Re: [PATCH v3 1/6] argo: lower level of noisy connection-refused log

[Jan Beulich <jbeulich@xxxxxxxx>]

On 09.06.2026 13:57, Daniel Smith wrote:
> From: Jason Andryuk <jason.andryuk@xxxxxxx>
> Date: Mon, 08 Jun 2026 19:16:01 -0400
>  > On 2026-06-08 15:54, Daniel P. Smith wrote: 
>  > > On 5/26/26 5:58 PM, dmukhin@xxxxxxxx wrote: 
>  > >> --- a/xen/common/argo.c 
>  > >> +++ b/xen/common/argo.c 
>  > >> @@ -2034,10 +2034,9 @@ sendv(struct domain *src_d, xen_argo_addr_t 
>  > >> *src_addr, 
>  > >>                                           src_id.domain_id); 
>  > >>       if ( !ring_info ) 
>  > >>       { 
>  > >> -        gprintk(XENLOG_ERR, 
>  > >> -                "argo: vm%u connection refused, src (vm%u:%x) dst 
>  > >> (vm%u:%x)\n", 
>  > >> -                current->domain->domain_id, src_id.domain_id, 
>  > >> src_id.aport, 
>  > >> -                dst_addr->domain_id, dst_addr->aport); 
>  > >> +        argo_dprintk("vm%u connection refused, src (vm%u:%x) dst 
>  > >> (vm%u:%x)\n", 
>  > >> +                     current->domain->domain_id, src_id.domain_id, 
>  > >> src_id.aport, 
>  > >> +                     dst_addr->domain_id, dst_addr->aport); 
>  > >>           ret = -ECONNREFUSED; 
>  > >>       } 
>  > > 
>  > > My apologies but this is not the wisest approach, hitting this is a real 
>  > > error and shouldn't be getting silenced. 
>  >  
>  > -ECONNREFUSED is still returned, and that is the important part, I think? 
>  >  
> 
> Absolutely not. Argo at its essence is a security protocol where you want to 
> minimize the amount of implicit trust we have to have with the endpoint. 
> Telling a bad actor he did a bad action tells you nothing. The send operation 
> is the critical security path and you must have an auditable record that an 
> endpoint misbehaved. If yo want to implicitly trust your end point after 
> passing the accees check, then you can just use grants. 

Yet then - is potentially spamming the log an appropriate model? Furthermore
gprintk()-s are, by default, rate-limited in release builds, and hence there
isn't going to reliably be an "auditable record" anyway. If you want logging
for auditing purposes, I think you'll need to add separate logging (not to
the system console).

Jan