#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ clobber_insn_unless_known_safe(unsigned char *);
int /*<<< orphan*/ printf(char *, ...);
void ensure_no_bad_insns_in_range(unsigned long start, unsigned long end) {
  printf("ensure_no_bad_insns_in_range(%lx-%lx)\n", start, end);
  for (unsigned char *p = (unsigned char *)start; p + 3 <= (unsigned char *)end;
       p++) {
    if (p[0] != 0x0f)
      continue;
    if (p[1] == 0x01 && p[2] == 0xef) {
      printf("WRPKRU at %p\n", p);
      clobber_insn_unless_known_safe(p);
    }
    if (p[1] == 0xae && (p[2] & 0x38) == 0x28 && (p[2] >> 6) != 3) {
      printf("XRSTOR at %p\n", p);
      clobber_insn_unless_known_safe(p);
    }
  }
}


x86 assembly (clang, -O0):
<ensure_no_bad_insns_in_range>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x8(%rbp),%rsi
mov    -0x10(%rbp),%rdx
lea    0xec1(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
add    $0x3,%rax
mov    -0x10(%rbp),%rcx
cmp    %rcx,%rax
ja     1223 <ensure_no_bad_insns_in_range+0x103>
mov    -0x18(%rbp),%rax
movzbl (%rax),%eax
cmp    $0xf,%eax
je     1178 <ensure_no_bad_insns_in_range+0x58>
jmp    1212 <ensure_no_bad_insns_in_range+0xf2>
mov    -0x18(%rbp),%rax
movzbl 0x1(%rax),%eax
cmp    $0x1,%eax
jne    11b7 <ensure_no_bad_insns_in_range+0x97>
mov    -0x18(%rbp),%rax
movzbl 0x2(%rax),%eax
cmp    $0xef,%eax
jne    11b7 <ensure_no_bad_insns_in_range+0x97>
mov    -0x18(%rbp),%rsi
lea    0xe80(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x18(%rbp),%rdi
call   1040 <clobber_insn_unless_known_safe@plt>
mov    -0x18(%rbp),%rax
movzbl 0x1(%rax),%eax
cmp    $0xae,%eax
jne    120d <ensure_no_bad_insns_in_range+0xed>
mov    -0x18(%rbp),%rax
movzbl 0x2(%rax),%eax
and    $0x38,%eax
cmp    $0x28,%eax
jne    120d <ensure_no_bad_insns_in_range+0xed>
mov    -0x18(%rbp),%rax
movzbl 0x2(%rax),%eax
sar    $0x6,%eax
cmp    $0x3,%eax
je     120d <ensure_no_bad_insns_in_range+0xed>
mov    -0x18(%rbp),%rsi
lea    0xe38(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x18(%rbp),%rdi
call   1040 <clobber_insn_unless_known_safe@plt>
jmp    1212 <ensure_no_bad_insns_in_range+0xf2>
mov    -0x18(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x18(%rbp)
jmp    114e <ensure_no_bad_insns_in_range+0x2e>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<ensure_no_bad_insns_in_range>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
mov    %rsi,%r14
mov    %rdi,%rbx
lea    0xeca(%rip),%rdi
mov    %rbx,%rsi
mov    %r14,%rdx
xor    %eax,%eax
call   1030 <printf@plt>
add    $0x3,%rbx
cmp    %r14,%rbx
jbe    1156 <ensure_no_bad_insns_in_range+0x36>
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret
lea    0xeca(%rip),%r15
lea    0xed1(%rip),%r12
jmp    1179 <ensure_no_bad_insns_in_range+0x59>
cs nopw 0x0(%rax,%rax,1)
add    $0x1,%rbx
cmp    %r14,%rbx
ja     114c <ensure_no_bad_insns_in_range+0x2c>
cmpb   $0xf,-0x3(%rbx)
jne    1170 <ensure_no_bad_insns_in_range+0x50>
lea    -0x3(%rbx),%r13
movzbl -0x2(%rbx),%eax
cmp    $0x1,%al
jne    11aa <ensure_no_bad_insns_in_range+0x8a>
cmpb   $0xef,-0x1(%rbx)
jne    1170 <ensure_no_bad_insns_in_range+0x50>
mov    %r15,%rdi
mov    %r13,%rsi
xor    %eax,%eax
call   1030 <printf@plt>
mov    %r13,%rdi
call   1040 <clobber_insn_unless_known_safe@plt>
movzbl -0x2(%rbx),%eax
cmp    $0xae,%al
jne    1170 <ensure_no_bad_insns_in_range+0x50>
movzbl -0x1(%rbx),%eax
mov    %eax,%ecx
and    $0x38,%ecx
cmp    $0x28,%ecx
jne    1170 <ensure_no_bad_insns_in_range+0x50>
and    $0xffffffc0,%eax
cmp    $0xc0,%eax
je     1170 <ensure_no_bad_insns_in_range+0x50>
mov    %r12,%rdi
mov    %r13,%rsi
xor    %eax,%eax
call   1030 <printf@plt>
mov    %r13,%rdi
call   1040 <clobber_insn_unless_known_safe@plt>
jmp    1170 <ensure_no_bad_insns_in_range+0x50>

LLVM IR (-O0):
@.str = [39 x i8] c"ensure_no_bad_insns_in_range(%lx-%lx)\0A\00"
@.str.1 = [14 x i8] c"WRPKRU at %p\0A\00"
@.str.2 = [14 x i8] c"XRSTOR at %p\0A\00"
define void @ensure_no_bad_insns_in_range(i64 %0, i64 %1) {
%3 = alloca i64
%4 = alloca i64
%5 = alloca i8*
store i64 %0, i64* %3
store i64 %1, i64* %4
%6 = load i64, i64* %3
%7 = load i64, i64* %4
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str, i64 0, i64 0), i64 %6, i64 %7)
%9 = load i64, i64* %3
%10 = inttoptr i64 %9 to i8*
store i8* %10, i8** %5
br label %11
11: ; preds = %67, %2
%12 = load i8*, i8** %5
%13 = getelementptr inbounds i8, i8* %12, i64 3
%14 = load i64, i64* %4
%15 = inttoptr i64 %14 to i8*
%16 = icmp ule i8* %13, %15
br i1 %16, label %17, label %70
17: ; preds = %11
%18 = load i8*, i8** %5
%19 = getelementptr inbounds i8, i8* %18, i64 0
%20 = load i8, i8* %19
%21 = zext i8 %20 to i32
%22 = icmp ne i32 %21, 15
br i1 %22, label %23, label %24
23: ; preds = %17
br label %67
24: ; preds = %17
%25 = load i8*, i8** %5
%26 = getelementptr inbounds i8, i8* %25, i64 1
%27 = load i8, i8* %26
%28 = zext i8 %27 to i32
%29 = icmp eq i32 %28, 1
br i1 %29, label %30, label %41
30: ; preds = %24
%31 = load i8*, i8** %5
%32 = getelementptr inbounds i8, i8* %31, i64 2
%33 = load i8, i8* %32
%34 = zext i8 %33 to i32
%35 = icmp eq i32 %34, 239
br i1 %35, label %36, label %41
36: ; preds = %30
%37 = load i8*, i8** %5
%38 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %37)
%39 = load i8*, i8** %5
%40 = call i32 @clobber_insn_unless_known_safe(i8* %39)
br label %41
41: ; preds = %36, %30, %24
%42 = load i8*, i8** %5
%43 = getelementptr inbounds i8, i8* %42, i64 1
%44 = load i8, i8* %43
%45 = zext i8 %44 to i32
%46 = icmp eq i32 %45, 174
br i1 %46, label %47, label %66
47: ; preds = %41
%48 = load i8*, i8** %5
%49 = getelementptr inbounds i8, i8* %48, i64 2
%50 = load i8, i8* %49
%51 = zext i8 %50 to i32
%52 = and i32 %51, 56
%53 = icmp eq i32 %52, 40
br i1 %53, label %54, label %66
54: ; preds = %47
%55 = load i8*, i8** %5
%56 = getelementptr inbounds i8, i8* %55, i64 2
%57 = load i8, i8* %56
%58 = zext i8 %57 to i32
%59 = ashr i32 %58, 6
%60 = icmp ne i32 %59, 3
br i1 %60, label %61, label %66
61: ; preds = %54
%62 = load i8*, i8** %5
%63 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i8* %62)
%64 = load i8*, i8** %5
%65 = call i32 @clobber_insn_unless_known_safe(i8* %64)
br label %66
66: ; preds = %61, %54, %47, %41
br label %67
67: ; preds = %66, %23
%68 = load i8*, i8** %5
%69 = getelementptr inbounds i8, i8* %68, i32 1
store i8* %69, i8** %5
br label %11
70: ; preds = %11
ret void
}

LLVM IR (-O2):
@.str = [39 x i8] c"ensure_no_bad_insns_in_range(%lx-%lx)\0A\00"
@.str.1 = [14 x i8] c"WRPKRU at %p\0A\00"
@.str.2 = [14 x i8] c"XRSTOR at %p\0A\00"
define void @ensure_no_bad_insns_in_range(i64 %0, i64 %1) {
%3 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([39 x i8], [39 x i8]* @.str, i64 0, i64 0), i64 %0, i64 %1)
%4 = inttoptr i64 %0 to i8*
%5 = inttoptr i64 %1 to i8*
%6 = getelementptr inbounds i8, i8* %4, i64 3
%7 = icmp ugt i8* %6, %5
br i1 %7, label %8, label %9
8: ; preds = %40, %2
ret void
9: ; preds = %2, %40
%10 = phi i8* [ %41, %40 ], [ %4, %2 ]
%11 = load i8, i8* %10
%12 = icmp eq i8 %11, 15
br i1 %12, label %13, label %40
13: ; preds = %9
%14 = getelementptr inbounds i8, i8* %10, i64 1
%15 = load i8, i8* %14
%16 = icmp eq i8 %15, 1
br i1 %16, label %17, label %25
17: ; preds = %13
%18 = getelementptr inbounds i8, i8* %10, i64 2
%19 = load i8, i8* %18
%20 = icmp eq i8 %19, -17
br i1 %20, label %21, label %40
21: ; preds = %17
%22 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %10)
%23 = tail call i32 @clobber_insn_unless_known_safe(i8* %10)
%24 = load i8, i8* %14
br label %25
25: ; preds = %21, %13
%26 = phi i8 [ %15, %13 ], [ %24, %21 ]
%27 = icmp eq i8 %26, -82
br i1 %27, label %28, label %40
28: ; preds = %25
%29 = getelementptr inbounds i8, i8* %10, i64 2
%30 = load i8, i8* %29
%31 = zext i8 %30 to i32
%32 = and i32 %31, 56
%33 = icmp ne i32 %32, 40
%34 = and i32 %31, 192
%35 = icmp eq i32 %34, 192
%36 = or i1 %33, %35
br i1 %36, label %40, label %37
37: ; preds = %28
%38 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i8* %10)
%39 = tail call i32 @clobber_insn_unless_known_safe(i8* %10)
br label %40
40: ; preds = %17, %25, %28, %37, %9
%41 = getelementptr inbounds i8, i8* %10, i64 1
%42 = getelementptr inbounds i8, i8* %10, i64 4
%43 = icmp ugt i8* %42, %5
br i1 %43, label %8, label %9
}