Comment 9 for bug 1896725

mp_irqdomain_activate from arch/x86/kernel/apic/io_apic.c will use the chip_data that is set by the commit referred by Stefan ("XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.").

From drivers/xen/events/events_base.c, xen_allocate_irq_gsi has a test:
        if (gsi < nr_legacy_irqs())
                irq = gsi;
[...]
        xen_irq_init(irq);

And xen_irq_init calls irq_set_chip_data. That is not an irq number that had a irq_desc allocated by Xen, but one of the legacy IRQs, which is controlled by IO-APIC.

That still does not clarify why it works on bionic or upstream. But documenting what I was able to investigate so far.

Cascardo.