[aes/rtl] Make rw/hro fields of CTRL reg observable to software

Without this commit, software always reads 0 from hro fields of the
CTRL register.

This is related to lowRISC/OpenTitan#1428.

Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>
diff --git a/hw/ip/aes/data/aes.hjson b/hw/ip/aes/data/aes.hjson
index 940c0df..42a4cff 100644
--- a/hw/ip/aes/data/aes.hjson
+++ b/hw/ip/aes/data/aes.hjson
@@ -96,7 +96,7 @@
       AES unit is non-idle, writes to this register are ignored.
     '''
     swaccess: "rw",
-    hwaccess: "hro",
+    hwaccess: "hrw",
     hwext:    "true",
     hwqe:     "true",
     fields: [
diff --git a/hw/ip/aes/rtl/aes_core.sv b/hw/ip/aes/rtl/aes_core.sv
index 1b79db4..abf5b88 100644
--- a/hw/ip/aes/rtl/aes_core.sv
+++ b/hw/ip/aes/rtl/aes_core.sv
@@ -398,6 +398,11 @@
 
   assign hw2reg.ctrl.key_len.d  = {key_len_q};
 
+  // These fields are actually hro. But software must be able observe the current value (rw).
+  assign hw2reg.ctrl.mode.d                 = mode_q;
+  assign hw2reg.ctrl.manual_start_trigger.d = manual_start_trigger_q;
+  assign hw2reg.ctrl.force_data_overwrite.d = force_data_overwrite_q;
+
   ////////////////
   // Assertions //
   ////////////////
diff --git a/hw/ip/aes/rtl/aes_reg_pkg.sv b/hw/ip/aes/rtl/aes_reg_pkg.sv
index 5721e07..9c386e2 100644
--- a/hw/ip/aes/rtl/aes_reg_pkg.sv
+++ b/hw/ip/aes/rtl/aes_reg_pkg.sv
@@ -78,8 +78,17 @@
 
   typedef struct packed {
     struct packed {
+      logic        d;
+    } mode;
+    struct packed {
       logic [2:0]  d;
     } key_len;
+    struct packed {
+      logic        d;
+    } manual_start_trigger;
+    struct packed {
+      logic        d;
+    } force_data_overwrite;
   } aes_hw2reg_ctrl_reg_t;
 
   typedef struct packed {
@@ -136,12 +145,12 @@
   // Internal design logic to register //
   ///////////////////////////////////////
   typedef struct packed {
-    aes_hw2reg_key_mreg_t [7:0] key; // [534:279]
-    aes_hw2reg_data_in_mreg_t [3:0] data_in; // [278:147]
-    aes_hw2reg_data_out_mreg_t [3:0] data_out; // [146:19]
-    aes_hw2reg_ctrl_reg_t ctrl; // [18:9]
-    aes_hw2reg_trigger_reg_t trigger; // [8:5]
-    aes_hw2reg_status_reg_t status; // [4:5]
+    aes_hw2reg_key_mreg_t [7:0] key; // [537:282]
+    aes_hw2reg_data_in_mreg_t [3:0] data_in; // [281:150]
+    aes_hw2reg_data_out_mreg_t [3:0] data_out; // [149:22]
+    aes_hw2reg_ctrl_reg_t ctrl; // [21:12]
+    aes_hw2reg_trigger_reg_t trigger; // [11:8]
+    aes_hw2reg_status_reg_t status; // [7:8]
   } aes_hw2reg_t;
 
   // Register Address
diff --git a/hw/ip/aes/rtl/aes_reg_top.sv b/hw/ip/aes/rtl/aes_reg_top.sv
index 18249f5..694a484 100644
--- a/hw/ip/aes/rtl/aes_reg_top.sv
+++ b/hw/ip/aes/rtl/aes_reg_top.sv
@@ -442,7 +442,7 @@
     .re     (ctrl_mode_re),
     .we     (ctrl_mode_we),
     .wd     (ctrl_mode_wd),
-    .d      ('0),
+    .d      (hw2reg.ctrl.mode.d),
     .qre    (),
     .qe     (reg2hw.ctrl.mode.qe),
     .q      (reg2hw.ctrl.mode.q ),
@@ -472,7 +472,7 @@
     .re     (ctrl_manual_start_trigger_re),
     .we     (ctrl_manual_start_trigger_we),
     .wd     (ctrl_manual_start_trigger_wd),
-    .d      ('0),
+    .d      (hw2reg.ctrl.manual_start_trigger.d),
     .qre    (),
     .qe     (reg2hw.ctrl.manual_start_trigger.qe),
     .q      (reg2hw.ctrl.manual_start_trigger.q ),
@@ -487,7 +487,7 @@
     .re     (ctrl_force_data_overwrite_re),
     .we     (ctrl_force_data_overwrite_we),
     .wd     (ctrl_force_data_overwrite_wd),
-    .d      ('0),
+    .d      (hw2reg.ctrl.force_data_overwrite.d),
     .qre    (),
     .qe     (reg2hw.ctrl.force_data_overwrite.qe),
     .q      (reg2hw.ctrl.force_data_overwrite.q ),