I finally used SignalTap to check various signals inside of a core.
I had read that the the .sof image needed to be manually loaded, and no communication to the ARM core was possible, but that's not true at all; the .rbf can be instrumented, and connection can happen at any time.