Re: [PATCH v5 2/2] xen/console: add build-time rate-limiting controls

On 12.08.2026 01:38, [email protected] wrote:
> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -672,4 +672,34 @@ config PM_STATS
>  	  Enable collection of performance management statistics to aid in
>  	  analyzing and tuning power/performance characteristics of the system
>  
> +menu "Console rate-limiting"
> +	visible if EXPERT
> +
> +config PRINTK_RATELIMIT_MS
> +	int "printk rate-limiting time window (milliseconds)"
> +	default 5000
> +	help
> +	  Specifies the time window, in milliseconds, for rate-limited printk
> +	  messages. No more than `CONFIG_PRINTK_RATELIMIT_BURST` messages will be
> +	  printed within this window.
> +
> +	  Setting this value to 0 disables rate-limiting entirely.
> +
> +	  Configurations using a value other than the default of 5000 are not
> +	  security supported.

Do we need to be as strict? Specifying a larger value wouldn't increase
the risk of log flooding.

> +config PRINTK_RATELIMIT_BURST
> +	int "printk rate-limited message burst size"
> +	default 10
> +	help
> +	  Defines the maximum number of rate-limited printk messages that may
> +	  be printed within each `CONFIG_PRINTK_RATELIMIT_MS` time window.
> +
> +	  Setting this value to 0 disables rate-limiting entirely.
> +
> +	  Configurations using a value other than the default of 10 are not
> +	  security supported.

Same here - lowering the number (to a non-zero value) wouldn't increase
the risk of log flooding.

(Question to everyone, not just Denis.)

Jan