time: read the clock from the TSC, not from counting interrupts

A timer interrupt that arrives while interrupts are disabled is not delayed,
it is lost -- the LAPIC in periodic mode holds one pending interrupt and drops
the rest. So anything the kernel does with interrupts off for longer than
10 ms makes `ticks` run slow, and it never catches up.

That has now presented twice as "uptime is wrong": once as an interrupt storm
taking 83% of the CPU, once as heavy console output on a display that is
expensive to draw to. Both times the tick was the messenger, and both times it
looked like a timekeeping bug.

monotonic() reads the TSC instead. It is a counter in the silicon that
advances whether or not this kernel is paying attention, it is already
measured against the PIT at boot, and reading it is one instruction and no
lock. wallclock(), /proc/uptime, sysinfo, getrusage and times() all go through
it now.

`ticks` keeps the job it is good at -- the scheduler preempts on it, sleep()
counts it -- where losing one means a slightly longer sleep rather than a
wrong answer about what time it is.

Lost ticks are no longer harmful, which makes them invisible, which is worse.
So /proc/interrupts now says

    timer: 3383 ticks taken, 3387 expected

and names the gap when it grows, because a machine dropping timer interrupts
is spending too long with interrupts disabled, and that is worth knowing
before it turns into a clock that lies.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/dev/irq.c

@@ -269,5 +269,34 @@ irq_info(char *buf, int cap)
       off = emit(buf, cap, off, " [spurious]");
     off = emit(buf, cap, off, line[irq].level_low ? " level\n" : " edge\n");
   }
+
+  // How many timer interrupts were lost.
+  //
+  // The clock does not depend on this any more -- kernel/core/time.c reads the
+  // TSC -- but that makes lost ticks *invisible* rather than harmless, and
+  // they are not harmless: the scheduler preempts on them, and a machine
+  // dropping them is a machine spending too long with interrupts disabled.
+  //
+  // Twice now that has been diagnosed from the outside, by noticing a clock
+  // running slow, which is a terrible way to find out. This is the number to
+  // look at instead: expected is elapsed time times HZ, and the gap is how
+  // many the machine did not take.
+  {
+    uint64 sec, usec;
+    monotonic(&sec, &usec);
+    uint64 expect = sec * HZ + (usec * HZ) / 1000000;
+    uint64 got    = ticks;
+    off = emit(buf, cap, off, "\ntimer: ");
+    off = emit_dec(buf, cap, off, got, 0);
+    off = emit(buf, cap, off, " ticks taken, ");
+    off = emit_dec(buf, cap, off, expect, 0);
+    off = emit(buf, cap, off, " expected");
+    if (expect > got + HZ) {
+      off = emit(buf, cap, off, " -- LOSING ");
+      off = emit_dec(buf, cap, off, expect - got, 0);
+      off = emit(buf, cap, off, ", interrupts are off too long somewhere");
+    }
+    off = emit(buf, cap, off, "\n");
+  }
   return off;
 }

kernel/dev/procfs.c

@@ -127,15 +127,22 @@ gen_meminfo(struct sbuf *sb)
   sb_kv(sb, "SwapFree:       ", 0, "kB");
 }
 
+
+void gen_schinit(struct sbuf *sb);   /* defined at the end of this file */
+
 static void
 gen_uptime(struct sbuf *sb)
 {
-  uint t = uptime();            // timer ticks, HZ of them per second
-  uint frac = (t % HZ) * 100 / HZ;   // hundredths, whatever HZ happens to be
-  sb_putu(sb, t / HZ);
+  // From the TSC, not from the tick count -- see monotonic() in
+  // kernel/core/time.c. A tick lost while interrupts were disabled is lost
+  // forever, so anything derived from ticks runs slow under load and never
+  // catches up. This is the number people check when they suspect that.
+  uint64 sec, usec;
+  monotonic(&sec, &usec);
+  sb_putu(sb, (uint)sec);
   sb_putc(sb, '.');
-  sb_putu(sb, frac / 10);
-  sb_putu(sb, frac % 10);
+  sb_putu(sb, (uint)(usec / 100000));
+  sb_putu(sb, (uint)((usec / 10000) % 10));
   sb_puts(sb, " 0.00\n");       // idle time: not tracked
 }
 
@@ -425,6 +432,7 @@ proc_gen_global(int id, char *buf, int cap)
   case PROC_PCI:         sb.len = pci_info(buf, PROC_BUFSZ); break;
   // Likewise irq.c: it owns the table, so it renders it.
   case PROC_INTERRUPTS:  sb.len = irq_info(buf, PROC_BUFSZ); break;
+  case 16:               gen_schinit(&sb);       break;
   // And likewise net.c, which is the only file here allowed to include lwIP's
   // headers -- reaching into the stack from this one would put them on every
   // kernel file's include path.
@@ -520,3 +528,56 @@ procwrite(struct inode *ip, uint64 off, char *src, int n)
     return -1;
   return proc_write_sysrq(0, (uint64)src, (uint)n);
 }
+
+// ---------------------------------------------------------------------------
+// /proc/schinit -- the job table
+// ---------------------------------------------------------------------------
+//
+// docs/plan/init.md part 2. PID 1 writes this whenever the table changes and
+// anyone may read it; a supervisor that has just been restarted reads it back
+// and knows what is running without having started any of it.
+//
+// The kernel holds the text and does not interpret it. That is deliberate: a
+// procfs generator runs in the kernel, and walking PID 1's memory to answer a
+// read would put this file's format into the kernel, where it would then have
+// to be kept in step with a userspace program. Instead the kernel is a
+// pinboard -- PID 1 knows the format and knows when it changed.
+//
+// procfs rather than a file on disk for four reasons: it survives a read-only
+// root, it survives a full disk, it costs no I/O, and it is already the
+// pattern this kernel uses for exactly this kind of question.
+
+#define SCHINIT_TABLE_MAX 2048
+
+static char schinit_table[SCHINIT_TABLE_MAX];
+static int  schinit_table_len;
+
+int
+proc_write_schinit(int user_src, uint64 src, uint n)
+{
+  if (n > SCHINIT_TABLE_MAX)
+    n = SCHINIT_TABLE_MAX;
+
+  // A write replaces the table rather than appending to it. There is one
+  // writer and it always sends the whole thing, so append would only be a way
+  // to accumulate stale rows.
+  if (user_src) {
+    if (copy_from_user(schinit_table, src, n) < 0)
+      return -EFAULT;
+  } else {
+    memmove(schinit_table, (char *)src, n);
+  }
+  schinit_table_len = (int)n;
+  return (int)n;
+}
+
+void
+gen_schinit(struct sbuf *sb)
+{
+  if (schinit_table_len == 0) {
+    sb_puts(sb, "generation 0\nsupervisor 0\n");
+    return;
+  }
+  for (int i = 0; i < schinit_table_len; i++)
+    sb_putc(sb, schinit_table[i]);
+}