rpc-worker: debugfs access is restricted

[Andreas Hasenack]

In impish, with libvirt 7.6.0-0ubuntu1.1. I'm seeing these messages every 3s in my dmesg:
```
[sex jan 14 10:42:38 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
[sex jan 14 10:42:38 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
[sex jan 14 10:42:38 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
[sex jan 14 10:42:38 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
[sex jan 14 10:42:41 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
[sex jan 14 10:42:41 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
[sex jan 14 10:42:41 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
[sex jan 14 10:42:41 2022] Lockdown: rpc-worker: debugfs access is restricted; see man kernel_lockdown.7
```

A quick google led me to https://gitlab.com/libvirt/libvirt/-/issues/213

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jon Smirl (jonsmirl)]

From libvirt gitlib...

Daniel P. Berrangé 💬 @berrange · 2 months ago
Owner
The QEMU patches required to solve this are here https://lists.gnu.org/archive/html/qemu-devel/2022-02/msg03279.html

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Lucas Kanashiro (lucaskanashiro)]

Since this is a non-critical issue, I think it is best to wait until it get merged upstream to fix it in Ubuntu.

[AceLan Kao (acelankao)]

The fix has landed on qemu v7.1.0

467ef823d8 qmp: add filtering of statistics by target vCPU
cc01a3f4ca kvm: Support for querying fd-based stats
b9f88dc071 qmp: Support for querying stats

[Christian Ehrhardt  (paelzer)]

Qemu 22.10 is in feature freeze right now, once 23.04 is open we can merge this qemu change.
And probably also a libvirt change that makes use of it if it exists by then.

From there on we can then evaluate which backport options (if any) we have.
So far it does not look too compelling for an SRU, also the workarounds options as quoted in the upstream case are not too great :-/

[Christian Ehrhardt  (paelzer)]

Merging qemu 7.2 for Lunar, marking the qemu part as done as part of that upload.

[Christian Ehrhardt  (paelzer)]

The qemu bits landed and are in 7.2 that I'm merging right now.
But on the libvirt side the case [1] seems stuck or at least not updated yet.

[1]: https://gitlab.com/libvirt/libvirt/-/issues/213

[Launchpad Janitor (janitor)]

This bug was fixed in the package qemu - 1:7.2+dfsg-4ubuntu1

---------------
qemu (1:7.2+dfsg-4ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993438), among many other fixes
    this resolvs these bugs:
    (LP: #1957924) - support for querying stats,
    (LP: #1853307) - Enhanced Interpretation for PCI Functions (s390x)
    (LP: #1959966) - guest dump encryption with customer keys (s390x)
    (LP: #1999885) - pv: don't allow userspace to set the clock under PV
    (LP: #1957924) - add filtering of statistics by target vCPU
    remaining changes:
    - qemu-kvm to systemd unit
      - d/qemu-kvm-init: script for QEMU KVM preparation modules, ksm,
        hugepages and architecture specifics
      - d/qemu-system-common.qemu-kvm.service: systemd unit to call
        qemu-kvm-init
      - d/qemu-system-common.install: install helper script
      - d/qemu-system-common.qemu-kvm.default: defaults for
        /etc/default/qemu-kvm
      - d/rules: call dh_installinit and dh_installsystemd for qemu-kvm
    - Distribution specific machine type
      (LP: 1304107 1621042 1776189 1761372 1761372 1776189)
      - d/p/ubuntu/define-ubuntu-machine-types.patch: define distro machine
        types containing release versioned machine attributes
      - d/qemu-system-x86.NEWS Info on fixed machine type defintions
        for host-phys-bits=true
      - Add an info about -hpb machine type in debian/qemu-system-x86.NEWS
      - ubuntu-q35 alias added to auto-select the most recent q35 ubuntu type
    - Enable nesting by default
      - d/p/ubuntu/enable-svm-by-default.patch: Enable nested svm by default
        in qemu64 on amd
        [ No more strictly needed, but required for backward compatibility ]
    - tolerate ipxe size change on migrations to >=18.04 (LP: 1713490)
      - d/p/ubuntu/pre-bionic-256k-ipxe-efi-roms.patch: old machine types
        reference 256k path
      - d/control-in: depend on ipxe-qemu-256k-compat-efi-roms to be able to
        handle incoming migrations from former releases.
    - d/qemu-system-x86.README.Debian: add info about updated nesting changes
    - Ease the use of module retention on upgrades (LP 1913421)
      - debian/qemu-block-extra.postinst: enable mount unit on install/upgrade
    - d/control-in: switch qemu-system-x86-xen to qemu-system-xen as this
      landed in Debian but under a different name.
    - Remaining GCC-12 FTBFS (LP 1988710 + LP 1921664)
      + d/p/u/qboot-Disable-LTO-for-ELF-binary-build-step.patch:
        fix qboot FTBFS with LTO
  * Dropped Changes [now part of upstream v7.2.0]
    - d/p/u/lp1994002-migration-Read-state-once.patch: Fix for libvirt
      error 'migration was active, but no RAM info was set' (LP 1994002)
    - d/p/u/ebpf-replace-deprecated-bpf_program__set_socket_filt.patch:
      Fix FTBFS with libbpf 1.0.1-2.
      + Header updates that were added as part of the libbpf fixes
        but not mentioned in changelog
    - d/p/u/lp-1981339-*: fix s390x system emulation (LP 1981339)
    - Fix I/O stalls when using NVMe storage (LP 1970737).
      + d/p/lp1970737-linux-aio-*.patch: Fix unbalanced plugged counter
        in laio_io_unplug.
    - SECURITY UPDATE...

[Christian Ehrhardt  (paelzer)]

As outlined upstream in the linked issue:

"Libvirt queries the qemu monitor instead of debugfs if available to fetch the stats." since 6353e8f5c1f8336a58c2fde93c1c17de224a4dfb which is in v8.7.0 and later and therefore in Ubuntu lunar and later.

Combined with the qemu fix that was done in Lunar this should be good on both.