x86: svm_cpu_park() does not write to guest memory

Reworked svm_cpu_park() according to the discussion followed commit
292746c on Github. To summarize:

 - There are no VMX guest activity states equivalent in AMD-V, thus
   no easy way to halt a CPU in guest mode waiting for NMI.

 - Copying parking code directly into guest memory is ugly and
   dangerous, and it is not to say Linux may see changes made by
   svm_cpu_park() as memory corruption.

 - There is no straightforward way to halt CPU waiting for NMI in host
   mode - events can be lost.

The approach implemented by this commit is probably the least evil: we
create a static parking code page and static shared page tables that maps it
at reset vector (0xfffffff0). When a CPU is parked, its NPT is switched to
that shared page tables, and CS:RIP are set so the code at reset vector is
executed. When the CPU resumes, NPTs are switched back to real ones.
x86: Never write to vmcb->rax from now on

This commit fixes subtle bug introduced with commit 8b7fb51: vmcb->rax
is overwritten with guest_regs->rax value when a guest resumes, so one
should never modify vmcb->rax as that value will be lost.
x86: Misc fixes

This commit combines several trivial changes in svm.c code:

 - avic_page is allocated only when AVIC is present, not the opposite;
 - page_map_create() for avic_page receives arguments in correct order;
 - paged_mode is correctly initialized as boolean, not integer.
x86: Fixed x86_parse_mov_to_cr()

The bug was in that function implied incorrect bit order for
ModRM. This is fixed now, so registers indices are parsed
correctly.
configs: Enable PIC 2 in qemu-vm.cell

Without this change, rebooting Linux (3.14.5-1-ARCH) with Jailhouse enabled
and apic-demo running results in Invalid PIO to port 0xa1. This was not probably
meant to work anyway since apic-demo insists on two shutdown requests, but
getting rid of the fatal error makes the code cleaner.