v0.5.5: fix real-hardware boot crash — shadow back in heap as first allocation

User's machine: boot reached 'rsnix: boot done — shell' then panicked
'len is 0, index 0' at the first cell write — CELLS (the vt grid) was
valid at vt::init and empty at the first shell paint, i.e. something
stomped the heap between vt::init and the shell banner.  The only
change in that window vs the working v0.5.3 was the v0.5.4 move of the
1.9 MB display shadow from the heap to the fb-aware page allocator:
on this machine's memory layout the page-allocator shadow's fill loop
(480K words) clobbered the heap's vt vectors.

- Shadow is again the *first* heap allocation, in gop::init before
  vt::init builds its grids (the v0.5.3 layout that provably boots on
  the user's hardware) — nothing else in the heap can collide with it.
- init_heap now splits the free list at the GOP framebuffer hole
  instead of subtracting its size from one block that still *spanned*
  the hole — no heap allocation of any size can land on the display.
- Kept the panic-proof try_reserve + fb-overlap rejection + no-shadow
  warning band; dropped the late init_shadow() call in main.rs.
- Verified on QEMU: shadow @ 0x1980020 origin=heap, allocated before
  vt::init, fb clean at 0x80000000; all 5 suites PASS; 0 warnings.

1 files changed, 56 insertions, 102 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 90c24bf..d37468f 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -80,8 +80,7 @@ const STAGE_MAX: usize = 96;
 /// The last boot stage string (for the panic band).
 pub fn last_boot_stage() -> alloc::string::String {
     unsafe {
-        alloc::string::String::from_utf8_lossy(&LAST_BOOT_STAGE[..LAST_BOOT_STAGE_LEN])
-            .into_owned()
+        alloc::string::String::from_utf8_lossy(&LAST_BOOT_STAGE[..LAST_BOOT_STAGE_LEN]).into_owned()
     }
 }
 
@@ -210,7 +209,7 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
     let bgr = info.pixel_format == PIXEL_BGR;
     let _ = fg;
 
-    let fb = Framebuffer {
+    let fbf = Framebuffer {
         base,
         width,
         height,
@@ -221,14 +220,8 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
         bgr,
     };
 
-    // The RAM backbuffer is allocated *after* ExitBootServices by
-    // `init_shadow()` (main.rs) — via the fb-aware page allocator so it
-    // can never land on the framebuffer (see init_shadow).  Nothing is
-    // drawn between fb.clear() here and init_shadow(), so the blank
-    // shadow is in sync with the cleared display.
-
-    // Re-stash the post-SetMode region (base can move) for the page
-    // allocator, and log the authoritative geometry for diagnostics.
+    // Re-stash the post-SetMode region (base can move) for the
+    // allocators, and log the authoritative geometry for diagnostics.
     unsafe {
         FB_REGION_BASE = mode.framebuffer_base as usize;
         FB_REGION_SIZE = mode.framebuffer_size;
@@ -244,104 +237,65 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
         bgr
     );
 
-    fb.clear();
+    fbf.clear();
 
     unsafe {
-        FB = Some(fb);
-    }
-}
-
-/// Allocate the RAM backbuffer.  Must run *after*
-/// `memory::init_page_allocator` (which excludes the GOP framebuffer
-/// pages per-page), and before any text is painted.
-///
-/// The heap (pre-ExitBootServices) is excluded from the fb region only
-/// by a coarse overlap subtraction that still leaves one contiguous
-/// free block *spanning* the fb hole — a 1.9 MB shadow allocation could
-/// therefore land *on* the framebuffer on machines where firmware
-/// reports it as ConventionalMemory.  A shadow aliased over the display
-/// makes every scroll a 1.8 MB MMIO→MMIO memcpy, which can wedge a
-/// real uncached framebuffer (a stall, not a fault — hence no dump).
-/// The page allocator marks those pages used, so the shadow can never
-/// land there.  Heap allocation is kept only as a fallback, with an
-/// explicit overlap rejection.
-pub fn init_shadow() {
+        FB = Some(fbf);
+    }
+
+    // The RAM backbuffer is the *first* heap allocation: allocated here
+    // (pre-ExitBootServices, before vt::init builds its grids) so no
+    // other heap object can collide with it — the v0.5.3 layout that
+    // provably boots on real hardware.  The heap free list excludes the
+    // fb region (init_heap splits at the fb hole) and we additionally
+    // reject any range overlapping the fb, so the shadow can never
+    // alias the display (an aliased shadow turns every scroll into a
+    // 1.8 MB MMIO→MMIO memcpy on an uncached real fb — a wedge).
+    // Allocation failure degrades to no-shadow mode, never panics.
     unsafe {
-        let Some(fb) = fb().as_ref() else {
-            return;
-        };
-        let words = (fb.pitch * fb.height) / 4;
-        if words == 0 {
-            return;
-        }
-        let bytes = words * 4;
-        let pages = bytes.div_ceil(crate::memory::PAGE_SIZE);
-        let mut origin = "none";
-
-        // Primary: fb-aware page allocator (fb pages already marked
-        // used by init_page_allocator).  Defensively refuse the range if
-        // it ever overlaps the fb region anyway.
-        if let Some(p) = crate::memory::alloc_pages(pages) {
-            let overlaps = FB_REGION_SIZE > 0
-                && p < FB_REGION_BASE + FB_REGION_SIZE
-                && p + bytes > FB_REGION_BASE;
-            if !overlaps {
-                SHADOW = p as *mut u32;
-                SHADOW_WORDS = words;
-                origin = "page-alloc";
-                for i in 0..words {
-                    *SHADOW.add(i) = fb.bg;
+        if let Some(fbinfo) = fb().as_ref() {
+            let words = (fbinfo.pitch * fbinfo.height) / 4;
+            if words > 0 {
+                let bytes = words * 4;
+                #[allow(clippy::slow_vector_initialization)] // deliberate: try_reserve must not panic
+                let mut v: alloc::vec::Vec<u32> = alloc::vec::Vec::new();
+                if v.try_reserve_exact(words).is_ok() {
+                    v.resize(words, 0); // can't fail after the reserve
+                    let p = v.as_ptr() as usize;
+                    let overlaps = FB_REGION_SIZE > 0
+                        && p < FB_REGION_BASE + FB_REGION_SIZE
+                        && p + bytes > FB_REGION_BASE;
+                    if !overlaps {
+                        SHADOW = v.as_ptr() as *mut u32;
+                        SHADOW_WORDS = words;
+                        for i in 0..words {
+                            *SHADOW.add(i) = fbinfo.bg;
+                        }
+                        core::mem::forget(v); // shadow owns the memory now
+                    }
                 }
-            }
-        }
-        if origin == "none" {
-            // Fallback: heap — must never panic here: an OOM would halt
-            // the kernel before the shell banner, a blank screen on real
-            // hardware (the old `vec![0; words]` could abort).  On any
-            // failure we degrade to no-shadow mode instead.
-            #[allow(clippy::slow_vector_initialization)] // deliberate: try_reserve must not panic
-            let mut v: alloc::vec::Vec<u32> = alloc::vec::Vec::new();
-            if v.try_reserve_exact(words).is_ok() {
-                v.resize(words, 0); // can't fail after the reserve
-                let p = v.as_ptr() as usize;
-                let overlaps = FB_REGION_SIZE > 0
-                    && p < FB_REGION_BASE + FB_REGION_SIZE
-                    && p + bytes > FB_REGION_BASE;
-                if !overlaps {
-                    SHADOW = v.as_ptr() as *mut u32;
-                    SHADOW_WORDS = words;
-                    origin = "heap";
-                    core::mem::forget(v); // shadow owns the memory now
+                let (rbase, rsize) = (FB_REGION_BASE, FB_REGION_SIZE);
+                let (shadow, swords) = (SHADOW as usize, SHADOW_WORDS);
+                crate::serial_println!(
+                    "gop: shadow @ {:#x} words={} fb={:#x}..{:#x} origin=heap",
+                    shadow,
+                    swords,
+                    rbase,
+                    rbase + rsize,
+                );
+                if SHADOW.is_null() {
+                    let msg =
+                        "gop: WARNING — shadow rejected (fb overlap); no-shadow fallback";
+                    crate::serial_println!("{}", msg);
+                    let lines: alloc::vec::Vec<&str> = msg
+                        .as_bytes()
+                        .chunks(100)
+                        .map(|c| core::str::from_utf8(c).unwrap_or("?"))
+                        .collect();
+                    dump_lines(&lines);
                 }
             }
         }
-        let (rbase, rsize) = (FB_REGION_BASE, FB_REGION_SIZE);
-        let (shadow, swords) = (SHADOW as usize, SHADOW_WORDS);
-        crate::serial_println!(
-            "gop: shadow @ {:#x} words={} fb={:#x}..{:#x} origin={}",
-            shadow,
-            swords,
-            rbase,
-            rbase + rsize,
-            origin
-        );
-        // Real hardware has no serial console: surface a degraded shadow
-        // (heap fallback or rejected allocation) as a visible warning
-        // band so a boot on hardware shows it on the screen.
-        if origin != "page-alloc" {
-            let msg = if SHADOW.is_null() {
-                "gop: WARNING — shadow allocation rejected (fb overlap); no-shadow fallback"
-            } else {
-                "gop: WARNING — shadow from heap (page allocator unavailable)"
-            };
-            crate::serial_println!("{}", msg);
-            let lines: alloc::vec::Vec<&str> = msg
-                .as_bytes()
-                .chunks(100)
-                .map(|c| core::str::from_utf8(c).unwrap_or("?"))
-                .collect();
-            dump_lines(&lines);
-        }
     }
 }