[ipaccess-config] fix bugs in generating the PHYSICAL CONFIG attribute

... while asking the BTS to perform tests for us.  The length of the
ARFCN whitelist is the actual length in bytes, not the number of 16bit
ARFCN numbers.

Also, implement a limit, either by rxlevel or by number of ARFCN
that should end up in the whitelist.
diff --git a/openbsc/include/openbsc/network_listen.h b/openbsc/include/openbsc/network_listen.h
index 8ca5cd8..67d1f4e 100644
--- a/openbsc/include/openbsc/network_listen.h
+++ b/openbsc/include/openbsc/network_listen.h
@@ -10,4 +10,7 @@
 int ipac_nwl_test_start(struct gsm_bts_trx *trx, uint8_t testnr,
 			const uint8_t *phys_conf, unsigned int phys_conf_len);
 
+int ipac_rxlevstat2whitelist(uint16_t *buf, const struct rxlev_stats *st, uint8_t min_rxlev,
+			     uint16_t max_num_arfcns);
+
 #endif /* _OPENBSC_NWL_H */
diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c
index 2d8f687..aaf99ee 100644
--- a/openbsc/src/abis_nm.c
+++ b/openbsc/src/abis_nm.c
@@ -1058,7 +1058,8 @@
 	if (oh->placement != ABIS_OM_PLACEMENT_ONLY) {
 		LOGP(DNM, LOGL_ERROR, "ABIS OML placement 0x%x not supported\n",
 			oh->placement);
-		return -EINVAL;
+		if (oh->placement != ABIS_OM_PLACEMENT_FIRST)
+			return -EINVAL;
 	}
 	if (oh->sequence != 0) {
 		LOGP(DNM, LOGL_ERROR, "ABIS OML sequence 0x%x != 0x00\n",
diff --git a/openbsc/src/ipaccess/ipaccess-config.c b/openbsc/src/ipaccess/ipaccess-config.c
index 7b0fd40..f0ad464 100644
--- a/openbsc/src/ipaccess/ipaccess-config.c
+++ b/openbsc/src/ipaccess/ipaccess-config.c
@@ -127,10 +127,10 @@
 	/* Create whitelist from rxlevels */
 	physconf_buf[0] = phys_conf_min[0];
 	physconf_buf[1] = NM_IPAC_EIE_ARFCN_WHITE;
-	num_arfcn = ipac_rxlevstat2whitelist(whitelist, st);
+	num_arfcn = ipac_rxlevstat2whitelist(whitelist, st, 0, 100);
 	arfcnlist_size = num_arfcn * 2;
-	*((uint16_t *) (physconf_buf+2)) = htons(num_arfcn);
-	printf("pc_buf (%s)\n", hexdump(physconf_buf, arfcnlist_size+4));
+	*((uint16_t *) (physconf_buf+2)) = htons(arfcnlist_size);
+	DEBUGP(DNM, "physconf_buf (%s)\n", hexdump(physconf_buf, arfcnlist_size+4));
 	return arfcnlist_size+4;
 }
 
diff --git a/openbsc/src/ipaccess/network_listen.c b/openbsc/src/ipaccess/network_listen.c
index 7625eec..23e404f 100644
--- a/openbsc/src/ipaccess/network_listen.c
+++ b/openbsc/src/ipaccess/network_listen.c
@@ -40,18 +40,23 @@
 
 #define WHITELIST_MAX_SIZE ((NUM_ARFCNS*2)+2+1)
 
-int ipac_rxlevstat2whitelist(uint16_t *buf, const struct rxlev_stats *st)
+int ipac_rxlevstat2whitelist(uint16_t *buf, const struct rxlev_stats *st, uint8_t min_rxlev,
+			     uint16_t max_num_arfcns)
 {
 	int i;
 	unsigned int num_arfcn = 0;
 
-	for (i = NUM_RXLEVS-1; i >= 0; i--) {
+	for (i = NUM_RXLEVS-1; i >= min_rxlev; i--) {
 		int16_t arfcn = -1;
 
 		while ((arfcn = rxlev_stat_get_next(st, i, arfcn)) >= 0) {
 			*buf++ = htons(arfcn);
 			num_arfcn++;
+
 		}
+
+		if (num_arfcn > max_num_arfcns)
+			break;
 	}
 
 	return num_arfcn;