RR Release Cell selection IE: fix repeated EARFCNs encoding

3GPP 44.018 10.5.2.1e defines the EARFCNs encoded in the 'Cell selection
indicator after release of all TCH and SDCCH IE' as follows:

  <Cell Selection Indicator after release of all TCH and SDCCH value part> ::=
  [...]
  | 011 { 1 <E-UTRAN Description : < E-UTRAN Description struct >> } ** 0

So after a 3-bit discriminator of '3' there can be multiple E-UTRAN
Descriptions, and each of them starts with a '1' bit to indicate that another
item follows. Finally there is a '0' bit to indicate the list end.

Before this patch, osmo-bsc only encoded the first '1' bit, and failed to
repeat this before each following E-UTRAN Description. Fix that by moving the
'1' encoding into the loop.

The final '0' was missing. Add it.

With these changes, adjust the size calculation in
CELL_SEL_IND_AFTER_REL_MAX_BITS to match.

Also fix CELL_SEL_IND_AFTER_REL_MAX_BYTES by using OSMO_BYTES_FOR_BITS()
instead of the inaccurate (n/8)+1.

A test for this is in I882c5e1f70bcc4833fc837a95c900ce291919cc5
(osmo-ttcn3-hacks).

Related: SYS#4871 SYS#4872
Change-Id: I59e427e4ebb1c6af99b27a15c40fed82457ac8ab
diff --git a/src/osmo-bsc/gsm_04_08_rr.c b/src/osmo-bsc/gsm_04_08_rr.c
index f47c31f..f425b16 100644
--- a/src/osmo-bsc/gsm_04_08_rr.c
+++ b/src/osmo-bsc/gsm_04_08_rr.c
@@ -238,8 +238,8 @@
 }
 
 
-#define CELL_SEL_IND_AFTER_REL_MAX_BITS	(4+MAX_EARFCN_LIST*19)
-#define CELL_SEL_IND_AFTER_REL_MAX_BYTES ((CELL_SEL_IND_AFTER_REL_MAX_BITS/8)+1)
+#define CELL_SEL_IND_AFTER_REL_MAX_BITS (3+MAX_EARFCN_LIST*20+1)
+#define CELL_SEL_IND_AFTER_REL_MAX_BYTES OSMO_BYTES_FOR_BITS(CELL_SEL_IND_AFTER_REL_MAX_BITS)
 
 /* Generate a CSN.1 encoded "Cell Selection Indicator after release of all TCH and SDCCH"
  * as per TF 44.018 version 15.3.0 Table 10.5.2.1e.1.  This only generates the "value"
@@ -255,17 +255,18 @@
 
 	/* E-UTRAN Description */
 	bitvec_set_uint(&bv, 3, 3);
-	bitvec_set_bit(&bv, 1);
 
 	for (i = 0; i < MAX_EARFCN_LIST; i++) {
 		const struct osmo_earfcn_si2q *e = &bts->si_common.si2quater_neigh_list;
 		if (e->arfcn[i] == OSMO_EARFCN_INVALID)
 			continue;
 
-		if (bitvec_tailroom_bits(&bv) < 19) {
+		/* tailroom must fit one more EARFCN (20 bits), plus the final list term bit. */
+		if (bitvec_tailroom_bits(&bv) < 21) {
 			LOGP(DRR, LOGL_NOTICE, "%s: Not enough room to store EARFCN %u in the "
 				"Cell Selection Indicator IE\n", gsm_bts_name(bts), e->arfcn[i]);
 		} else {
+			bitvec_set_bit(&bv, 1);
 			bitvec_set_uint(&bv, e->arfcn[i], 16);
 			/* No "Measurement Bandwidth" */
 			bitvec_set_bit(&bv, 0);
@@ -276,6 +277,9 @@
 		}
 	}
 
+	/* list term */
+	bitvec_set_bit(&bv, 0);
+
 	rc = bitvec_used_bytes(&bv);
 
 	if (rc == 1) {