feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

crates/types/src/bounded.rs

@@ -3,7 +3,9 @@ use crate::macros::bounded;
 // Kani runs the real kernel with tiny tables; see kernel/src/proofs.
 bounded!(CapSlot, u8, 0, if cfg!(kani) { 3 } else { 63 });
 bounded!(Priority, u8, 0, 31);
-bounded!(PageCount, u16, 1, 1024);
+// Up to a process's whole address window (32 MiB): one request may be big (a
+// KDF's memory); budgets bound how much anyone gets.
+bounded!(PageCount, u16, 1, 8192);
 
 impl Priority {
     pub const DEFAULT: Self = Self(16);

crates/types/src/gatekeeper.rs

@@ -0,0 +1,13 @@
+//! Init and the gatekeeper: after handing it the keystore and randomness
+//! (device setup calls), init calls `UNLOCK`, which returns once the owner
+//! is authenticated (`OK`) or the gatekeeper cannot go on (`FAILED`); then
+//! `KEY`, whose reply is the 32-byte master key in its four words. The
+//! gatekeeper then exits. Only the unbadged holder (init) is answered.
+
+pub const UNLOCK: usize = 1;
+pub const KEY: usize = 2;
+
+pub mod reply {
+    pub const OK: usize = 0;
+    pub const FAILED: usize = 1;
+}

crates/types/src/lib.rs

@@ -8,6 +8,7 @@ pub mod bootinfo;
 pub mod bounded;
 pub mod budget;
 pub mod display;
+pub mod gatekeeper;
 pub mod generation;
 pub mod id;
 pub mod input;

crates/types/src/storage.rs

@@ -33,6 +33,9 @@ pub mod op {
     /// Takes back the grant this is called through, and everything
     /// granted from it, from every holder.
     pub const RELEASE: usize = 12;
+    /// Half the master key (word 1: which half, words 2..4: it), from the
+    /// unbadged holder (init) only, each half once.
+    pub const SET_KEY: usize = 13;
 }
 
 /// Reply tags (word 0).

crates/types/src/terminal.rs

@@ -5,6 +5,9 @@
 /// the line's last chunk ends with `\n`. Blocks until a line is entered.
 pub const READ: usize = 10;
 pub const CLEAR: usize = 11;
+/// As `READ`, but what is typed shows as `*` and is forgotten once read:
+/// for passcodes.
+pub const READ_SECRET: usize = 14;
 /// Repaints the whole screen and takes input focus back, after a program
 /// that drew on the screen itself.
 pub const REDRAW: usize = 12;