Multipath makes a mess of time-of-flight measurements, plus the low-level hardware doesn't necessarily export the information you want. Researchers working on location with GSM (short example paper) have been using signal strength instead.