[spi_device] Add Read access to Read buffer in PassThru

This commit adds a test accessing the read buffer while SPI Device is in
the Passthrough mode.

The expected behavior is to not fetch any data from DPSRAM and return
garbage data.

Signed-off-by: Eunchan Kim <eunchan@opentitan.org>

hw/ip/spi_device/pre_dv/tb/spid_readcmd_tb.sv

diff --git a/hw/ip/spi_device/pre_dv/tb/spid_readcmd_tb.sv b/hw/ip/spi_device/pre_dv/tb/spid_readcmd_tb.sv
index ea8818a..76b6249 100644
--- a/hw/ip/spi_device/pre_dv/tb/spid_readcmd_tb.sv
+++ b/hw/ip/spi_device/pre_dv/tb/spid_readcmd_tb.sv
@@ -321,12 +321,14 @@
     // Issue Read Cmd: Fast Read Buffer Flip
 
 
-    //=========================================================================
-    // Issue Read Cmd: Fast Read to Mailbox
-
     // Switch PassThrough mode
     ->flashmode_done;
 
+    // Wait till configuration done from SW side
+    repeat(20) @(negedge tb_sif.clk);
+
+    //=========================================================================
+    // Issue Read Cmd: Fast Read to Mailbox
     $display("Sending Fast Read Command to Mailbox");
     mbx_offset = $urandom_range(0, MailboxSpace -1);
     // Check mbx_offset and determine size
@@ -350,6 +352,31 @@
     expected_data.delete();
 
     //=========================================================================
+    // Issue Read Cmd to Read buffer space in PassThrough
+    //
+    //   Expected: return high-z or X or '0
+    $display("Sending Fast Read to Read Buffer while in PassThrough");
+    spiflash_read(
+      tb_sif,
+      8'h 0B,
+      $urandom_range(0, MailboxHostAddr-1),
+      1'b 1,
+      8,
+      1,
+      IoSingle,
+      read_data
+    );
+
+    if (! (read_data[0] inside {'hx, 'hz, 'h0}) ) begin
+      $display("Received data is not expected: %x", read_data[0]);
+      match = 1'b 0;
+    end else begin
+      $display("Expected data has been received [%x]", read_data[0]);
+    end
+
+    read_data.delete();
+
+    //=========================================================================
     // Issue Read Cmd: Fast Read Mailbox Boundary Crossing
 
     // Complete the simulation