Hot Reset — Resetting a Link Without Removing Power

HOT_RESET_MASTER_UP     initiating, Link up
HOT_RESET_MASTER_DOWN   initiating, Link down
HOT_RESET_HOT_RESET     receiving  (Slave)

software writes Secondary Bus Reset on a bridge/port
      ↓
that port's control logic requests Hot Reset
      ↓
the LTSSM transmits the instruction in-band
      ↓
the partner qualifies it, enters Hot Reset, and resets its state

1.  reset REQUEST        someone asked          (a register write, or received TS)
2.  reset ASSERTION      the reset is active    (may be immediate)
3.  state CLEARING       the state is gone      (takes cycles; scope matters)
4.  reset RELEASE        the reset deasserts    (an edge)
5.  functional READINESS you may use it again   (the Link is retrained,
                                                 credits reinitialized)

// SYNTHESIZABLE. Normalized Hot Reset types and reset-domain scope.
// THE DOMAINS follow section 1's cascade evidence. They are NOT a claim
// about which Configuration Space fields survive -- section 7 marks that
// NOT ASSERTED, and no signal here pretends to know.
package hotrst_pkg;
 
  typedef enum logic [1:0] {
    HR_SRC_NONE   = 2'd0,
    HR_SRC_LOCAL  = 2'd1,   // Secondary Bus Reset write -> Master (section 6)
    HR_SRC_REMOTE = 2'd2    // qualified TS with the Hot Reset bit -> Slave
  } hotrst_src_e;
 
  // ==================================================================
  // RESET DOMAINS, NOT A GLOBAL RESET.
  //
  // `assign global_reset = hot_reset;` is the design this package exists
  // to prevent. Section 1's cascade shows the domains are LAYERED and
  // that at least one thing is deliberately EXCLUDED -- configuration
  // registers stay readable when the link is down.
  // ==================================================================
  typedef struct packed {
    logic dll_state;      // sequence numbers, replay buffer, ACK/NAK (15.x)
    logic fc_state;       // flow-control credits (16.x) -- DLL state
    logic ltssm_training; // qualification history, candidate config
    logic tl_context;     // outstanding Tags, in-flight request context
    // NOTE THE ABSENCE of a config_registers bit. Section 1 states Root
    // Port configuration registers are deliberately kept readable when
    // the link is down; section 7 declines to assert Hot Reset's exact
    // Configuration Space scope. A domain this design cannot justify
    // is a domain it must not drive.
  } reset_domains_t;
 
  function automatic reset_domains_t all_link_domains();
    return '{ dll_state: 1'b1, fc_state: 1'b1,
              ltssm_training: 1'b1, tl_context: 1'b1 };
  endfunction
 
endpackage

import hotrst_pkg::*;
 
// SYNTHESIZABLE. Hold a LOCAL (directed) Hot Reset request.
// A SECONDARY BUS RESET WRITE IS A ONE-CYCLE PULSE (section 6). The
// episode controller may be busy. A pulse wired straight into the entry
// condition is lost, and the software that requested the reset sees
// nothing happen (section 15, mutation 3).
module hotrst_request_latch (
  input  logic clk,
  input  logic rst_n,
  input  logic sbr_write_pulse,
  input  logic request_taken,
  input  logic abort,
  output logic request_pending
);
  logic p_q;
  assign request_pending = p_q;
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || abort)   p_q <= 1'b0;
    else if (request_taken) p_q <= 1'b0;   // consumed EXACTLY once
    else if (sbr_write_pulse) p_q <= 1'b1;
  end
endmodule

import hotrst_pkg::*;
 
// SYNTHESIZABLE. Qualify a REMOTE Hot Reset instruction.
// SECTION 1: "typically 2 consecutive TS OS with the appropriate Control
// Symbol bit set" -- AND the hazard that two corrupted TS can spell it
// (section 9). THRESH is parameterised; this chapter publishes no
// normative count.
module hotrst_remote_qual #(
  parameter int THRESH = 2,
  parameter int CNT_W  = (THRESH <= 1) ? 1 : $clog2(THRESH + 1)
) (
  input  logic clk,
  input  logic rst_n,
 
  input  logic rx_ts_entry_enabled,   // section 1's per-state mitigation
  input  logic obs_valid,
  input  logic obs_hot_reset_bit,
 
  // ==============================================================
  // CLEARED ON RESET ENTRY. Section 13 measured this exact bug: with
  // history retained, 25.0% of (stream, reset-point) cases qualify
  // prematurely after the reset using PRE-reset observations.
  // ==============================================================
  input  logic episode_restart,
 
  output logic [CNT_W-1:0] count,
  output logic             remote_hot_reset
);
  generate
    if (THRESH < 1) $error("THRESH must be at least 1");
    if ((1 << CNT_W) < (THRESH + 1)) $error("CNT_W too narrow for THRESH");
  endgenerate
 
  logic [CNT_W-1:0] cnt_q;
  assign count            = cnt_q;
  assign remote_hot_reset = rx_ts_entry_enabled && (cnt_q >= CNT_W'(THRESH));
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n)                cnt_q <= '0;
    else if (episode_restart)  cnt_q <= '0;
    else if (obs_valid) begin
      // CONSECUTIVE, not cumulative -- the defence against scattered
      // bit errors accumulating into a reset instruction (section 9).
      if (obs_hot_reset_bit) begin
        if (cnt_q < CNT_W'(THRESH)) cnt_q <= cnt_q + CNT_W'(1);
      end else cnt_q <= '0;
    end
  end
endmodule

import hotrst_pkg::*;
 
// SYNTHESIZABLE. One Hot Reset episode.
// THESE ARE TEACHING PHASES. Section 1 verifies the Master/Slave roles;
// it does not publish the transition criteria a normative substate
// encoding would need. This is not the LTSSM.
module hotrst_controller (
  input  logic clk,
  input  logic rst_n,
 
  input  logic request_pending,      // local  (section 12)
  input  logic remote_hot_reset,     // remote (section 12)
  input  logic link_up,              // MASTER_UP vs MASTER_DOWN (section 1)
 
  input  logic signal_sent,          // the instruction was transmitted
  input  logic domains_cleared,      // every driven domain reports done
  input  logic link_ready,           // retrained, configured, DL up
 
  output logic          request_taken,
  output logic          start_signal,
  output logic          hot_reset_active,
  output logic          episode_restart,
  output logic          episode_pulse,     // ONE per episode (section 14)
  output hotrst_src_e   source
);
 
  typedef enum logic [2:0] {
    S_IDLE, S_MASTER_SIGNAL, S_SLAVE_ACCEPT, S_CLEARING, S_WAIT_LINK, S_DONE
  } st_e;
  st_e st_q;
  hotrst_src_e src_q;
 
  assign source        = src_q;
  assign request_taken = (st_q == S_IDLE) && request_pending;
  assign start_signal  = (st_q == S_MASTER_SIGNAL);
 
  // ==================================================================
  // hot_reset_active SPANS CLEARING AND RETRAINING.
  //
  // It does NOT drop when the domains finish clearing. Section 11: reset
  // release is not readiness, and the Link has to be rebuilt after the
  // state is gone.
  // ==================================================================
  assign hot_reset_active = (st_q inside {S_MASTER_SIGNAL, S_SLAVE_ACCEPT,
                                          S_CLEARING, S_WAIT_LINK});
 
  // ONE PULSE PER EPISODE, on entry -- not per qualifying observation.
  // Section 13 measured the level-counting alternative: a single reset
  // episode over-counted by up to +9.
  assign episode_pulse   = (st_q == S_IDLE) && (request_pending || remote_hot_reset);
  assign episode_restart = episode_pulse;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin st_q <= S_IDLE; src_q <= HR_SRC_NONE; end
    else begin
      unique case (st_q)
        S_IDLE :
          // LOCAL WINS a same-cycle tie: this port was explicitly told to
          // reset its partner, and that instruction still has to go out.
          if (request_pending) begin
            src_q <= HR_SRC_LOCAL;
            st_q  <= link_up ? S_MASTER_SIGNAL : S_CLEARING;
          end else if (remote_hot_reset) begin
            src_q <= HR_SRC_REMOTE;
            st_q  <= S_SLAVE_ACCEPT;
          end
 
        // MASTER_UP: the instruction can be delivered, so send it first.
        // MASTER_DOWN skipped straight to clearing above -- section 3.
        S_MASTER_SIGNAL : if (signal_sent)     st_q <= S_CLEARING;
        S_SLAVE_ACCEPT  :                      st_q <= S_CLEARING;
 
        // State clearing takes cycles and is NOT instantaneous (section 11).
        S_CLEARING      : if (domains_cleared) st_q <= S_WAIT_LINK;
 
        // AND THEN THE LINK MUST BE REBUILT. This state is the difference
        // between reset release and readiness.
        S_WAIT_LINK     : if (link_ready)      st_q <= S_DONE;
 
        S_DONE          :                      st_q <= S_IDLE;
        default         :                      st_q <= S_IDLE;
      endcase
    end
  end
endmodule

import hotrst_pkg::*;
 
// SYNTHESIZABLE. Drive ONLY the domains this reset is defined to affect.
// THIS BLOCK EXISTS TO PREVENT ONE LINE: `assign global_reset = hot_reset;`
// Section 1's cascade shows the domains are layered and that
// configuration registers are deliberately excluded (section 8).
module hotrst_domain_fanout (
  input  logic clk,
  input  logic rst_n,
  input  logic hot_reset_active,
  input  logic clearing_phase,
 
  // Per-domain completion. Each domain knows when IT is done; this block
  // does not guess (the lesson from section 4's FLR acknowledgement).
  input  logic dll_clear_done,
  input  logic fc_clear_done,
  input  logic ltssm_clear_done,
  input  logic tl_clear_done,
 
  output reset_domains_t domain_reset,
  output logic           domains_cleared
);
  // Asserted only during the clearing phase, and only for declared domains.
  assign domain_reset = clearing_phase ? all_link_domains() : '0;
 
  // EVERY driven domain must report done. A design that proceeded on the
  // first completion would release with state still live in the others.
  assign domains_cleared = dll_clear_done && fc_clear_done
                        && ltssm_clear_done && tl_clear_done;
 
  // NOTE: nothing here drives configuration registers. Section 7 declines
  // to assert Hot Reset's Configuration Space scope, and section 1 shows
  // config registers are deliberately kept readable when the link is
  // down. Driving a domain this design cannot justify is mutation 15.
endmodule

// SYNTHESIZABLE. THE FLAGSHIP BLOCK OF THIS CHAPTER.
// Traffic resumes on READINESS, never on reset deassertion (section 11).
module hotrst_release_coord (
  input  logic hot_reset_active,
  input  logic local_reset_done,    // our own state is cleared
  input  logic ltssm_link_ready,    // trained, configured, DL layer up
  output logic protocol_enable
);
  // ==================================================================
  // ALL THREE CONDITIONS.
  //
  //   assign protocol_enable = !hot_reset_active;      // WRONG
  //
  // Section 15 enumerated all 32 input combinations: the wrong version
  // transmits a TLP into an untrained Link in 3 of them. This version
  // does so in 0.
  //
  // This is section 1's cascade in miniature: a layer is enabled by the
  // readiness of what it depends on, not by the absence of a reset.
  // ==================================================================
  assign protocol_enable = !hot_reset_active
                        && local_reset_done
                        && ltssm_link_ready;
endmodule

import hotrst_pkg::*;
 
// SYNTHESIZABLE. Lab diagnostics. Saturating, EDGE-driven.
module hotrst_diag #(parameter int CYC_W = 32, parameter int EVT_W = 16) (
  input  logic clk,
  input  logic rst_n,
  input  logic hot_reset_active,
  input  logic episode_pulse,       // ONE per episode (section 13)
  input  hotrst_src_e source,
  input  logic exit_state_valid,
  input  logic clear,
 
  output logic [EVT_W-1:0] hot_reset_count,
  output logic [EVT_W-1:0] local_count,
  output logic [EVT_W-1:0] remote_count,
  output logic [CYC_W-1:0] last_duration,
  output hotrst_src_e      last_source
);
  logic [EVT_W-1:0] n_q, l_q, r_q;
  logic [CYC_W-1:0] cur_q, last_q;
  hotrst_src_e      s_q;
 
  assign hot_reset_count = n_q; assign local_count = l_q;
  assign remote_count = r_q;    assign last_duration = last_q;
  assign last_source = s_q;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || clear) begin
      n_q<='0; l_q<='0; r_q<='0; cur_q<='0; last_q<='0; s_q<=HR_SRC_NONE;
    end else begin
      // ==============================================================
      // ONE INCREMENT PER EPISODE. Section 15 measured the alternative:
      // counting every qualifying observation over-counts a SINGLE
      // reset episode by up to +9, because the instruction is
      // transmitted repeatedly by design.
      // ==============================================================
      if (episode_pulse) begin
        if (!(&n_q)) n_q <= n_q + EVT_W'(1);
        s_q   <= source;
        cur_q <= '0;
        // LOCAL vs REMOTE, separately. Section 16's first question.
        if (source == HR_SRC_LOCAL  && !(&l_q)) l_q <= l_q + EVT_W'(1);
        if (source == HR_SRC_REMOTE && !(&r_q)) r_q <= r_q + EVT_W'(1);
      end else if (hot_reset_active) begin
        if (!(&cur_q)) cur_q <= cur_q + CYC_W'(1);
      end else if (exit_state_valid) begin
        last_q <= cur_q;
      end
    end
  end
endmodule

// SVA over the Hot Reset blocks. LOCAL contract only. Nothing asserts that
// a reset completes, that the Link retrains, or that the partner accepts.
 
// ---- ENVIRONMENT ------------------------------------------------------
assume property (@(posedge clk) disable iff (!rst_n)
  sbr_write_pulse |=> !sbr_write_pulse);
assume property (@(posedge clk) disable iff (!rst_n)
  (up_valid && !up_ready) |=> (up_valid && $stable(up_payload)));
 
// ---- REQUEST OWNERSHIP ------------------------------------------------
 
// P1: A LOCAL RESET REQUEST IS NEVER LOST. A Secondary Bus Reset write is
// a one-cycle pulse and the controller may be busy (section 12).
property p_request_held;
  @(posedge clk) disable iff (!rst_n)
  (request_pending && !request_taken && !abort) |=> request_pending;
endproperty
a_held : assert property (p_request_held);
 
// P2: REMOTE DETECTION REQUIRES QUALIFIED, CONSECUTIVE EVIDENCE, and is
// gated by section 1's per-state mitigation (section 9).
property p_remote_qualified;
  @(posedge clk) disable iff (!rst_n)
  remote_hot_reset |-> (rx_ts_entry_enabled && (count >= CNT_W'(THRESH)));
endproperty
a_qual : assert property (p_remote_qualified);
 
// P2b: a non-matching observation resets the count to ZERO -- the defence
// against scattered bit errors accumulating into a RESET instruction.
property p_reset_to_zero;
  @(posedge clk) disable iff (!rst_n)
  (obs_valid && !obs_hot_reset_bit) |=> (count == '0);
endproperty
a_zero : assert property (p_reset_to_zero);
 
// P3: the signalling descriptor is stable while the generator stalls.
property p_descriptor_stable;
  @(posedge clk) disable iff (!rst_n)
  (sig_valid && !sig_ready) |=> (sig_valid && $stable(sig_kind)
                                           && $stable(sig_hot_reset_bit));
endproperty
a_desc : assert property (p_descriptor_stable);
 
// P4: and the Hot Reset bit is set. Without it the partner receives
// ordinary training sets and no reset occurs (mutation 4).
property p_bit_set;
  @(posedge clk) disable iff (!rst_n) sig_valid |-> sig_hot_reset_bit;
endproperty
a_bit : assert property (p_bit_set);
 
// ---- TRAFFIC AND THE RELEASE -- THE CENTRAL PROPERTIES ----------------
 
// P5: NO NORMAL PACKET TRANSFER DURING HOT RESET, and a packet offered
// remains upstream-owned.
property p_no_transfer;
  @(posedge clk) disable iff (!rst_n)
  hot_reset_active |-> !(up_valid && up_ready);
endproperty
a_noxfer : assert property (p_no_transfer);
 
property p_symmetric;
  @(posedge clk) disable iff (!rst_n)
  (up_valid && up_ready) <-> (down_valid && down_ready);
endproperty
a_sym : assert property (p_symmetric);
 
// P6: TRAFFIC RESUMES ON READINESS, NEVER ON RESET DEASSERTION.
// THE flagship property of this chapter. Section 15 enumerated all 32
// input combinations: `protocol_enable = !hot_reset_active` transmits into
// an untrained Link in 3 of them; this form does so in 0.
property p_enable_needs_ready;
  @(posedge clk) disable iff (!rst_n)
  protocol_enable |-> (!hot_reset_active && local_reset_done
                                         && ltssm_link_ready);
endproperty
a_ready : assert property (p_enable_needs_ready);
 
// P6b: restated as a transfer property, independently of protocol_enable,
// so a miswired enable fails rather than agreeing with itself.
property p_no_transfer_before_ready;
  @(posedge clk) disable iff (!rst_n)
  (up_valid && up_ready) |-> (local_reset_done && ltssm_link_ready);
endproperty
a_noearly : assert property (p_no_transfer_before_ready);
 
// ---- RESET DOMAINS ----------------------------------------------------
 
// P7: EVERY DRIVEN DOMAIN MUST REPORT DONE before clearing completes.
// Proceeding on the first completion releases with state still live
// elsewhere (mutation 14).
property p_all_domains;
  @(posedge clk) disable iff (!rst_n)
  domains_cleared |-> (dll_clear_done && fc_clear_done
                    && ltssm_clear_done && tl_clear_done);
endproperty
a_domains : assert property (p_all_domains);
 
// P7b: DOMAIN RESETS ARE ASSERTED ONLY DURING THE CLEARING PHASE, and only
// for declared domains. Section 7 declines to assert Hot Reset's exact
// Configuration Space scope, so nothing here may drive it (mutation 15).
property p_domain_scope;
  @(posedge clk) disable iff (!rst_n)
  (domain_reset != '0) |-> clearing_phase;
endproperty
a_scope : assert property (p_domain_scope);
 
// P8: A CANDIDATE CONFIGURATION CANNOT BECOME ACTIVE DURING A RESET. The
// configuration being committed describes a Link that is being torn down
// (Chapter 18.5 P14's reasoning, one layer over).
property p_no_commit_during_reset;
  @(posedge clk) disable iff (!rst_n)
  hot_reset_active |-> !$rose(active_config_valid);
endproperty
a_nocommit : assert property (p_no_commit_during_reset);
 
// ---- EPISODE ACCOUNTING -----------------------------------------------
 
// P9: THE SOURCE IS CAPTURED AND STABLE for the episode. Section 16's first
// debugging question depends on local vs remote being trustworthy.
property p_source_stable;
  @(posedge clk) disable iff (!rst_n)
  (hot_reset_active && !episode_pulse) |=> $stable(source);
endproperty
a_src : assert property (p_source_stable);
 
// P10: ONE EPISODE PER RESET, however many times the instruction is
// signalled. Section 15 measured the alternative: a single episode
// over-counted by up to +9, because repeated signalling IS the design.
property p_one_episode;
  @(posedge clk) disable iff (!rst_n)
  (hot_reset_count > $past(hot_reset_count)) |-> $past(episode_pulse);
endproperty
a_episode : assert property (p_one_episode);
 
// P10b: and a pulse cannot occur while an episode is already running.
property p_no_nested;
  @(posedge clk) disable iff (!rst_n)
  (hot_reset_active && !$rose(hot_reset_active)) |-> !episode_pulse;
endproperty
a_nested : assert property (p_no_nested);
 
// P11: STALE DATA LINK STATE IS NOT REUSED. Replay and credit state are
// reset when the Physical Layer goes down (sections 7, 8), so post-reset
// operation must start from reinitialized values.
property p_no_stale_dll;
  @(posedge clk) disable iff (!rst_n)
  $fell(hot_reset_active) |-> ((dut_replay.occupancy == '0)
                            && (dut_fc.credits_initialized == 1'b0));
endproperty
a_dll : assert property (p_no_stale_dll);
 
// P12: PRE-RESET QUALIFICATION HISTORY CANNOT COMPLETE POST-RESET
// QUALIFICATION. Section 15 measured retention: 25.0% of reset points
// qualify prematurely.
property p_no_stale_history;
  @(posedge clk) disable iff (!rst_n)
  episode_restart |=> (count == '0);
endproperty
a_history : assert property (p_no_stale_history);
 
// P13: reset dominates.
property p_reset;
  @(posedge clk)
  !rst_n |=> (!hot_reset_active && !request_pending && !protocol_enable);
endproperty
a_reset : assert property (p_reset);

PHY / electrical evidence
        ↓
LTSSM state
        ↓
normal-link eligibility
        ↓
TLP / DLLP machinery