emulate_movs() uses the memread and memwrite callbacks selected from
the faulting GPA for both operands of an MMIO-to-MMIO MOVS. A guest
can therefore make the local APIC handler write to a GPA outside the
APIC page, which trips the offset assertion in vlapic_write() on
INVARIANTS kernels.

Dispatch each MMIO read and write according to its GPA. This allows
MOVS between in-kernel devices. During in-kernel emulation, return
EINVAL if an MMIO operand lies outside those devices' ranges.

Reported by: llm-postcr
Sponsored by: Alchemilla Ventures Private Limited