[PATCH v6 1/2] xen/console: add build-time rate-limiting controls

[dmukhin@xxxxxxxx]

From: Denis Mukhin <dmukhin@xxxxxxxx>

Introduce CONFIG_PRINTK_RATELIMIT_MS and CONFIG_PRINTK_RATELIMIT_BURST
for configuring rate-limiting policy at the compile time.

Use symbols for global rate-limiting initialization in the console driver.

Signed-off-by: Denis Mukhin <dmukhin@xxxxxxxx>
---
Changes since v5:
- updated notes on security supportable rate-limiting configurations
---
 xen/common/Kconfig         | 30 ++++++++++++++++++++++++++++++
 xen/drivers/char/console.c |  6 ++++--
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 5b289e444fa5..539cccf21029 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -675,4 +675,34 @@ config PM_STATS
          Enable collection of performance management statistics to aid in
          analyzing and tuning power/performance characteristics of the system
 
+menu "Console rate-limiting"
+       visible if EXPERT
+
+config PRINTK_RATELIMIT_MS
+       int "printk rate-limiting time window (milliseconds)"
+       default 5000
+       help
+         Specifies the time window, in milliseconds, for rate-limited printk
+         messages. No more than `CONFIG_PRINTK_RATELIMIT_BURST` messages will 
be
+         printed within this window.
+
+         Setting this value to 0 disables rate-limiting entirely.
+
+         Rate-limiting configurations within [0..5000) milliseconds are not
+         security supported.
+
+config PRINTK_RATELIMIT_BURST
+       int "printk rate-limited message burst size"
+       default 10
+       help
+         Defines the maximum number of rate-limited printk messages that may
+         be printed within each `CONFIG_PRINTK_RATELIMIT_MS` time window.
+
+         Setting this value to 0 disables rate-limiting entirely.
+
+         Rate-limiting configurations with burst size larger than default 10
+         are not security supported.
+
+endmenu
+
 endmenu
diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
index e4df0bbc2eec..1a8beb6665c1 100644
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -1330,10 +1330,12 @@ bool __printk_ratelimit(unsigned int ratelimit_ms,
 }
 
 /* Minimum time in ms between messages */
-static const unsigned int printk_ratelimit_ms = 5 * 1000;
+static const unsigned int printk_ratelimit_ms =
+    CONFIG_PRINTK_RATELIMIT_MS;
 
 /* Number of messages we send before ratelimiting */
-static const unsigned int printk_ratelimit_burst = 10;
+static const unsigned int printk_ratelimit_burst =
+    CONFIG_PRINTK_RATELIMIT_BURST;
 
 bool printk_ratelimit(void)
 {
-- 
2.56.0