Configure USB redirection

USB devices are shared between Citrix Workspace app and the Linux VDA desktop. When a USB device is redirected to the desktop, the user can use the USB device as if it were locally connected.

USB redirection includes three main areas of functionality:

  • Open-source project implementation (VHCI)
  • VHCI service
  • USB service

Open-source VHCI:

This portion of the USB redirection feature develops a general USB device sharing system over an IP network. It consists of a Linux kernel driver and some user mode libraries that allow you to communicate with the kernel driver to get all the USB data. In the Linux VDA implementation, Citrix reuses the kernel driver of VHCI. However, all the USB data transfers between the Linux VDA and Citrix Workspace app are encapsulated in the Citrix ICA protocol package.

VHCI service:

The VHCI service is an open-source service provided by Citrix to communicate with the VHCI kernel module. This service works as a gateway between VHCI and the Citrix USB service.

USB service:

The USB service represents a Citrix module that manages all the virtualization and data transfers on the USB device.

How USB redirection works

Typically, if a USB device is redirected successfully to the Linux VDA, one or more device nodes are created in the system /dev path. Sometimes, however, the redirected device is not usable for an active Linux VDA session. USB devices rely on drivers to function properly and some devices require special drivers. If drivers are not provided, the redirected USB devices are inaccessible to the active Linux VDA session. To ensure USB device connectivity, install the drivers and configure the system properly.

The Linux VDA supports a list of USB devices that are successfully redirected to and from the client. In addition, the device is properly mounted, especially the USB disk, allowing the user to access the disk without any additional configuration.

Supported USB devices

The following devices have been verified to support this version of the Linux VDA. Other devices might be freely used, with unexpected results:

Note:

The Linux VDA supports only USB 2.0 protocols.

USB mass storage device VID:PID File system
Netac Technology Co., Ltd 0dd8:173c FAT32
Kingston Datatraveler 101 II 0951:1625 FAT32
Kingston Datatraveler GT101 G2 1567:8902 FAT32
SanDisk SDCZ80 flash drive 0781:5580 FAT32
SanDisk Cruzer 16 GB 1058:10B8 FAT32
WD HDD 0781:5567 FAT32
USB 3D mouse VID:PID
3DConnexion SpaceMouse Pro 046d: c62b
USB scanner VID:PID
Epson Perfection V330 photo 04B8: 0142

Configure USB redirection

A Citrix policy controls whether USB device redirection is enabled or disabled. In addition, the type of device can also be specified using a Delivery Controller policy. When configuring USB redirection for the Linux VDA, configure the following policy and rules:

  • Client USB device redirection policy
  • Client USB device redirection rules

Enable USB redirection policy

In Citrix Studio, enable (or disable) USB device redirection to and from the client (for workstation hosts only).

In the Edit Setting dialog:

  1. Select Allowed.
  2. Click OK.

Image of enabling USB redirection

Set USB redirection rules

After enabling the USB redirection policy, set redirection rules using Citrix Studio by specifying which devices are allowed (or denied) on the Linux VDA.

In the Client USB device redirection rules dialog:

  1. Click New to add a redirection rule, or click Edit to review an existing rule.
  2. After creating (or editing) a rule, click OK.

Image of client USB redirection rule setting

For more information about configuring generic USB redirection, see Citrix Generic USB Redirection Configuration Guide.

Build the VHCI kernel module

USB redirection depends on the VHCI kernel modules (usb-vhci-hcd.ko and usb-vhci-iocif.ko). These modules are part of the Linux VDA distribution (as part of the RPM package). They are compiled based on the official Linux distribution kernels and are noted in the following table:

Supported Linux distribution Kernel version
RHEL 7.7, CentOS 7.7 3.10.0-1062
SUSE 12.3 4.4.73-5-default
Ubuntu 18.04 4.15.0-45-generic
Ubuntu 16.04 4.4.0-142-generic

Important:

If the kernel of your machine is not compatible with the driver built for the Linux VDA, the USB service might fail to start. In this case, you can use the USB redirection feature only if you build your own VHCI kernel modules.

Verify whether your kernel is consistent with the modules built by Citrix

On the command line, run the following command to verify whether the kernel is consistent:

insmod /opt/Citrix/VDA/lib64/usb-vhci-hcd.ko

If the command runs successfully, the kernel module has loaded successfully and the version is consistent with the one installed by Citrix.

If the command runs with errors, the kernel is inconsistent with the Citrix module and must be rebuilt.

Rebuild the VHCI kernel module

If your kernel module is inconsistent with the Citrix version, do the following:

  1. Download the LVDA source code from the Citrix download site. Select the file contained in the section “Linux Virtual Delivery Agent (sources).”

  2. Unzip the citrix-linux-vda-sources.zip file. Navigate to linux-vda-souces/vhci-hcd-1.15.tar.bz2 and unzip the VHCI source files by using tar xvf vhci-hcd-1.15.tar.bz2.

  3. Build the kernel module based on the header files and the Module.symvers file. Use the following steps to install the kernel header files and create Module.symvers based on the appropriate Linux distribution:

    RHEL/CentOS:

    yum install kernel-devel
    

    SUSE 12:

    zypper install kernel-devel
    
    zypper install kernel-source
    

    Ubuntu:

    apt-get install linux-headers
    

    Tip:

    If the installation is successful, there is a kernel folder resembling:

    /usr/src/kernels/3.10.0-327.10.1.el7.x86_64

  4. In the /usr/src/kernels/3.10.0-327.10.1.el7.x86_64 folder, verify that the Module.symvers file is present. If this file is not in the folder, build the kernel (by running the following commands in sequence: make oldconfig; make prepare; make modules; make) to get this file or copy it from /usr/src/kernels/3.10.0-327.10.1.el7.x86_64-obj/x86_64/defaults/module.*

  5. Run the following commands to install the development tools.

    RHEL/CentOS:

    yum groupinstall 'Development Tools'
    

    Ubuntu 18.04:

    apt install build-essential
    apt install libelf-dev
    

    Ubuntu 16.04:

    apt install build-essential
    
  6. In the vhci-hcd-1.15/Makefile file, change the Makefile of VCHI and set KDIR to the kernel directory:

    #KDIR = $(BUILD_PREFIX)/lib/modules/$(KVERSION)/build
    
    KDIR = /usr/src/kernels/3.10.0-327.10.1.el7.x86_64
    
  7. In the vhci-hcd-1.15/ folder, run make to build the VHCI kernel.

    Note:

    If the build was successful, usb-vhci-hcd.ko and usb-vhci-iocifc.ko are created in the vhci-hcd-1.15/ folder.

  8. Replace the kernel module with the newly built one: cp -f usb-vhci-*.ko /opt/Citrix/VDA/lib64/

  9. Restart the USB service:

    service ctxusbsd restart
    
  10. Log off and back on to the session again. Check whether USB redirection is functioning.

Troubleshoot kernel building issues

  • A kernel building error might occur on specific kernels of Ubuntu 16. The error reads implicit declaration of function ‘copy\_to\_user’, see the following screen capture.

    Image of the implicit declaration of function error

    The error occurs due to header file changes in the kernels. As a workaround, add the #include <linux/uaccess.h> line to the vhci-hcd-1.15/usb-vhci-iocifc.c file.

    Image of adding a line for fixing a kernel building error

  • A kernel building error might occur on kernel 4.15.0-29-generic of Ubuntu 16. The error reads ‘driver\_attr\_debug_output’ undeclared, see the following screen capture.

    Image of the undeclared kernel building error

    The error occurs when symbols are missing on the kernel. As a workaround, disable the macro definition for DEBUG in the vhci-hcd-1.15/usb-vhci-iocifc.c and vhci-hcd-1.15/usb-vhci-hcd.c files.

    image of disabling macro

Troubleshoot USB redirection issues

Use the information in this section to troubleshoot various issues that you might encounter when using the Linux VDA.

Unable to unmount the redirected USB disk**

For the access control of all USB disks redirected from Citrix Workspace app, the Linux VDA manages all these devices under administrative privilege to ensure that only the owner can access the redirected device. As a result, the user cannot unmount the device without the administrative privilege.

Image of unable to unmount a device

File lost when you stop redirecting a USB disk

If you redirect a USB disk to a session and try to modify it (for example, create some files on the disk), then stop redirecting it immediately using the toolbar of Citrix Workspace app, the file you modified or created can be lost. This issue occurs because when you write data to a file system, the system mounts the memory cache in the file system. The data is not written to the disk itself. If you stop redirecting using the toolbar of Citrix Workspace app, there is no time remaining for the data being flushed to the disk, which results in lost data. To resolve this issue, use the sync command in a terminal to flush data to the disk before stopping USB redirection.

Image of file lost when you stop redirecting a USB disk

No devices in the toolbar of Citrix Workspace app

Sometimes, you might not be able to see devices listed in the toolbar of Citrix Workspace app, which indicates that no USB redirection is taking place. If you encounter the issue, verify the following:

  • The policy is configured to allow USB redirection
  • The Kernel module is compatible with your kernel

Image of the devices tab in the workspace app toolbar

Note:

The Devices tab is not available in Citrix Workspace app for Linux.

Failed redirection when USB devices can be seen in the toolbar of Citrix Workspace app, but are labeled policy restricted

When the issue occurs, do the following:

  • Configure the Linux VDA policy to enable redirection.
  • Check whether any additional policy restrictions are configured in the registry of Citrix Workspace app. Check DeviceRules in the registry path to ensure that the device is not denied access by this setting:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\GenericUSB

For more information, see Knowledge Center article How to Configure Automatic Redirection of USB Devices.

A USB device is redirected successfully, but I cannot use it in my session

Usually, only supported USB devices can be redirected. Other devices might be redirected to an active Linux VDA session too. In this case, for every redirected device, a node owned by the user is created in the system /dev path. However, it is the drivers and the configuration that determine whether the user can use the device successfully. If you find a device owned (plugged in) but inaccessible, add the device to an unrestricted policy.

Note:

In the case of USB drives, the Linux VDA configures and mounts the disk. The user (and only the owner who installed it) can access the disk without any additional configuration. This might not be the case for devices that are not in the supported device list.