Calling a nonexistent non-XPLINK function

Figure 1 demonstrates the error of calling a nonexistent function. This routine was compiled with the compiler options LIST, OFFSET, and RENT and was run with the option TERMTHDACT(DUMP). The code was processed by the binder with MAP to generate a binder map, which is used to calculate the addresses of static and external variables. This routine was not compiled with the TEST(ALL) compiler option. As a result, arguments and variables do not appear in the dump.

Figure 1. C/C++example of calling a nonexistent subroutine
 #include <stdio.h>
 #include <stdlib.h>
 #include <errno.h>
 #include <signal.h>
 void funca(int* aa);
 int (*func_ptr)(void)=0;
 int main(void) {
   int aa;
   funca(&aa);
   printf("result of funca = %d\n",aa);
   return;
 }
 void funca(int* aa) {
   *aa = func_ptr();
   return;
 }

To debug this routine, use the following steps:

  1. Locate the Original Condition message in the Condition Information for Active Routines section of the dump, shown in Figure 2. In this example, the message is CEE3201S The system detected an operation exception (System Completion Code=0C1). This message suggests that the error was caused by an attempt to branch to an unknown address. For additional information about CEE3201S, see z/OS Language Environment Runtime Messages.

    The Location section of the dump indicates that the exception occurred at offset X'-20900978' within function funca and that there may have been a bad branch from offset X'+0000005A' within function funca. The negative offset indicates that the offset cannot be used to locate the instruction that caused the error. Another indication of bad data is the value of X'80000002' in the instruction address of the PSW. This address indicates that an instruction in the routine branched outside the bounds of the routine.

    Figure 2. Sections of the dump from example C routine (calling a nonexistent subroutine)
    CEE3DMP V1 R12.0: Condition processing resulted in the unhandled condition.         04/18/10 5:38:23 PM                  Page:    1  
    ASID: 0049   Job ID: JOB21060   Job name: EXIST      Step name: STEP1      UserID: HEALY                                            
                                                                                                                                        
    CEE3845I CEEDUMP Processing started.                                                                                                
                                                                                                                                        
    Information for enclave main                                                                                                        
                                                                                                                                        
      Information for thread 8000000000000000                                                                                           
                                                                                                                                        
      Traceback:                                                                                                                        
        DSA   Entry       E  Offset  Statement   Load Mod             Program Unit                   Service  Status                    
        1     CEEHDSP     +00004030              CEEPLPKA             CEEHDSP                        D1908    Call                      
        2     funca       -20900978              EXIST                                                        Exception                 
        3     main        +0000005C              EXIST                                                        Call                      
        4     EDCZMINV    +000000C2              CEEEV003                                                     Call                      
        5     CEEBBEXT    +000001B6              CEEPLPKA             CEEBBEXT                       D1908    Call                      
                                                                                                                                        
        DSA   DSA Addr   E  Addr    PU Addr    PU Offset  Comp Date  Compile Attributes                                                 
        1     20FCB350   209D2B08   209D2B08   +00004030  20061215   CEL                                                                
        2     20FCB2B0   20900978   20900978   -20900978  20070115   C/C++                                                              
        3     20FCB208   209008E0   209008E0   +0000005C  20070115   C/C++                                                              
        4     20FCB0F0   20E699EE   20E699EE   +000000C2  20061215   LIBRARY                                                            
        5     20FCB030   209A0AD8   209A0AD8   +000001B6  20061215   CEL                                                                
                                                                                                                                        
      Condition Information for Active Routines                                                                                         
        Condition Information for  (DSA address 20FCB2B0)                                                                               
          CIB Address: 20FCBC70                                                                                                         
          Current Condition:                                                                                                            
            CEE0198S The termination of a thread was signaled due to an unhandled condition.                                            
          Original Condition:                                                                                                           
            CEE3201S The system detected an operation exception (System Completion Code=0C1).                  
          Location:                                                                                                                     
            Program Unit:  Entry: funca Statement:  Offset: -20900978                                                                   
            Possible Bad Branch:  Statement:   Offset: +0000005A                                                                        
          Machine State:                                                                                                                
            ILC..... 0002    Interruption Code..... 0001                                                                                
            PSW..... 078D1400 80000002
            GPR0..... 00000000_20FCB350  GPR1..... 00000000_20FCB2A0  GPR2..... 00000000_20FCB2A0  GPR3..... 00000000_209009B2  
            GPR4..... 00000000_A09A0BBC  GPR5..... 00000000_20912648  GPR6..... 00000000_20900AA4  GPR7..... 00000000_20900098          
            GPR8..... 00000000_00000030  GPR9..... 00000000_80000000  GPR10.... 00000000_A0E699E2  GPR11.... 00000000_A09A0AD8          
            GPR12.... 00000000_209139B0  GPR13.... 00000000_20FCB2B0  GPR14.... 00000000_A09009D4  GPR15.... 00000000_00000000    
        Storage dump near condition, beginning at location: 00000000                                                                    
          +000000 00000000  Inaccessible storage.                                                                                       
        GPREG STORAGE:                                                                                                                  
          Storage around GPR0 (20FCB350)                                                                                                
         -0020 20FCB330  00000000 00000000 00000000 00000000  00000000 00000000 00000000 00000000  |................................|
         +0000 20FCB350  0808CEE1 20FCB2B0 20FCE470 A09D6B3A  A09EFFD8 20FCB350 20FCB7A8 20912648  |..........U...,....Q...&...y.j..|
    ⋮                                                                                                                                 
     Parameters, Registers, and Variables for Active Routines:                                                                         
        CEEHDSP (DSA address 20FCB350):                                                                                                 
          UPSTACK DSA                                                                                                                   
          Saved Registers:                                                                                                              
            GPR0..... 20FCB350  GPR1..... 20FCB7A8  GPR2..... 20912648  GPR3..... 00000080                                              
            GPR4..... 209D7734  GPR5..... A0915000  GPR6..... 2090C2A8  GPR7..... 20FCBC70                                              
            GPR8..... A09D665A  GPR9..... 20FCD34E  GPR10.... 20FCC34F  GPR11.... 209D2B08                                              
            GPR12.... 209139B0  GPR13.... 20FCB350  GPR14.... A09D6B3A  GPR15.... A09EFFD8                                              
    ⋮                                                                                                                                   
        funca (DSA address 20FCB2B0):                                                                                                   
          UPSTACK DSA                                                                                                                   
          Saved Registers:                                                                                                              
            GPR0..... 20FCB350  GPR1..... 20FCB2A0  GPR2..... 20FCB2A0  GPR3..... 209009B2                                              
            GPR4..... A09A0BBC  GPR5..... 20912648  GPR6..... 20900AA4  GPR7..... 20900098                                              
            GPR8..... 00000030  GPR9..... 80000000  GPR10.... A0E699E2  GPR11.... A09A0AD8                                              
            GPR12.... 209139B0  GPR13.... 20FCB2B0  GPR14.... A09009D4  GPR15.... 00000000                                              
    ⋮                          
  2. Find the branch instructions at offset X'+0000005A' of funca in the listing in Figure 3. The instruction is BASR r14,r15. This branch is part of the source statement *aa = func_ptr().
    Figure 3. Pseudo assembly listing (calling a nonexistent subroutine)
    OFFSET OBJECT CODE        LINE#  FILE#    P S E U D O   A S S E M B L Y   L I S T I N G 
                                                                                                                                        
                              000016 |       *  void funca(int* aa) {                                                                   
    000000                    000016 |        funca    DS       0D                                                                      
    .                                                                                                                                   
    .                                                                                                                                   
    .                                                                                                                                   
    000046  50D0  E004        000016 |                 ST       r13,4(,r14)                                                             
    00004A  18DE              000016 |                 LR       r13,r14                                                                 
    00004C                    End of Prolog                                                                                             
                                                                                                                                        
    00004C  58E0  C1F4        000000 |                 L        r14,_CEECAA_(,r12,500)                                                  
                              000017 |       *    *aa = func_ptr();                                                                     
    000050  58F0  303A        000017 |                 L        r15,=Q(func_ptr)(,r3,58)                                                
    000054  1821              000016 |                 LR       r2,r1                                                                   
    000056  58FF  E000        000017 |                 L        r15,func_ptr(r15,r14,0)                                                 
    00005A  0DEF              000017 |                 BASR     r14,r15                                                                 
    00005C  5810  2000        000017 |                 L        r1,aa(,r2,0)                                                            
    000060  50F0  1000        000017 |                 ST       r15,(*)int(,r1,0)                                                       
                              000018 |       *    return;                                                                               
                              000019 |       *  }                                                                                       
    000064                    000019 |        @2L3     DS       0H                                                                      
                                                                                                                                        
    000064                    Start of Epilog                                                                                           
    000064  58D0  D004        000019 |                 L        r13,4(,r13)                                                             
    000068  58E0  D00C        000019 |                 L        r14,12(,r13)                                                            
    00006C  9824  D01C        000019 |                 LM       r2,r4,28(r13)                                                           
    000070  051E              000019 |                 BALR     r1,r14                                                                  
    000072  0707              000019 |                 NOPR     7     
  3. Find the offset of func_ptr in the Writable Static Map, shown in Figure 4, as produced by the binder.
    Figure 4. Writable static map (calling a nonexistent subroutine)
    ⋮                                                                                                                                  
    ---------------                                                                                                                     
    CLASS  C_WSA             LENGTH =       A4  ATTRIBUTES = MRG, DEFER , RMODE=ANY                                                     
                             OFFSET =        0 IN SEGMENT 002       ALIGN = DBLWORD                                                     
    ---------------                                                                                                                     
                                                                                                                                        
                CLASS                                                                                                                   
               OFFSET  NAME                TYPE    LENGTH   SECTION                                                                     
                    0  func_ptr         PART             4  func_ptr                                                                    
                    8  environ          PART             4  environ                                                                     
                   10  errno            PART             4  errno                                                                       
                   18  tzname           PART             8  tzname                                                                      
    ⋮
  4. Add the offset of FUNC@PTR (X'0') to the address of WSA (X'20914F58'). The result ( X'20914F58') is the address of the function pointer func_ptr in the writable static storage area within the heap. This value is 0, indicating the variable is uninitialized. Figure 5 shows the sections of the dump.
    Figure 5. Enclave control blocks and storage sections in dump (calling a nonexistent subroutine)
    ⋮                                                                                                                                  
      Enclave Control Blocks:                                                                                                           
    ⋮                                                                                                                                  
        WSA address.................20914F58                                                                                            
                                                                                                                                        
      Enclave Storage:                                                                                                                  
    ⋮                                                                                                                                   
        WSA for Program Object(s)                                                                                                       
        WSA: 20914F58                                                                                                                   
          +000000 20914F58  00000000 00000000 2090A880 00000000  00000000 00000000 20910260 2091026A  |..........y..............j.-.j..|
          +000020 20914F78  00000000 00000000 00000000 00000000  00000000 00000000 00000001 00000000  |................................|
          +000040 20914F98  00000001 00000000 00000000 00000000  00000000 00000000 00000000 00000000  |................................|
          +000060 20914FB8  00000000 00000000 00000000 00000000  00000000 00000000 00000000 00000000  |................................|
          +000080 20914FD8  00000000 00000000 2090F6BC 00000000  2090F28C 00000000 2090F4A4 00000000  |..........6.......2.......4u....|
          +0000A0 20914FF8  00000000 00000000 A099FF10 A09C4A58  A09D0FD8 A09D7E98 A09D2B08 A09D9A78  |.........r.........Q..=q........|
    ⋮