penguin: guest register access, CPUArchState CFFI headers, powerpc64el target

[lacraig2]

Summary

Three changes restoring PANDA-era CPU state access for Penguin's PyPANDA compatibility layer (part of the panda-ng → qemu migration cleanup):

1. penguin_read_guest_reg / penguin_write_guest_reg — small exports over the gdbstub register accessors (gdb_read_register/gdb_write_register), keyed by GDB core-feature register number, with cpu_synchronize_state so they are correct under both TCG and KVM. These restore PANDA-era semantics for arch.get_reg outside the captured syscall args, arch.set_arg write-through to the guest, and the MIPS A3 syscall success/failure flag in arch.set_retval. Penguin handles name→regnum mapping and endianness and degrades gracefully against libs without these exports.

2. Compiled CPUArchState CFFI modules + generated headers — the gdbstub surface covers the GDB core register set only; Penguin also wants typed access to the rest of the per-target CPU state (coprocessor registers, timers, FPU) the way PyPANDA's CPUArchState cdefs did. scripts/penguin-env-cffi-gen.py enumerates fields from the DWARF of each just-built library and produces two artifacts per target:

   • a compiled CFFI API-mode module (_penguin_qemu_env_<mode>_<arch>): real type names with ... ellipses, compiled against the actual QEMU headers with flags harvested from compile_commands.json — the C compiler is the layout authority, bitfields and anonymous members are fully supported (x87/MMX register unions included), and layout checks run at import. Cached as a build artifact; tied to the builder's CPython ABI (cp310, matching Penguin's 22.04 container).
   • an ABI-mode header (qemu_cffi_<mode>_<arch>_env.h) as a Python-version-agnostic fallback: layout-exact cdef verified field-by-field against DWARF offsets, unrepresentable members padded over.

   Two supporting exports: penguin_cpu_env (the CPUState+1 layout contract validated in cpu-target.c, usable from common code) and penguin_sync_cpu_state (env freshness/write-back under KVM). Both artifacts ride along in the cffi manifest and penguin-qemu.tar.gz; Penguin prefers the compiled module and falls back to the header.

3. powerpc64el system target assets — Penguin's archend spelling for little-endian ppc64 is powerpc64el and it dlopens libqemu-system-powerpc64el.so, but the build only staged a powerpc64le alias, leaving the arch unusable under the QEMU backend. Both spellings now alias ppc64-softmmu.

Testing

• Single-target smoke builds (mipsel-softmmu, x86_64-softmmu): compile and link cleanly; all four new symbols exported with default visibility; NULL-CPU guards return error codes without crashing when called via cffi.
• Env header generation runs in ~6s per target. Layout cross-checked independently against gdb ground truth on both targets: mipsel (sizeof(CPUArchState)=7520, CP0_Count@1052, CP0_Compare@1064, active_tc.gpr[7]@28) and x86_64 (regs@0, eip@256, cr@552, xmm_regs@992, efer@728, sizeof=15344) — all exact.
• Only dropped members across both targets: zero-length save/reset marker arrays, one Int128 field, and the host-side breakpoint/watchpoint debug union — no guest-visible state lost.
• End-to-end through Penguin's compat shim: panda.cpu_env(cpu) returns a typed CPUArchState * (from the compiled module when present, header otherwise) whose field writes land at the gdb-verified byte offsets; x86_64 fpregs[i].d.low, MMX views, and the flattened breakpoint/watchpoint union all accessible.
• Build deps: pyelftools>=0.31 + cffi added to the builder image (DWARF5 needs recent pyelftools).

The Penguin-side counterpart (GDB regnum maps, cpu_env()/sync_cpu_state() shim methods, set_retval/set_arg/get_reg semantics) lands separately in rehosting/penguin.