Added timing advance support for up and downlink TBFs

The timing advance of any TBF is stored when it ends. Whenever a new TBF
with the same TLLI is created (downlink TBF), the stored TA is recalled.

This algorithm assumes that the mobile does not move too fast during
transfer. Also the mobile must start a connection in order to get correct
initial timing advance.

This algorithm does not implement the timing advance procedure as defined
in TS 04.60. To implement the standard timing advance procedure, the BTS
must decode RACH on certain bursts, the mobile is expected to send them.
This requires much more complexity to a transceiver like USRP/UmTRX or
Calypso BTS.

The algorithm was tested at TA >= 8 and works quite well.
diff --git a/src/pcu_l1_if.cpp b/src/pcu_l1_if.cpp
index d7f5ec4..923070f 100644
--- a/src/pcu_l1_if.cpp
+++ b/src/pcu_l1_if.cpp
@@ -516,6 +516,7 @@
 static int pcu_rx_time_ind(struct gsm_pcu_if_time_ind *time_ind)
 {
 	struct gprs_rlcmac_tbf *tbf;
+	struct gprs_rlcmac_sba *sba, *sba2;
 	uint32_t elapsed;
 	uint8_t fn13 = time_ind->fn % 13;
 
@@ -531,18 +532,27 @@
 	/* check for poll timeout */
 	llist_for_each_entry(tbf, &gprs_rlcmac_ul_tbfs, list) {
 		if (tbf->poll_state == GPRS_RLCMAC_POLL_SCHED) {
-			elapsed = (frame_number - tbf->poll_fn) % 2715648;
-			if (elapsed >= 20 && elapsed < 200)
+			elapsed = (frame_number + 2715648 - tbf->poll_fn)
+								% 2715648;
+			if (elapsed >= 20 && elapsed < 2715400)
 				gprs_rlcmac_poll_timeout(tbf);
 		}
 	}
 	llist_for_each_entry(tbf, &gprs_rlcmac_dl_tbfs, list) {
 		if (tbf->poll_state == GPRS_RLCMAC_POLL_SCHED) {
-			elapsed = (frame_number - tbf->poll_fn) % 2715648;
-			if (elapsed >= 20 && elapsed < 200)
+			elapsed = (frame_number + 2715648 - tbf->poll_fn)
+								% 2715648;
+			if (elapsed >= 20 && elapsed < 2715400)
 				gprs_rlcmac_poll_timeout(tbf);
 		}
 	}
+	llist_for_each_entry_safe(sba, sba2, &gprs_rlcmac_sbas, list) {
+		elapsed = (frame_number + 2715648 - sba->fn) % 2715648;
+		if (elapsed >= 20 && elapsed < 2715400) {
+			/* sba will be freed here */
+			gprs_rlcmac_sba_timeout(sba);
+		}
+	}
 
 	return 0;
 }