[SGSN] Fix TLLI (re)assignments

Once The TLLI (or P-TMSI of which it is derived) change has been
confirmed by the MS, we need to unassign the old TLLI but keep
the new TLLI  _without_ re-setting the LLC entity structure such
as VUsend /VUrecv counters.
diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index bd5a7fa..9a43766 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -883,7 +883,7 @@
 		mmctx->p_tmsi_old = 0;
 		/* Unassign the old TLLI */
 		mmctx->tlli = mmctx->tlli_new;
-		gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli_new, 0, NULL);
+		gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli, 0, NULL);
 		break;
 	case GSM48_MT_GMM_RA_UPD_COMPL:
 		/* only in case SGSN offered new P-TMSI */
@@ -892,7 +892,7 @@
 		mmctx->p_tmsi_old = 0;
 		/* Unassign the old TLLI */
 		mmctx->tlli = mmctx->tlli_new;
-		gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli_new, 0, NULL);
+		gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli, 0, NULL);
 		break;
 	case GSM48_MT_GMM_PTMSI_REALL_COMPL:
 		DEBUGP(DMM, "-> PTMSI REALLLICATION COMPLETE\n");
@@ -900,7 +900,7 @@
 		mmctx->p_tmsi_old = 0;
 		/* Unassign the old TLLI */
 		mmctx->tlli = mmctx->tlli_new;
-		//gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli_new, 0, NULL);
+		//gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli, 0, NULL);
 		break;
 	case GSM48_MT_GMM_AUTH_CIPH_RESP:
 		DEBUGP(DMM, "Unimplemented GSM 04.08 GMM msg type 0x%02x\n",
diff --git a/openbsc/src/gprs/gprs_llc.c b/openbsc/src/gprs/gprs_llc.c
index f45bd32..98193d9 100644
--- a/openbsc/src/gprs/gprs_llc.c
+++ b/openbsc/src/gprs/gprs_llc.c
@@ -141,6 +141,7 @@
 		return NULL;
 
 	llme->tlli = tlli;
+	llme->old_tlli = 0xffffffff;
 	llme->state = GPRS_LLMS_UNASSIGNED;
 
 	for (i = 0; i < ARRAY_SIZE(llme->lle); i++)
@@ -709,19 +710,23 @@
 		/* If old TLLI != 0xffffffff was assigned to LLME, then TLLI
 		 * old is unassigned.  Only TLLI new shall be accepted when
 		 * received from peer. */
-
-		/* If TLLI old == 0xffffffff was assigned to LLME, then this is
-		 * TLLI assignmemt according to 8.3.1 */
-		llme->old_tlli = 0;
-		llme->tlli = new_tlli;
-		llme->state = GPRS_LLMS_ASSIGNED;
-		/* 8.5.3.1 For all LLE's */
-		for (i = 0; i < ARRAY_SIZE(llme->lle); i++) {
-			struct gprs_llc_lle *l = &llme->lle[i];
-			l->vu_send = l->vu_recv = 0;
-			l->retrans_ctr = 0;
-			l->state = GPRS_LLES_ASSIGNED_ADM;
-			/* FIXME Set parameters according to table 9 */
+		if (llme->old_tlli != 0xffffffff) {
+			llme->old_tlli = 0xffffffff;
+			llme->tlli = new_tlli;
+		} else {
+			/* If TLLI old == 0xffffffff was assigned to LLME, then this is
+			 * TLLI assignmemt according to 8.3.1 */
+			llme->old_tlli = 0xffffffff;
+			llme->tlli = new_tlli;
+			llme->state = GPRS_LLMS_ASSIGNED;
+			/* 8.5.3.1 For all LLE's */
+			for (i = 0; i < ARRAY_SIZE(llme->lle); i++) {
+				struct gprs_llc_lle *l = &llme->lle[i];
+				l->vu_send = l->vu_recv = 0;
+				l->retrans_ctr = 0;
+				l->state = GPRS_LLES_ASSIGNED_ADM;
+				/* FIXME Set parameters according to table 9 */
+			}
 		}
 	} else if (old_tlli != 0xffffffff && new_tlli != 0xffffffff) {
 		/* TLLI Change 8.3.2 */