requestNetworkScan - returns invalid cell identity - Android P

Question

I'm developing a privileged system app to scan the network. After executing the API, the results does not contain a valid cell identity information. All values return either as 0, null or max int.

Granted relevant system privileged permissions.

An extract of the code:

public class ScannerActivity extends Activity implements View.OnClickListener {

     private final int PHONE_STATE_REQUEST = 1;
     private Button scanButton;
     private TextView resultsTextView;

     private class RadioCallback extends TelephonyScanManager.NetworkScanCallback {
     private List<CellInfo> mCellInfoResults;
     private int mScanError;

     @Override
     public void onResults(List<CellInfo> cellInfoResults) {
     mCellInfoResults = cellInfoResults;
     ScannerActivity.this.runOnUiThread(new Runnable() {
           @Override
           public void run() {
               for (CellInfo cellInfo:mCellInfoResults) {
                   resultsTextView.append(" " + cellInfo.toString() + " ");
               }
           }
       });
    }


     @Override
     public void onError(int error) {
          mScanError = error;
          ScannerActivity.this.runOnUiThread(new Runnable() {
               @Override
               public void run() {
                    resultsTextView.append(" Error: " + mScanError);
               }
          });
     }

     @Override
     public void onComplete() {
          ScannerActivity.this.runOnUiThread(new Runnable() {
              @Override
              public void run() {
                  resultsTextView.append(" Scan Completed! ");
             }
         });
     }

   }

      @Override
      protected void onCreate(Bundle savedInstanceState) {
           super.onCreate(savedInstanceState);
           setContentView(R.layout.activity_scanner);

          scanButton = (Button) findViewById(R.id.scan_button);
          scanButton.setOnClickListener(this);
          resultsTextView = (TextView)  findViewById(R.id.results_text_view);
     }



      public void onClick(View view) {

          NetworkScanRequest networkScanRequest;
          RadioAccessSpecifier radioAccessSpecifiers[];


     TelephonyManager telephonyManager = (TelephonyManager) getApplicationContext()
        .getSystemService(Context.TELEPHONY_SERVICE);

    radioAccessSpecifiers = new RadioAccessSpecifier[1];
    radioAccessSpecifiers[0] = new RadioAccessSpecifier(
        AccessNetworkConstants.AccessNetworkType.UTRAN,
        null,
        null);

         networkScanRequest = new NetworkScanRequest(
             NetworkScanRequest.SCAN_TYPE_ONE_SHOT,
             radioAccessSpecifiers,
             30,
             300,
             true,
             3,
             null);

      telephonyManager.requestNetworkScan(networkScanRequest,     AsyncTask.SERIAL_EXECUTOR,new RadioCallback());
 }

Any idea why this happens? Tried on Pixel 2.

score 0 · Answer 1 · answered Dec 04 '18 at 12:06

You can check if radio layer has provided a valid cell identity info in response to your requestNetworkScan or not. Get radio log by cmd "adb logcat -v time -b radio" and check any occurrence of UNSOL_NETWORK_SCAN_RESULT API in this log. Below is the description of this unsolicited response.

/**
 * RIL_UNSOL_NETWORK_SCAN_RESULT
 *
 * Returns incremental result for the network scan which is started by
 * RIL_REQUEST_START_NETWORK_SCAN, sent to report results, status, or errors.
 *
 * "data" is NULL
 * "response" is a const RIL_NetworkScanResult *
 */
#define RIL_UNSOL_NETWORK_SCAN_RESULT 1049

Response struct RIL_NetworkScanResult has below fields:

typedef struct {
    RIL_ScanStatus status;              // The status of the scan
    uint32_t network_infos_length;      // Total length of RIL_CellInfo
    RIL_CellInfo_v12* network_infos;    // List of network information
    RIL_Errno error;
} RIL_NetworkScanResult;

If this UNSOL_NETWORK_SCAN_RESULT response is either returning NULL struct or no UNSOL_NETWORK_SCAN_RESULT response at all then probably radio HAL is not supporting this API.

score 0 · Answer 2 · answered Feb 06 '19 at 13:36

The requestNetworkScan has similar functionality to the getAvailableNetworks. These functions are doing high-level network scans to find nearby carriers. The modem is only looking for a set of unique PLMNs (i.e. a carrier identifier) and doesn't dwell on the cells long enough to find more detailed information such as the cell identity.

The RIL should be able to return some basic information about the cell such as the frequency channel (ARFCN for GSM, UARFCN for UMTS, and EARFCN for LTE) and a physical cell identity (BSIC for GSM, PSC for UMTS, PCI for LTE) but it doesn't seem to return any valid information for those values currently.

requestNetworkScan - returns invalid cell identity - Android P

2 Answers2