Added timing advance support for up and downlink TBFs

The timing advance of any TBF is stored when it ends. Whenever a new TBF
with the same TLLI is created (downlink TBF), the stored TA is recalled.

This algorithm assumes that the mobile does not move too fast during
transfer. Also the mobile must start a connection in order to get correct
initial timing advance.

This algorithm does not implement the timing advance procedure as defined
in TS 04.60. To implement the standard timing advance procedure, the BTS
must decode RACH on certain bursts, the mobile is expected to send them.
This requires much more complexity to a transceiver like USRP/UmTRX or
Calypso BTS.

The algorithm was tested at TA >= 8 and works quite well.
diff --git a/src/gprs_bssgp_pcu.cpp b/src/gprs_bssgp_pcu.cpp
index 5dbfb2c..54753b8 100644
--- a/src/gprs_bssgp_pcu.cpp
+++ b/src/gprs_bssgp_pcu.cpp
@@ -196,6 +196,7 @@
 		uint8_t trx, ta, ss;
 		int8_t use_trx;
 		struct gprs_rlcmac_tbf *old_tbf;
+		int rc;
 
 		/* check for uplink data, so we copy our informations */
 		tbf = tbf_by_tlli(tlli, GPRS_RLCMAC_UL_TBF);
@@ -207,7 +208,19 @@
 			old_tbf = tbf;
 		} else {
 			use_trx = -1;
-			ta = 0; /* FIXME: initial TA */
+			/* we already have an uplink TBF, so we use that TA */
+			if (tbf)
+				ta = tbf->ta;
+			else {
+				/* recall TA */
+				rc = recall_timing_advance(tlli);
+				if (rc < 0) {
+					LOGP(DRLCMAC, LOGL_NOTICE, "TA unknown"
+						", assuming 0\n");
+					ta = 0;
+				} else
+					ta = rc;
+			}
 			ss = 1; /* PCH assignment only allows one timeslot */
 			old_tbf = NULL;
 		}
diff --git a/src/gprs_rlcmac.cpp b/src/gprs_rlcmac.cpp
index 2c87317..2ea0a61 100644
--- a/src/gprs_rlcmac.cpp
+++ b/src/gprs_rlcmac.cpp
@@ -1819,3 +1819,107 @@
 
 	return 0;
 }
+
+
+/*
+ * timing advance memory
+ */
+
+/* enable to debug timing advance memory */
+//#define DEBUG_TA
+
+static LLIST_HEAD(gprs_rlcmac_ta_list);
+static int gprs_rlcmac_ta_num = 0;
+
+struct gprs_rlcmac_ta {
+	struct llist_head	list;
+	uint32_t		tlli;
+	uint8_t			ta;
+};
+
+/* remember timing advance of a given TLLI */
+int remember_timing_advance(uint32_t tlli, uint8_t ta)
+{
+	struct gprs_rlcmac_ta *ta_entry;
+
+	/* check for existing entry */
+	llist_for_each_entry(ta_entry, &gprs_rlcmac_ta_list, list) {
+		if (ta_entry->tlli == tlli) {
+#ifdef DEBUG_TA
+			fprintf(stderr, "update %08x %d\n", tlli, ta);
+#endif
+			ta_entry->ta = ta;
+			/* relink to end of list */
+			llist_del(&ta_entry->list);
+			llist_add_tail(&ta_entry->list, &gprs_rlcmac_ta_list);
+			return 0;
+		}
+	}
+
+#ifdef DEBUG_TA
+	fprintf(stderr, "remember %08x %d\n", tlli, ta);
+#endif
+	/* if list is full, remove oldest entry */
+	if (gprs_rlcmac_ta_num == 30) {
+		ta_entry = llist_entry(gprs_rlcmac_ta_list.next,
+			struct gprs_rlcmac_ta, list);
+	        llist_del(&ta_entry->list);
+		talloc_free(ta_entry);
+		gprs_rlcmac_ta_num--;
+	}
+
+	/* create new TA entry */
+	ta_entry = talloc_zero(tall_pcu_ctx, struct gprs_rlcmac_ta);
+	if (!ta_entry)
+		return -ENOMEM;
+
+	ta_entry->tlli = tlli;
+	ta_entry->ta = ta;
+	llist_add_tail(&ta_entry->list, &gprs_rlcmac_ta_list);
+	gprs_rlcmac_ta_num++;
+
+	return 0;
+}
+
+int recall_timing_advance(uint32_t tlli)
+{
+	struct gprs_rlcmac_ta *ta_entry;
+	uint8_t ta;
+
+	llist_for_each_entry(ta_entry, &gprs_rlcmac_ta_list, list) {
+		if (ta_entry->tlli == tlli) {
+			ta = ta_entry->ta;
+#ifdef DEBUG_TA
+			fprintf(stderr, "recall %08x %d\n", tlli, ta);
+#endif
+			return ta;
+		}
+	}
+#ifdef DEBUG_TA
+	fprintf(stderr, "no entry for %08x\n", tlli);
+#endif
+
+	return -EINVAL;
+}
+
+int flush_timing_advance(void)
+{
+	struct gprs_rlcmac_ta *ta_entry;
+	int count = 0;
+
+	while (!llist_empty(&gprs_rlcmac_ta_list)) {
+		ta_entry = llist_entry(gprs_rlcmac_ta_list.next,
+			struct gprs_rlcmac_ta, list);
+#ifdef DEBUG_TA
+		fprintf(stderr, "flush entry %08x %d\n", ta_entry->tlli,
+			ta_entry->ta);
+#endif
+	        llist_del(&ta_entry->list);
+		talloc_free(ta_entry);
+		count++;
+	}
+	gprs_rlcmac_ta_num = 0;
+
+	return count;
+}
+
diff --git a/src/gprs_rlcmac.h b/src/gprs_rlcmac.h
index 5badb12..c5af602 100644
--- a/src/gprs_rlcmac.h
+++ b/src/gprs_rlcmac.h
@@ -374,6 +374,8 @@
 
 int gprs_rlcmac_poll_timeout(struct gprs_rlcmac_tbf *tbf);
 
+int gprs_rlcmac_sba_timeout(struct gprs_rlcmac_sba *sba);
+
 int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, int16_t qta);
 
 int gprs_rlcmac_rcv_control_block(bitvec *rlc_block, uint8_t trx, uint8_t ts,
@@ -421,6 +423,12 @@
 struct msgb *gprs_rlcmac_send_packet_paging_request(
 	struct gprs_rlcmac_pdch *pdch);
 
+int remember_timing_advance(uint32_t tlli, uint8_t ta);
+
+int recall_timing_advance(uint32_t tlli);
+
+int flush_timing_advance(void);
+
 extern "C" {
 #endif
 int alloc_algorithm_a(struct gprs_rlcmac_tbf *old_tbf,
diff --git a/src/gprs_rlcmac_data.cpp b/src/gprs_rlcmac_data.cpp
index 1109451..4f2b649 100644
--- a/src/gprs_rlcmac_data.cpp
+++ b/src/gprs_rlcmac_data.cpp
@@ -206,6 +206,15 @@
 	return 0;
 }
 
+int gprs_rlcmac_sba_timeout(struct gprs_rlcmac_sba *sba)
+{
+	LOGP(DRLCMAC, LOGL_NOTICE, "Poll timeout for SBA\n");
+	llist_del(&sba->list);
+	talloc_free(sba);
+
+	return 0;
+}
+
 static uint8_t get_ms_class_by_capability(MS_Radio_Access_capability_t *cap)
 {
 	int i;
@@ -263,6 +272,7 @@
 	int8_t tfi = 0; /* must be signed */
 	uint32_t tlli = 0;
 	struct gprs_rlcmac_tbf *tbf;
+	struct gprs_rlcmac_sba *sba;
 	int rc;
 
 	RlcMacUplink_t * ul_control_block = (RlcMacUplink_t *)talloc_zero(tall_pcu_ctx, RlcMacUplink_t);
@@ -420,6 +430,7 @@
 			if (!tbf) {
 				uint8_t ms_class = 0;
 				struct gprs_rlcmac_tbf *dl_tbf;
+				uint8_t ta;
 
 				if ((dl_tbf = tbf_by_tlli(tlli, GPRS_RLCMAC_DL_TBF))) {
 					LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from "
@@ -431,12 +442,28 @@
 				LOGP(DRLCMAC, LOGL_DEBUG, "MS requests UL TBF "
 					"in packet ressource request of single "
 					"block, so we provide one:\n");
+				sba = sba_find(trx, ts, fn);
+				if (!sba) {
+					LOGP(DRLCMAC, LOGL_NOTICE, "MS requests UL TBF "
+						"in packet ressource request of single "
+						"block, but there is no resource request "
+						"scheduled!\n");
+					rc = recall_timing_advance(tlli);
+					if (rc >= 0)
+						ta = rc;
+					else
+						ta = 0;
+				} else {
+					ta = sba->ta;
+					remember_timing_advance(tlli, ta);
+					llist_del(&sba->list);
+					talloc_free(sba);
+				}
 				if (ul_control_block->u.Packet_Resource_Request.Exist_MS_Radio_Access_capability)
 					ms_class = get_ms_class_by_capability(&ul_control_block->u.Packet_Resource_Request.MS_Radio_Access_capability);
 				if (!ms_class)
 					LOGP(DRLCMAC, LOGL_NOTICE, "MS does not give us a class.\n");
-				tbf = alloc_ul_tbf(trx, ms_class, tlli, 0, NULL);
-#warning FIXME TA!!!
+				tbf = alloc_ul_tbf(trx, ms_class, tlli, ta, NULL);
 				if (!tbf)
 					break;
 				/* set control ts to current MS's TS, until assignment complete */
@@ -469,6 +496,17 @@
 		LOGP(DRLCMAC, LOGL_ERROR, "RX: [PCU <- BTS] %s TFI: %u TLLI: 0x%08x FIXME: Packet ressource request\n", (tbf->direction == GPRS_RLCMAC_UL_TBF) ? "UL" : "DL", tbf->tfi, tbf->tlli);
 		break;
 	case MT_PACKET_MEASUREMENT_REPORT:
+		sba = sba_find(trx, ts, fn);
+		if (!sba) {
+			LOGP(DRLCMAC, LOGL_NOTICE, "MS send measurement "
+				"in packet ressource request of single "
+				"block, but there is no resource request "
+				"scheduled!\n");
+		} else {
+			remember_timing_advance(ul_control_block->u.Packet_Measurement_Report.TLLI, sba->ta);
+			llist_del(&sba->list);
+			talloc_free(sba);
+		}
 		gprs_rlcmac_meas_rep(&ul_control_block->u.Packet_Measurement_Report);
 		break;
 	default:
@@ -888,6 +926,8 @@
 		}
 		/* mark TLLI valid now */
 		tbf->tlli_valid = 1;
+		/* store current timing advance */
+		remember_timing_advance(tbf->tlli, tbf->ta);
 	/* already have TLLI, but we stille get another one */
 	} else if (rh->ti) {
 		uint32_t tlli;
diff --git a/src/gprs_rlcmac_sched.cpp b/src/gprs_rlcmac_sched.cpp
index f588c47..9b31fbc 100644
--- a/src/gprs_rlcmac_sched.cpp
+++ b/src/gprs_rlcmac_sched.cpp
@@ -78,11 +78,8 @@
 		sba_fn ++;
 	sba_fn = sba_fn % 2715648;
 	sba = sba_find(trx, ts, sba_fn);
-	if (sba) {
-		llist_del(&sba->list);
-		talloc_free(sba);
+	if (sba)
 		return sba_fn;
-	}
 
 	return 0xffffffff;
 }
diff --git a/src/pcu_l1_if.cpp b/src/pcu_l1_if.cpp
index d7f5ec4..923070f 100644
--- a/src/pcu_l1_if.cpp
+++ b/src/pcu_l1_if.cpp
@@ -516,6 +516,7 @@
 static int pcu_rx_time_ind(struct gsm_pcu_if_time_ind *time_ind)
 {
 	struct gprs_rlcmac_tbf *tbf;
+	struct gprs_rlcmac_sba *sba, *sba2;
 	uint32_t elapsed;
 	uint8_t fn13 = time_ind->fn % 13;
 
@@ -531,18 +532,27 @@
 	/* check for poll timeout */
 	llist_for_each_entry(tbf, &gprs_rlcmac_ul_tbfs, list) {
 		if (tbf->poll_state == GPRS_RLCMAC_POLL_SCHED) {
-			elapsed = (frame_number - tbf->poll_fn) % 2715648;
-			if (elapsed >= 20 && elapsed < 200)
+			elapsed = (frame_number + 2715648 - tbf->poll_fn)
+								% 2715648;
+			if (elapsed >= 20 && elapsed < 2715400)
 				gprs_rlcmac_poll_timeout(tbf);
 		}
 	}
 	llist_for_each_entry(tbf, &gprs_rlcmac_dl_tbfs, list) {
 		if (tbf->poll_state == GPRS_RLCMAC_POLL_SCHED) {
-			elapsed = (frame_number - tbf->poll_fn) % 2715648;
-			if (elapsed >= 20 && elapsed < 200)
+			elapsed = (frame_number + 2715648 - tbf->poll_fn)
+								% 2715648;
+			if (elapsed >= 20 && elapsed < 2715400)
 				gprs_rlcmac_poll_timeout(tbf);
 		}
 	}
+	llist_for_each_entry_safe(sba, sba2, &gprs_rlcmac_sbas, list) {
+		elapsed = (frame_number + 2715648 - sba->fn) % 2715648;
+		if (elapsed >= 20 && elapsed < 2715400) {
+			/* sba will be freed here */
+			gprs_rlcmac_sba_timeout(sba);
+		}
+	}
 
 	return 0;
 }
diff --git a/src/pcu_main.cpp b/src/pcu_main.cpp
index 4f23dd7..041831f6 100644
--- a/src/pcu_main.cpp
+++ b/src/pcu_main.cpp
@@ -248,6 +248,8 @@
 
 	pcu_l1if_close();
 
+	flush_timing_advance();
+
 	talloc_free(gprs_rlcmac_bts);
 
 	talloc_report_full(tall_pcu_ctx, stderr);