How to Connect to rild Socket

Question

I'm trying to write an app to talk to the rild. And Yes, I know this is not politically correct, but it's an embedded industrial telemetry app so I'm not concerned about user experience, portability and all that stuff.

The problem is that when I try to connect, I get a java.io "Permission denied" exception. Can anybody help me?

The phone (Nexus One) is rooted with Cyanogenmod 7 and the app is running as superuser using the "SuperUser" app from Market.

My Code (abbreviated):

try {
  mSocket = new LocalSocket();
  mSockAddr = new LocalSocketAddress( "rild", LocalSocketAddress.Namespace.RESERVED );
  mSocket.connect( mSockAddr );
}
catch( Exception e ) {
  dbg.p( "connect failed: "+e );
}

I see the rild (and rild-debug) sockets in /dev/socket.

srw-rw----    1 root     radio            0 Feb 13 19:14 rild
srw-rw----    1 radio    system           0 Feb 13 19:14 rild-debug

Could it be that the Dialer app is already connected and hogging the socket?

BTW I initially tried to use the frameworks but got a humongus boatload of errors mostly about java and and third party classes unknown, so I gave up after days of hair-pulling. I've also STFW and this site - lot's of dancing around the issue but no concrete advice.

Any help greatly appreciated. -John

Barram

Answer 1

On the java end of the rild socket is an instance of com.android.internal.telephony.RIL.java, which is owned by com.android.phone.PhoneApp.java. PhoneApp is a persistent app which, not surprisingly, provides the phone functionality. Disabling PhoneApp should kill any java-side use of the rild socket.

You also might want to try connecting to "rild-debug", which is unused (but may be ignored by the ril-daemon).

BTW - You can see the comms between the RIL layers by doing logcat -b radio.

Please post back if you come up with a workaround.

Bushman

Thanks, I'll try that. BTW - I was able to get by the "permission denied" problem by "chmod 666 /dev/socket/rild". I can get no exception on connect but get no response when I send a command. I'm not sure I'm sending a valid command (having reverse engineered it). I'm sending: int DIAL (10), int seq++, String phonenum ("7035551234"), int clirmode(0), int no-uus (0), int null-uus (0). I'll report back on progress so as to be helpfult to others. – Barram

Your best bet is looking at the source for RIL.java, which defines the mapping from the java API to the messages going across the socket. – Bushman

Yeah, I tried that but it proved just too difficult because it was so layered and abstracted. But I found the real solution: I found I can connect to the "rild-debug" socket just fine, and do what I need. Thanks, John – Barram

Hello John: I am doing more or less the same thing as u asked originally, as i tried to connect to ril-debug socket and after some workaround i was able to do that: NOW my question is how to exchange data (read & write) with the rild socket via ril-debug socket in android?. All my code is in c language. I somehow vaguely know that IPC binder class in android exchanges parcels of data across the socket of rild but it happens in java and i want to be in c language. Can you please tell me how am i gonna achieve that? I can share detail information if you are willing to help. Regards – Censorious

Here's how I did it: create a LocalSocket, connect it to RILD_NAME ("rild-debug"), getOuputStream(), issue write on output stream. The commands are binary-encoded. I reverse-engineered them from hardware/ril/rild/radiooptions.c. You may also have to change the permissions on the socket to be world-writable using Runtime.getRuntime and executing "su -c chmod 666 /dev/socket/rild-debug". I'd publish the source code but it was part of a customer project. BTW - AFIK you can only write, not read. Good luck. -John – Barram

Hi John: How did you connect to localsocket in java? when i try to connect from java it gives me connection refused error. I am probably not able to provide correct path in unix socket approach to ril-debug. I am using this code: try { mSocket = new LocalSocket(); mSockAddr = new LocalSocketAddress( "rild", LocalSocketAddress.Namespace.RESERVED ); mSocket.connect( mSockAddr ); } catch( Exception e ) { dbg.p( "connect failed: "+e ); } what possible solution can you propose? I am available @ [email protected], in case you provide me with some guidance. Thanks alot... – Censorious

Code to connect to socket is given in my orig question. I suspect your problem (as was mine) has to do with permissions. Check /dev/socket/rild-debug from ADB shell with "ls -l /dev/socket/rild-debug". Socket must be writeable by world. Is your phone rooted? (you must be rooted to change permissions). – Barram

Hmmmm, I just noticed: you are trying to connect to "rild". You must connect to "rild-debug" ("rild" is in use by the telephony system and you cannot connect to it - sorry about the error in my original post). – Barram

@Barram so there isn't any way to read responce from socket? I need to send some USSD coomands and get responce. – Rothwell

I make rild-debug world-writtable by executing su -c chomod 666 /dev/socket/rild-debug , but it gives exception when calling connect method of LocaSocket . It's message is Permisson Denied . – Acrolith

Answer 2

In recent versions of Android (and, likely, in the earlier versions), rild-debug is not meant to accept a full range of commands; only predefined commands are accepted.

Check out ril.cpp here;

static void debugCallback (int fd, short flags, void *param)
...

    case 0:
        LOGI ("Connection on debug port: issuing reset.");
        issueLocalRequest(RIL_REQUEST_RESET_RADIO, NULL, 0);
        break;
    case 1:
        LOGI ("Connection on debug port: issuing radio power off.");
        data = 0;
        issueLocalRequest(RIL_REQUEST_RADIO_POWER, &data, sizeof(int));
        // Close the socket
        close(s_fdCommand);
        s_fdCommand = -1;
        break;

UPD: also, RIL requests are incrementally numbered and it's very easy to effectively break the ril/phoneapp pairing by issuing an out-of-the-series event.

Brominate

On my project, I just hacked across init scripts, hex-edited socket name in librilmtk.so and implemented a custom proxy based on Mozilla's Boot2Gecko rilproxy (had to rewrite a whole lot of socket listening code..). Also, see UPD. – Brominate

Can you please post an example about how to send USSD request via rild, having root access? – Lorenzetti

@RankoR I can't show that source right now, and 'root access' by itself actually is not mandatory - my end application can run as ordinary user. Your best hope to complete this quickly - is to target all AOSP 1-sim phones with custom libril.so (and some of MTK6575 phones, since they have RIL source available). Just rebuild the source adding one more command to libril's debug source, it's easy with AOSP (but I target newer MTK's, so had to go binary hacking + proxy way). 2-sim phones and generalized support are a problem. – Brominate

@RankoR some kind of modified libril.so accepting AT commands was available at XDA – Brominate

@RankoR also, USSD requests are solicited, meaning a) that rild will alert phone about USSD reply b) I warned in my answer that RIL requests are incrementally numbered, so you'll have to go writing proxies and filtering all ril requests anyway.. – Brominate

@RankoR I'm more a native code, than Android/Java developer, this means with your experience you can have more success by making java injection into ITelephony methods than I did. Another trick to learn, if you're a successful C++/kernel dev too, is to try droid-injectso workaround (kill existing rild, new is started, capture sockets, then do ril proxy magic on all platforms), or to write a kernel module for renaming existing socket descriptors, then again - make a proxy service – Brominate

@RankoR if you have enough will to continue, let's discuss this in Russian - I've found your profile at Habr. – Brominate

can you message me to the Habrahabr PM or Skype (wia-games) ? – Lorenzetti

@RankoR already did so, also see forum.xda-developers.com/showthread.php?t=1037075 – Brominate