Bug 1876635

Summary: VM fails to start with a passthrough smartcard
Product: Red Hat Enterprise Linux Advanced Virtualization Reporter: Milan Zamazal <mzamazal>
Component: qemu-kvmAssignee: Danilo de Paula <ddepaula>
qemu-kvm sub component: General QA Contact: yduan
Status: CLOSED ERRATA Docs Contact:
Severity: unspecified    
Priority: high CC: ahadas, coli, ddepaula, ehadley, elima, fjin, jdenemar, mrezanin, virt-maint, yafu, yalzhang, yduan
Version: 8.3Keywords: Regression, Triaged
Target Milestone: rc   
Target Release: 8.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: qemu-kvm-5.1.0-11.module+el8.3.0+8333+986f16ff Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-17 17:51:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1884994    
Attachments:
Description Flags
domain XML none

Description Milan Zamazal 2020-09-07 18:32:18 UTC
Created attachment 1713995 [details]
domain XML

Description of problem:

When I try to start a VM with a passthrough smartcard:

  <smartcard mode="passthrough" type="spicevmc">
    <alias name="ua-ab2f5a34-e893-430d-a4e1-02a8ae5463fe" />
  </smartcard>

libvirt refuses to start the VM with the message:

  unsupported configuration: this QEMU binary lacks smartcard passthrough mode support

Version-Release number of selected component (if applicable):

libvirt-daemon-6.6.0-4.module+el8.3.0+7883+3d717aa8.x86_64
qemu-kvm-5.1.0-4.module+el8.3.0+7846+ae9b566f.x86_64
kernel-4.18.0-234.el8.x86_64
spice-server-0.14.3-3.el8.x86_64

How reproducible:

100%

Steps to Reproduce:
1. Try to start a VM with a passthrough smartcard.

Actual results:

The VM fails to start.

Expected results:

The VM starts and the smartcard is available.

Additional info:

It works with AV 8.2.

I don't know whether the bug is in libvirt, QEMU or elsewhere. Please reassign to the right product if needed.

Attaching the complete domain XML.

Comment 1 Jiri Denemark 2020-09-10 09:40:01 UTC
I checked with Mirek who was handling the rebases of QEMU for RHEL-AV 8.3.0 to
QEMU 5.1.0 and the smartcard support is supposed to be enabled. It seems the
feature detection in libvirt is not working for some reason, even though it
works just fine upstream.

Comment 2 Fangge Jin 2020-09-14 03:12:03 UTC
I met this issue before, please install package libcacard and try again.
Note:
After installing package libcacard, pls remember to rm /var/cache/libvirt/qemu/capabilities/*.xml and restart libvirtd.

It is an issue in downstream qemu spec file as my colleague hhan pointed out:
1. # ldd /usr/libexec/qemu-kvm                                    
        linux-vdso.so.1 (0x00007ffc7e36d000)                          
        libseccomp.so.2 => /lib64/libseccomp.so.2 (0x00007fc4216bf000)
        libgio-2.0.so.0 => /lib64/libgio-2.0.so.0 (0x00007fc421316000)
        libgobject-2.0.so.0 => /lib64/libgobject-2.0.so.0 (0x00007fc4210c3000)
        libglib-2.0.so.0 => /lib64/libglib-2.0.so.0 (0x00007fc420daa000)
        libvirglrenderer.so.1 => /lib64/libvirglrenderer.so.1 (0x00007fc420b2f000)
        libusb-1.0.so.0 => /lib64/libusb-1.0.so.0 (0x00007fc420914000)
        librdmacm.so.1 => /lib64/librdmacm.so.1 (0x00007fc4206fa000)                                                                            
        libibverbs.so.1 => /lib64/libibverbs.so.1 (0x00007fc4204de000)  
        libibumad.so.3 => /lib64/libibumad.so.3 (0x00007fc4202d4000)
        libepoxy.so.0 => /lib64/libepoxy.so.0 (0x00007fc41ffa4000)  
        libgbm.so.1 => /lib64/libgbm.so.1 (0x00007fc41fd93000)
        libaio.so.1 => /lib64/libaio.so.1 (0x00007fc41fb90000)
        libpixman-1.so.0 => /lib64/libpixman-1.so.0 (0x00007fc41f8e8000)
        libutil.so.1 => /lib64/libutil.so.1 (0x00007fc41f6e4000)
        libnuma.so.1 => /lib64/libnuma.so.1 (0x00007fc41f4d8000)
        libpng16.so.16 => /lib64/libpng16.so.16 (0x00007fc41f2a3000)
        libz.so.1 => /lib64/libz.so.1 (0x00007fc41f08c000)
        libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007fc41ee6e000)

2. Get the keyword of these libraries, and match the requirement of the libraries:
For example libpng:
~ grep '^Requires.*png' ~/rpmbuild/SPECS/qemu-kvm.spec

So libpng dependency is missing. So if libpng is not installed and the code of qemu-kvm reaches
the symbols of libpng, it will cause the error like "cannot open shared object file: No such file or directory"

Comment 3 Milan Zamazal 2020-09-24 11:03:27 UTC
(In reply to Fangge Jin from comment #2)
> I met this issue before, please install package libcacard and try again.
> Note:
> After installing package libcacard, pls remember to rm
> /var/cache/libvirt/qemu/capabilities/*.xml and restart libvirtd.

Thank you, it works. So should libcacard be added to qemu-kvm dependencies? Which team should take care of this bug?

Comment 4 Fangge Jin 2020-09-24 12:19:51 UTC
(In reply to Milan Zamazal from comment #3)
> (In reply to Fangge Jin from comment #2)
> > I met this issue before, please install package libcacard and try again.
> > Note:
> > After installing package libcacard, pls remember to rm
> > /var/cache/libvirt/qemu/capabilities/*.xml and restart libvirtd.
> 
> Thank you, it works. So should libcacard be added to qemu-kvm dependencies?
> Which team should take care of this bug?

Yes, libcacard should be a dependency of qemu-kvm, I just asked qemu-kvm qe to see whether there is existing bugzilla against qemu-kvm component for this issue.

Comment 5 yduan 2020-09-25 06:42:56 UTC
Seems qemu loses the libcacard dependency.

qemu-kvm-5.1.0-9.module+el8.3.0+8182+ac9ced32.x86_64
# ldd /usr/libexec/qemu-kvm | grep card
no output here
# grep "Requires.*card" qemu-kvm.spec 
BuildRequires: libcacard-devel

Comment 6 Danilo de Paula 2020-09-29 16:39:49 UTC
It's not just adding "Requires: libcacard" - requires a deeper investigation.

Not digging too much: qemu-kvm always got the libcacard dependency automatically at rpm level.
Looks like it's not getting it anymore.

Seems like there's a new SO file 'hw-usb-smartcard.so' in the package, which wasn't present in AV-8.2.
but the spec building system should be able to infer the dependency from there, and that's not working. 

For what's worth: Two dependencies disappeared from AV-8.3 (when comparing to AV-8.2). rpmdiff complained about it:
https://rpmdiff.engineering.redhat.com/run/461889/14/

libusbredirparser.so.1 and libcacard.so.0. Both options seems to be present in the configure line of the package.
So, as the work to be done on this BZ, we need to investigate why the system is not able to infer the dependency automatically.

Comment 7 Danilo de Paula 2020-09-29 16:58:21 UTC
For the record:
/usr/lib64/qemu-kvm/ contains some qemu SO files:
But some of them, like hw-display-qxl.so, hw-usb-redirect.so and hw-usb-smartcard.so don't have the execution bit set.

And, looks like the automatic rpm dependency solver can't infer dependency of .so files if the execution bit is not set.

Bug identified, just needs a patch...

Comment 8 Danilo de Paula 2020-09-29 17:09:22 UTC
QA_ACK, please?

Comment 13 Danilo de Paula 2020-10-02 14:36:33 UTC
QA_ACK, please?

Comment 23 Danilo de Paula 2020-10-13 15:49:35 UTC
Most important thing here is to make shure that the original usecase "start a VM with a passthrough smartcard" works.

Comment 27 errata-xmlrpc 2020-11-17 17:51:44 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (virt:8.3 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:5137