//	then UV = u*v + x*(u*VV+v*UU) + x*x*UU*VV

func Mul(U, V PS) PS {
	Z := mkPS()
	go func() {
		<-Z.req
		uv := get2(U, V)
		if end(uv[0]) != 0 || end(uv[1]) != 0 {
			Z.dat <- finis
		} else {
			Z.dat <- mul(uv[0], uv[1])
			UU := Split(U)
			VV := Split(V)
			W := Add(Cmul(uv[0], VV[0]), Cmul(uv[1], UU[0]))
			<-Z.req
			Z.dat <- get(W)
			copy(Add(W, Mul(UU[1], VV[1])), Z)
		}
	}()
	return Z

//	then UV = u*v + x*(u*VV+v*UU) + x*x*UU*VV

func Mul(U, V PS) PS {
	Z := mkPS()
	go func(U, V, Z PS) {
		<-Z.req
		uv := get2(U, V)
		if end(uv[0].(*rat)) != 0 || end(uv[1].(*rat)) != 0 {
			Z.dat <- finis
		} else {
			Z.dat <- mul(uv[0].(*rat), uv[1].(*rat))
			UU := Split(U)
			VV := Split(V)
			W := Add(Cmul(uv[0].(*rat), VV[0]), Cmul(uv[1].(*rat), UU[0]))
			<-Z.req
			Z.dat <- get(W)

	WFDDB	V1, V3, V6
	VLEG	$0, 768(R9), V18
	FMOVD	760(R9), F7
	FMOVD	752(R9), F5
	VLEG	$0, 744(R9), V16
	FMOVD	736(R9), F3
	FMOVD	728(R9), F2
	FMOVD	720(R9), F4
	WFMDB	V6, V6, V1
	FMUL	F0, F0
	MOVH	$0x0, R3
	WFMADB	V1, V7, V20, V7
	WFMADB	V1, V5, V18, V5
	WFMADB	V1, V7, V16, V7
	WFMADB	V1, V5, V3, V5
	WFMADB	V1, V7, V4, V7
	WFMADB	V1, V5, V2, V5
	FMOVD	712(R9), F2

	itd8{a: -1, b: 127, add: 126, sub: -128, mul: -127, div: 0, mod: -1},
	itd8{a: 0, b: -128, add: -128, sub: -128, mul: 0, div: 0, mod: 0},
	itd8{a: 0, b: -127, add: -127, sub: 127, mul: 0, div: 0, mod: 0},
	itd8{a: 0, b: -1, add: -1, sub: 1, mul: 0, div: 0, mod: 0},
	itd8{a: 0, b: 0, add: 0, sub: 0, mul: 0},
	itd8{a: 0, b: 1, add: 1, sub: -1, mul: 0, div: 0, mod: 0},

	var t2 = new(fiat.P384Element)

	z.Square(x)
	z.Mul(x, z)
	z.Square(z)
	t0.Mul(x, z)
	z.Square(t0)
	for s := 1; s < 3; s++ {
		z.Square(z)
	}
	t1.Mul(t0, z)
	t2.Square(t1)
	z.Mul(x, t2)
	for s := 0; s < 5; s++ {
		t2.Square(t2)
	}
	t1.Mul(t1, t2)
	t2.Square(t1)
	for s := 1; s < 12; s++ {
		t2.Square(t2)
	}
	t1.Mul(t1, t2)
	for s := 0; s < 7; s++ {
		t1.Square(t1)
	}

(Select0 m:(LoweredMuluhilo x y)) && m.Uses == 1 => (MULHU x y)
(Select1 m:(LoweredMuluhilo x y)) && m.Uses == 1 => (MUL x y)

(FADD(S|D) a (FMUL(S|D) x y)) && a.Block.Func.useFMA(v) => (FMADD(S|D) x y a)
(FSUB(S|D) a (FMUL(S|D) x y)) && a.Block.Func.useFMA(v) => (FNMSUB(S|D) x y a)
(FSUB(S|D) (FMUL(S|D) x y) a) && a.Block.Func.useFMA(v) => (FMSUB(S|D) x y a)

// Merge negation into fused multiply-add and multiply-subtract.
//

// conditions are also hoisted (i.e., `tf.Add` and `tf.Mul`).

// CHECK-LABEL: readvariableop_is_hoisted_if_readonly
// CHECK:       [[CST_0:%.*]] = "tf.Const"
// CHECK:       [[VAR:%.*]] = "tf.VarHandleOp"
// CHECK:       [[CST_1:%.*]] = "tf.Const"
// CHECK:       [[VAR_VAL:%.*]] = "tf.ReadVariableOp"
// CHECK:       [[RES_1:%.*]] = "tf.Add"([[VAR_VAL]], [[CST_0]])
// CHECK:       [[RES_2:%.*]] = "tf.Mul"([[RES_1]], [[CST_1]])

                                    %weight_scale : tensor<*xf32>) -> tensor<*xf32> {
    %scale_prod = "tf.Mul"(%input_scale, %weight_scale) : (tensor<*xf32>, tensor<*xf32>) -> tensor<*xf32>

    %cast = "tf.Cast"(%input) : (tensor<*xi32>) -> tensor<*xf32>
    %mul = "tf.Mul"(%cast, %scale_prod) : (tensor<*xf32>, tensor<*xf32>) -> tensor<*xf32>
    func.return %mul : tensor<*xf32>
  }

	SUB	$2, R0
loop:
	CBZ	R0, done
	LDP.P	32(R2), (R5, R6)
	LDP	-16(R2), (R7, R8)

	MUL	R3, R5, R10
	UMULH	R3, R5, R11
	ADDS	R4, R10
	MUL	R3, R6, R12
	UMULH	R3, R6, R13
	ADCS	R11, R12

	MUL	R3, R7, R14
	UMULH	R3, R7, R15
	ADCS	R13, R14
	MUL	R3, R8, R16
	UMULH	R3, R8, R17
	ADCS	R15, R16
	ADC	$0, R17, R4

	STP.P	(R10, R12), 32(R1)
	STP	(R14, R16), -16(R1)
	SUB	$4, R0

// Test that decryption tables are correct.
// (Can adapt this code to generate them too.)
func TestTd(t *testing.T) {
	for i := 0; i < 256; i++ {
		s := uint32(sbox1[i])
		s9 := mul(s, 0x9)
		sb := mul(s, 0xb)
		sd := mul(s, 0xd)
		se := mul(s, 0xe)
		w := se<<24 | s9<<16 | sd<<8 | sb
		td := [][256]uint32{td0, td1, td2, td3}
		for j := 0; j < 4; j++ {
			if x := td[j][i]; x != w {