type III support.

we have observations, if you have some either, let us know on the ML.


git-svn-id: https://dedected.org/svn/trunk@69 8d8ab74c-27aa-4a3d-9bde-523a2bc1f624

13 files changed, 1218 insertions, 630 deletions

diff --git a/com-on-air_cs-linux/dect.c b/com-on-air_cs-linux/dect.c
index 5a867a4..bc4074d 100644
--- a/com-on-air_cs-linux/dect.c
+++ b/com-on-air_cs-linux/dect.c
@@ -82,6 +82,14 @@ int dect_compare_RFPI(unsigned char *packet, unsigned char* RFPI)
 	return 0;
 }
 
+int dect_has_b_field(unsigned char *packet)
+{
+	if ((packet[5] & DECT_A_BA) != DECT_A_BA)
+		return 1;
+
+	return 0;
+}
+
 int dect_get_slot(unsigned char *packet)
 {
 	int slot = -1;
@@ -133,7 +141,7 @@ int dect_update_slottable(struct dect_slot_info *slottable, int slot, unsigned c
 {
 	if (slottable[slot].type == DECT_SLOTTYPE_SCAN)
 	{
-		printk("received packet on scanslot %u on carrier %u\n", slot, slottable[slot].channel);
+		//printk("received packet on scanslot %u on carrier %u\n", slot, slottable[slot].channel);
 		slottable[slot].type = DECT_SLOTTYPE_CARRIER;
 		if (slottable[slot].channel == 0)
 			slottable[slot].channel = 9;
@@ -170,10 +178,8 @@ int dect_update_slottable(struct dect_slot_info *slottable, int slot, unsigned c
 		switch(packet[5] & DECT_A_TA)
 		{
 		case DECT_P_TYPE:
-			if ( ( (packet[6] & DECT_P_HEAD) ==
-					DECT_P_HEAD_ZEROLP) ||
-				( (packet[6] & DECT_P_HEAD) ==
-				 	DECT_P_HEAD_SHORTLP) )
+			if ( ( (packet[6] & DECT_P_HEAD) == DECT_P_HEAD_ZEROLP) || 
+				( (packet[6] & DECT_P_HEAD) == DECT_P_HEAD_SHORTLP) )
 			{
 				switch((packet[9] & DECT_P_INFOTYPE))
 				{
@@ -192,7 +198,7 @@ int dect_update_slottable(struct dect_slot_info *slottable, int slot, unsigned c
 						slottable[newslot+12].errcnt = 0;
 						slottable[newslot+12].update = 1;
 
-						/*printk("\n\nstation switching to slot %u channel %u\n\n",newslot, packet[10] & DECT_P_IT_BEARERPOS_CN); */
+						//printk("\n\nstation switching to slot %u channel %u\n\n",newslot, packet[10] & DECT_P_IT_BEARERPOS_CN); 
 						return 1;
 					}
 
@@ -208,7 +214,7 @@ int dect_update_slottable(struct dect_slot_info *slottable, int slot, unsigned c
 							
 							if (x && (!slottable[i].active))
 							{
-								printk("scanning on slot %u\n", i);
+								//printk("scanning on slot %u\n", i);
 								slottable[i].active = 1;
 								slottable[i].channel = 0;		/* channel unknown at this position */
 								slottable[i].type = DECT_SLOTTYPE_SCAN;
@@ -219,7 +225,7 @@ int dect_update_slottable(struct dect_slot_info *slottable, int slot, unsigned c
 
 							if (x && (!slottable[i+12].active))
 							{
-								printk("scanning on slot %u\n", i + 12);
+								//printk("scanning on slot %u\n", i + 12);
 								slottable[i+12].active = 1;
 								slottable[i+12].channel = 0;	/* channel unknown at this position */
 								slottable[i+12].type = DECT_SLOTTYPE_SCAN;
@@ -273,6 +279,9 @@ int dect_update_slottable(struct dect_slot_info *slottable, int slot, unsigned c
 
 int dect_receive_error(struct dect_slot_info *slottable, int slot)
 {
+
+	//printk("slot:%u,errcnt:%u,type:%u,channel:%u\n",slot,slottable[slot].errcnt,slottable[slot].type,slottable[slot].channel);
+
 	slottable[slot].errcnt++;
 
 	if (slottable[slot].type != DECT_SLOTTYPE_SCAN)
@@ -282,7 +291,7 @@ int dect_receive_error(struct dect_slot_info *slottable, int slot)
 			slottable[slot].active = 0;
 			slottable[slot].update = 1;
 
-			printk("slot %u on channel %u died\n", slot, slottable[slot].channel);
+			//printk("slot %u on channel %u died\n", slot, slottable[slot].channel);
 
 			return 1;
 		}		
@@ -309,7 +318,7 @@ int dect_update_scanchannels(struct dect_slot_info *slottable)
 
 				ret = 1;
 
-				/*printk("slot %u will now scan on carrier %u\n", i, slottable[i].channel); */
+				//printk("slot %u will now scan on carrier %u\n", i, slottable[i].channel); 
 			}
 		}
 	}
diff --git a/com-on-air_cs-linux/dect.h b/com-on-air_cs-linux/dect.h
index 4706560..54e67db 100644
--- a/com-on-air_cs-linux/dect.h
+++ b/com-on-air_cs-linux/dect.h
@@ -32,6 +32,7 @@ struct dect_slot_info
 
 int dect_is_RFPI_Packet(unsigned char *packet);
 int dect_compare_RFPI(unsigned char *packet, unsigned char* RFPI);
+int dect_has_b_field(unsigned char *packet);
 int dect_get_slot(unsigned char *packet);
 int dect_is_multiframe_number(unsigned char *packet);
 int dect_is_fp_packet(unsigned char *packet);
diff --git a/com-on-air_cs-linux/firmware/Makefile b/com-on-air_cs-linux/firmware/Makefile
index 239cf9b..1052ce5 100644
--- a/com-on-air_cs-linux/firmware/Makefile
+++ b/com-on-air_cs-linux/firmware/Makefile
@@ -4,8 +4,10 @@ FW=sc14421_firmware
 
 FW1=sc14421_II_sniff_scan
 FW2=sc14421_II_sniff_sync
+FW3=sc14421_III_sniff_scan
+FW4=sc14421_III_sniff_sync
 
-ALL_FW=$(FW1) $(FW2)
+ALL_FW=$(FW1) $(FW2) $(FW3) $(FW4)
 
 BIN2C=./bin2c
 
@@ -33,8 +35,11 @@ $(foreach f,$(ALL_FW),$f.c): $(foreach f,$(ALL_FW),$f.bin) $(BIN2C)
 $(foreach f,$(ALL_FW),$f.decl):
 	@echo "extern unsigned char $(@:.decl=)_fw[509];" > $@
 
+mrproper:
+	rm -f ../$(FW).h ../$(FW).c
+	$(MAKE) clean
 clean:
-	rm -f ../$(FW).h ../$(FW).c $(BIN2C)
+	rm -f $(BIN2C)
 	rm -f $(foreach f,$(ALL_FW),$f.c)
 	rm -f $(foreach f,$(ALL_FW),$f.p)
 	rm -f $(foreach f,$(ALL_FW),$f.decl)
diff --git a/com-on-air_cs-linux/firmware/sc14421_III_sniff_scan.asm b/com-on-air_cs-linux/firmware/sc14421_III_sniff_scan.asm
new file mode 100644
index 0000000..f3ceee6
--- /dev/null
+++ b/com-on-air_cs-linux/firmware/sc14421_III_sniff_scan.asm
@@ -0,0 +1,129 @@
+		CPU     SC14421
+
+		ORG 0
+		BR	Start
+
+
+PB_LED          EQU     0x80
+PB_RX_ON        EQU     0x40
+PB_TX_ON        EQU     0x10
+PB_RADIOPOWER   EQU     0x04
+PB_DCTHRESHOLD  EQU     0x02
+PB_RSSI		EQU	0x01
+
+;-------------------------------------------------------------
+
+Start:		B_RST	
+		BK_C		0x00
+		C_LD		0x10
+		WT		10
+		B_RC		0x00
+		WT		8
+		B_RST	
+		C_ON		
+		WT		10
+		P_EN	
+		P_LD		0x00
+		RCK_INT	
+		RFEN	
+;-------------------------------------------------------------	
+
+		BK_C		0x20
+TryAgain:	JMP		RFInit
+		JMP		RFDKnow1	
+		MEN2N	
+		WT		250
+		P_SC		0x60
+		P_LDH		PB_RX_ON|PB_DCTHRESHOLD	
+		UNLCK	
+		WT		64
+		B_XOFF	
+		B_SR	
+		WNT		20
+		JMP1		SFieldFound
+		B_RST
+		WT		22
+		BR		TryAgain
+;-------------------------------------------------------------
+
+SFieldFound:	WNT		23
+		P_SC		0x00
+		JMP		RecvSlot
+		U_INT0	
+		BR		TryAgain
+;-------------------------------------------------------------
+
+													
+RecvSlot:	JMP		RFDKnow1
+		JMP		RecvPP
+	        WT		1
+		B_BRFU		0x0E
+	 	WT		255
+		WT		73
+ 		P_LDH		PB_RSSI
+		P_LDL		0x20|PB_DCTHRESHOLD;|PB_RADIOPOWER
+		B_WRS		0x00
+		WT		7
+		B_RST	
+		MEN1N	
+		WNT		1
+		RTN	
+;-------------------------------------------------------------
+
+RecvPP: 	MEN2	
+		P_LDL		PB_RSSI
+		WT		1
+		RFDIS	
+		WNT		1
+		WT		5
+		B_XON	
+		WT		14
+		B_SR	
+		EN_SL_ADJ	
+		WT		13
+		P_LDH		PB_DCTHRESHOLD
+		WT		32
+		B_AR2		0x06
+		WT		61
+		RTN
+;-------------------------------------------------------------
+
+RFInit:		RFEN	
+          	WT		1
+            WT		1
+            M_WR	0x4A
+            WT		9
+            M_RST	
+            JMP		label_C0
+            M_WR	0x4B
+            WT		17
+            M_RST	
+            JMP		label_C0
+            M_WR	0x4D
+            WT		25
+	    M_RST	
+            RTN	
+;-------------------------------------------------------------
+
+RFDKnow1:	JMP		label_C0
+		BR		RFDKnow3
+;-------------------------------------------------------------
+
+RFDKnow2: 	JMP		label_C3
+RFDKnow3: 	B_RST	
+		B_RC		0x58
+		WT		8
+		MEN2N	
+		P_LDH		PB_RADIOPOWER
+		WT		208
+		RTN	
+;-------------------------------------------------------------

+
+label_C0: 	MEN1	
+       		MEN1N	
+      		RTN	
+;-------------------------------------------------------------

+
+label_C3: 	MEN1	
+		RTN	
+;-------------------------------------------------------------

diff --git a/com-on-air_cs-linux/firmware/sc14421_III_sniff_sync.asm b/com-on-air_cs-linux/firmware/sc14421_III_sniff_sync.asm
new file mode 100644
index 0000000..ffe59b2
--- /dev/null
+++ b/com-on-air_cs-linux/firmware/sc14421_III_sniff_sync.asm
@@ -0,0 +1,301 @@
+		CPU     SC14421

+

+		ORG 0

+

+		BR	Start

+

+PB_LED          EQU     0x80

+PB_RX_ON        EQU     0x40

+PB_TX_ON        EQU     0x10

+PB_RADIOPOWER   EQU     0x04

+PB_DCTHRESHOLD  EQU     0x02

+PB_RSSI			EQU		0x01

+

+;-------------------------------------------------------------

+

+Start:		BR	InitDIP

+;-------------------------------------------------------------

+

+SlotTable:	SLOTZERO	

+JP0III:		BK_C	0x20

+PP0III:		WNT	2

+JP2III:		BK_C	0x30

+PP2III:		WNT	2

+JP4III:		BK_C	0x40

+PP4III:		WNT	2

+JP6III:		BK_C	0x50

+PP6III:		WNT	2

+JP8III:		BK_C	0x60

+PP8III:		WNT	2

+JP10III:	BK_C	0x70

+PP10III:	WNT	2

+		U_INT0	

+JP12III:	BK_C	0x80

+PP12III:	WNT	2

+JP14III:	BK_C	0x90

+PP14III:	WNT	2

+JP16III:	BK_C	0xA0

+PP16III:	WNT	2

+JP18III:	BK_C	0xB0

+PP18III:	WNT	2

+JP20III:	BK_C	0xC0

+PP20III:	WNT	2

+JP22III:	BK_C	0xD0

+PP22III:	WNT	2

+            U_INT3	

+            P_LDH	PB_LED

+			BR		SlotTable

+;-------------------------------------------------------------

+

+RecvIII:		JMP		RFInit

+			JMP	RFDKnow1

+        	BR		label_2D

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow2

+label_2D: 	JMP		RecvPP

+            WT		1

+            B_BRFU	0x0E

+            JMP		label_6B

+            BR		label_51

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow1

+            BR		label_37

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow2

+label_37: 	JMP		RecvPP

+            BR		label_1

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow1

+            BR		label_3E

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow2

+label_3E: 	JMP		label_2

+            WT		1

+            B_BTFU	0x0E

+            JMP		label_3

+            BR		label_54

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow2

+            JMP		label_2

+            WT		1

+            B_BT	0x0E

+            JMP		label_4

+            BR		label_53

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow1

+            BR		label_4F

+;-------------------------------------------------------------

+

+            JMP		RFInit

+            JMP		RFDKnow2

+label_4F:	JMP		label_2

+            BR		label_5

+;-------------------------------------------------------------

+

+label_51: 	B_WRS	0x00

+            WT		7

+label_53: 	B_RST	

+label_54: 	MEN1N	

+            WNT		1

+label_6: 	RTN	

+;-------------------------------------------------------------

+

+label_7: 	B_RST	

+            MEN1N	

+            BR		label_6

+;-------------------------------------------------------------

+

+RecvPP: 	MEN2	

+            P_LDL	PB_RSSI

+            WT		1

+            RFDIS	

+            WNT		1

+            WT		5

+            B_XON	

+            WT		14

+            B_SR	

+            EN_SL_ADJ	

+            WT		13

+            P_LDH	PB_DCTHRESHOLD

+            WT		32

+            B_AR2	0x06

+            WT		61

+            RTN	

+;-------------------------------------------------------------

+

+label_6B: 	WT		249

+            WT		79

+label_10: 	P_LDH	PB_RSSI

+            P_LDL	0x20|PB_RADIOPOWER|PB_DCTHRESHOLD

+            RTN	

+;-------------------------------------------------------------

+

+label_2: 	MEN2	

+            WT		2

+            RFDIS	

+            B_RST	

+            B_RC	0x50

+            WT		8

+            WNT		1

+            WT		4

+            P_LDH	PB_RX_ON

+            WT		3

+            P_LDH	PB_TX_ON

+            WT		3

+            B_ST2	

+            WT		31

+            B_AT2	0x06

+            WT		61

+            RTN	

+;-------------------------------------------------------------

+

+label_3:	WT		249

+            WT		84

+            B_RST	

+label_4: 	P_LDL	PB_TX_ON

+            WT		8

+            P_LDL	PB_RX_ON|PB_RADIOPOWER

+            RTN	

+;-------------------------------------------------------------

+

+label_8: 	B_XON	

+            WT		15

+            B_XOFF	

+            WT		61

+            RTN	

+;-------------------------------------------------------------

+

+label_9: 	WT		61

+            JMP		label_8

+            JMP		label_8

+            JMP		label_8

+            JMP		label_8

+            JMP		label_8

+            WT		1

+            B_XON	

+            WT		11

+            RTN	

+;-------------------------------------------------------------

+

+label_1: 	B_BR	0x0E

+            JMP		label_9

+            WT		3

+            B_XR	

+            WT		6

+            JMP		label_10

+            B_WRS	0x00

+            WT		6

+            BR		label_7

+;-------------------------------------------------------------

+

+label_5: 	B_BT	0x0E

+            WT		3

+            JMP		label_9

+            B_XT	

+            WT		13

+            B_RST	

+            JMP		label_4

+            BR		label_7

+;-------------------------------------------------------------

+

+RFInit:	RFEN	

+            WT		1

+            WT		1

+            M_WR	0x4A

+            WT		9

+            M_RST	

+            JMP		label_C0

+            M_WR	0x4B

+            WT		17

+            M_RST	

+            JMP		label_C0

+            M_WR	0x4D

+            WT		25

+            M_RST	

+            RTN	

+;-------------------------------------------------------------

+

+RFDKnow1: 	JMP		label_C0

+            BR		RFDKnow3

+;-------------------------------------------------------------

+

+RFDKnow2: 	JMP		label_C3

+RFDKnow3: 	B_RST	

+            B_RC	0x58

+            WT		8

+            MEN2N	

+            P_LDH	PB_RADIOPOWER

+            WT		208

+            RTN	

+;-------------------------------------------------------------

+

+label_C0: 	MEN1	

+       		MEN1N	

+      		RTN	

+;-------------------------------------------------------------

+

+label_C3: 	MEN1	

+            RTN	

+;-------------------------------------------------------------

+

+PPSync: 	BK_C	0x20

+;            P_LDL	PB_LED

+PPSearchIII: JMP		RFInit

+            JMP		RFDKnow1

+            MEN2N	

+            WT		250

+            P_SC	0x60

+            P_LDH	PB_DCTHRESHOLD

+            UNLCK	

+            WT		64

+            B_XOFF	

+            B_SR	

+            WNT		20

+            JMP1	SFieldFound

+            B_RST	

+            U_INT1	

+            WNT		23

+            BR		PPSearchIII

+;-------------------------------------------------------------

+

+SFieldFound:WNT		23

+            P_SC	0x00

+RecvNextIII:	JMP	RecvIII

+            U_INT0	

+            WNT		22

+PPFoundIII:	BR		PPSearchIII

+;-------------------------------------------------------------

+

+InitDIP: 	B_RST	

+            BK_C	0x00

+            C_LD	0x10

+            WT		10

+            B_RC	0x00

+            WT		8

+            B_RST	

+            C_ON	

+            WT		10

+            P_EN	

+            P_LD	0x00

+            RCK_INT	

+            RFEN	

+            BR		PPSync

+;-------------------------------------------------------------

+

+		SHARED		PP0III,PP2III,PP4III,PP6III,PP8III,PP10III,PP12III,PP14III,PP16III,PP18III,PP20III,PP22III

+		SHARED		JP0III,JP2III,JP4III,JP6III,JP8III,JP10III,JP12III,JP14III,JP16III,JP18III,JP20III,JP22III

+		SHARED		RecvNextIII,PPFoundIII,RecvIII

diff --git a/com-on-air_cs-linux/firmware/sc14421_II_sniff_scan.asm b/com-on-air_cs-linux/firmware/sc14421_II_sniff_scan.asm
index 0c0aab7..d006fd0 100644
--- a/com-on-air_cs-linux/firmware/sc14421_II_sniff_scan.asm
+++ b/com-on-air_cs-linux/firmware/sc14421_II_sniff_scan.asm
@@ -9,102 +9,107 @@ PB_RX_ON        EQU     0x40
 PB_TX_ON        EQU     0x10
 PB_RADIOPOWER   EQU     0x04
 PB_DCTHRESHOLD  EQU     0x02
-PB_RSSI		EQU	0x01
+PB_RSSI			EQU		0x01
 
 ;-------------------------------------------------------------
 
 Start:		B_RST	
-		BK_C	0x00
-		C_LD	0x10
-		WT	10
-		B_RC	0x00
-		WT	8
-		B_RST
-		C_ON		
-		WT	10
-		P_EN	
-		P_LD	PB_RADIOPOWER
-		RCK_INT	
-		RFEN	
+			BK_C	0x00
+			C_LD	0x10
+			WT		10
+			B_RC	0x00
+			WT		8
+			B_RST
+			C_ON		
+			WT		10
+			P_EN	
+			P_LD	PB_RADIOPOWER
+			RCK_INT	
+			RFEN	
 ;-------------------------------------------------------------
 
-		BK_C	0x20
-		JMP	RFInit
-TryAgain:	JMP	label_B1
-		WT	250
-		P_SC	0x20
-		P_LDH	PB_RX_ON|PB_DCTHRESHOLD
-		UNLCK	
-		WT	64
-		B_XOFF	
-		B_SR	
-		WNT	20
-		JMP1	SFieldFound
-		BR	TryAgain
+			BK_C	0x20
+			JMP		RFInit
+TryAgain:	JMP		RFDKnow1
+			WT		250
+			P_SC	0x20
+			P_LDH	PB_RX_ON|PB_DCTHRESHOLD
+			UNLCK	
+			WT		64
+			B_XOFF	
+			B_SR	
+			WNT		20
+			JMP1	SFieldFound
+			BR		TryAgain
 ;-------------------------------------------------------------
 
-SFieldFound:	WNT	23
-		P_SC	0x00
-		JMP	ReceiveSlot
-		U_INT0	
-		BR	TryAgain
+SFieldFound:WNT		23
+			P_SC	0x00
+			JMP		RecvSlot
+			U_INT0	
+			BR		TryAgain
 ;-------------------------------------------------------------
 
-ReceiveSlot:	JMP	label_B1
-		JMP	RecvPP
-		WT	1
-		B_BRFU	0x0e
-		WT	255
-		WT	73
-		P_LDH	PB_RSSI
-		P_LDL	PB_RX_ON
-		B_WRS	0x00
-		WT	6
-		B_RST	
-		P_LDL	PB_RX_ON|PB_TX_ON
-		WT	5
-		RTN	
+RecvSlot:	JMP		RFDKnow1
+			JMP		RecvPP
+			WT		1
+			B_BRFU	0x0E
+			WT		255
+			WT		73
+			P_LDH	PB_RSSI
+			P_LDL	PB_RX_ON
+			B_WRS	0x00
+			WT		6
+			B_RST	
+			P_LDL	PB_RX_ON|PB_TX_ON
+			WT		5
+			RTN	
 ;-------------------------------------------------------------
 
 RecvPP:		P_LDH	PB_RX_ON
-		P_LDL	PB_RSSI
-		WT	34
-		WNT	1
-		B_XON	
-		P_LDH	PB_DCTHRESHOLD
-		WT	5
-		B_SR	
-		EN_SL_ADJ	
-		WT	12
-		P_LDL	PB_DCTHRESHOLD
-		WT	33
-		B_AR2	0x06
-		WT	61
-		RTN	
+			P_LDL	PB_RSSI
+			WT		34
+			WNT		1
+			B_XON	
+			P_LDH	PB_DCTHRESHOLD
+			WT		5
+			B_SR	
+			EN_SL_ADJ	
+			WT		12
+			P_LDL	PB_DCTHRESHOLD
+			WT		33
+			B_AR2	0x06
+			WT		61
+			RTN	
 ;-------------------------------------------------------------
 
 RFInit:		RFEN	
-		MEN1N	
-		WT	2
-		M_WR	0x4A
-		WT	25
-		M_RST	
-		MEN1	
-		MEN1N	
-		M_WR	0x4D
-		WT	10
-		M_RST	
-		MEN1	
-		RTN	
+			MEN1N	
+			WT		2
+			M_WR	0x4A
+			WT		25
+			M_RST	
+			MEN1	
+			MEN1N	
+			M_WR	0x4D
+			WT		10
+			M_RST	
+			MEN1	
+			RTN	
 ;-------------------------------------------------------------
 
-label_B1:	B_RST	
-		B_RC	0x58
-		WT	8
-		MEN2	
-		WT	182
-		MEN2N	
-		WT	16
-		RTN	
+RFDKnow1:	B_RST	
+			B_RC	0x58
+			WT		8
+			MEN2	
+			WT		182
+			MEN2N	
+			WT		16
+			RTN	
 ;-------------------------------------------------------------
 
+
+
+
+
+
diff --git a/com-on-air_cs-linux/firmware/sc14421_II_sniff_sync.asm b/com-on-air_cs-linux/firmware/sc14421_II_sniff_sync.asm
index 9d9e9de..4001505 100644
--- a/com-on-air_cs-linux/firmware/sc14421_II_sniff_sync.asm
+++ b/com-on-air_cs-linux/firmware/sc14421_II_sniff_sync.asm
@@ -1,15 +1,15 @@
 		CPU     SC14421
 
 		ORG 0
-		BR      Start
 
+		BR	Start
 
 PB_LED          EQU     0x80
 PB_RX_ON        EQU     0x40
 PB_TX_ON        EQU     0x10
 PB_RADIOPOWER   EQU     0x04
 PB_DCTHRESHOLD  EQU     0x02
-PB_RSSI		EQU	0x01
+PB_RSSI			EQU		0x01
 
 ;-------------------------------------------------------------
 
@@ -17,282 +17,275 @@ Start:		BR	InitDIP
 ;-------------------------------------------------------------
 
 SlotTable:	SLOTZERO	
-JP0:		BK_C	0x20
-PP0:		WNT	2
-JP2:		BK_C	0x30
-PP2:		WNT	2
-JP4:		BK_C	0x40
-PP4:		WNT	2
-JP6:		BK_C	0x50
-PP6:		WNT	2
-JP8:		BK_C	0x60
-PP8:		WNT	2
-JP10:		BK_C	0x70
-PP10:		WNT	2
-		U_INT0
-JP12:		BK_C	0x80
-PP12:		WNT	2
-JP14:		BK_C	0x90
-PP14:		WNT	2
-JP16:		BK_C	0xA0
-PP16:		WNT	2
-JP18:		BK_C	0xB0
-PP18:		WNT	2
-JP20:		BK_C	0xC0
-PP20:		WNT	2
-JP22:		BK_C	0xD0
-PP22:		WNT	2
-		U_INT3
-		P_LDL	0x80
-		BR	SlotTable
+JP0II:		BK_C	0x20
+PP0II:		WNT	2
+JP2II:		BK_C	0x30
+PP2II:		WNT	2
+JP4II:		BK_C	0x40
+PP4II:		WNT	2
+JP6II:		BK_C	0x50
+PP6II:		WNT	2
+JP8II:		BK_C	0x60
+PP8II:		WNT	2
+JP10II:		BK_C	0x70
+PP10II:		WNT	2
+			U_INT0
+JP12II:		BK_C	0x80
+PP12II:		WNT	2
+JP14II:		BK_C	0x90
+PP14II:		WNT	2
+JP16II:		BK_C	0xA0
+PP16II:		WNT	2
+JP18II:		BK_C	0xB0
+PP18II:		WNT	2
+JP20II:		BK_C	0xC0
+PP20II:		WNT	2
+JP22II:		BK_C	0xD0
+PP22II:		WNT	2
+			U_INT3
+			P_LDL	0x80
+			BR	SlotTable
 ;-------------------------------------------------------------
 
-sync_label_28:	JMP	RFInit
-		JMP	label_B1
-		BR	label_2D
+RecvII:		JMP	RFInit
+			JMP	RFDKnow1
+			BR	label_2D
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B3
+			JMP	RFInit
+			JMP	RFDKnow2
 label_2D:	JMP	RecvPP
-		WT	1
-		B_BRFU	0x0E
-		JMP	label_6B
-		BR	label_51
+			WT	1
+			B_BRFU	0x0E
+			JMP	label_6B
+			BR	label_51
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B1
-		BR	label_37
+			JMP	RFInit
+			JMP	RFDKnow1
+			BR	label_37
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B3
+			JMP	RFInit
+			JMP	RFDKnow2
 label_37:	JMP	RecvPP
-		BR	label_92
+			BR	label_1
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B1
-		BR	label_3E
+			JMP	RFInit
+			JMP	RFDKnow1
+			BR	label_3E
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B3
-label_3E:	JMP	label_70
-		WT	1
-		B_BTFU	0x0E
-		JMP	label_7C
-		BR	label_54
+			JMP	RFInit
+			JMP	RFDKnow2
+label_3E:	JMP	label_2
+			WT	1
+			B_BTFU	0x0E
+			JMP	label_3
+			BR	label_54
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B3
-		JMP	label_70
-		WT	1
-		B_BT	0x0E
-		JMP	label_7F
-		BR	label_53
+			JMP	RFInit
+			JMP	RFDKnow2
+			JMP	label_2
+			WT	1
+			B_BT	0x0E
+			JMP	label_4
+			BR	label_53
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B1
-		BR	label_4F
+			JMP	RFInit
+			JMP	RFDKnow1
+			BR	label_4F
 ;-------------------------------------------------------------
 
-		JMP	RFInit
-		JMP	label_B3
-label_4F:	JMP	label_70
-		BR	label_9B
+			JMP	RFInit
+			JMP	RFDKnow2
+label_4F:	JMP	label_2
+			BR	label_5
 ;-------------------------------------------------------------
 
 label_51:	B_WRS	0x00
-		WT	6
+			WT	6
 label_53:	B_RST	
-label_54:	P_LDL	0x50
-		WT	5
-		WNT	1
-label_57:	RTN	
+label_54:	P_LDL	PB_RX_ON|PB_TX_ON
+			WT	5
+			WNT	1
+label_6:	RTN	
 ;-------------------------------------------------------------
 
-label_58:	B_RST	
-		P_LDL	0x50
-		BR	label_57
+label_7:	B_RST	
+			P_LDL	PB_RX_ON|PB_TX_ON
+			BR	label_6
 ;-------------------------------------------------------------
 
-RecvPP:		P_LDH	0x40
-		P_LDL	PB_RSSI	
-		WT	25
-		WNT	1
-		WT	9
-		B_XON	
-		P_LDH	0x02
-		WT	5
-		B_SR	
-		EN_SL_ADJ	
-		WT	12
-		P_LDL	0x02
-		WT	33
-		B_AR2	0x06
-		WT	61
-		RTN	
+RecvPP:		P_LDH	PB_RX_ON
+			P_LDL	PB_RSSI	
+			WT	25
+			WNT	1
+			WT	9
+			B_XON	
+			P_LDH	PB_DCTHRESHOLD
+			WT	5
+			B_SR	
+			EN_SL_ADJ	
+			WT	12
+			P_LDL	PB_DCTHRESHOLD
+			WT	33
+			B_AR2	0x06
+			WT	61
+			RTN	
 ;-------------------------------------------------------------
 
 label_6B:	WT	249
-		WT	79
-label_6D:	P_LDH	PB_RSSI
-		P_LDL	0x40
-		RTN	
+			WT	79
+label_10:	P_LDH	PB_RSSI
+			P_LDL	PB_RX_ON
+			RTN	
 ;-------------------------------------------------------------
 
-label_70:	P_LDH	0x00
-		WT	40
-		B_RST	
-		B_RC	0x50
-		WNT	1
-		B_ST	0x00
-		WT	1
-		P_LDH	0x10
-		WT	37
-		B_AT2	0x06
-		WT	61
-		RTN	
+label_2:	P_LDH	0x00
+			WT	40
+			B_RST	
+			B_RC	0x50
+			WNT	1
+			B_ST	0x00
+			WT	1
+			P_LDH	PB_TX_ON
+			WT	37
+			B_AT2	0x06
+			WT	61
+			RTN	
 ;-------------------------------------------------------------
 
-label_7C:  	WT	249
-             	WT	84
-             	B_RST	
-label_7F:  	P_LDL	0x10
-             	WT	8
-             	P_LDL	0x00
-             	RTN	
+label_3:  	WT	249
+           	WT	84
+           	B_RST	
+label_4:  	P_LDL	PB_TX_ON
+           	WT	8
+           	P_LDL	0x00
+           	RTN	
 ;-------------------------------------------------------------
 
-label_83:  	B_XON	
-             	WT	15
-             	B_XOFF	
-             	WT	61
-             	RTN	
+label_8:  	B_XON	
+            WT	15
+            B_XOFF	
+            WT	61
+            RTN	
 ;-------------------------------------------------------------
 
-label_88:  	WT	61
-             	JMP	label_83
-             	JMP	label_83
-             	JMP	label_83
-             	JMP	label_83
-             	JMP	label_83
-             	WT	1
-             	B_XON	
-             	WT	11
-             	RTN	
+label_9:  	WT	61
+            JMP	label_8
+            JMP	label_8
+            JMP	label_8
+            JMP	label_8
+            JMP	label_8
+            WT	1
+            B_XON	
+            WT	11
+            RTN	
 ;-------------------------------------------------------------
 
-label_92:  	B_BR	0x0E
-             	JMP	label_88
-             	WT	3
-             	B_XR	
-             	WT	6
-             	JMP	label_6D
-             	B_WRS	0x00
-             	WT	6
-             	BR	label_58
+label_1:  	B_BR	0x0E
+            JMP	label_9
+            WT	3
+            B_XR	
+            WT	6
+            JMP	label_10
+            B_WRS	0x00
+            WT	6
+            BR	label_7
 ;-------------------------------------------------------------
 
-label_9B:  	B_BT	0x0E
-             	WT	3
-             	JMP	label_88
-             	B_XT	
-             	WT	13
-             	B_RST	
-             	JMP	label_7F
-             	BR	label_58
+label_5:  	B_BT	0x0E
+            WT	3
+            JMP	label_9
+            B_XT	
+            WT	13
+            B_RST	
+            JMP	label_4
+            BR	label_7
 ;-------------------------------------------------------------
 
 RFInit:  	RFEN	
-             	MEN1N	
-             	WT	1
-             	WT	1
-             	M_WR	0x4A
-             	WT	25
-             	M_RST	
-             	MEN1	
-             	MEN1N	
-             	M_WR	0x4D
-             	WT	10
-             	M_RST	
-             	MEN1	
-             	RTN	
+            MEN1N	
+            WT	1
+            WT	1
+            M_WR	0x4A
+            WT	25
+            M_RST	
+            MEN1	
+            MEN1N	
+            M_WR	0x4D
+            WT	10
+            M_RST	
+            MEN1	
+            RTN	
 ;-------------------------------------------------------------
 
-label_B1:  	P_LDL	0x20
-             	BR	label_B5
+RFDKnow1:  	P_LDL	0x20
+            BR	RFDKnow3
 ;-------------------------------------------------------------
 
-label_B3:  	P_LDH	0x20
-             	BR	label_B5
+RFDKnow2:  	P_LDH	0x20
+            BR	RFDKnow3
 ;-------------------------------------------------------------
 
-label_B5:	B_RST	
-		B_RC	0x58
-		WT	8
-		MEN2	
-		WT	118
-		WT	64
-		MEN2N	
-		P_LDH	0x00
-		WT	16
-		RTN	
+RFDKnow3:	B_RST	
+			B_RC	0x58
+			WT	8
+			MEN2	
+			WT	118
+			WT	64
+			MEN2N	
+			P_LDH	0x00
+			WT	16
+			RTN	
 ;-------------------------------------------------------------
 
 PPSync:		BK_C	0x20
-label_C0:	JMP	RFInit
-		JMP	label_B1
-		WT	250
-		P_SC	0x20
-		P_LDH	PB_RX_ON|PB_DCTHRESHOLD
-		UNLCK	
-		WT	64
-		B_XOFF	
-		B_SR	
-		WNT	20
-		JMP1	SFieldFound
-		B_RST	
-		U_INT1	
-		WNT	23
-		BR	label_C0
+PPSearchII:	JMP	RFInit
+			JMP	RFDKnow1
+			WT	250
+			P_SC	0x20
+			P_LDH	PB_RX_ON|PB_DCTHRESHOLD
+			UNLCK	
+			WT	64
+			B_XOFF	
+			B_SR	
+			WNT	20
+			JMP1	SFieldFound
+			B_RST	
+			U_INT1	
+			WNT	23
+			BR	PPSearchII
 ;-------------------------------------------------------------
 
 SFieldFound:	WNT	23
-		P_SC	0x00
-sync_label_D1:	JMP	sync_label_28
-		U_INT0	
-		WNT	22
-sync_label_D4:	BR	label_C0
+			P_SC	0x00
+RecvNextII:	JMP	RecvII
+			U_INT0	
+			WNT	22
+PPFoundII:	BR	PPSearchII
 ;-------------------------------------------------------------
 
 InitDIP:	B_RST	
-		BK_C	0x00
-		C_LD	0x10
-		WT	10
-		B_RC	0x00
-		WT	8
-		B_RST	
-		BK_A	0x00
-		A_LDR	0x8C
-		A_LDW	0xB4
-		BK_A1	0x00
-		A_LDR1	0x0C
-		A_LDW1	0x34
-		C_ON	
-		A_NORM	
-		WT	10
-		P_EN	
-		P_LD	0x04
-		RCK_INT	
-		RFEN	
-		BR	PPSync
+			BK_C	0x00
+			C_LD	0x10
+			WT	10
+			B_RC	0x00
+			WT	8
+			B_RST	
+			C_ON	
+			WT	10
+			P_EN	
+			P_LD	PB_RADIOPOWER
+			RCK_INT	
+			RFEN	
+			BR	PPSync
 ;-------------------------------------------------------------
 
-		SHARED		PP0,PP2,PP4,PP6,PP8,PP10,PP12,PP14,PP16,PP18,PP20,PP22
-		SHARED		JP0,JP2,JP4,JP6,JP8,JP10,JP12,JP14,JP16,JP18,JP20,JP22
-		SHARED		sync_label_D1,sync_label_D4,sync_label_28
+		SHARED		PP0II,PP2II,PP4II,PP6II,PP8II,PP10II,PP12II,PP14II,PP16II,PP18II,PP20II,PP22II
+		SHARED		JP0II,JP2II,JP4II,JP6II,JP8II,JP10II,JP12II,JP14II,JP16II,JP18II,JP20II,JP22II
+		SHARED		RecvNextII,PPFoundII,RecvII
diff --git a/com-on-air_cs-linux/sc14421_firmware.c b/com-on-air_cs-linux/sc14421_firmware.c
index 8216b5e..52177d2 100644
--- a/com-on-air_cs-linux/sc14421_firmware.c
+++ b/com-on-air_cs-linux/sc14421_firmware.c
@@ -128,11 +128,153 @@ unsigned char sc14421_II_sniff_sync_fw[] = {
 	0x08, 0x17, 0x01, 0xb7, 0x08, 0x17, 0xea, 0x00,
 	0x02, 0x1f, 0x61, 0x00, 0x08, 0x16, 0x01, 0xb7,
 	0x20, 0x00, 0x0f, 0x00, 0xfa, 0x10, 0x09, 0x0a,
-	0x33, 0x00, 0x09, 0x08, 0x20, 0x00, 0x0e, 0x00,
-	0xc6, 0x8c, 0xc7, 0xb4, 0x05, 0x00, 0xce, 0x0c,
-	0xcf, 0x34, 0xee, 0x00, 0xc5, 0x00, 0x09, 0x0a,
-	0xe9, 0x00, 0xe8, 0x04, 0x62, 0x00, 0x0b, 0x00,
-	0x01, 0xb6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0x33, 0x00, 0x09, 0x08, 0x20, 0x00, 0xee, 0x00,
+	0x09, 0x0a, 0xe9, 0x00, 0xe8, 0x04, 0x62, 0x00,
+	0x0b, 0x00, 0x01, 0xb6, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff};
+
+
+/* automatically generated file
+ * DO NOT EDIT
+ * edit firmware/filename.asm instead */
+
+unsigned char sc14421_III_sniff_scan_fw[] = {
+	0x01, 0x01, 0x20, 0x00, 0x0f, 0x00, 0xfa, 0x10,
+	0x09, 0x0a, 0x33, 0x00, 0x09, 0x08, 0x20, 0x00,
+	0xee, 0x00, 0x09, 0x0a, 0xe9, 0x00, 0xe8, 0x00,
+	0x62, 0x00, 0x0b, 0x00, 0x0f, 0x20, 0x02, 0x41,
+	0x02, 0x50, 0xa6, 0x00, 0x09, 0xfa, 0xea, 0x60,
+	0xed, 0x42, 0x28, 0x00, 0x09, 0x40, 0x26, 0x00,
+	0x29, 0x00, 0x08, 0x14, 0x03, 0x1e, 0x20, 0x00,
+	0x09, 0x16, 0x01, 0x0f, 0x08, 0x17, 0xea, 0x00,
+	0x02, 0x23, 0x61, 0x00, 0x01, 0x0f, 0x02, 0x50,
+	0x02, 0x31, 0x09, 0x01, 0x2d, 0x0e, 0x09, 0xff,
+	0x09, 0x49, 0xed, 0x01, 0xec, 0x22, 0x39, 0x00,
+	0x09, 0x07, 0x20, 0x00, 0xa4, 0x00, 0x08, 0x01,
+	0x04, 0x00, 0xa7, 0x00, 0xec, 0x01, 0x09, 0x01,
+	0x0a, 0x00, 0x08, 0x01, 0x09, 0x05, 0x27, 0x00,
+	0x09, 0x0e, 0x29, 0x00, 0x2c, 0x00, 0x09, 0x0d,
+	0xed, 0x02, 0x09, 0x20, 0x3f, 0x06, 0x09, 0x3d,
+	0x04, 0x00, 0x0b, 0x00, 0x09, 0x01, 0x09, 0x01,
+	0xb9, 0x4a, 0x09, 0x09, 0xa9, 0x00, 0x02, 0x5a,
+	0xb9, 0x4b, 0x09, 0x11, 0xa9, 0x00, 0x02, 0x5a,
+	0xb9, 0x4d, 0x09, 0x19, 0xa9, 0x00, 0x04, 0x00,
+	0x02, 0x5a, 0x01, 0x53, 0x02, 0x5d, 0x20, 0x00,
+	0x33, 0x58, 0x09, 0x08, 0xa6, 0x00, 0xed, 0x04,
+	0x09, 0xd0, 0x04, 0x00, 0xa5, 0x00, 0xa4, 0x00,
+	0x04, 0x00, 0xa5, 0x00, 0x04, 0x00, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff};
+
+
+/* automatically generated file
+ * DO NOT EDIT
+ * edit firmware/filename.asm instead */
+
+unsigned char sc14421_III_sniff_sync_fw[] = {
+	0x01, 0x01, 0x01, 0xd3, 0x0d, 0x00, 0x0f, 0x20,
+	0x08, 0x02, 0x0f, 0x30, 0x08, 0x02, 0x0f, 0x40,
+	0x08, 0x02, 0x0f, 0x50, 0x08, 0x02, 0x0f, 0x60,
+	0x08, 0x02, 0x0f, 0x70, 0x08, 0x02, 0x61, 0x00,
+	0x0f, 0x80, 0x08, 0x02, 0x0f, 0x90, 0x08, 0x02,
+	0x0f, 0xa0, 0x08, 0x02, 0x0f, 0xb0, 0x08, 0x02,
+	0x0f, 0xc0, 0x08, 0x02, 0x0f, 0xd0, 0x08, 0x02,
+	0x6f, 0x00, 0xed, 0x80, 0x01, 0x02, 0x02, 0x9e,
+	0x02, 0xad, 0x01, 0x24, 0x02, 0x9e, 0x02, 0xaf,
+	0x02, 0x51, 0x09, 0x01, 0x2d, 0x0e, 0x02, 0x61,
+	0x01, 0x48, 0x02, 0x9e, 0x02, 0xad, 0x01, 0x2e,
+	0x02, 0x9e, 0x02, 0xaf, 0x02, 0x51, 0x01, 0x8d,
+	0x02, 0x9e, 0x02, 0xad, 0x01, 0x35, 0x02, 0x9e,
+	0x02, 0xaf, 0x02, 0x66, 0x09, 0x01, 0x25, 0x0e,
+	0x02, 0x77, 0x01, 0x4b, 0x02, 0x9e, 0x02, 0xaf,
+	0x02, 0x66, 0x09, 0x01, 0x34, 0x0e, 0x02, 0x7a,
+	0x01, 0x4a, 0x02, 0x9e, 0x02, 0xad, 0x01, 0x46,
+	0x02, 0x9e, 0x02, 0xaf, 0x02, 0x66, 0x01, 0x96,
+	0x39, 0x00, 0x09, 0x07, 0x20, 0x00, 0xa4, 0x00,
+	0x08, 0x01, 0x04, 0x00, 0x20, 0x00, 0xa4, 0x00,
+	0x01, 0x4d, 0xa7, 0x00, 0xec, 0x01, 0x09, 0x01,
+	0x0a, 0x00, 0x08, 0x01, 0x09, 0x05, 0x27, 0x00,
+	0x09, 0x0e, 0x29, 0x00, 0x2c, 0x00, 0x09, 0x0d,
+	0xed, 0x02, 0x09, 0x20, 0x3f, 0x06, 0x09, 0x3d,
+	0x04, 0x00, 0x09, 0xf9, 0x09, 0x4f, 0xed, 0x01,
+	0xec, 0x26, 0x04, 0x00, 0xa7, 0x00, 0x09, 0x02,
+	0x0a, 0x00, 0x20, 0x00, 0x33, 0x50, 0x09, 0x08,
+	0x08, 0x01, 0x09, 0x04, 0xed, 0x40, 0x09, 0x03,
+	0xed, 0x10, 0x09, 0x03, 0x21, 0x00, 0x09, 0x1f,
+	0x37, 0x06, 0x09, 0x3d, 0x04, 0x00, 0x09, 0xf9,
+	0x09, 0x54, 0x20, 0x00, 0xec, 0x10, 0x09, 0x08,
+	0xec, 0x44, 0x04, 0x00, 0x27, 0x00, 0x09, 0x0f,
+	0x26, 0x00, 0x09, 0x3d, 0x04, 0x00, 0x09, 0x3d,
+	0x02, 0x7e, 0x02, 0x7e, 0x02, 0x7e, 0x02, 0x7e,
+	0x02, 0x7e, 0x09, 0x01, 0x27, 0x00, 0x09, 0x0b,
+	0x04, 0x00, 0x3c, 0x0e, 0x02, 0x83, 0x09, 0x03,
+	0x2b, 0x00, 0x09, 0x06, 0x02, 0x63, 0x39, 0x00,
+	0x09, 0x06, 0x01, 0x4e, 0x34, 0x0e, 0x09, 0x03,
+	0x02, 0x83, 0x24, 0x00, 0x09, 0x0d, 0x20, 0x00,
+	0x02, 0x7a, 0x01, 0x4e, 0x0b, 0x00, 0x09, 0x01,
+	0x09, 0x01, 0xb9, 0x4a, 0x09, 0x09, 0xa9, 0x00,
+	0x02, 0xb7, 0xb9, 0x4b, 0x09, 0x11, 0xa9, 0x00,
+	0x02, 0xb7, 0xb9, 0x4d, 0x09, 0x19, 0xa9, 0x00,
+	0x04, 0x00, 0x02, 0xb7, 0x01, 0xb0, 0x02, 0xba,
+	0x20, 0x00, 0x33, 0x58, 0x09, 0x08, 0xa6, 0x00,
+	0xed, 0x04, 0x09, 0xd0, 0x04, 0x00, 0xa5, 0x00,
+	0xa4, 0x00, 0x04, 0x00, 0xa5, 0x00, 0x04, 0x00,
+	0x0f, 0x20, 0x02, 0x9e, 0x02, 0xad, 0xa6, 0x00,
+	0x09, 0xfa, 0xea, 0x60, 0xed, 0x02, 0x28, 0x00,
+	0x09, 0x40, 0x26, 0x00, 0x29, 0x00, 0x08, 0x14,
+	0x03, 0xcd, 0x20, 0x00, 0x6b, 0x00, 0x08, 0x17,
+	0x01, 0xbd, 0x08, 0x17, 0xea, 0x00, 0x02, 0x1f,
+	0x61, 0x00, 0x08, 0x16, 0x01, 0xbd, 0x20, 0x00,
+	0x0f, 0x00, 0xfa, 0x10, 0x09, 0x0a, 0x33, 0x00,
+	0x09, 0x08, 0x20, 0x00, 0xee, 0x00, 0x09, 0x0a,
+	0xe9, 0x00, 0xe8, 0x00, 0x62, 0x00, 0x0b, 0x00,
+	0x01, 0xbc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
diff --git a/com-on-air_cs-linux/sc14421_firmware.h b/com-on-air_cs-linux/sc14421_firmware.h
index b9939e2..046d8fc 100644
--- a/com-on-air_cs-linux/sc14421_firmware.h
+++ b/com-on-air_cs-linux/sc14421_firmware.h
@@ -6,33 +6,66 @@ extern unsigned char sc14421_II_sniff_scan_fw[509];
 /* Ende Includefile für C-Programm */
 extern unsigned char sc14421_II_sniff_sync_fw[509];
 /* sc14421_II_sniff_sync.asm-Includefile für C-Programm */
-#define PP0 0x4
-#define PP2 0x6
-#define PP4 0x8
-#define PP6 0xA
-#define PP8 0xC
-#define PP10 0xE
-#define PP12 0x11
-#define PP14 0x13
-#define PP16 0x15
-#define PP18 0x17
-#define PP20 0x19
-#define PP22 0x1B
-#define JP0 0x3
-#define JP2 0x5
-#define JP4 0x7
-#define JP6 0x9
-#define JP8 0xB
-#define JP10 0xD
-#define JP12 0x10
-#define JP14 0x12
-#define JP16 0x14
-#define JP18 0x16
-#define JP20 0x18
-#define JP22 0x1A
-#define sync_label_D1 0xC8
-#define sync_label_D4 0xCB
-#define sync_label_28 0x1F
+#define PP0II 0x4
+#define PP2II 0x6
+#define PP4II 0x8
+#define PP6II 0xA
+#define PP8II 0xC
+#define PP10II 0xE
+#define PP12II 0x11
+#define PP14II 0x13
+#define PP16II 0x15
+#define PP18II 0x17
+#define PP20II 0x19
+#define PP22II 0x1B
+#define JP0II 0x3
+#define JP2II 0x5
+#define JP4II 0x7
+#define JP6II 0x9
+#define JP8II 0xB
+#define JP10II 0xD
+#define JP12II 0x10
+#define JP14II 0x12
+#define JP16II 0x14
+#define JP18II 0x16
+#define JP20II 0x18
+#define JP22II 0x1A
+#define RecvNextII 0xC8
+#define PPFoundII 0xCB
+#define RecvII 0x1F
+/* Ende Includefile für C-Programm */
+extern unsigned char sc14421_III_sniff_scan_fw[509];
+/* sc14421_III_sniff_scan.asm-Includefile für C-Programm */
+/* Ende Includefile für C-Programm */
+extern unsigned char sc14421_III_sniff_sync_fw[509];
+/* sc14421_III_sniff_sync.asm-Includefile für C-Programm */
+#define PP0III 0x4
+#define PP2III 0x6
+#define PP4III 0x8
+#define PP6III 0xA
+#define PP8III 0xC
+#define PP10III 0xE
+#define PP12III 0x11
+#define PP14III 0x13
+#define PP16III 0x15
+#define PP18III 0x17
+#define PP20III 0x19
+#define PP22III 0x1B
+#define JP0III 0x3
+#define JP2III 0x5
+#define JP4III 0x7
+#define JP6III 0x9
+#define JP8III 0xB
+#define JP10III 0xD
+#define JP12III 0x10
+#define JP14III 0x12
+#define JP16III 0x14
+#define JP18III 0x16
+#define JP20III 0x18
+#define JP22III 0x1A
+#define RecvNextIII 0xCF
+#define PPFoundIII 0xD2
+#define RecvIII 0x1F
 /* Ende Includefile für C-Programm */
 
 #endif
diff --git a/com-on-air_cs-linux/sc14421_sniffer.c b/com-on-air_cs-linux/sc14421_sniffer.c
index d325916..c1d764b 100644
--- a/com-on-air_cs-linux/sc14421_sniffer.c
+++ b/com-on-air_cs-linux/sc14421_sniffer.c
@@ -24,30 +24,18 @@
 
 
 /* dip config register control */
-unsigned char scan_init1[] = {0x27,0x00,0xff,0x00,0x5f,0x04,0x00};
-unsigned char scan_init2[] = {0xc2,0x05,0x00,0x03,0x00,0x00};
+unsigned char dip_ctrl[] = {0xc2,0x05,0x00,0x03,0x00,0x00};
 
-/* hf register type II card */
-unsigned char radio_II_chan[] = {0x54,0x80,0x09/* patch */,0xa0,0x00,0x00};
-/* hf register type III card */
-unsigned char scan_III_init3[] = {0x54,0x80,0x09/* patch */,0xa0,0x00,0x00};
+/* rf register type II card */
+unsigned char radio_II_chan[]  = {0x54,0x80,0x09/* patch */,0xa0,0x00,0x00};
+/* rf register type III card */
+unsigned char radio_III_chan[] = {0x32,0x20,0x28,0x01,0xc1,0x1b};
 
-/* hf register */
-unsigned char scan_init4[] = {0x15,0xa0,0xff,0x00/* &0x3f */,0x5f,0x04,0x00};
+/* dip register */
+unsigned char dip_register[] = {0x15,0xa0,0xff,0x00/* &0x3f */,0x5f,0x04,0x00};
 
 /* dip control */
-unsigned char scan_init5[] = {0x27,0x00,0xff,0x00,0x5f,0x05,0x00};
-
-/* dip control */
-unsigned char sync_init1[] = {0x27,0x00,0xff,0x00,0x5f,0x04,0x00};
-unsigned char sync_init2[] = {0xc2,0x05,0x00,0x03,0x00,0x00};
-
-/* hf register type III card */
-unsigned char sync_III_init3[] = {0x54,0x80,0x09/* patch */,0xa0,0x00,0x00};
-/* hf register */
-unsigned char sync_init4[] = {0x15,0xa0,0xff,0x00/* &0x3f */,0x5f,0x04,0x00};
-/* dip control */
-unsigned char sync_init5[] = {0x27,0x00,0xff,0x00,0x5f,0x05,0x00};
+unsigned char dip_mode_fp_pp[] = {0x27,0x00,0xff,0x00,0x5f,0x05,0x00};
 
 
 unsigned char fppacket[53] = {0xAA,0xAA,0xAA,0xE9,0x8A};
@@ -57,32 +45,32 @@ unsigned char pppacket[53] = {0x55,0x55,0x55,0x16,0x75};
 /* FIXME:auto-generate all this stuff */
 
 int sync_jumptable[] = {
-	 JP0, 0,
-	 JP2, 0,
-	 JP4, 0,
-	 JP6, 0,
-	 JP8, 0,
-	JP10, 0,
-	JP12, 0,
-	JP14, 0,
-	JP16, 0,
-	JP18, 0,
-	JP20, 0,
-	JP22, 0
+	 JP0II, 0,
+	 JP2II, 0,
+	 JP4II, 0,
+	 JP6II, 0,
+	 JP8II, 0,
+	JP10II, 0,
+	JP12II, 0,
+	JP14II, 0,
+	JP16II, 0,
+	JP18II, 0,
+	JP20II, 0,
+	JP22II, 0
 };
 int sync_patchtable[] = {
-	 PP0, 0,
-	 PP2, 0,
-	 PP4, 0,
-	 PP6, 0,
-	 PP8, 0,
-	PP10, 0,
-	PP12, 0,
-	PP14, 0,
-	PP16, 0,
-	PP18, 0,
-	PP20, 0,
-	PP22, 0
+	 PP0II, 0,
+	 PP2II, 0,
+	 PP4II, 0,
+	 PP6II, 0,
+	 PP8II, 0,
+	PP10II, 0,
+	PP12II, 0,
+	PP14II, 0,
+	PP16II, 0,
+	PP18II, 0,
+	PP20II, 0,
+	PP22II, 0
 };
 /* FIXME:end */
 
@@ -139,90 +127,106 @@ void sniffer_init(struct coa_info *dev)
 	}
 }
 
-void set_channel(struct coa_info *dev, int ch)
+
+void set_channel(struct coa_info *dev, int ch, int sync_slot, int sync_frame, unsigned char dipmode , unsigned char bank)
 {
-	int channel;
+	int channel,memofs;
+        unsigned short *sc14421_base = dev->sc14421_base;
+
+//	printk("set channel:%u slot:%u frame#:%u dipmode:%u bank:%x\n",ch,sync_slot,sync_frame,dipmode,bank);
+
+	if ( (sync_slot/2) % 2)
+		memofs = 0x80;
+	else
+		memofs = 0x00;
+
+
 	if (ch<10)
 		channel = 10 - ch;
 	else
 		channel = ch;
 
+	SC14421_switch_to_bank(sc14421_base, dipmode | SC14421_RAMBANK0);
+	to_dip(sc14421_base + 0x10, dip_ctrl, ARRAY_SIZE(dip_ctrl));
+
+
+	SC14421_switch_to_bank(sc14421_base, dipmode | bank);
+
+	switch(dev->sniffer_config->snifftype)
+	{
+	case SNIFF_SYNC:
+		if (sync_slot > 11)
+		{
+			dip_mode_fp_pp[0] &= 0xFE;
+			dip_mode_fp_pp[6] = sync_frame;
+		}else{
+			dip_mode_fp_pp[0] |= 0x01;
+			dip_mode_fp_pp[6] = sync_frame;
+		}
+		break;
+	case SNIFF_SCANFP:
+		dip_mode_fp_pp[0] |= 0x01;
+		break;
+	case SNIFF_SCANPP:
+		dip_mode_fp_pp[0] &= 0xFE;
+		break;
+	default:
+		printk("ERROR: this snifftype is currently not "
+			"supported. please update the driver\n");
+	}
+
 	switch(dev->radio_type)
 	{
 	case COA_RADIO_TYPE_II:
-		radio_II_chan[0] =
-			(radio_II_chan[0] & 0xC1) |
-			(channel << 1);
+		radio_II_chan[0] = (radio_II_chan[0] & 0xC1) | (channel << 1);
+		dip_mode_fp_pp[0] &= 0xF7;
+		
+		to_dip(sc14421_base + memofs + 0x4A, radio_II_chan, ARRAY_SIZE(radio_II_chan));
+		break;
+	case COA_RADIO_TYPE_III:
+		radio_III_chan[2] = channel << 2;
+		dip_mode_fp_pp[0] |= 0x08;
+		to_dip(sc14421_base + memofs + 0x4A, radio_III_chan, ARRAY_SIZE(radio_III_chan));
 		break;
 	default:
 		printk("ERROR: this radio type is currently not "
 			"supported. please update the driver\n");
 	}
+
+	to_dip(sc14421_base + memofs + 0x58, dip_mode_fp_pp, ARRAY_SIZE(dip_mode_fp_pp));
+	to_dip(sc14421_base + memofs + 0x50, dip_register, ARRAY_SIZE(dip_register));
+
 }
 
 void sniffer_init_sniff_scan(struct coa_info *dev)
 {
 	volatile uint16_t *sc14421_base = dev->sc14421_base;
 
-/*	printk("loading sniff_scan firmware\n"); */
-
-	SC14421_switch_to_bank(
-		sc14421_base,
-		SC14421_DIPSTOPPED | SC14421_CODEBANK
-		);
-	to_dip(
-		sc14421_base,
-		sc14421_II_sniff_scan_fw,
-		ARRAY_SIZE(sc14421_II_sniff_scan_fw));
-
-	SC14421_clear_interrupt(sc14421_base);
+	/* printk("loading sniff_scan firmware"); */
 
-	set_channel(dev, dev->sniffer_config->channel);
+	SC14421_switch_to_bank(sc14421_base, SC14421_DIPSTOPPED | SC14421_CODEBANK);
 
-	if (dev->sniffer_config->snifftype == SNIFF_SCANPP)
-	{
-		scan_init1[0] &= 0xFE;
-		scan_init5[0] &= 0xFE;
-	}
-	else
+	switch(dev->radio_type)
 	{
-		scan_init1[0] |= 0x01;
-		scan_init5[0] |= 0x01;
+	case COA_RADIO_TYPE_II:
+		/* printk(" for type II\n"); */
+		to_dip(sc14421_base, sc14421_II_sniff_scan_fw, ARRAY_SIZE(sc14421_II_sniff_scan_fw));
+		break;
+	case COA_RADIO_TYPE_III:
+		/* printk(" for type III\n"); */
+		to_dip(sc14421_base, sc14421_III_sniff_scan_fw, ARRAY_SIZE(sc14421_III_sniff_scan_fw));
+		break;
+	default:
+		printk("ERROR: this radio type is currently not "
+			"supported. please update the driver\n");
 	}
 
-	SC14421_switch_to_bank(
-		sc14421_base,
-		SC14421_DIPSTOPPED | SC14421_RAMBANK0
-		);
-	to_dip(
-		sc14421_base + 0x00,
-		scan_init1,
-		ARRAY_SIZE(scan_init1));
-	to_dip(
-		sc14421_base + 0x10,
-		scan_init2,
-		ARRAY_SIZE(scan_init2)
-		);
-	SC14421_switch_to_bank(
-		sc14421_base,
-		SC14421_DIPSTOPPED | SC14421_RAMBANK1
-		);
-	to_dip(
-		sc14421_base + 0x4A,
-		radio_II_chan,
-		ARRAY_SIZE(radio_II_chan)
-		);
-	to_dip(
-		sc14421_base + 0x58,
-		scan_init5,
-		ARRAY_SIZE(scan_init5)
-		);
-	to_dip(
-		sc14421_base + 0x50,
-		scan_init4,
-		ARRAY_SIZE(scan_init4));
+	/* printk("clear interrupt\n"); */
+	SC14421_clear_interrupt(sc14421_base);
+
+	set_channel(dev, dev->sniffer_config->channel, -1, -1, SC14421_DIPSTOPPED, SC14421_RAMBANK1);
 
-/*	printk("starting dip\n"); */
+	/* printk("starting dip\n"); */
 	SC14421_switch_to_bank(sc14421_base, SC14421_RAMBANK0);
 
 }
@@ -232,64 +236,33 @@ void sniffer_init_sniff_sync(struct coa_info *dev)
 {
 	volatile uint16_t *sc14421_base = dev->sc14421_base;
 
-	printk("loading sniff_sync firmware\n");
+	/* printk("loading sniff_sync firmware"); */
 
-	SC14421_switch_to_bank(
-		sc14421_base,
-		SC14421_DIPSTOPPED | SC14421_CODEBANK
-		);
-	to_dip(
-		sc14421_base,
-		sc14421_II_sniff_sync_fw,
-		ARRAY_SIZE(sc14421_II_sniff_sync_fw));
+	SC14421_switch_to_bank(sc14421_base, SC14421_DIPSTOPPED | SC14421_CODEBANK);
+	switch(dev->radio_type)
+	{
+	case COA_RADIO_TYPE_II:
+		/* printk(" for type II\n"); */
+		to_dip(sc14421_base, sc14421_II_sniff_sync_fw, ARRAY_SIZE(sc14421_II_sniff_sync_fw));
+		break;
+	case COA_RADIO_TYPE_III:
+		/* printk(" for type III\n"); */
+		to_dip(sc14421_base, sc14421_III_sniff_sync_fw, ARRAY_SIZE(sc14421_III_sniff_sync_fw));
+		break;
+	default:
+		printk("ERROR: this radio type is currently not "
+			"supported. please update the driver\n");
+	}
 
-	printk("clear interrupt\n");
+	/* printk("clear interrupt\n"); */
 	SC14421_clear_interrupt(sc14421_base);
 
-	SC14421_switch_to_bank(
-		sc14421_base,
-		SC14421_DIPSTOPPED | SC14421_RAMBANK0
-		);
-	to_dip(
-		sc14421_base + 0x00,
-		sync_init1,
-		ARRAY_SIZE(sync_init1)
-		);
-	to_dip(
-		sc14421_base + 0x10,
-		sync_init2,
-		ARRAY_SIZE(sync_init2));
-
-	set_channel(dev, dev->sniffer_config->channel);
-
-	sync_init5[0] |= 0x01;
-
-
-	SC14421_switch_to_bank(
-		sc14421_base,
-		SC14421_DIPSTOPPED | SC14421_RAMBANK1
-		);
-	to_dip(
-		sc14421_base + 0x4A,
-		radio_II_chan,
-		ARRAY_SIZE(radio_II_chan)
-		);
-	to_dip(
-		sc14421_base + 0x58,
-		sync_init5,
-		ARRAY_SIZE(sync_init5)
-		);
-	to_dip(
-		sc14421_base + 0x50,
-		sync_init4,
-		ARRAY_SIZE(sync_init4)
-		);
+	set_channel(dev, dev->sniffer_config->channel, -1, -1, SC14421_DIPSTOPPED, SC14421_RAMBANK1);
 
 	dev->sniffer_config->status = 0;
 	sniffer_clear_slottable(dev->sniffer_config->slottable);
 
-
-	printk("starting dip\n");
+	/* printk("starting dip\n"); */
 	SC14421_switch_to_bank(sc14421_base, SC14421_RAMBANK0);
 
 }
@@ -329,10 +302,7 @@ void sniffer_sniff_scan_irq(struct coa_info *dev, int irq)
 		if ( (SC14421_READ(1) & 0xc0) == 0xc0) /* Checksum ok */
 		{
 			uint8_t rssi = SC14421_READ(0);
-			from_dip(
-				fppacket + 5,
-				sc14421_base + 6,
-				6);
+			from_dip(fppacket + 5, sc14421_base + 6, 6);
 
 			SC14421_WRITE(1, 0); /* Clear Checksum-Flag */
 
@@ -373,8 +343,8 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 		{
 #if 0
 			printk("N:");
-			for (r=0; r<16; r++)
-				printk("%.2x ", SC14421_READ(r));
+			for (i=0; i<16; i++)
+				printk("%.2x ", SC14421_READ(i));
 
 			printk("\n");
 #endif
@@ -382,27 +352,27 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 			{
 				SC14421_WRITE(1, 0); /* clear checksum flag */
 
-				from_dip(
-					fppacket + 5,
-					sc14421_base + 6,
-					6);
+				from_dip(fppacket + 5,sc14421_base + 6, 6);
 
 				if (dect_compare_RFPI(fppacket, config->RFPI))
-				{
+				{ 
 					printk("found station for sync\n");
-					config->status |=
-						SNIFF_STATUS_FOUNDSTATION;
-
-					SC14421_switch_to_bank(
-						sc14421_base,
-						SC14421_CODEBANK
-						);
-					SC14421_write_cmd(
-						sc14421_base,
-						sync_label_D4,
-						BR,
-						sync_label_D1
-						);
+					config->status |= SNIFF_STATUS_FOUNDSTATION;
+
+					SC14421_switch_to_bank(sc14421_base,SC14421_CODEBANK);
+
+					switch(dev->radio_type)
+					{
+					case COA_RADIO_TYPE_II:
+						SC14421_write_cmd(sc14421_base, PPFoundII, BR, RecvNextII);
+						break;
+					case COA_RADIO_TYPE_III:
+						SC14421_write_cmd(sc14421_base, PPFoundIII, BR, RecvNextIII);
+						break;
+					default:
+						printk("ERROR: this radio type is currently not "
+								"supported. please update the driver\n");
+					}
 				}
 			}
 		}
@@ -421,51 +391,41 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 			if ( (SC14421_READ(1) & 0xc0) == 0xc0) /* Checksum ok */
 			{
 				SC14421_WRITE(1, 0); /* clear checksum flag */
-				from_dip(
-					fppacket + 5,
-					sc14421_base + 6,
-					48);
+				from_dip(fppacket + 5, sc14421_base + 6, 48);
 
 				slot = dect_get_slot(fppacket);
 				if (slot != -1)
 				{
-					/* printk("station in slot %u\n", slot); */
+					printk("station in slot %u\n", slot);
 					config->status |= SNIFF_STATUS_INSYNC;
 					slot %= 12;
 					if (slot%2)
-						printk("slot not possible "
-							"with this firmware\n");
+						printk("slot not possible with this firmware\n");
 
 					config->slottable[slot].active = 1;
-					config->slottable[slot].channel =
-						config->channel;
-					config->slottable[slot].type =
-						DECT_SLOTTYPE_CARRIER;
+					config->slottable[slot].channel = config->channel;
+					config->slottable[slot].type = DECT_SLOTTYPE_CARRIER;
 					config->slottable[slot].errcnt = 0;
 
-					sniffer_sync_patchloop(
-						dev,
-						config->slottable,
-						SNIFF_SLOTPATCH_FP
-						);
-					sniffer_sync_patchloop(
-						dev,
-						config->slottable,
-						SNIFF_SLOTPATCH_PP
-						);
-
-					SC14421_switch_to_bank(
-						sc14421_base,
-						SC14421_CODEBANK
-						);
-					printk("set jump to %u\n",
-						sync_jumptable[slot]);
-					SC14421_write_cmd(
-						sc14421_base,
-						sync_label_D4,
-						BR,
-						sync_jumptable[slot]
-						);
+					sniffer_sync_patchloop(dev,config->slottable,SNIFF_SLOTPATCH_FP);
+					sniffer_sync_patchloop(dev,config->slottable,SNIFF_SLOTPATCH_PP);
+
+					SC14421_switch_to_bank(sc14421_base,SC14421_CODEBANK);
+
+					printk("set jump to %u\n",sync_jumptable[slot]);
+
+					switch(dev->radio_type)
+					{
+					case COA_RADIO_TYPE_II:
+						SC14421_write_cmd(sc14421_base,PPFoundII,BR,sync_jumptable[slot]);
+						break;
+					case COA_RADIO_TYPE_III:
+						SC14421_write_cmd(sc14421_base,PPFoundIII,BR,sync_jumptable[slot]);
+						break;
+					default:
+						printk("ERROR: this radio type is currently not "
+								"supported. please update the driver\n");
+					}
 
 					printk("we are in sync :)\n");
 
@@ -476,12 +436,8 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 					packet.slot = slot;
 					memcpy(packet.data, fppacket, 53);
 
-					packet.timestamp =
-						dev->irq_timestamp;
-					ret = kfifo_put(
-						dev->rx_fifo,
-						(unsigned char*) &packet,
-						sizeof(struct sniffed_packet));
+					packet.timestamp = dev->irq_timestamp;
+					ret = kfifo_put(dev->rx_fifo,(unsigned char*) &packet,sizeof(struct sniffed_packet));
 					if (ret <= 0)
 						printk("com_on_air_cs: rx fifo "
 							"full? kfifo_put() "
@@ -493,7 +449,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 	else
 	{
 		if ( (irq & 0x09) == 0x09)
-			printk("interrupt too slow , lost packets!\n");
+			printk("com_on_air-cs: interrupt processing too slow , lost packets!\n");
 
 		if (irq & 0x01)
 		{
@@ -502,53 +458,56 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 			{
 				if (config->slottable[a].active)
 				{
-					SC14421_switch_to_bank(
-						sc14421_base,
-						sync_banktable[a]);
+					SC14421_switch_to_bank(sc14421_base,sync_banktable[a]);
 
 					if ( (a/2) % 2)
 						memofs = 0x80;
 					else
 						memofs = 0x00;
 
-					if ( (SC14421_READ(1+memofs) & 0xc0) ==
-						0xc0) /* Checksum ok */
+#if 0
+						printk("F:");
+			        		for (i=0; i<16; i++)
+			        		        printk("%.2x ",(unsigned char) SC14421_READ(i+memofs));
+
+			        		printk("  : %.2x : %x\n", irq, a);
+#endif
+
+					if ( (SC14421_READ(1+memofs) & 0xc0) == 0xc0) /* Checksum ok */
 					{
 						struct sniffed_packet packet;
-/* fixing indention / coding style is useless beyond here
- * need to talk to krater about where to cut in functions
- * - mazzoo */
-						packet.rssi =
-							SC14421_READ(memofs);
-						packet.channel =
-							config->slottable[a].channel;
+						packet.rssi = SC14421_READ(memofs);
+						packet.bfok = ((SC14421_READ(1+memofs) & 0x03) == 0x03);
+						packet.channel = config->slottable[a].channel;
 						packet.slot = a;
-						packet.framenumber = config->framenumber;
-						memcpy(
-							packet.data,
-							fppacket,
-							5);
-						from_dip(
-							&packet.data[5],
-							sc14421_base+memofs+6,
-							48);
-
-						if (config->slottable[a].type ==
-							DECT_SLOTTYPE_SCAN)
-							/* we received data on a scan-slot , channel is incemented before , but we want hear the old channel */
+						memcpy(packet.data,fppacket,5);
+
+						from_dip(&packet.data[5],sc14421_base+memofs+6,	48);
+
+						if (config->slottable[a].type == DECT_SLOTTYPE_SCAN)
+							/* we received data on a scan-slot,
+							 * channel is incemented before,
+							 * but we want hear the old channel */
 						{
 							packet.channel--;
-							printk("slot in scanmode\n");
+							//printk("slot in scanmode\n");
 						}
 
-						if (dect_is_multiframe_number(packet.data))			/* if there was a multiframe number , then this packet was in frame 8 (0) */
+						if (dect_is_multiframe_number(packet.data))
+							/* if there was a multiframe number,
+							 * then this packet was in frame 8 (0) */
 						{
-							/* printk("found multiframe number\n");						 */
+							//printk("found multiframe number\n");
 							config->framenumber = 1;
 						}
 
 						/* if (dev->open) */
 						{
+							if(config->framenumber)
+								packet.framenumber = config->framenumber-1;
+							else
+								packet.framenumber = 7;
+
 							packet.timestamp = dev->irq_timestamp;
 							ret = kfifo_put(dev->rx_fifo, (unsigned char*) &packet, sizeof(struct sniffed_packet));
 							if (ret <= 0)
@@ -559,7 +518,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 
 
 
-#if 0 
+#if 0
 						printk("F:");
 			        		for (i=0; i<16; i++)
 			        		        printk("%.2x ", SC14421_READ(i+memofs));
@@ -573,7 +532,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 						{
 							config->updateppslots = 1;
 							config->updatefpslots = 1;
-							/* printk("new slot , must update slots\n"); */
+							//printk("new slot , must update slots\n");
 						}
 
 					}
@@ -583,7 +542,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 						{
 							config->updateppslots = 1;
 							config->updatefpslots = 1;
-							printk("died slot , must update slots\n");
+							//printk("1:died slot , must update slots\n");
 						}
 					}
 				}
@@ -591,7 +550,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 
 			if ( (!(irq & 0x08)) && (config->updatefpslots) )
 			{
-				/* printk("patching fp slots\n"); */
+				//printk("patching fp slots\n");
 				sniffer_sync_patchloop(dev, config->slottable, SNIFF_SLOTPATCH_FP);
 				config->updatefpslots = 0;
 			}
@@ -618,22 +577,29 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 						struct sniffed_packet packet;
 
 						packet.rssi = SC14421_READ(memofs);
-						/* FIXME DECT6.0 channels */
+						packet.bfok = ((SC14421_READ(1+memofs) & 0x03) == 0x03);
 						packet.channel = config->slottable[a].channel;
 						packet.slot = a;
-						packet.framenumber = config->framenumber;
 						memcpy(packet.data, pppacket, 5);
 						from_dip(&packet.data[5], sc14421_base+memofs+6, 48);
 						if (config->slottable[a].type == DECT_SLOTTYPE_SCAN)
 						{
 							packet.channel--;
-							printk("slot in scanmode\n");
+							//printk("slot in scanmode\n");
 						}
 
 						/* if (dev->open) */
 						{
+							if(config->framenumber)
+								packet.framenumber = config->framenumber-1;
+							else
+								packet.framenumber = 7;
+
 							packet.timestamp = dev->irq_timestamp;
-							ret = kfifo_put(dev->rx_fifo, (unsigned char*) &packet, sizeof(struct sniffed_packet));
+							ret = kfifo_put(
+								dev->rx_fifo,
+								(unsigned char*) &packet,
+								sizeof(struct sniffed_packet));
 							if (ret <= 0)
 							{
 								printk("com_on_air_cs: rx fifo full? kfifo_put() = %d\n", ret);
@@ -656,7 +622,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 						{
 							config->updateppslots = 1;
 							config->updatefpslots = 1;
-							/* printk("new slot , must update slots\n"); */
+							//printk("new slot , must update slots\n"); 
 						}
 
 					}
@@ -666,7 +632,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 						{
 							config->updateppslots = 1;
 							config->updatefpslots = 1;
-							/* printk("died slot , must update slots\n"); */
+							//printk("8:died slot , must update slots\n"); 
 						}
 					}
 
@@ -676,7 +642,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 
 			if ( (!(irq & 0x01)) && (config->updateppslots) )
 			{
-				/* printk("patching pp slots\n"); */
+				//printk("patching pp slots\n");
 				sniffer_sync_patchloop(dev, config->slottable, SNIFF_SLOTPATCH_PP);
 				config->updateppslots = 0;
 			}
@@ -685,7 +651,7 @@ void sniffer_sniff_sync_irq(struct coa_info *dev, int irq)
 			{
 				config->updateppslots = 1;
 				config->updatefpslots = 1;
-				/* printk("new slot , must update slots\n"); */
+				//printk("new slot , must update slots\n");
 			}
 
 			if (config->framenumber >= 7)
@@ -707,12 +673,17 @@ void sniffer_sync_patchloop(struct coa_info *dev, struct dect_slot_info *slottab
 	struct sniffer_cfg *config = dev->sniffer_config;
 	int memofs;
 
-
 	if (type == SNIFF_SLOTPATCH_PP)
 		offset = 12;
 
 	for (slot = offset; slot < (offset+12); slot++)
 	{
+
+		if ( (slot/2) % 2)
+			memofs = 0x80;
+		else
+			memofs = 0x00;
+
 		if (slottable[slot].update)
 		{
 			slottable[slot].update = 0;
@@ -731,46 +702,34 @@ void sniffer_sync_patchloop(struct coa_info *dev, struct dect_slot_info *slottab
 			if (slottable[slot].active)
 			{
 
-				set_channel(dev, slottable[slot].channel);
-
-				if (slot > 11)
-					sync_init5[0] &= 0xFE;
-				else
-					sync_init5[0] |= 0x01;
-
-				if ( (slot/2) % 2)
-					memofs = 0x80;
-				else
-					memofs = 0x00;
-
-				sync_init5[6] = config->framenumber%8;
-
-				SC14421_switch_to_bank(sc14421_base, sync_banktable[slot]);
+				set_channel(dev,slottable[slot].channel,slot,config->framenumber%8,0,sync_banktable[slot]);
 
-				to_dip(sc14421_base + 0x4A + memofs, radio_II_chan, ARRAY_SIZE(radio_II_chan));
-				to_dip(sc14421_base + 0x58 + memofs, sync_init5, ARRAY_SIZE(sync_init5));
-				to_dip(sc14421_base + 0x50 + memofs, sync_init4, ARRAY_SIZE(sync_init4));
-
-
-				/* printk("patching slot %u at addr %u\n", slot, sync_patchtable[slot]); */
+				// printk("patching slot %u at addr %u\n", slot, sync_patchtable[slot]);
 				SC14421_switch_to_bank(sc14421_base, SC14421_CODEBANK);
-				SC14421_write_cmd(sc14421_base, sync_patchtable[slot], JMP, sync_label_28);
 
-			}
-			else
-			{
+				switch(dev->radio_type)
+				{
+				case COA_RADIO_TYPE_II:
+					/* printk(" for type II\n"); */
+					SC14421_write_cmd(sc14421_base, sync_patchtable[slot], JMP, RecvII);
+					break;
+				case COA_RADIO_TYPE_III:
+					/* printk(" for type III\n"); */
+					SC14421_write_cmd(sc14421_base, sync_patchtable[slot], JMP, RecvIII);
+					break;
+				default:
+					printk("ERROR: this radio type is currently not "
+						"supported. please update the driver\n");
+				}
+
+			}else{
 				SC14421_switch_to_bank(sc14421_base, SC14421_CODEBANK);
 				SC14421_write_cmd(sc14421_base, sync_patchtable[slot], WNT, 2);
-				/* printk("patching addr %u for wait\n", sync_patchtable[slot]); */
+				// printk("patching addr %u for wait\n", sync_patchtable[slot]);
 			}
 		}
 		else if (slottable[slot].active && (slottable[slot].type == DECT_SLOTTYPE_CARRIER))
 		{
-			if ( (slot/2) % 2)
-				memofs = 0x80;
-			else
-				memofs = 0x00;
-
 			SC14421_switch_to_bank(sc14421_base, sync_banktable[slot]);
 			SC14421_WRITE(0x5e + memofs, config->framenumber%8);
 		}
@@ -789,3 +748,8 @@ void sniffer_clear_slottable(struct dect_slot_info *slottable)
 }
 
 
+
+
+
+
+
diff --git a/com-on-air_cs-linux/sc14421_sniffer.h b/com-on-air_cs-linux/sc14421_sniffer.h
index 5170397..3c14368 100644
--- a/com-on-air_cs-linux/sc14421_sniffer.h
+++ b/com-on-air_cs-linux/sc14421_sniffer.h
@@ -57,6 +57,7 @@ struct sniffed_packet
 	unsigned char     channel;
 	unsigned char     slot;
 	unsigned char     framenumber;
+	unsigned char     bfok;
 	struct timespec   timestamp;
 	unsigned char     data[53];
 };
diff --git a/com-on-air_cs-linux/tools/dect_cli.c b/com-on-air_cs-linux/tools/dect_cli.c
index fe07900..303f02e 100644
--- a/com-on-air_cs-linux/tools/dect_cli.c
+++ b/com-on-air_cs-linux/tools/dect_cli.c
@@ -382,6 +382,10 @@ void do_chan(char * str_chan)
 		LOG("!!! please enter a valid channel number [0-14]\n");
 		return;
 	}
+
+	if(channel<10)
+		channel = 9 - channel;
+
 	cli.channel = channel;
 	set_channel(cli.channel);
 }
diff --git a/com-on-air_cs-linux/tools/dect_cli.h b/com-on-air_cs-linux/tools/dect_cli.h
index a438fa8..7bb7333 100644
--- a/com-on-air_cs-linux/tools/dect_cli.h
+++ b/com-on-air_cs-linux/tools/dect_cli.h
@@ -41,6 +41,7 @@ struct sniffed_packet
 	unsigned char channel;
 	unsigned char slot;
 	unsigned char framenumber;
+	unsigned char bfok;
 	struct timespec   timestamp;
 	unsigned char data[53];
 };