1 files changed, 21 insertions, 0 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 7b97d14..90c24bf 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -71,6 +71,20 @@ pub fn framebuffer_region() -> Option<(usize, usize)> {
 static mut SHADOW: *mut u32 = core::ptr::null_mut();
 static mut SHADOW_WORDS: usize = 0;
 
+/// Last boot-progress stage (set by `boot_marker`); the panic handler
+/// appends it to the on-screen band so a crash shows where boot died.
+static mut LAST_BOOT_STAGE: [u8; 96] = [0; 96];
+static mut LAST_BOOT_STAGE_LEN: usize = 0;
+const STAGE_MAX: usize = 96;
+
+/// The last boot stage string (for the panic band).
+pub fn last_boot_stage() -> alloc::string::String {
+    unsafe {
+        alloc::string::String::from_utf8_lossy(&LAST_BOOT_STAGE[..LAST_BOOT_STAGE_LEN])
+            .into_owned()
+    }
+}
+
 /// Diagnostic: when > 0, every display store busy-waits ~this many
 /// cycles first, simulating the per-write bus cost of an uncached real
 /// GOP framebuffer (QEMU's framebuffer is RAM — instant).  Lets us
@@ -338,6 +352,13 @@ pub fn init_shadow() {
 /// direct-display glyph path (the shadow may not exist yet in early
 /// boot); the shell banner overwrites row 0 at first paint.
 pub fn boot_marker(msg: &str) {
+    // Record the stage so a later panic band can show how far boot got.
+    unsafe {
+        let n = msg.len().min(STAGE_MAX);
+        let dst = core::ptr::addr_of_mut!(LAST_BOOT_STAGE) as *mut u8;
+        core::ptr::copy_nonoverlapping(msg.as_ptr(), dst, n);
+        LAST_BOOT_STAGE_LEN = n;
+    }
     let Some(fb) = fb().as_ref() else {
         return;
     };