xref: /freebsd/tests/sys/kern/ptrace_test.c (revision 488ab515d6cc02f6f743f0badfc8e94eb553cd30)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/types.h>
31 #include <sys/cpuset.h>
32 #include <sys/event.h>
33 #include <sys/file.h>
34 #include <sys/time.h>
35 #include <sys/procctl.h>
36 #include <sys/ptrace.h>
37 #include <sys/queue.h>
38 #include <sys/runq.h>
39 #include <sys/syscall.h>
40 #include <sys/sysctl.h>
41 #include <sys/user.h>
42 #include <sys/wait.h>
43 #include <errno.h>
44 #include <machine/cpufunc.h>
45 #include <pthread.h>
46 #include <sched.h>
47 #include <semaphore.h>
48 #include <signal.h>
49 #include <stdio.h>
50 #include <stdlib.h>
51 #include <unistd.h>
52 #include <atf-c.h>
53 
54 /*
55  * Architectures with a user-visible breakpoint().
56  */
57 #if defined(__amd64__) || defined(__i386__) || defined(__mips__) ||	\
58     defined(__sparc64__)
59 #define	HAVE_BREAKPOINT
60 #endif
61 
62 /*
63  * Adjust PC to skip over a breakpoint when stopped for a breakpoint trap.
64  */
65 #ifdef HAVE_BREAKPOINT
66 #if defined(__amd64__) || defined(__i386__)
67 #define	SKIP_BREAK(reg)
68 #elif defined(__mips__)
69 #define	SKIP_BREAK(reg)	((reg)->r_regs[PC] += 4)
70 #elif defined(__sparc64__)
71 #define	SKIP_BREAK(reg)	do {						\
72 	(reg)->r_tpc = (reg)->r_tnpc + 4;				\
73 	(reg)->r_tnpc += 8;						\
74 } while (0)
75 #endif
76 #endif
77 
78 /*
79  * A variant of ATF_REQUIRE that is suitable for use in child
80  * processes.  This only works if the parent process is tripped up by
81  * the early exit and fails some requirement itself.
82  */
83 #define	CHILD_REQUIRE(exp) do {						\
84 		if (!(exp))						\
85 			child_fail_require(__FILE__, __LINE__,		\
86 			    #exp " not met");				\
87 	} while (0)
88 
89 static __dead2 void
90 child_fail_require(const char *file, int line, const char *str)
91 {
92 	char buf[128];
93 
94 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
95 	write(2, buf, strlen(buf));
96 	_exit(32);
97 }
98 
99 static void
100 trace_me(void)
101 {
102 
103 	/* Attach the parent process as a tracer of this process. */
104 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
105 
106 	/* Trigger a stop. */
107 	raise(SIGSTOP);
108 }
109 
110 static void
111 attach_child(pid_t pid)
112 {
113 	pid_t wpid;
114 	int status;
115 
116 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
117 
118 	wpid = waitpid(pid, &status, 0);
119 	ATF_REQUIRE(wpid == pid);
120 	ATF_REQUIRE(WIFSTOPPED(status));
121 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
122 }
123 
124 static void
125 wait_for_zombie(pid_t pid)
126 {
127 
128 	/*
129 	 * Wait for a process to exit.  This is kind of gross, but
130 	 * there is not a better way.
131 	 *
132 	 * Prior to r325719, the kern.proc.pid.<pid> sysctl failed
133 	 * with ESRCH.  After that change, a valid struct kinfo_proc
134 	 * is returned for zombies with ki_stat set to SZOMB.
135 	 */
136 	for (;;) {
137 		struct kinfo_proc kp;
138 		size_t len;
139 		int mib[4];
140 
141 		mib[0] = CTL_KERN;
142 		mib[1] = KERN_PROC;
143 		mib[2] = KERN_PROC_PID;
144 		mib[3] = pid;
145 		len = sizeof(kp);
146 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
147 			ATF_REQUIRE(errno == ESRCH);
148 			break;
149 		}
150 		if (kp.ki_stat == SZOMB)
151 			break;
152 		usleep(5000);
153 	}
154 }
155 
156 /*
157  * Verify that a parent debugger process "sees" the exit of a debugged
158  * process exactly once when attached via PT_TRACE_ME.
159  */
160 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
161 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
162 {
163 	pid_t child, wpid;
164 	int status;
165 
166 	ATF_REQUIRE((child = fork()) != -1);
167 	if (child == 0) {
168 		/* Child process. */
169 		trace_me();
170 
171 		_exit(1);
172 	}
173 
174 	/* Parent process. */
175 
176 	/* The first wait() should report the stop from SIGSTOP. */
177 	wpid = waitpid(child, &status, 0);
178 	ATF_REQUIRE(wpid == child);
179 	ATF_REQUIRE(WIFSTOPPED(status));
180 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
181 
182 	/* Continue the child ignoring the SIGSTOP. */
183 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
184 
185 	/* The second wait() should report the exit status. */
186 	wpid = waitpid(child, &status, 0);
187 	ATF_REQUIRE(wpid == child);
188 	ATF_REQUIRE(WIFEXITED(status));
189 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
190 
191 	/* The child should no longer exist. */
192 	wpid = waitpid(child, &status, 0);
193 	ATF_REQUIRE(wpid == -1);
194 	ATF_REQUIRE(errno == ECHILD);
195 }
196 
197 /*
198  * Verify that a parent debugger process "sees" the exit of a debugged
199  * process exactly once when attached via PT_ATTACH.
200  */
201 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
202 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
203 {
204 	pid_t child, wpid;
205 	int cpipe[2], status;
206 	char c;
207 
208 	ATF_REQUIRE(pipe(cpipe) == 0);
209 	ATF_REQUIRE((child = fork()) != -1);
210 	if (child == 0) {
211 		/* Child process. */
212 		close(cpipe[0]);
213 
214 		/* Wait for the parent to attach. */
215 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
216 
217 		_exit(1);
218 	}
219 	close(cpipe[1]);
220 
221 	/* Parent process. */
222 
223 	/* Attach to the child process. */
224 	attach_child(child);
225 
226 	/* Continue the child ignoring the SIGSTOP. */
227 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
228 
229 	/* Signal the child to exit. */
230 	close(cpipe[0]);
231 
232 	/* The second wait() should report the exit status. */
233 	wpid = waitpid(child, &status, 0);
234 	ATF_REQUIRE(wpid == child);
235 	ATF_REQUIRE(WIFEXITED(status));
236 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
237 
238 	/* The child should no longer exist. */
239 	wpid = waitpid(child, &status, 0);
240 	ATF_REQUIRE(wpid == -1);
241 	ATF_REQUIRE(errno == ECHILD);
242 }
243 
244 /*
245  * Verify that a parent process "sees" the exit of a debugged process only
246  * after the debugger has seen it.
247  */
248 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
249 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
250 {
251 	pid_t child, debugger, wpid;
252 	int cpipe[2], dpipe[2], status;
253 	char c;
254 
255 	ATF_REQUIRE(pipe(cpipe) == 0);
256 	ATF_REQUIRE((child = fork()) != -1);
257 
258 	if (child == 0) {
259 		/* Child process. */
260 		close(cpipe[0]);
261 
262 		/* Wait for parent to be ready. */
263 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
264 
265 		_exit(1);
266 	}
267 	close(cpipe[1]);
268 
269 	ATF_REQUIRE(pipe(dpipe) == 0);
270 	ATF_REQUIRE((debugger = fork()) != -1);
271 
272 	if (debugger == 0) {
273 		/* Debugger process. */
274 		close(dpipe[0]);
275 
276 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
277 
278 		wpid = waitpid(child, &status, 0);
279 		CHILD_REQUIRE(wpid == child);
280 		CHILD_REQUIRE(WIFSTOPPED(status));
281 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
282 
283 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
284 
285 		/* Signal parent that debugger is attached. */
286 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
287 
288 		/* Wait for parent's failed wait. */
289 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
290 
291 		wpid = waitpid(child, &status, 0);
292 		CHILD_REQUIRE(wpid == child);
293 		CHILD_REQUIRE(WIFEXITED(status));
294 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
295 
296 		_exit(0);
297 	}
298 	close(dpipe[1]);
299 
300 	/* Parent process. */
301 
302 	/* Wait for the debugger to attach to the child. */
303 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
304 
305 	/* Release the child. */
306 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
307 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
308 	close(cpipe[0]);
309 
310 	wait_for_zombie(child);
311 
312 	/*
313 	 * This wait should return a pid of 0 to indicate no status to
314 	 * report.  The parent should see the child as non-exited
315 	 * until the debugger sees the exit.
316 	 */
317 	wpid = waitpid(child, &status, WNOHANG);
318 	ATF_REQUIRE(wpid == 0);
319 
320 	/* Signal the debugger to wait for the child. */
321 	close(dpipe[0]);
322 
323 	/* Wait for the debugger. */
324 	wpid = waitpid(debugger, &status, 0);
325 	ATF_REQUIRE(wpid == debugger);
326 	ATF_REQUIRE(WIFEXITED(status));
327 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
328 
329 	/* The child process should now be ready. */
330 	wpid = waitpid(child, &status, WNOHANG);
331 	ATF_REQUIRE(wpid == child);
332 	ATF_REQUIRE(WIFEXITED(status));
333 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
334 }
335 
336 /*
337  * Verify that a parent process "sees" the exit of a debugged process
338  * only after a non-direct-child debugger has seen it.  In particular,
339  * various wait() calls in the parent must avoid failing with ESRCH by
340  * checking the parent's orphan list for the debugee.
341  */
342 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
343 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
344 {
345 	pid_t child, debugger, fpid, wpid;
346 	int cpipe[2], dpipe[2], status;
347 	char c;
348 
349 	ATF_REQUIRE(pipe(cpipe) == 0);
350 	ATF_REQUIRE((child = fork()) != -1);
351 
352 	if (child == 0) {
353 		/* Child process. */
354 		close(cpipe[0]);
355 
356 		/* Wait for parent to be ready. */
357 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
358 
359 		_exit(1);
360 	}
361 	close(cpipe[1]);
362 
363 	ATF_REQUIRE(pipe(dpipe) == 0);
364 	ATF_REQUIRE((debugger = fork()) != -1);
365 
366 	if (debugger == 0) {
367 		/* Debugger parent. */
368 
369 		/*
370 		 * Fork again and drop the debugger parent so that the
371 		 * debugger is not a child of the main parent.
372 		 */
373 		CHILD_REQUIRE((fpid = fork()) != -1);
374 		if (fpid != 0)
375 			_exit(2);
376 
377 		/* Debugger process. */
378 		close(dpipe[0]);
379 
380 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
381 
382 		wpid = waitpid(child, &status, 0);
383 		CHILD_REQUIRE(wpid == child);
384 		CHILD_REQUIRE(WIFSTOPPED(status));
385 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
386 
387 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
388 
389 		/* Signal parent that debugger is attached. */
390 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
391 
392 		/* Wait for parent's failed wait. */
393 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
394 
395 		wpid = waitpid(child, &status, 0);
396 		CHILD_REQUIRE(wpid == child);
397 		CHILD_REQUIRE(WIFEXITED(status));
398 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
399 
400 		_exit(0);
401 	}
402 	close(dpipe[1]);
403 
404 	/* Parent process. */
405 
406 	/* Wait for the debugger parent process to exit. */
407 	wpid = waitpid(debugger, &status, 0);
408 	ATF_REQUIRE(wpid == debugger);
409 	ATF_REQUIRE(WIFEXITED(status));
410 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
411 
412 	/* A WNOHANG wait here should see the non-exited child. */
413 	wpid = waitpid(child, &status, WNOHANG);
414 	ATF_REQUIRE(wpid == 0);
415 
416 	/* Wait for the debugger to attach to the child. */
417 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
418 
419 	/* Release the child. */
420 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
421 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
422 	close(cpipe[0]);
423 
424 	wait_for_zombie(child);
425 
426 	/*
427 	 * This wait should return a pid of 0 to indicate no status to
428 	 * report.  The parent should see the child as non-exited
429 	 * until the debugger sees the exit.
430 	 */
431 	wpid = waitpid(child, &status, WNOHANG);
432 	ATF_REQUIRE(wpid == 0);
433 
434 	/* Signal the debugger to wait for the child. */
435 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
436 
437 	/* Wait for the debugger. */
438 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
439 	close(dpipe[0]);
440 
441 	/* The child process should now be ready. */
442 	wpid = waitpid(child, &status, WNOHANG);
443 	ATF_REQUIRE(wpid == child);
444 	ATF_REQUIRE(WIFEXITED(status));
445 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
446 }
447 
448 /*
449  * The parent process should always act the same regardless of how the
450  * debugger is attached to it.
451  */
452 static __dead2 void
453 follow_fork_parent(bool use_vfork)
454 {
455 	pid_t fpid, wpid;
456 	int status;
457 
458 	if (use_vfork)
459 		CHILD_REQUIRE((fpid = vfork()) != -1);
460 	else
461 		CHILD_REQUIRE((fpid = fork()) != -1);
462 
463 	if (fpid == 0)
464 		/* Child */
465 		_exit(2);
466 
467 	wpid = waitpid(fpid, &status, 0);
468 	CHILD_REQUIRE(wpid == fpid);
469 	CHILD_REQUIRE(WIFEXITED(status));
470 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
471 
472 	_exit(1);
473 }
474 
475 /*
476  * Helper routine for follow fork tests.  This waits for two stops
477  * that report both "sides" of a fork.  It returns the pid of the new
478  * child process.
479  */
480 static pid_t
481 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
482 {
483 	struct ptrace_lwpinfo pl;
484 	bool fork_reported[2];
485 	pid_t child, wpid;
486 	int i, status;
487 
488 	fork_reported[0] = false;
489 	fork_reported[1] = false;
490 	child = -1;
491 
492 	/*
493 	 * Each process should report a fork event.  The parent should
494 	 * report a PL_FLAG_FORKED event, and the child should report
495 	 * a PL_FLAG_CHILD event.
496 	 */
497 	for (i = 0; i < 2; i++) {
498 		wpid = wait(&status);
499 		ATF_REQUIRE(wpid > 0);
500 		ATF_REQUIRE(WIFSTOPPED(status));
501 
502 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
503 		    sizeof(pl)) != -1);
504 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
505 		    0);
506 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
507 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
508 		if (pl.pl_flags & PL_FLAG_CHILD) {
509 			ATF_REQUIRE(wpid != parent);
510 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
511 			ATF_REQUIRE(!fork_reported[1]);
512 			if (child == -1)
513 				child = wpid;
514 			else
515 				ATF_REQUIRE(child == wpid);
516 			if (ppl != NULL)
517 				ppl[1] = pl;
518 			fork_reported[1] = true;
519 		} else {
520 			ATF_REQUIRE(wpid == parent);
521 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
522 			ATF_REQUIRE(!fork_reported[0]);
523 			if (child == -1)
524 				child = pl.pl_child_pid;
525 			else
526 				ATF_REQUIRE(child == pl.pl_child_pid);
527 			if (ppl != NULL)
528 				ppl[0] = pl;
529 			fork_reported[0] = true;
530 		}
531 	}
532 
533 	return (child);
534 }
535 
536 /*
537  * Verify that a new child process is stopped after a followed fork and
538  * that the traced parent sees the exit of the child after the debugger
539  * when both processes remain attached to the debugger.
540  */
541 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
542 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
543 {
544 	pid_t children[2], fpid, wpid;
545 	int status;
546 
547 	ATF_REQUIRE((fpid = fork()) != -1);
548 	if (fpid == 0) {
549 		trace_me();
550 		follow_fork_parent(false);
551 	}
552 
553 	/* Parent process. */
554 	children[0] = fpid;
555 
556 	/* The first wait() should report the stop from SIGSTOP. */
557 	wpid = waitpid(children[0], &status, 0);
558 	ATF_REQUIRE(wpid == children[0]);
559 	ATF_REQUIRE(WIFSTOPPED(status));
560 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
561 
562 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
563 
564 	/* Continue the child ignoring the SIGSTOP. */
565 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
566 
567 	children[1] = handle_fork_events(children[0], NULL);
568 	ATF_REQUIRE(children[1] > 0);
569 
570 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
571 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
572 
573 	/*
574 	 * The child can't exit until the grandchild reports status, so the
575 	 * grandchild should report its exit first to the debugger.
576 	 */
577 	wpid = wait(&status);
578 	ATF_REQUIRE(wpid == children[1]);
579 	ATF_REQUIRE(WIFEXITED(status));
580 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
581 
582 	wpid = wait(&status);
583 	ATF_REQUIRE(wpid == children[0]);
584 	ATF_REQUIRE(WIFEXITED(status));
585 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
586 
587 	wpid = wait(&status);
588 	ATF_REQUIRE(wpid == -1);
589 	ATF_REQUIRE(errno == ECHILD);
590 }
591 
592 /*
593  * Verify that a new child process is stopped after a followed fork
594  * and that the traced parent sees the exit of the child when the new
595  * child process is detached after it reports its fork.
596  */
597 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
598 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
599 {
600 	pid_t children[2], fpid, wpid;
601 	int status;
602 
603 	ATF_REQUIRE((fpid = fork()) != -1);
604 	if (fpid == 0) {
605 		trace_me();
606 		follow_fork_parent(false);
607 	}
608 
609 	/* Parent process. */
610 	children[0] = fpid;
611 
612 	/* The first wait() should report the stop from SIGSTOP. */
613 	wpid = waitpid(children[0], &status, 0);
614 	ATF_REQUIRE(wpid == children[0]);
615 	ATF_REQUIRE(WIFSTOPPED(status));
616 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
617 
618 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
619 
620 	/* Continue the child ignoring the SIGSTOP. */
621 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
622 
623 	children[1] = handle_fork_events(children[0], NULL);
624 	ATF_REQUIRE(children[1] > 0);
625 
626 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
627 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
628 
629 	/*
630 	 * Should not see any status from the grandchild now, only the
631 	 * child.
632 	 */
633 	wpid = wait(&status);
634 	ATF_REQUIRE(wpid == children[0]);
635 	ATF_REQUIRE(WIFEXITED(status));
636 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
637 
638 	wpid = wait(&status);
639 	ATF_REQUIRE(wpid == -1);
640 	ATF_REQUIRE(errno == ECHILD);
641 }
642 
643 /*
644  * Verify that a new child process is stopped after a followed fork
645  * and that the traced parent sees the exit of the child when the
646  * traced parent is detached after the fork.
647  */
648 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
649 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
650 {
651 	pid_t children[2], fpid, wpid;
652 	int status;
653 
654 	ATF_REQUIRE((fpid = fork()) != -1);
655 	if (fpid == 0) {
656 		trace_me();
657 		follow_fork_parent(false);
658 	}
659 
660 	/* Parent process. */
661 	children[0] = fpid;
662 
663 	/* The first wait() should report the stop from SIGSTOP. */
664 	wpid = waitpid(children[0], &status, 0);
665 	ATF_REQUIRE(wpid == children[0]);
666 	ATF_REQUIRE(WIFSTOPPED(status));
667 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
668 
669 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
670 
671 	/* Continue the child ignoring the SIGSTOP. */
672 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
673 
674 	children[1] = handle_fork_events(children[0], NULL);
675 	ATF_REQUIRE(children[1] > 0);
676 
677 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
678 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
679 
680 	/*
681 	 * The child can't exit until the grandchild reports status, so the
682 	 * grandchild should report its exit first to the debugger.
683 	 *
684 	 * Even though the child process is detached, it is still a
685 	 * child of the debugger, so it will still report it's exit
686 	 * after the grandchild.
687 	 */
688 	wpid = wait(&status);
689 	ATF_REQUIRE(wpid == children[1]);
690 	ATF_REQUIRE(WIFEXITED(status));
691 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
692 
693 	wpid = wait(&status);
694 	ATF_REQUIRE(wpid == children[0]);
695 	ATF_REQUIRE(WIFEXITED(status));
696 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
697 
698 	wpid = wait(&status);
699 	ATF_REQUIRE(wpid == -1);
700 	ATF_REQUIRE(errno == ECHILD);
701 }
702 
703 static void
704 attach_fork_parent(int cpipe[2])
705 {
706 	pid_t fpid;
707 
708 	close(cpipe[0]);
709 
710 	/* Double-fork to disassociate from the debugger. */
711 	CHILD_REQUIRE((fpid = fork()) != -1);
712 	if (fpid != 0)
713 		_exit(3);
714 
715 	/* Send the pid of the disassociated child to the debugger. */
716 	fpid = getpid();
717 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
718 
719 	/* Wait for the debugger to attach. */
720 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
721 }
722 
723 /*
724  * Verify that a new child process is stopped after a followed fork and
725  * that the traced parent sees the exit of the child after the debugger
726  * when both processes remain attached to the debugger.  In this test
727  * the parent that forks is not a direct child of the debugger.
728  */
729 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
730 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
731 {
732 	pid_t children[2], fpid, wpid;
733 	int cpipe[2], status;
734 
735 	ATF_REQUIRE(pipe(cpipe) == 0);
736 	ATF_REQUIRE((fpid = fork()) != -1);
737 	if (fpid == 0) {
738 		attach_fork_parent(cpipe);
739 		follow_fork_parent(false);
740 	}
741 
742 	/* Parent process. */
743 	close(cpipe[1]);
744 
745 	/* Wait for the direct child to exit. */
746 	wpid = waitpid(fpid, &status, 0);
747 	ATF_REQUIRE(wpid == fpid);
748 	ATF_REQUIRE(WIFEXITED(status));
749 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
750 
751 	/* Read the pid of the fork parent. */
752 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
753 	    sizeof(children[0]));
754 
755 	/* Attach to the fork parent. */
756 	attach_child(children[0]);
757 
758 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
759 
760 	/* Continue the fork parent ignoring the SIGSTOP. */
761 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
762 
763 	/* Signal the fork parent to continue. */
764 	close(cpipe[0]);
765 
766 	children[1] = handle_fork_events(children[0], NULL);
767 	ATF_REQUIRE(children[1] > 0);
768 
769 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
770 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
771 
772 	/*
773 	 * The fork parent can't exit until the child reports status,
774 	 * so the child should report its exit first to the debugger.
775 	 */
776 	wpid = wait(&status);
777 	ATF_REQUIRE(wpid == children[1]);
778 	ATF_REQUIRE(WIFEXITED(status));
779 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
780 
781 	wpid = wait(&status);
782 	ATF_REQUIRE(wpid == children[0]);
783 	ATF_REQUIRE(WIFEXITED(status));
784 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
785 
786 	wpid = wait(&status);
787 	ATF_REQUIRE(wpid == -1);
788 	ATF_REQUIRE(errno == ECHILD);
789 }
790 
791 /*
792  * Verify that a new child process is stopped after a followed fork
793  * and that the traced parent sees the exit of the child when the new
794  * child process is detached after it reports its fork.  In this test
795  * the parent that forks is not a direct child of the debugger.
796  */
797 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
798 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
799 {
800 	pid_t children[2], fpid, wpid;
801 	int cpipe[2], status;
802 
803 	ATF_REQUIRE(pipe(cpipe) == 0);
804 	ATF_REQUIRE((fpid = fork()) != -1);
805 	if (fpid == 0) {
806 		attach_fork_parent(cpipe);
807 		follow_fork_parent(false);
808 	}
809 
810 	/* Parent process. */
811 	close(cpipe[1]);
812 
813 	/* Wait for the direct child to exit. */
814 	wpid = waitpid(fpid, &status, 0);
815 	ATF_REQUIRE(wpid == fpid);
816 	ATF_REQUIRE(WIFEXITED(status));
817 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
818 
819 	/* Read the pid of the fork parent. */
820 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
821 	    sizeof(children[0]));
822 
823 	/* Attach to the fork parent. */
824 	attach_child(children[0]);
825 
826 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
827 
828 	/* Continue the fork parent ignoring the SIGSTOP. */
829 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
830 
831 	/* Signal the fork parent to continue. */
832 	close(cpipe[0]);
833 
834 	children[1] = handle_fork_events(children[0], NULL);
835 	ATF_REQUIRE(children[1] > 0);
836 
837 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
838 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
839 
840 	/*
841 	 * Should not see any status from the child now, only the fork
842 	 * parent.
843 	 */
844 	wpid = wait(&status);
845 	ATF_REQUIRE(wpid == children[0]);
846 	ATF_REQUIRE(WIFEXITED(status));
847 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
848 
849 	wpid = wait(&status);
850 	ATF_REQUIRE(wpid == -1);
851 	ATF_REQUIRE(errno == ECHILD);
852 }
853 
854 /*
855  * Verify that a new child process is stopped after a followed fork
856  * and that the traced parent sees the exit of the child when the
857  * traced parent is detached after the fork.  In this test the parent
858  * that forks is not a direct child of the debugger.
859  */
860 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
861 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
862 {
863 	pid_t children[2], fpid, wpid;
864 	int cpipe[2], status;
865 
866 	ATF_REQUIRE(pipe(cpipe) == 0);
867 	ATF_REQUIRE((fpid = fork()) != -1);
868 	if (fpid == 0) {
869 		attach_fork_parent(cpipe);
870 		follow_fork_parent(false);
871 	}
872 
873 	/* Parent process. */
874 	close(cpipe[1]);
875 
876 	/* Wait for the direct child to exit. */
877 	wpid = waitpid(fpid, &status, 0);
878 	ATF_REQUIRE(wpid == fpid);
879 	ATF_REQUIRE(WIFEXITED(status));
880 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
881 
882 	/* Read the pid of the fork parent. */
883 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
884 	    sizeof(children[0]));
885 
886 	/* Attach to the fork parent. */
887 	attach_child(children[0]);
888 
889 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
890 
891 	/* Continue the fork parent ignoring the SIGSTOP. */
892 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
893 
894 	/* Signal the fork parent to continue. */
895 	close(cpipe[0]);
896 
897 	children[1] = handle_fork_events(children[0], NULL);
898 	ATF_REQUIRE(children[1] > 0);
899 
900 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
901 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
902 
903 	/*
904 	 * Should not see any status from the fork parent now, only
905 	 * the child.
906 	 */
907 	wpid = wait(&status);
908 	ATF_REQUIRE(wpid == children[1]);
909 	ATF_REQUIRE(WIFEXITED(status));
910 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
911 
912 	wpid = wait(&status);
913 	ATF_REQUIRE(wpid == -1);
914 	ATF_REQUIRE(errno == ECHILD);
915 }
916 
917 /*
918  * Verify that a child process does not see an unrelated debugger as its
919  * parent but sees its original parent process.
920  */
921 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
922 ATF_TC_BODY(ptrace__getppid, tc)
923 {
924 	pid_t child, debugger, ppid, wpid;
925 	int cpipe[2], dpipe[2], status;
926 	char c;
927 
928 	ATF_REQUIRE(pipe(cpipe) == 0);
929 	ATF_REQUIRE((child = fork()) != -1);
930 
931 	if (child == 0) {
932 		/* Child process. */
933 		close(cpipe[0]);
934 
935 		/* Wait for parent to be ready. */
936 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
937 
938 		/* Report the parent PID to the parent. */
939 		ppid = getppid();
940 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
941 		    sizeof(ppid));
942 
943 		_exit(1);
944 	}
945 	close(cpipe[1]);
946 
947 	ATF_REQUIRE(pipe(dpipe) == 0);
948 	ATF_REQUIRE((debugger = fork()) != -1);
949 
950 	if (debugger == 0) {
951 		/* Debugger process. */
952 		close(dpipe[0]);
953 
954 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
955 
956 		wpid = waitpid(child, &status, 0);
957 		CHILD_REQUIRE(wpid == child);
958 		CHILD_REQUIRE(WIFSTOPPED(status));
959 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
960 
961 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
962 
963 		/* Signal parent that debugger is attached. */
964 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
965 
966 		/* Wait for traced child to exit. */
967 		wpid = waitpid(child, &status, 0);
968 		CHILD_REQUIRE(wpid == child);
969 		CHILD_REQUIRE(WIFEXITED(status));
970 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
971 
972 		_exit(0);
973 	}
974 	close(dpipe[1]);
975 
976 	/* Parent process. */
977 
978 	/* Wait for the debugger to attach to the child. */
979 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
980 
981 	/* Release the child. */
982 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
983 
984 	/* Read the parent PID from the child. */
985 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
986 	close(cpipe[0]);
987 
988 	ATF_REQUIRE(ppid == getpid());
989 
990 	/* Wait for the debugger. */
991 	wpid = waitpid(debugger, &status, 0);
992 	ATF_REQUIRE(wpid == debugger);
993 	ATF_REQUIRE(WIFEXITED(status));
994 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
995 
996 	/* The child process should now be ready. */
997 	wpid = waitpid(child, &status, WNOHANG);
998 	ATF_REQUIRE(wpid == child);
999 	ATF_REQUIRE(WIFEXITED(status));
1000 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1001 }
1002 
1003 /*
1004  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1005  * child process created via fork() reports the correct value.
1006  */
1007 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
1008 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
1009 {
1010 	struct ptrace_lwpinfo pl[2];
1011 	pid_t children[2], fpid, wpid;
1012 	int status;
1013 
1014 	ATF_REQUIRE((fpid = fork()) != -1);
1015 	if (fpid == 0) {
1016 		trace_me();
1017 		follow_fork_parent(false);
1018 	}
1019 
1020 	/* Parent process. */
1021 	children[0] = fpid;
1022 
1023 	/* The first wait() should report the stop from SIGSTOP. */
1024 	wpid = waitpid(children[0], &status, 0);
1025 	ATF_REQUIRE(wpid == children[0]);
1026 	ATF_REQUIRE(WIFSTOPPED(status));
1027 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1028 
1029 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1030 
1031 	/* Continue the child ignoring the SIGSTOP. */
1032 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1033 
1034 	/* Wait for both halves of the fork event to get reported. */
1035 	children[1] = handle_fork_events(children[0], pl);
1036 	ATF_REQUIRE(children[1] > 0);
1037 
1038 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1039 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1040 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1041 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1042 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1043 
1044 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1045 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1046 
1047 	/*
1048 	 * The child can't exit until the grandchild reports status, so the
1049 	 * grandchild should report its exit first to the debugger.
1050 	 */
1051 	wpid = wait(&status);
1052 	ATF_REQUIRE(wpid == children[1]);
1053 	ATF_REQUIRE(WIFEXITED(status));
1054 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1055 
1056 	wpid = wait(&status);
1057 	ATF_REQUIRE(wpid == children[0]);
1058 	ATF_REQUIRE(WIFEXITED(status));
1059 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1060 
1061 	wpid = wait(&status);
1062 	ATF_REQUIRE(wpid == -1);
1063 	ATF_REQUIRE(errno == ECHILD);
1064 }
1065 
1066 /*
1067  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1068  * child process created via vfork() reports the correct value.
1069  */
1070 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1071 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1072 {
1073 	struct ptrace_lwpinfo pl[2];
1074 	pid_t children[2], fpid, wpid;
1075 	int status;
1076 
1077 	ATF_REQUIRE((fpid = fork()) != -1);
1078 	if (fpid == 0) {
1079 		trace_me();
1080 		follow_fork_parent(true);
1081 	}
1082 
1083 	/* Parent process. */
1084 	children[0] = fpid;
1085 
1086 	/* The first wait() should report the stop from SIGSTOP. */
1087 	wpid = waitpid(children[0], &status, 0);
1088 	ATF_REQUIRE(wpid == children[0]);
1089 	ATF_REQUIRE(WIFSTOPPED(status));
1090 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1091 
1092 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1093 
1094 	/* Continue the child ignoring the SIGSTOP. */
1095 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1096 
1097 	/* Wait for both halves of the fork event to get reported. */
1098 	children[1] = handle_fork_events(children[0], pl);
1099 	ATF_REQUIRE(children[1] > 0);
1100 
1101 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1102 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1103 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1104 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1105 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1106 
1107 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1108 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1109 
1110 	/*
1111 	 * The child can't exit until the grandchild reports status, so the
1112 	 * grandchild should report its exit first to the debugger.
1113 	 */
1114 	wpid = wait(&status);
1115 	ATF_REQUIRE(wpid == children[1]);
1116 	ATF_REQUIRE(WIFEXITED(status));
1117 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1118 
1119 	wpid = wait(&status);
1120 	ATF_REQUIRE(wpid == children[0]);
1121 	ATF_REQUIRE(WIFEXITED(status));
1122 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1123 
1124 	wpid = wait(&status);
1125 	ATF_REQUIRE(wpid == -1);
1126 	ATF_REQUIRE(errno == ECHILD);
1127 }
1128 
1129 static void *
1130 simple_thread(void *arg __unused)
1131 {
1132 
1133 	pthread_exit(NULL);
1134 }
1135 
1136 static __dead2 void
1137 simple_thread_main(void)
1138 {
1139 	pthread_t thread;
1140 
1141 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1142 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1143 	exit(1);
1144 }
1145 
1146 /*
1147  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1148  * thread reports the correct value.
1149  */
1150 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1151 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1152 {
1153 	struct ptrace_lwpinfo pl;
1154 	pid_t fpid, wpid;
1155 	lwpid_t mainlwp;
1156 	int status;
1157 
1158 	ATF_REQUIRE((fpid = fork()) != -1);
1159 	if (fpid == 0) {
1160 		trace_me();
1161 		simple_thread_main();
1162 	}
1163 
1164 	/* The first wait() should report the stop from SIGSTOP. */
1165 	wpid = waitpid(fpid, &status, 0);
1166 	ATF_REQUIRE(wpid == fpid);
1167 	ATF_REQUIRE(WIFSTOPPED(status));
1168 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1169 
1170 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1171 	    sizeof(pl)) != -1);
1172 	mainlwp = pl.pl_lwpid;
1173 
1174 	/*
1175 	 * Continue the child ignoring the SIGSTOP and tracing all
1176 	 * system call exits.
1177 	 */
1178 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1179 
1180 	/*
1181 	 * Wait for the new thread to arrive.  pthread_create() might
1182 	 * invoke any number of system calls.  For now we just wait
1183 	 * for the new thread to arrive and make sure it reports a
1184 	 * valid system call code.  If ptrace grows thread event
1185 	 * reporting then this test can be made more precise.
1186 	 */
1187 	for (;;) {
1188 		wpid = waitpid(fpid, &status, 0);
1189 		ATF_REQUIRE(wpid == fpid);
1190 		ATF_REQUIRE(WIFSTOPPED(status));
1191 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1192 
1193 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1194 		    sizeof(pl)) != -1);
1195 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1196 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1197 		if (pl.pl_lwpid != mainlwp)
1198 			/* New thread seen. */
1199 			break;
1200 
1201 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1202 	}
1203 
1204 	/* Wait for the child to exit. */
1205 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1206 	for (;;) {
1207 		wpid = waitpid(fpid, &status, 0);
1208 		ATF_REQUIRE(wpid == fpid);
1209 		if (WIFEXITED(status))
1210 			break;
1211 
1212 		ATF_REQUIRE(WIFSTOPPED(status));
1213 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1214 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1215 	}
1216 
1217 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1218 
1219 	wpid = wait(&status);
1220 	ATF_REQUIRE(wpid == -1);
1221 	ATF_REQUIRE(errno == ECHILD);
1222 }
1223 
1224 /*
1225  * Verify that the expected LWP events are reported for a child thread.
1226  */
1227 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1228 ATF_TC_BODY(ptrace__lwp_events, tc)
1229 {
1230 	struct ptrace_lwpinfo pl;
1231 	pid_t fpid, wpid;
1232 	lwpid_t lwps[2];
1233 	int status;
1234 
1235 	ATF_REQUIRE((fpid = fork()) != -1);
1236 	if (fpid == 0) {
1237 		trace_me();
1238 		simple_thread_main();
1239 	}
1240 
1241 	/* The first wait() should report the stop from SIGSTOP. */
1242 	wpid = waitpid(fpid, &status, 0);
1243 	ATF_REQUIRE(wpid == fpid);
1244 	ATF_REQUIRE(WIFSTOPPED(status));
1245 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1246 
1247 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1248 	    sizeof(pl)) != -1);
1249 	lwps[0] = pl.pl_lwpid;
1250 
1251 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1252 
1253 	/* Continue the child ignoring the SIGSTOP. */
1254 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1255 
1256 	/* The first event should be for the child thread's birth. */
1257 	wpid = waitpid(fpid, &status, 0);
1258 	ATF_REQUIRE(wpid == fpid);
1259 	ATF_REQUIRE(WIFSTOPPED(status));
1260 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1261 
1262 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1263 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1264 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1265 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1266 	lwps[1] = pl.pl_lwpid;
1267 
1268 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1269 
1270 	/* The next event should be for the child thread's death. */
1271 	wpid = waitpid(fpid, &status, 0);
1272 	ATF_REQUIRE(wpid == fpid);
1273 	ATF_REQUIRE(WIFSTOPPED(status));
1274 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1275 
1276 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1277 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1278 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1279 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1280 
1281 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1282 
1283 	/* The last event should be for the child process's exit. */
1284 	wpid = waitpid(fpid, &status, 0);
1285 	ATF_REQUIRE(WIFEXITED(status));
1286 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1287 
1288 	wpid = wait(&status);
1289 	ATF_REQUIRE(wpid == -1);
1290 	ATF_REQUIRE(errno == ECHILD);
1291 }
1292 
1293 static void *
1294 exec_thread(void *arg __unused)
1295 {
1296 
1297 	execl("/usr/bin/true", "true", NULL);
1298 	exit(127);
1299 }
1300 
1301 static __dead2 void
1302 exec_thread_main(void)
1303 {
1304 	pthread_t thread;
1305 
1306 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1307 	for (;;)
1308 		sleep(60);
1309 	exit(1);
1310 }
1311 
1312 /*
1313  * Verify that the expected LWP events are reported for a multithreaded
1314  * process that calls execve(2).
1315  */
1316 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1317 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1318 {
1319 	struct ptrace_lwpinfo pl;
1320 	pid_t fpid, wpid;
1321 	lwpid_t lwps[2];
1322 	int status;
1323 
1324 	ATF_REQUIRE((fpid = fork()) != -1);
1325 	if (fpid == 0) {
1326 		trace_me();
1327 		exec_thread_main();
1328 	}
1329 
1330 	/* The first wait() should report the stop from SIGSTOP. */
1331 	wpid = waitpid(fpid, &status, 0);
1332 	ATF_REQUIRE(wpid == fpid);
1333 	ATF_REQUIRE(WIFSTOPPED(status));
1334 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1335 
1336 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1337 	    sizeof(pl)) != -1);
1338 	lwps[0] = pl.pl_lwpid;
1339 
1340 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1341 
1342 	/* Continue the child ignoring the SIGSTOP. */
1343 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1344 
1345 	/* The first event should be for the child thread's birth. */
1346 	wpid = waitpid(fpid, &status, 0);
1347 	ATF_REQUIRE(wpid == fpid);
1348 	ATF_REQUIRE(WIFSTOPPED(status));
1349 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1350 
1351 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1352 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1353 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1354 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1355 	lwps[1] = pl.pl_lwpid;
1356 
1357 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1358 
1359 	/*
1360 	 * The next event should be for the main thread's death due to
1361 	 * single threading from execve().
1362 	 */
1363 	wpid = waitpid(fpid, &status, 0);
1364 	ATF_REQUIRE(wpid == fpid);
1365 	ATF_REQUIRE(WIFSTOPPED(status));
1366 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1367 
1368 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1369 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1370 	    (PL_FLAG_EXITED));
1371 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1372 
1373 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1374 
1375 	/* The next event should be for the child process's exec. */
1376 	wpid = waitpid(fpid, &status, 0);
1377 	ATF_REQUIRE(WIFSTOPPED(status));
1378 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1379 
1380 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1381 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1382 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1383 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1384 
1385 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1386 
1387 	/* The last event should be for the child process's exit. */
1388 	wpid = waitpid(fpid, &status, 0);
1389 	ATF_REQUIRE(WIFEXITED(status));
1390 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1391 
1392 	wpid = wait(&status);
1393 	ATF_REQUIRE(wpid == -1);
1394 	ATF_REQUIRE(errno == ECHILD);
1395 }
1396 
1397 static void
1398 handler(int sig __unused)
1399 {
1400 }
1401 
1402 static void
1403 signal_main(void)
1404 {
1405 
1406 	signal(SIGINFO, handler);
1407 	raise(SIGINFO);
1408 	exit(0);
1409 }
1410 
1411 /*
1412  * Verify that the expected ptrace event is reported for a signal.
1413  */
1414 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1415 ATF_TC_BODY(ptrace__siginfo, tc)
1416 {
1417 	struct ptrace_lwpinfo pl;
1418 	pid_t fpid, wpid;
1419 	int status;
1420 
1421 	ATF_REQUIRE((fpid = fork()) != -1);
1422 	if (fpid == 0) {
1423 		trace_me();
1424 		signal_main();
1425 	}
1426 
1427 	/* The first wait() should report the stop from SIGSTOP. */
1428 	wpid = waitpid(fpid, &status, 0);
1429 	ATF_REQUIRE(wpid == fpid);
1430 	ATF_REQUIRE(WIFSTOPPED(status));
1431 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1432 
1433 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1434 
1435 	/* The next event should be for the SIGINFO. */
1436 	wpid = waitpid(fpid, &status, 0);
1437 	ATF_REQUIRE(WIFSTOPPED(status));
1438 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1439 
1440 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1441 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1442 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1443 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1444 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1445 
1446 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1447 
1448 	/* The last event should be for the child process's exit. */
1449 	wpid = waitpid(fpid, &status, 0);
1450 	ATF_REQUIRE(WIFEXITED(status));
1451 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1452 
1453 	wpid = wait(&status);
1454 	ATF_REQUIRE(wpid == -1);
1455 	ATF_REQUIRE(errno == ECHILD);
1456 }
1457 
1458 /*
1459  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1460  */
1461 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1462 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1463 {
1464 	pid_t fpid, wpid;
1465 	int events, status;
1466 
1467 	ATF_REQUIRE((fpid = fork()) != -1);
1468 	if (fpid == 0) {
1469 		trace_me();
1470 		exec_thread(NULL);
1471 	}
1472 
1473 	/* The first wait() should report the stop from SIGSTOP. */
1474 	wpid = waitpid(fpid, &status, 0);
1475 	ATF_REQUIRE(wpid == fpid);
1476 	ATF_REQUIRE(WIFSTOPPED(status));
1477 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1478 
1479 	events = 0;
1480 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1481 	    sizeof(events)) == 0);
1482 
1483 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1484 
1485 	/* Should get one event at exit. */
1486 	wpid = waitpid(fpid, &status, 0);
1487 	ATF_REQUIRE(WIFEXITED(status));
1488 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1489 
1490 	wpid = wait(&status);
1491 	ATF_REQUIRE(wpid == -1);
1492 	ATF_REQUIRE(errno == ECHILD);
1493 }
1494 
1495 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1496 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1497 {
1498 	struct ptrace_lwpinfo pl;
1499 	pid_t fpid, wpid;
1500 	int events, status;
1501 
1502 	ATF_REQUIRE((fpid = fork()) != -1);
1503 	if (fpid == 0) {
1504 		trace_me();
1505 		exec_thread(NULL);
1506 	}
1507 
1508 	/* The first wait() should report the stop from SIGSTOP. */
1509 	wpid = waitpid(fpid, &status, 0);
1510 	ATF_REQUIRE(wpid == fpid);
1511 	ATF_REQUIRE(WIFSTOPPED(status));
1512 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1513 
1514 	events = PTRACE_EXEC;
1515 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1516 	    sizeof(events)) == 0);
1517 
1518 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1519 
1520 	/* The next event should be for the child process's exec. */
1521 	wpid = waitpid(fpid, &status, 0);
1522 	ATF_REQUIRE(WIFSTOPPED(status));
1523 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1524 
1525 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1526 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1527 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1528 
1529 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1530 
1531 	/* The last event should be for the child process's exit. */
1532 	wpid = waitpid(fpid, &status, 0);
1533 	ATF_REQUIRE(WIFEXITED(status));
1534 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1535 
1536 	wpid = wait(&status);
1537 	ATF_REQUIRE(wpid == -1);
1538 	ATF_REQUIRE(errno == ECHILD);
1539 }
1540 
1541 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1542 ATF_TC_BODY(ptrace__event_mask, tc)
1543 {
1544 	pid_t fpid, wpid;
1545 	int events, status;
1546 
1547 	ATF_REQUIRE((fpid = fork()) != -1);
1548 	if (fpid == 0) {
1549 		trace_me();
1550 		exit(0);
1551 	}
1552 
1553 	/* The first wait() should report the stop from SIGSTOP. */
1554 	wpid = waitpid(fpid, &status, 0);
1555 	ATF_REQUIRE(wpid == fpid);
1556 	ATF_REQUIRE(WIFSTOPPED(status));
1557 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1558 
1559 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1560 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1561 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1562 	    sizeof(events)) == 0);
1563 	ATF_REQUIRE(events & PTRACE_FORK);
1564 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1565 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1566 	    sizeof(events)) == 0);
1567 	ATF_REQUIRE(!(events & PTRACE_FORK));
1568 
1569 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1570 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1571 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1572 	    sizeof(events)) == 0);
1573 	ATF_REQUIRE(events & PTRACE_LWP);
1574 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1575 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1576 	    sizeof(events)) == 0);
1577 	ATF_REQUIRE(!(events & PTRACE_LWP));
1578 
1579 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1580 
1581 	/* Should get one event at exit. */
1582 	wpid = waitpid(fpid, &status, 0);
1583 	ATF_REQUIRE(WIFEXITED(status));
1584 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1585 
1586 	wpid = wait(&status);
1587 	ATF_REQUIRE(wpid == -1);
1588 	ATF_REQUIRE(errno == ECHILD);
1589 }
1590 
1591 /*
1592  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1593  */
1594 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1595 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1596 {
1597 	struct ptrace_lwpinfo pl;
1598 	pid_t fpid, wpid;
1599 	int events, status;
1600 
1601 	ATF_REQUIRE((fpid = fork()) != -1);
1602 	if (fpid == 0) {
1603 		trace_me();
1604 		follow_fork_parent(true);
1605 	}
1606 
1607 	/* The first wait() should report the stop from SIGSTOP. */
1608 	wpid = waitpid(fpid, &status, 0);
1609 	ATF_REQUIRE(wpid == fpid);
1610 	ATF_REQUIRE(WIFSTOPPED(status));
1611 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1612 
1613 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1614 	    sizeof(events)) == 0);
1615 	events |= PTRACE_VFORK;
1616 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1617 	    sizeof(events)) == 0);
1618 
1619 	/* Continue the child ignoring the SIGSTOP. */
1620 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1621 
1622 	/* The next event should report the end of the vfork. */
1623 	wpid = wait(&status);
1624 	ATF_REQUIRE(wpid == fpid);
1625 	ATF_REQUIRE(WIFSTOPPED(status));
1626 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1627 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1628 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1629 
1630 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1631 
1632 	wpid = wait(&status);
1633 	ATF_REQUIRE(wpid == fpid);
1634 	ATF_REQUIRE(WIFEXITED(status));
1635 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1636 
1637 	wpid = wait(&status);
1638 	ATF_REQUIRE(wpid == -1);
1639 	ATF_REQUIRE(errno == ECHILD);
1640 }
1641 
1642 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1643 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1644 {
1645 	struct ptrace_lwpinfo pl[2];
1646 	pid_t children[2], fpid, wpid;
1647 	int events, status;
1648 
1649 	ATF_REQUIRE((fpid = fork()) != -1);
1650 	if (fpid == 0) {
1651 		trace_me();
1652 		follow_fork_parent(true);
1653 	}
1654 
1655 	/* Parent process. */
1656 	children[0] = fpid;
1657 
1658 	/* The first wait() should report the stop from SIGSTOP. */
1659 	wpid = waitpid(children[0], &status, 0);
1660 	ATF_REQUIRE(wpid == children[0]);
1661 	ATF_REQUIRE(WIFSTOPPED(status));
1662 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1663 
1664 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1665 	    sizeof(events)) == 0);
1666 	events |= PTRACE_FORK | PTRACE_VFORK;
1667 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1668 	    sizeof(events)) == 0);
1669 
1670 	/* Continue the child ignoring the SIGSTOP. */
1671 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1672 
1673 	/* Wait for both halves of the fork event to get reported. */
1674 	children[1] = handle_fork_events(children[0], pl);
1675 	ATF_REQUIRE(children[1] > 0);
1676 
1677 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1678 
1679 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1680 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1681 
1682 	/*
1683 	 * The child can't exit until the grandchild reports status, so the
1684 	 * grandchild should report its exit first to the debugger.
1685 	 */
1686 	wpid = waitpid(children[1], &status, 0);
1687 	ATF_REQUIRE(wpid == children[1]);
1688 	ATF_REQUIRE(WIFEXITED(status));
1689 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1690 
1691 	/*
1692 	 * The child should report it's vfork() completion before it
1693 	 * exits.
1694 	 */
1695 	wpid = wait(&status);
1696 	ATF_REQUIRE(wpid == children[0]);
1697 	ATF_REQUIRE(WIFSTOPPED(status));
1698 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1699 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1700 	    -1);
1701 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1702 
1703 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1704 
1705 	wpid = wait(&status);
1706 	ATF_REQUIRE(wpid == children[0]);
1707 	ATF_REQUIRE(WIFEXITED(status));
1708 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1709 
1710 	wpid = wait(&status);
1711 	ATF_REQUIRE(wpid == -1);
1712 	ATF_REQUIRE(errno == ECHILD);
1713 }
1714 
1715 #ifdef HAVE_BREAKPOINT
1716 /*
1717  * Verify that no more events are reported after PT_KILL except for the
1718  * process exit when stopped due to a breakpoint trap.
1719  */
1720 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1721 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1722 {
1723 	pid_t fpid, wpid;
1724 	int status;
1725 
1726 	ATF_REQUIRE((fpid = fork()) != -1);
1727 	if (fpid == 0) {
1728 		trace_me();
1729 		breakpoint();
1730 		exit(1);
1731 	}
1732 
1733 	/* The first wait() should report the stop from SIGSTOP. */
1734 	wpid = waitpid(fpid, &status, 0);
1735 	ATF_REQUIRE(wpid == fpid);
1736 	ATF_REQUIRE(WIFSTOPPED(status));
1737 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1738 
1739 	/* Continue the child ignoring the SIGSTOP. */
1740 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1741 
1742 	/* The second wait() should report hitting the breakpoint. */
1743 	wpid = waitpid(fpid, &status, 0);
1744 	ATF_REQUIRE(wpid == fpid);
1745 	ATF_REQUIRE(WIFSTOPPED(status));
1746 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1747 
1748 	/* Kill the child process. */
1749 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1750 
1751 	/* The last wait() should report the SIGKILL. */
1752 	wpid = waitpid(fpid, &status, 0);
1753 	ATF_REQUIRE(wpid == fpid);
1754 	ATF_REQUIRE(WIFSIGNALED(status));
1755 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1756 
1757 	wpid = wait(&status);
1758 	ATF_REQUIRE(wpid == -1);
1759 	ATF_REQUIRE(errno == ECHILD);
1760 }
1761 #endif /* HAVE_BREAKPOINT */
1762 
1763 /*
1764  * Verify that no more events are reported after PT_KILL except for the
1765  * process exit when stopped inside of a system call.
1766  */
1767 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1768 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1769 {
1770 	struct ptrace_lwpinfo pl;
1771 	pid_t fpid, wpid;
1772 	int status;
1773 
1774 	ATF_REQUIRE((fpid = fork()) != -1);
1775 	if (fpid == 0) {
1776 		trace_me();
1777 		getpid();
1778 		exit(1);
1779 	}
1780 
1781 	/* The first wait() should report the stop from SIGSTOP. */
1782 	wpid = waitpid(fpid, &status, 0);
1783 	ATF_REQUIRE(wpid == fpid);
1784 	ATF_REQUIRE(WIFSTOPPED(status));
1785 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1786 
1787 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1788 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1789 
1790 	/* The second wait() should report a system call entry for getpid(). */
1791 	wpid = waitpid(fpid, &status, 0);
1792 	ATF_REQUIRE(wpid == fpid);
1793 	ATF_REQUIRE(WIFSTOPPED(status));
1794 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1795 
1796 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1797 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1798 
1799 	/* Kill the child process. */
1800 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1801 
1802 	/* The last wait() should report the SIGKILL. */
1803 	wpid = waitpid(fpid, &status, 0);
1804 	ATF_REQUIRE(wpid == fpid);
1805 	ATF_REQUIRE(WIFSIGNALED(status));
1806 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1807 
1808 	wpid = wait(&status);
1809 	ATF_REQUIRE(wpid == -1);
1810 	ATF_REQUIRE(errno == ECHILD);
1811 }
1812 
1813 /*
1814  * Verify that no more events are reported after PT_KILL except for the
1815  * process exit when killing a multithreaded process.
1816  */
1817 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1818 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1819 {
1820 	struct ptrace_lwpinfo pl;
1821 	pid_t fpid, wpid;
1822 	lwpid_t main_lwp;
1823 	int status;
1824 
1825 	ATF_REQUIRE((fpid = fork()) != -1);
1826 	if (fpid == 0) {
1827 		trace_me();
1828 		simple_thread_main();
1829 	}
1830 
1831 	/* The first wait() should report the stop from SIGSTOP. */
1832 	wpid = waitpid(fpid, &status, 0);
1833 	ATF_REQUIRE(wpid == fpid);
1834 	ATF_REQUIRE(WIFSTOPPED(status));
1835 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1836 
1837 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1838 	    sizeof(pl)) != -1);
1839 	main_lwp = pl.pl_lwpid;
1840 
1841 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1842 
1843 	/* Continue the child ignoring the SIGSTOP. */
1844 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1845 
1846 	/* The first event should be for the child thread's birth. */
1847 	wpid = waitpid(fpid, &status, 0);
1848 	ATF_REQUIRE(wpid == fpid);
1849 	ATF_REQUIRE(WIFSTOPPED(status));
1850 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1851 
1852 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1853 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1854 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1855 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1856 
1857 	/* Kill the child process. */
1858 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1859 
1860 	/* The last wait() should report the SIGKILL. */
1861 	wpid = waitpid(fpid, &status, 0);
1862 	ATF_REQUIRE(wpid == fpid);
1863 	ATF_REQUIRE(WIFSIGNALED(status));
1864 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1865 
1866 	wpid = wait(&status);
1867 	ATF_REQUIRE(wpid == -1);
1868 	ATF_REQUIRE(errno == ECHILD);
1869 }
1870 
1871 static void *
1872 mask_usr1_thread(void *arg)
1873 {
1874 	pthread_barrier_t *pbarrier;
1875 	sigset_t sigmask;
1876 
1877 	pbarrier = (pthread_barrier_t*)arg;
1878 
1879 	sigemptyset(&sigmask);
1880 	sigaddset(&sigmask, SIGUSR1);
1881 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1882 
1883 	/* Sync up with other thread after sigmask updated. */
1884 	pthread_barrier_wait(pbarrier);
1885 
1886 	for (;;)
1887 		sleep(60);
1888 
1889 	return (NULL);
1890 }
1891 
1892 /*
1893  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1894  * and prevents spurious stops due to those other signals.
1895  */
1896 ATF_TC(ptrace__PT_KILL_competing_signal);
1897 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1898 {
1899 
1900 	atf_tc_set_md_var(tc, "require.user", "root");
1901 }
1902 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1903 {
1904 	pid_t fpid, wpid;
1905 	int status;
1906 	cpuset_t setmask;
1907 	pthread_t t;
1908 	pthread_barrier_t barrier;
1909 	struct sched_param sched_param;
1910 
1911 	ATF_REQUIRE((fpid = fork()) != -1);
1912 	if (fpid == 0) {
1913 		/* Bind to one CPU so only one thread at a time will run. */
1914 		CPU_ZERO(&setmask);
1915 		CPU_SET(0, &setmask);
1916 		cpusetid_t setid;
1917 		CHILD_REQUIRE(cpuset(&setid) == 0);
1918 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1919 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1920 
1921 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1922 
1923 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1924 		    (void*)&barrier) == 0);
1925 
1926 		/*
1927 		 * Give the main thread higher priority. The test always
1928 		 * assumes that, if both threads are able to run, the main
1929 		 * thread runs first.
1930 		 */
1931 		sched_param.sched_priority =
1932 		    (sched_get_priority_max(SCHED_FIFO) +
1933 		    sched_get_priority_min(SCHED_FIFO)) / 2;
1934 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
1935 		    SCHED_FIFO, &sched_param) == 0);
1936 		sched_param.sched_priority -= RQ_PPQ;
1937 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
1938 		    &sched_param) == 0);
1939 
1940 		sigset_t sigmask;
1941 		sigemptyset(&sigmask);
1942 		sigaddset(&sigmask, SIGUSR2);
1943 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1944 
1945 		/* Sync up with other thread after sigmask updated. */
1946 		pthread_barrier_wait(&barrier);
1947 
1948 		trace_me();
1949 
1950 		for (;;)
1951 			sleep(60);
1952 
1953 		exit(1);
1954 	}
1955 
1956 	/* The first wait() should report the stop from SIGSTOP. */
1957 	wpid = waitpid(fpid, &status, 0);
1958 	ATF_REQUIRE(wpid == fpid);
1959 	ATF_REQUIRE(WIFSTOPPED(status));
1960 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1961 
1962 	/* Continue the child ignoring the SIGSTOP. */
1963 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1964 
1965 	/* Send a signal that only the second thread can handle. */
1966 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
1967 
1968 	/* The second wait() should report the SIGUSR2. */
1969 	wpid = waitpid(fpid, &status, 0);
1970 	ATF_REQUIRE(wpid == fpid);
1971 	ATF_REQUIRE(WIFSTOPPED(status));
1972 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
1973 
1974 	/* Send a signal that only the first thread can handle. */
1975 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
1976 
1977 	/* Replace the SIGUSR2 with a kill. */
1978 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1979 
1980 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
1981 	wpid = waitpid(fpid, &status, 0);
1982 	ATF_REQUIRE(wpid == fpid);
1983 	ATF_REQUIRE(WIFSIGNALED(status));
1984 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1985 
1986 	wpid = wait(&status);
1987 	ATF_REQUIRE(wpid == -1);
1988 	ATF_REQUIRE(errno == ECHILD);
1989 }
1990 
1991 /*
1992  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
1993  * and prevents spurious stops caused by those events.
1994  */
1995 ATF_TC(ptrace__PT_KILL_competing_stop);
1996 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
1997 {
1998 
1999 	atf_tc_set_md_var(tc, "require.user", "root");
2000 }
2001 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
2002 {
2003 	pid_t fpid, wpid;
2004 	int status;
2005 	cpuset_t setmask;
2006 	pthread_t t;
2007 	pthread_barrier_t barrier;
2008 	lwpid_t main_lwp;
2009 	struct ptrace_lwpinfo pl;
2010 	struct sched_param sched_param;
2011 
2012 	ATF_REQUIRE((fpid = fork()) != -1);
2013 	if (fpid == 0) {
2014 		trace_me();
2015 
2016 		/* Bind to one CPU so only one thread at a time will run. */
2017 		CPU_ZERO(&setmask);
2018 		CPU_SET(0, &setmask);
2019 		cpusetid_t setid;
2020 		CHILD_REQUIRE(cpuset(&setid) == 0);
2021 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2022 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2023 
2024 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2025 
2026 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2027 		    (void*)&barrier) == 0);
2028 
2029 		/*
2030 		 * Give the main thread higher priority. The test always
2031 		 * assumes that, if both threads are able to run, the main
2032 		 * thread runs first.
2033 		 */
2034 		sched_param.sched_priority =
2035 		    (sched_get_priority_max(SCHED_FIFO) +
2036 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2037 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2038 		    SCHED_FIFO, &sched_param) == 0);
2039 		sched_param.sched_priority -= RQ_PPQ;
2040 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2041 		    &sched_param) == 0);
2042 
2043 		sigset_t sigmask;
2044 		sigemptyset(&sigmask);
2045 		sigaddset(&sigmask, SIGUSR2);
2046 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2047 
2048 		/* Sync up with other thread after sigmask updated. */
2049 		pthread_barrier_wait(&barrier);
2050 
2051 		/* Sync up with the test before doing the getpid(). */
2052 		raise(SIGSTOP);
2053 
2054 		getpid();
2055 		exit(1);
2056 	}
2057 
2058 	/* The first wait() should report the stop from SIGSTOP. */
2059 	wpid = waitpid(fpid, &status, 0);
2060 	ATF_REQUIRE(wpid == fpid);
2061 	ATF_REQUIRE(WIFSTOPPED(status));
2062 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2063 
2064 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2065 	main_lwp = pl.pl_lwpid;
2066 
2067 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2068 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2069 
2070 	/*
2071 	 * Continue until child is done with setup, which is indicated with
2072 	 * SIGSTOP. Ignore system calls in the meantime.
2073 	 */
2074 	for (;;) {
2075 		wpid = waitpid(fpid, &status, 0);
2076 		ATF_REQUIRE(wpid == fpid);
2077 		ATF_REQUIRE(WIFSTOPPED(status));
2078 		if (WSTOPSIG(status) == SIGTRAP) {
2079 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2080 			    sizeof(pl)) != -1);
2081 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2082 		} else {
2083 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2084 			break;
2085 		}
2086 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2087 	}
2088 
2089 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2090 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2091 
2092 	wpid = waitpid(fpid, &status, 0);
2093 	ATF_REQUIRE(wpid == fpid);
2094 	ATF_REQUIRE(WIFSTOPPED(status));
2095 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2096 
2097 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2098 	    sizeof(pl)) != -1);
2099 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2100 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2101 	/* Prevent the main thread from hitting its syscall exit for now. */
2102 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2103 
2104 	/*
2105 	 * Proceed, allowing second thread to hit syscall exit for
2106 	 * pthread_barrier_wait().
2107 	 */
2108 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2109 
2110 	wpid = waitpid(fpid, &status, 0);
2111 	ATF_REQUIRE(wpid == fpid);
2112 	ATF_REQUIRE(WIFSTOPPED(status));
2113 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2114 
2115 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2116 	    sizeof(pl)) != -1);
2117 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2118 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2119 
2120 	/* Send a signal that only the second thread can handle. */
2121 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2122 
2123 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2124 
2125 	/* The next wait() should report the SIGUSR2. */
2126 	wpid = waitpid(fpid, &status, 0);
2127 	ATF_REQUIRE(wpid == fpid);
2128 	ATF_REQUIRE(WIFSTOPPED(status));
2129 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2130 
2131 	/* Allow the main thread to try to finish its system call. */
2132 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2133 
2134 	/*
2135 	 * At this point, the main thread is in the middle of a system call and
2136 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2137 	 * be replaced with a SIGKILL below. The main thread will get to run
2138 	 * first. It should notice the kill request (even though the signal
2139 	 * replacement occurred in the other thread) and exit accordingly.  It
2140 	 * should not stop for the system call exit event.
2141 	 */
2142 
2143 	/* Replace the SIGUSR2 with a kill. */
2144 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2145 
2146 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2147 	wpid = waitpid(fpid, &status, 0);
2148 	ATF_REQUIRE(wpid == fpid);
2149 	ATF_REQUIRE(WIFSIGNALED(status));
2150 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2151 
2152 	wpid = wait(&status);
2153 	ATF_REQUIRE(wpid == -1);
2154 	ATF_REQUIRE(errno == ECHILD);
2155 }
2156 
2157 static void
2158 sigusr1_handler(int sig)
2159 {
2160 
2161 	CHILD_REQUIRE(sig == SIGUSR1);
2162 	_exit(2);
2163 }
2164 
2165 /*
2166  * Verify that even if the signal queue is full for a child process,
2167  * a PT_KILL will kill the process.
2168  */
2169 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2170 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2171 {
2172 	pid_t fpid, wpid;
2173 	int status;
2174 	int max_pending_per_proc;
2175 	size_t len;
2176 	int i;
2177 
2178 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2179 
2180 	ATF_REQUIRE((fpid = fork()) != -1);
2181 	if (fpid == 0) {
2182 		trace_me();
2183 		exit(1);
2184 	}
2185 
2186 	/* The first wait() should report the stop from SIGSTOP. */
2187 	wpid = waitpid(fpid, &status, 0);
2188 	ATF_REQUIRE(wpid == fpid);
2189 	ATF_REQUIRE(WIFSTOPPED(status));
2190 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2191 
2192 	len = sizeof(max_pending_per_proc);
2193 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2194 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2195 
2196 	/* Fill the signal queue. */
2197 	for (i = 0; i < max_pending_per_proc; ++i)
2198 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2199 
2200 	/* Kill the child process. */
2201 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2202 
2203 	/* The last wait() should report the SIGKILL. */
2204 	wpid = waitpid(fpid, &status, 0);
2205 	ATF_REQUIRE(wpid == fpid);
2206 	ATF_REQUIRE(WIFSIGNALED(status));
2207 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2208 
2209 	wpid = wait(&status);
2210 	ATF_REQUIRE(wpid == -1);
2211 	ATF_REQUIRE(errno == ECHILD);
2212 }
2213 
2214 /*
2215  * Verify that when stopped at a system call entry, a signal can be
2216  * requested with PT_CONTINUE which will be delivered once the system
2217  * call is complete.
2218  */
2219 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2220 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2221 {
2222 	struct ptrace_lwpinfo pl;
2223 	pid_t fpid, wpid;
2224 	int status;
2225 
2226 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2227 
2228 	ATF_REQUIRE((fpid = fork()) != -1);
2229 	if (fpid == 0) {
2230 		trace_me();
2231 		getpid();
2232 		exit(1);
2233 	}
2234 
2235 	/* The first wait() should report the stop from SIGSTOP. */
2236 	wpid = waitpid(fpid, &status, 0);
2237 	ATF_REQUIRE(wpid == fpid);
2238 	ATF_REQUIRE(WIFSTOPPED(status));
2239 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2240 
2241 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2242 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2243 
2244 	/* The second wait() should report a system call entry for getpid(). */
2245 	wpid = waitpid(fpid, &status, 0);
2246 	ATF_REQUIRE(wpid == fpid);
2247 	ATF_REQUIRE(WIFSTOPPED(status));
2248 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2249 
2250 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2251 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2252 
2253 	/* Continue the child process with a signal. */
2254 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2255 
2256 	for (;;) {
2257 		/*
2258 		 * The last wait() should report exit 2, i.e., a normal _exit
2259 		 * from the signal handler. In the meantime, catch and proceed
2260 		 * past any syscall stops.
2261 		 */
2262 		wpid = waitpid(fpid, &status, 0);
2263 		ATF_REQUIRE(wpid == fpid);
2264 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2265 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2266 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2267 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2268 		} else {
2269 			ATF_REQUIRE(WIFEXITED(status));
2270 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2271 			break;
2272 		}
2273 	}
2274 
2275 	wpid = wait(&status);
2276 	ATF_REQUIRE(wpid == -1);
2277 	ATF_REQUIRE(errno == ECHILD);
2278 }
2279 
2280 static void
2281 sigusr1_counting_handler(int sig)
2282 {
2283 	static int counter = 0;
2284 
2285 	CHILD_REQUIRE(sig == SIGUSR1);
2286 	counter++;
2287 	if (counter == 2)
2288 		_exit(2);
2289 }
2290 
2291 /*
2292  * Verify that, when continuing from a stop at system call entry and exit,
2293  * a signal can be requested from both stops, and both will be delivered when
2294  * the system call is complete.
2295  */
2296 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2297 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2298 {
2299 	struct ptrace_lwpinfo pl;
2300 	pid_t fpid, wpid;
2301 	int status;
2302 
2303 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2304 
2305 	ATF_REQUIRE((fpid = fork()) != -1);
2306 	if (fpid == 0) {
2307 		trace_me();
2308 		getpid();
2309 		exit(1);
2310 	}
2311 
2312 	/* The first wait() should report the stop from SIGSTOP. */
2313 	wpid = waitpid(fpid, &status, 0);
2314 	ATF_REQUIRE(wpid == fpid);
2315 	ATF_REQUIRE(WIFSTOPPED(status));
2316 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2317 
2318 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2319 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2320 
2321 	/* The second wait() should report a system call entry for getpid(). */
2322 	wpid = waitpid(fpid, &status, 0);
2323 	ATF_REQUIRE(wpid == fpid);
2324 	ATF_REQUIRE(WIFSTOPPED(status));
2325 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2326 
2327 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2328 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2329 
2330 	/* Continue the child process with a signal. */
2331 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2332 
2333 	/* The third wait() should report a system call exit for getpid(). */
2334 	wpid = waitpid(fpid, &status, 0);
2335 	ATF_REQUIRE(wpid == fpid);
2336 	ATF_REQUIRE(WIFSTOPPED(status));
2337 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2338 
2339 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2340 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2341 
2342 	/* Continue the child process with a signal. */
2343 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2344 
2345 	for (;;) {
2346 		/*
2347 		 * The last wait() should report exit 2, i.e., a normal _exit
2348 		 * from the signal handler. In the meantime, catch and proceed
2349 		 * past any syscall stops.
2350 		 */
2351 		wpid = waitpid(fpid, &status, 0);
2352 		ATF_REQUIRE(wpid == fpid);
2353 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2354 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2355 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2356 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2357 		} else {
2358 			ATF_REQUIRE(WIFEXITED(status));
2359 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2360 			break;
2361 		}
2362 	}
2363 
2364 	wpid = wait(&status);
2365 	ATF_REQUIRE(wpid == -1);
2366 	ATF_REQUIRE(errno == ECHILD);
2367 }
2368 
2369 /*
2370  * Verify that even if the signal queue is full for a child process,
2371  * a PT_CONTINUE with a signal will not result in loss of that signal.
2372  */
2373 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2374 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2375 {
2376 	pid_t fpid, wpid;
2377 	int status;
2378 	int max_pending_per_proc;
2379 	size_t len;
2380 	int i;
2381 
2382 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2383 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2384 
2385 	ATF_REQUIRE((fpid = fork()) != -1);
2386 	if (fpid == 0) {
2387 		trace_me();
2388 		exit(1);
2389 	}
2390 
2391 	/* The first wait() should report the stop from SIGSTOP. */
2392 	wpid = waitpid(fpid, &status, 0);
2393 	ATF_REQUIRE(wpid == fpid);
2394 	ATF_REQUIRE(WIFSTOPPED(status));
2395 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2396 
2397 	len = sizeof(max_pending_per_proc);
2398 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2399 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2400 
2401 	/* Fill the signal queue. */
2402 	for (i = 0; i < max_pending_per_proc; ++i)
2403 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2404 
2405 	/* Continue with signal. */
2406 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2407 
2408 	for (;;) {
2409 		wpid = waitpid(fpid, &status, 0);
2410 		ATF_REQUIRE(wpid == fpid);
2411 		if (WIFSTOPPED(status)) {
2412 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2413 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2414 		} else {
2415 			/*
2416 			 * The last wait() should report normal _exit from the
2417 			 * SIGUSR1 handler.
2418 			 */
2419 			ATF_REQUIRE(WIFEXITED(status));
2420 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2421 			break;
2422 		}
2423 	}
2424 
2425 	wpid = wait(&status);
2426 	ATF_REQUIRE(wpid == -1);
2427 	ATF_REQUIRE(errno == ECHILD);
2428 }
2429 
2430 static sem_t sigusr1_sem;
2431 static int got_usr1;
2432 
2433 static void
2434 sigusr1_sempost_handler(int sig __unused)
2435 {
2436 
2437 	got_usr1++;
2438 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2439 }
2440 
2441 /*
2442  * Verify that even if the signal queue is full for a child process,
2443  * and the signal is masked, a PT_CONTINUE with a signal will not
2444  * result in loss of that signal.
2445  */
2446 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
2447 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue, tc)
2448 {
2449 	struct ptrace_lwpinfo pl;
2450 	pid_t fpid, wpid;
2451 	int status, err;
2452 	int max_pending_per_proc;
2453 	size_t len;
2454 	int i;
2455 	sigset_t sigmask;
2456 
2457 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2458 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2459 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2460 
2461 	got_usr1 = 0;
2462 	ATF_REQUIRE((fpid = fork()) != -1);
2463 	if (fpid == 0) {
2464 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2465 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2466 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2467 
2468 		trace_me();
2469 		CHILD_REQUIRE(got_usr1 == 0);
2470 
2471 		/* Allow the pending SIGUSR1 in now. */
2472 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2473 		/* Wait to receive the SIGUSR1. */
2474 		do {
2475 			err = sem_wait(&sigusr1_sem);
2476 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2477 		} while (err != 0 && errno == EINTR);
2478 		CHILD_REQUIRE(got_usr1 == 1);
2479 		exit(1);
2480 	}
2481 
2482 	/* The first wait() should report the stop from SIGSTOP. */
2483 	wpid = waitpid(fpid, &status, 0);
2484 	ATF_REQUIRE(wpid == fpid);
2485 	ATF_REQUIRE(WIFSTOPPED(status));
2486 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2487 
2488 	len = sizeof(max_pending_per_proc);
2489 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2490 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2491 
2492 	/* Fill the signal queue. */
2493 	for (i = 0; i < max_pending_per_proc; ++i)
2494 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2495 
2496 	/* Continue with signal. */
2497 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2498 
2499 	/* Collect and ignore all of the SIGUSR2. */
2500 	for (i = 0; i < max_pending_per_proc; ++i) {
2501 		wpid = waitpid(fpid, &status, 0);
2502 		ATF_REQUIRE(wpid == fpid);
2503 		ATF_REQUIRE(WIFSTOPPED(status));
2504 		ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2505 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2506 	}
2507 
2508 	/* Now our PT_CONTINUE'd SIGUSR1 should cause a stop after unmask. */
2509 	wpid = waitpid(fpid, &status, 0);
2510 	ATF_REQUIRE(wpid == fpid);
2511 	ATF_REQUIRE(WIFSTOPPED(status));
2512 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2513 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2514 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2515 
2516 	/* Continue the child, ignoring the SIGUSR1. */
2517 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2518 
2519 	/* The last wait() should report exit after receiving SIGUSR1. */
2520 	wpid = waitpid(fpid, &status, 0);
2521 	ATF_REQUIRE(wpid == fpid);
2522 	ATF_REQUIRE(WIFEXITED(status));
2523 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2524 
2525 	wpid = wait(&status);
2526 	ATF_REQUIRE(wpid == -1);
2527 	ATF_REQUIRE(errno == ECHILD);
2528 }
2529 
2530 /*
2531  * Verify that, after stopping due to a signal, that signal can be
2532  * replaced with another signal.
2533  */
2534 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2535 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2536 {
2537 	struct ptrace_lwpinfo pl;
2538 	pid_t fpid, wpid;
2539 	int status;
2540 
2541 	ATF_REQUIRE((fpid = fork()) != -1);
2542 	if (fpid == 0) {
2543 		trace_me();
2544 		sleep(20);
2545 		exit(1);
2546 	}
2547 
2548 	/* The first wait() should report the stop from SIGSTOP. */
2549 	wpid = waitpid(fpid, &status, 0);
2550 	ATF_REQUIRE(wpid == fpid);
2551 	ATF_REQUIRE(WIFSTOPPED(status));
2552 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2553 
2554 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2555 
2556 	/* Send a signal without ptrace. */
2557 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2558 
2559 	/* The second wait() should report a SIGINT was received. */
2560 	wpid = waitpid(fpid, &status, 0);
2561 	ATF_REQUIRE(wpid == fpid);
2562 	ATF_REQUIRE(WIFSTOPPED(status));
2563 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2564 
2565 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2566 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2567 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2568 
2569 	/* Continue the child process with a different signal. */
2570 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2571 
2572 	/*
2573 	 * The last wait() should report having died due to the new
2574 	 * signal, SIGTERM.
2575 	 */
2576 	wpid = waitpid(fpid, &status, 0);
2577 	ATF_REQUIRE(wpid == fpid);
2578 	ATF_REQUIRE(WIFSIGNALED(status));
2579 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2580 
2581 	wpid = wait(&status);
2582 	ATF_REQUIRE(wpid == -1);
2583 	ATF_REQUIRE(errno == ECHILD);
2584 }
2585 
2586 /*
2587  * Verify that a signal can be passed through to the child even when there
2588  * was no true signal originally. Such cases arise when a SIGTRAP is
2589  * invented for e.g, system call stops.
2590  */
2591 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2592 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2593 {
2594 	struct ptrace_lwpinfo pl;
2595 	struct rlimit rl;
2596 	pid_t fpid, wpid;
2597 	int status;
2598 
2599 	ATF_REQUIRE((fpid = fork()) != -1);
2600 	if (fpid == 0) {
2601 		trace_me();
2602 		/* SIGTRAP expected to cause exit on syscall entry. */
2603 		rl.rlim_cur = rl.rlim_max = 0;
2604 		ATF_REQUIRE(setrlimit(RLIMIT_CORE, &rl) == 0);
2605 		getpid();
2606 		exit(1);
2607 	}
2608 
2609 	/* The first wait() should report the stop from SIGSTOP. */
2610 	wpid = waitpid(fpid, &status, 0);
2611 	ATF_REQUIRE(wpid == fpid);
2612 	ATF_REQUIRE(WIFSTOPPED(status));
2613 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2614 
2615 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2616 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2617 
2618 	/* The second wait() should report a system call entry for getpid(). */
2619 	wpid = waitpid(fpid, &status, 0);
2620 	ATF_REQUIRE(wpid == fpid);
2621 	ATF_REQUIRE(WIFSTOPPED(status));
2622 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2623 
2624 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2625 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2626 
2627 	/* Continue the child process with a SIGTRAP. */
2628 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2629 
2630 	for (;;) {
2631 		/*
2632 		 * The last wait() should report exit due to SIGTRAP.  In the
2633 		 * meantime, catch and proceed past any syscall stops.
2634 		 */
2635 		wpid = waitpid(fpid, &status, 0);
2636 		ATF_REQUIRE(wpid == fpid);
2637 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2638 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2639 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2640 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2641 		} else {
2642 			ATF_REQUIRE(WIFSIGNALED(status));
2643 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2644 			break;
2645 		}
2646 	}
2647 
2648 	wpid = wait(&status);
2649 	ATF_REQUIRE(wpid == -1);
2650 	ATF_REQUIRE(errno == ECHILD);
2651 
2652 }
2653 
2654 /*
2655  * A mixed bag PT_CONTINUE with signal test.
2656  */
2657 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2658 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2659 {
2660 	struct ptrace_lwpinfo pl;
2661 	pid_t fpid, wpid;
2662 	int status;
2663 
2664 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2665 
2666 	ATF_REQUIRE((fpid = fork()) != -1);
2667 	if (fpid == 0) {
2668 		trace_me();
2669 		getpid();
2670 		exit(1);
2671 	}
2672 
2673 	/* The first wait() should report the stop from SIGSTOP. */
2674 	wpid = waitpid(fpid, &status, 0);
2675 	ATF_REQUIRE(wpid == fpid);
2676 	ATF_REQUIRE(WIFSTOPPED(status));
2677 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2678 
2679 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2680 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2681 
2682 	/* The second wait() should report a system call entry for getpid(). */
2683 	wpid = waitpid(fpid, &status, 0);
2684 	ATF_REQUIRE(wpid == fpid);
2685 	ATF_REQUIRE(WIFSTOPPED(status));
2686 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2687 
2688 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2689 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2690 
2691 	/* Continue with the first SIGUSR1. */
2692 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2693 
2694 	/* The next wait() should report a system call exit for getpid(). */
2695 	wpid = waitpid(fpid, &status, 0);
2696 	ATF_REQUIRE(wpid == fpid);
2697 	ATF_REQUIRE(WIFSTOPPED(status));
2698 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2699 
2700 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2701 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2702 
2703 	/* Send an ABRT without ptrace. */
2704 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2705 
2706 	/* Continue normally. */
2707 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2708 
2709 	/* The next wait() should report the SIGABRT. */
2710 	wpid = waitpid(fpid, &status, 0);
2711 	ATF_REQUIRE(wpid == fpid);
2712 	ATF_REQUIRE(WIFSTOPPED(status));
2713 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2714 
2715 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2716 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2717 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2718 
2719 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2720 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2721 
2722 	for (;;) {
2723 		/*
2724 		 * The last wait() should report exit 2, i.e., a normal _exit
2725 		 * from the signal handler. In the meantime, catch and proceed
2726 		 * past any syscall stops.
2727 		 */
2728 		wpid = waitpid(fpid, &status, 0);
2729 		ATF_REQUIRE(wpid == fpid);
2730 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2731 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2732 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2733 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2734 		} else {
2735 			ATF_REQUIRE(WIFEXITED(status));
2736 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2737 			break;
2738 		}
2739 	}
2740 
2741 	wpid = wait(&status);
2742 	ATF_REQUIRE(wpid == -1);
2743 	ATF_REQUIRE(errno == ECHILD);
2744 
2745 }
2746 
2747 /*
2748  * Verify a signal delivered by ptrace is noticed by kevent(2).
2749  */
2750 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2751 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2752 {
2753 	pid_t fpid, wpid;
2754 	int status, kq, nevents;
2755 	struct kevent kev;
2756 
2757 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2758 
2759 	ATF_REQUIRE((fpid = fork()) != -1);
2760 	if (fpid == 0) {
2761 		CHILD_REQUIRE((kq = kqueue()) > 0);
2762 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2763 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2764 
2765 		trace_me();
2766 
2767 		for (;;) {
2768 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2769 			if (nevents == -1 && errno == EINTR)
2770 				continue;
2771 			CHILD_REQUIRE(nevents > 0);
2772 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2773 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2774 			break;
2775 		}
2776 
2777 		exit(1);
2778 	}
2779 
2780 	/* The first wait() should report the stop from SIGSTOP. */
2781 	wpid = waitpid(fpid, &status, 0);
2782 	ATF_REQUIRE(wpid == fpid);
2783 	ATF_REQUIRE(WIFSTOPPED(status));
2784 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2785 
2786 	/* Continue with the SIGUSR1. */
2787 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2788 
2789 	/*
2790 	 * The last wait() should report normal exit with code 1.
2791 	 */
2792 	wpid = waitpid(fpid, &status, 0);
2793 	ATF_REQUIRE(wpid == fpid);
2794 	ATF_REQUIRE(WIFEXITED(status));
2795 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2796 
2797 	wpid = wait(&status);
2798 	ATF_REQUIRE(wpid == -1);
2799 	ATF_REQUIRE(errno == ECHILD);
2800 }
2801 
2802 static void *
2803 signal_thread(void *arg)
2804 {
2805 	int err;
2806 	sigset_t sigmask;
2807 
2808 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2809 
2810 	/* Wait for this thread to receive a SIGUSR1. */
2811 	do {
2812 		err = sem_wait(&sigusr1_sem);
2813 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2814 	} while (err != 0 && errno == EINTR);
2815 
2816 	/* Free our companion thread from the barrier. */
2817 	pthread_barrier_wait(pbarrier);
2818 
2819 	/*
2820 	 * Swap ignore duties; the next SIGUSR1 should go to the
2821 	 * other thread.
2822 	 */
2823 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2824 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2825 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2826 
2827 	/* Sync up threads after swapping signal masks. */
2828 	pthread_barrier_wait(pbarrier);
2829 
2830 	/* Wait until our companion has received its SIGUSR1. */
2831 	pthread_barrier_wait(pbarrier);
2832 
2833 	return (NULL);
2834 }
2835 
2836 /*
2837  * Verify that a traced process with blocked signal received the
2838  * signal from kill() once unmasked.
2839  */
2840 ATF_TC_WITHOUT_HEAD(ptrace__killed_with_sigmask);
2841 ATF_TC_BODY(ptrace__killed_with_sigmask, tc)
2842 {
2843 	struct ptrace_lwpinfo pl;
2844 	pid_t fpid, wpid;
2845 	int status, err;
2846 	sigset_t sigmask;
2847 
2848 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2849 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2850 	got_usr1 = 0;
2851 
2852 	ATF_REQUIRE((fpid = fork()) != -1);
2853 	if (fpid == 0) {
2854 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2855 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2856 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2857 
2858 		trace_me();
2859 		CHILD_REQUIRE(got_usr1 == 0);
2860 
2861 		/* Allow the pending SIGUSR1 in now. */
2862 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2863 		/* Wait to receive a SIGUSR1. */
2864 		do {
2865 			err = sem_wait(&sigusr1_sem);
2866 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2867 		} while (err != 0 && errno == EINTR);
2868 		CHILD_REQUIRE(got_usr1 == 1);
2869 		exit(1);
2870 	}
2871 
2872 	/* The first wait() should report the stop from SIGSTOP. */
2873 	wpid = waitpid(fpid, &status, 0);
2874 	ATF_REQUIRE(wpid == fpid);
2875 	ATF_REQUIRE(WIFSTOPPED(status));
2876 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2877 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2878 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2879 
2880 	/* Send blocked SIGUSR1 which should cause a stop. */
2881 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2882 
2883 	/* Continue the child ignoring the SIGSTOP. */
2884 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2885 
2886 	/* The next wait() should report the kill(SIGUSR1) was received. */
2887 	wpid = waitpid(fpid, &status, 0);
2888 	ATF_REQUIRE(wpid == fpid);
2889 	ATF_REQUIRE(WIFSTOPPED(status));
2890 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2891 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2892 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2893 
2894 	/* Continue the child, allowing in the SIGUSR1. */
2895 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2896 
2897 	/* The last wait() should report normal exit with code 1. */
2898 	wpid = waitpid(fpid, &status, 0);
2899 	ATF_REQUIRE(wpid == fpid);
2900 	ATF_REQUIRE(WIFEXITED(status));
2901 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2902 
2903 	wpid = wait(&status);
2904 	ATF_REQUIRE(wpid == -1);
2905 	ATF_REQUIRE(errno == ECHILD);
2906 }
2907 
2908 /*
2909  * Verify that a traced process with blocked signal received the
2910  * signal from PT_CONTINUE once unmasked.
2911  */
2912 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigmask);
2913 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigmask, tc)
2914 {
2915 	struct ptrace_lwpinfo pl;
2916 	pid_t fpid, wpid;
2917 	int status, err;
2918 	sigset_t sigmask;
2919 
2920 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2921 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2922 	got_usr1 = 0;
2923 
2924 	ATF_REQUIRE((fpid = fork()) != -1);
2925 	if (fpid == 0) {
2926 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2927 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2928 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2929 
2930 		trace_me();
2931 		CHILD_REQUIRE(got_usr1 == 0);
2932 
2933 		/* Allow the pending SIGUSR1 in now. */
2934 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2935 		/* Wait to receive a SIGUSR1. */
2936 		do {
2937 			err = sem_wait(&sigusr1_sem);
2938 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2939 		} while (err != 0 && errno == EINTR);
2940 
2941 		CHILD_REQUIRE(got_usr1 == 1);
2942 		exit(1);
2943 	}
2944 
2945 	/* The first wait() should report the stop from SIGSTOP. */
2946 	wpid = waitpid(fpid, &status, 0);
2947 	ATF_REQUIRE(wpid == fpid);
2948 	ATF_REQUIRE(WIFSTOPPED(status));
2949 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2950 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2951 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2952 
2953 	/* Continue the child replacing SIGSTOP with SIGUSR1. */
2954 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2955 
2956 	/* The next wait() should report the SIGUSR1 was received. */
2957 	wpid = waitpid(fpid, &status, 0);
2958 	ATF_REQUIRE(wpid == fpid);
2959 	ATF_REQUIRE(WIFSTOPPED(status));
2960 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2961 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2962 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2963 
2964 	/* Continue the child, ignoring the SIGUSR1. */
2965 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2966 
2967 	/* The last wait() should report normal exit with code 1. */
2968 	wpid = waitpid(fpid, &status, 0);
2969 	ATF_REQUIRE(wpid == fpid);
2970 	ATF_REQUIRE(WIFEXITED(status));
2971 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2972 
2973 	wpid = wait(&status);
2974 	ATF_REQUIRE(wpid == -1);
2975 	ATF_REQUIRE(errno == ECHILD);
2976 }
2977 
2978 /*
2979  * Verify that if ptrace stops due to a signal but continues with
2980  * a different signal that the new signal is routed to a thread
2981  * that can accept it, and that the thread is awakened by the signal
2982  * in a timely manner.
2983  */
2984 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
2985 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
2986 {
2987 	pid_t fpid, wpid;
2988 	int status, err;
2989 	pthread_t t;
2990 	sigset_t sigmask;
2991 	pthread_barrier_t barrier;
2992 
2993 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2994 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2995 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2996 
2997 	ATF_REQUIRE((fpid = fork()) != -1);
2998 	if (fpid == 0) {
2999 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
3000 
3001 		/* The other thread should receive the first SIGUSR1. */
3002 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
3003 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
3004 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
3005 
3006 		trace_me();
3007 
3008 		/* Wait until other thread has received its SIGUSR1. */
3009 		pthread_barrier_wait(&barrier);
3010 
3011 		/*
3012 		 * Swap ignore duties; the next SIGUSR1 should go to this
3013 		 * thread.
3014 		 */
3015 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3016 
3017 		/* Sync up threads after swapping signal masks. */
3018 		pthread_barrier_wait(&barrier);
3019 
3020 		/*
3021 		 * Sync up with test code; we're ready for the next SIGUSR1
3022 		 * now.
3023 		 */
3024 		raise(SIGSTOP);
3025 
3026 		/* Wait for this thread to receive a SIGUSR1. */
3027 		do {
3028 			err = sem_wait(&sigusr1_sem);
3029 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3030 		} while (err != 0 && errno == EINTR);
3031 
3032 		/* Free the other thread from the barrier. */
3033 		pthread_barrier_wait(&barrier);
3034 
3035 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
3036 
3037 		exit(1);
3038 	}
3039 
3040 	/* The first wait() should report the stop from SIGSTOP. */
3041 	wpid = waitpid(fpid, &status, 0);
3042 	ATF_REQUIRE(wpid == fpid);
3043 	ATF_REQUIRE(WIFSTOPPED(status));
3044 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3045 
3046 	/* Continue the child ignoring the SIGSTOP. */
3047 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3048 
3049 	/*
3050 	 * Send a signal without ptrace that either thread will accept (USR2,
3051 	 * in this case).
3052 	 */
3053 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3054 
3055 	/* The second wait() should report a SIGUSR2 was received. */
3056 	wpid = waitpid(fpid, &status, 0);
3057 	ATF_REQUIRE(wpid == fpid);
3058 	ATF_REQUIRE(WIFSTOPPED(status));
3059 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3060 
3061 	/* Continue the child, changing the signal to USR1. */
3062 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3063 
3064 	/* The next wait() should report the stop from SIGSTOP. */
3065 	wpid = waitpid(fpid, &status, 0);
3066 	ATF_REQUIRE(wpid == fpid);
3067 	ATF_REQUIRE(WIFSTOPPED(status));
3068 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3069 
3070 	/* Continue the child ignoring the SIGSTOP. */
3071 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3072 
3073 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3074 
3075 	/* The next wait() should report a SIGUSR2 was received. */
3076 	wpid = waitpid(fpid, &status, 0);
3077 	ATF_REQUIRE(wpid == fpid);
3078 	ATF_REQUIRE(WIFSTOPPED(status));
3079 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3080 
3081 	/* Continue the child, changing the signal to USR1. */
3082 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3083 
3084 	/* The last wait() should report normal exit with code 1. */
3085 	wpid = waitpid(fpid, &status, 0);
3086 	ATF_REQUIRE(wpid == fpid);
3087 	ATF_REQUIRE(WIFEXITED(status));
3088 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3089 
3090 	wpid = wait(&status);
3091 	ATF_REQUIRE(wpid == -1);
3092 	ATF_REQUIRE(errno == ECHILD);
3093 }
3094 
3095 static void *
3096 raise_sigstop_thread(void *arg __unused)
3097 {
3098 
3099 	raise(SIGSTOP);
3100 	return NULL;
3101 }
3102 
3103 static void *
3104 sleep_thread(void *arg __unused)
3105 {
3106 
3107 	sleep(60);
3108 	return NULL;
3109 }
3110 
3111 static void
3112 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
3113 {
3114 	pid_t fpid, wpid;
3115 	int status, i;
3116 	cpuset_t setmask;
3117 	cpusetid_t setid;
3118 	pthread_t t;
3119 
3120 	/*
3121 	 * Become the reaper for this process tree. We need to be able to check
3122 	 * that both child and grandchild have died.
3123 	 */
3124 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
3125 
3126 	fpid = fork();
3127 	ATF_REQUIRE(fpid >= 0);
3128 	if (fpid == 0) {
3129 		fpid = fork();
3130 		CHILD_REQUIRE(fpid >= 0);
3131 		if (fpid == 0) {
3132 			trace_me();
3133 
3134 			/* Pin to CPU 0 to serialize thread execution. */
3135 			CPU_ZERO(&setmask);
3136 			CPU_SET(0, &setmask);
3137 			CHILD_REQUIRE(cpuset(&setid) == 0);
3138 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
3139 			    CPU_WHICH_CPUSET, setid,
3140 			    sizeof(setmask), &setmask) == 0);
3141 
3142 			if (sigstop_from_main_thread) {
3143 				/*
3144 				 * We expect the SIGKILL sent when our parent
3145 				 * dies to be delivered to the new thread.
3146 				 * Raise the SIGSTOP in this thread so the
3147 				 * threads compete.
3148 				 */
3149 				CHILD_REQUIRE(pthread_create(&t, NULL,
3150 				    sleep_thread, NULL) == 0);
3151 				raise(SIGSTOP);
3152 			} else {
3153 				/*
3154 				 * We expect the SIGKILL to be delivered to
3155 				 * this thread. After creating the new thread,
3156 				 * just get off the CPU so the other thread can
3157 				 * raise the SIGSTOP.
3158 				 */
3159 				CHILD_REQUIRE(pthread_create(&t, NULL,
3160 				    raise_sigstop_thread, NULL) == 0);
3161 				sleep(60);
3162 			}
3163 
3164 			exit(0);
3165 		}
3166 		/* First stop is trace_me() immediately after fork. */
3167 		wpid = waitpid(fpid, &status, 0);
3168 		CHILD_REQUIRE(wpid == fpid);
3169 		CHILD_REQUIRE(WIFSTOPPED(status));
3170 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3171 
3172 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3173 
3174 		/* Second stop is from the raise(SIGSTOP). */
3175 		wpid = waitpid(fpid, &status, 0);
3176 		CHILD_REQUIRE(wpid == fpid);
3177 		CHILD_REQUIRE(WIFSTOPPED(status));
3178 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3179 
3180 		/*
3181 		 * Terminate tracing process without detaching. Our child
3182 		 * should be killed.
3183 		 */
3184 		exit(0);
3185 	}
3186 
3187 	/*
3188 	 * We should get a normal exit from our immediate child and a SIGKILL
3189 	 * exit from our grandchild. The latter case is the interesting one.
3190 	 * Our grandchild should not have stopped due to the SIGSTOP that was
3191 	 * left dangling when its parent died.
3192 	 */
3193 	for (i = 0; i < 2; ++i) {
3194 		wpid = wait(&status);
3195 		if (wpid == fpid)
3196 			ATF_REQUIRE(WIFEXITED(status) &&
3197 			    WEXITSTATUS(status) == 0);
3198 		else
3199 			ATF_REQUIRE(WIFSIGNALED(status) &&
3200 			    WTERMSIG(status) == SIGKILL);
3201 	}
3202 }
3203 
3204 /*
3205  * These two tests ensure that if the tracing process exits without detaching
3206  * just after the child received a SIGSTOP, the child is cleanly killed and
3207  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
3208  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
3209  * different threads, the SIGKILL must win.  There are two variants of this
3210  * test, designed to catch the case where the SIGKILL is delivered to the
3211  * younger thread (the first test) and the case where the SIGKILL is delivered
3212  * to the older thread (the second test). This behavior has changed in the
3213  * past, so make no assumption.
3214  */
3215 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
3216 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
3217 {
3218 
3219 	atf_tc_set_md_var(tc, "require.user", "root");
3220 }
3221 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
3222 {
3223 
3224 	terminate_with_pending_sigstop(true);
3225 }
3226 
3227 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
3228 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
3229 {
3230 
3231 	atf_tc_set_md_var(tc, "require.user", "root");
3232 }
3233 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
3234 {
3235 
3236 	terminate_with_pending_sigstop(false);
3237 }
3238 
3239 /*
3240  * Verify that after ptrace() discards a SIGKILL signal, the event mask
3241  * is not modified.
3242  */
3243 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
3244 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
3245 {
3246 	struct ptrace_lwpinfo pl;
3247 	pid_t fpid, wpid;
3248 	int status, event_mask, new_event_mask;
3249 
3250 	ATF_REQUIRE((fpid = fork()) != -1);
3251 	if (fpid == 0) {
3252 		trace_me();
3253 		raise(SIGSTOP);
3254 		exit(0);
3255 	}
3256 
3257 	/* The first wait() should report the stop from trace_me(). */
3258 	wpid = waitpid(fpid, &status, 0);
3259 	ATF_REQUIRE(wpid == fpid);
3260 	ATF_REQUIRE(WIFSTOPPED(status));
3261 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3262 
3263 	/* Set several unobtrusive event bits. */
3264 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3265 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3266 	    sizeof(event_mask)) == 0);
3267 
3268 	/* Send a SIGKILL without using ptrace. */
3269 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
3270 
3271 	/* Continue the child ignoring the SIGSTOP. */
3272 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3273 
3274 	/* The next stop should be due to the SIGKILL. */
3275 	wpid = waitpid(fpid, &status, 0);
3276 	ATF_REQUIRE(wpid == fpid);
3277 	ATF_REQUIRE(WIFSTOPPED(status));
3278 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
3279 
3280 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3281 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3282 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
3283 
3284 	/* Continue the child ignoring the SIGKILL. */
3285 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3286 
3287 	/* The next wait() should report the stop from SIGSTOP. */
3288 	wpid = waitpid(fpid, &status, 0);
3289 	ATF_REQUIRE(wpid == fpid);
3290 	ATF_REQUIRE(WIFSTOPPED(status));
3291 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3292 
3293 	/* Check the current event mask. It should not have changed. */
3294 	new_event_mask = 0;
3295 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3296 	    sizeof(new_event_mask)) == 0);
3297 	ATF_REQUIRE(event_mask == new_event_mask);
3298 
3299 	/* Continue the child to let it exit. */
3300 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3301 
3302 	/* The last event should be for the child process's exit. */
3303 	wpid = waitpid(fpid, &status, 0);
3304 	ATF_REQUIRE(WIFEXITED(status));
3305 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3306 
3307 	wpid = wait(&status);
3308 	ATF_REQUIRE(wpid == -1);
3309 	ATF_REQUIRE(errno == ECHILD);
3310 }
3311 
3312 static void *
3313 flock_thread(void *arg)
3314 {
3315 	int fd;
3316 
3317 	fd = *(int *)arg;
3318 	(void)flock(fd, LOCK_EX);
3319 	(void)flock(fd, LOCK_UN);
3320 	return (NULL);
3321 }
3322 
3323 /*
3324  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3325  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3326  * on a lock. This is a regression test for r318191.
3327  */
3328 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3329 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3330 {
3331 	pthread_barrier_t barrier;
3332 	pthread_barrierattr_t battr;
3333 	char tmpfile[64];
3334 	pid_t child, wpid;
3335 	int error, fd, i, status;
3336 
3337 	ATF_REQUIRE(pthread_barrierattr_init(&battr) == 0);
3338 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3339 	    PTHREAD_PROCESS_SHARED) == 0);
3340 	ATF_REQUIRE(pthread_barrier_init(&barrier, &battr, 2) == 0);
3341 
3342 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3343 	fd = mkstemp(tmpfile);
3344 	ATF_REQUIRE(fd >= 0);
3345 
3346 	ATF_REQUIRE((child = fork()) != -1);
3347 	if (child == 0) {
3348 		pthread_t t[2];
3349 		int cfd;
3350 
3351 		error = pthread_barrier_wait(&barrier);
3352 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3353 			_exit(1);
3354 
3355 		cfd = open(tmpfile, O_RDONLY);
3356 		if (cfd < 0)
3357 			_exit(1);
3358 
3359 		/*
3360 		 * We want at least two threads blocked on the file lock since
3361 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3362 		 * sleep.
3363 		 */
3364 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3365 			_exit(1);
3366 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3367 			_exit(1);
3368 		if (pthread_join(t[0], NULL) != 0)
3369 			_exit(1);
3370 		if (pthread_join(t[1], NULL) != 0)
3371 			_exit(1);
3372 		_exit(0);
3373 	}
3374 
3375 	ATF_REQUIRE(flock(fd, LOCK_EX) == 0);
3376 
3377 	error = pthread_barrier_wait(&barrier);
3378 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3379 
3380 	/*
3381 	 * Give the child some time to block. Is there a better way to do this?
3382 	 */
3383 	sleep(1);
3384 
3385 	/*
3386 	 * Attach and give the child 3 seconds to stop.
3387 	 */
3388 	ATF_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) == 0);
3389 	for (i = 0; i < 3; i++) {
3390 		wpid = waitpid(child, &status, WNOHANG);
3391 		if (wpid == child && WIFSTOPPED(status) &&
3392 		    WSTOPSIG(status) == SIGSTOP)
3393 			break;
3394 		sleep(1);
3395 	}
3396 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3397 
3398 	ATF_REQUIRE(ptrace(PT_DETACH, child, NULL, 0) == 0);
3399 
3400 	ATF_REQUIRE(flock(fd, LOCK_UN) == 0);
3401 	ATF_REQUIRE(unlink(tmpfile) == 0);
3402 	ATF_REQUIRE(close(fd) == 0);
3403 }
3404 
3405 static void
3406 sigusr1_step_handler(int sig)
3407 {
3408 
3409 	CHILD_REQUIRE(sig == SIGUSR1);
3410 	raise(SIGABRT);
3411 }
3412 
3413 /*
3414  * Verify that PT_STEP with a signal invokes the signal before
3415  * stepping the next instruction (and that the next instruction is
3416  * stepped correctly).
3417  */
3418 ATF_TC_WITHOUT_HEAD(ptrace__PT_STEP_with_signal);
3419 ATF_TC_BODY(ptrace__PT_STEP_with_signal, tc)
3420 {
3421 	struct ptrace_lwpinfo pl;
3422 	pid_t fpid, wpid;
3423 	int status;
3424 
3425 	ATF_REQUIRE((fpid = fork()) != -1);
3426 	if (fpid == 0) {
3427 		trace_me();
3428 		signal(SIGUSR1, sigusr1_step_handler);
3429 		raise(SIGABRT);
3430 		exit(1);
3431 	}
3432 
3433 	/* The first wait() should report the stop from SIGSTOP. */
3434 	wpid = waitpid(fpid, &status, 0);
3435 	ATF_REQUIRE(wpid == fpid);
3436 	ATF_REQUIRE(WIFSTOPPED(status));
3437 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3438 
3439 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3440 
3441 	/* The next stop should report the SIGABRT in the child body. */
3442 	wpid = waitpid(fpid, &status, 0);
3443 	ATF_REQUIRE(wpid == fpid);
3444 	ATF_REQUIRE(WIFSTOPPED(status));
3445 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3446 
3447 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3448 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3449 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3450 
3451 	/* Step the child process inserting SIGUSR1. */
3452 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, SIGUSR1) == 0);
3453 
3454 	/* The next stop should report the SIGABRT in the signal handler. */
3455 	wpid = waitpid(fpid, &status, 0);
3456 	ATF_REQUIRE(wpid == fpid);
3457 	ATF_REQUIRE(WIFSTOPPED(status));
3458 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3459 
3460 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3461 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3462 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3463 
3464 	/* Continue the child process discarding the signal. */
3465 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3466 
3467 	/* The next stop should report a trace trap from PT_STEP. */
3468 	wpid = waitpid(fpid, &status, 0);
3469 	ATF_REQUIRE(wpid == fpid);
3470 	ATF_REQUIRE(WIFSTOPPED(status));
3471 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3472 
3473 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3474 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3475 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3476 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3477 
3478 	/* Continue the child to let it exit. */
3479 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3480 
3481 	/* The last event should be for the child process's exit. */
3482 	wpid = waitpid(fpid, &status, 0);
3483 	ATF_REQUIRE(WIFEXITED(status));
3484 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3485 
3486 	wpid = wait(&status);
3487 	ATF_REQUIRE(wpid == -1);
3488 	ATF_REQUIRE(errno == ECHILD);
3489 }
3490 
3491 #ifdef HAVE_BREAKPOINT
3492 /*
3493  * Verify that a SIGTRAP event with the TRAP_BRKPT code is reported
3494  * for a breakpoint trap.
3495  */
3496 ATF_TC_WITHOUT_HEAD(ptrace__breakpoint_siginfo);
3497 ATF_TC_BODY(ptrace__breakpoint_siginfo, tc)
3498 {
3499 	struct ptrace_lwpinfo pl;
3500 	pid_t fpid, wpid;
3501 	int status;
3502 
3503 	ATF_REQUIRE((fpid = fork()) != -1);
3504 	if (fpid == 0) {
3505 		trace_me();
3506 		breakpoint();
3507 		exit(1);
3508 	}
3509 
3510 	/* The first wait() should report the stop from SIGSTOP. */
3511 	wpid = waitpid(fpid, &status, 0);
3512 	ATF_REQUIRE(wpid == fpid);
3513 	ATF_REQUIRE(WIFSTOPPED(status));
3514 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3515 
3516 	/* Continue the child ignoring the SIGSTOP. */
3517 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3518 
3519 	/* The second wait() should report hitting the breakpoint. */
3520 	wpid = waitpid(fpid, &status, 0);
3521 	ATF_REQUIRE(wpid == fpid);
3522 	ATF_REQUIRE(WIFSTOPPED(status));
3523 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3524 
3525 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3526 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3527 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3528 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_BRKPT);
3529 
3530 	/* Kill the child process. */
3531 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
3532 
3533 	/* The last wait() should report the SIGKILL. */
3534 	wpid = waitpid(fpid, &status, 0);
3535 	ATF_REQUIRE(wpid == fpid);
3536 	ATF_REQUIRE(WIFSIGNALED(status));
3537 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
3538 
3539 	wpid = wait(&status);
3540 	ATF_REQUIRE(wpid == -1);
3541 	ATF_REQUIRE(errno == ECHILD);
3542 }
3543 #endif /* HAVE_BREAKPOINT */
3544 
3545 /*
3546  * Verify that a SIGTRAP event with the TRAP_TRACE code is reported
3547  * for a single-step trap from PT_STEP.
3548  */
3549 ATF_TC_WITHOUT_HEAD(ptrace__step_siginfo);
3550 ATF_TC_BODY(ptrace__step_siginfo, tc)
3551 {
3552 	struct ptrace_lwpinfo pl;
3553 	pid_t fpid, wpid;
3554 	int status;
3555 
3556 	ATF_REQUIRE((fpid = fork()) != -1);
3557 	if (fpid == 0) {
3558 		trace_me();
3559 		exit(1);
3560 	}
3561 
3562 	/* The first wait() should report the stop from SIGSTOP. */
3563 	wpid = waitpid(fpid, &status, 0);
3564 	ATF_REQUIRE(wpid == fpid);
3565 	ATF_REQUIRE(WIFSTOPPED(status));
3566 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3567 
3568 	/* Step the child ignoring the SIGSTOP. */
3569 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, 0) == 0);
3570 
3571 	/* The second wait() should report a single-step trap. */
3572 	wpid = waitpid(fpid, &status, 0);
3573 	ATF_REQUIRE(wpid == fpid);
3574 	ATF_REQUIRE(WIFSTOPPED(status));
3575 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3576 
3577 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3578 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3579 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3580 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3581 
3582 	/* Continue the child process. */
3583 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3584 
3585 	/* The last event should be for the child process's exit. */
3586 	wpid = waitpid(fpid, &status, 0);
3587 	ATF_REQUIRE(WIFEXITED(status));
3588 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3589 
3590 	wpid = wait(&status);
3591 	ATF_REQUIRE(wpid == -1);
3592 	ATF_REQUIRE(errno == ECHILD);
3593 }
3594 
3595 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3596 static void *
3597 continue_thread(void *arg __unused)
3598 {
3599 	breakpoint();
3600 	return (NULL);
3601 }
3602 
3603 static __dead2 void
3604 continue_thread_main(void)
3605 {
3606 	pthread_t threads[2];
3607 
3608 	CHILD_REQUIRE(pthread_create(&threads[0], NULL, continue_thread,
3609 	    NULL) == 0);
3610 	CHILD_REQUIRE(pthread_create(&threads[1], NULL, continue_thread,
3611 	    NULL) == 0);
3612 	CHILD_REQUIRE(pthread_join(threads[0], NULL) == 0);
3613 	CHILD_REQUIRE(pthread_join(threads[1], NULL) == 0);
3614 	exit(1);
3615 }
3616 
3617 /*
3618  * Ensure that PT_CONTINUE clears the status of the thread that
3619  * triggered the stop even if a different thread's LWP was passed to
3620  * PT_CONTINUE.
3621  */
3622 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_different_thread);
3623 ATF_TC_BODY(ptrace__PT_CONTINUE_different_thread, tc)
3624 {
3625 	struct ptrace_lwpinfo pl;
3626 	pid_t fpid, wpid;
3627 	lwpid_t lwps[2];
3628 	bool hit_break[2];
3629 	struct reg reg;
3630 	int i, j, status;
3631 
3632 	ATF_REQUIRE((fpid = fork()) != -1);
3633 	if (fpid == 0) {
3634 		trace_me();
3635 		continue_thread_main();
3636 	}
3637 
3638 	/* The first wait() should report the stop from SIGSTOP. */
3639 	wpid = waitpid(fpid, &status, 0);
3640 	ATF_REQUIRE(wpid == fpid);
3641 	ATF_REQUIRE(WIFSTOPPED(status));
3642 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3643 
3644 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3645 	    sizeof(pl)) != -1);
3646 
3647 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
3648 
3649 	/* Continue the child ignoring the SIGSTOP. */
3650 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3651 
3652 	/* One of the new threads should report it's birth. */
3653 	wpid = waitpid(fpid, &status, 0);
3654 	ATF_REQUIRE(wpid == fpid);
3655 	ATF_REQUIRE(WIFSTOPPED(status));
3656 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3657 
3658 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3659 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3660 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3661 	lwps[0] = pl.pl_lwpid;
3662 
3663 	/*
3664 	 * Suspend this thread to ensure both threads are alive before
3665 	 * hitting the breakpoint.
3666 	 */
3667 	ATF_REQUIRE(ptrace(PT_SUSPEND, lwps[0], NULL, 0) != -1);
3668 
3669 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3670 
3671 	/* Second thread should report it's birth. */
3672 	wpid = waitpid(fpid, &status, 0);
3673 	ATF_REQUIRE(wpid == fpid);
3674 	ATF_REQUIRE(WIFSTOPPED(status));
3675 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3676 
3677 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3678 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3679 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3680 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
3681 	lwps[1] = pl.pl_lwpid;
3682 
3683 	/* Resume both threads waiting for breakpoint events. */
3684 	hit_break[0] = hit_break[1] = false;
3685 	ATF_REQUIRE(ptrace(PT_RESUME, lwps[0], NULL, 0) != -1);
3686 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3687 
3688 	/* One thread should report a breakpoint. */
3689 	wpid = waitpid(fpid, &status, 0);
3690 	ATF_REQUIRE(wpid == fpid);
3691 	ATF_REQUIRE(WIFSTOPPED(status));
3692 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3693 
3694 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3695 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3696 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3697 	    pl.pl_siginfo.si_code == TRAP_BRKPT);
3698 	if (pl.pl_lwpid == lwps[0])
3699 		i = 0;
3700 	else
3701 		i = 1;
3702 	hit_break[i] = true;
3703 	ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3704 	SKIP_BREAK(&reg);
3705 	ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3706 
3707 	/*
3708 	 * Resume both threads but pass the other thread's LWPID to
3709 	 * PT_CONTINUE.
3710 	 */
3711 	ATF_REQUIRE(ptrace(PT_CONTINUE, lwps[i ^ 1], (caddr_t)1, 0) == 0);
3712 
3713 	/*
3714 	 * Will now get two thread exit events and one more breakpoint
3715 	 * event.
3716 	 */
3717 	for (j = 0; j < 3; j++) {
3718 		wpid = waitpid(fpid, &status, 0);
3719 		ATF_REQUIRE(wpid == fpid);
3720 		ATF_REQUIRE(WIFSTOPPED(status));
3721 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3722 
3723 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3724 		    sizeof(pl)) != -1);
3725 
3726 		if (pl.pl_lwpid == lwps[0])
3727 			i = 0;
3728 		else
3729 			i = 1;
3730 
3731 		ATF_REQUIRE_MSG(lwps[i] != 0, "event for exited thread");
3732 		if (pl.pl_flags & PL_FLAG_EXITED) {
3733 			ATF_REQUIRE_MSG(hit_break[i],
3734 			    "exited thread did not report breakpoint");
3735 			lwps[i] = 0;
3736 		} else {
3737 			ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3738 			ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3739 			    pl.pl_siginfo.si_code == TRAP_BRKPT);
3740 			ATF_REQUIRE_MSG(!hit_break[i],
3741 			    "double breakpoint event");
3742 			hit_break[i] = true;
3743 			ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg,
3744 			    0) != -1);
3745 			SKIP_BREAK(&reg);
3746 			ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg,
3747 			    0) != -1);
3748 		}
3749 
3750 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3751 	}
3752 
3753 	/* Both threads should have exited. */
3754 	ATF_REQUIRE(lwps[0] == 0);
3755 	ATF_REQUIRE(lwps[1] == 0);
3756 
3757 	/* The last event should be for the child process's exit. */
3758 	wpid = waitpid(fpid, &status, 0);
3759 	ATF_REQUIRE(WIFEXITED(status));
3760 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3761 
3762 	wpid = wait(&status);
3763 	ATF_REQUIRE(wpid == -1);
3764 	ATF_REQUIRE(errno == ECHILD);
3765 }
3766 #endif
3767 
3768 ATF_TP_ADD_TCS(tp)
3769 {
3770 
3771 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
3772 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
3773 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
3774 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
3775 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
3776 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
3777 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
3778 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
3779 	ATF_TP_ADD_TC(tp,
3780 	    ptrace__follow_fork_child_detached_unrelated_debugger);
3781 	ATF_TP_ADD_TC(tp,
3782 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
3783 	ATF_TP_ADD_TC(tp, ptrace__getppid);
3784 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
3785 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
3786 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
3787 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
3788 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
3789 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
3790 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
3791 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
3792 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
3793 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
3794 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
3795 #ifdef HAVE_BREAKPOINT
3796 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
3797 #endif
3798 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
3799 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
3800 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
3801 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
3802 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
3803 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
3804 	ATF_TP_ADD_TC(tp,
3805 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
3806 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
3807 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
3808 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
3809 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
3810 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
3811 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
3812 	ATF_TP_ADD_TC(tp, ptrace__killed_with_sigmask);
3813 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigmask);
3814 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3815 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
3816 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
3817 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
3818 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
3819 	ATF_TP_ADD_TC(tp, ptrace__PT_STEP_with_signal);
3820 #ifdef HAVE_BREAKPOINT
3821 	ATF_TP_ADD_TC(tp, ptrace__breakpoint_siginfo);
3822 #endif
3823 	ATF_TP_ADD_TC(tp, ptrace__step_siginfo);
3824 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3825 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_different_thread);
3826 #endif
3827 
3828 	return (atf_no_error());
3829 }
3830