Ludovic Rousseau's blog (Posts about ccid)

Security issues reported by an AI tool in CCID driver

Ludovic Rousseau — Sat, 29 Aug 2026 13:39:21 GMT

version 1.8.3 of the CCID driver (New version of libccid: 1.8.3) addresses 6 security issues identified by an AI tool.

Very low impact

The reported issues are either not exploitable because the input and output buffers used by PC/SC Lite to call the CCID driver are large enough, or the exploitation requires rogue smart card or smart card reader (i.e. sending non-compliant data).

If you would like to read the details, the issues have been fixed in the following git commits:

Comments

The AI tool identified real issues.

However, it would be difficult to exploit these issues unless the attacker used a custom-built reader or smart card. This is something I started doing with the Pico HSM project, which is a CCID reader in a Raspberry Pi Pico. This allows you to modify the CCID frames sent by the reader as required.

The bug reports from the AI tool are very verbose. This is useful for impressing a manager with a long, complex-looking text. However, reading the entire report is often a waste of my time. It is often much faster to read the proposed patch to understand the problem it is trying to fix.

The proposed fixes are, sometimes, incorrect. They are a good starting point, though. However, never apply an AI-generated patch without fully understanding it.

Conclusion

Thanks to Red Hat and Jakub Jelen for the bug reports.

I am very happy that the AI tool only identified issues with no or low impact.

New version of libccid: 1.8.3

Ludovic Rousseau — Sat, 29 Aug 2026 13:32:34 GMT

I have just released version 1.8.3 of libccid the Free Software CCID class smart card reader driver.

Red Hat reported 6 security issues found by an AI tool. See Security issues reported by an AI tool in CCID driver.

Changes:

1.8.3 - 29 August 2026, Ludovic Rousseau

Add support of
- Broadcom Corp 58200 0x5884
- Broadcom Corp 58200 0x5885
- Broadcom Corp 58200 0x5886
- Broadcom Corp 58200 0x5887
- Circle CIR135 ICC
- DigiFlow LLP. KAZTOKEN
- HID Global Crescendo NFC Reader
- HID Global OMNIKEY Plug
- HID Global OMNIKEY SE Plug
- Neowave LinkeoC-PRO
- Swissbit iShield Key 2 Pro
macOS: provide a sample script to build the driver with meson
fix some minor issues found by an AI tool
Some other minor improvements

Some web statistics about ccid.apdu.fr

Ludovic Rousseau — Mon, 17 Aug 2026 12:16:21 GMT

Now that I have moved my blog from Blogspot to my own server (see Blog moved to https://blog.apdu.fr/) I am now able to analyse the web server logs for https://ccid.apdu.fr/.

I used the logs from June 2026.

The server received a total of 269,860 requests. This equates to 8,995 requests per day, or 6.2 requests per minute. This is a very small website.

All requests

I used the user_agents Python module to extract the system family.

Surprisingly Windows comes first with 28%, even though the website is for a Unix smart card reader driver. There is nothing for Windows users on https://ccid.apdu.fr/.

Second is 'Other' (22%). They are bots. More on that later.

Third is the expected Linux (with only 21%), which is the core target audience.

OS	#	%
Windows	76444	28.33%
Other	60525	22.43%
Linux	57642	21.36%
Mac OS X	28497	10.56%
Android	27549	10.21%
Chrome OS	6973	2.58%
Ubuntu	6092	2.26%
iOS	3852	1.43%
Unknown	2143	0.79%
Debian	42	0.02%
OpenBSD	30	0.01%
NetBSD	26	0.01%
FreeBSD	8	0.00%
Symbian OS	7	0.00%
CentOS	7	0.00%
Windows Phone	3	0.00%
Fedora	3	0.00%
Solaris	2	0.00%
Slackware	2	0.00%
Kubuntu	2	0.00%
Kindle	2	0.00%
BlackBerry OS	2	0.00%
webOS	1	0.00%
openSUSE	1	0.00%
Symbian^3	1	0.00%
Roku	1	0.00%
Maemo	1	0.00%
BSD	1	0.00%
BREW	1	0.00%

Bots

22% of the requests fall into the 'Other' category. These are bots, and not human users.

The first bot is related to Rivian. If I am correct, Rivian is an electric car manufacturer. I don't know why they need to contact my website 15 times an hour.

Wget, cURL, Amazonebot, Meta and ChatGPT are more expected.

OS	#	%
rivian-firmware-build/1.0 (https://gitlab.rivianvw.io/core/firmware)	10984	18.15%
Wget/1.25.0	8555	14.13%
curl/8.18.0	4704	7.77%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36	4610	7.62%
meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)	3967	6.55%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot	2394	3.96%
Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)	1957	3.23%
TLM-Audit-Scanner/1.0	1908	3.15%
Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)	1416	2.34%
Baiduspider-image+(+http://www.baidu.com/search/spider.htm)	1298	2.14%
Go-http-client/1.1	1068	1.76%
Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)	1028	1.70%
amazon-Quick-on-behalf-of-03b1f1a7	831	1.37%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)	821	1.36%
Mozilla/5.0 (compatible; AwarioBot/1.0; +https://awario.com/bots.html)	761	1.26%
Mozilla/5.0 (X11; compatible; semantic-visions.com crawler; HTTPClient 4.5)	754	1.25%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; SleepBot/1.0; +http://sleepbot.com/) Chrome/131.0.0.0 Safari/537.36	752	1.24%
amazon-Quick-on-behalf-of-24c5991b	699	1.15%
Mozilla/5.0 (compatible; IbouBot/1.0; +bot@ibou.io; +https://ibou.io/iboubot.html)	591	0.98%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36	563	0.93%
Mozilla/5.0 (compatible; crawler)	553	0.91%
Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)	551	0.91%
Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)	533	0.88%
Googlebot-Image/1.0	532	0.88%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GoogleOther) Chrome/148.0.7778.96 Safari/537.36	522	0.86%
Python-urllib/3.10	510	0.84%
Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)	454	0.75%
Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)	444	0.73%
Mozilla/5.0 (compatible; SeekportBot; +https://bot.seekport.com)	428	0.71%
Mozilla/5.0 AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/605.1.15	376	0.62%
Mozilla/5.0...	339	0.56%
Mozilla/5.0 (compatible; Qwantbot/1.0; +https://help.qwant.com/bot/)	317	0.52%
Anitya 2.2.2 at release-monitoring.org	305	0.50%
Chrome Privacy Preserving Prefetch Proxy	292	0.48%
Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)	206	0.34%
DuckDuckBot/1.1; (+http://duckduckgo.com/duckduckbot.html)	206	0.34%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ReyilBot/0.1	198	0.33%
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)	178	0.29%
Mozilla/5.0 (compatible; pathscan/1.0)	177	0.29%
DominicBot/1.0 (+https://vanylla.org/bot)	164	0.27%
Turnitin (https://bit.ly/2UvnfoQ)	151	0.25%
DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)	146	0.24%
Version-Tracker	144	0.24%
Claude-User (claude-code/2.1.197; +https://support.anthropic.com/)	136	0.22%
Mozilla/5.0 (compatible; YandexRenderResourcesBot/1.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0	131	0.22%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)	128	0.21%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36	124	0.20%
Mozilla/5.0 (l9scan/2.0.3313e27393e21393e21353; +https://leakix.net)	120	0.20%
com.apple.WebKit.Networking/21623.2.7.11.7 Network/5569.81.5 macOS/26.3.1	114	0.19%
portroach/	113	0.19%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)	98	0.16%
fetch libfetch/2.0	83	0.14%
Scrapy/2.16.0 (+https://scrapy.org)	76	0.13%
Python/3.12 aiohttp/3.13.3	76	0.13%
portscout/0.8.1	70	0.12%
Mozilla/5.0 (compatible; bitbake)	70	0.12%
Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)	70	0.12%
Mozilla/5.0 (compatible; WebGameGameExternalAudit/1.0; +https://webgamegame.win/)	68	0.11%
s4-updater/1.0	66	0.11%
python-requests/2.25.1	66	0.11%
xbps-src-update-check/113	64	0.11%
cbuild-update-check/4.20.69	64	0.11%
wl-checknewreleases/1.0.21	63	0.10%
CCBot/2.0 (https://commoncrawl.org/faq/)	63	0.10%
Desoutter/1.0 (benoit.marembert@cp.com)	57	0.09%
PTXdist 2024.12.0	53	0.09%
flatpak-builder 1.2.2	50	0.08%
Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)	48	0.08%
ClueWeb-Crawler/1.0 (+https://boston.lti.cs.cmu.edu/CMU-ClueWeb-Crawler/; mailto:cmu-clueweb-crawler@andrew.cmu.edu)	48	0.08%
Mozilla/5.0	44	0.07%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0	42	0.07%
Mozilla/5.0 (compatible; DataForSeoBot/1.0; +https://dataforseo.com/dataforseo-bot)	40	0.07%
OWLer	39	0.06%
python-httpx/0.28.1	38	0.06%
SEBot-WA	36	0.06%
Mozilla/5.0 (compatible; YandexImages/3.0; +http://yandex.com/bots)	36	0.06%
YoctoProject/Bitbake/1.0	35	0.06%
Mozilla/5.0 (compatible; Hister/v0.15.0 (6c51924); +https://hister.org/)	32	0.05%
Mozilla/5.0 (compatible; CT-WP-Scanner/1.0; +https://example.com/bot)	27	0.04%
cargo	25	0.04%
Lynx/2.9.3 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/3.6.2	23	0.04%
pc	19	0.03%
Mozilla/5.0 (compatible; HostQuality/1.0)	19	0.03%
Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)	18	0.03%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; AzureAI-SearchBot/1.0;	17	0.03%
Tricorder-Copyright-Collector/1.0	15	0.02%
7Siters/1.2 ( https://7ooo.ru/siters/ )	15	0.02%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)	14	0.02%
meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)	13	0.02%
Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)	13	0.02%
Exabot	12	0.02%
node	11	0.02%
anthropic-ai	11	0.02%
Mozilla/5.0 (compatible; VelenPublicWebCrawler/1.0; +https://velen.io)	11	0.02%
Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com)	11	0.02%
DomainStatsBot/1.0 (https://domainstats.com/pages/our-bot)	10	0.02%
okhttp/5.3.0	9	0.01%
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity	9	0.01%
FireFox	9	0.01%
Mozilla/5.0 (keys-so-bot)	8	0.01%
Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)	8	0.01%
gwf-carbon-txt-crawler/1.0 (Web Crawler for the GreenSoftwareFoundation to measure the adoption of the carbon.txt initiative; https://carbontxt.org/; crawler@carbontxt.org)	7	0.01%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot	7	0.01%
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)	7	0.01%
Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)	7	0.01%
Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36	7	0.01%
Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)	7	0.01%
CyberSitemapRepositoryBot/0.1 (research crawler; replace contact in scripts/crawl_validate.py)	7	0.01%
AteveSearchSourceUrlDiscovery/0.1 (+mailto:crawler@example.com)	7	0.01%
SummalyBot/5.2.2	6	0.01%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bravebot/1.0; +https://search.brave.com/help/brave-search-crawler) Chrome/W.X.Y.Z Safari/537.36	6	0.01%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0	6	0.01%
Mozilla/5.0 (compatible; intelx.io_bot +https://intelx.io)	6	0.01%
Mozilla/5.0 (compatible; MojeekBot/0.11; +https://www.mojeek.com/bot.html)	6	0.01%
Mozilla/5.0 (compatible; HubSeedsBot/1.0)	6	0.01%
Mozilla/5.0 (compatible; DomainExtractor/1.0)	6	0.01%
rpmdev-spectool	5	0.01%
imgproxy/3.30.0	5	0.01%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amzn-SearchBot/0.1) Chrome/119.0.6045.214 Safari/537.36	5	0.01%
Mozilla/5.0 (compatible; YaK/1.0; http://linkfluence.com/; bot@linkfluence.com)	5	0.01%
BrightEdge Crawler/1.0 (crawler@brightedge.com)	5	0.01%
AIWebIndex/2.0 (+https://lyrenth.com/bot; AI-readable web index)	5	0.01%
lftp/4.9.3	4	0.01%
gwf-carbon-txt-crawler/1.0 (Web Crawler for the Green Software Foundation to measure the adoption of the carbon.txt initiative; https://carbontxt.org/; support@greenweb.org)	4	0.01%
blh-scanner/1.0 (+authorized security research)	4	0.01%
WhatsApp/2.23.20.0	4	0.01%
SecurityAudit/1.0	4	0.01%
NVBot	4	0.01%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; YouBot/1.0; +https://docs.you.com/youbot; env:prod) Chrome/142.0.0.0 Safari/537.36	4	0.01%
Mozilla/5.0 (compatible; wpbot/1.4; +https://forms.gle/ajBaxygz9jSR8p8G9)	4	0.01%
Mozilla/5.0 (compatible; SecurityResearch/1.0; )	4	0.01%
Mozilla/5.0 (compatible; SERankingBacklinksBot/1.0; +https://seranking.com/backlinks-crawler)	4	0.01%
Java/1.8.0_171	4	0.01%
win10chrome117	3	0.00%
ttcontrol-yocto-build/1.0 (builder-fusion@ttcontrol.com)	3	0.00%
amilabs-interleaved-research/0.1 (sanghyun@amilabs.xyz)	3	0.00%
SonyEricssonK310iv/R4DA Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Link/6.3.1.13.0	3	0.00%
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Aranet-SearchBot/1.0; +https://aranet.ai/bot) Chrome/131.0.0.0 Safari/537.36	3	0.00%
Mozilla/5.0 (compatible; special_archiver/3.11.1; +https://archive.org/details/archive.org_bot)	3	0.00%
Mozilla/5.0 (compatible; SBIntuitionsBot/0.1; +https://www.sbintuitions.co.jp/bot/)	3	0.00%
Mozilla/5.0 (compatible) SemanticScholarBot (+https://www.semanticscholar.org/crawler)	3	0.00%
Mozilla/5.0 (compatible)	3	0.00%
Mozilla	3	0.00%
Misskey/2025.4.7 (https://social.louis-vallat.dev/)	3	0.00%
Misskey/2025.4.7 (https://shork.social/)	3	0.00%
Iframely/1.3.1 (+https://iframely.com/docs/about) Atlassian	3	0.00%
INETDEX-BOT/2.0 (https://inetdex.com/bot.php)	3	0.00%
GoogleOther	3	0.00%
Google-Lens	3	0.00%
yocto-imx8mp-build (rc@example.com)	2	0.00%
kagi-fetcher/1.0	2	0.00%
imx-yocto-build/1.0 (contact: local-build)	2	0.00%
fyndbot (robots; https://fynd.bot)	2	0.00%
forager/1.0 (+https://codeberg.org/atomdrift/forager)	2	0.00%
efx-yocto-build	2	0.00%
amazon-kendra	2	0.00%
XenForo/2.x (https://www.bsdforen.de)	2	0.00%
Timpibot/1.0 (+http://timpi.io/crawler)	2	0.00%
TelegramBot (like TwitterBot)	2	0.00%
SnipeSearchBot/Nutch-1.22	2	0.00%
ShorkBot/0.1 (small search engine crawler)	2	0.00%
Screaming Frog SEO Spider/24.0	2	0.00%
RootEvidence/1.0	2	0.00%
Observer/1.0 (+https://obsrvr.net/about; crawler@obsrvr.net)	2	0.00%
Mozilla/5.0 crawler	2	0.00%
Mozilla/5.0 (curator-mass-export)	2	0.00%
Mozilla/5.0 (compatible; myjob/1.0)	2	0.00%
Mozilla/5.0 (compatible; YandexFavicons/1.0; +http://yandex.com/bots)	2	0.00%
Mozilla/5.0 (compatible; Timpibot/0.8; +http://www.timpi.io)	2	0.00%
Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)	2	0.00%
Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)	2	0.00%
Mozilla/5.0 (compatible; HaloBot/1.0)	2	0.00%
Mozilla/5.0 (compatible; Google-Site-Verification/1.0)	2	0.00%
Mozilla/5.0 (compatible; AffsignalCrawler/1.0; +https://affsignal.com/bot)	2	0.00%
Mozilla/4.0 (compatible; MSIE 5.0; Series80/2.0 Nokia9500/4.51 Profile/MIDP-2.0 Configuration/CLDC-1.1)	2	0.00%
Deno/2.3.1	2	0.00%
BanglaBot/1.0 (+https://xn--54b7fta0cc.com/bot)	2	0.00%
ArenaUnfurlBot/1.0 (Link preview bot for AI model comparison platform; +https://arena.ai) Mozilla/5.0 (compatible)	2	0.00%
yocto-build	1	0.00%
wl-download/1.0.24	1	0.00%
webtech/1.3.4	1	0.00%
vercel-image-optimization/1.0	1	0.00%
undici	1	0.00%
ucve-finder/1.0 (research@vyprsec.ai)	1	0.00%
senthor-robots-research/1.0 (+https://senthor.io; audits public robots.txt for AI-access analytics)	1	0.00%
sbom-source-hash-verifier/1.0	1	0.00%
rag/1.0	1	0.00%
qi ye wei xin/5.0.8 (Mac OS X ban ben26.5(ban hao25F71))	1	0.00%
python-urllib3/1.26.9	1	0.00%
programbench-miner/0.1	1	0.00%
portalmmm/2.0 N410i(c20;TB)	1	0.00%
pimeyes-downloader-api/0.1	1	0.00%
msnbot-media/1.1 ( http://search.msn.com/msnbot.htm)	1	0.00%
meta-externalads/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)	1	0.00%
iwg50m-imx91-yocto-build (jslemaire@esmartcontrol.net)	1	0.00%
imx8mp-yocto-build/1.0 (contact: ban@example.com)	1	0.00%
hrepo-bfd/0.2 source-cache	1	0.00%
firefox	1	0.00%
facebookscraper/1.0( http://www.facebook.com/sharescraper_help.php)	1	0.00%
autospec/1.0	1	0.00%
apt-qa	1	0.00%
WhatsApp/2	1	0.00%
Web Downloader/6.9	1	0.00%
WP-Safe-Scanner/2.0	1	0.00%
Vodafone/1.0/V802SE/SEJ001 Browser/SEMC-Browser/4.1	1	0.00%
SonyEricssonZ800/R1Y Browser/SEMC-Browser/4.1 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Link/6.3.0.0.0	1	0.00%
SonyEricssonT68/R201A	1	0.00%
SonyEricssonS500i/R6BC Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1	1	0.00%
ServiceNow/1.0	1	0.00%
SEMrushBot	1	0.00%
SEC-SGHE900/1.0 NetFront/3.2 Profile/MIDP-2.0 Configuration/CLDC-1.1 Opera/8.01 (J2ME/MIDP; Opera Mini/2.0.4509/1378; nl; U; ssr)	1	0.00%
S33DBot/4.0 (+https://s33d.fr/bot)	1	0.00%
RecordedFuture Global Inventory Crawler	1	0.00%
PLD/distfiles	1	0.00%
PLD/Builder(v0.35)	1	0.00%
Opera/9.60 (J2ME/MIDP; Opera Mini/4.2.14320/554; U; cs) Presto/2.2.0	1	0.00%
Nokia6100/1.0 (04.01) Profile/MIDP-1.0 Configuration/CLDC-1.0	1	0.00%
Nextcloud-Server-Crawler/33.0.3	1	0.00%
NetAPI v1	1	0.00%
Mozilla/5.0 (en-us) AppleWebKit/525.13 (KHTML, like Gecko; Google Web Preview) Version/3.1 Safari/525.13	1	0.00%
Mozilla/5.0 (compatible; archive.org_bot; Wayback Machine Live Record; +http://archive.org/details/archive.org_bot)	1	0.00%
Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)	1	0.00%
Mozilla/5.0 (compatible; WP-Safe-Scanner/1.0)	1	0.00%
Mozilla/5.0 (compatible; SurdotlyBot/1.0; +http://sur.ly/bot.html)	1	0.00%
Mozilla/5.0 (compatible; SiteProber/1.0; +https://example.com/bot)	1	0.00%
Mozilla/5.0 (compatible; PD12M-downloader/1.0)	1	0.00%
Mozilla/5.0 (compatible; Konqueror/4.1; DragonFly) KHTML/4.1.4 (like Gecko)	1	0.00%
Mozilla/5.0 (compatible; GitFinder/1.0)	1	0.00%
Mozilla/5.0 (compatible; EngagemiiAcquisitionBot/1.0; +https://engagemii.com)	1	0.00%
Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)	1	0.00%
Mozilla/5.0 (OS/2; Warp 4.5; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21	1	0.00%
Mozilla/5.0 (OS/2; U; OS/2; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QupZilla/1.3.1 Safari/533.3	1	0.00%
Mozilla/4.77 [en] (X11; I; IRIX;64 6.5 IP30)	1	0.00%
Mozilla/4.0 (PSP (PlayStation Portable); 2.00)	1	0.00%
Mozilla/3.0 (compatible; NetPositive/2.1.1; BeOS)	1	0.00%
LinkupBot/1.0 (LinkupBot for web indexing; https://linkup.so/bot; bot@linkup.so)	1	0.00%
Java/1.6.0_13	1	0.00%
Iframely/1.3.1 (+https://iframely.com/docs/about)	1	0.00%
Hatena::Scissors/0.01	1	0.00%
Google-Jetski-AIStudio/1.0	1	0.00%
Google	1	0.00%
GitHubCopilotRuntime-WebFetch	1	0.00%
DefaultLangchainUserAgent	1	0.00%
Bun/1.3.14	1	0.00%
BuildStream/2	1	0.00%
BitBake	1	0.00%
Avant Browser/1.2.789rel1 (http://www.avantbrowser.com)	1	0.00%
Aidentify latest-version verifier	1	0.00%
AdsBot-Google ( http://www.google.com/adsbot.html)	1	0.00%
"Mozilla/5.0"	1	0.00%

404 Not Found

I also get a lot of 404 Not Found errors.

#	File
1492	/files/ccid-1.4.33.tar.bz2
775	/files/ccid-1.5.5.tar.bz2
292	/.well-known/traffic-advice
156	/sitemap.xml
107	/apple-touch-icon.png
104	/apple-touch-icon-precomposed.png
78	/.env
59	/ip
46	/.git/config
45	/ads.txt
43	/files/ccid-1.5.2.tar.bz2
30	/files/ccid-1.6.2.tar.xz
30	/files/ccid-1.5.0.pkg
28	/files/$%7Bpkgname
27	/config.json
26	/info/refs?service=git-upload-pack
26	/.env.local
24	/info.php
24	/files/ccid-1.7.0.tar.xz
24	/.aws/credentials
...	...

ccid-1.4.33

The file /files/ccid-1.4.33.tar.bz2 was fetched by "rivian-firmware-build/1.0 (https://gitlab.rivianvw.io/core/firmware)" at 90%, and then by Wget at 9%.

At the end of June 2026, I decided to remove the old versions of the source code archives. I don't think it is a good idea to provide artificial intelligence companies with old versions of my software (that may contain bugs).

It appears that Rivian is using my driver, in version 1.4.33, which was released in June 2020, and tries to fetch it repeatedly. They now receive a 404 error instead of the file contents.

ccid-1.5.5

I don't know why the version 1.5.5 (released in January 2024) is so popular.

According to the logs, this version is fetched by Wget for 89% of the time, curl 8% of the time and bitbake 1% of the time.

I don't know who is using this 'old' version of the CCID driver. In fact I could find out, as I have the IP addresses of the clients in the logs.

parse tool

The CCID driver contains a tool that can parse the USB CCID descriptor. This is mandatory if you want to add a new reader to the lists.

Instead of building the driver from the source code I also provide pre-compiled binaries of the parse tool.

The command to use is:

curl https://ccid.apdu.fr/files/parse.sh | bash -

From the log I can see that there were 50 accesses to the parse.sh shell script and 23 accesses to the Linux-x86_64 binary, but none to any of the other architectures I provide.

file/arch	#
parse.sh	50
Linux-x86_64	23
Linux-aarch64	0
Linux-armv7l	0
Darwin-arm64	0
Darwin-x86_64	0

The requests came from 8 different IP addresses. Therefore, only 8 users have used this service in June 2026.

IPv6

The old Internet Protocol is still widely used. However, only 19% of the requests use the current, modern version: IPv6.

Version	#	%
IPv4	217489	80.59%
IPv6	52371	19.41%

According to Google's IPv6 statistics the figure should be around 50% for each protocol.

I have no explanation for that discrepancy.

Conclusion

I was expecting to receive more requests from GNU/Linux systems.

I was also expecting more requests from bots, such as AI and search engines. According to 2026 Edition Thales Bad Bot Report "53% The percentage of internet traffic made up of bots.".

I am surprised to see requests for outdated versions of the CCID driver.

Enabling contactless Broadcom readers

Ludovic Rousseau — Wed, 08 Jul 2026 12:17:15 GMT

Current status

Some Dell laptops have a Broadcom smart card reader. Some readers are for contact cards and some are for contactless cards. Contact readers should work fine with my CCID driver and are listed in the Should work but untested by me list.

However, none of the contactless readers are supported by my driver and are in the Unsupported or partly supported CCID readers.

Example with a Dell Latitude 7350

$ lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 002: ID 0bda:557e Realtek Semiconductor Corp. Integrated_Webcam_FHD
Bus 003 Device 003: ID 0a5c:5865 Broadcom Corp. 58200
Bus 003 Device 004: ID 8087:0036 Intel Corp. BE200 Bluetooth
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

The reader found is this Broadcom Corp. 58200 (USB idProduct = 0x5865).

My CCID driver web page indicates for this reader: The contactless interface is not supported.

$ pcsc_scan
PC/SC device scanner
V 1.7.5 (c) 2001-2026, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
0: Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 00 00
1: Broadcom Corp 58200 [Contactless SmartCard] (0123456789ABCD) 01 00

Sat Jul  4 17:40:42 2026
 Reader 0: Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 00 00
  Event number: 0
  Card state: Card removed,
 Reader 1: Broadcom Corp 58200 [Contactless SmartCard] (0123456789ABCD) 01 00
  Event number: 0
  Card state: Card removed,
Insert or remove a card or a reader...

My CCID driver finds and reports both readers/interfaces. However, only the contact reader reports card insertion and removal and can use a card.

The readers are a composite device with two CCID interfaces: "Contacted SmartCard" and "Contactless SmartCard". The device also has an interface labelled "Broadcom ControlVault 3+ w/FingerPrint" and another labelled "Broadcom NFP" (NFP stands for "Near Field Proximity").

Electromagnetic field

The contactless reader does not detect the presence of a card because its electromagnetic field is inactive.

I have a special detector that tells me when a contactless reader is, or isn't, emitting an electromagnetic field. And I see no activity at all.

Broadcom NFC service

Broadcom provides a (proprietary) program at https://packages.broadcom.com/artifactory/dell-controlvault-drivers/

The current version is brcm_linux_nfc_6.4.23.tgz.

$ tar tzvf brcm_linux_nfc_6.4.23.tgz
-rwxrwxr-x adminuser/adminuser 1427144 2026-05-01 00:48 usr/lib/broadcom-nfc/bcmnfcd.bin
-rw-rw-r-- adminuser/adminuser   26117 2026-05-01 00:48 usr/lib/broadcom-nfc/bcmnfcd.conf
-r-xr-xr-x adminuser/adminuser     155 2026-05-01 00:48 filelist
-r-xr-xr-x adminuser/adminuser     961 2026-05-01 00:48 install.sh
-r-xr-xr-x adminuser/adminuser      83 2026-05-01 00:48 rm.sh
-r-xr-xr-x adminuser/adminuser     249 2026-05-01 00:48 etc/systemd/system/broadcom-nfc.service
-r-xr-xr-x adminuser/adminuser     157 2026-05-01 00:48 lib/systemd/system-sleep/bcmnfcd-control.sh
-r-xr-xr-x adminuser/adminuser    2098 2026-05-01 00:48 readme.txt
-r-xr-xr-x adminuser/adminuser    4325 2026-05-01 00:48 LICENSE.broadcom

Supported readers

Only Broadcom readers using a CV3+ chip (or later) are supported by the Broadcom NFC service to enable the contactless interface.

Older readers using a CV3 chip will not work.

Remember the interface name of the non-CCID interface: "Broadcom ControlVault 3+ w/FingerPrint"? "ControlVault 3+" refers to the CV3+ chip, so this reader is compatible.

Readme

Extract from the readme.txt file:

===========================================================
                         Broadcom NFC Daemon for Linux
===========================================================


================
DESCRIPTION
================

This package is a Linux based package to install Broadcom NFC daemon.  The NFC
daemon runs and NFC stack needed to initialize and keep the state of the NFC
controller of the CV device.  The sole purpose of this NFC stack is to enable
the Contactless CCID interface.

It is assumed higher level software such as PCSC Lite will be used in
conjunction with the NFC daemon.

[...]

Installation

After installation, the process bcmnfcd.bin is running:

$ systemctl status broadcom-nfc.service
● broadcom-nfc.service - Broadcom NFC service
         Loaded: loaded (/etc/systemd/system/broadcom-nfc.service; enabled; preset: enabled)
         Active: active (running) since Sat 2026-07-04 13:19:07 CEST; 1min 19s ago
 Invocation: 45b58a953ed54891a3b7d3c167502c39
   Main PID: 9271 (bcmnfcd.bin)
          Tasks: 6 (limit: 18475)
         Memory: 2.5M (peak: 3.5M)
                CPU: 48ms
         CGroup: /system.slice/broadcom-nfc.service
                         └─9271 /usr/lib/broadcom-nfc/bcmnfcd.bin -d -f -c /usr/lib/broadcom-nfc/

Use

And it is now possible to detect and use contactless smart cards.

$ pcsc_scan
PC/SC device scanner
V 1.7.3 (c) 2001-2024, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
0: Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 00 00
1: Broadcom Corp 58200 [Contactless SmartCard] (0123456789ABCD) 01 00

Sat Jul  4 13:21:48 2026
 Reader 0: Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 00 00
  Event number: 0
  Card state: Card removed,
 Reader 1: Broadcom Corp 58200 [Contactless SmartCard] (0123456789ABCD) 01 00
  Event number: 4
  Card state: Card removed,

Sat Jul  4 13:21:50 2026
 Reader 1: Broadcom Corp 58200 [Contactless SmartCard] (0123456789ABCD) 01 00
  Event number: 5
  Card state: Card inserted,
  ATR: 3B 8F 80 01 80 91 00 31 80 65 B0 84 05 00 25 83 01 90 00 CD

ATR: 3B 8F 80 01 80 91 00 31 80 65 B0 84 05 00 25 83 01 90 00 CD
+ TS = 3B --> Direct Convention
+ T0 = 8F, Y(1): 1000, K: 15 (historical bytes)
  TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0
-----
  TD(2) = 01 --> Y(i+1) = 0000, Protocol T = 1
-----
+ Historical bytes: 80 91 00 31 80 65 B0 84 05 00 25 83 01 90 00
  Category indicator byte: 80 (compact TLV data object)
        Tag: 9, len: 1 (unknown)
          Value: 00
        Tag: 3, len: 1 (card service data byte)
          Card service data byte: 80
                - Application selection: by full DF name
                - EF.DIR and EF.ATR access services: by GET RECORD(s) command
                - Card with MF
        Tag: 6, len: 5 (pre-issuing data)
          Data: B0 84 05 00 25
        Tag: 8, len: 3 (status indicator)
          LCS (life card cycle): 01 (Creation state)
          SW: 9000 (Normal processing.)
+ TCK = CD (correct checksum)

Possibly identified card (using /home/ludovic/.cache/smartcard_list.txt):
3B 8F 80 01 80 91 00 31 80 65 B0 84 05 00 25 83 01 90 00 CD
        Contactless IDCore3230 build 6.8, test APDU applet (JavaCard)

If you stop the /usr/lib/broadcom-nfc/bcmnfcd.bin process then the contactless reader is disabled again.

The process does more than just initialise the contactless reader.

License

Extract from the LICENSE.broadcom file:

Copyright: Copyright © 2005-2023 Broadcom. All Rights Reserved.
The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
License: Proprietary
[...]

The program is proprietary. The source code is not provided.

I understand this can be problematic. A Free Software solution would be preferable.

If you want to use a contactless reader that works without a non-free "driver" you can use one from the supported list or check the contactless support if you use a reader from the should work list.

I note that, in order to use the Wi-Fi card on this laptop, I need to install the package firmware-iwlwifi which comes from the Debian non-free-firmware repository. This is a similar issue, except that for the non-free program for the contactless reader runs on the main CPU rather than the Wi-Fi card CPU.

Conclusion

Broadcom provides a program that enables the use of the contactless readers.

It is not perfect, since the license is NOT Free Software. However, it does allow you to use the contactless reader if you really need to.

New version of libccid: 1.8.2

Ludovic Rousseau — Sat, 13 Jun 2026 11:00:27 GMT

I have just released version 1.8.2 of libccid the Free Software CCID class smart card reader driver.

This version resolves an issue that was introduced in version 1.8.1, which was released three days ago. Composite devices (devices with both a CCID interface and also another interface, such as HID) were not being handled correctly. Yubico Yubikey tokens, for example, are often composite devices.

Thank you

Less than three days after the release of version 1.8.1, I received three bug reports concerning an issue with Yubikey tokens.

Thanks to Anti Räis for the bug report: CCID fails to initialize Yubico YubiKey FIDO+CCID reader (github)
Thanks to Jeff King for the bug report: libccid: yubikey no longer recognized after upgrade to 1.8.1 (Debian bug)
Thanks to Robin Candau for the bug report: Can't unlock multiple smartcards with 1.8.1 (bisected) (salsa)

The bug reports either contain the problematic Git commit or a proposed patch to solve the problem. That was surprising.

I realise that bug reports are the main way of finding out whether people are using my software. Perhaps I should introduce more bugs to prompt a reaction? 😏

You can also email me to let me know that everything is working fine and that you are happy. My contact details can be found on the About me page.

Changes:

1.8.2 - 13 June 2026, Ludovic Rousseau

Fix initialisation of composite devices (like Yubico tokens)
Correctly close the slots of a multi-slots reader (serial)

New version of libccid: 1.8.1

Ludovic Rousseau — Wed, 10 Jun 2026 13:58:25 GMT

I just released version 1.8.1 of libccid the Free Software CCID class smart card reader driver.

This version fixes an issue with multi-slots readers.

Changes:

1.8.1 - 10 June 2026, Ludovic Rousseau

Correctly close the slots of a multi-slots reader
Fix 3 minor issues "Found by AISLE in partnership with Red Hat"
Some other minor improvements

No more limited to 16 readers

Ludovic Rousseau — Wed, 27 May 2026 15:25:41 GMT

pcsc-lite and my CCID driver are no longer limited to 16 readers. See New version of pcsc-lite: 2.5.0 and New version of libccid: 1.8.0.

History

Since the first version of pcsc-lite (in 2002 according to git history) the maximum number of readers has been set to 16. This number is defined by the PCSCLITE_MAX_READERS_CONTEXTS constant.

Since pcsc-lite was limited to 16 readers it was obvious to also limit the number of devices supported by the CCID driver to 16.

This limitation is problematic for some use cases. While it is possible to change the value of PCSCLITE_MAX_READERS_CONTEXTS and rebuild both pcsc-lite and the driver, this has side effects. See Fedora, flatpak and pcsc-lite for more information.

Changes

The request has been around since at least 2018. See https://salsa.debian.org/rousseau/CCID/-/work_items/4 and https://salsa.debian.org/rousseau/PCSC/-/work_items/4.

I had already calculated the amount of RAM that could be saved by using a list instead of a fixed-size array:

You can now use as many readers as you want.

In fact, no. There is still a limit of 256 readers due to the naming scheme used by pcsc-lite for readers. Readers will go from 00 to FF. See What is in a PC/SC reader name?.

Backward compatibility

In version 2.4.1 of pcsc-lite I introduced the ability to mix different versions of the internal communication protocol between the PC/SC daemon (pcscd) and the PC/SC library (libpcsclite). See pcsc-lite backward & forward compatible with itself.

In order to remove the limitation of the reader number, I had to update this internal communication protocol again. However, I tried to make it smart so that an old libpcsclite can communicate with a recent pcscd or vice versa. The application will still only recognise up to 16 readers, but at least it should work.

Conclusion

I hope you will benefit from this change:

Less RAM consumed when only 1 reader is used.
The possibility of using more than 16 readers.

New version of libccid: 1.8.0

Ludovic Rousseau — Wed, 27 May 2026 11:09:40 GMT

I just released version 1.8.0 of libccid the Free Software CCID class smart card reader driver.

The major changes in this version are:

no more limited to 16 smart card readers
./configure script is no more provided. Only meson configuration is provided.

Changes:

1.8.0 - 27 May 2026, Ludovic Rousseau

Add support of
- GLSolutions NM61 PC/SC
- Identiv uTrust FIDO2 Security Key
- Kensington VeriMark NFC+ USB-C Security Key
- MARX CryptoTech LP Tokey 3 FIDO
- mCore Contact-Reader
- mCore Contactless-Reader
- mCore DualSlot-Reader
- Pol Henarejos Pico Fido
- Pol Henarejos Pico HSM
- Pol Henarejos Pico OpenPGP
- Richmond Technologies CO. LLC AEGIS PRO4 Smart Card Reader
- SCR Prime
Remove the limitation to 16 readers
udev: Update rules file to comply with systemd documentation (and fix permissions issue)
meson: install serial config file in correct dir
Remove support of autotools
Fix crash in multi slots readers code
Fix some race conditions
Some other minor improvements

Laptops and smart card readers

Ludovic Rousseau — Tue, 03 Mar 2026 20:29:45 GMT

Which smart card reader is present in a particular laptop model? It can be difficult to find out the exact model of smart card reader included in a laptop before buying it.

However, thanks to the Hardware for Linux project, you can submit your own hardware configuration and also consult the configurations of many laptops and desktops to find out what hardware is included.

The website also provides aggregated results for a specific categories such as CPU Vendors.

One interesting result is the Chipcard Vendor aggregation.

Chipard Vendors market shares

The results do not represent exact market shares. They only include systems that:

run GNU/Linux
and that have been submitted to https://linux-hardware.org/ by their owners.

However, they should reflect reality.

Chipcard Vendors
#	Vendor	Percent
1	Broadcom	55.61%
2	Alcor Micro	26.17%
3	O2 Micro	6.53%
4	Upek	4.69%
5	Lenovo	3.45%
6	Yubico.com	0.83%
7	Gemalto (was Gemplus)	0.6%
8	SCM Microsystems	0.51%
9	Advanced Card Systems	0.37%
10	Activ	0.23%

An important point to note is that the first five on the list should be correct, as they correspond to the manufacturers of embedded smart card readers. However, the next five in the list are often (if not always) external smart card readers that are connected via a USB port and not integrated into the laptop. For instance, I am not aware of any Yubico readers that are embedded in laptops. These readers are listed on https://linux-hardware.org/ because they were plugged in when the user ran the hw-probe program to scan and report the hardware configuration.

Which laptop manufacturers use which smart card reader?

You can click on a specific slice of the Chipcard Vendor pie chart to see which laptop manuifacturers uses this smart card reader brand.

Broadcom

All Broadcom readers are used by Dell.

Alcor Micro

#	Vendor	Percent
1	Lenovo	82.4%
2	Hewlett-Packard	8.6%
3	Fujitsu	6.5%
4	Acer	0.7%
5	ASUSTek Computer	0.4%

O2 Micro

#	Vendor	Percent
1	Dell	40.8%
2	Fujitsu	37.3%
3	Toshiba	19.7%
4	Fujitsu Siemens	2.1%

Upek

All of Upek readers are used by Lenovo.

It looks like the Upek devices are "TouchChip Fingerprint Coprocessor" and not an "Integrated Smart Card Reader". I don't know why they are listed as "Chipcard Vendor". Perhaps it is a bug or limitation of https://linux-hardware.org/.

Lenovo

Unsurprisingly, all of Lenovo readers are used by... Lenovo.

Corresponding CCID devices

It is possible to list the CCID devices of each manufacturer that I know of:

Broadcom
Alcor Micro
O2 Micro
Upek (not smart card readers)
Lenovo

Conclusion

Only three main vendors of smart card readers are used in laptops: Broadcom, Alcor Micro and O2 Micro.

Do they produce good products? Are their products supported by my CCID driver? These are both very good questions, but for other blog articles. To be continued...

SCARD_CTL_CODE(3601): USB path of the reader

Ludovic Rousseau — Sun, 08 Feb 2026 12:10:17 GMT

In version 1.7.1 of my CCID driver I added a new service with the Control Code SCARD_CTL_CODE(3601).

Problem

Some people use two (or more) readers. And each reader plays a specific role in their application. It is therefore important to identify each one.

While it is often possible to use the PC/SC reader name (see What is in a PC/SC reader name?), if you have two identical readers with no serial numbers, it becomes impossible to distinguish between them.

Solution

A USB device is connected to a USB bus with a specific topology. The lsusb --tree command, for example, can display the USB bus topology. The output looks like this:

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 039, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

The smart card reader is connected to USB Port 003 on Bus 001. These numbers are fixed and linked to the computer's physical USB port. Disconnecting and reconnecting the reader to the same USB port will result in the same topology.

On GNU/Linux, the device number will change. For example, if I disconnect and reconnect the device, the reader's device number (Dev) will change from 039 to 040.

SCARD_CTL_CODE(3601)

This code is specific to my CCID driver. It comes after SCARD_CTL_CODE(3600) that is also specific/proprietary and used for MEP (see CCID driver and Multiple Enabled Profiles (MEP)).

Ideally, we would use a code defined by the PC/SC Workgroup but this group is essentially defunct and Microsoft is no longer a member. Microsoft stopped following the PC/SC Workgroup Specification a long time ago. Therefore, even if a name is defined by the PC/SC Workgroup, it will not be available on Windows.

API documentation

Use SCardControl() to send the control code SCARD_CTL_CODE(3601) to the reader. This code will be intercepted by the CCID driver. On return, you get a NUL-terminated string in the format <bus>-<port[.port[.port]]>:<config>.<interface> (e.g., 1-1.3.2:1.0) as found in /sys/bus/usb/devices/.

Source code

This example code is also included in the CCID driver's source code, in the examples/get_usb_path.py file.

The code also displays the SCARD_ATTR_CHANNEL_ID of the reader (see SCARD_ATTR_CHANNEL_ID and USB devices). This is an official PC/SC feature. It can be used when topology information is obtained from another source.

#! /usr/bin/env python3

"""
get_usb_path.py: get USB path of readers
Copyright (C) 2026  Ludovic Rousseau
"""

#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 3 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License along
#   with this program; if not, see <http://www.gnu.org/licenses/>.

import struct
import smartcard
from smartcard.pcsc.PCSCPart10 import SCARD_CTL_CODE
from smartcard.scard import (
    SCARD_E_NOT_TRANSACTED,
    SCARD_E_INVALID_PARAMETER,
    SCARD_ATTR_CHANNEL_ID,
    SCARD_SHARE_DIRECT,
    SCARD_LEAVE_CARD,
)
from smartcard.util import toASCIIString


def get_usb_path(reader):
    """
    Display USB topology
    """
    print("Using:", reader)
    card_connection = reader.createConnection()
    card_connection.connect(mode=SCARD_SHARE_DIRECT, disposition=SCARD_LEAVE_CARD)

    # special control code
    ioctl_get_usb_path = SCARD_CTL_CODE(3601)
    try:
        res = card_connection.control(ioctl_get_usb_path)
    except smartcard.Exceptions.SmartcardException as ex:
        # SCARD_E_NOT_TRANSACTED returned by pcsc-lite
        # SCARD_E_INVALID_PARAMETER retruned by macOS
        if ex.hresult in [SCARD_E_NOT_TRANSACTED, SCARD_E_INVALID_PARAMETER]:
            print("Your driver does not (yet) support SCARD_CTL_CODE(3601)")
            return
        raise
    print("USB path:", toASCIIString(res))

    # get Channel ID
    attrib = card_connection.getAttrib(SCARD_ATTR_CHANNEL_ID)
    ddddcccc = struct.unpack("i", bytearray(attrib))[0]
    dddd = ddddcccc >> 16
    if dddd == 0x0020:
        bus = (ddddcccc & 0xFF00) >> 8
        addr = ddddcccc & 0xFF
        print(f" USB: bus: {bus}, addr: {addr}")
    print()


def main():
    """
    main
    """
    # for all the available readers
    for reader in smartcard.System.readers():
        get_usb_path(reader)


if __name__ == "__main__":
    main()

Output

The reader is connected directly to the computer

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-3:1.0
 USB: bus: 1, addr: 39

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 039, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

The USB path is 1-3:1.0.

This corresponds to bus 1, port 3, configuration 1 and interface 0. You can ignore the configuration and interface details for non-composite USB devices.

Connected to another USB port of the computer

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-6:1.0
 USB: bus: 1, addr: 40

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 006: Dev 040, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

Note:

the Port changed from 003 to 006
the Dev changed from 039 to 040

Connected to a hub

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-3.1:1.0
 USB: bus: 1, addr: 42

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 041, If 0, Class=Hub, Driver=hub/4p, 480M
        |__ Port 001: Dev 042, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

Note:

Port 003 is now used by the USB hub (Class=Hub)
the reader uses Port 001 of the hub
the USB path has one extra level 1-3.1:1.0

Connected to another port of the hub

$ ./get_usb_path.py
Using: Gemalto PC Twin Reader (70D7E2EE) 01 00
USB path: 1-3.4:1.0
 USB: bus: 1, addr: 43

$ lsusb -t
/:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/16p, 480M
    |__ Port 003: Dev 041, If 0, Class=Hub, Driver=hub/4p, 480M
        |__ Port 004: Dev 043, If 0, Class=Chip/SmartCard, Driver=usbfs, 12M

Note:

the reader is connected to Port 004 of the hub
the hub is still connected to Port 003

Conclusion

Not everyone will need or use this feature. However, it can be very important if you have a large number of readers.

Many Thanks to Diego de los Santos for the idea and implementation.