Bug 1001123

"configure --disable-smartcard-nss" should do the trick.

(In reply to Markus Armbruster from comment #0)
> Device ccid-card-emulated should be removed or made unavailable with -device
> / device_add, because we won't support it.
> 
> How reproducible:
> Always
> 
> Steps to Reproduce:
> 1. qemu-kvm -nodefaults -display none -monitor stdio -S -usb -device
> usb-ccid -device ccid-card-emulated,backend=nss-emulated
> 
> Actual results:
> -device ccid-card-emulated is accepted
> 
> Expected results:
> -device ccid-card-emulated is rejected, just like -device nonexistant

Is this really true? Marc-André Lureau stated following (can't find mail link in archive, but it's from March 25,  RHEL 7 qemu-kvm configure):

"libcacard rely on NSS for loading certificates from PKCS11 modules and
other functions. Without NSS, there is no card emulation compiled in
atm. We need --enable-smartcard-nss."

Well, Alon told me we can --disable-smartcard-nss.  Suggest to post the obvious patch, cc: both.

Using --disable-smartcard-nss will disable libcacard build so option can't be used. This confirm Marc-Andre's statement that device is required for libcacard build.

The device needs to go one way or another.  Since "configure --disable-smartcard-nss" is not usable, we need to cut it some other way.

It looks like we support exactly the same thing (and the same code) via SPICE:

https://blogs.gnome.org/halfline/2013/09/08/another-smartcard-post/

Do we really need to disable this?

Denying users the possibility to conjure up a purely virtual smartcard
device isn't the point of this bug.  Its point is to get rid of some
qemu-kvm code we don't want to test and support.  If users can get the
functionality even without said code (as the post you quoted seems to
suggest), then that's another argument for removing the code.

That actually makes sense, I must admit.

Fix included in qemu-kvm-1.5.3-15.el7

Reproduced on qemu-kvm-1.5.3-14.el7.x86_64.

Steps:

1. launch a guest with "-chardev spicevmc,name=smartcard,id=ccid -device usb-ccid -device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3 " through:

2. shutdown guest
3. re-launch without "-device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3 " in cli

4. hot plug ccid-card-emulated

Actual Result:

a. With qemu-kvm-1.5.3-14.el7.x86_64, there was ccid-card-emuated option from output of /usr/libexec/qemu-kvm -device ?

b. guest could be launched after step 1

c. ccid-card-emulated could be hot plugged: 
{"execute":"device_add","arguments":{"driver":"ccid-card-emulated","backend":"certificates","cert1":"cert1","cert2":"cert2","cert3":"cert3"}}
{"return": {}}

------------------------------
Verified with qemu-kvm-1.5.3-30.el7.x86_64.rpm.

a. ccid-card-emuated option has been removed from output of /usr/libexec/qemu-kvm -device ?

b. after step 1, qemu-kvm quit on:
(qemu) device_add ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3
Parameter 'driver' expects device type

c. after step 4, it complains: 
{"execute":"device_add","arguments":{"driver":"ccid-card-emulated","backend":"certificates","cert1":"cert1","cert2":"cert2","cert3":"cert3"}}
{"error": {"class": "GenericError", "desc": "Parameter 'driver' expects device type"}}



As per above, this issue has been fixed.

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.