val va_qcode_Gcm_blocks_decrypt_stdcall
      (va_mods: va_mods_t)
      (win: bool)
      (alg: algorithm)
      (auth_b: buffer128)
      (auth_bytes auth_num: nat64)
      (keys_b iv_b: buffer128)
      (iv: supported_iv_LE)
      (hkeys_b abytes_b in128x6_b out128x6_b: buffer128)
      (len128x6_num: nat64)
      (in128_b out128_b: buffer128)
      (len128_num: nat64)
      (inout_b: buffer128)
      (cipher_num: nat64)
      (scratch_b tag_b: buffer128)
      (key: (seq nat32))
    : (va_quickCode unit (va_code_Gcm_blocks_decrypt_stdcall win alg))
let va_qcode_Gcm_blocks_decrypt_stdcall (va_mods:va_mods_t) (win:bool) (alg:algorithm)
  (auth_b:buffer128) (auth_bytes:nat64) (auth_num:nat64) (keys_b:buffer128) (iv_b:buffer128)
  (iv:supported_iv_LE) (hkeys_b:buffer128) (abytes_b:buffer128) (in128x6_b:buffer128)
  (out128x6_b:buffer128) (len128x6_num:nat64) (in128_b:buffer128) (out128_b:buffer128)
  (len128_num:nat64) (inout_b:buffer128) (cipher_num:nat64) (scratch_b:buffer128) (tag_b:buffer128)
  (key:(seq nat32)) : (va_quickCode unit (va_code_Gcm_blocks_decrypt_stdcall win alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (auth_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ -> va_get_reg64 rRcx va_s)
    (fun _ -> va_get_reg64 rRdi va_s) in let (auth_num_bytes:(va_int_range 0 18446744073709551615))
    = va_if win (fun _ -> va_get_reg64 rRdx va_s) (fun _ -> va_get_reg64 rRsi va_s) in let
    (auth_len:(va_int_range 0 18446744073709551615)) = va_if win (fun _ -> va_get_reg64 rR8 va_s)
    (fun _ -> va_get_reg64 rRdx va_s) in let (keys_ptr:(va_int_range 0 18446744073709551615)) =
    va_if win (fun _ -> va_get_reg64 rR9 va_s) (fun _ -> va_get_reg64 rRcx va_s) in let
    (iv_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 32 + 8 + 0) (va_get_stack va_s)) (fun _
    -> va_get_reg64 rR8 va_s) in let (xip:(va_int_range 0 18446744073709551615)) = va_if win (fun _
    -> Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 32 + 8 + 8) (va_get_stack va_s))
    (fun _ -> va_get_reg64 rR9 va_s) in let (abytes_ptr:(va_int_range 0 18446744073709551615)) =
    va_if win (fun _ -> Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 16)
    (va_get_stack va_s)) (fun _ -> Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 0)
    (va_get_stack va_s)) in let (in128x6_ptr:(va_int_range 0 18446744073709551615)) = va_if win
    (fun _ -> Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 24) (va_get_stack va_s))
    (fun _ -> Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 8) (va_get_stack va_s))
    in let (out128x6_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 32) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 16) (va_get_stack va_s)) in let
    (len128x6:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 40) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 24) (va_get_stack va_s)) in let
    (in128_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 48) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 32) (va_get_stack va_s)) in let
    (out128_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 56) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 40) (va_get_stack va_s)) in let
    (len128:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 64) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 48) (va_get_stack va_s)) in let
    (inout_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 72) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 56) (va_get_stack va_s)) in let
    (cipher_num_bytes:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 80) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 64) (va_get_stack va_s)) in let
    (scratch_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 88) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 72) (va_get_stack va_s)) in let
    (tag_ptr:(va_int_range 0 18446744073709551615)) = va_if win (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 96) (va_get_stack va_s)) (fun _ ->
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 80) (va_get_stack va_s)) in
    va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 989 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_CreateHeaplets ([declare_buffer128 auth_b 1 Secret Immutable; declare_buffer128
    abytes_b 7 Secret Immutable; declare_buffer128 in128x6_b 6 Secret Immutable; declare_buffer128
    in128_b 1 Secret Immutable; declare_buffer128 hkeys_b 0 Secret Immutable; declare_buffer128
    tag_b 0 Secret Immutable; declare_buffer128 keys_b 0 Secret Immutable; declare_buffer128 iv_b 2
    Public Mutable; declare_buffer128 scratch_b 3 Secret Mutable; declare_buffer128 out128x6_b 6
    Secret Mutable; declare_buffer128 out128_b 1 Secret Mutable; declare_buffer128 inout_b 5 Secret
    Mutable])) (fun (va_s:va_state) _ -> va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1003 column 30 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    ((fun (alg_10584:Vale.AES.AES_common_s.algorithm) (key_10585:(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat32)) (input_LE_10586:Vale.Def.Types_s.quad32) ->
    Vale.AES.AES_s.is_aes_key_LE alg_10584 key_10585) alg key (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0)) (fun _ -> let (va_arg69:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.AES_s.aes_encrypt_LE alg key
    (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)) in let (va_arg68:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s) hkeys_b in va_qPURE
    va_range1
    "***** PRECONDITION NOT MET AT line 1003 column 30 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_hkeys_reqs_pub_priv va_arg68 va_arg69) (va_qAssert
    va_range1
    "***** PRECONDITION NOT MET AT line 1004 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (win ==> Vale.X64.Stack_i.valid_src_stack64 (va_get_reg64 rRsp va_s + 40) (va_get_stack va_s))
    (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 1005 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (~win ==> Vale.X64.Stack_i.valid_src_stack64 (va_get_reg64 rRsp va_s + 80) (va_get_stack va_s))
    (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1006 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Save_registers win) (fun (va_s:va_state) _ -> va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1009 column 15 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_qInlineIf va_mods win (qblock va_mods (fun (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1011 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRcx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1012 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRsi) (va_op_opr64_reg64 rRdx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1013 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRdx) (va_op_opr64_reg64 rR8)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1014 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rR9)) (fun (va_s:va_state) _ ->
    va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 1015 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_reg64 rRsp va_s + 224 == va_get_reg64 rRsp va_old_s) (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 1016 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Stack_i.valid_src_stack64 (va_get_reg64 rRsp va_s + 224 + 40) (va_get_stack va_s))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1017 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rR8) (va_op_reg_opr64_reg64 rRsp) (224 + 40 + 0))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1018 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rR9) (va_op_reg_opr64_reg64 rRsp) (224 + 40 + 8))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1019 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRbp) (va_op_reg_opr64_reg64 rRsp) (224 + 40 +
    88)) (va_QEmpty (())))))))))))) (qblock va_mods (fun (va_s:va_state) -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 1023 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_reg64 rRsp va_s + 64 == va_get_reg64 rRsp va_old_s) (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 1024 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Stack_i.valid_src_stack64 (va_get_reg64 rRsp va_s + 64 + 80) (va_get_stack va_s))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1025 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRbp) (va_op_reg_opr64_reg64 rRsp) (64 + 8 + 72))
    (va_QEmpty (()))))))) (fun (va_s:va_state) va_g -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1028 column 23 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gcm_blocks_wrapped alg (Vale.X64.Decls.total_if #int win (224 + 56) (64 + 8)) auth_b
    abytes_b in128x6_b out128x6_b in128_b out128_b inout_b iv_b iv scratch_b key
    (Vale.X64.Decls.buffer128_as_seq (va_get_mem_heaplet 0 va_old_s) keys_b) keys_b hkeys_b
    (Vale.Def.Types_s.le_quad32_to_bytes (Vale.X64.Decls.buffer128_read tag_b 0 (va_get_mem_heaplet
    0 va_old_s)))) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1048 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rR15) (va_op_reg_opr64_reg64 rRsp)
    (Vale.X64.Decls.total_if #int win (224 + 40 + 96) (64 + 8 + 80))) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1049 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64
    rR15) 0 Secret tag_b 0) (fun (va_s:va_state) _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 1050 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_xmm 0 va_s == Vale.X64.Decls.buffer128_read tag_b 0 (va_get_mem_heaplet 0 va_s))
    (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 1051 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_xmm 0 va_s == Vale.X64.Decls.buffer128_read tag_b 0 (va_get_mem_heaplet 0 va_old_s))
    (let (alleged_tag_quad:quad32) = va_get_xmm 0 va_s in let (computed_tag:quad32) = va_get_xmm 8
    va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 1054 column 13 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_XmmEqual (va_op_xmm_xmm 0) (va_op_xmm_xmm 8)) (fun (va_s:va_state) _ -> let
    (auth_raw_quads:(FStar.Seq.Base.seq Vale.X64.Decls.quad32)) = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_old_s) auth_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 7 va_old_s) abytes_b) in va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1057 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes auth_raw_quads) 0
    auth_num_bytes) (fun _ -> let (auth_bytes:(FStar.Seq.Base.seq Vale.Def.Types_s.nat8)) =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    auth_raw_quads) 0 auth_num_bytes in let (cipher_raw_quads:(FStar.Seq.Base.seq
    Vale.X64.Decls.quad32)) = FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_old_s) in128_b)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_old_s) inout_b) in va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1059 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes cipher_raw_quads) 0
    cipher_num_bytes) (fun _ -> let (cipher_bytes:(FStar.Seq.Base.seq Vale.Def.Types_s.nat8)) =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    cipher_raw_quads) 0 cipher_num_bytes in let (va_arg67:Vale.Def.Types_s.quad32) = computed_tag
    in let (va_arg66:Vale.Def.Types_s.quad32) = alleged_tag_quad in let
    (va_arg65:Vale.Def.Words_s.nat64) = va_get_reg64 rRax va_s in let (va_arg64:(FStar.Seq.Base.seq
    Vale.Def.Words_s.nat8)) = auth_bytes in let (va_arg63:(FStar.Seq.Base.seq
    Vale.Def.Words_s.nat8)) = cipher_bytes in let (va_arg62:Vale.AES.GCM_s.supported_iv_LE) = iv in
    let (va_arg61:(FStar.Seq.Base.seq Vale.Def.Words_s.nat8)) =
    Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE key in let
    (va_arg60:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 1060 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GCM.decrypt_helper va_arg60 va_arg61 va_arg62 va_arg63 va_arg64
    va_arg65 va_arg66 va_arg67) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1066 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rRax)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1067 column 22 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Restore_registers win (va_get_reg64 rRsp va_old_s) (va_get_xmm 6 va_old_s)
    (va_get_xmm 7 va_old_s) (va_get_xmm 8 va_old_s) (va_get_xmm 9 va_old_s) (va_get_xmm 10
    va_old_s) (va_get_xmm 11 va_old_s) (va_get_xmm 12 va_old_s) (va_get_xmm 13 va_old_s)
    (va_get_xmm 14 va_old_s) (va_get_xmm 15 va_old_s)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1068 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRax) (va_op_opr64_reg64 rRcx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 1070 column 20 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_DestroyHeaplets ()) (va_QEmpty (())))))))))))))))))))))))
val va_qcode_Gcm_blocks_decrypt_stdcall
      (va_mods: va_mods_t)
      (win: bool)
      (alg: algorithm)
      (auth_b: buffer128)
      (auth_bytes auth_num: nat64)
      (keys_b iv_b: buffer128)
      (iv: supported_iv_LE)
      (hkeys_b abytes_b in128x6_b out128x6_b: buffer128)
      (len128x6_num: nat64)
      (in128_b out128_b: buffer128)
      (len128_num: nat64)
      (inout_b: buffer128)
      (cipher_num: nat64)
      (scratch_b tag_b: buffer128)
      (key: (seq nat32))
    : (va_quickCode unit (va_code_Gcm_blocks_decrypt_stdcall win alg))
let va_qcode_Gcm_blocks_decrypt_stdcall
      (va_mods: va_mods_t)
      (win: bool)
      (alg: algorithm)
      (auth_b: buffer128)
      (auth_bytes auth_num: nat64)
      (keys_b iv_b: buffer128)
      (iv: supported_iv_LE)
      (hkeys_b abytes_b in128x6_b out128x6_b: buffer128)
      (len128x6_num: nat64)
      (in128_b out128_b: buffer128)
      (len128_num: nat64)
      (inout_b: buffer128)
      (cipher_num: nat64)
      (scratch_b tag_b: buffer128)
      (key: (seq nat32))
    : (va_quickCode unit (va_code_Gcm_blocks_decrypt_stdcall win alg)) =
(qblock va_mods
    (fun (va_s: va_state) ->
        let va_old_s:va_state = va_s in
        let auth_ptr:(va_int_range 0 18446744073709551615) =
          va_if win (fun _ -> va_get_reg64 rRcx va_s) (fun _ -> va_get_reg64 rRdi va_s)
        in
        let auth_num_bytes:(va_int_range 0 18446744073709551615) =
          va_if win (fun _ -> va_get_reg64 rRdx va_s) (fun _ -> va_get_reg64 rRsi va_s)
        in
        let auth_len:(va_int_range 0 18446744073709551615) =
          va_if win (fun _ -> va_get_reg64 rR8 va_s) (fun _ -> va_get_reg64 rRdx va_s)
        in
        let keys_ptr:(va_int_range 0 18446744073709551615) =
          va_if win (fun _ -> va_get_reg64 rR9 va_s) (fun _ -> va_get_reg64 rRcx va_s)
        in
        let iv_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 32 + 8 + 0)
                  (va_get_stack va_s))
            (fun _ -> va_get_reg64 rR8 va_s)
        in
        let xip:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 32 + 8 + 8)
                  (va_get_stack va_s))
            (fun _ -> va_get_reg64 rR9 va_s)
        in
        let abytes_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 16) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 0) (va_get_stack va_s))
        in
        let in128x6_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 24) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 8) (va_get_stack va_s))
        in
        let out128x6_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 32) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 16) (va_get_stack va_s))
        in
        let len128x6:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 40) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 24) (va_get_stack va_s))
        in
        let in128_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 48) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 32) (va_get_stack va_s))
        in
        let out128_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 56) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 40) (va_get_stack va_s))
        in
        let len128:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 64) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 48) (va_get_stack va_s))
        in
        let inout_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 72) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 56) (va_get_stack va_s))
        in
        let cipher_num_bytes:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 80) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 64) (va_get_stack va_s))
        in
        let scratch_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 88) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 72) (va_get_stack va_s))
        in
        let tag_ptr:(va_int_range 0 18446744073709551615) =
          va_if win
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 40 + 96) (va_get_stack va_s)
            )
            (fun _ ->
                Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + 8 + 80) (va_get_stack va_s))
        in
        va_QBind va_range1
          "***** PRECONDITION NOT MET AT line 989 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
          (va_quick_CreateHeaplets ([
                  declare_buffer128 auth_b 1 Secret Immutable;
                  declare_buffer128 abytes_b 7 Secret Immutable;
                  declare_buffer128 in128x6_b 6 Secret Immutable;
                  declare_buffer128 in128_b 1 Secret Immutable;
                  declare_buffer128 hkeys_b 0 Secret Immutable;
                  declare_buffer128 tag_b 0 Secret Immutable;
                  declare_buffer128 keys_b 0 Secret Immutable;
                  declare_buffer128 iv_b 2 Public Mutable;
                  declare_buffer128 scratch_b 3 Secret Mutable;
                  declare_buffer128 out128x6_b 6 Secret Mutable;
                  declare_buffer128 out128_b 1 Secret Mutable;
                  declare_buffer128 inout_b 5 Secret Mutable
                ]))
          (fun (va_s: va_state) _ ->
              va_qAssertSquash va_range1
                "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1003 column 30 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                ((fun
                      (alg_10584: Vale.AES.AES_common_s.algorithm)
                      (key_10585: (FStar.Seq.Base.seq Vale.Def.Types_s.nat32))
                      (input_LE_10586: Vale.Def.Types_s.quad32)
                      ->
                      Vale.AES.AES_s.is_aes_key_LE alg_10584 key_10585) alg
                    key
                    (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0))
                (fun _ ->
                    let va_arg69:Vale.Def.Types_s.quad32 =
                      Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.AES_s.aes_encrypt_LE alg
                            key
                            (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0))
                    in
                    let va_arg68:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32) =
                      Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s) hkeys_b
                    in
                    va_qPURE va_range1
                      "***** PRECONDITION NOT MET AT line 1003 column 30 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                      (fun (_: unit) -> Vale.AES.GHash.lemma_hkeys_reqs_pub_priv va_arg68 va_arg69)
                      (va_qAssert va_range1
                          "***** PRECONDITION NOT MET AT line 1004 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                          (win ==>
                            Vale.X64.Stack_i.valid_src_stack64 (va_get_reg64 rRsp va_s + 40)
                              (va_get_stack va_s))
                          (va_qAssert va_range1
                              "***** PRECONDITION NOT MET AT line 1005 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                              (~win ==>
                                Vale.X64.Stack_i.valid_src_stack64 (va_get_reg64 rRsp va_s + 80)
                                  (va_get_stack va_s))
                              (va_QBind va_range1
                                  "***** PRECONDITION NOT MET AT line 1006 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                  (va_quick_Save_registers win)
                                  (fun (va_s: va_state) _ ->
                                      va_QBind va_range1
                                        "***** PRECONDITION NOT MET AT line 1009 column 15 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                        (va_qInlineIf va_mods
                                            win
                                            (qblock va_mods
                                                (fun (va_s: va_state) ->
                                                    va_QSeq va_range1
                                                      "***** PRECONDITION NOT MET AT line 1011 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                      (va_quick_Mov64 (va_op_dst_opr64_reg64 rRdi)
                                                          (va_op_opr64_reg64 rRcx))
                                                      (va_QSeq va_range1
                                                          "***** PRECONDITION NOT MET AT line 1012 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                          (va_quick_Mov64 (va_op_dst_opr64_reg64 rRsi
                                                                )
                                                              (va_op_opr64_reg64 rRdx))
                                                          (va_QSeq va_range1
                                                              "***** PRECONDITION NOT MET AT line 1013 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                              (va_quick_Mov64 (va_op_dst_opr64_reg64
                                                                      rRdx)
                                                                  (va_op_opr64_reg64 rR8))
                                                              (va_QBind va_range1
                                                                  "***** PRECONDITION NOT MET AT line 1014 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                  (va_quick_Mov64 (va_op_dst_opr64_reg64
                                                                          rRcx)
                                                                      (va_op_opr64_reg64 rR9))
                                                                  (fun (va_s: va_state) _ ->
                                                                      va_qAssert va_range1
                                                                        "***** PRECONDITION NOT MET AT line 1015 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                        (va_get_reg64 rRsp va_s +
                                                                          224 ==
                                                                          va_get_reg64 rRsp va_old_s
                                                                        )
                                                                        (va_qAssert va_range1
                                                                            "***** PRECONDITION NOT MET AT line 1016 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                            (Vale.X64.Stack_i.valid_src_stack64
                                                                                (va_get_reg64 rRsp
                                                                                    va_s +
                                                                                  224 +
                                                                                  40)
                                                                                (va_get_stack va_s))
                                                                            (va_QSeq va_range1
                                                                                "***** PRECONDITION NOT MET AT line 1017 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                (va_quick_Load64_stack
                                                                                    (va_op_dst_opr64_reg64
                                                                                        rR8)
                                                                                    (va_op_reg_opr64_reg64
                                                                                        rRsp)
                                                                                    (224 + 40 + 0))
                                                                                (va_QSeq va_range1
                                                                                    "***** PRECONDITION NOT MET AT line 1018 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                    (va_quick_Load64_stack
                                                                                        (va_op_dst_opr64_reg64
                                                                                            rR9)
                                                                                        (va_op_reg_opr64_reg64
                                                                                            rRsp)
                                                                                        (224 + 40 +
                                                                                          8))
                                                                                    (va_QSeq va_range1
                                                                                        "***** PRECONDITION NOT MET AT line 1019 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                        (va_quick_Load64_stack
                                                                                            (va_op_dst_opr64_reg64
                                                                                                rRbp
                                                                                            )
                                                                                            (va_op_reg_opr64_reg64
                                                                                                rRsp
                                                                                            )
                                                                                            (224 +
                                                                                              40 +
                                                                                              88))
                                                                                        (va_QEmpty (()
                                                                                            ))))))))
                                                          ))))
                                            (qblock va_mods
                                                (fun (va_s: va_state) ->
                                                    va_qAssert va_range1
                                                      "***** PRECONDITION NOT MET AT line 1023 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                      (va_get_reg64 rRsp va_s + 64 ==
                                                        va_get_reg64 rRsp va_old_s)
                                                      (va_qAssert va_range1
                                                          "***** PRECONDITION NOT MET AT line 1024 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                          (Vale.X64.Stack_i.valid_src_stack64 (va_get_reg64
                                                                  rRsp
                                                                  va_s +
                                                                64 +
                                                                80)
                                                              (va_get_stack va_s))
                                                          (va_QSeq va_range1
                                                              "***** PRECONDITION NOT MET AT line 1025 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                              (va_quick_Load64_stack (va_op_dst_opr64_reg64
                                                                      rRbp)
                                                                  (va_op_reg_opr64_reg64 rRsp)
                                                                  (64 + 8 + 72))
                                                              (va_QEmpty (())))))))
                                        (fun (va_s: va_state) va_g ->
                                            va_QSeq va_range1
                                              "***** PRECONDITION NOT MET AT line 1028 column 23 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                              (va_quick_Gcm_blocks_wrapped alg
                                                  (Vale.X64.Decls.total_if #int
                                                      win
                                                      (224 + 56)
                                                      (64 + 8)) auth_b abytes_b in128x6_b out128x6_b
                                                  in128_b out128_b inout_b iv_b iv scratch_b key
                                                  (Vale.X64.Decls.buffer128_as_seq (va_get_mem_heaplet
                                                          0
                                                          va_old_s)
                                                      keys_b) keys_b hkeys_b
                                                  (Vale.Def.Types_s.le_quad32_to_bytes (Vale.X64.Decls.buffer128_read
                                                          tag_b
                                                          0
                                                          (va_get_mem_heaplet 0 va_old_s))))
                                              (va_QSeq va_range1
                                                  "***** PRECONDITION NOT MET AT line 1048 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                  (va_quick_Load64_stack (va_op_dst_opr64_reg64 rR15
                                                      )
                                                      (va_op_reg_opr64_reg64 rRsp)
                                                      (Vale.X64.Decls.total_if #int
                                                          win
                                                          (224 + 40 + 96)
                                                          (64 + 8 + 80)))
                                                  (va_QBind va_range1
                                                      "***** PRECONDITION NOT MET AT line 1049 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                      (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet
                                                              0)
                                                          (va_op_xmm_xmm 0)
                                                          (va_op_reg_opr64_reg64 rR15)
                                                          0
                                                          Secret
                                                          tag_b
                                                          0)
                                                      (fun (va_s: va_state) _ ->
                                                          va_qAssert va_range1
                                                            "***** PRECONDITION NOT MET AT line 1050 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                            (va_get_xmm 0 va_s ==
                                                              Vale.X64.Decls.buffer128_read tag_b
                                                                0
                                                                (va_get_mem_heaplet 0 va_s))
                                                            (va_qAssert va_range1
                                                                "***** PRECONDITION NOT MET AT line 1051 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                (va_get_xmm 0 va_s ==
                                                                  Vale.X64.Decls.buffer128_read tag_b
                                                                    0
                                                                    (va_get_mem_heaplet 0 va_old_s))
                                                                (let alleged_tag_quad:quad32 =
                                                                    va_get_xmm 0 va_s
                                                                  in
                                                                  let computed_tag:quad32 =
                                                                    va_get_xmm 8 va_s
                                                                  in
                                                                  va_QBind va_range1
                                                                    "***** PRECONDITION NOT MET AT line 1054 column 13 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                    (va_quick_XmmEqual (va_op_xmm_xmm
                                                                            0)
                                                                        (va_op_xmm_xmm 8))
                                                                    (fun (va_s: va_state) _ ->
                                                                        let auth_raw_quads:(FStar.Seq.Base.seq
                                                                            Vale.X64.Decls.quad32) =
                                                                          FStar.Seq.Base.append #Vale.X64.Decls.quad32
                                                                            (Vale.X64.Decls.s128 (va_get_mem_heaplet
                                                                                    1
                                                                                    va_old_s)
                                                                                auth_b)
                                                                            (Vale.X64.Decls.s128 (va_get_mem_heaplet
                                                                                    7
                                                                                    va_old_s)
                                                                                abytes_b)
                                                                        in
                                                                        va_qAssertSquash va_range1
                                                                          "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1057 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                          ((fun
                                                                                a_1582
                                                                                (s_1583:
                                                                                  (FStar.Seq.Base.seq
                                                                                      a_1582))
                                                                                (i_1584: Prims.nat)
                                                                                (j_1585: Prims.nat)
                                                                                ->
                                                                                let j_1545:Prims.nat
                                                                                =
                                                                                  j_1585
                                                                                in
                                                                                Prims.b2t (Prims.op_AmpAmp
                                                                                      (Prims.op_LessThanOrEqual
                                                                                          i_1584
                                                                                          j_1545)
                                                                                      (Prims.op_LessThanOrEqual
                                                                                          j_1545
                                                                                          (FStar.Seq.Base.length
                                                                                              #a_1582
                                                                                              s_1583
                                                                                          )))) Vale.Def.Types_s.nat8
                                                                              (Vale.Def.Types_s.le_seq_quad32_to_bytes
                                                                                  auth_raw_quads)
                                                                              0
                                                                              auth_num_bytes)
                                                                          (fun _ ->
                                                                              let auth_bytes:(FStar.Seq.Base.seq
                                                                                  Vale.Def.Types_s.nat8
                                                                                ) =
                                                                                FStar.Seq.Base.slice
                                                                                  #Vale.Def.Types_s.nat8
                                                                                  (Vale.Def.Types_s.le_seq_quad32_to_bytes
                                                                                      auth_raw_quads
                                                                                  )
                                                                                  0
                                                                                  auth_num_bytes
                                                                              in
                                                                              let cipher_raw_quads:(FStar.Seq.Base.seq
                                                                                  Vale.X64.Decls.quad32
                                                                                ) =
                                                                                FStar.Seq.Base.append
                                                                                  #Vale.X64.Decls.quad32
                                                                                  (FStar.Seq.Base.append
                                                                                      #Vale.X64.Decls.quad32
                                                                                      (Vale.X64.Decls.s128
                                                                                          (va_get_mem_heaplet
                                                                                              6
                                                                                              va_old_s
                                                                                            )
                                                                                          in128x6_b)
                                                                                      (Vale.X64.Decls.s128
                                                                                          (va_get_mem_heaplet
                                                                                              1
                                                                                              va_old_s
                                                                                            )
                                                                                          in128_b))
                                                                                  (Vale.X64.Decls.s128
                                                                                      (va_get_mem_heaplet
                                                                                          5
                                                                                          va_old_s)
                                                                                      inout_b)
                                                                              in
                                                                              va_qAssertSquash va_range1
                                                                                "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 1059 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                ((fun
                                                                                      a_1582
                                                                                      (s_1583:
                                                                                        (FStar.Seq.Base.seq
                                                                                            a_1582))
                                                                                      (i_1584:
                                                                                        Prims.nat)
                                                                                      (j_1585:
                                                                                        Prims.nat)
                                                                                      ->
                                                                                      let j_1545:Prims.nat
                                                                                      =
                                                                                        j_1585
                                                                                      in
                                                                                      Prims.b2t (Prims.op_AmpAmp
                                                                                            (Prims.op_LessThanOrEqual
                                                                                                i_1584
                                                                                                j_1545
                                                                                              )
                                                                                            (Prims.op_LessThanOrEqual
                                                                                                j_1545
                                                                                                (FStar.Seq.Base.length
                                                                                                    #a_1582
                                                                                                    s_1583
                                                                                                  ))
                                                                                        )) Vale.Def.Types_s.nat8
                                                                                    (Vale.Def.Types_s.le_seq_quad32_to_bytes
                                                                                        cipher_raw_quads
                                                                                      )
                                                                                    0
                                                                                    cipher_num_bytes
                                                                                )
                                                                                (fun _ ->
                                                                                    let cipher_bytes:(
                                                                                      FStar.Seq.Base.seq
                                                                                        Vale.Def.Types_s.nat8
                                                                                      ) =
                                                                                      FStar.Seq.Base.slice
                                                                                        #Vale.Def.Types_s.nat8
                                                                                        (Vale.Def.Types_s.le_seq_quad32_to_bytes
                                                                                            cipher_raw_quads
                                                                                          )
                                                                                        0
                                                                                        cipher_num_bytes

                                                                                    in
                                                                                    let va_arg67:Vale.Def.Types_s.quad32
                                                                                    =
                                                                                      computed_tag
                                                                                    in
                                                                                    let va_arg66:Vale.Def.Types_s.quad32
                                                                                    =
                                                                                      alleged_tag_quad
                                                                                    in
                                                                                    let va_arg65:Vale.Def.Words_s.nat64
                                                                                    =
                                                                                      va_get_reg64 rRax
                                                                                        va_s
                                                                                    in
                                                                                    let va_arg64:(FStar.Seq.Base.seq
                                                                                        Vale.Def.Words_s.nat8
                                                                                      ) =
                                                                                      auth_bytes
                                                                                    in
                                                                                    let va_arg63:(FStar.Seq.Base.seq
                                                                                        Vale.Def.Words_s.nat8
                                                                                      ) =
                                                                                      cipher_bytes
                                                                                    in
                                                                                    let va_arg62:Vale.AES.GCM_s.supported_iv_LE
                                                                                    =
                                                                                      iv
                                                                                    in
                                                                                    let va_arg61:(FStar.Seq.Base.seq
                                                                                        Vale.Def.Words_s.nat8
                                                                                      ) =
                                                                                      Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE
                                                                                        key
                                                                                    in
                                                                                    let va_arg60:Vale.AES.AES_common_s.algorithm
                                                                                    =
                                                                                      alg
                                                                                    in
                                                                                    va_qPURE va_range1
                                                                                      "***** PRECONDITION NOT MET AT line 1060 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                      (fun
                                                                                          (_: unit)
                                                                                          ->
                                                                                          Vale.AES.GCM.decrypt_helper
                                                                                            va_arg60
                                                                                            va_arg61
                                                                                            va_arg62
                                                                                            va_arg63
                                                                                            va_arg64
                                                                                            va_arg65
                                                                                            va_arg66
                                                                                            va_arg67
                                                                                      )
                                                                                      (va_QSeq va_range1
                                                                                          "***** PRECONDITION NOT MET AT line 1066 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                          (va_quick_Mov64
                                                                                              (va_op_dst_opr64_reg64
                                                                                                  rRcx
                                                                                                )
                                                                                              (va_op_opr64_reg64
                                                                                                  rRax
                                                                                                ))
                                                                                          (va_QSeq va_range1
                                                                                              "***** PRECONDITION NOT MET AT line 1067 column 22 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                              (va_quick_Restore_registers
                                                                                                  win
                                                                                                  (va_get_reg64
                                                                                                      rRsp
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      6
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      7
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      8
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      9
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      10
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      11
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      12
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      13
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      14
                                                                                                      va_old_s

                                                                                                  )
                                                                                                  (va_get_xmm
                                                                                                      15
                                                                                                      va_old_s

                                                                                                  ))
                                                                                              (va_QSeq
                                                                                                  va_range1
                                                                                                  "***** PRECONDITION NOT MET AT line 1068 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                                  (va_quick_Mov64
                                                                                                      (
                                                                                                        va_op_dst_opr64_reg64
                                                                                                          rRax

                                                                                                      )
                                                                                                      (
                                                                                                        va_op_opr64_reg64
                                                                                                          rRcx

                                                                                                      )

                                                                                                  )
                                                                                                  (va_QSeq
                                                                                                      va_range1
                                                                                                      "***** PRECONDITION NOT MET AT line 1070 column 20 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
                                                                                                      (
                                                                                                        va_quick_DestroyHeaplets
                                                                                                          ()

                                                                                                      )
                                                                                                      (
                                                                                                        va_QEmpty
                                                                                                          (
                                                                                                            ()
                                                                                                          )

                                                                                                      )

                                                                                                  ))
                                                                                          ))))))))))
                                        )))))))))
Vale.AES.X64.GCMdecryptOpt.fst.checked
Vale.X64.State.fsti.checked Vale.X64.Stack_i.fsti.checked Vale.X64.Stack.fsti.checked Vale.X64.QuickCodes.fsti.checked Vale.X64.QuickCode.fst.checked Vale.X64.Memory.fsti.checked Vale.X64.Machine_s.fst.checked Vale.X64.InsVector.fsti.checked Vale.X64.InsStack.fsti.checked Vale.X64.InsMem.fsti.checked Vale.X64.InsBasic.fsti.checked Vale.X64.InsAes.fsti.checked Vale.X64.Flags.fsti.checked Vale.X64.Decls.fsti.checked Vale.X64.CPU_Features_s.fst.checked Vale.Poly1305.Math.fsti.checked Vale.Math.Poly2.Bits_s.fsti.checked Vale.Lib.Meta.fsti.checked Vale.Lib.Basic.fsti.checked Vale.Def.Words_s.fsti.checked Vale.Def.Words.Seq_s.fsti.checked Vale.Def.Types_s.fst.checked Vale.Def.Prop_s.fst.checked Vale.Def.Opaque_s.fsti.checked Vale.Arch.Types.fsti.checked Vale.Arch.HeapImpl.fsti.checked Vale.AES.X64.GHash.fsti.checked Vale.AES.X64.GF128_Mul.fsti.checked Vale.AES.X64.GCTR.fsti.checked Vale.AES.X64.GCMencryptOpt.fsti.checked Vale.AES.X64.AESopt2.fsti.checked Vale.AES.X64.AESopt.fsti.checked Vale.AES.X64.AESGCM.fsti.checked Vale.AES.X64.AES.fsti.checked Vale.AES.OptPublic.fsti.checked Vale.AES.GHash_s.fst.checked Vale.AES.GHash.fsti.checked Vale.AES.GF128_s.fsti.checked Vale.AES.GF128.fsti.checked Vale.AES.GCTR_s.fst.checked Vale.AES.GCTR.fsti.checked Vale.AES.GCM_s.fst.checked Vale.AES.GCM_helpers.fsti.checked Vale.AES.GCM.fsti.checked Vale.AES.AES_s.fst.checked Vale.AES.AES_common_s.fst.checked prims.fst.checked FStar.Seq.Base.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked
Vale.AES.X64.GCMdecryptOpt.fst
Vale.X64.QuickCode.va_mods_t Prims.bool Vale.AES.AES_common_s.algorithm Vale.X64.Memory.buffer128 Vale.X64.Memory.nat64 Vale.AES.GCM_s.supported_iv_LE FStar.Seq.Base.seq Vale.X64.Memory.nat32 Vale.X64.QuickCodes.qblock Prims.unit Prims.Cons Vale.X64.Decls.va_code Vale.X64.InsMem.va_code_CreateHeaplets Vale.X64.Machine_s.Block Vale.X64.Decls.ins Vale.X64.Decls.ocmp Prims.Nil Vale.X64.Machine_s.precode Vale.AES.X64.GCMencryptOpt.va_code_Save_registers Vale.X64.QuickCodes.if_code Vale.X64.QuickCodes.block Vale.X64.InsBasic.va_code_Mov64 Vale.X64.Decls.va_op_dst_opr64_reg64 Vale.X64.Machine_s.rRdi Vale.X64.Decls.va_op_opr64_reg64 Vale.X64.Machine_s.rRcx Vale.X64.Machine_s.rRsi Vale.X64.Machine_s.rRdx Vale.X64.Machine_s.rR8 Vale.X64.Machine_s.rR9 Vale.X64.InsStack.va_code_Load64_stack Vale.X64.Decls.va_op_reg_opr64_reg64 Vale.X64.Machine_s.rRsp Prims.op_Addition Vale.X64.Machine_s.rRbp Vale.AES.X64.GCMdecryptOpt.va_code_Gcm_blocks_wrapped Vale.X64.Decls.total_if Prims.int Vale.X64.Machine_s.rR15 Vale.X64.InsVector.va_code_Load128_buffer Vale.X64.Decls.va_op_heaplet_mem_heaplet Vale.X64.Decls.va_op_xmm_xmm Vale.Arch.HeapTypes_s.Secret Vale.X64.InsVector.va_code_XmmEqual Vale.X64.Machine_s.rRax Vale.AES.X64.GCMencryptOpt.va_code_Restore_registers Vale.X64.InsMem.va_code_DestroyHeaplets Vale.X64.Decls.va_state Vale.X64.QuickCodes.va_QBind Vale.X64.QuickCodes.va_range1 Vale.X64.InsMem.va_quick_CreateHeaplets Vale.Arch.HeapImpl.buffer_info Vale.X64.InsMem.declare_buffer128 Vale.Arch.HeapImpl.Immutable Vale.Arch.HeapTypes_s.Public Vale.Arch.HeapImpl.Mutable Vale.X64.QuickCodes.va_qAssertSquash Vale.AES.AES_s.is_aes_key_LE Prims.squash Vale.X64.QuickCodes.va_qPURE Prims.pure_post Prims.l_and Prims.l_True Prims.l_Forall Prims.l_imp Prims.l_iff Vale.AES.OptPublic.hkeys_reqs_pub Vale.AES.GHash.hkeys_reqs_priv Vale.AES.GHash.lemma_hkeys_reqs_pub_priv Vale.X64.QuickCodes.va_qAssert Prims.b2t Vale.X64.Stack_i.valid_src_stack64 Vale.X64.Decls.va_get_reg64 Vale.X64.Decls.va_get_stack Prims.l_not Vale.AES.X64.GCMencryptOpt.va_quick_Save_registers Vale.X64.QuickCodes.va_qInlineIf Vale.X64.QuickCodes.va_QSeq Vale.X64.InsBasic.va_quick_Mov64 Prims.eq2 Vale.X64.InsStack.va_quick_Load64_stack Vale.X64.QuickCodes.va_QEmpty Vale.X64.QuickCodes.quickCodes Vale.AES.X64.GCMdecryptOpt.va_quick_Gcm_blocks_wrapped Vale.X64.Decls.buffer128_as_seq Vale.X64.Decls.va_get_mem_heaplet Vale.Def.Types_s.le_quad32_to_bytes Vale.X64.Decls.buffer128_read Vale.X64.InsVector.va_quick_Load128_buffer Vale.X64.Decls.quad32 Vale.X64.Decls.va_get_xmm Vale.X64.InsVector.va_quick_XmmEqual Prims.op_AmpAmp Prims.op_LessThanOrEqual FStar.Seq.Base.length Vale.Def.Types_s.nat8 Vale.Def.Types_s.le_seq_quad32_to_bytes Prims.nat Vale.AES.AES_common_s.is_aes_key Prims.op_LessThan Vale.Def.Words_s.nat8 Prims.op_Equality Vale.Def.Types_s.quad32 Prims.op_GreaterThan Prims.logical Vale.AES.GCM.gcm_decrypt_LE_tag FStar.Pervasives.Native.snd Vale.AES.GCM_s.gcm_decrypt_LE Vale.AES.GCM.decrypt_helper Vale.AES.X64.GCMencryptOpt.va_quick_Restore_registers Vale.X64.InsMem.va_quick_DestroyHeaplets Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE Vale.Def.Words_s.nat64 FStar.Seq.Base.slice FStar.Seq.Base.append Vale.X64.Decls.s128 Vale.Def.Types_s.reverse_bytes_quad32 Vale.AES.AES_s.aes_encrypt_LE Vale.Def.Words_s.Mkfour Vale.Def.Types_s.nat32 Vale.X64.Decls.va_int_range Vale.X64.Decls.va_if Vale.X64.Stack_i.load_stack64 Vale.Def.Types_s.nat64 Vale.X64.State.vale_state Vale.X64.QuickCode.va_quickCode Vale.AES.X64.GCMdecryptOpt.va_code_Gcm_blocks_decrypt_stdcall
module Vale.AES.X64.GCMdecryptOpt
open Vale.Def.Prop_s
open Vale.Def.Opaque_s
open FStar.Seq
open Vale.Def.Words_s
open Vale.Def.Words.Seq_s
open Vale.Def.Types_s
open Vale.Arch.Types
open Vale.Arch.HeapImpl
open Vale.AES.AES_s
open Vale.AES.GCTR_s
open Vale.AES.GCTR
open Vale.AES.GCM
open Vale.AES.GHash_s
open Vale.AES.GHash
open Vale.AES.GCM_s
open Vale.AES.X64.AES
open Vale.AES.GF128_s
open Vale.AES.GF128
open Vale.Poly1305.Math
open Vale.AES.GCM_helpers
open Vale.AES.X64.GHash
open Vale.AES.X64.GCTR
open Vale.X64.Machine_s
open Vale.X64.Memory
open Vale.X64.Stack_i
open Vale.X64.State
open Vale.X64.Decls
open Vale.X64.InsBasic
open Vale.X64.InsMem
open Vale.X64.InsVector
open Vale.X64.InsStack
open Vale.X64.InsAes
open Vale.X64.QuickCode
open Vale.X64.QuickCodes
open Vale.AES.X64.GF128_Mul
open Vale.X64.Stack
open Vale.X64.CPU_Features_s
open Vale.Math.Poly2.Bits_s
open Vale.AES.X64.AESopt
open Vale.AES.X64.AESGCM
open Vale.AES.X64.AESopt2
open Vale.Lib.Meta
open Vale.AES.X64.GCMencryptOpt
open Vale.AES.OptPublic
open Vale.Lib.Basic
#reset-options "--z3rlimit 20 --max_ifuel 0"
//-- Gcm_extra_bytes

val va_code_Gcm_extra_bytes : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Gcm_extra_bytes alg =
  (va_Block (va_CCons (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 5) (va_op_xmm_xmm 0)
    (va_op_reg_opr64_reg64 rRax) 0 Secret) (va_CCons (va_code_Mov128 (va_op_xmm_xmm 10)
    (va_op_xmm_xmm 0)) (va_CCons (va_code_Ghash_extra_bytes ()) (va_CCons (va_code_Mov128
    (va_op_xmm_xmm 0) (va_op_xmm_xmm 11)) (va_CCons (va_code_Pshufb (va_op_xmm_xmm 0)
    (va_op_xmm_xmm 9)) (va_CCons (va_code_AESEncryptBlock alg) (va_CCons (va_code_Pxor
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_CCons (va_code_Store128_buffer
    (va_op_heaplet_mem_heaplet 5) (va_op_reg_opr64_reg64 rRax) (va_op_xmm_xmm 10) 0 Secret)
    (va_CNil ()))))))))))

val va_codegen_success_Gcm_extra_bytes : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Gcm_extra_bytes alg =
  (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 5) (va_op_xmm_xmm 0)
    (va_op_reg_opr64_reg64 rRax) 0 Secret) (va_pbool_and (va_codegen_success_Mov128 (va_op_xmm_xmm
    10) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_Ghash_extra_bytes ()) (va_pbool_and
    (va_codegen_success_Mov128 (va_op_xmm_xmm 0) (va_op_xmm_xmm 11)) (va_pbool_and
    (va_codegen_success_Pshufb (va_op_xmm_xmm 0) (va_op_xmm_xmm 9)) (va_pbool_and
    (va_codegen_success_AESEncryptBlock alg) (va_pbool_and (va_codegen_success_Pxor (va_op_xmm_xmm
    10) (va_op_xmm_xmm 0)) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 5) (va_op_reg_opr64_reg64 rRax) (va_op_xmm_xmm 10) 0 Secret)
    (va_ttrue ())))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Gcm_extra_bytes (va_mods:va_mods_t) (alg:algorithm) (inout_b:buffer128) (key:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (total_bytes:nat)
  (old_hash:quad32) (completed_quads:(seq quad32)) (h_LE:quad32) : (va_quickCode unit
  (va_code_Gcm_extra_bytes alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let (len:(va_int_range
    1 1)) = 1 in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 188 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 5) (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64
    rRax) 0 Secret inout_b 0) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 189 column 11 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov128 (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (fun (va_s:va_state) _ -> let
    (hash_input:quad32) = va_get_xmm 0 va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 193 column 22 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Ghash_extra_bytes hkeys_b total_bytes old_hash h_LE completed_quads) (fun
    (va_s:va_state) _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 194 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (FStar.Seq.Base.equal #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s)
    inout_b) (FStar.Seq.Base.create #quad32 1 hash_input)) (let (snap:(FStar.Seq.Base.seq
    Vale.X64.Decls.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s) inout_b in va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 198 column 11 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov128 (va_op_xmm_xmm 0) (va_op_xmm_xmm 11)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 199 column 11 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Pshufb (va_op_xmm_xmm 0) (va_op_xmm_xmm 9)) (fun (va_s:va_state) _ -> va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 200 column 20 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_AESEncryptBlock alg (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 11 va_s)) key
    round_keys keys_b) (fun (va_s:va_state) _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 201 column 26 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_s.aes_encrypt_LE_reveal ()) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 204 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Pxor (va_op_xmm_xmm 10) (va_op_xmm_xmm 0)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 205 column 20 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 5) (va_op_reg_opr64_reg64 rRax)
    (va_op_xmm_xmm 10) 0 Secret inout_b 0) (fun (va_s:va_state) _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 207 column 24 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_reveal ()) (va_QEmpty (()))))))))))))))


val va_lemma_Gcm_extra_bytes : va_b0:va_code -> va_s0:va_state -> alg:algorithm ->
  inout_b:buffer128 -> key:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  hkeys_b:buffer128 -> total_bytes:nat -> old_hash:quad32 -> completed_quads:(seq quad32) ->
  h_LE:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Gcm_extra_bytes alg) va_s0 /\ va_get_ok va_s0 /\ (let
    (len:(va_int_range 1 1)) = 1 in sse_enabled /\ Vale.X64.Decls.buffers_disjoint128 keys_b
    inout_b /\ Vale.X64.Decls.buffers_disjoint128 hkeys_b inout_b /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 5 va_s0) (va_get_reg64 rRax va_s0) inout_b
    len (va_get_mem_layout va_s0) Secret /\ len == Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 inout_b /\ va_get_xmm 9 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\ aes_reqs alg key round_keys
    keys_b (va_get_reg64 rR8 va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\
    pclmulqdq_enabled /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0
    va_s0) hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ va_get_xmm 8 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental0 h_LE old_hash completed_quads) /\ FStar.Seq.Base.length
    #quad32 completed_quads == total_bytes `op_Division` 16 /\ total_bytes < 16 `op_Multiply`
    FStar.Seq.Base.length #quad32 completed_quads + 16 /\ va_get_reg64 rR10 va_s0 == total_bytes
    `op_Modulus` 16 /\ total_bytes `op_Modulus` 16 =!= 0 /\ (0 < total_bytes /\ total_bytes < 16
    `op_Multiply` Vale.AES.GCM_helpers.bytes_to_quad_size total_bytes) /\ 16 `op_Multiply`
    (Vale.AES.GCM_helpers.bytes_to_quad_size total_bytes - 1) < total_bytes)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (let (len:(va_int_range 1 1)) = 1 in Vale.X64.Decls.modifies_buffer128 inout_b
    (va_get_mem_heaplet 5 va_s0) (va_get_mem_heaplet 5 va_sM) /\ Vale.AES.GCTR.gctr_partial alg len
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_sM) inout_b) key (va_get_xmm 11 va_s0) /\ (let raw_quads =
    FStar.Seq.Base.append #quad32 completed_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0)
    inout_b) in let input_bytes = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes raw_quads) 0 total_bytes in let padded_bytes =
    Vale.AES.GCTR_s.pad_to_128_bits input_bytes in let input_quads =
    Vale.Def.Types_s.le_bytes_to_seq_quad32 padded_bytes in l_and (FStar.Seq.Base.length
    #Vale.Def.Types_s.quad32 input_quads > 0) (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8
    va_sM) == Vale.AES.GHash.ghash_incremental h_LE old_hash input_quads))) /\ va_state_eq va_sM
    (va_update_flags va_sM (va_update_mem_heaplet 5 va_sM (va_update_xmm 10 va_sM (va_update_xmm 8
    va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4
    va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0
    va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rRcx va_sM (va_update_ok va_sM
    (va_update_mem va_sM va_s0))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Gcm_extra_bytes va_b0 va_s0 alg inout_b key round_keys keys_b hkeys_b total_bytes
  old_hash completed_quads h_LE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 5; va_Mod_xmm 10; va_Mod_xmm 8;
    va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm
    1; va_Mod_xmm 0; va_Mod_reg64 rR11; va_Mod_reg64 rRcx; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Gcm_extra_bytes va_mods alg inout_b key round_keys keys_b hkeys_b
    total_bytes old_hash completed_quads h_LE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Gcm_extra_bytes alg) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 121 column 1 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_ok va_sM) /\ (let (len:(va_int_range 1 1)) = 1 in label va_range1
    "***** POSTCONDITION NOT MET AT line 174 column 55 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 inout_b (va_get_mem_heaplet 5 va_s0) (va_get_mem_heaplet 5
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 177 column 95 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.AES.GCTR.gctr_partial alg len (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_sM) inout_b) key (va_get_xmm 11 va_s0)) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 180 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let raw_quads = FStar.Seq.Base.append #quad32 completed_quads (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_s0) inout_b) in label va_range1
    "***** POSTCONDITION NOT MET AT line 181 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let input_bytes = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes raw_quads) 0 total_bytes in label va_range1
    "***** POSTCONDITION NOT MET AT line 182 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let padded_bytes = Vale.AES.GCTR_s.pad_to_128_bits input_bytes in label va_range1
    "***** POSTCONDITION NOT MET AT line 183 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let input_quads = Vale.Def.Types_s.le_bytes_to_seq_quad32 padded_bytes in label va_range1
    "***** POSTCONDITION NOT MET AT line 186 column 59 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (l_and (FStar.Seq.Base.length #Vale.Def.Types_s.quad32 input_quads > 0)
    (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_sM) == Vale.AES.GHash.ghash_incremental
    h_LE old_hash input_quads)))))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 5; va_Mod_xmm 10; va_Mod_xmm 8; va_Mod_xmm
    7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_xmm 0; va_Mod_reg64 rR11; va_Mod_reg64 rRcx; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Gcm_extra_bytes (alg:algorithm) (inout_b:buffer128) (key:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (total_bytes:nat) (old_hash:quad32)
  (completed_quads:(seq quad32)) (h_LE:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0))
  : Type0 =
  (va_get_ok va_s0 /\ (let (len:(va_int_range 1 1)) = 1 in sse_enabled /\
    Vale.X64.Decls.buffers_disjoint128 keys_b inout_b /\ Vale.X64.Decls.buffers_disjoint128 hkeys_b
    inout_b /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 5 va_s0) (va_get_reg64 rRax
    va_s0) inout_b len (va_get_mem_layout va_s0) Secret /\ len == Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 inout_b /\ va_get_xmm 9 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\ aes_reqs alg key round_keys
    keys_b (va_get_reg64 rR8 va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\
    pclmulqdq_enabled /\ Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0
    va_s0) hkeys_b) (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret /\ va_get_xmm 8 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental0 h_LE old_hash completed_quads) /\ FStar.Seq.Base.length
    #quad32 completed_quads == total_bytes `op_Division` 16 /\ total_bytes < 16 `op_Multiply`
    FStar.Seq.Base.length #quad32 completed_quads + 16 /\ va_get_reg64 rR10 va_s0 == total_bytes
    `op_Modulus` 16 /\ total_bytes `op_Modulus` 16 =!= 0 /\ (0 < total_bytes /\ total_bytes < 16
    `op_Multiply` Vale.AES.GCM_helpers.bytes_to_quad_size total_bytes) /\ 16 `op_Multiply`
    (Vale.AES.GCM_helpers.bytes_to_quad_size total_bytes - 1) < total_bytes) /\ (forall
    (va_x_mem:vale_heap) (va_x_rcx:nat64) (va_x_r11:nat64) (va_x_xmm0:quad32) (va_x_xmm1:quad32)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm10:quad32) (va_x_heap5:vale_heap)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_mem_heaplet 5
    va_x_heap5 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7
    (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3
    (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1 va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR11
    va_x_r11 (va_upd_reg64 rRcx va_x_rcx (va_upd_mem va_x_mem va_s0)))))))))))))) in va_get_ok
    va_sM /\ (let (len:(va_int_range 1 1)) = 1 in Vale.X64.Decls.modifies_buffer128 inout_b
    (va_get_mem_heaplet 5 va_s0) (va_get_mem_heaplet 5 va_sM) /\ Vale.AES.GCTR.gctr_partial alg len
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_sM) inout_b) key (va_get_xmm 11 va_s0) /\ (let raw_quads =
    FStar.Seq.Base.append #quad32 completed_quads (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0)
    inout_b) in let input_bytes = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes raw_quads) 0 total_bytes in let padded_bytes =
    Vale.AES.GCTR_s.pad_to_128_bits input_bytes in let input_quads =
    Vale.Def.Types_s.le_bytes_to_seq_quad32 padded_bytes in l_and (FStar.Seq.Base.length
    #Vale.Def.Types_s.quad32 input_quads > 0) (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8
    va_sM) == Vale.AES.GHash.ghash_incremental h_LE old_hash input_quads))) ==> va_k va_sM (())))


val va_wpProof_Gcm_extra_bytes : alg:algorithm -> inout_b:buffer128 -> key:(seq nat32) ->
  round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 -> total_bytes:nat ->
  old_hash:quad32 -> completed_quads:(seq quad32) -> h_LE:quad32 -> va_s0:va_state ->
  va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Gcm_extra_bytes alg inout_b key round_keys keys_b hkeys_b
    total_bytes old_hash completed_quads h_LE va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Gcm_extra_bytes alg) ([va_Mod_flags;
    va_Mod_mem_heaplet 5; va_Mod_xmm 10; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR11;
    va_Mod_reg64 rRcx; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Gcm_extra_bytes alg inout_b key round_keys keys_b hkeys_b total_bytes old_hash
  completed_quads h_LE va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Gcm_extra_bytes (va_code_Gcm_extra_bytes alg) va_s0 alg inout_b key
    round_keys keys_b hkeys_b total_bytes old_hash completed_quads h_LE in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 5 va_sM (va_update_xmm 10
    va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5
    va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rRcx va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 5; va_Mod_xmm 10; va_Mod_xmm 8; va_Mod_xmm
    7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1;
    va_Mod_xmm 0; va_Mod_reg64 rR11; va_Mod_reg64 rRcx; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Gcm_extra_bytes (alg:algorithm) (inout_b:buffer128) (key:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (total_bytes:nat) (old_hash:quad32)
  (completed_quads:(seq quad32)) (h_LE:quad32) : (va_quickCode unit (va_code_Gcm_extra_bytes alg)) =
  (va_QProc (va_code_Gcm_extra_bytes alg) ([va_Mod_flags; va_Mod_mem_heaplet 5; va_Mod_xmm 10;
    va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm
    2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR11; va_Mod_reg64 rRcx; va_Mod_mem])
    (va_wp_Gcm_extra_bytes alg inout_b key round_keys keys_b hkeys_b total_bytes old_hash
    completed_quads h_LE) (va_wpProof_Gcm_extra_bytes alg inout_b key round_keys keys_b hkeys_b
    total_bytes old_hash completed_quads h_LE))
//--
//-- Gcm_blocks128

val va_code_Gcm_blocks128 : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Gcm_blocks128 alg =
  (va_Block (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rRbx) (va_op_opr64_reg64 rRdi))
    (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rR12) (va_op_opr64_reg64 rRdx)) (va_CCons
    (va_code_Mov64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRax)) (va_CCons
    (va_code_Ghash_buffer ()) (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rRdi)
    (va_op_opr64_reg64 rRbx)) (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rRdx)
    (va_op_opr64_reg64 rR12)) (va_CCons (va_code_Gctr_blocks128 alg) (va_CNil ())))))))))

val va_codegen_success_Gcm_blocks128 : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Gcm_blocks128 alg =
  (va_pbool_and (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rRbx) (va_op_opr64_reg64 rRdi))
    (va_pbool_and (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rR12) (va_op_opr64_reg64 rRdx))
    (va_pbool_and (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRax))
    (va_pbool_and (va_codegen_success_Ghash_buffer ()) (va_pbool_and (va_codegen_success_Mov64
    (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRbx)) (va_pbool_and (va_codegen_success_Mov64
    (va_op_dst_opr64_reg64 rRdx) (va_op_opr64_reg64 rR12)) (va_pbool_and
    (va_codegen_success_Gctr_blocks128 alg) (va_ttrue ()))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Gcm_blocks128 (va_mods:va_mods_t) (alg:algorithm) (in_b:buffer128) (out_b:buffer128)
  (key:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (h_LE:quad32)
  : (va_quickCode unit (va_code_Gcm_blocks128 alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 274 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRbx) (va_op_opr64_reg64 rRdi)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 275 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rR12) (va_op_opr64_reg64 rRdx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 276 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRax)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 277 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Ghash_buffer hkeys_b in_b h_LE (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8
    va_old_s))) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 278 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRbx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 279 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRdx) (va_op_opr64_reg64 rR12)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 280 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gctr_blocks128 alg in_b out_b key round_keys keys_b) (va_QEmpty (()))))))))))


val va_lemma_Gcm_blocks128 : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> in_b:buffer128 ->
  out_b:buffer128 -> key:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  hkeys_b:buffer128 -> h_LE:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Gcm_blocks128 alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.buffers_disjoint128 keys_b out_b /\
    Vale.X64.Decls.buffers_disjoint128 hkeys_b out_b /\ (Vale.X64.Decls.buffers_disjoint128 in_b
    out_b \/ in_b == out_b) /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 1 va_s0)
    (va_get_reg64 rRax va_s0) in_b (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 1 va_s0) (va_get_reg64 rRdi va_s0) out_b
    (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\ va_get_reg64 rRax va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64 rRdi va_s0 + 16 `op_Multiply`
    va_get_reg64 rRdx va_s0 < pow2_64 /\ l_and (Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 in_b == Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 out_b)
    (Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in_b < pow2_32) /\ va_get_reg64 rRdx
    va_s0 == Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in_b /\ va_get_xmm 9 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\
    va_get_reg64 rRdx va_s0 < pow2_32 /\ aes_reqs alg key round_keys keys_b (va_get_reg64 rR8
    va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ pclmulqdq_enabled /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer128 out_b (va_get_mem_heaplet 1 va_s0) (va_get_mem_heaplet 1
    va_sM) /\ Vale.AES.GCTR.gctr_partial alg (va_get_reg64 rRdx va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out_b) key
    (va_get_xmm 11 va_s0) /\ va_get_xmm 11 va_sM == Vale.AES.GCTR.inc32lite (va_get_xmm 11 va_s0)
    (va_get_reg64 rRdx va_s0) /\ (va_get_reg64 rRdx va_s0 == 0 ==> l_and (va_get_xmm 8 va_sM ==
    va_get_xmm 8 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out_b ==
    Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) out_b)) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    l_and (va_get_reg64 rRdx va_s0 <= FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in_b) ==> FStar.Seq.Base.length
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b) 0 (va_get_reg64 rRdx va_s0)) > 0)
    (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_sM) == Vale.AES.GHash.ghash_incremental
    h_LE (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s0)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b)))) /\ va_state_eq va_sM (va_update_flags va_sM
    (va_update_mem_heaplet 1 va_sM (va_update_xmm 10 va_sM (va_update_xmm 11 va_sM (va_update_xmm 8
    va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4
    va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0
    va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rRdx va_sM (va_update_reg64 rR10 va_sM
    (va_update_reg64 rR11 va_sM (va_update_reg64 rRdi va_sM (va_update_reg64 rRbx va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Gcm_blocks128 va_b0 va_s0 alg in_b out_b key round_keys keys_b hkeys_b h_LE =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 1; va_Mod_xmm 10; va_Mod_xmm 11;
    va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm
    2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR12; va_Mod_reg64 rRdx; va_Mod_reg64 rR10;
    va_Mod_reg64 rR11; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Gcm_blocks128 va_mods alg in_b out_b key round_keys keys_b hkeys_b h_LE in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Gcm_blocks128 alg) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 210 column 1 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 255 column 53 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 out_b (va_get_mem_heaplet 1 va_s0) (va_get_mem_heaplet 1
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 261 column 95 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.AES.GCTR.gctr_partial alg (va_get_reg64 rRdx va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out_b) key
    (va_get_xmm 11 va_s0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 262 column 45 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_xmm 11 va_sM == Vale.AES.GCTR.inc32lite (va_get_xmm 11 va_s0) (va_get_reg64 rRdx
    va_s0)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 265 column 93 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_reg64 rRdx va_s0 == 0 ==> l_and (va_get_xmm 8 va_sM == va_get_xmm 8 va_s0)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out_b == Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) out_b)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 267 column 131 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_reg64 rRdx va_s0 > 0 ==> l_and (va_get_reg64 rRdx va_s0 <= FStar.Seq.Base.length
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in_b) ==>
    FStar.Seq.Base.length #Vale.X64.Decls.quad32 (FStar.Seq.Base.slice #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in_b) 0 (va_get_reg64 rRdx va_s0)) > 0)
    (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_sM) == Vale.AES.GHash.ghash_incremental
    h_LE (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s0)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 1; va_Mod_xmm 10; va_Mod_xmm 11; va_Mod_xmm
    8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2;
    va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR12; va_Mod_reg64 rRdx; va_Mod_reg64 rR10;
    va_Mod_reg64 rR11; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Gcm_blocks128 (alg:algorithm) (in_b:buffer128) (out_b:buffer128) (key:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (h_LE:quad32) (va_s0:va_state)
  (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.buffers_disjoint128 keys_b out_b /\
    Vale.X64.Decls.buffers_disjoint128 hkeys_b out_b /\ (Vale.X64.Decls.buffers_disjoint128 in_b
    out_b \/ in_b == out_b) /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 1 va_s0)
    (va_get_reg64 rRax va_s0) in_b (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 1 va_s0) (va_get_reg64 rRdi va_s0) out_b
    (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\ va_get_reg64 rRax va_s0 + 16
    `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ va_get_reg64 rRdi va_s0 + 16 `op_Multiply`
    va_get_reg64 rRdx va_s0 < pow2_64 /\ l_and (Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 in_b == Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 out_b)
    (Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in_b < pow2_32) /\ va_get_reg64 rRdx
    va_s0 == Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in_b /\ va_get_xmm 9 va_s0 ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 202182159 134810123 67438087 66051 /\
    va_get_reg64 rRdx va_s0 < pow2_32 /\ aes_reqs alg key round_keys keys_b (va_get_reg64 rR8
    va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ pclmulqdq_enabled /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0 - 32) hkeys_b 8 (va_get_mem_layout va_s0)
    Secret) /\ (forall (va_x_mem:vale_heap) (va_x_rbx:nat64) (va_x_rdi:nat64) (va_x_r11:nat64)
    (va_x_r10:nat64) (va_x_rdx:nat64) (va_x_r12:nat64) (va_x_xmm0:quad32) (va_x_xmm1:quad32)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm11:quad32) (va_x_xmm10:quad32)
    (va_x_heap1:vale_heap) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl
    (va_upd_mem_heaplet 1 va_x_heap1 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 11 va_x_xmm11
    (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5
    (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1 va_x_xmm1
    (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64
    rR10 va_x_r10 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRdi va_x_rdi (va_upd_reg64 rRbx
    va_x_rbx (va_upd_mem va_x_mem va_s0))))))))))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer128 out_b (va_get_mem_heaplet 1 va_s0) (va_get_mem_heaplet 1
    va_sM) /\ Vale.AES.GCTR.gctr_partial alg (va_get_reg64 rRdx va_s0) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out_b) key
    (va_get_xmm 11 va_s0) /\ va_get_xmm 11 va_sM == Vale.AES.GCTR.inc32lite (va_get_xmm 11 va_s0)
    (va_get_reg64 rRdx va_s0) /\ (va_get_reg64 rRdx va_s0 == 0 ==> l_and (va_get_xmm 8 va_sM ==
    va_get_xmm 8 va_s0) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out_b ==
    Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) out_b)) /\ (va_get_reg64 rRdx va_s0 > 0 ==>
    l_and (va_get_reg64 rRdx va_s0 <= FStar.Seq.Base.length #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in_b) ==> FStar.Seq.Base.length
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b) 0 (va_get_reg64 rRdx va_s0)) > 0)
    (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_sM) == Vale.AES.GHash.ghash_incremental
    h_LE (Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s0)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in_b)))) ==> va_k va_sM (())))


val va_wpProof_Gcm_blocks128 : alg:algorithm -> in_b:buffer128 -> out_b:buffer128 -> key:(seq
  nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 -> h_LE:quad32 ->
  va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Gcm_blocks128 alg in_b out_b key round_keys keys_b hkeys_b
    h_LE va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Gcm_blocks128 alg) ([va_Mod_flags;
    va_Mod_mem_heaplet 1; va_Mod_xmm 10; va_Mod_xmm 11; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6;
    va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0;
    va_Mod_reg64 rR12; va_Mod_reg64 rRdx; va_Mod_reg64 rR10; va_Mod_reg64 rR11; va_Mod_reg64 rRdi;
    va_Mod_reg64 rRbx; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Gcm_blocks128 alg in_b out_b key round_keys keys_b hkeys_b h_LE va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Gcm_blocks128 (va_code_Gcm_blocks128 alg) va_s0 alg in_b out_b key
    round_keys keys_b hkeys_b h_LE in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 1 va_sM (va_update_xmm 10
    va_sM (va_update_xmm 11 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6
    va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2
    va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR12 va_sM
    (va_update_reg64 rRdx va_sM (va_update_reg64 rR10 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rRdi va_sM (va_update_reg64 rRbx va_sM (va_update_ok va_sM (va_update_mem
    va_sM va_s0))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 1; va_Mod_xmm 10; va_Mod_xmm 11; va_Mod_xmm
    8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2;
    va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR12; va_Mod_reg64 rRdx; va_Mod_reg64 rR10;
    va_Mod_reg64 rR11; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Gcm_blocks128 (alg:algorithm) (in_b:buffer128) (out_b:buffer128) (key:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (h_LE:quad32) : (va_quickCode
  unit (va_code_Gcm_blocks128 alg)) =
  (va_QProc (va_code_Gcm_blocks128 alg) ([va_Mod_flags; va_Mod_mem_heaplet 1; va_Mod_xmm 10;
    va_Mod_xmm 11; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR12; va_Mod_reg64 rRdx; va_Mod_reg64
    rR10; va_Mod_reg64 rR11; va_Mod_reg64 rRdi; va_Mod_reg64 rRbx; va_Mod_mem])
    (va_wp_Gcm_blocks128 alg in_b out_b key round_keys keys_b hkeys_b h_LE)
    (va_wpProof_Gcm_blocks128 alg in_b out_b key round_keys keys_b hkeys_b h_LE))
//--
//-- Gcm_blocks
#push-options "--z3rlimit 1000"

val va_code_Gcm_blocks : alg:algorithm -> offset:int -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Gcm_blocks alg offset =
  (va_Block (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rR13) (va_op_opr64_reg64 rRcx))
    (va_CCons (va_code_AddLea64 (va_op_dst_opr64_reg64 rR9) (va_op_opr64_reg64 rR9) (va_const_opr64
    32)) (va_CCons (va_code_Load64_stack (va_op_dst_opr64_reg64 rRbx) (va_op_reg_opr64_reg64 rRsp)
    (offset + 0)) (va_CCons (va_code_Gcm_blocks_auth ()) (va_CCons (va_code_Load64_stack
    (va_op_dst_opr64_reg64 rRdi) (va_op_reg_opr64_reg64 rRsp) (offset + 8)) (va_CCons
    (va_code_Load64_stack (va_op_dst_opr64_reg64 rRsi) (va_op_reg_opr64_reg64 rRsp) (offset + 16))
    (va_CCons (va_code_Load64_stack (va_op_dst_opr64_reg64 rRdx) (va_op_reg_opr64_reg64 rRsp)
    (offset + 24)) (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rR13))
    (va_CCons (va_code_Mov128 (va_op_xmm_xmm 0) (va_op_xmm_xmm 9)) (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 2) (va_op_xmm_xmm 1) (va_op_reg_opr64_reg64
    rR8) 0 Public) (va_CCons (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 1) 0 Secret) (va_CCons (va_code_Load_one_lsb
    (va_op_xmm_xmm 10)) (va_CCons (va_code_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 1)
    (va_op_xmm_xmm 10)) (va_CCons (va_code_AES_GCM_decrypt_6mult alg) (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 11) (va_op_reg_opr64_reg64
    rRbp) 32 Secret) (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rR8) (va_op_opr64_reg64 rRcx))
    (va_CCons (va_code_Load64_stack (va_op_dst_opr64_reg64 rRax) (va_op_reg_opr64_reg64 rRsp)
    (offset + 32)) (va_CCons (va_code_Load64_stack (va_op_dst_opr64_reg64 rRdi)
    (va_op_reg_opr64_reg64 rRsp) (offset + 40)) (va_CCons (va_code_Load64_stack
    (va_op_dst_opr64_reg64 rRdx) (va_op_reg_opr64_reg64 rRsp) (offset + 48)) (va_CCons
    (va_code_Mov64 (va_op_dst_opr64_reg64 rR14) (va_op_opr64_reg64 rRdx)) (va_CCons
    (va_code_InitPshufbMask (va_op_xmm_xmm 9) (va_op_reg_opr64_reg64 rR12)) (va_CCons
    (va_code_Pshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 9)) (va_CCons (va_code_Gcm_blocks128 alg)
    (va_CCons (va_code_Stack_lemma ()) (va_CCons (va_code_Add64 (va_op_dst_opr64_reg64 rR14)
    (va_opr_code_Stack (va_op_reg64_reg64 rRsp) (offset + 24) Public)) (va_CCons (va_code_IMul64
    (va_op_dst_opr64_reg64 rR14) (va_const_opr64 16)) (va_CCons (va_code_Load64_stack
    (va_op_dst_opr64_reg64 rR13) (va_op_reg_opr64_reg64 rRsp) (offset + 64)) (va_CCons (va_IfElse
    (va_cmp_gt (va_op_cmp_reg64 rR13) (va_op_cmp_reg64 rR14)) (va_Block (va_CCons
    (va_code_Load64_stack (va_op_dst_opr64_reg64 rRax) (va_op_reg_opr64_reg64 rRsp) (offset + 56))
    (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rR10) (va_op_opr64_reg64 rR13)) (va_CCons
    (va_code_And64 (va_op_dst_opr64_reg64 rR10) (va_const_opr64 15)) (va_CCons
    (va_code_Gcm_extra_bytes alg) (va_CCons (va_Block (va_CNil ())) (va_CNil ()))))))) (va_Block
    (va_CNil ()))) (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rR11) (va_op_opr64_reg64 rR15))
    (va_CCons (va_code_Gcm_make_length_quad ()) (va_CCons (va_code_Ghash_register ()) (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64
    rRbp) 0 Secret) (va_CCons (va_code_Gctr_register alg) (va_CCons (va_Block (va_CNil ()))
    (va_CNil ()))))))))))))))))))))))))))))))))))))

val va_codegen_success_Gcm_blocks : alg:algorithm -> offset:int -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Gcm_blocks alg offset =
  (va_pbool_and (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rR13) (va_op_opr64_reg64 rRcx))
    (va_pbool_and (va_codegen_success_AddLea64 (va_op_dst_opr64_reg64 rR9) (va_op_opr64_reg64 rR9)
    (va_const_opr64 32)) (va_pbool_and (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64
    rRbx) (va_op_reg_opr64_reg64 rRsp) (offset + 0)) (va_pbool_and
    (va_codegen_success_Gcm_blocks_auth ()) (va_pbool_and (va_codegen_success_Load64_stack
    (va_op_dst_opr64_reg64 rRdi) (va_op_reg_opr64_reg64 rRsp) (offset + 8)) (va_pbool_and
    (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rRsi) (va_op_reg_opr64_reg64 rRsp)
    (offset + 16)) (va_pbool_and (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rRdx)
    (va_op_reg_opr64_reg64 rRsp) (offset + 24)) (va_pbool_and (va_codegen_success_Mov64
    (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rR13)) (va_pbool_and (va_codegen_success_Mov128
    (va_op_xmm_xmm 0) (va_op_xmm_xmm 9)) (va_pbool_and (va_codegen_success_Load128_buffer
    (va_op_heaplet_mem_heaplet 2) (va_op_xmm_xmm 1) (va_op_reg_opr64_reg64 rR8) 0 Public)
    (va_pbool_and (va_codegen_success_Store128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 1) 0 Secret) (va_pbool_and
    (va_codegen_success_Load_one_lsb (va_op_xmm_xmm 10)) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 10)) (va_pbool_and
    (va_codegen_success_AES_GCM_decrypt_6mult alg) (va_pbool_and (va_codegen_success_Load128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 11) (va_op_reg_opr64_reg64 rRbp) 32 Secret)
    (va_pbool_and (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rR8) (va_op_opr64_reg64 rRcx))
    (va_pbool_and (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rRax)
    (va_op_reg_opr64_reg64 rRsp) (offset + 32)) (va_pbool_and (va_codegen_success_Load64_stack
    (va_op_dst_opr64_reg64 rRdi) (va_op_reg_opr64_reg64 rRsp) (offset + 40)) (va_pbool_and
    (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rRdx) (va_op_reg_opr64_reg64 rRsp)
    (offset + 48)) (va_pbool_and (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rR14)
    (va_op_opr64_reg64 rRdx)) (va_pbool_and (va_codegen_success_InitPshufbMask (va_op_xmm_xmm 9)
    (va_op_reg_opr64_reg64 rR12)) (va_pbool_and (va_codegen_success_Pshufb (va_op_xmm_xmm 11)
    (va_op_xmm_xmm 9)) (va_pbool_and (va_codegen_success_Gcm_blocks128 alg) (va_pbool_and
    (va_codegen_success_Stack_lemma ()) (va_pbool_and (va_codegen_success_Add64
    (va_op_dst_opr64_reg64 rR14) (va_opr_code_Stack (va_op_reg64_reg64 rRsp) (offset + 24) Public))
    (va_pbool_and (va_codegen_success_IMul64 (va_op_dst_opr64_reg64 rR14) (va_const_opr64 16))
    (va_pbool_and (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rR13)
    (va_op_reg_opr64_reg64 rRsp) (offset + 64)) (va_pbool_and (va_pbool_and
    (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rRax) (va_op_reg_opr64_reg64 rRsp)
    (offset + 56)) (va_pbool_and (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rR10)
    (va_op_opr64_reg64 rR13)) (va_pbool_and (va_codegen_success_And64 (va_op_dst_opr64_reg64 rR10)
    (va_const_opr64 15)) (va_codegen_success_Gcm_extra_bytes alg)))) (va_pbool_and
    (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rR11) (va_op_opr64_reg64 rR15)) (va_pbool_and
    (va_codegen_success_Gcm_make_length_quad ()) (va_pbool_and (va_codegen_success_Ghash_register
    ()) (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 3)
    (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64 rRbp) 0 Secret) (va_pbool_and
    (va_codegen_success_Gctr_register alg) (va_ttrue ()))))))))))))))))))))))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Gcm_blocks (va_mods:va_mods_t) (alg:algorithm) (offset:int) (auth_b:buffer128)
  (abytes_b:buffer128) (in128x6_b:buffer128) (out128x6_b:buffer128) (in128_b:buffer128)
  (out128_b:buffer128) (inout_b:buffer128) (iv_b:buffer128) (scratch_b:buffer128) (key:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) : (va_quickCode unit
  (va_code_Gcm_blocks alg offset)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s +
    offset + 0) (va_get_stack va_s) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 8) (va_get_stack va_s) in let
    (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s +
    offset + 16) (va_get_stack va_s) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 24) (va_get_stack va_s) in let
    (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s +
    offset + 32) (va_get_stack va_s) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 40) (va_get_stack va_s) in let
    (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset
    + 48) (va_get_stack va_s) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 56) (va_get_stack va_s) in let
    (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s
    + offset + 64) (va_get_stack va_s) in let (h_LE:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read hkeys_b 2
    (va_get_mem_heaplet 0 va_old_s)) in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 463 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rR13) (va_op_opr64_reg64 rRcx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 464 column 13 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_AddLea64 (va_op_dst_opr64_reg64 rR9) (va_op_opr64_reg64 rR9) (va_const_opr64 32))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 465 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRbx) (va_op_reg_opr64_reg64 rRsp) (offset + 0))
    (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 466 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gcm_blocks_auth auth_b abytes_b hkeys_b h_LE) (fun (va_s:va_state)
    (auth_quad_seq:(seq quad32)) -> let (y_0:quad32) = Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0 in let (y_auth_bytes:quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s) in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 473 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRdi) (va_op_reg_opr64_reg64 rRsp) (offset + 8))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 474 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRsi) (va_op_reg_opr64_reg64 rRsp) (offset + 16))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 475 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRdx) (va_op_reg_opr64_reg64 rRsp) (offset + 24))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 476 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rR13)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 477 column 11 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov128 (va_op_xmm_xmm 0) (va_op_xmm_xmm 9)) (fun (va_s:va_state) _ -> let
    (iv_BE:Vale.X64.Decls.quad32) = Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2
    va_old_s) in let (ctr_BE_1:quad32) = iv_BE in let (ctr_BE_2:quad32) = Vale.AES.GCTR_s.inc32
    iv_BE 1 in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 483 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 2) (va_op_xmm_xmm 1) (va_op_reg_opr64_reg64
    rR8) 0 Public iv_b 0) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 485 column 20 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 1) 0 Secret scratch_b 0) (fun (va_s:va_state) _ -> let (j0:quad32) = va_get_xmm
    1 va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 487 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load_one_lsb (va_op_xmm_xmm 10)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 489 column 11 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 1) (va_op_xmm_xmm 1) (va_op_xmm_xmm 10)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 491 column 26 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_AES_GCM_decrypt_6mult alg h_LE iv_b in128x6_b out128x6_b scratch_b key round_keys
    keys_b hkeys_b) (fun (va_s:va_state) _ -> let (y_cipher128x6:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s) in let (auth_in:(seq quad32)) =
    auth_quad_seq in let (va_arg138:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) =
    Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in128x6_b in let
    (va_arg137:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = auth_in in let
    (va_arg136:Vale.Def.Types_s.quad32) = y_auth_bytes in let (va_arg135:Vale.Def.Types_s.quad32) =
    y_0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 494 column 36 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_ghash_incremental0_append h_LE va_arg135 va_arg136
    y_cipher128x6 va_arg137 va_arg138) (let auth_in = FStar.Seq.Base.append #quad32 auth_in
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in128x6_b) in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 498 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 11)
    (va_op_reg_opr64_reg64 rRbp) 32 Secret scratch_b 2) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 499 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rR8) (va_op_opr64_reg64 rRcx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 500 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRax) (va_op_reg_opr64_reg64 rRsp) (offset + 32))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 501 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRdi) (va_op_reg_opr64_reg64 rRsp) (offset + 40))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 502 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRdx) (va_op_reg_opr64_reg64 rRsp) (offset + 48))
    (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 503 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rR14) (va_op_opr64_reg64 rRdx)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 504 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_InitPshufbMask (va_op_xmm_xmm 9) (va_op_reg_opr64_reg64 rR12)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 505 column 11 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Pshufb (va_op_xmm_xmm 11) (va_op_xmm_xmm 9)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 506 column 18 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gcm_blocks128 alg in128_b out128_b key round_keys keys_b hkeys_b h_LE) (fun
    (va_s:va_state) _ -> let (y_cipher128:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s) in let (va_arg134:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_old_s) in128_b in let
    (va_arg133:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = auth_in in let
    (va_arg132:Vale.Def.Types_s.quad32) = y_0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 508 column 36 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_ghash_incremental0_append h_LE va_arg132 y_cipher128x6
    y_cipher128 va_arg133 va_arg134) (let auth_in = FStar.Seq.Base.append #quad32 auth_in
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_old_s) in128_b) in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 512 column 22 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Stack_lemma (va_op_reg64_reg64 rRsp) (offset + 24) Public) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 512 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Add64 (va_op_dst_opr64_reg64 rR14) (va_opr_code_Stack (va_op_reg64_reg64 rRsp)
    (offset + 24) Public)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 513 column 11 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_IMul64 (va_op_dst_opr64_reg64 rR14) (va_const_opr64 16)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 514 column 17 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rR13) (va_op_reg_opr64_reg64 rRsp) (offset + 64))
    (fun (va_s:va_state) _ -> let (y_inout:Vale.Def.Types_s.quad32) = y_cipher128 in let
    (plain_byte_seq:(seq quad32)) = empty_seq_quad32 in let (cipher_byte_seq:(seq quad32)) =
    empty_seq_quad32 in let (va_arg131:Vale.Def.Types_s.quad32) = va_get_xmm 11 va_s in let
    (va_arg130:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key in let
    (va_arg129:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = cipher_byte_seq in let
    (va_arg128:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = plain_byte_seq in let
    (va_arg127:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 519 column 29 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.gctr_partial_opaque_init va_arg127 va_arg128 va_arg129 va_arg130
    va_arg131) (let (total_bytes:(va_int_at_least 0)) = FStar.Seq.Base.length #quad32 auth_quad_seq
    `op_Multiply` 16 + plain_num_bytes in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 523 column 8 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_qIf va_mods (Cmp_gt (va_op_cmp_reg64 rR13) (va_op_cmp_reg64 rR14)) (qblock va_mods (fun
    (va_s:va_state) -> va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 525 column 21 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load64_stack (va_op_dst_opr64_reg64 rRax) (va_op_reg_opr64_reg64 rRsp) (offset + 56))
    (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 526 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rR10) (va_op_opr64_reg64 rR13)) (fun (va_s:va_state) _
    -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 527 column 26 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.Poly1305.Math.lemma_poly_bits64 ()) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 528 column 14 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_And64 (va_op_dst_opr64_reg64 rR10) (va_const_opr64 15)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 532 column 24 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gcm_extra_bytes alg inout_b key round_keys keys_b hkeys_b total_bytes y_0 auth_in
    h_LE) (fun (va_s:va_state) _ -> let y_inout = Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm
    8 va_s) in let (raw_auth_quads:(FStar.Seq.Base.seq quad32)) = FStar.Seq.Base.append #quad32
    auth_in (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_old_s) inout_b) in va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 536 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes raw_auth_quads) 0 total_bytes)
    (fun _ -> let (auth_input_bytes:(FStar.Seq.Base.seq Vale.Def.Types_s.nat8)) =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    raw_auth_quads) 0 total_bytes in let (padded_auth_bytes:(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat8)) = Vale.AES.GCTR_s.pad_to_128_bits auth_input_bytes in let auth_in =
    Vale.Def.Types_s.le_bytes_to_seq_quad32 padded_auth_bytes in let plain_byte_seq =
    Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_old_s) inout_b in let cipher_byte_seq =
    Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s) inout_b in va_QEmpty ((auth_in,
    cipher_byte_seq, plain_byte_seq, y_inout)))))))))) (qblock va_mods (fun (va_s:va_state) ->
    va_QEmpty ((auth_in, cipher_byte_seq, plain_byte_seq, y_inout))))) (fun (va_s:va_state) va_g ->
    let ((auth_in:(seq quad32)), (cipher_byte_seq:(seq quad32)), (plain_byte_seq:(seq quad32)),
    (y_inout:Vale.Def.Types_s.quad32)) = va_g in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 547 column 10 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Mov64 (va_op_dst_opr64_reg64 rR11) (va_op_opr64_reg64 rR15)) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 548 column 25 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gcm_make_length_quad ()) (fun (va_s:va_state) _ -> let
    (length_quad32:Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 0
    va_s) in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 551 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Ghash_register hkeys_b h_LE y_inout) (fun (va_s:va_state) _ -> let
    (y_final:Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32 (va_get_xmm 8 va_s)
    in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 554 column 19 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64
    rRbp) 0 Secret scratch_b 0) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 557 column 18 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gctr_register alg key round_keys keys_b) (fun (va_s:va_state) _ -> let
    (va_arg126:Vale.Def.Types_s.quad32) = va_get_xmm 8 va_s in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 560 column 40 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.Arch.Types.le_seq_quad32_to_bytes_of_singleton va_arg126)
    (va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 561 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    ((fun (icb_BE_677:Vale.Def.Types_s.quad32) (plain_LE_678:Vale.Def.Types_s.quad32)
    (alg_679:Vale.AES.AES_common_s.algorithm) (key_680:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32))
    (i_681:Prims.int) -> Vale.AES.AES_s.is_aes_key_LE alg_679 key_680) j0 y_final alg key 0) (fun _
    -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 561 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_xmm 8 va_s == Vale.AES.GCTR_s.gctr_encrypt_block j0 y_final alg key 0) (let
    (plain128:(FStar.Seq.Base.seq Vale.X64.Decls.quad32)) = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_old_s) in128_b) in let
    (cipher128:(FStar.Seq.Base.seq Vale.X64.Decls.quad32)) = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s) in128_b) in va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 566 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (FStar.Seq.Base.length #quad32 plain_byte_seq == 0 ==> FStar.Seq.Base.equal
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32 plain128 plain_byte_seq)
    plain128) (va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 567 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (FStar.Seq.Base.length #quad32 cipher_byte_seq == 0 ==> FStar.Seq.Base.equal
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32 cipher128 cipher_byte_seq)
    cipher128) (let (va_arg125:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_BE_2 len128x6
    in let (va_arg124:Vale.Def.Types_s.quad32) = ctr_BE_2 in let (va_arg123:(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat32)) = key in let (va_arg122:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32))
    = Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s) out128_b in let
    (va_arg121:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_old_s) in128_b in let (va_arg120:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out128x6_b in let
    (va_arg119:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_old_s) in128x6_b in let (va_arg118:Prims.nat) = len128 in let
    (va_arg117:Prims.nat) = len128x6 in let (va_arg116:Vale.AES.AES_common_s.algorithm) = alg in
    va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 569 column 30 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.lemma_gctr_partial_append va_arg116 va_arg117 va_arg118
    va_arg119 va_arg120 va_arg121 va_arg122 va_arg123 va_arg124 va_arg125) (let
    (va_arg115:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite (Vale.AES.GCTR.inc32lite ctr_BE_2
    len128x6) len128 in let (va_arg114:Vale.Def.Types_s.quad32) = ctr_BE_2 in let
    (va_arg113:(FStar.Seq.Base.seq Vale.Def.Types_s.nat32)) = key in let
    (va_arg112:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = cipher_byte_seq in let
    (va_arg111:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = plain_byte_seq in let
    (va_arg110:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s) out128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s) out128_b) in let
    (va_arg109:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_old_s) in128_b) in let (va_arg108:Prims.nat) =
    FStar.Seq.Base.length #quad32 plain_byte_seq in let (va_arg107:Prims.nat) = len128x6 + len128
    in let (va_arg106:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 575 column 30 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GCTR.lemma_gctr_partial_append va_arg106 va_arg107 va_arg108
    va_arg109 va_arg110 va_arg111 va_arg112 va_arg113 va_arg114 va_arg115) (let
    (va_arg105:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = auth_in in let
    (va_arg104:Vale.Def.Types_s.quad32) = y_0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 583 column 23 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.lemma_hash_append2 h_LE va_arg104 y_inout y_final va_arg105
    length_quad32) (let auth_in = FStar.Seq.Base.append #quad32 auth_in (FStar.Seq.Base.create
    #Vale.Def.Types_s.quad32 1 length_quad32) in let (va_arg103:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = auth_in in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 585 column 31 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GHash.ghash_incremental_to_ghash h_LE va_arg103) (va_QEmpty
    (()))))))))))))))))))))))))))))))))))))))))))))))))


val va_lemma_Gcm_blocks : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> offset:int ->
  auth_b:buffer128 -> abytes_b:buffer128 -> in128x6_b:buffer128 -> out128x6_b:buffer128 ->
  in128_b:buffer128 -> out128_b:buffer128 -> inout_b:buffer128 -> iv_b:buffer128 ->
  scratch_b:buffer128 -> key:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  hkeys_b:buffer128
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Gcm_blocks alg offset) va_s0 /\ va_get_ok va_s0 /\
    (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 0) (va_get_stack va_s0) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0) in
    let (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 16) (va_get_stack va_s0) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 24) (va_get_stack va_s0) in
    let (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 32) (va_get_stack va_s0) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 40) (va_get_stack va_s0) in
    let (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 48) (va_get_stack va_s0) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 56) (va_get_stack va_s0) in
    let (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 64) (va_get_stack va_s0) in let (h_LE:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read hkeys_b 2
    (va_get_mem_heaplet 0 va_s0)) in sse_enabled /\ movbe_enabled /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 0) (va_get_stack va_s0)
    Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp
    va_s0 + offset + 8) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 16) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 24) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 32) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 40) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 48) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 56) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 64) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet
    1 va_s0) (va_get_reg64 rRdi va_s0) auth_b (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 7 va_s0) abytes_ptr abytes_b 1
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 6 va_s0) in128x6_ptr in128x6_b len128x6
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 6
    va_s0) out128x6_ptr out128x6_b len128x6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 1 va_s0) in128_ptr in128_b len128
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 1
    va_s0) out128_ptr out128_b len128 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 5 va_s0) inout_ptr inout_b 1
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3
    va_s0) (va_get_reg64 rRbp va_s0) scratch_b 9 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0) hkeys_b 8
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.buffer_disjoints128 iv_b ([keys_b;
    scratch_b; in128x6_b; out128x6_b; hkeys_b; in128_b; out128_b; inout_b]) /\
    Vale.X64.Decls.buffer_disjoints128 scratch_b ([keys_b; in128x6_b; out128x6_b; in128_b;
    out128_b; inout_b; hkeys_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128x6_b ([keys_b;
    hkeys_b; in128_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128_b ([keys_b; hkeys_b;
    out128x6_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 inout_b ([keys_b; hkeys_b;
    out128x6_b; out128_b]) /\ (Vale.X64.Decls.buffers_disjoint128 in128x6_b out128x6_b \/ in128x6_b
    == out128x6_b) /\ (Vale.X64.Decls.buffers_disjoint128 in128_b out128_b \/ in128_b == out128_b)
    /\ va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ in128x6_ptr
    + 16 `op_Multiply` len128x6 < pow2_64 /\ out128x6_ptr + 16 `op_Multiply` len128x6 < pow2_64 /\
    in128_ptr + 16 `op_Multiply` len128 < pow2_64 /\ out128_ptr + 16 `op_Multiply` len128 < pow2_64
    /\ inout_ptr + 16 < pow2_64 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 auth_b ==
    va_get_reg64 rRdx va_s0 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 abytes_b == 1
    /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128x6_b ==
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 out128x6_b /\
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b == Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 out128_b /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128
    in128x6_b == len128x6 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b ==
    len128 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 inout_b == 1 /\
    plain_num_bytes < pow2_32 /\ va_get_reg64 rRsi va_s0 < pow2_32 /\ va_get_reg64 rR9 va_s0 + 32 <
    pow2_64 /\ Vale.X64.Memory.buffer_addr #Vale.X64.Memory.vuint128 keys_b (va_get_mem_heaplet 0
    va_s0) + 128 < pow2_64 /\ len128x6 `op_Modulus` 6 == 0 /\ (len128x6 > 0 ==> len128x6 >= 6) /\
    12 + len128x6 + 6 < pow2_32 /\ (va_mul_nat len128x6 (128 `op_Division` 8) + va_mul_nat len128
    (128 `op_Division` 8) <= plain_num_bytes /\ plain_num_bytes < va_mul_nat len128x6 (128
    `op_Division` 8) + va_mul_nat len128 (128 `op_Division` 8) + 128 `op_Division` 8) /\
    (va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) <= va_get_reg64 rRsi va_s0 /\
    va_get_reg64 rRsi va_s0 < va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) + 128
    `op_Division` 8) /\ aes_reqs alg key round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ pclmulqdq_enabled /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.AES_s.aes_encrypt_LE alg key
    (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0))))))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 0) (va_get_stack va_s0) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0) in
    let (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 16) (va_get_stack va_s0) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 24) (va_get_stack va_s0) in
    let (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 32) (va_get_stack va_s0) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 40) (va_get_stack va_s0) in
    let (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 48) (va_get_stack va_s0) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 56) (va_get_stack va_s0) in
    let (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 64) (va_get_stack va_s0) in let (h_LE:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read hkeys_b 2
    (va_get_mem_heaplet 0 va_s0)) in Vale.X64.Decls.modifies_buffer128 out128_b (va_get_mem_heaplet
    1 va_s0) (va_get_mem_heaplet 1 va_sM) /\ Vale.X64.Decls.modifies_buffer128 iv_b
    (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) /\ Vale.X64.Decls.modifies_buffer128
    scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3 va_sM) /\
    Vale.X64.Decls.modifies_buffer128 inout_b (va_get_mem_heaplet 5 va_s0) (va_get_mem_heaplet 5
    va_sM) /\ Vale.X64.Decls.modifies_buffer128 out128x6_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) /\ plain_num_bytes < pow2_32 /\ va_get_reg64 rRsi va_s0 < pow2_32
    /\ (let iv_BE = Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2 va_s0) in let
    (ctr_BE_1:quad32) = iv_BE in let (ctr_BE_2:quad32) = Vale.AES.GCTR_s.inc32 iv_BE 1 in let
    (plain_in:(seq quad32)) = (if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128
    `op_Division` 8) then FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in128_b)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_s0) inout_b) else FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in128_b)) in let (cipher_out:(seq quad32)) = (if (plain_num_bytes
    > (len128x6 + len128) `op_Multiply` 128 `op_Division` 8) then FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out128x6_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM)
    out128_b)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_sM) inout_b) else
    FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM)
    out128x6_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out128_b)) in let
    (cipher_bound:nat) = (if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128 `op_Division`
    8) then (len128x6 + len128 + 1) else (len128x6 + len128)) in Vale.AES.GCTR.gctr_partial alg
    cipher_bound plain_in cipher_out key ctr_BE_2 /\ (let (length_quad:quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Def.Types_s.insert_nat64
    (Vale.Def.Types_s.insert_nat64 (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) (8
    `op_Multiply` va_get_reg64 rRsi va_s0) 1) (8 `op_Multiply` plain_num_bytes) 0) in let
    (raw_auth_quads:(seq quad32)) = (if (va_get_reg64 rRsi va_s0 > va_get_reg64 rRdx va_s0
    `op_Multiply` 128 `op_Division` 8) then FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) auth_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 7 va_s0) abytes_b) else Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0)
    auth_b) in let (auth_input_bytes:(seq nat8)) = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes raw_auth_quads) 0 (va_get_reg64 rRsi va_s0) in let
    (padded_auth_bytes:(seq nat8)) = Vale.AES.GCTR_s.pad_to_128_bits auth_input_bytes in let
    (auth_quad_seq:(seq quad32)) = Vale.Def.Types_s.le_bytes_to_seq_quad32 padded_auth_bytes in let
    (raw_quad_seq:(seq quad32)) = FStar.Seq.Base.append #quad32 (FStar.Seq.Base.append #quad32
    auth_quad_seq (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b))
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in128_b) in let (total_bytes:nat) =
    FStar.Seq.Base.length #quad32 auth_quad_seq `op_Multiply` 16 + plain_num_bytes in let
    (raw_quad_seq:(seq quad32)) = (if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128
    `op_Division` 8) then (let (ab:(seq nat8)) = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes (FStar.Seq.Base.append #quad32 raw_quad_seq
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b))) 0 total_bytes in let (pb:(seq
    nat8)) = Vale.AES.GCTR_s.pad_to_128_bits ab in Vale.Def.Types_s.le_bytes_to_seq_quad32 pb) else
    raw_quad_seq) in let (auth_quad_seq:(seq quad32)) = FStar.Seq.Base.append #quad32 raw_quad_seq
    (FStar.Seq.Base.create #quad32 1 length_quad) in va_get_xmm 8 va_sM ==
    Vale.AES.GCTR_s.gctr_encrypt_block ctr_BE_1 (Vale.AES.GHash_s.ghash_LE h_LE auth_quad_seq) alg
    key 0))) /\ va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 6 va_sM
    (va_update_mem_heaplet 5 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM
    (va_update_mem_heaplet 1 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm
    13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm
    9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5
    va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR15 va_sM (va_update_reg64 rR14 va_sM
    (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rR10 va_sM (va_update_reg64 rR9 va_sM (va_update_reg64 rR8 va_sM
    (va_update_reg64 rRbp va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM
    (va_update_reg64 rRdx va_sM (va_update_reg64 rRcx va_sM (va_update_reg64 rRbx va_sM
    (va_update_reg64 rRax va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0)))))))))))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Gcm_blocks va_b0 va_s0 alg offset auth_b abytes_b in128x6_b out128x6_b in128_b
  out128_b inout_b iv_b scratch_b key round_keys keys_b hkeys_b =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8;
    va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm
    1; va_Mod_xmm 0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12;
    va_Mod_reg64 rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx;
    va_Mod_reg64 rRax; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Gcm_blocks va_mods alg offset auth_b abytes_b in128x6_b out128x6_b in128_b
    out128_b inout_b iv_b scratch_b key round_keys keys_b hkeys_b in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Gcm_blocks alg offset) va_qc va_s0 (fun
    va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 283 column 1 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_ok va_sM) /\ (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64
    (va_get_reg64 rRsp va_s0 + offset + 0) (va_get_stack va_s0) in let
    (in128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 8) (va_get_stack va_s0) in let (out128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 16) (va_get_stack va_s0) in
    let (len128x6:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 24) (va_get_stack va_s0) in let (in128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 32) (va_get_stack va_s0) in
    let (out128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 40) (va_get_stack va_s0) in let (len128:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 48) (va_get_stack va_s0) in
    let (inout_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 56) (va_get_stack va_s0) in let (plain_num_bytes:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 64) (va_get_stack va_s0) in
    let (h_LE:Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read hkeys_b 2 (va_get_mem_heaplet 0 va_s0)) in label va_range1
    "***** POSTCONDITION NOT MET AT line 396 column 56 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 out128_b (va_get_mem_heaplet 1 va_s0) (va_get_mem_heaplet 1
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 397 column 52 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 iv_b (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 398 column 57 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 399 column 55 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 inout_b (va_get_mem_heaplet 5 va_s0) (va_get_mem_heaplet 5
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 400 column 58 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 out128x6_b (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet
    6 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 403 column 39 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (plain_num_bytes < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 404 column 38 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_reg64 rRsi va_s0 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 406 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let iv_BE = Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2 va_s0) in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 408 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (ctr_BE_1:quad32) = iv_BE in label va_range1
    "***** POSTCONDITION NOT MET AT line 409 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (ctr_BE_2:quad32) = Vale.AES.GCTR_s.inc32 iv_BE 1 in label va_range1
    "***** POSTCONDITION NOT MET AT line 412 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (plain_in:(seq quad32)) = va_if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128
    `op_Division` 8) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in128_b)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_s0) inout_b)) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in128_b)) in label va_range1
    "***** POSTCONDITION NOT MET AT line 421 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (cipher_out:(seq quad32)) = va_if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128
    `op_Division` 8) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out128_b)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_sM) inout_b)) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out128x6_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_sM) out128_b)) in label va_range1
    "***** POSTCONDITION NOT MET AT line 430 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (cipher_bound:nat) = va_if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128
    `op_Division` 8) (fun _ -> len128x6 + len128 + 1) (fun _ -> len128x6 + len128) in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 434 column 77 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.AES.GCTR.gctr_partial alg cipher_bound plain_in cipher_out key ctr_BE_2) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 438 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (length_quad:quad32) = Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.Def.Types_s.insert_nat64 (Vale.Def.Types_s.insert_nat64 (Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 0) (8 `op_Multiply` va_get_reg64 rRsi va_s0) 1) (8 `op_Multiply`
    plain_num_bytes) 0) in label va_range1
    "***** POSTCONDITION NOT MET AT line 440 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (raw_auth_quads:(seq quad32)) = va_if (va_get_reg64 rRsi va_s0 > va_get_reg64 rRdx va_s0
    `op_Multiply` 128 `op_Division` 8) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) auth_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 7 va_s0) abytes_b)) (fun _ -> Vale.X64.Decls.s128 (va_get_mem_heaplet 1
    va_s0) auth_b) in label va_range1
    "***** POSTCONDITION NOT MET AT line 444 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (auth_input_bytes:(seq nat8)) = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes raw_auth_quads) 0 (va_get_reg64 rRsi va_s0) in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 445 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (padded_auth_bytes:(seq nat8)) = Vale.AES.GCTR_s.pad_to_128_bits auth_input_bytes in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 446 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (auth_quad_seq:(seq quad32)) = Vale.Def.Types_s.le_bytes_to_seq_quad32 padded_auth_bytes
    in label va_range1
    "***** POSTCONDITION NOT MET AT line 448 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (raw_quad_seq:(seq quad32)) = FStar.Seq.Base.append #quad32 (FStar.Seq.Base.append #quad32
    auth_quad_seq (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b))
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in128_b) in label va_range1
    "***** POSTCONDITION NOT MET AT line 452 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (total_bytes:nat) = FStar.Seq.Base.length #quad32 auth_quad_seq `op_Multiply` 16 +
    plain_num_bytes in label va_range1
    "***** POSTCONDITION NOT MET AT line 453 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (raw_quad_seq:(seq quad32)) = va_if (plain_num_bytes > (len128x6 + len128) `op_Multiply`
    128 `op_Division` 8) (fun _ -> let (ab:(seq nat8)) = FStar.Seq.Base.slice
    #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes (FStar.Seq.Base.append #quad32
    raw_quad_seq (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b))) 0 total_bytes in let
    (pb:(seq nat8)) = Vale.AES.GCTR_s.pad_to_128_bits ab in Vale.Def.Types_s.le_bytes_to_seq_quad32
    pb) (fun _ -> raw_quad_seq) in label va_range1
    "***** POSTCONDITION NOT MET AT line 460 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let (auth_quad_seq:(seq quad32)) = FStar.Seq.Base.append #quad32 raw_quad_seq
    (FStar.Seq.Base.create #quad32 1 length_quad) in label va_range1
    "***** POSTCONDITION NOT MET AT line 461 column 106 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_xmm 8 va_sM == Vale.AES.GCTR_s.gctr_encrypt_block ctr_BE_1 (Vale.AES.GHash_s.ghash_LE
    h_LE auth_quad_seq) alg key 0)))))))))))))))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5; va_Mod_mem_heaplet
    3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64
    rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp; va_Mod_reg64
    rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx; va_Mod_reg64
    rRax; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Gcm_blocks (alg:algorithm) (offset:int) (auth_b:buffer128) (abytes_b:buffer128)
  (in128x6_b:buffer128) (out128x6_b:buffer128) (in128_b:buffer128) (out128_b:buffer128)
  (inout_b:buffer128) (iv_b:buffer128) (scratch_b:buffer128) (key:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (va_s0:va_state) (va_k:(va_state -> unit ->
  Type0)) : Type0 =
  (va_get_ok va_s0 /\ (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64
    (va_get_reg64 rRsp va_s0 + offset + 0) (va_get_stack va_s0) in let
    (in128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 8) (va_get_stack va_s0) in let (out128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 16) (va_get_stack va_s0) in
    let (len128x6:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 24) (va_get_stack va_s0) in let (in128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 32) (va_get_stack va_s0) in
    let (out128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 40) (va_get_stack va_s0) in let (len128:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 48) (va_get_stack va_s0) in
    let (inout_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 56) (va_get_stack va_s0) in let (plain_num_bytes:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 64) (va_get_stack va_s0) in
    let (h_LE:Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read hkeys_b 2 (va_get_mem_heaplet 0 va_s0)) in sse_enabled /\
    movbe_enabled /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 0)
    (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64
    (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 16) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 24) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 32) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 40) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 48) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 56) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 64) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet
    1 va_s0) (va_get_reg64 rRdi va_s0) auth_b (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 7 va_s0) abytes_ptr abytes_b 1
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 6 va_s0) in128x6_ptr in128x6_b len128x6
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 6
    va_s0) out128x6_ptr out128x6_b len128x6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 1 va_s0) in128_ptr in128_b len128
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 1
    va_s0) out128_ptr out128_b len128 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 5 va_s0) inout_ptr inout_b 1
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3
    va_s0) (va_get_reg64 rRbp va_s0) scratch_b 9 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0) hkeys_b 8
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.buffer_disjoints128 iv_b ([keys_b;
    scratch_b; in128x6_b; out128x6_b; hkeys_b; in128_b; out128_b; inout_b]) /\
    Vale.X64.Decls.buffer_disjoints128 scratch_b ([keys_b; in128x6_b; out128x6_b; in128_b;
    out128_b; inout_b; hkeys_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128x6_b ([keys_b;
    hkeys_b; in128_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128_b ([keys_b; hkeys_b;
    out128x6_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 inout_b ([keys_b; hkeys_b;
    out128x6_b; out128_b]) /\ (Vale.X64.Decls.buffers_disjoint128 in128x6_b out128x6_b \/ in128x6_b
    == out128x6_b) /\ (Vale.X64.Decls.buffers_disjoint128 in128_b out128_b \/ in128_b == out128_b)
    /\ va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ in128x6_ptr
    + 16 `op_Multiply` len128x6 < pow2_64 /\ out128x6_ptr + 16 `op_Multiply` len128x6 < pow2_64 /\
    in128_ptr + 16 `op_Multiply` len128 < pow2_64 /\ out128_ptr + 16 `op_Multiply` len128 < pow2_64
    /\ inout_ptr + 16 < pow2_64 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 auth_b ==
    va_get_reg64 rRdx va_s0 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 abytes_b == 1
    /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128x6_b ==
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 out128x6_b /\
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b == Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 out128_b /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128
    in128x6_b == len128x6 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b ==
    len128 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 inout_b == 1 /\
    plain_num_bytes < pow2_32 /\ va_get_reg64 rRsi va_s0 < pow2_32 /\ va_get_reg64 rR9 va_s0 + 32 <
    pow2_64 /\ Vale.X64.Memory.buffer_addr #Vale.X64.Memory.vuint128 keys_b (va_get_mem_heaplet 0
    va_s0) + 128 < pow2_64 /\ len128x6 `op_Modulus` 6 == 0 /\ (len128x6 > 0 ==> len128x6 >= 6) /\
    12 + len128x6 + 6 < pow2_32 /\ (va_mul_nat len128x6 (128 `op_Division` 8) + va_mul_nat len128
    (128 `op_Division` 8) <= plain_num_bytes /\ plain_num_bytes < va_mul_nat len128x6 (128
    `op_Division` 8) + va_mul_nat len128 (128 `op_Division` 8) + 128 `op_Division` 8) /\
    (va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) <= va_get_reg64 rRsi va_s0 /\
    va_get_reg64 rRsi va_s0 < va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) + 128
    `op_Division` 8) /\ aes_reqs alg key round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ pclmulqdq_enabled /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.AES_s.aes_encrypt_LE alg key
    (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)))) /\ (forall (va_x_mem:vale_heap)
    (va_x_rax:nat64) (va_x_rbx:nat64) (va_x_rcx:nat64) (va_x_rdx:nat64) (va_x_rdi:nat64)
    (va_x_rsi:nat64) (va_x_rbp:nat64) (va_x_r8:nat64) (va_x_r9:nat64) (va_x_r10:nat64)
    (va_x_r11:nat64) (va_x_r12:nat64) (va_x_r13:nat64) (va_x_r14:nat64) (va_x_r15:nat64)
    (va_x_xmm0:quad32) (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32)
    (va_x_xmm5:quad32) (va_x_xmm6:quad32) (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32)
    (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32)
    (va_x_xmm14:quad32) (va_x_xmm15:quad32) (va_x_heap1:vale_heap) (va_x_heap2:vale_heap)
    (va_x_heap3:vale_heap) (va_x_heap5:vale_heap) (va_x_heap6:vale_heap)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_mem_heaplet 6
    va_x_heap6 (va_upd_mem_heaplet 5 va_x_heap5 (va_upd_mem_heaplet 3 va_x_heap3
    (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_mem_heaplet 1 va_x_heap1 (va_upd_xmm 15 va_x_xmm15
    (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11
    va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8
    (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4
    (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1 va_x_xmm1 (va_upd_xmm 0 va_x_xmm0
    (va_upd_reg64 rR15 va_x_r15 (va_upd_reg64 rR14 va_x_r14 (va_upd_reg64 rR13 va_x_r13
    (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rR10 va_x_r10
    (va_upd_reg64 rR9 va_x_r9 (va_upd_reg64 rR8 va_x_r8 (va_upd_reg64 rRbp va_x_rbp (va_upd_reg64
    rRsi va_x_rsi (va_upd_reg64 rRdi va_x_rdi (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64 rRcx
    va_x_rcx (va_upd_reg64 rRbx va_x_rbx (va_upd_reg64 rRax va_x_rax (va_upd_mem va_x_mem
    va_s0))))))))))))))))))))))))))))))))))))) in va_get_ok va_sM /\ (let
    (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 0) (va_get_stack va_s0) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0) in
    let (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 16) (va_get_stack va_s0) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 24) (va_get_stack va_s0) in
    let (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 32) (va_get_stack va_s0) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 40) (va_get_stack va_s0) in
    let (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 48) (va_get_stack va_s0) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 56) (va_get_stack va_s0) in
    let (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 64) (va_get_stack va_s0) in let (h_LE:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read hkeys_b 2
    (va_get_mem_heaplet 0 va_s0)) in Vale.X64.Decls.modifies_buffer128 out128_b (va_get_mem_heaplet
    1 va_s0) (va_get_mem_heaplet 1 va_sM) /\ Vale.X64.Decls.modifies_buffer128 iv_b
    (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) /\ Vale.X64.Decls.modifies_buffer128
    scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3 va_sM) /\
    Vale.X64.Decls.modifies_buffer128 inout_b (va_get_mem_heaplet 5 va_s0) (va_get_mem_heaplet 5
    va_sM) /\ Vale.X64.Decls.modifies_buffer128 out128x6_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) /\ plain_num_bytes < pow2_32 /\ va_get_reg64 rRsi va_s0 < pow2_32
    /\ (let iv_BE = Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2 va_s0) in let
    (ctr_BE_1:quad32) = iv_BE in let (ctr_BE_2:quad32) = Vale.AES.GCTR_s.inc32 iv_BE 1 in let
    (plain_in:(seq quad32)) = va_if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128
    `op_Division` 8) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in128_b)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_s0) inout_b)) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) in128_b)) in let (cipher_out:(seq quad32)) = va_if
    (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128 `op_Division` 8) (fun _ ->
    FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out128x6_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_sM) out128_b)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_sM)
    inout_b)) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out128x6_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM)
    out128_b)) in let (cipher_bound:nat) = va_if (plain_num_bytes > (len128x6 + len128)
    `op_Multiply` 128 `op_Division` 8) (fun _ -> len128x6 + len128 + 1) (fun _ -> len128x6 +
    len128) in Vale.AES.GCTR.gctr_partial alg cipher_bound plain_in cipher_out key ctr_BE_2 /\ (let
    (length_quad:quad32) = Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Def.Types_s.insert_nat64
    (Vale.Def.Types_s.insert_nat64 (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) (8
    `op_Multiply` va_get_reg64 rRsi va_s0) 1) (8 `op_Multiply` plain_num_bytes) 0) in let
    (raw_auth_quads:(seq quad32)) = va_if (va_get_reg64 rRsi va_s0 > va_get_reg64 rRdx va_s0
    `op_Multiply` 128 `op_Division` 8) (fun _ -> FStar.Seq.Base.append #Vale.X64.Decls.quad32
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) auth_b) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 7 va_s0) abytes_b)) (fun _ -> Vale.X64.Decls.s128 (va_get_mem_heaplet 1
    va_s0) auth_b) in let (auth_input_bytes:(seq nat8)) = FStar.Seq.Base.slice
    #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes raw_auth_quads) 0 (va_get_reg64
    rRsi va_s0) in let (padded_auth_bytes:(seq nat8)) = Vale.AES.GCTR_s.pad_to_128_bits
    auth_input_bytes in let (auth_quad_seq:(seq quad32)) = Vale.Def.Types_s.le_bytes_to_seq_quad32
    padded_auth_bytes in let (raw_quad_seq:(seq quad32)) = FStar.Seq.Base.append #quad32
    (FStar.Seq.Base.append #quad32 auth_quad_seq (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0)
    in128x6_b)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in128_b) in let (total_bytes:nat)
    = FStar.Seq.Base.length #quad32 auth_quad_seq `op_Multiply` 16 + plain_num_bytes in let
    (raw_quad_seq:(seq quad32)) = va_if (plain_num_bytes > (len128x6 + len128) `op_Multiply` 128
    `op_Division` 8) (fun _ -> let (ab:(seq nat8)) = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes (FStar.Seq.Base.append #quad32 raw_quad_seq
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b))) 0 total_bytes in let (pb:(seq
    nat8)) = Vale.AES.GCTR_s.pad_to_128_bits ab in Vale.Def.Types_s.le_bytes_to_seq_quad32 pb) (fun
    _ -> raw_quad_seq) in let (auth_quad_seq:(seq quad32)) = FStar.Seq.Base.append #quad32
    raw_quad_seq (FStar.Seq.Base.create #quad32 1 length_quad) in va_get_xmm 8 va_sM ==
    Vale.AES.GCTR_s.gctr_encrypt_block ctr_BE_1 (Vale.AES.GHash_s.ghash_LE h_LE auth_quad_seq) alg
    key 0))) ==> va_k va_sM (())))


val va_wpProof_Gcm_blocks : alg:algorithm -> offset:int -> auth_b:buffer128 -> abytes_b:buffer128
  -> in128x6_b:buffer128 -> out128x6_b:buffer128 -> in128_b:buffer128 -> out128_b:buffer128 ->
  inout_b:buffer128 -> iv_b:buffer128 -> scratch_b:buffer128 -> key:(seq nat32) -> round_keys:(seq
  quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 -> va_s0:va_state -> va_k:(va_state -> unit ->
  Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Gcm_blocks alg offset auth_b abytes_b in128x6_b out128x6_b
    in128_b out128_b inout_b iv_b scratch_b key round_keys keys_b hkeys_b va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Gcm_blocks alg offset) ([va_Mod_flags;
    va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2;
    va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm
    11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5;
    va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR15;
    va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rR10;
    va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi;
    va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx; va_Mod_reg64 rRax; va_Mod_mem]) va_s0
    va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Gcm_blocks alg offset auth_b abytes_b in128x6_b out128x6_b in128_b out128_b inout_b
  iv_b scratch_b key round_keys keys_b hkeys_b va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Gcm_blocks (va_code_Gcm_blocks alg offset) va_s0 alg offset auth_b
    abytes_b in128x6_b out128x6_b in128_b out128_b inout_b iv_b scratch_b key round_keys keys_b
    hkeys_b in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 6 va_sM
    (va_update_mem_heaplet 5 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM
    (va_update_mem_heaplet 1 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm
    13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm
    9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5
    va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR15 va_sM (va_update_reg64 rR14 va_sM
    (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rR10 va_sM (va_update_reg64 rR9 va_sM (va_update_reg64 rR8 va_sM
    (va_update_reg64 rRbp va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM
    (va_update_reg64 rRdx va_sM (va_update_reg64 rRcx va_sM (va_update_reg64 rRbx va_sM
    (va_update_reg64 rRax va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0))))))))))))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5; va_Mod_mem_heaplet
    3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64
    rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp; va_Mod_reg64
    rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx; va_Mod_reg64
    rRax; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Gcm_blocks (alg:algorithm) (offset:int) (auth_b:buffer128) (abytes_b:buffer128)
  (in128x6_b:buffer128) (out128x6_b:buffer128) (in128_b:buffer128) (out128_b:buffer128)
  (inout_b:buffer128) (iv_b:buffer128) (scratch_b:buffer128) (key:(seq nat32)) (round_keys:(seq
  quad32)) (keys_b:buffer128) (hkeys_b:buffer128) : (va_quickCode unit (va_code_Gcm_blocks alg
  offset)) =
  (va_QProc (va_code_Gcm_blocks alg offset) ([va_Mod_flags; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 5; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1;
    va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64
    rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64
    rR8; va_Mod_reg64 rRbp; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64
    rRcx; va_Mod_reg64 rRbx; va_Mod_reg64 rRax; va_Mod_mem]) (va_wp_Gcm_blocks alg offset auth_b
    abytes_b in128x6_b out128x6_b in128_b out128_b inout_b iv_b scratch_b key round_keys keys_b
    hkeys_b) (va_wpProof_Gcm_blocks alg offset auth_b abytes_b in128x6_b out128x6_b in128_b
    out128_b inout_b iv_b scratch_b key round_keys keys_b hkeys_b))
#pop-options
//--
//-- Gcm_blocks_wrapped
#push-options "--z3rlimit 60"

val va_code_Gcm_blocks_wrapped : alg:algorithm -> offset:int -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Gcm_blocks_wrapped alg offset =
  (va_Block (va_CCons (va_code_Gcm_blocks alg offset) (va_CCons (va_Block (va_CNil ())) (va_CCons
    (va_Block (va_CNil ())) (va_CNil ())))))

val va_codegen_success_Gcm_blocks_wrapped : alg:algorithm -> offset:int -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Gcm_blocks_wrapped alg offset =
  (va_pbool_and (va_codegen_success_Gcm_blocks alg offset) (va_ttrue ()))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Gcm_blocks_wrapped (va_mods:va_mods_t) (alg:algorithm) (offset:int) (auth_b:buffer128)
  (abytes_b:buffer128) (in128x6_b:buffer128) (out128x6_b:buffer128) (in128_b:buffer128)
  (out128_b:buffer128) (inout_b:buffer128) (iv_b:buffer128) (iv:supported_iv_LE)
  (scratch_b:buffer128) (key:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (expected_tag:(seq nat8)) : (va_quickCode unit (va_code_Gcm_blocks_wrapped
  alg offset)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in let
    (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s +
    offset + 0) (va_get_stack va_s) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 8) (va_get_stack va_s) in let
    (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s +
    offset + 16) (va_get_stack va_s) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 24) (va_get_stack va_s) in let
    (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s +
    offset + 32) (va_get_stack va_s) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 40) (va_get_stack va_s) in let
    (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset
    + 48) (va_get_stack va_s) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s + offset + 56) (va_get_stack va_s) in let
    (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s
    + offset + 64) (va_get_stack va_s) in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 739 column 15 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_quick_Gcm_blocks alg offset auth_b abytes_b in128x6_b out128x6_b in128_b out128_b inout_b
    iv_b scratch_b key round_keys keys_b hkeys_b) (fun (va_s:va_state) _ -> va_qAssertSquash
    va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 741 column 37 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (8 `op_Multiply` va_get_reg64 rRsi va_old_s >= 0 /\ 8 `op_Multiply` va_get_reg64 rRsi va_old_s
    <= 18446744073709551615 /\ 8 `op_Multiply` plain_num_bytes >= 0 /\ 8 `op_Multiply`
    plain_num_bytes <= 18446744073709551615) (fun _ -> let (va_arg55:Vale.Def.Types_s.quad32) =
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.Def.Types_s.insert_nat64
    (Vale.Def.Types_s.insert_nat64 (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) (8
    `op_Multiply` va_get_reg64 rRsi va_old_s) 1) (8 `op_Multiply` plain_num_bytes) 0) in let
    (va_arg54:Vale.Def.Types_s.quad32) = va_get_xmm 8 va_s in let
    (va_arg53:Vale.Def.Types_s.quad32) = Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read hkeys_b 2 (va_get_mem_heaplet 0 va_s)) in let
    (va_arg52:Vale.Def.Types_s.quad32) = Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2
    va_old_s) in let (va_arg51:Vale.AES.GCM_s.supported_iv_LE) = iv in let (va_arg50:Prims.nat) =
    va_get_reg64 rRsi va_old_s in let (va_arg49:Prims.nat) = plain_num_bytes in let
    (va_arg48:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_s) inout_b in let (va_arg47:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s) out128_b in let
    (va_arg46:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out128x6_b in let (va_arg45:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_old_s) inout_b in let
    (va_arg44:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_old_s) in128_b in let (va_arg43:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in128x6_b in
    let (va_arg42:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 7 va_old_s) abytes_b in let (va_arg41:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_old_s) auth_b in let
    (va_arg40:(FStar.Seq.Base.seq Vale.Def.Words_s.nat32)) = key in let
    (va_arg39:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 741 column 37 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GCM.gcm_blocks_dec_helper_simplified va_arg39 va_arg40 va_arg41
    va_arg42 va_arg43 va_arg44 va_arg45 va_arg46 va_arg47 va_arg48 va_arg49 va_arg50 va_arg51
    va_arg52 va_arg53 va_arg54 va_arg55) (let (auth_raw_quads:(FStar.Seq.Base.seq
    Vale.X64.Decls.quad32)) = FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_old_s) auth_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 7 va_old_s)
    abytes_b) in va_qAssertSquash va_range1
    "***** EXPRESSION PRECONDITIONS NOT MET WITHIN line 751 column 5 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    ((fun a_1582 (s_1583:(FStar.Seq.Base.seq a_1582)) (i_1584:Prims.nat) (j_1585:Prims.nat) -> let
    (j_1545:Prims.nat) = j_1585 in Prims.b2t (Prims.op_AmpAmp (Prims.op_LessThanOrEqual i_1584
    j_1545) (Prims.op_LessThanOrEqual j_1545 (FStar.Seq.Base.length #a_1582 s_1583))))
    Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes auth_raw_quads) 0 (va_get_reg64
    rRsi va_old_s)) (fun _ -> let (auth_bytes:(FStar.Seq.Base.seq Vale.Def.Types_s.nat8)) =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    auth_raw_quads) 0 (va_get_reg64 rRsi va_old_s) in let (va_arg38:Vale.Def.Types_s.quad32) =
    Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2 va_old_s) in let
    (va_arg37:Vale.AES.GCM_s.supported_iv_LE) = iv in let (va_arg36:Prims.nat) = plain_num_bytes in
    let (va_arg35:(FStar.Seq.Base.seq Vale.Def.Words_s.nat8)) = expected_tag in let
    (va_arg34:(FStar.Seq.Base.seq Vale.Def.Words_s.nat8)) = auth_bytes in let
    (va_arg33:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_s) inout_b in let (va_arg32:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s) out128_b in let
    (va_arg31:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s) out128x6_b in let (va_arg30:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_old_s) inout_b in let
    (va_arg29:(FStar.Seq.Base.seq Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_old_s) in128_b in let (va_arg28:(FStar.Seq.Base.seq
    Vale.Def.Types_s.quad32)) = Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_old_s) in128x6_b in
    let (va_arg27:(FStar.Seq.Base.seq Vale.Def.Words_s.nat32)) = key in let
    (va_arg26:Vale.AES.AES_common_s.algorithm) = alg in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 752 column 37 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (fun (_:unit) -> Vale.AES.GCM.gcm_blocks_helper_dec_simplified va_arg26 va_arg27 va_arg28
    va_arg29 va_arg30 va_arg31 va_arg32 va_arg33 va_arg34 va_arg35 va_arg36 va_arg37 va_arg38)
    (va_QEmpty (()))))))))


val va_lemma_Gcm_blocks_wrapped : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> offset:int ->
  auth_b:buffer128 -> abytes_b:buffer128 -> in128x6_b:buffer128 -> out128x6_b:buffer128 ->
  in128_b:buffer128 -> out128_b:buffer128 -> inout_b:buffer128 -> iv_b:buffer128 ->
  iv:supported_iv_LE -> scratch_b:buffer128 -> key:(seq nat32) -> round_keys:(seq quad32) ->
  keys_b:buffer128 -> hkeys_b:buffer128 -> expected_tag:(seq nat8)
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Gcm_blocks_wrapped alg offset) va_s0 /\ va_get_ok
    va_s0 /\ (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64
    rRsp va_s0 + offset + 0) (va_get_stack va_s0) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0) in
    let (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 16) (va_get_stack va_s0) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 24) (va_get_stack va_s0) in
    let (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 32) (va_get_stack va_s0) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 40) (va_get_stack va_s0) in
    let (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 48) (va_get_stack va_s0) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 56) (va_get_stack va_s0) in
    let (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 64) (va_get_stack va_s0) in sse_enabled /\ movbe_enabled /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 0) (va_get_stack va_s0)
    Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp
    va_s0 + offset + 8) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 16) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 24) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 32) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 40) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 48) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 56) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 64) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet
    1 va_s0) (va_get_reg64 rRdi va_s0) auth_b (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 7 va_s0) abytes_ptr abytes_b 1
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2
    va_s0) (va_get_reg64 rR8 va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 6 va_s0) in128x6_ptr in128x6_b len128x6
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 6
    va_s0) out128x6_ptr out128x6_b len128x6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 1 va_s0) in128_ptr in128_b len128
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 1
    va_s0) out128_ptr out128_b len128 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 5 va_s0) inout_ptr inout_b 1
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3
    va_s0) (va_get_reg64 rRbp va_s0) scratch_b 9 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0) hkeys_b 8
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.buffer_disjoints128 iv_b ([keys_b;
    scratch_b; in128x6_b; out128x6_b; hkeys_b; in128_b; out128_b; inout_b]) /\
    Vale.X64.Decls.buffer_disjoints128 scratch_b ([keys_b; in128x6_b; out128x6_b; in128_b;
    out128_b; inout_b; hkeys_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128x6_b ([keys_b;
    hkeys_b; in128_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128_b ([keys_b; hkeys_b;
    out128x6_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 inout_b ([keys_b; hkeys_b;
    out128x6_b; out128_b]) /\ (Vale.X64.Decls.buffers_disjoint128 in128x6_b out128x6_b \/ in128x6_b
    == out128x6_b) /\ (Vale.X64.Decls.buffers_disjoint128 in128_b out128_b \/ in128_b == out128_b)
    /\ va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ in128x6_ptr
    + 16 `op_Multiply` len128x6 < pow2_64 /\ out128x6_ptr + 16 `op_Multiply` len128x6 < pow2_64 /\
    in128_ptr + 16 `op_Multiply` len128 < pow2_64 /\ out128_ptr + 16 `op_Multiply` len128 < pow2_64
    /\ inout_ptr + 16 < pow2_64 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 auth_b ==
    va_get_reg64 rRdx va_s0 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 abytes_b == 1
    /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128x6_b ==
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 out128x6_b /\
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b == Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 out128_b /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128
    in128x6_b == len128x6 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b ==
    len128 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 inout_b == 1 /\
    plain_num_bytes < pow2_32 /\ va_get_reg64 rRsi va_s0 < pow2_32 /\ va_get_reg64 rR9 va_s0 + 32 <
    pow2_64 /\ Vale.X64.Memory.buffer_addr #Vale.X64.Memory.vuint128 keys_b (va_get_mem_heaplet 0
    va_s0) + 128 < pow2_64 /\ len128x6 `op_Modulus` 6 == 0 /\ (len128x6 > 0 ==> len128x6 >= 6) /\
    12 + len128x6 + 6 < pow2_32 /\ (va_mul_nat len128x6 (128 `op_Division` 8) + va_mul_nat len128
    (128 `op_Division` 8) <= plain_num_bytes /\ plain_num_bytes < va_mul_nat len128x6 (128
    `op_Division` 8) + va_mul_nat len128 (128 `op_Division` 8) + 128 `op_Division` 8) /\
    (va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) <= va_get_reg64 rRsi va_s0 /\
    va_get_reg64 rRsi va_s0 < va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) + 128
    `op_Division` 8) /\ aes_reqs alg key round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ pclmulqdq_enabled /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.AES_s.aes_encrypt_LE alg key
    (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0))) /\ (let iv_BE =
    Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2 va_s0) in let h_LE =
    Vale.AES.AES_s.aes_encrypt_LE alg key (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)
    in iv_BE == Vale.AES.GCM_s.compute_iv_BE h_LE iv))))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 0) (va_get_stack va_s0) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0) in
    let (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 16) (va_get_stack va_s0) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 24) (va_get_stack va_s0) in
    let (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 32) (va_get_stack va_s0) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 40) (va_get_stack va_s0) in
    let (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 48) (va_get_stack va_s0) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 56) (va_get_stack va_s0) in
    let (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 64) (va_get_stack va_s0) in Vale.X64.Decls.modifies_buffer128 out128_b
    (va_get_mem_heaplet 1 va_s0) (va_get_mem_heaplet 1 va_sM) /\ Vale.X64.Decls.modifies_buffer128
    iv_b (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) /\
    Vale.X64.Decls.modifies_buffer128 scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3
    va_sM) /\ Vale.X64.Decls.modifies_buffer128 inout_b (va_get_mem_heaplet 5 va_s0)
    (va_get_mem_heaplet 5 va_sM) /\ Vale.X64.Decls.modifies_buffer128 out128x6_b
    (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6 va_sM) /\ plain_num_bytes < pow2_32 /\
    va_get_reg64 rRsi va_s0 < pow2_32 /\ (let iv_BE = Vale.X64.Decls.buffer128_read iv_b 0
    (va_get_mem_heaplet 2 va_s0) in let auth_raw_quads = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) auth_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 7 va_s0) abytes_b) in let auth_bytes =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    auth_raw_quads) 0 (va_get_reg64 rRsi va_s0) in let plain_raw_quads = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in128x6_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0)
    in128_b)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b) in let plain_bytes =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    plain_raw_quads) 0 plain_num_bytes in let cipher_raw_quads = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out128x6_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM)
    out128_b)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_sM) inout_b) in let cipher_bytes =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    cipher_raw_quads) 0 plain_num_bytes in l_and (l_and (l_and (FStar.Seq.Base.length
    #Vale.Def.Types_s.nat8 auth_bytes < pow2_32) (FStar.Seq.Base.length #Vale.Def.Types_s.nat8
    plain_bytes < pow2_32)) (cipher_bytes == __proj__Mktuple2__item___1 #(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat8) #bool (Vale.AES.GCM_s.gcm_decrypt_LE alg
    (Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE key) iv plain_bytes auth_bytes expected_tag)))
    (Vale.Def.Types_s.le_quad32_to_bytes (va_get_xmm 8 va_sM) == Vale.AES.GCM.gcm_decrypt_LE_tag
    alg (Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE key) iv plain_bytes auth_bytes))) /\
    va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 6 va_sM (va_update_mem_heaplet
    5 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM (va_update_mem_heaplet 1
    va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12
    va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8
    va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4
    va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0
    va_sM (va_update_reg64 rR15 va_sM (va_update_reg64 rR14 va_sM (va_update_reg64 rR13 va_sM
    (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rR10 va_sM
    (va_update_reg64 rR9 va_sM (va_update_reg64 rR8 va_sM (va_update_reg64 rRbp va_sM
    (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM (va_update_reg64 rRdx va_sM
    (va_update_reg64 rRcx va_sM (va_update_reg64 rRbx va_sM (va_update_reg64 rRax va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))))))))))))))))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Gcm_blocks_wrapped va_b0 va_s0 alg offset auth_b abytes_b in128x6_b out128x6_b in128_b
  out128_b inout_b iv_b iv scratch_b key round_keys keys_b hkeys_b expected_tag =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5;
    va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8;
    va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm
    1; va_Mod_xmm 0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12;
    va_Mod_reg64 rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx;
    va_Mod_reg64 rRax; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Gcm_blocks_wrapped va_mods alg offset auth_b abytes_b in128x6_b out128x6_b
    in128_b out128_b inout_b iv_b iv scratch_b key round_keys keys_b hkeys_b expected_tag in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Gcm_blocks_wrapped alg offset) va_qc
    va_s0 (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 588 column 1 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_ok va_sM) /\ (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64
    (va_get_reg64 rRsp va_s0 + offset + 0) (va_get_stack va_s0) in let
    (in128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 8) (va_get_stack va_s0) in let (out128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 16) (va_get_stack va_s0) in
    let (len128x6:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 24) (va_get_stack va_s0) in let (in128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 32) (va_get_stack va_s0) in
    let (out128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 40) (va_get_stack va_s0) in let (len128:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 48) (va_get_stack va_s0) in
    let (inout_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 56) (va_get_stack va_s0) in let (plain_num_bytes:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 64) (va_get_stack va_s0) in
    label va_range1
    "***** POSTCONDITION NOT MET AT line 711 column 56 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 out128_b (va_get_mem_heaplet 1 va_s0) (va_get_mem_heaplet 1
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 712 column 52 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 iv_b (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 713 column 57 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 714 column 55 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 inout_b (va_get_mem_heaplet 5 va_s0) (va_get_mem_heaplet 5
    va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 715 column 58 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (Vale.X64.Decls.modifies_buffer128 out128x6_b (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet
    6 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 718 column 39 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (plain_num_bytes < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 719 column 38 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (va_get_reg64 rRsi va_s0 < pow2_32) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 721 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let iv_BE = Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2 va_s0) in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 723 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let auth_raw_quads = FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 1 va_s0) auth_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 7 va_s0)
    abytes_b) in label va_range1
    "***** POSTCONDITION NOT MET AT line 724 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let auth_bytes = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes auth_raw_quads) 0 (va_get_reg64 rRsi va_s0) in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 725 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let plain_raw_quads = FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_s0) in128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) in128_b)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_s0) inout_b) in label va_range1
    "***** POSTCONDITION NOT MET AT line 726 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let plain_bytes = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes plain_raw_quads) 0 plain_num_bytes in label va_range1
    "***** POSTCONDITION NOT MET AT line 727 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let cipher_raw_quads = FStar.Seq.Base.append #Vale.X64.Decls.quad32 (FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 6 va_sM) out128x6_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM) out128_b)) (Vale.X64.Decls.s128
    (va_get_mem_heaplet 5 va_sM) inout_b) in label va_range1
    "***** POSTCONDITION NOT MET AT line 728 column 9 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (let cipher_bytes = FStar.Seq.Base.slice #Vale.Def.Types_s.nat8
    (Vale.Def.Types_s.le_seq_quad32_to_bytes cipher_raw_quads) 0 plain_num_bytes in label va_range1
    "***** POSTCONDITION NOT MET AT line 737 column 52 of file /home/gebner/everest/hacl-star/vale/code/crypto/aes/x64/Vale.AES.X64.GCMdecryptOpt.vaf *****"
    (l_and (l_and (l_and (FStar.Seq.Base.length #Vale.Def.Types_s.nat8 auth_bytes < pow2_32)
    (FStar.Seq.Base.length #Vale.Def.Types_s.nat8 plain_bytes < pow2_32)) (cipher_bytes ==
    __proj__Mktuple2__item___1 #(FStar.Seq.Base.seq Vale.Def.Types_s.nat8) #bool
    (Vale.AES.GCM_s.gcm_decrypt_LE alg (Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE key) iv
    plain_bytes auth_bytes expected_tag))) (Vale.Def.Types_s.le_quad32_to_bytes (va_get_xmm 8
    va_sM) == Vale.AES.GCM.gcm_decrypt_LE_tag alg (Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE
    key) iv plain_bytes auth_bytes))))))))))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5; va_Mod_mem_heaplet
    3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64
    rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp; va_Mod_reg64
    rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx; va_Mod_reg64
    rRax; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Gcm_blocks_wrapped (alg:algorithm) (offset:int) (auth_b:buffer128) (abytes_b:buffer128)
  (in128x6_b:buffer128) (out128x6_b:buffer128) (in128_b:buffer128) (out128_b:buffer128)
  (inout_b:buffer128) (iv_b:buffer128) (iv:supported_iv_LE) (scratch_b:buffer128) (key:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (hkeys_b:buffer128) (expected_tag:(seq nat8))
  (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (let (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64
    (va_get_reg64 rRsp va_s0 + offset + 0) (va_get_stack va_s0) in let
    (in128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 8) (va_get_stack va_s0) in let (out128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 16) (va_get_stack va_s0) in
    let (len128x6:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 24) (va_get_stack va_s0) in let (in128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 32) (va_get_stack va_s0) in
    let (out128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 40) (va_get_stack va_s0) in let (len128:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 48) (va_get_stack va_s0) in
    let (inout_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 56) (va_get_stack va_s0) in let (plain_num_bytes:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 64) (va_get_stack va_s0) in
    sse_enabled /\ movbe_enabled /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 +
    offset + 0) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0)
    Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp
    va_s0 + offset + 16) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 24) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 32) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 40) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 48) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64 rRsp va_s0 + offset + 56) (va_get_stack
    va_s0) Public (va_get_stackTaint va_s0) /\ Vale.X64.Stack_i.valid_stack_slot64 (va_get_reg64
    rRsp va_s0 + offset + 64) (va_get_stack va_s0) Public (va_get_stackTaint va_s0) /\
    Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 1 va_s0) (va_get_reg64 rRdi va_s0) auth_b
    (va_get_reg64 rRdx va_s0) (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128
    (va_get_mem_heaplet 7 va_s0) abytes_ptr abytes_b 1 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8 va_s0) iv_b 1
    (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 6
    va_s0) in128x6_ptr in128x6_b len128x6 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 6 va_s0) out128x6_ptr out128x6_b len128x6
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 1
    va_s0) in128_ptr in128_b len128 (va_get_mem_layout va_s0) Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 1 va_s0) out128_ptr out128_b len128
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 5
    va_s0) inout_ptr inout_b 1 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validDstAddrs128
    (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0) scratch_b 9 (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 0 va_s0) (va_get_reg64 rR9 va_s0)
    hkeys_b 8 (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.buffer_disjoints128 iv_b ([keys_b;
    scratch_b; in128x6_b; out128x6_b; hkeys_b; in128_b; out128_b; inout_b]) /\
    Vale.X64.Decls.buffer_disjoints128 scratch_b ([keys_b; in128x6_b; out128x6_b; in128_b;
    out128_b; inout_b; hkeys_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128x6_b ([keys_b;
    hkeys_b; in128_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 out128_b ([keys_b; hkeys_b;
    out128x6_b; inout_b]) /\ Vale.X64.Decls.buffer_disjoints128 inout_b ([keys_b; hkeys_b;
    out128x6_b; out128_b]) /\ (Vale.X64.Decls.buffers_disjoint128 in128x6_b out128x6_b \/ in128x6_b
    == out128x6_b) /\ (Vale.X64.Decls.buffers_disjoint128 in128_b out128_b \/ in128_b == out128_b)
    /\ va_get_reg64 rRdi va_s0 + 16 `op_Multiply` va_get_reg64 rRdx va_s0 < pow2_64 /\ in128x6_ptr
    + 16 `op_Multiply` len128x6 < pow2_64 /\ out128x6_ptr + 16 `op_Multiply` len128x6 < pow2_64 /\
    in128_ptr + 16 `op_Multiply` len128 < pow2_64 /\ out128_ptr + 16 `op_Multiply` len128 < pow2_64
    /\ inout_ptr + 16 < pow2_64 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 auth_b ==
    va_get_reg64 rRdx va_s0 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 abytes_b == 1
    /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128x6_b ==
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 out128x6_b /\
    Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b == Vale.X64.Decls.buffer_length
    #Vale.X64.Memory.vuint128 out128_b /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128
    in128x6_b == len128x6 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 in128_b ==
    len128 /\ Vale.X64.Decls.buffer_length #Vale.X64.Memory.vuint128 inout_b == 1 /\
    plain_num_bytes < pow2_32 /\ va_get_reg64 rRsi va_s0 < pow2_32 /\ va_get_reg64 rR9 va_s0 + 32 <
    pow2_64 /\ Vale.X64.Memory.buffer_addr #Vale.X64.Memory.vuint128 keys_b (va_get_mem_heaplet 0
    va_s0) + 128 < pow2_64 /\ len128x6 `op_Modulus` 6 == 0 /\ (len128x6 > 0 ==> len128x6 >= 6) /\
    12 + len128x6 + 6 < pow2_32 /\ (va_mul_nat len128x6 (128 `op_Division` 8) + va_mul_nat len128
    (128 `op_Division` 8) <= plain_num_bytes /\ plain_num_bytes < va_mul_nat len128x6 (128
    `op_Division` 8) + va_mul_nat len128 (128 `op_Division` 8) + 128 `op_Division` 8) /\
    (va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) <= va_get_reg64 rRsi va_s0 /\
    va_get_reg64 rRsi va_s0 < va_mul_nat (va_get_reg64 rRdx va_s0) (128 `op_Division` 8) + 128
    `op_Division` 8) /\ aes_reqs alg key round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ pclmulqdq_enabled /\
    Vale.AES.GHash.hkeys_reqs_priv (Vale.X64.Decls.s128 (va_get_mem_heaplet 0 va_s0) hkeys_b)
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.AES_s.aes_encrypt_LE alg key
    (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0))) /\ (let iv_BE =
    Vale.X64.Decls.buffer128_read iv_b 0 (va_get_mem_heaplet 2 va_s0) in let h_LE =
    Vale.AES.AES_s.aes_encrypt_LE alg key (Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)
    in iv_BE == Vale.AES.GCM_s.compute_iv_BE h_LE iv)) /\ (forall (va_x_mem:vale_heap)
    (va_x_rax:nat64) (va_x_rbx:nat64) (va_x_rcx:nat64) (va_x_rdx:nat64) (va_x_rdi:nat64)
    (va_x_rsi:nat64) (va_x_rbp:nat64) (va_x_r8:nat64) (va_x_r9:nat64) (va_x_r10:nat64)
    (va_x_r11:nat64) (va_x_r12:nat64) (va_x_r13:nat64) (va_x_r14:nat64) (va_x_r15:nat64)
    (va_x_xmm0:quad32) (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32)
    (va_x_xmm5:quad32) (va_x_xmm6:quad32) (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32)
    (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32)
    (va_x_xmm14:quad32) (va_x_xmm15:quad32) (va_x_heap1:vale_heap) (va_x_heap2:vale_heap)
    (va_x_heap3:vale_heap) (va_x_heap5:vale_heap) (va_x_heap6:vale_heap)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_mem_heaplet 6
    va_x_heap6 (va_upd_mem_heaplet 5 va_x_heap5 (va_upd_mem_heaplet 3 va_x_heap3
    (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_mem_heaplet 1 va_x_heap1 (va_upd_xmm 15 va_x_xmm15
    (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11
    va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8
    (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4
    (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1 va_x_xmm1 (va_upd_xmm 0 va_x_xmm0
    (va_upd_reg64 rR15 va_x_r15 (va_upd_reg64 rR14 va_x_r14 (va_upd_reg64 rR13 va_x_r13
    (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rR10 va_x_r10
    (va_upd_reg64 rR9 va_x_r9 (va_upd_reg64 rR8 va_x_r8 (va_upd_reg64 rRbp va_x_rbp (va_upd_reg64
    rRsi va_x_rsi (va_upd_reg64 rRdi va_x_rdi (va_upd_reg64 rRdx va_x_rdx (va_upd_reg64 rRcx
    va_x_rcx (va_upd_reg64 rRbx va_x_rbx (va_upd_reg64 rRax va_x_rax (va_upd_mem va_x_mem
    va_s0))))))))))))))))))))))))))))))))))))) in va_get_ok va_sM /\ (let
    (abytes_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 0) (va_get_stack va_s0) in let (in128x6_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 8) (va_get_stack va_s0) in
    let (out128x6_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 16) (va_get_stack va_s0) in let (len128x6:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 24) (va_get_stack va_s0) in
    let (in128_ptr:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0
    + offset + 32) (va_get_stack va_s0) in let (out128_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 40) (va_get_stack va_s0) in
    let (len128:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 +
    offset + 48) (va_get_stack va_s0) in let (inout_ptr:Vale.X64.Memory.nat64) =
    Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp va_s0 + offset + 56) (va_get_stack va_s0) in
    let (plain_num_bytes:Vale.X64.Memory.nat64) = Vale.X64.Stack_i.load_stack64 (va_get_reg64 rRsp
    va_s0 + offset + 64) (va_get_stack va_s0) in Vale.X64.Decls.modifies_buffer128 out128_b
    (va_get_mem_heaplet 1 va_s0) (va_get_mem_heaplet 1 va_sM) /\ Vale.X64.Decls.modifies_buffer128
    iv_b (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) /\
    Vale.X64.Decls.modifies_buffer128 scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3
    va_sM) /\ Vale.X64.Decls.modifies_buffer128 inout_b (va_get_mem_heaplet 5 va_s0)
    (va_get_mem_heaplet 5 va_sM) /\ Vale.X64.Decls.modifies_buffer128 out128x6_b
    (va_get_mem_heaplet 6 va_s0) (va_get_mem_heaplet 6 va_sM) /\ plain_num_bytes < pow2_32 /\
    va_get_reg64 rRsi va_s0 < pow2_32 /\ (let iv_BE = Vale.X64.Decls.buffer128_read iv_b 0
    (va_get_mem_heaplet 2 va_s0) in let auth_raw_quads = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0) auth_b)
    (Vale.X64.Decls.s128 (va_get_mem_heaplet 7 va_s0) abytes_b) in let auth_bytes =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    auth_raw_quads) 0 (va_get_reg64 rRsi va_s0) in let plain_raw_quads = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_s0) in128x6_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_s0)
    in128_b)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_s0) inout_b) in let plain_bytes =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    plain_raw_quads) 0 plain_num_bytes in let cipher_raw_quads = FStar.Seq.Base.append
    #Vale.X64.Decls.quad32 (FStar.Seq.Base.append #Vale.X64.Decls.quad32 (Vale.X64.Decls.s128
    (va_get_mem_heaplet 6 va_sM) out128x6_b) (Vale.X64.Decls.s128 (va_get_mem_heaplet 1 va_sM)
    out128_b)) (Vale.X64.Decls.s128 (va_get_mem_heaplet 5 va_sM) inout_b) in let cipher_bytes =
    FStar.Seq.Base.slice #Vale.Def.Types_s.nat8 (Vale.Def.Types_s.le_seq_quad32_to_bytes
    cipher_raw_quads) 0 plain_num_bytes in l_and (l_and (l_and (FStar.Seq.Base.length
    #Vale.Def.Types_s.nat8 auth_bytes < pow2_32) (FStar.Seq.Base.length #Vale.Def.Types_s.nat8
    plain_bytes < pow2_32)) (cipher_bytes == __proj__Mktuple2__item___1 #(FStar.Seq.Base.seq
    Vale.Def.Types_s.nat8) #bool (Vale.AES.GCM_s.gcm_decrypt_LE alg
    (Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE key) iv plain_bytes auth_bytes expected_tag)))
    (Vale.Def.Types_s.le_quad32_to_bytes (va_get_xmm 8 va_sM) == Vale.AES.GCM.gcm_decrypt_LE_tag
    alg (Vale.Def.Words.Seq_s.seq_nat32_to_seq_nat8_LE key) iv plain_bytes auth_bytes))) ==> va_k
    va_sM (())))


val va_wpProof_Gcm_blocks_wrapped : alg:algorithm -> offset:int -> auth_b:buffer128 ->
  abytes_b:buffer128 -> in128x6_b:buffer128 -> out128x6_b:buffer128 -> in128_b:buffer128 ->
  out128_b:buffer128 -> inout_b:buffer128 -> iv_b:buffer128 -> iv:supported_iv_LE ->
  scratch_b:buffer128 -> key:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  hkeys_b:buffer128 -> expected_tag:(seq nat8) -> va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Gcm_blocks_wrapped alg offset auth_b abytes_b in128x6_b
    out128x6_b in128_b out128_b inout_b iv_b iv scratch_b key round_keys keys_b hkeys_b
    expected_tag va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Gcm_blocks_wrapped alg offset)
    ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5; va_Mod_mem_heaplet 3;
    va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64
    rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp; va_Mod_reg64
    rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx; va_Mod_reg64
    rRax; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Gcm_blocks_wrapped alg offset auth_b abytes_b in128x6_b out128x6_b in128_b out128_b
  inout_b iv_b iv scratch_b key round_keys keys_b hkeys_b expected_tag va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Gcm_blocks_wrapped (va_code_Gcm_blocks_wrapped alg offset) va_s0
    alg offset auth_b abytes_b in128x6_b out128x6_b in128_b out128_b inout_b iv_b iv scratch_b key
    round_keys keys_b hkeys_b expected_tag in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_mem_heaplet 6 va_sM
    (va_update_mem_heaplet 5 va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM
    (va_update_mem_heaplet 1 va_sM (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm
    13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm
    9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM (va_update_xmm 6 va_sM (va_update_xmm 5
    va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM (va_update_xmm 1
    va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR15 va_sM (va_update_reg64 rR14 va_sM
    (va_update_reg64 rR13 va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM
    (va_update_reg64 rR10 va_sM (va_update_reg64 rR9 va_sM (va_update_reg64 rR8 va_sM
    (va_update_reg64 rRbp va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM
    (va_update_reg64 rRdx va_sM (va_update_reg64 rRcx va_sM (va_update_reg64 rRbx va_sM
    (va_update_reg64 rRax va_sM (va_update_ok va_sM (va_update_mem va_sM
    va_s0))))))))))))))))))))))))))))))))))))))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_mem_heaplet 5; va_Mod_mem_heaplet
    3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13;
    va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7;
    va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64
    rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64 rR8; va_Mod_reg64 rRbp; va_Mod_reg64
    rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64 rRcx; va_Mod_reg64 rRbx; va_Mod_reg64
    rRax; va_Mod_mem]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Gcm_blocks_wrapped (alg:algorithm) (offset:int) (auth_b:buffer128)
  (abytes_b:buffer128) (in128x6_b:buffer128) (out128x6_b:buffer128) (in128_b:buffer128)
  (out128_b:buffer128) (inout_b:buffer128) (iv_b:buffer128) (iv:supported_iv_LE)
  (scratch_b:buffer128) (key:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (expected_tag:(seq nat8)) : (va_quickCode unit (va_code_Gcm_blocks_wrapped
  alg offset)) =
  (va_QProc (va_code_Gcm_blocks_wrapped alg offset) ([va_Mod_flags; va_Mod_mem_heaplet 6;
    va_Mod_mem_heaplet 5; va_Mod_mem_heaplet 3; va_Mod_mem_heaplet 2; va_Mod_mem_heaplet 1;
    va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10;
    va_Mod_xmm 9; va_Mod_xmm 8; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 4; va_Mod_xmm
    3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR15; va_Mod_reg64 rR14; va_Mod_reg64
    rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rR10; va_Mod_reg64 rR9; va_Mod_reg64
    rR8; va_Mod_reg64 rRbp; va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_reg64 rRdx; va_Mod_reg64
    rRcx; va_Mod_reg64 rRbx; va_Mod_reg64 rRax; va_Mod_mem]) (va_wp_Gcm_blocks_wrapped alg offset
    auth_b abytes_b in128x6_b out128x6_b in128_b out128_b inout_b iv_b iv scratch_b key round_keys
    keys_b hkeys_b expected_tag) (va_wpProof_Gcm_blocks_wrapped alg offset auth_b abytes_b
    in128x6_b out128x6_b in128_b out128_b inout_b iv_b iv scratch_b key round_keys keys_b hkeys_b
    expected_tag))
#pop-options
//--
//-- Gcm_blocks_decrypt_stdcall
#push-options "--z3rlimit 1600"

[@ "opaque_to_smt" va_qattr]
let va_code_Gcm_blocks_decrypt_stdcall win alg =
  (va_Block (va_CCons (va_code_CreateHeaplets ()) (va_CCons (va_Block (va_CNil ())) (va_CCons
    (va_code_Save_registers win) (va_CCons (if win then va_Block (va_CCons (va_code_Mov64
    (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRcx)) (va_CCons (va_code_Mov64
    (va_op_dst_opr64_reg64 rRsi) (va_op_opr64_reg64 rRdx)) (va_CCons (va_code_Mov64
    (va_op_dst_opr64_reg64 rRdx) (va_op_opr64_reg64 rR8)) (va_CCons (va_code_Mov64
    (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rR9)) (va_CCons (va_code_Load64_stack
    (va_op_dst_opr64_reg64 rR8) (va_op_reg_opr64_reg64 rRsp) (224 + 40 + 0)) (va_CCons
    (va_code_Load64_stack (va_op_dst_opr64_reg64 rR9) (va_op_reg_opr64_reg64 rRsp) (224 + 40 + 8))
    (va_CCons (va_code_Load64_stack (va_op_dst_opr64_reg64 rRbp) (va_op_reg_opr64_reg64 rRsp) (224
    + 40 + 88)) (va_CNil ())))))))) else va_Block (va_CCons (va_code_Load64_stack
    (va_op_dst_opr64_reg64 rRbp) (va_op_reg_opr64_reg64 rRsp) (64 + 8 + 72)) (va_CNil ())))
    (va_CCons (va_code_Gcm_blocks_wrapped alg (Vale.X64.Decls.total_if #int win (224 + 56) (64 +
    8))) (va_CCons (va_code_Load64_stack (va_op_dst_opr64_reg64 rR15) (va_op_reg_opr64_reg64 rRsp)
    (Vale.X64.Decls.total_if #int win (224 + 40 + 96) (64 + 8 + 80))) (va_CCons
    (va_code_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 0) (va_op_reg_opr64_reg64
    rR15) 0 Secret) (va_CCons (va_code_XmmEqual (va_op_xmm_xmm 0) (va_op_xmm_xmm 8)) (va_CCons
    (va_Block (va_CNil ())) (va_CCons (va_Block (va_CNil ())) (va_CCons (va_code_Mov64
    (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rRax)) (va_CCons (va_code_Restore_registers
    win) (va_CCons (va_code_Mov64 (va_op_dst_opr64_reg64 rRax) (va_op_opr64_reg64 rRcx)) (va_CCons
    (va_code_DestroyHeaplets ()) (va_CNil ()))))))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Gcm_blocks_decrypt_stdcall win alg =
  (va_pbool_and (va_codegen_success_CreateHeaplets ()) (va_pbool_and
    (va_codegen_success_Save_registers win) (va_pbool_and (if win then va_pbool_and
    (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rRdi) (va_op_opr64_reg64 rRcx)) (va_pbool_and
    (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rRsi) (va_op_opr64_reg64 rRdx)) (va_pbool_and
    (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rRdx) (va_op_opr64_reg64 rR8)) (va_pbool_and
    (va_codegen_success_Mov64 (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rR9)) (va_pbool_and
    (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rR8) (va_op_reg_opr64_reg64 rRsp) (224
    + 40 + 0)) (va_pbool_and (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rR9)
    (va_op_reg_opr64_reg64 rRsp) (224 + 40 + 8)) (va_pbool_and (va_codegen_success_Load64_stack
    (va_op_dst_opr64_reg64 rRbp) (va_op_reg_opr64_reg64 rRsp) (224 + 40 + 88)) (va_ttrue ())))))))
    else va_pbool_and (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rRbp)
    (va_op_reg_opr64_reg64 rRsp) (64 + 8 + 72)) (va_ttrue ())) (va_pbool_and
    (va_codegen_success_Gcm_blocks_wrapped alg (Vale.X64.Decls.total_if #int win (224 + 56) (64 +
    8))) (va_pbool_and (va_codegen_success_Load64_stack (va_op_dst_opr64_reg64 rR15)
    (va_op_reg_opr64_reg64 rRsp) (Vale.X64.Decls.total_if #int win (224 + 40 + 96) (64 + 8 + 80)))
    (va_pbool_and (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm
    0) (va_op_reg_opr64_reg64 rR15) 0 Secret) (va_pbool_and (va_codegen_success_XmmEqual
    (va_op_xmm_xmm 0) (va_op_xmm_xmm 8)) (va_pbool_and (va_codegen_success_Mov64
    (va_op_dst_opr64_reg64 rRcx) (va_op_opr64_reg64 rRax)) (va_pbool_and
    (va_codegen_success_Restore_registers win) (va_pbool_and (va_codegen_success_Mov64
    (va_op_dst_opr64_reg64 rRax) (va_op_opr64_reg64 rRcx)) (va_pbool_and
    (va_codegen_success_DestroyHeaplets ()) (va_ttrue ()))))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Gcm_blocks_decrypt_stdcall (va_mods:va_mods_t) (win:bool) (alg:algorithm)
  (auth_b:buffer128) (auth_bytes:nat64) (auth_num:nat64) (keys_b:buffer128) (iv_b:buffer128)
  (iv:supported_iv_LE) (hkeys_b:buffer128) (abytes_b:buffer128) (in128x6_b:buffer128)
  (out128x6_b:buffer128) (len128x6_num:nat64) (in128_b:buffer128) (out128_b:buffer128)
  (len128_num:nat64) (inout_b:buffer128) (cipher_num:nat64) (scratch_b:buffer128) (tag_b:buffer128)
val va_qcode_Gcm_blocks_decrypt_stdcall
      (va_mods: va_mods_t)
      (win: bool)
      (alg: algorithm)
      (auth_b: buffer128)
      (auth_bytes auth_num: nat64)
      (keys_b iv_b: buffer128)
      (iv: supported_iv_LE)
      (hkeys_b abytes_b in128x6_b out128x6_b: buffer128)
      (len128x6_num: nat64)
      (in128_b out128_b: buffer128)
      (len128_num: nat64)
      (inout_b: buffer128)
      (cipher_num: nat64)
      (scratch_b tag_b: buffer128)
      (key: (seq nat32))
    : (va_quickCode unit (va_code_Gcm_blocks_decrypt_stdcall win alg))

    va_mods: Vale.X64.QuickCode.va_mods_t ->
    win: Prims.bool ->
    alg: Vale.AES.AES_common_s.algorithm ->
    auth_b: Vale.X64.Memory.buffer128 ->
    auth_bytes: Vale.X64.Memory.nat64 ->
    auth_num: Vale.X64.Memory.nat64 ->
    keys_b: Vale.X64.Memory.buffer128 ->
    iv_b: Vale.X64.Memory.buffer128 ->
    iv: Vale.AES.GCM_s.supported_iv_LE ->
    hkeys_b: Vale.X64.Memory.buffer128 ->
    abytes_b: Vale.X64.Memory.buffer128 ->
    in128x6_b: Vale.X64.Memory.buffer128 ->
    out128x6_b: Vale.X64.Memory.buffer128 ->
    len128x6_num: Vale.X64.Memory.nat64 ->
    in128_b: Vale.X64.Memory.buffer128 ->
    out128_b: Vale.X64.Memory.buffer128 ->
    len128_num: Vale.X64.Memory.nat64 ->
    inout_b: Vale.X64.Memory.buffer128 ->
    cipher_num: Vale.X64.Memory.nat64 ->
    scratch_b: Vale.X64.Memory.buffer128 ->
    tag_b: Vale.X64.Memory.buffer128 ->
    key: FStar.Seq.Base.seq Vale.X64.Memory.nat32
  -> Vale.X64.QuickCode.va_quickCode Prims.unit
      (Vale.AES.X64.GCMdecryptOpt.va_code_Gcm_blocks_decrypt_stdcall win alg)