2 * Copyright (c) 1988, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * @(#) Copyright (c) 1988, 1993 The Regents of the University of California. All rights reserved.
30 * @(#)fstat.c 8.3 (Berkeley) 5/2/95
31 * $FreeBSD: src/usr.bin/fstat/fstat.c,v 1.21.2.7 2001/11/21 10:49:37 dwmalone Exp $
35 #include <sys/param.h>
38 #include <sys/vnode.h>
39 #include <sys/socket.h>
40 #include <sys/socketvar.h>
41 #include <sys/domain.h>
42 #include <sys/protosw.h>
44 #include <sys/unpcb.h>
45 #include <sys/sysctl.h>
46 #include <sys/filedesc.h>
47 #include <sys/queue.h>
51 #include <sys/ktrace.h>
52 #include <vfs/ufs/quota.h>
53 #include <vfs/ufs/inode.h>
54 #include <sys/mount.h>
55 #include <sys/namecache.h>
56 #include <nfs/nfsproto.h>
57 #include <nfs/rpcv2.h>
59 #include <nfs/nfsnode.h>
60 #include <sys/devfs.h>
63 #include <vm/vm_map.h>
64 #include <vm/vm_object.h>
66 #include <net/route.h>
67 #include <netinet/in.h>
68 #include <netinet/in_systm.h>
69 #include <netinet/ip.h>
70 #include <netinet/in_pcb.h>
96 static void make_printable(char *buf
, int len
);
104 int fsflg
, /* show files on same filesystem as file(s) argument */
105 pflg
, /* show files open by a particular pid */
106 uflg
; /* show files open by a particular (effective) user */
107 int checkfile
; /* true if restricting to particular files or filesystems */
108 int nflg
; /* (numerical) display f.s. and rdev as dev_t */
109 int vflg
; /* display errors in locating kernel data objects etc... */
110 int mflg
; /* include memory-mapped files */
116 struct fdnode
*ofiles
; /* buffer of pointers to file structures */
119 #define ALLOC_OFILES(d) \
120 if ((d) > maxfiles) { \
122 ofiles = malloc((d) * sizeof(struct fdnode)); \
123 if (ofiles == NULL) { \
131 static void dofiles(struct kinfo_proc
*, struct proc
*);
132 static void dommap(struct proc
*);
133 static void vtrans(struct vnode
*, struct nchandle
*, int, int, off_t
);
134 static int ufs_filestat(struct vnode
*, struct filestat
*);
135 static int nfs_filestat(struct vnode
*, struct filestat
*);
136 static int devfs_filestat(struct vnode
*, struct filestat
*);
137 static char *getmnton(struct mount
*, struct namecache_list
*, struct nchandle
*);
138 static void pipetrans(struct pipe
*, int, int);
139 static void socktrans(struct socket
*, int);
140 static void getinetproto(int);
141 static int getfname(const char *);
142 static void usage(void) __dead2
;
146 main(int argc
, char **argv
)
148 struct passwd
*passwd
;
149 struct kinfo_proc
*p
, *plast
;
153 char buf
[_POSIX2_LINE_MAX
];
157 what
= KERN_PROC_ALL
;
158 nlistf
= memf
= NULL
;
159 while ((ch
= getopt(argc
, argv
, "fmnp:u:vwN:M:")) != -1)
179 if (!isdigit(*optarg
)) {
180 warnx("-p requires a process id");
183 what
= KERN_PROC_PID
;
189 if (!(passwd
= getpwnam(optarg
)))
190 errx(1, "%s: unknown uid", optarg
);
191 what
= KERN_PROC_UID
;
192 arg
= passwd
->pw_uid
;
206 if (*(argv
+= optind
)) {
207 for (; *argv
; ++argv
) {
211 if (!checkfile
) /* file(s) specified, but none accessable */
215 ALLOC_OFILES(256); /* reserve space for file pointers */
217 if (fsflg
&& !checkfile
) {
218 /* -f with no files means use wd */
219 if (getfname(".") == 0)
225 * Discard setgid privileges if not the running kernel so that bad
226 * guys can't print interesting stuff from kernel memory.
228 if (nlistf
!= NULL
|| memf
!= NULL
)
231 if ((kd
= kvm_openfiles(nlistf
, memf
, NULL
, O_RDONLY
, buf
)) == NULL
)
234 if (kvm_nlist(kd
, nl
) != 0)
235 errx(1, "no namelist: %s", kvm_geterr(kd
));
237 if ((p
= kvm_getprocs(kd
, what
, arg
, &cnt
)) == NULL
)
238 errx(1, "%s", kvm_geterr(kd
));
240 printf("USER %-*.*s %*.*s FD DEV %*.*s MODE SZ|DV R/W",
241 wflg_cmd
, wflg_cmd
, "CMD",
242 pid_width
, pid_width
, "PID",
243 ino_width
, ino_width
, "INUM");
245 printf("USER %-*.*s %*.*s FD %-*.*s %*.*s MODE SZ|DV R/W",
246 wflg_cmd
, wflg_cmd
, "CMD",
247 pid_width
, pid_width
, "PID",
248 wflg_mnt
, wflg_mnt
, "PATH",
249 ino_width
, ino_width
, "INUM");
250 if (checkfile
&& fsflg
== 0)
255 for (plast
= &p
[cnt
]; p
< plast
; ++p
) {
256 if (p
->kp_stat
== SZOMB
)
258 if (!kread((void *)p
->kp_paddr
, &proc
, sizeof(proc
))) {
259 dprintf(stderr
, "can't read proc at %p for pid %d\n",
260 (void *)p
->kp_paddr
, Pid
);
275 printf("%-8.8s %-*s %*d", Uname, wflg_cmd, Comm, pid_width, Pid); \
298 * print open files attributed to this process
301 dofiles(struct kinfo_proc
*kp
, struct proc
*p
)
305 struct filedesc filed
;
306 struct ktrace_node ktrace_node
;
308 Uname
= user_from_uid(kp
->kp_uid
, 0);
311 make_printable(Comm
, strlen(Comm
));
315 if (!kread(p
->p_fd
, &filed
, sizeof (filed
))) {
316 dprintf(stderr
, "can't read filedesc at %p for pid %d\n",
317 (void *)p
->p_fd
, Pid
);
321 * root directory vnode, if one
324 vtrans(filed
.fd_rdir
, &filed
.fd_nrdir
, RDIR
, FREAD
, 0);
326 * current working directory vnode
328 vtrans(filed
.fd_cdir
, &filed
.fd_ncdir
, CDIR
, FREAD
, 0);
330 * ktrace vnode, if one
332 if (p
->p_tracenode
) {
333 if (kread(p
->p_tracenode
, &ktrace_node
, sizeof (ktrace_node
)))
334 vtrans(ktrace_node
.kn_vp
, NULL
, TRACE
, FREAD
|FWRITE
, 0);
340 vtrans(p
->p_textvp
, NULL
, TEXT
, FREAD
, 0);
344 ALLOC_OFILES(filed
.fd_lastfile
+1);
345 if (!kread(filed
.fd_files
, ofiles
,
346 (filed
.fd_lastfile
+1) * sizeof(struct fdnode
))) {
348 "can't read file structures at %p for pid %d\n",
349 (void *)filed
.fd_files
, Pid
);
352 for (i
= 0; i
<= filed
.fd_lastfile
; i
++) {
353 if (ofiles
[i
].fp
== NULL
)
355 if (!kread(ofiles
[i
].fp
, &file
, sizeof (struct file
))) {
356 dprintf(stderr
, "can't read file %d at %p for pid %d\n",
357 i
, (void *)ofiles
[i
].fp
, Pid
);
360 if (file
.f_type
== DTYPE_VNODE
) {
361 vtrans((struct vnode
*)file
.f_data
, &file
.f_nchandle
,
362 i
, file
.f_flag
, file
.f_offset
);
363 } else if (file
.f_type
== DTYPE_SOCKET
) {
365 socktrans((struct socket
*)file
.f_data
, i
);
368 else if (file
.f_type
== DTYPE_PIPE
) {
370 pipetrans((struct pipe
*)file
.f_data
, i
,
375 else if (file
.f_type
== DTYPE_FIFO
) {
377 vtrans((struct vnode
*)file
.f_data
,
379 i
, file
.f_flag
, file
.f_offset
);
384 "unknown file type %d for file %d of pid %d\n",
385 file
.f_type
, i
, Pid
);
391 dommap(struct proc
*p
)
393 struct vmspace vmspace
;
395 struct vm_map_entry entry
;
396 vm_map_entry_t entryp
;
397 struct vm_object object
;
401 if (!kread(p
->p_vmspace
, &vmspace
, sizeof(vmspace
))) {
402 dprintf(stderr
, "can't read vmspace at %p for pid %d\n",
403 (void *)p
->p_vmspace
, Pid
);
407 map
= &vmspace
.vm_map
;
409 for (entryp
= map
->header
.next
; entryp
!= &p
->p_vmspace
->vm_map
.header
;
410 entryp
= entry
.next
) {
411 if (!kread(entryp
, &entry
, sizeof(entry
))) {
413 "can't read vm_map_entry at %p for pid %d\n",
414 (void *)entryp
, Pid
);
418 if (entry
.maptype
== VM_MAPTYPE_SUBMAP
)
421 if ((objp
= entry
.object
.vm_object
) == NULL
)
424 for (; objp
; objp
= object
.backing_object
) {
425 if (!kread(objp
, &object
, sizeof(object
))) {
427 "can't read vm_object at %p for pid %d\n",
433 prot
= entry
.protection
;
434 fflags
= (prot
& VM_PROT_READ
? FREAD
: 0) |
435 (prot
& VM_PROT_WRITE
? FWRITE
: 0);
437 switch (object
.type
) {
439 vtrans((struct vnode
*)object
.handle
, NULL
,
449 vtrans(struct vnode
*vp
, struct nchandle
*ncr
, int i
, int flag
, off_t off
)
453 char rw
[3], mode
[15];
454 const char *badtype
= NULL
, *filename
;
458 filename
= badtype
= NULL
;
459 if (!kread(vp
, &vn
, sizeof (struct vnode
))) {
460 dprintf(stderr
, "can't read vnode at %p for pid %d\n",
464 if (vn
.v_type
== VNON
|| vn
.v_tag
== VT_NON
)
466 else if (vn
.v_type
== VBAD
)
471 if (!hammer_filestat(&vn
, &fst
))
475 if (!tmpfs_filestat(&vn
, &fst
))
479 if (!ufs_filestat(&vn
, &fst
))
483 if (!ufs_filestat(&vn
, &fst
))
487 if (!nfs_filestat(&vn
, &fst
))
491 if (!ntfs_filestat(&vn
, &fst
))
495 if (!ext2fs_filestat(&vn
, &fst
))
500 if (!msdosfs_filestat(&vn
, &fst
))
505 if (!isofs_filestat(&vn
, &fst
))
510 if (!devfs_filestat(&vn
, &fst
))
515 static char unknown
[10];
516 sprintf(unknown
, "?(%x)", vn
.v_tag
);
527 for (d
= devs
; d
!= NULL
; d
= d
->next
)
528 if (d
->fsid
== fst
.fsid
) {
530 if (d
->ino
== (ino_t
)fst
.fileid
) {
535 if (fsmatch
== 0 || (filename
== NULL
&& fsflg
== 0))
540 (void)printf(" %-*s %10s %jd\n",
542 getmnton(vn
.v_mount
, &vn
.v_namecache
, ncr
),
549 major(fst
.fsid
), minor(fst
.fsid
));
552 wflg_mnt
, getmnton(vn
.v_mount
, &vn
.v_namecache
, ncr
));
554 sprintf(mode
, "%o", fst
.mode
);
556 strmode(fst
.mode
, mode
);
558 printf(" %*ld %10s", ino_width
, fst
.fileid
, mode
);
563 if (nflg
|| ((name
= devname(fst
.rdev
, vn
.v_type
== VCHR
?
564 S_IFCHR
: S_IFBLK
)) == NULL
))
565 printf(" %3u,%-4u", major(fst
.rdev
), minor(fst
.rdev
));
567 printf(" %8s", name
);
570 printf(" %jd", (intmax_t)fst
.offset
);
573 printf(" %8ju", (uintmax_t)fst
.size
);
581 if (filename
&& !fsflg
)
582 printf(" %s", filename
);
587 ufs_filestat(struct vnode
*vp
, struct filestat
*fsp
)
591 if (!kread(VTOI(vp
), &inode
, sizeof (inode
))) {
592 dprintf(stderr
, "can't read inode at %p for pid %d\n",
593 (void *)VTOI(vp
), Pid
);
597 * The st_dev from stat(2) is a udev_t. These kernel structures
598 * contain dev_t structures. We need to convert to udev to make
601 fsp
->fsid
= dev2udev(inode
.i_dev
);
602 fsp
->fileid
= (long)inode
.i_number
;
603 fsp
->mode
= (mode_t
)inode
.i_mode
;
604 fsp
->size
= inode
.i_size
;
605 fsp
->rdev
= inode
.i_rdev
;
611 nfs_filestat(struct vnode
*vp
, struct filestat
*fsp
)
613 struct nfsnode nfsnode
;
615 if (!kread(VTONFS(vp
), &nfsnode
, sizeof (nfsnode
))) {
616 dprintf(stderr
, "can't read nfsnode at %p for pid %d\n",
617 (void *)VTONFS(vp
), Pid
);
620 fsp
->fsid
= nfsnode
.n_vattr
.va_fsid
;
621 fsp
->fileid
= nfsnode
.n_vattr
.va_fileid
;
622 fsp
->size
= nfsnode
.n_size
;
623 fsp
->rdev
= makeudev(nfsnode
.n_vattr
.va_rmajor
,
624 nfsnode
.n_vattr
.va_rminor
);
625 fsp
->mode
= nfsnode
.n_vattr
.va_mode
| mtrans(vp
->v_type
);
631 devfs_filestat(struct vnode
*vp
, struct filestat
*fsp
)
633 struct devfs_node devfs_node
;
635 if (!kread(vp
->v_data
, &devfs_node
, sizeof (devfs_node
))) {
636 dprintf(stderr
, "can't read devfs_node at %p for pid %d\n",
637 (void *)vp
->v_data
, Pid
);
640 fsp
->fsid
= fsp
->rdev
= dev2udev(vp
->v_rdev
);
641 fsp
->fileid
= devfs_node
.d_dir
.d_ino
;
642 fsp
->mode
= (devfs_node
.mode
& ~S_IFMT
) | S_IFCHR
;
649 getmnton(struct mount
*m
, struct namecache_list
*ncplist
, struct nchandle
*ncr
)
651 static struct mount mount_l
;
655 char mntonname
[MNAMELEN
];
658 struct namecache
*ncp
;
659 struct namecache ncp_copy
;
660 static char path
[1024];
664 * If no ncp is passed try to find one via ncplist. Make sure
665 * we are using the correct mount pointer or the matching code
666 * will not know how to transition mount points properly.
668 if (ncr
== NULL
|| ncr
->ncp
== NULL
) {
669 ncp
= ncplist
->tqh_first
;
677 * If we have an ncp, traceback the path. This is a kvm pointer.
680 if (!kread(m
, &mount_l
, sizeof(struct mount
))) {
681 warnx("can't read mount table at %p", (void *)m
);
684 i
= sizeof(path
) - 1;
688 * If this is the root of the mount then traverse
689 * to the parent mount.
691 if (ncp
== mount_l
.mnt_ncmountpt
.ncp
) {
692 ncp
= mount_l
.mnt_ncmounton
.ncp
;
695 m
= mount_l
.mnt_ncmounton
.mount
;
696 if (!kread(m
, &mount_l
, sizeof(struct mount
))) {
697 warnx("can't read mount table at %p", (void *)m
);
703 * Ok, pull out the ncp and extract the name
705 if (!kread(ncp
, &ncp_copy
, sizeof(ncp_copy
))) {
706 warnx("can't read ncp at %p", ncp
);
709 if (i
<= ncp_copy
.nc_nlen
)
711 i
-= ncp_copy
.nc_nlen
;
712 if (!kread(ncp_copy
.nc_name
, path
+ i
, ncp_copy
.nc_nlen
)) {
713 warnx("can't read ncp %p path component at %p", ncp
, ncp_copy
.nc_name
);
716 make_printable(path
+ i
, ncp_copy
.nc_nlen
);
718 ncp
= ncp_copy
.nc_parent
;
720 if (i
== sizeof(path
) - 1)
726 * If all else fails print out the mount point path
728 for (mt
= mhead
; mt
!= NULL
; mt
= mt
->next
) {
730 return (mt
->mntonname
);
732 if (!kread(m
, &mount_l
, sizeof(struct mount
))) {
733 warnx("can't read mount table at %p", (void *)m
);
736 if ((mt
= malloc(sizeof (struct mtab
))) == NULL
)
739 bcopy(&mount_l
.mnt_stat
.f_mntonname
[0], &mt
->mntonname
[0], MNAMELEN
);
742 return (mt
->mntonname
);
746 pipetrans(struct pipe
*pi
, int i
, int flag
)
756 if ((intptr_t)pi
& 1) {
767 pi
= (void *)((intptr_t)pi
& ~(intptr_t)1);
770 if (!kread(pi
, &pip
, sizeof(struct pipe
))) {
771 dprintf(stderr
, "can't read pipe at %p\n", (void *)pi
);
775 printf("* pipe %8lx (%c<->%c)", (u_long
)pi
, side1
, side2
);
776 printf(" ravail %-zd wavail %-zd",
777 b1
->windex
- b1
->rindex
,
778 b2
->windex
- b2
->rindex
);
793 socktrans(struct socket
*sock
, int i
)
795 static const char *stypename
[] = {
805 struct protosw proto
;
815 if (!kread(sock
, &so
, sizeof(struct socket
))) {
816 dprintf(stderr
, "can't read sock at %p\n", (void *)sock
);
820 /* fill in protosw entry */
821 if (!kread(so
.so_proto
, &proto
, sizeof(struct protosw
))) {
822 dprintf(stderr
, "can't read protosw at %p",
823 (void *)so
.so_proto
);
828 if (!kread(proto
.pr_domain
, &dom
, sizeof(struct domain
))) {
829 dprintf(stderr
, "can't read domain at %p\n",
830 (const void *)proto
.pr_domain
);
834 if ((len
= kvm_read(kd
, (u_long
)dom
.dom_name
, dname
,
835 sizeof(dname
) - 1)) < 0) {
836 dprintf(stderr
, "can't read domain name at %p\n",
837 (void *)dom
.dom_name
);
843 if ((u_short
)so
.so_type
> STYPEMAX
)
844 printf("* %s ?%d", dname
, so
.so_type
);
846 printf("* %s %s", dname
, stypename
[so
.so_type
]);
849 * protocol specific formatting
851 * Try to find interesting things to print. For tcp, the interesting
852 * thing is the address of the tcpcb, for udp and others, just the
853 * inpcb (socket pcb). For unix domain, its the address of the socket
854 * pcb and the address of the connected pcb (if connected). Otherwise
855 * just print the protocol number and address of the socket itself.
856 * The idea is not to duplicate netstat, but to make available enough
857 * information for further analysis.
859 switch(dom
.dom_family
) {
862 getinetproto(proto
.pr_protocol
);
863 if (proto
.pr_protocol
== IPPROTO_TCP
) {
865 if (kvm_read(kd
, (u_long
)so
.so_pcb
,
866 (char *)&inpcb
, sizeof(struct inpcb
))
867 != sizeof(struct inpcb
)) {
869 "can't read inpcb at %p\n",
873 printf(" %lx", (u_long
)inpcb
.inp_ppcb
);
877 printf(" %lx", (u_long
)so
.so_pcb
);
880 /* print address of pcb and connected pcb */
882 printf(" %lx", (u_long
)so
.so_pcb
);
883 if (kvm_read(kd
, (u_long
)so
.so_pcb
, (char *)&unpcb
,
884 sizeof(struct unpcb
)) != sizeof(struct unpcb
)){
885 dprintf(stderr
, "can't read unpcb at %p\n",
889 if (unpcb
.unp_conn
) {
890 char shoconn
[4], *cp
;
893 if (!(so
.so_state
& SS_CANTRCVMORE
))
896 if (!(so
.so_state
& SS_CANTSENDMORE
))
899 printf(" %s %lx", shoconn
,
900 (u_long
)unpcb
.unp_conn
);
905 /* print protocol number and socket address */
906 printf(" %d %lx", proto
.pr_protocol
, (u_long
)sock
);
916 * Read the cdev structure in the kernel (as pointed to by a dev_t)
917 * in order to work out the associated udev_t
924 if (kread(dev
, &si
, sizeof si
)) {
925 if ((si
.si_umajor
& 0xffffff00) ||
926 (si
.si_uminor
& 0x0000ff00)) {
929 return((si
.si_umajor
<< 8) | si
.si_uminor
);
931 dprintf(stderr
, "can't convert dev_t %p to a udev_t\n", dev
);
937 makeudev(int x
, int y
)
939 if ((x
& 0xffffff00) || (y
& 0x0000ff00))
941 return ((x
<< 8) | y
);
946 * print name of protocol number
949 getinetproto(int number
)
955 setprotoent(++isopen
);
956 if ((pe
= getprotobynumber(number
)) != NULL
)
957 printf(" %s", pe
->p_name
);
959 printf(" %d", number
);
963 getfname(const char *filename
)
968 if (stat(filename
, &statbuf
)) {
969 warn("%s", filename
);
972 if ((cur
= malloc(sizeof(DEVS
))) == NULL
)
977 cur
->ino
= statbuf
.st_ino
;
978 cur
->fsid
= statbuf
.st_dev
;
979 cur
->name
= filename
;
986 (void)fprintf(stderr
,
987 "usage: fstat [-fmnv] [-p pid] [-u user] [-N system] [-M core] [file ...]\n");
993 make_printable(char *buf
, int len
)
1004 kread(const void *kaddr
, void *uaddr
, size_t nbytes
)
1006 if (nbytes
> 0x10000000)
1009 if (kvm_read(kd
, (u_long
)kaddr
, (char *)uaddr
, nbytes
) == (ssize_t
)nbytes
)