x86: Incorrect MSR_DEBUGCTL handling lets guests enable BTS

ISSUE DESCRIPTION

The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests.
Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to chose any MSR_DEBUGCTL setting it likes.

IMPACT

A malicious or buggy guest administrator can lock up the entire host, causing a Denial of Service.

VULNERABLE SYSTEMS

Xen versions 4.6 and later are vulnerable.
Only systems using Intel CPUs are affected. ARM and AMD systems are unaffected.
Only x86 HVM or PVH guests can exploit the vulnerability. x86 PV guests cannot exploit the vulnerability.