Incus imported Windows VM unresponsive

Incus
1

Problem
An imported VM (Windows 11) starts, shows as RUNNING but appears not to have obtained an IP address, appears to be unresponsive and I am unable to connect to the console.
Scenario
The VM (win11dev) was exported from a local PC (fedora 42, incus 6.11) and imported on a remote server (Debian 12, incus 6.14).
There is a ssh vpn from the local PC to the remote server and incus remote is working.
The remote server (s1) also has a linux container (deb01) RUNNING and there are no problems with the linux container.
From the PC after: incus remote switch h1 , incus console deb01 can connect to the console of the linux container on the remote server.
From the PC: incus console win11dev --type=vga starts virt-viewer but it shows only
Display output is not active.
The incus vga console does work to a remote container running XFCE.
The host OS (Debian 12) has the tpm device.
A shared folder the VM needs was created as the import aborted on first try reporting this error.
Both the PC and server use the defaults for network and storage pools.

incus list
+----------+---------+---------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |        IPV4         |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+---------------------+------------------------------------------------+-----------------+-----------+
| deb01    | RUNNING | 10.87.230.76 (eth0) | fd42:80e2:7f22:7b6a:1266:6aff:fe89:6869 (eth0) | CONTAINER       | 0         |
+----------+---------+---------------------+------------------------------------------------+-----------------+-----------+
| win11dev | RUNNING |                     | fd42:80e2:7f22:7b6a:216:3eff:fe6b:bd91 (eth0)  | VIRTUAL-MACHINE | 0         |
+----------+---------+---------------------+------------------------------------------------+-----------------+-----------+

incus config show win11dev
architecture: x86_64
config:
  limits.cpu: "4"
  limits.memory: 8GiB
  raw.qemu: -device intel-hda -device hda-duplex -audio spice
  volatile.cloud-init.instance-id: 9d6addf5-4c1b-4478-821d-9b7f570e96d1
  volatile.eth0.host_name: tapd8199bd5
  volatile.eth0.hwaddr: 00:16:3e:6b:bd:91
  volatile.last_state.power: RUNNING
  volatile.uuid: 3f286c3b-41e6-4cd7-9aaf-a997fbc19bfd
  volatile.uuid.generation: 3f286c3b-41e6-4cd7-9aaf-a997fbc19bfd
  volatile.vm.definition: pc-q35-9.0
  volatile.vm.rtc_adjustment: "0"
  volatile.vm.rtc_offset: "0"
  volatile.vsock_id: "1168545824"
devices:
  SHARED:
    path: SHARED
    source: /home/steve/Shared_with_Win11dev
    type: disk
  root:
    path: /
    pool: default
    size: 95GiB
    type: disk
  vtpm:
    path: /dev/tpm0
    type: tpm
ephemeral: false
profiles:
- default
stateful: false
description: ""

incus info win11dev --show-log
Name: win11dev
Description: 
Status: RUNNING
Type: virtual-machine
Architecture: x86_64
PID: 1849
Created: 2024/04/08 13:55 CEST
Last Used: 2025/07/24 09:35 CEST
Started: 2025/07/24 09:35 CEST

Resources:
  Processes: -1
  Disk usage:
    root: 61.34GiB
  Network usage:
    eth0:
      Type: broadcast
      State: UP
      Host interface: tapd8199bd5
      MAC address: 00:16:3e:6b:bd:91
      MTU: 1500
      Bytes received: 1.24kB
      Bytes sent: 0B
      Packets received: 6
      Packets sent: 0
      IP addresses:
        inet6: fd42:80e2:7f22:7b6a:216:3eff:fe6b:bd91/64 (global)

Log:


incus console win11dev --show-log   
!!!! X64 Exception Type - 06(#UD - Invalid Opcode)  CPU Apic ID - 00000000 !!!!
RIP  - 0000000000030000, CS  - 0000000000000038, RFLAGS - 0000000000010246
RAX  - 0000000000000000, RCX - 0000000000000000, RDX - 0000000000000000
RBX  - FFFFFFFFFFFFFFFF, RSP - 000000007EEFCE48, RBP - 000000007EEFCFC0
RSI  - 000000007E8EBB18, RDI - 000000007EF1F3F8
R8   - 0000000000000000, R9  - 0000000003041001, R10 - 000000000000003A
R11  - 0000000000000004, R12 - 000000007EEFCED8, R13 - 000000007EEFCED0
R14  - 0000000000000001, R15 - 000000008000F880
DS   - 0000000000000030, ES  - 0000000000000030, FS  - 0000000000000030
GS   - 0000000000000030, SS  - 0000000000000030
CR0  - 0000000080010033, CR2 - 0000000000000000, CR3 - 000000007EC01000
CR4  - 0000000000000668, CR8 - 0000000000000000
DR0  - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000
DR3  - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400
GDTR - 000000007E9E1000 0000000000000047, LDTR - 0000000000000000
IDTR - 000000007E393018 0000000000000FFF,   TR - 0000000000000000
FXSAVE_STATE - 000000007EEFCAA0
!!!! Can't find image information. !!!!

incus storage info default
info:
  description: ""
  driver: btrfs
  name: default
  space used: 61.89GiB
  total space: 200.00GiB
used by:
  images:
  - bb808967d963b63beed94e6c113dd9e919733595cb29351b6f4a6424e21a9f3f
  instances:
  - deb01
  - win11dev
  profiles:
  - default


incus storage volume info default virtual-machine/win11dev
Name: win11dev
Type: virtual-machine
Content type: block
Usage: 61.34GiB
Total: 95.00GiB
Created: 2024/04/08 13:55 CEST

incus network list
+----------+----------+---------+----------------+---------------------------+-------------+---------+---------+
|   NAME   |   TYPE   | MANAGED |      IPV4      |           IPV6            | DESCRIPTION | USED BY |  STATE  |
+----------+----------+---------+----------------+---------------------------+-------------+---------+---------+
| enp5s0   | physical | NO      |                |                           |             | 0       |         |
+----------+----------+---------+----------------+---------------------------+-------------+---------+---------+
| incusbr0 | bridge   | YES     | 10.87.230.1/24 | fd42:80e2:7f22:7b6a::1/64 |             | 3       | CREATED |
+----------+----------+---------+----------------+---------------------------+-------------+---------+---------+
| lo       | loopback | NO      |                |                           |             | 0       |         |
+----------+----------+---------+----------------+---------------------------+-------------+---------+---------+


incus network show incusbr0
config:
  ipv4.address: 10.87.230.1/24
  ipv4.nat: "true"
  ipv6.address: fd42:80e2:7f22:7b6a::1/64
  ipv6.nat: "true"
description: ""
name: incusbr0
type: bridge
used_by:
- /1.0/instances/deb01
- /1.0/instances/win11dev
- /1.0/profiles/default
managed: true
status: Created
locations:
- none
project: default

journalctl | grep win11dev #from the incus start win11dev event
Jul 24 08:08:06 h1 dnsmasq-dhcp[1490]: read /var/lib/incus/networks/incusbr0/dnsmasq.hosts/win11dev.eth0
Jul 24 08:08:08 h1 incusd[1079]: time="2025-07-24T08:08:08+02:00" level=warning msg="Using writeback cache I/O" devPath=/var/lib/incus/storage-pools/default/virtual-machines/win11dev/root.img device=root fsType=btrfs instance=win11dev instanceType=virtual-machine project=default
Jul 24 08:08:08 h1 audit[1724]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=1724 comm="apparmor_parser"
Jul 24 08:08:08 h1 kernel: audit: type=1400 audit(1753337288.067:17): apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=1724 comm="apparmor_parser"
Jul 24 08:08:08 h1 audit[1736]: AVC apparmor="DENIED" operation="open" profile="incus-win11dev_</var/lib/incus>" name="/proc/1736/uid_map" pid=1736 comm="incusd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 24 08:08:08 h1 kernel: audit: type=1400 audit(1753337288.091:18): apparmor="DENIED" operation="open" profile="incus-win11dev_</var/lib/incus>" name="/proc/1736/uid_map" pid=1736 comm="incusd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 24 08:08:08 h1 audit[1736]: AVC apparmor="DENIED" operation="capable" profile="incus-win11dev_</var/lib/incus>" pid=1736 comm="qemu-system-x86" capability=21  capname="sys_admin"
Jul 24 08:08:08 h1 kernel: audit: type=1400 audit(1753337288.107:19): apparmor="DENIED" operation="capable" profile="incus-win11dev_</var/lib/incus>" pid=1736 comm="qemu-system-x86" capability=21  capname="sys_admin"
Jul 24 08:53:59 h1 systemd[1]: var-lib-incus-devices-win11dev-config.mount.mount: Deactivated successfully.
Jul 24 08:53:59 h1 systemd[1]: var-lib-incus-devices-win11dev-disk.SHARED.SHARED.mount: Deactivated successfully.
Jul 24 08:54:00 h1 audit[2471]: AVC apparmor="STATUS" operation="profile_remove" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=2471 comm="apparmor_parser"
Jul 24 08:54:00 h1 kernel: audit: type=1400 audit(1753340040.148:25): apparmor="STATUS" operation="profile_remove" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=2471 comm="apparmor_parser"
Jul 24 08:55:13 h1 dnsmasq-dhcp[1457]: read /var/lib/incus/networks/incusbr0/dnsmasq.hosts/win11dev.eth0
Jul 24 09:11:25 h1 dnsmasq-dhcp[1487]: read /var/lib/incus/networks/incusbr0/dnsmasq.hosts/win11dev.eth0
Jul 24 09:35:57 h1 incusd[1080]: time="2025-07-24T09:35:57+02:00" level=warning msg="Using writeback cache I/O" devPath=/var/lib/incus/storage-pools/default/virtual-machines/win11dev/root.img device=root fsType=btrfs instance=win11dev instanceType=virtual-machine project=default
Jul 24 09:35:57 h1 audit[1832]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=1832 comm="apparmor_parser"
Jul 24 09:35:57 h1 kernel: audit: type=1400 audit(1753342557.266:16): apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=1832 comm="apparmor_parser"
Jul 24 09:35:57 h1 audit[1833]: AVC apparmor="DENIED" operation="open" profile="incus-win11dev_</var/lib/incus>" name="/proc/1833/uid_map" pid=1833 comm="incusd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 24 09:35:57 h1 kernel: audit: type=1400 audit(1753342557.282:17): apparmor="DENIED" operation="open" profile="incus-win11dev_</var/lib/incus>" name="/proc/1833/uid_map" pid=1833 comm="incusd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 24 09:35:57 h1 audit[1833]: AVC apparmor="DENIED" operation="capable" profile="incus-win11dev_</var/lib/incus>" pid=1833 comm="qemu-system-x86" capability=21  capname="sys_admin"
Jul 24 09:35:57 h1 kernel: audit: type=1400 audit(1753342557.302:18): apparmor="DENIED" operation="capable" profile="incus-win11dev_</var/lib/incus>" pid=1833 comm="qemu-system-x86" capability=21  capname="sys_admin"

dmesg | grep incus
[    8.659928] BTRFS: device label default devid 1 transid 352 /dev/loop0 scanned by incusd (1115)
[    8.735946] audit: type=1400 audit(1753341085.419:15): apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus_dnsmasq-incusbr0_</var/lib/incus>" pid=1486 comm="apparmor_parser"
[ 1480.778051] incusbr0: port 1(tapd8199bd5) entered blocking state
[ 1480.778072] incusbr0: port 1(tapd8199bd5) entered disabled state
[ 1480.921155] audit: type=1400 audit(1753342557.266:16): apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=1832 comm="apparmor_parser"
[ 1480.939751] audit: type=1400 audit(1753342557.282:17): apparmor="DENIED" operation="open" profile="incus-win11dev_</var/lib/incus>" name="/proc/1833/uid_map" pid=1833 comm="incusd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 1480.958688] audit: type=1400 audit(1753342557.302:18): apparmor="DENIED" operation="capable" profile="incus-win11dev_</var/lib/incus>" pid=1833 comm="qemu-system-x86" capability=21  capname="sys_admin"
[ 1481.045665] incusbr0: port 1(tapd8199bd5) entered blocking state
[ 1481.045688] incusbr0: port 1(tapd8199bd5) entered forwarding state
[ 1481.045722] IPv6: ADDRCONF(NETDEV_CHANGE): incusbr0: link becomes ready
[ 4800.528463] incusbr0: port 2(vethe7266111) entered blocking state
[ 4800.528473] incusbr0: port 2(vethe7266111) entered disabled state
[ 4800.559507] audit: type=1400 audit(1753345876.909:19): apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus-deb01_</var/lib/incus>" pid=2611 comm="apparmor_parser"
[ 4800.773660] incusbr0: port 2(vethe7266111) entered blocking state
[ 4800.773665] incusbr0: port 2(vethe7266111) entered forwarding state
[ 4801.001756] audit: type=1400 audit(1753345877.353:20): apparmor="DENIED" operation="file_lock" profile="incus-deb01_</var/lib/incus>" pid=2775 comm="(crub_all)" family="unix" sock_type="dgram" protocol=0 requested_mask="send"
[ 4801.001775] audit: type=1400 audit(1753345877.353:21): apparmor="DENIED" operation="file_lock" profile="incus-deb01_</var/lib/incus>" pid=2775 comm="(crub_all)" family="unix" sock_type="dgram" protocol=0 requested_mask="send"
[ 4801.082871] audit: type=1400 audit(1753345877.433:22): apparmor="DENIED" operation="file_lock" profile="incus-deb01_</var/lib/incus>" pid=2785 comm="(ostnamed)" family="unix" sock_type="dgram" protocol=0 requested_mask="send"
[ 4801.082891] audit: type=1400 audit(1753345877.433:23): apparmor="DENIED" operation="file_lock" profile="incus-deb01_</var/lib/incus>" pid=2785 comm="(ostnamed)" family="unix" sock_type="dgram" protocol=0 requested_mask="send"

dmesg | grep win11dev
[ 1480.921155] audit: type=1400 audit(1753342557.266:16): apparmor="STATUS" operation="profile_load" profile="unconfined" name="incus-win11dev_</var/lib/incus>" pid=1832 comm="apparmor_parser"
[ 1480.939751] audit: type=1400 audit(1753342557.282:17): apparmor="DENIED" operation="open" profile="incus-win11dev_</var/lib/incus>" name="/proc/1833/uid_map" pid=1833 comm="incusd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 1480.958688] audit: type=1400 audit(1753342557.302:18): apparmor="DENIED" operation="capable" profile="incus-win11dev_</var/lib/incus>" pid=1833 comm="qemu-system-x86" capability=21  capname="sys_admin"
2

EDK2 is crashing, so that’s probably an issue of with the version of EDK2 packaged by your distro.

1 Like
3

Thanks. It looks like fedora 42 is based on edk2-stable202502 and Debian 12 on edk2-stable202211.
I think I previously exported the incus VM from a different Debian machine to Fedora but that’s going forwards in versions. It looks like backwards is not going to work. I may have the original Debian export. If so I will try that.

4

The EDK2 firmware is loaded from the host system, it’s not part of the instance itself.

1 Like
5

I tired importing a similar version of the VM that was exported from a Debian PC and the VM works without any issues.
Thanks @stgraber, it was useful to learn more about EDK2 relationship with incus VMs.
Also reinforced is:

  • importing to hosts with older package versions than the exported host is unsupported and probably not going to work;
  • VM exports from Fedora:incus to incus Debian:incus are most likely not going to work because Fedora packages are a later versions than Debian (as one should expect).
  • the other way around, importing VMs to hosts with later package versions will probably be OK. I have not experienced any issues, with export/import of VMs from Debian:incus to Fedora:incus, or any issues with VMs exported/imported from incus 6.11 to incus 6.14.