CS & IMS Call Flows

CS vs IMS: the big picture

Android supports two fundamentally different ways of carrying a voice call. A circuit-switched (CS) call reserves a dedicated channel in the 2G/3G CS domain for the whole call. An IMS call is a SIP session over an IP bearer; voice is carried as RTP packets. VoLTE (over LTE), VoNR (over 5G SA) and VoWiFi (over Wi-Fi via an ePDG tunnel) are all IMS calls; they differ only in the access network.

The one decision point

Both paths share everything above the Phone object. The fork is inside GsmCdmaPhone.dial(): if IMS is usable for this call it delegates to its child ImsPhone; otherwise it dials on CS through GsmCdmaCallTracker. If the IMS attempt fails in a way that says "retry on CS", the framework silently redials on CS (see the CS fallback section).

                         Dialer / any calling app
                                   │ TelecomManager.placeCall()
                                   ▼
                      Telecom (system_server) : CallsManager
                                   │ bind ConnectionService
                                   ▼
             TelephonyConnectionService (com.android.phone)
                                   │
                                   ▼
                          GsmCdmaPhone.dial()
                 ┌─────────────────┴─────────────────┐
     useImsForCall() == true               useImsForCall() == false
                 │                                   │
          ImsPhone.dial()                  GsmCdmaCallTracker.dial()
      ImsPhoneCallTracker                        RIL.dial()
      ImsCall / IImsCallSession            IRadioVoice.dial (HAL)
      vendor ImsService (MmTelFeature)       rild → modem CC/MM
      SIP INVITE + RTP (QCI-1)               CS SETUP → CONNECT

The shared path: Dialer to Telecom to Telephony

Every cellular call crosses these layers before the CS/IMS split. The classes are identical on MediaTek and Qualcomm because they are all AOSP.

Every class, in order

The three Binder boundaries on one dial

Note that the radio HAL runs in both directions: the framework is the Binder client for IRadioVoice requests, and the server for IRadioVoiceResponse and IRadioVoiceIndication, which the vendor calls back. See Binder & AIDL for the IPC mechanics.

Dialer (app)              Telecom (system_server)              com.android.phone
  │ placeCall() ─────────► TelecomServiceImpl
  │                        UserCallIntentProcessor → CallIntentProcessor
  │                        CallsManager.startOutgoingCall()
  │                        picks PhoneAccount (SIM slot)
  │                        Call.startCreateConnection()
  │                        ConnectionServiceWrapper ── IConnectionService ──►
  │                                                    TelephonyConnectionService
  │                                                      .onCreateOutgoingConnection()
  │                                                    new TelephonyConnection
  │                                                    GsmCdmaPhone.dial()
  │                                                      ├─ IMS usable? → ImsPhone.dial()
  │                                                      └─ else ───────→ GsmCdmaCallTracker
  │ ◄── IInCallService ─── InCallController ◄── setDialing()/setActive() ──┘
  │   onCallAdded / onStateChanged

Full-stack sequence: Dialer to modem and back to the UI

One mobile-originated (MO) CS call as it crosses every process boundary: Dialer (app) → system_server (Telecom) → phone process (com.android.phone: TelephonyConnectionService, GsmCdmaPhone, call tracker, RIL Java) → vendor rild + IRadioVoice HAL → modem. The request goes down once; everything afterwards is the modem reporting state up and the framework pushing each transition to the UI.

Dialer          system_server        com.android.phone          rild + IRadio HAL      Modem
(InCallUI)      (Telecom)            (TCS/Phone/Tracker/RILJ)   (vendor)               (baseband)
  │                 │                        │                        │                    │
  │ ① ORIGINATION (downstream)               │                        │                    │
  │ 1 placeCall() ─►│                        │                        │                    │
  │                 │ 2 CallsManager.startOutgoingCall: pick PhoneAccount, new Call        │
  │                 │ 3 createConnection() ─►│ (IConnectionService Binder)                 │
  │                 │                        │ 4 TCS.onCreateOutgoingConnection            │
  │                 │                        │ 5 GsmCdmaPhone.dial(): useImsForCall()? no  │
  │                 │                        │   GsmCdmaCallTracker.dial()                 │
  │                 │                        │   new GsmCdmaConnection (DIALING)           │
  │                 │                        │ 6 RIL.dial() ─────────►│ IRadioVoice.dial   │
  │                 │                        │                        │ 7 QMI VOICE dial / │
  │                 │                        │                        │   AT: ATD<num>; ─►│
  │ ② MODEM ACCEPTS AND REPORTS (upstream)   │                        │                    │
  │                 │                        │                        │◄─ 8 accepted       │
  │                 │                        │◄─ 9 dialResponse ──────│                    │
  │                 │                        │                        │◄─ 10 state change  │
  │                 │                        │◄─ 11 callStateChanged (UNSOL)               │
  │                 │                        │ 12 pollCalls → getCurrentCalls() ─►│        │
  │                 │                        │◄─ 13 call list [DIALING] ──────────│        │
  │                 │                        │ 14 handlePollCalls(): update connection     │
  │ ③ STATUS TO THE UI (upstream)            │                        │                    │
  │                 │◄─ 15 TelephonyConnection.setDialing() (adapter Binder)               │
  │                 │ 16 Call state = DIALING                                              │
  │◄─ 17 InCallService.onCallAdded / onStateChanged                                        │
  │ 18 UI shows "Dialing"                    │                        │                    │
  │ ④ PROGRESS: same poll + propagate cycle for every transition     │                    │
  │ ◄════ ALERTING (network sent CC ALERTING; ringback) ══════════════════════════════════│
  │ ◄════ ACTIVE   (network sent CC CONNECT; UE sends CONNECT ACK) ══════════════════════│
  │ UI shows timer / "Active"

1. Request down placeCall → Telecom → createConnection → Phone.dial() → RIL.dial() → HAL → modem. Each hop is a Binder or HAL call; only the first few are synchronous in the caller's thread.
2. Solicited response The HAL returns dialResponse matching the request serial. This only means "the modem accepted the request", not that the call connected.
3. Unsolicited indications Every call-state change arrives as IRadioVoiceIndication.callStateChanged() (legacy name RIL_UNSOL_RESPONSE_CALL_STATE_CHANGED). It carries no details, so the tracker calls getCurrentCalls() and diffs the returned DriverCall list against its connections in handlePollCalls().
4. Propagate up GsmCdmaConnection change → TelephonyConnection.setDialing()/setActive() → Telecom Call state → InCallService callbacks → UI.

How state names map across layers

At a coarser level, PhoneConstants.State (IDLE / RINGING / OFFHOOK) is what TelephonyManager.getCallState() exposes as CALL_STATE_IDLE / CALL_STATE_RINGING / CALL_STATE_OFFHOOK.

Telecom API vs Telecomm vs Telephony

Three different things in AOSP are all loosely called "telecom". Mixing them up is a classic interview stumble.

What packages/services/Telephony actually is

It builds the Phone app, com.android.phone: a persistent, headless system app (not the Dialer). It carries two concerns.

Classes in com.android.services.telephony

Dialer ─placeCall()─► Telecomm (com.android.server.telecom : CallsManager)   [system_server]
                        │  binds ConnectionService (BIND_TELECOM_CONNECTION_SERVICE)
                        ▼
packages/services/Telephony : com.android.services.telephony                  [com.android.phone]
    TelephonyConnectionService.onCreateOutgoingConnection()
        ├─ creates TelephonyConnection (wraps GsmCdmaConnection / ImsPhoneConnection)
        └─ GsmCdmaPhone.dial() ──► CallTracker ──► RIL / ImsService ──► modem / SIP
    ... state returns ...
    TelephonyConnection.setDialing()/setActive() ──► Telecomm ──► InCallService (UI)

CS mobile-originated call flow

From GsmCdmaCallTracker downwards, the CS call is a RIL request followed by standard 3GPP mobility management (MM) and call control (CC) signalling performed entirely by the modem.

AOSP classes (framework to RIL)

Framework and modem sequence

[AOSP - identical on MTK and QCOM]
GsmCdmaPhone.dialInternal()
  → GsmCdmaCallTracker.dial(number, …)
      new GsmCdmaConnection(DIALING); mForegroundCall.attach(conn)
    → mCi.dial(...)  = RIL.dial(address, clirMode, uusInfo, obtainMessage(EVENT_OPERATION_COMPLETE))
      → IRadioVoice.dial(serial, dialInfo)                 [AIDL radio HAL]
        → vendor rild

[MTK vendor path]                          [QCOM vendor path]
MTK RIL (RfxController, RmmCallReq)        qcrild (VoiceModule / qcril_qmi_voice)
  → MIPC or AT: ATD<number>;                → QMI VOICE: dial_call_req
    → MD1 modem CM/MM/RRC                      → MPSS CM/MM/RRC

[3GPP over the air - same spec for both vendors]
UE                                   Network (RAN + MSC)
 │── RRC Connection Request ────────────►│
 │◄─ RRC Connection Setup ───────────────│
 │── CM SERVICE REQUEST (MM) ───────────►│
 │◄─ AUTHENTICATION REQ / RSP, SECURITY MODE ─►│
 │── SETUP (called number, bearer cap) ─►│   CC (TS 24.008)
 │◄─ CALL PROCEEDING ────────────────────│
 │◄─ RAB / channel assignment ───────────│   traffic channel allocated
 │◄─ ALERTING ───────────────────────────│   ringback tone to caller
 │◄─ CONNECT ────────────────────────────│   callee answered
 │── CONNECT ACKNOWLEDGE ───────────────►│
 │═══════════ voice on CS bearer ════════│

[State back up]
modem state change → rild → IRadioVoiceIndication.callStateChanged()
  → GsmCdmaCallTracker.pollCallsWhenSafe() → RIL.getCurrentCalls()
    → handlePollCalls(): DriverCall DIALING → ALERTING → ACTIVE
      → GsmCdmaConnection.update() → Phone.notifyPreciseCallStateChanged()
        → TelephonyConnection.setActive()
          → Telecom → InCallService (in-call screen, timer starts)

Hang-up (CS)

1. User taps end InCallUI → InCallAdapter.disconnectCall() → Telecom → Connection.onDisconnect() → TelephonyConnection.hangup().
2. Tracker GsmCdmaCallTracker.hangup(conn) → RIL.hangupConnection(index) (or hangupForegroundResumeBackground / hangupWaitingOrBackground).
3. Air interface UE sends CC DISCONNECT → network RELEASE → UE RELEASE COMPLETE; RRC connection released.
4. Cleanup callStateChanged → poll → call missing from list → getLastCallFailCause() → GsmCdmaConnection.onDisconnect(cause) → setDisconnected(DisconnectCause) → UI shows "Call ended".

MediaTek CS vendor stack

// Typical MTK radio log markers (CS MO)
GsmCdmaCallTracker: dial
RILJ    : [0001]> DIAL                        [PHONE0]
AT> ATD+15551234567;
AT< OK
AT< +CLCC: 1,0,2,0,0,"+15551234567",145    // stat 2 = dialing
AT< +CLCC: 1,0,3,0,0,"+15551234567",145    // stat 3 = alerting
AT< +CLCC: 1,0,0,0,0,"+15551234567",145    // stat 0 = active
GsmCdmaCallTracker: onDisconnect cause=NORMAL

Qualcomm CS vendor stack

// Typical QCOM radio log markers (CS MO)
GsmCdmaCallTracker: dial
RILJ    : [0001]> DIAL                        [PHONE0]
QCRIL_VOICE: dial_call_req
QMI_VOICE: dial response result=SUCCESS
RILJ    : [UNSL]< UNSOL_RESPONSE_CALL_STATE_CHANGED
RILJ    : [0002]> GET_CURRENT_CALLS
GsmCdmaCallTracker: update phone state OFFHOOK

IMS mobile-originated call flow

For an IMS call the framework path is the same down to GsmCdmaPhone.dial(), which delegates to ImsPhone.dial(). From there the call is handed to the vendor's ImsService, which runs the SIP signalling and sets up RTP media. The CS radio HAL (IRadioVoice.dial) is not used for a VoLTE dial.

Prerequisite: IMS must be registered

Registration, AKA, SIP/SDP details and SRVCC are covered in depth in IMS & VoLTE; this page keeps only what you need for the call flow.

AOSP classes (framework to ImsService)

IMS MO sequence with the SIP ladder

[AOSP - identical on MTK and QCOM]
GsmCdmaPhone.dial()          useImsForCall() == true
  → ImsPhone.dial() → dialInternal()
    → ImsPhoneCallTracker.dial()
        new ImsPhoneConnection (DIALING); build ImsCallProfile
      → ImsManager.makeCall(profile, callees, listener)
        → MmTelFeature.createCallSession(profile)   [Binder to vendor ImsService]
        → ImsCall.start(session, number)
          → IImsCallSession.start(callee, profile)
            → vendor ImsCallSessionImpl

[VENDOR IMS stack - SIP signalling on QCI 5]
UE                        P-CSCF / S-CSCF / TAS              Remote UE
 │── INVITE (SDP offer) ─────►│──────────────────────────────►│
 │◄─ 100 Trying ──────────────│                               │
 │◄─ 183 Session Progress (SDP answer, preconditions) ────────│
 │   ... P-CSCF typically starts QCI 1 from the SDP answer (around 183, not strictly at PRACK) ...
 │── PRACK ──────────────────►│──────────────────────────────►│
 │◄─ 200 OK (PRACK) ──────────│◄──────────────────────────────│
 │── UPDATE (local preconditions met) ───────────────────────►│
 │◄─ 200 OK (UPDATE) ─────────│◄──────────────────────────────│
 │◄─ 180 Ringing ─────────────│◄──────────────────────────────│
 │◄─ 200 OK (INVITE) ─────────│◄──────────────────────────────│  callee answered
 │── ACK ────────────────────►│──────────────────────────────►│
 │═══════════ RTP / RTCP voice on QCI 1 bearer ═══════════════│

[Parallel: dedicated bearer - network initiated]
P-CSCF → PCRF (Rx) → PGW → MME → eNB → UE:
  ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST (QCI 1, TFT for RTP ports)
  (framework may see it as QosBearerSession in DataCallResponse; it does not request it)

[State back to UI]
vendor → ImsCallSessionListener.callSessionProgressing / callSessionStarted
  → ImsCall.Listener.onCallProgressing / onCallStarted
    → ImsPhoneCallTracker updates ImsPhoneConnection (ALERTING → ACTIVE)
      → TelephonyConnection.setActive() → Telecom → InCallService

Hang-up (IMS)

InCallUI end → Telecom → TelephonyConnection.hangup() → ImsPhoneCallTracker.hangup() → ImsCall.terminate(ImsReasonInfo.CODE_USER_TERMINATED) → vendor sends SIP BYE (or CANCEL if the call was still ringing and not answered) → 200 OK → the network releases the QCI 1 bearer → onCallTerminated → setDisconnected().

Vendor IMS stacks

// Typical IMS log markers (both vendors, AOSP part)
ImsPhone          : dial: IMS registered, dialing over IMS
ImsPhoneCallTracker: dial clirMode=0
ImsPhoneCallTracker: onCallInitiating
ImsPhoneCallTracker: onCallProgressing
ImsPhoneCallTracker: onCallStarted
ImsPhoneCallTracker: onCallTerminated reasonCode=501 extraMessage=...
// 501 = ImsReasonInfo.CODE_USER_TERMINATED

IMS internals: class significance and dependencies

Above the Phone object IMS looks like CS, but underneath it is a different world: a vendor ImsService hosting an MmTelFeature, reached over Binder, that runs the real SIP session. Knowing who depends on whom is what separates "knows the names" from "understands the wiring".

IMS MO internal lanes

GsmCdmaPhone      ImsPhone        ImsPhoneCallTracker     ImsCall / Session      ImsService (vendor)
     │                │                   │                       │                     │
 ① SETUP (downstream)
     │─1 delegate ───►│                   │                       │                     │
     │                │─2 dial() ────────►│ new ImsPhoneConnection│                     │
     │                │                   │ 3 build ImsCallProfile│                     │
     │                │                   │─4 ImsCall.start() ───►│                     │
     │                │                   │                       │─5 createCallSession►│
 ② VENDOR SIP + MEDIA                                                                  │
     │                │                   │                       │   6 INVITE → P-CSCF │
     │                │                   │                       │   7 183/PRACK/UPDATE│
     │                │                   │                       │     + QCI 1 bearer  │
     │                │                   │                       │   8 180 → 200 → ACK │
 ③ STATE UP (upstream)
     │                │                   │                       │◄─9 SessionListener ─│
     │                │                   │◄─10 ImsCall.Listener ─│                     │
     │                │◄─11 conn update ──│                       │                     │
 12 TelephonyConnection.setActive() → Telecom → InCallService

A. Discovery, binding and registration

B. Phone and call tracking

C. Call session and media

D. Supplementary services, emergency and errors

Dependency graph

PUBLIC API (android.telephony.ims)            FRAMEWORK (com.android.internal.telephony.imsphone)
  ImsMmTelManager / ProvisioningManager         GsmCdmaPhone ──delegates IMS dial──► ImsPhone
          │ settings, callbacks                                                        │ owns
          ▼                                                                            ▼
TELEPHONY (com.android.ims)                                                  ImsPhoneCallTracker
  ImsManager ──uses──► ImsResolver ──binds──► vendor ImsService                 │ owns      │ creates
      │                                        (MmTelFeature)                  ▼           ▼
      └──────── MmTelFeatureConnection ───────────┘                     ImsPhoneConnection  ImsCall
                                                  │ createCallSession()        │ wraps        │ over
                                                  ▼                            └─────────────►│
                                        IImsCallSession (AIDL) ◄───────────────────────────── ImsCall
                                                  │
                                        vendor ImsCallSessionImpl ──► SIP INVITE ... + RTP media
                                                  │ ImsReasonInfo on failure ──► CS fallback
                                                  ▼
       ImsCallSessionListener ─► ImsCall.Listener ─► ImsPhoneCallTracker ─► TelephonyConnection ─► Telecom ─► UI

Incoming (MT) call flow

The incoming path runs the other way: the network pages the device, the modem or ImsService reports a new call, and the state flows up to the UI. If the UE was ECM-IDLE, paging first triggers RRC setup and a NAS Service Request so the INVITE or CS SETUP can be delivered. The only later downstream hops are Telecom binding the ConnectionService to create the incoming connection, and the user pressing answer.

Network: PAGING (IMSI/TMSI) on paging channel
UE: RRC setup → PAGING RESPONSE
Network → UE: SETUP (calling number)
UE → Network: CALL CONFIRMED
modem → rild → callStateChanged (+ callRing)
GsmCdmaCallTracker.pollCalls → handlePollCalls
  new GsmCdmaConnection (INCOMING)
  GsmCdmaPhone.notifyNewRingingConnection()
PstnIncomingCallNotifier
  → TelecomManager.addNewIncomingCall()
CallsManager.processIncomingCallIntent()
  → createConnection(isIncoming)
  → TCS.onCreateIncomingConnection()
  → setRinging() → InCallService (ring UI)
UE → Network: ALERTING (while ringing)
User answers → Connection.onAnswer()
  → GsmCdmaCallTracker.acceptCall()
  → RIL.acceptCall() → IRadioVoice.acceptCall
UE → Network: CONNECT
Network → UE: CONNECT ACKNOWLEDGE → ACTIVE

Network: page UE (if idle) → RRC connected
P-CSCF → UE: SIP INVITE (SDP offer)
UE → P-CSCF: 100 Trying, 183 (SDP answer)
  QCI 1 typically starts from that SDP answer; PRACK / UPDATE follow
vendor MmTelFeature.notifyIncomingCall(session)
  → ImsPhoneCallTracker (MmTelFeature.Listener)
     onIncomingCall → ImsManager.takeCall()
  new ImsCall + ImsPhoneConnection (INCOMING)
  ImsPhone.notifyNewRingingConnection()
PstnIncomingCallNotifier
  → TelecomManager.addNewIncomingCall()
CallsManager → TCS.onCreateIncomingConnection()
  → setRinging() → InCallService (ring UI)
UE → caller: 180 Ringing
User answers → Connection.onAnswer()
  → ImsPhoneCallTracker.acceptCall()
  → ImsCall.accept() → session.accept()
UE → caller: 200 OK (INVITE)
caller → UE: ACK → RTP flows → ACTIVE

MT swimlane across processes

Dialer          system_server           com.android.phone             rild / ImsService      Modem / network
  │ ① NETWORK TO DEVICE (upstream)         │                              │                     │
  │                 │                      │                              │◄─ 1 paging / INVITE │
  │                 │                      │◄─ 2 callStateChanged / notifyIncomingCall ─────────│
  │                 │                      │ 3 tracker creates INCOMING connection              │
  │                 │                      │ 4 Phone.notifyNewRingingConnection()               │
  │                 │◄─ 5 addNewIncomingCall() (PstnIncomingCallNotifier)                        │
  │ ② TELECOM BUILDS THE CALL (downstream)  │                              │                     │
  │                 │ 6 filters: blocking, CallScreeningService, DND                              │
  │                 │── 7 createConnection(incoming) ─►│ onCreateIncomingConnection              │
  │                 │◄─ 8 setRinging() ────────────────│                              │          │
  │◄─ 9 onCallAdded │ Ringer plays ringtone, vibration                                             │
  │ ③ USER ANSWERS (downstream)             │                              │                     │
  │── 10 answerCall()►│── 11 onAnswer() ──►│ 12 acceptCall()              │                     │
  │                 │                      │── 13 IRadioVoice.acceptCall / session.accept() ───►│
  │                 │                      │                              │── 14 CONNECT / 200 OK►
  │ ④ CONNECTED (upstream)                  │                              │                     │
  │◄═══ 15 state ACTIVE → setActive() → onStateChanged → "In call" ═════════════════════════════│

Things specific to MT calls

• Call waiting An MT call while another is active appears as WAITING (CS) or a second ImsPhoneConnection in mRingingCall; Telecom shows it as a second ringing call. Answering holds the active call (CS switchWaitingOrHoldingAndActive; IMS hold re-INVITE then accept).
• Call screening and blocking Telecom runs IncomingCallFilterGraph (blocked numbers, CallScreeningService, DND) before ringing. A blocked call is rejected without ever reaching the UI.
• Reject CS: RIL.rejectCall() / hangupWaitingOrBackground → user busy cause. IMS: ImsCall.reject(CODE_USER_DECLINE) → SIP 486 Busy Here or 603 Decline depending on carrier.
• Missed MT If the caller cancels while ringing: CS disconnect, or IMS CANCEL → UE replies 487 Request Terminated; Telecom logs a missed call and MissedCallNotifier posts a notification.

Vendor markers for MT: MTK: RmmCallUrcHdlr (CS incoming, +CRING / ECPI URCs) or RmmImsUrcHdlr (IMS incoming). QCOM: QMI_VOICE all-call-status indication (CS) or the QMI IMS incoming indication via QCRIL_IMS (IMS).

CS fallback end to end, with AOSP code

"CS fallback" means two different things. Separate them clearly in an interview.

Radio CSFB ladder (MO)

UE (on LTE, no VoLTE)        eNB            MME          MSC (via SGs)
 │── EXTENDED SERVICE REQUEST (CSFB MO) ──►│              │
 │                            │◄─ UE context modify (CSFB indicator)
 │◄─ RRC Release with redirection to GERAN/UTRAN (or PS HO / CCO)
 │ ... UE tunes to 2G/3G cell, reads system info ...
 │── CM SERVICE REQUEST ─────────────────────────────────►│
 │── SETUP ──────────────────────────────────────────────►│
 │◄─ CALL PROCEEDING / ALERTING / CONNECT ────────────────│
 │ call ends → UE returns to LTE (fast return / reselection)

Typical CSFB latency cost is one to a few extra seconds of call setup. Framework only sees a normal CS dial via GsmCdmaCallTracker; the RAT change shows up in ServiceStateTracker.

The sentinel constant in Phone.java

// frameworks/opt/telephony/.../com/android/internal/telephony/Phone.java
public static final String CS_FALLBACK    = "cs_fallback";
public static final String CS_FALLBACK_SS = "cs_fallback_ss";  // supplementary-service (Ut) fallback

It is just a string carried in a CallStateException message. When the IMS layer throws it, the CS layer recognises it and retries.

Step 1: decide whether to try IMS at all, useImsForCall()

// GsmCdmaPhone.java
private boolean useImsForCall(DialArgs dialArgs) {
    return isImsUseEnabled()
            && mImsPhone != null
            && (mImsPhone.isVoiceOverCellularImsEnabled() || mImsPhone.isWifiCallingEnabled()
            || (mImsPhone.isVideoEnabled() && VideoProfile.isVideo(dialArgs.videoState)))
            && (mImsPhone.getServiceState().getState() == ServiceState.STATE_IN_SERVICE);
}

If VoLTE/VoWiFi is not enabled or IMS is out of service, IMS is never attempted and the call goes straight to CS. That is a direct CS dial, not a fallback. A related trap: on LTE-only without IMS, ServiceState.getState() (voice) can be out of service while data is in service, so useImsForCall() is false and the CS dial then fails because there is no CS domain.

Step 2: synchronous fallback, try IMS then catch CS_FALLBACK

// GsmCdmaPhone.dial(...)
if ((useImsForCall && (!isMmiCode || isPotentialUssdCode))
        || (isMmiCode && useImsForUt)
        || useImsForEmergency) {
    try {
        if (DBG) logd("Trying IMS PS call");
        chosenPhoneConsumer.accept(imsPhone);
        return imsPhone.dial(dialString, dialArgs);          // attempt over IMS
    } catch (CallStateException e) {
        // Do not throw; fall back to circuit switch for emergency calls and MMI codes.
        if (Phone.CS_FALLBACK.equals(e.getMessage()) || isEmergency) {
            logi("IMS call failed with Exception: " + e.getMessage() + ". Falling back to CS.");
        } else {
            CallStateException ce = new CallStateException(e.getError(), e.getMessage());
            ce.setStackTrace(e.getStackTrace());
            throw ce;                                        // real failure: surface it
        }
    }
}
// ... service / airplane-mode / out-of-service guards ...
if (DBG) logd("Trying (non-IMS) CS call");
chosenPhoneConsumer.accept(this);
return dialInternal(dialString, dialArgs);                   // the CS dial

Step 3: where ImsPhone throws it (USSD / MMI example)

// ImsPhone.dialInternal(...)
} else if (!mmi.isSupportedOverImsPhone()) {
    // MMI not supported by the IMS service: dial with the default (CS) phone
    logi("dialInternal: USSD not supported by IMS; fallback to CS.");
    throw new CallStateException(CS_FALLBACK);
} else {
    mPendingMMIs.add(mmi);
    mMmiRegistrants.notifyRegistrants(new AsyncResult(null, mmi, null));
    try {
        mmi.processCode();
    } catch (CallStateException cse) {
        if (CS_FALLBACK.equals(cse.getMessage())) {
            logi("dialInternal: fallback to GSM required.");
            mPendingMMIs.remove(mmi);   // let CS own it
            throw cse;                  // caught by GsmCdmaPhone.dial above
        }
    }
}

Step 4: asynchronous fallback after the IMS call started

Sometimes IMS accepts the dial, then the modem/IMS stack rejects it with a reason meaning "this must go on CS": ImsReasonInfo.CODE_LOCAL_CALL_CS_RETRY_REQUIRED.

// ImsPhoneCallTracker: reason-to-cause map
PRECISE_CAUSE_MAP.append(ImsReasonInfo.CODE_LOCAL_CALL_CS_RETRY_REQUIRED,
        CallFailCause.LOCAL_CALL_CS_RETRY_REQUIRED);

// ImsPhoneCallTracker.mImsCallListener.onCallStartFailed(...)
if (mPendingMO != null) {
    if (reasonInfo.getCode() == ImsReasonInfo.CODE_LOCAL_CALL_CS_RETRY_REQUIRED
            && mRingingCall.getState() == ImsPhoneCall.State.IDLE
            && isForegroundHigherPriority()) {
        mForegroundCall.detach(mPendingMO);
        removeConnection(mPendingMO);
        mImsCallInfoTracker.updateImsCallStatus(mPendingMO);
        mPendingMO.finalize();
        mPendingMO = null;
        // for CSFB, first hang up any lower-priority background call
        if (mBackgroundCall.getState().isAlive()) {
            try {
                hangup(mBackgroundCall);
                mPendingSilentRedialInfo = new Pair<>(reasonInfo.getExtraCode() ==
                    ImsReasonInfo.EXTRA_CODE_CALL_RETRY_EMERGENCY, eccCategory);
            } catch (CallStateException ex) { mPendingSilentRedialInfo = null; }
        } else {
            updatePhoneState();
            mPhone.initiateSilentRedial(reasonInfo.getExtraCode() ==
                    ImsReasonInfo.EXTRA_CODE_CALL_RETRY_EMERGENCY, eccCategory);
        }
        return;
    } else {
        sendCallStartFailedDisconnect(imsCall, reasonInfo);
    }
}

Step 5: initiateSilentRedial() hands the number back for a CS dial

// ImsPhone.initiateSilentRedial(...)
int cause = CallFailCause.LOCAL_CALL_CS_RETRY_REQUIRED;
AsyncResult ar = new AsyncResult(null,
        new SilentRedialParam(mLastDialString, cause, dialArgs), null);
// posted to the main thread to avoid racing with dial() that is still finishing
mContext.getMainExecutor().execute(() -> {
    logd("initiateSilentRedial: notifying registrants");
    mSilentRedialRegistrants.notifyRegistrants(ar);   // default phone redials on CS
});

The listener (in the phone process, wired up so TelephonyConnection can follow the redial) dials again on CS and swaps the originalConnection under the existing TelephonyConnection. The user never sees a failed call, only a slightly longer setup.

The reverse: CS → IMS "VoLTE silent redial"

// GsmCdmaPhone
public void notifyVolteSilentRedial(String dialString, int causeCode) {
    AsyncResult ar = new AsyncResult(null,
            new SilentRedialParam(dialString, causeCode, mDialArgs), null);
    mVolteSilentRedialRegistrants.notifyRegistrants(ar);
}

// ImsPhone.handleMessage(...)
case EVENT_INITIATE_VOLTE_SILENT_REDIAL: {
    SilentRedialParam result = (SilentRedialParam) ar.result;
    Connection cn = dial(result.dialString,
            updateDialArgsForVolteSilentRedial(result.dialArgs, result.causeCode));
    if (mDefaultPhone != null) mDefaultPhone.notifyRedialConnectionChanged(cn);
    break;
}

Modern path: the Domain Selection Service (Android 14+)

When DomainSelectionResolver.isDomainSelectionSupported() is true, the framework stops hard-coding the redial. onCallStartFailed() records the reason and disconnects; the domain selection service (for example NormalCallDomainSelector / EmergencyCallDomainSelector) decides CS vs PS using 3GPP rules, carrier config and access-network state, and drives the next attempt.

// ImsPhoneCallTracker.onCallStartFailed(...) with domain selection
if (DomainSelectionResolver.getInstance().isDomainSelectionSupported()) {
    ImsPhoneConnection conn = findConnection(imsCall);
    if (conn != null) {
        conn.setImsReasonInfo(reasonInfo);
        sendCallStartFailedDisconnect(imsCall, reasonInfo);   // service picks next domain
        mMetrics.writeOnImsCallStartFailed(mPhone.getPhoneId(), imsCall.getCallSession(), reasonInfo);
        return;
    }
}

End-to-end sequence

Telecom / TelephonyConnectionService
        │ placeCall()
        ▼
GsmCdmaPhone.dial()
    │  useImsForCall()? ──no──────────────────────────► CS dialInternal()  (direct CS, no fallback)
    │  yes
    ▼
imsPhone.dial() ──► ImsPhoneCallTracker ──► ImsService / modem
    │                                             │
    │ (A) dial-time: throws CallStateException(CS_FALLBACK)
    │       └─ caught in GsmCdmaPhone.dial ──► CS dialInternal()      redial on CS
    │
    └─ (B) runtime: onCallStartFailed(CODE_LOCAL_CALL_CS_RETRY_REQUIRED)
             └─ ImsPhone.initiateSilentRedial()
                   └─ mSilentRedialRegistrants ──► dial on CS         silent redial
                   └─ (or, with domain selection) service picks CS and redials

  CS dial on an LTE cell without VoLTE → modem performs radio CSFB (ESR → 2G/3G)

Emergency call path overview

Emergency calls reuse the same Telecom and Telephony skeleton but with special rules at almost every layer: number detection, radio power, phone selection, domain selection, network procedures and a post-call callback mode.

1. Detect TelephonyManager.isEmergencyNumber() backed by EmergencyNumberTracker, which merges numbers from the SIM, the network (NAS list via the IRadioVoiceIndication.currentEmergencyNumberList indication), the modem, the built-in database and test config. Telecom marks the call as emergency (and bypasses call redirection and some restrictions).
2. Power the radio If airplane mode or radio off, TelephonyConnectionService uses RadioOnHelper / RadioOnStateListener to power on and wait for service (or emergency-only service) with a timeout.
3. Pick a phone On multi-SIM, choose the slot most likely to succeed (in service, then limited service, SIM present, etc.). A SIM is not required: the modem camps in limited service on any network.
4. Pick a domain Carrier config and (on Android 14+) EmergencyCallDomainSelector decide IMS vs CS, and on dual-access devices LTE/NR vs Wi-Fi. The EmergencyStateTracker manages emergency mode in the modem.
5. CS emergency RIL.emergencyDial() → IRadioVoice.emergencyDial() (HAL 1.4+) → modem sends CC EMERGENCY SETUP (no called number needed; the network routes to the PSAP).
6. IMS emergency Emergency PDN/PDU session (emergency APN) + emergency registration (or unauthenticated emergency session where allowed); INVITE to urn:service:sos; P-CSCF routes to the E-CSCF → PSAP, with location from the LRF/GMLC. High ARP allows pre-emption of other bearers.
7. Fallback If the IMS attempt fails, the framework retries on CS (isEmergency in the GsmCdmaPhone.dial catch, or EXTRA_CODE_CALL_RETRY_EMERGENCY in silent redial), and may try another slot.
8. After the call Emergency Callback Mode (ECBM; ImsEcbm for IMS): for a carrier-defined window the device stays reachable for a PSAP callback and data may be restricted.

Where MediaTek and Qualcomm diverge

The Telecom and Telephony frameworks are AOSP and identical on both platforms. Divergence starts at the radio HAL server (rild), the IPC to the modem, and the ImsService / IMS stack.

Debug cheat sheet

Most call-failure investigations follow the same order: which path (CS or IMS), how far setup got, what cause code was given at that exact timestamp, and whether the modem was healthy.

Triage order

1. First check Chipset and log family; RF environment (RSRP/RSRQ, PLMN, roaming, SIM state); modem health (SSR, md1 exception, RIL serviceDied) near the event.
2. Which path? Trying IMS PS call vs Trying (non-IMS) CS call in GsmCdmaPhone; ImsPhoneCallTracker vs GsmCdmaCallTracker lines.
3. How far did setup get? Telecom created the call? RILJ > DIAL sent? SIP INVITE sent? 100/183/180 received?
4. Cause at the exact timestamp SIP response / ImsReasonInfo, CallFailCause / DisconnectCause, NAS / RRC cause.
5. Correlate Align framework, radio and modem logs by time; build a hypothesis vs evidence table before concluding.

Key log tags and markers

Commands

# Radio buffer: RILJ, trackers, IMS framework
adb logcat -b radio -v threadtime
adb logcat -b main,system,radio -v threadtime | grep -E "Telecom|TelephonyConnection|CallTracker|RILJ"

# Telecom: current calls, per-call event timeline, bound InCallServices, analytics
adb shell dumpsys telecom

# Telephony state as other apps see it: call state, service state, signal
adb shell dumpsys telephony.registry

# Phone process state, carrier config, subscriptions
adb shell dumpsys phone
adb shell dumpsys carrier_config
adb shell dumpsys isub

# IMS helpers (TelephonyShellCommand)
adb shell cmd phone ims get-ims-service
adb shell cmd phone ims enable      # or disable, for the default slot

# Place / end a call from the shell for repro
adb shell am start -a android.intent.action.CALL -d tel:5551234
adb shell input keyevent KEYCODE_ENDCALL

Common failures and what they usually mean

Useful cause-code references

Quick revision

• CS voice uses a dedicated circuit in the 2G/3G CS domain; IMS voice is a SIP session with RTP media over an IP bearer.
• VoLTE, VoNR and VoWiFi are all IMS; only the access network differs (LTE, NR SA, Wi-Fi via ePDG).
• Shared top path: Dialer → TelecomManager.placeCall() → TelecomServiceImpl → CallsManager → ConnectionServiceWrapper → TelephonyConnectionService → Phone.dial().
• Three processes: Dialer app, system_server (Telecom), com.android.phone (Telephony); plus the vendor rild and ImsService processes.
• Telecom → phone process is IConnectionService, not ITelephony; PhoneInterfaceManager is not on the dial path.
• The CS/IMS fork is GsmCdmaPhone.dial() using useImsForCall() (IMS enabled, VoLTE/WFC on, IMS in service).
• CS path: GsmCdmaCallTracker → GsmCdmaConnection → RIL.dial() → IRadioVoice.dial() → rild → modem.
• CS over the air: CM SERVICE REQUEST → SETUP → CALL PROCEEDING → ALERTING → CONNECT → CONNECT ACK; release is DISCONNECT → RELEASE → RELEASE COMPLETE.
• callStateChanged carries no details; the CS tracker polls getCurrentCalls() and diffs DriverCalls in handlePollCalls().
• dialResponse success means the modem accepted the request, not that the call connected.
• IMS path: ImsPhone → ImsPhoneCallTracker → ImsCall → IImsCallSession → vendor MmTelFeature → SIP INVITE.
• IMS MO ladder: INVITE → 100 → 183 (SDP answer) → PRACK → UPDATE → 180 → 200 OK → ACK → RTP.
• SIP rides QCI 5 / 5QI 5; voice RTP rides a network-initiated GBR QCI 1 / 5QI 1 bearer, typically started from the SDP answer around 183, not strictly at PRACK.
• Preconditions reserve the voice bearer before alerting so the callee never answers into silence.
• The VoLTE dial does not use IRadioVoice.dial; it goes through the ImsService and vendor IMS path.
• ImsResolver binds the vendor ImsService; ImsManager is the framework handle; ImsRegistrationImplBase reports registration.
• State returns via TelephonyConnection.setDialing()/setActive() → Telecom → InCallService.onCallAdded/onStateChanged.
• Telecom has no alerting state; ALERTING still shows as STATE_DIALING.
• MT: tracker creates INCOMING connection → notifyNewRingingConnection() → PstnIncomingCallNotifier → addNewIncomingCall() → Telecom → onCreateIncomingConnection() → ring UI.
• Answer: CS RIL.acceptCall() → CC CONNECT; IMS ImsCall.accept() → SIP 200 OK → ACK.
• Radio CSFB (ESR, redirect to 2G/3G) is invisible to AOSP; framework IMS → CS fallback uses Phone.CS_FALLBACK and silent redial.
• Synchronous fallback: ImsPhone throws CallStateException(CS_FALLBACK), caught in GsmCdmaPhone.dial().
• Asynchronous fallback: onCallStartFailed(CODE_LOCAL_CALL_CS_RETRY_REQUIRED) → initiateSilentRedial(), posted to the main executor.
• Android 14+ domain selection service centralises the CS vs PS choice for normal and emergency calls.
• Voice can be OOS while LTE data is in service if there is no CS domain and IMS is not registered; useImsForCall() then fails and a CS dial fails too.
• Emergency: EmergencyNumberTracker, radio-on helper, any SIM or no SIM, emergencyDial (CS EMERGENCY SETUP) or IMS urn:service:sos, then ECBM.
• MTK vs QCOM diverge only below the HAL: rild + MIPC/AT + MD1 vs qcrild + QMI + MPSS; ImsService com.mediatek.ims vs org.codeaurora.ims.
• Debug order: path, last successful step, cause at the timestamp, modem health, correlation.
• Tools: logcat -b radio, dumpsys telecom, dumpsys telephony.registry, QXDM/QCAT or ELT, Wireshark for SIP/RTP.
• SIP error + healthy modem means IMS/operator layer; RADIO_NOT_AVAILABLE after serviceDied means the HAL or modem went away.

Glossary

ACK (SIP)

Final message confirming a 200 OK to an INVITE; after it, media flows.

ALERTING

CC message (and call state) meaning the called party is being rung; the caller hears ringback.

CallFailCause

Telephony class holding modem / 3GPP 24.008 call failure codes returned by getLastCallFailCause().

CallsManager

The core of Telecom in system_server; creates and tracks every Call, arbitrates between calls and accounts.

CC (Call Control)

3GPP TS 24.008 protocol for CS calls: SETUP, CALL PROCEEDING, ALERTING, CONNECT, DISCONNECT, RELEASE.

CONNECT

CC message meaning the call was answered; the receiver replies CONNECT ACKNOWLEDGE.

ConnectionService

android.telecom service a calling stack implements so Telecom can create and control its calls; Telephony's is TelephonyConnectionService.

CS (circuit-switched)

Voice carried on a dedicated channel reserved for the whole call (GSM/UMTS domain).

CS_FALLBACK

Sentinel string in Phone.java thrown in a CallStateException to tell GsmCdmaPhone to redial on CS.

CSFB

CS Fallback: 3GPP procedure moving an LTE UE without VoLTE to 2G/3G for a voice call via EXTENDED SERVICE REQUEST.

Dedicated bearer

Extra bearer with specific QoS (e.g. QCI 1 GBR for voice), activated by the network for a flow defined by a TFT.

DisconnectCause

Reason a call ended; android.telephony.DisconnectCause internally, mapped to android.telecom.DisconnectCause for the UI.

Domain selection

Android 14+ service deciding whether a call goes over CS or PS (IMS), and over which access.

DriverCall

The modem's description of one call (index, state, number) returned by getCurrentCalls().

ECBM

Emergency Callback Mode: a period after an emergency call when the device stays reachable for a PSAP callback.

EmergencyNumberTracker

Telephony component merging emergency numbers from SIM, network, modem and database.

ESR

EXTENDED SERVICE REQUEST, the NAS message an LTE UE sends to trigger CSFB.

GsmCdmaCallTracker

CS call state machine; talks to the RIL and owns CS connections and calls.

GsmCdmaPhone

Main Phone implementation per SIM slot; the place where CS vs IMS is decided.

IConnectionService

Binder interface Telecom uses to talk to a ConnectionService in another process.

ImsCall

Framework object representing one IMS call session over an IImsCallSession.

ImsCallProfile

Attributes of an IMS call: service type, call type (voice/video), media profile, extras.

ImsPhone

IMS "shadow" phone owned by GsmCdmaPhone; entry point for IMS calls and silent redial.

ImsPhoneCallTracker

IMS call state machine; builds profiles, starts ImsCalls, handles start failures.

ImsReasonInfo

Code and extra info explaining why an IMS call failed or ended.

ImsResolver

Phone-process component that finds and binds the vendor ImsService for each slot and feature.

ImsService

Vendor APK implementing AOSP's IMS API; hosts MmTelFeature and runs or drives the SIP stack.

InCallService

android.telecom service bound by Telecom to show and control calls; the Dialer's in-call UI implements it.

IRadioVoice

AIDL radio HAL interface for voice requests (dial, accept, hangup, getCurrentCalls, emergencyDial).

MmTelFeature

ImsService feature for multimedia telephony: creates call sessions, reports capabilities, notifies incoming calls.

MO / MT

Mobile-originated (outgoing) and mobile-terminated (incoming) calls.

Paging

Network broadcast asking an idle UE to connect because there is an incoming call or data.

PhoneAccount

Telecom record describing a calling account (a SIM or a VoIP app) and the ConnectionService that serves it.

Preconditions

SIP mechanism (183 with SDP answer / PRACK / UPDATE) that reserves network resources before the callee is alerted. The dedicated voice bearer is usually triggered from the SDP answer, not from PRACK itself.

PstnIncomingCallNotifier

Phone-process class that reports new ringing connections to Telecom via addNewIncomingCall().

QCI 1 / 5QI 1

GBR QoS class for conversational voice on LTE / NR; QCI 5 / 5QI 5 is for IMS signalling.

RIL / RILJ

Radio Interface Layer; RIL.java (log tag RILJ) is the framework client of the radio HAL.

rild

Vendor radio daemon implementing the radio HAL and talking to the modem (MTK rild, Qualcomm qcrild).

SETUP

CC message that starts a CS call; carries the called number and bearer capability.

Silent redial

Automatic redial on the other domain (IMS to CS or CS to IMS) without the user seeing a failed call.

SIP INVITE

SIP request that starts a session; carries the SDP offer for media.

SRVCC

Single Radio Voice Call Continuity: hands an active IMS call to CS when leaving VoLTE coverage.

TelecomServiceImpl

system_server implementation of ITelecomService, behind TelecomManager.

TelephonyConnection

Telecom Connection subclass wrapping an internal telephony connection and mapping its state.

TelephonyConnectionService

Telephony's ConnectionService in com.android.phone; creates cellular connections and calls Phone.dial().

useImsForCall()

GsmCdmaPhone check deciding whether to attempt the call over IMS.

Interview questions