/*

 * Copyright 2019 Richard Hughes <richard@hughsie.com>

 *

 * SPDX-License-Identifier: LGPL-2.1-or-later

 */

#define G_LOG_DOMAIN "FuFirmware"

#include "config.h"

#include <string.h>

#include "fu-byte-array.h"

#include "fu-firmware-common.h"

#include "fu-ihex-firmware.h"

#include "fu-mem.h"

#include "fu-string.h"

/**

 * FuIhexFirmware:

 *

 * A Intel hex (ihex) firmware image.

 *

 * See also: [class@FuFirmware]

 */

typedef struct {

  GPtrArray *records;

  guint8 padding_value;

} FuIhexFirmwarePrivate;

G_DEFINE_TYPE_WITH_PRIVATE(FuIhexFirmware, fu_ihex_firmware, FU_TYPE_FIRMWARE)

#define GET_PRIVATE(o) (fu_ihex_firmware_get_instance_private(o))

#define FU_IHEX_FIRMWARE_TOKENS_MAX 100000 /* lines */

/**

 * fu_ihex_firmware_get_records:

 * @self: A #FuIhexFirmware

 *

 * Returns the raw lines from tokenization.

 *

 * This might be useful if the plugin is expecting the hex file to be a list

 * of operations, rather than a simple linear image with filled holes.

 *

 * Returns: (transfer none) (element-type FuIhexFirmwareRecord): records

 *

 * Since: 1.3.4

 **/

GPtrArray *

fu_ihex_firmware_get_records(FuIhexFirmware *self)

{

  FuIhexFirmwarePrivate *priv = GET_PRIVATE(self);

  g_return_val_if_fail(FU_IS_IHEX_FIRMWARE(self), NULL);

  return priv->records;

}

/**

 * fu_ihex_firmware_set_padding_value:

 * @self: A #FuIhexFirmware

 * @padding_value: the byte used to pad the image

 *

 * Set the padding value to fill incomplete address ranges.

 *

 * The default value of zero can be changed to `0xff` if functions like

 * fu_bytes_is_empty() are going to be used on subsections of the data.

 *

 * Since: 1.6.0

 **/

void

fu_ihex_firmware_set_padding_value(FuIhexFirmware *self, guint8 padding_value)

{

  FuIhexFirmwarePrivate *priv = GET_PRIVATE(self);

  g_return_if_fail(FU_IS_IHEX_FIRMWARE(self));

  priv->padding_value = padding_value;

}

static void

fu_ihex_firmware_record_free(FuIhexFirmwareRecord *rcd)

{

  g_string_free(rcd->buf, TRUE);

  g_byte_array_unref(rcd->data);

  g_free(rcd);

}

G_DEFINE_AUTOPTR_CLEANUP_FUNC(FuIhexFirmwareRecord, fu_ihex_firmware_record_free)

static FuIhexFirmwareRecord *

fu_ihex_firmware_record_new(guint ln, const gchar *line, FuFirmwareParseFlags flags, GError **error)

{

  g_autoptr(FuIhexFirmwareRecord) rcd = NULL;

  gsize linesz = strlen(line);

  guint line_end;

  guint16 addr16 = 0;

  /* check starting token */

  if (line[0] != ':') {

    g_autofree gchar *strsafe = fu_strsafe(line, 5);

    if (strsafe != NULL) {

      g_set_error(error,

            FWUPD_ERROR,

            FWUPD_ERROR_INVALID_FILE,

            "invalid starting token: %s",

            strsafe);

      return NULL;

    }

    g_set_error_literal(error,

            FWUPD_ERROR,

            FWUPD_ERROR_INVALID_FILE,

            "invalid starting token");

    return NULL;

  }

  /* length, 16-bit address, type */

  rcd = g_new0(FuIhexFirmwareRecord, 1);

  rcd->ln = ln;

  rcd->data = g_byte_array_new();

  rcd->buf = g_string_new(line);

  if (!fu_firmware_strparse_uint8_safe(line, linesz, 1, &rcd->byte_cnt, error))

    return NULL;

  if (!fu_firmware_strparse_uint16_safe(line, linesz, 3, &addr16, error))

    return NULL;

  rcd->addr = addr16;

  if (!fu_firmware_strparse_uint8_safe(line, linesz, 7, &rcd->record_type, error))

    return NULL;

  /* position of checksum */

  line_end = 9 + rcd->byte_cnt * 2;

  if (line_end > (guint)rcd->buf->len) {

    g_set_error(error,

          FWUPD_ERROR,

          FWUPD_ERROR_INVALID_FILE,

          "line malformed, length: %u",

          line_end);

    return NULL;

  }

  /* verify checksum */

  if ((flags & FU_FIRMWARE_PARSE_FLAG_IGNORE_CHECKSUM) == 0) {

    guint8 checksum = 0;

    for (guint i = 1; i < line_end + 2; i += 2) {

      guint8 data_tmp = 0;

      if (!fu_firmware_strparse_uint8_safe(line, linesz, i, &data_tmp, error))

        return NULL;

      checksum += data_tmp;

    }

    if (checksum != 0) {

      g_set_error(error,

            FWUPD_ERROR,

            FWUPD_ERROR_INVALID_FILE,

            "invalid checksum (0x%02x)",

            checksum);

      return NULL;

    }

  }

  /* add data */

  for (guint i = 9; i < line_end; i += 2) {

    guint8 tmp_c = 0;

    if (!fu_firmware_strparse_uint8_safe(line, linesz, i, &tmp_c, error))

      return NULL;

    fu_byte_array_append_uint8(rcd->data, tmp_c);

  }

  return g_steal_pointer(&rcd);

}

typedef struct {

  FuIhexFirmware *self;

  FuFirmwareParseFlags flags;

} FuIhexFirmwareTokenHelper;

static gboolean

fu_ihex_firmware_tokenize_cb(GString *token, guint token_idx, gpointer user_data, GError **error)

{

  FuIhexFirmwareTokenHelper *helper = (FuIhexFirmwareTokenHelper *)user_data;

  FuIhexFirmwarePrivate *priv = GET_PRIVATE(helper->self);

  g_autoptr(FuIhexFirmwareRecord) rcd = NULL;

  /* sanity check */

  if (token_idx > FU_IHEX_FIRMWARE_TOKENS_MAX) {

    g_set_error_literal(error,

            FWUPD_ERROR,

            FWUPD_ERROR_INVALID_DATA,

            "file has too many lines");

    return FALSE;

  }

  /* remove WIN32 line endings */

  g_strdelimit(token->str, "\r\x1a", '\0');

  token->len = strlen(token->str);

  /* ignore blank lines */

  if (token->len == 0)

    return TRUE;

  /* ignore comments */

  if (g_str_has_prefix(token->str, ";"))

    return TRUE;

  /* parse record */

  rcd = fu_ihex_firmware_record_new(token_idx + 1, token->str, helper->flags, error);

  if (rcd == NULL) {

    g_prefix_error(error, "invalid line %u: ", token_idx + 1);

    return FALSE;

  }

  g_ptr_array_add(priv->records, g_steal_pointer(&rcd));

  return TRUE;

}

static gboolean

fu_ihex_firmware_tokenize(FuFirmware *firmware,

        GInputStream *stream,

        FuFirmwareParseFlags flags,

        GError **error)

{

  FuIhexFirmware *self = FU_IHEX_FIRMWARE(firmware);

  FuIhexFirmwareTokenHelper helper = {.self = self, .flags = flags};

  return fu_strsplit_stream(stream, 0x0, "\n", fu_ihex_firmware_tokenize_cb, &helper, error);

}

static gboolean

fu_ihex_firmware_parse(FuFirmware *firmware,

           GInputStream *stream,

           FuFirmwareParseFlags flags,

           GError **error)

{

  FuIhexFirmware *self = FU_IHEX_FIRMWARE(firmware);

  FuIhexFirmwarePrivate *priv = GET_PRIVATE(self);

  gboolean got_eof = FALSE;

  gboolean got_sig = FALSE;

  guint32 abs_addr = 0x0;

  guint32 addr_last = 0x0;

  guint32 img_addr = G_MAXUINT32;

  guint32 seg_addr = 0x0;

  g_autoptr(GBytes) img_bytes = NULL;

  g_autoptr(GByteArray) buf = g_byte_array_new();

  /* parse records */

  for (guint k = 0; k < priv->records->len; k++) {

    FuIhexFirmwareRecord *rcd = g_ptr_array_index(priv->records, k);

    guint16 addr16 = 0;

    guint32 addr = rcd->addr + seg_addr + abs_addr;

    guint32 len_hole;

    /* debug */

    g_debug("%s:", fu_ihex_firmware_record_type_to_string(rcd->record_type));

    g_debug("length:\t0x%02x", rcd->data->len);

    g_debug("addr:\t0x%08x", addr);

    /* sanity check */

    if (rcd->record_type != FU_IHEX_FIRMWARE_RECORD_TYPE_EOF && rcd->data->len == 0) {

      g_set_error(error,

            FWUPD_ERROR,

            FWUPD_ERROR_NOT_SUPPORTED,

            "record 0x%x had zero size",

            k);

      return FALSE;

    }

    /* process different record types */

    switch (rcd->record_type) {

    case FU_IHEX_FIRMWARE_RECORD_TYPE_DATA:

      /* does not make sense */

      if (got_eof) {

        g_set_error_literal(error,

                FWUPD_ERROR,

                FWUPD_ERROR_INVALID_FILE,

                "cannot process data after EOF");

        return FALSE;

      }

      if (rcd->data->len == 0) {

        g_set_error_literal(error,

                FWUPD_ERROR,

                FWUPD_ERROR_INVALID_FILE,

                "cannot parse invalid data");

        return FALSE;

      }

      /* base address for element */

      if (img_addr == G_MAXUINT32)

        img_addr = addr;

      /* does not make sense */

      if (addr < addr_last) {

        g_set_error(error,

              FWUPD_ERROR,

              FWUPD_ERROR_INVALID_FILE,

              "invalid address 0x%x, last was 0x%x on line %u",

              (guint)addr,

              (guint)addr_last,

              rcd->ln);

        return FALSE;

      }

      /* any holes in the hex record */

      len_hole = addr - addr_last;

      if (addr_last > 0 && len_hole > 0x100000) {

        g_set_error(error,

              FWUPD_ERROR,

              FWUPD_ERROR_INVALID_FILE,

              "hole of 0x%x bytes too large to fill on line %u",

              (guint)len_hole,

              rcd->ln);

        return FALSE;

      }

      if (addr_last > 0x0 && len_hole > 1) {

        g_debug("filling address 0x%08x to 0x%08x on line %u",

          addr_last + 1,

          addr_last + len_hole - 1,

          rcd->ln);

        for (guint j = 1; j < len_hole; j++)

          fu_byte_array_append_uint8(buf, priv->padding_value);

      }

      addr_last = addr + rcd->data->len - 1;

      if (addr_last < addr) {

        g_set_error(error,

              FWUPD_ERROR,

              FWUPD_ERROR_INVALID_FILE,

              "overflow of address 0x%x on line %u",

              (guint)addr,

              rcd->ln);

        return FALSE;

      }

      /* write into buf */

      g_byte_array_append(buf, rcd->data->data, rcd->data->len);

      break;

    case FU_IHEX_FIRMWARE_RECORD_TYPE_EOF:

      if (got_eof) {

        g_set_error_literal(error,

                FWUPD_ERROR,

                FWUPD_ERROR_INVALID_FILE,

                "duplicate EOF, perhaps "

                "corrupt file");

        return FALSE;

      }

      got_eof = TRUE;

      break;

    case FU_IHEX_FIRMWARE_RECORD_TYPE_EXTENDED_LINEAR:

      if (!fu_memread_uint16_safe(rcd->data->data,

                rcd->data->len,

                0x0,

                &addr16,

                G_BIG_ENDIAN,

                error))

        return FALSE;

      abs_addr = (guint32)addr16 << 16;

      g_debug("abs_addr:\t0x%02x on line %u", abs_addr, rcd->ln);

      break;

    case FU_IHEX_FIRMWARE_RECORD_TYPE_START_LINEAR:

      if (!fu_memread_uint32_safe(rcd->data->data,

                rcd->data->len,

                0x0,

                &abs_addr,

                G_BIG_ENDIAN,

                error))

        return FALSE;

      g_debug("abs_addr:\t0x%08x on line %u", abs_addr, rcd->ln);

      break;

    case FU_IHEX_FIRMWARE_RECORD_TYPE_EXTENDED_SEGMENT:

      if (!fu_memread_uint16_safe(rcd->data->data,

                rcd->data->len,

                0x0,

                &addr16,

                G_BIG_ENDIAN,

                error))

        return FALSE;

      /* segment base address, so ~1Mb addressable */

      seg_addr = (guint32)addr16 * 16;

      g_debug("seg_addr:\t0x%08x on line %u", seg_addr, rcd->ln);

      break;

    case FU_IHEX_FIRMWARE_RECORD_TYPE_START_SEGMENT:

      /* initial content of the CS:IP registers */

      if (!fu_memread_uint32_safe(rcd->data->data,

                rcd->data->len,

                0x0,

                &seg_addr,

                G_BIG_ENDIAN,

                error))

        return FALSE;

      g_debug("seg_addr:\t0x%02x on line %u", seg_addr, rcd->ln);

      break;

    case FU_IHEX_FIRMWARE_RECORD_TYPE_SIGNATURE:

      if (got_sig) {

        g_set_error_literal(error,

                FWUPD_ERROR,

                FWUPD_ERROR_INVALID_FILE,

                "duplicate signature, perhaps "

                "corrupt file");

        return FALSE;

      }

      if (rcd->data->len > 0) {

        g_autoptr(GBytes) data_sig =

            g_bytes_new(rcd->data->data, rcd->data->len);

        g_autoptr(FuFirmware) img_sig =

            fu_firmware_new_from_bytes(data_sig);

        fu_firmware_set_id(img_sig, FU_FIRMWARE_ID_SIGNATURE);

        if (!fu_firmware_add_image(firmware, img_sig, error))

          return FALSE;

      }

      got_sig = TRUE;

      break;

    default:

      /* vendors sneak in nonstandard sections past the EOF */

      if (got_eof)

        break;

      g_set_error(error,

            FWUPD_ERROR,

            FWUPD_ERROR_INVALID_FILE,

            "invalid ihex record type %i on line %u",

            rcd->record_type,

            rcd->ln);

      return FALSE;

    }

  }

  /* no EOF */

  if (!got_eof) {

    g_set_error_literal(error,

            FWUPD_ERROR,

            FWUPD_ERROR_INVALID_FILE,

            "no EOF, perhaps truncated file");

    return FALSE;

  }

  /* add single image */

  img_bytes = g_bytes_new(buf->data, buf->len);

  if (img_addr != G_MAXUINT32)

    fu_firmware_set_addr(firmware, img_addr);

  fu_firmware_set_bytes(firmware, img_bytes);

  return TRUE;

}

static void

fu_ihex_firmware_emit_chunk(GString *str,

          guint16 address,

          guint8 record_type,

          const guint8 *data,

          gsize sz)

{

  guint8 checksum = 0x00;

  g_string_append_printf(str, ":%02X%04X%02X", (guint)sz, (guint)address, (guint)record_type);

  for (gsize j = 0; j < sz; j++)

    g_string_append_printf(str, "%02X", data[j]);

  checksum = (guint8)sz;

  checksum += (guint8)((address & 0xff00) >> 8);

  checksum += (guint8)(address & 0xff);

  checksum += record_type;

  for (gsize j = 0; j < sz; j++)

    checksum += data[j];

  g_string_append_printf(str, "%02X\n", (guint)(((~checksum) + 0x01) & 0xff));

}

static gboolean

fu_ihex_firmware_image_to_string(GBytes *bytes,

         guint32 addr,

         guint8 record_type,

         GString *str,

         GError **error)

{

  const guint8 *data;

  const guint chunk_size = 16;

  gsize len;

  guint32 address_offset_last = 0x0;

  /* get number of chunks */

  data = g_bytes_get_data(bytes, &len);

  for (gsize i = 0; i < len; i += chunk_size) {

    guint32 address_tmp = addr + i;

    guint32 address_offset = (address_tmp >> 16) & 0xffff;

    gsize chunk_len = MIN(len - i, 16);

    /* need to offset */

    if (address_offset != address_offset_last) {

      guint8 buf[2]; /* nocheck:zero-init */

      fu_memwrite_uint16(buf, address_offset, G_BIG_ENDIAN);

      fu_ihex_firmware_emit_chunk(str,

                0x0,

                FU_IHEX_FIRMWARE_RECORD_TYPE_EXTENDED_LINEAR,

                buf,

                2);

      address_offset_last = address_offset;

    }

    address_tmp &= 0xffff;

    fu_ihex_firmware_emit_chunk(str, address_tmp, record_type, data + i, chunk_len);

  }

  return TRUE;

}

static GByteArray *

fu_ihex_firmware_write(FuFirmware *firmware, GError **error)

{

  g_autoptr(GByteArray) buf = g_byte_array_new();

  g_autoptr(GBytes) fw = NULL;

  g_autoptr(FuFirmware) img_sig = NULL;

  g_autoptr(GString) str = g_string_new("");

  /* payload */

  fw = fu_firmware_get_bytes_with_patches(firmware, error);

  if (fw == NULL)

    return NULL;

  if (!fu_ihex_firmware_image_to_string(fw,

                fu_firmware_get_addr(firmware),

                FU_IHEX_FIRMWARE_RECORD_TYPE_DATA,

                str,

                error))

    return NULL;

  /* signature */

  img_sig = fu_firmware_get_image_by_id(firmware, FU_FIRMWARE_ID_SIGNATURE, NULL);

  if (img_sig != NULL) {

    g_autoptr(GBytes) img_fw = fu_firmware_get_bytes(img_sig, error);

    if (img_fw == NULL)

      return NULL;

    if (!fu_ihex_firmware_image_to_string(img_fw,

                  0,

                  FU_IHEX_FIRMWARE_RECORD_TYPE_SIGNATURE,

                  str,

                  error))

      return NULL;

  }

  /* add EOF */

  fu_ihex_firmware_emit_chunk(str, 0x0, FU_IHEX_FIRMWARE_RECORD_TYPE_EOF, NULL, 0);

  g_byte_array_append(buf, (const guint8 *)str->str, str->len);

  return g_steal_pointer(&buf);

}

static void

fu_ihex_firmware_finalize(GObject *object)

{

  FuIhexFirmware *self = FU_IHEX_FIRMWARE(object);

  FuIhexFirmwarePrivate *priv = GET_PRIVATE(self);

  g_ptr_array_unref(priv->records);

  G_OBJECT_CLASS(fu_ihex_firmware_parent_class)->finalize(object);

}

static void

fu_ihex_firmware_init(FuIhexFirmware *self)

{

  FuIhexFirmwarePrivate *priv = GET_PRIVATE(self);

  priv->padding_value = 0x00; /* chosen as we can't write 0xffff to PIC14 */

  priv->records = g_ptr_array_new_with_free_func((GFreeFunc)fu_ihex_firmware_record_free);

  fu_firmware_add_flag(FU_FIRMWARE(self), FU_FIRMWARE_FLAG_HAS_CHECKSUM);

  fu_firmware_add_image_gtype(FU_FIRMWARE(self), FU_TYPE_FIRMWARE);

  fu_firmware_set_images_max(FU_FIRMWARE(self), 10);

}

static void

fu_ihex_firmware_class_init(FuIhexFirmwareClass *klass)

{

  GObjectClass *object_class = G_OBJECT_CLASS(klass);

  FuFirmwareClass *firmware_class = FU_FIRMWARE_CLASS(klass);

  object_class->finalize = fu_ihex_firmware_finalize;

  firmware_class->parse = fu_ihex_firmware_parse;

  firmware_class->tokenize = fu_ihex_firmware_tokenize;

  firmware_class->write = fu_ihex_firmware_write;

}

/**

 * fu_ihex_firmware_new:

 *

 * Creates a new #FuFirmware of sub type Ihex

 *

 * Since: 1.3.1

 **/

FuFirmware *

fu_ihex_firmware_new(void)

{

  return FU_FIRMWARE(g_object_new(FU_TYPE_IHEX_FIRMWARE, NULL));

}