Restore PANDA-faithful semantics in the QEMU compatibility layer

[lacraig2]

Summary

Fixes a batch of regressions from the panda-ng → qemu migration, identified in a systematic audit of the old stack (oldpenguin + PANDA) vs the new one. Counterpart to rehosting/qemu#7, which adds the QEMU-side exports these fixes use.

Register/env semantics (compat/qemu_compat.py) — the shim previously only emulated the hypercall-captured register view:

• arch.get_reg on uncaptured registers returned 0; now reads the real register via the new GDB-numbered QEMU exports (per-arch regnum maps verified against each target's gdbstub).
• arch.set_arg was a host-side-only no-op (live callers in nvram2); now writes through to the guest.
• arch.set_retval ignored convention/failure; MIPS A3 success/failure flag and error negation restored, gated on an explicit convention="syscall" to match pandare2's 'default' default.
• New panda.cpu_env(cpu) returns a typed CPUArchState * (full env: coprocessor registers, timers, FPU) via the compiled CFFI module shipped in the QEMU package, with the generated ABI-mode header as fallback; panda.sync_cpu_state(cpu) handles KVM freshness/write-back and cpu_env auto-syncs there.
• powerpc64el now normalizes to ppc64le conventions and resolves powerpc64le-spelled assets — the arch was entirely unusable before.
• virtual_memory_read(fmt="int") decodes unsigned again (pandare2 parity; kernel pointers must not come back negative).

Fail-fast guest callbacks — hypercall handler exceptions were logged and swallowed, with the guest seeing rv=0 for an unserviced hypercall. Now the first fatal error stops dispatch, ends the emulation, and re-raises out of panda.run(), mirroring PyPANDA.

Syscall-event writeback — the direct writeback path lost the address mask and the portal fallback of the old mem.write_bytes path; hooked-syscall modifications could be silently dropped. Both restored.

Portalcalls — unregistered magics skipped the real syscall and faked success (guest sendto() returned 0); now the real syscall runs and the first miss per magic logs at error level.

Events — portalcall-delivered events published cpu=None; subscribers doing memory reads got a NULL CPUState*. Now the real current CPU is passed on both delivery paths.

Now pins QEMU 0.0.8, which ships the rehosting/qemu#7 exports, the powerpc64el assets, and the generated env headers — so the full register/env semantics are active. Verified the shim directly against the released v0.0.8 artifact: register exports resolve, powerpc64el loads with ppc64le conventions, and panda.cpu_env() works via the ABI env header.

One caveat: v0.0.8 contains no compiled CFFI env modules — the qemu builder image lacks python3-dev, so the module build silently fell back to header-only (fix + release gate in rehosting/qemu#8). The shim already prefers compiled modules when present, so the next qemu release activates them with no penguin change.

Testing

• 11-check behavioral harness: MIPS A3/negation/convention gating, set_arg write-through + graceful degradation, get_reg fallback, fail-fast recording, portalcall passthrough with the registered path intact, unsigned fmt="int", powerpc64el resolution.
• End-to-end against a locally built qemu lib with the PR#7 exports: register writes land in env at gdb-verified offsets; cpu_env field writes (CP0_Count, active_tc.gpr[7], x86 fpregs[i].d.low) land at gdb-verified byte offsets via both the compiled module and the header fallback.
• tests/unit_tests/test_kvm_logic.py / test_kvm_runner_final.py unchanged (3 pre-existing host-environment failures present with and without these changes).

Note: the rw_logger target_long cast site flagged in the audit is already covered by 79a8f89's guest-sized target_long typedefs — no change needed there.