--- a/pirelli/fw-disasm	Fri Dec 22 23:26:41 2017 +0000
+++ b/pirelli/fw-disasm	Sat Dec 23 01:13:07 2017 +0000
@@ -762,6 +762,210 @@
   3bba2e:	f484 fc2d	bl	0x4028c		; $INT_EnableIRQ
   3bba32:	bd00		pop	{pc}
 
+$spi_get_info:
+; perfect match to TCS211 version
+  3cd72c:	b500		push	{lr}
+  3cd72e:	b081		sub	sp, #4
+  3cd730:	9000		str	r0, [sp, #0]
+  3cd732:	9900		ldr	r1, [sp, #0]
+  3cd734:	2003		mov	r0, #3
+  3cd736:	6008		str	r0, [r1, #0]
+  3cd738:	9800		ldr	r0, [sp, #0]
+  3cd73a:	497e		ldr	r1, =0xa0010	; via 0x3cd934
+  3cd73c:	6101		str	r1, [r0, #16]	; 0x10
+  3cd73e:	9800		ldr	r0, [sp, #0]
+  3cd740:	3004		add	r0, #4
+  3cd742:	a153		add	r1, pc, #332	; 0x14c
+  3cd744:	2204		mov	r2, #4
+  3cd746:	f029 fd79	bl	0x3f723c	; memcpy()
+  3cd74a:	9900		ldr	r1, [sp, #0]
+  3cd74c:	207d		mov	r0, #125	; 0x7d
+  3cd74e:	00c0		lsl	r0, r0, #3
+  3cd750:	8288		strh	r0, [r1, #20]	; 0x14
+  3cd752:	9900		ldr	r1, [sp, #0]
+  3cd754:	2027		mov	r0, #39	; 0x27
+  3cd756:	7588		strb	r0, [r1, #22]	; 0x16
+  3cd758:	9900		ldr	r1, [sp, #0]
+  3cd75a:	2001		mov	r0, #1
+  3cd75c:	7708		strb	r0, [r1, #28]	; 0x1c
+  3cd75e:	9800		ldr	r0, [sp, #0]
+  3cd760:	3020		add	r0, #32	; 0x20
+  3cd762:	a14c		add	r1, pc, #304	; 0x130
+  3cd764:	2209		mov	r2, #9
+  3cd766:	f029 fd69	bl	0x3f723c	; memcpy()
+  3cd76a:	9900		ldr	r1, [sp, #0]
+  3cd76c:	20ff		mov	r0, #255	; 0xff
+  3cd76e:	3001		add	r0, #1
+  3cd770:	62c8		str	r0, [r1, #44]	; 0x2c
+  3cd772:	9900		ldr	r1, [sp, #0]
+  3cd774:	20c8		mov	r0, #200	; 0xc8
+  3cd776:	6308		str	r0, [r1, #48]	; 0x30
+  3cd778:	205c		mov	r0, #92	; 0x5c
+  3cd77a:	9900		ldr	r1, [sp, #0]
+  3cd77c:	2200		mov	r2, #0
+  3cd77e:	5442		strb	r2, [r0, r1]
+; spi_set_info
+  3cd780:	2090		mov	r0, #144	; 0x90
+  3cd782:	9900		ldr	r1, [sp, #0]
+  3cd784:	4a6c		ldr	r2, =0x3cd7bd	; via 0x3cd938
+  3cd786:	5042		str	r2, [r0, r1]
+; spi_init
+  3cd788:	2094		mov	r0, #148	; 0x94
+  3cd78a:	9900		ldr	r1, [sp, #0]
+  3cd78c:	4a6b		ldr	r2, =0x3cd883	; via 0x3cd93c
+  3cd78e:	5042		str	r2, [r0, r1]
+; spi_core
+  3cd790:	2098		mov	r0, #152	; 0x98
+  3cd792:	9900		ldr	r1, [sp, #0]
+  3cd794:	4a6a		ldr	r2, =0x3e8ca1	; via 0x3cd940
+  3cd796:	5042		str	r2, [r0, r1]
+; spi_stop
+  3cd798:	209c		mov	r0, #156	; 0x9c
+  3cd79a:	9900		ldr	r1, [sp, #0]
+  3cd79c:	4a69		ldr	r2, =0x3cd887	; via 0x3cd944
+  3cd79e:	5042		str	r2, [r0, r1]
+; spi_kill
+  3cd7a0:	20a0		mov	r0, #160	; 0xa0
+  3cd7a2:	9900		ldr	r1, [sp, #0]
+  3cd7a4:	4a68		ldr	r2, =0x3cd88b	; via 0x3cd948
+  3cd7a6:	5042		str	r2, [r0, r1]
+  3cd7a8:	208c		mov	r0, #140	; 0x8c
+  3cd7aa:	9900		ldr	r1, [sp, #0]
+  3cd7ac:	2200		mov	r2, #0
+  3cd7ae:	5042		str	r2, [r0, r1]
+  3cd7b0:	2188		mov	r1, #136	; 0x88
+  3cd7b2:	9a00		ldr	r2, [sp, #0]
+  3cd7b4:	2000		mov	r0, #0
+  3cd7b6:	5488		strb	r0, [r1, r2]
+  3cd7b8:	b001		add	sp, #4
+  3cd7ba:	bd00		pop	{pc}
+
+T_SPI_GBL_INFO structure:
+
+0x00:	prim_id like in TCS211
+0x02:	addr_id (ditto)
+0x04:	adc_result[8] array (ditto)
+0x14:	Foxconn/Pirelli's unknown insertions
+0x32:	assumed is_gsm_on
+0x33:	assumed is_adc_on
+0x34:	assumed SpiTaskReady
+
+$spi_set_info:
+  3cd7bc:	b500		push	{lr}
+  3cd7be:	b088		sub	sp, #32	; 0x20
+  3cd7c0:	9305		str	r3, [sp, #20]	; 0x14
+  3cd7c2:	9204		str	r2, [sp, #16]	; 0x10
+  3cd7c4:	9103		str	r1, [sp, #12]	; 0xc
+  3cd7c6:	4669		mov	r1, sp
+  3cd7c8:	7208		strb	r0, [r1, #8]
+  3cd7ca:	485a		ldr	r0, =0xa0010	; via 0x3cd934
+  3cd7cc:	9000		str	r0, [sp, #0]
+  3cd7ce:	a034		add	r0, pc, #208	; 0xd0
+  3cd7d0:	213e		mov	r1, #62	; 0x3e
+  3cd7d2:	2200		mov	r2, #0
+  3cd7d4:	43d2		mvn	r2, r2
+  3cd7d6:	2305		mov	r3, #5
+  3cd7d8:	f00d fa2c	bl	0x3dac34	; rvf_send_trace()
+  3cd7dc:	9804		ldr	r0, [sp, #16]	; 0x10
+  3cd7de:	8800		ldrh	r0, [r0, #0]
+; struct allocation size differs from TCS211
+  3cd7e0:	2138		mov	r1, #56	; 0x38
+  3cd7e2:	4a5a		ldr	r2, =0x1774e38	; via 0x3cd94c
+  3cd7e4:	f5f7 f8f0	bl	0x1c49c8	; rvf_get_buf()
+  3cd7e8:	9006		str	r0, [sp, #24]	; 0x18
+  3cd7ea:	9806		ldr	r0, [sp, #24]	; 0x18
+  3cd7ec:	2802		cmp	r0, #2
+  3cd7ee:	d10b		bne	0x3cd808
+  3cd7f0:	4850		ldr	r0, =0xa0010	; via 0x3cd934
+  3cd7f2:	9000		str	r0, [sp, #0]
+  3cd7f4:	a03a		add	r0, pc, #232	; 0xe8
+  3cd7f6:	2150		mov	r1, #80	; 0x50
+  3cd7f8:	2200		mov	r2, #0
+  3cd7fa:	43d2		mvn	r2, r2
+  3cd7fc:	2301		mov	r3, #1
+  3cd7fe:	f00d fa19	bl	0x3dac34	; rvf_send_trace()
+  3cd802:	2004		mov	r0, #4
+  3cd804:	43c0		mvn	r0, r0
+  3cd806:	e03a		b	0x3cd87e
+  3cd808:	4951		ldr	r1, =0x1774e3c	; via 0x3cd950
+  3cd80a:	9805		ldr	r0, [sp, #20]	; 0x14
+  3cd80c:	6008		str	r0, [r1, #0]
+  3cd80e:	484f		ldr	r0, =0x1774e38	; via 0x3cd94c
+  3cd810:	6801		ldr	r1, [r0, #0]
+  3cd812:	9804		ldr	r0, [sp, #16]	; 0x10
+  3cd814:	8800		ldrh	r0, [r0, #0]
+  3cd816:	8008		strh	r0, [r1, #0]
+  3cd818:	484c		ldr	r0, =0x1774e38	; via 0x3cd94c
+  3cd81a:	6801		ldr	r1, [r0, #0]
+  3cd81c:	4668		mov	r0, sp
+  3cd81e:	7a00		ldrb	r0, [r0, #8]
+  3cd820:	7088		strb	r0, [r1, #2]
+  3cd822:	4669		mov	r1, sp
+  3cd824:	2000		mov	r0, #0
+  3cd826:	8388		strh	r0, [r1, #28]	; 0x1c
+  3cd828:	4668		mov	r0, sp
+  3cd82a:	8b80		ldrh	r0, [r0, #28]	; 0x1c
+  3cd82c:	2808		cmp	r0, #8
+  3cd82e:	da10		bge	0x3cd852
+  3cd830:	4668		mov	r0, sp
+  3cd832:	8b80		ldrh	r0, [r0, #28]	; 0x1c
+  3cd834:	0040		lsl	r0, r0, #1
+  3cd836:	4945		ldr	r1, =0x1774e38	; via 0x3cd94c
+  3cd838:	6809		ldr	r1, [r1, #0]
+  3cd83a:	1840		add	r0, r0, r1
+  3cd83c:	2100		mov	r1, #0
+  3cd83e:	8081		strh	r1, [r0, #4]
+  3cd840:	4669		mov	r1, sp
+  3cd842:	4668		mov	r0, sp
+  3cd844:	8b80		ldrh	r0, [r0, #28]	; 0x1c
+  3cd846:	3001		add	r0, #1
+  3cd848:	8388		strh	r0, [r1, #28]	; 0x1c
+  3cd84a:	4668		mov	r0, sp
+  3cd84c:	8b80		ldrh	r0, [r0, #28]	; 0x1c
+  3cd84e:	2808		cmp	r0, #8
+  3cd850:	dbee		blt	0x3cd830
+; the following 3 half-word writes do not correspond to TI's original version
+; they must be Pirelli/Foxconn's additions
+  3cd852:	483e		ldr	r0, =0x1774e38	; via 0x3cd94c
+  3cd854:	6800		ldr	r0, [r0, #0]
+  3cd856:	2100		mov	r1, #0
+  3cd858:	85c1		strh	r1, [r0, #46]	; 0x2e
+  3cd85a:	483c		ldr	r0, =0x1774e38	; via 0x3cd94c
+  3cd85c:	6801		ldr	r1, [r0, #0]
+  3cd85e:	2000		mov	r0, #0
+  3cd860:	8608		strh	r0, [r1, #48]	; 0x30
+  3cd862:	483a		ldr	r0, =0x1774e38	; via 0x3cd94c
+  3cd864:	6801		ldr	r1, [r0, #0]
+  3cd866:	2000		mov	r0, #0
+  3cd868:	8588		strh	r0, [r1, #44]	; 0x2c
+; the following two byte writes probably correspond to the clearing
+; of is_gsm_on and SpiTaskReady members in TI's original version
+  3cd86a:	2232		mov	r2, #50	; 0x32
+  3cd86c:	4837		ldr	r0, =0x1774e38	; via 0x3cd94c
+  3cd86e:	6800		ldr	r0, [r0, #0]
+  3cd870:	2100		mov	r1, #0
+  3cd872:	5411		strb	r1, [r2, r0]
+  3cd874:	2134		mov	r1, #52	; 0x34
+  3cd876:	4835		ldr	r0, =0x1774e38	; via 0x3cd94c
+  3cd878:	6802		ldr	r2, [r0, #0]
+  3cd87a:	2000		mov	r0, #0
+  3cd87c:	5488		strb	r0, [r1, r2]
+  3cd87e:	b008		add	sp, #32	; 0x20
+  3cd880:	bd00		pop	{pc}
+
+$spi_init:
+  3cd882:	2000		mov	r0, #0
+  3cd884:	4770		bx	lr
+
+$spi_stop:
+  3cd886:	2000		mov	r0, #0
+  3cd888:	4770		bx	lr
+
+$spi_kill:
+  3cd88a:	2000		mov	r0, #0
+  3cd88c:	4770		bx	lr
+  3cd88e:	46c0		nop			(mov r8, r8)
+
 _f_checksum:
   3e6990:	e1a0c000	mov	r12, r0
   3e6994:	e3a00000	mov	r0, #0
@@ -1157,3 +1361,8 @@
   83cb92:	2000		mov	r0, #0
   83cb94:	4770		bx	lr
   83cb96:	46c0		nop			(mov r8, r8)
+
+XRAM data:
+
+0x1774e38:	SPI_GBL_INFO_PTR
+0x1774e3c:	spi_error_ft