ANDROID: KVM: arm64: pkvm: Plug in cache invalidation for non-protected guests

Since we must still support the dreaded set/way CMOs for non-protected
VMs (as well as the equivalent operation when vcpus switch their MMU
on), perform an invalidation that will iterate over all the pages
that have been donated to the guest, one after the other.

This requires a minor change to the locking used for donation so
that all donated pages can be seen by a concurrent invalidation.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Bug: 209580772
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I1780127722bda7bdc884bb4e68db6ae47d042822