Merge "Fix AID offset and routing table size calculation is incorrect"
diff --git a/src/nfa/ee/nfa_ee_act.cc b/src/nfa/ee/nfa_ee_act.cc
index 6899a56..4f6a93e 100644
--- a/src/nfa/ee/nfa_ee_act.cc
+++ b/src/nfa/ee/nfa_ee_act.cc
@@ -409,15 +409,48 @@
   *ps = num_tlv;
 }
 
+/*******************************************************************************
+**
+** Function         nfa_ee_add_aid_route_to_ecb
+**
+** Description      Adds AIDs corresponding to ecb into listen mode routing
+**                  table(LMRT) buffer. Empty AID needs to be pushed as last
+**                  entry in LMRT. If Empty AID is part of any of the ecb,
+**                  its index is stored in tNFA_EE_EMPTY_AID_ECB structure.
+**                  If addEmptyAidRoute is set to true, only empty AID will
+**                  be added into LMRT buffer
+**
+** Returns          void
+**
+*******************************************************************************/
 static void nfa_ee_add_aid_route_to_ecb(tNFA_EE_ECB* p_cb, uint8_t* pp,
                                         uint8_t* p, uint8_t* ps,
-                                        int* p_cur_offset, int* p_max_len) {
+                                        int* p_cur_offset, int* p_max_len,
+                                        tNFA_EE_EMPTY_AID_ECB& empty_aid_ecb) {
   uint8_t num_tlv = *ps;
 
   /* add the AID routing */
   if (p_cb->aid_entries) {
     int start_offset = 0;
-    for (int xx = 0; xx < p_cb->aid_entries; xx++) {
+    int xx = 0;
+    if (empty_aid_ecb.addEmptyAidRoute && empty_aid_ecb.index != -1) {
+      xx = empty_aid_ecb.index;
+      start_offset = empty_aid_ecb.offset;
+    }
+    for (; xx < p_cb->aid_entries; xx++) {
+      /*
+       * If addEmptyAidRoute is false and aid is empty AID don't add to the
+       * LMRT buffer. Instead update the empty aid ecb and index, which will
+       * be used later to add empty add at the end of the routing table
+       */
+      if (p_cb->aid_len[xx] == NFA_EMPTY_AID_TLV_LEN &&
+          !empty_aid_ecb.addEmptyAidRoute) {
+        empty_aid_ecb.p_cb = p_cb;
+        empty_aid_ecb.index = xx;
+        empty_aid_ecb.offset = start_offset;
+        start_offset += p_cb->aid_len[xx];
+        continue;
+      }
       /* remember the beginning of this AID routing entry, just in case we
        * need to put it in next command */
       uint8_t route_qual = 0;
@@ -464,6 +497,11 @@
         *ps = num_tlv;
         *p_cur_offset += new_size;
       }
+
+      if (empty_aid_ecb.addEmptyAidRoute) {
+        // Break the loop after adding Empty AID
+        break;
+      }
     }
   } else {
     DLOG_IF(INFO, nfc_debug_enabled)
@@ -645,8 +683,8 @@
                                     int* p_offset, int* p_entry) {
   int xx, yy, aid_len_offset, offset;
   tNFA_EE_ECB *p_ret = nullptr, *p_ecb;
-  /* NFA_EE_CB_4_DH + Empty aid ECB */
-  p_ecb = &nfa_ee_cb.ecb[NFA_EE_CB_4_DH + 1];
+
+  p_ecb = &nfa_ee_cb.ecb[NFA_EE_CB_4_DH];
   aid_len_offset = 1; /* skip the tag */
   for (yy = 0; yy <= nfa_ee_cb.cur_ee; yy++) {
     if (p_ecb->aid_entries) {
@@ -2593,9 +2631,9 @@
 ** Returns          NFA_STATUS_OK, if ok to continue
 **
 *******************************************************************************/
-void nfa_ee_route_add_one_ecb_by_route_order(tNFA_EE_ECB* p_cb, int rout_type,
-                                             int* p_max_len, bool more,
-                                             uint8_t* ps, int* p_cur_offset) {
+void nfa_ee_route_add_one_ecb_by_route_order(
+    tNFA_EE_ECB* p_cb, int rout_type, int* p_max_len, bool more, uint8_t* ps,
+    int* p_cur_offset, tNFA_EE_EMPTY_AID_ECB& empty_aid_ecb) {
   /* use the first byte of the buffer (ps) to keep the num_tlv */
   uint8_t num_tlv = *ps;
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
@@ -2622,7 +2660,8 @@
       nfa_ee_add_proto_route_to_ecb(p_cb, pp, p, ps, p_cur_offset);
     } break;
     case NCI_ROUTE_ORDER_AID: {
-      nfa_ee_add_aid_route_to_ecb(p_cb, pp, p, ps, p_cur_offset, p_max_len);
+      nfa_ee_add_aid_route_to_ecb(p_cb, pp, p, ps, p_cur_offset, p_max_len,
+                                  empty_aid_ecb);
     } break;
     case NCI_ROUTE_ORDER_SYS_CODE: {
       nfa_ee_add_sys_code_route_to_ecb(p_cb, pp, p, ps, p_cur_offset,
@@ -2835,6 +2874,10 @@
   cur_offset = 0;
   /* use the first byte of the buffer (p) to keep the num_tlv */
   *p = 0;
+  tNFA_EE_EMPTY_AID_ECB empty_aid_ecb;
+  memset(&empty_aid_ecb, 0x00, sizeof(tNFA_EE_EMPTY_AID_ECB));
+  empty_aid_ecb.index = -1;
+
   for (int rt = NCI_ROUTE_ORDER_AID; rt <= NCI_ROUTE_ORDER_TECHNOLOGY; rt++) {
     /* add the routing entries for NFCEEs */
     p_cb = &nfa_ee_cb.ecb[0];
@@ -2844,7 +2887,7 @@
         DLOG_IF(INFO, nfc_debug_enabled)
             << StringPrintf("%s --add the routing for NFCEEs!!", __func__);
         nfa_ee_route_add_one_ecb_by_route_order(p_cb, rt, &max_len, more, p,
-                                                &cur_offset);
+                                                &cur_offset, empty_aid_ecb);
       }
     }
     if (rt == NCI_ROUTE_ORDER_TECHNOLOGY) more = false;
@@ -2852,15 +2895,17 @@
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("%s --add the routing for DH!!", __func__);
     nfa_ee_route_add_one_ecb_by_route_order(&nfa_ee_cb.ecb[NFA_EE_CB_4_DH], rt,
-                                            &max_len, more, p, &cur_offset);
+                                            &max_len, more, p, &cur_offset,
+                                            empty_aid_ecb);
 
     if (rt == NCI_ROUTE_ORDER_AID) {
-      p_cb = &nfa_ee_cb.ecb[NFA_EE_EMPTY_AID_ECB];
-      if (p_cb->ee_status == NFC_NFCEE_STATUS_ACTIVE) {
+      if (empty_aid_ecb.p_cb) {
         DLOG_IF(INFO, nfc_debug_enabled)
-            << StringPrintf("%s --add the routing for Empty Aid!!", __func__);
-        nfa_ee_route_add_one_ecb_by_route_order(p_cb, rt, &max_len, more, p,
-                                                &cur_offset);
+            << StringPrintf("%s --add Empty AID routing", __func__);
+        empty_aid_ecb.addEmptyAidRoute = true;
+        nfa_ee_route_add_one_ecb_by_route_order(empty_aid_ecb.p_cb, rt,
+                                                &max_len, more, p, &cur_offset,
+                                                empty_aid_ecb);
       }
     }
   }
diff --git a/src/nfa/ee/nfa_ee_api.cc b/src/nfa/ee/nfa_ee_api.cc
index 5ad43c1..16e056e 100644
--- a/src/nfa/ee/nfa_ee_api.cc
+++ b/src/nfa/ee/nfa_ee_api.cc
@@ -562,11 +562,7 @@
   tNFA_EE_ECB* p_cb;
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("handle:<0x%x>", ee_handle);
-  if (aid_len == 0) {
-    p_cb = &nfa_ee_cb.ecb[NFA_EE_EMPTY_AID_ECB];
-  } else {
-    p_cb = nfa_ee_find_ecb(nfcee_id);
-  }
+  p_cb = nfa_ee_find_ecb(nfcee_id);
 
   /* validate parameters - make sure the AID is in valid length range */
   if ((p_cb == nullptr) ||
@@ -578,7 +574,6 @@
     LOG(ERROR) << StringPrintf("Bad ee_handle or AID (len=%d)", aid_len);
     status = NFA_STATUS_INVALID_PARAM;
   } else {
-    p_cb->nfcee_id = nfcee_id;
     p_msg = (tNFA_EE_API_ADD_AID*)GKI_getbuf(size);
     if (p_msg != nullptr) {
       if (p_aid != nullptr)
diff --git a/src/nfa/include/nfa_ee_int.h b/src/nfa/include/nfa_ee_int.h
index b280562..5cf6fe5 100644
--- a/src/nfa/include/nfa_ee_int.h
+++ b/src/nfa/include/nfa_ee_int.h
@@ -30,12 +30,10 @@
 /*****************************************************************************
 **  Constants and data types
 *****************************************************************************/
-/* the number of tNFA_EE_ECBs (for NFCEEs and DH) + Empty aid ECB */
-#define NFA_EE_NUM_ECBS (NFA_EE_MAX_EE_SUPPORTED + 2)
+/* the number of tNFA_EE_ECBs (for NFCEEs and DH) */
+#define NFA_EE_NUM_ECBS (NFA_EE_MAX_EE_SUPPORTED + 1)
 /* The index for DH in nfa_ee_cb.ee_cb[] */
 #define NFA_EE_CB_4_DH NFA_EE_MAX_EE_SUPPORTED
-/* The index for Empty aid in nfa_ee_cb.ee_cb[] */
-#define NFA_EE_EMPTY_AID_ECB (NFA_EE_CB_4_DH + 1)
 #define NFA_EE_INVALID 0xFF
 /* only A, B, F, Bprime are supported by UICC now */
 #define NFA_EE_MAX_TECH_ROUTE 4
@@ -151,6 +149,8 @@
 /* this bit is in ee_status for internal use only */
 #define NFA_EE_STATUS_INT_MASK 0x20
 
+#define NFA_EMPTY_AID_TLV_LEN 0x02
+
 /* NFA-EE information for a particular NFCEE Entity (including DH) */
 typedef struct {
   tNFA_TECHNOLOGY_MASK
@@ -225,6 +225,14 @@
   uint16_t size_sys_code; /* The size for system code routing */
 } tNFA_EE_ECB;
 
+/* data type for Empty AID Index and ECB */
+typedef struct {
+  tNFA_EE_ECB* p_cb;
+  uint16_t index;
+  bool addEmptyAidRoute;
+  int offset;
+} tNFA_EE_EMPTY_AID_ECB;
+
 /* data type for NFA_EE_API_DISCOVER_EVT */
 typedef struct {
   NFC_HDR hdr;