/*
 * Copyright 2023 Richard Hughes <richard@hughsie.com>
 *
 * SPDX-License-Identifier: LGPL-2.1-or-later
 */

#define G_LOG_DOMAIN "FuHidDevice"

#include "config.h"

#include "fu-byte-array.h"
#include "fu-hid-descriptor.h"
#include "fu-hid-report-item.h"
#include "fu-hid-struct.h"
#include "fu-input-stream.h"

/**
 * FuHidDescriptor:
 *
 * A HID descriptor.
 *
 * Each report is a image of this firmware object and each report has children of #FuHidReportItem.
 *
 * Documented: https://www.usb.org/sites/default/files/hid1_11.pdf
 *
 * See also: [class@FuFirmware]
 */

G_DEFINE_TYPE(FuHidDescriptor, fu_hid_descriptor, FU_TYPE_FIRMWARE)

#define FU_HID_DESCRIPTOR_TABLE_LOCAL_SIZE_MAX	 1024
#define FU_HID_DESCRIPTOR_TABLE_LOCAL_DUPES_MAX	 16
#define FU_HID_DESCRIPTOR_TABLE_GLOBAL_SIZE_MAX	 1024
#define FU_HID_DESCRIPTOR_TABLE_GLOBAL_DUPES_MAX 64

static guint
fu_hid_descriptor_count_table_dupes(GPtrArray *table, FuHidReportItem *item)
{
	guint cnt = 0;
	for (guint i = 0; i < table->len; i++) {
		FuHidReportItem *item_tmp = g_ptr_array_index(table, i);
		if (fu_hid_report_item_get_kind(item) == fu_hid_report_item_get_kind(item_tmp) &&
		    fu_hid_report_item_get_value(item) == fu_hid_report_item_get_value(item_tmp) &&
		    fu_firmware_get_idx(FU_FIRMWARE(item)) ==
			fu_firmware_get_idx(FU_FIRMWARE(item_tmp)))
			cnt++;
	}
	return cnt;
}

static gboolean
fu_hid_descriptor_parse(FuFirmware *firmware,
			GInputStream *stream,
			FuFirmwareParseFlags flags,
			GError **error)
{
	gsize offset = 0;
	gsize streamsz = 0;
	g_autoptr(GPtrArray) table_state =
	    g_ptr_array_new_with_free_func((GDestroyNotify)g_object_unref);
	g_autoptr(GPtrArray) table_local =
	    g_ptr_array_new_with_free_func((GDestroyNotify)g_object_unref);
	if (!fu_input_stream_size(stream, &streamsz, error))
		return FALSE;
	while (offset < streamsz) {
		g_autofree gchar *itemstr = NULL;
		g_autoptr(FuHidReportItem) item = fu_hid_report_item_new();

		/* sanity check */
		if (table_state->len > FU_HID_DESCRIPTOR_TABLE_GLOBAL_SIZE_MAX) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "HID table state too large, limit is %u",
				    (guint)FU_HID_DESCRIPTOR_TABLE_GLOBAL_SIZE_MAX);
			return FALSE;
		}
		if (table_local->len > FU_HID_DESCRIPTOR_TABLE_LOCAL_SIZE_MAX) {
			g_set_error(error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "HID table state too large, limit is %u",
				    (guint)FU_HID_DESCRIPTOR_TABLE_LOCAL_SIZE_MAX);
			return FALSE;
		}

		if (!fu_firmware_parse_stream(FU_FIRMWARE(item), stream, offset, flags, error))
			return FALSE;
		offset += fu_firmware_get_size(FU_FIRMWARE(item));

		/* only for debugging */
		itemstr = fu_firmware_to_string(FU_FIRMWARE(item));
		g_debug("add to table-state: %s", itemstr);

		/* if there is a sane number of duplicate tokens then add to table */
		if (fu_hid_report_item_get_kind(item) == FU_HID_ITEM_KIND_GLOBAL) {
			if (fu_hid_descriptor_count_table_dupes(table_state, item) >
			    FU_HID_DESCRIPTOR_TABLE_GLOBAL_DUPES_MAX) {
				g_set_error(
				    error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "table invalid @0x%x, too many duplicate global %s tokens",
				    (guint)offset,
				    fu_firmware_get_id(FU_FIRMWARE(item)));
				return FALSE;
			}
			g_ptr_array_add(table_state, g_object_ref(item));
		} else if (fu_hid_report_item_get_kind(item) == FU_HID_ITEM_KIND_LOCAL ||
			   fu_hid_report_item_get_kind(item) == FU_HID_ITEM_KIND_MAIN) {
			if (fu_hid_descriptor_count_table_dupes(table_local, item) >
			    FU_HID_DESCRIPTOR_TABLE_LOCAL_DUPES_MAX) {
				g_set_error(
				    error,
				    FWUPD_ERROR,
				    FWUPD_ERROR_INVALID_DATA,
				    "table invalid @0x%x, too many duplicate %s %s:0x%x tokens",
				    (guint)offset,
				    fu_hid_item_kind_to_string(fu_hid_report_item_get_kind(item)),
				    fu_firmware_get_id(FU_FIRMWARE(item)),
				    fu_hid_report_item_get_value(item));
				return FALSE;
			}
			g_ptr_array_add(table_local, g_object_ref(item));
		}

		/* add report */
		if (fu_hid_report_item_get_kind(item) == FU_HID_ITEM_KIND_MAIN) {
			g_autoptr(FuHidReport) report = fu_hid_report_new();

			/* copy the table state to the new report */
			for (guint i = 0; i < table_state->len; i++) {
				FuHidReportItem *item_tmp = g_ptr_array_index(table_state, i);
				if (!fu_firmware_add_image(FU_FIRMWARE(report),
							   FU_FIRMWARE(item_tmp),
							   error))
					return FALSE;
			}
			for (guint i = 0; i < table_local->len; i++) {
				FuHidReportItem *item_tmp = g_ptr_array_index(table_local, i);
				if (!fu_firmware_add_image(FU_FIRMWARE(report),
							   FU_FIRMWARE(item_tmp),
							   error))
					return FALSE;
			}
			if (!fu_firmware_add_image(firmware, FU_FIRMWARE(report), error))
				return FALSE;

			/* remove all the local items */
			g_ptr_array_set_size(table_local, 0);
		}
	}

	/* success */
	return TRUE;
}

static gboolean
fu_hid_descriptor_write_report_item(FuFirmware *report_item,
				    GByteArray *buf,
				    GHashTable *globals,
				    GError **error)
{
	g_autoptr(GBytes) fw = NULL;

	/* dedupe any globals */
	if (fu_hid_report_item_get_kind(FU_HID_REPORT_ITEM(report_item)) ==
	    FU_HID_ITEM_KIND_GLOBAL) {
		guint8 tag = fu_firmware_get_idx(report_item);
		FuFirmware *report_item_tmp = g_hash_table_lookup(globals, GUINT_TO_POINTER(tag));
		if (report_item_tmp != NULL &&
		    fu_hid_report_item_get_value(FU_HID_REPORT_ITEM(report_item)) ==
			fu_hid_report_item_get_value(FU_HID_REPORT_ITEM(report_item_tmp))) {
			g_debug("skipping duplicate global tag 0x%x", tag);
			return TRUE;
		}
		g_hash_table_insert(globals, GUINT_TO_POINTER(tag), report_item);
	}
	fw = fu_firmware_write(report_item, error);
	if (fw == NULL)
		return FALSE;
	fu_byte_array_append_bytes(buf, fw);

	/* success */
	return TRUE;
}

static gboolean
fu_hid_descriptor_write_report(FuFirmware *report,
			       GByteArray *buf,
			       GHashTable *globals,
			       GError **error)
{
	g_autoptr(GPtrArray) report_items = fu_firmware_get_images(report);

	/* for each item */
	for (guint i = 0; i < report_items->len; i++) {
		FuFirmware *report_item = g_ptr_array_index(report_items, i);
		if (!fu_hid_descriptor_write_report_item(report_item, buf, globals, error))
			return FALSE;
	}

	/* success */
	return TRUE;
}

static GByteArray *
fu_hid_descriptor_write(FuFirmware *firmware, GError **error)
{
	g_autoptr(GByteArray) buf = g_byte_array_new();
	g_autoptr(GHashTable) globals = g_hash_table_new(g_direct_hash, g_direct_equal);
	g_autoptr(GPtrArray) reports = fu_firmware_get_images(firmware);

	/* for each report */
	for (guint i = 0; i < reports->len; i++) {
		FuFirmware *report = g_ptr_array_index(reports, i);
		if (!fu_hid_descriptor_write_report(report, buf, globals, error))
			return NULL;
	}

	/* success */
	return g_steal_pointer(&buf);
}

typedef struct {
	const gchar *id;
	guint32 value;
} FuHidDescriptorCondition;

/**
 * fu_hid_descriptor_find_report:
 * @self: a #FuHidDescriptor
 * @error: (nullable): optional return location for an error
 * @...: pairs of string-integer values, ending with %NULL
 *
 * Finds the first HID report that matches all the report attributes.
 *
 * Returns: (transfer full): A #FuHidReport, or %NULL if not found.
 *
 * Since: 1.9.4
 **/
FuHidReport *
fu_hid_descriptor_find_report(FuHidDescriptor *self, GError **error, ...)
{
	va_list args;
	g_autoptr(GPtrArray) conditions = g_ptr_array_new_with_free_func(g_free);
	g_autoptr(GPtrArray) reports = fu_firmware_get_images(FU_FIRMWARE(self));

	g_return_val_if_fail(FU_IS_HID_DESCRIPTOR(self), NULL);
	g_return_val_if_fail(error == NULL || *error == NULL, NULL);

	/* parse varargs */
	va_start(args, error);
	for (guint i = 0; i < 1000; i++) {
		g_autofree FuHidDescriptorCondition *cond = g_new0(FuHidDescriptorCondition, 1);
		cond->id = va_arg(args, const gchar *);
		if (cond->id == NULL)
			break;
		cond->value = va_arg(args, guint32);
		g_ptr_array_add(conditions, g_steal_pointer(&cond));
	}
	va_end(args);

	/* return the first report that matches *all* conditions */
	for (guint i = 0; i < reports->len; i++) {
		FuHidReport *report = g_ptr_array_index(reports, i);
		gboolean matched = TRUE;
		for (guint j = 0; j < conditions->len; j++) {
			FuHidDescriptorCondition *cond = g_ptr_array_index(conditions, j);
			g_autoptr(FuFirmware) item =
			    fu_firmware_get_image_by_id(FU_FIRMWARE(report), cond->id, NULL);
			if (item == NULL) {
				matched = FALSE;
				break;
			}
			if (fu_hid_report_item_get_value(FU_HID_REPORT_ITEM(item)) != cond->value) {
				matched = FALSE;
				break;
			}
		}
		if (matched)
			return g_object_ref(report);
	}
	g_set_error_literal(error, FWUPD_ERROR, FWUPD_ERROR_NOT_FOUND, "no report found");
	return NULL;
}

static void
fu_hid_descriptor_init(FuHidDescriptor *self)
{
	fu_firmware_add_flag(FU_FIRMWARE(self), FU_FIRMWARE_FLAG_NO_AUTO_DETECTION);
	fu_firmware_set_size_max(FU_FIRMWARE(self), 64 * 1024);
#ifdef HAVE_FUZZER
	fu_firmware_set_images_max(FU_FIRMWARE(self), 10);
#else
	fu_firmware_set_images_max(FU_FIRMWARE(self), 1024);
#endif
	fu_firmware_add_image_gtype(FU_FIRMWARE(self), FU_TYPE_HID_REPORT);
}

static void
fu_hid_descriptor_class_init(FuHidDescriptorClass *klass)
{
	FuFirmwareClass *firmware_class = FU_FIRMWARE_CLASS(klass);
	firmware_class->parse = fu_hid_descriptor_parse;
	firmware_class->write = fu_hid_descriptor_write;
}

/**
 * fu_hid_descriptor_new:
 *
 * Creates a new #FuFirmware to parse a HID descriptor
 *
 * Since: 1.9.4
 **/
FuFirmware *
fu_hid_descriptor_new(void)
{
	return FU_FIRMWARE(g_object_new(FU_TYPE_HID_DESCRIPTOR, NULL));
}
