1 files changed, 20 insertions, 5 deletions

diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 1e39908d02f9..bab5ac18fe0e 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -368,8 +368,13 @@ static int find_unbound_irq(void)
 {
         struct irq_data *data;
         int irq, res;
+        int start = get_nr_hw_irqs();
 
-        for (irq = 0; irq < nr_irqs; irq++) {
+        if (start == nr_irqs)
+                goto no_irqs;
+
+        /* nr_irqs is a magic value. Must not use it.*/
+        for (irq = nr_irqs-1; irq > start; irq--) {
                 data = irq_get_irq_data(irq);
                 /* only 0->15 have init'd desc; handle irq > 16 */
                 if (!data)
@@ -382,8 +387,8 @@ static int find_unbound_irq(void)
                         return irq;
         }
 
-        if (irq == nr_irqs)
-                panic("No available IRQ to bind to: increase nr_irqs!\n");
+        if (irq == start)
+                goto no_irqs;
 
         res = irq_alloc_desc_at(irq, 0);
 
@@ -391,6 +396,9 @@ static int find_unbound_irq(void)
                 return -1;
 
         return irq;
+
+no_irqs:
+        panic("No available IRQ to bind to: increase nr_irqs!\n");
 }
 
 static bool identity_mapped_irq(unsigned irq)
@@ -544,8 +552,15 @@ static int find_irq_by_gsi(unsigned gsi)
         return -1;
 }
 
-/*
- * Allocate a physical irq, along with a vector.  We don't assign an
+/* xen_allocate_irq might allocate irqs from the top down, as a
+ * consequence don't assume that the irq number returned has a low value
+ * or can be used as a pirq number unless you know otherwise.
+ *
+ * One notable exception is when xen_allocate_irq is called passing an
+ * hardware gsi as argument, in that case the irq number returned
+ * matches the gsi number passed as first argument.
+
+ * Note: We don't assign an
  * event channel until the irq actually started up.  Return an
  * existing irq if we've already got one for the gsi.
  */