USB2/1.1 (EHCI/UHCI) drivers + real-hardware bring-up hardening

- Add polled EHCI (USB2) and UHCI (USB1.1) host-controller drivers with
  HID boot mouse support, wired into cursor polling and the 'usb' shell cmd
- Add USB Legacy ownership handoff (claim_usb_legacy) plus config_write_byte
- Harden boot: verify the PIT/timer ticks before shell entry, EOI stray
  interrupts in the LAPIC to stop interrupt storms, bound PS/2 controller
  waits, and INTx-disable AHCI (polled driver)
- Add boot stage markers, klog screen echo, and QR lock; scheduler
  mark_shell_running; NO_USB stopgap to keep BIOS USB-Legacy input alive
- alloc_pages_above for DMA buffers that must avoid low conventional memory
- Expand DEBUG_NOTES with EHCI/QEMU bring-up findings

1 files changed, 16 insertions, 2 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index ccc6509..676814e 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -7,7 +7,7 @@ use crate::font;
 use crate::uefi::{GopModeInfo, GraphicsOutputProtocol, EFI_SUCCESS, PIXEL_BGR, PIXEL_RGB};
 use core::fmt;
 use core::ptr;
-use core::sync::atomic::{AtomicU32, AtomicU64, AtomicU8, Ordering};
+use core::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, AtomicU8, Ordering};
 
 /// Framebuffer state captured before ExitBootServices.
 pub struct Framebuffer {
@@ -91,6 +91,19 @@ pub fn last_boot_stage() -> alloc::string::String {
 /// the preemptive scheduler.  Set via the shell `stall` command.
 pub static DISPLAY_STALL: AtomicU32 = AtomicU32::new(0);
 
+/// Set once a diagnostic QR has been rendered on screen.  While locked, the
+/// klog screen echo is suppressed so subsequent log lines cannot overwrite
+/// the QR; the serial console keeps the full stream.  Never released (the
+/// QR is the "photograph this" surface for hardware with no serial pipe).
+pub static QR_LOCKED: AtomicBool = AtomicBool::new(false);
+
+pub fn qr_lock() {
+    QR_LOCKED.store(true, Ordering::Relaxed);
+}
+pub fn qr_locked() -> bool {
+    QR_LOCKED.load(Ordering::Relaxed)
+}
+
 #[inline]
 fn stall_display() {
     let n = DISPLAY_STALL.load(Ordering::Relaxed);
@@ -308,7 +321,8 @@ pub fn shadow_late_init() {
 /// boot stage is written straight to the framebuffer — the last visible
 /// marker before a hang identifies where the kernel died.  Uses the
 /// direct-display glyph path (the shadow may not exist yet in early
-/// boot); the shell banner overwrites row 0 at first paint.
+/// boot).  Row 0 stays a persistent status line: the shell starts its
+/// output at row 1 so the marker survives a post-boot freeze.
 pub fn boot_marker(msg: &str) {
     boot_marker_at(msg, 0);
 }