MME: SGsAP-MO-CSFB-INDICATION transmitted to MSC contains no TAI nor ECGI

[pespin]

Open5GS Release, Revision, or Tag

v2.6.6

Components and subsystems

open5gs-mmed

Proposed functionality

3GPP TS 29.118 section 8.25 "SGsAP-MO-CSFB-INDICATION message" lists optional TAI and ECGI fields that can be added to the message. However, open5gs-mmed seems to be never adding those AFAIU, only the IMSI is added:

ogs_pkbuf_t *sgsap_build_mo_csfb_indication(mme_ue_t *mme_ue)
{
    mme_csmap_t *csmap = NULL;
    mme_vlr_t *vlr = NULL;
    ogs_tlv_t *root = NULL;
    ogs_pkbuf_t *pkbuf = NULL;

    ogs_assert(mme_ue);
    csmap = mme_ue->csmap;
    ogs_assert(csmap);
    vlr = csmap->vlr;
    ogs_assert(vlr);

    root = ogs_tlv_add(NULL, OGS_TLV_MODE_T1_L1, SGSAP_IE_IMSI_TYPE,
            SGSAP_IE_IMSI_LEN, 0, &mme_ue->nas_mobile_identity_imsi);

    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
    if (!pkbuf) {
        ogs_error("ogs_pkbuf_alloc() failed");
        ogs_tlv_free_all(root);
        return NULL;
    }
    ogs_pkbuf_put_u8(pkbuf, SGSAP_MO_CSFB_INDICIATION);
    ogs_pkbuf_put(pkbuf, OGS_MAX_SDU_LEN-1);

    ogs_pkbuf_trim(pkbuf, 1+ogs_tlv_render(root,
            pkbuf->data+1, OGS_MAX_SDU_LEN-1));

    ogs_tlv_free_all(root);

    return pkbuf;
}

However, the MSC needs the PLMN information inside those fields to be able to inform the MS to do fast-fallback to 4g when the call finishes, by filling in the "last used LTE PLMN ID" field. See osmo-msc code:

/* SGsAP-MO-CSFB-INDICATION, chapter 8.25 */
static int sgs_rx_csfb_ind(struct sgs_connection *sgc, struct msgb *msg, const struct tlv_parsed *tp, char *imsi)
{
	struct vlr_subscr *vsub;
	struct osmo_plmn_id last_eutran_plmn_buf;
	const struct osmo_plmn_id *last_eutran_plmn = &last_eutran_plmn_buf;

	/* The MME informs us with this message that the UE has initiated a
	 * service request for MO CS fallback. There is not much we can do with
	 * this information, however, we can check if the subscriber actually
	 * exists in the VLR and if there are any lingering connections open.*/

	vsub = vlr_subscr_find_by_imsi(gsm_network->vlr, imsi, __func__);
	if (!vsub)
		return sgs_tx_status(sgc, imsi, SGSAP_SGS_CAUSE_IMSI_UNKNOWN, msg, SGSAP_IE_IMSI);

	/* 3GPP TS 23.272 sec 4.3.3 (CSFB):
	 * "During the SGs location update procedure, obtaining the last used LTE PLMN ID via TAI"
	 */
	if (TLVP_PRES_LEN(tp, SGSAP_IE_TAI, 3)) {
		osmo_plmn_from_bcd(TLVP_VAL(tp, SGSAP_IE_TAI), &last_eutran_plmn_buf);
		/* TODO: we could also gather the TAC from here, but we don't need it yet */
	} else if (TLVP_PRES_LEN(tp, SGSAP_IE_EUTRAN_CGI, 3)) {
		/* Since TAI is optional, let's try harder getting Last Used
		 * E-UTRAN PLMN ID by fetching it from E-UTRAN CGI */
		osmo_plmn_from_bcd(TLVP_VAL(tp, SGSAP_IE_EUTRAN_CGI), &last_eutran_plmn_buf);
		/* TODO: we could also gather the ECI from here, but we don't need it yet */
	} else {
		LOGSGC(sgc, LOGL_INFO, "Receiving SGsAP-MO-CSFB-INDICATION without TAI nor "
		       "E-CGI IEs, and they are not known from previous SGsAP-LOCATION-UPDATE-REQUEST. "
		       "Fast fallback GERAN->EUTRAN won't be possible!\n");
		last_eutran_plmn = NULL;
	}

	vlr_subscr_set_last_used_eutran_plmn_id(vsub, last_eutran_plmn);

	/* Check for lingering connections */
	subscr_conn_toss(vsub);

	vlr_subscr_put(vsub, __func__);
	return 0;
} 

So ideally open5gs-mmed should fill ECGI and TAI when possible.
I add a sample pcap showing how the MME provides TAI and ECGI when registering, but those fields are not forwarded on the SGsAP-MO-CSFB-INDICATION.
csfb_no_tai_ecgi_forwarded.pcapng.gz

External dependencies

No response

[acetcom]

@pespin

I've added TAI/ECGI to the SGaAP-MO-CSFB-INDICATON message.

Thank you so mcuh for raising this issue.
Sukchan

[pespin]

@acetcom thanks! I think we can then close this ticket.