feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

scripts/make-disk-image.sh

@@ -46,6 +46,7 @@ copy permission-manager permission
 copy session-server     session
 copy terminal-server    terminal
 copy shell              shell
+copy gatekeeper         gatekeeper
 # Apps.
 app cat
 app ls

scripts/test-qemu.sh

@@ -1,20 +1,58 @@
 #!/bin/bash
 # Boots IMAGE headless and waits for the self-test (init's SMP checks, then
-# spawntest) to report; the machine halts itself when done. Exit 0 only on
-# "SMPTEST PASS".
+# spawntest) to report; the machine halts itself when done. Twice, on one
+# fresh keystore: the first boot sets a passcode up at the gatekeeper, the
+# second gets it wrong once and then right. Exit 0 only if both unlock and
+# both say "SMPTEST PASS".
 set -uo pipefail
 
 IMAGE="${1:?usage: test-qemu.sh IMAGE}"
 SMP="${SMP:-4}"
 KERNEL="target/riscv64gc-unknown-none-elf/release/adapter-riscv"
 LOG="$(mktemp -t kos-test-qemu.XXXXXX)"
+KEYS="${LOG}.keys"
+MON="${LOG}.mon"
+truncate -s 64K "${KEYS}"
 
-timeout ${QT:-120} qemu-system-riscv64 -machine virt -smp "${SMP}" -bios default \
-    -kernel "${KERNEL}" \
-    -drive "file=${IMAGE},if=none,format=raw,id=hd0" -device virtio-blk-device,drive=hd0 \
-    -device virtio-gpu-device -device virtio-keyboard-device \
-    -display none -serial "file:${LOG}" -monitor none
+# Types `lines` (one per argument) at the gatekeeper once it waits.
+owner() {
+    for _ in $(seq 300); do grep -aq "gatekeeper: waiting" "${LOG}" 2>/dev/null && break; sleep 0.2; done
+    for line in "$@"; do
+        for ((i = 0; i < ${#line}; i++)); do
+            echo "sendkey ${line:i:1}" | socat - "unix-connect:${MON}" >/dev/null 2>&1; sleep 0.05
+        done
+        echo "sendkey ret" | socat - "unix-connect:${MON}" >/dev/null 2>&1; sleep 0.3
+    done
+}
+
+# One boot; `owner` types the arguments. Its serial output lands in LOG.
+boot() {
+    : > "${LOG}"; rm -f "${MON}"
+    owner "$@" &
+    timeout ${QT:-120} qemu-system-riscv64 -machine virt -smp "${SMP}" -bios default \
+        -kernel "${KERNEL}" \
+        -drive "file=${IMAGE},if=none,format=raw,id=hd0" -device virtio-blk-device,drive=hd0 \
+        -drive "file=${KEYS},if=none,format=raw,id=ks" -device virtio-blk-device,drive=ks \
+        -device virtio-rng-device -device virtio-gpu-device -device virtio-keyboard-device \
+        -display none -serial "file:${LOG}" -monitor "unix:${MON},server,nowait"
+    local s=$?
+    wait
+    return $s
+}
+
+# First boot: a new passcode (twice), no duress passcode (twice empty).
+boot 1234 1234 "" ""
 status=$?
+first_ok=0
+grep -aq "the owner is in" "${LOG}" && grep -aq "SMPTEST PASS" "${LOG}" && first_ok=1
+echo "test-qemu: first boot: passcode set up: $([ ${first_ok} -eq 1 ] && echo ok || echo FAIL)"
+# Second boot: the keystore remembers; a wrong guess, then the passcode.
+boot 9999 1234
+[ ${status} -eq 0 ] && status=$?
+second_ok=0
+grep -aq "the owner is in" "${LOG}" && second_ok=1
+echo "test-qemu: second boot: wrong passcode refused, right one unlocks: $([ ${second_ok} -eq 1 ] && echo ok || echo FAIL)"
+rm -f "${KEYS}" "${MON}"
 
 grep -a "smptest:\|spawntest:\|Hello\|SMPTEST" "${LOG}"
 # What k-os wrote must be ext4 that the real tools accept.
@@ -29,7 +67,7 @@ if command -v e2fsck >/dev/null && command -v debugfs >/dev/null; then
     fi
     rm -f "${LOG}.fsck"
 fi
-if [ "${disk_ok}" -eq 1 ] && grep -aq "SMPTEST PASS" "${LOG}"; then
+if [ "${disk_ok}" -eq 1 ] && [ ${first_ok} -eq 1 ] && [ ${second_ok} -eq 1 ] && grep -aq "SMPTEST PASS" "${LOG}"; then
     echo "test-qemu: pass (${SMP} harts)"
     rm -f "${LOG}"
     exit 0