[sram_ctrl,dv] Add readback_regwen test

To close a coverage gap, this commit enhances the regwen_vseq to also
cover the readback_regwen register. To reflect this change, the
`sec_cm_readback_config_regwen` label is added. No functional
RTL change.

Now, EXPRESSION (readback_we & readback_regwen_qs) gets full cond.
coverage.

Closes #24358.

Signed-off-by: Pascal Nasahl <nasahlpa@lowrisc.org>

hw/ip/sram_ctrl/data/sram_ctrl.hjson

@@ -196,6 +196,9 @@
     { name: "EXEC.CONFIG.REGWEN",
       desc: "The SRAM execution enable register is protected by a REGWEN."
     }
+    { name: "READBACK.CONFIG.REGWEN",
+      desc: "The SRAM readback enable register is protected by a REGWEN."
+    }
     { name: "EXEC.CONFIG.MUBI",
       desc: "The SRAM execution enable register is multibit encoded."
     }

hw/ip/sram_ctrl/data/sram_ctrl_sec_cm_testplan.hjson

@@ -40,6 +40,17 @@
       stage: V2S
       tests: ["{name}_regwen"]
     }
+    {
+      name: sec_cm_readback_config_regwen
+      desc: '''Verify the countermeasure(s) READBACK.CONFIG.REGWEN.
+
+            The `readback` CSR is excluded in CSR tests, add another test to verify:
+             - When `readback_regwen` is 1, writting to `readback` can take effect.
+             - When `readback_regwen` is 0, writting to `readback` has no effect.
+            '''
+      stage: V2S
+      tests: ["{name}_regwen"]
+    }
     {
       name: sec_cm_exec_config_regwen
       desc: "Verify the countermeasure(s) EXEC.CONFIG.REGWEN."

hw/ip/sram_ctrl/data/sram_ctrl_testplan.hjson

@@ -147,12 +147,13 @@
     {
       name: regwen
       desc: '''
-            This test is intended to test `exec_regwen` and `ctrl_regwen` as well as their related
-            CSRs.
+            This test is intended to test `exec_regwen`, `ctrl_regwen`, and `readback_regwen` as
+            well as their related CSRs.
 
-            `ctrl_regwen` related CSRs (renew_scr_key and init) are excluded from CSRs test as they
+            `ctrl_regwen` related CSRs (renew_scr_key and init) are excluded from CSR tests as they
             affects other CSRs.
-            `exec_regwen` and its related CSRs are tested in CSRs tests, but this `exec` relates to
+            `readback_regwen` related CSRs are excluded from CSR tests as they affect other CSRs.
+            `exec_regwen` and its related CSRs are tested in CSR tests, but this `exec` relates to
             other sram inputs (en_sram_ifetch and hw_debug_en), so also test it in this test.
 
             Both `exec_regwen` and `ctrl_regwen` as well as their related CSRs will be programmed

hw/ip/sram_ctrl/doc/interfaces.md

@@ -50,6 +50,7 @@ Referring to the [Comportable guideline for peripheral device functionality](htt
 | SRAM_CTRL.BUS.INTEGRITY                | End-to-end bus integrity scheme.                                                                                                                                            |
 | SRAM_CTRL.CTRL.CONFIG.REGWEN           | The SRAM control register is protected by a REGWEN.                                                                                                                         |
 | SRAM_CTRL.EXEC.CONFIG.REGWEN           | The SRAM execution enable register is protected by a REGWEN.                                                                                                                |
+| SRAM_CTRL.READBACK.CONFIG.REGWEN       | The SRAM readback enable register is protected by a REGWEN.                                                                                                                 |
 | SRAM_CTRL.EXEC.CONFIG.MUBI             | The SRAM execution enable register is multibit encoded.                                                                                                                     |
 | SRAM_CTRL.EXEC.INTERSIG.MUBI           | The SRAM execution enable signal coming from OTP is multibit encoded.                                                                                                       |
 | SRAM_CTRL.LC_ESCALATE_EN.INTERSIG.MUBI | The life cycle escalation enable signal is multibit encoded.                                                                                                                |

hw/ip/sram_ctrl/dv/env/seq_lib/sram_ctrl_regwen_vseq.sv

@@ -2,24 +2,32 @@
 // Licensed under the Apache License, Version 2.0, see LICENSE for details.
 // SPDX-License-Identifier: Apache-2.0
 
-// This sequence tests exec_regwen and ctrl_regwen as well as their related CSRs.
-// ctrl_regwen related CSRs (renew_scr_key and init) are excluded from CSRs test as they affects
-// other CSRs
-// exec_regwen and its related CSRs are tested in CSRs tests, but this `exec` feature relates to
+// This sequence tests exec_regwen, ctrl_regwen, and readback_regwen as well as their related
+// CSRs.
+// ctrl_regwen related CSRs (renew_scr_key and init) are excluded from CSR tests as they affect
+// other CSRs.
+// readback_regwen related CSRs are excluded from CSR tests as they affect other CSRs.
+// exec_regwen and its related CSRs are tested in CSR tests, but this `exec` feature relates to
 // other sram inputs (en_sram_ifetch and hw_debug_en), so also test it in this vseq.
 class sram_ctrl_regwen_vseq extends sram_ctrl_executable_vseq;
 
   `uvm_object_utils(sram_ctrl_regwen_vseq)
   `uvm_object_new
 
+  int readback_reg_val = 0;
+  rand mubi4_t readback_en;
+
   task req_mem_init(bit wait_done);
     super.req_mem_init(wait_done);
     `DV_CHECK_RANDOMIZE_FATAL(ral.exec_regwen)
     csr_update(ral.exec_regwen);
     `DV_CHECK_RANDOMIZE_FATAL(ral.ctrl_regwen)
     csr_update(ral.ctrl_regwen);
-    `uvm_info(`gfn, $sformatf("exec_regwen: %0d, ctrl_regwen: %0d",
-                              `gmv(ral.exec_regwen), `gmv(ral.ctrl_regwen)), UVM_MEDIUM)
+    `DV_CHECK_RANDOMIZE_FATAL(ral.readback_regwen)
+    csr_update(ral.readback_regwen);
+    `uvm_info(`gfn, $sformatf("exec_regwen: %0d, ctrl_regwen: %0d, readback_regwen: %0d",
+                              `gmv(ral.exec_regwen), `gmv(ral.ctrl_regwen),
+                              `gmv(ral.readback_regwen)), UVM_MEDIUM)
 
     // req_mem_init in base seq only write 'b11 to this CSR
     // do some dummy write here to gain 100% coverage for regwen
@@ -32,6 +40,19 @@ class sram_ctrl_regwen_vseq extends sram_ctrl_executable_vseq;
     end
     // regwen coverage sample happens at read. ctrl is WO, so it always returns 0.
     csr_rd_check(.ptr(ral.ctrl), .compare_value(0));
+
+    // Check readback_regwen.
+    if (`gmv(ral.readback_regwen)) begin
+      // when regwen=1, disable the readback feature.
+      csr_wr(.ptr(ral.readback), .value(MuBi4False));
+      // regwen coverage sample happens at read.
+      csr_rd(.ptr(ral.readback), .value(readback_reg_val));
+    end else begin
+      // when regwen=0, writing any value to readback won't affect anything.
+      csr_rd(.ptr(ral.readback), .value(readback_reg_val));
+      csr_wr(.ptr(ral.readback), .value($urandom));
+      csr_rd_check(.ptr(ral.readback), .compare_value(readback_reg_val));
+    end
   endtask
 
 endclass

hw/ip/sram_ctrl/dv/env/sram_ctrl_scoreboard.sv

@@ -550,6 +550,9 @@ class sram_ctrl_scoreboard #(parameter int AddrWidth = 10) extends cip_base_scor
       "exec": begin
         // do nothing
       end
+      "readback_regwen": begin
+        // do nothing
+      end
       "readback": begin
         // do nothing
       end

hw/ip/sram_ctrl/rtl/sram_ctrl.sv

@@ -110,6 +110,7 @@ module sram_ctrl
 
   // SEC_CM: CTRL.CONFIG.REGWEN
   // SEC_CM: EXEC.CONFIG.REGWEN
+  // SEC_CM: READBACK.CONFIG.REGWEN
   sram_ctrl_regs_reg_top u_reg_regs (
     .clk_i,
     .rst_ni,