Share a smart card reader between a host and its guest VM(s)
As I wrote in "One smart card reader accessible from many computers" it is possible to share a smart card reader between 2 or more systems.
Problem
I recently received a bug report about a problem between pcsc-lite and VirtualBox. When the smart card reader is connected to the VM guest then the kernel on the host reports errors like:
2022-11-11T14:25:01.186983-08:00 track pcscd[2474]: 00000001 eventhandler.c:336:EHStatusHandlerThread() Error communicating to: SCM Microsystems Inc. SCR 3310 [CCID Interface] (53311514247933) 00 00 2022-11-11T14:25:01.186993-08:00 track pcscd[2474]: 00000005 ccid_usb.c:1356:InterruptRead() libusb_submit_transfer failed: LIBUSB_ERROR_IO 2022-11-11T14:25:01.188050-08:00 track kernel: [ 1247.705353][ T2521] usb 1-2: usbfs: process 2521 (pcscd) did not claim interface 0 before use 2022-11-11T14:25:01.188053-08:00 track kernel: [ 1247.705386][ T2521] usb 1-2: usbfs: process 2521 (pcscd) did not claim interface 0 before use 2022-11-11T14:25:01.587034-08:00 track pcscd[2474]: 00400173 ccid_usb.c:865:WriteUSB() write failed (1/2): -1 LIBUSB_ERROR_IO 2022-11-11T14:25:01.587076-08:00 track pcscd[2474]: 00000008 ifdwrapper.c:364:IFDStatusICC() Card not transacted: 612
And after some times (in days) the host kernel crashes.
A Linux kernel crash is never a good thing. pcsc-lite may be very powerful but
it can't crash the Linux kernel. Only a bug in the kernel itself can generate
a crash. Here I suspect the VirtualBox Linux kernel module to do something
bad.
Solution
Instead of connecting the USB smart card reader in the guest VM (and
disconnecting it from the host) it is possible to share the smart card
reader(s) between the host and guest with some help from pcsc-lite.
Setup
My demo setup:
- Host: Debian testing system
-
Guest: NetBSD 9.3 running inside
KVM (Kernel Virtual
Machine).
I use 2 very different operating systems, GNU/Linux and NetBSD, on purpose. It is to show it is possible to mix systems.
Host
In the host, no change to the configuration. But we will redirect (inject) /run/pcscd/pcscd.comm in the virtual machine.
On the Debian host I run:
$ ssh -N -R/tmp/pcscd.comm:/run/pcscd/pcscd.comm VMNetBSD
Guest
On the NetBSD VM I use:
$ export PCSCLITE_CSOCK_NAME=/tmp/pcscd.comm
Then I can run any application using pcsc-lite and get access to the smart
card(s) and reader(s) from the host. For example:
$ pcsc_scan -c
Wed Nov 16 17:26:55 2022 Reader 0: Alcor Micro AU9540 00 00 Event number: 0 Card state: Card inserted, ATR: 3B A7 00 40 18 80 65 A2 08 01 01 52
With a screenshot:
Limitations
pcsc-lite to pcsc-lite
As I demonstrated the solution is not limited to GNU/Linux. Any Unix system using pcsc-lite can be used. But you must use the same pcsc-lite protocol on both sides.
For example the current protocol version used by pcsc-lite 1.9.9 (current version) is 4.4. It is the same protocol version since pcsc-lite 1.8.24 released in Oct 2018.
macOS or Windows host
It should be technically possible to use Windows or macOS as the host OS. That would involve a new development. Contact me if you need something like that.
Conclusion
No need to disconnect/reconnect the USB reader in the VM. Just share it with the host.
You will be able to use the same smart card at the same time on the two sides. Isn't it nice?