xref: /freebsd/tests/sys/kern/ptrace_test.c (revision 7e37c475fa08713cfdd04020cfbd532fe9f124f6)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD$");
28 
29 #include <sys/types.h>
30 #include <sys/cpuset.h>
31 #include <sys/event.h>
32 #include <sys/file.h>
33 #include <sys/time.h>
34 #include <sys/procctl.h>
35 #include <sys/ptrace.h>
36 #include <sys/queue.h>
37 #include <sys/runq.h>
38 #include <sys/syscall.h>
39 #include <sys/sysctl.h>
40 #include <sys/user.h>
41 #include <sys/wait.h>
42 #include <errno.h>
43 #include <machine/cpufunc.h>
44 #include <pthread.h>
45 #include <sched.h>
46 #include <semaphore.h>
47 #include <signal.h>
48 #include <stdio.h>
49 #include <stdlib.h>
50 #include <unistd.h>
51 #include <atf-c.h>
52 
53 /*
54  * Architectures with a user-visible breakpoint().
55  */
56 #if defined(__aarch64__) || defined(__amd64__) || defined(__arm__) ||	\
57     defined(__i386__) || defined(__mips__) || defined(__riscv) ||	\
58     defined(__sparc64__)
59 #define	HAVE_BREAKPOINT
60 #endif
61 
62 /*
63  * Adjust PC to skip over a breakpoint when stopped for a breakpoint trap.
64  */
65 #ifdef HAVE_BREAKPOINT
66 #if defined(__aarch64__)
67 #define	SKIP_BREAK(reg)	((reg)->elr += 4)
68 #elif defined(__amd64__) || defined(__i386__)
69 #define	SKIP_BREAK(reg)
70 #elif defined(__arm__)
71 #define	SKIP_BREAK(reg)	((reg)->r_pc += 4)
72 #elif defined(__mips__)
73 #define	SKIP_BREAK(reg)	((reg)->r_regs[PC] += 4)
74 #elif defined(__riscv)
75 #define	SKIP_BREAK(reg)	((reg)->sepc += 4)
76 #elif defined(__sparc64__)
77 #define	SKIP_BREAK(reg)	do {						\
78 	(reg)->r_tpc = (reg)->r_tnpc + 4;				\
79 	(reg)->r_tnpc += 8;						\
80 } while (0)
81 #endif
82 #endif
83 
84 /*
85  * A variant of ATF_REQUIRE that is suitable for use in child
86  * processes.  This only works if the parent process is tripped up by
87  * the early exit and fails some requirement itself.
88  */
89 #define	CHILD_REQUIRE(exp) do {						\
90 		if (!(exp))						\
91 			child_fail_require(__FILE__, __LINE__,		\
92 			    #exp " not met");				\
93 	} while (0)
94 
95 static __dead2 void
96 child_fail_require(const char *file, int line, const char *str)
97 {
98 	char buf[128];
99 
100 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
101 	write(2, buf, strlen(buf));
102 	_exit(32);
103 }
104 
105 static void
106 trace_me(void)
107 {
108 
109 	/* Attach the parent process as a tracer of this process. */
110 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
111 
112 	/* Trigger a stop. */
113 	raise(SIGSTOP);
114 }
115 
116 static void
117 attach_child(pid_t pid)
118 {
119 	pid_t wpid;
120 	int status;
121 
122 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
123 
124 	wpid = waitpid(pid, &status, 0);
125 	ATF_REQUIRE(wpid == pid);
126 	ATF_REQUIRE(WIFSTOPPED(status));
127 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
128 }
129 
130 static void
131 wait_for_zombie(pid_t pid)
132 {
133 
134 	/*
135 	 * Wait for a process to exit.  This is kind of gross, but
136 	 * there is not a better way.
137 	 *
138 	 * Prior to r325719, the kern.proc.pid.<pid> sysctl failed
139 	 * with ESRCH.  After that change, a valid struct kinfo_proc
140 	 * is returned for zombies with ki_stat set to SZOMB.
141 	 */
142 	for (;;) {
143 		struct kinfo_proc kp;
144 		size_t len;
145 		int mib[4];
146 
147 		mib[0] = CTL_KERN;
148 		mib[1] = KERN_PROC;
149 		mib[2] = KERN_PROC_PID;
150 		mib[3] = pid;
151 		len = sizeof(kp);
152 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
153 			ATF_REQUIRE(errno == ESRCH);
154 			break;
155 		}
156 		if (kp.ki_stat == SZOMB)
157 			break;
158 		usleep(5000);
159 	}
160 }
161 
162 /*
163  * Verify that a parent debugger process "sees" the exit of a debugged
164  * process exactly once when attached via PT_TRACE_ME.
165  */
166 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
167 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
168 {
169 	pid_t child, wpid;
170 	int status;
171 
172 	ATF_REQUIRE((child = fork()) != -1);
173 	if (child == 0) {
174 		/* Child process. */
175 		trace_me();
176 
177 		_exit(1);
178 	}
179 
180 	/* Parent process. */
181 
182 	/* The first wait() should report the stop from SIGSTOP. */
183 	wpid = waitpid(child, &status, 0);
184 	ATF_REQUIRE(wpid == child);
185 	ATF_REQUIRE(WIFSTOPPED(status));
186 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
187 
188 	/* Continue the child ignoring the SIGSTOP. */
189 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
190 
191 	/* The second wait() should report the exit status. */
192 	wpid = waitpid(child, &status, 0);
193 	ATF_REQUIRE(wpid == child);
194 	ATF_REQUIRE(WIFEXITED(status));
195 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
196 
197 	/* The child should no longer exist. */
198 	wpid = waitpid(child, &status, 0);
199 	ATF_REQUIRE(wpid == -1);
200 	ATF_REQUIRE(errno == ECHILD);
201 }
202 
203 /*
204  * Verify that a parent debugger process "sees" the exit of a debugged
205  * process exactly once when attached via PT_ATTACH.
206  */
207 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
208 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
209 {
210 	pid_t child, wpid;
211 	int cpipe[2], status;
212 	char c;
213 
214 	ATF_REQUIRE(pipe(cpipe) == 0);
215 	ATF_REQUIRE((child = fork()) != -1);
216 	if (child == 0) {
217 		/* Child process. */
218 		close(cpipe[0]);
219 
220 		/* Wait for the parent to attach. */
221 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
222 
223 		_exit(1);
224 	}
225 	close(cpipe[1]);
226 
227 	/* Parent process. */
228 
229 	/* Attach to the child process. */
230 	attach_child(child);
231 
232 	/* Continue the child ignoring the SIGSTOP. */
233 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
234 
235 	/* Signal the child to exit. */
236 	close(cpipe[0]);
237 
238 	/* The second wait() should report the exit status. */
239 	wpid = waitpid(child, &status, 0);
240 	ATF_REQUIRE(wpid == child);
241 	ATF_REQUIRE(WIFEXITED(status));
242 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
243 
244 	/* The child should no longer exist. */
245 	wpid = waitpid(child, &status, 0);
246 	ATF_REQUIRE(wpid == -1);
247 	ATF_REQUIRE(errno == ECHILD);
248 }
249 
250 /*
251  * Verify that a parent process "sees" the exit of a debugged process only
252  * after the debugger has seen it.
253  */
254 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
255 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
256 {
257 	pid_t child, debugger, wpid;
258 	int cpipe[2], dpipe[2], status;
259 	char c;
260 
261 	ATF_REQUIRE(pipe(cpipe) == 0);
262 	ATF_REQUIRE((child = fork()) != -1);
263 
264 	if (child == 0) {
265 		/* Child process. */
266 		close(cpipe[0]);
267 
268 		/* Wait for parent to be ready. */
269 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
270 
271 		_exit(1);
272 	}
273 	close(cpipe[1]);
274 
275 	ATF_REQUIRE(pipe(dpipe) == 0);
276 	ATF_REQUIRE((debugger = fork()) != -1);
277 
278 	if (debugger == 0) {
279 		/* Debugger process. */
280 		close(dpipe[0]);
281 
282 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
283 
284 		wpid = waitpid(child, &status, 0);
285 		CHILD_REQUIRE(wpid == child);
286 		CHILD_REQUIRE(WIFSTOPPED(status));
287 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
288 
289 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
290 
291 		/* Signal parent that debugger is attached. */
292 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
293 
294 		/* Wait for parent's failed wait. */
295 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
296 
297 		wpid = waitpid(child, &status, 0);
298 		CHILD_REQUIRE(wpid == child);
299 		CHILD_REQUIRE(WIFEXITED(status));
300 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
301 
302 		_exit(0);
303 	}
304 	close(dpipe[1]);
305 
306 	/* Parent process. */
307 
308 	/* Wait for the debugger to attach to the child. */
309 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
310 
311 	/* Release the child. */
312 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
313 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
314 	close(cpipe[0]);
315 
316 	wait_for_zombie(child);
317 
318 	/*
319 	 * This wait should return a pid of 0 to indicate no status to
320 	 * report.  The parent should see the child as non-exited
321 	 * until the debugger sees the exit.
322 	 */
323 	wpid = waitpid(child, &status, WNOHANG);
324 	ATF_REQUIRE(wpid == 0);
325 
326 	/* Signal the debugger to wait for the child. */
327 	close(dpipe[0]);
328 
329 	/* Wait for the debugger. */
330 	wpid = waitpid(debugger, &status, 0);
331 	ATF_REQUIRE(wpid == debugger);
332 	ATF_REQUIRE(WIFEXITED(status));
333 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
334 
335 	/* The child process should now be ready. */
336 	wpid = waitpid(child, &status, WNOHANG);
337 	ATF_REQUIRE(wpid == child);
338 	ATF_REQUIRE(WIFEXITED(status));
339 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
340 }
341 
342 /*
343  * Verify that a parent process "sees" the exit of a debugged process
344  * only after a non-direct-child debugger has seen it.  In particular,
345  * various wait() calls in the parent must avoid failing with ESRCH by
346  * checking the parent's orphan list for the debugee.
347  */
348 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
349 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
350 {
351 	pid_t child, debugger, fpid, wpid;
352 	int cpipe[2], dpipe[2], status;
353 	char c;
354 
355 	ATF_REQUIRE(pipe(cpipe) == 0);
356 	ATF_REQUIRE((child = fork()) != -1);
357 
358 	if (child == 0) {
359 		/* Child process. */
360 		close(cpipe[0]);
361 
362 		/* Wait for parent to be ready. */
363 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
364 
365 		_exit(1);
366 	}
367 	close(cpipe[1]);
368 
369 	ATF_REQUIRE(pipe(dpipe) == 0);
370 	ATF_REQUIRE((debugger = fork()) != -1);
371 
372 	if (debugger == 0) {
373 		/* Debugger parent. */
374 
375 		/*
376 		 * Fork again and drop the debugger parent so that the
377 		 * debugger is not a child of the main parent.
378 		 */
379 		CHILD_REQUIRE((fpid = fork()) != -1);
380 		if (fpid != 0)
381 			_exit(2);
382 
383 		/* Debugger process. */
384 		close(dpipe[0]);
385 
386 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
387 
388 		wpid = waitpid(child, &status, 0);
389 		CHILD_REQUIRE(wpid == child);
390 		CHILD_REQUIRE(WIFSTOPPED(status));
391 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
392 
393 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
394 
395 		/* Signal parent that debugger is attached. */
396 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
397 
398 		/* Wait for parent's failed wait. */
399 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
400 
401 		wpid = waitpid(child, &status, 0);
402 		CHILD_REQUIRE(wpid == child);
403 		CHILD_REQUIRE(WIFEXITED(status));
404 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
405 
406 		_exit(0);
407 	}
408 	close(dpipe[1]);
409 
410 	/* Parent process. */
411 
412 	/* Wait for the debugger parent process to exit. */
413 	wpid = waitpid(debugger, &status, 0);
414 	ATF_REQUIRE(wpid == debugger);
415 	ATF_REQUIRE(WIFEXITED(status));
416 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
417 
418 	/* A WNOHANG wait here should see the non-exited child. */
419 	wpid = waitpid(child, &status, WNOHANG);
420 	ATF_REQUIRE(wpid == 0);
421 
422 	/* Wait for the debugger to attach to the child. */
423 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
424 
425 	/* Release the child. */
426 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
427 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
428 	close(cpipe[0]);
429 
430 	wait_for_zombie(child);
431 
432 	/*
433 	 * This wait should return a pid of 0 to indicate no status to
434 	 * report.  The parent should see the child as non-exited
435 	 * until the debugger sees the exit.
436 	 */
437 	wpid = waitpid(child, &status, WNOHANG);
438 	ATF_REQUIRE(wpid == 0);
439 
440 	/* Signal the debugger to wait for the child. */
441 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
442 
443 	/* Wait for the debugger. */
444 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
445 	close(dpipe[0]);
446 
447 	/* The child process should now be ready. */
448 	wpid = waitpid(child, &status, WNOHANG);
449 	ATF_REQUIRE(wpid == child);
450 	ATF_REQUIRE(WIFEXITED(status));
451 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
452 }
453 
454 /*
455  * Make sure that we can collect the exit status of an orphaned process.
456  */
457 ATF_TC_WITHOUT_HEAD(ptrace__parent_exits_before_child);
458 ATF_TC_BODY(ptrace__parent_exits_before_child, tc)
459 {
460 	ssize_t n;
461 	int cpipe1[2], cpipe2[2], gcpipe[2], status;
462 	pid_t child, gchild;
463 
464 	ATF_REQUIRE(pipe(cpipe1) == 0);
465 	ATF_REQUIRE(pipe(cpipe2) == 0);
466 	ATF_REQUIRE(pipe(gcpipe) == 0);
467 
468 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
469 
470 	ATF_REQUIRE((child = fork()) != -1);
471 	if (child == 0) {
472 		CHILD_REQUIRE((gchild = fork()) != -1);
473 		if (gchild == 0) {
474 			status = 1;
475 			do {
476 				n = read(gcpipe[0], &status, sizeof(status));
477 			} while (n == -1 && errno == EINTR);
478 			_exit(status);
479 		}
480 
481 		CHILD_REQUIRE(write(cpipe1[1], &gchild, sizeof(gchild)) ==
482 		    sizeof(gchild));
483 		CHILD_REQUIRE(read(cpipe2[0], &status, sizeof(status)) ==
484 		    sizeof(status));
485 		_exit(status);
486 	}
487 
488 	ATF_REQUIRE(read(cpipe1[0], &gchild, sizeof(gchild)) == sizeof(gchild));
489 
490 	ATF_REQUIRE(ptrace(PT_ATTACH, gchild, NULL, 0) == 0);
491 
492 	status = 0;
493 	ATF_REQUIRE(write(cpipe2[1], &status, sizeof(status)) ==
494 	    sizeof(status));
495 	ATF_REQUIRE(waitpid(child, &status, 0) == child);
496 	ATF_REQUIRE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
497 
498 	status = 0;
499 	ATF_REQUIRE(write(gcpipe[1], &status, sizeof(status)) ==
500 	    sizeof(status));
501 	ATF_REQUIRE(waitpid(gchild, &status, 0) == gchild);
502 	ATF_REQUIRE(WIFSTOPPED(status));
503 	ATF_REQUIRE(ptrace(PT_DETACH, gchild, (caddr_t)1, 0) == 0);
504 	ATF_REQUIRE(waitpid(gchild, &status, 0) == gchild);
505 	ATF_REQUIRE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
506 
507 	ATF_REQUIRE(close(cpipe1[0]) == 0);
508 	ATF_REQUIRE(close(cpipe1[1]) == 0);
509 	ATF_REQUIRE(close(cpipe2[0]) == 0);
510 	ATF_REQUIRE(close(cpipe2[1]) == 0);
511 	ATF_REQUIRE(close(gcpipe[0]) == 0);
512 	ATF_REQUIRE(close(gcpipe[1]) == 0);
513 }
514 
515 /*
516  * The parent process should always act the same regardless of how the
517  * debugger is attached to it.
518  */
519 static __dead2 void
520 follow_fork_parent(bool use_vfork)
521 {
522 	pid_t fpid, wpid;
523 	int status;
524 
525 	if (use_vfork)
526 		CHILD_REQUIRE((fpid = vfork()) != -1);
527 	else
528 		CHILD_REQUIRE((fpid = fork()) != -1);
529 
530 	if (fpid == 0)
531 		/* Child */
532 		_exit(2);
533 
534 	wpid = waitpid(fpid, &status, 0);
535 	CHILD_REQUIRE(wpid == fpid);
536 	CHILD_REQUIRE(WIFEXITED(status));
537 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
538 
539 	_exit(1);
540 }
541 
542 /*
543  * Helper routine for follow fork tests.  This waits for two stops
544  * that report both "sides" of a fork.  It returns the pid of the new
545  * child process.
546  */
547 static pid_t
548 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
549 {
550 	struct ptrace_lwpinfo pl;
551 	bool fork_reported[2];
552 	pid_t child, wpid;
553 	int i, status;
554 
555 	fork_reported[0] = false;
556 	fork_reported[1] = false;
557 	child = -1;
558 
559 	/*
560 	 * Each process should report a fork event.  The parent should
561 	 * report a PL_FLAG_FORKED event, and the child should report
562 	 * a PL_FLAG_CHILD event.
563 	 */
564 	for (i = 0; i < 2; i++) {
565 		wpid = wait(&status);
566 		ATF_REQUIRE(wpid > 0);
567 		ATF_REQUIRE(WIFSTOPPED(status));
568 
569 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
570 		    sizeof(pl)) != -1);
571 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
572 		    0);
573 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
574 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
575 		if (pl.pl_flags & PL_FLAG_CHILD) {
576 			ATF_REQUIRE(wpid != parent);
577 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
578 			ATF_REQUIRE(!fork_reported[1]);
579 			if (child == -1)
580 				child = wpid;
581 			else
582 				ATF_REQUIRE(child == wpid);
583 			if (ppl != NULL)
584 				ppl[1] = pl;
585 			fork_reported[1] = true;
586 		} else {
587 			ATF_REQUIRE(wpid == parent);
588 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
589 			ATF_REQUIRE(!fork_reported[0]);
590 			if (child == -1)
591 				child = pl.pl_child_pid;
592 			else
593 				ATF_REQUIRE(child == pl.pl_child_pid);
594 			if (ppl != NULL)
595 				ppl[0] = pl;
596 			fork_reported[0] = true;
597 		}
598 	}
599 
600 	return (child);
601 }
602 
603 /*
604  * Verify that a new child process is stopped after a followed fork and
605  * that the traced parent sees the exit of the child after the debugger
606  * when both processes remain attached to the debugger.
607  */
608 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
609 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
610 {
611 	pid_t children[2], fpid, wpid;
612 	int status;
613 
614 	ATF_REQUIRE((fpid = fork()) != -1);
615 	if (fpid == 0) {
616 		trace_me();
617 		follow_fork_parent(false);
618 	}
619 
620 	/* Parent process. */
621 	children[0] = fpid;
622 
623 	/* The first wait() should report the stop from SIGSTOP. */
624 	wpid = waitpid(children[0], &status, 0);
625 	ATF_REQUIRE(wpid == children[0]);
626 	ATF_REQUIRE(WIFSTOPPED(status));
627 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
628 
629 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
630 
631 	/* Continue the child ignoring the SIGSTOP. */
632 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
633 
634 	children[1] = handle_fork_events(children[0], NULL);
635 	ATF_REQUIRE(children[1] > 0);
636 
637 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
638 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
639 
640 	/*
641 	 * The child can't exit until the grandchild reports status, so the
642 	 * grandchild should report its exit first to the debugger.
643 	 */
644 	wpid = wait(&status);
645 	ATF_REQUIRE(wpid == children[1]);
646 	ATF_REQUIRE(WIFEXITED(status));
647 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
648 
649 	wpid = wait(&status);
650 	ATF_REQUIRE(wpid == children[0]);
651 	ATF_REQUIRE(WIFEXITED(status));
652 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
653 
654 	wpid = wait(&status);
655 	ATF_REQUIRE(wpid == -1);
656 	ATF_REQUIRE(errno == ECHILD);
657 }
658 
659 /*
660  * Verify that a new child process is stopped after a followed fork
661  * and that the traced parent sees the exit of the child when the new
662  * child process is detached after it reports its fork.
663  */
664 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
665 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
666 {
667 	pid_t children[2], fpid, wpid;
668 	int status;
669 
670 	ATF_REQUIRE((fpid = fork()) != -1);
671 	if (fpid == 0) {
672 		trace_me();
673 		follow_fork_parent(false);
674 	}
675 
676 	/* Parent process. */
677 	children[0] = fpid;
678 
679 	/* The first wait() should report the stop from SIGSTOP. */
680 	wpid = waitpid(children[0], &status, 0);
681 	ATF_REQUIRE(wpid == children[0]);
682 	ATF_REQUIRE(WIFSTOPPED(status));
683 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
684 
685 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
686 
687 	/* Continue the child ignoring the SIGSTOP. */
688 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
689 
690 	children[1] = handle_fork_events(children[0], NULL);
691 	ATF_REQUIRE(children[1] > 0);
692 
693 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
694 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
695 
696 	/*
697 	 * Should not see any status from the grandchild now, only the
698 	 * child.
699 	 */
700 	wpid = wait(&status);
701 	ATF_REQUIRE(wpid == children[0]);
702 	ATF_REQUIRE(WIFEXITED(status));
703 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
704 
705 	wpid = wait(&status);
706 	ATF_REQUIRE(wpid == -1);
707 	ATF_REQUIRE(errno == ECHILD);
708 }
709 
710 /*
711  * Verify that a new child process is stopped after a followed fork
712  * and that the traced parent sees the exit of the child when the
713  * traced parent is detached after the fork.
714  */
715 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
716 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
717 {
718 	pid_t children[2], fpid, wpid;
719 	int status;
720 
721 	ATF_REQUIRE((fpid = fork()) != -1);
722 	if (fpid == 0) {
723 		trace_me();
724 		follow_fork_parent(false);
725 	}
726 
727 	/* Parent process. */
728 	children[0] = fpid;
729 
730 	/* The first wait() should report the stop from SIGSTOP. */
731 	wpid = waitpid(children[0], &status, 0);
732 	ATF_REQUIRE(wpid == children[0]);
733 	ATF_REQUIRE(WIFSTOPPED(status));
734 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
735 
736 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
737 
738 	/* Continue the child ignoring the SIGSTOP. */
739 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
740 
741 	children[1] = handle_fork_events(children[0], NULL);
742 	ATF_REQUIRE(children[1] > 0);
743 
744 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
745 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
746 
747 	/*
748 	 * The child can't exit until the grandchild reports status, so the
749 	 * grandchild should report its exit first to the debugger.
750 	 *
751 	 * Even though the child process is detached, it is still a
752 	 * child of the debugger, so it will still report it's exit
753 	 * after the grandchild.
754 	 */
755 	wpid = wait(&status);
756 	ATF_REQUIRE(wpid == children[1]);
757 	ATF_REQUIRE(WIFEXITED(status));
758 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
759 
760 	wpid = wait(&status);
761 	ATF_REQUIRE(wpid == children[0]);
762 	ATF_REQUIRE(WIFEXITED(status));
763 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
764 
765 	wpid = wait(&status);
766 	ATF_REQUIRE(wpid == -1);
767 	ATF_REQUIRE(errno == ECHILD);
768 }
769 
770 static void
771 attach_fork_parent(int cpipe[2])
772 {
773 	pid_t fpid;
774 
775 	close(cpipe[0]);
776 
777 	/* Double-fork to disassociate from the debugger. */
778 	CHILD_REQUIRE((fpid = fork()) != -1);
779 	if (fpid != 0)
780 		_exit(3);
781 
782 	/* Send the pid of the disassociated child to the debugger. */
783 	fpid = getpid();
784 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
785 
786 	/* Wait for the debugger to attach. */
787 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
788 }
789 
790 /*
791  * Verify that a new child process is stopped after a followed fork and
792  * that the traced parent sees the exit of the child after the debugger
793  * when both processes remain attached to the debugger.  In this test
794  * the parent that forks is not a direct child of the debugger.
795  */
796 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
797 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
798 {
799 	pid_t children[2], fpid, wpid;
800 	int cpipe[2], status;
801 
802 	ATF_REQUIRE(pipe(cpipe) == 0);
803 	ATF_REQUIRE((fpid = fork()) != -1);
804 	if (fpid == 0) {
805 		attach_fork_parent(cpipe);
806 		follow_fork_parent(false);
807 	}
808 
809 	/* Parent process. */
810 	close(cpipe[1]);
811 
812 	/* Wait for the direct child to exit. */
813 	wpid = waitpid(fpid, &status, 0);
814 	ATF_REQUIRE(wpid == fpid);
815 	ATF_REQUIRE(WIFEXITED(status));
816 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
817 
818 	/* Read the pid of the fork parent. */
819 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
820 	    sizeof(children[0]));
821 
822 	/* Attach to the fork parent. */
823 	attach_child(children[0]);
824 
825 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
826 
827 	/* Continue the fork parent ignoring the SIGSTOP. */
828 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
829 
830 	/* Signal the fork parent to continue. */
831 	close(cpipe[0]);
832 
833 	children[1] = handle_fork_events(children[0], NULL);
834 	ATF_REQUIRE(children[1] > 0);
835 
836 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
837 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
838 
839 	/*
840 	 * The fork parent can't exit until the child reports status,
841 	 * so the child should report its exit first to the debugger.
842 	 */
843 	wpid = wait(&status);
844 	ATF_REQUIRE(wpid == children[1]);
845 	ATF_REQUIRE(WIFEXITED(status));
846 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
847 
848 	wpid = wait(&status);
849 	ATF_REQUIRE(wpid == children[0]);
850 	ATF_REQUIRE(WIFEXITED(status));
851 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
852 
853 	wpid = wait(&status);
854 	ATF_REQUIRE(wpid == -1);
855 	ATF_REQUIRE(errno == ECHILD);
856 }
857 
858 /*
859  * Verify that a new child process is stopped after a followed fork
860  * and that the traced parent sees the exit of the child when the new
861  * child process is detached after it reports its fork.  In this test
862  * the parent that forks is not a direct child of the debugger.
863  */
864 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
865 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
866 {
867 	pid_t children[2], fpid, wpid;
868 	int cpipe[2], status;
869 
870 	atf_tc_skip("https://bugs.freebsd.org/bug239292");
871 
872 	ATF_REQUIRE(pipe(cpipe) == 0);
873 	ATF_REQUIRE((fpid = fork()) != -1);
874 	if (fpid == 0) {
875 		attach_fork_parent(cpipe);
876 		follow_fork_parent(false);
877 	}
878 
879 	/* Parent process. */
880 	close(cpipe[1]);
881 
882 	/* Wait for the direct child to exit. */
883 	wpid = waitpid(fpid, &status, 0);
884 	ATF_REQUIRE(wpid == fpid);
885 	ATF_REQUIRE(WIFEXITED(status));
886 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
887 
888 	/* Read the pid of the fork parent. */
889 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
890 	    sizeof(children[0]));
891 
892 	/* Attach to the fork parent. */
893 	attach_child(children[0]);
894 
895 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
896 
897 	/* Continue the fork parent ignoring the SIGSTOP. */
898 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
899 
900 	/* Signal the fork parent to continue. */
901 	close(cpipe[0]);
902 
903 	children[1] = handle_fork_events(children[0], NULL);
904 	ATF_REQUIRE(children[1] > 0);
905 
906 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
907 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
908 
909 	/*
910 	 * Should not see any status from the child now, only the fork
911 	 * parent.
912 	 */
913 	wpid = wait(&status);
914 	ATF_REQUIRE(wpid == children[0]);
915 	ATF_REQUIRE(WIFEXITED(status));
916 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
917 
918 	wpid = wait(&status);
919 	ATF_REQUIRE(wpid == -1);
920 	ATF_REQUIRE(errno == ECHILD);
921 }
922 
923 /*
924  * Verify that a new child process is stopped after a followed fork
925  * and that the traced parent sees the exit of the child when the
926  * traced parent is detached after the fork.  In this test the parent
927  * that forks is not a direct child of the debugger.
928  */
929 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
930 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
931 {
932 	pid_t children[2], fpid, wpid;
933 	int cpipe[2], status;
934 
935 	ATF_REQUIRE(pipe(cpipe) == 0);
936 	ATF_REQUIRE((fpid = fork()) != -1);
937 	if (fpid == 0) {
938 		attach_fork_parent(cpipe);
939 		follow_fork_parent(false);
940 	}
941 
942 	/* Parent process. */
943 	close(cpipe[1]);
944 
945 	/* Wait for the direct child to exit. */
946 	wpid = waitpid(fpid, &status, 0);
947 	ATF_REQUIRE(wpid == fpid);
948 	ATF_REQUIRE(WIFEXITED(status));
949 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
950 
951 	/* Read the pid of the fork parent. */
952 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
953 	    sizeof(children[0]));
954 
955 	/* Attach to the fork parent. */
956 	attach_child(children[0]);
957 
958 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
959 
960 	/* Continue the fork parent ignoring the SIGSTOP. */
961 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
962 
963 	/* Signal the fork parent to continue. */
964 	close(cpipe[0]);
965 
966 	children[1] = handle_fork_events(children[0], NULL);
967 	ATF_REQUIRE(children[1] > 0);
968 
969 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
970 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
971 
972 	/*
973 	 * Should not see any status from the fork parent now, only
974 	 * the child.
975 	 */
976 	wpid = wait(&status);
977 	ATF_REQUIRE(wpid == children[1]);
978 	ATF_REQUIRE(WIFEXITED(status));
979 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
980 
981 	wpid = wait(&status);
982 	ATF_REQUIRE(wpid == -1);
983 	ATF_REQUIRE(errno == ECHILD);
984 }
985 
986 /*
987  * Verify that a child process does not see an unrelated debugger as its
988  * parent but sees its original parent process.
989  */
990 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
991 ATF_TC_BODY(ptrace__getppid, tc)
992 {
993 	pid_t child, debugger, ppid, wpid;
994 	int cpipe[2], dpipe[2], status;
995 	char c;
996 
997 	ATF_REQUIRE(pipe(cpipe) == 0);
998 	ATF_REQUIRE((child = fork()) != -1);
999 
1000 	if (child == 0) {
1001 		/* Child process. */
1002 		close(cpipe[0]);
1003 
1004 		/* Wait for parent to be ready. */
1005 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
1006 
1007 		/* Report the parent PID to the parent. */
1008 		ppid = getppid();
1009 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
1010 		    sizeof(ppid));
1011 
1012 		_exit(1);
1013 	}
1014 	close(cpipe[1]);
1015 
1016 	ATF_REQUIRE(pipe(dpipe) == 0);
1017 	ATF_REQUIRE((debugger = fork()) != -1);
1018 
1019 	if (debugger == 0) {
1020 		/* Debugger process. */
1021 		close(dpipe[0]);
1022 
1023 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
1024 
1025 		wpid = waitpid(child, &status, 0);
1026 		CHILD_REQUIRE(wpid == child);
1027 		CHILD_REQUIRE(WIFSTOPPED(status));
1028 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1029 
1030 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
1031 
1032 		/* Signal parent that debugger is attached. */
1033 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
1034 
1035 		/* Wait for traced child to exit. */
1036 		wpid = waitpid(child, &status, 0);
1037 		CHILD_REQUIRE(wpid == child);
1038 		CHILD_REQUIRE(WIFEXITED(status));
1039 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
1040 
1041 		_exit(0);
1042 	}
1043 	close(dpipe[1]);
1044 
1045 	/* Parent process. */
1046 
1047 	/* Wait for the debugger to attach to the child. */
1048 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
1049 
1050 	/* Release the child. */
1051 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
1052 
1053 	/* Read the parent PID from the child. */
1054 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
1055 	close(cpipe[0]);
1056 
1057 	ATF_REQUIRE(ppid == getpid());
1058 
1059 	/* Wait for the debugger. */
1060 	wpid = waitpid(debugger, &status, 0);
1061 	ATF_REQUIRE(wpid == debugger);
1062 	ATF_REQUIRE(WIFEXITED(status));
1063 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1064 
1065 	/* The child process should now be ready. */
1066 	wpid = waitpid(child, &status, WNOHANG);
1067 	ATF_REQUIRE(wpid == child);
1068 	ATF_REQUIRE(WIFEXITED(status));
1069 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1070 }
1071 
1072 /*
1073  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1074  * child process created via fork() reports the correct value.
1075  */
1076 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
1077 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
1078 {
1079 	struct ptrace_lwpinfo pl[2];
1080 	pid_t children[2], fpid, wpid;
1081 	int status;
1082 
1083 	ATF_REQUIRE((fpid = fork()) != -1);
1084 	if (fpid == 0) {
1085 		trace_me();
1086 		follow_fork_parent(false);
1087 	}
1088 
1089 	/* Parent process. */
1090 	children[0] = fpid;
1091 
1092 	/* The first wait() should report the stop from SIGSTOP. */
1093 	wpid = waitpid(children[0], &status, 0);
1094 	ATF_REQUIRE(wpid == children[0]);
1095 	ATF_REQUIRE(WIFSTOPPED(status));
1096 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1097 
1098 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1099 
1100 	/* Continue the child ignoring the SIGSTOP. */
1101 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1102 
1103 	/* Wait for both halves of the fork event to get reported. */
1104 	children[1] = handle_fork_events(children[0], pl);
1105 	ATF_REQUIRE(children[1] > 0);
1106 
1107 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1108 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1109 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1110 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1111 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1112 
1113 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1114 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1115 
1116 	/*
1117 	 * The child can't exit until the grandchild reports status, so the
1118 	 * grandchild should report its exit first to the debugger.
1119 	 */
1120 	wpid = wait(&status);
1121 	ATF_REQUIRE(wpid == children[1]);
1122 	ATF_REQUIRE(WIFEXITED(status));
1123 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1124 
1125 	wpid = wait(&status);
1126 	ATF_REQUIRE(wpid == children[0]);
1127 	ATF_REQUIRE(WIFEXITED(status));
1128 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1129 
1130 	wpid = wait(&status);
1131 	ATF_REQUIRE(wpid == -1);
1132 	ATF_REQUIRE(errno == ECHILD);
1133 }
1134 
1135 /*
1136  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1137  * child process created via vfork() reports the correct value.
1138  */
1139 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1140 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1141 {
1142 	struct ptrace_lwpinfo pl[2];
1143 	pid_t children[2], fpid, wpid;
1144 	int status;
1145 
1146 	ATF_REQUIRE((fpid = fork()) != -1);
1147 	if (fpid == 0) {
1148 		trace_me();
1149 		follow_fork_parent(true);
1150 	}
1151 
1152 	/* Parent process. */
1153 	children[0] = fpid;
1154 
1155 	/* The first wait() should report the stop from SIGSTOP. */
1156 	wpid = waitpid(children[0], &status, 0);
1157 	ATF_REQUIRE(wpid == children[0]);
1158 	ATF_REQUIRE(WIFSTOPPED(status));
1159 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1160 
1161 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1162 
1163 	/* Continue the child ignoring the SIGSTOP. */
1164 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1165 
1166 	/* Wait for both halves of the fork event to get reported. */
1167 	children[1] = handle_fork_events(children[0], pl);
1168 	ATF_REQUIRE(children[1] > 0);
1169 
1170 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1171 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1172 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1173 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1174 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1175 
1176 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1177 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1178 
1179 	/*
1180 	 * The child can't exit until the grandchild reports status, so the
1181 	 * grandchild should report its exit first to the debugger.
1182 	 */
1183 	wpid = wait(&status);
1184 	ATF_REQUIRE(wpid == children[1]);
1185 	ATF_REQUIRE(WIFEXITED(status));
1186 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1187 
1188 	wpid = wait(&status);
1189 	ATF_REQUIRE(wpid == children[0]);
1190 	ATF_REQUIRE(WIFEXITED(status));
1191 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1192 
1193 	wpid = wait(&status);
1194 	ATF_REQUIRE(wpid == -1);
1195 	ATF_REQUIRE(errno == ECHILD);
1196 }
1197 
1198 static void *
1199 simple_thread(void *arg __unused)
1200 {
1201 
1202 	pthread_exit(NULL);
1203 }
1204 
1205 static __dead2 void
1206 simple_thread_main(void)
1207 {
1208 	pthread_t thread;
1209 
1210 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1211 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1212 	exit(1);
1213 }
1214 
1215 /*
1216  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1217  * thread reports the correct value.
1218  */
1219 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1220 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1221 {
1222 	struct ptrace_lwpinfo pl;
1223 	pid_t fpid, wpid;
1224 	lwpid_t mainlwp;
1225 	int status;
1226 
1227 	ATF_REQUIRE((fpid = fork()) != -1);
1228 	if (fpid == 0) {
1229 		trace_me();
1230 		simple_thread_main();
1231 	}
1232 
1233 	/* The first wait() should report the stop from SIGSTOP. */
1234 	wpid = waitpid(fpid, &status, 0);
1235 	ATF_REQUIRE(wpid == fpid);
1236 	ATF_REQUIRE(WIFSTOPPED(status));
1237 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1238 
1239 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1240 	    sizeof(pl)) != -1);
1241 	mainlwp = pl.pl_lwpid;
1242 
1243 	/*
1244 	 * Continue the child ignoring the SIGSTOP and tracing all
1245 	 * system call exits.
1246 	 */
1247 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1248 
1249 	/*
1250 	 * Wait for the new thread to arrive.  pthread_create() might
1251 	 * invoke any number of system calls.  For now we just wait
1252 	 * for the new thread to arrive and make sure it reports a
1253 	 * valid system call code.  If ptrace grows thread event
1254 	 * reporting then this test can be made more precise.
1255 	 */
1256 	for (;;) {
1257 		wpid = waitpid(fpid, &status, 0);
1258 		ATF_REQUIRE(wpid == fpid);
1259 		ATF_REQUIRE(WIFSTOPPED(status));
1260 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1261 
1262 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1263 		    sizeof(pl)) != -1);
1264 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1265 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1266 		if (pl.pl_lwpid != mainlwp)
1267 			/* New thread seen. */
1268 			break;
1269 
1270 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1271 	}
1272 
1273 	/* Wait for the child to exit. */
1274 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1275 	for (;;) {
1276 		wpid = waitpid(fpid, &status, 0);
1277 		ATF_REQUIRE(wpid == fpid);
1278 		if (WIFEXITED(status))
1279 			break;
1280 
1281 		ATF_REQUIRE(WIFSTOPPED(status));
1282 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1283 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1284 	}
1285 
1286 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1287 
1288 	wpid = wait(&status);
1289 	ATF_REQUIRE(wpid == -1);
1290 	ATF_REQUIRE(errno == ECHILD);
1291 }
1292 
1293 /*
1294  * Verify that the expected LWP events are reported for a child thread.
1295  */
1296 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1297 ATF_TC_BODY(ptrace__lwp_events, tc)
1298 {
1299 	struct ptrace_lwpinfo pl;
1300 	pid_t fpid, wpid;
1301 	lwpid_t lwps[2];
1302 	int status;
1303 
1304 	ATF_REQUIRE((fpid = fork()) != -1);
1305 	if (fpid == 0) {
1306 		trace_me();
1307 		simple_thread_main();
1308 	}
1309 
1310 	/* The first wait() should report the stop from SIGSTOP. */
1311 	wpid = waitpid(fpid, &status, 0);
1312 	ATF_REQUIRE(wpid == fpid);
1313 	ATF_REQUIRE(WIFSTOPPED(status));
1314 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1315 
1316 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1317 	    sizeof(pl)) != -1);
1318 	lwps[0] = pl.pl_lwpid;
1319 
1320 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1321 
1322 	/* Continue the child ignoring the SIGSTOP. */
1323 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1324 
1325 	/* The first event should be for the child thread's birth. */
1326 	wpid = waitpid(fpid, &status, 0);
1327 	ATF_REQUIRE(wpid == fpid);
1328 	ATF_REQUIRE(WIFSTOPPED(status));
1329 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1330 
1331 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1332 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1333 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1334 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1335 	lwps[1] = pl.pl_lwpid;
1336 
1337 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1338 
1339 	/* The next event should be for the child thread's death. */
1340 	wpid = waitpid(fpid, &status, 0);
1341 	ATF_REQUIRE(wpid == fpid);
1342 	ATF_REQUIRE(WIFSTOPPED(status));
1343 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1344 
1345 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1346 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1347 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1348 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1349 
1350 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1351 
1352 	/* The last event should be for the child process's exit. */
1353 	wpid = waitpid(fpid, &status, 0);
1354 	ATF_REQUIRE(WIFEXITED(status));
1355 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1356 
1357 	wpid = wait(&status);
1358 	ATF_REQUIRE(wpid == -1);
1359 	ATF_REQUIRE(errno == ECHILD);
1360 }
1361 
1362 static void *
1363 exec_thread(void *arg __unused)
1364 {
1365 
1366 	execl("/usr/bin/true", "true", NULL);
1367 	exit(127);
1368 }
1369 
1370 static __dead2 void
1371 exec_thread_main(void)
1372 {
1373 	pthread_t thread;
1374 
1375 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1376 	for (;;)
1377 		sleep(60);
1378 	exit(1);
1379 }
1380 
1381 /*
1382  * Verify that the expected LWP events are reported for a multithreaded
1383  * process that calls execve(2).
1384  */
1385 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1386 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1387 {
1388 	struct ptrace_lwpinfo pl;
1389 	pid_t fpid, wpid;
1390 	lwpid_t lwps[2];
1391 	int status;
1392 
1393 	ATF_REQUIRE((fpid = fork()) != -1);
1394 	if (fpid == 0) {
1395 		trace_me();
1396 		exec_thread_main();
1397 	}
1398 
1399 	/* The first wait() should report the stop from SIGSTOP. */
1400 	wpid = waitpid(fpid, &status, 0);
1401 	ATF_REQUIRE(wpid == fpid);
1402 	ATF_REQUIRE(WIFSTOPPED(status));
1403 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1404 
1405 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1406 	    sizeof(pl)) != -1);
1407 	lwps[0] = pl.pl_lwpid;
1408 
1409 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1410 
1411 	/* Continue the child ignoring the SIGSTOP. */
1412 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1413 
1414 	/* The first event should be for the child thread's birth. */
1415 	wpid = waitpid(fpid, &status, 0);
1416 	ATF_REQUIRE(wpid == fpid);
1417 	ATF_REQUIRE(WIFSTOPPED(status));
1418 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1419 
1420 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1421 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1422 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1423 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1424 	lwps[1] = pl.pl_lwpid;
1425 
1426 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1427 
1428 	/*
1429 	 * The next event should be for the main thread's death due to
1430 	 * single threading from execve().
1431 	 */
1432 	wpid = waitpid(fpid, &status, 0);
1433 	ATF_REQUIRE(wpid == fpid);
1434 	ATF_REQUIRE(WIFSTOPPED(status));
1435 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1436 
1437 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1438 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1439 	    (PL_FLAG_EXITED));
1440 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1441 
1442 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1443 
1444 	/* The next event should be for the child process's exec. */
1445 	wpid = waitpid(fpid, &status, 0);
1446 	ATF_REQUIRE(WIFSTOPPED(status));
1447 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1448 
1449 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1450 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1451 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1452 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1453 
1454 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1455 
1456 	/* The last event should be for the child process's exit. */
1457 	wpid = waitpid(fpid, &status, 0);
1458 	ATF_REQUIRE(WIFEXITED(status));
1459 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1460 
1461 	wpid = wait(&status);
1462 	ATF_REQUIRE(wpid == -1);
1463 	ATF_REQUIRE(errno == ECHILD);
1464 }
1465 
1466 static void
1467 handler(int sig __unused)
1468 {
1469 }
1470 
1471 static void
1472 signal_main(void)
1473 {
1474 
1475 	signal(SIGINFO, handler);
1476 	raise(SIGINFO);
1477 	exit(0);
1478 }
1479 
1480 /*
1481  * Verify that the expected ptrace event is reported for a signal.
1482  */
1483 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1484 ATF_TC_BODY(ptrace__siginfo, tc)
1485 {
1486 	struct ptrace_lwpinfo pl;
1487 	pid_t fpid, wpid;
1488 	int status;
1489 
1490 	ATF_REQUIRE((fpid = fork()) != -1);
1491 	if (fpid == 0) {
1492 		trace_me();
1493 		signal_main();
1494 	}
1495 
1496 	/* The first wait() should report the stop from SIGSTOP. */
1497 	wpid = waitpid(fpid, &status, 0);
1498 	ATF_REQUIRE(wpid == fpid);
1499 	ATF_REQUIRE(WIFSTOPPED(status));
1500 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1501 
1502 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1503 
1504 	/* The next event should be for the SIGINFO. */
1505 	wpid = waitpid(fpid, &status, 0);
1506 	ATF_REQUIRE(WIFSTOPPED(status));
1507 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1508 
1509 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1510 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1511 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1512 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1513 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1514 
1515 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1516 
1517 	/* The last event should be for the child process's exit. */
1518 	wpid = waitpid(fpid, &status, 0);
1519 	ATF_REQUIRE(WIFEXITED(status));
1520 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1521 
1522 	wpid = wait(&status);
1523 	ATF_REQUIRE(wpid == -1);
1524 	ATF_REQUIRE(errno == ECHILD);
1525 }
1526 
1527 /*
1528  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1529  */
1530 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1531 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1532 {
1533 	pid_t fpid, wpid;
1534 	int events, status;
1535 
1536 	ATF_REQUIRE((fpid = fork()) != -1);
1537 	if (fpid == 0) {
1538 		trace_me();
1539 		exec_thread(NULL);
1540 	}
1541 
1542 	/* The first wait() should report the stop from SIGSTOP. */
1543 	wpid = waitpid(fpid, &status, 0);
1544 	ATF_REQUIRE(wpid == fpid);
1545 	ATF_REQUIRE(WIFSTOPPED(status));
1546 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1547 
1548 	events = 0;
1549 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1550 	    sizeof(events)) == 0);
1551 
1552 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1553 
1554 	/* Should get one event at exit. */
1555 	wpid = waitpid(fpid, &status, 0);
1556 	ATF_REQUIRE(WIFEXITED(status));
1557 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1558 
1559 	wpid = wait(&status);
1560 	ATF_REQUIRE(wpid == -1);
1561 	ATF_REQUIRE(errno == ECHILD);
1562 }
1563 
1564 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1565 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1566 {
1567 	struct ptrace_lwpinfo pl;
1568 	pid_t fpid, wpid;
1569 	int events, status;
1570 
1571 	ATF_REQUIRE((fpid = fork()) != -1);
1572 	if (fpid == 0) {
1573 		trace_me();
1574 		exec_thread(NULL);
1575 	}
1576 
1577 	/* The first wait() should report the stop from SIGSTOP. */
1578 	wpid = waitpid(fpid, &status, 0);
1579 	ATF_REQUIRE(wpid == fpid);
1580 	ATF_REQUIRE(WIFSTOPPED(status));
1581 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1582 
1583 	events = PTRACE_EXEC;
1584 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1585 	    sizeof(events)) == 0);
1586 
1587 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1588 
1589 	/* The next event should be for the child process's exec. */
1590 	wpid = waitpid(fpid, &status, 0);
1591 	ATF_REQUIRE(WIFSTOPPED(status));
1592 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1593 
1594 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1595 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1596 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1597 
1598 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1599 
1600 	/* The last event should be for the child process's exit. */
1601 	wpid = waitpid(fpid, &status, 0);
1602 	ATF_REQUIRE(WIFEXITED(status));
1603 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1604 
1605 	wpid = wait(&status);
1606 	ATF_REQUIRE(wpid == -1);
1607 	ATF_REQUIRE(errno == ECHILD);
1608 }
1609 
1610 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1611 ATF_TC_BODY(ptrace__event_mask, tc)
1612 {
1613 	pid_t fpid, wpid;
1614 	int events, status;
1615 
1616 	ATF_REQUIRE((fpid = fork()) != -1);
1617 	if (fpid == 0) {
1618 		trace_me();
1619 		exit(0);
1620 	}
1621 
1622 	/* The first wait() should report the stop from SIGSTOP. */
1623 	wpid = waitpid(fpid, &status, 0);
1624 	ATF_REQUIRE(wpid == fpid);
1625 	ATF_REQUIRE(WIFSTOPPED(status));
1626 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1627 
1628 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1629 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1630 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1631 	    sizeof(events)) == 0);
1632 	ATF_REQUIRE(events & PTRACE_FORK);
1633 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1634 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1635 	    sizeof(events)) == 0);
1636 	ATF_REQUIRE(!(events & PTRACE_FORK));
1637 
1638 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1639 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1640 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1641 	    sizeof(events)) == 0);
1642 	ATF_REQUIRE(events & PTRACE_LWP);
1643 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1644 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1645 	    sizeof(events)) == 0);
1646 	ATF_REQUIRE(!(events & PTRACE_LWP));
1647 
1648 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1649 
1650 	/* Should get one event at exit. */
1651 	wpid = waitpid(fpid, &status, 0);
1652 	ATF_REQUIRE(WIFEXITED(status));
1653 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1654 
1655 	wpid = wait(&status);
1656 	ATF_REQUIRE(wpid == -1);
1657 	ATF_REQUIRE(errno == ECHILD);
1658 }
1659 
1660 /*
1661  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1662  */
1663 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1664 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1665 {
1666 	struct ptrace_lwpinfo pl;
1667 	pid_t fpid, wpid;
1668 	int events, status;
1669 
1670 	ATF_REQUIRE((fpid = fork()) != -1);
1671 	if (fpid == 0) {
1672 		trace_me();
1673 		follow_fork_parent(true);
1674 	}
1675 
1676 	/* The first wait() should report the stop from SIGSTOP. */
1677 	wpid = waitpid(fpid, &status, 0);
1678 	ATF_REQUIRE(wpid == fpid);
1679 	ATF_REQUIRE(WIFSTOPPED(status));
1680 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1681 
1682 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1683 	    sizeof(events)) == 0);
1684 	events |= PTRACE_VFORK;
1685 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1686 	    sizeof(events)) == 0);
1687 
1688 	/* Continue the child ignoring the SIGSTOP. */
1689 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1690 
1691 	/* The next event should report the end of the vfork. */
1692 	wpid = wait(&status);
1693 	ATF_REQUIRE(wpid == fpid);
1694 	ATF_REQUIRE(WIFSTOPPED(status));
1695 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1696 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1697 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1698 
1699 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1700 
1701 	wpid = wait(&status);
1702 	ATF_REQUIRE(wpid == fpid);
1703 	ATF_REQUIRE(WIFEXITED(status));
1704 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1705 
1706 	wpid = wait(&status);
1707 	ATF_REQUIRE(wpid == -1);
1708 	ATF_REQUIRE(errno == ECHILD);
1709 }
1710 
1711 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1712 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1713 {
1714 	struct ptrace_lwpinfo pl[2];
1715 	pid_t children[2], fpid, wpid;
1716 	int events, status;
1717 
1718 	ATF_REQUIRE((fpid = fork()) != -1);
1719 	if (fpid == 0) {
1720 		trace_me();
1721 		follow_fork_parent(true);
1722 	}
1723 
1724 	/* Parent process. */
1725 	children[0] = fpid;
1726 
1727 	/* The first wait() should report the stop from SIGSTOP. */
1728 	wpid = waitpid(children[0], &status, 0);
1729 	ATF_REQUIRE(wpid == children[0]);
1730 	ATF_REQUIRE(WIFSTOPPED(status));
1731 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1732 
1733 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1734 	    sizeof(events)) == 0);
1735 	events |= PTRACE_FORK | PTRACE_VFORK;
1736 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1737 	    sizeof(events)) == 0);
1738 
1739 	/* Continue the child ignoring the SIGSTOP. */
1740 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1741 
1742 	/* Wait for both halves of the fork event to get reported. */
1743 	children[1] = handle_fork_events(children[0], pl);
1744 	ATF_REQUIRE(children[1] > 0);
1745 
1746 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1747 
1748 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1749 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1750 
1751 	/*
1752 	 * The child can't exit until the grandchild reports status, so the
1753 	 * grandchild should report its exit first to the debugger.
1754 	 */
1755 	wpid = waitpid(children[1], &status, 0);
1756 	ATF_REQUIRE(wpid == children[1]);
1757 	ATF_REQUIRE(WIFEXITED(status));
1758 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1759 
1760 	/*
1761 	 * The child should report it's vfork() completion before it
1762 	 * exits.
1763 	 */
1764 	wpid = wait(&status);
1765 	ATF_REQUIRE(wpid == children[0]);
1766 	ATF_REQUIRE(WIFSTOPPED(status));
1767 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1768 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1769 	    -1);
1770 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1771 
1772 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1773 
1774 	wpid = wait(&status);
1775 	ATF_REQUIRE(wpid == children[0]);
1776 	ATF_REQUIRE(WIFEXITED(status));
1777 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1778 
1779 	wpid = wait(&status);
1780 	ATF_REQUIRE(wpid == -1);
1781 	ATF_REQUIRE(errno == ECHILD);
1782 }
1783 
1784 #ifdef HAVE_BREAKPOINT
1785 /*
1786  * Verify that no more events are reported after PT_KILL except for the
1787  * process exit when stopped due to a breakpoint trap.
1788  */
1789 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1790 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1791 {
1792 	pid_t fpid, wpid;
1793 	int status;
1794 
1795 	ATF_REQUIRE((fpid = fork()) != -1);
1796 	if (fpid == 0) {
1797 		trace_me();
1798 		breakpoint();
1799 		exit(1);
1800 	}
1801 
1802 	/* The first wait() should report the stop from SIGSTOP. */
1803 	wpid = waitpid(fpid, &status, 0);
1804 	ATF_REQUIRE(wpid == fpid);
1805 	ATF_REQUIRE(WIFSTOPPED(status));
1806 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1807 
1808 	/* Continue the child ignoring the SIGSTOP. */
1809 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1810 
1811 	/* The second wait() should report hitting the breakpoint. */
1812 	wpid = waitpid(fpid, &status, 0);
1813 	ATF_REQUIRE(wpid == fpid);
1814 	ATF_REQUIRE(WIFSTOPPED(status));
1815 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1816 
1817 	/* Kill the child process. */
1818 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1819 
1820 	/* The last wait() should report the SIGKILL. */
1821 	wpid = waitpid(fpid, &status, 0);
1822 	ATF_REQUIRE(wpid == fpid);
1823 	ATF_REQUIRE(WIFSIGNALED(status));
1824 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1825 
1826 	wpid = wait(&status);
1827 	ATF_REQUIRE(wpid == -1);
1828 	ATF_REQUIRE(errno == ECHILD);
1829 }
1830 #endif /* HAVE_BREAKPOINT */
1831 
1832 /*
1833  * Verify that no more events are reported after PT_KILL except for the
1834  * process exit when stopped inside of a system call.
1835  */
1836 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1837 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1838 {
1839 	struct ptrace_lwpinfo pl;
1840 	pid_t fpid, wpid;
1841 	int status;
1842 
1843 	ATF_REQUIRE((fpid = fork()) != -1);
1844 	if (fpid == 0) {
1845 		trace_me();
1846 		getpid();
1847 		exit(1);
1848 	}
1849 
1850 	/* The first wait() should report the stop from SIGSTOP. */
1851 	wpid = waitpid(fpid, &status, 0);
1852 	ATF_REQUIRE(wpid == fpid);
1853 	ATF_REQUIRE(WIFSTOPPED(status));
1854 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1855 
1856 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1857 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1858 
1859 	/* The second wait() should report a system call entry for getpid(). */
1860 	wpid = waitpid(fpid, &status, 0);
1861 	ATF_REQUIRE(wpid == fpid);
1862 	ATF_REQUIRE(WIFSTOPPED(status));
1863 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1864 
1865 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1866 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1867 
1868 	/* Kill the child process. */
1869 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1870 
1871 	/* The last wait() should report the SIGKILL. */
1872 	wpid = waitpid(fpid, &status, 0);
1873 	ATF_REQUIRE(wpid == fpid);
1874 	ATF_REQUIRE(WIFSIGNALED(status));
1875 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1876 
1877 	wpid = wait(&status);
1878 	ATF_REQUIRE(wpid == -1);
1879 	ATF_REQUIRE(errno == ECHILD);
1880 }
1881 
1882 /*
1883  * Verify that no more events are reported after PT_KILL except for the
1884  * process exit when killing a multithreaded process.
1885  */
1886 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1887 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1888 {
1889 	struct ptrace_lwpinfo pl;
1890 	pid_t fpid, wpid;
1891 	lwpid_t main_lwp;
1892 	int status;
1893 
1894 	ATF_REQUIRE((fpid = fork()) != -1);
1895 	if (fpid == 0) {
1896 		trace_me();
1897 		simple_thread_main();
1898 	}
1899 
1900 	/* The first wait() should report the stop from SIGSTOP. */
1901 	wpid = waitpid(fpid, &status, 0);
1902 	ATF_REQUIRE(wpid == fpid);
1903 	ATF_REQUIRE(WIFSTOPPED(status));
1904 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1905 
1906 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1907 	    sizeof(pl)) != -1);
1908 	main_lwp = pl.pl_lwpid;
1909 
1910 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1911 
1912 	/* Continue the child ignoring the SIGSTOP. */
1913 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1914 
1915 	/* The first event should be for the child thread's birth. */
1916 	wpid = waitpid(fpid, &status, 0);
1917 	ATF_REQUIRE(wpid == fpid);
1918 	ATF_REQUIRE(WIFSTOPPED(status));
1919 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1920 
1921 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1922 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1923 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1924 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1925 
1926 	/* Kill the child process. */
1927 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1928 
1929 	/* The last wait() should report the SIGKILL. */
1930 	wpid = waitpid(fpid, &status, 0);
1931 	ATF_REQUIRE(wpid == fpid);
1932 	ATF_REQUIRE(WIFSIGNALED(status));
1933 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1934 
1935 	wpid = wait(&status);
1936 	ATF_REQUIRE(wpid == -1);
1937 	ATF_REQUIRE(errno == ECHILD);
1938 }
1939 
1940 static void *
1941 mask_usr1_thread(void *arg)
1942 {
1943 	pthread_barrier_t *pbarrier;
1944 	sigset_t sigmask;
1945 
1946 	pbarrier = (pthread_barrier_t*)arg;
1947 
1948 	sigemptyset(&sigmask);
1949 	sigaddset(&sigmask, SIGUSR1);
1950 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1951 
1952 	/* Sync up with other thread after sigmask updated. */
1953 	pthread_barrier_wait(pbarrier);
1954 
1955 	for (;;)
1956 		sleep(60);
1957 
1958 	return (NULL);
1959 }
1960 
1961 /*
1962  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1963  * and prevents spurious stops due to those other signals.
1964  */
1965 ATF_TC(ptrace__PT_KILL_competing_signal);
1966 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1967 {
1968 
1969 	atf_tc_set_md_var(tc, "require.user", "root");
1970 }
1971 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1972 {
1973 	pid_t fpid, wpid;
1974 	int status;
1975 	cpuset_t setmask;
1976 	pthread_t t;
1977 	pthread_barrier_t barrier;
1978 	struct sched_param sched_param;
1979 
1980 	ATF_REQUIRE((fpid = fork()) != -1);
1981 	if (fpid == 0) {
1982 		/* Bind to one CPU so only one thread at a time will run. */
1983 		CPU_ZERO(&setmask);
1984 		CPU_SET(0, &setmask);
1985 		cpusetid_t setid;
1986 		CHILD_REQUIRE(cpuset(&setid) == 0);
1987 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1988 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1989 
1990 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1991 
1992 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1993 		    (void*)&barrier) == 0);
1994 
1995 		/*
1996 		 * Give the main thread higher priority. The test always
1997 		 * assumes that, if both threads are able to run, the main
1998 		 * thread runs first.
1999 		 */
2000 		sched_param.sched_priority =
2001 		    (sched_get_priority_max(SCHED_FIFO) +
2002 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2003 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2004 		    SCHED_FIFO, &sched_param) == 0);
2005 		sched_param.sched_priority -= RQ_PPQ;
2006 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2007 		    &sched_param) == 0);
2008 
2009 		sigset_t sigmask;
2010 		sigemptyset(&sigmask);
2011 		sigaddset(&sigmask, SIGUSR2);
2012 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2013 
2014 		/* Sync up with other thread after sigmask updated. */
2015 		pthread_barrier_wait(&barrier);
2016 
2017 		trace_me();
2018 
2019 		for (;;)
2020 			sleep(60);
2021 
2022 		exit(1);
2023 	}
2024 
2025 	/* The first wait() should report the stop from SIGSTOP. */
2026 	wpid = waitpid(fpid, &status, 0);
2027 	ATF_REQUIRE(wpid == fpid);
2028 	ATF_REQUIRE(WIFSTOPPED(status));
2029 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2030 
2031 	/* Continue the child ignoring the SIGSTOP. */
2032 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2033 
2034 	/* Send a signal that only the second thread can handle. */
2035 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2036 
2037 	/* The second wait() should report the SIGUSR2. */
2038 	wpid = waitpid(fpid, &status, 0);
2039 	ATF_REQUIRE(wpid == fpid);
2040 	ATF_REQUIRE(WIFSTOPPED(status));
2041 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2042 
2043 	/* Send a signal that only the first thread can handle. */
2044 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2045 
2046 	/* Replace the SIGUSR2 with a kill. */
2047 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2048 
2049 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
2050 	wpid = waitpid(fpid, &status, 0);
2051 	ATF_REQUIRE(wpid == fpid);
2052 	ATF_REQUIRE(WIFSIGNALED(status));
2053 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2054 
2055 	wpid = wait(&status);
2056 	ATF_REQUIRE(wpid == -1);
2057 	ATF_REQUIRE(errno == ECHILD);
2058 }
2059 
2060 /*
2061  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
2062  * and prevents spurious stops caused by those events.
2063  */
2064 ATF_TC(ptrace__PT_KILL_competing_stop);
2065 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
2066 {
2067 
2068 	atf_tc_set_md_var(tc, "require.user", "root");
2069 }
2070 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
2071 {
2072 	pid_t fpid, wpid;
2073 	int status;
2074 	cpuset_t setmask;
2075 	pthread_t t;
2076 	pthread_barrier_t barrier;
2077 	lwpid_t main_lwp;
2078 	struct ptrace_lwpinfo pl;
2079 	struct sched_param sched_param;
2080 
2081 	ATF_REQUIRE((fpid = fork()) != -1);
2082 	if (fpid == 0) {
2083 		trace_me();
2084 
2085 		/* Bind to one CPU so only one thread at a time will run. */
2086 		CPU_ZERO(&setmask);
2087 		CPU_SET(0, &setmask);
2088 		cpusetid_t setid;
2089 		CHILD_REQUIRE(cpuset(&setid) == 0);
2090 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2091 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2092 
2093 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2094 
2095 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2096 		    (void*)&barrier) == 0);
2097 
2098 		/*
2099 		 * Give the main thread higher priority. The test always
2100 		 * assumes that, if both threads are able to run, the main
2101 		 * thread runs first.
2102 		 */
2103 		sched_param.sched_priority =
2104 		    (sched_get_priority_max(SCHED_FIFO) +
2105 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2106 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2107 		    SCHED_FIFO, &sched_param) == 0);
2108 		sched_param.sched_priority -= RQ_PPQ;
2109 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2110 		    &sched_param) == 0);
2111 
2112 		sigset_t sigmask;
2113 		sigemptyset(&sigmask);
2114 		sigaddset(&sigmask, SIGUSR2);
2115 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2116 
2117 		/* Sync up with other thread after sigmask updated. */
2118 		pthread_barrier_wait(&barrier);
2119 
2120 		/* Sync up with the test before doing the getpid(). */
2121 		raise(SIGSTOP);
2122 
2123 		getpid();
2124 		exit(1);
2125 	}
2126 
2127 	/* The first wait() should report the stop from SIGSTOP. */
2128 	wpid = waitpid(fpid, &status, 0);
2129 	ATF_REQUIRE(wpid == fpid);
2130 	ATF_REQUIRE(WIFSTOPPED(status));
2131 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2132 
2133 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2134 	main_lwp = pl.pl_lwpid;
2135 
2136 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2137 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2138 
2139 	/*
2140 	 * Continue until child is done with setup, which is indicated with
2141 	 * SIGSTOP. Ignore system calls in the meantime.
2142 	 */
2143 	for (;;) {
2144 		wpid = waitpid(fpid, &status, 0);
2145 		ATF_REQUIRE(wpid == fpid);
2146 		ATF_REQUIRE(WIFSTOPPED(status));
2147 		if (WSTOPSIG(status) == SIGTRAP) {
2148 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2149 			    sizeof(pl)) != -1);
2150 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2151 		} else {
2152 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2153 			break;
2154 		}
2155 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2156 	}
2157 
2158 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2159 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2160 
2161 	wpid = waitpid(fpid, &status, 0);
2162 	ATF_REQUIRE(wpid == fpid);
2163 	ATF_REQUIRE(WIFSTOPPED(status));
2164 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2165 
2166 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2167 	    sizeof(pl)) != -1);
2168 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2169 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2170 	/* Prevent the main thread from hitting its syscall exit for now. */
2171 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2172 
2173 	/*
2174 	 * Proceed, allowing second thread to hit syscall exit for
2175 	 * pthread_barrier_wait().
2176 	 */
2177 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2178 
2179 	wpid = waitpid(fpid, &status, 0);
2180 	ATF_REQUIRE(wpid == fpid);
2181 	ATF_REQUIRE(WIFSTOPPED(status));
2182 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2183 
2184 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2185 	    sizeof(pl)) != -1);
2186 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2187 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2188 
2189 	/* Send a signal that only the second thread can handle. */
2190 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2191 
2192 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2193 
2194 	/* The next wait() should report the SIGUSR2. */
2195 	wpid = waitpid(fpid, &status, 0);
2196 	ATF_REQUIRE(wpid == fpid);
2197 	ATF_REQUIRE(WIFSTOPPED(status));
2198 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2199 
2200 	/* Allow the main thread to try to finish its system call. */
2201 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2202 
2203 	/*
2204 	 * At this point, the main thread is in the middle of a system call and
2205 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2206 	 * be replaced with a SIGKILL below. The main thread will get to run
2207 	 * first. It should notice the kill request (even though the signal
2208 	 * replacement occurred in the other thread) and exit accordingly.  It
2209 	 * should not stop for the system call exit event.
2210 	 */
2211 
2212 	/* Replace the SIGUSR2 with a kill. */
2213 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2214 
2215 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2216 	wpid = waitpid(fpid, &status, 0);
2217 	ATF_REQUIRE(wpid == fpid);
2218 	ATF_REQUIRE(WIFSIGNALED(status));
2219 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2220 
2221 	wpid = wait(&status);
2222 	ATF_REQUIRE(wpid == -1);
2223 	ATF_REQUIRE(errno == ECHILD);
2224 }
2225 
2226 static void
2227 sigusr1_handler(int sig)
2228 {
2229 
2230 	CHILD_REQUIRE(sig == SIGUSR1);
2231 	_exit(2);
2232 }
2233 
2234 /*
2235  * Verify that even if the signal queue is full for a child process,
2236  * a PT_KILL will kill the process.
2237  */
2238 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2239 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2240 {
2241 	pid_t fpid, wpid;
2242 	int status;
2243 	int max_pending_per_proc;
2244 	size_t len;
2245 	int i;
2246 
2247 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2248 
2249 	ATF_REQUIRE((fpid = fork()) != -1);
2250 	if (fpid == 0) {
2251 		trace_me();
2252 		exit(1);
2253 	}
2254 
2255 	/* The first wait() should report the stop from SIGSTOP. */
2256 	wpid = waitpid(fpid, &status, 0);
2257 	ATF_REQUIRE(wpid == fpid);
2258 	ATF_REQUIRE(WIFSTOPPED(status));
2259 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2260 
2261 	len = sizeof(max_pending_per_proc);
2262 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2263 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2264 
2265 	/* Fill the signal queue. */
2266 	for (i = 0; i < max_pending_per_proc; ++i)
2267 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2268 
2269 	/* Kill the child process. */
2270 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2271 
2272 	/* The last wait() should report the SIGKILL. */
2273 	wpid = waitpid(fpid, &status, 0);
2274 	ATF_REQUIRE(wpid == fpid);
2275 	ATF_REQUIRE(WIFSIGNALED(status));
2276 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2277 
2278 	wpid = wait(&status);
2279 	ATF_REQUIRE(wpid == -1);
2280 	ATF_REQUIRE(errno == ECHILD);
2281 }
2282 
2283 /*
2284  * Verify that when stopped at a system call entry, a signal can be
2285  * requested with PT_CONTINUE which will be delivered once the system
2286  * call is complete.
2287  */
2288 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2289 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2290 {
2291 	struct ptrace_lwpinfo pl;
2292 	pid_t fpid, wpid;
2293 	int status;
2294 
2295 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2296 
2297 	ATF_REQUIRE((fpid = fork()) != -1);
2298 	if (fpid == 0) {
2299 		trace_me();
2300 		getpid();
2301 		exit(1);
2302 	}
2303 
2304 	/* The first wait() should report the stop from SIGSTOP. */
2305 	wpid = waitpid(fpid, &status, 0);
2306 	ATF_REQUIRE(wpid == fpid);
2307 	ATF_REQUIRE(WIFSTOPPED(status));
2308 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2309 
2310 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2311 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2312 
2313 	/* The second wait() should report a system call entry for getpid(). */
2314 	wpid = waitpid(fpid, &status, 0);
2315 	ATF_REQUIRE(wpid == fpid);
2316 	ATF_REQUIRE(WIFSTOPPED(status));
2317 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2318 
2319 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2320 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2321 
2322 	/* Continue the child process with a signal. */
2323 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2324 
2325 	for (;;) {
2326 		/*
2327 		 * The last wait() should report exit 2, i.e., a normal _exit
2328 		 * from the signal handler. In the meantime, catch and proceed
2329 		 * past any syscall stops.
2330 		 */
2331 		wpid = waitpid(fpid, &status, 0);
2332 		ATF_REQUIRE(wpid == fpid);
2333 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2334 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2335 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2336 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2337 		} else {
2338 			ATF_REQUIRE(WIFEXITED(status));
2339 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2340 			break;
2341 		}
2342 	}
2343 
2344 	wpid = wait(&status);
2345 	ATF_REQUIRE(wpid == -1);
2346 	ATF_REQUIRE(errno == ECHILD);
2347 }
2348 
2349 static void
2350 sigusr1_counting_handler(int sig)
2351 {
2352 	static int counter = 0;
2353 
2354 	CHILD_REQUIRE(sig == SIGUSR1);
2355 	counter++;
2356 	if (counter == 2)
2357 		_exit(2);
2358 }
2359 
2360 /*
2361  * Verify that, when continuing from a stop at system call entry and exit,
2362  * a signal can be requested from both stops, and both will be delivered when
2363  * the system call is complete.
2364  */
2365 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2366 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2367 {
2368 	struct ptrace_lwpinfo pl;
2369 	pid_t fpid, wpid;
2370 	int status;
2371 
2372 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2373 
2374 	ATF_REQUIRE((fpid = fork()) != -1);
2375 	if (fpid == 0) {
2376 		trace_me();
2377 		getpid();
2378 		exit(1);
2379 	}
2380 
2381 	/* The first wait() should report the stop from SIGSTOP. */
2382 	wpid = waitpid(fpid, &status, 0);
2383 	ATF_REQUIRE(wpid == fpid);
2384 	ATF_REQUIRE(WIFSTOPPED(status));
2385 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2386 
2387 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2388 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2389 
2390 	/* The second wait() should report a system call entry for getpid(). */
2391 	wpid = waitpid(fpid, &status, 0);
2392 	ATF_REQUIRE(wpid == fpid);
2393 	ATF_REQUIRE(WIFSTOPPED(status));
2394 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2395 
2396 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2397 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2398 
2399 	/* Continue the child process with a signal. */
2400 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2401 
2402 	/* The third wait() should report a system call exit for getpid(). */
2403 	wpid = waitpid(fpid, &status, 0);
2404 	ATF_REQUIRE(wpid == fpid);
2405 	ATF_REQUIRE(WIFSTOPPED(status));
2406 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2407 
2408 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2409 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2410 
2411 	/* Continue the child process with a signal. */
2412 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2413 
2414 	for (;;) {
2415 		/*
2416 		 * The last wait() should report exit 2, i.e., a normal _exit
2417 		 * from the signal handler. In the meantime, catch and proceed
2418 		 * past any syscall stops.
2419 		 */
2420 		wpid = waitpid(fpid, &status, 0);
2421 		ATF_REQUIRE(wpid == fpid);
2422 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2423 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2424 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2425 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2426 		} else {
2427 			ATF_REQUIRE(WIFEXITED(status));
2428 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2429 			break;
2430 		}
2431 	}
2432 
2433 	wpid = wait(&status);
2434 	ATF_REQUIRE(wpid == -1);
2435 	ATF_REQUIRE(errno == ECHILD);
2436 }
2437 
2438 /*
2439  * Verify that even if the signal queue is full for a child process,
2440  * a PT_CONTINUE with a signal will not result in loss of that signal.
2441  */
2442 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2443 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2444 {
2445 	pid_t fpid, wpid;
2446 	int status;
2447 	int max_pending_per_proc;
2448 	size_t len;
2449 	int i;
2450 
2451 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2452 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2453 
2454 	ATF_REQUIRE((fpid = fork()) != -1);
2455 	if (fpid == 0) {
2456 		trace_me();
2457 		exit(1);
2458 	}
2459 
2460 	/* The first wait() should report the stop from SIGSTOP. */
2461 	wpid = waitpid(fpid, &status, 0);
2462 	ATF_REQUIRE(wpid == fpid);
2463 	ATF_REQUIRE(WIFSTOPPED(status));
2464 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2465 
2466 	len = sizeof(max_pending_per_proc);
2467 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2468 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2469 
2470 	/* Fill the signal queue. */
2471 	for (i = 0; i < max_pending_per_proc; ++i)
2472 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2473 
2474 	/* Continue with signal. */
2475 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2476 
2477 	for (;;) {
2478 		wpid = waitpid(fpid, &status, 0);
2479 		ATF_REQUIRE(wpid == fpid);
2480 		if (WIFSTOPPED(status)) {
2481 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2482 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2483 		} else {
2484 			/*
2485 			 * The last wait() should report normal _exit from the
2486 			 * SIGUSR1 handler.
2487 			 */
2488 			ATF_REQUIRE(WIFEXITED(status));
2489 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2490 			break;
2491 		}
2492 	}
2493 
2494 	wpid = wait(&status);
2495 	ATF_REQUIRE(wpid == -1);
2496 	ATF_REQUIRE(errno == ECHILD);
2497 }
2498 
2499 static sem_t sigusr1_sem;
2500 static int got_usr1;
2501 
2502 static void
2503 sigusr1_sempost_handler(int sig __unused)
2504 {
2505 
2506 	got_usr1++;
2507 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2508 }
2509 
2510 /*
2511  * Verify that even if the signal queue is full for a child process,
2512  * and the signal is masked, a PT_CONTINUE with a signal will not
2513  * result in loss of that signal.
2514  */
2515 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
2516 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue, tc)
2517 {
2518 	struct ptrace_lwpinfo pl;
2519 	pid_t fpid, wpid;
2520 	int status, err;
2521 	int max_pending_per_proc;
2522 	size_t len;
2523 	int i;
2524 	sigset_t sigmask;
2525 
2526 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2527 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2528 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2529 
2530 	got_usr1 = 0;
2531 	ATF_REQUIRE((fpid = fork()) != -1);
2532 	if (fpid == 0) {
2533 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2534 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2535 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2536 
2537 		trace_me();
2538 		CHILD_REQUIRE(got_usr1 == 0);
2539 
2540 		/* Allow the pending SIGUSR1 in now. */
2541 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2542 		/* Wait to receive the SIGUSR1. */
2543 		do {
2544 			err = sem_wait(&sigusr1_sem);
2545 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2546 		} while (err != 0 && errno == EINTR);
2547 		CHILD_REQUIRE(got_usr1 == 1);
2548 		exit(1);
2549 	}
2550 
2551 	/* The first wait() should report the stop from SIGSTOP. */
2552 	wpid = waitpid(fpid, &status, 0);
2553 	ATF_REQUIRE(wpid == fpid);
2554 	ATF_REQUIRE(WIFSTOPPED(status));
2555 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2556 
2557 	len = sizeof(max_pending_per_proc);
2558 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2559 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2560 
2561 	/* Fill the signal queue. */
2562 	for (i = 0; i < max_pending_per_proc; ++i)
2563 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2564 
2565 	/* Continue with signal. */
2566 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2567 
2568 	/* Collect and ignore all of the SIGUSR2. */
2569 	for (i = 0; i < max_pending_per_proc; ++i) {
2570 		wpid = waitpid(fpid, &status, 0);
2571 		ATF_REQUIRE(wpid == fpid);
2572 		ATF_REQUIRE(WIFSTOPPED(status));
2573 		ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2574 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2575 	}
2576 
2577 	/* Now our PT_CONTINUE'd SIGUSR1 should cause a stop after unmask. */
2578 	wpid = waitpid(fpid, &status, 0);
2579 	ATF_REQUIRE(wpid == fpid);
2580 	ATF_REQUIRE(WIFSTOPPED(status));
2581 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2582 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2583 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2584 
2585 	/* Continue the child, ignoring the SIGUSR1. */
2586 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2587 
2588 	/* The last wait() should report exit after receiving SIGUSR1. */
2589 	wpid = waitpid(fpid, &status, 0);
2590 	ATF_REQUIRE(wpid == fpid);
2591 	ATF_REQUIRE(WIFEXITED(status));
2592 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2593 
2594 	wpid = wait(&status);
2595 	ATF_REQUIRE(wpid == -1);
2596 	ATF_REQUIRE(errno == ECHILD);
2597 }
2598 
2599 /*
2600  * Verify that, after stopping due to a signal, that signal can be
2601  * replaced with another signal.
2602  */
2603 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2604 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2605 {
2606 	struct ptrace_lwpinfo pl;
2607 	pid_t fpid, wpid;
2608 	int status;
2609 
2610 	ATF_REQUIRE((fpid = fork()) != -1);
2611 	if (fpid == 0) {
2612 		trace_me();
2613 		sleep(20);
2614 		exit(1);
2615 	}
2616 
2617 	/* The first wait() should report the stop from SIGSTOP. */
2618 	wpid = waitpid(fpid, &status, 0);
2619 	ATF_REQUIRE(wpid == fpid);
2620 	ATF_REQUIRE(WIFSTOPPED(status));
2621 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2622 
2623 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2624 
2625 	/* Send a signal without ptrace. */
2626 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2627 
2628 	/* The second wait() should report a SIGINT was received. */
2629 	wpid = waitpid(fpid, &status, 0);
2630 	ATF_REQUIRE(wpid == fpid);
2631 	ATF_REQUIRE(WIFSTOPPED(status));
2632 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2633 
2634 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2635 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2636 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2637 
2638 	/* Continue the child process with a different signal. */
2639 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2640 
2641 	/*
2642 	 * The last wait() should report having died due to the new
2643 	 * signal, SIGTERM.
2644 	 */
2645 	wpid = waitpid(fpid, &status, 0);
2646 	ATF_REQUIRE(wpid == fpid);
2647 	ATF_REQUIRE(WIFSIGNALED(status));
2648 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2649 
2650 	wpid = wait(&status);
2651 	ATF_REQUIRE(wpid == -1);
2652 	ATF_REQUIRE(errno == ECHILD);
2653 }
2654 
2655 /*
2656  * Verify that a signal can be passed through to the child even when there
2657  * was no true signal originally. Such cases arise when a SIGTRAP is
2658  * invented for e.g, system call stops.
2659  */
2660 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2661 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2662 {
2663 	struct ptrace_lwpinfo pl;
2664 	struct rlimit rl;
2665 	pid_t fpid, wpid;
2666 	int status;
2667 
2668 	ATF_REQUIRE((fpid = fork()) != -1);
2669 	if (fpid == 0) {
2670 		trace_me();
2671 		/* SIGTRAP expected to cause exit on syscall entry. */
2672 		rl.rlim_cur = rl.rlim_max = 0;
2673 		ATF_REQUIRE(setrlimit(RLIMIT_CORE, &rl) == 0);
2674 		getpid();
2675 		exit(1);
2676 	}
2677 
2678 	/* The first wait() should report the stop from SIGSTOP. */
2679 	wpid = waitpid(fpid, &status, 0);
2680 	ATF_REQUIRE(wpid == fpid);
2681 	ATF_REQUIRE(WIFSTOPPED(status));
2682 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2683 
2684 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2685 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2686 
2687 	/* The second wait() should report a system call entry for getpid(). */
2688 	wpid = waitpid(fpid, &status, 0);
2689 	ATF_REQUIRE(wpid == fpid);
2690 	ATF_REQUIRE(WIFSTOPPED(status));
2691 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2692 
2693 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2694 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2695 
2696 	/* Continue the child process with a SIGTRAP. */
2697 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2698 
2699 	for (;;) {
2700 		/*
2701 		 * The last wait() should report exit due to SIGTRAP.  In the
2702 		 * meantime, catch and proceed past any syscall stops.
2703 		 */
2704 		wpid = waitpid(fpid, &status, 0);
2705 		ATF_REQUIRE(wpid == fpid);
2706 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2707 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2708 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2709 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2710 		} else {
2711 			ATF_REQUIRE(WIFSIGNALED(status));
2712 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2713 			break;
2714 		}
2715 	}
2716 
2717 	wpid = wait(&status);
2718 	ATF_REQUIRE(wpid == -1);
2719 	ATF_REQUIRE(errno == ECHILD);
2720 
2721 }
2722 
2723 /*
2724  * A mixed bag PT_CONTINUE with signal test.
2725  */
2726 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2727 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2728 {
2729 	struct ptrace_lwpinfo pl;
2730 	pid_t fpid, wpid;
2731 	int status;
2732 
2733 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2734 
2735 	ATF_REQUIRE((fpid = fork()) != -1);
2736 	if (fpid == 0) {
2737 		trace_me();
2738 		getpid();
2739 		exit(1);
2740 	}
2741 
2742 	/* The first wait() should report the stop from SIGSTOP. */
2743 	wpid = waitpid(fpid, &status, 0);
2744 	ATF_REQUIRE(wpid == fpid);
2745 	ATF_REQUIRE(WIFSTOPPED(status));
2746 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2747 
2748 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2749 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2750 
2751 	/* The second wait() should report a system call entry for getpid(). */
2752 	wpid = waitpid(fpid, &status, 0);
2753 	ATF_REQUIRE(wpid == fpid);
2754 	ATF_REQUIRE(WIFSTOPPED(status));
2755 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2756 
2757 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2758 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2759 
2760 	/* Continue with the first SIGUSR1. */
2761 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2762 
2763 	/* The next wait() should report a system call exit for getpid(). */
2764 	wpid = waitpid(fpid, &status, 0);
2765 	ATF_REQUIRE(wpid == fpid);
2766 	ATF_REQUIRE(WIFSTOPPED(status));
2767 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2768 
2769 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2770 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2771 
2772 	/* Send an ABRT without ptrace. */
2773 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2774 
2775 	/* Continue normally. */
2776 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2777 
2778 	/* The next wait() should report the SIGABRT. */
2779 	wpid = waitpid(fpid, &status, 0);
2780 	ATF_REQUIRE(wpid == fpid);
2781 	ATF_REQUIRE(WIFSTOPPED(status));
2782 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2783 
2784 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2785 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2786 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2787 
2788 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2789 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2790 
2791 	for (;;) {
2792 		/*
2793 		 * The last wait() should report exit 2, i.e., a normal _exit
2794 		 * from the signal handler. In the meantime, catch and proceed
2795 		 * past any syscall stops.
2796 		 */
2797 		wpid = waitpid(fpid, &status, 0);
2798 		ATF_REQUIRE(wpid == fpid);
2799 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2800 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2801 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2802 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2803 		} else {
2804 			ATF_REQUIRE(WIFEXITED(status));
2805 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2806 			break;
2807 		}
2808 	}
2809 
2810 	wpid = wait(&status);
2811 	ATF_REQUIRE(wpid == -1);
2812 	ATF_REQUIRE(errno == ECHILD);
2813 
2814 }
2815 
2816 /*
2817  * Verify a signal delivered by ptrace is noticed by kevent(2).
2818  */
2819 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2820 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2821 {
2822 	pid_t fpid, wpid;
2823 	int status, kq, nevents;
2824 	struct kevent kev;
2825 
2826 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2827 
2828 	ATF_REQUIRE((fpid = fork()) != -1);
2829 	if (fpid == 0) {
2830 		CHILD_REQUIRE((kq = kqueue()) > 0);
2831 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2832 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2833 
2834 		trace_me();
2835 
2836 		for (;;) {
2837 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2838 			if (nevents == -1 && errno == EINTR)
2839 				continue;
2840 			CHILD_REQUIRE(nevents > 0);
2841 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2842 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2843 			break;
2844 		}
2845 
2846 		exit(1);
2847 	}
2848 
2849 	/* The first wait() should report the stop from SIGSTOP. */
2850 	wpid = waitpid(fpid, &status, 0);
2851 	ATF_REQUIRE(wpid == fpid);
2852 	ATF_REQUIRE(WIFSTOPPED(status));
2853 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2854 
2855 	/* Continue with the SIGUSR1. */
2856 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2857 
2858 	/*
2859 	 * The last wait() should report normal exit with code 1.
2860 	 */
2861 	wpid = waitpid(fpid, &status, 0);
2862 	ATF_REQUIRE(wpid == fpid);
2863 	ATF_REQUIRE(WIFEXITED(status));
2864 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2865 
2866 	wpid = wait(&status);
2867 	ATF_REQUIRE(wpid == -1);
2868 	ATF_REQUIRE(errno == ECHILD);
2869 }
2870 
2871 static void *
2872 signal_thread(void *arg)
2873 {
2874 	int err;
2875 	sigset_t sigmask;
2876 
2877 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2878 
2879 	/* Wait for this thread to receive a SIGUSR1. */
2880 	do {
2881 		err = sem_wait(&sigusr1_sem);
2882 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2883 	} while (err != 0 && errno == EINTR);
2884 
2885 	/* Free our companion thread from the barrier. */
2886 	pthread_barrier_wait(pbarrier);
2887 
2888 	/*
2889 	 * Swap ignore duties; the next SIGUSR1 should go to the
2890 	 * other thread.
2891 	 */
2892 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2893 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2894 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2895 
2896 	/* Sync up threads after swapping signal masks. */
2897 	pthread_barrier_wait(pbarrier);
2898 
2899 	/* Wait until our companion has received its SIGUSR1. */
2900 	pthread_barrier_wait(pbarrier);
2901 
2902 	return (NULL);
2903 }
2904 
2905 /*
2906  * Verify that a traced process with blocked signal received the
2907  * signal from kill() once unmasked.
2908  */
2909 ATF_TC_WITHOUT_HEAD(ptrace__killed_with_sigmask);
2910 ATF_TC_BODY(ptrace__killed_with_sigmask, tc)
2911 {
2912 	struct ptrace_lwpinfo pl;
2913 	pid_t fpid, wpid;
2914 	int status, err;
2915 	sigset_t sigmask;
2916 
2917 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2918 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2919 	got_usr1 = 0;
2920 
2921 	ATF_REQUIRE((fpid = fork()) != -1);
2922 	if (fpid == 0) {
2923 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2924 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2925 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2926 
2927 		trace_me();
2928 		CHILD_REQUIRE(got_usr1 == 0);
2929 
2930 		/* Allow the pending SIGUSR1 in now. */
2931 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2932 		/* Wait to receive a SIGUSR1. */
2933 		do {
2934 			err = sem_wait(&sigusr1_sem);
2935 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2936 		} while (err != 0 && errno == EINTR);
2937 		CHILD_REQUIRE(got_usr1 == 1);
2938 		exit(1);
2939 	}
2940 
2941 	/* The first wait() should report the stop from SIGSTOP. */
2942 	wpid = waitpid(fpid, &status, 0);
2943 	ATF_REQUIRE(wpid == fpid);
2944 	ATF_REQUIRE(WIFSTOPPED(status));
2945 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2946 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2947 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2948 
2949 	/* Send blocked SIGUSR1 which should cause a stop. */
2950 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2951 
2952 	/* Continue the child ignoring the SIGSTOP. */
2953 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2954 
2955 	/* The next wait() should report the kill(SIGUSR1) was received. */
2956 	wpid = waitpid(fpid, &status, 0);
2957 	ATF_REQUIRE(wpid == fpid);
2958 	ATF_REQUIRE(WIFSTOPPED(status));
2959 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2960 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2961 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2962 
2963 	/* Continue the child, allowing in the SIGUSR1. */
2964 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2965 
2966 	/* The last wait() should report normal exit with code 1. */
2967 	wpid = waitpid(fpid, &status, 0);
2968 	ATF_REQUIRE(wpid == fpid);
2969 	ATF_REQUIRE(WIFEXITED(status));
2970 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2971 
2972 	wpid = wait(&status);
2973 	ATF_REQUIRE(wpid == -1);
2974 	ATF_REQUIRE(errno == ECHILD);
2975 }
2976 
2977 /*
2978  * Verify that a traced process with blocked signal received the
2979  * signal from PT_CONTINUE once unmasked.
2980  */
2981 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigmask);
2982 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigmask, tc)
2983 {
2984 	struct ptrace_lwpinfo pl;
2985 	pid_t fpid, wpid;
2986 	int status, err;
2987 	sigset_t sigmask;
2988 
2989 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2990 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2991 	got_usr1 = 0;
2992 
2993 	ATF_REQUIRE((fpid = fork()) != -1);
2994 	if (fpid == 0) {
2995 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2996 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2997 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2998 
2999 		trace_me();
3000 		CHILD_REQUIRE(got_usr1 == 0);
3001 
3002 		/* Allow the pending SIGUSR1 in now. */
3003 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3004 		/* Wait to receive a SIGUSR1. */
3005 		do {
3006 			err = sem_wait(&sigusr1_sem);
3007 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3008 		} while (err != 0 && errno == EINTR);
3009 
3010 		CHILD_REQUIRE(got_usr1 == 1);
3011 		exit(1);
3012 	}
3013 
3014 	/* The first wait() should report the stop from SIGSTOP. */
3015 	wpid = waitpid(fpid, &status, 0);
3016 	ATF_REQUIRE(wpid == fpid);
3017 	ATF_REQUIRE(WIFSTOPPED(status));
3018 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3019 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
3020 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
3021 
3022 	/* Continue the child replacing SIGSTOP with SIGUSR1. */
3023 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3024 
3025 	/* The next wait() should report the SIGUSR1 was received. */
3026 	wpid = waitpid(fpid, &status, 0);
3027 	ATF_REQUIRE(wpid == fpid);
3028 	ATF_REQUIRE(WIFSTOPPED(status));
3029 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
3030 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
3031 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
3032 
3033 	/* Continue the child, ignoring the SIGUSR1. */
3034 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3035 
3036 	/* The last wait() should report normal exit with code 1. */
3037 	wpid = waitpid(fpid, &status, 0);
3038 	ATF_REQUIRE(wpid == fpid);
3039 	ATF_REQUIRE(WIFEXITED(status));
3040 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3041 
3042 	wpid = wait(&status);
3043 	ATF_REQUIRE(wpid == -1);
3044 	ATF_REQUIRE(errno == ECHILD);
3045 }
3046 
3047 /*
3048  * Verify that if ptrace stops due to a signal but continues with
3049  * a different signal that the new signal is routed to a thread
3050  * that can accept it, and that the thread is awakened by the signal
3051  * in a timely manner.
3052  */
3053 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3054 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
3055 {
3056 	pid_t fpid, wpid;
3057 	int status, err;
3058 	pthread_t t;
3059 	sigset_t sigmask;
3060 	pthread_barrier_t barrier;
3061 
3062 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
3063 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
3064 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
3065 
3066 	ATF_REQUIRE((fpid = fork()) != -1);
3067 	if (fpid == 0) {
3068 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
3069 
3070 		/* The other thread should receive the first SIGUSR1. */
3071 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
3072 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
3073 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
3074 
3075 		trace_me();
3076 
3077 		/* Wait until other thread has received its SIGUSR1. */
3078 		pthread_barrier_wait(&barrier);
3079 
3080 		/*
3081 		 * Swap ignore duties; the next SIGUSR1 should go to this
3082 		 * thread.
3083 		 */
3084 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3085 
3086 		/* Sync up threads after swapping signal masks. */
3087 		pthread_barrier_wait(&barrier);
3088 
3089 		/*
3090 		 * Sync up with test code; we're ready for the next SIGUSR1
3091 		 * now.
3092 		 */
3093 		raise(SIGSTOP);
3094 
3095 		/* Wait for this thread to receive a SIGUSR1. */
3096 		do {
3097 			err = sem_wait(&sigusr1_sem);
3098 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3099 		} while (err != 0 && errno == EINTR);
3100 
3101 		/* Free the other thread from the barrier. */
3102 		pthread_barrier_wait(&barrier);
3103 
3104 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
3105 
3106 		exit(1);
3107 	}
3108 
3109 	/* The first wait() should report the stop from SIGSTOP. */
3110 	wpid = waitpid(fpid, &status, 0);
3111 	ATF_REQUIRE(wpid == fpid);
3112 	ATF_REQUIRE(WIFSTOPPED(status));
3113 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3114 
3115 	/* Continue the child ignoring the SIGSTOP. */
3116 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3117 
3118 	/*
3119 	 * Send a signal without ptrace that either thread will accept (USR2,
3120 	 * in this case).
3121 	 */
3122 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3123 
3124 	/* The second wait() should report a SIGUSR2 was received. */
3125 	wpid = waitpid(fpid, &status, 0);
3126 	ATF_REQUIRE(wpid == fpid);
3127 	ATF_REQUIRE(WIFSTOPPED(status));
3128 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3129 
3130 	/* Continue the child, changing the signal to USR1. */
3131 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3132 
3133 	/* The next wait() should report the stop from SIGSTOP. */
3134 	wpid = waitpid(fpid, &status, 0);
3135 	ATF_REQUIRE(wpid == fpid);
3136 	ATF_REQUIRE(WIFSTOPPED(status));
3137 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3138 
3139 	/* Continue the child ignoring the SIGSTOP. */
3140 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3141 
3142 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3143 
3144 	/* The next wait() should report a SIGUSR2 was received. */
3145 	wpid = waitpid(fpid, &status, 0);
3146 	ATF_REQUIRE(wpid == fpid);
3147 	ATF_REQUIRE(WIFSTOPPED(status));
3148 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3149 
3150 	/* Continue the child, changing the signal to USR1. */
3151 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3152 
3153 	/* The last wait() should report normal exit with code 1. */
3154 	wpid = waitpid(fpid, &status, 0);
3155 	ATF_REQUIRE(wpid == fpid);
3156 	ATF_REQUIRE(WIFEXITED(status));
3157 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3158 
3159 	wpid = wait(&status);
3160 	ATF_REQUIRE(wpid == -1);
3161 	ATF_REQUIRE(errno == ECHILD);
3162 }
3163 
3164 static void *
3165 raise_sigstop_thread(void *arg __unused)
3166 {
3167 
3168 	raise(SIGSTOP);
3169 	return NULL;
3170 }
3171 
3172 static void *
3173 sleep_thread(void *arg __unused)
3174 {
3175 
3176 	sleep(60);
3177 	return NULL;
3178 }
3179 
3180 static void
3181 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
3182 {
3183 	pid_t fpid, wpid;
3184 	int status, i;
3185 	cpuset_t setmask;
3186 	cpusetid_t setid;
3187 	pthread_t t;
3188 
3189 	/*
3190 	 * Become the reaper for this process tree. We need to be able to check
3191 	 * that both child and grandchild have died.
3192 	 */
3193 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
3194 
3195 	fpid = fork();
3196 	ATF_REQUIRE(fpid >= 0);
3197 	if (fpid == 0) {
3198 		fpid = fork();
3199 		CHILD_REQUIRE(fpid >= 0);
3200 		if (fpid == 0) {
3201 			trace_me();
3202 
3203 			/* Pin to CPU 0 to serialize thread execution. */
3204 			CPU_ZERO(&setmask);
3205 			CPU_SET(0, &setmask);
3206 			CHILD_REQUIRE(cpuset(&setid) == 0);
3207 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
3208 			    CPU_WHICH_CPUSET, setid,
3209 			    sizeof(setmask), &setmask) == 0);
3210 
3211 			if (sigstop_from_main_thread) {
3212 				/*
3213 				 * We expect the SIGKILL sent when our parent
3214 				 * dies to be delivered to the new thread.
3215 				 * Raise the SIGSTOP in this thread so the
3216 				 * threads compete.
3217 				 */
3218 				CHILD_REQUIRE(pthread_create(&t, NULL,
3219 				    sleep_thread, NULL) == 0);
3220 				raise(SIGSTOP);
3221 			} else {
3222 				/*
3223 				 * We expect the SIGKILL to be delivered to
3224 				 * this thread. After creating the new thread,
3225 				 * just get off the CPU so the other thread can
3226 				 * raise the SIGSTOP.
3227 				 */
3228 				CHILD_REQUIRE(pthread_create(&t, NULL,
3229 				    raise_sigstop_thread, NULL) == 0);
3230 				sleep(60);
3231 			}
3232 
3233 			exit(0);
3234 		}
3235 		/* First stop is trace_me() immediately after fork. */
3236 		wpid = waitpid(fpid, &status, 0);
3237 		CHILD_REQUIRE(wpid == fpid);
3238 		CHILD_REQUIRE(WIFSTOPPED(status));
3239 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3240 
3241 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3242 
3243 		/* Second stop is from the raise(SIGSTOP). */
3244 		wpid = waitpid(fpid, &status, 0);
3245 		CHILD_REQUIRE(wpid == fpid);
3246 		CHILD_REQUIRE(WIFSTOPPED(status));
3247 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3248 
3249 		/*
3250 		 * Terminate tracing process without detaching. Our child
3251 		 * should be killed.
3252 		 */
3253 		exit(0);
3254 	}
3255 
3256 	/*
3257 	 * We should get a normal exit from our immediate child and a SIGKILL
3258 	 * exit from our grandchild. The latter case is the interesting one.
3259 	 * Our grandchild should not have stopped due to the SIGSTOP that was
3260 	 * left dangling when its parent died.
3261 	 */
3262 	for (i = 0; i < 2; ++i) {
3263 		wpid = wait(&status);
3264 		if (wpid == fpid)
3265 			ATF_REQUIRE(WIFEXITED(status) &&
3266 			    WEXITSTATUS(status) == 0);
3267 		else
3268 			ATF_REQUIRE(WIFSIGNALED(status) &&
3269 			    WTERMSIG(status) == SIGKILL);
3270 	}
3271 }
3272 
3273 /*
3274  * These two tests ensure that if the tracing process exits without detaching
3275  * just after the child received a SIGSTOP, the child is cleanly killed and
3276  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
3277  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
3278  * different threads, the SIGKILL must win.  There are two variants of this
3279  * test, designed to catch the case where the SIGKILL is delivered to the
3280  * younger thread (the first test) and the case where the SIGKILL is delivered
3281  * to the older thread (the second test). This behavior has changed in the
3282  * past, so make no assumption.
3283  */
3284 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
3285 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
3286 {
3287 
3288 	atf_tc_set_md_var(tc, "require.user", "root");
3289 }
3290 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
3291 {
3292 
3293 	terminate_with_pending_sigstop(true);
3294 }
3295 
3296 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
3297 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
3298 {
3299 
3300 	atf_tc_set_md_var(tc, "require.user", "root");
3301 }
3302 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
3303 {
3304 
3305 	terminate_with_pending_sigstop(false);
3306 }
3307 
3308 /*
3309  * Verify that after ptrace() discards a SIGKILL signal, the event mask
3310  * is not modified.
3311  */
3312 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
3313 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
3314 {
3315 	struct ptrace_lwpinfo pl;
3316 	pid_t fpid, wpid;
3317 	int status, event_mask, new_event_mask;
3318 
3319 	ATF_REQUIRE((fpid = fork()) != -1);
3320 	if (fpid == 0) {
3321 		trace_me();
3322 		raise(SIGSTOP);
3323 		exit(0);
3324 	}
3325 
3326 	/* The first wait() should report the stop from trace_me(). */
3327 	wpid = waitpid(fpid, &status, 0);
3328 	ATF_REQUIRE(wpid == fpid);
3329 	ATF_REQUIRE(WIFSTOPPED(status));
3330 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3331 
3332 	/* Set several unobtrusive event bits. */
3333 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3334 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3335 	    sizeof(event_mask)) == 0);
3336 
3337 	/* Send a SIGKILL without using ptrace. */
3338 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
3339 
3340 	/* Continue the child ignoring the SIGSTOP. */
3341 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3342 
3343 	/* The next stop should be due to the SIGKILL. */
3344 	wpid = waitpid(fpid, &status, 0);
3345 	ATF_REQUIRE(wpid == fpid);
3346 	ATF_REQUIRE(WIFSTOPPED(status));
3347 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
3348 
3349 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3350 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3351 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
3352 
3353 	/* Continue the child ignoring the SIGKILL. */
3354 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3355 
3356 	/* The next wait() should report the stop from SIGSTOP. */
3357 	wpid = waitpid(fpid, &status, 0);
3358 	ATF_REQUIRE(wpid == fpid);
3359 	ATF_REQUIRE(WIFSTOPPED(status));
3360 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3361 
3362 	/* Check the current event mask. It should not have changed. */
3363 	new_event_mask = 0;
3364 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3365 	    sizeof(new_event_mask)) == 0);
3366 	ATF_REQUIRE(event_mask == new_event_mask);
3367 
3368 	/* Continue the child to let it exit. */
3369 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3370 
3371 	/* The last event should be for the child process's exit. */
3372 	wpid = waitpid(fpid, &status, 0);
3373 	ATF_REQUIRE(WIFEXITED(status));
3374 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3375 
3376 	wpid = wait(&status);
3377 	ATF_REQUIRE(wpid == -1);
3378 	ATF_REQUIRE(errno == ECHILD);
3379 }
3380 
3381 static void *
3382 flock_thread(void *arg)
3383 {
3384 	int fd;
3385 
3386 	fd = *(int *)arg;
3387 	(void)flock(fd, LOCK_EX);
3388 	(void)flock(fd, LOCK_UN);
3389 	return (NULL);
3390 }
3391 
3392 /*
3393  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3394  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3395  * on a lock. This is a regression test for r318191.
3396  */
3397 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3398 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3399 {
3400 	pthread_barrier_t barrier;
3401 	pthread_barrierattr_t battr;
3402 	char tmpfile[64];
3403 	pid_t child, wpid;
3404 	int error, fd, i, status;
3405 
3406 	ATF_REQUIRE(pthread_barrierattr_init(&battr) == 0);
3407 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3408 	    PTHREAD_PROCESS_SHARED) == 0);
3409 	ATF_REQUIRE(pthread_barrier_init(&barrier, &battr, 2) == 0);
3410 
3411 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3412 	fd = mkstemp(tmpfile);
3413 	ATF_REQUIRE(fd >= 0);
3414 
3415 	ATF_REQUIRE((child = fork()) != -1);
3416 	if (child == 0) {
3417 		pthread_t t[2];
3418 		int cfd;
3419 
3420 		error = pthread_barrier_wait(&barrier);
3421 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3422 			_exit(1);
3423 
3424 		cfd = open(tmpfile, O_RDONLY);
3425 		if (cfd < 0)
3426 			_exit(1);
3427 
3428 		/*
3429 		 * We want at least two threads blocked on the file lock since
3430 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3431 		 * sleep.
3432 		 */
3433 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3434 			_exit(1);
3435 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3436 			_exit(1);
3437 		if (pthread_join(t[0], NULL) != 0)
3438 			_exit(1);
3439 		if (pthread_join(t[1], NULL) != 0)
3440 			_exit(1);
3441 		_exit(0);
3442 	}
3443 
3444 	ATF_REQUIRE(flock(fd, LOCK_EX) == 0);
3445 
3446 	error = pthread_barrier_wait(&barrier);
3447 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3448 
3449 	/*
3450 	 * Give the child some time to block. Is there a better way to do this?
3451 	 */
3452 	sleep(1);
3453 
3454 	/*
3455 	 * Attach and give the child 3 seconds to stop.
3456 	 */
3457 	ATF_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) == 0);
3458 	for (i = 0; i < 3; i++) {
3459 		wpid = waitpid(child, &status, WNOHANG);
3460 		if (wpid == child && WIFSTOPPED(status) &&
3461 		    WSTOPSIG(status) == SIGSTOP)
3462 			break;
3463 		sleep(1);
3464 	}
3465 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3466 
3467 	ATF_REQUIRE(ptrace(PT_DETACH, child, NULL, 0) == 0);
3468 
3469 	ATF_REQUIRE(flock(fd, LOCK_UN) == 0);
3470 	ATF_REQUIRE(unlink(tmpfile) == 0);
3471 	ATF_REQUIRE(close(fd) == 0);
3472 }
3473 
3474 static void
3475 sigusr1_step_handler(int sig)
3476 {
3477 
3478 	CHILD_REQUIRE(sig == SIGUSR1);
3479 	raise(SIGABRT);
3480 }
3481 
3482 /*
3483  * Verify that PT_STEP with a signal invokes the signal before
3484  * stepping the next instruction (and that the next instruction is
3485  * stepped correctly).
3486  */
3487 ATF_TC_WITHOUT_HEAD(ptrace__PT_STEP_with_signal);
3488 ATF_TC_BODY(ptrace__PT_STEP_with_signal, tc)
3489 {
3490 	struct ptrace_lwpinfo pl;
3491 	pid_t fpid, wpid;
3492 	int status;
3493 
3494 	ATF_REQUIRE((fpid = fork()) != -1);
3495 	if (fpid == 0) {
3496 		trace_me();
3497 		signal(SIGUSR1, sigusr1_step_handler);
3498 		raise(SIGABRT);
3499 		exit(1);
3500 	}
3501 
3502 	/* The first wait() should report the stop from SIGSTOP. */
3503 	wpid = waitpid(fpid, &status, 0);
3504 	ATF_REQUIRE(wpid == fpid);
3505 	ATF_REQUIRE(WIFSTOPPED(status));
3506 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3507 
3508 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3509 
3510 	/* The next stop should report the SIGABRT in the child body. */
3511 	wpid = waitpid(fpid, &status, 0);
3512 	ATF_REQUIRE(wpid == fpid);
3513 	ATF_REQUIRE(WIFSTOPPED(status));
3514 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3515 
3516 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3517 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3518 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3519 
3520 	/* Step the child process inserting SIGUSR1. */
3521 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, SIGUSR1) == 0);
3522 
3523 	/* The next stop should report the SIGABRT in the signal handler. */
3524 	wpid = waitpid(fpid, &status, 0);
3525 	ATF_REQUIRE(wpid == fpid);
3526 	ATF_REQUIRE(WIFSTOPPED(status));
3527 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3528 
3529 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3530 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3531 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3532 
3533 	/* Continue the child process discarding the signal. */
3534 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3535 
3536 	/* The next stop should report a trace trap from PT_STEP. */
3537 	wpid = waitpid(fpid, &status, 0);
3538 	ATF_REQUIRE(wpid == fpid);
3539 	ATF_REQUIRE(WIFSTOPPED(status));
3540 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3541 
3542 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3543 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3544 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3545 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3546 
3547 	/* Continue the child to let it exit. */
3548 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3549 
3550 	/* The last event should be for the child process's exit. */
3551 	wpid = waitpid(fpid, &status, 0);
3552 	ATF_REQUIRE(WIFEXITED(status));
3553 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3554 
3555 	wpid = wait(&status);
3556 	ATF_REQUIRE(wpid == -1);
3557 	ATF_REQUIRE(errno == ECHILD);
3558 }
3559 
3560 #ifdef HAVE_BREAKPOINT
3561 /*
3562  * Verify that a SIGTRAP event with the TRAP_BRKPT code is reported
3563  * for a breakpoint trap.
3564  */
3565 ATF_TC_WITHOUT_HEAD(ptrace__breakpoint_siginfo);
3566 ATF_TC_BODY(ptrace__breakpoint_siginfo, tc)
3567 {
3568 	struct ptrace_lwpinfo pl;
3569 	pid_t fpid, wpid;
3570 	int status;
3571 
3572 	ATF_REQUIRE((fpid = fork()) != -1);
3573 	if (fpid == 0) {
3574 		trace_me();
3575 		breakpoint();
3576 		exit(1);
3577 	}
3578 
3579 	/* The first wait() should report the stop from SIGSTOP. */
3580 	wpid = waitpid(fpid, &status, 0);
3581 	ATF_REQUIRE(wpid == fpid);
3582 	ATF_REQUIRE(WIFSTOPPED(status));
3583 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3584 
3585 	/* Continue the child ignoring the SIGSTOP. */
3586 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3587 
3588 	/* The second wait() should report hitting the breakpoint. */
3589 	wpid = waitpid(fpid, &status, 0);
3590 	ATF_REQUIRE(wpid == fpid);
3591 	ATF_REQUIRE(WIFSTOPPED(status));
3592 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3593 
3594 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3595 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3596 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3597 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_BRKPT);
3598 
3599 	/* Kill the child process. */
3600 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
3601 
3602 	/* The last wait() should report the SIGKILL. */
3603 	wpid = waitpid(fpid, &status, 0);
3604 	ATF_REQUIRE(wpid == fpid);
3605 	ATF_REQUIRE(WIFSIGNALED(status));
3606 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
3607 
3608 	wpid = wait(&status);
3609 	ATF_REQUIRE(wpid == -1);
3610 	ATF_REQUIRE(errno == ECHILD);
3611 }
3612 #endif /* HAVE_BREAKPOINT */
3613 
3614 /*
3615  * Verify that a SIGTRAP event with the TRAP_TRACE code is reported
3616  * for a single-step trap from PT_STEP.
3617  */
3618 ATF_TC_WITHOUT_HEAD(ptrace__step_siginfo);
3619 ATF_TC_BODY(ptrace__step_siginfo, tc)
3620 {
3621 	struct ptrace_lwpinfo pl;
3622 	pid_t fpid, wpid;
3623 	int status;
3624 
3625 	ATF_REQUIRE((fpid = fork()) != -1);
3626 	if (fpid == 0) {
3627 		trace_me();
3628 		exit(1);
3629 	}
3630 
3631 	/* The first wait() should report the stop from SIGSTOP. */
3632 	wpid = waitpid(fpid, &status, 0);
3633 	ATF_REQUIRE(wpid == fpid);
3634 	ATF_REQUIRE(WIFSTOPPED(status));
3635 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3636 
3637 	/* Step the child ignoring the SIGSTOP. */
3638 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, 0) == 0);
3639 
3640 	/* The second wait() should report a single-step trap. */
3641 	wpid = waitpid(fpid, &status, 0);
3642 	ATF_REQUIRE(wpid == fpid);
3643 	ATF_REQUIRE(WIFSTOPPED(status));
3644 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3645 
3646 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3647 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3648 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3649 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3650 
3651 	/* Continue the child process. */
3652 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3653 
3654 	/* The last event should be for the child process's exit. */
3655 	wpid = waitpid(fpid, &status, 0);
3656 	ATF_REQUIRE(WIFEXITED(status));
3657 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3658 
3659 	wpid = wait(&status);
3660 	ATF_REQUIRE(wpid == -1);
3661 	ATF_REQUIRE(errno == ECHILD);
3662 }
3663 
3664 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3665 static void *
3666 continue_thread(void *arg __unused)
3667 {
3668 	breakpoint();
3669 	return (NULL);
3670 }
3671 
3672 static __dead2 void
3673 continue_thread_main(void)
3674 {
3675 	pthread_t threads[2];
3676 
3677 	CHILD_REQUIRE(pthread_create(&threads[0], NULL, continue_thread,
3678 	    NULL) == 0);
3679 	CHILD_REQUIRE(pthread_create(&threads[1], NULL, continue_thread,
3680 	    NULL) == 0);
3681 	CHILD_REQUIRE(pthread_join(threads[0], NULL) == 0);
3682 	CHILD_REQUIRE(pthread_join(threads[1], NULL) == 0);
3683 	exit(1);
3684 }
3685 
3686 /*
3687  * Ensure that PT_CONTINUE clears the status of the thread that
3688  * triggered the stop even if a different thread's LWP was passed to
3689  * PT_CONTINUE.
3690  */
3691 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_different_thread);
3692 ATF_TC_BODY(ptrace__PT_CONTINUE_different_thread, tc)
3693 {
3694 	struct ptrace_lwpinfo pl;
3695 	pid_t fpid, wpid;
3696 	lwpid_t lwps[2];
3697 	bool hit_break[2];
3698 	struct reg reg;
3699 	int i, j, status;
3700 
3701 	ATF_REQUIRE((fpid = fork()) != -1);
3702 	if (fpid == 0) {
3703 		trace_me();
3704 		continue_thread_main();
3705 	}
3706 
3707 	/* The first wait() should report the stop from SIGSTOP. */
3708 	wpid = waitpid(fpid, &status, 0);
3709 	ATF_REQUIRE(wpid == fpid);
3710 	ATF_REQUIRE(WIFSTOPPED(status));
3711 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3712 
3713 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3714 	    sizeof(pl)) != -1);
3715 
3716 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
3717 
3718 	/* Continue the child ignoring the SIGSTOP. */
3719 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3720 
3721 	/* One of the new threads should report it's birth. */
3722 	wpid = waitpid(fpid, &status, 0);
3723 	ATF_REQUIRE(wpid == fpid);
3724 	ATF_REQUIRE(WIFSTOPPED(status));
3725 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3726 
3727 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3728 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3729 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3730 	lwps[0] = pl.pl_lwpid;
3731 
3732 	/*
3733 	 * Suspend this thread to ensure both threads are alive before
3734 	 * hitting the breakpoint.
3735 	 */
3736 	ATF_REQUIRE(ptrace(PT_SUSPEND, lwps[0], NULL, 0) != -1);
3737 
3738 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3739 
3740 	/* Second thread should report it's birth. */
3741 	wpid = waitpid(fpid, &status, 0);
3742 	ATF_REQUIRE(wpid == fpid);
3743 	ATF_REQUIRE(WIFSTOPPED(status));
3744 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3745 
3746 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3747 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3748 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3749 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
3750 	lwps[1] = pl.pl_lwpid;
3751 
3752 	/* Resume both threads waiting for breakpoint events. */
3753 	hit_break[0] = hit_break[1] = false;
3754 	ATF_REQUIRE(ptrace(PT_RESUME, lwps[0], NULL, 0) != -1);
3755 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3756 
3757 	/* One thread should report a breakpoint. */
3758 	wpid = waitpid(fpid, &status, 0);
3759 	ATF_REQUIRE(wpid == fpid);
3760 	ATF_REQUIRE(WIFSTOPPED(status));
3761 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3762 
3763 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3764 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3765 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3766 	    pl.pl_siginfo.si_code == TRAP_BRKPT);
3767 	if (pl.pl_lwpid == lwps[0])
3768 		i = 0;
3769 	else
3770 		i = 1;
3771 	hit_break[i] = true;
3772 	ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3773 	SKIP_BREAK(&reg);
3774 	ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3775 
3776 	/*
3777 	 * Resume both threads but pass the other thread's LWPID to
3778 	 * PT_CONTINUE.
3779 	 */
3780 	ATF_REQUIRE(ptrace(PT_CONTINUE, lwps[i ^ 1], (caddr_t)1, 0) == 0);
3781 
3782 	/*
3783 	 * Will now get two thread exit events and one more breakpoint
3784 	 * event.
3785 	 */
3786 	for (j = 0; j < 3; j++) {
3787 		wpid = waitpid(fpid, &status, 0);
3788 		ATF_REQUIRE(wpid == fpid);
3789 		ATF_REQUIRE(WIFSTOPPED(status));
3790 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3791 
3792 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3793 		    sizeof(pl)) != -1);
3794 
3795 		if (pl.pl_lwpid == lwps[0])
3796 			i = 0;
3797 		else
3798 			i = 1;
3799 
3800 		ATF_REQUIRE_MSG(lwps[i] != 0, "event for exited thread");
3801 		if (pl.pl_flags & PL_FLAG_EXITED) {
3802 			ATF_REQUIRE_MSG(hit_break[i],
3803 			    "exited thread did not report breakpoint");
3804 			lwps[i] = 0;
3805 		} else {
3806 			ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3807 			ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3808 			    pl.pl_siginfo.si_code == TRAP_BRKPT);
3809 			ATF_REQUIRE_MSG(!hit_break[i],
3810 			    "double breakpoint event");
3811 			hit_break[i] = true;
3812 			ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg,
3813 			    0) != -1);
3814 			SKIP_BREAK(&reg);
3815 			ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg,
3816 			    0) != -1);
3817 		}
3818 
3819 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3820 	}
3821 
3822 	/* Both threads should have exited. */
3823 	ATF_REQUIRE(lwps[0] == 0);
3824 	ATF_REQUIRE(lwps[1] == 0);
3825 
3826 	/* The last event should be for the child process's exit. */
3827 	wpid = waitpid(fpid, &status, 0);
3828 	ATF_REQUIRE(WIFEXITED(status));
3829 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3830 
3831 	wpid = wait(&status);
3832 	ATF_REQUIRE(wpid == -1);
3833 	ATF_REQUIRE(errno == ECHILD);
3834 }
3835 #endif
3836 
3837 /*
3838  * Verify that PT_LWPINFO doesn't return stale siginfo.
3839  */
3840 ATF_TC_WITHOUT_HEAD(ptrace__PT_LWPINFO_stale_siginfo);
3841 ATF_TC_BODY(ptrace__PT_LWPINFO_stale_siginfo, tc)
3842 {
3843 	struct ptrace_lwpinfo pl;
3844 	pid_t fpid, wpid;
3845 	int events, status;
3846 
3847 	ATF_REQUIRE((fpid = fork()) != -1);
3848 	if (fpid == 0) {
3849 		trace_me();
3850 		raise(SIGABRT);
3851 		exit(1);
3852 	}
3853 
3854 	/* The first wait() should report the stop from SIGSTOP. */
3855 	wpid = waitpid(fpid, &status, 0);
3856 	ATF_REQUIRE(wpid == fpid);
3857 	ATF_REQUIRE(WIFSTOPPED(status));
3858 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3859 
3860 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3861 
3862 	/* The next stop should report the SIGABRT in the child body. */
3863 	wpid = waitpid(fpid, &status, 0);
3864 	ATF_REQUIRE(wpid == fpid);
3865 	ATF_REQUIRE(WIFSTOPPED(status));
3866 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3867 
3868 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3869 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3870 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3871 
3872 	/*
3873 	 * Continue the process ignoring the signal, but enabling
3874 	 * syscall traps.
3875 	 */
3876 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
3877 
3878 	/*
3879 	 * The next stop should report a system call entry from
3880 	 * exit().  PL_FLAGS_SI should not be set.
3881 	 */
3882 	wpid = waitpid(fpid, &status, 0);
3883 	ATF_REQUIRE(wpid == fpid);
3884 	ATF_REQUIRE(WIFSTOPPED(status));
3885 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3886 
3887 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3888 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3889 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) == 0);
3890 
3891 	/* Disable syscall tracing and continue the child to let it exit. */
3892 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
3893 	    sizeof(events)) == 0);
3894 	events &= ~PTRACE_SYSCALL;
3895 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
3896 	    sizeof(events)) == 0);
3897 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3898 
3899 	/* The last event should be for the child process's exit. */
3900 	wpid = waitpid(fpid, &status, 0);
3901 	ATF_REQUIRE(WIFEXITED(status));
3902 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3903 
3904 	wpid = wait(&status);
3905 	ATF_REQUIRE(wpid == -1);
3906 	ATF_REQUIRE(errno == ECHILD);
3907 }
3908 
3909 /*
3910  * A simple test of PT_GET_SC_ARGS and PT_GET_SC_RET.
3911  */
3912 ATF_TC_WITHOUT_HEAD(ptrace__syscall_args);
3913 ATF_TC_BODY(ptrace__syscall_args, tc)
3914 {
3915 	struct ptrace_lwpinfo pl;
3916 	struct ptrace_sc_ret psr;
3917 	pid_t fpid, wpid;
3918 	register_t args[2];
3919 	int events, status;
3920 
3921 	ATF_REQUIRE((fpid = fork()) != -1);
3922 	if (fpid == 0) {
3923 		trace_me();
3924 		kill(getpid(), 0);
3925 		close(3);
3926 		exit(1);
3927 	}
3928 
3929 	/* The first wait() should report the stop from SIGSTOP. */
3930 	wpid = waitpid(fpid, &status, 0);
3931 	ATF_REQUIRE(wpid == fpid);
3932 	ATF_REQUIRE(WIFSTOPPED(status));
3933 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3934 
3935 	/*
3936 	 * Continue the process ignoring the signal, but enabling
3937 	 * syscall traps.
3938 	 */
3939 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
3940 
3941 	/*
3942 	 * The next stop should be the syscall entry from getpid().
3943 	 */
3944 	wpid = waitpid(fpid, &status, 0);
3945 	ATF_REQUIRE(wpid == fpid);
3946 	ATF_REQUIRE(WIFSTOPPED(status));
3947 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3948 
3949 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3950 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3951 	ATF_REQUIRE(pl.pl_syscall_code == SYS_getpid);
3952 
3953 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3954 
3955 	/*
3956 	 * The next stop should be the syscall exit from getpid().
3957 	 */
3958 	wpid = waitpid(fpid, &status, 0);
3959 	ATF_REQUIRE(wpid == fpid);
3960 	ATF_REQUIRE(WIFSTOPPED(status));
3961 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3962 
3963 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3964 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
3965 	ATF_REQUIRE(pl.pl_syscall_code == SYS_getpid);
3966 
3967 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
3968 	    sizeof(psr)) != -1);
3969 	ATF_REQUIRE(psr.sr_error == 0);
3970 	ATF_REQUIRE(psr.sr_retval[0] == wpid);
3971 
3972 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3973 
3974 	/*
3975 	 * The next stop should be the syscall entry from kill().
3976 	 */
3977 	wpid = waitpid(fpid, &status, 0);
3978 	ATF_REQUIRE(wpid == fpid);
3979 	ATF_REQUIRE(WIFSTOPPED(status));
3980 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3981 
3982 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3983 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3984 	ATF_REQUIRE(pl.pl_syscall_code == SYS_kill);
3985 	ATF_REQUIRE(pl.pl_syscall_narg == 2);
3986 
3987 	ATF_REQUIRE(ptrace(PT_GET_SC_ARGS, wpid, (caddr_t)args,
3988 	    sizeof(args)) != -1);
3989 	ATF_REQUIRE(args[0] == wpid);
3990 	ATF_REQUIRE(args[1] == 0);
3991 
3992 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3993 
3994 	/*
3995 	 * The next stop should be the syscall exit from kill().
3996 	 */
3997 	wpid = waitpid(fpid, &status, 0);
3998 	ATF_REQUIRE(wpid == fpid);
3999 	ATF_REQUIRE(WIFSTOPPED(status));
4000 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
4001 
4002 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4003 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
4004 	ATF_REQUIRE(pl.pl_syscall_code == SYS_kill);
4005 
4006 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
4007 	    sizeof(psr)) != -1);
4008 	ATF_REQUIRE(psr.sr_error == 0);
4009 
4010 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
4011 
4012 	/*
4013 	 * The next stop should be the syscall entry from close().
4014 	 */
4015 	wpid = waitpid(fpid, &status, 0);
4016 	ATF_REQUIRE(wpid == fpid);
4017 	ATF_REQUIRE(WIFSTOPPED(status));
4018 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
4019 
4020 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4021 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
4022 	ATF_REQUIRE(pl.pl_syscall_code == SYS_close);
4023 	ATF_REQUIRE(pl.pl_syscall_narg == 1);
4024 
4025 	ATF_REQUIRE(ptrace(PT_GET_SC_ARGS, wpid, (caddr_t)args,
4026 	    sizeof(args)) != -1);
4027 	ATF_REQUIRE(args[0] == 3);
4028 
4029 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
4030 
4031 	/*
4032 	 * The next stop should be the syscall exit from close().
4033 	 */
4034 	wpid = waitpid(fpid, &status, 0);
4035 	ATF_REQUIRE(wpid == fpid);
4036 	ATF_REQUIRE(WIFSTOPPED(status));
4037 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
4038 
4039 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4040 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
4041 	ATF_REQUIRE(pl.pl_syscall_code == SYS_close);
4042 
4043 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
4044 	    sizeof(psr)) != -1);
4045 	ATF_REQUIRE(psr.sr_error == EBADF);
4046 
4047 	/* Disable syscall tracing and continue the child to let it exit. */
4048 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
4049 	    sizeof(events)) == 0);
4050 	events &= ~PTRACE_SYSCALL;
4051 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
4052 	    sizeof(events)) == 0);
4053 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
4054 
4055 	/* The last event should be for the child process's exit. */
4056 	wpid = waitpid(fpid, &status, 0);
4057 	ATF_REQUIRE(WIFEXITED(status));
4058 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
4059 
4060 	wpid = wait(&status);
4061 	ATF_REQUIRE(wpid == -1);
4062 	ATF_REQUIRE(errno == ECHILD);
4063 }
4064 
4065 ATF_TP_ADD_TCS(tp)
4066 {
4067 
4068 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
4069 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
4070 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
4071 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
4072 	ATF_TP_ADD_TC(tp, ptrace__parent_exits_before_child);
4073 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
4074 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
4075 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
4076 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
4077 	ATF_TP_ADD_TC(tp,
4078 	    ptrace__follow_fork_child_detached_unrelated_debugger);
4079 	ATF_TP_ADD_TC(tp,
4080 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
4081 	ATF_TP_ADD_TC(tp, ptrace__getppid);
4082 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
4083 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
4084 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
4085 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
4086 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
4087 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
4088 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
4089 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
4090 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
4091 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
4092 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
4093 #ifdef HAVE_BREAKPOINT
4094 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
4095 #endif
4096 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
4097 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
4098 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
4099 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
4100 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
4101 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
4102 	ATF_TP_ADD_TC(tp,
4103 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
4104 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
4105 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
4106 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
4107 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
4108 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
4109 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
4110 	ATF_TP_ADD_TC(tp, ptrace__killed_with_sigmask);
4111 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigmask);
4112 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
4113 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
4114 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
4115 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
4116 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
4117 	ATF_TP_ADD_TC(tp, ptrace__PT_STEP_with_signal);
4118 #ifdef HAVE_BREAKPOINT
4119 	ATF_TP_ADD_TC(tp, ptrace__breakpoint_siginfo);
4120 #endif
4121 	ATF_TP_ADD_TC(tp, ptrace__step_siginfo);
4122 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
4123 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_different_thread);
4124 #endif
4125 	ATF_TP_ADD_TC(tp, ptrace__PT_LWPINFO_stale_siginfo);
4126 	ATF_TP_ADD_TC(tp, ptrace__syscall_args);
4127 
4128 	return (atf_no_error());
4129 }
4130