2 files changed, 82 insertions, 113 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 90c24bf..d37468f 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -80,8 +80,7 @@ const STAGE_MAX: usize = 96;
 /// The last boot stage string (for the panic band).
 pub fn last_boot_stage() -> alloc::string::String {
     unsafe {
-        alloc::string::String::from_utf8_lossy(&LAST_BOOT_STAGE[..LAST_BOOT_STAGE_LEN])
-            .into_owned()
+        alloc::string::String::from_utf8_lossy(&LAST_BOOT_STAGE[..LAST_BOOT_STAGE_LEN]).into_owned()
     }
 }
 
@@ -210,7 +209,7 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
     let bgr = info.pixel_format == PIXEL_BGR;
     let _ = fg;
 
-    let fb = Framebuffer {
+    let fbf = Framebuffer {
         base,
         width,
         height,
@@ -221,14 +220,8 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
         bgr,
     };
 
-    // The RAM backbuffer is allocated *after* ExitBootServices by
-    // `init_shadow()` (main.rs) — via the fb-aware page allocator so it
-    // can never land on the framebuffer (see init_shadow).  Nothing is
-    // drawn between fb.clear() here and init_shadow(), so the blank
-    // shadow is in sync with the cleared display.
-
-    // Re-stash the post-SetMode region (base can move) for the page
-    // allocator, and log the authoritative geometry for diagnostics.
+    // Re-stash the post-SetMode region (base can move) for the
+    // allocators, and log the authoritative geometry for diagnostics.
     unsafe {
         FB_REGION_BASE = mode.framebuffer_base as usize;
         FB_REGION_SIZE = mode.framebuffer_size;
@@ -244,104 +237,65 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
         bgr
     );
 
-    fb.clear();
+    fbf.clear();
 
     unsafe {
-        FB = Some(fb);
-    }
-}
-
-/// Allocate the RAM backbuffer.  Must run *after*
-/// `memory::init_page_allocator` (which excludes the GOP framebuffer
-/// pages per-page), and before any text is painted.
-///
-/// The heap (pre-ExitBootServices) is excluded from the fb region only
-/// by a coarse overlap subtraction that still leaves one contiguous
-/// free block *spanning* the fb hole — a 1.9 MB shadow allocation could
-/// therefore land *on* the framebuffer on machines where firmware
-/// reports it as ConventionalMemory.  A shadow aliased over the display
-/// makes every scroll a 1.8 MB MMIO→MMIO memcpy, which can wedge a
-/// real uncached framebuffer (a stall, not a fault — hence no dump).
-/// The page allocator marks those pages used, so the shadow can never
-/// land there.  Heap allocation is kept only as a fallback, with an
-/// explicit overlap rejection.
-pub fn init_shadow() {
+        FB = Some(fbf);
+    }
+
+    // The RAM backbuffer is the *first* heap allocation: allocated here
+    // (pre-ExitBootServices, before vt::init builds its grids) so no
+    // other heap object can collide with it — the v0.5.3 layout that
+    // provably boots on real hardware.  The heap free list excludes the
+    // fb region (init_heap splits at the fb hole) and we additionally
+    // reject any range overlapping the fb, so the shadow can never
+    // alias the display (an aliased shadow turns every scroll into a
+    // 1.8 MB MMIO→MMIO memcpy on an uncached real fb — a wedge).
+    // Allocation failure degrades to no-shadow mode, never panics.
     unsafe {
-        let Some(fb) = fb().as_ref() else {
-            return;
-        };
-        let words = (fb.pitch * fb.height) / 4;
-        if words == 0 {
-            return;
-        }
-        let bytes = words * 4;
-        let pages = bytes.div_ceil(crate::memory::PAGE_SIZE);
-        let mut origin = "none";
-
-        // Primary: fb-aware page allocator (fb pages already marked
-        // used by init_page_allocator).  Defensively refuse the range if
-        // it ever overlaps the fb region anyway.
-        if let Some(p) = crate::memory::alloc_pages(pages) {
-            let overlaps = FB_REGION_SIZE > 0
-                && p < FB_REGION_BASE + FB_REGION_SIZE
-                && p + bytes > FB_REGION_BASE;
-            if !overlaps {
-                SHADOW = p as *mut u32;
-                SHADOW_WORDS = words;
-                origin = "page-alloc";
-                for i in 0..words {
-                    *SHADOW.add(i) = fb.bg;
+        if let Some(fbinfo) = fb().as_ref() {
+            let words = (fbinfo.pitch * fbinfo.height) / 4;
+            if words > 0 {
+                let bytes = words * 4;
+                #[allow(clippy::slow_vector_initialization)] // deliberate: try_reserve must not panic
+                let mut v: alloc::vec::Vec<u32> = alloc::vec::Vec::new();
+                if v.try_reserve_exact(words).is_ok() {
+                    v.resize(words, 0); // can't fail after the reserve
+                    let p = v.as_ptr() as usize;
+                    let overlaps = FB_REGION_SIZE > 0
+                        && p < FB_REGION_BASE + FB_REGION_SIZE
+                        && p + bytes > FB_REGION_BASE;
+                    if !overlaps {
+                        SHADOW = v.as_ptr() as *mut u32;
+                        SHADOW_WORDS = words;
+                        for i in 0..words {
+                            *SHADOW.add(i) = fbinfo.bg;
+                        }
+                        core::mem::forget(v); // shadow owns the memory now
+                    }
                 }
-            }
-        }
-        if origin == "none" {
-            // Fallback: heap — must never panic here: an OOM would halt
-            // the kernel before the shell banner, a blank screen on real
-            // hardware (the old `vec![0; words]` could abort).  On any
-            // failure we degrade to no-shadow mode instead.
-            #[allow(clippy::slow_vector_initialization)] // deliberate: try_reserve must not panic
-            let mut v: alloc::vec::Vec<u32> = alloc::vec::Vec::new();
-            if v.try_reserve_exact(words).is_ok() {
-                v.resize(words, 0); // can't fail after the reserve
-                let p = v.as_ptr() as usize;
-                let overlaps = FB_REGION_SIZE > 0
-                    && p < FB_REGION_BASE + FB_REGION_SIZE
-                    && p + bytes > FB_REGION_BASE;
-                if !overlaps {
-                    SHADOW = v.as_ptr() as *mut u32;
-                    SHADOW_WORDS = words;
-                    origin = "heap";
-                    core::mem::forget(v); // shadow owns the memory now
+                let (rbase, rsize) = (FB_REGION_BASE, FB_REGION_SIZE);
+                let (shadow, swords) = (SHADOW as usize, SHADOW_WORDS);
+                crate::serial_println!(
+                    "gop: shadow @ {:#x} words={} fb={:#x}..{:#x} origin=heap",
+                    shadow,
+                    swords,
+                    rbase,
+                    rbase + rsize,
+                );
+                if SHADOW.is_null() {
+                    let msg =
+                        "gop: WARNING — shadow rejected (fb overlap); no-shadow fallback";
+                    crate::serial_println!("{}", msg);
+                    let lines: alloc::vec::Vec<&str> = msg
+                        .as_bytes()
+                        .chunks(100)
+                        .map(|c| core::str::from_utf8(c).unwrap_or("?"))
+                        .collect();
+                    dump_lines(&lines);
                 }
             }
         }
-        let (rbase, rsize) = (FB_REGION_BASE, FB_REGION_SIZE);
-        let (shadow, swords) = (SHADOW as usize, SHADOW_WORDS);
-        crate::serial_println!(
-            "gop: shadow @ {:#x} words={} fb={:#x}..{:#x} origin={}",
-            shadow,
-            swords,
-            rbase,
-            rbase + rsize,
-            origin
-        );
-        // Real hardware has no serial console: surface a degraded shadow
-        // (heap fallback or rejected allocation) as a visible warning
-        // band so a boot on hardware shows it on the screen.
-        if origin != "page-alloc" {
-            let msg = if SHADOW.is_null() {
-                "gop: WARNING — shadow allocation rejected (fb overlap); no-shadow fallback"
-            } else {
-                "gop: WARNING — shadow from heap (page allocator unavailable)"
-            };
-            crate::serial_println!("{}", msg);
-            let lines: alloc::vec::Vec<&str> = msg
-                .as_bytes()
-                .chunks(100)
-                .map(|c| core::str::from_utf8(c).unwrap_or("?"))
-                .collect();
-            dump_lines(&lines);
-        }
     }
 }
 
diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index a947c53..605125a 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -366,18 +366,33 @@ fn init_heap() {
             if d.kind == MEMORY_TYPE_CONVENTIONAL {
                 let s = d.physical_start as usize;
                 let e = s + d.number_of_pages as usize * 4096;
-                // Subtract any overlap with the framebuffer region.
-                let (cs, ce) = match fb {
-                    Some((b, sz)) if e > b && s < b + sz => (s.max(b), e.min(b + sz)),
-                    _ => (e, s), // no overlap → empty range
-                };
-                let mut sz = e - s;
-                if ce > cs {
-                    sz -= ce - cs;
+                // Split at the framebuffer hole so the free list NEVER
+                // contains fb pages: a coarse size subtraction leaves one
+                // block *spanning* the hole, letting a large allocation
+                // (e.g. the 1.9 MB display shadow) straddle the display.
+                let mut lo = s;
+                if let Some((b, sz)) = fb
+                    && e > b
+                    && s < b + sz
+                {
+                    let h0 = b.max(s);
+                    let h1 = (b + sz).min(e);
+                    if h0 > lo {
+                        // Segment before the hole.
+                        let seg = h0 - lo;
+                        if seg > best_size {
+                            best_start = lo;
+                            best_size = seg;
+                        }
+                    }
+                    lo = h1;
                 }
-                if sz > best_size {
-                    best_start = s;
-                    best_size = sz;
+                if e > lo {
+                    let seg = e - lo;
+                    if seg > best_size {
+                        best_start = lo;
+                        best_size = seg;
+                    }
                 }
             }
         }