- Devel - libvirt List Archives

[PATCH RFC 0/5] qemu: Adjust to deprecation of -netdev tap properties 'fd' and 'vhostfd' - Variant B
by Peter Krempa 07 Feb '26

07 Feb '26

This patchset adapts libvirt to the proposed deprecation of 'fd'/'vhostfd' fields in favor of the plural spellings even for 1 fd. Based on the discussion [1] it seems that it should be possible to replace it unconditionally but I'm not certain about this and also it's outside my usual area of expertise. Thus this version is the more cautious approach of adding a capability and only switching the generator once deprecations are set up. While adding the capability I've also uncovered a bug in the QMP query strings where it was not possible to query features of an object member. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/SM4… Peter Krempa (5): virQEMUQAPISchemaTraverseObject: Consider features also on current members qemu: capabilities: Introduce QEMU_CAPS_NETDEV_TAP_FD_VHOSTFD_PLURAL qemuxmlconftest: Add version-locked test cases for the use of -netdev tap with fd/vhostfd qemuBuildHostNetProps: Use 'fds', 'vhostfds' with QEMU_CAPS_NETDEV_TAP_FD_VHOSTFD_PLURAL [DO_NOT_PUSH] qemucapabilitiesdata: Update with patches removing 'fd' and 'vhostfd' src/qemu/qemu_capabilities.c | 8 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 11 +- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_qapi.c | 26 + .../caps_11.0.0_x86_64.replies | 3571 ++++++++--------- .../caps_11.0.0_x86_64.xml | 11 +- .../downscript.x86_64-latest.args | 2 +- .../graphics-spice-timeout.x86_64-latest.args | 2 +- .../net-bandwidth.x86_64-latest.args | 2 +- .../net-bandwidth2.x86_64-latest.args | 2 +- .../net-coalesce.x86_64-latest.args | 6 +- .../net-eth-hostip.x86_64-latest.args | 2 +- .../net-eth-ifname.x86_64-latest.args | 2 +- .../net-eth-names.x86_64-latest.args | 4 +- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- .../net-eth.x86_64-10.2.0.args | 36 + .../qemuxmlconfdata/net-eth.x86_64-10.2.0.xml | 44 + .../net-eth.x86_64-latest.args | 2 +- .../net-isolated-port.x86_64-latest.args | 2 +- .../net-midonet.x86_64-latest.args | 2 +- .../net-mtu.x86_64-latest.args | 4 +- .../net-openvswitch.x86_64-latest.args | 2 +- ...irtio-network-portgroup.x86_64-latest.args | 6 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- .../net-virtio-vhost.x86_64-10.2.0.args | 42 + .../net-virtio-vhost.x86_64-10.2.0.xml | 65 + .../net-virtio-vhost.x86_64-latest.args | 2 +- .../tap-vhost-incorrect.x86_64-latest.args | 4 +- .../user-aliases.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 4 + 32 files changed, 2048 insertions(+), 1828 deletions(-) create mode 100644 tests/qemuxmlconfdata/net-eth.x86_64-10.2.0.args create mode 100644 tests/qemuxmlconfdata/net-eth.x86_64-10.2.0.xml create mode 100644 tests/qemuxmlconfdata/net-virtio-vhost.x86_64-10.2.0.args create mode 100644 tests/qemuxmlconfdata/net-virtio-vhost.x86_64-10.2.0.xml -- 2.53.0

1 5

[PATCH RFC 0/5] qemu: Adjust to deprecation of -netdev tap properties 'fd' and 'vhostfd' - Variant A
by Peter Krempa 07 Feb '26

07 Feb '26

This patchset adapts libvirt to the proposed deprecation of 'fd'/'vhostfd' fields in favor of the plural spellings even for 1 fd. Based on the discussion [1] it seems that it should be possible to replace it unconditionally but I'm not certain about this and also it's outside my usual area of expertise. This is the optimistic approach should it be possible for us to unconditionally use the plural variands. Reordering the patches shows that the proposal causes test suite failures in our code. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/SM4… Peter Krempa (2): qemuBuildHostNetProps: Use only plural form of 'fds' and 'vhostfds' properties [DO_NOT_PUSH] qemucapabilitiesdata: Update with patches removing 'fd' and 'vhostfd' src/qemu/qemu_command.c | 24 +- .../caps_11.0.0_x86_64.replies | 3571 ++++++++--------- .../caps_11.0.0_x86_64.xml | 10 +- .../downscript.x86_64-latest.args | 2 +- .../graphics-spice-timeout.x86_64-latest.args | 2 +- .../net-bandwidth.x86_64-latest.args | 2 +- .../net-bandwidth2.x86_64-latest.args | 2 +- .../net-coalesce.x86_64-latest.args | 6 +- .../net-eth-hostip.x86_64-latest.args | 2 +- .../net-eth-ifname.x86_64-latest.args | 2 +- .../net-eth-names.x86_64-latest.args | 4 +- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- .../net-eth.x86_64-latest.args | 2 +- .../net-isolated-port.x86_64-latest.args | 2 +- .../net-midonet.x86_64-latest.args | 2 +- .../net-mtu.x86_64-latest.args | 4 +- .../net-openvswitch.x86_64-latest.args | 2 +- ...irtio-network-portgroup.x86_64-latest.args | 6 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- .../net-virtio-vhost.x86_64-latest.args | 2 +- .../tap-vhost-incorrect.x86_64-latest.args | 4 +- .../user-aliases.x86_64-latest.args | 2 +- 22 files changed, 1815 insertions(+), 1842 deletions(-) -- 2.53.0

1 2

Failed to find parent device on Arrow Lake processor
by Bertrand Leconte 07 Feb '26

07 Feb '26

Hello, I am using libvirt within Qubes OS (https://www.qubes-or.org) My laptop is a Lenovo P16 Gen 3 with an Intel Core Ultra 9 275HX, which is in the Arrow Lake family. The associated PCH is an Intel 800 Series WM880. The particularity of this platform is that the PCH includes a dedicated PCI Root Complex in addition to the CPU one. That means that I have devices connected to `0000:00` bus (addresses like 0000:00:xx.x) and devices connected to `0000:80` bus (addresses like 0000:80:xx.x). The consequence of that architecture is that there is no PCI Root Port serving the `0000:80` bus. When I want to PCI passthrough my USB controller device `0000:80:14.0`, the function `virPCIDeviceIsBehindSwitchLackingACS()` says that `Failed to find parent device for 0000:80:14.0`. When I look into the source code, it looks like it enumerates all PCI devices, searching for the Root Port managing the bus `0000:80`. As I said before, it cannot find any as it's A Root Complex that manage the `0000:80` bus and not a Root Port (a Root Complex it's not a PCI/PCIe device). However, for any device connected to PCI bus `0000:00`, it cannot find any PCI Root Port either but there is an exception in the code for it. @Bloged (one of Qubes OS users) proposed in https://forum.qubes-os.org/t/aistone-x6ar57ty-aka-tongfang-x6-16-intel-high… to change the code to diff --git a/src/util/virpci.c b/src/util/virpci.c index 3816369..fbed8f5 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -2555,12 +2555,20 @@ virPCIDeviceIsBehindSwitchLackingACS(virPCIDevice *dev) if (virPCIDeviceGetParent(dev, &parent) < 0) return -1; if (!parent) { - /* if we have no parent, and this is the root bus, ACS doesn't come - * into play since devices on the root bus can't P2P without going - * through the root IOMMU. + /* if we have no parent, and this is a root-like bus (0 or 0x80), + * ACS doesn't come into play since devices on these buses can't P2P + * without going through the root IOMMU. + * + * Arrow Lake (Intel Core Ultra 200 series) uses bus 0x80 for integrated + * devices like USB controllers, with a complex PCH topology that confuses + * parent device detection. Treat bus 0x80 like bus 0 for ACS purposes. */ if (dev->address.bus == 0) { return 0; + } else if (dev->address.bus == 0x80) { + VIR_DEBUG("%s %s: Arrow Lake bus 0x80 device, treating as root bus for ACS check", + dev->id, dev->name); + return 0; } else { virReportError(VIR_ERR_INTERNAL_ERROR, _("Failed to find parent device for %1$s"), -- This patch works, but it does not look very generic. In addition to that, a thread in 2017 (this mailing list) seems to indicate that this part of the code may not be necessary: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/QRI4…. My question: can someone that knows this part of the code have a look to see what is the best way to correct it: either propose a patch to `virPCIDeviceIsBehindSwitchLackingACS` that is more generic or to change the rest of the code so it's no more used? (By the way, internationalization of error messages in syslog/dmesg/journald does not look like a good idea. It is very hard to understand if the message is given in French in this mailing list…) Thanks very much for your help Bertrand

4 11

[PATCH v2 0/2] target/arm: Deprecate '-cpu any'
by Philippe Mathieu-Daudé 07 Feb '26

07 Feb '26

Arm '-cpu any' is aliased to '-cpu max' since more than 5 years. Deprecate the former in preparation of removal. v2: s/any/max/ in target/arm/cpu.c comment Philippe Mathieu-Daudé (2): target/arm: Remove dead code target/arm: Deprecate '-cpu any' (remplaced by '-cpu max') docs/about/deprecated.rst | 8 ++++++++ target/arm/cpu.h | 2 +- target/arm/cpu.c | 1 + target/arm/tcg/cpu32.c | 3 --- 4 files changed, 10 insertions(+), 4 deletions(-) -- 2.52.0

3 7

[PATCH 0/4] hyperv: Implement virDomainInterfaceAddresses()
by Michal Privoznik 07 Feb '26

07 Feb '26

*** BLURB HERE *** Michal Prívozník (4): datatypes: Declare autofree func for virDomainInterface type virsocketaddr: Introduce virSocketAddrSubnetToPrefix() hyperv: Move MAC parsing into a separate function hyperv: Implement virDomainInterfaceAddresses() src/datatypes.h | 2 + src/hyperv/hyperv_driver.c | 228 +++++++++++++++++++++++--- src/hyperv/hyperv_wmi_generator.input | 12 ++ src/libvirt_private.syms | 1 + src/util/virsocketaddr.c | 51 ++++++ src/util/virsocketaddr.h | 2 + tests/sockettest.c | 29 ++++ 7 files changed, 300 insertions(+), 25 deletions(-) -- 2.52.0

3 6

[PATCH v4 0/6] cover: RFE libvirt secret encryption on disk
by Arun Menon 07 Feb '26

07 Feb '26

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. 6. Add documentation. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v3: - Fix the regression of loading unencrypted secrets after an upgrade. Previously the .base64 unencrypted secrets were not being loaded. - Add documentation on encrypted secrets. Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (6): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Rename virSecretObj structure attribute from base64File to secretValueFile secret: Add functionality to load and save secrets in encrypted format docs: secret: Add documentation of secret encryption feature docs/drvsecret.rst | 4 + docs/meson.build | 1 + docs/secretencryption.rst | 86 ++++++++ include/libvirt/virterror.h | 1 + libvirt.spec.in | 8 + po/POTFILES | 1 + src/conf/virsecretobj.c | 193 ++++++++++++++---- src/conf/virsecretobj.h | 18 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 4 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 32 +++ src/secret/secret.conf.in | 14 ++ src/secret/secret_config.c | 179 ++++++++++++++++ src/secret/secret_config.h | 40 ++++ src/secret/secret_driver.c | 34 ++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 8 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 +++++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 ++++++ 24 files changed, 831 insertions(+), 50 deletions(-) create mode 100644 docs/secretencryption.rst create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

2 14

[PATCH] virsh: Switch cmdDomIfAddr() to vshTable
by Michal Privoznik 07 Feb '26

07 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> The aim of cmdDomIfAddr() is to obtain IP addresses for given domain and then print (ifName, MAC, type, IP Address) tuple. Preferably in an aligned table. This is hard to do with printf style of spacing ("%-NNs") since the interface name (ifName) can vary a lot in length. Fortunately, we have vshTable which is designed to handle this case. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/virsh-domain-monitor.c | 53 ++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 23 deletions(-) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index f4274f2721..c0db30cb11 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -2279,6 +2279,7 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) bool full = vshCommandOptBool(cmd, "full"); const char *sourcestr = NULL; int source = VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE; + g_autoptr(vshTable) table = NULL; if (vshCommandOptString(ctl, cmd, "interface", &ifacestr) < 0) return false; @@ -2299,28 +2300,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) goto cleanup; } - vshPrintExtra(ctl, " %-10s %-20s %-8s %s\n%s%s\n", _("Name"), - _("MAC address"), _("Protocol"), _("Address"), - _("-------------------------------------------------"), - _("------------------------------")); + table = vshTableNew(_("Name"), _("MAC address"), _("Protocol"), _("Address"), NULL); + if (!table) + return false; for (i = 0; i < ifaces_count; i++) { virDomainInterfacePtr iface = ifaces[i]; const char *type = NULL; + const char *hwaddr = "N/A"; if (ifacestr && STRNEQ(ifacestr, iface->name)) continue; + if (iface->hwaddr) + hwaddr = iface->hwaddr; + /* When the interface has no IP address */ if (!iface->naddrs) { - vshPrint(ctl, " %-10s %-17s %-12s %s\n", - iface->name, - iface->hwaddr ? iface->hwaddr : "N/A", "N/A", "N/A"); + if (vshTableRowAppend(table, + iface->name, hwaddr, "N/A", "N/A", NULL) < 0) + goto cleanup; continue; } for (j = 0; j < iface->naddrs; j++) { - g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_autofree char *ip_addr_str = NULL; switch (iface->addrs[j].type) { @@ -2332,26 +2335,30 @@ cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) break; } - virBufferAsprintf(&buf, "%-12s %s/%d", - type, iface->addrs[j].addr, - iface->addrs[j].prefix); - - ip_addr_str = virBufferContentAndReset(&buf); - - if (!ip_addr_str) - ip_addr_str = g_strdup(""); + ip_addr_str = g_strdup_printf("%s/%d", + iface->addrs[j].addr, + iface->addrs[j].prefix); /* Don't repeat interface name */ - if (full || !j) - vshPrint(ctl, " %-10s %-17s %s\n", - iface->name, - NULLSTR_EMPTY(iface->hwaddr), ip_addr_str); - else - vshPrint(ctl, " %-10s %-17s %s\n", - "-", "-", ip_addr_str); + if (full || !j) { + if (vshTableRowAppend(table, + iface->name, + NULLSTR_EMPTY(iface->hwaddr), + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } else { + if (vshTableRowAppend(table, + "-", "-", + NULLSTR_MINUS(type), ip_addr_str, NULL) < 0) { + goto cleanup; + } + } } } + vshTablePrintToStdout(table, ctl); + ret = true; cleanup: -- 2.52.0

1 0

[PATCH] hyperv: Avoid memleak in hypervDomainDefParsePhysicalDisk
by Michal Privoznik 06 Feb '26

06 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> When parsing a physical disk, the @hostResouce is escaped once with the retval being stored into @hostEscaped. Then, it's escaped again, but the retval is stored into the very same variable, leading to a leak where intermediate value is lost. 256 bytes in 1 blocks are definitely lost in loss record 469 of 483 at 0x49543A0: realloc (vg_replace_malloc.c:1804) by 0x516C251: g_realloc (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x518BB7E: g_string_expand (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x518BFF9: g_string_insert_len (in /usr/lib64/libglib-2.0.so.0.8400.4) by 0x4A58B5F: g_string_append_len_inline (gstring.h:247) by 0x4A58B5F: virBufferAdd (virbuffer.c:164) by 0x4AFDA71: virStringReplace (virstring.c:708) by 0x4DA4381: hypervDomainDefParsePhysicalDisk (hyperv_driver.c:1375) by 0x4DA4A18: hypervDomainDefParseStorage (hyperv_driver.c:1487) by 0x4DA9E31: hypervDomainGetXMLDesc (hyperv_driver.c:2761) by 0x4DFB3E5: virDomainGetXMLDesc (libvirt-domain.c:2898) by 0x406D39B: cmdDumpXML (virsh-domain.c:10787) by 0x40B13B1: vshCommandRun (vsh.c:1383) Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/hyperv/hyperv_driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index 8dd56f39dc..203bbeb8a5 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -1351,6 +1351,7 @@ hypervDomainDefParsePhysicalDisk(hypervPrivate *priv, virDomainDiskDef *disk = NULL; char **hostResource = entry->data->HostResource.data; g_autofree char *hostEscaped = NULL; + g_autofree char *hostEscapedTwice = NULL; g_autofree char *driveNumberStr = NULL; g_auto(virBuffer) query = VIR_BUFFER_INITIALIZER; int addr = -1, ctrlr_idx = -1; @@ -1373,12 +1374,12 @@ hypervDomainDefParsePhysicalDisk(hypervPrivate *priv, /* Query Msvm_DiskDrive for the DriveNumber */ hostEscaped = virStringReplace(*hostResource, "\\\"", "\""); - hostEscaped = virStringReplace(hostEscaped, "\\", "\\\\"); + hostEscapedTwice = virStringReplace(hostEscaped, "\\", "\\\\"); /* quotes must be preserved, so virBufferEscapeSQL can't be used */ virBufferAsprintf(&query, MSVM_DISKDRIVE_WQL_SELECT "WHERE __PATH='%s'", - hostEscaped); + hostEscapedTwice); if (hypervGetWmiClass(Msvm_DiskDrive, &diskdrive) < 0) goto cleanup; -- 2.52.0

2 1

[PATCH] virt-aa-helper: Fix unchecked return values
by Dmitry Lopatin 06 Feb '26

06 Feb '26

Add missing return value checks to fix the following issues reported by the static analyzer: - vah_add_file() call when adding render node path to the AppArmor profile (line 1029) was not checked, while there are examples with return code check throughout the code. - vah_add_file() call when adding default render node path (line 1037) had the same issue. - virDriverLoadModule() call when loading the storage driver (line 908) was not checked, while there are examples with return code check throughout the code. Signed-off-by: Dmitry Lopatin <dmitry.lopatin(a)flant.com> --- src/security/virt-aa-helper.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 067a17f331..07e5882237 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -905,7 +905,8 @@ get_files(vahControl * ctl) /* load the storage driver so that backing store can be accessed */ #ifdef WITH_STORAGE - virDriverLoadModule("storage", "storageRegister", false); + if (virDriverLoadModule("storage", "storageRegister", false) < 0) + goto cleanup; #endif for (i = 0; i < ctl->def->ndisks; i++) { @@ -1026,7 +1027,8 @@ get_files(vahControl * ctl) const char *rendernode = virDomainGraphicsGetRenderNode(graphics); if (rendernode) { - vah_add_file(&buf, rendernode, "rw"); + if (vah_add_file(&buf, rendernode, "rw") != 0) + goto cleanup; needsgl = true; } else { if (virDomainGraphicsNeedsAutoRenderNode(graphics)) { @@ -1034,7 +1036,8 @@ get_files(vahControl * ctl) needsgl = true; if (defaultRenderNode) { - vah_add_file(&buf, defaultRenderNode, "rw"); + if (vah_add_file(&buf, defaultRenderNode, "rw") != 0) + goto cleanup; VIR_FREE(defaultRenderNode); } } -- 2.34.1

5 9

[PATCH] src/esx/esx_vi.c: Debug path element comparisons
by Richard W.M. Jones 06 Feb '26

06 Feb '26

Libvirt vpx:// and esx:// URIs are quite obscure. In particular it is very difficult to construct a correct path to a VMware resource. Basically you are iterating over VMware structures blindly with no way to know what your choices are at each level in the path. This commit doesn't directly address this. It's still difficult. But at least let's add the true path choices to the debug output so someone could in theory use 'LIBVIRT_DEBUG=1' to find out what possible choices exist at a path level. For example this command fails because the label (which looks like an IPv6 address, but is really a label) should use "::" instead of ":0:": LIBVIRT_DEBUG=1 virsh -c 'vpx://root@.../data/aaaa:52:0:49e0:2eea:7fff:fee6:eca0/?no_verify=1' In the debugging output we now print: 2026-02-05 10:58:25.421+0000: 1528876: debug : esxVI_LookupManagedObjectHelper:4956 : comparing path element 'aaaa:52:0:49e0:2eea:7fff:fee6:eca0' with candidate name 'aaaa:52::49e0:2eea:7fff:fee6:eca0' 2026-02-05 10:58:25.421+0000: 1528876: error : esxVI_Context_LookupManagedObjectsByPath:1098 : internal error: Could not find compute resource specified in '/data/aaaa:52:0:49e0:2eea:7fff:fee6:eca0/' In an ideal world we should improve the error message to show the possible choices, but the way the code is structured makes that prohibitive. Related: https://issues.redhat.com/browse/RHEL-145080 --- src/esx/esx_vi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 8d2ffb3f8f..cfd783622d 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -4953,6 +4953,8 @@ esxVI_LookupManagedObjectHelper(esxVI_Context *ctx, goto cleanup; } + VIR_DEBUG("comparing path element '%s' with candidate name '%s'", + name, name_candidate); if (STREQ(name_candidate, name)) { /* Found item with matching name */ break; -- 2.52.0

2 2