Android Radio Layer Interface

1. Android Radio Layer Interface

2. Summary
•Background
•RIL stack overview
•RIL daemon (rild)
•Example: RIL with Mc39i on versatile
•Example: RIL with HUAWEI E169 on
Eeepc 900
•Screenshots

3. Background
•What is RIL ?
–RIL is the abbreviation of Android's Radio Interface Layer (RIL),
–it provides an abstraction layer between Android telephony services (
android.telephony) and radio hardware.
–It consists of two primary components RIL Daemon and Vendor RIL.
–RIL Daemon
•it initializes the Vendor RIL,
•and processes all communication from Android telephony services, and dispatches calls to
the Vendor RIL as solicited commands.
•Solicited Request, all the request that sent by RILJ belong this category. For example : dial,
hung up send SMS
–Vendor RIL
•It initialize the baseband device
•and processes all communication with radio hardware and dispatches calls to the RIL
Daemon (rild) through unsolicited commands.
•Unsolicited Request, the event that coming from outside. For example : incoming calling,
MS change BS, signal strength
•The purpose of this section is to introduce RIL control flow, but not includes
voice and packet services.

4. Summary
•Background
•RIL stack overview
•RIL daemon (rild)
•Example: RIL with Mc39i on versatile
•Example: RIL with HUAWEI E169 on
Eeepc 900
•Screenshots

5. RIL Overview
Android RIL stack

6. Summary
•Background
•RIL stack overview
•RIL daemon (rild)
•Example: RIL with Mc39i on versatile
•Example: RIL with HUAWEI E169 on
Eeepc 900
•Screenshots

7. RIL daemon (rild)
•RILD internal structure
•Startup flow
•Solicited request flow
•Unsolicited request flow

8. RILD internal structure

9. Component naming
•the RIL component, RILJ RILD RILC and RIL,
are the name used in the android LOG
functions.
•Android has a set of functions for recording
different type log message, ex: LOGE() for error
message, LOGW() for warning message, and
LOGI() for normal information, we call those
function ( or method whatever ) as LOG
functions.
•You can use logcat to watch those message via
adb.

10. RIL stack component
•RILJ
–java/android/telephony/gsm
–Send Requests ( dial, hang up,
signal strength ... ) to RIL via local
socket “rild”
•RILD ( log tag name )
–hardware/ril/rild
–Ril Daemon ,initiates the telephony
stack of RILC and RIL, then go to
sleep forever
•RILC
–hardware/ril/libril
–Libril, a event scheduler library for
processing solicited and unsolicited
request and as a bridge between
RILJ and Vendor RIL.
•RIL
–hardware/ril/reference-ril
–Vendor library, launches the device
and processes the RIL_Request.

11. RIL daemon (rild)
•RILD internal structure
•Startup flow
•Solicited request flow
•Unsolicited request flow

12. RIL daemon startup flow
•Init read /init.rc start rild services
–service ril-daemon /system/bin/rild
– socket rild stream 660 root radio
– socket rild-debug stream 660 radio system
– user root
– group radio cache inet misc

13. RIL daemon startup flow
watch_table

14. eventLoop
Event
Name :s_wakeupfd_event
Watch Fd : s_fdWakeupRead
Persist : true
Callback :
processWakeupCallback
Extra param : null
It do nothing more than just
read s_fdWakeupRead

15. Introduction to RIL Event
timer_list
linking list
Store event related
with time
watch_table
Max Size: 8
Store event related with
fd ( socket , pipe , and
device node)

16. Introduction to RIL Event(2)
•RIL has two category event,
which corresponds to Time
and I/O event.
–Time event is put on timer_list.
–I/O event is inserted into
watch_table.
•time_list is a linked-list data
structuture
•watch_table is a array, it’s
maximal size is 8.
•All event use the same data
structure ril_event

17. Introduction to RIL Event(3)
Time event

18. Introduction to RIL Event(4)
add time event flow

19. Introduction to RIL Event(5)
I/O event

20. Introduction to RIL Event(6)
insert I/O event flow

21. Introduction to RIL Event(7)
schedule and fire event

22. ril_event_loop

23. RIL_Register
Event
Name :s_listen_event
Watch Fd : s_fdListen
Persist : false
Callback : listenCallback
Extra param : null

24. Event listenCallback
Event
Name :s_commands_event
Watch Fd : s_fdCommand
Persist : 1
Callback :
processCommandsCallback
Extra param :
RecordStream *p_rs

25. Event processCommandsCallback

26. processCommandBuffer

27. The usage of RequestInfo, CommandInfo
and UnsolResponseInfo
•In Android, RIL stack has two command table that
corresponding to solicited and unsolicited request
–Solicited Request, all the request that sent by
RILJ belong this category. For example : dial,
hung up send SMS
–Unsolicited Request, the event that coming from
outside. For example : incoming calling, MS
change BS, signal strength
•CommandInfo stores Solicited Request processing
function
–hardware\ril\libril\ril_commands.h
•UnsolResponseInfo stores Unsolicited Request
processing function
–hardware\ril\libril\ril_unsol_commands.h
•RequestInfo link multiple CommandInfo into a
linked-list

28. The structure of RequestInfo,
CommandInfo

29. dispatchDial

30. RIL onRequest Handler flow

31. mainLoop

32. readerLoop

33. Event initializeCallback

34. RIL daemon (rild)
Solicited request
flow
•RILD internal
structure
•Startup flow
•Solicited request
flow
•Unsolicited
request flow
Request Path
Response Path

35. Solicited request flow
RILC RIL Mc39i
rild
RILSender
RILReceiver
sendResponse(p);
rild
Call Setup
readerLoop
Send Dial
Event
Fire Dial event
at_send_command
Fetch next
event to fire
RILJ

36. Generalization Solicited Reqeust

37. RIL daemon (rild)
Unsolicited request
flow
•RILD internal
structure
•Startup flow
•Solicited request
flow
•Unsolicited
request flow
Response Path

38. Unsolicited request flow
RIL Mc39iRILC
readerLoop
sendResponse(p);
RILReceiver
rild
RILJ

39. Generalization Unsolicited Request

40. Summary
•Background
•RIL stack overview
•RIL daemon (rild)
•Example: RIL with Mc39i on versatile
•Example: RIL with HUAWEI E169 on
Eeepc 900
•Screenshots

41. RIL with Mc39i on versatile
•Building process
•Turn on telephony service on android

42. Building process
•pre-requirement
–Android release 1.0
–Linux Kernel 2.6.25 for
android
–Siemens Mc39i Module
•It was connected to versatile
serial port 2
–Versatile development
board

43. Building process
•Kernel configuration
–make versatile_defconfig
–make menuconfig
–Kernel Features->Use the ARM EABI ...
–Networking->Networking options->IP: DHCP
–Device Drivers->Input device support->Event interface
–Device Drivers->Real Time Clock
–Device Drivers->Android->Android power driver
–Device Drivers->Android->Android power driver lock stats

44. Building process
•Kernel modification
–arch/arm/mach-versatile/core.c
•Line 578
–val |= SYS_CLCD_MODE_565_BLSB;
•Line 611
–framesize=640*480*2*2;
–drivers/video/amba-clcd.c
•Line 370 fb->fb.fix.ypanstep = 1;
•Line 377 fb->fb.var.yres_virtual = fb->panel->mode.yres * 2;
•clcdfb_disable, directly return;
•clcdfb_enable, insert below line into the function’s head.
–static int e=0; if (en==1) return; en=1;

45. Building process
• Download android open source release 1.0
– $ mkdir mydroid
$ cd mydroid
– repo init -u
git://android.git.kernel.org/platform/manife
st.git –b release-1.0
– repo sync
• Modification for Mc39i
– hardware/ril/reference-ril/reference-
ril.c
– Function initializeCallback
• Remove line 1742
at_send_command("AT+CMOD=0",
NULL);
• Alter line line 1754
at_send_command("AT+CSCS=\" HEX\"",
NULL); 
at_send_command("AT+CSCS=\“ GSM\"",
NULL);

46. Building process
•Modification for Mc39i (cont.)
– hardware/ril/reference-ril/reference-ril.c
(mainLoop)
– Change startup code
if ( fd >= 0 &&
!memcmp( s_device_path, "/dev/tty", 8 ) )
{
struct termios ios;
tcgetattr( fd, &ios );
ios.c_lflag = 0;
cfsetispeed(&ios, B115200);
cfsetospeed(&ios, B115200);
ios.c_cflag |= CLOCAL|CREAD;
ios.c_cflag &= ~PARENB;
ios.c_cflag &= ~CSTOPB;
ios.c_cflag &= ~CSIZE;
ios.c_cflag |= CS8;
tcsetattr(fd, TCSANOW, &ios);
}

47. Building process
•Modification for Mc39i (cont.)
–hardware/ril/reference-ril/reference-
ril.c (requestOperator)
–No operator name on screen lock
•Mc39i is not supported AT+COPS=3,1
•AT+COPS=3,0 : Full Name, ex: ChungHwa
•AT+COPS=3,1 : Short Name, ex: CHT
•AT+COPS=3,2 : Location Area Identification,
ex: 46692
–Solution :
•Create a mapping table, before return from
requestOperator, assign the short name to
the Name vector.

48. Building process
•Compile android open source release 1.0
–$ cd mydroid && make
•NFS setup
–mkdir /opt/rootfs/
–cp –R out/target/product/generic/root/* /opt/rootfs
–cp –R out/target/product/generic/system/* /opt/rootfs/system
–chmod 777 /opt/rootfs/system ( to solve keymap file
problem )
–vi /etc/exports
•/opt/rootfs *(rw, no_root_squash )
–Restart NFS services

49. Building process
•Modification RIL configuration
–/opt/rootfs/system/build.prop
–rild.libargs=-d /dev/ttyS0 
rild.libargs=-d /dev/ttyAMA2
•Kernel command line
–Enter Uboot
•setenv bootargs console=ttyAMA0 mem=128M
root=/dev/nfs ip=dhcp nfsroot=“your_ip_address”:/opt/rootfs
init=/init
–Reboot versatile for into Android

50. Reference
•Android RIL porting guide
–http://www.kandroid.org/android_pdk/telephony.html
–The original document has been obsolete by
google.

51. RIL with Mc39i on versatile
•Building process
•Turn on telephony service on android

52. Turn on telephony service
•Problem : No startup wizard on android release 1.0
–The android is not active .
–Some services can not worked, ex: incoming call.
•To active the android, the device_provisioned flag must
be set by manually.
–$cd
/opt/rootfs/data/data/com.android.providers.settings/databases
–sqlite3 settings.db
–INSERT INTO system (name,value) VALUES
(‘device_provisioned’, ‘1’);
–.quit

53. flag device_provisioned usage
•device_provisioned usage in android donut
(android 2.0)
•define in class android.provider.Settings.Secure
–public static final String DEVICE_PROVISIONED =
"device_provisioned";
–framework/base/core/java/com/android/provider/
Settings.java

54. flag device_provisioned usage
•Settings.Secure.getInt(context.getContentResol
ver(), Settings.Secure.DEVICE_PROVISIONED,
0)
•Settings.Secure.getInt(cr, name, def)
Settings.Secure.getString(cr, name);
•getString()android.provider.Settings.Secure.N
ameValueCache.getString()

55. android.provider.Settings.Secure.Na
meValueCache.getString()

56. Summary
•Background
•RIL stack overview
•RIL daemon (rild)
•Example: RIL with Mc39i on versatile
•Example: RIL with HUAWEI E169 on
Eeepc 900
•Screenshots

57. RIL with E169 on Eeepc 900
•Building Process
•Surfing internet

58. Building Process
•Pre-requirement
–Asus EEE PC 900
–HUAWEI E169
–Kernel 2.6.27 for android
–Android cupcake source tree
–Source ppp-2.4.3.tar.gz
–

59. Building Process
•Download android cupcake for eeepc_701
–mkdir ./eeepc;cd eeepc
–repo init -u git://android.git.kernel.org/
platform/manifest.git –b cupcake
–repo sync
–vim .repo/local_manifest.xml
•<?xml version="1.0" encoding="UTF-8"?>
• <manifest>
• <project name="platform/vendor/asus/eee_701"
path="vendor/asus/eee_701"/>
• </manifest>
–repo sync

60. Building Process
•Kernel configuration
–Use cupcake/kernel
–Get eeepc 901 kernel config from http://pastebin.com/f26fe5376 ,.
–Make menuconfig
•EXT2 ( installer needs it to mount ramdisk )
•PPP ( choose all options )
•USB serial
–Includes USB GSM and CDMA option
•Framebuffer
–VESA VGA Driver
–drivers/rtc/alarm.c revision
•Delete #include <time.h>
•Add below code to alarm.c
•#ifdef __i386__
•static void save_time_delta(struct timespec *delta, struct timespec *rtc)
•{
set_normalized_timespec(delta,
xtime.tv_sec - rtc->tv_sec,
xtime.tv_nsec - rtc->tv_nsec);
•}
•#endif

61. Building Process
•Source tree Modification
–cd cupcake
–mv verdor/asus/eee_701/Android.mk verdor/asus/eee_701
/AndroidBoard.mk
–vi external/e2fsprogs/Android.mk
•Unmark include $(call all-subdir-makefiles)
–vi framework/base/preloaded-classes (mark below lines )
•#com.android.internal.policy.impl.PhoneLayoutInflater
•#com.android.internal.policy.impl.PhoneWindow
•#com.android.internal.policy.impl.PhoneWindow$1
•#com.android.internal.policy.impl.PhoneWindow$ContextMenuCallback
•#com.android.internal.policy.impl.PhoneWindow$DecorView
•#com.android.internal.policy.impl.PhoneWindow$PanelFeatureState
•#com.android.internal.policy.impl.PhoneWindow$PanelFeatureState$SavedStat
e
•#com.android.internal.policy.impl.PhoneWindow$PanelFeatureState$SavedStat
e$1

62. Building Process
•Source tree Modification (cont.)
–vi vendor/asus/eee_701/init.rc：
•# Define the oom_adj values for the classes of processes that can be killed by the kernel.
These are used in ActivityManagerService.
• setprop ro.FOREGROUND_APP_ADJ 0
• setprop ro.VISIBLE_APP_ADJ 1
• setprop ro.SECONDARY_SERVER_ADJ 2
• setprop ro.HOME_APP_ADJ 4
• setprop ro.HIDDEN_APP_MIN_ADJ 7
• setprop ro.CONTENT_PROVIDER_ADJ 14
• setprop ro.EMPTY_APP_ADJ 15
•# Define the memory thresholds at which the above process classes will
•# be killed. These numbers are in pages (4k).
• setprop ro.FOREGROUND_APP_MEM 1536
• setprop ro.VISIBLE_APP_MEM 2048
• setprop ro.SECONDARY_SERVER_MEM 4096
• setprop ro.HOME_APP_MEM 4096
• setprop ro.HIDDEN_APP_MEM 8192
• setprop ro.CONTENT_PROVIDER_MEM 8704
• setprop ro.EMPTY_APP_MEM 16384

63. Building Process
•Source tree Modification (cont.)
–vi bootable/diskinstaller/init.rc ：
•service installer /system/bin/installer -p
/dev/block/sdc2
–vi vendor/asus/eeepc_701/BoardConfig.mk
•add vga=788 into BOOT_KERNEL_CMDLINE
–Vi external/ppp/pppd/Android.mk
•Del first line and last line to enable pppd compiling
for x86 platform

64. Building Process
•Add ppp and chat script to source tree
–mkdir external/ppp/chat
–get chat source from ftp://ftp.samba.org/pub/ppp/ppp-2.4.3.tar.gz
–vi external/ppp/chat/Android.mk
•LOCAL_PATH:= $(call my-dir)
•include $(CLEAR_VARS)
•LOCAL_SRC_FILES:= \
• chat.c
•LOCAL_SHARED_LIBRARIES := \
• libcutils libc
•LOCAL_C_INCLUDES := \
• $(LOCAL_PATH)/include
•LOCAL_CFLAGS := -DANDROID_CHANGES -DTERMIOS -DSIGTYPE=void -
UNO_SLEEP -DFNDELAY=O_NDELAY
•LOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES)
•LOCAL_MODULE_TAGS := eng
•LOCAL_MODULE:= chat
•include $(BUILD_EXECUTABLE)

65. Building Process
•Add ppp and chat script to source tree
(cont.)
–vi system/core/rootdir/etc/ppp/ppp-startup.sh
#!/system/bin/sh
setprop net.dns1 168.95.1.1
/system/xbin/pppd –detach modem crtscts debug \
/dev/ttyUSB0 460800 noipdefault \
defaultroute usepeerdns \
connect “/etc/ppp/pppondialer”

66. Building Process
•Add ppp and chat script to source tree (cont.)
–vi system/core/rootdir/etc/ppp/pppondialer
#!/system/bin/sh
chat –v –s \
TIMEOUT 30 \
ABORT BUSY \
ABORT ERROR \
“” ‘AT’ \
OK ‘ATZ’ \
OK ‘ATQ0 V1 E1 S0=0 &C1 &C2 +FCLASS=0’ \
OK ‘AT+CGDCONT=1,”IP”,”internet”’ \  internet 為中華電信 APN
name
OK ‘AT+CSQ’ \
OK ‘ATD*99#’ \
CONNECT ‘’

67. Building Process
•Add ppp and chat script to source tree (cont.)
–vi system/core/rootdir/Android.mk
copy_from := \
etc/dbus.conf \
etc/init.goldfish.sh \
etc/hosts \
etc/ppp/ppp-startup.sh \
etc/ppp/pppondialer
–vi vendor/asus/eeepc_701/init.rc
Add “chmod 777 /etc/ppp/ppp-startup.sh”
Add “chmod 777 /etc/ppp/pppondialer ”
Add “symlink /dev/ttyUSB0 /dev/3GModem”
Add “chmod 777 /dev/3GModem”

68. Building Process
•Compile source tree and install image into
eeepc 900
–Compile source
•TARGET_ARCH=x86
TARGET_PRODUCT=eee_701
DISABLE_DEXPREOPT=true make installer_img
–Create USB installer
•dd if= out/target/product/
eee_701/installer.img of=/dev/<USB HDD>

69. I915 resolution solution
•The uvesafb denotes the userspace VESA frame
buffer driver, a generic frame buffer driver for Linux
systems. It offers more features than the original
vesafb, such as adjustable resolution and adjustable
refresh rates with VBE 3.0-compliant graphic cards.
•UvesafbHowTo
–http://www.android-x86.org/documents/uvesafbhowto
•Uvesafb project
–http://dev.gentoo.org/~spock/projects/uvesafb/

70. RIL with E169 on Eeepc 900
•Building Process
•Surfing internet

71. Surfing internet
•Insert HUAWEI E169 into Eeepc
900
•Press ALT+F1 into framebuffer
console
●
/etc/ppp/ppp-startup.sh
•Press ALT+CTRL+F7, back to
Android

72. Summary
•Background
•RIL stack overview
•RIL daemon (rild)
•Example: RIL with Mc39i on versatile
•Example: RIL with HUAWEI E169 on
Eeepc 900
•Screenshots

73. Screenshots

74. Screenshots

75. Screenshots

76. Screenshots

77. Screenshots

78. RILJ Overview
Connect to “rild”
Handle solicited and
unsolicited response
Store solicited
request that sent by
mSender
All request args.
would be stored to
Parcel object
for holding solicited
request code, EX:
REQUEST_DIAL
for sending response to
the activity that solicits this
request