openvmm: KVM VP snapshots omit guest-writable MSRs across several CPU features #1160

When restoring a snapshot into fresh KVM vCPUs, OpenVMM only saves and restores the VP state elements listed in vmm_core/virt/src/x86/vp.rs and the 8 syscall MSRs in VirtualMsrs::names:

    (8, "pat", pat, set_pat, Pat),
    (9, "msrs", virtual_msrs, set_virtual_msrs, VirtualMsrs),
    (10, "drs", debug_regs, set_debug_regs, DebugRegisters),
    (11, "tsc", tsc, set_tsc, Tsc),
    (12, "cet", cet, set_cet, Cet),
    (13, "cet_ss", cet_ss, set_cet_ss, CetSs),
    (14, "tsc_aux", tsc_aux, set_tsc_aux, TscAux),
    // The deadline must be restored after APIC mode and guest TSC.
    (15, "tsc_deadline", tsc_deadline, set_tsc_deadline, TscDeadline),

Beyond IA32_SPEC_CTRL (tracked separately in P0-urgent/run-1-part-1-spec-ctrl), several non-mitigation guest-writable MSRs are neither included in VpSavedState nor carried by VirtualMsrs, causing fresh destination vCPUs to revert to reset/binder defaults after restore:

• IA32_UMWAIT_CONTROL (0xe1, run-1-part-2): Exposed on profiles advertising WAITPKG (CPUID.(7,0):ECX[5], e.g., Alder Lake). Guest-configured UMWAIT/TPAUSE time limits are lost on restore.
• Machine-check configuration and bank status (MCG_STATUS, MCi_CTL/STATUS/ADDR/MISC/CTL2, run-1-part-3): Restoring the LAPIC CMCI LVT entry does not restore MCA bank controls or pending error telemetry.
• Miscellaneous feature/power MSRs (IA32_MISC_ENABLE, MISC_FEATURES_ENABLES, POWER_CTL, AMD VM_HSAVE_PA, run-1-part-4): KvmProcessorBinder::bind reinitializes IA32_MISC_ENABLE to hv1_emulator::x86::MISC_ENABLE on fresh vCPUs, discarding any guest modifications permitted by KVM.
• IA32_DEBUGCTL (0x1d9, run-1-part-5): Architectural DR0–DR7 registers are saved in DebugRegisters, but IA32_DEBUGCTL (branch-step, LBR, RTM debug controls where supported) is omitted.
• IA32_BNDCFGS (0xd90, run-1-part-6): Exposed on Skylake-SP (CPUID.(7,0):EBX[14]); Xsave saves MPX bounds registers, but the IA32_BNDCFGS supervisor configuration MSR is omitted.
• AMD legacy PMU MSRs (PerfEvtSel0–3, PerfCtr0–3, run-1-part-7): Although architectural PMU leaf 0xA is cleared in built-in profiles, AMD legacy PMU MSRs remain accessible unless filtered by KVM and are not saved across restore.

Proposed Fix

For each MSR family above, either:

1. Add capability-gated optional state elements to VpSavedState (with a defined fallback when restoring older snapshots that lack those fields), or
2. Filter/disallow guest writes (or hide the corresponding CPUID feature bits, such as WAITPKG or MPX, on snapshot-supported profiles) when OpenVMM intentionally keeps those registers fixed.