Debug module DV - Chip-level integration tests + JTAG DMI agent

[martin-velay]

Chip-level debug testpoints beyond the smoke (the smoke is tracked in #141). The debug module is the raw PULP dm_top + dmi_jtag, not the OpenTitan rv_dm wrapper.

Prerequisite: connect a JTAG DMI agent (the vendored hw/vendor/lowrisc_ip/dv/sv/jtag_agent + jtag_dmi_agent) to the chip JTAG pins, which are currently tied off in hw/top_chip/dv/tb/tb.sv.

Testpoints (all V2, placeholders registered):

• chip_rv_dm_ndm_reset (rv_dm_ndm_reset_req, rv_dm_ndm_reset_req_when_cpu_halted)
• chip_rv_dm_sba (rv_dm_sba_access / rv_dm_sba_access_cheri)
• chip_rv_dm_access_after_wakeup (rv_dm_access_after_wakeup)
• chip_rv_dm_access_after_escalation_reset (rv_dm_access_after_escalation_reset)

Open questions for the debug/reset specialist that gate the pass/fail wording: (a) does the debug module survive its own NDM reset, given rst_debug_n is parented on rst_sys_src_n (the system-reset tree the NDM reset drives); (b) is debug meant to be available during low power, given the DM is clocked by clk_main_infra which gates in sleep; (c) is unconditional JTAG debug intended, or should it be gated by lifecycle state / authentication; (d) debug-mode CHERI behaviour (PCC for debug-ROM fetch, and capability-register tag access via abstract commands); (e) confirm the SBA-to-memory tag behaviour (the DM master drives AXI user=0, so SBA writes clear capability tags and reads cannot observe tag validity).

chip_rv_dm_access_after_escalation_reset is additionally blocked on alert_handler integration (#270).

[martin-velay]

Answers received from Marno van der Maas (debug-module owner), 2026-07-14. Resolutions and how each maps to the testplan:

• NDM reset survival: the debug module DOES survive its own NDM reset. In the rstmgr's OpenTitan terminology, sys_rst-parented resets (including rst_debug_n) survive the debug-module reset, while lc_rst-parented resets are reset by it. Fixed in [hw] Rework reset tree for non-debug-module reset #593. chip_rv_dm_ndm_reset now asserts the DM/DMI stay accessible throughout the reset, including the CPU-already-halted variant.
• Debug during low power: intended. The DM and DMI bridge are on clk_main_infra, gated in low power; the DM has nothing to interact with and no means to wake the chip while the core and bus are down. chip_rv_dm_access_after_wakeup now asserts "no access during sleep, restored after wakeup."
• Debug enable / gating: external debug is NOT meant to be unconditional. A top-level debug-enable input driven by an external root of trust is planned (see doc/ref/arch.md top-level interface), implementation tracked by Top-level interfaces finalised #637 (targeted for RC-1). Added chip_rv_dm_debug_disabled (V2) to verify JTAG debug is denied when debug-enable is deasserted; depends on Top-level interfaces finalised #637.
• Debug-mode CHERI fetch: all CHERI checks are disabled while the core is in debug mode, so debug-ROM fetch and abstract commands are not subject to PCC bounds. No fetch-bounds testpoint needed. (Future: debug mode may not stop CHERI LSU checks, pending the RISC-V Y standard.)
• Capability-register tag via abstract command: the DM currently transfers 64-bit data only (no tag). For RC-1, once the DM scratch registers are full capability length, we should read out full capabilities (data plus tag) from the core to the DM. Added chip_rv_dm_cap_reg_access (RC-1, depends on the capability-aware DM).
• SBA-to-memory tag behaviour: confirmed intended. The current (non-capability-aware) DM drives the AXI user/tag to zero, so SBA writes clear the tag (a debugger cannot forge a valid capability) and SBA reads see data only. chip_rv_dm_sba is kept as written; RC-1 may extend it to write valid and invalid tags if a capability-aware DM is adopted.

Related: #593 (NDM reset fix), #637 (debug-enable pin).