// File: /workspace/github_c_makefile_star2_O1/rb-de0[P]hashverifier-for-monacoin/Lyra2RE/Lyra2.c
// Function: LYRA2
int LYRA2(void *K, uint64_t kLen, const void *pwd, uint64_t pwdlen, const void *salt, uint64_t saltlen, uint64_t timeCost, uint64_t nRows, uint64_t nCols) {

    //============================= Basic variables ============================//
    int64_t row = 2; //index of row to be processed
    int64_t prev = 1; //index of prev (last row ever computed/modified)
    int64_t rowa = 0; //index of row* (a previous row, deterministically picked during Setup and randomly picked while Wandering)
    int64_t tau; //Time Loop iterator
    int64_t step = 1; //Visitation step (used during Setup and Wandering phases)
    int64_t window = 2; //Visitation window (used to define which rows can be revisited during Setup)
    int64_t gap = 1; //Modifier to the step, assuming the values 1 or -1
    int64_t i; //auxiliary iteration counter
    //==========================================================================/

    //========== Initializing the Memory Matrix and pointers to it =============//
    //Tries to allocate enough space for the whole memory matrix


    const int64_t ROW_LEN_INT64 = BLOCK_LEN_INT64 * nCols;
    const int64_t ROW_LEN_BYTES = ROW_LEN_INT64 * 8;

    i = (int64_t) ((int64_t) nRows * (int64_t) ROW_LEN_BYTES);
    uint64_t *wholeMatrix = malloc(i);
    if (wholeMatrix == NULL) {
      return -1;
    }
	memset(wholeMatrix, 0, i);

    //Allocates pointers to each row of the matrix
    uint64_t **memMatrix = malloc(nRows * sizeof (uint64_t*));
    if (memMatrix == NULL) {
      return -1;
    }
    //Places the pointers in the correct positions
    uint64_t *ptrWord = wholeMatrix;
    for (i = 0; i < nRows; i++) {
      memMatrix[i] = ptrWord;
      ptrWord += ROW_LEN_INT64;
    }
    //==========================================================================/

    //============= Getting the password + salt + basil padded with 10*1 ===============//
    //OBS.:The memory matrix will temporarily hold the password: not for saving memory,
    //but this ensures that the password copied locally will be overwritten as soon as possible

    //First, we clean enough blocks for the password, salt, basil and padding
    uint64_t nBlocksInput = ((saltlen + pwdlen + 6 * sizeof (uint64_t)) / BLOCK_LEN_BLAKE2_SAFE_BYTES) + 1;
    byte *ptrByte = (byte*) wholeMatrix;
    memset(ptrByte, 0, nBlocksInput * BLOCK_LEN_BLAKE2_SAFE_BYTES);

    //Prepends the password
    memcpy(ptrByte, pwd, pwdlen);
    ptrByte += pwdlen;

    //Concatenates the salt
    memcpy(ptrByte, salt, saltlen);
    ptrByte += saltlen;

    //Concatenates the basil: every integer passed as parameter, in the order they are provided by the interface
    memcpy(ptrByte, &kLen, sizeof (uint64_t));
    ptrByte += sizeof (uint64_t);
    memcpy(ptrByte, &pwdlen, sizeof (uint64_t));
    ptrByte += sizeof (uint64_t);
    memcpy(ptrByte, &saltlen, sizeof (uint64_t));
    ptrByte += sizeof (uint64_t);
    memcpy(ptrByte, &timeCost, sizeof (uint64_t));
    ptrByte += sizeof (uint64_t);
    memcpy(ptrByte, &nRows, sizeof (uint64_t));
    ptrByte += sizeof (uint64_t);
    memcpy(ptrByte, &nCols, sizeof (uint64_t));
    ptrByte += sizeof (uint64_t);

    //Now comes the padding
    *ptrByte = 0x80; //first byte of padding: right after the password
    ptrByte = (byte*) wholeMatrix; //resets the pointer to the start of the memory matrix
    ptrByte += nBlocksInput * BLOCK_LEN_BLAKE2_SAFE_BYTES - 1; //sets the pointer to the correct position: end of incomplete block
    *ptrByte ^= 0x01; //last byte of padding: at the end of the last incomplete block
    //==========================================================================/

    //======================= Initializing the Sponge State ====================//
    //Sponge state: 16 uint64_t, BLOCK_LEN_INT64 words of them for the bitrate (b) and the remainder for the capacity (c)
    uint64_t *state = malloc(16 * sizeof (uint64_t));
    if (state == NULL) {
      return -1;
    }
    initState(state);
    //==========================================================================/

    //================================ Setup Phase =============================//
    //Absorbing salt, password and basil: this is the only place in which the block length is hard-coded to 512 bits
    ptrWord = wholeMatrix;
    for (i = 0; i < nBlocksInput; i++) {
      absorbBlockBlake2Safe(state, ptrWord); //absorbs each block of pad(pwd || salt || basil)
      ptrWord += BLOCK_LEN_BLAKE2_SAFE_INT64; //goes to next block of pad(pwd || salt || basil)
    }

    //Initializes M[0] and M[1]
    reducedSqueezeRow0(state, memMatrix[0], nCols); //The locally copied password is most likely overwritten here
    reducedDuplexRow1(state, memMatrix[0], memMatrix[1], nCols);

    do {
      //M[row] = rand; //M[row*] = M[row*] XOR rotW(rand)
      reducedDuplexRowSetup(state, memMatrix[prev], memMatrix[rowa], memMatrix[row], nCols);


      //updates the value of row* (deterministically picked during Setup))
      rowa = (rowa + step) & (window - 1);
      //update prev: it now points to the last row ever computed
      prev = row;
      //updates row: goes to the next row to be computed
      row++;

      //Checks if all rows in the window where visited.
      if (rowa == 0) {
      step = window + gap; //changes the step: approximately doubles its value
      window *= 2; //doubles the size of the re-visitation window
      gap = -gap; //inverts the modifier to the step
    }

    } while (row < nRows);
    //==========================================================================/

    //============================ Wandering Phase =============================//
    row = 0; //Resets the visitation to the first row of the memory matrix
    for (tau = 1; tau <= timeCost; tau++) {
    	//Step is approximately half the number of all rows of the memory matrix for an odd tau; otherwise, it is -1
    	step = (tau % 2 == 0) ? -1 : nRows / 2 - 1;
    	do {
  	    //Selects a pseudorandom index row*
  	    //------------------------------------------------------------------------------------------
  	    //rowa = ((unsigned int)state[0]) & (nRows-1);	//(USE THIS IF nRows IS A POWER OF 2)
  	    rowa = ((uint64_t) (state[0])) % nRows; //(USE THIS FOR THE "GENERIC" CASE)
  	    //------------------------------------------------------------------------------------------

  	    //Performs a reduced-round duplexing operation over M[row*] XOR M[prev], updating both M[row*] and M[row]
  	    reducedDuplexRow(state, memMatrix[prev], memMatrix[rowa], memMatrix[row], nCols);

  	    //update prev: it now points to the last row ever computed
  	    prev = row;

  	    //updates row: goes to the next row to be computed
  	    //------------------------------------------------------------------------------------------
  	    //row = (row + step) & (nRows-1);	//(USE THIS IF nRows IS A POWER OF 2)
  	    row = (row + step) % nRows; //(USE THIS FOR THE "GENERIC" CASE)
  	    //------------------------------------------------------------------------------------------

      } while (row != 0);
    }
    //==========================================================================/

    //============================ Wrap-up Phase ===============================//
    //Absorbs the last block of the memory matrix
    absorbBlock(state, memMatrix[rowa]);

    //Squeezes the key
    squeeze(state, K, kLen);
    //==========================================================================/

    //========================= Freeing the memory =============================//
    free(memMatrix);
    free(wholeMatrix);

    //Wiping out the sponge's internal state before freeing it
    memset(state, 0, 16 * sizeof (uint64_t));
    free(state);
    //==========================================================================/

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x38, %rsp
movq %r9, %r14
movq %r8, -0x30(%rbp)
movq %rcx, -0x38(%rbp)
movq %rdx, -0x48(%rbp)
movq %rsi, -0x50(%rbp)
movq %rdi, %r12
movq 0x20(%rbp), %rax
movq 0x18(%rbp), %r15
shlq $0x5, %rax
leaq (%rax,%rax,2), %rbx
movq %rbx, %r13
imulq %r15, %r13
movq %r13, %rdi
callq 0x10b0
movl $0xffffffff, %ecx       # imm = 0xFFFFFFFF
testq %rax, %rax
je 0x1c03
movq %rax, -0x40(%rbp)
movq %rax, %rdi
xorl %esi, %esi
movq %r13, %rdx
callq 0x1080
leaq (,%r15,8), %rdi
callq 0x10b0
testq %rax, %rax
je 0x1bfe
movq %rax, %r13
movq %r12, -0x58(%rbp)
testq %r15, %r15
movq -0x40(%rbp), %rsi
je 0x1988
xorl %eax, %eax
movq %rsi, %rcx
movq %rcx, (%r13,%rax,8)
addq %rbx, %rcx
incq %rax
cmpq %rax, %r15
jne 0x1978
movq -0x38(%rbp), %r15
leaq (%r15,%r14), %r12
addq $0x30, %r12
movq %r12, %rax
andq $-0x40, %rax
movq %rax, -0x60(%rbp)
leaq 0x40(%rax), %rdx
movq %rsi, %rbx
movq %rsi, %rdi
xorl %esi, %esi
callq 0x1080
movq %rbx, %rdi
movq -0x48(%rbp), %rsi
movq %r15, %rdx
callq 0x10a0
movq -0x40(%rbp), %rbx
addq %r15, %rbx
movq %rbx, %rdi
movq -0x30(%rbp), %rsi
movq %r14, %rdx
callq 0x10a0
movq -0x50(%rbp), %rax
movq %rax, (%r14,%rbx)
movq %r15, 0x8(%r14,%rbx)
movq %r14, 0x10(%r14,%rbx)
movq 0x10(%rbp), %rax
movq %rax, 0x18(%r14,%rbx)
movq 0x18(%rbp), %rax
movq %rax, 0x20(%r14,%rbx)
movq 0x20(%rbp), %rax
movq %rax, 0x28(%r14,%rbx)
movb $-0x80, 0x30(%r14,%rbx)
movq -0x40(%rbp), %rbx
movq -0x60(%rbp), %rax
xorb $0x1, 0x3f(%rbx,%rax)
movl $0x80, %edi
callq 0x10b0
testq %rax, %rax
movl $0xffffffff, %ecx       # imm = 0xFFFFFFFF
je 0x1c03
movq %rax, %r14
shrq $0x6, %r12
movq %rax, %rdi
callq 0x1f44
incq %r12
movq %r14, %rdi
movq %rbx, %rsi
callq 0x3e38
addq $0x40, %rbx
decq %r12
jne 0x1a3f
movq (%r13), %rbx
movq %r14, %rdi
movq %rbx, %rsi
movq 0x20(%rbp), %r15
movq %r15, %rdx
callq 0x3e80
movq 0x8(%r13), %rdx
movq %r14, %rdi
movq %rbx, %rsi
movq %r15, %rcx
callq 0x4197
movq 0x18(%rbp), %rcx
cmpq $0x4, %rcx
movl $0x3, %eax
cmovaeq %rcx, %rax
movl $0x2, %edi
movl $0x2, %ecx
subq %rax, %rcx
movq %rcx, -0x48(%rbp)
movl $0x1, %r12d
xorl %ebx, %ebx
movl $0x1, %r15d
movl $0x1, %r8d
movq %r8, -0x30(%rbp)
movq %rdi, -0x38(%rbp)
movq (%r13,%rbx,8), %rdx
movq (%r13,%r12,8), %rsi
movq 0x8(%r13,%r12,8), %rcx
movq %r14, %rdi
movq 0x20(%rbp), %r8
callq 0x42dd
movq -0x30(%rbp), %r8
movq -0x38(%rbp), %rdi
movq %rbx, %rax
addq %r8, %rax
leaq -0x1(%rdi), %rbx
leaq (%rdi,%r15), %rdx
movq %r15, %rsi
negq %rsi
andq %rax, %rbx
sete %cl
cmoveq %rsi, %r15
cmoveq %rdx, %r8
shlq %cl, %rdi
movq -0x48(%rbp), %rax
addq %r12, %rax
incq %rax
incq %r12
cmpq $0x1, %rax
jne 0x1ab1
cmpq $0x0, 0x10(%rbp)
je 0x1b9a
movq 0x18(%rbp), %rsi
movq %rsi, %rax
shrq %rax
decq %rax
movq %rax, -0x30(%rbp)
movl $0x1, %eax
movq %rax, -0x38(%rbp)
andl $0x1, %eax
cmpq $0x1, %rax
movl $0x0, %r15d
sbbq %r15, %r15
orq -0x30(%rbp), %r15
movq %r12, %rcx
xorl %edx, %edx
movq %rdx, %r12
movq (%r14), %rax
xorl %edx, %edx
divq %rsi
movq %rdx, %rbx
movq (%r13,%rcx,8), %rsi
movq (%r13,%rdx,8), %rdx
movq (%r13,%r12,8), %rcx
movq %r14, %rdi
movq 0x20(%rbp), %r8
callq 0x450c
movq 0x18(%rbp), %rsi
leaq (%r12,%r15), %rax
xorl %edx, %edx
divq %rsi
movq %r12, %rcx
testq %rdx, %rdx
jne 0x1b4e
movq -0x38(%rbp), %rcx
leaq 0x1(%rcx), %rax
cmpq 0x10(%rbp), %rcx
jne 0x1b31
movq (%r13,%rbx,8), %rsi
movq %r14, %rdi
callq 0x3dd0
movq %r14, %rdi
movq -0x58(%rbp), %rsi
movq -0x50(%rbp), %rdx
callq 0x1fcc
movq %r13, %rdi
callq 0x1030
movq -0x40(%rbp), %rdi
callq 0x1030
xorps %xmm0, %xmm0
movups %xmm0, 0x70(%r14)
movups %xmm0, 0x60(%r14)
movups %xmm0, 0x50(%r14)
movups %xmm0, 0x40(%r14)
movups %xmm0, 0x30(%r14)
movups %xmm0, 0x20(%r14)
movups %xmm0, 0x10(%r14)
movups %xmm0, (%r14)
movq %r14, %rdi
callq 0x1030
xorl %ecx, %ecx
jmp 0x1c03
movl $0xffffffff, %ecx       # imm = 0xFFFFFFFF
movl %ecx, %eax
addq $0x38, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq