rsnix v0.5.3: fix real-hardware scroll wedge — per-word display push

The real-hardware crash (2 lines of white + freeze, no CPU exception
even with the 0.5.2 fault dumps) pointed away from a fault and at a
stall: the scroll's full-frame push used one 1.92 MB rep-movsb to the
framebuffer.  On QEMU the framebuffer is RAM, so it flies; on a real
GPU the framebuffer is uncached MMIO and the CPU's fast-string burst
path can stall forever — the shell wedges mid-instruction, the cursor
task's own writes wedge too, no exception fires (MMIO writes don't
fault), and the screen shows the torn partial push (the white bands).

The boot-time clear() always worked on the same hardware and uses
per-word volatile stores, so the scroll push now uses the identical
pattern: shadow reads (cached RAM, cheap) + individually-posted
display stores.  Interruptible between stores, never a bulk burst,
and functionally identical on QEMU (all 5 suites re-pass).

Also converts the no-shadow fallback shift to the same per-word
pattern.  CONTEXT.md updated (scroll-cost note + versioning).

2 files changed, 31 insertions, 13 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 47a2208..439dfb1 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -4,13 +4,13 @@
 /// module is the low-level rasteriser: glyph blits and pixel shifts on the
 /// linear framebuffer.
 use crate::font;
-use crate::uefi::{EFI_SUCCESS, GopModeInfo, GraphicsOutputProtocol, PIXEL_BGR, PIXEL_RGB};
+use crate::uefi::{GopModeInfo, GraphicsOutputProtocol, EFI_SUCCESS, PIXEL_BGR, PIXEL_RGB};
 use alloc::boxed::Box;
 use alloc::vec;
 use alloc::vec::Vec;
 use core::fmt;
 use core::ptr;
-use core::sync::atomic::{AtomicU8, AtomicU64, Ordering};
+use core::sync::atomic::{AtomicU64, AtomicU8, Ordering};
 
 /// Framebuffer state captured before ExitBootServices.
 pub struct Framebuffer {
@@ -590,12 +590,16 @@ impl Framebuffer {
         unsafe {
             if SHADOW.is_null() {
                 // No shadow (allocation failed): fall back to shifting the
-                // display directly.
-                ptr::copy(
-                    self.base.add(n * row_bytes),
-                    self.base,
-                    total - n * row_bytes,
-                );
+                // display directly — per-word volatile stores, never a
+                // bulk memcpy: a giant REP MOVS to an uncached MMIO
+                // framebuffer can stall forever on real hardware (the
+                // boot-time clear() uses the same per-word pattern and
+                // provably works).
+                let src = self.base.add(n * row_bytes) as *mut u32;
+                let n_words = (total - n * row_bytes) / 4;
+                for i in 0..n_words {
+                    ptr::write_volatile(self.base.add(i * 4) as *mut u32, ptr::read(src.add(i)));
+                }
                 let last_row = self.base.add(total - n * row_bytes);
                 for i in 0..(n * row_words) {
                     ptr::write_volatile(last_row.add(i * 4) as *mut u32, self.bg);
@@ -609,15 +613,25 @@ impl Framebuffer {
                 *SHADOW.add(i) = self.bg;
             }
             // Push the shadow to the display: write-only, no reads.
-            // A bulk copy (rep movsb) writes in 64-byte bursts that
-            // coalesce well on WC framebuffers — far fewer bus
-            // transactions than per-pixel stores.
+            //
+            // Per-word volatile stores, NOT a bulk rep-movsb: the shadow
+            // is cached RAM (reads are cheap) and each display store is
+            // individually posted, exactly like the boot-time clear().  A
+            // 1.92 MB REP MOVS to an uncached real-GPU framebuffer can
+            // wedge the CPU — the "fast string" burst path never drains
+            // on some hardware, the shell stalls mid-instruction, no
+            // exception fires, and the machine looks hung with a torn
+            // frame (the white bands).  QEMU never shows this because its
+            // framebuffer is RAM.
             //
             // Clamp to the firmware's mapping size; a pitch-padded mode
             // whose `pitch * height` exceeds the buffer degrades to a
             // truncated view instead of faulting past the mapping.
             let push_words = words.min(self.framebuffer_size / 4);
-            ptr::copy_nonoverlapping(SHADOW, self.base as *mut u32, push_words);
+            let dst = self.base as *mut u32;
+            for i in 0..push_words {
+                ptr::write_volatile(dst.add(i), ptr::read(SHADOW.add(i)));
+            }
             // The scroll copied the shadow (which never contains the
             // cursor); re-composite it on top of the pushed frame.
             crate::gop::cursor_redraw();
diff --git a/rsnix/src/sched.rs b/rsnix/src/sched.rs
index cfce58f..f48e210 100644
--- a/rsnix/src/sched.rs
+++ b/rsnix/src/sched.rs
@@ -282,7 +282,11 @@ pub fn spawn(entry: fn(), name: &str) -> Option<usize> {
     };
     let ok = spawn_at(id, entry, name);
     unlock();
-    if ok { Some(id) } else { None }
+    if ok {
+        Some(id)
+    } else {
+        None
+    }
 }
 
 unsafe fn reap(id: usize) {