xref: /freebsd/tests/sys/kern/ptrace_test.c (revision f0574f5cf69e168cc4ea71ebbe5fdec9ec9a3dfe)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/types.h>
31 #include <sys/cpuset.h>
32 #include <sys/event.h>
33 #include <sys/time.h>
34 #include <sys/procctl.h>
35 #include <sys/ptrace.h>
36 #include <sys/queue.h>
37 #include <sys/runq.h>
38 #include <sys/syscall.h>
39 #include <sys/sysctl.h>
40 #include <sys/user.h>
41 #include <sys/wait.h>
42 #include <errno.h>
43 #include <machine/cpufunc.h>
44 #include <pthread.h>
45 #include <sched.h>
46 #include <semaphore.h>
47 #include <signal.h>
48 #include <stdio.h>
49 #include <stdlib.h>
50 #include <unistd.h>
51 #include <atf-c.h>
52 
53 /*
54  * A variant of ATF_REQUIRE that is suitable for use in child
55  * processes.  This only works if the parent process is tripped up by
56  * the early exit and fails some requirement itself.
57  */
58 #define	CHILD_REQUIRE(exp) do {						\
59 		if (!(exp))						\
60 			child_fail_require(__FILE__, __LINE__,		\
61 			    #exp " not met");				\
62 	} while (0)
63 
64 static __dead2 void
65 child_fail_require(const char *file, int line, const char *str)
66 {
67 	char buf[128];
68 
69 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
70 	write(2, buf, strlen(buf));
71 	_exit(32);
72 }
73 
74 static void
75 trace_me(void)
76 {
77 
78 	/* Attach the parent process as a tracer of this process. */
79 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
80 
81 	/* Trigger a stop. */
82 	raise(SIGSTOP);
83 }
84 
85 static void
86 attach_child(pid_t pid)
87 {
88 	pid_t wpid;
89 	int status;
90 
91 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
92 
93 	wpid = waitpid(pid, &status, 0);
94 	ATF_REQUIRE(wpid == pid);
95 	ATF_REQUIRE(WIFSTOPPED(status));
96 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
97 }
98 
99 static void
100 wait_for_zombie(pid_t pid)
101 {
102 
103 	/*
104 	 * Wait for a process to exit.  This is kind of gross, but
105 	 * there is not a better way.
106 	 */
107 	for (;;) {
108 		struct kinfo_proc kp;
109 		size_t len;
110 		int mib[4];
111 
112 		mib[0] = CTL_KERN;
113 		mib[1] = KERN_PROC;
114 		mib[2] = KERN_PROC_PID;
115 		mib[3] = pid;
116 		len = sizeof(kp);
117 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
118 			/* The KERN_PROC_PID sysctl fails for zombies. */
119 			ATF_REQUIRE(errno == ESRCH);
120 			break;
121 		}
122 		usleep(5000);
123 	}
124 }
125 
126 /*
127  * Verify that a parent debugger process "sees" the exit of a debugged
128  * process exactly once when attached via PT_TRACE_ME.
129  */
130 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
131 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
132 {
133 	pid_t child, wpid;
134 	int status;
135 
136 	ATF_REQUIRE((child = fork()) != -1);
137 	if (child == 0) {
138 		/* Child process. */
139 		trace_me();
140 
141 		_exit(1);
142 	}
143 
144 	/* Parent process. */
145 
146 	/* The first wait() should report the stop from SIGSTOP. */
147 	wpid = waitpid(child, &status, 0);
148 	ATF_REQUIRE(wpid == child);
149 	ATF_REQUIRE(WIFSTOPPED(status));
150 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
151 
152 	/* Continue the child ignoring the SIGSTOP. */
153 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
154 
155 	/* The second wait() should report the exit status. */
156 	wpid = waitpid(child, &status, 0);
157 	ATF_REQUIRE(wpid == child);
158 	ATF_REQUIRE(WIFEXITED(status));
159 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
160 
161 	/* The child should no longer exist. */
162 	wpid = waitpid(child, &status, 0);
163 	ATF_REQUIRE(wpid == -1);
164 	ATF_REQUIRE(errno == ECHILD);
165 }
166 
167 /*
168  * Verify that a parent debugger process "sees" the exit of a debugged
169  * process exactly once when attached via PT_ATTACH.
170  */
171 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
172 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
173 {
174 	pid_t child, wpid;
175 	int cpipe[2], status;
176 	char c;
177 
178 	ATF_REQUIRE(pipe(cpipe) == 0);
179 	ATF_REQUIRE((child = fork()) != -1);
180 	if (child == 0) {
181 		/* Child process. */
182 		close(cpipe[0]);
183 
184 		/* Wait for the parent to attach. */
185 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
186 
187 		_exit(1);
188 	}
189 	close(cpipe[1]);
190 
191 	/* Parent process. */
192 
193 	/* Attach to the child process. */
194 	attach_child(child);
195 
196 	/* Continue the child ignoring the SIGSTOP. */
197 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
198 
199 	/* Signal the child to exit. */
200 	close(cpipe[0]);
201 
202 	/* The second wait() should report the exit status. */
203 	wpid = waitpid(child, &status, 0);
204 	ATF_REQUIRE(wpid == child);
205 	ATF_REQUIRE(WIFEXITED(status));
206 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
207 
208 	/* The child should no longer exist. */
209 	wpid = waitpid(child, &status, 0);
210 	ATF_REQUIRE(wpid == -1);
211 	ATF_REQUIRE(errno == ECHILD);
212 }
213 
214 /*
215  * Verify that a parent process "sees" the exit of a debugged process only
216  * after the debugger has seen it.
217  */
218 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
219 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
220 {
221 	pid_t child, debugger, wpid;
222 	int cpipe[2], dpipe[2], status;
223 	char c;
224 
225 	ATF_REQUIRE(pipe(cpipe) == 0);
226 	ATF_REQUIRE((child = fork()) != -1);
227 
228 	if (child == 0) {
229 		/* Child process. */
230 		close(cpipe[0]);
231 
232 		/* Wait for parent to be ready. */
233 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
234 
235 		_exit(1);
236 	}
237 	close(cpipe[1]);
238 
239 	ATF_REQUIRE(pipe(dpipe) == 0);
240 	ATF_REQUIRE((debugger = fork()) != -1);
241 
242 	if (debugger == 0) {
243 		/* Debugger process. */
244 		close(dpipe[0]);
245 
246 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
247 
248 		wpid = waitpid(child, &status, 0);
249 		CHILD_REQUIRE(wpid == child);
250 		CHILD_REQUIRE(WIFSTOPPED(status));
251 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
252 
253 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
254 
255 		/* Signal parent that debugger is attached. */
256 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
257 
258 		/* Wait for parent's failed wait. */
259 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
260 
261 		wpid = waitpid(child, &status, 0);
262 		CHILD_REQUIRE(wpid == child);
263 		CHILD_REQUIRE(WIFEXITED(status));
264 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
265 
266 		_exit(0);
267 	}
268 	close(dpipe[1]);
269 
270 	/* Parent process. */
271 
272 	/* Wait for the debugger to attach to the child. */
273 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
274 
275 	/* Release the child. */
276 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
277 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
278 	close(cpipe[0]);
279 
280 	wait_for_zombie(child);
281 
282 	/*
283 	 * This wait should return a pid of 0 to indicate no status to
284 	 * report.  The parent should see the child as non-exited
285 	 * until the debugger sees the exit.
286 	 */
287 	wpid = waitpid(child, &status, WNOHANG);
288 	ATF_REQUIRE(wpid == 0);
289 
290 	/* Signal the debugger to wait for the child. */
291 	close(dpipe[0]);
292 
293 	/* Wait for the debugger. */
294 	wpid = waitpid(debugger, &status, 0);
295 	ATF_REQUIRE(wpid == debugger);
296 	ATF_REQUIRE(WIFEXITED(status));
297 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
298 
299 	/* The child process should now be ready. */
300 	wpid = waitpid(child, &status, WNOHANG);
301 	ATF_REQUIRE(wpid == child);
302 	ATF_REQUIRE(WIFEXITED(status));
303 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
304 }
305 
306 /*
307  * Verify that a parent process "sees" the exit of a debugged process
308  * only after a non-direct-child debugger has seen it.  In particular,
309  * various wait() calls in the parent must avoid failing with ESRCH by
310  * checking the parent's orphan list for the debugee.
311  */
312 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
313 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
314 {
315 	pid_t child, debugger, fpid, wpid;
316 	int cpipe[2], dpipe[2], status;
317 	char c;
318 
319 	ATF_REQUIRE(pipe(cpipe) == 0);
320 	ATF_REQUIRE((child = fork()) != -1);
321 
322 	if (child == 0) {
323 		/* Child process. */
324 		close(cpipe[0]);
325 
326 		/* Wait for parent to be ready. */
327 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
328 
329 		_exit(1);
330 	}
331 	close(cpipe[1]);
332 
333 	ATF_REQUIRE(pipe(dpipe) == 0);
334 	ATF_REQUIRE((debugger = fork()) != -1);
335 
336 	if (debugger == 0) {
337 		/* Debugger parent. */
338 
339 		/*
340 		 * Fork again and drop the debugger parent so that the
341 		 * debugger is not a child of the main parent.
342 		 */
343 		CHILD_REQUIRE((fpid = fork()) != -1);
344 		if (fpid != 0)
345 			_exit(2);
346 
347 		/* Debugger process. */
348 		close(dpipe[0]);
349 
350 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
351 
352 		wpid = waitpid(child, &status, 0);
353 		CHILD_REQUIRE(wpid == child);
354 		CHILD_REQUIRE(WIFSTOPPED(status));
355 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
356 
357 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
358 
359 		/* Signal parent that debugger is attached. */
360 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
361 
362 		/* Wait for parent's failed wait. */
363 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
364 
365 		wpid = waitpid(child, &status, 0);
366 		CHILD_REQUIRE(wpid == child);
367 		CHILD_REQUIRE(WIFEXITED(status));
368 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
369 
370 		_exit(0);
371 	}
372 	close(dpipe[1]);
373 
374 	/* Parent process. */
375 
376 	/* Wait for the debugger parent process to exit. */
377 	wpid = waitpid(debugger, &status, 0);
378 	ATF_REQUIRE(wpid == debugger);
379 	ATF_REQUIRE(WIFEXITED(status));
380 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
381 
382 	/* A WNOHANG wait here should see the non-exited child. */
383 	wpid = waitpid(child, &status, WNOHANG);
384 	ATF_REQUIRE(wpid == 0);
385 
386 	/* Wait for the debugger to attach to the child. */
387 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
388 
389 	/* Release the child. */
390 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
391 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
392 	close(cpipe[0]);
393 
394 	wait_for_zombie(child);
395 
396 	/*
397 	 * This wait should return a pid of 0 to indicate no status to
398 	 * report.  The parent should see the child as non-exited
399 	 * until the debugger sees the exit.
400 	 */
401 	wpid = waitpid(child, &status, WNOHANG);
402 	ATF_REQUIRE(wpid == 0);
403 
404 	/* Signal the debugger to wait for the child. */
405 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
406 
407 	/* Wait for the debugger. */
408 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
409 	close(dpipe[0]);
410 
411 	/* The child process should now be ready. */
412 	wpid = waitpid(child, &status, WNOHANG);
413 	ATF_REQUIRE(wpid == child);
414 	ATF_REQUIRE(WIFEXITED(status));
415 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
416 }
417 
418 /*
419  * The parent process should always act the same regardless of how the
420  * debugger is attached to it.
421  */
422 static __dead2 void
423 follow_fork_parent(bool use_vfork)
424 {
425 	pid_t fpid, wpid;
426 	int status;
427 
428 	if (use_vfork)
429 		CHILD_REQUIRE((fpid = vfork()) != -1);
430 	else
431 		CHILD_REQUIRE((fpid = fork()) != -1);
432 
433 	if (fpid == 0)
434 		/* Child */
435 		_exit(2);
436 
437 	wpid = waitpid(fpid, &status, 0);
438 	CHILD_REQUIRE(wpid == fpid);
439 	CHILD_REQUIRE(WIFEXITED(status));
440 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
441 
442 	_exit(1);
443 }
444 
445 /*
446  * Helper routine for follow fork tests.  This waits for two stops
447  * that report both "sides" of a fork.  It returns the pid of the new
448  * child process.
449  */
450 static pid_t
451 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
452 {
453 	struct ptrace_lwpinfo pl;
454 	bool fork_reported[2];
455 	pid_t child, wpid;
456 	int i, status;
457 
458 	fork_reported[0] = false;
459 	fork_reported[1] = false;
460 	child = -1;
461 
462 	/*
463 	 * Each process should report a fork event.  The parent should
464 	 * report a PL_FLAG_FORKED event, and the child should report
465 	 * a PL_FLAG_CHILD event.
466 	 */
467 	for (i = 0; i < 2; i++) {
468 		wpid = wait(&status);
469 		ATF_REQUIRE(wpid > 0);
470 		ATF_REQUIRE(WIFSTOPPED(status));
471 
472 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
473 		    sizeof(pl)) != -1);
474 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
475 		    0);
476 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
477 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
478 		if (pl.pl_flags & PL_FLAG_CHILD) {
479 			ATF_REQUIRE(wpid != parent);
480 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
481 			ATF_REQUIRE(!fork_reported[1]);
482 			if (child == -1)
483 				child = wpid;
484 			else
485 				ATF_REQUIRE(child == wpid);
486 			if (ppl != NULL)
487 				ppl[1] = pl;
488 			fork_reported[1] = true;
489 		} else {
490 			ATF_REQUIRE(wpid == parent);
491 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
492 			ATF_REQUIRE(!fork_reported[0]);
493 			if (child == -1)
494 				child = pl.pl_child_pid;
495 			else
496 				ATF_REQUIRE(child == pl.pl_child_pid);
497 			if (ppl != NULL)
498 				ppl[0] = pl;
499 			fork_reported[0] = true;
500 		}
501 	}
502 
503 	return (child);
504 }
505 
506 /*
507  * Verify that a new child process is stopped after a followed fork and
508  * that the traced parent sees the exit of the child after the debugger
509  * when both processes remain attached to the debugger.
510  */
511 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
512 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
513 {
514 	pid_t children[2], fpid, wpid;
515 	int status;
516 
517 	ATF_REQUIRE((fpid = fork()) != -1);
518 	if (fpid == 0) {
519 		trace_me();
520 		follow_fork_parent(false);
521 	}
522 
523 	/* Parent process. */
524 	children[0] = fpid;
525 
526 	/* The first wait() should report the stop from SIGSTOP. */
527 	wpid = waitpid(children[0], &status, 0);
528 	ATF_REQUIRE(wpid == children[0]);
529 	ATF_REQUIRE(WIFSTOPPED(status));
530 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
531 
532 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
533 
534 	/* Continue the child ignoring the SIGSTOP. */
535 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
536 
537 	children[1] = handle_fork_events(children[0], NULL);
538 	ATF_REQUIRE(children[1] > 0);
539 
540 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
541 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
542 
543 	/*
544 	 * The child can't exit until the grandchild reports status, so the
545 	 * grandchild should report its exit first to the debugger.
546 	 */
547 	wpid = wait(&status);
548 	ATF_REQUIRE(wpid == children[1]);
549 	ATF_REQUIRE(WIFEXITED(status));
550 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
551 
552 	wpid = wait(&status);
553 	ATF_REQUIRE(wpid == children[0]);
554 	ATF_REQUIRE(WIFEXITED(status));
555 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
556 
557 	wpid = wait(&status);
558 	ATF_REQUIRE(wpid == -1);
559 	ATF_REQUIRE(errno == ECHILD);
560 }
561 
562 /*
563  * Verify that a new child process is stopped after a followed fork
564  * and that the traced parent sees the exit of the child when the new
565  * child process is detached after it reports its fork.
566  */
567 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
568 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
569 {
570 	pid_t children[2], fpid, wpid;
571 	int status;
572 
573 	ATF_REQUIRE((fpid = fork()) != -1);
574 	if (fpid == 0) {
575 		trace_me();
576 		follow_fork_parent(false);
577 	}
578 
579 	/* Parent process. */
580 	children[0] = fpid;
581 
582 	/* The first wait() should report the stop from SIGSTOP. */
583 	wpid = waitpid(children[0], &status, 0);
584 	ATF_REQUIRE(wpid == children[0]);
585 	ATF_REQUIRE(WIFSTOPPED(status));
586 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
587 
588 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
589 
590 	/* Continue the child ignoring the SIGSTOP. */
591 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
592 
593 	children[1] = handle_fork_events(children[0], NULL);
594 	ATF_REQUIRE(children[1] > 0);
595 
596 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
597 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
598 
599 	/*
600 	 * Should not see any status from the grandchild now, only the
601 	 * child.
602 	 */
603 	wpid = wait(&status);
604 	ATF_REQUIRE(wpid == children[0]);
605 	ATF_REQUIRE(WIFEXITED(status));
606 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
607 
608 	wpid = wait(&status);
609 	ATF_REQUIRE(wpid == -1);
610 	ATF_REQUIRE(errno == ECHILD);
611 }
612 
613 /*
614  * Verify that a new child process is stopped after a followed fork
615  * and that the traced parent sees the exit of the child when the
616  * traced parent is detached after the fork.
617  */
618 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
619 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
620 {
621 	pid_t children[2], fpid, wpid;
622 	int status;
623 
624 	ATF_REQUIRE((fpid = fork()) != -1);
625 	if (fpid == 0) {
626 		trace_me();
627 		follow_fork_parent(false);
628 	}
629 
630 	/* Parent process. */
631 	children[0] = fpid;
632 
633 	/* The first wait() should report the stop from SIGSTOP. */
634 	wpid = waitpid(children[0], &status, 0);
635 	ATF_REQUIRE(wpid == children[0]);
636 	ATF_REQUIRE(WIFSTOPPED(status));
637 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
638 
639 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
640 
641 	/* Continue the child ignoring the SIGSTOP. */
642 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
643 
644 	children[1] = handle_fork_events(children[0], NULL);
645 	ATF_REQUIRE(children[1] > 0);
646 
647 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
648 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
649 
650 	/*
651 	 * The child can't exit until the grandchild reports status, so the
652 	 * grandchild should report its exit first to the debugger.
653 	 *
654 	 * Even though the child process is detached, it is still a
655 	 * child of the debugger, so it will still report it's exit
656 	 * after the grandchild.
657 	 */
658 	wpid = wait(&status);
659 	ATF_REQUIRE(wpid == children[1]);
660 	ATF_REQUIRE(WIFEXITED(status));
661 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
662 
663 	wpid = wait(&status);
664 	ATF_REQUIRE(wpid == children[0]);
665 	ATF_REQUIRE(WIFEXITED(status));
666 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
667 
668 	wpid = wait(&status);
669 	ATF_REQUIRE(wpid == -1);
670 	ATF_REQUIRE(errno == ECHILD);
671 }
672 
673 static void
674 attach_fork_parent(int cpipe[2])
675 {
676 	pid_t fpid;
677 
678 	close(cpipe[0]);
679 
680 	/* Double-fork to disassociate from the debugger. */
681 	CHILD_REQUIRE((fpid = fork()) != -1);
682 	if (fpid != 0)
683 		_exit(3);
684 
685 	/* Send the pid of the disassociated child to the debugger. */
686 	fpid = getpid();
687 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
688 
689 	/* Wait for the debugger to attach. */
690 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
691 }
692 
693 /*
694  * Verify that a new child process is stopped after a followed fork and
695  * that the traced parent sees the exit of the child after the debugger
696  * when both processes remain attached to the debugger.  In this test
697  * the parent that forks is not a direct child of the debugger.
698  */
699 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
700 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
701 {
702 	pid_t children[2], fpid, wpid;
703 	int cpipe[2], status;
704 
705 	ATF_REQUIRE(pipe(cpipe) == 0);
706 	ATF_REQUIRE((fpid = fork()) != -1);
707 	if (fpid == 0) {
708 		attach_fork_parent(cpipe);
709 		follow_fork_parent(false);
710 	}
711 
712 	/* Parent process. */
713 	close(cpipe[1]);
714 
715 	/* Wait for the direct child to exit. */
716 	wpid = waitpid(fpid, &status, 0);
717 	ATF_REQUIRE(wpid == fpid);
718 	ATF_REQUIRE(WIFEXITED(status));
719 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
720 
721 	/* Read the pid of the fork parent. */
722 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
723 	    sizeof(children[0]));
724 
725 	/* Attach to the fork parent. */
726 	attach_child(children[0]);
727 
728 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
729 
730 	/* Continue the fork parent ignoring the SIGSTOP. */
731 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
732 
733 	/* Signal the fork parent to continue. */
734 	close(cpipe[0]);
735 
736 	children[1] = handle_fork_events(children[0], NULL);
737 	ATF_REQUIRE(children[1] > 0);
738 
739 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
740 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
741 
742 	/*
743 	 * The fork parent can't exit until the child reports status,
744 	 * so the child should report its exit first to the debugger.
745 	 */
746 	wpid = wait(&status);
747 	ATF_REQUIRE(wpid == children[1]);
748 	ATF_REQUIRE(WIFEXITED(status));
749 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
750 
751 	wpid = wait(&status);
752 	ATF_REQUIRE(wpid == children[0]);
753 	ATF_REQUIRE(WIFEXITED(status));
754 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
755 
756 	wpid = wait(&status);
757 	ATF_REQUIRE(wpid == -1);
758 	ATF_REQUIRE(errno == ECHILD);
759 }
760 
761 /*
762  * Verify that a new child process is stopped after a followed fork
763  * and that the traced parent sees the exit of the child when the new
764  * child process is detached after it reports its fork.  In this test
765  * the parent that forks is not a direct child of the debugger.
766  */
767 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
768 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
769 {
770 	pid_t children[2], fpid, wpid;
771 	int cpipe[2], status;
772 
773 	ATF_REQUIRE(pipe(cpipe) == 0);
774 	ATF_REQUIRE((fpid = fork()) != -1);
775 	if (fpid == 0) {
776 		attach_fork_parent(cpipe);
777 		follow_fork_parent(false);
778 	}
779 
780 	/* Parent process. */
781 	close(cpipe[1]);
782 
783 	/* Wait for the direct child to exit. */
784 	wpid = waitpid(fpid, &status, 0);
785 	ATF_REQUIRE(wpid == fpid);
786 	ATF_REQUIRE(WIFEXITED(status));
787 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
788 
789 	/* Read the pid of the fork parent. */
790 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
791 	    sizeof(children[0]));
792 
793 	/* Attach to the fork parent. */
794 	attach_child(children[0]);
795 
796 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
797 
798 	/* Continue the fork parent ignoring the SIGSTOP. */
799 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
800 
801 	/* Signal the fork parent to continue. */
802 	close(cpipe[0]);
803 
804 	children[1] = handle_fork_events(children[0], NULL);
805 	ATF_REQUIRE(children[1] > 0);
806 
807 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
808 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
809 
810 	/*
811 	 * Should not see any status from the child now, only the fork
812 	 * parent.
813 	 */
814 	wpid = wait(&status);
815 	ATF_REQUIRE(wpid == children[0]);
816 	ATF_REQUIRE(WIFEXITED(status));
817 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
818 
819 	wpid = wait(&status);
820 	ATF_REQUIRE(wpid == -1);
821 	ATF_REQUIRE(errno == ECHILD);
822 }
823 
824 /*
825  * Verify that a new child process is stopped after a followed fork
826  * and that the traced parent sees the exit of the child when the
827  * traced parent is detached after the fork.  In this test the parent
828  * that forks is not a direct child of the debugger.
829  */
830 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
831 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
832 {
833 	pid_t children[2], fpid, wpid;
834 	int cpipe[2], status;
835 
836 	ATF_REQUIRE(pipe(cpipe) == 0);
837 	ATF_REQUIRE((fpid = fork()) != -1);
838 	if (fpid == 0) {
839 		attach_fork_parent(cpipe);
840 		follow_fork_parent(false);
841 	}
842 
843 	/* Parent process. */
844 	close(cpipe[1]);
845 
846 	/* Wait for the direct child to exit. */
847 	wpid = waitpid(fpid, &status, 0);
848 	ATF_REQUIRE(wpid == fpid);
849 	ATF_REQUIRE(WIFEXITED(status));
850 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
851 
852 	/* Read the pid of the fork parent. */
853 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
854 	    sizeof(children[0]));
855 
856 	/* Attach to the fork parent. */
857 	attach_child(children[0]);
858 
859 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
860 
861 	/* Continue the fork parent ignoring the SIGSTOP. */
862 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
863 
864 	/* Signal the fork parent to continue. */
865 	close(cpipe[0]);
866 
867 	children[1] = handle_fork_events(children[0], NULL);
868 	ATF_REQUIRE(children[1] > 0);
869 
870 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
871 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
872 
873 	/*
874 	 * Should not see any status from the fork parent now, only
875 	 * the child.
876 	 */
877 	wpid = wait(&status);
878 	ATF_REQUIRE(wpid == children[1]);
879 	ATF_REQUIRE(WIFEXITED(status));
880 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
881 
882 	wpid = wait(&status);
883 	ATF_REQUIRE(wpid == -1);
884 	ATF_REQUIRE(errno == ECHILD);
885 }
886 
887 /*
888  * Verify that a child process does not see an unrelated debugger as its
889  * parent but sees its original parent process.
890  */
891 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
892 ATF_TC_BODY(ptrace__getppid, tc)
893 {
894 	pid_t child, debugger, ppid, wpid;
895 	int cpipe[2], dpipe[2], status;
896 	char c;
897 
898 	ATF_REQUIRE(pipe(cpipe) == 0);
899 	ATF_REQUIRE((child = fork()) != -1);
900 
901 	if (child == 0) {
902 		/* Child process. */
903 		close(cpipe[0]);
904 
905 		/* Wait for parent to be ready. */
906 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
907 
908 		/* Report the parent PID to the parent. */
909 		ppid = getppid();
910 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
911 		    sizeof(ppid));
912 
913 		_exit(1);
914 	}
915 	close(cpipe[1]);
916 
917 	ATF_REQUIRE(pipe(dpipe) == 0);
918 	ATF_REQUIRE((debugger = fork()) != -1);
919 
920 	if (debugger == 0) {
921 		/* Debugger process. */
922 		close(dpipe[0]);
923 
924 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
925 
926 		wpid = waitpid(child, &status, 0);
927 		CHILD_REQUIRE(wpid == child);
928 		CHILD_REQUIRE(WIFSTOPPED(status));
929 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
930 
931 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
932 
933 		/* Signal parent that debugger is attached. */
934 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
935 
936 		/* Wait for traced child to exit. */
937 		wpid = waitpid(child, &status, 0);
938 		CHILD_REQUIRE(wpid == child);
939 		CHILD_REQUIRE(WIFEXITED(status));
940 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
941 
942 		_exit(0);
943 	}
944 	close(dpipe[1]);
945 
946 	/* Parent process. */
947 
948 	/* Wait for the debugger to attach to the child. */
949 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
950 
951 	/* Release the child. */
952 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
953 
954 	/* Read the parent PID from the child. */
955 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
956 	close(cpipe[0]);
957 
958 	ATF_REQUIRE(ppid == getpid());
959 
960 	/* Wait for the debugger. */
961 	wpid = waitpid(debugger, &status, 0);
962 	ATF_REQUIRE(wpid == debugger);
963 	ATF_REQUIRE(WIFEXITED(status));
964 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
965 
966 	/* The child process should now be ready. */
967 	wpid = waitpid(child, &status, WNOHANG);
968 	ATF_REQUIRE(wpid == child);
969 	ATF_REQUIRE(WIFEXITED(status));
970 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
971 }
972 
973 /*
974  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
975  * child process created via fork() reports the correct value.
976  */
977 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
978 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
979 {
980 	struct ptrace_lwpinfo pl[2];
981 	pid_t children[2], fpid, wpid;
982 	int status;
983 
984 	ATF_REQUIRE((fpid = fork()) != -1);
985 	if (fpid == 0) {
986 		trace_me();
987 		follow_fork_parent(false);
988 	}
989 
990 	/* Parent process. */
991 	children[0] = fpid;
992 
993 	/* The first wait() should report the stop from SIGSTOP. */
994 	wpid = waitpid(children[0], &status, 0);
995 	ATF_REQUIRE(wpid == children[0]);
996 	ATF_REQUIRE(WIFSTOPPED(status));
997 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
998 
999 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1000 
1001 	/* Continue the child ignoring the SIGSTOP. */
1002 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1003 
1004 	/* Wait for both halves of the fork event to get reported. */
1005 	children[1] = handle_fork_events(children[0], pl);
1006 	ATF_REQUIRE(children[1] > 0);
1007 
1008 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1009 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1010 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1011 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1012 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1013 
1014 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1015 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1016 
1017 	/*
1018 	 * The child can't exit until the grandchild reports status, so the
1019 	 * grandchild should report its exit first to the debugger.
1020 	 */
1021 	wpid = wait(&status);
1022 	ATF_REQUIRE(wpid == children[1]);
1023 	ATF_REQUIRE(WIFEXITED(status));
1024 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1025 
1026 	wpid = wait(&status);
1027 	ATF_REQUIRE(wpid == children[0]);
1028 	ATF_REQUIRE(WIFEXITED(status));
1029 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1030 
1031 	wpid = wait(&status);
1032 	ATF_REQUIRE(wpid == -1);
1033 	ATF_REQUIRE(errno == ECHILD);
1034 }
1035 
1036 /*
1037  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1038  * child process created via vfork() reports the correct value.
1039  */
1040 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1041 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1042 {
1043 	struct ptrace_lwpinfo pl[2];
1044 	pid_t children[2], fpid, wpid;
1045 	int status;
1046 
1047 	ATF_REQUIRE((fpid = fork()) != -1);
1048 	if (fpid == 0) {
1049 		trace_me();
1050 		follow_fork_parent(true);
1051 	}
1052 
1053 	/* Parent process. */
1054 	children[0] = fpid;
1055 
1056 	/* The first wait() should report the stop from SIGSTOP. */
1057 	wpid = waitpid(children[0], &status, 0);
1058 	ATF_REQUIRE(wpid == children[0]);
1059 	ATF_REQUIRE(WIFSTOPPED(status));
1060 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1061 
1062 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1063 
1064 	/* Continue the child ignoring the SIGSTOP. */
1065 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1066 
1067 	/* Wait for both halves of the fork event to get reported. */
1068 	children[1] = handle_fork_events(children[0], pl);
1069 	ATF_REQUIRE(children[1] > 0);
1070 
1071 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1072 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1073 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1074 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1075 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1076 
1077 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1078 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1079 
1080 	/*
1081 	 * The child can't exit until the grandchild reports status, so the
1082 	 * grandchild should report its exit first to the debugger.
1083 	 */
1084 	wpid = wait(&status);
1085 	ATF_REQUIRE(wpid == children[1]);
1086 	ATF_REQUIRE(WIFEXITED(status));
1087 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1088 
1089 	wpid = wait(&status);
1090 	ATF_REQUIRE(wpid == children[0]);
1091 	ATF_REQUIRE(WIFEXITED(status));
1092 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1093 
1094 	wpid = wait(&status);
1095 	ATF_REQUIRE(wpid == -1);
1096 	ATF_REQUIRE(errno == ECHILD);
1097 }
1098 
1099 static void *
1100 simple_thread(void *arg __unused)
1101 {
1102 
1103 	pthread_exit(NULL);
1104 }
1105 
1106 static __dead2 void
1107 simple_thread_main(void)
1108 {
1109 	pthread_t thread;
1110 
1111 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1112 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1113 	exit(1);
1114 }
1115 
1116 /*
1117  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1118  * thread reports the correct value.
1119  */
1120 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1121 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1122 {
1123 	struct ptrace_lwpinfo pl;
1124 	pid_t fpid, wpid;
1125 	lwpid_t mainlwp;
1126 	int status;
1127 
1128 	ATF_REQUIRE((fpid = fork()) != -1);
1129 	if (fpid == 0) {
1130 		trace_me();
1131 		simple_thread_main();
1132 	}
1133 
1134 	/* The first wait() should report the stop from SIGSTOP. */
1135 	wpid = waitpid(fpid, &status, 0);
1136 	ATF_REQUIRE(wpid == fpid);
1137 	ATF_REQUIRE(WIFSTOPPED(status));
1138 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1139 
1140 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1141 	    sizeof(pl)) != -1);
1142 	mainlwp = pl.pl_lwpid;
1143 
1144 	/*
1145 	 * Continue the child ignoring the SIGSTOP and tracing all
1146 	 * system call exits.
1147 	 */
1148 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1149 
1150 	/*
1151 	 * Wait for the new thread to arrive.  pthread_create() might
1152 	 * invoke any number of system calls.  For now we just wait
1153 	 * for the new thread to arrive and make sure it reports a
1154 	 * valid system call code.  If ptrace grows thread event
1155 	 * reporting then this test can be made more precise.
1156 	 */
1157 	for (;;) {
1158 		wpid = waitpid(fpid, &status, 0);
1159 		ATF_REQUIRE(wpid == fpid);
1160 		ATF_REQUIRE(WIFSTOPPED(status));
1161 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1162 
1163 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1164 		    sizeof(pl)) != -1);
1165 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1166 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1167 		if (pl.pl_lwpid != mainlwp)
1168 			/* New thread seen. */
1169 			break;
1170 
1171 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1172 	}
1173 
1174 	/* Wait for the child to exit. */
1175 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1176 	for (;;) {
1177 		wpid = waitpid(fpid, &status, 0);
1178 		ATF_REQUIRE(wpid == fpid);
1179 		if (WIFEXITED(status))
1180 			break;
1181 
1182 		ATF_REQUIRE(WIFSTOPPED(status));
1183 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1184 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1185 	}
1186 
1187 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1188 
1189 	wpid = wait(&status);
1190 	ATF_REQUIRE(wpid == -1);
1191 	ATF_REQUIRE(errno == ECHILD);
1192 }
1193 
1194 /*
1195  * Verify that the expected LWP events are reported for a child thread.
1196  */
1197 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1198 ATF_TC_BODY(ptrace__lwp_events, tc)
1199 {
1200 	struct ptrace_lwpinfo pl;
1201 	pid_t fpid, wpid;
1202 	lwpid_t lwps[2];
1203 	int status;
1204 
1205 	ATF_REQUIRE((fpid = fork()) != -1);
1206 	if (fpid == 0) {
1207 		trace_me();
1208 		simple_thread_main();
1209 	}
1210 
1211 	/* The first wait() should report the stop from SIGSTOP. */
1212 	wpid = waitpid(fpid, &status, 0);
1213 	ATF_REQUIRE(wpid == fpid);
1214 	ATF_REQUIRE(WIFSTOPPED(status));
1215 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1216 
1217 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1218 	    sizeof(pl)) != -1);
1219 	lwps[0] = pl.pl_lwpid;
1220 
1221 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1222 
1223 	/* Continue the child ignoring the SIGSTOP. */
1224 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1225 
1226 	/* The first event should be for the child thread's birth. */
1227 	wpid = waitpid(fpid, &status, 0);
1228 	ATF_REQUIRE(wpid == fpid);
1229 	ATF_REQUIRE(WIFSTOPPED(status));
1230 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1231 
1232 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1233 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1234 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1235 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1236 	lwps[1] = pl.pl_lwpid;
1237 
1238 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1239 
1240 	/* The next event should be for the child thread's death. */
1241 	wpid = waitpid(fpid, &status, 0);
1242 	ATF_REQUIRE(wpid == fpid);
1243 	ATF_REQUIRE(WIFSTOPPED(status));
1244 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1245 
1246 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1247 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1248 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1249 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1250 
1251 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1252 
1253 	/* The last event should be for the child process's exit. */
1254 	wpid = waitpid(fpid, &status, 0);
1255 	ATF_REQUIRE(WIFEXITED(status));
1256 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1257 
1258 	wpid = wait(&status);
1259 	ATF_REQUIRE(wpid == -1);
1260 	ATF_REQUIRE(errno == ECHILD);
1261 }
1262 
1263 static void *
1264 exec_thread(void *arg __unused)
1265 {
1266 
1267 	execl("/usr/bin/true", "true", NULL);
1268 	exit(127);
1269 }
1270 
1271 static __dead2 void
1272 exec_thread_main(void)
1273 {
1274 	pthread_t thread;
1275 
1276 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1277 	for (;;)
1278 		sleep(60);
1279 	exit(1);
1280 }
1281 
1282 /*
1283  * Verify that the expected LWP events are reported for a multithreaded
1284  * process that calls execve(2).
1285  */
1286 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1287 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1288 {
1289 	struct ptrace_lwpinfo pl;
1290 	pid_t fpid, wpid;
1291 	lwpid_t lwps[2];
1292 	int status;
1293 
1294 	ATF_REQUIRE((fpid = fork()) != -1);
1295 	if (fpid == 0) {
1296 		trace_me();
1297 		exec_thread_main();
1298 	}
1299 
1300 	/* The first wait() should report the stop from SIGSTOP. */
1301 	wpid = waitpid(fpid, &status, 0);
1302 	ATF_REQUIRE(wpid == fpid);
1303 	ATF_REQUIRE(WIFSTOPPED(status));
1304 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1305 
1306 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1307 	    sizeof(pl)) != -1);
1308 	lwps[0] = pl.pl_lwpid;
1309 
1310 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1311 
1312 	/* Continue the child ignoring the SIGSTOP. */
1313 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1314 
1315 	/* The first event should be for the child thread's birth. */
1316 	wpid = waitpid(fpid, &status, 0);
1317 	ATF_REQUIRE(wpid == fpid);
1318 	ATF_REQUIRE(WIFSTOPPED(status));
1319 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1320 
1321 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1322 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1323 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1324 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1325 	lwps[1] = pl.pl_lwpid;
1326 
1327 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1328 
1329 	/*
1330 	 * The next event should be for the main thread's death due to
1331 	 * single threading from execve().
1332 	 */
1333 	wpid = waitpid(fpid, &status, 0);
1334 	ATF_REQUIRE(wpid == fpid);
1335 	ATF_REQUIRE(WIFSTOPPED(status));
1336 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1337 
1338 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1339 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1340 	    (PL_FLAG_EXITED));
1341 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1342 
1343 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1344 
1345 	/* The next event should be for the child process's exec. */
1346 	wpid = waitpid(fpid, &status, 0);
1347 	ATF_REQUIRE(WIFSTOPPED(status));
1348 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1349 
1350 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1351 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1352 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1353 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1354 
1355 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1356 
1357 	/* The last event should be for the child process's exit. */
1358 	wpid = waitpid(fpid, &status, 0);
1359 	ATF_REQUIRE(WIFEXITED(status));
1360 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1361 
1362 	wpid = wait(&status);
1363 	ATF_REQUIRE(wpid == -1);
1364 	ATF_REQUIRE(errno == ECHILD);
1365 }
1366 
1367 static void
1368 handler(int sig __unused)
1369 {
1370 }
1371 
1372 static void
1373 signal_main(void)
1374 {
1375 
1376 	signal(SIGINFO, handler);
1377 	raise(SIGINFO);
1378 	exit(0);
1379 }
1380 
1381 /*
1382  * Verify that the expected ptrace event is reported for a signal.
1383  */
1384 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1385 ATF_TC_BODY(ptrace__siginfo, tc)
1386 {
1387 	struct ptrace_lwpinfo pl;
1388 	pid_t fpid, wpid;
1389 	int status;
1390 
1391 	ATF_REQUIRE((fpid = fork()) != -1);
1392 	if (fpid == 0) {
1393 		trace_me();
1394 		signal_main();
1395 	}
1396 
1397 	/* The first wait() should report the stop from SIGSTOP. */
1398 	wpid = waitpid(fpid, &status, 0);
1399 	ATF_REQUIRE(wpid == fpid);
1400 	ATF_REQUIRE(WIFSTOPPED(status));
1401 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1402 
1403 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1404 
1405 	/* The next event should be for the SIGINFO. */
1406 	wpid = waitpid(fpid, &status, 0);
1407 	ATF_REQUIRE(WIFSTOPPED(status));
1408 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1409 
1410 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1411 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1412 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1413 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1414 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1415 
1416 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1417 
1418 	/* The last event should be for the child process's exit. */
1419 	wpid = waitpid(fpid, &status, 0);
1420 	ATF_REQUIRE(WIFEXITED(status));
1421 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1422 
1423 	wpid = wait(&status);
1424 	ATF_REQUIRE(wpid == -1);
1425 	ATF_REQUIRE(errno == ECHILD);
1426 }
1427 
1428 /*
1429  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1430  */
1431 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1432 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1433 {
1434 	pid_t fpid, wpid;
1435 	int events, status;
1436 
1437 	ATF_REQUIRE((fpid = fork()) != -1);
1438 	if (fpid == 0) {
1439 		trace_me();
1440 		exec_thread(NULL);
1441 	}
1442 
1443 	/* The first wait() should report the stop from SIGSTOP. */
1444 	wpid = waitpid(fpid, &status, 0);
1445 	ATF_REQUIRE(wpid == fpid);
1446 	ATF_REQUIRE(WIFSTOPPED(status));
1447 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1448 
1449 	events = 0;
1450 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1451 	    sizeof(events)) == 0);
1452 
1453 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1454 
1455 	/* Should get one event at exit. */
1456 	wpid = waitpid(fpid, &status, 0);
1457 	ATF_REQUIRE(WIFEXITED(status));
1458 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1459 
1460 	wpid = wait(&status);
1461 	ATF_REQUIRE(wpid == -1);
1462 	ATF_REQUIRE(errno == ECHILD);
1463 }
1464 
1465 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1466 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1467 {
1468 	struct ptrace_lwpinfo pl;
1469 	pid_t fpid, wpid;
1470 	int events, status;
1471 
1472 	ATF_REQUIRE((fpid = fork()) != -1);
1473 	if (fpid == 0) {
1474 		trace_me();
1475 		exec_thread(NULL);
1476 	}
1477 
1478 	/* The first wait() should report the stop from SIGSTOP. */
1479 	wpid = waitpid(fpid, &status, 0);
1480 	ATF_REQUIRE(wpid == fpid);
1481 	ATF_REQUIRE(WIFSTOPPED(status));
1482 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1483 
1484 	events = PTRACE_EXEC;
1485 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1486 	    sizeof(events)) == 0);
1487 
1488 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1489 
1490 	/* The next event should be for the child process's exec. */
1491 	wpid = waitpid(fpid, &status, 0);
1492 	ATF_REQUIRE(WIFSTOPPED(status));
1493 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1494 
1495 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1496 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1497 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1498 
1499 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1500 
1501 	/* The last event should be for the child process's exit. */
1502 	wpid = waitpid(fpid, &status, 0);
1503 	ATF_REQUIRE(WIFEXITED(status));
1504 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1505 
1506 	wpid = wait(&status);
1507 	ATF_REQUIRE(wpid == -1);
1508 	ATF_REQUIRE(errno == ECHILD);
1509 }
1510 
1511 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1512 ATF_TC_BODY(ptrace__event_mask, tc)
1513 {
1514 	pid_t fpid, wpid;
1515 	int events, status;
1516 
1517 	ATF_REQUIRE((fpid = fork()) != -1);
1518 	if (fpid == 0) {
1519 		trace_me();
1520 		exit(0);
1521 	}
1522 
1523 	/* The first wait() should report the stop from SIGSTOP. */
1524 	wpid = waitpid(fpid, &status, 0);
1525 	ATF_REQUIRE(wpid == fpid);
1526 	ATF_REQUIRE(WIFSTOPPED(status));
1527 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1528 
1529 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1530 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1531 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1532 	    sizeof(events)) == 0);
1533 	ATF_REQUIRE(events & PTRACE_FORK);
1534 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1535 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1536 	    sizeof(events)) == 0);
1537 	ATF_REQUIRE(!(events & PTRACE_FORK));
1538 
1539 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1540 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1541 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1542 	    sizeof(events)) == 0);
1543 	ATF_REQUIRE(events & PTRACE_LWP);
1544 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1545 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1546 	    sizeof(events)) == 0);
1547 	ATF_REQUIRE(!(events & PTRACE_LWP));
1548 
1549 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1550 
1551 	/* Should get one event at exit. */
1552 	wpid = waitpid(fpid, &status, 0);
1553 	ATF_REQUIRE(WIFEXITED(status));
1554 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1555 
1556 	wpid = wait(&status);
1557 	ATF_REQUIRE(wpid == -1);
1558 	ATF_REQUIRE(errno == ECHILD);
1559 }
1560 
1561 /*
1562  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1563  */
1564 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1565 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1566 {
1567 	struct ptrace_lwpinfo pl;
1568 	pid_t fpid, wpid;
1569 	int events, status;
1570 
1571 	ATF_REQUIRE((fpid = fork()) != -1);
1572 	if (fpid == 0) {
1573 		trace_me();
1574 		follow_fork_parent(true);
1575 	}
1576 
1577 	/* The first wait() should report the stop from SIGSTOP. */
1578 	wpid = waitpid(fpid, &status, 0);
1579 	ATF_REQUIRE(wpid == fpid);
1580 	ATF_REQUIRE(WIFSTOPPED(status));
1581 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1582 
1583 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1584 	    sizeof(events)) == 0);
1585 	events |= PTRACE_VFORK;
1586 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1587 	    sizeof(events)) == 0);
1588 
1589 	/* Continue the child ignoring the SIGSTOP. */
1590 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1591 
1592 	/* The next event should report the end of the vfork. */
1593 	wpid = wait(&status);
1594 	ATF_REQUIRE(wpid == fpid);
1595 	ATF_REQUIRE(WIFSTOPPED(status));
1596 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1597 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1598 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1599 
1600 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1601 
1602 	wpid = wait(&status);
1603 	ATF_REQUIRE(wpid == fpid);
1604 	ATF_REQUIRE(WIFEXITED(status));
1605 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1606 
1607 	wpid = wait(&status);
1608 	ATF_REQUIRE(wpid == -1);
1609 	ATF_REQUIRE(errno == ECHILD);
1610 }
1611 
1612 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1613 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1614 {
1615 	struct ptrace_lwpinfo pl[2];
1616 	pid_t children[2], fpid, wpid;
1617 	int events, status;
1618 
1619 	ATF_REQUIRE((fpid = fork()) != -1);
1620 	if (fpid == 0) {
1621 		trace_me();
1622 		follow_fork_parent(true);
1623 	}
1624 
1625 	/* Parent process. */
1626 	children[0] = fpid;
1627 
1628 	/* The first wait() should report the stop from SIGSTOP. */
1629 	wpid = waitpid(children[0], &status, 0);
1630 	ATF_REQUIRE(wpid == children[0]);
1631 	ATF_REQUIRE(WIFSTOPPED(status));
1632 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1633 
1634 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1635 	    sizeof(events)) == 0);
1636 	events |= PTRACE_FORK | PTRACE_VFORK;
1637 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1638 	    sizeof(events)) == 0);
1639 
1640 	/* Continue the child ignoring the SIGSTOP. */
1641 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1642 
1643 	/* Wait for both halves of the fork event to get reported. */
1644 	children[1] = handle_fork_events(children[0], pl);
1645 	ATF_REQUIRE(children[1] > 0);
1646 
1647 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1648 
1649 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1650 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1651 
1652 	/*
1653 	 * The child can't exit until the grandchild reports status, so the
1654 	 * grandchild should report its exit first to the debugger.
1655 	 */
1656 	wpid = waitpid(children[1], &status, 0);
1657 	ATF_REQUIRE(wpid == children[1]);
1658 	ATF_REQUIRE(WIFEXITED(status));
1659 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1660 
1661 	/*
1662 	 * The child should report it's vfork() completion before it
1663 	 * exits.
1664 	 */
1665 	wpid = wait(&status);
1666 	ATF_REQUIRE(wpid == children[0]);
1667 	ATF_REQUIRE(WIFSTOPPED(status));
1668 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1669 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1670 	    -1);
1671 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1672 
1673 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1674 
1675 	wpid = wait(&status);
1676 	ATF_REQUIRE(wpid == children[0]);
1677 	ATF_REQUIRE(WIFEXITED(status));
1678 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1679 
1680 	wpid = wait(&status);
1681 	ATF_REQUIRE(wpid == -1);
1682 	ATF_REQUIRE(errno == ECHILD);
1683 }
1684 
1685 /*
1686  * XXX: There's nothing inherently platform specific about this test, however a
1687  * userspace visible breakpoint() is a prerequisite.
1688  */
1689  #if defined(__amd64__) || defined(__i386__) || defined(__sparc64__)
1690 /*
1691  * Verify that no more events are reported after PT_KILL except for the
1692  * process exit when stopped due to a breakpoint trap.
1693  */
1694 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1695 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1696 {
1697 	pid_t fpid, wpid;
1698 	int status;
1699 
1700 	ATF_REQUIRE((fpid = fork()) != -1);
1701 	if (fpid == 0) {
1702 		trace_me();
1703 		breakpoint();
1704 		exit(1);
1705 	}
1706 
1707 	/* The first wait() should report the stop from SIGSTOP. */
1708 	wpid = waitpid(fpid, &status, 0);
1709 	ATF_REQUIRE(wpid == fpid);
1710 	ATF_REQUIRE(WIFSTOPPED(status));
1711 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1712 
1713 	/* Continue the child ignoring the SIGSTOP. */
1714 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1715 
1716 	/* The second wait() should report hitting the breakpoint. */
1717 	wpid = waitpid(fpid, &status, 0);
1718 	ATF_REQUIRE(wpid == fpid);
1719 	ATF_REQUIRE(WIFSTOPPED(status));
1720 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1721 
1722 	/* Kill the child process. */
1723 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1724 
1725 	/* The last wait() should report the SIGKILL. */
1726 	wpid = waitpid(fpid, &status, 0);
1727 	ATF_REQUIRE(wpid == fpid);
1728 	ATF_REQUIRE(WIFSIGNALED(status));
1729 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1730 
1731 	wpid = wait(&status);
1732 	ATF_REQUIRE(wpid == -1);
1733 	ATF_REQUIRE(errno == ECHILD);
1734 }
1735 #endif /* defined(__amd64__) || defined(__i386__) || defined(__sparc64__) */
1736 
1737 /*
1738  * Verify that no more events are reported after PT_KILL except for the
1739  * process exit when stopped inside of a system call.
1740  */
1741 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1742 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1743 {
1744 	struct ptrace_lwpinfo pl;
1745 	pid_t fpid, wpid;
1746 	int status;
1747 
1748 	ATF_REQUIRE((fpid = fork()) != -1);
1749 	if (fpid == 0) {
1750 		trace_me();
1751 		getpid();
1752 		exit(1);
1753 	}
1754 
1755 	/* The first wait() should report the stop from SIGSTOP. */
1756 	wpid = waitpid(fpid, &status, 0);
1757 	ATF_REQUIRE(wpid == fpid);
1758 	ATF_REQUIRE(WIFSTOPPED(status));
1759 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1760 
1761 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1762 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1763 
1764 	/* The second wait() should report a system call entry for getpid(). */
1765 	wpid = waitpid(fpid, &status, 0);
1766 	ATF_REQUIRE(wpid == fpid);
1767 	ATF_REQUIRE(WIFSTOPPED(status));
1768 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1769 
1770 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1771 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1772 
1773 	/* Kill the child process. */
1774 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1775 
1776 	/* The last wait() should report the SIGKILL. */
1777 	wpid = waitpid(fpid, &status, 0);
1778 	ATF_REQUIRE(wpid == fpid);
1779 	ATF_REQUIRE(WIFSIGNALED(status));
1780 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1781 
1782 	wpid = wait(&status);
1783 	ATF_REQUIRE(wpid == -1);
1784 	ATF_REQUIRE(errno == ECHILD);
1785 }
1786 
1787 /*
1788  * Verify that no more events are reported after PT_KILL except for the
1789  * process exit when killing a multithreaded process.
1790  */
1791 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1792 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1793 {
1794 	struct ptrace_lwpinfo pl;
1795 	pid_t fpid, wpid;
1796 	lwpid_t main_lwp;
1797 	int status;
1798 
1799 	ATF_REQUIRE((fpid = fork()) != -1);
1800 	if (fpid == 0) {
1801 		trace_me();
1802 		simple_thread_main();
1803 	}
1804 
1805 	/* The first wait() should report the stop from SIGSTOP. */
1806 	wpid = waitpid(fpid, &status, 0);
1807 	ATF_REQUIRE(wpid == fpid);
1808 	ATF_REQUIRE(WIFSTOPPED(status));
1809 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1810 
1811 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1812 	    sizeof(pl)) != -1);
1813 	main_lwp = pl.pl_lwpid;
1814 
1815 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1816 
1817 	/* Continue the child ignoring the SIGSTOP. */
1818 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1819 
1820 	/* The first event should be for the child thread's birth. */
1821 	wpid = waitpid(fpid, &status, 0);
1822 	ATF_REQUIRE(wpid == fpid);
1823 	ATF_REQUIRE(WIFSTOPPED(status));
1824 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1825 
1826 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1827 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1828 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1829 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1830 
1831 	/* Kill the child process. */
1832 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1833 
1834 	/* The last wait() should report the SIGKILL. */
1835 	wpid = waitpid(fpid, &status, 0);
1836 	ATF_REQUIRE(wpid == fpid);
1837 	ATF_REQUIRE(WIFSIGNALED(status));
1838 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1839 
1840 	wpid = wait(&status);
1841 	ATF_REQUIRE(wpid == -1);
1842 	ATF_REQUIRE(errno == ECHILD);
1843 }
1844 
1845 static void *
1846 mask_usr1_thread(void *arg)
1847 {
1848 	pthread_barrier_t *pbarrier;
1849 	sigset_t sigmask;
1850 
1851 	pbarrier = (pthread_barrier_t*)arg;
1852 
1853 	sigemptyset(&sigmask);
1854 	sigaddset(&sigmask, SIGUSR1);
1855 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1856 
1857 	/* Sync up with other thread after sigmask updated. */
1858 	pthread_barrier_wait(pbarrier);
1859 
1860 	for (;;)
1861 		sleep(60);
1862 
1863 	return (NULL);
1864 }
1865 
1866 /*
1867  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1868  * and prevents spurious stops due to those other signals.
1869  */
1870 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_competing_signal);
1871 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1872 {
1873 	pid_t fpid, wpid;
1874 	int status;
1875 	cpuset_t setmask;
1876 	pthread_t t;
1877 	pthread_barrier_t barrier;
1878 	struct sched_param sched_param;
1879 
1880 	ATF_REQUIRE((fpid = fork()) != -1);
1881 	if (fpid == 0) {
1882 		/* Bind to one CPU so only one thread at a time will run. */
1883 		CPU_ZERO(&setmask);
1884 		CPU_SET(0, &setmask);
1885 		cpusetid_t setid;
1886 		CHILD_REQUIRE(cpuset(&setid) == 0);
1887 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1888 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1889 
1890 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1891 
1892 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1893 		    (void*)&barrier) == 0);
1894 
1895 		/*
1896 		 * Give the main thread higher priority. The test always
1897 		 * assumes that, if both threads are able to run, the main
1898 		 * thread runs first.
1899 		 */
1900 		sched_param.sched_priority =
1901 		    (sched_get_priority_max(SCHED_FIFO) +
1902 		    sched_get_priority_min(SCHED_FIFO)) / 2;
1903 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
1904 		    SCHED_FIFO, &sched_param) == 0);
1905 		sched_param.sched_priority -= RQ_PPQ;
1906 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
1907 		    &sched_param) == 0);
1908 
1909 		sigset_t sigmask;
1910 		sigemptyset(&sigmask);
1911 		sigaddset(&sigmask, SIGUSR2);
1912 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1913 
1914 		/* Sync up with other thread after sigmask updated. */
1915 		pthread_barrier_wait(&barrier);
1916 
1917 		trace_me();
1918 
1919 		for (;;)
1920 			sleep(60);
1921 
1922 		exit(1);
1923 	}
1924 
1925 	/* The first wait() should report the stop from SIGSTOP. */
1926 	wpid = waitpid(fpid, &status, 0);
1927 	ATF_REQUIRE(wpid == fpid);
1928 	ATF_REQUIRE(WIFSTOPPED(status));
1929 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1930 
1931 	/* Continue the child ignoring the SIGSTOP. */
1932 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1933 
1934 	/* Send a signal that only the second thread can handle. */
1935 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
1936 
1937 	/* The second wait() should report the SIGUSR2. */
1938 	wpid = waitpid(fpid, &status, 0);
1939 	ATF_REQUIRE(wpid == fpid);
1940 	ATF_REQUIRE(WIFSTOPPED(status));
1941 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
1942 
1943 	/* Send a signal that only the first thread can handle. */
1944 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
1945 
1946 	/* Replace the SIGUSR2 with a kill. */
1947 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1948 
1949 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
1950 	wpid = waitpid(fpid, &status, 0);
1951 	ATF_REQUIRE(wpid == fpid);
1952 	ATF_REQUIRE(WIFSIGNALED(status));
1953 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1954 
1955 	wpid = wait(&status);
1956 	ATF_REQUIRE(wpid == -1);
1957 	ATF_REQUIRE(errno == ECHILD);
1958 }
1959 
1960 /*
1961  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
1962  * and prevents spurious stops caused by those events.
1963  */
1964 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_competing_stop);
1965 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
1966 {
1967 	pid_t fpid, wpid;
1968 	int status;
1969 	cpuset_t setmask;
1970 	pthread_t t;
1971 	pthread_barrier_t barrier;
1972 	lwpid_t main_lwp;
1973 	struct ptrace_lwpinfo pl;
1974 	struct sched_param sched_param;
1975 
1976 	ATF_REQUIRE((fpid = fork()) != -1);
1977 	if (fpid == 0) {
1978 		trace_me();
1979 
1980 		/* Bind to one CPU so only one thread at a time will run. */
1981 		CPU_ZERO(&setmask);
1982 		CPU_SET(0, &setmask);
1983 		cpusetid_t setid;
1984 		CHILD_REQUIRE(cpuset(&setid) == 0);
1985 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1986 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1987 
1988 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1989 
1990 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1991 		    (void*)&barrier) == 0);
1992 
1993 		/*
1994 		 * Give the main thread higher priority. The test always
1995 		 * assumes that, if both threads are able to run, the main
1996 		 * thread runs first.
1997 		 */
1998 		sched_param.sched_priority =
1999 		    (sched_get_priority_max(SCHED_FIFO) +
2000 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2001 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2002 		    SCHED_FIFO, &sched_param) == 0);
2003 		sched_param.sched_priority -= RQ_PPQ;
2004 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2005 		    &sched_param) == 0);
2006 
2007 		sigset_t sigmask;
2008 		sigemptyset(&sigmask);
2009 		sigaddset(&sigmask, SIGUSR2);
2010 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2011 
2012 		/* Sync up with other thread after sigmask updated. */
2013 		pthread_barrier_wait(&barrier);
2014 
2015 		/* Sync up with the test before doing the getpid(). */
2016 		raise(SIGSTOP);
2017 
2018 		getpid();
2019 		exit(1);
2020 	}
2021 
2022 	/* The first wait() should report the stop from SIGSTOP. */
2023 	wpid = waitpid(fpid, &status, 0);
2024 	ATF_REQUIRE(wpid == fpid);
2025 	ATF_REQUIRE(WIFSTOPPED(status));
2026 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2027 
2028 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2029 	main_lwp = pl.pl_lwpid;
2030 
2031 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2032 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2033 
2034 	/*
2035 	 * Continue until child is done with setup, which is indicated with
2036 	 * SIGSTOP. Ignore system calls in the meantime.
2037 	 */
2038 	for (;;) {
2039 		wpid = waitpid(fpid, &status, 0);
2040 		ATF_REQUIRE(wpid == fpid);
2041 		ATF_REQUIRE(WIFSTOPPED(status));
2042 		if (WSTOPSIG(status) == SIGTRAP) {
2043 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2044 			    sizeof(pl)) != -1);
2045 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2046 		} else {
2047 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2048 			break;
2049 		}
2050 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2051 	}
2052 
2053 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2054 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2055 
2056 	wpid = waitpid(fpid, &status, 0);
2057 	ATF_REQUIRE(wpid == fpid);
2058 	ATF_REQUIRE(WIFSTOPPED(status));
2059 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2060 
2061 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2062 	    sizeof(pl)) != -1);
2063 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2064 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2065 	/* Prevent the main thread from hitting its syscall exit for now. */
2066 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2067 
2068 	/*
2069 	 * Proceed, allowing second thread to hit syscall exit for
2070 	 * pthread_barrier_wait().
2071 	 */
2072 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2073 
2074 	wpid = waitpid(fpid, &status, 0);
2075 	ATF_REQUIRE(wpid == fpid);
2076 	ATF_REQUIRE(WIFSTOPPED(status));
2077 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2078 
2079 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2080 	    sizeof(pl)) != -1);
2081 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2082 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2083 
2084 	/* Send a signal that only the second thread can handle. */
2085 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2086 
2087 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2088 
2089 	/* The next wait() should report the SIGUSR2. */
2090 	wpid = waitpid(fpid, &status, 0);
2091 	ATF_REQUIRE(wpid == fpid);
2092 	ATF_REQUIRE(WIFSTOPPED(status));
2093 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2094 
2095 	/* Allow the main thread to try to finish its system call. */
2096 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2097 
2098 	/*
2099 	 * At this point, the main thread is in the middle of a system call and
2100 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2101 	 * be replaced with a SIGKILL below. The main thread will get to run
2102 	 * first. It should notice the kill request (even though the signal
2103 	 * replacement occurred in the other thread) and exit accordingly.  It
2104 	 * should not stop for the system call exit event.
2105 	 */
2106 
2107 	/* Replace the SIGUSR2 with a kill. */
2108 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2109 
2110 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2111 	wpid = waitpid(fpid, &status, 0);
2112 	ATF_REQUIRE(wpid == fpid);
2113 	ATF_REQUIRE(WIFSIGNALED(status));
2114 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2115 
2116 	wpid = wait(&status);
2117 	ATF_REQUIRE(wpid == -1);
2118 	ATF_REQUIRE(errno == ECHILD);
2119 }
2120 
2121 static void
2122 sigusr1_handler(int sig)
2123 {
2124 
2125 	CHILD_REQUIRE(sig == SIGUSR1);
2126 	_exit(2);
2127 }
2128 
2129 /*
2130  * Verify that even if the signal queue is full for a child process,
2131  * a PT_KILL will kill the process.
2132  */
2133 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2134 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2135 {
2136 	pid_t fpid, wpid;
2137 	int status;
2138 	int max_pending_per_proc;
2139 	size_t len;
2140 	int i;
2141 
2142 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2143 
2144 	ATF_REQUIRE((fpid = fork()) != -1);
2145 	if (fpid == 0) {
2146 		trace_me();
2147 		exit(1);
2148 	}
2149 
2150 	/* The first wait() should report the stop from SIGSTOP. */
2151 	wpid = waitpid(fpid, &status, 0);
2152 	ATF_REQUIRE(wpid == fpid);
2153 	ATF_REQUIRE(WIFSTOPPED(status));
2154 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2155 
2156 	len = sizeof(max_pending_per_proc);
2157 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2158 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2159 
2160 	/* Fill the signal queue. */
2161 	for (i = 0; i < max_pending_per_proc; ++i)
2162 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2163 
2164 	/* Kill the child process. */
2165 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2166 
2167 	/* The last wait() should report the SIGKILL. */
2168 	wpid = waitpid(fpid, &status, 0);
2169 	ATF_REQUIRE(wpid == fpid);
2170 	ATF_REQUIRE(WIFSIGNALED(status));
2171 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2172 
2173 	wpid = wait(&status);
2174 	ATF_REQUIRE(wpid == -1);
2175 	ATF_REQUIRE(errno == ECHILD);
2176 }
2177 
2178 /*
2179  * Verify that when stopped at a system call entry, a signal can be
2180  * requested with PT_CONTINUE which will be delivered once the system
2181  * call is complete.
2182  */
2183 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2184 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2185 {
2186 	struct ptrace_lwpinfo pl;
2187 	pid_t fpid, wpid;
2188 	int status;
2189 
2190 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2191 
2192 	ATF_REQUIRE((fpid = fork()) != -1);
2193 	if (fpid == 0) {
2194 		trace_me();
2195 		getpid();
2196 		exit(1);
2197 	}
2198 
2199 	/* The first wait() should report the stop from SIGSTOP. */
2200 	wpid = waitpid(fpid, &status, 0);
2201 	ATF_REQUIRE(wpid == fpid);
2202 	ATF_REQUIRE(WIFSTOPPED(status));
2203 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2204 
2205 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2206 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2207 
2208 	/* The second wait() should report a system call entry for getpid(). */
2209 	wpid = waitpid(fpid, &status, 0);
2210 	ATF_REQUIRE(wpid == fpid);
2211 	ATF_REQUIRE(WIFSTOPPED(status));
2212 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2213 
2214 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2215 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2216 
2217 	/* Continue the child process with a signal. */
2218 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2219 
2220 	for (;;) {
2221 		/*
2222 		 * The last wait() should report exit 2, i.e., a normal _exit
2223 		 * from the signal handler. In the meantime, catch and proceed
2224 		 * past any syscall stops.
2225 		 */
2226 		wpid = waitpid(fpid, &status, 0);
2227 		ATF_REQUIRE(wpid == fpid);
2228 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2229 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2230 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2231 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2232 		} else {
2233 			ATF_REQUIRE(WIFEXITED(status));
2234 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2235 			break;
2236 		}
2237 	}
2238 
2239 	wpid = wait(&status);
2240 	ATF_REQUIRE(wpid == -1);
2241 	ATF_REQUIRE(errno == ECHILD);
2242 }
2243 
2244 static void
2245 sigusr1_counting_handler(int sig)
2246 {
2247 	static int counter = 0;
2248 
2249 	CHILD_REQUIRE(sig == SIGUSR1);
2250 	counter++;
2251 	if (counter == 2)
2252 		_exit(2);
2253 }
2254 
2255 /*
2256  * Verify that, when continuing from a stop at system call entry and exit,
2257  * a signal can be requested from both stops, and both will be delivered when
2258  * the system call is complete.
2259  */
2260 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2261 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2262 {
2263 	struct ptrace_lwpinfo pl;
2264 	pid_t fpid, wpid;
2265 	int status;
2266 
2267 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2268 
2269 	ATF_REQUIRE((fpid = fork()) != -1);
2270 	if (fpid == 0) {
2271 		trace_me();
2272 		getpid();
2273 		exit(1);
2274 	}
2275 
2276 	/* The first wait() should report the stop from SIGSTOP. */
2277 	wpid = waitpid(fpid, &status, 0);
2278 	ATF_REQUIRE(wpid == fpid);
2279 	ATF_REQUIRE(WIFSTOPPED(status));
2280 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2281 
2282 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2283 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2284 
2285 	/* The second wait() should report a system call entry for getpid(). */
2286 	wpid = waitpid(fpid, &status, 0);
2287 	ATF_REQUIRE(wpid == fpid);
2288 	ATF_REQUIRE(WIFSTOPPED(status));
2289 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2290 
2291 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2292 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2293 
2294 	/* Continue the child process with a signal. */
2295 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2296 
2297 	/* The third wait() should report a system call exit for getpid(). */
2298 	wpid = waitpid(fpid, &status, 0);
2299 	ATF_REQUIRE(wpid == fpid);
2300 	ATF_REQUIRE(WIFSTOPPED(status));
2301 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2302 
2303 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2304 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2305 
2306 	/* Continue the child process with a signal. */
2307 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2308 
2309 	for (;;) {
2310 		/*
2311 		 * The last wait() should report exit 2, i.e., a normal _exit
2312 		 * from the signal handler. In the meantime, catch and proceed
2313 		 * past any syscall stops.
2314 		 */
2315 		wpid = waitpid(fpid, &status, 0);
2316 		ATF_REQUIRE(wpid == fpid);
2317 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2318 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2319 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2320 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2321 		} else {
2322 			ATF_REQUIRE(WIFEXITED(status));
2323 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2324 			break;
2325 		}
2326 	}
2327 
2328 	wpid = wait(&status);
2329 	ATF_REQUIRE(wpid == -1);
2330 	ATF_REQUIRE(errno == ECHILD);
2331 }
2332 
2333 /*
2334  * Verify that even if the signal queue is full for a child process,
2335  * a PT_CONTINUE with a signal will not result in loss of that signal.
2336  */
2337 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2338 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2339 {
2340 	pid_t fpid, wpid;
2341 	int status;
2342 	int max_pending_per_proc;
2343 	size_t len;
2344 	int i;
2345 
2346 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2347 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2348 
2349 	ATF_REQUIRE((fpid = fork()) != -1);
2350 	if (fpid == 0) {
2351 		trace_me();
2352 		exit(1);
2353 	}
2354 
2355 	/* The first wait() should report the stop from SIGSTOP. */
2356 	wpid = waitpid(fpid, &status, 0);
2357 	ATF_REQUIRE(wpid == fpid);
2358 	ATF_REQUIRE(WIFSTOPPED(status));
2359 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2360 
2361 	len = sizeof(max_pending_per_proc);
2362 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2363 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2364 
2365 	/* Fill the signal queue. */
2366 	for (i = 0; i < max_pending_per_proc; ++i)
2367 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2368 
2369 	/* Continue with signal. */
2370 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2371 
2372 	for (;;) {
2373 		wpid = waitpid(fpid, &status, 0);
2374 		ATF_REQUIRE(wpid == fpid);
2375 		if (WIFSTOPPED(status)) {
2376 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2377 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2378 		} else {
2379 			/*
2380 			 * The last wait() should report normal _exit from the
2381 			 * SIGUSR1 handler.
2382 			 */
2383 			ATF_REQUIRE(WIFEXITED(status));
2384 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2385 			break;
2386 		}
2387 	}
2388 
2389 	wpid = wait(&status);
2390 	ATF_REQUIRE(wpid == -1);
2391 	ATF_REQUIRE(errno == ECHILD);
2392 }
2393 
2394 /*
2395  * Verify that, after stopping due to a signal, that signal can be
2396  * replaced with another signal.
2397  */
2398 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2399 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2400 {
2401 	struct ptrace_lwpinfo pl;
2402 	pid_t fpid, wpid;
2403 	int status;
2404 
2405 	ATF_REQUIRE((fpid = fork()) != -1);
2406 	if (fpid == 0) {
2407 		trace_me();
2408 		sleep(20);
2409 		exit(1);
2410 	}
2411 
2412 	/* The first wait() should report the stop from SIGSTOP. */
2413 	wpid = waitpid(fpid, &status, 0);
2414 	ATF_REQUIRE(wpid == fpid);
2415 	ATF_REQUIRE(WIFSTOPPED(status));
2416 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2417 
2418 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2419 
2420 	/* Send a signal without ptrace. */
2421 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2422 
2423 	/* The second wait() should report a SIGINT was received. */
2424 	wpid = waitpid(fpid, &status, 0);
2425 	ATF_REQUIRE(wpid == fpid);
2426 	ATF_REQUIRE(WIFSTOPPED(status));
2427 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2428 
2429 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2430 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2431 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2432 
2433 	/* Continue the child process with a different signal. */
2434 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2435 
2436 	/*
2437 	 * The last wait() should report having died due to the new
2438 	 * signal, SIGTERM.
2439 	 */
2440 	wpid = waitpid(fpid, &status, 0);
2441 	ATF_REQUIRE(wpid == fpid);
2442 	ATF_REQUIRE(WIFSIGNALED(status));
2443 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2444 
2445 	wpid = wait(&status);
2446 	ATF_REQUIRE(wpid == -1);
2447 	ATF_REQUIRE(errno == ECHILD);
2448 }
2449 
2450 /*
2451  * Verify that a signal can be passed through to the child even when there
2452  * was no true signal originally. Such cases arise when a SIGTRAP is
2453  * invented for e.g, system call stops.
2454  */
2455 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2456 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2457 {
2458 	struct ptrace_lwpinfo pl;
2459 	pid_t fpid, wpid;
2460 	int status;
2461 
2462 	ATF_REQUIRE((fpid = fork()) != -1);
2463 	if (fpid == 0) {
2464 		trace_me();
2465 		getpid();
2466 		exit(1);
2467 	}
2468 
2469 	/* The first wait() should report the stop from SIGSTOP. */
2470 	wpid = waitpid(fpid, &status, 0);
2471 	ATF_REQUIRE(wpid == fpid);
2472 	ATF_REQUIRE(WIFSTOPPED(status));
2473 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2474 
2475 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2476 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2477 
2478 	/* The second wait() should report a system call entry for getpid(). */
2479 	wpid = waitpid(fpid, &status, 0);
2480 	ATF_REQUIRE(wpid == fpid);
2481 	ATF_REQUIRE(WIFSTOPPED(status));
2482 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2483 
2484 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2485 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2486 
2487 	/* Continue the child process with a SIGTRAP. */
2488 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2489 
2490 	for (;;) {
2491 		/*
2492 		 * The last wait() should report exit due to SIGTRAP.  In the
2493 		 * meantime, catch and proceed past any syscall stops.
2494 		 */
2495 		wpid = waitpid(fpid, &status, 0);
2496 		ATF_REQUIRE(wpid == fpid);
2497 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2498 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2499 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2500 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2501 		} else {
2502 			ATF_REQUIRE(WIFSIGNALED(status));
2503 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2504 			break;
2505 		}
2506 	}
2507 
2508 	wpid = wait(&status);
2509 	ATF_REQUIRE(wpid == -1);
2510 	ATF_REQUIRE(errno == ECHILD);
2511 
2512 }
2513 
2514 /*
2515  * A mixed bag PT_CONTINUE with signal test.
2516  */
2517 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2518 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2519 {
2520 	struct ptrace_lwpinfo pl;
2521 	pid_t fpid, wpid;
2522 	int status;
2523 
2524 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2525 
2526 	ATF_REQUIRE((fpid = fork()) != -1);
2527 	if (fpid == 0) {
2528 		trace_me();
2529 		getpid();
2530 		exit(1);
2531 	}
2532 
2533 	/* The first wait() should report the stop from SIGSTOP. */
2534 	wpid = waitpid(fpid, &status, 0);
2535 	ATF_REQUIRE(wpid == fpid);
2536 	ATF_REQUIRE(WIFSTOPPED(status));
2537 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2538 
2539 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2540 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2541 
2542 	/* The second wait() should report a system call entry for getpid(). */
2543 	wpid = waitpid(fpid, &status, 0);
2544 	ATF_REQUIRE(wpid == fpid);
2545 	ATF_REQUIRE(WIFSTOPPED(status));
2546 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2547 
2548 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2549 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2550 
2551 	/* Continue with the first SIGUSR1. */
2552 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2553 
2554 	/* The next wait() should report a system call exit for getpid(). */
2555 	wpid = waitpid(fpid, &status, 0);
2556 	ATF_REQUIRE(wpid == fpid);
2557 	ATF_REQUIRE(WIFSTOPPED(status));
2558 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2559 
2560 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2561 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2562 
2563 	/* Send an ABRT without ptrace. */
2564 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2565 
2566 	/* Continue normally. */
2567 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2568 
2569 	/* The next wait() should report the SIGABRT. */
2570 	wpid = waitpid(fpid, &status, 0);
2571 	ATF_REQUIRE(wpid == fpid);
2572 	ATF_REQUIRE(WIFSTOPPED(status));
2573 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2574 
2575 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2576 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2577 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2578 
2579 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2580 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2581 
2582 	for (;;) {
2583 		/*
2584 		 * The last wait() should report exit 2, i.e., a normal _exit
2585 		 * from the signal handler. In the meantime, catch and proceed
2586 		 * past any syscall stops.
2587 		 */
2588 		wpid = waitpid(fpid, &status, 0);
2589 		ATF_REQUIRE(wpid == fpid);
2590 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2591 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2592 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2593 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2594 		} else {
2595 			ATF_REQUIRE(WIFEXITED(status));
2596 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2597 			break;
2598 		}
2599 	}
2600 
2601 	wpid = wait(&status);
2602 	ATF_REQUIRE(wpid == -1);
2603 	ATF_REQUIRE(errno == ECHILD);
2604 
2605 }
2606 
2607 /*
2608  * Verify a signal delivered by ptrace is noticed by kevent(2).
2609  */
2610 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2611 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2612 {
2613 	pid_t fpid, wpid;
2614 	int status, kq, nevents;
2615 	struct kevent kev;
2616 
2617 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2618 
2619 	ATF_REQUIRE((fpid = fork()) != -1);
2620 	if (fpid == 0) {
2621 		CHILD_REQUIRE((kq = kqueue()) > 0);
2622 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2623 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2624 
2625 		trace_me();
2626 
2627 		for (;;) {
2628 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2629 			if (nevents == -1 && errno == EINTR)
2630 				continue;
2631 			CHILD_REQUIRE(nevents > 0);
2632 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2633 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2634 			break;
2635 		}
2636 
2637 		exit(1);
2638 	}
2639 
2640 	/* The first wait() should report the stop from SIGSTOP. */
2641 	wpid = waitpid(fpid, &status, 0);
2642 	ATF_REQUIRE(wpid == fpid);
2643 	ATF_REQUIRE(WIFSTOPPED(status));
2644 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2645 
2646 	/* Continue with the SIGUSR1. */
2647 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2648 
2649 	/*
2650 	 * The last wait() should report normal exit with code 1.
2651 	 */
2652 	wpid = waitpid(fpid, &status, 0);
2653 	ATF_REQUIRE(wpid == fpid);
2654 	ATF_REQUIRE(WIFEXITED(status));
2655 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2656 
2657 	wpid = wait(&status);
2658 	ATF_REQUIRE(wpid == -1);
2659 	ATF_REQUIRE(errno == ECHILD);
2660 }
2661 
2662 static sem_t sigusr1_sem;
2663 
2664 static void
2665 sigusr1_sempost_handler(int sig __unused)
2666 {
2667 
2668 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2669 }
2670 
2671 static void *
2672 signal_thread(void *arg)
2673 {
2674 	int err;
2675 	sigset_t sigmask;
2676 
2677 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2678 
2679 	/* Wait for this thread to receive a SIGUSR1. */
2680 	do {
2681 		err = sem_wait(&sigusr1_sem);
2682 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2683 	} while (err != 0 && errno == EINTR);
2684 
2685 	/* Free our companion thread from the barrier. */
2686 	pthread_barrier_wait(pbarrier);
2687 
2688 	/*
2689 	 * Swap ignore duties; the next SIGUSR1 should go to the
2690 	 * other thread.
2691 	 */
2692 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2693 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2694 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2695 
2696 	/* Sync up threads after swapping signal masks. */
2697 	pthread_barrier_wait(pbarrier);
2698 
2699 	/* Wait until our companion has received its SIGUSR1. */
2700 	pthread_barrier_wait(pbarrier);
2701 
2702 	return (NULL);
2703 }
2704 
2705 /*
2706  * Verify that if ptrace stops due to a signal but continues with
2707  * a different signal that the new signal is routed to a thread
2708  * that can accept it, and that that thread is awakened by the signal
2709  * in a timely manner.
2710  */
2711 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
2712 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
2713 {
2714 	pid_t fpid, wpid;
2715 	int status, err;
2716 	pthread_t t;
2717 	sigset_t sigmask;
2718 	pthread_barrier_t barrier;
2719 
2720 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2721 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2722 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2723 
2724 	ATF_REQUIRE((fpid = fork()) != -1);
2725 	if (fpid == 0) {
2726 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
2727 
2728 		/* The other thread should receive the first SIGUSR1. */
2729 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2730 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2731 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2732 
2733 		trace_me();
2734 
2735 		/* Wait until other thread has received its SIGUSR1. */
2736 		pthread_barrier_wait(&barrier);
2737 
2738 		/*
2739 		 * Swap ignore duties; the next SIGUSR1 should go to this
2740 		 * thread.
2741 		 */
2742 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2743 
2744 		/* Sync up threads after swapping signal masks. */
2745 		pthread_barrier_wait(&barrier);
2746 
2747 		/*
2748 		 * Sync up with test code; we're ready for the next SIGUSR1
2749 		 * now.
2750 		 */
2751 		raise(SIGSTOP);
2752 
2753 		/* Wait for this thread to receive a SIGUSR1. */
2754 		do {
2755 			err = sem_wait(&sigusr1_sem);
2756 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2757 		} while (err != 0 && errno == EINTR);
2758 
2759 		/* Free the other thread from the barrier. */
2760 		pthread_barrier_wait(&barrier);
2761 
2762 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
2763 
2764 		exit(1);
2765 	}
2766 
2767 	/* The first wait() should report the stop from SIGSTOP. */
2768 	wpid = waitpid(fpid, &status, 0);
2769 	ATF_REQUIRE(wpid == fpid);
2770 	ATF_REQUIRE(WIFSTOPPED(status));
2771 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2772 
2773 	/* Continue the child ignoring the SIGSTOP. */
2774 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2775 
2776 	/*
2777 	 * Send a signal without ptrace that either thread will accept (USR2,
2778 	 * in this case).
2779 	 */
2780 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2781 
2782 	/* The second wait() should report a SIGUSR2 was received. */
2783 	wpid = waitpid(fpid, &status, 0);
2784 	ATF_REQUIRE(wpid == fpid);
2785 	ATF_REQUIRE(WIFSTOPPED(status));
2786 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2787 
2788 	/* Continue the child, changing the signal to USR1. */
2789 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2790 
2791 	/* The next wait() should report the stop from SIGSTOP. */
2792 	wpid = waitpid(fpid, &status, 0);
2793 	ATF_REQUIRE(wpid == fpid);
2794 	ATF_REQUIRE(WIFSTOPPED(status));
2795 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2796 
2797 	/* Continue the child ignoring the SIGSTOP. */
2798 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2799 
2800 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2801 
2802 	/* The next wait() should report a SIGUSR2 was received. */
2803 	wpid = waitpid(fpid, &status, 0);
2804 	ATF_REQUIRE(wpid == fpid);
2805 	ATF_REQUIRE(WIFSTOPPED(status));
2806 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2807 
2808 	/* Continue the child, changing the signal to USR1. */
2809 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2810 
2811 	/* The last wait() should report normal exit with code 1. */
2812 	wpid = waitpid(fpid, &status, 0);
2813 	ATF_REQUIRE(wpid == fpid);
2814 	ATF_REQUIRE(WIFEXITED(status));
2815 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2816 
2817 	wpid = wait(&status);
2818 	ATF_REQUIRE(wpid == -1);
2819 	ATF_REQUIRE(errno == ECHILD);
2820 }
2821 
2822 static void *
2823 raise_sigstop_thread(void *arg __unused)
2824 {
2825 
2826 	raise(SIGSTOP);
2827 	return NULL;
2828 }
2829 
2830 static void *
2831 sleep_thread(void *arg __unused)
2832 {
2833 
2834 	sleep(60);
2835 	return NULL;
2836 }
2837 
2838 static void
2839 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
2840 {
2841 	pid_t fpid, wpid;
2842 	int status, i;
2843 	cpuset_t setmask;
2844 	cpusetid_t setid;
2845 	pthread_t t;
2846 
2847 	/*
2848 	 * Become the reaper for this process tree. We need to be able to check
2849 	 * that both child and grandchild have died.
2850 	 */
2851 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
2852 
2853 	fpid = fork();
2854 	ATF_REQUIRE(fpid >= 0);
2855 	if (fpid == 0) {
2856 		fpid = fork();
2857 		CHILD_REQUIRE(fpid >= 0);
2858 		if (fpid == 0) {
2859 			trace_me();
2860 
2861 			/* Pin to CPU 0 to serialize thread execution. */
2862 			CPU_ZERO(&setmask);
2863 			CPU_SET(0, &setmask);
2864 			CHILD_REQUIRE(cpuset(&setid) == 0);
2865 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2866 			    CPU_WHICH_CPUSET, setid,
2867 			    sizeof(setmask), &setmask) == 0);
2868 
2869 			if (sigstop_from_main_thread) {
2870 				/*
2871 				 * We expect the SIGKILL sent when our parent
2872 				 * dies to be delivered to the new thread.
2873 				 * Raise the SIGSTOP in this thread so the
2874 				 * threads compete.
2875 				 */
2876 				CHILD_REQUIRE(pthread_create(&t, NULL,
2877 				    sleep_thread, NULL) == 0);
2878 				raise(SIGSTOP);
2879 			} else {
2880 				/*
2881 				 * We expect the SIGKILL to be delivered to
2882 				 * this thread. After creating the new thread,
2883 				 * just get off the CPU so the other thread can
2884 				 * raise the SIGSTOP.
2885 				 */
2886 				CHILD_REQUIRE(pthread_create(&t, NULL,
2887 				    raise_sigstop_thread, NULL) == 0);
2888 				sleep(60);
2889 			}
2890 
2891 			exit(0);
2892 		}
2893 		/* First stop is trace_me() immediately after fork. */
2894 		wpid = waitpid(fpid, &status, 0);
2895 		CHILD_REQUIRE(wpid == fpid);
2896 		CHILD_REQUIRE(WIFSTOPPED(status));
2897 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2898 
2899 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2900 
2901 		/* Second stop is from the raise(SIGSTOP). */
2902 		wpid = waitpid(fpid, &status, 0);
2903 		CHILD_REQUIRE(wpid == fpid);
2904 		CHILD_REQUIRE(WIFSTOPPED(status));
2905 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2906 
2907 		/*
2908 		 * Terminate tracing process without detaching. Our child
2909 		 * should be killed.
2910 		 */
2911 		exit(0);
2912 	}
2913 
2914 	/*
2915 	 * We should get a normal exit from our immediate child and a SIGKILL
2916 	 * exit from our grandchild. The latter case is the interesting one.
2917 	 * Our grandchild should not have stopped due to the SIGSTOP that was
2918 	 * left dangling when its parent died.
2919 	 */
2920 	for (i = 0; i < 2; ++i) {
2921 		wpid = wait(&status);
2922 		if (wpid == fpid)
2923 			ATF_REQUIRE(WIFEXITED(status) &&
2924 			    WEXITSTATUS(status) == 0);
2925 		else
2926 			ATF_REQUIRE(WIFSIGNALED(status) &&
2927 			    WTERMSIG(status) == SIGKILL);
2928 	}
2929 }
2930 
2931 /*
2932  * These two tests ensure that if the tracing process exits without detaching
2933  * just after the child received a SIGSTOP, the child is cleanly killed and
2934  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
2935  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
2936  * different threads, the SIGKILL must win.  There are two variants of this
2937  * test, designed to catch the case where the SIGKILL is delivered to the
2938  * younger thread (the first test) and the case where the SIGKILL is delivered
2939  * to the older thread (the second test). This behavior has changed in the
2940  * past, so make no assumption.
2941  */
2942 ATF_TC_WITHOUT_HEAD(ptrace__parent_terminate_with_pending_sigstop1);
2943 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
2944 {
2945 
2946 	terminate_with_pending_sigstop(true);
2947 }
2948 ATF_TC_WITHOUT_HEAD(ptrace__parent_terminate_with_pending_sigstop2);
2949 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
2950 {
2951 
2952 	terminate_with_pending_sigstop(false);
2953 }
2954 
2955 /*
2956  * Verify that after ptrace() discards a SIGKILL signal, the event mask
2957  * is not modified.
2958  */
2959 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
2960 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
2961 {
2962 	struct ptrace_lwpinfo pl;
2963 	pid_t fpid, wpid;
2964 	int status, event_mask, new_event_mask;
2965 
2966 	ATF_REQUIRE((fpid = fork()) != -1);
2967 	if (fpid == 0) {
2968 		trace_me();
2969 		raise(SIGSTOP);
2970 		exit(0);
2971 	}
2972 
2973 	/* The first wait() should report the stop from trace_me(). */
2974 	wpid = waitpid(fpid, &status, 0);
2975 	ATF_REQUIRE(wpid == fpid);
2976 	ATF_REQUIRE(WIFSTOPPED(status));
2977 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2978 
2979 	/* Set several unobtrusive event bits. */
2980 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
2981 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
2982 	    sizeof(event_mask)) == 0);
2983 
2984 	/* Send a SIGKILL without using ptrace. */
2985 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
2986 
2987 	/* Continue the child ignoring the SIGSTOP. */
2988 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2989 
2990 	/* The next stop should be due to the SIGKILL. */
2991 	wpid = waitpid(fpid, &status, 0);
2992 	ATF_REQUIRE(wpid == fpid);
2993 	ATF_REQUIRE(WIFSTOPPED(status));
2994 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
2995 
2996 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2997 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2998 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
2999 
3000 	/* Continue the child ignoring the SIGKILL. */
3001 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3002 
3003 	/* The next wait() should report the stop from SIGSTOP. */
3004 	wpid = waitpid(fpid, &status, 0);
3005 	ATF_REQUIRE(wpid == fpid);
3006 	ATF_REQUIRE(WIFSTOPPED(status));
3007 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3008 
3009 	/* Check the current event mask. It should not have changed. */
3010 	new_event_mask = 0;
3011 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3012 	    sizeof(new_event_mask)) == 0);
3013 	ATF_REQUIRE(event_mask == new_event_mask);
3014 
3015 	/* Continue the child to let it exit. */
3016 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3017 
3018 	/* The last event should be for the child process's exit. */
3019 	wpid = waitpid(fpid, &status, 0);
3020 	ATF_REQUIRE(WIFEXITED(status));
3021 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3022 
3023 	wpid = wait(&status);
3024 	ATF_REQUIRE(wpid == -1);
3025 	ATF_REQUIRE(errno == ECHILD);
3026 }
3027 
3028 ATF_TP_ADD_TCS(tp)
3029 {
3030 
3031 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
3032 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
3033 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
3034 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
3035 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
3036 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
3037 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
3038 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
3039 	ATF_TP_ADD_TC(tp,
3040 	    ptrace__follow_fork_child_detached_unrelated_debugger);
3041 	ATF_TP_ADD_TC(tp,
3042 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
3043 	ATF_TP_ADD_TC(tp, ptrace__getppid);
3044 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
3045 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
3046 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
3047 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
3048 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
3049 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
3050 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
3051 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
3052 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
3053 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
3054 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
3055 #if defined(__amd64__) || defined(__i386__) || defined(__sparc64__)
3056 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
3057 #endif
3058 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
3059 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
3060 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
3061 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
3062 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
3063 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
3064 	ATF_TP_ADD_TC(tp,
3065 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
3066 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
3067 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
3068 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
3069 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
3070 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
3071 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3072 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
3073 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
3074 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
3075 
3076 	return (atf_no_error());
3077 }
3078