From 676f4e6ad5bd56899d46f3a4039a38154cb699b8 Mon Sep 17 00:00:00 2001
From: MJ666 <MJ666@users.noreply.github.com>
Date: Sat, 12 Jun 2021 08:40:03 +0200
Subject: [PATCH 1/2] Fix bind problem for FrSky XM+ v2.1.2 firmware (#1011)

---
 src/protocol/frskyx_cc2500.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/src/protocol/frskyx_cc2500.c b/src/protocol/frskyx_cc2500.c
index 8b6db46a72..57d5b82daa 100644
--- a/src/protocol/frskyx_cc2500.c
+++ b/src/protocol/frskyx_cc2500.c
@@ -174,12 +174,12 @@ static void set_start(u8 ch) {
 #define RXNUM 16
 static void frskyX_build_bind_packet()
 {
-    packet[0] = packet_size;
-    packet[1] = 0x03;
-    packet[2] = 0x01;
+    packet[0] = packet_size;                // Number of bytes in the packet (after this one)
+    packet[1] = 0x03;                       // Bind packet
+    packet[2] = 0x01;                       // Bind packet
 
-    packet[3] = fixed_id;
-    packet[4] = fixed_id >> 8;
+    packet[3] = fixed_id;                   // ID
+    packet[4] = fixed_id >> 8;              // ID
 
     if (!Model.proto_opts[PROTO_OPTS_VERSION]) {
         int idx = ((state - FRSKY_BIND) % 10) * 5;
@@ -189,7 +189,7 @@ static void frskyX_build_bind_packet()
         packet[8] = hop_data[idx++];
         packet[9] = hop_data[idx++];
         packet[10] = hop_data[idx++];
-        packet[11] = 0x02;
+        packet[11] = 0x02;                  // ID
         packet[12] = RXNUM;
 
         memset(&packet[13], 0, packet_size - 14);
@@ -199,16 +199,19 @@ static void frskyX_build_bind_packet()
             memcpy(&packet[17], (void *)"\x55\xAA\x5A\xA5", 4);   // CH9-16
     } else {
         // packet 1D 03 01 0E 1C 02 00 00 32 0B 00 00 A8 26 28 01 A1 00 00 00 3E F6 87 C7 00 00 00 00 C9 C9
-        packet[5] = 0x02;                   // Unknown but constant ID?
+        // Unknown bytes
+        if (state & 0x01)
+            memcpy(&packet[7], "\x00\x18\x0A\x00\x00\xE0\x02\x0B\x01\xD3\x08\x00\x00\x4C\xFE\x87\xC7", 17);
+        else
+            memcpy(&packet[7], "\x27\xAD\x02\x00\x00\x64\xC8\x46\x00\x64\x00\x00\x00\xFB\xF6\x87\xC7", 17);
+        packet[5] = 0x02;                   // ID
         packet[6] = RXNUM;
         // Bind flags
-        packet[7] = 0;
         if (binding_idx & 0x01)
             packet[7] |= 0x40;              // Telem off
         if (binding_idx & 0x02)
             packet[7] |= 0x80;              // CH9-16
         // Unknown bytes
-        memcpy(&packet[8], "\x32\x0B\x00\x00\xA8\x26\x28\x01\xA1\x00\x00\x00\x3E\xF6\x87\xC7", 16);
         packet[20]^= 0x0E ^ fixed_id;       // Update the ID
         packet[21]^= 0x1C ^ fixed_id >> 8;  // Update the ID
         // Xor

From 07b5cf1b3ea7d281a535471bf6899f08dddc7794 Mon Sep 17 00:00:00 2001
From: StonedDawg <68074253+StonedDawg@users.noreply.github.com>
Date: Sat, 28 Aug 2021 23:40:50 +0700
Subject: [PATCH 2/2] fix crsf datatype for config page (#1013)

---
 src/pages/common/_crsfdevice_page.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pages/common/_crsfdevice_page.c b/src/pages/common/_crsfdevice_page.c
index 20a2c5cc39..b99c4dd9b8 100644
--- a/src/pages/common/_crsfdevice_page.c
+++ b/src/pages/common/_crsfdevice_page.c
@@ -440,11 +440,11 @@ static void parse_bytes(enum data_type type, char **buffer, void *dest) {
         *buffer += 1;
         break;
     case UINT16:
-        *(u16 *)dest = (u16) (((*buffer)[0] << 16) | (*buffer)[1]);
+        *(u16 *)dest = (u16) (((*buffer)[0] << 8) | (*buffer)[1]);
         *buffer += 2;
         break;
     case INT16:
-        *(s16 *)dest = (s16) (((*buffer)[0] << 16) | (*buffer)[1]);
+        *(s16 *)dest = (s16) (((*buffer)[0] << 8) | (*buffer)[1]);
         *buffer += 2;
         break;
     case FLOAT: