Very misleading error message when booting PVH with incompatible kernel

[marmarek]

Qubes OS version:

R4.0

---

Steps to reproduce the behavior:

qvm-create -l red testvm
qvm-prefs testvm virt_mode pvh
qvm-prefs testvm kernel 4.9.56-21  # any kernel < 4.11
qvm-start testvm

Expected behavior:

Some message saying PVH require 4.11 or newer kernel.

Actual behavior:

Start failed: internal error: libxenlight failed to create new domain 'testvm', see /var/log/libvirt/libxl/libxl-driver.log for details

Then in /var/log/libvirt/libxl/libxl-driver.log:

2018-01-18 18:17:09.304+0000: xc: panic: xc_dom_boot.c:141: xc_dom_boot_mem_init: can't allocate low memory for domain: Out of memory
2018-01-18 18:17:09.304+0000: libxl: libxl_dom.c:653:libxl__build_dom: xc_dom_boot_mem_init failed: Permission denied
2018-01-18 18:17:09.311+0000: libxl: libxl_create.c:1266:domcreate_rebuild_done: cannot (re-)build domain: -3

This is really misleading, because the actual cause have nothing to do with "Out of memory" or "Permission denied".

I don't know how easy would it be to improve it upstream (in libxenctrl and/or libxl), but we can also workaround it at core-admin side: extract vmlinux from vmlinuz and check for appropriate PVH entry note.

General note:

It would be also nice to have actual libxl error reported through libvirt (or elsewhere) to core-admin (qubesd). Having actual error instead of "look to this file" would greatly ease troubleshooting. And would also allow qubesd to provide more helpful advice what to do.

cc @HW42

[HW42]

For the Xen part of this problem I think this is the upstream fix. At the first look it seems trivial to backport. And yes libxl error via qubesd would be really nice.

[HW42]

For the Xen part of this problem I think this is the upstream fix. At the first look it seems trivial to backport. And yes libxl error via qubesd would be really nice.

[lunarthegrey]

I assume this one can be closed? Looks like upstream patch was merged.

[lunarthegrey]

I assume this one can be closed? Looks like upstream patch was merged.