Re: [PATCH for-4.22 2/2] xen/arm: vgic: free eSPIs using the bitmap index

[Mykola Kvach <xakep.amatop@xxxxxxxxx>]

On Thu, Jul 16, 2026 at 3:03 PM Orzel, Michal <michal.orzel@xxxxxxx> wrote:
>
>
>
> On 10-Jul-26 10:31, Mykola Kvach wrote:
> > Classic vGIC stores eSPIs in allocated_irqs after the regular virtual
> > interrupts. vgic_reserve_virq() therefore translates an eSPI INTID to a
> > compressed bitmap index before test_and_set_bit().
> >
> > vgic_free_virq() still used the raw virtual INTID. Freeing INTID 4096
> > would clear bit 4096 instead of the first eSPI allocation bit, which is
> > outside allocated_irqs for a domain with eSPI support. That can leave
> > the eSPI reserved and may corrupt memory.
> >
> > Add the inverse of idx_to_virq() and use it in both reserve and free, so
> > the allocation bitmap is indexed consistently. Also reject invalid
> > virtual INTIDs before clearing the bitmap.
> I think we can have it in 4.22 given that the release is postponed a bit.
>
> >
> > Fixes: bdde400c6e1b ("xen/arm: vgic: add resource management for extended 
> > SPIs")
> > Signed-off-by: Mykola Kvach <mykola_kvach@xxxxxxxx>
> > ---
> >  xen/arch/arm/vgic.c | 27 ++++++++++++++++-----------
> >  1 file changed, 16 insertions(+), 11 deletions(-)
> >
> > diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c
> > index e5aca17dcb..b85710c6a7 100644
> > --- a/xen/arch/arm/vgic.c
> > +++ b/xen/arch/arm/vgic.c
> > @@ -33,6 +33,16 @@ static inline unsigned int idx_to_virq(struct domain *d, 
> > unsigned int idx)
> >      return idx;
> >  }
> >
> > +static inline unsigned int virq_to_idx(struct domain *d, unsigned int virq)
> > +{
> > +#ifdef CONFIG_GICV3_ESPI
> Same as for patch 1: is_espi() shouldn't be protected as it protects itself.

Ack.

Best regards,
Mykola