OpenVMM/microVM umbrella: processor state across snapshots #1182

Objective. A capture saves every guest-visible piece of processor state, or refuses state that it cannot represent; a restore writes all of it; and a restore rejects unsupported or malformed state, a snapshot's own CPU profile included, with an error before it changes the partition. Most children concern the KVM backend.

Children.

Order. No child blocks another.

Notes.

• openvmm: KVM snapshot restore loses guest SPEC_CTRL mitigation settings #1141 and openvmm: KVM VP snapshots omit guest-writable MSRs across several CPU features #1160 both add capability-gated optional VP state, and both must decide how older snapshots and readers behave; give them one mechanism and one policy. openvmm: VirtualMsrs.sysenter_eip holds SYSENTER_ESP on KVM, MSHV and WHP #1367 (what fields 3 and 4 of VirtualMsrs mean) and openvmm: KVM snapshots drop the interrupt-shadow kind (STI vs MOV SS) #1369 (the shadow's kind) need the same decision. openvmm: KVM VP snapshots omit guest-writable MSRs across several CPU features #1160 may instead hide some of its CPUID features, as openvmm: KVM guests with an Intel profile can write AMD HWCR, lost on restore #1368 hides HWCR.
• openvmm: KVM snapshots silently lose pending SMI and SMM execution state #1158, openvmm: KVM snapshot restore collapses two pending NMIs into one #1161, openvmm: KVM snapshot restore drops pending exceptions and panics on backend-normalized CPU state in debug builds #1169, openvmm: KVM snapshots drop the interrupt-shadow kind (STI vs MOV SS) #1369, and openvmm: restoring an injected #BP or #OF on KVM loses it or panics debug #1385 all change KvmVpStateAccess::{activity, set_activity}; land them one at a time. openvmm: KVM CPU reset retains a pending NMI and interrupt shadow #1159 (CPU reset), which moved to OpenVMM/microVM umbrella: OpenVMM issues outside the microVM and NVX implementation #1186 because a microVM never resets its vCPUs, changes the same functions, and openvmm: KVM snapshot restore collapses two pending NMIs into one #1161 asks to stay separate from its validity-flag fix. openvmm: saving or inspecting a KVM AP in SEV-ES/SNP reset hold panics #1383 and openvmm: on KVM, a halted VP with a PV kick waiting restores as running #1386, in OpenVMM/microVM umbrella: OpenVMM issues outside the microVM and NVX implementation #1186 because no microVM reaches them, change them too.
• openvmm: KVM's set_xsave keeps old PKRU or MXCSR after a VM reset on some hosts #1360, openvmm: a restored XSAVE component outside the caps loads, then is lost #1380, and openvmm: restoring a short or malformed XSAVE area panics the VM worker on KVM #1381 all change KvmVpStateAccess::set_xsave; land them one at a time. openvmm: with task PKRU 0 on a PKU host, KVM snapshots can lose guest PKRU #1359 concerns the same PKRU state as openvmm: KVM's set_xsave keeps old PKRU or MXCSR after a VM reset on some hosts #1360, from the VP thread's side, and openvmm: KVM snapshots lose MXCSR on hosts without XSAVEC or XSAVES #1389 is the save side of openvmm: KVM's set_xsave keeps old PKRU or MXCSR after a VM reset on some hosts #1360's MXCSR case, on the same hosts: a Linux regression that OpenVMM cannot work around, whose fix is a kernel patch. openvmm: KVM's set_xsave keeps old PKRU or MXCSR after a VM reset on some hosts #1360's two reset cases need a VM reset, which a microVM never performs, but its third, a crafted snapshot on a host without XSAVE, reaches a restore.
• openvmm: a snapshot's host CPU profile can give the guest VMX or SVM #1357 and openvmm: a restored CPU profile's XSAVE layout overflows XSAVE length math #1382 come from a snapshot's own host CPU profile (<vendor>.host.v<n>), which host_profile_for_restore accepts once it decodes and matches its digest. Through EFER.SVME, openvmm: a snapshot's EFER.SVME gives SVM to a KVM guest whose CPUID lacks it #1358 lets a crafted snapshot give the guest SVM as openvmm: a snapshot's host CPU profile can give the guest VMX or SVM #1357 does.
• Only a crafted, corrupted, or foreign snapshot reaches openvmm: a snapshot's host CPU profile can give the guest VMX or SVM #1357, openvmm: a snapshot's EFER.SVME gives SVM to a KVM guest whose CPUID lacks it #1358, openvmm: a restored non-Fixed APIC timer makes KVM inject INIT, SIPI or NMI #1365, openvmm: a restored XSAVE component outside the caps loads, then is lost #1380, openvmm: restoring a short or malformed XSAVE area panics the VM worker on KVM #1381, openvmm: a restored CPU profile's XSAVE layout overflows XSAVE length math #1382, and openvmm: restoring an injected #BP or #OF on KVM loses it or panics debug #1385.
• openvmm: with vGIF, a guest without SVM can clear GIF, and a snapshot loses it #1391 bears on openvmm: snapshot capture mixes CPU state from before and after INIT or SIPI #1150 and openvmm: KVM snapshots silently lose pending SMI and SMM execution state #1158: openvmm: snapshot capture mixes CPU state from before and after INIT or SIPI #1150's proposed refusal of a capture while KVM reports a latched INIT also covers an INIT held behind a clear GIF, which openvmm: KVM snapshots silently lose pending SMI and SMM execution state #1158's patch assumes only SMM can hold. GIF itself has no saved element; Linux 7.1 makes such a guest's CLGI raise #UD.
• openvmm: a restored non-Fixed APIC timer makes KVM inject INIT, SIPI or NMI #1365 and openvmm: on KVM, a restored one-shot LAPIC timer can fire an extra time or drift #1366 (in OpenVMM/microVM umbrella: VM time and the time ABI #1183) both change how a restore writes the LAPIC timer to KVM; land them one at a time.
• openvmm: KVM snapshots silently lose pending SMI and SMM execution state #1158, openvmm: unsupported snapshot state panics restore after potentially changing the partition #1168, and openvmm: KVM snapshot restore drops pending exceptions and panics on backend-normalized CPU state in debug builds #1169 all change the generated save_all or restore_all in vmm_core/virt/src/state.rs.