Lava can be used to do functional tests on real hardware
The OsmoGSMTester project is able to be interfaced with the Android RIL through ofono and can emulate a GSM network with the help of a GSM base station or a compatible SDR.
The Simtrace 2 project can be used, along with SIM card readers to programmatically feed a SIM card to a smartphone