Bug 954263 - ccid-card-emulated doesn't have a 'database' property, it's called 'db'
ccid-card-emulated doesn't have a 'database' property, it's called 'db'
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libvirt (Show other bugs)
7.0
x86_64 Linux
unspecified Severity unspecified
: rc
: ---
Assigned To: Eric Blake
Virtualization Bugs
:
Depends On: 904692
Blocks:
  Show dependency treegraph
 
Reported: 2013-04-22 02:27 EDT by Geyang Kong
Modified: 2014-06-17 20:48 EDT (History)
24 users (show)

See Also:
Fixed In Version: libvirt-1.0.5-1.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 904692
Environment:
Last Closed: 2014-06-13 08:29:39 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Geyang Kong 2013-04-22 02:27:32 EDT
+++ This bug was initially created as a clone of Bug #904692 +++

When defining a VM with an emulated smartcard as specified at http://libvirt.org/formatdomain.html#elementsSmartcard, the VM won't start and issues the following error:

2013-01-27 03:38:19.224+0000: starting up
LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin QEMU_AUDIO_DRV=spice /usr/bin/qemu-kvm -name build2 -S -M pc-1.2 -enable-kvm -m 1024 -smp 2,sockets=2,cores=1,threads=1 -uuid 23979824-dcd9-5a8d-61a7-5f5bc625aedd -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/build2.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x4 -device usb-ccid,id=ccid0 -drive file=/var/lib/libvirt/images/build2.img,if=none,id=drive-virtio-disk0,format=raw -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -drive if=none,id=drive-ide0-1-0,readonly=on,format=raw -device ide-cd,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -netdev tap,fd=37,id=hostnet0,vhost=on,vhostfd=38 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:39:28:d9,bus=pci.0,addr=0x3 -device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3,database=/etc/pki/libvirt-smartcard,id=smartcard0,bus=ccid0.0 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -device usb-tablet,id=input0 -spice port=5904,tls-port=5905,addr=0.0.0.0,x509-dir=/etc/pki/libvirt-spice -vga qxl -global qxl-vga.vram_size=67108864 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6
char device redirected to /dev/pts/6
qemu-kvm: -device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3,database=/etc/pki/libvirt-smartcard,id=smartcard0,bus=ccid0.0: Property '.database' not found
2013-01-27 03:38:19.871+0000: shutting down

Using:
qemu-kvm-1.2.2-4.fc18.x86_64
libvirt-0.10.2.2-3.fc18.x86_64
virt-manager-0.9.4-4.fc18.noarch
kernel3.7.4-204.fc18.x86_64

In http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=blob;f=hw/ccid-card-emulated.c;h=f4a6da4283a3a27eaff154be7ad6ca75dee900d5;hb=HEAD#l25 (for roughly the version I'm using) it states that the parameter "db" should be used.

I'm not sure whether this is the issue, but db != database.  http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=blob;f=hw/ccid-card-emulated.c;h=f4a6da4283a3a27eaff154be7ad6ca75dee900d5;hb=HEAD#l118

Any help would be appreciated.  Thanks.

--- Additional comment from Anthony Messina on 2013-01-26 23:31:55 EST ---

*** Bug 904693 has been marked as a duplicate of this bug. ***

--- Additional comment from Cole Robinson on 2013-04-01 18:48:58 EDT ---

Thanks for the report Anthony, indeed it looks like libvirt is passing the wrong property here, it should be named db. Reassigning

--- Additional comment from Eric Blake on 2013-04-01 18:58:10 EDT ---

You're probably one of the first people actively using this feature, since the bug has been there since it's introduction in v0.8.8 (Feb 2011).

Upstream patch proposal:
https://www.redhat.com/archives/libvir-list/2013-April/msg00056.html

If that is accepted, I can backport to v0.10.2-maint for inclusion in the next F18 build.

--- Additional comment from Anthony Messina on 2013-04-01 19:45:01 EDT ---

(In reply to comment #3)
> You're probably one of the first people actively using this feature, since
> the bug has been there since it's introduction in v0.8.8 (Feb 2011).

Hah!  And I was probably trying to use it incorrectly as well.  I was hoping to use the "fake" smartcard as a storage utility for kernel module signing keys to be used in a manner similar to pesign, but for external kernel modules to be signed from within a koji/mock buildroot on a VM.
Comment 2 Eric Blake 2013-04-22 10:44:53 EDT
Next rebase will pick up this commit:
commit 6f7e4ea359323f9bc413dfb738a5c544d4f9c4f8
Author: Eric Blake <eblake@redhat.com>
Date:   Mon Apr 1 16:54:31 2013 -0600

    smartcard: spell ccid-card-emulated qemu property correctly
    
    Reported by Anthony Messina in
    https://bugzilla.redhat.com/show_bug.cgi?id=904692
    Present since introduction of smartcard support in commit f5fd9baa
    
    * src/qemu/qemu_command.c (qemuBuildCommandLine): Match qemu spelling.
    * tests/qemuxml2argvdata/qemuxml2argv-smartcard-host-certificates.args:
    Fix broken test.
Comment 3 Geyang Kong 2013-05-06 04:49:43 EDT
This bug could be reproduced on following build:
libvirt-1.0.2-1.el7

Verified PASS on the following build:
libvirt-1.0.5-1.el7.x86_64

Steps:
1. Prepare a rhel6.4 guest, make sure install "smart card support" group.
2. Run certutil -N -d /etc/pki/nssdb/ and just keep typing enter until finish
3. certutil -d /etc/pki/nssdb -x -t CT,CT,CT -S -s CN=cert1 -n cert1
4. certutil -d /etc/pki/nssdb -x -t CT,CT,CT -S -s CN=cert2 -n cert2
5. certutil -d /etc/pki/nssdb -x -t CT,CT,CT -S -s CN=cert3 -n cert3
6. virsh edit $guest
7. Paste following content, between <devices></devices>
    <smartcard mode='host-certificates'>
      <certificate>cert1</certificate>
      <certificate>cert2</certificate>
      <certificate>cert3</certificate>
      <database>/etc/pki/nssdb/</database>
    </smartcard>
8. virsh start $guest.
9. virsh dumpxml $guest
10. In guest, run command #esc

Actual result:
1. After step 8, guest could be started.
2. After step 9, got following output:
   <devices>
    .....
    <smartcard mode='host-certificates'>
      <certificate>cert1</certificate>
      <certificate>cert2</certificate>
      <certificate>cert3</certificate>
      <database>/etc/pki/nssdb/</database>
      <address type='ccid' controller='0' slot='0'/>
    </smartcard>
    .....
   </devices>
3. After step 10, got smart card manager form, and have an enrolled smart card issued to cert1 was shown.

So mark this bug as VERIFIED
Comment 5 CongDong 2014-02-17 00:51:31 EST
1. 
host-certificates is not supported by qemu-kvm on rhel7, only passthrough is supported now.
#/user/libexec/qemu-kvm -device ?
Controller/Bridge/Hub devices:
name "i82801b11-bridge", bus PCI
name "ioh3420", bus PCI, desc "Intel IOH device id 3420 PCIE Root Port"
name "pci-bridge", bus PCI, desc "Standard PCI Bridge"
name "usb-host", bus usb-bus
name "usb-hub", bus usb-bus
name "x3130-upstream", bus PCI, desc "TI X3130 Upstream Port of PCI Express Switch"
name "xio3130-downstream", bus PCI, desc "TI X3130 Downstream Port of PCI Express Switch"

USB devices:
name "ich9-usb-ehci1", bus PCI
name "ich9-usb-ehci2", bus PCI
name "ich9-usb-uhci1", bus PCI
name "ich9-usb-uhci2", bus PCI
name "ich9-usb-uhci3", bus PCI
name "ich9-usb-uhci4", bus PCI
name "ich9-usb-uhci5", bus PCI
name "ich9-usb-uhci6", bus PCI
name "nec-usb-xhci", bus PCI
name "piix3-usb-uhci", bus PCI
name "piix4-usb-uhci", bus PCI
name "usb-ehci", bus PCI
name "vt82c686b-usb-uhci", bus PCI

Storage devices:
name "ich9-ahci", bus PCI, alias "ahci"
name "ide-cd", bus IDE, desc "virtual IDE CD-ROM"
name "ide-drive", bus IDE, desc "virtual IDE disk or CD-ROM (legacy)"
name "ide-hd", bus IDE, desc "virtual IDE disk"
name "scsi-block", bus SCSI, desc "SCSI block device passthrough"
name "scsi-cd", bus SCSI, desc "virtual SCSI CD-ROM"
name "scsi-disk", bus SCSI, desc "virtual SCSI disk or CD-ROM (legacy)"
name "scsi-generic", bus SCSI, desc "pass through generic scsi device (/dev/sg*)"
name "scsi-hd", bus SCSI, desc "virtual SCSI disk"
name "usb-bot", bus usb-bus
name "usb-storage", bus usb-bus
name "virtio-blk-device", bus virtio-bus
name "virtio-blk-pci", bus PCI, alias "virtio-blk"
name "virtio-scsi-device", bus virtio-bus
name "virtio-scsi-pci", bus PCI

Network devices:
name "e1000", bus PCI, desc "Intel Gigabit Ethernet"
name "rtl8139", bus PCI
name "virtio-net-device", bus virtio-bus
name "virtio-net-pci", bus PCI, alias "virtio-net"

Input devices:
name "ccid-card-passthru", bus ccid-bus, desc "passthrough smartcard"
name "isa-serial", bus ISA
name "pci-serial", bus PCI
name "usb-ccid", bus usb-bus, desc "CCID Rev 1.1 smartcard reader"
name "usb-kbd", bus usb-bus
name "usb-mouse", bus usb-bus
name "virtconsole", bus virtio-serial-bus
name "virtio-serial-device", bus virtio-bus
name "virtio-serial-pci", bus PCI, alias "virtio-serial"
name "virtserialport", bus virtio-serial-bus

Display devices:
name "cirrus-vga", bus PCI, desc "Cirrus CLGD 54xx VGA"
name "qxl", bus PCI, desc "Spice QXL GPU (secondary)"
name "qxl-vga", bus PCI, desc "Spice QXL GPU (primary, vga compatible)"
name "sga", bus ISA, desc "Serial Graphics Adapter"
name "VGA", bus PCI

Sound devices:
name "AC97", bus PCI, desc "Intel 82801AA AC97 Audio"
name "hda-duplex", bus HDA, desc "HDA Audio Codec, duplex (line-out, line-in)"
name "hda-micro", bus HDA, desc "HDA Audio Codec, duplex (speaker, microphone)"
name "hda-output", bus HDA, desc "HDA Audio Codec, output-only (line-out)"
name "ich9-intel-hda", bus PCI, desc "Intel HD Audio Controller (ich9)"
name "intel-hda", bus PCI, desc "Intel HD Audio Controller (ich6)"

Misc devices:
name "i6300esb", bus PCI
name "ib700", bus ISA
name "isa-debug-exit", bus ISA
name "isa-debugcon", bus ISA
name "kvm-pci-assign", bus PCI, alias "pci-assign", desc "KVM-based PCI passthrough"
name "pc-testdev", bus ISA
name "pci-testdev", bus PCI, desc "PCI Test Device"
name "usb-redir", bus usb-bus
name "usb-tablet", bus usb-bus
name "vfio-pci", bus PCI, desc "VFIO-based PCI device assignment"
name "virtio-balloon-device", bus virtio-bus
name "virtio-balloon-pci", bus PCI, alias "virtio-balloon"
name "virtio-rng-device", bus virtio-bus
name "virtio-rng-pci", bus PCI

Uncategorized devices:
name "pvpanic", bus ISA
[root@mig2 ~]# /usr/libexec/qemu-kvm -device ?
[root@mig2 ~]# /usr/libexec/qemu-kvm -device ?
Controller/Bridge/Hub devices:
name "i82801b11-bridge", bus PCI
name "ioh3420", bus PCI, desc "Intel IOH device id 3420 PCIE Root Port"
name "pci-bridge", bus PCI, desc "Standard PCI Bridge"
name "usb-host", bus usb-bus
name "usb-hub", bus usb-bus
name "x3130-upstream", bus PCI, desc "TI X3130 Upstream Port of PCI Express Switch"
name "xio3130-downstream", bus PCI, desc "TI X3130 Downstream Port of PCI Express Switch"

USB devices:
name "ich9-usb-ehci1", bus PCI
name "ich9-usb-ehci2", bus PCI
name "ich9-usb-uhci1", bus PCI
name "ich9-usb-uhci2", bus PCI
name "ich9-usb-uhci3", bus PCI
name "ich9-usb-uhci4", bus PCI
name "ich9-usb-uhci5", bus PCI
name "ich9-usb-uhci6", bus PCI
name "nec-usb-xhci", bus PCI
name "piix3-usb-uhci", bus PCI
name "piix4-usb-uhci", bus PCI
name "usb-ehci", bus PCI
name "vt82c686b-usb-uhci", bus PCI

Storage devices:
name "ich9-ahci", bus PCI, alias "ahci"
name "ide-cd", bus IDE, desc "virtual IDE CD-ROM"
name "ide-drive", bus IDE, desc "virtual IDE disk or CD-ROM (legacy)"
name "ide-hd", bus IDE, desc "virtual IDE disk"
name "scsi-block", bus SCSI, desc "SCSI block device passthrough"
name "scsi-cd", bus SCSI, desc "virtual SCSI CD-ROM"
name "scsi-disk", bus SCSI, desc "virtual SCSI disk or CD-ROM (legacy)"
name "scsi-generic", bus SCSI, desc "pass through generic scsi device (/dev/sg*)"
name "scsi-hd", bus SCSI, desc "virtual SCSI disk"
name "usb-bot", bus usb-bus
name "usb-storage", bus usb-bus
name "virtio-blk-device", bus virtio-bus
name "virtio-blk-pci", bus PCI, alias "virtio-blk"
name "virtio-scsi-device", bus virtio-bus
name "virtio-scsi-pci", bus PCI

Network devices:
name "e1000", bus PCI, desc "Intel Gigabit Ethernet"
name "rtl8139", bus PCI
name "virtio-net-device", bus virtio-bus
name "virtio-net-pci", bus PCI, alias "virtio-net"

Input devices:
name "ccid-card-passthru", bus ccid-bus, desc "passthrough smartcard"
name "isa-serial", bus ISA
name "pci-serial", bus PCI
name "usb-ccid", bus usb-bus, desc "CCID Rev 1.1 smartcard reader"
name "usb-kbd", bus usb-bus
name "usb-mouse", bus usb-bus
name "virtconsole", bus virtio-serial-bus
name "virtio-serial-device", bus virtio-bus
name "virtio-serial-pci", bus PCI, alias "virtio-serial"
name "virtserialport", bus virtio-serial-bus

Display devices:
name "cirrus-vga", bus PCI, desc "Cirrus CLGD 54xx VGA"
name "qxl", bus PCI, desc "Spice QXL GPU (secondary)"
name "qxl-vga", bus PCI, desc "Spice QXL GPU (primary, vga compatible)"
name "sga", bus ISA, desc "Serial Graphics Adapter"
name "VGA", bus PCI

Sound devices:
name "AC97", bus PCI, desc "Intel 82801AA AC97 Audio"
name "hda-duplex", bus HDA, desc "HDA Audio Codec, duplex (line-out, line-in)"
name "hda-micro", bus HDA, desc "HDA Audio Codec, duplex (speaker, microphone)"
name "hda-output", bus HDA, desc "HDA Audio Codec, output-only (line-out)"
name "ich9-intel-hda", bus PCI, desc "Intel HD Audio Controller (ich9)"
name "intel-hda", bus PCI, desc "Intel HD Audio Controller (ich6)"

Misc devices:
name "i6300esb", bus PCI
name "ib700", bus ISA
name "isa-debug-exit", bus ISA
name "isa-debugcon", bus ISA
name "kvm-pci-assign", bus PCI, alias "pci-assign", desc "KVM-based PCI passthrough"
name "pc-testdev", bus ISA
name "pci-testdev", bus PCI, desc "PCI Test Device"
name "usb-redir", bus usb-bus
name "usb-tablet", bus usb-bus
name "vfio-pci", bus PCI, desc "VFIO-based PCI device assignment"
name "virtio-balloon-device", bus virtio-bus
name "virtio-balloon-pci", bus PCI, alias "virtio-balloon"
name "virtio-rng-device", bus virtio-bus
name "virtio-rng-pci", bus PCI

Uncategorized devices:
name "pvpanic", bus ISA

device "ccid--card-emulated" is not in the list

2. 
So cannot start a guest which is configured as comment3, will get error:
error: Failed to start domain rhel6
error: internal error: early end of file from monitor: possible problem:
qemu-kvm: -device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3,db=/etc/pki/nssdb/,id=smartcard0,bus=ccid0.0: Parameter 'driver' expects pluggable device type

But use a smartcard with passthrough, the guest will work well.
#lsusb
Bus 002 Device 004: ID 04e6:e001 SCM Microsystems, Inc. SCR331 SmartCard Reader
plug in a usb smartcard device to host.
#lsusb
Bus 002 Device 004: ID 04e6:e001 SCM Microsystems, Inc. SCR331 SmartCard Reader
pass throught it to the guest
# virsh dumpxml rhel6
...
    <smartcard mode='passthrough' type='spicevmc'>
      <alias name='smartcard0'/>
      <address type='ccid' controller='0' slot='0'/>
    </smartcard>
...
    <hostdev mode='subsystem' type='usb' managed='yes'>
      <source>
        <vendor id='0x04e6'/>
        <product id='0xe001'/>
        <address bus='2' device='4'/>
      </source>
      <alias name='hostdev0'/>
    </hostdev>
...
# virsh start rhel6
When login guest, open smartcard manager, an enrolled smart card of the smartcard device is shown.
Comment 6 Ludek Smid 2014-06-13 08:29:39 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.