tbf: Don't change type from CCCH to PACCH without ack

Currently the CCCH flag is cleared and the PACCH flag is set when a
multislot upgrade is scheduled for a downlink TBF, even if the MS has
never confirmed in any way that the PACCH really exists. This can
happen if the MS did not receive the DL IMM.ASS. Since the CCCH flags
gets cleared in that case, the IMM.ASSS is never retried and all
subsequent PACKET DOWNLINK ASSIGNMENTS will fail.

This commit delays the update of these flags until the MS has
responded with a corresponding CONTROL ACK.

Sponsored-by: On-Waves ehf
diff --git a/src/bts.cpp b/src/bts.cpp
index 0356718..47dc1d1 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -569,7 +569,8 @@
 
 		/* change state */
 		dl_tbf->set_state(GPRS_RLCMAC_ASSIGN);
-		dl_tbf->state_flags |= (1 << GPRS_RLCMAC_FLAG_PACCH);
+		if (!(dl_tbf->state_flags & (1 << GPRS_RLCMAC_FLAG_CCCH)))
+			dl_tbf->state_flags |= (1 << GPRS_RLCMAC_FLAG_PACCH);
 		/* start timer */
 		tbf_timer_start(dl_tbf, 0, Tassign_pacch);
 	} else {
@@ -799,6 +800,15 @@
 		if (tbf->state_is(GPRS_RLCMAC_WAIT_RELEASE))
 			tbf_free(tbf);
 
+		if ((new_tbf->state_flags & (1 << GPRS_RLCMAC_FLAG_CCCH))) {
+			/* We now know that the PACCH really existed */
+			LOGP(DRLCMAC, LOGL_INFO,
+				"The TBF has been confirmed on the PACCH, "
+				"changed type from CCCH to PACCH for %s\n",
+				tbf_name(new_tbf));
+			new_tbf->state_flags &= ~(1 << GPRS_RLCMAC_FLAG_CCCH);
+			new_tbf->state_flags |= (1 << GPRS_RLCMAC_FLAG_PACCH);
+		}
 		new_tbf->set_state(GPRS_RLCMAC_FLOW);
 		/* stop pending assignment timer */
 		new_tbf->stop_timer();