Address Map Checklist

There is no Wishbone rule about your address map. B3 hands the job to the interconnect and declines to describe it:

"each SLAVE decodes only the range of addresses that it requires... The remaining address bits are decoded by the interconnection system."

Everything in this chapter is therefore a SYSTEM INVARIANT, and the practical consequence is blunt: no protocol checker you can buy or write will catch any of it.

1. The Four Decisions

Module 12 built the mechanism. The review takes it apart into four independently-wrong steps:

Overlap and alias are different failures and a review that only checks one has done half the job:

An overlap is resolved by first-match-wins, silently — the shadowed peripheral simply stops receiving traffic and does not complain. An alias produces no collision at all: the truncated address matches exactly one region, and it is the wrong one.

2. Sweep Boundaries, Not Typical Addresses

MAP-03. Has every region boundary been probed, in both directions?

The probe set is not a sample. It is nine positions chosen because each one can be wrong on its own:

=== SIM F - ADDRESS OWNERSHIP MATRIX ===

  probe                 address  expected  actual    offset  selects  term
  seed write           0x0100  S1 mem    S1 mem    kept         1  ACK 
  seed write           0x01ff  S1 mem    S1 mem    kept         1  ACK 
  first of S0          0x0000  S0 regs   S0 regs   kept         1  ACK 
  last of S0           0x00ff  S0 regs   S0 regs   kept         1  ERR 
  first of S1          0x0100  S1 mem    S1 mem    kept         1  ACK 
  last of S1           0x01ff  S1 mem    S1 mem    kept         1  ACK 
  one above the top    0x0200  unmapped  unmapped  kept         1  ERR 
  hole                 0x0300  unmapped  unmapped  kept         1  ERR 
  alias candidate      0x1000  unmapped  unmapped  kept         1  ERR 

  addresses checked                    9
  owner mismatches                     0
  local-offset mismatches              0
  multi-select events                  0
  protocol violations  P0 0   P2 0
  monitor unknown fields               0

Three details in that table are review discipline rather than decoration.

The two seed writes come first. Probing a memory word nobody has written produces X, and an X in a mismatch is a stimulus bug wearing a design bug's clothes. Define the state before reading it.

0x00FF terminates with ERR and still counts as a correct decode. Termination class and address ownership are different questions. That address belongs to the register slave and reached it; the slave refused it because offset 0xF is reserved. A review that conflates where did it go with what did it answer will chase the wrong thing.

The expected column is computed from the documented map as ranges, deliberately not from the decoder's own mask arithmetic:

  // The expected decode, written from the documented map as RANGES. A
  // bug in the fabric's mask arithmetic must not be able to hide inside
  // the checker that is supposed to catch it.
  function [1:0] expect_owner(input [15:0] a);

EXECUTED TESTBENCH — tb_m30_map.sv.

PASS: owner mismatches 0, local-offset mismatches 0, multi-select 0, across all nine probes. FAIL: any nonzero. Holes are judged against documented policy, not against zero — an unmapped address answering ERR is a pass only if ERR is what you specified.

3. The Alias, And What Stays Silent

MAP-07. Can two global addresses reach one resource?

The same nine probes, one truncated compare:

=== SIM G - ADDRESS ALIAS NEGATIVE CONTROL ===

  the same nine probes, one truncated compare

  address  expected  actual    term
  0x0000  S0 regs   S0 regs   ACK 
  0x00ff  S0 regs   S0 regs   ERR 
  0x0100  S1 mem    S0 regs   ACK 
  0x01ff  S1 mem    S0 regs   ERR 
  0x0200  unmapped  S0 regs   ACK 
  0x0300  unmapped  S0 regs   ACK 
  0x1000  unmapped  S0 regs   ACK 

  owner mismatches                     7
  protocol violations  P0 0   P2 0
  monitor unknown fields               0

  THE HANDSHAKE IS CLEAN AND THE MAP IS NOT.
  7 probes reached a target the documented map does not
  assign them to, including an address in no window at all,
  and not one protocol check fired. Address ownership is a
  SYSTEM INVARIANT; no Wishbone rule encodes your map.

Look at 0x0200 and 0x1000. Those addresses belong to no region, and a correct system answers ERR from a default responder. Here they are acknowledged, by the register slave, with a plausible-looking value.

And every handshake is legal. CYC and STB correct, one termination each, data qualified, request held still. A design that shipped like this would pass every protocol check in Module 26 and corrupt configuration registers from addresses nobody mapped.

4. Documentation Versus RTL

MAP-11. Do the documented map and the executable decode describe the same machine?

This is the review item most often skipped and most often wrong, because the two artifacts are maintained by different people at different times.

The check is mechanical: take the map from the datasheet, encode it as an independent range function, and sweep. SIM F's expect_owner is the documented map, and the sweep is the comparison. If they disagree, one of them is wrong and the review cannot tell you which — that is a conversation, not a defect report.

Three ways they drift apart:

The third is the nastiest, because the owner column is clean and only the offset column moves. It is also the one an interface-only monitor can never see.

5. Byte Or Word

MAP-13. Do the map, the decode and the register bank agree on what an address unit is?

A 32-bit port with byte addressing means register k sits at byte address 4k, and a decoder indexing adr[n:0] directly has just built a map four times denser than the datasheet describes. Every access still terminates. Every handshake stays legal.

Module 29 found a real system decoding ADR[31:30] — two bits for a whole SoC — which is correct there and would be catastrophic with four peripherals. The review question is not "is the decode narrow" but "is the decode as wide as the map it implements".

6. False Confidence

"The documentation says so." Proves: somebody wrote it down. Does not prove: that the RTL implements it. SIM G's decode is entirely consistent with a document nobody checked it against. Missing evidence: a sweep whose expected column comes from the document and whose actual column comes from the design.

"ACK came back." Proves: something answered. Does not prove: which something. Seven probes in SIM G were acknowledged by the wrong peripheral. Missing evidence: a decode trace recording the address asked for and the target strobed as two separate fields.

7. The Address Map Checklist

MAP-14 is the one that decays fastest. An address-map review is valid for exactly as long as the map is.

8. What To Carry Forward

• No Wishbone rule encodes your address map. Every item here is a system invariant, and no protocol checker will help.
• Overlap and alias are different failures. One is silent because it resolves; the other is silent because it does not collide.
• Sweep boundaries. First, last, one below, one above, a hole, and a truncation candidate — nine probes found seven mismatches in SIM G.
• Seed before you read. An X in a mismatch is a stimulus defect.
• Owner and termination are separate columns. An ERR from the right peripheral is a correct decode.
• Compare the document against the design, as two independent artifacts.

Chapter 30.4 takes two individually-correct endpoints and shows them deadlocking.