Re: [PATCH] xen/sched: rtds: prevent extratime priority_level wraparound

[Oleksii Moisieiev <oleksii_moisieiev@xxxxxxxx>]

On 31/03/2026 11:23, Jürgen Groß wrote:
> On 31.03.26 09:54, Oleksii Moisieiev wrote:
> > In RTDS, burn_budget() increments priority_level for extratime units
> > whenever cur_budget is exhausted. As priority_level is unsigned and was
> > unbounded, it could eventually overflow to 0.
> >
> > A wrapped value of 0 is the highest RTDS priority, so an extratime unit
> > could unexpectedly regain top priority and preempt units with active
> > real-time reservations, violating EDF intent.
> >
> > Fix this by saturating priority_level at RTDS_MAX_PRIORITY_LEVEL instead
> > of incrementing unconditionally. Budget refill semantics are unchanged.
> >
> > Normal behavior is unchanged. Once saturated, priority_level remains at
> > the lowest priority until the next period update resets it.
> >
> > Signed-off-by: Oleksii Moisieiev <oleksii_moisieiev@xxxxxxxx>
> Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
>
> with one note: overflowing priority_level would require extremely long
> scheduling periods (probably at least several days), so this bug is
> more a theoretical one. Anyone configuring the rtds scheduler in such
> a way would probably deserve to experience the fallout from this bug. :-)
>
>
> Juergen
Hi Juergen,

Thank you for the review and R-b.

I understand that this bug is more theoretical but it still needs to be 
fixed for the certification.
--

Oleksii

> > ---
> >
> >   xen/common/sched/rt.c | 10 +++++++++-
> >   1 file changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/xen/common/sched/rt.c b/xen/common/sched/rt.c
> > index 7b1f64a779..9c1027c388 100644
> > --- a/xen/common/sched/rt.c
> > +++ b/xen/common/sched/rt.c
> > @@ -110,6 +110,12 @@
> >    */
> >   #define RTDS_MIN_BUDGET     (MICROSECS(10))
> >   +/*
> > + * Maximum extratime demotion level. Saturating at this value avoids
> > + * unsigned wraparound back to 0 (highest scheduling priority).
> > + */
> > +#define RTDS_MAX_PRIORITY_LEVEL (~0U)
> > +
> >   /*
> >    * UPDATE_LIMIT_SHIFT: a constant used in rt_update_deadline(). 
> > When finding
> >    * the next deadline, performing addition could be faster if the 
> > difference
> > @@ -976,7 +982,9 @@ burn_budget(const struct scheduler *ops, struct 
> > rt_unit *svc, s_time_t now)
> >       {
> >           if ( has_extratime(svc) )
> >           {
> > -            svc->priority_level++;
> > +            if ( svc->priority_level < RTDS_MAX_PRIORITY_LEVEL )
> > +                svc->priority_level++;
> > +
> >               svc->cur_budget = svc->budget;
> >           }
> >           else