Bug 1001123 - Disable or remove device ccid-card-emulated
Disable or remove device ccid-card-emulated
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Markus Armbruster
Virtualization Bugs
: Reopened
Depends On: 1001216
Blocks: 720747
  Show dependency treegraph
 
Reported: 2013-08-26 10:19 EDT by Markus Armbruster
Modified: 2014-06-17 23:34 EDT (History)
9 users (show)

See Also:
Fixed In Version: qemu-kvm-1.5.3-15.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 08:55:03 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Markus Armbruster 2013-08-26 10:19:23 EDT
Device ccid-card-emulated should be removed or made unavailable with -device / device_add, because we won't support it.

How reproducible:
Always

Steps to Reproduce:
1. qemu-kvm -nodefaults -display none -monitor stdio -S -usb -device usb-ccid -device ccid-card-emulated,backend=nss-emulated

Actual results:
-device ccid-card-emulated is accepted

Expected results:
-device ccid-card-emulated is rejected, just like -device nonexistant
Comment 2 Markus Armbruster 2013-08-26 10:23:13 EDT
"configure --disable-smartcard-nss" should do the trick.
Comment 3 Miroslav Rezanina 2013-08-27 09:06:26 EDT
(In reply to Markus Armbruster from comment #0)
> Device ccid-card-emulated should be removed or made unavailable with -device
> / device_add, because we won't support it.
> 
> How reproducible:
> Always
> 
> Steps to Reproduce:
> 1. qemu-kvm -nodefaults -display none -monitor stdio -S -usb -device
> usb-ccid -device ccid-card-emulated,backend=nss-emulated
> 
> Actual results:
> -device ccid-card-emulated is accepted
> 
> Expected results:
> -device ccid-card-emulated is rejected, just like -device nonexistant

Is this really true? Marc-André Lureau stated following (can't find mail link in archive, but it's from March 25,  RHEL 7 qemu-kvm configure):

"libcacard rely on NSS for loading certificates from PKCS11 modules and
other functions. Without NSS, there is no card emulation compiled in
atm. We need --enable-smartcard-nss."
Comment 4 Markus Armbruster 2013-08-27 09:47:49 EDT
Well, Alon told me we can --disable-smartcard-nss.  Suggest to post the obvious patch, cc: both.
Comment 5 Miroslav Rezanina 2013-08-30 04:06:58 EDT
Using --disable-smartcard-nss will disable libcacard build so option can't be used. This confirm Marc-Andre's statement that device is required for libcacard build.
Comment 6 Markus Armbruster 2013-09-10 02:47:59 EDT
The device needs to go one way or another.  Since "configure --disable-smartcard-nss" is not usable, we need to cut it some other way.
Comment 7 Paolo Bonzini 2013-09-18 09:43:10 EDT
It looks like we support exactly the same thing (and the same code) via SPICE:

https://blogs.gnome.org/halfline/2013/09/08/another-smartcard-post/

Do we really need to disable this?
Comment 8 Markus Armbruster 2013-09-18 10:28:29 EDT
Denying users the possibility to conjure up a purely virtual smartcard
device isn't the point of this bug.  Its point is to get rid of some
qemu-kvm code we don't want to test and support.  If users can get the
functionality even without said code (as the post you quoted seems to
suggest), then that's another argument for removing the code.
Comment 9 Paolo Bonzini 2013-09-20 09:53:53 EDT
That actually makes sense, I must admit.
Comment 10 Miroslav Rezanina 2013-11-07 03:23:05 EST
Fix included in qemu-kvm-1.5.3-15.el7
Comment 12 Chao Yang 2013-12-24 03:02:05 EST
Reproduced on qemu-kvm-1.5.3-14.el7.x86_64.

Steps:

1. launch a guest with "-chardev spicevmc,name=smartcard,id=ccid -device usb-ccid -device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3 " through:

2. shutdown guest
3. re-launch without "-device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3 " in cli

4. hot plug ccid-card-emulated

Actual Result:

a. With qemu-kvm-1.5.3-14.el7.x86_64, there was ccid-card-emuated option from output of /usr/libexec/qemu-kvm -device ?

b. guest could be launched after step 1

c. ccid-card-emulated could be hot plugged: 
{"execute":"device_add","arguments":{"driver":"ccid-card-emulated","backend":"certificates","cert1":"cert1","cert2":"cert2","cert3":"cert3"}}
{"return": {}}

------------------------------
Verified with qemu-kvm-1.5.3-30.el7.x86_64.rpm.

a. ccid-card-emuated option has been removed from output of /usr/libexec/qemu-kvm -device ?

b. after step 1, qemu-kvm quit on:
(qemu) device_add ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3
Parameter 'driver' expects device type

c. after step 4, it complains: 
{"execute":"device_add","arguments":{"driver":"ccid-card-emulated","backend":"certificates","cert1":"cert1","cert2":"cert2","cert3":"cert3"}}
{"error": {"class": "GenericError", "desc": "Parameter 'driver' expects device type"}}



As per above, this issue has been fixed.
Comment 14 Ludek Smid 2014-06-13 08:55:03 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.