7 files changed, 124 insertions, 15 deletions

diff --git a/CONTEXT.md b/CONTEXT.md
index bfe0170..375bf57 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -113,10 +113,10 @@ Workspace version is `a.b.c` (single version for all crates):
 
 Bump the workspace version in the root `Cargo.toml` when a change of
 that class lands — do not leave the version to drift.  Current:
-`0.5.0` — the GUI era landed (graphics layer + cursor compositor) as a
-`b` bump from the 0.4.0 input foundation; a future major GUI overhaul
-(graphics windows beyond the text surface) would be the `a` bump
-(1.0.0).
+`0.5.1` — the GUI era landed with 0.5.0 (graphics layer + cursor
+compositor) and the canvas was fixed at 800×600 as a `c` bump; a
+future major GUI overhaul (graphics windows beyond the text surface)
+would be the `a` bump (1.0.0).
 
 ## Project layout
 
@@ -515,6 +515,14 @@ Workspace of four crates, all built for the `x86_64-unknown-uefi` target:
     the cursor tip is white on the display but absent from the shadow
     (overlay purity), and prints PASS/FAIL per stage.
 
+- **Canvas resolution fixed at 800×600** — `gop::init` scans the GOP
+    mode list and calls `SetMode` for an exact 800×600 (BGR/RGB 32-bit;
+    QEMU std-vga lists it as mode 3, real GPUs list it as a standard
+    mode), falling back to the smallest mode that fits, then to the
+    firmware's choice.  Everything derives from it: the vt text grid,
+    the cursor clamp, the demo strip.  `SetMode` may move the info
+    pointer and framebuffer base, so they are re-read after the switch.
+
   Verified in QEMU (`make test-gfx`): `fill_rect/shadow: OK`,
   `display push: OK`, `cursor overlay: OK`, `cursor not in shadow:
   OK`, `gfx check: PASS`; the demo draws; the cursor tracks injected
diff --git a/Cargo.lock b/Cargo.lock
index 19806d4..0d31a3b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "rsdos"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
  "rsnix",
  "shell",
@@ -19,11 +19,11 @@ dependencies = [
 
 [[package]]
 name = "rsnix"
-version = "0.5.0"
+version = "0.5.1"
 
 [[package]]
 name = "shell"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
  "rsdosedit",
  "rsnix",
diff --git a/Cargo.toml b/Cargo.toml
index 273966b..9bf5854 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["rsnix", "shell", "rsdos", "rsdosedit"]
 
 [workspace.package]
-version = "0.5.0"
+version = "0.5.1"
 edition = "2024"
 
 # no_std UEFI kernel: no unwinder available, so panic must abort.
diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 9dedcb8..dad4505 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -4,7 +4,7 @@
 /// module is the low-level rasteriser: glyph blits and pixel shifts on the
 /// linear framebuffer.
 use crate::font;
-use crate::uefi::{GraphicsOutputProtocol, PIXEL_BGR, PIXEL_RGB};
+use crate::uefi::{EFI_SUCCESS, GopModeInfo, GraphicsOutputProtocol, PIXEL_BGR, PIXEL_RGB};
 use alloc::boxed::Box;
 use alloc::vec;
 use alloc::vec::Vec;
@@ -37,8 +37,93 @@ static mut FB: Option<Framebuffer> = None;
 static mut SHADOW: *mut u32 = core::ptr::null_mut();
 static mut SHADOW_WORDS: usize = 0;
 
+/// The GUI canvas.  Every display surface assumes this resolution:
+/// `vt` derives its text grid from it, the compositor's cursor clamps
+/// to it, and the future window manager lays out windows on it.  We
+/// force it through GOP `SetMode` at boot — QEMU's std-vga offers it,
+/// and real GPUs list it as a standard mode — falling back to the
+/// smallest mode that fits, then to whatever the firmware chose.
+const WANTED_W: usize = 800;
+const WANTED_H: usize = 600;
+
+/// Pick a GOP mode: prefer an exact 800×600 (BGR/RGB 32-bit), else the
+/// smallest mode that fits the canvas, else leave the firmware's choice
+/// alone.  Call before reading the framebuffer — `SetMode` may move
+/// both the mode info pointer and the framebuffer base.
+fn select_gop_mode(gop: &mut GraphicsOutputProtocol) {
+    let mode = unsafe { &*gop.mode };
+    let cur = mode.mode;
+    let info = unsafe { &*mode.info };
+    let cur_w = info.horizontal_resolution as usize;
+    let cur_h = info.vertical_resolution as usize;
+    if cur_w == WANTED_W && cur_h == WANTED_H {
+        crate::serial_println!("gop: mode {} — already {}x{}", cur, cur_w, cur_h);
+        return;
+    }
+
+    let mut best: Option<(u32, usize, usize)> = None; // (mode#, w, h)
+    for i in 0..mode.max_mode {
+        let mut size: usize = 0;
+        let mut info_ptr: *mut GopModeInfo = core::ptr::null_mut();
+        let st = unsafe { (gop.query_mode)(gop, i, &mut size, &mut info_ptr) };
+        if st != EFI_SUCCESS || info_ptr.is_null() {
+            continue;
+        }
+        let mi = unsafe { &*info_ptr };
+        if mi.pixel_format != PIXEL_BGR && mi.pixel_format != PIXEL_RGB {
+            continue; // 32-bit BGR/RGB only (the driver assumes 4 Bpp)
+        }
+        let w = mi.horizontal_resolution as usize;
+        let h = mi.vertical_resolution as usize;
+        if w == WANTED_W && h == WANTED_H {
+            best = Some((i, w, h));
+            break;
+        }
+        if w >= WANTED_W && h >= WANTED_H {
+            match best {
+                Some((_, bw, bh)) if bw * bh <= w * h => {}
+                _ => best = Some((i, w, h)),
+            }
+        }
+    }
+
+    match best {
+        Some((n, w, h)) => {
+            let st = unsafe { (gop.set_mode)(gop, n) };
+            if st != EFI_SUCCESS {
+                crate::serial_println!(
+                    "gop: SetMode({}) failed 0x{:x} — keeping current {}x{}",
+                    n,
+                    st,
+                    cur_w,
+                    cur_h
+                );
+                return;
+            }
+            crate::serial_println!(
+                "gop: mode {} selected — {}x{} (was {}x{})",
+                n,
+                w,
+                h,
+                cur_w,
+                cur_h
+            );
+        }
+        None => crate::serial_println!(
+            "gop: no mode ≥ {}x{} — keeping current {}x{}",
+            WANTED_W,
+            WANTED_H,
+            cur_w,
+            cur_h
+        ),
+    }
+}
+
 /// Initialise the framebuffer from GOP. Call *before* ExitBootServices.
 pub fn init(gop: &mut GraphicsOutputProtocol) {
+    // Force the 800×600 canvas first; SetMode may move the info
+    // pointer and framebuffer base, so everything is re-read after.
+    select_gop_mode(gop);
     let mode = unsafe { &*gop.mode };
     let info = unsafe { &*mode.info };
     let base = mode.framebuffer_base as *mut u8;
diff --git a/rsnix/src/uefi.rs b/rsnix/src/uefi.rs
index f947c90..c311ad9 100644
--- a/rsnix/src/uefi.rs
+++ b/rsnix/src/uefi.rs
@@ -321,12 +321,28 @@ pub struct GopMode {
 
 #[repr(C)]
 pub struct GraphicsOutputProtocol {
-    pub query_mode: *mut c_void,
-    pub set_mode: *mut c_void,
-    pub get_current_mode: *mut c_void,
+    pub query_mode: EfiGopQueryMode,
+    pub set_mode: EfiGopSetMode,
+    pub get_current_mode: EfiGopGetMode,
     pub mode: *mut GopMode,
 }
 
+pub type EfiGopQueryMode = unsafe extern "efiapi" fn(
+    *mut GraphicsOutputProtocol,
+    u32,                   // mode number
+    *mut usize,            // out: size of info
+    *mut *mut GopModeInfo, // out: info pointer (firmware-owned)
+) -> Status;
+
+pub type EfiGopSetMode = unsafe extern "efiapi" fn(*mut GraphicsOutputProtocol, u32) -> Status;
+
+pub type EfiGopGetMode = unsafe extern "efiapi" fn(
+    *mut GraphicsOutputProtocol,
+    *mut u32,              // out: current mode
+    *mut u32,              // out: size of info
+    *mut *mut GopModeInfo, // out: info pointer
+) -> Status;
+
 // ---------------------------------------------------------------------------
 // System table
 // ---------------------------------------------------------------------------
diff --git a/scripts/test-gfx.sh b/scripts/test-gfx.sh
index a6e4016..7bee4ee 100755
--- a/scripts/test-gfx.sh
+++ b/scripts/test-gfx.sh
@@ -85,7 +85,7 @@ rm -f "$SOCK" "$LOG"
 echo $! >"$QPID"
 
 wait_log "$LOG" "boot: entering shell" 90 || fail "kernel never reached the shell"
-grep -aq "cursor: task " "$LOG" || fail "cursor task did not spawn"
+wait_log "$LOG" "cursor: task " 10 || fail "cursor task did not spawn"
 
 echo "==> 4/5 in-kernel pixel self-test (gfx check)"
 python3 "$SCRIPT_DIR/sendkeys.py" --sock "$SOCK" \
diff --git a/scripts/test-mouse.sh b/scripts/test-mouse.sh
index e58d474..ea58f91 100755
--- a/scripts/test-mouse.sh
+++ b/scripts/test-mouse.sh
@@ -95,7 +95,7 @@ echo $! >"$QPID"
 
 wait_log "$LOG" "boot: entering shell" 90 || fail "kernel never reached the shell"
 grep -aq "ps2: mouse ready" "$LOG" || fail "mouse driver did not come up at boot"
-grep -aq "cursor: task " "$LOG" || fail "cursor task did not spawn"
+wait_log "$LOG" "cursor: task " 10 || fail "cursor task did not spawn"
 
 echo "==> 4/6 cursor position tracks injected movement"
 INIT=$(cursor_state)
@@ -153,7 +153,7 @@ qemu_hmp "sendkey ctrl-c"
 grep -aq "mouse: routing events to task 3" "$LOG" || fail "mouse 3 did not arm routing"
 grep -aq "msgrecv\[3\]: Mouse(+" "$LOG" || fail "task 3 queue did not receive the routed Mouse event"
 # Watch line: x/y/buttons format (any occurrence after watching started).
-grep -aq "mouse: x=$((X3 + 3)) y=$((Y3 + 2)) buttons=---" "$LOG" || fail "watch did not print the moved cursor (x=$((X3+3)) y=$((Y3+2)))"
+grep -aq "mouse: x=$((X3 + 3)) y=$((Y3 + 2)) buttons=---" "$LOG" || fail "watch did not print the moved cursor (x=$((X3 + 3)) y=$((Y3 + 2)))"
 grep -aq "mouse: stopped" "$LOG" || fail "^C did not stop the mouse watch"
 
 python3 "$SCRIPT_DIR/sendkeys.py" --sock "$SOCK" "poweroff"