rhdl_ed25519_scalable_core/

planner.rs

//! Ed25519 components for the chip planner (`rhdl_fpga_planner`).
//!
//! [`Ed25519Sign`] and [`Ed25519Verify`] wrap [`crate::frontier`]'s
//! sizing so the Ed25519 modules sit next to DSig and the SHA-512 line in
//! one TUI, each with its own power and knobs:
//!
//! | Knob | Values |
//! |---|---|
//! | Modules | specialized (routed fix9 blocks, preferred memory layouts) / as built (2023.2 synthesis of 15/11/3/1) |
//! | SHA-512 | shared line / own rings |
//! | Verify mode (verify only) | known-key / strict / batch |
//! | Block ratio | auto (best mix) / manual: keep the three weights below |
//! | FB (or verify) machine, SHA ring, scalar ring weight | 1–32 each; the ratio in manual mode |
//! | Batch compress | auto / on (a compress machine) / off (each machine inverts and encodes; model) |
//!
//! **Memory placement** (specialized table): every block starts in its
//! preferred layout (machine banks in UltraRAM). When the share's URAM runs
//! out, replicated machines move one at a time to their block-RAM layout
//! ([`MachineMemory::BRAM_BANKS`](crate::machine::MachineMemory::BRAM_BANKS)),
//! the one fallback the RTL builds; the plan detail says how many ("3 of 9
//! machines in block RAM") and the `uram_machines` flag builds exactly
//! that (`ED25519_URAM_MACHINES`). Nothing else moves: when block RAM runs
//! out too, the plan holds fewer machines.
//!
//! **Cores.** A module is 1 to [`MAX_CORES`] identical cores, each in an
//! equal part of the share, because one core's credit pool caps it.
//!
//! With the shared line a module has no SHA rings: it pays a client port
//! ([`crate::frontier::SHA_CLIENT_LUT`]) and demands `"sha512 blocks"`
//! (three per signature, two per verification), which the planner checks
//! against the line's supply.
//!
//! [`Sha512Estimate`] stands in for the SHA-512 line component of
//! `rhdl_sha512_pipelined` (DSig's) in builds without it: an allowance taken
//! out of the budget (the SHA part of the LUT split), up to 432k LUTs and 20
//! DSPs, whose throughput is modeled from its LUTs.

use rhdl_fpga_planner::{BuildFlags, Component, Context, Cost, Flow, Knob, Plan, Role, SHA512_BLOCKS, Share};

use crate::{
    config::{CP_BUNDLES, CP_CONTEXTS, CREDIT_OVERHEAD, FB_BUNDLES, SIGN_CONTEXTS},
    frontier::{self, Compress, Costs, Multiplier, Shape, VerifyMode},
};

/// Labels of the "batch compress" knob, in [`COMPRESS`] order.
const COMPRESS_LABELS: [&str; 3] = ["auto", "on (compress machine)", "off (each machine encodes; model)"];
/// The batch-compress choices.
const COMPRESS: [Compress; 3] = [Compress::Auto, Compress::On, Compress::Off];

/// The shape controls every Ed25519 module has: a ratio mode, three
/// weights and batch compression.
#[derive(Clone, Copy, Debug, PartialEq)]
pub struct ShapeKnobs {
    /// Keep the weights below (`false`: the planner chooses the mix).
    pub manual: bool,
    /// Field machines : SHA-512 rings : scalar rings.
    pub weights: [f64; 3],
    /// Batch compression.
    pub compress: Compress,
}

impl ShapeKnobs {
    /// Auto with weights `weights` ready for manual mode.
    const fn auto(weights: [f64; 3]) -> Self {
        ShapeKnobs { manual: false, weights, compress: Compress::Auto }
    }
    /// The knobs, after the module's own; `machine` names the field
    /// machines ("FB machines" or "verify machines").
    fn knobs(&self, machine: &str) -> Vec<Knob> {
        vec![
            Knob::choice("block ratio", usize::from(self.manual), &["auto (best mix)", "manual (weights below)"]),
            Knob::range(&format!("  {machine} weight"), self.weights[0], 1.0, 32.0, 1.0),
            Knob::range("  SHA ring weight", self.weights[1], 1.0, 32.0, 1.0),
            Knob::range("  scalar ring weight", self.weights[2], 1.0, 32.0, 1.0),
            Knob::choice("batch compress", COMPRESS.iter().position(|c| *c == self.compress).unwrap_or(0), &COMPRESS_LABELS),
        ]
    }
    /// Set shape knob `index` (0 ratio mode .. 4 compress).
    fn set(&mut self, index: usize, value: f64) {
        match index {
            0 => self.manual = value >= 1.0,
            1..=3 => self.weights[index - 1] = value.clamp(1.0, 32.0),
            _ => self.compress = COMPRESS[(value.max(0.0) as usize).min(2)],
        }
    }
    /// The search restriction.
    fn shape(&self) -> Shape {
        Shape { ratio: self.manual.then_some(self.weights), compress: self.compress }
    }
    /// Short text for a plan detail, empty in full auto.
    fn note(&self) -> String {
        let mut n = String::new();
        if self.manual {
            let [a, b, c] = self.weights;
            n.push_str(&format!(", ratio {a}:{b}:{c}"));
        }
        if self.compress != Compress::Auto {
            n.push_str(if self.compress == Compress::On { ", batch compress on" } else { ", batch compress off" });
        }
        n
    }
}

/// Most identical cores one module may be built from.
///
/// *Why:* one core has one controller and one credit pool: a signing core
/// stops at 8.82M signatures/s however many field machines it gets (2,048
/// compress credits, each held ~47.6k cycles: 23.25 cycles per signature). Beyond that, the only
/// way to turn more LUTs and DSPs into rate is a second core beside it.
pub const MAX_CORES: u32 = 4;

/// `share` divided evenly between `n` cores.
fn per_core(s: &Share, n: u32) -> frontier::Share {
    frontier::Share { lut: s.lut / n, dsp: s.dsp / n, bram36: s.bram36 / n, uram: s.uram / n }
}

/// The best of `n = 1..=MAX_CORES` identical cores, each planned by `plan`
/// in `1/n` of the share: `(n, the core's plan)`. Highest total rate wins;
/// within 1 operation/s the cheaper build in LUTs.
fn best_cores<P: Copy>(
    share: &Share,
    plan: impl Fn(frontier::Share) -> Option<frontier::ModulePlan<P>>,
) -> Option<(u32, frontier::ModulePlan<P>)> {
    let mut best: Option<(u32, frontier::ModulePlan<P>)> = None;
    for n in 1..=MAX_CORES {
        let Some(p) = plan(per_core(share, n)) else { continue };
        let (rate, lut) = (n as f64 * p.rate, n * p.cost.lut);
        let better = best.as_ref().is_none_or(|(m, b)| {
            let (r, l) = (*m as f64 * b.rate, m * b.cost.lut);
            rate > r + 1.0 || (rate > r - 1.0 && lut < l)
        });
        if better {
            best = Some((n, p));
        }
    }
    best
}

/// `c` times `n`.
fn times(c: frontier::Cost, n: u32) -> Cost {
    Cost { lut: c.lut * n, dsp: c.dsp * n, bram36: c.bram36 * n, uram: c.uram * n }
}

/// Measured single-request latency of the small signer in cycles.
pub const SMALL_SIGNER_LATENCY: f64 = 22_240.0;

/// Idle latency of one signature in cycles (model): the nonce block, a
/// scalar job, the fixed-base walk on a 32-context barrel (one bundle per
/// 32 cycles), the compress machine's flush wait and its batch program on a
/// 64-context barrel, the two challenge blocks and two scalar jobs. With
/// `own_sha` the module's SHA rings take ~81 cycles per block; on the shared
/// line each block takes [`LINE_BLOCK_CYCLES`] (dispatch, the line, the
/// return). Measured isolated (fix13, 8,0,2,1 on the line): 40,446 cycles
/// against 40,406 from this model. The
/// fused small core measured 22,240 cycles for one request (it has no
/// compress machine, so this batch-compress model is not directly
/// comparable).
pub fn sign_latency_cycles(own_sha: bool) -> f64 {
    // Three SHA-512 blocks (one nonce, two challenge) at ~81 cycles each on
    // an idle ring, or one shared-line round trip each.
    let sha = 3.0 * if own_sha { 81.0 } else { LINE_BLOCK_CYCLES };
    // Fixed-base program: one bundle issues every 32 cycles per context, so
    // one request's walk takes bundles x 32 cycles.
    let fb = FB_BUNDLES as f64 * 32.0;
    let compress = compress_cycles();
    // Three scalar jobs at 32 cycles each.
    sha + 3.0 * 32.0 + fb + compress
}

/// Idle latency of one verification in cycles (model): the two challenge
/// blocks, one scalar job, the verify program on a 32-context barrel, and
/// the compress machine as for signing. Measured isolated (fix13, 6,0,1,1
/// on the line): 52,350 cycles against 52,392 from this model.
pub fn verify_latency_cycles(mode: VerifyMode, own_sha: bool) -> f64 {
    // Two challenge blocks at ~81 cycles each on the module's own ring, or
    // one shared-line round trip each.
    let sha = 2.0 * if own_sha { 81.0 } else { LINE_BLOCK_CYCLES };
    // The mode's verify program at one bundle every 32 cycles.
    let machine = mode.bundles() * 32.0;
    // Same flush wait and batch program as for signing.
    let compress = compress_cycles();
    // One 32-cycle scalar job. The final 2 cycles are a fixed extra term
    // that the model text above does not account for.
    // The final + 2: reading the stored R and comparing it with the encoding.
    sha + 32.0 + machine + compress + 2.0
}

/// One SHA-512 block's round trip on the shared line for an idle core, in
/// cycles: the 82-cycle line plus dispatch and return. Fitted to the
/// isolated native runs of 2026-10-19 (signer 8,0,2,1: 224 per block over
/// the model without the line; verifier 6,0,1,1: 190).
pub const LINE_BLOCK_CYCLES: f64 = 210.0;

/// Cycles a point spends in the compress machine (model): up to 64 cycles
/// of flush wait for a partial batch, then the batch program at one bundle
/// every 64 cycles (64-context barrel).
fn compress_cycles() -> f64 {
    64.0 + CP_BUNDLES as f64 * CP_CONTEXTS as f64
}

/// Requests one core holds in flight at full load.
///
/// A request is admitted only when a field machine has a free context (32
/// per machine) and a compress credit is left (2,048). The barrel runs
/// each context at a fixed cadence whatever the load, so a machine-bound
/// core holds its `contexts` plus the requests that have left the machines
/// and not yet finished: `after_machine` cycles of work at one request per
/// `cycles_per_op`. Past the credit pool the pool is the limit.
///
/// Measured (native, fix12/fix13): verify 6,0,1,1 holds ~404 (median
/// saturated latency 54,533 cycles at 134.98 cycles/verification) and this
/// gives 393; verify 1,1,1,1 holds ~86 (63,026 at 735.25) and this gives
/// 69, since a slow core also waits to fill compress batches. Sign 8,0,2,1
/// (fix13, 2026-10-19) holds 1,026 (median saturated latency 45,431, p90
/// 55,844 at 46.46 cycles/signature, i.e. a mean hold of ~47.7k cycles);
/// with the fitted [`CREDIT_OVERHEAD`] as part of `after_machine` this
/// gives 1,012 at the measured rate and 952 at the model's 50.52.
fn loaded_in_flight(contexts: f64, cycles_per_op: f64, after_machine: f64) -> f64 {
    (contexts + after_machine / cycles_per_op).min(SIGN_CONTEXTS as f64)
}

/// The `a,b,c,d` profile from a plan detail that starts with `a/b/c/d`.
fn profile_token(detail: &str) -> String {
    detail.split_whitespace().next().unwrap_or("").replace('/', ",")
}

/// The `multiplier` build flag of a plan detail (`ED25519_MULTIPLIER` for
/// the export: the 225-DSP unit or the 150-DSP Karatsuba unit).
fn multiplier_flag(detail: &str) -> &'static str {
    if detail.contains("150-DSP") { "\"LEAN150\"" } else { "\"DSP225\"" }
}

/// The `buildable` flag, and `not_buildable` listing every reason a plan
/// cannot be exported as planned today (`measure/export_build.py` refuses
/// such a config).
fn buildable(gaps: &[&str]) -> BuildFlags {
    let mut flags = vec![("buildable".into(), gaps.is_empty().to_string())];
    if !gaps.is_empty() {
        flags.push(("not_buildable".into(), format!("\"{}\"", gaps.join("; "))));
    }
    flags
}

/// Plan-detail text for a placement `[uram, lut, bram]` of `n` machines.
fn memory_label(place: [u32; 3], n: u32) -> String {
    match place {
        [u, 0, 0] if u == n => "all machines in UltraRAM".into(),
        [u, l, b] => format!("{u} of {n} machines in UltraRAM, {l} with LUT-RAM banks, {b} with block-RAM banks"),
    }
}

/// One routed whole core: side, `a,b,c,d` profile, 150-DSP multiplier,
/// machines in UltraRAM and with LUT-RAM banks (the rest block RAM),
/// worst setup slack at 4.878 ns, the job and the RTL.
struct Routed {
    side: &'static str,
    profile: [u32; 4],
    lean: bool,
    uram: u32,
    lut: u32,
    wns: f64,
    job: &'static str,
    rtl: &'static str,
}

/// Whole cores routed out of context at 205 MHz (`measure/results.tsv`),
/// the newest RTL of each build since fix7. Older rows predate the timing
/// fixes and say nothing about today's RTL. Add a row when a route lands.
/// Only the 1,1,1,1 verifier is routed on fix14 (constant ROM); its LUTs
/// grew 2.7 % and its slack went from +0.094 to +0.072, so the fix13 rows
/// are a good guide but not a proof for fix14. The 24-machine verifier
/// meets only with Vivado's hard route directives, by 0.008 ns; the screen
/// says so.
const ROUTED: &[Routed] = &[
    Routed { side: "sign", profile: [4, 0, 1, 1], lean: false, uram: 4, lut: 0, wns: 0.024, job: "007zzl", rtl: "fix13" },
    Routed { side: "sign", profile: [8, 0, 2, 0], lean: false, uram: 8, lut: 0, wns: 0.397, job: "007zzn", rtl: "fix13" },
    Routed { side: "sign", profile: [8, 0, 2, 1], lean: false, uram: 6, lut: 0, wns: 0.218, job: "007zp", rtl: "fix9" },
    Routed { side: "sign", profile: [8, 0, 2, 1], lean: true, uram: 8, lut: 0, wns: 0.103, job: "007zzp", rtl: "fix13" },
    Routed { side: "sign", profile: [8, 0, 3, 1], lean: false, uram: 8, lut: 0, wns: 0.159, job: "007zzm", rtl: "fix13" },
    Routed { side: "sign", profile: [9, 0, 2, 1], lean: false, uram: 9, lut: 0, wns: 0.114, job: "007zl", rtl: "fix7" },
    Routed { side: "sign", profile: [12, 0, 3, 1], lean: false, uram: 5, lut: 2, wns: 0.050, job: "007zzd", rtl: "fix10" },
    Routed { side: "verify", profile: [1, 1, 1, 1], lean: false, uram: 1, lut: 0, wns: 0.072, job: "007zzr", rtl: "fix14" },
    Routed { side: "verify", profile: [6, 0, 1, 1], lean: false, uram: 6, lut: 0, wns: 0.019, job: "007zzh", rtl: "fix12" },
    Routed { side: "verify", profile: [12, 0, 1, 1], lean: false, uram: 12, lut: 0, wns: 0.031, job: "007zzo", rtl: "fix13" },
    Routed { side: "verify", profile: [24, 0, 2, 1], lean: false, uram: 2, lut: 19, wns: 0.008, job: "007zzq", rtl: "fix13, hard route" },
];

/// What routing says about this build's timing at 205 MHz: the routed
/// core with the same profile, multiplier and memory layout, else one
/// with the same profile in another layout, else that it is not routed.
/// Timing is not part of the plan's search; this only reports it.
fn routed_note(side: &str, profile: [u32; 4], lean: bool, place: [u32; 3]) -> String {
    let verdict = |r: &Routed| {
        if r.wns >= 0.0 {
            format!("meets 205 MHz (+{:.3} ns, {} {})", r.wns, r.job, r.rtl)
        } else {
            format!("misses 205 MHz by {:.3} ns ({} {})", -r.wns, r.job, r.rtl)
        }
    };
    let same = |r: &&Routed| r.side == side && r.profile == profile && r.lean == lean;
    if let Some(r) = ROUTED.iter().filter(same).find(|r| r.uram == place[0] && r.lut == place[1]) {
        format!("; routed: {}", verdict(r))
    } else if let Some(r) = ROUTED.iter().find(same) {
        format!("; routed in another layout ({} UltraRAM, {} LUT-RAM): {}", r.uram, r.lut, verdict(r))
    } else {
        "; timing: not routed".into()
    }
}

/// The `uram_machines` and `lut_machines` flags of a plan detail, parsed
/// back from [`memory_label`]'s text (all in UltraRAM when it says so).
fn placement_flags(detail: &str, machines: u32) -> (u32, u32) {
    let Some(t) = detail.split("memory ").nth(1) else { return (machines, 0) };
    if t.starts_with("all machines in UltraRAM") {
        return (machines, 0);
    }
    let num = |s: &str| s.trim().split(' ').next().and_then(|x| x.parse::<u32>().ok()).unwrap_or(0);
    (num(t), t.split("UltraRAM, ").nth(1).map_or(0, num))
}

/// Replicated machines in a plan detail (the profile's first number).
fn machines_of(detail: &str) -> u32 {
    profile_token(detail).split(',').next().and_then(|t| t.parse().ok()).unwrap_or(1)
}

/// Cores in a plan detail (`"... x 3 cores: ..."`; 1 when absent).
fn cores_of(detail: &str) -> u32 {
    detail.split(" x ").nth(1).and_then(|t| t.split_whitespace().next()).and_then(|n| n.parse().ok()).unwrap_or(1)
}

/// Block cost table for the "modules" knob: the routed fix9 blocks in
/// their preferred memory layouts ([`frontier::slimmed_costs`]) or the
/// older synthesized as-built blocks ([`frontier::vivado_costs`]). Both
/// are Vivado numbers; what neither table built is noted per plan.
fn costs(specialized: bool) -> Costs {
    if specialized { frontier::slimmed_costs() } else { frontier::vivado_costs() }
}

/// Labels of the "modules" knob; index 0 is specialized, index 1 as built.
const MODULES: [&str; 2] = ["specialized (routed)", "as built (Vivado)"];
/// Labels of the "SHA-512" knob; index 0 is the shared line, index 1 own rings.
const SHA: [&str; 2] = ["shared SHA-512 line", "own SHA rings"];

/// The Ed25519 signing module as a chip-planner component. Its plan is the
/// best [`frontier::plan_sign_with`] build for the share it is given.
#[derive(Clone, Debug)]
pub struct Ed25519Sign {
    /// Specialized memory layout instead of the as-built one.
    pub specialized: bool,
    /// Hash through the shared SHA-512 line.
    pub shared_sha: bool,
    /// Block ratio and batch compression.
    pub shape: ShapeKnobs,
}

/// Defaults to the specialized layout on the shared SHA-512 line, the
/// planner choosing the mix (manual weights start at 15:11:3, the routed
/// 15/11/3/1).
impl Default for Ed25519Sign {
    fn default() -> Self {
        Ed25519Sign { specialized: true, shared_sha: true, shape: ShapeKnobs::auto([15.0, 11.0, 3.0]) }
    }
}

/// Chip-planner interface of the signing module.
impl Component for Ed25519Sign {
    /// Display name in the TUI.
    fn name(&self) -> String {
        "Ed25519 sign".into()
    }
    /// Planner role, used to report delivered signatures.
    fn role(&self) -> Role {
        Role::Ed25519Sign
    }
    /// The two choice knobs; the selected index is 0 for the first label.
    fn knobs(&self) -> Vec<Knob> {
        let mut k = vec![
            Knob::choice("modules", usize::from(!self.specialized), &MODULES),
            Knob::choice("SHA-512", usize::from(!self.shared_sha), &SHA),
        ];
        k.extend(self.shape.knobs("FB machine"));
        k
    }
    /// Applies a knob change; `value` is the chosen label index, and index
    /// 0 is the specialized layout or the shared line. Indices 2.. are the
    /// shape knobs ([`ShapeKnobs`]).
    fn set_knob(&mut self, index: usize, value: f64) {
        match index {
            0 => self.specialized = value == 0.0,
            1 => self.shared_sha = value == 0.0,
            _ => self.shape.set(index - 2, value),
        }
    }
    /// Best signing build within `share` at the context's clock, or `None`
    /// when nothing fits. On the shared line the plan demands three SHA-512
    /// blocks per signature from the line.
    fn plan(&self, share: &Share, cx: &Context) -> Option<Plan> {
        let c = costs(self.specialized);
        let shape = self.shape.shape();
        let (n, p) = best_cores(share, |s| frontier::plan_sign_shaped(s, &c, cx.mhz, self.shared_sha, &shape))?;
        let f = p.profile;
        // The measured small signer, as opposed to a fused model build.
        let small = f.fused && p.cost == c.small_signer;
        let note = self.shape.note();
        let cores = if n > 1 { format!(" x {n} cores") } else { String::new() };
        // The fused small signer keeps its own SHA ring even when the
        // module is set to the shared line.
        let on_line = self.shared_sha && !small;
        let sha = if on_line { "shared SHA".to_string() } else { format!("{} SHA", f.sha) };
        let detail = if small {
            format!("1/1/1/0 profile{cores}: Ed25519SignCoreSmall (fused, own SHA ring)")
        } else {
            // The leading `fb/sha/sc/cp` token is what `build_flags` exports.
            let cp = if f.fused { "no compress machine (model)" } else { "1 compress" };
            let pc = frontier::with_mul_pub(&c, p.multiplier);
            let port = if self.shared_sha { frontier::SHA_CLIENT_LUT } else { 0 };
            let place = frontier::sign_placement(&f, &pc, &p.share, port);
            let routed = if self.specialized {
                routed_note("sign", [f.fb, f.sha, f.sc, u32::from(!f.fused)], p.multiplier == Multiplier::Lean150, place)
            } else {
                String::new()
            };
            format!(
                "{}/{}/{}/{} profile{cores}: {} FB, {sha}, {} scalar, {cp}, {}, memory {}{note}{routed}",
                f.fb,
                f.sha,
                f.sc,
                u32::from(!f.fused),
                f.fb,
                f.sc,
                p.multiplier.name(),
                memory_label(place, f.fb as u32)
            )
        };
        Some(Plan {
            cost: times(p.cost, n),
            rate: n as f64 * p.rate,
            unit: "sign",
            limit: p.limit.into(),
            detail,
            demands: if on_line { vec![Flow { service: SHA512_BLOCKS, per_second: 3.0 * p.rate }] } else { Vec::new() },
            supplies: Vec::new(),
            // Both tables are Vivado blocks (routed, or synthesized as
            // built); a fused core of more than one machine is a model.
            measured: small || !f.fused,
            // The small signer measured 22,240 cycles for one request.
            latency_cycles: if small { SMALL_SIGNER_LATENCY } else { sign_latency_cycles(!on_line) },
            // Requests in flight at full load: the fused cores hold 32 per
            // machine; otherwise the FB machines' contexts plus the
            // signatures past them (compress plus the fitted credit
            // overhead, which covers queueing, the two challenge blocks and
            // two scalar jobs), at most the 2,048 credits.
            in_flight: n as f64
                * if f.fused {
                    32.0 * f.fb as f64
                } else {
                    loaded_in_flight(32.0 * f.fb as f64, cx.mhz * 1e6 / p.rate, compress_cycles() + CREDIT_OVERHEAD)
                },
            batch: None,
            covers: Vec::new(),
        })
    }
    /// Compile-time settings that would build this plan: the
    /// `fb,sha,sc,cp` profile `build.rs` parses (`sha = 0` on the shared
    /// line; `1,1,1,0` selects the small signer) and the SHA mode.
    fn build_flags(&self, plan: &Plan) -> BuildFlags {
        let profile = profile_token(&plan.detail);
        let gaps: Vec<&str> = Vec::new();
        let mut flags = vec![
            ("ED25519_SCALABLE_PROFILE".into(), format!("\"{profile}\"")),
            ("cores".into(), cores_of(&plan.detail).to_string()),
            ("SH".into(), u8::from(self.shared_sha && profile != "1,1,1,0").to_string()),
            ("memory".into(), if self.specialized { "\"SPECIALIZED\"" } else { "\"AS_BUILT\"" }.into()),
            ("multiplier".into(), multiplier_flag(&plan.detail).into()),
            ("uram_machines".into(), placement_flags(&plan.detail, machines_of(&plan.detail)).0.to_string()),
            ("lut_machines".into(), placement_flags(&plan.detail, machines_of(&plan.detail)).1.to_string()),
        ];
        flags.extend(buildable(&gaps));
        flags
    }
}

/// The Ed25519 verification module as a chip-planner component. Its plan
/// is the best [`frontier::plan_verify_with`] build for the share and mode.
#[derive(Clone, Debug)]
pub struct Ed25519Verify {
    /// Specialized memory layout instead of the as-built one.
    pub specialized: bool,
    /// Hash through the shared SHA-512 line.
    pub shared_sha: bool,
    /// Verification mode; sets the verify program length
    /// ([`VerifyMode::bundles`]).
    pub mode: VerifyMode,
    /// Block ratio and batch compression.
    pub shape: ShapeKnobs,
}

/// Defaults to the specialized layout, the shared line and known-key mode,
/// the planner choosing the mix (manual weights start at 16:2:1).
impl Default for Ed25519Verify {
    fn default() -> Self {
        Ed25519Verify { specialized: true, shared_sha: true, mode: VerifyMode::KnownKey, shape: ShapeKnobs::auto([16.0, 2.0, 1.0]) }
    }
}

/// Verify modes in the order of the "mode" knob's labels.
const MODES: [VerifyMode; 3] = [VerifyMode::KnownKey, VerifyMode::Strict, VerifyMode::Batch];

/// Chip-planner interface of the verification module.
impl Component for Ed25519Verify {
    /// Display name in the TUI.
    fn name(&self) -> String {
        "Ed25519 verify".into()
    }
    /// Planner role, used to report delivered verifications.
    fn role(&self) -> Role {
        Role::Ed25519Verify
    }
    /// Module set, SHA-512 source and verify mode, as choice knobs.
    fn knobs(&self) -> Vec<Knob> {
        vec![
            Knob::choice("modules", usize::from(!self.specialized), &MODULES),
            Knob::choice("SHA-512", usize::from(!self.shared_sha), &SHA),
            Knob::choice(
                "mode",
                MODES.iter().position(|m| *m == self.mode).unwrap(),
                &["known-key", "strict (any key)", "batch (model, not strict)"],
            ),
        ]
        .into_iter()
        .chain(self.shape.knobs("verify machine"))
        .collect()
    }
    /// Applies a knob change; `value` is the chosen label index (the mode
    /// knob indexes `MODES`).
    fn set_knob(&mut self, index: usize, value: f64) {
        match index {
            0 => self.specialized = value == 0.0,
            1 => self.shared_sha = value == 0.0,
            2 => self.mode = MODES[value as usize],
            _ => self.shape.set(index - 3, value),
        }
    }
    /// Best verification build within `share`, or `None` when nothing fits.
    /// On the shared line the plan demands two SHA-512 blocks per
    /// verification.
    fn plan(&self, share: &Share, cx: &Context) -> Option<Plan> {
        let c = costs(self.specialized);
        let shape = self.shape.shape();
        let (n, p) = best_cores(share, |s| frontier::plan_verify_shaped(s, self.mode, &c, cx.mhz, self.shared_sha, &shape))?;
        let note = self.shape.note();
        let v = p.profile;
        let cores = if n > 1 { format!(" x {n} cores") } else { String::new() };
        let sha = if self.shared_sha { "shared SHA".to_string() } else { format!("{} SHA", v.sha) };
        let pc = frontier::with_mul_pub(&c, p.multiplier);
        let port = if self.shared_sha { frontier::SHA_CLIENT_LUT } else { 0 };
        let place = frontier::verify_placement(&v, self.mode, &pc, &p.share, port);
        let routed = if self.specialized && self.mode == VerifyMode::KnownKey {
            routed_note("verify", [v.machines, v.sha, v.sc, v.cp], p.multiplier == Multiplier::Lean150, place)
        } else {
            String::new()
        };
        Some(Plan {
            cost: times(p.cost, n),
            rate: n as f64 * p.rate,
            unit: "verify",
            limit: p.limit.into(),
            // The leading `machines/sha/sc/cp` token is what `build_flags` exports.
            detail: format!(
                "{}/{}/{}/{} profile{cores}: {} VM, {sha}, {} scalar, {} CP{}, {}, memory {}{note}{routed}",
                v.machines,
                v.sha,
                v.sc,
                v.cp,
                v.machines,
                v.sc,
                v.cp,
                if v.cp == 0 { " (machines encode; model)" } else { "" },
                p.multiplier.name(),
                memory_label(place, v.machines)
            ),
            demands: if self.shared_sha { vec![Flow { service: SHA512_BLOCKS, per_second: 2.0 * p.rate }] } else { Vec::new() },
            supplies: Vec::new(),
            // Only the routed table has a built verify machine, and only
            // the known-key one; a verifier without a compress machine is
            // a model. As built, verify blocks are derived from sign blocks.
            measured: self.specialized && self.mode == VerifyMode::KnownKey && v.cp != 0,
            latency_cycles: verify_latency_cycles(self.mode, !self.shared_sha),
            // The verify machines' contexts plus the verifications in the
            // compress stage and the final compare, at most 2,048 per core.
            in_flight: n as f64 * loaded_in_flight(32.0 * v.machines as f64, cx.mhz * 1e6 / p.rate, compress_cycles() + 2.0),
            batch: None,
            covers: Vec::new(),
        })
    }
    /// Compile-time settings that would build this plan.
    fn build_flags(&self, plan: &Plan) -> BuildFlags {
        let mut flags: BuildFlags = vec![
            // `machines,sha,sc,cp` for `KnownKeyVerifyCore<NV, NSHA, NSC, SH>`.
            ("verify_profile".into(), format!("\"{}\"", profile_token(&plan.detail))),
            ("cores".into(), cores_of(&plan.detail).to_string()),
            ("verify_mode".into(), format!("\"{}\"", self.mode.name())),
            ("SH".into(), u8::from(self.shared_sha).to_string()),
            ("memory".into(), if self.specialized { "\"SPECIALIZED\"" } else { "\"AS_BUILT\"" }.into()),
            ("multiplier".into(), multiplier_flag(&plan.detail).into()),
            ("uram_machines".into(), placement_flags(&plan.detail, machines_of(&plan.detail)).0.to_string()),
            ("lut_machines".into(), placement_flags(&plan.detail, machines_of(&plan.detail)).1.to_string()),
        ];
        let mut gaps = Vec::new();
        if !profile_token(&plan.detail).ends_with(",1") {
            gaps.push("KnownKeyVerifyCore has exactly one compress stage");
        }
        if self.mode != VerifyMode::KnownKey {
            gaps.push("only the known-key verifier is built");
        }
        flags.extend(buildable(&gaps));
        flags
    }
}

/// Stand-in for the SHA-512 line (`rhdl_sha512_pipelined`'s component
/// replaces it): auto-sized to demand by default (at least one 5.5k-LUT
/// folded core), or by hand 0–432k LUTs and 0–20 DSPs.
///
/// Model: `LUT / 87.2k` blocks per clock, the Yosys cost of the full
/// pipeline and (per block) of the folded cores, continuous in between.
#[derive(Clone, Debug)]
pub struct Sha512Estimate {
    /// LUT allowance, out of the chip budget (0..=432,000).
    pub lut: u32,
    /// DSP allowance, out of the chip budget (0..=20). At 20 the DSP
    /// adder variant of the model applies.
    pub dsp: u32,
    /// Sized by the planner to what the chip wants, so the line never
    /// limits it (the default); `lut` then shows the size it settled on.
    pub auto: bool,
}

/// The smallest line the estimate builds: one 2-stage folded core
/// (`rhdl_sha512_pipelined::folded`, ~5.5k LUT by Yosys).
pub const SHA_ESTIMATE_MIN_LUT: u32 = 5_500;

/// Largest LUT allowance of the estimate's knob, the same as the real line's
/// (ten pipelines' worth, 432k LUT, about 11.6 blocks per clock).
pub const SHA_ESTIMATE_MAX_LUT: u32 = 432_000;

/// The default: auto size; 65k LUTs and 20 DSPs (~0.75 block per clock)
/// when set by hand.
impl Default for Sha512Estimate {
    fn default() -> Self {
        Sha512Estimate { lut: 65_000, dsp: 20, auto: true }
    }
}

/// Throughput model of the SHA-512 line.
impl Sha512Estimate {
    /// Modeled blocks per clock of the allowance.
    pub fn blocks_per_clock(&self) -> f64 {
        self.blocks_per_clock_in(self.lut)
    }
    /// Modeled blocks per clock of `lut` LUTs: LUTs divided by the
    /// projected LUT cost of one block per clock.
    pub fn blocks_per_clock_in(&self, lut: u32) -> f64 {
        lut as f64 / self.lut_per_block()
    }
    /// LUTs per block per clock: 87,200, the Yosys count of the full
    /// SHA-512 pipeline (folded cores cost about the same per block). The
    /// earlier projection (37k with DSP adders) was not borne out. An
    /// estimate, not measured.
    fn lut_per_block(&self) -> f64 {
        87_200.0
    }
    /// How far the planner may grow the line past its allowance, out of
    /// LUTs no other module uses: 2 blocks per clock (an allowance above that
    /// is built as given).
    pub fn largest_lut(&self) -> u32 {
        (2.0 * self.lut_per_block()).ceil() as u32
    }
}

/// Chip-planner interface of the SHA-512 line stand-in.
impl Component for Sha512Estimate {
    /// Display name in the TUI.
    fn name(&self) -> String {
        "SHA-512 line (estimate)".into()
    }
    /// Planner role; the line supplies `"sha512 blocks"`.
    fn role(&self) -> Role {
        Role::Sha512
    }
    /// LUT allowance (0..=65,000 in steps of 1,000) and DSP allowance
    /// (0..=20).
    fn knobs(&self) -> Vec<Knob> {
        vec![
            Knob::range("LUT allowance", self.lut as f64, 0.0, f64::from(SHA_ESTIMATE_MAX_LUT), 1_000.0),
            Knob::range("DSP allowance", self.dsp as f64, 0.0, 20.0, 1.0),
            Knob::choice("size", usize::from(!self.auto), &["auto (never limits)", "manual (LUT allowance)"]),
        ]
    }
    /// Applies a knob change: index 0 sets the LUT allowance (and makes the
    /// size manual), 1 the DSP allowance, 2 auto or manual.
    fn set_knob(&mut self, index: usize, value: f64) {
        match index {
            0 => {
                self.lut = (value.max(0.0) as u32).min(SHA_ESTIMATE_MAX_LUT);
                self.auto = false;
            }
            1 => self.dsp = value as u32,
            _ => self.auto = value < 0.5,
        }
    }
    /// The line's supply of SHA-512 blocks per second at the context's
    /// clock, or `None` when the allowance is zero (no line) or does not fit
    /// `share`. In a share larger than the allowance (the planner lending
    /// it LUTs nobody else uses) the line grows, up to
    /// [`largest_lut`](Self::largest_lut).
    fn plan(&self, share: &Share, cx: &Context) -> Option<Plan> {
        // Auto: the share is the size the planner chose.
        let base = if self.auto { share.lut } else { self.lut };
        if base == 0 || share.lut < base || share.dsp < self.dsp {
            return None;
        }
        let lut = share.lut.min(self.largest_lut().max(base));
        let cost = Cost { lut, dsp: self.dsp, bram36: 0, uram: 0 };
        let per_clock = self.blocks_per_clock_in(lut);
        let rate = per_clock * cx.mhz * 1e6;
        Some(Plan {
            cost,
            rate,
            unit: "block",
            limit: "allowance".into(),
            detail: format!("{per_clock:.2} blocks/clock"),
            demands: Vec::new(),
            supplies: vec![Flow { service: SHA512_BLOCKS, per_second: rate }],
            measured: false,
            // Input register, 80 rounds, feed-forward add.
            latency_cycles: 82.0,
            // Little's law: blocks in the pipeline = latency x blocks/clock.
            in_flight: 82.0 * per_clock,
            batch: None,
            covers: Vec::new(),
        })
    }
    /// The allowance comes off the top of the budget (the SHA part of the
    /// LUT split) rather than from the power-weighted shares.
    fn fixed(&self) -> Option<Share> {
        Some(Share { lut: self.lut, dsp: self.dsp, ..Share::default() })
    }
    /// Auto: the LUTs that hash `per_second` blocks at the clock (at least
    /// the smallest core), or none when nothing is wanted.
    fn size_for(&self, per_second: f64, cx: &Context) -> Option<Share> {
        if !self.auto {
            return None;
        }
        let lut = if per_second <= 0.0 {
            0
        } else {
            ((per_second / (cx.mhz * 1e6) * self.lut_per_block()).ceil() as u32).max(SHA_ESTIMATE_MIN_LUT)
        };
        Some(Share { lut, dsp: if lut > 0 { self.dsp } else { 0 }, ..Share::default() })
    }
    /// Remember the auto size.
    fn resize(&mut self, allowance: Share) {
        if self.auto {
            self.lut = allowance.lut;
        }
    }
    /// Compile-time settings: the LUTs the line was planned with (its
    /// allowance plus anything it grew into) and its DSPs.
    fn build_flags(&self, plan: &Plan) -> BuildFlags {
        vec![("sha_lut".into(), plan.cost.lut.to_string()), ("sha_dsp".into(), self.dsp.to_string())]
    }
}

/// Chip-level checks of the three components through the shared planner.
#[cfg(test)]
mod tests {
    use super::*;
    use rhdl_fpga_planner::{Budget, Mode, Powers, Side, Slot, apply_powers, balance_mix};

    /// The default Ed25519 chip: sign, verify and the SHA-512 line, with
    /// both modules on the shared line or on their own rings.
    fn chip(shared: bool) -> Vec<Slot> {
        vec![
            Slot::new(Box::new(Ed25519Sign { shared_sha: shared, ..Default::default() }), 0.0),
            Slot::new(Box::new(Ed25519Verify { shared_sha: shared, ..Default::default() }), 0.0),
            Slot::new(Box::new(Sha512Estimate::default()), 0.0),
        ]
    }

    /// Balancing the default budget for one verification per signature
    /// gives both sides a positive rate with both SHA-512 options. Prints
    /// the result for inspection.
    #[test]
    fn ed25519_paper_balanced() {
        let b = Budget::default();
        let cx = Context::default();
        for shared in [false, true] {
            let mut slots = chip(shared);
            let powers = balance_mix(Mode::Ed25519, &b, &cx, &mut slots);
            let p = apply_powers(Mode::Ed25519, &b, &cx, &mut slots, powers);
            let d = &p.delivered;
            println!(
                "{}: {:.2}M sign + {:.2}M verify (powers {:.0}/{:.0}, limited by {} / {}), {} LUT {} DSP, latency {:.0}/{:.0} us",
                if shared { "shared SHA line" } else { "own rings" },
                d.sign.rate / 1e6,
                d.verify.rate / 1e6,
                powers.sign,
                powers.verify,
                d.sign.bottleneck,
                d.verify.bottleneck,
                p.total.lut,
                p.total.dsp,
                d.sign.latency_us,
                d.verify.latency_us
            );
            assert!(d.sign.rate > 0.0 && d.verify.rate > 0.0);
        }
    }

    /// The sides are independent: all power to signing gives no
    /// verification and more signing than an even split.
    #[test]
    fn sides_are_independent() {
        let b = Budget::default();
        let cx = Context::default();
        let mut slots = chip(true);
        let even = apply_powers(Mode::Ed25519, &b, &cx, &mut slots, Powers::default()).delivered;
        let sign_only = apply_powers(Mode::Ed25519, &b, &cx, &mut slots, Powers { sign: 100.0, verify: 0.0 }).delivered;
        assert_eq!(sign_only.verify.rate, 0.0);
        assert!(sign_only.sign.rate > even.sign.rate);
    }

    /// When UltraRAM runs short, machines move to their block-RAM layout
    /// (the only fallback the RTL builds), and the plan says how many: the
    /// rate stays well above what the UltraRAM alone would allow. When
    /// block RAM runs short too, the plan holds fewer machines instead.
    #[test]
    fn memory_moves_to_bram_and_says_how_many() {
        let cx = Context::default();
        let sign = Ed25519Sign::default();
        let full = Share { lut: 420_000, dsp: 4_500, bram36: 2_016, uram: 960 };
        let rate = |s: Share| sign.plan(&s, &cx).map(|p| (p.rate, p.cost, p.detail));
        let (r_full, c_full, d_full) = rate(full).unwrap();
        assert!(d_full.contains("all machines in UltraRAM"), "{d_full}");
        let little_uram = Share { uram: c_full.uram / 3, ..full };
        let (r_lu, c_lu, d_lu) = rate(little_uram).unwrap();
        println!("little URAM: {:.2}M {c_lu:?} {d_lu}", r_lu / 1e6);
        assert!(c_lu.uram <= little_uram.uram && d_lu.contains("machines in UltraRAM,") && r_lu > 0.5 * r_full, "{d_lu}");
        let flags = sign.build_flags(&sign.plan(&little_uram, &cx).unwrap());
        let kept: u32 = flags.iter().find(|(k, _)| k == "uram_machines").unwrap().1.parse().unwrap();
        assert!(kept < d_lu.split('/').next().unwrap().parse::<u32>().unwrap(), "{flags:?}");
        let little_ram = Share { uram: 40, bram36: 400, ..full };
        let (r_lr, c_lr, d_lr) = rate(little_ram).unwrap();
        println!("little RAM: {:.2}M {c_lr:?} {d_lr}", r_lr / 1e6);
        assert!(c_lr.uram <= 40 && c_lr.bram36 <= 400 && r_lr < r_lu, "{d_lr}");
    }

    /// A manual ratio is kept, and batch compression can be switched off.
    #[test]
    fn ratio_and_batch_compress_knobs() {
        let cx = Context::default();
        let share = Share { lut: 210_000, dsp: 2_250, bram36: 1_008, uram: 480 };
        let mut sign = Ed25519Sign { shared_sha: false, ..Ed25519Sign::default() };
        sign.set_knob(2, 1.0); // manual
        sign.set_knob(3, 4.0); // FB 4
        sign.set_knob(4, 2.0); // SHA 2
        sign.set_knob(5, 1.0); // scalar 1
        let p = sign.plan(&share, &cx).unwrap();
        let t: Vec<u32> = profile_token(&p.detail).split(',').map(|x| x.parse().unwrap()).collect();
        assert_eq!((t[1], t[2]), ((t[0] as f64 / 2.0).round().max(1.0) as u32, (t[0] as f64 / 4.0).round().max(1.0) as u32), "{}", p.detail);
        sign.set_knob(6, 2.0); // compress off
        let off = sign.plan(&share, &cx).unwrap();
        assert!(profile_token(&off.detail).ends_with(",0"), "{}", off.detail);
        // Known-key verification is built only with its one compress stage,
        // so switching batch compression off leaves nothing to plan. The
        // strict mode (a model) still plans a build without one.
        let mut verify = Ed25519Verify::default();
        verify.set_knob(7, 2.0);
        assert!(verify.plan(&share, &cx).is_none());
        verify.set_knob(2, 1.0); // strict
        let v = verify.plan(&share, &cx).unwrap();
        assert!(profile_token(&v.detail).ends_with(",0"), "{}", v.detail);
        verify.set_knob(2, 0.0); // known-key
        verify.set_knob(7, 1.0);
        assert!(profile_token(&verify.plan(&share, &cx).unwrap().detail).ends_with(",1"));
    }

    /// The SHA-512 line is part of the LUT split: shrinking its allowance
    /// gives its LUTs to the engines, and the rates never fall while the line
    /// suffices (65k, 40k, 10k: the line borrows back the few LUTs it lacks
    /// from what the engines leave). A manual allowance far below what the
    /// line needs (2k) either borrows its way back too, or, when the engines
    /// use every LUT, binds, and then the plan must say the line limits both
    /// sides. Which one happens moves with small cost changes (the 2026-10-20
    /// ring refit made 2k bind; the fix14 constant ROM, which leaves fewer
    /// engines and LUTs to spare, made it borrow again), so the test accepts
    /// either and checks that neither is silent. "auto" never binds.
    #[test]
    fn sha_line_size_trades_against_the_engines() {
        let b = Budget::default();
        let cx = Context::default();
        let mut last = (0.0_f64, 0.0_f64);
        for lut in [65_000.0, 40_000.0, 10_000.0, 2_000.0] {
            let mut slots = chip(true);
            slots[2].component.set_knob(0, lut);
            let p = apply_powers(Mode::Ed25519, &b, &cx, &mut slots, Powers::default());
            let d = &p.delivered;
            let line = p.parts[2].1.as_ref().map_or(0, |x| x.cost.lut);
            println!(
                "SHA allowance {lut} LUT (built {line}): {:.2}M sign / {:.2}M verify, limited by {} / {}",
                d.sign.rate / 1e6,
                d.verify.rate / 1e6,
                d.side(Side::Sign).bottleneck,
                d.side(Side::Verify).bottleneck
            );
            assert!(p.total.fits(&b.chip()));
            if d.sha_bound {
                // Too small, and said so: the line limits both sides.
                assert_eq!(lut, 2_000.0, "only the 2k line may bind (built {line})");
                assert!(d.side(Side::Sign).bottleneck.contains("SHA") && d.side(Side::Verify).bottleneck.contains("SHA"));
                continue;
            }
            // Powers are fixed here (not balanced), and freed LUTs change
            // what one side lends the other, so one side can dip while the
            // other gains: the total never falls more than 5 %, and the
            // lower side stays within 15 %. (Routed costs, 2026-10-17: at
            // 2k verify dips 10 % while sign gains 10 %.)
            let total = d.sign.rate + d.verify.rate;
            assert!(total >= 0.95 * (last.0 + last.1), "the total fell at {lut}");
            assert!(d.sign.rate.min(d.verify.rate) >= 0.85 * last.0.min(last.1), "the lower rate fell far at {lut}");
            last = (d.sign.rate, d.verify.rate);
        }
        // The default "auto" size sizes the line to what the engines want:
        // it never limits, and it delivers at least the manual sizes did.
        let mut slots = chip(true);
        let p = apply_powers(Mode::Ed25519, &b, &cx, &mut slots, Powers::default());
        let d = &p.delivered;
        println!("SHA auto: {:.2}M sign / {:.2}M verify", d.sign.rate / 1e6, d.verify.rate / 1e6);
        assert!(!d.sha_bound && p.total.fits(&b.chip()));
        assert!(d.sign.rate + d.verify.rate >= 0.95 * (last.0 + last.1), "auto delivers less than 10k manual");
    }
}

/// Ed25519 as uBFT's service ([`crate::ubft::UbftEd25519`], feature
/// `ubft`): the signer and the verifier of `UbftEd25519<1, NV>` as two
/// uBFT modules ([`Component::ubft`]), planned only in
/// `Mode::UbftEd25519`, beside the replica
/// ([`rhdl_fpga_planner::ubft::UbftReplica`]).
///
/// Each is a fixed build, not sized to its share: a slot needs one
/// signature and at most 2f = 6 verifications, so a larger build would
/// shorten nothing but the verify queue. The signer is the measured
/// small signer (1,1,1,0, own SHA ring). The verifier is the known-key
/// 1,1,1,1 core (routed on fix14, job 007zzr) with `NV` machines, plus
/// the key tables the 16 slots add ([`KEY_SLOTS_16_BRAM36`]). The
/// service's own logic (tag tables, two FIFOs, the AXI-Lite map) is not
/// synthesized yet: [`UBFT_WRAPPER_LUT`] is an estimate.
#[cfg(feature = "ubft")]
pub mod ubft {
    use rhdl_fpga_planner::{Component, Context, Cost, Knob, Plan, Role, Share, Slot, ubft::UbftReplica};

    use super::{SMALL_SIGNER_LATENCY, costs, per_core, times, verify_latency_cycles};
    use crate::frontier::{self, SMALL_SIGNER_CYCLES, VerifyMode, VerifyProfile};

    /// Estimated LUTs of the service around the cores (control, tag tables,
    /// the signature and verdict FIFOs, the AXI-Lite map), split evenly
    /// between the two modules. A model until the service is synthesized.
    pub const UBFT_WRAPPER_LUT: u32 = 6_000;
    /// Extra BRAM36 per verify machine for 16 key slots instead of 8 (the
    /// machine's key tables double; `key-slots-16`). A model.
    pub const KEY_SLOTS_16_BRAM36: u32 = 57;

    /// The signing half of the Ed25519 uBFT service.
    #[derive(Clone, Debug, Default)]
    pub struct Ed25519UbftSign;

    impl Component for Ed25519UbftSign {
        fn name(&self) -> String {
            "Ed25519 uBFT sign".into()
        }
        fn role(&self) -> Role {
            Role::Ed25519Sign
        }
        fn knobs(&self) -> Vec<Knob> {
            Vec::new()
        }
        fn set_knob(&mut self, _index: usize, _value: f64) {}
        /// The small signer plus half the service logic, if it fits.
        fn plan(&self, share: &Share, cx: &Context) -> Option<Plan> {
            let core = times(costs(true).small_signer, 1);
            let cost = Cost { lut: core.lut + UBFT_WRAPPER_LUT / 2, ..core };
            cost.fits(share).then(|| Plan {
                cost,
                rate: cx.mhz * 1e6 / SMALL_SIGNER_CYCLES,
                unit: "sign",
                limit: cost.limit(share).into(),
                detail: format!("1/1/1/0 small signer, own SHA ring; + {} LUT service logic (estimate)", UBFT_WRAPPER_LUT / 2),
                demands: Vec::new(),
                supplies: Vec::new(),
                // The core is measured; the service logic is not.
                measured: false,
                latency_cycles: SMALL_SIGNER_LATENCY,
                in_flight: 32.0,
                batch: None,
                covers: Vec::new(),
            })
        }
        fn ubft(&self) -> bool {
            true
        }
    }

    /// The verifying half of the Ed25519 uBFT service: `machines` known-key
    /// verify machines (1 to 4, default 1).
    #[derive(Clone, Debug)]
    pub struct Ed25519UbftVerify {
        /// Verify field machines (`NV`).
        pub machines: u32,
    }

    impl Default for Ed25519UbftVerify {
        fn default() -> Self {
            Ed25519UbftVerify { machines: 1 }
        }
    }

    impl Component for Ed25519UbftVerify {
        fn name(&self) -> String {
            "Ed25519 uBFT verify".into()
        }
        fn role(&self) -> Role {
            Role::Ed25519Verify
        }
        fn knobs(&self) -> Vec<Knob> {
            vec![Knob::range("verify machines (NV)", self.machines as f64, 1.0, 4.0, 1.0)]
        }
        fn set_knob(&mut self, _index: usize, value: f64) {
            self.machines = value as u32;
        }
        /// The `NV`,1,1,1 known-key verifier with 16 key slots plus half
        /// the service logic, if it fits.
        fn plan(&self, share: &Share, cx: &Context) -> Option<Plan> {
            let c = costs(true);
            let v = VerifyProfile { machines: self.machines, sha: 1, sc: 1, cp: 1 };
            let core = times(frontier::verify_cost_within(&v, VerifyMode::KnownKey, &c, &per_core(share, 1), 0), 1);
            let cost = Cost {
                lut: core.lut + UBFT_WRAPPER_LUT / 2,
                bram36: core.bram36 + self.machines * KEY_SLOTS_16_BRAM36,
                ..core
            };
            // The service has only 16 IDs, fewer than a single machine's 32
            // contexts. Fixed-priority dispatch therefore keeps using machine
            // zero. Extra NV currently adds cost, not usable service rate.
            let latency = verify_latency_cycles(VerifyMode::KnownKey, true);
            let one = VerifyProfile { machines: 1, sha: 1, sc: 1, cp: 1 };
            let rate_bound = (cx.mhz * 1e6 / one.cycles(VerifyMode::KnownKey)).min(cx.mhz * 1e6 * 16.0 / latency);
            cost.fits(share).then(|| Plan {
                cost,
                rate: rate_bound,
                unit: "verify",
                limit: format!("{}; 16 IDs, fixed-priority dispatch", cost.limit(share)),
                detail: format!(
                    "{}/1/1/1 known-key, own SHA ring, 16 key slots (+{} BRAM, model); + {} LUT service logic (estimate)",
                    self.machines,
                    self.machines * KEY_SLOTS_16_BRAM36,
                    UBFT_WRAPPER_LUT / 2
                ),
                demands: Vec::new(),
                supplies: Vec::new(),
                measured: false,
                latency_cycles: latency,
                in_flight: 16.0,
                batch: None,
                covers: Vec::new(),
            })
        }
        fn build_flags(&self, _plan: &Plan) -> rhdl_fpga_planner::BuildFlags {
            vec![("RHDL_UBFT_VERIFY_MACHINES".into(), self.machines.to_string())]
        }
        fn ubft(&self) -> bool {
            true
        }
    }

    /// The uBFT chip's slots: the replica, then the service's two halves.
    pub fn slots() -> Vec<Slot> {
        vec![
            Slot::new(Box::new(UbftReplica::default()), 0.0),
            Slot::new(Box::new(Ed25519UbftSign), 0.0),
            Slot::new(Box::new(Ed25519UbftVerify::default()), 0.0),
        ]
    }
}

/// The Ed25519 uBFT chip plans the replica and both halves of the service
/// on the whole device; a slot's crypto time is the measured signer, the
/// verifier model and serial peer verification. Overlap is a separate scenario.
#[cfg(all(test, feature = "ubft"))]
mod ubft_tests {
    use rhdl_fpga_planner::{Budget, Context, Mode, Powers, apply_powers, ubft as u};

    #[test]
    fn ubft_chip_plans_serial_crypto_without_claiming_a_baseline_ratio() {
        let mut slots = super::ubft::slots();
        let cx = Context::default();
        let plan = apply_powers(Mode::UbftEd25519, &Budget::whole_device(), &cx, &mut slots, Powers::default());
        assert!(plan.parts.iter().all(|p| p.1.is_some()), "{:?}", plan.parts);
        let d = &plan.delivered;
        for n in u::UBFT_REPLICAS {
            let t = u::serial_slot_crypto_us(d, n);
            assert_eq!(t, d.sign.latency_us + f64::from(u::quorum_verifies(n)) * d.verify.latency_us);
            assert!(t.is_finite() && t > 0.0);
        }
        // One signature (22,240 cycles measured) plus one verification's
        // latency plus one more verification at the verify rate.
        let expect = (super::SMALL_SIGNER_LATENCY + super::verify_latency_cycles(crate::frontier::VerifyMode::KnownKey, true)) / 205.0
            + 1e6 / d.verify.rate;
        assert!((u::slot_crypto_us(d, 4) - expect).abs() < 1e-6);
        println!("total {:?}", plan.total);
    }
    #[test]
    fn ubft_extra_verifiers_add_cost_without_inventing_service_capacity() {
        use rhdl_fpga_planner::{Component, Cost};
        let share = Cost { lut: 2_000_000, dsp: 20_000, bram36: 20_000, uram: 20_000 };
        let cx = Context::default();
        let one = super::ubft::Ed25519UbftVerify { machines: 1 }.plan(&share, &cx).unwrap();
        let four = super::ubft::Ed25519UbftVerify { machines: 4 }.plan(&share, &cx).unwrap();
        assert_eq!(one.rate, four.rate);
        assert_eq!((one.in_flight, four.in_flight), (16.0, 16.0));
        assert!(four.cost.lut > one.cost.lut);
        let flags = super::ubft::Ed25519UbftVerify { machines: 4 }.build_flags(&four);
        assert!(flags.contains(&("RHDL_UBFT_VERIFY_MACHINES".into(), "4".into())));
    }

}