Share USB Device between Host and multiple VMs

[Royd]

Hello Virtualbox,

I have a use case for sharing a USB device. We have a USB based two factor authentication (USB card reader and CAC/PIV card). VMWare allows users to share the USB device between multiple VMs and the host. I would like to see this feature added to VirtualBox.

A typical use is that the CAC card is used to log in to the computer, and when it is removed the screen automatically locks. So, passing the USB Device to the VM causes the host to be locked because it detaches the USB Device from the host. But the CAC reader is needed by the VM to login.

Obviously, this would be a bad idea for USB Thumb drives, but to these authentication methods it's really required.

VMWare is able to do this with the guest additions installed, but unfortunately we cannot use VMWare any more, and the other option is switching to Hyper-V.... *shudder*. Which I would like to avoid.

Is this already a feature that can be enabled on a per device level? Did I miss something in the documentation?

According to the wikipedia article on xHCI under the Virtualization support section...

The xHCI virtualization features also provide for:

direct-Assignment of individual USB devices (irrespective of their location in the bus topology) to any VM
minimizing run-time inter-VM communications
support for native USB device-sharing
support of PCIe SR-IOV (single root I/O virtualization)

Thank you,
Justin

[michaln]

I have a use case for sharing a USB device. We have a USB based two factor authentication (USB card reader and CAC/PIV card). VMWare allows users to share the USB device between multiple VMs and the host. I would like to see this feature added to VirtualBox.

How many licenses are you interested in buying? Or how many programmers do you have at your disposal?

Is this already a feature that can be enabled on a per device level? Did I miss something in the documentation?

No, you didn't miss anything.

According to the wikipedia article on xHCI under the Virtualization support section...

Yes. There are just two tiny problems with that. One is that the xHCI hardware virtualization support does nothing for sharing a device across multiple VMs, it just shortens the path between the VM and the USB host controller. The other problem is that many, if not most, actual xHCI hardware implementations do not have this virtualization support anyway.

The "sharing" mentioned there is not implemented in hardware at all. The actual xHCI specification elucidates: "In cases were the resources of single USB device needs to be shared across multiple VMs, the VMM may own the physical device and emulate the operation of that device to multiple VMs." (The bad grammar is a hint as to how well thought out all of that is.) In other words, there is no real sharing at all, the host controls the device and emulates all or some of its functionality to one or more VMs. That's more like the kind of sharing you get with USB keyboards, mice, or USB sound devices managed by the host.

[mpack]

There's also the devices themselves. How many of them will be designed to be able to carry on several parallel discussions simultaneously? On most of the USB devices I've used, that would be disastrous.

[socratis]

At the beginning I started thinking that sharing a device, USB or not, between two computers is not a reality. Except maybe some hard disks that require specialized drivers and operating systems. You can't simply share (physically) a hard drive between a Windows and a Linux or an OSX computer. No way.

Second thought was that "in theory" it could be a read-only access, because read-write is a major design hurdle. But, still I couldn't think of a device that you could use like that. In the real-world that is. So, out goes that.

Third, I looked up at VMWare's support about this. And I found (https://www.vmware.com/support/ws45/doc ... sb_ws.html):

Who Has Control over a USB Device?
Only one computer — host or guest — can have control of a USB device at any one time.

That's it.

Fourth, the mention in Wikipedia doesn't have any references. And that was weird. So, I went straight to the source, the Intel specification: https://www.intel.com/content/dam/www/p ... b-xhci.pdf (warning: it's a big one). And in page 555, lo and behold, there is a dedicated chapter, Ch. 8 Virtualization. The more I started reading the more I started asking questions about how this would work in reality.

And then mpack answered and made the whole thing a lot clearer. 1) it's a specification only, 2) there's nothing yet in the real-world that makes this an option; hardware- or software-wise. Or at least I couldn't find a real-world reference...