Artemis Milestone 2e: real connect drives Enable Slot, slot ID correlated

xhci_poll_events()'s Port Status Change connect branch now calls
xhci_cmd_enable_slot() directly (the earlier boot-time smoke test call is
gone), tracked via a new dev->pending_connect_port_id -- since this
driver only ever has one command outstanding at a time, that alone
identifies which port a later Command Completion Event answers, without
needing to match the Command TRB Pointer yet. On success the returned
Slot ID is recorded in a new dev->port_slot_id[], a fixed
uint32_t[XHCI_MAX_TRACKED_PORTS] (32) indexed by port. Disconnect clears
the port's tracked slot (real teardown -- Disable Slot, DCBAA clear,
Section U callback -- is still a later increment).

Fixed array, not heap-allocated: a first attempt sized port_slot_id
dynamically via kmalloc_aligned(dev->max_ports * sizeof(uint32_t), 64)
inside xhci_bringup() and it crashed amd64 with a page fault (IFETCH at
RIP=CR2=0xA0000, the legacy VGA hole) during the unrelated Mama-VM-birth
phase afterward -- a heap-corruption signature, not chased to root cause.
Switching to a fixed array (matching this driver's existing preference
for fixed over dynamic allocation) made the crash go away; the crashing
boot's log is kept (logs/20260822-102516/) as the evidence trail.

Verified live via QMP hotplug, all three architectures: connect ->
"enable slot command submitted" -> "enable slot succeeded", with a
disconnect/reconnect cycle repeating cleanly and no port wedge.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZ8kNoTuP63pbQtro4qvrm

include/starkernel/xhci.h

@@ -222,4 +222,12 @@ typedef struct {
 #define XHCI_RING_TRB_COUNT   256u
 #define XHCI_RING_BYTES       (XHCI_RING_TRB_COUNT * sizeof(xhci_trb_t))
 
+/* Milestone 2e: upper bound on ports tracked for connect/disconnect ->
+ * Enable Slot correlation (xhci_dev_t.port_slot_id). PORTSC's own field
+ * width allows up to 255 ports (XHCI_HCSPARAMS1_MAX_PORTS is 8 bits), but
+ * no real or QEMU-emulated root hub this driver targets comes close to
+ * that; 32 is comfortably generous and keeps this a fixed, not
+ * heap-allocated, array. */
+#define XHCI_MAX_TRACKED_PORTS 32u
+
 #endif /* STARKERNEL_XHCI_H */

include/starkernel/xhci_driver.h

@@ -41,6 +41,22 @@ typedef struct {
     xhci_intr_regs_t    *intr0;          /* Interrupter 0 register set, cached
                                            * by xhci_bringup() for
                                            * xhci_poll_events() */
+
+    /* Milestone 2e: connect -> Enable Slot correlation. port_slot_id is
+     * indexed by port_id - 1 (1-based port IDs, matching PORTSC/Port
+     * Status Change Event numbering); 0 means no slot allocated for that
+     * port yet. Fixed-size, not heap-allocated -- XHCI_MAX_TRACKED_PORTS
+     * comfortably covers any real or emulated root hub's port count
+     * without adding a new kmalloc_aligned() call to xhci_bringup(); ports
+     * beyond this bound (checked against both this array and max_ports)
+     * are simply not tracked, matching this driver's existing preference
+     * for fixed allocations over dynamic growth (xhci.h's own ring-sizing
+     * rationale). Only one Enable Slot is ever in flight at a time (this
+     * driver issues commands synchronously with respect to connect events,
+     * not a queue) -- pending_connect_port_id is 0 when idle, or the
+     * port_id whose Command Completion Event is still outstanding. */
+    uint32_t            port_slot_id[XHCI_MAX_TRACKED_PORTS];
+    uint32_t            pending_connect_port_id;
 } xhci_dev_t;
 
 /*
@@ -107,10 +123,14 @@ void xhci_poll_events(void);
 /*
  * xhci_cmd_enable_slot — submit an Enable Slot command TRB to the Command
  *                        Ring and ring doorbell 0. Does not wait for or
- *                        read the resulting Command Completion Event --
- *                        that arrives asynchronously via xhci_poll_events(),
- *                        which currently only logs it (Milestone 2e's slot-
- *                        ID/context bookkeeping is not wired up yet).
+ *                        read the resulting Command Completion Event -- it
+ *                        arrives asynchronously via xhci_poll_events(),
+ *                        which correlates the returned Slot ID back to
+ *                        dev->pending_connect_port_id and records it in
+ *                        dev->port_slot_id[].
+ *
+ * Called from xhci_poll_events()'s own Port Status Change handling on a
+ * real connect event -- not called directly by other code.
  *
  * Returns 0 if the command was posted, -1 if dev/dev->cmd_ring is not set
  * up (xhci_bringup() has not completed).