On Sat, 24 Oct 2026 06:31:53 GMT, Shawn Emery <[email protected]> wrote:
>> Currently, P-384 field operations use 14x28-bit limbs. The efficiency of >> these operations vastly improve by using a 7x55-bit limb configuration. >> Performance gains yield 32% to 52% for Java alone: >> >> AArch64: >> Key pair generation - P-384: +51% >> Key agreement - P-384: +51% >> >> Key pair generation - secP384r1MLKEM1024: +50% >> KEM decapsulation - secP384r1MLKEM1024: +49% >> KEM encapsulation - secP384r1MLKEM1024: +52% >> >> x86_64: >> Key pair generation - P-384: +35% >> Key agreement - P-384: +35% >> >> Key pair generation - secP384r1MLKEM1024: +32% >> KEM decapsulation - secP384r1MLKEM1024: +32% >> KEM encapsulation - secP384r1MLKEM1024: +33% >> >> --------- >> - [X] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Shawn Emery has updated the pull request with a new target base due to a > merge or a rebase. The incremental webrev excludes the unrelated changes > brought in by the merge/rebase. The pull request contains 12 additional > commits since the last revision: > > - Fix issue for Windows x64 where tmp and length use the same register > Add support for conditional assign with 7 limbs on AArch64 and x86_64 > - Merge with master branch > - Improve x86_64 performance by 13% > - Merge carryReduceUpper with reduce and fix/add more comments > - Fix square method > - Implement multByInt and square > - Fix finalCarryReduceLast and mult > - Fix reduceIn, carryReduceUpper, and carryReduceLower > - Fix reduceIn, carryReduce, and reduce > - Cleanup whitespace > - ... and 2 more: https://git.openjdk.org/jdk/compare/0c1c1a43...0b3a1656 Ran into issues on Windows x64 when generating keys where the coordinates were not on the P-384 curve. This was due to an existing bug in the conditional assign intrinsics for any non-specific limb sizes, where the `tmp` register was aliased to the same register as the limb `length` argument for the method. In Windows x64 the fourth argument is loaded to r9, which was `length`. `tmp` was aliased to r9 and was used a loop counter which gets overwritten. The latest commit fixes this issue but also creates new optimizations for AArch64 and x86_64 conditional assign with 7 limbs. ------------- PR Comment: https://git.openjdk.org/jdk/pull/33193#issuecomment-6381006380
