2 * Copyright (c) 1988, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * @(#) Copyright (c) 1988, 1993 The Regents of the University of California. All rights reserved.
30 * @(#)fstat.c 8.3 (Berkeley) 5/2/95
31 * $FreeBSD: src/usr.bin/fstat/fstat.c,v 1.21.2.7 2001/11/21 10:49:37 dwmalone Exp $
35 #include <sys/param.h>
38 #include <sys/vnode.h>
39 #include <sys/socket.h>
40 #include <sys/socketvar.h>
41 #include <sys/domain.h>
42 #include <sys/protosw.h>
44 #include <sys/unpcb.h>
45 #include <sys/sysctl.h>
46 #include <sys/filedesc.h>
47 #include <sys/queue.h>
51 #include <sys/ktrace.h>
52 #include <vfs/ufs/quota.h>
53 #include <vfs/ufs/inode.h>
54 #include <sys/mount.h>
55 #include <sys/namecache.h>
56 #include <nfs/nfsproto.h>
57 #include <nfs/rpcv2.h>
59 #include <nfs/nfsnode.h>
60 #include <sys/devfs.h>
63 #include <vm/vm_map.h>
64 #include <vm/vm_object.h>
66 #include <net/route.h>
67 #include <netinet/in.h>
68 #include <netinet/in_systm.h>
69 #include <netinet/ip.h>
70 #include <netinet/in_pcb.h>
96 static void make_printable(char *buf
, int len
);
104 int fsflg
, /* show files on same filesystem as file(s) argument */
105 pflg
, /* show files open by a particular pid */
106 uflg
; /* show files open by a particular (effective) user */
107 int checkfile
; /* true if restricting to particular files or filesystems */
108 int nflg
; /* (numerical) display f.s. and rdev as dev_t */
109 int vflg
; /* display errors in locating kernel data objects etc... */
110 int mflg
; /* include memory-mapped files */
116 struct fdnode
*ofiles
; /* buffer of pointers to file structures */
119 #define ALLOC_OFILES(d) \
120 if ((d) > maxfiles) { \
122 ofiles = malloc((d) * sizeof(struct fdnode)); \
123 if (ofiles == NULL) { \
131 static void dofiles(struct kinfo_proc
*, struct proc
*);
132 static void dommap(struct proc
*);
133 static void vtrans(struct vnode
*, struct nchandle
*, int, int, off_t
);
134 static int ufs_filestat(struct vnode
*, struct filestat
*);
135 static int nfs_filestat(struct vnode
*, struct filestat
*);
136 static int devfs_filestat(struct vnode
*, struct filestat
*);
137 static char *getmnton(struct mount
*, struct namecache_list
*, struct nchandle
*);
138 static void pipetrans(struct pipe
*, int, int);
139 static void socktrans(struct socket
*, int);
140 static void getinetproto(int);
141 static int getfname(const char *);
142 static void usage(void) __dead2
;
146 main(int argc
, char **argv
)
148 struct passwd
*passwd
;
149 struct kinfo_proc
*p
, *plast
;
153 char buf
[_POSIX2_LINE_MAX
];
157 what
= KERN_PROC_ALL
;
158 nlistf
= memf
= NULL
;
159 while ((ch
= getopt(argc
, argv
, "fmnp:u:vwN:M:")) != -1)
179 if (!isdigit(*optarg
)) {
180 warnx("-p requires a process id");
183 what
= KERN_PROC_PID
;
189 if (!(passwd
= getpwnam(optarg
)))
190 errx(1, "%s: unknown uid", optarg
);
191 what
= KERN_PROC_UID
;
192 arg
= passwd
->pw_uid
;
206 if (*(argv
+= optind
)) {
207 for (; *argv
; ++argv
) {
211 if (!checkfile
) /* file(s) specified, but none accessable */
215 ALLOC_OFILES(256); /* reserve space for file pointers */
217 if (fsflg
&& !checkfile
) {
218 /* -f with no files means use wd */
219 if (getfname(".") == 0)
225 * Discard setgid privileges if not the running kernel so that bad
226 * guys can't print interesting stuff from kernel memory.
228 if (nlistf
!= NULL
|| memf
!= NULL
)
231 if ((kd
= kvm_openfiles(nlistf
, memf
, NULL
, O_RDONLY
, buf
)) == NULL
)
234 if (kvm_nlist(kd
, nl
) != 0)
235 errx(1, "no namelist: %s", kvm_geterr(kd
));
237 if ((p
= kvm_getprocs(kd
, what
, arg
, &cnt
)) == NULL
)
238 errx(1, "%s", kvm_geterr(kd
));
240 printf("USER %-*.*s %*.*s FD DEV %*.*s MODE SZ|DV R/W",
241 wflg_cmd
, wflg_cmd
, "CMD",
242 pid_width
, pid_width
, "PID",
243 ino_width
, ino_width
, "INUM");
245 printf("USER %-*.*s %*.*s FD %-*.*s %*.*s MODE SZ|DV R/W",
246 wflg_cmd
, wflg_cmd
, "CMD",
247 pid_width
, pid_width
, "PID",
248 wflg_mnt
, wflg_mnt
, "PATH",
249 ino_width
, ino_width
, "INUM");
250 if (checkfile
&& fsflg
== 0)
255 for (plast
= &p
[cnt
]; p
< plast
; ++p
) {
256 if (p
->kp_stat
== SZOMB
)
258 if (!kread((void *)p
->kp_paddr
, &proc
, sizeof(proc
))) {
259 dprintf(stderr
, "can't read proc at %p for pid %d\n",
260 (void *)p
->kp_paddr
, Pid
);
275 printf("%-8.8s %-*s %*d", Uname, wflg_cmd, Comm, pid_width, Pid); \
298 * print open files attributed to this process
301 dofiles(struct kinfo_proc
*kp
, struct proc
*p
)
305 struct filedesc filed
;
306 struct ktrace_node ktrace_node
;
308 Uname
= user_from_uid(kp
->kp_uid
, 0);
311 make_printable(Comm
, strlen(Comm
));
315 if (!kread(p
->p_fd
, &filed
, sizeof (filed
))) {
316 dprintf(stderr
, "can't read filedesc at %p for pid %d\n",
317 (void *)p
->p_fd
, Pid
);
321 * root directory vnode, if one
324 vtrans(filed
.fd_rdir
, &filed
.fd_nrdir
, RDIR
, FREAD
, 0);
326 * current working directory vnode
328 vtrans(filed
.fd_cdir
, &filed
.fd_ncdir
, CDIR
, FREAD
, 0);
330 * ktrace vnode, if one
332 if (p
->p_tracenode
) {
333 if (kread(p
->p_tracenode
, &ktrace_node
, sizeof (ktrace_node
)))
334 vtrans(ktrace_node
.kn_vp
, NULL
, TRACE
, FREAD
|FWRITE
, 0);
340 vtrans(p
->p_textvp
, NULL
, TEXT
, FREAD
, 0);
344 ALLOC_OFILES(filed
.fd_lastfile
+1);
345 if (!kread(filed
.fd_files
, ofiles
,
346 (filed
.fd_lastfile
+1) * sizeof(struct fdnode
))) {
348 "can't read file structures at %p for pid %d\n",
349 (void *)filed
.fd_files
, Pid
);
352 for (i
= 0; i
<= filed
.fd_lastfile
; i
++) {
353 if (ofiles
[i
].fp
== NULL
)
355 if (!kread(ofiles
[i
].fp
, &file
, sizeof (struct file
))) {
356 dprintf(stderr
, "can't read file %d at %p for pid %d\n",
357 i
, (void *)ofiles
[i
].fp
, Pid
);
360 if (file
.f_type
== DTYPE_VNODE
) {
361 vtrans((struct vnode
*)file
.f_data
, &file
.f_nchandle
,
362 i
, file
.f_flag
, file
.f_offset
);
363 } else if (file
.f_type
== DTYPE_SOCKET
) {
365 socktrans((struct socket
*)file
.f_data
, i
);
368 else if (file
.f_type
== DTYPE_PIPE
) {
370 pipetrans((struct pipe
*)file
.f_data
, i
,
375 else if (file
.f_type
== DTYPE_FIFO
) {
377 vtrans((struct vnode
*)file
.f_data
,
379 i
, file
.f_flag
, file
.f_offset
);
384 "unknown file type %d for file %d of pid %d\n",
385 file
.f_type
, i
, Pid
);
391 dommap(struct proc
*p
)
393 struct vmspace vmspace
;
395 struct vm_map_entry entry
;
396 vm_map_entry_t entryp
;
397 struct vm_object object
;
401 if (!kread(p
->p_vmspace
, &vmspace
, sizeof(vmspace
))) {
402 dprintf(stderr
, "can't read vmspace at %p for pid %d\n",
403 (void *)p
->p_vmspace
, Pid
);
407 map
= &vmspace
.vm_map
;
409 for (entryp
= map
->header
.next
; entryp
!= &p
->p_vmspace
->vm_map
.header
;
410 entryp
= entry
.next
) {
411 if (!kread(entryp
, &entry
, sizeof(entry
))) {
413 "can't read vm_map_entry at %p for pid %d\n",
414 (void *)entryp
, Pid
);
418 if (entry
.maptype
== VM_MAPTYPE_SUBMAP
)
421 if ((objp
= entry
.object
.vm_object
) == NULL
)
424 for (; objp
; objp
= object
.backing_object
) {
425 if (!kread(objp
, &object
, sizeof(object
))) {
427 "can't read vm_object at %p for pid %d\n",
433 prot
= entry
.protection
;
434 fflags
= (prot
& VM_PROT_READ
? FREAD
: 0) |
435 (prot
& VM_PROT_WRITE
? FWRITE
: 0);
437 switch (object
.type
) {
439 vtrans((struct vnode
*)object
.handle
, NULL
,
449 vtrans(struct vnode
*vp
, struct nchandle
*ncr
, int i
, int flag
, off_t off
)
453 char rw
[3], mode
[15];
454 const char *badtype
= NULL
, *filename
;
458 filename
= badtype
= NULL
;
459 if (!kread(vp
, &vn
, sizeof (struct vnode
))) {
460 dprintf(stderr
, "can't read vnode at %p for pid %d\n",
464 if (vn
.v_type
== VNON
|| vn
.v_tag
== VT_NON
)
466 else if (vn
.v_type
== VBAD
)
471 if (!hammer_filestat(&vn
, &fst
))
475 if (!hammer2_filestat(&vn
, &fst
))
479 if (!tmpfs_filestat(&vn
, &fst
))
483 if (!ufs_filestat(&vn
, &fst
))
487 if (!ufs_filestat(&vn
, &fst
))
491 if (!nfs_filestat(&vn
, &fst
))
495 if (!ntfs_filestat(&vn
, &fst
))
499 if (!ext2fs_filestat(&vn
, &fst
))
504 if (!msdosfs_filestat(&vn
, &fst
))
509 if (!isofs_filestat(&vn
, &fst
))
514 if (!devfs_filestat(&vn
, &fst
))
519 static char unknown
[10];
520 sprintf(unknown
, "?(%x)", vn
.v_tag
);
531 for (d
= devs
; d
!= NULL
; d
= d
->next
)
532 if (d
->fsid
== fst
.fsid
) {
534 if (d
->ino
== (ino_t
)fst
.fileid
) {
539 if (fsmatch
== 0 || (filename
== NULL
&& fsflg
== 0))
544 (void)printf(" %-*s %10s %jd\n",
546 getmnton(vn
.v_mount
, &vn
.v_namecache
, ncr
),
553 major(fst
.fsid
), minor(fst
.fsid
));
556 wflg_mnt
, getmnton(vn
.v_mount
, &vn
.v_namecache
, ncr
));
558 sprintf(mode
, "%o", fst
.mode
);
560 strmode(fst
.mode
, mode
);
562 printf(" %*ld %10s", ino_width
, fst
.fileid
, mode
);
567 if (nflg
|| ((name
= devname(fst
.rdev
, vn
.v_type
== VCHR
?
568 S_IFCHR
: S_IFBLK
)) == NULL
))
569 printf(" %3u,%-4u", major(fst
.rdev
), minor(fst
.rdev
));
571 printf(" %8s", name
);
574 printf(" %jd", (intmax_t)fst
.offset
);
577 printf(" %8ju", (uintmax_t)fst
.size
);
585 if (filename
&& !fsflg
)
586 printf(" %s", filename
);
591 ufs_filestat(struct vnode
*vp
, struct filestat
*fsp
)
595 if (!kread(VTOI(vp
), &inode
, sizeof (inode
))) {
596 dprintf(stderr
, "can't read inode at %p for pid %d\n",
597 (void *)VTOI(vp
), Pid
);
601 * The st_dev from stat(2) is a udev_t. These kernel structures
602 * contain dev_t structures. We need to convert to udev to make
605 fsp
->fsid
= dev2udev(inode
.i_dev
);
606 fsp
->fileid
= (long)inode
.i_number
;
607 fsp
->mode
= (mode_t
)inode
.i_mode
;
608 fsp
->size
= inode
.i_size
;
609 fsp
->rdev
= inode
.i_rdev
;
615 nfs_filestat(struct vnode
*vp
, struct filestat
*fsp
)
617 struct nfsnode nfsnode
;
619 if (!kread(VTONFS(vp
), &nfsnode
, sizeof (nfsnode
))) {
620 dprintf(stderr
, "can't read nfsnode at %p for pid %d\n",
621 (void *)VTONFS(vp
), Pid
);
624 fsp
->fsid
= nfsnode
.n_vattr
.va_fsid
;
625 fsp
->fileid
= nfsnode
.n_vattr
.va_fileid
;
626 fsp
->size
= nfsnode
.n_size
;
627 fsp
->rdev
= makeudev(nfsnode
.n_vattr
.va_rmajor
,
628 nfsnode
.n_vattr
.va_rminor
);
629 fsp
->mode
= nfsnode
.n_vattr
.va_mode
| mtrans(vp
->v_type
);
635 devfs_filestat(struct vnode
*vp
, struct filestat
*fsp
)
637 struct devfs_node devfs_node
;
639 if (!kread(vp
->v_data
, &devfs_node
, sizeof (devfs_node
))) {
640 dprintf(stderr
, "can't read devfs_node at %p for pid %d\n",
641 (void *)vp
->v_data
, Pid
);
644 fsp
->fsid
= fsp
->rdev
= dev2udev(vp
->v_rdev
);
645 fsp
->fileid
= devfs_node
.d_dir
.d_ino
;
646 fsp
->mode
= (devfs_node
.mode
& ~S_IFMT
) | S_IFCHR
;
653 getmnton(struct mount
*m
, struct namecache_list
*ncplist
, struct nchandle
*ncr
)
655 static struct mount mount_l
;
659 char mntonname
[MNAMELEN
];
662 struct namecache
*ncp
;
663 struct namecache ncp_copy
;
664 static char path
[1024];
668 * If no ncp is passed try to find one via ncplist. Make sure
669 * we are using the correct mount pointer or the matching code
670 * will not know how to transition mount points properly.
672 if (ncr
== NULL
|| ncr
->ncp
== NULL
) {
673 ncp
= ncplist
->tqh_first
;
681 * If we have an ncp, traceback the path. This is a kvm pointer.
684 if (!kread(m
, &mount_l
, sizeof(struct mount
))) {
685 warnx("can't read mount table at %p", (void *)m
);
688 i
= sizeof(path
) - 1;
692 * If this is the root of the mount then traverse
693 * to the parent mount.
695 if (ncp
== mount_l
.mnt_ncmountpt
.ncp
) {
696 ncp
= mount_l
.mnt_ncmounton
.ncp
;
699 m
= mount_l
.mnt_ncmounton
.mount
;
700 if (!kread(m
, &mount_l
, sizeof(struct mount
))) {
701 warnx("can't read mount table at %p", (void *)m
);
707 * Ok, pull out the ncp and extract the name
709 if (!kread(ncp
, &ncp_copy
, sizeof(ncp_copy
))) {
710 warnx("can't read ncp at %p", ncp
);
713 if (i
<= ncp_copy
.nc_nlen
)
715 i
-= ncp_copy
.nc_nlen
;
716 if (!kread(ncp_copy
.nc_name
, path
+ i
, ncp_copy
.nc_nlen
)) {
717 warnx("can't read ncp %p path component at %p", ncp
, ncp_copy
.nc_name
);
720 make_printable(path
+ i
, ncp_copy
.nc_nlen
);
722 ncp
= ncp_copy
.nc_parent
;
724 if (i
== sizeof(path
) - 1)
730 * If all else fails print out the mount point path
732 for (mt
= mhead
; mt
!= NULL
; mt
= mt
->next
) {
734 return (mt
->mntonname
);
736 if (!kread(m
, &mount_l
, sizeof(struct mount
))) {
737 warnx("can't read mount table at %p", (void *)m
);
740 if ((mt
= malloc(sizeof (struct mtab
))) == NULL
)
743 bcopy(&mount_l
.mnt_stat
.f_mntonname
[0], &mt
->mntonname
[0], MNAMELEN
);
746 return (mt
->mntonname
);
750 pipetrans(struct pipe
*pi
, int i
, int flag
)
760 if ((intptr_t)pi
& 1) {
771 pi
= (void *)((intptr_t)pi
& ~(intptr_t)1);
774 if (!kread(pi
, &pip
, sizeof(struct pipe
))) {
775 dprintf(stderr
, "can't read pipe at %p\n", (void *)pi
);
779 printf("* pipe %8lx (%c<->%c)", (u_long
)pi
, side1
, side2
);
780 printf(" ravail %-zd wavail %-zd",
781 b1
->windex
- b1
->rindex
,
782 b2
->windex
- b2
->rindex
);
797 socktrans(struct socket
*sock
, int i
)
799 static const char *stypename
[] = {
809 struct protosw proto
;
819 if (!kread(sock
, &so
, sizeof(struct socket
))) {
820 dprintf(stderr
, "can't read sock at %p\n", (void *)sock
);
824 /* fill in protosw entry */
825 if (!kread(so
.so_proto
, &proto
, sizeof(struct protosw
))) {
826 dprintf(stderr
, "can't read protosw at %p",
827 (void *)so
.so_proto
);
832 if (!kread(proto
.pr_domain
, &dom
, sizeof(struct domain
))) {
833 dprintf(stderr
, "can't read domain at %p\n",
834 (const void *)proto
.pr_domain
);
838 if ((len
= kvm_read(kd
, (u_long
)dom
.dom_name
, dname
,
839 sizeof(dname
) - 1)) < 0) {
840 dprintf(stderr
, "can't read domain name at %p\n",
841 (void *)dom
.dom_name
);
847 if ((u_short
)so
.so_type
> STYPEMAX
)
848 printf("* %s ?%d", dname
, so
.so_type
);
850 printf("* %s %s", dname
, stypename
[so
.so_type
]);
853 * protocol specific formatting
855 * Try to find interesting things to print. For tcp, the interesting
856 * thing is the address of the tcpcb, for udp and others, just the
857 * inpcb (socket pcb). For unix domain, its the address of the socket
858 * pcb and the address of the connected pcb (if connected). Otherwise
859 * just print the protocol number and address of the socket itself.
860 * The idea is not to duplicate netstat, but to make available enough
861 * information for further analysis.
863 switch(dom
.dom_family
) {
866 getinetproto(proto
.pr_protocol
);
867 if (proto
.pr_protocol
== IPPROTO_TCP
) {
869 if (kvm_read(kd
, (u_long
)so
.so_pcb
,
870 (char *)&inpcb
, sizeof(struct inpcb
))
871 != sizeof(struct inpcb
)) {
873 "can't read inpcb at %p\n",
877 printf(" %lx", (u_long
)inpcb
.inp_ppcb
);
881 printf(" %lx", (u_long
)so
.so_pcb
);
884 /* print address of pcb and connected pcb */
886 printf(" %lx", (u_long
)so
.so_pcb
);
887 if (kvm_read(kd
, (u_long
)so
.so_pcb
, (char *)&unpcb
,
888 sizeof(struct unpcb
)) != sizeof(struct unpcb
)){
889 dprintf(stderr
, "can't read unpcb at %p\n",
893 if (unpcb
.unp_conn
) {
894 char shoconn
[4], *cp
;
897 if (!(so
.so_state
& SS_CANTRCVMORE
))
900 if (!(so
.so_state
& SS_CANTSENDMORE
))
903 printf(" %s %lx", shoconn
,
904 (u_long
)unpcb
.unp_conn
);
909 /* print protocol number and socket address */
910 printf(" %d %lx", proto
.pr_protocol
, (u_long
)sock
);
920 * Read the cdev structure in the kernel (as pointed to by a dev_t)
921 * in order to work out the associated udev_t
928 if (kread(dev
, &si
, sizeof si
)) {
929 if ((si
.si_umajor
& 0xffffff00) ||
930 (si
.si_uminor
& 0x0000ff00)) {
933 return((si
.si_umajor
<< 8) | si
.si_uminor
);
935 dprintf(stderr
, "can't convert dev_t %p to a udev_t\n", dev
);
941 makeudev(int x
, int y
)
943 if ((x
& 0xffffff00) || (y
& 0x0000ff00))
945 return ((x
<< 8) | y
);
950 * print name of protocol number
953 getinetproto(int number
)
959 setprotoent(++isopen
);
960 if ((pe
= getprotobynumber(number
)) != NULL
)
961 printf(" %s", pe
->p_name
);
963 printf(" %d", number
);
967 getfname(const char *filename
)
972 if (stat(filename
, &statbuf
)) {
973 warn("%s", filename
);
976 if ((cur
= malloc(sizeof(DEVS
))) == NULL
)
981 cur
->ino
= statbuf
.st_ino
;
982 cur
->fsid
= statbuf
.st_dev
;
983 cur
->name
= filename
;
990 (void)fprintf(stderr
,
991 "usage: fstat [-fmnv] [-p pid] [-u user] [-N system] [-M core] [file ...]\n");
997 make_printable(char *buf
, int len
)
1008 kread(const void *kaddr
, void *uaddr
, size_t nbytes
)
1010 if (nbytes
> 0x10000000)
1013 if (kvm_read(kd
, (u_long
)kaddr
, (char *)uaddr
, nbytes
) == (ssize_t
)nbytes
)