// Copyright lowRISC contributors.
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
// SPDX-License-Identifier: Apache-2.0
//
// Power Manager
//

`include "prim_assert.sv"

module pwrmgr
  import pwrmgr_pkg::*;
  import pwrmgr_reg_pkg::*;
#(
  parameter logic [NumAlerts-1:0] AlertAsyncOn = {NumAlerts{1'b1}}
) (
  // Clocks and resets
  input clk_slow_i,
  input clk_i,
  input rst_slow_ni,
  input rst_ni,
  input rst_main_ni,
  input clk_esc_i,
  input rst_esc_ni,

  // Bus Interface
  input  tlul_pkg::tl_h2d_t tl_i,
  output tlul_pkg::tl_d2h_t tl_o,

  // Alerts
  input  prim_alert_pkg::alert_rx_t [NumAlerts-1:0] alert_rx_i,
  output prim_alert_pkg::alert_tx_t [NumAlerts-1:0] alert_tx_o,

  // AST interface
  input  pwr_ast_rsp_t pwr_ast_i,
  output pwr_ast_req_t pwr_ast_o,

  // rstmgr interface
  input  pwr_rst_rsp_t pwr_rst_i,
  output pwr_rst_req_t pwr_rst_o,

  // clkmgr interface
  output pwr_clk_req_t pwr_clk_o,
  input  pwr_clk_rsp_t pwr_clk_i,

  // otp interface
  input  pwr_otp_rsp_t pwr_otp_i,
  output pwr_otp_req_t pwr_otp_o,

  // life cycle interface
  input  pwr_lc_rsp_t pwr_lc_i,
  output pwr_lc_req_t pwr_lc_o,

  // flash interface
  input  pwr_flash_t pwr_flash_i,

  // processor interface
  input  pwr_cpu_t pwr_cpu_i,
  // SEC_CM: LC_CTRL.INTERSIG.MUBI
  output lc_ctrl_pkg::lc_tx_t fetch_en_o,
  input lc_ctrl_pkg::lc_tx_t lc_hw_debug_en_i,
  input lc_ctrl_pkg::lc_tx_t lc_dft_en_i,

  // peripherals wakeup and reset requests
  input  [NumWkups-1:0] wakeups_i,
  input  [NumRstReqs-1:0] rstreqs_i,

  // pinmux and other peripherals
  output logic strap_o,
  output logic low_power_o,

  // rom_ctrl interface
  // SEC_CM: ROM_CTRL.INTERSIG.MUBI
  input rom_ctrl_pkg::pwrmgr_data_t rom_ctrl_i,

  // software issued reset request
  // SEC_CM: RSTMGR.INTERSIG.MUBI
  input prim_mubi_pkg::mubi4_t sw_rst_req_i,

  // escalation interface
  input prim_esc_pkg::esc_tx_t esc_rst_tx_i,
  output prim_esc_pkg::esc_rx_t esc_rst_rx_o,

  output intr_wakeup_o

);

  ////////////////////////////
  ///  escalation detections
  ////////////////////////////

  logic clk_esc;
  logic rst_esc_n;
  prim_clock_buf #(
    .NoFpgaBuf(1'b1)
  ) u_esc_clk_buf (
    .clk_i(clk_esc_i),
    .clk_o(clk_esc)
  );

  prim_clock_buf #(
    .NoFpgaBuf(1'b1)
  ) u_esc_rst_buf (
    .clk_i(rst_esc_ni),
    .clk_o(rst_esc_n)
  );

  logic esc_rst_req;

  prim_esc_receiver #(
    .N_ESC_SEV   (alert_handler_reg_pkg::N_ESC_SEV),
    .PING_CNT_DW (alert_handler_reg_pkg::PING_CNT_DW)
  ) u_esc_rx (
    .clk_i(clk_esc),
    .rst_ni(rst_esc_n),
    .esc_req_o(esc_rst_req),
    .esc_rx_o(esc_rst_rx_o),
    .esc_tx_i(esc_rst_tx_i)
  );

  localparam int EscTimeOutCnt = 128;
  logic esc_timeout;
  // SEC_CM: ESC_RX.CLK.BKGN_CHK, ESC_RX.CLK.LOCAL_ESC
  prim_clock_timeout #(
    .TimeOutCnt(EscTimeOutCnt)
  ) u_esc_timeout (
    .clk_chk_i(clk_esc),
    .rst_chk_ni(rst_esc_n),
    .clk_i,
    .rst_ni,
    // if any ip clock enable is turned on, then the escalation
    // clocks are also enabled.
    .en_i(|pwr_clk_o),
    .timeout_o(esc_timeout)
  );


  ////////////////////////////
  ///  async declarations
  ////////////////////////////
  pwr_peri_t peri_reqs_raw;
  logic slow_rst_req;

  assign peri_reqs_raw.wakeups = wakeups_i;
  assign peri_reqs_raw.rstreqs[NumRstReqs-1:0] = rstreqs_i;
  assign peri_reqs_raw.rstreqs[ResetMainPwrIdx] = slow_rst_req;
  // SEC_CM: ESC_RX.CLK.LOCAL_ESC, CTRL_FLOW.GLOBAL_ESC
  assign peri_reqs_raw.rstreqs[ResetEscIdx] = esc_rst_req | esc_timeout;

  ////////////////////////////
  ///  Software reset request
  ////////////////////////////
  logic sw_rst_req;
  prim_buf #(
    .Width(1)
  ) u_sw_req_buf (
    .in_i(prim_mubi_pkg::mubi4_test_true_strict(sw_rst_req_i)),
    .out_o(sw_rst_req)
  );

  assign peri_reqs_raw.rstreqs[ResetSwReqIdx] = sw_rst_req;

  ////////////////////////////
  ///  clk_i domain declarations
  ////////////////////////////

  pwrmgr_reg2hw_t reg2hw;
  pwrmgr_hw2reg_t hw2reg;
  pwr_peri_t peri_reqs_masked;

  logic req_pwrup;
  logic ack_pwrup;
  logic req_pwrdn;
  logic ack_pwrdn;
  logic fsm_invalid;
  logic clr_slow_req;
  logic clr_slow_ack;
  logic usb_ip_clk_en;
  logic usb_ip_clk_status;
  pwrup_cause_e pwrup_cause;

  logic low_power_fall_through;
  logic low_power_abort;

  pwr_flash_t flash_rsp;
  pwr_otp_rsp_t otp_rsp;

  prim_mubi_pkg::mubi4_t rom_ctrl_done;
  prim_mubi_pkg::mubi4_t rom_ctrl_good;


  ////////////////////////////
  ///  clk_slow_i domain declarations
  ////////////////////////////

  // Captured signals
  // These signals, though on clk_i domain, are safe for clk_slow_i to use
  logic [NumWkups-1:0] slow_wakeup_en;
  logic [NumRstReqs-1:0] slow_reset_en;

  pwr_ast_rsp_t slow_ast;
  pwr_peri_t slow_peri_reqs, slow_peri_reqs_masked;

  pwrup_cause_e slow_pwrup_cause;
  logic slow_pwrup_cause_toggle;
  logic slow_req_pwrup;
  logic slow_ack_pwrup;
  logic slow_req_pwrdn;
  logic slow_ack_pwrdn;
  logic slow_fsm_invalid;
  logic slow_main_pd_n;
  logic slow_io_clk_en;
  logic slow_core_clk_en;
  logic slow_usb_clk_en_lp;
  logic slow_usb_clk_en_active;
  logic slow_clr_req;
  logic slow_usb_ip_clk_en;
  logic slow_usb_ip_clk_status;


  ////////////////////////////
  ///  Register module
  ////////////////////////////
  logic [NumAlerts-1:0] alert_test, alerts;
  logic low_power_hint;
  logic lowpwr_cfg_wen;
  logic clr_hint;
  logic wkup;
  logic clr_cfg_lock;
  logic reg_intg_err;

  // SEC_CM: BUS.INTEGRITY
  // SEC_CM: CTRL.CONFIG.REGWEN, WAKEUP.CONFIG.REGWEN, RESET.CONFIG.REGWEN
  pwrmgr_reg_top u_reg (
    .clk_i,
    .rst_ni,
    .tl_i,
    .tl_o,
    .reg2hw,
    .hw2reg,
    .intg_err_o (reg_intg_err),
    .devmode_i  (1'b1)
  );

  // whenever low power entry begins, wipe the hint
  assign hw2reg.control.low_power_hint.d = 1'b0;
  assign hw2reg.control.low_power_hint.de = clr_hint;

  always_ff @(posedge clk_i or negedge rst_ni) begin
    if (!rst_ni) begin
      lowpwr_cfg_wen <= 1'b1;
    end else if (!lowpwr_cfg_wen && (clr_cfg_lock || wkup)) begin
      lowpwr_cfg_wen <= 1'b1;
    end else if (low_power_hint) begin
      lowpwr_cfg_wen <= 1'b0;
    end
  end

  assign hw2reg.ctrl_cfg_regwen.d = lowpwr_cfg_wen;

  assign hw2reg.fault_status.reg_intg_err.de    = reg_intg_err;
  assign hw2reg.fault_status.reg_intg_err.d     = 1'b1;
  assign hw2reg.fault_status.esc_timeout.de     = esc_timeout;
  assign hw2reg.fault_status.esc_timeout.d      = 1'b1;
  assign hw2reg.fault_status.main_pd_glitch.de  = peri_reqs_masked.rstreqs[ResetMainPwrIdx];
  assign hw2reg.fault_status.main_pd_glitch.d   = 1'b1;


  ////////////////////////////
  ///  alerts
  ////////////////////////////

  // the logic below assumes there is only one alert, so make an
  // explicit assertion check for it.
  `ASSERT_INIT(AlertNumCheck_A, NumAlerts == 1)

  assign alert_test = {
    reg2hw.alert_test.q &
    reg2hw.alert_test.qe
  };

  assign alerts[0] = reg2hw.fault_status.reg_intg_err.q |
                     reg2hw.fault_status.esc_timeout.q |
                     reg2hw.fault_status.main_pd_glitch.q;

  for (genvar i = 0; i < NumAlerts; i++) begin : gen_alert_tx
    prim_alert_sender #(
      .AsyncOn(AlertAsyncOn[i]),
      .IsFatal(1'b1)
    ) u_prim_alert_sender (
      .clk_i,
      .rst_ni,
      .alert_test_i  ( alert_test[i] ),
      .alert_req_i   ( alerts[i]     ),
      .alert_ack_o   (               ),
      .alert_state_o (               ),
      .alert_rx_i    ( alert_rx_i[i] ),
      .alert_tx_o    ( alert_tx_o[i] )
    );
  end

  ////////////////////////////
  ///  cdc handling
  ////////////////////////////

  pwrmgr_cdc u_cdc (
    .clk_i,
    .rst_ni,
    .clk_slow_i,
    .rst_slow_ni,

    // slow domain signals
    .slow_req_pwrup_i(slow_req_pwrup),
    .slow_ack_pwrdn_i(slow_ack_pwrdn),
    .slow_fsm_invalid_i(slow_fsm_invalid),
    .slow_pwrup_cause_toggle_i(slow_pwrup_cause_toggle),
    .slow_pwrup_cause_i(slow_pwrup_cause),
    .slow_wakeup_en_o(slow_wakeup_en),
    .slow_reset_en_o(slow_reset_en),
    .slow_main_pd_no(slow_main_pd_n),
    .slow_io_clk_en_o(slow_io_clk_en),
    .slow_core_clk_en_o(slow_core_clk_en),
    .slow_usb_clk_en_lp_o(slow_usb_clk_en_lp),
    .slow_usb_clk_en_active_o(slow_usb_clk_en_active),
    .slow_req_pwrdn_o(slow_req_pwrdn),
    .slow_ack_pwrup_o(slow_ack_pwrup),
    .slow_ast_o(slow_ast),
    .slow_peri_reqs_o(slow_peri_reqs),
    .slow_peri_reqs_masked_i(slow_peri_reqs_masked),
    .slow_clr_req_o(slow_clr_req),
    .slow_usb_ip_clk_en_i(slow_usb_ip_clk_en),
    .slow_usb_ip_clk_status_o(slow_usb_ip_clk_status),

    // fast domain signals
    .req_pwrdn_i(req_pwrdn),
    .ack_pwrup_i(ack_pwrup),
    .cfg_cdc_sync_i(reg2hw.cfg_cdc_sync.qe & reg2hw.cfg_cdc_sync.q),
    .cdc_sync_done_o(hw2reg.cfg_cdc_sync.de),
    .wakeup_en_i(reg2hw.wakeup_en),
    .reset_en_i(reg2hw.reset_en),
    .main_pd_ni(reg2hw.control.main_pd_n.q),
    .io_clk_en_i(reg2hw.control.io_clk_en.q),
    .core_clk_en_i(reg2hw.control.core_clk_en.q),
    .usb_clk_en_lp_i(reg2hw.control.usb_clk_en_lp.q),
    .usb_clk_en_active_i(reg2hw.control.usb_clk_en_active.q),
    .ack_pwrdn_o(ack_pwrdn),
    .fsm_invalid_o(fsm_invalid),
    .req_pwrup_o(req_pwrup),
    .pwrup_cause_o(pwrup_cause),
    .peri_reqs_o(peri_reqs_masked),
    .clr_slow_req_i(clr_slow_req),
    .clr_slow_ack_o(clr_slow_ack),
    .usb_ip_clk_en_o(usb_ip_clk_en),
    .usb_ip_clk_status_i(usb_ip_clk_status),

    // AST signals
    .ast_i(pwr_ast_i),

    // peripheral signals
    .peri_i(peri_reqs_raw),

    // flash handshake
    .flash_i(pwr_flash_i),
    .flash_o(flash_rsp),

    // OTP signals
    .otp_i(pwr_otp_i),
    .otp_o(otp_rsp),

    // rom_ctrl signals
    .rom_ctrl_done_i(rom_ctrl_i.done),
    .rom_ctrl_done_o(rom_ctrl_done)

  );
  // rom_ctrl_i.good is not synchronized as it acts as a "payload" signal
  // to "done". Good is only observed if "done" is high.
  assign rom_ctrl_good = rom_ctrl_i.good;
  assign hw2reg.cfg_cdc_sync.d = 1'b0;

  ////////////////////////////
  ///  Wakup and reset capture
  ////////////////////////////

  // reset and wakeup requests are captured into the slow clock domain and then
  // fanned out to other domains as necessary.  This ensures there is not a huge
  // time gap between when the slow clk domain sees the signal vs when the fast
  // clock domains see it.  This creates redundant syncing but keeps the time
  // scale approximately the same across all domains.
  //
  // This also implies that these signals must be at least 1 clk_slow pulse long
  //
  // Since resets are not latched inside pwrmgr, there exists a corner case where
  // non-always-on reset requests may get wiped out by a graceful low power entry
  // It's not clear if this is really an issue at the moment, but something to keep
  // in mind if future changes are needed.
  //
  // Latching the reset requests is not difficult, but the bigger question is who
  // should clear it and when that should happen. If the clearing does not work
  // correctly, it is possible for the device to end up in a permanent reset loop,
  // and that would be very undesirable.

  assign slow_peri_reqs_masked.wakeups = slow_peri_reqs.wakeups & slow_wakeup_en;
  // msb is software request
  // the internal requests include escalation and internal requests
  // the lsbs are the software enabled peripheral requests.
  assign slow_peri_reqs_masked.rstreqs = slow_peri_reqs.rstreqs &
                                         {{NumSwRstReq{1'b1}},
                                          {IntReqLastIdx{1'b1}},
                                          slow_reset_en};

  for (genvar i = 0; i < NumWkups; i++) begin : gen_wakeup_status
    assign hw2reg.wake_status[i].de = 1'b1;
    assign hw2reg.wake_status[i].d  = peri_reqs_masked.wakeups[i];
  end

  for (genvar i = 0; i < NumRstReqs; i++) begin : gen_reset_status
    assign hw2reg.reset_status[i].de = 1'b1;
    assign hw2reg.reset_status[i].d  = peri_reqs_masked.rstreqs[i];
  end

  assign hw2reg.escalate_reset_status.de = 1'b1;
  assign hw2reg.escalate_reset_status.d = peri_reqs_masked.rstreqs[NumRstReqs];


  ////////////////////////////
  ///  clk_slow FSM
  ////////////////////////////

  pwrmgr_slow_fsm u_slow_fsm (
    .clk_i                (clk_slow_i),
    .rst_ni               (rst_slow_ni),
    .rst_main_ni          (rst_main_ni),
    .wakeup_i             (|slow_peri_reqs_masked.wakeups),
    .reset_req_i          (|slow_peri_reqs_masked.rstreqs),
    .ast_i                (slow_ast),
    .req_pwrup_o          (slow_req_pwrup),
    .pwrup_cause_o        (slow_pwrup_cause),
    .pwrup_cause_toggle_o (slow_pwrup_cause_toggle),
    .ack_pwrup_i          (slow_ack_pwrup),
    .req_pwrdn_i          (slow_req_pwrdn),
    .ack_pwrdn_o          (slow_ack_pwrdn),
    .rst_req_o            (slow_rst_req),
    .fsm_invalid_o        (slow_fsm_invalid),
    .clr_req_i            (slow_clr_req),
    .usb_ip_clk_en_o      (slow_usb_ip_clk_en),
    .usb_ip_clk_status_i  (slow_usb_ip_clk_status),

    .main_pd_ni           (slow_main_pd_n),
    .io_clk_en_i          (slow_io_clk_en),
    .core_clk_en_i        (slow_core_clk_en),
    .usb_clk_en_lp_i      (slow_usb_clk_en_lp),
    .usb_clk_en_active_i  (slow_usb_clk_en_active),

    // outputs to AST - These are on the slow clock domain
    // TBD - need to check this with partners
    .ast_o                (pwr_ast_o)
  );


  ////////////////////////////
  ///  clk FSM
  ////////////////////////////

  assign low_power_hint = reg2hw.control.low_power_hint.q == LowPower;

  pwrmgr_fsm u_fsm (
    .clk_i,
    .rst_ni,
    .clk_slow_i,
    .rst_slow_ni,

    // interface with slow_fsm
    .req_pwrup_i         (req_pwrup),
    .pwrup_cause_i       (pwrup_cause), // por, wake or reset request
    .ack_pwrup_o         (ack_pwrup),
    .req_pwrdn_o         (req_pwrdn),
    .ack_pwrdn_i         (ack_pwrdn),
    .low_power_entry_i   (pwr_cpu_i.core_sleeping & low_power_hint),
    .reset_reqs_i        (peri_reqs_masked.rstreqs),
    .fsm_invalid_i       (fsm_invalid),
    .clr_slow_req_o      (clr_slow_req),
    .clr_slow_ack_i      (clr_slow_ack),
    .usb_ip_clk_en_i     (usb_ip_clk_en),
    .usb_ip_clk_status_o (usb_ip_clk_status),

    // cfg
    .main_pd_ni        (reg2hw.control.main_pd_n.q),

    // consumed in pwrmgr
    .wkup_o            (wkup),
    .clr_cfg_lock_o    (clr_cfg_lock),
    .fall_through_o    (low_power_fall_through),
    .abort_o           (low_power_abort),
    .clr_hint_o        (clr_hint),

    // rstmgr
    .pwr_rst_o         (pwr_rst_o),
    .pwr_rst_i         (pwr_rst_i),

    // clkmgr
    .ips_clk_en_o      (pwr_clk_o),
    .clk_en_status_i   (pwr_clk_i),

    // otp
    .otp_init_o        (pwr_otp_o.otp_init),
    .otp_done_i        (otp_rsp.otp_done),
    .otp_idle_i        (otp_rsp.otp_idle),

    // lc
    .lc_init_o         (pwr_lc_o.lc_init),
    .lc_done_i         (pwr_lc_i.lc_done),
    .lc_idle_i         (pwr_lc_i.lc_idle),
    .lc_dft_en_i,
    .lc_hw_debug_en_i,

    // flash
    .flash_idle_i      (flash_rsp.flash_idle),

    // rom_ctrl
    .rom_ctrl_done_i   (rom_ctrl_done),
    .rom_ctrl_good_i   (rom_ctrl_good),

    // processing element
    .fetch_en_o,

    // pinmux and other peripherals
    .strap_o,
    .low_power_o
  );

  ////////////////////////////
  ///  Wakeup Info Capture
  ////////////////////////////

  logic wake_info_wen;
  logic [TotalWakeWidth-1:0] wake_info_data;

  assign wake_info_wen = reg2hw.wake_info.abort.qe |
                         reg2hw.wake_info.fall_through.qe |
                         reg2hw.wake_info.reasons.qe;

  assign wake_info_data = {reg2hw.wake_info.abort.q,
                           reg2hw.wake_info.fall_through.q,
                           reg2hw.wake_info.reasons.q};

  pwrmgr_wake_info i_wake_info (
    .clk_i,
    .rst_ni,
    .wr_i            (wake_info_wen),
    .data_i          (wake_info_data),
    .start_capture_i (low_power_o),
    .record_dis_i    (reg2hw.wake_info_capture_dis.q),
    .wakeups_i       (peri_reqs_masked.wakeups),
    .fall_through_i  (low_power_fall_through),
    .abort_i         (low_power_abort),
    .info_o          (hw2reg.wake_info)
  );

  ////////////////////////////
  ///  Interrupts
  ////////////////////////////

  // This interrupt is asserted whenever the fast FSM transitions
  // into active state.  However, it does not assert during POR
  prim_intr_hw #(.Width(1)) intr_wakeup (
    .clk_i,
    .rst_ni,
    .event_intr_i           (wkup),
    .reg2hw_intr_enable_q_i (reg2hw.intr_enable.q),
    .reg2hw_intr_test_q_i   (reg2hw.intr_test.q),
    .reg2hw_intr_test_qe_i  (reg2hw.intr_test.qe),
    .reg2hw_intr_state_q_i  (reg2hw.intr_state.q),
    .hw2reg_intr_state_de_o (hw2reg.intr_state.de),
    .hw2reg_intr_state_d_o  (hw2reg.intr_state.d),
    .intr_o                 (intr_wakeup_o)
  );


  ////////////////////////////
  ///  Assertions
  ////////////////////////////

  `ASSERT_KNOWN(TlDValidKnownO_A,  tl_o.d_valid     )
  `ASSERT_KNOWN(TlAReadyKnownO_A,  tl_o.a_ready     )
  `ASSERT_KNOWN(AlertsKnownO_A,    alert_tx_o       )
  `ASSERT_KNOWN(AstKnownO_A,       pwr_ast_o        )
  `ASSERT_KNOWN(RstKnownO_A,       pwr_rst_o        )
  `ASSERT_KNOWN(ClkKnownO_A,       pwr_clk_o        )
  `ASSERT_KNOWN(OtpKnownO_A,       pwr_otp_o        )
  `ASSERT_KNOWN(LcKnownO_A,        pwr_lc_o         )
  `ASSERT_KNOWN(IntrKnownO_A,      intr_wakeup_o    )

  // EscTimeOutCnt also sets the required clock ratios between escalator and local clock
  // Ie, clk_esc cannot be so slow that the timeout count is reached
  `ifdef INC_ASSERT
  logic [31:0] cnt;
  always_ff @(posedge clk_i or negedge clk_esc_i or negedge rst_ni) begin
    if (!rst_ni || !clk_esc_i) begin
      cnt <= '0;
    end else begin
      cnt <= cnt + 1'b1;
    end
  end

  `ASSERT(ClkRatio_A, cnt < EscTimeOutCnt)

  `endif

  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(FsmCheck_A, u_fsm.u_state_regs, alert_tx_o[0])
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(SlowFsmCheck_A, u_slow_fsm.u_state_regs, alert_tx_o[0])

endmodule // pwrmgr