; LLVM IR from gognl/VMBR :: victim/src/hooks (int15h)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.vmexit_data_t = type { ptr, i32, %union.exit_qualification_t, i64, i64, %union.exit_interruption_info_t, i32, %union.exit_interruption_info_t, i32, i32, %union.instruction_info_t, i32 }
%union.exit_qualification_t = type { i64 }
%union.exit_interruption_info_t = type { i32 }
%union.instruction_info_t = type { i32 }
%struct.guest_registers_t = type { i64, i64, i64, i64, i64, i64, i64, i64, i64, i64, i64, i64, i64, i64, i64 }
%struct.mmap_table_t = type <{ i32, [0 x %struct.mmap_entry_t] }>
%struct.mmap_entry_t = type { i64, i64, i32, i32 }

; Function Attrs: nounwind uwtable
declare dso_local void @emulate_iret(ptr noundef) #0 section ".vmm"

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: alwaysinline nounwind uwtable
declare i64 @__vmread(i32 noundef) #2

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nounwind uwtable
define dso_local void @handle_int15h_hook(ptr noundef %0) #0 section ".vmm" {
  %2 = alloca ptr, align 8
  %3 = alloca ptr, align 8
  %4 = alloca ptr, align 8
  %5 = alloca i64, align 8
  %6 = alloca i32, align 4
  store ptr %0, ptr %2, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 8, ptr %3) #3
  store ptr inttoptr (i64 20480 to ptr), ptr %3, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 8, ptr %4) #3
  %7 = call i64 @__vmread(i32 noundef 26630)
  %8 = load ptr, ptr %2, align 8, !tbaa !5
  %9 = getelementptr inbounds %struct.vmexit_data_t, ptr %8, i32 0, i32 0
  %10 = load ptr, ptr %9, align 8, !tbaa !9
  %11 = getelementptr inbounds %struct.guest_registers_t, ptr %10, i32 0, i32 4
  %12 = load i64, ptr %11, align 1, !tbaa !13
  %13 = and i64 %12, 65535
  %14 = add i64 %7, %13
  %15 = inttoptr i64 %14 to ptr
  store ptr %15, ptr %4, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 8, ptr %5) #3
  %16 = load ptr, ptr %2, align 8, !tbaa !5
  %17 = getelementptr inbounds %struct.vmexit_data_t, ptr %16, i32 0, i32 0
  %18 = load ptr, ptr %17, align 8, !tbaa !9
  %19 = getelementptr inbounds %struct.guest_registers_t, ptr %18, i32 0, i32 1
  %20 = load i64, ptr %19, align 1, !tbaa !15
  store i64 %20, ptr %5, align 8, !tbaa !16
  %21 = load i64, ptr %5, align 8, !tbaa !16
  %22 = load ptr, ptr %3, align 8, !tbaa !5
  %23 = getelementptr inbounds %struct.mmap_table_t, ptr %22, i32 0, i32 0
  %24 = load i32, ptr %23, align 1, !tbaa !17
  %25 = zext i32 %24 to i64
  %26 = icmp uge i64 %21, %25
  br i1 %26, label %27, label %38

27:                                               ; preds = %1
  %28 = call i64 @__vmread(i32 noundef 26634)
  %29 = call i64 @__vmread(i32 noundef 26652)
  %30 = add i64 %28, %29
  %31 = add i64 %30, 4
  %32 = inttoptr i64 %31 to ptr
  %33 = load i16, ptr %32, align 2, !tbaa !18
  %34 = zext i16 %33 to i32
  %35 = or i32 %34, 1
  %36 = trunc i32 %35 to i16
  store i16 %36, ptr %32, align 2, !tbaa !18
  %37 = load ptr, ptr %2, align 8, !tbaa !5
  call void @emulate_iret(ptr noundef %37)
  store i32 1, ptr %6, align 4
  br label %110

38:                                               ; preds = %1
  %39 = load ptr, ptr %3, align 8, !tbaa !5
  %40 = getelementptr inbounds %struct.mmap_table_t, ptr %39, i32 0, i32 1
  %41 = load i64, ptr %5, align 8, !tbaa !16
  %42 = getelementptr inbounds [0 x %struct.mmap_entry_t], ptr %40, i64 0, i64 %41
  %43 = getelementptr inbounds %struct.mmap_entry_t, ptr %42, i32 0, i32 0
  %44 = load i64, ptr %43, align 1, !tbaa !20
  %45 = load ptr, ptr %4, align 8, !tbaa !5
  %46 = getelementptr inbounds %struct.mmap_entry_t, ptr %45, i32 0, i32 0
  store i64 %44, ptr %46, align 1, !tbaa !20
  %47 = load ptr, ptr %3, align 8, !tbaa !5
  %48 = getelementptr inbounds %struct.mmap_table_t, ptr %47, i32 0, i32 1
  %49 = load i64, ptr %5, align 8, !tbaa !16
  %50 = getelementptr inbounds [0 x %struct.mmap_entry_t], ptr %48, i64 0, i64 %49
  %51 = getelementptr inbounds %struct.mmap_entry_t, ptr %50, i32 0, i32 1
  %52 = load i64, ptr %51, align 1, !tbaa !22
  %53 = load ptr, ptr %4, align 8, !tbaa !5
  %54 = getelementptr inbounds %struct.mmap_entry_t, ptr %53, i32 0, i32 1
  store i64 %52, ptr %54, align 1, !tbaa !22
  %55 = load ptr, ptr %3, align 8, !tbaa !5
  %56 = getelementptr inbounds %struct.mmap_table_t, ptr %55, i32 0, i32 1
  %57 = load i64, ptr %5, align 8, !tbaa !16
  %58 = getelementptr inbounds [0 x %struct.mmap_entry_t], ptr %56, i64 0, i64 %57
  %59 = getelementptr inbounds %struct.mmap_entry_t, ptr %58, i32 0, i32 2
  %60 = load i32, ptr %59, align 1, !tbaa !23
  %61 = load ptr, ptr %4, align 8, !tbaa !5
  %62 = getelementptr inbounds %struct.mmap_entry_t, ptr %61, i32 0, i32 2
  store i32 %60, ptr %62, align 1, !tbaa !23
  %63 = load ptr, ptr %2, align 8, !tbaa !5
  %64 = getelementptr inbounds %struct.vmexit_data_t, ptr %63, i32 0, i32 0
  %65 = load ptr, ptr %64, align 8, !tbaa !9
  %66 = getelementptr inbounds %struct.guest_registers_t, ptr %65, i32 0, i32 1
  %67 = load i64, ptr %66, align 1, !tbaa !15
  %68 = add i64 %67, 1
  store i64 %68, ptr %66, align 1, !tbaa !15
  %69 = load ptr, ptr %2, align 8, !tbaa !5
  %70 = getelementptr inbounds %struct.vmexit_data_t, ptr %69, i32 0, i32 0
  %71 = load ptr, ptr %70, align 8, !tbaa !9
  %72 = getelementptr inbounds %struct.guest_registers_t, ptr %71, i32 0, i32 0
  store i64 1397571920, ptr %72, align 1, !tbaa !24
  %73 = load ptr, ptr %2, align 8, !tbaa !5
  %74 = getelementptr inbounds %struct.vmexit_data_t, ptr %73, i32 0, i32 0
  %75 = load ptr, ptr %74, align 8, !tbaa !9
  %76 = getelementptr inbounds %struct.guest_registers_t, ptr %75, i32 0, i32 2
  %77 = load i64, ptr %76, align 1, !tbaa !25
  %78 = and i64 %77, -256
  %79 = or i64 %78, 20
  %80 = load ptr, ptr %2, align 8, !tbaa !5
  %81 = getelementptr inbounds %struct.vmexit_data_t, ptr %80, i32 0, i32 0
  %82 = load ptr, ptr %81, align 8, !tbaa !9
  %83 = getelementptr inbounds %struct.guest_registers_t, ptr %82, i32 0, i32 2
  store i64 %79, ptr %83, align 1, !tbaa !25
  %84 = load ptr, ptr %2, align 8, !tbaa !5
  %85 = getelementptr inbounds %struct.vmexit_data_t, ptr %84, i32 0, i32 0
  %86 = load ptr, ptr %85, align 8, !tbaa !9
  %87 = getelementptr inbounds %struct.guest_registers_t, ptr %86, i32 0, i32 1
  %88 = load i64, ptr %87, align 1, !tbaa !15
  %89 = load ptr, ptr %3, align 8, !tbaa !5
  %90 = getelementptr inbounds %struct.mmap_table_t, ptr %89, i32 0, i32 0
  %91 = load i32, ptr %90, align 1, !tbaa !17
  %92 = zext i32 %91 to i64
  %93 = icmp eq i64 %88, %92
  br i1 %93, label %94, label %99

94:                                               ; preds = %38
  %95 = load ptr, ptr %2, align 8, !tbaa !5
  %96 = getelementptr inbounds %struct.vmexit_data_t, ptr %95, i32 0, i32 0
  %97 = load ptr, ptr %96, align 8, !tbaa !9
  %98 = getelementptr inbounds %struct.guest_registers_t, ptr %97, i32 0, i32 1
  store i64 0, ptr %98, align 1, !tbaa !15
  br label %99

99:                                               ; preds = %94, %38
  %100 = call i64 @__vmread(i32 noundef 26634)
  %101 = call i64 @__vmread(i32 noundef 26652)
  %102 = add i64 %100, %101
  %103 = add i64 %102, 4
  %104 = inttoptr i64 %103 to ptr
  %105 = load i16, ptr %104, align 2, !tbaa !18
  %106 = zext i16 %105 to i32
  %107 = and i32 %106, -2
  %108 = trunc i32 %107 to i16
  store i16 %108, ptr %104, align 2, !tbaa !18
  %109 = load ptr, ptr %2, align 8, !tbaa !5
  call void @emulate_iret(ptr noundef %109)
  store i32 0, ptr %6, align 4
  br label %110

110:                                              ; preds = %99, %27
  call void @llvm.lifetime.end.p0(i64 8, ptr %5) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %4) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %3) #3
  %111 = load i32, ptr %6, align 4
  switch i32 %111, label %113 [
    i32 0, label %112
    i32 1, label %112
  ]

112:                                              ; preds = %110, %110
  ret void

113:                                              ; preds = %110
  unreachable
}

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { alwaysinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !6, i64 0}
!10 = !{!"", !6, i64 0, !11, i64 8, !7, i64 16, !12, i64 24, !12, i64 32, !7, i64 40, !11, i64 44, !7, i64 48, !11, i64 52, !11, i64 56, !7, i64 60, !11, i64 64}
!11 = !{!"int", !7, i64 0}
!12 = !{!"long long", !7, i64 0}
!13 = !{!14, !12, i64 32}
!14 = !{!"", !12, i64 0, !12, i64 8, !12, i64 16, !12, i64 24, !12, i64 32, !12, i64 40, !12, i64 48, !12, i64 56, !12, i64 64, !12, i64 72, !12, i64 80, !12, i64 88, !12, i64 96, !12, i64 104, !12, i64 112}
!15 = !{!14, !12, i64 8}
!16 = !{!12, !12, i64 0}
!17 = !{!11, !11, i64 0}
!18 = !{!19, !19, i64 0}
!19 = !{!"short", !7, i64 0}
!20 = !{!21, !12, i64 0}
!21 = !{!"", !12, i64 0, !12, i64 8, !11, i64 16, !11, i64 20}
!22 = !{!21, !12, i64 8}
!23 = !{!21, !11, i64 16}
!24 = !{!14, !12, i64 0}
!25 = !{!14, !12, i64 16}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.mmap_entry_t = type { i64, i64, i32, i32 }

; Function Attrs: nounwind uwtable
declare dso_local void @emulate_iret(ptr noundef) local_unnamed_addr #0 section ".vmm"

; Function Attrs: alwaysinline nounwind uwtable
declare i64 @__vmread(i32 noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
define dso_local void @handle_int15h_hook(ptr noundef %0) local_unnamed_addr #0 section ".vmm" {
  %2 = tail call i64 @__vmread(i32 noundef 26630)
  %3 = load ptr, ptr %0, align 8, !tbaa !5
  %4 = getelementptr inbounds i8, ptr %3, i64 8
  %5 = load i64, ptr %4, align 1, !tbaa !12
  %6 = load i32, ptr inttoptr (i64 20480 to ptr), align 4096, !tbaa !14
  %7 = zext i32 %6 to i64
  %.not = icmp ult i64 %5, %7
  br i1 %.not, label %16, label %8

8:                                                ; preds = %1
  %9 = tail call i64 @__vmread(i32 noundef 26634)
  %10 = tail call i64 @__vmread(i32 noundef 26652)
  %11 = add i64 %9, 4
  %12 = add i64 %11, %10
  %13 = inttoptr i64 %12 to ptr
  %14 = load i16, ptr %13, align 2, !tbaa !15
  %15 = or i16 %14, 1
  store i16 %15, ptr %13, align 2, !tbaa !15
  br label %44

16:                                               ; preds = %1
  %17 = getelementptr inbounds i8, ptr %3, i64 32
  %18 = load i64, ptr %17, align 1, !tbaa !17
  %19 = and i64 %18, 65535
  %20 = add i64 %19, %2
  %21 = inttoptr i64 %20 to ptr
  %22 = getelementptr inbounds [0 x %struct.mmap_entry_t], ptr inttoptr (i64 20484 to ptr), i64 0, i64 %5
  %23 = load <2 x i64>, ptr %22, align 4, !tbaa !18
  store <2 x i64> %23, ptr %21, align 1, !tbaa !18
  %24 = getelementptr inbounds i8, ptr %22, i64 16
  %25 = load i32, ptr %24, align 4, !tbaa !19
  %26 = getelementptr inbounds i8, ptr %21, i64 16
  store i32 %25, ptr %26, align 1, !tbaa !19
  %27 = add nuw nsw i64 %5, 1
  store i64 %27, ptr %4, align 1, !tbaa !12
  store i64 1397571920, ptr %3, align 1, !tbaa !21
  %28 = getelementptr inbounds i8, ptr %3, i64 16
  %29 = load i64, ptr %28, align 1, !tbaa !22
  %30 = and i64 %29, -256
  %31 = or disjoint i64 %30, 20
  store i64 %31, ptr %28, align 1, !tbaa !22
  %32 = load i32, ptr inttoptr (i64 20480 to ptr), align 4096, !tbaa !14
  %33 = zext i32 %32 to i64
  %34 = icmp eq i64 %27, %33
  br i1 %34, label %35, label %36

35:                                               ; preds = %16
  store i64 0, ptr %4, align 1, !tbaa !12
  br label %36

36:                                               ; preds = %35, %16
  %37 = tail call i64 @__vmread(i32 noundef 26634)
  %38 = tail call i64 @__vmread(i32 noundef 26652)
  %39 = add i64 %37, 4
  %40 = add i64 %39, %38
  %41 = inttoptr i64 %40 to ptr
  %42 = load i16, ptr %41, align 2, !tbaa !15
  %43 = and i16 %42, -2
  store i16 %43, ptr %41, align 2, !tbaa !15
  br label %44

44:                                               ; preds = %36, %8
  tail call void @emulate_iret(ptr noundef nonnull %0)
  ret void
}

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { alwaysinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !7, i64 0}
!6 = !{!"", !7, i64 0, !10, i64 8, !8, i64 16, !11, i64 24, !11, i64 32, !8, i64 40, !10, i64 44, !8, i64 48, !10, i64 52, !10, i64 56, !8, i64 60, !10, i64 64}
!7 = !{!"any pointer", !8, i64 0}
!8 = !{!"omnipotent char", !9, i64 0}
!9 = !{!"Simple C/C++ TBAA"}
!10 = !{!"int", !8, i64 0}
!11 = !{!"long long", !8, i64 0}
!12 = !{!13, !11, i64 8}
!13 = !{!"", !11, i64 0, !11, i64 8, !11, i64 16, !11, i64 24, !11, i64 32, !11, i64 40, !11, i64 48, !11, i64 56, !11, i64 64, !11, i64 72, !11, i64 80, !11, i64 88, !11, i64 96, !11, i64 104, !11, i64 112}
!14 = !{!10, !10, i64 0}
!15 = !{!16, !16, i64 0}
!16 = !{!"short", !8, i64 0}
!17 = !{!13, !11, i64 32}
!18 = !{!11, !11, i64 0}
!19 = !{!20, !10, i64 16}
!20 = !{!"", !11, i64 0, !11, i64 8, !10, i64 16, !10, i64 20}
!21 = !{!13, !11, i64 0}
!22 = !{!13, !11, i64 16}


; Effective O3 passes: CorrelatedValuePropagationPass,EarlyCSEPass,GlobalOptPass,IPSCCPPass,InferAlignmentPass,InferFunctionAttrsPass,InstCombinePass,ReassociatePass,SLPVectorizerPass,SROAPass,SimplifyCFGPass,TailCallElimPass