OSDN Git Service

Fix double freeing of memory in SAP service and add null-checks.
[android-x86/hardware-ril.git] / libril / sap_service.cpp
1 /*
2  * Copyright (c) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16
17 #define LOG_TAG "RIL_SAP"
18
19 #include <android/hardware/radio/1.1/ISap.h>
20
21 #include <hwbinder/IPCThreadState.h>
22 #include <hwbinder/ProcessState.h>
23 #include <sap_service.h>
24 #include "pb_decode.h"
25 #include "pb_encode.h"
26
27 using namespace android::hardware::radio::V1_0;
28 using ::android::hardware::Return;
29 using ::android::hardware::hidl_vec;
30 using ::android::hardware::hidl_array;
31 using ::android::hardware::Void;
32 using android::CommandInfo;
33 using android::RequestInfo;
34 using android::requestToString;
35 using android::sp;
36
37 struct SapImpl;
38
39 #if (SIM_COUNT >= 2)
40 sp<SapImpl> sapService[SIM_COUNT];
41 #else
42 sp<SapImpl> sapService[1];
43 #endif
44
45 struct SapImpl : public android::hardware::radio::V1_1::ISap {
46     int32_t slotId;
47     sp<ISapCallback> sapCallback;
48     RIL_SOCKET_ID rilSocketId;
49
50     Return<void> setCallback(const ::android::sp<ISapCallback>& sapCallbackParam);
51
52     Return<void> connectReq(int32_t token, int32_t maxMsgSize);
53
54     Return<void> disconnectReq(int32_t token);
55
56     Return<void> apduReq(int32_t token, SapApduType type, const hidl_vec<uint8_t>& command);
57
58     Return<void> transferAtrReq(int32_t token);
59
60     Return<void> powerReq(int32_t token, bool state);
61
62     Return<void> resetSimReq(int32_t token);
63
64     Return<void> transferCardReaderStatusReq(int32_t token);
65
66     Return<void> setTransferProtocolReq(int32_t token, SapTransferProtocol transferProtocol);
67
68     MsgHeader* createMsgHeader(MsgId msgId, int32_t token);
69
70     Return<void> addPayloadAndDispatchRequest(MsgHeader *msg, uint16_t reqLen, uint8_t *reqPtr);
71
72     void sendFailedResponse(MsgId msgId, int32_t token, int numPointers, ...);
73
74     void checkReturnStatus(Return<void>& ret);
75 };
76
77 void SapImpl::checkReturnStatus(Return<void>& ret) {
78     if (ret.isOk() == false) {
79         RLOGE("checkReturnStatus: unable to call response/indication callback: %s",
80                 ret.description().c_str());
81         // Remote process (SapRilReceiver.java) hosting the callback must be dead. Reset the
82         // callback object; there's no other recovery to be done here. When the client process is
83         // back up, it will call setCallback()
84         sapCallback = NULL;
85     }
86 }
87
88 Return<void> SapImpl::setCallback(const ::android::sp<ISapCallback>& sapCallbackParam) {
89     RLOGD("SapImpl::setCallback for slotId %d", slotId);
90     sapCallback = sapCallbackParam;
91     return Void();
92 }
93
94 MsgHeader* SapImpl::createMsgHeader(MsgId msgId, int32_t token) {
95     // Memory for msg will be freed by RilSapSocket::onRequestComplete()
96     MsgHeader *msg = (MsgHeader *)calloc(1, sizeof(MsgHeader));
97     if (msg == NULL) {
98         return NULL;
99     }
100     msg->token = token;
101     msg->type = MsgType_REQUEST;
102     msg->id = msgId;
103     msg->error = Error_RIL_E_SUCCESS;
104     return msg;
105 }
106
107 Return<void> SapImpl::addPayloadAndDispatchRequest(MsgHeader *msg, uint16_t reqLen,
108         uint8_t *reqPtr) {
109     pb_bytes_array_t *payload = (pb_bytes_array_t *) malloc(sizeof(pb_bytes_array_t) - 1 + reqLen);
110     if (payload == NULL) {
111         sendFailedResponse(msg->id, msg->token, 2, reqPtr, msg);
112         return Void();
113     }
114
115     msg->payload = payload;
116     msg->payload->size = reqLen;
117     memcpy(msg->payload->bytes, reqPtr, reqLen);
118
119     RilSapSocket *sapSocket = RilSapSocket::getSocketById(rilSocketId);
120     if (sapSocket) {
121         RLOGD("SapImpl::addPayloadAndDispatchRequest: calling dispatchRequest");
122         sapSocket->dispatchRequest(msg);
123     } else {
124         RLOGE("SapImpl::addPayloadAndDispatchRequest: sapSocket is null");
125         sendFailedResponse(msg->id, msg->token, 3, payload, reqPtr, msg);
126         return Void();
127     }
128     free(msg->payload);
129     free(reqPtr);
130     return Void();
131 }
132
133 void SapImpl::sendFailedResponse(MsgId msgId, int32_t token, int numPointers, ...) {
134     va_list ap;
135     va_start(ap, numPointers);
136     for (int i = 0; i < numPointers; i++) {
137         void *ptr = va_arg(ap, void *);
138         if (ptr) free(ptr);
139     }
140     va_end(ap);
141     Return<void> retStatus;
142     switch(msgId) {
143         case MsgId_RIL_SIM_SAP_CONNECT:
144             retStatus = sapCallback->connectResponse(token, SapConnectRsp::CONNECT_FAILURE, 0);
145             break;
146
147         case MsgId_RIL_SIM_SAP_DISCONNECT:
148             retStatus = sapCallback->disconnectResponse(token);
149             break;
150
151         case MsgId_RIL_SIM_SAP_APDU: {
152             hidl_vec<uint8_t> apduRsp;
153             retStatus = sapCallback->apduResponse(token, SapResultCode::GENERIC_FAILURE, apduRsp);
154             break;
155         }
156
157         case MsgId_RIL_SIM_SAP_TRANSFER_ATR: {
158             hidl_vec<uint8_t> atr;
159             retStatus = sapCallback->transferAtrResponse(token, SapResultCode::GENERIC_FAILURE,
160                     atr);
161             break;
162         }
163
164         case MsgId_RIL_SIM_SAP_POWER:
165             retStatus = sapCallback->powerResponse(token, SapResultCode::GENERIC_FAILURE);
166             break;
167
168         case MsgId_RIL_SIM_SAP_RESET_SIM:
169             retStatus = sapCallback->resetSimResponse(token, SapResultCode::GENERIC_FAILURE);
170             break;
171
172         case MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS:
173             retStatus = sapCallback->transferCardReaderStatusResponse(token,
174                     SapResultCode::GENERIC_FAILURE, 0);
175             break;
176
177         case MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL:
178             retStatus = sapCallback->transferProtocolResponse(token, SapResultCode::NOT_SUPPORTED);
179             break;
180
181         default:
182             return;
183     }
184     sapService[slotId]->checkReturnStatus(retStatus);
185 }
186
187 Return<void> SapImpl::connectReq(int32_t token, int32_t maxMsgSize) {
188     RLOGD("SapImpl::connectReq");
189     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_CONNECT, token);
190     if (msg == NULL) {
191         RLOGE("SapImpl::connectReq: Error allocating memory for msg");
192         sendFailedResponse(MsgId_RIL_SIM_SAP_CONNECT, token, 0);
193         return Void();
194     }
195
196     /***** Encode RIL_SIM_SAP_CONNECT_REQ *****/
197     RIL_SIM_SAP_CONNECT_REQ req;
198     memset(&req, 0, sizeof(RIL_SIM_SAP_CONNECT_REQ));
199     req.max_message_size = maxMsgSize;
200
201     size_t encodedSize = 0;
202     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_CONNECT_REQ_fields, &req)) {
203         RLOGE("SapImpl::connectReq: Error getting encoded size for RIL_SIM_SAP_CONNECT_REQ");
204         sendFailedResponse(MsgId_RIL_SIM_SAP_CONNECT, token, 1, msg);
205         return Void();
206     }
207
208     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
209     if (buffer == NULL) {
210         RLOGE("SapImpl::connectReq: Error allocating memory for buffer");
211         sendFailedResponse(MsgId_RIL_SIM_SAP_CONNECT, token, 1, msg);
212         return Void();
213     }
214     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
215
216     RLOGD("SapImpl::connectReq calling pb_encode");
217     if (!pb_encode(&stream, RIL_SIM_SAP_CONNECT_REQ_fields, &req)) {
218         RLOGE("SapImpl::connectReq: Error encoding RIL_SIM_SAP_CONNECT_REQ");
219         sendFailedResponse(MsgId_RIL_SIM_SAP_CONNECT, token, 2, buffer, msg);
220         return Void();
221     }
222     /***** Encode RIL_SIM_SAP_CONNECT_REQ done *****/
223
224     /* encoded req is payload */
225     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
226 }
227
228 Return<void> SapImpl::disconnectReq(int32_t token) {
229     RLOGD("SapImpl::disconnectReq");
230     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_DISCONNECT, token);
231     if (msg == NULL) {
232         RLOGE("SapImpl::disconnectReq: Error allocating memory for msg");
233         sendFailedResponse(MsgId_RIL_SIM_SAP_DISCONNECT, token, 0);
234         return Void();
235     }
236
237     /***** Encode RIL_SIM_SAP_DISCONNECT_REQ *****/
238     RIL_SIM_SAP_DISCONNECT_REQ req;
239     memset(&req, 0, sizeof(RIL_SIM_SAP_DISCONNECT_REQ));
240
241     size_t encodedSize = 0;
242     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_DISCONNECT_REQ_fields, &req)) {
243         RLOGE("SapImpl::disconnectReq: Error getting encoded size for RIL_SIM_SAP_DISCONNECT_REQ");
244         sendFailedResponse(MsgId_RIL_SIM_SAP_DISCONNECT, token, 1, msg);
245         return Void();
246     }
247
248     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
249     if (buffer == NULL) {
250         RLOGE("SapImpl::disconnectReq: Error allocating memory for buffer");
251         sendFailedResponse(MsgId_RIL_SIM_SAP_DISCONNECT, token, 1, msg);
252         return Void();
253     }
254
255     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
256
257     RLOGD("SapImpl::disconnectReq calling pb_encode");
258     if (!pb_encode(&stream, RIL_SIM_SAP_DISCONNECT_REQ_fields, &req)) {
259         RLOGE("SapImpl::disconnectReq: Error encoding RIL_SIM_SAP_DISCONNECT_REQ");
260         sendFailedResponse(MsgId_RIL_SIM_SAP_DISCONNECT, token, 2, buffer, msg);
261         return Void();
262     }
263     /***** Encode RIL_SIM_SAP_DISCONNECT_REQ done *****/
264
265     /* encoded req is payload */
266     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
267 }
268
269 Return<void> SapImpl::apduReq(int32_t token, SapApduType type, const hidl_vec<uint8_t>& command) {
270     RLOGD("SapImpl::apduReq");
271     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_APDU, token);
272     if (msg == NULL) {
273         RLOGE("SapImpl::apduReq: Error allocating memory for msg");
274         sendFailedResponse(MsgId_RIL_SIM_SAP_APDU, token, 0);
275         return Void();
276     }
277
278     /***** Encode RIL_SIM_SAP_APDU_REQ *****/
279     RIL_SIM_SAP_APDU_REQ req;
280     memset(&req, 0, sizeof(RIL_SIM_SAP_APDU_REQ));
281     req.type = (RIL_SIM_SAP_APDU_REQ_Type)type;
282
283     if (command.size() > 0) {
284         req.command = (pb_bytes_array_t *)malloc(sizeof(pb_bytes_array_t) - 1 + command.size());
285         if (req.command == NULL) {
286             RLOGE("SapImpl::apduReq: Error allocating memory for req.command");
287             sendFailedResponse(MsgId_RIL_SIM_SAP_APDU, token, 1, msg);
288             return Void();
289         }
290         req.command->size = command.size();
291         memcpy(req.command->bytes, command.data(), command.size());
292     }
293
294     size_t encodedSize = 0;
295     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_APDU_REQ_fields, &req)) {
296         RLOGE("SapImpl::apduReq: Error getting encoded size for RIL_SIM_SAP_APDU_REQ");
297         sendFailedResponse(MsgId_RIL_SIM_SAP_APDU, token, 2, req.command, msg);
298         return Void();
299     }
300
301     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
302     if (buffer == NULL) {
303         RLOGE("SapImpl::apduReq: Error allocating memory for buffer");
304         sendFailedResponse(MsgId_RIL_SIM_SAP_APDU, token, 2, req.command, msg);
305         return Void();
306     }
307
308     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
309
310     RLOGD("SapImpl::apduReq calling pb_encode");
311     if (!pb_encode(&stream, RIL_SIM_SAP_APDU_REQ_fields, &req)) {
312         RLOGE("SapImpl::apduReq: Error encoding RIL_SIM_SAP_APDU_REQ");
313         sendFailedResponse(MsgId_RIL_SIM_SAP_APDU, token, 3, req.command, buffer, msg);
314         return Void();
315     }
316     /***** Encode RIL_SIM_SAP_APDU_REQ done *****/
317
318     /* encoded req is payload */
319     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
320 }
321
322 Return<void> SapImpl::transferAtrReq(int32_t token) {
323     RLOGD("SapImpl::transferAtrReq");
324     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_TRANSFER_ATR, token);
325     if (msg == NULL) {
326         RLOGE("SapImpl::transferAtrReq: Error allocating memory for msg");
327         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_ATR, token, 0);
328         return Void();
329     }
330
331     /***** Encode RIL_SIM_SAP_TRANSFER_ATR_REQ *****/
332     RIL_SIM_SAP_TRANSFER_ATR_REQ req;
333     memset(&req, 0, sizeof(RIL_SIM_SAP_TRANSFER_ATR_REQ));
334
335     size_t encodedSize = 0;
336     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_TRANSFER_ATR_REQ_fields, &req)) {
337         RLOGE("SapImpl::transferAtrReq: Error getting encoded size for "
338                 "RIL_SIM_SAP_TRANSFER_ATR_REQ");
339         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_ATR, token, 1, msg);
340         return Void();
341     }
342
343     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
344     if (buffer == NULL) {
345         RLOGE("SapImpl::transferAtrReq: Error allocating memory for buffer");
346         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_ATR, token, 1, msg);
347         return Void();
348     }
349
350     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
351
352     RLOGD("SapImpl::transferAtrReq calling pb_encode");
353     if (!pb_encode(&stream, RIL_SIM_SAP_TRANSFER_ATR_REQ_fields, &req)) {
354         RLOGE("SapImpl::transferAtrReq: Error encoding RIL_SIM_SAP_TRANSFER_ATR_REQ");
355         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_ATR, token, 2, buffer, msg);
356         return Void();
357     }
358     /***** Encode RIL_SIM_SAP_TRANSFER_ATR_REQ done *****/
359
360     /* encoded req is payload */
361     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
362 }
363
364 Return<void> SapImpl::powerReq(int32_t token, bool state) {
365     RLOGD("SapImpl::powerReq");
366     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_POWER, token);
367     if (msg == NULL) {
368         RLOGE("SapImpl::powerReq: Error allocating memory for msg");
369         sendFailedResponse(MsgId_RIL_SIM_SAP_POWER, token, 0);
370         return Void();
371     }
372
373     /***** Encode RIL_SIM_SAP_POWER_REQ *****/
374     RIL_SIM_SAP_POWER_REQ req;
375     memset(&req, 0, sizeof(RIL_SIM_SAP_POWER_REQ));
376     req.state = state;
377
378     size_t encodedSize = 0;
379     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_POWER_REQ_fields, &req)) {
380         RLOGE("SapImpl::powerReq: Error getting encoded size for RIL_SIM_SAP_POWER_REQ");
381         sendFailedResponse(MsgId_RIL_SIM_SAP_POWER, token, 1, msg);
382         return Void();
383     }
384
385     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
386     if (buffer == NULL) {
387         RLOGE("SapImpl::powerReq: Error allocating memory for buffer");
388         sendFailedResponse(MsgId_RIL_SIM_SAP_POWER, token, 1, msg);
389         return Void();
390     }
391
392     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
393
394     RLOGD("SapImpl::powerReq calling pb_encode");
395     if (!pb_encode(&stream, RIL_SIM_SAP_POWER_REQ_fields, &req)) {
396         RLOGE("SapImpl::powerReq: Error encoding RIL_SIM_SAP_POWER_REQ");
397         sendFailedResponse(MsgId_RIL_SIM_SAP_POWER, token, 2, buffer, msg);
398         return Void();
399     }
400     /***** Encode RIL_SIM_SAP_POWER_REQ done *****/
401
402     /* encoded req is payload */
403     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
404 }
405
406 Return<void> SapImpl::resetSimReq(int32_t token) {
407     RLOGD("SapImpl::resetSimReq");
408     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_RESET_SIM, token);
409     if (msg == NULL) {
410         RLOGE("SapImpl::resetSimReq: Error allocating memory for msg");
411         sendFailedResponse(MsgId_RIL_SIM_SAP_RESET_SIM, token, 0);
412         return Void();
413     }
414
415     /***** Encode RIL_SIM_SAP_RESET_SIM_REQ *****/
416     RIL_SIM_SAP_RESET_SIM_REQ req;
417     memset(&req, 0, sizeof(RIL_SIM_SAP_RESET_SIM_REQ));
418
419     size_t encodedSize = 0;
420     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_RESET_SIM_REQ_fields, &req)) {
421         RLOGE("SapImpl::resetSimReq: Error getting encoded size for RIL_SIM_SAP_RESET_SIM_REQ");
422         sendFailedResponse(MsgId_RIL_SIM_SAP_RESET_SIM, token, 1, msg);
423         return Void();
424     }
425
426     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
427     if (buffer == NULL) {
428         RLOGE("SapImpl::resetSimReq: Error allocating memory for buffer");
429         sendFailedResponse(MsgId_RIL_SIM_SAP_RESET_SIM, token, 1, msg);
430         return Void();
431     }
432
433     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
434
435     RLOGD("SapImpl::resetSimReq calling pb_encode");
436     if (!pb_encode(&stream, RIL_SIM_SAP_RESET_SIM_REQ_fields, &req)) {
437         RLOGE("SapImpl::resetSimReq: Error encoding RIL_SIM_SAP_RESET_SIM_REQ");
438         sendFailedResponse(MsgId_RIL_SIM_SAP_RESET_SIM, token, 2, buffer, msg);
439         return Void();
440     }
441     /***** Encode RIL_SIM_SAP_RESET_SIM_REQ done *****/
442
443     /* encoded req is payload */
444     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
445 }
446
447 Return<void> SapImpl::transferCardReaderStatusReq(int32_t token) {
448     RLOGD("SapImpl::transferCardReaderStatusReq");
449     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS, token);
450     if (msg == NULL) {
451         RLOGE("SapImpl::transferCardReaderStatusReq: Error allocating memory for msg");
452         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS, token, 0);
453         return Void();
454     }
455
456     /***** Encode RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ *****/
457     RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ req;
458     memset(&req, 0, sizeof(RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ));
459
460     size_t encodedSize = 0;
461     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ_fields,
462             &req)) {
463         RLOGE("SapImpl::transferCardReaderStatusReq: Error getting encoded size for "
464                 "RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ");
465         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS, token, 1, msg);
466         return Void();
467     }
468
469     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
470     if (buffer == NULL) {
471         RLOGE("SapImpl::transferCardReaderStatusReq: Error allocating memory for buffer");
472         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS, token, 1, msg);
473         return Void();
474     }
475
476     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
477
478     RLOGD("SapImpl::transferCardReaderStatusReq calling pb_encode");
479     if (!pb_encode(&stream, RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ_fields, &req)) {
480         RLOGE("SapImpl::transferCardReaderStatusReq: Error encoding "
481                 "RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ");
482         sendFailedResponse(MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS, token, 2, buffer, msg);
483         return Void();
484     }
485     /***** Encode RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_REQ done *****/
486
487     /* encoded req is payload */
488     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
489 }
490
491 Return<void> SapImpl::setTransferProtocolReq(int32_t token, SapTransferProtocol transferProtocol) {
492     RLOGD("SapImpl::setTransferProtocolReq");
493     MsgHeader *msg = createMsgHeader(MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL, token);
494     if (msg == NULL) {
495         RLOGE("SapImpl::setTransferProtocolReq: Error allocating memory for msg");
496         sendFailedResponse(MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL, token, 0);
497         return Void();
498     }
499
500     /***** Encode RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ *****/
501     RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ req;
502     memset(&req, 0, sizeof(RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ));
503     req.protocol = (RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ_Protocol)transferProtocol;
504
505     size_t encodedSize = 0;
506     if (!pb_get_encoded_size(&encodedSize, RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ_fields, &req)) {
507         RLOGE("SapImpl::setTransferProtocolReq: Error getting encoded size for "
508                 "RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ");
509         sendFailedResponse(MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL, token, 1, msg);
510         return Void();
511     }
512
513     uint8_t *buffer = (uint8_t *)calloc(1, encodedSize);
514     if (buffer == NULL) {
515         RLOGE("SapImpl::setTransferProtocolReq: Error allocating memory for buffer");
516         sendFailedResponse(MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL, token, 1, msg);
517         return Void();
518     }
519
520     pb_ostream_t stream = pb_ostream_from_buffer(buffer, encodedSize);
521
522     RLOGD("SapImpl::setTransferProtocolReq calling pb_encode");
523     if (!pb_encode(&stream, RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ_fields, &req)) {
524         RLOGE("SapImpl::setTransferProtocolReq: Error encoding "
525                 "RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ");
526         sendFailedResponse(MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL, token, 2, buffer, msg);
527         return Void();
528     }
529     /***** Encode RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_REQ done *****/
530
531     /* encoded req is payload */
532     return addPayloadAndDispatchRequest(msg, stream.bytes_written, buffer);
533 }
534
535 void *sapDecodeMessage(MsgId msgId, MsgType msgType, uint8_t *payloadPtr, size_t payloadLen) {
536     void *responsePtr = NULL;
537     pb_istream_t stream;
538
539     /* Create the stream */
540     stream = pb_istream_from_buffer((uint8_t *)payloadPtr, payloadLen);
541
542     /* Decode based on the message id */
543     switch (msgId)
544     {
545         case MsgId_RIL_SIM_SAP_CONNECT:
546             responsePtr = malloc(sizeof(RIL_SIM_SAP_CONNECT_RSP));
547             if (responsePtr) {
548                 if (!pb_decode(&stream, RIL_SIM_SAP_CONNECT_RSP_fields, responsePtr)) {
549                     RLOGE("Error decoding RIL_SIM_SAP_CONNECT_RSP");
550                     return NULL;
551                 }
552             }
553             break;
554
555         case MsgId_RIL_SIM_SAP_DISCONNECT:
556             if (msgType == MsgType_RESPONSE) {
557                 responsePtr = malloc(sizeof(RIL_SIM_SAP_DISCONNECT_RSP));
558                 if (responsePtr) {
559                     if (!pb_decode(&stream, RIL_SIM_SAP_DISCONNECT_RSP_fields, responsePtr)) {
560                         RLOGE("Error decoding RIL_SIM_SAP_DISCONNECT_RSP");
561                         return NULL;
562                     }
563                 }
564             } else {
565                 responsePtr = malloc(sizeof(RIL_SIM_SAP_DISCONNECT_IND));
566                 if (responsePtr) {
567                     if (!pb_decode(&stream, RIL_SIM_SAP_DISCONNECT_IND_fields, responsePtr)) {
568                         RLOGE("Error decoding RIL_SIM_SAP_DISCONNECT_IND");
569                         return NULL;
570                     }
571                 }
572             }
573             break;
574
575         case MsgId_RIL_SIM_SAP_APDU:
576             responsePtr = malloc(sizeof(RIL_SIM_SAP_APDU_RSP));
577             if (responsePtr) {
578                 if (!pb_decode(&stream, RIL_SIM_SAP_APDU_RSP_fields, responsePtr)) {
579                     RLOGE("Error decoding RIL_SIM_SAP_APDU_RSP");
580                     return NULL;
581                 }
582             }
583             break;
584
585         case MsgId_RIL_SIM_SAP_TRANSFER_ATR:
586             responsePtr = malloc(sizeof(RIL_SIM_SAP_TRANSFER_ATR_RSP));
587             if (responsePtr) {
588                 if (!pb_decode(&stream, RIL_SIM_SAP_TRANSFER_ATR_RSP_fields, responsePtr)) {
589                     RLOGE("Error decoding RIL_SIM_SAP_TRANSFER_ATR_RSP");
590                     return NULL;
591                 }
592             }
593             break;
594
595         case MsgId_RIL_SIM_SAP_POWER:
596             responsePtr = malloc(sizeof(RIL_SIM_SAP_POWER_RSP));
597             if (responsePtr) {
598                 if (!pb_decode(&stream, RIL_SIM_SAP_POWER_RSP_fields, responsePtr)) {
599                     RLOGE("Error decoding RIL_SIM_SAP_POWER_RSP");
600                     return NULL;
601                 }
602             }
603             break;
604
605         case MsgId_RIL_SIM_SAP_RESET_SIM:
606             responsePtr = malloc(sizeof(RIL_SIM_SAP_RESET_SIM_RSP));
607             if (responsePtr) {
608                 if (!pb_decode(&stream, RIL_SIM_SAP_RESET_SIM_RSP_fields, responsePtr)) {
609                     RLOGE("Error decoding RIL_SIM_SAP_RESET_SIM_RSP");
610                     return NULL;
611                 }
612             }
613             break;
614
615         case MsgId_RIL_SIM_SAP_STATUS:
616             responsePtr = malloc(sizeof(RIL_SIM_SAP_STATUS_IND));
617             if (responsePtr) {
618                 if (!pb_decode(&stream, RIL_SIM_SAP_STATUS_IND_fields, responsePtr)) {
619                     RLOGE("Error decoding RIL_SIM_SAP_STATUS_IND");
620                     return NULL;
621                 }
622             }
623             break;
624
625         case MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS:
626             responsePtr = malloc(sizeof(RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP));
627             if (responsePtr) {
628                 if (!pb_decode(&stream, RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP_fields,
629                         responsePtr)) {
630                     RLOGE("Error decoding RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP");
631                     return NULL;
632                 }
633             }
634             break;
635
636         case MsgId_RIL_SIM_SAP_ERROR_RESP:
637             responsePtr = malloc(sizeof(RIL_SIM_SAP_ERROR_RSP));
638             if (responsePtr) {
639                 if (!pb_decode(&stream, RIL_SIM_SAP_ERROR_RSP_fields, responsePtr)) {
640                     RLOGE("Error decoding RIL_SIM_SAP_ERROR_RSP");
641                     return NULL;
642                 }
643             }
644             break;
645
646         case MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL:
647             responsePtr = malloc(sizeof(RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_RSP));
648             if (responsePtr) {
649                 if (!pb_decode(&stream, RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_RSP_fields,
650                         responsePtr)) {
651                     RLOGE("Error decoding RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_RSP");
652                     return NULL;
653                 }
654             }
655             break;
656
657         default:
658             break;
659     }
660     return responsePtr;
661 } /* sapDecodeMessage */
662
663 sp<SapImpl> getSapImpl(RilSapSocket *sapSocket) {
664     switch (sapSocket->getSocketId()) {
665         case RIL_SOCKET_1:
666             RLOGD("getSapImpl: returning sapService[0]");
667             return sapService[0];
668         #if (SIM_COUNT >= 2)
669         case RIL_SOCKET_2:
670             return sapService[1];
671         #if (SIM_COUNT >= 3)
672         case RIL_SOCKET_3:
673             return sapService[2];
674         #if (SIM_COUNT >= 4)
675         case RIL_SOCKET_4:
676             return sapService[3];
677         #endif
678         #endif
679         #endif
680         default:
681             return NULL;
682     }
683 }
684
685 SapResultCode convertApduResponseProtoToHal(RIL_SIM_SAP_APDU_RSP_Response responseProto) {
686     switch(responseProto) {
687         case RIL_SIM_SAP_APDU_RSP_Response_RIL_E_SUCCESS:
688             return SapResultCode::SUCCESS;
689         case RIL_SIM_SAP_APDU_RSP_Response_RIL_E_GENERIC_FAILURE:
690             return SapResultCode::GENERIC_FAILURE;
691         case RIL_SIM_SAP_APDU_RSP_Response_RIL_E_SIM_NOT_READY:
692             return SapResultCode::CARD_NOT_ACCESSSIBLE;
693         case RIL_SIM_SAP_APDU_RSP_Response_RIL_E_SIM_ALREADY_POWERED_OFF:
694             return SapResultCode::CARD_ALREADY_POWERED_OFF;
695         case RIL_SIM_SAP_APDU_RSP_Response_RIL_E_SIM_ABSENT:
696             return SapResultCode::CARD_REMOVED;
697         default:
698             return SapResultCode::GENERIC_FAILURE;
699     }
700 }
701
702 SapResultCode convertTransferAtrResponseProtoToHal(
703         RIL_SIM_SAP_TRANSFER_ATR_RSP_Response responseProto) {
704     switch(responseProto) {
705         case RIL_SIM_SAP_TRANSFER_ATR_RSP_Response_RIL_E_SUCCESS:
706             return SapResultCode::SUCCESS;
707         case RIL_SIM_SAP_TRANSFER_ATR_RSP_Response_RIL_E_GENERIC_FAILURE:
708             return SapResultCode::GENERIC_FAILURE;
709         case RIL_SIM_SAP_TRANSFER_ATR_RSP_Response_RIL_E_SIM_ALREADY_POWERED_OFF:
710             return SapResultCode::CARD_ALREADY_POWERED_OFF;
711         case RIL_SIM_SAP_TRANSFER_ATR_RSP_Response_RIL_E_SIM_ABSENT:
712             return SapResultCode::CARD_REMOVED;
713         case RIL_SIM_SAP_TRANSFER_ATR_RSP_Response_RIL_E_SIM_DATA_NOT_AVAILABLE:
714             return SapResultCode::DATA_NOT_AVAILABLE;
715         default:
716             return SapResultCode::GENERIC_FAILURE;
717     }
718 }
719
720 SapResultCode convertPowerResponseProtoToHal(RIL_SIM_SAP_POWER_RSP_Response responseProto) {
721     switch(responseProto) {
722         case RIL_SIM_SAP_POWER_RSP_Response_RIL_E_SUCCESS:
723             return SapResultCode::SUCCESS;
724         case RIL_SIM_SAP_POWER_RSP_Response_RIL_E_GENERIC_FAILURE:
725             return SapResultCode::GENERIC_FAILURE;
726         case RIL_SIM_SAP_POWER_RSP_Response_RIL_E_SIM_ABSENT:
727             return SapResultCode::CARD_REMOVED;
728         case RIL_SIM_SAP_POWER_RSP_Response_RIL_E_SIM_ALREADY_POWERED_OFF:
729             return SapResultCode::CARD_ALREADY_POWERED_OFF;
730         case RIL_SIM_SAP_POWER_RSP_Response_RIL_E_SIM_ALREADY_POWERED_ON:
731             return SapResultCode::CARD_ALREADY_POWERED_ON;
732         default:
733             return SapResultCode::GENERIC_FAILURE;
734     }
735 }
736
737 SapResultCode convertResetSimResponseProtoToHal(RIL_SIM_SAP_RESET_SIM_RSP_Response responseProto) {
738     switch(responseProto) {
739         case RIL_SIM_SAP_RESET_SIM_RSP_Response_RIL_E_SUCCESS:
740             return SapResultCode::SUCCESS;
741         case RIL_SIM_SAP_RESET_SIM_RSP_Response_RIL_E_GENERIC_FAILURE:
742             return SapResultCode::GENERIC_FAILURE;
743         case RIL_SIM_SAP_RESET_SIM_RSP_Response_RIL_E_SIM_ABSENT:
744             return SapResultCode::CARD_REMOVED;
745         case RIL_SIM_SAP_RESET_SIM_RSP_Response_RIL_E_SIM_NOT_READY:
746             return SapResultCode::CARD_NOT_ACCESSSIBLE;
747         case RIL_SIM_SAP_RESET_SIM_RSP_Response_RIL_E_SIM_ALREADY_POWERED_OFF:
748             return SapResultCode::CARD_ALREADY_POWERED_OFF;
749     }
750     return SapResultCode::GENERIC_FAILURE;
751 }
752
753 SapResultCode convertTransferCardReaderStatusResponseProtoToHal(
754         RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP_Response responseProto) {
755     switch(responseProto) {
756         case RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP_Response_RIL_E_SUCCESS:
757             return SapResultCode::SUCCESS;
758         case RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP_Response_RIL_E_GENERIC_FAILURE:
759             return SapResultCode::GENERIC_FAILURE;
760         case RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP_Response_RIL_E_SIM_DATA_NOT_AVAILABLE:
761             return SapResultCode::DATA_NOT_AVAILABLE;
762     }
763     return SapResultCode::GENERIC_FAILURE;
764 }
765
766 void processResponse(MsgHeader *rsp, RilSapSocket *sapSocket, MsgType msgType) {
767     MsgId msgId = rsp->id;
768     uint8_t *data = rsp->payload->bytes;
769     size_t dataLen = rsp->payload->size;
770
771     void *messagePtr = sapDecodeMessage(msgId, msgType, data, dataLen);
772
773     sp<SapImpl> sapImpl = getSapImpl(sapSocket);
774     if (sapImpl->sapCallback == NULL) {
775         RLOGE("processResponse: sapCallback == NULL; msgId = %d; msgType = %d",
776                 msgId, msgType);
777         return;
778     }
779
780     if (messagePtr == NULL) {
781         RLOGE("processResponse: *messagePtr == NULL; msgId = %d; msgType = %d",
782                 msgId, msgType);
783         sapImpl->sendFailedResponse(msgId, rsp->token, 0);
784         return;
785     }
786
787     RLOGD("processResponse: sapCallback != NULL; msgId = %d; msgType = %d",
788             msgId, msgType);
789
790     Return<void> retStatus;
791     switch (msgId) {
792         case MsgId_RIL_SIM_SAP_CONNECT: {
793             RIL_SIM_SAP_CONNECT_RSP *connectRsp = (RIL_SIM_SAP_CONNECT_RSP *)messagePtr;
794             RLOGD("processResponse: calling sapCallback->connectResponse %d %d %d",
795                     rsp->token,
796                     connectRsp->response,
797                     connectRsp->max_message_size);
798             retStatus = sapImpl->sapCallback->connectResponse(rsp->token,
799                     (SapConnectRsp)connectRsp->response,
800                     connectRsp->max_message_size);
801             break;
802         }
803
804         case MsgId_RIL_SIM_SAP_DISCONNECT:
805             if (msgType == MsgType_RESPONSE) {
806                 RLOGD("processResponse: calling sapCallback->disconnectResponse %d", rsp->token);
807                 retStatus = sapImpl->sapCallback->disconnectResponse(rsp->token);
808             } else {
809                 RIL_SIM_SAP_DISCONNECT_IND *disconnectInd =
810                         (RIL_SIM_SAP_DISCONNECT_IND *)messagePtr;
811                 RLOGD("processResponse: calling sapCallback->disconnectIndication %d %d",
812                         rsp->token, disconnectInd->disconnectType);
813                 retStatus = sapImpl->sapCallback->disconnectIndication(rsp->token,
814                         (SapDisconnectType)disconnectInd->disconnectType);
815             }
816             break;
817
818         case MsgId_RIL_SIM_SAP_APDU: {
819             RIL_SIM_SAP_APDU_RSP *apduRsp = (RIL_SIM_SAP_APDU_RSP *)messagePtr;
820             SapResultCode apduResponse = convertApduResponseProtoToHal(apduRsp->response);
821             RLOGD("processResponse: calling sapCallback->apduResponse %d %d",
822                     rsp->token, apduResponse);
823             hidl_vec<uint8_t> apduRspVec;
824             if (apduRsp->apduResponse != NULL && apduRsp->apduResponse->size > 0) {
825                 apduRspVec.setToExternal(apduRsp->apduResponse->bytes, apduRsp->apduResponse->size);
826             }
827             retStatus = sapImpl->sapCallback->apduResponse(rsp->token, apduResponse, apduRspVec);
828             break;
829         }
830
831         case MsgId_RIL_SIM_SAP_TRANSFER_ATR: {
832             RIL_SIM_SAP_TRANSFER_ATR_RSP *transferAtrRsp =
833                 (RIL_SIM_SAP_TRANSFER_ATR_RSP *)messagePtr;
834             SapResultCode transferAtrResponse =
835                 convertTransferAtrResponseProtoToHal(transferAtrRsp->response);
836             RLOGD("processResponse: calling sapCallback->transferAtrResponse %d %d",
837                     rsp->token, transferAtrResponse);
838             hidl_vec<uint8_t> transferAtrRspVec;
839             if (transferAtrRsp->atr != NULL && transferAtrRsp->atr->size > 0) {
840                 transferAtrRspVec.setToExternal(transferAtrRsp->atr->bytes,
841                         transferAtrRsp->atr->size);
842             }
843             retStatus = sapImpl->sapCallback->transferAtrResponse(rsp->token, transferAtrResponse,
844                     transferAtrRspVec);
845             break;
846         }
847
848         case MsgId_RIL_SIM_SAP_POWER: {
849             SapResultCode powerResponse = convertPowerResponseProtoToHal(
850                     ((RIL_SIM_SAP_POWER_RSP *)messagePtr)->response);
851             RLOGD("processResponse: calling sapCallback->powerResponse %d %d",
852                     rsp->token, powerResponse);
853             retStatus = sapImpl->sapCallback->powerResponse(rsp->token, powerResponse);
854             break;
855         }
856
857         case MsgId_RIL_SIM_SAP_RESET_SIM: {
858             SapResultCode resetSimResponse = convertResetSimResponseProtoToHal(
859                     ((RIL_SIM_SAP_RESET_SIM_RSP *)messagePtr)->response);
860             RLOGD("processResponse: calling sapCallback->resetSimResponse %d %d",
861                     rsp->token, resetSimResponse);
862             retStatus = sapImpl->sapCallback->resetSimResponse(rsp->token, resetSimResponse);
863             break;
864         }
865
866         case MsgId_RIL_SIM_SAP_STATUS: {
867             RIL_SIM_SAP_STATUS_IND *statusInd = (RIL_SIM_SAP_STATUS_IND *)messagePtr;
868             RLOGD("processResponse: calling sapCallback->statusIndication %d %d",
869                     rsp->token, statusInd->statusChange);
870             retStatus = sapImpl->sapCallback->statusIndication(rsp->token,
871                     (SapStatus)statusInd->statusChange);
872             break;
873         }
874
875         case MsgId_RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS: {
876             RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP *transferStatusRsp =
877                     (RIL_SIM_SAP_TRANSFER_CARD_READER_STATUS_RSP *)messagePtr;
878             SapResultCode transferCardReaderStatusResponse =
879                     convertTransferCardReaderStatusResponseProtoToHal(
880                     transferStatusRsp->response);
881             RLOGD("processResponse: calling sapCallback->transferCardReaderStatusResponse %d %d %d",
882                     rsp->token,
883                     transferCardReaderStatusResponse,
884                     transferStatusRsp->CardReaderStatus);
885             retStatus = sapImpl->sapCallback->transferCardReaderStatusResponse(rsp->token,
886                     transferCardReaderStatusResponse,
887                     transferStatusRsp->CardReaderStatus);
888             break;
889         }
890
891         case MsgId_RIL_SIM_SAP_ERROR_RESP: {
892             RLOGD("processResponse: calling sapCallback->errorResponse %d", rsp->token);
893             retStatus = sapImpl->sapCallback->errorResponse(rsp->token);
894             break;
895         }
896
897         case MsgId_RIL_SIM_SAP_SET_TRANSFER_PROTOCOL: {
898             SapResultCode setTransferProtocolResponse;
899             if (((RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_RSP *)messagePtr)->response ==
900                     RIL_SIM_SAP_SET_TRANSFER_PROTOCOL_RSP_Response_RIL_E_SUCCESS) {
901                 setTransferProtocolResponse = SapResultCode::SUCCESS;
902             } else {
903                 setTransferProtocolResponse = SapResultCode::NOT_SUPPORTED;
904             }
905             RLOGD("processResponse: calling sapCallback->transferProtocolResponse %d %d",
906                     rsp->token, setTransferProtocolResponse);
907             retStatus = sapImpl->sapCallback->transferProtocolResponse(rsp->token,
908                     setTransferProtocolResponse);
909             break;
910         }
911
912         default:
913             return;
914     }
915     sapImpl->checkReturnStatus(retStatus);
916 }
917
918 void sap::processResponse(MsgHeader *rsp, RilSapSocket *sapSocket) {
919     processResponse(rsp, sapSocket, MsgType_RESPONSE);
920 }
921
922 void sap::processUnsolResponse(MsgHeader *rsp, RilSapSocket *sapSocket) {
923     processResponse(rsp, sapSocket, MsgType_UNSOL_RESPONSE);
924 }
925
926 void sap::registerService(const RIL_RadioFunctions *callbacks) {
927     using namespace android::hardware;
928     int simCount = 1;
929     const char *serviceNames[] = {
930         android::RIL_getServiceName()
931         #if (SIM_COUNT >= 2)
932         , RIL2_SERVICE_NAME
933         #if (SIM_COUNT >= 3)
934         , RIL3_SERVICE_NAME
935         #if (SIM_COUNT >= 4)
936         , RIL4_SERVICE_NAME
937         #endif
938         #endif
939         #endif
940     };
941
942     RIL_SOCKET_ID socketIds[] = {
943         RIL_SOCKET_1
944         #if (SIM_COUNT >= 2)
945         , RIL_SOCKET_2
946         #if (SIM_COUNT >= 3)
947         , RIL_SOCKET_3
948         #if (SIM_COUNT >= 4)
949         , RIL_SOCKET_4
950         #endif
951         #endif
952         #endif
953     };
954     #if (SIM_COUNT >= 2)
955     simCount = SIM_COUNT;
956     #endif
957
958     for (int i = 0; i < simCount; i++) {
959         sapService[i] = new SapImpl;
960         sapService[i]->slotId = i;
961         sapService[i]->rilSocketId = socketIds[i];
962         RLOGD("registerService: starting ISap %s for slotId %d", serviceNames[i], i);
963         android::status_t status = sapService[i]->registerAsService(serviceNames[i]);
964         RLOGD("registerService: started ISap %s status %d", serviceNames[i], status);
965     }
966 }