val va_lemma_KeyExpansionStdcall : va_b0:va_code -> va_s0:va_state -> win:bool -> alg:algorithm ->
  input_key_b:buffer128 -> output_key_expansion_b:buffer128
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_KeyExpansionStdcall win alg) va_s0 /\ va_get_ok va_s0
    /\ (let (key_ptr:(va_int_range 0 18446744073709551615)) = (if win then va_get_reg64 rRcx va_s0
    else va_get_reg64 rRdi va_s0) in let (key_expansion_ptr:(va_int_range 0 18446744073709551615))
    = (if win then va_get_reg64 rRdx va_s0 else va_get_reg64 rRsi va_s0) in let
    (key:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = (if (alg = AES_128) then
    Vale.Arch.Types.quad32_to_seq (Vale.X64.Decls.buffer128_read input_key_b 0 (va_get_mem va_s0))
    else Vale.AES.AES256_helpers.make_AES256_key (Vale.X64.Decls.buffer128_read input_key_b 0
    (va_get_mem va_s0)) (Vale.X64.Decls.buffer128_read input_key_b 1 (va_get_mem va_s0))) in
    Vale.X64.Memory.is_initial_heap (va_get_mem_layout va_s0) (va_get_mem va_s0) /\ (aesni_enabled
    /\ avx_enabled /\ sse_enabled) /\ (alg = AES_128 \/ alg = AES_256) /\
    Vale.X64.Decls.buffers_disjoint128 input_key_b output_key_expansion_b /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem va_s0) key_ptr input_key_b (if (alg = AES_128) then
    1 else 2) (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem
    va_s0) key_expansion_ptr output_key_expansion_b (Vale.AES.AES_common_s.nr alg + 1)
    (va_get_mem_layout va_s0) Secret)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (let (key_ptr:(va_int_range 0 18446744073709551615)) = (if win then va_get_reg64 rRcx va_s0
    else va_get_reg64 rRdi va_s0) in let (key_expansion_ptr:(va_int_range 0 18446744073709551615))
    = (if win then va_get_reg64 rRdx va_s0 else va_get_reg64 rRsi va_s0) in let
    (key:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = (if (alg = AES_128) then
    Vale.Arch.Types.quad32_to_seq (Vale.X64.Decls.buffer128_read input_key_b 0 (va_get_mem va_s0))
    else Vale.AES.AES256_helpers.make_AES256_key (Vale.X64.Decls.buffer128_read input_key_b 0
    (va_get_mem va_s0)) (Vale.X64.Decls.buffer128_read input_key_b 1 (va_get_mem va_s0))) in
    Vale.X64.Decls.modifies_buffer128 output_key_expansion_b (va_get_mem va_s0) (va_get_mem va_sM)
    /\ (forall j . 0 <= j /\ j <= Vale.AES.AES_common_s.nr alg ==> Vale.X64.Decls.buffer128_read
    output_key_expansion_b j (va_get_mem va_sM) == FStar.Seq.Base.index #Vale.Def.Types_s.quad32
    (Vale.AES.AES_s.key_to_round_keys_LE alg key) j)) /\ va_state_eq va_sM (va_update_flags va_sM
    (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM
    (va_update_mem_layout va_sM (va_update_mem_heaplet 1 va_sM (va_update_reg64 rRdx va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))
val va_lemma_KeyExpansionStdcall : va_b0:va_code -> va_s0:va_state -> win:bool -> alg:algorithm ->
  input_key_b:buffer128 -> output_key_expansion_b:buffer128
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_KeyExpansionStdcall win alg) va_s0 /\ va_get_ok va_s0
    /\ (let (key_ptr:(va_int_range 0 18446744073709551615)) = (if win then va_get_reg64 rRcx va_s0
    else va_get_reg64 rRdi va_s0) in let (key_expansion_ptr:(va_int_range 0 18446744073709551615))
    = (if win then va_get_reg64 rRdx va_s0 else va_get_reg64 rRsi va_s0) in let
    (key:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = (if (alg = AES_128) then
    Vale.Arch.Types.quad32_to_seq (Vale.X64.Decls.buffer128_read input_key_b 0 (va_get_mem va_s0))
    else Vale.AES.AES256_helpers.make_AES256_key (Vale.X64.Decls.buffer128_read input_key_b 0
    (va_get_mem va_s0)) (Vale.X64.Decls.buffer128_read input_key_b 1 (va_get_mem va_s0))) in
    Vale.X64.Memory.is_initial_heap (va_get_mem_layout va_s0) (va_get_mem va_s0) /\ (aesni_enabled
    /\ avx_enabled /\ sse_enabled) /\ (alg = AES_128 \/ alg = AES_256) /\
    Vale.X64.Decls.buffers_disjoint128 input_key_b output_key_expansion_b /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem va_s0) key_ptr input_key_b (if (alg = AES_128) then
    1 else 2) (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem
    va_s0) key_expansion_ptr output_key_expansion_b (Vale.AES.AES_common_s.nr alg + 1)
    (va_get_mem_layout va_s0) Secret)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (let (key_ptr:(va_int_range 0 18446744073709551615)) = (if win then va_get_reg64 rRcx va_s0
    else va_get_reg64 rRdi va_s0) in let (key_expansion_ptr:(va_int_range 0 18446744073709551615))
    = (if win then va_get_reg64 rRdx va_s0 else va_get_reg64 rRsi va_s0) in let
    (key:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = (if (alg = AES_128) then
    Vale.Arch.Types.quad32_to_seq (Vale.X64.Decls.buffer128_read input_key_b 0 (va_get_mem va_s0))
    else Vale.AES.AES256_helpers.make_AES256_key (Vale.X64.Decls.buffer128_read input_key_b 0
    (va_get_mem va_s0)) (Vale.X64.Decls.buffer128_read input_key_b 1 (va_get_mem va_s0))) in
    Vale.X64.Decls.modifies_buffer128 output_key_expansion_b (va_get_mem va_s0) (va_get_mem va_sM)
    /\ (forall j . 0 <= j /\ j <= Vale.AES.AES_common_s.nr alg ==> Vale.X64.Decls.buffer128_read
    output_key_expansion_b j (va_get_mem va_sM) == FStar.Seq.Base.index #Vale.Def.Types_s.quad32
    (Vale.AES.AES_s.key_to_round_keys_LE alg key) j)) /\ va_state_eq va_sM (va_update_flags va_sM
    (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM
    (va_update_mem_layout va_sM (va_update_mem_heaplet 1 va_sM (va_update_reg64 rRdx va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))
let va_lemma_KeyExpansionStdcall va_b0 va_s0 win alg input_key_b output_key_expansion_b =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_mem_layout; va_Mod_mem_heaplet 1; va_Mod_reg64 rRdx; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_KeyExpansionStdcall va_mods win alg input_key_b output_key_expansion_b in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_KeyExpansionStdcall win alg) va_qc
    va_s0 (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 56 column 1 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (va_get_ok va_sM) /\ (let (key_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    va_get_reg64 rRcx va_s0) (fun _ -> va_get_reg64 rRdi va_s0) in let
    (key_expansion_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ -> va_get_reg64
    rRdx va_s0) (fun _ -> va_get_reg64 rRsi va_s0) in let (key:(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat32)) = va_if (alg = AES_128) (fun _ -> Vale.Arch.Types.quad32_to_seq
    (Vale.X64.Decls.buffer128_read input_key_b 0 (va_get_mem va_s0))) (fun _ ->
    Vale.AES.AES256_helpers.make_AES256_key (Vale.X64.Decls.buffer128_read input_key_b 0
    (va_get_mem va_s0)) (Vale.X64.Decls.buffer128_read input_key_b 1 (va_get_mem va_s0))) in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 83 column 66 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 output_key_expansion_b (va_get_mem va_s0) (va_get_mem
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 85 column 103 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (forall j . 0 <= j /\ j <= Vale.AES.AES_common_s.nr alg ==> Vale.X64.Decls.buffer128_read
    output_key_expansion_b j (va_get_mem va_sM) == FStar.Seq.Base.index #Vale.Def.Types_s.quad32
    (Vale.AES.AES_s.key_to_round_keys_LE alg key) j))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_mem_layout; va_Mod_mem_heaplet 1; va_Mod_reg64 rRdx; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)
module Vale.AES.X64.AES
open Vale.Def.Types_s
open FStar.Seq
open Vale.Arch.HeapImpl
open Vale.AES.AES_s
open Vale.X64.Machine_s
open Vale.X64.Memory
open Vale.X64.State
open Vale.X64.Decls
open Vale.X64.InsBasic
open Vale.X64.InsMem
open Vale.X64.InsVector
//open Vale.X64.InsAes
open Vale.X64.QuickCode
open Vale.X64.QuickCodes
open Vale.Arch.Types
//open Vale.AES.AES_helpers
open Vale.AES.AES256_helpers
open Vale.Def.Opaque_s
open Vale.AES.X64.AES128
open Vale.AES.X64.AES256
open Vale.AES.GCTR
open Vale.X64.CPU_Features_s
open Vale.X64.Stack
#reset-options "--z3rlimit 20"
//-- KeyExpansionStdcall

[@ "opaque_to_smt" va_qattr]
let va_code_KeyExpansionStdcall win alg =
  (va_Block (va_CCons (va_code_CreateHeaplets ()) (va_CCons (if (alg = AES_128) then va_Block
    (va_CCons (va_code_KeyExpansion128Stdcall win) (va_CNil ())) else va_Block (va_CCons
    (va_code_KeyExpansion256Stdcall win) (va_CNil ()))) (va_CCons (va_code_DestroyHeaplets ())
    (va_CNil ())))))

[@ "opaque_to_smt" va_qattr]
let va_codegen_success_KeyExpansionStdcall win alg =
  (va_pbool_and (va_codegen_success_CreateHeaplets ()) (va_pbool_and (if (alg = AES_128) then
    va_pbool_and (va_codegen_success_KeyExpansion128Stdcall win) (va_ttrue ()) else va_pbool_and
    (va_codegen_success_KeyExpansion256Stdcall win) (va_ttrue ())) (va_pbool_and
    (va_codegen_success_DestroyHeaplets ()) (va_ttrue ()))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_KeyExpansionStdcall (va_mods:va_mods_t) (win:bool) (alg:algorithm)
  (input_key_b:buffer128) (output_key_expansion_b:buffer128) : (va_quickCode unit
  (va_code_KeyExpansionStdcall win alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (key_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ -> va_get_reg64 rRcx va_s)
    (fun _ -> va_get_reg64 rRdi va_s) in let (key_expansion_ptr:(va_int_range 0
    18446744073709551615)) = va_if win (fun _ -> va_get_reg64 rRdx va_s) (fun _ -> va_get_reg64
    rRsi va_s) in let (key:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = va_if (alg = AES_128)
    (fun _ -> Vale.Arch.Types.quad32_to_seq (Vale.X64.Decls.buffer128_read input_key_b 0
    (va_get_mem va_s))) (fun _ -> Vale.AES.AES256_helpers.make_AES256_key
    (Vale.X64.Decls.buffer128_read input_key_b 0 (va_get_mem va_s)) (Vale.X64.Decls.buffer128_read
    input_key_b 1 (va_get_mem va_s))) in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 87 column 19 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (va_quick_CreateHeaplets ([declare_buffer128 input_key_b 0 Secret Immutable; declare_buffer128
    output_key_expansion_b 1 Secret Mutable])) (fun (va_s:va_state) _ -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 91 column 15 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (va_qInlineIf va_mods (alg = AES_128) (qblock va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 92 column 31 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (va_quick_KeyExpansion128Stdcall win input_key_b output_key_expansion_b) (va_QEmpty (()))))
    (qblock va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 94 column 31 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (va_quick_KeyExpansion256Stdcall win input_key_b output_key_expansion_b) (va_QEmpty (())))))
    (fun (va_s:va_state) va_g -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 97 column 20 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
    (va_quick_DestroyHeaplets ()) (va_QEmpty (()))))))
/
Vale.X64.State.fsti.checked Vale.X64.Stack.fsti.checked Vale.X64.QuickCodes.fsti.checked Vale.X64.QuickCode.fst.checked Vale.X64.Memory.fsti.checked Vale.X64.Machine_s.fst.checked Vale.X64.InsVector.fsti.checked Vale.X64.InsMem.fsti.checked Vale.X64.InsBasic.fsti.checked Vale.X64.Decls.fsti.checked Vale.X64.CPU_Features_s.fst.checked Vale.Def.Types_s.fst.checked Vale.Def.Opaque_s.fsti.checked Vale.Arch.Types.fsti.checked Vale.Arch.HeapImpl.fsti.checked Vale.AES.X64.AES256.fsti.checked Vale.AES.X64.AES128.fsti.checked Vale.AES.GCTR.fsti.checked Vale.AES.AES_s.fst.checked Vale.AES.AES_common_s.fst.checked Vale.AES.AES256_helpers.fsti.checked prims.fst.checked FStar.Seq.Base.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked
Vale.AES.X64.AES.fst

    va_b0: Vale.X64.Decls.va_code ->
    va_s0: Vale.X64.Decls.va_state ->
    win: Prims.bool ->
    alg: Vale.AES.AES_common_s.algorithm ->
    input_key_b: Vale.X64.Memory.buffer128 ->
    output_key_expansion_b: Vale.X64.Memory.buffer128
  -> Prims.Ghost (Vale.X64.Decls.va_state * Vale.X64.Decls.va_fuel)
Vale.X64.Decls.va_code Vale.X64.Decls.va_state Prims.bool Vale.AES.AES_common_s.algorithm Vale.X64.Memory.buffer128 Vale.X64.QuickCodes.fuel Prims.unit FStar.Pervasives.Native.Mktuple2 Vale.X64.Decls.va_fuel Vale.X64.QuickCode.va_lemma_norm_mods Prims.Cons Vale.X64.QuickCode.mod_t Vale.X64.QuickCode.va_Mod_flags Vale.X64.QuickCode.va_Mod_xmm Vale.X64.QuickCode.va_Mod_mem_layout Vale.X64.QuickCode.va_Mod_mem_heaplet Vale.X64.QuickCode.va_Mod_reg64 Vale.X64.Machine_s.rRdx Vale.X64.QuickCode.va_Mod_ok Vale.X64.QuickCode.va_Mod_mem Prims.Nil FStar.Pervasives.assert_norm Prims.eq2 Prims.list Vale.X64.QuickCode.__proj__QProc__item__mods Vale.AES.X64.AES.va_code_KeyExpansionStdcall FStar.Pervasives.Native.tuple2 FStar.Pervasives.Native.tuple3 Vale.X64.State.vale_state Vale.X64.QuickCodes.va_wp_sound_code_norm Prims.l_and Vale.X64.QuickCodes.label Vale.X64.QuickCodes.va_range1 Prims.b2t Vale.X64.Decls.va_get_ok Vale.X64.Decls.modifies_buffer128 Vale.X64.Decls.va_get_mem Prims.l_Forall Prims.int Prims.op_GreaterThanOrEqual Prims.op_LessThan FStar.Seq.Base.length Vale.Def.Types_s.quad32 Vale.AES.AES_s.key_to_round_keys_LE Prims.l_imp Prims.op_LessThanOrEqual Vale.AES.AES_common_s.nr Vale.X64.Decls.buffer128_read FStar.Seq.Base.index FStar.Seq.Base.seq Vale.Def.Words_s.nat32 Vale.X64.Decls.va_if Prims.op_Equality Vale.AES.AES_common_s.AES_128 Vale.Arch.Types.quad32_to_seq Prims.l_not Vale.AES.AES256_helpers.make_AES256_key Vale.X64.Decls.va_int_range Vale.Def.Types_s.nat64 Vale.X64.Decls.va_get_reg64 Vale.X64.Machine_s.rRsi Vale.X64.Machine_s.rRcx Vale.X64.Machine_s.rRdi Vale.X64.QuickCode.quickCode Vale.AES.X64.AES.va_qcode_KeyExpansionStdcall
let va_lemma_KeyExpansionStdcall va_b0 va_s0 win alg input_key_b output_key_expansion_b =
  
let va_mods:va_mods_t =
  [
    va_Mod_flags; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_mem_layout;
    va_Mod_mem_heaplet 1; va_Mod_reg64 rRdx; va_Mod_ok; va_Mod_mem
  ]
in
let va_qc = va_qcode_KeyExpansionStdcall va_mods win alg input_key_b output_key_expansion_b in
let va_sM, va_fM, va_g =
  va_wp_sound_code_norm (va_code_KeyExpansionStdcall win alg)
    va_qc
    va_s0
    (fun va_s0 va_sM va_g ->
        let () = va_g in
        label va_range1
          "***** POSTCONDITION NOT MET AT line 56 column 1 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
          (va_get_ok va_sM) /\
        (let key_ptr:(va_int_range 0 18446744073709551615) =
            va_if win (fun _ -> va_get_reg64 rRcx va_s0) (fun _ -> va_get_reg64 rRdi va_s0)
          in
          let key_expansion_ptr:(va_int_range 0 18446744073709551615) =
            va_if win (fun _ -> va_get_reg64 rRdx va_s0) (fun _ -> va_get_reg64 rRsi va_s0)
          in
          let key:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32) =
            va_if (alg = AES_128)
              (fun _ ->
                  Vale.Arch.Types.quad32_to_seq (Vale.X64.Decls.buffer128_read input_key_b
                        0
                        (va_get_mem va_s0)))
              (fun _ ->
                  Vale.AES.AES256_helpers.make_AES256_key (Vale.X64.Decls.buffer128_read input_key_b
                        0
                        (va_get_mem va_s0))
                    (Vale.X64.Decls.buffer128_read input_key_b 1 (va_get_mem va_s0)))
          in
          label va_range1
            "***** POSTCONDITION NOT MET AT line 83 column 66 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
            (Vale.X64.Decls.modifies_buffer128 output_key_expansion_b
                (va_get_mem va_s0)
                (va_get_mem va_sM)) /\
          label va_range1
            "***** POSTCONDITION NOT MET AT line 85 column 103 of file /home/gebner/fstar_dataset/projects/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.AES.vaf *****"
            (forall j.
                0 <= j /\ j <= Vale.AES.AES_common_s.nr alg ==>
                Vale.X64.Decls.buffer128_read output_key_expansion_b j (va_get_mem va_sM) ==
                FStar.Seq.Base.index #Vale.Def.Types_s.quad32
                  (Vale.AES.AES_s.key_to_round_keys_LE alg key)
                  j)))
in
assert_norm (va_qc.mods == va_mods);
va_lemma_norm_mods ([
      va_Mod_flags; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_mem_layout;
      va_Mod_mem_heaplet 1; va_Mod_reg64 rRdx; va_Mod_ok; va_Mod_mem
    ])
  va_sM
  va_s0;
(va_sM, va_fM)