Local Open Scope logic.
Opaque Snuffle.Snuffle. Opaque prepare_data.
Definition HFalse_inv l i xs ys :=
Zlength l = 64 /\
forall ii, 0<=ii<i ->
exists x_i, Znth ii (map Vint xs) = Vint x_i /\
exists y_i, Znth ii (map Vint ys) = Vint y_i /\
sublist (4*ii) (4*ii+4) l =
QuadByte2ValList (littleendian_invert (Int.add x_i y_i)).
Definition HFalsePostCond FR t y x w nonce out c k h xs ys :=
PROP  ()
LOCAL  (lvar _t (tarray tuint 4) t;
lvar _y (tarray tuint 16) y; lvar _x (tarray tuint 16) x;
lvar _w (tarray tuint 16) w; temp _in nonce; temp _out out; temp _c c;
temp _k k; temp _h (Vint (Int.repr h)))
SEP  (FR; data_at Tsh (tarray tuint 16) (map Vint xs) x;
data_at Tsh (tarray tuint 16) (map Vint ys) y;
EX  l : list val,
!!HFalse_inv l 16 xs ys && data_at Tsh (tarray tuchar 64) l out).
Definition epilogue_hfalse_statement:=
Sfor (Sset _i (Econst_int (Int.repr 0) tint))
(Ebinop Olt (Etempvar _i tint) (Econst_int (Int.repr 16) tint) tint)
(Ssequence
(Sset _t'11
(Ederef
(Ebinop Oadd (Evar _x (tarray tuint 16)) (Etempvar _i tint)
(tptr tuint)) tuint))
(Ssequence
(Sset _t'12
(Ederef
(Ebinop Oadd (Evar _y (tarray tuint 16)) (Etempvar _i tint)
(tptr tuint)) tuint))
(Scall None
(Evar _st32
(Tfunction (Tcons (tptr tuchar) (Tcons tuint Tnil)) tvoid
cc_default))
[Ebinop Oadd (Etempvar _out (tptr tuchar))
(Ebinop Omul (Econst_int (Int.repr 4) tint)
(Etempvar _i tint) tint) (tptr tuchar);
Ebinop Oadd (Etempvar _t'11 tuint) (Etempvar _t'12 tuint) tuint])))
(Sset _i
(Ebinop Oadd (Etempvar _i tint) (Econst_int (Int.repr 1) tint) tint)).

Lemma verif_fcore_epilogue_hfalse Espec FR t y x w nonce out c k h OUT xs ys:
@semax CompSpecs Espec
(func_tycontext f_core SalsaVarSpecs SalsaFunSpecs nil)
(PROP  ()
LOCAL  (lvar _t (tarray tuint 4) t; lvar _y (tarray tuint 16) y;
lvar _x (tarray tuint 16) x; lvar _w (tarray tuint 16) w; temp _in nonce;
temp _out out; temp _c c; temp _k k; temp _h (Vint (Int.repr h)))
SEP  (FR; data_at Tsh (tarray tuchar 64) OUT out;
data_at Tsh (tarray tuint 16) (map Vint ys) y;
data_at Tsh (tarray tuint 16) (map Vint xs) x))
epilogue_hfalse_statement
(normal_ret_assert (HFalsePostCond FR t y x w nonce out c k h xs ys (*data*))).