x86: Loop over hlt in shutdown state

If an NMI should hit us while waiting for Linux to get this CPU online
again, we should avoid resuming execution of the hypervisor code. The
active hypervisor page table may not allow us to cause much damage, but
it's better to not rely on this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Introduce panic_halt

In case we can recover from a panic situation, either by destroying the
guest cell or by re-initializing the CPU from with that cell, we do not
need to enter the fatal stop state. Provide panic_halt for that
scenarios, it will park the faulted CPU in wait-for-SIPI state instead,
keeping virtualization enabled.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Don't switch off virtualization on panic stops

This CPU is lost until the next system reset. Disabling VMX mode doesn't
buy us anything, so drop that line of code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Park CPU on guest originated faults

If a guest CPU violates a cell boundary or cause an unhandled vmexit,
only park the CPU in non-root mode afterwards. This allows to recover
the CPU when its cell is destructed, e.g. Any fault we see in root mode
remains fatal, and we will continue to stop using the CPU from that on.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>