[PATCH v4 0/2] xen/console: updates to rate-limiting

[PATCH v4 0/2] xen/console: updates to rate-limiting

[dmukhin]

The series introduces compile-configuration for diagnostic
messages rate-limiting.

Patch 1 is a fixup for the rate-limiter to adjust to user-defined
rate-limiting parameters.

Patch 2 introduces compile-time rate-limiting controls.

[1] v3: https://lore.kernel.org/xen-devel/20260715201902.2984407-1-dmukhin@ford.com/
[2] CI: https://gitlab.com/xen-project/people/dmukhin/xen/-/pipelines/2714300378

Denis Mukhin (2):
  xen/console: correct leaky-bucket rate limiter
  xen/console: add build-time rate-limiting controls

 xen/common/Kconfig         | 36 +++++++++++++++++++++++++++++++
 xen/drivers/char/console.c | 43 ++++++++++++++++++++++++++++++--------
 2 files changed, 70 insertions(+), 9 deletions(-)

-- 
2.54.0

[PATCH v4 1/2] xen/console: correct leaky-bucket rate limiter

[dmukhin]

From: Denis Mukhin <dmukhin@ford.com> 

Use existing 'ratelimit_ms' and 'ratelimit_burst' variables in
do_printk_ratelimit() instead of hardcoded values 5000 and 10 respectively.

Ensure rate limiter is disabled if either 'ratelimit_ms' or 'ratelimit_burst'
is 0.

Account for integer overflow in the rate-limiter logic.

Signed-off-by: Denis Mukhin <dmukhin@ford.com>
---
Changes since v3:
- fixed types
- fixed integer division logic - I used DIM_MUL2() from xvmalloc.h
  I hope this is fine given another pending patch which will include xvmalloc.h
  for heap allocations
- fixed potential problem w/ overflow of toks (introduced elapsed)
- fixed potential problem with toks == 0 which is also "uninitialized"
  state.
---
 xen/drivers/char/console.c | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
index ea4e3ff34178..76a1681670c1 100644
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -33,6 +33,7 @@
 #include <asm/setup.h>
 #include <xen/sections.h>
 #include <xen/consoled.h>
+#include <xen/xvmalloc.h>
 
 #ifdef CONFIG_X86
 #include <asm/guest.h>
@@ -1286,21 +1287,43 @@ bool __printk_ratelimit(unsigned int ratelimit_ms,
                         unsigned int ratelimit_burst)
 {
     static DEFINE_SPINLOCK(ratelimit_lock);
-    static unsigned long toks = 10 * 5 * 1000;
+    static unsigned long toks;
     static unsigned long last_msg;
     static unsigned int missed;
+    static bool initialized;
+    unsigned long limit;
     unsigned long flags;
-    unsigned long long now = NOW(); /* ns */
     unsigned long ms;
+    s_time_t now;
 
-    do_div(now, 1000000);
-    ms = (unsigned long)now;
+    if ( !ratelimit_ms || !ratelimit_burst )
+        return true;
+
+    limit = DIM_MUL2(ratelimit_burst, ratelimit_ms);
+
+    now = NOW(); /* ns */
+    do_div(now, MILLISECS(1));
+    ms = now;
 
     spin_lock_irqsave(&ratelimit_lock, flags);
-    toks += ms - last_msg;
+
+    if ( initialized )
+    {
+        unsigned long elapsed = ms - last_msg;
+
+        if ( toks >= limit || elapsed >= limit - toks )
+            toks = limit;
+        else
+            toks += elapsed;
+    }
+    else
+    {
+        toks = limit;
+        initialized = true;
+    }
+
     last_msg = ms;
-    if ( toks > (ratelimit_burst * ratelimit_ms))
-        toks = ratelimit_burst * ratelimit_ms;
+
     if ( toks >= ratelimit_ms )
     {
         unsigned int lost = missed;
-- 
2.54.0

Re: [PATCH v4 1/2] xen/console: correct leaky-bucket rate limiter

[Roger Pau Monné]

You mention "correct" in the subject, but there's no fixes tag, and
it's not clear exactly what this patch corrects.

On Wed, Jul 29, 2026 at 12:25:19AM -0700, dmukhin@ford.com wrote:
> From: Denis Mukhin <dmukhin@ford.com> 
> 
> Use existing 'ratelimit_ms' and 'ratelimit_burst' variables in
> do_printk_ratelimit() instead of hardcoded values 5000 and 10 respectively.
> 
> Ensure rate limiter is disabled if either 'ratelimit_ms' or 'ratelimit_burst'
> is 0.
> 
> Account for integer overflow in the rate-limiter logic.
> 
> Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> ---
> Changes since v3:
> - fixed types
> - fixed integer division logic - I used DIM_MUL2() from xvmalloc.h
>   I hope this is fine given another pending patch which will include xvmalloc.h
>   for heap allocations
> - fixed potential problem w/ overflow of toks (introduced elapsed)
> - fixed potential problem with toks == 0 which is also "uninitialized"
>   state.
> ---
>  xen/drivers/char/console.c | 37 ++++++++++++++++++++++++++++++-------
>  1 file changed, 30 insertions(+), 7 deletions(-)
> 
> diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
> index ea4e3ff34178..76a1681670c1 100644
> --- a/xen/drivers/char/console.c
> +++ b/xen/drivers/char/console.c
> @@ -33,6 +33,7 @@
>  #include <asm/setup.h>
>  #include <xen/sections.h>
>  #include <xen/consoled.h>
> +#include <xen/xvmalloc.h>
>  
>  #ifdef CONFIG_X86
>  #include <asm/guest.h>
> @@ -1286,21 +1287,43 @@ bool __printk_ratelimit(unsigned int ratelimit_ms,
>                          unsigned int ratelimit_burst)
>  {
>      static DEFINE_SPINLOCK(ratelimit_lock);
> -    static unsigned long toks = 10 * 5 * 1000;
> +    static unsigned long toks;
>      static unsigned long last_msg;
>      static unsigned int missed;
> +    static bool initialized;
> +    unsigned long limit;
>      unsigned long flags;
> -    unsigned long long now = NOW(); /* ns */
>      unsigned long ms;
> +    s_time_t now;
>  
> -    do_div(now, 1000000);
> -    ms = (unsigned long)now;
> +    if ( !ratelimit_ms || !ratelimit_burst )
> +        return true;
> +
> +    limit = DIM_MUL2(ratelimit_burst, ratelimit_ms);
> +
> +    now = NOW(); /* ns */
> +    do_div(now, MILLISECS(1));
> +    ms = now;
>  
>      spin_lock_irqsave(&ratelimit_lock, flags);
> -    toks += ms - last_msg;
> +
> +    if ( initialized )
> +    {
> +        unsigned long elapsed = ms - last_msg;
> +
> +        if ( toks >= limit || elapsed >= limit - toks )
> +            toks = limit;
> +        else
> +            toks += elapsed;
> +    }
> +    else
> +    {
> +        toks = limit;
> +        initialized = true;
> +    }

I'm not sure you need the `initialized` static variable.  You could
set the initial value of toks = ~0, and then if the limit is set to a
lower value it would already get adjusted as part of the toks >= limit
check?

Thanks, Roger.

[PATCH v4 2/2] xen/console: add compile-time rate-limiting controls

[dmukhin]

From: Denis Mukhin <dmukhin@ford.com> 

Introduce CONFIG_PRINTK_RATELIMIT_MS and CONFIG_PRINTK_RATELIMIT_BURST
for configuring rate-limiting policy at the compile time.

Use symbols for global rate-limiting initialization in the console driver.

Signed-off-by: Denis Mukhin <dmukhin@ford.com>
---
Changes since v3:
- added note on security support for non-standard configurations
- gated menu with EXPERT

I kept both settings for now.
---
 xen/common/Kconfig         | 36 ++++++++++++++++++++++++++++++++++++
 xen/drivers/char/console.c |  6 ++++--
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index da80fdba8469..749d3bfb08e0 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -672,4 +672,40 @@ config PM_STATS
 	  Enable collection of performance management statistics to aid in
 	  analyzing and tuning power/performance characteristics of the system
 
+menu "Console rate-limiting"
+	visible if EXPERT
+
+config PRINTK_RATELIMIT_MS
+	int "printk rate-limiting time window (milliseconds)"
+	default 5000
+	help
+	  Specifies the time window, in milliseconds, for rate-limited [*] printk
+	  messages. No more than `CONFIG_PRINTK_RATELIMIT_BURST` messages will be
+	  printed within this window.
+
+	  Setting this value to 0 disables rate-limiting entirely.
+
+	  Configurations using a value other than the default of 5000 are not
+	  security supported.
+
+	  [*] Rate-limited messages are those controlled by the `loglvl` and
+	  `guest_loglvl` command-line parameters.
+
+config PRINTK_RATELIMIT_BURST
+	int "printk rate-limited message burst size"
+	default 10
+	help
+	  Defines the maximum number of rate-limited [*] printk messages that may
+	  be printed within each `CONFIG_PRINTK_RATELIMIT_MS` time window.
+
+	  Setting this value to 0 disables rate-limiting entirely.
+
+	  Configurations using a value other than the default of 10 are not
+	  security supported.
+
+	  [*] Rate-limited messages are those controlled by the `loglvl` and
+	  `guest_loglvl` command-line parameters.
+
+endmenu
+
 endmenu
diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
index 76a1681670c1..2c7be1e61f3e 100644
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -1353,10 +1353,12 @@ bool __printk_ratelimit(unsigned int ratelimit_ms,
 }
 
 /* Minimum time in ms between messages */
-static const unsigned int printk_ratelimit_ms = 5 * 1000;
+static const unsigned int printk_ratelimit_ms =
+    CONFIG_PRINTK_RATELIMIT_MS;
 
 /* Number of messages we send before ratelimiting */
-static const unsigned int printk_ratelimit_burst = 10;
+static const unsigned int printk_ratelimit_burst =
+    CONFIG_PRINTK_RATELIMIT_BURST;
 
 bool printk_ratelimit(void)
 {
-- 
2.54.0

Re: [PATCH v4 2/2] xen/console: add compile-time rate-limiting controls

[Roger Pau Monné]

On Wed, Jul 29, 2026 at 12:25:20AM -0700, dmukhin@ford.com wrote:
> From: Denis Mukhin <dmukhin@ford.com> 
> 
> Introduce CONFIG_PRINTK_RATELIMIT_MS and CONFIG_PRINTK_RATELIMIT_BURST
> for configuring rate-limiting policy at the compile time.
> 
> Use symbols for global rate-limiting initialization in the console driver.
> 
> Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> ---
> Changes since v3:
> - added note on security support for non-standard configurations
> - gated menu with EXPERT
> 
> I kept both settings for now.
> ---
>  xen/common/Kconfig         | 36 ++++++++++++++++++++++++++++++++++++
>  xen/drivers/char/console.c |  6 ++++--
>  2 files changed, 40 insertions(+), 2 deletions(-)
> 
> diff --git a/xen/common/Kconfig b/xen/common/Kconfig
> index da80fdba8469..749d3bfb08e0 100644
> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -672,4 +672,40 @@ config PM_STATS
>  	  Enable collection of performance management statistics to aid in
>  	  analyzing and tuning power/performance characteristics of the system
>  
> +menu "Console rate-limiting"
> +	visible if EXPERT

No strong opinion, but there's a drivers/char/Kconfig which might be a
more natural place for those option to live, and then there's no
reason for the extra menu?

> +
> +config PRINTK_RATELIMIT_MS
> +	int "printk rate-limiting time window (milliseconds)"
> +	default 5000
> +	help
> +	  Specifies the time window, in milliseconds, for rate-limited [*] printk
> +	  messages. No more than `CONFIG_PRINTK_RATELIMIT_BURST` messages will be
> +	  printed within this window.
> +
> +	  Setting this value to 0 disables rate-limiting entirely.
> +
> +	  Configurations using a value other than the default of 5000 are not
> +	  security supported.
> +
> +	  [*] Rate-limited messages are those controlled by the `loglvl` and
> +	  `guest_loglvl` command-line parameters.
> +
> +config PRINTK_RATELIMIT_BURST
> +	int "printk rate-limited message burst size"
> +	default 10
> +	help
> +	  Defines the maximum number of rate-limited [*] printk messages that may
> +	  be printed within each `CONFIG_PRINTK_RATELIMIT_MS` time window.
> +
> +	  Setting this value to 0 disables rate-limiting entirely.
> +
> +	  Configurations using a value other than the default of 10 are not
> +	  security supported.
> +
> +	  [*] Rate-limited messages are those controlled by the `loglvl` and
> +	  `guest_loglvl` command-line parameters.

Is it common to use footnotes in Kconfig options?  It seems a bit
weird to me, I would probably just expand inside parenthesis if
needed.

Also, I'm a bit confused by the mention of loglvl and guest_loglvl
explicitly here: messages outside of the selected level are just
discarded, and hence it's kind of obvious that just messages inside
the selected level are controlled by this rate-limiting.

Re: [PATCH v4 2/2] xen/console: add compile-time rate-limiting controls

[dmukhin]

On Mon, Aug 10, 2026 at 03:06:35PM +0200, Roger Pau Monné wrote:
> On Wed, Jul 29, 2026 at 12:25:20AM -0700, dmukhin@ford.com wrote:
> > From: Denis Mukhin <dmukhin@ford.com> 
> > 
> > Introduce CONFIG_PRINTK_RATELIMIT_MS and CONFIG_PRINTK_RATELIMIT_BURST
> > for configuring rate-limiting policy at the compile time.
> > 
> > Use symbols for global rate-limiting initialization in the console driver.
> > 
> > Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> > ---
> > Changes since v3:
> > - added note on security support for non-standard configurations
> > - gated menu with EXPERT
> > 
> > I kept both settings for now.
> > ---
> >  xen/common/Kconfig         | 36 ++++++++++++++++++++++++++++++++++++
> >  xen/drivers/char/console.c |  6 ++++--
> >  2 files changed, 40 insertions(+), 2 deletions(-)
> > 
> > diff --git a/xen/common/Kconfig b/xen/common/Kconfig
> > index da80fdba8469..749d3bfb08e0 100644
> > --- a/xen/common/Kconfig
> > +++ b/xen/common/Kconfig
> > @@ -672,4 +672,40 @@ config PM_STATS
> >  	  Enable collection of performance management statistics to aid in
> >  	  analyzing and tuning power/performance characteristics of the system
> >  
> > +menu "Console rate-limiting"
> > +	visible if EXPERT
> 
> No strong opinion, but there's a drivers/char/Kconfig which might be a
> more natural place for those option to live, and then there's no
> reason for the extra menu?

I had the knob initially in drivers/char/Kconfig, but moved to
common/Kconfig to address Jan's feedback:

  https://lore.kernel.org/xen-devel/2eba7de1-a8e2-4c45-affb-8ecb91278707@suse.com/

> 
> > +
> > +config PRINTK_RATELIMIT_MS
> > +	int "printk rate-limiting time window (milliseconds)"
> > +	default 5000
> > +	help
> > +	  Specifies the time window, in milliseconds, for rate-limited [*] printk
> > +	  messages. No more than `CONFIG_PRINTK_RATELIMIT_BURST` messages will be
> > +	  printed within this window.
> > +
> > +	  Setting this value to 0 disables rate-limiting entirely.
> > +
> > +	  Configurations using a value other than the default of 5000 are not
> > +	  security supported.
> > +
> > +	  [*] Rate-limited messages are those controlled by the `loglvl` and
> > +	  `guest_loglvl` command-line parameters.
> > +
> > +config PRINTK_RATELIMIT_BURST
> > +	int "printk rate-limited message burst size"
> > +	default 10
> > +	help
> > +	  Defines the maximum number of rate-limited [*] printk messages that may
> > +	  be printed within each `CONFIG_PRINTK_RATELIMIT_MS` time window.
> > +
> > +	  Setting this value to 0 disables rate-limiting entirely.
> > +
> > +	  Configurations using a value other than the default of 10 are not
> > +	  security supported.
> > +
> > +	  [*] Rate-limited messages are those controlled by the `loglvl` and
> > +	  `guest_loglvl` command-line parameters.
> 
> Is it common to use footnotes in Kconfig options?  It seems a bit
> weird to me, I would probably just expand inside parenthesis if
> needed.

I'll just drop extra text.

> 
> Also, I'm a bit confused by the mention of loglvl and guest_loglvl
> explicitly here: messages outside of the selected level are just
> discarded, and hence it's kind of obvious that just messages inside
> the selected level are controlled by this rate-limiting.

Re: [PATCH v4 2/2] xen/console: add compile-time rate-limiting controls

[Roger Pau Monné]

On Mon, Aug 10, 2026 at 10:56:15AM -0700, dmukhin@ford.com wrote:
> On Mon, Aug 10, 2026 at 03:06:35PM +0200, Roger Pau Monné wrote:
> > On Wed, Jul 29, 2026 at 12:25:20AM -0700, dmukhin@ford.com wrote:
> > > From: Denis Mukhin <dmukhin@ford.com> 
> > > 
> > > Introduce CONFIG_PRINTK_RATELIMIT_MS and CONFIG_PRINTK_RATELIMIT_BURST
> > > for configuring rate-limiting policy at the compile time.
> > > 
> > > Use symbols for global rate-limiting initialization in the console driver.
> > > 
> > > Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> > > ---
> > > Changes since v3:
> > > - added note on security support for non-standard configurations
> > > - gated menu with EXPERT
> > > 
> > > I kept both settings for now.
> > > ---
> > >  xen/common/Kconfig         | 36 ++++++++++++++++++++++++++++++++++++
> > >  xen/drivers/char/console.c |  6 ++++--
> > >  2 files changed, 40 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/xen/common/Kconfig b/xen/common/Kconfig
> > > index da80fdba8469..749d3bfb08e0 100644
> > > --- a/xen/common/Kconfig
> > > +++ b/xen/common/Kconfig
> > > @@ -672,4 +672,40 @@ config PM_STATS
> > >  	  Enable collection of performance management statistics to aid in
> > >  	  analyzing and tuning power/performance characteristics of the system
> > >  
> > > +menu "Console rate-limiting"
> > > +	visible if EXPERT
> > 
> > No strong opinion, but there's a drivers/char/Kconfig which might be a
> > more natural place for those option to live, and then there's no
> > reason for the extra menu?
> 
> I had the knob initially in drivers/char/Kconfig, but moved to
> common/Kconfig to address Jan's feedback:
> 
>   https://lore.kernel.org/xen-devel/2eba7de1-a8e2-4c45-affb-8ecb91278707@suse.com/

OK, as I said, I don't have a strong opinion.  I think we want to keep
drivers/char/Kconfig for console driver specific options, but not
generic console related parameters.

Thanks, Roger.