fallensigh/mlkem-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix ML-KEM arithmetic timing paths

Browse Source
This commit is contained in:
FallenSigh
2026-07-07 18:28:47 +08:00
parent 2fb1cd67e3
commit 8c3f4317f5
12 changed files with 5030 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
sync_rtl/top/mlkem_top.v
View File

@@ -1009,7 +1009,7 @@ module mlkem_top #(
// (d=du), then c2 = 1 poly of v (d=dv). Per poly = 256 coeffs -> 32*d
// bytes (whole), so the bit buffer empties at each poly boundary.
// micro-phase cp_ph: 0 present coeff addr; 1 feed comp_decomp (cd_valid);
// 2 wait pipe; 3 capture compressed + accumulate bits; 4..n drain bytes.
// 2 drop valid pulse; 3 wait/capture cd_vo; 4..n drain bytes.
// ================================================================
wire cd_active = (st == ST_ENC_C1) || (st == ST_ENC_C2);
reg [11:0] cd_coeff; // coeff presented to comp_decomp
@@ -1701,8 +1701,8 @@ module mlkem_top #(
// ---- ST_ENC_C1/C2: Compress_d -> byteEncode_d -> ct region ----
// C1 (E5): Compress_du(u[0..K-1]) from bank_se -> ct[0..c1_bytes).
// C2 (E7): Compress_dv(v) from bank_t[UPSUM] -> ct[c1_bytes..ct_bytes).
// Per coeff, 5-phase micro-sequence (read-ahead 1 cyc bram + 1 cyc
// comp_decomp pipe), then a drain sub-phase emitting whole bytes:
// Per coeff, 5-phase micro-sequence (read-ahead 1 cyc bram plus
// variable-latency comp_decomp), then a drain sub-phase emitting whole bytes:
// ph0: present coeff addr (cp_se_full / cp_bt_full by state).
// ph1: coeff arrives (cp_coeff_src) -> latch into cd_coeff, pulse cd_valid.
// ph2: drop cd_valid (1-cyc pulse); comp_decomp captures.
@@ -1723,10 +1723,12 @@ module mlkem_top #(
cp_ph <= 3'd3;
end
3'd3: begin
// cd_out valid (cd_vo): append cp_d bits LSB-first at bit cp_nbits
cp_buf <= cp_buf | (({13'd0, cd_out} & ((25'd1 << cp_d) - 25'd1)) << cp_nbits);
cp_nbits <= cp_nbits + {1'b0, cp_d};
cp_ph <= 3'd4;
if (cd_vo) begin
// Append compressed low cp_d bits LSB-first at bit cp_nbits.
cp_buf <= cp_buf | (({13'd0, cd_out} & ((25'd1 << cp_d) - 25'd1)) << cp_nbits);
cp_nbits <= cp_nbits + {1'b0, cp_d};
cp_ph <= 3'd4;
end
end
default: begin // 3'd4: drain whole bytes
if (cp_nbits >= 6'd8) begin