gfx: the second head shows the boot, not just what comes after it

Two things, both asked for.

**The crash report no longer says which monitors it reached.** "The report is
on the virtio-gpu display too" was a line about the crash screen printed on the
crash screen. The report says what happened and where to read it again; that is
not part of it.

**And the second head now shows the F8 menu and the boot.** It used to be black
until vgpud started several seconds into userspace -- through the splash,
through the menu, through every boot message -- which from the outside is
indistinguishable from a display that does not work. Three stages now cover the
whole boot and hand over to each other without coordinating:

*The loader.* LocateProtocol() answers with the first GOP and offers no way to
ask for the rest, so the rest are found by handle and fed the primary's
framebuffer as a Blt source at the points where a screen is finished: the menu,
the resolution chooser, system information, the splash, each segment of the
kernel load. Blt rather than a second framebuffer to draw into, because a
virtio GOP does not have one -- the same fact that made a virtio-only machine
reboot-loop two commits ago.

*The kernel.* gfx remembers which rows were drawn, as one span rather than a
list of rectangles, because console output is lines and a span is what lines
make. display_mirror_console() copies that span across: a line of boot text is
one cell-row transfer, not a screen. Primed once after pci_init(), because a
display that has just appeared has a black scanout and the console it should be
showing was drawn by the loader into a framebuffer it knows nothing about.

*Then vgpud*, from the same console framebuffer, unchanged.

**Two bugs found building it, both worth the retelling.**

The mirror ran per character from inside vt_feed -- which is inside the console
lock -- and vga_disp_acquire() announces its back buffer with a cprintf. A CPU
taking a lock it already holds, with a call chain that said exactly that. It
runs at the end of consolewrite() and cprintf() now, outside the lock, which is
also the better batching: one transfer per write instead of one per character.

And "is this the console's own screen" was asked of the pointer acquire()
returned. vga_fb hands back a back buffer it copies onto the console's
framebuffer afterwards, so on a one-screen machine the answer was "a different
screen" -- and the console was mirrored onto itself through two megabytes of
intermediate, allocated for the purpose. display_ops grew scanout_phys, which
is a fact about the hardware rather than a policy a driver can get subtly
wrong, and it is asked first: it has no side effects and acquire() has two.

Verified with two heads under QEMU, screendumping the virtio head every 400 ms
from power-on: splash, splash, splash, then the console, and it stays. The F8
menu appears on it; choosing 1024x768 there brings both heads up at 1024x768
byte-identical. A panic still reaches both. Both supported configurations: one
boot each, no traps, no panics, socktest and memfdtest green.

One gap remains and is documented rather than hidden: while the kernel's driver
resets the device during probe, QEMU shows "Display output is not active" for a
fraction of a second. A device being taken over has no scanout until the new
driver sets one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kernel/dev/gfx.c

@@ -69,6 +69,41 @@ static void   draw_glyph_px(int x, int y, uint32 cp, uint32 fg, uint32 bg);
 static struct fb_info scanout;
 static volatile uchar *fb;
 
+// What has been drawn since anyone last asked.
+//
+// The console framebuffer is one screen on a machine that may have two, and
+// the second one is a copy of this that somebody has to make. Copying all of
+// it every time would be four megabytes to move one line of text, so the rows
+// that were touched are remembered as a single span -- not a list of
+// rectangles, because console output is lines and a span is what lines make.
+//
+// Rows rather than pixels: the copy is row-at-a-time anyway, and a column
+// range would save nothing a memcpy cares about.
+static int dmg_y0 = -1, dmg_y1 = -1;
+
+static void
+damage(int y0, int y1)
+{
+  if (y0 < 0) y0 = 0;
+  if (y1 >= (int)scanout.height) y1 = (int)scanout.height - 1;
+  if (y1 < y0) return;
+  if (dmg_y0 < 0 || y0 < dmg_y0) dmg_y0 = y0;
+  if (dmg_y1 < 0 || y1 > dmg_y1) dmg_y1 = y1;
+}
+
+// Hand the span over and forget it. Returns 0 when nothing has changed, which
+// is the common case and the reason the caller can afford to ask often.
+int
+gfx_damage_take(int *y0, int *y1)
+{
+  if (dmg_y0 < 0)
+    return 0;
+  *y0 = dmg_y0;
+  *y1 = dmg_y1;
+  dmg_y0 = dmg_y1 = -1;
+  return 1;
+}
+
 static int cursor_x = 0;
 static int cursor_y = 0;
 // Current fill color for glyph backgrounds, backspace erase, and scroll --
@@ -125,6 +160,8 @@ gfx_draw_pixel(int x, int y, uint32 color)
 
   uint32 offset = (y * scanout.stride) + (x * (scanout.bpp / 8));
 
+  damage(y, y);
+
   if (scanout.bpp == 32) {
     *(volatile uint32*)(fb + offset) = color;
   } else if (scanout.bpp == 24) {
@@ -404,6 +441,7 @@ gfx_scroll_up(uint32 bg)
   uint32 total_size = scanout.stride * scanout.height;
 
   memmove((void*)fb, (void*)(fb + line_size), total_size - line_size);
+  damage(0, (int)scanout.height - 1);   // a scroll moves every row
 
   for (int y = (int)scanout.height - CHAR_HEIGHT; y < (int)scanout.height; y++)
     for (int x = 0; x < (int)scanout.width; x++)
@@ -566,6 +604,8 @@ gfx_fill_rect(int x0, int y0, int w, int h, uint32 color)
   if (w <= 0 || h <= 0)
     return;
 
+  damage(y0, y0 + h - 1);
+
   // Only the 32bpp case gets the fast path; anything else is rare enough that
   // correctness through gfx_draw_pixel is the better trade.
   if (scanout.bpp != 32) {