[spi_device] Mailbox intercept logic.

Mailbox is processed in readcmd submodule. If the received address falls
into the mailbox region, the logic raises the intercept signal to assume
the SPI and return data internally regardless of spi Flash or
Passthrough mode.

Signed-off-by: Eunchan Kim <eunchan@opentitan.org>
diff --git a/hw/ip/spi_device/rtl/spi_device.sv b/hw/ip/spi_device/rtl/spi_device.sv
index ef3851f..4eb9094 100644
--- a/hw/ip/spi_device/rtl/spi_device.sv
+++ b/hw/ip/spi_device/rtl/spi_device.sv
@@ -220,7 +220,7 @@
   sel_datapath_e cmd_dp_sel, cmd_dp_sel_outclk;
 
   // Mailbox in Passthrough needs to take SPI if readcmd hits mailbox address
-  logic intercept_en, intercept_q;
+  logic intercept_en;
 
   logic cfg_mailbox_en;
   logic [31:0] mailbox_addr;
@@ -954,15 +954,14 @@
 
   // Assume `intercept` is registered (SPI_IN).
   // passthrough assumed signal shall be registered in (SPI_OUT)
-  always_ff @(posedge clk_spi_in_buf or negedge rst_spi_n) begin
-    if (!rst_spi_n)      intercept_q <= 1'b 0;
-    else if (|intercept) intercept_q <= 1'b 1;
-  end
-
   always_ff @(posedge clk_spi_out_buf or negedge rst_spi_n) begin
     if (!rst_spi_n) intercept_en <= 1'b 0;
-    else            intercept_en <= |intercept | intercept_q;
+    else            intercept_en <= |intercept;
   end
+  // intercept_en shall not be de-asserted except reset
+  `ASSUME(InterceptLevel_M,
+    $rose(intercept_en) |=> $stable(intercept_en) until !rst_spi_n,
+    clk_spi_out_buf, !rst_spi_n)
 
   ////////////////////////////
   // SPI Serial to Parallel //
@@ -1134,7 +1133,9 @@
 
     .addr_4b_en_i (cfg_addr_4b_en),
 
-    .mailbox_en_i      (cfg_mailbox_en ),
+    .mailbox_en_i           (cfg_mailbox_en ),
+    .cfg_intercept_en_mbx_i (cfg_intercept_en.mbx),
+
     .mailbox_addr_i    (mailbox_addr   ),
     .mailbox_assumed_o (intercept.mbx  ),
 
diff --git a/hw/ip/spi_device/rtl/spi_readcmd.sv b/hw/ip/spi_device/rtl/spi_readcmd.sv
index 6f38dd4..7e4353c 100644
--- a/hw/ip/spi_device/rtl/spi_readcmd.sv
+++ b/hw/ip/spi_device/rtl/spi_readcmd.sv
@@ -152,6 +152,7 @@
 
   // Features
   input mailbox_en_i,
+  input cfg_intercept_en_mbx_i, // Intercept
 
   // Mailbox Address base address
   // Only allow compile-time fixed size (1kB by default)
@@ -179,9 +180,6 @@
   spi_mode_e unused_spi_mode ; // will be used for passthrough for output enable
   assign unused_spi_mode = spi_mode_i;
 
-  // TODO: Implement
-  assign mailbox_assumed_o = 1'b 0;
-
   sram_err_t unused_sram_rerr;
   assign unused_sram_rerr = sram_m2l_i.rerror;
 
@@ -471,6 +469,17 @@
   // manages the address to follow.
 
   logic sram_req;
+
+  // Check if mailbox and intercept config, then raises mailbox_assumed.
+  // The signal shall be registered in SCK in.
+  // Then, spi_device top will latch to SCK out
+  always_ff @(posedge clk_i or negedge rst_ni) begin
+    if (!rst_ni) mailbox_assumed_o <= 1'b 0;
+    else if (sram_req && mailbox_en_i && cfg_intercept_en_mbx_i
+            && addr_in_mailbox) begin
+      mailbox_assumed_o <= 1'b 1;
+    end
+  end
   //- END:   SRAM Datapath ----------------------------------------------------
 
   //= BEGIN: FIFO to P2S datapath =============================================