USB vs SPI

// =====================================================================
//  TWO SELECTION DISCIPLINES, SIDE BY SIDE.
//
//  CLASSIFICATION: simplified synthesisable teaching RTL.
//  Two separate modules, because they ARE two separate designs -- that
//  is the comparison. Neither is a complete controller: there is no SPI
//  shift register here and no USB packet decoder, only the part that
//  answers one question.
//
//      "Which peripheral should respond to this transaction?"
//
//  SPI answers it with a WIRE. A board designer routes one chip-select
//  line per device, and the master pulls one of them low. The answer is
//  fixed at layout time and is not visible to anybody except the master
//  and the one slave being addressed.
//
//  USB answers it with a FIELD. Every token on the bus carries an
//  address and an endpoint number, every device sees every token, and
//  the address was ASSIGNED BY THE HOST at enumeration -- so the answer
//  is run-time state that can be changed, queried and checked.
//
//  The difference that matters is not the wire count. It is this:
//
//      SPI's selection information is DISTRIBUTED (each slave sees only
//      its own select line). USB's is BROADCAST (every device sees the
//      whole address field).
//
//  A distributed selector cannot detect its own worst failure. Section
//  7 of the chapter measures exactly that, and the RTL below is built
//  so the measurement is possible rather than assumed.
// =====================================================================

// ---------------------------------------------------------------------
//  spi_cs_select -- selection by wire.
//
//  IMPORTANT AND EASY TO MISS: this module is given ALL N chip-select
//  lines. No real SPI slave has that. A real slave receives exactly one
//  CS pin and has no way to know whether any other slave is also
//  selected. So `contention` below is a BUS MONITOR output -- it is
//  observable only from a vantage point that no SPI device on a real
//  board occupies.
//
//  That is not a limitation of this model. It is the finding.
// ---------------------------------------------------------------------
module spi_cs_select #(
  parameter integer N_DEV = 4
) (
  input  wire                     clk,
  input  wire                     rst_n,

  // Active-low chip selects, one per device, routed on the board.
  input  wire [N_DEV-1:0]         cs_n,

  // Resolved selection.
  output wire                     sel_valid,
  output wire [$clog2(N_DEV)-1:0] sel_idx,

  // The failure a real slave cannot see.
  output wire                     contention,

  output wire [31:0]              n_sel,
  output wire [31:0]              n_idle,
  output wire [31:0]              n_contend
);

  localparam integer IW = $clog2(N_DEV);

  // How many selects are asserted. On a correct board this is 0 or 1;
  // two at once is a firmware or routing fault, and on real hardware it
  // means two slaves drive MISO simultaneously.
  reg [IW:0] n_low;
  reg [IW-1:0] first_low;
  integer i;

  always @(*) begin
    n_low     = {(IW+1){1'b0}};
    first_low = {IW{1'b0}};
    // Walk downwards so the LOWEST asserted index wins the tie. The
    // direction is arbitrary but it must be DEFINED: an undefined
    // winner makes the contention case unverifiable.
    for (i = N_DEV - 1; i >= 0; i = i - 1) begin
      if (!cs_n[i]) begin
        n_low     = n_low + 1'b1;
        first_low = i[IW-1:0];
      end
    end
  end

  assign contention = (n_low > 1);
  assign sel_valid  = (n_low == 1);
  assign sel_idx    = first_low;

  reg [31:0] sel_c, idle_c, con_c;
  assign n_sel    = sel_c;
  assign n_idle   = idle_c;
  assign n_contend = con_c;

  always @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      sel_c  <= 32'd0;
      idle_c <= 32'd0;
      con_c  <= 32'd0;
    end else begin
      if (n_low == 0)      idle_c <= idle_c + 32'd1;
      else if (n_low == 1) sel_c  <= sel_c  + 32'd1;
      else                 con_c  <= con_c  + 32'd1;
    end
  end

endmodule


// ---------------------------------------------------------------------
//  usb_addr_select -- selection by assigned name.
//
//  A device slot holds an address the HOST gave it, plus a mask of
//  which endpoints are configured. A token matches a slot only if the
//  address matches AND that endpoint is configured.
//
//  Two real USB rules are enforced here because both are places where
//  an implementation can be plausibly wrong:
//
//    * Address 0 is the DEFAULT address. A device sitting at address 0
//      is mid-enumeration and has only endpoint 0. Honouring any other
//      endpoint at address 0 would let a half-enumerated device answer
//      traffic it has no configuration for.
//
//    * An UNASSIGNED slot matches nothing at all, including address 0.
//      A slot that answered before being assigned would respond to the
//      enumeration of a different device.
//
//  Unlike the SPI decoder, this one CAN see its own worst failure: two
//  slots holding the same address is directly detectable, because the
//  address is a field every slot compares against.
// ---------------------------------------------------------------------
module usb_addr_select #(
  parameter integer N_SLOT = 4
) (
  input  wire                      clk,
  input  wire                      rst_n,

  // ---- the assignment interface: this is the whole difference ----
  //
  // The SPI decoder above has no equivalent port. Its mapping is fixed
  // at elaboration. This one's mapping is a register file, writable at
  // run time, which is what "the host assigns an address" means in
  // hardware.
  input  wire                      cfg_valid,
  input  wire [$clog2(N_SLOT)-1:0] cfg_slot,
  input  wire                      cfg_assigned,
  input  wire [6:0]                cfg_addr,
  input  wire [15:0]               cfg_ep_mask,

  // ---- a token ----
  input  wire                      req_valid,
  input  wire [6:0]                req_addr,
  input  wire [3:0]                req_ep,

  // ---- the answer ----
  output wire                      sel_valid,
  output wire [$clog2(N_SLOT)-1:0] sel_slot,
  output wire [2:0]                sel_reason,

  // The failure this discipline CAN see.
  output wire                      conflict,

  output wire [31:0]               n_match,
  output wire [31:0]               n_no_addr,
  output wire [31:0]               n_no_ep,
  output wire [31:0]               n_conflict
);

  localparam integer SW = $clog2(N_SLOT);

  localparam [2:0] R_NONE    = 3'd0,  // no token this cycle
                   R_MATCH   = 3'd1,  // addressed and configured
                   R_NO_ADDR = 3'd2,  // nobody holds that address
                   R_NO_EP   = 3'd3;  // address matched, endpoint did not

  // The assignment register file -- per-field arrays rather than an
  // array of structs, because a variable field-select into an unpacked
  // array of packed structs aborts the Icarus elaborator.
  reg              sl_asg  [0:N_SLOT-1];
  reg [6:0]        sl_addr [0:N_SLOT-1];
  reg [15:0]       sl_epm  [0:N_SLOT-1];

  integer j;

  // ---- the match, combinational over the registered table ----
  reg          m_any, m_ep_any;
  reg [SW-1:0] m_slot;
  reg [SW:0]   m_addr_count;

  always @(*) begin
    m_any        = 1'b0;
    m_ep_any     = 1'b0;
    m_slot       = {SW{1'b0}};
    m_addr_count = {(SW+1){1'b0}};
    // Walk downwards so the LOWEST matching slot wins. Defined, not
    // arbitrary: the conflict case must have a predictable winner or it
    // cannot be checked.
    for (j = N_SLOT - 1; j >= 0; j = j - 1) begin
      if (sl_asg[j] && (sl_addr[j] == req_addr)) begin
        m_addr_count = m_addr_count + 1'b1;
        m_any        = 1'b1;
        m_slot       = j[SW-1:0];
        // Address 0 is the default address: endpoint 0 only. A device
        // there has no configuration yet, so honouring any other
        // endpoint would answer traffic it cannot service.
        if (sl_addr[j] == 7'd0) begin
          if (req_ep == 4'd0) m_ep_any = 1'b1;
        end else begin
          if (sl_epm[j][req_ep]) m_ep_any = 1'b1;
        end
      end
    end
  end

  assign conflict = (m_addr_count > 1);

  assign sel_valid  = req_valid && m_any && m_ep_any;
  assign sel_slot   = m_slot;
  assign sel_reason = !req_valid ? R_NONE    :
                      !m_any     ? R_NO_ADDR :
                      !m_ep_any  ? R_NO_EP   : R_MATCH;

  reg [31:0] match_c, noaddr_c, noep_c, conf_c;
  assign n_match    = match_c;
  assign n_no_addr  = noaddr_c;
  assign n_no_ep    = noep_c;
  assign n_conflict = conf_c;

  always @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      for (j = 0; j < N_SLOT; j = j + 1) begin
        sl_asg[j]  <= 1'b0;
        sl_addr[j] <= 7'd0;
        sl_epm[j]  <= 16'd0;
      end
      match_c  <= 32'd0;
      noaddr_c <= 32'd0;
      noep_c   <= 32'd0;
      conf_c   <= 32'd0;
    end else begin
      if (cfg_valid) begin
        sl_asg[cfg_slot]  <= cfg_assigned;
        sl_addr[cfg_slot] <= cfg_addr;
        sl_epm[cfg_slot]  <= cfg_ep_mask;
      end

      if (req_valid) begin
        case (sel_reason)
          R_MATCH:   match_c  <= match_c  + 32'd1;
          R_NO_ADDR: noaddr_c <= noaddr_c + 32'd1;
          R_NO_EP:   noep_c   <= noep_c   + 32'd1;
          default:   ;
        endcase
        if (conflict) conf_c <= conf_c + 32'd1;
      end
    end
  end

endmodule

    slave k's entire view of the world        =  cs_n[k]
    slave k's view if it alone were selected  =  0 (its own line low)

    the two are EQUAL for every k and every contention pattern

    cfg_valid = 1'b1; cfg_slot = 2'd1; cfg_assigned = 1'b1;
    cfg_addr = 7'd8; cfg_ep_mask = 16'h000F;
    req_valid = 1'b1; req_addr = 7'd7; req_ep = 4'd0;
    #1;
    ck(usb_sel_valid === 1'b1,
       "a configuration write took effect in the same cycle as the token");

// =====================================================================
//  Testbench for spi_cs_select and usb_addr_select.
//
//  BOTH DISCIPLINES, ONE BENCH, ONE STIMULUS SOURCE. The point of the
//  chapter is a comparison, so the comparison happens inside the
//  verification rather than in prose afterwards.
//
//  THE SHADOW MODELS ARE FORMULATED IN THE OPPOSITE DIRECTION.
//  Both designs resolve ties by walking their index space DOWNWARDS so
//  the lowest index wins. Both models walk UPWARDS and stop at the
//  first hit. Same answer, different derivation -- which is the only
//  way a model can fail to inherit the design's mistake.
//
//  THE HEADLINE MEASUREMENT is not a pass/fail. It is:
//
//      of the selection failures each discipline admits, how many are
//      DETECTABLE FROM THE VANTAGE POINT A REAL DEVICE OCCUPIES?
//
//  An SPI slave receives exactly one chip-select pin. A USB device sees
//  every token's whole address field. That asymmetry is measured in
//  phase 3, and it is measured by CONSTRUCTING each observer's view and
//  comparing it against the view it would have had in the clean case --
//  not by asserting the conclusion.
// =====================================================================
`timescale 1ns/1ps
module tb_sl_v;

  localparam integer N_DEV  = 4;
  localparam integer N_SLOT = 4;

  reg clk = 1'b0, rst_n = 1'b0;
  always #5 clk = ~clk;

  // ---- SPI side ----
  reg  [N_DEV-1:0] cs_n = {N_DEV{1'b1}};
  wire             spi_sel_valid, spi_contention;
  wire [1:0]       spi_sel_idx;
  wire [31:0]      spi_n_sel, spi_n_idle, spi_n_contend;

  spi_cs_select #(.N_DEV(N_DEV)) dut_spi (
    .clk(clk), .rst_n(rst_n), .cs_n(cs_n),
    .sel_valid(spi_sel_valid), .sel_idx(spi_sel_idx),
    .contention(spi_contention),
    .n_sel(spi_n_sel), .n_idle(spi_n_idle), .n_contend(spi_n_contend)
  );

  // ---- USB side ----
  reg        cfg_valid = 1'b0;
  reg [1:0]  cfg_slot = 2'd0;
  reg        cfg_assigned = 1'b0;
  reg [6:0]  cfg_addr = 7'd0;
  reg [15:0] cfg_ep_mask = 16'd0;
  reg        req_valid = 1'b0;
  reg [6:0]  req_addr = 7'd0;
  reg [3:0]  req_ep = 4'd0;

  wire        usb_sel_valid, usb_conflict;
  wire [1:0]  usb_sel_slot;
  wire [2:0]  usb_sel_reason;
  wire [31:0] usb_n_match, usb_n_no_addr, usb_n_no_ep, usb_n_conflict;

  usb_addr_select #(.N_SLOT(N_SLOT)) dut_usb (
    .clk(clk), .rst_n(rst_n),
    .cfg_valid(cfg_valid), .cfg_slot(cfg_slot),
    .cfg_assigned(cfg_assigned), .cfg_addr(cfg_addr),
    .cfg_ep_mask(cfg_ep_mask),
    .req_valid(req_valid), .req_addr(req_addr), .req_ep(req_ep),
    .sel_valid(usb_sel_valid), .sel_slot(usb_sel_slot),
    .sel_reason(usb_sel_reason), .conflict(usb_conflict),
    .n_match(usb_n_match), .n_no_addr(usb_n_no_addr),
    .n_no_ep(usb_n_no_ep), .n_conflict(usb_n_conflict)
  );

  localparam [2:0] R_NONE = 3'd0, R_MATCH = 3'd1,
                   R_NO_ADDR = 3'd2, R_NO_EP = 3'd3;

  integer errors = 0, checks = 0, steps = 0;

  // ---- the headline measurement ----
  integer spi_contend_patterns = 0;  // patterns with >= 2 selects asserted
  integer spi_contend_visible  = 0;  // ... distinguishable by SOME slave
  integer usb_conflict_cases   = 0;  // tokens hitting a duplicate address
  integer usb_conflict_visible = 0;  // ... detected by the device logic
  integer seed;

  // $random is SIGNED: mask the sign bit before any modulo, or every
  // `% N` is negative about half the time and the sweep silently
  // collapses onto a subset of its range.
  function [31:0] urand;
    input dummy;
    begin urand = $random(seed) & 32'h3FFF_FFFF; end
  endfunction

  task ck(input cond, input [255:0] what);
    begin
      checks = checks + 1;
      if (!cond) begin
        errors = errors + 1;
        if (errors <= 20)
          $display("  ERROR @%0t step#%0d: %0s", $time, steps, what);
      end
    end
  endtask

  // ---- the shadow copy of the assignment table ----
  //
  // Maintained by the BENCH from the writes it issued, never read back
  // from the design. A model that reads the design's own table cannot
  // detect a design that writes the wrong entry.
  reg        s_asg  [0:N_SLOT-1];
  reg [6:0]  s_addr [0:N_SLOT-1];
  reg [15:0] s_epm  [0:N_SLOT-1];

  // ---------------------------------------------------------------
  //  SPI model -- counts upward, unlike the design's downward walk.
  // ---------------------------------------------------------------
  function [2:0] spi_popcount(input [N_DEV-1:0] p);
    integer i; reg [2:0] c;
    begin
      c = 3'd0;
      for (i = 0; i < N_DEV; i = i + 1) if (!p[i]) c = c + 3'd1;
      spi_popcount = c;
    end
  endfunction

  function [1:0] spi_first_low(input [N_DEV-1:0] p);
    integer i; reg found; reg [1:0] r;
    begin
      found = 1'b0; r = 2'd0;
      // upward, stop at the first. The design walks downward and
      // overwrites, so the two agree only if both are right.
      for (i = 0; i < N_DEV; i = i + 1)
        if (!p[i] && !found) begin r = i[1:0]; found = 1'b1; end
      spi_first_low = r;
    end
  endfunction

  // ---------------------------------------------------------------
  //  USB model -- also upward-and-stop, over the bench's own table.
  // ---------------------------------------------------------------
  function [2:0] usb_addr_count(input [6:0] a);
    integer j; reg [2:0] c;
    begin
      c = 3'd0;
      for (j = 0; j < N_SLOT; j = j + 1)
        if (s_asg[j] && (s_addr[j] == a)) c = c + 3'd1;
      usb_addr_count = c;
    end
  endfunction

  function [1:0] usb_first_slot(input [6:0] a);
    integer j; reg found; reg [1:0] r;
    begin
      found = 1'b0; r = 2'd0;
      for (j = 0; j < N_SLOT; j = j + 1)
        if (s_asg[j] && (s_addr[j] == a) && !found) begin r = j[1:0]; found = 1'b1; end
      usb_first_slot = r;
    end
  endfunction

  // Does ANY assigned slot at address `a` expose endpoint `e`?
  //
  // The default-address rule lives here, stated independently of the
  // design: a slot at address 0 is mid-enumeration and has endpoint 0
  // only, whatever its ep_mask happens to contain.
  function usb_ep_ok(input [6:0] a, input [3:0] e);
    integer j; reg ok;
    begin
      ok = 1'b0;
      for (j = 0; j < N_SLOT; j = j + 1) begin
        if (s_asg[j] && (s_addr[j] == a)) begin
          if (s_addr[j] == 7'd0) begin
            if (e == 4'd0) ok = 1'b1;
          end else begin
            if (s_epm[j][e]) ok = 1'b1;
          end
        end
      end
      usb_ep_ok = ok;
    end
  endfunction

  // ---------------------------------------------------------------
  //  Drive one SPI pattern and check the resolution.
  // ---------------------------------------------------------------
  task spi_step(input [N_DEV-1:0] p);
    reg [2:0]  nlow;
    reg [1:0]  efirst;
    reg [31:0] s0, i0, c0;
    begin
      nlow   = spi_popcount(p);
      efirst = spi_first_low(p);
      s0 = spi_n_sel; i0 = spi_n_idle; c0 = spi_n_contend;

      cs_n = p;
      #1;

      // ---- PROPERTY 1: exactly one low is a selection ----
      ck(spi_sel_valid === (nlow == 3'd1),
         "spi sel_valid does not mean exactly one chip select is asserted");
      // ---- PROPERTY 2: two or more low is contention ----
      ck(spi_contention === (nlow > 3'd1),
         "spi contention does not mean two or more chip selects are asserted");
      // ---- PROPERTY 3: a selection and a contention are exclusive ----
      ck(!(spi_sel_valid && spi_contention),
         "spi reported a selection and a contention at the same time");
      // ---- PROPERTY 4: the winner is the lowest asserted index ----
      if (nlow >= 3'd1)
        ck(spi_sel_idx === efirst,
           "spi did not resolve the tie to the lowest asserted index");

      @(posedge clk); #1;

      // ---- PROPERTY 5: exactly one counter moved ----
      if (nlow == 3'd0) begin
        ck(spi_n_idle == i0 + 32'd1 && spi_n_sel == s0 && spi_n_contend == c0,
           "spi counters wrong for an idle bus");
      end else if (nlow == 3'd1) begin
        ck(spi_n_sel == s0 + 32'd1 && spi_n_idle == i0 && spi_n_contend == c0,
           "spi counters wrong for a clean selection");
      end else begin
        ck(spi_n_contend == c0 + 32'd1 && spi_n_sel == s0 && spi_n_idle == i0,
           "spi counters wrong for a contention");
      end
      steps = steps + 1;
    end
  endtask

  // ---------------------------------------------------------------
  //  Write one assignment slot, mirroring it into the bench's table.
  //  The mirror happens AFTER the edge on purpose -- see phase 5.
  // ---------------------------------------------------------------
  task do_cfg(input [1:0] slot, input asg, input [6:0] a, input [15:0] epm);
    begin
      cfg_valid = 1'b1; cfg_slot = slot; cfg_assigned = asg;
      cfg_addr = a; cfg_ep_mask = epm;
      @(posedge clk); #1;
      cfg_valid = 1'b0;
      s_asg[slot]  = asg;
      s_addr[slot] = a;
      s_epm[slot]  = epm;
    end
  endtask

  // ---------------------------------------------------------------
  //  Present one token and check the resolution.
  // ---------------------------------------------------------------
  task usb_step(input [6:0] a, input [3:0] e);
    reg [2:0]  nmatch, ereason;
    reg [1:0]  efirst;
    reg        eep, eany;
    reg [31:0] m0, na0, ne0, cf0;
    begin
      nmatch  = usb_addr_count(a);
      efirst  = usb_first_slot(a);
      eany    = (nmatch > 3'd0);
      eep     = usb_ep_ok(a, e);
      ereason = !eany ? R_NO_ADDR : (!eep ? R_NO_EP : R_MATCH);

      m0 = usb_n_match; na0 = usb_n_no_addr;
      ne0 = usb_n_no_ep; cf0 = usb_n_conflict;

      req_valid = 1'b1; req_addr = a; req_ep = e;
      #1;

      // ---- PROPERTY 6: selection means addressed AND configured ----
      ck(usb_sel_valid === (eany && eep),
         "usb sel_valid does not mean the address matched and the endpoint was configured");
      // ---- PROPERTY 7: the reason code is exact ----
      ck(usb_sel_reason === ereason, "usb sel_reason disagrees with the model");
      // ---- PROPERTY 8: the winner is the lowest matching slot ----
      if (eany)
        ck(usb_sel_slot === efirst,
           "usb did not resolve a duplicate address to the lowest slot");
      // ---- PROPERTY 9: a duplicate address is DETECTED ----
      //
      // The property the SPI decoder has no equivalent of, and the
      // reason is structural rather than a matter of effort: the address
      // is a field every slot compares against, so the count is
      // available on the spot. A chip select is a wire only one slave
      // ever receives.
      ck(usb_conflict === (nmatch > 3'd1),
         "usb conflict does not mean two assigned slots share the address");

      // The measurement, taken on EVERY token rather than on a directed
      // handful. The denominator is therefore every duplicate-address
      // token the exhaustive sweep produces, which makes it comparable
      // in weight to the SPI enumeration in phase 3.
      if (nmatch > 3'd1) begin
        usb_conflict_cases = usb_conflict_cases + 1;
        if (usb_conflict === 1'b1)
          usb_conflict_visible = usb_conflict_visible + 1;
      end

      @(posedge clk); #1;
      req_valid = 1'b0;

      // ---- PROPERTY 10: exactly one reason counter moved ----
      case (ereason)
        R_MATCH:   ck(usb_n_match == m0 + 32'd1 && usb_n_no_addr == na0 && usb_n_no_ep == ne0,
                      "usb counters wrong for a match");
        R_NO_ADDR: ck(usb_n_no_addr == na0 + 32'd1 && usb_n_match == m0 && usb_n_no_ep == ne0,
                      "usb counters wrong for an unknown address");
        R_NO_EP:   ck(usb_n_no_ep == ne0 + 32'd1 && usb_n_match == m0 && usb_n_no_addr == na0,
                      "usb counters wrong for an unconfigured endpoint");
        default: ;
      endcase
      ck(usb_n_conflict == cf0 + ((nmatch > 3'd1) ? 32'd1 : 32'd0),
         "usb conflict counter disagrees with the model");
      steps = steps + 1;
    end
  endtask

  task reset_dut;
    integer j;
    begin
      rst_n = 1'b0;
      cs_n = {N_DEV{1'b1}};
      cfg_valid = 1'b0; req_valid = 1'b0;
      @(posedge clk); @(posedge clk);
      rst_n = 1'b1;
      @(posedge clk); #1;
      for (j = 0; j < N_SLOT; j = j + 1) begin
        s_asg[j] = 1'b0; s_addr[j] = 7'd0; s_epm[j] = 16'd0;
      end
    end
  endtask

  // ---- exhaustive reach ----
  //
  // SPI: 2**N_DEV chip-select patterns = 16.
  // USB: asg_mask(16) x addr_mode(4) x ep_mode(2) x req_addr(5) x req_ep(4)
  //      = 2560. Every dimension is an independent input with no
  //      forbidden combinations, so the denominator is exactly 2560 and a
  //      sweep reporting less is broken rather than constrained.
  reg reach_spi [0:15];
  reg reach_usb [0:2559];
  integer nrs, nru, ri;


  integer pat, am, em, ra, re, asg, j2, k;
  reg [6:0]  addr_of;
  reg [15:0] epm_of;
  reg        any_slave_knows, view_here, view_clean;

  initial begin
    for (ri = 0; ri < 16;   ri = ri + 1) reach_spi[ri] = 1'b0;
    for (ri = 0; ri < 2560; ri = ri + 1) reach_usb[ri] = 1'b0;
    seed = 32'd28002;

    reset_dut;

    // =============================================================
    //  PHASE 1 (DIRECTED, EXHAUSTIVE) -- every chip-select pattern.
    //  16 of 16, nothing unreachable.
    // =============================================================
    for (pat = 0; pat < 16; pat = pat + 1) begin
      spi_step(pat[N_DEV-1:0]);
      reach_spi[pat] = 1'b1;
    end
    cs_n = {N_DEV{1'b1}};

    // =============================================================
    //  PHASE 2 (DIRECTED, EXHAUSTIVE) -- the USB selection space.
    //
    //  The table is reconfigured once per (asg_mask, addr_mode,
    //  ep_mode) and then every (req_addr, req_ep) is presented against
    //  it: 128 configurations x 20 tokens.
    //
    //  addr_mode exists so duplicate addresses are REACHED rather than
    //  assumed away. Mode 1 gives every slot the same address, mode 3
    //  gives pairwise duplicates, mode 2 puts everything at the default
    //  address. A sweep with distinct addresses only would leave the
    //  conflict logic at zero coverage while reporting completeness.
    // =============================================================
    for (asg = 0; asg < 16; asg = asg + 1)
    for (am = 0; am < 4; am = am + 1)
    for (em = 0; em < 2; em = em + 1) begin
      for (j2 = 0; j2 < N_SLOT; j2 = j2 + 1) begin
        case (am)
          0: addr_of = j2[6:0] + 7'd1;                 // all distinct
          1: addr_of = 7'd1;                           // all identical
          2: addr_of = 7'd0;                           // all at default
          default: addr_of = (j2[6:0] % 7'd2) + 7'd1;  // pairwise duplicates
        endcase
        // ep_mode 1 leaves endpoints 1 and 3 unconfigured, so R_NO_EP is
        // reachable at a NON-zero address and not only through the
        // default-address rule.
        epm_of = (em == 0) ? 16'h000F : 16'h0005;
        do_cfg(j2[1:0], asg[j2], addr_of, epm_of);
      end
      for (ra = 0; ra < 5; ra = ra + 1)
      for (re = 0; re < 4; re = re + 1) begin
        usb_step(ra[6:0], re[3:0]);
        ri = ((((asg * 4 + am) * 2 + em) * 5 + ra) * 4 + re);
        reach_usb[ri] = 1'b1;
      end
    end

    // =============================================================
    //  PHASE 3 (DIRECTED, EXHAUSTIVE) -- THE MEASUREMENT.
    //
    //  Not a pass/fail. For every failure each discipline admits, could
    //  a real device detect it from what that device actually receives?
    //
    //  An SPI slave receives ONE chip-select pin, so slave k's entire
    //  view of the world is cs_n[k]. The test is a DISTINGUISHABILITY
    //  test, constructed rather than asserted: compare slave k's view
    //  under the contention pattern against its view under the clean
    //  pattern in which only k is selected. If the two views are equal,
    //  no logic inside slave k can tell them apart, whatever it does.
    // =============================================================
    for (pat = 0; pat < 16; pat = pat + 1) begin
      if (spi_popcount(pat[N_DEV-1:0]) > 3'd1) begin
        spi_contend_patterns = spi_contend_patterns + 1;

        any_slave_knows = 1'b0;
        for (k = 0; k < N_DEV; k = k + 1) begin
          if (!pat[k]) begin
            // what slave k sees now
            view_here  = pat[k];
            // what slave k would see if it alone were selected: its own
            // line low. Every other line is invisible to it.
            view_clean = 1'b0;
            if (view_here !== view_clean) any_slave_knows = 1'b1;
          end
        end
        if (any_slave_knows) spi_contend_visible = spi_contend_visible + 1;

        // And confirm the BUS MONITOR does see it -- the detector exists
        // only because this module was handed all N lines, which no slave
        // on a real board is.
        cs_n = pat[N_DEV-1:0]; #1;
        ck(spi_contention === 1'b1,
           "the bus monitor failed to see a contention it was given every wire for");
        @(posedge clk); #1;
      end
    end
    cs_n = {N_DEV{1'b1}};

    // The USB side of this question is measured inside usb_step, on
    // every one of the 2560 exhaustive tokens, so there is nothing to
    // add here -- the numbers are reported at the end of the run.

    // =============================================================
    //  PHASE 4 (DIRECTED) -- RE-ADDRESSING AT RUN TIME.
    //
    //  The capability SPI does not have and cannot be given without
    //  changing the board. Assign a slot, verify it answers, re-assign
    //  it, verify the OLD address has gone silent and the new one
    //  answers, then unassign it entirely.
    //
    //  The absence of a comparable phase on the SPI side is not an
    //  omission in this bench. spi_cs_select HAS NO CONFIGURATION PORT
    //  -- its mapping is fixed at elaboration -- and that missing port
    //  is the finding.
    // =============================================================
    reset_dut;
    do_cfg(2'd0, 1'b1, 7'd5, 16'h000F);
    usb_step(7'd5, 4'd0);                 // answers at 5
    do_cfg(2'd0, 1'b1, 7'd9, 16'h000F);   // re-addressed to 9
    usb_step(7'd5, 4'd0);                 // must now be silent at 5
    usb_step(7'd9, 4'd0);                 // and answer at 9
    do_cfg(2'd0, 1'b0, 7'd9, 16'h000F);   // unassigned entirely
    usb_step(7'd9, 4'd0);                 // silent again
    // An unassigned slot must not answer even at the default address, or
    // it would respond during another device's enumeration.
    usb_step(7'd0, 4'd0);

    // =============================================================
    //  PHASE 5 (DIRECTED) -- WHEN A CONFIGURATION TAKES EFFECT.
    //
    //  The design registers the table, so a token presented in the SAME
    //  cycle as a write must see the OLD table. Getting this backwards
    //  is a classic shadow-model error, and it earns an explicit phase:
    //  do_cfg mirrors the write only AFTER the edge, so a design that
    //  applied it early would disagree here and nowhere else in the run.
    // =============================================================
    reset_dut;
    do_cfg(2'd1, 1'b1, 7'd7, 16'h000F);
    // A same-cycle write moving the slot to a different address, plus a
    // token at the OLD one: the token must still match.
    cfg_valid = 1'b1; cfg_slot = 2'd1; cfg_assigned = 1'b1;
    cfg_addr = 7'd8; cfg_ep_mask = 16'h000F;
    req_valid = 1'b1; req_addr = 7'd7; req_ep = 4'd0;
    #1;
    ck(usb_sel_valid === 1'b1,
       "a configuration write took effect in the same cycle as the token");
    ck(usb_sel_reason === R_MATCH,
       "same-cycle reason code should still be MATCH at the old address");
    @(posedge clk); #1;
    cfg_valid = 1'b0; req_valid = 1'b0;
    s_asg[1] = 1'b1; s_addr[1] = 7'd8; s_epm[1] = 16'h000F;
    // and from the next cycle the new address is the live one
    usb_step(7'd8, 4'd0);
    usb_step(7'd7, 4'd0);

    // =============================================================
    //  PHASE 6 (RANDOM)
    // =============================================================
`ifndef DIRECTED_ONLY
    reset_dut;
    for (k = 0; k < 400; k = k + 1) begin
      if ((urand(0) % 3) == 0)
        do_cfg((urand(0) % 4), (urand(0) % 4) != 0,
               (urand(0) % 6), (urand(0) % 2) ? 16'h000F : 16'h0005);
      usb_step((urand(0) % 6), (urand(0) % 4));
      spi_step((urand(0) % 16));
    end
`endif

    nrs = 0; for (ri = 0; ri < 16;   ri = ri + 1) if (reach_spi[ri]) nrs = nrs + 1;
    nru = 0; for (ri = 0; ri < 2560; ri = ri + 1) if (reach_usb[ri]) nru = nru + 1;

    $display("steps=%0d checks=%0d reach_spi=%0d/16 reach_usb=%0d/2560 errors=%0d",
             steps, checks, nrs, nru, errors);
    $display("[spi] selections=%0d idle=%0d CONTENTIONS=%0d",
             spi_n_sel, spi_n_idle, spi_n_contend);
    $display("[usb] matches=%0d no_addr=%0d no_ep=%0d CONFLICTS=%0d",
             usb_n_match, usb_n_no_addr, usb_n_no_ep, usb_n_conflict);
    $display("--- detectability from the vantage point a real device occupies ---");
    $display("[spi] contention patterns=%0d  distinguishable by any slave=%0d",
             spi_contend_patterns, spi_contend_visible);
    $display("[usb] duplicate-address tokens=%0d  detected by the device=%0d",
             usb_conflict_cases, usb_conflict_visible);
    if (nrs != 16 || nru != 2560) begin
      $display("FAIL: exhaustive sweep incomplete"); errors = errors + 1;
    end
    if (errors == 0) $display("PASS: 0 errors in %0d checks", checks);
    else             $display("FAIL: %0d errors in %0d checks", errors, checks);
    $finish;
  end

endmodule

// =====================================================================
//  TWO SELECTION DISCIPLINES, SIDE BY SIDE -- SystemVerilog.
//
//  CLASSIFICATION: simplified synthesisable teaching RTL.
//  Same hardware contract as the Verilog file: same ports, same widths,
//  same reset values, same cycle-by-cycle behaviour. What changes is
//  that the reason code becomes a named type, so a reason that does not
//  exist cannot be produced.
//
//  The question both modules answer:
//
//      "Which peripheral should respond to this transaction?"
//
//  SPI answers it with a WIRE routed at layout time. USB answers it with
//  a FIELD every device sees, holding an address the HOST assigned.
//
//  The difference that matters is not the wire count:
//
//      SPI's selection information is DISTRIBUTED -- each slave sees
//      only its own select line. USB's is BROADCAST -- every device
//      sees the whole address field.
//
//  A distributed selector cannot detect its own worst failure.
// =====================================================================

// ---------------------------------------------------------------------
//  spi_cs_select -- selection by wire.
//
//  IMPORTANT: this module is given ALL N chip-select lines. No real SPI
//  slave has that. A real slave receives exactly one CS pin and cannot
//  know whether another slave is also selected. So `contention` is a
//  BUS MONITOR output, observable only from a vantage point that no SPI
//  device on a real board occupies.
//
//  That is not a limitation of the model. It is the finding.
// ---------------------------------------------------------------------
module spi_cs_select #(
  parameter int N_DEV = 4
) (
  input  logic                     clk,
  input  logic                     rst_n,

  // Active-low chip selects, one per device, routed on the board.
  input  logic [N_DEV-1:0]         cs_n,

  output logic                     sel_valid,
  output logic [$clog2(N_DEV)-1:0] sel_idx,

  // The failure a real slave cannot see.
  output logic                     contention,

  output logic [31:0]              n_sel,
  output logic [31:0]              n_idle,
  output logic [31:0]              n_contend
);

  localparam int IW = $clog2(N_DEV);

  // How many selects are asserted. On a correct board 0 or 1; two at
  // once is a firmware or routing fault, and on real hardware it means
  // two slaves drive MISO simultaneously.
  logic [IW:0]   n_low;
  logic [IW-1:0] first_low;

  always_comb begin
    n_low     = '0;
    first_low = '0;
    // Downwards, so the LOWEST asserted index wins the tie. The
    // direction is arbitrary but it must be DEFINED: an undefined winner
    // makes the contention case unverifiable.
    for (int i = N_DEV - 1; i >= 0; i--) begin
      if (!cs_n[i]) begin
        n_low     = n_low + 1'b1;
        first_low = IW'(i);
      end
    end
  end

  assign contention = (n_low > 1);
  assign sel_valid  = (n_low == 1);
  assign sel_idx    = first_low;

  logic [31:0] sel_c, idle_c, con_c;
  assign n_sel     = sel_c;
  assign n_idle    = idle_c;
  assign n_contend = con_c;

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      sel_c  <= 32'd0;
      idle_c <= 32'd0;
      con_c  <= 32'd0;
    end else begin
      if (n_low == 0)      idle_c <= idle_c + 32'd1;
      else if (n_low == 1) sel_c  <= sel_c  + 32'd1;
      else                 con_c  <= con_c  + 32'd1;
    end
  end

endmodule


// ---------------------------------------------------------------------
//  usb_addr_select -- selection by assigned name.
//
//  Two real USB rules are enforced, because both are places an
//  implementation can be plausibly wrong:
//
//    * Address 0 is the DEFAULT address. A device there is
//      mid-enumeration and has endpoint 0 only. Honouring any other
//      endpoint would let a half-enumerated device answer traffic it has
//      no configuration for.
//
//    * An UNASSIGNED slot matches nothing, including address 0. A slot
//      that answered before being assigned would respond during another
//      device's enumeration.
//
//  Unlike the SPI decoder, this one CAN see its own worst failure: two
//  slots holding the same address is directly detectable, because the
//  address is a field every slot compares against.
// ---------------------------------------------------------------------
module usb_addr_select #(
  parameter int N_SLOT = 4
) (
  input  logic                      clk,
  input  logic                      rst_n,

  // ---- the assignment interface: this is the whole difference ----
  //
  // spi_cs_select has no equivalent port. Its mapping is fixed at
  // elaboration. This one's mapping is a register file, writable at run
  // time, which is what "the host assigns an address" means in hardware.
  input  logic                      cfg_valid,
  input  logic [$clog2(N_SLOT)-1:0] cfg_slot,
  input  logic                      cfg_assigned,
  input  logic [6:0]                cfg_addr,
  input  logic [15:0]               cfg_ep_mask,

  input  logic                      req_valid,
  input  logic [6:0]                req_addr,
  input  logic [3:0]                req_ep,

  output logic                      sel_valid,
  output logic [$clog2(N_SLOT)-1:0] sel_slot,
  output logic [2:0]                sel_reason,

  // The failure this discipline CAN see.
  output logic                      conflict,

  output logic [31:0]               n_match,
  output logic [31:0]               n_no_addr,
  output logic [31:0]               n_no_ep,
  output logic [31:0]               n_conflict
);

  localparam int SW = $clog2(N_SLOT);

  // A named type, exported as 3 bits so all three languages present one
  // identical observable contract.
  typedef enum logic [2:0] {
    R_NONE    = 3'd0,   // no token this cycle
    R_MATCH   = 3'd1,   // addressed and configured
    R_NO_ADDR = 3'd2,   // nobody holds that address
    R_NO_EP   = 3'd3    // address matched, endpoint did not
  } reason_e;

  // Per-field arrays rather than an array of structs: a variable
  // field-select into an unpacked array of packed structs aborts the
  // Icarus elaborator.
  logic        sl_asg  [N_SLOT];
  logic [6:0]  sl_addr [N_SLOT];
  logic [15:0] sl_epm  [N_SLOT];

  logic          m_any, m_ep_any;
  logic [SW-1:0] m_slot;
  logic [SW:0]   m_addr_count;
  reason_e       reason_q;

  always_comb begin
    m_any        = 1'b0;
    m_ep_any     = 1'b0;
    m_slot       = '0;
    m_addr_count = '0;
    // Downwards, so the LOWEST matching slot wins. Defined, not
    // arbitrary: the conflict case must have a predictable winner or it
    // cannot be checked.
    for (int j = N_SLOT - 1; j >= 0; j--) begin
      if (sl_asg[j] && (sl_addr[j] == req_addr)) begin
        m_addr_count = m_addr_count + 1'b1;
        m_any        = 1'b1;
        m_slot       = SW'(j);
        // Address 0 is the default address: endpoint 0 only. A device
        // there has no configuration yet, so honouring any other
        // endpoint would answer traffic it cannot service.
        if (sl_addr[j] == 7'd0) begin
          if (req_ep == 4'd0) m_ep_any = 1'b1;
        end else begin
          if (sl_epm[j][req_ep]) m_ep_any = 1'b1;
        end
      end
    end
  end

  always_comb begin
    if      (!req_valid) reason_q = R_NONE;
    else if (!m_any)     reason_q = R_NO_ADDR;
    else if (!m_ep_any)  reason_q = R_NO_EP;
    else                 reason_q = R_MATCH;
  end

  assign conflict   = (m_addr_count > 1);
  assign sel_valid  = req_valid && m_any && m_ep_any;
  assign sel_slot   = m_slot;
  assign sel_reason = reason_q;

  logic [31:0] match_c, noaddr_c, noep_c, conf_c;
  assign n_match    = match_c;
  assign n_no_addr  = noaddr_c;
  assign n_no_ep    = noep_c;
  assign n_conflict = conf_c;

  always_ff @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      for (int j = 0; j < N_SLOT; j++) begin
        sl_asg[j]  <= 1'b0;
        sl_addr[j] <= 7'd0;
        sl_epm[j]  <= 16'd0;
      end
      match_c  <= 32'd0;
      noaddr_c <= 32'd0;
      noep_c   <= 32'd0;
      conf_c   <= 32'd0;
    end else begin
      if (cfg_valid) begin
        sl_asg[cfg_slot]  <= cfg_assigned;
        sl_addr[cfg_slot] <= cfg_addr;
        sl_epm[cfg_slot]  <= cfg_ep_mask;
      end

      if (req_valid) begin
        case (reason_q)
          R_MATCH:   match_c  <= match_c  + 32'd1;
          R_NO_ADDR: noaddr_c <= noaddr_c + 32'd1;
          R_NO_EP:   noep_c   <= noep_c   + 32'd1;
          default:   ;
        endcase
        if (conflict) conf_c <= conf_c + 32'd1;
      end
    end
  end

endmodule

// =====================================================================
//  Testbench for spi_cs_select and usb_addr_select -- SystemVerilog.
//
//  BOTH DISCIPLINES, ONE BENCH, ONE STIMULUS SOURCE. The chapter's point
//  is a comparison, so the comparison happens inside the verification
//  rather than in prose afterwards.
//
//  THE SHADOW MODELS ARE FORMULATED IN THE OPPOSITE DIRECTION. Both
//  designs resolve ties by walking their index space DOWNWARDS so the
//  lowest index wins; both models walk UPWARDS and stop at the first
//  hit. Same answer, different derivation -- the only way a model can
//  fail to inherit the design's mistake.
//
//  SAME SEED AND SAME PHASE ORDER AS THE VERILOG BENCH, deliberately.
//  Icarus seeds $random identically, so both drive identical stimulus and
//  any difference between the two mutation columns is a real difference
//  between the two DESIGNS. The independent-stimulus role is VHDL's.
// =====================================================================
`timescale 1ns/1ps
module tb_sl_sv;

  localparam int N_DEV  = 4;
  localparam int N_SLOT = 4;

  logic clk = 1'b0, rst_n = 1'b0;
  always #5 clk = ~clk;

  // ---- SPI side ----
  logic [N_DEV-1:0] cs_n = '1;
  logic             spi_sel_valid, spi_contention;
  logic [1:0]       spi_sel_idx;
  logic [31:0]      spi_n_sel, spi_n_idle, spi_n_contend;

  spi_cs_select #(.N_DEV(N_DEV)) dut_spi (
    .clk(clk), .rst_n(rst_n), .cs_n(cs_n),
    .sel_valid(spi_sel_valid), .sel_idx(spi_sel_idx),
    .contention(spi_contention),
    .n_sel(spi_n_sel), .n_idle(spi_n_idle), .n_contend(spi_n_contend)
  );

  // ---- USB side ----
  logic        cfg_valid = 1'b0;
  logic [1:0]  cfg_slot = 2'd0;
  logic        cfg_assigned = 1'b0;
  logic [6:0]  cfg_addr = 7'd0;
  logic [15:0] cfg_ep_mask = 16'd0;
  logic        req_valid = 1'b0;
  logic [6:0]  req_addr = 7'd0;
  logic [3:0]  req_ep = 4'd0;

  logic        usb_sel_valid, usb_conflict;
  logic [1:0]  usb_sel_slot;
  logic [2:0]  usb_sel_reason;
  logic [31:0] usb_n_match, usb_n_no_addr, usb_n_no_ep, usb_n_conflict;

  usb_addr_select #(.N_SLOT(N_SLOT)) dut_usb (
    .clk(clk), .rst_n(rst_n),
    .cfg_valid(cfg_valid), .cfg_slot(cfg_slot),
    .cfg_assigned(cfg_assigned), .cfg_addr(cfg_addr),
    .cfg_ep_mask(cfg_ep_mask),
    .req_valid(req_valid), .req_addr(req_addr), .req_ep(req_ep),
    .sel_valid(usb_sel_valid), .sel_slot(usb_sel_slot),
    .sel_reason(usb_sel_reason), .conflict(usb_conflict),
    .n_match(usb_n_match), .n_no_addr(usb_n_no_addr),
    .n_no_ep(usb_n_no_ep), .n_conflict(usb_n_conflict)
  );

  localparam logic [2:0] R_NONE = 3'd0, R_MATCH = 3'd1,
                         R_NO_ADDR = 3'd2, R_NO_EP = 3'd3;

  int errors = 0, checks = 0, steps = 0;
  int seed;

  // ---- the headline measurement ----
  int spi_contend_patterns = 0;  // patterns with >= 2 selects asserted
  int spi_contend_visible  = 0;  // ... distinguishable by SOME slave
  int usb_conflict_cases   = 0;  // tokens hitting a duplicate address
  int usb_conflict_visible = 0;  // ... detected by the device logic

  // $random is SIGNED: mask the sign bit before any modulo, or every
  // `% N` is negative about half the time and the sweep silently
  // collapses onto a subset of its range.
  function automatic logic [31:0] urand();
    return $random(seed) & 32'h3FFF_FFFF;
  endfunction

  task automatic ck(input logic cond, input string what);
    checks++;
    if (!cond) begin
      errors++;
      if (errors <= 20)
        $display("  ERROR @%0t step#%0d: %s", $time, steps, what);
    end
  endtask

  // ---- the shadow copy of the assignment table ----
  //
  // Maintained by the BENCH from the writes it issued, never read back
  // from the design. A model that reads the design's own table cannot
  // detect a design that writes the wrong entry.
  logic        s_asg  [N_SLOT];
  logic [6:0]  s_addr [N_SLOT];
  logic [15:0] s_epm  [N_SLOT];

  // ---- SPI model: counts upward, unlike the design's downward walk ----
  function automatic logic [2:0] spi_popcount(input logic [N_DEV-1:0] p);
    logic [2:0] c = 3'd0;
    for (int i = 0; i < N_DEV; i++) if (!p[i]) c = c + 3'd1;
    return c;
  endfunction

  function automatic logic [1:0] spi_first_low(input logic [N_DEV-1:0] p);
    logic found = 1'b0;
    logic [1:0] r = 2'd0;
    // upward, stop at the first. The design walks downward and
    // overwrites, so the two agree only if both are right.
    for (int i = 0; i < N_DEV; i++)
      if (!p[i] && !found) begin r = 2'(i); found = 1'b1; end
    return r;
  endfunction

  // ---- USB model: also upward-and-stop, over the bench's own table ----
  function automatic logic [2:0] usb_addr_count(input logic [6:0] a);
    logic [2:0] c = 3'd0;
    for (int j = 0; j < N_SLOT; j++)
      if (s_asg[j] && (s_addr[j] == a)) c = c + 3'd1;
    return c;
  endfunction

  function automatic logic [1:0] usb_first_slot(input logic [6:0] a);
    logic found = 1'b0;
    logic [1:0] r = 2'd0;
    for (int j = 0; j < N_SLOT; j++)
      if (s_asg[j] && (s_addr[j] == a) && !found) begin r = 2'(j); found = 1'b1; end
    return r;
  endfunction

  // Does ANY assigned slot at address `a` expose endpoint `e`?
  //
  // The default-address rule lives here, stated independently of the
  // design: a slot at address 0 is mid-enumeration and has endpoint 0
  // only, whatever its ep_mask happens to contain.
  function automatic logic usb_ep_ok(input logic [6:0] a, input logic [3:0] e);
    logic ok = 1'b0;
    for (int j = 0; j < N_SLOT; j++) begin
      if (s_asg[j] && (s_addr[j] == a)) begin
        if (s_addr[j] == 7'd0) begin
          if (e == 4'd0) ok = 1'b1;
        end else begin
          if (s_epm[j][e]) ok = 1'b1;
        end
      end
    end
    return ok;
  endfunction

  // ---------------------------------------------------------------
  //  Drive one SPI pattern and check the resolution.
  // ---------------------------------------------------------------
  task automatic spi_step(input logic [N_DEV-1:0] p);
    logic [2:0]  nlow;
    logic [1:0]  efirst;
    logic [31:0] s0, i0, c0;
    begin
      nlow   = spi_popcount(p);
      efirst = spi_first_low(p);
      s0 = spi_n_sel; i0 = spi_n_idle; c0 = spi_n_contend;

      cs_n = p;
      #1;

      // ---- PROPERTY 1: exactly one low is a selection ----
      ck(spi_sel_valid === (nlow == 3'd1),
         "spi sel_valid does not mean exactly one chip select is asserted");
      // ---- PROPERTY 2: two or more low is contention ----
      ck(spi_contention === (nlow > 3'd1),
         "spi contention does not mean two or more chip selects are asserted");
      // ---- PROPERTY 3: a selection and a contention are exclusive ----
      ck(!(spi_sel_valid && spi_contention),
         "spi reported a selection and a contention at the same time");
      // ---- PROPERTY 4: the winner is the lowest asserted index ----
      if (nlow >= 3'd1)
        ck(spi_sel_idx === efirst,
           "spi did not resolve the tie to the lowest asserted index");

      @(posedge clk); #1;

      // ---- PROPERTY 5: exactly one counter moved ----
      if (nlow == 3'd0) begin
        ck(spi_n_idle == i0 + 32'd1 && spi_n_sel == s0 && spi_n_contend == c0,
           "spi counters wrong for an idle bus");
      end else if (nlow == 3'd1) begin
        ck(spi_n_sel == s0 + 32'd1 && spi_n_idle == i0 && spi_n_contend == c0,
           "spi counters wrong for a clean selection");
      end else begin
        ck(spi_n_contend == c0 + 32'd1 && spi_n_sel == s0 && spi_n_idle == i0,
           "spi counters wrong for a contention");
      end
      steps++;
    end
  endtask

  // ---------------------------------------------------------------
  //  Write one assignment slot, mirroring it into the bench's table.
  //  The mirror happens AFTER the edge on purpose -- see phase 5.
  // ---------------------------------------------------------------
  task automatic do_cfg(input logic [1:0] slot, input logic asg,
                        input logic [6:0] a, input logic [15:0] epm);
    cfg_valid = 1'b1; cfg_slot = slot; cfg_assigned = asg;
    cfg_addr = a; cfg_ep_mask = epm;
    @(posedge clk); #1;
    cfg_valid = 1'b0;
    s_asg[slot]  = asg;
    s_addr[slot] = a;
    s_epm[slot]  = epm;
  endtask

  // ---------------------------------------------------------------
  //  Present one token and check the resolution.
  // ---------------------------------------------------------------
  task automatic usb_step(input logic [6:0] a, input logic [3:0] e);
    logic [2:0]  nmatch, ereason;
    logic [1:0]  efirst;
    logic        eep, eany;
    logic [31:0] m0, na0, ne0, cf0;
    begin
      nmatch  = usb_addr_count(a);
      efirst  = usb_first_slot(a);
      eany    = (nmatch > 3'd0);
      eep     = usb_ep_ok(a, e);
      ereason = !eany ? R_NO_ADDR : (!eep ? R_NO_EP : R_MATCH);

      m0 = usb_n_match; na0 = usb_n_no_addr;
      ne0 = usb_n_no_ep; cf0 = usb_n_conflict;

      req_valid = 1'b1; req_addr = a; req_ep = e;
      #1;

      // ---- PROPERTY 6: selection means addressed AND configured ----
      ck(usb_sel_valid === (eany && eep),
         "usb sel_valid does not mean the address matched and the endpoint was configured");
      // ---- PROPERTY 7: the reason code is exact ----
      ck(usb_sel_reason === ereason, "usb sel_reason disagrees with the model");
      // ---- PROPERTY 8: the winner is the lowest matching slot ----
      if (eany)
        ck(usb_sel_slot === efirst,
           "usb did not resolve a duplicate address to the lowest slot");
      // ---- PROPERTY 9: a duplicate address is DETECTED ----
      //
      // The property the SPI decoder has no equivalent of, and the
      // reason is structural rather than a matter of effort: the address
      // is a field every slot compares against, so the count is
      // available on the spot. A chip select is a wire only one slave
      // ever receives.
      ck(usb_conflict === (nmatch > 3'd1),
         "usb conflict does not mean two assigned slots share the address");

      // The measurement, taken on EVERY token rather than on a directed
      // handful, so its denominator is every duplicate-address token the
      // exhaustive sweep produces.
      if (nmatch > 3'd1) begin
        usb_conflict_cases++;
        if (usb_conflict === 1'b1) usb_conflict_visible++;
      end

      @(posedge clk); #1;
      req_valid = 1'b0;

      // ---- PROPERTY 10: exactly one reason counter moved ----
      case (ereason)
        R_MATCH:   ck(usb_n_match == m0 + 32'd1 && usb_n_no_addr == na0 && usb_n_no_ep == ne0,
                      "usb counters wrong for a match");
        R_NO_ADDR: ck(usb_n_no_addr == na0 + 32'd1 && usb_n_match == m0 && usb_n_no_ep == ne0,
                      "usb counters wrong for an unknown address");
        R_NO_EP:   ck(usb_n_no_ep == ne0 + 32'd1 && usb_n_match == m0 && usb_n_no_addr == na0,
                      "usb counters wrong for an unconfigured endpoint");
        default: ;
      endcase
      ck(usb_n_conflict == cf0 + ((nmatch > 3'd1) ? 32'd1 : 32'd0),
         "usb conflict counter disagrees with the model");
      steps++;
    end
  endtask

  task automatic reset_dut();
    rst_n = 1'b0;
    cs_n = '1;
    cfg_valid = 1'b0; req_valid = 1'b0;
    @(posedge clk); @(posedge clk);
    rst_n = 1'b1;
    @(posedge clk); #1;
    for (int j = 0; j < N_SLOT; j++) begin
      s_asg[j] = 1'b0; s_addr[j] = 7'd0; s_epm[j] = 16'd0;
    end
  endtask

  // ---- exhaustive reach ----
  //
  // SPI: 2**N_DEV chip-select patterns = 16.
  // USB: asg_mask(16) x addr_mode(4) x ep_mode(2) x req_addr(5) x req_ep(4)
  //      = 2560. Every dimension is an independent input with no
  //      forbidden combinations, so the denominator is exactly 2560.
  bit reach_spi [0:15];
  bit reach_usb [0:2559];
  int nrs, nru, ri;

  int pat, am, em, ra, re, asg, j2, k;
  logic [6:0]  addr_of;
  logic [15:0] epm_of;
  logic        any_slave_knows, view_here, view_clean;

  initial begin
    for (ri = 0; ri < 16;   ri++) reach_spi[ri] = 1'b0;
    for (ri = 0; ri < 2560; ri++) reach_usb[ri] = 1'b0;
    seed = 32'd28002;

    reset_dut();

    // =============================================================
    //  PHASE 1 (DIRECTED, EXHAUSTIVE) -- every chip-select pattern.
    //  16 of 16, nothing unreachable.
    // =============================================================
    for (pat = 0; pat < 16; pat++) begin
      spi_step(pat[N_DEV-1:0]);
      reach_spi[pat] = 1'b1;
    end
    cs_n = '1;

    // =============================================================
    //  PHASE 2 (DIRECTED, EXHAUSTIVE) -- the USB selection space.
    //
    //  The table is reconfigured once per (asg_mask, addr_mode, ep_mode)
    //  and every (req_addr, req_ep) is presented against it: 128
    //  configurations x 20 tokens.
    //
    //  addr_mode exists so duplicate addresses are REACHED rather than
    //  assumed away. A sweep with distinct addresses only would leave the
    //  conflict logic at zero coverage while reporting completeness.
    // =============================================================
    for (asg = 0; asg < 16; asg++)
    for (am = 0; am < 4; am++)
    for (em = 0; em < 2; em++) begin
      for (j2 = 0; j2 < N_SLOT; j2++) begin
        case (am)
          0: addr_of = 7'(j2) + 7'd1;               // all distinct
          1: addr_of = 7'd1;                        // all identical
          2: addr_of = 7'd0;                        // all at default
          default: addr_of = (7'(j2) % 7'd2) + 7'd1; // pairwise duplicates
        endcase
        // ep_mode 1 leaves endpoints 1 and 3 unconfigured, so R_NO_EP is
        // reachable at a NON-zero address and not only through the
        // default-address rule.
        epm_of = (em == 0) ? 16'h000F : 16'h0005;
        do_cfg(2'(j2), asg[j2], addr_of, epm_of);
      end
      for (ra = 0; ra < 5; ra++)
      for (re = 0; re < 4; re++) begin
        usb_step(7'(ra), 4'(re));
        ri = ((((asg * 4 + am) * 2 + em) * 5 + ra) * 4 + re);
        reach_usb[ri] = 1'b1;
      end
    end

    // =============================================================
    //  PHASE 3 (DIRECTED, EXHAUSTIVE) -- THE MEASUREMENT.
    //
    //  An SPI slave receives ONE chip-select pin, so slave k's entire
    //  view of the world is cs_n[k]. The test is a DISTINGUISHABILITY
    //  test, constructed rather than asserted: compare slave k's view
    //  under the contention pattern against its view under the clean
    //  pattern in which only k is selected. If the two views are equal,
    //  no logic inside slave k can tell them apart, whatever it does.
    // =============================================================
    for (pat = 0; pat < 16; pat++) begin
      if (spi_popcount(pat[N_DEV-1:0]) > 3'd1) begin
        spi_contend_patterns++;

        any_slave_knows = 1'b0;
        for (k = 0; k < N_DEV; k++) begin
          if (!pat[k]) begin
            view_here  = pat[k];   // what slave k sees now
            view_clean = 1'b0;     // what it would see if it alone were selected
            if (view_here !== view_clean) any_slave_knows = 1'b1;
          end
        end
        if (any_slave_knows) spi_contend_visible++;

        // And confirm the BUS MONITOR does see it -- the detector exists
        // only because this module was handed every wire, which no slave
        // on a real board is.
        cs_n = pat[N_DEV-1:0]; #1;
        ck(spi_contention === 1'b1,
           "the bus monitor failed to see a contention it was given every wire for");
        @(posedge clk); #1;
      end
    end
    cs_n = '1;

    // The USB side of this question is measured inside usb_step, on every
    // one of the 2560 exhaustive tokens, so there is nothing to add here.

    // =============================================================
    //  PHASE 4 (DIRECTED) -- RE-ADDRESSING AT RUN TIME.
    //
    //  The capability SPI does not have and cannot be given without
    //  changing the board.
    //
    //  The absence of a comparable phase on the SPI side is not an
    //  omission. spi_cs_select HAS NO CONFIGURATION PORT -- its mapping
    //  is fixed at elaboration -- and that missing port is the finding.
    // =============================================================
    reset_dut();
    do_cfg(2'd0, 1'b1, 7'd5, 16'h000F);
    usb_step(7'd5, 4'd0);                 // answers at 5
    do_cfg(2'd0, 1'b1, 7'd9, 16'h000F);   // re-addressed to 9
    usb_step(7'd5, 4'd0);                 // must now be silent at 5
    usb_step(7'd9, 4'd0);                 // and answer at 9
    do_cfg(2'd0, 1'b0, 7'd9, 16'h000F);   // unassigned entirely
    usb_step(7'd9, 4'd0);                 // silent again
    // An unassigned slot must not answer even at the default address, or
    // it would respond during another device's enumeration.
    usb_step(7'd0, 4'd0);

    // =============================================================
    //  PHASE 5 (DIRECTED) -- WHEN A CONFIGURATION TAKES EFFECT.
    //
    //  The design registers the table, so a token presented in the SAME
    //  cycle as a write must see the OLD table. do_cfg mirrors the write
    //  only AFTER the edge, so a design that applied it early would
    //  disagree here and nowhere else in the run.
    // =============================================================
    reset_dut();
    do_cfg(2'd1, 1'b1, 7'd7, 16'h000F);
    cfg_valid = 1'b1; cfg_slot = 2'd1; cfg_assigned = 1'b1;
    cfg_addr = 7'd8; cfg_ep_mask = 16'h000F;
    req_valid = 1'b1; req_addr = 7'd7; req_ep = 4'd0;
    #1;
    ck(usb_sel_valid === 1'b1,
       "a configuration write took effect in the same cycle as the token");
    ck(usb_sel_reason === R_MATCH,
       "same-cycle reason code should still be MATCH at the old address");
    @(posedge clk); #1;
    cfg_valid = 1'b0; req_valid = 1'b0;
    s_asg[1] = 1'b1; s_addr[1] = 7'd8; s_epm[1] = 16'h000F;
    usb_step(7'd8, 4'd0);
    usb_step(7'd7, 4'd0);

    // =============================================================
    //  PHASE 6 (RANDOM)
    // =============================================================
`ifndef DIRECTED_ONLY
    reset_dut();
    for (k = 0; k < 400; k++) begin
      if ((urand() % 3) == 0)
        do_cfg(2'(urand() % 4), (urand() % 4) != 0,
               7'(urand() % 6), (urand() % 2) ? 16'h000F : 16'h0005);
      usb_step(7'(urand() % 6), 4'(urand() % 4));
      spi_step(4'(urand() % 16));
    end
`endif

    nrs = 0; for (ri = 0; ri < 16;   ri++) if (reach_spi[ri]) nrs++;
    nru = 0; for (ri = 0; ri < 2560; ri++) if (reach_usb[ri]) nru++;

    $display("steps=%0d checks=%0d reach_spi=%0d/16 reach_usb=%0d/2560 errors=%0d",
             steps, checks, nrs, nru, errors);
    $display("[spi] selections=%0d idle=%0d CONTENTIONS=%0d",
             spi_n_sel, spi_n_idle, spi_n_contend);
    $display("[usb] matches=%0d no_addr=%0d no_ep=%0d CONFLICTS=%0d",
             usb_n_match, usb_n_no_addr, usb_n_no_ep, usb_n_conflict);
    $display("--- detectability from the vantage point a real device occupies ---");
    $display("[spi] contention patterns=%0d  distinguishable by any slave=%0d",
             spi_contend_patterns, spi_contend_visible);
    $display("[usb] duplicate-address tokens=%0d  detected by the device=%0d",
             usb_conflict_cases, usb_conflict_visible);
    if (nrs != 16 || nru != 2560) begin
      $display("FAIL: exhaustive sweep incomplete"); errors++;
    end
    if (errors == 0) $display("PASS: 0 errors in %0d checks", checks);
    else             $display("FAIL: %0d errors in %0d checks", errors, checks);
    $finish;
  end

endmodule

-- =====================================================================
--  TWO SELECTION DISCIPLINES, SIDE BY SIDE -- VHDL-2008.
--
--  CLASSIFICATION: simplified synthesisable teaching RTL.
--  Same hardware contract as the Verilog and SystemVerilog files: same
--  ports, same widths, same reset values, same cycle-by-cycle behaviour.
--
--  The question both entities answer:
--
--      "Which peripheral should respond to this transaction?"
--
--  SPI answers it with a WIRE routed at layout time. USB answers it with
--  a FIELD every device sees, holding an address the HOST assigned.
--
--  The difference that matters is not the wire count:
--
--      SPI's selection information is DISTRIBUTED -- each slave sees
--      only its own select line. USB's is BROADCAST -- every device
--      sees the whole address field.
--
--  A distributed selector cannot detect its own worst failure.
--
--  Both combinational processes use `process (all)`. That is a
--  deliberate choice for a file that gets mutated: a mutation which adds
--  a branch reading a new signal would otherwise need the sensitivity
--  list extended by hand, and forgetting to do so produces a mutant that
--  fails for the wrong reason.
-- =====================================================================
library ieee;
use ieee.std_logic_1164.all;
use ieee.numeric_std.all;

package sel_pkg is
  -- Ceiling log2, for index widths. Named so it cannot collide with a
  -- port: a VHDL port shadows a same-named package object, and VHDL is
  -- case-insensitive, so the collision would be silent.
  function sel_clog2 (n : natural) return natural;
end package;

package body sel_pkg is
  function sel_clog2 (n : natural) return natural is
    variable r : natural := 0;
    variable v : natural := 1;
  begin
    while v < n loop
      v := v * 2;
      r := r + 1;
    end loop;
    if r = 0 then
      return 1;
    else
      return r;
    end if;
  end function;
end package body;


-- ---------------------------------------------------------------------
--  spi_cs_select -- selection by wire.
--
--  IMPORTANT: this entity is given ALL N chip-select lines. No real SPI
--  slave has that. A real slave receives exactly one CS pin and cannot
--  know whether another slave is also selected. So `contention` is a BUS
--  MONITOR output, observable only from a vantage point that no SPI
--  device on a real board occupies.
--
--  That is not a limitation of the model. It is the finding.
-- ---------------------------------------------------------------------
library ieee;
use ieee.std_logic_1164.all;
use ieee.numeric_std.all;
use work.sel_pkg.all;

entity spi_cs_select is
  generic (
    N_DEV : natural := 4
  );
  port (
    clk   : in std_logic;
    rst_n : in std_logic;

    -- Active-low chip selects, one per device, routed on the board.
    cs_n : in std_logic_vector(N_DEV - 1 downto 0);

    sel_valid : out std_logic;
    sel_idx   : out std_logic_vector(sel_clog2(N_DEV) - 1 downto 0);

    -- The failure a real slave cannot see.
    contention : out std_logic;

    n_sel     : out std_logic_vector(31 downto 0);
    n_idle    : out std_logic_vector(31 downto 0);
    n_contend : out std_logic_vector(31 downto 0)
  );
end entity;

architecture rtl of spi_cs_select is
  constant IW : natural := sel_clog2(N_DEV);

  -- How many selects are asserted. On a correct board 0 or 1; two at
  -- once is a firmware or routing fault, and on real hardware it means
  -- two slaves drive MISO simultaneously.
  signal n_low     : unsigned(IW downto 0) := (others => '0');
  signal first_low : unsigned(IW - 1 downto 0) := (others => '0');

  signal sel_c  : unsigned(31 downto 0) := (others => '0');
  signal idle_c : unsigned(31 downto 0) := (others => '0');
  signal con_c  : unsigned(31 downto 0) := (others => '0');
begin

  count : process (all)
    variable c : unsigned(IW downto 0);
    variable f : unsigned(IW - 1 downto 0);
  begin
    c := (others => '0');
    f := (others => '0');
    -- Downwards, so the LOWEST asserted index wins the tie. The
    -- direction is arbitrary but it must be DEFINED: an undefined winner
    -- makes the contention case unverifiable.
    for i in N_DEV - 1 downto 0 loop
      if cs_n(i) = '0' then
        c := c + 1;
        f := to_unsigned(i, IW);
      end if;
    end loop;
    n_low     <= c;
    first_low <= f;
  end process;

  contention <= '1' when n_low > 1 else '0';
  sel_valid  <= '1' when n_low = 1 else '0';
  sel_idx    <= std_logic_vector(first_low);

  n_sel     <= std_logic_vector(sel_c);
  n_idle    <= std_logic_vector(idle_c);
  n_contend <= std_logic_vector(con_c);

  process (clk, rst_n)
  begin
    if rst_n = '0' then
      sel_c  <= (others => '0');
      idle_c <= (others => '0');
      con_c  <= (others => '0');
    elsif rising_edge(clk) then
      if n_low = 0 then
        idle_c <= idle_c + 1;
      elsif n_low = 1 then
        sel_c <= sel_c + 1;
      else
        con_c <= con_c + 1;
      end if;
    end if;
  end process;

end architecture;


-- ---------------------------------------------------------------------
--  usb_addr_select -- selection by assigned name.
--
--  Two real USB rules are enforced, because both are places an
--  implementation can be plausibly wrong:
--
--    * Address 0 is the DEFAULT address. A device there is
--      mid-enumeration and has endpoint 0 only. Honouring any other
--      endpoint would let a half-enumerated device answer traffic it has
--      no configuration for.
--
--    * An UNASSIGNED slot matches nothing, including address 0. A slot
--      that answered before being assigned would respond during another
--      device's enumeration.
--
--  Unlike the SPI decoder, this one CAN see its own worst failure: two
--  slots holding the same address is directly detectable, because the
--  address is a field every slot compares against.
-- ---------------------------------------------------------------------
library ieee;
use ieee.std_logic_1164.all;
use ieee.numeric_std.all;
use work.sel_pkg.all;

entity usb_addr_select is
  generic (
    N_SLOT : natural := 4
  );
  port (
    clk   : in std_logic;
    rst_n : in std_logic;

    -- ---- the assignment interface: this is the whole difference ----
    --
    -- spi_cs_select has no equivalent port. Its mapping is fixed at
    -- elaboration. This one's mapping is a register file, writable at run
    -- time, which is what "the host assigns an address" means in
    -- hardware.
    cfg_valid    : in std_logic;
    cfg_slot     : in std_logic_vector(sel_clog2(N_SLOT) - 1 downto 0);
    cfg_assigned : in std_logic;
    cfg_addr     : in std_logic_vector(6 downto 0);
    cfg_ep_mask  : in std_logic_vector(15 downto 0);

    req_valid : in std_logic;
    req_addr  : in std_logic_vector(6 downto 0);
    req_ep    : in std_logic_vector(3 downto 0);

    sel_valid  : out std_logic;
    sel_slot   : out std_logic_vector(sel_clog2(N_SLOT) - 1 downto 0);
    sel_reason : out std_logic_vector(2 downto 0);

    -- The failure this discipline CAN see.
    conflict : out std_logic;

    n_match    : out std_logic_vector(31 downto 0);
    n_no_addr  : out std_logic_vector(31 downto 0);
    n_no_ep    : out std_logic_vector(31 downto 0);
    n_conflict : out std_logic_vector(31 downto 0)
  );
end entity;

architecture rtl of usb_addr_select is
  constant SW : natural := sel_clog2(N_SLOT);

  constant R_NONE    : std_logic_vector(2 downto 0) := "000";  -- no token
  constant R_MATCH   : std_logic_vector(2 downto 0) := "001";  -- addressed + configured
  constant R_NO_ADDR : std_logic_vector(2 downto 0) := "010";  -- nobody holds it
  constant R_NO_EP   : std_logic_vector(2 downto 0) := "011";  -- endpoint not configured

  type asg_arr_t  is array (0 to N_SLOT - 1) of std_logic;
  type addr_arr_t is array (0 to N_SLOT - 1) of std_logic_vector(6 downto 0);
  type epm_arr_t  is array (0 to N_SLOT - 1) of std_logic_vector(15 downto 0);

  signal sl_asg  : asg_arr_t  := (others => '0');
  signal sl_addr : addr_arr_t := (others => (others => '0'));
  signal sl_epm  : epm_arr_t  := (others => (others => '0'));

  -- Initialised so the concurrent comparisons below are never
  -- evaluated against 'U' in the first delta cycle, which numeric_std
  -- reports as a metavalue warning on every run.
  signal m_any        : std_logic := '0';
  signal m_ep_any     : std_logic := '0';
  signal m_slot       : unsigned(SW - 1 downto 0) := (others => '0');
  signal m_addr_count : unsigned(SW downto 0) := (others => '0');
  signal reason_q     : std_logic_vector(2 downto 0) := "000";

  signal match_c  : unsigned(31 downto 0) := (others => '0');
  signal noaddr_c : unsigned(31 downto 0) := (others => '0');
  signal noep_c   : unsigned(31 downto 0) := (others => '0');
  signal conf_c   : unsigned(31 downto 0) := (others => '0');
begin

  match : process (all)
    variable any_v   : std_logic;
    variable ep_v    : std_logic;
    variable slot_v  : unsigned(SW - 1 downto 0);
    variable count_v : unsigned(SW downto 0);
  begin
    any_v   := '0';
    ep_v    := '0';
    slot_v  := (others => '0');
    count_v := (others => '0');
    -- Downwards, so the LOWEST matching slot wins. Defined, not
    -- arbitrary: the conflict case must have a predictable winner or it
    -- cannot be checked.
    for j in N_SLOT - 1 downto 0 loop
      if sl_asg(j) = '1' and sl_addr(j) = req_addr then
        count_v := count_v + 1;
        any_v   := '1';
        slot_v  := to_unsigned(j, SW);
        -- Address 0 is the default address: endpoint 0 only. A device
        -- there has no configuration yet, so honouring any other
        -- endpoint would answer traffic it cannot service.
        if sl_addr(j) = "0000000" then
          if req_ep = "0000" then
            ep_v := '1';
          end if;
        else
          if sl_epm(j)(to_integer(unsigned(req_ep))) = '1' then
            ep_v := '1';
          end if;
        end if;
      end if;
    end loop;
    m_any        <= any_v;
    m_ep_any     <= ep_v;
    m_slot       <= slot_v;
    m_addr_count <= count_v;
  end process;

  reason : process (all)
  begin
    if req_valid = '0' then
      reason_q <= R_NONE;
    elsif m_any = '0' then
      reason_q <= R_NO_ADDR;
    elsif m_ep_any = '0' then
      reason_q <= R_NO_EP;
    else
      reason_q <= R_MATCH;
    end if;
  end process;

  conflict   <= '1' when m_addr_count > 1 else '0';
  sel_valid  <= '1' when (req_valid = '1' and m_any = '1' and m_ep_any = '1') else '0';
  sel_slot   <= std_logic_vector(m_slot);
  sel_reason <= reason_q;

  n_match    <= std_logic_vector(match_c);
  n_no_addr  <= std_logic_vector(noaddr_c);
  n_no_ep    <= std_logic_vector(noep_c);
  n_conflict <= std_logic_vector(conf_c);

  process (clk, rst_n)
  begin
    if rst_n = '0' then
      sl_asg   <= (others => '0');
      sl_addr  <= (others => (others => '0'));
      sl_epm   <= (others => (others => '0'));
      match_c  <= (others => '0');
      noaddr_c <= (others => '0');
      noep_c   <= (others => '0');
      conf_c   <= (others => '0');
    elsif rising_edge(clk) then
      if cfg_valid = '1' then
        sl_asg(to_integer(unsigned(cfg_slot)))  <= cfg_assigned;
        sl_addr(to_integer(unsigned(cfg_slot))) <= cfg_addr;
        sl_epm(to_integer(unsigned(cfg_slot)))  <= cfg_ep_mask;
      end if;

      if req_valid = '1' then
        case reason_q is
          when R_MATCH   => match_c  <= match_c  + 1;
          when R_NO_ADDR => noaddr_c <= noaddr_c + 1;
          when R_NO_EP   => noep_c   <= noep_c   + 1;
          when others    => null;
        end case;
        if m_addr_count > 1 then
          conf_c <= conf_c + 1;
        end if;
      end if;
    end if;
  end process;

end architecture;