usb: real-hardware rework — hubs, both EHCI controllers, keyboard, xHCI hardening

EHCI (OptiPlex 7010 / Q77 and similar Intel PCH):
- enumerate *both* EHCI controllers (00:1a.0 + 00:1d.0), not just the first
- hub support: read the hub class descriptor, power/reset each port via hub
  class requests, read the child speed, then drive the child with split
  transactions carrying the hub's address and port (TT).  On 7-series PCH the
  root port presents the integrated Rate Matching Hub (8087:0024, class 9)
  and the mouse/keyboard sit behind it; without this the driver stopped at
  "no HID mouse/keyboard endpoint in config".
- HID mouse *and* keyboard, boot protocol + idle, per-device periodic QH
  chained into the frame list, per-device report buffers and counters
- periodic re-arm follows the standard shape (qTD re-activated, Next-qTD
  re-linked); the HC owns the status/toggle overlay
- DMA from the page allocator inside [16 MiB, 4 GiB): EHCI programs 32-bit
  addresses and the page bitmap spans all RAM
- 2 ms recovery after SET_ADDRESS

xHCI:
- scratchpad buffers (HCSPARAMS2) and MaxSlotsEn > 1, with per-slot EP0 and
  interrupt rings plus per-slot device contexts
- DMA from the page allocator instead of the heap allocator
- boot protocol + idle, mouse + keyboard, first-report diagnostics
- transfer events are routed to every device before matching a waiter, so a
  second device's enumeration cannot swallow an armed device's report

shared:
- rsnix/src/hid.rs: HID usage -> scancode-set-1 tables, one scancode FIFO
  feeding ps2::feed_scancode, per-device boot-keyboard report differ
- WM input pump polls PS/2 -> UHCI -> EHCI -> xHCI
- memory::alloc_pages_range(count, min, max) for bounded DMA allocations

QEMU coverage: make test-usb (EHCI + xHCI, mouse + keyboard).  QEMU's EHCI
split path delivers only the first report for FS devices, so repeated-report
delivery and the RMH path remain hardware-test items.

1 files changed, 11 insertions, 2 deletions

diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index 2a32da8..0bac169 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -1200,6 +1200,13 @@ pub fn alloc_pages(count: usize) -> Option<usize> {
 /// chipsets is hostile to PCI masters and shows up as a controller
 /// "System Error" (SE) halt.  Page-aligned like `alloc_pages`.
 pub fn alloc_pages_above(count: usize, min_addr: usize) -> Option<usize> {
+    alloc_pages_range(count, min_addr, usize::MAX)
+}
+
+/// Allocate `count` contiguous physical pages inside `[min_addr, max_addr)`.
+/// The upper bound matters for 32-bit DMA engines (EHCI): a buffer above
+/// 4 GiB is unreachable even though the kernel can address it.
+pub fn alloc_pages_range(count: usize, min_addr: usize, max_addr: usize) -> Option<usize> {
     if count == 0 {
         return None;
     }
@@ -1209,13 +1216,15 @@ pub fn alloc_pages_above(count: usize, min_addr: usize) -> Option<usize> {
         }
         let span = SPAN_PAGES;
         let min_page = min_addr.div_ceil(PAGE_SIZE).max(BASE_PAGE);
-        if min_page >= BASE_PAGE + span {
+        let max_page = (max_addr / PAGE_SIZE).min(BASE_PAGE + span);
+        if min_page >= max_page {
             return None;
         }
         let start_idx = min_page - BASE_PAGE;
+        let end_idx = max_page - BASE_PAGE;
         let mut run_start = 0usize;
         let mut run_len = 0usize;
-        for idx in start_idx..span {
+        for idx in start_idx..end_idx {
             let free = (*BITMAP.add(idx / 8) >> (idx % 8)) & 1 == 0;
             if free {
                 if run_len == 0 {