boot: stop assuming the machine is an emulator

Every one of these works under QEMU and stops a real machine:

- MADT processors that are "online capable" but not enabled were
  counted as CPUs. AMD firmware lists absent cores that way (so does
  QEMU with maxcpus), and startothers() then waited for ever for an
  AP that does not exist. Only enabled entries count now, x2APIC
  (type 9) entries are read too, and the wait is bounded to a second;
  an AP that misses it is parked with INIT and the boot goes on.
- The PIT calibration loop had no bound. Recent boards clock-gate the
  8254: the output never rises (a hang) or floats high (TSC "0 MHz"
  and every clock thousands of times fast). The loop is bounded and
  checked, and falls back to the ACPI PM timer, then CPUID 0x15/0x16.
  Under QEMU pit=off the PM timer gives the same figures the PIT did.
- Firmware that hands over in x2APIC mode left lapic[] reading
  garbage: cpunum() panicked or the timer never started. Each CPU is
  switched back to xAPIC first (x2APIC -> disabled -> xAPIC).
- The IOAPIC was always at 0xFEC00000 and interrupts were aimed at
  APIC ID "0". Both now come from the firmware's tables.
- INIT-to-STARTUP was 100 us ("Bochs is slow"); it is the 10 ms the
  MP specification asks for.
- mouseinit() drained the 8042 with an unbounded loop. With no
  controller the port reads 0xFF and the loop never ends. It now
  notices there is no controller and skips the mouse.

Tested in QEMU: i440fx and q35, -smp 4, -smp 2,maxcpus=4, pit=off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HH7xukt4aaiGj1nQEAoQf1

kernel/arch/x86_64/ioapic.c

@@ -6,8 +6,11 @@
 #include "defs.h"
 #include "traps.h"
 #include "memlayout.h"
+#include "mmu.h"
+#include "mp.h"
+#include "param.h"
+#include "proc.h"
 
-#define IOAPIC  0xFEC00000   // Default physical address of IO APIC
 
 #define REG_ID     0x00  // Register index: ID
 #define REG_VER    0x01  // Register index: version
@@ -51,7 +54,12 @@ ioapicinit(void)
 {
   int i, id, maxintr;
 
-  ioapic = P2V((volatile struct ioapic*)IOAPIC);
+  // The firmware's address for it, not a constant: see ioapic_phys in mp.c.
+  // ioremap() rather than P2V because nothing obliges it to be in the low
+  // four gigabytes the direct map is sure to cover.
+  ioapic = ioremap(ioapic_phys, PGSIZE);
+  if(!ioapic)
+    panic("ioapicinit: cannot map the I/O APIC");
   maxintr = (ioapicread(REG_VER) >> 16) & 0xFF;
   id = ioapicread(REG_ID) >> 24;
   if(id != ioapicid)
@@ -85,7 +93,12 @@ ioapicroute(int irq, int cpunum, int level_low)
 
   // Program the destination before unmasking, so the entry is never briefly
   // live pointing at CPU 0 when it was meant for another.
-  ioapicwrite(REG_TABLE+2*irq+1, cpunum << 24);
+  //
+  // The destination is an APIC *ID*, not a CPU index. This wrote the index,
+  // which is the same number only when the boot processor's APIC ID is 0 --
+  // true under every emulator and on most boards, and not promised: an
+  // interrupt aimed at an ID nobody has is an interrupt nobody receives.
+  ioapicwrite(REG_TABLE+2*irq+1, (uint)cpus[cpunum].apicid << 24);
   ioapicwrite(REG_TABLE+2*irq, lo);
 }