kernel: the clock ran 7x slow because the GPU never acknowledged its interrupt

fastfetch reported 3 seconds of uptime after 15 real ones, `time` claimed
3.12s for a 20-second command, and ping's one-second interval was closer to
six. One cause, not three: `ticks` was advancing at ~14.5 Hz instead of 100.

It was not the timer. virtio-gpu-pci shares IRQ 11 with the e1000 and
registered no interrupt handler at all. PCI INTx is level-triggered, so the
device held the line asserted, the kernel signalled EOI, and it fired again
immediately -- 72,000 interrupts a second, 83% of CPU0, starving the tick.
The e1000's handler read ICR as zero half a million times, correctly
answering "not mine", which is what made it look like a network-free problem.

Reading virtio's ISR byte clears it and drops the line. That is the fix.

irq_dispatch now measures each line's rate against the TSC -- not ticks,
which is the first casualty of a storm -- and names the attached handlers
once above 20000/s. It reproduces the original fault as a single line.

Found along the way, and fixed because they were real:

  - lapicinit loaded TICR with xv6's uncalibrated 10000000, whose own comment
    admitted it was never measured. calibrate_timers() now measures the LAPIC
    and the TSC against the 8254 PIT. (It came back at 999.9 MHz, so this was
    not the bug -- but the next machine is not obliged to be 1 GHz.)
  - microdelay() was an empty function body. Every microdelay(1000) in the
    xHCI reset path and the USB hub power-on sequence returned instantly.
  - HZ is a constant in param.h now, not the literal 100 written out at a
    dozen ticks-to-seconds conversions. USER_HZ is separate and deliberately
    does not follow it: musl answers sysconf(_SC_CLK_TCK) with 100 always, so
    times() and /proc/stat scale at the syscall boundary the way Linux does.
  - TIOCGWINSZ answered a hardcoded 24x80. gfx_cols()/gfx_rows() have known
    the real geometry all along; at 1024x768 the console is 128x48, so every
    program that lays out a screen was formatting for the wrong one.
  - TCFLSH fell through to the catch-all `return 0`, claiming to discard
    input without discarding any.

uptime now advances 5.01 seconds per 5 real seconds. schfs-check passes.

Full investigation, including the two wrong hypotheses and the measurement
flaw that protected them, in docs/history/kernel.md section 13.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/drivers/gpu/virtio_gpu/virtio_gpu.c

@@ -14,6 +14,7 @@
 
 #include "types.h"
 #include "defs.h"
+#include "irq.h"
 #include "param.h"
 #include "x86.h"
 #include "spinlock.h"
@@ -35,6 +36,9 @@
 struct vgpu {
   volatile uint8 *common;      // common configuration structure
   volatile uint8 *notify;      // notification area
+  // The interrupt status byte. Reading it is what tells the device we have
+  // noticed, and therefore what makes it drop the PCI interrupt line.
+  volatile uint8 *isr;
   uint32 notify_mult;          // queue_notify_off multiplier
 
   // The queue. Allocated as one contiguous block from the DMA arena, because
@@ -396,6 +400,33 @@ const struct display_ops virtio_gpu_display_ops = {
 
 // --- probe -----------------------------------------------------------------
 
+// Acknowledge the device's interrupt.
+//
+// This driver polls for command completion and wants no notifications at all,
+// which is why nothing here reacts to the cause -- but "wants none" and "gets
+// none" are different things, and a PCI interrupt line is level-triggered.
+// The device raises INTx, the CPU takes the interrupt, the kernel signals EOI,
+// and if nobody has cleared the device's interrupt status the line is still
+// asserted, so it fires again immediately. Forever.
+//
+// That is not hypothetical. With no handler registered here at all, this
+// device shared IRQ 11 with the e1000 under QEMU and storme at roughly 72,000
+// interrupts a second, eating 83% of CPU0. The visible symptom was nowhere
+// near the graphics driver: the timer interrupt was starved, so `ticks`
+// advanced at about 14 Hz instead of 100, and every duration in the system --
+// uptime, `time`, sleep, ping's one-second interval -- came out ~7x short.
+// See docs/history/kernel.md.
+//
+// Reading the ISR byte clears it and deasserts the line. That single read is
+// the entire handler, and it is not optional.
+static void
+vgpu_intr(void *arg)
+{
+  struct vgpu *g = arg;
+  if (g && g->isr)
+    (void)*g->isr;
+}
+
 static int
 vgpu_probe(struct pci_dev *d)
 {
@@ -414,6 +445,7 @@ vgpu_probe(struct pci_dev *d)
 
   g->common = find_cfg(d, VIRTIO_PCI_CAP_COMMON_CFG, 0);
   g->notify = find_cfg(d, VIRTIO_PCI_CAP_NOTIFY_CFG, &g->notify_mult);
+  g->isr    = find_cfg(d, VIRTIO_PCI_CAP_ISR_CFG, 0);
   if (!g->common || !g->notify) {
     cprintf("virtio-gpu: no modern virtio capabilities; not a 1.0 device\n");
     return -1;
@@ -465,9 +497,16 @@ vgpu_probe(struct pci_dev *d)
     return -1;
   }
 
+  // Level-triggered and active low, like every other PCI INTx line -- see
+  // vgpu_intr for what happens when this registration is missing.
+  if (g->isr)
+    irq_register(d->irq, vgpu_intr, g, "virtio-gpu", 1);
+  else
+    cprintf("virtio-gpu: no ISR capability; leaving irq %d unclaimed\n", d->irq);
+
   g->ready = 1;
-  cprintf("virtio-gpu: %dx%d, %d KB framebuffer, queue %d\n",
-          g->width, g->height, g->fb_bytes / 1024, g->qsize);
+  cprintf("virtio-gpu: %dx%d, %d KB framebuffer, queue %d, irq %d\n",
+          g->width, g->height, g->fb_bytes / 1024, g->qsize, d->irq);
   return 0;
 }