diff --git a/sync_rtl/top/TB/tb_mlkem_kg_2a_xsim.v b/sync_rtl/top/TB/tb_mlkem_kg_2a_xsim.v new file mode 100644 index 0000000..1b1a3fb --- /dev/null +++ b/sync_rtl/top/TB/tb_mlkem_kg_2a_xsim.v @@ -0,0 +1,45 @@ +// tb_mlkem_kg_2a_xsim.v - Stage 2a: verify G(d||K) -> rho/sigma in mlkem_top. +`timescale 1ns/1ps +module tb_mlkem_kg_2a_xsim; + reg clk=0, rst_n=0, start_i=0; + reg [255:0] d_i, z_i=0; + wire busy_o, done_o; + reg [3:0] dbg_slot_i=0; reg [7:0] dbg_idx_i=0; wire [11:0] dbg_coeff_o; + wire [255:0] dbg_rho_o, dbg_sigma_o; + + mlkem_top #(.K(2)) dut ( + .clk(clk), .rst_n(rst_n), .d_i(d_i), .z_i(z_i), .start_i(start_i), + .busy_o(busy_o), .done_o(done_o), + .dbg_slot_i(dbg_slot_i), .dbg_idx_i(dbg_idx_i), .dbg_coeff_o(dbg_coeff_o), + .dbg_rho_o(dbg_rho_o), .dbg_sigma_o(dbg_sigma_o) + ); + + always #5 clk = ~clk; + + localparam [255:0] D_LIT = 256'h2426f1941779574d3f1b163bd57f7e173e229e630ec7f7073bdf365137c4bb6d; + localparam [255:0] RHO_EXP = 256'h15f74355ca862c3cdf3dab780c35cf24b88bf144706090a1c17e41205f9f1379; + localparam [255:0] SIG_EXP = 256'h69b042001b5630b1a039116cbfd29f62c0bde5a6b571504a9fcce68bed667fd5; + + integer c; + initial begin + d_i = D_LIT; + rst_n=0; repeat(4) @(posedge clk); rst_n=1; @(posedge clk); + start_i=1; @(posedge clk); start_i=0; + c=0; while(!done_o && c<1000) begin @(posedge clk); c=c+1; end + if(!done_o) begin $display("FAIL: timeout"); $finish; end + $display("=== Stage 2a: G(d||K) ==="); + if (dbg_rho_o===RHO_EXP && dbg_sigma_o===SIG_EXP) begin + $display("PASS: rho = %064x", dbg_rho_o); + $display("PASS: sigma = %064x", dbg_sigma_o); + $display("ALL TESTS PASSED"); + end else begin + $display("FAIL:"); + $display(" rho got=%064x", dbg_rho_o); + $display(" rho exp=%064x", RHO_EXP); + $display(" sig got=%064x", dbg_sigma_o); + $display(" sig exp=%064x", SIG_EXP); + end + $finish; + end + initial begin #50000; $display("FAIL: global timeout"); $finish; end +endmodule diff --git a/sync_rtl/top/TB/tb_mlkem_kg_2c_xsim.v b/sync_rtl/top/TB/tb_mlkem_kg_2c_xsim.v new file mode 100644 index 0000000..c1de8b4 --- /dev/null +++ b/sync_rtl/top/TB/tb_mlkem_kg_2c_xsim.v @@ -0,0 +1,60 @@ +// tb_mlkem_kg_2c_xsim.v - Stage 2c: verify A_hat + s + e stored in mlkem_top. +// Reads golden kg_c000_AsE.hex (8 polys x 256 = 2048 lines, mod-q) and checks +// polymem slots A00,A01,A10,A11,S0,S1,E0,E1 via the debug readback tap. +`timescale 1ns/1ps +module tb_mlkem_kg_2c_xsim; + reg clk=0, rst_n=0, start_i=0; + reg [255:0] d_i, z_i=0; + wire busy_o, done_o; + reg [3:0] dbg_slot_i=0; reg [7:0] dbg_idx_i=0; wire [11:0] dbg_coeff_o; + wire [255:0] dbg_rho_o, dbg_sigma_o; + + mlkem_top #(.K(2)) dut ( + .clk(clk), .rst_n(rst_n), .d_i(d_i), .z_i(z_i), .start_i(start_i), + .busy_o(busy_o), .done_o(done_o), + .dbg_slot_i(dbg_slot_i), .dbg_idx_i(dbg_idx_i), .dbg_coeff_o(dbg_coeff_o), + .dbg_rho_o(dbg_rho_o), .dbg_sigma_o(dbg_sigma_o) + ); + always #5 clk = ~clk; + + localparam [255:0] D_LIT = 256'h2426f1941779574d3f1b163bd57f7e173e229e630ec7f7073bdf365137c4bb6d; + + reg [11:0] gold [0:2047]; + // slot order matches golden file order + reg [3:0] slot_of [0:7]; + integer c, p, idx, errors, gi; + + initial begin + $readmemh("sync_rtl/top/TB/vectors/kg_c000_AsE.hex", gold); + slot_of[0]=4'd0; slot_of[1]=4'd1; slot_of[2]=4'd2; slot_of[3]=4'd3; // A00..A11 + slot_of[4]=4'd4; slot_of[5]=4'd5; // S0,S1 + slot_of[6]=4'd6; slot_of[7]=4'd7; // E0,E1 + + d_i = D_LIT; + rst_n=0; repeat(4) @(posedge clk); rst_n=1; @(posedge clk); + start_i=1; @(posedge clk); start_i=0; + c=0; while(!done_o && c<200000) begin @(posedge clk); c=c+1; end + if(!done_o) begin $display("FAIL: timeout after %0d cyc", c); $finish; end + $display("=== Stage 2c: A_hat + s + e (8 polys) === done in %0d cyc", c); + + errors = 0; + for (p = 0; p < 8; p = p + 1) begin + for (idx = 0; idx < 256; idx = idx + 1) begin + dbg_slot_i = slot_of[p]; + dbg_idx_i = idx[7:0]; + @(posedge clk); @(posedge clk); // 2 cyc for registered readback + gi = p*256 + idx; + if (dbg_coeff_o !== gold[gi]) begin + if (errors < 8) + $display(" MISMATCH slot%0d[%0d]: got=%03x exp=%03x", + slot_of[p], idx, dbg_coeff_o, gold[gi]); + errors = errors + 1; + end + end + end + if (errors == 0) $display("ALL TESTS PASSED (2048/2048 coeffs)"); + else $display("TESTS FAILED: %0d mismatches", errors); + $finish; + end + initial begin #5000000; $display("FAIL: global timeout"); $finish; end +endmodule diff --git a/sync_rtl/top/TB/vectors/kg_c000_AsE.hex b/sync_rtl/top/TB/vectors/kg_c000_AsE.hex new file mode 100644 index 0000000..027c431 --- /dev/null +++ b/sync_rtl/top/TB/vectors/kg_c000_AsE.hex @@ -0,0 +1,2048 @@ +8d8 +a49 +3b7 +05e +179 +1bb +945 +5d2 +868 +700 +133 +61f +214 +142 +3ad +cb4 +354 +8cc +507 +c94 +c2b +9b7 +32e +25b +1c5 +4bb +01c +2bf +819 +4fd +cd9 +c29 +13e +cf0 +46c +6e1 +9fa +3cf +9f8 +1d9 +b0b +5be +7e0 +195 +1c8 +b3e +bfd +0ff +cb7 +195 +c74 +509 +42d +191 +9a0 +088 +8f6 +810 +528 +487 +684 +099 +66f +0fa +367 +579 +524 +a5c +4fb +121 +194 +7d4 +3ad +c78 +209 +411 +684 +8bd +721 +aa1 +c03 +226 +82c +21d +1a0 +428 +bbe +3d8 +53e +087 +cc9 +9b8 +ca7 +5fa +367 +0ba +06c +b71 +5c3 +28c +11f +710 +189 +928 +aa4 +6ac +366 +8e5 +519 +197 +36d +7d4 +261 +03c +a50 +038 +089 +156 +71f +48d +80a +7b0 +be5 +6c3 +8a8 +1a2 +b18 +213 +197 +726 +03f +4a6 +b0e +41f +412 +85b +341 +6b9 +059 +7a2 +4d7 +5c3 +ad3 +5f5 +7b3 +4eb +b7e +5df +886 +923 +138 +0a2 +979 +6cb +651 +1cb +984 +7be +b1b +281 +0db +50c +01e +2bf +071 +631 +44a +3fa +2d7 +120 +66f +36d +aec +200 +b41 +93d +b4d +819 +504 +b22 +9da +760 +c49 +0f6 +70b +95e +68b +1db +913 +af4 +20b +3e8 +c38 +26d +225 +34d +aa1 +be2 +553 +1fe +609 +1d7 +331 +be0 +959 +7ec +621 +355 +0ff +55a +3ba +2a8 +7d4 +43d +1c5 +54d +2a9 +5e7 +950 +7ab +643 +68e +689 +510 +212 +b24 +5e9 +2eb +a92 +036 +5aa +771 +a8a +318 +550 +8e6 +030 +269 +199 +15f +3f7 +036 +193 +0bc +67e +648 +289 +c87 +b89 +3a3 +312 +97d +03c +4a4 +aaf +b2d +58e +c5e +6e0 +299 +5d2 +98f +925 +54c +1ab +afb +6be +452 +a87 +5e1 +598 +68e +7e8 +170 +3da +a5c +552 +c0f +443 +343 +c2c +792 +c03 +24e +3c3 +461 +5aa +c47 +64e +743 +85e +7f5 +b63 +315 +730 +b06 +8e2 +ae0 +4bb +9f8 +b20 +2a4 +1b9 +876 +abf +33e +80c +898 +a87 +143 +86e +5d6 +39d +358 +649 +810 +64f +169 +5bc +046 +0d4 +4f0 +cef +8da +c5e +49c +c49 +8e0 +c4b +596 +259 +3a5 +a92 +234 +153 +cf1 +36a +138 +8c2 +89d +2fb +00a +823 +007 +3d7 +acc +667 +cd4 +a75 +cd4 +aa9 +97c +42e +649 +8b0 +122 +4dd +61d +813 +41a +4d9 +0ac +72a +b8f +9ea +41d +01f +787 +518 +2b2 +aac +c31 +2a9 +4c4 +a50 +53f +a6c +5f5 +8c8 +13c +697 +0eb +1f7 +637 +a44 +b3e +1d3 +b69 +8f0 +816 +7b1 +af8 +8cf +238 +a2b +129 +0cf +454 +2c1 +684 +ad9 +9c8 +289 +39c +921 +655 +c00 +a64 +26f +c67 +367 +07e +7ea +316 +304 +b95 +11c +9a7 +83d +644 +9d2 +65d +cb6 +3c2 +2a2 +a81 +120 +9c8 +0ff +7ad +286 +5f2 +0b3 +b6b +6a0 +14a +b10 +72f +bfc +39e +5b8 +5dd +029 +4e7 +6e9 +c55 +7ae +be1 +b11 +60c +3b7 +036 +aa7 +26f +2ab +cf8 +125 +601 +50c +8d9 +8e8 +63a +b8e +bb8 +891 +466 +513 +2e2 +ae5 +4cc +2c9 +7cd +3c5 +4f6 +590 +98c +cd0 +456 +9c8 +2c2 +3ae +10b +cf8 +582 +4fd +40f +82a +a5a +762 +43e +203 +2aa +c3f +645 +051 +290 +811 +6b4 +09c +c81 +51b +789 +2ed +aec +215 +b3a +240 +1b4 +2cc +7ec +9fc +72d +3e9 +88b +8a2 +2a9 +92c +5b8 +6ab +0ae +961 +a7b +970 +33a +aa6 +7f8 +c83 +030 +26d +594 +a50 +469 +619 +c75 +b92 +7ee +907 +1c3 +97c +c58 +8b8 +b2f +7b2 +4f7 +394 +021 +b94 +a37 +6f7 +397 +a07 +8c4 +cc1 +a41 +a21 +97f +8c9 +955 +571 +8ef +545 +185 +706 +80a +9fd +329 +5c6 +7b5 +357 +cdd +a62 +c25 +5d0 +375 +663 +93c +111 +ab5 +0d4 +42e +54b +462 +8fb +4eb +c21 +6ca +cb0 +b79 +80e +092 +399 +a56 +55f +390 +130 +54f +174 +c4b +4f1 +32b +032 +18a +8e6 +1bd +1f3 +165 +2a4 +571 +3b8 +408 +2a2 +9b0 +336 +465 +4c7 +833 +a09 +10b +14c +730 +03f +2bf +123 +c4b +064 +187 +c4b +9f3 +21d +3f5 +29c +6d6 +b10 +63d +3a2 +1cf +0df +bb0 +392 +2e3 +bbd +b3c +19d +8bd +88d +688 +0dc +613 +46b +3c4 +523 +bc6 +9e2 +480 +8b5 +7c0 +0ae +8e0 +177 +186 +5ff +539 +932 +bb9 +9cd +2df +7b3 +237 +5d3 +9ff +a88 +a62 +60f +c24 +a3d +457 +c16 +ce6 +ad0 +62a +089 +747 +c7f +8ea +2c3 +042 +6fa +cad +5ae +7fa +858 +93b +7d5 +b34 +17c +804 +9e0 +229 +847 +794 +000 +47d +684 +54a +a75 +a38 +261 +c8e +a8e +898 +3fd +1cc +ad3 +142 +3d6 +115 +4d8 +58f +864 +2f5 +922 +049 +799 +b7a +95a +419 +1d1 +0f3 +74d +86f +898 +654 +834 +91d +405 +310 +6d2 +a2c +8b7 +36b +4f6 +132 +cc3 +c1a +61b +b79 +75d +406 +3ad +2d8 +a0b +c79 +510 +a06 +060 +9e2 +4b3 +466 +c7d +9c9 +094 +964 +566 +1e2 +825 +380 +687 +cf3 +b6b +cd0 +c24 +19b +ae4 +759 +c5e +055 +c64 +922 +2a8 +1ec +73b +8c4 +9e9 +734 +c65 +216 +7f4 +6e0 +baa +6b3 +9f0 +2f4 +161 +9bb +1e4 +163 +b81 +060 +b5d +598 +073 +4d5 +6dd +4f4 +611 +69d +740 +b3d +79f +1e2 +519 +055 +7a0 +42c +02f +96a +b5c +3cf +068 +772 +267 +8da +926 +8cf +170 +1ba +852 +90a +0b8 +31f +033 +6f3 +329 +3fe +71d +00c +2a1 +b0e +410 +099 +4e9 +0b4 +356 +27e +2b9 +5b1 +60f +cb2 +089 +44c +b47 +930 +653 +5d1 +312 +1c2 +340 +b5b +af3 +ba7 +626 +83d +a16 +898 +bdd +bd0 +91f +b3d +784 +38f +8ec +32c +c85 +7ed +916 +00d +4ed +4ca +33d +7f5 +4c5 +5ab +a43 +ae8 +ad9 +76c +ba9 +8a2 +05b +809 +924 +77d +4c7 +bfd +299 +29a +02a +71e +12f +b83 +4f6 +bfe +82e +c82 +1fc +130 +454 +8e9 +846 +290 +c7d +ab7 +7c7 +458 +41a +a36 +bfe +5db +caa +784 +867 +70f +62b +176 +48e +4c5 +27e +5a9 +586 +a90 +627 +b76 +2f5 +011 +4b2 +919 +925 +646 +215 +52f +7d1 +ce4 +c8a +bd0 +38d +0bc +70c +988 +6b5 +939 +a7b +482 +176 +b20 +94b +046 +990 +cd6 +787 +374 +302 +4a1 +872 +907 +55e +5d7 +c86 +63d +006 +37a +97b +12e +218 +159 +b3c +808 +072 +a72 +8c7 +801 +27b +a9e +3b7 +7a6 +9f8 +35d +356 +457 +2cb +294 +601 +900 +a5f +2a5 +4a2 +134 +0da +7a3 +7cc +b4b +3b1 +7cc +685 +7ea +7ce +0ed +28c +a3b +745 +a05 +32c +2ae +b06 +4d1 +cf7 +203 +93e +24a +bd4 +55b +0f6 +826 +ac1 +4db +001 +000 +d00 +000 +000 +001 +d00 +001 +000 +003 +cfe +000 +000 +d00 +000 +000 +001 +d00 +d00 +001 +d00 +cff +001 +000 +d00 +003 +d00 +002 +d00 +cff +000 +000 +000 +001 +001 +002 +000 +002 +cfe +000 +d00 +003 +d00 +d00 +000 +001 +000 +000 +d00 +000 +001 +cff +d00 +001 +001 +001 +000 +001 +000 +000 +000 +001 +000 +000 +001 +d00 +000 +cfe +001 +000 +cff +000 +001 +001 +d00 +001 +002 +d00 +cff +000 +001 +000 +000 +d00 +001 +002 +001 +002 +d00 +001 +cff +000 +d00 +cff +d00 +000 +cff +002 +000 +001 +d00 +cff +001 +001 +000 +d00 +000 +001 +d00 +d00 +d00 +002 +003 +cff +d00 +002 +d00 +001 +d00 +cff +001 +000 +001 +d00 +000 +000 +000 +001 +001 +000 +001 +cfe +d00 +001 +000 +001 +000 +d00 +000 +d00 +002 +000 +001 +cff +d00 +d00 +001 +000 +001 +000 +002 +002 +cff +d00 +000 +000 +d00 +d00 +000 +002 +001 +001 +000 +d00 +cff +000 +001 +001 +000 +002 +d00 +d00 +000 +002 +000 +000 +cff +cfe +000 +cff +002 +001 +002 +d00 +d00 +001 +001 +001 +cff +001 +001 +001 +d00 +001 +000 +d00 +002 +cff +d00 +001 +000 +000 +002 +002 +000 +cfe +001 +001 +d00 +001 +d00 +cff +000 +d00 +000 +001 +000 +d00 +000 +d00 +001 +d00 +cff +001 +001 +000 +001 +000 +000 +000 +cff +000 +002 +001 +000 +d00 +d00 +cfe +d00 +000 +003 +002 +001 +003 +d00 +000 +d00 +001 +d00 +000 +d00 +d00 +000 +002 +cff +d00 +000 +001 +000 +000 +002 +003 +000 +003 +d00 +000 +d00 +d00 +d00 +000 +001 +d00 +001 +000 +000 +000 +002 +d00 +001 +001 +000 +d00 +000 +000 +cff +cff +d00 +001 +000 +001 +001 +d00 +000 +000 +002 +d00 +d00 +d00 +001 +000 +d00 +d00 +000 +d00 +001 +d00 +003 +d00 +000 +002 +cff +d00 +002 +001 +002 +000 +001 +001 +000 +002 +cff +000 +d00 +000 +cff +000 +001 +000 +d00 +cff +002 +d00 +d00 +cff +d00 +000 +000 +cff +cff +001 +002 +d00 +000 +002 +001 +001 +000 +d00 +000 +000 +d00 +001 +000 +002 +001 +000 +002 +002 +001 +cff +001 +000 +cff +001 +002 +000 +cff +cff +000 +002 +000 +000 +000 +002 +000 +d00 +000 +cff +001 +000 +000 +d00 +001 +001 +d00 +d00 +002 +d00 +001 +cfe +000 +d00 +002 +d00 +000 +cff +000 +000 +cff +001 +d00 +000 +000 +000 +d00 +003 +d00 +000 +001 +002 +001 +000 +000 +001 +000 +cff +000 +001 +d00 +002 +000 +cff +000 +002 +001 +001 +000 +000 +000 +001 +001 +002 +000 +001 +001 +d00 +cff +000 +d00 +000 +001 +000 +d00 +000 +001 +d00 +000 +d00 +000 +d00 +000 +002 +000 +001 +000 +001 +d00 +001 +cff +d00 +001 +d00 +002 +001 +001 +001 +000 +000 +000 +001 +002 +d00 +000 +cff +d00 +001 +000 +002 +000 +000 +001 +d00 +d00 +d00 +000 +000 +000 +001 +cfe +d00 +000 +001 +001 +002 +003 +001 +000 +d00 +000 +000 +000 +001 +d00 +cff +001 +003 +001 +002 +000 +000 +002 +001 +001 +000 +cfe +d00 +001 +002 +cff +000 +cff +d00 +000 +000 +001 +000 +000 +cfe +d00 +000 +000 +001 +d00 +000 +000 +cff +001 +001 +d00 +000 +002 +001 +002 +cff +001 +002 +000 +d00 +d00 +002 +002 +000 +000 +000 +cff +002 +d00 +000 +d00 +000 +000 +001 +000 +000 +000 +000 +d00 +001 +d00 +d00 +000 +002 +002 +cff +001 +000 +cff +000 +000 +002 +002 +cff +000 +000 +001 +d00 +000 +000 +001 +000 +cff +d00 +d00 +000 +000 +cff +000 +000 +d00 +cff +000 +cfe +cff +000 +000 +000 +001 +d00 +002 +000 +000 +001 +cff +d00 +001 +000 +d00 +001 +d00 +001 +002 +001 +d00 +d00 +d00 +002 +001 +001 +000 +000 +d00 +000 +000 +000 +d00 +001 +001 +002 +d00 +001 +002 +000 +001 +d00 +000 +001 +cfe +002 +d00 +cfe +cff +000 +001 +cff +001 +002 +d00 +001 +000 +d00 +d00 +001 +000 +000 +001 +d00 +d00 +000 +000 +000 +d00 +002 +001 +000 +d00 +000 +d00 +000 +d00 +002 +d00 +001 +cff +001 +000 +d00 +000 +000 +d00 +000 +003 +d00 +002 +000 +d00 +000 +000 +d00 +000 +d00 +d00 +000 +001 +001 +d00 +001 +002 +000 +000 +cff +000 +000 +000 +d00 +000 +d00 +000 +001 +000 +d00 +000 +000 +d00 +000 +cff +000 +001 +001 +d00 +000 +001 +002 +d00 +001 +003 +cff +d00 +001 +cff +cff +cff +d00 +001 +d00 +d00 +cff +000 +001 +002 +002 +001 +000 +001 +d00 +cff +002 +002 +d00 +002 +001 +002 +000 +000 +d00 +001 +000 +003 +000 +002 +d00 +d00 +000 +000 +d00 +003 +d00 +d00 +cff +001 +d00 +002 +cff +000 +000 +000 +000 +d00 +002 +d00 +000 +000 +d00 +000 +d00 +000 +d00 +000 +001 +002 +001 +001 +001 +001 +d00 +001 +001 +d00 +d00 +001 +000 +003 +001 +002 +002 +d00 +000 +000 +002 +000 +000 +d00 +cff +002 +000 +001 +cff +d00 +d00 +000 +000 +000 +d00 +001 +d00 +001 +002 +000 +d00 +001 +001 +cfe +000 +d00 +002 +001 +cff +000 +000 +001 +d00 +d00 +000 +000 +001 +001 +cff +000 +000 +000 +001 +001 +000 +d00 +000 +000 +d00 +d00 +d00 +002 +d00 +000 +cfe +000 +001 +000 +cff +001 +001 +001 +001 +001 +cfe +000 +001 +002 +d00 +001 +000 +000 +001 +000 +001 +001 +d00 +001 +000 +003 +000 +d00 +001 +002 +000 +002 +000 +001 +cff +002 +001 +d00 +cff +d00 +000 +002 +000 +000 +000 +cff +001 +002 +d00 +003 +000 +000 +cff +000 +001 +d00 +000 +d00 +000 +000 +d00 +d00 +001 +000 +cff +000 +001 +000 +000 +cff +000 +000 +001 +d00 +000 +001 +000 +000 +001 +d00 +001 +001 +001 +d00 +cff +000 +d00 +d00 +000 +000 +d00 +001 +d00 +002 +000 +000 +000 +002 +cff +000 +001 +000 +d00 +d00 +002 +d00 +000 +002 +000 +001 +d00 +002 +000 +cff +001 +cff +d00 +000 +d00 +002 +000 +000 +002 +001 +000 +001 +000 +000 +cfe +000 +001 +cff +001 +000 +d00 +cff +002 +d00 +000 +d00 +d00 +000 +d00 +cff +000 +d00 +000 +000 +001 +cff +d00 +d00 +001 diff --git a/sync_rtl/top/mlkem_top.v b/sync_rtl/top/mlkem_top.v new file mode 100644 index 0000000..6bf5a13 --- /dev/null +++ b/sync_rtl/top/mlkem_top.v @@ -0,0 +1,277 @@ +// mlkem_top.v - ML-KEM-512 KeyGen top-level integration (K=2, eta1=3). +// +// Streaming valid/ready interface. Given seeds d and z, computes the +// ML-KEM key pair per FIPS 203 Algorithm 16 (KeyGen_internal): +// (rho,sigma) = G(d || K) +// A_hat[i][j] = SampleNTT(rho || j || i) i,j in 0..K-1 +// s[i] = CBD3(PRF(sigma, i)), e[i] = CBD3(PRF(sigma, K+i)) +// s_hat[i] = NTT(s[i]); e_hat[i] = NTT(e[i]) +// t_hat[i] = e_hat[i] + sum_j A_hat[i][j] o s_hat[j] +// ek = byteEncode12(t_hat[0..K-1]) || rho +// dk = byteEncode12(s_hat[0..K-1]) || ek || H(ek) || z +// +// Built incrementally and verified stage-by-stage against ml-kem-r golden +// vectors (test_framework/modules/mlkem_keygen/golden) and NIST KAT. +// +// Uses independent (verified) leaf modules, each with its own keccak_core: +// sha3_top, sample_ntt_sync, sample_cbd_sync, ntt_core, poly_mul_sync, +// mod_add_sync. No shared-keccak arbiter. + +`include "sync_rtl/common/defines.vh" + +module mlkem_top #( + parameter K = 2, // ML-KEM-512 + parameter ETA1 = 3 +) ( + input clk, + input rst_n, + input [255:0] d_i, // KeyGen seed d (byte 0 in d_i[7:0]) + input [255:0] z_i, // implicit-rejection seed z + input start_i, // pulse to begin KeyGen + output busy_o, // high while running + output done_o, // pulse when ek/dk ready + + // Debug readback tap: read one stored coefficient by (poly slot, index). + // Lets stage TBs verify intermediates without wide buses. + input [3:0] dbg_slot_i, // poly slot (see localparams below) + input [7:0] dbg_idx_i, // coefficient index 0..255 + output [11:0] dbg_coeff_o, + // Debug taps for hash outputs + output [255:0] dbg_rho_o, + output [255:0] dbg_sigma_o +); + + localparam Q = `Q; // 3329 + + // ================================================================ + // Polynomial storage: K=2 needs A_hat[2][2]=4, s/s_hat[2], e/e_hat[2], + // t_hat[2]. Reuse slots: s and s_hat share (NTT in place), same for e. + // Slot map: + // 0..3 : A_hat[0][0],A_hat[0][1],A_hat[1][0],A_hat[1][1] + // 4..5 : s_hat[0], s_hat[1] (s[i] then overwritten by NTT) + // 6..7 : e_hat[0], e_hat[1] (e[i] then overwritten by NTT) + // 8..9 : t_hat[0], t_hat[1] + // ================================================================ + localparam SLOT_A00 = 4'd0, SLOT_A01 = 4'd1, SLOT_A10 = 4'd2, SLOT_A11 = 4'd3; + localparam SLOT_S0 = 4'd4, SLOT_S1 = 4'd5; + localparam SLOT_E0 = 4'd6, SLOT_E1 = 4'd7; + localparam SLOT_T0 = 4'd8, SLOT_T1 = 4'd9; + localparam NUM_SLOTS = 10; + + reg [11:0] polymem [0:NUM_SLOTS*256-1]; + + // Debug readback (registered for timing) + reg [11:0] dbg_coeff_r; + always @(posedge clk) dbg_coeff_r <= polymem[dbg_slot_i*256 + dbg_idx_i]; + assign dbg_coeff_o = dbg_coeff_r; + + // ================================================================ + // Top-level FSM (built incrementally). Stage 2a: G only. + // ================================================================ + localparam ST_IDLE = 4'd0; + localparam ST_G = 4'd1; // run G(d||K), capture rho/sigma + localparam ST_A = 4'd2; // generate A_hat[i][j] via SampleNTT + localparam ST_C = 4'd3; // generate s[i],e[i] via CBD + localparam ST_DONE = 4'd15; + + reg [3:0] st, st_next; + reg [255:0] rho_r, sigma_r; + + // A-generation bookkeeping + reg [2:0] a_pair; // 0..K*K (=4) pairs done + reg [7:0] a_widx; // write index 0..255 within current poly + reg a_busy; // 1 once current pair's request accepted (gates collect) + wire [1:0] a_i = a_pair[1] ? 2'd1 : 2'd0; // pair/K (K=2) + wire [1:0] a_j = a_pair[0] ? 2'd1 : 2'd0; // pair%K + wire [3:0] a_slot = {2'b0, a_pair[1], a_pair[0]}; // SLOT_A00..A11 = pair index + + // C-generation bookkeeping: 2*K polys = s0,s1,e0,e1 (idx 0..3) + reg [2:0] c_poly; // 0..2K + reg [7:0] c_widx; + reg c_busy; // 1 once current poly's request accepted (gates collect) + wire [7:0] c_nonce = {5'b0, c_poly}; // s:0,1 e:2,3 == nonce + // slot: c_poly 0->S0,1->S1,2->E0,3->E1 + wire [3:0] c_slot = (c_poly == 3'd0) ? SLOT_S0 : + (c_poly == 3'd1) ? SLOT_S1 : + (c_poly == 3'd2) ? SLOT_E0 : SLOT_E1; + + assign busy_o = (st != ST_IDLE); + assign done_o = (st == ST_DONE); + assign dbg_rho_o = rho_r; + assign dbg_sigma_o = sigma_r; + + // ---- sha3_top in G mode: data_i = {K_byte, d} (d byte0 in [7:0]) ---- + reg sha3_valid; + wire sha3_ready; + wire [511:0] sha3_hash; + wire sha3_vo; + reg sha3_ack; // consumer ready for hash + wire [511:0] g_data = {248'b0, 8'(K), d_i}; // data_i[263:256]=K, [255:0]=d + + sha3_top u_sha3 ( + .clk(clk), .rst_n(rst_n), + .mode(2'b00), // G = SHA3-512 + .data_i(g_data), + .valid_i(sha3_valid), + .ready_o(sha3_ready), + .hash_o(sha3_hash), + .valid_o(sha3_vo), + .ready_i(sha3_ack), + .mb_en(1'b0), .mb_block_i(1088'b0), .mb_valid_i(1'b0), + .mb_last_i(1'b0), .mb_ready_o() + ); + + // ---- sample_ntt_sync: Â[i][j] = SampleNTT(rho || j || i) ---- + reg snt_valid; + wire snt_ready; + wire [11:0] snt_coeff; + wire snt_vo; + wire snt_last; + reg snt_ack; // we accept coeffs + + sample_ntt_sync #(.K(K)) u_snt ( + .clk(clk), .rst_n(rst_n), + .rho_i(rho_r), + .k_i(3'(K)), + .i_idx(a_i), + .j_idx(a_j), + .valid_i(snt_valid), + .ready_o(snt_ready), + .coeff_o(snt_coeff), + .valid_o(snt_vo), + .ready_i(snt_ack), + .last_o(snt_last) + ); + + // ---- sample_cbd_sync: s[i]=CBD3(PRF(sigma,i)), e[i]=CBD3(PRF(sigma,K+i)) ---- + reg cbd_valid; + wire cbd_ready; + wire [11:0] cbd_coeff; // 12-bit signed (two's complement) + wire cbd_vo; + wire cbd_last; + reg cbd_ack; + + sample_cbd_sync u_cbd ( + .clk(clk), .rst_n(rst_n), + .seed_i(sigma_r), + .nonce_i(c_nonce), + .eta_i(2'(ETA1)), + .valid_i(cbd_valid), + .ready_o(cbd_ready), + .coeff_o(cbd_coeff), + .valid_o(cbd_vo), + .ready_i(cbd_ack), + .last_o(cbd_last) + ); + + // signed (two's complement) -> [0,Q): add Q when negative + wire [11:0] cbd_modq = cbd_coeff[11] ? (cbd_coeff + 12'(Q)) : cbd_coeff; + + always @(*) begin + st_next = st; + case (st) + ST_IDLE: if (start_i) st_next = ST_G; + ST_G: if (sha3_vo) st_next = ST_A; + ST_A: if (a_pair >= K*K) st_next = ST_C; + ST_C: if (c_poly >= 2*K) st_next = ST_DONE; + ST_DONE: st_next = ST_IDLE; + default: st_next = ST_IDLE; + endcase + end + + always @(posedge clk or negedge rst_n) begin + if (!rst_n) begin + st <= ST_IDLE; + rho_r <= 256'd0; + sigma_r <= 256'd0; + sha3_valid <= 1'b0; + sha3_ack <= 1'b0; + snt_valid <= 1'b0; + snt_ack <= 1'b0; + a_pair <= 3'd0; + a_widx <= 8'd0; + a_busy <= 1'b0; + cbd_valid <= 1'b0; + cbd_ack <= 1'b0; + c_poly <= 3'd0; + c_widx <= 8'd0; + c_busy <= 1'b0; + end else begin + st <= st_next; + + // Kick off G when entering ST_G + if (st == ST_IDLE && start_i) begin + sha3_valid <= 1'b1; + sha3_ack <= 1'b1; + end + // Drop valid once accepted + if (sha3_valid && sha3_ready) sha3_valid <= 1'b0; + + // Capture rho/sigma when G completes; arm A stage + if (st == ST_G && sha3_vo) begin + rho_r <= sha3_hash[255:0]; // rho = G output bytes 0..31 + sigma_r <= sha3_hash[511:256]; // sigma = bytes 32..63 + sha3_ack <= 1'b0; + snt_valid <= 1'b1; // start first SampleNTT + snt_ack <= 1'b1; + a_pair <= 3'd0; + a_widx <= 8'd0; + a_busy <= 1'b0; + end + + // ---- ST_A: drive SampleNTT, store 256 coeffs per pair ---- + if (st == ST_A) begin + // mark busy once this pair's request accepted + if (snt_valid && snt_ready) begin + snt_valid <= 1'b0; + a_busy <= 1'b1; + end + + // store each output coefficient only while busy (ignore stale last coeff from prior poly) + if (a_busy && snt_vo && snt_ack) begin + polymem[a_slot*256 + a_widx] <= snt_coeff; + if (snt_last) begin + // finished this poly; advance to next pair + a_pair <= a_pair + 3'd1; + a_widx <= 8'd0; + a_busy <= 1'b0; + // start next SampleNTT if more pairs remain + if (a_pair + 3'd1 < K*K) snt_valid <= 1'b1; + end else begin + a_widx <= a_widx + 8'd1; + end + end + end + + // Arm C stage when A finishes + if (st == ST_A && st_next == ST_C) begin + cbd_valid <= 1'b1; + cbd_ack <= 1'b1; + c_poly <= 3'd0; + c_widx <= 8'd0; + c_busy <= 1'b0; + end + + // ---- ST_C: drive CBD, store 256 mod-q coeffs per poly ---- + if (st == ST_C) begin + if (cbd_valid && cbd_ready) begin + cbd_valid <= 1'b0; + c_busy <= 1'b1; + end + + if (c_busy && cbd_vo && cbd_ack) begin + polymem[c_slot*256 + c_widx] <= cbd_modq; + if (cbd_last) begin + c_poly <= c_poly + 3'd1; + c_widx <= 8'd0; + c_busy <= 1'b0; + if (c_poly + 3'd1 < 2*K) cbd_valid <= 1'b1; + end else begin + c_widx <= c_widx + 8'd1; + end + end + end + end + end + +endmodule