OM2000: Route TS config requests to the right TRX

The TRX number is encoded in mo.assoc_so, whereas the TS number
is in mo.inst!
diff --git a/openbsc/src/libbsc/abis_om2000.c b/openbsc/src/libbsc/abis_om2000.c
index 00bbc45..9eadff2 100644
--- a/openbsc/src/libbsc/abis_om2000.c
+++ b/openbsc/src/libbsc/abis_om2000.c
@@ -654,7 +654,6 @@
 	case OM2K_MO_CLS_TRXC:
 	case OM2K_MO_CLS_TX:
 	case OM2K_MO_CLS_RX:
-	case OM2K_MO_CLS_TS:
 		/* Route through per-TRX OML Link to the appropriate TRX */
 		to_trx_oml = 1;
 		msg->trx = gsm_bts_trx_by_nr(bts, o2h->mo.inst);
@@ -664,6 +663,16 @@
 			return -ENODEV;
 		}
 		break;
+	case OM2K_MO_CLS_TS:
+		/* Route through per-TRX OML Link to the appropriate TRX */
+		to_trx_oml = 1;
+		msg->trx = gsm_bts_trx_by_nr(bts, o2h->mo.assoc_so);
+		if (!msg->trx) {
+			LOGP(DNM, LOGL_ERROR, "MO=%s Tx Dropping msg to "
+				"non-existing TRX\n", om2k_mo_name(&o2h->mo));
+			return -ENODEV;
+		}
+		break;
 	default:
 		/* Route through the IXU/DXU OML Link */
 		msg->trx = bts->c0;