xen/arm: validate max grant frames against the grant table region

Per the binding (docs/misc/arm/device-tree/guest.txt), region 0 for
mapping grant table is large enough to map the whole grant table. Xen
never checks that this holds:
 - enhanced dom0less domUs are given GUEST_GNTTAB_SIZE (4096 frames),
   while their limit comes from the max_grant_frames DT property or, if
   absent, from the gnttab_max_frames command line option or default,
   neither of which is bounded by the region size,
 - a dom0less hardware domain is given gnttab_dom0_frames() frames,
   while the max_grant_frames DT property can raise its limit above
   that.

A guest growing its grant table past the end of the region ends up
mapping grant frames over whatever follows it in its address space,
e.g. the magic pages at GUEST_MAGIC_BASE for a domU.

Validate that the configured max frames can actually fit in the region
Xen exposes in make_hypervisor_node().

Fix find_gnttab_region() logic of setting the gnttab_size for hardware
domain to allow the max frames up until the size of the text section.
Otherwise, the DT setting would only allow to shrink it from the
default.

Fixes: 79eb2871f2 ("xen/arm: configure dom0less domain for enabling xenstore after boot")
Fixes: df68a4cb7e ("xen/arm: Add capabilities to dom0less")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

docs/misc/arm/device-tree/booting.txt

@@ -291,7 +291,10 @@ with the following properties:
     Optional. A 32-bit integer specifying the maximum number of grant frames
     the domain is allowed to have. If this property is missing, the value
     specified by Xen command line parameter gnttab_max_frames (or its default
-    value if unspecified, i.e. 64) is used.
+    value if unspecified, i.e. 64) is used. For hardware domain and xen,enhanced
+    domains (for which Xen advertises /hypervisor node) the limit is based on
+    the max region size (GUEST_GNTTAB_SIZE for domUs, size of Xen's text section
+    for hardware domain). A larger value makes the domain fail to build.
 
 - max_maptrack_frames