feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

crates/init/src/manifest.rs

@@ -7,6 +7,8 @@ use types::budget::Limits;
 pub enum Device {
     Gpu,
     Input,
+    Keystore,
+    Random,
 }
 
 /// A storage grant: a folder (or the whole disk, `b""`) and whether it may
@@ -23,7 +25,11 @@ pub struct Program {
     pub limits: Limits,
     /// Serves an endpoint, which it finds in slot 0.
     pub serves: bool,
-    pub device: Option<Device>,
+    /// Handed over in this order, after it starts.
+    pub devices: &'static [Device],
+    /// Authenticates the owner: init waits for the master key before
+    /// starting anything that touches user data.
+    pub unlocks: bool,
     /// Earlier programs' endpoints it may call, in its next slots; each
     /// program's copy carries its own badge, so a server can tell them apart.
     pub uses: &'static [&'static str],
@@ -51,7 +57,8 @@ const fn server(name: &'static str, file: &'static [u8], limits: Limits) -> Prog
         file,
         limits,
         serves: true,
-        device: None,
+        devices: &[],
+        unlocks: false,
         uses: &[],
         storage: None,
         console: false,
@@ -63,16 +70,26 @@ const fn server(name: &'static str, file: &'static [u8], limits: Limits) -> Prog
 /// Started on every boot. The log server comes first so the rest can print.
 pub const SERVERS: &[Program] = &[
     Program { console: true, ..server("log", b"bin/log", SMALL) },
-    Program { device: Some(Device::Input), ..server("input", b"bin/input", Limits { regions: 4, ..SMALL }) },
+    Program { devices: &[Device::Input], ..server("input", b"bin/input", Limits { regions: 4, ..SMALL }) },
     // The input server's only client: it passes input on to the app in focus.
     Program {
-        device: Some(Device::Gpu),
+        devices: &[Device::Gpu],
         uses: &["input"],
         // The framebuffer alone is ~1000 pages at 1280x800.
         ..server("display", b"bin/display", Limits { pages: 1280, regions: 4, ..SMALL })
     },
     // Text on the display, lines from the keyboard (it takes input focus).
     Program { uses: &["display"], ..server("terminal", b"bin/terminal", SMALL) },
+    // Nothing that touches user data starts before the owner is in. It
+    // holds the screen (through the terminal), its keystore and randomness,
+    // and exits once it has handed over the key.
+    Program {
+        uses: &["terminal"],
+        devices: &[Device::Keystore, Device::Random],
+        unlocks: true,
+        // argon2's 16 MiB, its image and a little more.
+        ..server("gatekeeper", b"bin/gatekeeper", Limits { pages: 4096 + 160, regions: 6, ..SMALL })
+    },
     // The only one that equips apps (docs/apps.md): it reaches every app's
     // files and the owner's decisions, and runs apps through init.
     Program {