xref: /freebsd/tests/sys/kern/ptrace_test.c (revision e95923a2288fb2845c7be4822b1b92b2fc106d18)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD$");
28 
29 #include <sys/types.h>
30 #include <sys/cpuset.h>
31 #include <sys/event.h>
32 #include <sys/file.h>
33 #include <sys/time.h>
34 #include <sys/procctl.h>
35 #include <sys/ptrace.h>
36 #include <sys/queue.h>
37 #include <sys/runq.h>
38 #include <sys/syscall.h>
39 #include <sys/sysctl.h>
40 #include <sys/user.h>
41 #include <sys/wait.h>
42 #include <errno.h>
43 #include <machine/cpufunc.h>
44 #include <pthread.h>
45 #include <sched.h>
46 #include <semaphore.h>
47 #include <signal.h>
48 #include <stdio.h>
49 #include <stdlib.h>
50 #include <unistd.h>
51 #include <atf-c.h>
52 
53 /*
54  * Architectures with a user-visible breakpoint().
55  */
56 #if defined(__aarch64__) || defined(__amd64__) || defined(__arm__) ||	\
57     defined(__i386__) || defined(__mips__) || defined(__riscv) ||	\
58     defined(__sparc64__)
59 #define	HAVE_BREAKPOINT
60 #endif
61 
62 /*
63  * Adjust PC to skip over a breakpoint when stopped for a breakpoint trap.
64  */
65 #ifdef HAVE_BREAKPOINT
66 #if defined(__aarch64__)
67 #define	SKIP_BREAK(reg)	((reg)->elr += 4)
68 #elif defined(__amd64__) || defined(__i386__)
69 #define	SKIP_BREAK(reg)
70 #elif defined(__arm__)
71 #define	SKIP_BREAK(reg)	((reg)->r_pc += 4)
72 #elif defined(__mips__)
73 #define	SKIP_BREAK(reg)	((reg)->r_regs[PC] += 4)
74 #elif defined(__riscv)
75 #define	SKIP_BREAK(reg)	((reg)->sepc += 4)
76 #elif defined(__sparc64__)
77 #define	SKIP_BREAK(reg)	do {						\
78 	(reg)->r_tpc = (reg)->r_tnpc + 4;				\
79 	(reg)->r_tnpc += 8;						\
80 } while (0)
81 #endif
82 #endif
83 
84 /*
85  * A variant of ATF_REQUIRE that is suitable for use in child
86  * processes.  This only works if the parent process is tripped up by
87  * the early exit and fails some requirement itself.
88  */
89 #define	CHILD_REQUIRE(exp) do {						\
90 		if (!(exp))						\
91 			child_fail_require(__FILE__, __LINE__,		\
92 			    #exp " not met");				\
93 	} while (0)
94 
95 static __dead2 void
96 child_fail_require(const char *file, int line, const char *str)
97 {
98 	char buf[128];
99 
100 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
101 	write(2, buf, strlen(buf));
102 	_exit(32);
103 }
104 
105 static void
106 trace_me(void)
107 {
108 
109 	/* Attach the parent process as a tracer of this process. */
110 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
111 
112 	/* Trigger a stop. */
113 	raise(SIGSTOP);
114 }
115 
116 static void
117 attach_child(pid_t pid)
118 {
119 	pid_t wpid;
120 	int status;
121 
122 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
123 
124 	wpid = waitpid(pid, &status, 0);
125 	ATF_REQUIRE(wpid == pid);
126 	ATF_REQUIRE(WIFSTOPPED(status));
127 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
128 }
129 
130 static void
131 wait_for_zombie(pid_t pid)
132 {
133 
134 	/*
135 	 * Wait for a process to exit.  This is kind of gross, but
136 	 * there is not a better way.
137 	 *
138 	 * Prior to r325719, the kern.proc.pid.<pid> sysctl failed
139 	 * with ESRCH.  After that change, a valid struct kinfo_proc
140 	 * is returned for zombies with ki_stat set to SZOMB.
141 	 */
142 	for (;;) {
143 		struct kinfo_proc kp;
144 		size_t len;
145 		int mib[4];
146 
147 		mib[0] = CTL_KERN;
148 		mib[1] = KERN_PROC;
149 		mib[2] = KERN_PROC_PID;
150 		mib[3] = pid;
151 		len = sizeof(kp);
152 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
153 			ATF_REQUIRE(errno == ESRCH);
154 			break;
155 		}
156 		if (kp.ki_stat == SZOMB)
157 			break;
158 		usleep(5000);
159 	}
160 }
161 
162 /*
163  * Verify that a parent debugger process "sees" the exit of a debugged
164  * process exactly once when attached via PT_TRACE_ME.
165  */
166 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
167 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
168 {
169 	pid_t child, wpid;
170 	int status;
171 
172 	ATF_REQUIRE((child = fork()) != -1);
173 	if (child == 0) {
174 		/* Child process. */
175 		trace_me();
176 
177 		_exit(1);
178 	}
179 
180 	/* Parent process. */
181 
182 	/* The first wait() should report the stop from SIGSTOP. */
183 	wpid = waitpid(child, &status, 0);
184 	ATF_REQUIRE(wpid == child);
185 	ATF_REQUIRE(WIFSTOPPED(status));
186 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
187 
188 	/* Continue the child ignoring the SIGSTOP. */
189 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
190 
191 	/* The second wait() should report the exit status. */
192 	wpid = waitpid(child, &status, 0);
193 	ATF_REQUIRE(wpid == child);
194 	ATF_REQUIRE(WIFEXITED(status));
195 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
196 
197 	/* The child should no longer exist. */
198 	wpid = waitpid(child, &status, 0);
199 	ATF_REQUIRE(wpid == -1);
200 	ATF_REQUIRE(errno == ECHILD);
201 }
202 
203 /*
204  * Verify that a parent debugger process "sees" the exit of a debugged
205  * process exactly once when attached via PT_ATTACH.
206  */
207 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
208 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
209 {
210 	pid_t child, wpid;
211 	int cpipe[2], status;
212 	char c;
213 
214 	ATF_REQUIRE(pipe(cpipe) == 0);
215 	ATF_REQUIRE((child = fork()) != -1);
216 	if (child == 0) {
217 		/* Child process. */
218 		close(cpipe[0]);
219 
220 		/* Wait for the parent to attach. */
221 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
222 
223 		_exit(1);
224 	}
225 	close(cpipe[1]);
226 
227 	/* Parent process. */
228 
229 	/* Attach to the child process. */
230 	attach_child(child);
231 
232 	/* Continue the child ignoring the SIGSTOP. */
233 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
234 
235 	/* Signal the child to exit. */
236 	close(cpipe[0]);
237 
238 	/* The second wait() should report the exit status. */
239 	wpid = waitpid(child, &status, 0);
240 	ATF_REQUIRE(wpid == child);
241 	ATF_REQUIRE(WIFEXITED(status));
242 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
243 
244 	/* The child should no longer exist. */
245 	wpid = waitpid(child, &status, 0);
246 	ATF_REQUIRE(wpid == -1);
247 	ATF_REQUIRE(errno == ECHILD);
248 }
249 
250 /*
251  * Verify that a parent process "sees" the exit of a debugged process only
252  * after the debugger has seen it.
253  */
254 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
255 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
256 {
257 	pid_t child, debugger, wpid;
258 	int cpipe[2], dpipe[2], status;
259 	char c;
260 
261 	ATF_REQUIRE(pipe(cpipe) == 0);
262 	ATF_REQUIRE((child = fork()) != -1);
263 
264 	if (child == 0) {
265 		/* Child process. */
266 		close(cpipe[0]);
267 
268 		/* Wait for parent to be ready. */
269 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
270 
271 		_exit(1);
272 	}
273 	close(cpipe[1]);
274 
275 	ATF_REQUIRE(pipe(dpipe) == 0);
276 	ATF_REQUIRE((debugger = fork()) != -1);
277 
278 	if (debugger == 0) {
279 		/* Debugger process. */
280 		close(dpipe[0]);
281 
282 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
283 
284 		wpid = waitpid(child, &status, 0);
285 		CHILD_REQUIRE(wpid == child);
286 		CHILD_REQUIRE(WIFSTOPPED(status));
287 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
288 
289 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
290 
291 		/* Signal parent that debugger is attached. */
292 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
293 
294 		/* Wait for parent's failed wait. */
295 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
296 
297 		wpid = waitpid(child, &status, 0);
298 		CHILD_REQUIRE(wpid == child);
299 		CHILD_REQUIRE(WIFEXITED(status));
300 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
301 
302 		_exit(0);
303 	}
304 	close(dpipe[1]);
305 
306 	/* Parent process. */
307 
308 	/* Wait for the debugger to attach to the child. */
309 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
310 
311 	/* Release the child. */
312 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
313 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
314 	close(cpipe[0]);
315 
316 	wait_for_zombie(child);
317 
318 	/*
319 	 * This wait should return a pid of 0 to indicate no status to
320 	 * report.  The parent should see the child as non-exited
321 	 * until the debugger sees the exit.
322 	 */
323 	wpid = waitpid(child, &status, WNOHANG);
324 	ATF_REQUIRE(wpid == 0);
325 
326 	/* Signal the debugger to wait for the child. */
327 	close(dpipe[0]);
328 
329 	/* Wait for the debugger. */
330 	wpid = waitpid(debugger, &status, 0);
331 	ATF_REQUIRE(wpid == debugger);
332 	ATF_REQUIRE(WIFEXITED(status));
333 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
334 
335 	/* The child process should now be ready. */
336 	wpid = waitpid(child, &status, WNOHANG);
337 	ATF_REQUIRE(wpid == child);
338 	ATF_REQUIRE(WIFEXITED(status));
339 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
340 }
341 
342 /*
343  * Verify that a parent process "sees" the exit of a debugged process
344  * only after a non-direct-child debugger has seen it.  In particular,
345  * various wait() calls in the parent must avoid failing with ESRCH by
346  * checking the parent's orphan list for the debugee.
347  */
348 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
349 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
350 {
351 	pid_t child, debugger, fpid, wpid;
352 	int cpipe[2], dpipe[2], status;
353 	char c;
354 
355 	ATF_REQUIRE(pipe(cpipe) == 0);
356 	ATF_REQUIRE((child = fork()) != -1);
357 
358 	if (child == 0) {
359 		/* Child process. */
360 		close(cpipe[0]);
361 
362 		/* Wait for parent to be ready. */
363 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
364 
365 		_exit(1);
366 	}
367 	close(cpipe[1]);
368 
369 	ATF_REQUIRE(pipe(dpipe) == 0);
370 	ATF_REQUIRE((debugger = fork()) != -1);
371 
372 	if (debugger == 0) {
373 		/* Debugger parent. */
374 
375 		/*
376 		 * Fork again and drop the debugger parent so that the
377 		 * debugger is not a child of the main parent.
378 		 */
379 		CHILD_REQUIRE((fpid = fork()) != -1);
380 		if (fpid != 0)
381 			_exit(2);
382 
383 		/* Debugger process. */
384 		close(dpipe[0]);
385 
386 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
387 
388 		wpid = waitpid(child, &status, 0);
389 		CHILD_REQUIRE(wpid == child);
390 		CHILD_REQUIRE(WIFSTOPPED(status));
391 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
392 
393 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
394 
395 		/* Signal parent that debugger is attached. */
396 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
397 
398 		/* Wait for parent's failed wait. */
399 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
400 
401 		wpid = waitpid(child, &status, 0);
402 		CHILD_REQUIRE(wpid == child);
403 		CHILD_REQUIRE(WIFEXITED(status));
404 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
405 
406 		_exit(0);
407 	}
408 	close(dpipe[1]);
409 
410 	/* Parent process. */
411 
412 	/* Wait for the debugger parent process to exit. */
413 	wpid = waitpid(debugger, &status, 0);
414 	ATF_REQUIRE(wpid == debugger);
415 	ATF_REQUIRE(WIFEXITED(status));
416 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
417 
418 	/* A WNOHANG wait here should see the non-exited child. */
419 	wpid = waitpid(child, &status, WNOHANG);
420 	ATF_REQUIRE(wpid == 0);
421 
422 	/* Wait for the debugger to attach to the child. */
423 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
424 
425 	/* Release the child. */
426 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
427 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
428 	close(cpipe[0]);
429 
430 	wait_for_zombie(child);
431 
432 	/*
433 	 * This wait should return a pid of 0 to indicate no status to
434 	 * report.  The parent should see the child as non-exited
435 	 * until the debugger sees the exit.
436 	 */
437 	wpid = waitpid(child, &status, WNOHANG);
438 	ATF_REQUIRE(wpid == 0);
439 
440 	/* Signal the debugger to wait for the child. */
441 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
442 
443 	/* Wait for the debugger. */
444 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
445 	close(dpipe[0]);
446 
447 	/* The child process should now be ready. */
448 	wpid = waitpid(child, &status, WNOHANG);
449 	ATF_REQUIRE(wpid == child);
450 	ATF_REQUIRE(WIFEXITED(status));
451 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
452 }
453 
454 /*
455  * The parent process should always act the same regardless of how the
456  * debugger is attached to it.
457  */
458 static __dead2 void
459 follow_fork_parent(bool use_vfork)
460 {
461 	pid_t fpid, wpid;
462 	int status;
463 
464 	if (use_vfork)
465 		CHILD_REQUIRE((fpid = vfork()) != -1);
466 	else
467 		CHILD_REQUIRE((fpid = fork()) != -1);
468 
469 	if (fpid == 0)
470 		/* Child */
471 		_exit(2);
472 
473 	wpid = waitpid(fpid, &status, 0);
474 	CHILD_REQUIRE(wpid == fpid);
475 	CHILD_REQUIRE(WIFEXITED(status));
476 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
477 
478 	_exit(1);
479 }
480 
481 /*
482  * Helper routine for follow fork tests.  This waits for two stops
483  * that report both "sides" of a fork.  It returns the pid of the new
484  * child process.
485  */
486 static pid_t
487 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
488 {
489 	struct ptrace_lwpinfo pl;
490 	bool fork_reported[2];
491 	pid_t child, wpid;
492 	int i, status;
493 
494 	fork_reported[0] = false;
495 	fork_reported[1] = false;
496 	child = -1;
497 
498 	/*
499 	 * Each process should report a fork event.  The parent should
500 	 * report a PL_FLAG_FORKED event, and the child should report
501 	 * a PL_FLAG_CHILD event.
502 	 */
503 	for (i = 0; i < 2; i++) {
504 		wpid = wait(&status);
505 		ATF_REQUIRE(wpid > 0);
506 		ATF_REQUIRE(WIFSTOPPED(status));
507 
508 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
509 		    sizeof(pl)) != -1);
510 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
511 		    0);
512 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
513 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
514 		if (pl.pl_flags & PL_FLAG_CHILD) {
515 			ATF_REQUIRE(wpid != parent);
516 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
517 			ATF_REQUIRE(!fork_reported[1]);
518 			if (child == -1)
519 				child = wpid;
520 			else
521 				ATF_REQUIRE(child == wpid);
522 			if (ppl != NULL)
523 				ppl[1] = pl;
524 			fork_reported[1] = true;
525 		} else {
526 			ATF_REQUIRE(wpid == parent);
527 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
528 			ATF_REQUIRE(!fork_reported[0]);
529 			if (child == -1)
530 				child = pl.pl_child_pid;
531 			else
532 				ATF_REQUIRE(child == pl.pl_child_pid);
533 			if (ppl != NULL)
534 				ppl[0] = pl;
535 			fork_reported[0] = true;
536 		}
537 	}
538 
539 	return (child);
540 }
541 
542 /*
543  * Verify that a new child process is stopped after a followed fork and
544  * that the traced parent sees the exit of the child after the debugger
545  * when both processes remain attached to the debugger.
546  */
547 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
548 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
549 {
550 	pid_t children[2], fpid, wpid;
551 	int status;
552 
553 	ATF_REQUIRE((fpid = fork()) != -1);
554 	if (fpid == 0) {
555 		trace_me();
556 		follow_fork_parent(false);
557 	}
558 
559 	/* Parent process. */
560 	children[0] = fpid;
561 
562 	/* The first wait() should report the stop from SIGSTOP. */
563 	wpid = waitpid(children[0], &status, 0);
564 	ATF_REQUIRE(wpid == children[0]);
565 	ATF_REQUIRE(WIFSTOPPED(status));
566 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
567 
568 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
569 
570 	/* Continue the child ignoring the SIGSTOP. */
571 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
572 
573 	children[1] = handle_fork_events(children[0], NULL);
574 	ATF_REQUIRE(children[1] > 0);
575 
576 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
577 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
578 
579 	/*
580 	 * The child can't exit until the grandchild reports status, so the
581 	 * grandchild should report its exit first to the debugger.
582 	 */
583 	wpid = wait(&status);
584 	ATF_REQUIRE(wpid == children[1]);
585 	ATF_REQUIRE(WIFEXITED(status));
586 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
587 
588 	wpid = wait(&status);
589 	ATF_REQUIRE(wpid == children[0]);
590 	ATF_REQUIRE(WIFEXITED(status));
591 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
592 
593 	wpid = wait(&status);
594 	ATF_REQUIRE(wpid == -1);
595 	ATF_REQUIRE(errno == ECHILD);
596 }
597 
598 /*
599  * Verify that a new child process is stopped after a followed fork
600  * and that the traced parent sees the exit of the child when the new
601  * child process is detached after it reports its fork.
602  */
603 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
604 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
605 {
606 	pid_t children[2], fpid, wpid;
607 	int status;
608 
609 	ATF_REQUIRE((fpid = fork()) != -1);
610 	if (fpid == 0) {
611 		trace_me();
612 		follow_fork_parent(false);
613 	}
614 
615 	/* Parent process. */
616 	children[0] = fpid;
617 
618 	/* The first wait() should report the stop from SIGSTOP. */
619 	wpid = waitpid(children[0], &status, 0);
620 	ATF_REQUIRE(wpid == children[0]);
621 	ATF_REQUIRE(WIFSTOPPED(status));
622 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
623 
624 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
625 
626 	/* Continue the child ignoring the SIGSTOP. */
627 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
628 
629 	children[1] = handle_fork_events(children[0], NULL);
630 	ATF_REQUIRE(children[1] > 0);
631 
632 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
633 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
634 
635 	/*
636 	 * Should not see any status from the grandchild now, only the
637 	 * child.
638 	 */
639 	wpid = wait(&status);
640 	ATF_REQUIRE(wpid == children[0]);
641 	ATF_REQUIRE(WIFEXITED(status));
642 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
643 
644 	wpid = wait(&status);
645 	ATF_REQUIRE(wpid == -1);
646 	ATF_REQUIRE(errno == ECHILD);
647 }
648 
649 /*
650  * Verify that a new child process is stopped after a followed fork
651  * and that the traced parent sees the exit of the child when the
652  * traced parent is detached after the fork.
653  */
654 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
655 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
656 {
657 	pid_t children[2], fpid, wpid;
658 	int status;
659 
660 	ATF_REQUIRE((fpid = fork()) != -1);
661 	if (fpid == 0) {
662 		trace_me();
663 		follow_fork_parent(false);
664 	}
665 
666 	/* Parent process. */
667 	children[0] = fpid;
668 
669 	/* The first wait() should report the stop from SIGSTOP. */
670 	wpid = waitpid(children[0], &status, 0);
671 	ATF_REQUIRE(wpid == children[0]);
672 	ATF_REQUIRE(WIFSTOPPED(status));
673 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
674 
675 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
676 
677 	/* Continue the child ignoring the SIGSTOP. */
678 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
679 
680 	children[1] = handle_fork_events(children[0], NULL);
681 	ATF_REQUIRE(children[1] > 0);
682 
683 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
684 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
685 
686 	/*
687 	 * The child can't exit until the grandchild reports status, so the
688 	 * grandchild should report its exit first to the debugger.
689 	 *
690 	 * Even though the child process is detached, it is still a
691 	 * child of the debugger, so it will still report it's exit
692 	 * after the grandchild.
693 	 */
694 	wpid = wait(&status);
695 	ATF_REQUIRE(wpid == children[1]);
696 	ATF_REQUIRE(WIFEXITED(status));
697 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
698 
699 	wpid = wait(&status);
700 	ATF_REQUIRE(wpid == children[0]);
701 	ATF_REQUIRE(WIFEXITED(status));
702 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
703 
704 	wpid = wait(&status);
705 	ATF_REQUIRE(wpid == -1);
706 	ATF_REQUIRE(errno == ECHILD);
707 }
708 
709 static void
710 attach_fork_parent(int cpipe[2])
711 {
712 	pid_t fpid;
713 
714 	close(cpipe[0]);
715 
716 	/* Double-fork to disassociate from the debugger. */
717 	CHILD_REQUIRE((fpid = fork()) != -1);
718 	if (fpid != 0)
719 		_exit(3);
720 
721 	/* Send the pid of the disassociated child to the debugger. */
722 	fpid = getpid();
723 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
724 
725 	/* Wait for the debugger to attach. */
726 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
727 }
728 
729 /*
730  * Verify that a new child process is stopped after a followed fork and
731  * that the traced parent sees the exit of the child after the debugger
732  * when both processes remain attached to the debugger.  In this test
733  * the parent that forks is not a direct child of the debugger.
734  */
735 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
736 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
737 {
738 	pid_t children[2], fpid, wpid;
739 	int cpipe[2], status;
740 
741 	ATF_REQUIRE(pipe(cpipe) == 0);
742 	ATF_REQUIRE((fpid = fork()) != -1);
743 	if (fpid == 0) {
744 		attach_fork_parent(cpipe);
745 		follow_fork_parent(false);
746 	}
747 
748 	/* Parent process. */
749 	close(cpipe[1]);
750 
751 	/* Wait for the direct child to exit. */
752 	wpid = waitpid(fpid, &status, 0);
753 	ATF_REQUIRE(wpid == fpid);
754 	ATF_REQUIRE(WIFEXITED(status));
755 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
756 
757 	/* Read the pid of the fork parent. */
758 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
759 	    sizeof(children[0]));
760 
761 	/* Attach to the fork parent. */
762 	attach_child(children[0]);
763 
764 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
765 
766 	/* Continue the fork parent ignoring the SIGSTOP. */
767 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
768 
769 	/* Signal the fork parent to continue. */
770 	close(cpipe[0]);
771 
772 	children[1] = handle_fork_events(children[0], NULL);
773 	ATF_REQUIRE(children[1] > 0);
774 
775 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
776 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
777 
778 	/*
779 	 * The fork parent can't exit until the child reports status,
780 	 * so the child should report its exit first to the debugger.
781 	 */
782 	wpid = wait(&status);
783 	ATF_REQUIRE(wpid == children[1]);
784 	ATF_REQUIRE(WIFEXITED(status));
785 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
786 
787 	wpid = wait(&status);
788 	ATF_REQUIRE(wpid == children[0]);
789 	ATF_REQUIRE(WIFEXITED(status));
790 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
791 
792 	wpid = wait(&status);
793 	ATF_REQUIRE(wpid == -1);
794 	ATF_REQUIRE(errno == ECHILD);
795 }
796 
797 /*
798  * Verify that a new child process is stopped after a followed fork
799  * and that the traced parent sees the exit of the child when the new
800  * child process is detached after it reports its fork.  In this test
801  * the parent that forks is not a direct child of the debugger.
802  */
803 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
804 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
805 {
806 	pid_t children[2], fpid, wpid;
807 	int cpipe[2], status;
808 
809 	ATF_REQUIRE(pipe(cpipe) == 0);
810 	ATF_REQUIRE((fpid = fork()) != -1);
811 	if (fpid == 0) {
812 		attach_fork_parent(cpipe);
813 		follow_fork_parent(false);
814 	}
815 
816 	/* Parent process. */
817 	close(cpipe[1]);
818 
819 	/* Wait for the direct child to exit. */
820 	wpid = waitpid(fpid, &status, 0);
821 	ATF_REQUIRE(wpid == fpid);
822 	ATF_REQUIRE(WIFEXITED(status));
823 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
824 
825 	/* Read the pid of the fork parent. */
826 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
827 	    sizeof(children[0]));
828 
829 	/* Attach to the fork parent. */
830 	attach_child(children[0]);
831 
832 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
833 
834 	/* Continue the fork parent ignoring the SIGSTOP. */
835 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
836 
837 	/* Signal the fork parent to continue. */
838 	close(cpipe[0]);
839 
840 	children[1] = handle_fork_events(children[0], NULL);
841 	ATF_REQUIRE(children[1] > 0);
842 
843 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
844 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
845 
846 	/*
847 	 * Should not see any status from the child now, only the fork
848 	 * parent.
849 	 */
850 	wpid = wait(&status);
851 	ATF_REQUIRE(wpid == children[0]);
852 	ATF_REQUIRE(WIFEXITED(status));
853 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
854 
855 	wpid = wait(&status);
856 	ATF_REQUIRE(wpid == -1);
857 	ATF_REQUIRE(errno == ECHILD);
858 }
859 
860 /*
861  * Verify that a new child process is stopped after a followed fork
862  * and that the traced parent sees the exit of the child when the
863  * traced parent is detached after the fork.  In this test the parent
864  * that forks is not a direct child of the debugger.
865  */
866 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
867 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
868 {
869 	pid_t children[2], fpid, wpid;
870 	int cpipe[2], status;
871 
872 	ATF_REQUIRE(pipe(cpipe) == 0);
873 	ATF_REQUIRE((fpid = fork()) != -1);
874 	if (fpid == 0) {
875 		attach_fork_parent(cpipe);
876 		follow_fork_parent(false);
877 	}
878 
879 	/* Parent process. */
880 	close(cpipe[1]);
881 
882 	/* Wait for the direct child to exit. */
883 	wpid = waitpid(fpid, &status, 0);
884 	ATF_REQUIRE(wpid == fpid);
885 	ATF_REQUIRE(WIFEXITED(status));
886 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
887 
888 	/* Read the pid of the fork parent. */
889 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
890 	    sizeof(children[0]));
891 
892 	/* Attach to the fork parent. */
893 	attach_child(children[0]);
894 
895 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
896 
897 	/* Continue the fork parent ignoring the SIGSTOP. */
898 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
899 
900 	/* Signal the fork parent to continue. */
901 	close(cpipe[0]);
902 
903 	children[1] = handle_fork_events(children[0], NULL);
904 	ATF_REQUIRE(children[1] > 0);
905 
906 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
907 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
908 
909 	/*
910 	 * Should not see any status from the fork parent now, only
911 	 * the child.
912 	 */
913 	wpid = wait(&status);
914 	ATF_REQUIRE(wpid == children[1]);
915 	ATF_REQUIRE(WIFEXITED(status));
916 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
917 
918 	wpid = wait(&status);
919 	ATF_REQUIRE(wpid == -1);
920 	ATF_REQUIRE(errno == ECHILD);
921 }
922 
923 /*
924  * Verify that a child process does not see an unrelated debugger as its
925  * parent but sees its original parent process.
926  */
927 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
928 ATF_TC_BODY(ptrace__getppid, tc)
929 {
930 	pid_t child, debugger, ppid, wpid;
931 	int cpipe[2], dpipe[2], status;
932 	char c;
933 
934 	ATF_REQUIRE(pipe(cpipe) == 0);
935 	ATF_REQUIRE((child = fork()) != -1);
936 
937 	if (child == 0) {
938 		/* Child process. */
939 		close(cpipe[0]);
940 
941 		/* Wait for parent to be ready. */
942 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
943 
944 		/* Report the parent PID to the parent. */
945 		ppid = getppid();
946 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
947 		    sizeof(ppid));
948 
949 		_exit(1);
950 	}
951 	close(cpipe[1]);
952 
953 	ATF_REQUIRE(pipe(dpipe) == 0);
954 	ATF_REQUIRE((debugger = fork()) != -1);
955 
956 	if (debugger == 0) {
957 		/* Debugger process. */
958 		close(dpipe[0]);
959 
960 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
961 
962 		wpid = waitpid(child, &status, 0);
963 		CHILD_REQUIRE(wpid == child);
964 		CHILD_REQUIRE(WIFSTOPPED(status));
965 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
966 
967 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
968 
969 		/* Signal parent that debugger is attached. */
970 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
971 
972 		/* Wait for traced child to exit. */
973 		wpid = waitpid(child, &status, 0);
974 		CHILD_REQUIRE(wpid == child);
975 		CHILD_REQUIRE(WIFEXITED(status));
976 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
977 
978 		_exit(0);
979 	}
980 	close(dpipe[1]);
981 
982 	/* Parent process. */
983 
984 	/* Wait for the debugger to attach to the child. */
985 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
986 
987 	/* Release the child. */
988 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
989 
990 	/* Read the parent PID from the child. */
991 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
992 	close(cpipe[0]);
993 
994 	ATF_REQUIRE(ppid == getpid());
995 
996 	/* Wait for the debugger. */
997 	wpid = waitpid(debugger, &status, 0);
998 	ATF_REQUIRE(wpid == debugger);
999 	ATF_REQUIRE(WIFEXITED(status));
1000 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1001 
1002 	/* The child process should now be ready. */
1003 	wpid = waitpid(child, &status, WNOHANG);
1004 	ATF_REQUIRE(wpid == child);
1005 	ATF_REQUIRE(WIFEXITED(status));
1006 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1007 }
1008 
1009 /*
1010  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1011  * child process created via fork() reports the correct value.
1012  */
1013 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
1014 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
1015 {
1016 	struct ptrace_lwpinfo pl[2];
1017 	pid_t children[2], fpid, wpid;
1018 	int status;
1019 
1020 	ATF_REQUIRE((fpid = fork()) != -1);
1021 	if (fpid == 0) {
1022 		trace_me();
1023 		follow_fork_parent(false);
1024 	}
1025 
1026 	/* Parent process. */
1027 	children[0] = fpid;
1028 
1029 	/* The first wait() should report the stop from SIGSTOP. */
1030 	wpid = waitpid(children[0], &status, 0);
1031 	ATF_REQUIRE(wpid == children[0]);
1032 	ATF_REQUIRE(WIFSTOPPED(status));
1033 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1034 
1035 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1036 
1037 	/* Continue the child ignoring the SIGSTOP. */
1038 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1039 
1040 	/* Wait for both halves of the fork event to get reported. */
1041 	children[1] = handle_fork_events(children[0], pl);
1042 	ATF_REQUIRE(children[1] > 0);
1043 
1044 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1045 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1046 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1047 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1048 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1049 
1050 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1051 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1052 
1053 	/*
1054 	 * The child can't exit until the grandchild reports status, so the
1055 	 * grandchild should report its exit first to the debugger.
1056 	 */
1057 	wpid = wait(&status);
1058 	ATF_REQUIRE(wpid == children[1]);
1059 	ATF_REQUIRE(WIFEXITED(status));
1060 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1061 
1062 	wpid = wait(&status);
1063 	ATF_REQUIRE(wpid == children[0]);
1064 	ATF_REQUIRE(WIFEXITED(status));
1065 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1066 
1067 	wpid = wait(&status);
1068 	ATF_REQUIRE(wpid == -1);
1069 	ATF_REQUIRE(errno == ECHILD);
1070 }
1071 
1072 /*
1073  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1074  * child process created via vfork() reports the correct value.
1075  */
1076 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1077 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1078 {
1079 	struct ptrace_lwpinfo pl[2];
1080 	pid_t children[2], fpid, wpid;
1081 	int status;
1082 
1083 	ATF_REQUIRE((fpid = fork()) != -1);
1084 	if (fpid == 0) {
1085 		trace_me();
1086 		follow_fork_parent(true);
1087 	}
1088 
1089 	/* Parent process. */
1090 	children[0] = fpid;
1091 
1092 	/* The first wait() should report the stop from SIGSTOP. */
1093 	wpid = waitpid(children[0], &status, 0);
1094 	ATF_REQUIRE(wpid == children[0]);
1095 	ATF_REQUIRE(WIFSTOPPED(status));
1096 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1097 
1098 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1099 
1100 	/* Continue the child ignoring the SIGSTOP. */
1101 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1102 
1103 	/* Wait for both halves of the fork event to get reported. */
1104 	children[1] = handle_fork_events(children[0], pl);
1105 	ATF_REQUIRE(children[1] > 0);
1106 
1107 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1108 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1109 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1110 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1111 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1112 
1113 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1114 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1115 
1116 	/*
1117 	 * The child can't exit until the grandchild reports status, so the
1118 	 * grandchild should report its exit first to the debugger.
1119 	 */
1120 	wpid = wait(&status);
1121 	ATF_REQUIRE(wpid == children[1]);
1122 	ATF_REQUIRE(WIFEXITED(status));
1123 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1124 
1125 	wpid = wait(&status);
1126 	ATF_REQUIRE(wpid == children[0]);
1127 	ATF_REQUIRE(WIFEXITED(status));
1128 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1129 
1130 	wpid = wait(&status);
1131 	ATF_REQUIRE(wpid == -1);
1132 	ATF_REQUIRE(errno == ECHILD);
1133 }
1134 
1135 static void *
1136 simple_thread(void *arg __unused)
1137 {
1138 
1139 	pthread_exit(NULL);
1140 }
1141 
1142 static __dead2 void
1143 simple_thread_main(void)
1144 {
1145 	pthread_t thread;
1146 
1147 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1148 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1149 	exit(1);
1150 }
1151 
1152 /*
1153  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1154  * thread reports the correct value.
1155  */
1156 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1157 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1158 {
1159 	struct ptrace_lwpinfo pl;
1160 	pid_t fpid, wpid;
1161 	lwpid_t mainlwp;
1162 	int status;
1163 
1164 	ATF_REQUIRE((fpid = fork()) != -1);
1165 	if (fpid == 0) {
1166 		trace_me();
1167 		simple_thread_main();
1168 	}
1169 
1170 	/* The first wait() should report the stop from SIGSTOP. */
1171 	wpid = waitpid(fpid, &status, 0);
1172 	ATF_REQUIRE(wpid == fpid);
1173 	ATF_REQUIRE(WIFSTOPPED(status));
1174 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1175 
1176 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1177 	    sizeof(pl)) != -1);
1178 	mainlwp = pl.pl_lwpid;
1179 
1180 	/*
1181 	 * Continue the child ignoring the SIGSTOP and tracing all
1182 	 * system call exits.
1183 	 */
1184 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1185 
1186 	/*
1187 	 * Wait for the new thread to arrive.  pthread_create() might
1188 	 * invoke any number of system calls.  For now we just wait
1189 	 * for the new thread to arrive and make sure it reports a
1190 	 * valid system call code.  If ptrace grows thread event
1191 	 * reporting then this test can be made more precise.
1192 	 */
1193 	for (;;) {
1194 		wpid = waitpid(fpid, &status, 0);
1195 		ATF_REQUIRE(wpid == fpid);
1196 		ATF_REQUIRE(WIFSTOPPED(status));
1197 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1198 
1199 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1200 		    sizeof(pl)) != -1);
1201 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1202 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1203 		if (pl.pl_lwpid != mainlwp)
1204 			/* New thread seen. */
1205 			break;
1206 
1207 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1208 	}
1209 
1210 	/* Wait for the child to exit. */
1211 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1212 	for (;;) {
1213 		wpid = waitpid(fpid, &status, 0);
1214 		ATF_REQUIRE(wpid == fpid);
1215 		if (WIFEXITED(status))
1216 			break;
1217 
1218 		ATF_REQUIRE(WIFSTOPPED(status));
1219 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1220 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1221 	}
1222 
1223 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1224 
1225 	wpid = wait(&status);
1226 	ATF_REQUIRE(wpid == -1);
1227 	ATF_REQUIRE(errno == ECHILD);
1228 }
1229 
1230 /*
1231  * Verify that the expected LWP events are reported for a child thread.
1232  */
1233 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1234 ATF_TC_BODY(ptrace__lwp_events, tc)
1235 {
1236 	struct ptrace_lwpinfo pl;
1237 	pid_t fpid, wpid;
1238 	lwpid_t lwps[2];
1239 	int status;
1240 
1241 	ATF_REQUIRE((fpid = fork()) != -1);
1242 	if (fpid == 0) {
1243 		trace_me();
1244 		simple_thread_main();
1245 	}
1246 
1247 	/* The first wait() should report the stop from SIGSTOP. */
1248 	wpid = waitpid(fpid, &status, 0);
1249 	ATF_REQUIRE(wpid == fpid);
1250 	ATF_REQUIRE(WIFSTOPPED(status));
1251 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1252 
1253 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1254 	    sizeof(pl)) != -1);
1255 	lwps[0] = pl.pl_lwpid;
1256 
1257 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1258 
1259 	/* Continue the child ignoring the SIGSTOP. */
1260 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1261 
1262 	/* The first event should be for the child thread's birth. */
1263 	wpid = waitpid(fpid, &status, 0);
1264 	ATF_REQUIRE(wpid == fpid);
1265 	ATF_REQUIRE(WIFSTOPPED(status));
1266 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1267 
1268 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1269 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1270 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1271 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1272 	lwps[1] = pl.pl_lwpid;
1273 
1274 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1275 
1276 	/* The next event should be for the child thread's death. */
1277 	wpid = waitpid(fpid, &status, 0);
1278 	ATF_REQUIRE(wpid == fpid);
1279 	ATF_REQUIRE(WIFSTOPPED(status));
1280 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1281 
1282 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1283 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1284 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1285 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1286 
1287 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1288 
1289 	/* The last event should be for the child process's exit. */
1290 	wpid = waitpid(fpid, &status, 0);
1291 	ATF_REQUIRE(WIFEXITED(status));
1292 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1293 
1294 	wpid = wait(&status);
1295 	ATF_REQUIRE(wpid == -1);
1296 	ATF_REQUIRE(errno == ECHILD);
1297 }
1298 
1299 static void *
1300 exec_thread(void *arg __unused)
1301 {
1302 
1303 	execl("/usr/bin/true", "true", NULL);
1304 	exit(127);
1305 }
1306 
1307 static __dead2 void
1308 exec_thread_main(void)
1309 {
1310 	pthread_t thread;
1311 
1312 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1313 	for (;;)
1314 		sleep(60);
1315 	exit(1);
1316 }
1317 
1318 /*
1319  * Verify that the expected LWP events are reported for a multithreaded
1320  * process that calls execve(2).
1321  */
1322 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1323 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1324 {
1325 	struct ptrace_lwpinfo pl;
1326 	pid_t fpid, wpid;
1327 	lwpid_t lwps[2];
1328 	int status;
1329 
1330 	ATF_REQUIRE((fpid = fork()) != -1);
1331 	if (fpid == 0) {
1332 		trace_me();
1333 		exec_thread_main();
1334 	}
1335 
1336 	/* The first wait() should report the stop from SIGSTOP. */
1337 	wpid = waitpid(fpid, &status, 0);
1338 	ATF_REQUIRE(wpid == fpid);
1339 	ATF_REQUIRE(WIFSTOPPED(status));
1340 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1341 
1342 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1343 	    sizeof(pl)) != -1);
1344 	lwps[0] = pl.pl_lwpid;
1345 
1346 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1347 
1348 	/* Continue the child ignoring the SIGSTOP. */
1349 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1350 
1351 	/* The first event should be for the child thread's birth. */
1352 	wpid = waitpid(fpid, &status, 0);
1353 	ATF_REQUIRE(wpid == fpid);
1354 	ATF_REQUIRE(WIFSTOPPED(status));
1355 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1356 
1357 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1358 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1359 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1360 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1361 	lwps[1] = pl.pl_lwpid;
1362 
1363 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1364 
1365 	/*
1366 	 * The next event should be for the main thread's death due to
1367 	 * single threading from execve().
1368 	 */
1369 	wpid = waitpid(fpid, &status, 0);
1370 	ATF_REQUIRE(wpid == fpid);
1371 	ATF_REQUIRE(WIFSTOPPED(status));
1372 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1373 
1374 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1375 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1376 	    (PL_FLAG_EXITED));
1377 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1378 
1379 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1380 
1381 	/* The next event should be for the child process's exec. */
1382 	wpid = waitpid(fpid, &status, 0);
1383 	ATF_REQUIRE(WIFSTOPPED(status));
1384 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1385 
1386 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1387 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1388 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1389 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1390 
1391 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1392 
1393 	/* The last event should be for the child process's exit. */
1394 	wpid = waitpid(fpid, &status, 0);
1395 	ATF_REQUIRE(WIFEXITED(status));
1396 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1397 
1398 	wpid = wait(&status);
1399 	ATF_REQUIRE(wpid == -1);
1400 	ATF_REQUIRE(errno == ECHILD);
1401 }
1402 
1403 static void
1404 handler(int sig __unused)
1405 {
1406 }
1407 
1408 static void
1409 signal_main(void)
1410 {
1411 
1412 	signal(SIGINFO, handler);
1413 	raise(SIGINFO);
1414 	exit(0);
1415 }
1416 
1417 /*
1418  * Verify that the expected ptrace event is reported for a signal.
1419  */
1420 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1421 ATF_TC_BODY(ptrace__siginfo, tc)
1422 {
1423 	struct ptrace_lwpinfo pl;
1424 	pid_t fpid, wpid;
1425 	int status;
1426 
1427 	ATF_REQUIRE((fpid = fork()) != -1);
1428 	if (fpid == 0) {
1429 		trace_me();
1430 		signal_main();
1431 	}
1432 
1433 	/* The first wait() should report the stop from SIGSTOP. */
1434 	wpid = waitpid(fpid, &status, 0);
1435 	ATF_REQUIRE(wpid == fpid);
1436 	ATF_REQUIRE(WIFSTOPPED(status));
1437 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1438 
1439 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1440 
1441 	/* The next event should be for the SIGINFO. */
1442 	wpid = waitpid(fpid, &status, 0);
1443 	ATF_REQUIRE(WIFSTOPPED(status));
1444 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1445 
1446 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1447 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1448 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1449 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1450 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1451 
1452 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1453 
1454 	/* The last event should be for the child process's exit. */
1455 	wpid = waitpid(fpid, &status, 0);
1456 	ATF_REQUIRE(WIFEXITED(status));
1457 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1458 
1459 	wpid = wait(&status);
1460 	ATF_REQUIRE(wpid == -1);
1461 	ATF_REQUIRE(errno == ECHILD);
1462 }
1463 
1464 /*
1465  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1466  */
1467 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1468 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1469 {
1470 	pid_t fpid, wpid;
1471 	int events, status;
1472 
1473 	ATF_REQUIRE((fpid = fork()) != -1);
1474 	if (fpid == 0) {
1475 		trace_me();
1476 		exec_thread(NULL);
1477 	}
1478 
1479 	/* The first wait() should report the stop from SIGSTOP. */
1480 	wpid = waitpid(fpid, &status, 0);
1481 	ATF_REQUIRE(wpid == fpid);
1482 	ATF_REQUIRE(WIFSTOPPED(status));
1483 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1484 
1485 	events = 0;
1486 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1487 	    sizeof(events)) == 0);
1488 
1489 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1490 
1491 	/* Should get one event at exit. */
1492 	wpid = waitpid(fpid, &status, 0);
1493 	ATF_REQUIRE(WIFEXITED(status));
1494 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1495 
1496 	wpid = wait(&status);
1497 	ATF_REQUIRE(wpid == -1);
1498 	ATF_REQUIRE(errno == ECHILD);
1499 }
1500 
1501 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1502 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1503 {
1504 	struct ptrace_lwpinfo pl;
1505 	pid_t fpid, wpid;
1506 	int events, status;
1507 
1508 	ATF_REQUIRE((fpid = fork()) != -1);
1509 	if (fpid == 0) {
1510 		trace_me();
1511 		exec_thread(NULL);
1512 	}
1513 
1514 	/* The first wait() should report the stop from SIGSTOP. */
1515 	wpid = waitpid(fpid, &status, 0);
1516 	ATF_REQUIRE(wpid == fpid);
1517 	ATF_REQUIRE(WIFSTOPPED(status));
1518 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1519 
1520 	events = PTRACE_EXEC;
1521 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1522 	    sizeof(events)) == 0);
1523 
1524 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1525 
1526 	/* The next event should be for the child process's exec. */
1527 	wpid = waitpid(fpid, &status, 0);
1528 	ATF_REQUIRE(WIFSTOPPED(status));
1529 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1530 
1531 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1532 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1533 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1534 
1535 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1536 
1537 	/* The last event should be for the child process's exit. */
1538 	wpid = waitpid(fpid, &status, 0);
1539 	ATF_REQUIRE(WIFEXITED(status));
1540 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1541 
1542 	wpid = wait(&status);
1543 	ATF_REQUIRE(wpid == -1);
1544 	ATF_REQUIRE(errno == ECHILD);
1545 }
1546 
1547 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1548 ATF_TC_BODY(ptrace__event_mask, tc)
1549 {
1550 	pid_t fpid, wpid;
1551 	int events, status;
1552 
1553 	ATF_REQUIRE((fpid = fork()) != -1);
1554 	if (fpid == 0) {
1555 		trace_me();
1556 		exit(0);
1557 	}
1558 
1559 	/* The first wait() should report the stop from SIGSTOP. */
1560 	wpid = waitpid(fpid, &status, 0);
1561 	ATF_REQUIRE(wpid == fpid);
1562 	ATF_REQUIRE(WIFSTOPPED(status));
1563 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1564 
1565 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1566 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1567 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1568 	    sizeof(events)) == 0);
1569 	ATF_REQUIRE(events & PTRACE_FORK);
1570 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1571 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1572 	    sizeof(events)) == 0);
1573 	ATF_REQUIRE(!(events & PTRACE_FORK));
1574 
1575 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1576 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1577 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1578 	    sizeof(events)) == 0);
1579 	ATF_REQUIRE(events & PTRACE_LWP);
1580 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1581 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1582 	    sizeof(events)) == 0);
1583 	ATF_REQUIRE(!(events & PTRACE_LWP));
1584 
1585 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1586 
1587 	/* Should get one event at exit. */
1588 	wpid = waitpid(fpid, &status, 0);
1589 	ATF_REQUIRE(WIFEXITED(status));
1590 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1591 
1592 	wpid = wait(&status);
1593 	ATF_REQUIRE(wpid == -1);
1594 	ATF_REQUIRE(errno == ECHILD);
1595 }
1596 
1597 /*
1598  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1599  */
1600 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1601 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1602 {
1603 	struct ptrace_lwpinfo pl;
1604 	pid_t fpid, wpid;
1605 	int events, status;
1606 
1607 	ATF_REQUIRE((fpid = fork()) != -1);
1608 	if (fpid == 0) {
1609 		trace_me();
1610 		follow_fork_parent(true);
1611 	}
1612 
1613 	/* The first wait() should report the stop from SIGSTOP. */
1614 	wpid = waitpid(fpid, &status, 0);
1615 	ATF_REQUIRE(wpid == fpid);
1616 	ATF_REQUIRE(WIFSTOPPED(status));
1617 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1618 
1619 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1620 	    sizeof(events)) == 0);
1621 	events |= PTRACE_VFORK;
1622 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1623 	    sizeof(events)) == 0);
1624 
1625 	/* Continue the child ignoring the SIGSTOP. */
1626 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1627 
1628 	/* The next event should report the end of the vfork. */
1629 	wpid = wait(&status);
1630 	ATF_REQUIRE(wpid == fpid);
1631 	ATF_REQUIRE(WIFSTOPPED(status));
1632 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1633 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1634 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1635 
1636 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1637 
1638 	wpid = wait(&status);
1639 	ATF_REQUIRE(wpid == fpid);
1640 	ATF_REQUIRE(WIFEXITED(status));
1641 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1642 
1643 	wpid = wait(&status);
1644 	ATF_REQUIRE(wpid == -1);
1645 	ATF_REQUIRE(errno == ECHILD);
1646 }
1647 
1648 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1649 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1650 {
1651 	struct ptrace_lwpinfo pl[2];
1652 	pid_t children[2], fpid, wpid;
1653 	int events, status;
1654 
1655 	ATF_REQUIRE((fpid = fork()) != -1);
1656 	if (fpid == 0) {
1657 		trace_me();
1658 		follow_fork_parent(true);
1659 	}
1660 
1661 	/* Parent process. */
1662 	children[0] = fpid;
1663 
1664 	/* The first wait() should report the stop from SIGSTOP. */
1665 	wpid = waitpid(children[0], &status, 0);
1666 	ATF_REQUIRE(wpid == children[0]);
1667 	ATF_REQUIRE(WIFSTOPPED(status));
1668 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1669 
1670 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1671 	    sizeof(events)) == 0);
1672 	events |= PTRACE_FORK | PTRACE_VFORK;
1673 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1674 	    sizeof(events)) == 0);
1675 
1676 	/* Continue the child ignoring the SIGSTOP. */
1677 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1678 
1679 	/* Wait for both halves of the fork event to get reported. */
1680 	children[1] = handle_fork_events(children[0], pl);
1681 	ATF_REQUIRE(children[1] > 0);
1682 
1683 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1684 
1685 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1686 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1687 
1688 	/*
1689 	 * The child can't exit until the grandchild reports status, so the
1690 	 * grandchild should report its exit first to the debugger.
1691 	 */
1692 	wpid = waitpid(children[1], &status, 0);
1693 	ATF_REQUIRE(wpid == children[1]);
1694 	ATF_REQUIRE(WIFEXITED(status));
1695 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1696 
1697 	/*
1698 	 * The child should report it's vfork() completion before it
1699 	 * exits.
1700 	 */
1701 	wpid = wait(&status);
1702 	ATF_REQUIRE(wpid == children[0]);
1703 	ATF_REQUIRE(WIFSTOPPED(status));
1704 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1705 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1706 	    -1);
1707 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1708 
1709 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1710 
1711 	wpid = wait(&status);
1712 	ATF_REQUIRE(wpid == children[0]);
1713 	ATF_REQUIRE(WIFEXITED(status));
1714 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1715 
1716 	wpid = wait(&status);
1717 	ATF_REQUIRE(wpid == -1);
1718 	ATF_REQUIRE(errno == ECHILD);
1719 }
1720 
1721 #ifdef HAVE_BREAKPOINT
1722 /*
1723  * Verify that no more events are reported after PT_KILL except for the
1724  * process exit when stopped due to a breakpoint trap.
1725  */
1726 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1727 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1728 {
1729 	pid_t fpid, wpid;
1730 	int status;
1731 
1732 	ATF_REQUIRE((fpid = fork()) != -1);
1733 	if (fpid == 0) {
1734 		trace_me();
1735 		breakpoint();
1736 		exit(1);
1737 	}
1738 
1739 	/* The first wait() should report the stop from SIGSTOP. */
1740 	wpid = waitpid(fpid, &status, 0);
1741 	ATF_REQUIRE(wpid == fpid);
1742 	ATF_REQUIRE(WIFSTOPPED(status));
1743 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1744 
1745 	/* Continue the child ignoring the SIGSTOP. */
1746 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1747 
1748 	/* The second wait() should report hitting the breakpoint. */
1749 	wpid = waitpid(fpid, &status, 0);
1750 	ATF_REQUIRE(wpid == fpid);
1751 	ATF_REQUIRE(WIFSTOPPED(status));
1752 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1753 
1754 	/* Kill the child process. */
1755 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1756 
1757 	/* The last wait() should report the SIGKILL. */
1758 	wpid = waitpid(fpid, &status, 0);
1759 	ATF_REQUIRE(wpid == fpid);
1760 	ATF_REQUIRE(WIFSIGNALED(status));
1761 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1762 
1763 	wpid = wait(&status);
1764 	ATF_REQUIRE(wpid == -1);
1765 	ATF_REQUIRE(errno == ECHILD);
1766 }
1767 #endif /* HAVE_BREAKPOINT */
1768 
1769 /*
1770  * Verify that no more events are reported after PT_KILL except for the
1771  * process exit when stopped inside of a system call.
1772  */
1773 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1774 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1775 {
1776 	struct ptrace_lwpinfo pl;
1777 	pid_t fpid, wpid;
1778 	int status;
1779 
1780 	ATF_REQUIRE((fpid = fork()) != -1);
1781 	if (fpid == 0) {
1782 		trace_me();
1783 		getpid();
1784 		exit(1);
1785 	}
1786 
1787 	/* The first wait() should report the stop from SIGSTOP. */
1788 	wpid = waitpid(fpid, &status, 0);
1789 	ATF_REQUIRE(wpid == fpid);
1790 	ATF_REQUIRE(WIFSTOPPED(status));
1791 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1792 
1793 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1794 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1795 
1796 	/* The second wait() should report a system call entry for getpid(). */
1797 	wpid = waitpid(fpid, &status, 0);
1798 	ATF_REQUIRE(wpid == fpid);
1799 	ATF_REQUIRE(WIFSTOPPED(status));
1800 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1801 
1802 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1803 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1804 
1805 	/* Kill the child process. */
1806 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1807 
1808 	/* The last wait() should report the SIGKILL. */
1809 	wpid = waitpid(fpid, &status, 0);
1810 	ATF_REQUIRE(wpid == fpid);
1811 	ATF_REQUIRE(WIFSIGNALED(status));
1812 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1813 
1814 	wpid = wait(&status);
1815 	ATF_REQUIRE(wpid == -1);
1816 	ATF_REQUIRE(errno == ECHILD);
1817 }
1818 
1819 /*
1820  * Verify that no more events are reported after PT_KILL except for the
1821  * process exit when killing a multithreaded process.
1822  */
1823 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1824 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1825 {
1826 	struct ptrace_lwpinfo pl;
1827 	pid_t fpid, wpid;
1828 	lwpid_t main_lwp;
1829 	int status;
1830 
1831 	ATF_REQUIRE((fpid = fork()) != -1);
1832 	if (fpid == 0) {
1833 		trace_me();
1834 		simple_thread_main();
1835 	}
1836 
1837 	/* The first wait() should report the stop from SIGSTOP. */
1838 	wpid = waitpid(fpid, &status, 0);
1839 	ATF_REQUIRE(wpid == fpid);
1840 	ATF_REQUIRE(WIFSTOPPED(status));
1841 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1842 
1843 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1844 	    sizeof(pl)) != -1);
1845 	main_lwp = pl.pl_lwpid;
1846 
1847 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1848 
1849 	/* Continue the child ignoring the SIGSTOP. */
1850 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1851 
1852 	/* The first event should be for the child thread's birth. */
1853 	wpid = waitpid(fpid, &status, 0);
1854 	ATF_REQUIRE(wpid == fpid);
1855 	ATF_REQUIRE(WIFSTOPPED(status));
1856 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1857 
1858 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1859 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1860 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1861 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1862 
1863 	/* Kill the child process. */
1864 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1865 
1866 	/* The last wait() should report the SIGKILL. */
1867 	wpid = waitpid(fpid, &status, 0);
1868 	ATF_REQUIRE(wpid == fpid);
1869 	ATF_REQUIRE(WIFSIGNALED(status));
1870 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1871 
1872 	wpid = wait(&status);
1873 	ATF_REQUIRE(wpid == -1);
1874 	ATF_REQUIRE(errno == ECHILD);
1875 }
1876 
1877 static void *
1878 mask_usr1_thread(void *arg)
1879 {
1880 	pthread_barrier_t *pbarrier;
1881 	sigset_t sigmask;
1882 
1883 	pbarrier = (pthread_barrier_t*)arg;
1884 
1885 	sigemptyset(&sigmask);
1886 	sigaddset(&sigmask, SIGUSR1);
1887 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1888 
1889 	/* Sync up with other thread after sigmask updated. */
1890 	pthread_barrier_wait(pbarrier);
1891 
1892 	for (;;)
1893 		sleep(60);
1894 
1895 	return (NULL);
1896 }
1897 
1898 /*
1899  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1900  * and prevents spurious stops due to those other signals.
1901  */
1902 ATF_TC(ptrace__PT_KILL_competing_signal);
1903 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1904 {
1905 
1906 	atf_tc_set_md_var(tc, "require.user", "root");
1907 }
1908 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1909 {
1910 	pid_t fpid, wpid;
1911 	int status;
1912 	cpuset_t setmask;
1913 	pthread_t t;
1914 	pthread_barrier_t barrier;
1915 	struct sched_param sched_param;
1916 
1917 	ATF_REQUIRE((fpid = fork()) != -1);
1918 	if (fpid == 0) {
1919 		/* Bind to one CPU so only one thread at a time will run. */
1920 		CPU_ZERO(&setmask);
1921 		CPU_SET(0, &setmask);
1922 		cpusetid_t setid;
1923 		CHILD_REQUIRE(cpuset(&setid) == 0);
1924 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1925 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1926 
1927 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1928 
1929 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1930 		    (void*)&barrier) == 0);
1931 
1932 		/*
1933 		 * Give the main thread higher priority. The test always
1934 		 * assumes that, if both threads are able to run, the main
1935 		 * thread runs first.
1936 		 */
1937 		sched_param.sched_priority =
1938 		    (sched_get_priority_max(SCHED_FIFO) +
1939 		    sched_get_priority_min(SCHED_FIFO)) / 2;
1940 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
1941 		    SCHED_FIFO, &sched_param) == 0);
1942 		sched_param.sched_priority -= RQ_PPQ;
1943 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
1944 		    &sched_param) == 0);
1945 
1946 		sigset_t sigmask;
1947 		sigemptyset(&sigmask);
1948 		sigaddset(&sigmask, SIGUSR2);
1949 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1950 
1951 		/* Sync up with other thread after sigmask updated. */
1952 		pthread_barrier_wait(&barrier);
1953 
1954 		trace_me();
1955 
1956 		for (;;)
1957 			sleep(60);
1958 
1959 		exit(1);
1960 	}
1961 
1962 	/* The first wait() should report the stop from SIGSTOP. */
1963 	wpid = waitpid(fpid, &status, 0);
1964 	ATF_REQUIRE(wpid == fpid);
1965 	ATF_REQUIRE(WIFSTOPPED(status));
1966 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1967 
1968 	/* Continue the child ignoring the SIGSTOP. */
1969 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1970 
1971 	/* Send a signal that only the second thread can handle. */
1972 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
1973 
1974 	/* The second wait() should report the SIGUSR2. */
1975 	wpid = waitpid(fpid, &status, 0);
1976 	ATF_REQUIRE(wpid == fpid);
1977 	ATF_REQUIRE(WIFSTOPPED(status));
1978 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
1979 
1980 	/* Send a signal that only the first thread can handle. */
1981 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
1982 
1983 	/* Replace the SIGUSR2 with a kill. */
1984 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1985 
1986 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
1987 	wpid = waitpid(fpid, &status, 0);
1988 	ATF_REQUIRE(wpid == fpid);
1989 	ATF_REQUIRE(WIFSIGNALED(status));
1990 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1991 
1992 	wpid = wait(&status);
1993 	ATF_REQUIRE(wpid == -1);
1994 	ATF_REQUIRE(errno == ECHILD);
1995 }
1996 
1997 /*
1998  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
1999  * and prevents spurious stops caused by those events.
2000  */
2001 ATF_TC(ptrace__PT_KILL_competing_stop);
2002 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
2003 {
2004 
2005 	atf_tc_set_md_var(tc, "require.user", "root");
2006 }
2007 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
2008 {
2009 	pid_t fpid, wpid;
2010 	int status;
2011 	cpuset_t setmask;
2012 	pthread_t t;
2013 	pthread_barrier_t barrier;
2014 	lwpid_t main_lwp;
2015 	struct ptrace_lwpinfo pl;
2016 	struct sched_param sched_param;
2017 
2018 	ATF_REQUIRE((fpid = fork()) != -1);
2019 	if (fpid == 0) {
2020 		trace_me();
2021 
2022 		/* Bind to one CPU so only one thread at a time will run. */
2023 		CPU_ZERO(&setmask);
2024 		CPU_SET(0, &setmask);
2025 		cpusetid_t setid;
2026 		CHILD_REQUIRE(cpuset(&setid) == 0);
2027 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2028 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2029 
2030 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2031 
2032 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2033 		    (void*)&barrier) == 0);
2034 
2035 		/*
2036 		 * Give the main thread higher priority. The test always
2037 		 * assumes that, if both threads are able to run, the main
2038 		 * thread runs first.
2039 		 */
2040 		sched_param.sched_priority =
2041 		    (sched_get_priority_max(SCHED_FIFO) +
2042 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2043 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2044 		    SCHED_FIFO, &sched_param) == 0);
2045 		sched_param.sched_priority -= RQ_PPQ;
2046 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2047 		    &sched_param) == 0);
2048 
2049 		sigset_t sigmask;
2050 		sigemptyset(&sigmask);
2051 		sigaddset(&sigmask, SIGUSR2);
2052 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2053 
2054 		/* Sync up with other thread after sigmask updated. */
2055 		pthread_barrier_wait(&barrier);
2056 
2057 		/* Sync up with the test before doing the getpid(). */
2058 		raise(SIGSTOP);
2059 
2060 		getpid();
2061 		exit(1);
2062 	}
2063 
2064 	/* The first wait() should report the stop from SIGSTOP. */
2065 	wpid = waitpid(fpid, &status, 0);
2066 	ATF_REQUIRE(wpid == fpid);
2067 	ATF_REQUIRE(WIFSTOPPED(status));
2068 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2069 
2070 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2071 	main_lwp = pl.pl_lwpid;
2072 
2073 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2074 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2075 
2076 	/*
2077 	 * Continue until child is done with setup, which is indicated with
2078 	 * SIGSTOP. Ignore system calls in the meantime.
2079 	 */
2080 	for (;;) {
2081 		wpid = waitpid(fpid, &status, 0);
2082 		ATF_REQUIRE(wpid == fpid);
2083 		ATF_REQUIRE(WIFSTOPPED(status));
2084 		if (WSTOPSIG(status) == SIGTRAP) {
2085 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2086 			    sizeof(pl)) != -1);
2087 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2088 		} else {
2089 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2090 			break;
2091 		}
2092 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2093 	}
2094 
2095 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2096 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2097 
2098 	wpid = waitpid(fpid, &status, 0);
2099 	ATF_REQUIRE(wpid == fpid);
2100 	ATF_REQUIRE(WIFSTOPPED(status));
2101 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2102 
2103 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2104 	    sizeof(pl)) != -1);
2105 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2106 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2107 	/* Prevent the main thread from hitting its syscall exit for now. */
2108 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2109 
2110 	/*
2111 	 * Proceed, allowing second thread to hit syscall exit for
2112 	 * pthread_barrier_wait().
2113 	 */
2114 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2115 
2116 	wpid = waitpid(fpid, &status, 0);
2117 	ATF_REQUIRE(wpid == fpid);
2118 	ATF_REQUIRE(WIFSTOPPED(status));
2119 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2120 
2121 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2122 	    sizeof(pl)) != -1);
2123 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2124 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2125 
2126 	/* Send a signal that only the second thread can handle. */
2127 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2128 
2129 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2130 
2131 	/* The next wait() should report the SIGUSR2. */
2132 	wpid = waitpid(fpid, &status, 0);
2133 	ATF_REQUIRE(wpid == fpid);
2134 	ATF_REQUIRE(WIFSTOPPED(status));
2135 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2136 
2137 	/* Allow the main thread to try to finish its system call. */
2138 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2139 
2140 	/*
2141 	 * At this point, the main thread is in the middle of a system call and
2142 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2143 	 * be replaced with a SIGKILL below. The main thread will get to run
2144 	 * first. It should notice the kill request (even though the signal
2145 	 * replacement occurred in the other thread) and exit accordingly.  It
2146 	 * should not stop for the system call exit event.
2147 	 */
2148 
2149 	/* Replace the SIGUSR2 with a kill. */
2150 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2151 
2152 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2153 	wpid = waitpid(fpid, &status, 0);
2154 	ATF_REQUIRE(wpid == fpid);
2155 	ATF_REQUIRE(WIFSIGNALED(status));
2156 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2157 
2158 	wpid = wait(&status);
2159 	ATF_REQUIRE(wpid == -1);
2160 	ATF_REQUIRE(errno == ECHILD);
2161 }
2162 
2163 static void
2164 sigusr1_handler(int sig)
2165 {
2166 
2167 	CHILD_REQUIRE(sig == SIGUSR1);
2168 	_exit(2);
2169 }
2170 
2171 /*
2172  * Verify that even if the signal queue is full for a child process,
2173  * a PT_KILL will kill the process.
2174  */
2175 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2176 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2177 {
2178 	pid_t fpid, wpid;
2179 	int status;
2180 	int max_pending_per_proc;
2181 	size_t len;
2182 	int i;
2183 
2184 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2185 
2186 	ATF_REQUIRE((fpid = fork()) != -1);
2187 	if (fpid == 0) {
2188 		trace_me();
2189 		exit(1);
2190 	}
2191 
2192 	/* The first wait() should report the stop from SIGSTOP. */
2193 	wpid = waitpid(fpid, &status, 0);
2194 	ATF_REQUIRE(wpid == fpid);
2195 	ATF_REQUIRE(WIFSTOPPED(status));
2196 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2197 
2198 	len = sizeof(max_pending_per_proc);
2199 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2200 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2201 
2202 	/* Fill the signal queue. */
2203 	for (i = 0; i < max_pending_per_proc; ++i)
2204 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2205 
2206 	/* Kill the child process. */
2207 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2208 
2209 	/* The last wait() should report the SIGKILL. */
2210 	wpid = waitpid(fpid, &status, 0);
2211 	ATF_REQUIRE(wpid == fpid);
2212 	ATF_REQUIRE(WIFSIGNALED(status));
2213 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2214 
2215 	wpid = wait(&status);
2216 	ATF_REQUIRE(wpid == -1);
2217 	ATF_REQUIRE(errno == ECHILD);
2218 }
2219 
2220 /*
2221  * Verify that when stopped at a system call entry, a signal can be
2222  * requested with PT_CONTINUE which will be delivered once the system
2223  * call is complete.
2224  */
2225 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2226 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2227 {
2228 	struct ptrace_lwpinfo pl;
2229 	pid_t fpid, wpid;
2230 	int status;
2231 
2232 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2233 
2234 	ATF_REQUIRE((fpid = fork()) != -1);
2235 	if (fpid == 0) {
2236 		trace_me();
2237 		getpid();
2238 		exit(1);
2239 	}
2240 
2241 	/* The first wait() should report the stop from SIGSTOP. */
2242 	wpid = waitpid(fpid, &status, 0);
2243 	ATF_REQUIRE(wpid == fpid);
2244 	ATF_REQUIRE(WIFSTOPPED(status));
2245 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2246 
2247 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2248 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2249 
2250 	/* The second wait() should report a system call entry for getpid(). */
2251 	wpid = waitpid(fpid, &status, 0);
2252 	ATF_REQUIRE(wpid == fpid);
2253 	ATF_REQUIRE(WIFSTOPPED(status));
2254 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2255 
2256 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2257 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2258 
2259 	/* Continue the child process with a signal. */
2260 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2261 
2262 	for (;;) {
2263 		/*
2264 		 * The last wait() should report exit 2, i.e., a normal _exit
2265 		 * from the signal handler. In the meantime, catch and proceed
2266 		 * past any syscall stops.
2267 		 */
2268 		wpid = waitpid(fpid, &status, 0);
2269 		ATF_REQUIRE(wpid == fpid);
2270 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2271 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2272 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2273 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2274 		} else {
2275 			ATF_REQUIRE(WIFEXITED(status));
2276 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2277 			break;
2278 		}
2279 	}
2280 
2281 	wpid = wait(&status);
2282 	ATF_REQUIRE(wpid == -1);
2283 	ATF_REQUIRE(errno == ECHILD);
2284 }
2285 
2286 static void
2287 sigusr1_counting_handler(int sig)
2288 {
2289 	static int counter = 0;
2290 
2291 	CHILD_REQUIRE(sig == SIGUSR1);
2292 	counter++;
2293 	if (counter == 2)
2294 		_exit(2);
2295 }
2296 
2297 /*
2298  * Verify that, when continuing from a stop at system call entry and exit,
2299  * a signal can be requested from both stops, and both will be delivered when
2300  * the system call is complete.
2301  */
2302 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2303 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2304 {
2305 	struct ptrace_lwpinfo pl;
2306 	pid_t fpid, wpid;
2307 	int status;
2308 
2309 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2310 
2311 	ATF_REQUIRE((fpid = fork()) != -1);
2312 	if (fpid == 0) {
2313 		trace_me();
2314 		getpid();
2315 		exit(1);
2316 	}
2317 
2318 	/* The first wait() should report the stop from SIGSTOP. */
2319 	wpid = waitpid(fpid, &status, 0);
2320 	ATF_REQUIRE(wpid == fpid);
2321 	ATF_REQUIRE(WIFSTOPPED(status));
2322 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2323 
2324 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2325 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2326 
2327 	/* The second wait() should report a system call entry for getpid(). */
2328 	wpid = waitpid(fpid, &status, 0);
2329 	ATF_REQUIRE(wpid == fpid);
2330 	ATF_REQUIRE(WIFSTOPPED(status));
2331 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2332 
2333 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2334 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2335 
2336 	/* Continue the child process with a signal. */
2337 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2338 
2339 	/* The third wait() should report a system call exit for getpid(). */
2340 	wpid = waitpid(fpid, &status, 0);
2341 	ATF_REQUIRE(wpid == fpid);
2342 	ATF_REQUIRE(WIFSTOPPED(status));
2343 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2344 
2345 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2346 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2347 
2348 	/* Continue the child process with a signal. */
2349 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2350 
2351 	for (;;) {
2352 		/*
2353 		 * The last wait() should report exit 2, i.e., a normal _exit
2354 		 * from the signal handler. In the meantime, catch and proceed
2355 		 * past any syscall stops.
2356 		 */
2357 		wpid = waitpid(fpid, &status, 0);
2358 		ATF_REQUIRE(wpid == fpid);
2359 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2360 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2361 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2362 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2363 		} else {
2364 			ATF_REQUIRE(WIFEXITED(status));
2365 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2366 			break;
2367 		}
2368 	}
2369 
2370 	wpid = wait(&status);
2371 	ATF_REQUIRE(wpid == -1);
2372 	ATF_REQUIRE(errno == ECHILD);
2373 }
2374 
2375 /*
2376  * Verify that even if the signal queue is full for a child process,
2377  * a PT_CONTINUE with a signal will not result in loss of that signal.
2378  */
2379 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2380 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2381 {
2382 	pid_t fpid, wpid;
2383 	int status;
2384 	int max_pending_per_proc;
2385 	size_t len;
2386 	int i;
2387 
2388 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2389 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2390 
2391 	ATF_REQUIRE((fpid = fork()) != -1);
2392 	if (fpid == 0) {
2393 		trace_me();
2394 		exit(1);
2395 	}
2396 
2397 	/* The first wait() should report the stop from SIGSTOP. */
2398 	wpid = waitpid(fpid, &status, 0);
2399 	ATF_REQUIRE(wpid == fpid);
2400 	ATF_REQUIRE(WIFSTOPPED(status));
2401 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2402 
2403 	len = sizeof(max_pending_per_proc);
2404 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2405 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2406 
2407 	/* Fill the signal queue. */
2408 	for (i = 0; i < max_pending_per_proc; ++i)
2409 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2410 
2411 	/* Continue with signal. */
2412 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2413 
2414 	for (;;) {
2415 		wpid = waitpid(fpid, &status, 0);
2416 		ATF_REQUIRE(wpid == fpid);
2417 		if (WIFSTOPPED(status)) {
2418 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2419 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2420 		} else {
2421 			/*
2422 			 * The last wait() should report normal _exit from the
2423 			 * SIGUSR1 handler.
2424 			 */
2425 			ATF_REQUIRE(WIFEXITED(status));
2426 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2427 			break;
2428 		}
2429 	}
2430 
2431 	wpid = wait(&status);
2432 	ATF_REQUIRE(wpid == -1);
2433 	ATF_REQUIRE(errno == ECHILD);
2434 }
2435 
2436 static sem_t sigusr1_sem;
2437 static int got_usr1;
2438 
2439 static void
2440 sigusr1_sempost_handler(int sig __unused)
2441 {
2442 
2443 	got_usr1++;
2444 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2445 }
2446 
2447 /*
2448  * Verify that even if the signal queue is full for a child process,
2449  * and the signal is masked, a PT_CONTINUE with a signal will not
2450  * result in loss of that signal.
2451  */
2452 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
2453 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue, tc)
2454 {
2455 	struct ptrace_lwpinfo pl;
2456 	pid_t fpid, wpid;
2457 	int status, err;
2458 	int max_pending_per_proc;
2459 	size_t len;
2460 	int i;
2461 	sigset_t sigmask;
2462 
2463 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2464 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2465 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2466 
2467 	got_usr1 = 0;
2468 	ATF_REQUIRE((fpid = fork()) != -1);
2469 	if (fpid == 0) {
2470 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2471 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2472 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2473 
2474 		trace_me();
2475 		CHILD_REQUIRE(got_usr1 == 0);
2476 
2477 		/* Allow the pending SIGUSR1 in now. */
2478 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2479 		/* Wait to receive the SIGUSR1. */
2480 		do {
2481 			err = sem_wait(&sigusr1_sem);
2482 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2483 		} while (err != 0 && errno == EINTR);
2484 		CHILD_REQUIRE(got_usr1 == 1);
2485 		exit(1);
2486 	}
2487 
2488 	/* The first wait() should report the stop from SIGSTOP. */
2489 	wpid = waitpid(fpid, &status, 0);
2490 	ATF_REQUIRE(wpid == fpid);
2491 	ATF_REQUIRE(WIFSTOPPED(status));
2492 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2493 
2494 	len = sizeof(max_pending_per_proc);
2495 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2496 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2497 
2498 	/* Fill the signal queue. */
2499 	for (i = 0; i < max_pending_per_proc; ++i)
2500 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2501 
2502 	/* Continue with signal. */
2503 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2504 
2505 	/* Collect and ignore all of the SIGUSR2. */
2506 	for (i = 0; i < max_pending_per_proc; ++i) {
2507 		wpid = waitpid(fpid, &status, 0);
2508 		ATF_REQUIRE(wpid == fpid);
2509 		ATF_REQUIRE(WIFSTOPPED(status));
2510 		ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2511 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2512 	}
2513 
2514 	/* Now our PT_CONTINUE'd SIGUSR1 should cause a stop after unmask. */
2515 	wpid = waitpid(fpid, &status, 0);
2516 	ATF_REQUIRE(wpid == fpid);
2517 	ATF_REQUIRE(WIFSTOPPED(status));
2518 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2519 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2520 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2521 
2522 	/* Continue the child, ignoring the SIGUSR1. */
2523 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2524 
2525 	/* The last wait() should report exit after receiving SIGUSR1. */
2526 	wpid = waitpid(fpid, &status, 0);
2527 	ATF_REQUIRE(wpid == fpid);
2528 	ATF_REQUIRE(WIFEXITED(status));
2529 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2530 
2531 	wpid = wait(&status);
2532 	ATF_REQUIRE(wpid == -1);
2533 	ATF_REQUIRE(errno == ECHILD);
2534 }
2535 
2536 /*
2537  * Verify that, after stopping due to a signal, that signal can be
2538  * replaced with another signal.
2539  */
2540 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2541 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2542 {
2543 	struct ptrace_lwpinfo pl;
2544 	pid_t fpid, wpid;
2545 	int status;
2546 
2547 	ATF_REQUIRE((fpid = fork()) != -1);
2548 	if (fpid == 0) {
2549 		trace_me();
2550 		sleep(20);
2551 		exit(1);
2552 	}
2553 
2554 	/* The first wait() should report the stop from SIGSTOP. */
2555 	wpid = waitpid(fpid, &status, 0);
2556 	ATF_REQUIRE(wpid == fpid);
2557 	ATF_REQUIRE(WIFSTOPPED(status));
2558 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2559 
2560 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2561 
2562 	/* Send a signal without ptrace. */
2563 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2564 
2565 	/* The second wait() should report a SIGINT was received. */
2566 	wpid = waitpid(fpid, &status, 0);
2567 	ATF_REQUIRE(wpid == fpid);
2568 	ATF_REQUIRE(WIFSTOPPED(status));
2569 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2570 
2571 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2572 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2573 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2574 
2575 	/* Continue the child process with a different signal. */
2576 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2577 
2578 	/*
2579 	 * The last wait() should report having died due to the new
2580 	 * signal, SIGTERM.
2581 	 */
2582 	wpid = waitpid(fpid, &status, 0);
2583 	ATF_REQUIRE(wpid == fpid);
2584 	ATF_REQUIRE(WIFSIGNALED(status));
2585 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2586 
2587 	wpid = wait(&status);
2588 	ATF_REQUIRE(wpid == -1);
2589 	ATF_REQUIRE(errno == ECHILD);
2590 }
2591 
2592 /*
2593  * Verify that a signal can be passed through to the child even when there
2594  * was no true signal originally. Such cases arise when a SIGTRAP is
2595  * invented for e.g, system call stops.
2596  */
2597 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2598 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2599 {
2600 	struct ptrace_lwpinfo pl;
2601 	struct rlimit rl;
2602 	pid_t fpid, wpid;
2603 	int status;
2604 
2605 	ATF_REQUIRE((fpid = fork()) != -1);
2606 	if (fpid == 0) {
2607 		trace_me();
2608 		/* SIGTRAP expected to cause exit on syscall entry. */
2609 		rl.rlim_cur = rl.rlim_max = 0;
2610 		ATF_REQUIRE(setrlimit(RLIMIT_CORE, &rl) == 0);
2611 		getpid();
2612 		exit(1);
2613 	}
2614 
2615 	/* The first wait() should report the stop from SIGSTOP. */
2616 	wpid = waitpid(fpid, &status, 0);
2617 	ATF_REQUIRE(wpid == fpid);
2618 	ATF_REQUIRE(WIFSTOPPED(status));
2619 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2620 
2621 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2622 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2623 
2624 	/* The second wait() should report a system call entry for getpid(). */
2625 	wpid = waitpid(fpid, &status, 0);
2626 	ATF_REQUIRE(wpid == fpid);
2627 	ATF_REQUIRE(WIFSTOPPED(status));
2628 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2629 
2630 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2631 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2632 
2633 	/* Continue the child process with a SIGTRAP. */
2634 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2635 
2636 	for (;;) {
2637 		/*
2638 		 * The last wait() should report exit due to SIGTRAP.  In the
2639 		 * meantime, catch and proceed past any syscall stops.
2640 		 */
2641 		wpid = waitpid(fpid, &status, 0);
2642 		ATF_REQUIRE(wpid == fpid);
2643 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2644 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2645 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2646 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2647 		} else {
2648 			ATF_REQUIRE(WIFSIGNALED(status));
2649 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2650 			break;
2651 		}
2652 	}
2653 
2654 	wpid = wait(&status);
2655 	ATF_REQUIRE(wpid == -1);
2656 	ATF_REQUIRE(errno == ECHILD);
2657 
2658 }
2659 
2660 /*
2661  * A mixed bag PT_CONTINUE with signal test.
2662  */
2663 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2664 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2665 {
2666 	struct ptrace_lwpinfo pl;
2667 	pid_t fpid, wpid;
2668 	int status;
2669 
2670 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2671 
2672 	ATF_REQUIRE((fpid = fork()) != -1);
2673 	if (fpid == 0) {
2674 		trace_me();
2675 		getpid();
2676 		exit(1);
2677 	}
2678 
2679 	/* The first wait() should report the stop from SIGSTOP. */
2680 	wpid = waitpid(fpid, &status, 0);
2681 	ATF_REQUIRE(wpid == fpid);
2682 	ATF_REQUIRE(WIFSTOPPED(status));
2683 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2684 
2685 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2686 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2687 
2688 	/* The second wait() should report a system call entry for getpid(). */
2689 	wpid = waitpid(fpid, &status, 0);
2690 	ATF_REQUIRE(wpid == fpid);
2691 	ATF_REQUIRE(WIFSTOPPED(status));
2692 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2693 
2694 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2695 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2696 
2697 	/* Continue with the first SIGUSR1. */
2698 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2699 
2700 	/* The next wait() should report a system call exit for getpid(). */
2701 	wpid = waitpid(fpid, &status, 0);
2702 	ATF_REQUIRE(wpid == fpid);
2703 	ATF_REQUIRE(WIFSTOPPED(status));
2704 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2705 
2706 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2707 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2708 
2709 	/* Send an ABRT without ptrace. */
2710 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2711 
2712 	/* Continue normally. */
2713 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2714 
2715 	/* The next wait() should report the SIGABRT. */
2716 	wpid = waitpid(fpid, &status, 0);
2717 	ATF_REQUIRE(wpid == fpid);
2718 	ATF_REQUIRE(WIFSTOPPED(status));
2719 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2720 
2721 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2722 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2723 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2724 
2725 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2726 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2727 
2728 	for (;;) {
2729 		/*
2730 		 * The last wait() should report exit 2, i.e., a normal _exit
2731 		 * from the signal handler. In the meantime, catch and proceed
2732 		 * past any syscall stops.
2733 		 */
2734 		wpid = waitpid(fpid, &status, 0);
2735 		ATF_REQUIRE(wpid == fpid);
2736 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2737 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2738 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2739 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2740 		} else {
2741 			ATF_REQUIRE(WIFEXITED(status));
2742 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2743 			break;
2744 		}
2745 	}
2746 
2747 	wpid = wait(&status);
2748 	ATF_REQUIRE(wpid == -1);
2749 	ATF_REQUIRE(errno == ECHILD);
2750 
2751 }
2752 
2753 /*
2754  * Verify a signal delivered by ptrace is noticed by kevent(2).
2755  */
2756 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2757 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2758 {
2759 	pid_t fpid, wpid;
2760 	int status, kq, nevents;
2761 	struct kevent kev;
2762 
2763 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2764 
2765 	ATF_REQUIRE((fpid = fork()) != -1);
2766 	if (fpid == 0) {
2767 		CHILD_REQUIRE((kq = kqueue()) > 0);
2768 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2769 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2770 
2771 		trace_me();
2772 
2773 		for (;;) {
2774 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2775 			if (nevents == -1 && errno == EINTR)
2776 				continue;
2777 			CHILD_REQUIRE(nevents > 0);
2778 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2779 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2780 			break;
2781 		}
2782 
2783 		exit(1);
2784 	}
2785 
2786 	/* The first wait() should report the stop from SIGSTOP. */
2787 	wpid = waitpid(fpid, &status, 0);
2788 	ATF_REQUIRE(wpid == fpid);
2789 	ATF_REQUIRE(WIFSTOPPED(status));
2790 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2791 
2792 	/* Continue with the SIGUSR1. */
2793 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2794 
2795 	/*
2796 	 * The last wait() should report normal exit with code 1.
2797 	 */
2798 	wpid = waitpid(fpid, &status, 0);
2799 	ATF_REQUIRE(wpid == fpid);
2800 	ATF_REQUIRE(WIFEXITED(status));
2801 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2802 
2803 	wpid = wait(&status);
2804 	ATF_REQUIRE(wpid == -1);
2805 	ATF_REQUIRE(errno == ECHILD);
2806 }
2807 
2808 static void *
2809 signal_thread(void *arg)
2810 {
2811 	int err;
2812 	sigset_t sigmask;
2813 
2814 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2815 
2816 	/* Wait for this thread to receive a SIGUSR1. */
2817 	do {
2818 		err = sem_wait(&sigusr1_sem);
2819 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2820 	} while (err != 0 && errno == EINTR);
2821 
2822 	/* Free our companion thread from the barrier. */
2823 	pthread_barrier_wait(pbarrier);
2824 
2825 	/*
2826 	 * Swap ignore duties; the next SIGUSR1 should go to the
2827 	 * other thread.
2828 	 */
2829 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2830 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2831 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2832 
2833 	/* Sync up threads after swapping signal masks. */
2834 	pthread_barrier_wait(pbarrier);
2835 
2836 	/* Wait until our companion has received its SIGUSR1. */
2837 	pthread_barrier_wait(pbarrier);
2838 
2839 	return (NULL);
2840 }
2841 
2842 /*
2843  * Verify that a traced process with blocked signal received the
2844  * signal from kill() once unmasked.
2845  */
2846 ATF_TC_WITHOUT_HEAD(ptrace__killed_with_sigmask);
2847 ATF_TC_BODY(ptrace__killed_with_sigmask, tc)
2848 {
2849 	struct ptrace_lwpinfo pl;
2850 	pid_t fpid, wpid;
2851 	int status, err;
2852 	sigset_t sigmask;
2853 
2854 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2855 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2856 	got_usr1 = 0;
2857 
2858 	ATF_REQUIRE((fpid = fork()) != -1);
2859 	if (fpid == 0) {
2860 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2861 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2862 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2863 
2864 		trace_me();
2865 		CHILD_REQUIRE(got_usr1 == 0);
2866 
2867 		/* Allow the pending SIGUSR1 in now. */
2868 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2869 		/* Wait to receive a SIGUSR1. */
2870 		do {
2871 			err = sem_wait(&sigusr1_sem);
2872 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2873 		} while (err != 0 && errno == EINTR);
2874 		CHILD_REQUIRE(got_usr1 == 1);
2875 		exit(1);
2876 	}
2877 
2878 	/* The first wait() should report the stop from SIGSTOP. */
2879 	wpid = waitpid(fpid, &status, 0);
2880 	ATF_REQUIRE(wpid == fpid);
2881 	ATF_REQUIRE(WIFSTOPPED(status));
2882 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2883 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2884 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2885 
2886 	/* Send blocked SIGUSR1 which should cause a stop. */
2887 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2888 
2889 	/* Continue the child ignoring the SIGSTOP. */
2890 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2891 
2892 	/* The next wait() should report the kill(SIGUSR1) was received. */
2893 	wpid = waitpid(fpid, &status, 0);
2894 	ATF_REQUIRE(wpid == fpid);
2895 	ATF_REQUIRE(WIFSTOPPED(status));
2896 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2897 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2898 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2899 
2900 	/* Continue the child, allowing in the SIGUSR1. */
2901 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2902 
2903 	/* The last wait() should report normal exit with code 1. */
2904 	wpid = waitpid(fpid, &status, 0);
2905 	ATF_REQUIRE(wpid == fpid);
2906 	ATF_REQUIRE(WIFEXITED(status));
2907 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2908 
2909 	wpid = wait(&status);
2910 	ATF_REQUIRE(wpid == -1);
2911 	ATF_REQUIRE(errno == ECHILD);
2912 }
2913 
2914 /*
2915  * Verify that a traced process with blocked signal received the
2916  * signal from PT_CONTINUE once unmasked.
2917  */
2918 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigmask);
2919 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigmask, tc)
2920 {
2921 	struct ptrace_lwpinfo pl;
2922 	pid_t fpid, wpid;
2923 	int status, err;
2924 	sigset_t sigmask;
2925 
2926 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2927 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2928 	got_usr1 = 0;
2929 
2930 	ATF_REQUIRE((fpid = fork()) != -1);
2931 	if (fpid == 0) {
2932 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2933 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2934 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2935 
2936 		trace_me();
2937 		CHILD_REQUIRE(got_usr1 == 0);
2938 
2939 		/* Allow the pending SIGUSR1 in now. */
2940 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2941 		/* Wait to receive a SIGUSR1. */
2942 		do {
2943 			err = sem_wait(&sigusr1_sem);
2944 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2945 		} while (err != 0 && errno == EINTR);
2946 
2947 		CHILD_REQUIRE(got_usr1 == 1);
2948 		exit(1);
2949 	}
2950 
2951 	/* The first wait() should report the stop from SIGSTOP. */
2952 	wpid = waitpid(fpid, &status, 0);
2953 	ATF_REQUIRE(wpid == fpid);
2954 	ATF_REQUIRE(WIFSTOPPED(status));
2955 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2956 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2957 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2958 
2959 	/* Continue the child replacing SIGSTOP with SIGUSR1. */
2960 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2961 
2962 	/* The next wait() should report the SIGUSR1 was received. */
2963 	wpid = waitpid(fpid, &status, 0);
2964 	ATF_REQUIRE(wpid == fpid);
2965 	ATF_REQUIRE(WIFSTOPPED(status));
2966 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2967 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2968 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2969 
2970 	/* Continue the child, ignoring the SIGUSR1. */
2971 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2972 
2973 	/* The last wait() should report normal exit with code 1. */
2974 	wpid = waitpid(fpid, &status, 0);
2975 	ATF_REQUIRE(wpid == fpid);
2976 	ATF_REQUIRE(WIFEXITED(status));
2977 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2978 
2979 	wpid = wait(&status);
2980 	ATF_REQUIRE(wpid == -1);
2981 	ATF_REQUIRE(errno == ECHILD);
2982 }
2983 
2984 /*
2985  * Verify that if ptrace stops due to a signal but continues with
2986  * a different signal that the new signal is routed to a thread
2987  * that can accept it, and that the thread is awakened by the signal
2988  * in a timely manner.
2989  */
2990 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
2991 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
2992 {
2993 	pid_t fpid, wpid;
2994 	int status, err;
2995 	pthread_t t;
2996 	sigset_t sigmask;
2997 	pthread_barrier_t barrier;
2998 
2999 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
3000 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
3001 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
3002 
3003 	ATF_REQUIRE((fpid = fork()) != -1);
3004 	if (fpid == 0) {
3005 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
3006 
3007 		/* The other thread should receive the first SIGUSR1. */
3008 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
3009 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
3010 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
3011 
3012 		trace_me();
3013 
3014 		/* Wait until other thread has received its SIGUSR1. */
3015 		pthread_barrier_wait(&barrier);
3016 
3017 		/*
3018 		 * Swap ignore duties; the next SIGUSR1 should go to this
3019 		 * thread.
3020 		 */
3021 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3022 
3023 		/* Sync up threads after swapping signal masks. */
3024 		pthread_barrier_wait(&barrier);
3025 
3026 		/*
3027 		 * Sync up with test code; we're ready for the next SIGUSR1
3028 		 * now.
3029 		 */
3030 		raise(SIGSTOP);
3031 
3032 		/* Wait for this thread to receive a SIGUSR1. */
3033 		do {
3034 			err = sem_wait(&sigusr1_sem);
3035 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3036 		} while (err != 0 && errno == EINTR);
3037 
3038 		/* Free the other thread from the barrier. */
3039 		pthread_barrier_wait(&barrier);
3040 
3041 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
3042 
3043 		exit(1);
3044 	}
3045 
3046 	/* The first wait() should report the stop from SIGSTOP. */
3047 	wpid = waitpid(fpid, &status, 0);
3048 	ATF_REQUIRE(wpid == fpid);
3049 	ATF_REQUIRE(WIFSTOPPED(status));
3050 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3051 
3052 	/* Continue the child ignoring the SIGSTOP. */
3053 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3054 
3055 	/*
3056 	 * Send a signal without ptrace that either thread will accept (USR2,
3057 	 * in this case).
3058 	 */
3059 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3060 
3061 	/* The second wait() should report a SIGUSR2 was received. */
3062 	wpid = waitpid(fpid, &status, 0);
3063 	ATF_REQUIRE(wpid == fpid);
3064 	ATF_REQUIRE(WIFSTOPPED(status));
3065 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3066 
3067 	/* Continue the child, changing the signal to USR1. */
3068 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3069 
3070 	/* The next wait() should report the stop from SIGSTOP. */
3071 	wpid = waitpid(fpid, &status, 0);
3072 	ATF_REQUIRE(wpid == fpid);
3073 	ATF_REQUIRE(WIFSTOPPED(status));
3074 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3075 
3076 	/* Continue the child ignoring the SIGSTOP. */
3077 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3078 
3079 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3080 
3081 	/* The next wait() should report a SIGUSR2 was received. */
3082 	wpid = waitpid(fpid, &status, 0);
3083 	ATF_REQUIRE(wpid == fpid);
3084 	ATF_REQUIRE(WIFSTOPPED(status));
3085 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3086 
3087 	/* Continue the child, changing the signal to USR1. */
3088 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3089 
3090 	/* The last wait() should report normal exit with code 1. */
3091 	wpid = waitpid(fpid, &status, 0);
3092 	ATF_REQUIRE(wpid == fpid);
3093 	ATF_REQUIRE(WIFEXITED(status));
3094 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3095 
3096 	wpid = wait(&status);
3097 	ATF_REQUIRE(wpid == -1);
3098 	ATF_REQUIRE(errno == ECHILD);
3099 }
3100 
3101 static void *
3102 raise_sigstop_thread(void *arg __unused)
3103 {
3104 
3105 	raise(SIGSTOP);
3106 	return NULL;
3107 }
3108 
3109 static void *
3110 sleep_thread(void *arg __unused)
3111 {
3112 
3113 	sleep(60);
3114 	return NULL;
3115 }
3116 
3117 static void
3118 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
3119 {
3120 	pid_t fpid, wpid;
3121 	int status, i;
3122 	cpuset_t setmask;
3123 	cpusetid_t setid;
3124 	pthread_t t;
3125 
3126 	/*
3127 	 * Become the reaper for this process tree. We need to be able to check
3128 	 * that both child and grandchild have died.
3129 	 */
3130 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
3131 
3132 	fpid = fork();
3133 	ATF_REQUIRE(fpid >= 0);
3134 	if (fpid == 0) {
3135 		fpid = fork();
3136 		CHILD_REQUIRE(fpid >= 0);
3137 		if (fpid == 0) {
3138 			trace_me();
3139 
3140 			/* Pin to CPU 0 to serialize thread execution. */
3141 			CPU_ZERO(&setmask);
3142 			CPU_SET(0, &setmask);
3143 			CHILD_REQUIRE(cpuset(&setid) == 0);
3144 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
3145 			    CPU_WHICH_CPUSET, setid,
3146 			    sizeof(setmask), &setmask) == 0);
3147 
3148 			if (sigstop_from_main_thread) {
3149 				/*
3150 				 * We expect the SIGKILL sent when our parent
3151 				 * dies to be delivered to the new thread.
3152 				 * Raise the SIGSTOP in this thread so the
3153 				 * threads compete.
3154 				 */
3155 				CHILD_REQUIRE(pthread_create(&t, NULL,
3156 				    sleep_thread, NULL) == 0);
3157 				raise(SIGSTOP);
3158 			} else {
3159 				/*
3160 				 * We expect the SIGKILL to be delivered to
3161 				 * this thread. After creating the new thread,
3162 				 * just get off the CPU so the other thread can
3163 				 * raise the SIGSTOP.
3164 				 */
3165 				CHILD_REQUIRE(pthread_create(&t, NULL,
3166 				    raise_sigstop_thread, NULL) == 0);
3167 				sleep(60);
3168 			}
3169 
3170 			exit(0);
3171 		}
3172 		/* First stop is trace_me() immediately after fork. */
3173 		wpid = waitpid(fpid, &status, 0);
3174 		CHILD_REQUIRE(wpid == fpid);
3175 		CHILD_REQUIRE(WIFSTOPPED(status));
3176 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3177 
3178 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3179 
3180 		/* Second stop is from the raise(SIGSTOP). */
3181 		wpid = waitpid(fpid, &status, 0);
3182 		CHILD_REQUIRE(wpid == fpid);
3183 		CHILD_REQUIRE(WIFSTOPPED(status));
3184 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3185 
3186 		/*
3187 		 * Terminate tracing process without detaching. Our child
3188 		 * should be killed.
3189 		 */
3190 		exit(0);
3191 	}
3192 
3193 	/*
3194 	 * We should get a normal exit from our immediate child and a SIGKILL
3195 	 * exit from our grandchild. The latter case is the interesting one.
3196 	 * Our grandchild should not have stopped due to the SIGSTOP that was
3197 	 * left dangling when its parent died.
3198 	 */
3199 	for (i = 0; i < 2; ++i) {
3200 		wpid = wait(&status);
3201 		if (wpid == fpid)
3202 			ATF_REQUIRE(WIFEXITED(status) &&
3203 			    WEXITSTATUS(status) == 0);
3204 		else
3205 			ATF_REQUIRE(WIFSIGNALED(status) &&
3206 			    WTERMSIG(status) == SIGKILL);
3207 	}
3208 }
3209 
3210 /*
3211  * These two tests ensure that if the tracing process exits without detaching
3212  * just after the child received a SIGSTOP, the child is cleanly killed and
3213  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
3214  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
3215  * different threads, the SIGKILL must win.  There are two variants of this
3216  * test, designed to catch the case where the SIGKILL is delivered to the
3217  * younger thread (the first test) and the case where the SIGKILL is delivered
3218  * to the older thread (the second test). This behavior has changed in the
3219  * past, so make no assumption.
3220  */
3221 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
3222 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
3223 {
3224 
3225 	atf_tc_set_md_var(tc, "require.user", "root");
3226 }
3227 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
3228 {
3229 
3230 	terminate_with_pending_sigstop(true);
3231 }
3232 
3233 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
3234 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
3235 {
3236 
3237 	atf_tc_set_md_var(tc, "require.user", "root");
3238 }
3239 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
3240 {
3241 
3242 	terminate_with_pending_sigstop(false);
3243 }
3244 
3245 /*
3246  * Verify that after ptrace() discards a SIGKILL signal, the event mask
3247  * is not modified.
3248  */
3249 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
3250 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
3251 {
3252 	struct ptrace_lwpinfo pl;
3253 	pid_t fpid, wpid;
3254 	int status, event_mask, new_event_mask;
3255 
3256 	ATF_REQUIRE((fpid = fork()) != -1);
3257 	if (fpid == 0) {
3258 		trace_me();
3259 		raise(SIGSTOP);
3260 		exit(0);
3261 	}
3262 
3263 	/* The first wait() should report the stop from trace_me(). */
3264 	wpid = waitpid(fpid, &status, 0);
3265 	ATF_REQUIRE(wpid == fpid);
3266 	ATF_REQUIRE(WIFSTOPPED(status));
3267 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3268 
3269 	/* Set several unobtrusive event bits. */
3270 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3271 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3272 	    sizeof(event_mask)) == 0);
3273 
3274 	/* Send a SIGKILL without using ptrace. */
3275 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
3276 
3277 	/* Continue the child ignoring the SIGSTOP. */
3278 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3279 
3280 	/* The next stop should be due to the SIGKILL. */
3281 	wpid = waitpid(fpid, &status, 0);
3282 	ATF_REQUIRE(wpid == fpid);
3283 	ATF_REQUIRE(WIFSTOPPED(status));
3284 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
3285 
3286 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3287 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3288 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
3289 
3290 	/* Continue the child ignoring the SIGKILL. */
3291 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3292 
3293 	/* The next wait() should report the stop from SIGSTOP. */
3294 	wpid = waitpid(fpid, &status, 0);
3295 	ATF_REQUIRE(wpid == fpid);
3296 	ATF_REQUIRE(WIFSTOPPED(status));
3297 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3298 
3299 	/* Check the current event mask. It should not have changed. */
3300 	new_event_mask = 0;
3301 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3302 	    sizeof(new_event_mask)) == 0);
3303 	ATF_REQUIRE(event_mask == new_event_mask);
3304 
3305 	/* Continue the child to let it exit. */
3306 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3307 
3308 	/* The last event should be for the child process's exit. */
3309 	wpid = waitpid(fpid, &status, 0);
3310 	ATF_REQUIRE(WIFEXITED(status));
3311 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3312 
3313 	wpid = wait(&status);
3314 	ATF_REQUIRE(wpid == -1);
3315 	ATF_REQUIRE(errno == ECHILD);
3316 }
3317 
3318 static void *
3319 flock_thread(void *arg)
3320 {
3321 	int fd;
3322 
3323 	fd = *(int *)arg;
3324 	(void)flock(fd, LOCK_EX);
3325 	(void)flock(fd, LOCK_UN);
3326 	return (NULL);
3327 }
3328 
3329 /*
3330  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3331  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3332  * on a lock. This is a regression test for r318191.
3333  */
3334 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3335 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3336 {
3337 	pthread_barrier_t barrier;
3338 	pthread_barrierattr_t battr;
3339 	char tmpfile[64];
3340 	pid_t child, wpid;
3341 	int error, fd, i, status;
3342 
3343 	ATF_REQUIRE(pthread_barrierattr_init(&battr) == 0);
3344 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3345 	    PTHREAD_PROCESS_SHARED) == 0);
3346 	ATF_REQUIRE(pthread_barrier_init(&barrier, &battr, 2) == 0);
3347 
3348 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3349 	fd = mkstemp(tmpfile);
3350 	ATF_REQUIRE(fd >= 0);
3351 
3352 	ATF_REQUIRE((child = fork()) != -1);
3353 	if (child == 0) {
3354 		pthread_t t[2];
3355 		int cfd;
3356 
3357 		error = pthread_barrier_wait(&barrier);
3358 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3359 			_exit(1);
3360 
3361 		cfd = open(tmpfile, O_RDONLY);
3362 		if (cfd < 0)
3363 			_exit(1);
3364 
3365 		/*
3366 		 * We want at least two threads blocked on the file lock since
3367 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3368 		 * sleep.
3369 		 */
3370 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3371 			_exit(1);
3372 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3373 			_exit(1);
3374 		if (pthread_join(t[0], NULL) != 0)
3375 			_exit(1);
3376 		if (pthread_join(t[1], NULL) != 0)
3377 			_exit(1);
3378 		_exit(0);
3379 	}
3380 
3381 	ATF_REQUIRE(flock(fd, LOCK_EX) == 0);
3382 
3383 	error = pthread_barrier_wait(&barrier);
3384 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3385 
3386 	/*
3387 	 * Give the child some time to block. Is there a better way to do this?
3388 	 */
3389 	sleep(1);
3390 
3391 	/*
3392 	 * Attach and give the child 3 seconds to stop.
3393 	 */
3394 	ATF_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) == 0);
3395 	for (i = 0; i < 3; i++) {
3396 		wpid = waitpid(child, &status, WNOHANG);
3397 		if (wpid == child && WIFSTOPPED(status) &&
3398 		    WSTOPSIG(status) == SIGSTOP)
3399 			break;
3400 		sleep(1);
3401 	}
3402 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3403 
3404 	ATF_REQUIRE(ptrace(PT_DETACH, child, NULL, 0) == 0);
3405 
3406 	ATF_REQUIRE(flock(fd, LOCK_UN) == 0);
3407 	ATF_REQUIRE(unlink(tmpfile) == 0);
3408 	ATF_REQUIRE(close(fd) == 0);
3409 }
3410 
3411 static void
3412 sigusr1_step_handler(int sig)
3413 {
3414 
3415 	CHILD_REQUIRE(sig == SIGUSR1);
3416 	raise(SIGABRT);
3417 }
3418 
3419 /*
3420  * Verify that PT_STEP with a signal invokes the signal before
3421  * stepping the next instruction (and that the next instruction is
3422  * stepped correctly).
3423  */
3424 ATF_TC_WITHOUT_HEAD(ptrace__PT_STEP_with_signal);
3425 ATF_TC_BODY(ptrace__PT_STEP_with_signal, tc)
3426 {
3427 	struct ptrace_lwpinfo pl;
3428 	pid_t fpid, wpid;
3429 	int status;
3430 
3431 	ATF_REQUIRE((fpid = fork()) != -1);
3432 	if (fpid == 0) {
3433 		trace_me();
3434 		signal(SIGUSR1, sigusr1_step_handler);
3435 		raise(SIGABRT);
3436 		exit(1);
3437 	}
3438 
3439 	/* The first wait() should report the stop from SIGSTOP. */
3440 	wpid = waitpid(fpid, &status, 0);
3441 	ATF_REQUIRE(wpid == fpid);
3442 	ATF_REQUIRE(WIFSTOPPED(status));
3443 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3444 
3445 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3446 
3447 	/* The next stop should report the SIGABRT in the child body. */
3448 	wpid = waitpid(fpid, &status, 0);
3449 	ATF_REQUIRE(wpid == fpid);
3450 	ATF_REQUIRE(WIFSTOPPED(status));
3451 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3452 
3453 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3454 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3455 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3456 
3457 	/* Step the child process inserting SIGUSR1. */
3458 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, SIGUSR1) == 0);
3459 
3460 	/* The next stop should report the SIGABRT in the signal handler. */
3461 	wpid = waitpid(fpid, &status, 0);
3462 	ATF_REQUIRE(wpid == fpid);
3463 	ATF_REQUIRE(WIFSTOPPED(status));
3464 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3465 
3466 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3467 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3468 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3469 
3470 	/* Continue the child process discarding the signal. */
3471 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3472 
3473 	/* The next stop should report a trace trap from PT_STEP. */
3474 	wpid = waitpid(fpid, &status, 0);
3475 	ATF_REQUIRE(wpid == fpid);
3476 	ATF_REQUIRE(WIFSTOPPED(status));
3477 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3478 
3479 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3480 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3481 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3482 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3483 
3484 	/* Continue the child to let it exit. */
3485 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3486 
3487 	/* The last event should be for the child process's exit. */
3488 	wpid = waitpid(fpid, &status, 0);
3489 	ATF_REQUIRE(WIFEXITED(status));
3490 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3491 
3492 	wpid = wait(&status);
3493 	ATF_REQUIRE(wpid == -1);
3494 	ATF_REQUIRE(errno == ECHILD);
3495 }
3496 
3497 #ifdef HAVE_BREAKPOINT
3498 /*
3499  * Verify that a SIGTRAP event with the TRAP_BRKPT code is reported
3500  * for a breakpoint trap.
3501  */
3502 ATF_TC_WITHOUT_HEAD(ptrace__breakpoint_siginfo);
3503 ATF_TC_BODY(ptrace__breakpoint_siginfo, tc)
3504 {
3505 	struct ptrace_lwpinfo pl;
3506 	pid_t fpid, wpid;
3507 	int status;
3508 
3509 	ATF_REQUIRE((fpid = fork()) != -1);
3510 	if (fpid == 0) {
3511 		trace_me();
3512 		breakpoint();
3513 		exit(1);
3514 	}
3515 
3516 	/* The first wait() should report the stop from SIGSTOP. */
3517 	wpid = waitpid(fpid, &status, 0);
3518 	ATF_REQUIRE(wpid == fpid);
3519 	ATF_REQUIRE(WIFSTOPPED(status));
3520 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3521 
3522 	/* Continue the child ignoring the SIGSTOP. */
3523 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3524 
3525 	/* The second wait() should report hitting the breakpoint. */
3526 	wpid = waitpid(fpid, &status, 0);
3527 	ATF_REQUIRE(wpid == fpid);
3528 	ATF_REQUIRE(WIFSTOPPED(status));
3529 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3530 
3531 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3532 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3533 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3534 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_BRKPT);
3535 
3536 	/* Kill the child process. */
3537 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
3538 
3539 	/* The last wait() should report the SIGKILL. */
3540 	wpid = waitpid(fpid, &status, 0);
3541 	ATF_REQUIRE(wpid == fpid);
3542 	ATF_REQUIRE(WIFSIGNALED(status));
3543 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
3544 
3545 	wpid = wait(&status);
3546 	ATF_REQUIRE(wpid == -1);
3547 	ATF_REQUIRE(errno == ECHILD);
3548 }
3549 #endif /* HAVE_BREAKPOINT */
3550 
3551 /*
3552  * Verify that a SIGTRAP event with the TRAP_TRACE code is reported
3553  * for a single-step trap from PT_STEP.
3554  */
3555 ATF_TC_WITHOUT_HEAD(ptrace__step_siginfo);
3556 ATF_TC_BODY(ptrace__step_siginfo, tc)
3557 {
3558 	struct ptrace_lwpinfo pl;
3559 	pid_t fpid, wpid;
3560 	int status;
3561 
3562 	ATF_REQUIRE((fpid = fork()) != -1);
3563 	if (fpid == 0) {
3564 		trace_me();
3565 		exit(1);
3566 	}
3567 
3568 	/* The first wait() should report the stop from SIGSTOP. */
3569 	wpid = waitpid(fpid, &status, 0);
3570 	ATF_REQUIRE(wpid == fpid);
3571 	ATF_REQUIRE(WIFSTOPPED(status));
3572 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3573 
3574 	/* Step the child ignoring the SIGSTOP. */
3575 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, 0) == 0);
3576 
3577 	/* The second wait() should report a single-step trap. */
3578 	wpid = waitpid(fpid, &status, 0);
3579 	ATF_REQUIRE(wpid == fpid);
3580 	ATF_REQUIRE(WIFSTOPPED(status));
3581 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3582 
3583 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3584 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3585 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3586 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3587 
3588 	/* Continue the child process. */
3589 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3590 
3591 	/* The last event should be for the child process's exit. */
3592 	wpid = waitpid(fpid, &status, 0);
3593 	ATF_REQUIRE(WIFEXITED(status));
3594 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3595 
3596 	wpid = wait(&status);
3597 	ATF_REQUIRE(wpid == -1);
3598 	ATF_REQUIRE(errno == ECHILD);
3599 }
3600 
3601 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3602 static void *
3603 continue_thread(void *arg __unused)
3604 {
3605 	breakpoint();
3606 	return (NULL);
3607 }
3608 
3609 static __dead2 void
3610 continue_thread_main(void)
3611 {
3612 	pthread_t threads[2];
3613 
3614 	CHILD_REQUIRE(pthread_create(&threads[0], NULL, continue_thread,
3615 	    NULL) == 0);
3616 	CHILD_REQUIRE(pthread_create(&threads[1], NULL, continue_thread,
3617 	    NULL) == 0);
3618 	CHILD_REQUIRE(pthread_join(threads[0], NULL) == 0);
3619 	CHILD_REQUIRE(pthread_join(threads[1], NULL) == 0);
3620 	exit(1);
3621 }
3622 
3623 /*
3624  * Ensure that PT_CONTINUE clears the status of the thread that
3625  * triggered the stop even if a different thread's LWP was passed to
3626  * PT_CONTINUE.
3627  */
3628 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_different_thread);
3629 ATF_TC_BODY(ptrace__PT_CONTINUE_different_thread, tc)
3630 {
3631 	struct ptrace_lwpinfo pl;
3632 	pid_t fpid, wpid;
3633 	lwpid_t lwps[2];
3634 	bool hit_break[2];
3635 	struct reg reg;
3636 	int i, j, status;
3637 
3638 	ATF_REQUIRE((fpid = fork()) != -1);
3639 	if (fpid == 0) {
3640 		trace_me();
3641 		continue_thread_main();
3642 	}
3643 
3644 	/* The first wait() should report the stop from SIGSTOP. */
3645 	wpid = waitpid(fpid, &status, 0);
3646 	ATF_REQUIRE(wpid == fpid);
3647 	ATF_REQUIRE(WIFSTOPPED(status));
3648 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3649 
3650 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3651 	    sizeof(pl)) != -1);
3652 
3653 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
3654 
3655 	/* Continue the child ignoring the SIGSTOP. */
3656 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3657 
3658 	/* One of the new threads should report it's birth. */
3659 	wpid = waitpid(fpid, &status, 0);
3660 	ATF_REQUIRE(wpid == fpid);
3661 	ATF_REQUIRE(WIFSTOPPED(status));
3662 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3663 
3664 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3665 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3666 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3667 	lwps[0] = pl.pl_lwpid;
3668 
3669 	/*
3670 	 * Suspend this thread to ensure both threads are alive before
3671 	 * hitting the breakpoint.
3672 	 */
3673 	ATF_REQUIRE(ptrace(PT_SUSPEND, lwps[0], NULL, 0) != -1);
3674 
3675 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3676 
3677 	/* Second thread should report it's birth. */
3678 	wpid = waitpid(fpid, &status, 0);
3679 	ATF_REQUIRE(wpid == fpid);
3680 	ATF_REQUIRE(WIFSTOPPED(status));
3681 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3682 
3683 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3684 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3685 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3686 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
3687 	lwps[1] = pl.pl_lwpid;
3688 
3689 	/* Resume both threads waiting for breakpoint events. */
3690 	hit_break[0] = hit_break[1] = false;
3691 	ATF_REQUIRE(ptrace(PT_RESUME, lwps[0], NULL, 0) != -1);
3692 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3693 
3694 	/* One thread should report a breakpoint. */
3695 	wpid = waitpid(fpid, &status, 0);
3696 	ATF_REQUIRE(wpid == fpid);
3697 	ATF_REQUIRE(WIFSTOPPED(status));
3698 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3699 
3700 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3701 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3702 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3703 	    pl.pl_siginfo.si_code == TRAP_BRKPT);
3704 	if (pl.pl_lwpid == lwps[0])
3705 		i = 0;
3706 	else
3707 		i = 1;
3708 	hit_break[i] = true;
3709 	ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3710 	SKIP_BREAK(&reg);
3711 	ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3712 
3713 	/*
3714 	 * Resume both threads but pass the other thread's LWPID to
3715 	 * PT_CONTINUE.
3716 	 */
3717 	ATF_REQUIRE(ptrace(PT_CONTINUE, lwps[i ^ 1], (caddr_t)1, 0) == 0);
3718 
3719 	/*
3720 	 * Will now get two thread exit events and one more breakpoint
3721 	 * event.
3722 	 */
3723 	for (j = 0; j < 3; j++) {
3724 		wpid = waitpid(fpid, &status, 0);
3725 		ATF_REQUIRE(wpid == fpid);
3726 		ATF_REQUIRE(WIFSTOPPED(status));
3727 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3728 
3729 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3730 		    sizeof(pl)) != -1);
3731 
3732 		if (pl.pl_lwpid == lwps[0])
3733 			i = 0;
3734 		else
3735 			i = 1;
3736 
3737 		ATF_REQUIRE_MSG(lwps[i] != 0, "event for exited thread");
3738 		if (pl.pl_flags & PL_FLAG_EXITED) {
3739 			ATF_REQUIRE_MSG(hit_break[i],
3740 			    "exited thread did not report breakpoint");
3741 			lwps[i] = 0;
3742 		} else {
3743 			ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3744 			ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3745 			    pl.pl_siginfo.si_code == TRAP_BRKPT);
3746 			ATF_REQUIRE_MSG(!hit_break[i],
3747 			    "double breakpoint event");
3748 			hit_break[i] = true;
3749 			ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg,
3750 			    0) != -1);
3751 			SKIP_BREAK(&reg);
3752 			ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg,
3753 			    0) != -1);
3754 		}
3755 
3756 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3757 	}
3758 
3759 	/* Both threads should have exited. */
3760 	ATF_REQUIRE(lwps[0] == 0);
3761 	ATF_REQUIRE(lwps[1] == 0);
3762 
3763 	/* The last event should be for the child process's exit. */
3764 	wpid = waitpid(fpid, &status, 0);
3765 	ATF_REQUIRE(WIFEXITED(status));
3766 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3767 
3768 	wpid = wait(&status);
3769 	ATF_REQUIRE(wpid == -1);
3770 	ATF_REQUIRE(errno == ECHILD);
3771 }
3772 #endif
3773 
3774 /*
3775  * Verify that PT_LWPINFO doesn't return stale siginfo.
3776  */
3777 ATF_TC_WITHOUT_HEAD(ptrace__PT_LWPINFO_stale_siginfo);
3778 ATF_TC_BODY(ptrace__PT_LWPINFO_stale_siginfo, tc)
3779 {
3780 	struct ptrace_lwpinfo pl;
3781 	pid_t fpid, wpid;
3782 	int events, status;
3783 
3784 	ATF_REQUIRE((fpid = fork()) != -1);
3785 	if (fpid == 0) {
3786 		trace_me();
3787 		raise(SIGABRT);
3788 		exit(1);
3789 	}
3790 
3791 	/* The first wait() should report the stop from SIGSTOP. */
3792 	wpid = waitpid(fpid, &status, 0);
3793 	ATF_REQUIRE(wpid == fpid);
3794 	ATF_REQUIRE(WIFSTOPPED(status));
3795 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3796 
3797 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3798 
3799 	/* The next stop should report the SIGABRT in the child body. */
3800 	wpid = waitpid(fpid, &status, 0);
3801 	ATF_REQUIRE(wpid == fpid);
3802 	ATF_REQUIRE(WIFSTOPPED(status));
3803 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3804 
3805 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3806 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3807 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3808 
3809 	/*
3810 	 * Continue the process ignoring the signal, but enabling
3811 	 * syscall traps.
3812 	 */
3813 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
3814 
3815 	/*
3816 	 * The next stop should report a system call entry from
3817 	 * exit().  PL_FLAGS_SI should not be set.
3818 	 */
3819 	wpid = waitpid(fpid, &status, 0);
3820 	ATF_REQUIRE(wpid == fpid);
3821 	ATF_REQUIRE(WIFSTOPPED(status));
3822 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3823 
3824 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3825 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3826 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) == 0);
3827 
3828 	/* Disable syscall tracing and continue the child to let it exit. */
3829 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
3830 	    sizeof(events)) == 0);
3831 	events &= ~PTRACE_SYSCALL;
3832 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
3833 	    sizeof(events)) == 0);
3834 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3835 
3836 	/* The last event should be for the child process's exit. */
3837 	wpid = waitpid(fpid, &status, 0);
3838 	ATF_REQUIRE(WIFEXITED(status));
3839 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3840 
3841 	wpid = wait(&status);
3842 	ATF_REQUIRE(wpid == -1);
3843 	ATF_REQUIRE(errno == ECHILD);
3844 }
3845 
3846 ATF_TP_ADD_TCS(tp)
3847 {
3848 
3849 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
3850 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
3851 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
3852 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
3853 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
3854 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
3855 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
3856 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
3857 	ATF_TP_ADD_TC(tp,
3858 	    ptrace__follow_fork_child_detached_unrelated_debugger);
3859 	ATF_TP_ADD_TC(tp,
3860 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
3861 	ATF_TP_ADD_TC(tp, ptrace__getppid);
3862 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
3863 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
3864 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
3865 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
3866 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
3867 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
3868 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
3869 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
3870 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
3871 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
3872 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
3873 #ifdef HAVE_BREAKPOINT
3874 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
3875 #endif
3876 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
3877 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
3878 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
3879 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
3880 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
3881 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
3882 	ATF_TP_ADD_TC(tp,
3883 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
3884 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
3885 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
3886 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
3887 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
3888 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
3889 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
3890 	ATF_TP_ADD_TC(tp, ptrace__killed_with_sigmask);
3891 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigmask);
3892 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3893 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
3894 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
3895 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
3896 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
3897 	ATF_TP_ADD_TC(tp, ptrace__PT_STEP_with_signal);
3898 #ifdef HAVE_BREAKPOINT
3899 	ATF_TP_ADD_TC(tp, ptrace__breakpoint_siginfo);
3900 #endif
3901 	ATF_TP_ADD_TC(tp, ptrace__step_siginfo);
3902 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3903 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_different_thread);
3904 #endif
3905 	ATF_TP_ADD_TC(tp, ptrace__PT_LWPINFO_stale_siginfo);
3906 
3907 	return (atf_no_error());
3908 }
3909