Android RIL driver for Android 14 Issue

I am using EC25 Module with IMX8MP Android 14 OS.

I have enabled Radio 1.4 with Quectel Driver Version “Quectel_Android_RIL_Driver_V3.6.24_master_Release” and after board boots i am replacing libril.so with quectel provieded file.

When vendor.ril-daemon tries to start it throws error
“rilc_confi_thread_pool” symbol cannot be found.

I have also tried with Radio V1.0 but Android is Showing No Sim in Mobile Networks Setting So I switched to Radio 1.4.

I have followed Steps provided at https://forums.quectel.com/t/ril-library-not-provided-by-quectel/5178/4?u=himanshusibrain and did driver modifications using User Guide in docs folder.

I have tried using Radio 1.6 too but same error occured, Below are logs for that

09-03 15:01:26.445     1     1 I init    : starting service 'exec 2343 (/system/bin/flags_health_check UPDATABLE_CRASHING)'...                              09-03 15:01:26.480     1     1 I init    : ... started service 'exec 2343 (/system/bin/flags_health_check UPDATABLE_CRASHING)' has pid 22000                09-03 15:01:26.223 22000 22000 I flags_health_check: ServerConfigurableFlagsReset reset_mode value: 1
09-03 15:01:26.223 22000 22000 I flags_health_check: ServerConfigurableFlagsReset updatable crashing detected, resetting flags.                             09-03 15:01:26.227 22000 22000 I flags_health_ch: type=1400 audit(0.0:272314): avc:  denied  { open } for  path="/dev/__properties__/u:object_r:device_logging_prop:s0" dev="tmpfs" ino=185 scontext=u:r:flags_health_check:s0 tcontext=u:object_r:device_logging_prop:s0 tclass=file permissive=1
09-03 15:01:26.262 22001 22001 F linker  : CANNOT LINK EXECUTABLE "/vendor/bin/hw/rild": cannot locate symbol "rilc_confi_thread_pool" referenced by "/vendor/bin/hw/rild"...                                                                                                                 

I found problem for “rilc_confi_thread_pool” and resolved it. I did modifications in default rild serivice code and have added this function there. But now as i am using Radio 1.6 i have to replace libril.so and this functions is missing.

Now Another error occurs,

09-03 15:38:16.320     1     1 I init    : starting service 'vendor.ril-daemon'...                                                                                                                                                         09-03 15:38:16.352     1     1 I init    : ... started service 'vendor.ril-daemon' has pid 4137                                                                                                                                            --------- beginning of crash                                                                                                                                                                                                               09-03 15:38:16.139  4137  4137 F libc    : FORTIFY: memcpy: prevented 994331344-byte write into 32-byte buffer                                                                                                                             09-03 15:38:16.139  4137  4137 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 4137 (rild), pid 4137 (rild)                                                                                                                09-03 15:38:16.133  4137  4137 I rild    : type=1400 audit(0.0:31570): avc:  denied  { read } for  name="ql-ril.conf" dev="dm-0" ino=8044481 scontext=u:r:rild:s0 tcontext=u:object_r:system_file:s0 tclass=fil1                           09-03 15:38:16.175  4141  4141 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto                                                                                                                         09-03 15:38:16.178   270   270 I tombstoned: received crash request for pid 4137                                                                                                                                                           09-03 15:38:16.178  4141  4141 I crash_dump64: performing dump of process 4137 (target tid = 4137)                                                                                                                                         09-03 15:38:16.133  4137  4137 I rild    : type=1400 audit(0.0:31571): avc:  denied  { open } for  path="/system/etc/ql-ril.conf" dev="overlay" ino=8044481 scontext=u:r:rild:s0 tcontext=u:object_r:system_fil1                           09-03 15:38:16.133  4137  4137 I rild    : type=1400 audit(0.0:31572): avc:  denied  { getattr } for  path="/system/etc/ql-ril.conf" dev="overlay" ino=8044481 scontext=u:r:rild:s0 tcontext=u:object_r:system_1                           09-03 15:38:16.536   213   213 I logd    : logdr: UID=0 GID=1001 PID=4141 n tail=500 logMask=8 pid=4137 start=0ns deadline=0ns                                                                                                             09-03 15:38:16.548   213   213 I logd    : logdr: UID=0 GID=1001 PID=4141 n tail=500 logMask=1 pid=4137 start=0ns deadline=0ns                                                                                                             09-03 15:38:16.272  4141  4141 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***                                                                                                                                 09-03 15:38:16.272  4141  4141 F DEBUG   : Build fingerprint: 'Android/verdin_8mp/verdin_8mp:14/UQ1A.231205.015/eng.sibrai.20240820.153117:userdebug/dev-keys'                                                                             09-03 15:38:16.272  4141  4141 F DEBUG   : Revision: '0'                                                                                                                                                                                   09-03 15:38:16.272  4141  4141 F DEBUG   : ABI: 'arm64'                                                                                                                                                                                    09-03 15:38:16.272  4141  4141 F DEBUG   : Timestamp: 2024-09-03 15:38:16.181762375+0000                                                                                                                                                   09-03 15:38:16.272   257   262 W libperfmgr: Failed to write to node: /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq with value: 1800000, fd: -1                                                                                    09-03 15:38:16.272  4141  4141 F DEBUG   : Process uptime: 2s                                                                                                                                                                              09-03 15:38:16.272  4141  4141 F DEBUG   : Cmdline: /vendor/bin/hw/rild -l /vendor/lib64/libquectel-ril.so                                                                                                                                 09-03 15:38:16.272   257   262 W libperfmgr: Failed to write to node: /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq with value: 1200000, fd: -1                                                                                    09-03 15:38:16.272  4141  4141 F DEBUG   : pid: 4137, tid: 4137, name: rild  >>> /vendor/bin/hw/rild <<<
09-03 15:38:16.272  4141  4141 F DEBUG   : uid: 0
09-03 15:38:16.272  4141  4141 F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
09-03 15:38:16.272  4141  4141 F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
09-03 15:38:16.272  4141  4141 F DEBUG   : Abort message: 'FORTIFY: memcpy: prevented 994331344-byte write into 32-byte buffer'                                                                                                            09-03 15:38:16.272  4141  4141 F DEBUG   :     x0  0000000000000000  x1  0000000000001029  x2  0000000000000006  x3  0000ffffc4bbb2f0                                                                                                      09-03 15:38:16.272  4141  4141 F DEBUG   :     x4  32323338381f6364  x5  32323338381f6364  x6  32323338381f6364  x7  7f7f7f7f7f7f7f7f                                                                                                      09-03 15:38:16.273  4141  4141 F DEBUG   :     x8  00000000000000f0  x9  0000f5b749460090  x10 0000000000000001  x11 0000f5b7494b6f00                                                                                                      09-03 15:38:16.273  4141  4141 F DEBUG   :     x12 0000000066d72d68  x13 000000007fffffff  x14 0000000000035e7c  x15 000000011e3ab252                                                                                                      09-03 15:38:16.273  4141  4141 F DEBUG   :     x16 0000f5b749530d08  x17 0000f5b7494ff810  x18 0000f5b753ebe000  x19 00000000000000ac                                                                                                      09-03 15:38:16.273  4141  4141 F DEBUG   :     x20 00000000000000b2  x21 0000000000001029  x22 0000000000001029  x23 00000000ffffffff                                                                                                      09-03 15:38:16.273  4141  4141 F DEBUG   :     x24 0000ffffc4bbb590  x25 0000000000000000  x26 0000000000000000  x27 0000000000000002                                                                                                      09-03 15:38:16.273  4141  4141 F DEBUG   :     x28 0000c50499f40348  x29 0000ffffc4bbb370
09-03 15:38:16.273  4141  4141 F DEBUG   :     lr  0000f5b7494a7414  sp  0000ffffc4bbb2d0  pc  0000f5b7494a7444  pst 0000000000000000                                                                                                      09-03 15:38:16.273  4141  4141 F DEBUG   : 8 total frames
09-03 15:38:16.273  4141  4141 F DEBUG   : backtrace:
09-03 15:38:16.273  4141  4141 F DEBUG   :       #00 pc 0000000000069444  /apex/com.android.runtime/lib64/bionic/libc.so (abort+180) (BuildId: 218db69eb66aeb253a34d956906a8bba)                                                           09-03 15:38:16.273  4141  4141 F DEBUG   :       #01 pc 000000000006b39c  /apex/com.android.runtime/lib64/bionic/libc.so (__fortify_fatal(char const*, ...)+124) (BuildId: 218db69eb66aeb253a34d956906a8bba)                               09-03 15:38:16.273  4141  4141 F DEBUG   :       #02 pc 0000000000096f18  /apex/com.android.runtime/lib64/bionic/libc.so (__check_buffer_access(char const*, char const*, unsigned long, unsigned long)+40) (Bu)                           09-03 15:38:16.273  4141  4141 F DEBUG   :       #03 pc 00000000000970c4  /apex/com.android.runtime/lib64/bionic/libc.so (__memcpy_chk_fail+68) (BuildId: 218db69eb66aeb253a34d956906a8bba)                                                09-03 15:38:16.274  4141  4141 F DEBUG   :       #04 pc 00000000000980a0  /apex/com.android.runtime/lib64/bionic/libc.so (__memcpy_chk+16) (BuildId: 218db69eb66aeb253a34d956906a8bba)                                                     09-03 15:38:16.274  4141  4141 F DEBUG   :       #05 pc 000000000003dea8  /vendor/lib64/libquectel-ril.so (RIL_Init+1196) (BuildId: 4c5946f37cb74d34f80cf17d8fe151f6)                                                                      09-03 15:38:16.274  4141  4141 F DEBUG   :       #06 pc 0000000000010364  /vendor/bin/hw/rild (main+756) (BuildId: 0a851a665bab285f5a404649ddc338f8)                                                                                       09-03 15:38:16.274  4141  4141 F DEBUG   :       #07 pc 0000000000061838  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+104) (BuildId: 218db69eb66aeb253a34d956906a8bba)                                                     --------- beginning of system
09-03 15:38:16.287   607   834 W NativeCrashListener: Couldn't find ProcessRecord for pid 4137
09-03 15:38:16.288   270   270 E tombstoned: Tombstone written to: tombstone_11
09-03 15:38:16.289   607   687 E NativeTombstoneManager: Tombstone's UID (0) not an app, ignoring
09-03 15:38:16.290   607   687 E NativeTombstoneManager: Tombstone's UID (0) not an app, ignoring
09-03 15:38:16.582     1     1 I init    : Untracked pid 4141 exited with status 0
09-03 15:38:16.591     1     1 I init    : Untracked pid 4141 did not have an associated service entry and will not be reaped                                                                                                              09-03 15:38:16.603     1     1 I init    : Service 'vendor.ril-daemon' (pid 4137) received signal 6
09-03 15:38:16.614     1     1 I init    : Sending signal 9 to service 'vendor.ril-daemon' (pid 4137) process group...                                                                                                                     09-03 15:38:16.626     1     1 I libprocessgroup: Successfully killed process cgroup uid 0 pid 4137 in 0ms                                                                                                     

I think you can try the IRadio 1.5 first.
If it still not work let’s try AIDL later.
Please provide the log files.

Hi @Bean.Wang-Q
Sorry for Delayed Response.
I finally got working.
I have implemented Audio Routing Logic, too. If you have any lead for that please share.

1 Like

Sounds great!
The EC25 support UAC and Voice over USB, I don’t know how the audio works with only the MIC and speaker on the Android.This is something that Android audio experts will be familiar with. I would be happy if you could give me a brief introduction.

@Bean.Wang-Q Thanks for Your Support Over Time.

I am not allowed to share more information as It is IP of our company.

That’s Great. I’m still glad you figured it out. At least I haven’t had any customers say they figured out Android audio routing with the UAC before.

Yeah.
I will share Video Link for the Demo when Its uploaded on LinkedIn.

@Bean.Wang-Q In AOSP settings app, manual network selection doesn’t display available networks. Calls and SMS function properly even on serial i get list of network using cops command.

Any logs, could you show it with pictures?

@Bean.Wang-Q yes i have mention log below.

E PhoneInterfaceManager: [PhoneIntfMgr] getForbiddenPlmns() no app with specified type – 2
E PhoneInterfaceManager: [PhoneIntfMgr] getForbiddenPlmns() no app with specified type – 2
D NetworkScanHelper: Network scan status: 1
D NetworkScanHelper: Available operators: null

in the ql-ril.conf make sure
Query_Available_Networks=1

@Bean.Wang-Q yes it is Query_Available_Networks=1.but unable to get list of manual network.

Disabling automatic network search resulted in only one network being available; others are not detected.
I have attached the relevant log files for your review.

log.txt (4.1 KB)

Just from the log, it seems that it do not support the AT command AT+QCSAN.

05-16 16:59:51.180  2133  2134 D CELL_INFO: qcomm_qscan:1580 g_is_scan_ing = 1                                                                                               
05-16 16:59:51.180  2133  2134 D ATC     : AT> AT+QSCAN=2,1                                                                                                                  
05-16 16:59:51.180  1021  1159 D RILJ    : [5381]< START_NETWORK_SCAN {scanStatus=1, scanError=0, networkInfos=null} [PHONE0]                                                
05-16 16:59:51.187  2133  2137 D ATC     : AT< ERROR                                                                                                                         05-16 16:59:51.187  2133  2134 D CELL_INFO: qcomm_qscan_nr:1570 size = 0                                                                                                     
05-16 16:59:51.187  2133  2134 D ATC     : AT> AT+QSCAN=1,1                                                                                                                  
05-16 16:59:51.192  2133  2137 D ATC     : AT< ERROR      

Thank you for the update @Bean.Wang-Q . In that case, could you please advise how we can resolve this issue? Also, could you please provide the firmware that supports the AT+QCSAN command?

Normally it should use the AT+COPS=2 to querry the available network.
What’s the module it is?

@Bean.Wang-Q We are utilizing the libril.so and libreference-ril.so files on the EC25 GSM module.

It should not use the AT+QCAN. Where did you find the libs? Is the cellular working except the available network?

@Bean.Wang-Q, The cellular functionality—including voice calls, SMS, and internet—works correctly on our device. We referenced the RIL library from the Quectel forum for integration. If this library is not suitable for Android 13 (AOSP 13) on the EC25 module, could you please provide the appropriate RIL library for this configuration?