Tighten checks in the x86 stack unwinder.

[markj]

Summary

With the 4/4 split on i386, INKERNEL is always true, and so we do no
validation of the first frame pointer. This pointer will be NULL for a
thread that has been created but was never scheduled, so procstat -kka
reliably panics on i386. Fix the problem by reordering some checks in
the unwind loop: ensure that each frame pointer, including the first,
lies within the bounds of the kernel stack.

[cem]

Thanks!

Prior to this change, we could also take a second trap if the traced code used %rbp for a kernel pointer other than a framepointer. E.g., we have some proprietary assembly libraries that (ab)use rbp in this way.

Would it be possible to impose similar stricter requirements on callpc in an inexpensive way? The difficulty is loadable modules, I guess.

[markj]

In D16572#460051, @cem wrote:

Thanks!

Prior to this change, we could also take a second trap if the traced code used %rbp for a kernel pointer other than a framepointer. E.g., we have some proprietary assembly libraries that (ab)use rbp in this way.

Would it be possible to impose similar stricter requirements on callpc in an inexpensive way? The difficulty is loadable modules, I guess.

On amd64 we require all kernel and module text to live in the last 2GB of KVA, so we could check that.