x86: Remove mmio_lock

There is no state shared between CPUs when runngin mmio_parse. Also, we
no longer modify the hypervisor page table in a way that may require
synchronization: page_map_get_foreign_page only modifies a single PTE
in the given CPU's foreign mapping region. Since d401dba795 we no longer
unmap the foreign pages, only overwrite the mapping. And since
3c01f4192c we guarantee that all page directories are present for the
foreign mapping region. So let's get ride of this unneeded lock.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Convert global wait_lock into per-CPU control_lock

The wait_lock actually only protects CPU-specific fields, thus does not
need to be global. Convert it, and also document what it protects
precisely and under which conditions.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Introduce panic_halt

In case we can recover from a panic situation, either by destroying the
guest cell or by re-initializing the CPU from with that cell, we do not
need to enter the fatal stop state. Provide panic_halt for that
scenarios, it will park the faulted CPU in wait-for-SIPI state instead,
keeping virtualization enabled.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Park CPU on guest originated faults

If a guest CPU violates a cell boundary or cause an unhandled vmexit,
only park the CPU in non-root mode afterwards. This allows to recover
the CPU when its cell is destructed, e.g. Any fault we see in root mode
remains fatal, and we will continue to stop using the CPU from that on.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>