Merge tag 'LA.UM.9.12.r1-13800.02-SMxx50.QSSI12.0' into int/12/fp4

"LA.UM.9.12.r1-13800.02-SMxx50.QSSI12.0"

* tag 'LA.UM.9.12.r1-13800.02-SMxx50.QSSI12.0':
  Fix an issue in SystemStatusNetworkInfo DataItem
  Increasing boot_time and real_time acceptable variation
  Use QMI WDS API to query pdn for SUPL ATL
  Apgs subscriber mananger fix
  Resolve one race condition issue in GnssAdapter
  Fixes ubsan shift-out-of-bounds SIGABRT
  Correct equals() for SystemStatusNetworkInfo
  Clear Emergency SUPL APN Name of SOS
  Block antennainfoCallback when vector size is 0
  add policy files to package list
  Comment out ANTENNA_INFO_VECTOR_SIZE by default
  BatchingAdapter to handle engine up after init
  GTP: add xtwifi policies for GTP WWAN call flow
  add libminiajil polices for xtwifi-client and inet-agent
  fix ntrip parameters invalid issue
  Batching API batch retrieval changes

Change-Id: I8885694cd261bb185f9e01886ab325ad0a62ed7f
diff --git a/Android.bp b/Android.bp
index ea0d991..0681f67 100644
--- a/Android.bp
+++ b/Android.bp
@@ -16,18 +16,6 @@
     "-Wno-error=date-time",
 ]
 
-/* Activate the following for regression testing */
-GNSS_SANITIZE = {
-/*  address: true,*/
-    cfi: true,
-    misc_undefined: [
-        "bounds",
-        "null",
-        "unreachable",
-        "integer",
-    ],
-}
-
 /* Activate the following for debug purposes only,
    comment out for production */
 GNSS_SANITIZE_DIAG = {
diff --git a/Android.mk b/Android.mk
index 77d61c9..88bb0f4 100644
--- a/Android.mk
+++ b/Android.mk
@@ -36,9 +36,6 @@
 LOCAL_PATH := $(call my-dir)
 include $(call all-makefiles-under,$(LOCAL_PATH))
 
-GNSS_SANITIZE := cfi bounds null unreachable integer
-# Activate the following two lines for regression testing
-#GNSS_SANITIZE += address
-#GNSS_SANITIZE_DIAG := $(GNSS_SANITIZE)
+GNSS_SANITIZE_DIAG := cfi bounds null unreachable integer address
 
 endif # ifneq ($(BOARD_VENDOR_QCOM_GPS_LOC_API_HARDWARE),)
diff --git a/android/1.0/Android.mk b/android/1.0/Android.mk
index 797ecce..f63a948 100644
--- a/android/1.0/Android.mk
+++ b/android/1.0/Android.mk
@@ -2,7 +2,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@1.0-impl-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
+
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VENDOR_MODULE := true
@@ -58,7 +58,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@1.0-service-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
+
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VINTF_FRAGMENTS := android.hardware.gnss@1.0-service-qti.xml
diff --git a/android/1.1/Android.mk b/android/1.1/Android.mk
index 66abd06..edf8547 100644
--- a/android/1.1/Android.mk
+++ b/android/1.1/Android.mk
@@ -2,7 +2,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@1.1-impl-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
+
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VENDOR_MODULE := true
@@ -59,7 +59,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@1.1-service-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
+
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VINTF_FRAGMENTS := android.hardware.gnss@1.1-service-qti.xml
diff --git a/android/2.0/Android.mk b/android/2.0/Android.mk
index c0b91ae..e3422f9 100644
--- a/android/2.0/Android.mk
+++ b/android/2.0/Android.mk
@@ -2,7 +2,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@2.0-impl-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
+
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VENDOR_MODULE := true
@@ -71,7 +71,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@2.0-service-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
+
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VINTF_FRAGMENTS := android.hardware.gnss@2.0-service-qti.xml
diff --git a/android/2.1/AGnss.cpp b/android/2.1/AGnss.cpp
index c759492..ce7b3aa 100644
--- a/android/2.1/AGnss.cpp
+++ b/android/2.1/AGnss.cpp
@@ -32,7 +32,7 @@
 
 static AGnss* spAGnss = nullptr;
 
-AGnss::AGnss(Gnss* gnss) : mGnss(gnss) {
+AGnss::AGnss(Gnss* gnss) : mGnss(gnss), mType(LOC_AGPS_TYPE_INVALID) {
     spAGnss = this;
 }
 
@@ -51,6 +51,9 @@
     V2_0::IAGnssCallback::AGnssType  aType;
     IAGnssCallback::AGnssStatusValue aStatus;
 
+    // cache the AGps Type
+    mType = type;
+
     switch (type) {
     case LOC_AGPS_TYPE_SUPL:
         aType = IAGnssCallback::AGnssType::SUPL;
@@ -138,18 +141,20 @@
 Return<bool> AGnss::dataConnOpen(uint64_t /*networkHandle*/, const hidl_string& apn,
         V2_0::IAGnss::ApnIpType apnIpType) {
 
-    if(mGnss == nullptr || mGnss->getGnssInterface() == nullptr){
+    if (mGnss == nullptr || mGnss->getGnssInterface() == nullptr){
         LOC_LOGE("Null GNSS interface");
         return false;
     }
 
-    /* Validate */
-    if(apn.empty()){
-        LOC_LOGE("Invalid APN");
-        return false;
+    std::string apnString(apn.c_str());
+    // During Emergency SUPL, an apn name of "sos" means that no
+    // apn was found, like in the simless case, so apn is cleared
+    if (LOC_AGPS_TYPE_SUPL_ES == mType && "sos" == apnString) {
+        LOC_LOGD("dataConnOpen APN name = [sos] cleared");
+        apnString.clear();
     }
 
-    LOC_LOGD("dataConnOpen APN name = [%s]", apn.c_str());
+    LOC_LOGD("dataConnOpen APN name = [%s]", apnString.c_str());
 
     AGpsBearerType bearerType;
     switch (apnIpType) {
@@ -168,7 +173,7 @@
     }
 
     mGnss->getGnssInterface()->agpsDataConnOpen(
-        LOC_AGPS_TYPE_SUPL, apn.c_str(), apn.size(), (int)bearerType);
+        LOC_AGPS_TYPE_SUPL, apnString.c_str(), apnString.size(), (int)bearerType);
     return true;
 }
 
diff --git a/android/2.1/AGnss.h b/android/2.1/AGnss.h
index f6ea997..cf9c8a7 100644
--- a/android/2.1/AGnss.h
+++ b/android/2.1/AGnss.h
@@ -67,6 +67,8 @@
  private:
     Gnss* mGnss = nullptr;
     sp<V2_0::IAGnssCallback> mAGnssCbIface = nullptr;
+
+    AGpsExtType mType;
 };
 
 }  // namespace implementation
diff --git a/android/2.1/Android.mk b/android/2.1/Android.mk
index a947e41..4be97a9 100644
--- a/android/2.1/Android.mk
+++ b/android/2.1/Android.mk
@@ -2,7 +2,6 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@2.1-impl-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VENDOR_MODULE := true
@@ -74,7 +73,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := android.hardware.gnss@2.1-service-qti
-LOCAL_SANITIZE += $(GNSS_SANITIZE)
+
 # activate the following line for debug purposes only, comment out for production
 #LOCAL_SANITIZE_DIAG += $(GNSS_SANITIZE_DIAG)
 LOCAL_VINTF_FRAGMENTS := android.hardware.gnss@2.1-service-qti.xml
diff --git a/android/2.1/location_api/BatchingAPIClient.cpp b/android/2.1/location_api/BatchingAPIClient.cpp
index 00d2ed9..0c871b7 100644
--- a/android/2.1/location_api/BatchingAPIClient.cpp
+++ b/android/2.1/location_api/BatchingAPIClient.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,7 +33,7 @@
 #include <inttypes.h>
 #include <log_util.h>
 #include <loc_cfg.h>
-
+#include <thread>
 #include "LocationUtil.h"
 #include "BatchingAPIClient.h"
 
@@ -82,10 +82,10 @@
     LOC_LOGD("%s]: ()", __FUNCTION__);
 }
 
-int BatchingAPIClient::getBatchSize()
-{
-    LOC_LOGD("%s]: ()", __FUNCTION__);
-    return locAPIGetBatchSize();
+int BatchingAPIClient::getBatchSize() {
+    int batchSize = locAPIGetBatchSize();
+    LOC_LOGd("batchSize: %d", batchSize);
+    return batchSize;
 }
 
 void BatchingAPIClient::setCallbacks()
@@ -133,8 +133,10 @@
     }
 }
 
-int BatchingAPIClient::startSession(const IGnssBatching::Options& opts)
-{
+int BatchingAPIClient::startSession(const IGnssBatching::Options& opts) {
+    mMutex.lock();
+    mState = STARTED;
+    mMutex.unlock();
     LOC_LOGD("%s]: (%lld %d)", __FUNCTION__,
             static_cast<long long>(opts.periodNanos), static_cast<uint8_t>(opts.flags));
     int retVal = -1;
@@ -168,10 +170,13 @@
     return retVal;
 }
 
-int BatchingAPIClient::stopSession()
-{
+int BatchingAPIClient::stopSession() {
+    mMutex.lock();
+    mState = STOPPING;
+    mMutex.unlock();
     LOC_LOGD("%s]: ", __FUNCTION__);
     int retVal = -1;
+    locAPIGetBatchedLocations(mDefaultId, SIZE_MAX);
     if (locAPIStopSession(mDefaultId) == LOCATION_ERROR_SUCCESS) {
         retVal = 1;
     }
@@ -184,10 +189,15 @@
     locAPIGetBatchedLocations(mDefaultId, last_n_locations);
 }
 
-void BatchingAPIClient::flushBatchedLocations()
-{
+void BatchingAPIClient::flushBatchedLocations() {
     LOC_LOGD("%s]: ()", __FUNCTION__);
-    locAPIGetBatchedLocations(mDefaultId, SIZE_MAX);
+    uint32_t retVal = locAPIGetBatchedLocations(mDefaultId, SIZE_MAX);
+    // when flush a stopped session or one doesn't exist, just report an empty batch.
+    if (LOCATION_ERROR_ID_UNKNOWN == retVal) {
+        BatchingOptions opt = {};
+        ::std::thread thd(&BatchingAPIClient::onBatchingCb, this, 0, nullptr, opt);
+        thd.detach();
+    }
 }
 
 void BatchingAPIClient::onCapabilitiesCb(LocationCapabilitiesMask capabilitiesMask)
@@ -197,37 +207,68 @@
 }
 
 void BatchingAPIClient::onBatchingCb(size_t count, Location* location,
-        BatchingOptions /*batchOptions*/)
-{
+        BatchingOptions /*batchOptions*/) {
+    bool processReport = false;
+    LOC_LOGd("(count: %zu)", count);
     mMutex.lock();
-    auto gnssBatchingCbIface(mGnssBatchingCbIface);
-    auto gnssBatchingCbIface_2_0(mGnssBatchingCbIface_2_0);
-    mMutex.unlock();
-
-    LOC_LOGD("%s]: (count: %zu)", __FUNCTION__, count);
-    if (gnssBatchingCbIface_2_0 != nullptr && count > 0) {
-        hidl_vec<V2_0::GnssLocation> locationVec;
-        locationVec.resize(count);
-        for (size_t i = 0; i < count; i++) {
-            convertGnssLocation(location[i], locationVec[i]);
-        }
-        auto r = gnssBatchingCbIface_2_0->gnssLocationBatchCb(locationVec);
-        if (!r.isOk()) {
-            LOC_LOGE("%s] Error from gnssLocationBatchCb 2_0 description=%s",
-                __func__, r.description().c_str());
-        }
-    } else if (gnssBatchingCbIface != nullptr && count > 0) {
-        hidl_vec<V1_0::GnssLocation> locationVec;
-        locationVec.resize(count);
-        for (size_t i = 0; i < count; i++) {
-            convertGnssLocation(location[i], locationVec[i]);
-        }
-        auto r = gnssBatchingCbIface->gnssLocationBatchCb(locationVec);
-        if (!r.isOk()) {
-            LOC_LOGE("%s] Error from gnssLocationBatchCb 1.0 description=%s",
-                __func__, r.description().c_str());
-        }
+    // back to back stop() and flush() could bring twice onBatchingCb(). Each one might come first.
+    // Combine them both (the first goes to cache, the second in location*) before report to FW
+    switch (mState) {
+        case STOPPING:
+            mState = STOPPED;
+            for (size_t i = 0; i < count; i++) {
+                mBatchedLocationInCache.push_back(location[i]);
+            }
+            break;
+        case STARTED:
+        case STOPPED: // flush() always trigger report, even on a stopped session
+            processReport = true;
+            break;
+        default:
+            break;
     }
+    // report location batch when in STARTED state or flush(), combined with cache in last stop()
+    if (processReport) {
+        auto gnssBatchingCbIface(mGnssBatchingCbIface);
+        auto gnssBatchingCbIface_2_0(mGnssBatchingCbIface_2_0);
+        size_t batchCacheCnt = mBatchedLocationInCache.size();
+        LOC_LOGd("(batchCacheCnt: %zu)", batchCacheCnt);
+        if (gnssBatchingCbIface_2_0 != nullptr) {
+            hidl_vec<V2_0::GnssLocation> locationVec;
+            if (count+batchCacheCnt > 0) {
+                locationVec.resize(count+batchCacheCnt);
+                for (size_t i = 0; i < batchCacheCnt; ++i) {
+                    convertGnssLocation(mBatchedLocationInCache[i], locationVec[i]);
+                }
+                for (size_t i = 0; i < count; i++) {
+                    convertGnssLocation(location[i], locationVec[i+batchCacheCnt]);
+                }
+            }
+            auto r = gnssBatchingCbIface_2_0->gnssLocationBatchCb(locationVec);
+            if (!r.isOk()) {
+                LOC_LOGE("%s] Error from gnssLocationBatchCb 2_0 description=%s",
+                        __func__, r.description().c_str());
+            }
+        } else if (gnssBatchingCbIface != nullptr) {
+            hidl_vec<V1_0::GnssLocation> locationVec;
+            if (count+batchCacheCnt > 0) {
+                locationVec.resize(count+batchCacheCnt);
+                for (size_t i = 0; i < batchCacheCnt; ++i) {
+                    convertGnssLocation(mBatchedLocationInCache[i], locationVec[i]);
+                }
+                for (size_t i = 0; i < count; i++) {
+                    convertGnssLocation(location[i], locationVec[i+batchCacheCnt]);
+                }
+            }
+            auto r = gnssBatchingCbIface->gnssLocationBatchCb(locationVec);
+            if (!r.isOk()) {
+                LOC_LOGE("%s] Error from gnssLocationBatchCb 1.0 description=%s",
+                        __func__, r.description().c_str());
+            }
+        }
+        mBatchedLocationInCache.clear();
+    }
+    mMutex.unlock();
 }
 
 static void convertBatchOption(const IGnssBatching::Options& in, LocationOptions& out,
diff --git a/android/2.1/location_api/BatchingAPIClient.h b/android/2.1/location_api/BatchingAPIClient.h
index 08d7d23..2d9ab74 100755
--- a/android/2.1/location_api/BatchingAPIClient.h
+++ b/android/2.1/location_api/BatchingAPIClient.h
@@ -43,6 +43,9 @@
 namespace V2_1 {
 namespace implementation {
 
+
+enum BATCHING_STATE { STARTED, STOPPING, STOPPED };
+
 class BatchingAPIClient : public LocationAPIClientBase
 {
 public:
@@ -72,6 +75,9 @@
     uint32_t mDefaultId;
     LocationCapabilitiesMask mLocationCapabilitiesMask;
     sp<V2_0::IGnssBatchingCallback> mGnssBatchingCbIface_2_0;
+    volatile BATCHING_STATE mState = STOPPED;
+
+    std::vector<Location> mBatchedLocationInCache;
 };
 
 }  // namespace implementation
diff --git a/android/utils/Android.bp b/android/utils/Android.bp
index c3dc17a..20fea88 100644
--- a/android/utils/Android.bp
+++ b/android/utils/Android.bp
@@ -3,7 +3,7 @@
     name: "liblocbatterylistener",
     vendor: true,
 
-    sanitize: GNSS_SANITIZE,
+
 
     cflags: GNSS_CFLAGS + ["-DBATTERY_LISTENER_ENABLED"],
     local_include_dirs: ["."],
diff --git a/batching/Android.bp b/batching/Android.bp
index 9182a0a..ce794d1 100644
--- a/batching/Android.bp
+++ b/batching/Android.bp
@@ -4,7 +4,7 @@
     name: "libbatching",
     vendor: true,
 
-    sanitize: GNSS_SANITIZE,
+
 
     shared_libs: [
         "libutils",
diff --git a/batching/BatchingAdapter.cpp b/batching/BatchingAdapter.cpp
index d9f7945..4f1a43c 100644
--- a/batching/BatchingAdapter.cpp
+++ b/batching/BatchingAdapter.cpp
@@ -37,7 +37,9 @@
 using namespace loc_core;
 
 BatchingAdapter::BatchingAdapter() :
-    LocAdapterBase(0, LocContext::getLocContext(LocContext::mLocationHalName)),
+    LocAdapterBase(0,
+                   LocContext::getLocContext(LocContext::mLocationHalName),
+                   false, nullptr, true),
     mOngoingTripDistance(0),
     mOngoingTripTBFInterval(0),
     mTripWithOngoingTBFDropped(false),
@@ -50,6 +52,10 @@
     LOC_LOGD("%s]: Constructor", __func__);
     readConfigCommand();
     setConfigCommand();
+
+    // at last step, let us inform adapater base that we are done
+    // with initialization, e.g.: ready to process handleEngineUpEvent
+    doneInit();
 }
 
 void
diff --git a/core/Android.bp b/core/Android.bp
index ee8e807..fe9f067 100644
--- a/core/Android.bp
+++ b/core/Android.bp
@@ -4,7 +4,7 @@
     name: "libloc_core",
     vendor: true,
 
-    sanitize: GNSS_SANITIZE,
+
 
     shared_libs: [
         "liblog",
diff --git a/core/LocApiBase.cpp b/core/LocApiBase.cpp
index 6a0ff84..860da2e 100644
--- a/core/LocApiBase.cpp
+++ b/core/LocApiBase.cpp
@@ -1034,7 +1034,7 @@
     struct timespec sinceBootTime;
     struct timespec sinceBootTimeTest;
     bool clockGetTimeSuccess = false;
-    const uint32_t MAX_TIME_DELTA_VALUE_NANOS = 10000;
+    const uint32_t MAX_TIME_DELTA_VALUE_NANOS = 15000;
     const uint32_t MAX_GET_TIME_COUNT = 20;
     /* Attempt to get CLOCK_REALTIME and CLOCK_BOOTIME in succession without an interruption
     or context switch (for up to MAX_GET_TIME_COUNT times) to avoid errors in the calculation */
diff --git a/core/SystemStatus.cpp b/core/SystemStatus.cpp
index d792577..fe11de0 100644
--- a/core/SystemStatus.cpp
+++ b/core/SystemStatus.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -1586,6 +1586,7 @@
             break;
     }
     pthread_mutex_unlock(&mMutexSystemStatus);
+    LOC_LOGv("DataItemId: %d, whether to record dateitem in cache: %d", dataitem->getId(), ret);
     return ret;
 }
 
diff --git a/core/SystemStatus.h b/core/SystemStatus.h
index 097e7cc..638933a 100644
--- a/core/SystemStatus.h
+++ b/core/SystemStatus.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -509,9 +509,11 @@
         for (uint8_t i = 0; rtv && i < MAX_NETWORK_HANDLES; ++i) {
             rtv &= (mAllNetworkHandles[i] == peer.mAllNetworkHandles[i]);
         }
-        return peer.mApn.compare(mApn);
+        return rtv && !peer.mApn.compare(mApn);
     }
     inline virtual SystemStatusItemBase& collate(SystemStatusItemBase& curInfo) {
+        LOC_LOGv("NetworkInfo: mAllTypes=%" PRIx64 " connected=%u mType=%x mApn=%s",
+                 mAllTypes, mConnected, mType, mApn.c_str());
         uint64_t allTypes = (static_cast<SystemStatusNetworkInfo&>(curInfo)).mAllTypes;
         string& apn = (static_cast<SystemStatusNetworkInfo&>(curInfo)).mApn;
         // Replace current with cached table for now and then update
diff --git a/etc/gnss_antenna_info.conf b/etc/gnss_antenna_info.conf
index 79a2aef..e037daa 100644
--- a/etc/gnss_antenna_info.conf
+++ b/etc/gnss_antenna_info.conf
@@ -80,7 +80,8 @@
 # NUMBER_OF_ROWS_SGC_ and NUMBER_OF_COLUMNS_SGC_ represent the number of
 # rows/columns for signal gain corrections
 
-ANTENNA_INFO_VECTOR_SIZE = 2
+# ANTENNA_INFO_VECTOR_SIZE must be non zero if antenna corrections are sent
+# ANTENNA_INFO_VECTOR_SIZE = 2
 
 CARRIER_FREQUENCY_0 = 1575.42
 
diff --git a/etc/seccomp_policy/gnss@2.0-base.policy b/etc/seccomp_policy/gnss@2.0-base.policy
index 7b93037..0a2e17b 100644
--- a/etc/seccomp_policy/gnss@2.0-base.policy
+++ b/etc/seccomp_policy/gnss@2.0-base.policy
@@ -93,3 +93,27 @@
 sendto: 1
 recvfrom: 1
 
+getsockname: 1
+nanosleep: 1
+clone: 1
+setsockopt: 1
+getsockopt: 1
+madvise: 1
+
+getitimer: 1
+setitimer: 1
+getpid: 1
+bind: 1
+listen: 1
+getpeername: 1
+socketpair: 1
+wait4: 1
+chown: 1
+fchown: 1
+lchown: 1
+umask: 1
+mmap2: 1
+fstat64: 1
+fstatat64: 1
+_llseek: 1
+geteuid: 1
diff --git a/etc/seccomp_policy/gnss@2.0-xtwifi-client.policy b/etc/seccomp_policy/gnss@2.0-xtwifi-client.policy
index 17df31a..38a41f9 100644
--- a/etc/seccomp_policy/gnss@2.0-xtwifi-client.policy
+++ b/etc/seccomp_policy/gnss@2.0-xtwifi-client.policy
@@ -32,7 +32,7 @@
 fdatasync: 1
 getdents64: 1
 gettimeofday: 1
-#ioctl: arg1 == _IOC(_IOC_NONE || arg1 == _IOC(_IOC_READ || arg1 == VSOC_MAYBE_SEND_INTERRUPT_TO_HOST
+ioctl: 1
 lseek: 1
 madvise: 1
 mkdirat: 1
@@ -43,3 +43,31 @@
 epoll_create1: 1
 epoll_pwait: 1
 epoll_ctl: 1
+
+sched_getaffinity: 1
+gettid: 1
+fchown: 1
+fchmod: 1
+fchmodat: 1
+getsockopt: 1
+fchownat: 1
+fstat: 1
+fstatfs: 1
+newfstatat: 1
+sendmsg: 1
+recvmsg: 1
+gettimeofday: 1
+setsockopt: 1
+rt_tgsigqueueinfo: 1
+ioctl: 1
+mmap: 1
+getuid32: 1
+getuid: 1
+fstat64: 1
+fstatat64: 1
+mkdir: 1
+rmdir: 1
+creat: 1
+chmod: 1
+lseek: 1
+geteuid32: 1
diff --git a/etc/seccomp_policy/gnss@2.0-xtwifi-inet-agent.policy b/etc/seccomp_policy/gnss@2.0-xtwifi-inet-agent.policy
index 00df6c7..024600a 100644
--- a/etc/seccomp_policy/gnss@2.0-xtwifi-inet-agent.policy
+++ b/etc/seccomp_policy/gnss@2.0-xtwifi-inet-agent.policy
@@ -31,3 +31,13 @@
 
 unlinkat: 1
 sched_getaffinity: 1
+newfstatat: 1
+fchmodat: 1
+madvise: 1
+mmap: 1
+getuid: 1
+getuid32: 1
+fstat64: 1
+fstatat64: 1
+gettimeofday: 1
+getdents64: 1
diff --git a/geofence/Android.bp b/geofence/Android.bp
index 4801eb8..bf8474f 100644
--- a/geofence/Android.bp
+++ b/geofence/Android.bp
@@ -5,7 +5,7 @@
     name: "libgeofencing",
     vendor: true,
 
-    sanitize: GNSS_SANITIZE,
+
 
     srcs: [
         "GeofenceAdapter.cpp",
diff --git a/geofence/GeofenceAdapter.cpp b/geofence/GeofenceAdapter.cpp
index f024e3f..1aeea0a 100644
--- a/geofence/GeofenceAdapter.cpp
+++ b/geofence/GeofenceAdapter.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2021, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -38,9 +38,13 @@
 GeofenceAdapter::GeofenceAdapter() :
     LocAdapterBase(0,
                    LocContext::getLocContext(LocContext::mLocationHalName),
-                   true /*isMaster*/)
+                   true /*isMaster*/, nullptr, true)
 {
     LOC_LOGD("%s]: Constructor", __func__);
+
+    // at last step, let us inform adapater base that we are done
+    // with initialization, e.g.: ready to process handleEngineUpEvent
+    doneInit();
 }
 
 void
diff --git a/gnss/Agps.cpp b/gnss/Agps.cpp
index 9255f88..0b95f99 100644
--- a/gnss/Agps.cpp
+++ b/gnss/Agps.cpp
@@ -448,7 +448,7 @@
         mAPN  = NULL;
     }
 
-    if (NULL == apn || len <= 0 || len > MAX_APN_LEN || strlen(apn) != len) {
+    if (NULL == apn || len > MAX_APN_LEN || strlen(apn) != len) {
         LOC_LOGD("Invalid apn len (%d) or null apn", len);
         mAPN = NULL;
         mAPNLen = 0;
@@ -590,7 +590,7 @@
     sm->setApnTypeMask(apnTypeMask);
 
     /* Invoke AGPS SM processing */
-    AgpsSubscriber subscriber(connHandle, false, false, apnTypeMask);
+    AgpsSubscriber subscriber(connHandle, true, false, apnTypeMask);
     sm->setCurrentSubscriber(&subscriber);
     /* Send subscriber event */
     sm->processAgpsEvent(AGPS_EVENT_SUBSCRIBE);
diff --git a/gnss/Agps.h b/gnss/Agps.h
index 6b43bf5..8a27cd9 100644
--- a/gnss/Agps.h
+++ b/gnss/Agps.h
@@ -167,7 +167,7 @@
 
     /* Getter/Setter methods */
     void setAPN(char* apn, unsigned int len);
-    inline char* getAPN() const { return (char*)mAPN; }
+    inline char* getAPN() const { return mAPN; }
     inline uint32_t getAPNLen() const { return mAPNLen; }
     inline void setBearer(AGpsBearerType bearer) { mBearer = bearer; }
     inline LocApnTypeMask getApnTypeMask() const { return mApnTypeMask; }
diff --git a/gnss/Android.bp b/gnss/Android.bp
index a3e8de9..736ea81 100644
--- a/gnss/Android.bp
+++ b/gnss/Android.bp
@@ -5,7 +5,7 @@
     name: "libgnss",
     vendor: true,
 
-    sanitize: GNSS_SANITIZE,
+
 
     shared_libs: [
         "libutils",
diff --git a/gnss/GnssAdapter.cpp b/gnss/GnssAdapter.cpp
index cff0298..f3ccd99 100644
--- a/gnss/GnssAdapter.cpp
+++ b/gnss/GnssAdapter.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -77,6 +77,8 @@
 
 typedef const CdfwInterface* (*getCdfwInterface)();
 
+typedef void getPdnTypeFromWds(const std::string& apnName, std::function<void(int)> pdnCb);
+
 inline bool GnssReportLoggerUtil::isLogEnabled() {
     return (mLogLatency != nullptr);
 }
@@ -889,6 +891,8 @@
                       ContextBase::mGps_conf.MO_SUPL_PORT,
                       LOC_AGPS_MO_SUPL_SERVER);
 
+    std::string moServerUrl = getMoServerUrl();
+    std::string serverUrl = getServerUrl();
     // inject the configurations into modem
     loc_gps_cfg_s gpsConf = ContextBase::mGps_conf;
     loc_sap_cfg_s_type sapConf = ContextBase::mSap_conf;
@@ -936,8 +940,10 @@
     gnssConfigRequested.blacklistedSvIds.assign(mBlacklistedSvIds.begin(),
                                                 mBlacklistedSvIds.end());
     mLocApi->sendMsg(new LocApiMsg(
-            [this, gpsConf, sapConf, oldMoServerUrl, gnssConfigRequested] () mutable {
-        gnssUpdateConfig(oldMoServerUrl, gnssConfigRequested, gnssConfigRequested);
+            [this, gpsConf, sapConf, oldMoServerUrl, moServerUrl,
+            serverUrl, gnssConfigRequested] () mutable {
+        gnssUpdateConfig(oldMoServerUrl, moServerUrl, serverUrl,
+                gnssConfigRequested, gnssConfigRequested);
 
         // set nmea mask type
         uint32_t mask = 0;
@@ -1025,6 +1031,7 @@
 }
 
 std::vector<LocationError> GnssAdapter::gnssUpdateConfig(const std::string& oldMoServerUrl,
+        const std::string& moServerUrl, const std::string& serverUrl,
         GnssConfig& gnssConfigRequested, GnssConfig& gnssConfigNeedEngineUpdate, size_t count) {
     loc_gps_cfg_s gpsConf = ContextBase::mGps_conf;
     size_t index = 0;
@@ -1034,9 +1041,6 @@
         errsList.insert(errsList.begin(), count, LOCATION_ERROR_SUCCESS);
     }
 
-    std::string serverUrl = getServerUrl();
-    std::string moServerUrl = getMoServerUrl();
-
     int serverUrlLen = serverUrl.length();
     int moServerUrlLen = moServerUrl.length();
 
@@ -1424,10 +1428,14 @@
                     adapter.reportResponse(countOfConfigs, errs.data(), ids.data());
             });
 
+            std::string moServerUrl = adapter.getMoServerUrl();
+            std::string serverUrl = adapter.getServerUrl();
             mApi.sendMsg(new LocApiMsg(
                     [&adapter, gnssConfigRequested, gnssConfigNeedEngineUpdate,
-                    countOfConfigs, configCollectiveResponse, errs] () mutable {
+                    moServerUrl, serverUrl, countOfConfigs, configCollectiveResponse,
+                    errs] () mutable {
                 std::vector<LocationError> errsList = adapter.gnssUpdateConfig("",
+                        moServerUrl, serverUrl,
                         gnssConfigRequested, gnssConfigNeedEngineUpdate, countOfConfigs);
 
                 configCollectiveResponse->returnToSender(errsList);
@@ -5214,6 +5222,38 @@
     return true;
 }
 
+void GnssAdapter::reportPdnTypeFromWds(int pdnType, AGpsExtType agpsType, std::string apnName,
+        AGpsBearerType bearerType) {
+    LOC_LOGd("pdnType from WDS QMI: %d, agpsType: %d, apnName: %s, bearerType: %d",
+            pdnType, agpsType, apnName.c_str(), bearerType);
+
+    struct MsgReportAtlPdn : public LocMsg {
+        GnssAdapter& mAdapter;
+        int mPdnType;
+        AgpsManager* mAgpsManager;
+        AGpsExtType mAgpsType;
+        string mApnName;
+        AGpsBearerType mBearerType;
+
+        inline MsgReportAtlPdn(GnssAdapter& adapter, int pdnType,
+                AgpsManager* agpsManager, AGpsExtType agpsType,
+                const string& apnName, AGpsBearerType bearerType) :
+            LocMsg(), mAgpsManager(agpsManager), mAgpsType(agpsType),
+            mApnName(apnName), mBearerType(bearerType),
+            mAdapter(adapter), mPdnType(pdnType) {}
+        inline virtual void proc() const {
+            mAgpsManager->reportAtlOpenSuccess(mAgpsType,
+                    const_cast<char*>(mApnName.c_str()),
+                    mApnName.length(), mPdnType<=0? mBearerType:mPdnType);
+        }
+    };
+
+    AGpsBearerType atlPdnType = (pdnType+1) & 3; // convert WDS QMI pdn type to AgpsBearerType
+    sendMsg(new MsgReportAtlPdn(*this, atlPdnType, &mAgpsManager,
+                agpsType, apnName, bearerType));
+}
+
+
 void GnssAdapter::dataConnOpenCommand(
         AGpsExtType agpsType,
         const char* apnName, int apnLen, AGpsBearerType bearerType){
@@ -5221,17 +5261,16 @@
     LOC_LOGI("GnssAdapter::frameworkDataConnOpen");
 
     struct AgpsMsgAtlOpenSuccess: public LocMsg {
-
+        GnssAdapter& mAdapter;
         AgpsManager* mAgpsManager;
         AGpsExtType mAgpsType;
         char* mApnName;
-        int mApnLen;
         AGpsBearerType mBearerType;
 
-        inline AgpsMsgAtlOpenSuccess(AgpsManager* agpsManager, AGpsExtType agpsType,
-                const char* apnName, int apnLen, AGpsBearerType bearerType) :
+        inline AgpsMsgAtlOpenSuccess(GnssAdapter& adapter, AgpsManager* agpsManager,
+                AGpsExtType agpsType, const char* apnName, int apnLen, AGpsBearerType bearerType) :
                 LocMsg(), mAgpsManager(agpsManager), mAgpsType(agpsType), mApnName(
-                        new char[apnLen + 1]), mApnLen(apnLen), mBearerType(bearerType) {
+                        new char[apnLen + 1]), mBearerType(bearerType), mAdapter(adapter) {
 
             LOC_LOGV("AgpsMsgAtlOpenSuccess");
             if (mApnName == nullptr) {
@@ -5249,19 +5288,36 @@
         }
 
         inline virtual void proc() const {
+            LOC_LOGv("AgpsMsgAtlOpenSuccess::proc()");
+            string apn(mApnName);
+            //Use QMI WDS API to query IP Protocol from modem profile
+            void* libHandle = nullptr;
+            getPdnTypeFromWds* getPdnTypeFunc = (getPdnTypeFromWds*)dlGetSymFromLib(libHandle,
+            #ifdef USE_GLIB
+                    "libloc_api_wds.so", "_Z10getPdnTypeRKNSt7__cxx1112basic_string"\
+                    "IcSt11char_traitsIcESaIcEEESt8functionIFviEE");
+            #else
+                    "libloc_api_wds.so", "_Z10getPdnTypeRKNSt3__112basic_stringIcNS_11char_traits"\
+                    "IcEENS_9allocatorIcEEEENS_8functionIFviEEE");
+            #endif
 
-            LOC_LOGV("AgpsMsgAtlOpenSuccess::proc()");
-            mAgpsManager->reportAtlOpenSuccess(mAgpsType, mApnName, mApnLen, mBearerType);
+            std::function<void(int)> wdsPdnTypeCb = std::bind(&GnssAdapter::reportPdnTypeFromWds,
+                    &mAdapter, std::placeholders::_1, mAgpsType, apn, mBearerType);
+           if (getPdnTypeFunc != nullptr) {
+               LOC_LOGv("dlGetSymFromLib success");
+               (*getPdnTypeFunc)(apn, wdsPdnTypeCb);
+           } else {
+               mAgpsManager->reportAtlOpenSuccess(mAgpsType, mApnName, apn.length(), mBearerType);
+           }
         }
     };
     // Added inital length checks for apnlen check to avoid security issues
     // In case of failure reporting the same
-    if (NULL == apnName || apnLen <= 0 || apnLen > MAX_APN_LEN ||
-            (strlen(apnName) != (unsigned)apnLen)) {
+    if (NULL == apnName || apnLen > MAX_APN_LEN || (strlen(apnName) != apnLen)) {
         LOC_LOGe("%s]: incorrect apnlen length or incorrect apnName", __func__);
         mAgpsManager.reportAtlClosed(agpsType);
     } else {
-        sendMsg( new AgpsMsgAtlOpenSuccess(
+        sendMsg( new AgpsMsgAtlOpenSuccess(*this,
                     &mAgpsManager, agpsType, apnName, apnLen, bearerType));
     }
 }
@@ -6731,7 +6787,9 @@
         }
         gnssAntennaInformations.push_back(std::move(gnssAntennaInfo));
     }
-    antennaInfoCallback(gnssAntennaInformations);
+    if (antennaInfoVectorSize > 0) {
+        antennaInfoCallback(gnssAntennaInformations);
+    }
 }
 
 /* ==== DGnss Usable Reporter ========================================================= */
@@ -6768,10 +6826,15 @@
                                               bool enableRTKEngine) {
 
     (void)enableRTKEngine; //future parameter, not used
+    if (0 == params.size || params.hostNameOrIp.empty() || params.mountPoint.empty() ||
+            params.username.empty() || params.password.empty()) {
+        LOC_LOGe("Ntrip parameters are invalid!");
+        return;
+    }
 
     struct enableNtripMsg : public LocMsg {
         GnssAdapter& mAdapter;
-        const GnssNtripConnectionParams& mParams;
+        const GnssNtripConnectionParams mParams;
 
         inline enableNtripMsg(GnssAdapter& adapter,
                 const GnssNtripConnectionParams& params) :
diff --git a/gnss/GnssAdapter.h b/gnss/GnssAdapter.h
index 6b8d024..d7b4275 100644
--- a/gnss/GnssAdapter.h
+++ b/gnss/GnssAdapter.h
@@ -321,7 +321,6 @@
     void logLatencyInfo();
 
 public:
-
     GnssAdapter();
     virtual inline ~GnssAdapter() { }
 
@@ -409,6 +408,8 @@
     void deleteAidingData(const GnssAidingData &data, uint32_t sessionId);
     void gnssUpdateXtraThrottleCommand(const bool enabled);
     std::vector<LocationError> gnssUpdateConfig(const std::string& oldMoServerUrl,
+            const std::string& moServerUrl,
+            const std::string& serverUrl,
             GnssConfig& gnssConfigRequested,
             GnssConfig& gnssConfigNeedEngineUpdate, size_t count = 0);
 
@@ -525,6 +526,8 @@
     (
         const std::unordered_map<LocationQwesFeatureType, bool> &featureMap
     );
+    void reportPdnTypeFromWds(int pdnType, AGpsExtType agpsType, std::string apnName,
+            AGpsBearerType bearerType);
 
     /* ======== UTILITIES ================================================================= */
     bool needReportForGnssClient(const UlpLocation& ulpLocation,
diff --git a/gnss/location_gnss.cpp b/gnss/location_gnss.cpp
index 0454a13..8f67369 100644
--- a/gnss/location_gnss.cpp
+++ b/gnss/location_gnss.cpp
@@ -519,7 +519,7 @@
 static void antennaInfoClose() {
     if (NULL != gGnssAdapter) {
         return gGnssAdapter->antennaInfoCloseCommand();
-	}
+    }
 }
 
 static uint32_t configRobustLocation(bool enable, bool enableForE911){
diff --git a/gps_vendor_product.mk b/gps_vendor_product.mk
index 0e578e8..cd35684 100644
--- a/gps_vendor_product.mk
+++ b/gps_vendor_product.mk
@@ -27,6 +27,10 @@
 PRODUCT_PACKAGES += gps.conf
 PRODUCT_PACKAGES += flp.conf
 PRODUCT_PACKAGES += gnss_antenna_info.conf
+PRODUCT_PACKAGES += gnss@2.0-base.policy
+PRODUCT_PACKAGES += gnss@2.0-xtra-daemon.policy
+PRODUCT_PACKAGES += gnss@2.0-xtwifi-client.policy
+PRODUCT_PACKAGES += gnss@2.0-xtwifi-inet-agent.policy
 PRODUCT_PACKAGES += libloc_pla_headers
 PRODUCT_PACKAGES += liblocation_api_headers
 PRODUCT_PACKAGES += libgps.utils_headers
diff --git a/location/Android.bp b/location/Android.bp
index 8532a08..fb4af2d 100644
--- a/location/Android.bp
+++ b/location/Android.bp
@@ -4,7 +4,7 @@
     name: "liblocation_api",
     vendor: true,
 
-    sanitize: GNSS_SANITIZE,
+
 
     shared_libs: [
         "libutils",
diff --git a/location/LocationAPIClientBase.cpp b/location/LocationAPIClientBase.cpp
index 4865a16..ea15a76 100644
--- a/location/LocationAPIClientBase.cpp
+++ b/location/LocationAPIClientBase.cpp
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, 2020 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017, 2020-2021 The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -634,7 +634,7 @@
             }
         }  else {
             retVal = LOCATION_ERROR_ID_UNKNOWN;
-            LOC_LOGE("%s:%d] invalid session: %d.", __FUNCTION__, __LINE__, id);
+            LOC_LOGd("unknown session id: %d, might flush() a stopped session",  id);
         }
     }
     pthread_mutex_unlock(&mMutex);
diff --git a/utils/Android.bp b/utils/Android.bp
index 7d43d57..33d8440 100644
--- a/utils/Android.bp
+++ b/utils/Android.bp
@@ -4,7 +4,7 @@
     name: "libgps.utils",
     vendor: true,
 
-    sanitize: GNSS_SANITIZE,
+
 
     //# Libs
     shared_libs: [