[xen staging] xen/sched: rtds: prevent extratime priority_level wraparound

[patchbot@xxxxxxx]

commit 410d44fcf3911679c19af24a9b4f3ddfb4788f42
Author:     Oleksii Moisieiev <oleksii_moisieiev@xxxxxxxx>
AuthorDate: Fri May 22 08:13:59 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri May 22 08:13:59 2026 +0200

    xen/sched: rtds: prevent extratime priority_level wraparound
    
    In RTDS, burn_budget() increments priority_level for extratime units
    whenever cur_budget is exhausted. As priority_level is unsigned and was
    unbounded, it could eventually overflow to 0.
    
    A wrapped value of 0 is the highest RTDS priority, so an extratime unit
    could unexpectedly regain top priority and preempt units with active
    real-time reservations, violating EDF intent.
    
    Fix this by saturating priority_level at RTDS_MAX_PRIORITY_LEVEL instead
    of incrementing unconditionally. Budget refill semantics are unchanged.
    
    Normal behavior is unchanged. Once saturated, priority_level remains at
    the lowest priority until the next period update resets it.
    
    Fixes: 463b958317 (xen:rtds: towards work conserving RTDS)
    Signed-off-by: Oleksii Moisieiev <oleksii_moisieiev@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/common/sched/rt.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/xen/common/sched/rt.c b/xen/common/sched/rt.c
index b156f61afa..6109aa66c2 100644
--- a/xen/common/sched/rt.c
+++ b/xen/common/sched/rt.c
@@ -110,6 +110,12 @@
  */
 #define RTDS_MIN_BUDGET     (MICROSECS(10))
 
+/*
+ * Maximum extratime demotion level. Saturating at this value avoids
+ * unsigned wraparound back to 0 (highest scheduling priority).
+ */
+#define RTDS_MAX_PRIORITY_LEVEL (~0U)
+
 /*
  * UPDATE_LIMIT_SHIFT: a constant used in rt_update_deadline(). When finding
  * the next deadline, performing addition could be faster if the difference
@@ -976,7 +982,9 @@ burn_budget(const struct scheduler *ops, struct rt_unit 
*svc, s_time_t now)
     {
         if ( has_extratime(svc) )
         {
-            svc->priority_level++;
+            if ( svc->priority_level < RTDS_MAX_PRIORITY_LEVEL )
+                svc->priority_level++;
+
             svc->cur_budget = svc->budget;
         }
         else
--
generated by git-patchbot for /home/xen/git/xen.git#staging