Cellular communication uplink
BlackMath hit the nail on its proverbial head:


  Using control channels from the base station. 


Typically, the whole circus works like this:

Before a user equipment can register at a base station, it has to look for that cell's "beacon". Whenever it sees that, it waits a time $T_\text{wait}$ after the beacon, at which new devices are allowed to say "hey, I'm here". Because these devices can't know of each other yet, that phase isn't really TDD per se (it's more like ALOHA, with the random element being delay do to distance); especially, because these devices are at different distances from the base station (which they can't know already), it's not time-slotted. For that reason, the "hello" phase is not as tightly timed as regular TDD slots. That means it "wastes" a lot of uplink time, and for that reason, the network operator might define these phases to happen relatively rarely.

Assuming the new user equipment successfully registered within that "hello" phase (i.e. didn't collide with another new device), the base station now knows that there's a new device, and this devices cumulative delay $T_\text{beacon} + T_\text{distance} + T_\text{wait} + T_\text{distance}$. Since to the base station, $T_\text{beacon}$ and $T_\text{wait}$ are known, it can easily deduct $T_\text{distance}$. It then uses the downlink to tell the new device that, "hey, you need to be $T_\text{timing advance}$ earlier than you are, to fit into our TDD scheme. Your timeslots to send data are 1, 3, 22 and 128. Welcome to my cell!".

The user equipment adjusts its internal TDD timekeeping using that timing advance. During operation, the cell tower continuously informs the user equipment whether it needs to do adjustments of that timing advance, which would, for example, be the case if the user moved away or towards the cell tower.