Merge tag 'LA.BF64.1.2.2-03240-8x94.0' into HEADstable/cm-13.0-caf-ZNH0E

"LA.BF64.1.2.2-03240-8x94.0"

Issue-Id: SAMBAR-1280
Change-Id: I3b7e32c045f21ca629a154cb1868331308385757

5 files changed, 180 insertions, 59 deletions

diff --git a/include/telephony/ril.h b/include/telephony/ril.h
index dae869b..f80ff07 100644
--- a/include/telephony/ril.h
+++ b/include/telephony/ril.h
@@ -728,6 +728,8 @@ typedef enum {
     PDP_FAIL_TETHERED_CALL_ACTIVE = -6,   /* data call was disconnected by modem because tethered
                                              mode was up on same APN/data profile - no retry until
                                              tethered call is off */
+    PDP_FAIL_IPV4_CALL_THROTTLED = -7,
+    PDP_FAIL_IPV6_CALL_THROTTLED = -8,
 
     PDP_FAIL_ERROR_UNSPECIFIED = 0xffff,  /* retry silently */
 } RIL_DataCallFailCause;
@@ -1500,6 +1502,12 @@ typedef struct {
   uint32_t rx_mode_time_ms;
 } RIL_ActivityStatsInfo;
 
+typedef struct {
+    uint8_t p2; /* P2 parameter */
+    char * aidPtr; /* AID value, See ETSI 102.221 and 101.220*/
+
+} RIL_CafOpenChannelParams;
+
 /**
  * RIL_REQUEST_GET_SIM_STATUS
  *
@@ -4546,8 +4554,30 @@ typedef struct {
  */
 #define RIL_REQUEST_SIM_GET_ATR 136
 
-/***********************************************************************/
+/**
+ * RIL_REQUEST_CAF_SIM_OPEN_CHANNEL_WITH_P2
+ *
+ * Open a new logical channel and select the given application. This command
+ * reflects TS 27.007 "open logical channel" operation (+CCHO). This request
+ * also specifies the P2 parameter.
+ *
+ * "data" is a const RIL_CafOpenChannelParam *
+ *
+ * "response" is int *
+ * ((int *)data)[0] contains the session id of the logical channel.
+ * ((int *)data)[1] onwards may optionally contain the select response for the
+ *     open channel command with one byte per integer.
+ *
+ * Valid errors:
+ *  SUCCESS
+ *  RADIO_NOT_AVAILABLE
+ *  GENERIC_FAILURE
+ *  MISSING_RESOURCE
+ *  NO_SUCH_ELEMENT
+ */
+#define RIL_REQUEST_CAF_SIM_OPEN_CHANNEL_WITH_P2 137
 
+/***********************************************************************/
 
 #define RIL_UNSOL_RESPONSE_BASE 1000
 
diff --git a/libril/RilSapSocket.cpp b/libril/RilSapSocket.cpp
index 36277cf..e422f34 100644
--- a/libril/RilSapSocket.cpp
+++ b/libril/RilSapSocket.cpp
@@ -26,7 +26,7 @@
 #include <arpa/inet.h>
 #include <errno.h>
 
-RilSapSocket::RilSapSocketList *head;
+static RilSapSocket::RilSapSocketList *head = NULL;
 
 void ril_sap_on_request_complete (
         RIL_Token t, RIL_Errno e,
@@ -62,6 +62,9 @@ void RilSapSocket::sOnRequestComplete (RIL_Token t,
         sap_socket->onRequestComplete(t,e,response,responselen);
     } else {
         RLOGE("Invalid socket id");
+        if (request->curr->payload) {
+            free(request->curr->payload);
+        }
         free(request->curr);
         free(request);
     }
@@ -150,11 +153,15 @@ void RilSapSocket::initSapSocket(const char *socketName,
 void RilSapSocket::addSocketToList(const char *socketName, RIL_SOCKET_ID socketid,
         RIL_RadioFunctions *uimFuncs) {
     RilSapSocket* socket = NULL;
-    RilSapSocketList* listItem = (RilSapSocketList*)malloc(sizeof(RilSapSocketList));
     RilSapSocketList *current;
 
     if(!SocketExists(socketName)) {
         socket = new RilSapSocket(socketName, socketid, uimFuncs);
+        RilSapSocketList* listItem = (RilSapSocketList*)malloc(sizeof(RilSapSocketList));
+        if (!listItem) {
+            RLOGE("addSocketToList: OOM");
+            return;
+        }
         listItem->socket = socket;
         listItem->next = NULL;
 
@@ -188,16 +195,15 @@ bool RilSapSocket::SocketExists(const char *socketName) {
 }
 
 void* RilSapSocket::processRequestsLoop(void) {
-    SapSocketRequest *req = (SapSocketRequest*)malloc(sizeof(SapSocketRequest));
     RLOGI("UIM_SOCKET:Request loop started");
 
     while(true) {
-        req = dispatchQueue.dequeue();
+        SapSocketRequest *req = dispatchQueue.dequeue();
 
         RLOGI("New request from the dispatch Queue");
 
         if (req != NULL) {
-            processRequest(req->curr);
+            dispatchRequest(req->curr);
             free(req);
         } else {
             RLOGE("Fetched null buffer from queue!");
@@ -215,11 +221,6 @@ RilSapSocket::RilSapSocket(const char *socketName,
     }
 }
 
-int RilSapSocket::processRequest(MsgHeader *request) {
-    dispatchRequest(request);
-    return 0;
-}
-
 #define BYTES_PER_LINE 16
 
 #define NIBBLE_TO_HEX(n) ({ \
@@ -264,7 +265,14 @@ void log_hex(const char *who, const uint8_t *buffer, int length) {
 }
 
 void RilSapSocket::dispatchRequest(MsgHeader *req) {
+    // SapSocketRequest will be deallocated in onRequestComplete()
     SapSocketRequest* currRequest=(SapSocketRequest*)malloc(sizeof(SapSocketRequest));
+    if (!currRequest) {
+        RLOGE("dispatchRequest: OOM");
+        // Free MsgHeader allocated in pushRecord()
+        free(req);
+        return;
+    }
     currRequest->token = req->token;
     currRequest->curr = req;
     currRequest->p_next = NULL;
@@ -291,27 +299,36 @@ void RilSapSocket::onRequestComplete(RIL_Token t, RIL_Errno e, void *response,
         size_t response_len) {
     SapSocketRequest* request= (SapSocketRequest*)t;
     MsgHeader *hdr = request->curr;
-    pb_bytes_array_t *payload = (pb_bytes_array_t *)
-        calloc(1,sizeof(pb_bytes_array_t) + response_len);
 
-    if (hdr && payload) {
-        memcpy(payload->bytes, response, response_len);
-        payload->size = response_len;
-        hdr->payload = payload;
-        hdr->type = MsgType_RESPONSE;
-        hdr->error = (Error) e;
-
-        RLOGE("Token:%d, MessageId:%d", hdr->token, hdr->id);
+    if (response && response_len > 0) {
+        MsgHeader rsp;
+        rsp.token = request->curr->token;
+        rsp.type = MsgType_RESPONSE;
+        rsp.id = request->curr->id;
+        rsp.error = (Error)e;
+        rsp.payload = (pb_bytes_array_t *)calloc(1,
+                sizeof(pb_bytes_array_t) + response_len);
+        if (!rsp.payload) {
+            RLOGE("onRequestComplete: OOM");
+        } else {
+            memcpy(rsp.payload->bytes, response, response_len);
+            rsp.payload->size = response_len;
 
-        if(!pendingResponseQueue.checkAndDequeue(hdr->id, hdr->token)) {
             RLOGE("Token:%d, MessageId:%d", hdr->token, hdr->id);
-            RLOGE ("RilSapSocket::onRequestComplete: invalid Token or Message Id");
-            return;
+
+            sendResponse(&rsp);
+            free(rsp.payload);
         }
+    }
 
-        sendResponse(hdr);
-        free(hdr);
+    // Deallocate SapSocketRequest
+    if(!pendingResponseQueue.checkAndDequeue(hdr->id, hdr->token)) {
+        RLOGE("Token:%d, MessageId:%d", hdr->token, hdr->id);
+        RLOGE ("RilSapSocket::onRequestComplete: invalid Token or Message Id");
     }
+
+    // Deallocate MsgHeader
+    free(hdr);
 }
 
 void RilSapSocket::sendResponse(MsgHeader* hdr) {
@@ -357,36 +374,48 @@ void RilSapSocket::sendResponse(MsgHeader* hdr) {
 }
 
 void RilSapSocket::onUnsolicitedResponse(int unsolResponse, void *data, size_t datalen) {
-    MsgHeader *hdr = new MsgHeader;
-    pb_bytes_array_t *payload = (pb_bytes_array_t *)
-        calloc(1, sizeof(pb_bytes_array_t) + datalen);
-    if (hdr && payload) {
+    if (data && datalen > 0) {
+        pb_bytes_array_t *payload = (pb_bytes_array_t *)calloc(1,
+                sizeof(pb_bytes_array_t) + datalen);
+        if (!payload) {
+            RLOGE("onUnsolicitedResponse: OOM");
+            return;
+        }
         memcpy(payload->bytes, data, datalen);
         payload->size = datalen;
-        hdr->payload = payload;
-        hdr->type = MsgType_UNSOL_RESPONSE;
-        hdr->id = (MsgId)unsolResponse;
-        hdr->error = Error_RIL_E_SUCCESS;
-        sendResponse(hdr);
-        delete hdr;
+        MsgHeader rsp;
+        rsp.payload = payload;
+        rsp.type = MsgType_UNSOL_RESPONSE;
+        rsp.id = (MsgId)unsolResponse;
+        rsp.error = Error_RIL_E_SUCCESS;
+        sendResponse(&rsp);
+        free(payload);
     }
 }
 
 void RilSapSocket::pushRecord(void *p_record, size_t recordlen) {
-    int ret;
-    SapSocketRequest *recv = (SapSocketRequest*)malloc(sizeof(SapSocketRequest));
-    MsgHeader  *reqHeader;
-    pb_istream_t stream;
-
-    stream = pb_istream_from_buffer((uint8_t *)p_record, recordlen);
-    reqHeader = (MsgHeader *)malloc(sizeof (MsgHeader));
+    pb_istream_t stream = pb_istream_from_buffer((uint8_t *)p_record, recordlen);
+    // MsgHeader will be deallocated in onRequestComplete()
+    MsgHeader *reqHeader = (MsgHeader *)malloc(sizeof (MsgHeader));
+    if (!reqHeader) {
+        RLOGE("pushRecord: OOM");
+        return;
+    }
     memset(reqHeader, 0, sizeof(MsgHeader));
 
     log_hex("BtSapTest-Payload", (const uint8_t*)p_record, recordlen);
 
     if (!pb_decode(&stream, MsgHeader_fields, reqHeader) ) {
         RLOGE("Error decoding protobuf buffer : %s", PB_GET_ERROR(&stream));
+        free(reqHeader);
     } else {
+        // SapSocketRequest will be deallocated in processRequestsLoop()
+        SapSocketRequest *recv = (SapSocketRequest*)malloc(sizeof(SapSocketRequest));
+        if (!recv) {
+            RLOGE("pushRecord: OOM");
+            free(reqHeader);
+            return;
+        }
         recv->token = reqHeader->token;
         recv->curr = reqHeader;
         recv->socketId = id;
@@ -396,14 +425,11 @@ void RilSapSocket::pushRecord(void *p_record, size_t recordlen) {
 }
 
 void RilSapSocket::sendDisconnect() {
-    MsgHeader *hdr = new MsgHeader;
-    pb_bytes_array_t *payload ;
     size_t encoded_size = 0;
     uint32_t written_size;
     size_t buffer_size = 0;
     pb_ostream_t ostream;
     bool success = false;
-    ssize_t written_bytes;
 
     RIL_SIM_SAP_DISCONNECT_REQ disconnectReq;
 
@@ -417,11 +443,22 @@ void RilSapSocket::sendDisconnect() {
         success = pb_encode(&ostream, RIL_SIM_SAP_DISCONNECT_REQ_fields, buffer);
 
         if(success) {
-            pb_bytes_array_t *payload = (pb_bytes_array_t *)
-        calloc(1,sizeof(pb_bytes_array_t) + written_size);
-
+            // Buffer will be deallocated in sOnRequestComplete()
+            pb_bytes_array_t *payload = (pb_bytes_array_t *)calloc(1,
+                    sizeof(pb_bytes_array_t) + written_size);
+            if (!payload) {
+                RLOGE("sendDisconnect: OOM");
+                return;
+            }
             memcpy(payload->bytes, buffer, written_size);
             payload->size = written_size;
+            // MsgHeader will be deallocated in sOnRequestComplete()
+            MsgHeader *hdr = (MsgHeader *)malloc(sizeof(MsgHeader));
+            if (!hdr) {
+                RLOGE("sendDisconnect: OOM");
+                free(payload);
+                return;
+            }
             hdr->payload = payload;
             hdr->type = MsgType_REQUEST;
             hdr->id = MsgId_RIL_SIM_SAP_DISCONNECT;
@@ -430,14 +467,20 @@ void RilSapSocket::sendDisconnect() {
         }
         else {
             RLOGE("Encode failed in send disconnect!");
-            delete hdr;
-            free(payload);
         }
     }
 }
 
 void RilSapSocket::dispatchDisconnect(MsgHeader *req) {
+    // SapSocketRequest will be deallocated in sOnRequestComplete()
     SapSocketRequest* currRequest=(SapSocketRequest*)malloc(sizeof(SapSocketRequest));
+    if (!currRequest) {
+        RLOGE("dispatchDisconnect: OOM");
+        // Free memory allocated in sendDisconnect
+        free(req->payload);
+        free(req);
+        return;
+    }
     currRequest->token = -1;
     currRequest->curr = req;
     currRequest->p_next = NULL;
diff --git a/libril/RilSapSocket.h b/libril/RilSapSocket.h
index 4261f93..75c3965 100644
--- a/libril/RilSapSocket.h
+++ b/libril/RilSapSocket.h
@@ -88,12 +88,6 @@ class RilSapSocket : public RilSocket {
         RIL_RadioFunctions *uimFuncs);
 
         /**
-         * Process requests from the dispatch request queue.
-         * @param Request to be dispatched.
-         */
-        int processRequest(MsgHeader *request);
-
-        /**
          * Ril envoronment variable that holds the request and
          * unsol response handlers.
          */
@@ -214,8 +208,8 @@ class RilSapSocket : public RilSocket {
         RIL_RadioFunctions *inputUimFuncs);
 
         /**
-         * Called by the processRequest method to dispatch the request to
-         * the lower layers. It calls the on request function.
+         * Dispatches the request to the lower layers.
+         * It calls the on request function.
          *
          * @param The request message.
          */
diff --git a/libril/ril.cpp b/libril/ril.cpp
index 42cd0ff..0c99526 100755
--- a/libril/ril.cpp
+++ b/libril/ril.cpp
@@ -271,6 +271,7 @@ static void dispatchUiccSubscripton(Parcel &p, RequestInfo *pRI);
 static void dispatchSimAuthentication(Parcel &p, RequestInfo *pRI);
 static void dispatchDataProfile(Parcel &p, RequestInfo *pRI);
 static void dispatchRadioCapability(Parcel &p, RequestInfo *pRI);
+static void dispatchOpenChannelWithP2(Parcel &p, RequestInfo *pRI);
 static int responseInts(Parcel &p, void *response, size_t responselen);
 static int responseFailCause(Parcel &p, void *response, size_t responselen);
 static int responseStrings(Parcel &p, void *response, size_t responselen);
@@ -2050,6 +2051,57 @@ invalid:
     return;
 }
 
+/**
+ * Callee expects const RIL_CafOpenChannelParams *
+ * Payload is:
+ * byte p2
+ * char * aidPtr
+ */
+static void dispatchOpenChannelWithP2 (Parcel &p, RequestInfo *pRI) {
+    RIL_CafOpenChannelParams openChannel;
+    status_t status;
+    uint8_t p2;
+
+#if VDBG
+    RLOGD("dispatchOpenChannelWithP2");
+#endif
+    memset (&openChannel, 0, sizeof(RIL_CafOpenChannelParams));
+
+    status = p.read(&p2, sizeof(p2));
+    openChannel.p2 = (uint8_t) p2;
+
+    openChannel.aidPtr = strdupReadString(p);
+    if (status != NO_ERROR || openChannel.aidPtr == NULL) {
+        goto invalid;
+    }
+
+    startRequest;
+    appendPrintBuf("%s[p2:%d, aid:%s]", printBuf, openChannel.p2, openChannel.aidPtr);
+
+    closeRequest;
+    printRequest(pRI->token, pRI->pCI->requestNumber);
+
+    CALL_ONREQUEST(pRI->pCI->requestNumber,
+                &openChannel,
+                sizeof(openChannel),
+                pRI, pRI->socket_id);
+
+#ifdef MEMSET_FREED
+    memsetString(openChannel.aidPtr);
+#endif
+
+    free(openChannel.aidPtr);
+
+#ifdef MEMSET_FREED
+    memset(&openChannel, 0, sizeof(openChannel));
+#endif
+
+    return;
+invalid:
+    invalidCommandBlock(pRI);
+    return;
+}
+
 static int
 blockingWrite(int fd, const void *buffer, size_t len) {
     size_t writeOffset = 0;
@@ -5163,6 +5215,7 @@ requestToString(int request) {
         case RIL_REQUEST_IMS_SEND_SMS: return "IMS_SEND_SMS";
         case RIL_REQUEST_SIM_TRANSMIT_APDU_BASIC: return "SIM_TRANSMIT_APDU_BASIC";
         case RIL_REQUEST_SIM_OPEN_CHANNEL: return "SIM_OPEN_CHANNEL";
+        case RIL_REQUEST_CAF_SIM_OPEN_CHANNEL_WITH_P2: return "CAF_SIM_OPEN_CHANNEL_WITH_P2";
         case RIL_REQUEST_SIM_CLOSE_CHANNEL: return "SIM_CLOSE_CHANNEL";
         case RIL_REQUEST_SIM_TRANSMIT_APDU_CHANNEL: return "SIM_TRANSMIT_APDU_CHANNEL";
         case RIL_REQUEST_GET_RADIO_CAPABILITY: return "RIL_REQUEST_GET_RADIO_CAPABILITY";
diff --git a/libril/ril_commands.h b/libril/ril_commands.h
index 50e649a..acbd6ba 100644
--- a/libril/ril_commands.h
+++ b/libril/ril_commands.h
@@ -151,3 +151,4 @@
     {RIL_REQUEST_PULL_LCEDATA, dispatchVoid, responseLceData},
     {RIL_REQUEST_GET_ACTIVITY_INFO, dispatchVoid, responseActivityData},
     {RIL_REQUEST_SIM_GET_ATR, dispatchInts, responseString},
+    {RIL_REQUEST_CAF_SIM_OPEN_CHANNEL_WITH_P2, dispatchOpenChannelWithP2, responseInts},