Fix ML-KEM arithmetic timing paths

sync_rtl/comp_decomp/comp_decomp_sync.v

@@ -1,8 +1,9 @@
 // comp_decomp_sync.v - ML-KEM coefficient compression/decompression
 //
-// Streaming: one coefficient per cycle through pipeline_reg.
+// Streaming valid/ready interface. Compression is intentionally iterative to
+// avoid inferring a long combinational divider for /Q.
 // mode=0: compress   — round((2^d * x) / Q) mod 2^d
-// mode=1: decompress — round((Q * x) / 2^d) mod Q
+// mode=1: decompress — round((Q * x) / 2^d)
 // Uses round-half-up (round(2.5)=3, round(3.5)=4).
 // Integer arithmetic:
 //   compress:   (x * 2^d + Q/2) / Q,  lower d bits as result
@@ -24,52 +25,81 @@ module comp_decomp_sync (
     input         ready_i
 );
 
-    // 2^d for d in {4,5,10,11}; fits in 12 bits (max 2048)
-    wire [11:0] two_pow_d;
-    assign two_pow_d = 12'd1 << d;
+    localparam [11:0] Q_VAL       = 12'(`Q);
+    localparam [4:0]  COMP_MSB    = 5'd22;  // max ((Q-1)<<11)+Q/2 is 23 bits
 
-    // Product: 12-bit * 12-bit = max 2048*3328 = 6,815,744 → 23 bits (use 24)
-    wire [23:0] product;
+    reg        busy_r;
+    reg [4:0]  bit_idx_r;
+    reg [4:0]  d_r;
+    reg [23:0] dividend_r;
+    reg [23:0] quotient_r;
+    reg [12:0] rem_r;
+    reg [11:0] data_r;
+    reg        valid_r;
 
-    // compress: x * 2^d;  decompress: x * Q
-    assign product = mode ? {12'b0, coeff_in} * {12'b0, 12'(`Q)}
-                          : {12'b0, coeff_in} * {12'b0, two_pow_d};
+    wire fire_i = valid_i && ready_o;
 
-    // Rounding offset: compress→Q/2=1664; decompress→2^(d-1)
-    wire [11:0] round_off;
-    assign round_off = mode ? (two_pow_d >> 1) : 12'd1664;
+    // Accept a new command only when the iterative divider and output slot are
+    // both free. Current users tie ready_i high and issue one coefficient at a
+    // time, but this keeps the module from accepting work it cannot retain.
+    assign ready_o   = !busy_r && (!valid_r || ready_i);
+    assign coeff_out = data_r;
+    assign valid_o   = valid_r;
 
-    // Dividend = product + round_off  (max ~ 6,817,408 fits in 24 bits)
-    wire [23:0] dividend;
-    assign dividend = product + {12'b0, round_off};
+    wire [23:0] comp_dividend = ({12'd0, coeff_in} << d) + 24'd1664;
+    wire [23:0] decomp_product =
+        {12'd0, coeff_in} +
+        ({12'd0, coeff_in} << 8) +
+        ({12'd0, coeff_in} << 10) +
+        ({12'd0, coeff_in} << 11);
+    wire [23:0] decomp_rounded = decomp_product + (24'd1 << (d - 1'b1));
+    wire [11:0] decomp_result  = decomp_rounded >> d;
 
-    // Divisor: compress→Q=3329; decompress→2^d
-    wire [11:0] divisor;
-    assign divisor = mode ? two_pow_d : 12'(`Q);
+    wire [12:0] rem_shift = {rem_r[11:0], dividend_r[bit_idx_r]};
+    wire        rem_ge_q  = rem_shift >= {1'b0, Q_VAL};
+    wire [12:0] rem_sub_q = rem_shift - {1'b0, Q_VAL};
+    wire [12:0] rem_next  = rem_ge_q ? rem_sub_q : rem_shift;
+    wire [23:0] quot_next = quotient_r | (rem_ge_q ? (24'd1 << bit_idx_r) : 24'd0);
+    wire [11:0] comp_mask = (12'd1 << d_r) - 12'd1;
 
-    // Integer division (both ops positive → floor)
-    // Quotient is computed as 24b (widest operand) but fits in 12b
-    /* verilator lint_off WIDTHTRUNC */
-    wire [11:0] div_result;
-    assign div_result = dividend / {12'b0, divisor};
-    /* verilator lint_on WIDTHTRUNC */
+    always @(posedge clk or negedge rst_n) begin
+        if (!rst_n) begin
+            busy_r     <= 1'b0;
+            bit_idx_r  <= 5'd0;
+            d_r        <= 5'd0;
+            dividend_r <= 24'd0;
+            quotient_r <= 24'd0;
+            rem_r      <= 13'd0;
+            data_r     <= 12'd0;
+            valid_r    <= 1'b0;
+        end else begin
+            if (valid_r && ready_i)
+                valid_r <= 1'b0;
 
-    // Final modular reduction
-    // compress: lower d bits  (mask with 2^d - 1)
-    // decompress: result < Q always, but apply mod Q for safety
-    wire [11:0] mod_result;
-    assign mod_result = mode ? (div_result % 12'(`Q)) : (div_result & (two_pow_d - 1'b1));
-
-    // Pipeline through valid/ready stage
-    pipeline_reg #(.DW(12)) u_pipe (
-        .clk    (clk),
-        .rst_n  (rst_n),
-        .data_i (mod_result),
-        .valid_i(valid_i),
-        .ready_o(ready_o),
-        .data_o (coeff_out),
-        .valid_o(valid_o),
-        .ready_i(ready_i)
-    );
+            if (busy_r) begin
+                rem_r      <= rem_next;
+                quotient_r <= quot_next;
+                if (bit_idx_r == 5'd0) begin
+                    busy_r  <= 1'b0;
+                    data_r  <= quot_next[11:0] & comp_mask;
+                    valid_r <= 1'b1;
+                end else begin
+                    bit_idx_r <= bit_idx_r - 5'd1;
+                end
+            end else if (fire_i) begin
+                if (mode) begin
+                    data_r  <= decomp_result;
+                    valid_r <= 1'b1;
+                end else begin
+                    busy_r     <= 1'b1;
+                    bit_idx_r  <= COMP_MSB;
+                    d_r        <= d;
+                    dividend_r <= comp_dividend;
+                    quotient_r <= 24'd0;
+                    rem_r      <= 13'd0;
+                end
+            end
+        end
+    end
 
 endmodule