KVM: introduce irq_lock, use it to protect ioapic