How to use USB devices with a VMware vSphere virtual machine
The main function of a hypervisor is to emulate the devices used by virtual machines at the software level. Devices, such as virtual controllers, disks, DVD-ROMs, video cards, network cards, input devices, etc., are created in a virtual machine. But what if you want to connect a printer, scanner, USB flash drive, USB hard drive, USB smart card reader, security dongles, USB license keys, etc.?
For external physical devices with a USB interface, you can connect them to a virtual machine running on VMware Workstation or an ESXi host by using the USB passthrough feature. This blog post covers using this feature in VMware vSphere on ESXi hosts, including requirements and steps for connecting USB devices.
What is USB Passthrough?
VMware USB device passthrough is a feature that allows you to connect a physical USB device connected to a USB port on a physical ESXi host to a virtual machine as if the USB device was connected to a virtual machine directly. VMware passthrough is a feature available starting with ESXi 4.1.
The reasons for using passthrough for a USB device from the ESXi host to a guest operating system (OS) of a virtual machine vary. For example, if you have an older scanner or printer that does not have drivers for the latest versions of the Windows operating system. You can install the older version of Windows that supports the USB device and connect this device to a virtual machine. Another practical use of this feature is when you need to copy files from/to a USB hard drive to/from a virtual machine directly with high speed. It may happen that users need to use software protected by hardware USB license keys in virtual machines.
How USB Passthrough Works
There are three main components required for USB passthrough to work: the arbitrator, the USB controller, and the physical USB device.
The arbitrator is a dedicated service on an ESXi server. The arbitrator scans physical USB devices connected to the physical server and is responsible for routing USB device traffic between a physical host and a virtual machine. Only one virtual machine can access the USB device at a time. Access to the USB device connected to a virtual machine is blocked for other virtual machines. The USB arbitrator supports up to 15 USB controllers (vSphere 7.0). The Arbitrator service is enabled by default in ESXi.
A USB controller used on a physical ESXi server is the controller to which the physical USB ports are connected. The physical USB controller works with physical USB devices inserted into the physical USB ports on the server. USB controllers can be onboard (also called integrated and built into a chip on a motherboard) or external (implemented as PCI or PCIe cards that are inserted into the corresponding slots on a server motherboard). The onboard USB controller acts as a bridge between a USB bus and a PCIe (or PCI) bus. The onboard USB controller is physically connected via the appropriate number of PCIe lanes to a motherboard chipset.
A virtual USB controller is an emulated device created specifically for a virtual machine running on a hypervisor. A virtual USB controller interacts with a physical USB controller when a physical USB device is passed from a physical ESXi host to a guest OS in the virtual machine. The presence of a virtual USB controller is required in the VM configuration to use the USB passthrough feature in the VM. A maximum of eight virtual USB controllers can be connected to a virtual machine on an ESXi host. If you need to remove a virtual USB controller from a VM configuration, you must first remove all USB devices connected to that controller. The VMware USB driver is installed on a guest operating system after a virtual USB controller is added to the virtual machine configuration.
A physical USB device is any USB device that has a USB interface and a USB port for connecting to a computer. A maximum of 20 USB devices can be connected to a single virtual machine or ESXi host.
The USB standards and controller modes are:
- USB 2.0 and USB 1.1 (EHCI+UHCI)
- USB 3.0 (xHCI) VM hardware version 8 or higher
After you connect a physical USB device to a virtual machine using the VMware USB passthrough feature, you might need to install drivers for the connected USB device in a guest operating system.
Requirements for USB 3.0
USB 3.0 is available for ESXi servers starting with VMware vSphere 5.5 patch 3. This requires the USB xHCI driver in the VM configuration. The operating system requirements for using USB 3.0 passthrough are: Windows 8.1 or higher, Windows Server 2012 R2 or higher, or Linux with Linux kernel 2.6.35 or higher. USB 3.1 devices are supported at their full speed starting with VMware vSphere 7.0.
USB Passthrough Limitations
There are a few limitations that you should be aware of before you start using the USB passthrough feature:
- A USB drive cannot be used as a boot drive for a virtual machine.
- If a USB drive is used to boot ESXi, this USB drive cannot be connected to a virtual machine.
- Virtual hardware version 7 or higher is required for a virtual machine.
Some USB devices may not be supported by VMware:
- USB hubs
- Audio devices and video cameras that use asynchronous data transfer
- Some USB keyboards and mice (more details can be found in VMware article 1021345)
- Some smart cards that use CCID may need additional configuration to connect to a virtual machine.
vMotion is possible for VMs with USB passthrough devices connected. After you properly configure the VM and enable vMotion, USB devices remain connected to the VM after migration to another ESXi host.
There are vMotion limitations for virtual machines that use USB passthrough disks:
- Distributed Power Management (DPM) is not supported because an ESXi host cannot be powered off to save power without disconnecting a USB device from a virtual machine (a USB device is disconnected if the host is powered off using DPM). DPM should be disabled on this host.
- Fault tolerance is not supported.
- A VM cannot be suspended or powered off (otherwise, USB devices are disconnected from a VM and can only be reconnected after migration of the VM to the initial ESXi host to which the USB devices are physically connected). The VM must be manually migrated to the ESXi host with the USB device connected when you need to power on this VM. Linux guests that were resumed can mount USB devices at different mount points after reconnection.
- ESXi hosts that have virtual machines with USB passthrough devices must be accessible through the vmk0 virtual machine kernel interface (for management networking) and TCP port 902.
Disconnect USB devices from a virtual machine before using the hot-add feature and adding CPU, memory, or PCI devices. Otherwise, USB devices are automatically disconnected and some data may be lost when using the hot-add feature. If you suspend a VM and then resume it, USB devices are disconnected and then reconnected to the VM.
As for creating a VMware virtual USB drive or virtual flash drive to attach to a virtual machine running ESXi or VMware Workstation, just as you would mount a virtual floppy disk or CD/DVD disk, this option is currently not supported.
How to connect a USB device to a virtual machine
Now that we have familiarized ourselves with the theory, we can move on to the practical part and see the configuration in VMware vSphere.
- Insert a USB device into a USB port on your ESXi server. In my case, I’m going to insert a USB flash drive.
- You can then check if the USB device is connected to ESXi in the ESXi command line interface:
lsusb - As you can see in the following screenshot, my flash drive is now connected to the ESXi server.
- The USB arbiter service must be running. You can check the status of the service with the command:
chkconfig usbarbitrator --list - If the USB arbiter is stopped, you can start it with the command
/etc/init.d/usbarbitrator startNote: Read more about ESXiCLI in the blog post.
The VM resides on the ESXi host which is managed by vCenter Server in my example. Windows is installed as a guest OS on my virtual machine. Open VMware vSphere Client, go to Hosts and Clusters. In the Navigator pane select a virtual machine to which you want to connect the USB device using the passthrough feature. The virtual machine must be powered off. You must install VMware Tools on the guest OS.
- Once you have selected the virtual machine, click Actions > Edit settings.
- In the Edit Settings window, check if there is a USB controller in the virtual machine settings. If the USB controller is missing, click Add New Device > USB Controller, and select the USB controller type (USB 2.0 or USB 3.0).
- If the USB controller is present, you need to add the USB device that is connected to the ESXi host to your VM. Click Add New Device > Host USB Device.
- A new string is added to the virtual machine configuration. In the New USB Host device string, select a USB device that you want to connect to the VM. I now have two USB flash drives connected to my physical ESXi server, and I am connecting the Verbatim flash drive to my VM (Verbatim product 0x0302). If you need to enable vMotion support, expand New USB Host device and select the “Support vMotion while device is connected” checkbox. Note the vMotion requirements and limitations. Click OK to save the settings and close this window.
- Start a virtual machine. Once the guest OS is loaded, wait for it to initialize and install the USB flash drive. Next, open the Windows Device Manager. Right-click on My Computer and from the context menu, click on Manage. In the Computer Management window, click on Device Manager and expand the Disk drives section (since we connected a USB flash drive, this device should appear in this device category). We can see the Verbatim USB device, which is the name of my USB stick connected to the VM using the VMware USB Passthrough feature.
- Open Disk Management in the Computer Management window and make sure that the USB flash drive has a disk drive assigned. In my case, everything is correct, and now I can copy data from the USB flash drive to the virtual disk of a VM in the Windows guest and vice versa.
VMware PCI Passthrough
If the USB device you want to connect to a VM using the VMware USB passthrough feature is not supported by VMware, you can try using the PCI passthrough feature and connect the entire physical USB controller that has the PCI interface to a VM.
If your ESXi server has a USB controller inserted into a PCI slot, you can pass this PCI device to a virtual machine. VMware PCI passthrough is also called VMDirectPass. This method is less convenient than using USB passthrough, but it can help you accomplish the task.
Requirements
Intel Directed I/O or AMD I/O Virtualization Technology (AMD IOMMU) must be supported by the server hardware and enabled in UEFI/BIOS. If you only have one USB controller on your server, you should connect an additional USB controller to avoid losing connections to USB devices used by your physical ESXi host.
Restrictions and Limitations:
- You cannot suspend a virtual machine.
- A VM cannot be migrated to other ESXi hosts using vMotion.
- Virtual machine snapshots are not supported.
Let’s look at the workflow of connecting a USB device to a VM using PCI passthrough and connecting the entire USB controller to which a USB device is connected to a VM.
- To identify the USB device and the USB controller your USB device is connected to (if multiple USB controllers are installed on your server) use this command:
lsusb -v | grep -e Bus -e iSerial - Find the string with the name of your USB device connected to the USB controller and identify the controller id (e.g. bus002).
- You can check the VMkernel log when you connect a USB device to an ESXi server:
tail -f /var/log/vmkernel.log | grep -i USB - Open VMware vSphere Client and go to Hosts and Clusters.
- Select the ESXi host on which your virtual machine resides (to which you need to connect a USB device).
- Go to the Configure tab and select PCI Devices in the Hardware section.
- Find and select the required USB controller from the list of PCI devices using the ID you detected earlier.
- The status of the selected driver should now change to Available.
- Press OK to save the settings.
- Reboot the ESXi host for the changes to take effect.
- Make sure your virtual machine is powered off. Go to VM settings, click Add New Device > PCI device > Add. Select your USB controller from the dropdown menu using the correct ID.
- Power on the virtual machine. Check the devices in the guest OS. If Windows is installed on the virtual machine, open Device Manager and check the drivers and storage devices.
USB Smart Card Connection
Some USB devices that have the appropriate CCID class may not be supported by default for connecting to VMs. The error message “Cannot connect ‘path:0/1/6/1’ to this virtual machine. The device was not found”. In the logs, you can see the message:
(vmx-vcpu-0) did not claim interface 0 before use
PCSCD is the ESXi daemon that controls smart card readers. Access to USB smart cards is disabled for virtual machines to avoid conflicts, since an ESXi host requires a smart card. As a result, USB passthrough cannot be used with the default settings for USB smart cards. You must edit the ESXi host configuration to enable USB passthrough for USB smart cards.
- Stop the virtual machine. Open the virtual machine settings, select the VM Options tab, and click Edit Configuration.
- In the Configuration Parameters window, click Add Configuration Params.
Alternatively, you can edit the virtual machine’s VMX configuration file in the command line interface by connecting to the ESXi console with an SSH client.
- Edit or add this line to the virtual machine configuration if the parameter is not present:
usb.generic.allowCCID = "TRUE" - Save the virtual machine settings.
- Stop the PCSCD service using this command on the ESXi command line:
sudo /etc/init.d/pcscd stop - Make sure the PCSCD service is not running:
ps | grep pcscd - Power on the virtual machine and check the devices to verify that the USB smart card reader is connected to the virtual machine.
Conclusion
You can connect various devices connected to USB ports on physical ESXi hosts to virtual machines directly and use them in guest operating systems of virtual machines just like you use these USB devices on regular physical computers. You can even migrate virtual machines using external USB devices connected to the primary ESXi host with vMotion to another host. Despite some limitations, the VMware USB passthrough feature adds more capabilities and flexibility in different situations.
VMware VM backups is important for those who use VMware vSphere. Download NAKIVO Backup & Replication and try this universal data protection solution to protect your VMware vSphere virtual machines and other data in your environment.
