Index: sys/arm/include/pmc_mdep.h
===================================================================
--- sys/arm/include/pmc_mdep.h
+++ sys/arm/include/pmc_mdep.h
@@ -70,7 +70,9 @@
 /* Build a fake kernel trapframe from current instruction pointer. */
 #define PMC_FAKE_TRAPFRAME(TF)						\
 	do {								\
+	(TF)->tf_spsr = PSR_SVC32_MODE;					\
 	__asm __volatile("mov %0, pc" : "=r" ((TF)->tf_pc));		\
+	__asm __volatile("mov %0, r11" : "=r" ((TF)->tf_r11));		\
 	} while (0)
 
 /*
Index: sys/dev/hwpmc/hwpmc_arm.c
===================================================================
--- sys/dev/hwpmc/hwpmc_arm.c
+++ sys/dev/hwpmc/hwpmc_arm.c
@@ -72,6 +72,16 @@
 #endif
 }
 
+/* XXX handle runtime detection
+ */
+#ifdef __clang__
+#define PC_OFF 1
+#define FP_OFF 0
+#else
+#define PC_OFF -1
+#define FP_OFF -3
+#endif
+
 int
 pmc_save_kernel_callchain(uintptr_t *cc, int maxsamples,
     struct trapframe *tf)
@@ -100,7 +110,7 @@
 
 	for (count = 1; count < maxsamples; count++) {
 		/* Use saved lr as pc. */
-		r = fp - sizeof(uintptr_t);
+		r = fp + PC_OFF * sizeof(uintptr_t);
 		if (!PMC_IN_KERNEL_STACK(r, stackstart, stackend))
 			break;
 		pc = *(uintptr_t *)r;
@@ -110,7 +120,7 @@
 		*cc++ = pc;
 
 		/* Switch to next frame up */
-		r = fp - 3 * sizeof(uintptr_t);
+		r = fp + FP_OFF * sizeof(uintptr_t);
 		if (!PMC_IN_KERNEL_STACK(r, stackstart, stackend))
 			break;
 		fp = *(uintptr_t *)r;
@@ -147,7 +157,7 @@
 
 	for (count = 1; count < maxsamples; count++) {
 		/* Use saved lr as pc. */
-		r = fp - sizeof(uintptr_t);
+		r = fp + PC_OFF * sizeof(uintptr_t);
 		if (copyin((void *)r, &pc, sizeof(pc)) != 0)
 			break;
 		if (!PMC_IN_USERSPACE(pc))
@@ -157,7 +167,7 @@
 
 		/* Switch to next frame up */
 		oldfp = fp;
-		r = fp - 3 * sizeof(uintptr_t);
+		r = fp + FP_OFF * sizeof(uintptr_t);
 		if (copyin((void *)r, &fp, sizeof(fp)) != 0)
 			break;
 		if (fp < oldfp || !PMC_IN_USERSPACE(fp))