Re: [Crash-utility] Crash-utility Digest, Vol 179, Issue 9

Send Crash-utility mailing list submissions to crash-utility(a)redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/crash-utility or, via email, send a message with subject or body 'help' to crash-utility-request(a)redhat.com You can reach the person managing the list at crash-utility-owner(a)redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of Crash-utility digest..." Today's Topics: 1. Re: Crash-utility Digest, Vol 178, Issue 21 (lijiang) 2. Re: Crash-utility Digest, Vol 178, Issue 21 (Mathias Krause) 3. Re: Crash-utility Digest, Vol 178, Issue 21 (lijiang) ---------------------------------------------------------------------- Message: 1 Date: Tue, 11 Aug 2020 10:08:22 +0800 From: lijiang <lijiang(a)redhat.com&gt; To: crash-utility(a)redhat.com Subject: Re: [Crash-utility] Crash-utility Digest, Vol 178, Issue 21 Message-ID: <c712820b-2b84-bfbe-935a-6f5ab4e10c79(a)redhat.com&gt; Content-Type: text/plain; charset=utf-8 ? 2020?07?31? 00:00, crash-utility-request(a)redhat.com ??: > Message: 1 > Date: Thu, 30 Jul 2020 15:34:59 +0200 > From: Mathias Krause <minipli(a)grsecurity.net&gt; > To: crash-utility(a)redhat.com > Subject: [Crash-utility] [PATCH RESEND] Basic support for PaX's split > module layout > Message-ID: <20200730133459.7868-1-minipli(a)grsecurity.net&gt; > Content-Type: text/plain; charset=US-ASCII > > PaX and grsecurity kernels split module memory into dedicated r/x and > r/w mappings using '*_rw' and '*_rx' named member variables in 'struct > module'. To add basic support for such kernels detect the split layout > by testing for the corresponding structure members and use these > instead. > > So far we limit ourself to only track module code mappings for such > kernels as adding support for separate data mappings violates lots of > invariants in the rest of our code base, thereby would require a major > rework. However, with that patch applied, module code references can be > resolved in backtraces, memory and code dumps, which makes it already > very useful for analyzing such kernels. > > Signed-off-by: Mathias Krause <minipli(a)grsecurity.net&gt; > --- > Resend as the original posting got stuck in the mail queue. > > defs.h | 13 +++++++++++ > kernel.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++---- > symbols.c | 20 ++++++++-------- > 3 files changed, 86 insertions(+), 15 deletions(-) > > diff --git a/defs.h b/defs.h > index d7adb23b86d5..160974ed554a 100644 > --- a/defs.h > +++ b/defs.h > @@ -654,12 +654,15 @@ struct new_utsname { > #define TIMER_BASES (0x20ULL) > #define IRQ_DESC_TREE_RADIX (0x40ULL) > #define IRQ_DESC_TREE_XARRAY (0x80ULL) > +#define KMOD_PAX (0x100ULL) > > #define XEN() (kt->flags & ARCH_XEN) > #define OPENVZ() (kt->flags & ARCH_OPENVZ) > #define PVOPS() (kt->flags & ARCH_PVOPS) > #define PVOPS_XEN() (kt->flags & ARCH_PVOPS_XEN) > > +#define PAX_MODULE_SPLIT() (kt->flags2 & KMOD_PAX) > + > #define XEN_MACHINE_TO_MFN(m) ((ulonglong)(m) >> PAGESHIFT()) > #define XEN_PFN_TO_PSEUDO(p) ((ulonglong)(p) << PAGESHIFT()) > > @@ -1346,7 +1349,11 @@ struct offset_table { /* stash of commonly-used offsets */ > long module_gpl_syms; > long module_num_gpl_syms; > long module_module_core; > + long module_module_core_rw; > + long module_module_core_rx; > long module_core_size; > + long module_core_size_rw; > + long module_core_size_rx; > long module_core_text_size; > long module_num_symtab; > long module_symtab; > @@ -1776,6 +1783,8 @@ struct offset_table { /* stash of commonly-used offsets */ > long mm_struct_rss_stat; > long mm_rss_stat_count; > long module_module_init; > + long module_module_init_rw; > + long module_module_init_rx; > long module_init_text_size; > long cpu_context_save_fp; > long cpu_context_save_sp; > @@ -1793,6 +1802,8 @@ struct offset_table { /* stash of commonly-used offsets */ > long unwind_idx_insn; > long signal_struct_nr_threads; > long module_init_size; > + long module_init_size_rw; > + long module_init_size_rx; > long module_percpu; > long radix_tree_node_slots; > long s390_stack_frame_back_chain; > @@ -2313,6 +2324,8 @@ struct array_table { > * in the offset table, size table or array_table. > */

> #define OFFSET(X) (OFFSET_verify(offset_table.X, (char *)__FUNCTION__, __FILE__, __LINE__, #X)) > +#define MODULE_OFFSET(X,Y) (PAX_MODULE_SPLIT() ? OFFSET(Y) : OFFSET(X)) > +#define MODULE_OFFSET2(X,T) MODULE_OFFSET(X, X##_##T) The above definition has a code style issue(space required after that ','), but we could correct it when this patch is applied. Otherwise, it looks good to me. Acked-by: Lianbo Jiang <lijiang(a)redhat.com&gt; Thanks. Lianbo > #define SIZE(X) (SIZE_verify(size_table.X, (char *)__FUNCTION__, __FILE__, __LINE__, #X)) > #define INVALID_OFFSET (-1) > #define INVALID_MEMBER(X) (offset_table.X == INVALID_OFFSET) > diff --git a/kernel.c b/kernel.c > index 5ed602108b87..c2b8e0a04a26 100644 > --- a/kernel.c > +++ b/kernel.c > @@ -3540,6 +3540,62 @@ module_init(void) > "module_core"); > MEMBER_OFFSET_INIT(module_module_init, "module", > "module_init"); > + } else if (MEMBER_EXISTS("module", "module_core_rx")) { > + if (CRASHDEBUG(1)) > + error(INFO, "PaX module layout detected.\n"); > + kt->flags2 |= KMOD_PAX; > + > + MEMBER_OFFSET_INIT(module_core_size_rw, "module", > + "core_size_rw"); > + MEMBER_OFFSET_INIT(module_core_size_rx, "module", > + "core_size_rx"); > + > + MEMBER_OFFSET_INIT(module_init_size_rw, "module", > + "init_size_rw"); > + MEMBER_OFFSET_INIT(module_init_size_rx, "module", > + "init_size_rx"); > + > + MEMBER_OFFSET_INIT(module_module_core_rw, "module", > + "module_core_rw"); > + MEMBER_OFFSET_INIT(module_module_core_rx, "module", > + "module_core_rx"); > + > + MEMBER_OFFSET_INIT(module_module_init_rw, "module", > + "module_init_rw"); > + MEMBER_OFFSET_INIT(module_module_init_rx, "module", > + "module_init_rx"); > + } else if (MEMBER_EXISTS("module_layout", "base_rx")) { > + if (CRASHDEBUG(1)) > + error(INFO, "PaX module layout detected.\n"); > + kt->flags2 |= KMOD_PAX; > + > + ASSIGN_OFFSET(module_core_size_rw) = > + MEMBER_OFFSET("module", "core_layout") + > + MEMBER_OFFSET("module_layout", "size_rw"); > + ASSIGN_OFFSET(module_core_size_rx) = > + MEMBER_OFFSET("module", "core_layout") + > + MEMBER_OFFSET("module_layout", "size_rx"); > + > + ASSIGN_OFFSET(module_init_size_rw) = > + MEMBER_OFFSET("module", "init_layout") + > + MEMBER_OFFSET("module_layout", "size_rw"); > + ASSIGN_OFFSET(module_init_size_rx) = > + MEMBER_OFFSET("module", "init_layout") + > + MEMBER_OFFSET("module_layout", "size_rx"); > + > + ASSIGN_OFFSET(module_module_core_rw) = > + MEMBER_OFFSET("module", "core_layout") + > + MEMBER_OFFSET("module_layout", "base_rw"); > + ASSIGN_OFFSET(module_module_core_rx) = > + MEMBER_OFFSET("module", "core_layout") + > + MEMBER_OFFSET("module_layout", "base_rx"); > + > + ASSIGN_OFFSET(module_module_init_rw) = > + MEMBER_OFFSET("module", "init_layout") + > + MEMBER_OFFSET("module_layout", "base_rw"); > + ASSIGN_OFFSET(module_module_init_rx) = > + MEMBER_OFFSET("module", "init_layout") + > + MEMBER_OFFSET("module_layout", "base_rx"); > } else { > ASSIGN_OFFSET(module_core_size) = > MEMBER_OFFSET("module", "core_layout") + > @@ -3682,10 +3738,10 @@ module_init(void) > case KALLSYMS_V2: > if (THIS_KERNEL_VERSION >= LINUX(2,6,27)) { > numksyms = UINT(modbuf + OFFSET(module_num_symtab)); > - size = UINT(modbuf + OFFSET(module_core_size)); > + size = UINT(modbuf + MODULE_OFFSET2(module_core_size, rx)); > } else { > numksyms = ULONG(modbuf + OFFSET(module_num_symtab)); > - size = ULONG(modbuf + OFFSET(module_core_size)); > + size = ULONG(modbuf + MODULE_OFFSET2(module_core_size, rx)); > } > > if (!size) { > @@ -3792,7 +3848,7 @@ verify_modules(void) > break; > case KMOD_V2: > mod_base = ULONG(modbuf + > - OFFSET(module_module_core)); > + MODULE_OFFSET2(module_module_core, rx)); > break; > } > > @@ -3816,10 +3872,10 @@ verify_modules(void) > OFFSET(module_name); > if (THIS_KERNEL_VERSION >= LINUX(2,6,27)) > mod_size = UINT(modbuf + > - OFFSET(module_core_size)); > + MODULE_OFFSET2(module_core_size, rx)); > else > mod_size = ULONG(modbuf + > - OFFSET(module_core_size)); > + MODULE_OFFSET2(module_core_size, rx)); > if (strlen(module_name) < MAX_MOD_NAME) > strcpy(buf, module_name); > else > @@ -5989,6 +6045,8 @@ dump_kernel_table(int verbose) > fprintf(fp, "%sIRQ_DESC_TREE_RADIX", others++ ? "|" : ""); > if (kt->flags2 & IRQ_DESC_TREE_XARRAY) > fprintf(fp, "%sIRQ_DESC_TREE_XARRAY", others++ ? "|" : ""); > + if (kt->flags2 & KMOD_PAX) > + fprintf(fp, "%sKMOD_PAX", others++ ? "|" : ""); > fprintf(fp, ")\n"); > > fprintf(fp, " stext: %lx\n", kt->stext); > diff --git a/symbols.c b/symbols.c > index 3b1f08af43ff..be672fcaefd9 100644 > --- a/symbols.c > +++ b/symbols.c > @@ -1766,17 +1766,17 @@ store_module_symbols_v2(ulong total, int mods_installed) > > if (THIS_KERNEL_VERSION >= LINUX(2,6,27)) { > nksyms = UINT(modbuf + OFFSET(module_num_symtab)); > - size = UINT(modbuf + OFFSET(module_core_size)); > + size = UINT(modbuf + MODULE_OFFSET2(module_core_size, rx)); > } else { > nksyms = ULONG(modbuf + OFFSET(module_num_symtab)); > - size = ULONG(modbuf + OFFSET(module_core_size)); > + size = ULONG(modbuf + MODULE_OFFSET2(module_core_size, rx)); > } > > mod_name = modbuf + OFFSET(module_name); > > lm = &st->load_modules[m++]; > BZERO(lm, sizeof(struct load_module)); > - lm->mod_base = ULONG(modbuf + OFFSET(module_module_core)); > + lm->mod_base = ULONG(modbuf + MODULE_OFFSET2(module_module_core, rx)); > lm->module_struct = mod; > lm->mod_size = size; > if (strlen(mod_name) < MAX_MOD_NAME) > @@ -1795,23 +1795,23 @@ store_module_symbols_v2(ulong total, int mods_installed) > lm->mod_flags = MOD_EXT_SYMS; > lm->mod_ext_symcnt = mcnt; > lm->mod_init_module_ptr = ULONG(modbuf + > - OFFSET(module_module_init)); > + MODULE_OFFSET2(module_module_init, rx)); > if (VALID_MEMBER(module_percpu)) > lm->mod_percpu = ULONG(modbuf + OFFSET(module_percpu)); > if (THIS_KERNEL_VERSION >= LINUX(2,6,27)) { > lm->mod_etext_guess = lm->mod_base + > - UINT(modbuf + OFFSET(module_core_text_size)); > + UINT(modbuf + MODULE_OFFSET(module_core_text_size, module_core_size_rx)); > lm->mod_init_size = > - UINT(modbuf + OFFSET(module_init_size)); > + UINT(modbuf + MODULE_OFFSET2(module_init_size, rx)); > lm->mod_init_text_size = > - UINT(modbuf + OFFSET(module_init_text_size)); > + UINT(modbuf + MODULE_OFFSET(module_init_text_size, module_init_size_rx)); > } else { > lm->mod_etext_guess = lm->mod_base + > - ULONG(modbuf + OFFSET(module_core_text_size)); > + ULONG(modbuf + MODULE_OFFSET(module_core_text_size, module_core_size_rx)); > lm->mod_init_size = > - ULONG(modbuf + OFFSET(module_init_size)); > + ULONG(modbuf + MODULE_OFFSET2(module_init_size, rx)); > lm->mod_init_text_size = > - ULONG(modbuf + OFFSET(module_init_text_size)); > + ULONG(modbuf + MODULE_OFFSET(module_init_text_size, module_init_size_rx)); > } > lm->mod_text_start = lm->mod_base; > > -- 2.20.1 ------------------------------ Message: 2 Date: Tue, 11 Aug 2020 10:23:14 +0200 From: Mathias Krause <minipli(a)grsecurity.net&gt; To: lijiang <lijiang(a)redhat.com&gt; Cc: crash-utility(a)redhat.com Subject: Re: [Crash-utility] Crash-utility Digest, Vol 178, Issue 21 Message-ID: <d0c9b41e-379b-58cc-c457-e06b59eae9af(a)grsecurity.net&gt; Content-Type: text/plain; charset=utf-8 Hi Lianbo, Am 11.08.20 um 04:08 schrieb lijiang: > ? 2020?07?31? 00:00, crash-utility-request(a)redhat.com ??: >> Message: 1 >> Date: Thu, 30 Jul 2020 15:34:59 +0200 >> From: Mathias Krause <minipli(a)grsecurity.net&gt; >> To: crash-utility(a)redhat.com >> Subject: [Crash-utility] [PATCH RESEND] Basic support for PaX's split >> module layout >> Message-ID: <20200730133459.7868-1-minipli(a)grsecurity.net&gt; >> Content-Type: text/plain; charset=US-ASCII >> >> PaX and grsecurity kernels split module memory into dedicated r/x and >> r/w mappings using '*_rw' and '*_rx' named member variables in 'struct >> module'. To add basic support for such kernels detect the split layout >> by testing for the corresponding structure members and use these >> instead. >> >> So far we limit ourself to only track module code mappings for such >> kernels as adding support for separate data mappings violates lots of >> invariants in the rest of our code base, thereby would require a major >> rework. However, with that patch applied, module code references can be >> resolved in backtraces, memory and code dumps, which makes it already >> very useful for analyzing such kernels. >> >> Signed-off-by: Mathias Krause <minipli(a)grsecurity.net&gt; >> --- >> Resend as the original posting got stuck in the mail queue. >> >> defs.h | 13 +++++++++++ >> kernel.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++---- >> symbols.c | 20 ++++++++-------- >> 3 files changed, 86 insertions(+), 15 deletions(-) >> >> diff --git a/defs.h b/defs.h >> index d7adb23b86d5..160974ed554a 100644 >> --- a/defs.h >> +++ b/defs.h >> @@ -654,12 +654,15 @@ struct new_utsname { >> #define TIMER_BASES (0x20ULL) >> #define IRQ_DESC_TREE_RADIX (0x40ULL) >> #define IRQ_DESC_TREE_XARRAY (0x80ULL) >> +#define KMOD_PAX (0x100ULL) >> >> #define XEN() (kt->flags & ARCH_XEN) >> #define OPENVZ() (kt->flags & ARCH_OPENVZ) >> #define PVOPS() (kt->flags & ARCH_PVOPS) >> #define PVOPS_XEN() (kt->flags & ARCH_PVOPS_XEN) >> >> +#define PAX_MODULE_SPLIT() (kt->flags2 & KMOD_PAX) >> + >> #define XEN_MACHINE_TO_MFN(m) ((ulonglong)(m) >> PAGESHIFT()) >> #define XEN_PFN_TO_PSEUDO(p) ((ulonglong)(p) << PAGESHIFT()) >> >> @@ -1346,7 +1349,11 @@ struct offset_table { /* stash of commonly-used offsets */ >> long module_gpl_syms; >> long module_num_gpl_syms; >> long module_module_core; >> + long module_module_core_rw; >> + long module_module_core_rx; >> long module_core_size; >> + long module_core_size_rw; >> + long module_core_size_rx; >> long module_core_text_size; >> long module_num_symtab; >> long module_symtab; >> @@ -1776,6 +1783,8 @@ struct offset_table { /* stash of commonly-used offsets */ >> long mm_struct_rss_stat; >> long mm_rss_stat_count; >> long module_module_init; >> + long module_module_init_rw; >> + long module_module_init_rx; >> long module_init_text_size; >> long cpu_context_save_fp; >> long cpu_context_save_sp; >> @@ -1793,6 +1802,8 @@ struct offset_table { /* stash of commonly-used offsets */ >> long unwind_idx_insn; >> long signal_struct_nr_threads; >> long module_init_size; >> + long module_init_size_rw; >> + long module_init_size_rx; >> long module_percpu; >> long radix_tree_node_slots; >> long s390_stack_frame_back_chain; >> @@ -2313,6 +2324,8 @@ struct array_table { >> * in the offset table, size table or array_table. >> */ >> #define OFFSET(X) (OFFSET_verify(offset_table.X, (char *)__FUNCTION__, __FILE__, __LINE__, #X)) >> +#define MODULE_OFFSET(X,Y) (PAX_MODULE_SPLIT() ? OFFSET(Y) : OFFSET(X)) >> +#define MODULE_OFFSET2(X,T) MODULE_OFFSET(X, X##_##T) > The above definition has a code style issue(space required after that ','), but we could correct > it when this patch is applied. I just wanted to stick with the coding style nearby, like with MEMBER_OFFSET(), MEMBER_EXISTS(), MEMBER_SIZE(), etc. all have no space between the arguments. But I've no strong opinion about it. Feel free to adapt. > > Otherwise, it looks good to me. > Acked-by: Lianbo Jiang <lijiang(a)redhat.com&gt; Thanks for the review! Mathias > > Thanks. > Lianbo > >> [...] ------------------------------ Message: 3 Date: Tue, 11 Aug 2020 16:55:42 +0800 From: lijiang <lijiang(a)redhat.com&gt; To: Mathias Krause <minipli(a)grsecurity.net&gt; Cc: crash-utility(a)redhat.com Subject: Re: [Crash-utility] Crash-utility Digest, Vol 178, Issue 21 Message-ID: <87316ee3-adf9-7126-1ce6-5276a363bc4a(a)redhat.com&gt; Content-Type: text/plain; charset=utf-8 ? 2020?08?11? 16:23, Mathias Krause ??: > Hi Lianbo, > > Am 11.08.20 um 04:08 schrieb lijiang: >> ? 2020?07?31? 00:00, crash-utility-request(a)redhat.com ??: >>> Message: 1 >>> Date: Thu, 30 Jul 2020 15:34:59 +0200 >>> From: Mathias Krause <minipli(a)grsecurity.net&gt; >>> To: crash-utility(a)redhat.com >>> Subject: [Crash-utility] [PATCH RESEND] Basic support for PaX's split >>> module layout >>> Message-ID: <20200730133459.7868-1-minipli(a)grsecurity.net&gt; >>> Content-Type: text/plain; charset=US-ASCII >>> >>> PaX and grsecurity kernels split module memory into dedicated r/x and >>> r/w mappings using '*_rw' and '*_rx' named member variables in 'struct >>> module'. To add basic support for such kernels detect the split layout >>> by testing for the corresponding structure members and use these >>> instead. >>> >>> So far we limit ourself to only track module code mappings for such >>> kernels as adding support for separate data mappings violates lots of >>> invariants in the rest of our code base, thereby would require a major >>> rework. However, with that patch applied, module code references can be >>> resolved in backtraces, memory and code dumps, which makes it already >>> very useful for analyzing such kernels. >>> >>> Signed-off-by: Mathias Krause <minipli(a)grsecurity.net&gt; >>> --- >>> Resend as the original posting got stuck in the mail queue. >>> >>> defs.h | 13 +++++++++++ >>> kernel.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++---- >>> symbols.c | 20 ++++++++-------- >>> 3 files changed, 86 insertions(+), 15 deletions(-) >>> >>> diff --git a/defs.h b/defs.h >>> index d7adb23b86d5..160974ed554a 100644 >>> --- a/defs.h >>> +++ b/defs.h >>> @@ -654,12 +654,15 @@ struct new_utsname { >>> #define TIMER_BASES (0x20ULL) >>> #define IRQ_DESC_TREE_RADIX (0x40ULL) >>> #define IRQ_DESC_TREE_XARRAY (0x80ULL) >>> +#define KMOD_PAX (0x100ULL) >>> >>> #define XEN() (kt->flags & ARCH_XEN) >>> #define OPENVZ() (kt->flags & ARCH_OPENVZ) >>> #define PVOPS() (kt->flags & ARCH_PVOPS) >>> #define PVOPS_XEN() (kt->flags & ARCH_PVOPS_XEN) >>> >>> +#define PAX_MODULE_SPLIT() (kt->flags2 & KMOD_PAX) >>> + >>> #define XEN_MACHINE_TO_MFN(m) ((ulonglong)(m) >> PAGESHIFT()) >>> #define XEN_PFN_TO_PSEUDO(p) ((ulonglong)(p) << PAGESHIFT()) >>> >>> @@ -1346,7 +1349,11 @@ struct offset_table { /* stash of commonly-used offsets */ >>> long module_gpl_syms; >>> long module_num_gpl_syms; >>> long module_module_core; >>> + long module_module_core_rw; >>> + long module_module_core_rx; >>> long module_core_size; >>> + long module_core_size_rw; >>> + long module_core_size_rx; >>> long module_core_text_size; >>> long module_num_symtab; >>> long module_symtab; >>> @@ -1776,6 +1783,8 @@ struct offset_table { /* stash of commonly-used offsets */ >>> long mm_struct_rss_stat; >>> long mm_rss_stat_count; >>> long module_module_init; >>> + long module_module_init_rw; >>> + long module_module_init_rx; >>> long module_init_text_size; >>> long cpu_context_save_fp; >>> long cpu_context_save_sp; >>> @@ -1793,6 +1802,8 @@ struct offset_table { /* stash of commonly-used offsets */ >>> long unwind_idx_insn; >>> long signal_struct_nr_threads; >>> long module_init_size; >>> + long module_init_size_rw; >>> + long module_init_size_rx; >>> long module_percpu; >>> long radix_tree_node_slots; >>> long s390_stack_frame_back_chain; >>> @@ -2313,6 +2324,8 @@ struct array_table { >>> * in the offset table, size table or array_table. >>> */ >>> #define OFFSET(X) (OFFSET_verify(offset_table.X, (char *)__FUNCTION__, __FILE__, __LINE__, #X)) >>> +#define MODULE_OFFSET(X,Y) (PAX_MODULE_SPLIT() ? OFFSET(Y) : OFFSET(X)) >>> +#define MODULE_OFFSET2(X,T) MODULE_OFFSET(X, X##_##T) >> The above definition has a code style issue(space required after that ','), but we could correct >> it when this patch is applied. > > I just wanted to stick with the coding style nearby, like with > MEMBER_OFFSET(), MEMBER_EXISTS(), MEMBER_SIZE(), etc. all have no space That's true. > between the arguments. But I've no strong opinion about it. Feel free to > adapt. > No worry. :-) Thanks. Lianbo >> >> Otherwise, it looks good to me. >> Acked-by: Lianbo Jiang <lijiang(a)redhat.com&gt; > > Thanks for the review! > > Mathias > >> >> Thanks. >> Lianbo >> >>> [...] > ------------------------------ -- Crash-utility mailing list Crash-utility(a)redhat.com https://www.redhat.com/mailman/listinfo/crash-utility End of Crash-utility Digest, Vol 179, Issue 9 *********************************************