Hello to all cpint user! / Hello Neale Ferguson!
I think I've discovered a bug in cpcmd.c
When running hcp in a Guest with 2GB hcp fails with a segmentation
violation. The same code runs very well if the guest just has 1GB.
Process hcp (pid: 1013, stackpage=0000000079039000)
Kernel PSW: 0700200180000000 0000000080abf846
task: 0000000079038000 ksp: 000000007903bd20 pt_regs: 000000007903bc40
Kernel GPRS:
0000000000000008 0000000000002000
000000007900ee00 000000007900c000
0000000060000008 0000000000001fff
ffffffffffffffea 0000000000000000
000000007900e000 000000007900ee00
00000000800041f0 000000007900ee00
000000007900c000 0000000080abfe00
0000000080abf6e0 000000007903bd20
Kernel ACRS:
00000000 00000000 00000000 00000000
00000001 00000000 00000000 00000000
00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000
Kernel BackChain CallChain
000000007903bd20 [<0000000080abf6e0>]
000000007903bde0 [<000000000014c67a>]
000000007903be80 [<0000000000101e3c>]
According to PSW 0700200180000000 0000000080abf846 and the
kernel-symbol-table
[root@linux6 root]# grep /proc/ksyms -e "0000000080abf"
0000000080abf4cc cpcmd_release [cpint]
0000000080abff00 cpint_fops [cpint]
0000000080abfef0 __insmod_cpint_S.data_L1488 [cpint]
0000000080abf0b8 cpint_open [cpint]
0000000080abf9c4 applmon_open [cpint]
0000000080abf0b8 __insmod_cpint_S.text_L3100 [cpint]
0000000080abfef8 cpint_major [cpint]
0000000080abf574 cpcmd_read [cpint]
0000000080abf320 cpcmd_open [cpint]
0000000080abfb38 applmon_release [cpint]
0000000080abf660 cpcmd_write [cpint]
0000000080abfcd4 __insmod_cpint_S.rodata_L444 [cpint]
0000000080abfba0 applmon_write [cpint]
0000000080abff90 cpcmd_fops [cpint]
0000000080abf000
__insmod_cpint_O/lib/modules/2.4.7/kernel/drivers/s390/char/cpint.o_M000000003C726031_V132103
[cpint]
0000000080abfefc cpint_nr_devs [cpint]
0000000080abf940 cpcmd_ioctl [cpint]
we are in cpcmd_write at offset 1E6
>From objdump: cpcmd_Write starts at cpint + 5a8
00000000000005a8 <cpcmd_write>:
5a8: eb 6f f0 30 00 24 stmg %r6,%r15,48(%r15)
and 5a8+1e6 = 78e, which means we just tried to execute sam31.
788: a7 5a ff ff ahi %r5,-1
78c: 01 0d sam31
78e: 83 24 00 08 diag %r2,%r4,8
792: 01 0e sam64
794: b2 22 00 90 ipm %r9
and now I don't know further. But I'think it's the location of the code
which isn't a 31Bit range (above 0x80000000).
Maybe someone of you has any idea. (I cannot compile a module for 31Bit, or
can I?).
Mit freundlichen Gruessen / best regards
Thomas Weinzettl
IBM Austria - Integrated Technology Services
