This fixes three bugs with the ati_set_dirty address calculation.

First, vbe_start_addr is a word offset. All other values in the
calculation are byte offsets. It must be converted to bytes.

Second, when setting the dirty region with memory_region_set_dirty
the vbe_start_addr is used to calculate the start of the dirty region.
This is a problem because the vbe_start_addr is the offset at which scan out
begins. This puts it in the visible screen coordinate system. The dirty
region however is in the virtual screen coordinate system. This can cause both
overmarking and missed updates. This is removed from the calculation.

Third, when the start address of a blit is outside of the bounds check
the entire blit is missed and not set to dirty. This happens even if the
blit does partially overlap with the visible screen. The fix here is to
find the intersection of the visible screen and the blit and mark only
that region as dirty.

This does not attempt to apply clipping to the blit. So there will be
overmarking in some cases.

Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
---
 hw/display/ati_2d.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
index 504d1c5708..3192b864fd 100644
--- a/hw/display/ati_2d.c
+++ b/hw/display/ati_2d.c
@@ -69,19 +69,31 @@ typedef struct {
 static void ati_set_dirty(VGACommonState *vga, const ATI2DCtx *ctx)
 {
     DisplaySurface *ds = qemu_console_surface(vga->con);
+    unsigned int bypp = ctx->bpp / 8;
+    unsigned long dirty_size = ((ctx->dst.height - 1) * ctx->dst_stride) +
+                               (ctx->dst.width * bypp);
+    uint8_t *dirty_start = ctx->dst_bits + (ctx->dst.y * ctx->dst_stride) +
+                           (ctx->dst.x * bypp);
+    uint8_t *dirty_end = dirty_start + dirty_size;
+    /*
+     * The blit may be outside of the visible screen (e.g. virtual desktops.)
+     * Dirty only the intersection of the visible screen and the blit.
+     */
+    uint8_t *vis_start = vga->vram_ptr + (vga->vbe_start_addr * 4);
+    uint8_t *vis_end = vis_start + vga->vbe_regs[VBE_DISPI_INDEX_YRES] *
+                       vga->vbe_line_offset;
+    uint8_t *start = MAX(vis_start, dirty_start);
+    uint8_t *end = MIN(vis_end, dirty_end);
 
     (void)ds;
     DPRINTF("%p %u ds: %p %d %d rop: %x\n", vga->vram_ptr, vga->vbe_start_addr,
             surface_data(ds), surface_stride(ds), surface_bits_per_pixel(ds),
             ctx->rop3 >> 16);
-    if (ctx->dst_bits >= vga->vram_ptr + vga->vbe_start_addr &&
-        ctx->dst_bits < vga->vram_ptr + vga->vbe_start_addr +
-        vga->vbe_regs[VBE_DISPI_INDEX_YRES] * vga->vbe_line_offset) {
-        memory_region_set_dirty(&vga->vram,
-                                vga->vbe_start_addr + ctx->dst_offset +
-                                ctx->dst.y * ctx->dst_stride,
-                                ctx->dst.height * ctx->dst_stride);
+
+    if (start >= end) {
+        return;
     }
+    memory_region_set_dirty(&vga->vram, start - vga->vram_ptr, end - start);
 }
 
 static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2DCtx *ctx)
-- 
2.53.0

On Wed, 29 Apr 2026, Chad Jablonski wrote:
> This fixes three bugs with the ati_set_dirty address calculation.

Good catch, thanks for finding this.

> First, vbe_start_addr is a word offset. All other values in the
> calculation are byte offsets. It must be converted to bytes.
>
> Second, when setting the dirty region with memory_region_set_dirty
> the vbe_start_addr is used to calculate the start of the dirty region.
> This is a problem because the vbe_start_addr is the offset at which scan out
> begins. This puts it in the visible screen coordinate system. The dirty
> region however is in the virtual screen coordinate system. This can cause both
> overmarking and missed updates. This is removed from the calculation.
>
> Third, when the start address of a blit is outside of the bounds check
> the entire blit is missed and not set to dirty. This happens even if the
> blit does partially overlap with the visible screen. The fix here is to
> find the intersection of the visible screen and the blit and mark only
> that region as dirty.
>
> This does not attempt to apply clipping to the blit. So there will be
> overmarking in some cases.
>
> Signed-off-by: Chad Jablonski <chad@jablonski.xyz>
> ---
> hw/display/ati_2d.c | 26 +++++++++++++++++++-------
> 1 file changed, 19 insertions(+), 7 deletions(-)
>
> diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
> index 504d1c5708..3192b864fd 100644
> --- a/hw/display/ati_2d.c
> +++ b/hw/display/ati_2d.c
> @@ -69,19 +69,31 @@ typedef struct {
> static void ati_set_dirty(VGACommonState *vga, const ATI2DCtx *ctx)
> {
>     DisplaySurface *ds = qemu_console_surface(vga->con);
> +    unsigned int bypp = ctx->bpp / 8;
> +    unsigned long dirty_size = ((ctx->dst.height - 1) * ctx->dst_stride) +
> +                               (ctx->dst.width * bypp);

dirty_size is only used once below for dirty_end so maybe it does not need 
a separate variable just do the calculation on one line similar to 
vis_end and inline this in dirty_end.

> +    uint8_t *dirty_start = ctx->dst_bits + (ctx->dst.y * ctx->dst_stride) +
> +                           (ctx->dst.x * bypp);
> +    uint8_t *dirty_end = dirty_start + dirty_size;
> +    /*
> +     * The blit may be outside of the visible screen (e.g. virtual desktops.)
> +     * Dirty only the intersection of the visible screen and the blit.
> +     */
> +    uint8_t *vis_start = vga->vram_ptr + (vga->vbe_start_addr * 4);

There are excessive parenthesis in above formulas, these are not needed 
around multiplications. I see the intent but it's not usually done in 
QEMU so these could be dropped.

Instead of adding vga->vram_ptr here and then substracting it in 
memory_region_set_dirty below again maybe keep these offsets and substract 
vga->vram_ptr from ctx->dst_bits in dirty_start once instead.

> +    uint8_t *vis_end = vis_start + vga->vbe_regs[VBE_DISPI_INDEX_YRES] *
> +                       vga->vbe_line_offset;
> +    uint8_t *start = MAX(vis_start, dirty_start);
> +    uint8_t *end = MIN(vis_end, dirty_end);
>
>     (void)ds;
>     DPRINTF("%p %u ds: %p %d %d rop: %x\n", vga->vram_ptr, vga->vbe_start_addr,
>             surface_data(ds), surface_stride(ds), surface_bits_per_pixel(ds),
>             ctx->rop3 >> 16);
> -    if (ctx->dst_bits >= vga->vram_ptr + vga->vbe_start_addr &&
> -        ctx->dst_bits < vga->vram_ptr + vga->vbe_start_addr +
> -        vga->vbe_regs[VBE_DISPI_INDEX_YRES] * vga->vbe_line_offset) {
> -        memory_region_set_dirty(&vga->vram,
> -                                vga->vbe_start_addr + ctx->dst_offset +
> -                                ctx->dst.y * ctx->dst_stride,
> -                                ctx->dst.height * ctx->dst_stride);
> +
> +    if (start >= end) {
> +        return;
>     }
> +    memory_region_set_dirty(&vga->vram, start - vga->vram_ptr, end - start);

I'm never sure about sizes and off by one errors so can't tell if that's 
correct but I've tested it and it still fixes my reproducer so this seems 
to work. Please also cc qemu-stable for the next version of the patch.

Regards,
BALATON Zoltan

> }
>
> static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2DCtx *ctx)
>