fallensigh/mlkem-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(top): add shared keccak variants, arbiter, and mlkem_top integration

Browse Source 
- sha3_chain_top_shared.v: external keccak_core interface (6 ports)
- sample_cbd_sync_shared.v: shared keccak variant (6 ports)
- sample_ntt_sync_shared.v: shared keccak variant (6 ports)
- keccak_arbiter.v: fixed-priority arbiter for 3 keccak consumers
- mlkem_top.v: 1403-line monolithic FSM with KeyGen/Encaps/Decaps

Architecture:
  keccak_arbiter → keccak_core → keccak_round (shared)
  sha3_chain_top_shared (consumer 0)
  sample_cbd_sync_shared (consumer 1)
  sample_ntt_sync_shared (consumer 2)
  sha3_top (separate, own keccak_core)
  rng_sync, ntt_core, poly_arith, poly_mul, comp_decomp, mod_add
  sd_bram for polynomial storage

All original RTL files preserved unchanged.
This commit is contained in:
FallenSigh
2026-06-26 03:35:37 +08:00
parent 1983d840a7
commit 03b4707879
5 changed files with 2348 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

311
sync_rtl/sample_cbd/sample_cbd_sync_shared.v Normal file
View File

@@ -0,0 +1,311 @@
// sample_cbd_sync_shared.v - Centered Binomial Distribution sampling via SHAKE-256 PRF
// (shared keccak_core variant — external instance)
//
// Generates 256 polynomial coefficients from a 256-bit seed and 8-bit nonce
// using SHAKE-256 PRF followed by Centered Binomial Distribution (CBD).
//
// Algorithm (FIPS 203 / ML-KEM):
// PRF(sigma, N) = SHAKE-256(sigma || N) → squeeze eta*64 bytes
// For each of 256 coefficients:
// eta=2: read 4 bits, coeff = (b0+b1) - (b2+b3)
// eta=3: read 6 bits, coeff = (b0+b1+b2) - (b3+b4+b5)
// Each coefficient in range [-eta, eta], stored as 12-bit signed.
//
// SHAKE-256 parameters:
// rate = 1088 bits, capacity = 512 bits
// suffix = 4'b1111
// pad10*1 padding
//
// Multi-squeeze (eta=3):
// SHAKE-256 squeezes 1088-bit blocks. For eta=3 we need 1536 bits.
// First squeeze provides bits [0:1087], second provides [1088:1535].
// The 1536-bit squeeze_buf accumulates both blocks contiguously:
// After 1st: buf[1087:0] = squeeze1, buf[1535:1088] = 0
// After 2nd: buf[1535:1088] = squeeze2[447:0] (remapped)
// Bit ordering matches Python reference PRF output.
//
// Interface:
// clk, rst_n - clock, active-low reset
// seed_i [255:0] - sigma (256-bit seed)
// nonce_i [7:0] - N counter byte
// eta_i [1:0] - 2'd2 or 2'd3
// valid_i - input valid (start sampling)
// ready_o - module can accept new input
// coeff_o [11:0] - one coefficient per cycle, 12-bit signed
// valid_o - output valid
// ready_i - downstream accepts output
// last_o - high when last coefficient (255th, 0-indexed)
// kc_state_o - keccak result (from external keccak_core.state_o)
// kc_valid_o - keccak done (from external keccak_core.valid_o)
// kc_ready_i - always ready to accept keccak output (to keccak_core.ready_i)
// kc_state_i - keccak input state (to external keccak_core.state_i)
// kc_valid_i - request keccak permutation (to external keccak_core.valid_i)
// kc_ready_o - keccak ready to accept (from external keccak_core.ready_o)
module sample_cbd_sync_shared (
input clk,
input rst_n,
input [255:0] seed_i,
input [7:0] nonce_i,
input [1:0] eta_i, // 2'd2 or 2'd3
input valid_i,
output ready_o,
output [11:0] coeff_o, // 12-bit signed
output valid_o,
input ready_i,
output last_o,
// External keccak_core interface
input [1599:0] kc_state_o, // keccak result (from keccak_core.state_o)
input kc_valid_o, // keccak done (from keccak_core.valid_o)
output kc_ready_i, // always ready to accept (to keccak_core.ready_i)
output [1599:0] kc_state_i, // keccak input state (to keccak_core.state_i)
output kc_valid_i, // request keccak permutation (to keccak_core.valid_i)
input kc_ready_o // keccak ready to accept (from keccak_core.ready_o)
);
// ================================================================
// FSM state encoding
// ================================================================
localparam ST_IDLE = 2'd0;
localparam ST_PERMUTE = 2'd1;
localparam ST_SQUEEZE = 2'd2;
reg [1:0] state_r, state_next;
// ================================================================
// SHAKE-256 pad10*1 construction (combinational)
//
// Message: {nonce_i, seed_i} = 264 bits
// In FIPS 202 bit ordering: message[0] = seed_i[0], message[263] = nonce_i[7]
// Padded block (1088 rate bits):
// {1'b1, 818'b0, 1'b1, 4'b1111, nonce_i, seed_i}
//
// Matches Python: PRF(sigma, N) = shake256(sigma||N, d)
// where sigma bits come first (LSB), then N bits, then suffix+padding.
// ================================================================
wire [263:0] message_264;
wire [1087:0] padded_block;
assign message_264 = {nonce_i, seed_i};
assign padded_block = {1'b1, {818{1'b0}}, 1'b1, 4'b1111, message_264};
// Absorb state: capacity (512 bits of zero) || padded rate block
wire [1599:0] absorb_state;
assign absorb_state = {{(1600-1088){1'b0}}, padded_block};
// ================================================================
// Registered inputs (captured on valid_i && ready_o)
// ================================================================
reg [2:0] eta_r; // 2 or 3
reg [7:0] coeff_cnt; // 0..255, number of coeffs output so far
reg [1599:0] keccak_state_r; // current 1600-bit keccak state (for re-permutation)
reg perm_done; // 1 after first keccak permutation completes
// Combinational mux select: absorb_state BEFORE first perm finishes,
// keccak_state_r AFTER. Must be combinational to avoid NBA race
// with kc_valid_i on the IDLE→PERMUTE transition edge.
wire first_perm_sel;
assign first_perm_sel = !perm_done;
// ================================================================
// Squeeze buffer (accumulated across multiple squeezes)
// ================================================================
reg [1535:0] squeeze_buf; // accumulated squeeze data
reg [10:0] buf_fill; // valid bits in squeeze_buf (0, 1088, or 1536)
reg [10:0] buf_ptr; // read position within squeeze_buf
reg kc_done_d1; // kc_valid_o delayed by 1 cycle (gate for valid_o)
// ================================================================
// External keccak_core interface connections
//
// The external keccak_core is instantiated at the top level.
// This module drives kc_valid_i and kc_state_i, receives
// kc_valid_o and kc_state_o, and provides kc_ready_i = 1'b1
// (always ready to accept keccak output). kc_ready_o is exposed
// for the top-level arbiter to check keccak availability.
// ================================================================
// Mux: absorb_state for first perm, keccak_state_r for re-permutation
assign kc_state_i = first_perm_sel ? absorb_state : keccak_state_r;
// Always ready to accept keccak output
assign kc_ready_i = 1'b1;
// ================================================================
// Bits per coefficient
// ================================================================
wire [3:0] bits_per_coeff;
assign bits_per_coeff = (eta_r == 3'd2) ? 4'd4 : 4'd6;
// ================================================================
// CBD computation (combinational)
//
// Extract bits_per_coeff bits from squeeze_buf starting at buf_ptr.
// For eta=2: b0,b1,b2,b3 → coeff = (b0+b1) - (b2+b3)
// For eta=3: b0,b1,b2,b3,b4,b5 → coeff = (b0+b1+b2) - (b3+b4+b5)
// ================================================================
wire [5:0] cbd_bits;
assign cbd_bits = squeeze_buf[buf_ptr +: 6];
wire [2:0] sum_pos, sum_neg;
// eta=2: sum_pos = b0+b1, sum_neg = b2+b3
wire [2:0] sp2, sn2;
assign sp2 = {2'b00, cbd_bits[0]} + {2'b00, cbd_bits[1]};
assign sn2 = {2'b00, cbd_bits[2]} + {2'b00, cbd_bits[3]};
// eta=3: sum_pos = b0+b1+b2, sum_neg = b3+b4+b5
wire [2:0] sp3, sn3;
assign sp3 = {2'b00, cbd_bits[0]} + {2'b00, cbd_bits[1]} + {2'b00, cbd_bits[2]};
assign sn3 = {2'b00, cbd_bits[3]} + {2'b00, cbd_bits[4]} + {2'b00, cbd_bits[5]};
assign sum_pos = (eta_r == 3'd2) ? sp2 : sp3;
assign sum_neg = (eta_r == 3'd2) ? sn2 : sn3;
wire signed [3:0] coeff_raw;
assign coeff_raw = $signed({1'b0, sum_pos}) - $signed({1'b0, sum_neg});
wire [11:0] coeff_signed;
assign coeff_signed = {{8{coeff_raw[3]}}, coeff_raw[3:0]}; // sign-extend to 12 bits
assign coeff_o = coeff_signed;
// valid_o: suppress for 1 cycle after keccak finishes to avoid
// buf_ptr race between squeeze capture and SQUEEZE advancement.
assign valid_o = (state_r == ST_SQUEEZE) && (buf_fill >= {7'b0, bits_per_coeff}) && !kc_done_d1;
assign last_o = valid_o && (coeff_cnt == 8'd255);
// ================================================================
// FSM: ready_o
// ================================================================
assign ready_o = (state_r == ST_IDLE);
// ================================================================
// kc_valid_i: start external keccak_core when transitioning to PERMUTE
// ================================================================
assign kc_valid_i = (state_next == ST_PERMUTE) && (state_r != ST_PERMUTE);
// ================================================================
// Buffer exhaustion detection
// ================================================================
wire [11:0] next_buf_ptr;
assign next_buf_ptr = {1'b0, buf_ptr} + {8'b0, bits_per_coeff};
// buffer will be exhausted after outputting NEXT coefficient
wire buffer_exhaust_next;
assign buffer_exhaust_next = (next_buf_ptr + {8'b0, bits_per_coeff}) > {1'b0, buf_fill};
// Coefficients remaining AFTER the current one
wire [8:0] coeffs_remaining;
assign coeffs_remaining = 9'd256 - {1'b0, coeff_cnt} - 9'd1;
// ================================================================
// FSM combinational next-state logic
// ================================================================
always @(*) begin
state_next = state_r;
case (state_r)
ST_IDLE: begin
if (valid_i && ready_o)
state_next = ST_PERMUTE;
end
ST_PERMUTE: begin
// Wait for external keccak_core to finish
if (kc_valid_o)
state_next = ST_SQUEEZE;
end
ST_SQUEEZE: begin
// Output one coeff per cycle when ready
if (valid_o && ready_i) begin
if (coeff_cnt == 8'd255) begin
// Last coefficient was output
state_next = ST_IDLE;
end else if (buffer_exhaust_next && (coeffs_remaining > 9'd0)) begin
// Need more squeeze data: start another keccak permutation
state_next = ST_PERMUTE;
end
// else: stay in SQUEEZE for next coefficient
end
end
default: state_next = ST_IDLE;
endcase
end
// ================================================================
// Sequential logic
// ================================================================
always @(posedge clk or negedge rst_n) begin
if (!rst_n) begin
state_r <= ST_IDLE;
eta_r <= 3'd0;
coeff_cnt <= 8'd0;
keccak_state_r <= 1600'd0;
perm_done <= 1'b0;
squeeze_buf <= 1536'd0;
buf_fill <= 11'd0;
buf_ptr <= 11'd0;
kc_done_d1 <= 1'b0;
end else begin
state_r <= state_next;
// Delay kc_valid_o by 1 cycle to gate valid_o
kc_done_d1 <= kc_valid_o;
// ---- Capture inputs on IDLE → PERMUTE transition ----
if (state_r == ST_IDLE && valid_i && ready_o) begin
// Determine eta: 2 or 3
if (eta_i == 2'd2)
eta_r <= 3'd2;
else if (eta_i == 2'd3)
eta_r <= 3'd3;
else
eta_r <= 3'd2; // default
coeff_cnt <= 8'd0;
buf_fill <= 11'd0;
buf_ptr <= 11'd0;
end
// ---- On keccak_core valid_o: latch squeeze data ----
if (kc_valid_o) begin
// Save full 1600-bit state for potential re-permutation
keccak_state_r <= kc_state_o;
if (!perm_done) begin
// First squeeze: fill lower 1088 bits of squeeze_buf
// buf[1087:0] = squeeze data, buf[1535:1088] = 0
squeeze_buf <= {{(1536 - 1088){1'b0}}, kc_state_o[1087:0]};
buf_fill <= 11'd1088;
buf_ptr <= 11'd0;
perm_done <= 1'b1;
end else begin
// Second squeeze: fill upper 448 bits of squeeze_buf
// buf[1535:1088] = squeeze2[447:0], buf[1087:0] preserved
// This remaps: squeeze2[0] → buf[1088], matching Python's contiguous output
squeeze_buf <= {kc_state_o[447:0], squeeze_buf[1087:0]};
buf_fill <= 11'd1536;
// buf_ptr stays at current position (kept from SQUEEZE)
end
end
// ---- SQUEEZE: advance on output ----
if (state_r == ST_SQUEEZE && valid_o && ready_i) begin
buf_ptr <= buf_ptr + {7'b0, bits_per_coeff};
coeff_cnt <= coeff_cnt + 8'd1;
// Clear state on last coeff
if (coeff_cnt == 8'd255) begin
buf_fill <= 11'd0;
buf_ptr <= 11'd0;
// Reset perm_done here (before next IDLE→PERMUTE)
// so the mux selects absorb_state for the next vector.
perm_done <= 1'b0;
end
end
end
end
endmodule

376
sync_rtl/sample_ntt/sample_ntt_sync_shared.v Normal file
View File

@@ -0,0 +1,376 @@
// sample_ntt_sync_shared.v - Synchronous SampleNTT for ML-KEM A matrix generation
// with external Keccak interface ports.
//
// Identical to sample_ntt_sync.v except the internal keccak_core instance
// is replaced by explicit kc_* ports. This allows multiple SampleNTT
// instances to share a single keccak_core (via a round-robin arbiter).
//
// Generates one k×k polynomial (256 coefficients) via SHAKE-128 XOF
// rejection sampling from seed rho || j || i.
//
// Matches Python reference (sample.py/SHA_3.py) bit-exactly:
// - Absorb: S = Keccak-p(padded(rho || j || i))
// - For each squeeze: take S[23:0] (3 bytes), extract d1[11:0], d2[23:12]
// - Accept d if d < Q=3329
// - S = Keccak-p(S) (permute between every 3-byte squeeze)
// - Repeat until 256 coefficients collected
//
// Parameters:
// K = 4 (ML-KEM parameter)
//
// Interface:
// clk, rst_n - clock, active-low reset
// rho_i[255:0] - 256-bit seed rho (32 bytes)
// k_i[2:0] - actual k value (2/3/4)
// i_idx[1:0] - row index (0..k-1)
// j_idx[1:0] - column index (0..k-1)
// valid_i - start generation for this (i,j) pair
// ready_o - module can accept request
// coeff_o[11:0] - one coefficient output per cycle
// valid_o - coefficient output valid
// ready_i - consumer accepts coefficient
// last_o - high when 256th coefficient is output
//
// --- Keccak interface (external, shared) ---
// kc_state_o[1599:0] - keccak result (from keccak_core)
// kc_valid_o - keccak output valid (from keccak_core)
// kc_ready_i - sample_ntt ready to accept keccak output (always 1'b1)
// kc_state_i[1599:0] - keccak input state (to keccak_core)
// kc_valid_i - request keccak permutation (to keccak_core)
// kc_ready_o - keccak ready to accept new request (from keccak_core)
`include "sync_rtl/common/defines.vh"
/* verilator lint_off UNUSEDPARAM */
module sample_ntt_sync_shared #(parameter K = 4) (
/* verilator lint_on UNUSEDPARAM */
input clk,
input rst_n,
input [255:0] rho_i,
/* verilator lint_off UNUSEDSIGNAL */
input [2:0] k_i,
/* verilator lint_on UNUSEDSIGNAL */
input [1:0] i_idx,
input [1:0] j_idx,
input valid_i,
output ready_o,
output [11:0] coeff_o,
output valid_o,
input ready_i,
output last_o,
// --- Keccak interface ports (external) ---
input [1599:0] kc_state_o,
input kc_valid_o,
output kc_ready_i,
output [1599:0] kc_state_i,
output kc_valid_i,
/* verilator lint_off UNUSEDSIGNAL */
input kc_ready_o
/* verilator lint_on UNUSEDSIGNAL */
);
// ================================================================
// Local parameters
// ================================================================
localparam Q = `Q; // 3329
// ================================================================
// FSM state encoding
// ================================================================
localparam ST_IDLE = 3'd0;
localparam ST_ABSORB = 3'd1; // keccak running on absorb_state
localparam ST_SQUEEZE = 3'd2; // extract d1/d2, output coefficients
localparam ST_WAIT = 3'd3; // wait for next keccak to finish
localparam ST_DONE = 3'd4; // all 256 coefficients output
reg [2:0] state_r, state_next;
// ================================================================
// Registered inputs (captured on valid_i)
// ================================================================
/* verilator lint_off UNUSEDSIGNAL */
reg [255:0] rho_r;
reg [2:0] k_r;
reg [1:0] i_r;
reg [1:0] j_r;
/* verilator lint_on UNUSEDSIGNAL */
// ================================================================
// Coefficient counter (0..256). 9 bits to avoid overflow when
// reaching 256 after the 256th output.
// ================================================================
reg [8:0] coeff_cnt_r;
// ================================================================
// Squeeze state register (1600-bit result of keccak_p)
// ================================================================
reg [1599:0] squeeze_state_r;
// ================================================================
// Registered d1, d2 and acceptance flags
// ================================================================
reg [11:0] d1_r, d2_r;
reg d1_acc_r, d2_acc_r; // d1/d2 accepted?
// ================================================================
// Squeeze sub-phase (for multi-cycle coefficient output)
// 0 → latch d1/d2, start keccak → 1
// 1 → output d1 if accepted → 2
// 2 → output d2 if accepted → WAIT
// ================================================================
reg [1:0] sq_phase_r;
// ================================================================
// Comb: build absorb state from rho, i, j INPUT PORTS directly
// (not registered copies — avoids NBA race on IDLE→ABSORB edge)
// ================================================================
wire [7:0] abs_i_byte, abs_j_byte;
assign abs_i_byte = {6'b0, i_idx};
assign abs_j_byte = {6'b0, j_idx};
wire [271:0] msg_bytes;
assign msg_bytes = {abs_i_byte, abs_j_byte, rho_i};
// SHAKE-128 absorb block: capacity(256b) | pad10*1 | suffix(1111) | msg(272b)
wire [1599:0] absorb_state;
assign absorb_state = {
256'b0, // capacity [1599:1344]
1'b1, // pad10*1 final 1 [1343]
{1066{1'b0}}, // pad10*1 zeros [1342:277]
1'b1, // pad10*1 first 1 [276]
4'b1111, // SHAKE suffix [275:272]
msg_bytes // message [271:0]
};
// ================================================================
// Comb: extract d1,d2 from squeeze state
// ================================================================
// squeeze_state_r[7:0]=c0, [15:8]=c1, [23:16]=c2
// d1 = {c1[3:0], c0}
// d2 = {c2, c1[7:4]}
wire [7:0] c0, c1, c2;
assign c0 = squeeze_state_r[7:0];
assign c1 = squeeze_state_r[15:8];
assign c2 = squeeze_state_r[23:16];
wire [11:0] d1_comb, d2_comb;
assign d1_comb = {c1[3:0], c0};
assign d2_comb = {c2, c1[7:4]};
wire d1_ok, d2_ok;
assign d1_ok = (d1_comb < Q);
assign d2_ok = (d2_comb < Q);
// ================================================================
// Keccak interface: external ports instead of internal keccak_core.
//
// kc_valid_i: asserted during ABSORB and first phase of SQUEEZE.
// kc_state_i: absorb_state in ABSORB, squeeze_state_r otherwise.
// kc_ready_i: always 1'b1 — this module always accepts keccak output.
//
// These signals are output ports driven by the combinational logic
// below. The upstream arbiter connects them to a shared keccak_core.
// ================================================================
// kc_ready_i: always ready to accept keccak output
assign kc_ready_i = 1'b1;
// kc_valid_i: asserted during ABSORB and first phase of SQUEEZE.
assign kc_valid_i = (state_next == ST_ABSORB) ||
(state_r == ST_SQUEEZE && sq_phase_r == 2'd0);
// kc_state_i: absorb_state in ABSORB, squeeze_state_r otherwise
assign kc_state_i = (state_next == ST_ABSORB) ? absorb_state : squeeze_state_r;
// ================================================================
// Output signals
// ================================================================
reg [11:0] coeff_o_r;
reg valid_o_r;
reg last_o_r;
assign coeff_o = coeff_o_r;
assign valid_o = valid_o_r;
assign last_o = last_o_r;
// ================================================================
// ready_o: accept new request in IDLE
// ================================================================
assign ready_o = (state_r == ST_IDLE);
wire need_more = (coeff_cnt_r < 9'd256);
// ================================================================
// FSM: state_next (combinational)
// ================================================================
always @(*) begin
state_next = state_r;
case (state_r)
ST_IDLE: begin
if (valid_i && ready_o)
state_next = ST_ABSORB;
end
ST_ABSORB: begin
// Wait for keccak to finish the absorb permutation
if (kc_valid_o)
state_next = ST_SQUEEZE;
end
ST_SQUEEZE: begin
// Sub-phase transitions managed in sequential logic.
// Only transitions to ST_WAIT from phase 2 when done.
if (sq_phase_r == 2'd2 &&
(!d2_acc_r || !need_more || (valid_o_r && ready_i)))
state_next = ST_WAIT;
end
ST_WAIT: begin
// Wait for keccak to finish squeeze permutation
if (kc_valid_o) begin
if (!need_more)
state_next = ST_DONE;
else
state_next = ST_SQUEEZE;
end
end
ST_DONE: begin
state_next = ST_IDLE;
end
default: state_next = ST_IDLE;
endcase
end
// ================================================================
// FSM: sequential logic (registered)
// ================================================================
always @(posedge clk or negedge rst_n) begin
if (!rst_n) begin
state_r <= ST_IDLE;
sq_phase_r <= 2'd0;
coeff_cnt_r <= 9'd0;
squeeze_state_r <= 1600'd0;
d1_r <= 12'd0;
d2_r <= 12'd0;
d1_acc_r <= 1'b0;
d2_acc_r <= 1'b0;
coeff_o_r <= 12'd0;
valid_o_r <= 1'b0;
last_o_r <= 1'b0;
rho_r <= 256'd0;
k_r <= 3'd0;
i_r <= 2'd0;
j_r <= 2'd0;
end else begin
state_r <= state_next;
// ---------------------------------------------------------
// Capture inputs on valid_i (IDLE → ABSORB transition)
// ---------------------------------------------------------
if (state_r == ST_IDLE && valid_i && ready_o) begin
rho_r <= rho_i;
k_r <= k_i;
i_r <= i_idx;
j_r <= j_idx;
coeff_cnt_r <= 9'd0;
end
// ---------------------------------------------------------
// Latch keccak output when valid_o fires
// ---------------------------------------------------------
if (kc_valid_o) begin
squeeze_state_r <= kc_state_o;
end
// ---------------------------------------------------------
// SQ_PHASE = 0: latch d1/d2 acceptance
// ---------------------------------------------------------
if (state_r == ST_SQUEEZE && sq_phase_r == 2'd0) begin
d1_r <= d1_comb;
d2_r <= d2_comb;
d1_acc_r <= d1_ok;
d2_acc_r <= d2_ok;
end
// ---------------------------------------------------------
// SQ_PHASE management and coefficient output
//
// Handshake pattern (matching pipeline_reg convention):
// Cycle N: valid_o_r ← 1, coeff_o_r ← value
// Cycle N+1: if ready_i: consume, valid_o_r ← 0, advance
//
// The testbench reads coeff_o after Cycle N and consumes
// with the next posedge (Cycle N+1).
// ---------------------------------------------------------
if (state_r == ST_SQUEEZE) begin
case (sq_phase_r)
// ----- Phase 0: latch, advance to phase 1 -----
2'd0: begin
sq_phase_r <= 2'd1;
end
// ----- Phase 1: output d1 -----
2'd1: begin
if (d1_acc_r) begin
if (!valid_o_r) begin
// First cycle: assert output
coeff_o_r <= d1_r;
valid_o_r <= 1'b1;
last_o_r <= (coeff_cnt_r == 9'd255);
end else begin
// valid_o is high; wait for consumer
if (ready_i) begin
coeff_cnt_r <= coeff_cnt_r + 9'd1;
valid_o_r <= 1'b0;
sq_phase_r <= 2'd2;
end
end
end else begin
// d1 rejected, skip to phase 2
valid_o_r <= 1'b0;
sq_phase_r <= 2'd2;
end
end
// ----- Phase 2: output d2 -----
2'd2: begin
if (d2_acc_r && need_more) begin
if (!valid_o_r) begin
// First cycle: assert output
coeff_o_r <= d2_r;
valid_o_r <= 1'b1;
last_o_r <= (coeff_cnt_r == 9'd255);
end else begin
// valid_o is high; wait for consumer
if (ready_i) begin
coeff_cnt_r <= coeff_cnt_r + 9'd1;
valid_o_r <= 1'b0;
// state_next → ST_WAIT (combinational)
end
end
end else begin
// d2 rejected or done
valid_o_r <= 1'b0;
end
end
default: begin
valid_o_r <= 1'b0;
end
endcase
end else if (state_r != ST_SQUEEZE && state_next == ST_SQUEEZE) begin
// About to enter SQUEEZE: reset phase and output
sq_phase_r <= 2'd0;
valid_o_r <= 1'b0;
end else begin
// Not in SQUEEZE: clear
valid_o_r <= 1'b0;
sq_phase_r <= 2'd0;
end
end
end
endmodule

115
sync_rtl/sha3_chain/sha3_chain_top_shared.v Normal file
View File

@@ -0,0 +1,115 @@
// sha3_chain_top_shared.v - SHA3-512 chain: G(d||k=2) → rho, sigma
//
// Refactored version that accepts an external keccak_core interface instead
// of instantiating sha3_top internally. Designed for shared-keccak top-level
// integration where a single keccak_core is time-multiplexed via an arbiter.
//
// The internal logic replicates sha3_top's G-mode absorb-state construction
// and keccak sequencing, but exposes keccak_core signals through the port
// list so the arbiter can route them.
//
// 3-state FSM: IDLE → BUSY → DONE
//
// Interface:
// clk, rst_n - clock, active-low reset
// d_in[255:0] - 256-bit d input (external, NOT from RNG)
// start_i - start computation
// done_o - computation complete (pulsed for duration of DONE)
// rho_out[255:0] - G output first 256 bits
// sigma_out[255:0] - G output next 256 bits
// kc_state_o[1599:0]- from keccak_core output (post-permutation state)
// kc_valid_o - from keccak_core (permutation complete)
// kc_ready_i - to keccak_core (always accept output = 1'b1)
// kc_state_i[1599:0]- to keccak_core input (pre-permutation state)
// kc_valid_i - to keccak_core (start permutation pulse)
// kc_ready_o - from keccak_core (core is idle / can accept)
module sha3_chain_top_shared (
input clk,
input rst_n,
input [255:0] d_in,
input start_i,
output done_o,
output [255:0] rho_out,
output [255:0] sigma_out,
// keccak_core interface (connect to shared arbiter)
input [1599:0] kc_state_o,
input kc_valid_o,
output kc_ready_i,
output [1599:0] kc_state_i,
output kc_valid_i,
input kc_ready_o
);
localparam ST_IDLE = 2'd0;
localparam ST_BUSY = 2'd1;
localparam ST_DONE = 2'd2;
reg [1:0] state_r, state_next;
// ================================================================
// Absorb state: message || suffix || pad10*1 into rate bits
//
// Replicates sha3_top G-mode absorb_state construction:
// data_i = {248'b0, k=8'd2, d_in}
// G: padded_block = {1'b1, {308{1'b0}}, 1'b1, 2'b10, data_i[263:0]}
// absorb_state = {1024'b0, padded_block_576}
// ================================================================
wire [511:0] sha3_data_i;
wire [575:0] g_pad;
wire [1599:0] absorb_state;
assign sha3_data_i = {248'b0, 8'd2, d_in};
assign g_pad = {1'b1, {308{1'b0}}, 1'b1, 2'b10, sha3_data_i[263:0]};
assign absorb_state = {{(1600-576){1'b0}}, g_pad};
// ================================================================
// keccak_core interface connections
// ================================================================
assign kc_ready_i = 1'b1; // always accept output
assign kc_state_i = absorb_state; // feed absorb state combinationally
assign kc_valid_i = (state_next == ST_BUSY); // start keccak on IDLE → BUSY
// done_o: asserted for duration of DONE state
assign done_o = (state_r == ST_DONE);
// ================================================================
// Output registers
// ================================================================
reg [255:0] rho_out_r, sigma_out_r;
assign rho_out = rho_out_r;
assign sigma_out = sigma_out_r;
// ================================================================
// FSM combinational next-state
// ================================================================
always @(*) begin
state_next = state_r;
case (state_r)
ST_IDLE: if (start_i && kc_ready_o) state_next = ST_BUSY;
ST_BUSY: if (kc_valid_o) state_next = ST_DONE;
ST_DONE: if (!start_i) state_next = ST_IDLE;
default: state_next = ST_IDLE;
endcase
end
// ================================================================
// Sequential logic
// ================================================================
always @(posedge clk or negedge rst_n) begin
if (!rst_n) begin
state_r <= ST_IDLE;
rho_out_r <= 256'd0;
sigma_out_r <= 256'd0;
end else begin
state_r <= state_next;
// Capture squeezed output when BUSY → DONE
if (state_r == ST_BUSY && kc_valid_o) begin
rho_out_r <= kc_state_o[255:0];
sigma_out_r <= kc_state_o[511:256];
end
end
end
endmodule

143
sync_rtl/top/keccak_arbiter.v Normal file
View File

@@ -0,0 +1,143 @@
// keccak_arbiter.v - Fixed-priority arbiter for sharing a single keccak_core
//
// Allows N consumers (sha3_chain, sample_cbd, sample_ntt, sha3_top) to
// share one keccak_core instance. Consumer 0 has highest priority — used
// for sha3_chain which needs fast turnaround during KeyGen.
//
// State machine:
// IDLE: Wait for any cons_valid_i. Grant to highest-priority consumer
// (lowest index). Assert kc_valid_i to start permutation.
// BUSY: Hold grant until kc_valid_o fires (permutation done), then
// return to IDLE. cons_valid_o pulses for the granted consumer.
//
// Parameters:
// NUM_CONSUMERS = 4
//
// Interface:
// Keccak side: kc_state_i/o, kc_valid_i/o, kc_ready_i/o (single instance)
// Consumer side: packed per-consumer valid/ready/state vectors
module keccak_arbiter #(
parameter NUM_CONSUMERS = 4
) (
input clk,
input rst_n,
// ── Keccak core side (single keccak_core instance) ──────────────
output [1599:0] kc_state_i,
output kc_valid_i,
input kc_ready_o,
input [1599:0] kc_state_o,
input kc_valid_o,
output kc_ready_i,
// ── Consumer side (N copies, packed) ────────────────────────────
input [NUM_CONSUMERS*1600-1:0] cons_state_i,
input [NUM_CONSUMERS-1:0] cons_valid_i,
output [NUM_CONSUMERS-1:0] cons_ready_o,
output [NUM_CONSUMERS*1600-1:0] cons_state_o,
output [NUM_CONSUMERS-1:0] cons_valid_o,
/* verilator lint_off UNUSEDSIGNAL */
input [NUM_CONSUMERS-1:0] cons_ready_i
/* verilator lint_on UNUSEDSIGNAL */
);
// ================================================================
// State machine
// ================================================================
localparam ST_IDLE = 1'b0;
localparam ST_BUSY = 1'b1;
reg state_r, state_next;
// ================================================================
// Grant logic
// ================================================================
localparam GRANT_W = $clog2(NUM_CONSUMERS);
reg [GRANT_W-1:0] grant_r; // registered grant (held during BUSY)
reg [GRANT_W-1:0] grant_comb; // priority-encoded index (combinational)
// Any consumer requesting
wire any_valid;
assign any_valid = |cons_valid_i;
// Priority encoder: consumer 0 has highest priority (lowest index).
// Reverse iteration so last assignment wins → lowest-index priority.
integer i;
always @(*) begin
grant_comb = {GRANT_W{1'b0}};
for (i = NUM_CONSUMERS - 1; i >= 0; i = i - 1) begin
if (cons_valid_i[i]) begin
/* verilator lint_off WIDTHTRUNC */
grant_comb = i; // intentional truncation: i ∈ [0,NUM_CONSUMERS-1] fits GRANT_W
/* verilator lint_on WIDTHTRUNC */
end
end
end
// Active grant: combinational in IDLE, registered (held) in BUSY
wire [GRANT_W-1:0] active_grant;
assign active_grant = (state_r == ST_IDLE) ? grant_comb : grant_r;
// ================================================================
// FSM next-state logic
// ================================================================
always @(*) begin
state_next = state_r;
case (state_r)
ST_IDLE: if (kc_ready_o && any_valid) state_next = ST_BUSY;
ST_BUSY: if (kc_valid_o) state_next = ST_IDLE;
default: state_next = ST_IDLE;
endcase
end
// ================================================================
// Sequential logic
// ================================================================
always @(posedge clk or negedge rst_n) begin
if (!rst_n) begin
state_r <= ST_IDLE;
grant_r <= {GRANT_W{1'b0}};
end else begin
state_r <= state_next;
// Capture grant on IDLE→BUSY transition
if (state_r == ST_IDLE && state_next == ST_BUSY)
grant_r <= grant_comb;
end
end
// ================================================================
// Keccak core side
// ================================================================
// Route selected consumer's state to keccak
assign kc_state_i = cons_state_i[active_grant * 1600 +: 1600];
// Start permutation when IDLE, keccak ready, and any consumer wants access
assign kc_valid_i = (state_r == ST_IDLE) && kc_ready_o && any_valid;
// Always accept keccak output (keccak_core's ready_i)
assign kc_ready_i = 1'b1;
// ================================================================
// Consumer side (generated per consumer)
// ================================================================
genvar g;
generate
for (g = 0; g < NUM_CONSUMERS; g = g + 1) begin : gen_consumer
// cons_ready_o: this consumer is granted AND keccak is ready
assign cons_ready_o[g] = (active_grant == g)
&& any_valid
&& (state_r == ST_IDLE)
&& kc_ready_o;
// cons_valid_o: this consumer was granted AND keccak finished
assign cons_valid_o[g] = (grant_r == g) && kc_valid_o;
// cons_state_o: broadcast keccak output to all consumers.
// Each consumer latches only when its own valid_o is high.
assign cons_state_o[g*1600 +: 1600] = kc_state_o;
end
endgenerate
endmodule

1403
sync_rtl/top/mlkem_top.v Normal file
View File

File diff suppressed because it is too large Load Diff