On 2026-08-05 13:51, Marc-André Lureau wrote:
A guest can send bulk-out commands faster than the card backend produces responses. Each XfrBlock adds a pending answer slot, and other commands immediately allocate a bulk_in_pending entry. Once all BULK_IN_PENDING_NUM slots are full, ccid_reserve_recv_buf() returns NULL and responses are silently dropped.NAK the bulk-out endpoint at message boundaries when bulk_in_pending_num + pending_answers_num >= BULK_IN_PENDING_NUM, so the guest retries later, giving the response pipeline time to drain. Change ccid_write_data_block_answer() to peek the next answer before attempting to write the data block: if the bulk-in ring is full, the pending answer is preserved for retry rather than being consumed and lost. Update ccid_flush_pending_answers() to break on failure so it does not loop forever when the ring is full. Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Signed-off-by: Marc-André Lureau <[email protected]> --- hw/usb/dev-smartcard-reader.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
