feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

crates/servers/storage-server/src/server.rs

@@ -50,6 +50,9 @@ pub struct StorageServer<F: FileSystem, H: Host> {
     clients: [Option<Client>; MAX_CLIENTS],
     owners: [Option<Owner>; MAX_HANDLES],
     log: Option<CapSlot>,
+    /// The master key's halves, from the gatekeeper through init: what the
+    /// disk's encryption will be keyed with.
+    key: [Option<[usize; 2]>; 2],
 }
 
 impl<F: FileSystem, H: Host> StorageServer<F, H> {
@@ -61,6 +64,7 @@ impl<F: FileSystem, H: Host> StorageServer<F, H> {
             clients: [const { None }; MAX_CLIENTS],
             owners: [None; MAX_HANDLES],
             log: None,
+            key: [None; 2],
         }
     }
 
@@ -83,6 +87,23 @@ impl<F: FileSystem, H: Host> StorageServer<F, H> {
         }
     }
 
+    /// Only the unbadged holder (init), each half only once: nobody can
+    /// replace the key later.
+    fn set_key(&mut self, badge: usize, half: usize, words: [usize; 2]) -> StorageResponse {
+        match (badge, self.key.get_mut(half)) {
+            (0, Some(slot @ None)) => {
+                *slot = Some(words);
+                StorageResponse::Ok
+            }
+            _ => StorageResponse::Error,
+        }
+    }
+
+    /// Whether the whole master key has arrived.
+    pub fn unlocked(&self) -> bool {
+        self.key.iter().all(Option::is_some)
+    }
+
     pub fn filesystem(&self) -> &F {
         &self.fs
     }
@@ -265,7 +286,7 @@ impl<F: FileSystem, H: Host> StorageServer<F, H> {
             None => R::NotFound,
         };
         let response = match request {
-            Attach | SetLog | Release => R::Error,
+            Attach | SetLog | SetKey { .. } | Release => R::Error,
             Grant { path_len, write } => {
                 let narrower = scope.narrow(&buf[sent(path_len)], write);
                 return match narrower.and_then(|s| grants.add(badge, s, |b| host.mint(b))) {
@@ -368,6 +389,7 @@ impl<F: FileSystem, H: Host> Server for StorageServer<F, H> {
     ) -> ([usize; 4], Option<Give>) {
         match StorageRequest::decode(words) {
             Some(StorageRequest::SetLog) => (self.set_log(badge, cap).encode(), None),
+            Some(StorageRequest::SetKey { half, words }) => (self.set_key(badge, half, words).encode(), None),
             // A badge storage never issued, or one it has taken back.
             Some(request) => match self.grants.scope(badge) {
                 None => (StorageResponse::Denied.encode(), None),