Kernel panic when using pmcstat with aarch64 php binary

[tobil4sk]

When using pmcstat on an aarch64 build of PHP, there is a kernel panic when trying to collect information. cheribsd was built from source at commit 1f6f3ff.

PHP is built from this branch: https://github.com/tobil4sk/php-src/tree/feature/cheri-support, with the following configuration:

CC='cc -mabi=aapcs -fno-omit-frame-pointer' PKG_CONFIG_LIBDIR=/usr/local64/libdata/pkgconfig:/usr/lib64/pkgconfig ./configure --without-pcre-jit --prefix=/usr/local64 --with-iconv=/usr/local64 --host=aarch64-unknown-freebsd15.0

It occurred both when collecting information about branches and about stack traces.

sudo pmcstat -S br_mis_pred_retired -O profile.out sapi/cli/php Zend/bench.php

panic information

--- exception, esr 0xf2000000
kdb_enter() at kdb_enter+0x65
vpanic() at vpanic+0x1e5
panic() at panic+0x49
cap_abort() at cap_abort+0x259
handle_el1h_sync() at handle_el1h_sync+0x19
--- exception, esr 0x96000028
pmc_save_user_callchain() at pmc_save_user_callchain+0x15d
pmc_capture_user_callchain() at pmc_capture_user_callchain+0x17d
.LBB17_121() at .LBB17_121+0x55
handle_el0_irq() at handle_el0_irq+0x31

sudo pmcstat -S cpu_cycles,65536 -g -O stack_profile.out -- sapi/cli/php Zend/micro_bench.php

panic information

  x0: 0x0000000000000000
  x1: 0x000000008235ac18
  x2: 0x000000008235ac10
  x3: 0x0001000000000000
  x4: 0xffff0000461d3c00 [rwRW,0xffff0000461d3300-0xffff0000461d3c70] (_end + 0x44b903d0)
  x5: 0x0000000000000000
  x6: 0x0000000000000000
  x7: 0x0000000000000000
  x8: 0x000000008235ac18
  x9: 0xffff00008235ac17 (_end + 0x80d173e7)
 x10: 0xffff000000000ffe (text_start + 0xcae)
 x11: 0x0000000000007fe0
 x12: 0x0000000000007fe0
 x13: 0x0000000000000047
 x14: 0x0000000000001128
 x15: 0x0000000000000000
 x16: 0x0000000000000000
 x17: 0x0000000000000000
 x18: 0xffff00012e76e1f0 [rwxRW,0xffff00012e768000-0xffff00012e76f000]
 x19: 0x0000000000000001
 x20: 0xffff00017dca3800 [rwRW,0xffff00017dc80000-0xffff00017dd00000]
 x21: 0xffff00012e76e1f8 [rwxRW,0xffff00012e76e1f8-0xffff00012e76e200]
 x22: 0xffff00012e76e200 [rwxRW,0xffff00012e76e200-0xffff00012e76e210]
 x23: 0xffff00012e76e210 [rwxRW,0xffff00012e76e210-0xffff00012e76e220]
 x24: 0x000000007fffffff
 x25: 0x000000000000007f
 x26: 0xffff00000134b4dc [rwRW,0xffff00000134b4dc-0xffff00000134b4e0] (security_cheri_bound_legacy_capabilities + 0x0)
 x27: 0x0000000008000200
 x28: 0x0001000000000000
 x29: 0xffff00012e76e220 [rwxRW,0xffff00012e768000-0xffff00012e76f000]
 ddc: 0x0000000000000000 [rwRW,0x0000000000000000-0x0001000000000000]
  sp: 0xffff00012e76e1f0 [rwxRW,0xffff00012e768000-0xffff00012e76f000]
  lr: 0xffff00017f0b1c45 [rwxRW,0x0000000000000000-0xffffffffffffffff] (sentry) (pmc_capture_user_callchain + 0x181)
 elr: 0xffff00017f0b8de0 [rwxRW,0x0000000000000000-0xffffffffffffffff] (pmc_save_user_callchain + 0x15c)
spsr: 0x00000000244000c9
 far:               20
 esr:         96000028
panic: Capability abort from kernel space: tag violation
cpuid = 3
time = 1778678196
KDB: stack backtrace:
db_trace_self() at db_trace_self
db_trace_self_wrapper() at db_trace_self_wrapper+0x3d
vpanic() at vpanic+0x191
panic() at panic+0x49
cap_abort() at cap_abort+0x259
handle_el1h_sync() at handle_el1h_sync+0x19
--- exception, esr 0x96000028
pmc_save_user_callchain() at pmc_save_user_callchain+0x15d
pmc_capture_user_callchain() at pmc_capture_user_callchain+0x17d
.LBB17_121() at .LBB17_121+0x55
handle_el0_irq() at handle_el0_irq+0x31
--- interrupt
KDB: enter: panic
[ thread pid 85456 tid 100116 ]
Stopped at      kdb_enter+0x64: undefined       c200027f
2:26

db> bt
Tracing pid 85456 tid 100116 td 0xffff0000461d3300
db_trace_self() at db_trace_self
db_stack_trace() at db_stack_trace+0x131
db_command() at db_command+0x2ed
db_command_loop() at db_command_loop+0x85
db_trap() at db_trap+0x15d
kdb_trap() at kdb_trap+0x31d
handle_el1h_sync() at handle_el1h_sync+0x19
--- exception, esr 0xf2000000
kdb_enter() at kdb_enter+0x65
vpanic() at vpanic+0x1e5
panic() at panic+0x49
cap_abort() at cap_abort+0x259
handle_el1h_sync() at handle_el1h_sync+0x19
--- exception, esr 0x96000028
pmc_save_user_callchain() at pmc_save_user_callchain+0x15d
pmc_capture_user_callchain() at pmc_capture_user_callchain+0x17d
.LBB17_121() at .LBB17_121+0x55
handle_el0_irq() at handle_el0_irq+0x31
--- interrupt