#include <PR/bcp.h>
#include <PR/R4300.h>
#include <PR/bbsim.h>
#include <PR/bbskapi.h>

#include <PR/os.h>
#include <PR/os_bb.h>
#include <PR/os_bbfs.h>
#include <PR/os_bbatb.h>
#include <PR/os_bbexec.h>
#include <PR/ramrom.h>
#include <PR/gbi.h>

#include "PR/bbnand.h"
#include "os_bbsa.h"
#include <sha1.h>
#include <aes_api.h>
#include "mon.h"
#include "salaunch.h" 
#include "nu64sys.h" 
#include "graph.h"
#include "os_internal_reg.h"
#include "version.h"

#define BB_DIAG_APP  "00000000.app"

/* patch BbCrlBundle pointers from ticket bundle (packaged as
 *  * offsets from wherever 16KB ticket bundle is loaded).
 *   */
#define BOOT_PATCH_RL(_name,_off)                                      \
    if(rlBundle->##_name.head != NULL) rlBundle->##_name.head  =       \
                (BbCrlHead *)(((u32)(rlBundle->##_name.head))          \
                + (u32)(_off));                                          \
    rlBundle->##_name.list =                                           \
                (BbServerSuffix *)(((u32)(rlBundle->##_name.list))     \
                + (u32)(_off));                                          \
    rlBundle->##_name.certChain[0] =                                   \
                (BbCertBase *)(((u32)(rlBundle->##_name.certChain[0])) \
                + (u32)(_off));                                          \
    rlBundle->##_name.certChain[1] =                                   \
                (BbCertBase *)(((u32)(rlBundle->##_name.certChain[1])) \
                + (u32)(_off));

static          OSBbFs fs;
static OSBbStatBuf fsStat;
static char block[BB_FL_BLOCK_SIZE] ALIGN_DCACHE;

int my_poweroff()
{
    __osDisableInt();
    osBbPowerOff();

    /* Busy loop to let CPU spin */
    for (; ;);
}

/* * * * * * *  Heart beat part * * * * * * * * * * * */
#define HEART_BEAT_PRI   9
#define HEART_BEAT_RATE  500000    /*  1 sec */

static OSThread heartThread;
static u64      heartThreadStack[STACKSIZE/sizeof(u64)] __attribute__ ((aligned (8)));
OSMesg          heartMessageBuf;
OSMesgQueue     heartMessageQ;
static int init_heart_beat = 1;

static void heartproc(void  *arg)
{
    int on = 1;
    OSTimer  timer;

    while (1) {
        osBbSetErrorLed(on);
        osSetTimer(&timer, OS_USEC_TO_CYCLES((u64) HEART_BEAT_RATE), 0, &heartMessageQ, NULL);
        osRecvMesg(&heartMessageQ, NULL, OS_MESG_BLOCK);
        on ^= 1;
    }
}

void start_heart_beat()
{
    if (init_heart_beat) { /* create heartbeat thread the first time */
        osCreateMesgQueue(&heartMessageQ, &heartMessageBuf, 1);
        osCreateThread(&heartThread, 9, heartproc, NULL,
                   heartThreadStack+STACKSIZE/sizeof(u64), HEART_BEAT_PRI);
        init_heart_beat = 0;
    }
    osStartThread(&heartThread);
}

void stop_heart_beat()
{
    osStopThread(&heartThread);
    osBbSetErrorLed(0);
}

/* * * *  BG thread to Read SI backdoor and power button * * * */
#define BG_PRIORITY             10
#define BUT_DEBOUCE_TIME        5000
#define BUT_STABLE_TIME         1000000
#define BUT_RELEASED (!((IO_READ(MI_EINTR_REG)&MI_EINTR_BUTTON_PRESSED)))
#define BUT_STATE_CHANGED \
             (IO_READ(MI_EINTR_REG)&MI_INTR_BUT)
#define BUT_CLEAR_STATE_CHANGED \
        IO_WRITE(MI_INTR_EMASK_REG, MI_INTR_MASK_CLR_BUT)
#define CHECK_TIMER     10000        /* checking controller every .01 sec */

static OSMesgQueue              bgMsgQ, siMessageQ;
static OSMesg                   bgMsgBuf, bdretMsg, siMsg;

static char     bgThreadStack[STACKSIZE] __attribute__ ((aligned (16)));
static OSThread bgThread;

static void power_debouce()
{
    u64 end;

    /* debounce button pressed */
    do{
         while(BUT_STATE_CHANGED) {
             BUT_CLEAR_STATE_CHANGED;

             end = OS_CYCLES_TO_USEC(osGetTime()) + BUT_DEBOUCE_TIME;
             while (OS_CYCLES_TO_USEC(osGetTime()) < end);
         }
     } while(!BUT_RELEASED || BUT_STATE_CHANGED);

    IO_WRITE(MI_INTR_EMASK_REG, MI_INTR_MASK_CLR_BUT);
    end = OS_CYCLES_TO_USEC(osGetTime()) + BUT_STABLE_TIME / 2;
    while (OS_CYCLES_TO_USEC(osGetTime()) < end);
    IO_WRITE(MI_INTR_EMASK_REG, MI_INTR_MASK_SET_BUT);

    return;     
}

static void              bgproc(char *argv)
{
    int  key=CONT_L | CONT_G | CONT_R;
    OSContStatus     sdata[MAXCONTROLLERS];
    OSContPad        ctrl_data[MAXCONTROLLERS];
    char pattern;
    OSTimer  timer;

    power_debouce();
    osCreateMesgQueue(&bgMsgQ, &bgMsgBuf, 1);
    osSetEventMesg(OS_EVENT_PRENMI, &bgMsgQ, (OSMesg) OS_EVENT_PRENMI);

    osCreateMesgQueue(&siMessageQ, &siMsg, 1);
    osSetEventMesg(OS_EVENT_SI, &siMessageQ, NULL);
    osContInit(&siMessageQ, &pattern, &sdata[0]);

    for (;;) {
         osSetTimer(&timer, OS_USEC_TO_CYCLES(CHECK_TIMER), 0, &bgMsgQ, NULL);
         osRecvMesg(&bgMsgQ, &bdretMsg, OS_MESG_BLOCK);

         if (bdretMsg) my_poweroff();
         osContStartReadData(&siMessageQ);
         osRecvMesg(&siMessageQ, NULL, OS_MESG_BLOCK);
         osContGetReadData(ctrl_data);

         if ((ctrl_data[0].button & key) == key) {
             osBbCardInit();
             osBbFInit(&fs);
             osBbFDelete("errlog.gng");
             my_poweroff();
         }
    }
}

/* Alternative approach of bg_proc since USB thread have to be 
   higher priority one */
int check_backdoor()
{
    OSContStatus     sdata[MAXCONTROLLERS];
    OSContPad        ctrl_data[MAXCONTROLLERS];
    char pattern;
    int  key=CONT_L | CONT_G | CONT_R;
    int  key_id=CONT_L | CONT_G | CONT_A;

    osSetEventMesg(OS_EVENT_SI, &siMessageQ, (OSMesg)NULL);
    osContInit(&siMessageQ, &pattern, &sdata[0]);

    if (IO_READ(MI_EINTR_REG) & MI_EINTR_BUT_STATUS)
        my_poweroff();

    osContStartReadData(&siMessageQ);
    osRecvMesg(&siMessageQ, NULL, OS_MESG_BLOCK);
    osContGetReadData(ctrl_data);

    if ((ctrl_data[0].button & key) == key) {
         osBbCardInit();
         osBbFInit(&fs);
         osBbFDelete("errlog.gng");
         my_poweroff();
    }

    if ((ctrl_data[0].button & key_id) == key_id) {
        u32 bbid = 0;
        char msg[64];

        skGetId(&bbid); 
        sprintf(msg, "BBID = %d = 0x%x", bbid, bbid);

        clear(0x0);
        osViSwapBuffer(cfb);
        printstr(white, 9, 5, msg);
        osWritebackDCacheAll();

        for (; ;) {
            if (IO_READ(MI_EINTR_REG) & MI_EINTR_BUT_STATUS)
                my_poweroff();
        }
    }

    return key;
}

/* * * * * *  Delete GNG files * * * * * * * * * * * * * * * * */
int delete_gng_tmpfile()
{
    osBbCardInit();
    osBbFInit(&fs);

    osBbFDelete("errlog.gng");
    osBbFDelete(BB_DIAG_APP);

    return 0;
}

/* * * * * * * * Writes sysid file * * * * * * * * * * * * * */
int write_sysid_file()
{
    u32 bbid, tid;
    int fd;
    u16 window, cc[BB_MAX_CC], change=0;

    skGetId(&bbid);
    skGetConsumption(&window, cc);
    window |= BB_TICKET_ID_LIMITED;
    tid = BB_MAX_CC + window;
    for (fd = 0; fd < BB_MAX_CC; fd++)
	change |= cc[fd];
    if (change) {
        for (fd = 0; fd < BB_MAX_CC; fd++) 
            skAdvanceTicketWindow();
    }
    osBbCardInit();
    osBbFInit(&fs);

    osBbFDelete("id.sys");
    fd = osBbFCreate("id.sys", 1, sizeof(block));

    if (fd >= 0) {
        bzero(block, sizeof(block));
        bcopy(&bbid, block, 4);   
        bcopy(&tid, block + sizeof(int)*2, 4); 
        osBbFWrite(fd, 0, block, sizeof(block));
        osBbFClose(fd);
    }
    
    return 0;
}


/* * * * * *  Try to securely launch GNG test * * * * * * * * */
extern u32 __osBbHackFlags;
static u8 tik_data[PI_FLASH_PAGES_PER_BLOCK * PI_FLASH_PAGE_DATA_SIZE] ALIGN_DCACHE;
#define SYSTEM_TEST_DONE  0x200000
u16 cfb[SCREEN_WD*SCREEN_HT] __attribute__((aligned(64)));
int launch_sksa(char *fname);

void clear(u16 bg) 
{
    int i;
    for (i = 0; i < SCREEN_WD*SCREEN_HT; ++i) {
            cfb[i] = bg;
    }
}

static OSMesgQueue      retraceMessageQ;
static OSMesg           retraceMessageBuf, dummyMessage;
int try_to_launch_gng()
{
    int ret=0, fd, launch=1, rv, *p;
    char s_version[32];

    __osBbHackFlags = 0;
    osCreateMesgQueue(&retraceMessageQ, &retraceMessageBuf, 1);
    osViSetEvent(&retraceMessageQ, dummyMessage, 1);
    
    osViBlack(1);
    clear(0x0);
    osViSwapBuffer(cfb);
    osViBlack(0);
    osViSwapBuffer(cfb);

#ifdef RMA_MON
    printstr(white, 9, 5, "RMA MON START");
    sprintf(s_version, "(version %d.%d)", RMA_VER_MAJ, RMA_VER_MIN);
    printstr(white, 9, 6, s_version);
    osWritebackDCacheAll();
    power_debouce();
    osCreateMesgQueue(&siMessageQ, &siMsg, 1);
    check_backdoor();    
    return ret;
#else
    printstr(white, 9, 4, "Preparing system data");
    printstr(white, 9, 5, "please wait ...");
    osWritebackDCacheAll();
    power_debouce();
#endif

#ifndef BG_HIGH_PRI
    IO_WRITE(MI_INTR_EMASK_REG, MI_INTR_MASK_CLR_BUT);
    osCreateMesgQueue(&siMessageQ, &siMsg, 1);
    check_backdoor();    
#else
    osCreateThread(&bgThread, 8, (void(*)(void *))bgproc, (void *)0,
                   bgThreadStack+STACKSIZE, BG_PRIORITY);
    osStartThread(&bgThread); 
#endif

    osBbCardInit();
    osBbFInit(&fs);

    if ((fd = osBbFOpen("errlog.gng", "r")) >= 0) {
        bzero(block, sizeof(block));
        if ((rv = osBbFRead(fd, 0, block, sizeof(block))) > 0
            && rv == sizeof block) {
            p = (int *) block;
            if (*p  == SYSTEM_TEST_DONE) { /* All test passed */
                 launch = 0;
            }
        }
        osBbFClose(fd);
    }

#ifndef BG_HIGH_PRI
    check_backdoor();    
#endif

    ret = 0;
    if (launch) { 
        ret = launch_sksa(BB_DIAG_APP);
    }

    //osStopThread(&bgThread);
    clear(0x0);
    osViSwapBuffer(cfb);
    printstr(white, 9, 5, "EMS MON START");
    sprintf(s_version, "(version %d.%d)", EMS_VER_MAJ, EMS_VER_MIN);
    printstr(white, 9, 6, s_version);
    if (ret) {
       char msg[32];
       sprintf(msg, "Err %d, Cannot launch tests", ret);
       printstr(red, 5, 10, msg);
       printstr(white, 5, 12, "Please ignore at download station");
    }
    
    osWritebackDCacheAll();
    return ret ;
}

#define SK_PART  (64 * 1024)
#define TIK_PART (16 * 1024)
#define CT_START (SK_PART + TIK_PART)
#define  AES_BLK  128

static BbShaHash hash_data;
static SHA1Context sha;
static BbAesKey bb_root_key = {0xb8190276, 0x7e25db27, 0x0f3449c5, 0xd94b162f};
static BbAesKey content_key;
static AesKeyInstance keyI;
static AesCipherInstance cipher;
static char block_enc[BB_FL_BLOCK_SIZE] ALIGN_DCACHE;
#define PI_AES_KEYLEN     (sizeof(BbAesKey)*8)

void decrpt_one_block(u8 *in, u8 *out) 
{
    int i;

#ifndef BG_HIGH_PRI
    check_backdoor();    
#endif

    for (i=0; i<BB_FL_BLOCK_SIZE; i+=AES_BLK)
        aesBlockDecrypt(&cipher, &keyI, in+i, AES_BLK*8, out+i);

    return;
}

int launch_sksa(char *fname)
{
    s32 fd, rv;
    BbContentMetaDataHead *cmd = (BbContentMetaDataHead *) tik_data; 
    BbAppLaunchCrls *rlBundle;
    BbCertBase *certs[3];
    u32  code_rom_start, code_rom_end, code_start, code_end,
         bss_start, bss_end, data_start, data_end, addr, off;
    int (*f) ();

#ifndef BG_HIGH_PRI
    check_backdoor();    
#endif

    if ((fd = osBbFOpen(fname,"r")) < 0) 
       return -1;

    if( osBbFStat(fd, &fsStat, NULL, 0) < 0) {
        osBbFClose(fd);
        return -2;
    }

    if (fsStat.size < (SK_PART +TIK_PART)) {
        osBbFClose(fd);
        return -3;
    }

    if (osBbFRead(fd, SK_PART, (u8 *) cmd, TIK_PART)<0 ) {
        osBbFClose(fd);
        return -4;
    }

    certs[0] = (BbCertBase *)(tik_data + sizeof(BbContentMetaDataHead));
    certs[1] = (BbCertBase *)((u8 *)certs[0] + sizeof(BbRsaCert));
    certs[2] = NULL;
    
    /* verify rl and insure sysapp bundle is OK */
    rlBundle = (BbAppLaunchCrls *)(((u8 *)certs[1]) + sizeof(BbRsaCert));
    BOOT_PATCH_RL(carl,tik_data);
    BOOT_PATCH_RL(cprl,tik_data);

    SHA1Reset(&sha);
    SHA1Input(&sha, (u8 *) cmd, BB_CMD_HEAD_SIGNED_BYTES);
    SHA1Result(&sha, (u8 *) hash_data);

#ifndef BG_HIGH_PRI
    check_backdoor();    
#endif

    if ( skVerifyHash(hash_data, (BbGenericSig *) &cmd->contentMetaDataSign, certs, rlBundle) != BB_SYSAPP_PASS) {
       osBbFClose(fd);
       return -5;
    }   /* verify ticket hash */

    aes_SwDecrypt((u8 *) bb_root_key, (u8 *)cmd->commonCmdIv, (u8 *)&(cmd->key), 
                  BB_CMD_ENCRYPTED_CHUNK_BYTES, content_key);

#ifndef BG_HIGH_PRI
    check_backdoor();    
#endif

    if(aesMakeKey(&keyI, AES_DIR_DECRYPT, PI_AES_KEYLEN, (u8 *)content_key) != TRUE) {
        osBbFClose(fd);
        return -6;
    }
    if (aesCipherInit(&cipher, AES_MODE_CBC, (u8 *)cmd->iv)  != TRUE) {
        osBbFClose(fd);
        return -7;
    }

    rv = osBbFRead(fd, CT_START, block_enc, BB_FL_BLOCK_SIZE);
    decrpt_one_block(block_enc, block);
    SHA1Reset(&sha);
    SHA1Input(&sha, (u8 *) block, BB_FL_BLOCK_SIZE);

    /* must validate hash BEFORE data below may be used */
    code_rom_start = *(unsigned int*)(block);
    code_rom_end = *(unsigned int*)(block+4);
    code_start = *(unsigned int*)(block+8);
    code_end = *(unsigned int*)(block+0xc);
    bss_start = *(unsigned int*)(block+0x10);
    bss_end = *(unsigned int*)(block+0x14);
    data_start = *(unsigned int*)(block+0x18);
    data_end = *(unsigned int*)(block+0x1c);

    off = BB_FL_BLOCK_SIZE + CT_START;
    while (rv >= 0 && off < fsStat.size) {
        rv = osBbFRead(fd, off, (void*)block_enc, BB_FL_BLOCK_SIZE);
        decrpt_one_block(block_enc, block);
        SHA1Input(&sha, block,  BB_FL_BLOCK_SIZE);
        if (rv <= 0) break;
        off += BB_FL_BLOCK_SIZE;
    }
    if (rv < 0) return -8;
    SHA1Result(&sha, (u8 *) hash_data);
    if (bcmp(hash_data, cmd->hash, sizeof(hash_data)) != 0) 
        return -9;  /* Content hash */

    /* now addresses from file are trusted, so repeat to load app */
    rv = osBbFRead(fd, CT_START, block_enc, BB_FL_BLOCK_SIZE);
    if (aesCipherInit(&cipher, AES_MODE_CBC, (u8 *)cmd->iv)  != TRUE) {
        osBbFClose(fd);
        return -7;
    }
    decrpt_one_block(block_enc, block);
    SHA1Reset(&sha);
    SHA1Input(&sha, (u8 *) block, BB_FL_BLOCK_SIZE);

    addr = code_start - code_rom_start - 8 * sizeof(int);
    bcopy(block, (void*)addr, BB_FL_BLOCK_SIZE);

    addr += BB_FL_BLOCK_SIZE;
    off = BB_FL_BLOCK_SIZE + CT_START;
    while (rv >= 0 && off < fsStat.size) {
        rv = osBbFRead(fd, off, (void*)block_enc, BB_FL_BLOCK_SIZE);
        decrpt_one_block(block_enc, (u8 *) addr);
        SHA1Input(&sha, (u8 *) addr,  BB_FL_BLOCK_SIZE);
        if (rv <= 0) break;
        addr += BB_FL_BLOCK_SIZE;
        off += BB_FL_BLOCK_SIZE;
    }
    osBbFClose(fd);
    if (rv < 0) return -8;

    SHA1Result(&sha, (u8 *) hash_data);
    if (bcmp(hash_data, cmd->hash, sizeof(hash_data)) != 0) 
        return -9;  /* Content hash */

#ifndef BG_HIGH_PRI
    check_backdoor();    
#else
      /* Stop backgroud thread here */
    osStopThread(&bgThread);
#endif
    osRomBase = PI_DOM1_ADDR2;
    osMemSize =  0x800000;
    osTvType =  OS_TV_NTSC;
    osWritebackDCacheAll();
    IO_WRITE(MI_INTR_MASK_REG,
             MI_INTR_MASK_CLR_SP |
             MI_INTR_MASK_CLR_SI |
             MI_INTR_MASK_CLR_AI |
             MI_INTR_MASK_CLR_VI |
             MI_INTR_MASK_CLR_PI |
             MI_INTR_MASK_CLR_DP);
    IO_WRITE(MI_INTR_EMASK_REG,
             MI_INTR_MASK_CLR_FLASH |
             MI_INTR_MASK_CLR_AES |
             MI_INTR_MASK_CLR_PI_ERR |
             MI_INTR_MASK_CLR_USB0 |
             MI_INTR_MASK_CLR_USB1 |
             MI_INTR_MASK_CLR_BUT |
             MI_INTR_MASK_CLR_MD);
    __osDisableInt();
    osInvalICache((void*) code_start, code_end - code_start);
    osInvalDCache((void*) data_start, data_end - data_start);
    bzero((void *)bss_start, bss_end - bss_start);

    f = (void *) code_start;
    (*f)();   /* Never reach here */
     
    return 0;
}