Definition sha_update_loop_body :=
(Ssequence
(Scall None
(Evar _sha256_block_data_order
(Tfunction
(Tcons (tptr t_struct_SHA256state_st) (Tcons (tptr tvoid) Tnil))
tvoid cc_default))
[Etempvar _c (tptr t_struct_SHA256state_st);
Etempvar _data (tptr tuchar)])
(Ssequence
(Sset _data
(Ebinop Oadd (Etempvar _data (tptr tuchar))
(Ebinop Omul (Econst_int (Int.repr 16) tint)
(Econst_int (Int.repr 4) tint) tint) (tptr tuchar)))
(Sset _len
(Ebinop Osub (Etempvar _len tuint)
(Ebinop Omul (Econst_int (Int.repr 16) tint)
(Econst_int (Int.repr 4) tint) tint) tuint)))).
Definition update_outer_if :=
Sifthenelse
(Ebinop Cop.One (Etempvar _n tuint) (Econst_int (Int.repr 0) tint) tint)
(Ssequence
(Sset _fragment
(Ebinop Osub
(Ebinop Omul (Econst_int (Int.repr 16) tint)
(Econst_int (Int.repr 4) tint) tint) (Etempvar _n tuint)
tuint)) update_inner_if)
Sskip.

Lemma update_outer_if_proof:
forall  (Espec : OracleKind) (hashed : list int)
(dd data : list byte) (c d : val) (wsh sh : share) (len : Z) gv
(H : 0 <= len <= Zlength data)
(Hwsh: writable_share wsh)
(Hsh: readable_share sh)
(HBOUND : bitlength hashed dd + len * 8 < two_p 64)
(H3 : Zlength dd < CBLOCKz)
(H4 : (LBLOCKz | Zlength hashed))
(Hlen : len <= Int.max_unsigned),
semax
(func_tycontext f_SHA256_Update Vprog Gtot nil)
(PROP  ()
LOCAL
(temp _p (field_address t_struct_SHA256state_st [StructField _data] c);
temp _n (Vint (Int.repr (Zlength dd)));
temp _data d; temp _c c;temp _data_ d;
temp _len (Vint (Int.repr len));
gvars gv)
SEP  (data_at wsh t_struct_SHA256state_st
(map Vint (hash_blocks init_registers hashed),
(Vint (lo_part (bitlength hashed dd + len*8)),
(Vint (hi_part (bitlength hashed dd + len*8)),
(map Vubyte dd ++ list_repeat (Z.to_nat (CBLOCKz-Zlength dd)) Vundef,
Vint (Int.repr (Zlength dd))))))
c;
K_vector gv;
data_block sh data d))
update_outer_if
(overridePost (sha_update_inv wsh sh hashed len c d dd data gv false)
(frame_ret_assert
(function_body_ret_assert tvoid
(EX  a' : s256abs,
PROP  (update_abs (sublist 0 len data) (S256abs hashed dd) a')
LOCAL ()
SEP  (K_vector gv;
sha256state_ wsh a' c; data_block sh data d)))
emp)).