Extend `autoboot_delay' handling - is this variable is set to -1 don't allow

user to interrupt autoboot process at all. Currently, even when
`autoboot_delay' is set to 0, loader(8) still allows autoboot process to be
interrupted by pressing any key on the console when the loader reads kernel
and modules from the disk. In some cases (i.e. untrusted environment) such
behaviour is highly indesirable and user should not be allowed to interfere
with the autoboot process at all.

Sponsored by:	PBXpress Inc.
MFC after:	3 days

4 files changed, 70 insertions, 29 deletions

diff --git a/sys/boot/common/boot.c b/sys/boot/common/boot.c
index ca5c15d..515d0fa 100644
--- a/sys/boot/common/boot.c
+++ b/sys/boot/common/boot.c
@@ -166,15 +166,14 @@ autoboot(int timeout, char *prompt)
     autoboot_tried = 1;
 
     if (timeout == -1) {
+        timeout = 10;
 	/* try to get a delay from the environment */
 	if ((cp = getenv("autoboot_delay"))) {
 	    timeout = strtol(cp, &ep, 0);
 	    if (cp == ep)
-		timeout = -1;
+		timeout = 10;		/* Unparseable? Set default! */
 	}
     }
-    if (timeout == -1)		/* all else fails */
-	timeout = 10;
 
     kernelname = getenv("kernelname");
     if (kernelname == NULL) {
@@ -187,32 +186,38 @@ autoboot(int timeout, char *prompt)
 	}
     }
 
-    otime = time(NULL);
-    when = otime + timeout;	/* when to boot */
-    yes = 0;
-
-    printf("%s\n", (prompt == NULL) ? "Hit [Enter] to boot immediately, or any other key for command prompt." : prompt);
-
-    for (;;) {
-	if (ischar()) {
-	    c = getchar();
-	    if ((c == '\r') || (c == '\n'))
-		yes = 1;
-	    break;
-	}
-	ntime = time(NULL);
-	if (ntime >= when) {
-	    yes = 1;
-	    break;
-	}
-
-	if (ntime != otime) {
-	    printf("\rBooting [%s] in %d second%s... ",
-	    		kernelname, (int)(when - ntime),
-			(when-ntime)==1?"":"s");
-	    otime = ntime;
-	}
+    if (timeout >= 0) {
+        otime = time(NULL);
+        when = otime + timeout;	/* when to boot */
+
+        yes = 0;
+
+        printf("%s\n", (prompt == NULL) ? "Hit [Enter] to boot immediately, or any other key for command prompt." : prompt);
+
+        for (;;) {
+	    if (ischar()) {
+	        c = getchar();
+	        if ((c == '\r') || (c == '\n'))
+		    yes = 1;
+	        break;
+	    }
+	    ntime = time(NULL);
+	    if (ntime >= when) {
+	        yes = 1;
+	        break;
+	    }
+
+	    if (ntime != otime) {
+	        printf("\rBooting [%s] in %d second%s... ",
+	    		    kernelname, (int)(when - ntime),
+			    (when-ntime)==1?"":"s");
+	        otime = ntime;
+	    }
+        }
+    } else {
+        yes = 1;
     }
+
     if (yes)
 	printf("\rBooting [%s]...               ", kernelname);
     putchar('\n');
diff --git a/sys/boot/common/help.common b/sys/boot/common/help.common
index 02bc376..036f06b 100644
--- a/sys/boot/common/help.common
+++ b/sys/boot/common/help.common
@@ -133,6 +133,8 @@
 	set autoboot_delay=<value>
 
 	Sets the default delay for the autoboot command to <value> seconds.
+	Set value to -1 if you don't want to allow user to interrupt autoboot
+	process and escape to the loader prompt.
 
 ################################################################################
 # Tset Sbootfile DSet the default boot file set
diff --git a/sys/boot/common/loader.8 b/sys/boot/common/loader.8
index 67a5869..b67f8bf 100644
--- a/sys/boot/common/loader.8
+++ b/sys/boot/common/loader.8
@@ -111,6 +111,21 @@ If the system gets past this point,
 will be set and
 .Nm
 will engage interactive mode.
+Please note that historically even when
+.Va autoboot_delay
+is set to
+.Dq 0
+user will be able to interrupt autoboot process by pressing some key
+on the console while kernel and modules are being loaded.  In some
+cases such behaviour may be undesirable, to prevent it set
+.Va autoboot_delay
+to
+.Dq -1 ,
+in this case
+.Nm
+will engage interactive mode only if
+.Ic autoboot
+has failed.
 .Sh BUILTIN COMMANDS
 In
 .Nm ,
@@ -329,6 +344,22 @@ will be automatically attempted after processing
 though explicit
 .Ic autoboot Ns 's
 will be processed normally, defaulting to 10 seconds delay.
+.Pp
+If set to
+.Dq 0
+no delay will inserted, but user still will be able to interrupt
+.Ic autoboot
+process and escape into the interactive mode by pressing some key
+on the console while kernel and
+modules are being loaded.
+.Pp
+If set to
+.Dq -1
+no delay will inserted and
+.Nm
+will engange interactive mode only if
+.Ic autoboot
+has failed for some reason.
 .It Va boot_askname
 Instructs the kernel to prompt the user for the name of the root device
 when the kernel is booted.
diff --git a/sys/boot/forth/loader.conf b/sys/boot/forth/loader.conf
index 4496357..9b0c9cd 100644
--- a/sys/boot/forth/loader.conf
+++ b/sys/boot/forth/loader.conf
@@ -42,7 +42,10 @@ loader_color="NO"		# Set this to YES to enable splash screen colors
 ###  Loader settings  ########################################
 ##############################################################
 
-#autoboot_delay="10"		# Delay in seconds before autobooting
+#autoboot_delay="10"		# Delay in seconds before autobooting,
+				# set to -1 if you don't want user to be
+				# allowed to interrupt autoboot process and
+				# escape to the loader prompt
 #beastie_disable="NO"		# Turn the beastie boot menu on and off
 #console="vidconsole"		# Set the current console
 #currdev="disk1s1a"		# Set the current device