[for-4.22][PATCH v2] xen/arm: Fail domain construction if a secondary vCPU cannot be created

[Michal Orzel <michal.orzel@xxxxxxx>]

construct_domain() creates the secondary vCPUs in a loop, but on a
vcpu_create() failure it only prints a message and breaks out of the
loop returning success. As a result the domain can be partially
constructed with fewer vCPUs than d->max_vcpus. This causes two contract
violations:
 - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes
   incorrect information (e.g. two vCPUs listed in a device tree while only
   one is actually created),
 - User-Xen: unlike x86, on Arm port we try to bail out as soon as
   possible on unsatisfied user requests (e.g. user requested two vCPUs
   for a domain but it was created with only one).

Return an error instead of breaking out of the loop. Both callers
(construct_domU() and construct_hwdom()) already propagate a negative
return value and fail domain construction.

Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus")
Signed-off-by: Michal Orzel <michal.orzel@xxxxxxx>
---
Changes in v2:
 - return ENOMEM as allocation failure is most frequent cause of failure
 - update commit msg to focus on unmet contracts
---
 xen/arch/arm/domain_build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c
index 550617f152bb..72d531618045 100644
--- a/xen/arch/arm/domain_build.c
+++ b/xen/arch/arm/domain_build.c
@@ -1847,7 +1847,7 @@ int __init construct_domain(struct domain *d, struct 
kernel_info *kinfo)
         if ( vcpu_create(d, i) == NULL )
         {
             printk("Failed to allocate d%dv%d\n", d->domain_id, i);
-            break;
+            return -ENOMEM;
         }
 
         if ( is_64bit_domain(d) )
-- 
2.43.0