From ludovic.rousseau at gmail.com  Fri Jan  5 02:26:56 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Fri, 5 Jan 2024 11:26:56 +0100
Subject: [Pcsclite-muscle] New version of libccid: 1.5.5
Message-ID: <CAGstE8Be2bT4QHLoP-OQYkjx4=mACcZEMUP3+GeQ2kBHN3sTHw@mail.gmail.com>

Hello,

I just released version 1.5.5 of libccid the Free Software CCID class
smart card reader driver.

1.5.5 - 5 January 2024, Ludovic Rousseau
   - Add support of
     - Alpha-Project ANGARA Token
     - Broadcom Corp 58200 (idProduct: 0x5864)
     - Broadcom Corp 58200 (idProduct: 0x5865)
     - Imprivata USB CCID
     - KAPELSE eS-KAP-Ad
     - Kapelse inSide
     - KAPELSE KAP-Care
     - KAPELSE KAP-eCV
     - KAPELSE KAP-GO
     - KAPELSE KAP-LINK2
     - Kapelse KAP-Move
     - Kapelse Ti-Kap
     - rf IDEAS USB CCID
     - SIMHUB pcsc reader
   - support Kapelse readers on macOS (composite as multislot)
   - Some other minor improvements

https://ccid.apdu.fr/
https://blog.apdu.fr/posts/2024/01/new-version-of-libccid-155/

-- 
 Dr. Ludovic Rousseau


From bigon at bigon.be  Tue Jan 16 00:19:25 2024
From: bigon at bigon.be (Laurent Bigonville)
Date: Tue, 16 Jan 2024 09:19:25 +0100
Subject: [Pcsclite-muscle] Issue when plugging yubikey after pcscd has
 started
Message-ID: <a3d78bcd-bb96-47f0-a2b5-06d53e6d6f1f@bigon.be>

Hello,

I've an issue that when I'm plugging the my yubikey 5 while pcscd is 
already running, gpg/scdaemon cannot communicate with it. If I'm 
plugging it and then I'm starting the daemon, it works fine. I'm 
suspecting that it might be happening with all smartcard reader plugged 
after the daemon has started.

I'm running debian unstable (pcscd: 2.0.1-1 - libccid 1.5.5-1 - gpg 
2.2.40-1.1+b1). I uninstalled opensc completely to avoid interferences.

$ sudo pcscd --version
pcsc-lite version 2.0.1.
Copyright (C) 1999-2002 by David Corcoran<corcoran at musclecard.com>.
Copyright (C) 2001-2022 by Ludovic Rousseau<ludovic.rousseau at free.fr>.
Copyright (C) 2003-2004 by Damien Sauveron<sauveron at labri.fr>.
Report bugs to<pcsclite-muscle at lists.infradead.org>.
Enabled features: Linux x86_64-pc-linux-gnu libsystemd serial usb libudev polkit usbdropdir=/usr/lib/pcsc/drivers ipcdir=/run/pcscd filter configdir=/etc/reader.conf.d
MAX_READERNAME: 128, PCSCLITE_MAX_READERS_CONTEXTS: 16

scdaemon is configured as follow:

$ cat .gnupg/scdaemon.conf
pcsc-driver /usr/lib/x86_64-linux-gnu/libpcsclite.so.1
card-timeout 5
disable-ccid
pcsc-shared

$ LC_ALL=C gpg --card-status
gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device

I've attached the logs generated with the following procedure:

1. Stop scdaemon and pcscd
2. Plug the yubikey (only for the plugged_before log file)
3. Start pcscd
4. Run gpg --card-status
5. Unplug the yubikey
6. Ctrl-C the daemon

Any idea what's happening here?

Kind regards,

Laurent Bigonville
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcscd_plugged_before.log.gz
Type: application/gzip
Size: 10247 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/pcsclite-muscle/attachments/20240116/7a33d08c/attachment.gz>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcscd.log.gz
Type: application/gzip
Size: 4927 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/pcsclite-muscle/attachments/20240116/7a33d08c/attachment-0001.gz>

From ludovic.rousseau at gmail.com  Tue Jan 16 12:57:39 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Tue, 16 Jan 2024 21:57:39 +0100
Subject: [Pcsclite-muscle] Issue when plugging yubikey after pcscd has
 started
In-Reply-To: <a3d78bcd-bb96-47f0-a2b5-06d53e6d6f1f@bigon.be>
References: <a3d78bcd-bb96-47f0-a2b5-06d53e6d6f1f@bigon.be>
Message-ID: <CAGstE8A5=1vTDgRjYTT23mQMXfwJK-7yyn56cLSEEuPj3gxxWw@mail.gmail.com>

Le mar. 16 janv. 2024 ? 09:20, Laurent Bigonville <bigon at bigon.be> a ?crit :
>
> Hello,

Hello Laurent,

> I've an issue that when I'm plugging the my yubikey 5 while pcscd is
> already running, gpg/scdaemon cannot communicate with it. If I'm
> plugging it and then I'm starting the daemon, it works fine. I'm
> suspecting that it might be happening with all smartcard reader plugged
> after the daemon has started.
>
> I'm running debian unstable (pcscd: 2.0.1-1 - libccid 1.5.5-1 - gpg
> 2.2.40-1.1+b1). I uninstalled opensc completely to avoid interferences.
>
> $ sudo pcscd --version
> pcsc-lite version 2.0.1.
> Copyright (C) 1999-2002 by David Corcoran<corcoran at musclecard.com>.
> Copyright (C) 2001-2022 by Ludovic Rousseau<ludovic.rousseau at free.fr>.
> Copyright (C) 2003-2004 by Damien Sauveron<sauveron at labri.fr>.
> Report bugs to<pcsclite-muscle at lists.infradead.org>.
> Enabled features: Linux x86_64-pc-linux-gnu libsystemd serial usb libudev polkit usbdropdir=/usr/lib/pcsc/drivers ipcdir=/run/pcscd filter configdir=/etc/reader.conf.d
> MAX_READERNAME: 128, PCSCLITE_MAX_READERS_CONTEXTS: 16
>
> scdaemon is configured as follow:
>
> $ cat .gnupg/scdaemon.conf
> pcsc-driver /usr/lib/x86_64-linux-gnu/libpcsclite.so.1
> card-timeout 5
> disable-ccid
> pcsc-shared
>
> $ LC_ALL=C gpg --card-status
> gpg: selecting card failed: No such device
> gpg: OpenPGP card not available: No such device
>
> I've attached the logs generated with the following procedure:
>
> 1. Stop scdaemon and pcscd
> 2. Plug the yubikey (only for the plugged_before log file)
> 3. Start pcscd
> 4. Run gpg --card-status
> 5. Unplug the yubikey
> 6. Ctrl-C the daemon
>
> Any idea what's happening here?

I your log pcscd.log so, with pcscd started after the token is
inserted, I see NO APDU exchanges.
I looks like "gpg --card-status" is NOT using pcscd while it should
since you have the option "disable-ccid" in ~/.gnupg/scdaemon.conf
Do you get the expected results at step 4?

Your problem really looks like "GnuPG and PC/SC conflicts"
https://blog.apdu.fr/posts/2019/06/gnupg-and-pcsc-conflicts/

I will try to reproduce the problem in my side.

Bye

-- 
 Dr. Ludovic Rousseau


From bigon at bigon.be  Wed Jan 17 00:18:10 2024
From: bigon at bigon.be (Laurent Bigonville)
Date: Wed, 17 Jan 2024 09:18:10 +0100
Subject: [Pcsclite-muscle] Issue when plugging yubikey after pcscd has
 started
In-Reply-To: <CAGstE8A5=1vTDgRjYTT23mQMXfwJK-7yyn56cLSEEuPj3gxxWw@mail.gmail.com>
References: <a3d78bcd-bb96-47f0-a2b5-06d53e6d6f1f@bigon.be>
 <CAGstE8A5=1vTDgRjYTT23mQMXfwJK-7yyn56cLSEEuPj3gxxWw@mail.gmail.com>
Message-ID: <a8c29319-c29f-4c22-9e62-dbc5ca9dcd1c@bigon.be>

Le 16/01/24 ? 21:57, Ludovic Rousseau a ?crit?:
> Hello Laurent,
Hello Ludovic
> I your log pcscd.log so, with pcscd started after the token is
> inserted, I see NO APDU exchanges.
> I looks like "gpg --card-status" is NOT using pcscd while it should
> since you have the option "disable-ccid" in ~/.gnupg/scdaemon.conf
> Do you get the expected results at step 4?

Yes if the yubikey is plugged before pcscd, the output of "gpg 
--card-status" is perfectly fine

I can confirm that running "gpg --card-status" while pcscd is stopped is 
(systemd) activating both scdaemon and pcscd (in that order looking at 
the PID), so I guess it's really using pcscd?

I've attached the scdaemon logs (both when the yubikey is connected 
before and after) here, I can see a call to "open_pcsc_reader()"

It seems that the only variable here is whether pcscd is started before 
or after the yubikey is plugged. Starting scdaemon before or after pcscd 
doesn't make a difference.

> Your problem really looks like "GnuPG and PC/SC conflicts"
> https://blog.apdu.fr/posts/2019/06/gnupg-and-pcsc-conflicts/
Yes I was also thinking this, but ccid driver is disabled
> I will try to reproduce the problem in my side.

Merci!

Laurent
-------------- next part --------------
A non-text attachment was scrubbed...
Name: scdaemon.txt.gz
Type: application/gzip
Size: 893 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/pcsclite-muscle/attachments/20240117/01096045/attachment.gz>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: scdaemon_connected_before.txt.gz
Type: application/gzip
Size: 4818 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/pcsclite-muscle/attachments/20240117/01096045/attachment-0001.gz>

From ludovic.rousseau at gmail.com  Wed Jan 17 07:22:38 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Wed, 17 Jan 2024 16:22:38 +0100
Subject: [Pcsclite-muscle] Issue when plugging yubikey after pcscd has
 started
In-Reply-To: <a8c29319-c29f-4c22-9e62-dbc5ca9dcd1c@bigon.be>
References: <a3d78bcd-bb96-47f0-a2b5-06d53e6d6f1f@bigon.be>
 <CAGstE8A5=1vTDgRjYTT23mQMXfwJK-7yyn56cLSEEuPj3gxxWw@mail.gmail.com> <a8c29319-c29f-4c22-9e62-dbc5ca9dcd1c@bigon.be>
Message-ID: <CAGstE8CjCXqhfHsZSHorcqJu-i0U2LOk8CyrMX01chEV5W91+Q@mail.gmail.com>

Le mer. 17 janv. 2024 ? 09:19, Laurent Bigonville <bigon at bigon.be> a ?crit :
> I've attached the scdaemon logs (both when the yubikey is connected
> before and after) here, I can see a call to "open_pcsc_reader()"
>
> It seems that the only variable here is whether pcscd is started before
> or after the yubikey is plugged. Starting scdaemon before or after pcscd
> doesn't make a difference.

I think I found the cause of the problem.

In the working case you have:
jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: detected
reader 'Yubico YubiKey OTP+FIDO+CCID 00 00'
jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: detected
reader 'Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 01
00'
jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: reader
slot 0: not connected
jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: DBG:
open_pcsc_reader => slot=0

In the non-working case you have:
jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: detected
reader 'Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 00
00'
jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: detected
reader 'Yubico YubiKey OTP+FIDO+CCID 01 00'
jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: reader
slot 0: not connected
jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: DBG:
open_pcsc_reader => slot=0
jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: DBG:
enter: apdu_connect: slot=0
jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: reader
slot 0: not connected
jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: DBG:
leave: apdu_connect => sw=0x10008

The difference is the order of the readers.
If the YubiKey is found first (in slot 0) then it works.
If the YubiKey is found after the Broadcom reader then gpg does not work.

It looks like the problem is that scdaemon does not try to use slot 1
if slot 0 fails.
It is a very strange limitation or feature of scdaemon.


One solution is to ignore the Broadcom reader so the YubiKey token
will always be in slot 0 for scdaemon.
See PCSCLITE_FILTER_IGNORE_READER_NAMES from "Remove and/or customize
PC/SC reader names"
https://blog.apdu.fr/posts/2015/12/remove-andor-customize-pcsc-reader-names/

Bye

-- 
 Dr. Ludovic Rousseau


From bigon at bigon.be  Thu Jan 18 01:29:27 2024
From: bigon at bigon.be (Laurent Bigonville)
Date: Thu, 18 Jan 2024 10:29:27 +0100
Subject: [Pcsclite-muscle] Issue when plugging yubikey after pcscd has
 started
In-Reply-To: <CAGstE8CjCXqhfHsZSHorcqJu-i0U2LOk8CyrMX01chEV5W91+Q@mail.gmail.com>
References: <a3d78bcd-bb96-47f0-a2b5-06d53e6d6f1f@bigon.be>
 <CAGstE8A5=1vTDgRjYTT23mQMXfwJK-7yyn56cLSEEuPj3gxxWw@mail.gmail.com>
 <a8c29319-c29f-4c22-9e62-dbc5ca9dcd1c@bigon.be>
 <CAGstE8CjCXqhfHsZSHorcqJu-i0U2LOk8CyrMX01chEV5W91+Q@mail.gmail.com>
Message-ID: <2a69d9c5-653f-49c4-8fdb-d61d49fbd76e@bigon.be>

Le 17/01/24 ? 16:22, Ludovic Rousseau a ?crit?:
> Le mer. 17 janv. 2024 ? 09:19, Laurent Bigonville <bigon at bigon.be> a ?crit :
>> I've attached the scdaemon logs (both when the yubikey is connected
>> before and after) here, I can see a call to "open_pcsc_reader()"
>>
>> It seems that the only variable here is whether pcscd is started before
>> or after the yubikey is plugged. Starting scdaemon before or after pcscd
>> doesn't make a difference.
> I think I found the cause of the problem.
>
> In the working case you have:
> jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: detected
> reader 'Yubico YubiKey OTP+FIDO+CCID 00 00'
> jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: detected
> reader 'Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 01
> 00'
> jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: reader
> slot 0: not connected
> jan 17 07:55:04 eriador gpg-agent[117359]: scdaemon[117359]: DBG:
> open_pcsc_reader => slot=0
>
> In the non-working case you have:
> jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: detected
> reader 'Broadcom Corp 58200 [Contacted SmartCard] (0123456789ABCD) 00
> 00'
> jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: detected
> reader 'Yubico YubiKey OTP+FIDO+CCID 01 00'
> jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: reader
> slot 0: not connected
> jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: DBG:
> open_pcsc_reader => slot=0
> jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: DBG:
> enter: apdu_connect: slot=0
> jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: reader
> slot 0: not connected
> jan 17 07:49:59 eriador gpg-agent[116210]: scdaemon[116210]: DBG:
> leave: apdu_connect => sw=0x10008
>
> The difference is the order of the readers.
> If the YubiKey is found first (in slot 0) then it works.
> If the YubiKey is found after the Broadcom reader then gpg does not work.
>
> It looks like the problem is that scdaemon does not try to use slot 1
> if slot 0 fails.
> It is a very strange limitation or feature of scdaemon.
Thanks for your time and effort, I'll bring that issue to the gnupg project.
> One solution is to ignore the Broadcom reader so the YubiKey token
> will always be in slot 0 for scdaemon.
> See PCSCLITE_FILTER_IGNORE_READER_NAMES from "Remove and/or customize
> PC/SC reader names"
> https://blog.apdu.fr/posts/2015/12/remove-andor-customize-pcsc-reader-names/
FTR, there is also the "reader-port" option at scdaemon level.


From valentin.geffroy at iot.bzh  Fri Jan 19 06:48:00 2024
From: valentin.geffroy at iot.bzh (Valentin Geffroy)
Date: Fri, 19 Jan 2024 15:48:00 +0100
Subject: [Pcsclite-muscle] ACR122U NFC Card Reader
Message-ID: <46be2604-5fb9-404a-981b-293c865535d2@iot.bzh>

Hello,

We've noticed an issue on the ACR122U NFC Card Reader. When its is 
connected to a Linux based embedded board (using your reader with libusb 
& pscsd 2.0.1 / ccid 1.5.5), the reader is not detected by the pcscd daemon.

It works when we unplugged/plugged the reader again.

After a boot:

```
00000095 [281473221880224] ccid_usb.c:750:OpenUSBByName() Using USB 
bus/device: 1/3
00000022 [281473221880224] ccid_usb.c:814:OpenUSBByName() 
bNumDataRatesSupported is 0
00173126 [281473221880224] ccid_usb.c:1071:ReadUSB() read failed (1/3): 
LIBUSB_ERROR_TIMEOUT
00055909 [281473221880224] ccid_usb.c:1095:ReadUSB() Invalid frame detected
00116065 [281473221880224] ccid_usb.c:1071:ReadUSB() read failed (1/3): 
LIBUSB_ERROR_TIMEOUT
00000109 [281473221880224] 
ifdhandler.c:203:CreateChannelByNameOrChannel() failed
00000184 [281473221880224] ccid_usb.c:208:close_libusb_if_needed() 
libusb_exit
00004089 [281473221880224] readerfactory.c:1136:RFInitializeReader() 
Open Port 0x200000 Failed (usb:072f/2200:libudev:0:/dev/bus/usb/001/003)
00000086 [281473221880224] readerfactory.c:374:RFAddReader() ACS ACR122U 
PICC Interface init failed.
00000024 [281473221880224] readerfactory.c:624:RFRemoveReader() 
UnrefReader() count was: 1
00000014 [281473221880224] readerfactory.c:1149:RFUnInitializeReader() 
Attempting shutdown of ACS ACR122U PICC Interface 00 00.
```

After unplug/plug the reader :

```
00049715 [281473190051136] ifdhandler.c:390:IFDHGetCapabilities() tag: 
0xFB3, usb:072f/2200:libudev:0:/dev/bus/usb/001/005 (lun: 0)
00000036 [281473190051136] readerfactory.c:394:RFAddReader() Using the 
reader polling thread
00000417 [281473190051136] ifdhandler.c:390:IFDHGetCapabilities() tag: 
0xFAE, usb:072f/2200:libudev:0:/dev/bus/usb/001/005 (lun: 0)
00000050 [281473190051136] ifdhandler.c:473:IFDHGetCapabilities() Reader 
supports 1 slot(s)
02751965 [281473198443840] ifdhandler.c:1233:IFDHPowerICC() action: 
PowerUp, usb:072f/2200:libudev:0:/dev/bus/usb/001/005 (lun: 0)
00000281 [281473198443840] eventhandler.c:406:EHStatusHandlerThread() 
powerState: POWER_STATE_POWERED
00000071 [281473198443840] eventhandler.c:423:EHStatusHandlerThread() 
Card inserted into ACS ACR122U PICC Interface 00 00
00000037 [281473198443840] Card ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 
03 00 01 00 00 00 00 6A
00390039 [281473198443840] eventhandler.c:482:EHStatusHandlerThread() 
powerState: POWER_STATE_UNPOWERED
00000200 [281473198443840] eventhandler.c:358:EHStatusHandlerThread() 
Card Removed From ACS ACR122U PICC Interface 00 00
```

Do you have tips or ideas why it doesn't work at a first boot?

Thanks,
Valentin Geffroy

-- 
Valentin Geffroy - Embedded Engineer at IoT.bzh
valentin.geffroy at iot.bzh - https://iot.bzh




From valentin.geffroy at iot.bzh  Tue Jan 23 08:00:17 2024
From: valentin.geffroy at iot.bzh (Valentin Geffroy)
Date: Tue, 23 Jan 2024 17:00:17 +0100
Subject: [Pcsclite-muscle] ACR122U NFC Card Reader
Message-ID: <4cffe0c6-fc3b-4ac0-9a63-1929a4cc4be9@iot.bzh>

Hello,

We've noticed an issue on the ACR122U NFC Card Reader. When its is 
connected to a Linux based embedded board (using your reader with libusb 
& pscsd 2.0.1 / ccid 1.5.5), the reader is not detected by the pcscd 
daemon.

It works when we unplugged/plugged the reader again.

After a boot:

```
00000095 [281473221880224] ccid_usb.c:750:OpenUSBByName() Using USB 
bus/device: 1/3
00000022 [281473221880224] ccid_usb.c:814:OpenUSBByName() 
bNumDataRatesSupported is 0
00173126 [281473221880224] ccid_usb.c:1071:ReadUSB() read failed (1/3): 
LIBUSB_ERROR_TIMEOUT
00055909 [281473221880224] ccid_usb.c:1095:ReadUSB() Invalid frame detected
00116065 [281473221880224] ccid_usb.c:1071:ReadUSB() read failed (1/3): 
LIBUSB_ERROR_TIMEOUT
00000109 [281473221880224] 
ifdhandler.c:203:CreateChannelByNameOrChannel() failed
00000184 [281473221880224] ccid_usb.c:208:close_libusb_if_needed() 
libusb_exit
00004089 [281473221880224] readerfactory.c:1136:RFInitializeReader() 
Open Port 0x200000 Failed (usb:072f/2200:libudev:0:/dev/bus/usb/001/003)
00000086 [281473221880224] readerfactory.c:374:RFAddReader() ACS ACR122U 
PICC Interface init failed.
00000024 [281473221880224] readerfactory.c:624:RFRemoveReader() 
UnrefReader() count was: 1
00000014 [281473221880224] readerfactory.c:1149:RFUnInitializeReader() 
Attempting shutdown of ACS ACR122U PICC Interface 00 00.
```

After unplug/plug the reader :

```
00049715 [281473190051136] ifdhandler.c:390:IFDHGetCapabilities() tag: 
0xFB3, usb:072f/2200:libudev:0:/dev/bus/usb/001/005 (lun: 0)
00000036 [281473190051136] readerfactory.c:394:RFAddReader() Using the 
reader polling thread
00000417 [281473190051136] ifdhandler.c:390:IFDHGetCapabilities() tag: 
0xFAE, usb:072f/2200:libudev:0:/dev/bus/usb/001/005 (lun: 0)
00000050 [281473190051136] ifdhandler.c:473:IFDHGetCapabilities() Reader 
supports 1 slot(s)
02751965 [281473198443840] ifdhandler.c:1233:IFDHPowerICC() action: 
PowerUp, usb:072f/2200:libudev:0:/dev/bus/usb/001/005 (lun: 0)
00000281 [281473198443840] eventhandler.c:406:EHStatusHandlerThread() 
powerState: POWER_STATE_POWERED
00000071 [281473198443840] eventhandler.c:423:EHStatusHandlerThread() 
Card inserted into ACS ACR122U PICC Interface 00 00
00000037 [281473198443840] Card ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 
03 00 01 00 00 00 00 6A
00390039 [281473198443840] eventhandler.c:482:EHStatusHandlerThread() 
powerState: POWER_STATE_UNPOWERED
00000200 [281473198443840] eventhandler.c:358:EHStatusHandlerThread() 
Card Removed From ACS ACR122U PICC Interface 00 00
```

Do you have tips or ideas why it doesn't work at a first boot?

Thanks,
Valentin Geffroy

-- 
Valentin Geffroy - Embedded Engineer at IoT.bzh
valentin.geffroy at iot.bzh - https://iot.bzh




From fulup.arfoll at iot.bzh  Wed Jan 24 02:38:02 2024
From: fulup.arfoll at iot.bzh (Fulup Le Foll)
Date: Wed, 24 Jan 2024 11:38:02 +0100
Subject: [Pcsclite-muscle] ACR122U LIBUSB_ERROR_TIMEOUT
Message-ID: <488c3e9f-c733-46b1-ac3f-a046018eb42f@iot.bzh>

Hi,

I confirm that the issue describe yesterday by Valentin is easily 
reproducible. Here after the log on my laptop

Fedora-39
 ?- pcsc-lite-2.0.0
 ?- ccid-1.5.4

To reproduce:
 ?1) plug the reader ACR122U
 ?2) pcscd -d -f

Because of this bug, the reader is not visible after a boot and have to 
be unplug/plug to work. I tried to increase USB read timeout at 
ccid_usb.c:1023 with not success.

Any idea more than welcome.

Fulup

Log when reader is plug before starting pcscd (boot configuration)

00000002 [140146565136192] readerfactory.c:1089:RFInitializeReader() 
Attempting startup of ACS ACR122U PICC Interface 01 00 using 
/usr/local/lib64/pcsc/drivers/ifd-ccid.bundle/Contents/Linux/libccid.so
00000002 [140146565136192] readerfactory.c:877:RFLoadReader() Reusing 
already loaded driver for 
/usr/local/lib64/pcsc/drivers/ifd-ccid.bundle/Contents/Linux/libccid.so
00000007 [140146565136192] readerfactory.c:964:RFBindFunctions() Loading 
IFD Handler 3.0
00000010 [140146565136192] 
ifdhandler.c:111:CreateChannelByNameOrChannel() Lun: 10000, device: 
usb:072f/2200:libudev:0:/dev/bus/usb/001/026
00000007 [140146565136192] ccid_usb.c:327:OpenUSBByName() Using: 
/usr/local/lib64/pcsc/drivers/ifd-ccid.bundle/Contents/Info.plist
00000509 [140146565136192] ccid_usb.c:345:OpenUSBByName() 
ifdManufacturerString: Ludovic Rousseau (ludovic.rousseau at free.fr)
00000004 [140146565136192] ccid_usb.c:346:OpenUSBByName() 
ifdProductString: Generic CCID driver
00000003 [140146565136192] ccid_usb.c:347:OpenUSBByName() Copyright: 
This driver is protected by terms of the GNU Lesser General Public 
License version 2.1, or (at your option) any later version.
00000261 [140146565136192] ccid_usb.c:699:OpenUSBByName() Found 
Vendor/Product: 072F/2200 (ACS ACR122U PICC Interface)
00000003 [140146565136192] ccid_usb.c:701:OpenUSBByName() Using USB 
bus/device: 1/26
00000002 [140146565136192] ccid_usb.c:774:OpenUSBByName() 
bNumDataRatesSupported is 0
00168577 [140146565136192] ccid_usb.c:1023:ReadUSB() read failed (1/26): 
LIBUSB_ERROR_TIMEOUT
00055355 [140146565136192] ccid_usb.c:1050:ReadUSB() Invalid frame detected
00102643 [140146565136192] ccid_usb.c:1023:ReadUSB() read failed (1/26): 
LIBUSB_ERROR_TIMEOUT
00000046 [140146565136192] 
ifdhandler.c:203:CreateChannelByNameOrChannel() failed
00000335 [140146565136192] readerfactory.c:1130:RFInitializeReader() 
Open Port 0x200001 Failed (usb:072f/2200:libudev:0:/dev/bus/usb/001/026)

Unplug/Plug the reader and it works (hot plug case)

00000009 [140146539697856] ccid_usb.c:346:OpenUSBByName() 
ifdProductString: Generic CCID driver
00000006 [140146539697856] ccid_usb.c:347:OpenUSBByName() Copyright: 
This driver is protected by terms of the GNU Lesser General Public 
License version 2.1, or (at your option) any later version.
00000324 [140146539697856] ccid_usb.c:699:OpenUSBByName() Found 
Vendor/Product: 072F/2200 (ACS ACR122U PICC Interface)
00000006 [140146539697856] ccid_usb.c:701:OpenUSBByName() Using USB 
bus/device: 1/27
00000004 [140146539697856] ccid_usb.c:774:OpenUSBByName() 
bNumDataRatesSupported is 0

03106232 [140146539697856] ccid_usb.c:1023:ReadUSB() read failed (1/27): 
LIBUSB_ERROR_TIMEOUT
00001974 [140146539697856] ccid_usb.c:1050:ReadUSB() Invalid frame detected
00049533 [140146539697856] ifdhandler.c:389:IFDHGetCapabilities() tag: 
0xFB3, usb:072f/2200:libudev:0:/dev/bus/usb/001/027 (lun: 10000)
00000043 [140146539697856] readerfactory.c:394:RFAddReader() Using the 
reader polling thread
00000604 [140146539697856] ifdhandler.c:389:IFDHGetCapabilities() tag: 
0xFAE, usb:072f/2200:libudev:0:/dev/bus/usb/001/027 (lun: 10000)
00000025 [140146539697856] ifdhandler.c:496:IFDHGetCapabilities() Reader 
supports 1 slot(s)

With recompiled version of CCID and timeout*5

000261 [140146565136192] ccid_usb.c:699:OpenUSBByName() Found 
Vendor/Product: 072F/2200 (ACS ACR122U PICC Interface)
00000003 [140146565136192] ccid_usb.c:701:OpenUSBByName() Using USB 
bus/device: 1/26
00000002 [140146565136192] ccid_usb.c:774:OpenUSBByName() 
bNumDataRatesSupported is 0
00168577 [140146565136192] ccid_usb.c:1023:ReadUSB() read failed (1/26): 
LIBUSB_ERROR_TIMEOUT
00055355 [140146565136192] ccid_usb.c:1050:ReadUSB() Invalid frame detected
00102643 [140146565136192] ccid_usb.c:1023:ReadUSB() read failed (1/26): 
LIBUSB_ERROR_TIMEOUT
00000046 [140146565136192] 
ifdhandler.c:203:CreateChannelByNameOrChannel() failed
00000335 [140146565136192] readerfactory.c:1130:RFInitializeReader() 
Open Port 0x200001 Failed (usb:072f/2200:libudev:0:/dev/bus/usb/001/026)
00000033 [140146565136192] readerfactory.c:374:RFAddReader() ACS ACR122U 
PICC Interface init failed.
00000028 [140146565136192] readerfactory.c:624:RFRemoveReader() 
UnrefReader() count was: 1
00000019 [140146565136192] readerfactory.c:1143:RFUnInitializeReader() 
Attempting shutdown of ACS ACR122U PICC Interface 01 00.
00000035 [140146565136192] hotplug_libudev.c:516:HPAddDevice() Failed 
adding USB device: ACS ACR122U PICC Interface



On 19/01/2024 14:49, Valentin Geffroy wrote:
 > Hello,
 >
 > We've noticed an issue on the ACR122U NFC Card Reader. When its is 
connected to a Linux based embedded board (using your reader with libusb 
& pscsd 2.0.1 / ccid 1.5.5), the reader is not detected by the pcscd daemon.
 >
 > It works when we unplugged/plugged the reader again.
 >
 > After a boot:
 >
 >

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.infradead.org/pipermail/pcsclite-muscle/attachments/20240124/ee9190e9/attachment.sig>

From ludovic.rousseau at gmail.com  Wed Jan 24 12:42:17 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Wed, 24 Jan 2024 21:42:17 +0100
Subject: [Pcsclite-muscle] polkit and gdm
Message-ID: <CAGstE8DX7EmA_0BC04MLbB8DwCUgj3d2gbDq3euyAmjVirOubA@mail.gmail.com>

Hello,

I just received a new Debian bug report "Bug#1061444: pcscd: GDM user
is NOT authorized for action: access_pcsc"
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061444

Since pcsc-lite 2.0.1 poklit is enabled by default. This is the case
in the Debian package since this version released in November 2023.
https://blog.apdu.fr/posts/2023/11/pcsc-lite-and-polkit/

>From the Debian bug report:
" When looking at the logs of pcscd, I see the following messages:

jan 22 09:47:37 edoras pcscd[1663]: 00000000
auth.c:125:IsClientAuthorized() Error in authorization:
GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Process not found
jan 22 09:47:37 edoras pcscd[1663]: 00000031
auth.c:143:IsClientAuthorized() Process 1565 (user: 115) is NOT
authorized for action: access_pcsc

It seems that GDM is not allowed to talk to pcscd.

GDM has the functionality to detect whether there is a smartcard in the
reader and then use the gdm-smartcard PAM service instead of the
gdm-password one to perform login.

I guess that GDM should be whitelisted to allow it to use pcscd? "

Red Hat has polkit enabled in pcsc-lite since a long time.
I had a look at RHEL 8.6 to see how the system is configured.

- pcsc-lite package is provided with the default polkit rule fine
https://github.com/LudovicRousseau/PCSC/blob/master/doc/org.debian.pcsc-lite.policy

- gdm provides a polkit rule file
/usr/share/polkit-1/rules.d/org.gnome.gdm.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.network-control" &&
        subject.user == "gdm") {
            return polkit.Result.NO;
    }

    return polkit.Result.NOT_HANDLED;
});
So nothing to do with pcsc-lite.

My question: how is gdm-smartcard working on Red Hat?

I could add a polkit rule file in the pcscd Debian package to give
access to Debian-gdm user.
But maybe it is a better idea to add the polkit rule file in gdm
package since that is gdm that is requesting access to pcsc.

What do you think?
What do other GNU/Linux distributions do?

Thanks

-- 
 Dr. Ludovic Rousseau


From ludovic.rousseau at gmail.com  Mon Jan 29 13:33:28 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Mon, 29 Jan 2024 22:33:28 +0100
Subject: [Pcsclite-muscle] ACR122U NFC Card Reader
In-Reply-To: <46be2604-5fb9-404a-981b-293c865535d2@iot.bzh>
References: <46be2604-5fb9-404a-981b-293c865535d2@iot.bzh>
Message-ID: <CAGstE8Cf+xK9LTUYJ1gz1rBCY9ckCKEBFaNfs5f06RTkayH9tw@mail.gmail.com>

Le ven. 19 janv. 2024 ? 15:49, Valentin Geffroy
<valentin.geffroy at iot.bzh> a ?crit :
>
> Hello,

Hello,

Sorry for the delay. Your emails was in the gmail.com spam folder.

> We've noticed an issue on the ACR122U NFC Card Reader. When its is
> connected to a Linux based embedded board (using your reader with libusb
> & pscsd 2.0.1 / ccid 1.5.5), the reader is not detected by the pcscd daemon.
>
> It works when we unplugged/plugged the reader again.
>
> After a boot:
>
> ```
> 00000095 [281473221880224] ccid_usb.c:750:OpenUSBByName() Using USB
> bus/device: 1/3
> 00000022 [281473221880224] ccid_usb.c:814:OpenUSBByName()
> bNumDataRatesSupported is 0
> 00173126 [281473221880224] ccid_usb.c:1071:ReadUSB() read failed (1/3):
> LIBUSB_ERROR_TIMEOUT
> 00055909 [281473221880224] ccid_usb.c:1095:ReadUSB() Invalid frame detected

Invalid frame detected is the problem

> Do you have tips or ideas why it doesn't work at a first boot?

Generate a new trace as described in https://ccid.apdu.fr/#support

Bye

-- 
 Dr. Ludovic Rousseau


