6 files changed, 76 insertions, 40 deletions

diff --git a/rsnix/src/ahci.rs b/rsnix/src/ahci.rs
index 72da07d..a77b341 100644
--- a/rsnix/src/ahci.rs
+++ b/rsnix/src/ahci.rs
@@ -510,22 +510,24 @@ fn active() -> Option<&'static Disk> {
     disks().get(unsafe { ACTIVE }).and_then(|d| d.as_ref())
 }
 
-/// DMA `count` sectors starting at `lba` into the selected disk's buffer.
-pub fn read_sectors(lba: u64, count: u32) -> Result<(), ()> {
+/// Bounds-checked DMA of `count` sectors starting at `lba` into/out of the
+/// selected disk's buffer (single code path for both directions).
+fn dma_sectors(lba: u64, count: u32, cmd: u8, write: bool) -> Result<(), ()> {
     let d = active().ok_or(())?;
     if lba + count as u64 > d.sectors {
         return Err(());
     }
-    issue(d, ATA_READ_DMA_EXT, lba, count, false)
+    issue(d, cmd, lba, count, write)
+}
+
+/// DMA `count` sectors starting at `lba` into the selected disk's buffer.
+pub fn read_sectors(lba: u64, count: u32) -> Result<(), ()> {
+    dma_sectors(lba, count, ATA_READ_DMA_EXT, false)
 }
 
 /// DMA `count` sectors starting at `lba` out of the selected disk's buffer.
 pub fn write_sectors(lba: u64, count: u32) -> Result<(), ()> {
-    let d = active().ok_or(())?;
-    if lba + count as u64 > d.sectors {
-        return Err(());
-    }
-    issue(d, ATA_WRITE_DMA_EXT, lba, count, true)
+    dma_sectors(lba, count, ATA_WRITE_DMA_EXT, true)
 }
 
 /// Pointer to the selected disk's 4 KiB DMA buffer.
diff --git a/rsnix/src/fat.rs b/rsnix/src/fat.rs
index bad01cd..eda81ed 100644
--- a/rsnix/src/fat.rs
+++ b/rsnix/src/fat.rs
@@ -167,8 +167,18 @@ fn write_sector(lba: u64, data: &[u8; SECTOR]) -> Result<(), ()> {
 
 // --- cluster math ----------------------------------------------------------
 
+/// Current volume's metadata — only ever reached with a selected volume
+/// (the fs layer calls `select_vol` first), so a missing slot is a kernel
+/// invariant violation, not a recoverable error.
 fn v() -> &'static mut Volume {
-    vols().get_mut(*active_vol()).unwrap()
+    let i = *active_vol();
+    match vols().get_mut(i) {
+        Some(v) => v,
+        None => {
+            crate::serial_println!("fat: internal error — no volume at slot {}", i);
+            crate::interrupts::halt();
+        }
+    }
 }
 
 fn spc() -> usize {
diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index 7c3eda0..e03af8b 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -458,7 +458,9 @@ pub fn self_test() -> bool {
             seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1);
             let align = 16usize << (seed as usize % 8);
             seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1);
-            let layout = Layout::from_size_align(size, align).unwrap();
+            let Ok(layout) = Layout::from_size_align(size, align) else {
+                return false; // impossible: size <= 2048, align <= 2048
+            };
             let p = ALLOCATOR.alloc(layout);
             if p.is_null() {
                 break; // heap exhausted — stop
@@ -493,7 +495,9 @@ pub fn self_test() -> bool {
             seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1);
             let align = 16usize << (seed as usize % 8);
             seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1);
-            let layout = Layout::from_size_align(size, align).unwrap();
+            let Ok(layout) = Layout::from_size_align(size, align) else {
+                return false; // impossible: size <= 2048, align <= 2048
+            };
             let p = ALLOCATOR.alloc(layout);
             if p.is_null() {
                 return false; // failed to reuse freed space
@@ -510,7 +514,9 @@ pub fn self_test() -> bool {
             if *ptr == 0 {
                 continue;
             }
-            let layout = Layout::from_size_align(*size, *align).unwrap();
+            let Ok(layout) = Layout::from_size_align(*size, *align) else {
+                return false; // impossible: sizes/aligns came from the loop above
+            };
             ALLOCATOR.dealloc(*ptr as *mut u8, layout);
         }
         let stats = heap_stats();
diff --git a/rsnix/src/pci.rs b/rsnix/src/pci.rs
index 21d7536..b9c2265 100644
--- a/rsnix/src/pci.rs
+++ b/rsnix/src/pci.rs
@@ -46,25 +46,25 @@ fn inl(port: u16) -> u32 {
     val
 }
 
-/// Read a dword from a device's config space (`reg` must be dword-aligned).
-pub fn config_read(bus: u8, device: u8, func: u8, reg: u8) -> u32 {
-    let addr = 0x8000_0000
+/// Encode the PCI config-space port address for (bus, dev, fn, reg);
+/// `reg` must be dword-aligned.
+fn config_addr(bus: u8, device: u8, func: u8, reg: u8) -> u32 {
+    0x8000_0000
         | ((bus as u32) << 16)
         | ((device as u32) << 11)
         | ((func as u32) << 8)
-        | ((reg as u32) & 0xFC);
-    outl(CONFIG_ADDRESS, addr);
+        | ((reg as u32) & 0xFC)
+}
+
+/// Read a dword from a device's config space (`reg` must be dword-aligned).
+pub fn config_read(bus: u8, device: u8, func: u8, reg: u8) -> u32 {
+    outl(CONFIG_ADDRESS, config_addr(bus, device, func, reg));
     inl(CONFIG_DATA)
 }
 
 /// Write a dword to a device's config space (`reg` must be dword-aligned).
 pub fn config_write(bus: u8, device: u8, func: u8, reg: u8, val: u32) {
-    let addr = 0x8000_0000
-        | ((bus as u32) << 16)
-        | ((device as u32) << 11)
-        | ((func as u32) << 8)
-        | ((reg as u32) & 0xFC);
-    outl(CONFIG_ADDRESS, addr);
+    outl(CONFIG_ADDRESS, config_addr(bus, device, func, reg));
     outl(CONFIG_DATA, val)
 }
 
@@ -83,7 +83,11 @@ pub fn bar64(bus: u8, device: u8, func: u8, bar_index: u8) -> Option<u64> {
         0
     };
     let base = ((hi as u64) << 32) | (lo as u64 & 0xFFFF_FFF0);
-    if base == 0 { None } else { Some(base) }
+    if base == 0 {
+        None
+    } else {
+        Some(base)
+    }
 }
 
 /// Enumerate every device/function present on all buses.
diff --git a/rsnix/src/sched.rs b/rsnix/src/sched.rs
index 4b10503..6ffa745 100644
--- a/rsnix/src/sched.rs
+++ b/rsnix/src/sched.rs
@@ -372,7 +372,7 @@ pub fn page_fault(cr2: u64, frame_ptr: usize) -> usize {
     let rip = unsafe { (frame_ptr as *const IntFrame).read().rip };
     let mut buf = [0u8; 96];
     let n = {
-        let mut f = FmtBuf { b: &mut buf, n: 0 };
+        let mut f = crate::strbuf::FmtBuf::new(&mut buf);
         let _ = fmt::write(
             &mut f,
             core::format_args!(
@@ -386,7 +386,7 @@ pub fn page_fault(cr2: u64, frame_ptr: usize) -> usize {
                 rip
             ),
         );
-        f.n
+        f.len()
     };
     abort_current(core::str::from_utf8(&buf[..n]).unwrap_or("task fault"))
 }
@@ -528,17 +528,3 @@ fn idle_main() {
         }
     }
 }
-
-struct FmtBuf<'a> {
-    b: &'a mut [u8],
-    n: usize,
-}
-
-impl fmt::Write for FmtBuf<'_> {
-    fn write_str(&mut self, s: &str) -> fmt::Result {
-        let m = s.len().min(self.b.len() - self.n);
-        self.b[self.n..self.n + m].copy_from_slice(&s.as_bytes()[..m]);
-        self.n += m;
-        Ok(())
-    }
-}
diff --git a/rsnix/src/strbuf.rs b/rsnix/src/strbuf.rs
index 262720d..0e3ea56 100644
--- a/rsnix/src/strbuf.rs
+++ b/rsnix/src/strbuf.rs
@@ -69,3 +69,31 @@ impl<const N: usize> fmt::Debug for String<N> {
         write!(f, "{:?}", self.as_str())
     }
 }
+
+/// Small `fmt::Write` over a byte slice — no allocation, bounded.
+/// Shared by the panic handler (task-panic message) and the scheduler
+/// (page-fault abort message) so they don't each reinvent it.
+pub struct FmtBuf<'a> {
+    b: &'a mut [u8],
+    n: usize,
+}
+
+impl<'a> FmtBuf<'a> {
+    pub fn new(b: &'a mut [u8]) -> Self {
+        FmtBuf { b, n: 0 }
+    }
+
+    /// Bytes written so far (clamped at the buffer length).
+    pub fn len(&self) -> usize {
+        self.n
+    }
+}
+
+impl fmt::Write for FmtBuf<'_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        let m = s.len().min(self.b.len() - self.n);
+        self.b[self.n..self.n + m].copy_from_slice(&s.as_bytes()[..m]);
+        self.n += m;
+        Ok(())
+    }
+}