diff --git a/include/osmocom/msc/Makefile.am b/include/osmocom/msc/Makefile.am
index 13ac166..408d710 100644
--- a/include/osmocom/msc/Makefile.am
+++ b/include/osmocom/msc/Makefile.am
@@ -23,11 +23,15 @@
 	a_reset.h \
 	ran_conn.h \
 	rrlp.h \
+	sgs_iface.h \
+	sgs_server.h \
+	sgs_vty.h \
 	signal.h \
 	silent_call.h \
 	smpp.h \
 	sms_queue.h \
 	transaction.h \
 	vlr.h \
+	vlr_sgs.h \
 	vty.h \
 	$(NULL)
diff --git a/include/osmocom/msc/debug.h b/include/osmocom/msc/debug.h
index 717cf74..28ba482 100644
--- a/include/osmocom/msc/debug.h
+++ b/include/osmocom/msc/debug.h
@@ -21,5 +21,6 @@
 	DVLR,
 	DIUCS,
 	DBSSAP,
+	DSGS,
 	Debug_LastEntry,
 };
diff --git a/include/osmocom/msc/gsm_04_08.h b/include/osmocom/msc/gsm_04_08.h
index 5ff16de..2d4a0cd 100644
--- a/include/osmocom/msc/gsm_04_08.h
+++ b/include/osmocom/msc/gsm_04_08.h
@@ -77,5 +77,6 @@
 
 int gsm48_tch_rtp_create(struct gsm_trans *trans);
 int gsm48_conn_sendmsg(struct msgb *msg, struct ran_conn *conn, struct gsm_trans *trans);
+struct msgb *gsm48_create_mm_info(struct gsm_network *net);
 
 #endif
diff --git a/include/osmocom/msc/gsm_subscriber.h b/include/osmocom/msc/gsm_subscriber.h
index 2051067..f848ac8 100644
--- a/include/osmocom/msc/gsm_subscriber.h
+++ b/include/osmocom/msc/gsm_subscriber.h
@@ -5,6 +5,7 @@
 
 #include <osmocom/core/linuxlist.h>
 #include <osmocom/gsm/protocol/gsm_23_003.h>
+#include <osmocom/gsm/protocol/gsm_29_118.h>
 
 #include <osmocom/msc/gsm_data.h>
 
@@ -36,8 +37,8 @@
  */
 struct subscr_request *subscr_request_conn(struct vlr_subscr *vsub,
 					   gsm_cbfn *cbfn, void *param,
-					   const char *label);
-
+					   const char *label,
+					   enum sgsap_service_ind serv_ind);
 void subscr_remove_request(struct subscr_request *req);
 
 void subscr_paging_cancel(struct vlr_subscr *vsub, enum gsm_paging_event event);
diff --git a/include/osmocom/msc/ran_conn.h b/include/osmocom/msc/ran_conn.h
index affebc8..fca7ab6 100644
--- a/include/osmocom/msc/ran_conn.h
+++ b/include/osmocom/msc/ran_conn.h
@@ -208,6 +208,7 @@
 
 void ran_conn_rx_bssmap_clear_complete(struct ran_conn *conn);
 void ran_conn_rx_iu_release_complete(struct ran_conn *conn);
+void ran_conn_sgs_release_sent(struct ran_conn *conn);
 
 enum ran_conn_use {
 	RAN_CONN_USE_UNTRACKED = -1,
diff --git a/include/osmocom/msc/sgs_iface.h b/include/osmocom/msc/sgs_iface.h
new file mode 100644
index 0000000..a167cd6
--- /dev/null
+++ b/include/osmocom/msc/sgs_iface.h
@@ -0,0 +1,87 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+#include <osmocom/gsm/protocol/gsm_23_003.h>
+#include <osmocom/gsm/protocol/gsm_29_118.h>
+#include <osmocom/msc/vlr.h>
+#include <osmocom/msc/vlr_sgs.h>
+#include <osmocom/core/socket.h>
+
+static const unsigned int sgs_state_timer_defaults[_NUM_SGS_STATE_TIMERS] = {
+	[SGS_STATE_TS5] = SGS_TS5_DEFAULT,
+	[SGS_STATE_TS6_2] = SGS_TS6_2_DEFAULT,
+	[SGS_STATE_TS7] = SGS_TS7_DEFAULT,
+	[SGS_STATE_TS11] = SGS_TS11_DEFAULT,
+	[SGS_STATE_TS14] = SGS_TS14_DEFAULT,
+	[SGS_STATE_TS15] = SGS_TS15_DEFAULT,
+};
+
+static const unsigned int sgs_state_counter_defaults[_NUM_SGS_STATE_COUNTERS] = {
+	[SGS_STATE_NS7] = SGS_NS7_DEFAULT,
+	[SGS_STATE_NS11] = SGS_NS11_DEFAULT,
+};
+
+struct sgs_connection {
+	/* global list of SGs connections */
+	struct llist_head entry;
+
+	/* back-pointer */
+	struct sgs_state *sgs;
+
+	/* Socket name from osmo_sock_get_name() */
+	char sockname[OSMO_SOCK_NAME_MAXLEN];
+
+	/* MME for this connection, if any.  This field is NULL until we
+	 * receive the first "MME name" IE from the MME, which could be part
+	 * of the RESET procedure, but also just a normal LU request. */
+	struct sgs_mme_ctx *mme;
+
+	/* represents the SCTP connection we accept()ed from this MME */
+	struct osmo_stream_srv *srv;
+};
+
+struct sgs_mme_ctx {
+	/* global list of MME contexts */
+	struct llist_head entry;
+
+	/* back-pointer */
+	struct sgs_state *sgs;
+
+	/* MME name as string representation */
+	char fqdn[GSM23003_MME_DOMAIN_LEN + 1];
+
+	/* current connection for this MME, if any. Can be NULL if the SCTP
+	 * connection to the MME was lost and hasn't been re-established yet */
+	struct sgs_connection *conn;
+
+	/* FSM for the "VLR reset" procedure" */
+	struct osmo_fsm_inst *fi;
+	unsigned int ns11_remaining;
+};
+
+extern struct sgs_state *g_sgs;
+
+struct sgs_state *sgs_iface_init(void *ctx, struct gsm_network *network);
+int sgs_iface_rx(struct sgs_connection *sgc, struct msgb *msg);
+int sgs_iface_tx_paging(struct vlr_subscr *vsub, enum sgsap_service_ind serv_ind);
+int sgs_iface_tx_dtap_ud(struct msgb *msg);
+void sgs_iface_tx_release(struct ran_conn *conn);
diff --git a/include/osmocom/msc/sgs_server.h b/include/osmocom/msc/sgs_server.h
new file mode 100644
index 0000000..a89022d
--- /dev/null
+++ b/include/osmocom/msc/sgs_server.h
@@ -0,0 +1,53 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+#include <arpa/inet.h>
+#include <osmocom/gsm/protocol/gsm_29_118.h>
+
+#define DEFAULT_SGS_SERVER_IP "0.0.0.0"
+#define DEFAULT_SGS_SERVER_VLR_NAME "vlr.example.net"
+
+/* global SGs state */
+struct sgs_state {
+	/* list of MMEs (sgs_mme_ctx) */
+	struct llist_head mme_list;
+
+	/* list of SCTP client connections */
+	struct llist_head conn_list;
+
+	/* SCTP server for inbound SGs connections */
+	struct osmo_stream_srv_link *srv_link;
+
+	struct {
+		char local_addr[INET6_ADDRSTRLEN];
+		uint16_t local_port;
+		/* user-configured VLR name (FQDN) */
+		char vlr_name[SGS_VLR_NAME_MAXLEN];
+		/* timers on VLR side */
+		unsigned int timer[_NUM_SGS_STATE_TIMERS];
+		/* countrs on VLR side */
+		unsigned int counter[_NUM_SGS_STATE_COUNTERS];
+	} cfg;
+};
+
+struct sgs_state *sgs_server_alloc(void *ctx);
+int sgs_server_open(struct sgs_state *sgs);
diff --git a/include/osmocom/msc/sgs_vty.h b/include/osmocom/msc/sgs_vty.h
new file mode 100644
index 0000000..daf69c1
--- /dev/null
+++ b/include/osmocom/msc/sgs_vty.h
@@ -0,0 +1,23 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+void sgs_vty_init(void);
diff --git a/include/osmocom/msc/vlr.h b/include/osmocom/msc/vlr.h
index 83c8e1b..3529640 100644
--- a/include/osmocom/msc/vlr.h
+++ b/include/osmocom/msc/vlr.h
@@ -13,6 +13,7 @@
 #include <osmocom/msc/ran_conn.h>
 #include <osmocom/msc/msc_common.h>
 #include <osmocom/gsupclient/gsup_client.h>
+#include <osmocom/msc/vlr_sgs.h>
 
 #define LOGGSUPP(level, gsup, fmt, args...)				\
 	LOGP(DVLR, level, "GSUP(%s) " fmt, (gsup)->imsi, ## args)
@@ -162,6 +163,7 @@
 	struct osmo_fsm_inst *lu_fsm;
 	struct osmo_fsm_inst *auth_fsm;
 	struct osmo_fsm_inst *proc_arq_fsm;
+	struct osmo_fsm_inst *sgs_fsm;
 
 	bool lu_complete;
 	time_t expire_lu;
@@ -182,6 +184,17 @@
 		uint8_t lac;
 		enum osmo_rat_type attached_via_ran;
 	} cs;
+	/* SGs (MME) specific parts */
+	struct {
+		struct vlr_sgs_cfg cfg;
+		char mme_name[SGS_MME_NAME_LEN + 1];
+		struct osmo_location_area_id lai;
+		vlr_sgs_lu_response_cb_t response_cb;
+		vlr_sgs_lu_paging_cb_t paging_cb;
+		vlr_sgs_lu_mminfo_cb_t mminfo_cb;
+		enum sgsap_service_ind paging_serv_ind;
+		struct osmo_timer_list Ts5;
+	} sgs;
 
 	struct gsm_classmark classmark;
 };
diff --git a/include/osmocom/msc/vlr_sgs.h b/include/osmocom/msc/vlr_sgs.h
new file mode 100644
index 0000000..cc07807
--- /dev/null
+++ b/include/osmocom/msc/vlr_sgs.h
@@ -0,0 +1,107 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+#include <osmocom/gsm/gsm29118.h>
+
+enum vlr_lu_type;
+struct vlr_subscr;
+struct vlr_instance;
+
+/* See also 3GPP TS 29.118, chapter 4.2.2 States at the VLR */
+enum sgs_ue_fsm_state {
+	SGS_UE_ST_NULL,
+	SGS_UE_ST_ASSOCIATED,
+	SGS_UE_ST_LA_UPD_PRES,
+};
+
+enum vlr_sgs_state_tmr {
+	/* Started when sending the SGsAP-PAGING-REQUEST, implemented in vlr_sgs.c */
+	SGS_STATE_TS5,
+	/* TMSI reallocation, 5.2.3.5, implemented by fsm in vlr_sgs_fsm.c */
+	SGS_STATE_TS6_2,
+	/* Started when SGsAP-ALERT-REQUEST is sent 5.3.2.1, not implemented yet */
+	SGS_STATE_TS7,
+	/* Reset ack timeout, implemnted in sgs_iface.c */
+	SGS_STATE_TS11,
+	/* Started when SGsAP-SERVICE-REQUEST is received 5.15.1, not implemented yet */
+	SGS_STATE_TS14,
+	/* Started when SGsAP-MO-CSFB-INDICATION is received 5.16.3 (UE fallback, not implemented yet) */
+	SGS_STATE_TS15,
+	_NUM_SGS_STATE_TIMERS
+};
+
+enum vlr_sgs_state_ctr {
+	/* Alert request retransmit count */
+	SGS_STATE_NS7,
+	/* Reset repeat count */
+	SGS_STATE_NS11,
+	_NUM_SGS_STATE_COUNTERS
+};
+
+extern const struct value_string sgs_state_timer_names[];
+static inline const char *vlr_sgs_state_timer_name(enum vlr_sgs_state_tmr Ts)
+{
+	return get_value_string(sgs_state_timer_names, Ts);
+}
+
+extern const struct value_string sgs_state_counter_names[];
+static inline const char *vlr_sgs_state_counter_name(enum vlr_sgs_state_ctr Ns)
+{
+	return get_value_string(sgs_state_timer_names, Ns);
+}
+
+/* This callback function is called when an SGs location update is complete */
+struct sgs_lu_response {
+	bool accepted;
+	struct vlr_subscr *vsub;
+};
+typedef void (*vlr_sgs_lu_response_cb_t) (struct sgs_lu_response *response);
+
+/* This callback function is called in cases where a paging request is required
+ * after the LU is completed */
+typedef int (*vlr_sgs_lu_paging_cb_t) (struct vlr_subscr *vsub, enum sgsap_service_ind serv_ind);
+
+/* This callback function is called to send the MM info to the UE. */
+typedef void (*vlr_sgs_lu_mminfo_cb_t) (struct vlr_subscr *vsub);
+
+/* Configuration parameters for the SGs FSM */
+struct vlr_sgs_cfg {
+	unsigned int timer[_NUM_SGS_STATE_TIMERS];
+	unsigned int counter[_NUM_SGS_STATE_COUNTERS];
+};
+
+void vlr_sgs_reset(struct vlr_instance *vlr);
+int vlr_sgs_loc_update(struct vlr_instance *vlr, struct vlr_sgs_cfg *cfg,
+		       vlr_sgs_lu_response_cb_t response_cb, vlr_sgs_lu_paging_cb_t paging_cb,
+		       vlr_sgs_lu_mminfo_cb_t mminfo_cb, char *mme_name, enum vlr_lu_type type, const char *imsi,
+		       struct osmo_location_area_id *new_lai);
+void vlr_sgs_loc_update_acc_sent(struct vlr_subscr *vsub);
+void vlr_sgs_loc_update_rej_sent(struct vlr_subscr *vsub);
+void vlr_sgs_detach(struct vlr_instance *vlr, const char *imsi, bool eps);
+void vlr_sgs_imsi_detach(struct vlr_instance *vlr, const char *imsi, enum sgsap_imsi_det_noneps_type type);
+void vlr_sgs_eps_detach(struct vlr_instance *vlr, const char *imsi, enum sgsap_imsi_det_eps_type type);
+void vlr_sgs_tmsi_reall_compl(struct vlr_instance *vlr, const char *imsi);
+void vlr_sgs_pag_rej(struct vlr_instance *vlr, const char *imsi, enum sgsap_sgs_cause cause);
+void vlr_sgs_pag_ack(struct vlr_instance *vlr, const char *imsi);
+void vlr_sgs_ue_unr(struct vlr_instance *vlr, const char *imsi, enum sgsap_sgs_cause cause);
+void vlr_sgs_pag(struct vlr_subscr *vsub, enum sgsap_service_ind serv_ind);
+bool vlr_sgs_pag_pend(struct vlr_subscr *vsub);
diff --git a/include/osmocom/msc/vty.h b/include/osmocom/msc/vty.h
index 6a55df7..2a3b18b 100644
--- a/include/osmocom/msc/vty.h
+++ b/include/osmocom/msc/vty.h
@@ -23,6 +23,7 @@
 	SMPP_NODE,
 	SMPP_ESME_NODE,
 	HLR_NODE,
+	CFG_SGS_NODE,
 };
 
 int bsc_vty_init_extra(void);