[PATCH 20/27] hw/usb/dev-smartcard-reader: zero bChainParameter in DataBlock responses
Marc-André Lureau <[email protected]> Wed, 05 Aug 2026 15:51:10 +0400
| Newsgroups | gmane.comp.emulators.qemu |
|---|---|
| Message-ID | <[email protected]> |
ccid_write_data_block() initializes every CCID_DataBlock field except bChainParameter. Since bulk-in buffers are reused without zeroing, a stale non-zero value can make the guest CCID driver misinterpret a complete response as chained. This device never chains responses, so set bChainParameter to 00h as required by CCID Rev 1.1 section 6.2.1 for TPDU-level exchange. Signed-off-by: Marc-André Lureau <[email protected]> --- hw/usb/dev-smartcard-reader.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index cc7356c77413..208a14dbd1b3 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -848,6 +848,7 @@ static bool ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t seq, p->b.hdr.bSeq = seq; p->b.bStatus = ccid_calc_status(s); p->b.bError = s->bError; + p->bChainParameter = 0; if (p->b.bError) { DPRINTF(s, D_VERBOSE, "error %d\n", p->b.bError); } -- 2.55.0