[rtl, prim_reg_cdc_arb] Conditional coverage simplification

[antmarzam]

end else if (dst_req_i && !dst_req_q && busy) begin is equivalent to
end else if (dst_req_i && busy) begin.

In order to guarantee the above happens an assertion has been added checking:
dst_req_i |-> !dst_req_q

The reasoning for the simplification is:

In prim_reg_cdc, we expect to see a request that comes from the SW
as a signal on the src domain (either src_we_i or src_re_i).
This gets synchronised to the destination clock by
u_src_to_dst_req.
This then appears to the arbiter as dst_req_i.
If there is another request in flight (probably an update from HW),
the SW request get stored in the dst_req_q register.
The stored request gets cleared on the first posedge of the dst
clock after the previous request is complete, because it causes
dst_lat_d to be high.
To see dst_req_i && dst_req_q, we would need prim_reg_cdc to
send another request before that happened.
When the first SW request appears in prim_reg_cdc, we set busy
until we see src_ack.
This goes high when the SW request has been synchronised to the
dst clock by u_dst_update_sync.
As such, we can't see another request from prim_reg_cdc before
src_req_q has been cleared. Clearing src_req_q takes exactly one
clock crossing time and allowing prim_reg_cdc to send the second
request takes the same time.

This is part of the efforts to close code coverage for AON timer and taken as
feedback from Rupert in PR:
#25705 (comment)

[rswarbrick]

This looks good to me, thanks.

[rswarbrick]

CHANGE AUTHORIZED: hw/ip/prim/rtl/prim_reg_cdc_arb.sv

The behaviour shouldn't change (as "derived" reasonably carefully and described in the commit message). The assertion will explode in DV if we've got something wrong.

[alees24]

CHANGE AUTHORIZED: hw/ip/prim/rtl/prim_reg_cdc_arb.sv

[alees24]

@antmarzam Could you fix the first two lines of the commit message, please, just to clarify?

[antmarzam]

@alees24 Just pushed the changes amending the commit