Host2BMC sits behind the SoC's second PCIe BAR set and lets an external host CPU (BIOS/UEFI/OS) exchange data and notifications with the on-chip BMC. It offers three access styles: BAR1 mailbox queues with doorbell interrupts for short messages, BAR0 a directly-remapped window into BMC DRAM for bulk transfer, and an MMBI segment overlay implementing the DMTF shared-buffer scheme. All PCIe PHY, link training, config cycles and BAR enumeration are handled upstream — this IP only sees clean AXI4 memory transactions relative to a BAR base. It is explicitly documented as not a security boundary: no ECC, parity or authentication; a downstream firewall/IOMMU is required.

• 4-phase LEVEL req/ack CDC locked
  Chosen over a toggle handshake so asymmetric single-domain reset is safe by construction — the toggle version had a phantom-CSR-read bug.
• Doorbell clear = W0C locked
  Preserves datasheet / legacy BMC-BIOS software compatibility.
• Queue depth = 1 (mailbox) locked
  Matches the single 32-bit *_DATA register per datasheet; a Depth param is reserved for future expansion.
• Doorbell auto-set is edge-triggered
  A level trigger would latch permanently at reset (empty = 1).
• MMBI_CFG added as design supplement
  Not in the datasheet — makes segment size software-programmable and verifiable.

All host-side violations — unaligned access, disabled device, BAR0 size = none, MMBI out-of-range, burst to register targets, partial-strobe BAR1 writes, sub-word BAR1 reads — return AXI SLVERR; unmapped APB offsets return pslverr. Downstream non-OKAY responses are clamped to SLVERR. Two interrupt sources, both registered/glitch-free through h2bm_intr_agg with a two-level enable (UNMASK then INT_EN): irq_out (H2B doorbell → BMC) and intr_to_host (B2H doorbell → Host INTA/MSI). No ECC/parity/timeout — declared not a security boundary.

Activity-based clock gating via h2bm_prim_clock_gating: clk_dp for the msgq datapath, gated by the OR of 8 push/pop strobes — zero-latency wake, no wake FSM; and the MMBI cache RAM gated internally by chip-select. CSR, apb2apb, interrupt logic, host-xbar front-end and root clocks are never gated. test_en_i forces bypass for DFT scan.

Figure 1 — host access is decoded once, then fanned on a single bus to the mailbox, BAR0 and MMBI paths; the two doorbell interrupts and the APB CSR path run alongside.

13 documented CSRs across three regions: messaging queue/status 0x000–0x044, MMBI config 0x080/0x084, PCIe config header 0xA10–0xA70. A host-side BAR1 mirror lives at MSG_BAR+0x30000.

Chronological record of the work done on this IP's branch-stan worktree — documentation, constraint authoring, and the Formality clean-up pass.

1. 2026-07-22branch
   Cloned from jenshi/Host2BMC, fast-forwarded to main, then branched branch-stan with a sibling -wt git worktree so main stays untouched.
2. 2026-07-22doc
   One-page design document generated from an RTL + testbench survey of the worktree (interfaces, block diagram, register map, CDC, verification status).
3. 2026-07-23sdc
   Functional SDC set authored — h2bm_top_func_sdc.{clk,const,io}.tcl plus a h2bm_top.func.tcl wrapper. AXI clocks set to 600 MHz; top-controlled uncertainty / fanout / transition constraints removed; -datapath_only guarded so DC-NXT stays quiet.
4. 2026-07-24merged
   Formality read errors (FMR_VLOG-091 → FM-089) fixed by making wmerge() pure and assembling CSR readback in always_comb; the phantom 32-bit write-merge temporaries were hoisted out of the clocked block so RTL-vs-netlist verify passes. Merged to main — PR #4.

As-built signoff runs on a directed self-checking testbench (00_rtl_sim): 57/57 tests TRUE PASS, 0 assertion failures. URG coverage — Line 100% · Cond 93.65% · Toggle 88.52% · FSM 100% · Branch 99.17% · Group 96.78%. Lint (vcst) clean with named/justified waivers only; CDC and RDC report 0 fatal/error/warning; Linux co-sim all TRUE PASS.

A UVM 1.2 environment is planned, not yet run — 02_uvm_tb defines 46 test classes (APB / AXI-host / AXI-slave+mem-model / IRQ-monitor agents, reg model with predictor + adapter, scoreboard + functional coverage), targeting ≥95% functional coverage.

SRAM_ECC gives the SoC a common, RAS-protected SRAM pool. Masters access it over AXI4 (128-bit data, 40-bit address, 8 outstanding) while firmware configures it and observes error state over an APB4 CSR. Protection is a (72,64) Hsiao SECDED codeword per 64-bit granule: a 128-bit beat carries two independent codewords. The pool auto-initializes after reset so it works with zero software configuration, and it boots permissive — ECC and low-power default OFF — so an unprogrammed IP still passes traffic correctly and never stalls at power-on.

• Single-port 1RW SRAM macro locked · D2
  Simpler and smaller than 2P/DP; RMW costs 2 port cycles, hidden by 4-bank interleave.
• Poison-on-uncorrectable-RMW locked · D4 · R11
  An RMW-read UE writes a deliberately-bad codeword + BRESP=SLVERR + log + interrupt, fail-loud until a full-strobe rewrite clears it — untrustworthy partial data is never silently kept.
• AXI outstanding = 8 D1
  Measured sufficient; raising to 16 changes nothing — throughput is bound by 1-cycle turnaround + bank occupancy, not queue depth.
• Fine-grained bank interleave
  bank = addr[OffW+:BankW] spreads consecutive beats across banks to hide RMW cost; no per-bank address-lock table (ordering from in-order issue + bank ready handshake).
• Permissive boot
  SRECC_CTRL resets to 0x00 so AXI↔SRAM works with zero config and can't stall at power-on; auto-init still runs, interrupts stay enabled.

Hsiao decode syndrome distinguishes CE (odd-weight, valid column → auto-corrected) from UE (even nonzero, or ≥3-bit → conservatively flagged). Read UE → RRESP=SLVERR; RMW UE → poison + BRESP=SLVERR; out-of-range → DECERR. A first-error latch (ERR_ADDR/ERR_INFO, W1C re-arm) plus free-running CE/UE counters record events. Four 1-cycle interrupt sources — ce, ue, ue_rmw, init_done — mask through INTR_EN, latch W1C, OR-aggregate, then 2FF to clk_apb. Recovery is a full-strobe rewrite (re-establishes valid ECC, clears poison).

A single core clock gate (u_core_cg) drives clk_core for all banks + wr/rd ctrl + init FSM together; CSR / apb2apb / intr-agg stay on ungated clk_axi. The core stays awake while any AXI valid or reinit is active, else counts down hold_q=4 before sleeping. A wake-safe accept term (active_clk_q & clk_core_en) prevents dropped or double-accepted beats around sleep transitions — a real bug found and fixed in UVM deep-review. Default OFF at reset.

Figure 1 — read/write control feeds the Hsiao ECC codec and the interleaved 1RW bank array; the APB side reaches the CSR and interrupt path across the clock boundary.

11 CSRs, 0x000–0x028, APB4 32-bit — physically in clk_axi via srecc_apb2apb (~7–9 clk_apb cycles per access).

Chronological record of the work done on this IP's branch-stan worktree — documentation, constraint authoring, and the Formality clean-up pass.

1. 2026-07-22branch
   Cloned from jenshi/SRAM_ECC, fast-forwarded to main, then branched branch-stan with a sibling -wt git worktree so main stays untouched.
2. 2026-07-22doc
   One-page design document generated from an RTL + testbench survey of the worktree (interfaces, block diagram, register map, CDC, verification status).
3. 2026-07-23sdc
   Functional SDC set authored — srecc_top_func_sdc.{clk,const,io}.tcl plus a srecc_top.func.tcl wrapper. AXI clocks set to 600 MHz; top-controlled uncertainty / fanout / transition constraints removed; -datapath_only guarded so DC-NXT stays quiet.
4. 2026-07-24reviewed
   Formality scan of srecc_pkg.sv: ecc_decode reviewed and cleared as a false positive — it reads fields of its own local return struct, not module state. No change required.

UVM 1.2 environment (02_uvm_tb): APB (RAL front-door), AXI, passive IRQ, and clk/rst agents; a scoreboard driven by an srecc_mem_model + srecc_ecc_model + CSR predictor; functional coverage; virtual sequencer. 69/69 TRUE PASS — 8 register, 19 functional, 33 error/recovery, 9 random/stress. URG coverage: Line 98.03% · Cond 84.85% · Toggle 88.67% · FSM 100% · Branch 97.76% · Group 93.86% (cg_axi/cg_apb later 100%). Static Lint 0/0 (19 by-design waivers in srecc_prim_*), CDC 0 unwaived (9 crossings), RDC 0 unwaived. Legacy directed TBs still pass (tb_ecc 4737 checks, tb_srecc_top 41). Deep-review caught and fixed a beat-wide poison leak, a sleep-entry ready hole, and a 3-bit-error mis-classification.

RTC maintains century / year / month / day / hour / minute / second as seven counters advanced by a 1 Hz enable pulse, so timekeeping survives deep low-power where the bus clock is stopped. It compares the running time against a programmed alarm to raise a maskable interrupt, and against a wakeup target to drive an always-on wakeup output to the SoC power manager. A runtime-programmable prescaler lets one netlist run at any reference frequency (32.768 kHz, 1 MHz, …) without re-synthesis.

• 1 Hz as an enable pulse, not a divided clock
  No counter runs on a divided/gated clock — psc_sec_tick avoids extra clock domains and glitches.
• Runtime-programmable prescaler (RTC18)
  Divide ratio comes from a register, not a synthesis parameter — one netlist works at any clk_rtc frequency.
• Alarm/wakeup on un-gated clk_rtc
  Their match-history flops must keep tracking during disable, else an en 0→1 could spuriously pulse.
• Day self-correction
  An out-of-range loaded day self-corrects to 1 on the next rollover (day ≥ days_in_month).
• Non-saturating century wrap 31→0
  Gives a 0000–3199 range; Gregorian leap year via century / %4 / %100 / %400.
• No battery domain
  Power retention is the SoC's responsibility, not the RTC's.

Interrupt sources in RTC14, all maskable via RTC10, with irq_out_o the OR of enabled bits: Second/Combination alarm[0], Minute[1], Hour[2], Day[3], Per-second[4] (all W1C), Wakeup[5] (ROH, special-clear: WakeupEn=0 held ≥3 µs). Error behavior: an undefined offset returns pslverr with state unchanged; a Lock=0 write to counters is silently ignored; an illegal prescaler (0/1) is floored to MIN_PRESCALER=2; W1C set wins over clear on the same cycle.

The core clock clk_rtc_core (prescaler + calendar only) is ICG-gated with enable = RtcEn | RtcLock; off when fully disabled, so counters freeze. CSR / intr / wakeup / alarm stay on the un-gated always-on clk_rtc so wakeup works with clk_apb stopped. The gating-enable itself lives in the always-on domain, guaranteeing re-enable takes effect on the next clk_rtc edge.

Figure 1 — the prescaler and calendar sit in the gate-able core; alarm and wakeup compare against running time, one feeding the interrupt, the other the always-on wakeup pin.

6 registers, 0x00–0x18. Full 12-bit decode (paddr[11:8] must be 0), else pslverr.

Chronological record of the work done on this IP's branch-stan worktree — documentation, constraint authoring, and the Formality clean-up pass.

1. 2026-07-22branch
   Cloned from jenshi/RTC, fast-forwarded to main, then branched branch-stan with a sibling -wt git worktree so main stays untouched.
2. 2026-07-22doc
   One-page design document generated from an RTL + testbench survey of the worktree (interfaces, block diagram, register map, CDC, verification status).
3. 2026-07-23sdc
   Functional SDC set authored — rtc_top_func_sdc.{clk,const,io}.tcl plus a rtc_top.func.tcl wrapper. AXI clocks set to 600 MHz; top-controlled uncertainty / fanout / transition constraints removed; -datapath_only guarded so DC-NXT stays quiet.
4. 2026-07-24clean
   Formality scan clean — no function or task reads a non-local module variable. No changes required.

Directed TB (01_tb_top): 6/6 PASS (csr, prescaler, calendar, alarm, wakeup, top). UVM 1.2 (02_uvm_tb): APB (active) + IRQ/wakeup (passive) + clk_rst agents; a 6-register uvm_reg model with golden predictor + scoreboard; functional covergroups for reg fields, leap year, carry boundaries, alarm modes, interrupts and errors. 61/61 TRUE PASS (earlier docs cite 43/43 before the stress/robustness suite was expanded). Coverage target line/cond/toggle/FSM ≥95%, functional 100% of required bins. Lint 0/0 (2 by-design waivers in prim/*), CDC 0 error, RDC 0 error. An unmodified Linux driver (rtc-jmicron.c) co-sims TRUE PASS via DPI-C.

PBMC forwards legal PCIe-side transactions to the BMC AXI fabric and rejects illegal ones locally. The PCIe controller strips each host access down to a BAR-relative offset and tags it with a PID on AxID. PBMC uses that PID to index a base-address table (programmed by firmware) and computes out_addr = base[pid] + offset. Because one AXI slave serves every BAR, the interface count is fixed regardless of how many BARs the device exposes. It is explicitly the reference design that validated the PID method later used by its sister IP, PCIE_MMBI.

• PID-indexed base table, PID = AxID[3:0] locked
  Collapses N BARs onto one slave / one master; interface count is fixed regardless of BAR count.
• Fail-closed default
  Reset → every PID EN=0, SIZE=0 → all accesses DECERR; nothing is reachable until firmware programs and enables it.
• Full burst-extent bound check Rev.6
  Checks the highest byte the whole burst touches, not just the start — remapped output drops PID and AXI4's 4 KB rule can't protect sub-4 KB BARs; cross-PID isolation is enforced only here.
• Built-in error responder
  Rejected transactions never reach BMC; the master FSM locally absorbs the full W burst / generates exactly arlen+1 R beats, so the host handshake always completes (no hang).
• Single-outstanding, write-priority FSM
  Simplest, most verifiable control; deep pipelining deferred (reserved MAXOSTD unused).

A disabled PID returns DECERR; a burst-extent OOB or direction violation returns SLVERR — both raise remap_err. A BMC-returned SLVERR/DECERR is forwarded transparently and raises axi_err. A reserved FIFO-overflow bit is hardwired 0 (unreachable by design). Sources are 1-cycle pulses; clk_axi-origin pulses cross via pulse_sync, latch sticky in W1C IRQ_STAT (HW-set wins), mask through IRQ_EN, then aggregate to the irq_out DFF. Error-capture registers record the last {pid, resp, dir, 40-bit addr}.

The pure-combinational pbmc_lp_ctrl computes idle = ~busy & ~aw_pending & ~ar_pending; when LP_EN=1 and idle it gates only the AXI-master clock (clk_axi_g) via a single ICG cell. CDC and CSR stay always-on for responsiveness. Wake is glitch-free with no added latency; test_mode_i bypasses the ICG for DFT. Fully functionally transparent.

Figure 1 — one AXI slave collapses all BARs by PID and crosses the async-FIFO CDC into the remapping master; legal transactions forward to BMC, illegal ones are absorbed by the internal error-responder. APB programs both CSR halves.

Regions: 0x000–0x00F ID/CTL/STAT (clk_pbmc); 0x010–0x01F IRQ (clk_pbmc); 0x400–0x41F master attrs / error / LP (clk_axi); 0x500–0x5FF the 16-entry PID remap table, stride 0x10 (clk_axi).

Chronological record of the work done on this IP's branch-stan worktree — documentation, constraint authoring, and the Formality clean-up pass.

1. 2026-07-22branch
   Cloned from jenshi/PBMC, fast-forwarded to main, then branched branch-stan with a sibling -wt git worktree so main stays untouched.
2. 2026-07-22doc
   One-page design document generated from an RTL + testbench survey of the worktree (interfaces, block diagram, register map, CDC, verification status).
3. 2026-07-23sdc
   Functional SDC set authored — pbmc_top_func_sdc.{clk,const,io}.tcl plus a pbmc_top.func.tcl wrapper. AXI clocks set to 600 MHz; top-controlled uncertainty / fanout / transition constraints removed; -datapath_only guarded so DC-NXT stays quiet.
4. 2026-07-24clean
   Formality scan clean — CSR helpers already pass their state by argument. No changes required.

UVM 1.2 environment (mirrors the PCIE_MMBI architecture): APB master agent, two AXI agents (PCIe-side master, BMC-side reactive slave + memory model), IRQ monitor, RAL reg model, ref-model-driven scoreboard, functional coverage. The as-built plan (Rev.7) reports 44 tests, all TRUE PASS, with lint / CDC / RDC clean (by-design waivers only). The issued Coverage Sign-off captures the prior 36-test regression: PASS 36 / FAIL 0, SCORE 96.51 · Line 99.67 · Cond 87.74 · Toggle 96.39 · FSM 100.00 · Branch 95.26 · functional group 100.00, every non-100% metric itemized-waived (unmapped address bits, reserved FIFO-overflow bit, QoS/Lock tie-offs, DFT scan-enable, illegal protocol combos). coverage numbers not yet regenerated for the 44-test set

MCTP_VDM is the hardware transport engine for an out-of-band management channel. On receive it filters inbound VDM traffic down to MCTP packets and DMAs them into a DRAM Rx ring; on transmit it reads packets a firmware queued into a Tx ring and pushes them out through the PCIe controller. It maintains the ring pointers and raises completion interrupts, but treats each packet as opaque bytes — it never parses message type, reassembles, or manages endpoint IDs. That keeps the datapath simple and leaves protocol semantics to software.

• No backpressure on inbound VDM locked
  Matches the PCIe core's limitation; reliability shifts entirely to sizing (32-deep async FIFO) + software drain speed + threshold/overflow protection.
• Wrap bit fixed at bit 16
  Not log2(SIZE) — enables a runtime-variable RING_SIZE without changing the pointer format.
• Descriptor-register Tx path
  4× MMIO writes to DESC0-3 + readback compare, halt on mismatch — no auto-retry; software diagnoses via TX_MMIO_RB.
• Two Rx commit modes
  Per-packet vs per-EOM — trades interrupt granularity against message-reassembly latency.
• Physical vs committed occupancy split
  Overflow / threshold use physical (uncommitted) occupancy so mode-1 long messages can't overrun before EOM commits.
• Atomic 40-bit address commit
  Shadow LO/HI + CFG_COMMIT avoids torn values across two APB writes.

Seven W1C interrupt sources: RX_DONE, RX_OVERFLOW (ring full or async-FIFO overrun), TX_DONE, TX_ERR, RX_ALMOST_FULL, TX_ALMOST_FULL, RX_TIMEOUT. Four saturating drop counters classify losses — not-MCTP, EID-mismatch, buffer-full, and error/timeout/AXI. Overflow handling guarantees unread data is never overwritten, and a half-packet timeout auto-recovers with SOM resync in commit mode 1.

An ICG (mvdm_prim_clock_gating) gates the clk_axi Rx/Tx DMA datapath when idle. The clk_vdm_if front-end is never gated — it must watch MSG_VALID continuously, since inbound VDM cannot be back-pressured.

Figure 1 — Rx (solid accent) filters and DMAs inbound VDM into DRAM; Tx (dashed) reads DRAM and streams descriptors to the VDM port. Both share one AXI master, whose completions feed the interrupt aggregator.

44 registers, 0x000–0x0B4, APB4 32-bit within a 4 KB space.

Chronological record of the work done on this IP's branch-stan worktree — documentation, constraint authoring, and the Formality clean-up pass.

1. 2026-07-22branch
   Cloned from jenshi/MCTP_VDM, fast-forwarded to main, then branched branch-stan with a sibling -wt git worktree so main stays untouched.
2. 2026-07-22doc
   One-page design document generated from an RTL + testbench survey of the worktree (interfaces, block diagram, register map, CDC, verification status).
3. 2026-07-23sdc
   Functional SDC set authored — mvdm_top_func_sdc.{clk,const,io}.tcl plus a mvdm_top.func.tcl wrapper. AXI clocks set to 600 MHz; top-controlled uncertainty / fanout / transition constraints removed; -datapath_only guarded so DC-NXT stays quiet.
4. 2026-07-24merged
   Formality fix — wr_mask() made pure, mk_beat() takes bus / byte-enable as arguments, and the NBA tasks in mvdm_rx_dma inlined into the clocked block. VCS regression re-run: PASS. Merged to main — PR #1.
5. 2026-07-27fixed
   DC-NXT VER-720 (a part-select taken on a function-call return) fixed in mvdm_csr_axi: the IRQ_ENABLE write-merge is hoisted to an always_comb net and then sliced. Logically identical and Formality-safe; in branch-stan, not yet merged.

UVM 1.2 environment (VCS X-2025.06-SP2). Agents: APB master, AXI slave (+ DRAM/MMIO memory model), VDM master, IRQ monitor, and three clk/rst. A RAL front/back-door register model drives a reference-model scoreboard. 66 test cases — 11 register, 34 functional, 12 error/recovery, 9 IRQ/CDC/stress — all PASS. Coverage targets: functional ≥95% (error/CDC bins 100%), RAL 100%, code coverage ≥95%. Signoff: all 66 PASS + coverage met + lint/CDC/RDC (VC Static) zero un-waived violations. No open waivers documented in the reviewed set.

PCIE_MMBI is the largest block in the set. It gives the PCIe host and the local BMC firmware a standardized shared-RAM mailbox for MCTP management messages: the host writes packets into a ring through its BAR window, hardware DMA-stages them to BMC DRAM, and interrupts fire in both directions. It layers the DMTF standards precisely — DSP0282 supplies the buffer mechanics (ring buffers, descriptor, interface state machine) and DSP0284 the MCTP binding rules (Null-EID, disallowed control commands, MT timers) — and adds a hardware SPROT access-control block on the host path.

• DSP0282 base + DSP0284 on top
  Buffer mechanics (ring, descriptor, state machine) from DSP0282; MCTP binding rules (Null-EID, disallowed commands, MT timers) from DSP0284 — both fully adopted, not just the binding.
• §37 authoritative HW/FW matrix superseding
  TX packet composition, ring wrap / WP-not-past-RP, and MCTP reassembly / SEQ tracking are firmware-owned; HW does only RX validation, pointer/CDC mechanics, DMA staging and watchdogs.
• SPROT scoped to the host AXI path only
  Not the DMA local port — DMA is trusted BMC traffic with no host PID, so redundant protection on a trusted path is avoided.
• Two hard integration invariants
  H1 (AWID/AWUSER must be a trustworthy SoC-assigned PID) and M1 (ADRMAP for buffer PIDs must be identity, k=0) — SPROT collapses entirely if violated.
• Multi-bit CDC via packed handshake
  Values are never bit-synced; always moved via data_hs req/ack to avoid bit-tearing.

INTR_STAT[11:0] aggregates RXPKT, TXDONE, B2H/H2B_CONSUMED, RESET_REQ/DONE, PROT, DMA_DONE/ERR, CTLRESP, MT and MCTP_ERR, OR'd with INTR_EN into irq_out. The 16 write-monitor doorbell channels (address + value + per-PID mask) raise intr_db[n], gated by SPROT so denied writes never ring. Errors: AXI unmapped → DECERR; SPROT deny → SLVERR + intr_prot; non-atomic control write → SLVERR; DMA/DRAM error → INTR_STAT[8]; MCTP header errors → MMBI_MCTP_ST + [11]; MT timeout → [10]. All recoverable except an AXI-master "dead slave," which needs a full reset.

pmmbi_lowpower gates only the DMA / AXI-master clock (clk_dma_gated) and RAM write clocks via a latch-based ICG; the core clock is never gated (it must stay responsive to async host / doorbell / timer events). LP_CTL.AUTO_CG_EN enables auto-gating when idle = !dma_active; FORCE_ON overrides; IS_IDLE (RO) reports status. Wake-by-construction: the gate enable is combinational off always-on signals.

Figure 1 — the host writes packets down through SPROT into the dual-clock buffer RAM; the core DMA stages them to and from BMC DRAM (WMDA/RMDA), tapped by the MCTP validators, while doorbell and core INTR drive the two interrupt outputs.

Regions: 0x000–0x0FC E2M-compatible core; 0x100–0x1FC host-path (ADRMAP, doorbell); 0x200–0x2FC SPROT ACL; 0x400–0x458 MMBI transport (MCTP cfg, buffer ptrs, MT timers, interrupts, LP). Direct tally: 56 named registers/arrays across 152 addressable 32-bit words.

Chronological record of the work done on this IP's branch-stan worktree — documentation, constraint authoring, and the Formality clean-up pass.

1. 2026-07-22branch
   Cloned from jenshi/PCIE_MMBI, fast-forwarded to main, then branched branch-stan with a sibling -wt git worktree so main stays untouched.
2. 2026-07-22doc
   One-page design document generated from an RTL + testbench survey of the worktree (interfaces, block diagram, register map, CDC, verification status).
3. 2026-07-23sdc
   Functional SDC set authored — pmmbi_top_func_sdc.{clk,const,io}.tcl plus a pmmbi_top.func.tcl wrapper. AXI clocks set to 600 MHz; top-controlled uncertainty / fanout / transition constraints removed; -datapath_only guarded so DC-NXT stays quiet.
4. 2026-07-24merged
   Formality fix — wstrb() / wdata_strb() made pure in pmmbi_csr_axi and pmmbi_csr_pmmbi, with all call sites passing strobe / write-data explicitly. Merged to main — PR #1.
5. 2026-07-28build
   Build filelist fix — pmmbi_axi_master.sv (present on disk and instantiated in pmmbi_top) was missing from flist.py; added so all 28 RTL sources compile.

UVM 1.2 TB: APB agent (BMC), AXI agent (host), memory agent (AXI4 DRAM responder), RAL (reg_block + adapter + passive predictor), and bound SVA (pmmbi_sva, pmmbi_axi_master_sva, pmmbi_data_hs_sva). Note: pmmbi_ref_model is a documented stub, not wired into the scoreboard — correctness comes from inline directed self-checks + SVA rather than a full predictor. 65 delivered tests, all TRUE PASS (Design Spec §21.3 cites 61 — a minor cross-doc inconsistency).

coverage model partially implemented Implemented covergroups: cg_axi, cg_reg_access, cg_dma, cg_interrupt, cg_state, cg_packet. Explicitly not implemented: cg_buffer_state, cg_error, cg_ctlresp, cg_role and 5 named crosses — so the "100% functional bins" target is aspirational, not the current state. Code coverage (URG) 84.71% overall (Line 99.85%, Branch 94.75%). CDC/RDC 0-unwaived with 26 by-design waivers each; lint 0/0 with 5 by-design waivers.