From f846a9551bf30d61026fa9c9ccea78479ced321b Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Sun, 2 Aug 2026 23:28:29 +0200
Subject: v0.5.7: drop test-poison hooks; vt heap-struct verify at shell entry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The OptiPlex's first banner write #GPs when the vt cells VecData holds
firmware 0xAA fill instead of a real buffer pointer.  The poison/fill
test hooks (stack + free-heap + free-page 0x00AAAAAA) were removed from
the release image — they changed boot behavior and may walk a corrupt
free list over live blocks.  Added vt::debug_verify() (cells/rendered
ptr/cap/len + in-heap check) at shell entry: the next real-hardware
boot shows whether the corruption is present at shell entry or lands
during the banner write.
---
 rsdos/src/main.rs | 40 +++++++---------------------------------
 1 file changed, 7 insertions(+), 33 deletions(-)

(limited to 'rsdos/src/main.rs')

diff --git a/rsdos/src/main.rs b/rsdos/src/main.rs
index 52b37ec..42f95e5 100644
--- a/rsdos/src/main.rs
+++ b/rsdos/src/main.rs
@@ -344,22 +344,13 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
     } else {
         rsnix::serial_println!("cursor: no mouse — overlay disabled");
     }
-    // TEST HOOK: reproduce the OptiPlex '0xaaaaaa' uninit-drop crash in
-    // QEMU.  The real hardware's stack carries 0xAA fill left by
-    // firmware; any shell value that is dropped without being written
-    // then frees garbage and trips the dealloc guard.  Filling the
-    // shell's future stack region with 0xAA here makes the same bug
-    // visible on QEMU (serial + gdb available) instead of only on the
-    // OptiPlex.
-    stack_fill_aa();
-    // Poison the free heap AND the free pages with the OptiPlex's
-    // 0x00AAAAAA scrub pattern — the firmware's leftover fills both the
-    // heap (freed pool) and the pages the allocators hand out (heap
-    // growth, task stacks).  Together with the stack fill this makes
-    // any uninitialized read reproduce the real machine's crashes in
-    // QEMU (garbage sizes → alloc panics, garbage ptrs → dealloc guard).
-    rsnix::memory::poison_free_blocks_aa();
-    rsnix::memory::poison_free_pages_aa();
+    // Shell-entry self-check: verify the vt grid structs are sane right
+    // before the shell's first print.  The OptiPlex crashes in the first
+    // banner write when the cells VecData (or the shadow) holds the
+    // firmware's 0xAA fill instead of real values — this line shows
+    // whether the corruption is already present at shell entry or lands
+    // later, and prints the exact field values when it is.
+    rsnix::vt::debug_verify();
     shell::run();
 }
 
@@ -368,23 +359,6 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
 /// headroom.  128 KiB covers the whole shell frame chain on QEMU and
 /// the OptiPlex.  Best-effort: the region is below rsp inside the boot
 /// stack mapping; the call into `shell::run` overwrites the top word.
-fn stack_fill_aa() {
-    let rsp: usize;
-    unsafe {
-        core::arch::asm!("mov {}, rsp", out(reg) rsp);
-    }
-    let top = rsp - 0x100;
-    let bottom = rsp - 0x21100;
-    unsafe {
-        let mut p = bottom;
-        while p < top {
-            core::ptr::write_volatile(p as *mut u64, 0x00AAAAAA00AAAAAA);
-            p += 8;
-        }
-    }
-    rsnix::serial_println!("stack: 0x00AAAAAA-fill 0x{:x}..0x{:x}", bottom, top);
-}
-
 // ---------------------------------------------------------------------------
 // Print a memory summary from the stashed memory map
 // ---------------------------------------------------------------------------
-- 
cgit v1.2.3