xref: /freebsd/lib/libprocstat/libprocstat.c (revision a3b4dcfd682d2f0dcad7e9e15dc00df2d7a283f2)
1 /*-
2  * SPDX-License-Identifier: BSD-4-Clause
3  *
4  * Copyright (c) 2017 Dell EMC
5  * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
6  * Copyright (c) 1988, 1993
7  *      The Regents of the University of California.  All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *      This product includes software developed by the University of
20  *      California, Berkeley and its contributors.
21  * 4. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include <sys/param.h>
42 #include <sys/elf.h>
43 #include <sys/time.h>
44 #include <sys/resourcevar.h>
45 #define	_WANT_UCRED
46 #include <sys/ucred.h>
47 #undef _WANT_UCRED
48 #include <sys/proc.h>
49 #include <sys/user.h>
50 #include <sys/stat.h>
51 #include <sys/vnode.h>
52 #include <sys/socket.h>
53 #define	_WANT_SOCKET
54 #include <sys/socketvar.h>
55 #include <sys/domain.h>
56 #include <sys/protosw.h>
57 #include <sys/un.h>
58 #define	_WANT_UNPCB
59 #include <sys/unpcb.h>
60 #include <sys/sysctl.h>
61 #include <sys/tty.h>
62 #include <sys/filedesc.h>
63 #include <sys/queue.h>
64 #define	_WANT_FILE
65 #include <sys/file.h>
66 #include <sys/conf.h>
67 #include <sys/ksem.h>
68 #include <sys/mman.h>
69 #include <sys/capsicum.h>
70 #include <sys/ptrace.h>
71 #define	_KERNEL
72 #include <sys/mount.h>
73 #include <sys/filedesc.h>
74 #include <sys/pipe.h>
75 #include <ufs/ufs/quota.h>
76 #include <ufs/ufs/inode.h>
77 #include <fs/devfs/devfs.h>
78 #include <fs/devfs/devfs_int.h>
79 #undef _KERNEL
80 #include <nfs/nfsproto.h>
81 #include <nfsclient/nfs.h>
82 #include <nfsclient/nfsnode.h>
83 
84 #include <vm/vm.h>
85 #include <vm/vm_map.h>
86 #include <vm/vm_object.h>
87 
88 #include <net/route.h>
89 #include <netinet/in.h>
90 #include <netinet/in_systm.h>
91 #include <netinet/ip.h>
92 #define	_WANT_INPCB
93 #include <netinet/in_pcb.h>
94 
95 #include <assert.h>
96 #include <ctype.h>
97 #include <err.h>
98 #include <fcntl.h>
99 #include <kvm.h>
100 #include <libutil.h>
101 #include <limits.h>
102 #include <paths.h>
103 #include <pwd.h>
104 #include <stdio.h>
105 #include <stdlib.h>
106 #include <stddef.h>
107 #include <string.h>
108 #include <unistd.h>
109 #include <netdb.h>
110 
111 #include <libprocstat.h>
112 #include "libprocstat_internal.h"
113 #include "common_kvm.h"
114 #include "core.h"
115 
116 int     statfs(const char *, struct statfs *);	/* XXX */
117 
118 #define	PROCSTAT_KVM	1
119 #define	PROCSTAT_SYSCTL	2
120 #define	PROCSTAT_CORE	3
121 
122 static char	**getargv(struct procstat *procstat, struct kinfo_proc *kp,
123     size_t nchr, int env);
124 static char	*getmnton(kvm_t *kd, struct mount *m);
125 static struct kinfo_vmentry *	kinfo_getvmmap_core(struct procstat_core *core,
126     int *cntp);
127 static Elf_Auxinfo	*procstat_getauxv_core(struct procstat_core *core,
128     unsigned int *cntp);
129 static Elf_Auxinfo	*procstat_getauxv_sysctl(pid_t pid, unsigned int *cntp);
130 static struct filestat_list	*procstat_getfiles_kvm(
131     struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
132 static struct filestat_list	*procstat_getfiles_sysctl(
133     struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
134 static int	procstat_get_pipe_info_sysctl(struct filestat *fst,
135     struct pipestat *pipe, char *errbuf);
136 static int	procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
137     struct pipestat *pipe, char *errbuf);
138 static int	procstat_get_pts_info_sysctl(struct filestat *fst,
139     struct ptsstat *pts, char *errbuf);
140 static int	procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
141     struct ptsstat *pts, char *errbuf);
142 static int	procstat_get_sem_info_sysctl(struct filestat *fst,
143     struct semstat *sem, char *errbuf);
144 static int	procstat_get_sem_info_kvm(kvm_t *kd, struct filestat *fst,
145     struct semstat *sem, char *errbuf);
146 static int	procstat_get_shm_info_sysctl(struct filestat *fst,
147     struct shmstat *shm, char *errbuf);
148 static int	procstat_get_shm_info_kvm(kvm_t *kd, struct filestat *fst,
149     struct shmstat *shm, char *errbuf);
150 static int	procstat_get_socket_info_sysctl(struct filestat *fst,
151     struct sockstat *sock, char *errbuf);
152 static int	procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
153     struct sockstat *sock, char *errbuf);
154 static int	to_filestat_flags(int flags);
155 static int	procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
156     struct vnstat *vn, char *errbuf);
157 static int	procstat_get_vnode_info_sysctl(struct filestat *fst,
158     struct vnstat *vn, char *errbuf);
159 static gid_t	*procstat_getgroups_core(struct procstat_core *core,
160     unsigned int *count);
161 static gid_t *	procstat_getgroups_kvm(kvm_t *kd, struct kinfo_proc *kp,
162     unsigned int *count);
163 static gid_t	*procstat_getgroups_sysctl(pid_t pid, unsigned int *count);
164 static struct kinfo_kstack	*procstat_getkstack_sysctl(pid_t pid,
165     int *cntp);
166 static int	procstat_getosrel_core(struct procstat_core *core,
167     int *osrelp);
168 static int	procstat_getosrel_kvm(kvm_t *kd, struct kinfo_proc *kp,
169     int *osrelp);
170 static int	procstat_getosrel_sysctl(pid_t pid, int *osrelp);
171 static int	procstat_getpathname_core(struct procstat_core *core,
172     char *pathname, size_t maxlen);
173 static int	procstat_getpathname_sysctl(pid_t pid, char *pathname,
174     size_t maxlen);
175 static int	procstat_getrlimit_core(struct procstat_core *core, int which,
176     struct rlimit* rlimit);
177 static int	procstat_getrlimit_kvm(kvm_t *kd, struct kinfo_proc *kp,
178     int which, struct rlimit* rlimit);
179 static int	procstat_getrlimit_sysctl(pid_t pid, int which,
180     struct rlimit* rlimit);
181 static int	procstat_getumask_core(struct procstat_core *core,
182     unsigned short *maskp);
183 static int	procstat_getumask_kvm(kvm_t *kd, struct kinfo_proc *kp,
184     unsigned short *maskp);
185 static int	procstat_getumask_sysctl(pid_t pid, unsigned short *maskp);
186 static int	vntype2psfsttype(int type);
187 
188 void
189 procstat_close(struct procstat *procstat)
190 {
191 
192 	assert(procstat);
193 	if (procstat->type == PROCSTAT_KVM)
194 		kvm_close(procstat->kd);
195 	else if (procstat->type == PROCSTAT_CORE)
196 		procstat_core_close(procstat->core);
197 	procstat_freeargv(procstat);
198 	procstat_freeenvv(procstat);
199 	free(procstat);
200 }
201 
202 struct procstat *
203 procstat_open_sysctl(void)
204 {
205 	struct procstat *procstat;
206 
207 	procstat = calloc(1, sizeof(*procstat));
208 	if (procstat == NULL) {
209 		warn("malloc()");
210 		return (NULL);
211 	}
212 	procstat->type = PROCSTAT_SYSCTL;
213 	return (procstat);
214 }
215 
216 struct procstat *
217 procstat_open_kvm(const char *nlistf, const char *memf)
218 {
219 	struct procstat *procstat;
220 	kvm_t *kd;
221 	char buf[_POSIX2_LINE_MAX];
222 
223 	procstat = calloc(1, sizeof(*procstat));
224 	if (procstat == NULL) {
225 		warn("malloc()");
226 		return (NULL);
227 	}
228 	kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf);
229 	if (kd == NULL) {
230 		warnx("kvm_openfiles(): %s", buf);
231 		free(procstat);
232 		return (NULL);
233 	}
234 	procstat->type = PROCSTAT_KVM;
235 	procstat->kd = kd;
236 	return (procstat);
237 }
238 
239 struct procstat *
240 procstat_open_core(const char *filename)
241 {
242 	struct procstat *procstat;
243 	struct procstat_core *core;
244 
245 	procstat = calloc(1, sizeof(*procstat));
246 	if (procstat == NULL) {
247 		warn("malloc()");
248 		return (NULL);
249 	}
250 	core = procstat_core_open(filename);
251 	if (core == NULL) {
252 		free(procstat);
253 		return (NULL);
254 	}
255 	procstat->type = PROCSTAT_CORE;
256 	procstat->core = core;
257 	return (procstat);
258 }
259 
260 struct kinfo_proc *
261 procstat_getprocs(struct procstat *procstat, int what, int arg,
262     unsigned int *count)
263 {
264 	struct kinfo_proc *p0, *p;
265 	size_t len, olen;
266 	int name[4];
267 	int cnt;
268 	int error;
269 
270 	assert(procstat);
271 	assert(count);
272 	p = NULL;
273 	if (procstat->type == PROCSTAT_KVM) {
274 		*count = 0;
275 		p0 = kvm_getprocs(procstat->kd, what, arg, &cnt);
276 		if (p0 == NULL || cnt <= 0)
277 			return (NULL);
278 		*count = cnt;
279 		len = *count * sizeof(*p);
280 		p = malloc(len);
281 		if (p == NULL) {
282 			warnx("malloc(%zu)", len);
283 			goto fail;
284 		}
285 		bcopy(p0, p, len);
286 		return (p);
287 	} else if (procstat->type == PROCSTAT_SYSCTL) {
288 		len = 0;
289 		name[0] = CTL_KERN;
290 		name[1] = KERN_PROC;
291 		name[2] = what;
292 		name[3] = arg;
293 		error = sysctl(name, nitems(name), NULL, &len, NULL, 0);
294 		if (error < 0 && errno != EPERM) {
295 			warn("sysctl(kern.proc)");
296 			goto fail;
297 		}
298 		if (len == 0) {
299 			warnx("no processes?");
300 			goto fail;
301 		}
302 		do {
303 			len += len / 10;
304 			p = reallocf(p, len);
305 			if (p == NULL) {
306 				warnx("reallocf(%zu)", len);
307 				goto fail;
308 			}
309 			olen = len;
310 			error = sysctl(name, nitems(name), p, &len, NULL, 0);
311 		} while (error < 0 && errno == ENOMEM && olen == len);
312 		if (error < 0 && errno != EPERM) {
313 			warn("sysctl(kern.proc)");
314 			goto fail;
315 		}
316 		/* Perform simple consistency checks. */
317 		if ((len % sizeof(*p)) != 0 || p->ki_structsize != sizeof(*p)) {
318 			warnx("kinfo_proc structure size mismatch (len = %zu)", len);
319 			goto fail;
320 		}
321 		*count = len / sizeof(*p);
322 		return (p);
323 	} else if (procstat->type == PROCSTAT_CORE) {
324 		p = procstat_core_get(procstat->core, PSC_TYPE_PROC, NULL,
325 		    &len);
326 		if ((len % sizeof(*p)) != 0 || p->ki_structsize != sizeof(*p)) {
327 			warnx("kinfo_proc structure size mismatch");
328 			goto fail;
329 		}
330 		*count = len / sizeof(*p);
331 		return (p);
332 	} else {
333 		warnx("unknown access method: %d", procstat->type);
334 		return (NULL);
335 	}
336 fail:
337 	if (p)
338 		free(p);
339 	return (NULL);
340 }
341 
342 void
343 procstat_freeprocs(struct procstat *procstat __unused, struct kinfo_proc *p)
344 {
345 
346 	if (p != NULL)
347 		free(p);
348 	p = NULL;
349 }
350 
351 struct filestat_list *
352 procstat_getfiles(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
353 {
354 
355 	switch(procstat->type) {
356 	case PROCSTAT_KVM:
357 		return (procstat_getfiles_kvm(procstat, kp, mmapped));
358 	case PROCSTAT_SYSCTL:
359 	case PROCSTAT_CORE:
360 		return (procstat_getfiles_sysctl(procstat, kp, mmapped));
361 	default:
362 		warnx("unknown access method: %d", procstat->type);
363 		return (NULL);
364 	}
365 }
366 
367 void
368 procstat_freefiles(struct procstat *procstat, struct filestat_list *head)
369 {
370 	struct filestat *fst, *tmp;
371 
372 	STAILQ_FOREACH_SAFE(fst, head, next, tmp) {
373 		if (fst->fs_path != NULL)
374 			free(fst->fs_path);
375 		free(fst);
376 	}
377 	free(head);
378 	if (procstat->vmentries != NULL) {
379 		free(procstat->vmentries);
380 		procstat->vmentries = NULL;
381 	}
382 	if (procstat->files != NULL) {
383 		free(procstat->files);
384 		procstat->files = NULL;
385 	}
386 }
387 
388 static struct filestat *
389 filestat_new_entry(void *typedep, int type, int fd, int fflags, int uflags,
390     int refcount, off_t offset, char *path, cap_rights_t *cap_rightsp)
391 {
392 	struct filestat *entry;
393 
394 	entry = calloc(1, sizeof(*entry));
395 	if (entry == NULL) {
396 		warn("malloc()");
397 		return (NULL);
398 	}
399 	entry->fs_typedep = typedep;
400 	entry->fs_fflags = fflags;
401 	entry->fs_uflags = uflags;
402 	entry->fs_fd = fd;
403 	entry->fs_type = type;
404 	entry->fs_ref_count = refcount;
405 	entry->fs_offset = offset;
406 	entry->fs_path = path;
407 	if (cap_rightsp != NULL)
408 		entry->fs_cap_rights = *cap_rightsp;
409 	else
410 		cap_rights_init(&entry->fs_cap_rights);
411 	return (entry);
412 }
413 
414 static struct vnode *
415 getctty(kvm_t *kd, struct kinfo_proc *kp)
416 {
417 	struct pgrp pgrp;
418 	struct proc proc;
419 	struct session sess;
420 	int error;
421 
422 	assert(kp);
423 	error = kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
424 	    sizeof(proc));
425 	if (error == 0) {
426 		warnx("can't read proc struct at %p for pid %d",
427 		    kp->ki_paddr, kp->ki_pid);
428 		return (NULL);
429 	}
430 	if (proc.p_pgrp == NULL)
431 		return (NULL);
432 	error = kvm_read_all(kd, (unsigned long)proc.p_pgrp, &pgrp,
433 	    sizeof(pgrp));
434 	if (error == 0) {
435 		warnx("can't read pgrp struct at %p for pid %d",
436 		    proc.p_pgrp, kp->ki_pid);
437 		return (NULL);
438 	}
439 	error = kvm_read_all(kd, (unsigned long)pgrp.pg_session, &sess,
440 	    sizeof(sess));
441 	if (error == 0) {
442 		warnx("can't read session struct at %p for pid %d",
443 		    pgrp.pg_session, kp->ki_pid);
444 		return (NULL);
445 	}
446 	return (sess.s_ttyvp);
447 }
448 
449 static int
450 procstat_vm_map_reader(void *token, vm_map_entry_t addr, vm_map_entry_t dest)
451 {
452 	kvm_t *kd;
453 
454 	kd = (kvm_t *)token;
455 	return (kvm_read_all(kd, (unsigned long)addr, dest, sizeof(*dest)));
456 }
457 
458 static struct filestat_list *
459 procstat_getfiles_kvm(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
460 {
461 	struct file file;
462 	struct filedesc filed;
463 	struct pwddesc pathsd;
464 	struct fdescenttbl *fdt;
465 	struct pwd pwd;
466 	unsigned long pwd_addr;
467 	struct vm_map_entry vmentry;
468 	struct vm_object object;
469 	struct vmspace vmspace;
470 	vm_map_entry_t entryp;
471 	vm_object_t objp;
472 	struct vnode *vp;
473 	struct filestat *entry;
474 	struct filestat_list *head;
475 	kvm_t *kd;
476 	void *data;
477 	int fflags;
478 	unsigned int i;
479 	int prot, type;
480 	size_t fdt_size;
481 	unsigned int nfiles;
482 	bool haspwd;
483 
484 	assert(procstat);
485 	kd = procstat->kd;
486 	if (kd == NULL)
487 		return (NULL);
488 	if (kp->ki_fd == NULL || kp->ki_pd == NULL)
489 		return (NULL);
490 	if (!kvm_read_all(kd, (unsigned long)kp->ki_fd, &filed,
491 	    sizeof(filed))) {
492 		warnx("can't read filedesc at %p", (void *)kp->ki_fd);
493 		return (NULL);
494 	}
495 	if (!kvm_read_all(kd, (unsigned long)kp->ki_pd, &pathsd,
496 	    sizeof(pathsd))) {
497 		warnx("can't read pwddesc at %p", (void *)kp->ki_pd);
498 		return (NULL);
499 	}
500 	haspwd = false;
501 	pwd_addr = (unsigned long)(PWDDESC_KVM_LOAD_PWD(&pathsd));
502 	if (pwd_addr != 0) {
503 		if (!kvm_read_all(kd, pwd_addr, &pwd, sizeof(pwd))) {
504 			warnx("can't read fd_pwd at %p", (void *)pwd_addr);
505 			return (NULL);
506 		}
507 		haspwd = true;
508 	}
509 
510 	/*
511 	 * Allocate list head.
512 	 */
513 	head = malloc(sizeof(*head));
514 	if (head == NULL)
515 		return (NULL);
516 	STAILQ_INIT(head);
517 
518 	/* root directory vnode, if one. */
519 	if (haspwd) {
520 		if (pwd.pwd_rdir) {
521 			entry = filestat_new_entry(pwd.pwd_rdir, PS_FST_TYPE_VNODE, -1,
522 			    PS_FST_FFLAG_READ, PS_FST_UFLAG_RDIR, 0, 0, NULL, NULL);
523 			if (entry != NULL)
524 				STAILQ_INSERT_TAIL(head, entry, next);
525 		}
526 		/* current working directory vnode. */
527 		if (pwd.pwd_cdir) {
528 			entry = filestat_new_entry(pwd.pwd_cdir, PS_FST_TYPE_VNODE, -1,
529 			    PS_FST_FFLAG_READ, PS_FST_UFLAG_CDIR, 0, 0, NULL, NULL);
530 			if (entry != NULL)
531 				STAILQ_INSERT_TAIL(head, entry, next);
532 		}
533 		/* jail root, if any. */
534 		if (pwd.pwd_jdir) {
535 			entry = filestat_new_entry(pwd.pwd_jdir, PS_FST_TYPE_VNODE, -1,
536 			    PS_FST_FFLAG_READ, PS_FST_UFLAG_JAIL, 0, 0, NULL, NULL);
537 			if (entry != NULL)
538 				STAILQ_INSERT_TAIL(head, entry, next);
539 		}
540 	}
541 	/* ktrace vnode, if one */
542 	if (kp->ki_tracep) {
543 		entry = filestat_new_entry(kp->ki_tracep, PS_FST_TYPE_VNODE, -1,
544 		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
545 		    PS_FST_UFLAG_TRACE, 0, 0, NULL, NULL);
546 		if (entry != NULL)
547 			STAILQ_INSERT_TAIL(head, entry, next);
548 	}
549 	/* text vnode, if one */
550 	if (kp->ki_textvp) {
551 		entry = filestat_new_entry(kp->ki_textvp, PS_FST_TYPE_VNODE, -1,
552 		    PS_FST_FFLAG_READ, PS_FST_UFLAG_TEXT, 0, 0, NULL, NULL);
553 		if (entry != NULL)
554 			STAILQ_INSERT_TAIL(head, entry, next);
555 	}
556 	/* Controlling terminal. */
557 	if ((vp = getctty(kd, kp)) != NULL) {
558 		entry = filestat_new_entry(vp, PS_FST_TYPE_VNODE, -1,
559 		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
560 		    PS_FST_UFLAG_CTTY, 0, 0, NULL, NULL);
561 		if (entry != NULL)
562 			STAILQ_INSERT_TAIL(head, entry, next);
563 	}
564 
565 	if (!kvm_read_all(kd, (unsigned long)filed.fd_files, &nfiles,
566 	    sizeof(nfiles))) {
567 		warnx("can't read fd_files at %p", (void *)filed.fd_files);
568 		return (NULL);
569 	}
570 
571 	fdt_size = sizeof(*fdt) + nfiles * sizeof(struct filedescent);
572 	fdt = malloc(fdt_size);
573 	if (fdt == NULL) {
574 		warn("malloc(%zu)", fdt_size);
575 		goto do_mmapped;
576 	}
577 	if (!kvm_read_all(kd, (unsigned long)filed.fd_files, fdt, fdt_size)) {
578 		warnx("cannot read file structures at %p", (void *)filed.fd_files);
579 		free(fdt);
580 		goto do_mmapped;
581 	}
582 	for (i = 0; i < nfiles; i++) {
583 		if (fdt->fdt_ofiles[i].fde_file == NULL) {
584 			continue;
585 		}
586 		if (!kvm_read_all(kd, (unsigned long)fdt->fdt_ofiles[i].fde_file, &file,
587 		    sizeof(struct file))) {
588 			warnx("can't read file %d at %p", i,
589 			    (void *)fdt->fdt_ofiles[i].fde_file);
590 			continue;
591 		}
592 		switch (file.f_type) {
593 		case DTYPE_VNODE:
594 			type = PS_FST_TYPE_VNODE;
595 			data = file.f_vnode;
596 			break;
597 		case DTYPE_SOCKET:
598 			type = PS_FST_TYPE_SOCKET;
599 			data = file.f_data;
600 			break;
601 		case DTYPE_PIPE:
602 			type = PS_FST_TYPE_PIPE;
603 			data = file.f_data;
604 			break;
605 		case DTYPE_FIFO:
606 			type = PS_FST_TYPE_FIFO;
607 			data = file.f_vnode;
608 			break;
609 #ifdef DTYPE_PTS
610 		case DTYPE_PTS:
611 			type = PS_FST_TYPE_PTS;
612 			data = file.f_data;
613 			break;
614 #endif
615 		case DTYPE_SEM:
616 			type = PS_FST_TYPE_SEM;
617 			data = file.f_data;
618 			break;
619 		case DTYPE_SHM:
620 			type = PS_FST_TYPE_SHM;
621 			data = file.f_data;
622 			break;
623 		case DTYPE_PROCDESC:
624 			type = PS_FST_TYPE_PROCDESC;
625 			data = file.f_data;
626 			break;
627 		case DTYPE_DEV:
628 			type = PS_FST_TYPE_DEV;
629 			data = file.f_data;
630 			break;
631 		default:
632 			continue;
633 		}
634 		/* XXXRW: No capability rights support for kvm yet. */
635 		entry = filestat_new_entry(data, type, i,
636 		    to_filestat_flags(file.f_flag), 0, 0, 0, NULL, NULL);
637 		if (entry != NULL)
638 			STAILQ_INSERT_TAIL(head, entry, next);
639 	}
640 	free(fdt);
641 
642 do_mmapped:
643 
644 	/*
645 	 * Process mmapped files if requested.
646 	 */
647 	if (mmapped) {
648 		if (!kvm_read_all(kd, (unsigned long)kp->ki_vmspace, &vmspace,
649 		    sizeof(vmspace))) {
650 			warnx("can't read vmspace at %p",
651 			    (void *)kp->ki_vmspace);
652 			goto exit;
653 		}
654 
655 		vmentry = vmspace.vm_map.header;
656 		for (entryp = vm_map_entry_read_succ(kd, &vmentry, procstat_vm_map_reader);
657 		    entryp != NULL && entryp != &kp->ki_vmspace->vm_map.header;
658 		     entryp = vm_map_entry_read_succ(kd, &vmentry, procstat_vm_map_reader)) {
659 			if (vmentry.eflags & MAP_ENTRY_IS_SUB_MAP)
660 				continue;
661 			if ((objp = vmentry.object.vm_object) == NULL)
662 				continue;
663 			for (; objp; objp = object.backing_object) {
664 				if (!kvm_read_all(kd, (unsigned long)objp,
665 				    &object, sizeof(object))) {
666 					warnx("can't read vm_object at %p",
667 					    (void *)objp);
668 					break;
669 				}
670 			}
671 
672 			/* We want only vnode objects. */
673 			if (object.type != OBJT_VNODE)
674 				continue;
675 
676 			prot = vmentry.protection;
677 			fflags = 0;
678 			if (prot & VM_PROT_READ)
679 				fflags = PS_FST_FFLAG_READ;
680 			if ((vmentry.eflags & MAP_ENTRY_COW) == 0 &&
681 			    prot & VM_PROT_WRITE)
682 				fflags |= PS_FST_FFLAG_WRITE;
683 
684 			/*
685 			 * Create filestat entry.
686 			 */
687 			entry = filestat_new_entry(object.handle,
688 			    PS_FST_TYPE_VNODE, -1, fflags,
689 			    PS_FST_UFLAG_MMAP, 0, 0, NULL, NULL);
690 			if (entry != NULL)
691 				STAILQ_INSERT_TAIL(head, entry, next);
692 		}
693 		if (entryp == NULL)
694 			warnx("can't read vm_map_entry");
695 	}
696 exit:
697 	return (head);
698 }
699 
700 /*
701  * kinfo types to filestat translation.
702  */
703 static int
704 kinfo_type2fst(int kftype)
705 {
706 	static struct {
707 		int	kf_type;
708 		int	fst_type;
709 	} kftypes2fst[] = {
710 		{ KF_TYPE_PROCDESC, PS_FST_TYPE_PROCDESC },
711 		{ KF_TYPE_CRYPTO, PS_FST_TYPE_CRYPTO },
712 		{ KF_TYPE_DEV, PS_FST_TYPE_DEV },
713 		{ KF_TYPE_FIFO, PS_FST_TYPE_FIFO },
714 		{ KF_TYPE_KQUEUE, PS_FST_TYPE_KQUEUE },
715 		{ KF_TYPE_MQUEUE, PS_FST_TYPE_MQUEUE },
716 		{ KF_TYPE_NONE, PS_FST_TYPE_NONE },
717 		{ KF_TYPE_PIPE, PS_FST_TYPE_PIPE },
718 		{ KF_TYPE_PTS, PS_FST_TYPE_PTS },
719 		{ KF_TYPE_SEM, PS_FST_TYPE_SEM },
720 		{ KF_TYPE_SHM, PS_FST_TYPE_SHM },
721 		{ KF_TYPE_SOCKET, PS_FST_TYPE_SOCKET },
722 		{ KF_TYPE_VNODE, PS_FST_TYPE_VNODE },
723 		{ KF_TYPE_UNKNOWN, PS_FST_TYPE_UNKNOWN }
724 	};
725 #define NKFTYPES	(sizeof(kftypes2fst) / sizeof(*kftypes2fst))
726 	unsigned int i;
727 
728 	for (i = 0; i < NKFTYPES; i++)
729 		if (kftypes2fst[i].kf_type == kftype)
730 			break;
731 	if (i == NKFTYPES)
732 		return (PS_FST_TYPE_UNKNOWN);
733 	return (kftypes2fst[i].fst_type);
734 }
735 
736 /*
737  * kinfo flags to filestat translation.
738  */
739 static int
740 kinfo_fflags2fst(int kfflags)
741 {
742 	static struct {
743 		int	kf_flag;
744 		int	fst_flag;
745 	} kfflags2fst[] = {
746 		{ KF_FLAG_APPEND, PS_FST_FFLAG_APPEND },
747 		{ KF_FLAG_ASYNC, PS_FST_FFLAG_ASYNC },
748 		{ KF_FLAG_CREAT, PS_FST_FFLAG_CREAT },
749 		{ KF_FLAG_DIRECT, PS_FST_FFLAG_DIRECT },
750 		{ KF_FLAG_EXCL, PS_FST_FFLAG_EXCL },
751 		{ KF_FLAG_EXEC, PS_FST_FFLAG_EXEC },
752 		{ KF_FLAG_EXLOCK, PS_FST_FFLAG_EXLOCK },
753 		{ KF_FLAG_FSYNC, PS_FST_FFLAG_SYNC },
754 		{ KF_FLAG_HASLOCK, PS_FST_FFLAG_HASLOCK },
755 		{ KF_FLAG_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
756 		{ KF_FLAG_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
757 		{ KF_FLAG_READ, PS_FST_FFLAG_READ },
758 		{ KF_FLAG_SHLOCK, PS_FST_FFLAG_SHLOCK },
759 		{ KF_FLAG_TRUNC, PS_FST_FFLAG_TRUNC },
760 		{ KF_FLAG_WRITE, PS_FST_FFLAG_WRITE }
761 	};
762 #define NKFFLAGS	(sizeof(kfflags2fst) / sizeof(*kfflags2fst))
763 	unsigned int i;
764 	int flags;
765 
766 	flags = 0;
767 	for (i = 0; i < NKFFLAGS; i++)
768 		if ((kfflags & kfflags2fst[i].kf_flag) != 0)
769 			flags |= kfflags2fst[i].fst_flag;
770 	return (flags);
771 }
772 
773 static int
774 kinfo_uflags2fst(int fd)
775 {
776 
777 	switch (fd) {
778 	case KF_FD_TYPE_CTTY:
779 		return (PS_FST_UFLAG_CTTY);
780 	case KF_FD_TYPE_CWD:
781 		return (PS_FST_UFLAG_CDIR);
782 	case KF_FD_TYPE_JAIL:
783 		return (PS_FST_UFLAG_JAIL);
784 	case KF_FD_TYPE_TEXT:
785 		return (PS_FST_UFLAG_TEXT);
786 	case KF_FD_TYPE_TRACE:
787 		return (PS_FST_UFLAG_TRACE);
788 	case KF_FD_TYPE_ROOT:
789 		return (PS_FST_UFLAG_RDIR);
790 	}
791 	return (0);
792 }
793 
794 static struct kinfo_file *
795 kinfo_getfile_core(struct procstat_core *core, int *cntp)
796 {
797 	int cnt;
798 	size_t len;
799 	char *buf, *bp, *eb;
800 	struct kinfo_file *kif, *kp, *kf;
801 
802 	buf = procstat_core_get(core, PSC_TYPE_FILES, NULL, &len);
803 	if (buf == NULL)
804 		return (NULL);
805 	/*
806 	 * XXXMG: The code below is just copy&past from libutil.
807 	 * The code duplication can be avoided if libutil
808 	 * is extended to provide something like:
809 	 *   struct kinfo_file *kinfo_getfile_from_buf(const char *buf,
810 	 *       size_t len, int *cntp);
811 	 */
812 
813 	/* Pass 1: count items */
814 	cnt = 0;
815 	bp = buf;
816 	eb = buf + len;
817 	while (bp < eb) {
818 		kf = (struct kinfo_file *)(uintptr_t)bp;
819 		if (kf->kf_structsize == 0)
820 			break;
821 		bp += kf->kf_structsize;
822 		cnt++;
823 	}
824 
825 	kif = calloc(cnt, sizeof(*kif));
826 	if (kif == NULL) {
827 		free(buf);
828 		return (NULL);
829 	}
830 	bp = buf;
831 	eb = buf + len;
832 	kp = kif;
833 	/* Pass 2: unpack */
834 	while (bp < eb) {
835 		kf = (struct kinfo_file *)(uintptr_t)bp;
836 		if (kf->kf_structsize == 0)
837 			break;
838 		/* Copy/expand into pre-zeroed buffer */
839 		memcpy(kp, kf, kf->kf_structsize);
840 		/* Advance to next packed record */
841 		bp += kf->kf_structsize;
842 		/* Set field size to fixed length, advance */
843 		kp->kf_structsize = sizeof(*kp);
844 		kp++;
845 	}
846 	free(buf);
847 	*cntp = cnt;
848 	return (kif);	/* Caller must free() return value */
849 }
850 
851 static struct filestat_list *
852 procstat_getfiles_sysctl(struct procstat *procstat, struct kinfo_proc *kp,
853     int mmapped)
854 {
855 	struct kinfo_file *kif, *files;
856 	struct kinfo_vmentry *kve, *vmentries;
857 	struct filestat_list *head;
858 	struct filestat *entry;
859 	char *path;
860 	off_t offset;
861 	int cnt, fd, fflags;
862 	int i, type, uflags;
863 	int refcount;
864 	cap_rights_t cap_rights;
865 
866 	assert(kp);
867 	if (kp->ki_fd == NULL)
868 		return (NULL);
869 	switch(procstat->type) {
870 	case PROCSTAT_SYSCTL:
871 		files = kinfo_getfile(kp->ki_pid, &cnt);
872 		break;
873 	case PROCSTAT_CORE:
874 		files = kinfo_getfile_core(procstat->core, &cnt);
875 		break;
876 	default:
877 		assert(!"invalid type");
878 	}
879 	if (files == NULL && errno != EPERM) {
880 		warn("kinfo_getfile()");
881 		return (NULL);
882 	}
883 	procstat->files = files;
884 
885 	/*
886 	 * Allocate list head.
887 	 */
888 	head = malloc(sizeof(*head));
889 	if (head == NULL)
890 		return (NULL);
891 	STAILQ_INIT(head);
892 	for (i = 0; i < cnt; i++) {
893 		kif = &files[i];
894 
895 		type = kinfo_type2fst(kif->kf_type);
896 		fd = kif->kf_fd >= 0 ? kif->kf_fd : -1;
897 		fflags = kinfo_fflags2fst(kif->kf_flags);
898 		uflags = kinfo_uflags2fst(kif->kf_fd);
899 		refcount = kif->kf_ref_count;
900 		offset = kif->kf_offset;
901 		if (*kif->kf_path != '\0')
902 			path = strdup(kif->kf_path);
903 		else
904 			path = NULL;
905 		cap_rights = kif->kf_cap_rights;
906 
907 		/*
908 		 * Create filestat entry.
909 		 */
910 		entry = filestat_new_entry(kif, type, fd, fflags, uflags,
911 		    refcount, offset, path, &cap_rights);
912 		if (entry != NULL)
913 			STAILQ_INSERT_TAIL(head, entry, next);
914 	}
915 	if (mmapped != 0) {
916 		vmentries = procstat_getvmmap(procstat, kp, &cnt);
917 		procstat->vmentries = vmentries;
918 		if (vmentries == NULL || cnt == 0)
919 			goto fail;
920 		for (i = 0; i < cnt; i++) {
921 			kve = &vmentries[i];
922 			if (kve->kve_type != KVME_TYPE_VNODE)
923 				continue;
924 			fflags = 0;
925 			if (kve->kve_protection & KVME_PROT_READ)
926 				fflags = PS_FST_FFLAG_READ;
927 			if ((kve->kve_flags & KVME_FLAG_COW) == 0 &&
928 			    kve->kve_protection & KVME_PROT_WRITE)
929 				fflags |= PS_FST_FFLAG_WRITE;
930 			offset = kve->kve_offset;
931 			refcount = kve->kve_ref_count;
932 			if (*kve->kve_path != '\0')
933 				path = strdup(kve->kve_path);
934 			else
935 				path = NULL;
936 			entry = filestat_new_entry(kve, PS_FST_TYPE_VNODE, -1,
937 			    fflags, PS_FST_UFLAG_MMAP, refcount, offset, path,
938 			    NULL);
939 			if (entry != NULL)
940 				STAILQ_INSERT_TAIL(head, entry, next);
941 		}
942 	}
943 fail:
944 	return (head);
945 }
946 
947 int
948 procstat_get_pipe_info(struct procstat *procstat, struct filestat *fst,
949     struct pipestat *ps, char *errbuf)
950 {
951 
952 	assert(ps);
953 	if (procstat->type == PROCSTAT_KVM) {
954 		return (procstat_get_pipe_info_kvm(procstat->kd, fst, ps,
955 		    errbuf));
956 	} else if (procstat->type == PROCSTAT_SYSCTL ||
957 		procstat->type == PROCSTAT_CORE) {
958 		return (procstat_get_pipe_info_sysctl(fst, ps, errbuf));
959 	} else {
960 		warnx("unknown access method: %d", procstat->type);
961 		if (errbuf != NULL)
962 			snprintf(errbuf, _POSIX2_LINE_MAX, "error");
963 		return (1);
964 	}
965 }
966 
967 static int
968 procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
969     struct pipestat *ps, char *errbuf)
970 {
971 	struct pipe pi;
972 	void *pipep;
973 
974 	assert(kd);
975 	assert(ps);
976 	assert(fst);
977 	bzero(ps, sizeof(*ps));
978 	pipep = fst->fs_typedep;
979 	if (pipep == NULL)
980 		goto fail;
981 	if (!kvm_read_all(kd, (unsigned long)pipep, &pi, sizeof(struct pipe))) {
982 		warnx("can't read pipe at %p", (void *)pipep);
983 		goto fail;
984 	}
985 	ps->addr = (uintptr_t)pipep;
986 	ps->peer = (uintptr_t)pi.pipe_peer;
987 	ps->buffer_cnt = pi.pipe_buffer.cnt;
988 	return (0);
989 
990 fail:
991 	if (errbuf != NULL)
992 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
993 	return (1);
994 }
995 
996 static int
997 procstat_get_pipe_info_sysctl(struct filestat *fst, struct pipestat *ps,
998     char *errbuf __unused)
999 {
1000 	struct kinfo_file *kif;
1001 
1002 	assert(ps);
1003 	assert(fst);
1004 	bzero(ps, sizeof(*ps));
1005 	kif = fst->fs_typedep;
1006 	if (kif == NULL)
1007 		return (1);
1008 	ps->addr = kif->kf_un.kf_pipe.kf_pipe_addr;
1009 	ps->peer = kif->kf_un.kf_pipe.kf_pipe_peer;
1010 	ps->buffer_cnt = kif->kf_un.kf_pipe.kf_pipe_buffer_cnt;
1011 	return (0);
1012 }
1013 
1014 int
1015 procstat_get_pts_info(struct procstat *procstat, struct filestat *fst,
1016     struct ptsstat *pts, char *errbuf)
1017 {
1018 
1019 	assert(pts);
1020 	if (procstat->type == PROCSTAT_KVM) {
1021 		return (procstat_get_pts_info_kvm(procstat->kd, fst, pts,
1022 		    errbuf));
1023 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1024 		procstat->type == PROCSTAT_CORE) {
1025 		return (procstat_get_pts_info_sysctl(fst, pts, errbuf));
1026 	} else {
1027 		warnx("unknown access method: %d", procstat->type);
1028 		if (errbuf != NULL)
1029 			snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1030 		return (1);
1031 	}
1032 }
1033 
1034 static int
1035 procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
1036     struct ptsstat *pts, char *errbuf)
1037 {
1038 	struct tty tty;
1039 	void *ttyp;
1040 
1041 	assert(kd);
1042 	assert(pts);
1043 	assert(fst);
1044 	bzero(pts, sizeof(*pts));
1045 	ttyp = fst->fs_typedep;
1046 	if (ttyp == NULL)
1047 		goto fail;
1048 	if (!kvm_read_all(kd, (unsigned long)ttyp, &tty, sizeof(struct tty))) {
1049 		warnx("can't read tty at %p", (void *)ttyp);
1050 		goto fail;
1051 	}
1052 	pts->dev = dev2udev(kd, tty.t_dev);
1053 	(void)kdevtoname(kd, tty.t_dev, pts->devname);
1054 	return (0);
1055 
1056 fail:
1057 	if (errbuf != NULL)
1058 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1059 	return (1);
1060 }
1061 
1062 static int
1063 procstat_get_pts_info_sysctl(struct filestat *fst, struct ptsstat *pts,
1064     char *errbuf __unused)
1065 {
1066 	struct kinfo_file *kif;
1067 
1068 	assert(pts);
1069 	assert(fst);
1070 	bzero(pts, sizeof(*pts));
1071 	kif = fst->fs_typedep;
1072 	if (kif == NULL)
1073 		return (0);
1074 	pts->dev = kif->kf_un.kf_pts.kf_pts_dev;
1075 	strlcpy(pts->devname, kif->kf_path, sizeof(pts->devname));
1076 	return (0);
1077 }
1078 
1079 int
1080 procstat_get_sem_info(struct procstat *procstat, struct filestat *fst,
1081     struct semstat *sem, char *errbuf)
1082 {
1083 
1084 	assert(sem);
1085 	if (procstat->type == PROCSTAT_KVM) {
1086 		return (procstat_get_sem_info_kvm(procstat->kd, fst, sem,
1087 		    errbuf));
1088 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1089 	    procstat->type == PROCSTAT_CORE) {
1090 		return (procstat_get_sem_info_sysctl(fst, sem, errbuf));
1091 	} else {
1092 		warnx("unknown access method: %d", procstat->type);
1093 		if (errbuf != NULL)
1094 			snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1095 		return (1);
1096 	}
1097 }
1098 
1099 static int
1100 procstat_get_sem_info_kvm(kvm_t *kd, struct filestat *fst,
1101     struct semstat *sem, char *errbuf)
1102 {
1103 	struct ksem ksem;
1104 	void *ksemp;
1105 	char *path;
1106 	int i;
1107 
1108 	assert(kd);
1109 	assert(sem);
1110 	assert(fst);
1111 	bzero(sem, sizeof(*sem));
1112 	ksemp = fst->fs_typedep;
1113 	if (ksemp == NULL)
1114 		goto fail;
1115 	if (!kvm_read_all(kd, (unsigned long)ksemp, &ksem,
1116 	    sizeof(struct ksem))) {
1117 		warnx("can't read ksem at %p", (void *)ksemp);
1118 		goto fail;
1119 	}
1120 	sem->mode = S_IFREG | ksem.ks_mode;
1121 	sem->value = ksem.ks_value;
1122 	if (fst->fs_path == NULL && ksem.ks_path != NULL) {
1123 		path = malloc(MAXPATHLEN);
1124 		for (i = 0; i < MAXPATHLEN - 1; i++) {
1125 			if (!kvm_read_all(kd, (unsigned long)ksem.ks_path + i,
1126 			    path + i, 1))
1127 				break;
1128 			if (path[i] == '\0')
1129 				break;
1130 		}
1131 		path[i] = '\0';
1132 		if (i == 0)
1133 			free(path);
1134 		else
1135 			fst->fs_path = path;
1136 	}
1137 	return (0);
1138 
1139 fail:
1140 	if (errbuf != NULL)
1141 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1142 	return (1);
1143 }
1144 
1145 static int
1146 procstat_get_sem_info_sysctl(struct filestat *fst, struct semstat *sem,
1147     char *errbuf __unused)
1148 {
1149 	struct kinfo_file *kif;
1150 
1151 	assert(sem);
1152 	assert(fst);
1153 	bzero(sem, sizeof(*sem));
1154 	kif = fst->fs_typedep;
1155 	if (kif == NULL)
1156 		return (0);
1157 	sem->value = kif->kf_un.kf_sem.kf_sem_value;
1158 	sem->mode = kif->kf_un.kf_sem.kf_sem_mode;
1159 	return (0);
1160 }
1161 
1162 int
1163 procstat_get_shm_info(struct procstat *procstat, struct filestat *fst,
1164     struct shmstat *shm, char *errbuf)
1165 {
1166 
1167 	assert(shm);
1168 	if (procstat->type == PROCSTAT_KVM) {
1169 		return (procstat_get_shm_info_kvm(procstat->kd, fst, shm,
1170 		    errbuf));
1171 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1172 	    procstat->type == PROCSTAT_CORE) {
1173 		return (procstat_get_shm_info_sysctl(fst, shm, errbuf));
1174 	} else {
1175 		warnx("unknown access method: %d", procstat->type);
1176 		if (errbuf != NULL)
1177 			snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1178 		return (1);
1179 	}
1180 }
1181 
1182 static int
1183 procstat_get_shm_info_kvm(kvm_t *kd, struct filestat *fst,
1184     struct shmstat *shm, char *errbuf)
1185 {
1186 	struct shmfd shmfd;
1187 	void *shmfdp;
1188 	char *path;
1189 	int i;
1190 
1191 	assert(kd);
1192 	assert(shm);
1193 	assert(fst);
1194 	bzero(shm, sizeof(*shm));
1195 	shmfdp = fst->fs_typedep;
1196 	if (shmfdp == NULL)
1197 		goto fail;
1198 	if (!kvm_read_all(kd, (unsigned long)shmfdp, &shmfd,
1199 	    sizeof(struct shmfd))) {
1200 		warnx("can't read shmfd at %p", (void *)shmfdp);
1201 		goto fail;
1202 	}
1203 	shm->mode = S_IFREG | shmfd.shm_mode;
1204 	shm->size = shmfd.shm_size;
1205 	if (fst->fs_path == NULL && shmfd.shm_path != NULL) {
1206 		path = malloc(MAXPATHLEN);
1207 		for (i = 0; i < MAXPATHLEN - 1; i++) {
1208 			if (!kvm_read_all(kd, (unsigned long)shmfd.shm_path + i,
1209 			    path + i, 1))
1210 				break;
1211 			if (path[i] == '\0')
1212 				break;
1213 		}
1214 		path[i] = '\0';
1215 		if (i == 0)
1216 			free(path);
1217 		else
1218 			fst->fs_path = path;
1219 	}
1220 	return (0);
1221 
1222 fail:
1223 	if (errbuf != NULL)
1224 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1225 	return (1);
1226 }
1227 
1228 static int
1229 procstat_get_shm_info_sysctl(struct filestat *fst, struct shmstat *shm,
1230     char *errbuf __unused)
1231 {
1232 	struct kinfo_file *kif;
1233 
1234 	assert(shm);
1235 	assert(fst);
1236 	bzero(shm, sizeof(*shm));
1237 	kif = fst->fs_typedep;
1238 	if (kif == NULL)
1239 		return (0);
1240 	shm->size = kif->kf_un.kf_file.kf_file_size;
1241 	shm->mode = kif->kf_un.kf_file.kf_file_mode;
1242 	return (0);
1243 }
1244 
1245 int
1246 procstat_get_vnode_info(struct procstat *procstat, struct filestat *fst,
1247     struct vnstat *vn, char *errbuf)
1248 {
1249 
1250 	assert(vn);
1251 	if (procstat->type == PROCSTAT_KVM) {
1252 		return (procstat_get_vnode_info_kvm(procstat->kd, fst, vn,
1253 		    errbuf));
1254 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1255 		procstat->type == PROCSTAT_CORE) {
1256 		return (procstat_get_vnode_info_sysctl(fst, vn, errbuf));
1257 	} else {
1258 		warnx("unknown access method: %d", procstat->type);
1259 		if (errbuf != NULL)
1260 			snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1261 		return (1);
1262 	}
1263 }
1264 
1265 static int
1266 procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
1267     struct vnstat *vn, char *errbuf)
1268 {
1269 	/* Filesystem specific handlers. */
1270 	#define FSTYPE(fst)     {#fst, fst##_filestat}
1271 	struct {
1272 		const char	*tag;
1273 		int		(*handler)(kvm_t *kd, struct vnode *vp,
1274 		    struct vnstat *vn);
1275 	} fstypes[] = {
1276 		FSTYPE(devfs),
1277 		FSTYPE(isofs),
1278 		FSTYPE(msdosfs),
1279 		FSTYPE(nfs),
1280 		FSTYPE(smbfs),
1281 		FSTYPE(udf),
1282 		FSTYPE(ufs),
1283 #ifdef LIBPROCSTAT_ZFS
1284 		FSTYPE(zfs),
1285 #endif
1286 	};
1287 #define	NTYPES	(sizeof(fstypes) / sizeof(*fstypes))
1288 	struct vnode vnode;
1289 	char tagstr[12];
1290 	void *vp;
1291 	int error;
1292 	unsigned int i;
1293 
1294 	assert(kd);
1295 	assert(vn);
1296 	assert(fst);
1297 	vp = fst->fs_typedep;
1298 	if (vp == NULL)
1299 		goto fail;
1300 	error = kvm_read_all(kd, (unsigned long)vp, &vnode, sizeof(vnode));
1301 	if (error == 0) {
1302 		warnx("can't read vnode at %p", (void *)vp);
1303 		goto fail;
1304 	}
1305 	bzero(vn, sizeof(*vn));
1306 	vn->vn_type = vntype2psfsttype(vnode.v_type);
1307 	if (vnode.v_type == VNON || vnode.v_type == VBAD)
1308 		return (0);
1309 	error = kvm_read_all(kd, (unsigned long)vnode.v_lock.lock_object.lo_name,
1310 	    tagstr, sizeof(tagstr));
1311 	if (error == 0) {
1312 		warnx("can't read lo_name at %p", (void *)vp);
1313 		goto fail;
1314 	}
1315 	tagstr[sizeof(tagstr) - 1] = '\0';
1316 
1317 	/*
1318 	 * Find appropriate handler.
1319 	 */
1320 	for (i = 0; i < NTYPES; i++)
1321 		if (!strcmp(fstypes[i].tag, tagstr)) {
1322 			if (fstypes[i].handler(kd, &vnode, vn) != 0) {
1323 				goto fail;
1324 			}
1325 			break;
1326 		}
1327 	if (i == NTYPES) {
1328 		if (errbuf != NULL)
1329 			snprintf(errbuf, _POSIX2_LINE_MAX, "?(%s)", tagstr);
1330 		return (1);
1331 	}
1332 	vn->vn_mntdir = getmnton(kd, vnode.v_mount);
1333 	if ((vnode.v_type == VBLK || vnode.v_type == VCHR) &&
1334 	    vnode.v_rdev != NULL){
1335 		vn->vn_dev = dev2udev(kd, vnode.v_rdev);
1336 		(void)kdevtoname(kd, vnode.v_rdev, vn->vn_devname);
1337 	} else {
1338 		vn->vn_dev = -1;
1339 	}
1340 	return (0);
1341 
1342 fail:
1343 	if (errbuf != NULL)
1344 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1345 	return (1);
1346 }
1347 
1348 /*
1349  * kinfo vnode type to filestat translation.
1350  */
1351 static int
1352 kinfo_vtype2fst(int kfvtype)
1353 {
1354 	static struct {
1355 		int	kf_vtype;
1356 		int	fst_vtype;
1357 	} kfvtypes2fst[] = {
1358 		{ KF_VTYPE_VBAD, PS_FST_VTYPE_VBAD },
1359 		{ KF_VTYPE_VBLK, PS_FST_VTYPE_VBLK },
1360 		{ KF_VTYPE_VCHR, PS_FST_VTYPE_VCHR },
1361 		{ KF_VTYPE_VDIR, PS_FST_VTYPE_VDIR },
1362 		{ KF_VTYPE_VFIFO, PS_FST_VTYPE_VFIFO },
1363 		{ KF_VTYPE_VLNK, PS_FST_VTYPE_VLNK },
1364 		{ KF_VTYPE_VNON, PS_FST_VTYPE_VNON },
1365 		{ KF_VTYPE_VREG, PS_FST_VTYPE_VREG },
1366 		{ KF_VTYPE_VSOCK, PS_FST_VTYPE_VSOCK }
1367 	};
1368 #define	NKFVTYPES	(sizeof(kfvtypes2fst) / sizeof(*kfvtypes2fst))
1369 	unsigned int i;
1370 
1371 	for (i = 0; i < NKFVTYPES; i++)
1372 		if (kfvtypes2fst[i].kf_vtype == kfvtype)
1373 			break;
1374 	if (i == NKFVTYPES)
1375 		return (PS_FST_VTYPE_UNKNOWN);
1376 	return (kfvtypes2fst[i].fst_vtype);
1377 }
1378 
1379 static int
1380 procstat_get_vnode_info_sysctl(struct filestat *fst, struct vnstat *vn,
1381     char *errbuf)
1382 {
1383 	struct statfs stbuf;
1384 	struct kinfo_file *kif;
1385 	struct kinfo_vmentry *kve;
1386 	char *name, *path;
1387 	uint64_t fileid;
1388 	uint64_t size;
1389 	uint64_t fsid;
1390 	uint64_t rdev;
1391 	uint16_t mode;
1392 	int vntype;
1393 	int status;
1394 
1395 	assert(fst);
1396 	assert(vn);
1397 	bzero(vn, sizeof(*vn));
1398 	if (fst->fs_typedep == NULL)
1399 		return (1);
1400 	if (fst->fs_uflags & PS_FST_UFLAG_MMAP) {
1401 		kve = fst->fs_typedep;
1402 		fileid = kve->kve_vn_fileid;
1403 		fsid = kve->kve_vn_fsid;
1404 		mode = kve->kve_vn_mode;
1405 		path = kve->kve_path;
1406 		rdev = kve->kve_vn_rdev;
1407 		size = kve->kve_vn_size;
1408 		vntype = kinfo_vtype2fst(kve->kve_vn_type);
1409 		status = kve->kve_status;
1410 	} else {
1411 		kif = fst->fs_typedep;
1412 		fileid = kif->kf_un.kf_file.kf_file_fileid;
1413 		fsid = kif->kf_un.kf_file.kf_file_fsid;
1414 		mode = kif->kf_un.kf_file.kf_file_mode;
1415 		path = kif->kf_path;
1416 		rdev = kif->kf_un.kf_file.kf_file_rdev;
1417 		size = kif->kf_un.kf_file.kf_file_size;
1418 		vntype = kinfo_vtype2fst(kif->kf_vnode_type);
1419 		status = kif->kf_status;
1420 	}
1421 	vn->vn_type = vntype;
1422 	if (vntype == PS_FST_VTYPE_VNON || vntype == PS_FST_VTYPE_VBAD)
1423 		return (0);
1424 	if ((status & KF_ATTR_VALID) == 0) {
1425 		if (errbuf != NULL) {
1426 			snprintf(errbuf, _POSIX2_LINE_MAX,
1427 			    "? (no info available)");
1428 		}
1429 		return (1);
1430 	}
1431 	if (path && *path) {
1432 		statfs(path, &stbuf);
1433 		vn->vn_mntdir = strdup(stbuf.f_mntonname);
1434 	} else
1435 		vn->vn_mntdir = strdup("-");
1436 	vn->vn_dev = rdev;
1437 	if (vntype == PS_FST_VTYPE_VBLK) {
1438 		name = devname(rdev, S_IFBLK);
1439 		if (name != NULL)
1440 			strlcpy(vn->vn_devname, name,
1441 			    sizeof(vn->vn_devname));
1442 	} else if (vntype == PS_FST_VTYPE_VCHR) {
1443 		name = devname(vn->vn_dev, S_IFCHR);
1444 		if (name != NULL)
1445 			strlcpy(vn->vn_devname, name,
1446 			    sizeof(vn->vn_devname));
1447 	}
1448 	vn->vn_fsid = fsid;
1449 	vn->vn_fileid = fileid;
1450 	vn->vn_size = size;
1451 	vn->vn_mode = mode;
1452 	return (0);
1453 }
1454 
1455 int
1456 procstat_get_socket_info(struct procstat *procstat, struct filestat *fst,
1457     struct sockstat *sock, char *errbuf)
1458 {
1459 
1460 	assert(sock);
1461 	if (procstat->type == PROCSTAT_KVM) {
1462 		return (procstat_get_socket_info_kvm(procstat->kd, fst, sock,
1463 		    errbuf));
1464 	} else if (procstat->type == PROCSTAT_SYSCTL ||
1465 		procstat->type == PROCSTAT_CORE) {
1466 		return (procstat_get_socket_info_sysctl(fst, sock, errbuf));
1467 	} else {
1468 		warnx("unknown access method: %d", procstat->type);
1469 		if (errbuf != NULL)
1470 			snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1471 		return (1);
1472 	}
1473 }
1474 
1475 static int
1476 procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
1477     struct sockstat *sock, char *errbuf)
1478 {
1479 	struct domain dom;
1480 	struct inpcb inpcb;
1481 	struct protosw proto;
1482 	struct socket s;
1483 	struct unpcb unpcb;
1484 	ssize_t len;
1485 	void *so;
1486 
1487 	assert(kd);
1488 	assert(sock);
1489 	assert(fst);
1490 	bzero(sock, sizeof(*sock));
1491 	so = fst->fs_typedep;
1492 	if (so == NULL)
1493 		goto fail;
1494 	sock->so_addr = (uintptr_t)so;
1495 	/* fill in socket */
1496 	if (!kvm_read_all(kd, (unsigned long)so, &s,
1497 	    sizeof(struct socket))) {
1498 		warnx("can't read sock at %p", (void *)so);
1499 		goto fail;
1500 	}
1501 	/* fill in protosw entry */
1502 	if (!kvm_read_all(kd, (unsigned long)s.so_proto, &proto,
1503 	    sizeof(struct protosw))) {
1504 		warnx("can't read protosw at %p", (void *)s.so_proto);
1505 		goto fail;
1506 	}
1507 	/* fill in domain */
1508 	if (!kvm_read_all(kd, (unsigned long)proto.pr_domain, &dom,
1509 	    sizeof(struct domain))) {
1510 		warnx("can't read domain at %p",
1511 		    (void *)proto.pr_domain);
1512 		goto fail;
1513 	}
1514 	if ((len = kvm_read(kd, (unsigned long)dom.dom_name, sock->dname,
1515 	    sizeof(sock->dname) - 1)) < 0) {
1516 		warnx("can't read domain name at %p", (void *)dom.dom_name);
1517 		sock->dname[0] = '\0';
1518 	}
1519 	else
1520 		sock->dname[len] = '\0';
1521 
1522 	/*
1523 	 * Fill in known data.
1524 	 */
1525 	sock->type = s.so_type;
1526 	sock->proto = proto.pr_protocol;
1527 	sock->dom_family = dom.dom_family;
1528 	sock->so_pcb = (uintptr_t)s.so_pcb;
1529 
1530 	/*
1531 	 * Protocol specific data.
1532 	 */
1533 	switch(dom.dom_family) {
1534 	case AF_INET:
1535 	case AF_INET6:
1536 		if (proto.pr_protocol == IPPROTO_TCP) {
1537 			if (s.so_pcb) {
1538 				if (kvm_read(kd, (u_long)s.so_pcb,
1539 				    (char *)&inpcb, sizeof(struct inpcb))
1540 				    != sizeof(struct inpcb)) {
1541 					warnx("can't read inpcb at %p",
1542 					    (void *)s.so_pcb);
1543 				} else
1544 					sock->inp_ppcb =
1545 					    (uintptr_t)inpcb.inp_ppcb;
1546 				sock->sendq = s.so_snd.sb_ccc;
1547 				sock->recvq = s.so_rcv.sb_ccc;
1548 			}
1549 		}
1550 		break;
1551 	case AF_UNIX:
1552 		if (s.so_pcb) {
1553 			if (kvm_read(kd, (u_long)s.so_pcb, (char *)&unpcb,
1554 			    sizeof(struct unpcb)) != sizeof(struct unpcb)){
1555 				warnx("can't read unpcb at %p",
1556 				    (void *)s.so_pcb);
1557 			} else if (unpcb.unp_conn) {
1558 				sock->so_rcv_sb_state = s.so_rcv.sb_state;
1559 				sock->so_snd_sb_state = s.so_snd.sb_state;
1560 				sock->unp_conn = (uintptr_t)unpcb.unp_conn;
1561 				sock->sendq = s.so_snd.sb_ccc;
1562 				sock->recvq = s.so_rcv.sb_ccc;
1563 			}
1564 		}
1565 		break;
1566 	default:
1567 		break;
1568 	}
1569 	return (0);
1570 
1571 fail:
1572 	if (errbuf != NULL)
1573 		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
1574 	return (1);
1575 }
1576 
1577 static int
1578 procstat_get_socket_info_sysctl(struct filestat *fst, struct sockstat *sock,
1579     char *errbuf __unused)
1580 {
1581 	struct kinfo_file *kif;
1582 
1583 	assert(sock);
1584 	assert(fst);
1585 	bzero(sock, sizeof(*sock));
1586 	kif = fst->fs_typedep;
1587 	if (kif == NULL)
1588 		return (0);
1589 
1590 	/*
1591 	 * Fill in known data.
1592 	 */
1593 	sock->type = kif->kf_sock_type;
1594 	sock->proto = kif->kf_sock_protocol;
1595 	sock->dom_family = kif->kf_sock_domain;
1596 	sock->so_pcb = kif->kf_un.kf_sock.kf_sock_pcb;
1597 	strlcpy(sock->dname, kif->kf_path, sizeof(sock->dname));
1598 	bcopy(&kif->kf_un.kf_sock.kf_sa_local, &sock->sa_local,
1599 	    kif->kf_un.kf_sock.kf_sa_local.ss_len);
1600 	bcopy(&kif->kf_un.kf_sock.kf_sa_peer, &sock->sa_peer,
1601 	    kif->kf_un.kf_sock.kf_sa_peer.ss_len);
1602 
1603 	/*
1604 	 * Protocol specific data.
1605 	 */
1606 	switch(sock->dom_family) {
1607 	case AF_INET:
1608 	case AF_INET6:
1609 		if (sock->proto == IPPROTO_TCP) {
1610 			sock->inp_ppcb = kif->kf_un.kf_sock.kf_sock_inpcb;
1611 			sock->sendq = kif->kf_un.kf_sock.kf_sock_sendq;
1612 			sock->recvq = kif->kf_un.kf_sock.kf_sock_recvq;
1613 		}
1614 		break;
1615 	case AF_UNIX:
1616 		if (kif->kf_un.kf_sock.kf_sock_unpconn != 0) {
1617 			sock->so_rcv_sb_state =
1618 			    kif->kf_un.kf_sock.kf_sock_rcv_sb_state;
1619 			sock->so_snd_sb_state =
1620 			    kif->kf_un.kf_sock.kf_sock_snd_sb_state;
1621 			sock->unp_conn =
1622 			    kif->kf_un.kf_sock.kf_sock_unpconn;
1623 			sock->sendq = kif->kf_un.kf_sock.kf_sock_sendq;
1624 			sock->recvq = kif->kf_un.kf_sock.kf_sock_recvq;
1625 		}
1626 		break;
1627 	default:
1628 		break;
1629 	}
1630 	return (0);
1631 }
1632 
1633 /*
1634  * Descriptor flags to filestat translation.
1635  */
1636 static int
1637 to_filestat_flags(int flags)
1638 {
1639 	static struct {
1640 		int flag;
1641 		int fst_flag;
1642 	} fstflags[] = {
1643 		{ FREAD, PS_FST_FFLAG_READ },
1644 		{ FWRITE, PS_FST_FFLAG_WRITE },
1645 		{ O_APPEND, PS_FST_FFLAG_APPEND },
1646 		{ O_ASYNC, PS_FST_FFLAG_ASYNC },
1647 		{ O_CREAT, PS_FST_FFLAG_CREAT },
1648 		{ O_DIRECT, PS_FST_FFLAG_DIRECT },
1649 		{ O_EXCL, PS_FST_FFLAG_EXCL },
1650 		{ O_EXEC, PS_FST_FFLAG_EXEC },
1651 		{ O_EXLOCK, PS_FST_FFLAG_EXLOCK },
1652 		{ O_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
1653 		{ O_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
1654 		{ O_SHLOCK, PS_FST_FFLAG_SHLOCK },
1655 		{ O_SYNC, PS_FST_FFLAG_SYNC },
1656 		{ O_TRUNC, PS_FST_FFLAG_TRUNC }
1657 	};
1658 #define NFSTFLAGS	(sizeof(fstflags) / sizeof(*fstflags))
1659 	int fst_flags;
1660 	unsigned int i;
1661 
1662 	fst_flags = 0;
1663 	for (i = 0; i < NFSTFLAGS; i++)
1664 		if (flags & fstflags[i].flag)
1665 			fst_flags |= fstflags[i].fst_flag;
1666 	return (fst_flags);
1667 }
1668 
1669 /*
1670  * Vnode type to filestate translation.
1671  */
1672 static int
1673 vntype2psfsttype(int type)
1674 {
1675 	static struct {
1676 		int	vtype;
1677 		int	fst_vtype;
1678 	} vt2fst[] = {
1679 		{ VBAD, PS_FST_VTYPE_VBAD },
1680 		{ VBLK, PS_FST_VTYPE_VBLK },
1681 		{ VCHR, PS_FST_VTYPE_VCHR },
1682 		{ VDIR, PS_FST_VTYPE_VDIR },
1683 		{ VFIFO, PS_FST_VTYPE_VFIFO },
1684 		{ VLNK, PS_FST_VTYPE_VLNK },
1685 		{ VNON, PS_FST_VTYPE_VNON },
1686 		{ VREG, PS_FST_VTYPE_VREG },
1687 		{ VSOCK, PS_FST_VTYPE_VSOCK }
1688 	};
1689 #define	NVFTYPES	(sizeof(vt2fst) / sizeof(*vt2fst))
1690 	unsigned int i, fst_type;
1691 
1692 	fst_type = PS_FST_VTYPE_UNKNOWN;
1693 	for (i = 0; i < NVFTYPES; i++) {
1694 		if (type == vt2fst[i].vtype) {
1695 			fst_type = vt2fst[i].fst_vtype;
1696 			break;
1697 		}
1698 	}
1699 	return (fst_type);
1700 }
1701 
1702 static char *
1703 getmnton(kvm_t *kd, struct mount *m)
1704 {
1705 	struct mount mnt;
1706 	static struct mtab {
1707 		struct mtab *next;
1708 		struct mount *m;
1709 		char mntonname[MNAMELEN + 1];
1710 	} *mhead = NULL;
1711 	struct mtab *mt;
1712 
1713 	for (mt = mhead; mt != NULL; mt = mt->next)
1714 		if (m == mt->m)
1715 			return (mt->mntonname);
1716 	if (!kvm_read_all(kd, (unsigned long)m, &mnt, sizeof(struct mount))) {
1717 		warnx("can't read mount table at %p", (void *)m);
1718 		return (NULL);
1719 	}
1720 	if ((mt = malloc(sizeof (struct mtab))) == NULL)
1721 		err(1, NULL);
1722 	mt->m = m;
1723 	bcopy(&mnt.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
1724 	mt->mntonname[MNAMELEN] = '\0';
1725 	mt->next = mhead;
1726 	mhead = mt;
1727 	return (mt->mntonname);
1728 }
1729 
1730 /*
1731  * Auxiliary structures and functions to get process environment or
1732  * command line arguments.
1733  */
1734 struct argvec {
1735 	char	*buf;
1736 	size_t	bufsize;
1737 	char	**argv;
1738 	size_t	argc;
1739 };
1740 
1741 static struct argvec *
1742 argvec_alloc(size_t bufsize)
1743 {
1744 	struct argvec *av;
1745 
1746 	av = malloc(sizeof(*av));
1747 	if (av == NULL)
1748 		return (NULL);
1749 	av->bufsize = bufsize;
1750 	av->buf = malloc(av->bufsize);
1751 	if (av->buf == NULL) {
1752 		free(av);
1753 		return (NULL);
1754 	}
1755 	av->argc = 32;
1756 	av->argv = malloc(sizeof(char *) * av->argc);
1757 	if (av->argv == NULL) {
1758 		free(av->buf);
1759 		free(av);
1760 		return (NULL);
1761 	}
1762 	return av;
1763 }
1764 
1765 static void
1766 argvec_free(struct argvec * av)
1767 {
1768 
1769 	free(av->argv);
1770 	free(av->buf);
1771 	free(av);
1772 }
1773 
1774 static char **
1775 getargv(struct procstat *procstat, struct kinfo_proc *kp, size_t nchr, int env)
1776 {
1777 	int error, name[4], argc, i;
1778 	struct argvec *av, **avp;
1779 	enum psc_type type;
1780 	size_t len;
1781 	char *p, **argv;
1782 
1783 	assert(procstat);
1784 	assert(kp);
1785 	if (procstat->type == PROCSTAT_KVM) {
1786 		warnx("can't use kvm access method");
1787 		return (NULL);
1788 	}
1789 	if (procstat->type != PROCSTAT_SYSCTL &&
1790 	    procstat->type != PROCSTAT_CORE) {
1791 		warnx("unknown access method: %d", procstat->type);
1792 		return (NULL);
1793 	}
1794 
1795 	if (nchr == 0 || nchr > ARG_MAX)
1796 		nchr = ARG_MAX;
1797 
1798 	avp = (struct argvec **)(env ? &procstat->argv : &procstat->envv);
1799 	av = *avp;
1800 
1801 	if (av == NULL)
1802 	{
1803 		av = argvec_alloc(nchr);
1804 		if (av == NULL)
1805 		{
1806 			warn("malloc(%zu)", nchr);
1807 			return (NULL);
1808 		}
1809 		*avp = av;
1810 	} else if (av->bufsize < nchr) {
1811 		av->buf = reallocf(av->buf, nchr);
1812 		if (av->buf == NULL) {
1813 			warn("malloc(%zu)", nchr);
1814 			return (NULL);
1815 		}
1816 	}
1817 	if (procstat->type == PROCSTAT_SYSCTL) {
1818 		name[0] = CTL_KERN;
1819 		name[1] = KERN_PROC;
1820 		name[2] = env ? KERN_PROC_ENV : KERN_PROC_ARGS;
1821 		name[3] = kp->ki_pid;
1822 		len = nchr;
1823 		error = sysctl(name, nitems(name), av->buf, &len, NULL, 0);
1824 		if (error != 0 && errno != ESRCH && errno != EPERM)
1825 			warn("sysctl(kern.proc.%s)", env ? "env" : "args");
1826 		if (error != 0 || len == 0)
1827 			return (NULL);
1828 	} else /* procstat->type == PROCSTAT_CORE */ {
1829 		type = env ? PSC_TYPE_ENVV : PSC_TYPE_ARGV;
1830 		len = nchr;
1831 		if (procstat_core_get(procstat->core, type, av->buf, &len)
1832 		    == NULL) {
1833 			return (NULL);
1834 		}
1835 	}
1836 
1837 	argv = av->argv;
1838 	argc = av->argc;
1839 	i = 0;
1840 	for (p = av->buf; p < av->buf + len; p += strlen(p) + 1) {
1841 		argv[i++] = p;
1842 		if (i < argc)
1843 			continue;
1844 		/* Grow argv. */
1845 		argc += argc;
1846 		argv = realloc(argv, sizeof(char *) * argc);
1847 		if (argv == NULL) {
1848 			warn("malloc(%zu)", sizeof(char *) * argc);
1849 			return (NULL);
1850 		}
1851 		av->argv = argv;
1852 		av->argc = argc;
1853 	}
1854 	argv[i] = NULL;
1855 
1856 	return (argv);
1857 }
1858 
1859 /*
1860  * Return process command line arguments.
1861  */
1862 char **
1863 procstat_getargv(struct procstat *procstat, struct kinfo_proc *p, size_t nchr)
1864 {
1865 
1866 	return (getargv(procstat, p, nchr, 0));
1867 }
1868 
1869 /*
1870  * Free the buffer allocated by procstat_getargv().
1871  */
1872 void
1873 procstat_freeargv(struct procstat *procstat)
1874 {
1875 
1876 	if (procstat->argv != NULL) {
1877 		argvec_free(procstat->argv);
1878 		procstat->argv = NULL;
1879 	}
1880 }
1881 
1882 /*
1883  * Return process environment.
1884  */
1885 char **
1886 procstat_getenvv(struct procstat *procstat, struct kinfo_proc *p, size_t nchr)
1887 {
1888 
1889 	return (getargv(procstat, p, nchr, 1));
1890 }
1891 
1892 /*
1893  * Free the buffer allocated by procstat_getenvv().
1894  */
1895 void
1896 procstat_freeenvv(struct procstat *procstat)
1897 {
1898 	if (procstat->envv != NULL) {
1899 		argvec_free(procstat->envv);
1900 		procstat->envv = NULL;
1901 	}
1902 }
1903 
1904 static struct kinfo_vmentry *
1905 kinfo_getvmmap_core(struct procstat_core *core, int *cntp)
1906 {
1907 	int cnt;
1908 	size_t len;
1909 	char *buf, *bp, *eb;
1910 	struct kinfo_vmentry *kiv, *kp, *kv;
1911 
1912 	buf = procstat_core_get(core, PSC_TYPE_VMMAP, NULL, &len);
1913 	if (buf == NULL)
1914 		return (NULL);
1915 
1916 	/*
1917 	 * XXXMG: The code below is just copy&past from libutil.
1918 	 * The code duplication can be avoided if libutil
1919 	 * is extended to provide something like:
1920 	 *   struct kinfo_vmentry *kinfo_getvmmap_from_buf(const char *buf,
1921 	 *       size_t len, int *cntp);
1922 	 */
1923 
1924 	/* Pass 1: count items */
1925 	cnt = 0;
1926 	bp = buf;
1927 	eb = buf + len;
1928 	while (bp < eb) {
1929 		kv = (struct kinfo_vmentry *)(uintptr_t)bp;
1930 		if (kv->kve_structsize == 0)
1931 			break;
1932 		bp += kv->kve_structsize;
1933 		cnt++;
1934 	}
1935 
1936 	kiv = calloc(cnt, sizeof(*kiv));
1937 	if (kiv == NULL) {
1938 		free(buf);
1939 		return (NULL);
1940 	}
1941 	bp = buf;
1942 	eb = buf + len;
1943 	kp = kiv;
1944 	/* Pass 2: unpack */
1945 	while (bp < eb) {
1946 		kv = (struct kinfo_vmentry *)(uintptr_t)bp;
1947 		if (kv->kve_structsize == 0)
1948 			break;
1949 		/* Copy/expand into pre-zeroed buffer */
1950 		memcpy(kp, kv, kv->kve_structsize);
1951 		/* Advance to next packed record */
1952 		bp += kv->kve_structsize;
1953 		/* Set field size to fixed length, advance */
1954 		kp->kve_structsize = sizeof(*kp);
1955 		kp++;
1956 	}
1957 	free(buf);
1958 	*cntp = cnt;
1959 	return (kiv);	/* Caller must free() return value */
1960 }
1961 
1962 struct kinfo_vmentry *
1963 procstat_getvmmap(struct procstat *procstat, struct kinfo_proc *kp,
1964     unsigned int *cntp)
1965 {
1966 
1967 	switch(procstat->type) {
1968 	case PROCSTAT_KVM:
1969 		warnx("kvm method is not supported");
1970 		return (NULL);
1971 	case PROCSTAT_SYSCTL:
1972 		return (kinfo_getvmmap(kp->ki_pid, cntp));
1973 	case PROCSTAT_CORE:
1974 		return (kinfo_getvmmap_core(procstat->core, cntp));
1975 	default:
1976 		warnx("unknown access method: %d", procstat->type);
1977 		return (NULL);
1978 	}
1979 }
1980 
1981 void
1982 procstat_freevmmap(struct procstat *procstat __unused,
1983     struct kinfo_vmentry *vmmap)
1984 {
1985 
1986 	free(vmmap);
1987 }
1988 
1989 static gid_t *
1990 procstat_getgroups_kvm(kvm_t *kd, struct kinfo_proc *kp, unsigned int *cntp)
1991 {
1992 	struct proc proc;
1993 	struct ucred ucred;
1994 	gid_t *groups;
1995 	size_t len;
1996 
1997 	assert(kd != NULL);
1998 	assert(kp != NULL);
1999 	if (!kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
2000 	    sizeof(proc))) {
2001 		warnx("can't read proc struct at %p for pid %d",
2002 		    kp->ki_paddr, kp->ki_pid);
2003 		return (NULL);
2004 	}
2005 	if (proc.p_ucred == NOCRED)
2006 		return (NULL);
2007 	if (!kvm_read_all(kd, (unsigned long)proc.p_ucred, &ucred,
2008 	    sizeof(ucred))) {
2009 		warnx("can't read ucred struct at %p for pid %d",
2010 		    proc.p_ucred, kp->ki_pid);
2011 		return (NULL);
2012 	}
2013 	len = ucred.cr_ngroups * sizeof(gid_t);
2014 	groups = malloc(len);
2015 	if (groups == NULL) {
2016 		warn("malloc(%zu)", len);
2017 		return (NULL);
2018 	}
2019 	if (!kvm_read_all(kd, (unsigned long)ucred.cr_groups, groups, len)) {
2020 		warnx("can't read groups at %p for pid %d",
2021 		    ucred.cr_groups, kp->ki_pid);
2022 		free(groups);
2023 		return (NULL);
2024 	}
2025 	*cntp = ucred.cr_ngroups;
2026 	return (groups);
2027 }
2028 
2029 static gid_t *
2030 procstat_getgroups_sysctl(pid_t pid, unsigned int *cntp)
2031 {
2032 	int mib[4];
2033 	size_t len;
2034 	gid_t *groups;
2035 
2036 	mib[0] = CTL_KERN;
2037 	mib[1] = KERN_PROC;
2038 	mib[2] = KERN_PROC_GROUPS;
2039 	mib[3] = pid;
2040 	len = (sysconf(_SC_NGROUPS_MAX) + 1) * sizeof(gid_t);
2041 	groups = malloc(len);
2042 	if (groups == NULL) {
2043 		warn("malloc(%zu)", len);
2044 		return (NULL);
2045 	}
2046 	if (sysctl(mib, nitems(mib), groups, &len, NULL, 0) == -1) {
2047 		warn("sysctl: kern.proc.groups: %d", pid);
2048 		free(groups);
2049 		return (NULL);
2050 	}
2051 	*cntp = len / sizeof(gid_t);
2052 	return (groups);
2053 }
2054 
2055 static gid_t *
2056 procstat_getgroups_core(struct procstat_core *core, unsigned int *cntp)
2057 {
2058 	size_t len;
2059 	gid_t *groups;
2060 
2061 	groups = procstat_core_get(core, PSC_TYPE_GROUPS, NULL, &len);
2062 	if (groups == NULL)
2063 		return (NULL);
2064 	*cntp = len / sizeof(gid_t);
2065 	return (groups);
2066 }
2067 
2068 gid_t *
2069 procstat_getgroups(struct procstat *procstat, struct kinfo_proc *kp,
2070     unsigned int *cntp)
2071 {
2072 	switch(procstat->type) {
2073 	case PROCSTAT_KVM:
2074 		return (procstat_getgroups_kvm(procstat->kd, kp, cntp));
2075 	case PROCSTAT_SYSCTL:
2076 		return (procstat_getgroups_sysctl(kp->ki_pid, cntp));
2077 	case PROCSTAT_CORE:
2078 		return (procstat_getgroups_core(procstat->core, cntp));
2079 	default:
2080 		warnx("unknown access method: %d", procstat->type);
2081 		return (NULL);
2082 	}
2083 }
2084 
2085 void
2086 procstat_freegroups(struct procstat *procstat __unused, gid_t *groups)
2087 {
2088 
2089 	free(groups);
2090 }
2091 
2092 static int
2093 procstat_getumask_kvm(kvm_t *kd, struct kinfo_proc *kp, unsigned short *maskp)
2094 {
2095 	struct pwddesc pd;
2096 
2097 	assert(kd != NULL);
2098 	assert(kp != NULL);
2099 	if (kp->ki_pd == NULL)
2100 		return (-1);
2101 	if (!kvm_read_all(kd, (unsigned long)kp->ki_pd, &pd, sizeof(pd))) {
2102 		warnx("can't read pwddesc at %p for pid %d", kp->ki_pd,
2103 		    kp->ki_pid);
2104 		return (-1);
2105 	}
2106 	*maskp = pd.pd_cmask;
2107 	return (0);
2108 }
2109 
2110 static int
2111 procstat_getumask_sysctl(pid_t pid, unsigned short *maskp)
2112 {
2113 	int error;
2114 	int mib[4];
2115 	size_t len;
2116 
2117 	mib[0] = CTL_KERN;
2118 	mib[1] = KERN_PROC;
2119 	mib[2] = KERN_PROC_UMASK;
2120 	mib[3] = pid;
2121 	len = sizeof(*maskp);
2122 	error = sysctl(mib, nitems(mib), maskp, &len, NULL, 0);
2123 	if (error != 0 && errno != ESRCH && errno != EPERM)
2124 		warn("sysctl: kern.proc.umask: %d", pid);
2125 	return (error);
2126 }
2127 
2128 static int
2129 procstat_getumask_core(struct procstat_core *core, unsigned short *maskp)
2130 {
2131 	size_t len;
2132 	unsigned short *buf;
2133 
2134 	buf = procstat_core_get(core, PSC_TYPE_UMASK, NULL, &len);
2135 	if (buf == NULL)
2136 		return (-1);
2137 	if (len < sizeof(*maskp)) {
2138 		free(buf);
2139 		return (-1);
2140 	}
2141 	*maskp = *buf;
2142 	free(buf);
2143 	return (0);
2144 }
2145 
2146 int
2147 procstat_getumask(struct procstat *procstat, struct kinfo_proc *kp,
2148     unsigned short *maskp)
2149 {
2150 	switch(procstat->type) {
2151 	case PROCSTAT_KVM:
2152 		return (procstat_getumask_kvm(procstat->kd, kp, maskp));
2153 	case PROCSTAT_SYSCTL:
2154 		return (procstat_getumask_sysctl(kp->ki_pid, maskp));
2155 	case PROCSTAT_CORE:
2156 		return (procstat_getumask_core(procstat->core, maskp));
2157 	default:
2158 		warnx("unknown access method: %d", procstat->type);
2159 		return (-1);
2160 	}
2161 }
2162 
2163 static int
2164 procstat_getrlimit_kvm(kvm_t *kd, struct kinfo_proc *kp, int which,
2165     struct rlimit* rlimit)
2166 {
2167 	struct proc proc;
2168 	unsigned long offset;
2169 
2170 	assert(kd != NULL);
2171 	assert(kp != NULL);
2172 	assert(which >= 0 && which < RLIM_NLIMITS);
2173 	if (!kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
2174 	    sizeof(proc))) {
2175 		warnx("can't read proc struct at %p for pid %d",
2176 		    kp->ki_paddr, kp->ki_pid);
2177 		return (-1);
2178 	}
2179 	if (proc.p_limit == NULL)
2180 		return (-1);
2181 	offset = (unsigned long)proc.p_limit + sizeof(struct rlimit) * which;
2182 	if (!kvm_read_all(kd, offset, rlimit, sizeof(*rlimit))) {
2183 		warnx("can't read rlimit struct at %p for pid %d",
2184 		    (void *)offset, kp->ki_pid);
2185 		return (-1);
2186 	}
2187 	return (0);
2188 }
2189 
2190 static int
2191 procstat_getrlimit_sysctl(pid_t pid, int which, struct rlimit* rlimit)
2192 {
2193 	int error, name[5];
2194 	size_t len;
2195 
2196 	name[0] = CTL_KERN;
2197 	name[1] = KERN_PROC;
2198 	name[2] = KERN_PROC_RLIMIT;
2199 	name[3] = pid;
2200 	name[4] = which;
2201 	len = sizeof(struct rlimit);
2202 	error = sysctl(name, nitems(name), rlimit, &len, NULL, 0);
2203 	if (error < 0 && errno != ESRCH) {
2204 		warn("sysctl: kern.proc.rlimit: %d", pid);
2205 		return (-1);
2206 	}
2207 	if (error < 0 || len != sizeof(struct rlimit))
2208 		return (-1);
2209 	return (0);
2210 }
2211 
2212 static int
2213 procstat_getrlimit_core(struct procstat_core *core, int which,
2214     struct rlimit* rlimit)
2215 {
2216 	size_t len;
2217 	struct rlimit* rlimits;
2218 
2219 	if (which < 0 || which >= RLIM_NLIMITS) {
2220 		errno = EINVAL;
2221 		warn("getrlimit: which");
2222 		return (-1);
2223 	}
2224 	rlimits = procstat_core_get(core, PSC_TYPE_RLIMIT, NULL, &len);
2225 	if (rlimits == NULL)
2226 		return (-1);
2227 	if (len < sizeof(struct rlimit) * RLIM_NLIMITS) {
2228 		free(rlimits);
2229 		return (-1);
2230 	}
2231 	*rlimit = rlimits[which];
2232 	free(rlimits);
2233 	return (0);
2234 }
2235 
2236 int
2237 procstat_getrlimit(struct procstat *procstat, struct kinfo_proc *kp, int which,
2238     struct rlimit* rlimit)
2239 {
2240 	switch(procstat->type) {
2241 	case PROCSTAT_KVM:
2242 		return (procstat_getrlimit_kvm(procstat->kd, kp, which,
2243 		    rlimit));
2244 	case PROCSTAT_SYSCTL:
2245 		return (procstat_getrlimit_sysctl(kp->ki_pid, which, rlimit));
2246 	case PROCSTAT_CORE:
2247 		return (procstat_getrlimit_core(procstat->core, which, rlimit));
2248 	default:
2249 		warnx("unknown access method: %d", procstat->type);
2250 		return (-1);
2251 	}
2252 }
2253 
2254 static int
2255 procstat_getpathname_sysctl(pid_t pid, char *pathname, size_t maxlen)
2256 {
2257 	int error, name[4];
2258 	size_t len;
2259 
2260 	name[0] = CTL_KERN;
2261 	name[1] = KERN_PROC;
2262 	name[2] = KERN_PROC_PATHNAME;
2263 	name[3] = pid;
2264 	len = maxlen;
2265 	error = sysctl(name, nitems(name), pathname, &len, NULL, 0);
2266 	if (error != 0 && errno != ESRCH)
2267 		warn("sysctl: kern.proc.pathname: %d", pid);
2268 	if (len == 0)
2269 		pathname[0] = '\0';
2270 	return (error);
2271 }
2272 
2273 static int
2274 procstat_getpathname_core(struct procstat_core *core, char *pathname,
2275     size_t maxlen)
2276 {
2277 	struct kinfo_file *files;
2278 	int cnt, i, result;
2279 
2280 	files = kinfo_getfile_core(core, &cnt);
2281 	if (files == NULL)
2282 		return (-1);
2283 	result = -1;
2284 	for (i = 0; i < cnt; i++) {
2285 		if (files[i].kf_fd != KF_FD_TYPE_TEXT)
2286 			continue;
2287 		strncpy(pathname, files[i].kf_path, maxlen);
2288 		result = 0;
2289 		break;
2290 	}
2291 	free(files);
2292 	return (result);
2293 }
2294 
2295 int
2296 procstat_getpathname(struct procstat *procstat, struct kinfo_proc *kp,
2297     char *pathname, size_t maxlen)
2298 {
2299 	switch(procstat->type) {
2300 	case PROCSTAT_KVM:
2301 		/* XXX: Return empty string. */
2302 		if (maxlen > 0)
2303 			pathname[0] = '\0';
2304 		return (0);
2305 	case PROCSTAT_SYSCTL:
2306 		return (procstat_getpathname_sysctl(kp->ki_pid, pathname,
2307 		    maxlen));
2308 	case PROCSTAT_CORE:
2309 		return (procstat_getpathname_core(procstat->core, pathname,
2310 		    maxlen));
2311 	default:
2312 		warnx("unknown access method: %d", procstat->type);
2313 		return (-1);
2314 	}
2315 }
2316 
2317 static int
2318 procstat_getosrel_kvm(kvm_t *kd, struct kinfo_proc *kp, int *osrelp)
2319 {
2320 	struct proc proc;
2321 
2322 	assert(kd != NULL);
2323 	assert(kp != NULL);
2324 	if (!kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
2325 	    sizeof(proc))) {
2326 		warnx("can't read proc struct at %p for pid %d",
2327 		    kp->ki_paddr, kp->ki_pid);
2328 		return (-1);
2329 	}
2330 	*osrelp = proc.p_osrel;
2331 	return (0);
2332 }
2333 
2334 static int
2335 procstat_getosrel_sysctl(pid_t pid, int *osrelp)
2336 {
2337 	int error, name[4];
2338 	size_t len;
2339 
2340 	name[0] = CTL_KERN;
2341 	name[1] = KERN_PROC;
2342 	name[2] = KERN_PROC_OSREL;
2343 	name[3] = pid;
2344 	len = sizeof(*osrelp);
2345 	error = sysctl(name, nitems(name), osrelp, &len, NULL, 0);
2346 	if (error != 0 && errno != ESRCH)
2347 		warn("sysctl: kern.proc.osrel: %d", pid);
2348 	return (error);
2349 }
2350 
2351 static int
2352 procstat_getosrel_core(struct procstat_core *core, int *osrelp)
2353 {
2354 	size_t len;
2355 	int *buf;
2356 
2357 	buf = procstat_core_get(core, PSC_TYPE_OSREL, NULL, &len);
2358 	if (buf == NULL)
2359 		return (-1);
2360 	if (len < sizeof(*osrelp)) {
2361 		free(buf);
2362 		return (-1);
2363 	}
2364 	*osrelp = *buf;
2365 	free(buf);
2366 	return (0);
2367 }
2368 
2369 int
2370 procstat_getosrel(struct procstat *procstat, struct kinfo_proc *kp, int *osrelp)
2371 {
2372 	switch(procstat->type) {
2373 	case PROCSTAT_KVM:
2374 		return (procstat_getosrel_kvm(procstat->kd, kp, osrelp));
2375 	case PROCSTAT_SYSCTL:
2376 		return (procstat_getosrel_sysctl(kp->ki_pid, osrelp));
2377 	case PROCSTAT_CORE:
2378 		return (procstat_getosrel_core(procstat->core, osrelp));
2379 	default:
2380 		warnx("unknown access method: %d", procstat->type);
2381 		return (-1);
2382 	}
2383 }
2384 
2385 #define PROC_AUXV_MAX	256
2386 
2387 #if __ELF_WORD_SIZE == 64
2388 static const char *elf32_sv_names[] = {
2389 	"Linux ELF32",
2390 	"FreeBSD ELF32",
2391 };
2392 
2393 static int
2394 is_elf32_sysctl(pid_t pid)
2395 {
2396 	int error, name[4];
2397 	size_t len, i;
2398 	static char sv_name[256];
2399 
2400 	name[0] = CTL_KERN;
2401 	name[1] = KERN_PROC;
2402 	name[2] = KERN_PROC_SV_NAME;
2403 	name[3] = pid;
2404 	len = sizeof(sv_name);
2405 	error = sysctl(name, nitems(name), sv_name, &len, NULL, 0);
2406 	if (error != 0 || len == 0)
2407 		return (0);
2408 	for (i = 0; i < sizeof(elf32_sv_names) / sizeof(*elf32_sv_names); i++) {
2409 		if (strncmp(sv_name, elf32_sv_names[i], sizeof(sv_name)) == 0)
2410 			return (1);
2411 	}
2412 	return (0);
2413 }
2414 
2415 static Elf_Auxinfo *
2416 procstat_getauxv32_sysctl(pid_t pid, unsigned int *cntp)
2417 {
2418 	Elf_Auxinfo *auxv;
2419 	Elf32_Auxinfo *auxv32;
2420 	void *ptr;
2421 	size_t len;
2422 	unsigned int i, count;
2423 	int name[4];
2424 
2425 	name[0] = CTL_KERN;
2426 	name[1] = KERN_PROC;
2427 	name[2] = KERN_PROC_AUXV;
2428 	name[3] = pid;
2429 	len = PROC_AUXV_MAX * sizeof(Elf32_Auxinfo);
2430 	auxv = NULL;
2431 	auxv32 = malloc(len);
2432 	if (auxv32 == NULL) {
2433 		warn("malloc(%zu)", len);
2434 		goto out;
2435 	}
2436 	if (sysctl(name, nitems(name), auxv32, &len, NULL, 0) == -1) {
2437 		if (errno != ESRCH && errno != EPERM)
2438 			warn("sysctl: kern.proc.auxv: %d: %d", pid, errno);
2439 		goto out;
2440 	}
2441 	count = len / sizeof(Elf_Auxinfo);
2442 	auxv = malloc(count  * sizeof(Elf_Auxinfo));
2443 	if (auxv == NULL) {
2444 		warn("malloc(%zu)", count * sizeof(Elf_Auxinfo));
2445 		goto out;
2446 	}
2447 	for (i = 0; i < count; i++) {
2448 		/*
2449 		 * XXX: We expect that values for a_type on a 32-bit platform
2450 		 * are directly mapped to values on 64-bit one, which is not
2451 		 * necessarily true.
2452 		 */
2453 		auxv[i].a_type = auxv32[i].a_type;
2454 		ptr = &auxv32[i].a_un;
2455 		auxv[i].a_un.a_val = *((uint32_t *)ptr);
2456 	}
2457 	*cntp = count;
2458 out:
2459 	free(auxv32);
2460 	return (auxv);
2461 }
2462 #endif /* __ELF_WORD_SIZE == 64 */
2463 
2464 static Elf_Auxinfo *
2465 procstat_getauxv_sysctl(pid_t pid, unsigned int *cntp)
2466 {
2467 	Elf_Auxinfo *auxv;
2468 	int name[4];
2469 	size_t len;
2470 
2471 #if __ELF_WORD_SIZE == 64
2472 	if (is_elf32_sysctl(pid))
2473 		return (procstat_getauxv32_sysctl(pid, cntp));
2474 #endif
2475 	name[0] = CTL_KERN;
2476 	name[1] = KERN_PROC;
2477 	name[2] = KERN_PROC_AUXV;
2478 	name[3] = pid;
2479 	len = PROC_AUXV_MAX * sizeof(Elf_Auxinfo);
2480 	auxv = malloc(len);
2481 	if (auxv == NULL) {
2482 		warn("malloc(%zu)", len);
2483 		return (NULL);
2484 	}
2485 	if (sysctl(name, nitems(name), auxv, &len, NULL, 0) == -1) {
2486 		if (errno != ESRCH && errno != EPERM)
2487 			warn("sysctl: kern.proc.auxv: %d: %d", pid, errno);
2488 		free(auxv);
2489 		return (NULL);
2490 	}
2491 	*cntp = len / sizeof(Elf_Auxinfo);
2492 	return (auxv);
2493 }
2494 
2495 static Elf_Auxinfo *
2496 procstat_getauxv_core(struct procstat_core *core, unsigned int *cntp)
2497 {
2498 	Elf_Auxinfo *auxv;
2499 	size_t len;
2500 
2501 	auxv = procstat_core_get(core, PSC_TYPE_AUXV, NULL, &len);
2502 	if (auxv == NULL)
2503 		return (NULL);
2504 	*cntp = len / sizeof(Elf_Auxinfo);
2505 	return (auxv);
2506 }
2507 
2508 Elf_Auxinfo *
2509 procstat_getauxv(struct procstat *procstat, struct kinfo_proc *kp,
2510     unsigned int *cntp)
2511 {
2512 	switch(procstat->type) {
2513 	case PROCSTAT_KVM:
2514 		warnx("kvm method is not supported");
2515 		return (NULL);
2516 	case PROCSTAT_SYSCTL:
2517 		return (procstat_getauxv_sysctl(kp->ki_pid, cntp));
2518 	case PROCSTAT_CORE:
2519 		return (procstat_getauxv_core(procstat->core, cntp));
2520 	default:
2521 		warnx("unknown access method: %d", procstat->type);
2522 		return (NULL);
2523 	}
2524 }
2525 
2526 void
2527 procstat_freeauxv(struct procstat *procstat __unused, Elf_Auxinfo *auxv)
2528 {
2529 
2530 	free(auxv);
2531 }
2532 
2533 static struct ptrace_lwpinfo *
2534 procstat_getptlwpinfo_core(struct procstat_core *core, unsigned int *cntp)
2535 {
2536 	void *buf;
2537 	struct ptrace_lwpinfo *pl;
2538 	unsigned int cnt;
2539 	size_t len;
2540 
2541 	cnt = procstat_core_note_count(core, PSC_TYPE_PTLWPINFO);
2542 	if (cnt == 0)
2543 		return (NULL);
2544 
2545 	len = cnt * sizeof(*pl);
2546 	buf = calloc(1, len);
2547 	pl = procstat_core_get(core, PSC_TYPE_PTLWPINFO, buf, &len);
2548 	if (pl == NULL) {
2549 		free(buf);
2550 		return (NULL);
2551 	}
2552 	*cntp = len / sizeof(*pl);
2553 	return (pl);
2554 }
2555 
2556 struct ptrace_lwpinfo *
2557 procstat_getptlwpinfo(struct procstat *procstat, unsigned int *cntp)
2558 {
2559 	switch (procstat->type) {
2560 	case PROCSTAT_KVM:
2561 		warnx("kvm method is not supported");
2562 		return (NULL);
2563 	case PROCSTAT_SYSCTL:
2564 		warnx("sysctl method is not supported");
2565 		return (NULL);
2566 	case PROCSTAT_CORE:
2567 	 	return (procstat_getptlwpinfo_core(procstat->core, cntp));
2568 	default:
2569 		warnx("unknown access method: %d", procstat->type);
2570 		return (NULL);
2571 	}
2572 }
2573 
2574 void
2575 procstat_freeptlwpinfo(struct procstat *procstat __unused,
2576     struct ptrace_lwpinfo *pl)
2577 {
2578 	free(pl);
2579 }
2580 
2581 static struct kinfo_kstack *
2582 procstat_getkstack_sysctl(pid_t pid, int *cntp)
2583 {
2584 	struct kinfo_kstack *kkstp;
2585 	int error, name[4];
2586 	size_t len;
2587 
2588 	name[0] = CTL_KERN;
2589 	name[1] = KERN_PROC;
2590 	name[2] = KERN_PROC_KSTACK;
2591 	name[3] = pid;
2592 
2593 	len = 0;
2594 	error = sysctl(name, nitems(name), NULL, &len, NULL, 0);
2595 	if (error < 0 && errno != ESRCH && errno != EPERM && errno != ENOENT) {
2596 		warn("sysctl: kern.proc.kstack: %d", pid);
2597 		return (NULL);
2598 	}
2599 	if (error == -1 && errno == ENOENT) {
2600 		warnx("sysctl: kern.proc.kstack unavailable"
2601 		    " (options DDB or options STACK required in kernel)");
2602 		return (NULL);
2603 	}
2604 	if (error == -1)
2605 		return (NULL);
2606 	kkstp = malloc(len);
2607 	if (kkstp == NULL) {
2608 		warn("malloc(%zu)", len);
2609 		return (NULL);
2610 	}
2611 	if (sysctl(name, nitems(name), kkstp, &len, NULL, 0) == -1) {
2612 		warn("sysctl: kern.proc.pid: %d", pid);
2613 		free(kkstp);
2614 		return (NULL);
2615 	}
2616 	*cntp = len / sizeof(*kkstp);
2617 
2618 	return (kkstp);
2619 }
2620 
2621 struct kinfo_kstack *
2622 procstat_getkstack(struct procstat *procstat, struct kinfo_proc *kp,
2623     unsigned int *cntp)
2624 {
2625 	switch(procstat->type) {
2626 	case PROCSTAT_KVM:
2627 		warnx("kvm method is not supported");
2628 		return (NULL);
2629 	case PROCSTAT_SYSCTL:
2630 		return (procstat_getkstack_sysctl(kp->ki_pid, cntp));
2631 	case PROCSTAT_CORE:
2632 		warnx("core method is not supported");
2633 		return (NULL);
2634 	default:
2635 		warnx("unknown access method: %d", procstat->type);
2636 		return (NULL);
2637 	}
2638 }
2639 
2640 void
2641 procstat_freekstack(struct procstat *procstat __unused,
2642     struct kinfo_kstack *kkstp)
2643 {
2644 
2645 	free(kkstp);
2646 }
2647