xref: /freebsd/tests/sys/kern/ptrace_test.c (revision d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 #include <sys/types.h>
28 #include <sys/cpuset.h>
29 #include <sys/elf.h>
30 #include <sys/event.h>
31 #include <sys/file.h>
32 #include <sys/time.h>
33 #include <sys/procctl.h>
34 #include <sys/procdesc.h>
35 #include <sys/ptrace.h>
36 #include <sys/procfs.h>
37 #include <sys/queue.h>
38 #include <sys/runq.h>
39 #include <sys/syscall.h>
40 #include <sys/sysctl.h>
41 #include <sys/user.h>
42 #include <sys/wait.h>
43 #include <errno.h>
44 #include <machine/cpufunc.h>
45 #include <pthread.h>
46 #include <sched.h>
47 #include <semaphore.h>
48 #include <signal.h>
49 #include <stdarg.h>
50 #include <stdio.h>
51 #include <stdlib.h>
52 #include <unistd.h>
53 #include <atf-c.h>
54 
55 /*
56  * Architectures with a user-visible breakpoint().
57  */
58 #if defined(__aarch64__) || defined(__amd64__) || defined(__arm__) ||	\
59     defined(__i386__) || defined(__riscv)
60 #define	HAVE_BREAKPOINT
61 #endif
62 
63 /*
64  * Adjust PC to skip over a breakpoint when stopped for a breakpoint trap.
65  */
66 #ifdef HAVE_BREAKPOINT
67 #if defined(__aarch64__)
68 #define	SKIP_BREAK(reg)	((reg)->elr += 4)
69 #elif defined(__amd64__) || defined(__i386__)
70 #define	SKIP_BREAK(reg)
71 #elif defined(__arm__)
72 #define	SKIP_BREAK(reg)	((reg)->r_pc += 4)
73 #elif defined(__riscv)
74 #define	SKIP_BREAK(reg)	((reg)->sepc += 4)
75 #endif
76 #endif
77 
78 /*
79  * A variant of ATF_REQUIRE that is suitable for use in child
80  * processes.  This only works if the parent process is tripped up by
81  * the early exit and fails some requirement itself.
82  */
83 #define	CHILD_REQUIRE(exp) do {				\
84 	if (!(exp))					\
85 		child_fail_require(__FILE__, __LINE__,	\
86 		    #exp " not met\n");			\
87 } while (0)
88 
89 #define	CHILD_REQUIRE_EQ(actual, expected) do {			\
90 	__typeof__(expected) _e = expected;			\
91 	__typeof__(actual) _a = actual;				\
92 	if (_e != _a)						\
93 		child_fail_require(__FILE__, __LINE__, #actual	\
94 		    " (%jd) == " #expected " (%jd) not met\n",	\
95 		    (intmax_t)_a, (intmax_t)_e);		\
96 } while (0)
97 
98 static __dead2 void
99 child_fail_require(const char *file, int line, const char *fmt, ...)
100 {
101 	va_list ap;
102 	char buf[1024];
103 
104 	/* Use write() not fprintf() to avoid possible duplicate output. */
105 	snprintf(buf, sizeof(buf), "%s:%d: ", file, line);
106 	write(STDERR_FILENO, buf, strlen(buf));
107 	va_start(ap, fmt);
108 	vsnprintf(buf, sizeof(buf), fmt, ap);
109 	write(STDERR_FILENO, buf, strlen(buf));
110 	va_end(ap);
111 
112 	_exit(32);
113 }
114 
115 #define	REQUIRE_EQ(actual, expected) do {				\
116 	__typeof__(expected) _e = expected;				\
117 	__typeof__(actual) _a = actual;					\
118 	ATF_REQUIRE_MSG(_e == _a, #actual " (%jd) == "			\
119 	    #expected " (%jd) not met", (intmax_t)_a, (intmax_t)_e);	\
120 } while (0)
121 
122 static void
123 trace_me(void)
124 {
125 
126 	/* Attach the parent process as a tracer of this process. */
127 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
128 
129 	/* Trigger a stop. */
130 	raise(SIGSTOP);
131 }
132 
133 static void
134 attach_child(pid_t pid)
135 {
136 	pid_t wpid;
137 	int status;
138 
139 	REQUIRE_EQ(ptrace(PT_ATTACH, pid, NULL, 0), 0);
140 
141 	wpid = waitpid(pid, &status, 0);
142 	REQUIRE_EQ(wpid, pid);
143 	ATF_REQUIRE(WIFSTOPPED(status));
144 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
145 }
146 
147 static void
148 wait_for_zombie(pid_t pid)
149 {
150 
151 	/*
152 	 * Wait for a process to exit.  This is kind of gross, but
153 	 * there is not a better way.
154 	 *
155 	 * Prior to r325719, the kern.proc.pid.<pid> sysctl failed
156 	 * with ESRCH.  After that change, a valid struct kinfo_proc
157 	 * is returned for zombies with ki_stat set to SZOMB.
158 	 */
159 	for (;;) {
160 		struct kinfo_proc kp;
161 		size_t len;
162 		int mib[4];
163 
164 		mib[0] = CTL_KERN;
165 		mib[1] = KERN_PROC;
166 		mib[2] = KERN_PROC_PID;
167 		mib[3] = pid;
168 		len = sizeof(kp);
169 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
170 			REQUIRE_EQ(errno, ESRCH);
171 			break;
172 		}
173 		if (kp.ki_stat == SZOMB)
174 			break;
175 		usleep(5000);
176 	}
177 }
178 
179 /*
180  * Verify that a parent debugger process "sees" the exit of a debugged
181  * process exactly once when attached via PT_TRACE_ME.
182  */
183 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
184 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
185 {
186 	pid_t child, wpid;
187 	int status;
188 
189 	ATF_REQUIRE((child = fork()) != -1);
190 	if (child == 0) {
191 		/* Child process. */
192 		trace_me();
193 
194 		_exit(1);
195 	}
196 
197 	/* Parent process. */
198 
199 	/* The first wait() should report the stop from SIGSTOP. */
200 	wpid = waitpid(child, &status, 0);
201 	REQUIRE_EQ(wpid, child);
202 	ATF_REQUIRE(WIFSTOPPED(status));
203 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
204 
205 	/* Continue the child ignoring the SIGSTOP. */
206 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
207 
208 	/* The second wait() should report the exit status. */
209 	wpid = waitpid(child, &status, 0);
210 	REQUIRE_EQ(wpid, child);
211 	ATF_REQUIRE(WIFEXITED(status));
212 	REQUIRE_EQ(WEXITSTATUS(status), 1);
213 
214 	/* The child should no longer exist. */
215 	wpid = waitpid(child, &status, 0);
216 	REQUIRE_EQ(wpid, -1);
217 	REQUIRE_EQ(errno, ECHILD);
218 }
219 
220 /*
221  * Verify that a parent debugger process "sees" the exit of a debugged
222  * process exactly once when attached via PT_ATTACH.
223  */
224 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
225 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
226 {
227 	pid_t child, wpid;
228 	int cpipe[2], status;
229 	char c;
230 
231 	REQUIRE_EQ(pipe(cpipe), 0);
232 	ATF_REQUIRE((child = fork()) != -1);
233 	if (child == 0) {
234 		/* Child process. */
235 		close(cpipe[0]);
236 
237 		/* Wait for the parent to attach. */
238 		CHILD_REQUIRE_EQ(0, read(cpipe[1], &c, sizeof(c)));
239 
240 		_exit(1);
241 	}
242 	close(cpipe[1]);
243 
244 	/* Parent process. */
245 
246 	/* Attach to the child process. */
247 	attach_child(child);
248 
249 	/* Continue the child ignoring the SIGSTOP. */
250 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
251 
252 	/* Signal the child to exit. */
253 	close(cpipe[0]);
254 
255 	/* The second wait() should report the exit status. */
256 	wpid = waitpid(child, &status, 0);
257 	REQUIRE_EQ(wpid, child);
258 	ATF_REQUIRE(WIFEXITED(status));
259 	REQUIRE_EQ(WEXITSTATUS(status), 1);
260 
261 	/* The child should no longer exist. */
262 	wpid = waitpid(child, &status, 0);
263 	REQUIRE_EQ(wpid, -1);
264 	REQUIRE_EQ(errno, ECHILD);
265 }
266 
267 /*
268  * Verify that a parent process "sees" the exit of a debugged process only
269  * after the debugger has seen it.
270  */
271 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
272 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
273 {
274 	pid_t child, debugger, wpid;
275 	int cpipe[2], dpipe[2], status;
276 	char c;
277 
278 	REQUIRE_EQ(pipe(cpipe), 0);
279 	ATF_REQUIRE((child = fork()) != -1);
280 
281 	if (child == 0) {
282 		/* Child process. */
283 		close(cpipe[0]);
284 
285 		/* Wait for parent to be ready. */
286 		CHILD_REQUIRE_EQ(read(cpipe[1], &c, sizeof(c)),
287 		    (ssize_t)sizeof(c));
288 
289 		_exit(1);
290 	}
291 	close(cpipe[1]);
292 
293 	REQUIRE_EQ(pipe(dpipe), 0);
294 	ATF_REQUIRE((debugger = fork()) != -1);
295 
296 	if (debugger == 0) {
297 		/* Debugger process. */
298 		close(dpipe[0]);
299 
300 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
301 
302 		wpid = waitpid(child, &status, 0);
303 		CHILD_REQUIRE_EQ(wpid, child);
304 		CHILD_REQUIRE(WIFSTOPPED(status));
305 		CHILD_REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
306 
307 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
308 
309 		/* Signal parent that debugger is attached. */
310 		CHILD_REQUIRE_EQ(write(dpipe[1], &c, sizeof(c)),
311 		    (ssize_t)sizeof(c));
312 
313 		/* Wait for parent's failed wait. */
314 		CHILD_REQUIRE_EQ(read(dpipe[1], &c, sizeof(c)), 0);
315 
316 		wpid = waitpid(child, &status, 0);
317 		CHILD_REQUIRE_EQ(wpid, child);
318 		CHILD_REQUIRE(WIFEXITED(status));
319 		CHILD_REQUIRE_EQ(WEXITSTATUS(status), 1);
320 
321 		_exit(0);
322 	}
323 	close(dpipe[1]);
324 
325 	/* Parent process. */
326 
327 	/* Wait for the debugger to attach to the child. */
328 	REQUIRE_EQ(read(dpipe[0], &c, sizeof(c)), (ssize_t)sizeof(c));
329 
330 	/* Release the child. */
331 	REQUIRE_EQ(write(cpipe[0], &c, sizeof(c)), (ssize_t)sizeof(c));
332 	REQUIRE_EQ(read(cpipe[0], &c, sizeof(c)), 0);
333 	close(cpipe[0]);
334 
335 	wait_for_zombie(child);
336 
337 	/*
338 	 * This wait should return a pid of 0 to indicate no status to
339 	 * report.  The parent should see the child as non-exited
340 	 * until the debugger sees the exit.
341 	 */
342 	wpid = waitpid(child, &status, WNOHANG);
343 	REQUIRE_EQ(wpid, 0);
344 
345 	/* Signal the debugger to wait for the child. */
346 	close(dpipe[0]);
347 
348 	/* Wait for the debugger. */
349 	wpid = waitpid(debugger, &status, 0);
350 	REQUIRE_EQ(wpid, debugger);
351 	ATF_REQUIRE(WIFEXITED(status));
352 	REQUIRE_EQ(WEXITSTATUS(status), 0);
353 
354 	/* The child process should now be ready. */
355 	wpid = waitpid(child, &status, WNOHANG);
356 	REQUIRE_EQ(wpid, child);
357 	ATF_REQUIRE(WIFEXITED(status));
358 	REQUIRE_EQ(WEXITSTATUS(status), 1);
359 }
360 
361 /*
362  * Verify that a parent process "sees" the exit of a debugged process
363  * only after a non-direct-child debugger has seen it.  In particular,
364  * various wait() calls in the parent must avoid failing with ESRCH by
365  * checking the parent's orphan list for the debugee.
366  */
367 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
368 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
369 {
370 	pid_t child, debugger, fpid, wpid;
371 	int cpipe[2], dpipe[2], status;
372 	char c;
373 
374 	REQUIRE_EQ(pipe(cpipe), 0);
375 	ATF_REQUIRE((child = fork()) != -1);
376 
377 	if (child == 0) {
378 		/* Child process. */
379 		close(cpipe[0]);
380 
381 		/* Wait for parent to be ready. */
382 		CHILD_REQUIRE_EQ(read(cpipe[1], &c, sizeof(c)),
383 		    (ssize_t)sizeof(c));
384 
385 		_exit(1);
386 	}
387 	close(cpipe[1]);
388 
389 	REQUIRE_EQ(pipe(dpipe), 0);
390 	ATF_REQUIRE((debugger = fork()) != -1);
391 
392 	if (debugger == 0) {
393 		/* Debugger parent. */
394 
395 		/*
396 		 * Fork again and drop the debugger parent so that the
397 		 * debugger is not a child of the main parent.
398 		 */
399 		CHILD_REQUIRE((fpid = fork()) != -1);
400 		if (fpid != 0)
401 			_exit(2);
402 
403 		/* Debugger process. */
404 		close(dpipe[0]);
405 
406 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
407 
408 		wpid = waitpid(child, &status, 0);
409 		CHILD_REQUIRE_EQ(wpid, child);
410 		CHILD_REQUIRE(WIFSTOPPED(status));
411 		CHILD_REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
412 
413 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
414 
415 		/* Signal parent that debugger is attached. */
416 		CHILD_REQUIRE_EQ(write(dpipe[1], &c, sizeof(c)),
417 		    (ssize_t)sizeof(c));
418 
419 		/* Wait for parent's failed wait. */
420 		CHILD_REQUIRE_EQ(read(dpipe[1], &c, sizeof(c)),
421 		    (ssize_t)sizeof(c));
422 
423 		wpid = waitpid(child, &status, 0);
424 		CHILD_REQUIRE_EQ(wpid, child);
425 		CHILD_REQUIRE(WIFEXITED(status));
426 		CHILD_REQUIRE_EQ(WEXITSTATUS(status), 1);
427 
428 		_exit(0);
429 	}
430 	close(dpipe[1]);
431 
432 	/* Parent process. */
433 
434 	/* Wait for the debugger parent process to exit. */
435 	wpid = waitpid(debugger, &status, 0);
436 	REQUIRE_EQ(wpid, debugger);
437 	ATF_REQUIRE(WIFEXITED(status));
438 	REQUIRE_EQ(WEXITSTATUS(status), 2);
439 
440 	/* A WNOHANG wait here should see the non-exited child. */
441 	wpid = waitpid(child, &status, WNOHANG);
442 	REQUIRE_EQ(wpid, 0);
443 
444 	/* Wait for the debugger to attach to the child. */
445 	REQUIRE_EQ(read(dpipe[0], &c, sizeof(c)), (ssize_t)sizeof(c));
446 
447 	/* Release the child. */
448 	REQUIRE_EQ(write(cpipe[0], &c, sizeof(c)), (ssize_t)sizeof(c));
449 	REQUIRE_EQ(read(cpipe[0], &c, sizeof(c)), 0);
450 	close(cpipe[0]);
451 
452 	wait_for_zombie(child);
453 
454 	/*
455 	 * This wait should return a pid of 0 to indicate no status to
456 	 * report.  The parent should see the child as non-exited
457 	 * until the debugger sees the exit.
458 	 */
459 	wpid = waitpid(child, &status, WNOHANG);
460 	REQUIRE_EQ(wpid, 0);
461 
462 	/* Signal the debugger to wait for the child. */
463 	REQUIRE_EQ(write(dpipe[0], &c, sizeof(c)), (ssize_t)sizeof(c));
464 
465 	/* Wait for the debugger. */
466 	REQUIRE_EQ(read(dpipe[0], &c, sizeof(c)), 0);
467 	close(dpipe[0]);
468 
469 	/* The child process should now be ready. */
470 	wpid = waitpid(child, &status, WNOHANG);
471 	REQUIRE_EQ(wpid, child);
472 	ATF_REQUIRE(WIFEXITED(status));
473 	REQUIRE_EQ(WEXITSTATUS(status), 1);
474 }
475 
476 /*
477  * Make sure that we can collect the exit status of an orphaned process.
478  */
479 ATF_TC_WITHOUT_HEAD(ptrace__parent_exits_before_child);
480 ATF_TC_BODY(ptrace__parent_exits_before_child, tc)
481 {
482 	ssize_t n;
483 	int cpipe1[2], cpipe2[2], gcpipe[2], status;
484 	pid_t child, gchild;
485 
486 	REQUIRE_EQ(pipe(cpipe1), 0);
487 	REQUIRE_EQ(pipe(cpipe2), 0);
488 	REQUIRE_EQ(pipe(gcpipe), 0);
489 
490 	REQUIRE_EQ(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL), 0);
491 
492 	ATF_REQUIRE((child = fork()) != -1);
493 	if (child == 0) {
494 		CHILD_REQUIRE((gchild = fork()) != -1);
495 		if (gchild == 0) {
496 			status = 1;
497 			do {
498 				n = read(gcpipe[0], &status, sizeof(status));
499 			} while (n == -1 && errno == EINTR);
500 			_exit(status);
501 		}
502 
503 		CHILD_REQUIRE_EQ(write(cpipe1[1], &gchild, sizeof(gchild)),
504 		    (ssize_t)sizeof(gchild));
505 		CHILD_REQUIRE_EQ(read(cpipe2[0], &status, sizeof(status)),
506 		    (ssize_t)sizeof(status));
507 		_exit(status);
508 	}
509 
510 	REQUIRE_EQ(read(cpipe1[0], &gchild, sizeof(gchild)),
511 	    (ssize_t)sizeof(gchild));
512 
513 	REQUIRE_EQ(ptrace(PT_ATTACH, gchild, NULL, 0), 0);
514 
515 	status = 0;
516 	REQUIRE_EQ(write(cpipe2[1], &status, sizeof(status)),
517 	    (ssize_t)sizeof(status));
518 	REQUIRE_EQ(waitpid(child, &status, 0), child);
519 	ATF_REQUIRE(WIFEXITED(status));
520 	REQUIRE_EQ(WEXITSTATUS(status), 0);
521 
522 	status = 0;
523 	REQUIRE_EQ(write(gcpipe[1], &status, sizeof(status)),
524 	    (ssize_t)sizeof(status));
525 	REQUIRE_EQ(waitpid(gchild, &status, 0), gchild);
526 	ATF_REQUIRE(WIFSTOPPED(status));
527 	REQUIRE_EQ(ptrace(PT_DETACH, gchild, (caddr_t)1, 0), 0);
528 	REQUIRE_EQ(waitpid(gchild, &status, 0), gchild);
529 	ATF_REQUIRE(WIFEXITED(status));
530 	REQUIRE_EQ(WEXITSTATUS(status), 0);
531 
532 	REQUIRE_EQ(close(cpipe1[0]), 0);
533 	REQUIRE_EQ(close(cpipe1[1]), 0);
534 	REQUIRE_EQ(close(cpipe2[0]), 0);
535 	REQUIRE_EQ(close(cpipe2[1]), 0);
536 	REQUIRE_EQ(close(gcpipe[0]), 0);
537 	REQUIRE_EQ(close(gcpipe[1]), 0);
538 }
539 
540 /*
541  * The parent process should always act the same regardless of how the
542  * debugger is attached to it.
543  */
544 static __dead2 void
545 follow_fork_parent(bool use_vfork)
546 {
547 	pid_t fpid, wpid;
548 	int status;
549 
550 	if (use_vfork)
551 		CHILD_REQUIRE((fpid = vfork()) != -1);
552 	else
553 		CHILD_REQUIRE((fpid = fork()) != -1);
554 
555 	if (fpid == 0)
556 		/* Child */
557 		_exit(2);
558 
559 	wpid = waitpid(fpid, &status, 0);
560 	CHILD_REQUIRE_EQ(wpid, fpid);
561 	CHILD_REQUIRE(WIFEXITED(status));
562 	CHILD_REQUIRE_EQ(WEXITSTATUS(status), 2);
563 
564 	_exit(1);
565 }
566 
567 /*
568  * Helper routine for follow fork tests.  This waits for two stops
569  * that report both "sides" of a fork.  It returns the pid of the new
570  * child process.
571  */
572 static pid_t
573 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
574 {
575 	struct ptrace_lwpinfo pl;
576 	bool fork_reported[2];
577 	pid_t child, wpid;
578 	int i, status;
579 
580 	fork_reported[0] = false;
581 	fork_reported[1] = false;
582 	child = -1;
583 
584 	/*
585 	 * Each process should report a fork event.  The parent should
586 	 * report a PL_FLAG_FORKED event, and the child should report
587 	 * a PL_FLAG_CHILD event.
588 	 */
589 	for (i = 0; i < 2; i++) {
590 		wpid = wait(&status);
591 		ATF_REQUIRE(wpid > 0);
592 		ATF_REQUIRE(WIFSTOPPED(status));
593 
594 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
595 		    sizeof(pl)) != -1);
596 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
597 		    0);
598 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
599 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
600 		if (pl.pl_flags & PL_FLAG_CHILD) {
601 			ATF_REQUIRE(wpid != parent);
602 			REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
603 			ATF_REQUIRE(!fork_reported[1]);
604 			if (child == -1)
605 				child = wpid;
606 			else
607 				REQUIRE_EQ(child, wpid);
608 			if (ppl != NULL)
609 				ppl[1] = pl;
610 			fork_reported[1] = true;
611 		} else {
612 			REQUIRE_EQ(wpid, parent);
613 			REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
614 			ATF_REQUIRE(!fork_reported[0]);
615 			if (child == -1)
616 				child = pl.pl_child_pid;
617 			else
618 				REQUIRE_EQ(child, pl.pl_child_pid);
619 			if (ppl != NULL)
620 				ppl[0] = pl;
621 			fork_reported[0] = true;
622 		}
623 	}
624 
625 	return (child);
626 }
627 
628 /*
629  * Verify that a new child process is stopped after a followed fork and
630  * that the traced parent sees the exit of the child after the debugger
631  * when both processes remain attached to the debugger.
632  */
633 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
634 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
635 {
636 	pid_t children[2], fpid, wpid;
637 	int status;
638 
639 	ATF_REQUIRE((fpid = fork()) != -1);
640 	if (fpid == 0) {
641 		trace_me();
642 		follow_fork_parent(false);
643 	}
644 
645 	/* Parent process. */
646 	children[0] = fpid;
647 
648 	/* The first wait() should report the stop from SIGSTOP. */
649 	wpid = waitpid(children[0], &status, 0);
650 	REQUIRE_EQ(wpid, children[0]);
651 	ATF_REQUIRE(WIFSTOPPED(status));
652 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
653 
654 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
655 
656 	/* Continue the child ignoring the SIGSTOP. */
657 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
658 
659 	children[1] = handle_fork_events(children[0], NULL);
660 	ATF_REQUIRE(children[1] > 0);
661 
662 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
663 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
664 
665 	/*
666 	 * The child can't exit until the grandchild reports status, so the
667 	 * grandchild should report its exit first to the debugger.
668 	 */
669 	wpid = wait(&status);
670 	REQUIRE_EQ(wpid, children[1]);
671 	ATF_REQUIRE(WIFEXITED(status));
672 	REQUIRE_EQ(WEXITSTATUS(status), 2);
673 
674 	wpid = wait(&status);
675 	REQUIRE_EQ(wpid, children[0]);
676 	ATF_REQUIRE(WIFEXITED(status));
677 	REQUIRE_EQ(WEXITSTATUS(status), 1);
678 
679 	wpid = wait(&status);
680 	REQUIRE_EQ(wpid, -1);
681 	REQUIRE_EQ(errno, ECHILD);
682 }
683 
684 /*
685  * Verify that a new child process is stopped after a followed fork
686  * and that the traced parent sees the exit of the child when the new
687  * child process is detached after it reports its fork.
688  */
689 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
690 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
691 {
692 	pid_t children[2], fpid, wpid;
693 	int status;
694 
695 	ATF_REQUIRE((fpid = fork()) != -1);
696 	if (fpid == 0) {
697 		trace_me();
698 		follow_fork_parent(false);
699 	}
700 
701 	/* Parent process. */
702 	children[0] = fpid;
703 
704 	/* The first wait() should report the stop from SIGSTOP. */
705 	wpid = waitpid(children[0], &status, 0);
706 	REQUIRE_EQ(wpid, children[0]);
707 	ATF_REQUIRE(WIFSTOPPED(status));
708 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
709 
710 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
711 
712 	/* Continue the child ignoring the SIGSTOP. */
713 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
714 
715 	children[1] = handle_fork_events(children[0], NULL);
716 	ATF_REQUIRE(children[1] > 0);
717 
718 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
719 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
720 
721 	/*
722 	 * Should not see any status from the grandchild now, only the
723 	 * child.
724 	 */
725 	wpid = wait(&status);
726 	REQUIRE_EQ(wpid, children[0]);
727 	ATF_REQUIRE(WIFEXITED(status));
728 	REQUIRE_EQ(WEXITSTATUS(status), 1);
729 
730 	wpid = wait(&status);
731 	REQUIRE_EQ(wpid, -1);
732 	REQUIRE_EQ(errno, ECHILD);
733 }
734 
735 /*
736  * Verify that a new child process is stopped after a followed fork
737  * and that the traced parent sees the exit of the child when the
738  * traced parent is detached after the fork.
739  */
740 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
741 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
742 {
743 	pid_t children[2], fpid, wpid;
744 	int status;
745 
746 	ATF_REQUIRE((fpid = fork()) != -1);
747 	if (fpid == 0) {
748 		trace_me();
749 		follow_fork_parent(false);
750 	}
751 
752 	/* Parent process. */
753 	children[0] = fpid;
754 
755 	/* The first wait() should report the stop from SIGSTOP. */
756 	wpid = waitpid(children[0], &status, 0);
757 	REQUIRE_EQ(wpid, children[0]);
758 	ATF_REQUIRE(WIFSTOPPED(status));
759 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
760 
761 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
762 
763 	/* Continue the child ignoring the SIGSTOP. */
764 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
765 
766 	children[1] = handle_fork_events(children[0], NULL);
767 	ATF_REQUIRE(children[1] > 0);
768 
769 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
770 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
771 
772 	/*
773 	 * The child can't exit until the grandchild reports status, so the
774 	 * grandchild should report its exit first to the debugger.
775 	 *
776 	 * Even though the child process is detached, it is still a
777 	 * child of the debugger, so it will still report it's exit
778 	 * after the grandchild.
779 	 */
780 	wpid = wait(&status);
781 	REQUIRE_EQ(wpid, children[1]);
782 	ATF_REQUIRE(WIFEXITED(status));
783 	REQUIRE_EQ(WEXITSTATUS(status), 2);
784 
785 	wpid = wait(&status);
786 	REQUIRE_EQ(wpid, children[0]);
787 	ATF_REQUIRE(WIFEXITED(status));
788 	REQUIRE_EQ(WEXITSTATUS(status), 1);
789 
790 	wpid = wait(&status);
791 	REQUIRE_EQ(wpid, -1);
792 	REQUIRE_EQ(errno, ECHILD);
793 }
794 
795 static void
796 attach_fork_parent(int cpipe[2])
797 {
798 	pid_t fpid;
799 
800 	close(cpipe[0]);
801 
802 	/* Double-fork to disassociate from the debugger. */
803 	CHILD_REQUIRE((fpid = fork()) != -1);
804 	if (fpid != 0)
805 		_exit(3);
806 
807 	/* Send the pid of the disassociated child to the debugger. */
808 	fpid = getpid();
809 	CHILD_REQUIRE_EQ(write(cpipe[1], &fpid, sizeof(fpid)),
810 	    (ssize_t)sizeof(fpid));
811 
812 	/* Wait for the debugger to attach. */
813 	CHILD_REQUIRE_EQ(read(cpipe[1], &fpid, sizeof(fpid)), 0);
814 }
815 
816 /*
817  * Verify that a new child process is stopped after a followed fork and
818  * that the traced parent sees the exit of the child after the debugger
819  * when both processes remain attached to the debugger.  In this test
820  * the parent that forks is not a direct child of the debugger.
821  */
822 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
823 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
824 {
825 	pid_t children[2], fpid, wpid;
826 	int cpipe[2], status;
827 
828 	REQUIRE_EQ(pipe(cpipe), 0);
829 	ATF_REQUIRE((fpid = fork()) != -1);
830 	if (fpid == 0) {
831 		attach_fork_parent(cpipe);
832 		follow_fork_parent(false);
833 	}
834 
835 	/* Parent process. */
836 	close(cpipe[1]);
837 
838 	/* Wait for the direct child to exit. */
839 	wpid = waitpid(fpid, &status, 0);
840 	REQUIRE_EQ(wpid, fpid);
841 	ATF_REQUIRE(WIFEXITED(status));
842 	REQUIRE_EQ(WEXITSTATUS(status), 3);
843 
844 	/* Read the pid of the fork parent. */
845 	REQUIRE_EQ(read(cpipe[0], &children[0], sizeof(children[0])),
846 	    (ssize_t)sizeof(children[0]));
847 
848 	/* Attach to the fork parent. */
849 	attach_child(children[0]);
850 
851 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
852 
853 	/* Continue the fork parent ignoring the SIGSTOP. */
854 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
855 
856 	/* Signal the fork parent to continue. */
857 	close(cpipe[0]);
858 
859 	children[1] = handle_fork_events(children[0], NULL);
860 	ATF_REQUIRE(children[1] > 0);
861 
862 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
863 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
864 
865 	/*
866 	 * The fork parent can't exit until the child reports status,
867 	 * so the child should report its exit first to the debugger.
868 	 */
869 	wpid = wait(&status);
870 	REQUIRE_EQ(wpid, children[1]);
871 	ATF_REQUIRE(WIFEXITED(status));
872 	REQUIRE_EQ(WEXITSTATUS(status), 2);
873 
874 	wpid = wait(&status);
875 	REQUIRE_EQ(wpid, children[0]);
876 	ATF_REQUIRE(WIFEXITED(status));
877 	REQUIRE_EQ(WEXITSTATUS(status), 1);
878 
879 	wpid = wait(&status);
880 	REQUIRE_EQ(wpid, -1);
881 	REQUIRE_EQ(errno, ECHILD);
882 }
883 
884 /*
885  * Verify that a new child process is stopped after a followed fork
886  * and that the traced parent sees the exit of the child when the new
887  * child process is detached after it reports its fork.  In this test
888  * the parent that forks is not a direct child of the debugger.
889  */
890 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
891 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
892 {
893 	pid_t children[2], fpid, wpid;
894 	int cpipe[2], status;
895 
896 	REQUIRE_EQ(pipe(cpipe), 0);
897 	ATF_REQUIRE((fpid = fork()) != -1);
898 	if (fpid == 0) {
899 		attach_fork_parent(cpipe);
900 		follow_fork_parent(false);
901 	}
902 
903 	/* Parent process. */
904 	close(cpipe[1]);
905 
906 	/* Wait for the direct child to exit. */
907 	wpid = waitpid(fpid, &status, 0);
908 	REQUIRE_EQ(wpid, fpid);
909 	ATF_REQUIRE(WIFEXITED(status));
910 	REQUIRE_EQ(WEXITSTATUS(status), 3);
911 
912 	/* Read the pid of the fork parent. */
913 	REQUIRE_EQ(read(cpipe[0], &children[0], sizeof(children[0])),
914 	    (ssize_t)sizeof(children[0]));
915 
916 	/* Attach to the fork parent. */
917 	attach_child(children[0]);
918 
919 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
920 
921 	/* Continue the fork parent ignoring the SIGSTOP. */
922 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
923 
924 	/* Signal the fork parent to continue. */
925 	close(cpipe[0]);
926 
927 	children[1] = handle_fork_events(children[0], NULL);
928 	ATF_REQUIRE(children[1] > 0);
929 
930 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
931 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
932 
933 	/*
934 	 * Should not see any status from the child now, only the fork
935 	 * parent.
936 	 */
937 	wpid = wait(&status);
938 	REQUIRE_EQ(wpid, children[0]);
939 	ATF_REQUIRE(WIFEXITED(status));
940 	REQUIRE_EQ(WEXITSTATUS(status), 1);
941 
942 	wpid = wait(&status);
943 	REQUIRE_EQ(wpid, -1);
944 	REQUIRE_EQ(errno, ECHILD);
945 }
946 
947 /*
948  * Verify that a new child process is stopped after a followed fork
949  * and that the traced parent sees the exit of the child when the
950  * traced parent is detached after the fork.  In this test the parent
951  * that forks is not a direct child of the debugger.
952  */
953 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
954 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
955 {
956 	pid_t children[2], fpid, wpid;
957 	int cpipe[2], status;
958 
959 	REQUIRE_EQ(pipe(cpipe), 0);
960 	ATF_REQUIRE((fpid = fork()) != -1);
961 	if (fpid == 0) {
962 		attach_fork_parent(cpipe);
963 		follow_fork_parent(false);
964 	}
965 
966 	/* Parent process. */
967 	close(cpipe[1]);
968 
969 	/* Wait for the direct child to exit. */
970 	wpid = waitpid(fpid, &status, 0);
971 	REQUIRE_EQ(wpid, fpid);
972 	ATF_REQUIRE(WIFEXITED(status));
973 	REQUIRE_EQ(WEXITSTATUS(status), 3);
974 
975 	/* Read the pid of the fork parent. */
976 	REQUIRE_EQ(read(cpipe[0], &children[0], sizeof(children[0])),
977 	    (ssize_t)sizeof(children[0]));
978 
979 	/* Attach to the fork parent. */
980 	attach_child(children[0]);
981 
982 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
983 
984 	/* Continue the fork parent ignoring the SIGSTOP. */
985 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
986 
987 	/* Signal the fork parent to continue. */
988 	close(cpipe[0]);
989 
990 	children[1] = handle_fork_events(children[0], NULL);
991 	ATF_REQUIRE(children[1] > 0);
992 
993 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
994 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
995 
996 	/*
997 	 * Should not see any status from the fork parent now, only
998 	 * the child.
999 	 */
1000 	wpid = wait(&status);
1001 	REQUIRE_EQ(wpid, children[1]);
1002 	ATF_REQUIRE(WIFEXITED(status));
1003 	REQUIRE_EQ(WEXITSTATUS(status), 2);
1004 
1005 	wpid = wait(&status);
1006 	REQUIRE_EQ(wpid, -1);
1007 	REQUIRE_EQ(errno, ECHILD);
1008 }
1009 
1010 /*
1011  * Verify that a child process does not see an unrelated debugger as its
1012  * parent but sees its original parent process.
1013  */
1014 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
1015 ATF_TC_BODY(ptrace__getppid, tc)
1016 {
1017 	pid_t child, debugger, ppid, wpid;
1018 	int cpipe[2], dpipe[2], status;
1019 	char c;
1020 
1021 	REQUIRE_EQ(pipe(cpipe), 0);
1022 	ATF_REQUIRE((child = fork()) != -1);
1023 
1024 	if (child == 0) {
1025 		/* Child process. */
1026 		close(cpipe[0]);
1027 
1028 		/* Wait for parent to be ready. */
1029 		CHILD_REQUIRE_EQ(read(cpipe[1], &c, sizeof(c)),
1030 		    (ssize_t)sizeof(c));
1031 
1032 		/* Report the parent PID to the parent. */
1033 		ppid = getppid();
1034 		CHILD_REQUIRE_EQ(write(cpipe[1], &ppid, sizeof(ppid)),
1035 		    (ssize_t)sizeof(ppid));
1036 
1037 		_exit(1);
1038 	}
1039 	close(cpipe[1]);
1040 
1041 	REQUIRE_EQ(pipe(dpipe), 0);
1042 	ATF_REQUIRE((debugger = fork()) != -1);
1043 
1044 	if (debugger == 0) {
1045 		/* Debugger process. */
1046 		close(dpipe[0]);
1047 
1048 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
1049 
1050 		wpid = waitpid(child, &status, 0);
1051 		CHILD_REQUIRE_EQ(wpid, child);
1052 		CHILD_REQUIRE(WIFSTOPPED(status));
1053 		CHILD_REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1054 
1055 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
1056 
1057 		/* Signal parent that debugger is attached. */
1058 		CHILD_REQUIRE_EQ(write(dpipe[1], &c, sizeof(c)),
1059 		    (ssize_t)sizeof(c));
1060 
1061 		/* Wait for traced child to exit. */
1062 		wpid = waitpid(child, &status, 0);
1063 		CHILD_REQUIRE_EQ(wpid, child);
1064 		CHILD_REQUIRE(WIFEXITED(status));
1065 		CHILD_REQUIRE_EQ(WEXITSTATUS(status), 1);
1066 
1067 		_exit(0);
1068 	}
1069 	close(dpipe[1]);
1070 
1071 	/* Parent process. */
1072 
1073 	/* Wait for the debugger to attach to the child. */
1074 	REQUIRE_EQ(read(dpipe[0], &c, sizeof(c)), (ssize_t)sizeof(c));
1075 
1076 	/* Release the child. */
1077 	REQUIRE_EQ(write(cpipe[0], &c, sizeof(c)), (ssize_t)sizeof(c));
1078 
1079 	/* Read the parent PID from the child. */
1080 	REQUIRE_EQ(read(cpipe[0], &ppid, sizeof(ppid)), (ssize_t)sizeof(ppid));
1081 	close(cpipe[0]);
1082 
1083 	REQUIRE_EQ(ppid, getpid());
1084 
1085 	/* Wait for the debugger. */
1086 	wpid = waitpid(debugger, &status, 0);
1087 	REQUIRE_EQ(wpid, debugger);
1088 	ATF_REQUIRE(WIFEXITED(status));
1089 	REQUIRE_EQ(WEXITSTATUS(status), 0);
1090 
1091 	/* The child process should now be ready. */
1092 	wpid = waitpid(child, &status, WNOHANG);
1093 	REQUIRE_EQ(wpid, child);
1094 	ATF_REQUIRE(WIFEXITED(status));
1095 	REQUIRE_EQ(WEXITSTATUS(status), 1);
1096 }
1097 
1098 /*
1099  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1100  * child process created via fork() reports the correct value.
1101  */
1102 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
1103 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
1104 {
1105 	struct ptrace_lwpinfo pl[2];
1106 	pid_t children[2], fpid, wpid;
1107 	int status;
1108 
1109 	ATF_REQUIRE((fpid = fork()) != -1);
1110 	if (fpid == 0) {
1111 		trace_me();
1112 		follow_fork_parent(false);
1113 	}
1114 
1115 	/* Parent process. */
1116 	children[0] = fpid;
1117 
1118 	/* The first wait() should report the stop from SIGSTOP. */
1119 	wpid = waitpid(children[0], &status, 0);
1120 	REQUIRE_EQ(wpid, children[0]);
1121 	ATF_REQUIRE(WIFSTOPPED(status));
1122 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1123 
1124 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1125 
1126 	/* Continue the child ignoring the SIGSTOP. */
1127 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1128 
1129 	/* Wait for both halves of the fork event to get reported. */
1130 	children[1] = handle_fork_events(children[0], pl);
1131 	ATF_REQUIRE(children[1] > 0);
1132 
1133 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1134 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1135 	REQUIRE_EQ(pl[0].pl_syscall_code, (unsigned)SYS_fork);
1136 	REQUIRE_EQ(pl[0].pl_syscall_code, pl[1].pl_syscall_code);
1137 	REQUIRE_EQ(pl[0].pl_syscall_narg, pl[1].pl_syscall_narg);
1138 
1139 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1140 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1141 
1142 	/*
1143 	 * The child can't exit until the grandchild reports status, so the
1144 	 * grandchild should report its exit first to the debugger.
1145 	 */
1146 	wpid = wait(&status);
1147 	REQUIRE_EQ(wpid, children[1]);
1148 	ATF_REQUIRE(WIFEXITED(status));
1149 	REQUIRE_EQ(WEXITSTATUS(status), 2);
1150 
1151 	wpid = wait(&status);
1152 	REQUIRE_EQ(wpid, children[0]);
1153 	ATF_REQUIRE(WIFEXITED(status));
1154 	REQUIRE_EQ(WEXITSTATUS(status), 1);
1155 
1156 	wpid = wait(&status);
1157 	REQUIRE_EQ(wpid, -1);
1158 	REQUIRE_EQ(errno, ECHILD);
1159 }
1160 
1161 /*
1162  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1163  * child process created via vfork() reports the correct value.
1164  */
1165 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1166 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1167 {
1168 	struct ptrace_lwpinfo pl[2];
1169 	pid_t children[2], fpid, wpid;
1170 	int status;
1171 
1172 	ATF_REQUIRE((fpid = fork()) != -1);
1173 	if (fpid == 0) {
1174 		trace_me();
1175 		follow_fork_parent(true);
1176 	}
1177 
1178 	/* Parent process. */
1179 	children[0] = fpid;
1180 
1181 	/* The first wait() should report the stop from SIGSTOP. */
1182 	wpid = waitpid(children[0], &status, 0);
1183 	REQUIRE_EQ(wpid, children[0]);
1184 	ATF_REQUIRE(WIFSTOPPED(status));
1185 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1186 
1187 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1188 
1189 	/* Continue the child ignoring the SIGSTOP. */
1190 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1191 
1192 	/* Wait for both halves of the fork event to get reported. */
1193 	children[1] = handle_fork_events(children[0], pl);
1194 	ATF_REQUIRE(children[1] > 0);
1195 
1196 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1197 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1198 	REQUIRE_EQ(pl[0].pl_syscall_code, (unsigned)SYS_vfork);
1199 	REQUIRE_EQ(pl[0].pl_syscall_code, pl[1].pl_syscall_code);
1200 	REQUIRE_EQ(pl[0].pl_syscall_narg, pl[1].pl_syscall_narg);
1201 
1202 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1203 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1204 
1205 	/*
1206 	 * The child can't exit until the grandchild reports status, so the
1207 	 * grandchild should report its exit first to the debugger.
1208 	 */
1209 	wpid = wait(&status);
1210 	REQUIRE_EQ(wpid, children[1]);
1211 	ATF_REQUIRE(WIFEXITED(status));
1212 	REQUIRE_EQ(WEXITSTATUS(status), 2);
1213 
1214 	wpid = wait(&status);
1215 	REQUIRE_EQ(wpid, children[0]);
1216 	ATF_REQUIRE(WIFEXITED(status));
1217 	REQUIRE_EQ(WEXITSTATUS(status), 1);
1218 
1219 	wpid = wait(&status);
1220 	REQUIRE_EQ(wpid, -1);
1221 	REQUIRE_EQ(errno, ECHILD);
1222 }
1223 
1224 static void *
1225 simple_thread(void *arg __unused)
1226 {
1227 
1228 	pthread_exit(NULL);
1229 }
1230 
1231 static __dead2 void
1232 simple_thread_main(void)
1233 {
1234 	pthread_t thread;
1235 
1236 	CHILD_REQUIRE_EQ(pthread_create(&thread, NULL, simple_thread, NULL), 0);
1237 	CHILD_REQUIRE_EQ(pthread_join(thread, NULL), 0);
1238 	exit(1);
1239 }
1240 
1241 /*
1242  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1243  * thread reports the correct value.
1244  */
1245 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1246 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1247 {
1248 	struct ptrace_lwpinfo pl;
1249 	pid_t fpid, wpid;
1250 	lwpid_t mainlwp;
1251 	int status;
1252 
1253 	ATF_REQUIRE((fpid = fork()) != -1);
1254 	if (fpid == 0) {
1255 		trace_me();
1256 		simple_thread_main();
1257 	}
1258 
1259 	/* The first wait() should report the stop from SIGSTOP. */
1260 	wpid = waitpid(fpid, &status, 0);
1261 	REQUIRE_EQ(wpid, fpid);
1262 	ATF_REQUIRE(WIFSTOPPED(status));
1263 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1264 
1265 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1266 	    sizeof(pl)) != -1);
1267 	mainlwp = pl.pl_lwpid;
1268 
1269 	/*
1270 	 * Continue the child ignoring the SIGSTOP and tracing all
1271 	 * system call exits.
1272 	 */
1273 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1274 
1275 	/*
1276 	 * Wait for the new thread to arrive.  pthread_create() might
1277 	 * invoke any number of system calls.  For now we just wait
1278 	 * for the new thread to arrive and make sure it reports a
1279 	 * valid system call code.  If ptrace grows thread event
1280 	 * reporting then this test can be made more precise.
1281 	 */
1282 	for (;;) {
1283 		wpid = waitpid(fpid, &status, 0);
1284 		REQUIRE_EQ(wpid, fpid);
1285 		ATF_REQUIRE(WIFSTOPPED(status));
1286 		REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1287 
1288 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1289 		    sizeof(pl)) != -1);
1290 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1291 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1292 		if (pl.pl_lwpid != mainlwp)
1293 			/* New thread seen. */
1294 			break;
1295 
1296 		REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1297 	}
1298 
1299 	/* Wait for the child to exit. */
1300 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1301 	for (;;) {
1302 		wpid = waitpid(fpid, &status, 0);
1303 		REQUIRE_EQ(wpid, fpid);
1304 		if (WIFEXITED(status))
1305 			break;
1306 
1307 		ATF_REQUIRE(WIFSTOPPED(status));
1308 		REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1309 		REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1310 	}
1311 
1312 	REQUIRE_EQ(WEXITSTATUS(status), 1);
1313 
1314 	wpid = wait(&status);
1315 	REQUIRE_EQ(wpid, -1);
1316 	REQUIRE_EQ(errno, ECHILD);
1317 }
1318 
1319 /*
1320  * Verify that the expected LWP events are reported for a child thread.
1321  */
1322 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1323 ATF_TC_BODY(ptrace__lwp_events, tc)
1324 {
1325 	struct ptrace_lwpinfo pl;
1326 	pid_t fpid, wpid;
1327 	lwpid_t lwps[2];
1328 	int status;
1329 
1330 	ATF_REQUIRE((fpid = fork()) != -1);
1331 	if (fpid == 0) {
1332 		trace_me();
1333 		simple_thread_main();
1334 	}
1335 
1336 	/* The first wait() should report the stop from SIGSTOP. */
1337 	wpid = waitpid(fpid, &status, 0);
1338 	REQUIRE_EQ(wpid, fpid);
1339 	ATF_REQUIRE(WIFSTOPPED(status));
1340 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1341 
1342 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1343 	    sizeof(pl)) != -1);
1344 	lwps[0] = pl.pl_lwpid;
1345 
1346 	REQUIRE_EQ(ptrace(PT_LWP_EVENTS, wpid, NULL, 1), 0);
1347 
1348 	/* Continue the child ignoring the SIGSTOP. */
1349 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1350 
1351 	/* The first event should be for the child thread's birth. */
1352 	wpid = waitpid(fpid, &status, 0);
1353 	REQUIRE_EQ(wpid, fpid);
1354 	ATF_REQUIRE(WIFSTOPPED(status));
1355 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1356 
1357 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1358 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)),
1359 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1360 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1361 	lwps[1] = pl.pl_lwpid;
1362 
1363 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1364 
1365 	/* The next event should be for the child thread's death. */
1366 	wpid = waitpid(fpid, &status, 0);
1367 	REQUIRE_EQ(wpid, fpid);
1368 	ATF_REQUIRE(WIFSTOPPED(status));
1369 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1370 
1371 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1372 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)),
1373 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1374 	REQUIRE_EQ(pl.pl_lwpid, lwps[1]);
1375 
1376 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1377 
1378 	/* The last event should be for the child process's exit. */
1379 	wpid = waitpid(fpid, &status, 0);
1380 	ATF_REQUIRE(WIFEXITED(status));
1381 	REQUIRE_EQ(WEXITSTATUS(status), 1);
1382 
1383 	wpid = wait(&status);
1384 	REQUIRE_EQ(wpid, -1);
1385 	REQUIRE_EQ(errno, ECHILD);
1386 }
1387 
1388 static void *
1389 exec_thread(void *arg __unused)
1390 {
1391 
1392 	execl("/usr/bin/true", "true", NULL);
1393 	exit(127);
1394 }
1395 
1396 static __dead2 void
1397 exec_thread_main(void)
1398 {
1399 	pthread_t thread;
1400 
1401 	CHILD_REQUIRE_EQ(pthread_create(&thread, NULL, exec_thread, NULL), 0);
1402 	for (;;)
1403 		sleep(60);
1404 	exit(1);
1405 }
1406 
1407 /*
1408  * Verify that the expected LWP events are reported for a multithreaded
1409  * process that calls execve(2).
1410  */
1411 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1412 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1413 {
1414 	struct ptrace_lwpinfo pl;
1415 	pid_t fpid, wpid;
1416 	lwpid_t lwps[2];
1417 	int status;
1418 
1419 	ATF_REQUIRE((fpid = fork()) != -1);
1420 	if (fpid == 0) {
1421 		trace_me();
1422 		exec_thread_main();
1423 	}
1424 
1425 	/* The first wait() should report the stop from SIGSTOP. */
1426 	wpid = waitpid(fpid, &status, 0);
1427 	REQUIRE_EQ(wpid, fpid);
1428 	ATF_REQUIRE(WIFSTOPPED(status));
1429 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1430 
1431 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1432 	    sizeof(pl)) != -1);
1433 	lwps[0] = pl.pl_lwpid;
1434 
1435 	REQUIRE_EQ(ptrace(PT_LWP_EVENTS, wpid, NULL, 1), 0);
1436 
1437 	/* Continue the child ignoring the SIGSTOP. */
1438 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1439 
1440 	/* The first event should be for the child thread's birth. */
1441 	wpid = waitpid(fpid, &status, 0);
1442 	REQUIRE_EQ(wpid, fpid);
1443 	ATF_REQUIRE(WIFSTOPPED(status));
1444 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1445 
1446 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1447 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)),
1448 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1449 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1450 	lwps[1] = pl.pl_lwpid;
1451 
1452 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1453 
1454 	/*
1455 	 * The next event should be for the main thread's death due to
1456 	 * single threading from execve().
1457 	 */
1458 	wpid = waitpid(fpid, &status, 0);
1459 	REQUIRE_EQ(wpid, fpid);
1460 	ATF_REQUIRE(WIFSTOPPED(status));
1461 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1462 
1463 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1464 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)),
1465 	    (PL_FLAG_EXITED));
1466 	REQUIRE_EQ(pl.pl_lwpid, lwps[0]);
1467 
1468 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1469 
1470 	/* The next event should be for the child process's exec. */
1471 	wpid = waitpid(fpid, &status, 0);
1472 	ATF_REQUIRE(WIFSTOPPED(status));
1473 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1474 
1475 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1476 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)),
1477 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1478 	REQUIRE_EQ(pl.pl_lwpid, lwps[1]);
1479 
1480 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1481 
1482 	/* The last event should be for the child process's exit. */
1483 	wpid = waitpid(fpid, &status, 0);
1484 	ATF_REQUIRE(WIFEXITED(status));
1485 	REQUIRE_EQ(WEXITSTATUS(status), 0);
1486 
1487 	wpid = wait(&status);
1488 	REQUIRE_EQ(wpid, -1);
1489 	REQUIRE_EQ(errno, ECHILD);
1490 }
1491 
1492 static void
1493 handler(int sig __unused)
1494 {
1495 }
1496 
1497 static void
1498 signal_main(void)
1499 {
1500 
1501 	signal(SIGINFO, handler);
1502 	raise(SIGINFO);
1503 	exit(0);
1504 }
1505 
1506 /*
1507  * Verify that the expected ptrace event is reported for a signal.
1508  */
1509 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1510 ATF_TC_BODY(ptrace__siginfo, tc)
1511 {
1512 	struct ptrace_lwpinfo pl;
1513 	pid_t fpid, wpid;
1514 	int status;
1515 
1516 	ATF_REQUIRE((fpid = fork()) != -1);
1517 	if (fpid == 0) {
1518 		trace_me();
1519 		signal_main();
1520 	}
1521 
1522 	/* The first wait() should report the stop from SIGSTOP. */
1523 	wpid = waitpid(fpid, &status, 0);
1524 	REQUIRE_EQ(wpid, fpid);
1525 	ATF_REQUIRE(WIFSTOPPED(status));
1526 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1527 
1528 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1529 
1530 	/* The next event should be for the SIGINFO. */
1531 	wpid = waitpid(fpid, &status, 0);
1532 	ATF_REQUIRE(WIFSTOPPED(status));
1533 	REQUIRE_EQ(WSTOPSIG(status), SIGINFO);
1534 
1535 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1536 	REQUIRE_EQ(pl.pl_event, PL_EVENT_SIGNAL);
1537 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1538 	REQUIRE_EQ(pl.pl_siginfo.si_code, SI_LWP);
1539 	REQUIRE_EQ(pl.pl_siginfo.si_pid, wpid);
1540 
1541 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1542 
1543 	/* The last event should be for the child process's exit. */
1544 	wpid = waitpid(fpid, &status, 0);
1545 	ATF_REQUIRE(WIFEXITED(status));
1546 	REQUIRE_EQ(WEXITSTATUS(status), 0);
1547 
1548 	wpid = wait(&status);
1549 	REQUIRE_EQ(wpid, -1);
1550 	REQUIRE_EQ(errno, ECHILD);
1551 }
1552 
1553 /*
1554  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1555  */
1556 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1557 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1558 {
1559 	pid_t fpid, wpid;
1560 	int events, status;
1561 
1562 	ATF_REQUIRE((fpid = fork()) != -1);
1563 	if (fpid == 0) {
1564 		trace_me();
1565 		exec_thread(NULL);
1566 	}
1567 
1568 	/* The first wait() should report the stop from SIGSTOP. */
1569 	wpid = waitpid(fpid, &status, 0);
1570 	REQUIRE_EQ(wpid, fpid);
1571 	ATF_REQUIRE(WIFSTOPPED(status));
1572 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1573 
1574 	events = 0;
1575 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1576 	    sizeof(events)) == 0);
1577 
1578 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1579 
1580 	/* Should get one event at exit. */
1581 	wpid = waitpid(fpid, &status, 0);
1582 	ATF_REQUIRE(WIFEXITED(status));
1583 	REQUIRE_EQ(WEXITSTATUS(status), 0);
1584 
1585 	wpid = wait(&status);
1586 	REQUIRE_EQ(wpid, -1);
1587 	REQUIRE_EQ(errno, ECHILD);
1588 }
1589 
1590 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1591 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1592 {
1593 	struct ptrace_lwpinfo pl;
1594 	pid_t fpid, wpid;
1595 	int events, status;
1596 
1597 	ATF_REQUIRE((fpid = fork()) != -1);
1598 	if (fpid == 0) {
1599 		trace_me();
1600 		exec_thread(NULL);
1601 	}
1602 
1603 	/* The first wait() should report the stop from SIGSTOP. */
1604 	wpid = waitpid(fpid, &status, 0);
1605 	REQUIRE_EQ(wpid, fpid);
1606 	ATF_REQUIRE(WIFSTOPPED(status));
1607 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1608 
1609 	events = PTRACE_EXEC;
1610 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1611 	    sizeof(events)) == 0);
1612 
1613 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1614 
1615 	/* The next event should be for the child process's exec. */
1616 	wpid = waitpid(fpid, &status, 0);
1617 	ATF_REQUIRE(WIFSTOPPED(status));
1618 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1619 
1620 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1621 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)),
1622 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1623 
1624 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1625 
1626 	/* The last event should be for the child process's exit. */
1627 	wpid = waitpid(fpid, &status, 0);
1628 	ATF_REQUIRE(WIFEXITED(status));
1629 	REQUIRE_EQ(WEXITSTATUS(status), 0);
1630 
1631 	wpid = wait(&status);
1632 	REQUIRE_EQ(wpid, -1);
1633 	REQUIRE_EQ(errno, ECHILD);
1634 }
1635 
1636 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1637 ATF_TC_BODY(ptrace__event_mask, tc)
1638 {
1639 	pid_t fpid, wpid;
1640 	int events, status;
1641 
1642 	ATF_REQUIRE((fpid = fork()) != -1);
1643 	if (fpid == 0) {
1644 		trace_me();
1645 		exit(0);
1646 	}
1647 
1648 	/* The first wait() should report the stop from SIGSTOP. */
1649 	wpid = waitpid(fpid, &status, 0);
1650 	REQUIRE_EQ(wpid, fpid);
1651 	ATF_REQUIRE(WIFSTOPPED(status));
1652 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1653 
1654 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1655 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1656 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1657 	    sizeof(events)) == 0);
1658 	ATF_REQUIRE(events & PTRACE_FORK);
1659 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1660 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1661 	    sizeof(events)) == 0);
1662 	ATF_REQUIRE(!(events & PTRACE_FORK));
1663 
1664 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1665 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1666 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1667 	    sizeof(events)) == 0);
1668 	ATF_REQUIRE(events & PTRACE_LWP);
1669 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1670 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1671 	    sizeof(events)) == 0);
1672 	ATF_REQUIRE(!(events & PTRACE_LWP));
1673 
1674 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1675 
1676 	/* Should get one event at exit. */
1677 	wpid = waitpid(fpid, &status, 0);
1678 	ATF_REQUIRE(WIFEXITED(status));
1679 	REQUIRE_EQ(WEXITSTATUS(status), 0);
1680 
1681 	wpid = wait(&status);
1682 	REQUIRE_EQ(wpid, -1);
1683 	REQUIRE_EQ(errno, ECHILD);
1684 }
1685 
1686 /*
1687  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1688  */
1689 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1690 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1691 {
1692 	struct ptrace_lwpinfo pl;
1693 	pid_t fpid, wpid;
1694 	int events, status;
1695 
1696 	ATF_REQUIRE((fpid = fork()) != -1);
1697 	if (fpid == 0) {
1698 		trace_me();
1699 		follow_fork_parent(true);
1700 	}
1701 
1702 	/* The first wait() should report the stop from SIGSTOP. */
1703 	wpid = waitpid(fpid, &status, 0);
1704 	REQUIRE_EQ(wpid, fpid);
1705 	ATF_REQUIRE(WIFSTOPPED(status));
1706 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1707 
1708 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1709 	    sizeof(events)) == 0);
1710 	events |= PTRACE_VFORK;
1711 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1712 	    sizeof(events)) == 0);
1713 
1714 	/* Continue the child ignoring the SIGSTOP. */
1715 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1716 
1717 	/* The next event should report the end of the vfork. */
1718 	wpid = wait(&status);
1719 	REQUIRE_EQ(wpid, fpid);
1720 	ATF_REQUIRE(WIFSTOPPED(status));
1721 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1722 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1723 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1724 
1725 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1726 
1727 	wpid = wait(&status);
1728 	REQUIRE_EQ(wpid, fpid);
1729 	ATF_REQUIRE(WIFEXITED(status));
1730 	REQUIRE_EQ(WEXITSTATUS(status), 1);
1731 
1732 	wpid = wait(&status);
1733 	REQUIRE_EQ(wpid, -1);
1734 	REQUIRE_EQ(errno, ECHILD);
1735 }
1736 
1737 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1738 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1739 {
1740 	struct ptrace_lwpinfo pl[2];
1741 	pid_t children[2], fpid, wpid;
1742 	int events, status;
1743 
1744 	ATF_REQUIRE((fpid = fork()) != -1);
1745 	if (fpid == 0) {
1746 		trace_me();
1747 		follow_fork_parent(true);
1748 	}
1749 
1750 	/* Parent process. */
1751 	children[0] = fpid;
1752 
1753 	/* The first wait() should report the stop from SIGSTOP. */
1754 	wpid = waitpid(children[0], &status, 0);
1755 	REQUIRE_EQ(wpid, children[0]);
1756 	ATF_REQUIRE(WIFSTOPPED(status));
1757 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1758 
1759 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1760 	    sizeof(events)) == 0);
1761 	events |= PTRACE_FORK | PTRACE_VFORK;
1762 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1763 	    sizeof(events)) == 0);
1764 
1765 	/* Continue the child ignoring the SIGSTOP. */
1766 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1767 
1768 	/* Wait for both halves of the fork event to get reported. */
1769 	children[1] = handle_fork_events(children[0], pl);
1770 	ATF_REQUIRE(children[1] > 0);
1771 
1772 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1773 
1774 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1775 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1776 
1777 	/*
1778 	 * The child can't exit until the grandchild reports status, so the
1779 	 * grandchild should report its exit first to the debugger.
1780 	 */
1781 	wpid = waitpid(children[1], &status, 0);
1782 	REQUIRE_EQ(wpid, children[1]);
1783 	ATF_REQUIRE(WIFEXITED(status));
1784 	REQUIRE_EQ(WEXITSTATUS(status), 2);
1785 
1786 	/*
1787 	 * The child should report it's vfork() completion before it
1788 	 * exits.
1789 	 */
1790 	wpid = wait(&status);
1791 	REQUIRE_EQ(wpid, children[0]);
1792 	ATF_REQUIRE(WIFSTOPPED(status));
1793 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1794 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1795 	    -1);
1796 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1797 
1798 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1799 
1800 	wpid = wait(&status);
1801 	REQUIRE_EQ(wpid, children[0]);
1802 	ATF_REQUIRE(WIFEXITED(status));
1803 	REQUIRE_EQ(WEXITSTATUS(status), 1);
1804 
1805 	wpid = wait(&status);
1806 	REQUIRE_EQ(wpid, -1);
1807 	REQUIRE_EQ(errno, ECHILD);
1808 }
1809 
1810 #ifdef HAVE_BREAKPOINT
1811 /*
1812  * Verify that no more events are reported after PT_KILL except for the
1813  * process exit when stopped due to a breakpoint trap.
1814  */
1815 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1816 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1817 {
1818 	pid_t fpid, wpid;
1819 	int status;
1820 
1821 	ATF_REQUIRE((fpid = fork()) != -1);
1822 	if (fpid == 0) {
1823 		trace_me();
1824 		breakpoint();
1825 		exit(1);
1826 	}
1827 
1828 	/* The first wait() should report the stop from SIGSTOP. */
1829 	wpid = waitpid(fpid, &status, 0);
1830 	REQUIRE_EQ(wpid, fpid);
1831 	ATF_REQUIRE(WIFSTOPPED(status));
1832 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1833 
1834 	/* Continue the child ignoring the SIGSTOP. */
1835 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1836 
1837 	/* The second wait() should report hitting the breakpoint. */
1838 	wpid = waitpid(fpid, &status, 0);
1839 	REQUIRE_EQ(wpid, fpid);
1840 	ATF_REQUIRE(WIFSTOPPED(status));
1841 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1842 
1843 	/* Kill the child process. */
1844 	REQUIRE_EQ(ptrace(PT_KILL, fpid, 0, 0), 0);
1845 
1846 	/* The last wait() should report the SIGKILL. */
1847 	wpid = waitpid(fpid, &status, 0);
1848 	REQUIRE_EQ(wpid, fpid);
1849 	ATF_REQUIRE(WIFSIGNALED(status));
1850 	REQUIRE_EQ(WTERMSIG(status), SIGKILL);
1851 
1852 	wpid = wait(&status);
1853 	REQUIRE_EQ(wpid, -1);
1854 	REQUIRE_EQ(errno, ECHILD);
1855 }
1856 #endif /* HAVE_BREAKPOINT */
1857 
1858 /*
1859  * Verify that no more events are reported after PT_KILL except for the
1860  * process exit when stopped inside of a system call.
1861  */
1862 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1863 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1864 {
1865 	struct ptrace_lwpinfo pl;
1866 	pid_t fpid, wpid;
1867 	int status;
1868 
1869 	ATF_REQUIRE((fpid = fork()) != -1);
1870 	if (fpid == 0) {
1871 		trace_me();
1872 		getpid();
1873 		exit(1);
1874 	}
1875 
1876 	/* The first wait() should report the stop from SIGSTOP. */
1877 	wpid = waitpid(fpid, &status, 0);
1878 	REQUIRE_EQ(wpid, fpid);
1879 	ATF_REQUIRE(WIFSTOPPED(status));
1880 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1881 
1882 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1883 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
1884 
1885 	/* The second wait() should report a system call entry for getpid(). */
1886 	wpid = waitpid(fpid, &status, 0);
1887 	REQUIRE_EQ(wpid, fpid);
1888 	ATF_REQUIRE(WIFSTOPPED(status));
1889 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1890 
1891 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1892 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1893 
1894 	/* Kill the child process. */
1895 	REQUIRE_EQ(ptrace(PT_KILL, fpid, 0, 0), 0);
1896 
1897 	/* The last wait() should report the SIGKILL. */
1898 	wpid = waitpid(fpid, &status, 0);
1899 	REQUIRE_EQ(wpid, fpid);
1900 	ATF_REQUIRE(WIFSIGNALED(status));
1901 	REQUIRE_EQ(WTERMSIG(status), SIGKILL);
1902 
1903 	wpid = wait(&status);
1904 	REQUIRE_EQ(wpid, -1);
1905 	REQUIRE_EQ(errno, ECHILD);
1906 }
1907 
1908 /*
1909  * Verify that no more events are reported after PT_KILL except for the
1910  * process exit when killing a multithreaded process.
1911  */
1912 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1913 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1914 {
1915 	struct ptrace_lwpinfo pl;
1916 	pid_t fpid, wpid;
1917 	lwpid_t main_lwp;
1918 	int status;
1919 
1920 	ATF_REQUIRE((fpid = fork()) != -1);
1921 	if (fpid == 0) {
1922 		trace_me();
1923 		simple_thread_main();
1924 	}
1925 
1926 	/* The first wait() should report the stop from SIGSTOP. */
1927 	wpid = waitpid(fpid, &status, 0);
1928 	REQUIRE_EQ(wpid, fpid);
1929 	ATF_REQUIRE(WIFSTOPPED(status));
1930 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
1931 
1932 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1933 	    sizeof(pl)) != -1);
1934 	main_lwp = pl.pl_lwpid;
1935 
1936 	REQUIRE_EQ(ptrace(PT_LWP_EVENTS, wpid, NULL, 1), 0);
1937 
1938 	/* Continue the child ignoring the SIGSTOP. */
1939 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
1940 
1941 	/* The first event should be for the child thread's birth. */
1942 	wpid = waitpid(fpid, &status, 0);
1943 	REQUIRE_EQ(wpid, fpid);
1944 	ATF_REQUIRE(WIFSTOPPED(status));
1945 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
1946 
1947 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1948 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)),
1949 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1950 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1951 
1952 	/* Kill the child process. */
1953 	REQUIRE_EQ(ptrace(PT_KILL, fpid, 0, 0), 0);
1954 
1955 	/* The last wait() should report the SIGKILL. */
1956 	wpid = waitpid(fpid, &status, 0);
1957 	REQUIRE_EQ(wpid, fpid);
1958 	ATF_REQUIRE(WIFSIGNALED(status));
1959 	REQUIRE_EQ(WTERMSIG(status), SIGKILL);
1960 
1961 	wpid = wait(&status);
1962 	REQUIRE_EQ(wpid, -1);
1963 	REQUIRE_EQ(errno, ECHILD);
1964 }
1965 
1966 static void *
1967 mask_usr1_thread(void *arg)
1968 {
1969 	pthread_barrier_t *pbarrier;
1970 	sigset_t sigmask;
1971 
1972 	pbarrier = (pthread_barrier_t*)arg;
1973 
1974 	sigemptyset(&sigmask);
1975 	sigaddset(&sigmask, SIGUSR1);
1976 	CHILD_REQUIRE_EQ(pthread_sigmask(SIG_BLOCK, &sigmask, NULL), 0);
1977 
1978 	/* Sync up with other thread after sigmask updated. */
1979 	pthread_barrier_wait(pbarrier);
1980 
1981 	for (;;)
1982 		sleep(60);
1983 
1984 	return (NULL);
1985 }
1986 
1987 /*
1988  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1989  * and prevents spurious stops due to those other signals.
1990  */
1991 ATF_TC(ptrace__PT_KILL_competing_signal);
1992 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1993 {
1994 
1995 	atf_tc_set_md_var(tc, "require.user", "root");
1996 }
1997 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1998 {
1999 	pid_t fpid, wpid;
2000 	int status;
2001 	cpuset_t setmask;
2002 	pthread_t t;
2003 	pthread_barrier_t barrier;
2004 	struct sched_param sched_param;
2005 
2006 	ATF_REQUIRE((fpid = fork()) != -1);
2007 	if (fpid == 0) {
2008 		/* Bind to one CPU so only one thread at a time will run. */
2009 		CPU_ZERO(&setmask);
2010 		CPU_SET(0, &setmask);
2011 		cpusetid_t setid;
2012 		CHILD_REQUIRE_EQ(cpuset(&setid), 0);
2013 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2014 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2015 
2016 		CHILD_REQUIRE_EQ(pthread_barrier_init(&barrier, NULL, 2), 0);
2017 
2018 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2019 		    (void*)&barrier) == 0);
2020 
2021 		/*
2022 		 * Give the main thread higher priority. The test always
2023 		 * assumes that, if both threads are able to run, the main
2024 		 * thread runs first.
2025 		 */
2026 		sched_param.sched_priority =
2027 		    (sched_get_priority_max(SCHED_FIFO) +
2028 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2029 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2030 		    SCHED_FIFO, &sched_param) == 0);
2031 		sched_param.sched_priority -= RQ_PPQ;
2032 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2033 		    &sched_param) == 0);
2034 
2035 		sigset_t sigmask;
2036 		sigemptyset(&sigmask);
2037 		sigaddset(&sigmask, SIGUSR2);
2038 		CHILD_REQUIRE_EQ(pthread_sigmask(SIG_BLOCK, &sigmask, NULL), 0);
2039 
2040 		/* Sync up with other thread after sigmask updated. */
2041 		pthread_barrier_wait(&barrier);
2042 
2043 		trace_me();
2044 
2045 		for (;;)
2046 			sleep(60);
2047 
2048 		exit(1);
2049 	}
2050 
2051 	/* The first wait() should report the stop from SIGSTOP. */
2052 	wpid = waitpid(fpid, &status, 0);
2053 	REQUIRE_EQ(wpid, fpid);
2054 	ATF_REQUIRE(WIFSTOPPED(status));
2055 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2056 
2057 	/* Continue the child ignoring the SIGSTOP. */
2058 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2059 
2060 	/* Send a signal that only the second thread can handle. */
2061 	REQUIRE_EQ(kill(fpid, SIGUSR2), 0);
2062 
2063 	/* The second wait() should report the SIGUSR2. */
2064 	wpid = waitpid(fpid, &status, 0);
2065 	REQUIRE_EQ(wpid, fpid);
2066 	ATF_REQUIRE(WIFSTOPPED(status));
2067 	REQUIRE_EQ(WSTOPSIG(status), SIGUSR2);
2068 
2069 	/* Send a signal that only the first thread can handle. */
2070 	REQUIRE_EQ(kill(fpid, SIGUSR1), 0);
2071 
2072 	/* Replace the SIGUSR2 with a kill. */
2073 	REQUIRE_EQ(ptrace(PT_KILL, fpid, 0, 0), 0);
2074 
2075 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
2076 	wpid = waitpid(fpid, &status, 0);
2077 	REQUIRE_EQ(wpid, fpid);
2078 	ATF_REQUIRE(WIFSIGNALED(status));
2079 	REQUIRE_EQ(WTERMSIG(status), SIGKILL);
2080 
2081 	wpid = wait(&status);
2082 	REQUIRE_EQ(wpid, -1);
2083 	REQUIRE_EQ(errno, ECHILD);
2084 }
2085 
2086 /*
2087  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
2088  * and prevents spurious stops caused by those events.
2089  */
2090 ATF_TC(ptrace__PT_KILL_competing_stop);
2091 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
2092 {
2093 
2094 	atf_tc_set_md_var(tc, "require.user", "root");
2095 }
2096 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
2097 {
2098 	pid_t fpid, wpid;
2099 	int status;
2100 	cpuset_t setmask;
2101 	pthread_t t;
2102 	pthread_barrier_t barrier;
2103 	lwpid_t main_lwp;
2104 	struct ptrace_lwpinfo pl;
2105 	struct sched_param sched_param;
2106 
2107 	ATF_REQUIRE((fpid = fork()) != -1);
2108 	if (fpid == 0) {
2109 		trace_me();
2110 
2111 		/* Bind to one CPU so only one thread at a time will run. */
2112 		CPU_ZERO(&setmask);
2113 		CPU_SET(0, &setmask);
2114 		cpusetid_t setid;
2115 		CHILD_REQUIRE_EQ(cpuset(&setid), 0);
2116 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2117 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2118 
2119 		CHILD_REQUIRE_EQ(pthread_barrier_init(&barrier, NULL, 2), 0);
2120 
2121 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2122 		    (void*)&barrier) == 0);
2123 
2124 		/*
2125 		 * Give the main thread higher priority. The test always
2126 		 * assumes that, if both threads are able to run, the main
2127 		 * thread runs first.
2128 		 */
2129 		sched_param.sched_priority =
2130 		    (sched_get_priority_max(SCHED_FIFO) +
2131 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2132 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2133 		    SCHED_FIFO, &sched_param) == 0);
2134 		sched_param.sched_priority -= RQ_PPQ;
2135 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2136 		    &sched_param) == 0);
2137 
2138 		sigset_t sigmask;
2139 		sigemptyset(&sigmask);
2140 		sigaddset(&sigmask, SIGUSR2);
2141 		CHILD_REQUIRE_EQ(pthread_sigmask(SIG_BLOCK, &sigmask, NULL), 0);
2142 
2143 		/* Sync up with other thread after sigmask updated. */
2144 		pthread_barrier_wait(&barrier);
2145 
2146 		/* Sync up with the test before doing the getpid(). */
2147 		raise(SIGSTOP);
2148 
2149 		getpid();
2150 		exit(1);
2151 	}
2152 
2153 	/* The first wait() should report the stop from SIGSTOP. */
2154 	wpid = waitpid(fpid, &status, 0);
2155 	REQUIRE_EQ(wpid, fpid);
2156 	ATF_REQUIRE(WIFSTOPPED(status));
2157 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2158 
2159 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2160 	main_lwp = pl.pl_lwpid;
2161 
2162 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2163 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2164 
2165 	/*
2166 	 * Continue until child is done with setup, which is indicated with
2167 	 * SIGSTOP. Ignore system calls in the meantime.
2168 	 */
2169 	for (;;) {
2170 		wpid = waitpid(fpid, &status, 0);
2171 		REQUIRE_EQ(wpid, fpid);
2172 		ATF_REQUIRE(WIFSTOPPED(status));
2173 		if (WSTOPSIG(status) == SIGTRAP) {
2174 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2175 			    sizeof(pl)) != -1);
2176 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2177 		} else {
2178 			REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2179 			break;
2180 		}
2181 		REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2182 	}
2183 
2184 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2185 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2186 
2187 	wpid = waitpid(fpid, &status, 0);
2188 	REQUIRE_EQ(wpid, fpid);
2189 	ATF_REQUIRE(WIFSTOPPED(status));
2190 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2191 
2192 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2193 	    sizeof(pl)) != -1);
2194 	REQUIRE_EQ(pl.pl_lwpid, main_lwp);
2195 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2196 	/* Prevent the main thread from hitting its syscall exit for now. */
2197 	REQUIRE_EQ(ptrace(PT_SUSPEND, main_lwp, 0, 0), 0);
2198 
2199 	/*
2200 	 * Proceed, allowing second thread to hit syscall exit for
2201 	 * pthread_barrier_wait().
2202 	 */
2203 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2204 
2205 	wpid = waitpid(fpid, &status, 0);
2206 	REQUIRE_EQ(wpid, fpid);
2207 	ATF_REQUIRE(WIFSTOPPED(status));
2208 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2209 
2210 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2211 	    sizeof(pl)) != -1);
2212 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2213 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2214 
2215 	/* Send a signal that only the second thread can handle. */
2216 	REQUIRE_EQ(kill(fpid, SIGUSR2), 0);
2217 
2218 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2219 
2220 	/* The next wait() should report the SIGUSR2. */
2221 	wpid = waitpid(fpid, &status, 0);
2222 	REQUIRE_EQ(wpid, fpid);
2223 	ATF_REQUIRE(WIFSTOPPED(status));
2224 	REQUIRE_EQ(WSTOPSIG(status), SIGUSR2);
2225 
2226 	/* Allow the main thread to try to finish its system call. */
2227 	REQUIRE_EQ(ptrace(PT_RESUME, main_lwp, 0, 0), 0);
2228 
2229 	/*
2230 	 * At this point, the main thread is in the middle of a system call and
2231 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2232 	 * be replaced with a SIGKILL below. The main thread will get to run
2233 	 * first. It should notice the kill request (even though the signal
2234 	 * replacement occurred in the other thread) and exit accordingly.  It
2235 	 * should not stop for the system call exit event.
2236 	 */
2237 
2238 	/* Replace the SIGUSR2 with a kill. */
2239 	REQUIRE_EQ(ptrace(PT_KILL, fpid, 0, 0), 0);
2240 
2241 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2242 	wpid = waitpid(fpid, &status, 0);
2243 	REQUIRE_EQ(wpid, fpid);
2244 	ATF_REQUIRE(WIFSIGNALED(status));
2245 	REQUIRE_EQ(WTERMSIG(status), SIGKILL);
2246 
2247 	wpid = wait(&status);
2248 	REQUIRE_EQ(wpid, -1);
2249 	REQUIRE_EQ(errno, ECHILD);
2250 }
2251 
2252 static void
2253 sigusr1_handler(int sig)
2254 {
2255 
2256 	CHILD_REQUIRE_EQ(sig, SIGUSR1);
2257 	_exit(2);
2258 }
2259 
2260 /*
2261  * Verify that even if the signal queue is full for a child process,
2262  * a PT_KILL will kill the process.
2263  */
2264 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2265 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2266 {
2267 	pid_t fpid, wpid;
2268 	int status;
2269 	int max_pending_per_proc;
2270 	size_t len;
2271 	int i;
2272 
2273 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2274 
2275 	ATF_REQUIRE((fpid = fork()) != -1);
2276 	if (fpid == 0) {
2277 		trace_me();
2278 		exit(1);
2279 	}
2280 
2281 	/* The first wait() should report the stop from SIGSTOP. */
2282 	wpid = waitpid(fpid, &status, 0);
2283 	REQUIRE_EQ(wpid, fpid);
2284 	ATF_REQUIRE(WIFSTOPPED(status));
2285 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2286 
2287 	len = sizeof(max_pending_per_proc);
2288 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2289 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2290 
2291 	/* Fill the signal queue. */
2292 	for (i = 0; i < max_pending_per_proc; ++i)
2293 		REQUIRE_EQ(kill(fpid, SIGUSR1), 0);
2294 
2295 	/* Kill the child process. */
2296 	REQUIRE_EQ(ptrace(PT_KILL, fpid, 0, 0), 0);
2297 
2298 	/* The last wait() should report the SIGKILL. */
2299 	wpid = waitpid(fpid, &status, 0);
2300 	REQUIRE_EQ(wpid, fpid);
2301 	ATF_REQUIRE(WIFSIGNALED(status));
2302 	REQUIRE_EQ(WTERMSIG(status), SIGKILL);
2303 
2304 	wpid = wait(&status);
2305 	REQUIRE_EQ(wpid, -1);
2306 	REQUIRE_EQ(errno, ECHILD);
2307 }
2308 
2309 /*
2310  * Verify that when stopped at a system call entry, a signal can be
2311  * requested with PT_CONTINUE which will be delivered once the system
2312  * call is complete.
2313  */
2314 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2315 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2316 {
2317 	struct ptrace_lwpinfo pl;
2318 	pid_t fpid, wpid;
2319 	int status;
2320 
2321 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2322 
2323 	ATF_REQUIRE((fpid = fork()) != -1);
2324 	if (fpid == 0) {
2325 		trace_me();
2326 		getpid();
2327 		exit(1);
2328 	}
2329 
2330 	/* The first wait() should report the stop from SIGSTOP. */
2331 	wpid = waitpid(fpid, &status, 0);
2332 	REQUIRE_EQ(wpid, fpid);
2333 	ATF_REQUIRE(WIFSTOPPED(status));
2334 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2335 
2336 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2337 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2338 
2339 	/* The second wait() should report a system call entry for getpid(). */
2340 	wpid = waitpid(fpid, &status, 0);
2341 	REQUIRE_EQ(wpid, fpid);
2342 	ATF_REQUIRE(WIFSTOPPED(status));
2343 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2344 
2345 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2346 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2347 
2348 	/* Continue the child process with a signal. */
2349 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2350 
2351 	for (;;) {
2352 		/*
2353 		 * The last wait() should report exit 2, i.e., a normal _exit
2354 		 * from the signal handler. In the meantime, catch and proceed
2355 		 * past any syscall stops.
2356 		 */
2357 		wpid = waitpid(fpid, &status, 0);
2358 		REQUIRE_EQ(wpid, fpid);
2359 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2360 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2361 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2362 			REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2363 		} else {
2364 			ATF_REQUIRE(WIFEXITED(status));
2365 			REQUIRE_EQ(WEXITSTATUS(status), 2);
2366 			break;
2367 		}
2368 	}
2369 
2370 	wpid = wait(&status);
2371 	REQUIRE_EQ(wpid, -1);
2372 	REQUIRE_EQ(errno, ECHILD);
2373 }
2374 
2375 static void
2376 sigusr1_counting_handler(int sig)
2377 {
2378 	static int counter = 0;
2379 
2380 	CHILD_REQUIRE_EQ(sig, SIGUSR1);
2381 	counter++;
2382 	if (counter == 2)
2383 		_exit(2);
2384 }
2385 
2386 /*
2387  * Verify that, when continuing from a stop at system call entry and exit,
2388  * a signal can be requested from both stops, and both will be delivered when
2389  * the system call is complete.
2390  */
2391 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2392 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2393 {
2394 	struct ptrace_lwpinfo pl;
2395 	pid_t fpid, wpid;
2396 	int status;
2397 
2398 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2399 
2400 	ATF_REQUIRE((fpid = fork()) != -1);
2401 	if (fpid == 0) {
2402 		trace_me();
2403 		getpid();
2404 		exit(1);
2405 	}
2406 
2407 	/* The first wait() should report the stop from SIGSTOP. */
2408 	wpid = waitpid(fpid, &status, 0);
2409 	REQUIRE_EQ(wpid, fpid);
2410 	ATF_REQUIRE(WIFSTOPPED(status));
2411 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2412 
2413 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2414 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2415 
2416 	/* The second wait() should report a system call entry for getpid(). */
2417 	wpid = waitpid(fpid, &status, 0);
2418 	REQUIRE_EQ(wpid, fpid);
2419 	ATF_REQUIRE(WIFSTOPPED(status));
2420 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2421 
2422 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2423 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2424 
2425 	/* Continue the child process with a signal. */
2426 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2427 
2428 	/* The third wait() should report a system call exit for getpid(). */
2429 	wpid = waitpid(fpid, &status, 0);
2430 	REQUIRE_EQ(wpid, fpid);
2431 	ATF_REQUIRE(WIFSTOPPED(status));
2432 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2433 
2434 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2435 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2436 
2437 	/* Continue the child process with a signal. */
2438 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2439 
2440 	for (;;) {
2441 		/*
2442 		 * The last wait() should report exit 2, i.e., a normal _exit
2443 		 * from the signal handler. In the meantime, catch and proceed
2444 		 * past any syscall stops.
2445 		 */
2446 		wpid = waitpid(fpid, &status, 0);
2447 		REQUIRE_EQ(wpid, fpid);
2448 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2449 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2450 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2451 			REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2452 		} else {
2453 			ATF_REQUIRE(WIFEXITED(status));
2454 			REQUIRE_EQ(WEXITSTATUS(status), 2);
2455 			break;
2456 		}
2457 	}
2458 
2459 	wpid = wait(&status);
2460 	REQUIRE_EQ(wpid, -1);
2461 	REQUIRE_EQ(errno, ECHILD);
2462 }
2463 
2464 /*
2465  * Verify that even if the signal queue is full for a child process,
2466  * a PT_CONTINUE with a signal will not result in loss of that signal.
2467  */
2468 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2469 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2470 {
2471 	pid_t fpid, wpid;
2472 	int status;
2473 	int max_pending_per_proc;
2474 	size_t len;
2475 	int i;
2476 
2477 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2478 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2479 
2480 	ATF_REQUIRE((fpid = fork()) != -1);
2481 	if (fpid == 0) {
2482 		trace_me();
2483 		exit(1);
2484 	}
2485 
2486 	/* The first wait() should report the stop from SIGSTOP. */
2487 	wpid = waitpid(fpid, &status, 0);
2488 	REQUIRE_EQ(wpid, fpid);
2489 	ATF_REQUIRE(WIFSTOPPED(status));
2490 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2491 
2492 	len = sizeof(max_pending_per_proc);
2493 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2494 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2495 
2496 	/* Fill the signal queue. */
2497 	for (i = 0; i < max_pending_per_proc; ++i)
2498 		REQUIRE_EQ(kill(fpid, SIGUSR2), 0);
2499 
2500 	/* Continue with signal. */
2501 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2502 
2503 	for (;;) {
2504 		wpid = waitpid(fpid, &status, 0);
2505 		REQUIRE_EQ(wpid, fpid);
2506 		if (WIFSTOPPED(status)) {
2507 			REQUIRE_EQ(WSTOPSIG(status), SIGUSR2);
2508 			REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2509 		} else {
2510 			/*
2511 			 * The last wait() should report normal _exit from the
2512 			 * SIGUSR1 handler.
2513 			 */
2514 			ATF_REQUIRE(WIFEXITED(status));
2515 			REQUIRE_EQ(WEXITSTATUS(status), 2);
2516 			break;
2517 		}
2518 	}
2519 
2520 	wpid = wait(&status);
2521 	REQUIRE_EQ(wpid, -1);
2522 	REQUIRE_EQ(errno, ECHILD);
2523 }
2524 
2525 static sem_t sigusr1_sem;
2526 static int got_usr1;
2527 
2528 static void
2529 sigusr1_sempost_handler(int sig __unused)
2530 {
2531 
2532 	got_usr1++;
2533 	CHILD_REQUIRE_EQ(sem_post(&sigusr1_sem), 0);
2534 }
2535 
2536 /*
2537  * Verify that even if the signal queue is full for a child process,
2538  * and the signal is masked, a PT_CONTINUE with a signal will not
2539  * result in loss of that signal.
2540  */
2541 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
2542 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue, tc)
2543 {
2544 	struct ptrace_lwpinfo pl;
2545 	pid_t fpid, wpid;
2546 	int status, err;
2547 	int max_pending_per_proc;
2548 	size_t len;
2549 	int i;
2550 	sigset_t sigmask;
2551 
2552 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2553 	REQUIRE_EQ(sem_init(&sigusr1_sem, 0, 0), 0);
2554 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2555 
2556 	got_usr1 = 0;
2557 	ATF_REQUIRE((fpid = fork()) != -1);
2558 	if (fpid == 0) {
2559 		CHILD_REQUIRE_EQ(sigemptyset(&sigmask), 0);
2560 		CHILD_REQUIRE_EQ(sigaddset(&sigmask, SIGUSR1), 0);
2561 		CHILD_REQUIRE_EQ(sigprocmask(SIG_BLOCK, &sigmask, NULL), 0);
2562 
2563 		trace_me();
2564 		CHILD_REQUIRE_EQ(got_usr1, 0);
2565 
2566 		/* Allow the pending SIGUSR1 in now. */
2567 		CHILD_REQUIRE_EQ(sigprocmask(SIG_UNBLOCK, &sigmask, NULL), 0);
2568 		/* Wait to receive the SIGUSR1. */
2569 		do {
2570 			err = sem_wait(&sigusr1_sem);
2571 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2572 		} while (err != 0 && errno == EINTR);
2573 		CHILD_REQUIRE_EQ(got_usr1, 1);
2574 		exit(1);
2575 	}
2576 
2577 	/* The first wait() should report the stop from SIGSTOP. */
2578 	wpid = waitpid(fpid, &status, 0);
2579 	REQUIRE_EQ(wpid, fpid);
2580 	ATF_REQUIRE(WIFSTOPPED(status));
2581 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2582 
2583 	len = sizeof(max_pending_per_proc);
2584 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2585 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2586 
2587 	/* Fill the signal queue. */
2588 	for (i = 0; i < max_pending_per_proc; ++i)
2589 		REQUIRE_EQ(kill(fpid, SIGUSR2), 0);
2590 
2591 	/* Continue with signal. */
2592 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2593 
2594 	/* Collect and ignore all of the SIGUSR2. */
2595 	for (i = 0; i < max_pending_per_proc; ++i) {
2596 		wpid = waitpid(fpid, &status, 0);
2597 		REQUIRE_EQ(wpid, fpid);
2598 		ATF_REQUIRE(WIFSTOPPED(status));
2599 		REQUIRE_EQ(WSTOPSIG(status), SIGUSR2);
2600 		REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2601 	}
2602 
2603 	/* Now our PT_CONTINUE'd SIGUSR1 should cause a stop after unmask. */
2604 	wpid = waitpid(fpid, &status, 0);
2605 	REQUIRE_EQ(wpid, fpid);
2606 	ATF_REQUIRE(WIFSTOPPED(status));
2607 	REQUIRE_EQ(WSTOPSIG(status), SIGUSR1);
2608 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2609 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGUSR1);
2610 
2611 	/* Continue the child, ignoring the SIGUSR1. */
2612 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2613 
2614 	/* The last wait() should report exit after receiving SIGUSR1. */
2615 	wpid = waitpid(fpid, &status, 0);
2616 	REQUIRE_EQ(wpid, fpid);
2617 	ATF_REQUIRE(WIFEXITED(status));
2618 	REQUIRE_EQ(WEXITSTATUS(status), 1);
2619 
2620 	wpid = wait(&status);
2621 	REQUIRE_EQ(wpid, -1);
2622 	REQUIRE_EQ(errno, ECHILD);
2623 }
2624 
2625 /*
2626  * Verify that, after stopping due to a signal, that signal can be
2627  * replaced with another signal.
2628  */
2629 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2630 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2631 {
2632 	struct ptrace_lwpinfo pl;
2633 	pid_t fpid, wpid;
2634 	int status;
2635 
2636 	ATF_REQUIRE((fpid = fork()) != -1);
2637 	if (fpid == 0) {
2638 		trace_me();
2639 		sleep(20);
2640 		exit(1);
2641 	}
2642 
2643 	/* The first wait() should report the stop from SIGSTOP. */
2644 	wpid = waitpid(fpid, &status, 0);
2645 	REQUIRE_EQ(wpid, fpid);
2646 	ATF_REQUIRE(WIFSTOPPED(status));
2647 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2648 
2649 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2650 
2651 	/* Send a signal without ptrace. */
2652 	REQUIRE_EQ(kill(fpid, SIGINT), 0);
2653 
2654 	/* The second wait() should report a SIGINT was received. */
2655 	wpid = waitpid(fpid, &status, 0);
2656 	REQUIRE_EQ(wpid, fpid);
2657 	ATF_REQUIRE(WIFSTOPPED(status));
2658 	REQUIRE_EQ(WSTOPSIG(status), SIGINT);
2659 
2660 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2661 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2662 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGINT);
2663 
2664 	/* Continue the child process with a different signal. */
2665 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM), 0);
2666 
2667 	/*
2668 	 * The last wait() should report having died due to the new
2669 	 * signal, SIGTERM.
2670 	 */
2671 	wpid = waitpid(fpid, &status, 0);
2672 	REQUIRE_EQ(wpid, fpid);
2673 	ATF_REQUIRE(WIFSIGNALED(status));
2674 	REQUIRE_EQ(WTERMSIG(status), SIGTERM);
2675 
2676 	wpid = wait(&status);
2677 	REQUIRE_EQ(wpid, -1);
2678 	REQUIRE_EQ(errno, ECHILD);
2679 }
2680 
2681 /*
2682  * Verify that a signal can be passed through to the child even when there
2683  * was no true signal originally. Such cases arise when a SIGTRAP is
2684  * invented for e.g, system call stops.
2685  */
2686 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2687 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2688 {
2689 	struct ptrace_lwpinfo pl;
2690 	struct rlimit rl;
2691 	pid_t fpid, wpid;
2692 	int status;
2693 
2694 	ATF_REQUIRE((fpid = fork()) != -1);
2695 	if (fpid == 0) {
2696 		trace_me();
2697 		/* SIGTRAP expected to cause exit on syscall entry. */
2698 		rl.rlim_cur = rl.rlim_max = 0;
2699 		REQUIRE_EQ(setrlimit(RLIMIT_CORE, &rl), 0);
2700 		getpid();
2701 		exit(1);
2702 	}
2703 
2704 	/* The first wait() should report the stop from SIGSTOP. */
2705 	wpid = waitpid(fpid, &status, 0);
2706 	REQUIRE_EQ(wpid, fpid);
2707 	ATF_REQUIRE(WIFSTOPPED(status));
2708 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2709 
2710 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2711 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2712 
2713 	/* The second wait() should report a system call entry for getpid(). */
2714 	wpid = waitpid(fpid, &status, 0);
2715 	REQUIRE_EQ(wpid, fpid);
2716 	ATF_REQUIRE(WIFSTOPPED(status));
2717 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2718 
2719 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2720 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2721 
2722 	/* Continue the child process with a SIGTRAP. */
2723 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP), 0);
2724 
2725 	for (;;) {
2726 		/*
2727 		 * The last wait() should report exit due to SIGTRAP.  In the
2728 		 * meantime, catch and proceed past any syscall stops.
2729 		 */
2730 		wpid = waitpid(fpid, &status, 0);
2731 		REQUIRE_EQ(wpid, fpid);
2732 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2733 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2734 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2735 			REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2736 		} else {
2737 			ATF_REQUIRE(WIFSIGNALED(status));
2738 			REQUIRE_EQ(WTERMSIG(status), SIGTRAP);
2739 			break;
2740 		}
2741 	}
2742 
2743 	wpid = wait(&status);
2744 	REQUIRE_EQ(wpid, -1);
2745 	REQUIRE_EQ(errno, ECHILD);
2746 }
2747 
2748 /*
2749  * A mixed bag PT_CONTINUE with signal test.
2750  */
2751 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2752 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2753 {
2754 	struct ptrace_lwpinfo pl;
2755 	pid_t fpid, wpid;
2756 	int status;
2757 
2758 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2759 
2760 	ATF_REQUIRE((fpid = fork()) != -1);
2761 	if (fpid == 0) {
2762 		trace_me();
2763 		getpid();
2764 		exit(1);
2765 	}
2766 
2767 	/* The first wait() should report the stop from SIGSTOP. */
2768 	wpid = waitpid(fpid, &status, 0);
2769 	REQUIRE_EQ(wpid, fpid);
2770 	ATF_REQUIRE(WIFSTOPPED(status));
2771 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2772 
2773 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2774 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
2775 
2776 	/* The second wait() should report a system call entry for getpid(). */
2777 	wpid = waitpid(fpid, &status, 0);
2778 	REQUIRE_EQ(wpid, fpid);
2779 	ATF_REQUIRE(WIFSTOPPED(status));
2780 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2781 
2782 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2783 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2784 
2785 	/* Continue with the first SIGUSR1. */
2786 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2787 
2788 	/* The next wait() should report a system call exit for getpid(). */
2789 	wpid = waitpid(fpid, &status, 0);
2790 	REQUIRE_EQ(wpid, fpid);
2791 	ATF_REQUIRE(WIFSTOPPED(status));
2792 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
2793 
2794 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2795 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2796 
2797 	/* Send an ABRT without ptrace. */
2798 	REQUIRE_EQ(kill(fpid, SIGABRT), 0);
2799 
2800 	/* Continue normally. */
2801 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2802 
2803 	/* The next wait() should report the SIGABRT. */
2804 	wpid = waitpid(fpid, &status, 0);
2805 	REQUIRE_EQ(wpid, fpid);
2806 	ATF_REQUIRE(WIFSTOPPED(status));
2807 	REQUIRE_EQ(WSTOPSIG(status), SIGABRT);
2808 
2809 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2810 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2811 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGABRT);
2812 
2813 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2814 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2815 
2816 	for (;;) {
2817 		/*
2818 		 * The last wait() should report exit 2, i.e., a normal _exit
2819 		 * from the signal handler. In the meantime, catch and proceed
2820 		 * past any syscall stops.
2821 		 */
2822 		wpid = waitpid(fpid, &status, 0);
2823 		REQUIRE_EQ(wpid, fpid);
2824 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2825 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2826 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2827 			REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2828 		} else {
2829 			ATF_REQUIRE(WIFEXITED(status));
2830 			REQUIRE_EQ(WEXITSTATUS(status), 2);
2831 			break;
2832 		}
2833 	}
2834 
2835 	wpid = wait(&status);
2836 	REQUIRE_EQ(wpid, -1);
2837 	REQUIRE_EQ(errno, ECHILD);
2838 }
2839 
2840 /*
2841  * Verify a signal delivered by ptrace is noticed by kevent(2).
2842  */
2843 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2844 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2845 {
2846 	pid_t fpid, wpid;
2847 	int status, kq, nevents;
2848 	struct kevent kev;
2849 
2850 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2851 
2852 	ATF_REQUIRE((fpid = fork()) != -1);
2853 	if (fpid == 0) {
2854 		CHILD_REQUIRE((kq = kqueue()) > 0);
2855 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2856 		CHILD_REQUIRE_EQ(kevent(kq, &kev, 1, NULL, 0, NULL), 0);
2857 
2858 		trace_me();
2859 
2860 		for (;;) {
2861 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2862 			if (nevents == -1 && errno == EINTR)
2863 				continue;
2864 			CHILD_REQUIRE(nevents > 0);
2865 			CHILD_REQUIRE_EQ(kev.filter, EVFILT_SIGNAL);
2866 			CHILD_REQUIRE_EQ(kev.ident, (uintptr_t)SIGUSR1);
2867 			break;
2868 		}
2869 
2870 		exit(1);
2871 	}
2872 
2873 	/* The first wait() should report the stop from SIGSTOP. */
2874 	wpid = waitpid(fpid, &status, 0);
2875 	REQUIRE_EQ(wpid, fpid);
2876 	ATF_REQUIRE(WIFSTOPPED(status));
2877 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2878 
2879 	/* Continue with the SIGUSR1. */
2880 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2881 
2882 	/*
2883 	 * The last wait() should report normal exit with code 1.
2884 	 */
2885 	wpid = waitpid(fpid, &status, 0);
2886 	REQUIRE_EQ(wpid, fpid);
2887 	ATF_REQUIRE(WIFEXITED(status));
2888 	REQUIRE_EQ(WEXITSTATUS(status), 1);
2889 
2890 	wpid = wait(&status);
2891 	REQUIRE_EQ(wpid, -1);
2892 	REQUIRE_EQ(errno, ECHILD);
2893 }
2894 
2895 static void *
2896 signal_thread(void *arg)
2897 {
2898 	int err;
2899 	sigset_t sigmask;
2900 
2901 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2902 
2903 	/* Wait for this thread to receive a SIGUSR1. */
2904 	do {
2905 		err = sem_wait(&sigusr1_sem);
2906 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2907 	} while (err != 0 && errno == EINTR);
2908 
2909 	/* Free our companion thread from the barrier. */
2910 	pthread_barrier_wait(pbarrier);
2911 
2912 	/*
2913 	 * Swap ignore duties; the next SIGUSR1 should go to the
2914 	 * other thread.
2915 	 */
2916 	CHILD_REQUIRE_EQ(sigemptyset(&sigmask), 0);
2917 	CHILD_REQUIRE_EQ(sigaddset(&sigmask, SIGUSR1), 0);
2918 	CHILD_REQUIRE_EQ(pthread_sigmask(SIG_BLOCK, &sigmask, NULL), 0);
2919 
2920 	/* Sync up threads after swapping signal masks. */
2921 	pthread_barrier_wait(pbarrier);
2922 
2923 	/* Wait until our companion has received its SIGUSR1. */
2924 	pthread_barrier_wait(pbarrier);
2925 
2926 	return (NULL);
2927 }
2928 
2929 /*
2930  * Verify that a traced process with blocked signal received the
2931  * signal from kill() once unmasked.
2932  */
2933 ATF_TC_WITHOUT_HEAD(ptrace__killed_with_sigmask);
2934 ATF_TC_BODY(ptrace__killed_with_sigmask, tc)
2935 {
2936 	struct ptrace_lwpinfo pl;
2937 	pid_t fpid, wpid;
2938 	int status, err;
2939 	sigset_t sigmask;
2940 
2941 	REQUIRE_EQ(sem_init(&sigusr1_sem, 0, 0), 0);
2942 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2943 	got_usr1 = 0;
2944 
2945 	ATF_REQUIRE((fpid = fork()) != -1);
2946 	if (fpid == 0) {
2947 		CHILD_REQUIRE_EQ(sigemptyset(&sigmask), 0);
2948 		CHILD_REQUIRE_EQ(sigaddset(&sigmask, SIGUSR1), 0);
2949 		CHILD_REQUIRE_EQ(sigprocmask(SIG_BLOCK, &sigmask, NULL), 0);
2950 
2951 		trace_me();
2952 		CHILD_REQUIRE_EQ(got_usr1, 0);
2953 
2954 		/* Allow the pending SIGUSR1 in now. */
2955 		CHILD_REQUIRE_EQ(sigprocmask(SIG_UNBLOCK, &sigmask, NULL), 0);
2956 		/* Wait to receive a SIGUSR1. */
2957 		do {
2958 			err = sem_wait(&sigusr1_sem);
2959 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2960 		} while (err != 0 && errno == EINTR);
2961 		CHILD_REQUIRE_EQ(got_usr1, 1);
2962 		exit(1);
2963 	}
2964 
2965 	/* The first wait() should report the stop from SIGSTOP. */
2966 	wpid = waitpid(fpid, &status, 0);
2967 	REQUIRE_EQ(wpid, fpid);
2968 	ATF_REQUIRE(WIFSTOPPED(status));
2969 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
2970 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2971 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGSTOP);
2972 
2973 	/* Send blocked SIGUSR1 which should cause a stop. */
2974 	REQUIRE_EQ(kill(fpid, SIGUSR1), 0);
2975 
2976 	/* Continue the child ignoring the SIGSTOP. */
2977 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
2978 
2979 	/* The next wait() should report the kill(SIGUSR1) was received. */
2980 	wpid = waitpid(fpid, &status, 0);
2981 	REQUIRE_EQ(wpid, fpid);
2982 	ATF_REQUIRE(WIFSTOPPED(status));
2983 	REQUIRE_EQ(WSTOPSIG(status), SIGUSR1);
2984 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2985 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGUSR1);
2986 
2987 	/* Continue the child, allowing in the SIGUSR1. */
2988 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
2989 
2990 	/* The last wait() should report normal exit with code 1. */
2991 	wpid = waitpid(fpid, &status, 0);
2992 	REQUIRE_EQ(wpid, fpid);
2993 	ATF_REQUIRE(WIFEXITED(status));
2994 	REQUIRE_EQ(WEXITSTATUS(status), 1);
2995 
2996 	wpid = wait(&status);
2997 	REQUIRE_EQ(wpid, -1);
2998 	REQUIRE_EQ(errno, ECHILD);
2999 }
3000 
3001 /*
3002  * Verify that a traced process with blocked signal received the
3003  * signal from PT_CONTINUE once unmasked.
3004  */
3005 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigmask);
3006 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigmask, tc)
3007 {
3008 	struct ptrace_lwpinfo pl;
3009 	pid_t fpid, wpid;
3010 	int status, err;
3011 	sigset_t sigmask;
3012 
3013 	REQUIRE_EQ(sem_init(&sigusr1_sem, 0, 0), 0);
3014 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
3015 	got_usr1 = 0;
3016 
3017 	ATF_REQUIRE((fpid = fork()) != -1);
3018 	if (fpid == 0) {
3019 		CHILD_REQUIRE_EQ(sigemptyset(&sigmask), 0);
3020 		CHILD_REQUIRE_EQ(sigaddset(&sigmask, SIGUSR1), 0);
3021 		CHILD_REQUIRE_EQ(sigprocmask(SIG_BLOCK, &sigmask, NULL), 0);
3022 
3023 		trace_me();
3024 		CHILD_REQUIRE_EQ(got_usr1, 0);
3025 
3026 		/* Allow the pending SIGUSR1 in now. */
3027 		CHILD_REQUIRE_EQ(sigprocmask(SIG_UNBLOCK, &sigmask, NULL), 0);
3028 		/* Wait to receive a SIGUSR1. */
3029 		do {
3030 			err = sem_wait(&sigusr1_sem);
3031 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3032 		} while (err != 0 && errno == EINTR);
3033 
3034 		CHILD_REQUIRE_EQ(got_usr1, 1);
3035 		exit(1);
3036 	}
3037 
3038 	/* The first wait() should report the stop from SIGSTOP. */
3039 	wpid = waitpid(fpid, &status, 0);
3040 	REQUIRE_EQ(wpid, fpid);
3041 	ATF_REQUIRE(WIFSTOPPED(status));
3042 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3043 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
3044 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGSTOP);
3045 
3046 	/* Continue the child replacing SIGSTOP with SIGUSR1. */
3047 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
3048 
3049 	/* The next wait() should report the SIGUSR1 was received. */
3050 	wpid = waitpid(fpid, &status, 0);
3051 	REQUIRE_EQ(wpid, fpid);
3052 	ATF_REQUIRE(WIFSTOPPED(status));
3053 	REQUIRE_EQ(WSTOPSIG(status), SIGUSR1);
3054 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
3055 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGUSR1);
3056 
3057 	/* Continue the child, ignoring the SIGUSR1. */
3058 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3059 
3060 	/* The last wait() should report normal exit with code 1. */
3061 	wpid = waitpid(fpid, &status, 0);
3062 	REQUIRE_EQ(wpid, fpid);
3063 	ATF_REQUIRE(WIFEXITED(status));
3064 	REQUIRE_EQ(WEXITSTATUS(status), 1);
3065 
3066 	wpid = wait(&status);
3067 	REQUIRE_EQ(wpid, -1);
3068 	REQUIRE_EQ(errno, ECHILD);
3069 }
3070 
3071 /*
3072  * Verify that if ptrace stops due to a signal but continues with
3073  * a different signal that the new signal is routed to a thread
3074  * that can accept it, and that the thread is awakened by the signal
3075  * in a timely manner.
3076  */
3077 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3078 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
3079 {
3080 	pid_t fpid, wpid;
3081 	int status, err;
3082 	pthread_t t;
3083 	sigset_t sigmask;
3084 	pthread_barrier_t barrier;
3085 
3086 	REQUIRE_EQ(pthread_barrier_init(&barrier, NULL, 2), 0);
3087 	REQUIRE_EQ(sem_init(&sigusr1_sem, 0, 0), 0);
3088 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
3089 
3090 	ATF_REQUIRE((fpid = fork()) != -1);
3091 	if (fpid == 0) {
3092 		CHILD_REQUIRE_EQ(pthread_create(&t, NULL, signal_thread,
3093 		    (void *)&barrier), 0);
3094 
3095 		/* The other thread should receive the first SIGUSR1. */
3096 		CHILD_REQUIRE_EQ(sigemptyset(&sigmask), 0);
3097 		CHILD_REQUIRE_EQ(sigaddset(&sigmask, SIGUSR1), 0);
3098 		CHILD_REQUIRE_EQ(pthread_sigmask(SIG_BLOCK, &sigmask, NULL), 0);
3099 
3100 		trace_me();
3101 
3102 		/* Wait until other thread has received its SIGUSR1. */
3103 		pthread_barrier_wait(&barrier);
3104 
3105 		/*
3106 		 * Swap ignore duties; the next SIGUSR1 should go to this
3107 		 * thread.
3108 		 */
3109 		CHILD_REQUIRE_EQ(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL),
3110 		    0);
3111 
3112 		/* Sync up threads after swapping signal masks. */
3113 		pthread_barrier_wait(&barrier);
3114 
3115 		/*
3116 		 * Sync up with test code; we're ready for the next SIGUSR1
3117 		 * now.
3118 		 */
3119 		raise(SIGSTOP);
3120 
3121 		/* Wait for this thread to receive a SIGUSR1. */
3122 		do {
3123 			err = sem_wait(&sigusr1_sem);
3124 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3125 		} while (err != 0 && errno == EINTR);
3126 
3127 		/* Free the other thread from the barrier. */
3128 		pthread_barrier_wait(&barrier);
3129 
3130 		CHILD_REQUIRE_EQ(pthread_join(t, NULL), 0);
3131 
3132 		exit(1);
3133 	}
3134 
3135 	/* The first wait() should report the stop from SIGSTOP. */
3136 	wpid = waitpid(fpid, &status, 0);
3137 	REQUIRE_EQ(wpid, fpid);
3138 	ATF_REQUIRE(WIFSTOPPED(status));
3139 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3140 
3141 	/* Continue the child ignoring the SIGSTOP. */
3142 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3143 
3144 	/*
3145 	 * Send a signal without ptrace that either thread will accept (USR2,
3146 	 * in this case).
3147 	 */
3148 	REQUIRE_EQ(kill(fpid, SIGUSR2), 0);
3149 
3150 	/* The second wait() should report a SIGUSR2 was received. */
3151 	wpid = waitpid(fpid, &status, 0);
3152 	REQUIRE_EQ(wpid, fpid);
3153 	ATF_REQUIRE(WIFSTOPPED(status));
3154 	REQUIRE_EQ(WSTOPSIG(status), SIGUSR2);
3155 
3156 	/* Continue the child, changing the signal to USR1. */
3157 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
3158 
3159 	/* The next wait() should report the stop from SIGSTOP. */
3160 	wpid = waitpid(fpid, &status, 0);
3161 	REQUIRE_EQ(wpid, fpid);
3162 	ATF_REQUIRE(WIFSTOPPED(status));
3163 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3164 
3165 	/* Continue the child ignoring the SIGSTOP. */
3166 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3167 
3168 	REQUIRE_EQ(kill(fpid, SIGUSR2), 0);
3169 
3170 	/* The next wait() should report a SIGUSR2 was received. */
3171 	wpid = waitpid(fpid, &status, 0);
3172 	REQUIRE_EQ(wpid, fpid);
3173 	ATF_REQUIRE(WIFSTOPPED(status));
3174 	REQUIRE_EQ(WSTOPSIG(status), SIGUSR2);
3175 
3176 	/* Continue the child, changing the signal to USR1. */
3177 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1), 0);
3178 
3179 	/* The last wait() should report normal exit with code 1. */
3180 	wpid = waitpid(fpid, &status, 0);
3181 	REQUIRE_EQ(wpid, fpid);
3182 	ATF_REQUIRE(WIFEXITED(status));
3183 	REQUIRE_EQ(WEXITSTATUS(status), 1);
3184 
3185 	wpid = wait(&status);
3186 	REQUIRE_EQ(wpid, -1);
3187 	REQUIRE_EQ(errno, ECHILD);
3188 }
3189 
3190 /*
3191  * Verify that PT_GETREGSET returns registers and PT_SETREGSET updates them.
3192  */
3193 ATF_TC_WITHOUT_HEAD(ptrace__PT_REGSET);
3194 ATF_TC_BODY(ptrace__PT_REGSET, tc)
3195 {
3196 #if defined(__aarch64__)
3197 	struct arm64_addr_mask addr_mask;
3198 #endif
3199 	struct prstatus prstatus;
3200 	struct iovec vec;
3201 	pid_t child, wpid;
3202 	int status;
3203 
3204 	ATF_REQUIRE((child = fork()) != -1);
3205 	if (child == 0) {
3206 		trace_me();
3207 		exit(1);
3208 	}
3209 
3210 	/* The first wait() should report the stop from SIGSTOP. */
3211 	wpid = waitpid(child, &status, 0);
3212 	REQUIRE_EQ(wpid, child);
3213 	ATF_REQUIRE(WIFSTOPPED(status));
3214 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3215 
3216 	/* Check the size is returned when vec.iov_base is NULL */
3217 	vec.iov_base = NULL;
3218 	vec.iov_len = 0;
3219 	ATF_REQUIRE(ptrace(PT_GETREGSET, wpid, (caddr_t)&vec, NT_PRSTATUS) !=
3220 	    -1);
3221 	ATF_REQUIRE(vec.iov_len == sizeof(prstatus));
3222 	ATF_REQUIRE(vec.iov_base == NULL);
3223 
3224 	/* Read the registers. */
3225 	memset(&prstatus, 0, sizeof(prstatus));
3226 	vec.iov_base = &prstatus;
3227 	ATF_REQUIRE(ptrace(PT_GETREGSET, wpid, (caddr_t)&vec, NT_PRSTATUS) !=
3228 	    -1);
3229 	ATF_REQUIRE(vec.iov_len == sizeof(prstatus));
3230 	ATF_REQUIRE(vec.iov_base == &prstatus);
3231 	ATF_REQUIRE(prstatus.pr_statussz == sizeof(prstatus));
3232 
3233 	/* Write the registers back. */
3234 	ATF_REQUIRE(ptrace(PT_SETREGSET, wpid, (caddr_t)&vec, NT_PRSTATUS) !=
3235 	    -1);
3236 
3237 #if defined(__aarch64__)
3238 	vec.iov_base = &addr_mask;
3239 	vec.iov_len = sizeof(addr_mask);
3240 	ATF_REQUIRE(ptrace(PT_GETREGSET, wpid, (caddr_t)&vec,
3241 	    NT_ARM_ADDR_MASK) != -1);
3242 	REQUIRE_EQ(addr_mask.code, addr_mask.data);
3243 	ATF_REQUIRE(addr_mask.code == 0 ||
3244 	    addr_mask.code == 0xff7f000000000000UL);
3245 #endif
3246 
3247 	REQUIRE_EQ(ptrace(PT_CONTINUE, child, (caddr_t)1, 0), 0);
3248 
3249 	/* The second wait() should report the exit status. */
3250 	wpid = waitpid(child, &status, 0);
3251 	REQUIRE_EQ(wpid, child);
3252 	ATF_REQUIRE(WIFEXITED(status));
3253 	REQUIRE_EQ(WEXITSTATUS(status), 1);
3254 
3255 	/* The child should no longer exist. */
3256 	wpid = waitpid(child, &status, 0);
3257 	REQUIRE_EQ(wpid, -1);
3258 	REQUIRE_EQ(errno, ECHILD);
3259 }
3260 
3261 static void *
3262 raise_sigstop_thread(void *arg __unused)
3263 {
3264 
3265 	raise(SIGSTOP);
3266 	return NULL;
3267 }
3268 
3269 static void *
3270 sleep_thread(void *arg __unused)
3271 {
3272 
3273 	sleep(60);
3274 	return NULL;
3275 }
3276 
3277 static void
3278 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
3279 {
3280 	pid_t fpid, wpid;
3281 	int status, i;
3282 	cpuset_t setmask;
3283 	cpusetid_t setid;
3284 	pthread_t t;
3285 
3286 	/*
3287 	 * Become the reaper for this process tree. We need to be able to check
3288 	 * that both child and grandchild have died.
3289 	 */
3290 	REQUIRE_EQ(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL), 0);
3291 
3292 	fpid = fork();
3293 	ATF_REQUIRE(fpid >= 0);
3294 	if (fpid == 0) {
3295 		fpid = fork();
3296 		CHILD_REQUIRE(fpid >= 0);
3297 		if (fpid == 0) {
3298 			trace_me();
3299 
3300 			/* Pin to CPU 0 to serialize thread execution. */
3301 			CPU_ZERO(&setmask);
3302 			CPU_SET(0, &setmask);
3303 			CHILD_REQUIRE_EQ(cpuset(&setid), 0);
3304 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
3305 			    CPU_WHICH_CPUSET, setid,
3306 			    sizeof(setmask), &setmask) == 0);
3307 
3308 			if (sigstop_from_main_thread) {
3309 				/*
3310 				 * We expect the SIGKILL sent when our parent
3311 				 * dies to be delivered to the new thread.
3312 				 * Raise the SIGSTOP in this thread so the
3313 				 * threads compete.
3314 				 */
3315 				CHILD_REQUIRE(pthread_create(&t, NULL,
3316 				    sleep_thread, NULL) == 0);
3317 				raise(SIGSTOP);
3318 			} else {
3319 				/*
3320 				 * We expect the SIGKILL to be delivered to
3321 				 * this thread. After creating the new thread,
3322 				 * just get off the CPU so the other thread can
3323 				 * raise the SIGSTOP.
3324 				 */
3325 				CHILD_REQUIRE(pthread_create(&t, NULL,
3326 				    raise_sigstop_thread, NULL) == 0);
3327 				sleep(60);
3328 			}
3329 
3330 			exit(0);
3331 		}
3332 		/* First stop is trace_me() immediately after fork. */
3333 		wpid = waitpid(fpid, &status, 0);
3334 		CHILD_REQUIRE_EQ(wpid, fpid);
3335 		CHILD_REQUIRE(WIFSTOPPED(status));
3336 		CHILD_REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3337 
3338 		CHILD_REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3339 
3340 		/* Second stop is from the raise(SIGSTOP). */
3341 		wpid = waitpid(fpid, &status, 0);
3342 		CHILD_REQUIRE_EQ(wpid, fpid);
3343 		CHILD_REQUIRE(WIFSTOPPED(status));
3344 		CHILD_REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3345 
3346 		/*
3347 		 * Terminate tracing process without detaching. Our child
3348 		 * should be killed.
3349 		 */
3350 		exit(0);
3351 	}
3352 
3353 	/*
3354 	 * We should get a normal exit from our immediate child and a SIGKILL
3355 	 * exit from our grandchild. The latter case is the interesting one.
3356 	 * Our grandchild should not have stopped due to the SIGSTOP that was
3357 	 * left dangling when its parent died.
3358 	 */
3359 	for (i = 0; i < 2; ++i) {
3360 		wpid = wait(&status);
3361 		if (wpid == fpid) {
3362 			ATF_REQUIRE(WIFEXITED(status));
3363 			REQUIRE_EQ(WEXITSTATUS(status), 0);
3364 		} else {
3365 			ATF_REQUIRE(WIFSIGNALED(status));
3366 			REQUIRE_EQ(WTERMSIG(status), SIGKILL);
3367 		}
3368 	}
3369 }
3370 
3371 /*
3372  * These two tests ensure that if the tracing process exits without detaching
3373  * just after the child received a SIGSTOP, the child is cleanly killed and
3374  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
3375  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
3376  * different threads, the SIGKILL must win.  There are two variants of this
3377  * test, designed to catch the case where the SIGKILL is delivered to the
3378  * younger thread (the first test) and the case where the SIGKILL is delivered
3379  * to the older thread (the second test). This behavior has changed in the
3380  * past, so make no assumption.
3381  */
3382 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
3383 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
3384 {
3385 
3386 	atf_tc_set_md_var(tc, "require.user", "root");
3387 }
3388 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
3389 {
3390 
3391 	terminate_with_pending_sigstop(true);
3392 }
3393 
3394 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
3395 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
3396 {
3397 
3398 	atf_tc_set_md_var(tc, "require.user", "root");
3399 }
3400 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
3401 {
3402 
3403 	terminate_with_pending_sigstop(false);
3404 }
3405 
3406 /*
3407  * Verify that after ptrace() discards a SIGKILL signal, the event mask
3408  * is not modified.
3409  */
3410 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
3411 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
3412 {
3413 	struct ptrace_lwpinfo pl;
3414 	pid_t fpid, wpid;
3415 	int status, event_mask, new_event_mask;
3416 
3417 	ATF_REQUIRE((fpid = fork()) != -1);
3418 	if (fpid == 0) {
3419 		trace_me();
3420 		raise(SIGSTOP);
3421 		exit(0);
3422 	}
3423 
3424 	/* The first wait() should report the stop from trace_me(). */
3425 	wpid = waitpid(fpid, &status, 0);
3426 	REQUIRE_EQ(wpid, fpid);
3427 	ATF_REQUIRE(WIFSTOPPED(status));
3428 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3429 
3430 	/* Set several unobtrusive event bits. */
3431 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3432 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3433 	    sizeof(event_mask)) == 0);
3434 
3435 	/* Send a SIGKILL without using ptrace. */
3436 	REQUIRE_EQ(kill(fpid, SIGKILL), 0);
3437 
3438 	/* Continue the child ignoring the SIGSTOP. */
3439 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3440 
3441 	/* The next stop should be due to the SIGKILL. */
3442 	wpid = waitpid(fpid, &status, 0);
3443 	REQUIRE_EQ(wpid, fpid);
3444 	ATF_REQUIRE(WIFSTOPPED(status));
3445 	REQUIRE_EQ(WSTOPSIG(status), SIGKILL);
3446 
3447 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3448 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3449 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGKILL);
3450 
3451 	/* Continue the child ignoring the SIGKILL. */
3452 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3453 
3454 	/* The next wait() should report the stop from SIGSTOP. */
3455 	wpid = waitpid(fpid, &status, 0);
3456 	REQUIRE_EQ(wpid, fpid);
3457 	ATF_REQUIRE(WIFSTOPPED(status));
3458 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3459 
3460 	/* Check the current event mask. It should not have changed. */
3461 	new_event_mask = 0;
3462 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3463 	    sizeof(new_event_mask)) == 0);
3464 	REQUIRE_EQ(event_mask, new_event_mask);
3465 
3466 	/* Continue the child to let it exit. */
3467 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3468 
3469 	/* The last event should be for the child process's exit. */
3470 	wpid = waitpid(fpid, &status, 0);
3471 	ATF_REQUIRE(WIFEXITED(status));
3472 	REQUIRE_EQ(WEXITSTATUS(status), 0);
3473 
3474 	wpid = wait(&status);
3475 	REQUIRE_EQ(wpid, -1);
3476 	REQUIRE_EQ(errno, ECHILD);
3477 }
3478 
3479 static void *
3480 flock_thread(void *arg)
3481 {
3482 	int fd;
3483 
3484 	fd = *(int *)arg;
3485 	(void)flock(fd, LOCK_EX);
3486 	(void)flock(fd, LOCK_UN);
3487 	return (NULL);
3488 }
3489 
3490 /*
3491  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3492  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3493  * on a lock. This is a regression test for r318191.
3494  */
3495 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3496 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3497 {
3498 	pthread_barrier_t barrier;
3499 	pthread_barrierattr_t battr;
3500 	char tmpfile[64];
3501 	pid_t child, wpid;
3502 	int error, fd, i, status;
3503 
3504 	REQUIRE_EQ(pthread_barrierattr_init(&battr), 0);
3505 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3506 	    PTHREAD_PROCESS_SHARED) == 0);
3507 	REQUIRE_EQ(pthread_barrier_init(&barrier, &battr, 2), 0);
3508 
3509 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3510 	fd = mkstemp(tmpfile);
3511 	ATF_REQUIRE(fd >= 0);
3512 
3513 	ATF_REQUIRE((child = fork()) != -1);
3514 	if (child == 0) {
3515 		pthread_t t[2];
3516 		int cfd;
3517 
3518 		error = pthread_barrier_wait(&barrier);
3519 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3520 			_exit(1);
3521 
3522 		cfd = open(tmpfile, O_RDONLY);
3523 		if (cfd < 0)
3524 			_exit(1);
3525 
3526 		/*
3527 		 * We want at least two threads blocked on the file lock since
3528 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3529 		 * sleep.
3530 		 */
3531 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3532 			_exit(1);
3533 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3534 			_exit(1);
3535 		if (pthread_join(t[0], NULL) != 0)
3536 			_exit(1);
3537 		if (pthread_join(t[1], NULL) != 0)
3538 			_exit(1);
3539 		_exit(0);
3540 	}
3541 
3542 	REQUIRE_EQ(flock(fd, LOCK_EX), 0);
3543 
3544 	error = pthread_barrier_wait(&barrier);
3545 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3546 
3547 	/*
3548 	 * Give the child some time to block. Is there a better way to do this?
3549 	 */
3550 	sleep(1);
3551 
3552 	/*
3553 	 * Attach and give the child 3 seconds to stop.
3554 	 */
3555 	REQUIRE_EQ(ptrace(PT_ATTACH, child, NULL, 0), 0);
3556 	for (i = 0; i < 3; i++) {
3557 		wpid = waitpid(child, &status, WNOHANG);
3558 		if (wpid == child && WIFSTOPPED(status) &&
3559 		    WSTOPSIG(status) == SIGSTOP)
3560 			break;
3561 		sleep(1);
3562 	}
3563 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3564 
3565 	REQUIRE_EQ(ptrace(PT_DETACH, child, NULL, 0), 0);
3566 
3567 	REQUIRE_EQ(flock(fd, LOCK_UN), 0);
3568 	REQUIRE_EQ(unlink(tmpfile), 0);
3569 	REQUIRE_EQ(close(fd), 0);
3570 }
3571 
3572 static void
3573 sigusr1_step_handler(int sig)
3574 {
3575 
3576 	CHILD_REQUIRE_EQ(sig, SIGUSR1);
3577 	raise(SIGABRT);
3578 }
3579 
3580 /*
3581  * Verify that PT_STEP with a signal invokes the signal before
3582  * stepping the next instruction (and that the next instruction is
3583  * stepped correctly).
3584  */
3585 ATF_TC_WITHOUT_HEAD(ptrace__PT_STEP_with_signal);
3586 ATF_TC_BODY(ptrace__PT_STEP_with_signal, tc)
3587 {
3588 	struct ptrace_lwpinfo pl;
3589 	pid_t fpid, wpid;
3590 	int status;
3591 
3592 	ATF_REQUIRE((fpid = fork()) != -1);
3593 	if (fpid == 0) {
3594 		trace_me();
3595 		signal(SIGUSR1, sigusr1_step_handler);
3596 		raise(SIGABRT);
3597 		exit(1);
3598 	}
3599 
3600 	/* The first wait() should report the stop from SIGSTOP. */
3601 	wpid = waitpid(fpid, &status, 0);
3602 	REQUIRE_EQ(wpid, fpid);
3603 	ATF_REQUIRE(WIFSTOPPED(status));
3604 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3605 
3606 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3607 
3608 	/* The next stop should report the SIGABRT in the child body. */
3609 	wpid = waitpid(fpid, &status, 0);
3610 	REQUIRE_EQ(wpid, fpid);
3611 	ATF_REQUIRE(WIFSTOPPED(status));
3612 	REQUIRE_EQ(WSTOPSIG(status), SIGABRT);
3613 
3614 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3615 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3616 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGABRT);
3617 
3618 	/* Step the child process inserting SIGUSR1. */
3619 	REQUIRE_EQ(ptrace(PT_STEP, fpid, (caddr_t)1, SIGUSR1), 0);
3620 
3621 	/* The next stop should report the SIGABRT in the signal handler. */
3622 	wpid = waitpid(fpid, &status, 0);
3623 	REQUIRE_EQ(wpid, fpid);
3624 	ATF_REQUIRE(WIFSTOPPED(status));
3625 	REQUIRE_EQ(WSTOPSIG(status), SIGABRT);
3626 
3627 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3628 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3629 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGABRT);
3630 
3631 	/* Continue the child process discarding the signal. */
3632 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3633 
3634 	/* The next stop should report a trace trap from PT_STEP. */
3635 	wpid = waitpid(fpid, &status, 0);
3636 	REQUIRE_EQ(wpid, fpid);
3637 	ATF_REQUIRE(WIFSTOPPED(status));
3638 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3639 
3640 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3641 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3642 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGTRAP);
3643 	REQUIRE_EQ(pl.pl_siginfo.si_code, TRAP_TRACE);
3644 
3645 	/* Continue the child to let it exit. */
3646 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3647 
3648 	/* The last event should be for the child process's exit. */
3649 	wpid = waitpid(fpid, &status, 0);
3650 	ATF_REQUIRE(WIFEXITED(status));
3651 	REQUIRE_EQ(WEXITSTATUS(status), 1);
3652 
3653 	wpid = wait(&status);
3654 	REQUIRE_EQ(wpid, -1);
3655 	REQUIRE_EQ(errno, ECHILD);
3656 }
3657 
3658 #ifdef HAVE_BREAKPOINT
3659 /*
3660  * Verify that a SIGTRAP event with the TRAP_BRKPT code is reported
3661  * for a breakpoint trap.
3662  */
3663 ATF_TC_WITHOUT_HEAD(ptrace__breakpoint_siginfo);
3664 ATF_TC_BODY(ptrace__breakpoint_siginfo, tc)
3665 {
3666 	struct ptrace_lwpinfo pl;
3667 	pid_t fpid, wpid;
3668 	int status;
3669 
3670 	ATF_REQUIRE((fpid = fork()) != -1);
3671 	if (fpid == 0) {
3672 		trace_me();
3673 		breakpoint();
3674 		exit(1);
3675 	}
3676 
3677 	/* The first wait() should report the stop from SIGSTOP. */
3678 	wpid = waitpid(fpid, &status, 0);
3679 	REQUIRE_EQ(wpid, fpid);
3680 	ATF_REQUIRE(WIFSTOPPED(status));
3681 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3682 
3683 	/* Continue the child ignoring the SIGSTOP. */
3684 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3685 
3686 	/* The second wait() should report hitting the breakpoint. */
3687 	wpid = waitpid(fpid, &status, 0);
3688 	REQUIRE_EQ(wpid, fpid);
3689 	ATF_REQUIRE(WIFSTOPPED(status));
3690 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3691 
3692 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3693 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3694 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGTRAP);
3695 	REQUIRE_EQ(pl.pl_siginfo.si_code, TRAP_BRKPT);
3696 
3697 	/* Kill the child process. */
3698 	REQUIRE_EQ(ptrace(PT_KILL, fpid, 0, 0), 0);
3699 
3700 	/* The last wait() should report the SIGKILL. */
3701 	wpid = waitpid(fpid, &status, 0);
3702 	REQUIRE_EQ(wpid, fpid);
3703 	ATF_REQUIRE(WIFSIGNALED(status));
3704 	REQUIRE_EQ(WTERMSIG(status), SIGKILL);
3705 
3706 	wpid = wait(&status);
3707 	REQUIRE_EQ(wpid, -1);
3708 	REQUIRE_EQ(errno, ECHILD);
3709 }
3710 #endif /* HAVE_BREAKPOINT */
3711 
3712 /*
3713  * Verify that a SIGTRAP event with the TRAP_TRACE code is reported
3714  * for a single-step trap from PT_STEP.
3715  */
3716 ATF_TC_WITHOUT_HEAD(ptrace__step_siginfo);
3717 ATF_TC_BODY(ptrace__step_siginfo, tc)
3718 {
3719 	struct ptrace_lwpinfo pl;
3720 	pid_t fpid, wpid;
3721 	int status;
3722 
3723 	ATF_REQUIRE((fpid = fork()) != -1);
3724 	if (fpid == 0) {
3725 		trace_me();
3726 		exit(1);
3727 	}
3728 
3729 	/* The first wait() should report the stop from SIGSTOP. */
3730 	wpid = waitpid(fpid, &status, 0);
3731 	REQUIRE_EQ(wpid, fpid);
3732 	ATF_REQUIRE(WIFSTOPPED(status));
3733 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3734 
3735 	/* Step the child ignoring the SIGSTOP. */
3736 	REQUIRE_EQ(ptrace(PT_STEP, fpid, (caddr_t)1, 0), 0);
3737 
3738 	/* The second wait() should report a single-step trap. */
3739 	wpid = waitpid(fpid, &status, 0);
3740 	REQUIRE_EQ(wpid, fpid);
3741 	ATF_REQUIRE(WIFSTOPPED(status));
3742 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3743 
3744 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3745 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3746 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGTRAP);
3747 	REQUIRE_EQ(pl.pl_siginfo.si_code, TRAP_TRACE);
3748 
3749 	/* Continue the child process. */
3750 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3751 
3752 	/* The last event should be for the child process's exit. */
3753 	wpid = waitpid(fpid, &status, 0);
3754 	ATF_REQUIRE(WIFEXITED(status));
3755 	REQUIRE_EQ(WEXITSTATUS(status), 1);
3756 
3757 	wpid = wait(&status);
3758 	REQUIRE_EQ(wpid, -1);
3759 	REQUIRE_EQ(errno, ECHILD);
3760 }
3761 
3762 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3763 static void *
3764 continue_thread(void *arg __unused)
3765 {
3766 	breakpoint();
3767 	return (NULL);
3768 }
3769 
3770 static __dead2 void
3771 continue_thread_main(void)
3772 {
3773 	pthread_t threads[2];
3774 
3775 	CHILD_REQUIRE(pthread_create(&threads[0], NULL, continue_thread,
3776 	    NULL) == 0);
3777 	CHILD_REQUIRE(pthread_create(&threads[1], NULL, continue_thread,
3778 	    NULL) == 0);
3779 	CHILD_REQUIRE_EQ(pthread_join(threads[0], NULL), 0);
3780 	CHILD_REQUIRE_EQ(pthread_join(threads[1], NULL), 0);
3781 	exit(1);
3782 }
3783 
3784 /*
3785  * Ensure that PT_CONTINUE clears the status of the thread that
3786  * triggered the stop even if a different thread's LWP was passed to
3787  * PT_CONTINUE.
3788  */
3789 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_different_thread);
3790 ATF_TC_BODY(ptrace__PT_CONTINUE_different_thread, tc)
3791 {
3792 	struct ptrace_lwpinfo pl;
3793 	pid_t fpid, wpid;
3794 	lwpid_t lwps[2];
3795 	bool hit_break[2];
3796 	struct reg reg;
3797 	int i, j, status;
3798 
3799 	ATF_REQUIRE((fpid = fork()) != -1);
3800 	if (fpid == 0) {
3801 		trace_me();
3802 		continue_thread_main();
3803 	}
3804 
3805 	/* The first wait() should report the stop from SIGSTOP. */
3806 	wpid = waitpid(fpid, &status, 0);
3807 	REQUIRE_EQ(wpid, fpid);
3808 	ATF_REQUIRE(WIFSTOPPED(status));
3809 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3810 
3811 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3812 	    sizeof(pl)) != -1);
3813 
3814 	REQUIRE_EQ(ptrace(PT_LWP_EVENTS, wpid, NULL, 1), 0);
3815 
3816 	/* Continue the child ignoring the SIGSTOP. */
3817 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3818 
3819 	/* One of the new threads should report it's birth. */
3820 	wpid = waitpid(fpid, &status, 0);
3821 	REQUIRE_EQ(wpid, fpid);
3822 	ATF_REQUIRE(WIFSTOPPED(status));
3823 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3824 
3825 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3826 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)),
3827 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3828 	lwps[0] = pl.pl_lwpid;
3829 
3830 	/*
3831 	 * Suspend this thread to ensure both threads are alive before
3832 	 * hitting the breakpoint.
3833 	 */
3834 	ATF_REQUIRE(ptrace(PT_SUSPEND, lwps[0], NULL, 0) != -1);
3835 
3836 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3837 
3838 	/* Second thread should report it's birth. */
3839 	wpid = waitpid(fpid, &status, 0);
3840 	REQUIRE_EQ(wpid, fpid);
3841 	ATF_REQUIRE(WIFSTOPPED(status));
3842 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3843 
3844 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3845 	REQUIRE_EQ((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)),
3846 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3847 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
3848 	lwps[1] = pl.pl_lwpid;
3849 
3850 	/* Resume both threads waiting for breakpoint events. */
3851 	hit_break[0] = hit_break[1] = false;
3852 	ATF_REQUIRE(ptrace(PT_RESUME, lwps[0], NULL, 0) != -1);
3853 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3854 
3855 	/* One thread should report a breakpoint. */
3856 	wpid = waitpid(fpid, &status, 0);
3857 	REQUIRE_EQ(wpid, fpid);
3858 	ATF_REQUIRE(WIFSTOPPED(status));
3859 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3860 
3861 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3862 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3863 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGTRAP);
3864 	REQUIRE_EQ(pl.pl_siginfo.si_code, TRAP_BRKPT);
3865 	if (pl.pl_lwpid == lwps[0])
3866 		i = 0;
3867 	else
3868 		i = 1;
3869 	hit_break[i] = true;
3870 	ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3871 	SKIP_BREAK(&reg);
3872 	ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3873 
3874 	/*
3875 	 * Resume both threads but pass the other thread's LWPID to
3876 	 * PT_CONTINUE.
3877 	 */
3878 	REQUIRE_EQ(ptrace(PT_CONTINUE, lwps[i ^ 1], (caddr_t)1, 0), 0);
3879 
3880 	/*
3881 	 * Will now get two thread exit events and one more breakpoint
3882 	 * event.
3883 	 */
3884 	for (j = 0; j < 3; j++) {
3885 		wpid = waitpid(fpid, &status, 0);
3886 		REQUIRE_EQ(wpid, fpid);
3887 		ATF_REQUIRE(WIFSTOPPED(status));
3888 		REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3889 
3890 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3891 		    sizeof(pl)) != -1);
3892 
3893 		if (pl.pl_lwpid == lwps[0])
3894 			i = 0;
3895 		else
3896 			i = 1;
3897 
3898 		ATF_REQUIRE_MSG(lwps[i] != 0, "event for exited thread");
3899 		if (pl.pl_flags & PL_FLAG_EXITED) {
3900 			ATF_REQUIRE_MSG(hit_break[i],
3901 			    "exited thread did not report breakpoint");
3902 			lwps[i] = 0;
3903 		} else {
3904 			ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3905 			REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGTRAP);
3906 			REQUIRE_EQ(pl.pl_siginfo.si_code, TRAP_BRKPT);
3907 			ATF_REQUIRE_MSG(!hit_break[i],
3908 			    "double breakpoint event");
3909 			hit_break[i] = true;
3910 			ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg,
3911 			    0) != -1);
3912 			SKIP_BREAK(&reg);
3913 			ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg,
3914 			    0) != -1);
3915 		}
3916 
3917 		REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3918 	}
3919 
3920 	/* Both threads should have exited. */
3921 	REQUIRE_EQ(lwps[0], 0);
3922 	REQUIRE_EQ(lwps[1], 0);
3923 
3924 	/* The last event should be for the child process's exit. */
3925 	wpid = waitpid(fpid, &status, 0);
3926 	ATF_REQUIRE(WIFEXITED(status));
3927 	REQUIRE_EQ(WEXITSTATUS(status), 1);
3928 
3929 	wpid = wait(&status);
3930 	REQUIRE_EQ(wpid, -1);
3931 	REQUIRE_EQ(errno, ECHILD);
3932 }
3933 #endif
3934 
3935 /*
3936  * Verify that PT_LWPINFO doesn't return stale siginfo.
3937  */
3938 ATF_TC_WITHOUT_HEAD(ptrace__PT_LWPINFO_stale_siginfo);
3939 ATF_TC_BODY(ptrace__PT_LWPINFO_stale_siginfo, tc)
3940 {
3941 	struct ptrace_lwpinfo pl;
3942 	pid_t fpid, wpid;
3943 	int events, status;
3944 
3945 	ATF_REQUIRE((fpid = fork()) != -1);
3946 	if (fpid == 0) {
3947 		trace_me();
3948 		raise(SIGABRT);
3949 		exit(1);
3950 	}
3951 
3952 	/* The first wait() should report the stop from SIGSTOP. */
3953 	wpid = waitpid(fpid, &status, 0);
3954 	REQUIRE_EQ(wpid, fpid);
3955 	ATF_REQUIRE(WIFSTOPPED(status));
3956 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
3957 
3958 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3959 
3960 	/* The next stop should report the SIGABRT in the child body. */
3961 	wpid = waitpid(fpid, &status, 0);
3962 	REQUIRE_EQ(wpid, fpid);
3963 	ATF_REQUIRE(WIFSTOPPED(status));
3964 	REQUIRE_EQ(WSTOPSIG(status), SIGABRT);
3965 
3966 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3967 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3968 	REQUIRE_EQ(pl.pl_siginfo.si_signo, SIGABRT);
3969 
3970 	/*
3971 	 * Continue the process ignoring the signal, but enabling
3972 	 * syscall traps.
3973 	 */
3974 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
3975 
3976 	/*
3977 	 * The next stop should report a system call entry from
3978 	 * exit().  PL_FLAGS_SI should not be set.
3979 	 */
3980 	wpid = waitpid(fpid, &status, 0);
3981 	REQUIRE_EQ(wpid, fpid);
3982 	ATF_REQUIRE(WIFSTOPPED(status));
3983 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
3984 
3985 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3986 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3987 	REQUIRE_EQ((pl.pl_flags & PL_FLAG_SI), 0);
3988 
3989 	/* Disable syscall tracing and continue the child to let it exit. */
3990 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
3991 	    sizeof(events)) == 0);
3992 	events &= ~PTRACE_SYSCALL;
3993 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
3994 	    sizeof(events)) == 0);
3995 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
3996 
3997 	/* The last event should be for the child process's exit. */
3998 	wpid = waitpid(fpid, &status, 0);
3999 	ATF_REQUIRE(WIFEXITED(status));
4000 	REQUIRE_EQ(WEXITSTATUS(status), 1);
4001 
4002 	wpid = wait(&status);
4003 	REQUIRE_EQ(wpid, -1);
4004 	REQUIRE_EQ(errno, ECHILD);
4005 }
4006 
4007 /*
4008  * A simple test of PT_GET_SC_ARGS and PT_GET_SC_RET.
4009  */
4010 ATF_TC_WITHOUT_HEAD(ptrace__syscall_args);
4011 ATF_TC_BODY(ptrace__syscall_args, tc)
4012 {
4013 	struct ptrace_lwpinfo pl;
4014 	struct ptrace_sc_ret psr;
4015 	pid_t fpid, wpid;
4016 	register_t args[2];
4017 	int events, status;
4018 
4019 	ATF_REQUIRE((fpid = fork()) != -1);
4020 	if (fpid == 0) {
4021 		trace_me();
4022 		kill(getpid(), 0);
4023 		/* Close a fd that should not exist. */
4024 		close(12345);
4025 		exit(1);
4026 	}
4027 
4028 	/* The first wait() should report the stop from SIGSTOP. */
4029 	wpid = waitpid(fpid, &status, 0);
4030 	REQUIRE_EQ(wpid, fpid);
4031 	ATF_REQUIRE(WIFSTOPPED(status));
4032 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
4033 
4034 	/*
4035 	 * Continue the process ignoring the signal, but enabling
4036 	 * syscall traps.
4037 	 */
4038 	REQUIRE_EQ(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0), 0);
4039 
4040 	/*
4041 	 * The next stop should be the syscall entry from getpid().
4042 	 */
4043 	wpid = waitpid(fpid, &status, 0);
4044 	REQUIRE_EQ(wpid, fpid);
4045 	ATF_REQUIRE(WIFSTOPPED(status));
4046 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
4047 
4048 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4049 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
4050 	REQUIRE_EQ(pl.pl_syscall_code, (unsigned)SYS_getpid);
4051 
4052 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
4053 
4054 	/*
4055 	 * The next stop should be the syscall exit from getpid().
4056 	 */
4057 	wpid = waitpid(fpid, &status, 0);
4058 	REQUIRE_EQ(wpid, fpid);
4059 	ATF_REQUIRE(WIFSTOPPED(status));
4060 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
4061 
4062 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4063 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
4064 	REQUIRE_EQ(pl.pl_syscall_code, (unsigned)SYS_getpid);
4065 
4066 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
4067 	    sizeof(psr)) != -1);
4068 	REQUIRE_EQ(psr.sr_error, 0);
4069 	REQUIRE_EQ(psr.sr_retval[0], wpid);
4070 
4071 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
4072 
4073 	/*
4074 	 * The next stop should be the syscall entry from kill().
4075 	 */
4076 	wpid = waitpid(fpid, &status, 0);
4077 	REQUIRE_EQ(wpid, fpid);
4078 	ATF_REQUIRE(WIFSTOPPED(status));
4079 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
4080 
4081 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4082 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
4083 	REQUIRE_EQ(pl.pl_syscall_code, (unsigned)SYS_kill);
4084 	REQUIRE_EQ(pl.pl_syscall_narg, 2u);
4085 
4086 	ATF_REQUIRE(ptrace(PT_GET_SC_ARGS, wpid, (caddr_t)args,
4087 	    sizeof(args)) != -1);
4088 	REQUIRE_EQ(args[0], wpid);
4089 	REQUIRE_EQ(args[1], 0);
4090 
4091 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
4092 
4093 	/*
4094 	 * The next stop should be the syscall exit from kill().
4095 	 */
4096 	wpid = waitpid(fpid, &status, 0);
4097 	REQUIRE_EQ(wpid, fpid);
4098 	ATF_REQUIRE(WIFSTOPPED(status));
4099 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
4100 
4101 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4102 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
4103 	REQUIRE_EQ(pl.pl_syscall_code, (unsigned)SYS_kill);
4104 
4105 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
4106 	    sizeof(psr)) != -1);
4107 	REQUIRE_EQ(psr.sr_error, 0);
4108 
4109 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
4110 
4111 	/*
4112 	 * The next stop should be the syscall entry from close().
4113 	 */
4114 	wpid = waitpid(fpid, &status, 0);
4115 	REQUIRE_EQ(wpid, fpid);
4116 	ATF_REQUIRE(WIFSTOPPED(status));
4117 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
4118 
4119 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4120 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
4121 	REQUIRE_EQ(pl.pl_syscall_code, (unsigned)SYS_close);
4122 	REQUIRE_EQ(pl.pl_syscall_narg, 1u);
4123 
4124 	ATF_REQUIRE(ptrace(PT_GET_SC_ARGS, wpid, (caddr_t)args,
4125 	    sizeof(args)) != -1);
4126 	REQUIRE_EQ(args[0], 12345);
4127 
4128 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
4129 
4130 	/*
4131 	 * The next stop should be the syscall exit from close().
4132 	 */
4133 	wpid = waitpid(fpid, &status, 0);
4134 	REQUIRE_EQ(wpid, fpid);
4135 	ATF_REQUIRE(WIFSTOPPED(status));
4136 	REQUIRE_EQ(WSTOPSIG(status), SIGTRAP);
4137 
4138 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4139 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
4140 	REQUIRE_EQ(pl.pl_syscall_code, (unsigned)SYS_close);
4141 
4142 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
4143 	    sizeof(psr)) != -1);
4144 	REQUIRE_EQ(psr.sr_error, EBADF);
4145 
4146 	/* Disable syscall tracing and continue the child to let it exit. */
4147 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
4148 	    sizeof(events)) == 0);
4149 	events &= ~PTRACE_SYSCALL;
4150 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
4151 	    sizeof(events)) == 0);
4152 	REQUIRE_EQ(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0), 0);
4153 
4154 	/* The last event should be for the child process's exit. */
4155 	wpid = waitpid(fpid, &status, 0);
4156 	ATF_REQUIRE(WIFEXITED(status));
4157 	REQUIRE_EQ(WEXITSTATUS(status), 1);
4158 
4159 	wpid = wait(&status);
4160 	REQUIRE_EQ(wpid, -1);
4161 	REQUIRE_EQ(errno, ECHILD);
4162 }
4163 
4164 /*
4165  * Verify that when the process is traced that it isn't reparent
4166  * to the init process when we close all process descriptors.
4167  */
4168 ATF_TC(ptrace__proc_reparent);
4169 ATF_TC_HEAD(ptrace__proc_reparent, tc)
4170 {
4171 
4172 	atf_tc_set_md_var(tc, "timeout", "2");
4173 }
4174 ATF_TC_BODY(ptrace__proc_reparent, tc)
4175 {
4176 	pid_t traced, debuger, wpid;
4177 	int pd, status;
4178 
4179 	traced = pdfork(&pd, 0);
4180 	ATF_REQUIRE(traced >= 0);
4181 	if (traced == 0) {
4182 		raise(SIGSTOP);
4183 		exit(0);
4184 	}
4185 	ATF_REQUIRE(pd >= 0);
4186 
4187 	debuger = fork();
4188 	ATF_REQUIRE(debuger >= 0);
4189 	if (debuger == 0) {
4190 		/* The traced process is reparented to debuger. */
4191 		REQUIRE_EQ(ptrace(PT_ATTACH, traced, 0, 0), 0);
4192 		wpid = waitpid(traced, &status, 0);
4193 		REQUIRE_EQ(wpid, traced);
4194 		ATF_REQUIRE(WIFSTOPPED(status));
4195 		REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
4196 		REQUIRE_EQ(close(pd), 0);
4197 		REQUIRE_EQ(ptrace(PT_DETACH, traced, (caddr_t)1, 0), 0);
4198 
4199 		/* We closed pd so we should not have any child. */
4200 		wpid = wait(&status);
4201 		REQUIRE_EQ(wpid, -1);
4202 		REQUIRE_EQ(errno, ECHILD);
4203 
4204 		exit(0);
4205 	}
4206 
4207 	REQUIRE_EQ(close(pd), 0);
4208 	wpid = waitpid(debuger, &status, 0);
4209 	REQUIRE_EQ(wpid, debuger);
4210 	REQUIRE_EQ(WEXITSTATUS(status), 0);
4211 
4212 	/* Check if we still have any child. */
4213 	wpid = wait(&status);
4214 	REQUIRE_EQ(wpid, -1);
4215 	REQUIRE_EQ(errno, ECHILD);
4216 }
4217 
4218 /*
4219  * Ensure that traced processes created with pdfork(2) are visible to
4220  * waitid(P_ALL).
4221  */
4222 ATF_TC_WITHOUT_HEAD(ptrace__procdesc_wait_child);
4223 ATF_TC_BODY(ptrace__procdesc_wait_child, tc)
4224 {
4225 	pid_t child, wpid;
4226 	int pd, status;
4227 
4228 	child = pdfork(&pd, 0);
4229 	ATF_REQUIRE(child >= 0);
4230 
4231 	if (child == 0) {
4232 		trace_me();
4233 		(void)raise(SIGSTOP);
4234 		exit(0);
4235 	}
4236 
4237 	wpid = waitpid(child, &status, 0);
4238 	REQUIRE_EQ(wpid, child);
4239 	ATF_REQUIRE(WIFSTOPPED(status));
4240 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
4241 
4242 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
4243 
4244 	wpid = wait(&status);
4245 	REQUIRE_EQ(wpid, child);
4246 	ATF_REQUIRE(WIFSTOPPED(status));
4247 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
4248 
4249 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
4250 
4251 	/*
4252 	 * If process was created by pdfork, the return code have to
4253 	 * be collected through process descriptor.
4254 	 */
4255 	wpid = wait(&status);
4256 	REQUIRE_EQ(wpid, -1);
4257 	REQUIRE_EQ(errno, ECHILD);
4258 
4259 	ATF_REQUIRE(close(pd) != -1);
4260 }
4261 
4262 /*
4263  * Ensure that traced processes created with pdfork(2) are not visible
4264  * after returning to parent - waitid(P_ALL).
4265  */
4266 ATF_TC_WITHOUT_HEAD(ptrace__procdesc_reparent_wait_child);
4267 ATF_TC_BODY(ptrace__procdesc_reparent_wait_child, tc)
4268 {
4269 	pid_t traced, debuger, wpid;
4270 	int pd, status;
4271 
4272 	traced = pdfork(&pd, 0);
4273 	ATF_REQUIRE(traced >= 0);
4274 	if (traced == 0) {
4275 		raise(SIGSTOP);
4276 		exit(0);
4277 	}
4278 	ATF_REQUIRE(pd >= 0);
4279 
4280 	/* Wait until the child process has stopped before fork()ing again. */
4281 	REQUIRE_EQ(traced, waitpid(traced, &status, WSTOPPED));
4282 	debuger = fork();
4283 	ATF_REQUIRE(debuger >= 0);
4284 	if (debuger == 0) {
4285 		/* The traced process is reparented to debuger. */
4286 		REQUIRE_EQ(ptrace(PT_ATTACH, traced, 0, 0), 0);
4287 		wpid = waitpid(traced, &status, 0);
4288 		REQUIRE_EQ(wpid, traced);
4289 		ATF_REQUIRE(WIFSTOPPED(status));
4290 		REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
4291 
4292 		/* Allow process to die. */
4293 		REQUIRE_EQ(ptrace(PT_CONTINUE, traced, (caddr_t)1, 0), 0);
4294 		wpid = waitpid(traced, &status, 0);
4295 		REQUIRE_EQ(wpid, traced);
4296 		ATF_REQUIRE(WIFEXITED(status));
4297 		REQUIRE_EQ(WEXITSTATUS(status), 0);
4298 
4299 		/* Reparent back to the orginal process. */
4300 		REQUIRE_EQ(close(pd), 0);
4301 		exit(0);
4302 	}
4303 
4304 	wpid = waitpid(debuger, &status, 0);
4305 	REQUIRE_EQ(wpid, debuger);
4306 	REQUIRE_EQ(WEXITSTATUS(status), 0);
4307 
4308 	/*
4309 	 * We have a child but it has a process descriptori
4310 	 * so we should not be able to collect it process.
4311 	 */
4312 	wpid = wait(&status);
4313 	REQUIRE_EQ(wpid, -1);
4314 	REQUIRE_EQ(errno, ECHILD);
4315 
4316 	REQUIRE_EQ(close(pd), 0);
4317 }
4318 
4319 /*
4320  * Try using PT_SC_REMOTE to get the PID of a traced child process.
4321  */
4322 ATF_TC_WITHOUT_HEAD(ptrace__PT_SC_REMOTE_getpid);
4323 ATF_TC_BODY(ptrace__PT_SC_REMOTE_getpid, tc)
4324 {
4325 	struct ptrace_sc_remote pscr;
4326 	pid_t fpid, wpid;
4327 	int status;
4328 
4329 	ATF_REQUIRE((fpid = fork()) != -1);
4330 	if (fpid == 0) {
4331 		trace_me();
4332 		exit(0);
4333 	}
4334 
4335 	attach_child(fpid);
4336 
4337 	pscr.pscr_syscall = SYS_getpid;
4338 	pscr.pscr_nargs = 0;
4339 	pscr.pscr_args = NULL;
4340 	ATF_REQUIRE(ptrace(PT_SC_REMOTE, fpid, (caddr_t)&pscr, sizeof(pscr)) !=
4341 	    -1);
4342 	ATF_REQUIRE_MSG(pscr.pscr_ret.sr_error == 0,
4343 	    "remote getpid failed with error %d", pscr.pscr_ret.sr_error);
4344 	ATF_REQUIRE_MSG(pscr.pscr_ret.sr_retval[0] == fpid,
4345 	    "unexpected return value %jd instead of %d",
4346 	    (intmax_t)pscr.pscr_ret.sr_retval[0], fpid);
4347 
4348 	wpid = waitpid(fpid, &status, 0);
4349 	REQUIRE_EQ(wpid, fpid);
4350 	ATF_REQUIRE(WIFSTOPPED(status));
4351 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
4352 
4353 	pscr.pscr_syscall = SYS_getppid;
4354 	pscr.pscr_nargs = 0;
4355 	pscr.pscr_args = NULL;
4356 	ATF_REQUIRE(ptrace(PT_SC_REMOTE, fpid, (caddr_t)&pscr, sizeof(pscr)) !=
4357 	    -1);
4358 	ATF_REQUIRE_MSG(pscr.pscr_ret.sr_error == 0,
4359 	    "remote getppid failed with error %d", pscr.pscr_ret.sr_error);
4360 	ATF_REQUIRE_MSG(pscr.pscr_ret.sr_retval[0] == getpid(),
4361 	    "unexpected return value %jd instead of %d",
4362 	    (intmax_t)pscr.pscr_ret.sr_retval[0], fpid);
4363 
4364 	wpid = waitpid(fpid, &status, 0);
4365 	REQUIRE_EQ(wpid, fpid);
4366 	ATF_REQUIRE(WIFSTOPPED(status));
4367 	REQUIRE_EQ(WSTOPSIG(status), SIGSTOP);
4368 
4369 	ATF_REQUIRE(ptrace(PT_DETACH, fpid, (caddr_t)1, 0) != -1);
4370 }
4371 
4372 ATF_TP_ADD_TCS(tp)
4373 {
4374 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
4375 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
4376 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
4377 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
4378 	ATF_TP_ADD_TC(tp, ptrace__parent_exits_before_child);
4379 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
4380 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
4381 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
4382 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
4383 	ATF_TP_ADD_TC(tp,
4384 	    ptrace__follow_fork_child_detached_unrelated_debugger);
4385 	ATF_TP_ADD_TC(tp,
4386 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
4387 	ATF_TP_ADD_TC(tp, ptrace__getppid);
4388 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
4389 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
4390 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
4391 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
4392 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
4393 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
4394 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
4395 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
4396 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
4397 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
4398 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
4399 #ifdef HAVE_BREAKPOINT
4400 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
4401 #endif
4402 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
4403 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
4404 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
4405 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
4406 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
4407 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
4408 	ATF_TP_ADD_TC(tp,
4409 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
4410 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
4411 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
4412 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
4413 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
4414 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
4415 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
4416 	ATF_TP_ADD_TC(tp, ptrace__killed_with_sigmask);
4417 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigmask);
4418 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
4419 	ATF_TP_ADD_TC(tp, ptrace__PT_REGSET);
4420 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
4421 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
4422 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
4423 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
4424 	ATF_TP_ADD_TC(tp, ptrace__PT_STEP_with_signal);
4425 #ifdef HAVE_BREAKPOINT
4426 	ATF_TP_ADD_TC(tp, ptrace__breakpoint_siginfo);
4427 #endif
4428 	ATF_TP_ADD_TC(tp, ptrace__step_siginfo);
4429 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
4430 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_different_thread);
4431 #endif
4432 	ATF_TP_ADD_TC(tp, ptrace__PT_LWPINFO_stale_siginfo);
4433 	ATF_TP_ADD_TC(tp, ptrace__syscall_args);
4434 	ATF_TP_ADD_TC(tp, ptrace__proc_reparent);
4435 	ATF_TP_ADD_TC(tp, ptrace__procdesc_wait_child);
4436 	ATF_TP_ADD_TC(tp, ptrace__procdesc_reparent_wait_child);
4437 	ATF_TP_ADD_TC(tp, ptrace__PT_SC_REMOTE_getpid);
4438 
4439 	return (atf_no_error());
4440 }
4441