dtrace discuss - Oct 2007 - how to get the child pid on syscall::waitsys:return?

I''m struggling to traverse the structures to get the the child pid  
when returning from waitsys.  I got so far (below), but it''s not  
returning the correct pid.   Somewhere my pointers are going astray,  
can someone guide me on the right path?

thanks - mo


#!/usr/sbin/dtrace -s

syscall::waitsys:entry
/execname == $$1/
{
     self->infop = arg2;
}


syscall::waitsys:return
/self->infop != NULL/
{
     self->pt = (siginfo_t *)copyin(self->infop, sizeof(siginfo_t));
     printf("pid returned: %d", self->pt->__data.__proc.__pid);
     self->pt = NULL; self->infop = NULL;
}

Two ways:

1) #dtrace -C -U_LP64 -s foo.d x.sh

   where foo.d is:

   #include <sys/siginfo.h>
   syscall::waitsys:entry
   /execname == $$1/
   {
        self->infop = arg2;
   }
   syscall::waitsys:return
   /self->infop != NULL/
   {
        self->pt = (siginfo_t *)copyin(self->infop, sizeof(siginfo_t));
        printf("pid returned: %d\n", self->pt->si_pid);
        self->pt = NULL;
        self->infop = NULL;
   }


2) #dtrace -C -s foo32.d x.sh

where foo32.d is:

#include <sys/siginfo.h>
syscall::waitsys:entry
/execname == $$1/
{
    self->infop = arg2;
}
syscall::waitsys:return
/self->infop != NULL/
{
    self->pt = (siginfo32_t *)copyin(self->infop, sizeof(siginfo32_t));
    printf("pid returned: %d\n", self->pt->si_pid);
    self->pt = NULL;
    self->infop = NULL;
}


--
This message posted from opensolaris.org