; LLVM IR from sca-secure-library-sca25519/sca25519 :: STM32F407-unprotected/crypto/scalarmult (scalarmult_25519)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct._ST_curve25519ladderstepWorkingState = type { %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, i32, i8 }
%union.UN_256bitValue_ = type { [4 x %union.UN_64bitValue_] }
%union.UN_64bitValue_ = type { [1 x i64] }

; Function Attrs: nounwind uwtable
define dso_local i32 @crypto_scalarmult_curve25519(ptr noundef %0, ptr noundef %1, ptr noundef %2) #0 {
  %4 = alloca ptr, align 8
  %5 = alloca ptr, align 8
  %6 = alloca ptr, align 8
  %7 = alloca %struct._ST_curve25519ladderstepWorkingState, align 8
  %8 = alloca i8, align 1
  %9 = alloca i8, align 1
  %10 = alloca i8, align 1
  %11 = alloca i8, align 1
  %12 = alloca i8, align 1
  store ptr %0, ptr %4, align 8, !tbaa !5
  store ptr %1, ptr %5, align 8, !tbaa !5
  store ptr %2, ptr %6, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 232, ptr %7) #4
  call void @llvm.lifetime.start.p0(i64 1, ptr %8) #4
  store i8 0, ptr %8, align 1, !tbaa !9
  br label %13

13:                                               ; preds = %27, %3
  %14 = load i8, ptr %8, align 1, !tbaa !9
  %15 = zext i8 %14 to i32
  %16 = icmp slt i32 %15, 32
  br i1 %16, label %17, label %30

17:                                               ; preds = %13
  %18 = load ptr, ptr %5, align 8, !tbaa !5
  %19 = load i8, ptr %8, align 1, !tbaa !9
  %20 = zext i8 %19 to i64
  %21 = getelementptr inbounds i8, ptr %18, i64 %20
  %22 = load i8, ptr %21, align 1, !tbaa !9
  %23 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %24 = load i8, ptr %8, align 1, !tbaa !9
  %25 = zext i8 %24 to i64
  %26 = getelementptr inbounds [32 x i8], ptr %23, i64 0, i64 %25
  store i8 %22, ptr %26, align 1, !tbaa !9
  br label %27

27:                                               ; preds = %17
  %28 = load i8, ptr %8, align 1, !tbaa !9
  %29 = add i8 %28, 1
  store i8 %29, ptr %8, align 1, !tbaa !9
  br label %13, !llvm.loop !10

30:                                               ; preds = %13
  %31 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %32 = getelementptr inbounds [32 x i8], ptr %31, i64 0, i64 0
  %33 = load i8, ptr %32, align 8, !tbaa !9
  %34 = zext i8 %33 to i32
  %35 = and i32 %34, 248
  %36 = trunc i32 %35 to i8
  store i8 %36, ptr %32, align 8, !tbaa !9
  %37 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %38 = getelementptr inbounds [32 x i8], ptr %37, i64 0, i64 31
  %39 = load i8, ptr %38, align 1, !tbaa !9
  %40 = zext i8 %39 to i32
  %41 = and i32 %40, 127
  %42 = trunc i32 %41 to i8
  store i8 %42, ptr %38, align 1, !tbaa !9
  %43 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %44 = getelementptr inbounds [32 x i8], ptr %43, i64 0, i64 31
  %45 = load i8, ptr %44, align 1, !tbaa !9
  %46 = zext i8 %45 to i32
  %47 = or i32 %46, 64
  %48 = trunc i32 %47 to i8
  store i8 %48, ptr %44, align 1, !tbaa !9
  %49 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  %50 = load ptr, ptr %6, align 8, !tbaa !5
  call void @fe25519_unpack(ptr noundef %49, ptr noundef %50)
  %51 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 4
  call void @fe25519_setone(ptr noundef %51)
  %52 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 3
  %53 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  call void @fe25519_cpy(ptr noundef %52, ptr noundef %53)
  %54 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  call void @fe25519_setone(ptr noundef %54)
  %55 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  call void @fe25519_setzero(ptr noundef %55)
  %56 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  store i32 254, ptr %56, align 8, !tbaa !12
  %57 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 8
  store i8 0, ptr %57, align 4, !tbaa !15
  br label %58

58:                                               ; preds = %62, %30
  %59 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %60 = load i32, ptr %59, align 8, !tbaa !12
  %61 = icmp sge i32 %60, 0
  br i1 %61, label %62, label %95

62:                                               ; preds = %58
  call void @llvm.lifetime.start.p0(i64 1, ptr %9) #4
  %63 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %64 = load i32, ptr %63, align 8, !tbaa !12
  %65 = ashr i32 %64, 3
  %66 = trunc i32 %65 to i8
  store i8 %66, ptr %9, align 1, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 1, ptr %10) #4
  %67 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %68 = load i32, ptr %67, align 8, !tbaa !12
  %69 = and i32 %68, 7
  %70 = trunc i32 %69 to i8
  store i8 %70, ptr %10, align 1, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 1, ptr %11) #4
  call void @llvm.lifetime.start.p0(i64 1, ptr %12) #4
  %71 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %72 = load i8, ptr %9, align 1, !tbaa !9
  %73 = zext i8 %72 to i64
  %74 = getelementptr inbounds [32 x i8], ptr %71, i64 0, i64 %73
  %75 = load i8, ptr %74, align 1, !tbaa !9
  %76 = zext i8 %75 to i32
  %77 = load i8, ptr %10, align 1, !tbaa !9
  %78 = zext i8 %77 to i32
  %79 = ashr i32 %76, %78
  %80 = and i32 1, %79
  %81 = trunc i32 %80 to i8
  store i8 %81, ptr %11, align 1, !tbaa !9
  %82 = load i8, ptr %11, align 1, !tbaa !9
  %83 = zext i8 %82 to i32
  %84 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 8
  %85 = load i8, ptr %84, align 4, !tbaa !15
  %86 = zext i8 %85 to i32
  %87 = xor i32 %83, %86
  %88 = trunc i32 %87 to i8
  store i8 %88, ptr %12, align 1, !tbaa !9
  %89 = load i8, ptr %11, align 1, !tbaa !9
  %90 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 8
  store i8 %89, ptr %90, align 4, !tbaa !15
  %91 = load i8, ptr %12, align 1, !tbaa !9
  call void @curve25519_cswap(ptr noundef %7, i8 noundef zeroext %91)
  call void @curve25519_ladderstep(ptr noundef %7)
  %92 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %93 = load i32, ptr %92, align 8, !tbaa !12
  %94 = add nsw i32 %93, -1
  store i32 %94, ptr %92, align 8, !tbaa !12
  call void @llvm.lifetime.end.p0(i64 1, ptr %12) #4
  call void @llvm.lifetime.end.p0(i64 1, ptr %11) #4
  call void @llvm.lifetime.end.p0(i64 1, ptr %10) #4
  call void @llvm.lifetime.end.p0(i64 1, ptr %9) #4
  br label %58, !llvm.loop !16

95:                                               ; preds = %58
  %96 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 8
  %97 = load i8, ptr %96, align 4, !tbaa !15
  call void @curve25519_cswap(ptr noundef %7, i8 noundef zeroext %97)
  %98 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %99 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %100 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 3
  %101 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 4
  %102 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef %98, ptr noundef %99, ptr noundef %100, ptr noundef %101, ptr noundef %102)
  %103 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %104 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %105 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %103, ptr noundef %104, ptr noundef %105)
  %106 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  call void @fe25519_reduceCompletely(ptr noundef %106)
  %107 = load ptr, ptr %4, align 8, !tbaa !5
  %108 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  call void @fe25519_pack(ptr noundef %107, ptr noundef %108)
  call void @llvm.lifetime.end.p0(i64 1, ptr %8) #4
  call void @llvm.lifetime.end.p0(i64 232, ptr %7) #4
  ret i32 0
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

declare void @fe25519_unpack(ptr noundef, ptr noundef) #2

declare void @fe25519_setone(ptr noundef) #2

declare void @fe25519_cpy(ptr noundef, ptr noundef) #2

declare void @fe25519_setzero(ptr noundef) #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_cswap(ptr noundef, i8 noundef zeroext) #0

; Function Attrs: alwaysinline nounwind uwtable
declare void @curve25519_ladderstep(ptr noundef) #3

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

declare void @fe25519_invert_useProvidedScratchBuffers(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) #2

declare void @fe25519_mul_asm(ptr noundef, ptr noundef, ptr noundef) #2

declare void @fe25519_reduceCompletely(ptr noundef) #2

declare void @fe25519_pack(ptr noundef, ptr noundef) #2

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { alwaysinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!7, !7, i64 0}
!10 = distinct !{!10, !11}
!11 = !{!"llvm.loop.mustprogress"}
!12 = !{!13, !14, i64 224}
!13 = !{!"_ST_curve25519ladderstepWorkingState", !7, i64 0, !7, i64 32, !7, i64 64, !7, i64 96, !7, i64 128, !7, i64 160, !7, i64 192, !14, i64 224, !7, i64 228}
!14 = !{!"int", !7, i64 0}
!15 = !{!13, !7, i64 228}
!16 = distinct !{!16, !11}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct._ST_curve25519ladderstepWorkingState = type { %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, i32, i8 }
%union.UN_256bitValue_ = type { [4 x %union.UN_64bitValue_] }
%union.UN_64bitValue_ = type { [1 x i64] }

; Function Attrs: nounwind uwtable
define dso_local noundef i32 @crypto_scalarmult_curve25519(ptr noundef %0, ptr nocapture noundef readonly %1, ptr noundef %2) local_unnamed_addr #0 {
  %4 = alloca %struct._ST_curve25519ladderstepWorkingState, align 8
  call void @llvm.lifetime.start.p0(i64 232, ptr nonnull %4) #5
  %5 = getelementptr inbounds i8, ptr %4, i64 192
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 8 dereferenceable(32) %5, ptr noundef nonnull align 1 dereferenceable(32) %1, i64 32, i1 false), !tbaa !5
  %6 = load i8, ptr %5, align 8, !tbaa !5
  %7 = and i8 %6, -8
  store i8 %7, ptr %5, align 8, !tbaa !5
  %8 = getelementptr inbounds i8, ptr %4, i64 223
  %9 = load i8, ptr %8, align 1, !tbaa !5
  %10 = and i8 %9, 63
  %11 = or disjoint i8 %10, 64
  store i8 %11, ptr %8, align 1, !tbaa !5
  call void @fe25519_unpack(ptr noundef nonnull %4, ptr noundef %2) #5
  %12 = getelementptr inbounds i8, ptr %4, i64 128
  call void @fe25519_setone(ptr noundef nonnull %12) #5
  %13 = getelementptr inbounds i8, ptr %4, i64 96
  call void @fe25519_cpy(ptr noundef nonnull %13, ptr noundef nonnull %4) #5
  %14 = getelementptr inbounds i8, ptr %4, i64 32
  call void @fe25519_setone(ptr noundef nonnull %14) #5
  %15 = getelementptr inbounds i8, ptr %4, i64 64
  call void @fe25519_setzero(ptr noundef nonnull %15) #5
  %16 = getelementptr inbounds i8, ptr %4, i64 224
  store i32 254, ptr %16, align 8, !tbaa !8
  %17 = getelementptr inbounds i8, ptr %4, i64 228
  store i8 0, ptr %17, align 4, !tbaa !11
  br label %18

18:                                               ; preds = %3, %18
  %19 = phi i32 [ 254, %3 ], [ %33, %18 ]
  %20 = lshr i32 %19, 3
  %21 = and i32 %19, 7
  %22 = and i32 %20, 255
  %23 = zext nneg i32 %22 to i64
  %24 = getelementptr inbounds [32 x i8], ptr %5, i64 0, i64 %23
  %25 = load i8, ptr %24, align 1, !tbaa !5
  %26 = zext i8 %25 to i32
  %27 = lshr i32 %26, %21
  %28 = trunc nuw i32 %27 to i8
  %29 = and i8 %28, 1
  %30 = load i8, ptr %17, align 4, !tbaa !11
  %31 = xor i8 %29, %30
  store i8 %29, ptr %17, align 4, !tbaa !11
  call void @curve25519_cswap(ptr noundef nonnull %4, i8 noundef zeroext %31)
  call void @curve25519_ladderstep(ptr noundef nonnull %4)
  %32 = load i32, ptr %16, align 8, !tbaa !8
  %33 = add nsw i32 %32, -1
  store i32 %33, ptr %16, align 8, !tbaa !8
  %34 = icmp sgt i32 %32, 0
  br i1 %34, label %18, label %35, !llvm.loop !12

35:                                               ; preds = %18
  %36 = load i8, ptr %17, align 4, !tbaa !11
  call void @curve25519_cswap(ptr noundef nonnull %4, i8 noundef zeroext %36)
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef nonnull %15, ptr noundef nonnull %15, ptr noundef nonnull %13, ptr noundef nonnull %12, ptr noundef nonnull %4) #5
  call void @fe25519_mul_asm(ptr noundef nonnull %14, ptr noundef nonnull %14, ptr noundef nonnull %15) #5
  call void @fe25519_reduceCompletely(ptr noundef nonnull %14) #5
  call void @fe25519_pack(ptr noundef %0, ptr noundef nonnull %14) #5
  call void @llvm.lifetime.end.p0(i64 232, ptr nonnull %4) #5
  ret i32 0
}

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

declare void @fe25519_unpack(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_setone(ptr noundef) local_unnamed_addr #2

declare void @fe25519_cpy(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_setzero(ptr noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_cswap(ptr noundef, i8 noundef zeroext) local_unnamed_addr #0

; Function Attrs: alwaysinline nounwind uwtable
declare void @curve25519_ladderstep(ptr noundef) local_unnamed_addr #3

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

declare void @fe25519_invert_useProvidedScratchBuffers(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_mul_asm(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_reduceCompletely(ptr noundef) local_unnamed_addr #2

declare void @fe25519_pack(ptr noundef, ptr noundef) local_unnamed_addr #2

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #4

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { alwaysinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #5 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"omnipotent char", !7, i64 0}
!7 = !{!"Simple C/C++ TBAA"}
!8 = !{!9, !10, i64 224}
!9 = !{!"_ST_curve25519ladderstepWorkingState", !6, i64 0, !6, i64 32, !6, i64 64, !6, i64 96, !6, i64 128, !6, i64 160, !6, i64 192, !10, i64 224, !6, i64 228}
!10 = !{!"int", !6, i64 0}
!11 = !{!9, !6, i64 228}
!12 = distinct !{!12, !13}
!13 = !{!"llvm.loop.mustprogress"}


; Effective O3 passes: EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,IndVarSimplifyPass,InferFunctionAttrsPass,InstCombinePass,JumpThreadingPass,LICMPass,LoopIdiomRecognizePass,LoopRotatePass,PostOrderFunctionAttrsPass,SROAPass,SimplifyCFGPass