val va_wp_Loop6x_ctr_update
      (alg: algorithm)
      (h_LE: quad32)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0
let va_wp_Loop6x_ctr_update (alg:algorithm) (h_LE:quad32) (key_words:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state
  -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in sse_enabled /\ aes_reqs_offset alg key_words
    round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout
    va_s0) /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216
    /\ va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    0) /\ va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus`
    256 /\ va_get_xmm 9 va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0, va_get_xmm 12 va_s0,
    va_get_xmm 13 va_s0, va_get_xmm 14 va_s0) == xor_reverse_inc32lite_6 1 0 ctr_BE (va_get_xmm 15
    va_s0)) /\ hkeys_b_powers hkeys_b (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0)
    (va_get_reg64 rR9 va_s0 - 32) h) /\ (forall (va_x_rbx:nat64) (va_x_r11:nat64)
    (va_x_xmm3:quad32) (va_x_xmm0:quad32) (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm5:quad32)
    (va_x_xmm6:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_efl:Vale.X64.Flags.t) . let
    va_sM = va_upd_flags va_x_efl (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm
    12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9
    (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1 va_x_xmm1
    (va_upd_xmm 0 va_x_xmm0 (va_upd_xmm 3 va_x_xmm3 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRbx
    va_x_rbx va_s0)))))))))))))) in va_get_ok va_sM /\ (let (h:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in va_get_xmm 1
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\ (0 <=
    va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256) /\ va_get_reg64 rRbx va_sM ==
    Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256
    /\ (va_get_xmm 9 va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM,
    va_get_xmm 13 va_sM, va_get_xmm 14 va_sM) == xor_reverse_inc32lite_6 3 0 ctr_BE (va_get_xmm 15
    va_sM) /\ va_get_xmm 3 va_sM == Vale.X64.Decls.buffer128_read hkeys_b 0 (va_get_mem_heaplet 0
    va_sM)) ==> va_k va_sM (())))
val va_wp_Loop6x_ctr_update
      (alg: algorithm)
      (h_LE: quad32)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0
let va_wp_Loop6x_ctr_update
      (alg: algorithm)
      (h_LE: quad32)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0 =
(va_get_ok va_s0 /\
  (let h:Vale.Math.Poly2_s.poly =
      Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 h_LE)
    in
    sse_enabled /\
    aes_reqs_offset alg
      key_words
      round_keys
      keys_b
      (va_get_reg64 rRcx va_s0)
      (va_get_mem_heaplet 0 va_s0)
      (va_get_mem_layout va_s0) /\
    va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\
    va_get_reg64 rRbx va_s0 == (Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE) `op_Modulus` 256 /\
    va_get_xmm 9 va_s0 ==
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
              0))
      (va_get_xmm 15 va_s0) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==>
      (va_get_xmm 9 va_s0,
        va_get_xmm 10 va_s0,
        va_get_xmm 11 va_s0,
        va_get_xmm 12 va_s0,
        va_get_xmm 13 va_s0,
        va_get_xmm 14 va_s0) ==
      xor_reverse_inc32lite_6 1 0 ctr_BE (va_get_xmm 15 va_s0)) /\
    hkeys_b_powers hkeys_b
      (va_get_mem_heaplet 0 va_s0)
      (va_get_mem_layout va_s0)
      (va_get_reg64 rR9 va_s0 - 32)
      h) /\
  (forall (va_x_rbx: nat64) (va_x_r11: nat64) (va_x_xmm3: quad32) (va_x_xmm0: quad32)
      (va_x_xmm1: quad32) (va_x_xmm2: quad32) (va_x_xmm5: quad32) (va_x_xmm6: quad32)
      (va_x_xmm9: quad32) (va_x_xmm10: quad32) (va_x_xmm11: quad32) (va_x_xmm12: quad32)
      (va_x_xmm13: quad32) (va_x_xmm14: quad32) (va_x_efl: Vale.X64.Flags.t).
      let va_sM =
        va_upd_flags va_x_efl
          (va_upd_xmm 14
              va_x_xmm14
              (va_upd_xmm 13
                  va_x_xmm13
                  (va_upd_xmm 12
                      va_x_xmm12
                      (va_upd_xmm 11
                          va_x_xmm11
                          (va_upd_xmm 10
                              va_x_xmm10
                              (va_upd_xmm 9
                                  va_x_xmm9
                                  (va_upd_xmm 6
                                      va_x_xmm6
                                      (va_upd_xmm 5
                                          va_x_xmm5
                                          (va_upd_xmm 2
                                              va_x_xmm2
                                              (va_upd_xmm 1
                                                  va_x_xmm1
                                                  (va_upd_xmm 0
                                                      va_x_xmm0
                                                      (va_upd_xmm 3
                                                          va_x_xmm3
                                                          (va_upd_reg64 rR11
                                                              va_x_r11
                                                              (va_upd_reg64 rRbx va_x_rbx va_s0)))))
                                          )))))))))
      in
      va_get_ok va_sM /\
      (let h:Vale.Math.Poly2_s.poly =
          Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 h_LE)
        in
        va_get_xmm 1 va_sM ==
        Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\
        (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256) /\
        va_get_reg64 rRbx va_sM ==
        (Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6))
        `op_Modulus`
        256 /\
        (va_get_xmm 9 va_sM,
          va_get_xmm 10 va_sM,
          va_get_xmm 11 va_sM,
          va_get_xmm 12 va_sM,
          va_get_xmm 13 va_sM,
          va_get_xmm 14 va_sM) ==
        xor_reverse_inc32lite_6 3 0 ctr_BE (va_get_xmm 15 va_sM) /\
        va_get_xmm 3 va_sM == Vale.X64.Decls.buffer128_read hkeys_b 0 (va_get_mem_heaplet 0 va_sM)) ==>
      va_k va_sM (())))
Vale.AES.X64.AESopt.fst.checked
Vale.X64.State.fsti.checked Vale.X64.QuickCodes.fsti.checked Vale.X64.QuickCode.fst.checked Vale.X64.Memory.fsti.checked Vale.X64.Machine_s.fst.checked Vale.X64.InsVector.fsti.checked Vale.X64.InsMem.fsti.checked Vale.X64.InsBasic.fsti.checked Vale.X64.InsAes.fsti.checked Vale.X64.Flags.fsti.checked Vale.X64.Decls.fsti.checked Vale.X64.CPU_Features_s.fst.checked Vale.Transformers.Transform.fsti.checked Vale.Math.Poly2_s.fsti.checked Vale.Math.Poly2.Bits_s.fsti.checked Vale.Math.Poly2.Bits.fsti.checked Vale.Def.Words_s.fsti.checked Vale.Def.Types_s.fst.checked Vale.Def.Prop_s.fst.checked Vale.Def.Opaque_s.fsti.checked Vale.Arch.TypesNative.fsti.checked Vale.Arch.Types.fsti.checked Vale.Arch.HeapImpl.fsti.checked Vale.AES.X64.PolyOps.fsti.checked Vale.AES.X64.AESopt2.fsti.checked Vale.AES.X64.AESGCM_expected_code.fsti.checked Vale.AES.GHash.fsti.checked Vale.AES.GF128_s.fsti.checked Vale.AES.GF128.fsti.checked Vale.AES.GCTR_s.fst.checked Vale.AES.GCTR.fsti.checked Vale.AES.GCM_helpers.fsti.checked Vale.AES.AES_s.fst.checked Vale.AES.AES_helpers.fsti.checked Vale.AES.AES_common_s.fst.checked prims.fst.checked FStar.Seq.Base.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.Mul.fst.checked
Vale.AES.X64.AESopt.fst
Vale.AES.AES_common_s.algorithm Vale.X64.Decls.quad32 FStar.Seq.Base.seq Vale.X64.Memory.nat32 Vale.X64.Memory.buffer128 Vale.X64.Decls.va_state Prims.unit Prims.l_and Prims.b2t Vale.X64.Decls.va_get_ok Vale.X64.CPU_Features_s.sse_enabled Vale.AES.X64.AESopt.aes_reqs_offset Vale.X64.Decls.va_get_reg64 Vale.X64.Machine_s.rRcx Vale.X64.Decls.va_get_mem_heaplet Vale.X64.Decls.va_get_mem_layout Prims.eq2 Vale.Def.Words_s.four Vale.Def.Types_s.nat32 Vale.X64.Decls.va_get_xmm Vale.Def.Words_s.Mkfour Vale.Def.Types_s.quad32 Vale.Def.Types_s.reverse_bytes_quad32 Vale.AES.GCTR.inc32lite Prims.int Vale.X64.Machine_s.rRbx Prims.op_Modulus Vale.Def.Words_s.__proj__Mkfour__item__lo0 Vale.Def.Types_s.quad32_xor Prims.l_imp Prims.op_LessThan Prims.op_Addition FStar.Pervasives.Native.tuple6 FStar.Pervasives.Native.Mktuple6 Vale.AES.X64.AESopt.xor_reverse_inc32lite_6 Vale.AES.X64.AESopt2.hkeys_b_powers Prims.op_Subtraction Vale.X64.Machine_s.rR9 Vale.Math.Poly2_s.poly Vale.Math.Poly2.Bits_s.of_quad32 Prims.l_Forall Vale.X64.Memory.nat64 Vale.X64.Flags.t Prims.op_LessThanOrEqual Vale.X64.Decls.buffer128_read Vale.X64.State.vale_state Vale.X64.Decls.va_upd_flags Vale.X64.Decls.va_upd_xmm Vale.X64.Decls.va_upd_reg64 Vale.X64.Machine_s.rR11
module Vale.AES.X64.AESopt
open FStar.Mul
open Vale.Def.Prop_s
open Vale.Def.Opaque_s
open Vale.Def.Words_s
open Vale.Def.Types_s
open FStar.Seq
open Vale.Arch.Types
open Vale.Arch.HeapImpl
open Vale.AES.AES_s
open Vale.X64.Machine_s
open Vale.X64.Memory
open Vale.X64.State
open Vale.X64.Decls
open Vale.X64.InsBasic
open Vale.X64.InsMem
open Vale.X64.InsVector
open Vale.X64.InsAes
open Vale.X64.QuickCode
open Vale.X64.QuickCodes
open Vale.AES.AES_helpers
//open Vale.Poly1305.Math    // For lemma_poly_bits64()
open Vale.AES.GCM_helpers
open Vale.AES.GCTR_s
open Vale.AES.GCTR
open Vale.Arch.TypesNative
open Vale.X64.CPU_Features_s
open Vale.Math.Poly2_s
open Vale.AES.GF128_s
open Vale.AES.GF128
open Vale.AES.GHash
open Vale.AES.X64.PolyOps
open Vale.AES.X64.AESopt2
open Vale.AES.X64.AESGCM_expected_code
open Vale.Transformers.Transform
open FStar.Mul
let add = Vale.Math.Poly2_s.add
#reset-options "--z3rlimit 30"
//-- finish_aes_encrypt_le


val finish_aes_encrypt_le : alg:algorithm -> input_LE:quad32 -> key:(seq nat32)
  -> Lemma
  (requires (Vale.AES.AES_s.is_aes_key_LE alg key))
  (ensures (Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg
    input_LE (Vale.AES.AES_s.key_to_round_keys_LE alg key)))
let finish_aes_encrypt_le alg input_LE key =
  Vale.AES.AES_s.aes_encrypt_LE_reveal ();
  Vale.AES.AES_s.eval_cipher_reveal ();
  ()
//--
//-- Load_two_lsb

[@ "opaque_to_smt"]
let va_code_Load_two_lsb dst =
  (va_Block (va_CCons (va_code_ZeroXmm dst) (va_CCons (va_code_PinsrqImm dst 2 0
    (va_op_reg_opr64_reg64 rR11)) (va_CNil ()))))

[@ "opaque_to_smt"]
let va_codegen_success_Load_two_lsb dst =
  (va_pbool_and (va_codegen_success_ZeroXmm dst) (va_pbool_and (va_codegen_success_PinsrqImm dst 2
    0 (va_op_reg_opr64_reg64 rR11)) (va_ttrue ())))

[@"opaque_to_smt"]
let va_lemma_Load_two_lsb va_b0 va_s0 dst =
  va_reveal_opaque (`%va_code_Load_two_lsb) (va_code_Load_two_lsb dst);
  let (va_old_s:va_state) = va_s0 in
  let (va_b1:va_codes) = va_get_block va_b0 in
  let (va_s3, va_fc3) = va_lemma_ZeroXmm (va_hd va_b1) va_s0 dst in
  let va_b3 = va_tl va_b1 in
  Vale.Arch.Types.lemma_insert_nat64_nat32s (va_eval_xmm va_s3 dst) 2 0;
  assert (Vale.Arch.Types.two_to_nat32 (Vale.Def.Words_s.Mktwo #Vale.Def.Words_s.nat32 2 0) == 2);
  let (va_s6, va_fc6) = va_lemma_PinsrqImm (va_hd va_b3) va_s3 dst 2 0 (va_op_reg_opr64_reg64 rR11)
    in
  let va_b6 = va_tl va_b3 in
  let (va_sM, va_f6) = va_lemma_empty_total va_s6 va_b6 in
  let va_f3 = va_lemma_merge_total va_b3 va_s3 va_fc6 va_s6 va_f6 va_sM in
  let va_fM = va_lemma_merge_total va_b1 va_s0 va_fc3 va_s3 va_f3 va_sM in
  (va_sM, va_fM)


[@"opaque_to_smt"]
let va_wpProof_Load_two_lsb dst va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Load_two_lsb (va_code_Load_two_lsb dst) va_s0 dst in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM
    (va_update_operand_xmm dst va_sM va_s0)))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_reg64 rR11; va_mod_xmm dst]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

//--
//-- Load_0xc2_msb

val va_code_Load_0xc2_msb : dst:va_operand_xmm -> Tot va_code
[@ "opaque_to_smt"]
let va_code_Load_0xc2_msb dst =
  (va_Block (va_CCons (va_code_ZeroXmm dst) (va_CCons (va_code_PinsrqImm dst 13979173243358019584 1
    (va_op_reg_opr64_reg64 rR11)) (va_CNil ()))))

val va_codegen_success_Load_0xc2_msb : dst:va_operand_xmm -> Tot va_pbool
[@ "opaque_to_smt"]
let va_codegen_success_Load_0xc2_msb dst =
  (va_pbool_and (va_codegen_success_ZeroXmm dst) (va_pbool_and (va_codegen_success_PinsrqImm dst
    13979173243358019584 1 (va_op_reg_opr64_reg64 rR11)) (va_ttrue ())))


val va_lemma_Load_0xc2_msb : va_b0:va_code -> va_s0:va_state -> dst:va_operand_xmm
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Load_0xc2_msb dst) va_s0 /\ va_is_dst_xmm dst va_s0 /\
    va_get_ok va_s0 /\ sse_enabled))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    va_eval_xmm va_sM dst == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 3254779904 /\
    va_state_eq va_sM (va_update_flags va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM
    (va_update_operand_xmm dst va_sM va_s0))))))
[@"opaque_to_smt"]
let va_lemma_Load_0xc2_msb va_b0 va_s0 dst =
  va_reveal_opaque (`%va_code_Load_0xc2_msb) (va_code_Load_0xc2_msb dst);
  let (va_old_s:va_state) = va_s0 in
  let (va_b1:va_codes) = va_get_block va_b0 in
  let (va_s3, va_fc3) = va_lemma_ZeroXmm (va_hd va_b1) va_s0 dst in
  let va_b3 = va_tl va_b1 in
  assert (Vale.Arch.Types.two_to_nat32 (Vale.Def.Words_s.Mktwo #Vale.Def.Words_s.nat32 0
    3254779904) == 13979173243358019584);
  Vale.Arch.Types.lemma_insert_nat64_nat32s (va_eval_xmm va_s3 dst) 0 3254779904;
  let (va_s6, va_fc6) = va_lemma_PinsrqImm (va_hd va_b3) va_s3 dst 13979173243358019584 1
    (va_op_reg_opr64_reg64 rR11) in
  let va_b6 = va_tl va_b3 in
  let (va_sM, va_f6) = va_lemma_empty_total va_s6 va_b6 in
  let va_f3 = va_lemma_merge_total va_b3 va_s3 va_fc6 va_s6 va_f6 va_sM in
  let va_fM = va_lemma_merge_total va_b1 va_s0 va_fc3 va_s3 va_f3 va_sM in
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Load_0xc2_msb (dst:va_operand_xmm) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) :
  Type0 =
  (va_is_dst_xmm dst va_s0 /\ va_get_ok va_s0 /\ sse_enabled /\ (forall (va_x_dst:va_value_xmm)
    (va_x_r11:nat64) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_reg64
    rR11 va_x_r11 (va_upd_operand_xmm dst va_x_dst va_s0)) in va_get_ok va_sM /\ va_eval_xmm va_sM
    dst == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 3254779904 ==> va_k va_sM (())))


val va_wpProof_Load_0xc2_msb : dst:va_operand_xmm -> va_s0:va_state -> va_k:(va_state -> unit ->
  Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Load_0xc2_msb dst va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Load_0xc2_msb dst) ([va_Mod_flags;
    va_Mod_reg64 rR11; va_mod_xmm dst]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Load_0xc2_msb dst va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Load_0xc2_msb (va_code_Load_0xc2_msb dst) va_s0 dst in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM
    (va_update_operand_xmm dst va_sM va_s0)))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_reg64 rR11; va_mod_xmm dst]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Load_0xc2_msb (dst:va_operand_xmm) : (va_quickCode unit (va_code_Load_0xc2_msb dst)) =
  (va_QProc (va_code_Load_0xc2_msb dst) ([va_Mod_flags; va_Mod_reg64 rR11; va_mod_xmm dst])
    (va_wp_Load_0xc2_msb dst) (va_wpProof_Load_0xc2_msb dst))
//--
//-- Load_one_lsb

[@ "opaque_to_smt"]
let va_code_Load_one_lsb dst =
  (va_Block (va_CCons (va_code_ZeroXmm dst) (va_CCons (va_code_PinsrqImm dst 1 0
    (va_op_reg_opr64_reg64 rR11)) (va_CNil ()))))

[@ "opaque_to_smt"]
let va_codegen_success_Load_one_lsb dst =
  (va_pbool_and (va_codegen_success_ZeroXmm dst) (va_pbool_and (va_codegen_success_PinsrqImm dst 1
    0 (va_op_reg_opr64_reg64 rR11)) (va_ttrue ())))

[@"opaque_to_smt"]
let va_lemma_Load_one_lsb va_b0 va_s0 dst =
  va_reveal_opaque (`%va_code_Load_one_lsb) (va_code_Load_one_lsb dst);
  let (va_old_s:va_state) = va_s0 in
  let (va_b1:va_codes) = va_get_block va_b0 in
  let (va_s3, va_fc3) = va_lemma_ZeroXmm (va_hd va_b1) va_s0 dst in
  let va_b3 = va_tl va_b1 in
  Vale.Arch.Types.lemma_insert_nat64_nat32s (va_eval_xmm va_s3 dst) 1 0;
  assert (Vale.Arch.Types.two_to_nat32 (Vale.Def.Words_s.Mktwo #Vale.Def.Words_s.nat32 1 0) == 1);
  let (va_s6, va_fc6) = va_lemma_PinsrqImm (va_hd va_b3) va_s3 dst 1 0 (va_op_reg_opr64_reg64 rR11)
    in
  let va_b6 = va_tl va_b3 in
  let (va_sM, va_f6) = va_lemma_empty_total va_s6 va_b6 in
  let va_f3 = va_lemma_merge_total va_b3 va_s3 va_fc6 va_s6 va_f6 va_sM in
  let va_fM = va_lemma_merge_total va_b1 va_s0 va_fc3 va_s3 va_f3 va_sM in
  (va_sM, va_fM)


[@"opaque_to_smt"]
let va_wpProof_Load_one_lsb dst va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Load_one_lsb (va_code_Load_one_lsb dst) va_s0 dst in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM
    (va_update_operand_xmm dst va_sM va_s0)))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_reg64 rR11; va_mod_xmm dst]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

//--
//-- Handle_ctr32

val va_code_Handle_ctr32 : va_dummy:unit -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Handle_ctr32 () =
  (va_Block (va_CCons (va_code_InitPshufbMask (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64 rR11))
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Load_one_lsb (va_op_xmm_xmm 5)) (va_CCons (va_code_VPaddd (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_CCons (va_code_Load_two_lsb (va_op_xmm_xmm 5))
    (va_CCons (va_code_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 10) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 11) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 15)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 12) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 15)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 13) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_CNil
    ()))))))))))))))))))))

val va_codegen_success_Handle_ctr32 : va_dummy:unit -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Handle_ctr32 () =
  (va_pbool_and (va_codegen_success_InitPshufbMask (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64 rR11))
    (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 1) (va_op_xmm_xmm
    0)) (va_pbool_and (va_codegen_success_Load_one_lsb (va_op_xmm_xmm 5)) (va_pbool_and
    (va_codegen_success_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5))
    (va_pbool_and (va_codegen_success_Load_two_lsb (va_op_xmm_xmm 5)) (va_pbool_and
    (va_codegen_success_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5))
    (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 10) (va_op_xmm_xmm
    5)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm
    11) (va_op_xmm_xmm 5)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 11)
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm
    10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 15)) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 12) (va_op_xmm_xmm 5)) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm
    15)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 13)
    (va_op_xmm_xmm 5)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm
    13) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 14)
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm
    1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_ttrue ())))))))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Handle_ctr32 (va_mods:va_mods_t) (ctr_BE:quad32) : (va_quickCode unit
  (va_code_Handle_ctr32 ())) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 256 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_InitPshufbMask (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64 rR11)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 257 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 261 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_Load_one_lsb (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 262 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 263 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_Load_two_lsb (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 264 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 265 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 10) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 266 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 267 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 11) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 268 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 269 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 15)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 270 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 12) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 271 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 272 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 15)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 273 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 13) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 274 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 275 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 276 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_QEmpty
    (())))))))))))))))))))))


val va_lemma_Handle_ctr32 : va_b0:va_code -> va_s0:va_state -> ctr_BE:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Handle_ctr32 ()) va_s0 /\ va_get_ok va_s0 /\
    (avx_enabled /\ sse_enabled /\ va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    ctr_BE)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM, va_get_xmm 13 va_sM, va_get_xmm
    14 va_sM, va_get_xmm 1 va_sM) == xor_reverse_inc32lite_6 2 1 ctr_BE (va_get_xmm 15 va_sM) /\
    va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 6 va_sM
    (va_update_xmm 5 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM
    (va_update_reg64 rR11 va_sM (va_update_ok va_sM va_s0)))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Handle_ctr32 va_b0 va_s0 ctr_BE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rR11; va_Mod_ok] in
  let va_qc = va_qcode_Handle_ctr32 va_mods ctr_BE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Handle_ctr32 ()) va_qc va_s0 (fun va_s0
    va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 234 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_get_ok va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 254 column 107 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    ((va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM, va_get_xmm 13 va_sM,
    va_get_xmm 14 va_sM, va_get_xmm 1 va_sM) == xor_reverse_inc32lite_6 2 1 ctr_BE (va_get_xmm 15
    va_sM))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rR11; va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Handle_ctr32 (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (avx_enabled /\ sse_enabled /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 ctr_BE) /\ (forall (va_x_r11:nat64) (va_x_xmm0:quad32)
    (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_xmm 14 va_x_xmm14
    (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10
    va_x_xmm10 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm
    1 va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR11 va_x_r11 va_s0))))))))))) in va_get_ok
    va_sM /\ (va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM, va_get_xmm 13 va_sM,
    va_get_xmm 14 va_sM, va_get_xmm 1 va_sM) == xor_reverse_inc32lite_6 2 1 ctr_BE (va_get_xmm 15
    va_sM) ==> va_k va_sM (())))


val va_wpProof_Handle_ctr32 : ctr_BE:quad32 -> va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Handle_ctr32 ctr_BE va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Handle_ctr32 ()) ([va_Mod_flags;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR11]) va_s0 va_k ((va_sM,
    va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Handle_ctr32 ctr_BE va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Handle_ctr32 (va_code_Handle_ctr32 ()) va_s0 ctr_BE in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 6 va_sM
    (va_update_xmm 5 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM
    (va_update_reg64 rR11 va_sM (va_update_ok va_sM va_s0))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rR11]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Handle_ctr32 (ctr_BE:quad32) : (va_quickCode unit (va_code_Handle_ctr32 ())) =
  (va_QProc (va_code_Handle_ctr32 ()) ([va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_xmm 0; va_Mod_reg64 rR11]) (va_wp_Handle_ctr32 ctr_BE) (va_wpProof_Handle_ctr32 ctr_BE))
//--
//-- Loop6x_ctr_update

val va_code_Loop6x_ctr_update : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_ctr_update alg =
  (va_Block (va_CCons (va_code_Add64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 6)) (va_CCons
    (va_IfElse (va_cmp_ge (va_op_cmp_reg64 rRbx) (va_const_cmp 256)) (va_Block (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64
    rR9) (0 - 32) Secret) (va_CCons (va_code_Handle_ctr32 ()) (va_CCons (va_code_Sub64
    (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 256)) (va_CNil ()))))) (va_Block (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64
    rR9) (0 - 32) Secret) (va_CCons (va_code_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)
    (va_op_xmm_xmm 14)) (va_CCons (va_code_VPxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 10)
    (va_op_opr128_xmm 15)) (va_CCons (va_code_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11)
    (va_op_opr128_xmm 15)) (va_CNil ()))))))) (va_CNil ()))))

val va_codegen_success_Loop6x_ctr_update : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_ctr_update alg =
  (va_pbool_and (va_codegen_success_Add64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 6))
    (va_pbool_and (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 0)
    (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64 rR9) (0 - 32) Secret) (va_pbool_and
    (va_codegen_success_Handle_ctr32 ()) (va_pbool_and (va_codegen_success_Sub64
    (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 256)) (va_pbool_and
    (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3)
    (va_op_reg_opr64_reg64 rR9) (0 - 32) Secret) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 1) (va_op_xmm_xmm 2) (va_op_xmm_xmm 14)) (va_pbool_and (va_codegen_success_VPxor
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 15)) (va_codegen_success_VPxor
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 15)))))))) (va_ttrue ())))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_ctr_update (va_mods:va_mods_t) (alg:algorithm) (h_LE:quad32) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (ctr_BE:quad32) :
  (va_quickCode unit (va_code_Loop6x_ctr_update alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 339 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_Add64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 6)) (fun (va_s:va_state) _ ->
    va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 340 column 8 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_qIf va_mods (Cmp_ge (va_op_cmp_reg64 rRbx) (va_const_cmp 256)) (qblock va_mods (fun
    (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 341 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64
    rR9) (0 - 32) Secret hkeys_b 0) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 342 column 21 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_Handle_ctr32 ctr_BE) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 343 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_Sub64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 256)) (va_QEmpty (())))))) (qblock
    va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 345 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64
    rR9) (0 - 32) Secret hkeys_b 0) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 346 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 2) (va_op_xmm_xmm 14)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 347 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 15)) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 348 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 15)) (fun
    (va_s:va_state) _ -> let (va_arg36:Prims.nat) = va_get_reg64 rRbx va_old_s in let
    (va_arg35:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_s in let
    (va_arg34:Vale.Def.Types_s.quad32) = va_get_xmm 14 va_s in let
    (va_arg33:Vale.Def.Types_s.quad32) = ctr_BE in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 349 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_msb_in_bounds va_arg33 va_arg34 va_arg35 va_arg36)
    (va_QEmpty (()))))))))) (fun (va_s:va_state) va_g -> va_QEmpty (())))))


val va_lemma_Loop6x_ctr_update : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> h_LE:quad32 ->
  key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 ->
  ctr_BE:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Loop6x_ctr_update alg) va_s0 /\ va_get_ok va_s0 /\
    (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in sse_enabled /\ aes_reqs_offset alg key_words
    round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout
    va_s0) /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216
    /\ va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    0) /\ va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus`
    256 /\ va_get_xmm 9 va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0, va_get_xmm 12 va_s0,
    va_get_xmm 13 va_s0, va_get_xmm 14 va_s0) == xor_reverse_inc32lite_6 1 0 ctr_BE (va_get_xmm 15
    va_s0)) /\ hkeys_b_powers hkeys_b (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0)
    (va_get_reg64 rR9 va_s0 - 32) h)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\ (0 <= va_get_reg64
    rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256) /\ va_get_reg64 rRbx va_sM ==
    Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256
    /\ (va_get_xmm 9 va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM,
    va_get_xmm 13 va_sM, va_get_xmm 14 va_sM) == xor_reverse_inc32lite_6 3 0 ctr_BE (va_get_xmm 15
    va_sM) /\ va_get_xmm 3 va_sM == Vale.X64.Decls.buffer128_read hkeys_b 0 (va_get_mem_heaplet 0
    va_sM)) /\ va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 14 va_sM (va_update_xmm 13
    va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9
    va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_xmm 3 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRbx va_sM (va_update_ok va_sM va_s0))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_ctr_update va_b0 va_s0 alg h_LE key_words round_keys keys_b hkeys_b ctr_BE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_xmm 0; va_Mod_xmm 3; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_ok] in
  let va_qc = va_qcode_Loop6x_ctr_update va_mods alg h_LE key_words round_keys keys_b hkeys_b
    ctr_BE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_ctr_update alg) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 279 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_get_ok va_sM) /\ (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in label va_range1
    "***** POSTCONDITION NOT MET AT line 330 column 57 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 331 column 27 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 332 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite
    ctr_BE 6) `op_Modulus` 256) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 334 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    ((va_get_xmm 9 va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM, va_get_xmm
    13 va_sM, va_get_xmm 14 va_sM) == xor_reverse_inc32lite_6 3 0 ctr_BE (va_get_xmm 15 va_sM)) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 335 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESopt.vaf *****"
    (va_get_xmm 3 va_sM == Vale.X64.Decls.buffer128_read hkeys_b 0 (va_get_mem_heaplet 0 va_sM))))
    in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_xmm 3; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Loop6x_ctr_update (alg:algorithm) (h_LE:quad32) (key_words:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state
val va_wp_Loop6x_ctr_update
      (alg: algorithm)
      (h_LE: quad32)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0

    alg: Vale.AES.AES_common_s.algorithm ->
    h_LE: Vale.X64.Decls.quad32 ->
    key_words: FStar.Seq.Base.seq Vale.X64.Memory.nat32 ->
    round_keys: FStar.Seq.Base.seq Vale.X64.Decls.quad32 ->
    keys_b: Vale.X64.Memory.buffer128 ->
    hkeys_b: Vale.X64.Memory.buffer128 ->
    ctr_BE: Vale.X64.Decls.quad32 ->
    va_s0: Vale.X64.Decls.va_state ->
    va_k: (_: Vale.X64.Decls.va_state -> _: Prims.unit -> Type0)
  -> Type0