hw/misc: add ESP32-S3 AppTrace JTAG host emulation (QEMU-296)

[ltowarek]

Description

Add an Esp32s3AppTrace device that emulates the OpenOCD JTAG host of the ESP-IDF AppTrace component. It lets esp_gcov_dump() (and other AppTrace file I/O users) stream .gcda coverage files out of a running guest without a real JTAG probe attached.

To reach the TRAX registers the firmware drives, this also adds a pluggable Xtensa External Register (RER/WER) handler: the ER address space, previously created with NULL MemoryRegionOps (RER read as 0, WER discarded), now forwards to an optional board-installed callback via xtensa_cpu_set_er_ops(), mirroring riscv_cpu_set_rdtime_fn(). With no handler installed the behaviour is unchanged.

The device installs such a handler per core. The firmware drives the TRAX control and status registers, and on each block swap the device reads the committed up-channel chunks from guest DRAM, services the file I/O commands (fopen/fwrite/fread/fseek/ftell/fclose/feof) on the host, and writes the response back into the same TRAX block. Each core gets its own register bank; the host file service is shared. Open files are closed and the registers cleared on system reset.

It is enabled per machine:

-machine esp32s3,app-trace=file_io[,app-trace-path=DIR]

When app-trace-path is given, guest file paths are confined under that host directory ('..' escapes are rejected). Without it, guest paths are used verbatim, which lets the guest read and write host files with the privileges of the QEMU process -- intended for coverage dumps to the absolute host build paths that gcov emits. The machine property description carries the same warning.

Related

Working example - https://github.com/ltowarek/dust-mite/actions/runs/28400621494/job/84151850495?pr=103#step:5:1

Testing

Tested as part of ltowarek/dust-mite#103

---

Checklist

Before submitting a Pull Request, please ensure the following:

• 🚨 This PR does not introduce breaking changes.
• All CI checks (GH Actions) pass.
• Documentation is updated as needed.
• Tests are updated or added as necessary.
• Code is well-commented, especially in complex areas.
• Git history is clean — commits are squashed to the minimum necessary.