[proj] pwr_mgr V1 signoff

doc/proj/pwrmgr.md

@@ -3,7 +3,8 @@
 The Power manager in Mocha is generated with `ipgen` from the OpenTitan `pwrmgr` IP template.
 The documentation for the hardware IP block is its [theory of operation][theory], [register mapping][registers] and block [README][block doc].
 The register mapping documentation is currently an empty stub but it will be generated once `cmdgen` is imported, as part of [issue #706][cmdgen].
-It sequences the chip's power, clock and reset resources through cold boot, low power entry and exit, and reset, and releases the CPU once the ROM integrity check has passed.
+It sequences the chip's power, clock and reset resources through cold boot and reset, and releases the CPU once the ROM integrity check has passed.
+The IP also supports low power entry and exit, but Mocha does not use them.
 The [Mocha configuration][ipconfig] declares one external wakeup and the main power glitch, escalation, non-debug-module and external peripheral reset requests, with `main` and `io` as the source clocks.
 The [vendor patches][patch] add the Mocha fast-to-slow clock ratio, fix DV paths and the default simulator, follow the single-field reset status and enable registers of the Mocha configuration, and replace hard-coded reset request indices with the generated parameters; the logic is unchanged.
 
@@ -43,7 +44,26 @@ This sign-off is based on commit [`5d7a249`][d1-commit].
 
 ### V1
 
-*Not yet started - see [stages.md][verification stages].*
+All checklist items refer to the [V1 verification sign-off checklist][V1 checklist].
+This sign-off is based on commit [`5d7a249`][v1-commit].
+
+| Type          | Item                               | Status | Note/Collaterals |
+|---------------|------------------------------------|--------|------------------|
+| Documentation | DV_DOC_DRAFT_COMPLETED             | Done   | [Power manager DV document][] describes the goals, testbench architecture, stimulus, coverage, and checking strategy. It is template text that has not been regenerated for Mocha: it lists the six Earlgrey wakeups rather than the single `ext_wkup_req`, and eight of its links point at a `top_mocha` path in the OpenTitan repository that does not exist. Acceptable as a V1 draft. Tracked by [issue #751][dv readme issue] for V2 |
+| Documentation | TESTPLAN_COMPLETED                 | Done   | [Power manager testplan][] defines the V1 smoke test and post-V1 wakeup, clock control, low power abort, reset, power glitch and stress testpoints |
+| Testbench     | TB_TOP_CREATED                     | Done   | [tb.sv][] instantiates the four clocks, TileLink, power manager, interrupt, alert and escalation interfaces along with the power manager DUT |
+| Testbench     | PRELIMINARY_ASSERTION_CHECKS_ADDED | Done   | [pwrmgr_bind.sv][] binds the TLUL protocol, CSR, clock enable and clock manager handshake assertions, and [pwrmgr_unit_only_bind.sv][] the reset manager handshake assertions; the power manager RTL checks that outputs are known after reset |
+| Integration   | PRE_VERIFIED_SUB_MODULES_V1        | Waived | The Power manager and its primitive submodules (`prim_intr_hw`, `prim_subreg`, etc.) and TileLink adapters (`tlul_adapter_reg`, `tlul_cmd_intg_chk`, etc.) are generated from the OpenTitan template, where the block reached V2S ([OpenTitan power manager checklist][]) |
+| Review        | DESIGN_SPEC_REVIEWED               | Done   | The specification was reviewed through the OpenTitan sign-off process, and the [theory of operation][theory] was reviewed against the Mocha instantiation for this sign-off. It describes the two state machines and the power-up, reset and low power sequences correctly, but it is written for the OpenTitan configuration: Mocha has no AST, `otp_ctrl`, `lc_ctrl`, `flash_ctrl`, alert handler or pinmux, so the handshakes with those blocks and the wakeup and reset requests that come from them are tied off, and CVA6-CHERI does not export the WFI indication the document expects from Ibex. Mocha's power domains and the inputs they listen to are described in the [power domains section][arch power] of the architecture document |
+| Review        | TESTPLAN_REVIEWED                  | Done   | The generated [OpenTitan power manager checklist][] records the testplan review as complete upstream. The [Power manager testplan][] is identical to the one in `ip_templates/pwrmgr` and has not been regenerated for Mocha: its V1 testpoints, `smoke` and the imported CSR testpoints, apply as written, but the V2 `control_clks` testpoint describes a usb clock that Mocha does not have, and no testpoint covers the single `ext_wkup_req` wakeup or the `rst_req_external` reset request. Those gaps are out of V1 scope and must be closed before V2 |
+| Review        | STD_TEST_CATEGORIES_PLANNED        | Done   | Reset, escalation, main power glitch, invalid state and stress tests are covered in the [Power manager testplan][]; debug, power and performance are N/A |
+| Simulation    | SIM_TB_ENV_CREATED                 | Done   | CIP-based UVM environment with TL agent and scoreboard |
+| Tests         | SIM_SMOKE_TEST_PASSING             | Done   | `pwrmgr_smoke`: 50/50 passed with Xcelium on September 30, 2026 at commit `5d7a249` |
+| Regression    | SIM_SMOKE_REGRESSION_SETUP         | Done   | `smoke` regression in `pwrmgr_sim_cfg.hjson` selects `pwrmgr_smoke`; the aggregate Mocha config imports the power manager simulation config |
+| Regression    | SIM_NIGHTLY_REGRESSION_SETUP       | Done   | The Power manager is included in `mocha_sim_cfgs.hjson`, so it runs as part of the aggregate nightly regression; results are published on the [COSMIC reports dashboard][] |
+| Coverage      | SIM_COVERAGE_MODEL_ADDED           | Done   | Block-level coverage is in `pwrmgr_env_cov.sv` |
+| Tests         | FPV_MAIN_ASSERTIONS_PROVEN         | N/A    | This V1 sign-off uses simulation; TLUL and CSR assertions are enabled in the simulation testbench |
+| Regression    | FPV_REGRESSION_SETUP               | N/A    | No Power manager FPV regression is configured in Mocha |
 
 ### V2
 
@@ -61,11 +81,22 @@ This sign-off is based on commit [`5d7a249`][d1-commit].
 [OpenTitan D1 sign-off]: https://github.com/lowRISC/opentitan/pull/24191
 [D1 checklist]: stages.md#d1-design-sign-off-checklist
 [d1-commit]: https://github.com/lowRISC/mocha/commit/5d7a249ac6caa60464ea64192ed9e418292edfb6
+[V1 checklist]: stages.md#v1-verification-sign-off-checklist
+[v1-commit]: https://github.com/lowRISC/mocha/commit/5d7a249ac6caa60464ea64192ed9e418292edfb6
 [theory]: ../../hw/top_chip/ip_autogen/pwrmgr/doc/theory_of_operation.md
 [pguide]: ../../hw/top_chip/ip_autogen/pwrmgr/doc/programmers_guide.md
 [registers]: ../../hw/top_chip/ip_autogen/pwrmgr/doc/registers.md
 [csrs]: ../../hw/top_chip/ip_autogen/pwrmgr/data/pwrmgr.hjson
 [ipconfig]: ../../hw/top_chip/data/pwrmgr_cfg.hjson
+[arch power]: ../ref/arch.md#power-domains
 [cmdgen]: https://github.com/lowRISC/mocha/issues/706
+[dv readme issue]: https://github.com/lowRISC/mocha/issues/751
 [output asserts]: https://github.com/lowRISC/mocha/blob/5d7a249ac6caa60464ea64192ed9e418292edfb6/hw/top_chip/ip_autogen/pwrmgr/rtl/pwrmgr.sv#L703-L715
 [patch]: ../../hw/vendor/patches/lowrisc_ip/pwrmgr
+[Power manager DV document]: ../../hw/top_chip/ip_autogen/pwrmgr/dv/README.md
+[Power manager testplan]: ../../hw/top_chip/ip_autogen/pwrmgr/data/pwrmgr_testplan.hjson
+[tb.sv]: ../../hw/top_chip/ip_autogen/pwrmgr/dv/tb.sv
+[pwrmgr_bind.sv]: ../../hw/top_chip/ip_autogen/pwrmgr/dv/sva/pwrmgr_bind.sv
+[pwrmgr_unit_only_bind.sv]: ../../hw/top_chip/ip_autogen/pwrmgr/dv/sva/pwrmgr_unit_only_bind.sv
+[COSMIC reports dashboard]: https://dashboard.reports.lowrisc.org/cosmic/mocha/dashboard.html
+[OpenTitan power manager checklist]: ../../hw/top_chip/ip_autogen/pwrmgr/doc/checklist.md

doc/proj/stages.md

@@ -22,7 +22,7 @@ This table shows the current design and verification stage for each block in Moc
 | [I2C][]               | D1               | V1                     |
 | [Mailbox][]           | D1               | V0                     |
 | [PLIC][]              | D1               | V0                     |
-| [Power manager][]     | D1               | V0                     |
+| [Power manager][]     | D1               | V1                     |
 | [Reset manager][]     | D1               | V0                     |
 | [ROM control][]       | D1               | V0                     |
 | [SPI device][]        | D1               | V0                     |

doc/ref/arch.md

@@ -18,6 +18,26 @@ There are three clock domains in Mocha.<!-- rfj4pd_x -->
    Both the main and IO clocks can be disabled and are turned off when a system reset is requested.<!-- 68url6_x -->
    The always on clock drives the clock, reset and power managers and allows the system to come out of reset.<!-- w5ylk6_x -->
 
+## Power domains
+
+Mocha has two power domains, `Aon` and `Main`.<!-- ng5cds_x -->
+The always on domain is always powered and clocked and holds the clock, reset and power managers.<!-- 57toat_x -->
+The rest of Mocha sits in the main domain, which can be clock or power gated to enter a low power state while the always on domain waits for a wakeup.<!-- boexf1_x -->
+Nothing in Mocha needs to be powered independently of those two, so there are no further domains, and the reset tree and the clock enables are organised per domain.<!-- 84r0bb_x -->
+
+The always on domain listens to:<!-- bdqdkb_x -->
+
+1. A power good indication for the main domain and a validity indication for each source clock.<!-- lvtp3p_x -->
+   The main domain has to be held in reset until its supply and its clocks are stable, and a later loss of main power has to take the chip through a full reset rather than let it carry on.<!-- qwm70c_x -->
+2. An external reset request, so that a surrounding SoC can reset the enclave, and an external wakeup request, so that it can bring the main domain back from low power.<!-- e2k9ck_x -->
+3. A reset request from the debug module, which has to reset the main domain without resetting the debug module itself, as described under [reset domains](#reset-domains).<!-- cdyqu3_x -->
+4. An indication that the core is idle, as low power may only be entered once software has asked for it and the core has stopped executing.<!-- tefcy6_x -->
+5. The result of the ROM integrity check, which has to pass before the core is released and the ROM is made reachable.<!-- 1fywj5_x -->
+6. DFT enable and debug enable, which still need to be hooked up to the top.<!-- lz4jh2_x -->
+
+Mocha ties the power and clock indications, the external requests and the idle indication off, so it boots straight into its running state and takes a hardware reset request only from the debug module.<!-- nmyhcg_x -->
+CVA6-CHERI reports nothing when it stops executing either, so low power cannot be entered at all and the main domain is always powered.<!-- 6qzz27_x -->
+
 ## Memory map
 
 This is the current memory map for Mocha, where the base and top addresses are inclusive, and reserved is the amount of memory reserved for this function:<!-- mcbp27_x -->