; LLVM IR from tleonhardt/practical_cryptography_engineering :: mbedtls (gcm)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.mbedtls_gcm_context = type { %struct.mbedtls_cipher_context_t, [16 x i64], [16 x i64], i64, i64, [16 x i8], [16 x i8], [16 x i8], i32 }
%struct.mbedtls_cipher_context_t = type { ptr, i32, i32, ptr, ptr, [16 x i8], i64, [16 x i8], i64, ptr }

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: write)
declare void @llvm.memset.p0.i64(ptr nocapture writeonly, i8, i64, i1 immarg) #0

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nounwind uwtable
define dso_local i32 @mbedtls_gcm_starts(ptr noundef %0, i32 noundef %1, ptr noundef %2, i64 noundef %3, ptr noundef %4, i64 noundef %5) #2 {
  %7 = alloca i32, align 4
  %8 = alloca ptr, align 8
  %9 = alloca i32, align 4
  %10 = alloca ptr, align 8
  %11 = alloca i64, align 8
  %12 = alloca ptr, align 8
  %13 = alloca i64, align 8
  %14 = alloca i32, align 4
  %15 = alloca [16 x i8], align 16
  %16 = alloca i64, align 8
  %17 = alloca ptr, align 8
  %18 = alloca i64, align 8
  %19 = alloca i64, align 8
  %20 = alloca i32, align 4
  store ptr %0, ptr %8, align 8, !tbaa !5
  store i32 %1, ptr %9, align 4, !tbaa !9
  store ptr %2, ptr %10, align 8, !tbaa !5
  store i64 %3, ptr %11, align 8, !tbaa !11
  store ptr %4, ptr %12, align 8, !tbaa !5
  store i64 %5, ptr %13, align 8, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 4, ptr %14) #5
  call void @llvm.lifetime.start.p0(i64 16, ptr %15) #5
  call void @llvm.lifetime.start.p0(i64 8, ptr %16) #5
  call void @llvm.lifetime.start.p0(i64 8, ptr %17) #5
  call void @llvm.lifetime.start.p0(i64 8, ptr %18) #5
  call void @llvm.lifetime.start.p0(i64 8, ptr %19) #5
  store i64 0, ptr %19, align 8, !tbaa !11
  %21 = load i64, ptr %11, align 8, !tbaa !11
  %22 = icmp eq i64 %21, 0
  br i1 %22, label %31, label %23

23:                                               ; preds = %6
  %24 = load i64, ptr %11, align 8, !tbaa !11
  %25 = lshr i64 %24, 61
  %26 = icmp ne i64 %25, 0
  br i1 %26, label %31, label %27

27:                                               ; preds = %23
  %28 = load i64, ptr %13, align 8, !tbaa !11
  %29 = lshr i64 %28, 61
  %30 = icmp ne i64 %29, 0
  br i1 %30, label %31, label %32

31:                                               ; preds = %27, %23, %6
  store i32 -20, ptr %7, align 4
  store i32 1, ptr %20, align 4
  br label %218

32:                                               ; preds = %27
  %33 = load ptr, ptr %8, align 8, !tbaa !5
  %34 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %33, i32 0, i32 6
  %35 = getelementptr inbounds [16 x i8], ptr %34, i64 0, i64 0
  call void @llvm.memset.p0.i64(ptr align 8 %35, i8 0, i64 16, i1 false)
  %36 = load ptr, ptr %8, align 8, !tbaa !5
  %37 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %36, i32 0, i32 7
  %38 = getelementptr inbounds [16 x i8], ptr %37, i64 0, i64 0
  call void @llvm.memset.p0.i64(ptr align 8 %38, i8 0, i64 16, i1 false)
  %39 = load i32, ptr %9, align 4, !tbaa !9
  %40 = load ptr, ptr %8, align 8, !tbaa !5
  %41 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %40, i32 0, i32 8
  store i32 %39, ptr %41, align 8, !tbaa !13
  %42 = load ptr, ptr %8, align 8, !tbaa !5
  %43 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %42, i32 0, i32 3
  store i64 0, ptr %43, align 8, !tbaa !16
  %44 = load ptr, ptr %8, align 8, !tbaa !5
  %45 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %44, i32 0, i32 4
  store i64 0, ptr %45, align 8, !tbaa !17
  %46 = load i64, ptr %11, align 8, !tbaa !11
  %47 = icmp eq i64 %46, 12
  br i1 %47, label %48, label %57

48:                                               ; preds = %32
  %49 = load ptr, ptr %8, align 8, !tbaa !5
  %50 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %49, i32 0, i32 6
  %51 = getelementptr inbounds [16 x i8], ptr %50, i64 0, i64 0
  %52 = load ptr, ptr %10, align 8, !tbaa !5
  %53 = load i64, ptr %11, align 8, !tbaa !11
  call void @llvm.memcpy.p0.p0.i64(ptr align 8 %51, ptr align 1 %52, i64 %53, i1 false)
  %54 = load ptr, ptr %8, align 8, !tbaa !5
  %55 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %54, i32 0, i32 6
  %56 = getelementptr inbounds [16 x i8], ptr %55, i64 0, i64 15
  store i8 1, ptr %56, align 1, !tbaa !18
  br label %153

57:                                               ; preds = %32
  %58 = getelementptr inbounds [16 x i8], ptr %15, i64 0, i64 0
  call void @llvm.memset.p0.i64(ptr align 16 %58, i8 0, i64 16, i1 false)
  %59 = load i64, ptr %11, align 8, !tbaa !11
  %60 = mul i64 %59, 8
  %61 = lshr i64 %60, 24
  %62 = trunc i64 %61 to i8
  %63 = getelementptr inbounds [16 x i8], ptr %15, i64 0, i64 12
  store i8 %62, ptr %63, align 4, !tbaa !18
  %64 = load i64, ptr %11, align 8, !tbaa !11
  %65 = mul i64 %64, 8
  %66 = lshr i64 %65, 16
  %67 = trunc i64 %66 to i8
  %68 = getelementptr inbounds [16 x i8], ptr %15, i64 0, i64 13
  store i8 %67, ptr %68, align 1, !tbaa !18
  %69 = load i64, ptr %11, align 8, !tbaa !11
  %70 = mul i64 %69, 8
  %71 = lshr i64 %70, 8
  %72 = trunc i64 %71 to i8
  %73 = getelementptr inbounds [16 x i8], ptr %15, i64 0, i64 14
  store i8 %72, ptr %73, align 2, !tbaa !18
  %74 = load i64, ptr %11, align 8, !tbaa !11
  %75 = mul i64 %74, 8
  %76 = trunc i64 %75 to i8
  %77 = getelementptr inbounds [16 x i8], ptr %15, i64 0, i64 15
  store i8 %76, ptr %77, align 1, !tbaa !18
  %78 = load ptr, ptr %10, align 8, !tbaa !5
  store ptr %78, ptr %17, align 8, !tbaa !5
  br label %79

79:                                               ; preds = %111, %57
  %80 = load i64, ptr %11, align 8, !tbaa !11
  %81 = icmp ugt i64 %80, 0
  br i1 %81, label %82, label %125

82:                                               ; preds = %79
  %83 = load i64, ptr %11, align 8, !tbaa !11
  %84 = icmp ult i64 %83, 16
  br i1 %84, label %85, label %87

85:                                               ; preds = %82
  %86 = load i64, ptr %11, align 8, !tbaa !11
  br label %88

87:                                               ; preds = %82
  br label %88

88:                                               ; preds = %87, %85
  %89 = phi i64 [ %86, %85 ], [ 16, %87 ]
  store i64 %89, ptr %18, align 8, !tbaa !11
  store i64 0, ptr %16, align 8, !tbaa !11
  br label %90

90:                                               ; preds = %108, %88
  %91 = load i64, ptr %16, align 8, !tbaa !11
  %92 = load i64, ptr %18, align 8, !tbaa !11
  %93 = icmp ult i64 %91, %92
  br i1 %93, label %94, label %111

94:                                               ; preds = %90
  %95 = load ptr, ptr %17, align 8, !tbaa !5
  %96 = load i64, ptr %16, align 8, !tbaa !11
  %97 = getelementptr inbounds i8, ptr %95, i64 %96
  %98 = load i8, ptr %97, align 1, !tbaa !18
  %99 = zext i8 %98 to i32
  %100 = load ptr, ptr %8, align 8, !tbaa !5
  %101 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %100, i32 0, i32 6
  %102 = load i64, ptr %16, align 8, !tbaa !11
  %103 = getelementptr inbounds [16 x i8], ptr %101, i64 0, i64 %102
  %104 = load i8, ptr %103, align 1, !tbaa !18
  %105 = zext i8 %104 to i32
  %106 = xor i32 %105, %99
  %107 = trunc i32 %106 to i8
  store i8 %107, ptr %103, align 1, !tbaa !18
  br label %108

108:                                              ; preds = %94
  %109 = load i64, ptr %16, align 8, !tbaa !11
  %110 = add i64 %109, 1
  store i64 %110, ptr %16, align 8, !tbaa !11
  br label %90, !llvm.loop !19

111:                                              ; preds = %90
  %112 = load ptr, ptr %8, align 8, !tbaa !5
  %113 = load ptr, ptr %8, align 8, !tbaa !5
  %114 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %113, i32 0, i32 6
  %115 = getelementptr inbounds [16 x i8], ptr %114, i64 0, i64 0
  %116 = load ptr, ptr %8, align 8, !tbaa !5
  %117 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %116, i32 0, i32 6
  %118 = getelementptr inbounds [16 x i8], ptr %117, i64 0, i64 0
  call void @gcm_mult(ptr noundef %112, ptr noundef %115, ptr noundef %118)
  %119 = load i64, ptr %18, align 8, !tbaa !11
  %120 = load i64, ptr %11, align 8, !tbaa !11
  %121 = sub i64 %120, %119
  store i64 %121, ptr %11, align 8, !tbaa !11
  %122 = load i64, ptr %18, align 8, !tbaa !11
  %123 = load ptr, ptr %17, align 8, !tbaa !5
  %124 = getelementptr inbounds i8, ptr %123, i64 %122
  store ptr %124, ptr %17, align 8, !tbaa !5
  br label %79, !llvm.loop !21

125:                                              ; preds = %79
  store i64 0, ptr %16, align 8, !tbaa !11
  br label %126

126:                                              ; preds = %142, %125
  %127 = load i64, ptr %16, align 8, !tbaa !11
  %128 = icmp ult i64 %127, 16
  br i1 %128, label %129, label %145

129:                                              ; preds = %126
  %130 = load i64, ptr %16, align 8, !tbaa !11
  %131 = getelementptr inbounds [16 x i8], ptr %15, i64 0, i64 %130
  %132 = load i8, ptr %131, align 1, !tbaa !18
  %133 = zext i8 %132 to i32
  %134 = load ptr, ptr %8, align 8, !tbaa !5
  %135 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %134, i32 0, i32 6
  %136 = load i64, ptr %16, align 8, !tbaa !11
  %137 = getelementptr inbounds [16 x i8], ptr %135, i64 0, i64 %136
  %138 = load i8, ptr %137, align 1, !tbaa !18
  %139 = zext i8 %138 to i32
  %140 = xor i32 %139, %133
  %141 = trunc i32 %140 to i8
  store i8 %141, ptr %137, align 1, !tbaa !18
  br label %142

142:                                              ; preds = %129
  %143 = load i64, ptr %16, align 8, !tbaa !11
  %144 = add i64 %143, 1
  store i64 %144, ptr %16, align 8, !tbaa !11
  br label %126, !llvm.loop !22

145:                                              ; preds = %126
  %146 = load ptr, ptr %8, align 8, !tbaa !5
  %147 = load ptr, ptr %8, align 8, !tbaa !5
  %148 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %147, i32 0, i32 6
  %149 = getelementptr inbounds [16 x i8], ptr %148, i64 0, i64 0
  %150 = load ptr, ptr %8, align 8, !tbaa !5
  %151 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %150, i32 0, i32 6
  %152 = getelementptr inbounds [16 x i8], ptr %151, i64 0, i64 0
  call void @gcm_mult(ptr noundef %146, ptr noundef %149, ptr noundef %152)
  br label %153

153:                                              ; preds = %145, %48
  %154 = load ptr, ptr %8, align 8, !tbaa !5
  %155 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %154, i32 0, i32 0
  %156 = load ptr, ptr %8, align 8, !tbaa !5
  %157 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %156, i32 0, i32 6
  %158 = getelementptr inbounds [16 x i8], ptr %157, i64 0, i64 0
  %159 = load ptr, ptr %8, align 8, !tbaa !5
  %160 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %159, i32 0, i32 5
  %161 = getelementptr inbounds [16 x i8], ptr %160, i64 0, i64 0
  %162 = call i32 @mbedtls_cipher_update(ptr noundef %155, ptr noundef %158, i64 noundef 16, ptr noundef %161, ptr noundef %19)
  store i32 %162, ptr %14, align 4, !tbaa !9
  %163 = icmp ne i32 %162, 0
  br i1 %163, label %164, label %166

164:                                              ; preds = %153
  %165 = load i32, ptr %14, align 4, !tbaa !9
  store i32 %165, ptr %7, align 4
  store i32 1, ptr %20, align 4
  br label %218

166:                                              ; preds = %153
  %167 = load i64, ptr %13, align 8, !tbaa !11
  %168 = load ptr, ptr %8, align 8, !tbaa !5
  %169 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %168, i32 0, i32 4
  store i64 %167, ptr %169, align 8, !tbaa !17
  %170 = load ptr, ptr %12, align 8, !tbaa !5
  store ptr %170, ptr %17, align 8, !tbaa !5
  br label %171

171:                                              ; preds = %203, %166
  %172 = load i64, ptr %13, align 8, !tbaa !11
  %173 = icmp ugt i64 %172, 0
  br i1 %173, label %174, label %217

174:                                              ; preds = %171
  %175 = load i64, ptr %13, align 8, !tbaa !11
  %176 = icmp ult i64 %175, 16
  br i1 %176, label %177, label %179

177:                                              ; preds = %174
  %178 = load i64, ptr %13, align 8, !tbaa !11
  br label %180

179:                                              ; preds = %174
  br label %180

180:                                              ; preds = %179, %177
  %181 = phi i64 [ %178, %177 ], [ 16, %179 ]
  store i64 %181, ptr %18, align 8, !tbaa !11
  store i64 0, ptr %16, align 8, !tbaa !11
  br label %182

182:                                              ; preds = %200, %180
  %183 = load i64, ptr %16, align 8, !tbaa !11
  %184 = load i64, ptr %18, align 8, !tbaa !11
  %185 = icmp ult i64 %183, %184
  br i1 %185, label %186, label %203

186:                                              ; preds = %182
  %187 = load ptr, ptr %17, align 8, !tbaa !5
  %188 = load i64, ptr %16, align 8, !tbaa !11
  %189 = getelementptr inbounds i8, ptr %187, i64 %188
  %190 = load i8, ptr %189, align 1, !tbaa !18
  %191 = zext i8 %190 to i32
  %192 = load ptr, ptr %8, align 8, !tbaa !5
  %193 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %192, i32 0, i32 7
  %194 = load i64, ptr %16, align 8, !tbaa !11
  %195 = getelementptr inbounds [16 x i8], ptr %193, i64 0, i64 %194
  %196 = load i8, ptr %195, align 1, !tbaa !18
  %197 = zext i8 %196 to i32
  %198 = xor i32 %197, %191
  %199 = trunc i32 %198 to i8
  store i8 %199, ptr %195, align 1, !tbaa !18
  br label %200

200:                                              ; preds = %186
  %201 = load i64, ptr %16, align 8, !tbaa !11
  %202 = add i64 %201, 1
  store i64 %202, ptr %16, align 8, !tbaa !11
  br label %182, !llvm.loop !23

203:                                              ; preds = %182
  %204 = load ptr, ptr %8, align 8, !tbaa !5
  %205 = load ptr, ptr %8, align 8, !tbaa !5
  %206 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %205, i32 0, i32 7
  %207 = getelementptr inbounds [16 x i8], ptr %206, i64 0, i64 0
  %208 = load ptr, ptr %8, align 8, !tbaa !5
  %209 = getelementptr inbounds %struct.mbedtls_gcm_context, ptr %208, i32 0, i32 7
  %210 = getelementptr inbounds [16 x i8], ptr %209, i64 0, i64 0
  call void @gcm_mult(ptr noundef %204, ptr noundef %207, ptr noundef %210)
  %211 = load i64, ptr %18, align 8, !tbaa !11
  %212 = load i64, ptr %13, align 8, !tbaa !11
  %213 = sub i64 %212, %211
  store i64 %213, ptr %13, align 8, !tbaa !11
  %214 = load i64, ptr %18, align 8, !tbaa !11
  %215 = load ptr, ptr %17, align 8, !tbaa !5
  %216 = getelementptr inbounds i8, ptr %215, i64 %214
  store ptr %216, ptr %17, align 8, !tbaa !5
  br label %171, !llvm.loop !24

217:                                              ; preds = %171
  store i32 0, ptr %7, align 4
  store i32 1, ptr %20, align 4
  br label %218

218:                                              ; preds = %217, %164, %31
  call void @llvm.lifetime.end.p0(i64 8, ptr %19) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %18) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %17) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %16) #5
  call void @llvm.lifetime.end.p0(i64 16, ptr %15) #5
  call void @llvm.lifetime.end.p0(i64 4, ptr %14) #5
  %219 = load i32, ptr %7, align 4
  ret i32 %219
}

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #3

; Function Attrs: nounwind uwtable
declare hidden void @gcm_mult(ptr noundef, ptr noundef, ptr noundef) #2

declare i32 @mbedtls_cipher_update(ptr noundef, ptr noundef, i64 noundef, ptr noundef, ptr noundef) #4

attributes #0 = { nocallback nofree nounwind willreturn memory(argmem: write) }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #4 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #5 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"int", !7, i64 0}
!11 = !{!12, !12, i64 0}
!12 = !{!"long", !7, i64 0}
!13 = !{!14, !10, i64 408}
!14 = !{!"", !15, i64 0, !7, i64 88, !7, i64 216, !12, i64 344, !12, i64 352, !7, i64 360, !7, i64 376, !7, i64 392, !10, i64 408}
!15 = !{!"", !6, i64 0, !10, i64 8, !10, i64 12, !6, i64 16, !6, i64 24, !7, i64 32, !12, i64 48, !7, i64 56, !12, i64 72, !6, i64 80}
!16 = !{!14, !12, i64 344}
!17 = !{!14, !12, i64 352}
!18 = !{!7, !7, i64 0}
!19 = distinct !{!19, !20}
!20 = !{!"llvm.loop.mustprogress"}
!21 = distinct !{!21, !20}
!22 = distinct !{!22, !20}
!23 = distinct !{!23, !20}
!24 = distinct !{!24, !20}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

; Function Attrs: mustprogress nocallback nofree nounwind willreturn memory(argmem: write)
declare void @llvm.memset.p0.i64(ptr nocapture writeonly, i8, i64, i1 immarg) #0

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nounwind uwtable
define dso_local i32 @mbedtls_gcm_starts(ptr noundef %0, i32 noundef %1, ptr nocapture noundef readonly %2, i64 noundef %3, ptr nocapture noundef readonly %4, i64 noundef %5) local_unnamed_addr #2 {
  %7 = alloca i64, align 8
  call void @llvm.lifetime.start.p0(i64 8, ptr nonnull %7) #6
  store i64 0, ptr %7, align 8, !tbaa !5
  %8 = add i64 %3, -1
  %or.cond = icmp ult i64 %8, 2305843009213693951
  %.not77 = icmp ult i64 %5, 2305843009213693952
  %or.cond81 = and i1 %or.cond, %.not77
  br i1 %or.cond81, label %9, label %.loopexit

9:                                                ; preds = %6
  %10 = getelementptr inbounds i8, ptr %0, i64 376
  %11 = getelementptr i8, ptr %0, i64 392
  %12 = getelementptr inbounds i8, ptr %0, i64 408
  tail call void @llvm.memset.p0.i64(ptr noundef nonnull align 8 dereferenceable(32) %10, i8 0, i64 32, i1 false)
  store i32 %1, ptr %12, align 8, !tbaa !9
  %13 = getelementptr inbounds i8, ptr %0, i64 344
  %14 = getelementptr inbounds i8, ptr %0, i64 352
  %15 = icmp eq i64 %3, 12
  tail call void @llvm.memset.p0.i64(ptr noundef nonnull align 8 dereferenceable(16) %13, i8 0, i64 16, i1 false)
  br i1 %15, label %16, label %.lr.ph.preheader

16:                                               ; preds = %9
  tail call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 8 dereferenceable(12) %10, ptr noundef nonnull align 1 dereferenceable(12) %2, i64 12, i1 false)
  %17 = getelementptr inbounds i8, ptr %0, i64 391
  store i8 1, ptr %17, align 1, !tbaa !14
  br label %75

.lr.ph.preheader:                                 ; preds = %9
  %18 = lshr i64 %3, 21
  %19 = trunc i64 %18 to i8
  %20 = lshr i64 %3, 13
  %21 = trunc i64 %20 to i8
  %22 = lshr i64 %3, 5
  %23 = trunc i64 %22 to i8
  %.tr = trunc i64 %3 to i8
  %24 = shl i8 %.tr, 3
  %scevgep = getelementptr i8, ptr %0, i64 376
  %25 = getelementptr inbounds i8, ptr %0, i64 384
  br label %iter.check

.preheader:                                       ; preds = %.loopexit178
  %.phi.trans.insert110 = getelementptr inbounds i8, ptr %0, i64 385
  %.pre111 = load i8, ptr %.phi.trans.insert110, align 1, !tbaa !14
  %.phi.trans.insert112 = getelementptr inbounds i8, ptr %0, i64 386
  %.pre113 = load i8, ptr %.phi.trans.insert112, align 1, !tbaa !14
  %.phi.trans.insert114 = getelementptr inbounds i8, ptr %0, i64 387
  %.pre115 = load i8, ptr %.phi.trans.insert114, align 1, !tbaa !14
  %.phi.trans.insert116 = getelementptr inbounds i8, ptr %0, i64 388
  %26 = getelementptr inbounds i8, ptr %0, i64 385
  store i8 %.pre111, ptr %26, align 1, !tbaa !14
  %27 = getelementptr inbounds i8, ptr %0, i64 386
  store i8 %.pre113, ptr %27, align 1, !tbaa !14
  %28 = getelementptr inbounds i8, ptr %0, i64 387
  store i8 %.pre115, ptr %28, align 1, !tbaa !14
  %29 = getelementptr inbounds i8, ptr %0, i64 388
  %30 = load <4 x i8>, ptr %.phi.trans.insert116, align 1, !tbaa !14
  %31 = insertelement <4 x i8> poison, i8 %19, i64 0
  %32 = insertelement <4 x i8> %31, i8 %21, i64 1
  %33 = insertelement <4 x i8> %32, i8 %23, i64 2
  %34 = insertelement <4 x i8> %33, i8 %24, i64 3
  %35 = xor <4 x i8> %30, %34
  store <4 x i8> %35, ptr %29, align 1, !tbaa !14
  tail call void @gcm_mult(ptr noundef nonnull %0, ptr noundef nonnull %10, ptr noundef nonnull %10)
  br label %75

iter.check:                                       ; preds = %.lr.ph.preheader, %.loopexit178
  %.085 = phi ptr [ %74, %.loopexit178 ], [ %2, %.lr.ph.preheader ]
  %.07284 = phi i64 [ %73, %.loopexit178 ], [ %3, %.lr.ph.preheader ]
  %36 = tail call i64 @llvm.umin.i64(i64 %.07284, i64 16)
  %min.iters.check = icmp ult i64 %.07284, 8
  br i1 %min.iters.check, label %vec.epilog.scalar.ph.preheader, label %vector.memcheck

vector.memcheck:                                  ; preds = %iter.check
  %scevgep124 = getelementptr i8, ptr %scevgep, i64 %36
  %scevgep125 = getelementptr i8, ptr %.085, i64 %36
  %bound0 = icmp ult ptr %10, %scevgep125
  %bound1 = icmp ult ptr %.085, %scevgep124
  %found.conflict = and i1 %bound0, %bound1
  br i1 %found.conflict, label %vec.epilog.scalar.ph.preheader, label %vec.epilog.ph

vec.epilog.ph:                                    ; preds = %vector.memcheck
  %n.vec131 = and i64 %36, 24
  %wide.load133 = load <8 x i8>, ptr %.085, align 1, !tbaa !14, !alias.scope !15
  %wide.load134 = load <8 x i8>, ptr %10, align 1, !tbaa !14, !alias.scope !18, !noalias !15
  %37 = xor <8 x i8> %wide.load134, %wide.load133
  store <8 x i8> %37, ptr %10, align 1, !tbaa !14, !alias.scope !18, !noalias !15
  %38 = icmp eq i64 %n.vec131, 8
  br i1 %38, label %vec.epilog.middle.block, label %vec.epilog.vector.body.1, !llvm.loop !20

vec.epilog.vector.body.1:                         ; preds = %vec.epilog.ph
  %39 = getelementptr inbounds i8, ptr %.085, i64 8
  %wide.load133.1 = load <8 x i8>, ptr %39, align 1, !tbaa !14, !alias.scope !15
  %wide.load134.1 = load <8 x i8>, ptr %25, align 1, !tbaa !14, !alias.scope !18, !noalias !15
  %40 = xor <8 x i8> %wide.load134.1, %wide.load133.1
  store <8 x i8> %40, ptr %25, align 1, !tbaa !14, !alias.scope !18, !noalias !15
  br label %vec.epilog.middle.block

vec.epilog.middle.block:                          ; preds = %vec.epilog.vector.body.1, %vec.epilog.ph
  %cmp.n136 = icmp eq i64 %36, %n.vec131
  br i1 %cmp.n136, label %.loopexit178, label %vec.epilog.scalar.ph.preheader

vec.epilog.scalar.ph.preheader:                   ; preds = %vec.epilog.middle.block, %vector.memcheck, %iter.check
  %.06882.ph = phi i64 [ 0, %iter.check ], [ 0, %vector.memcheck ], [ %n.vec131, %vec.epilog.middle.block ]
  %xtraiter = and i64 %36, 3
  %lcmp.mod.not = icmp eq i64 %xtraiter, 0
  br i1 %lcmp.mod.not, label %vec.epilog.scalar.ph.prol.loopexit, label %vec.epilog.scalar.ph.prol

vec.epilog.scalar.ph.prol:                        ; preds = %vec.epilog.scalar.ph.preheader, %vec.epilog.scalar.ph.prol
  %.06882.prol = phi i64 [ %46, %vec.epilog.scalar.ph.prol ], [ %.06882.ph, %vec.epilog.scalar.ph.preheader ]
  %prol.iter = phi i64 [ %prol.iter.next, %vec.epilog.scalar.ph.prol ], [ 0, %vec.epilog.scalar.ph.preheader ]
  %41 = getelementptr inbounds i8, ptr %.085, i64 %.06882.prol
  %42 = load i8, ptr %41, align 1, !tbaa !14
  %43 = getelementptr inbounds [16 x i8], ptr %10, i64 0, i64 %.06882.prol
  %44 = load i8, ptr %43, align 1, !tbaa !14
  %45 = xor i8 %44, %42
  store i8 %45, ptr %43, align 1, !tbaa !14
  %46 = add nuw nsw i64 %.06882.prol, 1
  %prol.iter.next = add i64 %prol.iter, 1
  %prol.iter.cmp.not = icmp eq i64 %prol.iter.next, %xtraiter
  br i1 %prol.iter.cmp.not, label %vec.epilog.scalar.ph.prol.loopexit, label %vec.epilog.scalar.ph.prol, !llvm.loop !24

vec.epilog.scalar.ph.prol.loopexit:               ; preds = %vec.epilog.scalar.ph.prol, %vec.epilog.scalar.ph.preheader
  %.06882.unr = phi i64 [ %.06882.ph, %vec.epilog.scalar.ph.preheader ], [ %46, %vec.epilog.scalar.ph.prol ]
  %47 = sub nsw i64 %.06882.ph, %36
  %48 = icmp ugt i64 %47, -4
  br i1 %48, label %.loopexit178, label %vec.epilog.scalar.ph

vec.epilog.scalar.ph:                             ; preds = %vec.epilog.scalar.ph.prol.loopexit, %vec.epilog.scalar.ph
  %.06882 = phi i64 [ %72, %vec.epilog.scalar.ph ], [ %.06882.unr, %vec.epilog.scalar.ph.prol.loopexit ]
  %49 = getelementptr inbounds i8, ptr %.085, i64 %.06882
  %50 = load i8, ptr %49, align 1, !tbaa !14
  %51 = getelementptr inbounds [16 x i8], ptr %10, i64 0, i64 %.06882
  %52 = load i8, ptr %51, align 1, !tbaa !14
  %53 = xor i8 %52, %50
  store i8 %53, ptr %51, align 1, !tbaa !14
  %54 = add nuw nsw i64 %.06882, 1
  %55 = getelementptr inbounds i8, ptr %.085, i64 %54
  %56 = load i8, ptr %55, align 1, !tbaa !14
  %57 = getelementptr inbounds [16 x i8], ptr %10, i64 0, i64 %54
  %58 = load i8, ptr %57, align 1, !tbaa !14
  %59 = xor i8 %58, %56
  store i8 %59, ptr %57, align 1, !tbaa !14
  %60 = add nuw nsw i64 %.06882, 2
  %61 = getelementptr inbounds i8, ptr %.085, i64 %60
  %62 = load i8, ptr %61, align 1, !tbaa !14
  %63 = getelementptr inbounds [16 x i8], ptr %10, i64 0, i64 %60
  %64 = load i8, ptr %63, align 1, !tbaa !14
  %65 = xor i8 %64, %62
  store i8 %65, ptr %63, align 1, !tbaa !14
  %66 = add nuw nsw i64 %.06882, 3
  %67 = getelementptr inbounds i8, ptr %.085, i64 %66
  %68 = load i8, ptr %67, align 1, !tbaa !14
  %69 = getelementptr inbounds [16 x i8], ptr %10, i64 0, i64 %66
  %70 = load i8, ptr %69, align 1, !tbaa !14
  %71 = xor i8 %70, %68
  store i8 %71, ptr %69, align 1, !tbaa !14
  %72 = add nuw nsw i64 %.06882, 4
  %exitcond.not.3 = icmp eq i64 %72, %36
  br i1 %exitcond.not.3, label %.loopexit178, label %vec.epilog.scalar.ph, !llvm.loop !26

.loopexit178:                                     ; preds = %vec.epilog.scalar.ph.prol.loopexit, %vec.epilog.scalar.ph, %vec.epilog.middle.block
  tail call void @gcm_mult(ptr noundef nonnull %0, ptr noundef nonnull %10, ptr noundef nonnull %10)
  %73 = sub i64 %.07284, %36
  %74 = getelementptr inbounds i8, ptr %.085, i64 %36
  %.not78 = icmp eq i64 %73, 0
  br i1 %.not78, label %.preheader, label %iter.check, !llvm.loop !27

75:                                               ; preds = %.preheader, %16
  %76 = getelementptr inbounds i8, ptr %0, i64 360
  %77 = call i32 @mbedtls_cipher_update(ptr noundef nonnull %0, ptr noundef nonnull %10, i64 noundef 16, ptr noundef nonnull %76, ptr noundef nonnull %7) #6
  %.not79 = icmp eq i32 %77, 0
  br i1 %.not79, label %78, label %.loopexit

78:                                               ; preds = %75
  store i64 %5, ptr %14, align 8, !tbaa !28
  %.not8088 = icmp eq i64 %5, 0
  br i1 %.not8088, label %.loopexit, label %.lr.ph91.preheader

.lr.ph91.preheader:                               ; preds = %78
  %scevgep138 = getelementptr i8, ptr %0, i64 392
  %79 = getelementptr i8, ptr %0, i64 400
  br label %iter.check147

iter.check147:                                    ; preds = %.lr.ph91.preheader, %.loopexit177
  %.190 = phi ptr [ %118, %.loopexit177 ], [ %4, %.lr.ph91.preheader ]
  %.07189 = phi i64 [ %117, %.loopexit177 ], [ %5, %.lr.ph91.preheader ]
  %80 = call i64 @llvm.umin.i64(i64 %.07189, i64 16)
  %min.iters.check145 = icmp ult i64 %.07189, 8
  br i1 %min.iters.check145, label %vec.epilog.scalar.ph162.preheader, label %vector.memcheck137

vector.memcheck137:                               ; preds = %iter.check147
  %scevgep139 = getelementptr i8, ptr %scevgep138, i64 %80
  %scevgep140 = getelementptr i8, ptr %.190, i64 %80
  %bound0141 = icmp ult ptr %11, %scevgep140
  %bound1142 = icmp ult ptr %.190, %scevgep139
  %found.conflict143 = and i1 %bound0141, %bound1142
  br i1 %found.conflict143, label %vec.epilog.scalar.ph162.preheader, label %vec.epilog.ph163

vec.epilog.ph163:                                 ; preds = %vector.memcheck137
  %n.vec169 = and i64 %80, 24
  %wide.load173 = load <8 x i8>, ptr %.190, align 1, !tbaa !14, !alias.scope !29
  %wide.load174 = load <8 x i8>, ptr %11, align 1, !tbaa !14, !alias.scope !32, !noalias !29
  %81 = xor <8 x i8> %wide.load174, %wide.load173
  store <8 x i8> %81, ptr %11, align 1, !tbaa !14, !alias.scope !32, !noalias !29
  %82 = icmp eq i64 %n.vec169, 8
  br i1 %82, label %vec.epilog.middle.block161, label %vec.epilog.vector.body171.1, !llvm.loop !34

vec.epilog.vector.body171.1:                      ; preds = %vec.epilog.ph163
  %83 = getelementptr inbounds i8, ptr %.190, i64 8
  %wide.load173.1 = load <8 x i8>, ptr %83, align 1, !tbaa !14, !alias.scope !29
  %wide.load174.1 = load <8 x i8>, ptr %79, align 1, !tbaa !14, !alias.scope !32, !noalias !29
  %84 = xor <8 x i8> %wide.load174.1, %wide.load173.1
  store <8 x i8> %84, ptr %79, align 1, !tbaa !14, !alias.scope !32, !noalias !29
  br label %vec.epilog.middle.block161

vec.epilog.middle.block161:                       ; preds = %vec.epilog.vector.body171.1, %vec.epilog.ph163
  %cmp.n176 = icmp eq i64 %80, %n.vec169
  br i1 %cmp.n176, label %.loopexit177, label %vec.epilog.scalar.ph162.preheader

vec.epilog.scalar.ph162.preheader:                ; preds = %vec.epilog.middle.block161, %vector.memcheck137, %iter.check147
  %.287.ph = phi i64 [ 0, %iter.check147 ], [ 0, %vector.memcheck137 ], [ %n.vec169, %vec.epilog.middle.block161 ]
  %xtraiter179 = and i64 %80, 3
  %lcmp.mod180.not = icmp eq i64 %xtraiter179, 0
  br i1 %lcmp.mod180.not, label %vec.epilog.scalar.ph162.prol.loopexit, label %vec.epilog.scalar.ph162.prol

vec.epilog.scalar.ph162.prol:                     ; preds = %vec.epilog.scalar.ph162.preheader, %vec.epilog.scalar.ph162.prol
  %.287.prol = phi i64 [ %90, %vec.epilog.scalar.ph162.prol ], [ %.287.ph, %vec.epilog.scalar.ph162.preheader ]
  %prol.iter181 = phi i64 [ %prol.iter181.next, %vec.epilog.scalar.ph162.prol ], [ 0, %vec.epilog.scalar.ph162.preheader ]
  %85 = getelementptr inbounds i8, ptr %.190, i64 %.287.prol
  %86 = load i8, ptr %85, align 1, !tbaa !14
  %87 = getelementptr inbounds [16 x i8], ptr %11, i64 0, i64 %.287.prol
  %88 = load i8, ptr %87, align 1, !tbaa !14
  %89 = xor i8 %88, %86
  store i8 %89, ptr %87, align 1, !tbaa !14
  %90 = add nuw nsw i64 %.287.prol, 1
  %prol.iter181.next = add i64 %prol.iter181, 1
  %prol.iter181.cmp.not = icmp eq i64 %prol.iter181.next, %xtraiter179
  br i1 %prol.iter181.cmp.not, label %vec.epilog.scalar.ph162.prol.loopexit, label %vec.epilog.scalar.ph162.prol, !llvm.loop !35

vec.epilog.scalar.ph162.prol.loopexit:            ; preds = %vec.epilog.scalar.ph162.prol, %vec.epilog.scalar.ph162.preheader
  %.287.unr = phi i64 [ %.287.ph, %vec.epilog.scalar.ph162.preheader ], [ %90, %vec.epilog.scalar.ph162.prol ]
  %91 = sub nsw i64 %.287.ph, %80
  %92 = icmp ugt i64 %91, -4
  br i1 %92, label %.loopexit177, label %vec.epilog.scalar.ph162

vec.epilog.scalar.ph162:                          ; preds = %vec.epilog.scalar.ph162.prol.loopexit, %vec.epilog.scalar.ph162
  %.287 = phi i64 [ %116, %vec.epilog.scalar.ph162 ], [ %.287.unr, %vec.epilog.scalar.ph162.prol.loopexit ]
  %93 = getelementptr inbounds i8, ptr %.190, i64 %.287
  %94 = load i8, ptr %93, align 1, !tbaa !14
  %95 = getelementptr inbounds [16 x i8], ptr %11, i64 0, i64 %.287
  %96 = load i8, ptr %95, align 1, !tbaa !14
  %97 = xor i8 %96, %94
  store i8 %97, ptr %95, align 1, !tbaa !14
  %98 = add nuw nsw i64 %.287, 1
  %99 = getelementptr inbounds i8, ptr %.190, i64 %98
  %100 = load i8, ptr %99, align 1, !tbaa !14
  %101 = getelementptr inbounds [16 x i8], ptr %11, i64 0, i64 %98
  %102 = load i8, ptr %101, align 1, !tbaa !14
  %103 = xor i8 %102, %100
  store i8 %103, ptr %101, align 1, !tbaa !14
  %104 = add nuw nsw i64 %.287, 2
  %105 = getelementptr inbounds i8, ptr %.190, i64 %104
  %106 = load i8, ptr %105, align 1, !tbaa !14
  %107 = getelementptr inbounds [16 x i8], ptr %11, i64 0, i64 %104
  %108 = load i8, ptr %107, align 1, !tbaa !14
  %109 = xor i8 %108, %106
  store i8 %109, ptr %107, align 1, !tbaa !14
  %110 = add nuw nsw i64 %.287, 3
  %111 = getelementptr inbounds i8, ptr %.190, i64 %110
  %112 = load i8, ptr %111, align 1, !tbaa !14
  %113 = getelementptr inbounds [16 x i8], ptr %11, i64 0, i64 %110
  %114 = load i8, ptr %113, align 1, !tbaa !14
  %115 = xor i8 %114, %112
  store i8 %115, ptr %113, align 1, !tbaa !14
  %116 = add nuw nsw i64 %.287, 4
  %exitcond94.not.3 = icmp eq i64 %116, %80
  br i1 %exitcond94.not.3, label %.loopexit177, label %vec.epilog.scalar.ph162, !llvm.loop !36

.loopexit177:                                     ; preds = %vec.epilog.scalar.ph162.prol.loopexit, %vec.epilog.scalar.ph162, %vec.epilog.middle.block161
  call void @gcm_mult(ptr noundef nonnull %0, ptr noundef nonnull %11, ptr noundef nonnull %11)
  %117 = sub i64 %.07189, %80
  %118 = getelementptr inbounds i8, ptr %.190, i64 %80
  %.not80 = icmp eq i64 %117, 0
  br i1 %.not80, label %.loopexit, label %iter.check147, !llvm.loop !37

.loopexit:                                        ; preds = %.loopexit177, %78, %75, %6
  %.070 = phi i32 [ -20, %6 ], [ %77, %75 ], [ 0, %78 ], [ 0, %.loopexit177 ]
  call void @llvm.lifetime.end.p0(i64 8, ptr nonnull %7) #6
  ret i32 %.070
}

; Function Attrs: mustprogress nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #3

; Function Attrs: nounwind uwtable
declare hidden void @gcm_mult(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare i32 @mbedtls_cipher_update(ptr noundef, ptr noundef, i64 noundef, ptr noundef, ptr noundef) local_unnamed_addr #4

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i64 @llvm.umin.i64(i64, i64) #5

attributes #0 = { mustprogress nocallback nofree nounwind willreturn memory(argmem: write) }
attributes #1 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { mustprogress nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #4 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #5 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
attributes #6 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"long", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !13, i64 408}
!10 = !{!"", !11, i64 0, !7, i64 88, !7, i64 216, !6, i64 344, !6, i64 352, !7, i64 360, !7, i64 376, !7, i64 392, !13, i64 408}
!11 = !{!"", !12, i64 0, !13, i64 8, !13, i64 12, !12, i64 16, !12, i64 24, !7, i64 32, !6, i64 48, !7, i64 56, !6, i64 72, !12, i64 80}
!12 = !{!"any pointer", !7, i64 0}
!13 = !{!"int", !7, i64 0}
!14 = !{!7, !7, i64 0}
!15 = !{!16}
!16 = distinct !{!16, !17}
!17 = distinct !{!17, !"LVerDomain"}
!18 = !{!19}
!19 = distinct !{!19, !17}
!20 = distinct !{!20, !21, !22, !23}
!21 = !{!"llvm.loop.mustprogress"}
!22 = !{!"llvm.loop.isvectorized", i32 1}
!23 = !{!"llvm.loop.unroll.runtime.disable"}
!24 = distinct !{!24, !25}
!25 = !{!"llvm.loop.unroll.disable"}
!26 = distinct !{!26, !21, !22}
!27 = distinct !{!27, !21}
!28 = !{!10, !6, i64 352}
!29 = !{!30}
!30 = distinct !{!30, !31}
!31 = distinct !{!31, !"LVerDomain"}
!32 = !{!33}
!33 = distinct !{!33, !31}
!34 = distinct !{!34, !21, !22, !23}
!35 = distinct !{!35, !25}
!36 = distinct !{!36, !21, !22}
!37 = distinct !{!37, !21}


; Effective O3 passes: CorrelatedValuePropagationPass,DSEPass,EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,IndVarSimplifyPass,InferFunctionAttrsPass,InstCombinePass,InstSimplifyPass,JumpThreadingPass,LCSSAPass,LICMPass,LoopLoadEliminationPass,LoopRotatePass,LoopSimplifyPass,LoopUnrollPass,LoopVectorizePass,MemCpyOptPass,PostOrderFunctionAttrsPass,SLPVectorizerPass,SROAPass,SimplifyCFGPass,TailCallElimPass