xref: /freebsd/lib/libprocstat/libprocstat.c (revision 10b59a9b4add0320d52c15ce057dd697261e7dfc)
1 /*-
2  * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
3  * Copyright (c) 1988, 1993
4  *      The Regents of the University of California.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *      This product includes software developed by the University of
17  *      California, Berkeley and its contributors.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #include <sys/param.h>
39 #include <sys/time.h>
40 #include <sys/proc.h>
41 #include <sys/user.h>
42 #include <sys/stat.h>
43 #include <sys/vnode.h>
44 #include <sys/socket.h>
45 #include <sys/socketvar.h>
46 #include <sys/domain.h>
47 #include <sys/protosw.h>
48 #include <sys/un.h>
49 #include <sys/unpcb.h>
50 #include <sys/sysctl.h>
51 #include <sys/tty.h>
52 #include <sys/filedesc.h>
53 #include <sys/queue.h>
54 #define	_WANT_FILE
55 #include <sys/file.h>
56 #include <sys/conf.h>
57 #define	_KERNEL
58 #include <sys/mount.h>
59 #include <sys/pipe.h>
60 #include <ufs/ufs/quota.h>
61 #include <ufs/ufs/inode.h>
62 #include <fs/devfs/devfs.h>
63 #include <fs/devfs/devfs_int.h>
64 #undef _KERNEL
65 #include <nfs/nfsproto.h>
66 #include <nfsclient/nfs.h>
67 #include <nfsclient/nfsnode.h>
68 
69 #include <vm/vm.h>
70 #include <vm/vm_map.h>
71 #include <vm/vm_object.h>
72 
73 #include <net/route.h>
74 #include <netinet/in.h>
75 #include <netinet/in_systm.h>
76 #include <netinet/ip.h>
77 #include <netinet/in_pcb.h>
78 
79 #include <assert.h>
80 #include <ctype.h>
81 #include <err.h>
82 #include <fcntl.h>
83 #include <kvm.h>
84 #include <libutil.h>
85 #include <limits.h>
86 #include <paths.h>
87 #include <pwd.h>
88 #include <stdio.h>
89 #include <stdlib.h>
90 #include <stddef.h>
91 #include <string.h>
92 #include <unistd.h>
93 #include <netdb.h>
94 
95 #include <libprocstat.h>
96 #include "libprocstat_internal.h"
97 #include "common_kvm.h"
98 
99 int     statfs(const char *, struct statfs *);	/* XXX */
100 
101 #define	PROCSTAT_KVM	1
102 #define	PROCSTAT_SYSCTL	2
103 
104 static char	*getmnton(kvm_t *kd, struct mount *m);
105 static struct filestat_list	*procstat_getfiles_kvm(
106     struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
107 static struct filestat_list	*procstat_getfiles_sysctl(
108     struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
109 static int	procstat_get_pipe_info_sysctl(struct filestat *fst,
110     struct pipestat *pipe, char *errbuf);
111 static int	procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
112     struct pipestat *pipe, char *errbuf);
113 static int	procstat_get_pts_info_sysctl(struct filestat *fst,
114     struct ptsstat *pts, char *errbuf);
115 static int	procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
116     struct ptsstat *pts, char *errbuf);
117 static int	procstat_get_socket_info_sysctl(struct filestat *fst,
118     struct sockstat *sock, char *errbuf);
119 static int	procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
120     struct sockstat *sock, char *errbuf);
121 static int	to_filestat_flags(int flags);
122 static int	procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
123     struct vnstat *vn, char *errbuf);
124 static int	procstat_get_vnode_info_sysctl(struct filestat *fst,
125     struct vnstat *vn, char *errbuf);
126 static int	vntype2psfsttype(int type);
127 
128 void
129 procstat_close(struct procstat *procstat)
130 {
131 
132 	assert(procstat);
133 	if (procstat->type == PROCSTAT_KVM)
134 		kvm_close(procstat->kd);
135 	free(procstat);
136 }
137 
138 struct procstat *
139 procstat_open_sysctl(void)
140 {
141 	struct procstat *procstat;
142 
143 	procstat = calloc(1, sizeof(*procstat));
144 	if (procstat == NULL) {
145 		warn("malloc()");
146 		return (NULL);
147 	}
148 	procstat->type = PROCSTAT_SYSCTL;
149 	return (procstat);
150 }
151 
152 struct procstat *
153 procstat_open_kvm(const char *nlistf, const char *memf)
154 {
155 	struct procstat *procstat;
156 	kvm_t *kd;
157 	char buf[_POSIX2_LINE_MAX];
158 
159 	procstat = calloc(1, sizeof(*procstat));
160 	if (procstat == NULL) {
161 		warn("malloc()");
162 		return (NULL);
163 	}
164 	kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf);
165 	if (kd == NULL) {
166 		warnx("kvm_openfiles(): %s", buf);
167 		free(procstat);
168 		return (NULL);
169 	}
170 	procstat->type = PROCSTAT_KVM;
171 	procstat->kd = kd;
172 	return (procstat);
173 }
174 
175 struct kinfo_proc *
176 procstat_getprocs(struct procstat *procstat, int what, int arg,
177     unsigned int *count)
178 {
179 	struct kinfo_proc *p0, *p;
180 	size_t len;
181 	int name[4];
182 	int error;
183 
184 	assert(procstat);
185 	assert(count);
186 	p = NULL;
187 	if (procstat->type == PROCSTAT_KVM) {
188 		p0 = kvm_getprocs(procstat->kd, what, arg, count);
189 		if (p0 == NULL || count == 0)
190 			return (NULL);
191 		len = *count * sizeof(*p);
192 		p = malloc(len);
193 		if (p == NULL) {
194 			warnx("malloc(%zu)", len);
195 			goto fail;
196 		}
197 		bcopy(p0, p, len);
198 		return (p);
199 	} else if (procstat->type == PROCSTAT_SYSCTL) {
200 		len = 0;
201 		name[0] = CTL_KERN;
202 		name[1] = KERN_PROC;
203 		name[2] = what;
204 		name[3] = arg;
205 		error = sysctl(name, 4, NULL, &len, NULL, 0);
206 		if (error < 0 && errno != EPERM) {
207 			warn("sysctl(kern.proc)");
208 			goto fail;
209 		}
210 		if (len == 0) {
211 			warnx("no processes?");
212 			goto fail;
213 		}
214 		p = malloc(len);
215 		if (p == NULL) {
216 			warnx("malloc(%zu)", len);
217 			goto fail;
218 		}
219 		error = sysctl(name, 4, p, &len, NULL, 0);
220 		if (error < 0 && errno != EPERM) {
221 			warn("sysctl(kern.proc)");
222 			goto fail;
223 		}
224 		/* Perform simple consistency checks. */
225 		if ((len % sizeof(*p)) != 0 || p->ki_structsize != sizeof(*p)) {
226 			warnx("kinfo_proc structure size mismatch");
227 			goto fail;
228 		}
229 		*count = len / sizeof(*p);
230 		return (p);
231 	} else {
232 		warnx("unknown access method: %d", procstat->type);
233 		return (NULL);
234 	}
235 fail:
236 	if (p)
237 		free(p);
238 	return (NULL);
239 }
240 
241 void
242 procstat_freeprocs(struct procstat *procstat __unused, struct kinfo_proc *p)
243 {
244 
245 	if (p != NULL)
246 		free(p);
247 	p = NULL;
248 }
249 
250 struct filestat_list *
251 procstat_getfiles(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
252 {
253 
254 	if (procstat->type == PROCSTAT_SYSCTL)
255 		return (procstat_getfiles_sysctl(procstat, kp, mmapped));
256 	else if (procstat->type == PROCSTAT_KVM)
257 		return (procstat_getfiles_kvm(procstat, kp, mmapped));
258 	else
259 		return (NULL);
260 }
261 
262 void
263 procstat_freefiles(struct procstat *procstat, struct filestat_list *head)
264 {
265 	struct filestat *fst, *tmp;
266 
267 	STAILQ_FOREACH_SAFE(fst, head, next, tmp) {
268 		if (fst->fs_path != NULL)
269 			free(fst->fs_path);
270 		free(fst);
271 	}
272 	free(head);
273 	if (procstat->vmentries != NULL) {
274 		free(procstat->vmentries);
275 		procstat->vmentries = NULL;
276 	}
277 	if (procstat->files != NULL) {
278 		free(procstat->files);
279 		procstat->files = NULL;
280 	}
281 }
282 
283 static struct filestat *
284 filestat_new_entry(void *typedep, int type, int fd, int fflags, int uflags,
285     int refcount, off_t offset, char *path, cap_rights_t cap_rights)
286 {
287 	struct filestat *entry;
288 
289 	entry = calloc(1, sizeof(*entry));
290 	if (entry == NULL) {
291 		warn("malloc()");
292 		return (NULL);
293 	}
294 	entry->fs_typedep = typedep;
295 	entry->fs_fflags = fflags;
296 	entry->fs_uflags = uflags;
297 	entry->fs_fd = fd;
298 	entry->fs_type = type;
299 	entry->fs_ref_count = refcount;
300 	entry->fs_offset = offset;
301 	entry->fs_path = path;
302 	entry->fs_cap_rights = cap_rights;
303 	return (entry);
304 }
305 
306 static struct vnode *
307 getctty(kvm_t *kd, struct kinfo_proc *kp)
308 {
309 	struct pgrp pgrp;
310 	struct proc proc;
311 	struct session sess;
312 	int error;
313 
314 	assert(kp);
315 	error = kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
316 	    sizeof(proc));
317 	if (error == 0) {
318 		warnx("can't read proc struct at %p for pid %d",
319 		    kp->ki_paddr, kp->ki_pid);
320 		return (NULL);
321 	}
322 	if (proc.p_pgrp == NULL)
323 		return (NULL);
324 	error = kvm_read_all(kd, (unsigned long)proc.p_pgrp, &pgrp,
325 	    sizeof(pgrp));
326 	if (error == 0) {
327 		warnx("can't read pgrp struct at %p for pid %d",
328 		    proc.p_pgrp, kp->ki_pid);
329 		return (NULL);
330 	}
331 	error = kvm_read_all(kd, (unsigned long)pgrp.pg_session, &sess,
332 	    sizeof(sess));
333 	if (error == 0) {
334 		warnx("can't read session struct at %p for pid %d",
335 		    pgrp.pg_session, kp->ki_pid);
336 		return (NULL);
337 	}
338 	return (sess.s_ttyvp);
339 }
340 
341 static struct filestat_list *
342 procstat_getfiles_kvm(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
343 {
344 	struct file file;
345 	struct filedesc filed;
346 	struct vm_map_entry vmentry;
347 	struct vm_object object;
348 	struct vmspace vmspace;
349 	vm_map_entry_t entryp;
350 	vm_map_t map;
351 	vm_object_t objp;
352 	struct vnode *vp;
353 	struct file **ofiles;
354 	struct filestat *entry;
355 	struct filestat_list *head;
356 	kvm_t *kd;
357 	void *data;
358 	int i, fflags;
359 	int prot, type;
360 	unsigned int nfiles;
361 
362 	assert(procstat);
363 	kd = procstat->kd;
364 	if (kd == NULL)
365 		return (NULL);
366 	if (kp->ki_fd == NULL)
367 		return (NULL);
368 	if (!kvm_read_all(kd, (unsigned long)kp->ki_fd, &filed,
369 	    sizeof(filed))) {
370 		warnx("can't read filedesc at %p", (void *)kp->ki_fd);
371 		return (NULL);
372 	}
373 
374 	/*
375 	 * Allocate list head.
376 	 */
377 	head = malloc(sizeof(*head));
378 	if (head == NULL)
379 		return (NULL);
380 	STAILQ_INIT(head);
381 
382 	/* root directory vnode, if one. */
383 	if (filed.fd_rdir) {
384 		entry = filestat_new_entry(filed.fd_rdir, PS_FST_TYPE_VNODE, -1,
385 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_RDIR, 0, 0, NULL, 0);
386 		if (entry != NULL)
387 			STAILQ_INSERT_TAIL(head, entry, next);
388 	}
389 	/* current working directory vnode. */
390 	if (filed.fd_cdir) {
391 		entry = filestat_new_entry(filed.fd_cdir, PS_FST_TYPE_VNODE, -1,
392 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_CDIR, 0, 0, NULL, 0);
393 		if (entry != NULL)
394 			STAILQ_INSERT_TAIL(head, entry, next);
395 	}
396 	/* jail root, if any. */
397 	if (filed.fd_jdir) {
398 		entry = filestat_new_entry(filed.fd_jdir, PS_FST_TYPE_VNODE, -1,
399 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_JAIL, 0, 0, NULL, 0);
400 		if (entry != NULL)
401 			STAILQ_INSERT_TAIL(head, entry, next);
402 	}
403 	/* ktrace vnode, if one */
404 	if (kp->ki_tracep) {
405 		entry = filestat_new_entry(kp->ki_tracep, PS_FST_TYPE_VNODE, -1,
406 		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
407 		    PS_FST_UFLAG_TRACE, 0, 0, NULL, 0);
408 		if (entry != NULL)
409 			STAILQ_INSERT_TAIL(head, entry, next);
410 	}
411 	/* text vnode, if one */
412 	if (kp->ki_textvp) {
413 		entry = filestat_new_entry(kp->ki_textvp, PS_FST_TYPE_VNODE, -1,
414 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_TEXT, 0, 0, NULL, 0);
415 		if (entry != NULL)
416 			STAILQ_INSERT_TAIL(head, entry, next);
417 	}
418 	/* Controlling terminal. */
419 	if ((vp = getctty(kd, kp)) != NULL) {
420 		entry = filestat_new_entry(vp, PS_FST_TYPE_VNODE, -1,
421 		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
422 		    PS_FST_UFLAG_CTTY, 0, 0, NULL, 0);
423 		if (entry != NULL)
424 			STAILQ_INSERT_TAIL(head, entry, next);
425 	}
426 
427 	nfiles = filed.fd_lastfile + 1;
428 	ofiles = malloc(nfiles * sizeof(struct file *));
429 	if (ofiles == NULL) {
430 		warn("malloc(%zu)", nfiles * sizeof(struct file *));
431 		goto do_mmapped;
432 	}
433 	if (!kvm_read_all(kd, (unsigned long)filed.fd_ofiles, ofiles,
434 	    nfiles * sizeof(struct file *))) {
435 		warnx("cannot read file structures at %p",
436 		    (void *)filed.fd_ofiles);
437 		free(ofiles);
438 		goto do_mmapped;
439 	}
440 	for (i = 0; i <= filed.fd_lastfile; i++) {
441 		if (ofiles[i] == NULL)
442 			continue;
443 		if (!kvm_read_all(kd, (unsigned long)ofiles[i], &file,
444 		    sizeof(struct file))) {
445 			warnx("can't read file %d at %p", i,
446 			    (void *)ofiles[i]);
447 			continue;
448 		}
449 		switch (file.f_type) {
450 		case DTYPE_VNODE:
451 			type = PS_FST_TYPE_VNODE;
452 			data = file.f_vnode;
453 			break;
454 		case DTYPE_SOCKET:
455 			type = PS_FST_TYPE_SOCKET;
456 			data = file.f_data;
457 			break;
458 		case DTYPE_PIPE:
459 			type = PS_FST_TYPE_PIPE;
460 			data = file.f_data;
461 			break;
462 		case DTYPE_FIFO:
463 			type = PS_FST_TYPE_FIFO;
464 			data = file.f_vnode;
465 			break;
466 #ifdef DTYPE_PTS
467 		case DTYPE_PTS:
468 			type = PS_FST_TYPE_PTS;
469 			data = file.f_data;
470 			break;
471 #endif
472 		default:
473 			continue;
474 		}
475 		/* XXXRW: No capability rights support for kvm yet. */
476 		entry = filestat_new_entry(data, type, i,
477 		    to_filestat_flags(file.f_flag), 0, 0, 0, NULL, 0);
478 		if (entry != NULL)
479 			STAILQ_INSERT_TAIL(head, entry, next);
480 	}
481 	free(ofiles);
482 
483 do_mmapped:
484 
485 	/*
486 	 * Process mmapped files if requested.
487 	 */
488 	if (mmapped) {
489 		if (!kvm_read_all(kd, (unsigned long)kp->ki_vmspace, &vmspace,
490 		    sizeof(vmspace))) {
491 			warnx("can't read vmspace at %p",
492 			    (void *)kp->ki_vmspace);
493 			goto exit;
494 		}
495 		map = &vmspace.vm_map;
496 
497 		for (entryp = map->header.next;
498 		    entryp != &kp->ki_vmspace->vm_map.header;
499 		    entryp = vmentry.next) {
500 			if (!kvm_read_all(kd, (unsigned long)entryp, &vmentry,
501 			    sizeof(vmentry))) {
502 				warnx("can't read vm_map_entry at %p",
503 				    (void *)entryp);
504 				continue;
505 			}
506 			if (vmentry.eflags & MAP_ENTRY_IS_SUB_MAP)
507 				continue;
508 			if ((objp = vmentry.object.vm_object) == NULL)
509 				continue;
510 			for (; objp; objp = object.backing_object) {
511 				if (!kvm_read_all(kd, (unsigned long)objp,
512 				    &object, sizeof(object))) {
513 					warnx("can't read vm_object at %p",
514 					    (void *)objp);
515 					break;
516 				}
517 			}
518 
519 			/* We want only vnode objects. */
520 			if (object.type != OBJT_VNODE)
521 				continue;
522 
523 			prot = vmentry.protection;
524 			fflags = 0;
525 			if (prot & VM_PROT_READ)
526 				fflags = PS_FST_FFLAG_READ;
527 			if ((vmentry.eflags & MAP_ENTRY_COW) == 0 &&
528 			    prot & VM_PROT_WRITE)
529 				fflags |= PS_FST_FFLAG_WRITE;
530 
531 			/*
532 			 * Create filestat entry.
533 			 */
534 			entry = filestat_new_entry(object.handle,
535 			    PS_FST_TYPE_VNODE, -1, fflags,
536 			    PS_FST_UFLAG_MMAP, 0, 0, NULL, 0);
537 			if (entry != NULL)
538 				STAILQ_INSERT_TAIL(head, entry, next);
539 		}
540 	}
541 exit:
542 	return (head);
543 }
544 
545 /*
546  * kinfo types to filestat translation.
547  */
548 static int
549 kinfo_type2fst(int kftype)
550 {
551 	static struct {
552 		int	kf_type;
553 		int	fst_type;
554 	} kftypes2fst[] = {
555 		{ KF_TYPE_CRYPTO, PS_FST_TYPE_CRYPTO },
556 		{ KF_TYPE_FIFO, PS_FST_TYPE_FIFO },
557 		{ KF_TYPE_KQUEUE, PS_FST_TYPE_KQUEUE },
558 		{ KF_TYPE_MQUEUE, PS_FST_TYPE_MQUEUE },
559 		{ KF_TYPE_NONE, PS_FST_TYPE_NONE },
560 		{ KF_TYPE_PIPE, PS_FST_TYPE_PIPE },
561 		{ KF_TYPE_PTS, PS_FST_TYPE_PTS },
562 		{ KF_TYPE_SEM, PS_FST_TYPE_SEM },
563 		{ KF_TYPE_SHM, PS_FST_TYPE_SHM },
564 		{ KF_TYPE_SOCKET, PS_FST_TYPE_SOCKET },
565 		{ KF_TYPE_VNODE, PS_FST_TYPE_VNODE },
566 		{ KF_TYPE_UNKNOWN, PS_FST_TYPE_UNKNOWN }
567 	};
568 #define NKFTYPES	(sizeof(kftypes2fst) / sizeof(*kftypes2fst))
569 	unsigned int i;
570 
571 	for (i = 0; i < NKFTYPES; i++)
572 		if (kftypes2fst[i].kf_type == kftype)
573 			break;
574 	if (i == NKFTYPES)
575 		return (PS_FST_TYPE_UNKNOWN);
576 	return (kftypes2fst[i].fst_type);
577 }
578 
579 /*
580  * kinfo flags to filestat translation.
581  */
582 static int
583 kinfo_fflags2fst(int kfflags)
584 {
585 	static struct {
586 		int	kf_flag;
587 		int	fst_flag;
588 	} kfflags2fst[] = {
589 		{ KF_FLAG_APPEND, PS_FST_FFLAG_APPEND },
590 		{ KF_FLAG_ASYNC, PS_FST_FFLAG_ASYNC },
591 		{ KF_FLAG_CAPABILITY, PS_FST_FFLAG_CAPABILITY },
592 		{ KF_FLAG_CREAT, PS_FST_FFLAG_CREAT },
593 		{ KF_FLAG_DIRECT, PS_FST_FFLAG_DIRECT },
594 		{ KF_FLAG_EXCL, PS_FST_FFLAG_EXCL },
595 		{ KF_FLAG_EXEC, PS_FST_FFLAG_EXEC },
596 		{ KF_FLAG_EXLOCK, PS_FST_FFLAG_EXLOCK },
597 		{ KF_FLAG_FSYNC, PS_FST_FFLAG_SYNC },
598 		{ KF_FLAG_HASLOCK, PS_FST_FFLAG_HASLOCK },
599 		{ KF_FLAG_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
600 		{ KF_FLAG_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
601 		{ KF_FLAG_READ, PS_FST_FFLAG_READ },
602 		{ KF_FLAG_SHLOCK, PS_FST_FFLAG_SHLOCK },
603 		{ KF_FLAG_TRUNC, PS_FST_FFLAG_TRUNC },
604 		{ KF_FLAG_WRITE, PS_FST_FFLAG_WRITE }
605 	};
606 #define NKFFLAGS	(sizeof(kfflags2fst) / sizeof(*kfflags2fst))
607 	unsigned int i;
608 	int flags;
609 
610 	flags = 0;
611 	for (i = 0; i < NKFFLAGS; i++)
612 		if ((kfflags & kfflags2fst[i].kf_flag) != 0)
613 			flags |= kfflags2fst[i].fst_flag;
614 	return (flags);
615 }
616 
617 static int
618 kinfo_uflags2fst(int fd)
619 {
620 
621 	switch (fd) {
622 	case KF_FD_TYPE_CTTY:
623 		return (PS_FST_UFLAG_CTTY);
624 	case KF_FD_TYPE_CWD:
625 		return (PS_FST_UFLAG_CDIR);
626 	case KF_FD_TYPE_JAIL:
627 		return (PS_FST_UFLAG_JAIL);
628 	case KF_FD_TYPE_TEXT:
629 		return (PS_FST_UFLAG_TEXT);
630 	case KF_FD_TYPE_TRACE:
631 		return (PS_FST_UFLAG_TRACE);
632 	case KF_FD_TYPE_ROOT:
633 		return (PS_FST_UFLAG_RDIR);
634 	}
635 	return (0);
636 }
637 
638 static struct filestat_list *
639 procstat_getfiles_sysctl(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
640 {
641 	struct kinfo_file *kif, *files;
642 	struct kinfo_vmentry *kve, *vmentries;
643 	struct filestat_list *head;
644 	struct filestat *entry;
645 	char *path;
646 	off_t offset;
647 	int cnt, fd, fflags;
648 	int i, type, uflags;
649 	int refcount;
650 	cap_rights_t cap_rights;
651 
652 	assert(kp);
653 	if (kp->ki_fd == NULL)
654 		return (NULL);
655 
656 	files = kinfo_getfile(kp->ki_pid, &cnt);
657 	if (files == NULL && errno != EPERM) {
658 		warn("kinfo_getfile()");
659 		return (NULL);
660 	}
661 	procstat->files = files;
662 
663 	/*
664 	 * Allocate list head.
665 	 */
666 	head = malloc(sizeof(*head));
667 	if (head == NULL)
668 		return (NULL);
669 	STAILQ_INIT(head);
670 	for (i = 0; i < cnt; i++) {
671 		kif = &files[i];
672 
673 		type = kinfo_type2fst(kif->kf_type);
674 		fd = kif->kf_fd >= 0 ? kif->kf_fd : -1;
675 		fflags = kinfo_fflags2fst(kif->kf_flags);
676 		uflags = kinfo_uflags2fst(kif->kf_fd);
677 		refcount = kif->kf_ref_count;
678 		offset = kif->kf_offset;
679 		if (*kif->kf_path != '\0')
680 			path = strdup(kif->kf_path);
681 		else
682 			path = NULL;
683 		cap_rights = kif->kf_cap_rights;
684 
685 		/*
686 		 * Create filestat entry.
687 		 */
688 		entry = filestat_new_entry(kif, type, fd, fflags, uflags,
689 		    refcount, offset, path, cap_rights);
690 		if (entry != NULL)
691 			STAILQ_INSERT_TAIL(head, entry, next);
692 	}
693 	if (mmapped != 0) {
694 		vmentries = kinfo_getvmmap(kp->ki_pid, &cnt);
695 		procstat->vmentries = vmentries;
696 		if (vmentries == NULL || cnt == 0)
697 			goto fail;
698 		for (i = 0; i < cnt; i++) {
699 			kve = &vmentries[i];
700 			if (kve->kve_type != KVME_TYPE_VNODE)
701 				continue;
702 			fflags = 0;
703 			if (kve->kve_protection & KVME_PROT_READ)
704 				fflags = PS_FST_FFLAG_READ;
705 			if ((kve->kve_flags & KVME_FLAG_COW) == 0 &&
706 			    kve->kve_protection & KVME_PROT_WRITE)
707 				fflags |= PS_FST_FFLAG_WRITE;
708 			offset = kve->kve_offset;
709 			refcount = kve->kve_ref_count;
710 			if (*kve->kve_path != '\0')
711 				path = strdup(kve->kve_path);
712 			else
713 				path = NULL;
714 			entry = filestat_new_entry(kve, PS_FST_TYPE_VNODE, -1,
715 			    fflags, PS_FST_UFLAG_MMAP, refcount, offset, path,
716 			    0);
717 			if (entry != NULL)
718 				STAILQ_INSERT_TAIL(head, entry, next);
719 		}
720 	}
721 fail:
722 	return (head);
723 }
724 
725 int
726 procstat_get_pipe_info(struct procstat *procstat, struct filestat *fst,
727     struct pipestat *ps, char *errbuf)
728 {
729 
730 	assert(ps);
731 	if (procstat->type == PROCSTAT_KVM) {
732 		return (procstat_get_pipe_info_kvm(procstat->kd, fst, ps,
733 		    errbuf));
734 	} else if (procstat->type == PROCSTAT_SYSCTL) {
735 		return (procstat_get_pipe_info_sysctl(fst, ps, errbuf));
736 	} else {
737 		warnx("unknown access method: %d", procstat->type);
738 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
739 		return (1);
740 	}
741 }
742 
743 static int
744 procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
745     struct pipestat *ps, char *errbuf)
746 {
747 	struct pipe pi;
748 	void *pipep;
749 
750 	assert(kd);
751 	assert(ps);
752 	assert(fst);
753 	bzero(ps, sizeof(*ps));
754 	pipep = fst->fs_typedep;
755 	if (pipep == NULL)
756 		goto fail;
757 	if (!kvm_read_all(kd, (unsigned long)pipep, &pi, sizeof(struct pipe))) {
758 		warnx("can't read pipe at %p", (void *)pipep);
759 		goto fail;
760 	}
761 	ps->addr = (uintptr_t)pipep;
762 	ps->peer = (uintptr_t)pi.pipe_peer;
763 	ps->buffer_cnt = pi.pipe_buffer.cnt;
764 	return (0);
765 
766 fail:
767 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
768 	return (1);
769 }
770 
771 static int
772 procstat_get_pipe_info_sysctl(struct filestat *fst, struct pipestat *ps,
773     char *errbuf __unused)
774 {
775 	struct kinfo_file *kif;
776 
777 	assert(ps);
778 	assert(fst);
779 	bzero(ps, sizeof(*ps));
780 	kif = fst->fs_typedep;
781 	if (kif == NULL)
782 		return (1);
783 	ps->addr = kif->kf_un.kf_pipe.kf_pipe_addr;
784 	ps->peer = kif->kf_un.kf_pipe.kf_pipe_peer;
785 	ps->buffer_cnt = kif->kf_un.kf_pipe.kf_pipe_buffer_cnt;
786 	return (0);
787 }
788 
789 int
790 procstat_get_pts_info(struct procstat *procstat, struct filestat *fst,
791     struct ptsstat *pts, char *errbuf)
792 {
793 
794 	assert(pts);
795 	if (procstat->type == PROCSTAT_KVM) {
796 		return (procstat_get_pts_info_kvm(procstat->kd, fst, pts,
797 		    errbuf));
798 	} else if (procstat->type == PROCSTAT_SYSCTL) {
799 		return (procstat_get_pts_info_sysctl(fst, pts, errbuf));
800 	} else {
801 		warnx("unknown access method: %d", procstat->type);
802 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
803 		return (1);
804 	}
805 }
806 
807 static int
808 procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
809     struct ptsstat *pts, char *errbuf)
810 {
811 	struct tty tty;
812 	void *ttyp;
813 
814 	assert(kd);
815 	assert(pts);
816 	assert(fst);
817 	bzero(pts, sizeof(*pts));
818 	ttyp = fst->fs_typedep;
819 	if (ttyp == NULL)
820 		goto fail;
821 	if (!kvm_read_all(kd, (unsigned long)ttyp, &tty, sizeof(struct tty))) {
822 		warnx("can't read tty at %p", (void *)ttyp);
823 		goto fail;
824 	}
825 	pts->dev = dev2udev(kd, tty.t_dev);
826 	(void)kdevtoname(kd, tty.t_dev, pts->devname);
827 	return (0);
828 
829 fail:
830 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
831 	return (1);
832 }
833 
834 static int
835 procstat_get_pts_info_sysctl(struct filestat *fst, struct ptsstat *pts,
836     char *errbuf __unused)
837 {
838 	struct kinfo_file *kif;
839 
840 	assert(pts);
841 	assert(fst);
842 	bzero(pts, sizeof(*pts));
843 	kif = fst->fs_typedep;
844 	if (kif == NULL)
845 		return (0);
846 	pts->dev = kif->kf_un.kf_pts.kf_pts_dev;
847 	strlcpy(pts->devname, kif->kf_path, sizeof(pts->devname));
848 	return (0);
849 }
850 
851 int
852 procstat_get_vnode_info(struct procstat *procstat, struct filestat *fst,
853     struct vnstat *vn, char *errbuf)
854 {
855 
856 	assert(vn);
857 	if (procstat->type == PROCSTAT_KVM) {
858 		return (procstat_get_vnode_info_kvm(procstat->kd, fst, vn,
859 		    errbuf));
860 	} else if (procstat->type == PROCSTAT_SYSCTL) {
861 		return (procstat_get_vnode_info_sysctl(fst, vn, errbuf));
862 	} else {
863 		warnx("unknown access method: %d", procstat->type);
864 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
865 		return (1);
866 	}
867 }
868 
869 static int
870 procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
871     struct vnstat *vn, char *errbuf)
872 {
873 	/* Filesystem specific handlers. */
874 	#define FSTYPE(fst)     {#fst, fst##_filestat}
875 	struct {
876 		const char	*tag;
877 		int		(*handler)(kvm_t *kd, struct vnode *vp,
878 		    struct vnstat *vn);
879 	} fstypes[] = {
880 		FSTYPE(devfs),
881 		FSTYPE(isofs),
882 		FSTYPE(msdosfs),
883 		FSTYPE(nfs),
884 		FSTYPE(ntfs),
885 #ifdef LIBPROCSTAT_NWFS
886 		FSTYPE(nwfs),
887 #endif
888 		FSTYPE(smbfs),
889 		FSTYPE(udf),
890 		FSTYPE(ufs),
891 #ifdef LIBPROCSTAT_ZFS
892 		FSTYPE(zfs),
893 #endif
894 	};
895 #define	NTYPES	(sizeof(fstypes) / sizeof(*fstypes))
896 	struct vnode vnode;
897 	char tagstr[12];
898 	void *vp;
899 	int error, found;
900 	unsigned int i;
901 
902 	assert(kd);
903 	assert(vn);
904 	assert(fst);
905 	vp = fst->fs_typedep;
906 	if (vp == NULL)
907 		goto fail;
908 	error = kvm_read_all(kd, (unsigned long)vp, &vnode, sizeof(vnode));
909 	if (error == 0) {
910 		warnx("can't read vnode at %p", (void *)vp);
911 		goto fail;
912 	}
913 	bzero(vn, sizeof(*vn));
914 	vn->vn_type = vntype2psfsttype(vnode.v_type);
915 	if (vnode.v_type == VNON || vnode.v_type == VBAD)
916 		return (0);
917 	error = kvm_read_all(kd, (unsigned long)vnode.v_tag, tagstr,
918 	    sizeof(tagstr));
919 	if (error == 0) {
920 		warnx("can't read v_tag at %p", (void *)vp);
921 		goto fail;
922 	}
923 	tagstr[sizeof(tagstr) - 1] = '\0';
924 
925 	/*
926 	 * Find appropriate handler.
927 	 */
928 	for (i = 0, found = 0; i < NTYPES; i++)
929 		if (!strcmp(fstypes[i].tag, tagstr)) {
930 			if (fstypes[i].handler(kd, &vnode, vn) != 0) {
931 				goto fail;
932 			}
933 			break;
934 		}
935 	if (i == NTYPES) {
936 		snprintf(errbuf, _POSIX2_LINE_MAX, "?(%s)", tagstr);
937 		return (1);
938 	}
939 	vn->vn_mntdir = getmnton(kd, vnode.v_mount);
940 	if ((vnode.v_type == VBLK || vnode.v_type == VCHR) &&
941 	    vnode.v_rdev != NULL){
942 		vn->vn_dev = dev2udev(kd, vnode.v_rdev);
943 		(void)kdevtoname(kd, vnode.v_rdev, vn->vn_devname);
944 	} else {
945 		vn->vn_dev = -1;
946 	}
947 	return (0);
948 
949 fail:
950 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
951 	return (1);
952 }
953 
954 /*
955  * kinfo vnode type to filestat translation.
956  */
957 static int
958 kinfo_vtype2fst(int kfvtype)
959 {
960 	static struct {
961 		int	kf_vtype;
962 		int	fst_vtype;
963 	} kfvtypes2fst[] = {
964 		{ KF_VTYPE_VBAD, PS_FST_VTYPE_VBAD },
965 		{ KF_VTYPE_VBLK, PS_FST_VTYPE_VBLK },
966 		{ KF_VTYPE_VCHR, PS_FST_VTYPE_VCHR },
967 		{ KF_VTYPE_VDIR, PS_FST_VTYPE_VDIR },
968 		{ KF_VTYPE_VFIFO, PS_FST_VTYPE_VFIFO },
969 		{ KF_VTYPE_VLNK, PS_FST_VTYPE_VLNK },
970 		{ KF_VTYPE_VNON, PS_FST_VTYPE_VNON },
971 		{ KF_VTYPE_VREG, PS_FST_VTYPE_VREG },
972 		{ KF_VTYPE_VSOCK, PS_FST_VTYPE_VSOCK }
973 	};
974 #define	NKFVTYPES	(sizeof(kfvtypes2fst) / sizeof(*kfvtypes2fst))
975 	unsigned int i;
976 
977 	for (i = 0; i < NKFVTYPES; i++)
978 		if (kfvtypes2fst[i].kf_vtype == kfvtype)
979 			break;
980 	if (i == NKFVTYPES)
981 		return (PS_FST_VTYPE_UNKNOWN);
982 	return (kfvtypes2fst[i].fst_vtype);
983 }
984 
985 static int
986 procstat_get_vnode_info_sysctl(struct filestat *fst, struct vnstat *vn,
987     char *errbuf)
988 {
989 	struct statfs stbuf;
990 	struct kinfo_file *kif;
991 	struct kinfo_vmentry *kve;
992 	uint64_t fileid;
993 	uint64_t size;
994 	char *name, *path;
995 	uint32_t fsid;
996 	uint16_t mode;
997 	uint32_t rdev;
998 	int vntype;
999 	int status;
1000 
1001 	assert(fst);
1002 	assert(vn);
1003 	bzero(vn, sizeof(*vn));
1004 	if (fst->fs_typedep == NULL)
1005 		return (1);
1006 	if (fst->fs_uflags & PS_FST_UFLAG_MMAP) {
1007 		kve = fst->fs_typedep;
1008 		fileid = kve->kve_vn_fileid;
1009 		fsid = kve->kve_vn_fsid;
1010 		mode = kve->kve_vn_mode;
1011 		path = kve->kve_path;
1012 		rdev = kve->kve_vn_rdev;
1013 		size = kve->kve_vn_size;
1014 		vntype = kinfo_vtype2fst(kve->kve_vn_type);
1015 		status = kve->kve_status;
1016 	} else {
1017 		kif = fst->fs_typedep;
1018 		fileid = kif->kf_un.kf_file.kf_file_fileid;
1019 		fsid = kif->kf_un.kf_file.kf_file_fsid;
1020 		mode = kif->kf_un.kf_file.kf_file_mode;
1021 		path = kif->kf_path;
1022 		rdev = kif->kf_un.kf_file.kf_file_rdev;
1023 		size = kif->kf_un.kf_file.kf_file_size;
1024 		vntype = kinfo_vtype2fst(kif->kf_vnode_type);
1025 		status = kif->kf_status;
1026 	}
1027 	vn->vn_type = vntype;
1028 	if (vntype == PS_FST_VTYPE_VNON || vntype == PS_FST_VTYPE_VBAD)
1029 		return (0);
1030 	if ((status & KF_ATTR_VALID) == 0) {
1031 		snprintf(errbuf, _POSIX2_LINE_MAX, "? (no info available)");
1032 		return (1);
1033 	}
1034 	if (path && *path) {
1035 		statfs(path, &stbuf);
1036 		vn->vn_mntdir = strdup(stbuf.f_mntonname);
1037 	} else
1038 		vn->vn_mntdir = strdup("-");
1039 	vn->vn_dev = rdev;
1040 	if (vntype == PS_FST_VTYPE_VBLK) {
1041 		name = devname(rdev, S_IFBLK);
1042 		if (name != NULL)
1043 			strlcpy(vn->vn_devname, name,
1044 			    sizeof(vn->vn_devname));
1045 	} else if (vntype == PS_FST_VTYPE_VCHR) {
1046 		name = devname(vn->vn_dev, S_IFCHR);
1047 		if (name != NULL)
1048 			strlcpy(vn->vn_devname, name,
1049 			    sizeof(vn->vn_devname));
1050 	}
1051 	vn->vn_fsid = fsid;
1052 	vn->vn_fileid = fileid;
1053 	vn->vn_size = size;
1054 	vn->vn_mode = mode;
1055 	return (0);
1056 }
1057 
1058 int
1059 procstat_get_socket_info(struct procstat *procstat, struct filestat *fst,
1060     struct sockstat *sock, char *errbuf)
1061 {
1062 
1063 	assert(sock);
1064 	if (procstat->type == PROCSTAT_KVM) {
1065 		return (procstat_get_socket_info_kvm(procstat->kd, fst, sock,
1066 		    errbuf));
1067 	} else if (procstat->type == PROCSTAT_SYSCTL) {
1068 		return (procstat_get_socket_info_sysctl(fst, sock, errbuf));
1069 	} else {
1070 		warnx("unknown access method: %d", procstat->type);
1071 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1072 		return (1);
1073 	}
1074 }
1075 
1076 static int
1077 procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
1078     struct sockstat *sock, char *errbuf)
1079 {
1080 	struct domain dom;
1081 	struct inpcb inpcb;
1082 	struct protosw proto;
1083 	struct socket s;
1084 	struct unpcb unpcb;
1085 	ssize_t len;
1086 	void *so;
1087 
1088 	assert(kd);
1089 	assert(sock);
1090 	assert(fst);
1091 	bzero(sock, sizeof(*sock));
1092 	so = fst->fs_typedep;
1093 	if (so == NULL)
1094 		goto fail;
1095 	sock->so_addr = (uintptr_t)so;
1096 	/* fill in socket */
1097 	if (!kvm_read_all(kd, (unsigned long)so, &s,
1098 	    sizeof(struct socket))) {
1099 		warnx("can't read sock at %p", (void *)so);
1100 		goto fail;
1101 	}
1102 	/* fill in protosw entry */
1103 	if (!kvm_read_all(kd, (unsigned long)s.so_proto, &proto,
1104 	    sizeof(struct protosw))) {
1105 		warnx("can't read protosw at %p", (void *)s.so_proto);
1106 		goto fail;
1107 	}
1108 	/* fill in domain */
1109 	if (!kvm_read_all(kd, (unsigned long)proto.pr_domain, &dom,
1110 	    sizeof(struct domain))) {
1111 		warnx("can't read domain at %p",
1112 		    (void *)proto.pr_domain);
1113 		goto fail;
1114 	}
1115 	if ((len = kvm_read(kd, (unsigned long)dom.dom_name, sock->dname,
1116 	    sizeof(sock->dname) - 1)) < 0) {
1117 		warnx("can't read domain name at %p", (void *)dom.dom_name);
1118 		sock->dname[0] = '\0';
1119 	}
1120 	else
1121 		sock->dname[len] = '\0';
1122 
1123 	/*
1124 	 * Fill in known data.
1125 	 */
1126 	sock->type = s.so_type;
1127 	sock->proto = proto.pr_protocol;
1128 	sock->dom_family = dom.dom_family;
1129 	sock->so_pcb = (uintptr_t)s.so_pcb;
1130 
1131 	/*
1132 	 * Protocol specific data.
1133 	 */
1134 	switch(dom.dom_family) {
1135 	case AF_INET:
1136 	case AF_INET6:
1137 		if (proto.pr_protocol == IPPROTO_TCP) {
1138 			if (s.so_pcb) {
1139 				if (kvm_read(kd, (u_long)s.so_pcb,
1140 				    (char *)&inpcb, sizeof(struct inpcb))
1141 				    != sizeof(struct inpcb)) {
1142 					warnx("can't read inpcb at %p",
1143 					    (void *)s.so_pcb);
1144 				} else
1145 					sock->inp_ppcb =
1146 					    (uintptr_t)inpcb.inp_ppcb;
1147 			}
1148 		}
1149 		break;
1150 	case AF_UNIX:
1151 		if (s.so_pcb) {
1152 			if (kvm_read(kd, (u_long)s.so_pcb, (char *)&unpcb,
1153 			    sizeof(struct unpcb)) != sizeof(struct unpcb)){
1154 				warnx("can't read unpcb at %p",
1155 				    (void *)s.so_pcb);
1156 			} else if (unpcb.unp_conn) {
1157 				sock->so_rcv_sb_state = s.so_rcv.sb_state;
1158 				sock->so_snd_sb_state = s.so_snd.sb_state;
1159 				sock->unp_conn = (uintptr_t)unpcb.unp_conn;
1160 			}
1161 		}
1162 		break;
1163 	default:
1164 		break;
1165 	}
1166 	return (0);
1167 
1168 fail:
1169 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1170 	return (1);
1171 }
1172 
1173 static int
1174 procstat_get_socket_info_sysctl(struct filestat *fst, struct sockstat *sock,
1175     char *errbuf __unused)
1176 {
1177 	struct kinfo_file *kif;
1178 
1179 	assert(sock);
1180 	assert(fst);
1181 	bzero(sock, sizeof(*sock));
1182 	kif = fst->fs_typedep;
1183 	if (kif == NULL)
1184 		return (0);
1185 
1186 	/*
1187 	 * Fill in known data.
1188 	 */
1189 	sock->type = kif->kf_sock_type;
1190 	sock->proto = kif->kf_sock_protocol;
1191 	sock->dom_family = kif->kf_sock_domain;
1192 	sock->so_pcb = kif->kf_un.kf_sock.kf_sock_pcb;
1193 	strlcpy(sock->dname, kif->kf_path, sizeof(sock->dname));
1194 	bcopy(&kif->kf_sa_local, &sock->sa_local, kif->kf_sa_local.ss_len);
1195 	bcopy(&kif->kf_sa_peer, &sock->sa_peer, kif->kf_sa_peer.ss_len);
1196 
1197 	/*
1198 	 * Protocol specific data.
1199 	 */
1200 	switch(sock->dom_family) {
1201 	case AF_INET:
1202 	case AF_INET6:
1203 		if (sock->proto == IPPROTO_TCP)
1204 			sock->inp_ppcb = kif->kf_un.kf_sock.kf_sock_inpcb;
1205 		break;
1206 	case AF_UNIX:
1207 		if (kif->kf_un.kf_sock.kf_sock_unpconn != 0) {
1208 				sock->so_rcv_sb_state =
1209 				    kif->kf_un.kf_sock.kf_sock_rcv_sb_state;
1210 				sock->so_snd_sb_state =
1211 				    kif->kf_un.kf_sock.kf_sock_snd_sb_state;
1212 				sock->unp_conn =
1213 				    kif->kf_un.kf_sock.kf_sock_unpconn;
1214 		}
1215 		break;
1216 	default:
1217 		break;
1218 	}
1219 	return (0);
1220 }
1221 
1222 /*
1223  * Descriptor flags to filestat translation.
1224  */
1225 static int
1226 to_filestat_flags(int flags)
1227 {
1228 	static struct {
1229 		int flag;
1230 		int fst_flag;
1231 	} fstflags[] = {
1232 		{ FREAD, PS_FST_FFLAG_READ },
1233 		{ FWRITE, PS_FST_FFLAG_WRITE },
1234 		{ O_APPEND, PS_FST_FFLAG_APPEND },
1235 		{ O_ASYNC, PS_FST_FFLAG_ASYNC },
1236 		{ O_CREAT, PS_FST_FFLAG_CREAT },
1237 		{ O_DIRECT, PS_FST_FFLAG_DIRECT },
1238 		{ O_EXCL, PS_FST_FFLAG_EXCL },
1239 		{ O_EXEC, PS_FST_FFLAG_EXEC },
1240 		{ O_EXLOCK, PS_FST_FFLAG_EXLOCK },
1241 		{ O_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
1242 		{ O_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
1243 		{ O_SHLOCK, PS_FST_FFLAG_SHLOCK },
1244 		{ O_SYNC, PS_FST_FFLAG_SYNC },
1245 		{ O_TRUNC, PS_FST_FFLAG_TRUNC }
1246 	};
1247 #define NFSTFLAGS	(sizeof(fstflags) / sizeof(*fstflags))
1248 	int fst_flags;
1249 	unsigned int i;
1250 
1251 	fst_flags = 0;
1252 	for (i = 0; i < NFSTFLAGS; i++)
1253 		if (flags & fstflags[i].flag)
1254 			fst_flags |= fstflags[i].fst_flag;
1255 	return (fst_flags);
1256 }
1257 
1258 /*
1259  * Vnode type to filestate translation.
1260  */
1261 static int
1262 vntype2psfsttype(int type)
1263 {
1264 	static struct {
1265 		int	vtype;
1266 		int	fst_vtype;
1267 	} vt2fst[] = {
1268 		{ VBAD, PS_FST_VTYPE_VBAD },
1269 		{ VBLK, PS_FST_VTYPE_VBLK },
1270 		{ VCHR, PS_FST_VTYPE_VCHR },
1271 		{ VDIR, PS_FST_VTYPE_VDIR },
1272 		{ VFIFO, PS_FST_VTYPE_VFIFO },
1273 		{ VLNK, PS_FST_VTYPE_VLNK },
1274 		{ VNON, PS_FST_VTYPE_VNON },
1275 		{ VREG, PS_FST_VTYPE_VREG },
1276 		{ VSOCK, PS_FST_VTYPE_VSOCK }
1277 	};
1278 #define	NVFTYPES	(sizeof(vt2fst) / sizeof(*vt2fst))
1279 	unsigned int i, fst_type;
1280 
1281 	fst_type = PS_FST_VTYPE_UNKNOWN;
1282 	for (i = 0; i < NVFTYPES; i++) {
1283 		if (type == vt2fst[i].vtype) {
1284 			fst_type = vt2fst[i].fst_vtype;
1285 			break;
1286 		}
1287 	}
1288 	return (fst_type);
1289 }
1290 
1291 static char *
1292 getmnton(kvm_t *kd, struct mount *m)
1293 {
1294 	struct mount mnt;
1295 	static struct mtab {
1296 		struct mtab *next;
1297 		struct mount *m;
1298 		char mntonname[MNAMELEN + 1];
1299 	} *mhead = NULL;
1300 	struct mtab *mt;
1301 
1302 	for (mt = mhead; mt != NULL; mt = mt->next)
1303 		if (m == mt->m)
1304 			return (mt->mntonname);
1305 	if (!kvm_read_all(kd, (unsigned long)m, &mnt, sizeof(struct mount))) {
1306 		warnx("can't read mount table at %p", (void *)m);
1307 		return (NULL);
1308 	}
1309 	if ((mt = malloc(sizeof (struct mtab))) == NULL)
1310 		err(1, NULL);
1311 	mt->m = m;
1312 	bcopy(&mnt.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
1313 	mt->mntonname[MNAMELEN] = '\0';
1314 	mt->next = mhead;
1315 	mhead = mt;
1316 	return (mt->mntonname);
1317 }
1318