#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct sock_fprog {
  int dummy;
};

/* Variables and functions */
#define EINVAL 129
#define ENOSYS 128
int /*<<< orphan*/ PR_SET_SECCOMP;
int /*<<< orphan*/ SECCOMP_MODE_FILTER;
int /*<<< orphan*/ SECCOMP_SET_MODE_FILTER;
int /*<<< orphan*/ debug(char *);
int /*<<< orphan*/ die(char *);
int errno;
int prctl(int /*<<< orphan*/, int /*<<< orphan*/, struct sock_fprog *);
int seccomp(int /*<<< orphan*/, int, struct sock_fprog *);
void sc_apply_seccomp_filter(struct sock_fprog *prog) {
  int err;
  err = seccomp(SECCOMP_SET_MODE_FILTER, 2, prog);
  if (err != 0) {
    switch (errno) {
    case ENOSYS:
      debug("kernel doesn't support the seccomp(2) syscall");
      break;
    case EINVAL:
      debug("kernel may not support the SECCOMP_FILTER_FLAG_LOG flag");
      break;
    }
    debug("falling back to prctl(2) syscall to load seccomp filter");
    err = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, prog);
    if (err != 0) {
      die("cannot apply seccomp profile");
    }
  }
}


x86 assembly (clang, -O0):
<sc_apply_seccomp_filter>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %rdi,-0x8(%rbp)
mov    0x2e85(%rip),%rax
mov    (%rax),%edi
mov    -0x8(%rbp),%rdx
mov    $0x2,%esi
call   1050 <seccomp@plt>
mov    %eax,-0xc(%rbp)
cmpl   $0x0,-0xc(%rbp)
je     1201 <sc_apply_seccomp_filter+0xc1>
mov    0x2e51(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x10(%rbp)
sub    $0x80,%eax
je     119f <sc_apply_seccomp_filter+0x5f>
jmp    118c <sc_apply_seccomp_filter+0x4c>
mov    -0x10(%rbp),%eax
sub    $0x81,%eax
je     11b0 <sc_apply_seccomp_filter+0x70>
jmp    11bc <sc_apply_seccomp_filter+0x7c>
lea    0xe5a(%rip),%rdi
call   1030 <debug@plt>
jmp    11bc <sc_apply_seccomp_filter+0x7c>
lea    0xe77(%rip),%rdi
call   1030 <debug@plt>
lea    0xea3(%rip),%rdi
call   1030 <debug@plt>
mov    0x2e11(%rip),%rax
mov    (%rax),%edi
mov    0x2e10(%rip),%rax
mov    (%rax),%esi
mov    -0x8(%rbp),%rdx
call   1040 <prctl@plt>
mov    %eax,-0xc(%rbp)
cmpl   $0x0,-0xc(%rbp)
je     11fc <sc_apply_seccomp_filter+0xbc>
lea    0xea7(%rip),%rdi
call   1060 <die@plt>
jmp    1201 <sc_apply_seccomp_filter+0xc1>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<sc_apply_seccomp_filter>:
push   %rbx
mov    %rdi,%rbx
mov    0x2e8d(%rip),%rax
mov    (%rax),%edi
mov    $0x2,%esi
mov    %rbx,%rdx
call   1050 <seccomp@plt>
test   %eax,%eax
je     11c1 <sc_apply_seccomp_filter+0x81>
mov    0x2e63(%rip),%rax
mov    (%rax),%eax
cmp    $0x80,%eax
je     117e <sc_apply_seccomp_filter+0x3e>
cmp    $0x81,%eax
jne    118a <sc_apply_seccomp_filter+0x4a>
lea    0xeb2(%rip),%rdi
jmp    1185 <sc_apply_seccomp_filter+0x45>
lea    0xe7b(%rip),%rdi
call   1030 <debug@plt>
lea    0xed5(%rip),%rdi
call   1030 <debug@plt>
mov    0x2e43(%rip),%rax
mov    (%rax),%edi
mov    0x2e42(%rip),%rax
mov    (%rax),%esi
mov    %rbx,%rdx
call   1040 <prctl@plt>
test   %eax,%eax
je     11c1 <sc_apply_seccomp_filter+0x81>
lea    0xee3(%rip),%rdi
pop    %rbx
jmp    1060 <die@plt>
pop    %rbx
ret

LLVM IR (-O0):
%struct.sock_fprog = type { i32 }
@SECCOMP_SET_MODE_FILTER = global i32 0
@errno = global i32 0
@.str = [46 x i8] c"kernel doesn't support the seccomp(2) syscall\00"
@.str.1 = [56 x i8] c"kernel may not support the SECCOMP_FILTER_FLAG_LOG flag\00"
@.str.2 = [56 x i8] c"falling back to prctl(2) syscall to load seccomp filter\00"
@PR_SET_SECCOMP = global i32 0
@SECCOMP_MODE_FILTER = global i32 0
@.str.3 = [29 x i8] c"cannot apply seccomp profile\00"
define void @sc_apply_seccomp_filter(%struct.sock_fprog* %0) {
%2 = alloca %struct.sock_fprog*
%3 = alloca i32
store %struct.sock_fprog* %0, %struct.sock_fprog** %2
%4 = load i32, i32* @SECCOMP_SET_MODE_FILTER
%5 = load %struct.sock_fprog*, %struct.sock_fprog** %2
%6 = call i32 @seccomp(i32 %4, i32 2, %struct.sock_fprog* %5)
store i32 %6, i32* %3
%7 = load i32, i32* %3
%8 = icmp ne i32 %7, 0
br i1 %8, label %9, label %26
9: ; preds = %1
%10 = load i32, i32* @errno
switch i32 %10, label %15 [
i32 128, label %11
i32 129, label %13
]
11: ; preds = %9
%12 = call i32 @debug(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str, i64 0, i64 0))
br label %15
13: ; preds = %9
%14 = call i32 @debug(i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.1, i64 0, i64 0))
br label %15
15: ; preds = %9, %13, %11
%16 = call i32 @debug(i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.2, i64 0, i64 0))
%17 = load i32, i32* @PR_SET_SECCOMP
%18 = load i32, i32* @SECCOMP_MODE_FILTER
%19 = load %struct.sock_fprog*, %struct.sock_fprog** %2
%20 = call i32 @prctl(i32 %17, i32 %18, %struct.sock_fprog* %19)
store i32 %20, i32* %3
%21 = load i32, i32* %3
%22 = icmp ne i32 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %15
%24 = call i32 @die(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.3, i64 0, i64 0))
br label %25
25: ; preds = %23, %15
br label %26
26: ; preds = %25, %1
ret void
}

LLVM IR (-O2):
%struct.sock_fprog = type { i32 }
@SECCOMP_SET_MODE_FILTER = global i32 0
@errno = global i32 0
@.str = [46 x i8] c"kernel doesn't support the seccomp(2) syscall\00"
@.str.1 = [56 x i8] c"kernel may not support the SECCOMP_FILTER_FLAG_LOG flag\00"
@.str.2 = [56 x i8] c"falling back to prctl(2) syscall to load seccomp filter\00"
@PR_SET_SECCOMP = global i32 0
@SECCOMP_MODE_FILTER = global i32 0
@.str.3 = [29 x i8] c"cannot apply seccomp profile\00"
define void @sc_apply_seccomp_filter(%struct.sock_fprog* %0) {
%2 = load i32, i32* @SECCOMP_SET_MODE_FILTER
%3 = tail call i32 @seccomp(i32 %2, i32 2, %struct.sock_fprog* %0)
%4 = icmp eq i32 %3, 0
br i1 %4, label %19, label %5
5: ; preds = %1
%6 = load i32, i32* @errno
switch i32 %6, label %11 [
i32 128, label %8
i32 129, label %7
]
7: ; preds = %5
br label %8
8: ; preds = %5, %7
%9 = phi i8* [ getelementptr inbounds ([56 x i8], [56 x i8]* @.str.1, i64 0, i64 0), %7 ], [ getelementptr inbounds ([46 x i8], [46 x i8]* @.str, i64 0, i64 0), %5 ]
%10 = tail call i32 @debug(i8* %9)
br label %11
11: ; preds = %8, %5
%12 = tail call i32 @debug(i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.2, i64 0, i64 0))
%13 = load i32, i32* @PR_SET_SECCOMP
%14 = load i32, i32* @SECCOMP_MODE_FILTER
%15 = tail call i32 @prctl(i32 %13, i32 %14, %struct.sock_fprog* %0)
%16 = icmp eq i32 %15, 0
br i1 %16, label %19, label %17
17: ; preds = %11
%18 = tail call i32 @die(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.3, i64 0, i64 0))
br label %19
19: ; preds = %11, %17, %1
ret void
}