- Commit work from libprocstat project. These patches add support for runtime

  file and processes information retrieval from the running kernel via sysctl
  in the form of new library, libprocstat.  The library also supports KVM backend
  for analyzing memory crash dumps.  Both procstat(1) and fstat(1) utilities have
  been modified to take advantage of the library (as the bonus point the fstat(1)
  utility no longer need superuser privileges to operate), and the procstat(1)
  utility is now able to display information from memory dumps as well.

  The newly introduced fuser(1) utility also uses this library and able to operate
  via sysctl and kvm backends.

  The library is by no means complete (e.g. KVM backend is missing vnode name
  resolution routines, and there're no manpages for the library itself) so I
  plan to improve it further.  I'm commiting it so it will get wider exposure
  and review.

  We won't be able to MFC this work as it relies on changes in HEAD, which
  was introduced some time ago, that break kernel ABI.  OTOH we may be able
  to merge the library with KVM backend if we really need it there.

Discussed with:	rwatson

14 files changed, 2527 insertions, 0 deletions

diff --git a/lib/libprocstat/Makefile b/lib/libprocstat/Makefile
new file mode 100644
index 0000000..dc3dd58
--- /dev/null
+++ b/lib/libprocstat/Makefile
@@ -0,0 +1,36 @@
+# $FreeBSD$
+
+.include <bsd.own.mk>
+
+LIB=	procstat
+
+SRCS=	cd9660.c	\
+	common_kvm.c	\
+	libprocstat.c	\
+        msdosfs.c	\
+	ntfs.c		\
+	nwfs.c		\
+	smbfs.c		\
+	udf.c
+
+INCS=	libprocstat.h
+CFLAGS+=	-I. -I${.CURDIR} -D_KVM_VNODE
+SHLIB_MAJOR=	1
+WITHOUT_MAN=	yes
+
+# XXX This is a hack.
+.if ${MK_CDDL} != "no"
+CFLAGS+=	-DZFS
+OBJS+=	zfs/zfs.o
+SOBJS+=	zfs/zfs.So
+POBJS+=	zfs/zfs.po
+SUBDIR=	zfs
+zfs/zfs.o: .PHONY
+	@cd ${.CURDIR}/zfs && ${MAKE} zfs.o
+zfs/zfs.So: .PHONY
+	@cd ${.CURDIR}/zfs && ${MAKE} zfs.So
+zfs/zfs.po: .PHONY
+	@cd ${.CURDIR}/zfs && ${MAKE} zfs.po
+.endif
+
+.include <bsd.lib.mk>
diff --git a/lib/libprocstat/cd9660.c b/lib/libprocstat/cd9660.c
new file mode 100644
index 0000000..95882be
--- /dev/null
+++ b/lib/libprocstat/cd9660.c
@@ -0,0 +1,90 @@
+/* 
+ * Copyright (c) 2000 Peter Edwards
+ * Copyright (c) 1988, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * This code is derived from software contributed to Berkeley by Peter Edwards
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * XXX -
+ * This had to be separated from fstat.c because cd9660s has namespace
+ * conflicts with UFS.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+
+#include <netinet/in.h>
+
+#include <err.h>
+
+#include <isofs/cd9660/cd9660_node.h>
+#define _KERNEL
+#include <isofs/cd9660/iso.h>
+#undef _KERNEL
+
+#include <kvm.h>
+#include <stdio.h>
+
+#include "libprocstat.h"
+#include "common_kvm.h"
+
+int
+isofs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct iso_node isonode;
+	struct iso_mnt mnt;
+
+	if (!kvm_read_all(kd, (unsigned long)VTOI(vp), &isonode,
+	    sizeof(isonode))) {
+		warnx("can't read iso_node at %p",
+		    (void *)VTOI(vp));
+		return (1);
+	}
+	if (!kvm_read_all(kd, (unsigned long)isonode.i_mnt, &mnt,
+	    sizeof(mnt))) {
+		warnx("can't read iso_mnt at %p",
+		    (void *)VTOI(vp));
+		return (1);
+	}
+	vn->vn_fsid = dev2udev(kd, mnt.im_dev);
+	vn->vn_mode = (mode_t)isonode.inode.iso_mode;
+	vn->vn_fileid = (long)isonode.i_number;
+	vn->vn_size = (u_long)isonode.i_size;
+	return (0);
+}
diff --git a/lib/libprocstat/common_kvm.c b/lib/libprocstat/common_kvm.c
new file mode 100644
index 0000000..1ff181c
--- /dev/null
+++ b/lib/libprocstat/common_kvm.c
@@ -0,0 +1,207 @@
+/*-
+ * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
+ * Copyright (c) 1988, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/user.h>
+#include <sys/stat.h>
+#include <sys/vnode.h>
+#include <sys/conf.h>
+#define	_KERNEL
+#include <sys/pipe.h>
+#include <sys/mount.h>
+#include <ufs/ufs/quota.h>
+#include <ufs/ufs/inode.h>
+#include <fs/devfs/devfs.h>
+#include <fs/devfs/devfs_int.h>
+#undef _KERNEL
+#include <nfs/nfsproto.h>
+#include <nfsclient/nfs.h>
+#include <nfsclient/nfsnode.h>
+
+#include <assert.h>
+#include <err.h>
+#include <kvm.h>
+#include <stddef.h>
+#include <string.h>
+
+#include <libprocstat.h>
+#include "common_kvm.h"
+
+int
+kvm_read_all(kvm_t *kd, unsigned long addr, void *buf, size_t nbytes)
+{
+	ssize_t error;
+
+	if (nbytes >= SSIZE_MAX)
+		return (0);
+	error = kvm_read(kd, addr, buf, nbytes);
+	return (error == (ssize_t)(nbytes));
+}
+
+int
+kdevtoname(kvm_t *kd, struct cdev *dev, char *buf)
+{
+	struct cdev si;
+
+	assert(buf);
+	if (!kvm_read_all(kd, (unsigned long)dev, &si, sizeof(si)))
+		return (1);
+	strlcpy(buf, si.__si_namebuf, SPECNAMELEN + 1);
+	return (0);
+}
+
+int
+ufs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct inode inode;
+
+	if (!kvm_read_all(kd, (unsigned long)VTOI(vp), &inode, sizeof(inode))) {
+		warnx("can't read inode at %p", (void *)VTOI(vp));
+		return (1);
+	}
+	/*
+	 * The st_dev from stat(2) is a dev_t. These kernel structures
+	 * contain cdev pointers. We need to convert to dev_t to make
+	 * comparisons
+	 */
+	vn->vn_fsid = dev2udev(kd, inode.i_dev);
+	vn->vn_fileid = (long)inode.i_number;
+	vn->vn_mode = (mode_t)inode.i_mode;
+	vn->vn_size = (u_long)inode.i_size;
+	return (0);
+}
+
+int
+devfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct devfs_dirent devfs_dirent;
+	struct mount mount;
+
+	if (!kvm_read_all(kd, (unsigned long)getvnodedata(vp), &devfs_dirent,
+	    sizeof(devfs_dirent))) {
+		warnx("can't read devfs_dirent at %p",
+		    (void *)vp->v_data);
+		return (1);
+	}
+	if (!kvm_read_all(kd, (unsigned long)getvnodemount(vp), &mount,
+	    sizeof(mount))) {
+		warnx("can't read mount at %p",
+		    (void *)getvnodemount(vp));
+		return (1);
+	}
+	vn->vn_fsid = mount.mnt_stat.f_fsid.val[0];
+	vn->vn_fileid = devfs_dirent.de_inode;
+	vn->vn_mode = (devfs_dirent.de_mode & ~S_IFMT) | S_IFCHR;
+	vn->vn_size = 0;
+	return (0);
+}
+
+int
+nfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct nfsnode nfsnode;
+	mode_t mode;
+
+	if (!kvm_read_all(kd, (unsigned long)VTONFS(vp), &nfsnode,
+	    sizeof(nfsnode))) {
+		warnx("can't read nfsnode at %p",
+		    (void *)VTONFS(vp));
+		return (1);
+	}
+	vn->vn_fsid = nfsnode.n_vattr.va_fsid;
+	vn->vn_fileid = nfsnode.n_vattr.va_fileid;
+	vn->vn_size = nfsnode.n_size;
+	mode = (mode_t)nfsnode.n_vattr.va_mode;
+	switch (vp->v_type) {
+	case VREG:
+		mode |= S_IFREG;
+		break;
+	case VDIR:
+		mode |= S_IFDIR;
+		break;
+	case VBLK:
+		mode |= S_IFBLK;
+		break;
+	case VCHR:
+		mode |= S_IFCHR;
+		break;
+	case VLNK:
+		mode |= S_IFLNK;
+		break;
+	case VSOCK:
+		mode |= S_IFSOCK;
+		break;
+	case VFIFO:
+		mode |= S_IFIFO;
+		break;
+	default:
+		break;
+	};
+	vn->vn_mode = mode;
+	return (0);
+}
+
+/*
+ * Read the cdev structure in the kernel in order to work out the
+ * associated dev_t
+ */
+dev_t
+dev2udev(kvm_t *kd, struct cdev *dev)
+{
+	struct cdev_priv priv;
+
+	assert(kd);
+	if (kvm_read_all(kd, (unsigned long)cdev2priv(dev), &priv,
+	    sizeof(priv))) {
+		return ((dev_t)priv.cdp_inode);
+	} else {
+		warnx("can't convert cdev *%p to a dev_t\n", dev);
+		return (-1);
+	}
+}
+
+void *
+getvnodedata(struct vnode *vp)
+{
+	return (vp->v_data);
+}
+
+struct mount *
+getvnodemount(struct vnode *vp)
+{
+	return (vp->v_mount);
+}
diff --git a/lib/libprocstat/common_kvm.h b/lib/libprocstat/common_kvm.h
new file mode 100644
index 0000000..d0b5307
--- /dev/null
+++ b/lib/libprocstat/common_kvm.h
@@ -0,0 +1,53 @@
+/*-
+ * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_COMMON_KVM_H_
+#define	_COMMON_KVM_H_
+
+dev_t	dev2udev(kvm_t *kd, struct cdev *dev);
+int	kdevtoname(kvm_t *kd, struct cdev *dev, char *);
+int	kvm_read_all(kvm_t *kd, unsigned long addr, void *buf,
+    size_t nbytes);
+
+/*
+ * Filesystems specific access routines.
+ */
+int	devfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	isofs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	msdosfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	nfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	ntfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	nwfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	smbfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	udf_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	ufs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+int	zfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn);
+void	*getvnodedata(struct vnode *vp);
+struct mount	*getvnodemount(struct vnode *vp);
+
+#endif	/* _COMMON_KVM_H_ */
diff --git a/lib/libprocstat/libprocstat.c b/lib/libprocstat/libprocstat.c
new file mode 100644
index 0000000..cfe81a2
--- /dev/null
+++ b/lib/libprocstat/libprocstat.c
@@ -0,0 +1,1306 @@
+/*-
+ * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
+ * Copyright (c) 1988, 1993
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the University of
+ *      California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/proc.h>
+#include <sys/user.h>
+#include <sys/stat.h>
+#include <sys/vnode.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/domain.h>
+#include <sys/protosw.h>
+#include <sys/un.h>
+#include <sys/unpcb.h>
+#include <sys/sysctl.h>
+#include <sys/tty.h>
+#include <sys/filedesc.h>
+#include <sys/queue.h>
+#define	_WANT_FILE
+#include <sys/file.h>
+#include <sys/conf.h>
+#define	_KERNEL
+#include <sys/mount.h>
+#include <sys/pipe.h>
+#include <ufs/ufs/quota.h>
+#include <ufs/ufs/inode.h>
+#include <fs/devfs/devfs.h>
+#include <fs/devfs/devfs_int.h>
+#undef _KERNEL
+#include <nfs/nfsproto.h>
+#include <nfsclient/nfs.h>
+#include <nfsclient/nfsnode.h>
+
+#include <vm/vm.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <net/route.h>
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/in_pcb.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <err.h>
+#include <fcntl.h>
+#include <kvm.h>
+#include <libutil.h>
+#include <limits.h>
+#include <paths.h>
+#include <pwd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stddef.h>
+#include <string.h>
+#include <unistd.h>
+#include <netdb.h>
+
+#include <libprocstat.h>
+#include "libprocstat_internal.h"
+#include "common_kvm.h"
+
+int     statfs(const char *, struct statfs *);	/* XXX */
+
+#define	PROCSTAT_KVM	1
+#define	PROCSTAT_SYSCTL	2
+
+static char	*getmnton(kvm_t *kd, struct mount *m);
+static struct filestat_list	*procstat_getfiles_kvm(
+    struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
+static struct filestat_list	*procstat_getfiles_sysctl(
+    struct procstat *procstat, struct kinfo_proc *kp, int mmapped);
+static int	procstat_get_pipe_info_sysctl(struct filestat *fst,
+    struct pipestat *pipe, char *errbuf);
+static int	procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct pipestat *pipe, char *errbuf);
+static int	procstat_get_pts_info_sysctl(struct filestat *fst,
+    struct ptsstat *pts, char *errbuf);
+static int	procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct ptsstat *pts, char *errbuf);
+static int	procstat_get_socket_info_sysctl(struct filestat *fst,
+    struct sockstat *sock, char *errbuf);
+static int	procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct sockstat *sock, char *errbuf);
+static int	to_filestat_flags(int flags);
+static int	procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct vnstat *vn, char *errbuf);
+static int	procstat_get_vnode_info_sysctl(struct filestat *fst,
+    struct vnstat *vn, char *errbuf);
+static int	vntype2psfsttype(int type);
+
+void
+procstat_close(struct procstat *procstat)
+{
+
+	assert(procstat);
+	if (procstat->type == PROCSTAT_KVM)
+		kvm_close(procstat->kd);
+}
+
+struct procstat *
+procstat_open_sysctl(void)
+{
+	struct procstat *procstat;
+
+	procstat = calloc(1, sizeof(*procstat));
+	if (procstat == NULL) {
+		warn("malloc()");
+		return (NULL);
+	}
+	procstat->type = PROCSTAT_SYSCTL;
+	return (procstat);
+}
+
+struct procstat *
+procstat_open_kvm(const char *nlistf, const char *memf)
+{
+	struct procstat *procstat;
+	kvm_t *kd;
+	char buf[_POSIX2_LINE_MAX];
+
+	procstat = calloc(1, sizeof(*procstat));
+	if (procstat == NULL) {
+		warn("malloc()");
+		return (NULL);
+	}
+	kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf);
+	if (kd == NULL) {
+		warnx("kvm_openfiles(): %s", buf);
+		free(procstat);
+		return (NULL);
+	}
+	procstat->type = PROCSTAT_KVM;
+	procstat->kd = kd;
+	return (procstat);
+}
+
+struct kinfo_proc *
+procstat_getprocs(struct procstat *procstat, int what, int arg,
+    unsigned int *count)
+{
+	struct kinfo_proc *p0, *p;
+	size_t len;
+	int name[4];
+	int error;
+
+	assert(procstat);
+	assert(count);
+	p = NULL;
+	if (procstat->type == PROCSTAT_KVM) {
+		p0 = kvm_getprocs(procstat->kd, what, arg, count);
+		if (p0 == NULL || count == 0)
+			return (NULL);
+		len = *count * sizeof(*p);
+		p = malloc(len);
+		if (p == NULL) {
+			warnx("malloc(%zd)", len);
+			goto fail;
+		}
+		bcopy(p0, p, len);
+		return (p);
+	} else if (procstat->type == PROCSTAT_SYSCTL) {
+		len = 0;
+		name[0] = CTL_KERN;
+		name[1] = KERN_PROC;
+		name[2] = what;
+		name[3] = arg;
+		error = sysctl(name, 4, NULL, &len, NULL, 0);
+		if (error < 0 && errno != EPERM) {
+			warn("sysctl(kern.proc)");
+			goto fail;
+		}
+		if (len == 0) {
+			warnx("no processes?");
+			goto fail;
+		}
+		p = malloc(len);
+		if (p == NULL) {
+			warnx("malloc(%zd)", len);
+			goto fail;
+		}
+		error = sysctl(name, 4, p, &len, NULL, 0);
+		if (error < 0 && errno != EPERM) {
+			warn("sysctl(kern.proc)");
+			goto fail;
+		}
+		/* Perform simple consistency checks. */
+		if ((len % sizeof(*p)) != 0 || p->ki_structsize != sizeof(*p)) {
+			warnx("kinfo_proc structure size mismatch");
+			goto fail;
+		}
+		*count = len / sizeof(*p);
+		return (p);
+	} else {
+		warnx("unknown access method");
+		return (NULL);
+	}
+fail:
+	if (p)
+		free(p);
+	return (NULL);
+}
+
+void
+procstat_freeprocs(struct procstat *procstat __unused, struct kinfo_proc *p)
+{
+
+	if (p != NULL)
+		free(p);
+	p = NULL;
+}
+
+struct filestat_list *
+procstat_getfiles(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
+{
+	
+	if (procstat->type == PROCSTAT_SYSCTL)
+		return (procstat_getfiles_sysctl(procstat, kp, mmapped));
+	else if (procstat->type == PROCSTAT_KVM)
+		 return (procstat_getfiles_kvm(procstat, kp, mmapped));
+	else
+		return (NULL);
+}
+
+void
+procstat_freefiles(struct procstat *procstat, struct filestat_list *head)
+{
+	struct filestat *fst, *tmp;
+
+	STAILQ_FOREACH_SAFE(fst, head, next, tmp) {
+		if (fst->fs_path != NULL)
+			free(fst->fs_path);
+		free(fst);
+	}
+	free(head);
+	if (procstat->vmentries != NULL) {
+		free (procstat->vmentries);
+		procstat->vmentries = NULL;
+	}
+	if (procstat->files != NULL) {
+		free (procstat->files);
+		procstat->files = NULL;
+	}
+}
+
+static struct filestat *
+filestat_new_entry(void *typedep, int type, int fd, int fflags, int uflags,
+    int refcount, off_t offset, char *path)
+{
+	struct filestat *entry;
+
+	entry = calloc(1, sizeof(*entry));
+	if (entry == NULL) {
+		warn("malloc()");
+		return (NULL);
+	}
+	entry->fs_typedep = typedep;
+	entry->fs_fflags = fflags;
+	entry->fs_uflags = uflags;
+	entry->fs_fd = fd;
+	entry->fs_type = type;
+	entry->fs_ref_count = refcount;
+	entry->fs_offset = offset;
+	entry->fs_path = path;
+	return (entry);
+}
+
+static struct vnode *
+getctty(kvm_t *kd, struct kinfo_proc *kp)
+{
+	struct pgrp pgrp;
+	struct proc proc;
+	struct session sess;
+	int error;
+                        
+	assert(kp);
+	error = kvm_read_all(kd, (unsigned long)kp->ki_paddr, &proc,
+	    sizeof(proc));
+	if (error == 0) {
+		warnx("can't read proc struct at %p for pid %d",
+		    kp->ki_paddr, kp->ki_pid);
+		return (NULL);
+	}
+	if (proc.p_pgrp == NULL)
+		return (NULL);
+	error = kvm_read_all(kd, (unsigned long)proc.p_pgrp, &pgrp,
+	    sizeof(pgrp));
+	if (error == 0) {
+		warnx("can't read pgrp struct at %p for pid %d",
+		    proc.p_pgrp, kp->ki_pid);
+		return (NULL);
+	}
+	error = kvm_read_all(kd, (unsigned long)pgrp.pg_session, &sess,
+	    sizeof(sess));
+	if (error == 0) {
+		warnx("can't read session struct at %p for pid %d",
+		    pgrp.pg_session, kp->ki_pid);
+		return (NULL);
+	}
+	return (sess.s_ttyvp);
+}
+
+static struct filestat_list *
+procstat_getfiles_kvm(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
+{
+	struct file file;
+	struct filedesc filed;
+	struct vm_map_entry vmentry;
+	struct vm_object object;
+	struct vmspace vmspace;
+	vm_map_entry_t entryp;
+	vm_map_t map;
+	vm_object_t objp;
+	struct vnode *vp;
+	struct file **ofiles;
+	struct filestat *entry;
+	struct filestat_list *head;
+	kvm_t *kd;
+	void *data;
+	int i, fflags;
+	int prot, type;
+	unsigned int nfiles;
+
+	assert(procstat);
+	kd = procstat->kd;
+	if (kd == NULL)
+		return (NULL);
+	if (kp->ki_fd == NULL)
+		return (NULL);
+	if (!kvm_read_all(kd, (unsigned long)kp->ki_fd, &filed,
+	    sizeof(filed))) {
+		warnx("can't read filedesc at %p", (void *)kp->ki_fd);
+		return (NULL);
+	}
+
+	/*
+	 * Allocate list head.
+	 */
+	head = malloc(sizeof(*head));
+	if (head == NULL)
+		return (NULL);
+	STAILQ_INIT(head);
+
+	/* root directory vnode, if one. */
+	if (filed.fd_rdir) {
+		entry = filestat_new_entry(filed.fd_rdir, PS_FST_TYPE_VNODE, -1,
+		    PS_FST_FFLAG_READ, PS_FST_UFLAG_RDIR, 0, 0, NULL);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+	/* current working directory vnode. */
+	if (filed.fd_cdir) {
+		entry = filestat_new_entry(filed.fd_cdir, PS_FST_TYPE_VNODE, -1,
+		    PS_FST_FFLAG_READ, PS_FST_UFLAG_CDIR, 0, 0, NULL);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+	/* jail root, if any. */
+	if (filed.fd_jdir) {
+		entry = filestat_new_entry(filed.fd_jdir, PS_FST_TYPE_VNODE, -1,
+		    PS_FST_FFLAG_READ, PS_FST_UFLAG_JAIL, 0, 0, NULL);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+	/* ktrace vnode, if one */
+	if (kp->ki_tracep) {
+		entry = filestat_new_entry(kp->ki_tracep, PS_FST_TYPE_VNODE, -1,
+		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
+		    PS_FST_UFLAG_TRACE, 0, 0, NULL);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+	/* text vnode, if one */
+	if (kp->ki_textvp) {
+		entry = filestat_new_entry(kp->ki_textvp, PS_FST_TYPE_VNODE, -1,
+		    PS_FST_FFLAG_READ, PS_FST_UFLAG_TEXT, 0, 0, NULL);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+	/* Controlling terminal. */
+	if ((vp = getctty(kd, kp)) != NULL) {
+		entry = filestat_new_entry(vp, PS_FST_TYPE_VNODE, -1,
+		    PS_FST_FFLAG_READ | PS_FST_FFLAG_WRITE,
+		    PS_FST_UFLAG_CTTY, 0, 0, NULL);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+
+	nfiles = filed.fd_lastfile + 1;
+	ofiles = malloc(nfiles * sizeof(struct file *));
+	if (ofiles == NULL) {
+		warn("malloc(%zd)", nfiles * sizeof(struct file *));
+		goto do_mmapped;
+	}
+	if (!kvm_read_all(kd, (unsigned long)filed.fd_ofiles, ofiles,
+	    nfiles * sizeof(struct file *))) {
+		warnx("cannot read file structures at %p",
+		    (void *)filed.fd_ofiles);
+		free(ofiles);
+		goto do_mmapped;
+	}
+	for (i = 0; i <= filed.fd_lastfile; i++) {
+		if (ofiles[i] == NULL)
+			continue;
+		if (!kvm_read_all(kd, (unsigned long)ofiles[i], &file,
+		    sizeof(struct file))) {
+			warnx("can't read file %d at %p", i,
+			    (void *)ofiles[i]);
+			continue;
+		}
+		switch (file.f_type) {
+		case DTYPE_VNODE:
+			type = PS_FST_TYPE_VNODE;
+			data = file.f_vnode;
+			break;
+		case DTYPE_SOCKET:
+			type = PS_FST_TYPE_SOCKET;
+			data = file.f_data;
+			break;
+		case DTYPE_PIPE:
+			type = PS_FST_TYPE_PIPE;
+			data = file.f_data;
+			break;
+		case DTYPE_FIFO:
+			type = PS_FST_TYPE_FIFO;
+			data = file.f_vnode;
+			break;
+#ifdef DTYPE_PTS
+		case DTYPE_PTS:
+			type = PS_FST_TYPE_PTS;
+			data = file.f_data;
+			break;
+#endif
+		default:
+			continue;
+		}
+		entry = filestat_new_entry(data, type, i,
+		    to_filestat_flags(file.f_flag), 0, 0, 0, NULL);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+	free(ofiles);
+
+do_mmapped:
+
+	/*
+	 * Process mmapped files if requested.
+	 */
+	if (mmapped) {
+		if (!kvm_read_all(kd, (unsigned long)kp->ki_vmspace, &vmspace,
+		    sizeof(vmspace))) {
+			warnx("can't read vmspace at %p",
+			    (void *)kp->ki_vmspace);
+			goto exit;
+		}
+		map = &vmspace.vm_map;
+
+		for (entryp = map->header.next;
+		    entryp != &kp->ki_vmspace->vm_map.header;
+		    entryp = vmentry.next) {
+			if (!kvm_read_all(kd, (unsigned long)entryp, &vmentry,
+			    sizeof(vmentry))) {
+				warnx("can't read vm_map_entry at %p",
+				    (void *)entryp);
+				continue;
+			}
+			if (vmentry.eflags & MAP_ENTRY_IS_SUB_MAP)
+				continue;
+			if ((objp = vmentry.object.vm_object) == NULL)
+				continue;
+			for (; objp; objp = object.backing_object) {
+				if (!kvm_read_all(kd, (unsigned long)objp,
+				    &object, sizeof(object))) {
+					warnx("can't read vm_object at %p",
+					    (void *)objp);
+					break;
+				}
+			}
+
+			/* We want only vnode objects. */
+			if (object.type != OBJT_VNODE)
+				continue;
+
+			prot = vmentry.protection;
+			fflags = 0;
+			if (prot & VM_PROT_READ)
+				fflags = PS_FST_FFLAG_READ;
+			if (prot & VM_PROT_WRITE)
+				fflags |= PS_FST_FFLAG_WRITE;
+
+			/*
+			 * Create filestat entry.
+			 */
+			entry = filestat_new_entry(object.handle,
+			    PS_FST_TYPE_VNODE, -1, fflags,
+			    PS_FST_UFLAG_MMAP, 0, 0, NULL);
+			if (entry != NULL)
+				STAILQ_INSERT_TAIL(head, entry, next);
+		}
+	}
+exit:
+	return (head);
+}
+
+/*
+ * kinfo types to filestat translation.
+ */
+static int
+kinfo_type2fst(int kftype)
+{
+	static struct {
+		int	kf_type;
+		int	fst_type;
+	} kftypes2fst[] = {
+		{ KF_TYPE_CRYPTO, PS_FST_TYPE_CRYPTO },
+		{ KF_TYPE_FIFO, PS_FST_TYPE_FIFO },
+		{ KF_TYPE_KQUEUE, PS_FST_TYPE_KQUEUE },
+		{ KF_TYPE_MQUEUE, PS_FST_TYPE_MQUEUE },
+		{ KF_TYPE_NONE, PS_FST_TYPE_NONE },
+		{ KF_TYPE_PIPE, PS_FST_TYPE_PIPE },
+		{ KF_TYPE_PTS, PS_FST_TYPE_PTS },
+		{ KF_TYPE_SEM, PS_FST_TYPE_SEM },
+		{ KF_TYPE_SHM, PS_FST_TYPE_SHM },
+		{ KF_TYPE_SOCKET, PS_FST_TYPE_SOCKET },
+		{ KF_TYPE_VNODE, PS_FST_TYPE_VNODE },
+		{ KF_TYPE_UNKNOWN, PS_FST_TYPE_UNKNOWN }
+	};
+#define NKFTYPES	(sizeof(kftypes2fst) / sizeof(*kftypes2fst))
+	unsigned int i;
+
+	for (i = 0; i < NKFTYPES; i++)
+		if (kftypes2fst[i].kf_type == kftype)
+			break;
+	if (i == NKFTYPES)
+		return (PS_FST_TYPE_UNKNOWN);
+	return (kftypes2fst[i].fst_type);
+}
+
+/*
+ * kinfo flags to filestat translation.
+ */
+static int
+kinfo_fflags2fst(int kfflags)
+{
+	static struct {
+		int	kf_flag;
+		int	fst_flag;
+	} kfflags2fst[] = {
+		{ KF_FLAG_APPEND, PS_FST_FFLAG_APPEND },
+		{ KF_FLAG_ASYNC, PS_FST_FFLAG_ASYNC },
+		{ KF_FLAG_CREAT, PS_FST_FFLAG_CREAT },
+		{ KF_FLAG_DIRECT, PS_FST_FFLAG_DIRECT },
+		{ KF_FLAG_EXCL, PS_FST_FFLAG_EXCL },
+		{ KF_FLAG_EXEC, PS_FST_FFLAG_EXEC },
+		{ KF_FLAG_EXLOCK, PS_FST_FFLAG_EXLOCK },
+		{ KF_FLAG_FSYNC, PS_FST_FFLAG_SYNC },
+		{ KF_FLAG_HASLOCK, PS_FST_FFLAG_HASLOCK },
+		{ KF_FLAG_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
+		{ KF_FLAG_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
+		{ KF_FLAG_READ, PS_FST_FFLAG_READ },
+		{ KF_FLAG_SHLOCK, PS_FST_FFLAG_SHLOCK },
+		{ KF_FLAG_TRUNC, PS_FST_FFLAG_TRUNC },
+		{ KF_FLAG_WRITE, PS_FST_FFLAG_WRITE }
+	};
+#define NKFFLAGS	(sizeof(kfflags2fst) / sizeof(*kfflags2fst))
+	unsigned int i;
+	int flags;
+
+	flags = 0;
+	for (i = 0; i < NKFFLAGS; i++)
+		if ((kfflags & kfflags2fst[i].kf_flag) != 0)
+			flags |= kfflags2fst[i].fst_flag;
+	return (flags);
+}
+
+static int
+kinfo_uflags2fst(int fd)
+{
+
+	switch (fd) {
+	case KF_FD_TYPE_CTTY:
+		return (PS_FST_UFLAG_CTTY);
+	case KF_FD_TYPE_CWD:
+		return (PS_FST_UFLAG_CDIR);
+	case KF_FD_TYPE_JAIL:
+		return (PS_FST_UFLAG_JAIL);
+	case KF_FD_TYPE_TEXT:
+		return (PS_FST_UFLAG_TEXT);
+	case KF_FD_TYPE_TRACE:
+		return (PS_FST_UFLAG_TRACE);
+	case KF_FD_TYPE_ROOT:
+		return (PS_FST_UFLAG_RDIR);
+	}
+	return (0);
+}
+
+static struct filestat_list *
+procstat_getfiles_sysctl(struct procstat *procstat, struct kinfo_proc *kp, int mmapped)
+{
+	struct kinfo_file *kif, *files;
+	struct kinfo_vmentry *kve, *vmentries;
+	struct filestat_list *head;
+	struct filestat *entry;
+	char *path;
+	off_t offset;
+	int cnt, fd, fflags;
+	int i, type, uflags;
+	int refcount;
+
+	assert(kp);
+	if (kp->ki_fd == NULL)
+		return (NULL);
+
+	files = kinfo_getfile(kp->ki_pid, &cnt);
+	if (files == NULL && errno != EPERM) {
+		warn("kinfo_getfile()");
+		return (NULL);
+	}
+	procstat->files = files;
+
+	/*
+	 * Allocate list head.
+	 */
+	head = malloc(sizeof(*head));
+	if (head == NULL)
+		return (NULL);
+	STAILQ_INIT(head);
+	for (i = 0; i < cnt; i++) {
+		kif = &files[i];
+
+		type = kinfo_type2fst(kif->kf_type);
+		fd = kif->kf_fd >= 0 ? kif->kf_fd : -1;
+		fflags = kinfo_fflags2fst(kif->kf_flags);
+		uflags = kinfo_uflags2fst(kif->kf_fd);
+		refcount = kif->kf_ref_count;
+		offset = kif->kf_offset;
+		if (*kif->kf_path != '\0')
+			path = strdup(kif->kf_path);
+		else
+			path = NULL;
+
+		/*
+		 * Create filestat entry.
+		 */
+		entry = filestat_new_entry(kif, type, fd, fflags, uflags,
+		    refcount, offset, path);
+		if (entry != NULL)
+			STAILQ_INSERT_TAIL(head, entry, next);
+	}
+	if (mmapped != 0) {
+		vmentries = kinfo_getvmmap(kp->ki_pid, &cnt);
+		procstat->vmentries = vmentries;
+		if (vmentries == NULL || cnt == 0)
+			goto fail;
+		for (i = 0; i < cnt; i++) {
+			kve = &vmentries[i];
+			if (kve->kve_type != KVME_TYPE_VNODE)
+				continue;
+			fflags = 0;
+			if (kve->kve_protection & KVME_PROT_READ)
+				fflags = PS_FST_FFLAG_READ;
+			if (kve->kve_protection & KVME_PROT_WRITE)
+				fflags |= PS_FST_FFLAG_WRITE;
+			offset = kve->kve_offset;
+			refcount = kve->kve_ref_count;
+			if (*kve->kve_path != '\0')
+				path = strdup(kve->kve_path);
+			else
+				path = NULL;
+			entry = filestat_new_entry(kve, PS_FST_TYPE_VNODE, -1,
+			    fflags, PS_FST_UFLAG_MMAP, refcount, offset, path);
+			if (entry != NULL)
+				STAILQ_INSERT_TAIL(head, entry, next);
+		}
+	}
+fail:
+	return (head);
+}
+
+int
+procstat_get_pipe_info(struct procstat *procstat, struct filestat *fst,
+    struct pipestat *ps, char *errbuf)
+{
+
+	assert(ps);
+	if (procstat->type == PROCSTAT_KVM) {
+		return (procstat_get_pipe_info_kvm(procstat->kd, fst, ps,
+		    errbuf));
+	} else if (procstat->type == PROCSTAT_SYSCTL) {
+		return (procstat_get_pipe_info_sysctl(fst, ps, errbuf));
+	} else {
+		warnx("unknow access method: %d", procstat->type);
+		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+		return (1);
+	}
+}
+
+static int
+procstat_get_pipe_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct pipestat *ps, char *errbuf)
+{
+	struct pipe pi;
+	void *pipep;
+
+	assert(kd);
+	assert(ps);
+	assert(fst);
+	bzero(ps, sizeof(*ps));
+	pipep = fst->fs_typedep;
+	if (pipep == NULL)
+		goto fail;
+	if (!kvm_read_all(kd, (unsigned long)pipep, &pi, sizeof(struct pipe))) {
+		warnx("can't read pipe at %p", (void *)pipep);
+		goto fail;
+	}
+	ps->addr = (uintptr_t)pipep;
+	ps->peer = (uintptr_t)pi.pipe_peer;
+	ps->buffer_cnt = pi.pipe_buffer.cnt;
+	return (0);
+
+fail:
+	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+	return (1);
+}
+
+static int
+procstat_get_pipe_info_sysctl(struct filestat *fst, struct pipestat *ps,
+    char *errbuf __unused)
+{
+	struct kinfo_file *kif;
+
+	assert(ps);
+	assert(fst);
+	bzero(ps, sizeof(*ps));
+	kif = fst->fs_typedep;
+	if (kif == NULL)
+		return (1);
+	ps->addr = kif->kf_un.kf_pipe.kf_pipe_addr;
+	ps->peer = kif->kf_un.kf_pipe.kf_pipe_peer;
+	ps->buffer_cnt = kif->kf_un.kf_pipe.kf_pipe_buffer_cnt;
+	return (0);
+}
+
+int
+procstat_get_pts_info(struct procstat *procstat, struct filestat *fst,
+    struct ptsstat *pts, char *errbuf)
+{
+
+	assert(pts);
+	if (procstat->type == PROCSTAT_KVM) {
+		return (procstat_get_pts_info_kvm(procstat->kd, fst, pts,
+		    errbuf));
+	} else if (procstat->type == PROCSTAT_SYSCTL) {
+		return (procstat_get_pts_info_sysctl(fst, pts, errbuf));
+	} else {
+		warnx("unknow access method: %d", procstat->type);
+		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+		return (1);
+	}
+}
+
+static int
+procstat_get_pts_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct ptsstat *pts, char *errbuf)
+{
+	struct tty tty;
+	void *ttyp;
+
+	assert(kd);
+	assert(pts);
+	assert(fst);
+	bzero(pts, sizeof(*pts));
+	ttyp = fst->fs_typedep;
+	if (ttyp == NULL)
+		goto fail;
+	if (!kvm_read_all(kd, (unsigned long)ttyp, &tty, sizeof(struct tty))) {
+		warnx("can't read tty at %p", (void *)ttyp);
+		goto fail;
+	}
+	pts->dev = dev2udev(kd, tty.t_dev);
+	(void)kdevtoname(kd, tty.t_dev, pts->devname);
+	return (0);
+
+fail:
+	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+	return (1);
+}
+
+static int
+procstat_get_pts_info_sysctl(struct filestat *fst, struct ptsstat *pts,
+    char *errbuf __unused)
+{
+	struct kinfo_file *kif;
+
+	assert(pts);
+	assert(fst);
+	bzero(pts, sizeof(*pts));
+	kif = fst->fs_typedep;
+	if (kif == NULL)
+		return (0);
+	pts->dev = kif->kf_un.kf_pts.kf_pts_dev;
+	strlcpy(pts->devname, kif->kf_path, sizeof(pts->devname));
+	return (0);
+}
+
+int
+procstat_get_vnode_info(struct procstat *procstat, struct filestat *fst,
+    struct vnstat *vn, char *errbuf)
+{
+
+	assert(vn);
+	if (procstat->type == PROCSTAT_KVM) {
+		return (procstat_get_vnode_info_kvm(procstat->kd, fst, vn,
+		    errbuf));
+	} else if (procstat->type == PROCSTAT_SYSCTL) {
+		return (procstat_get_vnode_info_sysctl(fst, vn, errbuf));
+	} else {
+		warnx("unknow access method: %d", procstat->type);
+		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+		return (1);
+	}
+}
+
+static int
+procstat_get_vnode_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct vnstat *vn, char *errbuf)
+{
+	/* Filesystem specific handlers. */
+	#define FSTYPE(fst)     {#fst, fst##_filestat}
+	struct {
+		const char	*tag;
+		int		(*handler)(kvm_t *kd, struct vnode *vp,
+		    struct vnstat *vn);
+	} fstypes[] = {
+		FSTYPE(devfs),
+		FSTYPE(isofs),
+		FSTYPE(msdosfs),
+		FSTYPE(nfs),
+		FSTYPE(ntfs),
+		FSTYPE(nwfs), 
+		FSTYPE(smbfs),
+		FSTYPE(udf), 
+		FSTYPE(ufs),
+#ifdef ZFS
+		FSTYPE(zfs),
+#endif
+	};
+#define	NTYPES	(sizeof(fstypes) / sizeof(*fstypes))
+	struct vnode vnode;
+	char tagstr[12];
+	void *vp;
+	int error, found;
+	unsigned int i;
+
+	assert(kd);
+	assert(vn);
+	assert(fst);
+	vp = fst->fs_typedep;
+	if (vp == NULL)
+		goto fail;
+	error = kvm_read_all(kd, (unsigned long)vp, &vnode, sizeof(vnode));
+	if (error == 0) {
+		warnx("can't read vnode at %p", (void *)vp);
+		goto fail;
+	}
+	bzero(vn, sizeof(*vn));
+	vn->vn_type = vntype2psfsttype(vnode.v_type);
+	if (vnode.v_type == VNON || vnode.v_type == VBAD)
+		return (0);
+	error = kvm_read_all(kd, (unsigned long)vnode.v_tag, tagstr,
+	    sizeof(tagstr));
+	if (error == 0) {
+		warnx("can't read v_tag at %p", (void *)vp);
+		goto fail;
+	}
+	tagstr[sizeof(tagstr) - 1] = '\0';
+
+	/*
+	 * Find appropriate handler.
+	 */
+	for (i = 0, found = 0; i < NTYPES; i++)
+		if (!strcmp(fstypes[i].tag, tagstr)) {
+			if (fstypes[i].handler(kd, &vnode, vn) != 0) {
+				goto fail;
+			}
+			break;
+		}
+	if (i == NTYPES) {
+		snprintf(errbuf, _POSIX2_LINE_MAX, "?(%s)", tagstr);
+		return (1);
+	}
+	vn->vn_mntdir = getmnton(kd, vnode.v_mount);
+	if ((vnode.v_type == VBLK || vnode.v_type == VCHR) &&
+	    vnode.v_rdev != NULL){
+		vn->vn_dev = dev2udev(kd, vnode.v_rdev);
+		(void)kdevtoname(kd, vnode.v_rdev, vn->vn_devname);
+	} else {
+		vn->vn_dev = -1;
+	}
+	return (0);
+
+fail:
+	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+	return (1);
+}
+
+/*
+ * kinfo vnode type to filestat translation.
+ */
+static int
+kinfo_vtype2fst(int kfvtype)
+{
+	static struct {
+		int	kf_vtype; 
+		int	fst_vtype;
+	} kfvtypes2fst[] = {
+		{ KF_VTYPE_VBAD, PS_FST_VTYPE_VBAD },
+		{ KF_VTYPE_VBLK, PS_FST_VTYPE_VBLK },
+		{ KF_VTYPE_VCHR, PS_FST_VTYPE_VCHR },
+		{ KF_VTYPE_VDIR, PS_FST_VTYPE_VDIR },
+		{ KF_VTYPE_VFIFO, PS_FST_VTYPE_VFIFO },
+		{ KF_VTYPE_VLNK, PS_FST_VTYPE_VLNK },
+		{ KF_VTYPE_VNON, PS_FST_VTYPE_VNON },
+		{ KF_VTYPE_VREG, PS_FST_VTYPE_VREG },
+		{ KF_VTYPE_VSOCK, PS_FST_VTYPE_VSOCK }
+	};
+#define	NKFVTYPES	(sizeof(kfvtypes2fst) / sizeof(*kfvtypes2fst))
+	unsigned int i;
+
+	for (i = 0; i < NKFVTYPES; i++)
+		if (kfvtypes2fst[i].kf_vtype == kfvtype)
+			break;
+	if (i == NKFVTYPES)
+		return (PS_FST_VTYPE_UNKNOWN);
+	return (kfvtypes2fst[i].fst_vtype);
+}
+
+static int
+procstat_get_vnode_info_sysctl(struct filestat *fst, struct vnstat *vn,
+    char *errbuf)
+{
+	struct statfs stbuf;
+	struct kinfo_file *kif;
+	struct kinfo_vmentry *kve;
+	uint64_t fileid;
+	uint64_t size;
+	char *name, *path;
+	uint32_t fsid;
+	uint16_t mode;
+	uint32_t rdev;
+	int vntype;
+	int status;
+
+	assert(fst);
+	assert(vn);
+	bzero(vn, sizeof(*vn));
+	if (fst->fs_typedep == NULL)
+		return (1);
+	if (fst->fs_uflags & PS_FST_UFLAG_MMAP) {
+		kve = fst->fs_typedep;
+		fileid = kve->kve_vn_fileid;
+		fsid = kve->kve_vn_fsid;
+		mode = kve->kve_vn_mode;
+		path = kve->kve_path;
+		rdev = kve->kve_vn_rdev;
+		size = kve->kve_vn_size;
+		vntype = kinfo_vtype2fst(kve->kve_vn_type);
+		status = kve->kve_status;
+	} else {
+		kif = fst->fs_typedep;
+		fileid = kif->kf_un.kf_file.kf_file_fileid;
+		fsid = kif->kf_un.kf_file.kf_file_fsid;
+		mode = kif->kf_un.kf_file.kf_file_mode;
+		path = kif->kf_path;
+		rdev = kif->kf_un.kf_file.kf_file_rdev;
+		size = kif->kf_un.kf_file.kf_file_size;
+		vntype = kinfo_vtype2fst(kif->kf_vnode_type);
+		status = kif->kf_status;
+	}
+	vn->vn_type = vntype;
+	if (vntype == PS_FST_VTYPE_VNON || vntype == PS_FST_VTYPE_VBAD)
+		return (0);
+	if ((status & KF_ATTR_VALID) == 0) {
+		snprintf(errbuf, _POSIX2_LINE_MAX, "? (no info available)");
+		return (1);
+	}
+	if (path && *path) {
+		statfs(path, &stbuf);
+		vn->vn_mntdir = strdup(stbuf.f_mntonname);
+	} else
+		vn->vn_mntdir = strdup("-");
+	vn->vn_dev = rdev;
+	if (vntype == PS_FST_VTYPE_VBLK) {
+		name = devname(rdev, S_IFBLK);
+		if (name != NULL)
+			strlcpy(vn->vn_devname, name,
+			    sizeof(vn->vn_devname));
+	} else if (vntype == PS_FST_VTYPE_VCHR) {
+		name = devname(vn->vn_dev, S_IFCHR);
+		if (name != NULL)
+			strlcpy(vn->vn_devname, name,
+			    sizeof(vn->vn_devname));
+	}
+	vn->vn_fsid = fsid;
+	vn->vn_fileid = fileid;
+	vn->vn_size = size;
+	vn->vn_mode = mode;
+	return (0);
+}
+
+int
+procstat_get_socket_info(struct procstat *procstat, struct filestat *fst,
+    struct sockstat *sock, char *errbuf)
+{
+
+	assert(sock);
+	if (procstat->type == PROCSTAT_KVM) {
+		return (procstat_get_socket_info_kvm(procstat->kd, fst, sock,
+		    errbuf));
+	} else if (procstat->type == PROCSTAT_SYSCTL) {
+		return (procstat_get_socket_info_sysctl(fst, sock, errbuf));
+	} else {
+		warnx("unknow access method: %d", procstat->type);
+		snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+		return (1);
+	}
+}
+
+static int
+procstat_get_socket_info_kvm(kvm_t *kd, struct filestat *fst,
+    struct sockstat *sock, char *errbuf)
+{
+	struct domain dom;
+	struct inpcb inpcb;
+	struct protosw proto;
+	struct socket s;
+	struct unpcb unpcb;
+	ssize_t len;
+	void *so;
+
+	assert(kd);
+	assert(sock);
+	assert(fst);
+	bzero(sock, sizeof(*sock));
+	so = fst->fs_typedep;
+	if (so == NULL)
+		goto fail;
+	sock->so_addr = (uintptr_t)so;
+	/* fill in socket */
+	if (!kvm_read_all(kd, (unsigned long)so, &s,
+	    sizeof(struct socket))) {
+		warnx("can't read sock at %p", (void *)so);
+		goto fail;
+	}
+	/* fill in protosw entry */
+	if (!kvm_read_all(kd, (unsigned long)s.so_proto, &proto,
+	    sizeof(struct protosw))) {
+		warnx("can't read protosw at %p", (void *)s.so_proto);
+		goto fail;
+	}
+	/* fill in domain */
+	if (!kvm_read_all(kd, (unsigned long)proto.pr_domain, &dom,
+	    sizeof(struct domain))) {
+		warnx("can't read domain at %p",
+		    (void *)proto.pr_domain);
+		goto fail;
+	}
+	if ((len = kvm_read(kd, (unsigned long)dom.dom_name, sock->dname,
+	    sizeof(sock->dname) - 1)) < 0) {
+		warnx("can't read domain name at %p", (void *)dom.dom_name);
+		sock->dname[0] = '\0';
+	}
+	else
+		sock->dname[len] = '\0';
+	
+	/*
+	 * Fill in known data.
+	 */
+	sock->type = s.so_type;
+	sock->proto = proto.pr_protocol;
+	sock->dom_family = dom.dom_family;
+	sock->so_pcb = (uintptr_t)s.so_pcb;
+
+	/*
+	 * Protocol specific data.
+	 */
+	switch(dom.dom_family) {
+	case AF_INET:
+	case AF_INET6:
+		if (proto.pr_protocol == IPPROTO_TCP) {
+			if (s.so_pcb) {
+				if (kvm_read(kd, (u_long)s.so_pcb,
+				    (char *)&inpcb, sizeof(struct inpcb))
+				    != sizeof(struct inpcb)) {
+					warnx("can't read inpcb at %p",
+					    (void *)s.so_pcb);
+				} else
+					sock->inp_ppcb =
+					    (uintptr_t)inpcb.inp_ppcb;
+			}
+		}
+		break;
+	case AF_UNIX:
+		if (s.so_pcb) {
+			if (kvm_read(kd, (u_long)s.so_pcb, (char *)&unpcb,
+			    sizeof(struct unpcb)) != sizeof(struct unpcb)){
+				warnx("can't read unpcb at %p",
+				    (void *)s.so_pcb);
+			} else if (unpcb.unp_conn) {
+				sock->so_rcv_sb_state = s.so_rcv.sb_state;
+				sock->so_snd_sb_state = s.so_snd.sb_state;
+				sock->unp_conn = (uintptr_t)unpcb.unp_conn;
+			}
+		}
+		break;
+	default:
+		break;
+	}
+	return (0);
+
+fail:
+	snprintf(errbuf, _POSIX2_LINE_MAX, "error");
+	return (1);
+}
+
+static int
+procstat_get_socket_info_sysctl(struct filestat *fst, struct sockstat *sock,
+    char *errbuf __unused)
+{
+	struct kinfo_file *kif;
+
+	assert(sock);
+	assert(fst);
+	bzero(sock, sizeof(*sock));
+	kif = fst->fs_typedep;
+	if (kif == NULL)
+		return (0);
+
+	/*
+	 * Fill in known data.
+	 */
+	sock->type = kif->kf_sock_type;
+	sock->proto = kif->kf_sock_protocol;
+	sock->dom_family = kif->kf_sock_domain;
+	sock->so_pcb = kif->kf_un.kf_sock.kf_sock_pcb;
+	strlcpy(sock->dname, kif->kf_path, sizeof(sock->dname));
+	bcopy(&kif->kf_sa_local, &sock->sa_local, kif->kf_sa_local.ss_len);
+	bcopy(&kif->kf_sa_peer, &sock->sa_peer, kif->kf_sa_peer.ss_len);
+
+	/*
+	 * Protocol specific data.
+	 */
+	switch(sock->dom_family) {
+	case AF_INET:
+	case AF_INET6:
+		if (sock->proto == IPPROTO_TCP)
+			sock->inp_ppcb = kif->kf_un.kf_sock.kf_sock_inpcb;
+		break;
+	case AF_UNIX:
+		if (kif->kf_un.kf_sock.kf_sock_unpconn != 0) {
+				sock->so_rcv_sb_state =
+				    kif->kf_un.kf_sock.kf_sock_rcv_sb_state;
+				sock->so_snd_sb_state =
+				    kif->kf_un.kf_sock.kf_sock_snd_sb_state;
+				sock->unp_conn =
+				    kif->kf_un.kf_sock.kf_sock_unpconn;
+		}
+		break;
+	default:
+		break;
+	}
+	return (0);
+}
+
+/*
+ * Descriptor flags to filestat translation.
+ */
+static int
+to_filestat_flags(int flags)
+{
+	static struct {
+		int flag;
+		int fst_flag;
+	} fstflags[] = {
+		{ FREAD, PS_FST_FFLAG_READ },
+		{ FWRITE, PS_FST_FFLAG_WRITE },
+		{ O_APPEND, PS_FST_FFLAG_APPEND },
+		{ O_ASYNC, PS_FST_FFLAG_ASYNC },
+		{ O_CREAT, PS_FST_FFLAG_CREAT },
+		{ O_DIRECT, PS_FST_FFLAG_DIRECT },
+		{ O_EXCL, PS_FST_FFLAG_EXCL },
+		{ O_EXEC, PS_FST_FFLAG_EXEC },
+		{ O_EXLOCK, PS_FST_FFLAG_EXLOCK },
+		{ O_NOFOLLOW, PS_FST_FFLAG_NOFOLLOW },
+		{ O_NONBLOCK, PS_FST_FFLAG_NONBLOCK },
+		{ O_SHLOCK, PS_FST_FFLAG_SHLOCK },
+		{ O_SYNC, PS_FST_FFLAG_SYNC },
+		{ O_TRUNC, PS_FST_FFLAG_TRUNC }
+	};
+#define NFSTFLAGS	(sizeof(fstflags) / sizeof(*fstflags))
+	int fst_flags;
+	unsigned int i;
+
+	fst_flags = 0;
+	for (i = 0; i < NFSTFLAGS; i++)
+		if (flags & fstflags[i].flag)
+			fst_flags |= fstflags[i].fst_flag;
+	return (fst_flags);
+}
+
+/*
+ * Vnode type to filestate translation.
+ */
+static int
+vntype2psfsttype(int type)
+{
+	static struct {
+		int	vtype; 
+		int	fst_vtype;
+	} vt2fst[] = {
+		{ VBAD, PS_FST_VTYPE_VBAD },
+		{ VBLK, PS_FST_VTYPE_VBLK },
+		{ VCHR, PS_FST_VTYPE_VCHR },
+		{ VDIR, PS_FST_VTYPE_VDIR },
+		{ VFIFO, PS_FST_VTYPE_VFIFO },
+		{ VLNK, PS_FST_VTYPE_VLNK },
+		{ VNON, PS_FST_VTYPE_VNON },
+		{ VREG, PS_FST_VTYPE_VREG },
+		{ VSOCK, PS_FST_VTYPE_VSOCK }
+	};
+#define	NVFTYPES	(sizeof(vt2fst) / sizeof(*vt2fst))
+	unsigned int i, fst_type;
+
+	fst_type = PS_FST_VTYPE_UNKNOWN;
+	for (i = 0; i < NVFTYPES; i++) {
+		if (type == vt2fst[i].vtype) {
+			fst_type = vt2fst[i].fst_vtype;
+			break;
+		}
+	}
+	return (fst_type);
+}
+
+static char *
+getmnton(kvm_t *kd, struct mount *m)
+{
+	static struct mount mnt;
+	static struct mtab {
+		struct mtab *next;
+		struct mount *m;
+		char mntonname[MNAMELEN + 1];
+	} *mhead = NULL;
+	struct mtab *mt;
+
+	for (mt = mhead; mt != NULL; mt = mt->next)
+		if (m == mt->m)
+			return (mt->mntonname);
+	if (!kvm_read_all(kd, (unsigned long)m, &mnt, sizeof(struct mount))) {
+		warnx("can't read mount table at %p", (void *)m);
+		return (NULL);
+	}
+	if ((mt = malloc(sizeof (struct mtab))) == NULL)
+		err(1, NULL);
+	mt->m = m;
+	bcopy(&mnt.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
+	mnt.mnt_stat.f_mntonname[MNAMELEN] = '\0';
+	mt->next = mhead;
+	mhead = mt;
+	return (mt->mntonname);
+}
diff --git a/lib/libprocstat/libprocstat.h b/lib/libprocstat/libprocstat.h
new file mode 100644
index 0000000..62b1bd5
--- /dev/null
+++ b/lib/libprocstat/libprocstat.h
@@ -0,0 +1,160 @@
+/*-
+ * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _LIBPROCSTAT_H_
+#define	_LIBPROCSTAT_H_
+
+/*
+ * Vnode types.
+ */
+#define	PS_FST_VTYPE_VNON	1
+#define	PS_FST_VTYPE_VREG	2
+#define	PS_FST_VTYPE_VDIR	3
+#define	PS_FST_VTYPE_VBLK	4
+#define	PS_FST_VTYPE_VCHR	5
+#define	PS_FST_VTYPE_VLNK	6
+#define	PS_FST_VTYPE_VSOCK	7
+#define	PS_FST_VTYPE_VFIFO	8
+#define	PS_FST_VTYPE_VBAD	9
+#define	PS_FST_VTYPE_UNKNOWN	255
+
+/*
+ * Descriptor types.
+ */
+#define	PS_FST_TYPE_VNODE	1
+#define	PS_FST_TYPE_FIFO	2
+#define	PS_FST_TYPE_SOCKET	3
+#define	PS_FST_TYPE_PIPE	4
+#define	PS_FST_TYPE_PTS		5
+#define	PS_FST_TYPE_KQUEUE	6
+#define	PS_FST_TYPE_CRYPTO	7
+#define	PS_FST_TYPE_MQUEUE	8
+#define	PS_FST_TYPE_SHM		9
+#define	PS_FST_TYPE_SEM		10
+#define	PS_FST_TYPE_UNKNOWN	11
+#define	PS_FST_TYPE_NONE	12
+
+/*
+ * Special descriptor numbers.
+ */
+#define	PS_FST_UFLAG_RDIR	0x0001
+#define	PS_FST_UFLAG_CDIR	0x0002
+#define	PS_FST_UFLAG_JAIL	0x0004
+#define	PS_FST_UFLAG_TRACE	0x0008
+#define	PS_FST_UFLAG_TEXT	0x0010
+#define	PS_FST_UFLAG_MMAP	0x0020
+#define	PS_FST_UFLAG_CTTY	0x0040
+
+/*
+ * Descriptor flags.
+ */
+#define PS_FST_FFLAG_READ	0x0001
+#define PS_FST_FFLAG_WRITE	0x0002
+#define	PS_FST_FFLAG_NONBLOCK	0x0004
+#define	PS_FST_FFLAG_APPEND	0x0008
+#define	PS_FST_FFLAG_SHLOCK	0x0010
+#define	PS_FST_FFLAG_EXLOCK	0x0020
+#define	PS_FST_FFLAG_ASYNC	0x0040
+#define	PS_FST_FFLAG_SYNC	0x0080
+#define	PS_FST_FFLAG_NOFOLLOW	0x0100
+#define	PS_FST_FFLAG_CREAT	0x0200
+#define	PS_FST_FFLAG_TRUNC	0x0400
+#define	PS_FST_FFLAG_EXCL	0x0800
+#define	PS_FST_FFLAG_DIRECT	0x1000
+#define	PS_FST_FFLAG_EXEC	0x2000
+#define	PS_FST_FFLAG_HASLOCK	0x4000
+
+struct procstat;
+struct filestat {
+	int	fs_type;	/* Descriptor type. */
+	int	fs_flags;	/* filestat specific flags. */
+	int	fs_fflags;	/* Descriptor access flags. */
+	int	fs_uflags;	/* How this file is used. */
+	int	fs_fd;		/* File descriptor number. */
+	int	fs_ref_count;	/* Reference count. */
+	off_t	fs_offset;	/* Seek location. */
+	void	*fs_typedep;	/* Type dependent data. */
+	char	*fs_path;
+	STAILQ_ENTRY(filestat)	next;
+};
+struct vnstat {
+	uint64_t	vn_fileid;
+	uint64_t	vn_size;
+	char		*vn_mntdir;
+	uint32_t	vn_dev;
+	uint32_t	vn_fsid;
+	int		vn_type;
+	uint16_t	vn_mode;
+	char		vn_devname[SPECNAMELEN + 1];
+};
+struct ptsstat {
+	uint32_t	dev;
+	char		devname[SPECNAMELEN + 1];
+};
+struct pipestat {
+	size_t		buffer_cnt;
+	uint64_t	addr;
+	uint64_t	peer;
+};
+struct sockstat {
+	uint64_t	inp_ppcb;
+	uint64_t	so_addr;
+	uint64_t	so_pcb;
+	uint64_t	unp_conn;
+	int		dom_family;
+	int		proto;
+	int		so_rcv_sb_state;
+	int		so_snd_sb_state;
+	struct sockaddr_storage	sa_local;	/* Socket address. */
+	struct sockaddr_storage	sa_peer;	/* Peer address. */
+	int		type;
+	char		dname[32];
+};
+
+STAILQ_HEAD(filestat_list, filestat);
+
+void	procstat_close(struct procstat *procstat);
+void	procstat_freeprocs(struct procstat *procstat, struct kinfo_proc *p);
+void	procstat_freefiles(struct procstat *procstat,
+    struct filestat_list *head);
+struct filestat_list	*procstat_getfiles(struct procstat *procstat,
+    struct kinfo_proc *kp, int mmapped);
+struct kinfo_proc	*procstat_getprocs(struct procstat *procstat,
+    int what, int arg, unsigned int *count);
+int	procstat_get_pipe_info(struct procstat *procstat, struct filestat *fst,
+    struct pipestat *pipe, char *errbuf);
+int	procstat_get_pts_info(struct procstat *procstat, struct filestat *fst,
+    struct ptsstat *pts, char *errbuf);
+int	procstat_get_socket_info(struct procstat *procstat, struct filestat *fst,
+    struct sockstat *sock, char *errbuf);
+int	procstat_get_vnode_info(struct procstat *procstat, struct filestat *fst,
+    struct vnstat *vn, char *errbuf);
+struct procstat	*procstat_open_sysctl(void);
+struct procstat	*procstat_open_kvm(const char *nlistf, const char *memf);
+
+#endif	/* !_LIBPROCSTAT_H_ */
diff --git a/lib/libprocstat/libprocstat_internal.h b/lib/libprocstat/libprocstat_internal.h
new file mode 100644
index 0000000..1c1d842
--- /dev/null
+++ b/lib/libprocstat/libprocstat_internal.h
@@ -0,0 +1,39 @@
+/*-
+ * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _LIBPROCSTAT_INTERNAL_H_
+#define	_LIBPROCSTAT_INTERNAL_H_
+
+struct procstat {
+	int	type;
+	kvm_t	*kd;
+	void	*vmentries;
+	void	*files;
+};
+
+#endif	/* !_LIBPROCSTAT_INTERNAL_H_ */
diff --git a/lib/libprocstat/msdosfs.c b/lib/libprocstat/msdosfs.c
new file mode 100644
index 0000000..84b437e
--- /dev/null
+++ b/lib/libprocstat/msdosfs.c
@@ -0,0 +1,153 @@
+/* 
+ * Copyright (c) 2000 Peter Edwards
+ * Copyright (c) 1988, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * This code is derived from software contributed to Berkeley by Peter Edwards
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/stat.h>
+#include <sys/vnode.h>
+
+#include <netinet/in.h>
+
+#define	_KERNEL
+#include <sys/mount.h>
+#include <fs/msdosfs/bpb.h>
+#include <fs/msdosfs/msdosfsmount.h>
+#undef _KERNEL
+
+#include <fs/msdosfs/denode.h>
+#include <fs/msdosfs/direntry.h>
+#include <fs/msdosfs/fat.h>
+
+#include <err.h>
+#include <kvm.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+/*
+ * XXX -
+ * VTODE is defined in denode.h only if _KERNEL is defined, but that leads to
+ * header explosion
+ */
+#define VTODE(vp) ((struct denode *)getvnodedata(vp))
+
+#include "libprocstat.h"
+#include "common_kvm.h"
+
+struct dosmount {
+	struct dosmount *next;
+	struct msdosfsmount *kptr;	/* Pointer in kernel space */
+	struct msdosfsmount data;	/* User space copy of structure */
+};
+
+int
+msdosfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct denode denode;
+	static struct dosmount *mounts;
+	struct dosmount *mnt;
+	u_long dirsperblk;
+	int fileid;
+
+	if (!kvm_read_all(kd, (unsigned long)VTODE(vp), &denode,
+	    sizeof(denode))) {
+		warnx("can't read denode at %p", (void *)VTODE(vp));
+		return (1);
+	}
+
+	/*
+	 * Find msdosfsmount structure for the vnode's filesystem. Needed
+	 * for some filesystem parameters
+	 */
+	for (mnt = mounts; mnt; mnt = mnt->next)
+		if (mnt->kptr == denode.de_pmp)
+			break;
+
+	if (!mnt) {
+		if ((mnt = malloc(sizeof(struct dosmount))) == NULL) {
+			warn("malloc()");
+			return (1);
+		}
+		if (!kvm_read_all(kd, (unsigned long)denode.de_pmp,
+		    &mnt->data, sizeof(mnt->data))) {
+			free(mnt);
+			    warnx("can't read mount info at %p",
+			    (void *)denode.de_pmp);
+			return (1);
+		}
+		mnt->next = mounts;
+		mounts = mnt;
+		mnt->kptr = denode.de_pmp;
+	}
+
+	vn->vn_fsid = dev2udev(kd, mnt->data.pm_dev);
+	vn->vn_mode = 0555;
+	vn->vn_mode |= denode.de_Attributes & ATTR_READONLY ? 0 : 0222;
+	vn->vn_mode &= mnt->data.pm_mask;
+
+	/* Distinguish directories and files. No "special" files in FAT. */
+	vn->vn_mode |= denode.de_Attributes & ATTR_DIRECTORY ? S_IFDIR : S_IFREG;
+	vn->vn_size = denode.de_FileSize;
+
+	/*
+	 * XXX -
+	 * Culled from msdosfs_vnops.c. There appears to be a problem
+	 * here, in that a directory has the same inode number as the first
+	 * file in the directory. stat(2) suffers from this problem also, so
+	 * I won't try to fix it here.
+	 * 
+	 * The following computation of the fileid must be the same as that
+	 * used in msdosfs_readdir() to compute d_fileno. If not, pwd
+	 * doesn't work.
+	 */
+	dirsperblk = mnt->data.pm_BytesPerSec / sizeof(struct direntry);
+	if (denode.de_Attributes & ATTR_DIRECTORY) {
+		fileid = cntobn(&mnt->data, denode.de_StartCluster)
+		    * dirsperblk;
+		if (denode.de_StartCluster == MSDOSFSROOT)
+			fileid = 1;
+	} else {
+		fileid = cntobn(&mnt->data, denode.de_dirclust) * dirsperblk;
+		if (denode.de_dirclust == MSDOSFSROOT)
+			fileid = roottobn(&mnt->data, 0) * dirsperblk;
+		fileid += denode.de_diroffset / sizeof(struct direntry);
+	}
+
+	vn->vn_fileid = fileid;
+	return (0);
+}
diff --git a/lib/libprocstat/ntfs.c b/lib/libprocstat/ntfs.c
new file mode 100644
index 0000000..888e6cd
--- /dev/null
+++ b/lib/libprocstat/ntfs.c
@@ -0,0 +1,71 @@
+/*-
+ * Copyright (c) 2005-2009 Stanislav Sedov <stas@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+
+#include <netinet/in.h>
+
+#include <assert.h>
+#include <err.h>
+#include <kvm.h>
+#include <stdlib.h>
+
+#include <fs/ntfs/ntfs.h>
+#include <fs/ntfs/ntfs_inode.h>
+
+#include "libprocstat.h"
+#include "common_kvm.h"
+
+int
+ntfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct fnode fnod;
+	struct ntnode node;
+	int error;
+
+	assert(kd);
+	assert(vn);
+	error = kvm_read_all(kd, (unsigned long)VTOF(vp), &fnod, sizeof(fnod));
+	if (error != 0) {
+		warnx("can't read ntfs fnode at %p", (void *)VTOF(vp));
+		return (1);
+	}
+	error = kvm_read_all(kd, (unsigned long)FTONT(&fnod), &node,
+	    sizeof(node));
+	if (error != 0) {
+		warnx("can't read ntfs node at %p", (void *)FTONT(&fnod));
+		return (1);
+	}
+	vn->vn_fileid = node.i_number;
+	vn->vn_fsid = dev2udev(kd, node.i_dev);
+	return (0);
+}
diff --git a/lib/libprocstat/nwfs.c b/lib/libprocstat/nwfs.c
new file mode 100644
index 0000000..006f9aa
--- /dev/null
+++ b/lib/libprocstat/nwfs.c
@@ -0,0 +1,76 @@
+/*-
+ * Copyright (c) 2005-2009 Stanislav Sedov <stas@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/vnode.h>
+#define _KERNEL
+#include <sys/mount.h>
+#undef _KERNEL
+
+#include <netinet/in.h>
+
+#include <assert.h>
+#include <err.h>
+#include <kvm.h>
+#include <stdlib.h>
+
+#include <fs/nwfs/nwfs.h>
+#include <fs/nwfs/nwfs_node.h>
+
+#include "libprocstat.h"
+#include "common_kvm.h"
+
+int
+nwfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct mount mnt;
+	struct nwnode node;
+	int error;
+
+	assert(kd);
+	assert(vn);
+	error = kvm_read_all(kd, (unsigned long)VTONW(vp), &node, sizeof(node));
+	if (error != 0) {
+		warnx("can't read nwfs fnode at %p", (void *)VTONW(vp));
+		return (1);
+	}
+        error = kvm_read_all(kd, (unsigned long)getvnodemount(vp), &mnt,
+	    sizeof(mnt));
+        if (error != 0) {
+                warnx("can't read mount at %p for vnode %p",
+                    (void *)getvnodemount(vp), vp);
+                return (1);
+        }
+	vn->vn_fileid = node.n_fid.f_id;
+	if (vn->vn_fileid == 0)
+		vn->vn_fileid = NWFS_ROOT_INO;
+	vn->vn_fsid = mnt.mnt_stat.f_fsid.val[0];
+	return (0);
+}
diff --git a/lib/libprocstat/smbfs.c b/lib/libprocstat/smbfs.c
new file mode 100644
index 0000000..24d8acd
--- /dev/null
+++ b/lib/libprocstat/smbfs.c
@@ -0,0 +1,77 @@
+/*-
+ * Copyright (c) 2005-2009 Stanislav Sedov <stas@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/vnode.h>
+#define _KERNEL
+#include <sys/mount.h>
+#undef _KERNEL
+
+#include <netinet/in.h>
+
+#include <assert.h>
+#include <err.h>
+#include <kvm.h>
+#include <stdlib.h>
+
+#include <fs/smbfs/smbfs.h>
+#include <fs/smbfs/smbfs_node.h>
+
+#include "libprocstat.h"
+#include "common_kvm.h"
+
+int
+smbfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct smbnode node;
+	struct mount mnt;
+	int error;
+
+	assert(kd);
+	assert(vn);
+	error = kvm_read_all(kd, (unsigned long)VTOSMB(vp), &node,
+	    sizeof(node));
+	if (error != 0) {
+		warnx("can't read smbfs fnode at %p", (void *)VTOSMB(vp));
+		return (1);
+	}
+        error = kvm_read_all(kd, (unsigned long)getvnodemount(vp), &mnt,
+	    sizeof(mnt));
+        if (error != 0) {
+                warnx("can't read mount at %p for vnode %p",
+                    (void *)getvnodemount(vp), vp);
+                return (1);
+        }
+	vn->vn_fileid = node.n_ino;
+	if (vn->vn_fileid == 0)
+		vn->vn_fileid = 2;
+	vn->vn_fsid = mnt.mnt_stat.f_fsid.val[0];
+	return (0);
+}
diff --git a/lib/libprocstat/udf.c b/lib/libprocstat/udf.c
new file mode 100644
index 0000000..5d9310e
--- /dev/null
+++ b/lib/libprocstat/udf.c
@@ -0,0 +1,102 @@
+/*-
+ * Copyright (c) 2005-2009 Stanislav Sedov <stas@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/vnode.h>
+#include <sys/buf.h>
+#define _KERNEL
+#include <sys/mount.h>
+#undef _KERNEL
+
+#include <netinet/in.h>
+
+#include <assert.h>
+#include <err.h>
+#include <kvm.h>
+#include <stdlib.h>
+
+#include <fs/udf/ecma167-udf.h>
+
+#include "libprocstat.h"
+#include "common_kvm.h"
+
+/* XXX */
+struct udf_mnt {
+	int			im_flags;
+	struct mount		*im_mountp;
+	struct g_consumer	*im_cp;
+	struct bufobj		*im_bo;
+	struct cdev		*im_dev;
+	struct vnode		*im_devvp;
+	int			bsize;
+	int			bshift;
+	int			bmask;
+	uint32_t		part_start;
+	uint32_t		part_len;
+	uint64_t		root_id;
+	struct long_ad		root_icb;
+	int			p_sectors;
+	int			s_table_entries;
+	void			*s_table;
+	void			*im_d2l;
+};
+struct udf_node {
+	struct vnode	*i_vnode;
+	struct udf_mnt	*udfmp;
+	ino_t		hash_id;
+	long		diroff;
+	struct file_entry *fentry;
+};
+#define VTON(vp)	((struct udf_node *)((vp)->v_data))
+
+int
+udf_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+	struct udf_node node;
+	struct udf_mnt mnt;
+	int error;
+
+	assert(kd);
+	assert(vn);
+	error = kvm_read_all(kd, (unsigned long)VTON(vp), &node, sizeof(node));
+	if (error != 0) {
+		warnx("can't read udf fnode at %p", (void *)VTON(vp));
+		return (1);
+	}
+        error = kvm_read_all(kd, (unsigned long)node.udfmp, &mnt, sizeof(mnt));
+        if (error != 0) {
+                warnx("can't read udf_mnt at %p for vnode %p",
+                    (void *)node.udfmp, vp);
+                return (1);
+        }
+	vn->vn_fileid = node.hash_id;
+	vn->vn_fsid = dev2udev(kd, mnt.im_dev);
+	return (0);
+}
diff --git a/lib/libprocstat/zfs.c b/lib/libprocstat/zfs.c
new file mode 100644
index 0000000..aa6d78e
--- /dev/null
+++ b/lib/libprocstat/zfs.c
@@ -0,0 +1,134 @@
+/*-
+ * Copyright (c) 2007 Ulf Lilleengen
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/param.h>
+#define _KERNEL
+#include <sys/mount.h>
+#include <sys/taskqueue.h>
+#undef _KERNEL
+#include <sys/sysctl.h>
+
+#undef lbolt
+#undef lbolt64
+#undef gethrestime_sec
+#include <sys/zfs_context.h>
+#include <sys/spa.h>
+#include <sys/spa_impl.h>
+#include <sys/dmu.h>
+#include <sys/zap.h>
+#include <sys/fs/zfs.h>
+#include <sys/zfs_znode.h>
+#include <sys/zfs_sa.h>
+
+#include <netinet/in.h>
+
+#include <err.h>
+#include <kvm.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#define ZFS
+#include "libprocstat.h"
+#include "common_kvm.h"
+
+/* 
+ * Offset calculations that are used to get data from znode without having the
+ * definition.
+ */
+#define LOCATION_ZID (2 * sizeof(void *))
+#define LOCATION_ZPHYS(zsize) ((zsize) - (2 * sizeof(void *) + sizeof(struct task)))
+
+int
+zfs_filestat(kvm_t *kd, struct vnode *vp, struct vnstat *vn)
+{
+
+	znode_phys_t zphys;
+	struct mount mount, *mountptr;
+	uint64_t *zid;
+	void *znodeptr, *vnodeptr;
+	char *dataptr;
+	void *zphys_addr;
+	size_t len;
+	int size;
+
+	len = sizeof(size);
+	if (sysctlbyname("debug.sizeof.znode", &size, &len, NULL, 0) == -1) {
+		warnx("error getting sysctl");
+		return (1);
+	}
+	znodeptr = malloc(size);
+	if (znodeptr == NULL) {
+		warnx("error allocating memory for znode storage");
+		return (1);
+	}
+	/* Since we have problems including vnode.h, we'll use the wrappers. */
+	vnodeptr = getvnodedata(vp);
+	if (!kvm_read_all(kd, (unsigned long)vnodeptr, znodeptr,
+	    (size_t)size)) {
+		warnx("can't read znode at %p", (void *)vnodeptr);
+		goto bad;
+	}
+
+	/* 
+	 * z_id field is stored in the third pointer. We therefore skip the two
+	 * first bytes. 
+	 *
+	 * Pointer to the z_phys structure is the next last pointer. Therefore
+	 * go back two bytes from the end.
+	 */
+	dataptr = znodeptr;
+	zid = (uint64_t *)(dataptr + LOCATION_ZID);
+	zphys_addr = *(void **)(dataptr + LOCATION_ZPHYS(size));
+
+	if (!kvm_read_all(kd, (unsigned long)zphys_addr, &zphys,
+	    sizeof(zphys))) {
+		warnx("can't read znode_phys at %p", zphys_addr);
+		goto bad;
+	}
+
+	/* Get the mount pointer, and read from the address. */
+	mountptr = getvnodemount(vp);
+	if (!kvm_read_all(kd, (unsigned long)mountptr, &mount, sizeof(mount))) {
+		warnx("can't read mount at %p", (void *)mountptr);
+		goto bad;
+	}
+	vn->vn_fsid = mount.mnt_stat.f_fsid.val[0];
+	vn->vn_fileid = *zid;
+	/*
+	 * XXX: Shows up wrong in output, but UFS has this error too. Could
+	 * be that we're casting mode-variables from 64-bit to 8-bit or simply
+	 * error in the mode-to-string function.
+	 */
+	vn->vn_mode = (mode_t)zphys.zp_mode;
+	vn->vn_size = (u_long)zphys.zp_size;
+	free(znodeptr);
+	return (0);
+bad:
+	free(znodeptr);
+	return (1);
+}
diff --git a/lib/libprocstat/zfs/Makefile b/lib/libprocstat/zfs/Makefile
new file mode 100644
index 0000000..7ecfc85
--- /dev/null
+++ b/lib/libprocstat/zfs/Makefile
@@ -0,0 +1,23 @@
+# $FreeBSD$
+
+.PATH: ${.CURDIR}/..
+
+SRCS=	zfs.c
+OBJS=	zfs.o
+WARNS?=	1
+
+CFLAGS+= -I${.CURDIR}/../../../sys/cddl/compat/opensolaris
+CFLAGS+= -I${.CURDIR}/../../../cddl/compat/opensolaris/include
+CFLAGS+= -I${.CURDIR}/../../../cddl/compat/opensolaris/lib/libumem
+CFLAGS+= -I${.CURDIR}/../../../cddl/contrib/opensolaris/lib/libzpool/common
+CFLAGS+= -I${.CURDIR}/../../../sys/cddl/contrib/opensolaris/uts/common/fs/zfs
+CFLAGS+= -I${.CURDIR}/../../../sys/cddl/contrib/opensolaris/uts/common
+CFLAGS+= -I${.CURDIR}/../../../sys/cddl/contrib/opensolaris/uts/common/sys
+CFLAGS+= -I${.CURDIR}/../../../cddl/contrib/opensolaris/head
+CFLAGS+= -I${.CURDIR}/..
+CFLAGS+= -DNEED_SOLARIS_BOOLEAN
+
+all: ${OBJS}
+CLEANFILES= ${OBJS}
+
+.include <bsd.lib.mk>