xref: /freebsd/tests/sys/kern/ptrace_test.c (revision e08e9e999091f86081377b7cedc3fd2fe2ab70fc)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/types.h>
31 #include <sys/cpuset.h>
32 #include <sys/event.h>
33 #include <sys/file.h>
34 #include <sys/time.h>
35 #include <sys/procctl.h>
36 #include <sys/ptrace.h>
37 #include <sys/queue.h>
38 #include <sys/runq.h>
39 #include <sys/syscall.h>
40 #include <sys/sysctl.h>
41 #include <sys/user.h>
42 #include <sys/wait.h>
43 #include <errno.h>
44 #include <machine/cpufunc.h>
45 #include <pthread.h>
46 #include <sched.h>
47 #include <semaphore.h>
48 #include <signal.h>
49 #include <stdio.h>
50 #include <stdlib.h>
51 #include <unistd.h>
52 #include <atf-c.h>
53 
54 /*
55  * Architectures with a user-visible breakpoint().
56  */
57 #if defined(__amd64__) || defined(__i386__) || defined(__mips__) ||	\
58     defined(__riscv) || defined(__sparc64__)
59 #define	HAVE_BREAKPOINT
60 #endif
61 
62 /*
63  * Adjust PC to skip over a breakpoint when stopped for a breakpoint trap.
64  */
65 #ifdef HAVE_BREAKPOINT
66 #if defined(__amd64__) || defined(__i386__)
67 #define	SKIP_BREAK(reg)
68 #elif defined(__mips__)
69 #define	SKIP_BREAK(reg)	((reg)->r_regs[PC] += 4)
70 #elif defined(__riscv)
71 #define	SKIP_BREAK(reg)	((reg)->sepc += 4)
72 #elif defined(__sparc64__)
73 #define	SKIP_BREAK(reg)	do {						\
74 	(reg)->r_tpc = (reg)->r_tnpc + 4;				\
75 	(reg)->r_tnpc += 8;						\
76 } while (0)
77 #endif
78 #endif
79 
80 /*
81  * A variant of ATF_REQUIRE that is suitable for use in child
82  * processes.  This only works if the parent process is tripped up by
83  * the early exit and fails some requirement itself.
84  */
85 #define	CHILD_REQUIRE(exp) do {						\
86 		if (!(exp))						\
87 			child_fail_require(__FILE__, __LINE__,		\
88 			    #exp " not met");				\
89 	} while (0)
90 
91 static __dead2 void
92 child_fail_require(const char *file, int line, const char *str)
93 {
94 	char buf[128];
95 
96 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
97 	write(2, buf, strlen(buf));
98 	_exit(32);
99 }
100 
101 static void
102 trace_me(void)
103 {
104 
105 	/* Attach the parent process as a tracer of this process. */
106 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
107 
108 	/* Trigger a stop. */
109 	raise(SIGSTOP);
110 }
111 
112 static void
113 attach_child(pid_t pid)
114 {
115 	pid_t wpid;
116 	int status;
117 
118 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
119 
120 	wpid = waitpid(pid, &status, 0);
121 	ATF_REQUIRE(wpid == pid);
122 	ATF_REQUIRE(WIFSTOPPED(status));
123 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
124 }
125 
126 static void
127 wait_for_zombie(pid_t pid)
128 {
129 
130 	/*
131 	 * Wait for a process to exit.  This is kind of gross, but
132 	 * there is not a better way.
133 	 *
134 	 * Prior to r325719, the kern.proc.pid.<pid> sysctl failed
135 	 * with ESRCH.  After that change, a valid struct kinfo_proc
136 	 * is returned for zombies with ki_stat set to SZOMB.
137 	 */
138 	for (;;) {
139 		struct kinfo_proc kp;
140 		size_t len;
141 		int mib[4];
142 
143 		mib[0] = CTL_KERN;
144 		mib[1] = KERN_PROC;
145 		mib[2] = KERN_PROC_PID;
146 		mib[3] = pid;
147 		len = sizeof(kp);
148 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
149 			ATF_REQUIRE(errno == ESRCH);
150 			break;
151 		}
152 		if (kp.ki_stat == SZOMB)
153 			break;
154 		usleep(5000);
155 	}
156 }
157 
158 /*
159  * Verify that a parent debugger process "sees" the exit of a debugged
160  * process exactly once when attached via PT_TRACE_ME.
161  */
162 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
163 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
164 {
165 	pid_t child, wpid;
166 	int status;
167 
168 	ATF_REQUIRE((child = fork()) != -1);
169 	if (child == 0) {
170 		/* Child process. */
171 		trace_me();
172 
173 		_exit(1);
174 	}
175 
176 	/* Parent process. */
177 
178 	/* The first wait() should report the stop from SIGSTOP. */
179 	wpid = waitpid(child, &status, 0);
180 	ATF_REQUIRE(wpid == child);
181 	ATF_REQUIRE(WIFSTOPPED(status));
182 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
183 
184 	/* Continue the child ignoring the SIGSTOP. */
185 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
186 
187 	/* The second wait() should report the exit status. */
188 	wpid = waitpid(child, &status, 0);
189 	ATF_REQUIRE(wpid == child);
190 	ATF_REQUIRE(WIFEXITED(status));
191 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
192 
193 	/* The child should no longer exist. */
194 	wpid = waitpid(child, &status, 0);
195 	ATF_REQUIRE(wpid == -1);
196 	ATF_REQUIRE(errno == ECHILD);
197 }
198 
199 /*
200  * Verify that a parent debugger process "sees" the exit of a debugged
201  * process exactly once when attached via PT_ATTACH.
202  */
203 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
204 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
205 {
206 	pid_t child, wpid;
207 	int cpipe[2], status;
208 	char c;
209 
210 	ATF_REQUIRE(pipe(cpipe) == 0);
211 	ATF_REQUIRE((child = fork()) != -1);
212 	if (child == 0) {
213 		/* Child process. */
214 		close(cpipe[0]);
215 
216 		/* Wait for the parent to attach. */
217 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
218 
219 		_exit(1);
220 	}
221 	close(cpipe[1]);
222 
223 	/* Parent process. */
224 
225 	/* Attach to the child process. */
226 	attach_child(child);
227 
228 	/* Continue the child ignoring the SIGSTOP. */
229 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
230 
231 	/* Signal the child to exit. */
232 	close(cpipe[0]);
233 
234 	/* The second wait() should report the exit status. */
235 	wpid = waitpid(child, &status, 0);
236 	ATF_REQUIRE(wpid == child);
237 	ATF_REQUIRE(WIFEXITED(status));
238 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
239 
240 	/* The child should no longer exist. */
241 	wpid = waitpid(child, &status, 0);
242 	ATF_REQUIRE(wpid == -1);
243 	ATF_REQUIRE(errno == ECHILD);
244 }
245 
246 /*
247  * Verify that a parent process "sees" the exit of a debugged process only
248  * after the debugger has seen it.
249  */
250 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
251 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
252 {
253 	pid_t child, debugger, wpid;
254 	int cpipe[2], dpipe[2], status;
255 	char c;
256 
257 	ATF_REQUIRE(pipe(cpipe) == 0);
258 	ATF_REQUIRE((child = fork()) != -1);
259 
260 	if (child == 0) {
261 		/* Child process. */
262 		close(cpipe[0]);
263 
264 		/* Wait for parent to be ready. */
265 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
266 
267 		_exit(1);
268 	}
269 	close(cpipe[1]);
270 
271 	ATF_REQUIRE(pipe(dpipe) == 0);
272 	ATF_REQUIRE((debugger = fork()) != -1);
273 
274 	if (debugger == 0) {
275 		/* Debugger process. */
276 		close(dpipe[0]);
277 
278 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
279 
280 		wpid = waitpid(child, &status, 0);
281 		CHILD_REQUIRE(wpid == child);
282 		CHILD_REQUIRE(WIFSTOPPED(status));
283 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
284 
285 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
286 
287 		/* Signal parent that debugger is attached. */
288 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
289 
290 		/* Wait for parent's failed wait. */
291 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
292 
293 		wpid = waitpid(child, &status, 0);
294 		CHILD_REQUIRE(wpid == child);
295 		CHILD_REQUIRE(WIFEXITED(status));
296 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
297 
298 		_exit(0);
299 	}
300 	close(dpipe[1]);
301 
302 	/* Parent process. */
303 
304 	/* Wait for the debugger to attach to the child. */
305 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
306 
307 	/* Release the child. */
308 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
309 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
310 	close(cpipe[0]);
311 
312 	wait_for_zombie(child);
313 
314 	/*
315 	 * This wait should return a pid of 0 to indicate no status to
316 	 * report.  The parent should see the child as non-exited
317 	 * until the debugger sees the exit.
318 	 */
319 	wpid = waitpid(child, &status, WNOHANG);
320 	ATF_REQUIRE(wpid == 0);
321 
322 	/* Signal the debugger to wait for the child. */
323 	close(dpipe[0]);
324 
325 	/* Wait for the debugger. */
326 	wpid = waitpid(debugger, &status, 0);
327 	ATF_REQUIRE(wpid == debugger);
328 	ATF_REQUIRE(WIFEXITED(status));
329 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
330 
331 	/* The child process should now be ready. */
332 	wpid = waitpid(child, &status, WNOHANG);
333 	ATF_REQUIRE(wpid == child);
334 	ATF_REQUIRE(WIFEXITED(status));
335 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
336 }
337 
338 /*
339  * Verify that a parent process "sees" the exit of a debugged process
340  * only after a non-direct-child debugger has seen it.  In particular,
341  * various wait() calls in the parent must avoid failing with ESRCH by
342  * checking the parent's orphan list for the debugee.
343  */
344 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
345 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
346 {
347 	pid_t child, debugger, fpid, wpid;
348 	int cpipe[2], dpipe[2], status;
349 	char c;
350 
351 	ATF_REQUIRE(pipe(cpipe) == 0);
352 	ATF_REQUIRE((child = fork()) != -1);
353 
354 	if (child == 0) {
355 		/* Child process. */
356 		close(cpipe[0]);
357 
358 		/* Wait for parent to be ready. */
359 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
360 
361 		_exit(1);
362 	}
363 	close(cpipe[1]);
364 
365 	ATF_REQUIRE(pipe(dpipe) == 0);
366 	ATF_REQUIRE((debugger = fork()) != -1);
367 
368 	if (debugger == 0) {
369 		/* Debugger parent. */
370 
371 		/*
372 		 * Fork again and drop the debugger parent so that the
373 		 * debugger is not a child of the main parent.
374 		 */
375 		CHILD_REQUIRE((fpid = fork()) != -1);
376 		if (fpid != 0)
377 			_exit(2);
378 
379 		/* Debugger process. */
380 		close(dpipe[0]);
381 
382 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
383 
384 		wpid = waitpid(child, &status, 0);
385 		CHILD_REQUIRE(wpid == child);
386 		CHILD_REQUIRE(WIFSTOPPED(status));
387 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
388 
389 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
390 
391 		/* Signal parent that debugger is attached. */
392 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
393 
394 		/* Wait for parent's failed wait. */
395 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
396 
397 		wpid = waitpid(child, &status, 0);
398 		CHILD_REQUIRE(wpid == child);
399 		CHILD_REQUIRE(WIFEXITED(status));
400 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
401 
402 		_exit(0);
403 	}
404 	close(dpipe[1]);
405 
406 	/* Parent process. */
407 
408 	/* Wait for the debugger parent process to exit. */
409 	wpid = waitpid(debugger, &status, 0);
410 	ATF_REQUIRE(wpid == debugger);
411 	ATF_REQUIRE(WIFEXITED(status));
412 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
413 
414 	/* A WNOHANG wait here should see the non-exited child. */
415 	wpid = waitpid(child, &status, WNOHANG);
416 	ATF_REQUIRE(wpid == 0);
417 
418 	/* Wait for the debugger to attach to the child. */
419 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
420 
421 	/* Release the child. */
422 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
423 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
424 	close(cpipe[0]);
425 
426 	wait_for_zombie(child);
427 
428 	/*
429 	 * This wait should return a pid of 0 to indicate no status to
430 	 * report.  The parent should see the child as non-exited
431 	 * until the debugger sees the exit.
432 	 */
433 	wpid = waitpid(child, &status, WNOHANG);
434 	ATF_REQUIRE(wpid == 0);
435 
436 	/* Signal the debugger to wait for the child. */
437 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
438 
439 	/* Wait for the debugger. */
440 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
441 	close(dpipe[0]);
442 
443 	/* The child process should now be ready. */
444 	wpid = waitpid(child, &status, WNOHANG);
445 	ATF_REQUIRE(wpid == child);
446 	ATF_REQUIRE(WIFEXITED(status));
447 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
448 }
449 
450 /*
451  * The parent process should always act the same regardless of how the
452  * debugger is attached to it.
453  */
454 static __dead2 void
455 follow_fork_parent(bool use_vfork)
456 {
457 	pid_t fpid, wpid;
458 	int status;
459 
460 	if (use_vfork)
461 		CHILD_REQUIRE((fpid = vfork()) != -1);
462 	else
463 		CHILD_REQUIRE((fpid = fork()) != -1);
464 
465 	if (fpid == 0)
466 		/* Child */
467 		_exit(2);
468 
469 	wpid = waitpid(fpid, &status, 0);
470 	CHILD_REQUIRE(wpid == fpid);
471 	CHILD_REQUIRE(WIFEXITED(status));
472 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
473 
474 	_exit(1);
475 }
476 
477 /*
478  * Helper routine for follow fork tests.  This waits for two stops
479  * that report both "sides" of a fork.  It returns the pid of the new
480  * child process.
481  */
482 static pid_t
483 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
484 {
485 	struct ptrace_lwpinfo pl;
486 	bool fork_reported[2];
487 	pid_t child, wpid;
488 	int i, status;
489 
490 	fork_reported[0] = false;
491 	fork_reported[1] = false;
492 	child = -1;
493 
494 	/*
495 	 * Each process should report a fork event.  The parent should
496 	 * report a PL_FLAG_FORKED event, and the child should report
497 	 * a PL_FLAG_CHILD event.
498 	 */
499 	for (i = 0; i < 2; i++) {
500 		wpid = wait(&status);
501 		ATF_REQUIRE(wpid > 0);
502 		ATF_REQUIRE(WIFSTOPPED(status));
503 
504 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
505 		    sizeof(pl)) != -1);
506 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
507 		    0);
508 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
509 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
510 		if (pl.pl_flags & PL_FLAG_CHILD) {
511 			ATF_REQUIRE(wpid != parent);
512 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
513 			ATF_REQUIRE(!fork_reported[1]);
514 			if (child == -1)
515 				child = wpid;
516 			else
517 				ATF_REQUIRE(child == wpid);
518 			if (ppl != NULL)
519 				ppl[1] = pl;
520 			fork_reported[1] = true;
521 		} else {
522 			ATF_REQUIRE(wpid == parent);
523 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
524 			ATF_REQUIRE(!fork_reported[0]);
525 			if (child == -1)
526 				child = pl.pl_child_pid;
527 			else
528 				ATF_REQUIRE(child == pl.pl_child_pid);
529 			if (ppl != NULL)
530 				ppl[0] = pl;
531 			fork_reported[0] = true;
532 		}
533 	}
534 
535 	return (child);
536 }
537 
538 /*
539  * Verify that a new child process is stopped after a followed fork and
540  * that the traced parent sees the exit of the child after the debugger
541  * when both processes remain attached to the debugger.
542  */
543 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
544 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
545 {
546 	pid_t children[2], fpid, wpid;
547 	int status;
548 
549 	ATF_REQUIRE((fpid = fork()) != -1);
550 	if (fpid == 0) {
551 		trace_me();
552 		follow_fork_parent(false);
553 	}
554 
555 	/* Parent process. */
556 	children[0] = fpid;
557 
558 	/* The first wait() should report the stop from SIGSTOP. */
559 	wpid = waitpid(children[0], &status, 0);
560 	ATF_REQUIRE(wpid == children[0]);
561 	ATF_REQUIRE(WIFSTOPPED(status));
562 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
563 
564 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
565 
566 	/* Continue the child ignoring the SIGSTOP. */
567 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
568 
569 	children[1] = handle_fork_events(children[0], NULL);
570 	ATF_REQUIRE(children[1] > 0);
571 
572 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
573 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
574 
575 	/*
576 	 * The child can't exit until the grandchild reports status, so the
577 	 * grandchild should report its exit first to the debugger.
578 	 */
579 	wpid = wait(&status);
580 	ATF_REQUIRE(wpid == children[1]);
581 	ATF_REQUIRE(WIFEXITED(status));
582 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
583 
584 	wpid = wait(&status);
585 	ATF_REQUIRE(wpid == children[0]);
586 	ATF_REQUIRE(WIFEXITED(status));
587 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
588 
589 	wpid = wait(&status);
590 	ATF_REQUIRE(wpid == -1);
591 	ATF_REQUIRE(errno == ECHILD);
592 }
593 
594 /*
595  * Verify that a new child process is stopped after a followed fork
596  * and that the traced parent sees the exit of the child when the new
597  * child process is detached after it reports its fork.
598  */
599 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
600 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
601 {
602 	pid_t children[2], fpid, wpid;
603 	int status;
604 
605 	ATF_REQUIRE((fpid = fork()) != -1);
606 	if (fpid == 0) {
607 		trace_me();
608 		follow_fork_parent(false);
609 	}
610 
611 	/* Parent process. */
612 	children[0] = fpid;
613 
614 	/* The first wait() should report the stop from SIGSTOP. */
615 	wpid = waitpid(children[0], &status, 0);
616 	ATF_REQUIRE(wpid == children[0]);
617 	ATF_REQUIRE(WIFSTOPPED(status));
618 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
619 
620 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
621 
622 	/* Continue the child ignoring the SIGSTOP. */
623 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
624 
625 	children[1] = handle_fork_events(children[0], NULL);
626 	ATF_REQUIRE(children[1] > 0);
627 
628 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
629 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
630 
631 	/*
632 	 * Should not see any status from the grandchild now, only the
633 	 * child.
634 	 */
635 	wpid = wait(&status);
636 	ATF_REQUIRE(wpid == children[0]);
637 	ATF_REQUIRE(WIFEXITED(status));
638 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
639 
640 	wpid = wait(&status);
641 	ATF_REQUIRE(wpid == -1);
642 	ATF_REQUIRE(errno == ECHILD);
643 }
644 
645 /*
646  * Verify that a new child process is stopped after a followed fork
647  * and that the traced parent sees the exit of the child when the
648  * traced parent is detached after the fork.
649  */
650 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
651 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
652 {
653 	pid_t children[2], fpid, wpid;
654 	int status;
655 
656 	ATF_REQUIRE((fpid = fork()) != -1);
657 	if (fpid == 0) {
658 		trace_me();
659 		follow_fork_parent(false);
660 	}
661 
662 	/* Parent process. */
663 	children[0] = fpid;
664 
665 	/* The first wait() should report the stop from SIGSTOP. */
666 	wpid = waitpid(children[0], &status, 0);
667 	ATF_REQUIRE(wpid == children[0]);
668 	ATF_REQUIRE(WIFSTOPPED(status));
669 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
670 
671 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
672 
673 	/* Continue the child ignoring the SIGSTOP. */
674 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
675 
676 	children[1] = handle_fork_events(children[0], NULL);
677 	ATF_REQUIRE(children[1] > 0);
678 
679 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
680 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
681 
682 	/*
683 	 * The child can't exit until the grandchild reports status, so the
684 	 * grandchild should report its exit first to the debugger.
685 	 *
686 	 * Even though the child process is detached, it is still a
687 	 * child of the debugger, so it will still report it's exit
688 	 * after the grandchild.
689 	 */
690 	wpid = wait(&status);
691 	ATF_REQUIRE(wpid == children[1]);
692 	ATF_REQUIRE(WIFEXITED(status));
693 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
694 
695 	wpid = wait(&status);
696 	ATF_REQUIRE(wpid == children[0]);
697 	ATF_REQUIRE(WIFEXITED(status));
698 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
699 
700 	wpid = wait(&status);
701 	ATF_REQUIRE(wpid == -1);
702 	ATF_REQUIRE(errno == ECHILD);
703 }
704 
705 static void
706 attach_fork_parent(int cpipe[2])
707 {
708 	pid_t fpid;
709 
710 	close(cpipe[0]);
711 
712 	/* Double-fork to disassociate from the debugger. */
713 	CHILD_REQUIRE((fpid = fork()) != -1);
714 	if (fpid != 0)
715 		_exit(3);
716 
717 	/* Send the pid of the disassociated child to the debugger. */
718 	fpid = getpid();
719 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
720 
721 	/* Wait for the debugger to attach. */
722 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
723 }
724 
725 /*
726  * Verify that a new child process is stopped after a followed fork and
727  * that the traced parent sees the exit of the child after the debugger
728  * when both processes remain attached to the debugger.  In this test
729  * the parent that forks is not a direct child of the debugger.
730  */
731 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
732 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
733 {
734 	pid_t children[2], fpid, wpid;
735 	int cpipe[2], status;
736 
737 	ATF_REQUIRE(pipe(cpipe) == 0);
738 	ATF_REQUIRE((fpid = fork()) != -1);
739 	if (fpid == 0) {
740 		attach_fork_parent(cpipe);
741 		follow_fork_parent(false);
742 	}
743 
744 	/* Parent process. */
745 	close(cpipe[1]);
746 
747 	/* Wait for the direct child to exit. */
748 	wpid = waitpid(fpid, &status, 0);
749 	ATF_REQUIRE(wpid == fpid);
750 	ATF_REQUIRE(WIFEXITED(status));
751 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
752 
753 	/* Read the pid of the fork parent. */
754 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
755 	    sizeof(children[0]));
756 
757 	/* Attach to the fork parent. */
758 	attach_child(children[0]);
759 
760 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
761 
762 	/* Continue the fork parent ignoring the SIGSTOP. */
763 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
764 
765 	/* Signal the fork parent to continue. */
766 	close(cpipe[0]);
767 
768 	children[1] = handle_fork_events(children[0], NULL);
769 	ATF_REQUIRE(children[1] > 0);
770 
771 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
772 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
773 
774 	/*
775 	 * The fork parent can't exit until the child reports status,
776 	 * so the child should report its exit first to the debugger.
777 	 */
778 	wpid = wait(&status);
779 	ATF_REQUIRE(wpid == children[1]);
780 	ATF_REQUIRE(WIFEXITED(status));
781 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
782 
783 	wpid = wait(&status);
784 	ATF_REQUIRE(wpid == children[0]);
785 	ATF_REQUIRE(WIFEXITED(status));
786 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
787 
788 	wpid = wait(&status);
789 	ATF_REQUIRE(wpid == -1);
790 	ATF_REQUIRE(errno == ECHILD);
791 }
792 
793 /*
794  * Verify that a new child process is stopped after a followed fork
795  * and that the traced parent sees the exit of the child when the new
796  * child process is detached after it reports its fork.  In this test
797  * the parent that forks is not a direct child of the debugger.
798  */
799 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
800 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
801 {
802 	pid_t children[2], fpid, wpid;
803 	int cpipe[2], status;
804 
805 	ATF_REQUIRE(pipe(cpipe) == 0);
806 	ATF_REQUIRE((fpid = fork()) != -1);
807 	if (fpid == 0) {
808 		attach_fork_parent(cpipe);
809 		follow_fork_parent(false);
810 	}
811 
812 	/* Parent process. */
813 	close(cpipe[1]);
814 
815 	/* Wait for the direct child to exit. */
816 	wpid = waitpid(fpid, &status, 0);
817 	ATF_REQUIRE(wpid == fpid);
818 	ATF_REQUIRE(WIFEXITED(status));
819 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
820 
821 	/* Read the pid of the fork parent. */
822 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
823 	    sizeof(children[0]));
824 
825 	/* Attach to the fork parent. */
826 	attach_child(children[0]);
827 
828 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
829 
830 	/* Continue the fork parent ignoring the SIGSTOP. */
831 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
832 
833 	/* Signal the fork parent to continue. */
834 	close(cpipe[0]);
835 
836 	children[1] = handle_fork_events(children[0], NULL);
837 	ATF_REQUIRE(children[1] > 0);
838 
839 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
840 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
841 
842 	/*
843 	 * Should not see any status from the child now, only the fork
844 	 * parent.
845 	 */
846 	wpid = wait(&status);
847 	ATF_REQUIRE(wpid == children[0]);
848 	ATF_REQUIRE(WIFEXITED(status));
849 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
850 
851 	wpid = wait(&status);
852 	ATF_REQUIRE(wpid == -1);
853 	ATF_REQUIRE(errno == ECHILD);
854 }
855 
856 /*
857  * Verify that a new child process is stopped after a followed fork
858  * and that the traced parent sees the exit of the child when the
859  * traced parent is detached after the fork.  In this test the parent
860  * that forks is not a direct child of the debugger.
861  */
862 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
863 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
864 {
865 	pid_t children[2], fpid, wpid;
866 	int cpipe[2], status;
867 
868 	ATF_REQUIRE(pipe(cpipe) == 0);
869 	ATF_REQUIRE((fpid = fork()) != -1);
870 	if (fpid == 0) {
871 		attach_fork_parent(cpipe);
872 		follow_fork_parent(false);
873 	}
874 
875 	/* Parent process. */
876 	close(cpipe[1]);
877 
878 	/* Wait for the direct child to exit. */
879 	wpid = waitpid(fpid, &status, 0);
880 	ATF_REQUIRE(wpid == fpid);
881 	ATF_REQUIRE(WIFEXITED(status));
882 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
883 
884 	/* Read the pid of the fork parent. */
885 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
886 	    sizeof(children[0]));
887 
888 	/* Attach to the fork parent. */
889 	attach_child(children[0]);
890 
891 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
892 
893 	/* Continue the fork parent ignoring the SIGSTOP. */
894 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
895 
896 	/* Signal the fork parent to continue. */
897 	close(cpipe[0]);
898 
899 	children[1] = handle_fork_events(children[0], NULL);
900 	ATF_REQUIRE(children[1] > 0);
901 
902 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
903 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
904 
905 	/*
906 	 * Should not see any status from the fork parent now, only
907 	 * the child.
908 	 */
909 	wpid = wait(&status);
910 	ATF_REQUIRE(wpid == children[1]);
911 	ATF_REQUIRE(WIFEXITED(status));
912 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
913 
914 	wpid = wait(&status);
915 	ATF_REQUIRE(wpid == -1);
916 	ATF_REQUIRE(errno == ECHILD);
917 }
918 
919 /*
920  * Verify that a child process does not see an unrelated debugger as its
921  * parent but sees its original parent process.
922  */
923 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
924 ATF_TC_BODY(ptrace__getppid, tc)
925 {
926 	pid_t child, debugger, ppid, wpid;
927 	int cpipe[2], dpipe[2], status;
928 	char c;
929 
930 	ATF_REQUIRE(pipe(cpipe) == 0);
931 	ATF_REQUIRE((child = fork()) != -1);
932 
933 	if (child == 0) {
934 		/* Child process. */
935 		close(cpipe[0]);
936 
937 		/* Wait for parent to be ready. */
938 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
939 
940 		/* Report the parent PID to the parent. */
941 		ppid = getppid();
942 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
943 		    sizeof(ppid));
944 
945 		_exit(1);
946 	}
947 	close(cpipe[1]);
948 
949 	ATF_REQUIRE(pipe(dpipe) == 0);
950 	ATF_REQUIRE((debugger = fork()) != -1);
951 
952 	if (debugger == 0) {
953 		/* Debugger process. */
954 		close(dpipe[0]);
955 
956 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
957 
958 		wpid = waitpid(child, &status, 0);
959 		CHILD_REQUIRE(wpid == child);
960 		CHILD_REQUIRE(WIFSTOPPED(status));
961 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
962 
963 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
964 
965 		/* Signal parent that debugger is attached. */
966 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
967 
968 		/* Wait for traced child to exit. */
969 		wpid = waitpid(child, &status, 0);
970 		CHILD_REQUIRE(wpid == child);
971 		CHILD_REQUIRE(WIFEXITED(status));
972 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
973 
974 		_exit(0);
975 	}
976 	close(dpipe[1]);
977 
978 	/* Parent process. */
979 
980 	/* Wait for the debugger to attach to the child. */
981 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
982 
983 	/* Release the child. */
984 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
985 
986 	/* Read the parent PID from the child. */
987 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
988 	close(cpipe[0]);
989 
990 	ATF_REQUIRE(ppid == getpid());
991 
992 	/* Wait for the debugger. */
993 	wpid = waitpid(debugger, &status, 0);
994 	ATF_REQUIRE(wpid == debugger);
995 	ATF_REQUIRE(WIFEXITED(status));
996 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
997 
998 	/* The child process should now be ready. */
999 	wpid = waitpid(child, &status, WNOHANG);
1000 	ATF_REQUIRE(wpid == child);
1001 	ATF_REQUIRE(WIFEXITED(status));
1002 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1003 }
1004 
1005 /*
1006  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1007  * child process created via fork() reports the correct value.
1008  */
1009 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
1010 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
1011 {
1012 	struct ptrace_lwpinfo pl[2];
1013 	pid_t children[2], fpid, wpid;
1014 	int status;
1015 
1016 	ATF_REQUIRE((fpid = fork()) != -1);
1017 	if (fpid == 0) {
1018 		trace_me();
1019 		follow_fork_parent(false);
1020 	}
1021 
1022 	/* Parent process. */
1023 	children[0] = fpid;
1024 
1025 	/* The first wait() should report the stop from SIGSTOP. */
1026 	wpid = waitpid(children[0], &status, 0);
1027 	ATF_REQUIRE(wpid == children[0]);
1028 	ATF_REQUIRE(WIFSTOPPED(status));
1029 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1030 
1031 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1032 
1033 	/* Continue the child ignoring the SIGSTOP. */
1034 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1035 
1036 	/* Wait for both halves of the fork event to get reported. */
1037 	children[1] = handle_fork_events(children[0], pl);
1038 	ATF_REQUIRE(children[1] > 0);
1039 
1040 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1041 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1042 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1043 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1044 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1045 
1046 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1047 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1048 
1049 	/*
1050 	 * The child can't exit until the grandchild reports status, so the
1051 	 * grandchild should report its exit first to the debugger.
1052 	 */
1053 	wpid = wait(&status);
1054 	ATF_REQUIRE(wpid == children[1]);
1055 	ATF_REQUIRE(WIFEXITED(status));
1056 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1057 
1058 	wpid = wait(&status);
1059 	ATF_REQUIRE(wpid == children[0]);
1060 	ATF_REQUIRE(WIFEXITED(status));
1061 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1062 
1063 	wpid = wait(&status);
1064 	ATF_REQUIRE(wpid == -1);
1065 	ATF_REQUIRE(errno == ECHILD);
1066 }
1067 
1068 /*
1069  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1070  * child process created via vfork() reports the correct value.
1071  */
1072 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1073 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1074 {
1075 	struct ptrace_lwpinfo pl[2];
1076 	pid_t children[2], fpid, wpid;
1077 	int status;
1078 
1079 	ATF_REQUIRE((fpid = fork()) != -1);
1080 	if (fpid == 0) {
1081 		trace_me();
1082 		follow_fork_parent(true);
1083 	}
1084 
1085 	/* Parent process. */
1086 	children[0] = fpid;
1087 
1088 	/* The first wait() should report the stop from SIGSTOP. */
1089 	wpid = waitpid(children[0], &status, 0);
1090 	ATF_REQUIRE(wpid == children[0]);
1091 	ATF_REQUIRE(WIFSTOPPED(status));
1092 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1093 
1094 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1095 
1096 	/* Continue the child ignoring the SIGSTOP. */
1097 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1098 
1099 	/* Wait for both halves of the fork event to get reported. */
1100 	children[1] = handle_fork_events(children[0], pl);
1101 	ATF_REQUIRE(children[1] > 0);
1102 
1103 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1104 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1105 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1106 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1107 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1108 
1109 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1110 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1111 
1112 	/*
1113 	 * The child can't exit until the grandchild reports status, so the
1114 	 * grandchild should report its exit first to the debugger.
1115 	 */
1116 	wpid = wait(&status);
1117 	ATF_REQUIRE(wpid == children[1]);
1118 	ATF_REQUIRE(WIFEXITED(status));
1119 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1120 
1121 	wpid = wait(&status);
1122 	ATF_REQUIRE(wpid == children[0]);
1123 	ATF_REQUIRE(WIFEXITED(status));
1124 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1125 
1126 	wpid = wait(&status);
1127 	ATF_REQUIRE(wpid == -1);
1128 	ATF_REQUIRE(errno == ECHILD);
1129 }
1130 
1131 static void *
1132 simple_thread(void *arg __unused)
1133 {
1134 
1135 	pthread_exit(NULL);
1136 }
1137 
1138 static __dead2 void
1139 simple_thread_main(void)
1140 {
1141 	pthread_t thread;
1142 
1143 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1144 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1145 	exit(1);
1146 }
1147 
1148 /*
1149  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1150  * thread reports the correct value.
1151  */
1152 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1153 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1154 {
1155 	struct ptrace_lwpinfo pl;
1156 	pid_t fpid, wpid;
1157 	lwpid_t mainlwp;
1158 	int status;
1159 
1160 	ATF_REQUIRE((fpid = fork()) != -1);
1161 	if (fpid == 0) {
1162 		trace_me();
1163 		simple_thread_main();
1164 	}
1165 
1166 	/* The first wait() should report the stop from SIGSTOP. */
1167 	wpid = waitpid(fpid, &status, 0);
1168 	ATF_REQUIRE(wpid == fpid);
1169 	ATF_REQUIRE(WIFSTOPPED(status));
1170 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1171 
1172 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1173 	    sizeof(pl)) != -1);
1174 	mainlwp = pl.pl_lwpid;
1175 
1176 	/*
1177 	 * Continue the child ignoring the SIGSTOP and tracing all
1178 	 * system call exits.
1179 	 */
1180 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1181 
1182 	/*
1183 	 * Wait for the new thread to arrive.  pthread_create() might
1184 	 * invoke any number of system calls.  For now we just wait
1185 	 * for the new thread to arrive and make sure it reports a
1186 	 * valid system call code.  If ptrace grows thread event
1187 	 * reporting then this test can be made more precise.
1188 	 */
1189 	for (;;) {
1190 		wpid = waitpid(fpid, &status, 0);
1191 		ATF_REQUIRE(wpid == fpid);
1192 		ATF_REQUIRE(WIFSTOPPED(status));
1193 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1194 
1195 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1196 		    sizeof(pl)) != -1);
1197 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1198 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1199 		if (pl.pl_lwpid != mainlwp)
1200 			/* New thread seen. */
1201 			break;
1202 
1203 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1204 	}
1205 
1206 	/* Wait for the child to exit. */
1207 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1208 	for (;;) {
1209 		wpid = waitpid(fpid, &status, 0);
1210 		ATF_REQUIRE(wpid == fpid);
1211 		if (WIFEXITED(status))
1212 			break;
1213 
1214 		ATF_REQUIRE(WIFSTOPPED(status));
1215 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1216 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1217 	}
1218 
1219 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1220 
1221 	wpid = wait(&status);
1222 	ATF_REQUIRE(wpid == -1);
1223 	ATF_REQUIRE(errno == ECHILD);
1224 }
1225 
1226 /*
1227  * Verify that the expected LWP events are reported for a child thread.
1228  */
1229 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1230 ATF_TC_BODY(ptrace__lwp_events, tc)
1231 {
1232 	struct ptrace_lwpinfo pl;
1233 	pid_t fpid, wpid;
1234 	lwpid_t lwps[2];
1235 	int status;
1236 
1237 	ATF_REQUIRE((fpid = fork()) != -1);
1238 	if (fpid == 0) {
1239 		trace_me();
1240 		simple_thread_main();
1241 	}
1242 
1243 	/* The first wait() should report the stop from SIGSTOP. */
1244 	wpid = waitpid(fpid, &status, 0);
1245 	ATF_REQUIRE(wpid == fpid);
1246 	ATF_REQUIRE(WIFSTOPPED(status));
1247 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1248 
1249 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1250 	    sizeof(pl)) != -1);
1251 	lwps[0] = pl.pl_lwpid;
1252 
1253 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1254 
1255 	/* Continue the child ignoring the SIGSTOP. */
1256 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1257 
1258 	/* The first event should be for the child thread's birth. */
1259 	wpid = waitpid(fpid, &status, 0);
1260 	ATF_REQUIRE(wpid == fpid);
1261 	ATF_REQUIRE(WIFSTOPPED(status));
1262 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1263 
1264 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1265 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1266 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1267 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1268 	lwps[1] = pl.pl_lwpid;
1269 
1270 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1271 
1272 	/* The next event should be for the child thread's death. */
1273 	wpid = waitpid(fpid, &status, 0);
1274 	ATF_REQUIRE(wpid == fpid);
1275 	ATF_REQUIRE(WIFSTOPPED(status));
1276 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1277 
1278 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1279 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1280 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1281 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1282 
1283 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1284 
1285 	/* The last event should be for the child process's exit. */
1286 	wpid = waitpid(fpid, &status, 0);
1287 	ATF_REQUIRE(WIFEXITED(status));
1288 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1289 
1290 	wpid = wait(&status);
1291 	ATF_REQUIRE(wpid == -1);
1292 	ATF_REQUIRE(errno == ECHILD);
1293 }
1294 
1295 static void *
1296 exec_thread(void *arg __unused)
1297 {
1298 
1299 	execl("/usr/bin/true", "true", NULL);
1300 	exit(127);
1301 }
1302 
1303 static __dead2 void
1304 exec_thread_main(void)
1305 {
1306 	pthread_t thread;
1307 
1308 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1309 	for (;;)
1310 		sleep(60);
1311 	exit(1);
1312 }
1313 
1314 /*
1315  * Verify that the expected LWP events are reported for a multithreaded
1316  * process that calls execve(2).
1317  */
1318 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1319 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1320 {
1321 	struct ptrace_lwpinfo pl;
1322 	pid_t fpid, wpid;
1323 	lwpid_t lwps[2];
1324 	int status;
1325 
1326 	ATF_REQUIRE((fpid = fork()) != -1);
1327 	if (fpid == 0) {
1328 		trace_me();
1329 		exec_thread_main();
1330 	}
1331 
1332 	/* The first wait() should report the stop from SIGSTOP. */
1333 	wpid = waitpid(fpid, &status, 0);
1334 	ATF_REQUIRE(wpid == fpid);
1335 	ATF_REQUIRE(WIFSTOPPED(status));
1336 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1337 
1338 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1339 	    sizeof(pl)) != -1);
1340 	lwps[0] = pl.pl_lwpid;
1341 
1342 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1343 
1344 	/* Continue the child ignoring the SIGSTOP. */
1345 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1346 
1347 	/* The first event should be for the child thread's birth. */
1348 	wpid = waitpid(fpid, &status, 0);
1349 	ATF_REQUIRE(wpid == fpid);
1350 	ATF_REQUIRE(WIFSTOPPED(status));
1351 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1352 
1353 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1354 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1355 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1356 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1357 	lwps[1] = pl.pl_lwpid;
1358 
1359 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1360 
1361 	/*
1362 	 * The next event should be for the main thread's death due to
1363 	 * single threading from execve().
1364 	 */
1365 	wpid = waitpid(fpid, &status, 0);
1366 	ATF_REQUIRE(wpid == fpid);
1367 	ATF_REQUIRE(WIFSTOPPED(status));
1368 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1369 
1370 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1371 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1372 	    (PL_FLAG_EXITED));
1373 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1374 
1375 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1376 
1377 	/* The next event should be for the child process's exec. */
1378 	wpid = waitpid(fpid, &status, 0);
1379 	ATF_REQUIRE(WIFSTOPPED(status));
1380 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1381 
1382 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1383 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1384 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1385 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1386 
1387 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1388 
1389 	/* The last event should be for the child process's exit. */
1390 	wpid = waitpid(fpid, &status, 0);
1391 	ATF_REQUIRE(WIFEXITED(status));
1392 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1393 
1394 	wpid = wait(&status);
1395 	ATF_REQUIRE(wpid == -1);
1396 	ATF_REQUIRE(errno == ECHILD);
1397 }
1398 
1399 static void
1400 handler(int sig __unused)
1401 {
1402 }
1403 
1404 static void
1405 signal_main(void)
1406 {
1407 
1408 	signal(SIGINFO, handler);
1409 	raise(SIGINFO);
1410 	exit(0);
1411 }
1412 
1413 /*
1414  * Verify that the expected ptrace event is reported for a signal.
1415  */
1416 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1417 ATF_TC_BODY(ptrace__siginfo, tc)
1418 {
1419 	struct ptrace_lwpinfo pl;
1420 	pid_t fpid, wpid;
1421 	int status;
1422 
1423 	ATF_REQUIRE((fpid = fork()) != -1);
1424 	if (fpid == 0) {
1425 		trace_me();
1426 		signal_main();
1427 	}
1428 
1429 	/* The first wait() should report the stop from SIGSTOP. */
1430 	wpid = waitpid(fpid, &status, 0);
1431 	ATF_REQUIRE(wpid == fpid);
1432 	ATF_REQUIRE(WIFSTOPPED(status));
1433 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1434 
1435 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1436 
1437 	/* The next event should be for the SIGINFO. */
1438 	wpid = waitpid(fpid, &status, 0);
1439 	ATF_REQUIRE(WIFSTOPPED(status));
1440 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1441 
1442 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1443 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1444 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1445 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1446 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1447 
1448 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1449 
1450 	/* The last event should be for the child process's exit. */
1451 	wpid = waitpid(fpid, &status, 0);
1452 	ATF_REQUIRE(WIFEXITED(status));
1453 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1454 
1455 	wpid = wait(&status);
1456 	ATF_REQUIRE(wpid == -1);
1457 	ATF_REQUIRE(errno == ECHILD);
1458 }
1459 
1460 /*
1461  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1462  */
1463 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1464 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1465 {
1466 	pid_t fpid, wpid;
1467 	int events, status;
1468 
1469 	ATF_REQUIRE((fpid = fork()) != -1);
1470 	if (fpid == 0) {
1471 		trace_me();
1472 		exec_thread(NULL);
1473 	}
1474 
1475 	/* The first wait() should report the stop from SIGSTOP. */
1476 	wpid = waitpid(fpid, &status, 0);
1477 	ATF_REQUIRE(wpid == fpid);
1478 	ATF_REQUIRE(WIFSTOPPED(status));
1479 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1480 
1481 	events = 0;
1482 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1483 	    sizeof(events)) == 0);
1484 
1485 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1486 
1487 	/* Should get one event at exit. */
1488 	wpid = waitpid(fpid, &status, 0);
1489 	ATF_REQUIRE(WIFEXITED(status));
1490 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1491 
1492 	wpid = wait(&status);
1493 	ATF_REQUIRE(wpid == -1);
1494 	ATF_REQUIRE(errno == ECHILD);
1495 }
1496 
1497 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1498 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1499 {
1500 	struct ptrace_lwpinfo pl;
1501 	pid_t fpid, wpid;
1502 	int events, status;
1503 
1504 	ATF_REQUIRE((fpid = fork()) != -1);
1505 	if (fpid == 0) {
1506 		trace_me();
1507 		exec_thread(NULL);
1508 	}
1509 
1510 	/* The first wait() should report the stop from SIGSTOP. */
1511 	wpid = waitpid(fpid, &status, 0);
1512 	ATF_REQUIRE(wpid == fpid);
1513 	ATF_REQUIRE(WIFSTOPPED(status));
1514 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1515 
1516 	events = PTRACE_EXEC;
1517 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1518 	    sizeof(events)) == 0);
1519 
1520 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1521 
1522 	/* The next event should be for the child process's exec. */
1523 	wpid = waitpid(fpid, &status, 0);
1524 	ATF_REQUIRE(WIFSTOPPED(status));
1525 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1526 
1527 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1528 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1529 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1530 
1531 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1532 
1533 	/* The last event should be for the child process's exit. */
1534 	wpid = waitpid(fpid, &status, 0);
1535 	ATF_REQUIRE(WIFEXITED(status));
1536 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1537 
1538 	wpid = wait(&status);
1539 	ATF_REQUIRE(wpid == -1);
1540 	ATF_REQUIRE(errno == ECHILD);
1541 }
1542 
1543 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1544 ATF_TC_BODY(ptrace__event_mask, tc)
1545 {
1546 	pid_t fpid, wpid;
1547 	int events, status;
1548 
1549 	ATF_REQUIRE((fpid = fork()) != -1);
1550 	if (fpid == 0) {
1551 		trace_me();
1552 		exit(0);
1553 	}
1554 
1555 	/* The first wait() should report the stop from SIGSTOP. */
1556 	wpid = waitpid(fpid, &status, 0);
1557 	ATF_REQUIRE(wpid == fpid);
1558 	ATF_REQUIRE(WIFSTOPPED(status));
1559 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1560 
1561 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1562 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1563 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1564 	    sizeof(events)) == 0);
1565 	ATF_REQUIRE(events & PTRACE_FORK);
1566 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1567 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1568 	    sizeof(events)) == 0);
1569 	ATF_REQUIRE(!(events & PTRACE_FORK));
1570 
1571 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1572 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1573 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1574 	    sizeof(events)) == 0);
1575 	ATF_REQUIRE(events & PTRACE_LWP);
1576 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1577 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1578 	    sizeof(events)) == 0);
1579 	ATF_REQUIRE(!(events & PTRACE_LWP));
1580 
1581 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1582 
1583 	/* Should get one event at exit. */
1584 	wpid = waitpid(fpid, &status, 0);
1585 	ATF_REQUIRE(WIFEXITED(status));
1586 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1587 
1588 	wpid = wait(&status);
1589 	ATF_REQUIRE(wpid == -1);
1590 	ATF_REQUIRE(errno == ECHILD);
1591 }
1592 
1593 /*
1594  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1595  */
1596 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1597 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1598 {
1599 	struct ptrace_lwpinfo pl;
1600 	pid_t fpid, wpid;
1601 	int events, status;
1602 
1603 	ATF_REQUIRE((fpid = fork()) != -1);
1604 	if (fpid == 0) {
1605 		trace_me();
1606 		follow_fork_parent(true);
1607 	}
1608 
1609 	/* The first wait() should report the stop from SIGSTOP. */
1610 	wpid = waitpid(fpid, &status, 0);
1611 	ATF_REQUIRE(wpid == fpid);
1612 	ATF_REQUIRE(WIFSTOPPED(status));
1613 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1614 
1615 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1616 	    sizeof(events)) == 0);
1617 	events |= PTRACE_VFORK;
1618 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1619 	    sizeof(events)) == 0);
1620 
1621 	/* Continue the child ignoring the SIGSTOP. */
1622 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1623 
1624 	/* The next event should report the end of the vfork. */
1625 	wpid = wait(&status);
1626 	ATF_REQUIRE(wpid == fpid);
1627 	ATF_REQUIRE(WIFSTOPPED(status));
1628 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1629 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1630 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1631 
1632 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1633 
1634 	wpid = wait(&status);
1635 	ATF_REQUIRE(wpid == fpid);
1636 	ATF_REQUIRE(WIFEXITED(status));
1637 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1638 
1639 	wpid = wait(&status);
1640 	ATF_REQUIRE(wpid == -1);
1641 	ATF_REQUIRE(errno == ECHILD);
1642 }
1643 
1644 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1645 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1646 {
1647 	struct ptrace_lwpinfo pl[2];
1648 	pid_t children[2], fpid, wpid;
1649 	int events, status;
1650 
1651 	ATF_REQUIRE((fpid = fork()) != -1);
1652 	if (fpid == 0) {
1653 		trace_me();
1654 		follow_fork_parent(true);
1655 	}
1656 
1657 	/* Parent process. */
1658 	children[0] = fpid;
1659 
1660 	/* The first wait() should report the stop from SIGSTOP. */
1661 	wpid = waitpid(children[0], &status, 0);
1662 	ATF_REQUIRE(wpid == children[0]);
1663 	ATF_REQUIRE(WIFSTOPPED(status));
1664 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1665 
1666 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1667 	    sizeof(events)) == 0);
1668 	events |= PTRACE_FORK | PTRACE_VFORK;
1669 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1670 	    sizeof(events)) == 0);
1671 
1672 	/* Continue the child ignoring the SIGSTOP. */
1673 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1674 
1675 	/* Wait for both halves of the fork event to get reported. */
1676 	children[1] = handle_fork_events(children[0], pl);
1677 	ATF_REQUIRE(children[1] > 0);
1678 
1679 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1680 
1681 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1682 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1683 
1684 	/*
1685 	 * The child can't exit until the grandchild reports status, so the
1686 	 * grandchild should report its exit first to the debugger.
1687 	 */
1688 	wpid = waitpid(children[1], &status, 0);
1689 	ATF_REQUIRE(wpid == children[1]);
1690 	ATF_REQUIRE(WIFEXITED(status));
1691 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1692 
1693 	/*
1694 	 * The child should report it's vfork() completion before it
1695 	 * exits.
1696 	 */
1697 	wpid = wait(&status);
1698 	ATF_REQUIRE(wpid == children[0]);
1699 	ATF_REQUIRE(WIFSTOPPED(status));
1700 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1701 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1702 	    -1);
1703 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1704 
1705 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1706 
1707 	wpid = wait(&status);
1708 	ATF_REQUIRE(wpid == children[0]);
1709 	ATF_REQUIRE(WIFEXITED(status));
1710 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1711 
1712 	wpid = wait(&status);
1713 	ATF_REQUIRE(wpid == -1);
1714 	ATF_REQUIRE(errno == ECHILD);
1715 }
1716 
1717 #ifdef HAVE_BREAKPOINT
1718 /*
1719  * Verify that no more events are reported after PT_KILL except for the
1720  * process exit when stopped due to a breakpoint trap.
1721  */
1722 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1723 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1724 {
1725 	pid_t fpid, wpid;
1726 	int status;
1727 
1728 	ATF_REQUIRE((fpid = fork()) != -1);
1729 	if (fpid == 0) {
1730 		trace_me();
1731 		breakpoint();
1732 		exit(1);
1733 	}
1734 
1735 	/* The first wait() should report the stop from SIGSTOP. */
1736 	wpid = waitpid(fpid, &status, 0);
1737 	ATF_REQUIRE(wpid == fpid);
1738 	ATF_REQUIRE(WIFSTOPPED(status));
1739 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1740 
1741 	/* Continue the child ignoring the SIGSTOP. */
1742 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1743 
1744 	/* The second wait() should report hitting the breakpoint. */
1745 	wpid = waitpid(fpid, &status, 0);
1746 	ATF_REQUIRE(wpid == fpid);
1747 	ATF_REQUIRE(WIFSTOPPED(status));
1748 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1749 
1750 	/* Kill the child process. */
1751 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1752 
1753 	/* The last wait() should report the SIGKILL. */
1754 	wpid = waitpid(fpid, &status, 0);
1755 	ATF_REQUIRE(wpid == fpid);
1756 	ATF_REQUIRE(WIFSIGNALED(status));
1757 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1758 
1759 	wpid = wait(&status);
1760 	ATF_REQUIRE(wpid == -1);
1761 	ATF_REQUIRE(errno == ECHILD);
1762 }
1763 #endif /* HAVE_BREAKPOINT */
1764 
1765 /*
1766  * Verify that no more events are reported after PT_KILL except for the
1767  * process exit when stopped inside of a system call.
1768  */
1769 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1770 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1771 {
1772 	struct ptrace_lwpinfo pl;
1773 	pid_t fpid, wpid;
1774 	int status;
1775 
1776 	ATF_REQUIRE((fpid = fork()) != -1);
1777 	if (fpid == 0) {
1778 		trace_me();
1779 		getpid();
1780 		exit(1);
1781 	}
1782 
1783 	/* The first wait() should report the stop from SIGSTOP. */
1784 	wpid = waitpid(fpid, &status, 0);
1785 	ATF_REQUIRE(wpid == fpid);
1786 	ATF_REQUIRE(WIFSTOPPED(status));
1787 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1788 
1789 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1790 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1791 
1792 	/* The second wait() should report a system call entry for getpid(). */
1793 	wpid = waitpid(fpid, &status, 0);
1794 	ATF_REQUIRE(wpid == fpid);
1795 	ATF_REQUIRE(WIFSTOPPED(status));
1796 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1797 
1798 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1799 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1800 
1801 	/* Kill the child process. */
1802 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1803 
1804 	/* The last wait() should report the SIGKILL. */
1805 	wpid = waitpid(fpid, &status, 0);
1806 	ATF_REQUIRE(wpid == fpid);
1807 	ATF_REQUIRE(WIFSIGNALED(status));
1808 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1809 
1810 	wpid = wait(&status);
1811 	ATF_REQUIRE(wpid == -1);
1812 	ATF_REQUIRE(errno == ECHILD);
1813 }
1814 
1815 /*
1816  * Verify that no more events are reported after PT_KILL except for the
1817  * process exit when killing a multithreaded process.
1818  */
1819 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1820 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1821 {
1822 	struct ptrace_lwpinfo pl;
1823 	pid_t fpid, wpid;
1824 	lwpid_t main_lwp;
1825 	int status;
1826 
1827 	ATF_REQUIRE((fpid = fork()) != -1);
1828 	if (fpid == 0) {
1829 		trace_me();
1830 		simple_thread_main();
1831 	}
1832 
1833 	/* The first wait() should report the stop from SIGSTOP. */
1834 	wpid = waitpid(fpid, &status, 0);
1835 	ATF_REQUIRE(wpid == fpid);
1836 	ATF_REQUIRE(WIFSTOPPED(status));
1837 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1838 
1839 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1840 	    sizeof(pl)) != -1);
1841 	main_lwp = pl.pl_lwpid;
1842 
1843 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1844 
1845 	/* Continue the child ignoring the SIGSTOP. */
1846 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1847 
1848 	/* The first event should be for the child thread's birth. */
1849 	wpid = waitpid(fpid, &status, 0);
1850 	ATF_REQUIRE(wpid == fpid);
1851 	ATF_REQUIRE(WIFSTOPPED(status));
1852 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1853 
1854 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1855 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1856 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1857 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1858 
1859 	/* Kill the child process. */
1860 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1861 
1862 	/* The last wait() should report the SIGKILL. */
1863 	wpid = waitpid(fpid, &status, 0);
1864 	ATF_REQUIRE(wpid == fpid);
1865 	ATF_REQUIRE(WIFSIGNALED(status));
1866 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1867 
1868 	wpid = wait(&status);
1869 	ATF_REQUIRE(wpid == -1);
1870 	ATF_REQUIRE(errno == ECHILD);
1871 }
1872 
1873 static void *
1874 mask_usr1_thread(void *arg)
1875 {
1876 	pthread_barrier_t *pbarrier;
1877 	sigset_t sigmask;
1878 
1879 	pbarrier = (pthread_barrier_t*)arg;
1880 
1881 	sigemptyset(&sigmask);
1882 	sigaddset(&sigmask, SIGUSR1);
1883 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1884 
1885 	/* Sync up with other thread after sigmask updated. */
1886 	pthread_barrier_wait(pbarrier);
1887 
1888 	for (;;)
1889 		sleep(60);
1890 
1891 	return (NULL);
1892 }
1893 
1894 /*
1895  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1896  * and prevents spurious stops due to those other signals.
1897  */
1898 ATF_TC(ptrace__PT_KILL_competing_signal);
1899 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1900 {
1901 
1902 	atf_tc_set_md_var(tc, "require.user", "root");
1903 }
1904 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1905 {
1906 	pid_t fpid, wpid;
1907 	int status;
1908 	cpuset_t setmask;
1909 	pthread_t t;
1910 	pthread_barrier_t barrier;
1911 	struct sched_param sched_param;
1912 
1913 	ATF_REQUIRE((fpid = fork()) != -1);
1914 	if (fpid == 0) {
1915 		/* Bind to one CPU so only one thread at a time will run. */
1916 		CPU_ZERO(&setmask);
1917 		CPU_SET(0, &setmask);
1918 		cpusetid_t setid;
1919 		CHILD_REQUIRE(cpuset(&setid) == 0);
1920 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1921 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1922 
1923 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1924 
1925 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1926 		    (void*)&barrier) == 0);
1927 
1928 		/*
1929 		 * Give the main thread higher priority. The test always
1930 		 * assumes that, if both threads are able to run, the main
1931 		 * thread runs first.
1932 		 */
1933 		sched_param.sched_priority =
1934 		    (sched_get_priority_max(SCHED_FIFO) +
1935 		    sched_get_priority_min(SCHED_FIFO)) / 2;
1936 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
1937 		    SCHED_FIFO, &sched_param) == 0);
1938 		sched_param.sched_priority -= RQ_PPQ;
1939 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
1940 		    &sched_param) == 0);
1941 
1942 		sigset_t sigmask;
1943 		sigemptyset(&sigmask);
1944 		sigaddset(&sigmask, SIGUSR2);
1945 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1946 
1947 		/* Sync up with other thread after sigmask updated. */
1948 		pthread_barrier_wait(&barrier);
1949 
1950 		trace_me();
1951 
1952 		for (;;)
1953 			sleep(60);
1954 
1955 		exit(1);
1956 	}
1957 
1958 	/* The first wait() should report the stop from SIGSTOP. */
1959 	wpid = waitpid(fpid, &status, 0);
1960 	ATF_REQUIRE(wpid == fpid);
1961 	ATF_REQUIRE(WIFSTOPPED(status));
1962 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1963 
1964 	/* Continue the child ignoring the SIGSTOP. */
1965 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1966 
1967 	/* Send a signal that only the second thread can handle. */
1968 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
1969 
1970 	/* The second wait() should report the SIGUSR2. */
1971 	wpid = waitpid(fpid, &status, 0);
1972 	ATF_REQUIRE(wpid == fpid);
1973 	ATF_REQUIRE(WIFSTOPPED(status));
1974 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
1975 
1976 	/* Send a signal that only the first thread can handle. */
1977 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
1978 
1979 	/* Replace the SIGUSR2 with a kill. */
1980 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1981 
1982 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
1983 	wpid = waitpid(fpid, &status, 0);
1984 	ATF_REQUIRE(wpid == fpid);
1985 	ATF_REQUIRE(WIFSIGNALED(status));
1986 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1987 
1988 	wpid = wait(&status);
1989 	ATF_REQUIRE(wpid == -1);
1990 	ATF_REQUIRE(errno == ECHILD);
1991 }
1992 
1993 /*
1994  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
1995  * and prevents spurious stops caused by those events.
1996  */
1997 ATF_TC(ptrace__PT_KILL_competing_stop);
1998 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
1999 {
2000 
2001 	atf_tc_set_md_var(tc, "require.user", "root");
2002 }
2003 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
2004 {
2005 	pid_t fpid, wpid;
2006 	int status;
2007 	cpuset_t setmask;
2008 	pthread_t t;
2009 	pthread_barrier_t barrier;
2010 	lwpid_t main_lwp;
2011 	struct ptrace_lwpinfo pl;
2012 	struct sched_param sched_param;
2013 
2014 	ATF_REQUIRE((fpid = fork()) != -1);
2015 	if (fpid == 0) {
2016 		trace_me();
2017 
2018 		/* Bind to one CPU so only one thread at a time will run. */
2019 		CPU_ZERO(&setmask);
2020 		CPU_SET(0, &setmask);
2021 		cpusetid_t setid;
2022 		CHILD_REQUIRE(cpuset(&setid) == 0);
2023 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2024 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2025 
2026 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2027 
2028 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2029 		    (void*)&barrier) == 0);
2030 
2031 		/*
2032 		 * Give the main thread higher priority. The test always
2033 		 * assumes that, if both threads are able to run, the main
2034 		 * thread runs first.
2035 		 */
2036 		sched_param.sched_priority =
2037 		    (sched_get_priority_max(SCHED_FIFO) +
2038 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2039 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2040 		    SCHED_FIFO, &sched_param) == 0);
2041 		sched_param.sched_priority -= RQ_PPQ;
2042 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2043 		    &sched_param) == 0);
2044 
2045 		sigset_t sigmask;
2046 		sigemptyset(&sigmask);
2047 		sigaddset(&sigmask, SIGUSR2);
2048 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2049 
2050 		/* Sync up with other thread after sigmask updated. */
2051 		pthread_barrier_wait(&barrier);
2052 
2053 		/* Sync up with the test before doing the getpid(). */
2054 		raise(SIGSTOP);
2055 
2056 		getpid();
2057 		exit(1);
2058 	}
2059 
2060 	/* The first wait() should report the stop from SIGSTOP. */
2061 	wpid = waitpid(fpid, &status, 0);
2062 	ATF_REQUIRE(wpid == fpid);
2063 	ATF_REQUIRE(WIFSTOPPED(status));
2064 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2065 
2066 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2067 	main_lwp = pl.pl_lwpid;
2068 
2069 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2070 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2071 
2072 	/*
2073 	 * Continue until child is done with setup, which is indicated with
2074 	 * SIGSTOP. Ignore system calls in the meantime.
2075 	 */
2076 	for (;;) {
2077 		wpid = waitpid(fpid, &status, 0);
2078 		ATF_REQUIRE(wpid == fpid);
2079 		ATF_REQUIRE(WIFSTOPPED(status));
2080 		if (WSTOPSIG(status) == SIGTRAP) {
2081 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2082 			    sizeof(pl)) != -1);
2083 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2084 		} else {
2085 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2086 			break;
2087 		}
2088 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2089 	}
2090 
2091 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2092 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2093 
2094 	wpid = waitpid(fpid, &status, 0);
2095 	ATF_REQUIRE(wpid == fpid);
2096 	ATF_REQUIRE(WIFSTOPPED(status));
2097 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2098 
2099 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2100 	    sizeof(pl)) != -1);
2101 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2102 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2103 	/* Prevent the main thread from hitting its syscall exit for now. */
2104 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2105 
2106 	/*
2107 	 * Proceed, allowing second thread to hit syscall exit for
2108 	 * pthread_barrier_wait().
2109 	 */
2110 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2111 
2112 	wpid = waitpid(fpid, &status, 0);
2113 	ATF_REQUIRE(wpid == fpid);
2114 	ATF_REQUIRE(WIFSTOPPED(status));
2115 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2116 
2117 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2118 	    sizeof(pl)) != -1);
2119 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2120 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2121 
2122 	/* Send a signal that only the second thread can handle. */
2123 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2124 
2125 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2126 
2127 	/* The next wait() should report the SIGUSR2. */
2128 	wpid = waitpid(fpid, &status, 0);
2129 	ATF_REQUIRE(wpid == fpid);
2130 	ATF_REQUIRE(WIFSTOPPED(status));
2131 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2132 
2133 	/* Allow the main thread to try to finish its system call. */
2134 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2135 
2136 	/*
2137 	 * At this point, the main thread is in the middle of a system call and
2138 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2139 	 * be replaced with a SIGKILL below. The main thread will get to run
2140 	 * first. It should notice the kill request (even though the signal
2141 	 * replacement occurred in the other thread) and exit accordingly.  It
2142 	 * should not stop for the system call exit event.
2143 	 */
2144 
2145 	/* Replace the SIGUSR2 with a kill. */
2146 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2147 
2148 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2149 	wpid = waitpid(fpid, &status, 0);
2150 	ATF_REQUIRE(wpid == fpid);
2151 	ATF_REQUIRE(WIFSIGNALED(status));
2152 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2153 
2154 	wpid = wait(&status);
2155 	ATF_REQUIRE(wpid == -1);
2156 	ATF_REQUIRE(errno == ECHILD);
2157 }
2158 
2159 static void
2160 sigusr1_handler(int sig)
2161 {
2162 
2163 	CHILD_REQUIRE(sig == SIGUSR1);
2164 	_exit(2);
2165 }
2166 
2167 /*
2168  * Verify that even if the signal queue is full for a child process,
2169  * a PT_KILL will kill the process.
2170  */
2171 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2172 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2173 {
2174 	pid_t fpid, wpid;
2175 	int status;
2176 	int max_pending_per_proc;
2177 	size_t len;
2178 	int i;
2179 
2180 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2181 
2182 	ATF_REQUIRE((fpid = fork()) != -1);
2183 	if (fpid == 0) {
2184 		trace_me();
2185 		exit(1);
2186 	}
2187 
2188 	/* The first wait() should report the stop from SIGSTOP. */
2189 	wpid = waitpid(fpid, &status, 0);
2190 	ATF_REQUIRE(wpid == fpid);
2191 	ATF_REQUIRE(WIFSTOPPED(status));
2192 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2193 
2194 	len = sizeof(max_pending_per_proc);
2195 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2196 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2197 
2198 	/* Fill the signal queue. */
2199 	for (i = 0; i < max_pending_per_proc; ++i)
2200 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2201 
2202 	/* Kill the child process. */
2203 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2204 
2205 	/* The last wait() should report the SIGKILL. */
2206 	wpid = waitpid(fpid, &status, 0);
2207 	ATF_REQUIRE(wpid == fpid);
2208 	ATF_REQUIRE(WIFSIGNALED(status));
2209 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2210 
2211 	wpid = wait(&status);
2212 	ATF_REQUIRE(wpid == -1);
2213 	ATF_REQUIRE(errno == ECHILD);
2214 }
2215 
2216 /*
2217  * Verify that when stopped at a system call entry, a signal can be
2218  * requested with PT_CONTINUE which will be delivered once the system
2219  * call is complete.
2220  */
2221 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2222 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2223 {
2224 	struct ptrace_lwpinfo pl;
2225 	pid_t fpid, wpid;
2226 	int status;
2227 
2228 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2229 
2230 	ATF_REQUIRE((fpid = fork()) != -1);
2231 	if (fpid == 0) {
2232 		trace_me();
2233 		getpid();
2234 		exit(1);
2235 	}
2236 
2237 	/* The first wait() should report the stop from SIGSTOP. */
2238 	wpid = waitpid(fpid, &status, 0);
2239 	ATF_REQUIRE(wpid == fpid);
2240 	ATF_REQUIRE(WIFSTOPPED(status));
2241 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2242 
2243 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2244 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2245 
2246 	/* The second wait() should report a system call entry for getpid(). */
2247 	wpid = waitpid(fpid, &status, 0);
2248 	ATF_REQUIRE(wpid == fpid);
2249 	ATF_REQUIRE(WIFSTOPPED(status));
2250 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2251 
2252 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2253 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2254 
2255 	/* Continue the child process with a signal. */
2256 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2257 
2258 	for (;;) {
2259 		/*
2260 		 * The last wait() should report exit 2, i.e., a normal _exit
2261 		 * from the signal handler. In the meantime, catch and proceed
2262 		 * past any syscall stops.
2263 		 */
2264 		wpid = waitpid(fpid, &status, 0);
2265 		ATF_REQUIRE(wpid == fpid);
2266 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2267 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2268 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2269 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2270 		} else {
2271 			ATF_REQUIRE(WIFEXITED(status));
2272 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2273 			break;
2274 		}
2275 	}
2276 
2277 	wpid = wait(&status);
2278 	ATF_REQUIRE(wpid == -1);
2279 	ATF_REQUIRE(errno == ECHILD);
2280 }
2281 
2282 static void
2283 sigusr1_counting_handler(int sig)
2284 {
2285 	static int counter = 0;
2286 
2287 	CHILD_REQUIRE(sig == SIGUSR1);
2288 	counter++;
2289 	if (counter == 2)
2290 		_exit(2);
2291 }
2292 
2293 /*
2294  * Verify that, when continuing from a stop at system call entry and exit,
2295  * a signal can be requested from both stops, and both will be delivered when
2296  * the system call is complete.
2297  */
2298 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2299 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2300 {
2301 	struct ptrace_lwpinfo pl;
2302 	pid_t fpid, wpid;
2303 	int status;
2304 
2305 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2306 
2307 	ATF_REQUIRE((fpid = fork()) != -1);
2308 	if (fpid == 0) {
2309 		trace_me();
2310 		getpid();
2311 		exit(1);
2312 	}
2313 
2314 	/* The first wait() should report the stop from SIGSTOP. */
2315 	wpid = waitpid(fpid, &status, 0);
2316 	ATF_REQUIRE(wpid == fpid);
2317 	ATF_REQUIRE(WIFSTOPPED(status));
2318 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2319 
2320 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2321 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2322 
2323 	/* The second wait() should report a system call entry for getpid(). */
2324 	wpid = waitpid(fpid, &status, 0);
2325 	ATF_REQUIRE(wpid == fpid);
2326 	ATF_REQUIRE(WIFSTOPPED(status));
2327 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2328 
2329 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2330 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2331 
2332 	/* Continue the child process with a signal. */
2333 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2334 
2335 	/* The third wait() should report a system call exit for getpid(). */
2336 	wpid = waitpid(fpid, &status, 0);
2337 	ATF_REQUIRE(wpid == fpid);
2338 	ATF_REQUIRE(WIFSTOPPED(status));
2339 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2340 
2341 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2342 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2343 
2344 	/* Continue the child process with a signal. */
2345 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2346 
2347 	for (;;) {
2348 		/*
2349 		 * The last wait() should report exit 2, i.e., a normal _exit
2350 		 * from the signal handler. In the meantime, catch and proceed
2351 		 * past any syscall stops.
2352 		 */
2353 		wpid = waitpid(fpid, &status, 0);
2354 		ATF_REQUIRE(wpid == fpid);
2355 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2356 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2357 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2358 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2359 		} else {
2360 			ATF_REQUIRE(WIFEXITED(status));
2361 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2362 			break;
2363 		}
2364 	}
2365 
2366 	wpid = wait(&status);
2367 	ATF_REQUIRE(wpid == -1);
2368 	ATF_REQUIRE(errno == ECHILD);
2369 }
2370 
2371 /*
2372  * Verify that even if the signal queue is full for a child process,
2373  * a PT_CONTINUE with a signal will not result in loss of that signal.
2374  */
2375 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2376 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2377 {
2378 	pid_t fpid, wpid;
2379 	int status;
2380 	int max_pending_per_proc;
2381 	size_t len;
2382 	int i;
2383 
2384 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2385 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2386 
2387 	ATF_REQUIRE((fpid = fork()) != -1);
2388 	if (fpid == 0) {
2389 		trace_me();
2390 		exit(1);
2391 	}
2392 
2393 	/* The first wait() should report the stop from SIGSTOP. */
2394 	wpid = waitpid(fpid, &status, 0);
2395 	ATF_REQUIRE(wpid == fpid);
2396 	ATF_REQUIRE(WIFSTOPPED(status));
2397 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2398 
2399 	len = sizeof(max_pending_per_proc);
2400 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2401 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2402 
2403 	/* Fill the signal queue. */
2404 	for (i = 0; i < max_pending_per_proc; ++i)
2405 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2406 
2407 	/* Continue with signal. */
2408 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2409 
2410 	for (;;) {
2411 		wpid = waitpid(fpid, &status, 0);
2412 		ATF_REQUIRE(wpid == fpid);
2413 		if (WIFSTOPPED(status)) {
2414 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2415 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2416 		} else {
2417 			/*
2418 			 * The last wait() should report normal _exit from the
2419 			 * SIGUSR1 handler.
2420 			 */
2421 			ATF_REQUIRE(WIFEXITED(status));
2422 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2423 			break;
2424 		}
2425 	}
2426 
2427 	wpid = wait(&status);
2428 	ATF_REQUIRE(wpid == -1);
2429 	ATF_REQUIRE(errno == ECHILD);
2430 }
2431 
2432 static sem_t sigusr1_sem;
2433 static int got_usr1;
2434 
2435 static void
2436 sigusr1_sempost_handler(int sig __unused)
2437 {
2438 
2439 	got_usr1++;
2440 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2441 }
2442 
2443 /*
2444  * Verify that even if the signal queue is full for a child process,
2445  * and the signal is masked, a PT_CONTINUE with a signal will not
2446  * result in loss of that signal.
2447  */
2448 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
2449 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue, tc)
2450 {
2451 	struct ptrace_lwpinfo pl;
2452 	pid_t fpid, wpid;
2453 	int status, err;
2454 	int max_pending_per_proc;
2455 	size_t len;
2456 	int i;
2457 	sigset_t sigmask;
2458 
2459 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2460 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2461 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2462 
2463 	got_usr1 = 0;
2464 	ATF_REQUIRE((fpid = fork()) != -1);
2465 	if (fpid == 0) {
2466 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2467 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2468 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2469 
2470 		trace_me();
2471 		CHILD_REQUIRE(got_usr1 == 0);
2472 
2473 		/* Allow the pending SIGUSR1 in now. */
2474 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2475 		/* Wait to receive the SIGUSR1. */
2476 		do {
2477 			err = sem_wait(&sigusr1_sem);
2478 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2479 		} while (err != 0 && errno == EINTR);
2480 		CHILD_REQUIRE(got_usr1 == 1);
2481 		exit(1);
2482 	}
2483 
2484 	/* The first wait() should report the stop from SIGSTOP. */
2485 	wpid = waitpid(fpid, &status, 0);
2486 	ATF_REQUIRE(wpid == fpid);
2487 	ATF_REQUIRE(WIFSTOPPED(status));
2488 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2489 
2490 	len = sizeof(max_pending_per_proc);
2491 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2492 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2493 
2494 	/* Fill the signal queue. */
2495 	for (i = 0; i < max_pending_per_proc; ++i)
2496 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2497 
2498 	/* Continue with signal. */
2499 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2500 
2501 	/* Collect and ignore all of the SIGUSR2. */
2502 	for (i = 0; i < max_pending_per_proc; ++i) {
2503 		wpid = waitpid(fpid, &status, 0);
2504 		ATF_REQUIRE(wpid == fpid);
2505 		ATF_REQUIRE(WIFSTOPPED(status));
2506 		ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2507 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2508 	}
2509 
2510 	/* Now our PT_CONTINUE'd SIGUSR1 should cause a stop after unmask. */
2511 	wpid = waitpid(fpid, &status, 0);
2512 	ATF_REQUIRE(wpid == fpid);
2513 	ATF_REQUIRE(WIFSTOPPED(status));
2514 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2515 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2516 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2517 
2518 	/* Continue the child, ignoring the SIGUSR1. */
2519 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2520 
2521 	/* The last wait() should report exit after receiving SIGUSR1. */
2522 	wpid = waitpid(fpid, &status, 0);
2523 	ATF_REQUIRE(wpid == fpid);
2524 	ATF_REQUIRE(WIFEXITED(status));
2525 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2526 
2527 	wpid = wait(&status);
2528 	ATF_REQUIRE(wpid == -1);
2529 	ATF_REQUIRE(errno == ECHILD);
2530 }
2531 
2532 /*
2533  * Verify that, after stopping due to a signal, that signal can be
2534  * replaced with another signal.
2535  */
2536 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2537 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2538 {
2539 	struct ptrace_lwpinfo pl;
2540 	pid_t fpid, wpid;
2541 	int status;
2542 
2543 	ATF_REQUIRE((fpid = fork()) != -1);
2544 	if (fpid == 0) {
2545 		trace_me();
2546 		sleep(20);
2547 		exit(1);
2548 	}
2549 
2550 	/* The first wait() should report the stop from SIGSTOP. */
2551 	wpid = waitpid(fpid, &status, 0);
2552 	ATF_REQUIRE(wpid == fpid);
2553 	ATF_REQUIRE(WIFSTOPPED(status));
2554 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2555 
2556 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2557 
2558 	/* Send a signal without ptrace. */
2559 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2560 
2561 	/* The second wait() should report a SIGINT was received. */
2562 	wpid = waitpid(fpid, &status, 0);
2563 	ATF_REQUIRE(wpid == fpid);
2564 	ATF_REQUIRE(WIFSTOPPED(status));
2565 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2566 
2567 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2568 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2569 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2570 
2571 	/* Continue the child process with a different signal. */
2572 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2573 
2574 	/*
2575 	 * The last wait() should report having died due to the new
2576 	 * signal, SIGTERM.
2577 	 */
2578 	wpid = waitpid(fpid, &status, 0);
2579 	ATF_REQUIRE(wpid == fpid);
2580 	ATF_REQUIRE(WIFSIGNALED(status));
2581 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2582 
2583 	wpid = wait(&status);
2584 	ATF_REQUIRE(wpid == -1);
2585 	ATF_REQUIRE(errno == ECHILD);
2586 }
2587 
2588 /*
2589  * Verify that a signal can be passed through to the child even when there
2590  * was no true signal originally. Such cases arise when a SIGTRAP is
2591  * invented for e.g, system call stops.
2592  */
2593 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2594 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2595 {
2596 	struct ptrace_lwpinfo pl;
2597 	struct rlimit rl;
2598 	pid_t fpid, wpid;
2599 	int status;
2600 
2601 	ATF_REQUIRE((fpid = fork()) != -1);
2602 	if (fpid == 0) {
2603 		trace_me();
2604 		/* SIGTRAP expected to cause exit on syscall entry. */
2605 		rl.rlim_cur = rl.rlim_max = 0;
2606 		ATF_REQUIRE(setrlimit(RLIMIT_CORE, &rl) == 0);
2607 		getpid();
2608 		exit(1);
2609 	}
2610 
2611 	/* The first wait() should report the stop from SIGSTOP. */
2612 	wpid = waitpid(fpid, &status, 0);
2613 	ATF_REQUIRE(wpid == fpid);
2614 	ATF_REQUIRE(WIFSTOPPED(status));
2615 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2616 
2617 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2618 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2619 
2620 	/* The second wait() should report a system call entry for getpid(). */
2621 	wpid = waitpid(fpid, &status, 0);
2622 	ATF_REQUIRE(wpid == fpid);
2623 	ATF_REQUIRE(WIFSTOPPED(status));
2624 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2625 
2626 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2627 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2628 
2629 	/* Continue the child process with a SIGTRAP. */
2630 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2631 
2632 	for (;;) {
2633 		/*
2634 		 * The last wait() should report exit due to SIGTRAP.  In the
2635 		 * meantime, catch and proceed past any syscall stops.
2636 		 */
2637 		wpid = waitpid(fpid, &status, 0);
2638 		ATF_REQUIRE(wpid == fpid);
2639 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2640 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2641 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2642 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2643 		} else {
2644 			ATF_REQUIRE(WIFSIGNALED(status));
2645 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2646 			break;
2647 		}
2648 	}
2649 
2650 	wpid = wait(&status);
2651 	ATF_REQUIRE(wpid == -1);
2652 	ATF_REQUIRE(errno == ECHILD);
2653 
2654 }
2655 
2656 /*
2657  * A mixed bag PT_CONTINUE with signal test.
2658  */
2659 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2660 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2661 {
2662 	struct ptrace_lwpinfo pl;
2663 	pid_t fpid, wpid;
2664 	int status;
2665 
2666 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2667 
2668 	ATF_REQUIRE((fpid = fork()) != -1);
2669 	if (fpid == 0) {
2670 		trace_me();
2671 		getpid();
2672 		exit(1);
2673 	}
2674 
2675 	/* The first wait() should report the stop from SIGSTOP. */
2676 	wpid = waitpid(fpid, &status, 0);
2677 	ATF_REQUIRE(wpid == fpid);
2678 	ATF_REQUIRE(WIFSTOPPED(status));
2679 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2680 
2681 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2682 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2683 
2684 	/* The second wait() should report a system call entry for getpid(). */
2685 	wpid = waitpid(fpid, &status, 0);
2686 	ATF_REQUIRE(wpid == fpid);
2687 	ATF_REQUIRE(WIFSTOPPED(status));
2688 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2689 
2690 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2691 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2692 
2693 	/* Continue with the first SIGUSR1. */
2694 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2695 
2696 	/* The next wait() should report a system call exit for getpid(). */
2697 	wpid = waitpid(fpid, &status, 0);
2698 	ATF_REQUIRE(wpid == fpid);
2699 	ATF_REQUIRE(WIFSTOPPED(status));
2700 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2701 
2702 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2703 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2704 
2705 	/* Send an ABRT without ptrace. */
2706 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2707 
2708 	/* Continue normally. */
2709 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2710 
2711 	/* The next wait() should report the SIGABRT. */
2712 	wpid = waitpid(fpid, &status, 0);
2713 	ATF_REQUIRE(wpid == fpid);
2714 	ATF_REQUIRE(WIFSTOPPED(status));
2715 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2716 
2717 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2718 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2719 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2720 
2721 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2722 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2723 
2724 	for (;;) {
2725 		/*
2726 		 * The last wait() should report exit 2, i.e., a normal _exit
2727 		 * from the signal handler. In the meantime, catch and proceed
2728 		 * past any syscall stops.
2729 		 */
2730 		wpid = waitpid(fpid, &status, 0);
2731 		ATF_REQUIRE(wpid == fpid);
2732 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2733 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2734 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2735 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2736 		} else {
2737 			ATF_REQUIRE(WIFEXITED(status));
2738 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2739 			break;
2740 		}
2741 	}
2742 
2743 	wpid = wait(&status);
2744 	ATF_REQUIRE(wpid == -1);
2745 	ATF_REQUIRE(errno == ECHILD);
2746 
2747 }
2748 
2749 /*
2750  * Verify a signal delivered by ptrace is noticed by kevent(2).
2751  */
2752 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2753 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2754 {
2755 	pid_t fpid, wpid;
2756 	int status, kq, nevents;
2757 	struct kevent kev;
2758 
2759 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2760 
2761 	ATF_REQUIRE((fpid = fork()) != -1);
2762 	if (fpid == 0) {
2763 		CHILD_REQUIRE((kq = kqueue()) > 0);
2764 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2765 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2766 
2767 		trace_me();
2768 
2769 		for (;;) {
2770 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2771 			if (nevents == -1 && errno == EINTR)
2772 				continue;
2773 			CHILD_REQUIRE(nevents > 0);
2774 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2775 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2776 			break;
2777 		}
2778 
2779 		exit(1);
2780 	}
2781 
2782 	/* The first wait() should report the stop from SIGSTOP. */
2783 	wpid = waitpid(fpid, &status, 0);
2784 	ATF_REQUIRE(wpid == fpid);
2785 	ATF_REQUIRE(WIFSTOPPED(status));
2786 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2787 
2788 	/* Continue with the SIGUSR1. */
2789 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2790 
2791 	/*
2792 	 * The last wait() should report normal exit with code 1.
2793 	 */
2794 	wpid = waitpid(fpid, &status, 0);
2795 	ATF_REQUIRE(wpid == fpid);
2796 	ATF_REQUIRE(WIFEXITED(status));
2797 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2798 
2799 	wpid = wait(&status);
2800 	ATF_REQUIRE(wpid == -1);
2801 	ATF_REQUIRE(errno == ECHILD);
2802 }
2803 
2804 static void *
2805 signal_thread(void *arg)
2806 {
2807 	int err;
2808 	sigset_t sigmask;
2809 
2810 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2811 
2812 	/* Wait for this thread to receive a SIGUSR1. */
2813 	do {
2814 		err = sem_wait(&sigusr1_sem);
2815 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2816 	} while (err != 0 && errno == EINTR);
2817 
2818 	/* Free our companion thread from the barrier. */
2819 	pthread_barrier_wait(pbarrier);
2820 
2821 	/*
2822 	 * Swap ignore duties; the next SIGUSR1 should go to the
2823 	 * other thread.
2824 	 */
2825 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2826 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2827 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2828 
2829 	/* Sync up threads after swapping signal masks. */
2830 	pthread_barrier_wait(pbarrier);
2831 
2832 	/* Wait until our companion has received its SIGUSR1. */
2833 	pthread_barrier_wait(pbarrier);
2834 
2835 	return (NULL);
2836 }
2837 
2838 /*
2839  * Verify that a traced process with blocked signal received the
2840  * signal from kill() once unmasked.
2841  */
2842 ATF_TC_WITHOUT_HEAD(ptrace__killed_with_sigmask);
2843 ATF_TC_BODY(ptrace__killed_with_sigmask, tc)
2844 {
2845 	struct ptrace_lwpinfo pl;
2846 	pid_t fpid, wpid;
2847 	int status, err;
2848 	sigset_t sigmask;
2849 
2850 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2851 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2852 	got_usr1 = 0;
2853 
2854 	ATF_REQUIRE((fpid = fork()) != -1);
2855 	if (fpid == 0) {
2856 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2857 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2858 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2859 
2860 		trace_me();
2861 		CHILD_REQUIRE(got_usr1 == 0);
2862 
2863 		/* Allow the pending SIGUSR1 in now. */
2864 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2865 		/* Wait to receive a SIGUSR1. */
2866 		do {
2867 			err = sem_wait(&sigusr1_sem);
2868 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2869 		} while (err != 0 && errno == EINTR);
2870 		CHILD_REQUIRE(got_usr1 == 1);
2871 		exit(1);
2872 	}
2873 
2874 	/* The first wait() should report the stop from SIGSTOP. */
2875 	wpid = waitpid(fpid, &status, 0);
2876 	ATF_REQUIRE(wpid == fpid);
2877 	ATF_REQUIRE(WIFSTOPPED(status));
2878 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2879 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2880 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2881 
2882 	/* Send blocked SIGUSR1 which should cause a stop. */
2883 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2884 
2885 	/* Continue the child ignoring the SIGSTOP. */
2886 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2887 
2888 	/* The next wait() should report the kill(SIGUSR1) was received. */
2889 	wpid = waitpid(fpid, &status, 0);
2890 	ATF_REQUIRE(wpid == fpid);
2891 	ATF_REQUIRE(WIFSTOPPED(status));
2892 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2893 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2894 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2895 
2896 	/* Continue the child, allowing in the SIGUSR1. */
2897 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2898 
2899 	/* The last wait() should report normal exit with code 1. */
2900 	wpid = waitpid(fpid, &status, 0);
2901 	ATF_REQUIRE(wpid == fpid);
2902 	ATF_REQUIRE(WIFEXITED(status));
2903 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2904 
2905 	wpid = wait(&status);
2906 	ATF_REQUIRE(wpid == -1);
2907 	ATF_REQUIRE(errno == ECHILD);
2908 }
2909 
2910 /*
2911  * Verify that a traced process with blocked signal received the
2912  * signal from PT_CONTINUE once unmasked.
2913  */
2914 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigmask);
2915 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigmask, tc)
2916 {
2917 	struct ptrace_lwpinfo pl;
2918 	pid_t fpid, wpid;
2919 	int status, err;
2920 	sigset_t sigmask;
2921 
2922 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2923 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2924 	got_usr1 = 0;
2925 
2926 	ATF_REQUIRE((fpid = fork()) != -1);
2927 	if (fpid == 0) {
2928 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2929 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2930 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2931 
2932 		trace_me();
2933 		CHILD_REQUIRE(got_usr1 == 0);
2934 
2935 		/* Allow the pending SIGUSR1 in now. */
2936 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2937 		/* Wait to receive a SIGUSR1. */
2938 		do {
2939 			err = sem_wait(&sigusr1_sem);
2940 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2941 		} while (err != 0 && errno == EINTR);
2942 
2943 		CHILD_REQUIRE(got_usr1 == 1);
2944 		exit(1);
2945 	}
2946 
2947 	/* The first wait() should report the stop from SIGSTOP. */
2948 	wpid = waitpid(fpid, &status, 0);
2949 	ATF_REQUIRE(wpid == fpid);
2950 	ATF_REQUIRE(WIFSTOPPED(status));
2951 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2952 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2953 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2954 
2955 	/* Continue the child replacing SIGSTOP with SIGUSR1. */
2956 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2957 
2958 	/* The next wait() should report the SIGUSR1 was received. */
2959 	wpid = waitpid(fpid, &status, 0);
2960 	ATF_REQUIRE(wpid == fpid);
2961 	ATF_REQUIRE(WIFSTOPPED(status));
2962 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2963 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2964 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2965 
2966 	/* Continue the child, ignoring the SIGUSR1. */
2967 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2968 
2969 	/* The last wait() should report normal exit with code 1. */
2970 	wpid = waitpid(fpid, &status, 0);
2971 	ATF_REQUIRE(wpid == fpid);
2972 	ATF_REQUIRE(WIFEXITED(status));
2973 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2974 
2975 	wpid = wait(&status);
2976 	ATF_REQUIRE(wpid == -1);
2977 	ATF_REQUIRE(errno == ECHILD);
2978 }
2979 
2980 /*
2981  * Verify that if ptrace stops due to a signal but continues with
2982  * a different signal that the new signal is routed to a thread
2983  * that can accept it, and that the thread is awakened by the signal
2984  * in a timely manner.
2985  */
2986 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
2987 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
2988 {
2989 	pid_t fpid, wpid;
2990 	int status, err;
2991 	pthread_t t;
2992 	sigset_t sigmask;
2993 	pthread_barrier_t barrier;
2994 
2995 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2996 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2997 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2998 
2999 	ATF_REQUIRE((fpid = fork()) != -1);
3000 	if (fpid == 0) {
3001 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
3002 
3003 		/* The other thread should receive the first SIGUSR1. */
3004 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
3005 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
3006 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
3007 
3008 		trace_me();
3009 
3010 		/* Wait until other thread has received its SIGUSR1. */
3011 		pthread_barrier_wait(&barrier);
3012 
3013 		/*
3014 		 * Swap ignore duties; the next SIGUSR1 should go to this
3015 		 * thread.
3016 		 */
3017 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3018 
3019 		/* Sync up threads after swapping signal masks. */
3020 		pthread_barrier_wait(&barrier);
3021 
3022 		/*
3023 		 * Sync up with test code; we're ready for the next SIGUSR1
3024 		 * now.
3025 		 */
3026 		raise(SIGSTOP);
3027 
3028 		/* Wait for this thread to receive a SIGUSR1. */
3029 		do {
3030 			err = sem_wait(&sigusr1_sem);
3031 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3032 		} while (err != 0 && errno == EINTR);
3033 
3034 		/* Free the other thread from the barrier. */
3035 		pthread_barrier_wait(&barrier);
3036 
3037 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
3038 
3039 		exit(1);
3040 	}
3041 
3042 	/* The first wait() should report the stop from SIGSTOP. */
3043 	wpid = waitpid(fpid, &status, 0);
3044 	ATF_REQUIRE(wpid == fpid);
3045 	ATF_REQUIRE(WIFSTOPPED(status));
3046 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3047 
3048 	/* Continue the child ignoring the SIGSTOP. */
3049 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3050 
3051 	/*
3052 	 * Send a signal without ptrace that either thread will accept (USR2,
3053 	 * in this case).
3054 	 */
3055 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3056 
3057 	/* The second wait() should report a SIGUSR2 was received. */
3058 	wpid = waitpid(fpid, &status, 0);
3059 	ATF_REQUIRE(wpid == fpid);
3060 	ATF_REQUIRE(WIFSTOPPED(status));
3061 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3062 
3063 	/* Continue the child, changing the signal to USR1. */
3064 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3065 
3066 	/* The next wait() should report the stop from SIGSTOP. */
3067 	wpid = waitpid(fpid, &status, 0);
3068 	ATF_REQUIRE(wpid == fpid);
3069 	ATF_REQUIRE(WIFSTOPPED(status));
3070 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3071 
3072 	/* Continue the child ignoring the SIGSTOP. */
3073 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3074 
3075 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3076 
3077 	/* The next wait() should report a SIGUSR2 was received. */
3078 	wpid = waitpid(fpid, &status, 0);
3079 	ATF_REQUIRE(wpid == fpid);
3080 	ATF_REQUIRE(WIFSTOPPED(status));
3081 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3082 
3083 	/* Continue the child, changing the signal to USR1. */
3084 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3085 
3086 	/* The last wait() should report normal exit with code 1. */
3087 	wpid = waitpid(fpid, &status, 0);
3088 	ATF_REQUIRE(wpid == fpid);
3089 	ATF_REQUIRE(WIFEXITED(status));
3090 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3091 
3092 	wpid = wait(&status);
3093 	ATF_REQUIRE(wpid == -1);
3094 	ATF_REQUIRE(errno == ECHILD);
3095 }
3096 
3097 static void *
3098 raise_sigstop_thread(void *arg __unused)
3099 {
3100 
3101 	raise(SIGSTOP);
3102 	return NULL;
3103 }
3104 
3105 static void *
3106 sleep_thread(void *arg __unused)
3107 {
3108 
3109 	sleep(60);
3110 	return NULL;
3111 }
3112 
3113 static void
3114 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
3115 {
3116 	pid_t fpid, wpid;
3117 	int status, i;
3118 	cpuset_t setmask;
3119 	cpusetid_t setid;
3120 	pthread_t t;
3121 
3122 	/*
3123 	 * Become the reaper for this process tree. We need to be able to check
3124 	 * that both child and grandchild have died.
3125 	 */
3126 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
3127 
3128 	fpid = fork();
3129 	ATF_REQUIRE(fpid >= 0);
3130 	if (fpid == 0) {
3131 		fpid = fork();
3132 		CHILD_REQUIRE(fpid >= 0);
3133 		if (fpid == 0) {
3134 			trace_me();
3135 
3136 			/* Pin to CPU 0 to serialize thread execution. */
3137 			CPU_ZERO(&setmask);
3138 			CPU_SET(0, &setmask);
3139 			CHILD_REQUIRE(cpuset(&setid) == 0);
3140 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
3141 			    CPU_WHICH_CPUSET, setid,
3142 			    sizeof(setmask), &setmask) == 0);
3143 
3144 			if (sigstop_from_main_thread) {
3145 				/*
3146 				 * We expect the SIGKILL sent when our parent
3147 				 * dies to be delivered to the new thread.
3148 				 * Raise the SIGSTOP in this thread so the
3149 				 * threads compete.
3150 				 */
3151 				CHILD_REQUIRE(pthread_create(&t, NULL,
3152 				    sleep_thread, NULL) == 0);
3153 				raise(SIGSTOP);
3154 			} else {
3155 				/*
3156 				 * We expect the SIGKILL to be delivered to
3157 				 * this thread. After creating the new thread,
3158 				 * just get off the CPU so the other thread can
3159 				 * raise the SIGSTOP.
3160 				 */
3161 				CHILD_REQUIRE(pthread_create(&t, NULL,
3162 				    raise_sigstop_thread, NULL) == 0);
3163 				sleep(60);
3164 			}
3165 
3166 			exit(0);
3167 		}
3168 		/* First stop is trace_me() immediately after fork. */
3169 		wpid = waitpid(fpid, &status, 0);
3170 		CHILD_REQUIRE(wpid == fpid);
3171 		CHILD_REQUIRE(WIFSTOPPED(status));
3172 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3173 
3174 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3175 
3176 		/* Second stop is from the raise(SIGSTOP). */
3177 		wpid = waitpid(fpid, &status, 0);
3178 		CHILD_REQUIRE(wpid == fpid);
3179 		CHILD_REQUIRE(WIFSTOPPED(status));
3180 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3181 
3182 		/*
3183 		 * Terminate tracing process without detaching. Our child
3184 		 * should be killed.
3185 		 */
3186 		exit(0);
3187 	}
3188 
3189 	/*
3190 	 * We should get a normal exit from our immediate child and a SIGKILL
3191 	 * exit from our grandchild. The latter case is the interesting one.
3192 	 * Our grandchild should not have stopped due to the SIGSTOP that was
3193 	 * left dangling when its parent died.
3194 	 */
3195 	for (i = 0; i < 2; ++i) {
3196 		wpid = wait(&status);
3197 		if (wpid == fpid)
3198 			ATF_REQUIRE(WIFEXITED(status) &&
3199 			    WEXITSTATUS(status) == 0);
3200 		else
3201 			ATF_REQUIRE(WIFSIGNALED(status) &&
3202 			    WTERMSIG(status) == SIGKILL);
3203 	}
3204 }
3205 
3206 /*
3207  * These two tests ensure that if the tracing process exits without detaching
3208  * just after the child received a SIGSTOP, the child is cleanly killed and
3209  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
3210  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
3211  * different threads, the SIGKILL must win.  There are two variants of this
3212  * test, designed to catch the case where the SIGKILL is delivered to the
3213  * younger thread (the first test) and the case where the SIGKILL is delivered
3214  * to the older thread (the second test). This behavior has changed in the
3215  * past, so make no assumption.
3216  */
3217 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
3218 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
3219 {
3220 
3221 	atf_tc_set_md_var(tc, "require.user", "root");
3222 }
3223 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
3224 {
3225 
3226 	terminate_with_pending_sigstop(true);
3227 }
3228 
3229 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
3230 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
3231 {
3232 
3233 	atf_tc_set_md_var(tc, "require.user", "root");
3234 }
3235 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
3236 {
3237 
3238 	terminate_with_pending_sigstop(false);
3239 }
3240 
3241 /*
3242  * Verify that after ptrace() discards a SIGKILL signal, the event mask
3243  * is not modified.
3244  */
3245 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
3246 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
3247 {
3248 	struct ptrace_lwpinfo pl;
3249 	pid_t fpid, wpid;
3250 	int status, event_mask, new_event_mask;
3251 
3252 	ATF_REQUIRE((fpid = fork()) != -1);
3253 	if (fpid == 0) {
3254 		trace_me();
3255 		raise(SIGSTOP);
3256 		exit(0);
3257 	}
3258 
3259 	/* The first wait() should report the stop from trace_me(). */
3260 	wpid = waitpid(fpid, &status, 0);
3261 	ATF_REQUIRE(wpid == fpid);
3262 	ATF_REQUIRE(WIFSTOPPED(status));
3263 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3264 
3265 	/* Set several unobtrusive event bits. */
3266 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3267 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3268 	    sizeof(event_mask)) == 0);
3269 
3270 	/* Send a SIGKILL without using ptrace. */
3271 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
3272 
3273 	/* Continue the child ignoring the SIGSTOP. */
3274 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3275 
3276 	/* The next stop should be due to the SIGKILL. */
3277 	wpid = waitpid(fpid, &status, 0);
3278 	ATF_REQUIRE(wpid == fpid);
3279 	ATF_REQUIRE(WIFSTOPPED(status));
3280 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
3281 
3282 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3283 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3284 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
3285 
3286 	/* Continue the child ignoring the SIGKILL. */
3287 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3288 
3289 	/* The next wait() should report the stop from SIGSTOP. */
3290 	wpid = waitpid(fpid, &status, 0);
3291 	ATF_REQUIRE(wpid == fpid);
3292 	ATF_REQUIRE(WIFSTOPPED(status));
3293 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3294 
3295 	/* Check the current event mask. It should not have changed. */
3296 	new_event_mask = 0;
3297 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3298 	    sizeof(new_event_mask)) == 0);
3299 	ATF_REQUIRE(event_mask == new_event_mask);
3300 
3301 	/* Continue the child to let it exit. */
3302 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3303 
3304 	/* The last event should be for the child process's exit. */
3305 	wpid = waitpid(fpid, &status, 0);
3306 	ATF_REQUIRE(WIFEXITED(status));
3307 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3308 
3309 	wpid = wait(&status);
3310 	ATF_REQUIRE(wpid == -1);
3311 	ATF_REQUIRE(errno == ECHILD);
3312 }
3313 
3314 static void *
3315 flock_thread(void *arg)
3316 {
3317 	int fd;
3318 
3319 	fd = *(int *)arg;
3320 	(void)flock(fd, LOCK_EX);
3321 	(void)flock(fd, LOCK_UN);
3322 	return (NULL);
3323 }
3324 
3325 /*
3326  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3327  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3328  * on a lock. This is a regression test for r318191.
3329  */
3330 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3331 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3332 {
3333 	pthread_barrier_t barrier;
3334 	pthread_barrierattr_t battr;
3335 	char tmpfile[64];
3336 	pid_t child, wpid;
3337 	int error, fd, i, status;
3338 
3339 	ATF_REQUIRE(pthread_barrierattr_init(&battr) == 0);
3340 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3341 	    PTHREAD_PROCESS_SHARED) == 0);
3342 	ATF_REQUIRE(pthread_barrier_init(&barrier, &battr, 2) == 0);
3343 
3344 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3345 	fd = mkstemp(tmpfile);
3346 	ATF_REQUIRE(fd >= 0);
3347 
3348 	ATF_REQUIRE((child = fork()) != -1);
3349 	if (child == 0) {
3350 		pthread_t t[2];
3351 		int cfd;
3352 
3353 		error = pthread_barrier_wait(&barrier);
3354 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3355 			_exit(1);
3356 
3357 		cfd = open(tmpfile, O_RDONLY);
3358 		if (cfd < 0)
3359 			_exit(1);
3360 
3361 		/*
3362 		 * We want at least two threads blocked on the file lock since
3363 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3364 		 * sleep.
3365 		 */
3366 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3367 			_exit(1);
3368 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3369 			_exit(1);
3370 		if (pthread_join(t[0], NULL) != 0)
3371 			_exit(1);
3372 		if (pthread_join(t[1], NULL) != 0)
3373 			_exit(1);
3374 		_exit(0);
3375 	}
3376 
3377 	ATF_REQUIRE(flock(fd, LOCK_EX) == 0);
3378 
3379 	error = pthread_barrier_wait(&barrier);
3380 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3381 
3382 	/*
3383 	 * Give the child some time to block. Is there a better way to do this?
3384 	 */
3385 	sleep(1);
3386 
3387 	/*
3388 	 * Attach and give the child 3 seconds to stop.
3389 	 */
3390 	ATF_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) == 0);
3391 	for (i = 0; i < 3; i++) {
3392 		wpid = waitpid(child, &status, WNOHANG);
3393 		if (wpid == child && WIFSTOPPED(status) &&
3394 		    WSTOPSIG(status) == SIGSTOP)
3395 			break;
3396 		sleep(1);
3397 	}
3398 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3399 
3400 	ATF_REQUIRE(ptrace(PT_DETACH, child, NULL, 0) == 0);
3401 
3402 	ATF_REQUIRE(flock(fd, LOCK_UN) == 0);
3403 	ATF_REQUIRE(unlink(tmpfile) == 0);
3404 	ATF_REQUIRE(close(fd) == 0);
3405 }
3406 
3407 static void
3408 sigusr1_step_handler(int sig)
3409 {
3410 
3411 	CHILD_REQUIRE(sig == SIGUSR1);
3412 	raise(SIGABRT);
3413 }
3414 
3415 /*
3416  * Verify that PT_STEP with a signal invokes the signal before
3417  * stepping the next instruction (and that the next instruction is
3418  * stepped correctly).
3419  */
3420 ATF_TC_WITHOUT_HEAD(ptrace__PT_STEP_with_signal);
3421 ATF_TC_BODY(ptrace__PT_STEP_with_signal, tc)
3422 {
3423 	struct ptrace_lwpinfo pl;
3424 	pid_t fpid, wpid;
3425 	int status;
3426 
3427 	ATF_REQUIRE((fpid = fork()) != -1);
3428 	if (fpid == 0) {
3429 		trace_me();
3430 		signal(SIGUSR1, sigusr1_step_handler);
3431 		raise(SIGABRT);
3432 		exit(1);
3433 	}
3434 
3435 	/* The first wait() should report the stop from SIGSTOP. */
3436 	wpid = waitpid(fpid, &status, 0);
3437 	ATF_REQUIRE(wpid == fpid);
3438 	ATF_REQUIRE(WIFSTOPPED(status));
3439 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3440 
3441 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3442 
3443 	/* The next stop should report the SIGABRT in the child body. */
3444 	wpid = waitpid(fpid, &status, 0);
3445 	ATF_REQUIRE(wpid == fpid);
3446 	ATF_REQUIRE(WIFSTOPPED(status));
3447 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3448 
3449 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3450 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3451 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3452 
3453 	/* Step the child process inserting SIGUSR1. */
3454 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, SIGUSR1) == 0);
3455 
3456 	/* The next stop should report the SIGABRT in the signal handler. */
3457 	wpid = waitpid(fpid, &status, 0);
3458 	ATF_REQUIRE(wpid == fpid);
3459 	ATF_REQUIRE(WIFSTOPPED(status));
3460 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3461 
3462 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3463 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3464 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3465 
3466 	/* Continue the child process discarding the signal. */
3467 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3468 
3469 	/* The next stop should report a trace trap from PT_STEP. */
3470 	wpid = waitpid(fpid, &status, 0);
3471 	ATF_REQUIRE(wpid == fpid);
3472 	ATF_REQUIRE(WIFSTOPPED(status));
3473 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3474 
3475 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3476 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3477 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3478 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3479 
3480 	/* Continue the child to let it exit. */
3481 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3482 
3483 	/* The last event should be for the child process's exit. */
3484 	wpid = waitpid(fpid, &status, 0);
3485 	ATF_REQUIRE(WIFEXITED(status));
3486 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3487 
3488 	wpid = wait(&status);
3489 	ATF_REQUIRE(wpid == -1);
3490 	ATF_REQUIRE(errno == ECHILD);
3491 }
3492 
3493 #ifdef HAVE_BREAKPOINT
3494 /*
3495  * Verify that a SIGTRAP event with the TRAP_BRKPT code is reported
3496  * for a breakpoint trap.
3497  */
3498 ATF_TC_WITHOUT_HEAD(ptrace__breakpoint_siginfo);
3499 ATF_TC_BODY(ptrace__breakpoint_siginfo, tc)
3500 {
3501 	struct ptrace_lwpinfo pl;
3502 	pid_t fpid, wpid;
3503 	int status;
3504 
3505 	ATF_REQUIRE((fpid = fork()) != -1);
3506 	if (fpid == 0) {
3507 		trace_me();
3508 		breakpoint();
3509 		exit(1);
3510 	}
3511 
3512 	/* The first wait() should report the stop from SIGSTOP. */
3513 	wpid = waitpid(fpid, &status, 0);
3514 	ATF_REQUIRE(wpid == fpid);
3515 	ATF_REQUIRE(WIFSTOPPED(status));
3516 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3517 
3518 	/* Continue the child ignoring the SIGSTOP. */
3519 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3520 
3521 	/* The second wait() should report hitting the breakpoint. */
3522 	wpid = waitpid(fpid, &status, 0);
3523 	ATF_REQUIRE(wpid == fpid);
3524 	ATF_REQUIRE(WIFSTOPPED(status));
3525 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3526 
3527 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3528 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3529 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3530 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_BRKPT);
3531 
3532 	/* Kill the child process. */
3533 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
3534 
3535 	/* The last wait() should report the SIGKILL. */
3536 	wpid = waitpid(fpid, &status, 0);
3537 	ATF_REQUIRE(wpid == fpid);
3538 	ATF_REQUIRE(WIFSIGNALED(status));
3539 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
3540 
3541 	wpid = wait(&status);
3542 	ATF_REQUIRE(wpid == -1);
3543 	ATF_REQUIRE(errno == ECHILD);
3544 }
3545 #endif /* HAVE_BREAKPOINT */
3546 
3547 /*
3548  * Verify that a SIGTRAP event with the TRAP_TRACE code is reported
3549  * for a single-step trap from PT_STEP.
3550  */
3551 ATF_TC_WITHOUT_HEAD(ptrace__step_siginfo);
3552 ATF_TC_BODY(ptrace__step_siginfo, tc)
3553 {
3554 	struct ptrace_lwpinfo pl;
3555 	pid_t fpid, wpid;
3556 	int status;
3557 
3558 	ATF_REQUIRE((fpid = fork()) != -1);
3559 	if (fpid == 0) {
3560 		trace_me();
3561 		exit(1);
3562 	}
3563 
3564 	/* The first wait() should report the stop from SIGSTOP. */
3565 	wpid = waitpid(fpid, &status, 0);
3566 	ATF_REQUIRE(wpid == fpid);
3567 	ATF_REQUIRE(WIFSTOPPED(status));
3568 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3569 
3570 	/* Step the child ignoring the SIGSTOP. */
3571 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, 0) == 0);
3572 
3573 	/* The second wait() should report a single-step trap. */
3574 	wpid = waitpid(fpid, &status, 0);
3575 	ATF_REQUIRE(wpid == fpid);
3576 	ATF_REQUIRE(WIFSTOPPED(status));
3577 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3578 
3579 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3580 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3581 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3582 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3583 
3584 	/* Continue the child process. */
3585 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3586 
3587 	/* The last event should be for the child process's exit. */
3588 	wpid = waitpid(fpid, &status, 0);
3589 	ATF_REQUIRE(WIFEXITED(status));
3590 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3591 
3592 	wpid = wait(&status);
3593 	ATF_REQUIRE(wpid == -1);
3594 	ATF_REQUIRE(errno == ECHILD);
3595 }
3596 
3597 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3598 static void *
3599 continue_thread(void *arg __unused)
3600 {
3601 	breakpoint();
3602 	return (NULL);
3603 }
3604 
3605 static __dead2 void
3606 continue_thread_main(void)
3607 {
3608 	pthread_t threads[2];
3609 
3610 	CHILD_REQUIRE(pthread_create(&threads[0], NULL, continue_thread,
3611 	    NULL) == 0);
3612 	CHILD_REQUIRE(pthread_create(&threads[1], NULL, continue_thread,
3613 	    NULL) == 0);
3614 	CHILD_REQUIRE(pthread_join(threads[0], NULL) == 0);
3615 	CHILD_REQUIRE(pthread_join(threads[1], NULL) == 0);
3616 	exit(1);
3617 }
3618 
3619 /*
3620  * Ensure that PT_CONTINUE clears the status of the thread that
3621  * triggered the stop even if a different thread's LWP was passed to
3622  * PT_CONTINUE.
3623  */
3624 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_different_thread);
3625 ATF_TC_BODY(ptrace__PT_CONTINUE_different_thread, tc)
3626 {
3627 	struct ptrace_lwpinfo pl;
3628 	pid_t fpid, wpid;
3629 	lwpid_t lwps[2];
3630 	bool hit_break[2];
3631 	struct reg reg;
3632 	int i, j, status;
3633 
3634 	ATF_REQUIRE((fpid = fork()) != -1);
3635 	if (fpid == 0) {
3636 		trace_me();
3637 		continue_thread_main();
3638 	}
3639 
3640 	/* The first wait() should report the stop from SIGSTOP. */
3641 	wpid = waitpid(fpid, &status, 0);
3642 	ATF_REQUIRE(wpid == fpid);
3643 	ATF_REQUIRE(WIFSTOPPED(status));
3644 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3645 
3646 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3647 	    sizeof(pl)) != -1);
3648 
3649 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
3650 
3651 	/* Continue the child ignoring the SIGSTOP. */
3652 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3653 
3654 	/* One of the new threads should report it's birth. */
3655 	wpid = waitpid(fpid, &status, 0);
3656 	ATF_REQUIRE(wpid == fpid);
3657 	ATF_REQUIRE(WIFSTOPPED(status));
3658 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3659 
3660 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3661 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3662 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3663 	lwps[0] = pl.pl_lwpid;
3664 
3665 	/*
3666 	 * Suspend this thread to ensure both threads are alive before
3667 	 * hitting the breakpoint.
3668 	 */
3669 	ATF_REQUIRE(ptrace(PT_SUSPEND, lwps[0], NULL, 0) != -1);
3670 
3671 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3672 
3673 	/* Second thread should report it's birth. */
3674 	wpid = waitpid(fpid, &status, 0);
3675 	ATF_REQUIRE(wpid == fpid);
3676 	ATF_REQUIRE(WIFSTOPPED(status));
3677 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3678 
3679 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3680 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3681 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3682 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
3683 	lwps[1] = pl.pl_lwpid;
3684 
3685 	/* Resume both threads waiting for breakpoint events. */
3686 	hit_break[0] = hit_break[1] = false;
3687 	ATF_REQUIRE(ptrace(PT_RESUME, lwps[0], NULL, 0) != -1);
3688 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3689 
3690 	/* One thread should report a breakpoint. */
3691 	wpid = waitpid(fpid, &status, 0);
3692 	ATF_REQUIRE(wpid == fpid);
3693 	ATF_REQUIRE(WIFSTOPPED(status));
3694 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3695 
3696 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3697 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3698 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3699 	    pl.pl_siginfo.si_code == TRAP_BRKPT);
3700 	if (pl.pl_lwpid == lwps[0])
3701 		i = 0;
3702 	else
3703 		i = 1;
3704 	hit_break[i] = true;
3705 	ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3706 	SKIP_BREAK(&reg);
3707 	ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3708 
3709 	/*
3710 	 * Resume both threads but pass the other thread's LWPID to
3711 	 * PT_CONTINUE.
3712 	 */
3713 	ATF_REQUIRE(ptrace(PT_CONTINUE, lwps[i ^ 1], (caddr_t)1, 0) == 0);
3714 
3715 	/*
3716 	 * Will now get two thread exit events and one more breakpoint
3717 	 * event.
3718 	 */
3719 	for (j = 0; j < 3; j++) {
3720 		wpid = waitpid(fpid, &status, 0);
3721 		ATF_REQUIRE(wpid == fpid);
3722 		ATF_REQUIRE(WIFSTOPPED(status));
3723 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3724 
3725 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3726 		    sizeof(pl)) != -1);
3727 
3728 		if (pl.pl_lwpid == lwps[0])
3729 			i = 0;
3730 		else
3731 			i = 1;
3732 
3733 		ATF_REQUIRE_MSG(lwps[i] != 0, "event for exited thread");
3734 		if (pl.pl_flags & PL_FLAG_EXITED) {
3735 			ATF_REQUIRE_MSG(hit_break[i],
3736 			    "exited thread did not report breakpoint");
3737 			lwps[i] = 0;
3738 		} else {
3739 			ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3740 			ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3741 			    pl.pl_siginfo.si_code == TRAP_BRKPT);
3742 			ATF_REQUIRE_MSG(!hit_break[i],
3743 			    "double breakpoint event");
3744 			hit_break[i] = true;
3745 			ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg,
3746 			    0) != -1);
3747 			SKIP_BREAK(&reg);
3748 			ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg,
3749 			    0) != -1);
3750 		}
3751 
3752 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3753 	}
3754 
3755 	/* Both threads should have exited. */
3756 	ATF_REQUIRE(lwps[0] == 0);
3757 	ATF_REQUIRE(lwps[1] == 0);
3758 
3759 	/* The last event should be for the child process's exit. */
3760 	wpid = waitpid(fpid, &status, 0);
3761 	ATF_REQUIRE(WIFEXITED(status));
3762 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3763 
3764 	wpid = wait(&status);
3765 	ATF_REQUIRE(wpid == -1);
3766 	ATF_REQUIRE(errno == ECHILD);
3767 }
3768 #endif
3769 
3770 ATF_TP_ADD_TCS(tp)
3771 {
3772 
3773 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
3774 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
3775 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
3776 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
3777 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
3778 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
3779 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
3780 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
3781 	ATF_TP_ADD_TC(tp,
3782 	    ptrace__follow_fork_child_detached_unrelated_debugger);
3783 	ATF_TP_ADD_TC(tp,
3784 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
3785 	ATF_TP_ADD_TC(tp, ptrace__getppid);
3786 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
3787 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
3788 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
3789 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
3790 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
3791 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
3792 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
3793 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
3794 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
3795 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
3796 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
3797 #ifdef HAVE_BREAKPOINT
3798 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
3799 #endif
3800 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
3801 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
3802 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
3803 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
3804 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
3805 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
3806 	ATF_TP_ADD_TC(tp,
3807 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
3808 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
3809 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
3810 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
3811 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
3812 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
3813 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
3814 	ATF_TP_ADD_TC(tp, ptrace__killed_with_sigmask);
3815 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigmask);
3816 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3817 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
3818 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
3819 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
3820 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
3821 	ATF_TP_ADD_TC(tp, ptrace__PT_STEP_with_signal);
3822 #ifdef HAVE_BREAKPOINT
3823 	ATF_TP_ADD_TC(tp, ptrace__breakpoint_siginfo);
3824 #endif
3825 	ATF_TP_ADD_TC(tp, ptrace__step_siginfo);
3826 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3827 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_different_thread);
3828 #endif
3829 
3830 	return (atf_no_error());
3831 }
3832