x86/MSI: fix MSI-X case of freeing IRQ

Commit d1b6d0a024 ("x86: enable multi-vector MSI") went a little too
far with moving things around in msi_free_irqs() in order to streamline
the code: We shouldn't drop the MSI-X control page reference before
calling destroy_irq(), as the latter will call us back via
desc->handler->shutdown() (effectively invoking to msi_set_mask_bit()).

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -496,15 +496,8 @@ int __setup_msi_irq(struct irq_desc *des
 
 int msi_free_irq(struct msi_desc *entry)
 {
-    unsigned int nr = entry->msi.nvec;
-
-    if ( entry->msi_attrib.type == PCI_CAP_ID_MSIX )
-    {
-        unsigned long start;
-        start = (unsigned long)entry->mask_base & ~(PAGE_SIZE - 1);
-        msix_put_fixmap(entry->dev->msix, virt_to_fix(start));
-        nr = 1;
-    }
+    unsigned int nr = entry->msi_attrib.type != PCI_CAP_ID_MSIX
+                      ? entry->msi.nvec : 1;
 
     while ( nr-- )
     {
@@ -515,6 +508,10 @@ int msi_free_irq(struct msi_desc *entry)
             iommu_update_ire_from_msi(entry + nr, NULL);
     }
 
+    if ( entry->msi_attrib.type == PCI_CAP_ID_MSIX )
+        msix_put_fixmap(entry->dev->msix,
+                        virt_to_fix((unsigned long)entry->mask_base));
+
     list_del(&entry->list);
     xfree(entry);
     return 0;