handover_fsm: do not access conn->assignment.req, it may be outdated

handover_fsm.c accesses conn->assignment.req.s15_s0 to find out the current
lchan's AMR configuration. However, conn->assignment.* values are only valid
during an ongoing assignment.  Those values may be overwritten by any failed
Assignment attempt, at any time, and hence do not reflect the currently
assigned conn->lchan. Those realms must be kept separate.

The assignment.req.s15_s0 get passed to lchan_activate(), so it makes most
sense to store these values in struct gsm_lchan once the lchan activation
succeeded.

Add gsm_lchan.s15_s0, store the s15_s0 received in lchan_activate_info during
lchan_activate().

In handover_fsm.c, use conn->lchan->s15_s0 instead of conn->assignment.*.

Change-Id: Id8018fd9d56421f2ab7be91703018f6d6f21c929

include/osmocom/bsc/gsm_data.h

@@ -578,6 +578,8 @@ struct gsm_lchan {
 	/* AMR bits */
 	uint8_t mr_ms_lv[7];
 	uint8_t mr_bts_lv[7];
+	/* AMR bits were based on these rate bits: */
+	uint16_t s15_s0;
 
 	/* Established data link layer services */
 	uint8_t sapis[8];

src/osmo-bsc/handover_fsm.c

@@ -715,7 +715,7 @@ static void send_handover_performed(struct gsm_subscriber_connection *conn)
 		if (gscon_is_aoip(conn)) {
 			/* Extrapolate speech codec from speech mode */
 			gsm0808_speech_codec_from_chan_type(&sc, ho_perf_params.speech_version_chosen);
-			sc.cfg = conn->assignment.req.s15_s0;
+			sc.cfg = conn->lchan->s15_s0;
 			memcpy(&ho_perf_params.speech_codec_chosen, &sc, sizeof(sc));
 			ho_perf_params.speech_codec_chosen_present = true;
 		}

src/osmo-bsc/lchan_fsm.c

@@ -544,6 +544,7 @@ static void lchan_fsm_wait_ts_ready_onenter(struct osmo_fsm_inst *fi, uint32_t p
 			lchan_fail("Can not generate multirate configuration IE\n");
 			return;
 		}
+		lchan->s15_s0 = info->s15_s0;
 	}
 
 	switch (info->chan_mode) {