#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct timeval {
  int dummy;
};

/* Variables and functions */
int EXIT_FAILURE;
int EXIT_SUCCESS;
int MAP_ANONYMOUS;
void *MAP_FAILED;
int MAP_PRIVATE;
int MAP_SHARED;
int O_CREAT;
int O_RDWR;
int O_TRUNC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ S_IRWXU;
unsigned long atol(char *);
int /*<<< orphan*/ exit(int);
scalar_t__ ftruncate(int, unsigned long);
int getpagesize();
int /*<<< orphan*/ gettimeofday(struct timeval *, int /*<<< orphan*/ *);
void *mmap(int /*<<< orphan*/ *, unsigned long, int, int, int,
           int /*<<< orphan*/);
int open(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ pause();
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ sleep(int);
int timeval_to_ms(struct timeval *);
int /*<<< orphan*/ unlink(char *);
int main(int argc, char **argv) {
  void *p, *map;
  int flags, fd = 0;
  int stride = getpagesize();
  unsigned long memfault_size;
  struct timeval tv_start, tv_end;
  if (argc == 1) {
    printf("Specify fault size\n");
    exit(-1);
  }
  memfault_size = atol(argv[1]);
  flags = MAP_ANONYMOUS | MAP_PRIVATE;
  if (argc > 2) {
    fd = open(argv[2], O_CREAT | O_TRUNC | O_RDWR, S_IRWXU);
    if (fd < 0) {
      perror("open");
      exit(EXIT_FAILURE);
    }
    if (ftruncate(fd, memfault_size)) {
      perror("ftruncate");
      exit(EXIT_FAILURE);
    }
    flags = MAP_SHARED;
    unlink(argv[1]);
  }
  map = mmap(NULL, memfault_size, PROT_READ | PROT_WRITE, flags, fd, 0);
  if (map == MAP_FAILED) {
    perror("mmap");
    exit(EXIT_FAILURE);
  }
  while (1) {
    struct timeval tv_start, tv_end;
    gettimeofday(&tv_start, NULL);
    for (p = map; p < (map + memfault_size); p += stride)
      *(volatile unsigned long *)p = (unsigned long)p;
    gettimeofday(&tv_end, NULL);
    printf("%d\n", timeval_to_ms(&tv_end) - timeval_to_ms(&tv_start));
    sleep(5);
  }
  pause();
  exit(EXIT_SUCCESS);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x28(%rbp)
mov    $0x0,%al
call   10b0 <getpagesize@plt>
mov    %eax,-0x2c(%rbp)
cmpl   $0x1,-0x8(%rbp)
jne    1209 <main+0x49>
lea    0xe08(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0xffffffff,%edi
call   10c0 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1080 <atol@plt>
mov    %rax,-0x38(%rbp)
mov    0x2d97(%rip),%rax
mov    (%rax),%eax
mov    0x2d6e(%rip),%rcx
or     (%rcx),%eax
mov    %eax,-0x24(%rbp)
cmpl   $0x2,-0x8(%rbp)
jle    12da <main+0x11a>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
mov    0x2db0(%rip),%rax
mov    (%rax),%esi
mov    0x2d9f(%rip),%rax
or     (%rax),%esi
mov    0x2d66(%rip),%rax
or     (%rax),%esi
mov    0x2d65(%rip),%rax
mov    (%rax),%edx
call   1090 <open@plt>
mov    %eax,-0x28(%rbp)
cmpl   $0x0,-0x28(%rbp)
jge    1291 <main+0xd1>
lea    0xd96(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2d1e(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
mov    -0x28(%rbp),%edi
mov    -0x38(%rbp),%rsi
call   1060 <ftruncate@plt>
cmp    $0x0,%rax
je     12c1 <main+0x101>
lea    0xd6b(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2cee(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
mov    0x2d10(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x24(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1030 <unlink@plt>
mov    -0x38(%rbp),%rsi
mov    0x2d03(%rip),%rax
mov    (%rax),%edx
mov    0x2cb2(%rip),%rax
or     (%rax),%edx
mov    -0x24(%rbp),%ecx
mov    -0x28(%rbp),%r8d
xor    %eax,%eax
mov    %eax,%edi
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    0x2c7e(%rip),%rcx
cmp    (%rcx),%rax
jne    1335 <main+0x175>
lea    0xd01(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2c7a(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
jmp    133a <main+0x17a>
lea    -0x50(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
call   1070 <gettimeofday@plt>
mov    -0x20(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x20(%rbp),%rcx
add    -0x38(%rbp),%rcx
cmp    %rcx,%rax
jae    1385 <main+0x1c5>
mov    -0x18(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x2c(%rbp),%ecx
mov    -0x18(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x18(%rbp)
jmp    134f <main+0x18f>
lea    -0x58(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
call   1070 <gettimeofday@plt>
lea    -0x58(%rbp),%rdi
call   10d0 <timeval_to_ms@plt>
mov    %eax,-0x5c(%rbp)
lea    -0x50(%rbp),%rdi
call   10d0 <timeval_to_ms@plt>
mov    -0x5c(%rbp),%esi
sub    %eax,%esi
lea    0xc75(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x5,%edi
call   10e0 <sleep@plt>
jmp    133a <main+0x17a>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%r15
mov    %edi,%ebp
xor    %r12d,%r12d
xor    %eax,%eax
call   10c0 <getpagesize@plt>
cmp    $0x1,%ebp
je     1330 <main+0x160>
mov    %eax,%r14d
mov    0x8(%r15),%rdi
call   1090 <atol@plt>
mov    %rax,%rbx
cmp    $0x3,%ebp
jl     1269 <main+0x99>
mov    0x10(%r15),%rdi
mov    0x2de3(%rip),%rax
mov    0x2dd4(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    0x2d99(%rip),%rax
or     (%rax),%esi
mov    0x2d98(%rip),%rax
mov    (%rax),%edx
call   10a0 <open@plt>
test   %eax,%eax
js     134f <main+0x17f>
mov    %eax,%r12d
mov    %eax,%edi
mov    %rbx,%rsi
call   1070 <ftruncate@plt>
test   %rax,%rax
jne    1358 <main+0x188>
mov    0x2d7c(%rip),%rax
mov    (%rax),%ebp
mov    0x8(%r15),%rdi
call   1030 <unlink@plt>
jmp    127b <main+0xab>
mov    0x2d48(%rip),%rax
mov    0x2d21(%rip),%rcx
mov    (%rcx),%ebp
or     (%rax),%ebp
mov    0x2d66(%rip),%rax
mov    0x2d17(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
xor    %edi,%edi
mov    %rbx,%rsi
mov    %ebp,%ecx
mov    %r12d,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,%r13
mov    0x2ce7(%rip),%rax
cmp    (%rax),%r13
je     1346 <main+0x176>
add    %r13,%rbx
movslq %r14d,%r12
lea    0x10(%rsp),%r14
lea    0x8(%rsp),%r15
jmp    1308 <main+0x138>
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
mov    %r15,%rdi
xor    %esi,%esi
call   1080 <gettimeofday@plt>
mov    %r15,%rdi
call   10e0 <timeval_to_ms@plt>
mov    %eax,%ebp
mov    %r14,%rdi
call   10e0 <timeval_to_ms@plt>
sub    %eax,%ebp
lea    0xd1f(%rip),%rdi
mov    %ebp,%esi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0x5,%edi
call   10f0 <sleep@plt>
mov    %r14,%rdi
xor    %esi,%esi
call   1080 <gettimeofday@plt>
cmp    %rbx,%r13
jae    12d0 <main+0x100>
mov    %r13,%rax
mov    %r13,%rcx
nopl   (%rax)
mov    %rax,(%rcx)
add    %r12,%rcx
add    %r12,%rax
cmp    %rbx,%rcx
jb     1320 <main+0x150>
jmp    12d0 <main+0x100>
lea    0xce1(%rip),%rdi
call   1040 <puts@plt>
mov    $0xffffffff,%edi
call   10d0 <exit@plt>
lea    0xcc2(%rip),%rdi
jmp    135f <main+0x18f>
lea    0xcaa(%rip),%rdi
jmp    135f <main+0x18f>
lea    0xca6(%rip),%rdi
call   10b0 <perror@plt>
mov    0x2c3d(%rip),%rax
mov    (%rax),%edi
call   10d0 <exit@plt>

LLVM IR (-O0):
%struct.timeval = type { i32 }
@.str = [20 x i8] c"Specify fault size\0A\00"
@MAP_ANONYMOUS = global i32 0
@MAP_PRIVATE = global i32 0
@O_CREAT = global i32 0
@O_TRUNC = global i32 0
@O_RDWR = global i32 0
@S_IRWXU = global i32 0
@.str.1 = [5 x i8] c"open\00"
@EXIT_FAILURE = global i32 0
@.str.2 = [10 x i8] c"ftruncate\00"
@MAP_SHARED = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_FAILED = global i8* null
@.str.3 = [5 x i8] c"mmap\00"
@.str.4 = [4 x i8] c"%d\0A\00"
@EXIT_SUCCESS = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i64
%12 = alloca %struct.timeval
%13 = alloca %struct.timeval
%14 = alloca %struct.timeval
%15 = alloca %struct.timeval
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %9
%16 = call i32 (...) @getpagesize()
store i32 %16, i32* %10
%17 = load i32, i32* %4
%18 = icmp eq i32 %17, 1
br i1 %18, label %19, label %22
19: ; preds = %2
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0))
%21 = call i32 @exit(i32 -1)
unreachable
22: ; preds = %2
%23 = load i8**, i8*** %5
%24 = getelementptr inbounds i8*, i8** %23, i64 1
%25 = load i8*, i8** %24
%26 = call i64 @atol(i8* %25)
store i64 %26, i64* %11
%27 = load i32, i32* @MAP_ANONYMOUS
%28 = load i32, i32* @MAP_PRIVATE
%29 = or i32 %27, %28
store i32 %29, i32* %8
%30 = load i32, i32* %4
%31 = icmp sgt i32 %30, 2
br i1 %31, label %32, label %64
32: ; preds = %22
%33 = load i8**, i8*** %5
%34 = getelementptr inbounds i8*, i8** %33, i64 2
%35 = load i8*, i8** %34
%36 = load i32, i32* @O_CREAT
%37 = load i32, i32* @O_TRUNC
%38 = or i32 %36, %37
%39 = load i32, i32* @O_RDWR
%40 = or i32 %38, %39
%41 = load i32, i32* @S_IRWXU
%42 = call i32 @open(i8* %35, i32 %40, i32 %41)
store i32 %42, i32* %9
%43 = load i32, i32* %9
%44 = icmp slt i32 %43, 0
br i1 %44, label %45, label %49
45: ; preds = %32
%46 = call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
%47 = load i32, i32* @EXIT_FAILURE
%48 = call i32 @exit(i32 %47)
unreachable
49: ; preds = %32
%50 = load i32, i32* %9
%51 = load i64, i64* %11
%52 = call i64 @ftruncate(i32 %50, i64 %51)
%53 = icmp ne i64 %52, 0
br i1 %53, label %54, label %58
54: ; preds = %49
%55 = call i32 @perror(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0))
%56 = load i32, i32* @EXIT_FAILURE
%57 = call i32 @exit(i32 %56)
unreachable
58: ; preds = %49
%59 = load i32, i32* @MAP_SHARED
store i32 %59, i32* %8
%60 = load i8**, i8*** %5
%61 = getelementptr inbounds i8*, i8** %60, i64 1
%62 = load i8*, i8** %61
%63 = call i32 @unlink(i8* %62)
br label %64
64: ; preds = %58, %22
%65 = load i64, i64* %11
%66 = load i32, i32* @PROT_READ
%67 = load i32, i32* @PROT_WRITE
%68 = or i32 %66, %67
%69 = load i32, i32* %8
%70 = load i32, i32* %9
%71 = call i8* @mmap(i32* null, i64 %65, i32 %68, i32 %69, i32 %70, i32 0)
store i8* %71, i8** %7
%72 = load i8*, i8** %7
%73 = load i8*, i8** @MAP_FAILED
%74 = icmp eq i8* %72, %73
br i1 %74, label %75, label %79
75: ; preds = %64
%76 = call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0))
%77 = load i32, i32* @EXIT_FAILURE
%78 = call i32 @exit(i32 %77)
unreachable
79: ; preds = %64
br label %80
80: ; preds = %79, %99
%81 = call i32 @gettimeofday(%struct.timeval* %14, i32* null)
%82 = load i8*, i8** %7
store i8* %82, i8** %6
br label %83
83: ; preds = %94, %80
%84 = load i8*, i8** %6
%85 = load i8*, i8** %7
%86 = load i64, i64* %11
%87 = getelementptr i8, i8* %85, i64 %86
%88 = icmp ult i8* %84, %87
br i1 %88, label %89, label %99
89: ; preds = %83
%90 = load i8*, i8** %6
%91 = ptrtoint i8* %90 to i64
%92 = load i8*, i8** %6
%93 = bitcast i8* %92 to i64*
store volatile i64 %91, i64* %93
br label %94
94: ; preds = %89
%95 = load i32, i32* %10
%96 = load i8*, i8** %6
%97 = sext i32 %95 to i64
%98 = getelementptr i8, i8* %96, i64 %97
store i8* %98, i8** %6
br label %83
99: ; preds = %83
%100 = call i32 @gettimeofday(%struct.timeval* %15, i32* null)
%101 = call i32 @timeval_to_ms(%struct.timeval* %15)
%102 = call i32 @timeval_to_ms(%struct.timeval* %14)
%103 = sub nsw i32 %101, %102
%104 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.4, i64 0, i64 0), i32 %103)
%105 = call i32 @sleep(i32 5)
br label %80
}

LLVM IR (-O2):
%struct.timeval = type { i32 }
@MAP_ANONYMOUS = global i32 0
@MAP_PRIVATE = global i32 0
@O_CREAT = global i32 0
@O_TRUNC = global i32 0
@O_RDWR = global i32 0
@S_IRWXU = global i32 0
@.str.1 = [5 x i8] c"open\00"
@EXIT_FAILURE = global i32 0
@.str.2 = [10 x i8] c"ftruncate\00"
@MAP_SHARED = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_FAILED = global i8* null
@.str.3 = [5 x i8] c"mmap\00"
@.str.4 = [4 x i8] c"%d\0A\00"
@EXIT_SUCCESS = global i32 0
@str = [19 x i8] c"Specify fault size\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.timeval
%4 = alloca %struct.timeval
%5 = tail call i32 (...) @getpagesize()
%6 = icmp eq i32 %0, 1
br i1 %6, label %7, label %10
7: ; preds = %2
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str, i64 0, i64 0))
%9 = tail call i32 @exit(i32 -1)
unreachable
10: ; preds = %2
%11 = getelementptr inbounds i8*, i8** %1, i64 1
%12 = load i8*, i8** %11
%13 = tail call i64 @atol(i8* %12)
%14 = load i32, i32* @MAP_ANONYMOUS
%15 = load i32, i32* @MAP_PRIVATE
%16 = or i32 %15, %14
%17 = icmp sgt i32 %0, 2
br i1 %17, label %18, label %44
18: ; preds = %10
%19 = getelementptr inbounds i8*, i8** %1, i64 2
%20 = load i8*, i8** %19
%21 = load i32, i32* @O_CREAT
%22 = load i32, i32* @O_TRUNC
%23 = or i32 %22, %21
%24 = load i32, i32* @O_RDWR
%25 = or i32 %23, %24
%26 = load i32, i32* @S_IRWXU
%27 = tail call i32 @open(i8* %20, i32 %25, i32 %26)
%28 = icmp slt i32 %27, 0
br i1 %28, label %29, label %33
29: ; preds = %18
%30 = tail call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
%31 = load i32, i32* @EXIT_FAILURE
%32 = tail call i32 @exit(i32 %31)
unreachable
33: ; preds = %18
%34 = tail call i64 @ftruncate(i32 %27, i64 %13)
%35 = icmp eq i64 %34, 0
br i1 %35, label %40, label %36
36: ; preds = %33
%37 = tail call i32 @perror(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0))
%38 = load i32, i32* @EXIT_FAILURE
%39 = tail call i32 @exit(i32 %38)
unreachable
40: ; preds = %33
%41 = load i32, i32* @MAP_SHARED
%42 = load i8*, i8** %11
%43 = tail call i32 @unlink(i8* %42)
br label %44
44: ; preds = %40, %10
%45 = phi i32 [ %27, %40 ], [ 0, %10 ]
%46 = phi i32 [ %41, %40 ], [ %16, %10 ]
%47 = load i32, i32* @PROT_READ
%48 = load i32, i32* @PROT_WRITE
%49 = or i32 %48, %47
%50 = tail call i8* @mmap(i32* null, i64 %13, i32 %49, i32 %46, i32 %45, i32 0)
%51 = load i8*, i8** @MAP_FAILED
%52 = icmp eq i8* %50, %51
br i1 %52, label %59, label %53
53: ; preds = %44
%54 = bitcast %struct.timeval* %3 to i8*
%55 = bitcast %struct.timeval* %4 to i8*
%56 = getelementptr i8, i8* %50, i64 %13
%57 = icmp ult i8* %50, %56
%58 = sext i32 %5 to i64
br label %63
59: ; preds = %44
%60 = tail call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0))
%61 = load i32, i32* @EXIT_FAILURE
%62 = tail call i32 @exit(i32 %61)
unreachable
63: ; preds = %53, %71
%64 = call i32 @gettimeofday(%struct.timeval* %3, i32* null)
br i1 %57, label %65, label %71
65: ; preds = %63, %65
%66 = phi i8* [ %69, %65 ], [ %50, %63 ]
%67 = ptrtoint i8* %66 to i64
%68 = bitcast i8* %66 to i64*
store volatile i64 %67, i64* %68
%69 = getelementptr i8, i8* %66, i64 %58
%70 = icmp ult i8* %69, %56
br i1 %70, label %65, label %71
71: ; preds = %65, %63
%72 = call i32 @gettimeofday(%struct.timeval* %4, i32* null)
%73 = call i32 @timeval_to_ms(%struct.timeval* %4)
%74 = call i32 @timeval_to_ms(%struct.timeval* %3)
%75 = sub nsw i32 %73, %74
%76 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([4 x i8], [4 x i8]* @.str.4, i64 0, i64 0), i32 %75)
%77 = call i32 @sleep(i32 5)
br label %63
}