val va_code_AES_GCM_decrypt_6mult : alg:algorithm -> Tot va_code
let va_code_AES_GCM_decrypt_6mult alg =
  (va_Block (va_CCons (va_IfElse (va_cmp_eq (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (va_Block
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 1) 32 Secret) (va_CNil ())))) (va_Block (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 8) 32 Secret)
    (va_CCons (va_code_Add64 (va_op_dst_opr64_reg64 rRcx) (va_const_opr64 128)) (va_CCons
    (va_code_Pextrq (va_op_dst_opr64_reg64 rRbx) (va_op_xmm_xmm 1) 0) (va_CCons (va_code_And64
    (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 255)) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 1)
    (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_CCons (va_code_AddLea64 (va_op_dst_opr64_reg64 rR14)
    (va_op_opr64_reg64 rRdi) (va_const_opr64 96)) (va_CCons (va_code_Load128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 8) (va_op_reg_opr64_reg64 rRbp) 32 Secret)
    (va_CCons (va_code_DecryptPrelude ()) (va_CCons (va_code_Ctr32_ghash_6_prelude alg) (va_CCons
    (va_code_Loop6x_loop_decrypt alg) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet
    3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 1) 32 Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 9) (0 - 96) Secret)
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 10) (0 - 80) Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 11) (0 - 64) Secret)
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 12) (0 - 48) Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 13) (0 - 32) Secret)
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 14) (0 - 16) Secret) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block
    (va_CNil ())) (va_CCons (va_code_Sub64 (va_op_dst_opr64_reg64 rRcx) (va_const_opr64 128))
    (va_CNil ()))))))))))))))))))))))) (va_CNil ())))
val va_code_AES_GCM_decrypt_6mult : alg:algorithm -> Tot va_code
let va_code_AES_GCM_decrypt_6mult alg =
(va_Block (va_CCons (va_IfElse (va_cmp_eq (va_op_cmp_reg64 rRdx) (va_const_cmp 0))
            (va_Block (va_CCons (va_code_VPshufb (va_op_xmm_xmm 1)
                        (va_op_xmm_xmm 1)
                        (va_op_xmm_xmm 0))
                    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
                            (va_op_reg_opr64_reg64 rRbp)
                            (va_op_xmm_xmm 1)
                            32
                            Secret)
                        (va_CNil ()))))
            (va_Block (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
                        (va_op_reg_opr64_reg64 rRbp)
                        (va_op_xmm_xmm 8)
                        32
                        Secret)
                    (va_CCons (va_code_Add64 (va_op_dst_opr64_reg64 rRcx) (va_const_opr64 128))
                        (va_CCons (va_code_Pextrq (va_op_dst_opr64_reg64 rRbx) (va_op_xmm_xmm 1) 0)
                            (va_CCons (va_code_And64 (va_op_dst_opr64_reg64 rRbx)
                                    (va_const_opr64 255))
                                (va_CCons (va_code_VPshufb (va_op_xmm_xmm 1)
                                        (va_op_xmm_xmm 1)
                                        (va_op_xmm_xmm 0))
                                    (va_CCons (va_code_AddLea64 (va_op_dst_opr64_reg64 rR14)
                                            (va_op_opr64_reg64 rRdi)
                                            (va_const_opr64 96))
                                        (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet
                                                    3)
                                                (va_op_xmm_xmm 8)
                                                (va_op_reg_opr64_reg64 rRbp)
                                                32
                                                Secret)
                                            (va_CCons (va_code_DecryptPrelude ())
                                                (va_CCons (va_code_Ctr32_ghash_6_prelude alg)
                                                    (va_CCons (va_code_Loop6x_loop_decrypt alg)
                                                        (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet
                                                                    3)
                                                                (va_op_reg_opr64_reg64 rRbp)
                                                                (va_op_xmm_xmm 1)
                                                                32
                                                                Secret)
                                                            (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet
                                                                        6)
                                                                    (va_op_reg_opr64_reg64 rRsi)
                                                                    (va_op_xmm_xmm 9)
                                                                    (0 - 96)
                                                                    Secret)
                                                                (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet
                                                                            6)
                                                                        (va_op_reg_opr64_reg64 rRsi)
                                                                        (va_op_xmm_xmm 10)
                                                                        (0 - 80)
                                                                        Secret)
                                                                    (va_CCons (va_code_Store128_buffer
                                                                            (va_op_heaplet_mem_heaplet
                                                                                6)
                                                                            (va_op_reg_opr64_reg64 rRsi
                                                                              )
                                                                            (va_op_xmm_xmm 11)
                                                                            (0 - 64)
                                                                            Secret)
                                                                        (va_CCons (va_code_Store128_buffer
                                                                                (va_op_heaplet_mem_heaplet
                                                                                    6)
                                                                                (va_op_reg_opr64_reg64
                                                                                    rRsi)
                                                                                (va_op_xmm_xmm 12)
                                                                                (0 - 48)
                                                                                Secret)
                                                                            (va_CCons (va_code_Store128_buffer
                                                                                    (va_op_heaplet_mem_heaplet
                                                                                        6)
                                                                                    (va_op_reg_opr64_reg64
                                                                                        rRsi)
                                                                                    (va_op_xmm_xmm 13
                                                                                      )
                                                                                    (0 - 32)
                                                                                    Secret)
                                                                                (va_CCons (va_code_Store128_buffer
                                                                                        (va_op_heaplet_mem_heaplet
                                                                                            6)
                                                                                        (va_op_reg_opr64_reg64
                                                                                            rRsi)
                                                                                        (va_op_xmm_xmm
                                                                                            14)
                                                                                        (0 - 16)
                                                                                        Secret)
                                                                                    (va_CCons (va_Block
                                                                                            (va_CNil
                                                                                                ()))
                                                                                        (va_CCons (va_Block
                                                                                                (va_CNil
                                                                                                    ()
                                                                                                  ))
                                                                                            (va_CCons
                                                                                                (va_code_Sub64
                                                                                                    (
                                                                                                      va_op_dst_opr64_reg64
                                                                                                        rRcx

                                                                                                    )
                                                                                                    (
                                                                                                      va_const_opr64
                                                                                                        128

                                                                                                    )
                                                                                                  )
                                                                                                (va_CNil
                                                                                                    ()
                                                                                                  ))
                                                                                        ))))))))))))
                                        )))))))))
        (va_CNil ())))
Vale.AES.X64.AESGCM.fst.checked
Vale.X64.State.fsti.checked Vale.X64.QuickCodes.fsti.checked Vale.X64.QuickCode.fst.checked Vale.X64.Memory.fsti.checked Vale.X64.Machine_s.fst.checked Vale.X64.InsVector.fsti.checked Vale.X64.InsMem.fsti.checked Vale.X64.InsBasic.fsti.checked Vale.X64.InsAes.fsti.checked Vale.X64.Flags.fsti.checked Vale.X64.Decls.fsti.checked Vale.X64.CPU_Features_s.fst.checked Vale.Math.Poly2_s.fsti.checked Vale.Math.Poly2.Words.fsti.checked Vale.Math.Poly2.Lemmas.fsti.checked Vale.Math.Poly2.Bits_s.fsti.checked Vale.Math.Poly2.Bits.fsti.checked Vale.Math.Poly2.fsti.checked Vale.Def.Words_s.fsti.checked Vale.Def.Types_s.fst.checked Vale.Def.Prop_s.fst.checked Vale.Def.Opaque_s.fsti.checked Vale.Arch.TypesNative.fsti.checked Vale.Arch.Types.fsti.checked Vale.AES.X64.PolyOps.fsti.checked Vale.AES.X64.AESopt2.fsti.checked Vale.AES.X64.AESopt.fsti.checked Vale.AES.GHash.fsti.checked Vale.AES.GF128_s.fsti.checked Vale.AES.GF128.fsti.checked Vale.AES.GCTR_s.fst.checked Vale.AES.GCTR.fsti.checked Vale.AES.GCM_helpers.fsti.checked Vale.AES.AES_s.fst.checked Vale.AES.AES_helpers.fsti.checked Vale.AES.AES_common_s.fst.checked prims.fst.checked FStar.Seq.Base.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.Mul.fst.checked
Vale.AES.X64.AESGCM.fst
Vale.AES.AES_common_s.algorithm Vale.X64.Decls.va_Block Vale.X64.Decls.va_CCons Vale.X64.Decls.va_IfElse Vale.X64.Decls.va_cmp_eq Vale.X64.Decls.va_op_cmp_reg64 Vale.X64.Machine_s.rRdx Vale.X64.Decls.va_const_cmp Vale.X64.InsVector.va_code_VPshufb Vale.X64.Decls.va_op_xmm_xmm Vale.X64.InsVector.va_code_Store128_buffer Vale.X64.Decls.va_op_heaplet_mem_heaplet Vale.X64.Decls.va_op_reg_opr64_reg64 Vale.X64.Machine_s.rRbp Vale.Arch.HeapTypes_s.Secret Vale.X64.Decls.va_CNil Vale.X64.InsBasic.va_code_Add64 Vale.X64.Decls.va_op_dst_opr64_reg64 Vale.X64.Machine_s.rRcx Vale.X64.Decls.va_const_opr64 Vale.X64.InsVector.va_code_Pextrq Vale.X64.Machine_s.rRbx Vale.X64.InsBasic.va_code_And64 Vale.X64.InsBasic.va_code_AddLea64 Vale.X64.Machine_s.rR14 Vale.X64.Decls.va_op_opr64_reg64 Vale.X64.Machine_s.rRdi Vale.X64.InsVector.va_code_Load128_buffer Vale.AES.X64.AESGCM.va_code_DecryptPrelude Vale.AES.X64.AESGCM.va_code_Ctr32_ghash_6_prelude Vale.AES.X64.AESGCM.va_code_Loop6x_loop_decrypt Vale.X64.Machine_s.rRsi Prims.op_Subtraction Vale.X64.InsBasic.va_code_Sub64 Vale.X64.Decls.va_code
module Vale.AES.X64.AESGCM
open FStar.Mul
open Vale.Def.Prop_s
open Vale.Def.Opaque_s
open Vale.Def.Words_s
open Vale.Def.Types_s
open FStar.Seq
open Vale.AES.AES_s
open Vale.X64.Machine_s
open Vale.X64.Memory
open Vale.X64.State
open Vale.X64.Decls
open Vale.X64.InsBasic
open Vale.X64.InsMem
open Vale.X64.InsVector
open Vale.X64.InsAes
open Vale.X64.QuickCode
open Vale.X64.QuickCodes
open Vale.Arch.Types
open Vale.AES.AES_helpers
//open Vale.Poly1305.Math    // For lemma_poly_bits64()
open Vale.AES.GCM_helpers
open Vale.AES.GCTR_s
open Vale.AES.GCTR
open Vale.Arch.TypesNative
open Vale.X64.CPU_Features_s
open Vale.AES.X64.PolyOps
open Vale.Math.Poly2_s
open Vale.Math.Poly2
open Vale.Math.Poly2.Bits_s
open Vale.Math.Poly2.Bits
open Vale.Math.Poly2.Lemmas
open Vale.AES.GF128_s
open Vale.AES.GF128
open Vale.AES.GHash
open Vale.AES.X64.AESopt
open Vale.AES.X64.AESopt2
unfold let lo(x:poly):poly = mask x 64
unfold let hi(x:poly):poly = shift x (-64)

//let scratch_reqs (scratch_b:buffer128) (count:nat) (heap3:vale_heap) (s:seq quad32) (z3:quad32) : prop0 =
//  count * 6 + 6 <= length s /\
//  (let data = slice s (count * 6) (count * 6 + 6) in
//   z3 == reverse_bytes_quad32 (index data 5) /\
//   buffer128_read scratch_b 3 heap3 == reverse_bytes_quad32 (index data 4) /\
//   buffer128_read scratch_b 4 heap3 == reverse_bytes_quad32 (index data 3) /\
//   buffer128_read scratch_b 5 heap3 == reverse_bytes_quad32 (index data 2) /\
//   buffer128_read scratch_b 6 heap3 == reverse_bytes_quad32 (index data 1) /\
//   buffer128_read scratch_b 7 heap3 == reverse_bytes_quad32 (index data 0))


let scratch_reqs_simple (scratch_b:buffer128) (heap3:vale_heap) (data:seq quad32) (z3:quad32) : prop0 =
   length data == 6 /\
   z3 == reverse_bytes_quad32 (index data 5) /\
   buffer128_read scratch_b 3 heap3 == reverse_bytes_quad32 (index data 4) /\
   buffer128_read scratch_b 4 heap3 == reverse_bytes_quad32 (index data 3) /\
   buffer128_read scratch_b 5 heap3 == reverse_bytes_quad32 (index data 2) /\
   buffer128_read scratch_b 6 heap3 == reverse_bytes_quad32 (index data 1) /\
   buffer128_read scratch_b 7 heap3 == reverse_bytes_quad32 (index data 0)
//-- finish_aes_encrypt_le


val finish_aes_encrypt_le : alg:algorithm -> input_LE:quad32 -> key:(seq nat32)
  -> Lemma
  (requires (Vale.AES.AES_s.is_aes_key_LE alg key))
  (ensures (Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg
    input_LE (Vale.AES.AES_s.key_to_round_keys_LE alg key)))
let finish_aes_encrypt_le alg input_LE key =
  Vale.AES.AES_s.aes_encrypt_LE_reveal ();
  Vale.AES.AES_s.eval_cipher_reveal ();
  ()
//--
let va_subscript_FStar__Seq__Base__seq = Seq.index
#reset-options "--z3rlimit 30"
//-- Load_one_msb

val va_code_Load_one_msb : va_dummy:unit -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Load_one_msb () =
  (va_Block (va_CCons (va_code_ZeroXmm (va_op_xmm_xmm 2)) (va_CCons (va_code_PinsrqImm
    (va_op_xmm_xmm 2) 72057594037927936 1 (va_op_reg_opr64_reg64 rR11)) (va_CNil ()))))

val va_codegen_success_Load_one_msb : va_dummy:unit -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Load_one_msb () =
  (va_pbool_and (va_codegen_success_ZeroXmm (va_op_xmm_xmm 2)) (va_pbool_and
    (va_codegen_success_PinsrqImm (va_op_xmm_xmm 2) 72057594037927936 1 (va_op_reg_opr64_reg64
    rR11)) (va_ttrue ())))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Load_one_msb (va_mods:va_mods_t) : (va_quickCode unit (va_code_Load_one_msb ())) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 145 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_ZeroXmm (va_op_xmm_xmm 2)) (fun (va_s:va_state) _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 146 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Arch.Types.two_to_nat32 (Vale.Def.Words_s.Mktwo #Vale.Def.Words_s.nat32 0 16777216) ==
    72057594037927936) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 147 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_PinsrqImm (va_op_xmm_xmm 2) 72057594037927936 1 (va_op_reg_opr64_reg64 rR11)) (fun
    (va_s:va_state) _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 148 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Def.Types_s.insert_nat64_reveal ()) (va_QEmpty (())))))))


val va_lemma_Load_one_msb : va_b0:va_code -> va_s0:va_state
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Load_one_msb ()) va_s0 /\ va_get_ok va_s0 /\
    sse_enabled))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 2 va_sM (va_update_reg64 rR11 va_sM
    (va_update_ok va_sM va_s0))))))
[@"opaque_to_smt"]
let va_lemma_Load_one_msb va_b0 va_s0 =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11; va_Mod_ok] in
  let va_qc = va_qcode_Load_one_msb va_mods in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Load_one_msb ()) va_qc va_s0 (fun va_s0
    va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 138 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 143 column 46 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216)) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11; va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Load_one_msb (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ sse_enabled /\ (forall (va_x_r11:nat64) (va_x_xmm2:quad32)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_xmm 2 va_x_xmm2
    (va_upd_reg64 rR11 va_x_r11 va_s0)) in va_get_ok va_sM /\ va_get_xmm 2 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 ==> va_k va_sM (())))


val va_wpProof_Load_one_msb : va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Load_one_msb va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Load_one_msb ()) ([va_Mod_flags;
    va_Mod_xmm 2; va_Mod_reg64 rR11]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Load_one_msb va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Load_one_msb (va_code_Load_one_msb ()) va_s0 in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 2 va_sM (va_update_reg64 rR11
    va_sM (va_update_ok va_sM va_s0)))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Load_one_msb () : (va_quickCode unit (va_code_Load_one_msb ())) =
  (va_QProc (va_code_Load_one_msb ()) ([va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11])
    va_wp_Load_one_msb va_wpProof_Load_one_msb)
//--
//-- Ctr32_ghash_6_prelude

val va_code_Ctr32_ghash_6_prelude : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Ctr32_ghash_6_prelude alg =
  (va_Block (va_CCons (va_code_Load_one_msb ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm 4)
    (va_op_xmm_xmm 4) (va_op_opr128_xmm 4)) (va_CCons (va_code_Load128_buffer
    (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15) (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret)
    (va_CCons (va_code_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm 1) (va_op_opr128_xmm 15)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret) (va_CNil ()))))))))))))

val va_codegen_success_Ctr32_ghash_6_prelude : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Ctr32_ghash_6_prelude alg =
  (va_pbool_and (va_codegen_success_Load_one_msb ()) (va_pbool_and (va_codegen_success_VPxor
    (va_op_xmm_xmm 4) (va_op_xmm_xmm 4) (va_op_opr128_xmm 4)) (va_pbool_and
    (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15)
    (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (va_pbool_and
    (va_codegen_success_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2))
    (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm
    2)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12)
    (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm
    13) (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm
    1) (va_op_opr128_xmm 15)) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 4) 16 Secret)
    (va_ttrue ())))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Ctr32_ghash_6_prelude (va_mods:va_mods_t) (alg:algorithm) (scratch_b:buffer128)
  (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) :
  (va_quickCode unit (va_code_Ctr32_ghash_6_prelude alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 211 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load_one_msb ()) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 212 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 4) (va_op_xmm_xmm 4) (va_op_opr128_xmm 4)) (fun (va_s:va_state)
    _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 213 column 21 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Arch.Types.lemma_quad32_xor ()) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 214 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15)
    (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret keys_b 0) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 215 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (fun (va_s:va_state) _
    -> let (va_arg44:Vale.Def.Types_s.quad32) = va_get_xmm 10 va_s in let
    (va_arg43:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg42:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 215 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg42 va_arg43 va_arg44 1) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 216 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg41:Vale.Def.Types_s.quad32) = va_get_xmm 11 va_s in let
    (va_arg40:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg39:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 216 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg39 va_arg40 va_arg41 2) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 217 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg38:Vale.Def.Types_s.quad32) = va_get_xmm 12 va_s in let
    (va_arg37:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg36:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 217 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg36 va_arg37 va_arg38 3) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 218 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg35:Vale.Def.Types_s.quad32) = va_get_xmm 13 va_s in let
    (va_arg34:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg33:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 218 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg33 va_arg34 va_arg35 4) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 219 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg32:Vale.Def.Types_s.quad32) = va_get_xmm 14 va_s in let
    (va_arg31:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg30:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 219 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg30 va_arg31 va_arg32 5) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 220 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm 1) (va_op_opr128_xmm 15)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 221 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret scratch_b 1) (va_QEmpty (())))))))))))))))))))


val va_lemma_Ctr32_ghash_6_prelude : va_b0:va_code -> va_s0:va_state -> alg:algorithm ->
  scratch_b:buffer128 -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  ctr_orig:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Ctr32_ghash_6_prelude alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp
    va_s0) scratch_b 8 (va_get_mem_layout va_s0) Secret /\ aes_reqs_offset alg key_words round_keys
    keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig
    0))))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 1 /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32
    round_keys 0 /\ va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 0)) (va_get_xmm 15
    va_sM) /\ (let counter = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256
    in (counter + 6 < 256 ==> va_get_xmm 10 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 1)) /\ (counter + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2)) /\ (counter + 6 <
    256 ==> va_get_xmm 12 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 3)) /\ (counter + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4)) /\ (counter + 6 <
    256 ==> va_get_xmm 14 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 5)) /\ Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0 /\ va_get_xmm 4 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)) /\ va_state_eq va_sM (va_update_flags
    va_sM (va_update_mem_heaplet 3 va_sM (va_update_reg64 rR11 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 4 va_sM (va_update_xmm 2 va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Ctr32_ghash_6_prelude va_b0 va_s0 alg scratch_b key_words round_keys keys_b ctr_orig =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_reg64 rR11; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Ctr32_ghash_6_prelude va_mods alg scratch_b key_words round_keys keys_b
    ctr_orig in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Ctr32_ghash_6_prelude alg) va_qc va_s0
    (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 151 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 194 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 1) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 196 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 197 column 39 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 199 column 83 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 0)) (va_get_xmm 15 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 200 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (let counter = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256 in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 201 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 10 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 202 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 11 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 2)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 203 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 12 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 3)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 204 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 13 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 4)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 205 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 14 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 5)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 207 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 208 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 4 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_reg64 rR11; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Ctr32_ghash_6_prelude (alg:algorithm) (scratch_b:buffer128) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) (va_s0:va_state) (va_k:(va_state
  -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0)
    (va_get_reg64 rRbp va_s0) scratch_b 8 (va_get_mem_layout va_s0) Secret /\ aes_reqs_offset alg
    key_words round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0)
    (va_get_mem_layout va_s0) /\ va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 0)) /\ (forall (va_x_mem:vale_heap) (va_x_xmm2:quad32)
    (va_x_xmm4:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32)
    (va_x_r11:nat64) (va_x_heap3:vale_heap) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags
    va_x_efl (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_reg64 rR11 va_x_r11 (va_upd_xmm 15 va_x_xmm15
    (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11
    va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 4 va_x_xmm4
    (va_upd_xmm 2 va_x_xmm2 (va_upd_mem va_x_mem va_s0)))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 1 /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32
    round_keys 0 /\ va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 0)) (va_get_xmm 15
    va_sM) /\ (let counter = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256
    in (counter + 6 < 256 ==> va_get_xmm 10 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 1)) /\ (counter + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2)) /\ (counter + 6 <
    256 ==> va_get_xmm 12 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 3)) /\ (counter + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4)) /\ (counter + 6 <
    256 ==> va_get_xmm 14 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 5)) /\ Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0 /\ va_get_xmm 4 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)) ==> va_k va_sM (())))


val va_wpProof_Ctr32_ghash_6_prelude : alg:algorithm -> scratch_b:buffer128 -> key_words:(seq
  nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> ctr_orig:quad32 -> va_s0:va_state ->
  va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Ctr32_ghash_6_prelude alg scratch_b key_words round_keys
    keys_b ctr_orig va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Ctr32_ghash_6_prelude alg)
    ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_reg64 rR11; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 4;
    va_Mod_xmm 2; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Ctr32_ghash_6_prelude alg scratch_b key_words round_keys keys_b ctr_orig va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Ctr32_ghash_6_prelude (va_code_Ctr32_ghash_6_prelude alg) va_s0 alg
    scratch_b key_words round_keys keys_b ctr_orig in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM (va_update_reg64
    rR11 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM
    (va_update_xmm 4 va_sM (va_update_xmm 2 va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0)))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_reg64 rR11; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Ctr32_ghash_6_prelude (alg:algorithm) (scratch_b:buffer128) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) : (va_quickCode unit
  (va_code_Ctr32_ghash_6_prelude alg)) =
  (va_QProc (va_code_Ctr32_ghash_6_prelude alg) ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_reg64
    rR11; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_mem]) (va_wp_Ctr32_ghash_6_prelude alg
    scratch_b key_words round_keys keys_b ctr_orig) (va_wpProof_Ctr32_ghash_6_prelude alg scratch_b
    key_words round_keys keys_b ctr_orig))
//--
//-- Handle_ctr32_2

val va_code_Handle_ctr32_2 : va_dummy:unit -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Handle_ctr32_2 () =
  (va_Block (va_CCons (va_code_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0))
    (va_CCons (va_code_Load_one_lsb (va_op_xmm_xmm 5)) (va_CCons (va_code_VPaddd (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_CCons (va_code_Load_two_lsb (va_op_xmm_xmm 5))
    (va_CCons (va_code_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 10) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 11) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 4)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 12) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 4)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 13) (va_op_xmm_xmm 5)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_opr128_xmm 4)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_opr128_xmm 4)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_opr128_xmm 4)) (va_CNil
    ()))))))))))))))))))))))

val va_codegen_success_Handle_ctr32_2 : va_dummy:unit -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Handle_ctr32_2 () =
  (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Load_one_lsb (va_op_xmm_xmm 5)) (va_pbool_and
    (va_codegen_success_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5))
    (va_pbool_and (va_codegen_success_Load_two_lsb (va_op_xmm_xmm 5)) (va_pbool_and
    (va_codegen_success_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5))
    (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 10) (va_op_xmm_xmm
    5)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm
    11) (va_op_xmm_xmm 5)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 11)
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm
    10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 4)) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 12) (va_op_xmm_xmm 5)) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm
    4)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 13)
    (va_op_xmm_xmm 5)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm
    13) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 12)
    (va_op_xmm_xmm 12) (va_op_opr128_xmm 4)) (va_pbool_and (va_codegen_success_VPshufb
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_pbool_and
    (va_codegen_success_VPxor (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_opr128_xmm 4))
    (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm
    0)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 14) (va_op_xmm_xmm 14)
    (va_op_opr128_xmm 4)) (va_ttrue ())))))))))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Handle_ctr32_2 (va_mods:va_mods_t) (ctr_BE:quad32) : (va_quickCode unit
  (va_code_Handle_ctr32_2 ())) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 253 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 258 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load_one_lsb (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 260 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 262 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load_two_lsb (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 263 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 6) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 265 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 10) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 266 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 267 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 11) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 268 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 269 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 270 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 12) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 271 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 272 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 273 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 13) (va_op_xmm_xmm 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 274 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 275 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_opr128_xmm 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 276 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 277 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_opr128_xmm 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 278 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 279 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_opr128_xmm 4)) (va_QEmpty
    (())))))))))))))))))))))))


val va_lemma_Handle_ctr32_2 : va_b0:va_code -> va_s0:va_state -> ctr_BE:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Handle_ctr32_2 ()) va_s0 /\ va_get_ok va_s0 /\
    (avx_enabled /\ sse_enabled /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 ctr_BE)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 1)) (va_get_xmm 4 va_sM) /\ va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 2)) (va_get_xmm 4 va_sM) /\ va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 3)) (va_get_xmm 4 va_sM)
    /\ va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 4)) (va_get_xmm 4 va_sM) /\ va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 5)) (va_get_xmm 4 va_sM) /\ va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 6)) /\ va_state_eq va_sM (va_update_flags va_sM (va_update_xmm
    14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm
    10 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM va_s0))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Handle_ctr32_2 va_b0 va_s0 ctr_BE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR11;
    va_Mod_ok] in
  let va_qc = va_qcode_Handle_ctr32_2 va_mods ctr_BE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Handle_ctr32_2 ()) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 224 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 246 column 77 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 1)) (va_get_xmm 4 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 247 column 77 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 2)) (va_get_xmm 4 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 248 column 77 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 3)) (va_get_xmm 4 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 249 column 77 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 4)) (va_get_xmm 4 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 250 column 77 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 5)) (va_get_xmm 4 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 251 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    6)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR11;
    va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Handle_ctr32_2 (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) :
  Type0 =
  (va_get_ok va_s0 /\ (avx_enabled /\ sse_enabled /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 ctr_BE) /\ (forall (va_x_r11:nat64) (va_x_xmm1:quad32)
    (va_x_xmm2:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_xmm 14 va_x_xmm14
    (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10
    va_x_xmm10 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm
    1 va_x_xmm1 (va_upd_reg64 rR11 va_x_r11 va_s0)))))))))) in va_get_ok va_sM /\ (va_get_xmm 10
    va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 1)) (va_get_xmm 4 va_sM) /\ va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 2)) (va_get_xmm 4 va_sM) /\ va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 3)) (va_get_xmm 4 va_sM)
    /\ va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 4)) (va_get_xmm 4 va_sM) /\ va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 5)) (va_get_xmm 4 va_sM) /\ va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 6)) ==> va_k va_sM (())))


val va_wpProof_Handle_ctr32_2 : ctr_BE:quad32 -> va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Handle_ctr32_2 ctr_BE va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Handle_ctr32_2 ()) ([va_Mod_flags;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR11]) va_s0 va_k ((va_sM, va_f0,
    va_g))))
[@"opaque_to_smt"]
let va_wpProof_Handle_ctr32_2 ctr_BE va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Handle_ctr32_2 (va_code_Handle_ctr32_2 ()) va_s0 ctr_BE in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 6 va_sM
    (va_update_xmm 5 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_reg64 rR11
    va_sM (va_update_ok va_sM va_s0)))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR11])
    va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Handle_ctr32_2 (ctr_BE:quad32) : (va_quickCode unit (va_code_Handle_ctr32_2 ())) =
  (va_QProc (va_code_Handle_ctr32_2 ()) ([va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm
    12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_reg64 rR11]) (va_wp_Handle_ctr32_2 ctr_BE) (va_wpProof_Handle_ctr32_2 ctr_BE))
//--
//-- Loop6x_decrypt
#push-options "--z3rlimit 300"

val va_code_Loop6x_decrypt : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_decrypt alg =
  (va_Block (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block
    (va_CNil ())) (va_CCons (va_code_Loop6x_partial alg) (va_CCons (va_code_Loop6x_final alg)
    (va_CCons (va_code_Sub64 (va_op_dst_opr64_reg64 rRdx) (va_const_opr64 6)) (va_CCons (va_IfElse
    (va_cmp_gt (va_op_cmp_reg64 rRdx) (va_const_cmp 6)) (va_Block (va_CCons (va_code_Add64
    (va_op_dst_opr64_reg64 rR14) (va_const_opr64 96)) (va_CNil ()))) (va_Block (va_CNil ())))
    (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block
    (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_IfElse (va_cmp_gt
    (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (va_Block (va_CCons (va_code_Loop6x_save_output ())
    (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 7)
    (va_op_reg_opr64_reg64 rRbp) 32 Secret) (va_CCons (va_Block (va_CNil ())) (va_CNil ())))))
    (va_Block (va_CCons (va_code_Mem128_lemma ()) (va_CCons (va_code_VPolyAdd (va_op_xmm_xmm 8)
    (va_op_xmm_xmm 8) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 3) (va_op_reg64_reg64 rRbp) 16
    Secret)) (va_CCons (va_code_VPolyAdd (va_op_xmm_xmm 8) (va_op_xmm_xmm 8) (va_op_opr128_xmm 4))
    (va_CNil ())))))) (va_CNil ()))))))))))))))

val va_codegen_success_Loop6x_decrypt : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_decrypt alg =
  (va_pbool_and (va_codegen_success_Loop6x_partial alg) (va_pbool_and
    (va_codegen_success_Loop6x_final alg) (va_pbool_and (va_codegen_success_Sub64
    (va_op_dst_opr64_reg64 rRdx) (va_const_opr64 6)) (va_pbool_and (va_codegen_success_Add64
    (va_op_dst_opr64_reg64 rR14) (va_const_opr64 96)) (va_pbool_and (va_pbool_and
    (va_codegen_success_Loop6x_save_output ()) (va_pbool_and (va_codegen_success_Load128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 7) (va_op_reg_opr64_reg64 rRbp) 32 Secret)
    (va_pbool_and (va_codegen_success_Mem128_lemma ()) (va_pbool_and (va_codegen_success_VPolyAdd
    (va_op_xmm_xmm 8) (va_op_xmm_xmm 8) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 3)
    (va_op_reg64_reg64 rRbp) 16 Secret)) (va_codegen_success_VPolyAdd (va_op_xmm_xmm 8)
    (va_op_xmm_xmm 8) (va_op_opr128_xmm 4)))))) (va_ttrue ()))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_decrypt (va_mods:va_mods_t) (alg:algorithm) (h_LE:quad32) (y_orig:quad32)
  (y_prev:quad32) (count:nat) (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128)
  (scratch_b:buffer128) (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (ctr_BE_orig:quad32) (ctr_BE:quad32) :
  (va_quickCode (quad32) (va_code_Loop6x_decrypt alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (prev:Vale.Math.Poly2_s.poly) = add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s))
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s))) (Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_s))) in let
    (y_prev:Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 prev) in va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 449 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in0_b) (count
    `op_Multiply` 6) (count `op_Multiply` 6 + 6)) (fun _ -> let (data:(FStar.Seq.Base.seq
    Vale.X64.Decls.quad32)) = FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) in0_b) (count `op_Multiply` 6) (count `op_Multiply` 6 + 6) in
    va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 450 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b) (count
    `op_Multiply` 6) (count `op_Multiply` 6 + 6)) (fun _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 450 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.equal #Vale.X64.Decls.quad32 data (FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b) (count `op_Multiply` 6) (count
    `op_Multiply` 6 + 6))) (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 451 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b) (count
    `op_Multiply` 6) (count `op_Multiply` 6 + 6) /\ (fun a_1582 (s_1583:(FStar.Seq.Base.seq
    a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let (j_1545:Prims.nat) = j_1585 in Prims.b2t
    (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584 j_1545) (Prims.op_LessThanOrEqual j_1545
    (FStar.Seq.Base.length #a_1582 s_1583)))) quad32 plain_quads (count `op_Multiply` 6) (count
    `op_Multiply` 6 + 6)) (fun _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 451 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.equal #Vale.X64.Decls.quad32 (FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b) (count `op_Multiply` 6) (count
    `op_Multiply` 6 + 6)) (FStar.Seq.Base.slice #quad32 plain_quads (count `op_Multiply` 6) (count
    `op_Multiply` 6 + 6))) (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 453 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2_s.degree (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s)) < 128)
    (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 454 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2_s.degree (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s)) < 128)
    (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 455 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2_s.degree (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_s))) < 128) (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 456 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2_s.degree prev < 128) (va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 457 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Math.Poly2.Bits.lemma_of_to_quad32 prev) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 459 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_partial alg h_LE y_prev data count (va_if (va_get_reg64 rRdx va_s > 6) (fun _
    -> count + 1) (fun _ -> count)) iv_b in0_b in_b scratch_b key_words round_keys keys_b hkeys_b
    ctr_BE) (fun (va_s:va_state) (init:quad32_6) -> let (eventual_Xi:Vale.Math.Poly2_s.poly) = add
    (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s)) (Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_s))))
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s)) in va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 463 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (eventual_Xi == Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental h_LE y_prev data))) (let (ctrs:(six_of
    Vale.Def.Types_s.quad32)) = make_six_of #Vale.Def.Types_s.quad32 (fun (i:(va_int_range 0 5)) ->
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE i)) in let
    (plains:(six_of Vale.X64.Decls.quad32)) = make_six_of #Vale.X64.Decls.quad32 (fun
    (i:(va_int_range 0 5)) -> Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + i)
    (va_get_mem_heaplet 6 va_s)) in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 468 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_final alg iv_b scratch_b key_words round_keys keys_b (Vale.AES.GCTR.inc32lite
    ctr_BE 6) init ctrs plains (Vale.X64.Decls.buffer128_read in0_b (va_if (va_get_reg64 rRdx va_s
    > 6) (fun _ -> count + 1) (fun _ -> count) `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_s)))
    (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 471 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Sub64 (va_op_dst_opr64_reg64 rRdx) (va_const_opr64 6)) (fun (va_s:va_state) _ ->
    va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 472 column 8 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qIf va_mods (Cmp_gt (va_op_cmp_reg64 rRdx) (va_const_cmp 6)) (qblock va_mods (fun
    (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 474 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Add64 (va_op_dst_opr64_reg64 rR14) (va_const_opr64 96)) (va_QEmpty (())))) (qblock
    va_mods (fun (va_s:va_state) -> va_QEmpty (())))) (fun (va_s:va_state) va_g -> let
    (y_new:quad32) = Vale.AES.GHash.ghash_incremental0 h_LE y_prev data in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 479 column 36 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583)))) quad32
    plain_quads 0 (count `op_Multiply` 6)) (fun _ -> let (va_arg104:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = data in let (va_arg103:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = FStar.Seq.Base.slice #quad32 plain_quads 0 (count `op_Multiply` 6)
    in let (va_arg102:Vale.Def.Types_s.quad32) = y_new in let (va_arg101:Vale.Def.Types_s.quad32) =
    y_orig in let (va_arg100:Vale.Def.Types_s.quad32) = h_LE in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 479 column 36 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_ghash_incremental0_append va_arg100 va_arg101 y_prev
    va_arg102 va_arg103 va_arg104) (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 480 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583)))) quad32
    plain_quads 0 (count `op_Multiply` 6)) (fun _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 480 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.append #quad32
    (FStar.Seq.Base.slice #quad32 plain_quads 0 (count `op_Multiply` 6)) data)) (va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 481 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583)))) quad32
    plain_quads 0 (count `op_Multiply` 6) /\ (fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582))
    (i_1584:Prims.nat) (j_1585:Prims.nat) -> let (j_1545:Prims.nat) = j_1585 in Prims.b2t
    (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584 j_1545) (Prims.op_LessThanOrEqual j_1545
    (FStar.Seq.Base.length #a_1582 s_1583)))) quad32 plain_quads 0 ((count + 1) `op_Multiply` 6))
    (fun _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 481 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.equal #quad32 (FStar.Seq.Base.append #quad32 (FStar.Seq.Base.slice #quad32
    plain_quads 0 (count `op_Multiply` 6)) data) (FStar.Seq.Base.slice #quad32 plain_quads 0
    ((count + 1) `op_Multiply` 6))) (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 483 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583)))) quad32
    plain_quads 0 ((count + 1) `op_Multiply` 6)) (fun _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 483 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice #quad32
    plain_quads 0 ((count + 1) `op_Multiply` 6))) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 486 column 8 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qIf va_mods (Cmp_gt (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (qblock va_mods (fun
    (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 488 column 27 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_save_output count out_b) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 492 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 7) (va_op_reg_opr64_reg64
    rRbp) 32 Secret scratch_b 2) (fun (va_s:va_state) _ -> let (plain:(FStar.Seq.Base.seq
    Vale.X64.Decls.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in_b in let
    (cipher:(FStar.Seq.Base.seq Vale.X64.Decls.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s) out_b in let (bound:(va_int_at_least 0)) = count `op_Multiply` 6 in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 497 column 44 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (bound >= 0 /\ bound <= 4294967295) (fun _ -> let (va_arg99:Vale.Def.Types_s.quad32) =
    ctr_BE_orig in let (va_arg98:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key_words in let
    (va_arg97:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = cipher in let
    (va_arg96:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old_s) out_b in let (va_arg95:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = plain_quads in let (va_arg94:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = plain_quads in let (va_arg93:Vale.Def.Types_s.nat32) = bound in let
    (va_arg92:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 497 column 44 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_opaque_ignores_postfix va_arg92 va_arg93 va_arg94
    va_arg95 va_arg96 va_arg97 va_arg98 va_arg99) (let (va_arg91:Vale.Def.Types_s.quad32) =
    ctr_BE_orig in let (va_arg90:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key_words in let
    (va_arg89:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = cipher in let
    (va_arg88:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = plain_quads in let
    (va_arg87:Prims.nat) = bound in let (va_arg86:Vale.AES.AES_common_s.algorithm) = alg in
    va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 499 column 29 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_extend6 va_arg86 va_arg87 va_arg88 va_arg89
    va_arg90 va_arg91) (let (va_arg85:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s) in let (va_arg84:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_s)) in let
    (va_arg83:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s) in
    va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 501 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_add_manip va_arg83 va_arg84 va_arg85) (va_qAssert
    va_range1
    "***** PRECONDITION NOT MET AT line 507 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_new == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental h_LE y_prev data))))) (va_QEmpty (())))))))))) (qblock
    va_mods (fun (va_s:va_state) -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 511 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (eventual_Xi == Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental h_LE y_prev data))) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 512 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mem128_lemma (va_op_heaplet_mem_heaplet 3) (va_op_reg64_reg64 rRbp) 16 Secret
    scratch_b 1) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 512 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPolyAdd (va_op_xmm_xmm 8) (va_op_xmm_xmm 8) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 3) (va_op_reg64_reg64 rRbp) 16 Secret)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 513 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPolyAdd (va_op_xmm_xmm 8) (va_op_xmm_xmm 8) (va_op_opr128_xmm 4)) (fun
    (va_s:va_state) _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 514 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s) == Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GHash.ghash_incremental h_LE y_prev data)))
    (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 515 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2.Bits_s.to_quad32 (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s)) ==
    Vale.Math.Poly2.Bits_s.to_quad32 (Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GHash.ghash_incremental h_LE y_prev data))))
    (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 516 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 8 va_s == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GHash.ghash_incremental
    h_LE y_prev data)) (va_QEmpty (()))))))))))) (fun (va_s:va_state) va_g -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 518 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_registers_reveal ()) (va_QEmpty
    ((y_new)))))))))))))))))))))))))))))


val va_lemma_Loop6x_decrypt : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> h_LE:quad32 ->
  y_orig:quad32 -> y_prev:quad32 -> count:nat -> iv_b:buffer128 -> in0_b:buffer128 ->
  in_b:buffer128 -> out_b:buffer128 -> scratch_b:buffer128 -> plain_quads:(seq quad32) ->
  key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 ->
  ctr_BE_orig:quad32 -> ctr_BE:quad32
  -> Ghost (va_state & va_fuel & quad32)
  (requires (va_require_total va_b0 (va_code_Loop6x_decrypt alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ movbe_enabled /\ va_get_reg64 rRdx va_s0 >= 6 /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8 va_s0) iv_b 1
    (va_get_mem_layout va_s0) Public /\ (va_get_reg64 rRdx va_s0 > 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rR14 va_s0)
    in0_b ((count + 1) `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx
    va_s0 == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64
    rR14 va_s0) in0_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret) /\
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0)
    in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    out_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in_b) (count `op_Multiply` 6) (count `op_Multiply` 6 + 6) /\
    (Vale.X64.Decls.buffers_disjoint128 in_b out_b \/ in_b == out_b) /\ in0_b == in_b /\
    va_get_reg64 rRdi va_s0 + 96 < pow2_64 /\ va_get_reg64 rR14 va_s0 + 96 < pow2_64 /\
    va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words round_keys keys_b
    (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm
    15 va_s0 == FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled /\ h_LE ==
    Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0
    0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0)
    hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ scratch_reqs scratch_b count
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in0_b)
    (va_get_xmm 7 va_s0) /\ y_prev == Vale.AES.GHash.ghash_incremental0 h_LE y_orig
    (FStar.Seq.Base.slice #quad32 plain_quads 0 (count `op_Multiply` 6)) /\ y_prev ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_s0))))) /\ count `op_Multiply` 6 + 6 < pow2_32 /\ ctr_BE
    == Vale.AES.GCTR.inc32lite ctr_BE_orig (count `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\ va_get_reg64 rRbx
    va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256 /\ va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> va_get_xmm 10 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 1)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 2)) /\ (va_get_reg64 rRbx
    va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 3)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13
    va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 4)) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 5)) /\
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) out_b) key_words ctr_BE_orig)))
  (ensures (fun (va_sM, va_fM, y_new) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM
    /\ ((va_get_reg64 rRdx va_sM == 0 ==> va_get_mem_heaplet 6 va_sM == va_get_mem_heaplet 6 va_s0)
    /\ Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 out_b
    (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count
    `op_Multiply` 6 + 5) /\ Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2
    va_s0) (va_get_mem_heaplet 2 va_sM) 0 0 /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_sM) in_b) ((count + 1) `op_Multiply` 6) ((count + 1) `op_Multiply` 6)) /\ va_get_reg64 rRdx
    va_sM == va_get_reg64 rRdx va_s0 - 6 /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96
    /\ va_get_reg64 rR14 va_sM == (if (va_get_reg64 rRdx va_sM > 6) then (va_get_reg64 rR14 va_s0 +
    96) else va_get_reg64 rR14 va_s0) /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96 /\
    va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0 /\ va_get_xmm 2 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\ (va_get_reg64 rRbx
    va_sM + 6 < 256 ==> va_get_xmm 0 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 7)) /\ (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 5
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 8)) /\
    (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 6 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 9)) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 7 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 10))) /\ (va_get_reg64
    rRbx va_sM + 6 < 256 ==> va_get_xmm 3 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 11)) /\ va_get_reg64 rRbx va_sM ==
    Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256
    /\ (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM)
    (va_get_xmm 10 va_sM) (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM)
    (va_get_xmm 14 va_sM) plain_quads alg key_words ctr_BE_orig count) /\ (va_get_reg64 rRdx va_sM
    > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6)) (va_get_xmm 15
    va_sM)) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 10 va_sM == va_get_xmm 0 va_sM) /\
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 11 va_sM == va_get_xmm 5 va_sM) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_xmm 12 va_sM == va_get_xmm 6 va_sM) /\ (va_get_reg64 rRdx va_sM > 0
    ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 10))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_xmm 14 va_sM == va_get_xmm 3 va_sM) /\ (va_get_reg64 rRdx va_sM > 0
    ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6
    va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply`
    6 + 0) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 0))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 1)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 1))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 2)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 2))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 3)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 3))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 4)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 4))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 5)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 5))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` (count + 1)) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig) /\ y_new ==
    Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice #quad32 plain_quads 0
    ((count + 1) `op_Multiply` 6)) /\ (va_get_reg64 rRdx va_sM > 0 ==> y_new ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_sM))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_new) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    scratch_reqs scratch_b (count + 1) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in0_b) (va_get_xmm 7 va_sM))) /\ va_state_eq va_sM
    (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM
    (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm
    13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm
    9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5
    va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rRbx va_sM
    (va_update_reg64 rRdx va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_decrypt va_b0 va_s0 alg h_LE y_orig y_prev count iv_b in0_b in_b out_b
  scratch_b plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Loop6x_decrypt va_mods alg h_LE y_orig y_prev count iv_b in0_b in_b out_b
    scratch_b plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_decrypt alg) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let y_new = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 290 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 388 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_mem_heaplet 6 va_sM == va_get_mem_heaplet 6 va_s0) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 389 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 390 column 94 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 391 column 70 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2 va_s0)
    (va_get_mem_heaplet 2 va_sM) 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 392 column 100 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) in_b) ((count + 1) `op_Multiply` 6) ((count +
    1) `op_Multiply` 6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 397 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == va_get_reg64 rRdx va_s0 - 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 398 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 399 column 64 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rR14 va_sM == va_if (va_get_reg64 rRdx va_sM > 6) (fun _ -> va_get_reg64 rR14
    va_s0 + 96) (fun _ -> va_get_reg64 rR14 va_s0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 400 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 402 column 39 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 405 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 407 column 59 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 408 column 81 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 0 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 7)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 409 column 81 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 5 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 8)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 410 column 81 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 6 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 9)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 411 column 94 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 7 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 10))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 412 column 81 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 3 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 11)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 414 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite
    ctr_BE 6) `op_Modulus` 256) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 418 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm
    10 va_sM) (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14
    va_sM) plain_quads alg key_words ctr_BE_orig count) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 420 column 93 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6)) (va_get_xmm 15
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 421 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 10 va_sM == va_get_xmm 0 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 422 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 11 va_sM == va_get_xmm 5 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 423 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 12 va_sM == va_get_xmm 6 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 424 column 98 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 10))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 425 column 35 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 14 va_sM == va_get_xmm 3 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 427 column 177 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 +
    0) (va_get_mem_heaplet 6 va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read
    in_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE 0))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 428 column 177 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 +
    1) (va_get_mem_heaplet 6 va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read
    in_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE 1))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 429 column 177 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 +
    2) (va_get_mem_heaplet 6 va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read
    in_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE 2))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 430 column 177 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 +
    3) (va_get_mem_heaplet 6 va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read
    in_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE 3))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 431 column 177 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 +
    4) (va_get_mem_heaplet 6 va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read
    in_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE 4))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 432 column 177 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 +
    5) (va_get_mem_heaplet 6 va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read
    in_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE 5))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 435 column 108 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` (count + 1))
    plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 438 column 90 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice #quad32
    plain_quads 0 ((count + 1) `op_Multiply` 6))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 440 column 103 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> y_new == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 441 column 55 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    y_new) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 443 column 89 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs scratch_b (count + 1) (va_get_mem_heaplet 3
    va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in0_b) (va_get_xmm 7 va_sM)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  let y_new = va_g in
  (va_sM, va_fM, y_new)

[@ va_qattr]
let va_wp_Loop6x_decrypt (alg:algorithm) (h_LE:quad32) (y_orig:quad32) (y_prev:quad32) (count:nat)
  (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128) (scratch_b:buffer128)
  (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (ctr_BE_orig:quad32) (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state ->
  quad32 -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ movbe_enabled /\ va_get_reg64 rRdx va_s0 >= 6 /\ va_get_xmm 2
    va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8 va_s0) iv_b 1
    (va_get_mem_layout va_s0) Public /\ (va_get_reg64 rRdx va_s0 > 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rR14 va_s0)
    in0_b ((count + 1) `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx
    va_s0 == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64
    rR14 va_s0) in0_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret) /\
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0)
    in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    out_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in_b) (count `op_Multiply` 6) (count `op_Multiply` 6 + 6) /\
    (Vale.X64.Decls.buffers_disjoint128 in_b out_b \/ in_b == out_b) /\ in0_b == in_b /\
    va_get_reg64 rRdi va_s0 + 96 < pow2_64 /\ va_get_reg64 rR14 va_s0 + 96 < pow2_64 /\
    va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words round_keys keys_b
    (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm
    15 va_s0 == FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled /\ h_LE ==
    Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0
    0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0)
    hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ scratch_reqs scratch_b count
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in0_b)
    (va_get_xmm 7 va_s0) /\ y_prev == Vale.AES.GHash.ghash_incremental0 h_LE y_orig
    (FStar.Seq.Base.slice #quad32 plain_quads 0 (count `op_Multiply` 6)) /\ y_prev ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_s0))))) /\ count `op_Multiply` 6 + 6 < pow2_32 /\ ctr_BE
    == Vale.AES.GCTR.inc32lite ctr_BE_orig (count `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\ va_get_reg64 rRbx
    va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256 /\ va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> va_get_xmm 10 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 1)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 2)) /\ (va_get_reg64 rRbx
    va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 3)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13
    va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 4)) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 5)) /\
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) out_b) key_words ctr_BE_orig) /\ (forall (va_x_mem:vale_heap)
    (va_x_rdi:nat64) (va_x_rsi:nat64) (va_x_rdx:nat64) (va_x_rbx:nat64) (va_x_r11:nat64)
    (va_x_r12:nat64) (va_x_r13:nat64) (va_x_r14:nat64) (va_x_xmm0:quad32) (va_x_xmm1:quad32)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_xmm15:quad32) (va_x_heap6:vale_heap) (va_x_heap2:vale_heap) (va_x_heap3:vale_heap)
    (va_x_efl:Vale.X64.Flags.t) (y_new:quad32) . let va_sM = va_upd_flags va_x_efl
    (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_mem_heaplet 6
    va_x_heap6 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13
    (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9
    va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5
    va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1
    va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR14 va_x_r14 (va_upd_reg64 rR13 va_x_r13
    (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRbx va_x_rbx
    (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdi va_x_rdi (va_upd_mem
    va_x_mem va_s0)))))))))))))))))))))))))))) in va_get_ok va_sM /\ ((va_get_reg64 rRdx va_sM == 0
    ==> va_get_mem_heaplet 6 va_sM == va_get_mem_heaplet 6 va_s0) /\
    Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 out_b
    (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count
    `op_Multiply` 6 + 5) /\ Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2
    va_s0) (va_get_mem_heaplet 2 va_sM) 0 0 /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_sM) in_b) ((count + 1) `op_Multiply` 6) ((count + 1) `op_Multiply` 6)) /\ va_get_reg64 rRdx
    va_sM == va_get_reg64 rRdx va_s0 - 6 /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96
    /\ va_get_reg64 rR14 va_sM == va_if (va_get_reg64 rRdx va_sM > 6) (fun _ -> va_get_reg64 rR14
    va_s0 + 96) (fun _ -> va_get_reg64 rR14 va_s0) /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi
    va_s0 + 96 /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0 /\ va_get_xmm 2
    va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\ (va_get_reg64
    rRbx va_sM + 6 < 256 ==> va_get_xmm 0 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 7)) /\ (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 5
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 8)) /\
    (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 6 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 9)) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 7 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 10))) /\ (va_get_reg64
    rRbx va_sM + 6 < 256 ==> va_get_xmm 3 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 11)) /\ va_get_reg64 rRbx va_sM ==
    Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256
    /\ (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM)
    (va_get_xmm 10 va_sM) (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM)
    (va_get_xmm 14 va_sM) plain_quads alg key_words ctr_BE_orig count) /\ (va_get_reg64 rRdx va_sM
    > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6)) (va_get_xmm 15
    va_sM)) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 10 va_sM == va_get_xmm 0 va_sM) /\
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 11 va_sM == va_get_xmm 5 va_sM) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_xmm 12 va_sM == va_get_xmm 6 va_sM) /\ (va_get_reg64 rRdx va_sM > 0
    ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 10))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_xmm 14 va_sM == va_get_xmm 3 va_sM) /\ (va_get_reg64 rRdx va_sM > 0
    ==> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6
    va_sM) == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply`
    6 + 0) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 0))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 1)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 1))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 2)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 2))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 3)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 3))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 4)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 4))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM) ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 5)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE 5))) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` (count + 1)) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig) /\ y_new ==
    Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice #quad32 plain_quads 0
    ((count + 1) `op_Multiply` 6)) /\ (va_get_reg64 rRdx va_sM > 0 ==> y_new ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_sM))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_new) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    scratch_reqs scratch_b (count + 1) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in0_b) (va_get_xmm 7 va_sM))) ==> va_k va_sM ((y_new))))


val va_wpProof_Loop6x_decrypt : alg:algorithm -> h_LE:quad32 -> y_orig:quad32 -> y_prev:quad32 ->
  count:nat -> iv_b:buffer128 -> in0_b:buffer128 -> in_b:buffer128 -> out_b:buffer128 ->
  scratch_b:buffer128 -> plain_quads:(seq quad32) -> key_words:(seq nat32) -> round_keys:(seq
  quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 -> ctr_BE_orig:quad32 -> ctr_BE:quad32 ->
  va_s0:va_state -> va_k:(va_state -> quad32 -> Type0)
  -> Ghost (va_state & va_fuel & quad32)
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_decrypt alg h_LE y_orig y_prev count iv_b in0_b
    in_b out_b scratch_b plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE va_s0
    va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_decrypt alg) ([va_Mod_flags;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8;
    va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm
    1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11;
    va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem]) va_s0
    va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Loop6x_decrypt alg h_LE y_orig y_prev count iv_b in0_b in_b out_b scratch_b
  plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE va_s0 va_k =
  let (va_sM, va_f0, y_new) = va_lemma_Loop6x_decrypt (va_code_Loop6x_decrypt alg) va_s0 alg h_LE
    y_orig y_prev count iv_b in0_b in_b out_b scratch_b plain_quads key_words round_keys keys_b
    hkeys_b ctr_BE_orig ctr_BE in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM
    (va_update_mem_heaplet 2 va_sM (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR14
    va_sM (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRbx va_sM (va_update_reg64 rRdx va_sM (va_update_reg64 rRsi va_sM
    (va_update_reg64 rRdi va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0)))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_mem]) va_sM va_s0;
  let va_g = (y_new) in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_decrypt (alg:algorithm) (h_LE:quad32) (y_orig:quad32) (y_prev:quad32)
  (count:nat) (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128)
  (scratch_b:buffer128) (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (ctr_BE_orig:quad32) (ctr_BE:quad32) :
  (va_quickCode quad32 (va_code_Loop6x_decrypt alg)) =
  (va_QProc (va_code_Loop6x_decrypt alg) ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet
    2; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem]) (va_wp_Loop6x_decrypt alg h_LE y_orig y_prev
    count iv_b in0_b in_b out_b scratch_b plain_quads key_words round_keys keys_b hkeys_b
    ctr_BE_orig ctr_BE) (va_wpProof_Loop6x_decrypt alg h_LE y_orig y_prev count iv_b in0_b in_b
    out_b scratch_b plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE))
#pop-options
//--
//-- Loop6x_loop_decrypt_body0
#push-options "--z3rlimit 700"

val va_code_Loop6x_loop_decrypt_body0 : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_loop_decrypt_body0 alg =
  (va_Block (va_CCons (va_code_Loop6x_decrypt alg) (va_CCons (va_Block (va_CNil ())) (va_CNil ()))))

val va_codegen_success_Loop6x_loop_decrypt_body0 : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_loop_decrypt_body0 alg =
  (va_pbool_and (va_codegen_success_Loop6x_decrypt alg) (va_ttrue ()))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_loop_decrypt_body0 (va_mods:va_mods_t) (va_old:va_state) (alg:algorithm)
  (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128)
  (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32))
  (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32)
  (va_code_Loop6x_loop_decrypt_body0 alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (ctr_BE_orig:quad32) = va_in_ctr_BE_orig in let (h_LE:quad32) = va_in_h_LE in let
    (hkeys_b:buffer128) = va_in_hkeys_b in let (in0_b:buffer128) = va_in_in0_b in let
    (in_b:buffer128) = va_in_in_b in let (iv_b:buffer128) = va_in_iv_b in let (key_words:(seq
    nat32)) = va_in_key_words in let (keys_b:buffer128) = va_in_keys_b in let (out_b:buffer128) =
    va_in_out_b in let (plain_quads:(seq quad32)) = va_in_plain_quads in let (round_keys:(seq
    quad32)) = va_in_round_keys in let (scratch_b:buffer128) = va_in_scratch_b in let
    (y_orig:quad32) = va_in_y_orig in let (ctr:quad32) = va_in_ctr in let (iter:nat) = va_in_iter
    in let (y_cur:quad32) = va_in_y_cur in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 733 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_decrypt alg h_LE y_orig y_cur iter iv_b in0_b in_b out_b scratch_b plain_quads
    key_words round_keys keys_b hkeys_b ctr_BE_orig ctr) (fun (va_s:va_state) (y_cur:quad32) ->
    va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 735 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (iter + 1 >= 0) (fun _ -> let (iter:nat) = iter + 1 in let (ctr:quad32) = Vale.AES.GCTR_s.inc32
    ctr 6 in va_QEmpty ((ctr, iter, y_cur))))))


val va_lemma_Loop6x_loop_decrypt_body0 : va_b0:va_code -> va_s0:va_state -> va_old:va_state ->
  alg:algorithm -> va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 -> va_in_hkeys_b:buffer128 ->
  va_in_in0_b:buffer128 -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128 -> va_in_key_words:(seq
  nat32) -> va_in_keys_b:buffer128 -> va_in_out_b:buffer128 -> va_in_plain_quads:(seq quad32) ->
  va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 -> va_in_y_orig:quad32 ->
  va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32
  -> Ghost (va_state & va_fuel & quad32 & nat & quad32)
  (requires (va_require_total va_b0 (va_code_Loop6x_loop_decrypt_body0 alg) va_s0 /\ va_get_ok
    va_s0 /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64 rRdx va_old
    - 6 `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - 6 `op_Multiply` (va_in_iter + 1)) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64
    rRdx va_s0 == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi
    va_s0) va_in_in_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ Vale.X64.Decls.validDstAddrs128
    (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0) va_in_scratch_b 9 (va_get_mem_layout
    va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9
    va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout va_s0) Secret /\
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    va_in_in0_b == va_in_in_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` (va_get_reg64 rRdx
    va_s0 - 6) < pow2_64) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_scratch_b (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) 0 (va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 ==
    0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_s0) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0)
    /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b va_in_iter (va_get_mem_heaplet
    3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (va_get_xmm 7 va_s0))
    /\ (va_in_iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==>
    va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice
    #quad32 va_in_plain_quads 0 (va_in_iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add
    (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    va_get_xmm 8 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_iter `op_Multiply` 6 + 6 < pow2_32
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr ==
    Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_iter - 1)) /\ (va_get_reg64 rRdx
    va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (va_in_iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ va_get_reg64 rRdx va_s0 > 0))
  (ensures (fun (va_sM, va_fM, ctr, iter, y_cur) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\
    va_get_ok va_sM /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64
    rRdx va_old - 6 `op_Multiply` iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96
    `op_Multiply` iter /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply`
    iter /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` (iter +
    1)) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM == 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi va_sM)
    va_in_in_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi va_sM)
    va_in_out_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3
    va_sM) (va_get_reg64 rRbp va_sM) va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128
    va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\ va_in_in0_b == va_in_in_b /\
    FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old)
    va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6
    `op_Multiply` iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64
    rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM >
    0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` (va_get_reg64 rRdx va_sM - 6) < pow2_64) /\
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b iter (va_get_mem_heaplet 3
    va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\
    (iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==> y_cur ==
    Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice #quad32
    va_in_plain_quads 0 (iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_sM > 0 ==> y_cur ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_sM))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_get_reg64 rRdx va_old + 6 < pow2_32) /\ iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite
    va_in_ctr_BE_orig (iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (iter - 1)) /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ precedes_wrap (va_get_reg64 rRdx va_sM)
    (va_get_reg64 rRdx va_s0) /\ va_state_eq va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM
    (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM
    (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM
    (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM
    (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx
    va_sM (va_update_reg64 rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM
    (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_ok va_sM (va_update_mem va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet
    3 va_sM (va_update_mem_heaplet 2 va_sM (va_update_flags va_sM
    va_s0))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_loop_decrypt_body0 va_b0 va_s0 va_old alg va_in_ctr_BE_orig va_in_h_LE
  va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
  va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur =
  let va_old = va_expand_state va_old in
  let (va_mods:va_mods_t) = [va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags] in
  let va_qc = va_qcode_Loop6x_loop_decrypt_body0 va_mods va_old alg va_in_ctr_BE_orig va_in_h_LE
    va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
    va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter
    va_in_y_cur in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_loop_decrypt_body0 alg) va_qc
    va_s0 (fun va_s0 va_sM va_g -> let (ctr, iter, y_cur) = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 521 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 653 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (sse_enabled /\ movbe_enabled) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 655 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == va_get_reg64 rRdx va_old - 6 `op_Multiply` iter) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 658 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 659 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 661 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 664 column 69 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 666 column 121 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rR14 va_sM) va_in_in0_b ((iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - 6 `op_Multiply` (iter + 1)) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 669 column 114 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rR14 va_sM) va_in_in0_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` iter) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 671 column 113 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRdi va_sM) va_in_in_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` iter) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 672 column 113 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRsi va_sM) va_in_out_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` iter) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 674 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 675 column 79 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 676 column 62 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 677 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_in0_b == va_in_in_b) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 679 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b) >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 680 column 118 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` iter)
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 681 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 682 column 54 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` (va_get_reg64 rRdx
    va_sM - 6) < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 683 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 685 column 76 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3 va_old)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 686 column 81 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (iter `op_Multiply` 6 + 5)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 687 column 117 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\
    Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_old - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 688 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 691 column 87 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (aes_reqs_offset alg va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_sM)
    (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 692 column 43 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 695 column 30 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    pclmulqdq_enabled /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 696 column 71 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 697 column 78 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_sM)
    va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 698 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b iter (va_get_mem_heaplet 3 va_sM)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 699 column 123 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==> y_cur ==
    Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice #quad32
    va_in_plain_quads 0 (iter `op_Multiply` 6))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 701 column 107 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 702 column 59 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    y_cur) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 705 column 25 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM `op_Modulus` 6 == 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 706 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 707 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (6 <= va_get_reg64 rRdx va_old /\ va_get_reg64 rRdx va_old + 6 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 708 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (iter `op_Multiply` 6 + 6 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 709 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 710 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (iter `op_Multiply` 6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 711 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 712 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 713 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 715 column 94 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 717 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 718 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 719 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 720 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 721 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 724 column 90 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm
    10 va_sM) (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14
    va_sM) va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (iter - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 727 column 107 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` iter)
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 728 column 118 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` (iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 729 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (precedes_wrap (va_get_reg64 rRdx va_sM) (va_get_reg64 rRdx va_s0))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let (ctr, iter, y_cur) = va_g in
  (va_sM, va_fM, ctr, iter, y_cur)

[@ va_qattr]
let va_wp_Loop6x_loop_decrypt_body0 (va_old:va_state) (alg:algorithm) (va_in_ctr_BE_orig:quad32)
  (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128) (va_in_in_b:buffer128)
  (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32)) (va_in_keys_b:buffer128)
  (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32)) (va_in_round_keys:(seq quad32))
  (va_in_scratch_b:buffer128) (va_in_y_orig:quad32) (va_in_ctr:quad32) (va_in_iter:nat)
  (va_in_y_cur:quad32) (va_s0:va_state) (va_k:(va_state -> (quad32 & nat & quad32) -> Type0)) :
  Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64
    rRdx va_old - 6 `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old
    + 96 `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - 6 `op_Multiply` (va_in_iter + 1)) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64
    rRdx va_s0 == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi
    va_s0) va_in_in_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ Vale.X64.Decls.validDstAddrs128
    (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0) va_in_scratch_b 9 (va_get_mem_layout
    va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9
    va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout va_s0) Secret /\
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    va_in_in0_b == va_in_in_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` (va_get_reg64 rRdx
    va_s0 - 6) < pow2_64) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_scratch_b (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) 0 (va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 ==
    0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_s0) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0)
    /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b va_in_iter (va_get_mem_heaplet
    3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (va_get_xmm 7 va_s0))
    /\ (va_in_iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==>
    va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice
    #quad32 va_in_plain_quads 0 (va_in_iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add
    (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    va_get_xmm 8 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_iter `op_Multiply` 6 + 6 < pow2_32
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr ==
    Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_iter - 1)) /\ (va_get_reg64 rRdx
    va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (va_in_iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ va_get_reg64 rRdx va_s0 > 0 /\
    (forall (va_x_efl:Vale.X64.Flags.t) (va_x_heap2:vale_heap) (va_x_heap3:vale_heap)
    (va_x_heap6:vale_heap) (va_x_mem:vale_heap) (va_x_ok:bool) (va_x_r11:nat64) (va_x_r12:nat64)
    (va_x_r13:nat64) (va_x_r14:nat64) (va_x_rbx:nat64) (va_x_rdi:nat64) (va_x_rdx:nat64)
    (va_x_rsi:nat64) (va_x_xmm0:quad32) (va_x_xmm1:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32) (ctr:quad32) (iter:nat) (y_cur:quad32)
    . let va_sM = va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7
    (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3
    (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13
    va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10
    (va_upd_xmm 1 va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdx
    va_x_rdx (va_upd_reg64 rRdi va_x_rdi (va_upd_reg64 rRbx va_x_rbx (va_upd_reg64 rR14 va_x_r14
    (va_upd_reg64 rR13 va_x_r13 (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_ok
    va_x_ok (va_upd_mem va_x_mem (va_upd_mem_heaplet 6 va_x_heap6 (va_upd_mem_heaplet 3 va_x_heap3
    (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_flags va_x_efl va_s0))))))))))))))))))))))))))))) in
    va_get_ok va_sM /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64
    rRdx va_old - 6 `op_Multiply` iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96
    `op_Multiply` iter /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply`
    iter /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` (iter +
    1)) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM == 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi va_sM)
    va_in_in_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi va_sM)
    va_in_out_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3
    va_sM) (va_get_reg64 rRbp va_sM) va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128
    va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\ va_in_in0_b == va_in_in_b /\
    FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old)
    va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6
    `op_Multiply` iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64
    rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM >
    0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` (va_get_reg64 rRdx va_sM - 6) < pow2_64) /\
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b iter (va_get_mem_heaplet 3
    va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\
    (iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==> y_cur ==
    Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice #quad32
    va_in_plain_quads 0 (iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_sM > 0 ==> y_cur ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_sM))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_get_reg64 rRdx va_old + 6 < pow2_32) /\ iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite
    va_in_ctr_BE_orig (iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (iter - 1)) /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ precedes_wrap (va_get_reg64 rRdx va_sM)
    (va_get_reg64 rRdx va_s0) ==> va_k va_sM ((ctr, iter, y_cur))))


val va_wpProof_Loop6x_loop_decrypt_body0 : va_old:va_state -> alg:algorithm ->
  va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 -> va_in_hkeys_b:buffer128 -> va_in_in0_b:buffer128
  -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128 -> va_in_key_words:(seq nat32) ->
  va_in_keys_b:buffer128 -> va_in_out_b:buffer128 -> va_in_plain_quads:(seq quad32) ->
  va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 -> va_in_y_orig:quad32 ->
  va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32 -> va_s0:va_state -> va_k:(va_state ->
  (quad32 & nat & quad32) -> Type0)
  -> Ghost (va_state & va_fuel & (quad32 & nat & quad32))
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_loop_decrypt_body0 va_old alg va_in_ctr_BE_orig
    va_in_h_LE va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b
    va_in_out_b va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr
    va_in_iter va_in_y_cur va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_loop_decrypt_body0 alg)
    ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4;
    va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi; va_Mod_reg64 rRdx;
    va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12;
    va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3;
    va_Mod_mem_heaplet 2; va_Mod_flags]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Loop6x_loop_decrypt_body0 va_old alg va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
  va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
  va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur va_s0 va_k =
  let (va_sM, va_f0, ctr, iter, y_cur) = va_lemma_Loop6x_loop_decrypt_body0
    (va_code_Loop6x_loop_decrypt_body0 alg) va_s0 va_old alg va_in_ctr_BE_orig va_in_h_LE
    va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
    va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter
    va_in_y_cur in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 1 va_sM
    (va_update_xmm 0 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx va_sM (va_update_reg64
    rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM (va_update_mem
    va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2
    va_sM (va_update_flags va_sM va_s0)))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let va_g = (ctr, iter, y_cur) in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_loop_decrypt_body0 (va_old:va_state) (alg:algorithm) (va_in_ctr_BE_orig:quad32)
  (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128) (va_in_in_b:buffer128)
  (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32)) (va_in_keys_b:buffer128)
  (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32)) (va_in_round_keys:(seq quad32))
  (va_in_scratch_b:buffer128) (va_in_y_orig:quad32) (va_in_ctr:quad32) (va_in_iter:nat)
  (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32) (va_code_Loop6x_loop_decrypt_body0
  alg)) =
  (va_QProc (va_code_Loop6x_loop_decrypt_body0 alg) ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm
    14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem;
    va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags])
    (va_wp_Loop6x_loop_decrypt_body0 va_old alg va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
    va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur)
    (va_wpProof_Loop6x_loop_decrypt_body0 va_old alg va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
    va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur))
#pop-options
//--
//-- Loop6x_loop_decrypt_while0
#push-options "--z3rlimit 700"

val va_code_Loop6x_loop_decrypt_while0 : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_loop_decrypt_while0 alg =
  (va_Block (va_CCons (va_While (va_cmp_gt (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (va_Block
    (va_CCons (va_code_Loop6x_loop_decrypt_body0 alg) (va_CNil ())))) (va_CNil ())))

val va_codegen_success_Loop6x_loop_decrypt_while0 : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_loop_decrypt_while0 alg =
  (va_pbool_and (va_codegen_success_Loop6x_loop_decrypt_body0 alg) (va_ttrue ()))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_loop_decrypt_while0 (va_mods:va_mods_t) (va_old:va_state) (alg:algorithm)
  (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128)
  (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32))
  (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32)
  (va_code_Loop6x_loop_decrypt_while0 alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (ctr_BE_orig:quad32) = va_in_ctr_BE_orig in let (h_LE:quad32) = va_in_h_LE in let
    (hkeys_b:buffer128) = va_in_hkeys_b in let (in0_b:buffer128) = va_in_in0_b in let
    (in_b:buffer128) = va_in_in_b in let (iv_b:buffer128) = va_in_iv_b in let (key_words:(seq
    nat32)) = va_in_key_words in let (keys_b:buffer128) = va_in_keys_b in let (out_b:buffer128) =
    va_in_out_b in let (plain_quads:(seq quad32)) = va_in_plain_quads in let (round_keys:(seq
    quad32)) = va_in_round_keys in let (scratch_b:buffer128) = va_in_scratch_b in let
    (y_orig:quad32) = va_in_y_orig in let (ctr:quad32) = va_in_ctr in let (iter:nat) = va_in_iter
    in let (y_cur:quad32) = va_in_y_cur in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 521 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qWhile va_mods (Cmp_gt (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (fun va_g -> let
    (ctr:quad32) = let (ctr, iter, y_cur) = va_g in ctr in let (iter:nat) = let (ctr, iter, y_cur)
    = va_g in iter in let (y_cur:quad32) = let (ctr, iter, y_cur) = va_g in y_cur in qblock va_mods
    (fun (va_s:va_state) -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 521 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_loop_decrypt_body0 va_old alg ctr_BE_orig h_LE hkeys_b in0_b in_b iv_b
    key_words keys_b out_b plain_quads round_keys scratch_b y_orig ctr iter y_cur) (fun
    (va_s:va_state) va_g -> let (ctr, iter, y_cur) = va_g in va_QEmpty ((ctr, iter, y_cur))))) (fun
    (va_s:va_state) va_g -> let (ctr:quad32) = let (ctr, iter, y_cur) = va_g in ctr in let
    (iter:nat) = let (ctr, iter, y_cur) = va_g in iter in let (y_cur:quad32) = let (ctr, iter,
    y_cur) = va_g in y_cur in va_get_ok va_s /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx
    va_s == va_get_reg64 rRdx va_old - 6 `op_Multiply` iter /\ va_get_reg64 rRdi va_s ==
    va_get_reg64 rRdi va_old + 96 `op_Multiply` iter /\ va_get_reg64 rRsi va_s == va_get_reg64 rRsi
    va_old + 96 `op_Multiply` iter /\ va_get_xmm 2 va_s == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s) (va_get_reg64 rR8 va_s) iv_b 1 (va_get_mem_layout va_s) Public /\ (va_get_reg64 rRdx va_s
    > 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s) (va_get_reg64 rR14
    va_s) in0_b ((iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` (iter +
    1)) (va_get_mem_layout va_s) Secret) /\ (va_get_reg64 rRdx va_s == 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s) (va_get_reg64 rR14 va_s)
    in0_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_s) Secret) /\ (va_get_reg64 rRdx va_s > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s) (va_get_reg64 rRdi va_s) in_b
    (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter) (va_get_mem_layout
    va_s) Secret) /\ (va_get_reg64 rRdx va_s > 0 ==> Vale.X64.Decls.validDstAddrsOffset128
    (va_get_mem_heaplet 6 va_s) (va_get_reg64 rRsi va_s) out_b (iter `op_Multiply` 6) (va_get_reg64
    rRdx va_old - 6 `op_Multiply` iter) (va_get_mem_layout va_s) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s) (va_get_reg64 rRbp va_s) scratch_b
    9 (va_get_mem_layout va_s) Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0
    va_s) (va_get_reg64 rR9 va_s - 32) hkeys_b 8 (va_get_mem_layout va_s) Secret /\
    (Vale.X64.Decls.buffers_disjoint128 in_b out_b \/ in_b == out_b) /\ in0_b == in_b /\
    FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old)
    in_b) >= 6 /\ (va_get_reg64 rRdx va_s > 0 ==> Vale.AES.GCTR.partial_seq_agreement plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b) (6 `op_Multiply` iter)
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) in_b))) /\ (va_get_reg64 rRdx va_s > 0 ==> va_get_reg64 rRdi va_s + 16 `op_Multiply`
    va_get_reg64 rRdx va_s < pow2_64) /\ (va_get_reg64 rRdx va_s > 0 ==> va_get_reg64 rR14 va_s +
    16 `op_Multiply` (va_get_reg64 rRdx va_s - 6) < pow2_64) /\ (va_get_reg64 rRdx va_s > 0 ==>
    va_get_reg64 rRsi va_s + 16 `op_Multiply` va_get_reg64 rRdx va_s < pow2_64) /\
    Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_old)
    (va_get_mem_heaplet 3 va_s) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_s) 0 (iter `op_Multiply` 6 + 5) /\
    (va_get_reg64 rRdx va_s == 0 ==> va_get_reg64 rRdx va_old >= 6 /\
    Vale.X64.Decls.buffer_modifies_specific128 out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_s) 0 0 /\ aes_reqs_offset alg key_words round_keys keys_b
    (va_get_reg64 rRcx va_s) (va_get_mem_heaplet 0 va_s) (va_get_mem_layout va_s) /\ va_get_xmm 15
    va_s == FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled /\ h_LE ==
    Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0
    0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s)
    hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ (va_get_reg64 rRdx va_s > 0 ==>
    scratch_reqs scratch_b iter (va_get_mem_heaplet 3 va_s) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) in0_b) (va_get_xmm 7 va_s)) /\ (iter `op_Multiply` 6 <=
    FStar.Seq.Base.length #quad32 plain_quads ==> y_cur == Vale.AES.GHash.ghash_incremental0 h_LE
    y_orig (FStar.Seq.Base.slice #quad32 plain_quads 0 (iter `op_Multiply` 6))) /\ (va_get_reg64
    rRdx va_s > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_s)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_s)))))) /\ (va_get_reg64 rRdx va_s == 0 ==> va_get_xmm 8 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ va_get_reg64 rRdx va_s `op_Modulus` 6 == 0 /\
    va_get_reg64 rRdx va_s < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\ va_get_reg64 rRdx va_old
    + 6 < pow2_32) /\ iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_s > 0 ==>
    va_get_reg64 rRdx va_s >= 6) /\ ctr == Vale.AES.GCTR.inc32lite ctr_BE_orig (iter `op_Multiply`
    6) /\ va_get_xmm 2 va_s == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_s == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\
    va_get_reg64 rRbx va_s == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\
    (va_get_reg64 rRdx va_s > 0 ==> va_get_xmm 9 va_s == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_s))
    /\ (va_get_reg64 rRdx va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 10 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 11 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 12 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 13 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 14 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_s == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s) (va_get_xmm 10 va_s) (va_get_xmm
    11 va_s) (va_get_xmm 12 va_s) (va_get_xmm 13 va_s) (va_get_xmm 14 va_s) plain_quads alg
    key_words ctr_BE_orig (iter - 1)) /\ (va_get_reg64 rRdx va_s > 0 ==> Vale.AES.GCTR.gctr_partial
    alg (6 `op_Multiply` iter) plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b)
    key_words ctr_BE_orig) /\ (va_get_reg64 rRdx va_s == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (iter - 1)) plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b)
    key_words ctr_BE_orig)) (fun (va_s:va_state) va_g -> let (ctr:quad32) = let (ctr, iter, y_cur)
    = va_g in ctr in let (iter:nat) = let (ctr, iter, y_cur) = va_g in iter in let (y_cur:quad32) =
    let (ctr, iter, y_cur) = va_g in y_cur in va_get_reg64 rRdx va_s) ((ctr, iter, y_cur))) (fun
    (va_s:va_state) va_g -> let (ctr:quad32) = let (ctr, iter, y_cur) = va_g in ctr in let
    (iter:nat) = let (ctr, iter, y_cur) = va_g in iter in let (y_cur:quad32) = let (ctr, iter,
    y_cur) = va_g in y_cur in let va_g = (ctr, iter, y_cur) in let ((ctr:quad32), (iter:nat),
    (y_cur:quad32)) = va_g in va_QEmpty ((ctr, iter, y_cur)))))


val va_lemma_Loop6x_loop_decrypt_while0 : va_b0:va_code -> va_s0:va_state -> va_old:va_state ->
  alg:algorithm -> va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 -> va_in_hkeys_b:buffer128 ->
  va_in_in0_b:buffer128 -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128 -> va_in_key_words:(seq
  nat32) -> va_in_keys_b:buffer128 -> va_in_out_b:buffer128 -> va_in_plain_quads:(seq quad32) ->
  va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 -> va_in_y_orig:quad32 ->
  va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32
  -> Ghost (va_state & va_fuel & quad32 & nat & quad32)
  (requires (va_require_total va_b0 (va_code_Loop6x_loop_decrypt_while0 alg) va_s0 /\ va_get_ok
    va_s0 /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64 rRdx va_old
    - 6 `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - 6 `op_Multiply` (va_in_iter + 1)) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64
    rRdx va_s0 == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi
    va_s0) va_in_in_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ Vale.X64.Decls.validDstAddrs128
    (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0) va_in_scratch_b 9 (va_get_mem_layout
    va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9
    va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout va_s0) Secret /\
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    va_in_in0_b == va_in_in_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` (va_get_reg64 rRdx
    va_s0 - 6) < pow2_64) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_scratch_b (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) 0 (va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 ==
    0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_s0) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0)
    /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b va_in_iter (va_get_mem_heaplet
    3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (va_get_xmm 7 va_s0))
    /\ (va_in_iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==>
    va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice
    #quad32 va_in_plain_quads 0 (va_in_iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add
    (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    va_get_xmm 8 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_iter `op_Multiply` 6 + 6 < pow2_32
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr ==
    Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_iter - 1)) /\ (va_get_reg64 rRdx
    va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (va_in_iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) va_in_out_b) va_in_key_words va_in_ctr_BE_orig)))
  (ensures (fun (va_sM, va_fM, ctr, iter, y_cur) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\
    va_get_ok va_sM /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64
    rRdx va_old - 6 `op_Multiply` iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96
    `op_Multiply` iter /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply`
    iter /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` (iter +
    1)) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM == 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi va_sM)
    va_in_in_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi va_sM)
    va_in_out_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3
    va_sM) (va_get_reg64 rRbp va_sM) va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128
    va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\ va_in_in0_b == va_in_in_b /\
    FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old)
    va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6
    `op_Multiply` iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64
    rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM >
    0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` (va_get_reg64 rRdx va_sM - 6) < pow2_64) /\
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b iter (va_get_mem_heaplet 3
    va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\
    (iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==> y_cur ==
    Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice #quad32
    va_in_plain_quads 0 (iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_sM > 0 ==> y_cur ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_sM))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_get_reg64 rRdx va_old + 6 < pow2_32) /\ iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite
    va_in_ctr_BE_orig (iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (iter - 1)) /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ ~(va_get_reg64 rRdx va_sM > 0) /\
    va_state_eq va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 1 va_sM
    (va_update_xmm 0 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx va_sM (va_update_reg64
    rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM (va_update_mem
    va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2
    va_sM (va_update_flags va_sM va_s0))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_loop_decrypt_while0 va_b0 va_s0 va_old alg va_in_ctr_BE_orig va_in_h_LE
  va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
  va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur =
  let va_old = va_expand_state va_old in
  let (va_mods:va_mods_t) = [va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags] in
  let va_qc = va_qcode_Loop6x_loop_decrypt_while0 va_mods va_old alg va_in_ctr_BE_orig va_in_h_LE
    va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
    va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter
    va_in_y_cur in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_loop_decrypt_while0 alg) va_qc
    va_s0 (fun va_s0 va_sM va_g -> let (ctr, iter, y_cur) = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 521 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 653 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (sse_enabled /\ movbe_enabled) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 655 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == va_get_reg64 rRdx va_old - 6 `op_Multiply` iter) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 658 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 659 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 661 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 664 column 69 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 666 column 121 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rR14 va_sM) va_in_in0_b ((iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - 6 `op_Multiply` (iter + 1)) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 669 column 114 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rR14 va_sM) va_in_in0_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` iter) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 671 column 113 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRdi va_sM) va_in_in_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` iter) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 672 column 113 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRsi va_sM) va_in_out_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` iter) (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 674 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 675 column 79 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 676 column 62 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 677 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_in0_b == va_in_in_b) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 679 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b) >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 680 column 118 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` iter)
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 681 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 682 column 54 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` (va_get_reg64 rRdx
    va_sM - 6) < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 683 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 685 column 76 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3 va_old)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 686 column 81 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (iter `op_Multiply` 6 + 5)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 687 column 117 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\
    Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_old - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 688 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 691 column 87 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (aes_reqs_offset alg va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_sM)
    (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 692 column 43 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 695 column 30 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    pclmulqdq_enabled /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 696 column 71 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 697 column 78 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_sM)
    va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 698 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b iter (va_get_mem_heaplet 3 va_sM)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 699 column 123 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==> y_cur ==
    Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice #quad32
    va_in_plain_quads 0 (iter `op_Multiply` 6))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 701 column 107 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 702 column 59 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    y_cur) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 705 column 25 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM `op_Modulus` 6 == 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 706 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 707 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (6 <= va_get_reg64 rRdx va_old /\ va_get_reg64 rRdx va_old + 6 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 708 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (iter `op_Multiply` 6 + 6 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 709 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 710 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (iter `op_Multiply` 6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 711 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 712 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 713 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 715 column 94 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 717 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 718 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 719 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 720 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 721 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 724 column 90 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm
    10 va_sM) (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14
    va_sM) va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (iter - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 727 column 107 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` iter)
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 728 column 118 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` (iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 521 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (~(va_get_reg64 rRdx va_sM > 0))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let (ctr, iter, y_cur) = va_g in
  (va_sM, va_fM, ctr, iter, y_cur)

[@ va_qattr]
let va_wp_Loop6x_loop_decrypt_while0 (va_old:va_state) (alg:algorithm) (va_in_ctr_BE_orig:quad32)
  (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128) (va_in_in_b:buffer128)
  (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32)) (va_in_keys_b:buffer128)
  (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32)) (va_in_round_keys:(seq quad32))
  (va_in_scratch_b:buffer128) (va_in_y_orig:quad32) (va_in_ctr:quad32) (va_in_iter:nat)
  (va_in_y_cur:quad32) (va_s0:va_state) (va_k:(va_state -> (quad32 & nat & quad32) -> Type0)) :
  Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64
    rRdx va_old - 6 `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old
    + 96 `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - 6 `op_Multiply` (va_in_iter + 1)) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64
    rRdx va_s0 == 6 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old -
    6 `op_Multiply` va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi
    va_s0) va_in_in_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply`
    va_in_iter) (va_get_mem_layout va_s0) Secret) /\ Vale.X64.Decls.validDstAddrs128
    (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0) va_in_scratch_b 9 (va_get_mem_layout
    va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9
    va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout va_s0) Secret /\
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    va_in_in0_b == va_in_in_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` (va_get_reg64 rRdx
    va_s0 - 6) < pow2_64) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_scratch_b (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) 0 (va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 ==
    0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_s0) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0)
    /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b va_in_iter (va_get_mem_heaplet
    3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (va_get_xmm 7 va_s0))
    /\ (va_in_iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==>
    va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice
    #quad32 va_in_plain_quads 0 (va_in_iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add
    (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    va_get_xmm 8 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_iter `op_Multiply` 6 + 6 < pow2_32
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr ==
    Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_iter - 1)) /\ (va_get_reg64 rRdx
    va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (va_in_iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (forall (va_x_efl:Vale.X64.Flags.t)
    (va_x_heap2:vale_heap) (va_x_heap3:vale_heap) (va_x_heap6:vale_heap) (va_x_mem:vale_heap)
    (va_x_ok:bool) (va_x_r11:nat64) (va_x_r12:nat64) (va_x_r13:nat64) (va_x_r14:nat64)
    (va_x_rbx:nat64) (va_x_rdi:nat64) (va_x_rdx:nat64) (va_x_rsi:nat64) (va_x_xmm0:quad32)
    (va_x_xmm1:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32)
    (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32) (va_x_xmm2:quad32)
    (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32) (va_x_xmm7:quad32)
    (va_x_xmm8:quad32) (va_x_xmm9:quad32) (ctr:quad32) (iter:nat) (y_cur:quad32) . let va_sM =
    va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6
    (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2
    (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12
    va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 1 va_x_xmm1
    (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64
    rRdi va_x_rdi (va_upd_reg64 rRbx va_x_rbx (va_upd_reg64 rR14 va_x_r14 (va_upd_reg64 rR13
    va_x_r13 (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_ok va_x_ok (va_upd_mem
    va_x_mem (va_upd_mem_heaplet 6 va_x_heap6 (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_mem_heaplet
    2 va_x_heap2 (va_upd_flags va_x_efl va_s0))))))))))))))))))))))))))))) in va_get_ok va_sM /\
    (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64 rRdx va_old - 6
    `op_Multiply` iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply`
    iter /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((iter + 1) `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` (iter +
    1)) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM == 6 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi va_sM)
    va_in_in_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi va_sM)
    va_in_out_b (iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - 6 `op_Multiply` iter)
    (va_get_mem_layout va_sM) Secret) /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3
    va_sM) (va_get_reg64 rRbp va_sM) va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128
    va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\ va_in_in0_b == va_in_in_b /\
    FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old)
    va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6
    `op_Multiply` iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64
    rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM >
    0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` (va_get_reg64 rRdx va_sM - 6) < pow2_64) /\
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) 0 (iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b iter (va_get_mem_heaplet 3
    va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\
    (iter `op_Multiply` 6 <= FStar.Seq.Base.length #quad32 va_in_plain_quads ==> y_cur ==
    Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice #quad32
    va_in_plain_quads 0 (iter `op_Multiply` 6))) /\ (va_get_reg64 rRdx va_sM > 0 ==> y_cur ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_sM))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    va_in_scratch_b 1 (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_get_reg64 rRdx va_old + 6 < pow2_32) /\ iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite
    va_in_ctr_BE_orig (iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (iter - 1)) /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` iter) va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b) va_in_key_words
    va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ ~(va_get_reg64 rRdx va_sM > 0) ==> va_k
    va_sM ((ctr, iter, y_cur))))


val va_wpProof_Loop6x_loop_decrypt_while0 : va_old:va_state -> alg:algorithm ->
  va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 -> va_in_hkeys_b:buffer128 -> va_in_in0_b:buffer128
  -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128 -> va_in_key_words:(seq nat32) ->
  va_in_keys_b:buffer128 -> va_in_out_b:buffer128 -> va_in_plain_quads:(seq quad32) ->
  va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 -> va_in_y_orig:quad32 ->
  va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32 -> va_s0:va_state -> va_k:(va_state ->
  (quad32 & nat & quad32) -> Type0)
  -> Ghost (va_state & va_fuel & (quad32 & nat & quad32))
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_loop_decrypt_while0 va_old alg va_in_ctr_BE_orig
    va_in_h_LE va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b
    va_in_out_b va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr
    va_in_iter va_in_y_cur va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_loop_decrypt_while0 alg)
    ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4;
    va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi; va_Mod_reg64 rRdx;
    va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12;
    va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3;
    va_Mod_mem_heaplet 2; va_Mod_flags]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Loop6x_loop_decrypt_while0 va_old alg va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
  va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
  va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur va_s0 va_k =
  let (va_sM, va_f0, ctr, iter, y_cur) = va_lemma_Loop6x_loop_decrypt_while0
    (va_code_Loop6x_loop_decrypt_while0 alg) va_s0 va_old alg va_in_ctr_BE_orig va_in_h_LE
    va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
    va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter
    va_in_y_cur in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 1 va_sM
    (va_update_xmm 0 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx va_sM (va_update_reg64
    rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM (va_update_mem
    va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2
    va_sM (va_update_flags va_sM va_s0)))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let va_g = (ctr, iter, y_cur) in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_loop_decrypt_while0 (va_old:va_state) (alg:algorithm)
  (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128)
  (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32))
  (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32)
  (va_code_Loop6x_loop_decrypt_while0 alg)) =
  (va_QProc (va_code_Loop6x_loop_decrypt_while0 alg) ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm
    14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem;
    va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags])
    (va_wp_Loop6x_loop_decrypt_while0 va_old alg va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
    va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur)
    (va_wpProof_Loop6x_loop_decrypt_while0 va_old alg va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
    va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur))
#pop-options
//--
//-- Loop6x_loop_decrypt
#push-options "--z3rlimit 700"

val va_code_Loop6x_loop_decrypt : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_loop_decrypt alg =
  (va_Block (va_CCons (va_IfElse (va_cmp_eq (va_op_cmp_reg64 rRdx) (va_const_cmp 6)) (va_Block
    (va_CCons (va_code_Sub64 (va_op_dst_opr64_reg64 rR14) (va_const_opr64 96)) (va_CNil ())))
    (va_Block (va_CNil ()))) (va_CCons (va_code_Loop6x_loop_decrypt_while0 alg) (va_CNil ()))))

val va_codegen_success_Loop6x_loop_decrypt : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_loop_decrypt alg =
  (va_pbool_and (va_codegen_success_Sub64 (va_op_dst_opr64_reg64 rR14) (va_const_opr64 96))
    (va_pbool_and (va_codegen_success_Loop6x_loop_decrypt_while0 alg) (va_ttrue ())))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_loop_decrypt (va_mods:va_mods_t) (alg:algorithm) (h_LE:quad32) (y_orig:quad32)
  (y_prev:quad32) (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128)
  (scratch_b:buffer128) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (ctr_BE_orig:quad32) (ctr_BE:quad32) : (va_quickCode (quad32)
  (va_code_Loop6x_loop_decrypt alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let (iter:nat) = 0 in
    let (ctr:quad32) = ctr_BE in let (y_cur:quad32) = y_prev in let (plain_quads:(seq quad32)) =
    Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b in let (va_arg44:Vale.Def.Types_s.quad32)
    = ctr_BE_orig in let (va_arg43:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key_words in let
    (va_arg42:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b in let (va_arg41:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = plain_quads in let (va_arg40:Vale.AES.AES_common_s.algorithm) = alg
    in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 645 column 29 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_opaque_init va_arg40 va_arg41 va_arg42 va_arg43
    va_arg44) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 648 column 8 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qIf va_mods (Cmp_eq (va_op_cmp_reg64 rRdx) (va_const_cmp 6)) (qblock va_mods (fun
    (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 649 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Sub64 (va_op_dst_opr64_reg64 rR14) (va_const_opr64 96)) (va_QEmpty (())))) (qblock
    va_mods (fun (va_s:va_state) -> va_QEmpty (())))) (fun (va_s:va_state) va_g -> va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 651 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_loop_decrypt_while0 va_old_s alg ctr_BE_orig h_LE hkeys_b in0_b in_b iv_b
    key_words keys_b out_b plain_quads round_keys scratch_b y_orig ctr iter y_cur) (fun
    (va_s:va_state) va_g -> let (ctr, iter, y_cur) = va_g in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 738 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_registers_reveal ()) (let (y_new:quad32) = y_cur in
    va_QEmpty ((y_new))))))))


val va_lemma_Loop6x_loop_decrypt : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> h_LE:quad32
  -> y_orig:quad32 -> y_prev:quad32 -> iv_b:buffer128 -> in0_b:buffer128 -> in_b:buffer128 ->
  out_b:buffer128 -> scratch_b:buffer128 -> key_words:(seq nat32) -> round_keys:(seq quad32) ->
  keys_b:buffer128 -> hkeys_b:buffer128 -> ctr_BE_orig:quad32 -> ctr_BE:quad32
  -> Ghost (va_state & va_fuel & quad32)
  (requires (va_require_total va_b0 (va_code_Loop6x_loop_decrypt alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ movbe_enabled /\ (6 <= va_get_reg64 rRdx va_s0 /\ va_get_reg64 rRdx va_s0 + 6 <
    pow2_32) /\ va_get_reg64 rRdx va_s0 `op_Modulus` 6 == 0 /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8 va_s0) iv_b 1
    (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rR14 va_s0) in0_b 6 (va_get_reg64 rRdx va_s0 - 6) (va_get_mem_layout
    va_s0) Secret /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rRdi va_s0) in_b 0 (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    out_b 0 (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ (Vale.X64.Decls.buffers_disjoint128 in_b out_b \/ in_b == out_b) /\ in0_b == in_b /\
    va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64
    rR14 va_s0 + 16 `op_Multiply` (va_get_reg64 rRdx va_s0 - 6) < pow2_64 /\ va_get_reg64 rRsi
    va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ aes_reqs_offset alg key_words
    round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout
    va_s0) /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled
    /\ h_LE == Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_s0) hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\
    scratch_reqs scratch_b 0 (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_s0) in0_b) (va_get_xmm 7 va_s0) /\ y_prev == y_orig /\ y_prev ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_s0))))) /\ ctr_BE == Vale.AES.GCTR.inc32lite ctr_BE_orig 0
    /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0)
    /\ va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus`
    256 /\ va_get_xmm 9 va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> va_get_xmm 10 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 1)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 2)) /\ (va_get_reg64 rRbx
    va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 3)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13
    va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 4)) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 5)))))
  (ensures (fun (va_sM, va_fM, y_new) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM
    /\ (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ l_and (va_get_reg64 rRdx va_s0 - 1 > 0)
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_s0 - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2 va_s0)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 +
    16 `op_Multiply` va_get_reg64 rRdx va_s0 /\ l_and (va_get_reg64 rRdx va_s0 - 6 >= 0)
    (Vale.AES.GCTR.gctr_partial alg (va_get_reg64 rRdx va_s0 - 6) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b)
    key_words ctr_BE_orig) /\ va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 0) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6))) /\ va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 1) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 1))) /\ va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 2) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 2))) /\ va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 3) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 3))) /\ va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 4) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 4))) /\ va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 5) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 5))) /\ y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    in_b) 0 (va_get_reg64 rRdx va_s0)) /\ va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_new /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE (va_get_reg64 rRdx
    va_s0))) /\ va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM
    (va_update_mem_heaplet 2 va_sM (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR14
    va_sM (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRbx va_sM (va_update_reg64 rRdx va_sM (va_update_reg64 rRsi va_sM
    (va_update_reg64 rRdi va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_loop_decrypt va_b0 va_s0 alg h_LE y_orig y_prev iv_b in0_b in_b out_b scratch_b
  key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Loop6x_loop_decrypt va_mods alg h_LE y_orig y_prev iv_b in0_b in_b out_b
    scratch_b key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_loop_decrypt alg) va_qc va_s0
    (fun va_s0 va_sM va_g -> let y_new = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 521 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 614 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 615 column 103 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (l_and (va_get_reg64 rRdx va_s0 - 1 > 0) (Vale.X64.Decls.modifies_buffer_specific128 out_b
    (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_s0 - 1))) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 616 column 67 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2 va_s0)
    (va_get_mem_heaplet 2 va_sM) 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 621 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 622 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 625 column 135 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (l_and (va_get_reg64 rRdx va_s0 - 6 >= 0) (Vale.AES.GCTR.gctr_partial alg (va_get_reg64 rRdx
    va_s0 - 6) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 627 column 149 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (va_get_reg64 rRdx va_s0 - 6 + 0) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (va_get_reg64 rRdx va_s0 - 6)))) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 628 column 153 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (va_get_reg64 rRdx va_s0 - 6 + 1) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (va_get_reg64 rRdx va_s0 - 6 + 1)))) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 629 column 153 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (va_get_reg64 rRdx va_s0 - 6 + 2) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (va_get_reg64 rRdx va_s0 - 6 + 2)))) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 630 column 153 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (va_get_reg64 rRdx va_s0 - 6 + 3) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (va_get_reg64 rRdx va_s0 - 6 + 3)))) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 631 column 153 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (va_get_reg64 rRdx va_s0 - 6 + 4) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (va_get_reg64 rRdx va_s0 - 6 + 4)))) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 632 column 153 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (va_get_reg64 rRdx va_s0 - 6 + 5) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (va_get_reg64 rRdx va_s0 - 6 + 5)))) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 635 column 89 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in_b) 0 (va_get_reg64
    rRdx va_s0))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 636 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_new) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 639 column 64 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    (va_get_reg64 rRdx va_s0))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  let y_new = va_g in
  (va_sM, va_fM, y_new)

[@ va_qattr]
let va_wp_Loop6x_loop_decrypt (alg:algorithm) (h_LE:quad32) (y_orig:quad32) (y_prev:quad32)
  (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128) (scratch_b:buffer128)
  (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128)
  (ctr_BE_orig:quad32) (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state -> quad32 -> Type0)) :
  Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ movbe_enabled /\ (6 <= va_get_reg64 rRdx va_s0 /\
    va_get_reg64 rRdx va_s0 + 6 < pow2_32) /\ va_get_reg64 rRdx va_s0 `op_Modulus` 6 == 0 /\
    va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8 va_s0) iv_b 1
    (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rR14 va_s0) in0_b 6 (va_get_reg64 rRdx va_s0 - 6) (va_get_mem_layout
    va_s0) Secret /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rRdi va_s0) in_b 0 (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    out_b 0 (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ (Vale.X64.Decls.buffers_disjoint128 in_b out_b \/ in_b == out_b) /\ in0_b == in_b /\
    va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64
    rR14 va_s0 + 16 `op_Multiply` (va_get_reg64 rRdx va_s0 - 6) < pow2_64 /\ va_get_reg64 rRsi
    va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ aes_reqs_offset alg key_words
    round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout
    va_s0) /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled
    /\ h_LE == Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_s0) hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\
    scratch_reqs scratch_b 0 (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_s0) in0_b) (va_get_xmm 7 va_s0) /\ y_prev == y_orig /\ y_prev ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s0))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_s0))))) /\ ctr_BE == Vale.AES.GCTR.inc32lite ctr_BE_orig 0
    /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0)
    /\ va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus`
    256 /\ va_get_xmm 9 va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> va_get_xmm 10 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 1)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 2)) /\ (va_get_reg64 rRbx
    va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 3)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13
    va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 4)) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 5))) /\ (forall
    (va_x_mem:vale_heap) (va_x_rdi:nat64) (va_x_rsi:nat64) (va_x_rdx:nat64) (va_x_rbx:nat64)
    (va_x_r11:nat64) (va_x_r12:nat64) (va_x_r13:nat64) (va_x_r14:nat64) (va_x_xmm0:quad32)
    (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32)
    (va_x_xmm6:quad32) (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_xmm15:quad32) (va_x_heap6:vale_heap) (va_x_heap2:vale_heap) (va_x_heap3:vale_heap)
    (va_x_efl:Vale.X64.Flags.t) (y_new:quad32) . let va_sM = va_upd_flags va_x_efl
    (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_mem_heaplet 6
    va_x_heap6 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13
    (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9
    va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5
    va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1
    va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR14 va_x_r14 (va_upd_reg64 rR13 va_x_r13
    (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRbx va_x_rbx
    (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdi va_x_rdi (va_upd_mem
    va_x_mem va_s0)))))))))))))))))))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ l_and (va_get_reg64 rRdx va_s0 - 1 > 0)
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) 0 (va_get_reg64 rRdx va_s0 - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2 va_s0)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 +
    16 `op_Multiply` va_get_reg64 rRdx va_s0 /\ l_and (va_get_reg64 rRdx va_s0 - 6 >= 0)
    (Vale.AES.GCTR.gctr_partial alg (va_get_reg64 rRdx va_s0 - 6) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b)
    key_words ctr_BE_orig) /\ va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 0) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6))) /\ va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 1) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 1))) /\ va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 2) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 2))) /\ va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 3) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 3))) /\ va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 4) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 4))) /\ va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (va_get_reg64 rRdx va_s0 - 6 + 5) (va_get_mem_heaplet 6
    va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig
    (va_get_reg64 rRdx va_s0 - 6 + 5))) /\ y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    in_b) 0 (va_get_reg64 rRdx va_s0)) /\ va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_new /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE (va_get_reg64 rRdx
    va_s0))) ==> va_k va_sM ((y_new))))


val va_wpProof_Loop6x_loop_decrypt : alg:algorithm -> h_LE:quad32 -> y_orig:quad32 -> y_prev:quad32
  -> iv_b:buffer128 -> in0_b:buffer128 -> in_b:buffer128 -> out_b:buffer128 -> scratch_b:buffer128
  -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 ->
  ctr_BE_orig:quad32 -> ctr_BE:quad32 -> va_s0:va_state -> va_k:(va_state -> quad32 -> Type0)
  -> Ghost (va_state & va_fuel & quad32)
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_loop_decrypt alg h_LE y_orig y_prev iv_b in0_b in_b
    out_b scratch_b key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_loop_decrypt alg)
    ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 6; va_Mod_xmm
    15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm
    2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12;
    va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi;
    va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Loop6x_loop_decrypt alg h_LE y_orig y_prev iv_b in0_b in_b out_b scratch_b key_words
  round_keys keys_b hkeys_b ctr_BE_orig ctr_BE va_s0 va_k =
  let (va_sM, va_f0, y_new) = va_lemma_Loop6x_loop_decrypt (va_code_Loop6x_loop_decrypt alg) va_s0
    alg h_LE y_orig y_prev iv_b in0_b in_b out_b scratch_b key_words round_keys keys_b hkeys_b
    ctr_BE_orig ctr_BE in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM
    (va_update_mem_heaplet 2 va_sM (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR14
    va_sM (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRbx va_sM (va_update_reg64 rRdx va_sM (va_update_reg64 rRsi va_sM
    (va_update_reg64 rRdi va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0)))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_mem]) va_sM va_s0;
  let va_g = (y_new) in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_loop_decrypt (alg:algorithm) (h_LE:quad32) (y_orig:quad32) (y_prev:quad32)
  (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128) (scratch_b:buffer128)
  (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128)
  (ctr_BE_orig:quad32) (ctr_BE:quad32) : (va_quickCode quad32 (va_code_Loop6x_loop_decrypt alg)) =
  (va_QProc (va_code_Loop6x_loop_decrypt alg) ([va_Mod_flags; va_Mod_mem_heaplet 3;
    va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64
    rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem])
    (va_wp_Loop6x_loop_decrypt alg h_LE y_orig y_prev iv_b in0_b in_b out_b scratch_b key_words
    round_keys keys_b hkeys_b ctr_BE_orig ctr_BE) (va_wpProof_Loop6x_loop_decrypt alg h_LE y_orig
    y_prev iv_b in0_b in_b out_b scratch_b key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE))
#pop-options
//--
//-- Loop6x_loop_body0
#push-options "--z3rlimit 750"

val va_code_Loop6x_loop_body0 : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_loop_body0 alg =
  (va_Block (va_CCons (va_code_Loop6x alg) (va_CCons (va_Block (va_CNil ())) (va_CNil ()))))

val va_codegen_success_Loop6x_loop_body0 : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_loop_body0 alg =
  (va_pbool_and (va_codegen_success_Loop6x alg) (va_ttrue ()))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_loop_body0 (va_mods:va_mods_t) (va_old:va_state) (alg:algorithm)
  (va_in_count:nat) (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128)
  (va_in_in0_b:buffer128) (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq
  nat32)) (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32)
  (va_code_Loop6x_loop_body0 alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let (count:nat) =
    va_in_count in let (ctr_BE_orig:quad32) = va_in_ctr_BE_orig in let (h_LE:quad32) = va_in_h_LE
    in let (hkeys_b:buffer128) = va_in_hkeys_b in let (in0_b:buffer128) = va_in_in0_b in let
    (in_b:buffer128) = va_in_in_b in let (iv_b:buffer128) = va_in_iv_b in let (key_words:(seq
    nat32)) = va_in_key_words in let (keys_b:buffer128) = va_in_keys_b in let (out_b:buffer128) =
    va_in_out_b in let (plain_quads:(seq quad32)) = va_in_plain_quads in let (round_keys:(seq
    quad32)) = va_in_round_keys in let (scratch_b:buffer128) = va_in_scratch_b in let
    (y_orig:quad32) = va_in_y_orig in let (ctr:quad32) = va_in_ctr in let (iter:nat) = va_in_iter
    in let (y_cur:quad32) = va_in_y_cur in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 959 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x alg h_LE y_orig y_cur (count + iter) iv_b in0_b in_b out_b scratch_b
    plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr) (fun (va_s:va_state)
    (y_cur:quad32) -> va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 961 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (iter + 1 >= 0) (fun _ -> let (iter:nat) = iter + 1 in let (ctr:quad32) = Vale.AES.GCTR_s.inc32
    ctr 6 in va_QEmpty ((ctr, iter, y_cur))))))


val va_lemma_Loop6x_loop_body0 : va_b0:va_code -> va_s0:va_state -> va_old:va_state ->
  alg:algorithm -> va_in_count:nat -> va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 ->
  va_in_hkeys_b:buffer128 -> va_in_in0_b:buffer128 -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128
  -> va_in_key_words:(seq nat32) -> va_in_keys_b:buffer128 -> va_in_out_b:buffer128 ->
  va_in_plain_quads:(seq quad32) -> va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 ->
  va_in_y_orig:quad32 -> va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32
  -> Ghost (va_state & va_fuel & quad32 & nat & quad32)
  (requires (va_require_total va_b0 (va_code_Loop6x_loop_body0 alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64 rRdx va_old - 6
    `op_Multiply` va_in_iter /\ va_get_reg64 rR14 va_s0 == va_get_reg64 rR14 va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + va_in_iter
    `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout
    va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0) va_in_in_b (va_in_count `op_Multiply` 6
    + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6)
    (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_count `op_Multiply` 6 + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout va_s0) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    va_in_scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_s0) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply`
    va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64
    rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx
    va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_reg64 rRdx va_old
    >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_get_reg64 rRdx va_old - 1)) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b
    (va_get_mem_heaplet 2 va_old) (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg
    va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0
    va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    va_in_round_keys 0 /\ pclmulqdq_enabled /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg
    va_in_key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE) /\ va_in_count + va_in_iter - 2 >= 0 /\
    (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b (va_in_count + va_in_iter - 2)
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b)
    (va_get_xmm 7 va_s0)) /\ (va_get_reg64 rRdx va_s0 == 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + va_in_iter - 2) (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_s0))) /\ va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) 0 ((va_in_count + va_in_iter - 2) `op_Multiply` 6))
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_xmm 8 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + va_in_iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + va_in_iter - 1)) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` va_in_iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (va_in_iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ va_get_reg64 rRdx va_s0 > 0))
  (ensures (fun (va_sM, va_fM, ctr, iter, y_cur) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\
    va_get_ok va_sM /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64
    rRdx va_old - 6 `op_Multiply` iter /\ va_get_reg64 rR14 va_sM == va_get_reg64 rR14 va_old + 96
    `op_Multiply` iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply`
    iter /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi
    va_sM) va_in_in_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi
    va_sM) va_in_out_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply` iter)
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16
    `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rR14 va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM <
    pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3
    va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ va_in_count + iter - 2 >= 0 /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\ (va_get_reg64 rRdx va_sM == 0 ==> scratch_reqs
    va_in_scratch_b (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_sM))) /\ y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) 0 ((va_in_count + iter - 2) `op_Multiply` 6)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + iter - 1)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ precedes_wrap (va_get_reg64 rRdx va_sM) (va_get_reg64
    rRdx va_s0) /\ va_state_eq va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7
    va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3
    va_sM (va_update_xmm 2 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13
    va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx va_sM
    (va_update_reg64 rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM
    (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_ok va_sM (va_update_mem va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet
    3 va_sM (va_update_mem_heaplet 2 va_sM (va_update_flags va_sM
    va_s0))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_loop_body0 va_b0 va_s0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE
  va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
  va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur =
  let va_old = va_expand_state va_old in
  let (va_mods:va_mods_t) = [va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags] in
  let va_qc = va_qcode_Loop6x_loop_body0 va_mods va_old alg va_in_count va_in_ctr_BE_orig
    va_in_h_LE va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b
    va_in_out_b va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr
    va_in_iter va_in_y_cur in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_loop_body0 alg) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let (ctr, iter, y_cur) = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 742 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 878 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (sse_enabled /\ movbe_enabled) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 880 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == va_get_reg64 rRdx va_old - 6 `op_Multiply` iter) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 882 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rR14 va_sM == va_get_reg64 rR14 va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 883 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 884 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 886 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 889 column 69 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 891 column 127 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rR14 va_sM) va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + iter
    `op_Multiply` 6) (va_get_reg64 rRdx va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM)
    Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 892 column 123 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRdi va_sM) va_in_in_b (va_in_count `op_Multiply` 6 + iter `op_Multiply`
    6) (va_get_reg64 rRdx va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 893 column 123 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRsi va_sM) va_in_out_b (va_in_count `op_Multiply` 6 + iter `op_Multiply`
    6) (va_get_reg64 rRdx va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 895 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 896 column 79 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 897 column 62 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 898 column 27 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_in0_b == va_in_out_b) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 900 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b) >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 901 column 128 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` va_in_count + 6
    `op_Multiply` iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 902 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 903 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 904 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 906 column 76 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3 va_old)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 907 column 95 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 + iter
    `op_Multiply` 6 + 5)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 908 column 131 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\
    Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_get_reg64 rRdx va_old - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 909 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 912 column 87 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (aes_reqs_offset alg va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_sM)
    (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 913 column 43 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 916 column 30 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    pclmulqdq_enabled /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 917 column 71 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 918 column 78 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_sM)
    va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 920 column 34 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_count + iter - 2 >= 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 921 column 103 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b (va_in_count + iter - 2)
    (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b)
    (va_get_xmm 7 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 922 column 137 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> scratch_reqs va_in_scratch_b (va_in_count + iter - 2)
    (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b)
    (Vale.X64.Decls.buffer128_read va_in_scratch_b 2 (va_get_mem_heaplet 3 va_sM))) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 924 column 112 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) 0
    ((va_in_count + iter - 2) `op_Multiply` 6))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 926 column 107 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 927 column 59 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    y_cur) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 930 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (2 <= va_in_count) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 931 column 25 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM `op_Modulus` 6 == 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 932 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 933 column 62 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (6 <= va_get_reg64 rRdx va_old /\ va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 <
    pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 934 column 43 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6 + 6 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 935 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 936 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6 `op_Multiply` va_in_count + iter
    `op_Multiply` 6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 937 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 938 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 939 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 941 column 94 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 943 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 944 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 945 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 946 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 947 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 950 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm
    10 va_sM) (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14
    va_sM) va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + iter - 1)) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 953 column 117 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 954 column 128 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` (iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 955 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (precedes_wrap (va_get_reg64 rRdx va_sM) (va_get_reg64 rRdx va_s0))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let (ctr, iter, y_cur) = va_g in
  (va_sM, va_fM, ctr, iter, y_cur)

[@ va_qattr]
let va_wp_Loop6x_loop_body0 (va_old:va_state) (alg:algorithm) (va_in_count:nat)
  (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128)
  (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32))
  (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) (va_s0:va_state) (va_k:(va_state ->
  (quad32 & nat & quad32) -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64
    rRdx va_old - 6 `op_Multiply` va_in_iter /\ va_get_reg64 rR14 va_s0 == va_get_reg64 rR14 va_old
    + 96 `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + va_in_iter
    `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout
    va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0) va_in_in_b (va_in_count `op_Multiply` 6
    + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6)
    (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_count `op_Multiply` 6 + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout va_s0) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    va_in_scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_s0) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply`
    va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64
    rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx
    va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_reg64 rRdx va_old
    >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_get_reg64 rRdx va_old - 1)) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b
    (va_get_mem_heaplet 2 va_old) (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg
    va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0
    va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    va_in_round_keys 0 /\ pclmulqdq_enabled /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg
    va_in_key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE) /\ va_in_count + va_in_iter - 2 >= 0 /\
    (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b (va_in_count + va_in_iter - 2)
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b)
    (va_get_xmm 7 va_s0)) /\ (va_get_reg64 rRdx va_s0 == 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + va_in_iter - 2) (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_s0))) /\ va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) 0 ((va_in_count + va_in_iter - 2) `op_Multiply` 6))
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_xmm 8 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + va_in_iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + va_in_iter - 1)) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` va_in_iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (va_in_iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ va_get_reg64 rRdx va_s0 > 0 /\ (forall
    (va_x_efl:Vale.X64.Flags.t) (va_x_heap2:vale_heap) (va_x_heap3:vale_heap)
    (va_x_heap6:vale_heap) (va_x_mem:vale_heap) (va_x_ok:bool) (va_x_r11:nat64) (va_x_r12:nat64)
    (va_x_r13:nat64) (va_x_r14:nat64) (va_x_rbx:nat64) (va_x_rdi:nat64) (va_x_rdx:nat64)
    (va_x_rsi:nat64) (va_x_xmm0:quad32) (va_x_xmm1:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32) (ctr:quad32) (iter:nat) (y_cur:quad32)
    . let va_sM = va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7
    (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3
    (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13
    va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10
    (va_upd_xmm 1 va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdx
    va_x_rdx (va_upd_reg64 rRdi va_x_rdi (va_upd_reg64 rRbx va_x_rbx (va_upd_reg64 rR14 va_x_r14
    (va_upd_reg64 rR13 va_x_r13 (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_ok
    va_x_ok (va_upd_mem va_x_mem (va_upd_mem_heaplet 6 va_x_heap6 (va_upd_mem_heaplet 3 va_x_heap3
    (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_flags va_x_efl va_s0))))))))))))))))))))))))))))) in
    va_get_ok va_sM /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64
    rRdx va_old - 6 `op_Multiply` iter /\ va_get_reg64 rR14 va_sM == va_get_reg64 rR14 va_old + 96
    `op_Multiply` iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply`
    iter /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi
    va_sM) va_in_in_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi
    va_sM) va_in_out_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply` iter)
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16
    `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rR14 va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM <
    pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3
    va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ va_in_count + iter - 2 >= 0 /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\ (va_get_reg64 rRdx va_sM == 0 ==> scratch_reqs
    va_in_scratch_b (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_sM))) /\ y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) 0 ((va_in_count + iter - 2) `op_Multiply` 6)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + iter - 1)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ precedes_wrap (va_get_reg64 rRdx va_sM) (va_get_reg64
    rRdx va_s0) ==> va_k va_sM ((ctr, iter, y_cur))))


val va_wpProof_Loop6x_loop_body0 : va_old:va_state -> alg:algorithm -> va_in_count:nat ->
  va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 -> va_in_hkeys_b:buffer128 -> va_in_in0_b:buffer128
  -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128 -> va_in_key_words:(seq nat32) ->
  va_in_keys_b:buffer128 -> va_in_out_b:buffer128 -> va_in_plain_quads:(seq quad32) ->
  va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 -> va_in_y_orig:quad32 ->
  va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32 -> va_s0:va_state -> va_k:(va_state ->
  (quad32 & nat & quad32) -> Type0)
  -> Ghost (va_state & va_fuel & (quad32 & nat & quad32))
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_loop_body0 va_old alg va_in_count va_in_ctr_BE_orig
    va_in_h_LE va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b
    va_in_out_b va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr
    va_in_iter va_in_y_cur va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_loop_body0 alg) ([va_Mod_xmm 9;
    va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm
    2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi; va_Mod_reg64 rRdx; va_Mod_reg64 rRdi;
    va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11;
    va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_flags]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Loop6x_loop_body0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
  va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
  va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur va_s0 va_k =
  let (va_sM, va_f0, ctr, iter, y_cur) = va_lemma_Loop6x_loop_body0 (va_code_Loop6x_loop_body0 alg)
    va_s0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b va_in_in0_b va_in_in_b
    va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads va_in_round_keys
    va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 1 va_sM
    (va_update_xmm 0 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx va_sM (va_update_reg64
    rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM (va_update_mem
    va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2
    va_sM (va_update_flags va_sM va_s0)))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let va_g = (ctr, iter, y_cur) in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_loop_body0 (va_old:va_state) (alg:algorithm) (va_in_count:nat)
  (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128)
  (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32))
  (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32)
  (va_code_Loop6x_loop_body0 alg)) =
  (va_QProc (va_code_Loop6x_loop_body0 alg) ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm
    6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem;
    va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags])
    (va_wp_Loop6x_loop_body0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
    va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur)
    (va_wpProof_Loop6x_loop_body0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
    va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur))
#pop-options
//--
//-- Loop6x_loop_while0
#push-options "--z3rlimit 750"

val va_code_Loop6x_loop_while0 : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_loop_while0 alg =
  (va_Block (va_CCons (va_While (va_cmp_gt (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (va_Block
    (va_CCons (va_code_Loop6x_loop_body0 alg) (va_CNil ())))) (va_CNil ())))

val va_codegen_success_Loop6x_loop_while0 : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_loop_while0 alg =
  (va_pbool_and (va_codegen_success_Loop6x_loop_body0 alg) (va_ttrue ()))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_loop_while0 (va_mods:va_mods_t) (va_old:va_state) (alg:algorithm)
  (va_in_count:nat) (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128)
  (va_in_in0_b:buffer128) (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq
  nat32)) (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32)
  (va_code_Loop6x_loop_while0 alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let (count:nat) =
    va_in_count in let (ctr_BE_orig:quad32) = va_in_ctr_BE_orig in let (h_LE:quad32) = va_in_h_LE
    in let (hkeys_b:buffer128) = va_in_hkeys_b in let (in0_b:buffer128) = va_in_in0_b in let
    (in_b:buffer128) = va_in_in_b in let (iv_b:buffer128) = va_in_iv_b in let (key_words:(seq
    nat32)) = va_in_key_words in let (keys_b:buffer128) = va_in_keys_b in let (out_b:buffer128) =
    va_in_out_b in let (plain_quads:(seq quad32)) = va_in_plain_quads in let (round_keys:(seq
    quad32)) = va_in_round_keys in let (scratch_b:buffer128) = va_in_scratch_b in let
    (y_orig:quad32) = va_in_y_orig in let (ctr:quad32) = va_in_ctr in let (iter:nat) = va_in_iter
    in let (y_cur:quad32) = va_in_y_cur in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 742 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qWhile va_mods (Cmp_gt (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (fun va_g -> let
    (ctr:quad32) = let (ctr, iter, y_cur) = va_g in ctr in let (iter:nat) = let (ctr, iter, y_cur)
    = va_g in iter in let (y_cur:quad32) = let (ctr, iter, y_cur) = va_g in y_cur in qblock va_mods
    (fun (va_s:va_state) -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 742 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_loop_body0 va_old alg count ctr_BE_orig h_LE hkeys_b in0_b in_b iv_b key_words
    keys_b out_b plain_quads round_keys scratch_b y_orig ctr iter y_cur) (fun (va_s:va_state) va_g
    -> let (ctr, iter, y_cur) = va_g in va_QEmpty ((ctr, iter, y_cur))))) (fun (va_s:va_state) va_g
    -> let (ctr:quad32) = let (ctr, iter, y_cur) = va_g in ctr in let (iter:nat) = let (ctr, iter,
    y_cur) = va_g in iter in let (y_cur:quad32) = let (ctr, iter, y_cur) = va_g in y_cur in
    va_get_ok va_s /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s == va_get_reg64 rRdx
    va_old - 6 `op_Multiply` iter /\ va_get_reg64 rR14 va_s == va_get_reg64 rR14 va_old + 96
    `op_Multiply` iter /\ va_get_reg64 rRdi va_s == va_get_reg64 rRdi va_old + 96 `op_Multiply`
    iter /\ va_get_reg64 rRsi va_s == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter /\
    va_get_xmm 2 va_s == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s) (va_get_reg64 rR8 va_s) iv_b 1
    (va_get_mem_layout va_s) Public /\ (va_get_reg64 rRdx va_s > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s) (va_get_reg64 rR14 va_s)
    in0_b ((count - 1) `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - iter
    `op_Multiply` 6) (va_get_mem_layout va_s) Secret) /\ (va_get_reg64 rRdx va_s > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s) (va_get_reg64 rRdi va_s) in_b
    (count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - iter `op_Multiply`
    6) (va_get_mem_layout va_s) Secret) /\ (va_get_reg64 rRdx va_s > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s) (va_get_reg64 rRsi va_s)
    out_b (count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - iter
    `op_Multiply` 6) (va_get_mem_layout va_s) Secret) /\ Vale.X64.Decls.validDstAddrs128
    (va_get_mem_heaplet 3 va_s) (va_get_reg64 rRbp va_s) scratch_b 9 (va_get_mem_layout va_s)
    Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s) (va_get_reg64 rR9 va_s -
    32) hkeys_b 8 (va_get_mem_layout va_s) Secret /\ (Vale.X64.Decls.buffers_disjoint128 in_b out_b
    \/ in_b == out_b) /\ in0_b == out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) in_b) >= 6 /\ (va_get_reg64 rRdx va_s > 0
    ==> Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s) in_b) (6 `op_Multiply` count + 6 `op_Multiply` iter) (FStar.Seq.Base.length
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) in_b))) /\
    (va_get_reg64 rRdx va_s > 0 ==> va_get_reg64 rRdi va_s + 16 `op_Multiply` va_get_reg64 rRdx
    va_s < pow2_64) /\ (va_get_reg64 rRdx va_s > 0 ==> va_get_reg64 rR14 va_s + 16 `op_Multiply`
    va_get_reg64 rRdx va_s < pow2_64) /\ (va_get_reg64 rRdx va_s > 0 ==> va_get_reg64 rRsi va_s +
    16 `op_Multiply` va_get_reg64 rRdx va_s < pow2_64) /\
    Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_old)
    (va_get_mem_heaplet 3 va_s) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 out_b
    (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_s) (count `op_Multiply` 6) (count
    `op_Multiply` 6 + iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s == 0 ==> va_get_reg64
    rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 out_b (va_get_mem_heaplet 6
    va_old) (va_get_mem_heaplet 6 va_s) (count `op_Multiply` 6) (count `op_Multiply` 6 +
    va_get_reg64 rRdx va_old - 1)) /\ Vale.X64.Decls.modifies_buffer_specific128 iv_b
    (va_get_mem_heaplet 2 va_old) (va_get_mem_heaplet 2 va_s) 0 0 /\ aes_reqs_offset alg key_words
    round_keys keys_b (va_get_reg64 rRcx va_s) (va_get_mem_heaplet 0 va_s) (va_get_mem_layout va_s)
    /\ va_get_xmm 15 va_s == FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled /\ h_LE
    == Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32
    0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s)
    hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ count + iter - 2 >= 0 /\ (va_get_reg64
    rRdx va_s > 0 ==> scratch_reqs scratch_b (count + iter - 2) (va_get_mem_heaplet 3 va_s)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in0_b) (va_get_xmm 7 va_s)) /\ (va_get_reg64
    rRdx va_s == 0 ==> scratch_reqs scratch_b (count + iter - 2) (va_get_mem_heaplet 3 va_s)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in0_b) (Vale.X64.Decls.buffer128_read
    scratch_b 2 (va_get_mem_heaplet 3 va_s))) /\ y_cur == Vale.AES.GHash.ghash_incremental0 h_LE
    y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s) in0_b) 0 ((count + iter - 2) `op_Multiply` 6)) /\ (va_get_reg64 rRdx va_s > 0 ==> y_cur
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Math.Poly2.Bits_s.to_quad32 (add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_s)))))) /\ (va_get_reg64 rRdx va_s == 0 ==> va_get_xmm 8
    va_s == Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ 2 <= count /\ va_get_reg64 rRdx va_s
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ count `op_Multiply` 6 + iter
    `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_s > 0 ==> va_get_reg64 rRdx va_s >= 6)
    /\ ctr == Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + iter `op_Multiply` 6) /\
    va_get_xmm 2 va_s == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_s == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\
    va_get_reg64 rRbx va_s == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\
    (va_get_reg64 rRdx va_s > 0 ==> va_get_xmm 9 va_s == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_s))
    /\ (va_get_reg64 rRdx va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 10 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 11 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 12 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 13 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_s > 0 ==> (va_get_reg64 rRbx va_s + 6 < 256 ==> va_get_xmm 14 va_s ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_s == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s) (va_get_xmm 10 va_s) (va_get_xmm
    11 va_s) (va_get_xmm 12 va_s) (va_get_xmm 13 va_s) (va_get_xmm 14 va_s) plain_quads alg
    key_words ctr_BE_orig (count + iter - 1)) /\ (va_get_reg64 rRdx va_s > 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count + 6 `op_Multiply` iter) plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) key_words ctr_BE_orig) /\ (va_get_reg64
    rRdx va_s == 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count + 6 `op_Multiply`
    (iter - 1)) plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) key_words
    ctr_BE_orig)) (fun (va_s:va_state) va_g -> let (ctr:quad32) = let (ctr, iter, y_cur) = va_g in
    ctr in let (iter:nat) = let (ctr, iter, y_cur) = va_g in iter in let (y_cur:quad32) = let (ctr,
    iter, y_cur) = va_g in y_cur in va_get_reg64 rRdx va_s) ((ctr, iter, y_cur))) (fun
    (va_s:va_state) va_g -> let (ctr:quad32) = let (ctr, iter, y_cur) = va_g in ctr in let
    (iter:nat) = let (ctr, iter, y_cur) = va_g in iter in let (y_cur:quad32) = let (ctr, iter,
    y_cur) = va_g in y_cur in let va_g = (ctr, iter, y_cur) in let ((ctr:quad32), (iter:nat),
    (y_cur:quad32)) = va_g in va_QEmpty ((ctr, iter, y_cur)))))


val va_lemma_Loop6x_loop_while0 : va_b0:va_code -> va_s0:va_state -> va_old:va_state ->
  alg:algorithm -> va_in_count:nat -> va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 ->
  va_in_hkeys_b:buffer128 -> va_in_in0_b:buffer128 -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128
  -> va_in_key_words:(seq nat32) -> va_in_keys_b:buffer128 -> va_in_out_b:buffer128 ->
  va_in_plain_quads:(seq quad32) -> va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 ->
  va_in_y_orig:quad32 -> va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32
  -> Ghost (va_state & va_fuel & quad32 & nat & quad32)
  (requires (va_require_total va_b0 (va_code_Loop6x_loop_while0 alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64 rRdx va_old - 6
    `op_Multiply` va_in_iter /\ va_get_reg64 rR14 va_s0 == va_get_reg64 rR14 va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + va_in_iter
    `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout
    va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0) va_in_in_b (va_in_count `op_Multiply` 6
    + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6)
    (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_count `op_Multiply` 6 + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout va_s0) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    va_in_scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_s0) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply`
    va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64
    rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx
    va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_reg64 rRdx va_old
    >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_get_reg64 rRdx va_old - 1)) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b
    (va_get_mem_heaplet 2 va_old) (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg
    va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0
    va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    va_in_round_keys 0 /\ pclmulqdq_enabled /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg
    va_in_key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE) /\ va_in_count + va_in_iter - 2 >= 0 /\
    (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b (va_in_count + va_in_iter - 2)
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b)
    (va_get_xmm 7 va_s0)) /\ (va_get_reg64 rRdx va_s0 == 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + va_in_iter - 2) (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_s0))) /\ va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) 0 ((va_in_count + va_in_iter - 2) `op_Multiply` 6))
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_xmm 8 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + va_in_iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + va_in_iter - 1)) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` va_in_iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (va_in_iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig)))
  (ensures (fun (va_sM, va_fM, ctr, iter, y_cur) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\
    va_get_ok va_sM /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64
    rRdx va_old - 6 `op_Multiply` iter /\ va_get_reg64 rR14 va_sM == va_get_reg64 rR14 va_old + 96
    `op_Multiply` iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply`
    iter /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi
    va_sM) va_in_in_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi
    va_sM) va_in_out_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply` iter)
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16
    `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rR14 va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM <
    pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3
    va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ va_in_count + iter - 2 >= 0 /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\ (va_get_reg64 rRdx va_sM == 0 ==> scratch_reqs
    va_in_scratch_b (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_sM))) /\ y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) 0 ((va_in_count + iter - 2) `op_Multiply` 6)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + iter - 1)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ ~(va_get_reg64 rRdx va_sM > 0) /\ va_state_eq va_sM
    (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM
    (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM
    (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM
    (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM
    (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx va_sM (va_update_reg64 rRdi va_sM
    (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM (va_update_mem
    va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2
    va_sM (va_update_flags va_sM va_s0))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_loop_while0 va_b0 va_s0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE
  va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
  va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur =
  let va_old = va_expand_state va_old in
  let (va_mods:va_mods_t) = [va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags] in
  let va_qc = va_qcode_Loop6x_loop_while0 va_mods va_old alg va_in_count va_in_ctr_BE_orig
    va_in_h_LE va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b
    va_in_out_b va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr
    va_in_iter va_in_y_cur in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_loop_while0 alg) va_qc va_s0
    (fun va_s0 va_sM va_g -> let (ctr, iter, y_cur) = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 742 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 878 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (sse_enabled /\ movbe_enabled) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 880 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == va_get_reg64 rRdx va_old - 6 `op_Multiply` iter) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 882 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rR14 va_sM == va_get_reg64 rR14 va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 883 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 884 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 886 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 889 column 69 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 891 column 127 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rR14 va_sM) va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + iter
    `op_Multiply` 6) (va_get_reg64 rRdx va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM)
    Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 892 column 123 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRdi va_sM) va_in_in_b (va_in_count `op_Multiply` 6 + iter `op_Multiply`
    6) (va_get_reg64 rRdx va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 893 column 123 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6
    va_sM) (va_get_reg64 rRsi va_sM) va_in_out_b (va_in_count `op_Multiply` 6 + iter `op_Multiply`
    6) (va_get_reg64 rRdx va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 895 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 896 column 79 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32)
    va_in_hkeys_b 8 (va_get_mem_layout va_sM) Secret) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 897 column 62 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b == va_in_out_b) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 898 column 27 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_in0_b == va_in_out_b) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 900 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b) >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 901 column 128 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` va_in_count + 6
    `op_Multiply` iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 902 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 903 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rR14 va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 904 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx
    va_sM < pow2_64) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 906 column 76 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3 va_old)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 907 column 95 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 + iter
    `op_Multiply` 6 + 5)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 908 column 131 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\
    Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_sM) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_get_reg64 rRdx va_old - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 909 column 74 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 912 column 87 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (aes_reqs_offset alg va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_sM)
    (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 913 column 43 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 916 column 30 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    pclmulqdq_enabled /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 917 column 71 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 918 column 78 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_sM)
    va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 920 column 34 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_count + iter - 2 >= 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 921 column 103 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b (va_in_count + iter - 2)
    (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b)
    (va_get_xmm 7 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 922 column 137 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> scratch_reqs va_in_scratch_b (va_in_count + iter - 2)
    (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b)
    (Vale.X64.Decls.buffer128_read va_in_scratch_b 2 (va_get_mem_heaplet 3 va_sM))) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 924 column 112 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE va_in_y_orig (FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_in0_b) 0
    ((va_in_count + iter - 2) `op_Multiply` 6))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 926 column 107 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 927 column 59 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    y_cur) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 930 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (2 <= va_in_count) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 931 column 25 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM `op_Modulus` 6 == 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 932 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 933 column 62 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (6 <= va_get_reg64 rRdx va_old /\ va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 <
    pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 934 column 43 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6 + 6 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 935 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdx va_sM >= 6) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 936 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6 `op_Multiply` va_in_count + iter
    `op_Multiply` 6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 937 column 45 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 938 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 939 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 941 column 94 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 943 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 944 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 945 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 946 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 947 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 950 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm
    10 va_sM) (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14
    va_sM) va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + iter - 1)) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 953 column 117 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 954 column 128 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_sM == 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` (iter - 1)) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 742 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (~(va_get_reg64 rRdx va_sM > 0))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let (ctr, iter, y_cur) = va_g in
  (va_sM, va_fM, ctr, iter, y_cur)

[@ va_qattr]
let va_wp_Loop6x_loop_while0 (va_old:va_state) (alg:algorithm) (va_in_count:nat)
  (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128)
  (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32))
  (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) (va_s0:va_state) (va_k:(va_state ->
  (quad32 & nat & quad32) -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_s0 == va_get_reg64
    rRdx va_old - 6 `op_Multiply` va_in_iter /\ va_get_reg64 rR14 va_s0 == va_get_reg64 rR14 va_old
    + 96 `op_Multiply` va_in_iter /\ va_get_reg64 rRdi va_s0 == va_get_reg64 rRdi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_reg64 rRsi va_s0 == va_get_reg64 rRsi va_old + 96
    `op_Multiply` va_in_iter /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) va_in_iv_b 1 (va_get_mem_layout va_s0) Public /\ (va_get_reg64
    rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rR14 va_s0) va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + va_in_iter
    `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout
    va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==> Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0) va_in_in_b (va_in_count `op_Multiply` 6
    + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx va_old - va_in_iter `op_Multiply` 6)
    (va_get_mem_layout va_s0) Secret) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    va_in_out_b (va_in_count `op_Multiply` 6 + va_in_iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - va_in_iter `op_Multiply` 6) (va_get_mem_layout va_s0) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    va_in_scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_s0) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_s0
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply`
    va_in_iter) (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64
    rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\ (va_get_reg64 rRdx va_s0 >
    0 ==> va_get_reg64 rR14 va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx
    va_s0 < pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b
    (va_get_mem_heaplet 3 va_old) (va_get_mem_heaplet 3 va_s0) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_in_iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_reg64 rRdx va_old
    >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128 va_in_out_b (va_get_mem_heaplet 6 va_old)
    (va_get_mem_heaplet 6 va_s0) (va_in_count `op_Multiply` 6) (va_in_count `op_Multiply` 6 +
    va_get_reg64 rRdx va_old - 1)) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b
    (va_get_mem_heaplet 2 va_old) (va_get_mem_heaplet 2 va_s0) 0 0 /\ aes_reqs_offset alg
    va_in_key_words va_in_round_keys va_in_keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0
    va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    va_in_round_keys 0 /\ pclmulqdq_enabled /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg
    va_in_key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) va_in_hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE) /\ va_in_count + va_in_iter - 2 >= 0 /\
    (va_get_reg64 rRdx va_s0 > 0 ==> scratch_reqs va_in_scratch_b (va_in_count + va_in_iter - 2)
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_in0_b)
    (va_get_xmm 7 va_s0)) /\ (va_get_reg64 rRdx va_s0 == 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + va_in_iter - 2) (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_s0))) /\ va_in_y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) va_in_in0_b) 0 ((va_in_count + va_in_iter - 2) `op_Multiply` 6))
    /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_in_y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_s0)))))) /\ (va_get_reg64 rRdx va_s0 == 0 ==> va_get_xmm 8 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 va_in_y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx
    va_s0 `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_s0 < pow2_32 /\ (6 <= va_get_reg64 rRdx
    va_old /\ va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + va_in_iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    va_get_reg64 rRdx va_s0 >= 6) /\ va_in_ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + va_in_iter `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 0) /\ va_get_reg64
    rRbx va_s0 == va_in_ctr.lo0 `op_Modulus` 256 /\ (va_get_reg64 rRdx va_s0 > 0 ==> va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite va_in_ctr 0)) (va_get_xmm 15 va_s0)) /\ (va_get_reg64 rRdx va_s0 > 0
    ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 10 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 1))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 2))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 3))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 4))) /\ (va_get_reg64
    rRdx va_s0 > 0 ==> (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite va_in_ctr 5))) /\ (va_get_reg64
    rRdx va_s0 == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_s0) (va_get_xmm 10 va_s0)
    (va_get_xmm 11 va_s0) (va_get_xmm 12 va_s0) (va_get_xmm 13 va_s0) (va_get_xmm 14 va_s0)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + va_in_iter - 1)) /\
    (va_get_reg64 rRdx va_s0 > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` va_in_iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_s0 == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (va_in_iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ (forall (va_x_efl:Vale.X64.Flags.t)
    (va_x_heap2:vale_heap) (va_x_heap3:vale_heap) (va_x_heap6:vale_heap) (va_x_mem:vale_heap)
    (va_x_ok:bool) (va_x_r11:nat64) (va_x_r12:nat64) (va_x_r13:nat64) (va_x_r14:nat64)
    (va_x_rbx:nat64) (va_x_rdi:nat64) (va_x_rdx:nat64) (va_x_rsi:nat64) (va_x_xmm0:quad32)
    (va_x_xmm1:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32)
    (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32) (va_x_xmm2:quad32)
    (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32) (va_x_xmm7:quad32)
    (va_x_xmm8:quad32) (va_x_xmm9:quad32) (ctr:quad32) (iter:nat) (y_cur:quad32) . let va_sM =
    va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6
    (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2
    (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12
    va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 1 va_x_xmm1
    (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64
    rRdi va_x_rdi (va_upd_reg64 rRbx va_x_rbx (va_upd_reg64 rR14 va_x_r14 (va_upd_reg64 rR13
    va_x_r13 (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_ok va_x_ok (va_upd_mem
    va_x_mem (va_upd_mem_heaplet 6 va_x_heap6 (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_mem_heaplet
    2 va_x_heap2 (va_upd_flags va_x_efl va_s0))))))))))))))))))))))))))))) in va_get_ok va_sM /\
    (sse_enabled /\ movbe_enabled) /\ va_get_reg64 rRdx va_sM == va_get_reg64 rRdx va_old - 6
    `op_Multiply` iter /\ va_get_reg64 rR14 va_sM == va_get_reg64 rR14 va_old + 96 `op_Multiply`
    iter /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_old + 96 `op_Multiply` iter /\
    va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_old + 96 `op_Multiply` iter /\ va_get_xmm 2
    va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_sM) (va_get_reg64 rR8 va_sM)
    va_in_iv_b 1 (va_get_mem_layout va_sM) Public /\ (va_get_reg64 rRdx va_sM > 0 ==>
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rR14 va_sM)
    va_in_in0_b ((va_in_count - 1) `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRdi
    va_sM) va_in_in_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\ (va_get_reg64 rRdx va_sM >
    0 ==> Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_sM) (va_get_reg64 rRsi
    va_sM) va_in_out_b (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6) (va_get_reg64 rRdx
    va_old - iter `op_Multiply` 6) (va_get_mem_layout va_sM) Secret) /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_sM) (va_get_reg64 rRbp va_sM)
    va_in_scratch_b 9 (va_get_mem_layout va_sM) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_sM) (va_get_reg64 rR9 va_sM - 32) va_in_hkeys_b 8 (va_get_mem_layout
    va_sM) Secret /\ (Vale.X64.Decls.buffers_disjoint128 va_in_in_b va_in_out_b \/ va_in_in_b ==
    va_in_out_b) /\ va_in_in0_b == va_in_out_b /\ FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old) va_in_in_b) >= 6 /\ (va_get_reg64 rRdx va_sM
    > 0 ==> Vale.AES.GCTR.partial_seq_agreement va_in_plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in_b) (6 `op_Multiply` va_in_count + 6 `op_Multiply` iter)
    (FStar.Seq.Base.length #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_old) va_in_in_b))) /\ (va_get_reg64 rRdx va_sM > 0 ==> va_get_reg64 rRdi va_sM + 16
    `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rR14 va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM < pow2_64) /\ (va_get_reg64
    rRdx va_sM > 0 ==> va_get_reg64 rRsi va_sM + 16 `op_Multiply` va_get_reg64 rRdx va_sM <
    pow2_64) /\ Vale.X64.Decls.modifies_buffer_specific128 va_in_scratch_b (va_get_mem_heaplet 3
    va_old) (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + iter `op_Multiply` 6 + 5) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> va_get_reg64 rRdx va_old >= 6 /\ Vale.X64.Decls.buffer_modifies_specific128
    va_in_out_b (va_get_mem_heaplet 6 va_old) (va_get_mem_heaplet 6 va_sM) (va_in_count
    `op_Multiply` 6) (va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old - 1)) /\
    Vale.X64.Decls.modifies_buffer_specific128 va_in_iv_b (va_get_mem_heaplet 2 va_old)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ aes_reqs_offset alg va_in_key_words va_in_round_keys
    va_in_keys_b (va_get_reg64 rRcx va_sM) (va_get_mem_heaplet 0 va_sM) (va_get_mem_layout va_sM)
    /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 va_in_round_keys 0 /\ pclmulqdq_enabled
    /\ va_in_h_LE == Vale.AES.AES_s.aes_encrypt_LE alg va_in_key_words (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128
    (va_get_mem_heaplet 0 va_sM) va_in_hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 va_in_h_LE)
    /\ va_in_count + iter - 2 >= 0 /\ (va_get_reg64 rRdx va_sM > 0 ==> scratch_reqs va_in_scratch_b
    (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128 (va_get_mem_heaplet
    6 va_sM) va_in_in0_b) (va_get_xmm 7 va_sM)) /\ (va_get_reg64 rRdx va_sM == 0 ==> scratch_reqs
    va_in_scratch_b (va_in_count + iter - 2) (va_get_mem_heaplet 3 va_sM) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) (Vale.X64.Decls.buffer128_read va_in_scratch_b 2
    (va_get_mem_heaplet 3 va_sM))) /\ y_cur == Vale.AES.GHash.ghash_incremental0 va_in_h_LE
    va_in_y_orig (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) va_in_in0_b) 0 ((va_in_count + iter - 2) `op_Multiply` 6)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> y_cur == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_sM)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read va_in_scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))))) /\ (va_get_reg64 rRdx va_sM == 0 ==> va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_cur) /\ 2 <= va_in_count /\ va_get_reg64 rRdx va_sM
    `op_Modulus` 6 == 0 /\ va_get_reg64 rRdx va_sM < pow2_32 /\ (6 <= va_get_reg64 rRdx va_old /\
    va_in_count `op_Multiply` 6 + va_get_reg64 rRdx va_old + 6 < pow2_32) /\ va_in_count
    `op_Multiply` 6 + iter `op_Multiply` 6 + 6 < pow2_32 /\ (va_get_reg64 rRdx va_sM > 0 ==>
    va_get_reg64 rRdx va_sM >= 6) /\ ctr == Vale.AES.GCTR.inc32lite va_in_ctr_BE_orig (6
    `op_Multiply` va_in_count + iter `op_Multiply` 6) /\ va_get_xmm 2 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0) /\ va_get_reg64 rRbx
    va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr `op_Modulus` 256 /\ (va_get_reg64 rRdx
    va_sM > 0 ==> va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 0)) (va_get_xmm 15 va_sM))
    /\ (va_get_reg64 rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 10 va_sM
    == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 1))) /\ (va_get_reg64
    rRdx va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 2))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 3))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 4))) /\ (va_get_reg64 rRdx
    va_sM > 0 ==> (va_get_reg64 rRbx va_sM + 6 < 256 ==> va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr 5))) /\ (va_get_reg64 rRdx
    va_sM == 0 ==> Vale.AES.GCTR.gctr_registers (va_get_xmm 9 va_sM) (va_get_xmm 10 va_sM)
    (va_get_xmm 11 va_sM) (va_get_xmm 12 va_sM) (va_get_xmm 13 va_sM) (va_get_xmm 14 va_sM)
    va_in_plain_quads alg va_in_key_words va_in_ctr_BE_orig (va_in_count + iter - 1)) /\
    (va_get_reg64 rRdx va_sM > 0 ==> Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count +
    6 `op_Multiply` iter) va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    va_in_out_b) va_in_key_words va_in_ctr_BE_orig) /\ (va_get_reg64 rRdx va_sM == 0 ==>
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` va_in_count + 6 `op_Multiply` (iter - 1))
    va_in_plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) va_in_out_b)
    va_in_key_words va_in_ctr_BE_orig) /\ ~(va_get_reg64 rRdx va_sM > 0) ==> va_k va_sM ((ctr,
    iter, y_cur))))


val va_wpProof_Loop6x_loop_while0 : va_old:va_state -> alg:algorithm -> va_in_count:nat ->
  va_in_ctr_BE_orig:quad32 -> va_in_h_LE:quad32 -> va_in_hkeys_b:buffer128 -> va_in_in0_b:buffer128
  -> va_in_in_b:buffer128 -> va_in_iv_b:buffer128 -> va_in_key_words:(seq nat32) ->
  va_in_keys_b:buffer128 -> va_in_out_b:buffer128 -> va_in_plain_quads:(seq quad32) ->
  va_in_round_keys:(seq quad32) -> va_in_scratch_b:buffer128 -> va_in_y_orig:quad32 ->
  va_in_ctr:quad32 -> va_in_iter:nat -> va_in_y_cur:quad32 -> va_s0:va_state -> va_k:(va_state ->
  (quad32 & nat & quad32) -> Type0)
  -> Ghost (va_state & va_fuel & (quad32 & nat & quad32))
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_loop_while0 va_old alg va_in_count
    va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words
    va_in_keys_b va_in_out_b va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig
    va_in_ctr va_in_iter va_in_y_cur va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_loop_while0 alg) ([va_Mod_xmm
    9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3;
    va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi; va_Mod_reg64 rRdx; va_Mod_reg64
    rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64
    rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_flags]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Loop6x_loop_while0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
  va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
  va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur va_s0 va_k =
  let (va_sM, va_f0, ctr, iter, y_cur) = va_lemma_Loop6x_loop_while0 (va_code_Loop6x_loop_while0
    alg) va_s0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b va_in_in0_b
    va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 1 va_sM
    (va_update_xmm 0 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdx va_sM (va_update_reg64
    rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM (va_update_mem
    va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2
    va_sM (va_update_flags va_sM va_s0)))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rRsi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14; va_Mod_reg64 rR13;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags]) va_sM va_s0;
  let va_g = (ctr, iter, y_cur) in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_loop_while0 (va_old:va_state) (alg:algorithm) (va_in_count:nat)
  (va_in_ctr_BE_orig:quad32) (va_in_h_LE:quad32) (va_in_hkeys_b:buffer128) (va_in_in0_b:buffer128)
  (va_in_in_b:buffer128) (va_in_iv_b:buffer128) (va_in_key_words:(seq nat32))
  (va_in_keys_b:buffer128) (va_in_out_b:buffer128) (va_in_plain_quads:(seq quad32))
  (va_in_round_keys:(seq quad32)) (va_in_scratch_b:buffer128) (va_in_y_orig:quad32)
  (va_in_ctr:quad32) (va_in_iter:nat) (va_in_y_cur:quad32) : (va_quickCode (quad32 & nat & quad32)
  (va_code_Loop6x_loop_while0 alg)) =
  (va_QProc (va_code_Loop6x_loop_while0 alg) ([va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm
    6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdx; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_ok; va_Mod_mem;
    va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_flags])
    (va_wp_Loop6x_loop_while0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE va_in_hkeys_b
    va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b va_in_plain_quads
    va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter va_in_y_cur)
    (va_wpProof_Loop6x_loop_while0 va_old alg va_in_count va_in_ctr_BE_orig va_in_h_LE
    va_in_hkeys_b va_in_in0_b va_in_in_b va_in_iv_b va_in_key_words va_in_keys_b va_in_out_b
    va_in_plain_quads va_in_round_keys va_in_scratch_b va_in_y_orig va_in_ctr va_in_iter
    va_in_y_cur))
#pop-options
//--
//-- Loop6x_loop
#push-options "--z3rlimit 750"

val va_code_Loop6x_loop : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Loop6x_loop alg =
  (va_Block (va_CCons (va_code_Loop6x_loop_while0 alg) (va_CNil ())))

val va_codegen_success_Loop6x_loop : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Loop6x_loop alg =
  (va_pbool_and (va_codegen_success_Loop6x_loop_while0 alg) (va_ttrue ()))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Loop6x_loop (va_mods:va_mods_t) (alg:algorithm) (h_LE:quad32) (y_orig:quad32)
  (y_prev:quad32) (count:nat) (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128)
  (scratch_b:buffer128) (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (ctr_BE_orig:quad32) (ctr_BE:quad32) :
  (va_quickCode (quad32) (va_code_Loop6x_loop alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let (iter:nat) = 0 in
    let (ctr:quad32) = ctr_BE in let (y_cur:quad32) = y_prev in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 876 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_loop_while0 va_old_s alg count ctr_BE_orig h_LE hkeys_b in0_b in_b iv_b
    key_words keys_b out_b plain_quads round_keys scratch_b y_orig ctr iter y_cur) (fun
    (va_s:va_state) va_g -> let (ctr, iter, y_cur) = va_g in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 964 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_registers_reveal ()) (let (y_new:quad32) = y_cur in
    va_QEmpty ((y_new))))))


val va_lemma_Loop6x_loop : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> h_LE:quad32 ->
  y_orig:quad32 -> y_prev:quad32 -> count:nat -> iv_b:buffer128 -> in0_b:buffer128 ->
  in_b:buffer128 -> out_b:buffer128 -> scratch_b:buffer128 -> plain_quads:(seq quad32) ->
  key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 ->
  ctr_BE_orig:quad32 -> ctr_BE:quad32
  -> Ghost (va_state & va_fuel & quad32)
  (requires (va_require_total va_b0 (va_code_Loop6x_loop alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ movbe_enabled /\ count >= 2 /\ (6 <= va_get_reg64 rRdx va_s0 /\ count
    `op_Multiply` 6 + va_get_reg64 rRdx va_s0 + 6 < pow2_32) /\ va_get_reg64 rRdx va_s0
    `op_Modulus` 6 == 0 /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0
    0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8
    va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rR14 va_s0) in0_b ((count - 1) `op_Multiply` 6)
    (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0)
    in_b (count `op_Multiply` 6) (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    out_b (count `op_Multiply` 6) (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ (Vale.X64.Decls.buffers_disjoint128 in_b out_b \/ in_b == out_b) /\ in0_b == out_b /\
    Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) in_b) (count `op_Multiply` 6) (FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in_b)) /\ va_get_reg64 rRdi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64 rR14 va_s0 + 16 `op_Multiply`
    va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64
    rRdx va_s0 < pow2_64 /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx
    va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 ==
    FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled /\ h_LE ==
    Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0
    0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0)
    hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ scratch_reqs scratch_b (count - 2)
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in0_b)
    (va_get_xmm 7 va_s0) /\ y_prev == Vale.AES.GHash.ghash_incremental0 h_LE y_orig
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    in0_b) 0 ((count - 2) `op_Multiply` 6)) /\ y_prev == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_s0))))) /\ count `op_Multiply` 6 + 6 < pow2_32 /\ ctr_BE ==
    Vale.AES.GCTR.inc32lite ctr_BE_orig (count `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\ va_get_reg64 rRbx
    va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256 /\ va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> va_get_xmm 10 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 1)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 2)) /\ (va_get_reg64 rRbx
    va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 3)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13
    va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 4)) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 5)) /\
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) out_b) key_words ctr_BE_orig)))
  (ensures (fun (va_sM, va_fM, y_new) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM
    /\ (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 out_b
    (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6) (count
    `op_Multiply` 6 + va_get_reg64 rRdx va_s0 - 1) /\ Vale.X64.Decls.modifies_buffer_specific128
    iv_b (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) 0 0 /\ va_get_reg64 rR14 va_sM
    == va_get_reg64 rR14 va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 /\ va_get_reg64 rRdi
    va_sM == va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 /\ va_get_reg64
    rRsi va_sM == va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 /\
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6)
    plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig /\
    va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 0) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6))) /\ va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count +
    va_get_reg64 rRdx va_s0 - 6 + 1) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx
    va_s0 - 6 + 1))) /\ va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 2)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 +
    2))) /\ va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 3) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 3))) /\ va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count +
    va_get_reg64 rRdx va_s0 - 6 + 4) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx
    va_s0 - 6 + 4))) /\ va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 5)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 +
    5))) /\ y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) in0_b) 0 (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 12)) /\ va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_new /\ scratch_reqs_simple scratch_b
    (va_get_mem_heaplet 3 va_sM) (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) in0_b) (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 12) (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6)) (Vale.X64.Decls.buffer128_read scratch_b 2
    (va_get_mem_heaplet 3 va_sM)) /\ va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE (va_get_reg64 rRdx va_s0))) /\ va_state_eq va_sM
    (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM
    (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm
    13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm
    9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5
    va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rRbx va_sM
    (va_update_reg64 rRdx va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Loop6x_loop va_b0 va_s0 alg h_LE y_orig y_prev count iv_b in0_b in_b out_b scratch_b
  plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Loop6x_loop va_mods alg h_LE y_orig y_prev count iv_b in0_b in_b out_b
    scratch_b plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Loop6x_loop alg) va_qc va_s0 (fun va_s0
    va_sM va_g -> let y_new = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 742 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 842 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 843 column 97 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6) (count `op_Multiply` 6 + va_get_reg64 rRdx
    va_s0 - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 844 column 70 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2 va_s0)
    (va_get_mem_heaplet 2 va_sM) 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 849 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rR14 va_sM == va_get_reg64 rR14 va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 850 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 851 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 854 column 113 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6)
    plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig) /\
    label va_range1
    "***** POSTCONDITION NOT MET AT line 856 column 167 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 0) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6)))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 857 column 171 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 1) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 1)))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 858 column 171 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 2) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 2)))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 859 column 171 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 3) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 3)))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 860 column 171 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 4) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 4)))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 861 column 171 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 5) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 5)))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 864 column 113 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) in0_b) 0 (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 12))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 865 column 42 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 8 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 y_new) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 867 column 163 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (scratch_reqs_simple scratch_b (va_get_mem_heaplet 3 va_sM) (FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) in0_b) (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 12) (6 `op_Multiply` count + va_get_reg64 rRdx
    va_s0 - 6)) (Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM))) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 870 column 64 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    (va_get_reg64 rRdx va_s0))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  let y_new = va_g in
  (va_sM, va_fM, y_new)

[@ va_qattr]
let va_wp_Loop6x_loop (alg:algorithm) (h_LE:quad32) (y_orig:quad32) (y_prev:quad32) (count:nat)
  (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128) (scratch_b:buffer128)
  (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (ctr_BE_orig:quad32) (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state ->
  quad32 -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ movbe_enabled /\ count >= 2 /\ (6 <= va_get_reg64 rRdx va_s0
    /\ count `op_Multiply` 6 + va_get_reg64 rRdx va_s0 + 6 < pow2_32) /\ va_get_reg64 rRdx va_s0
    `op_Modulus` 6 == 0 /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0
    0 0 16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8
    va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rR14 va_s0) in0_b ((count - 1) `op_Multiply` 6)
    (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0)
    in_b (count `op_Multiply` 6) (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    out_b (count `op_Multiply` 6) (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 9 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ (Vale.X64.Decls.buffers_disjoint128 in_b out_b \/ in_b == out_b) /\ in0_b == out_b /\
    Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) in_b) (count `op_Multiply` 6) (FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in_b)) /\ va_get_reg64 rRdi va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64 rR14 va_s0 + 16 `op_Multiply`
    va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64
    rRdx va_s0 < pow2_64 /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx
    va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 ==
    FStar.Seq.Base.index #quad32 round_keys 0 /\ pclmulqdq_enabled /\ h_LE ==
    Vale.AES.AES_s.aes_encrypt_LE alg key_words (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0
    0 0 0) /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0)
    hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ scratch_reqs scratch_b (count - 2)
    (va_get_mem_heaplet 3 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in0_b)
    (va_get_xmm 7 va_s0) /\ y_prev == Vale.AES.GHash.ghash_incremental0 h_LE y_orig
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    in0_b) 0 ((count - 2) `op_Multiply` 6)) /\ y_prev == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Math.Poly2.Bits_s.to_quad32 (add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8
    va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_s0))))) /\ count `op_Multiply` 6 + 6 < pow2_32 /\ ctr_BE ==
    Vale.AES.GCTR.inc32lite ctr_BE_orig (count `op_Multiply` 6) /\ va_get_xmm 2 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\ va_get_reg64 rRbx
    va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256 /\ va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> va_get_xmm 10 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 1)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 11 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 2)) /\ (va_get_reg64 rRbx
    va_s0 + 6 < 256 ==> va_get_xmm 12 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 3)) /\ (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 13
    va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 4)) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==> va_get_xmm 14 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 5)) /\
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) out_b) key_words ctr_BE_orig) /\ (forall (va_x_mem:vale_heap)
    (va_x_rdi:nat64) (va_x_rsi:nat64) (va_x_rdx:nat64) (va_x_rbx:nat64) (va_x_r11:nat64)
    (va_x_r12:nat64) (va_x_r13:nat64) (va_x_r14:nat64) (va_x_xmm0:quad32) (va_x_xmm1:quad32)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_xmm15:quad32) (va_x_heap6:vale_heap) (va_x_heap2:vale_heap) (va_x_heap3:vale_heap)
    (va_x_efl:Vale.X64.Flags.t) (y_new:quad32) . let va_sM = va_upd_flags va_x_efl
    (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_mem_heaplet 6
    va_x_heap6 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13
    (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9
    va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5
    va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1
    va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR14 va_x_r14 (va_upd_reg64 rR13 va_x_r13
    (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRbx va_x_rbx
    (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdi va_x_rdi (va_upd_mem
    va_x_mem va_s0)))))))))))))))))))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 out_b
    (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6) (count
    `op_Multiply` 6 + va_get_reg64 rRdx va_s0 - 1) /\ Vale.X64.Decls.modifies_buffer_specific128
    iv_b (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) 0 0 /\ va_get_reg64 rR14 va_sM
    == va_get_reg64 rR14 va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 /\ va_get_reg64 rRdi
    va_sM == va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 /\ va_get_reg64
    rRsi va_sM == va_get_reg64 rRsi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 /\
    Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6)
    plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig /\
    va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 0) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6))) /\ va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count +
    va_get_reg64 rRdx va_s0 - 6 + 1) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx
    va_s0 - 6 + 1))) /\ va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 2)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 +
    2))) /\ va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b
    (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 3) (va_get_mem_heaplet 6 va_s0))
    (Vale.AES.GCTR.aes_encrypt_BE alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 3))) /\ va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.quad32_xor (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count +
    va_get_reg64 rRdx va_s0 - 6 + 4) (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE
    alg key_words (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx
    va_s0 - 6 + 4))) /\ va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.X64.Decls.buffer128_read in_b (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 + 5)
    (va_get_mem_heaplet 6 va_s0)) (Vale.AES.GCTR.aes_encrypt_BE alg key_words
    (Vale.AES.GCTR.inc32lite ctr_BE_orig (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6 +
    5))) /\ y_new == Vale.AES.GHash.ghash_incremental0 h_LE y_orig (FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) in0_b) 0 (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 12)) /\ va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 y_new /\ scratch_reqs_simple scratch_b
    (va_get_mem_heaplet 3 va_sM) (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) in0_b) (6 `op_Multiply` count + va_get_reg64 rRdx va_s0 - 12) (6
    `op_Multiply` count + va_get_reg64 rRdx va_s0 - 6)) (Vale.X64.Decls.buffer128_read scratch_b 2
    (va_get_mem_heaplet 3 va_sM)) /\ va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE (va_get_reg64 rRdx va_s0))) ==> va_k va_sM ((y_new))))


val va_wpProof_Loop6x_loop : alg:algorithm -> h_LE:quad32 -> y_orig:quad32 -> y_prev:quad32 ->
  count:nat -> iv_b:buffer128 -> in0_b:buffer128 -> in_b:buffer128 -> out_b:buffer128 ->
  scratch_b:buffer128 -> plain_quads:(seq quad32) -> key_words:(seq nat32) -> round_keys:(seq
  quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 -> ctr_BE_orig:quad32 -> ctr_BE:quad32 ->
  va_s0:va_state -> va_k:(va_state -> quad32 -> Type0)
  -> Ghost (va_state & va_fuel & quad32)
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_loop alg h_LE y_orig y_prev count iv_b in0_b in_b
    out_b scratch_b plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_loop alg) ([va_Mod_flags;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8;
    va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm
    1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11;
    va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem]) va_s0
    va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Loop6x_loop alg h_LE y_orig y_prev count iv_b in0_b in_b out_b scratch_b plain_quads
  key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE va_s0 va_k =
  let (va_sM, va_f0, y_new) = va_lemma_Loop6x_loop (va_code_Loop6x_loop alg) va_s0 alg h_LE y_orig
    y_prev count iv_b in0_b in_b out_b scratch_b plain_quads key_words round_keys keys_b hkeys_b
    ctr_BE_orig ctr_BE in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM
    (va_update_mem_heaplet 2 va_sM (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR14
    va_sM (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRbx va_sM (va_update_reg64 rRdx va_sM (va_update_reg64 rRsi va_sM
    (va_update_reg64 rRdi va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0)))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_mem]) va_sM va_s0;
  let va_g = (y_new) in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_loop (alg:algorithm) (h_LE:quad32) (y_orig:quad32) (y_prev:quad32) (count:nat)
  (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128) (out_b:buffer128) (scratch_b:buffer128)
  (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (ctr_BE_orig:quad32) (ctr_BE:quad32) : (va_quickCode quad32
  (va_code_Loop6x_loop alg)) =
  (va_QProc (va_code_Loop6x_loop alg) ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRdx;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem]) (va_wp_Loop6x_loop alg h_LE y_orig y_prev
    count iv_b in0_b in_b out_b scratch_b plain_quads key_words round_keys keys_b hkeys_b
    ctr_BE_orig ctr_BE) (va_wpProof_Loop6x_loop alg h_LE y_orig y_prev count iv_b in0_b in_b out_b
    scratch_b plain_quads key_words round_keys keys_b hkeys_b ctr_BE_orig ctr_BE))
#pop-options
//--
//-- AESNI_ctr32_6x_preamble
#push-options "--z3rlimit 80"
#restart-solver

val va_code_AESNI_ctr32_6x_preamble : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_AESNI_ctr32_6x_preamble alg =
  (va_Block (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 4)
    (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret) (va_CCons (va_code_Load_one_msb ()) (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15) (va_op_reg_opr64_reg64
    rRcx) (16 - 128) Secret) (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rR12)
    (va_op_opr64_reg64 rRcx)) (va_CCons (va_code_Sub64 (va_op_dst_opr64_reg64 rR12) (va_const_opr64
    96)) (va_CCons (va_code_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm 1) (va_op_opr128_xmm 4))
    (va_CCons (va_code_Add64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 6)) (va_CCons (va_IfElse
    (va_cmp_lt (va_op_cmp_reg64 rRbx) (va_const_cmp 256)) (va_Block (va_CCons (va_code_VPaddd
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (va_CCons (va_code_VPaddd
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2)) (va_CCons (va_code_VPxor
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 4)) (va_CCons (va_code_VPaddd
    (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm 2)) (va_CCons (va_code_VPxor
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 4)) (va_CCons (va_code_VPaddd
    (va_op_xmm_xmm 13) (va_op_xmm_xmm 12) (va_op_xmm_xmm 2)) (va_CCons (va_code_VPxor
    (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_opr128_xmm 4)) (va_CCons (va_code_VPaddd
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (va_CCons (va_code_VPxor
    (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_opr128_xmm 4)) (va_CCons (va_code_VPaddd
    (va_op_xmm_xmm 1) (va_op_xmm_xmm 14) (va_op_xmm_xmm 2)) (va_CCons (va_code_VPxor (va_op_xmm_xmm
    14) (va_op_xmm_xmm 14) (va_op_opr128_xmm 4)) (va_CNil ()))))))))))))) (va_Block (va_CCons
    (va_code_Sub64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 256)) (va_CCons
    (va_code_Handle_ctr32_2 ()) (va_CNil ()))))) (va_CNil ()))))))))))

val va_codegen_success_AESNI_ctr32_6x_preamble : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_AESNI_ctr32_6x_preamble alg =
  (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 4)
    (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret) (va_pbool_and (va_codegen_success_Load_one_msb
    ()) (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 0)
    (va_op_xmm_xmm 15) (va_op_reg_opr64_reg64 rRcx) (16 - 128) Secret) (va_pbool_and
    (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rR12) (va_op_opr64_reg64 rRcx)) (va_pbool_and
    (va_codegen_success_Sub64 (va_op_dst_opr64_reg64 rR12) (va_const_opr64 96)) (va_pbool_and
    (va_codegen_success_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm 1) (va_op_opr128_xmm 4))
    (va_pbool_and (va_codegen_success_Add64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 6))
    (va_pbool_and (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 1)
    (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm
    10) (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 10) (va_op_opr128_xmm 4)) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm 2)) (va_pbool_and
    (va_codegen_success_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 4))
    (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12) (va_op_xmm_xmm
    2)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 12) (va_op_xmm_xmm 12)
    (va_op_opr128_xmm 4)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 14)
    (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm
    13) (va_op_xmm_xmm 13) (va_op_opr128_xmm 4)) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 1) (va_op_xmm_xmm 14) (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPxor
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_opr128_xmm 4)) (va_pbool_and
    (va_codegen_success_Sub64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 256))
    (va_codegen_success_Handle_ctr32_2 ()))))))))))))) (va_ttrue ())))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_AESNI_ctr32_6x_preamble (va_mods:va_mods_t) (alg:algorithm) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x_preamble alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1024 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 4) (va_op_reg_opr64_reg64
    rRcx) (0 - 128) Secret keys_b 0) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1025 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load_one_msb ()) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1026 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15)
    (va_op_reg_opr64_reg64 rRcx) (16 - 128) Secret keys_b 1) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1029 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rR12) (va_op_opr64_reg64 rRcx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1030 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Sub64 (va_op_dst_opr64_reg64 rR12) (va_const_opr64 96)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1032 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm 1) (va_op_opr128_xmm 4)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1034 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Add64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 6)) (fun (va_s:va_state) _ ->
    va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1035 column 8 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qIf va_mods (Cmp_lt (va_op_cmp_reg64 rRbx) (va_const_cmp 256)) (qblock va_mods (fun
    (va_s:va_state) -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1036 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (fun (va_s:va_state) _
    -> let (va_arg83:Vale.Def.Types_s.quad32) = va_get_xmm 10 va_s in let
    (va_arg82:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg81:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1037 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg81 va_arg82 va_arg83 1) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 1038 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg80:Vale.Def.Types_s.quad32) = va_get_xmm 11 va_s in let
    (va_arg79:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg78:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1039 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg78 va_arg79 va_arg80 2) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1040 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_opr128_xmm 4)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1041 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg77:Vale.Def.Types_s.quad32) = va_get_xmm 12 va_s in let
    (va_arg76:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg75:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1042 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg75 va_arg76 va_arg77 3) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1043 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_opr128_xmm 4)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1044 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg74:Vale.Def.Types_s.quad32) = va_get_xmm 13 va_s in let
    (va_arg73:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg72:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1045 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg72 va_arg73 va_arg74 4) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1046 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_opr128_xmm 4)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1047 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg71:Vale.Def.Types_s.quad32) = va_get_xmm 14 va_s in let
    (va_arg70:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg69:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1048 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg69 va_arg70 va_arg71 5) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1049 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_opr128_xmm 4)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1050 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 14) (va_op_xmm_xmm 2)) (fun (va_s:va_state) _
    -> let (va_arg68:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_s in let
    (va_arg67:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg66:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1051 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg66 va_arg67 va_arg68 6) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1052 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_opr128_xmm 4)) (va_QEmpty
    (())))))))))))))))))))) (qblock va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1054 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Sub64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 256)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1055 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Handle_ctr32_2 ctr_orig) (va_QEmpty (())))))) (fun (va_s:va_state) va_g -> let
    (va_arg65:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = round_keys in let
    (va_arg64:Vale.Def.Types_s.quad32) = va_get_xmm 9 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1058 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.init_rounds_opaque va_arg64 va_arg65) (let
    (va_arg63:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = round_keys in let
    (va_arg62:Vale.Def.Types_s.quad32) = va_get_xmm 10 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1059 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.init_rounds_opaque va_arg62 va_arg63) (let
    (va_arg61:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = round_keys in let
    (va_arg60:Vale.Def.Types_s.quad32) = va_get_xmm 11 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1060 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.init_rounds_opaque va_arg60 va_arg61) (let
    (va_arg59:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = round_keys in let
    (va_arg58:Vale.Def.Types_s.quad32) = va_get_xmm 12 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1061 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.init_rounds_opaque va_arg58 va_arg59) (let
    (va_arg57:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = round_keys in let
    (va_arg56:Vale.Def.Types_s.quad32) = va_get_xmm 13 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1062 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.init_rounds_opaque va_arg56 va_arg57) (let
    (va_arg55:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = round_keys in let
    (va_arg54:Vale.Def.Types_s.quad32) = va_get_xmm 14 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1063 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.init_rounds_opaque va_arg54 va_arg55) (va_QEmpty
    (())))))))))))))))))


val va_lemma_AESNI_ctr32_6x_preamble : va_b0:va_code -> va_s0:va_state -> alg:algorithm ->
  key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> ctr_orig:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_AESNI_ctr32_6x_preamble alg) va_s0 /\ va_get_ok va_s0
    /\ (sse_enabled /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_reg64 rRcx va_s0 - 96 >= 0 /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig
    0) /\ va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig
    `op_Modulus` 256 /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32
    202182159 134810123 67438087 66051)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\ (0
    <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256 /\ va_get_reg64 rRbx va_sM ==
    Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_orig 6) `op_Modulus`
    256 /\ va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 0))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 10
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 1))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 11
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 12
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 3))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 13
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 14
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 5))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 1
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 6) /\
    va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 1) /\ va_state_eq va_sM
    (va_update_flags va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 2 va_sM
    (va_update_xmm 1 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_reg64
    rRbx va_sM (va_update_ok va_sM va_s0)))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_AESNI_ctr32_6x_preamble va_b0 va_s0 alg key_words round_keys keys_b ctr_orig =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm
    12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4;
    va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_ok]
    in
  let va_qc = va_qcode_AESNI_ctr32_6x_preamble va_mods alg key_words round_keys keys_b ctr_orig in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_AESNI_ctr32_6x_preamble alg) va_qc
    va_s0 (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 968 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 1010 column 27 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1011 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite
    ctr_orig 6) `op_Modulus` 256) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1013 column 125 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 0))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1014 column 125 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 1))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1015 column 125 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1016 column 125 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 3))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1017 column 125 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1018 column 125 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 5))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1020 column 59 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig
    6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1022 column 39 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 1))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4;
    va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx;
    va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_AESNI_ctr32_6x_preamble (alg:algorithm) (key_words:(seq nat32)) (round_keys:(seq quad32))
  (keys_b:buffer128) (ctr_orig:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64
    rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_reg64 rRcx va_s0 -
    96 >= 0 /\ va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 0) /\ va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig
    `op_Modulus` 256 /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32
    202182159 134810123 67438087 66051) /\ (forall (va_x_rbx:nat64) (va_x_r11:nat64)
    (va_x_r12:nat64) (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32)
    (va_x_xmm6:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_xmm 15 va_x_xmm15
    (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11
    va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 6 va_x_xmm6
    (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1 va_x_xmm1
    (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRbx va_x_rbx
    va_s0))))))))))))))) in va_get_ok va_sM /\ (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx
    va_sM < 256 /\ va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0
    (Vale.AES.GCTR.inc32lite ctr_orig 6) `op_Modulus` 256 /\ va_get_xmm 9 va_sM ==
    Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 0)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys
    0)) round_keys 0 /\ va_get_xmm 10 va_sM == Vale.AES.AES_s.eval_rounds
    (Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 1)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\
    va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 12
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 3))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 13
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 14
    va_sM == Vale.AES.AES_s.eval_rounds (Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 5))
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) round_keys 0 /\ va_get_xmm 1
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 6) /\
    va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 1) ==> va_k va_sM (())))


val va_wpProof_AESNI_ctr32_6x_preamble : alg:algorithm -> key_words:(seq nat32) -> round_keys:(seq
  quad32) -> keys_b:buffer128 -> ctr_orig:quad32 -> va_s0:va_state -> va_k:(va_state -> unit ->
  Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_AESNI_ctr32_6x_preamble alg key_words round_keys keys_b
    ctr_orig va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_AESNI_ctr32_6x_preamble alg)
    ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_xmm
    1; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_AESNI_ctr32_6x_preamble alg key_words round_keys keys_b ctr_orig va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_AESNI_ctr32_6x_preamble (va_code_AESNI_ctr32_6x_preamble alg) va_s0
    alg key_words round_keys keys_b ctr_orig in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM
    (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM
    (va_update_xmm 9 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11
    va_sM (va_update_reg64 rRbx va_sM (va_update_ok va_sM va_s0))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4;
    va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx]) va_sM
    va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_AESNI_ctr32_6x_preamble (alg:algorithm) (key_words:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (ctr_orig:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x_preamble alg)) =
  (va_QProc (va_code_AESNI_ctr32_6x_preamble alg) ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR12; va_Mod_reg64 rR11;
    va_Mod_reg64 rRbx]) (va_wp_AESNI_ctr32_6x_preamble alg key_words round_keys keys_b ctr_orig)
    (va_wpProof_AESNI_ctr32_6x_preamble alg key_words round_keys keys_b ctr_orig))
#pop-options
//--
//-- AESNI_ctr32_6x_loop_body

val va_code_AESNI_ctr32_6x_loop_body : alg:algorithm -> rnd:nat -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_AESNI_ctr32_6x_loop_body alg rnd =
  (va_Block (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm 15))
    (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 15))
    (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 15))
    (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 15))
    (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 15))
    (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 15))
    (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15)
    (va_op_reg_opr64_reg64 rRcx) (16 `op_Multiply` (rnd + 2) - 128) Secret) (va_CNil ())))))))))

val va_codegen_success_AESNI_ctr32_6x_loop_body : alg:algorithm -> rnd:nat -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_AESNI_ctr32_6x_loop_body alg rnd =
  (va_pbool_and (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm
    15)) (va_pbool_and (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 10) (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 15)) (va_pbool_and (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 11)
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 15)) (va_pbool_and (va_codegen_success_VAESNI_enc
    (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 15)) (va_pbool_and
    (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 15))
    (va_pbool_and (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 14) (va_op_xmm_xmm 14)
    (va_op_xmm_xmm 15)) (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet
    0) (va_op_xmm_xmm 15) (va_op_reg_opr64_reg64 rRcx) (16 `op_Multiply` (rnd + 2) - 128) Secret)
    (va_ttrue ()))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_AESNI_ctr32_6x_loop_body (va_mods:va_mods_t) (alg:algorithm) (rnd:nat) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x_loop_body alg rnd)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1118 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm 15)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1119 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1120 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1121 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1122 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 15)) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 1123 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 15)) (fun
    (va_s:va_state) _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1125 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_s.eval_rounds_reveal ()) (va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1126 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.commute_sub_bytes_shift_rows_forall ()) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1127 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15)
    (va_op_reg_opr64_reg64 rRcx) (16 `op_Multiply` (rnd + 2) - 128) Secret keys_b (rnd + 2))
    (va_QEmpty (()))))))))))))


val va_lemma_AESNI_ctr32_6x_loop_body : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> rnd:nat
  -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> init0:quad32 ->
  init1:quad32 -> init2:quad32 -> init3:quad32 -> init4:quad32 -> init5:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_AESNI_ctr32_6x_loop_body alg rnd) va_s0 /\ va_get_ok
    va_s0 /\ (sse_enabled /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx
    va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ rnd + 2 <
    FStar.Seq.Base.length #quad32 round_keys /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    round_keys (rnd + 1) /\ va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds init0 round_keys rnd
    /\ va_get_xmm 10 va_s0 == Vale.AES.AES_s.eval_rounds init1 round_keys rnd /\ va_get_xmm 11
    va_s0 == Vale.AES.AES_s.eval_rounds init2 round_keys rnd /\ va_get_xmm 12 va_s0 ==
    Vale.AES.AES_s.eval_rounds init3 round_keys rnd /\ va_get_xmm 13 va_s0 ==
    Vale.AES.AES_s.eval_rounds init4 round_keys rnd /\ va_get_xmm 14 va_s0 ==
    Vale.AES.AES_s.eval_rounds init5 round_keys rnd)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds init0 round_keys (rnd + 1) /\ va_get_xmm 10
    va_sM == Vale.AES.AES_s.eval_rounds init1 round_keys (rnd + 1) /\ va_get_xmm 11 va_sM ==
    Vale.AES.AES_s.eval_rounds init2 round_keys (rnd + 1) /\ va_get_xmm 12 va_sM ==
    Vale.AES.AES_s.eval_rounds init3 round_keys (rnd + 1) /\ va_get_xmm 13 va_sM ==
    Vale.AES.AES_s.eval_rounds init4 round_keys (rnd + 1) /\ va_get_xmm 14 va_sM ==
    Vale.AES.AES_s.eval_rounds init5 round_keys (rnd + 1) /\ va_get_xmm 15 va_sM ==
    FStar.Seq.Base.index #quad32 round_keys (rnd + 2)) /\ va_state_eq va_sM (va_update_flags va_sM
    (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM
    (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_ok va_sM
    va_s0)))))))))))
[@"opaque_to_smt"]
let va_lemma_AESNI_ctr32_6x_loop_body va_b0 va_s0 alg rnd key_words round_keys keys_b init0 init1
  init2 init3 init4 init5 =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm
    12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_ok] in
  let va_qc = va_qcode_AESNI_ctr32_6x_loop_body va_mods alg rnd key_words round_keys keys_b init0
    init1 init2 init3 init4 init5 in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_AESNI_ctr32_6x_loop_body alg rnd) va_qc
    va_s0 (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 1066 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 1109 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds init0 round_keys (rnd + 1)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1110 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.AES.AES_s.eval_rounds init1 round_keys (rnd + 1)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1111 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds init2 round_keys (rnd + 1)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1112 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.AES.AES_s.eval_rounds init3 round_keys (rnd + 1)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1113 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.AES.AES_s.eval_rounds init4 round_keys (rnd + 1)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1114 column 58 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.AES.AES_s.eval_rounds init5 round_keys (rnd + 1)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1116 column 43 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys (rnd + 2)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_AESNI_ctr32_6x_loop_body (alg:algorithm) (rnd:nat) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0))
  : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64
    rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ rnd + 2 <
    FStar.Seq.Base.length #quad32 round_keys /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    round_keys (rnd + 1) /\ va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds init0 round_keys rnd
    /\ va_get_xmm 10 va_s0 == Vale.AES.AES_s.eval_rounds init1 round_keys rnd /\ va_get_xmm 11
    va_s0 == Vale.AES.AES_s.eval_rounds init2 round_keys rnd /\ va_get_xmm 12 va_s0 ==
    Vale.AES.AES_s.eval_rounds init3 round_keys rnd /\ va_get_xmm 13 va_s0 ==
    Vale.AES.AES_s.eval_rounds init4 round_keys rnd /\ va_get_xmm 14 va_s0 ==
    Vale.AES.AES_s.eval_rounds init5 round_keys rnd) /\ (forall (va_x_xmm9:quad32)
    (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32)
    (va_x_xmm14:quad32) (va_x_xmm15:quad32) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags
    va_x_efl (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13
    (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9
    va_x_xmm9 va_s0))))))) in va_get_ok va_sM /\ (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds
    init0 round_keys (rnd + 1) /\ va_get_xmm 10 va_sM == Vale.AES.AES_s.eval_rounds init1
    round_keys (rnd + 1) /\ va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds init2 round_keys (rnd
    + 1) /\ va_get_xmm 12 va_sM == Vale.AES.AES_s.eval_rounds init3 round_keys (rnd + 1) /\
    va_get_xmm 13 va_sM == Vale.AES.AES_s.eval_rounds init4 round_keys (rnd + 1) /\ va_get_xmm 14
    va_sM == Vale.AES.AES_s.eval_rounds init5 round_keys (rnd + 1) /\ va_get_xmm 15 va_sM ==
    FStar.Seq.Base.index #quad32 round_keys (rnd + 2)) ==> va_k va_sM (())))


val va_wpProof_AESNI_ctr32_6x_loop_body : alg:algorithm -> rnd:nat -> key_words:(seq nat32) ->
  round_keys:(seq quad32) -> keys_b:buffer128 -> init0:quad32 -> init1:quad32 -> init2:quad32 ->
  init3:quad32 -> init4:quad32 -> init5:quad32 -> va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_AESNI_ctr32_6x_loop_body alg rnd key_words round_keys
    keys_b init0 init1 init2 init3 init4 init5 va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_AESNI_ctr32_6x_loop_body alg rnd)
    ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 9]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_AESNI_ctr32_6x_loop_body alg rnd key_words round_keys keys_b init0 init1 init2 init3
  init4 init5 va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_AESNI_ctr32_6x_loop_body (va_code_AESNI_ctr32_6x_loop_body alg rnd)
    va_s0 alg rnd key_words round_keys keys_b init0 init1 init2 init3 init4 init5 in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM
    (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM
    (va_update_xmm 9 va_sM (va_update_ok va_sM va_s0))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_AESNI_ctr32_6x_loop_body (alg:algorithm) (rnd:nat) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x_loop_body alg rnd)) =
  (va_QProc (va_code_AESNI_ctr32_6x_loop_body alg rnd) ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm
    14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9])
    (va_wp_AESNI_ctr32_6x_loop_body alg rnd key_words round_keys keys_b init0 init1 init2 init3
    init4 init5) (va_wpProof_AESNI_ctr32_6x_loop_body alg rnd key_words round_keys keys_b init0
    init1 init2 init3 init4 init5))
//--
//-- AESNI_ctr32_6x_loop_recursive

val va_code_AESNI_ctr32_6x_loop_recursive : alg:algorithm -> rnd:nat -> Tot va_code(decreases
  %[alg;rnd])
[@ "opaque_to_smt"]
let rec va_code_AESNI_ctr32_6x_loop_recursive alg rnd =
  (va_Block (va_CCons (if (rnd > 0) then va_Block (va_CCons (va_code_AESNI_ctr32_6x_loop_recursive
    alg (rnd - 1)) (va_CNil ())) else va_Block (va_CNil ())) (va_CCons
    (va_code_AESNI_ctr32_6x_loop_body alg rnd) (va_CNil ()))))

val va_codegen_success_AESNI_ctr32_6x_loop_recursive : alg:algorithm -> rnd:nat -> Tot
  va_pbool(decreases %[alg;rnd])
[@ "opaque_to_smt"]
let rec va_codegen_success_AESNI_ctr32_6x_loop_recursive alg rnd =
  (va_pbool_and (if (rnd > 0) then va_pbool_and (va_codegen_success_AESNI_ctr32_6x_loop_recursive
    alg (rnd - 1)) (va_ttrue ()) else va_ttrue ()) (va_pbool_and
    (va_codegen_success_AESNI_ctr32_6x_loop_body alg rnd) (va_ttrue ())))


val va_lemma_AESNI_ctr32_6x_loop_recursive : va_b0:va_code -> va_s0:va_state -> alg:algorithm ->
  rnd:nat -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> init0:quad32
  -> init1:quad32 -> init2:quad32 -> init3:quad32 -> init4:quad32 -> init5:quad32
  -> Ghost (va_state & va_fuel)(decreases
    %[va_b0;va_s0;alg;rnd;key_words;round_keys;keys_b;init0;init1;init2;init3;init4;init5])
  (requires (va_require_total va_b0 (va_code_AESNI_ctr32_6x_loop_recursive alg rnd) va_s0 /\
    va_get_ok va_s0 /\ (sse_enabled /\ aes_reqs_offset alg key_words round_keys keys_b
    (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ rnd + 2 <
    FStar.Seq.Base.length #quad32 round_keys /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    round_keys 1 /\ va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds init0 round_keys 0 /\
    va_get_xmm 10 va_s0 == Vale.AES.AES_s.eval_rounds init1 round_keys 0 /\ va_get_xmm 11 va_s0 ==
    Vale.AES.AES_s.eval_rounds init2 round_keys 0 /\ va_get_xmm 12 va_s0 ==
    Vale.AES.AES_s.eval_rounds init3 round_keys 0 /\ va_get_xmm 13 va_s0 ==
    Vale.AES.AES_s.eval_rounds init4 round_keys 0 /\ va_get_xmm 14 va_s0 ==
    Vale.AES.AES_s.eval_rounds init5 round_keys 0)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds init0 round_keys (rnd + 1) /\ va_get_xmm 10
    va_sM == Vale.AES.AES_s.eval_rounds init1 round_keys (rnd + 1) /\ va_get_xmm 11 va_sM ==
    Vale.AES.AES_s.eval_rounds init2 round_keys (rnd + 1) /\ va_get_xmm 12 va_sM ==
    Vale.AES.AES_s.eval_rounds init3 round_keys (rnd + 1) /\ va_get_xmm 13 va_sM ==
    Vale.AES.AES_s.eval_rounds init4 round_keys (rnd + 1) /\ va_get_xmm 14 va_sM ==
    Vale.AES.AES_s.eval_rounds init5 round_keys (rnd + 1) /\ va_get_xmm 15 va_sM ==
    FStar.Seq.Base.index #quad32 round_keys (rnd + 2)) /\ va_state_eq va_sM (va_update_flags va_sM
    (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM
    (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_ok va_sM
    va_s0)))))))))))
[@"opaque_to_smt"]
let rec va_lemma_AESNI_ctr32_6x_loop_recursive va_b0 va_s0 alg rnd key_words round_keys keys_b
  init0 init1 init2 init3 init4 init5 =
  va_reveal_opaque (`%va_code_AESNI_ctr32_6x_loop_recursive) (va_code_AESNI_ctr32_6x_loop_recursive
    alg rnd);
  let (va_old_s:va_state) = va_s0 in
  let (va_b1:va_codes) = va_get_block va_b0 in
  let va_b10 = va_tl va_b1 in
  let va_c10 = va_hd va_b1 in
  let (va_fc10, va_s10) =
  (
    if (rnd > 0) then
    (
      let va_b11 = va_get_block va_c10 in
      let (va_s12, va_fc12) = va_lemma_AESNI_ctr32_6x_loop_recursive (va_hd va_b11) va_s0 alg (rnd
        - 1) key_words round_keys keys_b init0 init1 init2 init3 init4 init5 in
      let va_b12 = va_tl va_b11 in
      let (va_s10, va_f12) = va_lemma_empty_total va_s12 va_b12 in
      let va_fc10 = va_lemma_merge_total va_b11 va_s0 va_fc12 va_s12 va_f12 va_s10 in
      (va_fc10, va_s10)
    )
    else
    (
      let va_b13 = va_get_block va_c10 in
      let (va_s10, va_fc10) = va_lemma_empty_total va_s0 va_b13 in
      (va_fc10, va_s10)
    )
  ) in
  let (va_s14, va_fc14) = va_lemma_AESNI_ctr32_6x_loop_body (va_hd va_b10) va_s10 alg rnd key_words
    round_keys keys_b init0 init1 init2 init3 init4 init5 in
  let va_b14 = va_tl va_b10 in
  let (va_sM, va_f14) = va_lemma_empty_total va_s14 va_b14 in
  let va_f10 = va_lemma_merge_total va_b10 va_s10 va_fc14 va_s14 va_f14 va_sM in
  let va_fM = va_lemma_merge_total va_b1 va_s0 va_fc10 va_s10 va_f10 va_sM in
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_AESNI_ctr32_6x_loop_recursive (alg:algorithm) (rnd:nat) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0))
  : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64
    rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ rnd + 2 <
    FStar.Seq.Base.length #quad32 round_keys /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32
    round_keys 1 /\ va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds init0 round_keys 0 /\
    va_get_xmm 10 va_s0 == Vale.AES.AES_s.eval_rounds init1 round_keys 0 /\ va_get_xmm 11 va_s0 ==
    Vale.AES.AES_s.eval_rounds init2 round_keys 0 /\ va_get_xmm 12 va_s0 ==
    Vale.AES.AES_s.eval_rounds init3 round_keys 0 /\ va_get_xmm 13 va_s0 ==
    Vale.AES.AES_s.eval_rounds init4 round_keys 0 /\ va_get_xmm 14 va_s0 ==
    Vale.AES.AES_s.eval_rounds init5 round_keys 0) /\ (forall (va_x_xmm9:quad32)
    (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32)
    (va_x_xmm14:quad32) (va_x_xmm15:quad32) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags
    va_x_efl (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13
    (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9
    va_x_xmm9 va_s0))))))) in va_get_ok va_sM /\ (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds
    init0 round_keys (rnd + 1) /\ va_get_xmm 10 va_sM == Vale.AES.AES_s.eval_rounds init1
    round_keys (rnd + 1) /\ va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds init2 round_keys (rnd
    + 1) /\ va_get_xmm 12 va_sM == Vale.AES.AES_s.eval_rounds init3 round_keys (rnd + 1) /\
    va_get_xmm 13 va_sM == Vale.AES.AES_s.eval_rounds init4 round_keys (rnd + 1) /\ va_get_xmm 14
    va_sM == Vale.AES.AES_s.eval_rounds init5 round_keys (rnd + 1) /\ va_get_xmm 15 va_sM ==
    FStar.Seq.Base.index #quad32 round_keys (rnd + 2)) ==> va_k va_sM (())))


val va_wpProof_AESNI_ctr32_6x_loop_recursive : alg:algorithm -> rnd:nat -> key_words:(seq nat32) ->
  round_keys:(seq quad32) -> keys_b:buffer128 -> init0:quad32 -> init1:quad32 -> init2:quad32 ->
  init3:quad32 -> init4:quad32 -> init5:quad32 -> va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_AESNI_ctr32_6x_loop_recursive alg rnd key_words round_keys
    keys_b init0 init1 init2 init3 init4 init5 va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_AESNI_ctr32_6x_loop_recursive alg rnd)
    ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 9]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_AESNI_ctr32_6x_loop_recursive alg rnd key_words round_keys keys_b init0 init1 init2
  init3 init4 init5 va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_AESNI_ctr32_6x_loop_recursive
    (va_code_AESNI_ctr32_6x_loop_recursive alg rnd) va_s0 alg rnd key_words round_keys keys_b init0
    init1 init2 init3 init4 init5 in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM
    (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM
    (va_update_xmm 9 va_sM (va_update_ok va_sM va_s0))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_AESNI_ctr32_6x_loop_recursive (alg:algorithm) (rnd:nat) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x_loop_recursive alg rnd)) =
  (va_QProc (va_code_AESNI_ctr32_6x_loop_recursive alg rnd) ([va_Mod_flags; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9])
    (va_wp_AESNI_ctr32_6x_loop_recursive alg rnd key_words round_keys keys_b init0 init1 init2
    init3 init4 init5) (va_wpProof_AESNI_ctr32_6x_loop_recursive alg rnd key_words round_keys
    keys_b init0 init1 init2 init3 init4 init5))
//--
//-- AESNI_ctr32_6x_round9
#push-options "--z3rlimit 100"

val va_code_AESNI_ctr32_6x_round9 : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_AESNI_ctr32_6x_round9 alg =
  (va_Block (va_CCons (if (alg = AES_128) then va_Block (va_CCons (va_code_Load128_buffer
    (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64 rRcx) (160 - 128)
    Secret) (va_CNil ())) else va_Block (va_CCons (va_code_Load128_buffer
    (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64 rRcx) (224 - 128)
    Secret) (va_CNil ()))) (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 9) (va_op_xmm_xmm 9)
    (va_op_xmm_xmm 15)) (va_CCons (va_code_Mem128_lemma ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm
    4) (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi)
    0 Secret)) (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm
    15)) (va_CCons (va_code_Mem128_lemma ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm 5)
    (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 16
    Secret)) (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm
    15)) (va_CCons (va_code_Mem128_lemma ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm 6)
    (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 32
    Secret)) (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm
    15)) (va_CCons (va_code_Mem128_lemma ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm 8)
    (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 48
    Secret)) (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm
    15)) (va_CCons (va_code_Mem128_lemma ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm 2)
    (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 64
    Secret)) (va_CCons (va_code_VAESNI_enc (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm
    15)) (va_CCons (va_code_Mem128_lemma ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm 3)
    (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 80
    Secret)) (va_CCons (va_code_AddLea64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRdi)
    (va_const_opr64 96)) (va_CNil ()))))))))))))))))))))))

val va_codegen_success_AESNI_ctr32_6x_round9 : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_AESNI_ctr32_6x_round9 alg =
  (va_pbool_and (if (alg = AES_128) then va_pbool_and (va_codegen_success_Load128_buffer
    (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64 rRcx) (160 - 128)
    Secret) (va_ttrue ()) else va_pbool_and (va_codegen_success_Load128_buffer
    (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64 rRcx) (224 - 128)
    Secret) (va_ttrue ())) (va_pbool_and (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 9)
    (va_op_xmm_xmm 9) (va_op_xmm_xmm 15)) (va_pbool_and (va_codegen_success_Mem128_lemma ())
    (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 4) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 0 Secret)) (va_pbool_and
    (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 15))
    (va_pbool_and (va_codegen_success_Mem128_lemma ()) (va_pbool_and (va_codegen_success_VPxor
    (va_op_xmm_xmm 5) (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6)
    (va_op_reg64_reg64 rRdi) 16 Secret)) (va_pbool_and (va_codegen_success_VAESNI_enc
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 15)) (va_pbool_and
    (va_codegen_success_Mem128_lemma ()) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 6)
    (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 32
    Secret)) (va_pbool_and (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 12) (va_op_xmm_xmm 12)
    (va_op_xmm_xmm 15)) (va_pbool_and (va_codegen_success_Mem128_lemma ()) (va_pbool_and
    (va_codegen_success_VPxor (va_op_xmm_xmm 8) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 48 Secret)) (va_pbool_and
    (va_codegen_success_VAESNI_enc (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 15))
    (va_pbool_and (va_codegen_success_Mem128_lemma ()) (va_pbool_and (va_codegen_success_VPxor
    (va_op_xmm_xmm 2) (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6)
    (va_op_reg64_reg64 rRdi) 64 Secret)) (va_pbool_and (va_codegen_success_VAESNI_enc
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 15)) (va_pbool_and
    (va_codegen_success_Mem128_lemma ()) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 3)
    (va_op_xmm_xmm 3) (va_opr_code_Mem128 (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 80
    Secret)) (va_pbool_and (va_codegen_success_AddLea64 (va_op_dst_opr64_reg64 rRdi)
    (va_op_opr64_reg64 rRdi) (va_const_opr64 96)) (va_ttrue ())))))))))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_AESNI_ctr32_6x_round9 (va_mods:va_mods_t) (alg:algorithm) (count:nat) (in_b:buffer128)
  (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32)
  (init1:quad32) (init2:quad32) (init3:quad32) (init4:quad32) (init5:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x_round9 alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1260 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qInlineIf va_mods (alg = AES_128) (qblock va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1261 column 21 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64
    rRcx) (160 - 128) Secret keys_b 10) (va_QEmpty (())))) (qblock va_mods (fun (va_s:va_state) ->
    va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1263 column 21 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64
    rRcx) (224 - 128) Secret keys_b 14) (va_QEmpty (()))))) (fun (va_s:va_state) va_g -> va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1266 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm 15)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1267 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mem128_lemma (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 0 Secret in_b
    (count `op_Multiply` 6 + 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1267 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 4) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 0 Secret)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1268 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1269 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mem128_lemma (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 16 Secret in_b
    (count `op_Multiply` 6 + 1)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1269 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 5) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 16 Secret)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1270 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1271 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mem128_lemma (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 32 Secret in_b
    (count `op_Multiply` 6 + 2)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1271 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 6) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 32 Secret)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1272 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1273 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mem128_lemma (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 48 Secret in_b
    (count `op_Multiply` 6 + 3)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1273 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 8) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 48 Secret)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1274 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1275 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mem128_lemma (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 64 Secret in_b
    (count `op_Multiply` 6 + 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1275 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 2) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 64 Secret)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1276 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 15)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1277 column 30 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mem128_lemma (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 80 Secret in_b
    (count `op_Multiply` 6 + 5)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1277 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 3) (va_op_xmm_xmm 3) (va_opr_code_Mem128
    (va_op_heaplet_mem_heaplet 6) (va_op_reg64_reg64 rRdi) 80 Secret)) (fun (va_s:va_state) _ ->
    va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1279 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_s.eval_rounds_reveal ()) (va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1280 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.commute_sub_bytes_shift_rows_forall ()) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1282 column 13 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AddLea64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRdi) (va_const_opr64 96))
    (va_QEmpty (())))))))))))))))))))))))))


val va_lemma_AESNI_ctr32_6x_round9 : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> count:nat
  -> in_b:buffer128 -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  init0:quad32 -> init1:quad32 -> init2:quad32 -> init3:quad32 -> init4:quad32 -> init5:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_AESNI_ctr32_6x_round9 alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rRdi va_s0) in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    va_get_reg64 rRdi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words round_keys keys_b
    (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm
    15 va_s0 == FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\
    va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds init0 round_keys (Vale.AES.AES_common_s.nr alg
    - 2) /\ va_get_xmm 10 va_s0 == Vale.AES.AES_s.eval_rounds init1 round_keys
    (Vale.AES.AES_common_s.nr alg - 2) /\ va_get_xmm 11 va_s0 == Vale.AES.AES_s.eval_rounds init2
    round_keys (Vale.AES.AES_common_s.nr alg - 2) /\ va_get_xmm 12 va_s0 ==
    Vale.AES.AES_s.eval_rounds init3 round_keys (Vale.AES.AES_common_s.nr alg - 2) /\ va_get_xmm 13
    va_s0 == Vale.AES.AES_s.eval_rounds init4 round_keys (Vale.AES.AES_common_s.nr alg - 2) /\
    va_get_xmm 14 va_s0 == Vale.AES.AES_s.eval_rounds init5 round_keys (Vale.AES.AES_common_s.nr
    alg - 2))))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds init0 round_keys (Vale.AES.AES_common_s.nr
    alg - 1) /\ va_get_xmm 10 va_sM == Vale.AES.AES_s.eval_rounds init1 round_keys
    (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds init2
    round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 12 va_sM ==
    Vale.AES.AES_s.eval_rounds init3 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 13
    va_sM == Vale.AES.AES_s.eval_rounds init4 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\
    va_get_xmm 14 va_sM == Vale.AES.AES_s.eval_rounds init5 round_keys (Vale.AES.AES_common_s.nr
    alg - 1) /\ (let rk = FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in
    va_get_xmm 4 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b (count
    `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM)) /\ va_get_xmm 5 va_sM ==
    Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 1)
    (va_get_mem_heaplet 6 va_sM)) /\ va_get_xmm 6 va_sM == Vale.Def.Types_s.quad32_xor rk
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM))
    /\ va_get_xmm 8 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM)) /\ va_get_xmm 2 va_sM ==
    Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 4)
    (va_get_mem_heaplet 6 va_sM)) /\ va_get_xmm 3 va_sM == Vale.Def.Types_s.quad32_xor rk
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM))
    /\ va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96)) /\ va_state_eq va_sM
    (va_update_flags va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM
    (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM
    (va_update_xmm 8 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM
    (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_reg64 rRdi va_sM (va_update_ok va_sM
    va_s0))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_AESNI_ctr32_6x_round9 va_b0 va_s0 alg count in_b key_words round_keys keys_b init0
  init1 init2 init3 init4 init5 =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm
    12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRdi; va_Mod_ok] in
  let va_qc = va_qcode_AESNI_ctr32_6x_round9 va_mods alg count in_b key_words round_keys keys_b
    init0 init1 init2 init3 init4 init5 in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_AESNI_ctr32_6x_round9 alg) va_qc va_s0
    (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 1191 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 1243 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.AES.AES_s.eval_rounds init0 round_keys (Vale.AES.AES_common_s.nr
    alg - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1244 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.AES.AES_s.eval_rounds init1 round_keys (Vale.AES.AES_common_s.nr
    alg - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1245 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds init2 round_keys (Vale.AES.AES_common_s.nr
    alg - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1246 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.AES.AES_s.eval_rounds init3 round_keys (Vale.AES.AES_common_s.nr
    alg - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1247 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.AES.AES_s.eval_rounds init4 round_keys (Vale.AES.AES_common_s.nr
    alg - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1248 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.AES.AES_s.eval_rounds init5 round_keys (Vale.AES.AES_common_s.nr
    alg - 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1250 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (let rk = FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1251 column 73 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 4 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1252 column 73 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 5 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1253 column 73 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 6 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1254 column 73 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 8 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1255 column 73 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1256 column 73 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 3 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1258 column 31 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRdi; va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_AESNI_ctr32_6x_round9 (alg:algorithm) (count:nat) (in_b:buffer128) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0))
  : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rRdi va_s0) in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0)
    Secret /\ va_get_reg64 rRdi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words round_keys
    keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\
    va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg -
    1) /\ va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds init0 round_keys
    (Vale.AES.AES_common_s.nr alg - 2) /\ va_get_xmm 10 va_s0 == Vale.AES.AES_s.eval_rounds init1
    round_keys (Vale.AES.AES_common_s.nr alg - 2) /\ va_get_xmm 11 va_s0 ==
    Vale.AES.AES_s.eval_rounds init2 round_keys (Vale.AES.AES_common_s.nr alg - 2) /\ va_get_xmm 12
    va_s0 == Vale.AES.AES_s.eval_rounds init3 round_keys (Vale.AES.AES_common_s.nr alg - 2) /\
    va_get_xmm 13 va_s0 == Vale.AES.AES_s.eval_rounds init4 round_keys (Vale.AES.AES_common_s.nr
    alg - 2) /\ va_get_xmm 14 va_s0 == Vale.AES.AES_s.eval_rounds init5 round_keys
    (Vale.AES.AES_common_s.nr alg - 2)) /\ (forall (va_x_rdi:nat64) (va_x_xmm2:quad32)
    (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32) (va_x_xmm8:quad32)
    (va_x_xmm9:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32)
    (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32) (va_x_efl:Vale.X64.Flags.t) . let
    va_sM = va_upd_flags va_x_efl (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm
    13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10
    (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5
    (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_reg64 rRdi
    va_x_rdi va_s0)))))))))))))) in va_get_ok va_sM /\ (va_get_xmm 9 va_sM ==
    Vale.AES.AES_s.eval_rounds init0 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 10
    va_sM == Vale.AES.AES_s.eval_rounds init1 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\
    va_get_xmm 11 va_sM == Vale.AES.AES_s.eval_rounds init2 round_keys (Vale.AES.AES_common_s.nr
    alg - 1) /\ va_get_xmm 12 va_sM == Vale.AES.AES_s.eval_rounds init3 round_keys
    (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 13 va_sM == Vale.AES.AES_s.eval_rounds init4
    round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 14 va_sM ==
    Vale.AES.AES_s.eval_rounds init5 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ (let rk =
    FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in va_get_xmm 4 va_sM ==
    Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 0)
    (va_get_mem_heaplet 6 va_sM)) /\ va_get_xmm 5 va_sM == Vale.Def.Types_s.quad32_xor rk
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM))
    /\ va_get_xmm 6 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM)) /\ va_get_xmm 8 va_sM ==
    Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 3)
    (va_get_mem_heaplet 6 va_sM)) /\ va_get_xmm 2 va_sM == Vale.Def.Types_s.quad32_xor rk
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM))
    /\ va_get_xmm 3 va_sM == Vale.Def.Types_s.quad32_xor rk (Vale.X64.Decls.buffer128_read in_b
    (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM)) /\ va_get_reg64 rRdi va_sM ==
    va_get_reg64 rRdi va_s0 + 96)) ==> va_k va_sM (())))


val va_wpProof_AESNI_ctr32_6x_round9 : alg:algorithm -> count:nat -> in_b:buffer128 ->
  key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> init0:quad32 ->
  init1:quad32 -> init2:quad32 -> init3:quad32 -> init4:quad32 -> init5:quad32 -> va_s0:va_state ->
  va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_AESNI_ctr32_6x_round9 alg count in_b key_words round_keys
    keys_b init0 init1 init2 init3 init4 init5 va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_AESNI_ctr32_6x_round9 alg)
    ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_reg64 rRdi]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_AESNI_ctr32_6x_round9 alg count in_b key_words round_keys keys_b init0 init1 init2
  init3 init4 init5 va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_AESNI_ctr32_6x_round9 (va_code_AESNI_ctr32_6x_round9 alg) va_s0 alg
    count in_b key_words round_keys keys_b init0 init1 init2 init3 init4 init5 in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM
    (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM
    (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM
    (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_reg64 rRdi
    va_sM (va_update_ok va_sM va_s0)))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12;
    va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRdi]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_AESNI_ctr32_6x_round9 (alg:algorithm) (count:nat) (in_b:buffer128) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) : (va_quickCode unit (va_code_AESNI_ctr32_6x_round9
  alg)) =
  (va_QProc (va_code_AESNI_ctr32_6x_round9 alg) ([va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRdi])
    (va_wp_AESNI_ctr32_6x_round9 alg count in_b key_words round_keys keys_b init0 init1 init2 init3
    init4 init5) (va_wpProof_AESNI_ctr32_6x_round9 alg count in_b key_words round_keys keys_b init0
    init1 init2 init3 init4 init5))
#pop-options
//--
//-- AESNI_ctr32_6x_final

val va_code_AESNI_ctr32_6x_final : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_AESNI_ctr32_6x_final alg =
  (va_Block (va_CCons (va_code_VAESNI_enc_last (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm
    4)) (va_CCons (va_code_VAESNI_enc_last (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 5))
    (va_CCons (va_code_VAESNI_enc_last (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 6))
    (va_CCons (va_code_VAESNI_enc_last (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 8))
    (va_CCons (va_code_VAESNI_enc_last (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2))
    (va_CCons (va_code_VAESNI_enc_last (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 3))
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 9) 0 Secret) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 10) 16 Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 11) 32 Secret)
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 12) 48 Secret) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 13) 64 Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 14) 80 Secret)
    (va_CCons (va_code_AddLea64 (va_op_dst_opr64_reg64 rRsi) (va_op_opr64_reg64 rRsi)
    (va_const_opr64 96)) (va_CNil ())))))))))))))))

val va_codegen_success_AESNI_ctr32_6x_final : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_AESNI_ctr32_6x_final alg =
  (va_pbool_and (va_codegen_success_VAESNI_enc_last (va_op_xmm_xmm 9) (va_op_xmm_xmm 9)
    (va_op_xmm_xmm 4)) (va_pbool_and (va_codegen_success_VAESNI_enc_last (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 5)) (va_pbool_and (va_codegen_success_VAESNI_enc_last
    (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 6)) (va_pbool_and
    (va_codegen_success_VAESNI_enc_last (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 8))
    (va_pbool_and (va_codegen_success_VAESNI_enc_last (va_op_xmm_xmm 13) (va_op_xmm_xmm 13)
    (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VAESNI_enc_last (va_op_xmm_xmm 14)
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 3)) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 9) 0 Secret)
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 10) 16 Secret) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 11) 32 Secret) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 12) 48 Secret)
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 13) 64 Secret) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 14) 80 Secret) (va_pbool_and (va_codegen_success_AddLea64 (va_op_dst_opr64_reg64
    rRsi) (va_op_opr64_reg64 rRsi) (va_const_opr64 96)) (va_ttrue ()))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_AESNI_ctr32_6x_final (va_mods:va_mods_t) (alg:algorithm) (count:nat) (out_b:buffer128)
  (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32)
  (init1:quad32) (init2:quad32) (init3:quad32) (init4:quad32) (init5:quad32) (ctr0:quad32)
  (ctr1:quad32) (ctr2:quad32) (ctr3:quad32) (ctr4:quad32) (ctr5:quad32) (plain0:quad32)
  (plain1:quad32) (plain2:quad32) (plain3:quad32) (plain4:quad32) (plain5:quad32) : (va_quickCode
  unit (va_code_AESNI_ctr32_6x_final alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1381 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc_last (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm 4)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1382 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc_last (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 5)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1383 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc_last (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 6)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1384 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc_last (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 8)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1385 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc_last (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1386 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VAESNI_enc_last (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 3)) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 1388 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 9) 0 Secret out_b (count `op_Multiply` 6 + 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1389 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 10) 16 Secret out_b (count `op_Multiply` 6 + 1)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1390 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 11) 32 Secret out_b (count `op_Multiply` 6 + 2)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1391 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 12) 48 Secret out_b (count `op_Multiply` 6 + 3)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1392 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 13) 64 Secret out_b (count `op_Multiply` 6 + 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1393 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 14) 80 Secret out_b (count `op_Multiply` 6 + 5)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1395 column 13 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AddLea64 (va_op_dst_opr64_reg64 rRsi) (va_op_opr64_reg64 rRsi) (va_const_opr64 96))
    (fun (va_s:va_state) _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1397 column 37 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Arch.TypesNative.lemma_quad32_xor_commutes_forall ()) (let
    (va_arg84:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = round_keys in let
    (va_arg83:Vale.Def.Types_s.quad32) = va_get_xmm 9 va_s in let
    (va_arg82:Vale.Def.Types_s.quad32) = va_get_xmm 9 va_old_s in let
    (va_arg81:Vale.Def.Types_s.quad32) = init0 in let (va_arg80:Vale.Def.Types_s.quad32) = plain0
    in let (va_arg79:Vale.Def.Types_s.quad32) = ctr0 in let
    (va_arg78:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1398 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.finish_cipher_opt va_arg78 va_arg79 va_arg80 va_arg81
    va_arg82 va_arg83 va_arg84) (let (va_arg77:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) =
    round_keys in let (va_arg76:Vale.Def.Types_s.quad32) = va_get_xmm 10 va_s in let
    (va_arg75:Vale.Def.Types_s.quad32) = va_get_xmm 10 va_old_s in let
    (va_arg74:Vale.Def.Types_s.quad32) = init1 in let (va_arg73:Vale.Def.Types_s.quad32) = plain1
    in let (va_arg72:Vale.Def.Types_s.quad32) = ctr1 in let
    (va_arg71:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1399 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.finish_cipher_opt va_arg71 va_arg72 va_arg73 va_arg74
    va_arg75 va_arg76 va_arg77) (let (va_arg70:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) =
    round_keys in let (va_arg69:Vale.Def.Types_s.quad32) = va_get_xmm 11 va_s in let
    (va_arg68:Vale.Def.Types_s.quad32) = va_get_xmm 11 va_old_s in let
    (va_arg67:Vale.Def.Types_s.quad32) = init2 in let (va_arg66:Vale.Def.Types_s.quad32) = plain2
    in let (va_arg65:Vale.Def.Types_s.quad32) = ctr2 in let
    (va_arg64:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1400 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.finish_cipher_opt va_arg64 va_arg65 va_arg66 va_arg67
    va_arg68 va_arg69 va_arg70) (let (va_arg63:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) =
    round_keys in let (va_arg62:Vale.Def.Types_s.quad32) = va_get_xmm 12 va_s in let
    (va_arg61:Vale.Def.Types_s.quad32) = va_get_xmm 12 va_old_s in let
    (va_arg60:Vale.Def.Types_s.quad32) = init3 in let (va_arg59:Vale.Def.Types_s.quad32) = plain3
    in let (va_arg58:Vale.Def.Types_s.quad32) = ctr3 in let
    (va_arg57:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1401 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.finish_cipher_opt va_arg57 va_arg58 va_arg59 va_arg60
    va_arg61 va_arg62 va_arg63) (let (va_arg56:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) =
    round_keys in let (va_arg55:Vale.Def.Types_s.quad32) = va_get_xmm 13 va_s in let
    (va_arg54:Vale.Def.Types_s.quad32) = va_get_xmm 13 va_old_s in let
    (va_arg53:Vale.Def.Types_s.quad32) = init4 in let (va_arg52:Vale.Def.Types_s.quad32) = plain4
    in let (va_arg51:Vale.Def.Types_s.quad32) = ctr4 in let
    (va_arg50:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1402 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.finish_cipher_opt va_arg50 va_arg51 va_arg52 va_arg53
    va_arg54 va_arg55 va_arg56) (let (va_arg49:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) =
    round_keys in let (va_arg48:Vale.Def.Types_s.quad32) = va_get_xmm 14 va_s in let
    (va_arg47:Vale.Def.Types_s.quad32) = va_get_xmm 14 va_old_s in let
    (va_arg46:Vale.Def.Types_s.quad32) = init5 in let (va_arg45:Vale.Def.Types_s.quad32) = plain5
    in let (va_arg44:Vale.Def.Types_s.quad32) = ctr5 in let
    (va_arg43:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1403 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.finish_cipher_opt va_arg43 va_arg44 va_arg45 va_arg46
    va_arg47 va_arg48 va_arg49) (va_QLemma va_range1
    "***** PRECONDITION NOT MET AT line 1404 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) -> Vale.AES.AES_s.is_aes_key_LE alg
    key) alg ctr0 key_words) (fun _ -> (fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) ->
    Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg input_LE
    (Vale.AES.AES_s.key_to_round_keys_LE alg key)) alg ctr0 key_words) (fun (_:unit) ->
    finish_aes_encrypt_le alg ctr0 key_words) (va_QLemma va_range1
    "***** PRECONDITION NOT MET AT line 1405 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) -> Vale.AES.AES_s.is_aes_key_LE alg
    key) alg ctr1 key_words) (fun _ -> (fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) ->
    Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg input_LE
    (Vale.AES.AES_s.key_to_round_keys_LE alg key)) alg ctr1 key_words) (fun (_:unit) ->
    finish_aes_encrypt_le alg ctr1 key_words) (va_QLemma va_range1
    "***** PRECONDITION NOT MET AT line 1406 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) -> Vale.AES.AES_s.is_aes_key_LE alg
    key) alg ctr2 key_words) (fun _ -> (fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) ->
    Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg input_LE
    (Vale.AES.AES_s.key_to_round_keys_LE alg key)) alg ctr2 key_words) (fun (_:unit) ->
    finish_aes_encrypt_le alg ctr2 key_words) (va_QLemma va_range1
    "***** PRECONDITION NOT MET AT line 1407 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) -> Vale.AES.AES_s.is_aes_key_LE alg
    key) alg ctr3 key_words) (fun _ -> (fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) ->
    Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg input_LE
    (Vale.AES.AES_s.key_to_round_keys_LE alg key)) alg ctr3 key_words) (fun (_:unit) ->
    finish_aes_encrypt_le alg ctr3 key_words) (va_QLemma va_range1
    "***** PRECONDITION NOT MET AT line 1408 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) -> Vale.AES.AES_s.is_aes_key_LE alg
    key) alg ctr4 key_words) (fun _ -> (fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) ->
    Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg input_LE
    (Vale.AES.AES_s.key_to_round_keys_LE alg key)) alg ctr4 key_words) (fun (_:unit) ->
    finish_aes_encrypt_le alg ctr4 key_words) (va_QLemma va_range1
    "***** PRECONDITION NOT MET AT line 1409 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) -> Vale.AES.AES_s.is_aes_key_LE alg
    key) alg ctr5 key_words) (fun _ -> (fun (alg:algorithm) (input_LE:quad32) (key:(seq nat32)) ->
    Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg input_LE
    (Vale.AES.AES_s.key_to_round_keys_LE alg key)) alg ctr5 key_words) (fun (_:unit) ->
    finish_aes_encrypt_le alg ctr5 key_words) (va_QEmpty (())))))))))))))))))))))))))))))


val va_lemma_AESNI_ctr32_6x_final : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> count:nat
  -> out_b:buffer128 -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  init0:quad32 -> init1:quad32 -> init2:quad32 -> init3:quad32 -> init4:quad32 -> init5:quad32 ->
  ctr0:quad32 -> ctr1:quad32 -> ctr2:quad32 -> ctr3:quad32 -> ctr4:quad32 -> ctr5:quad32 ->
  plain0:quad32 -> plain1:quad32 -> plain2:quad32 -> plain3:quad32 -> plain4:quad32 -> plain5:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_AESNI_ctr32_6x_final alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rRsi va_s0) out_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words round_keys keys_b
    (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ init0 ==
    Vale.Def.Types_s.quad32_xor ctr0 (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)
    /\ init1 == Vale.Def.Types_s.quad32_xor ctr1 (FStar.Seq.Base.index #Vale.Def.Types_s.quad32
    round_keys 0) /\ init2 == Vale.Def.Types_s.quad32_xor ctr2 (FStar.Seq.Base.index
    #Vale.Def.Types_s.quad32 round_keys 0) /\ init3 == Vale.Def.Types_s.quad32_xor ctr3
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) /\ init4 ==
    Vale.Def.Types_s.quad32_xor ctr4 (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)
    /\ init5 == Vale.Def.Types_s.quad32_xor ctr5 (FStar.Seq.Base.index #Vale.Def.Types_s.quad32
    round_keys 0) /\ va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds init0 round_keys
    (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 10 va_s0 == Vale.AES.AES_s.eval_rounds init1
    round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 11 va_s0 ==
    Vale.AES.AES_s.eval_rounds init2 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 12
    va_s0 == Vale.AES.AES_s.eval_rounds init3 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\
    va_get_xmm 13 va_s0 == Vale.AES.AES_s.eval_rounds init4 round_keys (Vale.AES.AES_common_s.nr
    alg - 1) /\ va_get_xmm 14 va_s0 == Vale.AES.AES_s.eval_rounds init5 round_keys
    (Vale.AES.AES_common_s.nr alg - 1) /\ (let rk = FStar.Seq.Base.index #quad32 round_keys
    (Vale.AES.AES_common_s.nr alg) in va_get_xmm 4 va_s0 == Vale.Def.Types_s.quad32_xor rk plain0
    /\ va_get_xmm 5 va_s0 == Vale.Def.Types_s.quad32_xor rk plain1 /\ va_get_xmm 6 va_s0 ==
    Vale.Def.Types_s.quad32_xor rk plain2 /\ va_get_xmm 8 va_s0 == Vale.Def.Types_s.quad32_xor rk
    plain3 /\ va_get_xmm 2 va_s0 == Vale.Def.Types_s.quad32_xor rk plain4 /\ va_get_xmm 3 va_s0 ==
    Vale.Def.Types_s.quad32_xor rk plain5))))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count) /\
    va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 9 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 10 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 11 va_sM /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 12 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 13 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 14 va_sM /\ va_get_xmm 9 va_sM ==
    Vale.Def.Types_s.quad32_xor plain0 (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr0) /\
    va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor plain1 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr1) /\ va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor plain2
    (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr2) /\ va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.quad32_xor plain3 (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr3) /\
    va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor plain4 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr4) /\ va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor plain5
    (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr5)) /\ va_state_eq va_sM (va_update_flags va_sM
    (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm
    13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm
    9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4
    va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_reg64 rRsi va_sM (va_update_ok
    va_sM (va_update_mem va_sM va_s0))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_AESNI_ctr32_6x_final va_b0 va_s0 alg count out_b key_words round_keys keys_b init0
  init1 init2 init3 init4 init5 ctr0 ctr1 ctr2 ctr3 ctr4 ctr5 plain0 plain1 plain2 plain3 plain4
  plain5 =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRsi;
    va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_AESNI_ctr32_6x_final va_mods alg count out_b key_words round_keys keys_b
    init0 init1 init2 init3 init4 init5 ctr0 ctr1 ctr2 ctr3 ctr4 ctr5 plain0 plain1 plain2 plain3
    plain4 plain5 in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_AESNI_ctr32_6x_final alg) va_qc va_s0
    (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 1285 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 1362 column 84 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1363 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1364 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1366 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 9 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1367 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 10 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1368 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 11 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1369 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 12 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1370 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 13 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1371 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 14 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1373 column 75 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor plain0 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1374 column 75 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor plain1 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1375 column 75 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor plain2 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr2)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1376 column 75 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.Def.Types_s.quad32_xor plain3 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr3)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1377 column 75 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor plain4 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr4)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1378 column 75 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor plain5 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr5)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm
    13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRsi; va_Mod_ok;
    va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_AESNI_ctr32_6x_final (alg:algorithm) (count:nat) (out_b:buffer128) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) (ctr0:quad32) (ctr1:quad32) (ctr2:quad32)
  (ctr3:quad32) (ctr4:quad32) (ctr5:quad32) (plain0:quad32) (plain1:quad32) (plain2:quad32)
  (plain3:quad32) (plain4:quad32) (plain5:quad32) (va_s0:va_state) (va_k:(va_state -> unit ->
  Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rRsi va_s0) out_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0)
    Secret /\ va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words round_keys
    keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\
    init0 == Vale.Def.Types_s.quad32_xor ctr0 (FStar.Seq.Base.index #Vale.Def.Types_s.quad32
    round_keys 0) /\ init1 == Vale.Def.Types_s.quad32_xor ctr1 (FStar.Seq.Base.index
    #Vale.Def.Types_s.quad32 round_keys 0) /\ init2 == Vale.Def.Types_s.quad32_xor ctr2
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) /\ init3 ==
    Vale.Def.Types_s.quad32_xor ctr3 (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)
    /\ init4 == Vale.Def.Types_s.quad32_xor ctr4 (FStar.Seq.Base.index #Vale.Def.Types_s.quad32
    round_keys 0) /\ init5 == Vale.Def.Types_s.quad32_xor ctr5 (FStar.Seq.Base.index
    #Vale.Def.Types_s.quad32 round_keys 0) /\ va_get_xmm 9 va_s0 == Vale.AES.AES_s.eval_rounds
    init0 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 10 va_s0 ==
    Vale.AES.AES_s.eval_rounds init1 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 11
    va_s0 == Vale.AES.AES_s.eval_rounds init2 round_keys (Vale.AES.AES_common_s.nr alg - 1) /\
    va_get_xmm 12 va_s0 == Vale.AES.AES_s.eval_rounds init3 round_keys (Vale.AES.AES_common_s.nr
    alg - 1) /\ va_get_xmm 13 va_s0 == Vale.AES.AES_s.eval_rounds init4 round_keys
    (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_xmm 14 va_s0 == Vale.AES.AES_s.eval_rounds init5
    round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ (let rk = FStar.Seq.Base.index #quad32
    round_keys (Vale.AES.AES_common_s.nr alg) in va_get_xmm 4 va_s0 == Vale.Def.Types_s.quad32_xor
    rk plain0 /\ va_get_xmm 5 va_s0 == Vale.Def.Types_s.quad32_xor rk plain1 /\ va_get_xmm 6 va_s0
    == Vale.Def.Types_s.quad32_xor rk plain2 /\ va_get_xmm 8 va_s0 == Vale.Def.Types_s.quad32_xor
    rk plain3 /\ va_get_xmm 2 va_s0 == Vale.Def.Types_s.quad32_xor rk plain4 /\ va_get_xmm 3 va_s0
    == Vale.Def.Types_s.quad32_xor rk plain5)) /\ (forall (va_x_mem:vale_heap) (va_x_rsi:nat64)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm8:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32)
    (va_x_heap6:vale_heap) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl
    (va_upd_mem_heaplet 6 va_x_heap6 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14
    (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10
    va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm
    5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2
    (va_upd_reg64 rRsi va_x_rsi (va_upd_mem va_x_mem va_s0)))))))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count) /\
    va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 9 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 10 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 11 va_sM /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 12 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 13 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 14 va_sM /\ va_get_xmm 9 va_sM ==
    Vale.Def.Types_s.quad32_xor plain0 (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr0) /\
    va_get_xmm 10 va_sM == Vale.Def.Types_s.quad32_xor plain1 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr1) /\ va_get_xmm 11 va_sM == Vale.Def.Types_s.quad32_xor plain2
    (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr2) /\ va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.quad32_xor plain3 (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr3) /\
    va_get_xmm 13 va_sM == Vale.Def.Types_s.quad32_xor plain4 (Vale.AES.AES_s.aes_encrypt_LE alg
    key_words ctr4) /\ va_get_xmm 14 va_sM == Vale.Def.Types_s.quad32_xor plain5
    (Vale.AES.AES_s.aes_encrypt_LE alg key_words ctr5)) ==> va_k va_sM (())))


val va_wpProof_AESNI_ctr32_6x_final : alg:algorithm -> count:nat -> out_b:buffer128 ->
  key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> init0:quad32 ->
  init1:quad32 -> init2:quad32 -> init3:quad32 -> init4:quad32 -> init5:quad32 -> ctr0:quad32 ->
  ctr1:quad32 -> ctr2:quad32 -> ctr3:quad32 -> ctr4:quad32 -> ctr5:quad32 -> plain0:quad32 ->
  plain1:quad32 -> plain2:quad32 -> plain3:quad32 -> plain4:quad32 -> plain5:quad32 ->
  va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_AESNI_ctr32_6x_final alg count out_b key_words round_keys
    keys_b init0 init1 init2 init3 init4 init5 ctr0 ctr1 ctr2 ctr3 ctr4 ctr5 plain0 plain1 plain2
    plain3 plain4 plain5 va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_AESNI_ctr32_6x_final alg)
    ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm
    12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRsi; va_Mod_mem]) va_s0 va_k ((va_sM,
    va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_AESNI_ctr32_6x_final alg count out_b key_words round_keys keys_b init0 init1 init2
  init3 init4 init5 ctr0 ctr1 ctr2 ctr3 ctr4 ctr5 plain0 plain1 plain2 plain3 plain4 plain5 va_s0
  va_k =
  let (va_sM, va_f0) = va_lemma_AESNI_ctr32_6x_final (va_code_AESNI_ctr32_6x_final alg) va_s0 alg
    count out_b key_words round_keys keys_b init0 init1 init2 init3 init4 init5 ctr0 ctr1 ctr2 ctr3
    ctr4 ctr5 plain0 plain1 plain2 plain3 plain4 plain5 in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 6 va_sM (va_update_xmm 15
    va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11
    va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 6
    va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2
    va_sM (va_update_reg64 rRsi va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0)))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm
    13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_reg64 rRsi; va_Mod_mem]) va_sM
    va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_AESNI_ctr32_6x_final (alg:algorithm) (count:nat) (out_b:buffer128) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (init0:quad32) (init1:quad32) (init2:quad32)
  (init3:quad32) (init4:quad32) (init5:quad32) (ctr0:quad32) (ctr1:quad32) (ctr2:quad32)
  (ctr3:quad32) (ctr4:quad32) (ctr5:quad32) (plain0:quad32) (plain1:quad32) (plain2:quad32)
  (plain3:quad32) (plain4:quad32) (plain5:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x_final alg)) =
  (va_QProc (va_code_AESNI_ctr32_6x_final alg) ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2;
    va_Mod_reg64 rRsi; va_Mod_mem]) (va_wp_AESNI_ctr32_6x_final alg count out_b key_words
    round_keys keys_b init0 init1 init2 init3 init4 init5 ctr0 ctr1 ctr2 ctr3 ctr4 ctr5 plain0
    plain1 plain2 plain3 plain4 plain5) (va_wpProof_AESNI_ctr32_6x_final alg count out_b key_words
    round_keys keys_b init0 init1 init2 init3 init4 init5 ctr0 ctr1 ctr2 ctr3 ctr4 ctr5 plain0
    plain1 plain2 plain3 plain4 plain5))
//--
//-- AESNI_ctr32_6x

val va_code_AESNI_ctr32_6x : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_AESNI_ctr32_6x alg =
  (va_Block (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block
    (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons
    (va_Block (va_CNil ())) (va_CCons (va_code_AESNI_ctr32_6x_preamble alg) (va_CCons (if (alg =
    AES_128) then va_Block (va_CCons (va_code_AESNI_ctr32_6x_loop_recursive alg 7) (va_CNil ()))
    else va_Block (va_CCons (va_code_AESNI_ctr32_6x_loop_recursive alg 11) (va_CNil ()))) (va_CCons
    (va_code_AESNI_ctr32_6x_round9 alg) (va_CCons (va_code_AESNI_ctr32_6x_final alg) (va_CCons
    (va_Block (va_CNil ())) (va_CNil ())))))))))))))

val va_codegen_success_AESNI_ctr32_6x : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_AESNI_ctr32_6x alg =
  (va_pbool_and (va_codegen_success_AESNI_ctr32_6x_preamble alg) (va_pbool_and (if (alg = AES_128)
    then va_pbool_and (va_codegen_success_AESNI_ctr32_6x_loop_recursive alg 7) (va_ttrue ()) else
    va_pbool_and (va_codegen_success_AESNI_ctr32_6x_loop_recursive alg 11) (va_ttrue ()))
    (va_pbool_and (va_codegen_success_AESNI_ctr32_6x_round9 alg) (va_pbool_and
    (va_codegen_success_AESNI_ctr32_6x_final alg) (va_ttrue ())))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_AESNI_ctr32_6x (va_mods:va_mods_t) (alg:algorithm) (count:nat) (in_b:buffer128)
  (out_b:buffer128) (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq quad32))
  (keys_b:buffer128) (ctr_BE:quad32) (ctr_BE_orig:quad32) : (va_quickCode unit
  (va_code_AESNI_ctr32_6x alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1492 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_336 (s_337:(FStar.Seq.Base.seq a_336)) (i_338:Prims.nat) -> let (i_312:Prims.nat) =
    i_338 in Prims.b2t (Prims.op_LessThan i_312 (FStar.Seq.Base.length #a_336 s_337)))
    Vale.Def.Types_s.quad32 round_keys 0) (fun _ -> let (init0:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 0)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1493 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_336 (s_337:(FStar.Seq.Base.seq a_336)) (i_338:Prims.nat) -> let (i_312:Prims.nat) =
    i_338 in Prims.b2t (Prims.op_LessThan i_312 (FStar.Seq.Base.length #a_336 s_337)))
    Vale.Def.Types_s.quad32 round_keys 0) (fun _ -> let (init1:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 1)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1494 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_336 (s_337:(FStar.Seq.Base.seq a_336)) (i_338:Prims.nat) -> let (i_312:Prims.nat) =
    i_338 in Prims.b2t (Prims.op_LessThan i_312 (FStar.Seq.Base.length #a_336 s_337)))
    Vale.Def.Types_s.quad32 round_keys 0) (fun _ -> let (init2:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 2)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1495 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_336 (s_337:(FStar.Seq.Base.seq a_336)) (i_338:Prims.nat) -> let (i_312:Prims.nat) =
    i_338 in Prims.b2t (Prims.op_LessThan i_312 (FStar.Seq.Base.length #a_336 s_337)))
    Vale.Def.Types_s.quad32 round_keys 0) (fun _ -> let (init3:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 3)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1496 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_336 (s_337:(FStar.Seq.Base.seq a_336)) (i_338:Prims.nat) -> let (i_312:Prims.nat) =
    i_338 in Prims.b2t (Prims.op_LessThan i_312 (FStar.Seq.Base.length #a_336 s_337)))
    Vale.Def.Types_s.quad32 round_keys 0) (fun _ -> let (init4:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 4)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1497 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    ((fun a_336 (s_337:(FStar.Seq.Base.seq a_336)) (i_338:Prims.nat) -> let (i_312:Prims.nat) =
    i_338 in Prims.b2t (Prims.op_LessThan i_312 (FStar.Seq.Base.length #a_336 s_337)))
    Vale.Def.Types_s.quad32 round_keys 0) (fun _ -> let (init5:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_BE 5)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0) in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1499 column 28 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AESNI_ctr32_6x_preamble alg key_words round_keys keys_b ctr_BE) (fun (va_s:va_state)
    _ -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1500 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qInlineIf va_mods (alg = AES_128) (qblock va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1501 column 36 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AESNI_ctr32_6x_loop_recursive alg 7 key_words round_keys keys_b init0 init1 init2
    init3 init4 init5) (va_QEmpty (())))) (qblock va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1503 column 36 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AESNI_ctr32_6x_loop_recursive alg 11 key_words round_keys keys_b init0 init1 init2
    init3 init4 init5) (va_QEmpty (()))))) (fun (va_s:va_state) va_g -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1505 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AESNI_ctr32_6x_round9 alg count in_b key_words round_keys keys_b init0 init1 init2
    init3 init4 init5) (fun (va_s:va_state) _ -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1506 column 25 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AESNI_ctr32_6x_final alg count out_b key_words round_keys keys_b init0 init1 init2
    init3 init4 init5 (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0))
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 1))
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 2))
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 3))
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 4))
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 5))
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_s))
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_s))
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_s))
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_s))
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_s))
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_s)))
    (fun (va_s:va_state) _ -> let (plain:(FStar.Seq.Base.seq Vale.X64.Decls.quad32)) =
    Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in_b in let (cipher:(FStar.Seq.Base.seq
    Vale.X64.Decls.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b in let
    (bound:(va_int_at_least 0)) = count `op_Multiply` 6 in va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1523 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (bound >= 0 /\ bound <= 4294967295) (fun _ -> let (va_arg61:Vale.Def.Types_s.quad32) =
    ctr_BE_orig in let (va_arg60:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key_words in let
    (va_arg59:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = cipher in let
    (va_arg58:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old_s) out_b in let (va_arg57:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = plain_quads in let (va_arg56:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = plain_quads in let (va_arg55:Vale.Def.Types_s.nat32) = bound in let
    (va_arg54:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1523 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_opaque_ignores_postfix va_arg54 va_arg55 va_arg56
    va_arg57 va_arg58 va_arg59 va_arg60 va_arg61) (let (va_arg53:Vale.Def.Types_s.quad32) =
    ctr_BE_orig in let (va_arg52:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key_words in let
    (va_arg51:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = cipher in let
    (va_arg50:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = plain_quads in let
    (va_arg49:Prims.nat) = bound in let (va_arg48:Vale.AES.AES_common_s.algorithm) = alg in
    va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1525 column 25 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_extend6 va_arg48 va_arg49 va_arg50 va_arg51
    va_arg52 va_arg53) (va_QEmpty (()))))))))))))))))


val va_lemma_AESNI_ctr32_6x : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> count:nat ->
  in_b:buffer128 -> out_b:buffer128 -> plain_quads:(seq quad32) -> key_words:(seq nat32) ->
  round_keys:(seq quad32) -> keys_b:buffer128 -> ctr_BE:quad32 -> ctr_BE_orig:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_AESNI_ctr32_6x alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rRdi va_s0) in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0)
    out_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) in_b) (count `op_Multiply` 6) (count `op_Multiply` 6 + 6) /\ va_get_reg64 rRdi va_s0 +
    96 < pow2_64 /\ va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words
    round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout
    va_s0) /\ va_get_reg64 rRcx va_s0 - 96 >= 0 /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\ count `op_Multiply` 6 + 6 <
    pow2_32 /\ ctr_BE == Vale.AES.GCTR.inc32lite ctr_BE_orig (count `op_Multiply` 6) /\ va_get_xmm
    1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\
    va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256
    /\ Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) out_b) key_words ctr_BE_orig)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count) /\
    va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96 /\ va_get_reg64 rRsi va_sM ==
    va_get_reg64 rRsi va_s0 + 96 /\ va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 6) /\ (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM
    < 256) /\ va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0
    (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 9 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 10 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 11 va_sM /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 12 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 13 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 14 va_sM /\ Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (count + 1)) plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b)
    key_words ctr_BE_orig) /\ va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 6
    va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12
    va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8
    va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3
    va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_reg64 rR12 va_sM
    (va_update_reg64 rR11 va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rRsi va_sM
    (va_update_reg64 rRdi va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0)))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_AESNI_ctr32_6x va_b0 va_s0 alg count in_b out_b plain_quads key_words round_keys
  keys_b ctr_BE ctr_BE_orig =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi;
    va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_AESNI_ctr32_6x va_mods alg count in_b out_b plain_quads key_words round_keys
    keys_b ctr_BE ctr_BE_orig in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_AESNI_ctr32_6x alg) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 1412 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 1473 column 84 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1474 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1475 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1476 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1478 column 57 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
    6)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1479 column 27 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1480 column 50 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite
    ctr_BE 6) `op_Modulus` 256) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1482 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 9 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1483 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 10 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1484 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 11 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1485 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 12 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1486 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 13 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1487 column 60 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 14 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1490 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` (count + 1)) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out_b) key_words ctr_BE_orig))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm
    13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR12;
    va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_ok;
    va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_AESNI_ctr32_6x (alg:algorithm) (count:nat) (in_b:buffer128) (out_b:buffer128)
  (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (ctr_BE:quad32) (ctr_BE_orig:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rRdi va_s0) in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi
    va_s0) out_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0) Secret /\
    Vale.AES.GCTR.partial_seq_agreement plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s0) in_b) (count `op_Multiply` 6) (count `op_Multiply` 6 + 6) /\ va_get_reg64 rRdi va_s0 +
    96 < pow2_64 /\ va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words
    round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout
    va_s0) /\ va_get_reg64 rRcx va_s0 - 96 >= 0 /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\ count `op_Multiply` 6 + 6 <
    pow2_32 /\ ctr_BE == Vale.AES.GCTR.inc32lite ctr_BE_orig (count `op_Multiply` 6) /\ va_get_xmm
    1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\
    va_get_reg64 rRbx va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256
    /\ Vale.AES.GCTR.gctr_partial alg (6 `op_Multiply` count) plain_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) out_b) key_words ctr_BE_orig) /\ (forall (va_x_mem:vale_heap)
    (va_x_rdi:nat64) (va_x_rsi:nat64) (va_x_rbx:nat64) (va_x_r11:nat64) (va_x_r12:nat64)
    (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32)
    (va_x_xmm6:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_xmm15:quad32) (va_x_heap6:vale_heap) (va_x_efl:Vale.X64.Flags.t) . let va_sM =
    va_upd_flags va_x_efl (va_upd_mem_heaplet 6 va_x_heap6 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14
    va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11
    (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 6
    va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2
    va_x_xmm2 (va_upd_xmm 1 va_x_xmm1 (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11
    (va_upd_reg64 rRbx va_x_rbx (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdi va_x_rdi (va_upd_mem
    va_x_mem va_s0))))))))))))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count) /\
    va_get_reg64 rRdi va_sM == va_get_reg64 rRdi va_s0 + 96 /\ va_get_reg64 rRsi va_sM ==
    va_get_reg64 rRsi va_s0 + 96 /\ va_get_xmm 1 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 6) /\ (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM
    < 256) /\ va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0
    (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 9 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 10 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 11 va_sM /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 12 va_sM /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 13 va_sM /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 14 va_sM /\ Vale.AES.GCTR.gctr_partial alg (6
    `op_Multiply` (count + 1)) plain_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b)
    key_words ctr_BE_orig) ==> va_k va_sM (())))


val va_wpProof_AESNI_ctr32_6x : alg:algorithm -> count:nat -> in_b:buffer128 -> out_b:buffer128 ->
  plain_quads:(seq quad32) -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128
  -> ctr_BE:quad32 -> ctr_BE_orig:quad32 -> va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_AESNI_ctr32_6x alg count in_b out_b plain_quads key_words
    round_keys keys_b ctr_BE ctr_BE_orig va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_AESNI_ctr32_6x alg) ([va_Mod_flags;
    va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4;
    va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64
    rRbx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_AESNI_ctr32_6x alg count in_b out_b plain_quads key_words round_keys keys_b ctr_BE
  ctr_BE_orig va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_AESNI_ctr32_6x (va_code_AESNI_ctr32_6x alg) va_s0 alg count in_b
    out_b plain_quads key_words round_keys keys_b ctr_BE ctr_BE_orig in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 6 va_sM (va_update_xmm 15
    va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11
    va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 6
    va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2
    va_sM (va_update_xmm 1 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRbx va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm
    13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_reg64 rR12;
    va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem]) va_sM
    va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_AESNI_ctr32_6x (alg:algorithm) (count:nat) (in_b:buffer128) (out_b:buffer128)
  (plain_quads:(seq quad32)) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (ctr_BE:quad32) (ctr_BE_orig:quad32) : (va_quickCode unit (va_code_AESNI_ctr32_6x alg)) =
  (va_QProc (va_code_AESNI_ctr32_6x alg) ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 8; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm
    1; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_mem]) (va_wp_AESNI_ctr32_6x alg count in_b out_b plain_quads key_words round_keys
    keys_b ctr_BE ctr_BE_orig) (va_wpProof_AESNI_ctr32_6x alg count in_b out_b plain_quads
    key_words round_keys keys_b ctr_BE ctr_BE_orig))
//--
//-- Encrypt_save_and_shuffle_output

val va_code_Encrypt_save_and_shuffle_output : va_dummy:unit -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Encrypt_save_and_shuffle_output () =
  (va_Block (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64
    rRsi) (va_op_xmm_xmm 9) (0 - 96) Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 9)
    (va_op_xmm_xmm 9) (va_op_xmm_xmm 0)) (va_CCons (va_code_VPxor (va_op_xmm_xmm 1) (va_op_xmm_xmm
    1) (va_op_opr128_xmm 7)) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 10) (0 - 80) Secret) (va_CCons (va_code_VPshufb
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 11) (0 - 64) Secret)
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 12) (0 - 48) Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 12)
    (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 13) (0 - 32) Secret)
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 14) (0 - 16) Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 14)
    (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_CNil ())))))))))))))))

val va_codegen_success_Encrypt_save_and_shuffle_output : va_dummy:unit -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Encrypt_save_and_shuffle_output () =
  (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 9) (0 - 96) Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_opr128_xmm
    7)) (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 10) (0 - 80) Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 11) (0 - 64) Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 12) (0 - 48) Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 13) (0 - 32) Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_reg_opr64_reg64 rRsi) (va_op_xmm_xmm 14) (0 - 16) Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_ttrue
    ()))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Encrypt_save_and_shuffle_output (va_mods:va_mods_t) (count:nat) (out_b:buffer128) :
  (va_quickCode unit (va_code_Encrypt_save_and_shuffle_output ())) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1573 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 9) (0 - 96) Secret out_b (count `op_Multiply` 6 + 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1574 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 9) (va_op_xmm_xmm 9) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1575 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_opr128_xmm 7)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1576 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 10) (0 - 80) Secret out_b (count `op_Multiply` 6 + 1)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1577 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 10) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1578 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 11) (0 - 64) Secret out_b (count `op_Multiply` 6 + 2)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1579 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1580 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 12) (0 - 48) Secret out_b (count `op_Multiply` 6 + 3)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1581 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 12) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1582 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 13) (0 - 32) Secret out_b (count `op_Multiply` 6 + 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1583 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 13) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1584 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_reg_opr64_reg64 rRsi)
    (va_op_xmm_xmm 14) (0 - 16) Secret out_b (count `op_Multiply` 6 + 5)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1585 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 14) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_QEmpty
    (()))))))))))))))))


val va_lemma_Encrypt_save_and_shuffle_output : va_b0:va_code -> va_s0:va_state -> count:nat ->
  out_b:buffer128
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Encrypt_save_and_shuffle_output ()) va_s0 /\ va_get_ok
    va_s0 /\ (avx_enabled /\ sse_enabled /\ Vale.X64.Decls.validDstAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0 - 96) out_b (count `op_Multiply` 6) 6
    (va_get_mem_layout va_s0) Secret /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count) /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 9 va_s0 /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 10 va_s0 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 11 va_s0 /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 12 va_s0 /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 13 va_s0 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 14 va_s0 /\ va_get_xmm 1
    va_sM == Vale.Def.Types_s.quad32_xor (va_get_xmm 1 va_s0) (va_get_xmm 7 va_sM) /\ va_get_xmm 9
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 9 va_s0) /\ va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 10 va_s0) /\ va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 11 va_s0) /\ va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 12 va_s0) /\ va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 13 va_s0) /\ va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 14 va_s0)) /\ va_state_eq va_sM
    (va_update_mem_heaplet 6 va_sM (va_update_flags va_sM (va_update_xmm 14 va_sM (va_update_xmm 13
    va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9
    va_sM (va_update_xmm 1 va_sM (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))
[@"opaque_to_smt"]
let va_lemma_Encrypt_save_and_shuffle_output va_b0 va_s0 count out_b =
  let (va_mods:va_mods_t) = [va_Mod_mem_heaplet 6; va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 1; va_Mod_ok; va_Mod_mem]
    in
  let va_qc = va_qcode_Encrypt_save_and_shuffle_output va_mods count out_b in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Encrypt_save_and_shuffle_output ())
    va_qc va_s0 (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 1528 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 1554 column 84 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1555 column 96 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1557 column 65 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 9 va_s0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1558 column 65 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 10 va_s0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1559 column 65 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 11 va_s0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1560 column 65 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 12 va_s0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1561 column 65 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 13 va_s0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1562 column 65 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM)
    == va_get_xmm 14 va_s0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1564 column 38 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 1 va_sM == Vale.Def.Types_s.quad32_xor (va_get_xmm 1 va_s0) (va_get_xmm 7 va_sM))
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1565 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 9 va_s0)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1566 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 10 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 10 va_s0)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1567 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 11 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 11 va_s0)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1568 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 12 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 12 va_s0)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1569 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 13 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 13 va_s0)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 1570 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 14 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 14 va_s0)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_mem_heaplet 6; va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm
    12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 1; va_Mod_ok; va_Mod_mem]) va_sM
    va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Encrypt_save_and_shuffle_output (count:nat) (out_b:buffer128) (va_s0:va_state)
  (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (avx_enabled /\ sse_enabled /\ Vale.X64.Decls.validDstAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0 - 96) out_b (count `op_Multiply` 6) 6
    (va_get_mem_layout va_s0) Secret /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051) /\ (forall (va_x_mem:vale_heap)
    (va_x_xmm1:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_efl:Vale.X64.Flags.t)
    (va_x_heap6:vale_heap) . let va_sM = va_upd_mem_heaplet 6 va_x_heap6 (va_upd_flags va_x_efl
    (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11
    va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 1 va_x_xmm1
    (va_upd_mem va_x_mem va_s0))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) out_b) 0 (6 `op_Multiply` count) /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 9 va_s0 /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 1)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 10 va_s0 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 11 va_s0 /\
    Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_sM) ==
    va_get_xmm 12 va_s0 /\ Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + 4)
    (va_get_mem_heaplet 6 va_sM) == va_get_xmm 13 va_s0 /\ Vale.X64.Decls.buffer128_read out_b
    (count `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_sM) == va_get_xmm 14 va_s0 /\ va_get_xmm 1
    va_sM == Vale.Def.Types_s.quad32_xor (va_get_xmm 1 va_s0) (va_get_xmm 7 va_sM) /\ va_get_xmm 9
    va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 9 va_s0) /\ va_get_xmm 10 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 10 va_s0) /\ va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 11 va_s0) /\ va_get_xmm 12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 12 va_s0) /\ va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 13 va_s0) /\ va_get_xmm 14 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 14 va_s0)) ==> va_k va_sM (())))


val va_wpProof_Encrypt_save_and_shuffle_output : count:nat -> out_b:buffer128 -> va_s0:va_state ->
  va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Encrypt_save_and_shuffle_output count out_b va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Encrypt_save_and_shuffle_output ())
    ([va_Mod_mem_heaplet 6; va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 1; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Encrypt_save_and_shuffle_output count out_b va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Encrypt_save_and_shuffle_output
    (va_code_Encrypt_save_and_shuffle_output ()) va_s0 count out_b in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_mem_heaplet 6 va_sM (va_update_flags va_sM (va_update_xmm 14
    va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10
    va_sM (va_update_xmm 9 va_sM (va_update_xmm 1 va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0))))))))))));
  va_lemma_norm_mods ([va_Mod_mem_heaplet 6; va_Mod_flags; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm
    12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 1; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Encrypt_save_and_shuffle_output (count:nat) (out_b:buffer128) : (va_quickCode unit
  (va_code_Encrypt_save_and_shuffle_output ())) =
  (va_QProc (va_code_Encrypt_save_and_shuffle_output ()) ([va_Mod_mem_heaplet 6; va_Mod_flags;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 1; va_Mod_mem]) (va_wp_Encrypt_save_and_shuffle_output count out_b)
    (va_wpProof_Encrypt_save_and_shuffle_output count out_b))
//--
//-- UpdateScratch

val va_code_UpdateScratch : va_dummy:unit -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_UpdateScratch () =
  (va_Block (va_CCons (va_code_ZeroXmm (va_op_xmm_xmm 4)) (va_CCons (va_code_Mov128 (va_op_xmm_xmm
    7) (va_op_xmm_xmm 14)) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 4) 16 Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 13) 48 Secret)
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 12) 64 Secret) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 11) 80 Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 10) 96 Secret)
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 9) 112 Secret) (va_CNil ()))))))))))

val va_codegen_success_UpdateScratch : va_dummy:unit -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_UpdateScratch () =
  (va_pbool_and (va_codegen_success_ZeroXmm (va_op_xmm_xmm 4)) (va_pbool_and
    (va_codegen_success_Mov128 (va_op_xmm_xmm 7) (va_op_xmm_xmm 14)) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 13) 48 Secret)
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 12) 64 Secret) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 11) 80 Secret) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 10) 96 Secret)
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 9) 112 Secret) (va_ttrue ())))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_UpdateScratch (va_mods:va_mods_t) (scratch_b:buffer128) : (va_quickCode unit
  (va_code_UpdateScratch ())) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1623 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_ZeroXmm (va_op_xmm_xmm 4)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1624 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Mov128 (va_op_xmm_xmm 7) (va_op_xmm_xmm 14)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1625 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret scratch_b 1) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1626 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 13) 48 Secret scratch_b 3) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1627 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 12) 64 Secret scratch_b 4) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1628 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 11) 80 Secret scratch_b 5) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1629 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 10) 96 Secret scratch_b 6) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1630 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 9) 112 Secret scratch_b 7) (va_QEmpty (())))))))))))


val va_lemma_UpdateScratch : va_b0:va_code -> va_s0:va_state -> scratch_b:buffer128
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_UpdateScratch ()) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp
    va_s0) scratch_b 8 (va_get_mem_layout va_s0) Secret)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer128 scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3
    va_sM) /\ Vale.X64.Decls.buffer_modifies_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 7 /\ Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0 /\
    Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_s0) ==
    Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM) /\
    Vale.X64.Decls.buffer128_read scratch_b 3 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 13 va_sM
    /\ Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 12
    va_sM /\ Vale.X64.Decls.buffer128_read scratch_b 5 (va_get_mem_heaplet 3 va_sM) == va_get_xmm
    11 va_sM /\ Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    va_get_xmm 10 va_sM /\ Vale.X64.Decls.buffer128_read scratch_b 7 (va_get_mem_heaplet 3 va_sM)
    == va_get_xmm 9 va_sM /\ va_get_xmm 7 va_sM == va_get_xmm 14 va_sM /\ va_get_xmm 4 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\ va_state_eq va_sM (va_update_flags
    va_sM (va_update_mem_heaplet 3 va_sM (va_update_xmm 7 va_sM (va_update_xmm 4 va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))
[@"opaque_to_smt"]
let va_lemma_UpdateScratch va_b0 va_s0 scratch_b =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 4;
    va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_UpdateScratch va_mods scratch_b in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_UpdateScratch ()) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 1588 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 1610 column 57 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1611 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer_modifies_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 7) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1613 column 63 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1614 column 88 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_s0) ==
    Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1615 column 54 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 3 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 13 va_sM)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1616 column 54 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 12 va_sM)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1617 column 54 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 5 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 11 va_sM)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1618 column 54 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 10 va_sM)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1619 column 54 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 7 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 9 va_sM)
    /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1620 column 21 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 7 va_sM == va_get_xmm 14 va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 1621 column 30 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 4 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 4; va_Mod_ok;
    va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_UpdateScratch (scratch_b:buffer128) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) :
  Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0)
    (va_get_reg64 rRbp va_s0) scratch_b 8 (va_get_mem_layout va_s0) Secret) /\ (forall
    (va_x_mem:vale_heap) (va_x_xmm4:quad32) (va_x_xmm7:quad32) (va_x_heap3:vale_heap)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_mem_heaplet 3
    va_x_heap3 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 4 va_x_xmm4 (va_upd_mem va_x_mem va_s0)))) in
    va_get_ok va_sM /\ (Vale.X64.Decls.modifies_buffer128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) /\ Vale.X64.Decls.buffer_modifies_specific128 scratch_b
    (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3 va_sM) 1 7 /\ Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_sM) == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0
    0 0 /\ Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_s0) ==
    Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM) /\
    Vale.X64.Decls.buffer128_read scratch_b 3 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 13 va_sM
    /\ Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) == va_get_xmm 12
    va_sM /\ Vale.X64.Decls.buffer128_read scratch_b 5 (va_get_mem_heaplet 3 va_sM) == va_get_xmm
    11 va_sM /\ Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    va_get_xmm 10 va_sM /\ Vale.X64.Decls.buffer128_read scratch_b 7 (va_get_mem_heaplet 3 va_sM)
    == va_get_xmm 9 va_sM /\ va_get_xmm 7 va_sM == va_get_xmm 14 va_sM /\ va_get_xmm 4 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) ==> va_k va_sM (())))


val va_wpProof_UpdateScratch : scratch_b:buffer128 -> va_s0:va_state -> va_k:(va_state -> unit ->
  Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_UpdateScratch scratch_b va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_UpdateScratch ()) ([va_Mod_flags;
    va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 4; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0,
    va_g))))
[@"opaque_to_smt"]
let va_wpProof_UpdateScratch scratch_b va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_UpdateScratch (va_code_UpdateScratch ()) va_s0 scratch_b in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM (va_update_xmm 7
    va_sM (va_update_xmm 4 va_sM (va_update_ok va_sM (va_update_mem va_sM va_s0)))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 4; va_Mod_mem])
    va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_UpdateScratch (scratch_b:buffer128) : (va_quickCode unit (va_code_UpdateScratch ())) =
  (va_QProc (va_code_UpdateScratch ()) ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7;
    va_Mod_xmm 4; va_Mod_mem]) (va_wp_UpdateScratch scratch_b) (va_wpProof_UpdateScratch scratch_b))
//--
//-- AES_GCM_encrypt_6mult
#push-options "--z3rlimit 40000 --z3refresh --max_ifuel 0 --z3seed 7"
#restart-solver

[@ "opaque_to_smt" va_qattr]
let va_code_AES_GCM_encrypt_6mult alg =
  (va_Block (va_CCons (va_IfElse (va_cmp_eq (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (va_Block
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 1) 32 Secret) (va_CNil ())))) (va_Block (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 8) 32 Secret)
    (va_CCons (va_code_Add64 (va_op_dst_opr64_reg64 rRcx) (va_const_opr64 128)) (va_CCons
    (va_code_Pextrq (va_op_dst_opr64_reg64 rRbx) (va_op_xmm_xmm 1) 0) (va_CCons (va_code_And64
    (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 255)) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 1)
    (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_CCons (va_code_AddLea64 (va_op_dst_opr64_reg64 rR14)
    (va_op_opr64_reg64 rRsi) (va_const_opr64 96)) (va_CCons (va_code_AESNI_ctr32_6x alg) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 8) (va_op_xmm_xmm 9) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_VPshufb (va_op_xmm_xmm 2) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 8) 112 Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 4) (va_op_xmm_xmm 11)
    (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 2) 96 Secret) (va_CCons (va_code_VPshufb
    (va_op_xmm_xmm 5) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 4) 80 Secret)
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 5) 64 Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 7) (va_op_xmm_xmm 14)
    (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 6) 48 Secret) (va_CCons (va_code_AESNI_ctr32_6x
    alg) (va_CCons (va_code_Sub64 (va_op_dst_opr64_reg64 rRdx) (va_const_opr64 12)) (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 8) (va_op_reg_opr64_reg64
    rRbp) 32 Secret) (va_CCons (va_code_Ctr32_ghash_6_prelude alg) (va_CCons (va_code_Loop6x_loop
    alg) (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 7)
    (va_op_reg_opr64_reg64 rRbp) 32 Secret) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 1) 32 Secret)
    (va_CCons (va_code_ZeroXmm (va_op_xmm_xmm 4)) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 4) 16 Secret)
    (va_CCons (va_Block (va_CNil ())) (va_CCons (va_code_GhashUnroll6x ()) (va_CCons (va_Block
    (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_code_InitPshufbMask
    (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64 rR12)) (va_CCons (va_Block (va_CNil ())) (va_CCons
    (va_code_Encrypt_save_and_shuffle_output ()) (va_CCons (va_code_UpdateScratch ()) (va_CCons
    (va_Block (va_CNil ())) (va_CCons (va_code_GhashUnroll6x ()) (va_CCons (va_Block (va_CNil ()))
    (va_CCons (va_Block (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_code_Sub64
    (va_op_dst_opr64_reg64 rRcx) (va_const_opr64 128)) (va_CNil
    ())))))))))))))))))))))))))))))))))))))))))))) (va_CNil ())))

[@ "opaque_to_smt" va_qattr]
let va_codegen_success_AES_GCM_encrypt_6mult alg =
  (va_pbool_and (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1)
    (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet
    3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 1) 32 Secret) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 8) 32 Secret) (va_pbool_and (va_codegen_success_Add64 (va_op_dst_opr64_reg64
    rRcx) (va_const_opr64 128)) (va_pbool_and (va_codegen_success_Pextrq (va_op_dst_opr64_reg64
    rRbx) (va_op_xmm_xmm 1) 0) (va_pbool_and (va_codegen_success_And64 (va_op_dst_opr64_reg64 rRbx)
    (va_const_opr64 255)) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 1)
    (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_AddLea64
    (va_op_dst_opr64_reg64 rR14) (va_op_opr64_reg64 rRsi) (va_const_opr64 96)) (va_pbool_and
    (va_codegen_success_AESNI_ctr32_6x alg) (va_pbool_and (va_codegen_success_VPshufb
    (va_op_xmm_xmm 8) (va_op_xmm_xmm 9) (va_op_xmm_xmm 0)) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 2) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 8) 112 Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 4) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 2) 96 Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 5) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 4) 80 Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 5) 64 Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 7) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 6) 48 Secret) (va_pbool_and
    (va_codegen_success_AESNI_ctr32_6x alg) (va_pbool_and (va_codegen_success_Sub64
    (va_op_dst_opr64_reg64 rRdx) (va_const_opr64 12)) (va_pbool_and
    (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 8)
    (va_op_reg_opr64_reg64 rRbp) 32 Secret) (va_pbool_and (va_codegen_success_Ctr32_ghash_6_prelude
    alg) (va_pbool_and (va_codegen_success_Loop6x_loop alg) (va_pbool_and
    (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 7)
    (va_op_reg_opr64_reg64 rRbp) 32 Secret) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 1) 32 Secret)
    (va_pbool_and (va_codegen_success_ZeroXmm (va_op_xmm_xmm 4)) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret) (va_pbool_and (va_codegen_success_GhashUnroll6x ()) (va_pbool_and
    (va_codegen_success_InitPshufbMask (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64 rR12))
    (va_pbool_and (va_codegen_success_Encrypt_save_and_shuffle_output ()) (va_pbool_and
    (va_codegen_success_UpdateScratch ()) (va_pbool_and (va_codegen_success_GhashUnroll6x ())
    (va_codegen_success_Sub64 (va_op_dst_opr64_reg64 rRcx) (va_const_opr64
    128)))))))))))))))))))))))))))))))))))) (va_ttrue ()))

[@ "opaque_to_smt" va_qattr]
let va_qcode_AES_GCM_encrypt_6mult (va_mods:va_mods_t) (alg:algorithm) (h_LE:quad32)
  (iv_b:buffer128) (in_b:buffer128) (out_b:buffer128) (scratch_b:buffer128) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) : (va_quickCode unit
  (va_code_AES_GCM_encrypt_6mult alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2176 column 8 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_qIf va_mods (Cmp_eq (va_op_cmp_reg64 rRdx) (va_const_cmp 0)) (qblock va_mods (fun
    (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2178 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2179 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 1) 32 Secret scratch_b 2) (fun (va_s:va_state) _ -> let
    (va_arg104:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg103:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key_words in let
    (va_arg102:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b in let (va_arg101:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b in let
    (va_arg100:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2180 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_opaque_init va_arg100 va_arg101 va_arg102 va_arg103
    va_arg104) (va_QEmpty (())))))) (qblock va_mods (fun (va_s:va_state) -> let
    (plain_quads:(FStar.Seq.Base.seq Vale.X64.Decls.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) in_b in let (y_orig:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s) in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2187 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 8) 32 Secret scratch_b 2) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2189 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Add64 (va_op_dst_opr64_reg64 rRcx) (va_const_opr64 128)) (fun (va_s:va_state) _ ->
    let (ctr_BE:quad32) = va_get_xmm 1 va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2195 column 15 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Pextrq (va_op_dst_opr64_reg64 rRbx) (va_op_xmm_xmm 1) 0) (fun (va_s:va_state) _ ->
    let (full_counter:nat64) = va_get_reg64 rRbx va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2197 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_And64 (va_op_dst_opr64_reg64 rRbx) (va_const_opr64 255)) (fun (va_s:va_state) _ ->
    let (va_arg136:Vale.Def.Types_s.nat64) = va_get_reg64 rRbx va_s in let
    (va_arg135:Vale.Def.Types_s.nat64) = full_counter in let (va_arg134:Vale.Def.Types_s.quad32) =
    va_get_xmm 1 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2198 column 27 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.lemma_counter_init va_arg134 va_arg135 va_arg136) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 2200 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 0)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2203 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AddLea64 (va_op_dst_opr64_reg64 rR14) (va_op_opr64_reg64 rRsi) (va_const_opr64 96))
    (fun (va_s:va_state) _ -> let (va_arg133:Vale.Def.Types_s.quad32) = ctr_BE in let
    (va_arg132:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key_words in let
    (va_arg131:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b in let (va_arg130:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in_b in let
    (va_arg129:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2205 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_opaque_init va_arg129 va_arg130 va_arg131 va_arg132
    va_arg133) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2206 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AESNI_ctr32_6x alg 0 in_b out_b plain_quads key_words round_keys keys_b ctr_BE
    ctr_BE) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2208 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 8) (va_op_xmm_xmm 9) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2209 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 2) (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2210 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 8) 112 Secret scratch_b 7) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2211 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 4) (va_op_xmm_xmm 11) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2212 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 2) 96 Secret scratch_b 6) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2213 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 5) (va_op_xmm_xmm 12) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2214 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 80 Secret scratch_b 5) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2215 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 13) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2216 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 5) 64 Secret scratch_b 4) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2217 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 7) (va_op_xmm_xmm 14) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2218 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 6) 48 Secret scratch_b 3) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2220 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_AESNI_ctr32_6x alg 1 in_b out_b plain_quads key_words round_keys keys_b
    (Vale.AES.GCTR_s.inc32 ctr_BE 6) ctr_BE) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2221 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Sub64 (va_op_dst_opr64_reg64 rRdx) (va_const_opr64 12)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2223 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 8) (va_op_reg_opr64_reg64
    rRbp) 32 Secret scratch_b 2) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2226 column 30 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Ctr32_ghash_6_prelude alg scratch_b key_words round_keys keys_b
    (Vale.AES.GCTR_s.inc32 ctr_BE 12)) (fun (va_s:va_state) _ -> let (mid_len:nat64) = va_get_reg64
    rRdx va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2233 column 26 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Math.Poly2.Words.lemma_quad32_zero ()) (let
    (va_arg128:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s) in
    va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2234 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Math.Poly2.lemma_add_zero va_arg128) (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 2235 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s) == add (add
    (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s)) (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 4 va_s))) (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read
    scratch_b 1 (va_get_mem_heaplet 3 va_s)))) (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 2236 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Math.Poly2.Bits_s.to_quad32 (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s)) ==
    va_get_xmm 8 va_s) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2237 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Loop6x_loop alg h_LE (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s))
    (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s)) 2 iv_b out_b in_b out_b scratch_b
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in_b) key_words round_keys keys_b hkeys_b
    ctr_BE (Vale.AES.GCTR_s.inc32 ctr_BE 12)) (fun (va_s:va_state) (y_new:quad32) -> let
    (out_snapshot:(FStar.Seq.Base.seq Vale.X64.Decls.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2240 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 7) (va_op_reg_opr64_reg64
    rRbp) 32 Secret scratch_b 2) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2243 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 1) 32 Secret scratch_b 2) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2246 column 16 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_ZeroXmm (va_op_xmm_xmm 4)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2247 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret scratch_b 1) (fun (va_s:va_state) _ -> let
    (va_arg127:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s) in
    va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2248 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Math.Poly2.lemma_add_zero va_arg127) (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2250 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_old_s - 12 >= 0 /\ va_get_reg64 rRdx va_old_s - 6 >= 0 /\ (fun a_1582
    (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) (va_get_reg64
    rRdx va_old_s - 12) (va_get_reg64 rRdx va_old_s - 6)) (fun _ -> let (data:(FStar.Seq.Base.seq
    Vale.X64.Decls.quad32)) = FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b) (va_get_reg64 rRdx va_old_s - 12) (va_get_reg64 rRdx
    va_old_s - 6) in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2251 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_GhashUnroll6x hkeys_b scratch_b h_LE y_new data) (fun (va_s:va_state) _ -> let
    (y_new':Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s) in
    va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2253 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_old_s - 12 >= 0 /\ (fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582))
    (i_1584:Prims.nat) (j_1585:Prims.nat) -> let (j_1545:Prims.nat) = j_1585 in Prims.b2t
    (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584 j_1545) (Prims.op_LessThanOrEqual j_1545
    (FStar.Seq.Base.length #a_1582 s_1583)))) Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64 rRdx va_old_s - 12)) (fun _ -> let
    (va_arg126:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = data in let
    (va_arg125:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64
    rRdx va_old_s - 12) in let (va_arg124:Vale.Def.Types_s.quad32) = y_new in let
    (va_arg123:Vale.Def.Types_s.quad32) = h_LE in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2253 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_ghash_incremental0_append va_arg123 y_orig va_arg124
    y_new' va_arg125 va_arg126) (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2255 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_old_s - 12 >= 0 /\ (fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582))
    (i_1584:Prims.nat) (j_1585:Prims.nat) -> let (j_1545:Prims.nat) = j_1585 in Prims.b2t
    (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584 j_1545) (Prims.op_LessThanOrEqual j_1545
    (FStar.Seq.Base.length #a_1582 s_1583)))) Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64 rRdx va_old_s - 12) /\ va_get_reg64 rRdx
    va_old_s - 6 >= 0 /\ (fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat)
    (j_1585:Prims.nat) -> let (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp
    (Prims.op_LessThanOrEqual i_1584 j_1545) (Prims.op_LessThanOrEqual j_1545
    (FStar.Seq.Base.length #a_1582 s_1583)))) Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64 rRdx va_old_s - 6)) (fun _ -> va_qAssert
    va_range1
    "***** PRECONDITION NOT MET AT line 2255 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.equal #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s)
    out_b) 0 (va_get_reg64 rRdx va_old_s - 12)) data) (FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64 rRdx va_old_s - 6)))
    (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2260 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_InitPshufbMask (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64 rR12)) (fun (va_s:va_state) _
    -> va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2267 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_old_s `op_Division` 6 - 1 >= 0) (fun _ -> let (offset_in:nat) =
    va_get_reg64 rRdx va_old_s `op_Division` 6 - 1 in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2268 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Encrypt_save_and_shuffle_output offset_in out_b) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2271 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_UpdateScratch scratch_b) (fun (va_s:va_state) _ -> va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2273 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_old_s - 6 >= 0 /\ va_get_reg64 rRdx va_old_s >= 0 /\ (fun a_1582
    (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) (va_get_reg64
    rRdx va_old_s - 6) (va_get_reg64 rRdx va_old_s)) (fun _ -> let data = FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) (va_get_reg64
    rRdx va_old_s - 6) (va_get_reg64 rRdx va_old_s) in let (va_arg122:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s) in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2274 column 23 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Math.Poly2.lemma_add_zero va_arg122) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 2275 column 22 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_GhashUnroll6x hkeys_b scratch_b h_LE y_new' data) (fun (va_s:va_state) _ -> let
    (y_new'':Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s)
    in va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2278 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_old_s - 6 >= 0 /\ (fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582))
    (i_1584:Prims.nat) (j_1585:Prims.nat) -> let (j_1545:Prims.nat) = j_1585 in Prims.b2t
    (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584 j_1545) (Prims.op_LessThanOrEqual j_1545
    (FStar.Seq.Base.length #a_1582 s_1583)))) Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64 rRdx va_old_s - 6)) (fun _ -> let
    (va_arg121:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = data in let
    (va_arg120:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64
    rRdx va_old_s - 6) in let (va_arg119:Vale.Def.Types_s.quad32) = h_LE in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2278 column 40 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_ghash_incremental0_append va_arg119 y_orig y_new' y_new''
    va_arg120 va_arg121) (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2280 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRdx va_old_s - 6 >= 0 /\ (fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582))
    (i_1584:Prims.nat) (j_1585:Prims.nat) -> let (j_1545:Prims.nat) = j_1585 in Prims.b2t
    (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584 j_1545) (Prims.op_LessThanOrEqual j_1545
    (FStar.Seq.Base.length #a_1582 s_1583)))) Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out_b) 0 (va_get_reg64 rRdx va_old_s - 6)) (fun _ -> va_qAssert
    va_range1
    "***** PRECONDITION NOT MET AT line 2280 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (FStar.Seq.Base.equal #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s)
    out_b) 0 (va_get_reg64 rRdx va_old_s - 6)) data) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6
    va_s) out_b)) (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 2286 column 44 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (12 + mid_len - 6 >= 0 /\ 12 + mid_len - 6 <= 4294967295) (fun _ -> let
    (va_arg118:Vale.Def.Types_s.quad32) = ctr_BE in let (va_arg117:(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat32)) = key_words in let (va_arg116:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b in let
    (va_arg115:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = out_snapshot in let
    (va_arg114:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old_s) in_b in let (va_arg113:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in_b in let
    (va_arg112:Vale.Def.Types_s.nat32) = 12 + mid_len - 6 in let
    (va_arg111:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2286 column 44 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_opaque_ignores_postfix va_arg111 va_arg112
    va_arg113 va_arg114 va_arg115 va_arg116 va_arg117 va_arg118) (let
    (va_arg110:Vale.Def.Types_s.quad32) = ctr_BE in let (va_arg109:(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat32)) = key_words in let (va_arg108:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out_b in let
    (va_arg107:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old_s) in_b in let (va_arg106:Prims.nat) = 12 + mid_len - 6 in let
    (va_arg105:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 2287 column 29 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_extend6 va_arg105 va_arg106 va_arg107 va_arg108
    va_arg109 va_arg110) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2289 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Sub64 (va_op_dst_opr64_reg64 rRcx) (va_const_opr64 128)) (va_QEmpty
    (()))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (fun (va_s:va_state) va_g ->
    va_QEmpty (()))))

[@"opaque_to_smt"]
let va_lemma_AES_GCM_encrypt_6mult va_b0 va_s0 alg h_LE iv_b in_b out_b scratch_b key_words
  round_keys keys_b hkeys_b =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_mem_heaplet 6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14;
    va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRcx;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRax; va_Mod_ok;
    va_Mod_mem] in
  let va_qc = va_qcode_AES_GCM_encrypt_6mult va_mods alg h_LE iv_b in_b out_b scratch_b key_words
    round_keys keys_b hkeys_b in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_AES_GCM_encrypt_6mult alg) va_qc va_s0
    (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 2086 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 2159 column 53 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 out_b (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2160 column 52 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 iv_b (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2161 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2163 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_reg64 rRcx va_sM == va_get_reg64 rRcx va_s0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2166 column 100 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.AES.GCTR.gctr_partial alg (va_get_reg64 rRdx va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b)
    key_words (va_get_xmm 1 va_s0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2169 column 112 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_sM) ==
    Vale.AES.GHash.ghash_incremental0 h_LE (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8
    va_s0)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out_b)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2173 column 98 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (l_and (va_get_reg64 rRdx va_s0 < pow2_32) (Vale.X64.Decls.buffer128_read scratch_b 2
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    (va_get_xmm 1 va_s0) (va_get_reg64 rRdx va_s0)))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRcx; va_Mod_reg64 rRdx; va_Mod_reg64
    rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRax; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)


[@"opaque_to_smt"]
let va_wpProof_AES_GCM_encrypt_6mult alg h_LE iv_b in_b out_b scratch_b key_words round_keys keys_b
  hkeys_b va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_AES_GCM_encrypt_6mult (va_code_AES_GCM_encrypt_6mult alg) va_s0 alg
    h_LE iv_b in_b out_b scratch_b key_words round_keys keys_b hkeys_b in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM
    (va_update_mem_heaplet 2 va_sM (va_update_mem_heaplet 6 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR14
    va_sM (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRbx va_sM (va_update_reg64 rRcx va_sM (va_update_reg64 rRdx va_sM
    (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM (va_update_reg64 rRax va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet
    6; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64
    rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRbx; va_Mod_reg64 rRcx; va_Mod_reg64 rRdx; va_Mod_reg64
    rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRax; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

#pop-options
//--
//-- DecryptPrelude

val va_code_DecryptPrelude : va_dummy:unit -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_DecryptPrelude () =
  (va_Block (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 7)
    (va_op_reg_opr64_reg64 rRdi) 80 Secret) (va_CCons (va_code_Load128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 4) (va_op_reg_opr64_reg64 rRdi) 64 Secret)
    (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 5)
    (va_op_reg_opr64_reg64 rRdi) 48 Secret) (va_CCons (va_code_Load128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 6) (va_op_reg_opr64_reg64 rRdi) 32 Secret)
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 7) (va_op_xmm_xmm 7) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 2) (va_op_reg_opr64_reg64
    rRdi) 16 Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 4) (va_op_xmm_xmm 4) (va_op_xmm_xmm
    0)) (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 3)
    (va_op_reg_opr64_reg64 rRdi) 0 Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 5)
    (va_op_xmm_xmm 5) (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 4) 48 Secret)
    (va_CCons (va_code_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 6) (va_op_xmm_xmm 0)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 5) 64 Secret) (va_CCons (va_code_VPshufb (va_op_xmm_xmm 2) (va_op_xmm_xmm 2)
    (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 6) 80 Secret) (va_CCons (va_code_VPshufb
    (va_op_xmm_xmm 3) (va_op_xmm_xmm 3) (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 2) 96 Secret)
    (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 3) 112 Secret) (va_CNil ())))))))))))))))))))

val va_codegen_success_DecryptPrelude : va_dummy:unit -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_DecryptPrelude () =
  (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 7)
    (va_op_reg_opr64_reg64 rRdi) 80 Secret) (va_pbool_and (va_codegen_success_Load128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 4) (va_op_reg_opr64_reg64 rRdi) 64 Secret)
    (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm
    5) (va_op_reg_opr64_reg64 rRdi) 48 Secret) (va_pbool_and (va_codegen_success_Load128_buffer
    (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 6) (va_op_reg_opr64_reg64 rRdi) 32 Secret)
    (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 7) (va_op_xmm_xmm 7) (va_op_xmm_xmm
    0)) (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 6)
    (va_op_xmm_xmm 2) (va_op_reg_opr64_reg64 rRdi) 16 Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 4) (va_op_xmm_xmm 4) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm
    3) (va_op_reg_opr64_reg64 rRdi) 0 Secret) (va_pbool_and (va_codegen_success_VPshufb
    (va_op_xmm_xmm 5) (va_op_xmm_xmm 5) (va_op_xmm_xmm 0)) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 48 Secret) (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 6)
    (va_op_xmm_xmm 6) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 5) 64 Secret)
    (va_pbool_and (va_codegen_success_VPshufb (va_op_xmm_xmm 2) (va_op_xmm_xmm 2) (va_op_xmm_xmm
    0)) (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 6) 80 Secret) (va_pbool_and
    (va_codegen_success_VPshufb (va_op_xmm_xmm 3) (va_op_xmm_xmm 3) (va_op_xmm_xmm 0))
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 2) 96 Secret) (va_pbool_and
    (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 3) 112 Secret) (va_ttrue ()))))))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_DecryptPrelude (va_mods:va_mods_t) (in_b:buffer128) (scratch_b:buffer128) :
  (va_quickCode unit (va_code_DecryptPrelude ())) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2339 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 7) (va_op_reg_opr64_reg64
    rRdi) 80 Secret in_b 5) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2340 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 4) (va_op_reg_opr64_reg64
    rRdi) 64 Secret in_b 4) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2341 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 5) (va_op_reg_opr64_reg64
    rRdi) 48 Secret in_b 3) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2342 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 6) (va_op_reg_opr64_reg64
    rRdi) 32 Secret in_b 2) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2344 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 7) (va_op_xmm_xmm 7) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2345 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 2) (va_op_reg_opr64_reg64
    rRdi) 16 Secret in_b 1) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2346 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 4) (va_op_xmm_xmm 4) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2347 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 6) (va_op_xmm_xmm 3) (va_op_reg_opr64_reg64
    rRdi) 0 Secret in_b 0) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2348 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 5) (va_op_xmm_xmm 5) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2349 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 48 Secret scratch_b 3) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2350 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 6) (va_op_xmm_xmm 6) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2351 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 5) 64 Secret scratch_b 4) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2352 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 2) (va_op_xmm_xmm 2) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2353 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 6) 80 Secret scratch_b 5) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2354 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPshufb (va_op_xmm_xmm 3) (va_op_xmm_xmm 3) (va_op_xmm_xmm 0)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2355 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 2) 96 Secret scratch_b 6) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 2356 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 3) 112 Secret scratch_b 7) (va_QEmpty (()))))))))))))))))))))


val va_lemma_DecryptPrelude : va_b0:va_code -> va_s0:va_state -> in_b:buffer128 ->
  scratch_b:buffer128
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_DecryptPrelude ()) va_s0 /\ va_get_ok va_s0 /\
    (avx_enabled /\ sse_enabled /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 6 va_s0)
    (va_get_reg64 rRdi va_s0) in_b 6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 8 (va_get_mem_layout va_s0) Secret /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 3 7 /\ Vale.X64.Decls.buffer128_read scratch_b 7
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in_b 0 (va_get_mem_heaplet 6 va_sM)) /\
    Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 1 (va_get_mem_heaplet
    6 va_sM)) /\ Vale.X64.Decls.buffer128_read scratch_b 5 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 2 (va_get_mem_heaplet
    6 va_sM)) /\ Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 3 (va_get_mem_heaplet
    6 va_sM)) /\ Vale.X64.Decls.buffer128_read scratch_b 3 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 4 (va_get_mem_heaplet
    6 va_sM)) /\ va_get_xmm 7 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in_b 5 (va_get_mem_heaplet 6 va_sM))) /\ va_state_eq va_sM
    (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6
    va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2
    va_sM (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))
[@"opaque_to_smt"]
let va_lemma_DecryptPrelude va_b0 va_s0 in_b scratch_b =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_DecryptPrelude va_mods in_b scratch_b in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_DecryptPrelude ()) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 2295 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 2323 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 3 7) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2325 column 100 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 7 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 0 (va_get_mem_heaplet
    6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2326 column 100 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 1 (va_get_mem_heaplet
    6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2327 column 100 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 5 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 2 (va_get_mem_heaplet
    6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2328 column 100 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 3 (va_get_mem_heaplet
    6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2329 column 100 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 3 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 4 (va_get_mem_heaplet
    6 va_sM))) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 2331 column 67 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 7 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read
    in_b 5 (va_get_mem_heaplet 6 va_sM))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm
    5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_DecryptPrelude (in_b:buffer128) (scratch_b:buffer128) (va_s0:va_state) (va_k:(va_state ->
  unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (avx_enabled /\ sse_enabled /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRdi va_s0) in_b 6 (va_get_mem_layout va_s0) Secret
    /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 8 (va_get_mem_layout va_s0) Secret /\ va_get_xmm 0 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051) /\ (forall (va_x_mem:vale_heap)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_heap3:vale_heap) (va_x_efl:Vale.X64.Flags.t) . let va_sM =
    va_upd_flags va_x_efl (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6
    va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2
    va_x_xmm2 (va_upd_mem va_x_mem va_s0)))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 3 7 /\ Vale.X64.Decls.buffer128_read scratch_b 7
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in_b 0 (va_get_mem_heaplet 6 va_sM)) /\
    Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 1 (va_get_mem_heaplet
    6 va_sM)) /\ Vale.X64.Decls.buffer128_read scratch_b 5 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 2 (va_get_mem_heaplet
    6 va_sM)) /\ Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 3 (va_get_mem_heaplet
    6 va_sM)) /\ Vale.X64.Decls.buffer128_read scratch_b 3 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in_b 4 (va_get_mem_heaplet
    6 va_sM)) /\ va_get_xmm 7 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in_b 5 (va_get_mem_heaplet 6 va_sM))) ==> va_k va_sM (())))


val va_wpProof_DecryptPrelude : in_b:buffer128 -> scratch_b:buffer128 -> va_s0:va_state ->
  va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_DecryptPrelude in_b scratch_b va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_DecryptPrelude ()) ([va_Mod_flags;
    va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3;
    va_Mod_xmm 2; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_DecryptPrelude in_b scratch_b va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_DecryptPrelude (va_code_DecryptPrelude ()) va_s0 in_b scratch_b in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 3 va_sM (va_update_xmm 7
    va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3
    va_sM (va_update_xmm 2 va_sM (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm
    5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_DecryptPrelude (in_b:buffer128) (scratch_b:buffer128) : (va_quickCode unit
  (va_code_DecryptPrelude ())) =
  (va_QProc (va_code_DecryptPrelude ()) ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_mem])
    (va_wp_DecryptPrelude in_b scratch_b) (va_wpProof_DecryptPrelude in_b scratch_b))
//--
//-- AES_GCM_decrypt_6mult
#push-options "--z3rlimit 100"

[@ "opaque_to_smt" va_qattr]
val va_code_AES_GCM_decrypt_6mult : alg:algorithm -> Tot va_code
alg: Vale.AES.AES_common_s.algorithm -> Vale.X64.Decls.va_code