#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *MAP_FAILED;
int /*<<< orphan*/ MAP_SHARED;
int /*<<< orphan*/ O_RDWR;
int PROT_READ;
int PROT_WRITE;
int atoi(char *);
size_t atox(char *);
int /*<<< orphan*/ close(int);
char *mmap(int /*<<< orphan*/, int, int, int /*<<< orphan*/, int, size_t);
int /*<<< orphan*/ munmap(char *, int);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int rand();
int /*<<< orphan*/ randtest(char *, int);
int /*<<< orphan*/ srand(int /*<<< orphan*/);
int /*<<< orphan*/ time(int /*<<< orphan*/);
int main(int args, char *arg[]) {
  int i;
  int fd;
  int len;
  char *mem;
  srand(time(0));
  printf("rand=%d\n", rand());
  if ((fd = open("/dev/mem", O_RDWR)) < 0) {
    perror("open error");
    return -1;
  }
  printf("open ok\n");
  size_t addr = (size_t)(0x11000000);
  addr = atox(arg[1]);
  len = atoi(arg[2]);
  mem = mmap(0, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, addr);
  if (mem == MAP_FAILED) {
    perror("mmap error:");
    return 1;
  }
  randtest(mem, len);
  printf("\n");
  munmap(mem, 10);
  close(fd);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
xor    %edi,%edi
call   1090 <time@plt>
mov    %eax,%edi
call   1080 <srand@plt>
mov    $0x0,%al
call   10e0 <rand@plt>
mov    %eax,%esi
lea    0xe0c(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2dd6(%rip),%rax
mov    (%rax),%esi
lea    0xdfe(%rip),%rdi
call   10b0 <open@plt>
mov    %eax,-0x18(%rbp)
cmp    $0x0,%eax
jge    1234 <main+0x74>
lea    0xdef(%rip),%rdi
call   10c0 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    12ff <main+0x13f>
lea    0xde2(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movq   $0x11000000,-0x30(%rbp)
11
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1040 <atox@plt>
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   10d0 <atoi@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x1c(%rbp),%esi
mov    0x2d83(%rip),%rax
mov    (%rax),%edx
mov    0x2d4a(%rip),%rax
or     (%rax),%edx
mov    0x2d61(%rip),%rax
mov    (%rax),%ecx
mov    -0x18(%rbp),%r8d
mov    -0x30(%rbp),%r9
xor    %edi,%edi
call   1050 <mmap@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    0x2d19(%rip),%rcx
cmp    (%rcx),%rax
jne    12c8 <main+0x108>
lea    0xd6f(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    12ff <main+0x13f>
mov    -0x28(%rbp),%rdi
mov    -0x1c(%rbp),%esi
call   1030 <randtest@plt>
lea    0xd2c(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x28(%rbp),%rdi
mov    $0xa,%esi
call   10a0 <munmap@plt>
mov    -0x18(%rbp),%edi
call   1070 <close@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %rsi,%r14
xor    %edi,%edi
call   10b0 <time@plt>
mov    %eax,%edi
call   10a0 <srand@plt>
xor    %eax,%eax
call   1100 <rand@plt>
lea    0xdfa(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1080 <printf@plt>
mov    0x2dc2(%rip),%rax
mov    (%rax),%esi
lea    0xdea(%rip),%rdi
call   10d0 <open@plt>
test   %eax,%eax
js     12c5 <main+0xe5>
mov    %eax,%r15d
lea    0xdf3(%rip),%rdi
call   1040 <puts@plt>
mov    0x8(%r14),%rdi
call   1060 <atox@plt>
mov    %rax,%rbx
mov    0x10(%r14),%rdi
call   10f0 <atoi@plt>
mov    %eax,%ebp
mov    0x2d9f(%rip),%rax
mov    0x2d68(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2d7d(%rip),%rax
mov    (%rax),%ecx
xor    %r14d,%r14d
xor    %edi,%edi
mov    %ebp,%esi
mov    %r15d,%r8d
mov    %rbx,%r9
call   1070 <mmap@plt>
mov    %rax,%rbx
mov    0x2d37(%rip),%rax
cmp    (%rax),%rbx
je     12d9 <main+0xf9>
mov    %rbx,%rdi
mov    %ebp,%esi
call   1050 <randtest@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
mov    %rbx,%rdi
mov    $0xa,%esi
call   10c0 <munmap@plt>
mov    %r15d,%edi
call   1090 <close@plt>
mov    %r14d,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xd46(%rip),%rdi
call   10e0 <perror@plt>
mov    $0xffffffff,%r14d
jmp    12b7 <main+0xd7>
lea    0xd3d(%rip),%rdi
call   10e0 <perror@plt>
mov    $0x1,%r14d
jmp    12b7 <main+0xd7>

LLVM IR (-O0):
@.str = [9 x i8] c"rand=%d\0A\00"
@.str.1 = [9 x i8] c"/dev/mem\00"
@O_RDWR = global i32 0
@.str.2 = [11 x i8] c"open error\00"
@.str.3 = [9 x i8] c"open ok\0A\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i8* null
@.str.4 = [12 x i8] c"mmap error:\00"
@.str.5 = [2 x i8] c"\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i8*
%10 = alloca i64
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%11 = call i32 @time(i32 0)
%12 = call i32 @srand(i32 %11)
%13 = call i32 (...) @rand()
%14 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i32 %13)
%15 = load i32, i32* @O_RDWR
%16 = call i32 @open(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 %15)
store i32 %16, i32* %7
%17 = icmp slt i32 %16, 0
br i1 %17, label %18, label %20
18: ; preds = %2
%19 = call i32 @perror(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.2, i64 0, i64 0))
store i32 -1, i32* %3
br label %52
20: ; preds = %2
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0))
store i64 285212672, i64* %10
%22 = load i8**, i8*** %5
%23 = getelementptr inbounds i8*, i8** %22, i64 1
%24 = load i8*, i8** %23
%25 = call i64 @atox(i8* %24)
store i64 %25, i64* %10
%26 = load i8**, i8*** %5
%27 = getelementptr inbounds i8*, i8** %26, i64 2
%28 = load i8*, i8** %27
%29 = call i32 @atoi(i8* %28)
store i32 %29, i32* %8
%30 = load i32, i32* %8
%31 = load i32, i32* @PROT_READ
%32 = load i32, i32* @PROT_WRITE
%33 = or i32 %31, %32
%34 = load i32, i32* @MAP_SHARED
%35 = load i32, i32* %7
%36 = load i64, i64* %10
%37 = call i8* @mmap(i32 0, i32 %30, i32 %33, i32 %34, i32 %35, i64 %36)
store i8* %37, i8** %9
%38 = load i8*, i8** %9
%39 = load i8*, i8** @MAP_FAILED
%40 = icmp eq i8* %38, %39
br i1 %40, label %41, label %43
41: ; preds = %20
%42 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0))
store i32 1, i32* %3
br label %52
43: ; preds = %20
%44 = load i8*, i8** %9
%45 = load i32, i32* %8
%46 = call i32 @randtest(i8* %44, i32 %45)
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
%48 = load i8*, i8** %9
%49 = call i32 @munmap(i8* %48, i32 10)
%50 = load i32, i32* %7
%51 = call i32 @close(i32 %50)
store i32 0, i32* %3
br label %52
52: ; preds = %43, %41, %18
%53 = load i32, i32* %3
ret i32 %53
}

LLVM IR (-O2):
@.str = [9 x i8] c"rand=%d\0A\00"
@.str.1 = [9 x i8] c"/dev/mem\00"
@O_RDWR = global i32 0
@.str.2 = [11 x i8] c"open error\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i8* null
@.str.4 = [12 x i8] c"mmap error:\00"
@str = [8 x i8] c"open ok\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = tail call i32 @time(i32 0)
%4 = tail call i32 @srand(i32 %3)
%5 = tail call i32 (...) @rand()
%6 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i32 %5)
%7 = load i32, i32* @O_RDWR
%8 = tail call i32 @open(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 %7)
%9 = icmp slt i32 %8, 0
br i1 %9, label %10, label %12
10: ; preds = %2
%11 = tail call i32 @perror(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.2, i64 0, i64 0))
br label %34
12: ; preds = %2
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([8 x i8], [8 x i8]* @str, i64 0, i64 0))
%14 = getelementptr inbounds i8*, i8** %1, i64 1
%15 = load i8*, i8** %14
%16 = tail call i64 @atox(i8* %15)
%17 = getelementptr inbounds i8*, i8** %1, i64 2
%18 = load i8*, i8** %17
%19 = tail call i32 @atoi(i8* %18)
%20 = load i32, i32* @PROT_READ
%21 = load i32, i32* @PROT_WRITE
%22 = or i32 %21, %20
%23 = load i32, i32* @MAP_SHARED
%24 = tail call i8* @mmap(i32 0, i32 %19, i32 %22, i32 %23, i32 %8, i64 %16)
%25 = load i8*, i8** @MAP_FAILED
%26 = icmp eq i8* %24, %25
br i1 %26, label %27, label %29
27: ; preds = %12
%28 = tail call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0))
br label %34
29: ; preds = %12
%30 = tail call i32 @randtest(i8* %24, i32 %19)
%31 = tail call i32 @putchar(i32 10)
%32 = tail call i32 @munmap(i8* %24, i32 10)
%33 = tail call i32 @close(i32 %8)
br label %34
34: ; preds = %27, %29, %10
%35 = phi i32 [ -1, %10 ], [ 1, %27 ], [ 0, %29 ]
ret i32 %35
}