JD 395 cx-10

for 5 bytes address:
00:  0x9BA7
01:  0x8BBB 
02:  0x85E1
03:  0x3E8C
04:  0x451E
05:  0x18E6
06:  0x6B24
07:  0xE7AB
08:  0x3828
09:  0x8148
10:  0xD461
11:  0xF494
12:  0x2503
13:  0x691D
14:  0xFE8B
15:  0x9BA7
16:  0x8B17
17:  0x2920
18:  0x8B5F
19:  0x61B1
20:  0xD391
21:  0x7401
22:  0x2138
23:  0x129F
24:  0xB3A0
25:  0x2988 -> maximum payload size for 5 bytes address with CRC enabled.
--
**:  0x3448 -> for 4 bytes address w/ 0 byte payload, or 3 bytes address w/ 1 byte payload

static const u16 xn297_crc_xorout[] = {
    0x0000, 0x3448, 0x9BA7, 0x8BBB, 0x85E1, 0x3E8C, 0x451E, 0x18E6, 
    0x6B24, 0xE7AB, 0x3828, 0x8148, 0xD461, 0xF494, 0x2503, 0x691D, 
    0xFE8B, 0x9BA7, 0x8B17, 0x2920, 0x8B5F, 0x61B1, 0xD391, 0x7401, 
    0x2138, 0x129F, 0xB3A0, 0x2988};

[snip]

    if (xn297_crc) {
        int offset = xn297_addr_len < 4 ? 1 : 0;
        u16 crc = initial;
        for (int i = offset; i < last; ++i) {
            crc = crc16_update(crc, buf[i]);
        }
        crc ^= xn297_crc_xorout[xn297_addr_len - 3 + len];  
        buf[last++] = crc >> 8;
       	buf[last++] = crc & 0xff;
    }

XN297_SetTXAddr(tx_addr, 5); // must do before SetRXAddr, even for RX only
XN297_SetRXAddr(tx_addr, 5);
NRF24L01_FlushRx();
NRF24L01_WriteReg(NRF24L01_11_RX_PW_P0, PAYLOAD_SIZE+2); // 15-byte payload + 2 bytes CRC
NRF24L01_SetTxRxMode(RX_EN); // must be called BEFORE XN297_Configure
// Power on, RX mode, 
//NRF24L01_00_EN_CRC tells the emulation layer to emulate crc checking, tbd
XN297_Configure( BV(NRF24L01_00_EN_CRC) | BV(NRF24L01_00_CRCO) 
	       | BV(NRF24L01_00_PWR_UP) | BV(NRF24L01_00_PRIM_RX)); 

while(!(NRF24L01_ReadReg(0x07) & 0x40)) {} // wait for RX FIFO data ready
XN297_ReadPayload(test_packet, PAYLOAD_SIZE+2);

u8 XN297_ReadPayload(u8 *msg, int len)
{
    u8 res = NRF24L01_ReadPayload(msg, len);
    for(u8 i=0; i<len; i++)
      msg[i] = bit_reverse(msg[i]) ^ bit_reverse(xn297_scramble[i+xn297_addr_len]);
    return res;
}