[ownership, rescue] Allow rescue to be triggered by watchdog

[cfrantz]

Allow rescue mode to be configured such that a watchdog timeout can
trigger entry into rescue mode.

1. Rename RESCUE_GPIO to RESCUE_MISC_GPIO.
2. Add an configuration bit to the RESCUE_MISC_GPIO byte.
3. Trigger rescue when the configuration bit is true and the reset reason includes a watchdog timeout.
4. Add tests to verify entry into rescue after a watchdog timeout.
5. Update opentitanlib to understand the enter_on_watchdog field.

[moidx]

Hi @cfrantz, can you add some documentation with recommendations on when to use this mode of operation? Is it only intended to be used in development and/or test environments?

[cfrantz]

Hi @cfrantz, can you add some documentation with recommendations on when to use this mode of operation? Is it only intended to be used in development and/or test environments?

I updated the documentation. This option is an owner configuration decision; I don't anticipate any special restrictions on its use.

The change was motivated by a customer accidentally bricking one of their dev boards by flashing a correctly signed but invalid image (ie: the image contained garbage code which hung until the WDT reset). The customer was able to use rescue on their dev board (with SW_STRAPs as the rescue trigger).

The customer anticipated that if the same type of image error occurred in a production environment, they'd have a difficult time recovering the device without automatic entry into rescue mode. Since a valid and properly functioning owner firmware should always manage the watchdog, a watchdog timeout is a reasonable configuration for entering rescue mode in the ROM_EXT.