On Mon, Mar 11, 2024 at 11:59:59AM -0700, Axel Rasmussen wrote: > I'd prefer not to require root or CAP_SYS_ADMIN or similar for > UFFDIO_POISON, because those control access to lots more things > besides, which we don't necessarily want the process using UFFD to be > able to do. :/ > > Ratelimiting seems fairly reasonable to me. I do see the concern about > dropping some addresses though. Do you know how much could an admin rely on such addresses? How frequent would MCE generate normally in a sane system? > Perhaps we can mitigate that concern by defining our own ratelimit > interval/burst configuration? Any details? > Another idea would be to only ratelimit it if !CONFIG_DEBUG_VM or > similar. Not sure if that's considered valid or not. :) This, OTOH, sounds like an overkill.. I just checked again on the detail of ratelimit code, where we by default it has: #define DEFAULT_RATELIMIT_INTERVAL (5 * HZ) #define DEFAULT_RATELIMIT_BURST 10 So it allows a 10 times burst rather than 2.. IIUC it means even if there're continous 10 MCEs it won't get suppressed, until the 11th came, in 5 seconds interval. I think it means it's possibly even less of a concern to directly use pr_err_ratelimited(). Thanks, -- Peter Xu
