xen/arm: Fail domain construction if a secondary vCPU cannot be created

construct_domain() creates the secondary vCPUs in a loop, but on a
vcpu_create() failure it only prints a message and breaks out of the
loop returning success. As a result the domain can be partially
constructed with fewer vCPUs than d->max_vcpus. This causes two contract
violations:
 - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes
   incorrect information (e.g. two vCPUs listed in a device tree while only
   one is actually created),
 - User-Xen: unlike x86, on Arm port we try to bail out as soon as
   possible on unsatisfied user requests (e.g. user requested two vCPUs
   for a domain but it was created with only one).

Return an error instead of breaking out of the loop. Both callers
(construct_domU() and construct_hwdom()) already propagate a negative
return value and fail domain construction.

Fixes: 6b0e8e4334 ("xen/arm: allocate secondaries dom0 vcpus")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>

xen/arch/arm/domain_build.c

@@ -1847,7 +1847,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo)
         if ( vcpu_create(d, i) == NULL )
         {
             printk("Failed to allocate d%dv%d\n", d->domain_id, i);
-            break;
+            return -ENOMEM;
         }
 
         if ( is_64bit_domain(d) )