xen: credit2: don't let b_avgload go negative.

The ASSERT() made effective by b5b5876619
("xen: credit2: fix two s_time_t handling issues
in load balancing") triggers for b_avgload (spotted
by OSSTest).

b_avgload is where we store the prediction of how
the load of a runqueue will look like in the medium
to long term, because of a vcpu being added to or
removed from there.

On vcpu removal, saturate down b_avgload to zero,
as it makes very few sense to predict that the
load of a runqueue will at some point become negative!

Signed-off-by: Dario Faggioli <dario.faggioli@citrix.com>
Acked-by: George Dunlap <george.dunlap@citrix.com>

xen/common/sched_credit2.c

@@ -1323,14 +1323,16 @@ runq_assign(const struct scheduler *ops, struct vcpu *vc)
 static void
 __runq_deassign(struct csched2_vcpu *svc)
 {
+    struct csched2_runqueue_data *rqd = svc->rqd;
+
     ASSERT(!__vcpu_on_runq(svc));
     ASSERT(!(svc->flags & CSFLAG_scheduled));
 
     list_del_init(&svc->rqd_elem);
-    update_max_weight(svc->rqd, 0, svc->weight);
+    update_max_weight(rqd, 0, svc->weight);
 
     /* Expected new load based on removing this vcpu */
-    svc->rqd->b_avgload -= svc->avgload;
+    rqd->b_avgload = max_t(s_time_t, rqd->b_avgload - svc->avgload, 0);
 
     svc->rqd = NULL;
 }
@@ -1590,7 +1592,7 @@ csched2_cpu_pick(const struct scheduler *ops, struct vcpu *vc)
         if ( rqd == svc->rqd )
         {
             if ( cpumask_intersects(vc->cpu_hard_affinity, &rqd->active) )
-                rqd_avgload = rqd->b_avgload - svc->avgload;
+                rqd_avgload = max_t(s_time_t, rqd->b_avgload - svc->avgload, 0);
         }
         else if ( spin_trylock(&rqd->lock) )
         {