The virtio-1.3 specification
<https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html> writes:
2.8.6 Next Flag: Descriptor Chaining
      Buffer ID is included in the last descriptor in the list.

If the feature (_F_INDIRECT_DESC) has been negotiated, install only
one descriptor in the virtqueue.
Therefor the buffer id should be obtained from the first descriptor.

In descriptor chaining scenarios, the buffer id should be obtained
from the last descriptor.

Fixes: 86044b24e8 ("virtio: basic packed virtqueue support")

Signed-off-by: Wafer <wafer@jaguarmicro.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>

--
Changes in v3:
 - Add Acked-by Jason Wang

Changes in v2:
 - Use Jason suggestion: Move the code out of the loop.
---
 hw/virtio/virtio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 871674f9be..e9e8447878 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -1744,6 +1744,11 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
                                              &indirect_desc_cache);
     } while (rc == VIRTQUEUE_READ_DESC_MORE);
 
+    if (desc_cache != &indirect_desc_cache) {
+        /* Buffer ID is included in the last descriptor in the list. */
+        id = desc.id;
+    }
+
     /* Now copy what we have collected and mapped */
     elem = virtqueue_alloc_element(sz, out_num, in_num);
     for (i = 0; i < out_num; i++) {
-- 
2.27.0

Ping :)

> -----Original Message-----
> From: Wafer
> Sent: 2024/05/10  15:29
> To: eperezma@redhat.com; mst@redhat.com; jasowang@redhat.com
> Cc: qemu-devel@nongnu.org; Angus Chen <angus.chen@jaguarmicro.com>;
> Wafer <wafer@jaguarmicro.com>
> Subject: [PATCH v3] hw/virtio: Fix obtain the buffer id from the last
> descriptor
> 
> The virtio-1.3 specification
> <https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html> writes:
> 2.8.6 Next Flag: Descriptor Chaining
>       Buffer ID is included in the last descriptor in the list.
> 
> If the feature (_F_INDIRECT_DESC) has been negotiated, install only one
> descriptor in the virtqueue.
> Therefor the buffer id should be obtained from the first descriptor.
> 
> In descriptor chaining scenarios, the buffer id should be obtained from the
> last descriptor.
> 
> Fixes: 86044b24e8 ("virtio: basic packed virtqueue support")
> 
> Signed-off-by: Wafer <wafer@jaguarmicro.com>
> Reviewed-by: Jason Wang <jasowang@redhat.com>
> Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
> Acked-by: Jason Wang <jasowang@redhat.com>
> 
> --
> Changes in v3:
>  - Add Acked-by Jason Wang
> 
> Changes in v2:
>  - Use Jason suggestion: Move the code out of the loop.
> ---
>  hw/virtio/virtio.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index
> 871674f9be..e9e8447878 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -1744,6 +1744,11 @@ static void *virtqueue_packed_pop(VirtQueue
> *vq, size_t sz)
>                                               &indirect_desc_cache);
>      } while (rc == VIRTQUEUE_READ_DESC_MORE);
> 
> +    if (desc_cache != &indirect_desc_cache) {
> +        /* Buffer ID is included in the last descriptor in the list. */
> +        id = desc.id;
> +    }
> +
>      /* Now copy what we have collected and mapped */
>      elem = virtqueue_alloc_element(sz, out_num, in_num);
>      for (i = 0; i < out_num; i++) {
> --
> 2.27.0