gfx: the console and the crash screen stop drawing on a driver by name

Same disease as the network stack, one subsystem over. kernel/dev/vga.c
was three things wearing one name: the owner of the framebuffer, a
bitmap drawing library, and the text console. Only the first is a
driver, and because they shared a file they shared a prefix -- so
panic.c drew the crash screen with vga_fill_rect, console.c printed with
vga_putc, /dev/fb0 handed out vga_fb_phys, and every one of those files
named a display driver it had no business knowing about.

Split three ways:

  - kernel/drivers/gpu/vga/vga_fb.c owns the VBE framebuffer -- the mode
    the loader programmed and handed over, the aperture, and the display
    class vtable. It is a driver and now lives with the driver that
    finds the card on the bus.
  - kernel/dev/gfx.c draws: pixels, shapes, glyphs, the cursor, scroll,
    the ANSI erase operations. It names no driver. The framebuffer
    arrives through gfx_attach_scanout(), so a driver publishes what it
    owns and this file draws on it without knowing what it is.
  - include/gfx.h is the interface, and says why it is deliberately not
    the display class: that one is about frames -- acquire, present,
    vblank -- and the crash screen has to work when nothing else does.

main() no longer calls a display driver. platform_register_devices()
takes the framebuffer address and brings up whatever owns it, which is
where driver names belong; kernel/drivers/registry.c is the file whose
entire job is naming every driver in the kernel.

virtio-gpu got the e1000 treatment as well: instances in an array, the
instance hung on dev->priv by an `attached` hook, and every op reading
it rather than a file-static. It refused the second adapter outright
before, which is not hypothetical -- integrated plus discrete is an
ordinary laptop. The VGA driver deliberately has no such hook, and says
so: there is one framebuffer the loader programmed however many
VGA-class controllers the bus turns up, and a second one publishing the
same scanout is the truth rather than a bug.

Private headers moved next to their drivers: include/virtio.h and
include/xhci.h each had exactly one includer. include/ is for headers
the rest of the kernel needs.

Deleted rather than moved: consoleinit() programmed the sixteen ANSI
colours into the VGA DAC and disabled text-mode blink, by writing ports
0x3C0-0x3C9 from the console. The comment three lines above the colour
table already said this does nothing in a 32bpp linear mode -- there is
no palette to index -- so it was both dead and in the wrong file.

Verified, and this is a refactor so the evidence is that nothing moved:
  - bootcheck -Fb -Net: 59 [ok], no failures. That covers the console
    through every command, /dev/fb0's geometry, writing pixels through
    write() and mapping the framebuffer through mmap.
  - make crashshot: the crash screen renders exactly as before --
    shapes, glyphs, logo and QR code -- which is the whole of gfx.c
    exercised at once, in a panic, with the scanout attached by a driver.
  - make schcom-test: five pixel assertions from the host oracle still
    pass, so the display class and the compositor above it are unmoved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kernel/drivers/gpu/virtio_gpu/virtio_gpu.c

@@ -59,9 +59,26 @@ struct vgpu {
   void *fb;                    // the framebuffer we scan out from
   uint32 fb_bytes;
   int    ready;
+  // Which PCI device this instance drives, so attached() can match the device
+  // the bus publishes against the instance probe() set up.
+  struct pci_dev *pdev;
 };
 
-static struct vgpu gpu;
+// More than one, because two display adapters in a machine is ordinary --
+// integrated plus discrete on real hardware, two -device virtio-gpu-pci under
+// QEMU -- and this driver used to refuse the second outright.
+#define VGPU_MAX 2
+
+static struct vgpu gpus[VGPU_MAX];
+
+// The instance behind a device, or 0. Every op goes through this rather than a
+// file-static, which is what makes the second adapter possible at all. See
+// include/netdev.h and the e1000 for the same arrangement on the network side.
+static struct vgpu *
+vgpu_of(struct device *d)
+{
+  return d ? (struct vgpu *)d->priv : 0;
+}
 
 // --- MMIO accessors --------------------------------------------------------
 //
@@ -309,51 +326,61 @@ setup_scanout(struct vgpu *g)
 static void
 vgpu_mode(struct device *d, struct display_mode *m)
 {
-  m->width  = gpu.width;
-  m->height = gpu.height;
+  struct vgpu *g = vgpu_of(d);
+
+  if (!g)
+    return;
+  m->width  = g->width;
+  m->height = g->height;
   m->bpp    = 32;
-  m->stride = (uint32)gpu.width * 4;
+  m->stride = (uint32)g->width * 4;
 }
 
 static void *
 vgpu_acquire(struct device *d, uint32 *stride_out)
 {
+  struct vgpu *g = vgpu_of(d);
+
+  if (!g)
+    return 0;
   if (stride_out)
-    *stride_out = (uint32)gpu.width * 4;
+    *stride_out = (uint32)g->width * 4;
   // No separate back buffer: the guest-side framebuffer already *is* one. The
   // host cannot see it until TRANSFER_TO_HOST_2D, so drawing into it is
   // inherently off-screen -- which is the whole reason this device is better to
   // composite against than a raw VBE aperture.
-  return gpu.ready ? gpu.fb : 0;
+  return g->ready ? g->fb : 0;
 }
 
 static void
 vgpu_present(struct device *d, int x, int y, int w, int h)
 {
-  if (!gpu.ready)
+  struct vgpu *g = vgpu_of(d);
+
+  if (!g || !g->ready)
     return;
   if (x < 0) { w += x; x = 0; }
   if (y < 0) { h += y; y = 0; }
-  if (x + w > gpu.width)  w = gpu.width - x;
-  if (y + h > gpu.height) h = gpu.height - y;
+  if (x + w > g->width)  w = g->width - x;
+  if (y + h > g->height) h = g->height - y;
   if (w <= 0 || h <= 0)
     return;
 
   {
-    struct virtio_gpu_transfer_to_host_2d *t = gpu.cmd;
+    struct virtio_gpu_transfer_to_host_2d *t = g->cmd;
     hdr_init(t, VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D);
     t->r.x = x; t->r.y = y; t->r.width = w; t->r.height = h;
-    t->offset      = (uint64)y * gpu.width * 4 + (uint64)x * 4;
+    t->offset      = (uint64)y * g->width * 4 + (uint64)x * 4;
     t->resource_id = 1;
-    if (cmd(&gpu, sizeof(*t), sizeof(struct virtio_gpu_ctrl_hdr)) != 0)
+    if (cmd(g, sizeof(*t), sizeof(struct virtio_gpu_ctrl_hdr)) != 0)
       return;
   }
   {
-    struct virtio_gpu_resource_flush *f = gpu.cmd;
+    struct virtio_gpu_resource_flush *f = g->cmd;
     hdr_init(f, VIRTIO_GPU_CMD_RESOURCE_FLUSH);
     f->r.x = x; f->r.y = y; f->r.width = w; f->r.height = h;
     f->resource_id = 1;
-    cmd(&gpu, sizeof(*f), sizeof(struct virtio_gpu_ctrl_hdr));
+    cmd(g, sizeof(*f), sizeof(struct virtio_gpu_ctrl_hdr));
   }
 }
 
@@ -372,10 +399,16 @@ const struct display_ops virtio_gpu_display_ops = {
 static int
 vgpu_probe(struct pci_dev *d)
 {
-  struct vgpu *g = &gpu;
+  struct vgpu *g = 0;
 
-  if (g->ready)
-    return -1;                     // one display is enough for now
+  for (int i = 0; i < VGPU_MAX; i++)
+    if (!gpus[i].ready) {
+      g = &gpus[i];
+      break;
+    }
+  if (!g)
+    return -1;                     // every slot already drives an adapter
+  g->pdev = d;
 
   pci_enable(d, 0x0006);           // memory space + bus master
 
@@ -443,9 +476,23 @@ static const struct pci_match virtio_gpu_match[] = {
   { 0, 0, 0, 0 },
 };
 
+// Hang the instance on the device the bus has just published. probe() runs
+// before device_add(), so there is nothing to attach it to in there -- see the
+// comment on `attached` in include/pci.h.
+static void
+vgpu_attached(struct pci_dev *d, struct device *dev)
+{
+  for (int i = 0; i < VGPU_MAX; i++)
+    if (gpus[i].ready && gpus[i].pdev == d) {
+      dev->priv = &gpus[i];
+      return;
+    }
+}
+
 const struct pci_driver virtio_gpu_driver = {
   .name  = "virtio-gpu",
   .match = virtio_gpu_match,
   .ops   = &virtio_gpu_display_ops,
   .probe = vgpu_probe,
+  .attached = vgpu_attached,
 };