feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

crates/servers/terminal-server/src/server.rs

@@ -157,9 +157,9 @@ impl<C: Console> TerminalServer<C> {
         }
     }
 
-    /// Edits a line from the keyboard, echoing it, until Enter. Ctrl+C
-    /// drops it and reads as an empty line.
-    fn read_line(&mut self) {
+    /// Edits a line from the keyboard, echoing it (as `*` if `secret`),
+    /// until Enter. Ctrl+C drops it and reads as an empty line.
+    fn read_line(&mut self, secret: bool) {
         self.console.flush();
         // Flushed now; a flush timer still running is harmless.
         self.flush_pending = false;
@@ -190,7 +190,7 @@ impl<C: Console> TerminalServer<C> {
                 b if self.line_len + 1 < MAX_LINE && (b' '..=b'~').contains(&b) => {
                     self.line[self.line_len] = b;
                     self.line_len += 1;
-                    self.grid.put(b);
+                    self.grid.put(if secret { b'*' } else { b });
                 }
                 _ => continue,
             }
@@ -202,14 +202,18 @@ impl<C: Console> TerminalServer<C> {
     }
 
     /// The next chunk of the typed line, reading one first if none is left.
-    fn read(&mut self) -> [usize; 4] {
+    /// A secret line never reaches the screen, and is forgotten once read.
+    fn read(&mut self, secret: bool) -> [usize; 4] {
         if self.line_read == self.line_len {
-            self.read_line();
+            self.read_line(secret);
         }
         let end = (self.line_read + TEXT_BYTES).min(self.line_len);
-        let chunk = &self.line[self.line_read..end];
+        let words = text_words(&self.line[self.line_read..end]);
         self.line_read = end;
-        text_words(chunk)
+        if secret && self.line_read == self.line_len {
+            self.line.fill(0);
+        }
+        words
     }
 }
 
@@ -230,7 +234,8 @@ impl<C: Console> Server for TerminalServer<C> {
 
     fn handle_call(&mut self, _badge: usize, words: [usize; 4], cap: Option<CapSlot>) -> ([usize; 4], Option<libkos::syscall::Give>) {
         let reply = match words[0] {
-            types::terminal::READ => self.read(),
+            types::terminal::READ => self.read(false),
+            types::terminal::READ_SECRET => self.read(true),
             types::terminal::REDRAW => {
                 // Taking focus back clears the screen.
                 self.console.take_focus();

crates/servers/terminal-server/src/tests/server.rs

@@ -176,3 +176,13 @@ fn rows_are_drawn_only_as_wide_as_their_text_or_what_it_replaces() {
     // Cleared: the old five cells and the cursor after them are erased.
     assert!(t.console().rows_drawn.contains(&(0, 6)), "{:?}", t.console().rows_drawn);
 }
+
+#[test]
+fn a_secret_line_shows_stars_and_is_forgotten() {
+    let mut t = term(b"hunter2\n");
+    let (words, _) = t.handle_call(1, [types::terminal::READ_SECRET, 0, 0, 0], None);
+    let (bytes, len) = text_of(words).unwrap();
+    assert_eq!(&bytes[..len], b"hunter2\n");
+    assert_eq!(&t.grid().row(0)[..8], b"*******\x20");
+    assert!(!t.grid().row(0).windows(7).any(|w| w == b"hunter2"));
+}