rhdl_ed25519_fast_core/

sign.rs

//! Cached-key, fixed-64-byte Ed25519 signing pipeline.
//!
//! The pipeline holds 128 independent requests and schedules their three
//! SHA-512 blocks, scalar reductions, fixed-base multiplications, paired point
//! compression, and scalar multiply-add operations independently. Messages and
//! intermediate values live in inferred BRAM; no DRAM, HBM, or host prehash is
//! part of the cryptographic path.

use rhdl::prelude::*;
use rhdl_fpga::core::{
    dff::DFF,
    ram::synchronous::{In as RamIn, SyncBRAM, Write as RamWrite},
};

use crate::{
    field_parallel::FieldElement51,
    multicomb::{ExtendedPoint, MultiCombMulIn},
    point_compress::{CompressedPoint, PointCompressPairIn},
    protocol::{SignRequest, Words512},
    scalar::ScalarWords,
    scalar_parallel::{
        ScalarReducePipe, ScalarReducePipeIn, ScalarWideMulIn, ScalarWideMulPipe,
        scalar_product_addend_kernel,
    },
    sha512_parallel::{Sha512PoolIn, Sha512PoolRequest},
};

#[cfg(feature = "wide-sign")]
use crate::parallel::{
    DualMultiComb as MultiCombMul, DualPointCompress as PointCompressPair,
    Sha512Pool8 as Sha512Pool,
};
#[cfg(not(feature = "wide-sign"))]
use crate::{
    multicomb::MultiCombMul, point_compress::PointCompressPair, sha512_parallel::Sha512Pool,
};

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct HashBlockInput {
    kind: b2,
    seed: ScalarWords,
    prefix: ScalarWords,
    public_key: ScalarWords,
    encoded_r: CompressedPoint,
    message: Words512,
}

const SIGN_FREE: u128 = 0;
const SIGN_NONCE_HASH: u128 = 1;
const SIGN_NONCE_WAIT: u128 = 2;
const SIGN_POINT: u128 = 3;
const SIGN_POINT_WAIT: u128 = 4;
const SIGN_COMPRESS_WAIT: u128 = 5;
const SIGN_CHALLENGE0_HASH: u128 = 6;
const SIGN_CHALLENGE0_WAIT: u128 = 7;
const SIGN_CHALLENGE1_HASH: u128 = 8;
const SIGN_CHALLENGE1_WAIT: u128 = 9;
const SIGN_MULADD: u128 = 10;
const SIGN_MULADD_WAIT: u128 = 11;

const HASH_NONCE: u128 = 0;
const HASH_CHALLENGE0: u128 = 1;
const HASH_CHALLENGE1: u128 = 2;
const HASH_SEED: u128 = 3;

/// Public input of [`CachedSignCore`].
#[derive(Copy, Clone, Debug, PartialEq, Digital)]
pub struct CachedSignIn {
    /// Loads and expands a key seed when [`CachedSignOut::load_key_ready`] is high.
    pub load_key_valid: bool,
    /// Secret 32-byte Ed25519 seed.
    pub key_seed: ScalarWords,
    /// Explicitly clears the cached expanded key.
    pub clear_key: bool,
    /// Marks [`Self::request`] valid.
    pub valid: bool,
    /// Fixed-64-byte signing request.
    pub request: SignRequest,
}

/// Public output of [`CachedSignCore`].
#[derive(Copy, Clone, Debug, PartialEq, Digital)]
pub struct CachedSignOut {
    /// High when a seed can be accepted.
    pub load_key_ready: bool,
    /// High after hardware key expansion and public-key derivation complete.
    pub key_loaded: bool,
    /// Cached compressed public key.
    pub public_key: ScalarWords,
    /// High when a signing request can be accepted.
    pub ready: bool,
    /// High for one cycle when [`Self::signature`] and [`Self::tag`] are valid.
    pub valid: bool,
    /// `R || S` signature, packed in little-endian words.
    pub signature: Words512,
    /// Delayed request tag.
    pub tag: b16,
    /// Number of occupied signing contexts.
    pub occupancy: b8,
    /// Sticky scheduler overflow or invariant failure.
    pub internal_error: bool,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct HashFetch {
    valid: bool,
    kind: b2,
    context: b7,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct HashIssue {
    valid: bool,
    state: [b64; 8],
    block: [b64; 16],
    tag: b9,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct MulFetch {
    valid: bool,
    context: b7,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct PointFetch {
    valid: bool,
    is_key: bool,
    context: b7,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct PointIssue {
    valid: bool,
    is_key: bool,
    context: b7,
    scalar: ScalarWords,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct OutputPending {
    valid: bool,
    context: b7,
    scalar: ScalarWords,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct SignMulStage {
    valid: bool,
    wide: Words512,
    tag: b16,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct SignControl {
    key_loaded: bool,
    key_busy: bool,
    key_hash_pending: bool,
    key_point_pending: bool,
    key_seed: ScalarWords,
    key_prefix: ScalarWords,
    key_secret: ScalarWords,
    public_key: ScalarWords,
    states: [b4; 128],
    tags: [b16; 128],
    free_fifo: [b7; 128],
    free_read: b7,
    free_write: b7,
    free_count: b8,
    hash_rr: b7,
    point_rr: b7,
    mul_rr: b7,
    hash_fetch: HashFetch,
    hash_issue: HashIssue,
    point_fetch: PointFetch,
    point_issue: PointIssue,
    mul_fetch: MulFetch,
    output_pending: OutputPending,
    internal_error: bool,
}

fn reset_control() -> SignControl {
    let mut free_fifo = [b7(0); 128];
    for (index, entry) in free_fifo.iter_mut().enumerate() {
        *entry = b7(index as u128);
    }
    SignControl {
        key_loaded: false,
        key_busy: false,
        key_hash_pending: false,
        key_point_pending: false,
        key_seed: ScalarWords { words: [b64(0); 4] },
        key_prefix: ScalarWords { words: [b64(0); 4] },
        key_secret: ScalarWords { words: [b64(0); 4] },
        public_key: ScalarWords { words: [b64(0); 4] },
        states: [b4(SIGN_FREE); 128],
        tags: [b16(0); 128],
        free_fifo,
        free_read: b7(0),
        free_write: b7(0),
        free_count: b8(128),
        hash_rr: b7(0),
        point_rr: b7(0),
        mul_rr: b7(0),
        hash_fetch: HashFetch {
            valid: false,
            kind: b2(0),
            context: b7(0),
        },
        hash_issue: HashIssue {
            valid: false,
            state: [b64(0); 8],
            block: [b64(0); 16],
            tag: b9(0),
        },
        point_fetch: PointFetch {
            valid: false,
            is_key: false,
            context: b7(0),
        },
        point_issue: PointIssue {
            valid: false,
            is_key: false,
            context: b7(0),
            scalar: ScalarWords { words: [b64(0); 4] },
        },
        mul_fetch: MulFetch {
            valid: false,
            context: b7(0),
        },
        output_pending: OutputPending {
            valid: false,
            context: b7(0),
            scalar: ScalarWords { words: [b64(0); 4] },
        },
        internal_error: false,
    }
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct SignMemoryIn {
    message: RamIn<Words512, 7>,
    chain: RamIn<Words512, 7>,
    nonce_point: RamIn<ScalarWords, 7>,
    nonce_mul: RamIn<ScalarWords, 7>,
    challenge: RamIn<ScalarWords, 7>,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct SignMemoryOut {
    message: Words512,
    chain: Words512,
    nonce_point: ScalarWords,
    nonce_mul: ScalarWords,
    challenge: ScalarWords,
}

/// On-chip signing context memories. The duplicated encoded-R memory provides
/// independent challenge-hash and result-retirement read ports.
#[derive(Clone, Debug, Synchronous, SynchronousDQ, Default)]
#[doc(hidden)]
pub struct SignMemory {
    message: SyncBRAM<Words512, 7>,
    chain: SyncBRAM<Words512, 7>,
    nonce_point: SyncBRAM<ScalarWords, 7>,
    nonce_mul: SyncBRAM<ScalarWords, 7>,
    challenge: SyncBRAM<ScalarWords, 7>,
}

impl SynchronousIO for SignMemory {
    type I = SignMemoryIn;
    type O = SignMemoryOut;
    type Kernel = sign_memory_kernel;
}

#[kernel]
#[doc(hidden)]
pub fn sign_memory_kernel(
    _cr: ClockReset,
    i: SignMemoryIn,
    q: SignMemoryQ,
) -> (SignMemoryOut, SignMemoryD) {
    let output = SignMemoryOut {
        message: q.message,
        chain: q.chain,
        nonce_point: q.nonce_point,
        nonce_mul: q.nonce_mul,
        challenge: q.challenge,
    };
    let mut d = SignMemoryD::dont_care();
    d.message = i.message;
    d.chain = i.chain;
    d.nonce_point = i.nonce_point;
    d.nonce_mul = i.nonce_mul;
    d.challenge = i.challenge;
    (output, d)
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct EncodedRWrite {
    enable: bool,
    context: b7,
    value: CompressedPoint,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct EncodedRStoreIn {
    read_hash: b7,
    read_result: b7,
    write0: EncodedRWrite,
    write1: EncodedRWrite,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct EncodedRStoreOut {
    hash: CompressedPoint,
    result: CompressedPoint,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct EncodedRBanks {
    bank0: [CompressedPoint; 16],
    bank1: [CompressedPoint; 16],
    bank2: [CompressedPoint; 16],
    bank3: [CompressedPoint; 16],
    bank4: [CompressedPoint; 16],
    bank5: [CompressedPoint; 16],
    bank6: [CompressedPoint; 16],
    bank7: [CompressedPoint; 16],
}

/// Two-write register file with two synchronous read ports for compressed points.
///
/// Eight physical banks keep each resettable RHDL array small. Compression
/// produces two points per cycle, so two logical write ports are required to
/// preserve the one-pair-per-cycle retirement burst.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
#[doc(hidden)]
pub struct EncodedRStore {
    read_data: DFF<[CompressedPoint; 2]>,
    bank0: DFF<[CompressedPoint; 16]>,
    bank1: DFF<[CompressedPoint; 16]>,
    bank2: DFF<[CompressedPoint; 16]>,
    bank3: DFF<[CompressedPoint; 16]>,
    bank4: DFF<[CompressedPoint; 16]>,
    bank5: DFF<[CompressedPoint; 16]>,
    bank6: DFF<[CompressedPoint; 16]>,
    bank7: DFF<[CompressedPoint; 16]>,
}

impl Default for EncodedRStore {
    fn default() -> Self {
        let zero = CompressedPoint { words: [b64(0); 4] };
        Self {
            read_data: DFF::new([zero; 2]),
            bank0: DFF::new([zero; 16]),
            bank1: DFF::new([zero; 16]),
            bank2: DFF::new([zero; 16]),
            bank3: DFF::new([zero; 16]),
            bank4: DFF::new([zero; 16]),
            bank5: DFF::new([zero; 16]),
            bank6: DFF::new([zero; 16]),
            bank7: DFF::new([zero; 16]),
        }
    }
}

impl SynchronousIO for EncodedRStore {
    type I = EncodedRStoreIn;
    type O = EncodedRStoreOut;
    type Kernel = encoded_r_store_kernel;
}

#[kernel]
fn encoded_r_read(address: b7, banks: EncodedRBanks) -> CompressedPoint {
    let index = address.resize::<4>();
    match (address >> 4).resize::<3>().raw() {
        0 => banks.bank0[index],
        1 => banks.bank1[index],
        2 => banks.bank2[index],
        3 => banks.bank3[index],
        4 => banks.bank4[index],
        5 => banks.bank5[index],
        6 => banks.bank6[index],
        _ => banks.bank7[index],
    }
}

#[kernel]
#[doc(hidden)]
pub fn encoded_r_store_kernel(
    _cr: ClockReset,
    i: EncodedRStoreIn,
    q: EncodedRStoreQ,
) -> (EncodedRStoreOut, EncodedRStoreD) {
    let mut bank0 = q.bank0;
    let mut bank1 = q.bank1;
    let mut bank2 = q.bank2;
    let mut bank3 = q.bank3;
    let mut bank4 = q.bank4;
    let mut bank5 = q.bank5;
    let mut bank6 = q.bank6;
    let mut bank7 = q.bank7;
    if i.write0.enable {
        let index = i.write0.context.resize::<4>();
        match (i.write0.context >> 4).resize::<3>().raw() {
            0 => bank0[index] = i.write0.value,
            1 => bank1[index] = i.write0.value,
            2 => bank2[index] = i.write0.value,
            3 => bank3[index] = i.write0.value,
            4 => bank4[index] = i.write0.value,
            5 => bank5[index] = i.write0.value,
            6 => bank6[index] = i.write0.value,
            _ => bank7[index] = i.write0.value,
        }
    }
    if i.write1.enable {
        let index = i.write1.context.resize::<4>();
        match (i.write1.context >> 4).resize::<3>().raw() {
            0 => bank0[index] = i.write1.value,
            1 => bank1[index] = i.write1.value,
            2 => bank2[index] = i.write1.value,
            3 => bank3[index] = i.write1.value,
            4 => bank4[index] = i.write1.value,
            5 => bank5[index] = i.write1.value,
            6 => bank6[index] = i.write1.value,
            _ => bank7[index] = i.write1.value,
        }
    }
    let banks = EncodedRBanks {
        bank0: q.bank0,
        bank1: q.bank1,
        bank2: q.bank2,
        bank3: q.bank3,
        bank4: q.bank4,
        bank5: q.bank5,
        bank6: q.bank6,
        bank7: q.bank7,
    };
    let output = EncodedRStoreOut {
        hash: q.read_data[0],
        result: q.read_data[1],
    };
    let mut d = EncodedRStoreD::dont_care();
    // Match the one-cycle read contract of the adjacent SyncBRAM stores.
    d.read_data = [
        encoded_r_read(i.read_hash, banks),
        encoded_r_read(i.read_result, banks),
    ];
    d.bank0 = bank0;
    d.bank1 = bank1;
    d.bank2 = bank2;
    d.bank3 = bank3;
    d.bank4 = bank4;
    d.bank5 = bank5;
    d.bank6 = bank6;
    d.bank7 = bank7;
    (output, d)
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct TaggedPoint {
    context: b7,
    point: ExtendedPoint,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct PointPairFifoIn {
    push: bool,
    value: TaggedPoint,
    pop: bool,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct PointPairFifoOut {
    valid: bool,
    second_valid: bool,
    first: TaggedPoint,
    second: TaggedPoint,
    count: b6,
    overflow: bool,
}

#[derive(Copy, Clone, Debug, PartialEq, Digital)]
#[doc(hidden)]
pub struct PointPairFifoControl {
    read_pair: b4,
    write_point: b5,
    count: b6,
    read_pending: bool,
    head_valid: bool,
    readable: b2,
    overflow: bool,
}

/// Thirty-two-point even/odd BRAM queue with a two-point dequeue interface.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
#[doc(hidden)]
pub struct PointPairFifo {
    control: DFF<PointPairFifoControl>,
    even: SyncBRAM<TaggedPoint, 4>,
    odd: SyncBRAM<TaggedPoint, 4>,
}

impl Default for PointPairFifo {
    fn default() -> Self {
        Self {
            control: DFF::new(PointPairFifoControl {
                read_pair: b4(0),
                write_point: b5(0),
                count: b6(0),
                read_pending: false,
                head_valid: false,
                readable: b2(0),
                overflow: false,
            }),
            even: SyncBRAM::default(),
            odd: SyncBRAM::default(),
        }
    }
}

impl SynchronousIO for PointPairFifo {
    type I = PointPairFifoIn;
    type O = PointPairFifoOut;
    type Kernel = point_pair_fifo_kernel;
}

#[kernel]
#[doc(hidden)]
pub fn point_pair_fifo_kernel(
    _cr: ClockReset,
    i: PointPairFifoIn,
    q: PointPairFifoQ,
) -> (PointPairFifoOut, PointPairFifoD) {
    let r = q.control;
    let mut n = r;
    let zero = FieldElement51 { limbs: [b51(0); 5] };
    let empty = TaggedPoint {
        context: b7(0),
        point: ExtendedPoint {
            x: zero,
            y: zero,
            z: zero,
            t: zero,
        },
    };
    let pop = i.pop && r.head_valid;
    let pop_two = pop && r.count >= b6(2);
    if r.read_pending {
        n.read_pending = false;
        n.head_valid = true;
    }
    if pop {
        n.head_valid = false;
        n.read_pair = r.read_pair + b4(1);
        if !pop_two {
            n.write_point = ((r.read_pair + b4(1)).resize::<5>()) << 1;
        }
    }
    let count_after_pop = if pop_two {
        r.count - b6(2)
    } else if pop {
        r.count - b6(1)
    } else {
        r.count
    };
    // SyncBRAM returns pre-write contents. A just-enqueued second point is
    // counted as occupied immediately, but cannot be read until the next edge.
    n.readable = if count_after_pop >= b6(2) {
        b2(2)
    } else {
        count_after_pop.resize::<2>()
    };
    if i.push {
        if count_after_pop < b6(32) {
            n.write_point = r.write_point + b5(1);
        } else {
            n.overflow = true;
        }
    }
    n.count = count_after_pop
        + if i.push && count_after_pop < b6(32) {
            b6(1)
        } else {
            b6(0)
        };
    if !n.head_valid && !n.read_pending && n.count >= b6(1) {
        n.read_pending = true;
    }
    let write = i.push && count_after_pop < b6(32);
    let even_write = RamWrite::<TaggedPoint, 4> {
        addr: (r.write_point >> 1).resize::<4>(),
        value: i.value,
        enable: write && (r.write_point & b5(1)) == b5(0),
    };
    let odd_write = RamWrite::<TaggedPoint, 4> {
        addr: (r.write_point >> 1).resize::<4>(),
        value: i.value,
        enable: write && (r.write_point & b5(1)) != b5(0),
    };
    let output = PointPairFifoOut {
        valid: r.head_valid && r.readable != b2(0),
        second_valid: r.head_valid && r.readable == b2(2),
        first: if r.head_valid { q.even } else { empty },
        second: if r.head_valid { q.odd } else { empty },
        count: r.count,
        overflow: r.overflow,
    };
    let mut d = PointPairFifoD::dont_care();
    d.control = n;
    d.even = RamIn::<TaggedPoint, 4> {
        read_addr: n.read_pair,
        write: even_write,
    };
    d.odd = RamIn::<TaggedPoint, 4> {
        read_addr: n.read_pair,
        write: odd_write,
    };
    (output, d)
}

/// Native-RHDL cached-key signing core for exactly 64-byte messages.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
pub struct CachedSignCore {
    control: DFF<SignControl>,
    memory: SignMemory,
    encoded_r: EncodedRStore,
    sha: Sha512Pool,
    hash_reducer: ScalarReducePipe,
    point: MultiCombMul,
    point_fifo: PointPairFifo,
    compressor: PointCompressPair,
    mul_multiplier: ScalarWideMulPipe,
    mul_add: DFF<SignMulStage>,
    mul_reducer: ScalarReducePipe,
}

impl Default for CachedSignCore {
    fn default() -> Self {
        Self {
            control: DFF::new(reset_control()),
            memory: SignMemory::default(),
            encoded_r: EncodedRStore::default(),
            sha: Sha512Pool::default(),
            hash_reducer: ScalarReducePipe::default(),
            point: MultiCombMul::default(),
            point_fifo: PointPairFifo::default(),
            compressor: PointCompressPair::default(),
            mul_multiplier: ScalarWideMulPipe::default(),
            mul_add: DFF::new(SignMulStage {
                valid: false,
                wide: Words512 { words: [b64(0); 8] },
                tag: b16(0),
            }),
            mul_reducer: ScalarReducePipe::default(),
        }
    }
}

impl SynchronousIO for CachedSignCore {
    type I = CachedSignIn;
    type O = CachedSignOut;
    type Kernel = cached_sign_kernel;
}

#[kernel]
fn next_context(value: b7) -> b7 {
    value + b7(1)
}

#[kernel]
fn scan_context(start: b7, offset: b8) -> b7 {
    (start.resize::<8>() + offset).resize::<7>()
}

#[kernel]
pub(crate) fn reverse_bytes(value: b64) -> b64 {
    let mut result = b64(0);
    for byte in 0..8 {
        result |= ((value >> (byte * 8) as u128).resize::<8>()).resize::<64>()
            << ((7 - byte) * 8) as u128;
    }
    result
}

#[kernel]
pub(crate) fn sha_iv() -> [b64; 8] {
    [
        b64(0x6a09e667f3bcc908),
        b64(0xbb67ae8584caa73b),
        b64(0x3c6ef372fe94f82b),
        b64(0xa54ff53a5f1d36f1),
        b64(0x510e527fade682d1),
        b64(0x9b05688c2b3e6c1f),
        b64(0x1f83d9abfb41bd6b),
        b64(0x5be0cd19137e2179),
    ]
}

#[kernel]
pub(crate) fn words256(value: ScalarWords) -> [b64; 4] {
    [
        reverse_bytes(value.words[0]),
        reverse_bytes(value.words[1]),
        reverse_bytes(value.words[2]),
        reverse_bytes(value.words[3]),
    ]
}

#[kernel]
fn build_hash_block(input: HashBlockInput) -> [b64; 16] {
    let mut block = [b64(0); 16];
    if input.kind == b2(HASH_SEED) {
        let seed_words = words256(input.seed);
        for index in 0..4 {
            block[index] = seed_words[index];
        }
        block[4] = b64(0x8000000000000000);
        block[15] = b64(0x100);
    } else if input.kind == b2(HASH_NONCE) {
        let prefix_words = words256(input.prefix);
        for index in 0..4 {
            block[index] = prefix_words[index];
        }
        for index in 0..8 {
            block[index + 4] = reverse_bytes(input.message.words[index]);
        }
        block[12] = b64(0x8000000000000000);
        block[15] = b64(0x300);
    } else if input.kind == b2(HASH_CHALLENGE0) {
        for index in 0..4 {
            block[index] = reverse_bytes(input.encoded_r.words[index]);
            block[index + 4] = reverse_bytes(input.public_key.words[index]);
        }
        for index in 0..8 {
            block[index + 8] = reverse_bytes(input.message.words[index]);
        }
    } else {
        block[0] = b64(0x8000000000000000);
        block[15] = b64(0x400);
    }
    block
}

#[kernel]
pub(crate) fn digest_words(state: [b64; 8]) -> Words512 {
    let mut words = [b64(0); 8];
    for index in 0..8 {
        words[index] = reverse_bytes(state[index]);
    }
    Words512 { words }
}

#[kernel]
pub(crate) fn secret_from_digest(state: [b64; 8]) -> ScalarWords {
    let digest = digest_words(state);
    let mut words = [
        digest.words[0],
        digest.words[1],
        digest.words[2],
        digest.words[3],
    ];
    words[0] &= b64(0xfffffffffffffff8);
    words[3] = (words[3] & b64(0x3fffffffffffffff)) | b64(0x4000000000000000);
    ScalarWords { words }
}

#[kernel]
pub(crate) fn prefix_from_digest(state: [b64; 8]) -> ScalarWords {
    let digest = digest_words(state);
    ScalarWords {
        words: [
            digest.words[4],
            digest.words[5],
            digest.words[6],
            digest.words[7],
        ],
    }
}

#[kernel]
fn compressed_as_scalar(value: CompressedPoint) -> ScalarWords {
    ScalarWords { words: value.words }
}

#[kernel]
fn scalar_as_compressed(value: ScalarWords) -> CompressedPoint {
    CompressedPoint { words: value.words }
}

/// State transition for [`CachedSignCore`].
#[kernel]
pub fn cached_sign_kernel(
    _cr: ClockReset,
    i: CachedSignIn,
    q: CachedSignCoreQ,
) -> (CachedSignOut, CachedSignCoreD) {
    let r = q.control;
    let mut n = r;
    let zero_scalar = ScalarWords { words: [b64(0); 4] };
    let zero_words = Words512 { words: [b64(0); 8] };
    let zero_field = FieldElement51 { limbs: [b51(0); 5] };
    let one_field = FieldElement51 {
        limbs: [b51(1), b51(0), b51(0), b51(0), b51(0)],
    };
    let identity = ExtendedPoint {
        x: zero_field,
        y: one_field,
        z: one_field,
        t: zero_field,
    };
    let mut output = CachedSignOut {
        load_key_ready: !r.key_loaded && !r.key_busy,
        key_loaded: r.key_loaded,
        public_key: r.public_key,
        ready: r.key_loaded && r.free_count != b8(0),
        valid: false,
        signature: zero_words,
        tag: b16(0),
        occupancy: b8(128) - r.free_count,
        internal_error: r.internal_error
            || q.point_fifo.overflow
            || q.point.error
            || q.compressor.error,
    };

    let no_message_write = RamWrite::<Words512, 7> {
        addr: b7(0),
        value: zero_words,
        enable: false,
    };
    let no_scalar_write = RamWrite::<ScalarWords, 7> {
        addr: b7(0),
        value: zero_scalar,
        enable: false,
    };
    let no_r_write = EncodedRWrite {
        enable: false,
        context: b7(0),
        value: CompressedPoint { words: [b64(0); 4] },
    };
    let mut message_write = no_message_write;
    let mut r_write0 = no_r_write;
    let mut r_write1 = no_r_write;
    let mut chain_write = no_message_write;
    let mut nonce_write = no_scalar_write;
    let mut challenge_write = no_scalar_write;

    if i.clear_key {
        n.key_loaded = false;
        n.key_busy = false;
        n.key_hash_pending = false;
        n.key_point_pending = false;
        n.key_seed = zero_scalar;
        n.key_prefix = zero_scalar;
        n.key_secret = zero_scalar;
        n.public_key = zero_scalar;
    }
    if i.load_key_valid && !r.key_loaded && !r.key_busy {
        n.key_busy = true;
        n.key_hash_pending = true;
        n.key_seed = i.key_seed;
    }

    let accept = i.valid && r.key_loaded && r.free_count != b8(0);
    if accept {
        let context = r.free_fifo[r.free_read];
        n.states[context] = b4(SIGN_NONCE_HASH);
        n.tags[context] = i.request.tag;
        n.free_read = next_context(r.free_read);
        n.free_count = r.free_count - b8(1);
        message_write = RamWrite::<Words512, 7> {
            addr: context,
            value: i.request.message,
            enable: true,
        };
    }

    let issue_accept = r.hash_issue.valid && q.sha.request0_ready;
    if issue_accept {
        n.hash_issue.valid = false;
    }
    let issue_available = !r.hash_issue.valid || issue_accept;
    if r.hash_fetch.valid && issue_available {
        let kind = r.hash_fetch.kind;
        n.hash_issue = HashIssue {
            valid: true,
            state: if kind == b2(HASH_CHALLENGE1) {
                q.memory.chain.words
            } else {
                sha_iv()
            },
            block: build_hash_block(HashBlockInput {
                kind,
                seed: r.key_seed,
                prefix: r.key_prefix,
                public_key: r.public_key,
                encoded_r: q.encoded_r.hash,
                message: q.memory.message,
            }),
            tag: (kind.resize::<9>() << 7) | r.hash_fetch.context.resize::<9>(),
        };
        n.hash_fetch.valid = false;
    }

    let fetch_available = !r.hash_fetch.valid || issue_available;
    let mut hash_found = false;
    let mut hash_kind = b2(HASH_NONCE);
    let mut hash_context = b7(0);
    if fetch_available {
        if r.key_hash_pending {
            hash_found = true;
            hash_kind = b2(HASH_SEED);
            n.key_hash_pending = false;
        } else {
            for offset in 0..8 {
                let context = scan_context(r.hash_rr, b8(offset as u128));
                let state = r.states[context];
                if !hash_found
                    && (state == b4(SIGN_NONCE_HASH)
                        || state == b4(SIGN_CHALLENGE0_HASH)
                        || state == b4(SIGN_CHALLENGE1_HASH))
                {
                    hash_found = true;
                    hash_context = context;
                    hash_kind = if state == b4(SIGN_NONCE_HASH) {
                        b2(HASH_NONCE)
                    } else if state == b4(SIGN_CHALLENGE0_HASH) {
                        b2(HASH_CHALLENGE0)
                    } else {
                        b2(HASH_CHALLENGE1)
                    };
                    n.states[context] = if state == b4(SIGN_NONCE_HASH) {
                        b4(SIGN_NONCE_WAIT)
                    } else if state == b4(SIGN_CHALLENGE0_HASH) {
                        b4(SIGN_CHALLENGE0_WAIT)
                    } else {
                        b4(SIGN_CHALLENGE1_WAIT)
                    };
                }
            }
            n.hash_rr = scan_context(r.hash_rr, b8(8));
        }
        if hash_found {
            n.hash_fetch = HashFetch {
                valid: true,
                kind: hash_kind,
                context: hash_context,
            };
        }
    }

    let sha_result = q.sha.result0;
    let sha_kind = (sha_result.tag >> 7).resize::<2>();
    let sha_context = sha_result.tag.resize::<7>();
    let reduce_input = ScalarReducePipeIn {
        valid: sha_result.valid && (sha_kind == b2(HASH_NONCE) || sha_kind == b2(HASH_CHALLENGE1)),
        wide: digest_words(sha_result.state),
        tag: sha_result.tag.resize::<16>(),
    };
    if sha_result.valid && sha_kind == b2(HASH_SEED) {
        n.key_secret = secret_from_digest(sha_result.state);
        n.key_prefix = prefix_from_digest(sha_result.state);
        n.key_point_pending = true;
    } else if sha_result.valid && sha_kind == b2(HASH_CHALLENGE0) {
        chain_write = RamWrite::<Words512, 7> {
            addr: sha_context,
            value: Words512 {
                words: sha_result.state,
            },
            enable: true,
        };
        n.states[sha_context] = b4(SIGN_CHALLENGE1_HASH);
    }

    if q.hash_reducer.valid {
        let kind = (q.hash_reducer.tag >> 7).resize::<2>();
        let context = q.hash_reducer.tag.resize::<7>();
        if kind == b2(HASH_NONCE) {
            nonce_write = RamWrite::<ScalarWords, 7> {
                addr: context,
                value: q.hash_reducer.scalar,
                enable: true,
            };
            n.states[context] = b4(SIGN_POINT);
        } else {
            challenge_write = RamWrite::<ScalarWords, 7> {
                addr: context,
                value: q.hash_reducer.scalar,
                enable: true,
            };
            n.states[context] = b4(SIGN_MULADD);
        }
    }

    let point_accept = r.point_issue.valid && q.point.ready;
    if point_accept {
        n.point_issue.valid = false;
    }
    let point_issue_available = !r.point_issue.valid || point_accept;
    if r.point_fetch.valid && point_issue_available {
        n.point_issue = PointIssue {
            valid: true,
            is_key: r.point_fetch.is_key,
            context: r.point_fetch.context,
            scalar: if r.point_fetch.is_key {
                r.key_secret
            } else {
                q.memory.nonce_point
            },
        };
        n.point_fetch.valid = false;
    }
    let point_fetch_available = !r.point_fetch.valid || point_issue_available;
    let mut point_found = false;
    let mut point_context = b7(0);
    let mut point_is_key = false;
    if point_fetch_available {
        if r.key_point_pending {
            point_found = true;
            point_is_key = true;
            n.key_point_pending = false;
        } else {
            for offset in 0..8 {
                let context = scan_context(r.point_rr, b8(offset as u128));
                if !point_found && r.states[context] == b4(SIGN_POINT) {
                    point_found = true;
                    point_context = context;
                    n.states[context] = b4(SIGN_POINT_WAIT);
                }
            }
            n.point_rr = scan_context(r.point_rr, b8(8));
        }
        if point_found {
            n.point_fetch = PointFetch {
                valid: true,
                is_key: point_is_key,
                context: point_context,
            };
        }
    }
    let point_input = MultiCombMulIn {
        valid: r.point_issue.valid,
        scalar: r.point_issue.scalar,
        tag: (if r.point_issue.is_key {
            b16(1) << 15
        } else {
            b16(0)
        }) | r.point_issue.context.resize::<16>(),
    };

    let point_is_key_result = q.point.valid && (q.point.tag & (b16(1) << 15)) != b16(0);
    let point_push = q.point.valid && !point_is_key_result;
    if point_push {
        let context = q.point.tag.resize::<7>();
        n.states[context] = b4(SIGN_COMPRESS_WAIT);
    }
    let mut point_work_pending = r.point_fetch.valid || r.point_issue.valid || point_push;
    for context in 0..128 {
        if r.states[context] == b4(SIGN_POINT) || r.states[context] == b4(SIGN_POINT_WAIT) {
            point_work_pending = true;
        }
    }
    if q.point.occupancy != b5(0) {
        point_work_pending = true;
    }
    let single_tail = q.point_fifo.valid && q.point_fifo.count == b6(1) && !point_work_pending;
    let pair_ready =
        q.point_fifo.valid && q.compressor.ready && (q.point_fifo.second_valid || single_tail);
    let key_compress = point_is_key_result && q.compressor.ready;
    if point_is_key_result && !q.compressor.ready {
        n.internal_error = true;
    }
    let compressor_input = PointCompressPairIn {
        valid: key_compress || pair_ready,
        first: if key_compress {
            q.point.point
        } else {
            q.point_fifo.first.point
        },
        second: if key_compress || single_tail {
            identity
        } else {
            q.point_fifo.second.point
        },
        tag: if key_compress {
            b16(1) << 15
        } else {
            q.point_fifo.first.context.resize::<16>()
                | (q.point_fifo.second.context.resize::<16>() << 7)
                | if single_tail { b16(1) << 14 } else { b16(0) }
        },
    };

    if q.compressor.valid {
        if (q.compressor.tag & (b16(1) << 15)) != b16(0) {
            n.public_key = compressed_as_scalar(q.compressor.first);
            n.key_loaded = true;
            n.key_busy = false;
        } else {
            let single = (q.compressor.tag & (b16(1) << 14)) != b16(0);
            let first_context = q.compressor.tag.resize::<7>();
            let second_context = (q.compressor.tag >> 7).resize::<7>();
            r_write0 = EncodedRWrite {
                enable: true,
                context: first_context,
                value: q.compressor.first,
            };
            r_write1 = EncodedRWrite {
                enable: !single,
                context: second_context,
                value: q.compressor.second,
            };
            n.states[first_context] = b4(SIGN_CHALLENGE0_HASH);
            if !single {
                n.states[second_context] = b4(SIGN_CHALLENGE0_HASH);
            }
        }
    }

    let mut mul_found = false;
    let mut mul_context = b7(0);
    if !r.mul_fetch.valid {
        for offset in 0..8 {
            let context = scan_context(r.mul_rr, b8(offset as u128));
            if !mul_found && r.states[context] == b4(SIGN_MULADD) {
                mul_found = true;
                mul_context = context;
                n.states[context] = b4(SIGN_MULADD_WAIT);
            }
        }
        n.mul_rr = scan_context(r.mul_rr, b8(8));
        if mul_found {
            n.mul_fetch = MulFetch {
                valid: true,
                context: mul_context,
            };
        }
    }
    let muladd_input = ScalarWideMulIn {
        valid: r.mul_fetch.valid,
        x: q.memory.challenge,
        y: r.key_secret,
        addend: q.memory.nonce_mul,
        tag: r.mul_fetch.context.resize::<16>(),
    };
    if r.mul_fetch.valid {
        n.mul_fetch.valid = false;
    }

    let scalar_result_pending = q.mul_reducer.valid;
    if scalar_result_pending {
        n.output_pending = OutputPending {
            valid: true,
            context: q.mul_reducer.tag.resize::<7>(),
            scalar: q.mul_reducer.scalar,
        };
    }
    let signature_retire = r.output_pending.valid;
    if signature_retire {
        let context = r.output_pending.context;
        output.valid = true;
        output.tag = r.tags[context];
        output.signature = Words512 {
            words: [
                q.encoded_r.result.words[0],
                q.encoded_r.result.words[1],
                q.encoded_r.result.words[2],
                q.encoded_r.result.words[3],
                r.output_pending.scalar.words[0],
                r.output_pending.scalar.words[1],
                r.output_pending.scalar.words[2],
                r.output_pending.scalar.words[3],
            ],
        };
        if !scalar_result_pending {
            n.output_pending.valid = false;
        }
        n.states[context] = b4(SIGN_FREE);
        n.free_fifo[r.free_write] = context;
        n.free_write = next_context(r.free_write);
        n.free_count = n.free_count + b8(1);
    }

    let hash_read_context = if hash_found {
        hash_context
    } else {
        r.hash_fetch.context
    };
    let scalar_read_context = if mul_found {
        mul_context
    } else {
        r.mul_fetch.context
    };
    let point_read_context = if point_found {
        point_context
    } else {
        r.point_fetch.context
    };
    let result_read_context = if scalar_result_pending {
        q.mul_reducer.tag.resize::<7>()
    } else {
        r.output_pending.context
    };
    let mut d = CachedSignCoreD::dont_care();
    d.control = n;
    d.memory = SignMemoryIn {
        message: RamIn::<Words512, 7> {
            read_addr: hash_read_context,
            write: message_write,
        },
        chain: RamIn::<Words512, 7> {
            read_addr: hash_read_context,
            write: chain_write,
        },
        nonce_point: RamIn::<ScalarWords, 7> {
            read_addr: point_read_context,
            write: nonce_write,
        },
        nonce_mul: RamIn::<ScalarWords, 7> {
            read_addr: scalar_read_context,
            write: nonce_write,
        },
        challenge: RamIn::<ScalarWords, 7> {
            read_addr: scalar_read_context,
            write: challenge_write,
        },
    };
    d.encoded_r = EncodedRStoreIn {
        read_hash: hash_read_context,
        read_result: result_read_context,
        write0: r_write0,
        write1: r_write1,
    };
    d.sha = Sha512PoolIn {
        request0: Sha512PoolRequest {
            valid: r.hash_issue.valid,
            tag: r.hash_issue.tag,
            state: r.hash_issue.state,
            block: r.hash_issue.block,
        },
        request1: Sha512PoolRequest {
            valid: false,
            tag: b9(0),
            state: [b64(0); 8],
            block: [b64(0); 16],
        },
    };
    d.hash_reducer = reduce_input;
    d.point = point_input;
    d.point_fifo = PointPairFifoIn {
        push: point_push,
        value: TaggedPoint {
            context: q.point.tag.resize::<7>(),
            point: q.point.point,
        },
        pop: pair_ready,
    };
    d.compressor = compressor_input;
    d.mul_multiplier = muladd_input;
    d.mul_add = SignMulStage {
        valid: q.mul_multiplier.valid,
        wide: scalar_product_addend_kernel(q.mul_multiplier.product, q.mul_multiplier.addend),
        tag: q.mul_multiplier.tag,
    };
    d.mul_reducer = ScalarReducePipeIn {
        valid: q.mul_add.valid,
        wide: q.mul_add.wide,
        tag: q.mul_add.tag,
    };
    (output, d)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::simulation::CycleSim;
    use ed25519_dalek::{Signer, SigningKey};

    #[test]
    fn compressed_point_reads_are_registered() {
        let zero = CompressedPoint::zero();
        let mut i = EncodedRStoreIn {
            read_hash: b7(0),
            read_result: b7(1),
            write0: EncodedRWrite {
                enable: false,
                context: b7(0),
                value: zero,
            },
            write1: EncodedRWrite {
                enable: false,
                context: b7(0),
                value: zero,
            },
        };
        let mut sim = CycleSim::new(EncodedRStore::default());
        i.write0 = EncodedRWrite {
            enable: true,
            context: b7(0),
            value: CompressedPoint {
                words: [b64(11); 4],
            },
        };
        i.write1 = EncodedRWrite {
            enable: true,
            context: b7(1),
            value: CompressedPoint {
                words: [b64(22); 4],
            },
        };
        sim.tick(i);
        i.write0.enable = false;
        i.write1.enable = false;
        let output = sim.tick(i);
        assert_eq!(output.hash.words, [b64(11); 4]);
        assert_eq!(output.result.words, [b64(22); 4]);
        // A combinational address change must not alter output before an edge.
        i.read_hash = b7(1);
        i.read_result = b7(0);
        let q = EncodedRStoreQ {
            read_data: [output.hash, output.result],
            bank0: [zero; 16],
            bank1: [zero; 16],
            bank2: [zero; 16],
            bank3: [zero; 16],
            bank4: [zero; 16],
            bank5: [zero; 16],
            bank6: [zero; 16],
            bank7: [zero; 16],
        };
        let (held, _) = encoded_r_store_kernel(ClockReset::dont_care(), i, q);
        assert_eq!(held, output);
        let output = sim.tick(i);
        assert_eq!(output.hash.words, [b64(22); 4]);
        assert_eq!(output.result.words, [b64(11); 4]);
    }

    #[test]
    fn all_128_compressed_point_contexts_are_distinct() {
        let mut sim = CycleSim::new(EncodedRStore::default());
        let mut input = EncodedRStoreIn::dont_care();
        for index in 0..64 {
            input.write0 = EncodedRWrite {
                enable: true,
                context: b7(index),
                value: CompressedPoint {
                    words: [b64(index + 1); 4],
                },
            };
            input.write1 = EncodedRWrite {
                enable: true,
                context: b7(index + 64),
                value: CompressedPoint {
                    words: [b64(index + 65); 4],
                },
            };
            sim.tick(input);
        }
        input.write0.enable = false;
        input.write1.enable = false;
        for index in 0..128 {
            input.read_hash = b7(index);
            input.read_result = b7(127 - index);
            let output = sim.tick(input);
            assert_eq!(output.hash.words, [b64(index + 1); 4]);
            assert_eq!(output.result.words, [b64(128 - index); 4]);
        }
    }

    #[test]
    fn point_pairs_never_read_a_just_written_bram_word() {
        let mut sim = CycleSim::new(PointPairFifo::default());
        let empty = TaggedPoint {
            context: b7(0),
            point: ExtendedPoint::identity(),
        };
        let mut output = sim.tick(PointPairFifoIn {
            push: false,
            value: empty,
            pop: false,
        });
        let mut seen = Vec::new();
        for cycle in 0..100 {
            let pop = output.valid && output.second_valid;
            if pop {
                seen.push(output.first.context.raw());
                seen.push(output.second.context.raw());
                assert_eq!(
                    output.first.point.x.limbs[0].raw(),
                    output.first.context.raw() + 1
                );
                assert_eq!(
                    output.second.point.x.limbs[0].raw(),
                    output.second.context.raw() + 1
                );
            }
            let mut value = empty;
            value.context = b7(cycle % 64);
            value.point.x.limbs[0] = b51(cycle + 1);
            output = sim.tick(PointPairFifoIn {
                push: cycle < 20,
                value,
                pop,
            });
            assert!(!output.overflow);
        }
        assert_eq!(seen, (0..20).collect::<Vec<_>>());
    }

    fn scalar_words(bytes: [u8; 32]) -> ScalarWords {
        ScalarWords {
            words: std::array::from_fn(|index| {
                b64(u64::from_le_bytes(bytes[index * 8..index * 8 + 8].try_into().unwrap()) as u128)
            }),
        }
    }

    fn words512(bytes: [u8; 64]) -> Words512 {
        Words512 {
            words: std::array::from_fn(|index| {
                b64(u64::from_le_bytes(bytes[index * 8..index * 8 + 8].try_into().unwrap()) as u128)
            }),
        }
    }

    fn bytes512(words: Words512) -> [u8; 64] {
        let mut bytes = [0u8; 64];
        for (index, word) in words.words.iter().enumerate() {
            bytes[index * 8..index * 8 + 8].copy_from_slice(&(word.raw() as u64).to_le_bytes());
        }
        bytes
    }

    fn idle() -> CachedSignIn {
        CachedSignIn {
            load_key_valid: false,
            key_seed: ScalarWords { words: [b64(0); 4] },
            clear_key: false,
            valid: false,
            request: SignRequest {
                message: Words512 { words: [b64(0); 8] },
                tag: b16(0),
            },
        }
    }

    #[test]
    fn cached_signing_matches_dalek() {
        std::thread::Builder::new()
            .name("cached-sign-sim".into())
            .stack_size(256 * 1024 * 1024)
            .spawn(cached_signing_body)
            .unwrap()
            .join()
            .unwrap();
    }

    fn cached_signing_body() {
        let seed = std::array::from_fn(|index| (index as u8).wrapping_mul(23));
        let message = std::array::from_fn(|index| (index as u8).wrapping_mul(31).rotate_left(1));
        let key = SigningKey::from_bytes(&seed);
        let expected_key = key.verifying_key().to_bytes();
        let expected_signature = key.sign(&message).to_bytes();
        let mut load_sent = false;
        let mut sign_sent = false;
        let mut sim = CycleSim::new(CachedSignCore::default());
        let mut output = sim.tick(idle());
        for _ in 0..40_000 {
            let mut input = idle();
            if !load_sent && output.load_key_ready {
                input.load_key_valid = true;
                input.key_seed = scalar_words(seed);
                load_sent = true;
            } else if !sign_sent && output.key_loaded && output.ready {
                assert_eq!(output.public_key, scalar_words(expected_key));
                input.valid = true;
                input.request = SignRequest {
                    message: words512(message),
                    tag: b16(0x51a7),
                };
                sign_sent = true;
            }
            output = sim.tick(input);
            assert!(!output.internal_error);
            if output.valid {
                assert_eq!(output.tag, b16(0x51a7));
                assert_eq!(bytes512(output.signature), expected_signature);
                println!("sign completion at cycle {}", sim.cycles());
                return;
            }
        }
        panic!(
            "signer timeout: loaded={} occupancy={}",
            output.key_loaded,
            output.occupancy.raw()
        );
    }

    #[test]
    #[ignore = "sustained experiment: run with --profile sim under tools/bounded.sh"]
    fn sustained_signing_matches_dalek() {
        std::thread::Builder::new().stack_size(256 * 1024 * 1024)
            .spawn(|| {
                let count = std::env::var("ED25519_BENCH_COUNT").ok().and_then(|s|s.parse::<usize>().ok()).unwrap_or(384);
                assert!((384..=4096).contains(&count));
                let seed=[0x51;32];
                let key=SigningKey::from_bytes(&seed);
                let messages:Vec<[u8;64]>=(0..count).map(|tag| {
                    let mut message=std::array::from_fn(|i|(tag as u8).wrapping_add((i as u8).wrapping_mul(17)));
                    message[..4].copy_from_slice(&(tag as u32).to_le_bytes());
                    message
                }).collect();
                let expected:Vec<_>=messages.iter().map(|m|key.sign(m).to_bytes()).collect();
                let mut seen=vec![false;count];
                let mut sim=CycleSim::new(CachedSignCore::default());
                let mut output=sim.tick(idle());
                let mut loaded=false; let mut accepted=0; let mut completed=0;
                let mut first=0; let mut last=0;
                let mut full_context_cycles=0; let mut loaded_cycles=0;
                let mut accepted_at=Vec::new(); let mut completed_at=Vec::new();
                for _ in 0..count*1000+30_000 {
                    let mut input=idle();
                    if !loaded && output.load_key_ready { input.load_key_valid=true;input.key_seed=scalar_words(seed);loaded=true; }
                    if output.ready && accepted<count {
                        input.valid=true;input.request=SignRequest{message:words512(messages[accepted]),tag:b16(accepted as u128)};
                        accepted+=1; accepted_at.push(sim.cycles()+1);
                    }
                    output=sim.tick(input);
                    if output.key_loaded && accepted<count { loaded_cycles+=1; if !output.ready {full_context_cycles+=1;} }
                    assert!(!output.internal_error,"internal error at {}",sim.cycles());
                    if output.valid {
                        let tag=output.tag.raw() as usize;
                        assert!(tag<count && !seen[tag],"unexpected/duplicate tag {tag}");
                        assert_eq!(bytes512(output.signature),expected[tag],"signature {tag}");
                        seen[tag]=true;completed+=1;completed_at.push(sim.cycles());
                        if completed==128 { first=sim.cycles(); }
                        if completed==count-128 { last=sim.cycles(); }
                        if completed%64==0 { println!("completed {completed}/{count} at cycle {}",sim.cycles()); }
                        if completed==count { break; }
                    }
                }
                assert_eq!((accepted,completed),(count,count));
                let interval=(last-first) as f64/(count-256) as f64;
                let topology=if cfg!(feature="wide-sign") {"wide"} else {"compact"};
                println!("topology={topology} cycles/sign={interval:.3} projection_at_205mhz={:.0} sig/s (NOT measured hardware clock)",205e6/interval);
                std::fs::create_dir_all("reports/bench").unwrap();
                std::fs::write(format!("reports/bench/native-{topology}.json"),format!(
                    "{{\"topology\":\"{topology}\",\"contexts\":128,\"accepted\":{accepted},\"completed\":{completed},\"warmup_completions\":128,\"drain_excluded\":128,\"interval_start\":{first},\"interval_end\":{last},\"sign_ii\":{interval},\"assumed_mhz\":205,\"achieved_mhz\":null,\"all_signatures_match_dalek\":true,\"loaded_offer_cycles\":{loaded_cycles},\"full_context_cycles\":{full_context_cycles},\"accept_cycles\":{accepted_at:?},\"completion_cycles\":{completed_at:?}}}\n"
                )).unwrap();
            }).unwrap().join().unwrap();
    }

    #[test]
    #[ignore = "explicit frontend gate for the 128-context scheduler"]
    fn signing_control_compiles() -> miette::Result<()> {
        rhdl::core::compile_design::<cached_sign_kernel>(rhdl::core::CompilationMode::Synchronous)?;
        rhdl::core::compile_design::<encoded_r_store_kernel>(
            rhdl::core::CompilationMode::Synchronous,
        )?;
        Ok(())
    }

    #[test]
    #[ignore = "large descriptor: use bounded explicit export after leaf tests"]
    fn compiles_to_native_rhdl_netlist() -> miette::Result<()> {
        unsafe { std::env::set_var("RHDL_SKIP_IVERILOG_CHECK", "1") };
        CachedSignCore::default()
            .descriptor(ScopedName::top())?
            .hdl()?;
        Ok(())
    }
}