Understanding the MTK GSM mux daemon

Created by: E3V3A

If we wanna play with RIL and rild on any device, we need to better understand how to use the MUX as part of the AP-BP communication of AOS. In this case we'll discuss the use of the MTK specific (?) binary: /system/bin/gsm0710muxd and what it is used for. The documentation related to this binary (as it's name suggests) are found in the 3GPP document:

3GPP ETSI TS 101 369 (aka. TS 07.10 v7.2.0) "Terminal Equipment to Mobile Station (TE-MS) multiplexer protocol"

In summary:

The 07.10 multiplexer protocol operates between an MS and a TE and allows a number of simultaneous sessions over a normal serial asynchronous interface. Each session consists of a stream of bytes transferring various kinds of data; for instance, voice, fax, data, SMS, CBS, phonebook maintenance, battery status, GPRS, USSD etc. This permits, for example, SMS and CBS to be transferred to a TE when a data connection is in progress. Many other combinations are possible including digital voice. It is, for instance, possible to transfer digital voice in combination with SMS. The multiplexer allows a complete system to be partitioned in a flexible way between a MS and TE. ... The multiplexer is based on a control channel. On this channel, management information is exchanged, such as parameter negotiation, power saving control information, testing, flow control, close down etc. The multiplexer is optional, but when supported, it is activated with the 07.07 AT+CMUX command. ... Each channel between TE and MS is called a Data Link Connection (DLC) and is established separately and sequentially. Each DLC may have individual flow control procedures for buffer management purposes and the aggregate link also has overall flow control mechanisms. ... The multiplexer has three operating options, basic, advanced without error recovery and advanced with error recovery.

How is this of interest to us? It is not really, but on some MTK devices the ATCoP interface locks up in a weird state, where every character is echoed to radio logcat. This is probably due to not properly closing down the MUX connection after use. Killing the process, resolves the issue, but not the cause. So one possible solution is to use the AT+CMUX= (TBD) command to close the channel. This need testing.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.