Given a freshly downloaded Debian 9 ISO from the Debian website
I expect to be able to create a working VM using Boxes
But instead Boxes fails with an uninformative error message.
It works from Virtual Machine Manager, but not from Boxes, either 1) coming straight from the ISO, or 2) importing the VM created by VMM).
Attached is the console output of attempting to import the working VMM setup, then the console output of attempting to create a VM straight from the Debian 9 ISO.
Hi,
can you please do a
virsh dumpxml debian9
and attach this output. For some reason gnome-boxes is picking a CPU model that doesn't work with your host CPU and we need to yet find out why. I don't think that's the issue but just to be sure: can you also attach the
dmesg | grep -i kvm
outut after gnome-boxes prints the error and please add the
grep -E 'vmx|svm' /proc/cpuinfo
output so we're sure Linux sees the right virtualization CPU flags and is able to use them properly?
If you just want to get a VM going, I'm using:
http://honk.sigxcpu.org/con/Preseeding_Debian_virtual_machines_with_virt_install.html
this should work in any case (if your user is in the libvirt group and you do a
virsh net-start default
first.
When you attempt to start a pureos live cd image in Boxes, you will get the following error in the terminal:
(gnome-boxes:3277): Boxes-WARNING **: machine.vala:611: Failed to start pureos-8: Unable to start domain: unsupported configuration: CPU mode 'custom' for x86_64 kvm domain on x86_64 host is not supported by hypervisor
and here is the troubleshooting log:
Broker URL: qemu+unix:///session
Domain: boxes-unknown
UUID: 47cc179f-b4ed-42e9-a7a7-94156dad6053
Persistent: yes
Cpu time: 0
Memory: 2097152 KiB
Max memory: 8085456 KiB
CPUs: 4
State: GVIR_DOMAIN_STATE_SHUTOFF
Domain config:
------------------------------------------------------------
<domain type="kvm">
<name>boxes-unknown</name>
<uuid>47cc179f-b4ed-42e9-a7a7-94156dad6053</uuid>
<title>pureos-8</title>
<metadata>
<boxes:gnome-boxes xmlns:boxes="https://wiki.gnome.org/Apps/Boxes">
<os-state>live</os-state>
<media>/home/kyle/pureos-8.0-gnome-live_20180119-amd64.hybrid.iso</media>
</boxes:gnome-boxes>
</metadata>
<memory unit="KiB">2097152</memory>
<currentMemory unit="KiB">2097152</currentMemory>
<vcpu placement="static">4</vcpu>
<os>
<type arch="x86_64" machine="pc-i440fx-2.11">hvm</type>
<boot dev="cdrom"/>
<boot dev="hd"/>
</os>
<features>
<acpi/>
<apic/>
</features>
<cpu mode="custom" match="exact" check="partial">
<model fallback="allow">Broadwell-noTSX-IBRS</model>
<topology sockets="1" cores="2" threads="2"/>
</cpu>
<clock offset="utc">
<timer name="rtc" tickpolicy="catchup"/>
<timer name="pit" tickpolicy="delay"/>
<timer name="hpet" present="no"/>
</clock>
<on_poweroff>destroy</on_poweroff>
<on_reboot>destroy</on_reboot>
<on_crash>destroy</on_crash>
<pm>
<suspend-to-mem enabled="no"/>
<suspend-to-disk enabled="no"/>
</pm>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type="file" device="disk">
<driver name="qemu" type="qcow2" cache="writeback"/>
<source file="/home/kyle/.local/share/gnome-boxes/images/boxes-unknown"/>
<target dev="hda" bus="ide"/>
<address type="drive" controller="0" bus="0" target="0" unit="0"/>
</disk>
<disk type="file" device="cdrom">
<driver name="qemu" type="raw"/>
<source file="/home/kyle/pureos-8.0-gnome-live_20180119-amd64.hybrid.iso" startupPolicy="mandatory"/>
<target dev="hdc" bus="ide"/>
<readonly/>
<address type="drive" controller="0" bus="1" target="0" unit="0"/>
</disk>
<controller type="usb" index="0" model="ich9-ehci1">
<address type="pci" domain="0x0000" bus="0x00" slot="0x05" function="0x7"/>
</controller>
<controller type="usb" index="0" model="ich9-uhci1">
<master startport="0"/>
<address type="pci" domain="0x0000" bus="0x00" slot="0x05" function="0x0" multifunction="on"/>
</controller>
<controller type="usb" index="0" model="ich9-uhci2">
<master startport="2"/>
<address type="pci" domain="0x0000" bus="0x00" slot="0x05" function="0x1"/>
</controller>
<controller type="usb" index="0" model="ich9-uhci3">
<master startport="4"/>
<address type="pci" domain="0x0000" bus="0x00" slot="0x05" function="0x2"/>
</controller>
<controller type="pci" index="0" model="pci-root"/>
<controller type="ide" index="0">
<address type="pci" domain="0x0000" bus="0x00" slot="0x01" function="0x1"/>
</controller>
<controller type="virtio-serial" index="0">
<address type="pci" domain="0x0000" bus="0x00" slot="0x06" function="0x0"/>
</controller>
<controller type="ccid" index="0">
<address type="usb" bus="0" port="2"/>
</controller>
<interface type="user">
<mac address="52:54:00:5c:05:f0"/>
<model type="rtl8139"/>
<address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x0"/>
</interface>
<smartcard mode="passthrough" type="spicevmc">
<address type="ccid" controller="0" slot="0"/>
</smartcard>
<serial type="pty">
<target type="isa-serial" port="0">
<model name="isa-serial"/>
</target>
</serial>
<console type="pty">
<target type="serial" port="0"/>
</console>
<channel type="spicevmc">
<target type="virtio" name="com.redhat.spice.0"/>
<address type="virtio-serial" controller="0" bus="0" port="1"/>
</channel>
<channel type="spiceport">
<source channel="org.spice-space.webdav.0"/>
<target type="virtio" name="org.spice-space.webdav.0"/>
<address type="virtio-serial" controller="0" bus="0" port="2"/>
</channel>
<input type="tablet" bus="usb">
<address type="usb" bus="0" port="3"/>
</input>
<input type="mouse" bus="usb">
<address type="usb" bus="0" port="4"/>
</input>
<input type="keyboard" bus="usb">
<address type="usb" bus="0" port="5"/>
</input>
<input type="mouse" bus="ps2"/>
<input type="keyboard" bus="ps2"/>
<graphics type="spice">
<listen type="none"/>
<image compression="off"/>
</graphics>
<sound model="ac97">
<address type="pci" domain="0x0000" bus="0x00" slot="0x04" function="0x0"/>
</sound>
<video>
<model type="qxl" ram="65536" vram="65536" vgamem="16384" heads="1" primary="yes"/>
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x0"/>
</video>
<redirdev bus="usb" type="spicevmc">
<address type="usb" bus="0" port="6"/>
</redirdev>
<redirdev bus="usb" type="spicevmc">
<address type="usb" bus="0" port="1.1"/>
</redirdev>
<redirdev bus="usb" type="spicevmc">
<address type="usb" bus="0" port="1.2"/>
</redirdev>
<redirdev bus="usb" type="spicevmc">
<address type="usb" bus="0" port="1.3"/>
</redirdev>
<hub type="usb">
<address type="usb" bus="0" port="1"/>
</hub>
<memballoon model="virtio">
<address type="pci" domain="0x0000" bus="0x00" slot="0x07" function="0x0"/>
</memballoon>
</devices>
</domain>
------------------------------------------------------------I added more logging and tried again. here are the (sanitized) results:
2018-02-06 20:05:32.738+0000: 4067: info : libvirt version: 4.0.0, package: 1 (Guido Günther <agx@sigxcpu.org> Sat, 20 Jan 2018 16:31:11 +0100) 2018-02-06 20:05:32.738+0000: 4067: info : hostname: user.example.com 2018-02-06 20:05:32.738+0000: 4067: error : virFileReadAll:1420 : Failed to open file '/sys/kernel/security/apparmor/profiles': Permission denied 2018-02-06 20:05:32.889+0000: 4067: error : profile_status:100 : Failed to read AppArmor profiles list '/sys/kernel/security/apparmor/profiles': Permission denied 2018-02-06 20:05:32.933+0000: 4071: error : virPCIDeviceNew:1787 : Device 0002:01:01.0 not found: could not access /sys/bus/pci/devices/0002:01:01.0/config: No such file or directory 2018-02-06 20:05:40.192+0000: 4054: error : qemuProcessUpdateGuestCPU:5321 : unsupported configuration: CPU mode 'custom' for x86_64 kvm domain on x86_64 host is not supported by hypervisor 2018-02-06 20:05:40.355+0000: 4054: error : virNetClientProgramDispatchError:177 : Unable to open file: /home/user/.cache/libvirt/qemu/log/boxes-unknown.log: No such file or directory
More debug info:
kyle@kylel13:~$ virsh cpu-models x86_64 486 pentium pentium2 pentium3 pentiumpro coreduo n270 core2duo qemu32 kvm32 cpu64-rhel5 cpu64-rhel6 kvm64 qemu64 Conroe Penryn Nehalem Nehalem-IBRS Westmere Westmere-IBRS SandyBridge SandyBridge-IBRS IvyBridge IvyBridge-IBRS Haswell-noTSX Haswell-noTSX-IBRS Haswell Haswell-IBRS Broadwell-noTSX Broadwell-noTSX-IBRS Broadwell Broadwell-IBRS Skylake-Client Skylake-Client-IBRS Skylake-Server Skylake-Server-IBRS athlon phenom Opteron_G1 Opteron_G2 Opteron_G3 Opteron_G4 Opteron_G5 EPYC EPYC-IBPB
@chris.lamb yes, I think that's the same issue. I hope to get around to look at it again later this week.
@chris.lamb that's the same issue. Could someone having this problem please run
virsh cpu-compare domain.xml
where domain.xml is the xml of a domain that fialed to install (boxes leaves them around)
Oh, installation on Debian buster works with e.g.:
gnome-boxes debian-9.3.0-amd64-netinst.iso
after you do a
setcap cap_net_admin+ep /usr/lib/qemu/qemu-bridge-helper
(due to the qemu package not setting up permissons properly). I'm not sure if pureOS does that but it should. This is not the cause for the above problem but will be the next issue users run into once we figured out why boxes picks a cpu model libvirt won't handle.
@kyle.rankin the setcap is only for a follow up problem. It won't help with the CPU type conflict.
@kyle.rankin @chris.lamb are you using different hw models, PureOS versions? @chris.lamb can you attach the "virsh capabilities" output as well?
Ah, I was a little behind on updates. When I upgrade to the latest versions of packages (on my Librem 13v2) it fails to start. :)
virsh capabilities output here: https://gist.githubusercontent.com/anonymous/8becdc7b30d9ee14f153422c7164264d/raw/9356d1b1b6d3f85ccc39fa61331eaaa4168c79f7/gistfile1.txt
What version of libvirt, qemu and gnome-boxes is pureos currently shipping? Any patches on top of Debian proper?
My system after the most recent updates is running the following versions:
libvirt - 4.0.0.1 qemu - 1:2.11+dfsg1 gnome-boxes - 3.26.2-3
Any chance somebody could run the above
virsh cpu-compare domain.xml
The domain.xml should be from the domain gnome-boxes failed to create:
virsh -c qemu:///session dumpxml <domainname> > domain.xml
where the domain name can be determined via
virsh -c qemu:///session list --all
CPU described in domain.xml is incompatible with host CPU
The relevant domain.xml is
https://gist.github.com/lamby/4de36003496e711a34859d0a719710fa/raw
virsh cpu-compare domain.xml
results in:
Host CPU is a superset of CPU described in domain.xml
Relevant domain.xml:
Hello,
It looks like the bug is in debian too: https://bugs.debian.org/889990
From here the bug was linked to an upstram issue which does not look related at first glance but it might help:
https://gitlab.gnome.org/GNOME/gnome-boxes/issues/150
And I got the same virsh output as jwolf.
I think I've found the issue: Can you try to add the user to the KVM group and see if it helps?
That's
sudo adduser <youruser> kvm newgrp kvm killall libvirtd libvirtd
and then retry after restarting gnome-boxes (or just reboot after the first command)
That seems to have worked. I ran into some additional issues with the storage pool, but that was mostly from me trying different things. Spun up a fresh user, added it to the kvm group, and successfully created & started a VM. Troubleshot the other issues on the main account, and successfully created & started a VM.
Thanks !
That worked for me too!
sudo adduser <youruser> kvm newgrp kvm
was enough for me.
So just a matter of updating the error message then...
That worked for me too. I did the killall libvirtd and so had to do /etc/init.d/libvirtd start to bring it back up without a reboot.
Thank you very much.
So, from PureOS's point of view, I wonder whether we should do any of:
etc
@chris.lamb as noted in https://bugs.debian.org/889990 I think logind should adjust the ACL as it does for the dri and audio devices.
Adding kvm to my user did solve something. Then I also installed libvirt-daemon-system manually, because it is only suggested.
But still I get some error when creating vm:
(gnome-boxes:12779): Boxes-WARNING **: wizard.vala:267: Unable to start domain: internal error: cannot load AppArmor profile 'libvirt-8bc855ae-b28e-40f6-87cd-76a5960a3815'
I didn't touch any global settings and same thing happens for newly created user.
Also the log contains things like this:
2018-03-15 20:40:48.974+0000: starting up libvirt version: 4.0.0, package: 2 (Guido Günther <agx@sigxcpu.org> Thu, 08 Feb 2018 19:29:59 +0100), qemu version: 2.11.0(Debian 1:2.11+dfsg-1), hostname: hhlibrem LC_ALL=C PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games HOME=/home/hh USER=hh LOGNAME=hh QEMU_AUDIO_DRV=spice /usr/bin/kvm -name guest=debian9-univ-2,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/home/hh/.config/libvirt/qemu/lib/domain-1-debian9-univ-2/master-key.aes -machine pc-i440fx-2.11,accel=kvm,usb=off,dump-guest-core=off -cpu Broadwell-noTSX,spec-ctrl=on -m 1024 -realtime mlock=off -smp 4,sockets=1,cores=2,threads=2 -uuid c222adb7-35db-4f21-b201-50f2b6325392 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/home/hh/.config/libvirt/qemu/lib/domain-1-debian9-univ-2/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-hpet -no-reboot -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot strict=on -kernel /home/hh/.cache/gnome-boxes/debian9-univ-2-kernel -initrd /home/hh/.cache/gnome-boxes/debian9-univ-2-initrd -append ' keyboard-configuration/xkb-keymap=us debconf/priority=critical' -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x5.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x5 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x5.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x5.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 -device usb-ccid,id=ccid0,bus=usb.0,port=3 -device usb-hub,id=hub0,bus=usb.0,port=1 -drive file=/home/hh/.local/share/gnome-boxes/images/debian9-univ-2,format=qcow2,if=none,id=drive-virtio-disk0,cache=writeback -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=2 -drive file=/home/hh/Downloads/debian-9.3.0-amd64-DVD-1.iso,format=raw,if=none,id=drive-ide0-1-0,readonly=on -device ide-cd,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0,bootindex=1 -drive file=/home/hh/.cache/gnome-boxes/debian9-univ-2-unattended.img,format=raw,if=none,id=drive-usb-disk0 -device usb-storage,bus=usb.0,port=2,drive=drive-usb-disk0,id=usb-disk0,removable=off -netdev user,id=hostnet0 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:6f:cf:f2,bus=pci.0,addr=0x3 -chardev spicevmc,id=charsmartcard0,name=smartcard -device ccid-card-passthru,chardev=charsmartcard0,id=smartcard0,bus=ccid0.0 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -chardev spiceport,id=charchannel1,name=org.spice-space.webdav.0 -device virtserialport,bus=virtio-serial0.0,nr=2,chardev=charchannel1,id=channel1,name=org.spice-space.webdav.0 -device usb-tablet,id=input0,bus=usb.0,port=4 -device usb-mouse,id=input1,bus=usb.0,port=5 -device usb-kbd,id=input2,bus=usb.0,port=6 -spice port=0,disable-ticketing,image-compression=off,seamless-migration=on -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,vram64_size_mb=0,vgamem_mb=16,max_outputs=1,bus=pci.0,addr=0x2 -device AC97,id=sound0,bus=pci.0,addr=0x4 -chardev spicevmc,id=charredir0,name=usbredir -device usb-redir,chardev=charredir0,id=redir0,bus=usb.0,port=1.1 -chardev spicevmc,id=charredir1,name=usbredir -device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=1.2 -chardev spicevmc,id=charredir2,name=usbredir -device usb-redir,chardev=charredir2,id=redir2,bus=usb.0,port=1.3 -chardev spicevmc,id=charredir3,name=usbredir -device usb-redir,chardev=charredir3,id=redir3,bus=usb.0,port=1.4 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x8 -msg timestamp=on 2018-03-15T20:40:48.999966Z qemu-system-x86_64: -chardev pty,id=charserial0: char device redirected to /dev/pts/1 (label charserial0) 2018-03-15T20:40:49.006261Z qemu-system-x86_64: can't apply global Broadwell-noTSX-x86_64-cpu.spec-ctrl=on: Property '.spec-ctrl' not found 2018-03-15 20:40:49.011+0000: shutting down, reason=failed 2018-03-15 20:53:33.282+0000: starting up libvirt version: 4.0.0, package: 2 (Guido Günther <agx@sigxcpu.org> Thu, 08 Feb 2018 19:29:59 +0100), qemu version: 2.11.0(Debian 1:2.11+dfsg-1), hostname: hhlibrem LC_ALL=C PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games HOME=/home/hh USER=hh LOGNAME=hh QEMU_AUDIO_DRV=spice /usr/bin/kvm -name guest=debian9-univ-2,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/home/hh/.config/libvirt/qemu/lib/domain-1-debian9-univ-2/master-key.aes -machine pc-i440fx-2.11,accel=kvm,usb=off,dump-guest-core=off -cpu Broadwell-noTSX,spec-ctrl=on -m 1024 -realtime mlock=off -smp 4,sockets=1,cores=2,threads=2 -uuid 79db3901-de9e-4579-936f-f530247085ca -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/home/hh/.config/libvirt/qemu/lib/domain-1-debian9-univ-2/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-hpet -no-reboot -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot strict=on -kernel /home/hh/.cache/gnome-boxes/debian9-univ-2-kernel -initrd /home/hh/.cache/gnome-boxes/debian9-univ-2-initrd -append ' keyboard-configuration/xkb-keymap=us debconf/priority=critical' -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x5.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x5 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x5.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x5.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 -device usb-ccid,id=ccid0,bus=usb.0,port=3 -device usb-hub,id=hub0,bus=usb.0,port=1 -drive file=/home/hh/.local/share/gnome-boxes/images/debian9-univ-2,format=qcow2,if=none,id=drive-virtio-disk0,cache=writeback -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=2 -drive file=/home/hh/Downloads/debian-9.3.0-amd64-DVD-1.iso,format=raw,if=none,id=drive-ide0-1-0,readonly=on -device ide-cd,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0,bootindex=1 -drive file=/home/hh/.cache/gnome-boxes/debian9-univ-2-unattended.img,format=raw,if=none,id=drive-usb-disk0 -device usb-storage,bus=usb.0,port=2,drive=drive-usb-disk0,id=usb-disk0,removable=off -netdev user,id=hostnet0 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:19:d4:f8,bus=pci.0,addr=0x3 -chardev spicevmc,id=charsmartcard0,name=smartcard -device ccid-card-passthru,chardev=charsmartcard0,id=smartcard0,bus=ccid0.0 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -chardev spiceport,id=charchannel1,name=org.spice-space.webdav.0 -device virtserialport,bus=virtio-serial0.0,nr=2,chardev=charchannel1,id=channel1,name=org.spice-space.webdav.0 -device usb-tablet,id=input0,bus=usb.0,port=4 -device usb-mouse,id=input1,bus=usb.0,port=5 -device usb-kbd,id=input2,bus=usb.0,port=6 -spice port=0,disable-ticketing,image-compression=off,seamless-migration=on -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,vram64_size_mb=0,vgamem_mb=16,max_outputs=1,bus=pci.0,addr=0x2 -device AC97,id=sound0,bus=pci.0,addr=0x4 -chardev spicevmc,id=charredir0,name=usbredir -device usb-redir,chardev=charredir0,id=redir0,bus=usb.0,port=1.1 -chardev spicevmc,id=charredir1,name=usbredir -device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=1.2 -chardev spicevmc,id=charredir2,name=usbredir -device usb-redir,chardev=charredir2,id=redir2,bus=usb.0,port=1.3 -chardev spicevmc,id=charredir3,name=usbredir -device usb-redir,chardev=charredir3,id=redir3,bus=usb.0,port=1.4 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x8 -msg timestamp=on 2018-03-15T20:53:33.309896Z qemu-system-x86_64: -chardev pty,id=charserial0: char device redirected to /dev/pts/1 (label charserial0) 2018-03-15T20:53:33.316697Z qemu-system-x86_64: can't apply global Broadwell-noTSX-x86_64-cpu.spec-ctrl=on: Property '.spec-ctrl' not found 2018-03-15 20:53:33.319+0000: shutting down, reason=failed
I don't know. But only suggested solution, adding kvm group did change the error messages, but there is still some problem.
I don't know if can't apply global Broadwell-noTSX-x86_64-cpu.spec-ctrl=on: Property '.spec-ctrl' not found or cannot load AppArmor profile ... is the problem.