REPRODUCIBILITY: 100%
OS VERSION: 5.0.0.77 (Tampella)
HARDWARE: Sony Xperia 10 II - Dual SIM (xqau52)
UI LANGUAGE: CS
REGRESSION: no (I guess?)
DESCRIPTION:
In my work we switched to incident management system PagerDuty.com . Soon after that I discovered that my phone is unable receive calls from its automata used for reporting incidents! I was able to track it down as problem with VoLTE. Is is 100% reproducible with PagerDuty phone number (at least with the Czech one). Not sure why this one is so special. I had no such issues for two years with Sailfish OS.
PRECONDITIONS:
- VoLTE is enabled and registered
- Configured PagerDuty notifications with calling to phone
STEPS TO REPRODUCE:
- Create test incident in PagerDuty. Or just break production system. Or wait few moments, it is broken anyway
EXPECTED RESULT:
- PagerDuty automata is able to call me and tell me what happened
ACTUAL RESULT:
- Nothing from user PoV. No notification, no sound, no call UI… But on the background bad things happen. See additional informations
MODIFICATIONS:
nothing related to modem stack
ADDITIONAL INFORMATION:
Disclaimer: Following investigation was done using Claude Code with LLM models. It may contain misleading information.
Ofono logs:
...
dub 07 12:38:44 Xperia10II ofonod[1343]: [gbinder-radio] WARNING! /dev/hwbinder:slot1:2:-1 died
dub 07 12:38:44 Xperia10II ofonod[1343]: slot1 binder service died
dub 07 12:38:44 Xperia10II ofonod[1343]: Deactivating context: 1
dub 07 12:38:44 Xperia10II ofonod[1343]: SMS History remove for modem: 0x10bb4b60
dub 07 12:38:44 Xperia10II dbus-daemon[1147]: [system] Rejected send message, 2 matched rules; type="method_return", sender=":1.145" (uid=100000 pid=4205 comm="/usr/libexec/telepathy-ring" label="u:r:kernel:s0") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.13" (uid=0 pid=1343 comm="/usr/sbin/ofonod -n --nobacktrace --noplugin=,he91" label="u:r:kernel:s0")
dub 07 12:38:44 Xperia10II dbus-daemon[1147]: dbus-daemon[1147]: [system] Rejected send message, 2 matched rules; type="method_return", sender=":1.145" (uid=100000 pid=4205 comm="/usr/libexec/telepathy-ring" label="u:r:kernel:s0") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.13" (uid=0 pid=1343 comm="/usr/sbin/ofonod -n --nobacktrace --noplugin=,he91" label="u:r:kernel:s0")
dub 07 12:38:44 Xperia10II connmand[2762]: [ofono] ERROR! Operation was cancelled
...
Claude said:
Critical Issue
Line 3-4: RIL binder service died for slot1
The radio interface layer (RIL) binder for SIM slot 1 crashed (/dev/hwbinder:slot1:2:-1 died). This is the main event — everything else cascades from it.
...
This could be caused by:
- The Android radio HAL crashing (check logcat for android.hardware.radio crashes around 12:38:44)
- A kernel/firmware issue with the modem
- Resource pressure (OOM killer, etc.)
output of /usr/libexec/droid-hybris/system/bin/logcat:
04-07 12:09:00.373 1648 1648 I /system/bin/tombstoned: received crash request for pid 1857
04-07 12:09:00.375 16158 16158 I crash_dump64: performing dump of process 1760 (target tid = 1857)
...
backtrace:
#00 pc 00000000000821a0 /apex/com.android.runtime/lib64/bionic/libc.so (abort+176) (BuildId: 99d256d401014e290f38edaacced78da)
#01 pc 000000000000bc3c /system/lib64/vndk-sp-29/libbase.so (android::base::DefaultAborter(char const*)+12) (BuildId: bf429c7208647ec333618df65d42e6ad)
#02 pc 000000000000c650 /system/lib64/vndk-sp-29/libbase.so (android::base::LogMessage::~LogMessage()+608) (BuildId: bf429c7208647ec333618df65d42e6ad)
#03 pc 00000000000434e4 /system/lib64/vndk-sp-29/libhidlbase.so (android::hardware::hidl_string::setToExternal(char const*, unsigned long)+348) (BuildId: c74f72030b9fb95b4e1c8512526aae5d)
#04 pc 0000000001a5b8a0 /odm/lib64/libril-qc-hal-qmi.so (vendor::qti::hardware::radio::ims::V1_0::utils::convertCallV13ToV12(vendor::qti::hardware::radio::ims::V1_3::CallInfo&, vendor::qti::hardware::radio::ims::V1_2::CallInfo&)+1664) (BuildId: edecd365a644311f6c0aba4f76054bfb)
#05 pc 0000000001a5ad20 /odm/lib64/libril-qc-hal-qmi.so (vendor::qti::hardware::radio::ims::V1_0::utils::convertCallListV13ToV12(android::hardware::hidl_vec<vendor::qti::hardware::radio::ims::V1_3::CallInfo>&, android::hardware::hidl_vec<vendor::qti::hardware::radio::ims::V1_2::CallInfo>&)+488) (BuildId: edecd365a644311f6c0aba4f76054bfb)
...
Claude said:
The detailed ofono.log from the diagnostic dump captures a binder death at 14:29:59 (a later occurrence, same issue). The sequence:
1. IMS ring indication arrives (incoming VoLTE call, 14:29:57)
2. Binder death 2 seconds later (14:29:59) — qcrild crashes processing the call state
3. Full modem teardown: data dropped, SIM unregistered, IMS lost
4. Recovery: HAL restarts in ~300ms, modem online by 14:30:10, data restored by 14:30:27, IMS by 14:30:29
5. Total outage: ~28 seconds for data, ~32 seconds for VoLTE
Additional findings from the diagnostic dump
- Device: Sony Xperia 10 II Dual SIM (xqau52), Qualcomm Snapdragon 665 ("nicobar")
- OS: Sailfish OS 5.0.0.77 (Tampella)
- Packages: ofono 1.29+git12, ofono-binder-plugin 1.1.24, libgbinder-radio 1.6.0
- Network: Vodafone CZ, LTE, signal -84 to -90 dBm (marginal)
- SIM: Only slot1 active, slot2 empty
- ModemManager stats: binder-death count = 1 at dump time
- IMS error:999 (vendor-specific) during re-registration after crash
- Facility lock query failures (INVALID_ARGUMENTS) — minor, likely firmware quirk
- EF_ECC structure mismatch (6fb7) — stale cache after restart
The problem is NOT in Sailfish/ofono
The crash is in Qualcomm's proprietary vendor RIL (libril-qc-hal-qmi.so), specifically in the IMS call state serialization code. oFono's binder plugin handles the death notification and recovery correctly — the ~28s outage is the expected recovery time.
This is triggered by incoming VoLTE calls. The modem hardware stays online throughout; it's the userspace HAL that keeps dying.
Possible workarounds
1. Disable VoLTE — switch to CS (circuit-switched) voice calls. This avoids the IMS call path and the buggy convertCallV13ToV12() entirely. In Sailfish: Settings > Mobile network > VoLTE (if toggle is available), or via ofono D-Bus to disable IMS.
2. Check for a newer Android vendor image — the bug is in /odm/lib64/libril-qc-hal-qmi.so from the vendor partition. A newer Sony vendor image (adaptation version > 1.0.0.50) might have a patched Qualcomm RIL.
3. Report to Jolla with this logcat + tombstone (/data/tombstones/tombstone_09 and tombstone_00) — they may be able to push a workaround in the ofono-binder-plugin or escalate to Sony/Qualcomm.
I tried various vendor images from Sony, but with the versions “11” (SW_binaries_for_Xperia_Android_11_4.14_*), Sailfish was unable to initialize WiFi and modem 
So I revert it to the recommended one SW_binaries_for_Xperia_Android_10.0.7.1_r1_v12b_seine.zip
volte-logs.targz (146.3 KB)