xref: /freebsd/tests/sys/kern/ptrace_test.c (revision 8657387683946d0c03e09fe77029edfe309eeb20)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/types.h>
31 #include <sys/cpuset.h>
32 #include <sys/event.h>
33 #include <sys/file.h>
34 #include <sys/time.h>
35 #include <sys/procctl.h>
36 #include <sys/ptrace.h>
37 #include <sys/queue.h>
38 #include <sys/runq.h>
39 #include <sys/syscall.h>
40 #include <sys/sysctl.h>
41 #include <sys/user.h>
42 #include <sys/wait.h>
43 #include <errno.h>
44 #include <machine/cpufunc.h>
45 #include <pthread.h>
46 #include <sched.h>
47 #include <semaphore.h>
48 #include <signal.h>
49 #include <stdio.h>
50 #include <stdlib.h>
51 #include <unistd.h>
52 #include <atf-c.h>
53 
54 /*
55  * A variant of ATF_REQUIRE that is suitable for use in child
56  * processes.  This only works if the parent process is tripped up by
57  * the early exit and fails some requirement itself.
58  */
59 #define	CHILD_REQUIRE(exp) do {						\
60 		if (!(exp))						\
61 			child_fail_require(__FILE__, __LINE__,		\
62 			    #exp " not met");				\
63 	} while (0)
64 
65 static __dead2 void
66 child_fail_require(const char *file, int line, const char *str)
67 {
68 	char buf[128];
69 
70 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
71 	write(2, buf, strlen(buf));
72 	_exit(32);
73 }
74 
75 static void
76 trace_me(void)
77 {
78 
79 	/* Attach the parent process as a tracer of this process. */
80 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
81 
82 	/* Trigger a stop. */
83 	raise(SIGSTOP);
84 }
85 
86 static void
87 attach_child(pid_t pid)
88 {
89 	pid_t wpid;
90 	int status;
91 
92 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
93 
94 	wpid = waitpid(pid, &status, 0);
95 	ATF_REQUIRE(wpid == pid);
96 	ATF_REQUIRE(WIFSTOPPED(status));
97 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
98 }
99 
100 static void
101 wait_for_zombie(pid_t pid)
102 {
103 
104 	/*
105 	 * Wait for a process to exit.  This is kind of gross, but
106 	 * there is not a better way.
107 	 */
108 	for (;;) {
109 		struct kinfo_proc kp;
110 		size_t len;
111 		int mib[4];
112 
113 		mib[0] = CTL_KERN;
114 		mib[1] = KERN_PROC;
115 		mib[2] = KERN_PROC_PID;
116 		mib[3] = pid;
117 		len = sizeof(kp);
118 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
119 			/* The KERN_PROC_PID sysctl fails for zombies. */
120 			ATF_REQUIRE(errno == ESRCH);
121 			break;
122 		}
123 		usleep(5000);
124 	}
125 }
126 
127 /*
128  * Verify that a parent debugger process "sees" the exit of a debugged
129  * process exactly once when attached via PT_TRACE_ME.
130  */
131 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
132 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
133 {
134 	pid_t child, wpid;
135 	int status;
136 
137 	ATF_REQUIRE((child = fork()) != -1);
138 	if (child == 0) {
139 		/* Child process. */
140 		trace_me();
141 
142 		_exit(1);
143 	}
144 
145 	/* Parent process. */
146 
147 	/* The first wait() should report the stop from SIGSTOP. */
148 	wpid = waitpid(child, &status, 0);
149 	ATF_REQUIRE(wpid == child);
150 	ATF_REQUIRE(WIFSTOPPED(status));
151 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
152 
153 	/* Continue the child ignoring the SIGSTOP. */
154 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
155 
156 	/* The second wait() should report the exit status. */
157 	wpid = waitpid(child, &status, 0);
158 	ATF_REQUIRE(wpid == child);
159 	ATF_REQUIRE(WIFEXITED(status));
160 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
161 
162 	/* The child should no longer exist. */
163 	wpid = waitpid(child, &status, 0);
164 	ATF_REQUIRE(wpid == -1);
165 	ATF_REQUIRE(errno == ECHILD);
166 }
167 
168 /*
169  * Verify that a parent debugger process "sees" the exit of a debugged
170  * process exactly once when attached via PT_ATTACH.
171  */
172 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
173 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
174 {
175 	pid_t child, wpid;
176 	int cpipe[2], status;
177 	char c;
178 
179 	ATF_REQUIRE(pipe(cpipe) == 0);
180 	ATF_REQUIRE((child = fork()) != -1);
181 	if (child == 0) {
182 		/* Child process. */
183 		close(cpipe[0]);
184 
185 		/* Wait for the parent to attach. */
186 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
187 
188 		_exit(1);
189 	}
190 	close(cpipe[1]);
191 
192 	/* Parent process. */
193 
194 	/* Attach to the child process. */
195 	attach_child(child);
196 
197 	/* Continue the child ignoring the SIGSTOP. */
198 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
199 
200 	/* Signal the child to exit. */
201 	close(cpipe[0]);
202 
203 	/* The second wait() should report the exit status. */
204 	wpid = waitpid(child, &status, 0);
205 	ATF_REQUIRE(wpid == child);
206 	ATF_REQUIRE(WIFEXITED(status));
207 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
208 
209 	/* The child should no longer exist. */
210 	wpid = waitpid(child, &status, 0);
211 	ATF_REQUIRE(wpid == -1);
212 	ATF_REQUIRE(errno == ECHILD);
213 }
214 
215 /*
216  * Verify that a parent process "sees" the exit of a debugged process only
217  * after the debugger has seen it.
218  */
219 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
220 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
221 {
222 	pid_t child, debugger, wpid;
223 	int cpipe[2], dpipe[2], status;
224 	char c;
225 
226 	ATF_REQUIRE(pipe(cpipe) == 0);
227 	ATF_REQUIRE((child = fork()) != -1);
228 
229 	if (child == 0) {
230 		/* Child process. */
231 		close(cpipe[0]);
232 
233 		/* Wait for parent to be ready. */
234 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
235 
236 		_exit(1);
237 	}
238 	close(cpipe[1]);
239 
240 	ATF_REQUIRE(pipe(dpipe) == 0);
241 	ATF_REQUIRE((debugger = fork()) != -1);
242 
243 	if (debugger == 0) {
244 		/* Debugger process. */
245 		close(dpipe[0]);
246 
247 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
248 
249 		wpid = waitpid(child, &status, 0);
250 		CHILD_REQUIRE(wpid == child);
251 		CHILD_REQUIRE(WIFSTOPPED(status));
252 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
253 
254 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
255 
256 		/* Signal parent that debugger is attached. */
257 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
258 
259 		/* Wait for parent's failed wait. */
260 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
261 
262 		wpid = waitpid(child, &status, 0);
263 		CHILD_REQUIRE(wpid == child);
264 		CHILD_REQUIRE(WIFEXITED(status));
265 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
266 
267 		_exit(0);
268 	}
269 	close(dpipe[1]);
270 
271 	/* Parent process. */
272 
273 	/* Wait for the debugger to attach to the child. */
274 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
275 
276 	/* Release the child. */
277 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
278 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
279 	close(cpipe[0]);
280 
281 	wait_for_zombie(child);
282 
283 	/*
284 	 * This wait should return a pid of 0 to indicate no status to
285 	 * report.  The parent should see the child as non-exited
286 	 * until the debugger sees the exit.
287 	 */
288 	wpid = waitpid(child, &status, WNOHANG);
289 	ATF_REQUIRE(wpid == 0);
290 
291 	/* Signal the debugger to wait for the child. */
292 	close(dpipe[0]);
293 
294 	/* Wait for the debugger. */
295 	wpid = waitpid(debugger, &status, 0);
296 	ATF_REQUIRE(wpid == debugger);
297 	ATF_REQUIRE(WIFEXITED(status));
298 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
299 
300 	/* The child process should now be ready. */
301 	wpid = waitpid(child, &status, WNOHANG);
302 	ATF_REQUIRE(wpid == child);
303 	ATF_REQUIRE(WIFEXITED(status));
304 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
305 }
306 
307 /*
308  * Verify that a parent process "sees" the exit of a debugged process
309  * only after a non-direct-child debugger has seen it.  In particular,
310  * various wait() calls in the parent must avoid failing with ESRCH by
311  * checking the parent's orphan list for the debugee.
312  */
313 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
314 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
315 {
316 	pid_t child, debugger, fpid, wpid;
317 	int cpipe[2], dpipe[2], status;
318 	char c;
319 
320 	ATF_REQUIRE(pipe(cpipe) == 0);
321 	ATF_REQUIRE((child = fork()) != -1);
322 
323 	if (child == 0) {
324 		/* Child process. */
325 		close(cpipe[0]);
326 
327 		/* Wait for parent to be ready. */
328 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
329 
330 		_exit(1);
331 	}
332 	close(cpipe[1]);
333 
334 	ATF_REQUIRE(pipe(dpipe) == 0);
335 	ATF_REQUIRE((debugger = fork()) != -1);
336 
337 	if (debugger == 0) {
338 		/* Debugger parent. */
339 
340 		/*
341 		 * Fork again and drop the debugger parent so that the
342 		 * debugger is not a child of the main parent.
343 		 */
344 		CHILD_REQUIRE((fpid = fork()) != -1);
345 		if (fpid != 0)
346 			_exit(2);
347 
348 		/* Debugger process. */
349 		close(dpipe[0]);
350 
351 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
352 
353 		wpid = waitpid(child, &status, 0);
354 		CHILD_REQUIRE(wpid == child);
355 		CHILD_REQUIRE(WIFSTOPPED(status));
356 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
357 
358 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
359 
360 		/* Signal parent that debugger is attached. */
361 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
362 
363 		/* Wait for parent's failed wait. */
364 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
365 
366 		wpid = waitpid(child, &status, 0);
367 		CHILD_REQUIRE(wpid == child);
368 		CHILD_REQUIRE(WIFEXITED(status));
369 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
370 
371 		_exit(0);
372 	}
373 	close(dpipe[1]);
374 
375 	/* Parent process. */
376 
377 	/* Wait for the debugger parent process to exit. */
378 	wpid = waitpid(debugger, &status, 0);
379 	ATF_REQUIRE(wpid == debugger);
380 	ATF_REQUIRE(WIFEXITED(status));
381 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
382 
383 	/* A WNOHANG wait here should see the non-exited child. */
384 	wpid = waitpid(child, &status, WNOHANG);
385 	ATF_REQUIRE(wpid == 0);
386 
387 	/* Wait for the debugger to attach to the child. */
388 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
389 
390 	/* Release the child. */
391 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
392 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
393 	close(cpipe[0]);
394 
395 	wait_for_zombie(child);
396 
397 	/*
398 	 * This wait should return a pid of 0 to indicate no status to
399 	 * report.  The parent should see the child as non-exited
400 	 * until the debugger sees the exit.
401 	 */
402 	wpid = waitpid(child, &status, WNOHANG);
403 	ATF_REQUIRE(wpid == 0);
404 
405 	/* Signal the debugger to wait for the child. */
406 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
407 
408 	/* Wait for the debugger. */
409 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
410 	close(dpipe[0]);
411 
412 	/* The child process should now be ready. */
413 	wpid = waitpid(child, &status, WNOHANG);
414 	ATF_REQUIRE(wpid == child);
415 	ATF_REQUIRE(WIFEXITED(status));
416 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
417 }
418 
419 /*
420  * The parent process should always act the same regardless of how the
421  * debugger is attached to it.
422  */
423 static __dead2 void
424 follow_fork_parent(bool use_vfork)
425 {
426 	pid_t fpid, wpid;
427 	int status;
428 
429 	if (use_vfork)
430 		CHILD_REQUIRE((fpid = vfork()) != -1);
431 	else
432 		CHILD_REQUIRE((fpid = fork()) != -1);
433 
434 	if (fpid == 0)
435 		/* Child */
436 		_exit(2);
437 
438 	wpid = waitpid(fpid, &status, 0);
439 	CHILD_REQUIRE(wpid == fpid);
440 	CHILD_REQUIRE(WIFEXITED(status));
441 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
442 
443 	_exit(1);
444 }
445 
446 /*
447  * Helper routine for follow fork tests.  This waits for two stops
448  * that report both "sides" of a fork.  It returns the pid of the new
449  * child process.
450  */
451 static pid_t
452 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
453 {
454 	struct ptrace_lwpinfo pl;
455 	bool fork_reported[2];
456 	pid_t child, wpid;
457 	int i, status;
458 
459 	fork_reported[0] = false;
460 	fork_reported[1] = false;
461 	child = -1;
462 
463 	/*
464 	 * Each process should report a fork event.  The parent should
465 	 * report a PL_FLAG_FORKED event, and the child should report
466 	 * a PL_FLAG_CHILD event.
467 	 */
468 	for (i = 0; i < 2; i++) {
469 		wpid = wait(&status);
470 		ATF_REQUIRE(wpid > 0);
471 		ATF_REQUIRE(WIFSTOPPED(status));
472 
473 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
474 		    sizeof(pl)) != -1);
475 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
476 		    0);
477 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
478 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
479 		if (pl.pl_flags & PL_FLAG_CHILD) {
480 			ATF_REQUIRE(wpid != parent);
481 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
482 			ATF_REQUIRE(!fork_reported[1]);
483 			if (child == -1)
484 				child = wpid;
485 			else
486 				ATF_REQUIRE(child == wpid);
487 			if (ppl != NULL)
488 				ppl[1] = pl;
489 			fork_reported[1] = true;
490 		} else {
491 			ATF_REQUIRE(wpid == parent);
492 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
493 			ATF_REQUIRE(!fork_reported[0]);
494 			if (child == -1)
495 				child = pl.pl_child_pid;
496 			else
497 				ATF_REQUIRE(child == pl.pl_child_pid);
498 			if (ppl != NULL)
499 				ppl[0] = pl;
500 			fork_reported[0] = true;
501 		}
502 	}
503 
504 	return (child);
505 }
506 
507 /*
508  * Verify that a new child process is stopped after a followed fork and
509  * that the traced parent sees the exit of the child after the debugger
510  * when both processes remain attached to the debugger.
511  */
512 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
513 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
514 {
515 	pid_t children[2], fpid, wpid;
516 	int status;
517 
518 	ATF_REQUIRE((fpid = fork()) != -1);
519 	if (fpid == 0) {
520 		trace_me();
521 		follow_fork_parent(false);
522 	}
523 
524 	/* Parent process. */
525 	children[0] = fpid;
526 
527 	/* The first wait() should report the stop from SIGSTOP. */
528 	wpid = waitpid(children[0], &status, 0);
529 	ATF_REQUIRE(wpid == children[0]);
530 	ATF_REQUIRE(WIFSTOPPED(status));
531 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
532 
533 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
534 
535 	/* Continue the child ignoring the SIGSTOP. */
536 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
537 
538 	children[1] = handle_fork_events(children[0], NULL);
539 	ATF_REQUIRE(children[1] > 0);
540 
541 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
542 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
543 
544 	/*
545 	 * The child can't exit until the grandchild reports status, so the
546 	 * grandchild should report its exit first to the debugger.
547 	 */
548 	wpid = wait(&status);
549 	ATF_REQUIRE(wpid == children[1]);
550 	ATF_REQUIRE(WIFEXITED(status));
551 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
552 
553 	wpid = wait(&status);
554 	ATF_REQUIRE(wpid == children[0]);
555 	ATF_REQUIRE(WIFEXITED(status));
556 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
557 
558 	wpid = wait(&status);
559 	ATF_REQUIRE(wpid == -1);
560 	ATF_REQUIRE(errno == ECHILD);
561 }
562 
563 /*
564  * Verify that a new child process is stopped after a followed fork
565  * and that the traced parent sees the exit of the child when the new
566  * child process is detached after it reports its fork.
567  */
568 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
569 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
570 {
571 	pid_t children[2], fpid, wpid;
572 	int status;
573 
574 	ATF_REQUIRE((fpid = fork()) != -1);
575 	if (fpid == 0) {
576 		trace_me();
577 		follow_fork_parent(false);
578 	}
579 
580 	/* Parent process. */
581 	children[0] = fpid;
582 
583 	/* The first wait() should report the stop from SIGSTOP. */
584 	wpid = waitpid(children[0], &status, 0);
585 	ATF_REQUIRE(wpid == children[0]);
586 	ATF_REQUIRE(WIFSTOPPED(status));
587 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
588 
589 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
590 
591 	/* Continue the child ignoring the SIGSTOP. */
592 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
593 
594 	children[1] = handle_fork_events(children[0], NULL);
595 	ATF_REQUIRE(children[1] > 0);
596 
597 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
598 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
599 
600 	/*
601 	 * Should not see any status from the grandchild now, only the
602 	 * child.
603 	 */
604 	wpid = wait(&status);
605 	ATF_REQUIRE(wpid == children[0]);
606 	ATF_REQUIRE(WIFEXITED(status));
607 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
608 
609 	wpid = wait(&status);
610 	ATF_REQUIRE(wpid == -1);
611 	ATF_REQUIRE(errno == ECHILD);
612 }
613 
614 /*
615  * Verify that a new child process is stopped after a followed fork
616  * and that the traced parent sees the exit of the child when the
617  * traced parent is detached after the fork.
618  */
619 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
620 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
621 {
622 	pid_t children[2], fpid, wpid;
623 	int status;
624 
625 	ATF_REQUIRE((fpid = fork()) != -1);
626 	if (fpid == 0) {
627 		trace_me();
628 		follow_fork_parent(false);
629 	}
630 
631 	/* Parent process. */
632 	children[0] = fpid;
633 
634 	/* The first wait() should report the stop from SIGSTOP. */
635 	wpid = waitpid(children[0], &status, 0);
636 	ATF_REQUIRE(wpid == children[0]);
637 	ATF_REQUIRE(WIFSTOPPED(status));
638 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
639 
640 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
641 
642 	/* Continue the child ignoring the SIGSTOP. */
643 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
644 
645 	children[1] = handle_fork_events(children[0], NULL);
646 	ATF_REQUIRE(children[1] > 0);
647 
648 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
649 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
650 
651 	/*
652 	 * The child can't exit until the grandchild reports status, so the
653 	 * grandchild should report its exit first to the debugger.
654 	 *
655 	 * Even though the child process is detached, it is still a
656 	 * child of the debugger, so it will still report it's exit
657 	 * after the grandchild.
658 	 */
659 	wpid = wait(&status);
660 	ATF_REQUIRE(wpid == children[1]);
661 	ATF_REQUIRE(WIFEXITED(status));
662 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
663 
664 	wpid = wait(&status);
665 	ATF_REQUIRE(wpid == children[0]);
666 	ATF_REQUIRE(WIFEXITED(status));
667 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
668 
669 	wpid = wait(&status);
670 	ATF_REQUIRE(wpid == -1);
671 	ATF_REQUIRE(errno == ECHILD);
672 }
673 
674 static void
675 attach_fork_parent(int cpipe[2])
676 {
677 	pid_t fpid;
678 
679 	close(cpipe[0]);
680 
681 	/* Double-fork to disassociate from the debugger. */
682 	CHILD_REQUIRE((fpid = fork()) != -1);
683 	if (fpid != 0)
684 		_exit(3);
685 
686 	/* Send the pid of the disassociated child to the debugger. */
687 	fpid = getpid();
688 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
689 
690 	/* Wait for the debugger to attach. */
691 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
692 }
693 
694 /*
695  * Verify that a new child process is stopped after a followed fork and
696  * that the traced parent sees the exit of the child after the debugger
697  * when both processes remain attached to the debugger.  In this test
698  * the parent that forks is not a direct child of the debugger.
699  */
700 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
701 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
702 {
703 	pid_t children[2], fpid, wpid;
704 	int cpipe[2], status;
705 
706 	ATF_REQUIRE(pipe(cpipe) == 0);
707 	ATF_REQUIRE((fpid = fork()) != -1);
708 	if (fpid == 0) {
709 		attach_fork_parent(cpipe);
710 		follow_fork_parent(false);
711 	}
712 
713 	/* Parent process. */
714 	close(cpipe[1]);
715 
716 	/* Wait for the direct child to exit. */
717 	wpid = waitpid(fpid, &status, 0);
718 	ATF_REQUIRE(wpid == fpid);
719 	ATF_REQUIRE(WIFEXITED(status));
720 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
721 
722 	/* Read the pid of the fork parent. */
723 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
724 	    sizeof(children[0]));
725 
726 	/* Attach to the fork parent. */
727 	attach_child(children[0]);
728 
729 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
730 
731 	/* Continue the fork parent ignoring the SIGSTOP. */
732 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
733 
734 	/* Signal the fork parent to continue. */
735 	close(cpipe[0]);
736 
737 	children[1] = handle_fork_events(children[0], NULL);
738 	ATF_REQUIRE(children[1] > 0);
739 
740 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
741 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
742 
743 	/*
744 	 * The fork parent can't exit until the child reports status,
745 	 * so the child should report its exit first to the debugger.
746 	 */
747 	wpid = wait(&status);
748 	ATF_REQUIRE(wpid == children[1]);
749 	ATF_REQUIRE(WIFEXITED(status));
750 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
751 
752 	wpid = wait(&status);
753 	ATF_REQUIRE(wpid == children[0]);
754 	ATF_REQUIRE(WIFEXITED(status));
755 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
756 
757 	wpid = wait(&status);
758 	ATF_REQUIRE(wpid == -1);
759 	ATF_REQUIRE(errno == ECHILD);
760 }
761 
762 /*
763  * Verify that a new child process is stopped after a followed fork
764  * and that the traced parent sees the exit of the child when the new
765  * child process is detached after it reports its fork.  In this test
766  * the parent that forks is not a direct child of the debugger.
767  */
768 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
769 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
770 {
771 	pid_t children[2], fpid, wpid;
772 	int cpipe[2], status;
773 
774 	ATF_REQUIRE(pipe(cpipe) == 0);
775 	ATF_REQUIRE((fpid = fork()) != -1);
776 	if (fpid == 0) {
777 		attach_fork_parent(cpipe);
778 		follow_fork_parent(false);
779 	}
780 
781 	/* Parent process. */
782 	close(cpipe[1]);
783 
784 	/* Wait for the direct child to exit. */
785 	wpid = waitpid(fpid, &status, 0);
786 	ATF_REQUIRE(wpid == fpid);
787 	ATF_REQUIRE(WIFEXITED(status));
788 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
789 
790 	/* Read the pid of the fork parent. */
791 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
792 	    sizeof(children[0]));
793 
794 	/* Attach to the fork parent. */
795 	attach_child(children[0]);
796 
797 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
798 
799 	/* Continue the fork parent ignoring the SIGSTOP. */
800 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
801 
802 	/* Signal the fork parent to continue. */
803 	close(cpipe[0]);
804 
805 	children[1] = handle_fork_events(children[0], NULL);
806 	ATF_REQUIRE(children[1] > 0);
807 
808 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
809 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
810 
811 	/*
812 	 * Should not see any status from the child now, only the fork
813 	 * parent.
814 	 */
815 	wpid = wait(&status);
816 	ATF_REQUIRE(wpid == children[0]);
817 	ATF_REQUIRE(WIFEXITED(status));
818 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
819 
820 	wpid = wait(&status);
821 	ATF_REQUIRE(wpid == -1);
822 	ATF_REQUIRE(errno == ECHILD);
823 }
824 
825 /*
826  * Verify that a new child process is stopped after a followed fork
827  * and that the traced parent sees the exit of the child when the
828  * traced parent is detached after the fork.  In this test the parent
829  * that forks is not a direct child of the debugger.
830  */
831 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
832 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
833 {
834 	pid_t children[2], fpid, wpid;
835 	int cpipe[2], status;
836 
837 	ATF_REQUIRE(pipe(cpipe) == 0);
838 	ATF_REQUIRE((fpid = fork()) != -1);
839 	if (fpid == 0) {
840 		attach_fork_parent(cpipe);
841 		follow_fork_parent(false);
842 	}
843 
844 	/* Parent process. */
845 	close(cpipe[1]);
846 
847 	/* Wait for the direct child to exit. */
848 	wpid = waitpid(fpid, &status, 0);
849 	ATF_REQUIRE(wpid == fpid);
850 	ATF_REQUIRE(WIFEXITED(status));
851 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
852 
853 	/* Read the pid of the fork parent. */
854 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
855 	    sizeof(children[0]));
856 
857 	/* Attach to the fork parent. */
858 	attach_child(children[0]);
859 
860 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
861 
862 	/* Continue the fork parent ignoring the SIGSTOP. */
863 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
864 
865 	/* Signal the fork parent to continue. */
866 	close(cpipe[0]);
867 
868 	children[1] = handle_fork_events(children[0], NULL);
869 	ATF_REQUIRE(children[1] > 0);
870 
871 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
872 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
873 
874 	/*
875 	 * Should not see any status from the fork parent now, only
876 	 * the child.
877 	 */
878 	wpid = wait(&status);
879 	ATF_REQUIRE(wpid == children[1]);
880 	ATF_REQUIRE(WIFEXITED(status));
881 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
882 
883 	wpid = wait(&status);
884 	ATF_REQUIRE(wpid == -1);
885 	ATF_REQUIRE(errno == ECHILD);
886 }
887 
888 /*
889  * Verify that a child process does not see an unrelated debugger as its
890  * parent but sees its original parent process.
891  */
892 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
893 ATF_TC_BODY(ptrace__getppid, tc)
894 {
895 	pid_t child, debugger, ppid, wpid;
896 	int cpipe[2], dpipe[2], status;
897 	char c;
898 
899 	ATF_REQUIRE(pipe(cpipe) == 0);
900 	ATF_REQUIRE((child = fork()) != -1);
901 
902 	if (child == 0) {
903 		/* Child process. */
904 		close(cpipe[0]);
905 
906 		/* Wait for parent to be ready. */
907 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
908 
909 		/* Report the parent PID to the parent. */
910 		ppid = getppid();
911 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
912 		    sizeof(ppid));
913 
914 		_exit(1);
915 	}
916 	close(cpipe[1]);
917 
918 	ATF_REQUIRE(pipe(dpipe) == 0);
919 	ATF_REQUIRE((debugger = fork()) != -1);
920 
921 	if (debugger == 0) {
922 		/* Debugger process. */
923 		close(dpipe[0]);
924 
925 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
926 
927 		wpid = waitpid(child, &status, 0);
928 		CHILD_REQUIRE(wpid == child);
929 		CHILD_REQUIRE(WIFSTOPPED(status));
930 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
931 
932 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
933 
934 		/* Signal parent that debugger is attached. */
935 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
936 
937 		/* Wait for traced child to exit. */
938 		wpid = waitpid(child, &status, 0);
939 		CHILD_REQUIRE(wpid == child);
940 		CHILD_REQUIRE(WIFEXITED(status));
941 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
942 
943 		_exit(0);
944 	}
945 	close(dpipe[1]);
946 
947 	/* Parent process. */
948 
949 	/* Wait for the debugger to attach to the child. */
950 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
951 
952 	/* Release the child. */
953 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
954 
955 	/* Read the parent PID from the child. */
956 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
957 	close(cpipe[0]);
958 
959 	ATF_REQUIRE(ppid == getpid());
960 
961 	/* Wait for the debugger. */
962 	wpid = waitpid(debugger, &status, 0);
963 	ATF_REQUIRE(wpid == debugger);
964 	ATF_REQUIRE(WIFEXITED(status));
965 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
966 
967 	/* The child process should now be ready. */
968 	wpid = waitpid(child, &status, WNOHANG);
969 	ATF_REQUIRE(wpid == child);
970 	ATF_REQUIRE(WIFEXITED(status));
971 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
972 }
973 
974 /*
975  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
976  * child process created via fork() reports the correct value.
977  */
978 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
979 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
980 {
981 	struct ptrace_lwpinfo pl[2];
982 	pid_t children[2], fpid, wpid;
983 	int status;
984 
985 	ATF_REQUIRE((fpid = fork()) != -1);
986 	if (fpid == 0) {
987 		trace_me();
988 		follow_fork_parent(false);
989 	}
990 
991 	/* Parent process. */
992 	children[0] = fpid;
993 
994 	/* The first wait() should report the stop from SIGSTOP. */
995 	wpid = waitpid(children[0], &status, 0);
996 	ATF_REQUIRE(wpid == children[0]);
997 	ATF_REQUIRE(WIFSTOPPED(status));
998 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
999 
1000 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1001 
1002 	/* Continue the child ignoring the SIGSTOP. */
1003 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1004 
1005 	/* Wait for both halves of the fork event to get reported. */
1006 	children[1] = handle_fork_events(children[0], pl);
1007 	ATF_REQUIRE(children[1] > 0);
1008 
1009 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1010 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1011 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1012 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1013 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1014 
1015 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1016 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1017 
1018 	/*
1019 	 * The child can't exit until the grandchild reports status, so the
1020 	 * grandchild should report its exit first to the debugger.
1021 	 */
1022 	wpid = wait(&status);
1023 	ATF_REQUIRE(wpid == children[1]);
1024 	ATF_REQUIRE(WIFEXITED(status));
1025 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1026 
1027 	wpid = wait(&status);
1028 	ATF_REQUIRE(wpid == children[0]);
1029 	ATF_REQUIRE(WIFEXITED(status));
1030 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1031 
1032 	wpid = wait(&status);
1033 	ATF_REQUIRE(wpid == -1);
1034 	ATF_REQUIRE(errno == ECHILD);
1035 }
1036 
1037 /*
1038  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1039  * child process created via vfork() reports the correct value.
1040  */
1041 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1042 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1043 {
1044 	struct ptrace_lwpinfo pl[2];
1045 	pid_t children[2], fpid, wpid;
1046 	int status;
1047 
1048 	ATF_REQUIRE((fpid = fork()) != -1);
1049 	if (fpid == 0) {
1050 		trace_me();
1051 		follow_fork_parent(true);
1052 	}
1053 
1054 	/* Parent process. */
1055 	children[0] = fpid;
1056 
1057 	/* The first wait() should report the stop from SIGSTOP. */
1058 	wpid = waitpid(children[0], &status, 0);
1059 	ATF_REQUIRE(wpid == children[0]);
1060 	ATF_REQUIRE(WIFSTOPPED(status));
1061 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1062 
1063 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1064 
1065 	/* Continue the child ignoring the SIGSTOP. */
1066 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1067 
1068 	/* Wait for both halves of the fork event to get reported. */
1069 	children[1] = handle_fork_events(children[0], pl);
1070 	ATF_REQUIRE(children[1] > 0);
1071 
1072 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1073 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1074 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1075 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1076 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1077 
1078 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1079 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1080 
1081 	/*
1082 	 * The child can't exit until the grandchild reports status, so the
1083 	 * grandchild should report its exit first to the debugger.
1084 	 */
1085 	wpid = wait(&status);
1086 	ATF_REQUIRE(wpid == children[1]);
1087 	ATF_REQUIRE(WIFEXITED(status));
1088 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1089 
1090 	wpid = wait(&status);
1091 	ATF_REQUIRE(wpid == children[0]);
1092 	ATF_REQUIRE(WIFEXITED(status));
1093 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1094 
1095 	wpid = wait(&status);
1096 	ATF_REQUIRE(wpid == -1);
1097 	ATF_REQUIRE(errno == ECHILD);
1098 }
1099 
1100 static void *
1101 simple_thread(void *arg __unused)
1102 {
1103 
1104 	pthread_exit(NULL);
1105 }
1106 
1107 static __dead2 void
1108 simple_thread_main(void)
1109 {
1110 	pthread_t thread;
1111 
1112 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1113 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1114 	exit(1);
1115 }
1116 
1117 /*
1118  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1119  * thread reports the correct value.
1120  */
1121 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1122 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1123 {
1124 	struct ptrace_lwpinfo pl;
1125 	pid_t fpid, wpid;
1126 	lwpid_t mainlwp;
1127 	int status;
1128 
1129 	ATF_REQUIRE((fpid = fork()) != -1);
1130 	if (fpid == 0) {
1131 		trace_me();
1132 		simple_thread_main();
1133 	}
1134 
1135 	/* The first wait() should report the stop from SIGSTOP. */
1136 	wpid = waitpid(fpid, &status, 0);
1137 	ATF_REQUIRE(wpid == fpid);
1138 	ATF_REQUIRE(WIFSTOPPED(status));
1139 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1140 
1141 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1142 	    sizeof(pl)) != -1);
1143 	mainlwp = pl.pl_lwpid;
1144 
1145 	/*
1146 	 * Continue the child ignoring the SIGSTOP and tracing all
1147 	 * system call exits.
1148 	 */
1149 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1150 
1151 	/*
1152 	 * Wait for the new thread to arrive.  pthread_create() might
1153 	 * invoke any number of system calls.  For now we just wait
1154 	 * for the new thread to arrive and make sure it reports a
1155 	 * valid system call code.  If ptrace grows thread event
1156 	 * reporting then this test can be made more precise.
1157 	 */
1158 	for (;;) {
1159 		wpid = waitpid(fpid, &status, 0);
1160 		ATF_REQUIRE(wpid == fpid);
1161 		ATF_REQUIRE(WIFSTOPPED(status));
1162 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1163 
1164 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1165 		    sizeof(pl)) != -1);
1166 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1167 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1168 		if (pl.pl_lwpid != mainlwp)
1169 			/* New thread seen. */
1170 			break;
1171 
1172 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1173 	}
1174 
1175 	/* Wait for the child to exit. */
1176 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1177 	for (;;) {
1178 		wpid = waitpid(fpid, &status, 0);
1179 		ATF_REQUIRE(wpid == fpid);
1180 		if (WIFEXITED(status))
1181 			break;
1182 
1183 		ATF_REQUIRE(WIFSTOPPED(status));
1184 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1185 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1186 	}
1187 
1188 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1189 
1190 	wpid = wait(&status);
1191 	ATF_REQUIRE(wpid == -1);
1192 	ATF_REQUIRE(errno == ECHILD);
1193 }
1194 
1195 /*
1196  * Verify that the expected LWP events are reported for a child thread.
1197  */
1198 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1199 ATF_TC_BODY(ptrace__lwp_events, tc)
1200 {
1201 	struct ptrace_lwpinfo pl;
1202 	pid_t fpid, wpid;
1203 	lwpid_t lwps[2];
1204 	int status;
1205 
1206 	ATF_REQUIRE((fpid = fork()) != -1);
1207 	if (fpid == 0) {
1208 		trace_me();
1209 		simple_thread_main();
1210 	}
1211 
1212 	/* The first wait() should report the stop from SIGSTOP. */
1213 	wpid = waitpid(fpid, &status, 0);
1214 	ATF_REQUIRE(wpid == fpid);
1215 	ATF_REQUIRE(WIFSTOPPED(status));
1216 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1217 
1218 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1219 	    sizeof(pl)) != -1);
1220 	lwps[0] = pl.pl_lwpid;
1221 
1222 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1223 
1224 	/* Continue the child ignoring the SIGSTOP. */
1225 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1226 
1227 	/* The first event should be for the child thread's birth. */
1228 	wpid = waitpid(fpid, &status, 0);
1229 	ATF_REQUIRE(wpid == fpid);
1230 	ATF_REQUIRE(WIFSTOPPED(status));
1231 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1232 
1233 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1234 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1235 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1236 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1237 	lwps[1] = pl.pl_lwpid;
1238 
1239 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1240 
1241 	/* The next event should be for the child thread's death. */
1242 	wpid = waitpid(fpid, &status, 0);
1243 	ATF_REQUIRE(wpid == fpid);
1244 	ATF_REQUIRE(WIFSTOPPED(status));
1245 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1246 
1247 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1248 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1249 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1250 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1251 
1252 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1253 
1254 	/* The last event should be for the child process's exit. */
1255 	wpid = waitpid(fpid, &status, 0);
1256 	ATF_REQUIRE(WIFEXITED(status));
1257 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1258 
1259 	wpid = wait(&status);
1260 	ATF_REQUIRE(wpid == -1);
1261 	ATF_REQUIRE(errno == ECHILD);
1262 }
1263 
1264 static void *
1265 exec_thread(void *arg __unused)
1266 {
1267 
1268 	execl("/usr/bin/true", "true", NULL);
1269 	exit(127);
1270 }
1271 
1272 static __dead2 void
1273 exec_thread_main(void)
1274 {
1275 	pthread_t thread;
1276 
1277 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1278 	for (;;)
1279 		sleep(60);
1280 	exit(1);
1281 }
1282 
1283 /*
1284  * Verify that the expected LWP events are reported for a multithreaded
1285  * process that calls execve(2).
1286  */
1287 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1288 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1289 {
1290 	struct ptrace_lwpinfo pl;
1291 	pid_t fpid, wpid;
1292 	lwpid_t lwps[2];
1293 	int status;
1294 
1295 	ATF_REQUIRE((fpid = fork()) != -1);
1296 	if (fpid == 0) {
1297 		trace_me();
1298 		exec_thread_main();
1299 	}
1300 
1301 	/* The first wait() should report the stop from SIGSTOP. */
1302 	wpid = waitpid(fpid, &status, 0);
1303 	ATF_REQUIRE(wpid == fpid);
1304 	ATF_REQUIRE(WIFSTOPPED(status));
1305 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1306 
1307 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1308 	    sizeof(pl)) != -1);
1309 	lwps[0] = pl.pl_lwpid;
1310 
1311 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1312 
1313 	/* Continue the child ignoring the SIGSTOP. */
1314 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1315 
1316 	/* The first event should be for the child thread's birth. */
1317 	wpid = waitpid(fpid, &status, 0);
1318 	ATF_REQUIRE(wpid == fpid);
1319 	ATF_REQUIRE(WIFSTOPPED(status));
1320 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1321 
1322 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1323 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1324 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1325 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1326 	lwps[1] = pl.pl_lwpid;
1327 
1328 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1329 
1330 	/*
1331 	 * The next event should be for the main thread's death due to
1332 	 * single threading from execve().
1333 	 */
1334 	wpid = waitpid(fpid, &status, 0);
1335 	ATF_REQUIRE(wpid == fpid);
1336 	ATF_REQUIRE(WIFSTOPPED(status));
1337 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1338 
1339 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1340 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1341 	    (PL_FLAG_EXITED));
1342 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1343 
1344 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1345 
1346 	/* The next event should be for the child process's exec. */
1347 	wpid = waitpid(fpid, &status, 0);
1348 	ATF_REQUIRE(WIFSTOPPED(status));
1349 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1350 
1351 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1352 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1353 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1354 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1355 
1356 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1357 
1358 	/* The last event should be for the child process's exit. */
1359 	wpid = waitpid(fpid, &status, 0);
1360 	ATF_REQUIRE(WIFEXITED(status));
1361 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1362 
1363 	wpid = wait(&status);
1364 	ATF_REQUIRE(wpid == -1);
1365 	ATF_REQUIRE(errno == ECHILD);
1366 }
1367 
1368 static void
1369 handler(int sig __unused)
1370 {
1371 }
1372 
1373 static void
1374 signal_main(void)
1375 {
1376 
1377 	signal(SIGINFO, handler);
1378 	raise(SIGINFO);
1379 	exit(0);
1380 }
1381 
1382 /*
1383  * Verify that the expected ptrace event is reported for a signal.
1384  */
1385 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1386 ATF_TC_BODY(ptrace__siginfo, tc)
1387 {
1388 	struct ptrace_lwpinfo pl;
1389 	pid_t fpid, wpid;
1390 	int status;
1391 
1392 	ATF_REQUIRE((fpid = fork()) != -1);
1393 	if (fpid == 0) {
1394 		trace_me();
1395 		signal_main();
1396 	}
1397 
1398 	/* The first wait() should report the stop from SIGSTOP. */
1399 	wpid = waitpid(fpid, &status, 0);
1400 	ATF_REQUIRE(wpid == fpid);
1401 	ATF_REQUIRE(WIFSTOPPED(status));
1402 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1403 
1404 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1405 
1406 	/* The next event should be for the SIGINFO. */
1407 	wpid = waitpid(fpid, &status, 0);
1408 	ATF_REQUIRE(WIFSTOPPED(status));
1409 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1410 
1411 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1412 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1413 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1414 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1415 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1416 
1417 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1418 
1419 	/* The last event should be for the child process's exit. */
1420 	wpid = waitpid(fpid, &status, 0);
1421 	ATF_REQUIRE(WIFEXITED(status));
1422 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1423 
1424 	wpid = wait(&status);
1425 	ATF_REQUIRE(wpid == -1);
1426 	ATF_REQUIRE(errno == ECHILD);
1427 }
1428 
1429 /*
1430  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1431  */
1432 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1433 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1434 {
1435 	pid_t fpid, wpid;
1436 	int events, status;
1437 
1438 	ATF_REQUIRE((fpid = fork()) != -1);
1439 	if (fpid == 0) {
1440 		trace_me();
1441 		exec_thread(NULL);
1442 	}
1443 
1444 	/* The first wait() should report the stop from SIGSTOP. */
1445 	wpid = waitpid(fpid, &status, 0);
1446 	ATF_REQUIRE(wpid == fpid);
1447 	ATF_REQUIRE(WIFSTOPPED(status));
1448 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1449 
1450 	events = 0;
1451 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1452 	    sizeof(events)) == 0);
1453 
1454 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1455 
1456 	/* Should get one event at exit. */
1457 	wpid = waitpid(fpid, &status, 0);
1458 	ATF_REQUIRE(WIFEXITED(status));
1459 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1460 
1461 	wpid = wait(&status);
1462 	ATF_REQUIRE(wpid == -1);
1463 	ATF_REQUIRE(errno == ECHILD);
1464 }
1465 
1466 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1467 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1468 {
1469 	struct ptrace_lwpinfo pl;
1470 	pid_t fpid, wpid;
1471 	int events, status;
1472 
1473 	ATF_REQUIRE((fpid = fork()) != -1);
1474 	if (fpid == 0) {
1475 		trace_me();
1476 		exec_thread(NULL);
1477 	}
1478 
1479 	/* The first wait() should report the stop from SIGSTOP. */
1480 	wpid = waitpid(fpid, &status, 0);
1481 	ATF_REQUIRE(wpid == fpid);
1482 	ATF_REQUIRE(WIFSTOPPED(status));
1483 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1484 
1485 	events = PTRACE_EXEC;
1486 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1487 	    sizeof(events)) == 0);
1488 
1489 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1490 
1491 	/* The next event should be for the child process's exec. */
1492 	wpid = waitpid(fpid, &status, 0);
1493 	ATF_REQUIRE(WIFSTOPPED(status));
1494 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1495 
1496 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1497 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1498 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1499 
1500 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1501 
1502 	/* The last event should be for the child process's exit. */
1503 	wpid = waitpid(fpid, &status, 0);
1504 	ATF_REQUIRE(WIFEXITED(status));
1505 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1506 
1507 	wpid = wait(&status);
1508 	ATF_REQUIRE(wpid == -1);
1509 	ATF_REQUIRE(errno == ECHILD);
1510 }
1511 
1512 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1513 ATF_TC_BODY(ptrace__event_mask, tc)
1514 {
1515 	pid_t fpid, wpid;
1516 	int events, status;
1517 
1518 	ATF_REQUIRE((fpid = fork()) != -1);
1519 	if (fpid == 0) {
1520 		trace_me();
1521 		exit(0);
1522 	}
1523 
1524 	/* The first wait() should report the stop from SIGSTOP. */
1525 	wpid = waitpid(fpid, &status, 0);
1526 	ATF_REQUIRE(wpid == fpid);
1527 	ATF_REQUIRE(WIFSTOPPED(status));
1528 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1529 
1530 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1531 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1532 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1533 	    sizeof(events)) == 0);
1534 	ATF_REQUIRE(events & PTRACE_FORK);
1535 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1536 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1537 	    sizeof(events)) == 0);
1538 	ATF_REQUIRE(!(events & PTRACE_FORK));
1539 
1540 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1541 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1542 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1543 	    sizeof(events)) == 0);
1544 	ATF_REQUIRE(events & PTRACE_LWP);
1545 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1546 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1547 	    sizeof(events)) == 0);
1548 	ATF_REQUIRE(!(events & PTRACE_LWP));
1549 
1550 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1551 
1552 	/* Should get one event at exit. */
1553 	wpid = waitpid(fpid, &status, 0);
1554 	ATF_REQUIRE(WIFEXITED(status));
1555 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1556 
1557 	wpid = wait(&status);
1558 	ATF_REQUIRE(wpid == -1);
1559 	ATF_REQUIRE(errno == ECHILD);
1560 }
1561 
1562 /*
1563  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1564  */
1565 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1566 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1567 {
1568 	struct ptrace_lwpinfo pl;
1569 	pid_t fpid, wpid;
1570 	int events, status;
1571 
1572 	ATF_REQUIRE((fpid = fork()) != -1);
1573 	if (fpid == 0) {
1574 		trace_me();
1575 		follow_fork_parent(true);
1576 	}
1577 
1578 	/* The first wait() should report the stop from SIGSTOP. */
1579 	wpid = waitpid(fpid, &status, 0);
1580 	ATF_REQUIRE(wpid == fpid);
1581 	ATF_REQUIRE(WIFSTOPPED(status));
1582 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1583 
1584 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1585 	    sizeof(events)) == 0);
1586 	events |= PTRACE_VFORK;
1587 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1588 	    sizeof(events)) == 0);
1589 
1590 	/* Continue the child ignoring the SIGSTOP. */
1591 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1592 
1593 	/* The next event should report the end of the vfork. */
1594 	wpid = wait(&status);
1595 	ATF_REQUIRE(wpid == fpid);
1596 	ATF_REQUIRE(WIFSTOPPED(status));
1597 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1598 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1599 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1600 
1601 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1602 
1603 	wpid = wait(&status);
1604 	ATF_REQUIRE(wpid == fpid);
1605 	ATF_REQUIRE(WIFEXITED(status));
1606 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1607 
1608 	wpid = wait(&status);
1609 	ATF_REQUIRE(wpid == -1);
1610 	ATF_REQUIRE(errno == ECHILD);
1611 }
1612 
1613 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1614 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1615 {
1616 	struct ptrace_lwpinfo pl[2];
1617 	pid_t children[2], fpid, wpid;
1618 	int events, status;
1619 
1620 	ATF_REQUIRE((fpid = fork()) != -1);
1621 	if (fpid == 0) {
1622 		trace_me();
1623 		follow_fork_parent(true);
1624 	}
1625 
1626 	/* Parent process. */
1627 	children[0] = fpid;
1628 
1629 	/* The first wait() should report the stop from SIGSTOP. */
1630 	wpid = waitpid(children[0], &status, 0);
1631 	ATF_REQUIRE(wpid == children[0]);
1632 	ATF_REQUIRE(WIFSTOPPED(status));
1633 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1634 
1635 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1636 	    sizeof(events)) == 0);
1637 	events |= PTRACE_FORK | PTRACE_VFORK;
1638 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1639 	    sizeof(events)) == 0);
1640 
1641 	/* Continue the child ignoring the SIGSTOP. */
1642 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1643 
1644 	/* Wait for both halves of the fork event to get reported. */
1645 	children[1] = handle_fork_events(children[0], pl);
1646 	ATF_REQUIRE(children[1] > 0);
1647 
1648 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1649 
1650 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1651 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1652 
1653 	/*
1654 	 * The child can't exit until the grandchild reports status, so the
1655 	 * grandchild should report its exit first to the debugger.
1656 	 */
1657 	wpid = waitpid(children[1], &status, 0);
1658 	ATF_REQUIRE(wpid == children[1]);
1659 	ATF_REQUIRE(WIFEXITED(status));
1660 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1661 
1662 	/*
1663 	 * The child should report it's vfork() completion before it
1664 	 * exits.
1665 	 */
1666 	wpid = wait(&status);
1667 	ATF_REQUIRE(wpid == children[0]);
1668 	ATF_REQUIRE(WIFSTOPPED(status));
1669 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1670 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1671 	    -1);
1672 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1673 
1674 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1675 
1676 	wpid = wait(&status);
1677 	ATF_REQUIRE(wpid == children[0]);
1678 	ATF_REQUIRE(WIFEXITED(status));
1679 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1680 
1681 	wpid = wait(&status);
1682 	ATF_REQUIRE(wpid == -1);
1683 	ATF_REQUIRE(errno == ECHILD);
1684 }
1685 
1686 /*
1687  * XXX: There's nothing inherently platform specific about this test, however a
1688  * userspace visible breakpoint() is a prerequisite.
1689  */
1690  #if defined(__amd64__) || defined(__i386__) || defined(__sparc64__)
1691 /*
1692  * Verify that no more events are reported after PT_KILL except for the
1693  * process exit when stopped due to a breakpoint trap.
1694  */
1695 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1696 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1697 {
1698 	pid_t fpid, wpid;
1699 	int status;
1700 
1701 	ATF_REQUIRE((fpid = fork()) != -1);
1702 	if (fpid == 0) {
1703 		trace_me();
1704 		breakpoint();
1705 		exit(1);
1706 	}
1707 
1708 	/* The first wait() should report the stop from SIGSTOP. */
1709 	wpid = waitpid(fpid, &status, 0);
1710 	ATF_REQUIRE(wpid == fpid);
1711 	ATF_REQUIRE(WIFSTOPPED(status));
1712 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1713 
1714 	/* Continue the child ignoring the SIGSTOP. */
1715 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1716 
1717 	/* The second wait() should report hitting the breakpoint. */
1718 	wpid = waitpid(fpid, &status, 0);
1719 	ATF_REQUIRE(wpid == fpid);
1720 	ATF_REQUIRE(WIFSTOPPED(status));
1721 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1722 
1723 	/* Kill the child process. */
1724 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1725 
1726 	/* The last wait() should report the SIGKILL. */
1727 	wpid = waitpid(fpid, &status, 0);
1728 	ATF_REQUIRE(wpid == fpid);
1729 	ATF_REQUIRE(WIFSIGNALED(status));
1730 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1731 
1732 	wpid = wait(&status);
1733 	ATF_REQUIRE(wpid == -1);
1734 	ATF_REQUIRE(errno == ECHILD);
1735 }
1736 #endif /* defined(__amd64__) || defined(__i386__) || defined(__sparc64__) */
1737 
1738 /*
1739  * Verify that no more events are reported after PT_KILL except for the
1740  * process exit when stopped inside of a system call.
1741  */
1742 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1743 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1744 {
1745 	struct ptrace_lwpinfo pl;
1746 	pid_t fpid, wpid;
1747 	int status;
1748 
1749 	ATF_REQUIRE((fpid = fork()) != -1);
1750 	if (fpid == 0) {
1751 		trace_me();
1752 		getpid();
1753 		exit(1);
1754 	}
1755 
1756 	/* The first wait() should report the stop from SIGSTOP. */
1757 	wpid = waitpid(fpid, &status, 0);
1758 	ATF_REQUIRE(wpid == fpid);
1759 	ATF_REQUIRE(WIFSTOPPED(status));
1760 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1761 
1762 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1763 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1764 
1765 	/* The second wait() should report a system call entry for getpid(). */
1766 	wpid = waitpid(fpid, &status, 0);
1767 	ATF_REQUIRE(wpid == fpid);
1768 	ATF_REQUIRE(WIFSTOPPED(status));
1769 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1770 
1771 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1772 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1773 
1774 	/* Kill the child process. */
1775 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1776 
1777 	/* The last wait() should report the SIGKILL. */
1778 	wpid = waitpid(fpid, &status, 0);
1779 	ATF_REQUIRE(wpid == fpid);
1780 	ATF_REQUIRE(WIFSIGNALED(status));
1781 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1782 
1783 	wpid = wait(&status);
1784 	ATF_REQUIRE(wpid == -1);
1785 	ATF_REQUIRE(errno == ECHILD);
1786 }
1787 
1788 /*
1789  * Verify that no more events are reported after PT_KILL except for the
1790  * process exit when killing a multithreaded process.
1791  */
1792 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1793 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1794 {
1795 	struct ptrace_lwpinfo pl;
1796 	pid_t fpid, wpid;
1797 	lwpid_t main_lwp;
1798 	int status;
1799 
1800 	ATF_REQUIRE((fpid = fork()) != -1);
1801 	if (fpid == 0) {
1802 		trace_me();
1803 		simple_thread_main();
1804 	}
1805 
1806 	/* The first wait() should report the stop from SIGSTOP. */
1807 	wpid = waitpid(fpid, &status, 0);
1808 	ATF_REQUIRE(wpid == fpid);
1809 	ATF_REQUIRE(WIFSTOPPED(status));
1810 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1811 
1812 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1813 	    sizeof(pl)) != -1);
1814 	main_lwp = pl.pl_lwpid;
1815 
1816 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1817 
1818 	/* Continue the child ignoring the SIGSTOP. */
1819 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1820 
1821 	/* The first event should be for the child thread's birth. */
1822 	wpid = waitpid(fpid, &status, 0);
1823 	ATF_REQUIRE(wpid == fpid);
1824 	ATF_REQUIRE(WIFSTOPPED(status));
1825 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1826 
1827 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1828 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1829 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1830 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1831 
1832 	/* Kill the child process. */
1833 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1834 
1835 	/* The last wait() should report the SIGKILL. */
1836 	wpid = waitpid(fpid, &status, 0);
1837 	ATF_REQUIRE(wpid == fpid);
1838 	ATF_REQUIRE(WIFSIGNALED(status));
1839 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1840 
1841 	wpid = wait(&status);
1842 	ATF_REQUIRE(wpid == -1);
1843 	ATF_REQUIRE(errno == ECHILD);
1844 }
1845 
1846 static void *
1847 mask_usr1_thread(void *arg)
1848 {
1849 	pthread_barrier_t *pbarrier;
1850 	sigset_t sigmask;
1851 
1852 	pbarrier = (pthread_barrier_t*)arg;
1853 
1854 	sigemptyset(&sigmask);
1855 	sigaddset(&sigmask, SIGUSR1);
1856 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1857 
1858 	/* Sync up with other thread after sigmask updated. */
1859 	pthread_barrier_wait(pbarrier);
1860 
1861 	for (;;)
1862 		sleep(60);
1863 
1864 	return (NULL);
1865 }
1866 
1867 /*
1868  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1869  * and prevents spurious stops due to those other signals.
1870  */
1871 ATF_TC(ptrace__PT_KILL_competing_signal);
1872 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1873 {
1874 
1875 	atf_tc_set_md_var(tc, "require.user", "root");
1876 }
1877 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1878 {
1879 	pid_t fpid, wpid;
1880 	int status;
1881 	cpuset_t setmask;
1882 	pthread_t t;
1883 	pthread_barrier_t barrier;
1884 	struct sched_param sched_param;
1885 
1886 	ATF_REQUIRE((fpid = fork()) != -1);
1887 	if (fpid == 0) {
1888 		/* Bind to one CPU so only one thread at a time will run. */
1889 		CPU_ZERO(&setmask);
1890 		CPU_SET(0, &setmask);
1891 		cpusetid_t setid;
1892 		CHILD_REQUIRE(cpuset(&setid) == 0);
1893 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1894 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1895 
1896 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1897 
1898 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1899 		    (void*)&barrier) == 0);
1900 
1901 		/*
1902 		 * Give the main thread higher priority. The test always
1903 		 * assumes that, if both threads are able to run, the main
1904 		 * thread runs first.
1905 		 */
1906 		sched_param.sched_priority =
1907 		    (sched_get_priority_max(SCHED_FIFO) +
1908 		    sched_get_priority_min(SCHED_FIFO)) / 2;
1909 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
1910 		    SCHED_FIFO, &sched_param) == 0);
1911 		sched_param.sched_priority -= RQ_PPQ;
1912 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
1913 		    &sched_param) == 0);
1914 
1915 		sigset_t sigmask;
1916 		sigemptyset(&sigmask);
1917 		sigaddset(&sigmask, SIGUSR2);
1918 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1919 
1920 		/* Sync up with other thread after sigmask updated. */
1921 		pthread_barrier_wait(&barrier);
1922 
1923 		trace_me();
1924 
1925 		for (;;)
1926 			sleep(60);
1927 
1928 		exit(1);
1929 	}
1930 
1931 	/* The first wait() should report the stop from SIGSTOP. */
1932 	wpid = waitpid(fpid, &status, 0);
1933 	ATF_REQUIRE(wpid == fpid);
1934 	ATF_REQUIRE(WIFSTOPPED(status));
1935 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1936 
1937 	/* Continue the child ignoring the SIGSTOP. */
1938 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1939 
1940 	/* Send a signal that only the second thread can handle. */
1941 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
1942 
1943 	/* The second wait() should report the SIGUSR2. */
1944 	wpid = waitpid(fpid, &status, 0);
1945 	ATF_REQUIRE(wpid == fpid);
1946 	ATF_REQUIRE(WIFSTOPPED(status));
1947 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
1948 
1949 	/* Send a signal that only the first thread can handle. */
1950 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
1951 
1952 	/* Replace the SIGUSR2 with a kill. */
1953 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1954 
1955 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
1956 	wpid = waitpid(fpid, &status, 0);
1957 	ATF_REQUIRE(wpid == fpid);
1958 	ATF_REQUIRE(WIFSIGNALED(status));
1959 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1960 
1961 	wpid = wait(&status);
1962 	ATF_REQUIRE(wpid == -1);
1963 	ATF_REQUIRE(errno == ECHILD);
1964 }
1965 
1966 /*
1967  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
1968  * and prevents spurious stops caused by those events.
1969  */
1970 ATF_TC(ptrace__PT_KILL_competing_stop);
1971 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
1972 {
1973 
1974 	atf_tc_set_md_var(tc, "require.user", "root");
1975 }
1976 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
1977 {
1978 	pid_t fpid, wpid;
1979 	int status;
1980 	cpuset_t setmask;
1981 	pthread_t t;
1982 	pthread_barrier_t barrier;
1983 	lwpid_t main_lwp;
1984 	struct ptrace_lwpinfo pl;
1985 	struct sched_param sched_param;
1986 
1987 	ATF_REQUIRE((fpid = fork()) != -1);
1988 	if (fpid == 0) {
1989 		trace_me();
1990 
1991 		/* Bind to one CPU so only one thread at a time will run. */
1992 		CPU_ZERO(&setmask);
1993 		CPU_SET(0, &setmask);
1994 		cpusetid_t setid;
1995 		CHILD_REQUIRE(cpuset(&setid) == 0);
1996 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1997 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1998 
1999 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2000 
2001 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2002 		    (void*)&barrier) == 0);
2003 
2004 		/*
2005 		 * Give the main thread higher priority. The test always
2006 		 * assumes that, if both threads are able to run, the main
2007 		 * thread runs first.
2008 		 */
2009 		sched_param.sched_priority =
2010 		    (sched_get_priority_max(SCHED_FIFO) +
2011 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2012 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2013 		    SCHED_FIFO, &sched_param) == 0);
2014 		sched_param.sched_priority -= RQ_PPQ;
2015 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2016 		    &sched_param) == 0);
2017 
2018 		sigset_t sigmask;
2019 		sigemptyset(&sigmask);
2020 		sigaddset(&sigmask, SIGUSR2);
2021 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2022 
2023 		/* Sync up with other thread after sigmask updated. */
2024 		pthread_barrier_wait(&barrier);
2025 
2026 		/* Sync up with the test before doing the getpid(). */
2027 		raise(SIGSTOP);
2028 
2029 		getpid();
2030 		exit(1);
2031 	}
2032 
2033 	/* The first wait() should report the stop from SIGSTOP. */
2034 	wpid = waitpid(fpid, &status, 0);
2035 	ATF_REQUIRE(wpid == fpid);
2036 	ATF_REQUIRE(WIFSTOPPED(status));
2037 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2038 
2039 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2040 	main_lwp = pl.pl_lwpid;
2041 
2042 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2043 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2044 
2045 	/*
2046 	 * Continue until child is done with setup, which is indicated with
2047 	 * SIGSTOP. Ignore system calls in the meantime.
2048 	 */
2049 	for (;;) {
2050 		wpid = waitpid(fpid, &status, 0);
2051 		ATF_REQUIRE(wpid == fpid);
2052 		ATF_REQUIRE(WIFSTOPPED(status));
2053 		if (WSTOPSIG(status) == SIGTRAP) {
2054 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2055 			    sizeof(pl)) != -1);
2056 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2057 		} else {
2058 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2059 			break;
2060 		}
2061 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2062 	}
2063 
2064 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2065 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2066 
2067 	wpid = waitpid(fpid, &status, 0);
2068 	ATF_REQUIRE(wpid == fpid);
2069 	ATF_REQUIRE(WIFSTOPPED(status));
2070 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2071 
2072 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2073 	    sizeof(pl)) != -1);
2074 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2075 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2076 	/* Prevent the main thread from hitting its syscall exit for now. */
2077 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2078 
2079 	/*
2080 	 * Proceed, allowing second thread to hit syscall exit for
2081 	 * pthread_barrier_wait().
2082 	 */
2083 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2084 
2085 	wpid = waitpid(fpid, &status, 0);
2086 	ATF_REQUIRE(wpid == fpid);
2087 	ATF_REQUIRE(WIFSTOPPED(status));
2088 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2089 
2090 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2091 	    sizeof(pl)) != -1);
2092 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2093 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2094 
2095 	/* Send a signal that only the second thread can handle. */
2096 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2097 
2098 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2099 
2100 	/* The next wait() should report the SIGUSR2. */
2101 	wpid = waitpid(fpid, &status, 0);
2102 	ATF_REQUIRE(wpid == fpid);
2103 	ATF_REQUIRE(WIFSTOPPED(status));
2104 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2105 
2106 	/* Allow the main thread to try to finish its system call. */
2107 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2108 
2109 	/*
2110 	 * At this point, the main thread is in the middle of a system call and
2111 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2112 	 * be replaced with a SIGKILL below. The main thread will get to run
2113 	 * first. It should notice the kill request (even though the signal
2114 	 * replacement occurred in the other thread) and exit accordingly.  It
2115 	 * should not stop for the system call exit event.
2116 	 */
2117 
2118 	/* Replace the SIGUSR2 with a kill. */
2119 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2120 
2121 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2122 	wpid = waitpid(fpid, &status, 0);
2123 	ATF_REQUIRE(wpid == fpid);
2124 	ATF_REQUIRE(WIFSIGNALED(status));
2125 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2126 
2127 	wpid = wait(&status);
2128 	ATF_REQUIRE(wpid == -1);
2129 	ATF_REQUIRE(errno == ECHILD);
2130 }
2131 
2132 static void
2133 sigusr1_handler(int sig)
2134 {
2135 
2136 	CHILD_REQUIRE(sig == SIGUSR1);
2137 	_exit(2);
2138 }
2139 
2140 /*
2141  * Verify that even if the signal queue is full for a child process,
2142  * a PT_KILL will kill the process.
2143  */
2144 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2145 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2146 {
2147 	pid_t fpid, wpid;
2148 	int status;
2149 	int max_pending_per_proc;
2150 	size_t len;
2151 	int i;
2152 
2153 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2154 
2155 	ATF_REQUIRE((fpid = fork()) != -1);
2156 	if (fpid == 0) {
2157 		trace_me();
2158 		exit(1);
2159 	}
2160 
2161 	/* The first wait() should report the stop from SIGSTOP. */
2162 	wpid = waitpid(fpid, &status, 0);
2163 	ATF_REQUIRE(wpid == fpid);
2164 	ATF_REQUIRE(WIFSTOPPED(status));
2165 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2166 
2167 	len = sizeof(max_pending_per_proc);
2168 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2169 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2170 
2171 	/* Fill the signal queue. */
2172 	for (i = 0; i < max_pending_per_proc; ++i)
2173 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2174 
2175 	/* Kill the child process. */
2176 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2177 
2178 	/* The last wait() should report the SIGKILL. */
2179 	wpid = waitpid(fpid, &status, 0);
2180 	ATF_REQUIRE(wpid == fpid);
2181 	ATF_REQUIRE(WIFSIGNALED(status));
2182 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2183 
2184 	wpid = wait(&status);
2185 	ATF_REQUIRE(wpid == -1);
2186 	ATF_REQUIRE(errno == ECHILD);
2187 }
2188 
2189 /*
2190  * Verify that when stopped at a system call entry, a signal can be
2191  * requested with PT_CONTINUE which will be delivered once the system
2192  * call is complete.
2193  */
2194 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2195 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2196 {
2197 	struct ptrace_lwpinfo pl;
2198 	pid_t fpid, wpid;
2199 	int status;
2200 
2201 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2202 
2203 	ATF_REQUIRE((fpid = fork()) != -1);
2204 	if (fpid == 0) {
2205 		trace_me();
2206 		getpid();
2207 		exit(1);
2208 	}
2209 
2210 	/* The first wait() should report the stop from SIGSTOP. */
2211 	wpid = waitpid(fpid, &status, 0);
2212 	ATF_REQUIRE(wpid == fpid);
2213 	ATF_REQUIRE(WIFSTOPPED(status));
2214 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2215 
2216 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2217 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2218 
2219 	/* The second wait() should report a system call entry for getpid(). */
2220 	wpid = waitpid(fpid, &status, 0);
2221 	ATF_REQUIRE(wpid == fpid);
2222 	ATF_REQUIRE(WIFSTOPPED(status));
2223 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2224 
2225 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2226 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2227 
2228 	/* Continue the child process with a signal. */
2229 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2230 
2231 	for (;;) {
2232 		/*
2233 		 * The last wait() should report exit 2, i.e., a normal _exit
2234 		 * from the signal handler. In the meantime, catch and proceed
2235 		 * past any syscall stops.
2236 		 */
2237 		wpid = waitpid(fpid, &status, 0);
2238 		ATF_REQUIRE(wpid == fpid);
2239 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2240 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2241 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2242 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2243 		} else {
2244 			ATF_REQUIRE(WIFEXITED(status));
2245 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2246 			break;
2247 		}
2248 	}
2249 
2250 	wpid = wait(&status);
2251 	ATF_REQUIRE(wpid == -1);
2252 	ATF_REQUIRE(errno == ECHILD);
2253 }
2254 
2255 static void
2256 sigusr1_counting_handler(int sig)
2257 {
2258 	static int counter = 0;
2259 
2260 	CHILD_REQUIRE(sig == SIGUSR1);
2261 	counter++;
2262 	if (counter == 2)
2263 		_exit(2);
2264 }
2265 
2266 /*
2267  * Verify that, when continuing from a stop at system call entry and exit,
2268  * a signal can be requested from both stops, and both will be delivered when
2269  * the system call is complete.
2270  */
2271 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2272 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2273 {
2274 	struct ptrace_lwpinfo pl;
2275 	pid_t fpid, wpid;
2276 	int status;
2277 
2278 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2279 
2280 	ATF_REQUIRE((fpid = fork()) != -1);
2281 	if (fpid == 0) {
2282 		trace_me();
2283 		getpid();
2284 		exit(1);
2285 	}
2286 
2287 	/* The first wait() should report the stop from SIGSTOP. */
2288 	wpid = waitpid(fpid, &status, 0);
2289 	ATF_REQUIRE(wpid == fpid);
2290 	ATF_REQUIRE(WIFSTOPPED(status));
2291 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2292 
2293 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2294 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2295 
2296 	/* The second wait() should report a system call entry for getpid(). */
2297 	wpid = waitpid(fpid, &status, 0);
2298 	ATF_REQUIRE(wpid == fpid);
2299 	ATF_REQUIRE(WIFSTOPPED(status));
2300 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2301 
2302 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2303 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2304 
2305 	/* Continue the child process with a signal. */
2306 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2307 
2308 	/* The third wait() should report a system call exit for getpid(). */
2309 	wpid = waitpid(fpid, &status, 0);
2310 	ATF_REQUIRE(wpid == fpid);
2311 	ATF_REQUIRE(WIFSTOPPED(status));
2312 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2313 
2314 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2315 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2316 
2317 	/* Continue the child process with a signal. */
2318 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2319 
2320 	for (;;) {
2321 		/*
2322 		 * The last wait() should report exit 2, i.e., a normal _exit
2323 		 * from the signal handler. In the meantime, catch and proceed
2324 		 * past any syscall stops.
2325 		 */
2326 		wpid = waitpid(fpid, &status, 0);
2327 		ATF_REQUIRE(wpid == fpid);
2328 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2329 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2330 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2331 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2332 		} else {
2333 			ATF_REQUIRE(WIFEXITED(status));
2334 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2335 			break;
2336 		}
2337 	}
2338 
2339 	wpid = wait(&status);
2340 	ATF_REQUIRE(wpid == -1);
2341 	ATF_REQUIRE(errno == ECHILD);
2342 }
2343 
2344 /*
2345  * Verify that even if the signal queue is full for a child process,
2346  * a PT_CONTINUE with a signal will not result in loss of that signal.
2347  */
2348 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2349 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2350 {
2351 	pid_t fpid, wpid;
2352 	int status;
2353 	int max_pending_per_proc;
2354 	size_t len;
2355 	int i;
2356 
2357 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2358 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2359 
2360 	ATF_REQUIRE((fpid = fork()) != -1);
2361 	if (fpid == 0) {
2362 		trace_me();
2363 		exit(1);
2364 	}
2365 
2366 	/* The first wait() should report the stop from SIGSTOP. */
2367 	wpid = waitpid(fpid, &status, 0);
2368 	ATF_REQUIRE(wpid == fpid);
2369 	ATF_REQUIRE(WIFSTOPPED(status));
2370 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2371 
2372 	len = sizeof(max_pending_per_proc);
2373 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2374 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2375 
2376 	/* Fill the signal queue. */
2377 	for (i = 0; i < max_pending_per_proc; ++i)
2378 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2379 
2380 	/* Continue with signal. */
2381 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2382 
2383 	for (;;) {
2384 		wpid = waitpid(fpid, &status, 0);
2385 		ATF_REQUIRE(wpid == fpid);
2386 		if (WIFSTOPPED(status)) {
2387 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2388 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2389 		} else {
2390 			/*
2391 			 * The last wait() should report normal _exit from the
2392 			 * SIGUSR1 handler.
2393 			 */
2394 			ATF_REQUIRE(WIFEXITED(status));
2395 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2396 			break;
2397 		}
2398 	}
2399 
2400 	wpid = wait(&status);
2401 	ATF_REQUIRE(wpid == -1);
2402 	ATF_REQUIRE(errno == ECHILD);
2403 }
2404 
2405 /*
2406  * Verify that, after stopping due to a signal, that signal can be
2407  * replaced with another signal.
2408  */
2409 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2410 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2411 {
2412 	struct ptrace_lwpinfo pl;
2413 	pid_t fpid, wpid;
2414 	int status;
2415 
2416 	ATF_REQUIRE((fpid = fork()) != -1);
2417 	if (fpid == 0) {
2418 		trace_me();
2419 		sleep(20);
2420 		exit(1);
2421 	}
2422 
2423 	/* The first wait() should report the stop from SIGSTOP. */
2424 	wpid = waitpid(fpid, &status, 0);
2425 	ATF_REQUIRE(wpid == fpid);
2426 	ATF_REQUIRE(WIFSTOPPED(status));
2427 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2428 
2429 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2430 
2431 	/* Send a signal without ptrace. */
2432 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2433 
2434 	/* The second wait() should report a SIGINT was received. */
2435 	wpid = waitpid(fpid, &status, 0);
2436 	ATF_REQUIRE(wpid == fpid);
2437 	ATF_REQUIRE(WIFSTOPPED(status));
2438 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2439 
2440 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2441 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2442 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2443 
2444 	/* Continue the child process with a different signal. */
2445 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2446 
2447 	/*
2448 	 * The last wait() should report having died due to the new
2449 	 * signal, SIGTERM.
2450 	 */
2451 	wpid = waitpid(fpid, &status, 0);
2452 	ATF_REQUIRE(wpid == fpid);
2453 	ATF_REQUIRE(WIFSIGNALED(status));
2454 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2455 
2456 	wpid = wait(&status);
2457 	ATF_REQUIRE(wpid == -1);
2458 	ATF_REQUIRE(errno == ECHILD);
2459 }
2460 
2461 /*
2462  * Verify that a signal can be passed through to the child even when there
2463  * was no true signal originally. Such cases arise when a SIGTRAP is
2464  * invented for e.g, system call stops.
2465  */
2466 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2467 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2468 {
2469 	struct ptrace_lwpinfo pl;
2470 	pid_t fpid, wpid;
2471 	int status;
2472 
2473 	ATF_REQUIRE((fpid = fork()) != -1);
2474 	if (fpid == 0) {
2475 		trace_me();
2476 		getpid();
2477 		exit(1);
2478 	}
2479 
2480 	/* The first wait() should report the stop from SIGSTOP. */
2481 	wpid = waitpid(fpid, &status, 0);
2482 	ATF_REQUIRE(wpid == fpid);
2483 	ATF_REQUIRE(WIFSTOPPED(status));
2484 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2485 
2486 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2487 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2488 
2489 	/* The second wait() should report a system call entry for getpid(). */
2490 	wpid = waitpid(fpid, &status, 0);
2491 	ATF_REQUIRE(wpid == fpid);
2492 	ATF_REQUIRE(WIFSTOPPED(status));
2493 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2494 
2495 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2496 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2497 
2498 	/* Continue the child process with a SIGTRAP. */
2499 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2500 
2501 	for (;;) {
2502 		/*
2503 		 * The last wait() should report exit due to SIGTRAP.  In the
2504 		 * meantime, catch and proceed past any syscall stops.
2505 		 */
2506 		wpid = waitpid(fpid, &status, 0);
2507 		ATF_REQUIRE(wpid == fpid);
2508 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2509 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2510 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2511 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2512 		} else {
2513 			ATF_REQUIRE(WIFSIGNALED(status));
2514 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2515 			break;
2516 		}
2517 	}
2518 
2519 	wpid = wait(&status);
2520 	ATF_REQUIRE(wpid == -1);
2521 	ATF_REQUIRE(errno == ECHILD);
2522 
2523 }
2524 
2525 /*
2526  * A mixed bag PT_CONTINUE with signal test.
2527  */
2528 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2529 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2530 {
2531 	struct ptrace_lwpinfo pl;
2532 	pid_t fpid, wpid;
2533 	int status;
2534 
2535 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2536 
2537 	ATF_REQUIRE((fpid = fork()) != -1);
2538 	if (fpid == 0) {
2539 		trace_me();
2540 		getpid();
2541 		exit(1);
2542 	}
2543 
2544 	/* The first wait() should report the stop from SIGSTOP. */
2545 	wpid = waitpid(fpid, &status, 0);
2546 	ATF_REQUIRE(wpid == fpid);
2547 	ATF_REQUIRE(WIFSTOPPED(status));
2548 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2549 
2550 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2551 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2552 
2553 	/* The second wait() should report a system call entry for getpid(). */
2554 	wpid = waitpid(fpid, &status, 0);
2555 	ATF_REQUIRE(wpid == fpid);
2556 	ATF_REQUIRE(WIFSTOPPED(status));
2557 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2558 
2559 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2560 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2561 
2562 	/* Continue with the first SIGUSR1. */
2563 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2564 
2565 	/* The next wait() should report a system call exit for getpid(). */
2566 	wpid = waitpid(fpid, &status, 0);
2567 	ATF_REQUIRE(wpid == fpid);
2568 	ATF_REQUIRE(WIFSTOPPED(status));
2569 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2570 
2571 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2572 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2573 
2574 	/* Send an ABRT without ptrace. */
2575 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2576 
2577 	/* Continue normally. */
2578 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2579 
2580 	/* The next wait() should report the SIGABRT. */
2581 	wpid = waitpid(fpid, &status, 0);
2582 	ATF_REQUIRE(wpid == fpid);
2583 	ATF_REQUIRE(WIFSTOPPED(status));
2584 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2585 
2586 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2587 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2588 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2589 
2590 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2591 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2592 
2593 	for (;;) {
2594 		/*
2595 		 * The last wait() should report exit 2, i.e., a normal _exit
2596 		 * from the signal handler. In the meantime, catch and proceed
2597 		 * past any syscall stops.
2598 		 */
2599 		wpid = waitpid(fpid, &status, 0);
2600 		ATF_REQUIRE(wpid == fpid);
2601 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2602 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2603 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2604 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2605 		} else {
2606 			ATF_REQUIRE(WIFEXITED(status));
2607 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2608 			break;
2609 		}
2610 	}
2611 
2612 	wpid = wait(&status);
2613 	ATF_REQUIRE(wpid == -1);
2614 	ATF_REQUIRE(errno == ECHILD);
2615 
2616 }
2617 
2618 /*
2619  * Verify a signal delivered by ptrace is noticed by kevent(2).
2620  */
2621 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2622 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2623 {
2624 	pid_t fpid, wpid;
2625 	int status, kq, nevents;
2626 	struct kevent kev;
2627 
2628 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2629 
2630 	ATF_REQUIRE((fpid = fork()) != -1);
2631 	if (fpid == 0) {
2632 		CHILD_REQUIRE((kq = kqueue()) > 0);
2633 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2634 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2635 
2636 		trace_me();
2637 
2638 		for (;;) {
2639 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2640 			if (nevents == -1 && errno == EINTR)
2641 				continue;
2642 			CHILD_REQUIRE(nevents > 0);
2643 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2644 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2645 			break;
2646 		}
2647 
2648 		exit(1);
2649 	}
2650 
2651 	/* The first wait() should report the stop from SIGSTOP. */
2652 	wpid = waitpid(fpid, &status, 0);
2653 	ATF_REQUIRE(wpid == fpid);
2654 	ATF_REQUIRE(WIFSTOPPED(status));
2655 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2656 
2657 	/* Continue with the SIGUSR1. */
2658 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2659 
2660 	/*
2661 	 * The last wait() should report normal exit with code 1.
2662 	 */
2663 	wpid = waitpid(fpid, &status, 0);
2664 	ATF_REQUIRE(wpid == fpid);
2665 	ATF_REQUIRE(WIFEXITED(status));
2666 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2667 
2668 	wpid = wait(&status);
2669 	ATF_REQUIRE(wpid == -1);
2670 	ATF_REQUIRE(errno == ECHILD);
2671 }
2672 
2673 static sem_t sigusr1_sem;
2674 
2675 static void
2676 sigusr1_sempost_handler(int sig __unused)
2677 {
2678 
2679 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2680 }
2681 
2682 static void *
2683 signal_thread(void *arg)
2684 {
2685 	int err;
2686 	sigset_t sigmask;
2687 
2688 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2689 
2690 	/* Wait for this thread to receive a SIGUSR1. */
2691 	do {
2692 		err = sem_wait(&sigusr1_sem);
2693 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2694 	} while (err != 0 && errno == EINTR);
2695 
2696 	/* Free our companion thread from the barrier. */
2697 	pthread_barrier_wait(pbarrier);
2698 
2699 	/*
2700 	 * Swap ignore duties; the next SIGUSR1 should go to the
2701 	 * other thread.
2702 	 */
2703 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2704 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2705 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2706 
2707 	/* Sync up threads after swapping signal masks. */
2708 	pthread_barrier_wait(pbarrier);
2709 
2710 	/* Wait until our companion has received its SIGUSR1. */
2711 	pthread_barrier_wait(pbarrier);
2712 
2713 	return (NULL);
2714 }
2715 
2716 /*
2717  * Verify that if ptrace stops due to a signal but continues with
2718  * a different signal that the new signal is routed to a thread
2719  * that can accept it, and that that thread is awakened by the signal
2720  * in a timely manner.
2721  */
2722 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
2723 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
2724 {
2725 	pid_t fpid, wpid;
2726 	int status, err;
2727 	pthread_t t;
2728 	sigset_t sigmask;
2729 	pthread_barrier_t barrier;
2730 
2731 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2732 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2733 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2734 
2735 	ATF_REQUIRE((fpid = fork()) != -1);
2736 	if (fpid == 0) {
2737 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
2738 
2739 		/* The other thread should receive the first SIGUSR1. */
2740 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2741 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2742 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2743 
2744 		trace_me();
2745 
2746 		/* Wait until other thread has received its SIGUSR1. */
2747 		pthread_barrier_wait(&barrier);
2748 
2749 		/*
2750 		 * Swap ignore duties; the next SIGUSR1 should go to this
2751 		 * thread.
2752 		 */
2753 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2754 
2755 		/* Sync up threads after swapping signal masks. */
2756 		pthread_barrier_wait(&barrier);
2757 
2758 		/*
2759 		 * Sync up with test code; we're ready for the next SIGUSR1
2760 		 * now.
2761 		 */
2762 		raise(SIGSTOP);
2763 
2764 		/* Wait for this thread to receive a SIGUSR1. */
2765 		do {
2766 			err = sem_wait(&sigusr1_sem);
2767 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2768 		} while (err != 0 && errno == EINTR);
2769 
2770 		/* Free the other thread from the barrier. */
2771 		pthread_barrier_wait(&barrier);
2772 
2773 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
2774 
2775 		exit(1);
2776 	}
2777 
2778 	/* The first wait() should report the stop from SIGSTOP. */
2779 	wpid = waitpid(fpid, &status, 0);
2780 	ATF_REQUIRE(wpid == fpid);
2781 	ATF_REQUIRE(WIFSTOPPED(status));
2782 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2783 
2784 	/* Continue the child ignoring the SIGSTOP. */
2785 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2786 
2787 	/*
2788 	 * Send a signal without ptrace that either thread will accept (USR2,
2789 	 * in this case).
2790 	 */
2791 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2792 
2793 	/* The second wait() should report a SIGUSR2 was received. */
2794 	wpid = waitpid(fpid, &status, 0);
2795 	ATF_REQUIRE(wpid == fpid);
2796 	ATF_REQUIRE(WIFSTOPPED(status));
2797 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2798 
2799 	/* Continue the child, changing the signal to USR1. */
2800 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2801 
2802 	/* The next wait() should report the stop from SIGSTOP. */
2803 	wpid = waitpid(fpid, &status, 0);
2804 	ATF_REQUIRE(wpid == fpid);
2805 	ATF_REQUIRE(WIFSTOPPED(status));
2806 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2807 
2808 	/* Continue the child ignoring the SIGSTOP. */
2809 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2810 
2811 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2812 
2813 	/* The next wait() should report a SIGUSR2 was received. */
2814 	wpid = waitpid(fpid, &status, 0);
2815 	ATF_REQUIRE(wpid == fpid);
2816 	ATF_REQUIRE(WIFSTOPPED(status));
2817 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2818 
2819 	/* Continue the child, changing the signal to USR1. */
2820 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2821 
2822 	/* The last wait() should report normal exit with code 1. */
2823 	wpid = waitpid(fpid, &status, 0);
2824 	ATF_REQUIRE(wpid == fpid);
2825 	ATF_REQUIRE(WIFEXITED(status));
2826 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2827 
2828 	wpid = wait(&status);
2829 	ATF_REQUIRE(wpid == -1);
2830 	ATF_REQUIRE(errno == ECHILD);
2831 }
2832 
2833 static void *
2834 raise_sigstop_thread(void *arg __unused)
2835 {
2836 
2837 	raise(SIGSTOP);
2838 	return NULL;
2839 }
2840 
2841 static void *
2842 sleep_thread(void *arg __unused)
2843 {
2844 
2845 	sleep(60);
2846 	return NULL;
2847 }
2848 
2849 static void
2850 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
2851 {
2852 	pid_t fpid, wpid;
2853 	int status, i;
2854 	cpuset_t setmask;
2855 	cpusetid_t setid;
2856 	pthread_t t;
2857 
2858 	/*
2859 	 * Become the reaper for this process tree. We need to be able to check
2860 	 * that both child and grandchild have died.
2861 	 */
2862 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
2863 
2864 	fpid = fork();
2865 	ATF_REQUIRE(fpid >= 0);
2866 	if (fpid == 0) {
2867 		fpid = fork();
2868 		CHILD_REQUIRE(fpid >= 0);
2869 		if (fpid == 0) {
2870 			trace_me();
2871 
2872 			/* Pin to CPU 0 to serialize thread execution. */
2873 			CPU_ZERO(&setmask);
2874 			CPU_SET(0, &setmask);
2875 			CHILD_REQUIRE(cpuset(&setid) == 0);
2876 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2877 			    CPU_WHICH_CPUSET, setid,
2878 			    sizeof(setmask), &setmask) == 0);
2879 
2880 			if (sigstop_from_main_thread) {
2881 				/*
2882 				 * We expect the SIGKILL sent when our parent
2883 				 * dies to be delivered to the new thread.
2884 				 * Raise the SIGSTOP in this thread so the
2885 				 * threads compete.
2886 				 */
2887 				CHILD_REQUIRE(pthread_create(&t, NULL,
2888 				    sleep_thread, NULL) == 0);
2889 				raise(SIGSTOP);
2890 			} else {
2891 				/*
2892 				 * We expect the SIGKILL to be delivered to
2893 				 * this thread. After creating the new thread,
2894 				 * just get off the CPU so the other thread can
2895 				 * raise the SIGSTOP.
2896 				 */
2897 				CHILD_REQUIRE(pthread_create(&t, NULL,
2898 				    raise_sigstop_thread, NULL) == 0);
2899 				sleep(60);
2900 			}
2901 
2902 			exit(0);
2903 		}
2904 		/* First stop is trace_me() immediately after fork. */
2905 		wpid = waitpid(fpid, &status, 0);
2906 		CHILD_REQUIRE(wpid == fpid);
2907 		CHILD_REQUIRE(WIFSTOPPED(status));
2908 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2909 
2910 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2911 
2912 		/* Second stop is from the raise(SIGSTOP). */
2913 		wpid = waitpid(fpid, &status, 0);
2914 		CHILD_REQUIRE(wpid == fpid);
2915 		CHILD_REQUIRE(WIFSTOPPED(status));
2916 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2917 
2918 		/*
2919 		 * Terminate tracing process without detaching. Our child
2920 		 * should be killed.
2921 		 */
2922 		exit(0);
2923 	}
2924 
2925 	/*
2926 	 * We should get a normal exit from our immediate child and a SIGKILL
2927 	 * exit from our grandchild. The latter case is the interesting one.
2928 	 * Our grandchild should not have stopped due to the SIGSTOP that was
2929 	 * left dangling when its parent died.
2930 	 */
2931 	for (i = 0; i < 2; ++i) {
2932 		wpid = wait(&status);
2933 		if (wpid == fpid)
2934 			ATF_REQUIRE(WIFEXITED(status) &&
2935 			    WEXITSTATUS(status) == 0);
2936 		else
2937 			ATF_REQUIRE(WIFSIGNALED(status) &&
2938 			    WTERMSIG(status) == SIGKILL);
2939 	}
2940 }
2941 
2942 /*
2943  * These two tests ensure that if the tracing process exits without detaching
2944  * just after the child received a SIGSTOP, the child is cleanly killed and
2945  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
2946  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
2947  * different threads, the SIGKILL must win.  There are two variants of this
2948  * test, designed to catch the case where the SIGKILL is delivered to the
2949  * younger thread (the first test) and the case where the SIGKILL is delivered
2950  * to the older thread (the second test). This behavior has changed in the
2951  * past, so make no assumption.
2952  */
2953 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
2954 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
2955 {
2956 
2957 	atf_tc_set_md_var(tc, "require.user", "root");
2958 }
2959 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
2960 {
2961 
2962 	terminate_with_pending_sigstop(true);
2963 }
2964 
2965 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
2966 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
2967 {
2968 
2969 	atf_tc_set_md_var(tc, "require.user", "root");
2970 }
2971 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
2972 {
2973 
2974 	terminate_with_pending_sigstop(false);
2975 }
2976 
2977 /*
2978  * Verify that after ptrace() discards a SIGKILL signal, the event mask
2979  * is not modified.
2980  */
2981 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
2982 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
2983 {
2984 	struct ptrace_lwpinfo pl;
2985 	pid_t fpid, wpid;
2986 	int status, event_mask, new_event_mask;
2987 
2988 	ATF_REQUIRE((fpid = fork()) != -1);
2989 	if (fpid == 0) {
2990 		trace_me();
2991 		raise(SIGSTOP);
2992 		exit(0);
2993 	}
2994 
2995 	/* The first wait() should report the stop from trace_me(). */
2996 	wpid = waitpid(fpid, &status, 0);
2997 	ATF_REQUIRE(wpid == fpid);
2998 	ATF_REQUIRE(WIFSTOPPED(status));
2999 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3000 
3001 	/* Set several unobtrusive event bits. */
3002 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3003 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3004 	    sizeof(event_mask)) == 0);
3005 
3006 	/* Send a SIGKILL without using ptrace. */
3007 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
3008 
3009 	/* Continue the child ignoring the SIGSTOP. */
3010 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3011 
3012 	/* The next stop should be due to the SIGKILL. */
3013 	wpid = waitpid(fpid, &status, 0);
3014 	ATF_REQUIRE(wpid == fpid);
3015 	ATF_REQUIRE(WIFSTOPPED(status));
3016 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
3017 
3018 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3019 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3020 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
3021 
3022 	/* Continue the child ignoring the SIGKILL. */
3023 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3024 
3025 	/* The next wait() should report the stop from SIGSTOP. */
3026 	wpid = waitpid(fpid, &status, 0);
3027 	ATF_REQUIRE(wpid == fpid);
3028 	ATF_REQUIRE(WIFSTOPPED(status));
3029 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3030 
3031 	/* Check the current event mask. It should not have changed. */
3032 	new_event_mask = 0;
3033 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3034 	    sizeof(new_event_mask)) == 0);
3035 	ATF_REQUIRE(event_mask == new_event_mask);
3036 
3037 	/* Continue the child to let it exit. */
3038 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3039 
3040 	/* The last event should be for the child process's exit. */
3041 	wpid = waitpid(fpid, &status, 0);
3042 	ATF_REQUIRE(WIFEXITED(status));
3043 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3044 
3045 	wpid = wait(&status);
3046 	ATF_REQUIRE(wpid == -1);
3047 	ATF_REQUIRE(errno == ECHILD);
3048 }
3049 
3050 static void *
3051 flock_thread(void *arg)
3052 {
3053 	int fd;
3054 
3055 	fd = *(int *)arg;
3056 	(void)flock(fd, LOCK_EX);
3057 	(void)flock(fd, LOCK_UN);
3058 	return (NULL);
3059 }
3060 
3061 /*
3062  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3063  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3064  * on a lock. This is a regression test for r318191.
3065  */
3066 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3067 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3068 {
3069 	pthread_barrier_t barrier;
3070 	pthread_barrierattr_t battr;
3071 	char tmpfile[64];
3072 	pid_t child, wpid;
3073 	int error, fd, i, status;
3074 
3075 	ATF_REQUIRE(pthread_barrierattr_init(&battr) == 0);
3076 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3077 	    PTHREAD_PROCESS_SHARED) == 0);
3078 	ATF_REQUIRE(pthread_barrier_init(&barrier, &battr, 2) == 0);
3079 
3080 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3081 	fd = mkstemp(tmpfile);
3082 	ATF_REQUIRE(fd >= 0);
3083 
3084 	ATF_REQUIRE((child = fork()) != -1);
3085 	if (child == 0) {
3086 		pthread_t t[2];
3087 		int error, cfd;
3088 
3089 		error = pthread_barrier_wait(&barrier);
3090 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3091 			_exit(1);
3092 
3093 		cfd = open(tmpfile, O_RDONLY);
3094 		if (cfd < 0)
3095 			_exit(1);
3096 
3097 		/*
3098 		 * We want at least two threads blocked on the file lock since
3099 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3100 		 * sleep.
3101 		 */
3102 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3103 			_exit(1);
3104 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3105 			_exit(1);
3106 		if (pthread_join(t[0], NULL) != 0)
3107 			_exit(1);
3108 		if (pthread_join(t[1], NULL) != 0)
3109 			_exit(1);
3110 		_exit(0);
3111 	}
3112 
3113 	ATF_REQUIRE(flock(fd, LOCK_EX) == 0);
3114 
3115 	error = pthread_barrier_wait(&barrier);
3116 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3117 
3118 	/*
3119 	 * Give the child some time to block. Is there a better way to do this?
3120 	 */
3121 	sleep(1);
3122 
3123 	/*
3124 	 * Attach and give the child 3 seconds to stop.
3125 	 */
3126 	ATF_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) == 0);
3127 	for (i = 0; i < 3; i++) {
3128 		wpid = waitpid(child, &status, WNOHANG);
3129 		if (wpid == child && WIFSTOPPED(status) &&
3130 		    WSTOPSIG(status) == SIGSTOP)
3131 			break;
3132 		sleep(1);
3133 	}
3134 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3135 
3136 	ATF_REQUIRE(ptrace(PT_DETACH, child, NULL, 0) == 0);
3137 
3138 	ATF_REQUIRE(flock(fd, LOCK_UN) == 0);
3139 	ATF_REQUIRE(unlink(tmpfile) == 0);
3140 	ATF_REQUIRE(close(fd) == 0);
3141 }
3142 
3143 ATF_TP_ADD_TCS(tp)
3144 {
3145 
3146 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
3147 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
3148 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
3149 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
3150 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
3151 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
3152 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
3153 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
3154 	ATF_TP_ADD_TC(tp,
3155 	    ptrace__follow_fork_child_detached_unrelated_debugger);
3156 	ATF_TP_ADD_TC(tp,
3157 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
3158 	ATF_TP_ADD_TC(tp, ptrace__getppid);
3159 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
3160 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
3161 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
3162 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
3163 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
3164 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
3165 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
3166 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
3167 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
3168 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
3169 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
3170 #if defined(__amd64__) || defined(__i386__) || defined(__sparc64__)
3171 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
3172 #endif
3173 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
3174 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
3175 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
3176 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
3177 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
3178 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
3179 	ATF_TP_ADD_TC(tp,
3180 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
3181 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
3182 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
3183 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
3184 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
3185 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
3186 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3187 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
3188 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
3189 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
3190 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
3191 
3192 	return (atf_no_error());
3193 }
3194