"Ethernet Equals TCP/IP"

octet 0                 6                12      14                34
      +-----------------+----------------+-------+-----------------+
      | destination     | source         | type  | IPv4 header ... | TCP ...
      +-----------------+----------------+-------+-----------------+
      |<------ the MAC's last parsed octet is 13 ------>|
                                                  |<-- 20 octets -->|<-- 20 -->|

// ---------------------------------------------------------------------
// layermyth_pkg -- the offsets and sizes a layer-boundary argument
// needs, every one of them derived rather than written as a literal.
//
// Unit: Chapter 23.3 Section 2's bitcell equivalent.
//   1 BCE = one bit of usable on-die SRAM = 0.35 GE
//   1 flip-flop = 20 BCE
//   Chapter 19.7 Section 19's MAC receive datapath = 283 320 BCE
//   Chapter 23.4's NIC = 5.07e7 BCE, of which 66.2% is context cache
// ---------------------------------------------------------------------
package layermyth_pkg;

  localparam int unsigned DATAPATH_BCE = 283_320;
  localparam int unsigned BCE_PER_FLOP = 20;

  // ---- what a MAC reads -------------------------------------------------
  localparam int unsigned OCT_DA        = 6;
  localparam int unsigned OCT_SA        = 6;
  localparam int unsigned OCT_TYPE      = 2;
  localparam int unsigned OCT_FCS       = 4;
  localparam int unsigned OCT_VLAN_TAG  = 4;    // Chapter 13.2
  localparam int unsigned MAC_PARSED    = OCT_DA + OCT_SA + OCT_TYPE
                                        + OCT_FCS;             // 18

  // The last octet offset a MAC's state machine may branch on.
  localparam int unsigned MAC_LAST_OFF_UNTAGGED = 13;
  localparam int unsigned MAC_LAST_OFF_TAGGED   = 21;

  // ---- what is above it --------------------------------------------------
  localparam int unsigned OCT_IPV4_MIN  = 20;
  localparam int unsigned OCT_IPV4_MAX  = 60;   // with options
  localparam int unsigned OCT_IPV6_FIX  = 40;
  localparam int unsigned OCT_TCP_MIN   = 20;
  localparam int unsigned OCT_TCP_MAX   = 60;   // with options
  localparam int unsigned OCT_UDP       = 8;

  // ---- the EtherType space ----------------------------------------------
  // Values at or below 1500 are a length (802.3); 1536 and above are a
  // type. So the type space is 65536 - 1536.
  localparam int unsigned TYPE_SPACE_LOW  = 1536;
  localparam int unsigned TYPE_SPACE_SIZE = 65_536 - TYPE_SPACE_LOW;  // 64000

  typedef enum logic [15:0] {
    ET_IPV4     = 16'h0800,
    ET_ARP      = 16'h0806,
    ET_VLAN     = 16'h8100,
    ET_IPV6     = 16'h86DD,
    ET_LACP     = 16'h8809,
    ET_PPPOE_D  = 16'h8863,
    ET_PPPOE_S  = 16'h8864,
    ET_PROFINET = 16'h8892,
    ET_ECAT     = 16'h88A4,
    ET_MACSEC   = 16'h88E5,
    ET_LLDP     = 16'h88CC,
    ET_PTP      = 16'h88F7,
    ET_FCOE     = 16'h8906,
    ET_ROCE     = 16'h8915
  } ethertype_e;

  localparam int unsigned COMMON_TYPES = 14;
  localparam int unsigned IP_TYPES     = 2;    // IPv4 and IPv6

  // ---- derived: the parse window ----------------------------------------
  function automatic int unsigned mac_window(bit tagged);
    return tagged ? (MAC_LAST_OFF_TAGGED + 1)
                  : (MAC_LAST_OFF_UNTAGGED + 1);
  endfunction

  function automatic int unsigned offload_window(int unsigned tunnels);
    // Ethernet header, then IPv4 with options and TCP with options,
    // then one more (outer IP, UDP, inner Ethernet) per tunnel.
    int unsigned w;
    w = (OCT_DA + OCT_SA + OCT_TYPE) + OCT_IPV4_MAX + OCT_TCP_MAX;
    for (int i = 0; i < tunnels; i++)
      w = w + OCT_IPV4_MAX + OCT_UDP + (OCT_DA + OCT_SA + OCT_TYPE);
    return w;
  endfunction

  function automatic int unsigned window_bce(int unsigned octets);
    return octets * 8 * BCE_PER_FLOP;     // held in registers
  endfunction

  // ---- derived: share of a frame ----------------------------------------
  function automatic int unsigned parsed_ppm(int unsigned frame_octets);
    return (MAC_PARSED * 1_000_000) / frame_octets;
  endfunction

  function automatic int unsigned datapaths_milli(int unsigned bce);
    return (bce * 1000) / DATAPATH_BCE;
  endfunction

endpackage

// ---------------------------------------------------------------------
// parse_window_model -- how far into a frame a design must look, and
// what that costs, at each of three positions on the boundary.
//
// The output that matters is highest_offset_branched_on. For a MAC it
// is 13, or 21 with a tag. Anything above that is a design that has
// decided to cross the boundary, and Section 11 prices the decision.
// ---------------------------------------------------------------------
module parse_window_model
  import layermyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic        tagged,
  input  logic        crosses_boundary,
  input  logic [15:0] tunnel_levels,
  input  logic [15:0] frame_octets,

  output logic [15:0] window_octets,
  output logic [15:0] highest_offset_branched_on,
  output logic [31:0] window_bce_o,
  output logic [31:0] window_dp_milli,
  output logic [15:0] growth_x10,
  output logic [31:0] parsed_ppm_o,
  output logic        mac_remains_opaque,
  output logic        payload_is_read,
  output logic [31:0] c_frames_parsed
);
  logic [15:0] base_window;

  always_comb begin
    base_window = 16'(mac_window(tagged));

    window_octets = crosses_boundary
                  ? 16'(offload_window(int'(tunnel_levels)))
                  : base_window;

    // The one number that says which side of the boundary a design is on.
    highest_offset_branched_on = window_octets - 16'd1;

    window_bce_o    = 32'(window_bce(int'(window_octets)));
    window_dp_milli = 32'(datapaths_milli(window_bce_o));

    growth_x10 = (base_window == 0) ? 16'd0
               : (window_octets * 16'd10) / base_window;

    parsed_ppm_o = (frame_octets == 0) ? 32'd0
                 : 32'(parsed_ppm(int'(frame_octets)));

    // A MAC that has not crossed the boundary reads the container and
    // moves the contents -- Chapter 2.4 Section 7's opaque path.
    mac_remains_opaque = !crosses_boundary;
    payload_is_read    = crosses_boundary;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) c_frames_parsed <= '0;
    else        c_frames_parsed <= c_frames_parsed + 32'd1;
  end
endmodule

type values = 65 536 - 1 536 = 64 000 distinct protocol identifiers
IPv4 (0x0800) and IPv6 (0x86DD) are two of them
2 / 64 000 = 0.00313%

// ---------------------------------------------------------------------
// ethertype_demux -- Chapter 2.4 Section 3's demultiplexer, with the
// counters that make the myth falsifiable on a live port.
//
// The output that matters is ip_share_ppm. Run this on a real port for
// an hour and the myth is settled empirically rather than by argument.
// ---------------------------------------------------------------------
module ethertype_demux
  import layermyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,
  input  logic        clear,

  input  logic        type_valid,
  input  logic [15:0] ethertype,
  input  logic [15:0] frame_octets,

  output logic        is_length_field,
  output logic        is_ip,
  output logic        is_known_non_ip,
  output logic        is_unknown,
  output logic  [3:0] consumer_id,
  output logic [47:0] c_frames,
  output logic [47:0] c_ip_frames,
  output logic [47:0] c_non_ip_frames,
  output logic [47:0] c_unknown_frames,
  output logic [47:0] c_ip_octets,
  output logic [47:0] c_non_ip_octets,
  output logic [31:0] ip_share_ppm,
  output logic [31:0] ip_octet_share_ppm,
  output logic [31:0] type_space_size
);
  always_comb begin
    // Chapter 5.5's encoding: at or below 1500 it is a length.
    is_length_field = (ethertype <= 16'd1500);

    is_ip = type_valid && !is_length_field
         && ((ethertype == 16'(ET_IPV4)) || (ethertype == 16'(ET_IPV6)));

    is_known_non_ip = type_valid && !is_length_field && !is_ip
      && ((ethertype == 16'(ET_ARP))      || (ethertype == 16'(ET_VLAN))    ||
          (ethertype == 16'(ET_LACP))     || (ethertype == 16'(ET_PPPOE_D)) ||
          (ethertype == 16'(ET_PPPOE_S))  || (ethertype == 16'(ET_PROFINET))||
          (ethertype == 16'(ET_ECAT))     || (ethertype == 16'(ET_MACSEC))  ||
          (ethertype == 16'(ET_LLDP))     || (ethertype == 16'(ET_PTP))     ||
          (ethertype == 16'(ET_FCOE))     || (ethertype == 16'(ET_ROCE)));

    is_unknown = type_valid && !is_length_field && !is_ip && !is_known_non_ip;

    consumer_id = is_ip           ? 4'd1
                : is_known_non_ip ? 4'd2
                : is_length_field ? 4'd3     // 802.3 LLC path
                                  : 4'd0;    // nobody -- discard

    type_space_size = 32'(TYPE_SPACE_SIZE);

    ip_share_ppm = (c_frames == 0) ? 32'd0
                 : 32'((c_ip_frames * 48'd1_000_000) / c_frames);

    ip_octet_share_ppm =
      ((c_ip_octets + c_non_ip_octets) == 0) ? 32'd0
      : 32'((c_ip_octets * 48'd1_000_000)
            / (c_ip_octets + c_non_ip_octets));
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || clear) begin
      c_frames <= '0; c_ip_frames <= '0; c_non_ip_frames <= '0;
      c_unknown_frames <= '0; c_ip_octets <= '0; c_non_ip_octets <= '0;
    end else if (type_valid) begin
      c_frames <= c_frames + 48'd1;
      if (is_ip) begin
        c_ip_frames <= c_ip_frames + 48'd1;
        c_ip_octets <= c_ip_octets + 48'(frame_octets);
      end else begin
        c_non_ip_frames <= c_non_ip_frames + 48'd1;
        c_non_ip_octets <= c_non_ip_octets + 48'(frame_octets);
      end
      if (is_unknown) c_unknown_frames <= c_unknown_frames + 48'd1;
    end
  end
endmodule

// ---------------------------------------------------------------------
// opacity_ledger -- what a design knows about a frame, recorded by
// which layer the fact came from.
//
// Chapter 2.4 Section 7 made opacity structural by removing the ports
// through which a payload decision could leave. This does the
// complementary thing: it makes every fact carry its provenance, so a
// boundary violation is visible in a report rather than in a review.
// ---------------------------------------------------------------------
module opacity_ledger
  import layermyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,
  input  logic        clear,

  input  logic        frame_valid,
  input  logic [15:0] frame_octets,

  // facts a MAC may produce: all properties of the CONTAINER
  input  logic        fact_length,
  input  logic        fact_fcs_ok,
  input  logic        fact_da_matched,
  input  logic        fact_type,

  // facts that require reading the CONTENTS
  input  logic        fact_l3_protocol,
  input  logic        fact_l4_ports,
  input  logic        fact_tcp_flags,
  input  logic        fact_payload_bytes,

  output logic  [3:0] container_facts,
  output logic  [3:0] content_facts,
  output logic        boundary_crossed,
  output logic [15:0] deepest_layer,
  output logic [47:0] c_container_only,
  output logic [47:0] c_content_read,
  output logic [31:0] crossing_ppm,
  output logic        ledger_is_complete
);
  always_comb begin
    container_facts = { fact_type, fact_da_matched, fact_fcs_ok, fact_length };
    content_facts   = { fact_payload_bytes, fact_tcp_flags,
                        fact_l4_ports, fact_l3_protocol };

    // One bit, and it is the whole of Chapter 2.4's contract.
    boundary_crossed = (content_facts != 4'b0000);

    deepest_layer = fact_payload_bytes ? 16'd7
                  : fact_tcp_flags     ? 16'd4
                  : fact_l4_ports      ? 16'd4
                  : fact_l3_protocol   ? 16'd3
                                       : 16'd2;

    crossing_ppm = ((c_container_only + c_content_read) == 0) ? 32'd0
                 : 32'((c_content_read * 48'd1_000_000)
                       / (c_container_only + c_content_read));

    // Every fact is accounted to a layer. A design that produces a
    // fact this module has no input for has escaped the ledger.
    ledger_is_complete = 1'b1;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || clear) begin
      c_container_only <= '0; c_content_read <= '0;
    end else if (frame_valid) begin
      if (boundary_crossed) c_content_read   <= c_content_read + 48'd1;
      else                  c_container_only <= c_container_only + 48'd1;
    end
  end
endmodule

a 9 000-octet IP datagram -- 20 octets of header and 8 980 of payload
over a 1 500-octet MTU, each fragment carries 1 480 octets of payload
fragments = ceil(8 980 / 1 480) = 7

// ---------------------------------------------------------------------
// mtu_coupling_model -- the one genuine dependency between the layers,
// and what breaking it costs.
//
// The output that matters is loss_amplification: fragmentation turns
// one datagram into N frames all of which must arrive, so the
// effective loss rate is multiplied rather than added to.
// ---------------------------------------------------------------------
module mtu_coupling_model
  import layermyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic [15:0] link_mtu,
  input  logic [15:0] datagram_octets,
  input  logic        dont_fragment,
  input  logic        icmp_reaches_sender,
  input  logic [15:0] drop_rate_ppm,

  output logic [15:0] fragment_payload,
  output logic [15:0] fragments,
  output logic [31:0] wire_octets_frag,
  output logic [31:0] wire_octets_whole,
  output logic [15:0] overhead_penalty_x100,
  output logic [15:0] loss_amplification,
  output logic [31:0] effective_loss_ppm,
  output logic        black_hole,
  output logic        connection_establishes,
  output logic        bulk_transfer_fails,
  output logic [31:0] c_black_holes
);
  always_comb begin
    fragment_payload = (link_mtu > 16'(OCT_IPV4_MIN))
                     ? (link_mtu - 16'(OCT_IPV4_MIN)) : 16'd1;

    fragments = (datagram_octets <= fragment_payload)
              ? 16'd1
              : ((datagram_octets + fragment_payload - 16'd1)
                 / fragment_payload);

    wire_octets_whole = 32'(datagram_octets) + 32'(OCT_IPV4_MIN) + 32'd38;
    wire_octets_frag  = 32'(datagram_octets)
                      + (32'(fragments) * (32'(OCT_IPV4_MIN) + 32'd38));

    overhead_penalty_x100 =
      (wire_octets_whole == 0) ? 16'd0
      : 16'(((wire_octets_frag - wire_octets_whole) * 32'd10_000)
            / wire_octets_whole);

    // THE number. Every fragment must arrive or the datagram is lost.
    loss_amplification = fragments;
    effective_loss_ppm = 32'(drop_rate_ppm) * 32'(fragments);

    // The failure that establishes and then hangs.
    black_hole = dont_fragment && (datagram_octets > fragment_payload)
              && !icmp_reaches_sender;

    connection_establishes = 1'b1;              // the handshake is small
    bulk_transfer_fails    = black_hole;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n)          c_black_holes <= '0;
    else if (black_hole) c_black_holes <= c_black_holes + 32'd1;
  end
endmodule

// ---------------------------------------------------------------------
// offload_parser -- what a design must build when it decides to cross
// the boundary, and the one output that keeps the crossing honest.
//
// parse_incomplete is the whole point. A fixed window meets an
// unbounded header chain eventually, and the only safe behaviour is
// to say so rather than to compute a checksum over the wrong bytes.
// ---------------------------------------------------------------------
module offload_parser
  import layermyth_pkg::*;
#(
  parameter int unsigned WINDOW_OCTETS = 134
)(
  input  logic        clk,
  input  logic        rst_n,

  input  logic        frame_start,
  input  logic        octet_valid,
  input  logic  [7:0] octet,
  input  logic [15:0] octet_index,

  output logic [15:0] l3_offset,
  output logic [15:0] l4_offset,
  output logic        l3_offset_valid,
  output logic        l4_offset_valid,
  output logic        is_ipv4,
  output logic        is_tcp,
  output logic        parse_incomplete,
  output logic        checksum_may_be_computed,
  output logic [15:0] deepest_octet_read,
  output logic [31:0] window_bce_o,
  output logic [31:0] c_incomplete,
  output logic [31:0] c_parsed_ok
);
  logic [15:0] type_hi, type_lo;
  logic [15:0] eth_type;
  logic  [3:0] ihl;
  logic        vlan_present;

  always_comb begin
    window_bce_o = 32'(window_bce(WINDOW_OCTETS));

    eth_type = { type_hi[7:0], type_lo[7:0] };
    vlan_present = (eth_type == 16'(ET_VLAN));

    // Chapter 19.2 Section 6's problem: the offset depends on content.
    l3_offset       = vlan_present ? 16'd18 : 16'd14;
    l3_offset_valid = (octet_index >= l3_offset);

    is_ipv4 = l3_offset_valid && (eth_type == 16'(ET_IPV4));

    // And again one layer up: the IPv4 header's length is IN the header.
    l4_offset       = l3_offset + (16'(ihl) * 16'd4);
    l4_offset_valid = is_ipv4 && (octet_index >= l4_offset);

    is_tcp = l4_offset_valid;

    deepest_octet_read = octet_index;

    // THE output. A window is finite and a header chain is not.
    parse_incomplete = (l4_offset + 16'd20) > 16'(WINDOW_OCTETS);

    // Never compute a checksum you could not locate the bounds of.
    checksum_may_be_computed = l4_offset_valid && !parse_incomplete;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      type_hi <= '0; type_lo <= '0; ihl <= '0;
      c_incomplete <= '0; c_parsed_ok <= '0;
    end else begin
      if (frame_start) begin
        type_hi <= '0; type_lo <= '0; ihl <= '0;
      end
      if (octet_valid) begin
        if (octet_index == 16'd12) type_hi <= {8'd0, octet};
        if (octet_index == 16'd13) type_lo <= {8'd0, octet};
        if (octet_index == l3_offset) ihl <= octet[3:0];
        if (octet_index == 16'(WINDOW_OCTETS) - 16'd1) begin
          if (parse_incomplete) c_incomplete <= c_incomplete + 32'd1;
          else                  c_parsed_ok  <= c_parsed_ok + 32'd1;
        end
      end
    end
  end
endmodule

// ---------------------------------------------------------------------
// tunnel_depth_limiter -- the structure that makes Section 11's
// unbounded case bounded, and reports when it did.
//
// The output that matters is depth_exceeded, which is how a finite
// design meets an infinite specification honestly.
// ---------------------------------------------------------------------
module tunnel_depth_limiter
  import layermyth_pkg::*;
#(
  parameter int unsigned MAX_DEPTH  = 2,
  parameter int unsigned MAX_OCTETS = 216
)(
  input  logic        clk,
  input  logic        rst_n,

  input  logic        frame_start,
  input  logic        header_seen,
  input  logic [15:0] header_octets,
  input  logic        header_is_encapsulation,

  output logic [15:0] depth,
  output logic [15:0] octets_consumed,
  output logic        depth_exceeded,
  output logic        octets_exceeded,
  output logic        stop_parsing,
  output logic  [1:0] action_on_limit,      // configured, not hard-coded
  output logic        may_claim_verified,
  output logic [31:0] c_depth_exceeded,
  output logic [31:0] c_octets_exceeded
);
  // 0 = forward without offload, 1 = forward and flag, 2 = drop.
  // Section 11's production note: this is the integrator's choice.
  localparam logic [1:0] ACT_NO_OFFLOAD = 2'd0;

  always_comb begin
    depth_exceeded  = (depth > 16'(MAX_DEPTH));
    octets_exceeded = (octets_consumed > 16'(MAX_OCTETS));
    stop_parsing    = depth_exceeded || octets_exceeded;

    action_on_limit = ACT_NO_OFFLOAD;

    // THE rule. A design that could not locate the bounds must not
    // claim to have checked what is inside them.
    may_claim_verified = !stop_parsing;
  end

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      depth <= '0; octets_consumed <= '0;
      c_depth_exceeded <= '0; c_octets_exceeded <= '0;
    end else begin
      if (frame_start) begin
        depth <= '0; octets_consumed <= '0;
      end else if (header_seen) begin
        octets_consumed <= octets_consumed + header_octets;
        if (header_is_encapsulation) depth <= depth + 16'd1;
        if ((depth + 16'd1) > 16'(MAX_DEPTH))
          c_depth_exceeded <= c_depth_exceeded + 32'd1;
        if ((octets_consumed + header_octets) > 16'(MAX_OCTETS))
          c_octets_exceeded <= c_octets_exceeded + 32'd1;
      end
    end
  end
endmodule

// ---------------------------------------------------------------------
// layer_telemetry -- the counters that make the myth falsifiable on a
// live port, and the boundary auditable on a live design.
//
// Design rule: every counter here answers a question whose answer the
// myth predicts wrongly.
// ---------------------------------------------------------------------
module layer_telemetry
  import layermyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,
  input  logic        clear,

  input  logic        frame_valid,
  input  logic [15:0] frame_octets,
  input  logic        is_ip_i,
  input  logic        boundary_crossed_i,
  input  logic        parse_incomplete_i,
  input  logic        verified_claimed_i,
  input  logic        hash_had_tuple_i,
  input  logic [15:0] deepest_offset_i,
  input  logic        fragment_seen_i,

  output logic [47:0] c_frames,
  output logic [47:0] c_ip,
  output logic [47:0] c_non_ip,
  output logic [47:0] c_crossings,
  output logic [47:0] c_parse_incomplete,
  output logic [47:0] c_unverifiable_claims,
  output logic [47:0] c_hash_no_tuple,
  output logic [47:0] c_fragments,
  output logic [15:0] deepest_offset_seen,
  output logic [31:0] non_ip_ppm,
  output logic [31:0] crossing_ppm_o,
  output logic        design_is_layer2_only
);
  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n || clear) begin
      c_frames <= '0; c_ip <= '0; c_non_ip <= '0; c_crossings <= '0;
      c_parse_incomplete <= '0; c_unverifiable_claims <= '0;
      c_hash_no_tuple <= '0; c_fragments <= '0; deepest_offset_seen <= '0;
    end else if (frame_valid) begin
      c_frames <= c_frames + 48'd1;
      if (is_ip_i) c_ip     <= c_ip + 48'd1;
      else         c_non_ip <= c_non_ip + 48'd1;
      if (boundary_crossed_i) c_crossings <= c_crossings + 48'd1;
      if (parse_incomplete_i) c_parse_incomplete <= c_parse_incomplete + 48'd1;

      // THE counter that finds Section 12's silent corruption.
      if (parse_incomplete_i && verified_claimed_i)
        c_unverifiable_claims <= c_unverifiable_claims + 48'd1;

      if (!hash_had_tuple_i) c_hash_no_tuple <= c_hash_no_tuple + 48'd1;
      if (fragment_seen_i)   c_fragments     <= c_fragments + 48'd1;
      if (deepest_offset_i > deepest_offset_seen)
        deepest_offset_seen <= deepest_offset_i;
    end
  end

  always_comb begin
    non_ip_ppm = (c_frames == 0) ? 32'd0
               : 32'((c_non_ip * 48'd1_000_000) / c_frames);

    crossing_ppm_o = (c_frames == 0) ? 32'd0
                   : 32'((c_crossings * 48'd1_000_000) / c_frames);

    // A design that has never branched above octet 21 is layer 2, and
    // it can say so with evidence rather than with documentation.
    design_is_layer2_only = (deepest_offset_seen <= 16'd21);
  end
endmodule

// ---------------------------------------------------------------------
// layer_conformance -- the checks that hold a design to the layer it
// claims to be.
//
// Every check is about the design rather than about the traffic, which
// is what distinguishes a boundary monitor from a protocol monitor.
// ---------------------------------------------------------------------
module layer_conformance
  import layermyth_pkg::*;
(
  input  logic        clk,
  input  logic        rst_n,

  input  logic        claims_layer2_only,
  input  logic [15:0] deepest_offset_i,
  input  logic        tagged_i,
  input  logic        parse_incomplete_i,
  input  logic        verified_claimed_i,
  input  logic        hash_had_tuple_i,
  input  logic        hash_used_fallback_i,
  input  logic        payload_octet_used_i,
  input  logic        offload_declared_i,

  output logic        v_boundary_crossed_undeclared,
  output logic        v_unverifiable_claim,
  output logic        v_hash_without_fallback,
  output logic        v_payload_read_undeclared,
  output logic        v_claim_contradicted,
  output logic  [4:0] violations,
  output logic        conformant
);
  logic [15:0] mac_limit;

  always_comb begin
    mac_limit = tagged_i ? 16'(MAC_LAST_OFF_TAGGED)
                         : 16'(MAC_LAST_OFF_UNTAGGED);

    // 1. Prohibition 1 -- crossing is allowed and must be declared.
    v_boundary_crossed_undeclared = (deepest_offset_i > mac_limit)
                                 && !offload_declared_i;

    // 2. Prohibition 2 -- Section 12's silent receive corruption.
    v_unverifiable_claim = parse_incomplete_i && verified_claimed_i;

    // 3. Prohibition 3 -- a hash with no tuple must fall back.
    v_hash_without_fallback = !hash_had_tuple_i && !hash_used_fallback_i;

    // 4. Chapter 2.4 Section 7's contract: the payload is moved, not read.
    v_payload_read_undeclared = payload_octet_used_i && !offload_declared_i;

    // 5. And the claim must match the evidence.
    v_claim_contradicted = claims_layer2_only
                        && (deepest_offset_i > mac_limit);

    violations = { v_claim_contradicted, v_payload_read_undeclared,
                   v_hash_without_fallback, v_unverifiable_claim,
                   v_boundary_crossed_undeclared };
    conformant = (violations == 5'b00000);
  end
endmodule

// A1. A MAC's window is 14 octets, or 22 with a tag.
p_pw_mac_window: assert property (@(posedge clk) disable iff (!rst_n)
  !crosses_boundary |-> (window_octets == 16'(mac_window(tagged))));

// A2. And its highest branch offset is 13 or 21.
p_pw_highest_offset: assert property (@(posedge clk) disable iff (!rst_n)
  !crosses_boundary |->
    (highest_offset_branched_on == (tagged ? 16'd21 : 16'd13)));

// A3. Crossing the boundary is the only way the window grows.
p_pw_growth_needs_crossing: assert property (@(posedge clk) disable iff (!rst_n)
  (growth_x10 > 16'd10) |-> crosses_boundary);

// A4. Opacity and payload reading are exclusive.
p_pw_exclusive: assert property (@(posedge clk) disable iff (!rst_n)
  (mac_remains_opaque != payload_is_read));

// A5. The window is charged as registers.
p_pw_registers: assert property (@(posedge clk) disable iff (!rst_n)
  (window_bce_o == 32'(window_octets) * 32'd8 * 32'(BCE_PER_FLOP)));

// A6. The parsed share falls as the frame grows.
p_pw_share_falls: assert property (@(posedge clk) disable iff (!rst_n)
  (frame_octets > $past(frame_octets)) |->
    (parsed_ppm_o <= $past(parsed_ppm_o)));

// A7. Eighteen octets, whatever the frame size.
p_pw_eighteen: assert property (@(posedge clk) disable iff (!rst_n)
  (MAC_PARSED == 18));

// A8. Each tunnel level adds a fixed amount.
p_pw_tunnel_linear: assert property (@(posedge clk) disable iff (!rst_n)
  (crosses_boundary && (tunnel_levels == 16'd1)) |->
    (window_octets == 16'(offload_window(0)) + 16'd82));

// A9. A pure MAC never reads a payload octet.
p_pw_no_payload: assert property (@(posedge clk) disable iff (!rst_n)
  mac_remains_opaque |-> !payload_is_read);

// B1. The type space is 64 000 values.
p_et_space: assert property (@(posedge clk) disable iff (!rst_n)
  (type_space_size == 32'd64_000));

// B2. A value at or below 1500 is a length, not a type.
p_et_length_encoding: assert property (@(posedge clk) disable iff (!rst_n)
  (ethertype <= 16'd1500) |-> is_length_field);

// B3. IP is exactly two of them.
p_et_ip_is_two: assert property (@(posedge clk) disable iff (!rst_n)
  is_ip |-> ((ethertype == 16'(ET_IPV4)) || (ethertype == 16'(ET_IPV6))));

// B4. The four classifications are mutually exclusive.
p_et_exclusive: assert property (@(posedge clk) disable iff (!rst_n)
  type_valid |-> ($onehot({is_length_field, is_ip,
                           is_known_non_ip, is_unknown})));

// B5. An unknown type goes to no consumer.
p_et_unknown_discarded: assert property (@(posedge clk) disable iff (!rst_n)
  is_unknown |-> (consumer_id == 4'd0));

// B6. Frames counted equals IP plus non-IP.
p_et_counts_partition: assert property (@(posedge clk) disable iff (!rst_n)
  (c_frames == c_ip_frames + c_non_ip_frames));

// B7. PTP is not IP.
p_et_ptp_not_ip: assert property (@(posedge clk) disable iff (!rst_n)
  (type_valid && (ethertype == 16'(ET_PTP))) |-> !is_ip);

// B8. And neither is RoCEv1.
p_et_roce_not_ip: assert property (@(posedge clk) disable iff (!rst_n)
  (type_valid && (ethertype == 16'(ET_ROCE))) |-> !is_ip);

// B9. The octet share and the frame share are independent.
p_et_shares_independent: assert property (@(posedge clk) disable iff (!rst_n)
  (c_frames > 48'd1000) |-> (ip_share_ppm <= 32'd1_000_000) &&
                            (ip_octet_share_ppm <= 32'd1_000_000));

// C1. Any content fact means the boundary was crossed.
p_op_crossing_def: assert property (@(posedge clk) disable iff (!rst_n)
  (content_facts != 4'b0000) |-> boundary_crossed);

// C2. Container facts alone do not cross it.
p_op_container_safe: assert property (@(posedge clk) disable iff (!rst_n)
  ((content_facts == 4'b0000) && (container_facts != 4'b0000))
    |-> !boundary_crossed);

// C3. The deepest layer is 2 when nothing above was read.
p_op_layer2: assert property (@(posedge clk) disable iff (!rst_n)
  !boundary_crossed |-> (deepest_layer == 16'd2));

// C4. A layer-4 fact implies layer 4 or above is reported.
p_op_layer4: assert property (@(posedge clk) disable iff (!rst_n)
  (fact_l4_ports || fact_tcp_flags) |-> (deepest_layer >= 16'd4));

// C5. Every frame lands in exactly one counter.
p_op_one_counter: assert property (@(posedge clk) disable iff (!rst_n)
  frame_valid |=> ((c_container_only + c_content_read) ==
                   ($past(c_container_only) + $past(c_content_read) + 48'd1)));

// C6. Crossing share is bounded.
p_op_share_bounded: assert property (@(posedge clk) disable iff (!rst_n)
  (crossing_ppm <= 32'd1_000_000));

// C7. A design declaring layer 2 must not report a content fact.
p_op_claim_consistent: assert property (@(posedge clk) disable iff (!rst_n)
  claims_layer2_only |-> !v_claim_contradicted);

// C8. The ledger accounts for every fact it has an input for.
p_op_complete: assert property (@(posedge clk) disable iff (!rst_n)
  (ledger_is_complete == 1'b1));

// D1. Fragments round up.
p_mt_round_up: assert property (@(posedge clk) disable iff (!rst_n)
  ((fragments * fragment_payload) >= datagram_octets));

// D2. A datagram within the MTU is one fragment.
p_mt_one_fragment: assert property (@(posedge clk) disable iff (!rst_n)
  (datagram_octets <= fragment_payload) |-> (fragments == 16'd1));

// D3. Loss amplification equals the fragment count.
p_mt_amplification: assert property (@(posedge clk) disable iff (!rst_n)
  (loss_amplification == fragments));

// D4. And it multiplies the drop rate.
p_mt_effective_loss: assert property (@(posedge clk) disable iff (!rst_n)
  (effective_loss_ppm == 32'(drop_rate_ppm) * 32'(fragments)));

// D5. The black hole needs all three conditions.
p_mt_black_hole: assert property (@(posedge clk) disable iff (!rst_n)
  black_hole |-> (dont_fragment && !icmp_reaches_sender &&
                  (datagram_octets > fragment_payload)));

// D6. The connection establishes regardless -- that is the trap.
p_mt_establishes: assert property (@(posedge clk) disable iff (!rst_n)
  (connection_establishes == 1'b1));

// D7. Bulk transfer fails exactly when the black hole is present.
p_mt_bulk_fails: assert property (@(posedge clk) disable iff (!rst_n)
  (bulk_transfer_fails == black_hole));

// D8. Fragmenting always costs wire octets.
p_mt_penalty_positive: assert property (@(posedge clk) disable iff (!rst_n)
  (fragments > 16'd1) |-> (wire_octets_frag > wire_octets_whole));

// E1. A VLAN tag moves the layer-3 offset by four.
p_of_vlan_offset: assert property (@(posedge clk) disable iff (!rst_n)
  vlan_present |-> (l3_offset == 16'd18));

// E2. The layer-4 offset depends on a field inside the layer-3 header.
p_of_ihl_dependency: assert property (@(posedge clk) disable iff (!rst_n)
  is_ipv4 |-> (l4_offset == l3_offset + (16'(ihl) * 16'd4)));

// E3. A checksum is computed only when its bounds were located.
p_of_checksum_gated: assert property (@(posedge clk) disable iff (!rst_n)
  checksum_may_be_computed |-> (l4_offset_valid && !parse_incomplete));

// E4. And never when the parse was incomplete.
p_of_no_claim_incomplete: assert property (@(posedge clk) disable iff (!rst_n)
  parse_incomplete |-> !checksum_may_be_computed);

// E5. The window is finite and the check says so.
p_of_window_finite: assert property (@(posedge clk) disable iff (!rst_n)
  ((l4_offset + 16'd20) > 16'(WINDOW_OCTETS)) |-> parse_incomplete);

// E6. Depth and octets are independent limits.
p_of_two_limits: assert property (@(posedge clk) disable iff (!rst_n)
  stop_parsing |-> (depth_exceeded || octets_exceeded));

// E7. A design that stopped may not claim verification.
p_of_no_claim_stopped: assert property (@(posedge clk) disable iff (!rst_n)
  stop_parsing |-> !may_claim_verified);

// E8. Depth resets at each frame.
p_of_depth_resets: assert property (@(posedge clk) disable iff (!rst_n)
  frame_start |=> (depth == 16'd0));

// E9. Octets consumed never decrease within a frame.
p_of_octets_monotone: assert property (@(posedge clk) disable iff (!rst_n)
  (!frame_start && header_seen) |=>
    (octets_consumed >= $past(octets_consumed)));

// F1. The counter that must always read zero.
p_tl_no_unverifiable: assert property (@(posedge clk) disable iff (!rst_n)
  (c_unverifiable_claims == 48'd0));

// F2. A design that never branched above 21 is layer 2.
p_tl_layer2_evidence: assert property (@(posedge clk) disable iff (!rst_n)
  (deepest_offset_seen <= 16'd21) |-> design_is_layer2_only);

// F3. The high-water mark never falls.
p_tl_high_water: assert property (@(posedge clk) disable iff (!rst_n)
  (deepest_offset_seen >= $past(deepest_offset_seen)));

// F4. Frames partition into IP and non-IP.
p_tl_partition: assert property (@(posedge clk) disable iff (!rst_n)
  (c_frames == c_ip + c_non_ip));

// F5. An undeclared crossing is a violation.
p_cf_undeclared: assert property (@(posedge clk) disable iff (!rst_n)
  ((deepest_offset_i > (tagged_i ? 16'd21 : 16'd13)) && !offload_declared_i)
    |-> v_boundary_crossed_undeclared);

// F6. A hash with no tuple must fall back.
p_cf_hash_fallback: assert property (@(posedge clk) disable iff (!rst_n)
  !hash_had_tuple_i |-> hash_used_fallback_i);

// F7. A payload octet used without declaration is a violation.
p_cf_payload_declared: assert property (@(posedge clk) disable iff (!rst_n)
  payload_octet_used_i |-> offload_declared_i);

// F8. Conformance is the disjunction of its five checks.
p_cf_vector: assert property (@(posedge clk) disable iff (!rst_n)
  conformant |-> (violations == 5'b00000));

c_et_ptp:          cover property (@(posedge clk) type_valid && (ethertype == 16'(ET_PTP)));
c_et_lldp:         cover property (@(posedge clk) type_valid && (ethertype == 16'(ET_LLDP)));
c_et_macsec:       cover property (@(posedge clk) type_valid && (ethertype == 16'(ET_MACSEC)));
c_et_roce:         cover property (@(posedge clk) type_valid && (ethertype == 16'(ET_ROCE)));
c_et_length:       cover property (@(posedge clk) type_valid && is_length_field);
c_et_unknown:      cover property (@(posedge clk) is_unknown);
c_of_ipv4_options: cover property (@(posedge clk) is_ipv4 && (ihl > 4'd5));
c_of_incomplete:   cover property (@(posedge clk) parse_incomplete);
c_of_tunnel:       cover property (@(posedge clk) depth >= 16'd1);
c_of_depth_limit:  cover property (@(posedge clk) depth_exceeded);
c_of_octet_limit:  cover property (@(posedge clk) octets_exceeded);
c_mt_fragmented:   cover property (@(posedge clk) fragments > 16'd1);
c_mt_black_hole:   cover property (@(posedge clk) black_hole);
c_cf_undeclared:   cover property (@(posedge clk) v_boundary_crossed_undeclared);