Fix Timing Advance handling

* initialize with invalid TA instead of making assumption that phone is
  located within 550 meters (TA=0)
* only set valid TA

Change-Id: Idfc40ff0c11bdac13d9e28fbfa4e95dfc6b735b0
Related: OS#1526
diff --git a/src/bts.cpp b/src/bts.cpp
index e65d608..795baa6 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -33,6 +33,7 @@
 	#include <osmocom/core/talloc.h>
 	#include <osmocom/core/msgb.h>
 	#include <osmocom/core/stats.h>
+	#include <osmocom/gsm/protocol/gsm_04_08.h>
 }
 
 #include <arpa/inet.h>
@@ -1129,7 +1130,7 @@
 		uint32_t tlli = request->ID.u.TLLI;
 		uint8_t ms_class = 0;
 		uint8_t egprs_ms_class = 0;
-		uint8_t ta = 0;
+		uint8_t ta = GSM48_TA_INVALID;
 		struct pcu_l1_meas meas;
 
 		GprsMs *ms = bts()->ms_by_tlli(tlli);
diff --git a/src/gprs_ms.cpp b/src/gprs_ms.cpp
index b3270b1..8facc50 100644
--- a/src/gprs_ms.cpp
+++ b/src/gprs_ms.cpp
@@ -32,6 +32,7 @@
 extern "C" {
 	#include <osmocom/core/talloc.h>
 	#include <osmocom/core/utils.h>
+	#include <osmocom/gsm/protocol/gsm_04_08.h>
 }
 
 #define GPRS_CODEL_SLOW_INTERVAL_MS 4000
@@ -95,7 +96,7 @@
 	m_tlli(tlli),
 	m_new_ul_tlli(0),
 	m_new_dl_tlli(0),
-	m_ta(0),
+	m_ta(GSM48_TA_INVALID),
 	m_ms_class(0),
 	m_egprs_ms_class(0),
 	m_is_idle(true),
@@ -464,11 +465,15 @@
 	if (ta_ == m_ta)
 		return;
 
-	LOGP(DRLCMAC, LOGL_INFO,
-		"Modifying MS object, TLLI = 0x%08x, TA %d -> %d\n",
-		tlli(), m_ta, ta_);
-
-	m_ta = ta_;
+	if (gsm48_ta_is_valid(ta_)) {
+		LOGP(DRLCMAC, LOGL_INFO,
+		     "Modifying MS object, TLLI = 0x%08x, TA %d -> %d\n",
+		     tlli(), m_ta, ta_);
+		m_ta = ta_;
+	} else
+		LOGP(DRLCMAC, LOGL_NOTICE,
+		     "MS object, TLLI = 0x%08x, invalid TA %d rejected (old "
+		     "value %d kept)\n", tlli(), ta_, m_ta);
 }
 
 void GprsMs::set_ms_class(uint8_t ms_class_)
diff --git a/src/sba.cpp b/src/sba.cpp
index 6aeeb7c..46c1431 100644
--- a/src/sba.cpp
+++ b/src/sba.cpp
@@ -26,6 +26,7 @@
 
 extern "C" {
 #include <osmocom/core/talloc.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
 }
 
 #include <errno.h>
@@ -55,6 +56,9 @@
 	if (!sba)
 		return -ENOMEM;
 
+	if (!gsm48_ta_is_valid(ta))
+		return -EINVAL;
+
 	for (trx = 0; trx < 8; trx++) {
 		for (ts = 7; ts >= 0; ts--) {
 			pdch = &m_bts.bts_data()->trx[trx].pdch[ts];
diff --git a/src/tbf.cpp b/src/tbf.cpp
index 1fc1aef..7a15547 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -74,7 +74,7 @@
 	m_tfi(0),
 	m_created_ts(0),
 	m_ms(NULL),
-	m_ta(0),
+	m_ta(GSM48_TA_INVALID),
 	m_ms_class(0),
 	m_list(this),
 	m_ms_list(this),
@@ -151,7 +151,8 @@
 	if (ms())
 		ms()->set_ta(ta);
 
-	m_ta = ta;
+	if (gsm48_ta_is_valid(ta))
+		m_ta = ta;
 }
 
 uint8_t gprs_rlcmac_tbf::ms_class() const
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index 4c67a12..489020b 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -120,7 +120,7 @@
 {
 	uint8_t ss;
 	int8_t use_trx;
-	uint16_t ta = 0;
+	uint16_t ta = GSM48_TA_INVALID;
 	struct gprs_rlcmac_ul_tbf *ul_tbf = NULL, *old_ul_tbf;
 	struct gprs_rlcmac_dl_tbf *dl_tbf = NULL;
 	GprsMs *ms;