xref: /freebsd/tests/sys/kern/ptrace_test.c (revision f157ca4696f5922275d5d451736005b9332eb136)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD$");
28 
29 #include <sys/types.h>
30 #include <sys/cpuset.h>
31 #include <sys/event.h>
32 #include <sys/file.h>
33 #include <sys/time.h>
34 #include <sys/procctl.h>
35 #include <sys/procdesc.h>
36 #define	_WANT_MIPS_REGNUM
37 #include <sys/ptrace.h>
38 #include <sys/queue.h>
39 #include <sys/runq.h>
40 #include <sys/syscall.h>
41 #include <sys/sysctl.h>
42 #include <sys/user.h>
43 #include <sys/wait.h>
44 #include <errno.h>
45 #include <machine/cpufunc.h>
46 #include <pthread.h>
47 #include <sched.h>
48 #include <semaphore.h>
49 #include <signal.h>
50 #include <stdio.h>
51 #include <stdlib.h>
52 #include <unistd.h>
53 #include <atf-c.h>
54 
55 /*
56  * Architectures with a user-visible breakpoint().
57  */
58 #if defined(__aarch64__) || defined(__amd64__) || defined(__arm__) ||	\
59     defined(__i386__) || defined(__mips__) || defined(__riscv) ||	\
60     defined(__sparc64__)
61 #define	HAVE_BREAKPOINT
62 #endif
63 
64 /*
65  * Adjust PC to skip over a breakpoint when stopped for a breakpoint trap.
66  */
67 #ifdef HAVE_BREAKPOINT
68 #if defined(__aarch64__)
69 #define	SKIP_BREAK(reg)	((reg)->elr += 4)
70 #elif defined(__amd64__) || defined(__i386__)
71 #define	SKIP_BREAK(reg)
72 #elif defined(__arm__)
73 #define	SKIP_BREAK(reg)	((reg)->r_pc += 4)
74 #elif defined(__mips__)
75 #define	SKIP_BREAK(reg)	((reg)->r_regs[PC] += 4)
76 #elif defined(__riscv)
77 #define	SKIP_BREAK(reg)	((reg)->sepc += 4)
78 #elif defined(__sparc64__)
79 #define	SKIP_BREAK(reg)	do {						\
80 	(reg)->r_tpc = (reg)->r_tnpc + 4;				\
81 	(reg)->r_tnpc += 8;						\
82 } while (0)
83 #endif
84 #endif
85 
86 /*
87  * A variant of ATF_REQUIRE that is suitable for use in child
88  * processes.  This only works if the parent process is tripped up by
89  * the early exit and fails some requirement itself.
90  */
91 #define	CHILD_REQUIRE(exp) do {						\
92 		if (!(exp))						\
93 			child_fail_require(__FILE__, __LINE__,		\
94 			    #exp " not met");				\
95 	} while (0)
96 
97 static __dead2 void
98 child_fail_require(const char *file, int line, const char *str)
99 {
100 	char buf[128];
101 
102 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
103 	write(2, buf, strlen(buf));
104 	_exit(32);
105 }
106 
107 static void
108 trace_me(void)
109 {
110 
111 	/* Attach the parent process as a tracer of this process. */
112 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
113 
114 	/* Trigger a stop. */
115 	raise(SIGSTOP);
116 }
117 
118 static void
119 attach_child(pid_t pid)
120 {
121 	pid_t wpid;
122 	int status;
123 
124 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
125 
126 	wpid = waitpid(pid, &status, 0);
127 	ATF_REQUIRE(wpid == pid);
128 	ATF_REQUIRE(WIFSTOPPED(status));
129 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
130 }
131 
132 static void
133 wait_for_zombie(pid_t pid)
134 {
135 
136 	/*
137 	 * Wait for a process to exit.  This is kind of gross, but
138 	 * there is not a better way.
139 	 *
140 	 * Prior to r325719, the kern.proc.pid.<pid> sysctl failed
141 	 * with ESRCH.  After that change, a valid struct kinfo_proc
142 	 * is returned for zombies with ki_stat set to SZOMB.
143 	 */
144 	for (;;) {
145 		struct kinfo_proc kp;
146 		size_t len;
147 		int mib[4];
148 
149 		mib[0] = CTL_KERN;
150 		mib[1] = KERN_PROC;
151 		mib[2] = KERN_PROC_PID;
152 		mib[3] = pid;
153 		len = sizeof(kp);
154 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
155 			ATF_REQUIRE(errno == ESRCH);
156 			break;
157 		}
158 		if (kp.ki_stat == SZOMB)
159 			break;
160 		usleep(5000);
161 	}
162 }
163 
164 /*
165  * Verify that a parent debugger process "sees" the exit of a debugged
166  * process exactly once when attached via PT_TRACE_ME.
167  */
168 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
169 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
170 {
171 	pid_t child, wpid;
172 	int status;
173 
174 	ATF_REQUIRE((child = fork()) != -1);
175 	if (child == 0) {
176 		/* Child process. */
177 		trace_me();
178 
179 		_exit(1);
180 	}
181 
182 	/* Parent process. */
183 
184 	/* The first wait() should report the stop from SIGSTOP. */
185 	wpid = waitpid(child, &status, 0);
186 	ATF_REQUIRE(wpid == child);
187 	ATF_REQUIRE(WIFSTOPPED(status));
188 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
189 
190 	/* Continue the child ignoring the SIGSTOP. */
191 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
192 
193 	/* The second wait() should report the exit status. */
194 	wpid = waitpid(child, &status, 0);
195 	ATF_REQUIRE(wpid == child);
196 	ATF_REQUIRE(WIFEXITED(status));
197 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
198 
199 	/* The child should no longer exist. */
200 	wpid = waitpid(child, &status, 0);
201 	ATF_REQUIRE(wpid == -1);
202 	ATF_REQUIRE(errno == ECHILD);
203 }
204 
205 /*
206  * Verify that a parent debugger process "sees" the exit of a debugged
207  * process exactly once when attached via PT_ATTACH.
208  */
209 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
210 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
211 {
212 	pid_t child, wpid;
213 	int cpipe[2], status;
214 	char c;
215 
216 	ATF_REQUIRE(pipe(cpipe) == 0);
217 	ATF_REQUIRE((child = fork()) != -1);
218 	if (child == 0) {
219 		/* Child process. */
220 		close(cpipe[0]);
221 
222 		/* Wait for the parent to attach. */
223 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
224 
225 		_exit(1);
226 	}
227 	close(cpipe[1]);
228 
229 	/* Parent process. */
230 
231 	/* Attach to the child process. */
232 	attach_child(child);
233 
234 	/* Continue the child ignoring the SIGSTOP. */
235 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
236 
237 	/* Signal the child to exit. */
238 	close(cpipe[0]);
239 
240 	/* The second wait() should report the exit status. */
241 	wpid = waitpid(child, &status, 0);
242 	ATF_REQUIRE(wpid == child);
243 	ATF_REQUIRE(WIFEXITED(status));
244 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
245 
246 	/* The child should no longer exist. */
247 	wpid = waitpid(child, &status, 0);
248 	ATF_REQUIRE(wpid == -1);
249 	ATF_REQUIRE(errno == ECHILD);
250 }
251 
252 /*
253  * Verify that a parent process "sees" the exit of a debugged process only
254  * after the debugger has seen it.
255  */
256 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
257 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
258 {
259 	pid_t child, debugger, wpid;
260 	int cpipe[2], dpipe[2], status;
261 	char c;
262 
263 	if (atf_tc_get_config_var_as_bool_wd(tc, "ci", false))
264 		atf_tc_skip("https://bugs.freebsd.org/239399");
265 
266 	ATF_REQUIRE(pipe(cpipe) == 0);
267 	ATF_REQUIRE((child = fork()) != -1);
268 
269 	if (child == 0) {
270 		/* Child process. */
271 		close(cpipe[0]);
272 
273 		/* Wait for parent to be ready. */
274 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
275 
276 		_exit(1);
277 	}
278 	close(cpipe[1]);
279 
280 	ATF_REQUIRE(pipe(dpipe) == 0);
281 	ATF_REQUIRE((debugger = fork()) != -1);
282 
283 	if (debugger == 0) {
284 		/* Debugger process. */
285 		close(dpipe[0]);
286 
287 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
288 
289 		wpid = waitpid(child, &status, 0);
290 		CHILD_REQUIRE(wpid == child);
291 		CHILD_REQUIRE(WIFSTOPPED(status));
292 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
293 
294 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
295 
296 		/* Signal parent that debugger is attached. */
297 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
298 
299 		/* Wait for parent's failed wait. */
300 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
301 
302 		wpid = waitpid(child, &status, 0);
303 		CHILD_REQUIRE(wpid == child);
304 		CHILD_REQUIRE(WIFEXITED(status));
305 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
306 
307 		_exit(0);
308 	}
309 	close(dpipe[1]);
310 
311 	/* Parent process. */
312 
313 	/* Wait for the debugger to attach to the child. */
314 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
315 
316 	/* Release the child. */
317 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
318 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
319 	close(cpipe[0]);
320 
321 	wait_for_zombie(child);
322 
323 	/*
324 	 * This wait should return a pid of 0 to indicate no status to
325 	 * report.  The parent should see the child as non-exited
326 	 * until the debugger sees the exit.
327 	 */
328 	wpid = waitpid(child, &status, WNOHANG);
329 	ATF_REQUIRE(wpid == 0);
330 
331 	/* Signal the debugger to wait for the child. */
332 	close(dpipe[0]);
333 
334 	/* Wait for the debugger. */
335 	wpid = waitpid(debugger, &status, 0);
336 	ATF_REQUIRE(wpid == debugger);
337 	ATF_REQUIRE(WIFEXITED(status));
338 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
339 
340 	/* The child process should now be ready. */
341 	wpid = waitpid(child, &status, WNOHANG);
342 	ATF_REQUIRE(wpid == child);
343 	ATF_REQUIRE(WIFEXITED(status));
344 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
345 }
346 
347 /*
348  * Verify that a parent process "sees" the exit of a debugged process
349  * only after a non-direct-child debugger has seen it.  In particular,
350  * various wait() calls in the parent must avoid failing with ESRCH by
351  * checking the parent's orphan list for the debugee.
352  */
353 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
354 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
355 {
356 	pid_t child, debugger, fpid, wpid;
357 	int cpipe[2], dpipe[2], status;
358 	char c;
359 
360 	ATF_REQUIRE(pipe(cpipe) == 0);
361 	ATF_REQUIRE((child = fork()) != -1);
362 
363 	if (child == 0) {
364 		/* Child process. */
365 		close(cpipe[0]);
366 
367 		/* Wait for parent to be ready. */
368 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
369 
370 		_exit(1);
371 	}
372 	close(cpipe[1]);
373 
374 	ATF_REQUIRE(pipe(dpipe) == 0);
375 	ATF_REQUIRE((debugger = fork()) != -1);
376 
377 	if (debugger == 0) {
378 		/* Debugger parent. */
379 
380 		/*
381 		 * Fork again and drop the debugger parent so that the
382 		 * debugger is not a child of the main parent.
383 		 */
384 		CHILD_REQUIRE((fpid = fork()) != -1);
385 		if (fpid != 0)
386 			_exit(2);
387 
388 		/* Debugger process. */
389 		close(dpipe[0]);
390 
391 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
392 
393 		wpid = waitpid(child, &status, 0);
394 		CHILD_REQUIRE(wpid == child);
395 		CHILD_REQUIRE(WIFSTOPPED(status));
396 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
397 
398 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
399 
400 		/* Signal parent that debugger is attached. */
401 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
402 
403 		/* Wait for parent's failed wait. */
404 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
405 
406 		wpid = waitpid(child, &status, 0);
407 		CHILD_REQUIRE(wpid == child);
408 		CHILD_REQUIRE(WIFEXITED(status));
409 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
410 
411 		_exit(0);
412 	}
413 	close(dpipe[1]);
414 
415 	/* Parent process. */
416 
417 	/* Wait for the debugger parent process to exit. */
418 	wpid = waitpid(debugger, &status, 0);
419 	ATF_REQUIRE(wpid == debugger);
420 	ATF_REQUIRE(WIFEXITED(status));
421 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
422 
423 	/* A WNOHANG wait here should see the non-exited child. */
424 	wpid = waitpid(child, &status, WNOHANG);
425 	ATF_REQUIRE(wpid == 0);
426 
427 	/* Wait for the debugger to attach to the child. */
428 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
429 
430 	/* Release the child. */
431 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
432 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
433 	close(cpipe[0]);
434 
435 	wait_for_zombie(child);
436 
437 	/*
438 	 * This wait should return a pid of 0 to indicate no status to
439 	 * report.  The parent should see the child as non-exited
440 	 * until the debugger sees the exit.
441 	 */
442 	wpid = waitpid(child, &status, WNOHANG);
443 	ATF_REQUIRE(wpid == 0);
444 
445 	/* Signal the debugger to wait for the child. */
446 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
447 
448 	/* Wait for the debugger. */
449 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
450 	close(dpipe[0]);
451 
452 	/* The child process should now be ready. */
453 	wpid = waitpid(child, &status, WNOHANG);
454 	ATF_REQUIRE(wpid == child);
455 	ATF_REQUIRE(WIFEXITED(status));
456 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
457 }
458 
459 /*
460  * Make sure that we can collect the exit status of an orphaned process.
461  */
462 ATF_TC_WITHOUT_HEAD(ptrace__parent_exits_before_child);
463 ATF_TC_BODY(ptrace__parent_exits_before_child, tc)
464 {
465 	ssize_t n;
466 	int cpipe1[2], cpipe2[2], gcpipe[2], status;
467 	pid_t child, gchild;
468 
469 	ATF_REQUIRE(pipe(cpipe1) == 0);
470 	ATF_REQUIRE(pipe(cpipe2) == 0);
471 	ATF_REQUIRE(pipe(gcpipe) == 0);
472 
473 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
474 
475 	ATF_REQUIRE((child = fork()) != -1);
476 	if (child == 0) {
477 		CHILD_REQUIRE((gchild = fork()) != -1);
478 		if (gchild == 0) {
479 			status = 1;
480 			do {
481 				n = read(gcpipe[0], &status, sizeof(status));
482 			} while (n == -1 && errno == EINTR);
483 			_exit(status);
484 		}
485 
486 		CHILD_REQUIRE(write(cpipe1[1], &gchild, sizeof(gchild)) ==
487 		    sizeof(gchild));
488 		CHILD_REQUIRE(read(cpipe2[0], &status, sizeof(status)) ==
489 		    sizeof(status));
490 		_exit(status);
491 	}
492 
493 	ATF_REQUIRE(read(cpipe1[0], &gchild, sizeof(gchild)) == sizeof(gchild));
494 
495 	ATF_REQUIRE(ptrace(PT_ATTACH, gchild, NULL, 0) == 0);
496 
497 	status = 0;
498 	ATF_REQUIRE(write(cpipe2[1], &status, sizeof(status)) ==
499 	    sizeof(status));
500 	ATF_REQUIRE(waitpid(child, &status, 0) == child);
501 	ATF_REQUIRE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
502 
503 	status = 0;
504 	ATF_REQUIRE(write(gcpipe[1], &status, sizeof(status)) ==
505 	    sizeof(status));
506 	ATF_REQUIRE(waitpid(gchild, &status, 0) == gchild);
507 	ATF_REQUIRE(WIFSTOPPED(status));
508 	ATF_REQUIRE(ptrace(PT_DETACH, gchild, (caddr_t)1, 0) == 0);
509 	ATF_REQUIRE(waitpid(gchild, &status, 0) == gchild);
510 	ATF_REQUIRE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
511 
512 	ATF_REQUIRE(close(cpipe1[0]) == 0);
513 	ATF_REQUIRE(close(cpipe1[1]) == 0);
514 	ATF_REQUIRE(close(cpipe2[0]) == 0);
515 	ATF_REQUIRE(close(cpipe2[1]) == 0);
516 	ATF_REQUIRE(close(gcpipe[0]) == 0);
517 	ATF_REQUIRE(close(gcpipe[1]) == 0);
518 }
519 
520 /*
521  * The parent process should always act the same regardless of how the
522  * debugger is attached to it.
523  */
524 static __dead2 void
525 follow_fork_parent(bool use_vfork)
526 {
527 	pid_t fpid, wpid;
528 	int status;
529 
530 	if (use_vfork)
531 		CHILD_REQUIRE((fpid = vfork()) != -1);
532 	else
533 		CHILD_REQUIRE((fpid = fork()) != -1);
534 
535 	if (fpid == 0)
536 		/* Child */
537 		_exit(2);
538 
539 	wpid = waitpid(fpid, &status, 0);
540 	CHILD_REQUIRE(wpid == fpid);
541 	CHILD_REQUIRE(WIFEXITED(status));
542 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
543 
544 	_exit(1);
545 }
546 
547 /*
548  * Helper routine for follow fork tests.  This waits for two stops
549  * that report both "sides" of a fork.  It returns the pid of the new
550  * child process.
551  */
552 static pid_t
553 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
554 {
555 	struct ptrace_lwpinfo pl;
556 	bool fork_reported[2];
557 	pid_t child, wpid;
558 	int i, status;
559 
560 	fork_reported[0] = false;
561 	fork_reported[1] = false;
562 	child = -1;
563 
564 	/*
565 	 * Each process should report a fork event.  The parent should
566 	 * report a PL_FLAG_FORKED event, and the child should report
567 	 * a PL_FLAG_CHILD event.
568 	 */
569 	for (i = 0; i < 2; i++) {
570 		wpid = wait(&status);
571 		ATF_REQUIRE(wpid > 0);
572 		ATF_REQUIRE(WIFSTOPPED(status));
573 
574 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
575 		    sizeof(pl)) != -1);
576 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
577 		    0);
578 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
579 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
580 		if (pl.pl_flags & PL_FLAG_CHILD) {
581 			ATF_REQUIRE(wpid != parent);
582 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
583 			ATF_REQUIRE(!fork_reported[1]);
584 			if (child == -1)
585 				child = wpid;
586 			else
587 				ATF_REQUIRE(child == wpid);
588 			if (ppl != NULL)
589 				ppl[1] = pl;
590 			fork_reported[1] = true;
591 		} else {
592 			ATF_REQUIRE(wpid == parent);
593 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
594 			ATF_REQUIRE(!fork_reported[0]);
595 			if (child == -1)
596 				child = pl.pl_child_pid;
597 			else
598 				ATF_REQUIRE(child == pl.pl_child_pid);
599 			if (ppl != NULL)
600 				ppl[0] = pl;
601 			fork_reported[0] = true;
602 		}
603 	}
604 
605 	return (child);
606 }
607 
608 /*
609  * Verify that a new child process is stopped after a followed fork and
610  * that the traced parent sees the exit of the child after the debugger
611  * when both processes remain attached to the debugger.
612  */
613 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
614 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
615 {
616 	pid_t children[2], fpid, wpid;
617 	int status;
618 
619 	ATF_REQUIRE((fpid = fork()) != -1);
620 	if (fpid == 0) {
621 		trace_me();
622 		follow_fork_parent(false);
623 	}
624 
625 	/* Parent process. */
626 	children[0] = fpid;
627 
628 	/* The first wait() should report the stop from SIGSTOP. */
629 	wpid = waitpid(children[0], &status, 0);
630 	ATF_REQUIRE(wpid == children[0]);
631 	ATF_REQUIRE(WIFSTOPPED(status));
632 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
633 
634 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
635 
636 	/* Continue the child ignoring the SIGSTOP. */
637 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
638 
639 	children[1] = handle_fork_events(children[0], NULL);
640 	ATF_REQUIRE(children[1] > 0);
641 
642 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
643 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
644 
645 	/*
646 	 * The child can't exit until the grandchild reports status, so the
647 	 * grandchild should report its exit first to the debugger.
648 	 */
649 	wpid = wait(&status);
650 	ATF_REQUIRE(wpid == children[1]);
651 	ATF_REQUIRE(WIFEXITED(status));
652 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
653 
654 	wpid = wait(&status);
655 	ATF_REQUIRE(wpid == children[0]);
656 	ATF_REQUIRE(WIFEXITED(status));
657 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
658 
659 	wpid = wait(&status);
660 	ATF_REQUIRE(wpid == -1);
661 	ATF_REQUIRE(errno == ECHILD);
662 }
663 
664 /*
665  * Verify that a new child process is stopped after a followed fork
666  * and that the traced parent sees the exit of the child when the new
667  * child process is detached after it reports its fork.
668  */
669 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
670 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
671 {
672 	pid_t children[2], fpid, wpid;
673 	int status;
674 
675 	ATF_REQUIRE((fpid = fork()) != -1);
676 	if (fpid == 0) {
677 		trace_me();
678 		follow_fork_parent(false);
679 	}
680 
681 	/* Parent process. */
682 	children[0] = fpid;
683 
684 	/* The first wait() should report the stop from SIGSTOP. */
685 	wpid = waitpid(children[0], &status, 0);
686 	ATF_REQUIRE(wpid == children[0]);
687 	ATF_REQUIRE(WIFSTOPPED(status));
688 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
689 
690 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
691 
692 	/* Continue the child ignoring the SIGSTOP. */
693 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
694 
695 	children[1] = handle_fork_events(children[0], NULL);
696 	ATF_REQUIRE(children[1] > 0);
697 
698 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
699 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
700 
701 	/*
702 	 * Should not see any status from the grandchild now, only the
703 	 * child.
704 	 */
705 	wpid = wait(&status);
706 	ATF_REQUIRE(wpid == children[0]);
707 	ATF_REQUIRE(WIFEXITED(status));
708 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
709 
710 	wpid = wait(&status);
711 	ATF_REQUIRE(wpid == -1);
712 	ATF_REQUIRE(errno == ECHILD);
713 }
714 
715 /*
716  * Verify that a new child process is stopped after a followed fork
717  * and that the traced parent sees the exit of the child when the
718  * traced parent is detached after the fork.
719  */
720 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
721 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
722 {
723 	pid_t children[2], fpid, wpid;
724 	int status;
725 
726 	ATF_REQUIRE((fpid = fork()) != -1);
727 	if (fpid == 0) {
728 		trace_me();
729 		follow_fork_parent(false);
730 	}
731 
732 	/* Parent process. */
733 	children[0] = fpid;
734 
735 	/* The first wait() should report the stop from SIGSTOP. */
736 	wpid = waitpid(children[0], &status, 0);
737 	ATF_REQUIRE(wpid == children[0]);
738 	ATF_REQUIRE(WIFSTOPPED(status));
739 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
740 
741 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
742 
743 	/* Continue the child ignoring the SIGSTOP. */
744 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
745 
746 	children[1] = handle_fork_events(children[0], NULL);
747 	ATF_REQUIRE(children[1] > 0);
748 
749 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
750 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
751 
752 	/*
753 	 * The child can't exit until the grandchild reports status, so the
754 	 * grandchild should report its exit first to the debugger.
755 	 *
756 	 * Even though the child process is detached, it is still a
757 	 * child of the debugger, so it will still report it's exit
758 	 * after the grandchild.
759 	 */
760 	wpid = wait(&status);
761 	ATF_REQUIRE(wpid == children[1]);
762 	ATF_REQUIRE(WIFEXITED(status));
763 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
764 
765 	wpid = wait(&status);
766 	ATF_REQUIRE(wpid == children[0]);
767 	ATF_REQUIRE(WIFEXITED(status));
768 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
769 
770 	wpid = wait(&status);
771 	ATF_REQUIRE(wpid == -1);
772 	ATF_REQUIRE(errno == ECHILD);
773 }
774 
775 static void
776 attach_fork_parent(int cpipe[2])
777 {
778 	pid_t fpid;
779 
780 	close(cpipe[0]);
781 
782 	/* Double-fork to disassociate from the debugger. */
783 	CHILD_REQUIRE((fpid = fork()) != -1);
784 	if (fpid != 0)
785 		_exit(3);
786 
787 	/* Send the pid of the disassociated child to the debugger. */
788 	fpid = getpid();
789 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
790 
791 	/* Wait for the debugger to attach. */
792 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
793 }
794 
795 /*
796  * Verify that a new child process is stopped after a followed fork and
797  * that the traced parent sees the exit of the child after the debugger
798  * when both processes remain attached to the debugger.  In this test
799  * the parent that forks is not a direct child of the debugger.
800  */
801 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
802 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
803 {
804 	pid_t children[2], fpid, wpid;
805 	int cpipe[2], status;
806 
807 	if (atf_tc_get_config_var_as_bool_wd(tc, "ci", false))
808 		atf_tc_skip("https://bugs.freebsd.org/239397");
809 
810 	ATF_REQUIRE(pipe(cpipe) == 0);
811 	ATF_REQUIRE((fpid = fork()) != -1);
812 	if (fpid == 0) {
813 		attach_fork_parent(cpipe);
814 		follow_fork_parent(false);
815 	}
816 
817 	/* Parent process. */
818 	close(cpipe[1]);
819 
820 	/* Wait for the direct child to exit. */
821 	wpid = waitpid(fpid, &status, 0);
822 	ATF_REQUIRE(wpid == fpid);
823 	ATF_REQUIRE(WIFEXITED(status));
824 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
825 
826 	/* Read the pid of the fork parent. */
827 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
828 	    sizeof(children[0]));
829 
830 	/* Attach to the fork parent. */
831 	attach_child(children[0]);
832 
833 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
834 
835 	/* Continue the fork parent ignoring the SIGSTOP. */
836 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
837 
838 	/* Signal the fork parent to continue. */
839 	close(cpipe[0]);
840 
841 	children[1] = handle_fork_events(children[0], NULL);
842 	ATF_REQUIRE(children[1] > 0);
843 
844 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
845 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
846 
847 	/*
848 	 * The fork parent can't exit until the child reports status,
849 	 * so the child should report its exit first to the debugger.
850 	 */
851 	wpid = wait(&status);
852 	ATF_REQUIRE(wpid == children[1]);
853 	ATF_REQUIRE(WIFEXITED(status));
854 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
855 
856 	wpid = wait(&status);
857 	ATF_REQUIRE(wpid == children[0]);
858 	ATF_REQUIRE(WIFEXITED(status));
859 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
860 
861 	wpid = wait(&status);
862 	ATF_REQUIRE(wpid == -1);
863 	ATF_REQUIRE(errno == ECHILD);
864 }
865 
866 /*
867  * Verify that a new child process is stopped after a followed fork
868  * and that the traced parent sees the exit of the child when the new
869  * child process is detached after it reports its fork.  In this test
870  * the parent that forks is not a direct child of the debugger.
871  */
872 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
873 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
874 {
875 	pid_t children[2], fpid, wpid;
876 	int cpipe[2], status;
877 
878 	if (atf_tc_get_config_var_as_bool_wd(tc, "ci", false))
879 		atf_tc_skip("https://bugs.freebsd.org/239292");
880 
881 	ATF_REQUIRE(pipe(cpipe) == 0);
882 	ATF_REQUIRE((fpid = fork()) != -1);
883 	if (fpid == 0) {
884 		attach_fork_parent(cpipe);
885 		follow_fork_parent(false);
886 	}
887 
888 	/* Parent process. */
889 	close(cpipe[1]);
890 
891 	/* Wait for the direct child to exit. */
892 	wpid = waitpid(fpid, &status, 0);
893 	ATF_REQUIRE(wpid == fpid);
894 	ATF_REQUIRE(WIFEXITED(status));
895 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
896 
897 	/* Read the pid of the fork parent. */
898 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
899 	    sizeof(children[0]));
900 
901 	/* Attach to the fork parent. */
902 	attach_child(children[0]);
903 
904 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
905 
906 	/* Continue the fork parent ignoring the SIGSTOP. */
907 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
908 
909 	/* Signal the fork parent to continue. */
910 	close(cpipe[0]);
911 
912 	children[1] = handle_fork_events(children[0], NULL);
913 	ATF_REQUIRE(children[1] > 0);
914 
915 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
916 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
917 
918 	/*
919 	 * Should not see any status from the child now, only the fork
920 	 * parent.
921 	 */
922 	wpid = wait(&status);
923 	ATF_REQUIRE(wpid == children[0]);
924 	ATF_REQUIRE(WIFEXITED(status));
925 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
926 
927 	wpid = wait(&status);
928 	ATF_REQUIRE(wpid == -1);
929 	ATF_REQUIRE(errno == ECHILD);
930 }
931 
932 /*
933  * Verify that a new child process is stopped after a followed fork
934  * and that the traced parent sees the exit of the child when the
935  * traced parent is detached after the fork.  In this test the parent
936  * that forks is not a direct child of the debugger.
937  */
938 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
939 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
940 {
941 	pid_t children[2], fpid, wpid;
942 	int cpipe[2], status;
943 
944 	if (atf_tc_get_config_var_as_bool_wd(tc, "ci", false))
945 		atf_tc_skip("https://bugs.freebsd.org/239425");
946 
947 	ATF_REQUIRE(pipe(cpipe) == 0);
948 	ATF_REQUIRE((fpid = fork()) != -1);
949 	if (fpid == 0) {
950 		attach_fork_parent(cpipe);
951 		follow_fork_parent(false);
952 	}
953 
954 	/* Parent process. */
955 	close(cpipe[1]);
956 
957 	/* Wait for the direct child to exit. */
958 	wpid = waitpid(fpid, &status, 0);
959 	ATF_REQUIRE(wpid == fpid);
960 	ATF_REQUIRE(WIFEXITED(status));
961 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
962 
963 	/* Read the pid of the fork parent. */
964 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
965 	    sizeof(children[0]));
966 
967 	/* Attach to the fork parent. */
968 	attach_child(children[0]);
969 
970 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
971 
972 	/* Continue the fork parent ignoring the SIGSTOP. */
973 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
974 
975 	/* Signal the fork parent to continue. */
976 	close(cpipe[0]);
977 
978 	children[1] = handle_fork_events(children[0], NULL);
979 	ATF_REQUIRE(children[1] > 0);
980 
981 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
982 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
983 
984 	/*
985 	 * Should not see any status from the fork parent now, only
986 	 * the child.
987 	 */
988 	wpid = wait(&status);
989 	ATF_REQUIRE(wpid == children[1]);
990 	ATF_REQUIRE(WIFEXITED(status));
991 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
992 
993 	wpid = wait(&status);
994 	ATF_REQUIRE(wpid == -1);
995 	ATF_REQUIRE(errno == ECHILD);
996 }
997 
998 /*
999  * Verify that a child process does not see an unrelated debugger as its
1000  * parent but sees its original parent process.
1001  */
1002 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
1003 ATF_TC_BODY(ptrace__getppid, tc)
1004 {
1005 	pid_t child, debugger, ppid, wpid;
1006 	int cpipe[2], dpipe[2], status;
1007 	char c;
1008 
1009 	if (atf_tc_get_config_var_as_bool_wd(tc, "ci", false))
1010 		atf_tc_skip("https://bugs.freebsd.org/240510");
1011 
1012 
1013 	ATF_REQUIRE(pipe(cpipe) == 0);
1014 	ATF_REQUIRE((child = fork()) != -1);
1015 
1016 	if (child == 0) {
1017 		/* Child process. */
1018 		close(cpipe[0]);
1019 
1020 		/* Wait for parent to be ready. */
1021 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
1022 
1023 		/* Report the parent PID to the parent. */
1024 		ppid = getppid();
1025 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
1026 		    sizeof(ppid));
1027 
1028 		_exit(1);
1029 	}
1030 	close(cpipe[1]);
1031 
1032 	ATF_REQUIRE(pipe(dpipe) == 0);
1033 	ATF_REQUIRE((debugger = fork()) != -1);
1034 
1035 	if (debugger == 0) {
1036 		/* Debugger process. */
1037 		close(dpipe[0]);
1038 
1039 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
1040 
1041 		wpid = waitpid(child, &status, 0);
1042 		CHILD_REQUIRE(wpid == child);
1043 		CHILD_REQUIRE(WIFSTOPPED(status));
1044 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1045 
1046 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
1047 
1048 		/* Signal parent that debugger is attached. */
1049 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
1050 
1051 		/* Wait for traced child to exit. */
1052 		wpid = waitpid(child, &status, 0);
1053 		CHILD_REQUIRE(wpid == child);
1054 		CHILD_REQUIRE(WIFEXITED(status));
1055 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
1056 
1057 		_exit(0);
1058 	}
1059 	close(dpipe[1]);
1060 
1061 	/* Parent process. */
1062 
1063 	/* Wait for the debugger to attach to the child. */
1064 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
1065 
1066 	/* Release the child. */
1067 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
1068 
1069 	/* Read the parent PID from the child. */
1070 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
1071 	close(cpipe[0]);
1072 
1073 	ATF_REQUIRE(ppid == getpid());
1074 
1075 	/* Wait for the debugger. */
1076 	wpid = waitpid(debugger, &status, 0);
1077 	ATF_REQUIRE(wpid == debugger);
1078 	ATF_REQUIRE(WIFEXITED(status));
1079 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1080 
1081 	/* The child process should now be ready. */
1082 	wpid = waitpid(child, &status, WNOHANG);
1083 	ATF_REQUIRE(wpid == child);
1084 	ATF_REQUIRE(WIFEXITED(status));
1085 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1086 }
1087 
1088 /*
1089  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1090  * child process created via fork() reports the correct value.
1091  */
1092 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
1093 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
1094 {
1095 	struct ptrace_lwpinfo pl[2];
1096 	pid_t children[2], fpid, wpid;
1097 	int status;
1098 
1099 	ATF_REQUIRE((fpid = fork()) != -1);
1100 	if (fpid == 0) {
1101 		trace_me();
1102 		follow_fork_parent(false);
1103 	}
1104 
1105 	/* Parent process. */
1106 	children[0] = fpid;
1107 
1108 	/* The first wait() should report the stop from SIGSTOP. */
1109 	wpid = waitpid(children[0], &status, 0);
1110 	ATF_REQUIRE(wpid == children[0]);
1111 	ATF_REQUIRE(WIFSTOPPED(status));
1112 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1113 
1114 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1115 
1116 	/* Continue the child ignoring the SIGSTOP. */
1117 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1118 
1119 	/* Wait for both halves of the fork event to get reported. */
1120 	children[1] = handle_fork_events(children[0], pl);
1121 	ATF_REQUIRE(children[1] > 0);
1122 
1123 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1124 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1125 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1126 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1127 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1128 
1129 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1130 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1131 
1132 	/*
1133 	 * The child can't exit until the grandchild reports status, so the
1134 	 * grandchild should report its exit first to the debugger.
1135 	 */
1136 	wpid = wait(&status);
1137 	ATF_REQUIRE(wpid == children[1]);
1138 	ATF_REQUIRE(WIFEXITED(status));
1139 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1140 
1141 	wpid = wait(&status);
1142 	ATF_REQUIRE(wpid == children[0]);
1143 	ATF_REQUIRE(WIFEXITED(status));
1144 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1145 
1146 	wpid = wait(&status);
1147 	ATF_REQUIRE(wpid == -1);
1148 	ATF_REQUIRE(errno == ECHILD);
1149 }
1150 
1151 /*
1152  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1153  * child process created via vfork() reports the correct value.
1154  */
1155 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1156 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1157 {
1158 	struct ptrace_lwpinfo pl[2];
1159 	pid_t children[2], fpid, wpid;
1160 	int status;
1161 
1162 	ATF_REQUIRE((fpid = fork()) != -1);
1163 	if (fpid == 0) {
1164 		trace_me();
1165 		follow_fork_parent(true);
1166 	}
1167 
1168 	/* Parent process. */
1169 	children[0] = fpid;
1170 
1171 	/* The first wait() should report the stop from SIGSTOP. */
1172 	wpid = waitpid(children[0], &status, 0);
1173 	ATF_REQUIRE(wpid == children[0]);
1174 	ATF_REQUIRE(WIFSTOPPED(status));
1175 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1176 
1177 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1178 
1179 	/* Continue the child ignoring the SIGSTOP. */
1180 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1181 
1182 	/* Wait for both halves of the fork event to get reported. */
1183 	children[1] = handle_fork_events(children[0], pl);
1184 	ATF_REQUIRE(children[1] > 0);
1185 
1186 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1187 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1188 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1189 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1190 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1191 
1192 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1193 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1194 
1195 	/*
1196 	 * The child can't exit until the grandchild reports status, so the
1197 	 * grandchild should report its exit first to the debugger.
1198 	 */
1199 	wpid = wait(&status);
1200 	ATF_REQUIRE(wpid == children[1]);
1201 	ATF_REQUIRE(WIFEXITED(status));
1202 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1203 
1204 	wpid = wait(&status);
1205 	ATF_REQUIRE(wpid == children[0]);
1206 	ATF_REQUIRE(WIFEXITED(status));
1207 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1208 
1209 	wpid = wait(&status);
1210 	ATF_REQUIRE(wpid == -1);
1211 	ATF_REQUIRE(errno == ECHILD);
1212 }
1213 
1214 static void *
1215 simple_thread(void *arg __unused)
1216 {
1217 
1218 	pthread_exit(NULL);
1219 }
1220 
1221 static __dead2 void
1222 simple_thread_main(void)
1223 {
1224 	pthread_t thread;
1225 
1226 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1227 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1228 	exit(1);
1229 }
1230 
1231 /*
1232  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1233  * thread reports the correct value.
1234  */
1235 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1236 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1237 {
1238 	struct ptrace_lwpinfo pl;
1239 	pid_t fpid, wpid;
1240 	lwpid_t mainlwp;
1241 	int status;
1242 
1243 	ATF_REQUIRE((fpid = fork()) != -1);
1244 	if (fpid == 0) {
1245 		trace_me();
1246 		simple_thread_main();
1247 	}
1248 
1249 	/* The first wait() should report the stop from SIGSTOP. */
1250 	wpid = waitpid(fpid, &status, 0);
1251 	ATF_REQUIRE(wpid == fpid);
1252 	ATF_REQUIRE(WIFSTOPPED(status));
1253 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1254 
1255 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1256 	    sizeof(pl)) != -1);
1257 	mainlwp = pl.pl_lwpid;
1258 
1259 	/*
1260 	 * Continue the child ignoring the SIGSTOP and tracing all
1261 	 * system call exits.
1262 	 */
1263 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1264 
1265 	/*
1266 	 * Wait for the new thread to arrive.  pthread_create() might
1267 	 * invoke any number of system calls.  For now we just wait
1268 	 * for the new thread to arrive and make sure it reports a
1269 	 * valid system call code.  If ptrace grows thread event
1270 	 * reporting then this test can be made more precise.
1271 	 */
1272 	for (;;) {
1273 		wpid = waitpid(fpid, &status, 0);
1274 		ATF_REQUIRE(wpid == fpid);
1275 		ATF_REQUIRE(WIFSTOPPED(status));
1276 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1277 
1278 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1279 		    sizeof(pl)) != -1);
1280 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1281 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1282 		if (pl.pl_lwpid != mainlwp)
1283 			/* New thread seen. */
1284 			break;
1285 
1286 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1287 	}
1288 
1289 	/* Wait for the child to exit. */
1290 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1291 	for (;;) {
1292 		wpid = waitpid(fpid, &status, 0);
1293 		ATF_REQUIRE(wpid == fpid);
1294 		if (WIFEXITED(status))
1295 			break;
1296 
1297 		ATF_REQUIRE(WIFSTOPPED(status));
1298 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1299 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1300 	}
1301 
1302 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1303 
1304 	wpid = wait(&status);
1305 	ATF_REQUIRE(wpid == -1);
1306 	ATF_REQUIRE(errno == ECHILD);
1307 }
1308 
1309 /*
1310  * Verify that the expected LWP events are reported for a child thread.
1311  */
1312 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1313 ATF_TC_BODY(ptrace__lwp_events, tc)
1314 {
1315 	struct ptrace_lwpinfo pl;
1316 	pid_t fpid, wpid;
1317 	lwpid_t lwps[2];
1318 	int status;
1319 
1320 	ATF_REQUIRE((fpid = fork()) != -1);
1321 	if (fpid == 0) {
1322 		trace_me();
1323 		simple_thread_main();
1324 	}
1325 
1326 	/* The first wait() should report the stop from SIGSTOP. */
1327 	wpid = waitpid(fpid, &status, 0);
1328 	ATF_REQUIRE(wpid == fpid);
1329 	ATF_REQUIRE(WIFSTOPPED(status));
1330 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1331 
1332 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1333 	    sizeof(pl)) != -1);
1334 	lwps[0] = pl.pl_lwpid;
1335 
1336 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1337 
1338 	/* Continue the child ignoring the SIGSTOP. */
1339 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1340 
1341 	/* The first event should be for the child thread's birth. */
1342 	wpid = waitpid(fpid, &status, 0);
1343 	ATF_REQUIRE(wpid == fpid);
1344 	ATF_REQUIRE(WIFSTOPPED(status));
1345 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1346 
1347 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1348 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1349 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1350 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1351 	lwps[1] = pl.pl_lwpid;
1352 
1353 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1354 
1355 	/* The next event should be for the child thread's death. */
1356 	wpid = waitpid(fpid, &status, 0);
1357 	ATF_REQUIRE(wpid == fpid);
1358 	ATF_REQUIRE(WIFSTOPPED(status));
1359 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1360 
1361 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1362 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1363 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1364 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1365 
1366 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1367 
1368 	/* The last event should be for the child process's exit. */
1369 	wpid = waitpid(fpid, &status, 0);
1370 	ATF_REQUIRE(WIFEXITED(status));
1371 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1372 
1373 	wpid = wait(&status);
1374 	ATF_REQUIRE(wpid == -1);
1375 	ATF_REQUIRE(errno == ECHILD);
1376 }
1377 
1378 static void *
1379 exec_thread(void *arg __unused)
1380 {
1381 
1382 	execl("/usr/bin/true", "true", NULL);
1383 	exit(127);
1384 }
1385 
1386 static __dead2 void
1387 exec_thread_main(void)
1388 {
1389 	pthread_t thread;
1390 
1391 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1392 	for (;;)
1393 		sleep(60);
1394 	exit(1);
1395 }
1396 
1397 /*
1398  * Verify that the expected LWP events are reported for a multithreaded
1399  * process that calls execve(2).
1400  */
1401 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1402 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1403 {
1404 	struct ptrace_lwpinfo pl;
1405 	pid_t fpid, wpid;
1406 	lwpid_t lwps[2];
1407 	int status;
1408 
1409 	ATF_REQUIRE((fpid = fork()) != -1);
1410 	if (fpid == 0) {
1411 		trace_me();
1412 		exec_thread_main();
1413 	}
1414 
1415 	/* The first wait() should report the stop from SIGSTOP. */
1416 	wpid = waitpid(fpid, &status, 0);
1417 	ATF_REQUIRE(wpid == fpid);
1418 	ATF_REQUIRE(WIFSTOPPED(status));
1419 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1420 
1421 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1422 	    sizeof(pl)) != -1);
1423 	lwps[0] = pl.pl_lwpid;
1424 
1425 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1426 
1427 	/* Continue the child ignoring the SIGSTOP. */
1428 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1429 
1430 	/* The first event should be for the child thread's birth. */
1431 	wpid = waitpid(fpid, &status, 0);
1432 	ATF_REQUIRE(wpid == fpid);
1433 	ATF_REQUIRE(WIFSTOPPED(status));
1434 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1435 
1436 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1437 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1438 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1439 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1440 	lwps[1] = pl.pl_lwpid;
1441 
1442 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1443 
1444 	/*
1445 	 * The next event should be for the main thread's death due to
1446 	 * single threading from execve().
1447 	 */
1448 	wpid = waitpid(fpid, &status, 0);
1449 	ATF_REQUIRE(wpid == fpid);
1450 	ATF_REQUIRE(WIFSTOPPED(status));
1451 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1452 
1453 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1454 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1455 	    (PL_FLAG_EXITED));
1456 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1457 
1458 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1459 
1460 	/* The next event should be for the child process's exec. */
1461 	wpid = waitpid(fpid, &status, 0);
1462 	ATF_REQUIRE(WIFSTOPPED(status));
1463 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1464 
1465 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1466 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1467 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1468 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1469 
1470 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1471 
1472 	/* The last event should be for the child process's exit. */
1473 	wpid = waitpid(fpid, &status, 0);
1474 	ATF_REQUIRE(WIFEXITED(status));
1475 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1476 
1477 	wpid = wait(&status);
1478 	ATF_REQUIRE(wpid == -1);
1479 	ATF_REQUIRE(errno == ECHILD);
1480 }
1481 
1482 static void
1483 handler(int sig __unused)
1484 {
1485 }
1486 
1487 static void
1488 signal_main(void)
1489 {
1490 
1491 	signal(SIGINFO, handler);
1492 	raise(SIGINFO);
1493 	exit(0);
1494 }
1495 
1496 /*
1497  * Verify that the expected ptrace event is reported for a signal.
1498  */
1499 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1500 ATF_TC_BODY(ptrace__siginfo, tc)
1501 {
1502 	struct ptrace_lwpinfo pl;
1503 	pid_t fpid, wpid;
1504 	int status;
1505 
1506 	ATF_REQUIRE((fpid = fork()) != -1);
1507 	if (fpid == 0) {
1508 		trace_me();
1509 		signal_main();
1510 	}
1511 
1512 	/* The first wait() should report the stop from SIGSTOP. */
1513 	wpid = waitpid(fpid, &status, 0);
1514 	ATF_REQUIRE(wpid == fpid);
1515 	ATF_REQUIRE(WIFSTOPPED(status));
1516 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1517 
1518 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1519 
1520 	/* The next event should be for the SIGINFO. */
1521 	wpid = waitpid(fpid, &status, 0);
1522 	ATF_REQUIRE(WIFSTOPPED(status));
1523 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1524 
1525 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1526 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1527 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1528 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1529 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1530 
1531 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1532 
1533 	/* The last event should be for the child process's exit. */
1534 	wpid = waitpid(fpid, &status, 0);
1535 	ATF_REQUIRE(WIFEXITED(status));
1536 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1537 
1538 	wpid = wait(&status);
1539 	ATF_REQUIRE(wpid == -1);
1540 	ATF_REQUIRE(errno == ECHILD);
1541 }
1542 
1543 /*
1544  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1545  */
1546 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1547 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1548 {
1549 	pid_t fpid, wpid;
1550 	int events, status;
1551 
1552 	ATF_REQUIRE((fpid = fork()) != -1);
1553 	if (fpid == 0) {
1554 		trace_me();
1555 		exec_thread(NULL);
1556 	}
1557 
1558 	/* The first wait() should report the stop from SIGSTOP. */
1559 	wpid = waitpid(fpid, &status, 0);
1560 	ATF_REQUIRE(wpid == fpid);
1561 	ATF_REQUIRE(WIFSTOPPED(status));
1562 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1563 
1564 	events = 0;
1565 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1566 	    sizeof(events)) == 0);
1567 
1568 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1569 
1570 	/* Should get one event at exit. */
1571 	wpid = waitpid(fpid, &status, 0);
1572 	ATF_REQUIRE(WIFEXITED(status));
1573 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1574 
1575 	wpid = wait(&status);
1576 	ATF_REQUIRE(wpid == -1);
1577 	ATF_REQUIRE(errno == ECHILD);
1578 }
1579 
1580 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1581 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1582 {
1583 	struct ptrace_lwpinfo pl;
1584 	pid_t fpid, wpid;
1585 	int events, status;
1586 
1587 	ATF_REQUIRE((fpid = fork()) != -1);
1588 	if (fpid == 0) {
1589 		trace_me();
1590 		exec_thread(NULL);
1591 	}
1592 
1593 	/* The first wait() should report the stop from SIGSTOP. */
1594 	wpid = waitpid(fpid, &status, 0);
1595 	ATF_REQUIRE(wpid == fpid);
1596 	ATF_REQUIRE(WIFSTOPPED(status));
1597 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1598 
1599 	events = PTRACE_EXEC;
1600 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1601 	    sizeof(events)) == 0);
1602 
1603 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1604 
1605 	/* The next event should be for the child process's exec. */
1606 	wpid = waitpid(fpid, &status, 0);
1607 	ATF_REQUIRE(WIFSTOPPED(status));
1608 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1609 
1610 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1611 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1612 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1613 
1614 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1615 
1616 	/* The last event should be for the child process's exit. */
1617 	wpid = waitpid(fpid, &status, 0);
1618 	ATF_REQUIRE(WIFEXITED(status));
1619 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1620 
1621 	wpid = wait(&status);
1622 	ATF_REQUIRE(wpid == -1);
1623 	ATF_REQUIRE(errno == ECHILD);
1624 }
1625 
1626 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1627 ATF_TC_BODY(ptrace__event_mask, tc)
1628 {
1629 	pid_t fpid, wpid;
1630 	int events, status;
1631 
1632 	ATF_REQUIRE((fpid = fork()) != -1);
1633 	if (fpid == 0) {
1634 		trace_me();
1635 		exit(0);
1636 	}
1637 
1638 	/* The first wait() should report the stop from SIGSTOP. */
1639 	wpid = waitpid(fpid, &status, 0);
1640 	ATF_REQUIRE(wpid == fpid);
1641 	ATF_REQUIRE(WIFSTOPPED(status));
1642 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1643 
1644 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1645 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1646 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1647 	    sizeof(events)) == 0);
1648 	ATF_REQUIRE(events & PTRACE_FORK);
1649 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1650 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1651 	    sizeof(events)) == 0);
1652 	ATF_REQUIRE(!(events & PTRACE_FORK));
1653 
1654 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1655 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1656 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1657 	    sizeof(events)) == 0);
1658 	ATF_REQUIRE(events & PTRACE_LWP);
1659 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1660 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1661 	    sizeof(events)) == 0);
1662 	ATF_REQUIRE(!(events & PTRACE_LWP));
1663 
1664 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1665 
1666 	/* Should get one event at exit. */
1667 	wpid = waitpid(fpid, &status, 0);
1668 	ATF_REQUIRE(WIFEXITED(status));
1669 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1670 
1671 	wpid = wait(&status);
1672 	ATF_REQUIRE(wpid == -1);
1673 	ATF_REQUIRE(errno == ECHILD);
1674 }
1675 
1676 /*
1677  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1678  */
1679 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1680 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1681 {
1682 	struct ptrace_lwpinfo pl;
1683 	pid_t fpid, wpid;
1684 	int events, status;
1685 
1686 	ATF_REQUIRE((fpid = fork()) != -1);
1687 	if (fpid == 0) {
1688 		trace_me();
1689 		follow_fork_parent(true);
1690 	}
1691 
1692 	/* The first wait() should report the stop from SIGSTOP. */
1693 	wpid = waitpid(fpid, &status, 0);
1694 	ATF_REQUIRE(wpid == fpid);
1695 	ATF_REQUIRE(WIFSTOPPED(status));
1696 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1697 
1698 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1699 	    sizeof(events)) == 0);
1700 	events |= PTRACE_VFORK;
1701 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1702 	    sizeof(events)) == 0);
1703 
1704 	/* Continue the child ignoring the SIGSTOP. */
1705 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1706 
1707 	/* The next event should report the end of the vfork. */
1708 	wpid = wait(&status);
1709 	ATF_REQUIRE(wpid == fpid);
1710 	ATF_REQUIRE(WIFSTOPPED(status));
1711 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1712 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1713 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1714 
1715 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1716 
1717 	wpid = wait(&status);
1718 	ATF_REQUIRE(wpid == fpid);
1719 	ATF_REQUIRE(WIFEXITED(status));
1720 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1721 
1722 	wpid = wait(&status);
1723 	ATF_REQUIRE(wpid == -1);
1724 	ATF_REQUIRE(errno == ECHILD);
1725 }
1726 
1727 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1728 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1729 {
1730 	struct ptrace_lwpinfo pl[2];
1731 	pid_t children[2], fpid, wpid;
1732 	int events, status;
1733 
1734 	ATF_REQUIRE((fpid = fork()) != -1);
1735 	if (fpid == 0) {
1736 		trace_me();
1737 		follow_fork_parent(true);
1738 	}
1739 
1740 	/* Parent process. */
1741 	children[0] = fpid;
1742 
1743 	/* The first wait() should report the stop from SIGSTOP. */
1744 	wpid = waitpid(children[0], &status, 0);
1745 	ATF_REQUIRE(wpid == children[0]);
1746 	ATF_REQUIRE(WIFSTOPPED(status));
1747 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1748 
1749 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1750 	    sizeof(events)) == 0);
1751 	events |= PTRACE_FORK | PTRACE_VFORK;
1752 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1753 	    sizeof(events)) == 0);
1754 
1755 	/* Continue the child ignoring the SIGSTOP. */
1756 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1757 
1758 	/* Wait for both halves of the fork event to get reported. */
1759 	children[1] = handle_fork_events(children[0], pl);
1760 	ATF_REQUIRE(children[1] > 0);
1761 
1762 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1763 
1764 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1765 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1766 
1767 	/*
1768 	 * The child can't exit until the grandchild reports status, so the
1769 	 * grandchild should report its exit first to the debugger.
1770 	 */
1771 	wpid = waitpid(children[1], &status, 0);
1772 	ATF_REQUIRE(wpid == children[1]);
1773 	ATF_REQUIRE(WIFEXITED(status));
1774 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1775 
1776 	/*
1777 	 * The child should report it's vfork() completion before it
1778 	 * exits.
1779 	 */
1780 	wpid = wait(&status);
1781 	ATF_REQUIRE(wpid == children[0]);
1782 	ATF_REQUIRE(WIFSTOPPED(status));
1783 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1784 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1785 	    -1);
1786 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1787 
1788 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1789 
1790 	wpid = wait(&status);
1791 	ATF_REQUIRE(wpid == children[0]);
1792 	ATF_REQUIRE(WIFEXITED(status));
1793 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1794 
1795 	wpid = wait(&status);
1796 	ATF_REQUIRE(wpid == -1);
1797 	ATF_REQUIRE(errno == ECHILD);
1798 }
1799 
1800 #ifdef HAVE_BREAKPOINT
1801 /*
1802  * Verify that no more events are reported after PT_KILL except for the
1803  * process exit when stopped due to a breakpoint trap.
1804  */
1805 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1806 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1807 {
1808 	pid_t fpid, wpid;
1809 	int status;
1810 
1811 	ATF_REQUIRE((fpid = fork()) != -1);
1812 	if (fpid == 0) {
1813 		trace_me();
1814 		breakpoint();
1815 		exit(1);
1816 	}
1817 
1818 	/* The first wait() should report the stop from SIGSTOP. */
1819 	wpid = waitpid(fpid, &status, 0);
1820 	ATF_REQUIRE(wpid == fpid);
1821 	ATF_REQUIRE(WIFSTOPPED(status));
1822 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1823 
1824 	/* Continue the child ignoring the SIGSTOP. */
1825 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1826 
1827 	/* The second wait() should report hitting the breakpoint. */
1828 	wpid = waitpid(fpid, &status, 0);
1829 	ATF_REQUIRE(wpid == fpid);
1830 	ATF_REQUIRE(WIFSTOPPED(status));
1831 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1832 
1833 	/* Kill the child process. */
1834 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1835 
1836 	/* The last wait() should report the SIGKILL. */
1837 	wpid = waitpid(fpid, &status, 0);
1838 	ATF_REQUIRE(wpid == fpid);
1839 	ATF_REQUIRE(WIFSIGNALED(status));
1840 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1841 
1842 	wpid = wait(&status);
1843 	ATF_REQUIRE(wpid == -1);
1844 	ATF_REQUIRE(errno == ECHILD);
1845 }
1846 #endif /* HAVE_BREAKPOINT */
1847 
1848 /*
1849  * Verify that no more events are reported after PT_KILL except for the
1850  * process exit when stopped inside of a system call.
1851  */
1852 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1853 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1854 {
1855 	struct ptrace_lwpinfo pl;
1856 	pid_t fpid, wpid;
1857 	int status;
1858 
1859 	ATF_REQUIRE((fpid = fork()) != -1);
1860 	if (fpid == 0) {
1861 		trace_me();
1862 		getpid();
1863 		exit(1);
1864 	}
1865 
1866 	/* The first wait() should report the stop from SIGSTOP. */
1867 	wpid = waitpid(fpid, &status, 0);
1868 	ATF_REQUIRE(wpid == fpid);
1869 	ATF_REQUIRE(WIFSTOPPED(status));
1870 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1871 
1872 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1873 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1874 
1875 	/* The second wait() should report a system call entry for getpid(). */
1876 	wpid = waitpid(fpid, &status, 0);
1877 	ATF_REQUIRE(wpid == fpid);
1878 	ATF_REQUIRE(WIFSTOPPED(status));
1879 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1880 
1881 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1882 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1883 
1884 	/* Kill the child process. */
1885 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1886 
1887 	/* The last wait() should report the SIGKILL. */
1888 	wpid = waitpid(fpid, &status, 0);
1889 	ATF_REQUIRE(wpid == fpid);
1890 	ATF_REQUIRE(WIFSIGNALED(status));
1891 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1892 
1893 	wpid = wait(&status);
1894 	ATF_REQUIRE(wpid == -1);
1895 	ATF_REQUIRE(errno == ECHILD);
1896 }
1897 
1898 /*
1899  * Verify that no more events are reported after PT_KILL except for the
1900  * process exit when killing a multithreaded process.
1901  */
1902 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1903 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1904 {
1905 	struct ptrace_lwpinfo pl;
1906 	pid_t fpid, wpid;
1907 	lwpid_t main_lwp;
1908 	int status;
1909 
1910 	ATF_REQUIRE((fpid = fork()) != -1);
1911 	if (fpid == 0) {
1912 		trace_me();
1913 		simple_thread_main();
1914 	}
1915 
1916 	/* The first wait() should report the stop from SIGSTOP. */
1917 	wpid = waitpid(fpid, &status, 0);
1918 	ATF_REQUIRE(wpid == fpid);
1919 	ATF_REQUIRE(WIFSTOPPED(status));
1920 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1921 
1922 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1923 	    sizeof(pl)) != -1);
1924 	main_lwp = pl.pl_lwpid;
1925 
1926 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1927 
1928 	/* Continue the child ignoring the SIGSTOP. */
1929 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1930 
1931 	/* The first event should be for the child thread's birth. */
1932 	wpid = waitpid(fpid, &status, 0);
1933 	ATF_REQUIRE(wpid == fpid);
1934 	ATF_REQUIRE(WIFSTOPPED(status));
1935 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1936 
1937 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1938 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1939 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1940 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1941 
1942 	/* Kill the child process. */
1943 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1944 
1945 	/* The last wait() should report the SIGKILL. */
1946 	wpid = waitpid(fpid, &status, 0);
1947 	ATF_REQUIRE(wpid == fpid);
1948 	ATF_REQUIRE(WIFSIGNALED(status));
1949 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1950 
1951 	wpid = wait(&status);
1952 	ATF_REQUIRE(wpid == -1);
1953 	ATF_REQUIRE(errno == ECHILD);
1954 }
1955 
1956 static void *
1957 mask_usr1_thread(void *arg)
1958 {
1959 	pthread_barrier_t *pbarrier;
1960 	sigset_t sigmask;
1961 
1962 	pbarrier = (pthread_barrier_t*)arg;
1963 
1964 	sigemptyset(&sigmask);
1965 	sigaddset(&sigmask, SIGUSR1);
1966 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1967 
1968 	/* Sync up with other thread after sigmask updated. */
1969 	pthread_barrier_wait(pbarrier);
1970 
1971 	for (;;)
1972 		sleep(60);
1973 
1974 	return (NULL);
1975 }
1976 
1977 /*
1978  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1979  * and prevents spurious stops due to those other signals.
1980  */
1981 ATF_TC(ptrace__PT_KILL_competing_signal);
1982 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1983 {
1984 
1985 	atf_tc_set_md_var(tc, "require.user", "root");
1986 }
1987 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1988 {
1989 	pid_t fpid, wpid;
1990 	int status;
1991 	cpuset_t setmask;
1992 	pthread_t t;
1993 	pthread_barrier_t barrier;
1994 	struct sched_param sched_param;
1995 
1996 	ATF_REQUIRE((fpid = fork()) != -1);
1997 	if (fpid == 0) {
1998 		/* Bind to one CPU so only one thread at a time will run. */
1999 		CPU_ZERO(&setmask);
2000 		CPU_SET(0, &setmask);
2001 		cpusetid_t setid;
2002 		CHILD_REQUIRE(cpuset(&setid) == 0);
2003 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2004 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2005 
2006 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2007 
2008 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2009 		    (void*)&barrier) == 0);
2010 
2011 		/*
2012 		 * Give the main thread higher priority. The test always
2013 		 * assumes that, if both threads are able to run, the main
2014 		 * thread runs first.
2015 		 */
2016 		sched_param.sched_priority =
2017 		    (sched_get_priority_max(SCHED_FIFO) +
2018 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2019 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2020 		    SCHED_FIFO, &sched_param) == 0);
2021 		sched_param.sched_priority -= RQ_PPQ;
2022 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2023 		    &sched_param) == 0);
2024 
2025 		sigset_t sigmask;
2026 		sigemptyset(&sigmask);
2027 		sigaddset(&sigmask, SIGUSR2);
2028 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2029 
2030 		/* Sync up with other thread after sigmask updated. */
2031 		pthread_barrier_wait(&barrier);
2032 
2033 		trace_me();
2034 
2035 		for (;;)
2036 			sleep(60);
2037 
2038 		exit(1);
2039 	}
2040 
2041 	/* The first wait() should report the stop from SIGSTOP. */
2042 	wpid = waitpid(fpid, &status, 0);
2043 	ATF_REQUIRE(wpid == fpid);
2044 	ATF_REQUIRE(WIFSTOPPED(status));
2045 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2046 
2047 	/* Continue the child ignoring the SIGSTOP. */
2048 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2049 
2050 	/* Send a signal that only the second thread can handle. */
2051 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2052 
2053 	/* The second wait() should report the SIGUSR2. */
2054 	wpid = waitpid(fpid, &status, 0);
2055 	ATF_REQUIRE(wpid == fpid);
2056 	ATF_REQUIRE(WIFSTOPPED(status));
2057 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2058 
2059 	/* Send a signal that only the first thread can handle. */
2060 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2061 
2062 	/* Replace the SIGUSR2 with a kill. */
2063 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2064 
2065 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
2066 	wpid = waitpid(fpid, &status, 0);
2067 	ATF_REQUIRE(wpid == fpid);
2068 	ATF_REQUIRE(WIFSIGNALED(status));
2069 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2070 
2071 	wpid = wait(&status);
2072 	ATF_REQUIRE(wpid == -1);
2073 	ATF_REQUIRE(errno == ECHILD);
2074 }
2075 
2076 /*
2077  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
2078  * and prevents spurious stops caused by those events.
2079  */
2080 ATF_TC(ptrace__PT_KILL_competing_stop);
2081 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
2082 {
2083 
2084 	atf_tc_set_md_var(tc, "require.user", "root");
2085 }
2086 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
2087 {
2088 	pid_t fpid, wpid;
2089 	int status;
2090 	cpuset_t setmask;
2091 	pthread_t t;
2092 	pthread_barrier_t barrier;
2093 	lwpid_t main_lwp;
2094 	struct ptrace_lwpinfo pl;
2095 	struct sched_param sched_param;
2096 
2097 	if (atf_tc_get_config_var_as_bool_wd(tc, "ci", false))
2098 		atf_tc_skip("https://bugs.freebsd.org/220841");
2099 
2100 	ATF_REQUIRE((fpid = fork()) != -1);
2101 	if (fpid == 0) {
2102 		trace_me();
2103 
2104 		/* Bind to one CPU so only one thread at a time will run. */
2105 		CPU_ZERO(&setmask);
2106 		CPU_SET(0, &setmask);
2107 		cpusetid_t setid;
2108 		CHILD_REQUIRE(cpuset(&setid) == 0);
2109 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2110 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2111 
2112 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2113 
2114 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2115 		    (void*)&barrier) == 0);
2116 
2117 		/*
2118 		 * Give the main thread higher priority. The test always
2119 		 * assumes that, if both threads are able to run, the main
2120 		 * thread runs first.
2121 		 */
2122 		sched_param.sched_priority =
2123 		    (sched_get_priority_max(SCHED_FIFO) +
2124 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2125 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2126 		    SCHED_FIFO, &sched_param) == 0);
2127 		sched_param.sched_priority -= RQ_PPQ;
2128 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2129 		    &sched_param) == 0);
2130 
2131 		sigset_t sigmask;
2132 		sigemptyset(&sigmask);
2133 		sigaddset(&sigmask, SIGUSR2);
2134 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2135 
2136 		/* Sync up with other thread after sigmask updated. */
2137 		pthread_barrier_wait(&barrier);
2138 
2139 		/* Sync up with the test before doing the getpid(). */
2140 		raise(SIGSTOP);
2141 
2142 		getpid();
2143 		exit(1);
2144 	}
2145 
2146 	/* The first wait() should report the stop from SIGSTOP. */
2147 	wpid = waitpid(fpid, &status, 0);
2148 	ATF_REQUIRE(wpid == fpid);
2149 	ATF_REQUIRE(WIFSTOPPED(status));
2150 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2151 
2152 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2153 	main_lwp = pl.pl_lwpid;
2154 
2155 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2156 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2157 
2158 	/*
2159 	 * Continue until child is done with setup, which is indicated with
2160 	 * SIGSTOP. Ignore system calls in the meantime.
2161 	 */
2162 	for (;;) {
2163 		wpid = waitpid(fpid, &status, 0);
2164 		ATF_REQUIRE(wpid == fpid);
2165 		ATF_REQUIRE(WIFSTOPPED(status));
2166 		if (WSTOPSIG(status) == SIGTRAP) {
2167 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2168 			    sizeof(pl)) != -1);
2169 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2170 		} else {
2171 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2172 			break;
2173 		}
2174 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2175 	}
2176 
2177 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2178 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2179 
2180 	wpid = waitpid(fpid, &status, 0);
2181 	ATF_REQUIRE(wpid == fpid);
2182 	ATF_REQUIRE(WIFSTOPPED(status));
2183 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2184 
2185 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2186 	    sizeof(pl)) != -1);
2187 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2188 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2189 	/* Prevent the main thread from hitting its syscall exit for now. */
2190 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2191 
2192 	/*
2193 	 * Proceed, allowing second thread to hit syscall exit for
2194 	 * pthread_barrier_wait().
2195 	 */
2196 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2197 
2198 	wpid = waitpid(fpid, &status, 0);
2199 	ATF_REQUIRE(wpid == fpid);
2200 	ATF_REQUIRE(WIFSTOPPED(status));
2201 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2202 
2203 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2204 	    sizeof(pl)) != -1);
2205 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2206 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2207 
2208 	/* Send a signal that only the second thread can handle. */
2209 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2210 
2211 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2212 
2213 	/* The next wait() should report the SIGUSR2. */
2214 	wpid = waitpid(fpid, &status, 0);
2215 	ATF_REQUIRE(wpid == fpid);
2216 	ATF_REQUIRE(WIFSTOPPED(status));
2217 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2218 
2219 	/* Allow the main thread to try to finish its system call. */
2220 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2221 
2222 	/*
2223 	 * At this point, the main thread is in the middle of a system call and
2224 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2225 	 * be replaced with a SIGKILL below. The main thread will get to run
2226 	 * first. It should notice the kill request (even though the signal
2227 	 * replacement occurred in the other thread) and exit accordingly.  It
2228 	 * should not stop for the system call exit event.
2229 	 */
2230 
2231 	/* Replace the SIGUSR2 with a kill. */
2232 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2233 
2234 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2235 	wpid = waitpid(fpid, &status, 0);
2236 	ATF_REQUIRE(wpid == fpid);
2237 	ATF_REQUIRE(WIFSIGNALED(status));
2238 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2239 
2240 	wpid = wait(&status);
2241 	ATF_REQUIRE(wpid == -1);
2242 	ATF_REQUIRE(errno == ECHILD);
2243 }
2244 
2245 static void
2246 sigusr1_handler(int sig)
2247 {
2248 
2249 	CHILD_REQUIRE(sig == SIGUSR1);
2250 	_exit(2);
2251 }
2252 
2253 /*
2254  * Verify that even if the signal queue is full for a child process,
2255  * a PT_KILL will kill the process.
2256  */
2257 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2258 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2259 {
2260 	pid_t fpid, wpid;
2261 	int status;
2262 	int max_pending_per_proc;
2263 	size_t len;
2264 	int i;
2265 
2266 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2267 
2268 	ATF_REQUIRE((fpid = fork()) != -1);
2269 	if (fpid == 0) {
2270 		trace_me();
2271 		exit(1);
2272 	}
2273 
2274 	/* The first wait() should report the stop from SIGSTOP. */
2275 	wpid = waitpid(fpid, &status, 0);
2276 	ATF_REQUIRE(wpid == fpid);
2277 	ATF_REQUIRE(WIFSTOPPED(status));
2278 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2279 
2280 	len = sizeof(max_pending_per_proc);
2281 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2282 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2283 
2284 	/* Fill the signal queue. */
2285 	for (i = 0; i < max_pending_per_proc; ++i)
2286 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2287 
2288 	/* Kill the child process. */
2289 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2290 
2291 	/* The last wait() should report the SIGKILL. */
2292 	wpid = waitpid(fpid, &status, 0);
2293 	ATF_REQUIRE(wpid == fpid);
2294 	ATF_REQUIRE(WIFSIGNALED(status));
2295 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2296 
2297 	wpid = wait(&status);
2298 	ATF_REQUIRE(wpid == -1);
2299 	ATF_REQUIRE(errno == ECHILD);
2300 }
2301 
2302 /*
2303  * Verify that when stopped at a system call entry, a signal can be
2304  * requested with PT_CONTINUE which will be delivered once the system
2305  * call is complete.
2306  */
2307 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2308 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2309 {
2310 	struct ptrace_lwpinfo pl;
2311 	pid_t fpid, wpid;
2312 	int status;
2313 
2314 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2315 
2316 	ATF_REQUIRE((fpid = fork()) != -1);
2317 	if (fpid == 0) {
2318 		trace_me();
2319 		getpid();
2320 		exit(1);
2321 	}
2322 
2323 	/* The first wait() should report the stop from SIGSTOP. */
2324 	wpid = waitpid(fpid, &status, 0);
2325 	ATF_REQUIRE(wpid == fpid);
2326 	ATF_REQUIRE(WIFSTOPPED(status));
2327 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2328 
2329 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2330 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2331 
2332 	/* The second wait() should report a system call entry for getpid(). */
2333 	wpid = waitpid(fpid, &status, 0);
2334 	ATF_REQUIRE(wpid == fpid);
2335 	ATF_REQUIRE(WIFSTOPPED(status));
2336 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2337 
2338 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2339 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2340 
2341 	/* Continue the child process with a signal. */
2342 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2343 
2344 	for (;;) {
2345 		/*
2346 		 * The last wait() should report exit 2, i.e., a normal _exit
2347 		 * from the signal handler. In the meantime, catch and proceed
2348 		 * past any syscall stops.
2349 		 */
2350 		wpid = waitpid(fpid, &status, 0);
2351 		ATF_REQUIRE(wpid == fpid);
2352 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2353 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2354 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2355 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2356 		} else {
2357 			ATF_REQUIRE(WIFEXITED(status));
2358 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2359 			break;
2360 		}
2361 	}
2362 
2363 	wpid = wait(&status);
2364 	ATF_REQUIRE(wpid == -1);
2365 	ATF_REQUIRE(errno == ECHILD);
2366 }
2367 
2368 static void
2369 sigusr1_counting_handler(int sig)
2370 {
2371 	static int counter = 0;
2372 
2373 	CHILD_REQUIRE(sig == SIGUSR1);
2374 	counter++;
2375 	if (counter == 2)
2376 		_exit(2);
2377 }
2378 
2379 /*
2380  * Verify that, when continuing from a stop at system call entry and exit,
2381  * a signal can be requested from both stops, and both will be delivered when
2382  * the system call is complete.
2383  */
2384 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2385 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2386 {
2387 	struct ptrace_lwpinfo pl;
2388 	pid_t fpid, wpid;
2389 	int status;
2390 
2391 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2392 
2393 	ATF_REQUIRE((fpid = fork()) != -1);
2394 	if (fpid == 0) {
2395 		trace_me();
2396 		getpid();
2397 		exit(1);
2398 	}
2399 
2400 	/* The first wait() should report the stop from SIGSTOP. */
2401 	wpid = waitpid(fpid, &status, 0);
2402 	ATF_REQUIRE(wpid == fpid);
2403 	ATF_REQUIRE(WIFSTOPPED(status));
2404 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2405 
2406 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2407 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2408 
2409 	/* The second wait() should report a system call entry for getpid(). */
2410 	wpid = waitpid(fpid, &status, 0);
2411 	ATF_REQUIRE(wpid == fpid);
2412 	ATF_REQUIRE(WIFSTOPPED(status));
2413 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2414 
2415 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2416 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2417 
2418 	/* Continue the child process with a signal. */
2419 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2420 
2421 	/* The third wait() should report a system call exit for getpid(). */
2422 	wpid = waitpid(fpid, &status, 0);
2423 	ATF_REQUIRE(wpid == fpid);
2424 	ATF_REQUIRE(WIFSTOPPED(status));
2425 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2426 
2427 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2428 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2429 
2430 	/* Continue the child process with a signal. */
2431 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2432 
2433 	for (;;) {
2434 		/*
2435 		 * The last wait() should report exit 2, i.e., a normal _exit
2436 		 * from the signal handler. In the meantime, catch and proceed
2437 		 * past any syscall stops.
2438 		 */
2439 		wpid = waitpid(fpid, &status, 0);
2440 		ATF_REQUIRE(wpid == fpid);
2441 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2442 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2443 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2444 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2445 		} else {
2446 			ATF_REQUIRE(WIFEXITED(status));
2447 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2448 			break;
2449 		}
2450 	}
2451 
2452 	wpid = wait(&status);
2453 	ATF_REQUIRE(wpid == -1);
2454 	ATF_REQUIRE(errno == ECHILD);
2455 }
2456 
2457 /*
2458  * Verify that even if the signal queue is full for a child process,
2459  * a PT_CONTINUE with a signal will not result in loss of that signal.
2460  */
2461 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2462 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2463 {
2464 	pid_t fpid, wpid;
2465 	int status;
2466 	int max_pending_per_proc;
2467 	size_t len;
2468 	int i;
2469 
2470 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2471 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2472 
2473 	ATF_REQUIRE((fpid = fork()) != -1);
2474 	if (fpid == 0) {
2475 		trace_me();
2476 		exit(1);
2477 	}
2478 
2479 	/* The first wait() should report the stop from SIGSTOP. */
2480 	wpid = waitpid(fpid, &status, 0);
2481 	ATF_REQUIRE(wpid == fpid);
2482 	ATF_REQUIRE(WIFSTOPPED(status));
2483 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2484 
2485 	len = sizeof(max_pending_per_proc);
2486 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2487 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2488 
2489 	/* Fill the signal queue. */
2490 	for (i = 0; i < max_pending_per_proc; ++i)
2491 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2492 
2493 	/* Continue with signal. */
2494 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2495 
2496 	for (;;) {
2497 		wpid = waitpid(fpid, &status, 0);
2498 		ATF_REQUIRE(wpid == fpid);
2499 		if (WIFSTOPPED(status)) {
2500 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2501 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2502 		} else {
2503 			/*
2504 			 * The last wait() should report normal _exit from the
2505 			 * SIGUSR1 handler.
2506 			 */
2507 			ATF_REQUIRE(WIFEXITED(status));
2508 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2509 			break;
2510 		}
2511 	}
2512 
2513 	wpid = wait(&status);
2514 	ATF_REQUIRE(wpid == -1);
2515 	ATF_REQUIRE(errno == ECHILD);
2516 }
2517 
2518 static sem_t sigusr1_sem;
2519 static int got_usr1;
2520 
2521 static void
2522 sigusr1_sempost_handler(int sig __unused)
2523 {
2524 
2525 	got_usr1++;
2526 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2527 }
2528 
2529 /*
2530  * Verify that even if the signal queue is full for a child process,
2531  * and the signal is masked, a PT_CONTINUE with a signal will not
2532  * result in loss of that signal.
2533  */
2534 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
2535 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue, tc)
2536 {
2537 	struct ptrace_lwpinfo pl;
2538 	pid_t fpid, wpid;
2539 	int status, err;
2540 	int max_pending_per_proc;
2541 	size_t len;
2542 	int i;
2543 	sigset_t sigmask;
2544 
2545 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2546 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2547 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2548 
2549 	got_usr1 = 0;
2550 	ATF_REQUIRE((fpid = fork()) != -1);
2551 	if (fpid == 0) {
2552 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2553 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2554 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2555 
2556 		trace_me();
2557 		CHILD_REQUIRE(got_usr1 == 0);
2558 
2559 		/* Allow the pending SIGUSR1 in now. */
2560 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2561 		/* Wait to receive the SIGUSR1. */
2562 		do {
2563 			err = sem_wait(&sigusr1_sem);
2564 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2565 		} while (err != 0 && errno == EINTR);
2566 		CHILD_REQUIRE(got_usr1 == 1);
2567 		exit(1);
2568 	}
2569 
2570 	/* The first wait() should report the stop from SIGSTOP. */
2571 	wpid = waitpid(fpid, &status, 0);
2572 	ATF_REQUIRE(wpid == fpid);
2573 	ATF_REQUIRE(WIFSTOPPED(status));
2574 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2575 
2576 	len = sizeof(max_pending_per_proc);
2577 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2578 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2579 
2580 	/* Fill the signal queue. */
2581 	for (i = 0; i < max_pending_per_proc; ++i)
2582 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2583 
2584 	/* Continue with signal. */
2585 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2586 
2587 	/* Collect and ignore all of the SIGUSR2. */
2588 	for (i = 0; i < max_pending_per_proc; ++i) {
2589 		wpid = waitpid(fpid, &status, 0);
2590 		ATF_REQUIRE(wpid == fpid);
2591 		ATF_REQUIRE(WIFSTOPPED(status));
2592 		ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2593 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2594 	}
2595 
2596 	/* Now our PT_CONTINUE'd SIGUSR1 should cause a stop after unmask. */
2597 	wpid = waitpid(fpid, &status, 0);
2598 	ATF_REQUIRE(wpid == fpid);
2599 	ATF_REQUIRE(WIFSTOPPED(status));
2600 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2601 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2602 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2603 
2604 	/* Continue the child, ignoring the SIGUSR1. */
2605 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2606 
2607 	/* The last wait() should report exit after receiving SIGUSR1. */
2608 	wpid = waitpid(fpid, &status, 0);
2609 	ATF_REQUIRE(wpid == fpid);
2610 	ATF_REQUIRE(WIFEXITED(status));
2611 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2612 
2613 	wpid = wait(&status);
2614 	ATF_REQUIRE(wpid == -1);
2615 	ATF_REQUIRE(errno == ECHILD);
2616 }
2617 
2618 /*
2619  * Verify that, after stopping due to a signal, that signal can be
2620  * replaced with another signal.
2621  */
2622 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2623 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2624 {
2625 	struct ptrace_lwpinfo pl;
2626 	pid_t fpid, wpid;
2627 	int status;
2628 
2629 	ATF_REQUIRE((fpid = fork()) != -1);
2630 	if (fpid == 0) {
2631 		trace_me();
2632 		sleep(20);
2633 		exit(1);
2634 	}
2635 
2636 	/* The first wait() should report the stop from SIGSTOP. */
2637 	wpid = waitpid(fpid, &status, 0);
2638 	ATF_REQUIRE(wpid == fpid);
2639 	ATF_REQUIRE(WIFSTOPPED(status));
2640 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2641 
2642 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2643 
2644 	/* Send a signal without ptrace. */
2645 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2646 
2647 	/* The second wait() should report a SIGINT was received. */
2648 	wpid = waitpid(fpid, &status, 0);
2649 	ATF_REQUIRE(wpid == fpid);
2650 	ATF_REQUIRE(WIFSTOPPED(status));
2651 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2652 
2653 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2654 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2655 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2656 
2657 	/* Continue the child process with a different signal. */
2658 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2659 
2660 	/*
2661 	 * The last wait() should report having died due to the new
2662 	 * signal, SIGTERM.
2663 	 */
2664 	wpid = waitpid(fpid, &status, 0);
2665 	ATF_REQUIRE(wpid == fpid);
2666 	ATF_REQUIRE(WIFSIGNALED(status));
2667 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2668 
2669 	wpid = wait(&status);
2670 	ATF_REQUIRE(wpid == -1);
2671 	ATF_REQUIRE(errno == ECHILD);
2672 }
2673 
2674 /*
2675  * Verify that a signal can be passed through to the child even when there
2676  * was no true signal originally. Such cases arise when a SIGTRAP is
2677  * invented for e.g, system call stops.
2678  */
2679 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2680 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2681 {
2682 	struct ptrace_lwpinfo pl;
2683 	struct rlimit rl;
2684 	pid_t fpid, wpid;
2685 	int status;
2686 
2687 	ATF_REQUIRE((fpid = fork()) != -1);
2688 	if (fpid == 0) {
2689 		trace_me();
2690 		/* SIGTRAP expected to cause exit on syscall entry. */
2691 		rl.rlim_cur = rl.rlim_max = 0;
2692 		ATF_REQUIRE(setrlimit(RLIMIT_CORE, &rl) == 0);
2693 		getpid();
2694 		exit(1);
2695 	}
2696 
2697 	/* The first wait() should report the stop from SIGSTOP. */
2698 	wpid = waitpid(fpid, &status, 0);
2699 	ATF_REQUIRE(wpid == fpid);
2700 	ATF_REQUIRE(WIFSTOPPED(status));
2701 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2702 
2703 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2704 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2705 
2706 	/* The second wait() should report a system call entry for getpid(). */
2707 	wpid = waitpid(fpid, &status, 0);
2708 	ATF_REQUIRE(wpid == fpid);
2709 	ATF_REQUIRE(WIFSTOPPED(status));
2710 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2711 
2712 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2713 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2714 
2715 	/* Continue the child process with a SIGTRAP. */
2716 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2717 
2718 	for (;;) {
2719 		/*
2720 		 * The last wait() should report exit due to SIGTRAP.  In the
2721 		 * meantime, catch and proceed past any syscall stops.
2722 		 */
2723 		wpid = waitpid(fpid, &status, 0);
2724 		ATF_REQUIRE(wpid == fpid);
2725 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2726 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2727 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2728 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2729 		} else {
2730 			ATF_REQUIRE(WIFSIGNALED(status));
2731 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2732 			break;
2733 		}
2734 	}
2735 
2736 	wpid = wait(&status);
2737 	ATF_REQUIRE(wpid == -1);
2738 	ATF_REQUIRE(errno == ECHILD);
2739 
2740 }
2741 
2742 /*
2743  * A mixed bag PT_CONTINUE with signal test.
2744  */
2745 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2746 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2747 {
2748 	struct ptrace_lwpinfo pl;
2749 	pid_t fpid, wpid;
2750 	int status;
2751 
2752 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2753 
2754 	ATF_REQUIRE((fpid = fork()) != -1);
2755 	if (fpid == 0) {
2756 		trace_me();
2757 		getpid();
2758 		exit(1);
2759 	}
2760 
2761 	/* The first wait() should report the stop from SIGSTOP. */
2762 	wpid = waitpid(fpid, &status, 0);
2763 	ATF_REQUIRE(wpid == fpid);
2764 	ATF_REQUIRE(WIFSTOPPED(status));
2765 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2766 
2767 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2768 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2769 
2770 	/* The second wait() should report a system call entry for getpid(). */
2771 	wpid = waitpid(fpid, &status, 0);
2772 	ATF_REQUIRE(wpid == fpid);
2773 	ATF_REQUIRE(WIFSTOPPED(status));
2774 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2775 
2776 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2777 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2778 
2779 	/* Continue with the first SIGUSR1. */
2780 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2781 
2782 	/* The next wait() should report a system call exit for getpid(). */
2783 	wpid = waitpid(fpid, &status, 0);
2784 	ATF_REQUIRE(wpid == fpid);
2785 	ATF_REQUIRE(WIFSTOPPED(status));
2786 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2787 
2788 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2789 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2790 
2791 	/* Send an ABRT without ptrace. */
2792 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2793 
2794 	/* Continue normally. */
2795 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2796 
2797 	/* The next wait() should report the SIGABRT. */
2798 	wpid = waitpid(fpid, &status, 0);
2799 	ATF_REQUIRE(wpid == fpid);
2800 	ATF_REQUIRE(WIFSTOPPED(status));
2801 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2802 
2803 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2804 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2805 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2806 
2807 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2808 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2809 
2810 	for (;;) {
2811 		/*
2812 		 * The last wait() should report exit 2, i.e., a normal _exit
2813 		 * from the signal handler. In the meantime, catch and proceed
2814 		 * past any syscall stops.
2815 		 */
2816 		wpid = waitpid(fpid, &status, 0);
2817 		ATF_REQUIRE(wpid == fpid);
2818 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2819 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2820 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2821 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2822 		} else {
2823 			ATF_REQUIRE(WIFEXITED(status));
2824 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2825 			break;
2826 		}
2827 	}
2828 
2829 	wpid = wait(&status);
2830 	ATF_REQUIRE(wpid == -1);
2831 	ATF_REQUIRE(errno == ECHILD);
2832 
2833 }
2834 
2835 /*
2836  * Verify a signal delivered by ptrace is noticed by kevent(2).
2837  */
2838 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2839 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2840 {
2841 	pid_t fpid, wpid;
2842 	int status, kq, nevents;
2843 	struct kevent kev;
2844 
2845 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2846 
2847 	ATF_REQUIRE((fpid = fork()) != -1);
2848 	if (fpid == 0) {
2849 		CHILD_REQUIRE((kq = kqueue()) > 0);
2850 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2851 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2852 
2853 		trace_me();
2854 
2855 		for (;;) {
2856 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2857 			if (nevents == -1 && errno == EINTR)
2858 				continue;
2859 			CHILD_REQUIRE(nevents > 0);
2860 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2861 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2862 			break;
2863 		}
2864 
2865 		exit(1);
2866 	}
2867 
2868 	/* The first wait() should report the stop from SIGSTOP. */
2869 	wpid = waitpid(fpid, &status, 0);
2870 	ATF_REQUIRE(wpid == fpid);
2871 	ATF_REQUIRE(WIFSTOPPED(status));
2872 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2873 
2874 	/* Continue with the SIGUSR1. */
2875 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2876 
2877 	/*
2878 	 * The last wait() should report normal exit with code 1.
2879 	 */
2880 	wpid = waitpid(fpid, &status, 0);
2881 	ATF_REQUIRE(wpid == fpid);
2882 	ATF_REQUIRE(WIFEXITED(status));
2883 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2884 
2885 	wpid = wait(&status);
2886 	ATF_REQUIRE(wpid == -1);
2887 	ATF_REQUIRE(errno == ECHILD);
2888 }
2889 
2890 static void *
2891 signal_thread(void *arg)
2892 {
2893 	int err;
2894 	sigset_t sigmask;
2895 
2896 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2897 
2898 	/* Wait for this thread to receive a SIGUSR1. */
2899 	do {
2900 		err = sem_wait(&sigusr1_sem);
2901 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2902 	} while (err != 0 && errno == EINTR);
2903 
2904 	/* Free our companion thread from the barrier. */
2905 	pthread_barrier_wait(pbarrier);
2906 
2907 	/*
2908 	 * Swap ignore duties; the next SIGUSR1 should go to the
2909 	 * other thread.
2910 	 */
2911 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2912 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2913 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2914 
2915 	/* Sync up threads after swapping signal masks. */
2916 	pthread_barrier_wait(pbarrier);
2917 
2918 	/* Wait until our companion has received its SIGUSR1. */
2919 	pthread_barrier_wait(pbarrier);
2920 
2921 	return (NULL);
2922 }
2923 
2924 /*
2925  * Verify that a traced process with blocked signal received the
2926  * signal from kill() once unmasked.
2927  */
2928 ATF_TC_WITHOUT_HEAD(ptrace__killed_with_sigmask);
2929 ATF_TC_BODY(ptrace__killed_with_sigmask, tc)
2930 {
2931 	struct ptrace_lwpinfo pl;
2932 	pid_t fpid, wpid;
2933 	int status, err;
2934 	sigset_t sigmask;
2935 
2936 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2937 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2938 	got_usr1 = 0;
2939 
2940 	ATF_REQUIRE((fpid = fork()) != -1);
2941 	if (fpid == 0) {
2942 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2943 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2944 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2945 
2946 		trace_me();
2947 		CHILD_REQUIRE(got_usr1 == 0);
2948 
2949 		/* Allow the pending SIGUSR1 in now. */
2950 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2951 		/* Wait to receive a SIGUSR1. */
2952 		do {
2953 			err = sem_wait(&sigusr1_sem);
2954 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2955 		} while (err != 0 && errno == EINTR);
2956 		CHILD_REQUIRE(got_usr1 == 1);
2957 		exit(1);
2958 	}
2959 
2960 	/* The first wait() should report the stop from SIGSTOP. */
2961 	wpid = waitpid(fpid, &status, 0);
2962 	ATF_REQUIRE(wpid == fpid);
2963 	ATF_REQUIRE(WIFSTOPPED(status));
2964 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2965 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2966 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2967 
2968 	/* Send blocked SIGUSR1 which should cause a stop. */
2969 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2970 
2971 	/* Continue the child ignoring the SIGSTOP. */
2972 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2973 
2974 	/* The next wait() should report the kill(SIGUSR1) was received. */
2975 	wpid = waitpid(fpid, &status, 0);
2976 	ATF_REQUIRE(wpid == fpid);
2977 	ATF_REQUIRE(WIFSTOPPED(status));
2978 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2979 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2980 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2981 
2982 	/* Continue the child, allowing in the SIGUSR1. */
2983 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2984 
2985 	/* The last wait() should report normal exit with code 1. */
2986 	wpid = waitpid(fpid, &status, 0);
2987 	ATF_REQUIRE(wpid == fpid);
2988 	ATF_REQUIRE(WIFEXITED(status));
2989 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2990 
2991 	wpid = wait(&status);
2992 	ATF_REQUIRE(wpid == -1);
2993 	ATF_REQUIRE(errno == ECHILD);
2994 }
2995 
2996 /*
2997  * Verify that a traced process with blocked signal received the
2998  * signal from PT_CONTINUE once unmasked.
2999  */
3000 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigmask);
3001 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigmask, tc)
3002 {
3003 	struct ptrace_lwpinfo pl;
3004 	pid_t fpid, wpid;
3005 	int status, err;
3006 	sigset_t sigmask;
3007 
3008 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
3009 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
3010 	got_usr1 = 0;
3011 
3012 	ATF_REQUIRE((fpid = fork()) != -1);
3013 	if (fpid == 0) {
3014 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
3015 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
3016 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
3017 
3018 		trace_me();
3019 		CHILD_REQUIRE(got_usr1 == 0);
3020 
3021 		/* Allow the pending SIGUSR1 in now. */
3022 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3023 		/* Wait to receive a SIGUSR1. */
3024 		do {
3025 			err = sem_wait(&sigusr1_sem);
3026 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3027 		} while (err != 0 && errno == EINTR);
3028 
3029 		CHILD_REQUIRE(got_usr1 == 1);
3030 		exit(1);
3031 	}
3032 
3033 	/* The first wait() should report the stop from SIGSTOP. */
3034 	wpid = waitpid(fpid, &status, 0);
3035 	ATF_REQUIRE(wpid == fpid);
3036 	ATF_REQUIRE(WIFSTOPPED(status));
3037 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3038 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
3039 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
3040 
3041 	/* Continue the child replacing SIGSTOP with SIGUSR1. */
3042 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3043 
3044 	/* The next wait() should report the SIGUSR1 was received. */
3045 	wpid = waitpid(fpid, &status, 0);
3046 	ATF_REQUIRE(wpid == fpid);
3047 	ATF_REQUIRE(WIFSTOPPED(status));
3048 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
3049 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
3050 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
3051 
3052 	/* Continue the child, ignoring the SIGUSR1. */
3053 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3054 
3055 	/* The last wait() should report normal exit with code 1. */
3056 	wpid = waitpid(fpid, &status, 0);
3057 	ATF_REQUIRE(wpid == fpid);
3058 	ATF_REQUIRE(WIFEXITED(status));
3059 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3060 
3061 	wpid = wait(&status);
3062 	ATF_REQUIRE(wpid == -1);
3063 	ATF_REQUIRE(errno == ECHILD);
3064 }
3065 
3066 /*
3067  * Verify that if ptrace stops due to a signal but continues with
3068  * a different signal that the new signal is routed to a thread
3069  * that can accept it, and that the thread is awakened by the signal
3070  * in a timely manner.
3071  */
3072 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3073 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
3074 {
3075 	pid_t fpid, wpid;
3076 	int status, err;
3077 	pthread_t t;
3078 	sigset_t sigmask;
3079 	pthread_barrier_t barrier;
3080 
3081 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
3082 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
3083 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
3084 
3085 	ATF_REQUIRE((fpid = fork()) != -1);
3086 	if (fpid == 0) {
3087 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
3088 
3089 		/* The other thread should receive the first SIGUSR1. */
3090 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
3091 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
3092 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
3093 
3094 		trace_me();
3095 
3096 		/* Wait until other thread has received its SIGUSR1. */
3097 		pthread_barrier_wait(&barrier);
3098 
3099 		/*
3100 		 * Swap ignore duties; the next SIGUSR1 should go to this
3101 		 * thread.
3102 		 */
3103 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3104 
3105 		/* Sync up threads after swapping signal masks. */
3106 		pthread_barrier_wait(&barrier);
3107 
3108 		/*
3109 		 * Sync up with test code; we're ready for the next SIGUSR1
3110 		 * now.
3111 		 */
3112 		raise(SIGSTOP);
3113 
3114 		/* Wait for this thread to receive a SIGUSR1. */
3115 		do {
3116 			err = sem_wait(&sigusr1_sem);
3117 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3118 		} while (err != 0 && errno == EINTR);
3119 
3120 		/* Free the other thread from the barrier. */
3121 		pthread_barrier_wait(&barrier);
3122 
3123 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
3124 
3125 		exit(1);
3126 	}
3127 
3128 	/* The first wait() should report the stop from SIGSTOP. */
3129 	wpid = waitpid(fpid, &status, 0);
3130 	ATF_REQUIRE(wpid == fpid);
3131 	ATF_REQUIRE(WIFSTOPPED(status));
3132 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3133 
3134 	/* Continue the child ignoring the SIGSTOP. */
3135 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3136 
3137 	/*
3138 	 * Send a signal without ptrace that either thread will accept (USR2,
3139 	 * in this case).
3140 	 */
3141 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3142 
3143 	/* The second wait() should report a SIGUSR2 was received. */
3144 	wpid = waitpid(fpid, &status, 0);
3145 	ATF_REQUIRE(wpid == fpid);
3146 	ATF_REQUIRE(WIFSTOPPED(status));
3147 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3148 
3149 	/* Continue the child, changing the signal to USR1. */
3150 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3151 
3152 	/* The next wait() should report the stop from SIGSTOP. */
3153 	wpid = waitpid(fpid, &status, 0);
3154 	ATF_REQUIRE(wpid == fpid);
3155 	ATF_REQUIRE(WIFSTOPPED(status));
3156 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3157 
3158 	/* Continue the child ignoring the SIGSTOP. */
3159 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3160 
3161 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3162 
3163 	/* The next wait() should report a SIGUSR2 was received. */
3164 	wpid = waitpid(fpid, &status, 0);
3165 	ATF_REQUIRE(wpid == fpid);
3166 	ATF_REQUIRE(WIFSTOPPED(status));
3167 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3168 
3169 	/* Continue the child, changing the signal to USR1. */
3170 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3171 
3172 	/* The last wait() should report normal exit with code 1. */
3173 	wpid = waitpid(fpid, &status, 0);
3174 	ATF_REQUIRE(wpid == fpid);
3175 	ATF_REQUIRE(WIFEXITED(status));
3176 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3177 
3178 	wpid = wait(&status);
3179 	ATF_REQUIRE(wpid == -1);
3180 	ATF_REQUIRE(errno == ECHILD);
3181 }
3182 
3183 static void *
3184 raise_sigstop_thread(void *arg __unused)
3185 {
3186 
3187 	raise(SIGSTOP);
3188 	return NULL;
3189 }
3190 
3191 static void *
3192 sleep_thread(void *arg __unused)
3193 {
3194 
3195 	sleep(60);
3196 	return NULL;
3197 }
3198 
3199 static void
3200 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
3201 {
3202 	pid_t fpid, wpid;
3203 	int status, i;
3204 	cpuset_t setmask;
3205 	cpusetid_t setid;
3206 	pthread_t t;
3207 
3208 	/*
3209 	 * Become the reaper for this process tree. We need to be able to check
3210 	 * that both child and grandchild have died.
3211 	 */
3212 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
3213 
3214 	fpid = fork();
3215 	ATF_REQUIRE(fpid >= 0);
3216 	if (fpid == 0) {
3217 		fpid = fork();
3218 		CHILD_REQUIRE(fpid >= 0);
3219 		if (fpid == 0) {
3220 			trace_me();
3221 
3222 			/* Pin to CPU 0 to serialize thread execution. */
3223 			CPU_ZERO(&setmask);
3224 			CPU_SET(0, &setmask);
3225 			CHILD_REQUIRE(cpuset(&setid) == 0);
3226 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
3227 			    CPU_WHICH_CPUSET, setid,
3228 			    sizeof(setmask), &setmask) == 0);
3229 
3230 			if (sigstop_from_main_thread) {
3231 				/*
3232 				 * We expect the SIGKILL sent when our parent
3233 				 * dies to be delivered to the new thread.
3234 				 * Raise the SIGSTOP in this thread so the
3235 				 * threads compete.
3236 				 */
3237 				CHILD_REQUIRE(pthread_create(&t, NULL,
3238 				    sleep_thread, NULL) == 0);
3239 				raise(SIGSTOP);
3240 			} else {
3241 				/*
3242 				 * We expect the SIGKILL to be delivered to
3243 				 * this thread. After creating the new thread,
3244 				 * just get off the CPU so the other thread can
3245 				 * raise the SIGSTOP.
3246 				 */
3247 				CHILD_REQUIRE(pthread_create(&t, NULL,
3248 				    raise_sigstop_thread, NULL) == 0);
3249 				sleep(60);
3250 			}
3251 
3252 			exit(0);
3253 		}
3254 		/* First stop is trace_me() immediately after fork. */
3255 		wpid = waitpid(fpid, &status, 0);
3256 		CHILD_REQUIRE(wpid == fpid);
3257 		CHILD_REQUIRE(WIFSTOPPED(status));
3258 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3259 
3260 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3261 
3262 		/* Second stop is from the raise(SIGSTOP). */
3263 		wpid = waitpid(fpid, &status, 0);
3264 		CHILD_REQUIRE(wpid == fpid);
3265 		CHILD_REQUIRE(WIFSTOPPED(status));
3266 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3267 
3268 		/*
3269 		 * Terminate tracing process without detaching. Our child
3270 		 * should be killed.
3271 		 */
3272 		exit(0);
3273 	}
3274 
3275 	/*
3276 	 * We should get a normal exit from our immediate child and a SIGKILL
3277 	 * exit from our grandchild. The latter case is the interesting one.
3278 	 * Our grandchild should not have stopped due to the SIGSTOP that was
3279 	 * left dangling when its parent died.
3280 	 */
3281 	for (i = 0; i < 2; ++i) {
3282 		wpid = wait(&status);
3283 		if (wpid == fpid)
3284 			ATF_REQUIRE(WIFEXITED(status) &&
3285 			    WEXITSTATUS(status) == 0);
3286 		else
3287 			ATF_REQUIRE(WIFSIGNALED(status) &&
3288 			    WTERMSIG(status) == SIGKILL);
3289 	}
3290 }
3291 
3292 /*
3293  * These two tests ensure that if the tracing process exits without detaching
3294  * just after the child received a SIGSTOP, the child is cleanly killed and
3295  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
3296  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
3297  * different threads, the SIGKILL must win.  There are two variants of this
3298  * test, designed to catch the case where the SIGKILL is delivered to the
3299  * younger thread (the first test) and the case where the SIGKILL is delivered
3300  * to the older thread (the second test). This behavior has changed in the
3301  * past, so make no assumption.
3302  */
3303 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
3304 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
3305 {
3306 
3307 	atf_tc_set_md_var(tc, "require.user", "root");
3308 }
3309 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
3310 {
3311 
3312 	terminate_with_pending_sigstop(true);
3313 }
3314 
3315 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
3316 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
3317 {
3318 
3319 	atf_tc_set_md_var(tc, "require.user", "root");
3320 }
3321 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
3322 {
3323 
3324 	terminate_with_pending_sigstop(false);
3325 }
3326 
3327 /*
3328  * Verify that after ptrace() discards a SIGKILL signal, the event mask
3329  * is not modified.
3330  */
3331 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
3332 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
3333 {
3334 	struct ptrace_lwpinfo pl;
3335 	pid_t fpid, wpid;
3336 	int status, event_mask, new_event_mask;
3337 
3338 	ATF_REQUIRE((fpid = fork()) != -1);
3339 	if (fpid == 0) {
3340 		trace_me();
3341 		raise(SIGSTOP);
3342 		exit(0);
3343 	}
3344 
3345 	/* The first wait() should report the stop from trace_me(). */
3346 	wpid = waitpid(fpid, &status, 0);
3347 	ATF_REQUIRE(wpid == fpid);
3348 	ATF_REQUIRE(WIFSTOPPED(status));
3349 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3350 
3351 	/* Set several unobtrusive event bits. */
3352 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3353 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3354 	    sizeof(event_mask)) == 0);
3355 
3356 	/* Send a SIGKILL without using ptrace. */
3357 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
3358 
3359 	/* Continue the child ignoring the SIGSTOP. */
3360 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3361 
3362 	/* The next stop should be due to the SIGKILL. */
3363 	wpid = waitpid(fpid, &status, 0);
3364 	ATF_REQUIRE(wpid == fpid);
3365 	ATF_REQUIRE(WIFSTOPPED(status));
3366 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
3367 
3368 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3369 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3370 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
3371 
3372 	/* Continue the child ignoring the SIGKILL. */
3373 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3374 
3375 	/* The next wait() should report the stop from SIGSTOP. */
3376 	wpid = waitpid(fpid, &status, 0);
3377 	ATF_REQUIRE(wpid == fpid);
3378 	ATF_REQUIRE(WIFSTOPPED(status));
3379 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3380 
3381 	/* Check the current event mask. It should not have changed. */
3382 	new_event_mask = 0;
3383 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3384 	    sizeof(new_event_mask)) == 0);
3385 	ATF_REQUIRE(event_mask == new_event_mask);
3386 
3387 	/* Continue the child to let it exit. */
3388 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3389 
3390 	/* The last event should be for the child process's exit. */
3391 	wpid = waitpid(fpid, &status, 0);
3392 	ATF_REQUIRE(WIFEXITED(status));
3393 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3394 
3395 	wpid = wait(&status);
3396 	ATF_REQUIRE(wpid == -1);
3397 	ATF_REQUIRE(errno == ECHILD);
3398 }
3399 
3400 static void *
3401 flock_thread(void *arg)
3402 {
3403 	int fd;
3404 
3405 	fd = *(int *)arg;
3406 	(void)flock(fd, LOCK_EX);
3407 	(void)flock(fd, LOCK_UN);
3408 	return (NULL);
3409 }
3410 
3411 /*
3412  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3413  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3414  * on a lock. This is a regression test for r318191.
3415  */
3416 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3417 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3418 {
3419 	pthread_barrier_t barrier;
3420 	pthread_barrierattr_t battr;
3421 	char tmpfile[64];
3422 	pid_t child, wpid;
3423 	int error, fd, i, status;
3424 
3425 	ATF_REQUIRE(pthread_barrierattr_init(&battr) == 0);
3426 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3427 	    PTHREAD_PROCESS_SHARED) == 0);
3428 	ATF_REQUIRE(pthread_barrier_init(&barrier, &battr, 2) == 0);
3429 
3430 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3431 	fd = mkstemp(tmpfile);
3432 	ATF_REQUIRE(fd >= 0);
3433 
3434 	ATF_REQUIRE((child = fork()) != -1);
3435 	if (child == 0) {
3436 		pthread_t t[2];
3437 		int cfd;
3438 
3439 		error = pthread_barrier_wait(&barrier);
3440 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3441 			_exit(1);
3442 
3443 		cfd = open(tmpfile, O_RDONLY);
3444 		if (cfd < 0)
3445 			_exit(1);
3446 
3447 		/*
3448 		 * We want at least two threads blocked on the file lock since
3449 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3450 		 * sleep.
3451 		 */
3452 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3453 			_exit(1);
3454 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3455 			_exit(1);
3456 		if (pthread_join(t[0], NULL) != 0)
3457 			_exit(1);
3458 		if (pthread_join(t[1], NULL) != 0)
3459 			_exit(1);
3460 		_exit(0);
3461 	}
3462 
3463 	ATF_REQUIRE(flock(fd, LOCK_EX) == 0);
3464 
3465 	error = pthread_barrier_wait(&barrier);
3466 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3467 
3468 	/*
3469 	 * Give the child some time to block. Is there a better way to do this?
3470 	 */
3471 	sleep(1);
3472 
3473 	/*
3474 	 * Attach and give the child 3 seconds to stop.
3475 	 */
3476 	ATF_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) == 0);
3477 	for (i = 0; i < 3; i++) {
3478 		wpid = waitpid(child, &status, WNOHANG);
3479 		if (wpid == child && WIFSTOPPED(status) &&
3480 		    WSTOPSIG(status) == SIGSTOP)
3481 			break;
3482 		sleep(1);
3483 	}
3484 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3485 
3486 	ATF_REQUIRE(ptrace(PT_DETACH, child, NULL, 0) == 0);
3487 
3488 	ATF_REQUIRE(flock(fd, LOCK_UN) == 0);
3489 	ATF_REQUIRE(unlink(tmpfile) == 0);
3490 	ATF_REQUIRE(close(fd) == 0);
3491 }
3492 
3493 static void
3494 sigusr1_step_handler(int sig)
3495 {
3496 
3497 	CHILD_REQUIRE(sig == SIGUSR1);
3498 	raise(SIGABRT);
3499 }
3500 
3501 /*
3502  * Verify that PT_STEP with a signal invokes the signal before
3503  * stepping the next instruction (and that the next instruction is
3504  * stepped correctly).
3505  */
3506 ATF_TC_WITHOUT_HEAD(ptrace__PT_STEP_with_signal);
3507 ATF_TC_BODY(ptrace__PT_STEP_with_signal, tc)
3508 {
3509 	struct ptrace_lwpinfo pl;
3510 	pid_t fpid, wpid;
3511 	int status;
3512 
3513 	ATF_REQUIRE((fpid = fork()) != -1);
3514 	if (fpid == 0) {
3515 		trace_me();
3516 		signal(SIGUSR1, sigusr1_step_handler);
3517 		raise(SIGABRT);
3518 		exit(1);
3519 	}
3520 
3521 	/* The first wait() should report the stop from SIGSTOP. */
3522 	wpid = waitpid(fpid, &status, 0);
3523 	ATF_REQUIRE(wpid == fpid);
3524 	ATF_REQUIRE(WIFSTOPPED(status));
3525 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3526 
3527 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3528 
3529 	/* The next stop should report the SIGABRT in the child body. */
3530 	wpid = waitpid(fpid, &status, 0);
3531 	ATF_REQUIRE(wpid == fpid);
3532 	ATF_REQUIRE(WIFSTOPPED(status));
3533 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3534 
3535 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3536 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3537 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3538 
3539 	/* Step the child process inserting SIGUSR1. */
3540 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, SIGUSR1) == 0);
3541 
3542 	/* The next stop should report the SIGABRT in the signal handler. */
3543 	wpid = waitpid(fpid, &status, 0);
3544 	ATF_REQUIRE(wpid == fpid);
3545 	ATF_REQUIRE(WIFSTOPPED(status));
3546 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3547 
3548 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3549 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3550 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3551 
3552 	/* Continue the child process discarding the signal. */
3553 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3554 
3555 	/* The next stop should report a trace trap from PT_STEP. */
3556 	wpid = waitpid(fpid, &status, 0);
3557 	ATF_REQUIRE(wpid == fpid);
3558 	ATF_REQUIRE(WIFSTOPPED(status));
3559 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3560 
3561 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3562 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3563 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3564 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3565 
3566 	/* Continue the child to let it exit. */
3567 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3568 
3569 	/* The last event should be for the child process's exit. */
3570 	wpid = waitpid(fpid, &status, 0);
3571 	ATF_REQUIRE(WIFEXITED(status));
3572 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3573 
3574 	wpid = wait(&status);
3575 	ATF_REQUIRE(wpid == -1);
3576 	ATF_REQUIRE(errno == ECHILD);
3577 }
3578 
3579 #ifdef HAVE_BREAKPOINT
3580 /*
3581  * Verify that a SIGTRAP event with the TRAP_BRKPT code is reported
3582  * for a breakpoint trap.
3583  */
3584 ATF_TC_WITHOUT_HEAD(ptrace__breakpoint_siginfo);
3585 ATF_TC_BODY(ptrace__breakpoint_siginfo, tc)
3586 {
3587 	struct ptrace_lwpinfo pl;
3588 	pid_t fpid, wpid;
3589 	int status;
3590 
3591 	ATF_REQUIRE((fpid = fork()) != -1);
3592 	if (fpid == 0) {
3593 		trace_me();
3594 		breakpoint();
3595 		exit(1);
3596 	}
3597 
3598 	/* The first wait() should report the stop from SIGSTOP. */
3599 	wpid = waitpid(fpid, &status, 0);
3600 	ATF_REQUIRE(wpid == fpid);
3601 	ATF_REQUIRE(WIFSTOPPED(status));
3602 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3603 
3604 	/* Continue the child ignoring the SIGSTOP. */
3605 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3606 
3607 	/* The second wait() should report hitting the breakpoint. */
3608 	wpid = waitpid(fpid, &status, 0);
3609 	ATF_REQUIRE(wpid == fpid);
3610 	ATF_REQUIRE(WIFSTOPPED(status));
3611 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3612 
3613 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3614 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3615 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3616 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_BRKPT);
3617 
3618 	/* Kill the child process. */
3619 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
3620 
3621 	/* The last wait() should report the SIGKILL. */
3622 	wpid = waitpid(fpid, &status, 0);
3623 	ATF_REQUIRE(wpid == fpid);
3624 	ATF_REQUIRE(WIFSIGNALED(status));
3625 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
3626 
3627 	wpid = wait(&status);
3628 	ATF_REQUIRE(wpid == -1);
3629 	ATF_REQUIRE(errno == ECHILD);
3630 }
3631 #endif /* HAVE_BREAKPOINT */
3632 
3633 /*
3634  * Verify that a SIGTRAP event with the TRAP_TRACE code is reported
3635  * for a single-step trap from PT_STEP.
3636  */
3637 ATF_TC_WITHOUT_HEAD(ptrace__step_siginfo);
3638 ATF_TC_BODY(ptrace__step_siginfo, tc)
3639 {
3640 	struct ptrace_lwpinfo pl;
3641 	pid_t fpid, wpid;
3642 	int status;
3643 
3644 	ATF_REQUIRE((fpid = fork()) != -1);
3645 	if (fpid == 0) {
3646 		trace_me();
3647 		exit(1);
3648 	}
3649 
3650 	/* The first wait() should report the stop from SIGSTOP. */
3651 	wpid = waitpid(fpid, &status, 0);
3652 	ATF_REQUIRE(wpid == fpid);
3653 	ATF_REQUIRE(WIFSTOPPED(status));
3654 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3655 
3656 	/* Step the child ignoring the SIGSTOP. */
3657 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, 0) == 0);
3658 
3659 	/* The second wait() should report a single-step trap. */
3660 	wpid = waitpid(fpid, &status, 0);
3661 	ATF_REQUIRE(wpid == fpid);
3662 	ATF_REQUIRE(WIFSTOPPED(status));
3663 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3664 
3665 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3666 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3667 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3668 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3669 
3670 	/* Continue the child process. */
3671 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3672 
3673 	/* The last event should be for the child process's exit. */
3674 	wpid = waitpid(fpid, &status, 0);
3675 	ATF_REQUIRE(WIFEXITED(status));
3676 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3677 
3678 	wpid = wait(&status);
3679 	ATF_REQUIRE(wpid == -1);
3680 	ATF_REQUIRE(errno == ECHILD);
3681 }
3682 
3683 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3684 static void *
3685 continue_thread(void *arg __unused)
3686 {
3687 	breakpoint();
3688 	return (NULL);
3689 }
3690 
3691 static __dead2 void
3692 continue_thread_main(void)
3693 {
3694 	pthread_t threads[2];
3695 
3696 	CHILD_REQUIRE(pthread_create(&threads[0], NULL, continue_thread,
3697 	    NULL) == 0);
3698 	CHILD_REQUIRE(pthread_create(&threads[1], NULL, continue_thread,
3699 	    NULL) == 0);
3700 	CHILD_REQUIRE(pthread_join(threads[0], NULL) == 0);
3701 	CHILD_REQUIRE(pthread_join(threads[1], NULL) == 0);
3702 	exit(1);
3703 }
3704 
3705 /*
3706  * Ensure that PT_CONTINUE clears the status of the thread that
3707  * triggered the stop even if a different thread's LWP was passed to
3708  * PT_CONTINUE.
3709  */
3710 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_different_thread);
3711 ATF_TC_BODY(ptrace__PT_CONTINUE_different_thread, tc)
3712 {
3713 	struct ptrace_lwpinfo pl;
3714 	pid_t fpid, wpid;
3715 	lwpid_t lwps[2];
3716 	bool hit_break[2];
3717 	struct reg reg;
3718 	int i, j, status;
3719 
3720 	ATF_REQUIRE((fpid = fork()) != -1);
3721 	if (fpid == 0) {
3722 		trace_me();
3723 		continue_thread_main();
3724 	}
3725 
3726 	/* The first wait() should report the stop from SIGSTOP. */
3727 	wpid = waitpid(fpid, &status, 0);
3728 	ATF_REQUIRE(wpid == fpid);
3729 	ATF_REQUIRE(WIFSTOPPED(status));
3730 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3731 
3732 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3733 	    sizeof(pl)) != -1);
3734 
3735 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
3736 
3737 	/* Continue the child ignoring the SIGSTOP. */
3738 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3739 
3740 	/* One of the new threads should report it's birth. */
3741 	wpid = waitpid(fpid, &status, 0);
3742 	ATF_REQUIRE(wpid == fpid);
3743 	ATF_REQUIRE(WIFSTOPPED(status));
3744 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3745 
3746 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3747 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3748 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3749 	lwps[0] = pl.pl_lwpid;
3750 
3751 	/*
3752 	 * Suspend this thread to ensure both threads are alive before
3753 	 * hitting the breakpoint.
3754 	 */
3755 	ATF_REQUIRE(ptrace(PT_SUSPEND, lwps[0], NULL, 0) != -1);
3756 
3757 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3758 
3759 	/* Second thread should report it's birth. */
3760 	wpid = waitpid(fpid, &status, 0);
3761 	ATF_REQUIRE(wpid == fpid);
3762 	ATF_REQUIRE(WIFSTOPPED(status));
3763 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3764 
3765 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3766 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3767 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3768 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
3769 	lwps[1] = pl.pl_lwpid;
3770 
3771 	/* Resume both threads waiting for breakpoint events. */
3772 	hit_break[0] = hit_break[1] = false;
3773 	ATF_REQUIRE(ptrace(PT_RESUME, lwps[0], NULL, 0) != -1);
3774 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3775 
3776 	/* One thread should report a breakpoint. */
3777 	wpid = waitpid(fpid, &status, 0);
3778 	ATF_REQUIRE(wpid == fpid);
3779 	ATF_REQUIRE(WIFSTOPPED(status));
3780 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3781 
3782 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3783 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3784 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3785 	    pl.pl_siginfo.si_code == TRAP_BRKPT);
3786 	if (pl.pl_lwpid == lwps[0])
3787 		i = 0;
3788 	else
3789 		i = 1;
3790 	hit_break[i] = true;
3791 	ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3792 	SKIP_BREAK(&reg);
3793 	ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3794 
3795 	/*
3796 	 * Resume both threads but pass the other thread's LWPID to
3797 	 * PT_CONTINUE.
3798 	 */
3799 	ATF_REQUIRE(ptrace(PT_CONTINUE, lwps[i ^ 1], (caddr_t)1, 0) == 0);
3800 
3801 	/*
3802 	 * Will now get two thread exit events and one more breakpoint
3803 	 * event.
3804 	 */
3805 	for (j = 0; j < 3; j++) {
3806 		wpid = waitpid(fpid, &status, 0);
3807 		ATF_REQUIRE(wpid == fpid);
3808 		ATF_REQUIRE(WIFSTOPPED(status));
3809 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3810 
3811 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3812 		    sizeof(pl)) != -1);
3813 
3814 		if (pl.pl_lwpid == lwps[0])
3815 			i = 0;
3816 		else
3817 			i = 1;
3818 
3819 		ATF_REQUIRE_MSG(lwps[i] != 0, "event for exited thread");
3820 		if (pl.pl_flags & PL_FLAG_EXITED) {
3821 			ATF_REQUIRE_MSG(hit_break[i],
3822 			    "exited thread did not report breakpoint");
3823 			lwps[i] = 0;
3824 		} else {
3825 			ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3826 			ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3827 			    pl.pl_siginfo.si_code == TRAP_BRKPT);
3828 			ATF_REQUIRE_MSG(!hit_break[i],
3829 			    "double breakpoint event");
3830 			hit_break[i] = true;
3831 			ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg,
3832 			    0) != -1);
3833 			SKIP_BREAK(&reg);
3834 			ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg,
3835 			    0) != -1);
3836 		}
3837 
3838 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3839 	}
3840 
3841 	/* Both threads should have exited. */
3842 	ATF_REQUIRE(lwps[0] == 0);
3843 	ATF_REQUIRE(lwps[1] == 0);
3844 
3845 	/* The last event should be for the child process's exit. */
3846 	wpid = waitpid(fpid, &status, 0);
3847 	ATF_REQUIRE(WIFEXITED(status));
3848 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3849 
3850 	wpid = wait(&status);
3851 	ATF_REQUIRE(wpid == -1);
3852 	ATF_REQUIRE(errno == ECHILD);
3853 }
3854 #endif
3855 
3856 /*
3857  * Verify that PT_LWPINFO doesn't return stale siginfo.
3858  */
3859 ATF_TC_WITHOUT_HEAD(ptrace__PT_LWPINFO_stale_siginfo);
3860 ATF_TC_BODY(ptrace__PT_LWPINFO_stale_siginfo, tc)
3861 {
3862 	struct ptrace_lwpinfo pl;
3863 	pid_t fpid, wpid;
3864 	int events, status;
3865 
3866 	ATF_REQUIRE((fpid = fork()) != -1);
3867 	if (fpid == 0) {
3868 		trace_me();
3869 		raise(SIGABRT);
3870 		exit(1);
3871 	}
3872 
3873 	/* The first wait() should report the stop from SIGSTOP. */
3874 	wpid = waitpid(fpid, &status, 0);
3875 	ATF_REQUIRE(wpid == fpid);
3876 	ATF_REQUIRE(WIFSTOPPED(status));
3877 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3878 
3879 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3880 
3881 	/* The next stop should report the SIGABRT in the child body. */
3882 	wpid = waitpid(fpid, &status, 0);
3883 	ATF_REQUIRE(wpid == fpid);
3884 	ATF_REQUIRE(WIFSTOPPED(status));
3885 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3886 
3887 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3888 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3889 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3890 
3891 	/*
3892 	 * Continue the process ignoring the signal, but enabling
3893 	 * syscall traps.
3894 	 */
3895 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
3896 
3897 	/*
3898 	 * The next stop should report a system call entry from
3899 	 * exit().  PL_FLAGS_SI should not be set.
3900 	 */
3901 	wpid = waitpid(fpid, &status, 0);
3902 	ATF_REQUIRE(wpid == fpid);
3903 	ATF_REQUIRE(WIFSTOPPED(status));
3904 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3905 
3906 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3907 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3908 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) == 0);
3909 
3910 	/* Disable syscall tracing and continue the child to let it exit. */
3911 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
3912 	    sizeof(events)) == 0);
3913 	events &= ~PTRACE_SYSCALL;
3914 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
3915 	    sizeof(events)) == 0);
3916 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3917 
3918 	/* The last event should be for the child process's exit. */
3919 	wpid = waitpid(fpid, &status, 0);
3920 	ATF_REQUIRE(WIFEXITED(status));
3921 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3922 
3923 	wpid = wait(&status);
3924 	ATF_REQUIRE(wpid == -1);
3925 	ATF_REQUIRE(errno == ECHILD);
3926 }
3927 
3928 /*
3929  * A simple test of PT_GET_SC_ARGS and PT_GET_SC_RET.
3930  */
3931 ATF_TC_WITHOUT_HEAD(ptrace__syscall_args);
3932 ATF_TC_BODY(ptrace__syscall_args, tc)
3933 {
3934 	struct ptrace_lwpinfo pl;
3935 	struct ptrace_sc_ret psr;
3936 	pid_t fpid, wpid;
3937 	register_t args[2];
3938 	int events, status;
3939 
3940 	ATF_REQUIRE((fpid = fork()) != -1);
3941 	if (fpid == 0) {
3942 		trace_me();
3943 		kill(getpid(), 0);
3944 		close(3);
3945 		exit(1);
3946 	}
3947 
3948 	/* The first wait() should report the stop from SIGSTOP. */
3949 	wpid = waitpid(fpid, &status, 0);
3950 	ATF_REQUIRE(wpid == fpid);
3951 	ATF_REQUIRE(WIFSTOPPED(status));
3952 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3953 
3954 	/*
3955 	 * Continue the process ignoring the signal, but enabling
3956 	 * syscall traps.
3957 	 */
3958 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
3959 
3960 	/*
3961 	 * The next stop should be the syscall entry from getpid().
3962 	 */
3963 	wpid = waitpid(fpid, &status, 0);
3964 	ATF_REQUIRE(wpid == fpid);
3965 	ATF_REQUIRE(WIFSTOPPED(status));
3966 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3967 
3968 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3969 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3970 	ATF_REQUIRE(pl.pl_syscall_code == SYS_getpid);
3971 
3972 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3973 
3974 	/*
3975 	 * The next stop should be the syscall exit from getpid().
3976 	 */
3977 	wpid = waitpid(fpid, &status, 0);
3978 	ATF_REQUIRE(wpid == fpid);
3979 	ATF_REQUIRE(WIFSTOPPED(status));
3980 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3981 
3982 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3983 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
3984 	ATF_REQUIRE(pl.pl_syscall_code == SYS_getpid);
3985 
3986 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
3987 	    sizeof(psr)) != -1);
3988 	ATF_REQUIRE(psr.sr_error == 0);
3989 	ATF_REQUIRE(psr.sr_retval[0] == wpid);
3990 
3991 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3992 
3993 	/*
3994 	 * The next stop should be the syscall entry from kill().
3995 	 */
3996 	wpid = waitpid(fpid, &status, 0);
3997 	ATF_REQUIRE(wpid == fpid);
3998 	ATF_REQUIRE(WIFSTOPPED(status));
3999 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
4000 
4001 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4002 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
4003 	ATF_REQUIRE(pl.pl_syscall_code == SYS_kill);
4004 	ATF_REQUIRE(pl.pl_syscall_narg == 2);
4005 
4006 	ATF_REQUIRE(ptrace(PT_GET_SC_ARGS, wpid, (caddr_t)args,
4007 	    sizeof(args)) != -1);
4008 	ATF_REQUIRE(args[0] == wpid);
4009 	ATF_REQUIRE(args[1] == 0);
4010 
4011 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
4012 
4013 	/*
4014 	 * The next stop should be the syscall exit from kill().
4015 	 */
4016 	wpid = waitpid(fpid, &status, 0);
4017 	ATF_REQUIRE(wpid == fpid);
4018 	ATF_REQUIRE(WIFSTOPPED(status));
4019 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
4020 
4021 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4022 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
4023 	ATF_REQUIRE(pl.pl_syscall_code == SYS_kill);
4024 
4025 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
4026 	    sizeof(psr)) != -1);
4027 	ATF_REQUIRE(psr.sr_error == 0);
4028 
4029 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
4030 
4031 	/*
4032 	 * The next stop should be the syscall entry from close().
4033 	 */
4034 	wpid = waitpid(fpid, &status, 0);
4035 	ATF_REQUIRE(wpid == fpid);
4036 	ATF_REQUIRE(WIFSTOPPED(status));
4037 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
4038 
4039 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4040 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
4041 	ATF_REQUIRE(pl.pl_syscall_code == SYS_close);
4042 	ATF_REQUIRE(pl.pl_syscall_narg == 1);
4043 
4044 	ATF_REQUIRE(ptrace(PT_GET_SC_ARGS, wpid, (caddr_t)args,
4045 	    sizeof(args)) != -1);
4046 	ATF_REQUIRE(args[0] == 3);
4047 
4048 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
4049 
4050 	/*
4051 	 * The next stop should be the syscall exit from close().
4052 	 */
4053 	wpid = waitpid(fpid, &status, 0);
4054 	ATF_REQUIRE(wpid == fpid);
4055 	ATF_REQUIRE(WIFSTOPPED(status));
4056 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
4057 
4058 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
4059 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
4060 	ATF_REQUIRE(pl.pl_syscall_code == SYS_close);
4061 
4062 	ATF_REQUIRE(ptrace(PT_GET_SC_RET, wpid, (caddr_t)&psr,
4063 	    sizeof(psr)) != -1);
4064 	ATF_REQUIRE(psr.sr_error == EBADF);
4065 
4066 	/* Disable syscall tracing and continue the child to let it exit. */
4067 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
4068 	    sizeof(events)) == 0);
4069 	events &= ~PTRACE_SYSCALL;
4070 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
4071 	    sizeof(events)) == 0);
4072 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
4073 
4074 	/* The last event should be for the child process's exit. */
4075 	wpid = waitpid(fpid, &status, 0);
4076 	ATF_REQUIRE(WIFEXITED(status));
4077 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
4078 
4079 	wpid = wait(&status);
4080 	ATF_REQUIRE(wpid == -1);
4081 	ATF_REQUIRE(errno == ECHILD);
4082 }
4083 
4084 /*
4085  * Verify that when the process is traced that it isn't reparent
4086  * to the init process when we close all process descriptors.
4087  */
4088 ATF_TC(ptrace__proc_reparent);
4089 ATF_TC_HEAD(ptrace__proc_reparent, tc)
4090 {
4091 
4092 	atf_tc_set_md_var(tc, "timeout", "2");
4093 }
4094 ATF_TC_BODY(ptrace__proc_reparent, tc)
4095 {
4096 	pid_t traced, debuger, wpid;
4097 	int pd, status;
4098 
4099 	traced = pdfork(&pd, 0);
4100 	ATF_REQUIRE(traced >= 0);
4101 	if (traced == 0) {
4102 		raise(SIGSTOP);
4103 		exit(0);
4104 	}
4105 	ATF_REQUIRE(pd >= 0);
4106 
4107 	debuger = fork();
4108 	ATF_REQUIRE(debuger >= 0);
4109 	if (debuger == 0) {
4110 		/* The traced process is reparented to debuger. */
4111 		ATF_REQUIRE(ptrace(PT_ATTACH, traced, 0, 0) == 0);
4112 		wpid = waitpid(traced, &status, 0);
4113 		ATF_REQUIRE(wpid == traced);
4114 		ATF_REQUIRE(WIFSTOPPED(status));
4115 		ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
4116 		ATF_REQUIRE(close(pd) == 0);
4117 		ATF_REQUIRE(ptrace(PT_DETACH, traced, (caddr_t)1, 0) == 0);
4118 
4119 		/* We closed pd so we should not have any child. */
4120 		wpid = wait(&status);
4121 		ATF_REQUIRE(wpid == -1);
4122 		ATF_REQUIRE(errno == ECHILD);
4123 
4124 		exit(0);
4125 	}
4126 
4127 	ATF_REQUIRE(close(pd) == 0);
4128 	wpid = waitpid(debuger, &status, 0);
4129 	ATF_REQUIRE(wpid == debuger);
4130 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
4131 
4132 	/* Check if we still have any child. */
4133 	wpid = wait(&status);
4134 	ATF_REQUIRE(wpid == -1);
4135 	ATF_REQUIRE(errno == ECHILD);
4136 }
4137 
4138 /*
4139  * Ensure that traced processes created with pdfork(2) are visible to
4140  * waitid(P_ALL).
4141  */
4142 ATF_TC_WITHOUT_HEAD(ptrace__procdesc_wait_child);
4143 ATF_TC_BODY(ptrace__procdesc_wait_child, tc)
4144 {
4145 	pid_t child, wpid;
4146 	int pd, status;
4147 
4148 	child = pdfork(&pd, 0);
4149 	ATF_REQUIRE(child >= 0);
4150 
4151 	if (child == 0) {
4152 		trace_me();
4153 		(void)raise(SIGSTOP);
4154 		exit(0);
4155 	}
4156 
4157 	wpid = waitpid(child, &status, 0);
4158 	ATF_REQUIRE(wpid == child);
4159 	ATF_REQUIRE(WIFSTOPPED(status));
4160 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
4161 
4162 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
4163 
4164 	wpid = wait(&status);
4165 	ATF_REQUIRE(wpid == child);
4166 	ATF_REQUIRE(WIFSTOPPED(status));
4167 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
4168 
4169 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
4170 
4171 	/*
4172 	 * If process was created by pdfork, the return code have to
4173 	 * be collected through process descriptor.
4174 	 */
4175 	wpid = wait(&status);
4176 	ATF_REQUIRE(wpid == -1);
4177 	ATF_REQUIRE(errno == ECHILD);
4178 
4179 	ATF_REQUIRE(close(pd) != -1);
4180 }
4181 
4182 /*
4183  * Ensure that traced processes created with pdfork(2) are not visible
4184  * after returning to parent - waitid(P_ALL).
4185  */
4186 ATF_TC_WITHOUT_HEAD(ptrace__procdesc_reparent_wait_child);
4187 ATF_TC_BODY(ptrace__procdesc_reparent_wait_child, tc)
4188 {
4189 	pid_t traced, debuger, wpid;
4190 	int pd, status;
4191 
4192 	traced = pdfork(&pd, 0);
4193 	ATF_REQUIRE(traced >= 0);
4194 	if (traced == 0) {
4195 		raise(SIGSTOP);
4196 		exit(0);
4197 	}
4198 	ATF_REQUIRE(pd >= 0);
4199 
4200 	debuger = fork();
4201 	ATF_REQUIRE(debuger >= 0);
4202 	if (debuger == 0) {
4203 		/* The traced process is reparented to debuger. */
4204 		ATF_REQUIRE(ptrace(PT_ATTACH, traced, 0, 0) == 0);
4205 		wpid = waitpid(traced, &status, 0);
4206 		ATF_REQUIRE(wpid == traced);
4207 		ATF_REQUIRE(WIFSTOPPED(status));
4208 		ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
4209 
4210 		/* Allow process to die. */
4211 		ATF_REQUIRE(ptrace(PT_CONTINUE, traced, (caddr_t)1, 0) == 0);
4212 		wpid = waitpid(traced, &status, 0);
4213 		ATF_REQUIRE(wpid == traced);
4214 		ATF_REQUIRE(WIFEXITED(status));
4215 		ATF_REQUIRE(WEXITSTATUS(status) == 0);
4216 
4217 		/* Reparent back to the orginal process. */
4218 		ATF_REQUIRE(close(pd) == 0);
4219 		exit(0);
4220 	}
4221 
4222 	wpid = waitpid(debuger, &status, 0);
4223 	ATF_REQUIRE(wpid == debuger);
4224 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
4225 
4226 	/*
4227 	 * We have a child but it has a process descriptori
4228 	 * so we should not be able to collect it process.
4229 	 */
4230 	wpid = wait(&status);
4231 	ATF_REQUIRE(wpid == -1);
4232 	ATF_REQUIRE(errno == ECHILD);
4233 
4234 	ATF_REQUIRE(close(pd) == 0);
4235 }
4236 
4237 ATF_TP_ADD_TCS(tp)
4238 {
4239 
4240 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
4241 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
4242 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
4243 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
4244 	ATF_TP_ADD_TC(tp, ptrace__parent_exits_before_child);
4245 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
4246 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
4247 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
4248 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
4249 	ATF_TP_ADD_TC(tp,
4250 	    ptrace__follow_fork_child_detached_unrelated_debugger);
4251 	ATF_TP_ADD_TC(tp,
4252 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
4253 	ATF_TP_ADD_TC(tp, ptrace__getppid);
4254 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
4255 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
4256 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
4257 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
4258 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
4259 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
4260 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
4261 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
4262 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
4263 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
4264 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
4265 #ifdef HAVE_BREAKPOINT
4266 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
4267 #endif
4268 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
4269 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
4270 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
4271 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
4272 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
4273 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
4274 	ATF_TP_ADD_TC(tp,
4275 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
4276 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
4277 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
4278 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
4279 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
4280 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
4281 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
4282 	ATF_TP_ADD_TC(tp, ptrace__killed_with_sigmask);
4283 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigmask);
4284 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
4285 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
4286 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
4287 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
4288 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
4289 	ATF_TP_ADD_TC(tp, ptrace__PT_STEP_with_signal);
4290 #ifdef HAVE_BREAKPOINT
4291 	ATF_TP_ADD_TC(tp, ptrace__breakpoint_siginfo);
4292 #endif
4293 	ATF_TP_ADD_TC(tp, ptrace__step_siginfo);
4294 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
4295 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_different_thread);
4296 #endif
4297 	ATF_TP_ADD_TC(tp, ptrace__PT_LWPINFO_stale_siginfo);
4298 	ATF_TP_ADD_TC(tp, ptrace__syscall_args);
4299 	ATF_TP_ADD_TC(tp, ptrace__proc_reparent);
4300 	ATF_TP_ADD_TC(tp, ptrace__procdesc_wait_child);
4301 	ATF_TP_ADD_TC(tp, ptrace__procdesc_reparent_wait_child);
4302 
4303 	return (atf_no_error());
4304 }
4305