// Copyright lowRISC contributors.
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
// SPDX-License-Identifier: Apache-2.0
//
// KMAC/SHA3

`include "prim_assert.sv"

module kmac
  import kmac_pkg::*;
  import kmac_reg_pkg::*;
#(
  // EnMasking: Enable masking security hardening inside keccak_round
  // If it is enabled, the result digest will be two set of 1600bit.
  parameter bit EnMasking = 1,

  // In case EnMasking == 0, this defines whether SW can provide a masked key or whether Share 1 of
  // the SW key is simply ignored. In case EnMasking == 1, this parameter has no meaning, always
  // both shares of the key provided by SW are used.
  // This is useful to allow both for area-optimized unmasked designs as well as unmasked designs
  // having a SW interface fully compatible with the masked design.
  parameter bit SwKeyMasked = 0,

  // Command delay, useful for SCA measurements only. A value of e.g. 40 allows the processor to go
  // into sleep before KMAC starts operation. If a value > 0 is chosen, the processor can provide
  // two commands subsquently and then go to sleep. The second command is buffered internally and
  // will be presented to the hardware SecCmdDelay number of cycles after the first one.
  parameter int SecCmdDelay = 0,

  // Accept SW message when idle and before receiving a START command. Useful for SCA only.
  parameter bit SecIdleAcceptSwMsg = 1'b0,

  parameter lfsr_perm_t RndCnstLfsrPerm = RndCnstLfsrPermDefault,
  parameter lfsr_seed_t RndCnstLfsrSeed = RndCnstLfsrSeedDefault,
  parameter lfsr_fwd_perm_t RndCnstLfsrFwdPerm = RndCnstLfsrFwdPermDefault,
  parameter msg_perm_t  RndCnstMsgPerm  = RndCnstMsgPermDefault,

  parameter logic [NumAlerts-1:0] AlertAsyncOn = {NumAlerts{1'b1}}
) (
  input clk_i,
  input rst_ni,

  input rst_shadowed_ni,

  input clk_edn_i,
  input rst_edn_ni,

  input  tlul_pkg::tl_h2d_t tl_i,
  output tlul_pkg::tl_d2h_t tl_o,

  // Alerts
  input  prim_alert_pkg::alert_rx_t [NumAlerts-1:0] alert_rx_i,
  output prim_alert_pkg::alert_tx_t [NumAlerts-1:0] alert_tx_o,

  // KeyMgr sideload (secret key) interface
  input keymgr_pkg::hw_key_req_t keymgr_key_i,

  // KeyMgr KDF data path
  input  app_req_t [NumAppIntf-1:0] app_i,
  output app_rsp_t [NumAppIntf-1:0] app_o,

  // EDN interface
  output edn_pkg::edn_req_t entropy_o,
  input  edn_pkg::edn_rsp_t entropy_i,

  // Life cycle
  input  lc_ctrl_pkg::lc_tx_t lc_escalate_en_i,

  // interrupts
  output logic intr_kmac_done_o,
  output logic intr_fifo_empty_o,
  output logic intr_kmac_err_o,

  // parameter consistency check with keymgr
  output logic en_masking_o,

  // Idle signal
  output prim_mubi_pkg::mubi4_t idle_o
);

  ////////////////
  // Parameters //
  ////////////////
  localparam int Share = (EnMasking) ? 2 : 1 ;
  localparam int SwKeyShare = (EnMasking || SwKeyMasked) ? 2 : 1;

  /////////////////
  // Definitions //
  /////////////////
  // This state machine is to track the current process based on SW input and
  // KMAC operation.
  // Encoding generated with:
  // $ ./util/design/sparse-fsm-encode.py -d 3 -m 6 -n 6 \
  //      -s 1966361510 --language=sv
  //
  // Hamming distance histogram:
  //
  //  0: --
  //  1: --
  //  2: --
  //  3: |||||||||||||||||||| (53.33%)
  //  4: ||||||||||||||| (40.00%)
  //  5: || (6.67%)
  //  6: --
  //
  // Minimum Hamming distance: 3
  // Maximum Hamming distance: 5
  // Minimum Hamming weight: 2
  // Maximum Hamming weight: 5
  //
  localparam int StateWidth = 6;
  typedef enum logic [StateWidth-1:0] {
    // Idle state
    KmacIdle = 6'b001011,

    // When software writes CmdStart @ KmacIdle and kmac_en, FSM moves to this
    KmacPrefix = 6'b000110,

    // When SHA3 engine processes Key block, FSM moves to here.
    KmacKeyBlock = 6'b111110,

    // Message Feed
    KmacMsgFeed = 6'b010101,

    // Complete and squeeze
    KmacDigest = 6'b101101,

    // Error
    KmacTerminalError = 6'b110000

  } kmac_st_e;

  kmac_st_e kmac_st, kmac_st_d;

  /////////////
  // Signals //
  /////////////
  kmac_reg2hw_t reg2hw;
  kmac_hw2reg_t hw2reg;

  // devmode ties to 1 as KMAC should be operated at the beginning for ROM_CTRL.
  logic devmode;
  assign devmode = 1'b 1;

  // Window
  typedef enum int {
    WinState   = 0,
    WinMsgFifo = 1
  } tl_window_e;

  tlul_pkg::tl_h2d_t tl_win_h2d[2];
  tlul_pkg::tl_d2h_t tl_win_d2h[2];

  // SHA3 core control signals and its response.
  // Sequence: start --> process(multiple) --> get absorbed event --> {run -->} done
  logic sha3_start, sha3_run, unused_sha3_squeeze;
  prim_mubi_pkg::mubi4_t sha3_done;
  prim_mubi_pkg::mubi4_t sha3_done_d;
  prim_mubi_pkg::mubi4_t sha3_absorbed;

  // Indicate one block processed
  logic sha3_block_processed;

  // EStatus for entropy
  logic entropy_in_keyblock;

  // Application interface logic generates absorbed from sha3_absorbed.
  // It is active only if SW initiates the hashing engine.
  prim_mubi_pkg::mubi4_t app_absorbed;
  logic event_absorbed;

  sha3_pkg::sha3_st_e sha3_fsm;

  // Prefix: kmac_pkg defines Prefix based on N size and S size.
  // Then computes left_encode(len(N)) size and left_encode(len(S))
  // For given default value 32, 256 bits, the max
  // encode_string(N) || encode_string(S) is 328. So 11 Prefix registers are
  // created.
  logic [sha3_pkg::NSRegisterSize*8-1:0] reg_ns_prefix;
  logic [sha3_pkg::NSRegisterSize*8-1:0] ns_prefix;

  // NumWordsPrefix from kmac_reg_pkg
  `ASSERT_INIT(PrefixRegSameToPrefixPkg_A,
               kmac_reg_pkg::NumWordsPrefix*4 == sha3_pkg::NSRegisterSize)

  // NumEntriesMsgFifo from kmac_reg_pkg must match calculated MsgFifoDepth
  // from kmac_pkg.
  `ASSERT_INIT(NumEntriesRegSameToNumEntriesPkg_A,
               kmac_reg_pkg::NumEntriesMsgFifo == kmac_pkg::MsgFifoDepth)

  // NumBytesMsgFifoEntry from kmac_reg_pkg must match the MsgWidth calculated
  // in kmac_pkg (although MsgWidth is in bits, so we multiply by 8).
  `ASSERT_INIT(EntrySizeRegSameToEntrySizePkg_A,
               kmac_reg_pkg::NumBytesMsgFifoEntry * 8 == kmac_pkg::MsgWidth)

  // Output state: this is used to redirect the digest to KeyMgr or Software
  // depends on the configuration.
  logic state_valid;
  logic [sha3_pkg::StateW-1:0] state [Share];

  // state is de-muxed in keymgr interface logic.
  // the output from keymgr logic goes into staterd module to be visible to SW
  logic reg_state_valid;
  logic [sha3_pkg::StateW-1:0] reg_state [Share];

  // SHA3 Entropy interface
  logic sha3_rand_valid, sha3_rand_early, sha3_rand_consumed;
  logic [sha3_pkg::StateW/2-1:0] sha3_rand_data;
  logic sha3_rand_aux;

  // FIFO related signals
  logic msgfifo_empty, msgfifo_full;
  logic [kmac_pkg::MsgFifoDepthW-1:0] msgfifo_depth;

  logic                          msgfifo_valid       ;
  logic [kmac_pkg::MsgWidth-1:0] msgfifo_data [Share];
  logic [kmac_pkg::MsgStrbW-1:0] msgfifo_strb        ;
  logic                          msgfifo_ready       ;

  if (EnMasking) begin : gen_msgfifo_data_masked
    // In Masked mode, the input message data is split into two shares.
    // Only concern, however, here is the secret key. So message can be
    // put into only one share and other is 0.
    assign msgfifo_data[1] = '0;
  end

  // TL-UL Adapter(MSG_FIFO) signals
  logic        tlram_req;
  logic        tlram_gnt;
  logic        tlram_we;
  logic [8:0]  tlram_addr;   // NOT_READ
  logic [31:0] tlram_wdata;
  logic [31:0] tlram_wmask;
  logic [31:0] tlram_rdata;
  logic        tlram_rvalid;
  logic [1:0]  tlram_rerror;
  logic [31:0] tlram_wdata_endian;
  logic [31:0] tlram_wmask_endian;

  logic                          sw_msg_valid;
  logic [kmac_pkg::MsgWidth-1:0] sw_msg_data ;
  logic [kmac_pkg::MsgWidth-1:0] sw_msg_mask ;
  logic                          sw_msg_ready;

  // KeyMgr interface to MSG_FIFO
  logic                          mux2fifo_valid;
  logic [kmac_pkg::MsgWidth-1:0] mux2fifo_data ;
  logic [kmac_pkg::MsgWidth-1:0] mux2fifo_mask ;
  logic                          mux2fifo_ready;

  // KMAC to SHA3 core
  logic                          msg_valid       ;
  logic [kmac_pkg::MsgWidth-1:0] msg_data [Share];
  logic [kmac_pkg::MsgWidth-1:0] msg_data_masked [Share];
  logic [kmac_pkg::MsgStrbW-1:0] msg_strb        ;
  logic                          msg_ready       ;

  // Process control signals
  // Process pulse propagates from register to SHA3 engine one by one.
  // Each module (MSG_FIFO, KMAC core, SHA3 core) generates the process pulse
  // after flushing internal data to the next module.
  logic reg2msgfifo_process, msgfifo2kmac_process, kmac2sha3_process;


  // Secret Key signals
  logic [MaxKeyLen-1:0] sw_key_data_reg [SwKeyShare];
  logic [MaxKeyLen-1:0] sw_key_data [Share];
  key_len_e             sw_key_len;
  logic [MaxKeyLen-1:0] key_data [Share];
  key_len_e             key_len;

  // SHA3 Mode, Strength, KMAC enable for app interface
  logic                       reg_kmac_en,         app_kmac_en;
  sha3_pkg::sha3_mode_e       reg_sha3_mode,       app_sha3_mode;
  sha3_pkg::keccak_strength_e reg_keccak_strength, app_keccak_strength;

  // RegIF of enabling unsupported mode & strength
  logic cfg_en_unsupported_modestrength;

  // Indicating AppIntf is active. This signal is used to check SW error
  logic app_active;

  // Command
  // sw_cmd is the command written by SW
  // checked_sw_cmd is checked in the kmac_errchk module.
  //   Invalid command is filtered out in the module.
  // kmac_cmd is generated in KeyMgr interface.
  // If SW initiates the KMAC/SHA3, kmac_cmd represents SW command,
  // if KeyMgr drives the data, kmac_cmd is controled in the state machine
  // in KeyMgr interface logic.
  kmac_cmd_e sw_cmd, checked_sw_cmd, kmac_cmd, cmd_q;
  logic      cmd_update;

  // Entropy configurations
  logic [9:0]  wait_timer_prescaler;
  logic [15:0] wait_timer_limit;
  logic        entropy_refresh_req;
  logic [NumSeedsEntropyLfsr-1:0]       entropy_seed_update;
  logic [NumSeedsEntropyLfsr-1:0][31:0] entropy_seed_data;

  logic [HashCntW-1:0] entropy_hash_threshold;
  logic [HashCntW-1:0] entropy_hash_cnt;
  logic                entropy_hash_clr;

  logic entropy_ready;
  entropy_mode_e entropy_mode;
  logic entropy_fast_process;

  prim_mubi_pkg::mubi4_t entropy_configured;

  // Message Masking
  logic msg_mask_en, cfg_msg_mask;
  logic [MsgWidth-1:0] msg_mask;

  // SHA3 Error response
  sha3_pkg::err_t sha3_err;

  // KeyMgr Error response
  kmac_pkg::err_t app_err;

  // Entropy Generator Error
  kmac_pkg::err_t entropy_err;

  // Error checker
  kmac_pkg::err_t errchecker_err;

  // MsgFIFO Error
  kmac_pkg::err_t msgfifo_err;

  logic err_processed;

  logic alert_fatal, alert_recov_operation;
  logic alert_intg_err;

  // Life cycle
  localparam int unsigned NumLcSyncCopies = 6;
  lc_ctrl_pkg::lc_tx_t [NumLcSyncCopies-1:0] lc_escalate_en_sync;
  lc_ctrl_pkg::lc_tx_t [NumLcSyncCopies-1:0] lc_escalate_en;

  //////////////////////////////////////
  // Connecting Register IF to logics //
  //////////////////////////////////////

  // Function-name N and Customization input string S
  always_comb begin
    for (int i = 0 ; i < NumWordsPrefix; i++) begin
      reg_ns_prefix[32*i+:32] = reg2hw.prefix[i].q;
    end
  end

  // Create a lint error to reduce the risk of accidentally enabling this feature.
  `ASSERT_STATIC_LINT_ERROR(KmacSecCmdDelayNonDefault, SecCmdDelay == 0)

  if (SecCmdDelay > 0) begin : gen_cmd_delay_buf
    // Delay and buffer commands for SCA measurements.
    localparam int unsigned WidthCounter = $clog2(SecCmdDelay+1);
    logic [WidthCounter-1:0] count_d, count_q;
    logic                    counting_d, counting_q;
    logic                    cmd_buf_empty;
    kmac_cmd_e               cmd_buf_q;

    assign cmd_buf_empty = (cmd_buf_q == CmdNone);

    // When seeing a write to the cmd register, we start counting. We stop counting once the
    // counter has expired and the command buffer is empty.
    assign counting_d = reg2hw.cmd.cmd.qe          ? 1'b1 :
                        cmd_update & cmd_buf_empty ? 1'b0 : counting_q;

    // Clear counter upon writes to the cmd register or if the specified delay is reached.
    assign count_d = reg2hw.cmd.cmd.qe ? '0             :
                     cmd_update        ? '0             :
                     counting_q        ? count_q + 1'b1 : count_q;

    // The manual run command cannot be delayed. Software expects this to be triggered immediately
    // and will poll the status register to wait for the SHA3 engine to return back to the squeeze
    // state.
    assign cmd_update = (cmd_q == CmdManualRun)                    ? 1'b1 :
                        (count_q == SecCmdDelay[WidthCounter-1:0]) ? 1'b1 : 1'b0;

    always_ff @(posedge clk_i or negedge rst_ni) begin
      if (!rst_ni) begin
        count_q    <= '0;
        counting_q <= 1'b0;
      end else begin
        count_q    <= count_d;
        counting_q <= counting_d;
      end
    end

    // cmd.q is valid while cmd.qe is high, meaning it needs to be registered. We buffer one
    // additional command such that software can write START followed by PROCESS and then go to
    // sleep.
    always_ff @(posedge clk_i or negedge rst_ni) begin
      if (!rst_ni) begin
        cmd_q     <= CmdNone;
        cmd_buf_q <= CmdNone;
      end else begin
        if (reg2hw.cmd.cmd.qe && cmd_update) begin
          // New write & counter expired.
          cmd_q     <= cmd_buf_q;
          cmd_buf_q <= kmac_cmd_e'(reg2hw.cmd.cmd.q);

        end else if (reg2hw.cmd.cmd.qe) begin
          // New write.
          if (counting_q == 1'b0) begin
            cmd_q     <= kmac_cmd_e'(reg2hw.cmd.cmd.q);
          end else begin
            cmd_buf_q <= kmac_cmd_e'(reg2hw.cmd.cmd.q);
          end

        end else if (cmd_update) begin
          // Counter expired.
          cmd_q     <= cmd_buf_q;
          cmd_buf_q <= CmdNone;
        end
      end
    end

  end else begin : gen_no_cmd_delay_buf
    // Directly forward signals from register IF.
    assign cmd_update = reg2hw.cmd.cmd.qe;
    assign cmd_q      = kmac_cmd_e'(reg2hw.cmd.cmd.q);
  end

  // Command signals
  assign sw_cmd = (cmd_update) ? cmd_q : CmdNone;
  `ASSERT_KNOWN(KmacCmd_A, sw_cmd)
  always_comb begin
    sha3_start = 1'b 0;
    sha3_run = 1'b 0;
    sha3_done_d = prim_mubi_pkg::MuBi4False;
    reg2msgfifo_process = 1'b 0;

    unique case (kmac_cmd)
      CmdStart: begin
        sha3_start = 1'b 1;
      end

      CmdProcess: begin
        reg2msgfifo_process = 1'b 1;
      end

      CmdManualRun: begin
        sha3_run = 1'b 1;
      end

      CmdDone: begin
        sha3_done_d = prim_mubi_pkg::MuBi4True;
      end

      CmdNone: begin
        // inactive state
      end

      default: begin
      end
    endcase
  end

  // Status register ==========================================================
  // status.squeeze is valid only when SHA3 engine completes the Absorb and not
  // running the manual keccak rounds. This status is for SW to determine when
  // to read the STATE values.
  assign hw2reg.status.sha3_idle.d     = sha3_fsm == sha3_pkg::StIdle;
  assign hw2reg.status.sha3_absorb.d   = sha3_fsm == sha3_pkg::StAbsorb;
  assign hw2reg.status.sha3_squeeze.d  = sha3_fsm == sha3_pkg::StSqueeze;

  // FIFO related status
  assign hw2reg.status.fifo_depth.d[MsgFifoDepthW-1:0] = msgfifo_depth;
  if ($bits(hw2reg.status.fifo_depth.d) != MsgFifoDepthW) begin : gen_fifo_depth_tie
    assign hw2reg.status.fifo_depth.d[$bits(hw2reg.status.fifo_depth.d)-1:MsgFifoDepthW] = '0;
  end
  assign hw2reg.status.fifo_empty.d  = msgfifo_empty;
  assign hw2reg.status.fifo_full.d   = msgfifo_full;

  // Configuration Register
  logic engine_stable;
  assign engine_stable = sha3_fsm == sha3_pkg::StIdle;

  // SEC_CM: CFG_SHADOWED.CONFIG.REGWEN
  assign hw2reg.cfg_regwen.d = engine_stable;

  // Secret Key
  // Secret key is defined as external register. So the logic latches when SW
  // writes to KEY_SHARE0 , KEY_SHARE1 registers.
  // SEC_CM: SW_KEY.KEY.MASKING
  always_ff @(posedge clk_i or negedge rst_ni) begin
    if (!rst_ni) begin
      sw_key_data_reg[0] <= '0;
    end else if (engine_stable) begin
      for (int j = 0 ; j < MaxKeyLen/32 ; j++) begin
        if (reg2hw.key_share0[j].qe) begin
          sw_key_data_reg[0][32*j+:32] <= reg2hw.key_share0[j].q;
        end
      end // for j
    end // else if engine_stable
  end // always_ff

  if (EnMasking || SwKeyMasked) begin : gen_key_share1_reg
    always_ff @(posedge clk_i or negedge rst_ni) begin
      if (!rst_ni) begin
        sw_key_data_reg[1] <= '0;
      end else if (engine_stable) begin
        for (int j = 0 ; j < MaxKeyLen/32 ; j++) begin
          if (reg2hw.key_share1[j].qe) begin
            sw_key_data_reg[1][32*j+:32] <= reg2hw.key_share1[j].q;
          end
        end // for j
      end // else if engine_stable
    end // always_ff
  end else begin : gen_no_key_share1_reg
    logic unused_key_share1;
    assign unused_key_share1 = ^reg2hw.key_share1;
  end

  if (EnMasking || !SwKeyMasked) begin : gen_key_forward
    // Forward all available key shares as is.
    assign sw_key_data = sw_key_data_reg;
  end else begin : gen_key_unmask
    // Masking is disabled but the SW still provides the key in two shares.
    // Unmask the key for processing.
    assign sw_key_data[0] = sw_key_data_reg[0] ^ sw_key_data_reg[1];
  end

  assign sw_key_len = key_len_e'(reg2hw.key_len.q);

  // Entropy configurations
  assign wait_timer_prescaler = reg2hw.entropy_period.prescaler.q;
  assign wait_timer_limit     = reg2hw.entropy_period.wait_timer.q;
  assign entropy_refresh_req = reg2hw.cmd.entropy_req.q
                            && reg2hw.cmd.entropy_req.qe;
  for (genvar i = 0; i < NumSeedsEntropyLfsr; i++) begin : gen_entropy_seed
    assign entropy_seed_update[i] = reg2hw.entropy_seed[i].qe;
    assign entropy_seed_data[i] = reg2hw.entropy_seed[i].q;
  end

  assign entropy_hash_threshold = reg2hw.entropy_refresh_threshold_shadowed.q;
  assign hw2reg.entropy_refresh_hash_cnt.de = 1'b 1;
  assign hw2reg.entropy_refresh_hash_cnt.d  = entropy_hash_cnt;

  assign entropy_hash_clr = reg2hw.cmd.hash_cnt_clr.qe
                         && reg2hw.cmd.hash_cnt_clr.q;

  // Entropy config
  assign entropy_ready = reg2hw.cfg_shadowed.entropy_ready.q
                       & reg2hw.cfg_shadowed.entropy_ready.qe;
  assign entropy_mode  = entropy_mode_e'(reg2hw.cfg_shadowed.entropy_mode.q);
  assign entropy_fast_process = reg2hw.cfg_shadowed.entropy_fast_process.q;

  // msg_mask_en turns on the message LFSR when KMAC is enabled.
  assign cfg_msg_mask = reg2hw.cfg_shadowed.msg_mask.q;
  assign msg_mask_en = cfg_msg_mask & msg_valid & msg_ready;

  // Enable unsupported mode & strength combination
  assign cfg_en_unsupported_modestrength =
    reg2hw.cfg_shadowed.en_unsupported_modestrength.q;

  `ASSERT(EntropyReadyLatched_A, $rose(entropy_ready) |=> !entropy_ready)

  // Idle control (registered output)
  // The logic checks idle of SHA3 engine, MSG_FIFO, KMAC_CORE, KEYMGR interface
  always_ff @(posedge clk_i or negedge rst_ni) begin
    if (!rst_ni) begin
      idle_o <= prim_mubi_pkg::MuBi4True;
    end else if ((sha3_fsm == sha3_pkg::StIdle) && (msgfifo_empty || SecIdleAcceptSwMsg)) begin
      idle_o <= prim_mubi_pkg::MuBi4True;
    end else begin
      idle_o <= prim_mubi_pkg::MuBi4False;
    end
  end

  // Clear the error processed
  assign err_processed = reg2hw.cfg_shadowed.err_processed.q
                       & reg2hw.cfg_shadowed.err_processed.qe;

  // Make sure the field has latch in reg_top
  `ASSERT(ErrProcessedLatched_A, $rose(err_processed) |=> !err_processed)

  // App mode, strength, kmac_en
  assign reg_kmac_en         = reg2hw.cfg_shadowed.kmac_en.q;
  assign reg_sha3_mode       = sha3_pkg::sha3_mode_e'(reg2hw.cfg_shadowed.mode.q);
  assign reg_keccak_strength = sha3_pkg::keccak_strength_e'(reg2hw.cfg_shadowed.kstrength.q);

  ///////////////
  // Interrupt //
  ///////////////

  logic event_msgfifo_empty, msgfifo_empty_q;

  // Hash process absorbed interrupt
  // Convert mubi4_t to logic to generate interrupts
  assign event_absorbed = prim_mubi_pkg::mubi4_test_true_strict(app_absorbed);

  prim_intr_hw #(.Width(1)) intr_kmac_done (
    .clk_i,
    .rst_ni,
    .event_intr_i           (event_absorbed),
    .reg2hw_intr_enable_q_i (reg2hw.intr_enable.kmac_done.q),
    .reg2hw_intr_test_q_i   (reg2hw.intr_test.kmac_done.q),
    .reg2hw_intr_test_qe_i  (reg2hw.intr_test.kmac_done.qe),
    .reg2hw_intr_state_q_i  (reg2hw.intr_state.kmac_done.q),
    .hw2reg_intr_state_de_o (hw2reg.intr_state.kmac_done.de),
    .hw2reg_intr_state_d_o  (hw2reg.intr_state.kmac_done.d),
    .intr_o                 (intr_kmac_done_o)
  );

  `ASSERT(Sha3AbsorbedPulse_A,
    $rose(prim_mubi_pkg::mubi4_test_true_strict(sha3_absorbed)) |=>
      prim_mubi_pkg::mubi4_test_false_strict(sha3_absorbed))

  always_ff @(posedge clk_i or negedge rst_ni) begin
    if (!rst_ni) msgfifo_empty_q <= 1'b1;
    else         msgfifo_empty_q <= msgfifo_empty;
  end

  assign event_msgfifo_empty = ~msgfifo_empty_q & msgfifo_empty;

  prim_intr_hw #(.Width(1)) intr_fifo_empty (
    .clk_i,
    .rst_ni,
    .event_intr_i           (event_msgfifo_empty),
    .reg2hw_intr_enable_q_i (reg2hw.intr_enable.fifo_empty.q),
    .reg2hw_intr_test_q_i   (reg2hw.intr_test.fifo_empty.q),
    .reg2hw_intr_test_qe_i  (reg2hw.intr_test.fifo_empty.qe),
    .reg2hw_intr_state_q_i  (reg2hw.intr_state.fifo_empty.q),
    .hw2reg_intr_state_de_o (hw2reg.intr_state.fifo_empty.de),
    .hw2reg_intr_state_d_o  (hw2reg.intr_state.fifo_empty.d),
    .intr_o                 (intr_fifo_empty_o)
  );

  // Error
  // As of now, only SHA3 error exists. More error codes will be added.

  logic event_error;
  assign event_error = sha3_err.valid    | app_err.valid
                     | entropy_err.valid | errchecker_err.valid
                     ;

  // Assing error code to the register
  assign hw2reg.err_code.de = event_error;

  always_comb begin
    hw2reg.err_code.d = '0;

    priority case (1'b 1)
      // app_err has the highest priority. If SW issues an incorrect command
      // while app is in active state, the error from AppIntf is passed
      // through.
      app_err.valid: begin
        hw2reg.err_code.d = {app_err.code, app_err.info};
      end

      errchecker_err.valid: begin
        hw2reg.err_code.d = {errchecker_err.code , errchecker_err.info};
      end

      sha3_err.valid: begin
        hw2reg.err_code.d = {sha3_err.code , sha3_err.info};
      end

      entropy_err.valid: begin
        hw2reg.err_code.d = {entropy_err.code, entropy_err.info};
      end

      msgfifo_err.valid: begin
        hw2reg.err_code.d = {msgfifo_err.code, msgfifo_err.info};
      end

      default: begin
        hw2reg.err_code.d = '0;
      end
    endcase
  end

  // Counter errors
  logic counter_error, sha3_count_error, key_index_error;
  logic msgfifo_counter_error;
  logic kmac_entropy_hash_counter_error;
  assign counter_error = sha3_count_error
                       | kmac_entropy_hash_counter_error
                       | key_index_error
                       | msgfifo_counter_error;

  assign msgfifo_counter_error = msgfifo_err.valid;

  // State Errors
  logic sparse_fsm_error;
  logic sha3_state_error, kmac_errchk_state_error;
  logic kmac_core_state_error, kmac_app_state_error;
  logic kmac_entropy_state_error, kmac_state_error;
  assign sparse_fsm_error = sha3_state_error
                          | kmac_errchk_state_error
                          | kmac_core_state_error
                          | kmac_app_state_error
                          | kmac_entropy_state_error
                          | kmac_state_error;

  // Control Signal Integrity Errors
  logic control_integrity_error;
  logic sha3_storage_rst_error;
  assign control_integrity_error = sha3_storage_rst_error;

  prim_intr_hw #(.Width(1)) intr_kmac_err (
    .clk_i,
    .rst_ni,
    .event_intr_i           (event_error),
    .reg2hw_intr_enable_q_i (reg2hw.intr_enable.kmac_err.q),
    .reg2hw_intr_test_q_i   (reg2hw.intr_test.kmac_err.q),
    .reg2hw_intr_test_qe_i  (reg2hw.intr_test.kmac_err.qe),
    .reg2hw_intr_state_q_i  (reg2hw.intr_state.kmac_err.q),
    .hw2reg_intr_state_de_o (hw2reg.intr_state.kmac_err.de),
    .hw2reg_intr_state_d_o  (hw2reg.intr_state.kmac_err.d),
    .intr_o                 (intr_kmac_err_o)
  );

  ///////////////////
  // State Machine //
  ///////////////////

  // State FF
  `PRIM_FLOP_SPARSE_FSM(u_state_regs, kmac_st_d, kmac_st, kmac_st_e, KmacIdle)

  always_comb begin
    // Default value
    kmac_st_d = kmac_st;

    entropy_in_keyblock = 1'b 0;
    kmac_state_error = 1'b 0;

    unique case (kmac_st)
      KmacIdle: begin
        if (kmac_cmd == CmdStart) begin
          // If cSHAKE turned on
          if (sha3_pkg::CShake == app_sha3_mode) begin
            kmac_st_d = KmacPrefix;
          end else begin
            // Jump to Msg feed directly
            kmac_st_d = KmacMsgFeed;
          end
        end else begin
          kmac_st_d = KmacIdle;
        end
      end

      KmacPrefix: begin
        // Wait until SHA3 processes one block
        if (sha3_block_processed) begin
          kmac_st_d = (app_kmac_en) ? KmacKeyBlock : KmacMsgFeed ;
        end else begin
          kmac_st_d = KmacPrefix;
        end
      end

      KmacKeyBlock: begin
        entropy_in_keyblock = 1'b 1;
        if (sha3_block_processed) begin
          kmac_st_d = KmacMsgFeed;
        end else begin
          kmac_st_d = KmacKeyBlock;
        end
      end

      KmacMsgFeed: begin
        // If absorbed, move to Digest
        if (prim_mubi_pkg::mubi4_test_true_strict(sha3_absorbed) &&
          prim_mubi_pkg::mubi4_test_true_strict(sha3_done)) begin
          // absorbed and done can be asserted at a cycle if Applications have
          // requested the hash operation. kmac_app FSM issues CmdDone command
          // if it receives absorbed signal.
          kmac_st_d = KmacIdle;
        end else if (prim_mubi_pkg::mubi4_test_true_strict(sha3_absorbed) &&
          prim_mubi_pkg::mubi4_test_false_loose(sha3_done)) begin
          kmac_st_d = KmacDigest;
        end else begin
          kmac_st_d = KmacMsgFeed;
        end
      end

      KmacDigest: begin
        // SW can manually run it, wait till done
        if (prim_mubi_pkg::mubi4_test_true_strict(sha3_done)) begin
          kmac_st_d = KmacIdle;
        end else begin
          kmac_st_d = KmacDigest;
        end
      end

      KmacTerminalError: begin
        //this state is terminal
        kmac_st_d = KmacTerminalError;
        kmac_state_error = 1'b 1;
      end

      default: begin
        kmac_st_d = KmacTerminalError;
        kmac_state_error = 1'b 1;
      end
    endcase

    // SEC_CM: FSM.GLOBAL_ESC, FSM.LOCAL_ESC
    // Unconditionally jump into the terminal error state
    // if the life cycle controller triggers an escalation.
    if (lc_escalate_en[0] != lc_ctrl_pkg::Off) begin
      kmac_st_d = KmacTerminalError;
    end
  end
  `ASSERT_KNOWN(KmacStKnown_A, kmac_st)

  ///////////////
  // Instances //
  ///////////////

  // KMAC core
  kmac_core #(
    .EnMasking (EnMasking)
  ) u_kmac_core (
    .clk_i,
    .rst_ni,

    // from Msg FIFO
    .fifo_valid_i (msgfifo_valid),
    .fifo_data_i  (msgfifo_data ),
    .fifo_strb_i  (msgfifo_strb ),
    .fifo_ready_o (msgfifo_ready),

    // to SHA3 core
    .msg_valid_o  (msg_valid),
    .msg_data_o   (msg_data ),
    .msg_strb_o   (msg_strb ),
    .msg_ready_i  (msg_ready),

    // Configurations
    .kmac_en_i  (app_kmac_en),
    .mode_i     (app_sha3_mode),
    .strength_i (app_keccak_strength),

    // Secret key interface
    .key_data_i (key_data),
    .key_len_i  (key_len ),

    // Controls
    .start_i   (sha3_start          ),
    .process_i (msgfifo2kmac_process),
    .done_i    (sha3_done           ),
    .process_o (kmac2sha3_process   ),

    // LC escalation
    .lc_escalate_en_i (lc_escalate_en[1]),

    // Error detection
    .sparse_fsm_error_o (kmac_core_state_error),
    .key_index_error_o  (key_index_error)
  );

  // SHA3 hashing engine

  // msg_data masking
  if (EnMasking == 1) begin: g_msg_mask
    logic [MsgWidth-1:0] msg_mask_permuted;

    // Permute the LFSR output to avoid same lfsr applied to multiple times
    always_comb begin
      msg_mask_permuted = '0;
      for (int unsigned i = 0 ; i < MsgWidth ; i++) begin
        // Loop through the MsgPerm constant and swap between the bits
        msg_mask_permuted[i] = msg_mask[RndCnstMsgPerm[i]];
      end
    end

    for (genvar i = 0 ; i < Share ; i++) begin: g_msg_data_mask
      assign msg_data_masked[i] = msg_data[i]
                                ^ ({MsgWidth{cfg_msg_mask}} & msg_mask_permuted);
    end : g_msg_data_mask
  end else begin : g_no_msg_mask
    assign msg_data_masked[0] = msg_data[0];

    logic unused_msgmask;
    assign unused_msgmask = ^{msg_mask, cfg_msg_mask, msg_mask_en};
  end
  sha3 #(
    .EnMasking (EnMasking)
  ) u_sha3 (
    .clk_i,
    .rst_ni,

    // MSG_FIFO interface (or from KMAC)
    .msg_valid_i (msg_valid),
    .msg_data_i  (msg_data_masked ),
    .msg_strb_i  (msg_strb ),
    .msg_ready_o (msg_ready),

    // Entropy interface
    .rand_valid_i    (sha3_rand_valid),
    .rand_early_i    (sha3_rand_early),
    .rand_data_i     (sha3_rand_data),
    .rand_aux_i      (sha3_rand_aux),
    .rand_consumed_o (sha3_rand_consumed),

    // N, S: Used in cSHAKE mode
    .ns_data_i       (ns_prefix),

    // Configurations
    .mode_i     (app_sha3_mode),
    .strength_i (app_keccak_strength),

    // Controls (CMD register)
    .start_i    (sha3_start       ),
    .process_i  (kmac2sha3_process),
    .run_i      (sha3_run         ),
    .done_i     (sha3_done        ),

    // LC escalation
    .lc_escalate_en_i (lc_escalate_en[2]),

    .absorbed_o  (sha3_absorbed),
    .squeezing_o (unused_sha3_squeeze),

    .block_processed_o (sha3_block_processed),

    .sha3_fsm_o (sha3_fsm),

    .state_valid_o (state_valid),
    .state_o       (state), // [Share]

    .error_o                    (sha3_err),
    .sparse_fsm_error_o         (sha3_state_error),
    .count_error_o              (sha3_count_error),
    .keccak_storage_rst_error_o (sha3_storage_rst_error)
  );

  // MSG_FIFO window interface to FIFO interface ===============================
  // Tie the read path
  assign tlram_rvalid = 1'b 0;
  assign tlram_rdata = '0;
  assign tlram_rerror = '0;

  // Convert endian here
  //    prim_packer always packs to the right(bit0). If the input DWORD is
  //    big-endian, it needs to be swapped to little-endian to maintain the
  //    order. Internal SHA3(Keccak) runs in little-endian in contrast to HMAC
  //    So, no endian-swap after prim_packer.
  assign tlram_wdata_endian = conv_endian32(tlram_wdata,
                                reg2hw.cfg_shadowed.msg_endianness.q);
  assign tlram_wmask_endian = conv_endian32(tlram_wmask,
                                reg2hw.cfg_shadowed.msg_endianness.q);

  // TL Adapter
  tlul_adapter_sram #(
    .SramAw ($clog2(MsgWindowDepth)),
    .SramDw (MsgWindowWidth),
    .Outstanding (1),
    .ByteAccess  (1),
    .ErrOnRead   (1)
  ) u_tlul_adapter_msgfifo (
    .clk_i,
    .rst_ni,
    .en_ifetch_i (prim_mubi_pkg::MuBi4False),
    .tl_i        (tl_win_h2d[WinMsgFifo]),
    .tl_o        (tl_win_d2h[WinMsgFifo]),

    .req_o       (tlram_req),
    .req_type_o  (),
    .gnt_i       (tlram_gnt),
    .we_o        (tlram_we ),
    .addr_o      (tlram_addr),
    .wdata_o     (tlram_wdata),
    .wmask_o     (tlram_wmask),
    .intg_error_o(           ),
    .rdata_i     (tlram_rdata),
    .rvalid_i    (tlram_rvalid),
    .rerror_i    (tlram_rerror)
  );

  assign sw_msg_valid = tlram_req & tlram_we ;
  if (MsgWidth == MsgWindowWidth) begin : gen_sw_msg_samewidth
    assign sw_msg_data  = tlram_wdata_endian ;
    assign sw_msg_mask  = tlram_wmask_endian ;
  end else begin : gen_sw_msg_diff
    assign sw_msg_data = {{MsgWidth-MsgWindowWidth{1'b0}}, tlram_wdata_endian};
    assign sw_msg_mask = {{MsgWidth-MsgWindowWidth{1'b0}}, tlram_wmask_endian};
  end
  assign tlram_gnt    = sw_msg_ready ;

  logic unused_tlram_addr;
  assign unused_tlram_addr = &{1'b0, tlram_addr};

  // Application interface Mux/Demux
  kmac_app #(
    .EnMasking(EnMasking),
    .SecIdleAcceptSwMsg(SecIdleAcceptSwMsg)
  ) u_app_intf (
    .clk_i,
    .rst_ni,

    .reg_key_data_i (sw_key_data),
    .reg_key_len_i  (sw_key_len),

    .reg_prefix_i (reg_ns_prefix),

    .reg_kmac_en_i         (reg_kmac_en),
    .reg_sha3_mode_i       (reg_sha3_mode),
    .reg_keccak_strength_i (reg_keccak_strength),

    // data from tl_adapter
    .sw_valid_i (sw_msg_valid),
    .sw_data_i  (sw_msg_data),
    .sw_mask_i  (sw_msg_mask),
    .sw_ready_o (sw_msg_ready),

    // KeyMgr sideloaded key interface
    .keymgr_key_i,

    // Application data in / digest out interface
    .app_i,
    .app_o,

    // Secret Key output to KMAC Core
    .key_data_o (key_data),
    .key_len_o  (key_len),

    // to MSG_FIFO
    .kmac_valid_o (mux2fifo_valid),
    .kmac_data_o  (mux2fifo_data),
    .kmac_mask_o  (mux2fifo_mask),
    .kmac_ready_i (mux2fifo_ready),

    // to KMAC Core
    .kmac_en_o (app_kmac_en),

    // to SHA3 Core
    .sha3_prefix_o     (ns_prefix),
    .sha3_mode_o       (app_sha3_mode),
    .keccak_strength_o (app_keccak_strength),

    // Keccak state from SHA3 core
    .keccak_state_valid_i (state_valid),
    .keccak_state_i       (state),

    // to STATE TL Window
    .reg_state_valid_o    (reg_state_valid),
    .reg_state_o          (reg_state),

    // Configuration: Sideloaded Key
    .keymgr_key_en_i      (reg2hw.cfg_shadowed.sideload.q),

    .absorbed_i (sha3_absorbed), // from SHA3
    .absorbed_o (app_absorbed),  // to SW

    .app_active_o(app_active),

    .error_i         (sha3_err.valid),
    .err_processed_i (err_processed),

    // Command interface
    .sw_cmd_i (checked_sw_cmd),
    .cmd_o    (kmac_cmd),

    // Status
    .entropy_ready_i (entropy_configured),

    // LC escalation
    .lc_escalate_en_i (lc_escalate_en[3]),

    // Error report
    .error_o            (app_err),
    .sparse_fsm_error_o (kmac_app_state_error)

  );

  // Message FIFO
  kmac_msgfifo #(
    .OutWidth  (kmac_pkg::MsgWidth),
    .MsgDepth  (kmac_pkg::MsgFifoDepth),
    .EnMasking (EnMasking)
  ) u_msgfifo (
    .clk_i,
    .rst_ni,

    .fifo_valid_i (mux2fifo_valid),
    .fifo_data_i  (mux2fifo_data),
    .fifo_mask_i  (mux2fifo_mask),
    .fifo_ready_o (mux2fifo_ready),

    .msg_valid_o (msgfifo_valid),
    .msg_data_o  (msgfifo_data[0]),
    .msg_strb_o  (msgfifo_strb),
    .msg_ready_i (msgfifo_ready),

    .fifo_empty_o (msgfifo_empty), // intr and status
    .fifo_full_o  (msgfifo_full),  // connected to status only
    .fifo_depth_o (msgfifo_depth),

    .clear_i (sha3_done),

    .process_i (reg2msgfifo_process ),
    .process_o (msgfifo2kmac_process),

    .err_o (msgfifo_err)
  );

  logic [sha3_pkg::StateW-1:0] reg_state_tl [Share];
  always_comb begin
    for (int i = 0 ; i < Share; i++) begin
      reg_state_tl[i] = reg_state_valid ? reg_state[i] : 'b0;
    end
  end

  // State (Digest) reader
  kmac_staterd #(
    .AddrW     (9), // 512B
    .EnMasking (EnMasking)
  ) u_staterd (
    .clk_i,
    .rst_ni,

    .tl_i (tl_win_h2d[WinState]),
    .tl_o (tl_win_d2h[WinState]),

    .state_i (reg_state_tl),

    .endian_swap_i (reg2hw.cfg_shadowed.state_endianness.q)
  );

  // Error checker
  kmac_errchk #(
    .EnMasking (EnMasking)
  ) u_errchk (
    .clk_i,
    .rst_ni,

    // Configurations
    .cfg_mode_i    (reg_sha3_mode      ),
    .cfg_strength_i(reg_keccak_strength),

    .kmac_en_i      (reg_kmac_en        ),
    .cfg_prefix_6B_i(reg_ns_prefix[47:0]), // first 6B of PREFIX

    .cfg_en_unsupported_modestrength_i (cfg_en_unsupported_modestrength),

    .entropy_ready_pulse_i (entropy_ready),

    // SW commands
    .sw_cmd_i(sw_cmd),
    .sw_cmd_o(checked_sw_cmd),

    // Status from KMAC_APP
    .app_active_i(app_active),

    // Status from SHA3 core
    .sha3_absorbed_i(sha3_absorbed       ),
    .keccak_done_i  (sha3_block_processed),

    // LC escalation
    .lc_escalate_en_i (lc_escalate_en[4]),

    .err_processed_i (err_processed),

    .error_o            (errchecker_err),
    .sparse_fsm_error_o (kmac_errchk_state_error)
  );

  // Entropy Generator
  if (EnMasking == 1) begin : gen_entropy

    logic entropy_req, entropy_ack;
    logic [edn_pkg::ENDPOINT_BUS_WIDTH-1:0] entropy_data;
    logic unused_entropy_fips;

    // Synchronize EDN interface
    prim_sync_reqack_data #(
      .Width(edn_pkg::ENDPOINT_BUS_WIDTH),
      .DataSrc2Dst(1'b0),
      .DataReg(1'b0)
    ) u_prim_sync_reqack_data (
      .clk_src_i (clk_i),
      .rst_src_ni(rst_ni),
      .clk_dst_i (clk_edn_i),
      .rst_dst_ni(rst_edn_ni),
      .req_chk_i ((kmac_entropy_state_error == 1'b0) && (entropy_err.valid == 1'b0)),
      .src_req_i (entropy_req),
      .src_ack_o (entropy_ack),
      .dst_req_o (entropy_o.edn_req),
      .dst_ack_i (entropy_i.edn_ack),
      .data_i    (entropy_i.edn_bus),
      .data_o    (entropy_data)
    );

    // We don't track whether the entropy is pre-FIPS or not inside KMAC.
    assign unused_entropy_fips = entropy_i.edn_fips;

    kmac_entropy #(
     .RndCnstLfsrPerm(RndCnstLfsrPerm),
     .RndCnstLfsrSeed(RndCnstLfsrSeed),
     .RndCnstLfsrFwdPerm(RndCnstLfsrFwdPerm)
    ) u_entropy (
      .clk_i,
      .rst_ni,

      // EDN interface
      .entropy_req_o (entropy_req),
      .entropy_ack_i (entropy_ack),
      .entropy_data_i(entropy_data),

      // Entropy to internal logic (DOM AND)
      .rand_valid_o    (sha3_rand_valid),
      .rand_early_o    (sha3_rand_early),
      .rand_data_o     (sha3_rand_data),
      .rand_aux_o      (sha3_rand_aux),
      .rand_consumed_i (sha3_rand_consumed),

      // Status from internal logic
      //// KMAC secret block handling indicator
      .in_keyblock_i (entropy_in_keyblock),

      // Configuration
      .mode_i          (entropy_mode),
      .entropy_ready_i (entropy_ready),
      .fast_process_i  (entropy_fast_process),

      //// Entropy refresh period in clk cycles
      .wait_timer_prescaler_i (wait_timer_prescaler),
      .wait_timer_limit_i     (wait_timer_limit),

      //// Message Masking
      .msg_mask_en_i (msg_mask_en),
      .msg_mask_o    (msg_mask),

      //// SW update of seed
      .seed_update_i         (entropy_seed_update),
      .seed_data_i           (entropy_seed_data),
      .entropy_refresh_req_i (entropy_refresh_req),

      // Status
      .hash_cnt_o       (entropy_hash_cnt),
      .hash_cnt_clr_i   (entropy_hash_clr),
      .hash_threshold_i (entropy_hash_threshold),

      .entropy_configured_o (entropy_configured),

      // LC escalation
      .lc_escalate_en_i (lc_escalate_en[5]),

      // Error
      .err_o              (entropy_err),
      .sparse_fsm_error_o (kmac_entropy_state_error),
      .count_error_o      (kmac_entropy_hash_counter_error),
      .err_processed_i    (err_processed)
    );
  end else begin : gen_empty_entropy
    // If Masking is not used, no need of entropy. Ignore inputs and config; tie output to 0.
    edn_pkg::edn_rsp_t unused_entropy_input;
    entropy_mode_e     unused_entropy_mode;
    logic              unused_entropy_fast_process;

    assign unused_entropy_input        = entropy_i;
    assign unused_entropy_mode         = entropy_mode;
    assign unused_entropy_fast_process = entropy_fast_process;

    assign entropy_o = '{default: '0};

    logic unused_sha3_rand_consumed;
    assign sha3_rand_valid = 1'b 1;
    assign sha3_rand_early = 1'b 1;
    assign sha3_rand_data = '0;
    assign sha3_rand_aux = '0;
    assign unused_sha3_rand_consumed = sha3_rand_consumed;

    logic [NumSeedsEntropyLfsr-1:0]       unused_seed_update;
    logic [NumSeedsEntropyLfsr-1:0][31:0] unused_seed_data;
    logic [31:0] unused_refresh_period;
    logic unused_entropy_refresh_req;
    assign unused_seed_data = entropy_seed_data;
    assign unused_seed_update = entropy_seed_update;
    assign unused_refresh_period = ^{wait_timer_limit, wait_timer_prescaler};
    assign unused_entropy_refresh_req = entropy_refresh_req;

    logic unused_entropy_hash;
    assign unused_entropy_hash = ^{entropy_hash_clr, entropy_hash_threshold};
    assign entropy_hash_cnt = '0;

    assign entropy_err = '{valid: 1'b 0, code: ErrNone, info: '0};

    assign kmac_entropy_state_error = 1'b 0;
    assign kmac_entropy_hash_counter_error  = 1'b 0;

    logic [1:0] unused_entropy_status;
    assign unused_entropy_status = entropy_in_keyblock;

    // If Masking is off, always entropy configured
    assign entropy_configured = prim_mubi_pkg::MuBi4True;
  end

  // MUBI4 buf
  prim_mubi4_sender #(
    .AsyncOn (0)
  ) u_sha3_done_sender (
    .clk_i,
    .rst_ni,
    .mubi_i (sha3_done_d),
    .mubi_o (sha3_done)
  );

  // Register top
  logic [NumAlerts-1:0] alert_test, alerts, alerts_q;

  logic shadowed_storage_err, shadowed_update_err;
  kmac_reg_top u_reg (
    .clk_i,
    .rst_ni,
    .rst_shadowed_ni,

    .tl_i,
    .tl_o,

    .tl_win_o (tl_win_h2d),
    .tl_win_i (tl_win_d2h),

    .reg2hw,
    .hw2reg,

    // SEC_CM: CFG_SHADOWED.CONFIG.SHADOW
    .shadowed_storage_err_o (shadowed_storage_err),
    .shadowed_update_err_o  (shadowed_update_err),
    // SEC_CM: BUS.INTEGRITY
    .intg_err_o             (alert_intg_err),

    .devmode_i (devmode)
  );

  logic unused_cfg_shadowed_qe;
  assign unused_cfg_shadowed_qe = ^{
    reg2hw.cfg_shadowed.kmac_en.qe                     ,
    reg2hw.cfg_shadowed.kstrength.qe                   ,
    reg2hw.cfg_shadowed.mode.qe                        ,
    reg2hw.cfg_shadowed.msg_endianness.qe              ,
    reg2hw.cfg_shadowed.state_endianness.qe            ,
    reg2hw.cfg_shadowed.sideload.qe                    ,
    reg2hw.cfg_shadowed.entropy_mode.qe                ,
    reg2hw.cfg_shadowed.entropy_fast_process.qe        ,
    reg2hw.cfg_shadowed.msg_mask.qe                    ,
    reg2hw.cfg_shadowed.en_unsupported_modestrength.qe
    };

  // Alerts
  assign alert_test = {
    reg2hw.alert_test.fatal_fault_err.q
      & reg2hw.alert_test.fatal_fault_err.qe,    // [1]
    reg2hw.alert_test.recov_operation_err.q
      & reg2hw.alert_test.recov_operation_err.qe // [0]
  };

  assign alerts = {
    alert_fatal,           // Alerts[1]
    alert_recov_operation  // Alerts[0]
    };

  assign alert_recov_operation = shadowed_update_err;

  // The recoverable alert is observable via status register until the KMAC operation is restarted
  // by re-writing the Control Register.
  logic status_alert_recov_ctrl_update_err;
  always_ff @(posedge clk_i or negedge rst_ni) begin
    if (!rst_ni) begin
      status_alert_recov_ctrl_update_err <= 1'b 0;
    end else if (alert_recov_operation) begin
      status_alert_recov_ctrl_update_err <= 1'b 1;
    end else if (err_processed) begin
      status_alert_recov_ctrl_update_err <= 1'b 0;
    end
  end

  assign hw2reg.status.alert_recov_ctrl_update_err.d  = status_alert_recov_ctrl_update_err;

  assign alert_fatal = shadowed_storage_err
                     | alert_intg_err
                     | sparse_fsm_error
                     | counter_error
                     | control_integrity_error
                     ;

  // Make the fatal alert observable via status register.
  // Cannot be reset except the hardware reset
  logic status_alert_fatal_fault;

  always_ff @(posedge clk_i or negedge rst_ni) begin
    if (!rst_ni) begin
      status_alert_fatal_fault <= 1'b 0;
    end else if (alert_fatal) begin
      status_alert_fatal_fault <= 1'b 1;
    end
  end
  assign hw2reg.status.alert_fatal_fault.d  = status_alert_fatal_fault;

  for (genvar i = 0; i < NumAlerts; i++) begin : gen_alert_tx
    prim_alert_sender #(
      .AsyncOn(AlertAsyncOn[i]),
      .IsFatal(i)
    ) u_prim_alert_sender (
      .clk_i,
      .rst_ni,
      .alert_test_i  ( alert_test[i] ),
      .alert_req_i   ( alerts[i]     ),
      .alert_ack_o   (               ),
      .alert_state_o (               ),
      .alert_rx_i    ( alert_rx_i[i] ),
      .alert_tx_o    ( alert_tx_o[i] )
    );
  end

  // Below assumes NumAlerts == 2
  `ASSERT_INIT(NumAlerts2_A, NumAlerts == 2)

  always_ff @(posedge clk_i or negedge rst_ni) begin
  // break up the combinatorial path for local escalation
    if (!rst_ni) begin
      alerts_q[1] <= 1'b0;
    end else if (alerts[1]) begin
      // fatal alerts cannot be cleared
      alerts_q[1] <= 1'b1;
    end
  end

  always_ff @(posedge clk_i or negedge rst_ni) begin
  // break up the combinatorial path for local escalation
    if (!rst_ni) begin
      alerts_q[0] <= 1'b0;
    end else begin
      // recoverable alerts can be cleared so just latch the value
      alerts_q[0] <= alerts[0];
    end
  end

  // Latched recoverable alert[0] is not used. Rather removing above,
  // keep alert_q[1:0] and make alert_q[0] unused (lint waive).
  logic unused_alerts_q0;
  assign unused_alerts_q0 = alerts_q[0];

  // SEC_CM: LC_ESCALATE_EN.INTERSIG.MUBI, FSM.GLOBAL_ESC, FSM.LOCAL_ESC
  lc_ctrl_pkg::lc_tx_t alert_to_lc_tx;
  assign alert_to_lc_tx = lc_ctrl_pkg::lc_tx_bool_to_lc_tx(alerts_q[1]);
  for (genvar i = 0; i < NumLcSyncCopies; i++) begin : gen_or_alert_lc_sync
      assign lc_escalate_en[i] = lc_ctrl_pkg::lc_tx_or_hi(alert_to_lc_tx, lc_escalate_en_sync[i]);
  end

  // Synchronize life cycle input
  prim_lc_sync #(
    .NumCopies (NumLcSyncCopies)
  ) u_prim_lc_sync (
    .clk_i,
    .rst_ni,
    .lc_en_i ( lc_escalate_en_i    ),
    .lc_en_o ( lc_escalate_en_sync )
  );

  assign en_masking_o = EnMasking;

  ////////////////
  // Assertions //
  ////////////////

  // Assert known for output values
  `ASSERT_KNOWN(KmacDone_A, intr_kmac_done_o)
  `ASSERT_KNOWN(FifoEmpty_A, intr_fifo_empty_o)
  `ASSERT_KNOWN(KmacErr_A, intr_kmac_err_o)
  `ASSERT_KNOWN(TlODValidKnown_A, tl_o.d_valid)
  `ASSERT_KNOWN(TlOAReadyKnown_A, tl_o.a_ready)
  `ASSERT_KNOWN(AlertKnownO_A, alert_tx_o)
  `ASSERT_KNOWN(EnMaskingKnown_A, en_masking_o)

  // Parameter as desired
  `ASSERT_INIT(SecretKeyDivideBy32_A, (kmac_pkg::MaxKeyLen % 32) == 0)

  // Command input should be sparse
  `ASSUME(CmdSparse_M, reg2hw.cmd.cmd.qe |-> reg2hw.cmd.cmd.q inside {CmdStart, CmdProcess,
                                                                CmdManualRun,CmdDone, CmdNone})

  // redundant counter error
  `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(SentMsgCountCheck_A, u_sha3.u_pad.u_sentmsg_count,
                                         alert_tx_o[1])
  `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(RoundCountCheck_A, u_sha3.u_keccak.u_round_count,
                                         alert_tx_o[1])
  `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(KeyIndexCountCheck_A, u_kmac_core.u_key_index_count,
                                         alert_tx_o[1])

  // Sparse FSM state error
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(KmacCoreFsmCheck_A, u_kmac_core.u_state_regs, alert_tx_o[1])
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(KmacAppFsmCheck_A, u_app_intf.u_state_regs, alert_tx_o[1])
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(SHA3FsmCheck_A, u_sha3.u_state_regs, alert_tx_o[1])
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(SHA3padFsmCheck_A, u_sha3.u_pad.u_state_regs, alert_tx_o[1])
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(KeccackFsmCheck_A, u_sha3.u_keccak.u_state_regs,
                                       alert_tx_o[1])
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(ErrorCheckFsmCheck_A, u_errchk.u_state_regs, alert_tx_o[1])
  `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(KmacFsmCheck_A, u_state_regs, alert_tx_o[1])

  // prim is only instantiated if masking is enabled
  if (EnMasking == 1) begin : g_testassertion
    `ASSERT_PRIM_FSM_ERROR_TRIGGER_ALERT(EntropyFsmCheck_A, gen_entropy.u_entropy.u_state_regs,
                                         alert_tx_o[1])

    `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(HashCountCheck_A, gen_entropy.u_entropy.u_hash_count,
                                         alert_tx_o[1])
    `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(SeedIdxCountCheck_A,
                                           gen_entropy.u_entropy.u_seed_idx_count,
                                           alert_tx_o[1])

    // MsgFifo.Packer
    `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(
      PackerCountCheck_A,
      u_msgfifo.u_packer.g_pos_dupcnt.u_pos,
      alert_tx_o[1]
    )

    // MsgFifo.Fifo
    `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(
      MsgFifoWptrCheck_A,
      u_msgfifo.u_msgfifo.gen_normal_fifo.u_fifo_cnt.gen_secure_ptrs.u_wptr,
      alert_tx_o[1]
    )
    `ASSERT_PRIM_COUNT_ERROR_TRIGGER_ALERT(
      MsgFifoRptrCheck_A,
      u_msgfifo.u_msgfifo.gen_normal_fifo.u_fifo_cnt.gen_secure_ptrs.u_rptr,
      alert_tx_o[1]
    )
  end

  // Alert assertions for reg_we onehot check
  `ASSERT_PRIM_REG_WE_ONEHOT_ERROR_TRIGGER_ALERT(RegWeOnehotCheck_A, u_reg, alert_tx_o[1])
endmodule