xref: /freebsd/lib/libprocstat/libprocstat.c (revision 1d17434b643c38bbd153694d8a84798b68282c0d)
1 /*-
2  * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
3  * Copyright (c) 1988, 1993
4  *      The Regents of the University of California.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *      This product includes software developed by the University of
17  *      California, Berkeley and its contributors.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #include <sys/param.h>
39 #include <sys/elf.h>
40 #include <sys/time.h>
41 #include <sys/resourcevar.h>
42 #define	_WANT_UCRED
43 #include <sys/ucred.h>
44 #undef _WANT_UCRED
45 #include <sys/proc.h>
46 #include <sys/user.h>
47 #include <sys/stat.h>
48 #include <sys/vnode.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/domain.h>
52 #include <sys/protosw.h>
53 #include <sys/un.h>
54 #include <sys/unpcb.h>
55 #include <sys/sysctl.h>
56 #include <sys/tty.h>
57 #include <sys/filedesc.h>
58 #include <sys/queue.h>
59 #define	_WANT_FILE
60 #include <sys/file.h>
61 #include <sys/conf.h>
62 #include <sys/ksem.h>
63 #include <sys/mman.h>
64 #define	_KERNEL
65 #include <sys/mount.h>
66 #include <sys/pipe.h>
67 #include <ufs/ufs/quota.h>
68 #include <ufs/ufs/inode.h>
69 #include <fs/devfs/devfs.h>
70 #include <fs/devfs/devfs_int.h>
71 #undef _KERNEL
72 #include <nfs/nfsproto.h>
73 #include <nfsclient/nfs.h>
74 #include <nfsclient/nfsnode.h>
75 
76 #include <vm/vm.h>
77 #include <vm/vm_map.h>
78 #include <vm/vm_object.h>
79 
80 #include <net/route.h>
81 #include <netinet/in.h>
82 #include <netinet/in_systm.h>
83 #include <netinet/ip.h>
84 #include <netinet/in_pcb.h>
85 
86 #include <assert.h>
87 #include <ctype.h>
88 #include <err.h>
89 #include <fcntl.h>
90 #include <kvm.h>
91 #include <libutil.h>
92 #include <limits.h>
93 #include <paths.h>
94 #include <pwd.h>
95 #include <stdio.h>
96 #include <stdlib.h>
97 #include <stddef.h>
98 #include <string.h>
99 #include <unistd.h>
100 #include <netdb.h>
101 
102 #include <libprocstat.h>
103 #include "libprocstat_internal.h"
104 #include "common_kvm.h"
105 #include "core.h"
106 
107 int     statfs(const char *, struct statfs *);	/* XXX */
108 
109 #define	PROCSTAT_KVM	1
110 #define	PROCSTAT_SYSCTL	2
111 #define	PROCSTAT_CORE	3
112 
113 static char	**getargv(struct procstat *procstat, struct kinfo_proc *kp,
114     size_t nchr, int env);
115 static char	*getmnton(kvm_t *kd, struct mount *m);
116 static struct kinfo_vmentry *	kinfo_getvmmap_core(struct procstat_core *core,
117     int *cntp);
118 static Elf_Auxinfo	*procstat_getauxv_core(struct procstat_core *core,
119     unsigned int *cntp);
120 static Elf_Auxinfo	*procstat_getauxv_sysctl(pid_t pid, unsigned int *cntp);
121 static struct filestat_list	*procstat_getfiles_kvm(
122     struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
123 static struct filestat_list	*procstat_getfiles_sysctl(
124     struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
125 static int	procstat_get_pipe_info_sysctl(struct filestat *fst,
126     struct pipestat *pipe, char *errbuf);
127 static int	procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
128     struct pipestat *pipe, char *errbuf);
129 static int	procstat_get_pts_info_sysctl(struct filestat *fst,
130     struct ptsstat *pts, char *errbuf);
131 static int	procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
132     struct ptsstat *pts, char *errbuf);
133 static int	procstat_get_sem_info_sysctl(struct filestat *fst,
134     struct semstat *sem, char *errbuf);
135 static int	procstat_get_sem_info_kvm(kvm_t *kd, struct filestat *fst,
136     struct semstat *sem, char *errbuf);
137 static int	procstat_get_shm_info_sysctl(struct filestat *fst,
138     struct shmstat *shm, char *errbuf);
139 static int	procstat_get_shm_info_kvm(kvm_t *kd, struct filestat *fst,
140     struct shmstat *shm, char *errbuf);
141 static int	procstat_get_socket_info_sysctl(struct filestat *fst,
142     struct sockstat *sock, char *errbuf);
143 static int	procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
144     struct sockstat *sock, char *errbuf);
145 static int	to_filestat_flags(int flags);
146 static int	procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
147     struct vnstat *vn, char *errbuf);
148 static int	procstat_get_vnode_info_sysctl(struct filestat *fst,
149     struct vnstat *vn, char *errbuf);
150 static gid_t	*procstat_getgroups_core(struct procstat_core *core,
151     unsigned int *count);
152 static gid_t *	procstat_getgroups_kvm(kvm_t *kd, struct kinfo_proc *kp,
153     unsigned int *count);
154 static gid_t	*procstat_getgroups_sysctl(pid_t pid, unsigned int *count);
155 static struct kinfo_kstack	*procstat_getkstack_sysctl(pid_t pid,
156     int *cntp);
157 static int	procstat_getosrel_core(struct procstat_core *core,
158     int *osrelp);
159 static int	procstat_getosrel_kvm(kvm_t *kd, struct kinfo_proc *kp,
160     int *osrelp);
161 static int	procstat_getosrel_sysctl(pid_t pid, int *osrelp);
162 static int	procstat_getpathname_core(struct procstat_core *core,
163     char *pathname, size_t maxlen);
164 static int	procstat_getpathname_sysctl(pid_t pid, char *pathname,
165     size_t maxlen);
166 static int	procstat_getrlimit_core(struct procstat_core *core, int which,
167     struct rlimit* rlimit);
168 static int	procstat_getrlimit_kvm(kvm_t *kd, struct kinfo_proc *kp,
169     int which, struct rlimit* rlimit);
170 static int	procstat_getrlimit_sysctl(pid_t pid, int which,
171     struct rlimit* rlimit);
172 static int	procstat_getumask_core(struct procstat_core *core,
173     unsigned short *maskp);
174 static int	procstat_getumask_kvm(kvm_t *kd, struct kinfo_proc *kp,
175     unsigned short *maskp);
176 static int	procstat_getumask_sysctl(pid_t pid, unsigned short *maskp);
177 static int	vntype2psfsttype(int type);
178 
179 void
180 procstat_close(struct procstat *procstat)
181 {
182 
183 	assert(procstat);
184 	if (procstat->type == PROCSTAT_KVM)
185 		kvm_close(procstat->kd);
186 	else if (procstat->type == PROCSTAT_CORE)
187 		procstat_core_close(procstat->core);
188 	procstat_freeargv(procstat);
189 	procstat_freeenvv(procstat);
190 	free(procstat);
191 }
192 
193 struct procstat *
194 procstat_open_sysctl(void)
195 {
196 	struct procstat *procstat;
197 
198 	procstat = calloc(1, sizeof(*procstat));
199 	if (procstat == NULL) {
200 		warn("malloc()");
201 		return (NULL);
202 	}
203 	procstat->type = PROCSTAT_SYSCTL;
204 	return (procstat);
205 }
206 
207 struct procstat *
208 procstat_open_kvm(const char *nlistf, const char *memf)
209 {
210 	struct procstat *procstat;
211 	kvm_t *kd;
212 	char buf[_POSIX2_LINE_MAX];
213 
214 	procstat = calloc(1, sizeof(*procstat));
215 	if (procstat == NULL) {
216 		warn("malloc()");
217 		return (NULL);
218 	}
219 	kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf);
220 	if (kd == NULL) {
221 		warnx("kvm_openfiles(): %s", buf);
222 		free(procstat);
223 		return (NULL);
224 	}
225 	procstat->type = PROCSTAT_KVM;
226 	procstat->kd = kd;
227 	return (procstat);
228 }
229 
230 struct procstat *
231 procstat_open_core(const char *filename)
232 {
233 	struct procstat *procstat;
234 	struct procstat_core *core;
235 
236 	procstat = calloc(1, sizeof(*procstat));
237 	if (procstat == NULL) {
238 		warn("malloc()");
239 		return (NULL);
240 	}
241 	core = procstat_core_open(filename);
242 	if (core == NULL) {
243 		free(procstat);
244 		return (NULL);
245 	}
246 	procstat->type = PROCSTAT_CORE;
247 	procstat->core = core;
248 	return (procstat);
249 }
250 
251 struct kinfo_proc *
252 procstat_getprocs(struct procstat *procstat, int what, int arg,
253     unsigned int *count)
254 {
255 	struct kinfo_proc *p0, *p;
256 	size_t len;
257 	int name[4];
258 	int cnt;
259 	int error;
260 
261 	assert(procstat);
262 	assert(count);
263 	p = NULL;
264 	if (procstat->type == PROCSTAT_KVM) {
265 		*count = 0;
266 		p0 = kvm_getprocs(procstat->kd, what, arg, &cnt);
267 		if (p0 == NULL || cnt <= 0)
268 			return (NULL);
269 		*count = cnt;
270 		len = *count * sizeof(*p);
271 		p = malloc(len);
272 		if (p == NULL) {
273 			warnx("malloc(%zu)", len);
274 			goto fail;
275 		}
276 		bcopy(p0, p, len);
277 		return (p);
278 	} else if (procstat->type == PROCSTAT_SYSCTL) {
279 		len = 0;
280 		name[0] = CTL_KERN;
281 		name[1] = KERN_PROC;
282 		name[2] = what;
283 		name[3] = arg;
284 		error = sysctl(name, 4, NULL, &len, NULL, 0);
285 		if (error < 0 && errno != EPERM) {
286 			warn("sysctl(kern.proc)");
287 			goto fail;
288 		}
289 		if (len == 0) {
290 			warnx("no processes?");
291 			goto fail;
292 		}
293 		p = malloc(len);
294 		if (p == NULL) {
295 			warnx("malloc(%zu)", len);
296 			goto fail;
297 		}
298 		error = sysctl(name, 4, p, &len, NULL, 0);
299 		if (error < 0 && errno != EPERM) {
300 			warn("sysctl(kern.proc)");
301 			goto fail;
302 		}
303 		/* Perform simple consistency checks. */
304 		if ((len % sizeof(*p)) != 0 || p->ki_structsize != sizeof(*p)) {
305 			warnx("kinfo_proc structure size mismatch (len = %zu)", len);
306 			goto fail;
307 		}
308 		*count = len / sizeof(*p);
309 		return (p);
310 	} else if (procstat->type == PROCSTAT_CORE) {
311 		p = procstat_core_get(procstat->core, PSC_TYPE_PROC, NULL,
312 		    &len);
313 		if ((len % sizeof(*p)) != 0 || p->ki_structsize != sizeof(*p)) {
314 			warnx("kinfo_proc structure size mismatch");
315 			goto fail;
316 		}
317 		*count = len / sizeof(*p);
318 		return (p);
319 	} else {
320 		warnx("unknown access method: %d", procstat->type);
321 		return (NULL);
322 	}
323 fail:
324 	if (p)
325 		free(p);
326 	return (NULL);
327 }
328 
329 void
330 procstat_freeprocs(struct procstat *procstat __unused, struct kinfo_proc *p)
331 {
332 
333 	if (p != NULL)
334 		free(p);
335 	p = NULL;
336 }
337 
338 struct filestat_list *
339 procstat_getfiles(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
340 {
341 
342 	switch(procstat->type) {
343 	case PROCSTAT_KVM:
344 		return (procstat_getfiles_kvm(procstat, kp, mmapped));
345 	case PROCSTAT_SYSCTL:
346 	case PROCSTAT_CORE:
347 		return (procstat_getfiles_sysctl(procstat, kp, mmapped));
348 	default:
349 		warnx("unknown access method: %d", procstat->type);
350 		return (NULL);
351 	}
352 }
353 
354 void
355 procstat_freefiles(struct procstat *procstat, struct filestat_list *head)
356 {
357 	struct filestat *fst, *tmp;
358 
359 	STAILQ_FOREACH_SAFE(fst, head, next, tmp) {
360 		if (fst->fs_path != NULL)
361 			free(fst->fs_path);
362 		free(fst);
363 	}
364 	free(head);
365 	if (procstat->vmentries != NULL) {
366 		free(procstat->vmentries);
367 		procstat->vmentries = NULL;
368 	}
369 	if (procstat->files != NULL) {
370 		free(procstat->files);
371 		procstat->files = NULL;
372 	}
373 }
374 
375 static struct filestat *
376 filestat_new_entry(void *typedep, int type, int fd, int fflags, int uflags,
377     int refcount, off_t offset, char *path, cap_rights_t cap_rights)
378 {
379 	struct filestat *entry;
380 
381 	entry = calloc(1, sizeof(*entry));
382 	if (entry == NULL) {
383 		warn("malloc()");
384 		return (NULL);
385 	}
386 	entry->fs_typedep = typedep;
387 	entry->fs_fflags = fflags;
388 	entry->fs_uflags = uflags;
389 	entry->fs_fd = fd;
390 	entry->fs_type = type;
391 	entry->fs_ref_count = refcount;
392 	entry->fs_offset = offset;
393 	entry->fs_path = path;
394 	entry->fs_cap_rights = cap_rights;
395 	return (entry);
396 }
397 
398 static struct vnode *
399 getctty(kvm_t *kd, struct kinfo_proc *kp)
400 {
401 	struct pgrp pgrp;
402 	struct proc proc;
403 	struct session sess;
404 	int error;
405 
406 	assert(kp);
407 	error = kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
408 	    sizeof(proc));
409 	if (error == 0) {
410 		warnx("can't read proc struct at %p for pid %d",
411 		    kp->ki_paddr, kp->ki_pid);
412 		return (NULL);
413 	}
414 	if (proc.p_pgrp == NULL)
415 		return (NULL);
416 	error = kvm_read_all(kd, (unsigned long)proc.p_pgrp, &pgrp,
417 	    sizeof(pgrp));
418 	if (error == 0) {
419 		warnx("can't read pgrp struct at %p for pid %d",
420 		    proc.p_pgrp, kp->ki_pid);
421 		return (NULL);
422 	}
423 	error = kvm_read_all(kd, (unsigned long)pgrp.pg_session, &sess,
424 	    sizeof(sess));
425 	if (error == 0) {
426 		warnx("can't read session struct at %p for pid %d",
427 		    pgrp.pg_session, kp->ki_pid);
428 		return (NULL);
429 	}
430 	return (sess.s_ttyvp);
431 }
432 
433 static struct filestat_list *
434 procstat_getfiles_kvm(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
435 {
436 	struct file file;
437 	struct filedesc filed;
438 	struct vm_map_entry vmentry;
439 	struct vm_object object;
440 	struct vmspace vmspace;
441 	vm_map_entry_t entryp;
442 	vm_map_t map;
443 	vm_object_t objp;
444 	struct vnode *vp;
445 	struct file **ofiles;
446 	struct filestat *entry;
447 	struct filestat_list *head;
448 	kvm_t *kd;
449 	void *data;
450 	int i, fflags;
451 	int prot, type;
452 	unsigned int nfiles;
453 
454 	assert(procstat);
455 	kd = procstat->kd;
456 	if (kd == NULL)
457 		return (NULL);
458 	if (kp->ki_fd == NULL)
459 		return (NULL);
460 	if (!kvm_read_all(kd, (unsigned long)kp->ki_fd, &filed,
461 	    sizeof(filed))) {
462 		warnx("can't read filedesc at %p", (void *)kp->ki_fd);
463 		return (NULL);
464 	}
465 
466 	/*
467 	 * Allocate list head.
468 	 */
469 	head = malloc(sizeof(*head));
470 	if (head == NULL)
471 		return (NULL);
472 	STAILQ_INIT(head);
473 
474 	/* root directory vnode, if one. */
475 	if (filed.fd_rdir) {
476 		entry = filestat_new_entry(filed.fd_rdir, PS_FST_TYPE_VNODE, -1,
477 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_RDIR, 0, 0, NULL, 0);
478 		if (entry != NULL)
479 			STAILQ_INSERT_TAIL(head, entry, next);
480 	}
481 	/* current working directory vnode. */
482 	if (filed.fd_cdir) {
483 		entry = filestat_new_entry(filed.fd_cdir, PS_FST_TYPE_VNODE, -1,
484 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_CDIR, 0, 0, NULL, 0);
485 		if (entry != NULL)
486 			STAILQ_INSERT_TAIL(head, entry, next);
487 	}
488 	/* jail root, if any. */
489 	if (filed.fd_jdir) {
490 		entry = filestat_new_entry(filed.fd_jdir, PS_FST_TYPE_VNODE, -1,
491 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_JAIL, 0, 0, NULL, 0);
492 		if (entry != NULL)
493 			STAILQ_INSERT_TAIL(head, entry, next);
494 	}
495 	/* ktrace vnode, if one */
496 	if (kp->ki_tracep) {
497 		entry = filestat_new_entry(kp->ki_tracep, PS_FST_TYPE_VNODE, -1,
498 		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
499 		    PS_FST_UFLAG_TRACE, 0, 0, NULL, 0);
500 		if (entry != NULL)
501 			STAILQ_INSERT_TAIL(head, entry, next);
502 	}
503 	/* text vnode, if one */
504 	if (kp->ki_textvp) {
505 		entry = filestat_new_entry(kp->ki_textvp, PS_FST_TYPE_VNODE, -1,
506 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_TEXT, 0, 0, NULL, 0);
507 		if (entry != NULL)
508 			STAILQ_INSERT_TAIL(head, entry, next);
509 	}
510 	/* Controlling terminal. */
511 	if ((vp = getctty(kd, kp)) != NULL) {
512 		entry = filestat_new_entry(vp, PS_FST_TYPE_VNODE, -1,
513 		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
514 		    PS_FST_UFLAG_CTTY, 0, 0, NULL, 0);
515 		if (entry != NULL)
516 			STAILQ_INSERT_TAIL(head, entry, next);
517 	}
518 
519 	nfiles = filed.fd_lastfile + 1;
520 	ofiles = malloc(nfiles * sizeof(struct file *));
521 	if (ofiles == NULL) {
522 		warn("malloc(%zu)", nfiles * sizeof(struct file *));
523 		goto do_mmapped;
524 	}
525 	if (!kvm_read_all(kd, (unsigned long)filed.fd_ofiles, ofiles,
526 	    nfiles * sizeof(struct file *))) {
527 		warnx("cannot read file structures at %p",
528 		    (void *)filed.fd_ofiles);
529 		free(ofiles);
530 		goto do_mmapped;
531 	}
532 	for (i = 0; i <= filed.fd_lastfile; i++) {
533 		if (ofiles[i] == NULL)
534 			continue;
535 		if (!kvm_read_all(kd, (unsigned long)ofiles[i], &file,
536 		    sizeof(struct file))) {
537 			warnx("can't read file %d at %p", i,
538 			    (void *)ofiles[i]);
539 			continue;
540 		}
541 		switch (file.f_type) {
542 		case DTYPE_VNODE:
543 			type = PS_FST_TYPE_VNODE;
544 			data = file.f_vnode;
545 			break;
546 		case DTYPE_SOCKET:
547 			type = PS_FST_TYPE_SOCKET;
548 			data = file.f_data;
549 			break;
550 		case DTYPE_PIPE:
551 			type = PS_FST_TYPE_PIPE;
552 			data = file.f_data;
553 			break;
554 		case DTYPE_FIFO:
555 			type = PS_FST_TYPE_FIFO;
556 			data = file.f_vnode;
557 			break;
558 #ifdef DTYPE_PTS
559 		case DTYPE_PTS:
560 			type = PS_FST_TYPE_PTS;
561 			data = file.f_data;
562 			break;
563 #endif
564 		case DTYPE_SEM:
565 			type = PS_FST_TYPE_SEM;
566 			data = file.f_data;
567 			break;
568 		case DTYPE_SHM:
569 			type = PS_FST_TYPE_SHM;
570 			data = file.f_data;
571 			break;
572 		default:
573 			continue;
574 		}
575 		/* XXXRW: No capability rights support for kvm yet. */
576 		entry = filestat_new_entry(data, type, i,
577 		    to_filestat_flags(file.f_flag), 0, 0, 0, NULL, 0);
578 		if (entry != NULL)
579 			STAILQ_INSERT_TAIL(head, entry, next);
580 	}
581 	free(ofiles);
582 
583 do_mmapped:
584 
585 	/*
586 	 * Process mmapped files if requested.
587 	 */
588 	if (mmapped) {
589 		if (!kvm_read_all(kd, (unsigned long)kp->ki_vmspace, &vmspace,
590 		    sizeof(vmspace))) {
591 			warnx("can't read vmspace at %p",
592 			    (void *)kp->ki_vmspace);
593 			goto exit;
594 		}
595 		map = &vmspace.vm_map;
596 
597 		for (entryp = map->header.next;
598 		    entryp != &kp->ki_vmspace->vm_map.header;
599 		    entryp = vmentry.next) {
600 			if (!kvm_read_all(kd, (unsigned long)entryp, &vmentry,
601 			    sizeof(vmentry))) {
602 				warnx("can't read vm_map_entry at %p",
603 				    (void *)entryp);
604 				continue;
605 			}
606 			if (vmentry.eflags & MAP_ENTRY_IS_SUB_MAP)
607 				continue;
608 			if ((objp = vmentry.object.vm_object) == NULL)
609 				continue;
610 			for (; objp; objp = object.backing_object) {
611 				if (!kvm_read_all(kd, (unsigned long)objp,
612 				    &object, sizeof(object))) {
613 					warnx("can't read vm_object at %p",
614 					    (void *)objp);
615 					break;
616 				}
617 			}
618 
619 			/* We want only vnode objects. */
620 			if (object.type != OBJT_VNODE)
621 				continue;
622 
623 			prot = vmentry.protection;
624 			fflags = 0;
625 			if (prot & VM_PROT_READ)
626 				fflags = PS_FST_FFLAG_READ;
627 			if ((vmentry.eflags & MAP_ENTRY_COW) == 0 &&
628 			    prot & VM_PROT_WRITE)
629 				fflags |= PS_FST_FFLAG_WRITE;
630 
631 			/*
632 			 * Create filestat entry.
633 			 */
634 			entry = filestat_new_entry(object.handle,
635 			    PS_FST_TYPE_VNODE, -1, fflags,
636 			    PS_FST_UFLAG_MMAP, 0, 0, NULL, 0);
637 			if (entry != NULL)
638 				STAILQ_INSERT_TAIL(head, entry, next);
639 		}
640 	}
641 exit:
642 	return (head);
643 }
644 
645 /*
646  * kinfo types to filestat translation.
647  */
648 static int
649 kinfo_type2fst(int kftype)
650 {
651 	static struct {
652 		int	kf_type;
653 		int	fst_type;
654 	} kftypes2fst[] = {
655 		{ KF_TYPE_CRYPTO, PS_FST_TYPE_CRYPTO },
656 		{ KF_TYPE_FIFO, PS_FST_TYPE_FIFO },
657 		{ KF_TYPE_KQUEUE, PS_FST_TYPE_KQUEUE },
658 		{ KF_TYPE_MQUEUE, PS_FST_TYPE_MQUEUE },
659 		{ KF_TYPE_NONE, PS_FST_TYPE_NONE },
660 		{ KF_TYPE_PIPE, PS_FST_TYPE_PIPE },
661 		{ KF_TYPE_PTS, PS_FST_TYPE_PTS },
662 		{ KF_TYPE_SEM, PS_FST_TYPE_SEM },
663 		{ KF_TYPE_SHM, PS_FST_TYPE_SHM },
664 		{ KF_TYPE_SOCKET, PS_FST_TYPE_SOCKET },
665 		{ KF_TYPE_VNODE, PS_FST_TYPE_VNODE },
666 		{ KF_TYPE_UNKNOWN, PS_FST_TYPE_UNKNOWN }
667 	};
668 #define NKFTYPES	(sizeof(kftypes2fst) / sizeof(*kftypes2fst))
669 	unsigned int i;
670 
671 	for (i = 0; i < NKFTYPES; i++)
672 		if (kftypes2fst[i].kf_type == kftype)
673 			break;
674 	if (i == NKFTYPES)
675 		return (PS_FST_TYPE_UNKNOWN);
676 	return (kftypes2fst[i].fst_type);
677 }
678 
679 /*
680  * kinfo flags to filestat translation.
681  */
682 static int
683 kinfo_fflags2fst(int kfflags)
684 {
685 	static struct {
686 		int	kf_flag;
687 		int	fst_flag;
688 	} kfflags2fst[] = {
689 		{ KF_FLAG_APPEND, PS_FST_FFLAG_APPEND },
690 		{ KF_FLAG_ASYNC, PS_FST_FFLAG_ASYNC },
691 		{ KF_FLAG_CREAT, PS_FST_FFLAG_CREAT },
692 		{ KF_FLAG_DIRECT, PS_FST_FFLAG_DIRECT },
693 		{ KF_FLAG_EXCL, PS_FST_FFLAG_EXCL },
694 		{ KF_FLAG_EXEC, PS_FST_FFLAG_EXEC },
695 		{ KF_FLAG_EXLOCK, PS_FST_FFLAG_EXLOCK },
696 		{ KF_FLAG_FSYNC, PS_FST_FFLAG_SYNC },
697 		{ KF_FLAG_HASLOCK, PS_FST_FFLAG_HASLOCK },
698 		{ KF_FLAG_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
699 		{ KF_FLAG_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
700 		{ KF_FLAG_READ, PS_FST_FFLAG_READ },
701 		{ KF_FLAG_SHLOCK, PS_FST_FFLAG_SHLOCK },
702 		{ KF_FLAG_TRUNC, PS_FST_FFLAG_TRUNC },
703 		{ KF_FLAG_WRITE, PS_FST_FFLAG_WRITE }
704 	};
705 #define NKFFLAGS	(sizeof(kfflags2fst) / sizeof(*kfflags2fst))
706 	unsigned int i;
707 	int flags;
708 
709 	flags = 0;
710 	for (i = 0; i < NKFFLAGS; i++)
711 		if ((kfflags & kfflags2fst[i].kf_flag) != 0)
712 			flags |= kfflags2fst[i].fst_flag;
713 	return (flags);
714 }
715 
716 static int
717 kinfo_uflags2fst(int fd)
718 {
719 
720 	switch (fd) {
721 	case KF_FD_TYPE_CTTY:
722 		return (PS_FST_UFLAG_CTTY);
723 	case KF_FD_TYPE_CWD:
724 		return (PS_FST_UFLAG_CDIR);
725 	case KF_FD_TYPE_JAIL:
726 		return (PS_FST_UFLAG_JAIL);
727 	case KF_FD_TYPE_TEXT:
728 		return (PS_FST_UFLAG_TEXT);
729 	case KF_FD_TYPE_TRACE:
730 		return (PS_FST_UFLAG_TRACE);
731 	case KF_FD_TYPE_ROOT:
732 		return (PS_FST_UFLAG_RDIR);
733 	}
734 	return (0);
735 }
736 
737 static struct kinfo_file *
738 kinfo_getfile_core(struct procstat_core *core, int *cntp)
739 {
740 	int cnt;
741 	size_t len;
742 	char *buf, *bp, *eb;
743 	struct kinfo_file *kif, *kp, *kf;
744 
745 	buf = procstat_core_get(core, PSC_TYPE_FILES, NULL, &len);
746 	if (buf == NULL)
747 		return (NULL);
748 	/*
749 	 * XXXMG: The code below is just copy&past from libutil.
750 	 * The code duplication can be avoided if libutil
751 	 * is extended to provide something like:
752 	 *   struct kinfo_file *kinfo_getfile_from_buf(const char *buf,
753 	 *       size_t len, int *cntp);
754 	 */
755 
756 	/* Pass 1: count items */
757 	cnt = 0;
758 	bp = buf;
759 	eb = buf + len;
760 	while (bp < eb) {
761 		kf = (struct kinfo_file *)(uintptr_t)bp;
762 		bp += kf->kf_structsize;
763 		cnt++;
764 	}
765 
766 	kif = calloc(cnt, sizeof(*kif));
767 	if (kif == NULL) {
768 		free(buf);
769 		return (NULL);
770 	}
771 	bp = buf;
772 	eb = buf + len;
773 	kp = kif;
774 	/* Pass 2: unpack */
775 	while (bp < eb) {
776 		kf = (struct kinfo_file *)(uintptr_t)bp;
777 		/* Copy/expand into pre-zeroed buffer */
778 		memcpy(kp, kf, kf->kf_structsize);
779 		/* Advance to next packed record */
780 		bp += kf->kf_structsize;
781 		/* Set field size to fixed length, advance */
782 		kp->kf_structsize = sizeof(*kp);
783 		kp++;
784 	}
785 	free(buf);
786 	*cntp = cnt;
787 	return (kif);	/* Caller must free() return value */
788 }
789 
790 static struct filestat_list *
791 procstat_getfiles_sysctl(struct procstat *procstat, struct kinfo_proc *kp,
792     int mmapped)
793 {
794 	struct kinfo_file *kif, *files;
795 	struct kinfo_vmentry *kve, *vmentries;
796 	struct filestat_list *head;
797 	struct filestat *entry;
798 	char *path;
799 	off_t offset;
800 	int cnt, fd, fflags;
801 	int i, type, uflags;
802 	int refcount;
803 	cap_rights_t cap_rights;
804 
805 	assert(kp);
806 	if (kp->ki_fd == NULL)
807 		return (NULL);
808 	switch(procstat->type) {
809 	case PROCSTAT_SYSCTL:
810 		files = kinfo_getfile(kp->ki_pid, &cnt);
811 		break;
812 	case PROCSTAT_CORE:
813 		files = kinfo_getfile_core(procstat->core, &cnt);
814 		break;
815 	default:
816 		assert(!"invalid type");
817 	}
818 	if (files == NULL && errno != EPERM) {
819 		warn("kinfo_getfile()");
820 		return (NULL);
821 	}
822 	procstat->files = files;
823 
824 	/*
825 	 * Allocate list head.
826 	 */
827 	head = malloc(sizeof(*head));
828 	if (head == NULL)
829 		return (NULL);
830 	STAILQ_INIT(head);
831 	for (i = 0; i < cnt; i++) {
832 		kif = &files[i];
833 
834 		type = kinfo_type2fst(kif->kf_type);
835 		fd = kif->kf_fd >= 0 ? kif->kf_fd : -1;
836 		fflags = kinfo_fflags2fst(kif->kf_flags);
837 		uflags = kinfo_uflags2fst(kif->kf_fd);
838 		refcount = kif->kf_ref_count;
839 		offset = kif->kf_offset;
840 		if (*kif->kf_path != '\0')
841 			path = strdup(kif->kf_path);
842 		else
843 			path = NULL;
844 		cap_rights = kif->kf_cap_rights;
845 
846 		/*
847 		 * Create filestat entry.
848 		 */
849 		entry = filestat_new_entry(kif, type, fd, fflags, uflags,
850 		    refcount, offset, path, cap_rights);
851 		if (entry != NULL)
852 			STAILQ_INSERT_TAIL(head, entry, next);
853 	}
854 	if (mmapped != 0) {
855 		vmentries = procstat_getvmmap(procstat, kp, &cnt);
856 		procstat->vmentries = vmentries;
857 		if (vmentries == NULL || cnt == 0)
858 			goto fail;
859 		for (i = 0; i < cnt; i++) {
860 			kve = &vmentries[i];
861 			if (kve->kve_type != KVME_TYPE_VNODE)
862 				continue;
863 			fflags = 0;
864 			if (kve->kve_protection & KVME_PROT_READ)
865 				fflags = PS_FST_FFLAG_READ;
866 			if ((kve->kve_flags & KVME_FLAG_COW) == 0 &&
867 			    kve->kve_protection & KVME_PROT_WRITE)
868 				fflags |= PS_FST_FFLAG_WRITE;
869 			offset = kve->kve_offset;
870 			refcount = kve->kve_ref_count;
871 			if (*kve->kve_path != '\0')
872 				path = strdup(kve->kve_path);
873 			else
874 				path = NULL;
875 			entry = filestat_new_entry(kve, PS_FST_TYPE_VNODE, -1,
876 			    fflags, PS_FST_UFLAG_MMAP, refcount, offset, path,
877 			    0);
878 			if (entry != NULL)
879 				STAILQ_INSERT_TAIL(head, entry, next);
880 		}
881 	}
882 fail:
883 	return (head);
884 }
885 
886 int
887 procstat_get_pipe_info(struct procstat *procstat, struct filestat *fst,
888     struct pipestat *ps, char *errbuf)
889 {
890 
891 	assert(ps);
892 	if (procstat->type == PROCSTAT_KVM) {
893 		return (procstat_get_pipe_info_kvm(procstat->kd, fst, ps,
894 		    errbuf));
895 	} else if (procstat->type == PROCSTAT_SYSCTL ||
896 		procstat->type == PROCSTAT_CORE) {
897 		return (procstat_get_pipe_info_sysctl(fst, ps, errbuf));
898 	} else {
899 		warnx("unknown access method: %d", procstat->type);
900 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
901 		return (1);
902 	}
903 }
904 
905 static int
906 procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
907     struct pipestat *ps, char *errbuf)
908 {
909 	struct pipe pi;
910 	void *pipep;
911 
912 	assert(kd);
913 	assert(ps);
914 	assert(fst);
915 	bzero(ps, sizeof(*ps));
916 	pipep = fst->fs_typedep;
917 	if (pipep == NULL)
918 		goto fail;
919 	if (!kvm_read_all(kd, (unsigned long)pipep, &pi, sizeof(struct pipe))) {
920 		warnx("can't read pipe at %p", (void *)pipep);
921 		goto fail;
922 	}
923 	ps->addr = (uintptr_t)pipep;
924 	ps->peer = (uintptr_t)pi.pipe_peer;
925 	ps->buffer_cnt = pi.pipe_buffer.cnt;
926 	return (0);
927 
928 fail:
929 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
930 	return (1);
931 }
932 
933 static int
934 procstat_get_pipe_info_sysctl(struct filestat *fst, struct pipestat *ps,
935     char *errbuf __unused)
936 {
937 	struct kinfo_file *kif;
938 
939 	assert(ps);
940 	assert(fst);
941 	bzero(ps, sizeof(*ps));
942 	kif = fst->fs_typedep;
943 	if (kif == NULL)
944 		return (1);
945 	ps->addr = kif->kf_un.kf_pipe.kf_pipe_addr;
946 	ps->peer = kif->kf_un.kf_pipe.kf_pipe_peer;
947 	ps->buffer_cnt = kif->kf_un.kf_pipe.kf_pipe_buffer_cnt;
948 	return (0);
949 }
950 
951 int
952 procstat_get_pts_info(struct procstat *procstat, struct filestat *fst,
953     struct ptsstat *pts, char *errbuf)
954 {
955 
956 	assert(pts);
957 	if (procstat->type == PROCSTAT_KVM) {
958 		return (procstat_get_pts_info_kvm(procstat->kd, fst, pts,
959 		    errbuf));
960 	} else if (procstat->type == PROCSTAT_SYSCTL ||
961 		procstat->type == PROCSTAT_CORE) {
962 		return (procstat_get_pts_info_sysctl(fst, pts, errbuf));
963 	} else {
964 		warnx("unknown access method: %d", procstat->type);
965 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
966 		return (1);
967 	}
968 }
969 
970 static int
971 procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
972     struct ptsstat *pts, char *errbuf)
973 {
974 	struct tty tty;
975 	void *ttyp;
976 
977 	assert(kd);
978 	assert(pts);
979 	assert(fst);
980 	bzero(pts, sizeof(*pts));
981 	ttyp = fst->fs_typedep;
982 	if (ttyp == NULL)
983 		goto fail;
984 	if (!kvm_read_all(kd, (unsigned long)ttyp, &tty, sizeof(struct tty))) {
985 		warnx("can't read tty at %p", (void *)ttyp);
986 		goto fail;
987 	}
988 	pts->dev = dev2udev(kd, tty.t_dev);
989 	(void)kdevtoname(kd, tty.t_dev, pts->devname);
990 	return (0);
991 
992 fail:
993 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
994 	return (1);
995 }
996 
997 static int
998 procstat_get_pts_info_sysctl(struct filestat *fst, struct ptsstat *pts,
999     char *errbuf __unused)
1000 {
1001 	struct kinfo_file *kif;
1002 
1003 	assert(pts);
1004 	assert(fst);
1005 	bzero(pts, sizeof(*pts));
1006 	kif = fst->fs_typedep;
1007 	if (kif == NULL)
1008 		return (0);
1009 	pts->dev = kif->kf_un.kf_pts.kf_pts_dev;
1010 	strlcpy(pts->devname, kif->kf_path, sizeof(pts->devname));
1011 	return (0);
1012 }
1013 
1014 int
1015 procstat_get_sem_info(struct procstat *procstat, struct filestat *fst,
1016     struct semstat *sem, char *errbuf)
1017 {
1018 
1019 	assert(sem);
1020 	if (procstat->type == PROCSTAT_KVM) {
1021 		return (procstat_get_sem_info_kvm(procstat->kd, fst, sem,
1022 		    errbuf));
1023 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1024 	    procstat->type == PROCSTAT_CORE) {
1025 		return (procstat_get_sem_info_sysctl(fst, sem, errbuf));
1026 	} else {
1027 		warnx("unknown access method: %d", procstat->type);
1028 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1029 		return (1);
1030 	}
1031 }
1032 
1033 static int
1034 procstat_get_sem_info_kvm(kvm_t *kd, struct filestat *fst,
1035     struct semstat *sem, char *errbuf)
1036 {
1037 	struct ksem ksem;
1038 	void *ksemp;
1039 	char *path;
1040 	int i;
1041 
1042 	assert(kd);
1043 	assert(sem);
1044 	assert(fst);
1045 	bzero(sem, sizeof(*sem));
1046 	ksemp = fst->fs_typedep;
1047 	if (ksemp == NULL)
1048 		goto fail;
1049 	if (!kvm_read_all(kd, (unsigned long)ksemp, &ksem,
1050 	    sizeof(struct ksem))) {
1051 		warnx("can't read ksem at %p", (void *)ksemp);
1052 		goto fail;
1053 	}
1054 	sem->mode = S_IFREG | ksem.ks_mode;
1055 	sem->value = ksem.ks_value;
1056 	if (fst->fs_path == NULL && ksem.ks_path != NULL) {
1057 		path = malloc(MAXPATHLEN);
1058 		for (i = 0; i < MAXPATHLEN - 1; i++) {
1059 			if (!kvm_read_all(kd, (unsigned long)ksem.ks_path + i,
1060 			    path + i, 1))
1061 				break;
1062 			if (path[i] == '\0')
1063 				break;
1064 		}
1065 		path[i] = '\0';
1066 		if (i == 0)
1067 			free(path);
1068 		else
1069 			fst->fs_path = path;
1070 	}
1071 	return (0);
1072 
1073 fail:
1074 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1075 	return (1);
1076 }
1077 
1078 static int
1079 procstat_get_sem_info_sysctl(struct filestat *fst, struct semstat *sem,
1080     char *errbuf __unused)
1081 {
1082 	struct kinfo_file *kif;
1083 
1084 	assert(sem);
1085 	assert(fst);
1086 	bzero(sem, sizeof(*sem));
1087 	kif = fst->fs_typedep;
1088 	if (kif == NULL)
1089 		return (0);
1090 	sem->value = kif->kf_un.kf_sem.kf_sem_value;
1091 	sem->mode = kif->kf_un.kf_sem.kf_sem_mode;
1092 	return (0);
1093 }
1094 
1095 int
1096 procstat_get_shm_info(struct procstat *procstat, struct filestat *fst,
1097     struct shmstat *shm, char *errbuf)
1098 {
1099 
1100 	assert(shm);
1101 	if (procstat->type == PROCSTAT_KVM) {
1102 		return (procstat_get_shm_info_kvm(procstat->kd, fst, shm,
1103 		    errbuf));
1104 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1105 	    procstat->type == PROCSTAT_CORE) {
1106 		return (procstat_get_shm_info_sysctl(fst, shm, errbuf));
1107 	} else {
1108 		warnx("unknown access method: %d", procstat->type);
1109 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1110 		return (1);
1111 	}
1112 }
1113 
1114 static int
1115 procstat_get_shm_info_kvm(kvm_t *kd, struct filestat *fst,
1116     struct shmstat *shm, char *errbuf)
1117 {
1118 	struct shmfd shmfd;
1119 	void *shmfdp;
1120 	char *path;
1121 	int i;
1122 
1123 	assert(kd);
1124 	assert(shm);
1125 	assert(fst);
1126 	bzero(shm, sizeof(*shm));
1127 	shmfdp = fst->fs_typedep;
1128 	if (shmfdp == NULL)
1129 		goto fail;
1130 	if (!kvm_read_all(kd, (unsigned long)shmfdp, &shmfd,
1131 	    sizeof(struct shmfd))) {
1132 		warnx("can't read shmfd at %p", (void *)shmfdp);
1133 		goto fail;
1134 	}
1135 	shm->mode = S_IFREG | shmfd.shm_mode;
1136 	shm->size = shmfd.shm_size;
1137 	if (fst->fs_path == NULL && shmfd.shm_path != NULL) {
1138 		path = malloc(MAXPATHLEN);
1139 		for (i = 0; i < MAXPATHLEN - 1; i++) {
1140 			if (!kvm_read_all(kd, (unsigned long)shmfd.shm_path + i,
1141 			    path + i, 1))
1142 				break;
1143 			if (path[i] == '\0')
1144 				break;
1145 		}
1146 		path[i] = '\0';
1147 		if (i == 0)
1148 			free(path);
1149 		else
1150 			fst->fs_path = path;
1151 	}
1152 	return (0);
1153 
1154 fail:
1155 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1156 	return (1);
1157 }
1158 
1159 static int
1160 procstat_get_shm_info_sysctl(struct filestat *fst, struct shmstat *shm,
1161     char *errbuf __unused)
1162 {
1163 	struct kinfo_file *kif;
1164 
1165 	assert(shm);
1166 	assert(fst);
1167 	bzero(shm, sizeof(*shm));
1168 	kif = fst->fs_typedep;
1169 	if (kif == NULL)
1170 		return (0);
1171 	shm->size = kif->kf_un.kf_file.kf_file_size;
1172 	shm->mode = kif->kf_un.kf_file.kf_file_mode;
1173 	return (0);
1174 }
1175 
1176 int
1177 procstat_get_vnode_info(struct procstat *procstat, struct filestat *fst,
1178     struct vnstat *vn, char *errbuf)
1179 {
1180 
1181 	assert(vn);
1182 	if (procstat->type == PROCSTAT_KVM) {
1183 		return (procstat_get_vnode_info_kvm(procstat->kd, fst, vn,
1184 		    errbuf));
1185 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1186 		procstat->type == PROCSTAT_CORE) {
1187 		return (procstat_get_vnode_info_sysctl(fst, vn, errbuf));
1188 	} else {
1189 		warnx("unknown access method: %d", procstat->type);
1190 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1191 		return (1);
1192 	}
1193 }
1194 
1195 static int
1196 procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
1197     struct vnstat *vn, char *errbuf)
1198 {
1199 	/* Filesystem specific handlers. */
1200 	#define FSTYPE(fst)     {#fst, fst##_filestat}
1201 	struct {
1202 		const char	*tag;
1203 		int		(*handler)(kvm_t *kd, struct vnode *vp,
1204 		    struct vnstat *vn);
1205 	} fstypes[] = {
1206 		FSTYPE(devfs),
1207 		FSTYPE(isofs),
1208 		FSTYPE(msdosfs),
1209 		FSTYPE(nfs),
1210 		FSTYPE(udf),
1211 		FSTYPE(ufs),
1212 #ifdef LIBPROCSTAT_ZFS
1213 		FSTYPE(zfs),
1214 #endif
1215 	};
1216 #define	NTYPES	(sizeof(fstypes) / sizeof(*fstypes))
1217 	struct vnode vnode;
1218 	char tagstr[12];
1219 	void *vp;
1220 	int error, found;
1221 	unsigned int i;
1222 
1223 	assert(kd);
1224 	assert(vn);
1225 	assert(fst);
1226 	vp = fst->fs_typedep;
1227 	if (vp == NULL)
1228 		goto fail;
1229 	error = kvm_read_all(kd, (unsigned long)vp, &vnode, sizeof(vnode));
1230 	if (error == 0) {
1231 		warnx("can't read vnode at %p", (void *)vp);
1232 		goto fail;
1233 	}
1234 	bzero(vn, sizeof(*vn));
1235 	vn->vn_type = vntype2psfsttype(vnode.v_type);
1236 	if (vnode.v_type == VNON || vnode.v_type == VBAD)
1237 		return (0);
1238 	error = kvm_read_all(kd, (unsigned long)vnode.v_tag, tagstr,
1239 	    sizeof(tagstr));
1240 	if (error == 0) {
1241 		warnx("can't read v_tag at %p", (void *)vp);
1242 		goto fail;
1243 	}
1244 	tagstr[sizeof(tagstr) - 1] = '\0';
1245 
1246 	/*
1247 	 * Find appropriate handler.
1248 	 */
1249 	for (i = 0, found = 0; i < NTYPES; i++)
1250 		if (!strcmp(fstypes[i].tag, tagstr)) {
1251 			if (fstypes[i].handler(kd, &vnode, vn) != 0) {
1252 				goto fail;
1253 			}
1254 			break;
1255 		}
1256 	if (i == NTYPES) {
1257 		snprintf(errbuf, _POSIX2_LINE_MAX, "?(%s)", tagstr);
1258 		return (1);
1259 	}
1260 	vn->vn_mntdir = getmnton(kd, vnode.v_mount);
1261 	if ((vnode.v_type == VBLK || vnode.v_type == VCHR) &&
1262 	    vnode.v_rdev != NULL){
1263 		vn->vn_dev = dev2udev(kd, vnode.v_rdev);
1264 		(void)kdevtoname(kd, vnode.v_rdev, vn->vn_devname);
1265 	} else {
1266 		vn->vn_dev = -1;
1267 	}
1268 	return (0);
1269 
1270 fail:
1271 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1272 	return (1);
1273 }
1274 
1275 /*
1276  * kinfo vnode type to filestat translation.
1277  */
1278 static int
1279 kinfo_vtype2fst(int kfvtype)
1280 {
1281 	static struct {
1282 		int	kf_vtype;
1283 		int	fst_vtype;
1284 	} kfvtypes2fst[] = {
1285 		{ KF_VTYPE_VBAD, PS_FST_VTYPE_VBAD },
1286 		{ KF_VTYPE_VBLK, PS_FST_VTYPE_VBLK },
1287 		{ KF_VTYPE_VCHR, PS_FST_VTYPE_VCHR },
1288 		{ KF_VTYPE_VDIR, PS_FST_VTYPE_VDIR },
1289 		{ KF_VTYPE_VFIFO, PS_FST_VTYPE_VFIFO },
1290 		{ KF_VTYPE_VLNK, PS_FST_VTYPE_VLNK },
1291 		{ KF_VTYPE_VNON, PS_FST_VTYPE_VNON },
1292 		{ KF_VTYPE_VREG, PS_FST_VTYPE_VREG },
1293 		{ KF_VTYPE_VSOCK, PS_FST_VTYPE_VSOCK }
1294 	};
1295 #define	NKFVTYPES	(sizeof(kfvtypes2fst) / sizeof(*kfvtypes2fst))
1296 	unsigned int i;
1297 
1298 	for (i = 0; i < NKFVTYPES; i++)
1299 		if (kfvtypes2fst[i].kf_vtype == kfvtype)
1300 			break;
1301 	if (i == NKFVTYPES)
1302 		return (PS_FST_VTYPE_UNKNOWN);
1303 	return (kfvtypes2fst[i].fst_vtype);
1304 }
1305 
1306 static int
1307 procstat_get_vnode_info_sysctl(struct filestat *fst, struct vnstat *vn,
1308     char *errbuf)
1309 {
1310 	struct statfs stbuf;
1311 	struct kinfo_file *kif;
1312 	struct kinfo_vmentry *kve;
1313 	uint64_t fileid;
1314 	uint64_t size;
1315 	char *name, *path;
1316 	uint32_t fsid;
1317 	uint16_t mode;
1318 	uint32_t rdev;
1319 	int vntype;
1320 	int status;
1321 
1322 	assert(fst);
1323 	assert(vn);
1324 	bzero(vn, sizeof(*vn));
1325 	if (fst->fs_typedep == NULL)
1326 		return (1);
1327 	if (fst->fs_uflags & PS_FST_UFLAG_MMAP) {
1328 		kve = fst->fs_typedep;
1329 		fileid = kve->kve_vn_fileid;
1330 		fsid = kve->kve_vn_fsid;
1331 		mode = kve->kve_vn_mode;
1332 		path = kve->kve_path;
1333 		rdev = kve->kve_vn_rdev;
1334 		size = kve->kve_vn_size;
1335 		vntype = kinfo_vtype2fst(kve->kve_vn_type);
1336 		status = kve->kve_status;
1337 	} else {
1338 		kif = fst->fs_typedep;
1339 		fileid = kif->kf_un.kf_file.kf_file_fileid;
1340 		fsid = kif->kf_un.kf_file.kf_file_fsid;
1341 		mode = kif->kf_un.kf_file.kf_file_mode;
1342 		path = kif->kf_path;
1343 		rdev = kif->kf_un.kf_file.kf_file_rdev;
1344 		size = kif->kf_un.kf_file.kf_file_size;
1345 		vntype = kinfo_vtype2fst(kif->kf_vnode_type);
1346 		status = kif->kf_status;
1347 	}
1348 	vn->vn_type = vntype;
1349 	if (vntype == PS_FST_VTYPE_VNON || vntype == PS_FST_VTYPE_VBAD)
1350 		return (0);
1351 	if ((status & KF_ATTR_VALID) == 0) {
1352 		snprintf(errbuf, _POSIX2_LINE_MAX, "? (no info available)");
1353 		return (1);
1354 	}
1355 	if (path && *path) {
1356 		statfs(path, &stbuf);
1357 		vn->vn_mntdir = strdup(stbuf.f_mntonname);
1358 	} else
1359 		vn->vn_mntdir = strdup("-");
1360 	vn->vn_dev = rdev;
1361 	if (vntype == PS_FST_VTYPE_VBLK) {
1362 		name = devname(rdev, S_IFBLK);
1363 		if (name != NULL)
1364 			strlcpy(vn->vn_devname, name,
1365 			    sizeof(vn->vn_devname));
1366 	} else if (vntype == PS_FST_VTYPE_VCHR) {
1367 		name = devname(vn->vn_dev, S_IFCHR);
1368 		if (name != NULL)
1369 			strlcpy(vn->vn_devname, name,
1370 			    sizeof(vn->vn_devname));
1371 	}
1372 	vn->vn_fsid = fsid;
1373 	vn->vn_fileid = fileid;
1374 	vn->vn_size = size;
1375 	vn->vn_mode = mode;
1376 	return (0);
1377 }
1378 
1379 int
1380 procstat_get_socket_info(struct procstat *procstat, struct filestat *fst,
1381     struct sockstat *sock, char *errbuf)
1382 {
1383 
1384 	assert(sock);
1385 	if (procstat->type == PROCSTAT_KVM) {
1386 		return (procstat_get_socket_info_kvm(procstat->kd, fst, sock,
1387 		    errbuf));
1388 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1389 		procstat->type == PROCSTAT_CORE) {
1390 		return (procstat_get_socket_info_sysctl(fst, sock, errbuf));
1391 	} else {
1392 		warnx("unknown access method: %d", procstat->type);
1393 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1394 		return (1);
1395 	}
1396 }
1397 
1398 static int
1399 procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
1400     struct sockstat *sock, char *errbuf)
1401 {
1402 	struct domain dom;
1403 	struct inpcb inpcb;
1404 	struct protosw proto;
1405 	struct socket s;
1406 	struct unpcb unpcb;
1407 	ssize_t len;
1408 	void *so;
1409 
1410 	assert(kd);
1411 	assert(sock);
1412 	assert(fst);
1413 	bzero(sock, sizeof(*sock));
1414 	so = fst->fs_typedep;
1415 	if (so == NULL)
1416 		goto fail;
1417 	sock->so_addr = (uintptr_t)so;
1418 	/* fill in socket */
1419 	if (!kvm_read_all(kd, (unsigned long)so, &s,
1420 	    sizeof(struct socket))) {
1421 		warnx("can't read sock at %p", (void *)so);
1422 		goto fail;
1423 	}
1424 	/* fill in protosw entry */
1425 	if (!kvm_read_all(kd, (unsigned long)s.so_proto, &proto,
1426 	    sizeof(struct protosw))) {
1427 		warnx("can't read protosw at %p", (void *)s.so_proto);
1428 		goto fail;
1429 	}
1430 	/* fill in domain */
1431 	if (!kvm_read_all(kd, (unsigned long)proto.pr_domain, &dom,
1432 	    sizeof(struct domain))) {
1433 		warnx("can't read domain at %p",
1434 		    (void *)proto.pr_domain);
1435 		goto fail;
1436 	}
1437 	if ((len = kvm_read(kd, (unsigned long)dom.dom_name, sock->dname,
1438 	    sizeof(sock->dname) - 1)) < 0) {
1439 		warnx("can't read domain name at %p", (void *)dom.dom_name);
1440 		sock->dname[0] = '\0';
1441 	}
1442 	else
1443 		sock->dname[len] = '\0';
1444 
1445 	/*
1446 	 * Fill in known data.
1447 	 */
1448 	sock->type = s.so_type;
1449 	sock->proto = proto.pr_protocol;
1450 	sock->dom_family = dom.dom_family;
1451 	sock->so_pcb = (uintptr_t)s.so_pcb;
1452 
1453 	/*
1454 	 * Protocol specific data.
1455 	 */
1456 	switch(dom.dom_family) {
1457 	case AF_INET:
1458 	case AF_INET6:
1459 		if (proto.pr_protocol == IPPROTO_TCP) {
1460 			if (s.so_pcb) {
1461 				if (kvm_read(kd, (u_long)s.so_pcb,
1462 				    (char *)&inpcb, sizeof(struct inpcb))
1463 				    != sizeof(struct inpcb)) {
1464 					warnx("can't read inpcb at %p",
1465 					    (void *)s.so_pcb);
1466 				} else
1467 					sock->inp_ppcb =
1468 					    (uintptr_t)inpcb.inp_ppcb;
1469 			}
1470 		}
1471 		break;
1472 	case AF_UNIX:
1473 		if (s.so_pcb) {
1474 			if (kvm_read(kd, (u_long)s.so_pcb, (char *)&unpcb,
1475 			    sizeof(struct unpcb)) != sizeof(struct unpcb)){
1476 				warnx("can't read unpcb at %p",
1477 				    (void *)s.so_pcb);
1478 			} else if (unpcb.unp_conn) {
1479 				sock->so_rcv_sb_state = s.so_rcv.sb_state;
1480 				sock->so_snd_sb_state = s.so_snd.sb_state;
1481 				sock->unp_conn = (uintptr_t)unpcb.unp_conn;
1482 			}
1483 		}
1484 		break;
1485 	default:
1486 		break;
1487 	}
1488 	return (0);
1489 
1490 fail:
1491 	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1492 	return (1);
1493 }
1494 
1495 static int
1496 procstat_get_socket_info_sysctl(struct filestat *fst, struct sockstat *sock,
1497     char *errbuf __unused)
1498 {
1499 	struct kinfo_file *kif;
1500 
1501 	assert(sock);
1502 	assert(fst);
1503 	bzero(sock, sizeof(*sock));
1504 	kif = fst->fs_typedep;
1505 	if (kif == NULL)
1506 		return (0);
1507 
1508 	/*
1509 	 * Fill in known data.
1510 	 */
1511 	sock->type = kif->kf_sock_type;
1512 	sock->proto = kif->kf_sock_protocol;
1513 	sock->dom_family = kif->kf_sock_domain;
1514 	sock->so_pcb = kif->kf_un.kf_sock.kf_sock_pcb;
1515 	strlcpy(sock->dname, kif->kf_path, sizeof(sock->dname));
1516 	bcopy(&kif->kf_sa_local, &sock->sa_local, kif->kf_sa_local.ss_len);
1517 	bcopy(&kif->kf_sa_peer, &sock->sa_peer, kif->kf_sa_peer.ss_len);
1518 
1519 	/*
1520 	 * Protocol specific data.
1521 	 */
1522 	switch(sock->dom_family) {
1523 	case AF_INET:
1524 	case AF_INET6:
1525 		if (sock->proto == IPPROTO_TCP)
1526 			sock->inp_ppcb = kif->kf_un.kf_sock.kf_sock_inpcb;
1527 		break;
1528 	case AF_UNIX:
1529 		if (kif->kf_un.kf_sock.kf_sock_unpconn != 0) {
1530 				sock->so_rcv_sb_state =
1531 				    kif->kf_un.kf_sock.kf_sock_rcv_sb_state;
1532 				sock->so_snd_sb_state =
1533 				    kif->kf_un.kf_sock.kf_sock_snd_sb_state;
1534 				sock->unp_conn =
1535 				    kif->kf_un.kf_sock.kf_sock_unpconn;
1536 		}
1537 		break;
1538 	default:
1539 		break;
1540 	}
1541 	return (0);
1542 }
1543 
1544 /*
1545  * Descriptor flags to filestat translation.
1546  */
1547 static int
1548 to_filestat_flags(int flags)
1549 {
1550 	static struct {
1551 		int flag;
1552 		int fst_flag;
1553 	} fstflags[] = {
1554 		{ FREAD, PS_FST_FFLAG_READ },
1555 		{ FWRITE, PS_FST_FFLAG_WRITE },
1556 		{ O_APPEND, PS_FST_FFLAG_APPEND },
1557 		{ O_ASYNC, PS_FST_FFLAG_ASYNC },
1558 		{ O_CREAT, PS_FST_FFLAG_CREAT },
1559 		{ O_DIRECT, PS_FST_FFLAG_DIRECT },
1560 		{ O_EXCL, PS_FST_FFLAG_EXCL },
1561 		{ O_EXEC, PS_FST_FFLAG_EXEC },
1562 		{ O_EXLOCK, PS_FST_FFLAG_EXLOCK },
1563 		{ O_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
1564 		{ O_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
1565 		{ O_SHLOCK, PS_FST_FFLAG_SHLOCK },
1566 		{ O_SYNC, PS_FST_FFLAG_SYNC },
1567 		{ O_TRUNC, PS_FST_FFLAG_TRUNC }
1568 	};
1569 #define NFSTFLAGS	(sizeof(fstflags) / sizeof(*fstflags))
1570 	int fst_flags;
1571 	unsigned int i;
1572 
1573 	fst_flags = 0;
1574 	for (i = 0; i < NFSTFLAGS; i++)
1575 		if (flags & fstflags[i].flag)
1576 			fst_flags |= fstflags[i].fst_flag;
1577 	return (fst_flags);
1578 }
1579 
1580 /*
1581  * Vnode type to filestate translation.
1582  */
1583 static int
1584 vntype2psfsttype(int type)
1585 {
1586 	static struct {
1587 		int	vtype;
1588 		int	fst_vtype;
1589 	} vt2fst[] = {
1590 		{ VBAD, PS_FST_VTYPE_VBAD },
1591 		{ VBLK, PS_FST_VTYPE_VBLK },
1592 		{ VCHR, PS_FST_VTYPE_VCHR },
1593 		{ VDIR, PS_FST_VTYPE_VDIR },
1594 		{ VFIFO, PS_FST_VTYPE_VFIFO },
1595 		{ VLNK, PS_FST_VTYPE_VLNK },
1596 		{ VNON, PS_FST_VTYPE_VNON },
1597 		{ VREG, PS_FST_VTYPE_VREG },
1598 		{ VSOCK, PS_FST_VTYPE_VSOCK }
1599 	};
1600 #define	NVFTYPES	(sizeof(vt2fst) / sizeof(*vt2fst))
1601 	unsigned int i, fst_type;
1602 
1603 	fst_type = PS_FST_VTYPE_UNKNOWN;
1604 	for (i = 0; i < NVFTYPES; i++) {
1605 		if (type == vt2fst[i].vtype) {
1606 			fst_type = vt2fst[i].fst_vtype;
1607 			break;
1608 		}
1609 	}
1610 	return (fst_type);
1611 }
1612 
1613 static char *
1614 getmnton(kvm_t *kd, struct mount *m)
1615 {
1616 	struct mount mnt;
1617 	static struct mtab {
1618 		struct mtab *next;
1619 		struct mount *m;
1620 		char mntonname[MNAMELEN + 1];
1621 	} *mhead = NULL;
1622 	struct mtab *mt;
1623 
1624 	for (mt = mhead; mt != NULL; mt = mt->next)
1625 		if (m == mt->m)
1626 			return (mt->mntonname);
1627 	if (!kvm_read_all(kd, (unsigned long)m, &mnt, sizeof(struct mount))) {
1628 		warnx("can't read mount table at %p", (void *)m);
1629 		return (NULL);
1630 	}
1631 	if ((mt = malloc(sizeof (struct mtab))) == NULL)
1632 		err(1, NULL);
1633 	mt->m = m;
1634 	bcopy(&mnt.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
1635 	mt->mntonname[MNAMELEN] = '\0';
1636 	mt->next = mhead;
1637 	mhead = mt;
1638 	return (mt->mntonname);
1639 }
1640 
1641 /*
1642  * Auxiliary structures and functions to get process environment or
1643  * command line arguments.
1644  */
1645 struct argvec {
1646 	char	*buf;
1647 	size_t	bufsize;
1648 	char	**argv;
1649 	size_t	argc;
1650 };
1651 
1652 static struct argvec *
1653 argvec_alloc(size_t bufsize)
1654 {
1655 	struct argvec *av;
1656 
1657 	av = malloc(sizeof(*av));
1658 	if (av == NULL)
1659 		return (NULL);
1660 	av->bufsize = bufsize;
1661 	av->buf = malloc(av->bufsize);
1662 	if (av->buf == NULL) {
1663 		free(av);
1664 		return (NULL);
1665 	}
1666 	av->argc = 32;
1667 	av->argv = malloc(sizeof(char *) * av->argc);
1668 	if (av->argv == NULL) {
1669 		free(av->buf);
1670 		free(av);
1671 		return (NULL);
1672 	}
1673 	return av;
1674 }
1675 
1676 static void
1677 argvec_free(struct argvec * av)
1678 {
1679 
1680 	free(av->argv);
1681 	free(av->buf);
1682 	free(av);
1683 }
1684 
1685 static char **
1686 getargv(struct procstat *procstat, struct kinfo_proc *kp, size_t nchr, int env)
1687 {
1688 	int error, name[4], argc, i;
1689 	struct argvec *av, **avp;
1690 	enum psc_type type;
1691 	size_t len;
1692 	char *p, **argv;
1693 
1694 	assert(procstat);
1695 	assert(kp);
1696 	if (procstat->type == PROCSTAT_KVM) {
1697 		warnx("can't use kvm access method");
1698 		return (NULL);
1699 	}
1700 	if (procstat->type != PROCSTAT_SYSCTL &&
1701 	    procstat->type != PROCSTAT_CORE) {
1702 		warnx("unknown access method: %d", procstat->type);
1703 		return (NULL);
1704 	}
1705 
1706 	if (nchr == 0 || nchr > ARG_MAX)
1707 		nchr = ARG_MAX;
1708 
1709 	avp = (struct argvec **)(env ? &procstat->argv : &procstat->envv);
1710 	av = *avp;
1711 
1712 	if (av == NULL)
1713 	{
1714 		av = argvec_alloc(nchr);
1715 		if (av == NULL)
1716 		{
1717 			warn("malloc(%zu)", nchr);
1718 			return (NULL);
1719 		}
1720 		*avp = av;
1721 	} else if (av->bufsize < nchr) {
1722 		av->buf = reallocf(av->buf, nchr);
1723 		if (av->buf == NULL) {
1724 			warn("malloc(%zu)", nchr);
1725 			return (NULL);
1726 		}
1727 	}
1728 	if (procstat->type == PROCSTAT_SYSCTL) {
1729 		name[0] = CTL_KERN;
1730 		name[1] = KERN_PROC;
1731 		name[2] = env ? KERN_PROC_ENV : KERN_PROC_ARGS;
1732 		name[3] = kp->ki_pid;
1733 		len = nchr;
1734 		error = sysctl(name, 4, av->buf, &len, NULL, 0);
1735 		if (error != 0 && errno != ESRCH && errno != EPERM)
1736 			warn("sysctl(kern.proc.%s)", env ? "env" : "args");
1737 		if (error != 0 || len == 0)
1738 			return (NULL);
1739 	} else /* procstat->type == PROCSTAT_CORE */ {
1740 		type = env ? PSC_TYPE_ENVV : PSC_TYPE_ARGV;
1741 		len = nchr;
1742 		if (procstat_core_get(procstat->core, type, av->buf, &len)
1743 		    == NULL) {
1744 			return (NULL);
1745 		}
1746 	}
1747 
1748 	argv = av->argv;
1749 	argc = av->argc;
1750 	i = 0;
1751 	for (p = av->buf; p < av->buf + len; p += strlen(p) + 1) {
1752 		argv[i++] = p;
1753 		if (i < argc)
1754 			continue;
1755 		/* Grow argv. */
1756 		argc += argc;
1757 		argv = realloc(argv, sizeof(char *) * argc);
1758 		if (argv == NULL) {
1759 			warn("malloc(%zu)", sizeof(char *) * argc);
1760 			return (NULL);
1761 		}
1762 		av->argv = argv;
1763 		av->argc = argc;
1764 	}
1765 	argv[i] = NULL;
1766 
1767 	return (argv);
1768 }
1769 
1770 /*
1771  * Return process command line arguments.
1772  */
1773 char **
1774 procstat_getargv(struct procstat *procstat, struct kinfo_proc *p, size_t nchr)
1775 {
1776 
1777 	return (getargv(procstat, p, nchr, 0));
1778 }
1779 
1780 /*
1781  * Free the buffer allocated by procstat_getargv().
1782  */
1783 void
1784 procstat_freeargv(struct procstat *procstat)
1785 {
1786 
1787 	if (procstat->argv != NULL) {
1788 		argvec_free(procstat->argv);
1789 		procstat->argv = NULL;
1790 	}
1791 }
1792 
1793 /*
1794  * Return process environment.
1795  */
1796 char **
1797 procstat_getenvv(struct procstat *procstat, struct kinfo_proc *p, size_t nchr)
1798 {
1799 
1800 	return (getargv(procstat, p, nchr, 1));
1801 }
1802 
1803 /*
1804  * Free the buffer allocated by procstat_getenvv().
1805  */
1806 void
1807 procstat_freeenvv(struct procstat *procstat)
1808 {
1809 	if (procstat->envv != NULL) {
1810 		argvec_free(procstat->envv);
1811 		procstat->envv = NULL;
1812 	}
1813 }
1814 
1815 static struct kinfo_vmentry *
1816 kinfo_getvmmap_core(struct procstat_core *core, int *cntp)
1817 {
1818 	int cnt;
1819 	size_t len;
1820 	char *buf, *bp, *eb;
1821 	struct kinfo_vmentry *kiv, *kp, *kv;
1822 
1823 	buf = procstat_core_get(core, PSC_TYPE_VMMAP, NULL, &len);
1824 	if (buf == NULL)
1825 		return (NULL);
1826 
1827 	/*
1828 	 * XXXMG: The code below is just copy&past from libutil.
1829 	 * The code duplication can be avoided if libutil
1830 	 * is extended to provide something like:
1831 	 *   struct kinfo_vmentry *kinfo_getvmmap_from_buf(const char *buf,
1832 	 *       size_t len, int *cntp);
1833 	 */
1834 
1835 	/* Pass 1: count items */
1836 	cnt = 0;
1837 	bp = buf;
1838 	eb = buf + len;
1839 	while (bp < eb) {
1840 		kv = (struct kinfo_vmentry *)(uintptr_t)bp;
1841 		bp += kv->kve_structsize;
1842 		cnt++;
1843 	}
1844 
1845 	kiv = calloc(cnt, sizeof(*kiv));
1846 	if (kiv == NULL) {
1847 		free(buf);
1848 		return (NULL);
1849 	}
1850 	bp = buf;
1851 	eb = buf + len;
1852 	kp = kiv;
1853 	/* Pass 2: unpack */
1854 	while (bp < eb) {
1855 		kv = (struct kinfo_vmentry *)(uintptr_t)bp;
1856 		/* Copy/expand into pre-zeroed buffer */
1857 		memcpy(kp, kv, kv->kve_structsize);
1858 		/* Advance to next packed record */
1859 		bp += kv->kve_structsize;
1860 		/* Set field size to fixed length, advance */
1861 		kp->kve_structsize = sizeof(*kp);
1862 		kp++;
1863 	}
1864 	free(buf);
1865 	*cntp = cnt;
1866 	return (kiv);	/* Caller must free() return value */
1867 }
1868 
1869 struct kinfo_vmentry *
1870 procstat_getvmmap(struct procstat *procstat, struct kinfo_proc *kp,
1871     unsigned int *cntp)
1872 {
1873 
1874 	switch(procstat->type) {
1875 	case PROCSTAT_KVM:
1876 		warnx("kvm method is not supported");
1877 		return (NULL);
1878 	case PROCSTAT_SYSCTL:
1879 		return (kinfo_getvmmap(kp->ki_pid, cntp));
1880 	case PROCSTAT_CORE:
1881 		return (kinfo_getvmmap_core(procstat->core, cntp));
1882 	default:
1883 		warnx("unknown access method: %d", procstat->type);
1884 		return (NULL);
1885 	}
1886 }
1887 
1888 void
1889 procstat_freevmmap(struct procstat *procstat __unused,
1890     struct kinfo_vmentry *vmmap)
1891 {
1892 
1893 	free(vmmap);
1894 }
1895 
1896 static gid_t *
1897 procstat_getgroups_kvm(kvm_t *kd, struct kinfo_proc *kp, unsigned int *cntp)
1898 {
1899 	struct proc proc;
1900 	struct ucred ucred;
1901 	gid_t *groups;
1902 	size_t len;
1903 
1904 	assert(kd != NULL);
1905 	assert(kp != NULL);
1906 	if (!kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
1907 	    sizeof(proc))) {
1908 		warnx("can't read proc struct at %p for pid %d",
1909 		    kp->ki_paddr, kp->ki_pid);
1910 		return (NULL);
1911 	}
1912 	if (proc.p_ucred == NOCRED)
1913 		return (NULL);
1914 	if (!kvm_read_all(kd, (unsigned long)proc.p_ucred, &ucred,
1915 	    sizeof(ucred))) {
1916 		warnx("can't read ucred struct at %p for pid %d",
1917 		    proc.p_ucred, kp->ki_pid);
1918 		return (NULL);
1919 	}
1920 	len = ucred.cr_ngroups * sizeof(gid_t);
1921 	groups = malloc(len);
1922 	if (groups == NULL) {
1923 		warn("malloc(%zu)", len);
1924 		return (NULL);
1925 	}
1926 	if (!kvm_read_all(kd, (unsigned long)ucred.cr_groups, groups, len)) {
1927 		warnx("can't read groups at %p for pid %d",
1928 		    ucred.cr_groups, kp->ki_pid);
1929 		free(groups);
1930 		return (NULL);
1931 	}
1932 	*cntp = ucred.cr_ngroups;
1933 	return (groups);
1934 }
1935 
1936 static gid_t *
1937 procstat_getgroups_sysctl(pid_t pid, unsigned int *cntp)
1938 {
1939 	int mib[4];
1940 	size_t len;
1941 	gid_t *groups;
1942 
1943 	mib[0] = CTL_KERN;
1944 	mib[1] = KERN_PROC;
1945 	mib[2] = KERN_PROC_GROUPS;
1946 	mib[3] = pid;
1947 	len = (sysconf(_SC_NGROUPS_MAX) + 1) * sizeof(gid_t);
1948 	groups = malloc(len);
1949 	if (groups == NULL) {
1950 		warn("malloc(%zu)", len);
1951 		return (NULL);
1952 	}
1953 	if (sysctl(mib, 4, groups, &len, NULL, 0) == -1) {
1954 		warn("sysctl: kern.proc.groups: %d", pid);
1955 		free(groups);
1956 		return (NULL);
1957 	}
1958 	*cntp = len / sizeof(gid_t);
1959 	return (groups);
1960 }
1961 
1962 static gid_t *
1963 procstat_getgroups_core(struct procstat_core *core, unsigned int *cntp)
1964 {
1965 	size_t len;
1966 	gid_t *groups;
1967 
1968 	groups = procstat_core_get(core, PSC_TYPE_GROUPS, NULL, &len);
1969 	if (groups == NULL)
1970 		return (NULL);
1971 	*cntp = len / sizeof(gid_t);
1972 	return (groups);
1973 }
1974 
1975 gid_t *
1976 procstat_getgroups(struct procstat *procstat, struct kinfo_proc *kp,
1977     unsigned int *cntp)
1978 {
1979 	switch(procstat->type) {
1980 	case PROCSTAT_KVM:
1981 		return (procstat_getgroups_kvm(procstat->kd, kp, cntp));
1982 	case PROCSTAT_SYSCTL:
1983 		return (procstat_getgroups_sysctl(kp->ki_pid, cntp));
1984 	case PROCSTAT_CORE:
1985 		return (procstat_getgroups_core(procstat->core, cntp));
1986 	default:
1987 		warnx("unknown access method: %d", procstat->type);
1988 		return (NULL);
1989 	}
1990 }
1991 
1992 void
1993 procstat_freegroups(struct procstat *procstat __unused, gid_t *groups)
1994 {
1995 
1996 	free(groups);
1997 }
1998 
1999 static int
2000 procstat_getumask_kvm(kvm_t *kd, struct kinfo_proc *kp, unsigned short *maskp)
2001 {
2002 	struct filedesc fd;
2003 
2004 	assert(kd != NULL);
2005 	assert(kp != NULL);
2006 	if (kp->ki_fd == NULL)
2007 		return (-1);
2008 	if (!kvm_read_all(kd, (unsigned long)kp->ki_fd, &fd, sizeof(fd))) {
2009 		warnx("can't read filedesc at %p for pid %d", kp->ki_fd,
2010 		    kp->ki_pid);
2011 		return (-1);
2012 	}
2013 	*maskp = fd.fd_cmask;
2014 	return (0);
2015 }
2016 
2017 static int
2018 procstat_getumask_sysctl(pid_t pid, unsigned short *maskp)
2019 {
2020 	int error;
2021 	int mib[4];
2022 	size_t len;
2023 
2024 	mib[0] = CTL_KERN;
2025 	mib[1] = KERN_PROC;
2026 	mib[2] = KERN_PROC_UMASK;
2027 	mib[3] = pid;
2028 	len = sizeof(*maskp);
2029 	error = sysctl(mib, 4, maskp, &len, NULL, 0);
2030 	if (error != 0 && errno != ESRCH)
2031 		warn("sysctl: kern.proc.umask: %d", pid);
2032 	return (error);
2033 }
2034 
2035 static int
2036 procstat_getumask_core(struct procstat_core *core, unsigned short *maskp)
2037 {
2038 	size_t len;
2039 	unsigned short *buf;
2040 
2041 	buf = procstat_core_get(core, PSC_TYPE_UMASK, NULL, &len);
2042 	if (buf == NULL)
2043 		return (-1);
2044 	if (len < sizeof(*maskp)) {
2045 		free(buf);
2046 		return (-1);
2047 	}
2048 	*maskp = *buf;
2049 	free(buf);
2050 	return (0);
2051 }
2052 
2053 int
2054 procstat_getumask(struct procstat *procstat, struct kinfo_proc *kp,
2055     unsigned short *maskp)
2056 {
2057 	switch(procstat->type) {
2058 	case PROCSTAT_KVM:
2059 		return (procstat_getumask_kvm(procstat->kd, kp, maskp));
2060 	case PROCSTAT_SYSCTL:
2061 		return (procstat_getumask_sysctl(kp->ki_pid, maskp));
2062 	case PROCSTAT_CORE:
2063 		return (procstat_getumask_core(procstat->core, maskp));
2064 	default:
2065 		warnx("unknown access method: %d", procstat->type);
2066 		return (-1);
2067 	}
2068 }
2069 
2070 static int
2071 procstat_getrlimit_kvm(kvm_t *kd, struct kinfo_proc *kp, int which,
2072     struct rlimit* rlimit)
2073 {
2074 	struct proc proc;
2075 	unsigned long offset;
2076 
2077 	assert(kd != NULL);
2078 	assert(kp != NULL);
2079 	assert(which >= 0 && which < RLIM_NLIMITS);
2080 	if (!kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
2081 	    sizeof(proc))) {
2082 		warnx("can't read proc struct at %p for pid %d",
2083 		    kp->ki_paddr, kp->ki_pid);
2084 		return (-1);
2085 	}
2086 	if (proc.p_limit == NULL)
2087 		return (-1);
2088 	offset = (unsigned long)proc.p_limit + sizeof(struct rlimit) * which;
2089 	if (!kvm_read_all(kd, offset, rlimit, sizeof(*rlimit))) {
2090 		warnx("can't read rlimit struct at %p for pid %d",
2091 		    (void *)offset, kp->ki_pid);
2092 		return (-1);
2093 	}
2094 	return (0);
2095 }
2096 
2097 static int
2098 procstat_getrlimit_sysctl(pid_t pid, int which, struct rlimit* rlimit)
2099 {
2100 	int error, name[5];
2101 	size_t len;
2102 
2103 	name[0] = CTL_KERN;
2104 	name[1] = KERN_PROC;
2105 	name[2] = KERN_PROC_RLIMIT;
2106 	name[3] = pid;
2107 	name[4] = which;
2108 	len = sizeof(struct rlimit);
2109 	error = sysctl(name, 5, rlimit, &len, NULL, 0);
2110 	if (error < 0 && errno != ESRCH) {
2111 		warn("sysctl: kern.proc.rlimit: %d", pid);
2112 		return (-1);
2113 	}
2114 	if (error < 0 || len != sizeof(struct rlimit))
2115 		return (-1);
2116 	return (0);
2117 }
2118 
2119 static int
2120 procstat_getrlimit_core(struct procstat_core *core, int which,
2121     struct rlimit* rlimit)
2122 {
2123 	size_t len;
2124 	struct rlimit* rlimits;
2125 
2126 	if (which < 0 || which >= RLIM_NLIMITS) {
2127 		errno = EINVAL;
2128 		warn("getrlimit: which");
2129 		return (-1);
2130 	}
2131 	rlimits = procstat_core_get(core, PSC_TYPE_RLIMIT, NULL, &len);
2132 	if (rlimits == NULL)
2133 		return (-1);
2134 	if (len < sizeof(struct rlimit) * RLIM_NLIMITS) {
2135 		free(rlimits);
2136 		return (-1);
2137 	}
2138 	*rlimit = rlimits[which];
2139 	return (0);
2140 }
2141 
2142 int
2143 procstat_getrlimit(struct procstat *procstat, struct kinfo_proc *kp, int which,
2144     struct rlimit* rlimit)
2145 {
2146 	switch(procstat->type) {
2147 	case PROCSTAT_KVM:
2148 		return (procstat_getrlimit_kvm(procstat->kd, kp, which,
2149 		    rlimit));
2150 	case PROCSTAT_SYSCTL:
2151 		return (procstat_getrlimit_sysctl(kp->ki_pid, which, rlimit));
2152 	case PROCSTAT_CORE:
2153 		return (procstat_getrlimit_core(procstat->core, which, rlimit));
2154 	default:
2155 		warnx("unknown access method: %d", procstat->type);
2156 		return (-1);
2157 	}
2158 }
2159 
2160 static int
2161 procstat_getpathname_sysctl(pid_t pid, char *pathname, size_t maxlen)
2162 {
2163 	int error, name[4];
2164 	size_t len;
2165 
2166 	name[0] = CTL_KERN;
2167 	name[1] = KERN_PROC;
2168 	name[2] = KERN_PROC_PATHNAME;
2169 	name[3] = pid;
2170 	len = maxlen;
2171 	error = sysctl(name, 4, pathname, &len, NULL, 0);
2172 	if (error != 0 && errno != ESRCH)
2173 		warn("sysctl: kern.proc.pathname: %d", pid);
2174 	if (len == 0)
2175 		pathname[0] = '\0';
2176 	return (error);
2177 }
2178 
2179 static int
2180 procstat_getpathname_core(struct procstat_core *core, char *pathname,
2181     size_t maxlen)
2182 {
2183 	struct kinfo_file *files;
2184 	int cnt, i, result;
2185 
2186 	files = kinfo_getfile_core(core, &cnt);
2187 	if (files == NULL)
2188 		return (-1);
2189 	result = -1;
2190 	for (i = 0; i < cnt; i++) {
2191 		if (files[i].kf_fd != KF_FD_TYPE_TEXT)
2192 			continue;
2193 		strncpy(pathname, files[i].kf_path, maxlen);
2194 		result = 0;
2195 		break;
2196 	}
2197 	free(files);
2198 	return (result);
2199 }
2200 
2201 int
2202 procstat_getpathname(struct procstat *procstat, struct kinfo_proc *kp,
2203     char *pathname, size_t maxlen)
2204 {
2205 	switch(procstat->type) {
2206 	case PROCSTAT_KVM:
2207 		/* XXX: Return empty string. */
2208 		if (maxlen > 0)
2209 			pathname[0] = '\0';
2210 		return (0);
2211 	case PROCSTAT_SYSCTL:
2212 		return (procstat_getpathname_sysctl(kp->ki_pid, pathname,
2213 		    maxlen));
2214 	case PROCSTAT_CORE:
2215 		return (procstat_getpathname_core(procstat->core, pathname,
2216 		    maxlen));
2217 	default:
2218 		warnx("unknown access method: %d", procstat->type);
2219 		return (-1);
2220 	}
2221 }
2222 
2223 static int
2224 procstat_getosrel_kvm(kvm_t *kd, struct kinfo_proc *kp, int *osrelp)
2225 {
2226 	struct proc proc;
2227 
2228 	assert(kd != NULL);
2229 	assert(kp != NULL);
2230 	if (!kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
2231 	    sizeof(proc))) {
2232 		warnx("can't read proc struct at %p for pid %d",
2233 		    kp->ki_paddr, kp->ki_pid);
2234 		return (-1);
2235 	}
2236 	*osrelp = proc.p_osrel;
2237 	return (0);
2238 }
2239 
2240 static int
2241 procstat_getosrel_sysctl(pid_t pid, int *osrelp)
2242 {
2243 	int error, name[4];
2244 	size_t len;
2245 
2246 	name[0] = CTL_KERN;
2247 	name[1] = KERN_PROC;
2248 	name[2] = KERN_PROC_OSREL;
2249 	name[3] = pid;
2250 	len = sizeof(*osrelp);
2251 	error = sysctl(name, 4, osrelp, &len, NULL, 0);
2252 	if (error != 0 && errno != ESRCH)
2253 		warn("sysctl: kern.proc.osrel: %d", pid);
2254 	return (error);
2255 }
2256 
2257 static int
2258 procstat_getosrel_core(struct procstat_core *core, int *osrelp)
2259 {
2260 	size_t len;
2261 	int *buf;
2262 
2263 	buf = procstat_core_get(core, PSC_TYPE_OSREL, NULL, &len);
2264 	if (buf == NULL)
2265 		return (-1);
2266 	if (len < sizeof(*osrelp)) {
2267 		free(buf);
2268 		return (-1);
2269 	}
2270 	*osrelp = *buf;
2271 	free(buf);
2272 	return (0);
2273 }
2274 
2275 int
2276 procstat_getosrel(struct procstat *procstat, struct kinfo_proc *kp, int *osrelp)
2277 {
2278 	switch(procstat->type) {
2279 	case PROCSTAT_KVM:
2280 		return (procstat_getosrel_kvm(procstat->kd, kp, osrelp));
2281 	case PROCSTAT_SYSCTL:
2282 		return (procstat_getosrel_sysctl(kp->ki_pid, osrelp));
2283 	case PROCSTAT_CORE:
2284 		return (procstat_getosrel_core(procstat->core, osrelp));
2285 	default:
2286 		warnx("unknown access method: %d", procstat->type);
2287 		return (-1);
2288 	}
2289 }
2290 
2291 #define PROC_AUXV_MAX	256
2292 
2293 #if __ELF_WORD_SIZE == 64
2294 static const char *elf32_sv_names[] = {
2295 	"Linux ELF32",
2296 	"FreeBSD ELF32",
2297 };
2298 
2299 static int
2300 is_elf32_sysctl(pid_t pid)
2301 {
2302 	int error, name[4];
2303 	size_t len, i;
2304 	static char sv_name[256];
2305 
2306 	name[0] = CTL_KERN;
2307 	name[1] = KERN_PROC;
2308 	name[2] = KERN_PROC_SV_NAME;
2309 	name[3] = pid;
2310 	len = sizeof(sv_name);
2311 	error = sysctl(name, 4, sv_name, &len, NULL, 0);
2312 	if (error != 0 || len == 0)
2313 		return (0);
2314 	for (i = 0; i < sizeof(elf32_sv_names) / sizeof(*elf32_sv_names); i++) {
2315 		if (strncmp(sv_name, elf32_sv_names[i], sizeof(sv_name)) == 0)
2316 			return (1);
2317 	}
2318 	return (0);
2319 }
2320 
2321 static Elf_Auxinfo *
2322 procstat_getauxv32_sysctl(pid_t pid, unsigned int *cntp)
2323 {
2324 	Elf_Auxinfo *auxv;
2325 	Elf32_Auxinfo *auxv32;
2326 	void *ptr;
2327 	size_t len;
2328 	unsigned int i, count;
2329 	int name[4];
2330 
2331 	name[0] = CTL_KERN;
2332 	name[1] = KERN_PROC;
2333 	name[2] = KERN_PROC_AUXV;
2334 	name[3] = pid;
2335 	len = PROC_AUXV_MAX * sizeof(Elf32_Auxinfo);
2336 	auxv = NULL;
2337 	auxv32 = malloc(len);
2338 	if (auxv32 == NULL) {
2339 		warn("malloc(%zu)", len);
2340 		goto out;
2341 	}
2342 	if (sysctl(name, 4, auxv32, &len, NULL, 0) == -1) {
2343 		if (errno != ESRCH && errno != EPERM)
2344 			warn("sysctl: kern.proc.auxv: %d: %d", pid, errno);
2345 		goto out;
2346 	}
2347 	count = len / sizeof(Elf_Auxinfo);
2348 	auxv = malloc(count  * sizeof(Elf_Auxinfo));
2349 	if (auxv == NULL) {
2350 		warn("malloc(%zu)", count * sizeof(Elf_Auxinfo));
2351 		goto out;
2352 	}
2353 	for (i = 0; i < count; i++) {
2354 		/*
2355 		 * XXX: We expect that values for a_type on a 32-bit platform
2356 		 * are directly mapped to values on 64-bit one, which is not
2357 		 * necessarily true.
2358 		 */
2359 		auxv[i].a_type = auxv32[i].a_type;
2360 		ptr = &auxv32[i].a_un;
2361 		auxv[i].a_un.a_val = *((uint32_t *)ptr);
2362 	}
2363 	*cntp = count;
2364 out:
2365 	free(auxv32);
2366 	return (auxv);
2367 }
2368 #endif /* __ELF_WORD_SIZE == 64 */
2369 
2370 static Elf_Auxinfo *
2371 procstat_getauxv_sysctl(pid_t pid, unsigned int *cntp)
2372 {
2373 	Elf_Auxinfo *auxv;
2374 	int name[4];
2375 	size_t len;
2376 
2377 #if __ELF_WORD_SIZE == 64
2378 	if (is_elf32_sysctl(pid))
2379 		return (procstat_getauxv32_sysctl(pid, cntp));
2380 #endif
2381 	name[0] = CTL_KERN;
2382 	name[1] = KERN_PROC;
2383 	name[2] = KERN_PROC_AUXV;
2384 	name[3] = pid;
2385 	len = PROC_AUXV_MAX * sizeof(Elf_Auxinfo);
2386 	auxv = malloc(len);
2387 	if (auxv == NULL) {
2388 		warn("malloc(%zu)", len);
2389 		return (NULL);
2390 	}
2391 	if (sysctl(name, 4, auxv, &len, NULL, 0) == -1) {
2392 		if (errno != ESRCH && errno != EPERM)
2393 			warn("sysctl: kern.proc.auxv: %d: %d", pid, errno);
2394 		free(auxv);
2395 		return (NULL);
2396 	}
2397 	*cntp = len / sizeof(Elf_Auxinfo);
2398 	return (auxv);
2399 }
2400 
2401 static Elf_Auxinfo *
2402 procstat_getauxv_core(struct procstat_core *core, unsigned int *cntp)
2403 {
2404 	Elf_Auxinfo *auxv;
2405 	size_t len;
2406 
2407 	auxv = procstat_core_get(core, PSC_TYPE_AUXV, NULL, &len);
2408 	if (auxv == NULL)
2409 		return (NULL);
2410 	*cntp = len / sizeof(Elf_Auxinfo);
2411 	return (auxv);
2412 }
2413 
2414 Elf_Auxinfo *
2415 procstat_getauxv(struct procstat *procstat, struct kinfo_proc *kp,
2416     unsigned int *cntp)
2417 {
2418 	switch(procstat->type) {
2419 	case PROCSTAT_KVM:
2420 		warnx("kvm method is not supported");
2421 		return (NULL);
2422 	case PROCSTAT_SYSCTL:
2423 		return (procstat_getauxv_sysctl(kp->ki_pid, cntp));
2424 	case PROCSTAT_CORE:
2425 		return (procstat_getauxv_core(procstat->core, cntp));
2426 	default:
2427 		warnx("unknown access method: %d", procstat->type);
2428 		return (NULL);
2429 	}
2430 }
2431 
2432 void
2433 procstat_freeauxv(struct procstat *procstat __unused, Elf_Auxinfo *auxv)
2434 {
2435 
2436 	free(auxv);
2437 }
2438 
2439 static struct kinfo_kstack *
2440 procstat_getkstack_sysctl(pid_t pid, int *cntp)
2441 {
2442 	struct kinfo_kstack *kkstp;
2443 	int error, name[4];
2444 	size_t len;
2445 
2446 	name[0] = CTL_KERN;
2447 	name[1] = KERN_PROC;
2448 	name[2] = KERN_PROC_KSTACK;
2449 	name[3] = pid;
2450 
2451 	len = 0;
2452 	error = sysctl(name, 4, NULL, &len, NULL, 0);
2453 	if (error < 0 && errno != ESRCH && errno != EPERM && errno != ENOENT) {
2454 		warn("sysctl: kern.proc.kstack: %d", pid);
2455 		return (NULL);
2456 	}
2457 	if (error == -1 && errno == ENOENT) {
2458 		warnx("sysctl: kern.proc.kstack unavailable"
2459 		    " (options DDB or options STACK required in kernel)");
2460 		return (NULL);
2461 	}
2462 	if (error == -1)
2463 		return (NULL);
2464 	kkstp = malloc(len);
2465 	if (kkstp == NULL) {
2466 		warn("malloc(%zu)", len);
2467 		return (NULL);
2468 	}
2469 	if (sysctl(name, 4, kkstp, &len, NULL, 0) == -1) {
2470 		warn("sysctl: kern.proc.pid: %d", pid);
2471 		free(kkstp);
2472 		return (NULL);
2473 	}
2474 	*cntp = len / sizeof(*kkstp);
2475 
2476 	return (kkstp);
2477 }
2478 
2479 struct kinfo_kstack *
2480 procstat_getkstack(struct procstat *procstat, struct kinfo_proc *kp,
2481     unsigned int *cntp)
2482 {
2483 	switch(procstat->type) {
2484 	case PROCSTAT_KVM:
2485 		warnx("kvm method is not supported");
2486 		return (NULL);
2487 	case PROCSTAT_SYSCTL:
2488 		return (procstat_getkstack_sysctl(kp->ki_pid, cntp));
2489 	case PROCSTAT_CORE:
2490 		warnx("core method is not supported");
2491 		return (NULL);
2492 	default:
2493 		warnx("unknown access method: %d", procstat->type);
2494 		return (NULL);
2495 	}
2496 }
2497 
2498 void
2499 procstat_freekstack(struct procstat *procstat __unused,
2500     struct kinfo_kstack *kkstp)
2501 {
2502 
2503 	free(kkstp);
2504 }
2505