val va_wp_Loop6x_partial
      (alg: algorithm)
      (h_LE y_prev: quad32)
      (data: (seq quad32))
      (count in0_count: nat)
      (iv_b in0_b in_b scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> quad32_6 -> Type0))
    : Type0
let va_wp_Loop6x_partial (alg:algorithm) (h_LE:quad32) (y_prev:quad32) (data:(seq quad32))
  (count:nat) (in0_count:nat) (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128)
  (scratch_b:buffer128) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state -> quad32_6 -> Type0)) :
  Type0 =
  (va_get_ok va_s0 /\ (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in let (prev:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 y_prev) in sse_enabled
    /\ movbe_enabled /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0
    16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8
    va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rR14 va_s0) in0_b (in0_count `op_Multiply` 6) 6
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rRdi va_s0) in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp
    va_s0) scratch_b 9 (va_get_mem_layout va_s0) Secret /\ va_get_reg64 rRdi va_s0 + 96 < pow2_64
    /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 ==
    FStar.Seq.Base.index #quad32 round_keys 0 /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\ va_get_reg64 rRbx
    va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256 /\ va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0, va_get_xmm 12 va_s0,
    va_get_xmm 13 va_s0, va_get_xmm 14 va_s0) == xor_reverse_inc32lite_6 1 0 ctr_BE (va_get_xmm 15
    va_s0)) /\ FStar.Seq.Base.length #quad32 data == 6 /\ hkeys_b_powers hkeys_b
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) (va_get_reg64 rR9 va_s0 - 32) h /\
    scratch_b_data true true scratch_b 8 5 (va_get_mem_heaplet 3 va_s0) (va_get_mem_layout va_s0)
    (va_get_reg64 rRbp va_s0) data /\ va_get_xmm 7 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (va_subscript_FStar__Seq__Base__seq data 5) /\ add (add (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_s0))) == prev) /\ (forall (va_x_mem:vale_heap) (va_x_rbx:nat64)
    (va_x_r11:nat64) (va_x_r12:nat64) (va_x_r13:nat64) (va_x_xmm0:quad32) (va_x_xmm1:quad32)
    (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm4:quad32) (va_x_xmm5:quad32) (va_x_xmm6:quad32)
    (va_x_xmm7:quad32) (va_x_xmm8:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_xmm15:quad32) (va_x_heap2:vale_heap) (va_x_heap3:vale_heap) (va_x_efl:Vale.X64.Flags.t)
    (init:quad32_6) . let va_sM = va_upd_flags va_x_efl (va_upd_mem_heaplet 3 va_x_heap3
    (va_upd_mem_heaplet 2 va_x_heap2 (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14 va_x_xmm14
    (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10
    va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 8 va_x_xmm8 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm
    6 va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 4 va_x_xmm4 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm
    2 va_x_xmm2 (va_upd_xmm 1 va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR13 va_x_r13
    (va_upd_reg64 rR12 va_x_r12 (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRbx va_x_rbx (va_upd_mem
    va_x_mem va_s0))))))))))))))))))))))) in va_get_ok va_sM /\ (let (h:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in let
    (prev:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 y_prev) in Vale.X64.Decls.modifies_buffer_specific128
    scratch_b (va_get_mem_heaplet 3 va_s0) (va_get_mem_heaplet 3 va_sM) 1 8 /\
    Vale.X64.Decls.modifies_buffer_specific128 iv_b (va_get_mem_heaplet 2 va_s0)
    (va_get_mem_heaplet 2 va_sM) 0 0 /\ (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM <
    256) /\ va_get_reg64 rRbx va_sM == Vale.Def.Words_s.__proj__Mkfour__item__lo0
    (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256 /\ (va_get_xmm 9 va_sM, va_get_xmm 10
    va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM, va_get_xmm 13 va_sM, va_get_xmm 14 va_sM) ==
    rounds_opaque_6 init round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_reg64 rR13 va_sM
    == Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.hi64 (Vale.X64.Decls.buffer128_read
    in0_b (in0_count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM))) /\ va_get_reg64 rR12 va_sM
    == Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.lo64 (Vale.X64.Decls.buffer128_read
    in0_b (in0_count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM))) /\ (let rk =
    FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in (va_get_xmm 2 va_sM,
    va_get_xmm 0 va_sM, va_get_xmm 5 va_sM, va_get_xmm 6 va_sM, va_get_xmm 7 va_sM, va_get_xmm 3
    va_sM) == make_six_of #quad32 (fun (i:(va_int_range 0 5)) -> Vale.Def.Types_s.quad32_xor rk
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + i) (va_get_mem_heaplet 6 va_sM)))
    /\ Vale.X64.Decls.buffer128_read scratch_b 8 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\
    Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 3
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in0_b (in0_count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6
    va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 5
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in0_b (in0_count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6
    va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_s0)) /\ init == make_six_of #quad32 (fun
    (n:(va_int_range 0 5)) -> Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE n)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys
    0)) /\ (let eventual_Xi = add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)) in
    eventual_Xi == Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental h_LE y_prev data))))) ==> va_k va_sM ((init))))
val va_wp_Loop6x_partial
      (alg: algorithm)
      (h_LE y_prev: quad32)
      (data: (seq quad32))
      (count in0_count: nat)
      (iv_b in0_b in_b scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> quad32_6 -> Type0))
    : Type0
let va_wp_Loop6x_partial
      (alg: algorithm)
      (h_LE y_prev: quad32)
      (data: (seq quad32))
      (count in0_count: nat)
      (iv_b in0_b in_b scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> quad32_6 -> Type0))
    : Type0 =
(va_get_ok va_s0 /\
  (let h:Vale.Math.Poly2_s.poly =
      Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 h_LE)
    in
    let prev:Vale.Math.Poly2_s.poly =
      Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 y_prev)
    in
    sse_enabled /\ movbe_enabled /\
    va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0)
      (va_get_reg64 rR8 va_s0)
      iv_b
      1
      (va_get_mem_layout va_s0)
      Public /\
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
      (va_get_reg64 rR14 va_s0)
      in0_b
      (in0_count `op_Multiply` 6)
      6
      (va_get_mem_layout va_s0)
      Secret /\
    Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6 va_s0)
      (va_get_reg64 rRdi va_s0)
      in_b
      (count `op_Multiply` 6)
      6
      (va_get_mem_layout va_s0)
      Secret /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0)
      (va_get_reg64 rRbp va_s0)
      scratch_b
      9
      (va_get_mem_layout va_s0)
      Secret /\ va_get_reg64 rRdi va_s0 + 96 < pow2_64 /\
    aes_reqs_offset alg
      key_words
      round_keys
      keys_b
      (va_get_reg64 rRcx va_s0)
      (va_get_mem_heaplet 0 va_s0)
      (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 == FStar.Seq.Base.index #quad32 round_keys 0 /\
    va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\
    va_get_reg64 rRbx va_s0 == (Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE) `op_Modulus` 256 /\
    va_get_xmm 9 va_s0 ==
    Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE
              0))
      (va_get_xmm 15 va_s0) /\
    (va_get_reg64 rRbx va_s0 + 6 < 256 ==>
      (va_get_xmm 9 va_s0,
        va_get_xmm 10 va_s0,
        va_get_xmm 11 va_s0,
        va_get_xmm 12 va_s0,
        va_get_xmm 13 va_s0,
        va_get_xmm 14 va_s0) ==
      xor_reverse_inc32lite_6 1 0 ctr_BE (va_get_xmm 15 va_s0)) /\
    FStar.Seq.Base.length #quad32 data == 6 /\
    hkeys_b_powers hkeys_b
      (va_get_mem_heaplet 0 va_s0)
      (va_get_mem_layout va_s0)
      (va_get_reg64 rR9 va_s0 - 32)
      h /\
    scratch_b_data true
      true
      scratch_b
      8
      5
      (va_get_mem_heaplet 3 va_s0)
      (va_get_mem_layout va_s0)
      (va_get_reg64 rRbp va_s0)
      data /\
    va_get_xmm 7 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (va_subscript_FStar__Seq__Base__seq data 5) /\
    add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_s0))
          (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
      (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b
              1
              (va_get_mem_heaplet 3 va_s0))) ==
    prev) /\
  (forall (va_x_mem: vale_heap) (va_x_rbx: nat64) (va_x_r11: nat64) (va_x_r12: nat64)
      (va_x_r13: nat64) (va_x_xmm0: quad32) (va_x_xmm1: quad32) (va_x_xmm2: quad32)
      (va_x_xmm3: quad32) (va_x_xmm4: quad32) (va_x_xmm5: quad32) (va_x_xmm6: quad32)
      (va_x_xmm7: quad32) (va_x_xmm8: quad32) (va_x_xmm9: quad32) (va_x_xmm10: quad32)
      (va_x_xmm11: quad32) (va_x_xmm12: quad32) (va_x_xmm13: quad32) (va_x_xmm14: quad32)
      (va_x_xmm15: quad32) (va_x_heap2: vale_heap) (va_x_heap3: vale_heap)
      (va_x_efl: Vale.X64.Flags.t) (init: quad32_6).
      let va_sM =
        va_upd_flags va_x_efl
          (va_upd_mem_heaplet 3
              va_x_heap3
              (va_upd_mem_heaplet 2
                  va_x_heap2
                  (va_upd_xmm 15
                      va_x_xmm15
                      (va_upd_xmm 14
                          va_x_xmm14
                          (va_upd_xmm 13
                              va_x_xmm13
                              (va_upd_xmm 12
                                  va_x_xmm12
                                  (va_upd_xmm 11
                                      va_x_xmm11
                                      (va_upd_xmm 10
                                          va_x_xmm10
                                          (va_upd_xmm 9
                                              va_x_xmm9
                                              (va_upd_xmm 8
                                                  va_x_xmm8
                                                  (va_upd_xmm 7
                                                      va_x_xmm7
                                                      (va_upd_xmm 6
                                                          va_x_xmm6
                                                          (va_upd_xmm 5
                                                              va_x_xmm5
                                                              (va_upd_xmm 4
                                                                  va_x_xmm4
                                                                  (va_upd_xmm 3
                                                                      va_x_xmm3
                                                                      (va_upd_xmm 2
                                                                          va_x_xmm2
                                                                          (va_upd_xmm 1
                                                                              va_x_xmm1
                                                                              (va_upd_xmm 0
                                                                                  va_x_xmm0
                                                                                  (va_upd_reg64 rR13
                                                                                      va_x_r13
                                                                                      (va_upd_reg64 rR12
                                                                                          va_x_r12
                                                                                          (va_upd_reg64
                                                                                              rR11
                                                                                              va_x_r11
                                                                                              (va_upd_reg64
                                                                                                  rRbx
                                                                                                  va_x_rbx
                                                                                                  (va_upd_mem
                                                                                                      va_x_mem
                                                                                                      va_s0

                                                                                                  ))
                                                                                          ))))))))))
                                                  )))))))))))
      in
      va_get_ok va_sM /\
      (let h:Vale.Math.Poly2_s.poly =
          Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 h_LE)
        in
        let prev:Vale.Math.Poly2_s.poly =
          Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 y_prev)
        in
        Vale.X64.Decls.modifies_buffer_specific128 scratch_b
          (va_get_mem_heaplet 3 va_s0)
          (va_get_mem_heaplet 3 va_sM)
          1
          8 /\
        Vale.X64.Decls.modifies_buffer_specific128 iv_b
          (va_get_mem_heaplet 2 va_s0)
          (va_get_mem_heaplet 2 va_sM)
          0
          0 /\ (0 <= va_get_reg64 rRbx va_sM /\ va_get_reg64 rRbx va_sM < 256) /\
        va_get_reg64 rRbx va_sM ==
        (Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6))
        `op_Modulus`
        256 /\
        (va_get_xmm 9 va_sM,
          va_get_xmm 10 va_sM,
          va_get_xmm 11 va_sM,
          va_get_xmm 12 va_sM,
          va_get_xmm 13 va_sM,
          va_get_xmm 14 va_sM) ==
        rounds_opaque_6 init round_keys (Vale.AES.AES_common_s.nr alg - 1) /\
        va_get_reg64 rR13 va_sM ==
        Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.hi64 (Vale.X64.Decls.buffer128_read in0_b
                  (in0_count `op_Multiply` 6 + 0)
                  (va_get_mem_heaplet 6 va_sM))) /\
        va_get_reg64 rR12 va_sM ==
        Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.lo64 (Vale.X64.Decls.buffer128_read in0_b
                  (in0_count `op_Multiply` 6 + 0)
                  (va_get_mem_heaplet 6 va_sM))) /\
        (let rk = FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in
          (va_get_xmm 2 va_sM,
            va_get_xmm 0 va_sM,
            va_get_xmm 5 va_sM,
            va_get_xmm 6 va_sM,
            va_get_xmm 7 va_sM,
            va_get_xmm 3 va_sM) ==
          make_six_of #quad32
            (fun (i: (va_int_range 0 5)) ->
                Vale.Def.Types_s.quad32_xor rk
                  (Vale.X64.Decls.buffer128_read in_b
                      (count `op_Multiply` 6 + i)
                      (va_get_mem_heaplet 6 va_sM))) /\
          Vale.X64.Decls.buffer128_read scratch_b 8 (va_get_mem_heaplet 3 va_sM) ==
          Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\
          Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM) ==
          Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b
                (in0_count `op_Multiply` 6 + 5)
                (va_get_mem_heaplet 6 va_s0)) /\
          Vale.X64.Decls.buffer128_read scratch_b 3 (va_get_mem_heaplet 3 va_sM) ==
          Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b
                (in0_count `op_Multiply` 6 + 4)
                (va_get_mem_heaplet 6 va_s0)) /\
          Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) ==
          Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b
                (in0_count `op_Multiply` 6 + 3)
                (va_get_mem_heaplet 6 va_s0)) /\
          Vale.X64.Decls.buffer128_read scratch_b 5 (va_get_mem_heaplet 3 va_sM) ==
          Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b
                (in0_count `op_Multiply` 6 + 2)
                (va_get_mem_heaplet 6 va_s0)) /\
          Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
          Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b
                (in0_count `op_Multiply` 6 + 1)
                (va_get_mem_heaplet 6 va_s0)) /\
          init ==
          make_six_of #quad32
            (fun (n: (va_int_range 0 5)) ->
                Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
                          ctr_BE
                          n))
                  (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) /\
          (let eventual_Xi =
              add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM))
                    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b
                            1
                            (va_get_mem_heaplet 3 va_sM))))
                (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM))
            in
            eventual_Xi ==
            Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GHash.ghash_incremental
                      h_LE
                      y_prev
                      data))))) ==>
      va_k va_sM ((init))))
Vale.AES.X64.AESopt.fsti.checked
Vale.X64.State.fsti.checked Vale.X64.QuickCodes.fsti.checked Vale.X64.QuickCode.fst.checked Vale.X64.Memory.fsti.checked Vale.X64.Machine_s.fst.checked Vale.X64.InsVector.fsti.checked Vale.X64.InsMem.fsti.checked Vale.X64.InsBasic.fsti.checked Vale.X64.InsAes.fsti.checked Vale.X64.Flags.fsti.checked Vale.X64.Decls.fsti.checked Vale.X64.CPU_Features_s.fst.checked Vale.Transformers.Transform.fsti.checked Vale.Math.Poly2_s.fsti.checked Vale.Math.Poly2.Bits_s.fsti.checked Vale.Def.Words_s.fsti.checked Vale.Def.Types_s.fst.checked Vale.Def.Prop_s.fst.checked Vale.Def.Opaque_s.fsti.checked Vale.Arch.TypesNative.fsti.checked Vale.Arch.Types.fsti.checked Vale.Arch.HeapImpl.fsti.checked Vale.AES.X64.PolyOps.fsti.checked Vale.AES.X64.AESopt2.fsti.checked Vale.AES.X64.AESGCM_expected_code.fsti.checked Vale.AES.GHash.fsti.checked Vale.AES.GF128_s.fsti.checked Vale.AES.GF128.fsti.checked Vale.AES.GCTR_s.fst.checked Vale.AES.GCTR.fsti.checked Vale.AES.GCM_helpers.fsti.checked Vale.AES.AES_s.fst.checked Vale.AES.AES_helpers.fsti.checked Vale.AES.AES_common_s.fst.checked prims.fst.checked FStar.Seq.Base.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.Mul.fst.checked
Vale.AES.X64.AESopt.fsti
Vale.AES.AES_common_s.algorithm Vale.X64.Decls.quad32 FStar.Seq.Base.seq Prims.nat Vale.X64.Memory.buffer128 Vale.X64.Memory.nat32 Vale.X64.Decls.va_state Vale.AES.X64.AESopt.quad32_6 Prims.l_and Prims.b2t Vale.X64.Decls.va_get_ok Vale.X64.CPU_Features_s.sse_enabled Vale.X64.CPU_Features_s.movbe_enabled Prims.eq2 Vale.Def.Words_s.four Vale.Def.Types_s.nat32 Vale.X64.Decls.va_get_xmm Vale.Def.Words_s.Mkfour Vale.X64.Decls.validDstAddrs128 Vale.X64.Decls.va_get_mem_heaplet Vale.X64.Decls.va_get_reg64 Vale.X64.Machine_s.rR8 Vale.X64.Decls.va_get_mem_layout Vale.Arch.HeapTypes_s.Public Vale.X64.Decls.validSrcAddrsOffset128 Vale.X64.Machine_s.rR14 Prims.op_Multiply Vale.Arch.HeapTypes_s.Secret Vale.X64.Machine_s.rRdi Vale.X64.Machine_s.rRbp Prims.op_LessThan Prims.op_Addition Vale.X64.Machine_s.pow2_64 Vale.AES.X64.AESopt.aes_reqs_offset Vale.X64.Machine_s.rRcx FStar.Seq.Base.index Vale.Def.Types_s.quad32 Vale.Def.Types_s.reverse_bytes_quad32 Vale.AES.GCTR.inc32lite Prims.int Vale.X64.Machine_s.rRbx Prims.op_Modulus Vale.Def.Words_s.__proj__Mkfour__item__lo0 Vale.Def.Types_s.quad32_xor Prims.l_imp FStar.Pervasives.Native.tuple6 FStar.Pervasives.Native.Mktuple6 Vale.AES.X64.AESopt.xor_reverse_inc32lite_6 FStar.Seq.Base.length Vale.AES.X64.AESopt2.hkeys_b_powers Prims.op_Subtraction Vale.X64.Machine_s.rR9 Vale.AES.X64.AESopt2.scratch_b_data Vale.AES.X64.AESopt2.va_subscript_FStar__Seq__Base__seq Vale.Math.Poly2_s.poly Vale.Math.Poly2_s.add Vale.Math.Poly2.Bits_s.of_quad32 Vale.X64.Decls.buffer128_read Prims.l_Forall Vale.X64.InsBasic.vale_heap Vale.X64.Memory.nat64 Vale.X64.Flags.t Vale.X64.Decls.modifies_buffer_specific128 Prims.op_LessThanOrEqual Vale.AES.X64.AESopt.rounds_opaque_6 Vale.AES.AES_common_s.nr Vale.Def.Types_s.nat64 Vale.X64.Machine_s.rR13 Vale.Def.Types_s.reverse_bytes_nat64 Vale.Arch.Types.hi64 Vale.X64.Machine_s.rR12 Vale.Arch.Types.lo64 Vale.AES.X64.AESopt.make_six_of Vale.X64.Decls.va_int_range Vale.AES.X64.AESopt.six_of Vale.AES.GHash.ghash_incremental Vale.X64.State.vale_state Vale.X64.Decls.va_upd_flags Vale.X64.Decls.va_upd_mem_heaplet Vale.X64.Decls.va_upd_xmm Vale.X64.Decls.va_upd_reg64 Vale.X64.Machine_s.rR11 Vale.X64.Decls.va_upd_mem
module Vale.AES.X64.AESopt
open FStar.Mul
open Vale.Def.Prop_s
open Vale.Def.Opaque_s
open Vale.Def.Words_s
open Vale.Def.Types_s
open FStar.Seq
open Vale.Arch.Types
open Vale.Arch.HeapImpl
open Vale.AES.AES_s
open Vale.X64.Machine_s
open Vale.X64.Memory
open Vale.X64.State
open Vale.X64.Decls
open Vale.X64.InsBasic
open Vale.X64.InsMem
open Vale.X64.InsVector
open Vale.X64.InsAes
open Vale.X64.QuickCode
open Vale.X64.QuickCodes
open Vale.AES.AES_helpers
//open Vale.Poly1305.Math    // For lemma_poly_bits64()
open Vale.AES.GCM_helpers
open Vale.AES.GCTR_s
open Vale.AES.GCTR
open Vale.Arch.TypesNative
open Vale.X64.CPU_Features_s
open Vale.Math.Poly2_s
open Vale.AES.GF128_s
open Vale.AES.GF128
open Vale.AES.GHash
open Vale.AES.X64.PolyOps
open Vale.AES.X64.AESopt2
open Vale.AES.X64.AESGCM_expected_code
open Vale.Transformers.Transform
open FStar.Mul
let aes_reqs0
  (alg:algorithm) (key:seq nat32) (round_keys:seq quad32) (keys_b:buffer128)
  (key_ptr:int) (heap0:vale_heap) (layout:vale_heap_layout) : prop0
  =
  aesni_enabled /\ pclmulqdq_enabled /\ avx_enabled /\
  alg = AES_128 /\
  //(alg = AES_128 || alg = AES_256) /\
  is_aes_key_LE alg key /\
  length(round_keys) == nr(alg) + 1 /\
  round_keys == key_to_round_keys_LE alg key /\
  validSrcAddrsOffset128 heap0 key_ptr keys_b 8 (nr alg + 1 - 8) layout Secret /\
  buffer128_as_seq heap0 keys_b == round_keys

let aes_reqs_offset
  (alg:algorithm) (key:seq nat32) (round_keys:seq quad32) (keys_b:buffer128)
  (key_ptr:int) (heap0:vale_heap) (layout:vale_heap_layout) : prop0
  =
  aesni_enabled /\ avx_enabled /\ pclmulqdq_enabled /\
  (alg = AES_128 || alg = AES_256) /\
  is_aes_key_LE alg key /\
  length(round_keys) == nr(alg) + 1 /\
  round_keys == key_to_round_keys_LE alg key /\
  validSrcAddrsOffset128 heap0 key_ptr keys_b 8 (nr alg + 1 - 8) layout Secret /\
  s128 heap0 keys_b == round_keys

let six_of (a:Type0) = a & a & a & a & a & a
let quad32_6 = six_of quad32

unfold let make_six_of (#a:Type0) (f:(n:nat{n < 6}) -> GTot a) : GTot (six_of a) =
  (f 0, f 1, f 2, f 3, f 4, f 5)
unfold let map_six_of (#a #b:Type0) (x:six_of a) (f:a -> GTot b) : GTot (six_of b) =
  let (x0, x1, x2, x3, x4, x5) = x in
  (f x0, f x1, f x2, f x3, f x4, f x5)
unfold let map2_six_of (#a #b #c:Type0) (x:six_of a) (y:six_of b) (f:a -> b -> GTot c) : GTot (six_of c) =
  let (x0, x1, x2, x3, x4, x5) = x in
  let (y0, y1, y2, y3, y4, y5) = y in
  (f x0 y0, f x1 y1, f x2 y2, f x3 y3, f x4 y4, f x5 y5)

let rounds_opaque_6 (init:quad32_6) (round_keys:seq quad32) (rnd:nat{rnd < length round_keys}) : GTot quad32_6 =
  map_six_of init (fun x -> eval_rounds x round_keys rnd)

let xor_reverse_inc32lite_6 (n i0:int) (ctr_BE rndkey:quad32) : GTot quad32_6 =
  make_six_of (fun i ->
    let r = reverse_bytes_quad32 (inc32lite ctr_BE (i0 + i)) in
    if i < n then quad32_xor r rndkey else r)

//let scratch_reqs (scratch_b:buffer128) (count:nat) (heap3:vale_heap) (s:seq quad32) (z3:quad32) : prop0 =
//  count * 6 + 6 <= length s /\ (
//    let data = slice s (count * 6) (count * 6 + 6) in
//    z3 == reverse_bytes_quad32 (index data 5) /\
//    scratch_b_blocks true true scratch_b 8 5 heap3 data)

let scratch_reqs (scratch_b:buffer128) (count:nat) (heap3:vale_heap) (s:seq quad32) (z3:quad32) : prop0 =
  count * 6 + 6 <= length s /\ (
    let data = slice s (count * 6) (count * 6 + 6) in
    z3 == reverse_bytes_quad32 (index data 5) /\
    buffer128_read scratch_b 3 heap3 == reverse_bytes_quad32 (index data 4) /\
    buffer128_read scratch_b 4 heap3 == reverse_bytes_quad32 (index data 3) /\
    buffer128_read scratch_b 5 heap3 == reverse_bytes_quad32 (index data 2) /\
    buffer128_read scratch_b 6 heap3 == reverse_bytes_quad32 (index data 1) /\
    buffer128_read scratch_b 7 heap3 == reverse_bytes_quad32 (index data 0))
//-- Load_two_lsb

val va_code_Load_two_lsb : dst:va_operand_xmm -> Tot va_code

val va_codegen_success_Load_two_lsb : dst:va_operand_xmm -> Tot va_pbool

val va_lemma_Load_two_lsb : va_b0:va_code -> va_s0:va_state -> dst:va_operand_xmm
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Load_two_lsb dst) va_s0 /\ va_is_dst_xmm dst va_s0 /\
    va_get_ok va_s0 /\ sse_enabled))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    va_eval_xmm va_sM dst == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 2 0 0 0 /\ va_state_eq
    va_sM (va_update_flags va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM
    (va_update_operand_xmm dst va_sM va_s0))))))
[@ va_qattr]
let va_wp_Load_two_lsb (dst:va_operand_xmm) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) :
  Type0 =
  (va_is_dst_xmm dst va_s0 /\ va_get_ok va_s0 /\ sse_enabled /\ (forall (va_x_dst:va_value_xmm)
    (va_x_r11:nat64) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_reg64
    rR11 va_x_r11 (va_upd_operand_xmm dst va_x_dst va_s0)) in va_get_ok va_sM /\ va_eval_xmm va_sM
    dst == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 2 0 0 0 ==> va_k va_sM (())))

val va_wpProof_Load_two_lsb : dst:va_operand_xmm -> va_s0:va_state -> va_k:(va_state -> unit ->
  Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Load_two_lsb dst va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Load_two_lsb dst) ([va_Mod_flags;
    va_Mod_reg64 rR11; va_mod_xmm dst]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@ "opaque_to_smt" va_qattr]
let va_quick_Load_two_lsb (dst:va_operand_xmm) : (va_quickCode unit (va_code_Load_two_lsb dst)) =
  (va_QProc (va_code_Load_two_lsb dst) ([va_Mod_flags; va_Mod_reg64 rR11; va_mod_xmm dst])
    (va_wp_Load_two_lsb dst) (va_wpProof_Load_two_lsb dst))
//--
//-- Load_one_lsb

val va_code_Load_one_lsb : dst:va_operand_xmm -> Tot va_code

val va_codegen_success_Load_one_lsb : dst:va_operand_xmm -> Tot va_pbool

val va_lemma_Load_one_lsb : va_b0:va_code -> va_s0:va_state -> dst:va_operand_xmm
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Load_one_lsb dst) va_s0 /\ va_is_dst_xmm dst va_s0 /\
    va_get_ok va_s0 /\ sse_enabled))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    va_eval_xmm va_sM dst == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 1 0 0 0 /\ va_state_eq
    va_sM (va_update_flags va_sM (va_update_reg64 rR11 va_sM (va_update_ok va_sM
    (va_update_operand_xmm dst va_sM va_s0))))))
[@ va_qattr]
let va_wp_Load_one_lsb (dst:va_operand_xmm) (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) :
  Type0 =
  (va_is_dst_xmm dst va_s0 /\ va_get_ok va_s0 /\ sse_enabled /\ (forall (va_x_dst:va_value_xmm)
    (va_x_r11:nat64) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_reg64
    rR11 va_x_r11 (va_upd_operand_xmm dst va_x_dst va_s0)) in va_get_ok va_sM /\ va_eval_xmm va_sM
    dst == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 1 0 0 0 ==> va_k va_sM (())))

val va_wpProof_Load_one_lsb : dst:va_operand_xmm -> va_s0:va_state -> va_k:(va_state -> unit ->
  Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Load_one_lsb dst va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Load_one_lsb dst) ([va_Mod_flags;
    va_Mod_reg64 rR11; va_mod_xmm dst]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@ "opaque_to_smt" va_qattr]
let va_quick_Load_one_lsb (dst:va_operand_xmm) : (va_quickCode unit (va_code_Load_one_lsb dst)) =
  (va_QProc (va_code_Load_one_lsb dst) ([va_Mod_flags; va_Mod_reg64 rR11; va_mod_xmm dst])
    (va_wp_Load_one_lsb dst) (va_wpProof_Load_one_lsb dst))
//--
//-- Loop6x_final

val va_code_Loop6x_final : alg:algorithm -> Tot va_code

val va_codegen_success_Loop6x_final : alg:algorithm -> Tot va_pbool

val va_lemma_Loop6x_final : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> iv_b:buffer128 ->
  scratch_b:buffer128 -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  ctr_orig:quad32 -> init:quad32_6 -> ctrs:quad32_6 -> plain:quad32_6 -> inb:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Loop6x_final alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8
    va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validDstAddrs128
    (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0) scratch_b 9 (va_get_mem_layout va_s0)
    Secret /\ va_get_reg64 rRdi va_s0 + 96 < pow2_64 /\ va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\
    aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0
    va_s0) (va_get_mem_layout va_s0) /\ init == map_six_of #quad32 #quad32 ctrs (fun (c:quad32) ->
    Vale.Def.Types_s.quad32_xor c (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) /\
    (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0, va_get_xmm 12 va_s0, va_get_xmm
    13 va_s0, va_get_xmm 14 va_s0) == rounds_opaque_6 init round_keys (Vale.AES.AES_common_s.nr alg
    - 1) /\ va_get_reg64 rR13 va_s0 == Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.hi64
    inb) /\ va_get_reg64 rR12 va_s0 == Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.lo64
    inb) /\ (let rk = FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in
    (va_get_xmm 2 va_s0, va_get_xmm 0 va_s0, va_get_xmm 5 va_s0, va_get_xmm 6 va_s0, va_get_xmm 7
    va_s0, va_get_xmm 3 va_s0) == map_six_of #quad32 #quad32 plain (fun (p:quad32) ->
    Vale.Def.Types_s.quad32_xor rk p) /\ Vale.X64.Decls.buffer128_read scratch_b 8
    (va_get_mem_heaplet 3 va_s0) == Vale.Def.Types_s.reverse_bytes_quad32 ctr_orig))))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 7 7 /\ Vale.X64.Decls.buffer128_read scratch_b 7
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32 inb /\ (va_get_xmm 9
    va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM, va_get_xmm 13 va_sM,
    va_get_xmm 14 va_sM) == map2_six_of #quad32 #quad32 #quad32 plain ctrs (fun (p:quad32)
    (c:quad32) -> Vale.Def.Types_s.quad32_xor p (Vale.AES.AES_s.aes_encrypt_LE alg key_words c)) /\
    va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0 /\ va_get_reg64 rRdi va_sM ==
    va_get_reg64 rRdi va_s0 + 96 /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96 /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_sM == Vale.X64.Decls.buffer128_read scratch_b 8 (va_get_mem_heaplet 3 va_s0) /\
    (let ctr = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256 in ctr + 6 <
    256 ==> (va_get_xmm 1 va_sM, va_get_xmm 0 va_sM, va_get_xmm 5 va_sM, va_get_xmm 6 va_sM,
    va_get_xmm 7 va_sM, va_get_xmm 3 va_sM) == xor_reverse_inc32lite_6 0 0 ctr_orig (va_get_xmm 15
    va_sM))) /\ va_state_eq va_sM (va_update_mem_heaplet 3 va_sM (va_update_flags va_sM
    (va_update_xmm 15 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM
    (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 3 va_sM (va_update_xmm 2 va_sM
    (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR13 va_sM (va_update_reg64 rR12
    va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rRsi va_sM (va_update_reg64 rRdi va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))))))))))))))
[@ va_qattr]
let va_wp_Loop6x_final (alg:algorithm) (iv_b:buffer128) (scratch_b:buffer128) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) (init:quad32_6)
  (ctrs:quad32_6) (plain:quad32_6) (inb:quad32) (va_s0:va_state) (va_k:(va_state -> unit -> Type0))
  : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.validSrcAddrs128 (va_get_mem_heaplet 2 va_s0)
    (va_get_reg64 rR8 va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp va_s0)
    scratch_b 9 (va_get_mem_layout va_s0) Secret /\ va_get_reg64 rRdi va_s0 + 96 < pow2_64 /\
    va_get_reg64 rRsi va_s0 + 96 < pow2_64 /\ aes_reqs_offset alg key_words round_keys keys_b
    (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ init ==
    map_six_of #quad32 #quad32 ctrs (fun (c:quad32) -> Vale.Def.Types_s.quad32_xor c
    (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys 0)) /\ (va_get_xmm 9 va_s0,
    va_get_xmm 10 va_s0, va_get_xmm 11 va_s0, va_get_xmm 12 va_s0, va_get_xmm 13 va_s0, va_get_xmm
    14 va_s0) == rounds_opaque_6 init round_keys (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_reg64
    rR13 va_s0 == Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.hi64 inb) /\ va_get_reg64
    rR12 va_s0 == Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.lo64 inb) /\ (let rk =
    FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in (va_get_xmm 2 va_s0,
    va_get_xmm 0 va_s0, va_get_xmm 5 va_s0, va_get_xmm 6 va_s0, va_get_xmm 7 va_s0, va_get_xmm 3
    va_s0) == map_six_of #quad32 #quad32 plain (fun (p:quad32) -> Vale.Def.Types_s.quad32_xor rk p)
    /\ Vale.X64.Decls.buffer128_read scratch_b 8 (va_get_mem_heaplet 3 va_s0) ==
    Vale.Def.Types_s.reverse_bytes_quad32 ctr_orig)) /\ (forall (va_x_mem:vale_heap)
    (va_x_rdi:nat64) (va_x_rsi:nat64) (va_x_r11:nat64) (va_x_r12:nat64) (va_x_r13:nat64)
    (va_x_xmm0:quad32) (va_x_xmm1:quad32) (va_x_xmm2:quad32) (va_x_xmm3:quad32) (va_x_xmm5:quad32)
    (va_x_xmm6:quad32) (va_x_xmm7:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32)
    (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32)
    (va_x_xmm15:quad32) (va_x_efl:Vale.X64.Flags.t) (va_x_heap3:vale_heap) . let va_sM =
    va_upd_mem_heaplet 3 va_x_heap3 (va_upd_flags va_x_efl (va_upd_xmm 15 va_x_xmm15 (va_upd_xmm 14
    va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11
    (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 7 va_x_xmm7 (va_upd_xmm 6
    va_x_xmm6 (va_upd_xmm 5 va_x_xmm5 (va_upd_xmm 3 va_x_xmm3 (va_upd_xmm 2 va_x_xmm2 (va_upd_xmm 1
    va_x_xmm1 (va_upd_xmm 0 va_x_xmm0 (va_upd_reg64 rR13 va_x_r13 (va_upd_reg64 rR12 va_x_r12
    (va_upd_reg64 rR11 va_x_r11 (va_upd_reg64 rRsi va_x_rsi (va_upd_reg64 rRdi va_x_rdi (va_upd_mem
    va_x_mem va_s0))))))))))))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 7 7 /\ Vale.X64.Decls.buffer128_read scratch_b 7
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32 inb /\ (va_get_xmm 9
    va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM, va_get_xmm 13 va_sM,
    va_get_xmm 14 va_sM) == map2_six_of #quad32 #quad32 #quad32 plain ctrs (fun (p:quad32)
    (c:quad32) -> Vale.Def.Types_s.quad32_xor p (Vale.AES.AES_s.aes_encrypt_LE alg key_words c)) /\
    va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0 /\ va_get_reg64 rRdi va_sM ==
    va_get_reg64 rRdi va_s0 + 96 /\ va_get_reg64 rRsi va_sM == va_get_reg64 rRsi va_s0 + 96 /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_get_xmm 1 va_sM == Vale.X64.Decls.buffer128_read scratch_b 8 (va_get_mem_heaplet 3 va_s0) /\
    (let ctr = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256 in ctr + 6 <
    256 ==> (va_get_xmm 1 va_sM, va_get_xmm 0 va_sM, va_get_xmm 5 va_sM, va_get_xmm 6 va_sM,
    va_get_xmm 7 va_sM, va_get_xmm 3 va_sM) == xor_reverse_inc32lite_6 0 0 ctr_orig (va_get_xmm 15
    va_sM))) ==> va_k va_sM (())))

val va_wpProof_Loop6x_final : alg:algorithm -> iv_b:buffer128 -> scratch_b:buffer128 ->
  key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> ctr_orig:quad32 ->
  init:quad32_6 -> ctrs:quad32_6 -> plain:quad32_6 -> inb:quad32 -> va_s0:va_state ->
  va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_final alg iv_b scratch_b key_words round_keys
    keys_b ctr_orig init ctrs plain inb va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_final alg) ([va_Mod_mem_heaplet
    3; va_Mod_flags; va_Mod_xmm 15; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11;
    va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 3; va_Mod_xmm
    2; va_Mod_xmm 1; va_Mod_xmm 0; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11;
    va_Mod_reg64 rRsi; va_Mod_reg64 rRdi; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_final (alg:algorithm) (iv_b:buffer128) (scratch_b:buffer128) (key_words:(seq
  nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) (init:quad32_6)
  (ctrs:quad32_6) (plain:quad32_6) (inb:quad32) : (va_quickCode unit (va_code_Loop6x_final alg)) =
  (va_QProc (va_code_Loop6x_final alg) ([va_Mod_mem_heaplet 3; va_Mod_flags; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 7; va_Mod_xmm 6; va_Mod_xmm 5; va_Mod_xmm 3; va_Mod_xmm 2; va_Mod_xmm 1; va_Mod_xmm
    0; va_Mod_reg64 rR13; va_Mod_reg64 rR12; va_Mod_reg64 rR11; va_Mod_reg64 rRsi; va_Mod_reg64
    rRdi; va_Mod_mem]) (va_wp_Loop6x_final alg iv_b scratch_b key_words round_keys keys_b ctr_orig
    init ctrs plain inb) (va_wpProof_Loop6x_final alg iv_b scratch_b key_words round_keys keys_b
    ctr_orig init ctrs plain inb))
//--
//-- Loop6x_save_output

val va_code_Loop6x_save_output : va_dummy:unit -> Tot va_code

val va_codegen_success_Loop6x_save_output : va_dummy:unit -> Tot va_pbool

val va_lemma_Loop6x_save_output : va_b0:va_code -> va_s0:va_state -> count:nat -> out_b:buffer128
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Loop6x_save_output ()) va_s0 /\ va_get_ok va_s0 /\
    (avx_enabled /\ sse_enabled /\ Vale.X64.Decls.validDstAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rRsi va_s0 - 96) out_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0)
    Secret)))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.buffer128_as_seq
    (va_get_mem_heaplet 6 va_sM) out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.buffer128_as_seq (va_get_mem_heaplet 6 va_s0) out_b) 0
    (6 `op_Multiply` count) /\ (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0,
    va_get_xmm 12 va_s0, va_get_xmm 13 va_s0, va_get_xmm 14 va_s0) == make_six_of #quad32 (fun
    (i:(va_int_range 0 5)) -> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + i)
    (va_get_mem_heaplet 6 va_sM)) /\ (va_get_xmm 9 va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM,
    va_get_xmm 12 va_sM, va_get_xmm 13 va_sM, va_get_xmm 14 va_sM) == (Vale.Def.Types_s.quad32_xor
    (va_get_xmm 1 va_sM) (va_get_xmm 15 va_sM), va_get_xmm 0 va_sM, va_get_xmm 5 va_sM, va_get_xmm
    6 va_sM, va_get_xmm 7 va_sM, va_get_xmm 3 va_sM)) /\ va_state_eq va_sM (va_update_flags va_sM
    (va_update_mem_heaplet 6 va_sM (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm
    12 va_sM (va_update_xmm 11 va_sM (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_ok
    va_sM (va_update_mem va_sM va_s0))))))))))))
[@ va_qattr]
let va_wp_Loop6x_save_output (count:nat) (out_b:buffer128) (va_s0:va_state) (va_k:(va_state -> unit
  -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (avx_enabled /\ sse_enabled /\ Vale.X64.Decls.validDstAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rRsi va_s0 - 96) out_b (count `op_Multiply` 6) 6
    (va_get_mem_layout va_s0) Secret) /\ (forall (va_x_mem:vale_heap) (va_x_xmm9:quad32)
    (va_x_xmm10:quad32) (va_x_xmm11:quad32) (va_x_xmm12:quad32) (va_x_xmm13:quad32)
    (va_x_xmm14:quad32) (va_x_heap6:vale_heap) (va_x_efl:Vale.X64.Flags.t) . let va_sM =
    va_upd_flags va_x_efl (va_upd_mem_heaplet 6 va_x_heap6 (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13
    va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11 va_x_xmm11 (va_upd_xmm 10 va_x_xmm10
    (va_upd_xmm 9 va_x_xmm9 (va_upd_mem va_x_mem va_s0)))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 out_b (va_get_mem_heaplet 6 va_s0)
    (va_get_mem_heaplet 6 va_sM) (count `op_Multiply` 6 + 0) (count `op_Multiply` 6 + 5) /\
    FStar.Seq.Base.slice #Vale.X64.Decls.quad32 (Vale.X64.Decls.buffer128_as_seq
    (va_get_mem_heaplet 6 va_sM) out_b) 0 (6 `op_Multiply` count) == FStar.Seq.Base.slice
    #Vale.X64.Decls.quad32 (Vale.X64.Decls.buffer128_as_seq (va_get_mem_heaplet 6 va_s0) out_b) 0
    (6 `op_Multiply` count) /\ (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0,
    va_get_xmm 12 va_s0, va_get_xmm 13 va_s0, va_get_xmm 14 va_s0) == make_six_of #quad32 (fun
    (i:(va_int_range 0 5)) -> Vale.X64.Decls.buffer128_read out_b (count `op_Multiply` 6 + i)
    (va_get_mem_heaplet 6 va_sM)) /\ (va_get_xmm 9 va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM,
    va_get_xmm 12 va_sM, va_get_xmm 13 va_sM, va_get_xmm 14 va_sM) == (Vale.Def.Types_s.quad32_xor
    (va_get_xmm 1 va_sM) (va_get_xmm 15 va_sM), va_get_xmm 0 va_sM, va_get_xmm 5 va_sM, va_get_xmm
    6 va_sM, va_get_xmm 7 va_sM, va_get_xmm 3 va_sM)) ==> va_k va_sM (())))

val va_wpProof_Loop6x_save_output : count:nat -> out_b:buffer128 -> va_s0:va_state ->
  va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Loop6x_save_output count out_b va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Loop6x_save_output ()) ([va_Mod_flags;
    va_Mod_mem_heaplet 6; va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm
    10; va_Mod_xmm 9; va_Mod_mem]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@ "opaque_to_smt" va_qattr]
let va_quick_Loop6x_save_output (count:nat) (out_b:buffer128) : (va_quickCode unit
  (va_code_Loop6x_save_output ())) =
  (va_QProc (va_code_Loop6x_save_output ()) ([va_Mod_flags; va_Mod_mem_heaplet 6; va_Mod_xmm 14;
    va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9; va_Mod_mem])
    (va_wp_Loop6x_save_output count out_b) (va_wpProof_Loop6x_save_output count out_b))
//--
//-- Loop6x_partial

val va_code_untransformedoriginal_Loop6x_partial : alg:algorithm -> Tot va_code

val va_codegen_success_untransformedoriginal_Loop6x_partial : alg:algorithm -> Tot va_pbool

val va_lemma_untransformedoriginal_Loop6x_partial : va_b0:va_code -> va_s0:va_state ->
  alg:algorithm -> h_LE:quad32 -> y_prev:quad32 -> data:(seq quad32) -> count:nat -> in0_count:nat
  -> iv_b:buffer128 -> in0_b:buffer128 -> in_b:buffer128 -> scratch_b:buffer128 -> key_words:(seq
  nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 -> ctr_BE:quad32
  -> Ghost (va_state & va_fuel & quad32_6)
  (requires (va_require_total va_b0 (va_code_untransformedoriginal_Loop6x_partial alg) va_s0 /\
    va_get_ok va_s0 /\ (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in let (prev:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 y_prev) in sse_enabled
    /\ movbe_enabled /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0
    16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8
    va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rR14 va_s0) in0_b (in0_count `op_Multiply` 6) 6
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rRdi va_s0) in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp
    va_s0) scratch_b 9 (va_get_mem_layout va_s0) Secret /\ va_get_reg64 rRdi va_s0 + 96 < pow2_64
    /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 ==
    FStar.Seq.Base.index #quad32 round_keys 0 /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\ va_get_reg64 rRbx
    va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256 /\ va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0, va_get_xmm 12 va_s0,
    va_get_xmm 13 va_s0, va_get_xmm 14 va_s0) == xor_reverse_inc32lite_6 1 0 ctr_BE (va_get_xmm 15
    va_s0)) /\ FStar.Seq.Base.length #quad32 data == 6 /\ hkeys_b_powers hkeys_b
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) (va_get_reg64 rR9 va_s0 - 32) h /\
    scratch_b_data true true scratch_b 8 5 (va_get_mem_heaplet 3 va_s0) (va_get_mem_layout va_s0)
    (va_get_reg64 rRbp va_s0) data /\ va_get_xmm 7 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (va_subscript_FStar__Seq__Base__seq data 5) /\ add (add (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_s0))) == prev)))
  (ensures (fun (va_sM, va_fM, init) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM
    /\ (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in let (prev:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 y_prev) in
    Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 iv_b
    (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) 0 0 /\ (0 <= va_get_reg64 rRbx va_sM
    /\ va_get_reg64 rRbx va_sM < 256) /\ va_get_reg64 rRbx va_sM ==
    Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256
    /\ (va_get_xmm 9 va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM,
    va_get_xmm 13 va_sM, va_get_xmm 14 va_sM) == rounds_opaque_6 init round_keys
    (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_reg64 rR13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.hi64 (Vale.X64.Decls.buffer128_read in0_b
    (in0_count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM))) /\ va_get_reg64 rR12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.lo64 (Vale.X64.Decls.buffer128_read in0_b
    (in0_count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM))) /\ (let rk =
    FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in (va_get_xmm 2 va_sM,
    va_get_xmm 0 va_sM, va_get_xmm 5 va_sM, va_get_xmm 6 va_sM, va_get_xmm 7 va_sM, va_get_xmm 3
    va_sM) == make_six_of #quad32 (fun (i:(va_int_range 0 5)) -> Vale.Def.Types_s.quad32_xor rk
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + i) (va_get_mem_heaplet 6 va_sM)))
    /\ Vale.X64.Decls.buffer128_read scratch_b 8 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\
    Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 3
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in0_b (in0_count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6
    va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 5
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in0_b (in0_count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6
    va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_s0)) /\ init == make_six_of #quad32 (fun
    (n:(va_int_range 0 5)) -> Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE n)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys
    0)) /\ (let eventual_Xi = add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)) in
    eventual_Xi == Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental h_LE y_prev data))))) /\ va_state_eq va_sM (va_update_flags
    va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR13
    va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rRbx va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))))))))))))))))

val va_transform_Loop6x_partial : alg:algorithm -> Tot va_transformation_result

val va_code_Loop6x_partial : alg:algorithm -> Tot va_code

val va_codegen_success_Loop6x_partial : alg:algorithm -> Tot va_pbool

val va_lemma_Loop6x_partial : va_b0:va_code -> va_s0:va_state -> alg:algorithm -> h_LE:quad32 ->
  y_prev:quad32 -> data:(seq quad32) -> count:nat -> in0_count:nat -> iv_b:buffer128 ->
  in0_b:buffer128 -> in_b:buffer128 -> scratch_b:buffer128 -> key_words:(seq nat32) ->
  round_keys:(seq quad32) -> keys_b:buffer128 -> hkeys_b:buffer128 -> ctr_BE:quad32
  -> Ghost (va_state & va_fuel & quad32_6)
  (requires (va_require_total va_b0 (va_code_Loop6x_partial alg) va_s0 /\ va_get_ok va_s0 /\ (let
    (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in let (prev:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 y_prev) in sse_enabled
    /\ movbe_enabled /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0
    16777216 /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 2 va_s0) (va_get_reg64 rR8
    va_s0) iv_b 1 (va_get_mem_layout va_s0) Public /\ Vale.X64.Decls.validSrcAddrsOffset128
    (va_get_mem_heaplet 6 va_s0) (va_get_reg64 rR14 va_s0) in0_b (in0_count `op_Multiply` 6) 6
    (va_get_mem_layout va_s0) Secret /\ Vale.X64.Decls.validSrcAddrsOffset128 (va_get_mem_heaplet 6
    va_s0) (va_get_reg64 rRdi va_s0) in_b (count `op_Multiply` 6) 6 (va_get_mem_layout va_s0)
    Secret /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp
    va_s0) scratch_b 9 (va_get_mem_layout va_s0) Secret /\ va_get_reg64 rRdi va_s0 + 96 < pow2_64
    /\ aes_reqs_offset alg key_words round_keys keys_b (va_get_reg64 rRcx va_s0)
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\ va_get_xmm 15 va_s0 ==
    FStar.Seq.Base.index #quad32 round_keys 0 /\ va_get_xmm 2 va_s0 == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 1 va_s0 ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 0) /\ va_get_reg64 rRbx
    va_s0 == Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_BE `op_Modulus` 256 /\ va_get_xmm 9
    va_s0 == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE 0)) (va_get_xmm 15 va_s0) /\ (va_get_reg64 rRbx va_s0 + 6 < 256
    ==> (va_get_xmm 9 va_s0, va_get_xmm 10 va_s0, va_get_xmm 11 va_s0, va_get_xmm 12 va_s0,
    va_get_xmm 13 va_s0, va_get_xmm 14 va_s0) == xor_reverse_inc32lite_6 1 0 ctr_BE (va_get_xmm 15
    va_s0)) /\ FStar.Seq.Base.length #quad32 data == 6 /\ hkeys_b_powers hkeys_b
    (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) (va_get_reg64 rR9 va_s0 - 32) h /\
    scratch_b_data true true scratch_b 8 5 (va_get_mem_heaplet 3 va_s0) (va_get_mem_layout va_s0)
    (va_get_reg64 rRbp va_s0) data /\ va_get_xmm 7 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (va_subscript_FStar__Seq__Base__seq data 5) /\ add (add (Vale.Math.Poly2.Bits_s.of_quad32
    (va_get_xmm 8 va_s0)) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_s0)))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_s0))) == prev)))
  (ensures (fun (va_sM, va_fM, init) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM
    /\ (let (h:Vale.Math.Poly2_s.poly) = Vale.Math.Poly2.Bits_s.of_quad32
    (Vale.Def.Types_s.reverse_bytes_quad32 h_LE) in let (prev:Vale.Math.Poly2_s.poly) =
    Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32 y_prev) in
    Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 8 /\ Vale.X64.Decls.modifies_buffer_specific128 iv_b
    (va_get_mem_heaplet 2 va_s0) (va_get_mem_heaplet 2 va_sM) 0 0 /\ (0 <= va_get_reg64 rRbx va_sM
    /\ va_get_reg64 rRbx va_sM < 256) /\ va_get_reg64 rRbx va_sM ==
    Vale.Def.Words_s.__proj__Mkfour__item__lo0 (Vale.AES.GCTR.inc32lite ctr_BE 6) `op_Modulus` 256
    /\ (va_get_xmm 9 va_sM, va_get_xmm 10 va_sM, va_get_xmm 11 va_sM, va_get_xmm 12 va_sM,
    va_get_xmm 13 va_sM, va_get_xmm 14 va_sM) == rounds_opaque_6 init round_keys
    (Vale.AES.AES_common_s.nr alg - 1) /\ va_get_reg64 rR13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.hi64 (Vale.X64.Decls.buffer128_read in0_b
    (in0_count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM))) /\ va_get_reg64 rR12 va_sM ==
    Vale.Def.Types_s.reverse_bytes_nat64 (Vale.Arch.Types.lo64 (Vale.X64.Decls.buffer128_read in0_b
    (in0_count `op_Multiply` 6 + 0) (va_get_mem_heaplet 6 va_sM))) /\ (let rk =
    FStar.Seq.Base.index #quad32 round_keys (Vale.AES.AES_common_s.nr alg) in (va_get_xmm 2 va_sM,
    va_get_xmm 0 va_sM, va_get_xmm 5 va_sM, va_get_xmm 6 va_sM, va_get_xmm 7 va_sM, va_get_xmm 3
    va_sM) == make_six_of #quad32 (fun (i:(va_int_range 0 5)) -> Vale.Def.Types_s.quad32_xor rk
    (Vale.X64.Decls.buffer128_read in_b (count `op_Multiply` 6 + i) (va_get_mem_heaplet 6 va_sM)))
    /\ Vale.X64.Decls.buffer128_read scratch_b 8 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_BE 6) /\
    Vale.X64.Decls.buffer128_read scratch_b 2 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 5) (va_get_mem_heaplet 6 va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 3
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in0_b (in0_count `op_Multiply` 6 + 4) (va_get_mem_heaplet 6
    va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 4 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 3) (va_get_mem_heaplet 6 va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 5
    (va_get_mem_heaplet 3 va_sM) == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.X64.Decls.buffer128_read in0_b (in0_count `op_Multiply` 6 + 2) (va_get_mem_heaplet 6
    va_s0)) /\ Vale.X64.Decls.buffer128_read scratch_b 6 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.X64.Decls.buffer128_read in0_b (in0_count
    `op_Multiply` 6 + 1) (va_get_mem_heaplet 6 va_s0)) /\ init == make_six_of #quad32 (fun
    (n:(va_int_range 0 5)) -> Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_BE n)) (FStar.Seq.Base.index #Vale.Def.Types_s.quad32 round_keys
    0)) /\ (let eventual_Xi = add (add (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 8 va_sM))
    (Vale.Math.Poly2.Bits_s.of_quad32 (Vale.X64.Decls.buffer128_read scratch_b 1
    (va_get_mem_heaplet 3 va_sM)))) (Vale.Math.Poly2.Bits_s.of_quad32 (va_get_xmm 4 va_sM)) in
    eventual_Xi == Vale.Math.Poly2.Bits_s.of_quad32 (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GHash.ghash_incremental h_LE y_prev data))))) /\ va_state_eq va_sM (va_update_flags
    va_sM (va_update_mem_heaplet 3 va_sM (va_update_mem_heaplet 2 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 8 va_sM (va_update_xmm 7 va_sM
    (va_update_xmm 6 va_sM (va_update_xmm 5 va_sM (va_update_xmm 4 va_sM (va_update_xmm 3 va_sM
    (va_update_xmm 2 va_sM (va_update_xmm 1 va_sM (va_update_xmm 0 va_sM (va_update_reg64 rR13
    va_sM (va_update_reg64 rR12 va_sM (va_update_reg64 rR11 va_sM (va_update_reg64 rRbx va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0)))))))))))))))))))))))))))
[@ va_qattr]
let va_wp_Loop6x_partial (alg:algorithm) (h_LE:quad32) (y_prev:quad32) (data:(seq quad32))
  (count:nat) (in0_count:nat) (iv_b:buffer128) (in0_b:buffer128) (in_b:buffer128)
  (scratch_b:buffer128) (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128)
  (hkeys_b:buffer128) (ctr_BE:quad32) (va_s0:va_state) (va_k:(va_state -> quad32_6 -> Type0)) :
val va_wp_Loop6x_partial
      (alg: algorithm)
      (h_LE y_prev: quad32)
      (data: (seq quad32))
      (count in0_count: nat)
      (iv_b in0_b in_b scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b hkeys_b: buffer128)
      (ctr_BE: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> quad32_6 -> Type0))
    : Type0

    alg: Vale.AES.AES_common_s.algorithm ->
    h_LE: Vale.X64.Decls.quad32 ->
    y_prev: Vale.X64.Decls.quad32 ->
    data: FStar.Seq.Base.seq Vale.X64.Decls.quad32 ->
    count: Prims.nat ->
    in0_count: Prims.nat ->
    iv_b: Vale.X64.Memory.buffer128 ->
    in0_b: Vale.X64.Memory.buffer128 ->
    in_b: Vale.X64.Memory.buffer128 ->
    scratch_b: Vale.X64.Memory.buffer128 ->
    key_words: FStar.Seq.Base.seq Vale.X64.Memory.nat32 ->
    round_keys: FStar.Seq.Base.seq Vale.X64.Decls.quad32 ->
    keys_b: Vale.X64.Memory.buffer128 ->
    hkeys_b: Vale.X64.Memory.buffer128 ->
    ctr_BE: Vale.X64.Decls.quad32 ->
    va_s0: Vale.X64.Decls.va_state ->
    va_k: (_: Vale.X64.Decls.va_state -> _: Vale.AES.X64.AESopt.quad32_6 -> Type0)
  -> Type0