L1 — Deeper Power, Coordinated Entry, and a Drain That Must Complete First

L1  (LTSSM major state, this chapter)
└── L1.1 / L1.2  (optional deeper refinements, driven by the PM state machine)

4.  Transmit PM_ENTER_L1 DLLPs UNTIL PM_REQ_ACK is received
5.  Core directs LTSSM state machine to L1

logical Link context   — negotiated identity; survives L1 (§1)
analog PHY state       — implementation- and mode-dependent; do not assume

step               1     2     3     4     5     6     7     8     9    10    11    12
policy_l1_req      1     1     0     0     0     0     0     0     0     0     0     0
tlp_tx_blocked     0     1     1     1     1     1     1     1     1     1     1     0
inflight_tlps      2     2     1     0     0     0     0     0     0     0     0     0
replay_occupancy   3     3     3     2     0     0     0     0     0     0     0     0
drain_done         0     0     0     0     1     1     1     1     1     1     1     1
 
pm_enter_l1_tx     0     0     0     0     1     1     0     0     0     0     0     0
pm_req_ack_rx      0     0     0     0     0     1     0     0     0     0     0     0
in_l1              0     0     0     0     0     0     1     1     1     1     0     0
 
up_valid           0     0     0     0     0     0     0     1     1     1     1     1
up_ready           0     0     0     0     0     0     0     0     0     0     0     1
wake_pending       0     0     0     0     0     0     0     1     1     1     1     0
phy_exit_done      0     0     0     0     0     0     0     0     0     1     1     1
link_operational   1     1     1     1     1     1     0     0     0     0     0     1

// SYNTHESIZABLE. Normalized L1 types.
// THE TWO ENTRY PATHS are sourced (section 6). The enum encoding is
// internal -- it appears on no PCIe wire.
package l1_pkg;
 
  typedef enum logic [1:0] {
    L1R_NONE       = 2'd0,
    L1R_ASPM       = 2'd1,   // hardware-autonomous, link idle for the period
    L1R_PM_DIRECTED= 2'd2,   // software wrote a non-D0 power state
    L1R_REMOTE     = 2'd3    // the partner requested; we are responding
  } l1_entry_reason_e;
 
  // Wake causes as a BITMASK -- several can be true at once, the same
  // reasoning as Chapter 18.5's Recovery cause register.
  typedef struct packed {
    logic local_tx_pending;   // section 1: "a TLP is pending"
    logic remote_wake;        // section 1: "exited due to link partner activity"
    logic pm_exit_request;    // software moved the device back toward D0
    logic link_event;         // link-down, reset, directed transition
  } l1_wake_t;
 
  function automatic bit any_wake(input l1_wake_t w); return (|w); endfunction
 
  // THE DRAIN CONTRACT (section 7). All three, in this order of strictness.
  function automatic bit drain_complete(input logic tx_blocked,
                                        input logic no_inflight,
                                        input logic replay_empty);
    return tx_blocked && no_inflight && replay_empty;
  endfunction
 
endpackage

import l1_pkg::*;
 
// SYNTHESIZABLE. Own one L1 entry request.
// THE REQUEST IS NOT ISSUED UNTIL THE DRAIN COMPLETES (section 7). A
// request issued earlier would ask the partner to sleep while this end
// still has unacknowledged TLPs -- and the acknowledgement can never
// arrive once both directions are idle.
module l1_entry_owner (
  input  logic clk,
  input  logic rst_n,
 
  input  logic             policy_enable,
  input  logic             idle_period_met,   // ASPM path
  input  logic             pm_non_d0,         // software-directed path
  input  logic             remote_request,    // we are the responder
 
  // ---- Drain status, from the Data Link Layer (Chapter 15.1) -------------
  input  logic             tx_blocked,
  input  logic             no_inflight_tlps,
  input  logic             replay_empty,
 
  input  logic             abort,             // link-down, wake, reset
 
  output logic             entry_req_valid,
  input  logic             entry_req_ready,
  output l1_entry_reason_e entry_reason,
  output logic             entry_committed,
 
  // Sourced in section 8: the partner may say no, and that is NORMAL.
  input  logic             entry_refused,
  output logic             refused_sticky
);
 
  logic             req_q, done_q, refused_q;
  l1_entry_reason_e reason_q;
 
  assign entry_req_valid = req_q;
  assign entry_reason    = reason_q;     // CAPTURED, stable while requesting
  assign entry_committed = done_q;
  assign refused_sticky  = refused_q;
 
  wire drained = drain_complete(tx_blocked, no_inflight_tlps, replay_empty);
 
  // PRIORITY IS DECLARED: a software-directed entry outranks an autonomous
  // one, and responding to the partner outranks initiating.
  wire [1:0] want = remote_request ? 2'd3
                  : pm_non_d0      ? 2'd2
                  : (policy_enable && idle_period_met) ? 2'd1 : 2'd0;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      req_q <= 1'b0; done_q <= 1'b0; refused_q <= 1'b0; reason_q <= L1R_NONE;
    end else if (abort) begin
      // Checked first. Clears only an UN-ACCEPTED request -- once the
      // macro takes it, entry is happening and the exit path reverses it.
      req_q <= 1'b0; done_q <= 1'b0;
    end else begin
      if (!req_q && !done_q) begin
        // ==========================================================
        // THE DRAIN GATES THE REQUEST. Note `drained` is required even
        // for the remote-responder path: section 1's Downstream Port
        // flow drains BEFORE transmitting PM_REQ_ACK, exactly as the
        // initiator drains before PM_ENTER_L1.
        // ==========================================================
        if ((want != 2'd0) && drained) begin
          req_q    <= 1'b1;
          reason_q <= l1_entry_reason_e'(want);   // captured once
        end
      end else if (req_q && entry_req_ready) begin
        // Dropped on the HANDSHAKE, never on a later "entry done".
        req_q <= 1'b0; done_q <= 1'b1;
      end
 
      // A REFUSAL IS RECORDED, NOT ESCALATED (section 8, mutation 16).
      if (entry_refused) begin
        req_q     <= 1'b0;
        refused_q <= 1'b1;
      end
      // NOTE: policy_enable or idle_period_met dropping does NOT withdraw
      // an outstanding request -- Chapter 18.7 section 14's rule.
    end
  end
 
endmodule

import l1_pkg::*;
 
// SYNTHESIZABLE. One power-state transaction with the PHY macro.
// SECTION 1's L1_TO_L0 is the evidence for the exit half: "wait for PHY to
// indicate exit from L1 complete". Asking is not arriving.
//
// THIS IS THE SAME OWNERSHIP PATTERN as Chapter 18.2's detection owner,
// Chapter 18.5's rate owner and Chapter 18.7's electrical-idle owner --
// deliberately identical, because the problem is identical.
module phy_pm_owner #(
  parameter int PM_W = 3
) (
  input  logic clk,
  input  logic rst_n,
 
  input  logic            start,
  input  logic [PM_W-1:0] target,      // requested PHY power state
 
  output logic            req_valid,
  input  logic            req_ready,
  output logic [PM_W-1:0] req_target,
 
  input  logic            done,        // CANNOT be backpressured
  input  logic            success,
 
  output logic            result_valid,
  output logic            result_success,
  output logic            unowned_done
);
 
  typedef enum logic [1:0] { S_IDLE, S_ISSUE, S_WAIT, S_REPORT } st_e;
  st_e st_q;
  logic [PM_W-1:0] tgt_q;
  logic ok_q, unowned_q;
 
  // ==================================================================
  // req_valid IS TRUE ONLY IN S_ISSUE, and S_ISSUE is left on the
  // HANDSHAKE. Section 20 measured the alternative over 2,396,744
  // sequences: 452,512 double-accepts plus 588,768 results with no
  // accepted request.
  // ==================================================================
  assign req_valid      = (st_q == S_ISSUE);
  assign req_target     = tgt_q;              // captured, never re-read
  assign result_valid   = (st_q == S_REPORT);
  assign result_success = ok_q;
  assign unowned_done   = unowned_q;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      st_q <= S_IDLE; tgt_q <= '0; ok_q <= 1'b0; unowned_q <= 1'b0;
    end else begin
      unique case (st_q)
        S_IDLE : begin
          if (start) begin tgt_q <= target; st_q <= S_ISSUE; end
          if (done)  unowned_q <= 1'b1;     // reported, never consumed
        end
        S_ISSUE : if (req_ready) st_q <= S_WAIT;
        S_WAIT  : if (done) begin ok_q <= success; st_q <= S_REPORT; end
        S_REPORT: st_q <= S_IDLE;
        default : st_q <= S_IDLE;
      endcase
    end
  end
 
endmodule

import l1_pkg::*;
 
// SYNTHESIZABLE. Capture every wake cause; hold until the controller owns it.
// SECTION 1 sources two triggers: "a TLP is pending" and "exited due to
// link partner activity". A lost wake means a packet waits FOREVER --
// nothing at this layer times it out.
module l1_wake_latch (
  input  logic clk,
  input  logic rst_n,
  input  logic in_l1,
 
  input  logic pending_packet,   // LEVEL, from the gate below
  input  logic remote_wake,      // PULSE, from the PHY
  input  logic pm_exit_request,  // LEVEL, software heading back to D0
  input  logic link_event,       // PULSE
 
  input  logic exit_taken,
 
  output l1_wake_t wake_reason,
  output logic     wake_pending
);
 
  l1_wake_t r_q; logic p_q;
  assign wake_reason = r_q; assign wake_pending = p_q;
 
  wire now = pending_packet | remote_wake | pm_exit_request | link_event;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      r_q <= '0; p_q <= 1'b0;
    end else if (exit_taken) begin
      p_q <= 1'b0;              // consumed exactly once; reason kept readable
    end else if (in_l1 && now) begin
      // ACCUMULATE, never replace -- local and remote wakes coincide often
      // on a bidirectional workload (Chapter 18.7 section 16).
      r_q.local_tx_pending <= r_q.local_tx_pending | pending_packet;
      r_q.remote_wake      <= r_q.remote_wake      | remote_wake;
      r_q.pm_exit_request  <= r_q.pm_exit_request  | pm_exit_request;
      r_q.link_event       <= r_q.link_event       | link_event;
      p_q <= 1'b1;
    end
  end
 
endmodule

import l1_pkg::*;
 
// SYNTHESIZABLE. L1-only controller.
// THESE ARE IMPLEMENTATION-FACING NORMALIZED PHASES, not PCIe LTSSM
// substate encoding. Section 1 verifies L1.Idle and the exit handshake;
// it does not publish the transition criteria a normative encoding needs.
module l1_controller (
  input  logic clk,
  input  logic rst_n,
 
  input  logic entry_committed,
  input  logic pm_low_power_done,   // PHY reached the low-power state
  input  logic wake_pending,
  input  logic pm_active_done,      // section 1's "PHY exit from L1 complete"
  input  logic resync_done,         // symbol lock, BOTH directions (section 9)
  input  logic link_down,
 
  output logic in_l1,
  output logic exit_taken,
  output logic start_pm_low,
  output logic start_pm_active,
  output logic ready_for_l0
);
 
  typedef enum logic [2:0] {
    S_L0, S_ENTER_PHY, S_RESIDENT, S_EXIT_PHY, S_RESYNC, S_DONE
  } st_e;
  st_e st_q;
 
  // in_l1 EXCLUDES S_DONE and S_RESYNC's completion, so the traffic gate
  // cannot reopen before lock is restored in both directions.
  assign in_l1           = (st_q inside {S_ENTER_PHY, S_RESIDENT,
                                         S_EXIT_PHY, S_RESYNC});
  assign exit_taken      = (st_q == S_RESIDENT) && wake_pending;
  assign start_pm_low    = (st_q == S_ENTER_PHY);
  assign start_pm_active = (st_q == S_EXIT_PHY);
  assign ready_for_l0    = (st_q == S_DONE);
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n)          st_q <= S_L0;
    else if (link_down)  st_q <= S_L0;      // dominates everything
    else begin
      unique case (st_q)
        S_L0        : if (entry_committed)   st_q <= S_ENTER_PHY;
        // A wake during entry is honoured only AFTER the PHY command
        // completes -- interrupting it leaves the macro state unknown.
        S_ENTER_PHY : if (pm_low_power_done) st_q <= S_RESIDENT;
        S_RESIDENT  : if (wake_pending)      st_q <= S_EXIT_PHY;
        S_EXIT_PHY  : if (pm_active_done)    st_q <= S_RESYNC;
        // BOTH DIRECTIONS must re-lock (section 9). Returning to L0 on
        // pm_active_done alone is mutation 10.
        S_RESYNC    : if (resync_done)       st_q <= S_DONE;
        S_DONE      :                        st_q <= S_L0;
        default     :                        st_q <= S_L0;
      endcase
    end
  end
 
endmodule

// SYNTHESIZABLE. The same gate as Chapters 18.6 and 18.7, sixth instance.
// A PACKET ARRIVING IN L1 MUST REMAIN UPSTREAM-OWNED. Section 20
// enumerated it: 1 of 8 state/valid/ready combinations destroys the packet
// when up_ready is ungated -- and in L1 the window is the longest yet,
// because L1 residency is measured in microseconds.
module l1_traffic_gate #(parameter int W = 256) (
  input  logic         link_operational,
  input  logic         up_valid,
  input  logic [W-1:0] up_payload,
  output logic         up_ready,
  output logic         down_valid,
  output logic [W-1:0] down_payload,
  input  logic         down_ready,
  output logic         pending_packet
);
  assign down_valid     = up_valid   && link_operational;
  assign up_ready       = down_ready && link_operational;
  assign down_payload   = up_payload;
  // An OUTPUT observation. Nothing flows back into up_ready -- no
  // combinational loop, and no path by which wanting to wake could
  // cause the packet to be accepted.
  assign pending_packet = up_valid   && !link_operational;
endmodule

import l1_pkg::*;
 
// SYNTHESIZABLE. Silicon-debug instrumentation.
// SATURATING, and driven by EDGES -- Chapter 18.6 section 15's rule. A
// counter driven by the level reports residency cycles as entries, which
// is one of the most common metrics bugs in any state machine.
module l1_diag #(parameter int CYC_W = 32, parameter int EVT_W = 16) (
  input  logic clk,
  input  logic rst_n,
  input  logic in_l1,
  input  logic l1_entry_pulse,
  input  logic l1_exit_pulse,
  input  logic exit_failed,
  input  l1_entry_reason_e entry_reason,
  input  l1_wake_t         wake_reason,
  input  logic refused_pulse,
  input  logic clear,
 
  output logic [EVT_W-1:0] l1_entry_count,
  output logic [EVT_W-1:0] l1_exit_count,
  output logic [EVT_W-1:0] l1_refused_count,
  output logic [EVT_W-1:0] l1_exit_fail_count,
  output logic [CYC_W-1:0] l1_cycles,
  output l1_entry_reason_e last_entry_reason,
  output l1_wake_t         last_wake_reason
);
 
  logic [EVT_W-1:0] ent_q, exi_q, ref_q, fail_q;
  logic [CYC_W-1:0] cyc_q;
  l1_entry_reason_e er_q;
  l1_wake_t         wr_q;
 
  assign {l1_entry_count, l1_exit_count}      = {ent_q, exi_q};
  assign {l1_refused_count, l1_exit_fail_count} = {ref_q, fail_q};
  assign l1_cycles          = cyc_q;
  assign last_entry_reason  = er_q;
  assign last_wake_reason   = wr_q;
 
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || clear) begin
      ent_q <= '0; exi_q <= '0; ref_q <= '0; fail_q <= '0; cyc_q <= '0;
      er_q  <= L1R_NONE; wr_q <= '0;
    end else begin
      if (in_l1          && !(&cyc_q))  cyc_q  <= cyc_q  + CYC_W'(1);
      if (l1_entry_pulse && !(&ent_q)) begin
        ent_q <= ent_q + EVT_W'(1);
        er_q  <= entry_reason;   // WHY this episode began (section 6)
      end
      if (l1_exit_pulse  && !(&exi_q)) begin
        exi_q <= exi_q + EVT_W'(1);
        wr_q  <= wake_reason;
      end
      // A REFUSAL IS COUNTED, NOT ESCALATED (section 8).
      if (refused_pulse  && !(&ref_q))  ref_q  <= ref_q  + EVT_W'(1);
      if (exit_failed    && !(&fail_q)) fail_q <= fail_q + EVT_W'(1);
    end
  end
 
endmodule

// SVA over the L1 blocks. LOCAL contract only. Nothing asserts that L1 is
// ever entered, that a wake succeeds, or that the partner cooperates.
 
// ---- ENVIRONMENT ------------------------------------------------------
assume property (@(posedge clk) disable iff (!rst_n)
  (up_valid && !up_ready) |=> (up_valid && $stable(up_payload)));
assume property (@(posedge clk) disable iff (!rst_n) remote_wake |=> !remote_wake);
 
// ---- ENTRY, AND THE DRAIN ---------------------------------------------
 
// P1: THE REQUEST IS NEVER ISSUED BEFORE THE DRAIN COMPLETES. Section 7's
// precondition, and the property that keeps L1 compatible with Chapter
// 15.1's replay machinery.
property p_no_request_before_drain;
  @(posedge clk) disable iff (!rst_n)
  $rose(entry_req_valid) |-> (tx_blocked && no_inflight_tlps && replay_empty);
endproperty
a_drain : assert property (p_no_request_before_drain);
 
// P1b: specifically, the replay buffer. Stated separately because waiting
// only for the transmit path to idle is the plausible wrong version.
property p_replay_empty;
  @(posedge clk) disable iff (!rst_n)
  entry_req_valid |-> replay_empty;
endproperty
a_replay : assert property (p_replay_empty);
 
// P2: request held under stall; P3: reason stable throughout the episode.
property p_held;
  @(posedge clk) disable iff (!rst_n)
  (entry_req_valid && !entry_req_ready && !abort && !entry_refused)
    |=> entry_req_valid;
endproperty
a_held : assert property (p_held);
 
property p_reason_stable;
  @(posedge clk) disable iff (!rst_n)
  (entry_req_valid || entry_committed) |=> $stable(entry_reason)
    || $past(abort) || $past(entry_refused);
endproperty
a_reason : assert property (p_reason_stable);
 
// P4: PHY PM target stable under stall.
property p_target_stable;
  @(posedge clk) disable iff (!rst_n)
  (req_valid && !req_ready) |=> (req_valid && $stable(req_target));
endproperty
a_target : assert property (p_target_stable);
 
// P5: ONE START, AT MOST ONE ACCEPTANCE.
property p_single_issue;
  @(posedge clk) disable iff (!rst_n)
  (req_valid && req_ready) |=> !req_valid until_with start;
endproperty
a_single : assert property (p_single_issue);
 
// P6: an unowned PM completion cannot advance state.
property p_unowned;
  @(posedge clk) disable iff (!rst_n)
  (done && (st_q == S_IDLE)) |=> (unowned_done && !result_valid);
endproperty
a_unowned : assert property (p_unowned);
 
// ---- PACKET OWNERSHIP -- the central pair -----------------------------
 
// P7: no normal packet transfer in L1.
property p_no_transfer;
  @(posedge clk) disable iff (!rst_n) in_l1 |-> !(up_valid && up_ready);
endproperty
a_noxfer : assert property (p_no_transfer);
 
// P8: a packet valid in L1 stays upstream-owned.
property p_survives;
  @(posedge clk) disable iff (!rst_n)
  (up_valid && in_l1) |=> (up_valid || $past(up_ready));
endproperty
a_survive : assert property (p_survives);
 
// P9: no loss, stated symmetrically.
property p_symmetric;
  @(posedge clk) disable iff (!rst_n)
  (up_valid && up_ready) <-> (down_valid && down_ready);
endproperty
a_sym : assert property (p_symmetric);
 
// P10: and it raises a wake. SEPARATE from P7 -- wanting to wake is not
// accepting the packet.
property p_wakes;
  @(posedge clk) disable iff (!rst_n)
  (up_valid && in_l1) |-> pending_packet;
endproperty
a_wake : assert property (p_wakes);
 
// ---- WAKE PRESERVATION ------------------------------------------------
 
// P11: a wake cannot disappear before the controller owns it.
property p_wake_held;
  @(posedge clk) disable iff (!rst_n)
  (wake_pending && !exit_taken) |=> wake_pending;
endproperty
a_wheld : assert property (p_wake_held);
 
// P12: consumed exactly once; P13: cause accumulates, never substitutes.
property p_wake_once;
  @(posedge clk) disable iff (!rst_n)
  (wake_pending && exit_taken) |=> !wake_pending;
endproperty
a_wonce : assert property (p_wake_once);
 
property p_wake_monotonic;
  @(posedge clk) disable iff (!rst_n)
  (wake_pending && !exit_taken)
    |=> ((wake_reason & $past(wake_reason)) == $past(wake_reason));
endproperty
a_wmono : assert property (p_wake_monotonic);
 
// P14: STALE WAKE FROM A PRIOR EPISODE IS CLEARED. A wake left set would
// make the next L1 entry exit immediately (mutation 17).
property p_no_stale_wake;
  @(posedge clk) disable iff (!rst_n)
  $rose(in_l1) |-> !$past(wake_pending);
endproperty
a_stale : assert property (p_no_stale_wake);
 
// ---- EXIT AND STATE INTEGRITY -----------------------------------------
 
// P15: BOTH-DIRECTION RESYNC IS REQUIRED before returning to L0.
property p_resync_required;
  @(posedge clk) disable iff (!rst_n)
  $rose(ready_for_l0) |-> $past(resync_done);
endproperty
a_resync : assert property (p_resync_required);
 
// P16: L1 never reports normal traffic enabled.
property p_not_operational;
  @(posedge clk) disable iff (!rst_n) in_l1 |-> !link_operational;
endproperty
a_notop : assert property (p_not_operational);
 
// P17: THE COMMITTED CONFIGURATION SURVIVES AN L1 EPISODE UNCHANGED, and
// cannot partially mutate. Section 9's teaching contract.
property p_config_intact;
  @(posedge clk) disable iff (!rst_n)
  (in_l1 && !link_down) |=> ($stable(active_speed) && $stable(active_width)
                                                   && $stable(active_lane_map));
endproperty
a_cfg : assert property (p_config_intact);
 
// P18: L1 and L0s are mutually exclusive in the normalized local model.
property p_not_both;
  @(posedge clk) disable iff (!rst_n) !(in_l1 && dut_l0s.in_l0s);
endproperty
a_excl : assert property (p_not_both);
 
// P19: link-down dominates a completed exit.
property p_linkdown;
  @(posedge clk) disable iff (!rst_n)
  link_down |=> (!in_l1 && !entry_req_valid);
endproperty
a_down : assert property (p_linkdown);
 
// P20: entry counted once per entry, not per residency cycle.
property p_entry_count;
  @(posedge clk) disable iff (!rst_n)
  (l1_entry_count > $past(l1_entry_count)) |-> $past(l1_entry_pulse);
endproperty
a_cnt : assert property (p_entry_count);
 
// P21: reset.
property p_reset;
  @(posedge clk) !rst_n |=> (!in_l1 && !wake_pending && !entry_req_valid);
endproperty
a_reset : assert property (p_reset);

pending_packet / remote_wake   did anything ask?      -> §16 gate, PHY
wake_pending                   was it LATCHED?        -> §16, P11
exit_taken                     did the controller own it? -> §16
start_pm_active                was the PHY commanded? -> §15
pm_active_done                 did the PHY return?    -> the macro
resync_done                    did BOTH ends re-lock? -> §9
link_operational               did the gate reopen?   -> §16