- Commit work from libprocstat project. These patches add support for runtime

  file and processes information retrieval from the running kernel via sysctl
  in the form of new library, libprocstat.  The library also supports KVM backend
  for analyzing memory crash dumps.  Both procstat(1) and fstat(1) utilities have
  been modified to take advantage of the library (as the bonus point the fstat(1)
  utility no longer need superuser privileges to operate), and the procstat(1)
  utility is now able to display information from memory dumps as well.

  The newly introduced fuser(1) utility also uses this library and able to operate
  via sysctl and kvm backends.

  The library is by no means complete (e.g. KVM backend is missing vnode name
  resolution routines, and there're no manpages for the library itself) so I
  plan to improve it further.  I'm commiting it so it will get wider exposure
  and review.

  We won't be able to MFC this work as it relies on changes in HEAD, which
  was introduced some time ago, that break kernel ABI.  OTOH we may be able
  to merge the library with KVM backend if we really need it there.

Discussed with:	rwatson

1 files changed, 240 insertions, 746 deletions

diff --git a/usr.bin/fstat/fstat.c b/usr.bin/fstat/fstat.c
index 7725c88..9d057e5 100644
--- a/usr.bin/fstat/fstat.c
+++ b/usr.bin/fstat/fstat.c
@@ -1,4 +1,5 @@
 /*-
+ * Copyright (c) 2009 Stanislav Sedov <stas@FreeBSD.org>
  * Copyright (c) 1988, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
@@ -27,69 +28,24 @@
  * SUCH DAMAGE.
  */
 
-#ifndef lint
-static const char copyright[] =
-"@(#) Copyright (c) 1988, 1993\n\
-	The Regents of the University of California.  All rights reserved.\n";
-#endif /* not lint */
-
-#ifndef lint
-#if 0
-static char sccsid[] = "@(#)fstat.c	8.3 (Berkeley) 5/2/95";
-#endif
-#endif /* not lint */
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
-#include <sys/time.h>
-#include <sys/proc.h>
 #include <sys/user.h>
 #include <sys/stat.h>
-#include <sys/vnode.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/un.h>
-#include <sys/unpcb.h>
 #include <sys/sysctl.h>
-#include <sys/tty.h>
-#include <sys/filedesc.h>
 #include <sys/queue.h>
-#define	_WANT_FILE
-#include <sys/file.h>
-#include <sys/conf.h>
-#define	_KERNEL
-#include <sys/pipe.h>
-#include <sys/mount.h>
-#include <ufs/ufs/quota.h>
-#include <ufs/ufs/inode.h>
-#include <fs/devfs/devfs.h>
-#include <fs/devfs/devfs_int.h>
-#undef _KERNEL
-#include <nfs/nfsproto.h>
-#include <nfsclient/nfs.h>
-#include <nfsclient/nfsnode.h>
-
-
-#include <vm/vm.h>
-#include <vm/vm_map.h>
-#include <vm/vm_object.h>
-
-#include <net/route.h>
+
 #include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
 
+#include <assert.h>
 #include <ctype.h>
 #include <err.h>
-#include <fcntl.h>
-#include <kvm.h>
+#include <libprocstat.h>
 #include <limits.h>
-#include <nlist.h>
-#include <paths.h>
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -98,69 +54,49 @@ __FBSDID("$FreeBSD$");
 #include <unistd.h>
 #include <netdb.h>
 
-#include "fstat.h"
-
-#define	TEXT	-1
-#define	CDIR	-2
-#define	RDIR	-3
-#define	TRACE	-4
-#define	MMAP	-5
-#define	JDIR	-6
-
-DEVS *devs;
-
-#ifdef notdef
-struct nlist nl[] = {
-	{ "" },
-};
-#endif
+#include "functions.h"
 
 int 	fsflg,	/* show files on same filesystem as file(s) argument */
 	pflg,	/* show files open by a particular pid */
 	uflg;	/* show files open by a particular (effective) user */
 int 	checkfile; /* true if restricting to particular files or filesystems */
 int	nflg;	/* (numerical) display f.s. and rdev as dev_t */
-int	vflg;	/* display errors in locating kernel data objects etc... */
 int	mflg;	/* include memory-mapped files */
+int	vflg;	/* be verbose */
 
+typedef struct devs {
+	struct devs	*next;
+	uint32_t	fsid;
+	uint64_t	ino;
+	const char	*name;
+} DEVS;
 
-struct file **ofiles;	/* buffer of pointers to file structures */
-int maxfiles;
-#define ALLOC_OFILES(d)	\
-	if ((d) > maxfiles) { \
-		free(ofiles); \
-		ofiles = malloc((d) * sizeof(struct file *)); \
-		if (ofiles == NULL) { \
-			err(1, NULL); \
-		} \
-		maxfiles = (d); \
-	}
-
+DEVS *devs;
 char *memf, *nlistf;
-kvm_t *kd;
-
-static void fstat_kvm(int, int);
-static void fstat_sysctl(int, int);
-void dofiles(struct kinfo_proc *kp);
-void dommap(struct kinfo_proc *kp);
-void vtrans(struct vnode *vp, int i, int flag);
-int  ufs_filestat(struct vnode *vp, struct filestat *fsp);
-int  nfs_filestat(struct vnode *vp, struct filestat *fsp);
-int  devfs_filestat(struct vnode *vp, struct filestat *fsp);
-char *getmnton(struct mount *m);
-void pipetrans(struct pipe *pi, int i, int flag);
-void socktrans(struct socket *sock, int i);
-void ptstrans(struct tty *tp, int i, int flag);
-void getinetproto(int number);
-int  getfname(const char *filename);
-void usage(void);
-char *kdevtoname(struct cdev *dev);
+
+static int	getfname(const char *filename);
+static void	dofiles(struct procstat *procstat, struct kinfo_proc *p);
+static void	print_access_flags(int flags);
+static void	print_file_info(struct procstat *procstat,
+    struct filestat *fst, const char *uname, const char *cmd, int pid);
+static void	print_pipe_info(struct procstat *procstat,
+    struct filestat *fst);
+static void	print_pts_info(struct procstat *procstat,
+    struct filestat *fst);
+static void	print_socket_info(struct procstat *procstat,
+    struct filestat *fst);
+static void	print_vnode_info(struct procstat *procstat,
+    struct filestat *fst);
+static void	usage(void) __dead2;
 
 int
-main(int argc, char **argv)
+do_fstat(int argc, char **argv)
 {
+	struct kinfo_proc *p;
 	struct passwd *passwd;
+	struct procstat *procstat;
 	int arg, ch, what;
+	int cnt, i;
 
 	arg = 0;
 	what = KERN_PROC_PROC;
@@ -225,16 +161,18 @@ main(int argc, char **argv)
 	}
 
 	if (memf != NULL)
-		fstat_kvm(what, arg);
+		procstat = procstat_open_kvm(nlistf, memf);
 	else
-		fstat_sysctl(what, arg);
-	exit(0);
-}
-
-static void
-print_header(void)
-{
+		procstat = procstat_open_sysctl();
+	if (procstat == NULL)
+		errx(1, "procstat_open()");
+	p = procstat_getprocs(procstat, what, arg, &cnt);
+	if (p == NULL)
+		errx(1, "procstat_getprocs()");
 
+	/*
+	 * Print header.
+	 */
 	if (nflg)
 		printf("%s",
 "USER     CMD          PID   FD  DEV    INUM       MODE SZ|DV R/W");
@@ -245,312 +183,65 @@ print_header(void)
 		printf(" NAME\n");
 	else
 		putchar('\n');
-}
-
-static void
-fstat_kvm(int what, int arg)
-{
-	struct kinfo_proc *p, *plast;
-	char buf[_POSIX2_LINE_MAX];
-	int cnt;
-
-	ALLOC_OFILES(256);	/* reserve space for file pointers */
 
 	/*
-	 * Discard setgid privileges if not the running kernel so that bad
-	 * guys can't print interesting stuff from kernel memory.
+	 * Go through the process list.
 	 */
-	if (nlistf != NULL || memf != NULL)
-		setgid(getgid());
-
-	if ((kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf)) == NULL)
-		errx(1, "%s", buf);
-	setgid(getgid());
-#ifdef notdef
-	if (kvm_nlist(kd, nl) != 0)
-		errx(1, "no namelist: %s", kvm_geterr(kd));
-#endif
-	if ((p = kvm_getprocs(kd, what, arg, &cnt)) == NULL)
-		errx(1, "%s", kvm_geterr(kd));
-	print_header();
-	for (plast = &p[cnt]; p < plast; ++p) {
-		if (p->ki_stat == SZOMB)
+	for (i = 0; i < cnt; i++) {
+		if (p[i].ki_stat == SZOMB)
 			continue;
-		dofiles(p);
-		if (mflg)
-			dommap(p);
+		dofiles(procstat, &p[i]);
 	}
+	procstat_freeprocs(procstat, p);
+	procstat_close(procstat);
+	return (0);
 }
 
 static void
-fstat_sysctl(int what, int arg)
-{
-
-	/* not yet implemented */
-	fstat_kvm(what, arg);
-}
-
-const char	*Uname, *Comm;
-int	Pid;
-
-#define PREFIX(i) printf("%-8.8s %-10s %5d", Uname, Comm, Pid); \
-	switch(i) { \
-	case TEXT: \
-		printf(" text"); \
-		break; \
-	case CDIR: \
-		printf("   wd"); \
-		break; \
-	case RDIR: \
-		printf(" root"); \
-		break; \
-	case TRACE: \
-		printf("   tr"); \
-		break; \
-	case MMAP: \
-		printf(" mmap"); \
-		break; \
-	case JDIR: \
-		printf(" jail"); \
-		break; \
-	default: \
-		printf(" %4d", i); \
-		break; \
-	}
-
-/*
- * print open files attributed to this process
- */
-void
-dofiles(struct kinfo_proc *kp)
+dofiles(struct procstat *procstat, struct kinfo_proc *kp)
 {
-	int i;
-	struct file file;
-	struct filedesc filed;
-
-	Uname = user_from_uid(kp->ki_uid, 0);
-	Pid = kp->ki_pid;
-	Comm = kp->ki_comm;
-
-	if (kp->ki_fd == NULL)
+	const char *cmd;
+	const char *uname;
+	struct filestat *fst;
+	struct filestat_list *head;
+	int pid;
+
+	uname = user_from_uid(kp->ki_uid, 0);
+	pid = kp->ki_pid;
+	cmd = kp->ki_comm;
+
+	head = procstat_getfiles(procstat, kp, mflg);
+	if (head == NULL)
 		return;
-	if (!KVM_READ(kp->ki_fd, &filed, sizeof (filed))) {
-		dprintf(stderr, "can't read filedesc at %p for pid %d\n",
-		    (void *)kp->ki_fd, Pid);
-		return;
-	}
-	/*
-	 * root directory vnode, if one
-	 */
-	if (filed.fd_rdir)
-		vtrans(filed.fd_rdir, RDIR, FREAD);
-	/*
-	 * current working directory vnode
-	 */
-	if (filed.fd_cdir)
-		vtrans(filed.fd_cdir, CDIR, FREAD);
-	/*
-	 * jail root, if any.
-	 */
-	if (filed.fd_jdir)
-		vtrans(filed.fd_jdir, JDIR, FREAD);
-	/*
-	 * ktrace vnode, if one
-	 */
-	if (kp->ki_tracep)
-		vtrans(kp->ki_tracep, TRACE, FREAD|FWRITE);
-	/*
-	 * text vnode, if one
-	 */
-	if (kp->ki_textvp)
-		vtrans(kp->ki_textvp, TEXT, FREAD);
-	/*
-	 * open files
-	 */
-#define FPSIZE	(sizeof (struct file *))
-#define MAX_LASTFILE	(0x1000000)
-
-	/* Sanity check on filed.fd_lastfile */
-	if (filed.fd_lastfile <= -1 || filed.fd_lastfile > MAX_LASTFILE)
-		return;
-
-	ALLOC_OFILES(filed.fd_lastfile+1);
-	if (!KVM_READ(filed.fd_ofiles, ofiles,
-	    (filed.fd_lastfile+1) * FPSIZE)) {
-		dprintf(stderr,
-		    "can't read file structures at %p for pid %d\n",
-		    (void *)filed.fd_ofiles, Pid);
-		return;
-	}
-	for (i = 0; i <= filed.fd_lastfile; i++) {
-		if (ofiles[i] == NULL)
-			continue;
-		if (!KVM_READ(ofiles[i], &file, sizeof (struct file))) {
-			dprintf(stderr, "can't read file %d at %p for pid %d\n",
-			    i, (void *)ofiles[i], Pid);
-			continue;
-		}
-		if (file.f_type == DTYPE_VNODE)
-			vtrans(file.f_vnode, i, file.f_flag);
-		else if (file.f_type == DTYPE_SOCKET) {
-			if (checkfile == 0)
-				socktrans(file.f_data, i);
-		}
-#ifdef DTYPE_PIPE
-		else if (file.f_type == DTYPE_PIPE) {
-			if (checkfile == 0)
-				pipetrans(file.f_data, i, file.f_flag);
-		}
-#endif
-#ifdef DTYPE_FIFO
-		else if (file.f_type == DTYPE_FIFO) {
-			if (checkfile == 0)
-				vtrans(file.f_vnode, i, file.f_flag);
-		}
-#endif
-#ifdef DTYPE_PTS
-		else if (file.f_type == DTYPE_PTS) {
-			if (checkfile == 0)
-				ptstrans(file.f_data, i, file.f_flag);
-		}
-#endif
-		else {
-			dprintf(stderr,
-			    "unknown file type %d for file %d of pid %d\n",
-			    file.f_type, i, Pid);
-		}
-	}
-}
-
-void
-dommap(struct kinfo_proc *kp)
-{
-	vm_map_t map;
-	struct vmspace vmspace;
-	struct vm_map_entry entry;
-	vm_map_entry_t entryp;
-	struct vm_object object;
-	vm_object_t objp;
-	int prot, fflags;
-
-	if (!KVM_READ(kp->ki_vmspace, &vmspace, sizeof(vmspace))) {
-		dprintf(stderr,
-		    "can't read vmspace at %p for pid %d\n",
-		    (void *)kp->ki_vmspace, Pid);
-		return;
-	}
-	map = &vmspace.vm_map;
-
-	for (entryp = map->header.next;
-	    entryp != &kp->ki_vmspace->vm_map.header; entryp = entry.next) {
-		if (!KVM_READ(entryp, &entry, sizeof(entry))) {
-			dprintf(stderr,
-			    "can't read vm_map_entry at %p for pid %d\n",
-			    (void *)entryp, Pid);
-			return;
-		}
-
-		if (entry.eflags & MAP_ENTRY_IS_SUB_MAP)
-			continue;
-
-		if ((objp = entry.object.vm_object) == NULL)
-			continue;
-
-		for (; objp; objp = object.backing_object) {
-			if (!KVM_READ(objp, &object, sizeof(object))) {
-				dprintf(stderr,
-				    "can't read vm_object at %p for pid %d\n",
-				    (void *)objp, Pid);
-				return;
-			}
-		}
-
-		prot = entry.protection;
-		fflags = (prot & VM_PROT_READ ? FREAD : 0) |
-		    (prot & VM_PROT_WRITE ? FWRITE : 0);
-
-		switch (object.type) {
-		case OBJT_VNODE:
-			vtrans((struct vnode *)object.handle, MMAP, fflags);
-			break;
-		default:
-			break;
-		}
-	}
+	STAILQ_FOREACH(fst, head, next)
+		print_file_info(procstat, fst, uname, cmd, pid);
+	procstat_freefiles(procstat, head);
 }
 
-char *
-kdevtoname(struct cdev *dev)
-{
-	struct cdev si;
 
-	if (!KVM_READ(dev, &si, sizeof si))
-		return (NULL);
-	return (strdup(si.__si_namebuf));
-}
-
-void
-vtrans(struct vnode *vp, int i, int flag)
+static void
+print_file_info(struct procstat *procstat, struct filestat *fst,
+    const char *uname, const char *cmd, int pid)
 {
-	struct vnode vn;
-	struct filestat fst;
-	char rw[3], mode[15], tagstr[12], *tagptr;
-	const char *badtype, *filename;
-
-	filename = badtype = NULL;
-	if (!KVM_READ(vp, &vn, sizeof (struct vnode))) {
-		dprintf(stderr, "can't read vnode at %p for pid %d\n",
-		    (void *)vp, Pid);
-		return;
-	}
-	if (!KVM_READ(&vp->v_tag, &tagptr, sizeof tagptr) ||
-	    !KVM_READ(tagptr, tagstr, sizeof tagstr)) {
-		dprintf(stderr, "can't read v_tag at %p for pid %d\n",
-		    (void *)vp, Pid);
-		return;
-	}
-	tagstr[sizeof(tagstr) - 1] = '\0';
-	if (vn.v_type == VNON)
-		badtype = "none";
-	else if (vn.v_type == VBAD)
-		badtype = "bad";
-	else {
-		if (!strcmp("ufs", tagstr)) {
-			if (!ufs_filestat(&vn, &fst))
-				badtype = "error";
-		} else if (!strcmp("devfs", tagstr)) {
-			if (!devfs_filestat(&vn, &fst))
-				badtype = "error";
-		} else if (!strcmp("nfs", tagstr)) {
-			if (!nfs_filestat(&vn, &fst))
-				badtype = "error";
-		} else if (!strcmp("msdosfs", tagstr)) {
-			if (!msdosfs_filestat(&vn, &fst))
-				badtype = "error";
-		} else if (!strcmp("isofs", tagstr)) {
-			if (!isofs_filestat(&vn, &fst))
-				badtype = "error";
-#ifdef ZFS
-		} else if (!strcmp("zfs", tagstr)) {
-			if (!zfs_filestat(&vn, &fst))
-				badtype = "error";
-#endif
-		} else {
-			static char unknown[32];
-			snprintf(unknown, sizeof unknown, "?(%s)", tagstr);
-			badtype = unknown;
-		}
-	}
-	if (checkfile) {
-		int fsmatch = 0;
-		DEVS *d;
-
-		if (badtype)
+	struct vnstat vn;
+	DEVS *d;
+	const char *filename;
+	int error, fsmatch = 0;
+	char errbuf[_POSIX2_LINE_MAX];
+
+	filename = NULL;
+	if (checkfile != 0) {
+		if (fst->fs_type != PS_FST_TYPE_VNODE &&
+		    fst->fs_type != PS_FST_TYPE_FIFO)
 			return;
+		error = procstat_get_vnode_info(procstat, fst, &vn, errbuf);
+		if (error != 0)
+			return;
+
 		for (d = devs; d != NULL; d = d->next)
-			if (d->fsid == fst.fsid) {
+			if (d->fsid == vn.vn_fsid) {
 				fsmatch = 1;
-				if (d->ino == fst.fileid) {
+				if ((unsigned)d->ino == vn.vn_fileid) {
 					filename = d->name;
 					break;
 				}
@@ -558,271 +249,83 @@ vtrans(struct vnode *vp, int i, int flag)
 		if (fsmatch == 0 || (filename == NULL && fsflg == 0))
 			return;
 	}
-	PREFIX(i);
-	if (badtype) {
-		(void)printf(" -         -  %10s    -\n", badtype);
-		return;
-	}
-	if (nflg)
-		(void)printf(" %2d,%-2d", major(fst.fsid), minor(fst.fsid));
-	else
-		(void)printf(" %-8s", getmnton(vn.v_mount));
-	if (nflg)
-		(void)sprintf(mode, "%o", fst.mode);
-	else
-		strmode(fst.mode, mode);
-	(void)printf(" %6ld %10s", fst.fileid, mode);
-	switch (vn.v_type) {
-	case VBLK:
-	case VCHR: {
-		char *name;
-
-		name = kdevtoname(vn.v_rdev);
-		if (nflg || !name)
-			printf("  %2d,%-2d", major(fst.rdev), minor(fst.rdev));
-		else {
-			printf(" %6s", name);
-			free(name);
-		}
-		break;
-	}
-	default:
-		printf(" %6lu", fst.size);
-	}
-	rw[0] = '\0';
-	if (flag & FREAD)
-		strcat(rw, "r");
-	if (flag & FWRITE)
-		strcat(rw, "w");
-	printf(" %2s", rw);
-	if (filename && !fsflg)
-		printf("  %s", filename);
-	putchar('\n');
-}
-
-int
-ufs_filestat(struct vnode *vp, struct filestat *fsp)
-{
-	struct inode inode;
 
-	if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) {
-		dprintf(stderr, "can't read inode at %p for pid %d\n",
-		    (void *)VTOI(vp), Pid);
-		return 0;
-	}
 	/*
-	 * The st_dev from stat(2) is a dev_t. These kernel structures
-	 * contain cdev pointers. We need to convert to dev_t to make
-	 * comparisons
+	 * Print entry prefix.
 	 */
-	fsp->fsid = dev2udev(inode.i_dev);
-	fsp->fileid = (long)inode.i_number;
-	fsp->mode = (mode_t)inode.i_mode;
-	fsp->size = (u_long)inode.i_size;
-#if should_be_but_is_hard
-	/* XXX - need to load i_ump and i_din[12] from kernel memory */
-	if (inode.i_ump->um_fstype == UFS1)
-		fsp->rdev = inode.i_din1->di_rdev;
+	printf("%-8.8s %-10s %5d", uname, cmd, pid);
+	if (fst->fs_uflags & PS_FST_UFLAG_TEXT)
+		printf(" text");
+	else if (fst->fs_uflags & PS_FST_UFLAG_CDIR)
+		printf("   wd");
+	else if (fst->fs_uflags & PS_FST_UFLAG_RDIR)
+		printf(" root");
+	else if (fst->fs_uflags & PS_FST_UFLAG_TRACE)
+		printf("   tr");
+	else if (fst->fs_uflags & PS_FST_UFLAG_MMAP)
+		printf(" mmap");
+	else if (fst->fs_uflags & PS_FST_UFLAG_JAIL)
+		printf(" jail");
+	else if (fst->fs_uflags & PS_FST_UFLAG_CTTY)
+		printf(" ctty");
 	else
-		fsp->rdev = inode.i_din2->di_rdev;
-#else
-	fsp->rdev = 0;
-#endif
-
-	return 1;
-}
-
-int
-devfs_filestat(struct vnode *vp, struct filestat *fsp)
-{
-	struct devfs_dirent devfs_dirent;
-	struct mount mount;
-	struct vnode vnode;
-
-	if (!KVM_READ(vp->v_data, &devfs_dirent, sizeof (devfs_dirent))) {
-		dprintf(stderr, "can't read devfs_dirent at %p for pid %d\n",
-		    (void *)vp->v_data, Pid);
-		return 0;
-	}
-	if (!KVM_READ(vp->v_mount, &mount, sizeof (mount))) {
-		dprintf(stderr, "can't read mount at %p for pid %d\n",
-		    (void *)vp->v_mount, Pid);
-		return 0;
-	}
-	if (!KVM_READ(devfs_dirent.de_vnode, &vnode, sizeof (vnode))) {
-		dprintf(stderr, "can't read vnode at %p for pid %d\n",
-		    (void *)devfs_dirent.de_vnode, Pid);
-		return 0;
-	}
-	fsp->fsid = (long)(uint32_t)mount.mnt_stat.f_fsid.val[0];
-	fsp->fileid = devfs_dirent.de_inode;
-	fsp->mode = (devfs_dirent.de_mode & ~S_IFMT) | S_IFCHR;
-	fsp->size = 0;
-	fsp->rdev = dev2udev(vnode.v_rdev);
+		printf(" %4d", fst->fs_fd);
 
-	return 1;
-}
-
-int
-nfs_filestat(struct vnode *vp, struct filestat *fsp)
-{
-	struct nfsnode nfsnode;
-	mode_t mode;
-
-	if (!KVM_READ(VTONFS(vp), &nfsnode, sizeof (nfsnode))) {
-		dprintf(stderr, "can't read nfsnode at %p for pid %d\n",
-		    (void *)VTONFS(vp), Pid);
-		return 0;
-	}
-	fsp->fsid = nfsnode.n_vattr.va_fsid;
-	fsp->fileid = nfsnode.n_vattr.va_fileid;
-	fsp->size = nfsnode.n_size;
-	fsp->rdev = nfsnode.n_vattr.va_rdev;
-	mode = (mode_t)nfsnode.n_vattr.va_mode;
-	switch (vp->v_type) {
-	case VREG:
-		mode |= S_IFREG;
-		break;
-	case VDIR:
-		mode |= S_IFDIR;
-		break;
-	case VBLK:
-		mode |= S_IFBLK;
-		break;
-	case VCHR:
-		mode |= S_IFCHR;
+	/*
+	 * Print type-specific data.
+	 */
+	switch (fst->fs_type) {
+	case PS_FST_TYPE_FIFO:
+	case PS_FST_TYPE_VNODE:
+		print_vnode_info(procstat, fst);
 		break;
-	case VLNK:
-		mode |= S_IFLNK;
+	case PS_FST_TYPE_SOCKET:
+		print_socket_info(procstat, fst);
 		break;
-	case VSOCK:
-		mode |= S_IFSOCK;
+	case PS_FST_TYPE_PIPE:
+		print_pipe_info(procstat, fst);
 		break;
-	case VFIFO:
-		mode |= S_IFIFO;
+	case PS_FST_TYPE_PTS:
+		print_pts_info(procstat, fst);
 		break;
-	case VNON:
-	case VBAD:
-	case VMARKER:
-		return 0;
-	};
-	fsp->mode = mode;
-
-	return 1;
-}
-
-
-char *
-getmnton(struct mount *m)
-{
-	static struct mount mount;
-	static struct mtab {
-		struct mtab *next;
-		struct mount *m;
-		char mntonname[MNAMELEN];
-	} *mhead = NULL;
-	struct mtab *mt;
-
-	for (mt = mhead; mt != NULL; mt = mt->next)
-		if (m == mt->m)
-			return (mt->mntonname);
-	if (!KVM_READ(m, &mount, sizeof(struct mount))) {
-		warnx("can't read mount table at %p", (void *)m);
-		return (NULL);
-	}
-	if ((mt = malloc(sizeof (struct mtab))) == NULL)
-		err(1, NULL);
-	mt->m = m;
-	bcopy(&mount.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
-	mt->next = mhead;
-	mhead = mt;
-	return (mt->mntonname);
-}
-
-void
-pipetrans(struct pipe *pi, int i, int flag)
-{
-	struct pipe pip;
-	char rw[3];
-
-	PREFIX(i);
-
-	/* fill in socket */
-	if (!KVM_READ(pi, &pip, sizeof(struct pipe))) {
-		dprintf(stderr, "can't read pipe at %p\n", (void *)pi);
-		goto bad;
+	default:	
+		if (vflg)
+			fprintf(stderr,
+			    "unknown file type %d for file %d of pid %d\n",
+			    fst->fs_type, fst->fs_fd, pid);
 	}
-
-	printf("* pipe %8lx <-> %8lx", (u_long)pi, (u_long)pip.pipe_peer);
-	printf(" %6d", (int)pip.pipe_buffer.cnt);
-	rw[0] = '\0';
-	if (flag & FREAD)
-		strcat(rw, "r");
-	if (flag & FWRITE)
-		strcat(rw, "w");
-	printf(" %2s", rw);
+	if (filename && !fsflg)
+		printf("  %s", filename);
 	putchar('\n');
-	return;
-
-bad:
-	printf("* error\n");
 }
 
-void
-socktrans(struct socket *sock, int i)
+static void
+print_socket_info(struct procstat *procstat, struct filestat *fst)
 {
 	static const char *stypename[] = {
 		"unused",	/* 0 */
-		"stream", 	/* 1 */
+		"stream",	/* 1 */
 		"dgram",	/* 2 */
 		"raw",		/* 3 */
 		"rdm",		/* 4 */
 		"seqpak"	/* 5 */
 	};
-#define	STYPEMAX 5
-	struct socket	so;
-	struct protosw	proto;
-	struct domain	dom;
-	struct inpcb	inpcb;
-	struct unpcb	unpcb;
-	int len;
-	char dname[32];
-
-	PREFIX(i);
-
-	/* fill in socket */
-	if (!KVM_READ(sock, &so, sizeof(struct socket))) {
-		dprintf(stderr, "can't read sock at %p\n", (void *)sock);
-		goto bad;
-	}
-
-	/* fill in protosw entry */
-	if (!KVM_READ(so.so_proto, &proto, sizeof(struct protosw))) {
-		dprintf(stderr, "can't read protosw at %p",
-		    (void *)so.so_proto);
-		goto bad;
-	}
-
-	/* fill in domain */
-	if (!KVM_READ(proto.pr_domain, &dom, sizeof(struct domain))) {
-		dprintf(stderr, "can't read domain at %p\n",
-		    (void *)proto.pr_domain);
-		goto bad;
-	}
+#define STYPEMAX 5
+	struct sockstat sock;
+	struct protoent *pe;
+	char errbuf[_POSIX2_LINE_MAX];
+	int error;
+	static int isopen;
 
-	if ((len = kvm_read(kd, (u_long)dom.dom_name, dname,
-	    sizeof(dname) - 1)) < 0) {
-		dprintf(stderr, "can't read domain name at %p\n",
-		    (void *)dom.dom_name);
-		dname[0] = '\0';
+	error = procstat_get_socket_info(procstat, fst, &sock, errbuf);
+	if (error != 0) {
+		printf("* error");
+		return;
 	}
+	if (sock.type > STYPEMAX)
+		printf("* %s ?%d", sock.dname, sock.type);
 	else
-		dname[len] = '\0';
-
-	if ((u_short)so.so_type > STYPEMAX)
-		printf("* %s ?%d", dname, so.so_type);
-	else
-		printf("* %s %s", dname, stypename[so.so_type]);
+		printf("* %s %s", sock.dname, stypename[sock.type]);
 
 	/*
 	 * protocol specific formatting
@@ -835,139 +338,144 @@ socktrans(struct socket *sock, int i)
 	 * The idea is not to duplicate netstat, but to make available enough
 	 * information for further analysis.
 	 */
-	switch(dom.dom_family) {
+	switch (sock.dom_family) {
 	case AF_INET:
 	case AF_INET6:
-		getinetproto(proto.pr_protocol);
-		if (proto.pr_protocol == IPPROTO_TCP ) {
-			if (so.so_pcb) {
-				if (kvm_read(kd, (u_long)so.so_pcb,
-				    (char *)&inpcb, sizeof(struct inpcb))
-				    != sizeof(struct inpcb)) {
-					dprintf(stderr,
-					    "can't read inpcb at %p\n",
-					    (void *)so.so_pcb);
-					goto bad;
-				}
-				printf(" %lx", (u_long)inpcb.inp_ppcb);
-			}
+		if (!isopen)
+			setprotoent(++isopen);
+		if ((pe = getprotobynumber(sock.proto)) != NULL)
+			printf(" %s", pe->p_name);
+		else
+			printf(" %d", sock.proto);
+		if (sock.proto == IPPROTO_TCP ) {
+			if (sock.inp_ppcb != 0)
+				printf(" %lx", (u_long)sock.inp_ppcb);
 		}
-		else if (so.so_pcb)
-			printf(" %lx", (u_long)so.so_pcb);
+		else if (sock.so_pcb != 0)
+			printf(" %lx", (u_long)sock.so_pcb);
 		break;
 	case AF_UNIX:
 		/* print address of pcb and connected pcb */
-		if (so.so_pcb) {
-			printf(" %lx", (u_long)so.so_pcb);
-			if (kvm_read(kd, (u_long)so.so_pcb, (char *)&unpcb,
-			    sizeof(struct unpcb)) != sizeof(struct unpcb)){
-				dprintf(stderr, "can't read unpcb at %p\n",
-				    (void *)so.so_pcb);
-				goto bad;
-			}
-			if (unpcb.unp_conn) {
+		if (sock.so_pcb != 0) {
+			printf(" %lx", (u_long)sock.so_pcb);
+			if (sock.unp_conn) {
 				char shoconn[4], *cp;
 
 				cp = shoconn;
-				if (!(so.so_rcv.sb_state & SBS_CANTRCVMORE))
+				if (!(sock.so_rcv_sb_state & SBS_CANTRCVMORE))
 					*cp++ = '<';
 				*cp++ = '-';
-				if (!(so.so_snd.sb_state & SBS_CANTSENDMORE))
+				if (!(sock.so_snd_sb_state & SBS_CANTSENDMORE))
 					*cp++ = '>';
 				*cp = '\0';
 				printf(" %s %lx", shoconn,
-				    (u_long)unpcb.unp_conn);
-			}
+				    (u_long)sock.unp_conn);
+                        }
 		}
 		break;
 	default:
 		/* print protocol number and socket address */
-		printf(" %d %lx", proto.pr_protocol, (u_long)sock);
+		printf(" %d %lx", sock.proto, (u_long)sock.so_addr);
 	}
-	printf("\n");
-	return;
-bad:
-	printf("* error\n");
 }
 
-void
-ptstrans(struct tty *tp, int i, int flag)
+static void
+print_pipe_info(struct procstat *procstat, struct filestat *fst)
 {
-	struct tty tty;
-	char *name;
-	char rw[3];
-	dev_t rdev;
+	struct pipestat ps;
+	char errbuf[_POSIX2_LINE_MAX];
+	int error;
 
-	PREFIX(i);
-
-	/* Obtain struct tty. */
-	if (!KVM_READ(tp, &tty, sizeof(struct tty))) {
-		dprintf(stderr, "can't read tty at %p\n", (void *)tp);
-		goto bad;
-	}
-
-	/* Figure out the device name. */
-	name = kdevtoname(tty.t_dev);
-	if (name == NULL) {
-		dprintf(stderr, "can't determine tty name at %p\n", (void *)tp);
-		goto bad;
+	error = procstat_get_pipe_info(procstat, fst, &ps, errbuf);
+	if (error != 0) {
+		printf("* error");
+		return;
 	}
+	printf("* pipe %8lx <-> %8lx", (u_long)ps.addr, (u_long)ps.peer);
+	printf(" %6zd", ps.buffer_cnt);
+	print_access_flags(fst->fs_fflags);
+}
 
-	rw[0] = '\0';
-	if (flag & FREAD)
-		strcat(rw, "r");
-	if (flag & FWRITE)
-		strcat(rw, "w");
+static void
+print_pts_info(struct procstat *procstat, struct filestat *fst)
+{
+	struct ptsstat pts;
+	char errbuf[_POSIX2_LINE_MAX];
+	int error;
 
+	error = procstat_get_pts_info(procstat, fst, &pts, errbuf);
+	if (error != 0) {
+		printf("* error");
+		return;
+	}
 	printf("* pseudo-terminal master ");
-	if (nflg || !name) {
-		rdev = dev2udev(tty.t_dev);
-		printf("%10d,%-2d", major(rdev), minor(rdev));
+	if (nflg || !*pts.devname) {
+		printf("%10d,%-2d", major(pts.dev), minor(pts.dev));
 	} else {
-		printf("%10s", name);
+		printf("%10s", pts.devname);
 	}
-	printf(" %2s\n", rw);
-
-	free(name);
-
-	return;
-bad:
-	printf("* error\n");
+	print_access_flags(fst->fs_fflags);
 }
 
-/*
- * Read the cdev structure in the kernel in order to work out the
- * associated dev_t
- */
-dev_t
-dev2udev(struct cdev *dev)
+static void
+print_vnode_info(struct procstat *procstat, struct filestat *fst)
 {
-	struct cdev_priv priv;
+	struct vnstat vn;
+	char errbuf[_POSIX2_LINE_MAX];
+	char mode[15];
+	const char *badtype;
+	int error;
+
+	badtype = NULL;
+	error = procstat_get_vnode_info(procstat, fst, &vn, errbuf);
+	if (error != 0)
+		badtype = errbuf;
+	else if (vn.vn_type == PS_FST_VTYPE_VBAD)
+		badtype = "bad";
+	else if (vn.vn_type == PS_FST_VTYPE_VNON)
+		badtype = "none";
+	if (badtype != NULL) {
+		printf(" -         -  %10s    -", badtype);
+		return;
+	}
 
-	if (KVM_READ(cdev2priv(dev), &priv, sizeof priv)) {
-		return ((dev_t)priv.cdp_inode);
-	} else {
-		dprintf(stderr, "can't convert cdev *%p to a dev_t\n", dev);
-		return -1;
+	if (nflg)
+		printf(" %2d,%-2d", major(vn.vn_fsid), minor(vn.vn_fsid));
+	else if (vn.vn_mntdir != NULL)
+		(void)printf(" %-8s", vn.vn_mntdir);
+
+	/*
+	 * Print access mode.
+	 */
+	if (nflg)
+		(void)snprintf(mode, sizeof(mode), "%o", vn.vn_mode);
+	else {
+		strmode(vn.vn_mode, mode);
 	}
+	(void)printf(" %6ld %10s", vn.vn_fileid, mode);
+
+	if (vn.vn_type == PS_FST_VTYPE_VBLK || vn.vn_type == PS_FST_VTYPE_VCHR) {
+		if (nflg || !*vn.vn_devname)
+			printf("  %2d,%-2d", major(vn.vn_dev), minor(vn.vn_dev));
+		else {
+			printf(" %6s", vn.vn_devname);
+		}
+	} else
+		printf(" %6lu", vn.vn_size);
+	print_access_flags(fst->fs_fflags);
 }
 
-/*
- * getinetproto --
- *	print name of protocol number
- */
-void
-getinetproto(int number)
+static void
+print_access_flags(int flags)
 {
-	static int isopen;
-	struct protoent *pe;
+	char rw[3];
 
-	if (!isopen)
-		setprotoent(++isopen);
-	if ((pe = getprotobynumber(number)) != NULL)
-		printf(" %s", pe->p_name);
-	else
-		printf(" %d", number);
+	rw[0] = '\0';
+	if (flags & PS_FST_FFLAG_READ)
+		strcat(rw, "r");
+	if (flags & PS_FST_FFLAG_WRITE)
+		strcat(rw, "w");
+	printf(" %2s", rw);
 }
 
 int
@@ -978,7 +486,7 @@ getfname(const char *filename)
 
 	if (stat(filename, &statbuf)) {
 		warn("%s", filename);
-		return(0);
+		return (0);
 	}
 	if ((cur = malloc(sizeof(DEVS))) == NULL)
 		err(1, NULL);
@@ -988,24 +496,10 @@ getfname(const char *filename)
 	cur->ino = statbuf.st_ino;
 	cur->fsid = statbuf.st_dev;
 	cur->name = filename;
-	return(1);
+	return (1);
 }
 
-#ifdef ZFS
-void *
-getvnodedata(struct vnode *vp)
-{
-	return (vp->v_data);
-}
-
-struct mount *
-getvnodemount(struct vnode *vp)
-{
-	return (vp->v_mount);
-}
-#endif
-
-void
+static void
 usage(void)
 {
 	(void)fprintf(stderr,