/* DF-5652 — upper-bound probe. The ONLY upper-bound enforcement in
 * elcr_write_trigger() is KASSERT(irq < ISA_IRQ_CNT) (elcr.c:106),
 * which sys/sys/systm.h:94-122 compiles to nothing on production
 * (non-INVARIANTS) kernels. On THIS INVARIANTS guest the call panics
 * at the assert — proving there is no runtime guard, only a debug
 * assertion. Run this module LAST in the sequence (it kills the box);
 * the guest is reset afterwards.
 */
#include <sys/param.h>
#include <sys/module.h>
#include <sys/kernel.h>
#include <sys/systm.h>
#include <sys/types.h>
#include <sys/bus.h>

extern void	elcr_write_trigger(int, enum intr_trigger); /* elcr.c:100 */

static int
elcrboom_modevent(module_t mod, int type, void *data)
{
	switch (type) {
	case MOD_LOAD:
		kprintf("BOOM: calling elcr_write_trigger(16, LEVEL): "
		    "expect 'panic: elcr_write_trigger: invalid IRQ 16' on "
		    "this INVARIANTS kernel; on a production kernel the "
		    "assert is compiled out (systm.h:117) and the call "
		    "silently corrupts shadow bit 16 via 1<<16\n");
		elcr_write_trigger(16, INTR_TRIGGER_LEVEL);
		kprintf("BOOM: RETURNED — no guard at all\n");
		return (0);
	case MOD_UNLOAD:
		return (0);
	default:
		return (EOPNOTSUPP);
	}
}

static moduledata_t elcrboom_mod = { "elcrboom", elcrboom_modevent, NULL };
DECLARE_MODULE(elcrboom, elcrboom_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);