xref: /freebsd/tests/sys/kern/ptrace_test.c (revision 0957b409)
1 /*-
2  * Copyright (c) 2015 John Baldwin <jhb@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/types.h>
31 #include <sys/cpuset.h>
32 #include <sys/event.h>
33 #include <sys/file.h>
34 #include <sys/time.h>
35 #include <sys/procctl.h>
36 #include <sys/ptrace.h>
37 #include <sys/queue.h>
38 #include <sys/runq.h>
39 #include <sys/syscall.h>
40 #include <sys/sysctl.h>
41 #include <sys/user.h>
42 #include <sys/wait.h>
43 #include <errno.h>
44 #include <machine/cpufunc.h>
45 #include <pthread.h>
46 #include <sched.h>
47 #include <semaphore.h>
48 #include <signal.h>
49 #include <stdio.h>
50 #include <stdlib.h>
51 #include <unistd.h>
52 #include <atf-c.h>
53 
54 /*
55  * Architectures with a user-visible breakpoint().
56  */
57 #if defined(__aarch64__) || defined(__amd64__) || defined(__arm__) ||	\
58     defined(__i386__) || defined(__mips__) || defined(__riscv) ||	\
59     defined(__sparc64__)
60 #define	HAVE_BREAKPOINT
61 #endif
62 
63 /*
64  * Adjust PC to skip over a breakpoint when stopped for a breakpoint trap.
65  */
66 #ifdef HAVE_BREAKPOINT
67 #if defined(__aarch64__)
68 #define	SKIP_BREAK(reg)	((reg)->elr += 4)
69 #elif defined(__amd64__) || defined(__i386__)
70 #define	SKIP_BREAK(reg)
71 #elif defined(__arm__)
72 #define	SKIP_BREAK(reg)	((reg)->r_pc += 4)
73 #elif defined(__mips__)
74 #define	SKIP_BREAK(reg)	((reg)->r_regs[PC] += 4)
75 #elif defined(__riscv)
76 #define	SKIP_BREAK(reg)	((reg)->sepc += 4)
77 #elif defined(__sparc64__)
78 #define	SKIP_BREAK(reg)	do {						\
79 	(reg)->r_tpc = (reg)->r_tnpc + 4;				\
80 	(reg)->r_tnpc += 8;						\
81 } while (0)
82 #endif
83 #endif
84 
85 /*
86  * A variant of ATF_REQUIRE that is suitable for use in child
87  * processes.  This only works if the parent process is tripped up by
88  * the early exit and fails some requirement itself.
89  */
90 #define	CHILD_REQUIRE(exp) do {						\
91 		if (!(exp))						\
92 			child_fail_require(__FILE__, __LINE__,		\
93 			    #exp " not met");				\
94 	} while (0)
95 
96 static __dead2 void
97 child_fail_require(const char *file, int line, const char *str)
98 {
99 	char buf[128];
100 
101 	snprintf(buf, sizeof(buf), "%s:%d: %s\n", file, line, str);
102 	write(2, buf, strlen(buf));
103 	_exit(32);
104 }
105 
106 static void
107 trace_me(void)
108 {
109 
110 	/* Attach the parent process as a tracer of this process. */
111 	CHILD_REQUIRE(ptrace(PT_TRACE_ME, 0, NULL, 0) != -1);
112 
113 	/* Trigger a stop. */
114 	raise(SIGSTOP);
115 }
116 
117 static void
118 attach_child(pid_t pid)
119 {
120 	pid_t wpid;
121 	int status;
122 
123 	ATF_REQUIRE(ptrace(PT_ATTACH, pid, NULL, 0) == 0);
124 
125 	wpid = waitpid(pid, &status, 0);
126 	ATF_REQUIRE(wpid == pid);
127 	ATF_REQUIRE(WIFSTOPPED(status));
128 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
129 }
130 
131 static void
132 wait_for_zombie(pid_t pid)
133 {
134 
135 	/*
136 	 * Wait for a process to exit.  This is kind of gross, but
137 	 * there is not a better way.
138 	 *
139 	 * Prior to r325719, the kern.proc.pid.<pid> sysctl failed
140 	 * with ESRCH.  After that change, a valid struct kinfo_proc
141 	 * is returned for zombies with ki_stat set to SZOMB.
142 	 */
143 	for (;;) {
144 		struct kinfo_proc kp;
145 		size_t len;
146 		int mib[4];
147 
148 		mib[0] = CTL_KERN;
149 		mib[1] = KERN_PROC;
150 		mib[2] = KERN_PROC_PID;
151 		mib[3] = pid;
152 		len = sizeof(kp);
153 		if (sysctl(mib, nitems(mib), &kp, &len, NULL, 0) == -1) {
154 			ATF_REQUIRE(errno == ESRCH);
155 			break;
156 		}
157 		if (kp.ki_stat == SZOMB)
158 			break;
159 		usleep(5000);
160 	}
161 }
162 
163 /*
164  * Verify that a parent debugger process "sees" the exit of a debugged
165  * process exactly once when attached via PT_TRACE_ME.
166  */
167 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_trace_me);
168 ATF_TC_BODY(ptrace__parent_wait_after_trace_me, tc)
169 {
170 	pid_t child, wpid;
171 	int status;
172 
173 	ATF_REQUIRE((child = fork()) != -1);
174 	if (child == 0) {
175 		/* Child process. */
176 		trace_me();
177 
178 		_exit(1);
179 	}
180 
181 	/* Parent process. */
182 
183 	/* The first wait() should report the stop from SIGSTOP. */
184 	wpid = waitpid(child, &status, 0);
185 	ATF_REQUIRE(wpid == child);
186 	ATF_REQUIRE(WIFSTOPPED(status));
187 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
188 
189 	/* Continue the child ignoring the SIGSTOP. */
190 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
191 
192 	/* The second wait() should report the exit status. */
193 	wpid = waitpid(child, &status, 0);
194 	ATF_REQUIRE(wpid == child);
195 	ATF_REQUIRE(WIFEXITED(status));
196 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
197 
198 	/* The child should no longer exist. */
199 	wpid = waitpid(child, &status, 0);
200 	ATF_REQUIRE(wpid == -1);
201 	ATF_REQUIRE(errno == ECHILD);
202 }
203 
204 /*
205  * Verify that a parent debugger process "sees" the exit of a debugged
206  * process exactly once when attached via PT_ATTACH.
207  */
208 ATF_TC_WITHOUT_HEAD(ptrace__parent_wait_after_attach);
209 ATF_TC_BODY(ptrace__parent_wait_after_attach, tc)
210 {
211 	pid_t child, wpid;
212 	int cpipe[2], status;
213 	char c;
214 
215 	ATF_REQUIRE(pipe(cpipe) == 0);
216 	ATF_REQUIRE((child = fork()) != -1);
217 	if (child == 0) {
218 		/* Child process. */
219 		close(cpipe[0]);
220 
221 		/* Wait for the parent to attach. */
222 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == 0);
223 
224 		_exit(1);
225 	}
226 	close(cpipe[1]);
227 
228 	/* Parent process. */
229 
230 	/* Attach to the child process. */
231 	attach_child(child);
232 
233 	/* Continue the child ignoring the SIGSTOP. */
234 	ATF_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
235 
236 	/* Signal the child to exit. */
237 	close(cpipe[0]);
238 
239 	/* The second wait() should report the exit status. */
240 	wpid = waitpid(child, &status, 0);
241 	ATF_REQUIRE(wpid == child);
242 	ATF_REQUIRE(WIFEXITED(status));
243 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
244 
245 	/* The child should no longer exist. */
246 	wpid = waitpid(child, &status, 0);
247 	ATF_REQUIRE(wpid == -1);
248 	ATF_REQUIRE(errno == ECHILD);
249 }
250 
251 /*
252  * Verify that a parent process "sees" the exit of a debugged process only
253  * after the debugger has seen it.
254  */
255 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_child_debugger);
256 ATF_TC_BODY(ptrace__parent_sees_exit_after_child_debugger, tc)
257 {
258 	pid_t child, debugger, wpid;
259 	int cpipe[2], dpipe[2], status;
260 	char c;
261 
262 	ATF_REQUIRE(pipe(cpipe) == 0);
263 	ATF_REQUIRE((child = fork()) != -1);
264 
265 	if (child == 0) {
266 		/* Child process. */
267 		close(cpipe[0]);
268 
269 		/* Wait for parent to be ready. */
270 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
271 
272 		_exit(1);
273 	}
274 	close(cpipe[1]);
275 
276 	ATF_REQUIRE(pipe(dpipe) == 0);
277 	ATF_REQUIRE((debugger = fork()) != -1);
278 
279 	if (debugger == 0) {
280 		/* Debugger process. */
281 		close(dpipe[0]);
282 
283 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
284 
285 		wpid = waitpid(child, &status, 0);
286 		CHILD_REQUIRE(wpid == child);
287 		CHILD_REQUIRE(WIFSTOPPED(status));
288 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
289 
290 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
291 
292 		/* Signal parent that debugger is attached. */
293 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
294 
295 		/* Wait for parent's failed wait. */
296 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == 0);
297 
298 		wpid = waitpid(child, &status, 0);
299 		CHILD_REQUIRE(wpid == child);
300 		CHILD_REQUIRE(WIFEXITED(status));
301 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
302 
303 		_exit(0);
304 	}
305 	close(dpipe[1]);
306 
307 	/* Parent process. */
308 
309 	/* Wait for the debugger to attach to the child. */
310 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
311 
312 	/* Release the child. */
313 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
314 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
315 	close(cpipe[0]);
316 
317 	wait_for_zombie(child);
318 
319 	/*
320 	 * This wait should return a pid of 0 to indicate no status to
321 	 * report.  The parent should see the child as non-exited
322 	 * until the debugger sees the exit.
323 	 */
324 	wpid = waitpid(child, &status, WNOHANG);
325 	ATF_REQUIRE(wpid == 0);
326 
327 	/* Signal the debugger to wait for the child. */
328 	close(dpipe[0]);
329 
330 	/* Wait for the debugger. */
331 	wpid = waitpid(debugger, &status, 0);
332 	ATF_REQUIRE(wpid == debugger);
333 	ATF_REQUIRE(WIFEXITED(status));
334 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
335 
336 	/* The child process should now be ready. */
337 	wpid = waitpid(child, &status, WNOHANG);
338 	ATF_REQUIRE(wpid == child);
339 	ATF_REQUIRE(WIFEXITED(status));
340 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
341 }
342 
343 /*
344  * Verify that a parent process "sees" the exit of a debugged process
345  * only after a non-direct-child debugger has seen it.  In particular,
346  * various wait() calls in the parent must avoid failing with ESRCH by
347  * checking the parent's orphan list for the debugee.
348  */
349 ATF_TC_WITHOUT_HEAD(ptrace__parent_sees_exit_after_unrelated_debugger);
350 ATF_TC_BODY(ptrace__parent_sees_exit_after_unrelated_debugger, tc)
351 {
352 	pid_t child, debugger, fpid, wpid;
353 	int cpipe[2], dpipe[2], status;
354 	char c;
355 
356 	ATF_REQUIRE(pipe(cpipe) == 0);
357 	ATF_REQUIRE((child = fork()) != -1);
358 
359 	if (child == 0) {
360 		/* Child process. */
361 		close(cpipe[0]);
362 
363 		/* Wait for parent to be ready. */
364 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
365 
366 		_exit(1);
367 	}
368 	close(cpipe[1]);
369 
370 	ATF_REQUIRE(pipe(dpipe) == 0);
371 	ATF_REQUIRE((debugger = fork()) != -1);
372 
373 	if (debugger == 0) {
374 		/* Debugger parent. */
375 
376 		/*
377 		 * Fork again and drop the debugger parent so that the
378 		 * debugger is not a child of the main parent.
379 		 */
380 		CHILD_REQUIRE((fpid = fork()) != -1);
381 		if (fpid != 0)
382 			_exit(2);
383 
384 		/* Debugger process. */
385 		close(dpipe[0]);
386 
387 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
388 
389 		wpid = waitpid(child, &status, 0);
390 		CHILD_REQUIRE(wpid == child);
391 		CHILD_REQUIRE(WIFSTOPPED(status));
392 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
393 
394 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
395 
396 		/* Signal parent that debugger is attached. */
397 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
398 
399 		/* Wait for parent's failed wait. */
400 		CHILD_REQUIRE(read(dpipe[1], &c, sizeof(c)) == sizeof(c));
401 
402 		wpid = waitpid(child, &status, 0);
403 		CHILD_REQUIRE(wpid == child);
404 		CHILD_REQUIRE(WIFEXITED(status));
405 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
406 
407 		_exit(0);
408 	}
409 	close(dpipe[1]);
410 
411 	/* Parent process. */
412 
413 	/* Wait for the debugger parent process to exit. */
414 	wpid = waitpid(debugger, &status, 0);
415 	ATF_REQUIRE(wpid == debugger);
416 	ATF_REQUIRE(WIFEXITED(status));
417 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
418 
419 	/* A WNOHANG wait here should see the non-exited child. */
420 	wpid = waitpid(child, &status, WNOHANG);
421 	ATF_REQUIRE(wpid == 0);
422 
423 	/* Wait for the debugger to attach to the child. */
424 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
425 
426 	/* Release the child. */
427 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
428 	ATF_REQUIRE(read(cpipe[0], &c, sizeof(c)) == 0);
429 	close(cpipe[0]);
430 
431 	wait_for_zombie(child);
432 
433 	/*
434 	 * This wait should return a pid of 0 to indicate no status to
435 	 * report.  The parent should see the child as non-exited
436 	 * until the debugger sees the exit.
437 	 */
438 	wpid = waitpid(child, &status, WNOHANG);
439 	ATF_REQUIRE(wpid == 0);
440 
441 	/* Signal the debugger to wait for the child. */
442 	ATF_REQUIRE(write(dpipe[0], &c, sizeof(c)) == sizeof(c));
443 
444 	/* Wait for the debugger. */
445 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == 0);
446 	close(dpipe[0]);
447 
448 	/* The child process should now be ready. */
449 	wpid = waitpid(child, &status, WNOHANG);
450 	ATF_REQUIRE(wpid == child);
451 	ATF_REQUIRE(WIFEXITED(status));
452 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
453 }
454 
455 /*
456  * The parent process should always act the same regardless of how the
457  * debugger is attached to it.
458  */
459 static __dead2 void
460 follow_fork_parent(bool use_vfork)
461 {
462 	pid_t fpid, wpid;
463 	int status;
464 
465 	if (use_vfork)
466 		CHILD_REQUIRE((fpid = vfork()) != -1);
467 	else
468 		CHILD_REQUIRE((fpid = fork()) != -1);
469 
470 	if (fpid == 0)
471 		/* Child */
472 		_exit(2);
473 
474 	wpid = waitpid(fpid, &status, 0);
475 	CHILD_REQUIRE(wpid == fpid);
476 	CHILD_REQUIRE(WIFEXITED(status));
477 	CHILD_REQUIRE(WEXITSTATUS(status) == 2);
478 
479 	_exit(1);
480 }
481 
482 /*
483  * Helper routine for follow fork tests.  This waits for two stops
484  * that report both "sides" of a fork.  It returns the pid of the new
485  * child process.
486  */
487 static pid_t
488 handle_fork_events(pid_t parent, struct ptrace_lwpinfo *ppl)
489 {
490 	struct ptrace_lwpinfo pl;
491 	bool fork_reported[2];
492 	pid_t child, wpid;
493 	int i, status;
494 
495 	fork_reported[0] = false;
496 	fork_reported[1] = false;
497 	child = -1;
498 
499 	/*
500 	 * Each process should report a fork event.  The parent should
501 	 * report a PL_FLAG_FORKED event, and the child should report
502 	 * a PL_FLAG_CHILD event.
503 	 */
504 	for (i = 0; i < 2; i++) {
505 		wpid = wait(&status);
506 		ATF_REQUIRE(wpid > 0);
507 		ATF_REQUIRE(WIFSTOPPED(status));
508 
509 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
510 		    sizeof(pl)) != -1);
511 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
512 		    0);
513 		ATF_REQUIRE((pl.pl_flags & (PL_FLAG_FORKED | PL_FLAG_CHILD)) !=
514 		    (PL_FLAG_FORKED | PL_FLAG_CHILD));
515 		if (pl.pl_flags & PL_FLAG_CHILD) {
516 			ATF_REQUIRE(wpid != parent);
517 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
518 			ATF_REQUIRE(!fork_reported[1]);
519 			if (child == -1)
520 				child = wpid;
521 			else
522 				ATF_REQUIRE(child == wpid);
523 			if (ppl != NULL)
524 				ppl[1] = pl;
525 			fork_reported[1] = true;
526 		} else {
527 			ATF_REQUIRE(wpid == parent);
528 			ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
529 			ATF_REQUIRE(!fork_reported[0]);
530 			if (child == -1)
531 				child = pl.pl_child_pid;
532 			else
533 				ATF_REQUIRE(child == pl.pl_child_pid);
534 			if (ppl != NULL)
535 				ppl[0] = pl;
536 			fork_reported[0] = true;
537 		}
538 	}
539 
540 	return (child);
541 }
542 
543 /*
544  * Verify that a new child process is stopped after a followed fork and
545  * that the traced parent sees the exit of the child after the debugger
546  * when both processes remain attached to the debugger.
547  */
548 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached);
549 ATF_TC_BODY(ptrace__follow_fork_both_attached, tc)
550 {
551 	pid_t children[2], fpid, wpid;
552 	int status;
553 
554 	ATF_REQUIRE((fpid = fork()) != -1);
555 	if (fpid == 0) {
556 		trace_me();
557 		follow_fork_parent(false);
558 	}
559 
560 	/* Parent process. */
561 	children[0] = fpid;
562 
563 	/* The first wait() should report the stop from SIGSTOP. */
564 	wpid = waitpid(children[0], &status, 0);
565 	ATF_REQUIRE(wpid == children[0]);
566 	ATF_REQUIRE(WIFSTOPPED(status));
567 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
568 
569 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
570 
571 	/* Continue the child ignoring the SIGSTOP. */
572 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
573 
574 	children[1] = handle_fork_events(children[0], NULL);
575 	ATF_REQUIRE(children[1] > 0);
576 
577 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
578 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
579 
580 	/*
581 	 * The child can't exit until the grandchild reports status, so the
582 	 * grandchild should report its exit first to the debugger.
583 	 */
584 	wpid = wait(&status);
585 	ATF_REQUIRE(wpid == children[1]);
586 	ATF_REQUIRE(WIFEXITED(status));
587 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
588 
589 	wpid = wait(&status);
590 	ATF_REQUIRE(wpid == children[0]);
591 	ATF_REQUIRE(WIFEXITED(status));
592 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
593 
594 	wpid = wait(&status);
595 	ATF_REQUIRE(wpid == -1);
596 	ATF_REQUIRE(errno == ECHILD);
597 }
598 
599 /*
600  * Verify that a new child process is stopped after a followed fork
601  * and that the traced parent sees the exit of the child when the new
602  * child process is detached after it reports its fork.
603  */
604 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached);
605 ATF_TC_BODY(ptrace__follow_fork_child_detached, tc)
606 {
607 	pid_t children[2], fpid, wpid;
608 	int status;
609 
610 	ATF_REQUIRE((fpid = fork()) != -1);
611 	if (fpid == 0) {
612 		trace_me();
613 		follow_fork_parent(false);
614 	}
615 
616 	/* Parent process. */
617 	children[0] = fpid;
618 
619 	/* The first wait() should report the stop from SIGSTOP. */
620 	wpid = waitpid(children[0], &status, 0);
621 	ATF_REQUIRE(wpid == children[0]);
622 	ATF_REQUIRE(WIFSTOPPED(status));
623 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
624 
625 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
626 
627 	/* Continue the child ignoring the SIGSTOP. */
628 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
629 
630 	children[1] = handle_fork_events(children[0], NULL);
631 	ATF_REQUIRE(children[1] > 0);
632 
633 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
634 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
635 
636 	/*
637 	 * Should not see any status from the grandchild now, only the
638 	 * child.
639 	 */
640 	wpid = wait(&status);
641 	ATF_REQUIRE(wpid == children[0]);
642 	ATF_REQUIRE(WIFEXITED(status));
643 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
644 
645 	wpid = wait(&status);
646 	ATF_REQUIRE(wpid == -1);
647 	ATF_REQUIRE(errno == ECHILD);
648 }
649 
650 /*
651  * Verify that a new child process is stopped after a followed fork
652  * and that the traced parent sees the exit of the child when the
653  * traced parent is detached after the fork.
654  */
655 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached);
656 ATF_TC_BODY(ptrace__follow_fork_parent_detached, tc)
657 {
658 	pid_t children[2], fpid, wpid;
659 	int status;
660 
661 	ATF_REQUIRE((fpid = fork()) != -1);
662 	if (fpid == 0) {
663 		trace_me();
664 		follow_fork_parent(false);
665 	}
666 
667 	/* Parent process. */
668 	children[0] = fpid;
669 
670 	/* The first wait() should report the stop from SIGSTOP. */
671 	wpid = waitpid(children[0], &status, 0);
672 	ATF_REQUIRE(wpid == children[0]);
673 	ATF_REQUIRE(WIFSTOPPED(status));
674 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
675 
676 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
677 
678 	/* Continue the child ignoring the SIGSTOP. */
679 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
680 
681 	children[1] = handle_fork_events(children[0], NULL);
682 	ATF_REQUIRE(children[1] > 0);
683 
684 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
685 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
686 
687 	/*
688 	 * The child can't exit until the grandchild reports status, so the
689 	 * grandchild should report its exit first to the debugger.
690 	 *
691 	 * Even though the child process is detached, it is still a
692 	 * child of the debugger, so it will still report it's exit
693 	 * after the grandchild.
694 	 */
695 	wpid = wait(&status);
696 	ATF_REQUIRE(wpid == children[1]);
697 	ATF_REQUIRE(WIFEXITED(status));
698 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
699 
700 	wpid = wait(&status);
701 	ATF_REQUIRE(wpid == children[0]);
702 	ATF_REQUIRE(WIFEXITED(status));
703 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
704 
705 	wpid = wait(&status);
706 	ATF_REQUIRE(wpid == -1);
707 	ATF_REQUIRE(errno == ECHILD);
708 }
709 
710 static void
711 attach_fork_parent(int cpipe[2])
712 {
713 	pid_t fpid;
714 
715 	close(cpipe[0]);
716 
717 	/* Double-fork to disassociate from the debugger. */
718 	CHILD_REQUIRE((fpid = fork()) != -1);
719 	if (fpid != 0)
720 		_exit(3);
721 
722 	/* Send the pid of the disassociated child to the debugger. */
723 	fpid = getpid();
724 	CHILD_REQUIRE(write(cpipe[1], &fpid, sizeof(fpid)) == sizeof(fpid));
725 
726 	/* Wait for the debugger to attach. */
727 	CHILD_REQUIRE(read(cpipe[1], &fpid, sizeof(fpid)) == 0);
728 }
729 
730 /*
731  * Verify that a new child process is stopped after a followed fork and
732  * that the traced parent sees the exit of the child after the debugger
733  * when both processes remain attached to the debugger.  In this test
734  * the parent that forks is not a direct child of the debugger.
735  */
736 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_both_attached_unrelated_debugger);
737 ATF_TC_BODY(ptrace__follow_fork_both_attached_unrelated_debugger, tc)
738 {
739 	pid_t children[2], fpid, wpid;
740 	int cpipe[2], status;
741 
742 	ATF_REQUIRE(pipe(cpipe) == 0);
743 	ATF_REQUIRE((fpid = fork()) != -1);
744 	if (fpid == 0) {
745 		attach_fork_parent(cpipe);
746 		follow_fork_parent(false);
747 	}
748 
749 	/* Parent process. */
750 	close(cpipe[1]);
751 
752 	/* Wait for the direct child to exit. */
753 	wpid = waitpid(fpid, &status, 0);
754 	ATF_REQUIRE(wpid == fpid);
755 	ATF_REQUIRE(WIFEXITED(status));
756 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
757 
758 	/* Read the pid of the fork parent. */
759 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
760 	    sizeof(children[0]));
761 
762 	/* Attach to the fork parent. */
763 	attach_child(children[0]);
764 
765 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
766 
767 	/* Continue the fork parent ignoring the SIGSTOP. */
768 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
769 
770 	/* Signal the fork parent to continue. */
771 	close(cpipe[0]);
772 
773 	children[1] = handle_fork_events(children[0], NULL);
774 	ATF_REQUIRE(children[1] > 0);
775 
776 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
777 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
778 
779 	/*
780 	 * The fork parent can't exit until the child reports status,
781 	 * so the child should report its exit first to the debugger.
782 	 */
783 	wpid = wait(&status);
784 	ATF_REQUIRE(wpid == children[1]);
785 	ATF_REQUIRE(WIFEXITED(status));
786 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
787 
788 	wpid = wait(&status);
789 	ATF_REQUIRE(wpid == children[0]);
790 	ATF_REQUIRE(WIFEXITED(status));
791 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
792 
793 	wpid = wait(&status);
794 	ATF_REQUIRE(wpid == -1);
795 	ATF_REQUIRE(errno == ECHILD);
796 }
797 
798 /*
799  * Verify that a new child process is stopped after a followed fork
800  * and that the traced parent sees the exit of the child when the new
801  * child process is detached after it reports its fork.  In this test
802  * the parent that forks is not a direct child of the debugger.
803  */
804 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_child_detached_unrelated_debugger);
805 ATF_TC_BODY(ptrace__follow_fork_child_detached_unrelated_debugger, tc)
806 {
807 	pid_t children[2], fpid, wpid;
808 	int cpipe[2], status;
809 
810 	ATF_REQUIRE(pipe(cpipe) == 0);
811 	ATF_REQUIRE((fpid = fork()) != -1);
812 	if (fpid == 0) {
813 		attach_fork_parent(cpipe);
814 		follow_fork_parent(false);
815 	}
816 
817 	/* Parent process. */
818 	close(cpipe[1]);
819 
820 	/* Wait for the direct child to exit. */
821 	wpid = waitpid(fpid, &status, 0);
822 	ATF_REQUIRE(wpid == fpid);
823 	ATF_REQUIRE(WIFEXITED(status));
824 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
825 
826 	/* Read the pid of the fork parent. */
827 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
828 	    sizeof(children[0]));
829 
830 	/* Attach to the fork parent. */
831 	attach_child(children[0]);
832 
833 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
834 
835 	/* Continue the fork parent ignoring the SIGSTOP. */
836 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
837 
838 	/* Signal the fork parent to continue. */
839 	close(cpipe[0]);
840 
841 	children[1] = handle_fork_events(children[0], NULL);
842 	ATF_REQUIRE(children[1] > 0);
843 
844 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
845 	ATF_REQUIRE(ptrace(PT_DETACH, children[1], (caddr_t)1, 0) != -1);
846 
847 	/*
848 	 * Should not see any status from the child now, only the fork
849 	 * parent.
850 	 */
851 	wpid = wait(&status);
852 	ATF_REQUIRE(wpid == children[0]);
853 	ATF_REQUIRE(WIFEXITED(status));
854 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
855 
856 	wpid = wait(&status);
857 	ATF_REQUIRE(wpid == -1);
858 	ATF_REQUIRE(errno == ECHILD);
859 }
860 
861 /*
862  * Verify that a new child process is stopped after a followed fork
863  * and that the traced parent sees the exit of the child when the
864  * traced parent is detached after the fork.  In this test the parent
865  * that forks is not a direct child of the debugger.
866  */
867 ATF_TC_WITHOUT_HEAD(ptrace__follow_fork_parent_detached_unrelated_debugger);
868 ATF_TC_BODY(ptrace__follow_fork_parent_detached_unrelated_debugger, tc)
869 {
870 	pid_t children[2], fpid, wpid;
871 	int cpipe[2], status;
872 
873 	ATF_REQUIRE(pipe(cpipe) == 0);
874 	ATF_REQUIRE((fpid = fork()) != -1);
875 	if (fpid == 0) {
876 		attach_fork_parent(cpipe);
877 		follow_fork_parent(false);
878 	}
879 
880 	/* Parent process. */
881 	close(cpipe[1]);
882 
883 	/* Wait for the direct child to exit. */
884 	wpid = waitpid(fpid, &status, 0);
885 	ATF_REQUIRE(wpid == fpid);
886 	ATF_REQUIRE(WIFEXITED(status));
887 	ATF_REQUIRE(WEXITSTATUS(status) == 3);
888 
889 	/* Read the pid of the fork parent. */
890 	ATF_REQUIRE(read(cpipe[0], &children[0], sizeof(children[0])) ==
891 	    sizeof(children[0]));
892 
893 	/* Attach to the fork parent. */
894 	attach_child(children[0]);
895 
896 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
897 
898 	/* Continue the fork parent ignoring the SIGSTOP. */
899 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
900 
901 	/* Signal the fork parent to continue. */
902 	close(cpipe[0]);
903 
904 	children[1] = handle_fork_events(children[0], NULL);
905 	ATF_REQUIRE(children[1] > 0);
906 
907 	ATF_REQUIRE(ptrace(PT_DETACH, children[0], (caddr_t)1, 0) != -1);
908 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
909 
910 	/*
911 	 * Should not see any status from the fork parent now, only
912 	 * the child.
913 	 */
914 	wpid = wait(&status);
915 	ATF_REQUIRE(wpid == children[1]);
916 	ATF_REQUIRE(WIFEXITED(status));
917 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
918 
919 	wpid = wait(&status);
920 	ATF_REQUIRE(wpid == -1);
921 	ATF_REQUIRE(errno == ECHILD);
922 }
923 
924 /*
925  * Verify that a child process does not see an unrelated debugger as its
926  * parent but sees its original parent process.
927  */
928 ATF_TC_WITHOUT_HEAD(ptrace__getppid);
929 ATF_TC_BODY(ptrace__getppid, tc)
930 {
931 	pid_t child, debugger, ppid, wpid;
932 	int cpipe[2], dpipe[2], status;
933 	char c;
934 
935 	ATF_REQUIRE(pipe(cpipe) == 0);
936 	ATF_REQUIRE((child = fork()) != -1);
937 
938 	if (child == 0) {
939 		/* Child process. */
940 		close(cpipe[0]);
941 
942 		/* Wait for parent to be ready. */
943 		CHILD_REQUIRE(read(cpipe[1], &c, sizeof(c)) == sizeof(c));
944 
945 		/* Report the parent PID to the parent. */
946 		ppid = getppid();
947 		CHILD_REQUIRE(write(cpipe[1], &ppid, sizeof(ppid)) ==
948 		    sizeof(ppid));
949 
950 		_exit(1);
951 	}
952 	close(cpipe[1]);
953 
954 	ATF_REQUIRE(pipe(dpipe) == 0);
955 	ATF_REQUIRE((debugger = fork()) != -1);
956 
957 	if (debugger == 0) {
958 		/* Debugger process. */
959 		close(dpipe[0]);
960 
961 		CHILD_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) != -1);
962 
963 		wpid = waitpid(child, &status, 0);
964 		CHILD_REQUIRE(wpid == child);
965 		CHILD_REQUIRE(WIFSTOPPED(status));
966 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
967 
968 		CHILD_REQUIRE(ptrace(PT_CONTINUE, child, (caddr_t)1, 0) != -1);
969 
970 		/* Signal parent that debugger is attached. */
971 		CHILD_REQUIRE(write(dpipe[1], &c, sizeof(c)) == sizeof(c));
972 
973 		/* Wait for traced child to exit. */
974 		wpid = waitpid(child, &status, 0);
975 		CHILD_REQUIRE(wpid == child);
976 		CHILD_REQUIRE(WIFEXITED(status));
977 		CHILD_REQUIRE(WEXITSTATUS(status) == 1);
978 
979 		_exit(0);
980 	}
981 	close(dpipe[1]);
982 
983 	/* Parent process. */
984 
985 	/* Wait for the debugger to attach to the child. */
986 	ATF_REQUIRE(read(dpipe[0], &c, sizeof(c)) == sizeof(c));
987 
988 	/* Release the child. */
989 	ATF_REQUIRE(write(cpipe[0], &c, sizeof(c)) == sizeof(c));
990 
991 	/* Read the parent PID from the child. */
992 	ATF_REQUIRE(read(cpipe[0], &ppid, sizeof(ppid)) == sizeof(ppid));
993 	close(cpipe[0]);
994 
995 	ATF_REQUIRE(ppid == getpid());
996 
997 	/* Wait for the debugger. */
998 	wpid = waitpid(debugger, &status, 0);
999 	ATF_REQUIRE(wpid == debugger);
1000 	ATF_REQUIRE(WIFEXITED(status));
1001 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1002 
1003 	/* The child process should now be ready. */
1004 	wpid = waitpid(child, &status, WNOHANG);
1005 	ATF_REQUIRE(wpid == child);
1006 	ATF_REQUIRE(WIFEXITED(status));
1007 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1008 }
1009 
1010 /*
1011  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1012  * child process created via fork() reports the correct value.
1013  */
1014 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_fork);
1015 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_fork, tc)
1016 {
1017 	struct ptrace_lwpinfo pl[2];
1018 	pid_t children[2], fpid, wpid;
1019 	int status;
1020 
1021 	ATF_REQUIRE((fpid = fork()) != -1);
1022 	if (fpid == 0) {
1023 		trace_me();
1024 		follow_fork_parent(false);
1025 	}
1026 
1027 	/* Parent process. */
1028 	children[0] = fpid;
1029 
1030 	/* The first wait() should report the stop from SIGSTOP. */
1031 	wpid = waitpid(children[0], &status, 0);
1032 	ATF_REQUIRE(wpid == children[0]);
1033 	ATF_REQUIRE(WIFSTOPPED(status));
1034 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1035 
1036 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1037 
1038 	/* Continue the child ignoring the SIGSTOP. */
1039 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1040 
1041 	/* Wait for both halves of the fork event to get reported. */
1042 	children[1] = handle_fork_events(children[0], pl);
1043 	ATF_REQUIRE(children[1] > 0);
1044 
1045 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1046 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1047 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_fork);
1048 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1049 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1050 
1051 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1052 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1053 
1054 	/*
1055 	 * The child can't exit until the grandchild reports status, so the
1056 	 * grandchild should report its exit first to the debugger.
1057 	 */
1058 	wpid = wait(&status);
1059 	ATF_REQUIRE(wpid == children[1]);
1060 	ATF_REQUIRE(WIFEXITED(status));
1061 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1062 
1063 	wpid = wait(&status);
1064 	ATF_REQUIRE(wpid == children[0]);
1065 	ATF_REQUIRE(WIFEXITED(status));
1066 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1067 
1068 	wpid = wait(&status);
1069 	ATF_REQUIRE(wpid == -1);
1070 	ATF_REQUIRE(errno == ECHILD);
1071 }
1072 
1073 /*
1074  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1075  * child process created via vfork() reports the correct value.
1076  */
1077 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_vfork);
1078 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_vfork, tc)
1079 {
1080 	struct ptrace_lwpinfo pl[2];
1081 	pid_t children[2], fpid, wpid;
1082 	int status;
1083 
1084 	ATF_REQUIRE((fpid = fork()) != -1);
1085 	if (fpid == 0) {
1086 		trace_me();
1087 		follow_fork_parent(true);
1088 	}
1089 
1090 	/* Parent process. */
1091 	children[0] = fpid;
1092 
1093 	/* The first wait() should report the stop from SIGSTOP. */
1094 	wpid = waitpid(children[0], &status, 0);
1095 	ATF_REQUIRE(wpid == children[0]);
1096 	ATF_REQUIRE(WIFSTOPPED(status));
1097 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1098 
1099 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, children[0], NULL, 1) != -1);
1100 
1101 	/* Continue the child ignoring the SIGSTOP. */
1102 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1103 
1104 	/* Wait for both halves of the fork event to get reported. */
1105 	children[1] = handle_fork_events(children[0], pl);
1106 	ATF_REQUIRE(children[1] > 0);
1107 
1108 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_SCX) != 0);
1109 	ATF_REQUIRE((pl[1].pl_flags & PL_FLAG_SCX) != 0);
1110 	ATF_REQUIRE(pl[0].pl_syscall_code == SYS_vfork);
1111 	ATF_REQUIRE(pl[0].pl_syscall_code == pl[1].pl_syscall_code);
1112 	ATF_REQUIRE(pl[0].pl_syscall_narg == pl[1].pl_syscall_narg);
1113 
1114 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1115 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1116 
1117 	/*
1118 	 * The child can't exit until the grandchild reports status, so the
1119 	 * grandchild should report its exit first to the debugger.
1120 	 */
1121 	wpid = wait(&status);
1122 	ATF_REQUIRE(wpid == children[1]);
1123 	ATF_REQUIRE(WIFEXITED(status));
1124 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1125 
1126 	wpid = wait(&status);
1127 	ATF_REQUIRE(wpid == children[0]);
1128 	ATF_REQUIRE(WIFEXITED(status));
1129 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1130 
1131 	wpid = wait(&status);
1132 	ATF_REQUIRE(wpid == -1);
1133 	ATF_REQUIRE(errno == ECHILD);
1134 }
1135 
1136 static void *
1137 simple_thread(void *arg __unused)
1138 {
1139 
1140 	pthread_exit(NULL);
1141 }
1142 
1143 static __dead2 void
1144 simple_thread_main(void)
1145 {
1146 	pthread_t thread;
1147 
1148 	CHILD_REQUIRE(pthread_create(&thread, NULL, simple_thread, NULL) == 0);
1149 	CHILD_REQUIRE(pthread_join(thread, NULL) == 0);
1150 	exit(1);
1151 }
1152 
1153 /*
1154  * Verify that pl_syscall_code in struct ptrace_lwpinfo for a new
1155  * thread reports the correct value.
1156  */
1157 ATF_TC_WITHOUT_HEAD(ptrace__new_child_pl_syscall_code_thread);
1158 ATF_TC_BODY(ptrace__new_child_pl_syscall_code_thread, tc)
1159 {
1160 	struct ptrace_lwpinfo pl;
1161 	pid_t fpid, wpid;
1162 	lwpid_t mainlwp;
1163 	int status;
1164 
1165 	ATF_REQUIRE((fpid = fork()) != -1);
1166 	if (fpid == 0) {
1167 		trace_me();
1168 		simple_thread_main();
1169 	}
1170 
1171 	/* The first wait() should report the stop from SIGSTOP. */
1172 	wpid = waitpid(fpid, &status, 0);
1173 	ATF_REQUIRE(wpid == fpid);
1174 	ATF_REQUIRE(WIFSTOPPED(status));
1175 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1176 
1177 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1178 	    sizeof(pl)) != -1);
1179 	mainlwp = pl.pl_lwpid;
1180 
1181 	/*
1182 	 * Continue the child ignoring the SIGSTOP and tracing all
1183 	 * system call exits.
1184 	 */
1185 	ATF_REQUIRE(ptrace(PT_TO_SCX, fpid, (caddr_t)1, 0) != -1);
1186 
1187 	/*
1188 	 * Wait for the new thread to arrive.  pthread_create() might
1189 	 * invoke any number of system calls.  For now we just wait
1190 	 * for the new thread to arrive and make sure it reports a
1191 	 * valid system call code.  If ptrace grows thread event
1192 	 * reporting then this test can be made more precise.
1193 	 */
1194 	for (;;) {
1195 		wpid = waitpid(fpid, &status, 0);
1196 		ATF_REQUIRE(wpid == fpid);
1197 		ATF_REQUIRE(WIFSTOPPED(status));
1198 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1199 
1200 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1201 		    sizeof(pl)) != -1);
1202 		ATF_REQUIRE((pl.pl_flags & PL_FLAG_SCX) != 0);
1203 		ATF_REQUIRE(pl.pl_syscall_code != 0);
1204 		if (pl.pl_lwpid != mainlwp)
1205 			/* New thread seen. */
1206 			break;
1207 
1208 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1209 	}
1210 
1211 	/* Wait for the child to exit. */
1212 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1213 	for (;;) {
1214 		wpid = waitpid(fpid, &status, 0);
1215 		ATF_REQUIRE(wpid == fpid);
1216 		if (WIFEXITED(status))
1217 			break;
1218 
1219 		ATF_REQUIRE(WIFSTOPPED(status));
1220 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1221 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1222 	}
1223 
1224 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1225 
1226 	wpid = wait(&status);
1227 	ATF_REQUIRE(wpid == -1);
1228 	ATF_REQUIRE(errno == ECHILD);
1229 }
1230 
1231 /*
1232  * Verify that the expected LWP events are reported for a child thread.
1233  */
1234 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events);
1235 ATF_TC_BODY(ptrace__lwp_events, tc)
1236 {
1237 	struct ptrace_lwpinfo pl;
1238 	pid_t fpid, wpid;
1239 	lwpid_t lwps[2];
1240 	int status;
1241 
1242 	ATF_REQUIRE((fpid = fork()) != -1);
1243 	if (fpid == 0) {
1244 		trace_me();
1245 		simple_thread_main();
1246 	}
1247 
1248 	/* The first wait() should report the stop from SIGSTOP. */
1249 	wpid = waitpid(fpid, &status, 0);
1250 	ATF_REQUIRE(wpid == fpid);
1251 	ATF_REQUIRE(WIFSTOPPED(status));
1252 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1253 
1254 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1255 	    sizeof(pl)) != -1);
1256 	lwps[0] = pl.pl_lwpid;
1257 
1258 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1259 
1260 	/* Continue the child ignoring the SIGSTOP. */
1261 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1262 
1263 	/* The first event should be for the child thread's birth. */
1264 	wpid = waitpid(fpid, &status, 0);
1265 	ATF_REQUIRE(wpid == fpid);
1266 	ATF_REQUIRE(WIFSTOPPED(status));
1267 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1268 
1269 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1270 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1271 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1272 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1273 	lwps[1] = pl.pl_lwpid;
1274 
1275 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1276 
1277 	/* The next event should be for the child thread's death. */
1278 	wpid = waitpid(fpid, &status, 0);
1279 	ATF_REQUIRE(wpid == fpid);
1280 	ATF_REQUIRE(WIFSTOPPED(status));
1281 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1282 
1283 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1284 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1285 	    (PL_FLAG_EXITED | PL_FLAG_SCE));
1286 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1287 
1288 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1289 
1290 	/* The last event should be for the child process's exit. */
1291 	wpid = waitpid(fpid, &status, 0);
1292 	ATF_REQUIRE(WIFEXITED(status));
1293 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1294 
1295 	wpid = wait(&status);
1296 	ATF_REQUIRE(wpid == -1);
1297 	ATF_REQUIRE(errno == ECHILD);
1298 }
1299 
1300 static void *
1301 exec_thread(void *arg __unused)
1302 {
1303 
1304 	execl("/usr/bin/true", "true", NULL);
1305 	exit(127);
1306 }
1307 
1308 static __dead2 void
1309 exec_thread_main(void)
1310 {
1311 	pthread_t thread;
1312 
1313 	CHILD_REQUIRE(pthread_create(&thread, NULL, exec_thread, NULL) == 0);
1314 	for (;;)
1315 		sleep(60);
1316 	exit(1);
1317 }
1318 
1319 /*
1320  * Verify that the expected LWP events are reported for a multithreaded
1321  * process that calls execve(2).
1322  */
1323 ATF_TC_WITHOUT_HEAD(ptrace__lwp_events_exec);
1324 ATF_TC_BODY(ptrace__lwp_events_exec, tc)
1325 {
1326 	struct ptrace_lwpinfo pl;
1327 	pid_t fpid, wpid;
1328 	lwpid_t lwps[2];
1329 	int status;
1330 
1331 	ATF_REQUIRE((fpid = fork()) != -1);
1332 	if (fpid == 0) {
1333 		trace_me();
1334 		exec_thread_main();
1335 	}
1336 
1337 	/* The first wait() should report the stop from SIGSTOP. */
1338 	wpid = waitpid(fpid, &status, 0);
1339 	ATF_REQUIRE(wpid == fpid);
1340 	ATF_REQUIRE(WIFSTOPPED(status));
1341 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1342 
1343 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1344 	    sizeof(pl)) != -1);
1345 	lwps[0] = pl.pl_lwpid;
1346 
1347 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1348 
1349 	/* Continue the child ignoring the SIGSTOP. */
1350 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1351 
1352 	/* The first event should be for the child thread's birth. */
1353 	wpid = waitpid(fpid, &status, 0);
1354 	ATF_REQUIRE(wpid == fpid);
1355 	ATF_REQUIRE(WIFSTOPPED(status));
1356 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1357 
1358 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1359 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1360 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1361 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
1362 	lwps[1] = pl.pl_lwpid;
1363 
1364 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1365 
1366 	/*
1367 	 * The next event should be for the main thread's death due to
1368 	 * single threading from execve().
1369 	 */
1370 	wpid = waitpid(fpid, &status, 0);
1371 	ATF_REQUIRE(wpid == fpid);
1372 	ATF_REQUIRE(WIFSTOPPED(status));
1373 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1374 
1375 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1376 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXITED | PL_FLAG_SCE)) ==
1377 	    (PL_FLAG_EXITED));
1378 	ATF_REQUIRE(pl.pl_lwpid == lwps[0]);
1379 
1380 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1381 
1382 	/* The next event should be for the child process's exec. */
1383 	wpid = waitpid(fpid, &status, 0);
1384 	ATF_REQUIRE(WIFSTOPPED(status));
1385 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1386 
1387 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1388 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1389 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1390 	ATF_REQUIRE(pl.pl_lwpid == lwps[1]);
1391 
1392 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1393 
1394 	/* The last event should be for the child process's exit. */
1395 	wpid = waitpid(fpid, &status, 0);
1396 	ATF_REQUIRE(WIFEXITED(status));
1397 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1398 
1399 	wpid = wait(&status);
1400 	ATF_REQUIRE(wpid == -1);
1401 	ATF_REQUIRE(errno == ECHILD);
1402 }
1403 
1404 static void
1405 handler(int sig __unused)
1406 {
1407 }
1408 
1409 static void
1410 signal_main(void)
1411 {
1412 
1413 	signal(SIGINFO, handler);
1414 	raise(SIGINFO);
1415 	exit(0);
1416 }
1417 
1418 /*
1419  * Verify that the expected ptrace event is reported for a signal.
1420  */
1421 ATF_TC_WITHOUT_HEAD(ptrace__siginfo);
1422 ATF_TC_BODY(ptrace__siginfo, tc)
1423 {
1424 	struct ptrace_lwpinfo pl;
1425 	pid_t fpid, wpid;
1426 	int status;
1427 
1428 	ATF_REQUIRE((fpid = fork()) != -1);
1429 	if (fpid == 0) {
1430 		trace_me();
1431 		signal_main();
1432 	}
1433 
1434 	/* The first wait() should report the stop from SIGSTOP. */
1435 	wpid = waitpid(fpid, &status, 0);
1436 	ATF_REQUIRE(wpid == fpid);
1437 	ATF_REQUIRE(WIFSTOPPED(status));
1438 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1439 
1440 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1441 
1442 	/* The next event should be for the SIGINFO. */
1443 	wpid = waitpid(fpid, &status, 0);
1444 	ATF_REQUIRE(WIFSTOPPED(status));
1445 	ATF_REQUIRE(WSTOPSIG(status) == SIGINFO);
1446 
1447 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1448 	ATF_REQUIRE(pl.pl_event == PL_EVENT_SIGNAL);
1449 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
1450 	ATF_REQUIRE(pl.pl_siginfo.si_code == SI_LWP);
1451 	ATF_REQUIRE(pl.pl_siginfo.si_pid == wpid);
1452 
1453 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1454 
1455 	/* The last event should be for the child process's exit. */
1456 	wpid = waitpid(fpid, &status, 0);
1457 	ATF_REQUIRE(WIFEXITED(status));
1458 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1459 
1460 	wpid = wait(&status);
1461 	ATF_REQUIRE(wpid == -1);
1462 	ATF_REQUIRE(errno == ECHILD);
1463 }
1464 
1465 /*
1466  * Verify that the expected ptrace events are reported for PTRACE_EXEC.
1467  */
1468 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_disable);
1469 ATF_TC_BODY(ptrace__ptrace_exec_disable, tc)
1470 {
1471 	pid_t fpid, wpid;
1472 	int events, status;
1473 
1474 	ATF_REQUIRE((fpid = fork()) != -1);
1475 	if (fpid == 0) {
1476 		trace_me();
1477 		exec_thread(NULL);
1478 	}
1479 
1480 	/* The first wait() should report the stop from SIGSTOP. */
1481 	wpid = waitpid(fpid, &status, 0);
1482 	ATF_REQUIRE(wpid == fpid);
1483 	ATF_REQUIRE(WIFSTOPPED(status));
1484 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1485 
1486 	events = 0;
1487 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1488 	    sizeof(events)) == 0);
1489 
1490 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1491 
1492 	/* Should get one event at exit. */
1493 	wpid = waitpid(fpid, &status, 0);
1494 	ATF_REQUIRE(WIFEXITED(status));
1495 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1496 
1497 	wpid = wait(&status);
1498 	ATF_REQUIRE(wpid == -1);
1499 	ATF_REQUIRE(errno == ECHILD);
1500 }
1501 
1502 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_exec_enable);
1503 ATF_TC_BODY(ptrace__ptrace_exec_enable, tc)
1504 {
1505 	struct ptrace_lwpinfo pl;
1506 	pid_t fpid, wpid;
1507 	int events, status;
1508 
1509 	ATF_REQUIRE((fpid = fork()) != -1);
1510 	if (fpid == 0) {
1511 		trace_me();
1512 		exec_thread(NULL);
1513 	}
1514 
1515 	/* The first wait() should report the stop from SIGSTOP. */
1516 	wpid = waitpid(fpid, &status, 0);
1517 	ATF_REQUIRE(wpid == fpid);
1518 	ATF_REQUIRE(WIFSTOPPED(status));
1519 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1520 
1521 	events = PTRACE_EXEC;
1522 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1523 	    sizeof(events)) == 0);
1524 
1525 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1526 
1527 	/* The next event should be for the child process's exec. */
1528 	wpid = waitpid(fpid, &status, 0);
1529 	ATF_REQUIRE(WIFSTOPPED(status));
1530 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1531 
1532 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1533 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_EXEC | PL_FLAG_SCX)) ==
1534 	    (PL_FLAG_EXEC | PL_FLAG_SCX));
1535 
1536 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1537 
1538 	/* The last event should be for the child process's exit. */
1539 	wpid = waitpid(fpid, &status, 0);
1540 	ATF_REQUIRE(WIFEXITED(status));
1541 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1542 
1543 	wpid = wait(&status);
1544 	ATF_REQUIRE(wpid == -1);
1545 	ATF_REQUIRE(errno == ECHILD);
1546 }
1547 
1548 ATF_TC_WITHOUT_HEAD(ptrace__event_mask);
1549 ATF_TC_BODY(ptrace__event_mask, tc)
1550 {
1551 	pid_t fpid, wpid;
1552 	int events, status;
1553 
1554 	ATF_REQUIRE((fpid = fork()) != -1);
1555 	if (fpid == 0) {
1556 		trace_me();
1557 		exit(0);
1558 	}
1559 
1560 	/* The first wait() should report the stop from SIGSTOP. */
1561 	wpid = waitpid(fpid, &status, 0);
1562 	ATF_REQUIRE(wpid == fpid);
1563 	ATF_REQUIRE(WIFSTOPPED(status));
1564 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1565 
1566 	/* PT_FOLLOW_FORK should toggle the state of PTRACE_FORK. */
1567 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 1) != -1);
1568 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1569 	    sizeof(events)) == 0);
1570 	ATF_REQUIRE(events & PTRACE_FORK);
1571 	ATF_REQUIRE(ptrace(PT_FOLLOW_FORK, fpid, NULL, 0) != -1);
1572 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1573 	    sizeof(events)) == 0);
1574 	ATF_REQUIRE(!(events & PTRACE_FORK));
1575 
1576 	/* PT_LWP_EVENTS should toggle the state of PTRACE_LWP. */
1577 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 1) != -1);
1578 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1579 	    sizeof(events)) == 0);
1580 	ATF_REQUIRE(events & PTRACE_LWP);
1581 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, fpid, NULL, 0) != -1);
1582 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1583 	    sizeof(events)) == 0);
1584 	ATF_REQUIRE(!(events & PTRACE_LWP));
1585 
1586 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1587 
1588 	/* Should get one event at exit. */
1589 	wpid = waitpid(fpid, &status, 0);
1590 	ATF_REQUIRE(WIFEXITED(status));
1591 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
1592 
1593 	wpid = wait(&status);
1594 	ATF_REQUIRE(wpid == -1);
1595 	ATF_REQUIRE(errno == ECHILD);
1596 }
1597 
1598 /*
1599  * Verify that the expected ptrace events are reported for PTRACE_VFORK.
1600  */
1601 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork);
1602 ATF_TC_BODY(ptrace__ptrace_vfork, tc)
1603 {
1604 	struct ptrace_lwpinfo pl;
1605 	pid_t fpid, wpid;
1606 	int events, status;
1607 
1608 	ATF_REQUIRE((fpid = fork()) != -1);
1609 	if (fpid == 0) {
1610 		trace_me();
1611 		follow_fork_parent(true);
1612 	}
1613 
1614 	/* The first wait() should report the stop from SIGSTOP. */
1615 	wpid = waitpid(fpid, &status, 0);
1616 	ATF_REQUIRE(wpid == fpid);
1617 	ATF_REQUIRE(WIFSTOPPED(status));
1618 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1619 
1620 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
1621 	    sizeof(events)) == 0);
1622 	events |= PTRACE_VFORK;
1623 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
1624 	    sizeof(events)) == 0);
1625 
1626 	/* Continue the child ignoring the SIGSTOP. */
1627 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1628 
1629 	/* The next event should report the end of the vfork. */
1630 	wpid = wait(&status);
1631 	ATF_REQUIRE(wpid == fpid);
1632 	ATF_REQUIRE(WIFSTOPPED(status));
1633 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1634 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1635 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_VFORK_DONE) != 0);
1636 
1637 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) != -1);
1638 
1639 	wpid = wait(&status);
1640 	ATF_REQUIRE(wpid == fpid);
1641 	ATF_REQUIRE(WIFEXITED(status));
1642 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1643 
1644 	wpid = wait(&status);
1645 	ATF_REQUIRE(wpid == -1);
1646 	ATF_REQUIRE(errno == ECHILD);
1647 }
1648 
1649 ATF_TC_WITHOUT_HEAD(ptrace__ptrace_vfork_follow);
1650 ATF_TC_BODY(ptrace__ptrace_vfork_follow, tc)
1651 {
1652 	struct ptrace_lwpinfo pl[2];
1653 	pid_t children[2], fpid, wpid;
1654 	int events, status;
1655 
1656 	ATF_REQUIRE((fpid = fork()) != -1);
1657 	if (fpid == 0) {
1658 		trace_me();
1659 		follow_fork_parent(true);
1660 	}
1661 
1662 	/* Parent process. */
1663 	children[0] = fpid;
1664 
1665 	/* The first wait() should report the stop from SIGSTOP. */
1666 	wpid = waitpid(children[0], &status, 0);
1667 	ATF_REQUIRE(wpid == children[0]);
1668 	ATF_REQUIRE(WIFSTOPPED(status));
1669 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1670 
1671 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, children[0], (caddr_t)&events,
1672 	    sizeof(events)) == 0);
1673 	events |= PTRACE_FORK | PTRACE_VFORK;
1674 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, children[0], (caddr_t)&events,
1675 	    sizeof(events)) == 0);
1676 
1677 	/* Continue the child ignoring the SIGSTOP. */
1678 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1679 
1680 	/* Wait for both halves of the fork event to get reported. */
1681 	children[1] = handle_fork_events(children[0], pl);
1682 	ATF_REQUIRE(children[1] > 0);
1683 
1684 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORKED) != 0);
1685 
1686 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1687 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[1], (caddr_t)1, 0) != -1);
1688 
1689 	/*
1690 	 * The child can't exit until the grandchild reports status, so the
1691 	 * grandchild should report its exit first to the debugger.
1692 	 */
1693 	wpid = waitpid(children[1], &status, 0);
1694 	ATF_REQUIRE(wpid == children[1]);
1695 	ATF_REQUIRE(WIFEXITED(status));
1696 	ATF_REQUIRE(WEXITSTATUS(status) == 2);
1697 
1698 	/*
1699 	 * The child should report it's vfork() completion before it
1700 	 * exits.
1701 	 */
1702 	wpid = wait(&status);
1703 	ATF_REQUIRE(wpid == children[0]);
1704 	ATF_REQUIRE(WIFSTOPPED(status));
1705 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1706 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl[0], sizeof(pl[0])) !=
1707 	    -1);
1708 	ATF_REQUIRE((pl[0].pl_flags & PL_FLAG_VFORK_DONE) != 0);
1709 
1710 	ATF_REQUIRE(ptrace(PT_CONTINUE, children[0], (caddr_t)1, 0) != -1);
1711 
1712 	wpid = wait(&status);
1713 	ATF_REQUIRE(wpid == children[0]);
1714 	ATF_REQUIRE(WIFEXITED(status));
1715 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
1716 
1717 	wpid = wait(&status);
1718 	ATF_REQUIRE(wpid == -1);
1719 	ATF_REQUIRE(errno == ECHILD);
1720 }
1721 
1722 #ifdef HAVE_BREAKPOINT
1723 /*
1724  * Verify that no more events are reported after PT_KILL except for the
1725  * process exit when stopped due to a breakpoint trap.
1726  */
1727 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_breakpoint);
1728 ATF_TC_BODY(ptrace__PT_KILL_breakpoint, tc)
1729 {
1730 	pid_t fpid, wpid;
1731 	int status;
1732 
1733 	ATF_REQUIRE((fpid = fork()) != -1);
1734 	if (fpid == 0) {
1735 		trace_me();
1736 		breakpoint();
1737 		exit(1);
1738 	}
1739 
1740 	/* The first wait() should report the stop from SIGSTOP. */
1741 	wpid = waitpid(fpid, &status, 0);
1742 	ATF_REQUIRE(wpid == fpid);
1743 	ATF_REQUIRE(WIFSTOPPED(status));
1744 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1745 
1746 	/* Continue the child ignoring the SIGSTOP. */
1747 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1748 
1749 	/* The second wait() should report hitting the breakpoint. */
1750 	wpid = waitpid(fpid, &status, 0);
1751 	ATF_REQUIRE(wpid == fpid);
1752 	ATF_REQUIRE(WIFSTOPPED(status));
1753 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1754 
1755 	/* Kill the child process. */
1756 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1757 
1758 	/* The last wait() should report the SIGKILL. */
1759 	wpid = waitpid(fpid, &status, 0);
1760 	ATF_REQUIRE(wpid == fpid);
1761 	ATF_REQUIRE(WIFSIGNALED(status));
1762 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1763 
1764 	wpid = wait(&status);
1765 	ATF_REQUIRE(wpid == -1);
1766 	ATF_REQUIRE(errno == ECHILD);
1767 }
1768 #endif /* HAVE_BREAKPOINT */
1769 
1770 /*
1771  * Verify that no more events are reported after PT_KILL except for the
1772  * process exit when stopped inside of a system call.
1773  */
1774 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_system_call);
1775 ATF_TC_BODY(ptrace__PT_KILL_system_call, tc)
1776 {
1777 	struct ptrace_lwpinfo pl;
1778 	pid_t fpid, wpid;
1779 	int status;
1780 
1781 	ATF_REQUIRE((fpid = fork()) != -1);
1782 	if (fpid == 0) {
1783 		trace_me();
1784 		getpid();
1785 		exit(1);
1786 	}
1787 
1788 	/* The first wait() should report the stop from SIGSTOP. */
1789 	wpid = waitpid(fpid, &status, 0);
1790 	ATF_REQUIRE(wpid == fpid);
1791 	ATF_REQUIRE(WIFSTOPPED(status));
1792 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1793 
1794 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
1795 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
1796 
1797 	/* The second wait() should report a system call entry for getpid(). */
1798 	wpid = waitpid(fpid, &status, 0);
1799 	ATF_REQUIRE(wpid == fpid);
1800 	ATF_REQUIRE(WIFSTOPPED(status));
1801 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1802 
1803 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1804 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
1805 
1806 	/* Kill the child process. */
1807 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1808 
1809 	/* The last wait() should report the SIGKILL. */
1810 	wpid = waitpid(fpid, &status, 0);
1811 	ATF_REQUIRE(wpid == fpid);
1812 	ATF_REQUIRE(WIFSIGNALED(status));
1813 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1814 
1815 	wpid = wait(&status);
1816 	ATF_REQUIRE(wpid == -1);
1817 	ATF_REQUIRE(errno == ECHILD);
1818 }
1819 
1820 /*
1821  * Verify that no more events are reported after PT_KILL except for the
1822  * process exit when killing a multithreaded process.
1823  */
1824 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_threads);
1825 ATF_TC_BODY(ptrace__PT_KILL_threads, tc)
1826 {
1827 	struct ptrace_lwpinfo pl;
1828 	pid_t fpid, wpid;
1829 	lwpid_t main_lwp;
1830 	int status;
1831 
1832 	ATF_REQUIRE((fpid = fork()) != -1);
1833 	if (fpid == 0) {
1834 		trace_me();
1835 		simple_thread_main();
1836 	}
1837 
1838 	/* The first wait() should report the stop from SIGSTOP. */
1839 	wpid = waitpid(fpid, &status, 0);
1840 	ATF_REQUIRE(wpid == fpid);
1841 	ATF_REQUIRE(WIFSTOPPED(status));
1842 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1843 
1844 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
1845 	    sizeof(pl)) != -1);
1846 	main_lwp = pl.pl_lwpid;
1847 
1848 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
1849 
1850 	/* Continue the child ignoring the SIGSTOP. */
1851 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1852 
1853 	/* The first event should be for the child thread's birth. */
1854 	wpid = waitpid(fpid, &status, 0);
1855 	ATF_REQUIRE(wpid == fpid);
1856 	ATF_REQUIRE(WIFSTOPPED(status));
1857 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
1858 
1859 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
1860 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
1861 	    (PL_FLAG_BORN | PL_FLAG_SCX));
1862 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
1863 
1864 	/* Kill the child process. */
1865 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1866 
1867 	/* The last wait() should report the SIGKILL. */
1868 	wpid = waitpid(fpid, &status, 0);
1869 	ATF_REQUIRE(wpid == fpid);
1870 	ATF_REQUIRE(WIFSIGNALED(status));
1871 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1872 
1873 	wpid = wait(&status);
1874 	ATF_REQUIRE(wpid == -1);
1875 	ATF_REQUIRE(errno == ECHILD);
1876 }
1877 
1878 static void *
1879 mask_usr1_thread(void *arg)
1880 {
1881 	pthread_barrier_t *pbarrier;
1882 	sigset_t sigmask;
1883 
1884 	pbarrier = (pthread_barrier_t*)arg;
1885 
1886 	sigemptyset(&sigmask);
1887 	sigaddset(&sigmask, SIGUSR1);
1888 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1889 
1890 	/* Sync up with other thread after sigmask updated. */
1891 	pthread_barrier_wait(pbarrier);
1892 
1893 	for (;;)
1894 		sleep(60);
1895 
1896 	return (NULL);
1897 }
1898 
1899 /*
1900  * Verify that the SIGKILL from PT_KILL takes priority over other signals
1901  * and prevents spurious stops due to those other signals.
1902  */
1903 ATF_TC(ptrace__PT_KILL_competing_signal);
1904 ATF_TC_HEAD(ptrace__PT_KILL_competing_signal, tc)
1905 {
1906 
1907 	atf_tc_set_md_var(tc, "require.user", "root");
1908 }
1909 ATF_TC_BODY(ptrace__PT_KILL_competing_signal, tc)
1910 {
1911 	pid_t fpid, wpid;
1912 	int status;
1913 	cpuset_t setmask;
1914 	pthread_t t;
1915 	pthread_barrier_t barrier;
1916 	struct sched_param sched_param;
1917 
1918 	ATF_REQUIRE((fpid = fork()) != -1);
1919 	if (fpid == 0) {
1920 		/* Bind to one CPU so only one thread at a time will run. */
1921 		CPU_ZERO(&setmask);
1922 		CPU_SET(0, &setmask);
1923 		cpusetid_t setid;
1924 		CHILD_REQUIRE(cpuset(&setid) == 0);
1925 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
1926 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
1927 
1928 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
1929 
1930 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
1931 		    (void*)&barrier) == 0);
1932 
1933 		/*
1934 		 * Give the main thread higher priority. The test always
1935 		 * assumes that, if both threads are able to run, the main
1936 		 * thread runs first.
1937 		 */
1938 		sched_param.sched_priority =
1939 		    (sched_get_priority_max(SCHED_FIFO) +
1940 		    sched_get_priority_min(SCHED_FIFO)) / 2;
1941 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
1942 		    SCHED_FIFO, &sched_param) == 0);
1943 		sched_param.sched_priority -= RQ_PPQ;
1944 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
1945 		    &sched_param) == 0);
1946 
1947 		sigset_t sigmask;
1948 		sigemptyset(&sigmask);
1949 		sigaddset(&sigmask, SIGUSR2);
1950 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
1951 
1952 		/* Sync up with other thread after sigmask updated. */
1953 		pthread_barrier_wait(&barrier);
1954 
1955 		trace_me();
1956 
1957 		for (;;)
1958 			sleep(60);
1959 
1960 		exit(1);
1961 	}
1962 
1963 	/* The first wait() should report the stop from SIGSTOP. */
1964 	wpid = waitpid(fpid, &status, 0);
1965 	ATF_REQUIRE(wpid == fpid);
1966 	ATF_REQUIRE(WIFSTOPPED(status));
1967 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
1968 
1969 	/* Continue the child ignoring the SIGSTOP. */
1970 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
1971 
1972 	/* Send a signal that only the second thread can handle. */
1973 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
1974 
1975 	/* The second wait() should report the SIGUSR2. */
1976 	wpid = waitpid(fpid, &status, 0);
1977 	ATF_REQUIRE(wpid == fpid);
1978 	ATF_REQUIRE(WIFSTOPPED(status));
1979 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
1980 
1981 	/* Send a signal that only the first thread can handle. */
1982 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
1983 
1984 	/* Replace the SIGUSR2 with a kill. */
1985 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
1986 
1987 	/* The last wait() should report the SIGKILL (not the SIGUSR signal). */
1988 	wpid = waitpid(fpid, &status, 0);
1989 	ATF_REQUIRE(wpid == fpid);
1990 	ATF_REQUIRE(WIFSIGNALED(status));
1991 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
1992 
1993 	wpid = wait(&status);
1994 	ATF_REQUIRE(wpid == -1);
1995 	ATF_REQUIRE(errno == ECHILD);
1996 }
1997 
1998 /*
1999  * Verify that the SIGKILL from PT_KILL takes priority over other stop events
2000  * and prevents spurious stops caused by those events.
2001  */
2002 ATF_TC(ptrace__PT_KILL_competing_stop);
2003 ATF_TC_HEAD(ptrace__PT_KILL_competing_stop, tc)
2004 {
2005 
2006 	atf_tc_set_md_var(tc, "require.user", "root");
2007 }
2008 ATF_TC_BODY(ptrace__PT_KILL_competing_stop, tc)
2009 {
2010 	pid_t fpid, wpid;
2011 	int status;
2012 	cpuset_t setmask;
2013 	pthread_t t;
2014 	pthread_barrier_t barrier;
2015 	lwpid_t main_lwp;
2016 	struct ptrace_lwpinfo pl;
2017 	struct sched_param sched_param;
2018 
2019 	ATF_REQUIRE((fpid = fork()) != -1);
2020 	if (fpid == 0) {
2021 		trace_me();
2022 
2023 		/* Bind to one CPU so only one thread at a time will run. */
2024 		CPU_ZERO(&setmask);
2025 		CPU_SET(0, &setmask);
2026 		cpusetid_t setid;
2027 		CHILD_REQUIRE(cpuset(&setid) == 0);
2028 		CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
2029 		    CPU_WHICH_CPUSET, setid, sizeof(setmask), &setmask) == 0);
2030 
2031 		CHILD_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
2032 
2033 		CHILD_REQUIRE(pthread_create(&t, NULL, mask_usr1_thread,
2034 		    (void*)&barrier) == 0);
2035 
2036 		/*
2037 		 * Give the main thread higher priority. The test always
2038 		 * assumes that, if both threads are able to run, the main
2039 		 * thread runs first.
2040 		 */
2041 		sched_param.sched_priority =
2042 		    (sched_get_priority_max(SCHED_FIFO) +
2043 		    sched_get_priority_min(SCHED_FIFO)) / 2;
2044 		CHILD_REQUIRE(pthread_setschedparam(pthread_self(),
2045 		    SCHED_FIFO, &sched_param) == 0);
2046 		sched_param.sched_priority -= RQ_PPQ;
2047 		CHILD_REQUIRE(pthread_setschedparam(t, SCHED_FIFO,
2048 		    &sched_param) == 0);
2049 
2050 		sigset_t sigmask;
2051 		sigemptyset(&sigmask);
2052 		sigaddset(&sigmask, SIGUSR2);
2053 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2054 
2055 		/* Sync up with other thread after sigmask updated. */
2056 		pthread_barrier_wait(&barrier);
2057 
2058 		/* Sync up with the test before doing the getpid(). */
2059 		raise(SIGSTOP);
2060 
2061 		getpid();
2062 		exit(1);
2063 	}
2064 
2065 	/* The first wait() should report the stop from SIGSTOP. */
2066 	wpid = waitpid(fpid, &status, 0);
2067 	ATF_REQUIRE(wpid == fpid);
2068 	ATF_REQUIRE(WIFSTOPPED(status));
2069 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2070 
2071 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2072 	main_lwp = pl.pl_lwpid;
2073 
2074 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2075 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2076 
2077 	/*
2078 	 * Continue until child is done with setup, which is indicated with
2079 	 * SIGSTOP. Ignore system calls in the meantime.
2080 	 */
2081 	for (;;) {
2082 		wpid = waitpid(fpid, &status, 0);
2083 		ATF_REQUIRE(wpid == fpid);
2084 		ATF_REQUIRE(WIFSTOPPED(status));
2085 		if (WSTOPSIG(status) == SIGTRAP) {
2086 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2087 			    sizeof(pl)) != -1);
2088 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2089 		} else {
2090 			ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2091 			break;
2092 		}
2093 		ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2094 	}
2095 
2096 	/* Proceed, allowing main thread to hit syscall entry for getpid(). */
2097 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2098 
2099 	wpid = waitpid(fpid, &status, 0);
2100 	ATF_REQUIRE(wpid == fpid);
2101 	ATF_REQUIRE(WIFSTOPPED(status));
2102 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2103 
2104 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2105 	    sizeof(pl)) != -1);
2106 	ATF_REQUIRE(pl.pl_lwpid == main_lwp);
2107 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2108 	/* Prevent the main thread from hitting its syscall exit for now. */
2109 	ATF_REQUIRE(ptrace(PT_SUSPEND, main_lwp, 0, 0) == 0);
2110 
2111 	/*
2112 	 * Proceed, allowing second thread to hit syscall exit for
2113 	 * pthread_barrier_wait().
2114 	 */
2115 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2116 
2117 	wpid = waitpid(fpid, &status, 0);
2118 	ATF_REQUIRE(wpid == fpid);
2119 	ATF_REQUIRE(WIFSTOPPED(status));
2120 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2121 
2122 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
2123 	    sizeof(pl)) != -1);
2124 	ATF_REQUIRE(pl.pl_lwpid != main_lwp);
2125 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2126 
2127 	/* Send a signal that only the second thread can handle. */
2128 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2129 
2130 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2131 
2132 	/* The next wait() should report the SIGUSR2. */
2133 	wpid = waitpid(fpid, &status, 0);
2134 	ATF_REQUIRE(wpid == fpid);
2135 	ATF_REQUIRE(WIFSTOPPED(status));
2136 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2137 
2138 	/* Allow the main thread to try to finish its system call. */
2139 	ATF_REQUIRE(ptrace(PT_RESUME, main_lwp, 0, 0) == 0);
2140 
2141 	/*
2142 	 * At this point, the main thread is in the middle of a system call and
2143 	 * has been resumed. The second thread has taken a SIGUSR2 which will
2144 	 * be replaced with a SIGKILL below. The main thread will get to run
2145 	 * first. It should notice the kill request (even though the signal
2146 	 * replacement occurred in the other thread) and exit accordingly.  It
2147 	 * should not stop for the system call exit event.
2148 	 */
2149 
2150 	/* Replace the SIGUSR2 with a kill. */
2151 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2152 
2153 	/* The last wait() should report the SIGKILL (not a syscall exit). */
2154 	wpid = waitpid(fpid, &status, 0);
2155 	ATF_REQUIRE(wpid == fpid);
2156 	ATF_REQUIRE(WIFSIGNALED(status));
2157 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2158 
2159 	wpid = wait(&status);
2160 	ATF_REQUIRE(wpid == -1);
2161 	ATF_REQUIRE(errno == ECHILD);
2162 }
2163 
2164 static void
2165 sigusr1_handler(int sig)
2166 {
2167 
2168 	CHILD_REQUIRE(sig == SIGUSR1);
2169 	_exit(2);
2170 }
2171 
2172 /*
2173  * Verify that even if the signal queue is full for a child process,
2174  * a PT_KILL will kill the process.
2175  */
2176 ATF_TC_WITHOUT_HEAD(ptrace__PT_KILL_with_signal_full_sigqueue);
2177 ATF_TC_BODY(ptrace__PT_KILL_with_signal_full_sigqueue, tc)
2178 {
2179 	pid_t fpid, wpid;
2180 	int status;
2181 	int max_pending_per_proc;
2182 	size_t len;
2183 	int i;
2184 
2185 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2186 
2187 	ATF_REQUIRE((fpid = fork()) != -1);
2188 	if (fpid == 0) {
2189 		trace_me();
2190 		exit(1);
2191 	}
2192 
2193 	/* The first wait() should report the stop from SIGSTOP. */
2194 	wpid = waitpid(fpid, &status, 0);
2195 	ATF_REQUIRE(wpid == fpid);
2196 	ATF_REQUIRE(WIFSTOPPED(status));
2197 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2198 
2199 	len = sizeof(max_pending_per_proc);
2200 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2201 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2202 
2203 	/* Fill the signal queue. */
2204 	for (i = 0; i < max_pending_per_proc; ++i)
2205 		ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2206 
2207 	/* Kill the child process. */
2208 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
2209 
2210 	/* The last wait() should report the SIGKILL. */
2211 	wpid = waitpid(fpid, &status, 0);
2212 	ATF_REQUIRE(wpid == fpid);
2213 	ATF_REQUIRE(WIFSIGNALED(status));
2214 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
2215 
2216 	wpid = wait(&status);
2217 	ATF_REQUIRE(wpid == -1);
2218 	ATF_REQUIRE(errno == ECHILD);
2219 }
2220 
2221 /*
2222  * Verify that when stopped at a system call entry, a signal can be
2223  * requested with PT_CONTINUE which will be delivered once the system
2224  * call is complete.
2225  */
2226 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry);
2227 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry, tc)
2228 {
2229 	struct ptrace_lwpinfo pl;
2230 	pid_t fpid, wpid;
2231 	int status;
2232 
2233 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2234 
2235 	ATF_REQUIRE((fpid = fork()) != -1);
2236 	if (fpid == 0) {
2237 		trace_me();
2238 		getpid();
2239 		exit(1);
2240 	}
2241 
2242 	/* The first wait() should report the stop from SIGSTOP. */
2243 	wpid = waitpid(fpid, &status, 0);
2244 	ATF_REQUIRE(wpid == fpid);
2245 	ATF_REQUIRE(WIFSTOPPED(status));
2246 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2247 
2248 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2249 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2250 
2251 	/* The second wait() should report a system call entry for getpid(). */
2252 	wpid = waitpid(fpid, &status, 0);
2253 	ATF_REQUIRE(wpid == fpid);
2254 	ATF_REQUIRE(WIFSTOPPED(status));
2255 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2256 
2257 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2258 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2259 
2260 	/* Continue the child process with a signal. */
2261 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2262 
2263 	for (;;) {
2264 		/*
2265 		 * The last wait() should report exit 2, i.e., a normal _exit
2266 		 * from the signal handler. In the meantime, catch and proceed
2267 		 * past any syscall stops.
2268 		 */
2269 		wpid = waitpid(fpid, &status, 0);
2270 		ATF_REQUIRE(wpid == fpid);
2271 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2272 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2273 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2274 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2275 		} else {
2276 			ATF_REQUIRE(WIFEXITED(status));
2277 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2278 			break;
2279 		}
2280 	}
2281 
2282 	wpid = wait(&status);
2283 	ATF_REQUIRE(wpid == -1);
2284 	ATF_REQUIRE(errno == ECHILD);
2285 }
2286 
2287 static void
2288 sigusr1_counting_handler(int sig)
2289 {
2290 	static int counter = 0;
2291 
2292 	CHILD_REQUIRE(sig == SIGUSR1);
2293 	counter++;
2294 	if (counter == 2)
2295 		_exit(2);
2296 }
2297 
2298 /*
2299  * Verify that, when continuing from a stop at system call entry and exit,
2300  * a signal can be requested from both stops, and both will be delivered when
2301  * the system call is complete.
2302  */
2303 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
2304 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit, tc)
2305 {
2306 	struct ptrace_lwpinfo pl;
2307 	pid_t fpid, wpid;
2308 	int status;
2309 
2310 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2311 
2312 	ATF_REQUIRE((fpid = fork()) != -1);
2313 	if (fpid == 0) {
2314 		trace_me();
2315 		getpid();
2316 		exit(1);
2317 	}
2318 
2319 	/* The first wait() should report the stop from SIGSTOP. */
2320 	wpid = waitpid(fpid, &status, 0);
2321 	ATF_REQUIRE(wpid == fpid);
2322 	ATF_REQUIRE(WIFSTOPPED(status));
2323 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2324 
2325 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2326 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2327 
2328 	/* The second wait() should report a system call entry for getpid(). */
2329 	wpid = waitpid(fpid, &status, 0);
2330 	ATF_REQUIRE(wpid == fpid);
2331 	ATF_REQUIRE(WIFSTOPPED(status));
2332 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2333 
2334 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2335 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2336 
2337 	/* Continue the child process with a signal. */
2338 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2339 
2340 	/* The third wait() should report a system call exit for getpid(). */
2341 	wpid = waitpid(fpid, &status, 0);
2342 	ATF_REQUIRE(wpid == fpid);
2343 	ATF_REQUIRE(WIFSTOPPED(status));
2344 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2345 
2346 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2347 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2348 
2349 	/* Continue the child process with a signal. */
2350 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2351 
2352 	for (;;) {
2353 		/*
2354 		 * The last wait() should report exit 2, i.e., a normal _exit
2355 		 * from the signal handler. In the meantime, catch and proceed
2356 		 * past any syscall stops.
2357 		 */
2358 		wpid = waitpid(fpid, &status, 0);
2359 		ATF_REQUIRE(wpid == fpid);
2360 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2361 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2362 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2363 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2364 		} else {
2365 			ATF_REQUIRE(WIFEXITED(status));
2366 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2367 			break;
2368 		}
2369 	}
2370 
2371 	wpid = wait(&status);
2372 	ATF_REQUIRE(wpid == -1);
2373 	ATF_REQUIRE(errno == ECHILD);
2374 }
2375 
2376 /*
2377  * Verify that even if the signal queue is full for a child process,
2378  * a PT_CONTINUE with a signal will not result in loss of that signal.
2379  */
2380 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_full_sigqueue);
2381 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_full_sigqueue, tc)
2382 {
2383 	pid_t fpid, wpid;
2384 	int status;
2385 	int max_pending_per_proc;
2386 	size_t len;
2387 	int i;
2388 
2389 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2390 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_handler) != SIG_ERR);
2391 
2392 	ATF_REQUIRE((fpid = fork()) != -1);
2393 	if (fpid == 0) {
2394 		trace_me();
2395 		exit(1);
2396 	}
2397 
2398 	/* The first wait() should report the stop from SIGSTOP. */
2399 	wpid = waitpid(fpid, &status, 0);
2400 	ATF_REQUIRE(wpid == fpid);
2401 	ATF_REQUIRE(WIFSTOPPED(status));
2402 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2403 
2404 	len = sizeof(max_pending_per_proc);
2405 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2406 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2407 
2408 	/* Fill the signal queue. */
2409 	for (i = 0; i < max_pending_per_proc; ++i)
2410 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2411 
2412 	/* Continue with signal. */
2413 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2414 
2415 	for (;;) {
2416 		wpid = waitpid(fpid, &status, 0);
2417 		ATF_REQUIRE(wpid == fpid);
2418 		if (WIFSTOPPED(status)) {
2419 			ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2420 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2421 		} else {
2422 			/*
2423 			 * The last wait() should report normal _exit from the
2424 			 * SIGUSR1 handler.
2425 			 */
2426 			ATF_REQUIRE(WIFEXITED(status));
2427 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2428 			break;
2429 		}
2430 	}
2431 
2432 	wpid = wait(&status);
2433 	ATF_REQUIRE(wpid == -1);
2434 	ATF_REQUIRE(errno == ECHILD);
2435 }
2436 
2437 static sem_t sigusr1_sem;
2438 static int got_usr1;
2439 
2440 static void
2441 sigusr1_sempost_handler(int sig __unused)
2442 {
2443 
2444 	got_usr1++;
2445 	CHILD_REQUIRE(sem_post(&sigusr1_sem) == 0);
2446 }
2447 
2448 /*
2449  * Verify that even if the signal queue is full for a child process,
2450  * and the signal is masked, a PT_CONTINUE with a signal will not
2451  * result in loss of that signal.
2452  */
2453 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
2454 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue, tc)
2455 {
2456 	struct ptrace_lwpinfo pl;
2457 	pid_t fpid, wpid;
2458 	int status, err;
2459 	int max_pending_per_proc;
2460 	size_t len;
2461 	int i;
2462 	sigset_t sigmask;
2463 
2464 	ATF_REQUIRE(signal(SIGUSR2, handler) != SIG_ERR);
2465 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2466 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2467 
2468 	got_usr1 = 0;
2469 	ATF_REQUIRE((fpid = fork()) != -1);
2470 	if (fpid == 0) {
2471 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2472 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2473 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2474 
2475 		trace_me();
2476 		CHILD_REQUIRE(got_usr1 == 0);
2477 
2478 		/* Allow the pending SIGUSR1 in now. */
2479 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2480 		/* Wait to receive the SIGUSR1. */
2481 		do {
2482 			err = sem_wait(&sigusr1_sem);
2483 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2484 		} while (err != 0 && errno == EINTR);
2485 		CHILD_REQUIRE(got_usr1 == 1);
2486 		exit(1);
2487 	}
2488 
2489 	/* The first wait() should report the stop from SIGSTOP. */
2490 	wpid = waitpid(fpid, &status, 0);
2491 	ATF_REQUIRE(wpid == fpid);
2492 	ATF_REQUIRE(WIFSTOPPED(status));
2493 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2494 
2495 	len = sizeof(max_pending_per_proc);
2496 	ATF_REQUIRE(sysctlbyname("kern.sigqueue.max_pending_per_proc",
2497 	    &max_pending_per_proc, &len, NULL, 0) == 0);
2498 
2499 	/* Fill the signal queue. */
2500 	for (i = 0; i < max_pending_per_proc; ++i)
2501 		ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
2502 
2503 	/* Continue with signal. */
2504 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2505 
2506 	/* Collect and ignore all of the SIGUSR2. */
2507 	for (i = 0; i < max_pending_per_proc; ++i) {
2508 		wpid = waitpid(fpid, &status, 0);
2509 		ATF_REQUIRE(wpid == fpid);
2510 		ATF_REQUIRE(WIFSTOPPED(status));
2511 		ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
2512 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2513 	}
2514 
2515 	/* Now our PT_CONTINUE'd SIGUSR1 should cause a stop after unmask. */
2516 	wpid = waitpid(fpid, &status, 0);
2517 	ATF_REQUIRE(wpid == fpid);
2518 	ATF_REQUIRE(WIFSTOPPED(status));
2519 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2520 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2521 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2522 
2523 	/* Continue the child, ignoring the SIGUSR1. */
2524 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2525 
2526 	/* The last wait() should report exit after receiving SIGUSR1. */
2527 	wpid = waitpid(fpid, &status, 0);
2528 	ATF_REQUIRE(wpid == fpid);
2529 	ATF_REQUIRE(WIFEXITED(status));
2530 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2531 
2532 	wpid = wait(&status);
2533 	ATF_REQUIRE(wpid == -1);
2534 	ATF_REQUIRE(errno == ECHILD);
2535 }
2536 
2537 /*
2538  * Verify that, after stopping due to a signal, that signal can be
2539  * replaced with another signal.
2540  */
2541 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_change_sig);
2542 ATF_TC_BODY(ptrace__PT_CONTINUE_change_sig, tc)
2543 {
2544 	struct ptrace_lwpinfo pl;
2545 	pid_t fpid, wpid;
2546 	int status;
2547 
2548 	ATF_REQUIRE((fpid = fork()) != -1);
2549 	if (fpid == 0) {
2550 		trace_me();
2551 		sleep(20);
2552 		exit(1);
2553 	}
2554 
2555 	/* The first wait() should report the stop from SIGSTOP. */
2556 	wpid = waitpid(fpid, &status, 0);
2557 	ATF_REQUIRE(wpid == fpid);
2558 	ATF_REQUIRE(WIFSTOPPED(status));
2559 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2560 
2561 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2562 
2563 	/* Send a signal without ptrace. */
2564 	ATF_REQUIRE(kill(fpid, SIGINT) == 0);
2565 
2566 	/* The second wait() should report a SIGINT was received. */
2567 	wpid = waitpid(fpid, &status, 0);
2568 	ATF_REQUIRE(wpid == fpid);
2569 	ATF_REQUIRE(WIFSTOPPED(status));
2570 	ATF_REQUIRE(WSTOPSIG(status) == SIGINT);
2571 
2572 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2573 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2574 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGINT);
2575 
2576 	/* Continue the child process with a different signal. */
2577 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTERM) == 0);
2578 
2579 	/*
2580 	 * The last wait() should report having died due to the new
2581 	 * signal, SIGTERM.
2582 	 */
2583 	wpid = waitpid(fpid, &status, 0);
2584 	ATF_REQUIRE(wpid == fpid);
2585 	ATF_REQUIRE(WIFSIGNALED(status));
2586 	ATF_REQUIRE(WTERMSIG(status) == SIGTERM);
2587 
2588 	wpid = wait(&status);
2589 	ATF_REQUIRE(wpid == -1);
2590 	ATF_REQUIRE(errno == ECHILD);
2591 }
2592 
2593 /*
2594  * Verify that a signal can be passed through to the child even when there
2595  * was no true signal originally. Such cases arise when a SIGTRAP is
2596  * invented for e.g, system call stops.
2597  */
2598 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
2599 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigtrap_system_call_entry, tc)
2600 {
2601 	struct ptrace_lwpinfo pl;
2602 	struct rlimit rl;
2603 	pid_t fpid, wpid;
2604 	int status;
2605 
2606 	ATF_REQUIRE((fpid = fork()) != -1);
2607 	if (fpid == 0) {
2608 		trace_me();
2609 		/* SIGTRAP expected to cause exit on syscall entry. */
2610 		rl.rlim_cur = rl.rlim_max = 0;
2611 		ATF_REQUIRE(setrlimit(RLIMIT_CORE, &rl) == 0);
2612 		getpid();
2613 		exit(1);
2614 	}
2615 
2616 	/* The first wait() should report the stop from SIGSTOP. */
2617 	wpid = waitpid(fpid, &status, 0);
2618 	ATF_REQUIRE(wpid == fpid);
2619 	ATF_REQUIRE(WIFSTOPPED(status));
2620 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2621 
2622 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2623 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2624 
2625 	/* The second wait() should report a system call entry for getpid(). */
2626 	wpid = waitpid(fpid, &status, 0);
2627 	ATF_REQUIRE(wpid == fpid);
2628 	ATF_REQUIRE(WIFSTOPPED(status));
2629 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2630 
2631 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2632 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2633 
2634 	/* Continue the child process with a SIGTRAP. */
2635 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGTRAP) == 0);
2636 
2637 	for (;;) {
2638 		/*
2639 		 * The last wait() should report exit due to SIGTRAP.  In the
2640 		 * meantime, catch and proceed past any syscall stops.
2641 		 */
2642 		wpid = waitpid(fpid, &status, 0);
2643 		ATF_REQUIRE(wpid == fpid);
2644 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2645 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2646 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2647 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2648 		} else {
2649 			ATF_REQUIRE(WIFSIGNALED(status));
2650 			ATF_REQUIRE(WTERMSIG(status) == SIGTRAP);
2651 			break;
2652 		}
2653 	}
2654 
2655 	wpid = wait(&status);
2656 	ATF_REQUIRE(wpid == -1);
2657 	ATF_REQUIRE(errno == ECHILD);
2658 
2659 }
2660 
2661 /*
2662  * A mixed bag PT_CONTINUE with signal test.
2663  */
2664 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_mix);
2665 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_mix, tc)
2666 {
2667 	struct ptrace_lwpinfo pl;
2668 	pid_t fpid, wpid;
2669 	int status;
2670 
2671 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_counting_handler) != SIG_ERR);
2672 
2673 	ATF_REQUIRE((fpid = fork()) != -1);
2674 	if (fpid == 0) {
2675 		trace_me();
2676 		getpid();
2677 		exit(1);
2678 	}
2679 
2680 	/* The first wait() should report the stop from SIGSTOP. */
2681 	wpid = waitpid(fpid, &status, 0);
2682 	ATF_REQUIRE(wpid == fpid);
2683 	ATF_REQUIRE(WIFSTOPPED(status));
2684 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2685 
2686 	/* Continue the child ignoring the SIGSTOP and tracing system calls. */
2687 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
2688 
2689 	/* The second wait() should report a system call entry for getpid(). */
2690 	wpid = waitpid(fpid, &status, 0);
2691 	ATF_REQUIRE(wpid == fpid);
2692 	ATF_REQUIRE(WIFSTOPPED(status));
2693 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2694 
2695 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2696 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
2697 
2698 	/* Continue with the first SIGUSR1. */
2699 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2700 
2701 	/* The next wait() should report a system call exit for getpid(). */
2702 	wpid = waitpid(fpid, &status, 0);
2703 	ATF_REQUIRE(wpid == fpid);
2704 	ATF_REQUIRE(WIFSTOPPED(status));
2705 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
2706 
2707 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2708 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCX);
2709 
2710 	/* Send an ABRT without ptrace. */
2711 	ATF_REQUIRE(kill(fpid, SIGABRT) == 0);
2712 
2713 	/* Continue normally. */
2714 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2715 
2716 	/* The next wait() should report the SIGABRT. */
2717 	wpid = waitpid(fpid, &status, 0);
2718 	ATF_REQUIRE(wpid == fpid);
2719 	ATF_REQUIRE(WIFSTOPPED(status));
2720 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
2721 
2722 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2723 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
2724 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
2725 
2726 	/* Continue, replacing the SIGABRT with another SIGUSR1. */
2727 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2728 
2729 	for (;;) {
2730 		/*
2731 		 * The last wait() should report exit 2, i.e., a normal _exit
2732 		 * from the signal handler. In the meantime, catch and proceed
2733 		 * past any syscall stops.
2734 		 */
2735 		wpid = waitpid(fpid, &status, 0);
2736 		ATF_REQUIRE(wpid == fpid);
2737 		if (WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP) {
2738 			ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
2739 			ATF_REQUIRE(pl.pl_flags & (PL_FLAG_SCE | PL_FLAG_SCX));
2740 			ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2741 		} else {
2742 			ATF_REQUIRE(WIFEXITED(status));
2743 			ATF_REQUIRE(WEXITSTATUS(status) == 2);
2744 			break;
2745 		}
2746 	}
2747 
2748 	wpid = wait(&status);
2749 	ATF_REQUIRE(wpid == -1);
2750 	ATF_REQUIRE(errno == ECHILD);
2751 
2752 }
2753 
2754 /*
2755  * Verify a signal delivered by ptrace is noticed by kevent(2).
2756  */
2757 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_kqueue);
2758 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_kqueue, tc)
2759 {
2760 	pid_t fpid, wpid;
2761 	int status, kq, nevents;
2762 	struct kevent kev;
2763 
2764 	ATF_REQUIRE(signal(SIGUSR1, SIG_IGN) != SIG_ERR);
2765 
2766 	ATF_REQUIRE((fpid = fork()) != -1);
2767 	if (fpid == 0) {
2768 		CHILD_REQUIRE((kq = kqueue()) > 0);
2769 		EV_SET(&kev, SIGUSR1, EVFILT_SIGNAL, EV_ADD, 0, 0, 0);
2770 		CHILD_REQUIRE(kevent(kq, &kev, 1, NULL, 0, NULL) == 0);
2771 
2772 		trace_me();
2773 
2774 		for (;;) {
2775 			nevents = kevent(kq, NULL, 0, &kev, 1, NULL);
2776 			if (nevents == -1 && errno == EINTR)
2777 				continue;
2778 			CHILD_REQUIRE(nevents > 0);
2779 			CHILD_REQUIRE(kev.filter == EVFILT_SIGNAL);
2780 			CHILD_REQUIRE(kev.ident == SIGUSR1);
2781 			break;
2782 		}
2783 
2784 		exit(1);
2785 	}
2786 
2787 	/* The first wait() should report the stop from SIGSTOP. */
2788 	wpid = waitpid(fpid, &status, 0);
2789 	ATF_REQUIRE(wpid == fpid);
2790 	ATF_REQUIRE(WIFSTOPPED(status));
2791 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2792 
2793 	/* Continue with the SIGUSR1. */
2794 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2795 
2796 	/*
2797 	 * The last wait() should report normal exit with code 1.
2798 	 */
2799 	wpid = waitpid(fpid, &status, 0);
2800 	ATF_REQUIRE(wpid == fpid);
2801 	ATF_REQUIRE(WIFEXITED(status));
2802 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2803 
2804 	wpid = wait(&status);
2805 	ATF_REQUIRE(wpid == -1);
2806 	ATF_REQUIRE(errno == ECHILD);
2807 }
2808 
2809 static void *
2810 signal_thread(void *arg)
2811 {
2812 	int err;
2813 	sigset_t sigmask;
2814 
2815 	pthread_barrier_t *pbarrier = (pthread_barrier_t*)arg;
2816 
2817 	/* Wait for this thread to receive a SIGUSR1. */
2818 	do {
2819 		err = sem_wait(&sigusr1_sem);
2820 		CHILD_REQUIRE(err == 0 || errno == EINTR);
2821 	} while (err != 0 && errno == EINTR);
2822 
2823 	/* Free our companion thread from the barrier. */
2824 	pthread_barrier_wait(pbarrier);
2825 
2826 	/*
2827 	 * Swap ignore duties; the next SIGUSR1 should go to the
2828 	 * other thread.
2829 	 */
2830 	CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2831 	CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2832 	CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
2833 
2834 	/* Sync up threads after swapping signal masks. */
2835 	pthread_barrier_wait(pbarrier);
2836 
2837 	/* Wait until our companion has received its SIGUSR1. */
2838 	pthread_barrier_wait(pbarrier);
2839 
2840 	return (NULL);
2841 }
2842 
2843 /*
2844  * Verify that a traced process with blocked signal received the
2845  * signal from kill() once unmasked.
2846  */
2847 ATF_TC_WITHOUT_HEAD(ptrace__killed_with_sigmask);
2848 ATF_TC_BODY(ptrace__killed_with_sigmask, tc)
2849 {
2850 	struct ptrace_lwpinfo pl;
2851 	pid_t fpid, wpid;
2852 	int status, err;
2853 	sigset_t sigmask;
2854 
2855 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2856 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2857 	got_usr1 = 0;
2858 
2859 	ATF_REQUIRE((fpid = fork()) != -1);
2860 	if (fpid == 0) {
2861 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2862 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2863 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2864 
2865 		trace_me();
2866 		CHILD_REQUIRE(got_usr1 == 0);
2867 
2868 		/* Allow the pending SIGUSR1 in now. */
2869 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2870 		/* Wait to receive a SIGUSR1. */
2871 		do {
2872 			err = sem_wait(&sigusr1_sem);
2873 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2874 		} while (err != 0 && errno == EINTR);
2875 		CHILD_REQUIRE(got_usr1 == 1);
2876 		exit(1);
2877 	}
2878 
2879 	/* The first wait() should report the stop from SIGSTOP. */
2880 	wpid = waitpid(fpid, &status, 0);
2881 	ATF_REQUIRE(wpid == fpid);
2882 	ATF_REQUIRE(WIFSTOPPED(status));
2883 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2884 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2885 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2886 
2887 	/* Send blocked SIGUSR1 which should cause a stop. */
2888 	ATF_REQUIRE(kill(fpid, SIGUSR1) == 0);
2889 
2890 	/* Continue the child ignoring the SIGSTOP. */
2891 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2892 
2893 	/* The next wait() should report the kill(SIGUSR1) was received. */
2894 	wpid = waitpid(fpid, &status, 0);
2895 	ATF_REQUIRE(wpid == fpid);
2896 	ATF_REQUIRE(WIFSTOPPED(status));
2897 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2898 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2899 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2900 
2901 	/* Continue the child, allowing in the SIGUSR1. */
2902 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2903 
2904 	/* The last wait() should report normal exit with code 1. */
2905 	wpid = waitpid(fpid, &status, 0);
2906 	ATF_REQUIRE(wpid == fpid);
2907 	ATF_REQUIRE(WIFEXITED(status));
2908 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2909 
2910 	wpid = wait(&status);
2911 	ATF_REQUIRE(wpid == -1);
2912 	ATF_REQUIRE(errno == ECHILD);
2913 }
2914 
2915 /*
2916  * Verify that a traced process with blocked signal received the
2917  * signal from PT_CONTINUE once unmasked.
2918  */
2919 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_sigmask);
2920 ATF_TC_BODY(ptrace__PT_CONTINUE_with_sigmask, tc)
2921 {
2922 	struct ptrace_lwpinfo pl;
2923 	pid_t fpid, wpid;
2924 	int status, err;
2925 	sigset_t sigmask;
2926 
2927 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
2928 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
2929 	got_usr1 = 0;
2930 
2931 	ATF_REQUIRE((fpid = fork()) != -1);
2932 	if (fpid == 0) {
2933 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
2934 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
2935 		CHILD_REQUIRE(sigprocmask(SIG_BLOCK, &sigmask, NULL) == 0);
2936 
2937 		trace_me();
2938 		CHILD_REQUIRE(got_usr1 == 0);
2939 
2940 		/* Allow the pending SIGUSR1 in now. */
2941 		CHILD_REQUIRE(sigprocmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
2942 		/* Wait to receive a SIGUSR1. */
2943 		do {
2944 			err = sem_wait(&sigusr1_sem);
2945 			CHILD_REQUIRE(err == 0 || errno == EINTR);
2946 		} while (err != 0 && errno == EINTR);
2947 
2948 		CHILD_REQUIRE(got_usr1 == 1);
2949 		exit(1);
2950 	}
2951 
2952 	/* The first wait() should report the stop from SIGSTOP. */
2953 	wpid = waitpid(fpid, &status, 0);
2954 	ATF_REQUIRE(wpid == fpid);
2955 	ATF_REQUIRE(WIFSTOPPED(status));
2956 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
2957 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2958 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGSTOP);
2959 
2960 	/* Continue the child replacing SIGSTOP with SIGUSR1. */
2961 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
2962 
2963 	/* The next wait() should report the SIGUSR1 was received. */
2964 	wpid = waitpid(fpid, &status, 0);
2965 	ATF_REQUIRE(wpid == fpid);
2966 	ATF_REQUIRE(WIFSTOPPED(status));
2967 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR1);
2968 	ATF_REQUIRE(ptrace(PT_LWPINFO, fpid, (caddr_t)&pl, sizeof(pl)) != -1);
2969 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGUSR1);
2970 
2971 	/* Continue the child, ignoring the SIGUSR1. */
2972 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
2973 
2974 	/* The last wait() should report normal exit with code 1. */
2975 	wpid = waitpid(fpid, &status, 0);
2976 	ATF_REQUIRE(wpid == fpid);
2977 	ATF_REQUIRE(WIFEXITED(status));
2978 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
2979 
2980 	wpid = wait(&status);
2981 	ATF_REQUIRE(wpid == -1);
2982 	ATF_REQUIRE(errno == ECHILD);
2983 }
2984 
2985 /*
2986  * Verify that if ptrace stops due to a signal but continues with
2987  * a different signal that the new signal is routed to a thread
2988  * that can accept it, and that the thread is awakened by the signal
2989  * in a timely manner.
2990  */
2991 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_with_signal_thread_sigmask);
2992 ATF_TC_BODY(ptrace__PT_CONTINUE_with_signal_thread_sigmask, tc)
2993 {
2994 	pid_t fpid, wpid;
2995 	int status, err;
2996 	pthread_t t;
2997 	sigset_t sigmask;
2998 	pthread_barrier_t barrier;
2999 
3000 	ATF_REQUIRE(pthread_barrier_init(&barrier, NULL, 2) == 0);
3001 	ATF_REQUIRE(sem_init(&sigusr1_sem, 0, 0) == 0);
3002 	ATF_REQUIRE(signal(SIGUSR1, sigusr1_sempost_handler) != SIG_ERR);
3003 
3004 	ATF_REQUIRE((fpid = fork()) != -1);
3005 	if (fpid == 0) {
3006 		CHILD_REQUIRE(pthread_create(&t, NULL, signal_thread, (void*)&barrier) == 0);
3007 
3008 		/* The other thread should receive the first SIGUSR1. */
3009 		CHILD_REQUIRE(sigemptyset(&sigmask) == 0);
3010 		CHILD_REQUIRE(sigaddset(&sigmask, SIGUSR1) == 0);
3011 		CHILD_REQUIRE(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) == 0);
3012 
3013 		trace_me();
3014 
3015 		/* Wait until other thread has received its SIGUSR1. */
3016 		pthread_barrier_wait(&barrier);
3017 
3018 		/*
3019 		 * Swap ignore duties; the next SIGUSR1 should go to this
3020 		 * thread.
3021 		 */
3022 		CHILD_REQUIRE(pthread_sigmask(SIG_UNBLOCK, &sigmask, NULL) == 0);
3023 
3024 		/* Sync up threads after swapping signal masks. */
3025 		pthread_barrier_wait(&barrier);
3026 
3027 		/*
3028 		 * Sync up with test code; we're ready for the next SIGUSR1
3029 		 * now.
3030 		 */
3031 		raise(SIGSTOP);
3032 
3033 		/* Wait for this thread to receive a SIGUSR1. */
3034 		do {
3035 			err = sem_wait(&sigusr1_sem);
3036 			CHILD_REQUIRE(err == 0 || errno == EINTR);
3037 		} while (err != 0 && errno == EINTR);
3038 
3039 		/* Free the other thread from the barrier. */
3040 		pthread_barrier_wait(&barrier);
3041 
3042 		CHILD_REQUIRE(pthread_join(t, NULL) == 0);
3043 
3044 		exit(1);
3045 	}
3046 
3047 	/* The first wait() should report the stop from SIGSTOP. */
3048 	wpid = waitpid(fpid, &status, 0);
3049 	ATF_REQUIRE(wpid == fpid);
3050 	ATF_REQUIRE(WIFSTOPPED(status));
3051 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3052 
3053 	/* Continue the child ignoring the SIGSTOP. */
3054 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3055 
3056 	/*
3057 	 * Send a signal without ptrace that either thread will accept (USR2,
3058 	 * in this case).
3059 	 */
3060 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3061 
3062 	/* The second wait() should report a SIGUSR2 was received. */
3063 	wpid = waitpid(fpid, &status, 0);
3064 	ATF_REQUIRE(wpid == fpid);
3065 	ATF_REQUIRE(WIFSTOPPED(status));
3066 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3067 
3068 	/* Continue the child, changing the signal to USR1. */
3069 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3070 
3071 	/* The next wait() should report the stop from SIGSTOP. */
3072 	wpid = waitpid(fpid, &status, 0);
3073 	ATF_REQUIRE(wpid == fpid);
3074 	ATF_REQUIRE(WIFSTOPPED(status));
3075 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3076 
3077 	/* Continue the child ignoring the SIGSTOP. */
3078 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3079 
3080 	ATF_REQUIRE(kill(fpid, SIGUSR2) == 0);
3081 
3082 	/* The next wait() should report a SIGUSR2 was received. */
3083 	wpid = waitpid(fpid, &status, 0);
3084 	ATF_REQUIRE(wpid == fpid);
3085 	ATF_REQUIRE(WIFSTOPPED(status));
3086 	ATF_REQUIRE(WSTOPSIG(status) == SIGUSR2);
3087 
3088 	/* Continue the child, changing the signal to USR1. */
3089 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, SIGUSR1) == 0);
3090 
3091 	/* The last wait() should report normal exit with code 1. */
3092 	wpid = waitpid(fpid, &status, 0);
3093 	ATF_REQUIRE(wpid == fpid);
3094 	ATF_REQUIRE(WIFEXITED(status));
3095 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3096 
3097 	wpid = wait(&status);
3098 	ATF_REQUIRE(wpid == -1);
3099 	ATF_REQUIRE(errno == ECHILD);
3100 }
3101 
3102 static void *
3103 raise_sigstop_thread(void *arg __unused)
3104 {
3105 
3106 	raise(SIGSTOP);
3107 	return NULL;
3108 }
3109 
3110 static void *
3111 sleep_thread(void *arg __unused)
3112 {
3113 
3114 	sleep(60);
3115 	return NULL;
3116 }
3117 
3118 static void
3119 terminate_with_pending_sigstop(bool sigstop_from_main_thread)
3120 {
3121 	pid_t fpid, wpid;
3122 	int status, i;
3123 	cpuset_t setmask;
3124 	cpusetid_t setid;
3125 	pthread_t t;
3126 
3127 	/*
3128 	 * Become the reaper for this process tree. We need to be able to check
3129 	 * that both child and grandchild have died.
3130 	 */
3131 	ATF_REQUIRE(procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == 0);
3132 
3133 	fpid = fork();
3134 	ATF_REQUIRE(fpid >= 0);
3135 	if (fpid == 0) {
3136 		fpid = fork();
3137 		CHILD_REQUIRE(fpid >= 0);
3138 		if (fpid == 0) {
3139 			trace_me();
3140 
3141 			/* Pin to CPU 0 to serialize thread execution. */
3142 			CPU_ZERO(&setmask);
3143 			CPU_SET(0, &setmask);
3144 			CHILD_REQUIRE(cpuset(&setid) == 0);
3145 			CHILD_REQUIRE(cpuset_setaffinity(CPU_LEVEL_CPUSET,
3146 			    CPU_WHICH_CPUSET, setid,
3147 			    sizeof(setmask), &setmask) == 0);
3148 
3149 			if (sigstop_from_main_thread) {
3150 				/*
3151 				 * We expect the SIGKILL sent when our parent
3152 				 * dies to be delivered to the new thread.
3153 				 * Raise the SIGSTOP in this thread so the
3154 				 * threads compete.
3155 				 */
3156 				CHILD_REQUIRE(pthread_create(&t, NULL,
3157 				    sleep_thread, NULL) == 0);
3158 				raise(SIGSTOP);
3159 			} else {
3160 				/*
3161 				 * We expect the SIGKILL to be delivered to
3162 				 * this thread. After creating the new thread,
3163 				 * just get off the CPU so the other thread can
3164 				 * raise the SIGSTOP.
3165 				 */
3166 				CHILD_REQUIRE(pthread_create(&t, NULL,
3167 				    raise_sigstop_thread, NULL) == 0);
3168 				sleep(60);
3169 			}
3170 
3171 			exit(0);
3172 		}
3173 		/* First stop is trace_me() immediately after fork. */
3174 		wpid = waitpid(fpid, &status, 0);
3175 		CHILD_REQUIRE(wpid == fpid);
3176 		CHILD_REQUIRE(WIFSTOPPED(status));
3177 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3178 
3179 		CHILD_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3180 
3181 		/* Second stop is from the raise(SIGSTOP). */
3182 		wpid = waitpid(fpid, &status, 0);
3183 		CHILD_REQUIRE(wpid == fpid);
3184 		CHILD_REQUIRE(WIFSTOPPED(status));
3185 		CHILD_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3186 
3187 		/*
3188 		 * Terminate tracing process without detaching. Our child
3189 		 * should be killed.
3190 		 */
3191 		exit(0);
3192 	}
3193 
3194 	/*
3195 	 * We should get a normal exit from our immediate child and a SIGKILL
3196 	 * exit from our grandchild. The latter case is the interesting one.
3197 	 * Our grandchild should not have stopped due to the SIGSTOP that was
3198 	 * left dangling when its parent died.
3199 	 */
3200 	for (i = 0; i < 2; ++i) {
3201 		wpid = wait(&status);
3202 		if (wpid == fpid)
3203 			ATF_REQUIRE(WIFEXITED(status) &&
3204 			    WEXITSTATUS(status) == 0);
3205 		else
3206 			ATF_REQUIRE(WIFSIGNALED(status) &&
3207 			    WTERMSIG(status) == SIGKILL);
3208 	}
3209 }
3210 
3211 /*
3212  * These two tests ensure that if the tracing process exits without detaching
3213  * just after the child received a SIGSTOP, the child is cleanly killed and
3214  * doesn't go to sleep due to the SIGSTOP. The parent's death will send a
3215  * SIGKILL to the child. If the SIGKILL and the SIGSTOP are handled by
3216  * different threads, the SIGKILL must win.  There are two variants of this
3217  * test, designed to catch the case where the SIGKILL is delivered to the
3218  * younger thread (the first test) and the case where the SIGKILL is delivered
3219  * to the older thread (the second test). This behavior has changed in the
3220  * past, so make no assumption.
3221  */
3222 ATF_TC(ptrace__parent_terminate_with_pending_sigstop1);
3223 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop1, tc)
3224 {
3225 
3226 	atf_tc_set_md_var(tc, "require.user", "root");
3227 }
3228 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop1, tc)
3229 {
3230 
3231 	terminate_with_pending_sigstop(true);
3232 }
3233 
3234 ATF_TC(ptrace__parent_terminate_with_pending_sigstop2);
3235 ATF_TC_HEAD(ptrace__parent_terminate_with_pending_sigstop2, tc)
3236 {
3237 
3238 	atf_tc_set_md_var(tc, "require.user", "root");
3239 }
3240 ATF_TC_BODY(ptrace__parent_terminate_with_pending_sigstop2, tc)
3241 {
3242 
3243 	terminate_with_pending_sigstop(false);
3244 }
3245 
3246 /*
3247  * Verify that after ptrace() discards a SIGKILL signal, the event mask
3248  * is not modified.
3249  */
3250 ATF_TC_WITHOUT_HEAD(ptrace__event_mask_sigkill_discard);
3251 ATF_TC_BODY(ptrace__event_mask_sigkill_discard, tc)
3252 {
3253 	struct ptrace_lwpinfo pl;
3254 	pid_t fpid, wpid;
3255 	int status, event_mask, new_event_mask;
3256 
3257 	ATF_REQUIRE((fpid = fork()) != -1);
3258 	if (fpid == 0) {
3259 		trace_me();
3260 		raise(SIGSTOP);
3261 		exit(0);
3262 	}
3263 
3264 	/* The first wait() should report the stop from trace_me(). */
3265 	wpid = waitpid(fpid, &status, 0);
3266 	ATF_REQUIRE(wpid == fpid);
3267 	ATF_REQUIRE(WIFSTOPPED(status));
3268 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3269 
3270 	/* Set several unobtrusive event bits. */
3271 	event_mask = PTRACE_EXEC | PTRACE_FORK | PTRACE_LWP;
3272 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, wpid, (caddr_t)&event_mask,
3273 	    sizeof(event_mask)) == 0);
3274 
3275 	/* Send a SIGKILL without using ptrace. */
3276 	ATF_REQUIRE(kill(fpid, SIGKILL) == 0);
3277 
3278 	/* Continue the child ignoring the SIGSTOP. */
3279 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3280 
3281 	/* The next stop should be due to the SIGKILL. */
3282 	wpid = waitpid(fpid, &status, 0);
3283 	ATF_REQUIRE(wpid == fpid);
3284 	ATF_REQUIRE(WIFSTOPPED(status));
3285 	ATF_REQUIRE(WSTOPSIG(status) == SIGKILL);
3286 
3287 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3288 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3289 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGKILL);
3290 
3291 	/* Continue the child ignoring the SIGKILL. */
3292 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3293 
3294 	/* The next wait() should report the stop from SIGSTOP. */
3295 	wpid = waitpid(fpid, &status, 0);
3296 	ATF_REQUIRE(wpid == fpid);
3297 	ATF_REQUIRE(WIFSTOPPED(status));
3298 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3299 
3300 	/* Check the current event mask. It should not have changed. */
3301 	new_event_mask = 0;
3302 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, wpid, (caddr_t)&new_event_mask,
3303 	    sizeof(new_event_mask)) == 0);
3304 	ATF_REQUIRE(event_mask == new_event_mask);
3305 
3306 	/* Continue the child to let it exit. */
3307 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3308 
3309 	/* The last event should be for the child process's exit. */
3310 	wpid = waitpid(fpid, &status, 0);
3311 	ATF_REQUIRE(WIFEXITED(status));
3312 	ATF_REQUIRE(WEXITSTATUS(status) == 0);
3313 
3314 	wpid = wait(&status);
3315 	ATF_REQUIRE(wpid == -1);
3316 	ATF_REQUIRE(errno == ECHILD);
3317 }
3318 
3319 static void *
3320 flock_thread(void *arg)
3321 {
3322 	int fd;
3323 
3324 	fd = *(int *)arg;
3325 	(void)flock(fd, LOCK_EX);
3326 	(void)flock(fd, LOCK_UN);
3327 	return (NULL);
3328 }
3329 
3330 /*
3331  * Verify that PT_ATTACH will suspend threads sleeping in an SBDRY section.
3332  * We rely on the fact that the lockf implementation sets SBDRY before blocking
3333  * on a lock. This is a regression test for r318191.
3334  */
3335 ATF_TC_WITHOUT_HEAD(ptrace__PT_ATTACH_with_SBDRY_thread);
3336 ATF_TC_BODY(ptrace__PT_ATTACH_with_SBDRY_thread, tc)
3337 {
3338 	pthread_barrier_t barrier;
3339 	pthread_barrierattr_t battr;
3340 	char tmpfile[64];
3341 	pid_t child, wpid;
3342 	int error, fd, i, status;
3343 
3344 	ATF_REQUIRE(pthread_barrierattr_init(&battr) == 0);
3345 	ATF_REQUIRE(pthread_barrierattr_setpshared(&battr,
3346 	    PTHREAD_PROCESS_SHARED) == 0);
3347 	ATF_REQUIRE(pthread_barrier_init(&barrier, &battr, 2) == 0);
3348 
3349 	(void)snprintf(tmpfile, sizeof(tmpfile), "./ptrace.XXXXXX");
3350 	fd = mkstemp(tmpfile);
3351 	ATF_REQUIRE(fd >= 0);
3352 
3353 	ATF_REQUIRE((child = fork()) != -1);
3354 	if (child == 0) {
3355 		pthread_t t[2];
3356 		int cfd;
3357 
3358 		error = pthread_barrier_wait(&barrier);
3359 		if (error != 0 && error != PTHREAD_BARRIER_SERIAL_THREAD)
3360 			_exit(1);
3361 
3362 		cfd = open(tmpfile, O_RDONLY);
3363 		if (cfd < 0)
3364 			_exit(1);
3365 
3366 		/*
3367 		 * We want at least two threads blocked on the file lock since
3368 		 * the SIGSTOP from PT_ATTACH may kick one of them out of
3369 		 * sleep.
3370 		 */
3371 		if (pthread_create(&t[0], NULL, flock_thread, &cfd) != 0)
3372 			_exit(1);
3373 		if (pthread_create(&t[1], NULL, flock_thread, &cfd) != 0)
3374 			_exit(1);
3375 		if (pthread_join(t[0], NULL) != 0)
3376 			_exit(1);
3377 		if (pthread_join(t[1], NULL) != 0)
3378 			_exit(1);
3379 		_exit(0);
3380 	}
3381 
3382 	ATF_REQUIRE(flock(fd, LOCK_EX) == 0);
3383 
3384 	error = pthread_barrier_wait(&barrier);
3385 	ATF_REQUIRE(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD);
3386 
3387 	/*
3388 	 * Give the child some time to block. Is there a better way to do this?
3389 	 */
3390 	sleep(1);
3391 
3392 	/*
3393 	 * Attach and give the child 3 seconds to stop.
3394 	 */
3395 	ATF_REQUIRE(ptrace(PT_ATTACH, child, NULL, 0) == 0);
3396 	for (i = 0; i < 3; i++) {
3397 		wpid = waitpid(child, &status, WNOHANG);
3398 		if (wpid == child && WIFSTOPPED(status) &&
3399 		    WSTOPSIG(status) == SIGSTOP)
3400 			break;
3401 		sleep(1);
3402 	}
3403 	ATF_REQUIRE_MSG(i < 3, "failed to stop child process after PT_ATTACH");
3404 
3405 	ATF_REQUIRE(ptrace(PT_DETACH, child, NULL, 0) == 0);
3406 
3407 	ATF_REQUIRE(flock(fd, LOCK_UN) == 0);
3408 	ATF_REQUIRE(unlink(tmpfile) == 0);
3409 	ATF_REQUIRE(close(fd) == 0);
3410 }
3411 
3412 static void
3413 sigusr1_step_handler(int sig)
3414 {
3415 
3416 	CHILD_REQUIRE(sig == SIGUSR1);
3417 	raise(SIGABRT);
3418 }
3419 
3420 /*
3421  * Verify that PT_STEP with a signal invokes the signal before
3422  * stepping the next instruction (and that the next instruction is
3423  * stepped correctly).
3424  */
3425 ATF_TC_WITHOUT_HEAD(ptrace__PT_STEP_with_signal);
3426 ATF_TC_BODY(ptrace__PT_STEP_with_signal, tc)
3427 {
3428 	struct ptrace_lwpinfo pl;
3429 	pid_t fpid, wpid;
3430 	int status;
3431 
3432 	ATF_REQUIRE((fpid = fork()) != -1);
3433 	if (fpid == 0) {
3434 		trace_me();
3435 		signal(SIGUSR1, sigusr1_step_handler);
3436 		raise(SIGABRT);
3437 		exit(1);
3438 	}
3439 
3440 	/* The first wait() should report the stop from SIGSTOP. */
3441 	wpid = waitpid(fpid, &status, 0);
3442 	ATF_REQUIRE(wpid == fpid);
3443 	ATF_REQUIRE(WIFSTOPPED(status));
3444 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3445 
3446 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3447 
3448 	/* The next stop should report the SIGABRT in the child body. */
3449 	wpid = waitpid(fpid, &status, 0);
3450 	ATF_REQUIRE(wpid == fpid);
3451 	ATF_REQUIRE(WIFSTOPPED(status));
3452 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3453 
3454 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3455 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3456 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3457 
3458 	/* Step the child process inserting SIGUSR1. */
3459 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, SIGUSR1) == 0);
3460 
3461 	/* The next stop should report the SIGABRT in the signal handler. */
3462 	wpid = waitpid(fpid, &status, 0);
3463 	ATF_REQUIRE(wpid == fpid);
3464 	ATF_REQUIRE(WIFSTOPPED(status));
3465 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3466 
3467 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3468 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3469 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3470 
3471 	/* Continue the child process discarding the signal. */
3472 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3473 
3474 	/* The next stop should report a trace trap from PT_STEP. */
3475 	wpid = waitpid(fpid, &status, 0);
3476 	ATF_REQUIRE(wpid == fpid);
3477 	ATF_REQUIRE(WIFSTOPPED(status));
3478 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3479 
3480 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3481 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3482 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3483 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3484 
3485 	/* Continue the child to let it exit. */
3486 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3487 
3488 	/* The last event should be for the child process's exit. */
3489 	wpid = waitpid(fpid, &status, 0);
3490 	ATF_REQUIRE(WIFEXITED(status));
3491 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3492 
3493 	wpid = wait(&status);
3494 	ATF_REQUIRE(wpid == -1);
3495 	ATF_REQUIRE(errno == ECHILD);
3496 }
3497 
3498 #ifdef HAVE_BREAKPOINT
3499 /*
3500  * Verify that a SIGTRAP event with the TRAP_BRKPT code is reported
3501  * for a breakpoint trap.
3502  */
3503 ATF_TC_WITHOUT_HEAD(ptrace__breakpoint_siginfo);
3504 ATF_TC_BODY(ptrace__breakpoint_siginfo, tc)
3505 {
3506 	struct ptrace_lwpinfo pl;
3507 	pid_t fpid, wpid;
3508 	int status;
3509 
3510 	ATF_REQUIRE((fpid = fork()) != -1);
3511 	if (fpid == 0) {
3512 		trace_me();
3513 		breakpoint();
3514 		exit(1);
3515 	}
3516 
3517 	/* The first wait() should report the stop from SIGSTOP. */
3518 	wpid = waitpid(fpid, &status, 0);
3519 	ATF_REQUIRE(wpid == fpid);
3520 	ATF_REQUIRE(WIFSTOPPED(status));
3521 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3522 
3523 	/* Continue the child ignoring the SIGSTOP. */
3524 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3525 
3526 	/* The second wait() should report hitting the breakpoint. */
3527 	wpid = waitpid(fpid, &status, 0);
3528 	ATF_REQUIRE(wpid == fpid);
3529 	ATF_REQUIRE(WIFSTOPPED(status));
3530 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3531 
3532 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3533 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3534 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3535 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_BRKPT);
3536 
3537 	/* Kill the child process. */
3538 	ATF_REQUIRE(ptrace(PT_KILL, fpid, 0, 0) == 0);
3539 
3540 	/* The last wait() should report the SIGKILL. */
3541 	wpid = waitpid(fpid, &status, 0);
3542 	ATF_REQUIRE(wpid == fpid);
3543 	ATF_REQUIRE(WIFSIGNALED(status));
3544 	ATF_REQUIRE(WTERMSIG(status) == SIGKILL);
3545 
3546 	wpid = wait(&status);
3547 	ATF_REQUIRE(wpid == -1);
3548 	ATF_REQUIRE(errno == ECHILD);
3549 }
3550 #endif /* HAVE_BREAKPOINT */
3551 
3552 /*
3553  * Verify that a SIGTRAP event with the TRAP_TRACE code is reported
3554  * for a single-step trap from PT_STEP.
3555  */
3556 ATF_TC_WITHOUT_HEAD(ptrace__step_siginfo);
3557 ATF_TC_BODY(ptrace__step_siginfo, tc)
3558 {
3559 	struct ptrace_lwpinfo pl;
3560 	pid_t fpid, wpid;
3561 	int status;
3562 
3563 	ATF_REQUIRE((fpid = fork()) != -1);
3564 	if (fpid == 0) {
3565 		trace_me();
3566 		exit(1);
3567 	}
3568 
3569 	/* The first wait() should report the stop from SIGSTOP. */
3570 	wpid = waitpid(fpid, &status, 0);
3571 	ATF_REQUIRE(wpid == fpid);
3572 	ATF_REQUIRE(WIFSTOPPED(status));
3573 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3574 
3575 	/* Step the child ignoring the SIGSTOP. */
3576 	ATF_REQUIRE(ptrace(PT_STEP, fpid, (caddr_t)1, 0) == 0);
3577 
3578 	/* The second wait() should report a single-step trap. */
3579 	wpid = waitpid(fpid, &status, 0);
3580 	ATF_REQUIRE(wpid == fpid);
3581 	ATF_REQUIRE(WIFSTOPPED(status));
3582 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3583 
3584 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3585 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3586 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP);
3587 	ATF_REQUIRE(pl.pl_siginfo.si_code == TRAP_TRACE);
3588 
3589 	/* Continue the child process. */
3590 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3591 
3592 	/* The last event should be for the child process's exit. */
3593 	wpid = waitpid(fpid, &status, 0);
3594 	ATF_REQUIRE(WIFEXITED(status));
3595 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3596 
3597 	wpid = wait(&status);
3598 	ATF_REQUIRE(wpid == -1);
3599 	ATF_REQUIRE(errno == ECHILD);
3600 }
3601 
3602 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3603 static void *
3604 continue_thread(void *arg __unused)
3605 {
3606 	breakpoint();
3607 	return (NULL);
3608 }
3609 
3610 static __dead2 void
3611 continue_thread_main(void)
3612 {
3613 	pthread_t threads[2];
3614 
3615 	CHILD_REQUIRE(pthread_create(&threads[0], NULL, continue_thread,
3616 	    NULL) == 0);
3617 	CHILD_REQUIRE(pthread_create(&threads[1], NULL, continue_thread,
3618 	    NULL) == 0);
3619 	CHILD_REQUIRE(pthread_join(threads[0], NULL) == 0);
3620 	CHILD_REQUIRE(pthread_join(threads[1], NULL) == 0);
3621 	exit(1);
3622 }
3623 
3624 /*
3625  * Ensure that PT_CONTINUE clears the status of the thread that
3626  * triggered the stop even if a different thread's LWP was passed to
3627  * PT_CONTINUE.
3628  */
3629 ATF_TC_WITHOUT_HEAD(ptrace__PT_CONTINUE_different_thread);
3630 ATF_TC_BODY(ptrace__PT_CONTINUE_different_thread, tc)
3631 {
3632 	struct ptrace_lwpinfo pl;
3633 	pid_t fpid, wpid;
3634 	lwpid_t lwps[2];
3635 	bool hit_break[2];
3636 	struct reg reg;
3637 	int i, j, status;
3638 
3639 	ATF_REQUIRE((fpid = fork()) != -1);
3640 	if (fpid == 0) {
3641 		trace_me();
3642 		continue_thread_main();
3643 	}
3644 
3645 	/* The first wait() should report the stop from SIGSTOP. */
3646 	wpid = waitpid(fpid, &status, 0);
3647 	ATF_REQUIRE(wpid == fpid);
3648 	ATF_REQUIRE(WIFSTOPPED(status));
3649 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3650 
3651 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3652 	    sizeof(pl)) != -1);
3653 
3654 	ATF_REQUIRE(ptrace(PT_LWP_EVENTS, wpid, NULL, 1) == 0);
3655 
3656 	/* Continue the child ignoring the SIGSTOP. */
3657 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3658 
3659 	/* One of the new threads should report it's birth. */
3660 	wpid = waitpid(fpid, &status, 0);
3661 	ATF_REQUIRE(wpid == fpid);
3662 	ATF_REQUIRE(WIFSTOPPED(status));
3663 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3664 
3665 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3666 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3667 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3668 	lwps[0] = pl.pl_lwpid;
3669 
3670 	/*
3671 	 * Suspend this thread to ensure both threads are alive before
3672 	 * hitting the breakpoint.
3673 	 */
3674 	ATF_REQUIRE(ptrace(PT_SUSPEND, lwps[0], NULL, 0) != -1);
3675 
3676 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3677 
3678 	/* Second thread should report it's birth. */
3679 	wpid = waitpid(fpid, &status, 0);
3680 	ATF_REQUIRE(wpid == fpid);
3681 	ATF_REQUIRE(WIFSTOPPED(status));
3682 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3683 
3684 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3685 	ATF_REQUIRE((pl.pl_flags & (PL_FLAG_BORN | PL_FLAG_SCX)) ==
3686 	    (PL_FLAG_BORN | PL_FLAG_SCX));
3687 	ATF_REQUIRE(pl.pl_lwpid != lwps[0]);
3688 	lwps[1] = pl.pl_lwpid;
3689 
3690 	/* Resume both threads waiting for breakpoint events. */
3691 	hit_break[0] = hit_break[1] = false;
3692 	ATF_REQUIRE(ptrace(PT_RESUME, lwps[0], NULL, 0) != -1);
3693 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3694 
3695 	/* One thread should report a breakpoint. */
3696 	wpid = waitpid(fpid, &status, 0);
3697 	ATF_REQUIRE(wpid == fpid);
3698 	ATF_REQUIRE(WIFSTOPPED(status));
3699 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3700 
3701 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3702 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3703 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3704 	    pl.pl_siginfo.si_code == TRAP_BRKPT);
3705 	if (pl.pl_lwpid == lwps[0])
3706 		i = 0;
3707 	else
3708 		i = 1;
3709 	hit_break[i] = true;
3710 	ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3711 	SKIP_BREAK(&reg);
3712 	ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg, 0) != -1);
3713 
3714 	/*
3715 	 * Resume both threads but pass the other thread's LWPID to
3716 	 * PT_CONTINUE.
3717 	 */
3718 	ATF_REQUIRE(ptrace(PT_CONTINUE, lwps[i ^ 1], (caddr_t)1, 0) == 0);
3719 
3720 	/*
3721 	 * Will now get two thread exit events and one more breakpoint
3722 	 * event.
3723 	 */
3724 	for (j = 0; j < 3; j++) {
3725 		wpid = waitpid(fpid, &status, 0);
3726 		ATF_REQUIRE(wpid == fpid);
3727 		ATF_REQUIRE(WIFSTOPPED(status));
3728 		ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3729 
3730 		ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl,
3731 		    sizeof(pl)) != -1);
3732 
3733 		if (pl.pl_lwpid == lwps[0])
3734 			i = 0;
3735 		else
3736 			i = 1;
3737 
3738 		ATF_REQUIRE_MSG(lwps[i] != 0, "event for exited thread");
3739 		if (pl.pl_flags & PL_FLAG_EXITED) {
3740 			ATF_REQUIRE_MSG(hit_break[i],
3741 			    "exited thread did not report breakpoint");
3742 			lwps[i] = 0;
3743 		} else {
3744 			ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) != 0);
3745 			ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGTRAP &&
3746 			    pl.pl_siginfo.si_code == TRAP_BRKPT);
3747 			ATF_REQUIRE_MSG(!hit_break[i],
3748 			    "double breakpoint event");
3749 			hit_break[i] = true;
3750 			ATF_REQUIRE(ptrace(PT_GETREGS, pl.pl_lwpid, (caddr_t)&reg,
3751 			    0) != -1);
3752 			SKIP_BREAK(&reg);
3753 			ATF_REQUIRE(ptrace(PT_SETREGS, pl.pl_lwpid, (caddr_t)&reg,
3754 			    0) != -1);
3755 		}
3756 
3757 		ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3758 	}
3759 
3760 	/* Both threads should have exited. */
3761 	ATF_REQUIRE(lwps[0] == 0);
3762 	ATF_REQUIRE(lwps[1] == 0);
3763 
3764 	/* The last event should be for the child process's exit. */
3765 	wpid = waitpid(fpid, &status, 0);
3766 	ATF_REQUIRE(WIFEXITED(status));
3767 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3768 
3769 	wpid = wait(&status);
3770 	ATF_REQUIRE(wpid == -1);
3771 	ATF_REQUIRE(errno == ECHILD);
3772 }
3773 #endif
3774 
3775 /*
3776  * Verify that PT_LWPINFO doesn't return stale siginfo.
3777  */
3778 ATF_TC_WITHOUT_HEAD(ptrace__PT_LWPINFO_stale_siginfo);
3779 ATF_TC_BODY(ptrace__PT_LWPINFO_stale_siginfo, tc)
3780 {
3781 	struct ptrace_lwpinfo pl;
3782 	pid_t fpid, wpid;
3783 	int events, status;
3784 
3785 	ATF_REQUIRE((fpid = fork()) != -1);
3786 	if (fpid == 0) {
3787 		trace_me();
3788 		raise(SIGABRT);
3789 		exit(1);
3790 	}
3791 
3792 	/* The first wait() should report the stop from SIGSTOP. */
3793 	wpid = waitpid(fpid, &status, 0);
3794 	ATF_REQUIRE(wpid == fpid);
3795 	ATF_REQUIRE(WIFSTOPPED(status));
3796 	ATF_REQUIRE(WSTOPSIG(status) == SIGSTOP);
3797 
3798 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3799 
3800 	/* The next stop should report the SIGABRT in the child body. */
3801 	wpid = waitpid(fpid, &status, 0);
3802 	ATF_REQUIRE(wpid == fpid);
3803 	ATF_REQUIRE(WIFSTOPPED(status));
3804 	ATF_REQUIRE(WSTOPSIG(status) == SIGABRT);
3805 
3806 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3807 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SI);
3808 	ATF_REQUIRE(pl.pl_siginfo.si_signo == SIGABRT);
3809 
3810 	/*
3811 	 * Continue the process ignoring the signal, but enabling
3812 	 * syscall traps.
3813 	 */
3814 	ATF_REQUIRE(ptrace(PT_SYSCALL, fpid, (caddr_t)1, 0) == 0);
3815 
3816 	/*
3817 	 * The next stop should report a system call entry from
3818 	 * exit().  PL_FLAGS_SI should not be set.
3819 	 */
3820 	wpid = waitpid(fpid, &status, 0);
3821 	ATF_REQUIRE(wpid == fpid);
3822 	ATF_REQUIRE(WIFSTOPPED(status));
3823 	ATF_REQUIRE(WSTOPSIG(status) == SIGTRAP);
3824 
3825 	ATF_REQUIRE(ptrace(PT_LWPINFO, wpid, (caddr_t)&pl, sizeof(pl)) != -1);
3826 	ATF_REQUIRE(pl.pl_flags & PL_FLAG_SCE);
3827 	ATF_REQUIRE((pl.pl_flags & PL_FLAG_SI) == 0);
3828 
3829 	/* Disable syscall tracing and continue the child to let it exit. */
3830 	ATF_REQUIRE(ptrace(PT_GET_EVENT_MASK, fpid, (caddr_t)&events,
3831 	    sizeof(events)) == 0);
3832 	events &= ~PTRACE_SYSCALL;
3833 	ATF_REQUIRE(ptrace(PT_SET_EVENT_MASK, fpid, (caddr_t)&events,
3834 	    sizeof(events)) == 0);
3835 	ATF_REQUIRE(ptrace(PT_CONTINUE, fpid, (caddr_t)1, 0) == 0);
3836 
3837 	/* The last event should be for the child process's exit. */
3838 	wpid = waitpid(fpid, &status, 0);
3839 	ATF_REQUIRE(WIFEXITED(status));
3840 	ATF_REQUIRE(WEXITSTATUS(status) == 1);
3841 
3842 	wpid = wait(&status);
3843 	ATF_REQUIRE(wpid == -1);
3844 	ATF_REQUIRE(errno == ECHILD);
3845 }
3846 
3847 ATF_TP_ADD_TCS(tp)
3848 {
3849 
3850 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_trace_me);
3851 	ATF_TP_ADD_TC(tp, ptrace__parent_wait_after_attach);
3852 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_child_debugger);
3853 	ATF_TP_ADD_TC(tp, ptrace__parent_sees_exit_after_unrelated_debugger);
3854 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached);
3855 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_child_detached);
3856 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_parent_detached);
3857 	ATF_TP_ADD_TC(tp, ptrace__follow_fork_both_attached_unrelated_debugger);
3858 	ATF_TP_ADD_TC(tp,
3859 	    ptrace__follow_fork_child_detached_unrelated_debugger);
3860 	ATF_TP_ADD_TC(tp,
3861 	    ptrace__follow_fork_parent_detached_unrelated_debugger);
3862 	ATF_TP_ADD_TC(tp, ptrace__getppid);
3863 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_fork);
3864 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_vfork);
3865 	ATF_TP_ADD_TC(tp, ptrace__new_child_pl_syscall_code_thread);
3866 	ATF_TP_ADD_TC(tp, ptrace__lwp_events);
3867 	ATF_TP_ADD_TC(tp, ptrace__lwp_events_exec);
3868 	ATF_TP_ADD_TC(tp, ptrace__siginfo);
3869 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_disable);
3870 	ATF_TP_ADD_TC(tp, ptrace__ptrace_exec_enable);
3871 	ATF_TP_ADD_TC(tp, ptrace__event_mask);
3872 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork);
3873 	ATF_TP_ADD_TC(tp, ptrace__ptrace_vfork_follow);
3874 #ifdef HAVE_BREAKPOINT
3875 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_breakpoint);
3876 #endif
3877 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_system_call);
3878 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_threads);
3879 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_signal);
3880 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_competing_stop);
3881 	ATF_TP_ADD_TC(tp, ptrace__PT_KILL_with_signal_full_sigqueue);
3882 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_system_call_entry);
3883 	ATF_TP_ADD_TC(tp,
3884 	    ptrace__PT_CONTINUE_with_signal_system_call_entry_and_exit);
3885 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_full_sigqueue);
3886 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_masked_full_sigqueue);
3887 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_change_sig);
3888 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigtrap_system_call_entry);
3889 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_mix);
3890 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_kqueue);
3891 	ATF_TP_ADD_TC(tp, ptrace__killed_with_sigmask);
3892 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_sigmask);
3893 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_with_signal_thread_sigmask);
3894 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop1);
3895 	ATF_TP_ADD_TC(tp, ptrace__parent_terminate_with_pending_sigstop2);
3896 	ATF_TP_ADD_TC(tp, ptrace__event_mask_sigkill_discard);
3897 	ATF_TP_ADD_TC(tp, ptrace__PT_ATTACH_with_SBDRY_thread);
3898 	ATF_TP_ADD_TC(tp, ptrace__PT_STEP_with_signal);
3899 #ifdef HAVE_BREAKPOINT
3900 	ATF_TP_ADD_TC(tp, ptrace__breakpoint_siginfo);
3901 #endif
3902 	ATF_TP_ADD_TC(tp, ptrace__step_siginfo);
3903 #if defined(HAVE_BREAKPOINT) && defined(SKIP_BREAK)
3904 	ATF_TP_ADD_TC(tp, ptrace__PT_CONTINUE_different_thread);
3905 #endif
3906 	ATF_TP_ADD_TC(tp, ptrace__PT_LWPINFO_stale_siginfo);
3907 
3908 	return (atf_no_error());
3909 }
3910