usb: real-hardware rework — hubs, both EHCI controllers, keyboard, xHCI hardening

EHCI (OptiPlex 7010 / Q77 and similar Intel PCH):
- enumerate *both* EHCI controllers (00:1a.0 + 00:1d.0), not just the first
- hub support: read the hub class descriptor, power/reset each port via hub
  class requests, read the child speed, then drive the child with split
  transactions carrying the hub's address and port (TT).  On 7-series PCH the
  root port presents the integrated Rate Matching Hub (8087:0024, class 9)
  and the mouse/keyboard sit behind it; without this the driver stopped at
  "no HID mouse/keyboard endpoint in config".
- HID mouse *and* keyboard, boot protocol + idle, per-device periodic QH
  chained into the frame list, per-device report buffers and counters
- periodic re-arm follows the standard shape (qTD re-activated, Next-qTD
  re-linked); the HC owns the status/toggle overlay
- DMA from the page allocator inside [16 MiB, 4 GiB): EHCI programs 32-bit
  addresses and the page bitmap spans all RAM
- 2 ms recovery after SET_ADDRESS

xHCI:
- scratchpad buffers (HCSPARAMS2) and MaxSlotsEn > 1, with per-slot EP0 and
  interrupt rings plus per-slot device contexts
- DMA from the page allocator instead of the heap allocator
- boot protocol + idle, mouse + keyboard, first-report diagnostics
- transfer events are routed to every device before matching a waiter, so a
  second device's enumeration cannot swallow an armed device's report

shared:
- rsnix/src/hid.rs: HID usage -> scancode-set-1 tables, one scancode FIFO
  feeding ps2::feed_scancode, per-device boot-keyboard report differ
- WM input pump polls PS/2 -> UHCI -> EHCI -> xHCI
- memory::alloc_pages_range(count, min, max) for bounded DMA allocations

QEMU coverage: make test-usb (EHCI + xHCI, mouse + keyboard).  QEMU's EHCI
split path delivers only the first report for FS devices, so repeated-report
delivery and the RMH path remain hardware-test items.

1 files changed, 5 insertions, 1 deletions

diff --git a/rsnix/src/wm.rs b/rsnix/src/wm.rs
index 9f3806f..38cae47 100644
--- a/rsnix/src/wm.rs
+++ b/rsnix/src/wm.rs
@@ -647,7 +647,11 @@ fn pump_main() {
     // global rings directly; when nothing is focused the keys drop.
     loop {
         let o = focused().and_then(owner).unwrap_or(crate::sched::SHELL_TID);
-        while let Some(ev) = crate::ps2::try_poll_key().or_else(crate::uhci::try_poll_key) {
+        while let Some(ev) = crate::ps2::try_poll_key()
+            .or_else(crate::uhci::try_poll_key)
+            .or_else(crate::ehci::try_poll_key)
+            .or_else(crate::usb::try_poll_key)
+        {
             if !handle_key(ev) {
                 let _ = crate::sched::send(o, TaskMsg::Key(ev));
             }