部分移动卡无人接听时呼叫转移失败问题分析

1 背景

平台：高通865（SM8250）
版本：Android R
运营商：中国移动

2 现象

部分移动卡设置无人接听时呼叫转移提示 “出现连接问题或 MMI 码无效”

3 Log分析

AP侧Log提示error

07-29 19:02:35.696 2791 2823 I QImsService: ImsSenderRxr : [0333]> REQUEST_SET_CALL_FORWARD_STATUS [SUB0]
07-29 19:02:36.880 2791 2867 I QImsService: IFRequest : [0333]< REQUEST_SET_CALL_FORWARD_STATUS error: 2
07-29 19:02:36.909 2929 2929 D ImsPhone: [0] getCommandException code= 0, errorString= 出现连接问题或 MMI 码无效。(0)
07-29 19:02:36.925 2929 2929 D RILJ : [7291]> QUERY_CALL_FORWARD_STATUS cfreason = 2 serviceClass = 1 [PHONE0]
07-29 19:03:06.767 2929 3007 D RILJ : [7291]< QUERY_CALL_FORWARD_STATUS error 40 [PHONE0]
07-29 19:03:06.768 2929 3007 D RilRequest: [7291]< QUERY_CALL_FORWARD_STATUS error: com.android.internal.telephony.CommandException: MODEM_ERR ret={}
1
2
3
4
5
6

Modem侧上报QMI_FAILURE_CAUSE_SYSTEM_FAILURE，sip_error_code = 403

2021 Jul 29 11:02:35.660 [A9] 0x1544 QMI_MCS_QCSI_PKT
packetVersion = 2
MsgType = Response
Counter = 240
ServiceId = VOICE
MajorRev = 2
MinorRev = 124
ConHandle = 0x00000060
MsgId = 0x00000033
QmiLength = 17
Service_VOICE {
ServiceVOICEV2 {
voice_set_sups_service {
voice_set_sups_service_respTlvs[0] {
Type = 0x02
Length = 4
resp {
result = QMI_RESULT_FAILURE
error = QMI_ERR_SUPS_FAILURE_CAUSE}}
voice_set_sups_service_respTlvs[1] {
Type = 0x10
Length = 2
failure_cause {
failure_cause = QMI_FAILURE_CAUSE_SYSTEM_FAILURE}}
voice_set_sups_service_respTlvs[2] {
Type = 0x18
Length = 2
sip_error_code {
sip_error_code = 403}}}}}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

systemFailure在代码中的定义

/** 
 * System failure.
 */
#define   systemFailure                0x22 	// （十进制 34）
位置：Cm_gw.h (mmcp\api\public)
1
2
3
4
5

Refer to 3GPP 24.080的systemFailure说明

4.3.2.9 systemFailure
This error is returned by the network, when it cannot perform an operation because of a failure in the network.
1
2

SIP Error Code 403，即禁止

403 Forbidden
1

继续modem侧分析

// 设置
11:02:34.505869 [0x1544] QMI_MCS_QCSI_PKT
MsgType = Request
voice_set_sups_service {
voice_service = VOICE_SERVICE_REGISTER
reason = VOICE_REASON_FWD_NOREPLY
service_class = 1
number = 189xxxxxxxx
timer_value = 20

// IMS Error
11:02:35.658665 IMS/Verbose/Medium/OTHER [IMSSupplementaryService.cpp 3281] HandleSpecificErrorCodes - Block Ut

// error code: 34
11:02:35.659356 MMODE/STRM/High/CM [ cmipsups.c 790] cmipsups_common_conf_proc: retry duration: 0 , error code: 34, error tag : 2 asub_id 0 is_ext_resp = 0 err_present 1

// 网络侧拒绝了timer_value = 20的设置请求
// 向网络请求
2021 Aug 2 08:27:10.502 [A6] 0x19FA IMS HTTP Message
Direction = UE_TO_NETWORK
HTTP Message = PUT ...
Content-Length: 1062
Content-Type: application/xcap-el+xml
X-3GPP-Intended-Identity: "sip:+86139xxxxxxxx@gd.ims.mnc000.mcc460.3gppnetwork.org"
User-Agent: 3gpp-gba
Authorization: Digest username="..."
Host: xcap.ims.mnc000.mcc460.pub.3gppnetwork.org:80
Connection: Keep-Alive

20 =========> timer_value = 20

// 网络回应
2021 Aug 2 08:27:10.952 [7B] 0x19FA IMS HTTP Message
Direction = NETWORK_TO_UE
HTTP Message = HTTP/1.1 403 Forbidden =========>NW didn't set NoReplyTimer

// 对比机OK的情况
// 分析得知timer_value = 0
2021 Aug 10 09:45:15.383 [44] 0x19FA IMS HTTP Message
Direction = NETWORK_TO_UE
HTTP Message = HTTP/1.1 200 OK
0 =========>NW set NoReplyTimer
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

4 分析结论

最后，用出问题的机器和SIM卡通过手动设置MMI码之后测试，即设置timer_value = 0之后OK。

说明一下：
该SIM卡用对比机设置timer_value = 20之后也会fail。

MMI码命令：

**61*Num**Time#
1

示例，拨号盘输入命令，然后拨号即可

**61*10086**20#
1

到这里，情况就比较明了了，即：
当timer_value = 20，网络侧拒绝设置；
当timer_value = 0，网络侧允许设置。

注意
这里如果timer_value ≠ 0，全都会失败。

5 修改方法

AP侧查看设置timeSec的Log

08-02 17:13:46.728 2864 2864 D CallForwardEditPreference: callForwardInfo=[CallForwardInfo: status= active , reason= 2, serviceClass= 1, timeSec= 20 seconds, number=[xxx]]
1

通过AP侧的Log打印，定位到CallForwardEditPreference.java的onDialogClosed()中：

int time = 0;
if (reason == CommandsInterface.CF_REASON_NO_REPLY) {
    PersistableBundle carrierConfig = PhoneGlobals.getInstance()
            .getCarrierConfigForSubId(mPhone.getSubId());
    if (carrierConfig.getBoolean(
            CarrierConfigManager.KEY_SUPPORT_NO_REPLY_TIMER_FOR_CFNRY_BOOL, true)) {
        time = 20;
    }
}
1
2
3
4
5
6
7
8
9

在time = 20之前有个判断，即KEY_SUPPORT_NO_REPLY_TIMER_FOR_CFNRY_BOOL，
最后，在移动的运营商配置中，把它设置为false即可。

设置后，time会使用默认值0，之后这类SIM卡就不会再出现这个问题。

以上陋解，多多指教~
转载请注明出处，谢谢~