From 66b043a3f4996d3605949fa4a457d5fdbb3de683 Mon Sep 17 00:00:00 2001
From: "(no author)" <(no author)@b08762b0-b915-fc4b-9d8c-17b2551a87ff>
Date: Thu, 29 Nov 2007 07:16:11 +0000
Subject: [PATCH] =?UTF-8?q?(=E6=9B=B4=E6=96=B0=E8=80=85)akabane=5Fjumpei?=
 =?UTF-8?q?=20=E6=B4=BB=E7=B7=9A=E6=8C=BF=E6=8A=9C=E3=83=A9=E3=82=A4?=
 =?UTF-8?q?=E3=83=96=E3=83=A9=E3=83=AA=E4=BF=AE=E6=AD=A3=20=E3=82=B3?=
 =?UTF-8?q?=E3=83=9E=E3=83=B3=E3=83=89=E8=AA=8D=E8=A8=BC=E5=80=A4=E3=80=81?=
 =?UTF-8?q?=E3=82=B3=E3=83=9E=E3=83=B3=E3=83=89=E3=82=AB=E3=82=A6=E3=83=B3?=
 =?UTF-8?q?=E3=82=BF=E5=88=9D=E6=9C=9F=E5=80=A4=E3=80=81PN=E3=82=B8?=
 =?UTF-8?q?=E3=82=A7=E3=83=8D=E3=83=AC=E3=83=BC=E3=82=BF=E5=88=9D=E6=9C=9F?=
 =?UTF-8?q?=E5=80=A4=E3=81=AB=E4=B9=B1=E6=95=B0=E3=82=92=E4=BD=BF=E7=94=A8?=
 =?UTF-8?q?=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: file:///Users/lillianskinner/Downloads/platinum/twl/TwlIPL/trunk@288 b08762b0-b915-fc4b-9d8c-17b2551a87ff
---
 .../libraries_sysmenu/hotsw/ARM7/src/hotsw.c  | 40 +++++++++++++++----
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/build/libraries_sysmenu/hotsw/ARM7/src/hotsw.c b/build/libraries_sysmenu/hotsw/ARM7/src/hotsw.c
index 4c535f19..ebadba14 100644
--- a/build/libraries_sysmenu/hotsw/ARM7/src/hotsw.c
+++ b/build/libraries_sysmenu/hotsw/ARM7/src/hotsw.c
@@ -46,6 +46,7 @@ static void LoadStaticModule_Secure(void);
 static void McPowerOn(void);
 static void SetMCSCR(void);
 
+static void GenVA_VB_VD(void);
 static void LoadTable(void);
 static void ReadIDNormal(void);
 static void MIm_CardDmaCopy32(u32 dmaNo, const void *src, void *dest);
@@ -141,7 +142,7 @@ void HOTSW_Init(void)
     
 	// カードブート用構造体の初期化
 	MI_CpuClear32(&s_cbData, sizeof(CardBootData));
-
+    
 	OS_TPrintf("*** sizeof(ROM_Header) : 0x%08x\n", sizeof(ROM_Header));
 }
 
@@ -162,11 +163,6 @@ BOOL HOTSW_Boot(void)
 	OS_TPrintf("---------------- Card Boot Start ---------------\n");
 	// カード電源ON
 	McPowerOn();
-    
-	// VAE・VBI・VD値の設定
-    s_cbData.vae = VAE_VALUE;
-    s_cbData.vbi = VBI_VALUE;
-	s_cbData.vd  = VD_VALUE;
 
 	// セキュア領域の読み込みセグメント先頭番号(Segment4 〜 Segment7)
     s_cbData.secureSegNum = 4;
@@ -236,7 +232,10 @@ BOOL HOTSW_Boot(void)
 	        }
 	    	// Key Table初期化
 	    	GCDm_MakeBlowfishTableDS(&s_cbData.keyTable, &s_pBootSegBuffer->rh.s, s_cbData.keyBuf, 8);
-	
+
+			// コマンド認証値・コマンドカウンタ初期値・PNジェネレータ初期値の生成
+            GenVA_VB_VD();
+            
 	    	// セキュアモードに移行
 	    	s_funcTable[s_cbData.cardType].ChangeMode_N(&s_cbData);
 	
@@ -395,6 +394,33 @@ void HOTSW_SetSecureSegmentBuffer(void* buf, u32 size)
     OS_TPrintf("*** Scr Seg Buf Address : 0x%08x\n", s_pSecureSegBuffer);
 }
 
+
+/* -----------------------------------------------------------------
+ * GenVA_VB_VD関数
+ *
+ * コマンド認証値・コマンドカウンタ・PNジェネレータ初期値の生成
+ * ----------------------------------------------------------------- */
+static void GenVA_VB_VD(void)
+{
+    u32 dummy = 0;
+	MATHRandContext32	rnd;					
+    
+	// 乱数を初期化 VBlankカウンタ値を種とする。
+    MATH_InitRand32(&rnd, (u64)OS_GetVBlankCount());
+    
+    s_cbData.vae = MATH_Rand32(&rnd, 0);
+    s_cbData.vbi = MATH_Rand32(&rnd, 0);
+    s_cbData.vd  = MATH_Rand32(&rnd, 0);
+    dummy        = MATH_Rand32(&rnd, 0);
+
+    EncryptByBlowfish(&s_cbData.keyTable, &s_cbData.vae, &s_cbData.vbi);
+    EncryptByBlowfish(&s_cbData.keyTable, &s_cbData.vd , &dummy);
+
+	s_cbData.vae &= 0xffffff;
+	s_cbData.vbi &= 0xfffff;
+	s_cbData.vd  &= 0xffffff;
+}
+
 /* -----------------------------------------------------------------
  * LoadTable関数
  *