diff --git a/firmware/application/hackrf_core_mini.c b/firmware/application/hackrf_core_mini.c
index 1830cc9ce..eeeba2911 100644
--- a/firmware/application/hackrf_core_mini.c
+++ b/firmware/application/hackrf_core_mini.c
@@ -1,5 +1,6 @@
 #include "gpio_lpc.h"
 #include "gpio.h"
+#include "delay.h"
 
 typedef enum {
     LED1 = 0,
@@ -34,6 +35,15 @@ void delay_us_at_mhz(uint32_t us, uint32_t mhz) {
     delay((uint32_t)cycles64);
 }
 
+/* The application M0 core runs from BASE_M4_CLK at 200MHz. */
+void delay_us(uint32_t us) {
+    delay_us_at_mhz(us, 200);
+}
+
+void delay_ms(uint32_t ms) {
+    delay_us_at_mhz(ms * 1000, 200);
+}
+
 void led_on(const led_t led) {
     gpio_set(&gpio_led[led]);
 }
diff --git a/firmware/baseband/CMakeLists.txt b/firmware/baseband/CMakeLists.txt
index 163e00052..4bd84258b 100644
--- a/firmware/baseband/CMakeLists.txt
+++ b/firmware/baseband/CMakeLists.txt
@@ -776,6 +776,7 @@ set(MODE_CPPSRC
 	${HACKRF_PATH}/firmware/common/usb_request.c
 	${HACKRF_PATH}/firmware/common/usb_standard_request.c
 	${HACKRF_PATH}/firmware/common/platform_detect.c
+	${HACKRF_PATH}/firmware/common/delay.c
 	${HACKRF_PATH}/firmware/common/platform_gpio.c
 	${HACKRF_PATH}/firmware/common/platform_scu.c
 	${HACKRF_PATH}/firmware/common/gpio_lpc.c
@@ -806,11 +807,19 @@ endif()
 
 ### HackRF "factory" firmware
 
+# The RAM image (${HACKRF_FIRMWARE_BIN_IMAGE}) is produced by the hackrf
+# "hackrf_usb_ram.bin" custom target (objcopy of the .elf). The previous
+# DEPENDS used the bare filename ${HACKRF_FIRMWARE_BIN_FILENAME}, which CMake
+# silently dropped, so the embed (hackrf.lz4/hackrf.img) was never regenerated
+# when the hackrf firmware changed -> stale RAM image baked into the build.
+# Depend on the full path (marked GENERATED so Make doesn't look for a file
+# rule) AND on the producing custom target (for build ordering).
+set_source_files_properties(${HACKRF_FIRMWARE_BIN_IMAGE} PROPERTIES GENERATED TRUE)
 add_custom_command(
 	OUTPUT hackrf.img
 	COMMAND ${LZ4} -f -9 ${HACKRF_FIRMWARE_BIN_IMAGE} hackrf.lz4
 	COMMAND ${MAKE_IMAGE_CHUNK} hackrf.lz4 HRF1 hackrf.img
-	DEPENDS ${HACKRF_FIRMWARE_BIN_FILENAME} ${MAKE_IMAGE_CHUNK}
+	DEPENDS ${HACKRF_FIRMWARE_BIN_IMAGE} hackrf_usb_ram.bin ${MAKE_IMAGE_CHUNK}
 	VERBATIM
 )
 
diff --git a/firmware/baseband/sd_over_usb/hackrf_core.c b/firmware/baseband/sd_over_usb/hackrf_core.c
index 043d1ee22..b0ba5abef 100644
--- a/firmware/baseband/sd_over_usb/hackrf_core.c
+++ b/firmware/baseband/sd_over_usb/hackrf_core.c
@@ -39,6 +39,7 @@
 #include "platform_scu.h"
 #include "fixed_point.h"
 #include "clkin.h"
+#include "cpu_clock.h"
 #include "usb_type.h"
 #include <libopencm3/lpc43xx/cgu.h>
 #include <libopencm3/lpc43xx/ccu.h>
@@ -51,6 +52,10 @@
 
 #include "gpio_lpc.h"
 
+/* Referenced by the hackrf common delay.c. The Mayhem firmware already runs
+ * the CPU at 204MHz when this baseband image is started. */
+unsigned int cpu_clock_mhz = 204;
+
 /* GPIO Output PinMux */
 static struct gpio gpio_led[] = {
     GPIO(2, 1),
@@ -492,6 +497,9 @@ static void cpu_clock_pll1_max_speed(void) {
     reg_val |= CGU_BASE_M4_CLK_CLK_SEL(CGU_SRC_IRC) | CGU_BASE_M4_CLK_AUTOBLOCK(1);
     CGU_BASE_M4_CLK = reg_val;
 
+    /* CPU is now at 12MHz */
+    cpu_clock_mhz = 12;
+
     /* 2. Enable the crystal oscillator. */
     CGU_XTAL_OSC_CTRL &= ~CGU_XTAL_OSC_CTRL_ENABLE_MASK;
 
@@ -537,11 +545,17 @@ static void cpu_clock_pll1_max_speed(void) {
     reg_val |= CGU_BASE_M4_CLK_CLK_SEL(CGU_SRC_PLL1);
     CGU_BASE_M4_CLK = reg_val;
 
+    /* CPU is now at 102MHz */
+    cpu_clock_mhz = 102;
+
     /* 9. Wait 50us. */
     delay_us_at_mhz(50, 102);
 
     /* 10. Set the PLL1 P-divider to direct output mode (DIRECT=1). */
     CGU_PLL1_CTRL |= CGU_PLL1_CTRL_DIRECT_MASK;
+
+    /* CPU is now at 204MHz */
+    cpu_clock_mhz = 204;
 }
 
 /* clock startup for LPC4320 configure PLL1 to max speed (204MHz).
diff --git a/hackrf b/hackrf
index 216949a84..ba2045a86 160000
--- a/hackrf
+++ b/hackrf
@@ -1 +1 @@
-Subproject commit 216949a844978ede713a597d7fc130367933713d
+Subproject commit ba2045a866387d9108c3c82b8ec9c13494d2f839