--- a/pirelli/fw-disasm	Tue Dec 26 00:56:55 2017 +0000
+++ b/pirelli/fw-disasm	Tue Dec 26 03:28:22 2017 +0000
@@ -481,6 +481,311 @@
    406d0:	1afffffb	bne	0x406c4
    406d4:	e8bd8001	ldmia	sp!, {r0, pc}
 
+  2e21bc:	b510		push	{r4, lr}
+  2e21be:	2400		mov	r4, #0
+  2e21c0:	489d		ldr	r0, =0x8036a8	; via 0x2e2438
+  2e21c2:	6800		ldr	r0, [r0, #0]
+  2e21c4:	2802		cmp	r0, #2
+  2e21c6:	d804		bhi	0x2e21d2
+  2e21c8:	f0d1 ff6d	bl	0x3b40a6
+  2e21cc:	2800		cmp	r0, #0
+  2e21ce:	d100		bne	0x2e21d2
+  2e21d0:	2401		mov	r4, #1
+  2e21d2:	1c20		add	r0, r4, #0
+  2e21d4:	bd10		pop	{r4, pc}
+
+$pwr_start_CI_charging:
+  2e21d6:	b510		push	{r4, lr}
+  2e21d8:	b083		sub	sp, #12	; 0xc
+  2e21da:	1c04		add	r4, r0, #0
+  2e21dc:	4997		ldr	r1, =0x1774b7a	; via 0x2e243c
+  2e21de:	2000		mov	r0, #0
+  2e21e0:	8008		strh	r0, [r1, #0]
+; start of MV100-matching code
+  2e21e2:	48f8		ldr	r0, =0xa0020	; via 0x2e25c4
+  2e21e4:	9000		str	r0, [sp, #0]
+  2e21e6:	a0f9		add	r0, pc, #996	; 0x3e4
+  2e21e8:	2111		mov	r1, #17	; 0x11
+  2e21ea:	2200		mov	r2, #0
+  2e21ec:	43d2		mvn	r2, r2
+  2e21ee:	2305		mov	r3, #5
+  2e21f0:	f0f8 fd20	bl	0x3dac34
+  2e21f4:	207d		mov	r0, #125	; 0x7d
+  2e21f6:	00c0		lsl	r0, r0, #3
+  2e21f8:	4344		mul	r4, r0
+  2e21fa:	1c20		add	r0, r4, #0
+  2e21fc:	4990		ldr	r1, =0x357	; via 0x2e2440
+  2e21fe:	f115 f815	bl	0x3f722c	; I$DIV
+  2e2202:	4668		mov	r0, sp
+  2e2204:	8101		strh	r1, [r0, #8]
+  2e2206:	2001		mov	r0, #1
+  2e2208:	213a		mov	r1, #58	; 0x3a
+  2e220a:	2202		mov	r2, #2
+  2e220c:	f066 fffe	bl	0x34920c
+  2e2210:	2001		mov	r0, #1
+  2e2212:	2132		mov	r1, #50	; 0x32
+  2e2214:	466a		mov	r2, sp
+  2e2216:	8912		ldrh	r2, [r2, #8]
+  2e2218:	f066 fff8	bl	0x34920c
+  2e221c:	2001		mov	r0, #1
+  2e221e:	213a		mov	r1, #58	; 0x3a
+  2e2220:	2203		mov	r2, #3
+  2e2222:	f066 fff3	bl	0x34920c
+  2e2226:	48e8		ldr	r0, =0x1774e70	; via 0x2e25c8
+  2e2228:	6800		ldr	r0, [r0, #0]
+  2e222a:	2102		mov	r1, #2
+  2e222c:	6041		str	r1, [r0, #4]
+; end of MV100-matching code
+  2e222e:	4985		ldr	r1, =0x17749b8	; via 0x2e2444
+  2e2230:	2001		mov	r0, #1
+  2e2232:	7008		strb	r0, [r1, #0]
+  2e2234:	b003		add	sp, #12	; 0xc
+  2e2236:	bd10		pop	{r4, pc}
+
+$pwr_start_CV_charging:
+  2e2238:	b510		push	{r4, lr}
+  2e223a:	b083		sub	sp, #12	; 0xc
+  2e223c:	1c04		add	r4, r0, #0
+  2e223e:	497f		ldr	r1, =0x1774b7a	; via 0x2e243c
+  2e2240:	2001		mov	r0, #1
+  2e2242:	8008		strh	r0, [r1, #0]
+  2e2244:	48df		ldr	r0, =0xa0020	; via 0x2e25c4
+  2e2246:	9000		str	r0, [sp, #0]
+  2e2248:	a0e5		add	r0, pc, #916	; 0x394
+  2e224a:	2111		mov	r1, #17	; 0x11
+  2e224c:	2200		mov	r2, #0
+  2e224e:	43d2		mvn	r2, r2
+  2e2250:	2305		mov	r3, #5
+  2e2252:	f0f8 fcef	bl	0x3dac34
+  2e2256:	3414		add	r4, #20	; 0x14
+  2e2258:	0420		lsl	r0, r4, #16
+  2e225a:	0c02		lsr	r2, r0, #16
+  2e225c:	497a		ldr	r1, =0x801746	; via 0x2e2448
+  2e225e:	2000		mov	r0, #0
+  2e2260:	5e08		ldrsh	r0, [r1, r0]
+  2e2262:	1a10		sub	r0, r2, r0
+  2e2264:	0280		lsl	r0, r0, #10
+  2e2266:	4979		ldr	r1, =0x801734	; via 0x2e244c
+  2e2268:	8809		ldrh	r1, [r1, #0]
+  2e226a:	f114 ffc7	bl	0x3f71fc
+  2e226e:	4668		mov	r0, sp
+  2e2270:	8101		strh	r1, [r0, #8]
+  2e2272:	8900		ldrh	r0, [r0, #8]
+  2e2274:	4976		ldr	r1, =0x17749ca	; via 0x2e2450
+  2e2276:	8008		strh	r0, [r1, #0]
+  2e2278:	4976		ldr	r1, =0x17749c6	; via 0x2e2454
+  2e227a:	8008		strh	r0, [r1, #0]
+  2e227c:	2000		mov	r0, #0
+  2e227e:	4976		ldr	r1, =0x17749c8	; via 0x2e2458
+  2e2280:	8008		strh	r0, [r1, #0]
+  2e2282:	4976		ldr	r1, =0x17749c0	; via 0x2e245c
+  2e2284:	8008		strh	r0, [r1, #0]
+  2e2286:	4a76		ldr	r2, =0x17749c4	; via 0x2e2460
+  2e2288:	2103		mov	r1, #3
+  2e228a:	8011		strh	r1, [r2, #0]
+  2e228c:	4975		ldr	r1, =0x17749c2	; via 0x2e2464
+  2e228e:	8008		strh	r0, [r1, #0]
+  2e2290:	4668		mov	r0, sp
+  2e2292:	8902		ldrh	r2, [r0, #8]
+  2e2294:	48cb		ldr	r0, =0xa0020	; via 0x2e25c4
+  2e2296:	9000		str	r0, [sp, #0]
+  2e2298:	a0d6		add	r0, pc, #856	; 0x358
+  2e229a:	2113		mov	r1, #19	; 0x13
+  2e229c:	2305		mov	r3, #5
+  2e229e:	f0f8 fcc9	bl	0x3dac34
+  2e22a2:	2001		mov	r0, #1
+  2e22a4:	213a		mov	r1, #58	; 0x3a
+  2e22a6:	2200		mov	r2, #0
+  2e22a8:	f066 ffb0	bl	0x34920c
+  2e22ac:	2001		mov	r0, #1
+  2e22ae:	2132		mov	r1, #50	; 0x32
+  2e22b0:	466a		mov	r2, sp
+  2e22b2:	8912		ldrh	r2, [r2, #8]
+  2e22b4:	f066 ffaa	bl	0x34920c
+  2e22b8:	2001		mov	r0, #1
+  2e22ba:	213a		mov	r1, #58	; 0x3a
+  2e22bc:	2201		mov	r2, #1
+  2e22be:	f066 ffa5	bl	0x34920c
+  2e22c2:	48c1		ldr	r0, =0x1774e70	; via 0x2e25c8
+  2e22c4:	6801		ldr	r1, [r0, #0]
+  2e22c6:	2003		mov	r0, #3
+  2e22c8:	6048		str	r0, [r1, #4]
+  2e22ca:	f04b ffbc	bl	0x32e246
+  2e22ce:	2002		mov	r0, #2
+  2e22d0:	f7cf fae5	bl	0x2b189e
+  2e22d4:	2001		mov	r0, #1
+  2e22d6:	2122		mov	r1, #34	; 0x22
+  2e22d8:	2200		mov	r2, #0
+  2e22da:	f066 ff97	bl	0x34920c
+  2e22de:	2002		mov	r0, #2
+  2e22e0:	f7cf fadd	bl	0x2b189e
+  2e22e4:	4857		ldr	r0, =0x17749b8	; via 0x2e2444
+  2e22e6:	2101		mov	r1, #1
+  2e22e8:	7001		strb	r1, [r0, #0]
+  2e22ea:	b003		add	sp, #12	; 0xc
+  2e22ec:	bd10		pop	{r4, pc}
+
+$pwr_stop_charging:
+  2e22ee:	b500		push	{lr}
+  2e22f0:	b082		sub	sp, #8
+  2e22f2:	48b4		ldr	r0, =0xa0020	; via 0x2e25c4
+  2e22f4:	9000		str	r0, [sp, #0]
+  2e22f6:	a0eb		add	r0, pc, #940	; 0x3ac
+  2e22f8:	2115		mov	r1, #21	; 0x15
+  2e22fa:	2200		mov	r2, #0
+  2e22fc:	43d2		mvn	r2, r2
+  2e22fe:	2305		mov	r3, #5
+  2e2300:	f0f8 fc98	bl	0x3dac34
+  2e2304:	2001		mov	r0, #1
+  2e2306:	213a		mov	r1, #58	; 0x3a
+  2e2308:	2200		mov	r2, #0
+  2e230a:	f066 ff7f	bl	0x34920c
+  2e230e:	48ae		ldr	r0, =0x1774e70	; via 0x2e25c8
+  2e2310:	6800		ldr	r0, [r0, #0]
+  2e2312:	2100		mov	r1, #0
+  2e2314:	6041		str	r1, [r0, #4]
+; additional code beyond MV100 version
+  2e2316:	48bc		ldr	r0, =0x1774b78	; via 0x2e2608
+  2e2318:	80c1		strh	r1, [r0, #6]
+  2e231a:	8101		strh	r1, [r0, #8]
+  2e231c:	4849		ldr	r0, =0x17749b8	; via 0x2e2444
+  2e231e:	7001		strb	r1, [r0, #0]
+  2e2320:	b002		add	sp, #8
+  2e2322:	bd00		pop	{pc}
+
+$pwr_current_loop_cal:
+  2e2324:	b500		push	{lr}
+  2e2326:	b082		sub	sp, #8
+; "Current loop calibration" trace
+  2e2328:	48a6		ldr	r0, =0xa0020	; via 0x2e25c4
+  2e232a:	9000		str	r0, [sp, #0]
+  2e232c:	a0e3		add	r0, pc, #908	; 0x38c
+  2e232e:	2118		mov	r1, #24	; 0x18
+  2e2330:	2200		mov	r2, #0
+  2e2332:	43d2		mvn	r2, r2
+  2e2334:	2305		mov	r3, #5
+  2e2336:	f0f8 fc7d	bl	0x3dac34
+; same as MV100 version
+  2e233a:	2001		mov	r0, #1
+  2e233c:	213a		mov	r1, #58	; 0x3a
+  2e233e:	2210		mov	r2, #16	; 0x10
+  2e2340:	f066 ff64	bl	0x34920c
+  2e2344:	2001		mov	r0, #1
+  2e2346:	213a		mov	r1, #58	; 0x3a
+  2e2348:	2219		mov	r2, #25	; 0x19
+  2e234a:	f066 ff5f	bl	0x34920c
+; TIMER0 run for 22 ticks (probably 100 ms intended)
+  2e234e:	2000		mov	r0, #0
+  2e2350:	2116		mov	r1, #22	; 0x16
+  2e2352:	2200		mov	r2, #0
+  2e2354:	f048 fd90	bl	0x32ae78
+  2e2358:	b002		add	sp, #8
+  2e235a:	bd00		pop	{pc}
+
+$pwr_calibration_process:
+  2e235c:	b500		push	{lr}
+  2e235e:	2138		mov	r1, #56	; 0x38
+  2e2360:	4899		ldr	r0, =0x1774e70	; via 0x2e25c8
+  2e2362:	6800		ldr	r0, [r0, #0]
+  2e2364:	5e08		ldrsh	r0, [r1, r0]
+  2e2366:	f04b fbda	bl	0x32db1e	; $pwr_bat_temp_within_limits
+  2e236a:	2800		cmp	r0, #0
+  2e236c:	d111		bne	0x2e2392
+; failure code path
+  2e236e:	2000		mov	r0, #0
+  2e2370:	f0b2 fda7	bl	0x394ec2
+  2e2374:	2132		mov	r1, #50	; 0x32
+  2e2376:	48ca		ldr	r0, =0x1774e38	; via 0x2e26a0
+  2e2378:	6800		ldr	r0, [r0, #0]
+  2e237a:	5c08		ldrb	r0, [r1, r0]
+  2e237c:	2800		cmp	r0, #0
+  2e237e:	d105		bne	0x2e238c
+  2e2380:	2001		mov	r0, #1
+  2e2382:	213c		mov	r1, #60	; 0x3c
+  2e2384:	2201		mov	r2, #1
+  2e2386:	f066 ff41	bl	0x34920c
+  2e238a:	bd00		pop	{pc}
+  2e238c:	f0d1 fc11	bl	0x3b3bb2
+  2e2390:	bd00		pop	{pc}
+; good path
+  2e2392:	488d		ldr	r0, =0x1774e70	; via 0x2e25c8
+  2e2394:	6801		ldr	r1, [r0, #0]
+  2e2396:	2005		mov	r0, #5
+  2e2398:	6308		str	r0, [r1, #48]	; 0x30
+  2e239a:	f7ff ffc3	bl	0x2e2324	; $pwr_current_loop_cal
+  2e239e:	bd00		pop	{pc}
+
+$pwr_battery_qualification:
+  2e23a0:	b500		push	{lr}
+  2e23a2:	b082		sub	sp, #8
+; "Battery qualification" trace
+  2e23a4:	4887		ldr	r0, =0xa0020	; via 0x2e25c4
+  2e23a6:	9000		str	r0, [sp, #0]
+  2e23a8:	a0cb		add	r0, pc, #812	; 0x32c
+  2e23aa:	2115		mov	r1, #21	; 0x15
+  2e23ac:	2200		mov	r2, #0
+  2e23ae:	43d2		mvn	r2, r2
+  2e23b0:	2305		mov	r3, #5
+  2e23b2:	f0f8 fc3f	bl	0x3dac34
+; pwr_env_ctrl_blk->timer0_state = BATTERY_SHORT_TEST;
+  2e23b6:	4884		ldr	r0, =0x1774e70	; via 0x2e25c8
+  2e23b8:	6800		ldr	r0, [r0, #0]
+  2e23ba:	2101		mov	r1, #1
+  2e23bc:	6301		str	r1, [r0, #48]	; 0x30
+; CONSTANT_CURRENT_VALUE = 522 mA
+  2e23be:	4893		ldr	r0, =0x20a	; via 0x2e260c
+  2e23c0:	f7ff ff09	bl	0x2e21d6	; $pwr_start_CI_charging
+; TIMER0 to 300 ms
+  2e23c4:	2000		mov	r0, #0
+  2e23c6:	2141		mov	r1, #65	; 0x41
+  2e23c8:	2200		mov	r2, #0
+  2e23ca:	f048 fd55	bl	0x32ae78
+  2e23ce:	b002		add	sp, #8
+  2e23d0:	bd00		pop	{pc}
+
+$pwr_start_fast_charge:
+  2e23d2:	b500		push	{lr}
+  2e23d4:	f0b2 fcca	bl	0x394d6c	; $pwr_send_CI_charge_start_event ?
+  2e23d8:	2001		mov	r0, #1
+  2e23da:	2138		mov	r1, #56	; 0x38
+  2e23dc:	2201		mov	r2, #1
+  2e23de:	f066 ff15	bl	0x34920c
+  2e23e2:	4817		ldr	r0, =0x357	; via 0x2e2440
+  2e23e4:	4978		ldr	r1, =0x1774e70	; via 0x2e25c8
+  2e23e6:	6809		ldr	r1, [r1, #0]
+  2e23e8:	8909		ldrh	r1, [r1, #8]
+  2e23ea:	4348		mul	r0, r1
+  2e23ec:	217d		mov	r1, #125	; 0x7d
+  2e23ee:	00c9		lsl	r1, r1, #3
+  2e23f0:	f114 ff1c	bl	0x3f722c	; I$DIV
+; diff from MV100 version begins
+  2e23f4:	0408		lsl	r0, r1, #16
+  2e23f6:	0c00		lsr	r0, r0, #16
+  2e23f8:	f113 ff88	bl	0x3f630c	; U$TOFD
+  2e23fc:	a2bc		add	r2, pc, #752	; 0x2f0
+  2e23fe:	ca0c		ldmia	r2!, {r2, r3}
+  2e2400:	f101 fb1d	bl	0x3e3a3e	; FD$ADD
+  2e2404:	f112 fd5a	bl	0x3f4ebc	; FD$TOU
+  2e2408:	0400		lsl	r0, r0, #16
+  2e240a:	0c00		lsr	r0, r0, #16
+  2e240c:	f7ff fee3	bl	0x2e21d6	; $pwr_start_CI_charging
+  2e2410:	f04b ff19	bl	0x32e246
+  2e2414:	2002		mov	r0, #2
+  2e2416:	f7cf fa42	bl	0x2b189e	; rvf_delay()
+  2e241a:	2001		mov	r0, #1
+  2e241c:	2122		mov	r1, #34	; 0x22
+  2e241e:	2200		mov	r2, #0
+  2e2420:	f066 fef4	bl	0x34920c	; $ABB_Write_Register_on_page
+  2e2424:	2002		mov	r0, #2
+  2e2426:	f7cf fa3a	bl	0x2b189e
+; same TIMER1 setting as in MV100
+  2e242a:	2001		mov	r0, #1
+  2e242c:	49b2		ldr	r1, =0x363	; via 0x2e26f8
+  2e242e:	2200		mov	r2, #0
+  2e2430:	f048 fd22	bl	0x32ae78
+  2e2434:	bd00		pop	{pc}
+  2e2436:	46c0		nop			(mov r8, r8)
+
 $l1_abb_power_on:
   31c036:	b510		push	{r4, lr}
   31c038:	b084		sub	sp, #16	; 0x10
@@ -4297,9 +4602,16 @@
 
 0x17741e0:	abb_sem
 
+0x17749b8:	8-bit var zeroed in pwr_stop_charging(), set to 1 in
+		pwr_start_CI_charging() and pwr_start_CV_charging()
+
 0x1774b78:	16-bit var, gets -4 written into it if the battery T
 		is too high, or -5 if it is too low
+0x1774b7a:	16-bit var set to 0 when starting CI charging,
+		set to 1 when starting CV charging
 0x1774b7c:	16-bit var battery voltage in mV
+0x1774b7e:	16-bit var zeroed in pwr_stop_charging()
+0x1774b80:	16-bit var zeroed in pwr_stop_charging()
 
 0x1774ccc:	16-bit var initial battery % is stored here