From 02b5a756755a503070af1a441c6b53c31ebc522e Mon Sep 17 00:00:00 2001
From: "Peter D. Gray" <peter@conalgo.com>
Date: Thu, 5 Mar 2026 09:14:33 -0500
Subject: [PATCH] new bootloader

---
 stm32/mk4-bootloader/releases/3.3.0.txt       |     4 +
 .../releases/3.3.0/bootloader.bin             |   Bin 0 -> 114688 bytes
 .../releases/3.3.0/bootloader.dfu             |   Bin 0 -> 114997 bytes
 .../releases/3.3.0/bootloader.lss             | 34693 ++++++++++++++++
 stm32/mk4-bootloader/releases/README.md       |     1 +
 5 files changed, 34698 insertions(+)
 create mode 100644 stm32/mk4-bootloader/releases/3.3.0.txt
 create mode 100644 stm32/mk4-bootloader/releases/3.3.0/bootloader.bin
 create mode 100644 stm32/mk4-bootloader/releases/3.3.0/bootloader.dfu
 create mode 100644 stm32/mk4-bootloader/releases/3.3.0/bootloader.lss

diff --git a/stm32/mk4-bootloader/releases/3.3.0.txt b/stm32/mk4-bootloader/releases/3.3.0.txt
new file mode 100644
index 00000000..ae532198
--- /dev/null
+++ b/stm32/mk4-bootloader/releases/3.3.0.txt
@@ -0,0 +1,4 @@
+97c72e22f99e347e1d03c0f4b558f16c5cb6e1164e02efd86bf702c4deb19487  bootloader.dfu
+6bb9350a650f6268e84a5126ae2816ef6fe9d37c3baefecdf806907c43c43618  bootloader.bin
+425dee4c9e849a282a643e6f731b672ddfeab21e4fba3c756891a98e6d2e6001  bootloader.lss
+3.3.0 time=20260305.091240 git=master@e35f60ed
diff --git a/stm32/mk4-bootloader/releases/3.3.0/bootloader.bin b/stm32/mk4-bootloader/releases/3.3.0/bootloader.bin
new file mode 100644
index 0000000000000000000000000000000000000000..cde222660429cadb4fc638e05164d1349cd2d289
GIT binary patch
literal 114688
zcmb@v3wRVo);C^#nM-DJ8AyQKAU!hyh79095W+<rW<oO%AgH*Di0eQQCka9XUD@?@
z8SsXR3lcyevWuX*2?!>ExJJwd1zp#bbw<JErlKfgh?fo|OlNNW{i-Lp?)$y(^ZdW(
z`ID!otE;O{Rh>HL)Twh$HG~+17DDucaTVY)<Feu!ii`Ox`&aI-{9iSHO@zq*@=wDN
zJz@Wsm&mqNj1b%_YJRh_@;={#!dS<cl2KzFW5)`Me}nAG<<*rB-Yd*lUNKrQ2!?sS
z%2mRunne}&3QJe46jt85{6VuY^PyD_3S(UJ+&BE@-bE|bazq*^mrIJHTp|oE78ggP
z{9ex$fhoVtjM4j^5X&Wo1ZDn0&2&QY%1BG@a+k!gxl8kwKikMj3`c57-N3TDeCKq9
zrv`WgGb<gB$gNprSu@$%PjXLmaAV86{q7ST8pnwa9ZA{5))UDro0`%*M0z@wR+d|3
zq3{;xRZ(b6EmKFNXJupK-7+5~Ce}#^<D7ex(W7U2g1h%$xaTv@RV}7gMqnFj+H%Th
zpZsc{ILWWV7@+p(hf`C1@Ay)hl%kF^oUh-U(n{{KR%0p~>^03E;k?tk)>q^l<J{pr
z>t!laXZCYioH>gYEDCgJg`6tZZI-l*!JWI92>%F?_UnBiib81nM7f0=RX8#Lt*>gi
z-hSqs%-Prb(7!C#H`d8|7y3pzOT9aM8MDSX*Lu&Q&3C*xm1ZZiXhEgL=~|Rq#Y#N8
zZV|-*%N<)p$JEyzZ42$t_Gnw|%-eldVCi-*oejpx&djWG<2iFNo>7KA)A!e(|95Ko
z|Nl+DNjVvFu8@>>uB4=tcasGll+KX({lRI`;AQcIII4q`5^1X3_AMzrCH`OKjI><M
z^!BUe8#ObuWgqz1?hA`E-T&~?9MT@A`2U_<;7LTYz3F*Z=K01hau4^3aRyuZj4S=j
zBTc01VJGSN9ck>53dXe)Ax)^6o{r0ci{N7Dy`5Z05o%ig(3mD#Uu0@mzWz#CPL)|=
zn4CW9V{4mx{43Zxa`oam#*uF$S6*NH#kVG@mmN&T5kF}oL2`v$We)%J7a=sQVG5af
z%zey$Cd_Erd)PhfU)Xl`Bes(zR;Sq}lFdqZufmI-BaBFP+Qc+zUN71C)C`)szxN4G
znzW{u7jrKVtANr<_&Jo_-fFDZNV8<#lGe#GG(8WzN){RG%eya()kw4D5hBgqD6`W3
z$U~qtOSgY<t~b}`>h|A8?|4@4cvkZ*-DG9*J-PneSDxnY?O9hWh`CiNclY7LSZk~s
z0%~NXCA|yF@~X}?@9p}Ky~B0KRAwhzlpo-V3Ia?~X5d3RB+0rvJa^3ErN?4qD3J^?
zK_t>EF(N%2;iZ@2&owzPi*r2XD6um315$I4x<A$tnysdMF=pt+(5xA=XX<@3e3>G5
zY>QV3hZ9U)F?fOvdLS)+2WWEv?YD8Jj<s{aB?2dX+S?hTkXdO$gq7}#&^Lwvhl{bZ
z0aiM%+!i7NEA3O}gcu<bA{Ju<SI<ZbBF1`FY5|@{0`je~g@7;+5DYPXNOn6@I4?x3
zj5-&8OYkDGt?8cinyqF=h%e#;LJ=GA6gj2fT4Lq<X7_Mksfn+#(v@CjJJ~q`<If<h
zG+ZGzA_e`L!Xm&-&hM_i(w5hl9c4ob?BvS+wMC*$<fPxnLX_6Q%k?41Ie~R9g}m$c
z716Jta_=0`{|@&hr-^<8?$6`?0?qdmA^$w?eemz^gMa0qV7UW5Oq23u+A=Fu$)QWc
zTHd|kfh1MV?<@J)!OuE~Rd2uP^cUZ9k|rgs-+-LKmSKeUX>qLa61{&IdsV%E5UW@3
zC*v=x_w|Y0xbsq}{Ng2oRyb*`@`9T4h+M0-HX5xdVM||Ie?F+`+3>*S5L36rJ~f~{
z&De(oSi3DSxrr^@e(7HOl)zGZZ}3B5+=V2zw0-rSJ^0ehJ##=C|2X8bc`LoSqNYo)
zxfcB0rDVA)@#IWBe9$H`Qbv3w+D^{lH+^ra4l<IWY*s1xLwjmFYgMfFnqOVoCoocP
zoD|-9>4?yaS@L5PO8A4mTIB~>N#9Gcr&Y4iYtFt;#S)t_xD+^3%O374J5g=>Nbk5y
zOy8S7_q`c;kP&IWPV}by^lnGryCDbdt4)({u+tLj+bxBR^ky%yIi>ggM$qb(UcH6#
zdaA^zwAALOaE`=@ExSFnQ28cFg-Up3AGGiRR%(>ZfW=C?V(sb-e5lUAqP`NB4j3Eg
zJiQ%DV(jw+yX27$V-q8N4&Gwyn4guYn3KE!v9IYK_ZodmQy(1ANfnXzzQMDJj9Ak>
z{IyeZO+V9!vh$jr#u}Y;BtkjmF9&i%*K0H#Fo`<pqv*zOn7XoSKQ69yaY07fm0$|@
zelz>p0X+8x39!E>J_>yJT!iv6vlDMBcDlYp$pwiH%tsQ(Y+vu6I)Hg+M+~M|I2>Pt
z@tf5-xY9S8hY!#(aOl52U@2Vj4J(b1efg~P`>0^mg?#xssXDH=vVc2Rt@mkPy}J&i
zK_aJ0FDCBz=5QBT!JaXcz35^;F`#GTWFl>nzrSQGoc;}Ir}{_@)k(mg+b$CQZpwqu
zPY&U3m}#5=IeoiZ=IzhAqCq{L{69Tu%d|7Dzp0u2<6jSaP6#JpEjJOu3q;@reG8GQ
zds(!pRk3jzJWul$^>WCI^(x_iDillS!SA}30uL{J(91|~C{)T#i079<pBqCgJ1Wjp
z?5sFjk+URs$&ST47w1&uR_yJ0(EXqCooZW3_)iKWJ(x)E;|eB7q3fhU3FFL6Xd60C
z)iAt}O36Qg^F4M|zuxWJKK*q%ZmOdJ4^$s9wJ=g0dUFI<N`jGQBubzWGSc7To>oS3
zC2s6%gAII$Id{e=M~%Tcuu&d^ah#SN_^s$YDQ|I{W7t!p@w8BVa(5H%IC6_-angN&
zJvc$6GqP=l-XdVWejT^93N^cZ1Z$}heh8yUOAxae*!nY`C*XO6ik<qHPWr2?ML!s6
zS(KNS_Oep{-jb$ll$_f;2(1n6rDGq6)MgnxC<{$(-<q76c<*fGr57WNbRo|7jp6S>
zUUJ7`Ayqe};|Ctz0Y0eQ{*>YcGMUQe_aVEfoW6*(gp11Vb<LQiVg_*Y-<tPjilA#@
zEYHb0VltOYo18>?AWAIInjc6$RpIISn<de-E*--NO87H{`6>6#D5vVnH7y!3T_lCC
zy2!bjHpksc_+y0`7Y>yGJ};(0m*3<xnW2Y8nV-R*^fUP5q9a5BvhSeM_HBvt-!0gV
zl(eMJN}p}@?RO0f@LhVc&_c|qk`ycNUbm{k3!S9mB7R9tw)J?2mK*97L<)gOvyYUt
z(J>MS<8-u)DH}60$M?MJ>BjkiT<;BKj@f6IQH|s5lC#TL+?mbHPH6K~bHNUS>-OKy
z*0OaOC%9KLj@x}!FV~R7$<kgrg8DuTor$o8yRF!3jN=+KR$4+=OQ2)@yF@U8y@J#p
zCl+TPj@u&!<h&kde#&`0qJ%dntmH{}o6MrY!&r#)Y9wVw4zPV2sOYO$N~5DqJL6ht
zF2-}iFQ2i}Igin~))UV(%<D*8B`p-wO89A|{|qf^-uSb5dLr_3y#Frp?|EGvN#gxV
z;@>!59#Q8&`qNv(0N2s-QX>zzcPoQcxG6t_d*^?^z3pdkXGN^54>fVp8cm+oc#0Wk
z7K=n5c;>t4$kIxz5K6c;@qK8~>SS(8j2(A1^zR;w0>$4KGh@`Go%Uf=hva?<+Orn*
za+JwxKi>UWj|comKhh(hHA`~7^pW!J-HT?sNnv^SZy(qi?dtK5vbFn%?iPzz6Z^CP
zdYF=@Ej-1HA0y6Gdsr8pQ~E|1$ru#mJ5#trJ>E4V&YkS>KA0A$1cf$q@+nIAuEb0+
zt&?Zyh@Ow$6L}gl?tQRYyg^L8@WARMoIgg{@n=Ihs~1UY7*1yLm|F%lUCx_1t>+we
zwt8~m2C-7~h_gzS@VLaw%{Pg!|7`pRAZtQVb7R}L(qnY|rk34}Rp26}I7?)peS#Aw
zlL*t5*|j!<1?--nLB+}Bgjw`s?%fGiGRJLAni*+$awLRCQyVuUMUbK6{R;4MD9j{Y
z%fFBhudSMe-{+rbBvylOY=rA!gBsfQMrQaQos+;zhyAmCLnV{p%`P@$V6go1C+Vc~
z_vz?|@pD=5mS29>ST1FxrbdjhVV6@=(<`+R<2CVes`j6F8<0t3`DJ%{xx}GFdTa&q
z?Uz%Hn!aa4mojPAWn=1_T}%eE?WjzS4mcf<^+&aU^iQ8Qk{+3f)KTOFWd7*L%R1e=
zS4n<qgp18Wdb;;-KIRV-oWG|fuifl^&-(*ec<Qw5^@<XseIIw4wo05%*X5tCMV_w5
zKY`oEp>^&L|C05)(ew23%NtVDBdOOKyEc^<UDl@G6c|3I(KRKY?eQ;dbWQ5Jm-OAo
z_ua<@Jk!P@O;9GaT{lcWObZy|<#g>|y~BL}au4YC-;&yXvvZ((n0KjfKsV`oTI&51
zp8N&LcYpF;@*QC3spT$tnc|y5WZ2mdGwgJT9rkI68+J0p5BoTz85Rg>hy9c4=sauy
zJn^XOUpDc8H_F|ZzpR&VHBq`}QpQBst4xs2U`m9QvoABLO9C1nXZ;1?BHC+~2$#6g
zO=nQ!#r(}>C7sSLwv&vZnusoJ1y(U{HBb45U)JiL@=nKHui_cc+V{K`iPLJk{338O
zo&{b%mGu|eNt=`6PIEaueN4byw%z3ja6SHt?XJ;%_mO?~qQ1K=Fn5|QFn=2GX4PAd
zI9E-}3?A}XFKaX{UMudYoYh;Q-YdL&)%#xWMfHBs%Z&X!bf~XGjP<J!YrPQSte=N?
z>-mtzdN!oBp8h$GfFF`iJX~dtE32J>o>Md3(6n|@&GfafT(~RmbWTNjT_e`KVycrE
z-Sqd^qPG{(-(!_b?a@kqx8HH}DsjR(GM!pK_?fp>GA?}!8<@LD313t6)MkP?;e6{F
zcl!EwAH63U#9bRZx!q^#KI&zHv}W!jA2(yA6?Wme5|UboZC+rLe77SY7arv#g*CSN
z<%I$Rs}XDUBj4z2?zynSDmgi$7g`;6%W3rS4ib25F;{JGrSCRi7r|J$ia-Z5VX|9S
z`FQ1%Rg>M*D<`}EhD(QZv77HE4^MU*y<9bGXWNZF=ra{Yue*BIWtJ^W&2{q<&s*HD
z_mF$^?Z>L7U1l}2(Hg_*+l`Bem0OCQ2-%|4#t5;{V6nNUW<^_QRL9k+L&Qz;LI-1~
zE6yhDH(&HK==DN}M)D@Mp!bYjC!TJ0O27A$QNImPY5H)0vp$YDdwmw)D;30isE3rB
zm%c3D?0;DnP5Sms-^=n8zrNiKo89q_%zox2FUzGg-@CU8W$)1ip%ZqK+cUkHbQJ3S
zPVKKy&kY=9f>!dHE^e%AX6&Y5@~$~^qs&hJ#CvfgJDI;QKxQUquDZC9nOxU=@hMv3
zVrvpI({Axmn0~;d8c3d^ZxXE5rF(tFtxT=ech<*juJcj45SEh??9qjO7p%UWzRf!0
zsjoI}Zf1%&+LHaO_wOOJV$WUmkI<Y}PGHpW68tW7uvD6^U6ub%KqGw=KbqI*YWw8-
z5G#C#O9Dp2?ja(v9+0&Tir3F%n?H%$LBMU{+UvM&j#Jz&@-g<c;@M_Hps8ow8mH8M
z?Oq?TJEiose34T!uDzp`G5@@6y~wHS2)W@(fQ*&`6vm#a;Y)aXe!HfxkIlfabt&*(
zjM)JH0r%clDlR?sr>As5YR@5k_8fZuN~KKx^kG>P=;-I1S)f{c7Qpf|7c&AokmO`@
zy*W)u>==T{`^|k=qVqxLfEh+-f!IrefaIX5;^3YtE1;8m(!fDMUF;NXt7e5$+U!5;
z+uRKN2yM7_`1(mEMi;Qa`pUAFrRCRtT)ETBnCa|INhD{_x}5GCfBV{RLJL&8)N6fn
zLn)v=L`FLT$<{{(l5=V6o6Be0>0HuzJnPL}^=$jajkLd9mr_jod}-tB&D;9uCL?I|
z<@$c1)1F-5GwED(+&|g5sQrr!OOESeliByIFB8_$L4oTyD>(CkZ#dea&+Mel&A_^F
z{T+9DrrP6~-XY=}UCJ%DbXUKokq*apccu{MG^KmVYn(YfWOzh}KBA6^nfNrVZwiHS
zAGwYpOEp`x2K9FOJ_Z(ZA6XP)&E1z+vwUe(hcdN5rL}a2+jj^Q#6xo*Af^T%^WEOc
ztFk9kBrh0%%R>oXrQ0nkuM_Dra5<%B4eV!0F88Zk{*j-ICYU2Kibxy%yh>Aht3X3@
zRX)GROew1$`Z#yklA*qrDqec(%cs(U(5k`5cCTIKXS)|;aZv6=Imbox?81s_--dQ8
z_>%HwHC6#CGuU=o&+n%7=4-i=s15#4*0%U472O<6@^wBWMv|**eO~|zNtj#PGavcH
zS6ox<r}O?P^1t*ofyP|HbEthlPIt87TI91LcikF8a1W)&ayCHivmE6Gm9}^KOpx!i
z#P|Sktetl9x@<_lQ0qIROF5PKh!zs(=VLk$y5+w~h4RoN`FkJ{-iz+;)RQ+{FMjfa
zI)~{(6Go4I2yX`IO#TJja0)%md*oo~=lyw`t~1?7SF{C^t4kVImo%X}^q+ju1Q~M-
zS9XXHxg}Lh@eLN2SO-CuzSFJq=*ya-SG$z(oJf&4QFOpIb9db8vzJ=EGS)S^hs>Xs
zO=?<RY}7*5XF(p-C5RQimy!1bQ|dXXBtE`u!pu+P?aoTEynD^<DfLSDL#24;%RPQ~
zrAVLNRhR}^^5OVc5qol^o{ZDyytrT)gA$xn7%%UZim}QqPS$u;;k(G<<2{X;Y!4Zm
z%-f?7=~sy%GqDO*By)Bs`7>?SWV%+#{VDyNl8sUq`dWWd889=ouasZOEF(L2y0n4*
zo<#U5<>f9Xyhv|^MyS0Q9xp=wsC8<5oJh7rKJ|v&!s-dZ<-}E^6p+=pWL!ik*z}N6
zKykD5Yof2g-Ya!>+8iRK0z1%Lyh*#7;j~%QTWq3H^1^ENcDo%mM8UhrtG}_u^?eZV
zDa;3zf=tvO(Nwm2w4DtaSC6$D&iKH8Cl$Sg?m3Lo)cDa17CJm5M6svVV5d#3Y)W`l
zFEcIzi^j&pl94^Zk~S0I5b1-s#b+$r=`sa{M|@4z-`rw1p59xzx5sZi)DtMseC(~%
z*fzjd!3d@{f|Z@LkLyo9bhNlDjkBL<)O0>JfET&vdFj^)9vI?wkWB){ppklH3cW5a
zP)oI-!S3t=#t!{+Dm);+c(G9f`Wb{?y#?#`+$L>TD&rWegrCP#Nz)JyCpF8YP!RJ~
znF9NKT+`#6pHfe@aMA$m=GWX_gdGv3m{$|0<?Xj<di*Z*xo;l#B$8A#FUIUMVV*dt
z0#^Au;!J}BExv>{vRk!i!!Mr*q4o_EMFx=eCf*C(k3K$(3$~6;1o{aBe+IK79a#Ik
zw=v?EoGI6B7)5h7H4@1l-zINxD0W?NIN;5fhk2Cnqv*Ng!ce5<z!EwoK%{K!==BYB
zmL7mjs9$`DrxNMA(GTAtJ#44PqnIU014`oJ*?pE9ec-vKfu1F1CH#Us0I-W>?S*Mg
znMe(lGXcB5B8VnX-KVfPSz9xZpCe~@u7pz5I*-a}p07h`p2JkX1zq|vrYQDseoCVP
z>!iH80eL%c$)6E@1MY8}A^Nv*{|HyPbivBaT(F2(b}rIba-sK<_V$wuNuT+#yx!sN
zuHoLnJr({OVpe@I-W}AJBh}w#={8w%VPo;%hBc9{^?2H$)~CKPx(}iI^Qp7mZX|+6
zdI*-YO%AJ+4a?akhiZ2yKG9*Ya>FyMWGFif9@z=yl1@Jb_7Y8sq5ee2ppp|ES@)gj
z$k_%@?H#FGO<M<UOWCTG<k$>RQ?HfwC|1}5dF%*Al;zb@tL9|-TTxOwsWuxv1?S2W
z9Yad;>aAtBY_`;%=*a)|i4I}un62Zt>ZJMz?F}?WH|@>EWk?lYTyk+4hdb5jtjp;d
zVO?td$>y_nnHz2GU9xu>hdWox)$P3>Ww^cf?!BMGov-EV_ExJo6??0#^i72lo~ukv
zYFVnk*6-62Li#b8WeX~y6^vc5D7W%sE_O1f(loQ5ix1{j26UzE3}(SdOGtj#0{CQI
zkbtygP%WwHEBSF>N!5>td5#=oiLNEZlQPpVqkpbZaz|6jb}n;u`&aH<QipN*SJ81L
zX`1>Ssm&;G8I~f<6a2W9Zi%>Wr?UrG`W8LfCq;&{x|ut@Y}fj+JH2;R5<7dAhlIQq
zQ};F~XJzi2M*ZKW7JsW@Rz>9kVmhUSFDUx5i(am)wD_X8qVg`HJ*7ddb1`bWRKjc9
zsdQnTlZ$dx-+4{Tfu1MsC(^{|`>@6M7a8h_bWhaKfV4Le-ko5kTn#3|&nWDH(cqk{
zC^Jq!Qj~e43{8P4P7NsGdS&3OL32)Zkg-%I+M|x9EVQ>5av&bDc{@Y;afe;hGxL2=
z0URZ~NlAm{kVrp7DCc)lADt>q)1$=pWl%rvRhNX44=HKr7i2N)>O!BNpW4_PaTT<%
z(3ObqR$u?$p6FnUtKlEatx>|a0Qw?@dahDDM(I+-)TBpGeii$ygSBdr^BMdRJ+Pr5
zmY`D!m$p0m;CgVcX<6UMiOWRNC1|pJcls<M_l~}Jzbi`&qc{Bld7P3m+c0OD*!?YQ
zrEACQfUg7m(J{JiTn*|$X*Ixb_D}u*IyZD*rV(>t38?Wa;U5x8*rbfg({%EwwmZ+u
zys27jf;OpdZ^SQmOh>i8fZnnQ7$MTE$m&)-^k*WCj+j~vXiJVx5{p%AJsi<DX+1r_
zZt1jtVK0lF%v2?O_OBE_bnT;UZ+e?i*MXa7uWwYsjgW}zBXljLz68On#acxqBT_nX
z0&LH*-cuc>C+J%8P-J*hF<Ltjr}ppkCMEn`Vq|NJ+E1$c-VoGCx+t~nQ)&9E$W2Wn
zQ2O<_&BIF1s&$BTd*o%*+nFesCComF8R5GG^0E7z+bHD%Zv`m7IeLAr*Cg`sye*!G
z`qgUv{-BSsk&F||#Ej!xzs(?z<Ej?ZW@gRG7IRkjmzldNoqJr=eisf3uweh8x1=>4
zFdmGj0mcj!2AvOS?REO0HunQx056x4xS54?4bqebRC$dwU8j|Beu4-}_>P3W4Aw)-
z*~N+_x8m%Q+<R$cio#kD0g~jT^C}-rXkk~ICf!iPiR>8@dN4dnKs_0=GG<p%3Q}jU
zyw?X@NO90nf>I~tlNaEN;Ls9>^_t?LBgm+BKstBV^^cmCw3%tMv?3X5U9H%SK{86;
zK2#LOZE;--5@}B_u@={i6g3x!y&G%a&Rz!3f(V|Wy3qwjPxY6QR(J@A5<a8A#^K<_
zD0;FVJvo7uGTD>cdTEN<@Qu=}zO)Hxu`ivCw6m8|7?mFlZB*kS1hx`u$}B_qU~$-L
zWpqlAxltJRmP-z5ys(Tw+GTpBHZr<9$P`}*(Z0|=NiEMdvImkBII8!$UN=*|o|-1_
zlJ(eaoNJETJ5Lj<Pkc@$4ki2u)m2(4buEky2aeaqC|&NtyRs&3b+SBr#)3CK*z6w%
zuTH`U7sko(%Q@fPd8?1ghYL9r^G4~MtQAeI`U%1fRLZ#GOPdA&t|KNjvr;fheE^M7
zst*|(r8c#FuM(aN+z}zS)rgXLu^&T^yO=<VM-B<_!xHH?GO=9>Uc>tTJZOm08J)wO
zNdF1fL0ly*l%h)DGpOlJ_fXnMgbQLBfVMQMgujj{VQt(1`SiRjh|tjI8Kn*KtH7lW
z+D8|>VqZq-cmW@<iBzD@?Oy=*JzVew0=7Z<{}L<1lq%Ns@VF|I=ey=lt(k7ZUNzI%
z6VkPy9feBc)iSd^xkkZvS4s-kyELG*`{l!t$Dxs#+E8P1zWXZdd^IikVy#Pa4*cKu
zwx;dfh5uamkaMJ)Deeks%XIMU%=I0`4r!Bbt*bXcY~et*m#&v@VC^G%?OYlWb(=1;
zW$?*<GlR>fcKgl2B_A(ip~<LzA6P7SSS%>*Qoj6DsTjf)^QYbTWllftVuN%wTmi}i
zJ+@PLbS<TFZx!}a)3V9PS2}qubDqXeDdE2;{78$)Y^rbPEmS)-NGlb7%6B0>#@?VX
zRwC(Og(VVcXG&s0eH-*LiwQKYn^n8WX#KJ>Ma!S;SNV6Y_Y^ZZ9AwM<&Dl?=?am_3
znij37AIcOCgEe!F@F?cvg0h4#H+|jQgWUx608Puzk{P2CzO1|o4|fUphw6QZKAEv|
z(Fc{cY1xy|Jpdcy_>VuXOmE43%z4d#h&W&lZDp>PTJ)u!D;n)u%w%Rwp5gWysjZ*P
zJVJXg+yyVdl<am`3t>HXb9$sm`lV@g&Drg%oXI|Y7yL4`sztk+6#m|&5f8|`Gc!0s
zY#ef9DYNfrGxaC$l6hf(%ud0cEC`#+tX;B(SaTP;7ETpJip?a=EmvSolLjM(OYem4
z+)goh1%5)k^9V5TP&*-X55kP87Wa0(&5_r%;x2K$aDph|`@o@V6k-|SS%$p@FfnqQ
z_@SJAL1PWb`TlH4$l!x&s++9P2aZ+NX-A)WY{NcRUGune%-D|5dD-O8h7~^)U?zVP
zw7~D8ziDWxRWz5rpG$06pTRCPg%L<0*QHC(mzj-kbgjwIxASf%>7I5Jb3)g3*a6By
z!GNg^eo1NVvC2FRcMAT>3U2YIAxc+n89peE0lmK)qIjot#e-gX?BG~LqbOm%ozn7K
zpyi6YKfW=uZ0G&ZDJ?tit-F6+BlK7+)%P;W2(<F_nYrF<%YsFK&o1yfuj$#HUgwn*
z%US9nU7Wj^+U5}R=+%^IQIguFK?R^?+U`g~OxN2`!n4~mTl9szIjxfc9?KO5a#14?
zX@NrZG<c#M`U|{G4$@s#8umn219a{vhm7iw-K5LFaow?1<h28xTw0p=UjDbhzCLA)
z=mdY+6wbzr#`7i>;uy@4QEBaBQhrq7>Mm@Dygh_nI&bd^ZkHKCF(*Ivb~CN}uLNXZ
z;Hx3}E{3szw~oh&@I%Pa@<iicahEJOpOaIChpqh$&q2Ol9Q>S|;&=`=k>_Lsc}_N(
zz}pF}nMI!~u}^3ArFEq+8Ud6E+5c3c6y8_5tG+A2>`Qt@A5E~ZSilRLpu1fixRlf?
z;rErK<ifLsH9IgvS777dabK&n$vkns>2JPXLa=a%!sFnN9EkV(lQp3e&TZGVB;UFF
z-tGG7ovU4H`C}uoWDVy;>Q^5q^n*o?`iQv(0Z`^ZN?kyd9xMGO1{e)AwJtVEq_H}z
z^k^)lEO-3@SufPB#<(3U-g6dKdLTANeSZiMas^m(B9Q4dEmO_)@a{4eJ>YIsG%EZd
zn9m!rW|bud0N(Ui&J4jqQ*+UpS){45*nl!-AJ=8l4iKphn<a9`^~Hx=7U-}htW~tk
z#8}!4UadDS#zX$lyc=R^4fOs1AZZ%XfZ2?=joMjY*P!}S9DORqo$5-Ir{8Hb9-x}4
z4Lg1%?1^WYwWw2yH8&n7*31Sic8`29<#QTObayZhuz!qFyAn;wNM$zA)YT}DUeVMK
zQN4v%^E#rOB~?v*9sR+|Skk(TOkO>x#KB7EP(H1z7|*P9D(bqz6tlo{Ui|?%6>mR`
zvUoc|efwT?K-uV5xh{d-tzu%B$i1g8u62zACdRAKqfx3?-u$ZWxV2_B=x37X78$b*
z_<k8W`Ygnl*;<wG*0><LR6P>BHIDjeKLjqA88qVJx9t=+H7)5P4@<2Q?pF969P*bd
zn_8*$<7}d)_2p)Zc)>gsxvwUsfKQ){j}V=BDoJQ;T>)U2I9f8wo@hKIXFBL8h&2^D
zPr5@Ra@Hb|H<MbY!0lJU3ld9E`@XnYt(}9~KLjZ4lXglkl+OmhHpHUFbU^<#M$j3r
zX%z~&I<mzgzN6-rBq;Y#53<9FSjsk9A1j<?L!;l!i!ACbNboA9b;LRGjn>aPv<$x!
zoNEd;Gb5PI>?Tw2ovS*FwJ0^X3;g^;ks<gQ?EV&Sn`{vF__M`S$Qi~O2^mE>l!?`#
zGe+fP4fLB!xb}cPcE^u4_p_x3sfFfkRjX6Nr`1w-gZ@=pnkO1!JiVdsF|KZ0pttfJ
z;+`&n1D1M@u0c;<quwp{%qUMhToW(9eAJK;c_u=Jl}m#0y-soL%**evo16FNtuyx*
zPQc5pgpZ)*3RwE41cjTmoqCSgFQ0FP_iJ20KXSQv7M?I6<6lAj$irAI3t^G*==EJX
zj+11L%1L&=OH|C+kZNnAnl6EXrZ3)s9k2`6b2MJfk|Vz9cZ!n+!>1p6iA<GP=FRnt
zlwby7^o?kHXuL&CouIBX8>wz6wd{vgE<@z%v&;j5i9bg(5QVCQKT;#wZVK*eX3Yao
zcQfkhkhl8?BvWh<sD4(2wLT|n96#U}nzD5O;)GHhX3=U*0go6URe4BN?OgaYo%$^X
z$p&7VDAJlYMRd@6XsRTV0~;Al6-P2~7a)a3N5-h7Y9fMYhZG{PWw6kej4Gx7Sz&hS
zo8sYPF_Xw3cKJ2nG8|xb3T6|$SadgySlc(TW`Q3}*hg1kOf+WM(MsoeJ4)-@S4a#m
zh<Z?n)N%l$XP)Q#MsJIzH1HVxTy^vwjGk9VpNY}0S7Y&RhSUp0bI{`td-Ead`q%fv
z*xrl`P_aO9kqTV!!?C6~1dG+$uOSE6NC!4jYJe4B!-y3q!^t9!Qm@8OQ&@+4Cm~uy
z$I$e_-Yg5P#YzpmDY#RdyxcoRq&b&*1#uK`Qqy7(*Q@sSLV-Z;9fRbitIKWZqqlX8
zuS#8|HeuX0b=>)JeQP{C0(7m1ETy(Mt@t#eWd>o*#hH-E+TJ&&rJlQ9??KetuGS;*
z)u@*in+bVT2>2WO+8Kg&uyg5R^k0PpF@;K{$LNk~5G1i_7gI}h<mNcDgWXqx)QQB=
z)~`wFWvykMnT1DC30KF!|9}^X&Tp+6!tO7)5&P(ZOz1&dU28A%Ouw3ILAvWv^)~mj
zjXJUaE@9Mq@p*BG$Ok;5*uVgA++U((Tbbw*iJ7+2j$Q{^g;Ci7EjX0ay2LW{n!ahq
z8(%AXfNZ6uSv9X7dD*Q+BKLt~$pcI19*d5Fv{Rm->&hD#OPYA|A2@X^v*O&2G<7WZ
zLA$s$xN=C^YXcgzT?MJ=_m6|1PcNS4zno5>qZxaGLorir@(<vLEP+PP4G_L2R>Y)z
z-Q0h8xwKCIoIFs_)eo>}pMOp^fhzj>pOgE8Dl+F9q^-SzC9Q!%*eC0-4$;&ra*jo-
zrgqD8<)V3Y@?bURGude_y{xfpZYIwU*gsXI<9!-CxiQfaI-<20%k*a&Gi?2LX~E^2
z#2t`US-@Qmc9wfYGHUQ=`REx}e*$qX2I&{Q?0#WXk(kn1+ONJ{uuw@;*y|R_rb(h1
zwtLvJ6<aGajvM(3Y*Sw#KGr~6c`AuF_&AEzgQ^CKT129kAQF9iARldAjIie8WKT1d
z>&v73=n-OSJ1?m7AK^s(5zpv?U}1A9?30_DDTP44Ql%R$(SZ{F*3xeB;GVvBv!n2M
z;LUlw$!>*Z;{)50$|cz<Wv?@TfOV11A?yu9vf825SU6Sx8XHaOUvEcjt=LoGz!2S;
zC=M#;slNm(4rnqRa8E|*iuwiU!--Y5yf61moJt+oti%$k<@G^@<w@1*wnZq+>$}yX
zS086nv5Ha7ycRL5ocTl~85!VoncAo=glV8VunHHVj5uE6`1$P%U9fv_X`LLOCG)AY
zU#6B#jagU^sXRU>XJL;<YWqRgqpR=>5xu%T-WhSUGUA@*eDwJ!EDkqDOnoCFg<lbW
zAHN-nXfUG`Yf~fHm_L4`gq@!To*k)0Q+S|f>Z3|{Sxn!=Oo;@4fl>#RI}qdjg}($X
z(;Y93_&(#`C0{_?1{+v`IqmJ;C4cF#+GVW2-#LD;cjJD^k(Z*i{}?Q(<7y}Eul<%I
z{3h^#X^AHVnCOp_Ra|`{yfp6hq(E0f)IF>fM0y=?CycqnZV%oyqtr5`K1J$O7L=v+
z>{`in6*9N?t!~d^b<10y={F7Khs_)12=X`jM@1lu4ZUR8{Cy>e89yL<7b)QuxlQ((
zv4UU}CBVml-jX98Q1~#w4Jp&+w8<s6mX^c%DNl>=SI_Bwbt--2Ld4AT((*yV2w}v{
zvmB%7zY(NlzrFO`s~cH@wVP~H!k@!R_9SB8-wxd9`5mkdbTy-t(hXbj<Un@_R!m?E
zK6kv)HV9&uT4q=SjoSBEaK6Ku1OMkgSKe7azcxjBNug&Q0xRb?=!Ns4Z1m8C9&S@$
zuc|oFkzOpo4wl}a75*6-)<8A69Wi2iCpfS{hqN6nz7-r;&r5UQ-7}4R0eE;)CYH5k
zI_fs`b1eF~KS*syX_#9?=b%qxL?Zk-#1wXiD1SKV`iOX7oF>szJ(A#=?km^3YGAP#
zAhJOdW?9>7q*iEluFU5lHau?=)iH)0bTQ`;C)GwN&e>{#WS~6DqF1o7jsG!(^_BeC
z$A>j7+ZvyDrNb{wqlnpHHlUu9;dhHTkH88@U<D6Y#4+H%uOb@pbSpgpQ;;xWKS5Kr
z1noCXSrN-g<BMr}Fk%=vtc#44t)^%!zD*p6l?@zyW3M_sIv!}0g-W<ePHjqrZ^a(6
z5|Oq_cwRziV#X!H9>p;7M?}C;OXB=Dk~WZ?i$Ia*5sL+1jHjJ+DUNF)*rQ-SaF*4y
zoL%OeMR&(EBKVm`7Adls?4(h`Y+sZxt40aa9KJ7yXW7lHT1MZOqi4CzoSI`o&N=vy
zOsdBy<3r7XjCbK#_iEHg;&^y!bZFV<zJsm&xc~cIaWqLOn(>+j#+r;Pj)!fK>c_0i
zP))-iPs$ef(QbsltTZ0ZkG6pi`+F>6JiIApg5IJ9wcV4zp8s}DL#jtptJ@k6r$n#6
zxh;`l)gxEaK=b1f18|$P1N;~0g_Iz^5OKxCL_GQy#>`<(?};TnrK&#&`4d`FX7d(1
z;^XKUF~~c~73VG0ea`}(C&j6~nK)S3thO}@Ba+brOfCD_AWtm(cV$GYfEfA|_{-_c
z(s|E}bM^f|8H|(<SQIYJ9SE;{l1BO=UVy7N%wVKc>`v&rInY4_oc|dcvtWNnTfH;>
zFO@#1|Ax|tqh%}I-PWh!-Nl#+9reD8(LMbxr4*QA@ceZw=`Ys=1q<ILGc@lkRt9>{
z?~4jx;1?dC?t>`Y{uQr{rZ)Wbjg_s`@B0sh)+|Lla3cJtcy{Xwse(`q)Z#P2iZcii
zDS~~_`IGRk3ieFgU&TG+e8qC-wKXei-G*R=uNd(`S<qdV5+ZyF9=n%(j^Cx^TqxOA
zBFrfo(EIw{q#Os`!W*C6nh1}eUSrA|<07zwJl}|(K)3NhZ%RQd2jcaiRbWj;FNeg0
zCR$Dq`(Y%|bYTV7@1y<i#3?{xlY)9k@E%3q8Vj=usk3`K0C6jHXeEp@36Nqu=&Bg=
zz&B{XYuBRL6rO|P1-4B&bzd_7xC*T+m<nkBRH2=N_g*8M=wM2@E!d&LzVKC$h5S>`
zfS~1bLAnY)2CvztL1rhngROhUWt9rJE$z?bR#<kp#<ky-ORQBD`zzkZn)X~HflrBA
zajGIX*Jzs@Wb3%DQGB6P!0&ajX9k19wkIy;?(Is`q)#reUpt*m>4^x#Q>2qI*kWGb
z_m35|=ns$R>${^2G)rz1v_(Ml0^;^owr+4KSGUV`Cisf$UmxdNG#K|^V##`(StIaU
zvDRYriEvS3g;Yt>pv_XbE42)O=A9~z0d?Cz-MgTZr{G;i8QrP;HbKu*(Vfa<>_FDH
z+QsEKNhav11!b)21w7&!2)hA|gP{8U-1rxuflB^-XnywWVyWdH>yIry(3AEkw=82e
zS4%a%j1xT0Cv5#z2fvk$7_nw7h)#r+2Qwty6(z7XfM@n=LDTe|FPeth(7W3o1PxQK
zab}APUVZ8}*3IJJ2d9?AMEDmmVNoJ{d(4Xy!KOCVJ_tTGwQNy&iIHxOQvQj94w!l#
z{8$=I^3jvgER?6b=V(a-9(XmLCJ|1L?N;|2pDWdLyiD$D*m{jF=X2DrW)BA~zBF)&
zK9GiadkavB*$3Py(JP^95&X#N59Ev7hp)O!-dnv^k;NITYe9M<g0xfKpm;a6u)Zw7
zSP$H@flNC8andDo29fk^sDYM|hdp%OV_4s)oJfS<jn=3=+NvxbQY{vY>)W3g_h5fQ
z)cpzN-hacVd}S;fAktZUA)W}|6xa4efBXV_CHUgvg{^w<OOmrFkM)LD-FN?J8gDE?
zhCZ+I&?U^e?MOAEHRlIktAeLmI|;Ilj&%{_{f3p)`j{d;7PXbxy^}x#uPt`q`F800
z3U;<rgVZ)T0rnyX=<bIYr3~60)_*bI@@|I_ZrBviX+<;<{vwtLf0@v$x<xhoP>JxT
zvG-a#tMyyl&`3Kg=-!r=ogLLfw^G8xl?1eMV_B_S;}EdE16t{Pr)`M_GL62!EB<#-
z;sgA9`1SF}RGCEOARQmwZxZw0Fx#-j$Kj{7{U&&^`izcrz3Ye0tLMa*s)p@zBChJ&
z1U!tkvOrt!i^9DXjP+s#DJqxJ5I@l-zvw7Gn~B)z)OKb#84k}KWXF{VX)S2FSnb9d
zda)uAHbie#d+0<D=R0W~VTrYSwaZemKr{9fv0hyK=c+dO51aV?lf<cFHgMO16DjZ9
z@!KJ6DR0hPJ<6UUWx!Lxb}3_1>@T)EiZg4NiRG7ba%j#E)Zz&|FAJtOrFEI~FIA<Y
z*GhOmqP_{Z)}-UaMl<v^DoH0MXzO=r-aAR9KF#?cW)r8YyUavb0QN13RA4^=S?6f-
zRx=Jxnx?FfR%kjyso<SmaUC%6NibD~=1Wjq+*gri^$g!zL0-t(pSq7Tr$7R%fL2X?
z@qZ0LF5?7N27$cqohW7jI~DNM?~*edd9BwmL`MH5m<YpP|I<9qcOLIBE)|yS$Gk1m
z9H6tO*$3T?&K<QUu7@P0(tQW0*bn+Rs}oN3D=S(?>EL$fIm9tiPp<(z`4y<@57-}3
z3qz&osG(F*nn;8X#w$fSPFtLwU&aXe?`T^*PEVo@x<4i6msQ%hFGgv@DQ)pn>Tq_w
z=-;VhPwlOu+)&{=DKFWS*)$8BdnB48jn6O!bEK4vvcQZo%TK-GPbI={^{$Za(>!ni
zw5Gy)B$x&oo2ssFv3QQeWS9e3Urqh@@m(8;5=JbaZBbCLLh8e2(0{)k{a%8d$uEQb
zU(5JN6f@p?0oK_kaS397>{|B3`(u7i#BwBk#)Lq{^1S|;QYxzp+GcQ|oqoOC?l)o2
zW6xr3){MTucQxt^2m9~$;B1#C<%G=p$+i+uda=TpVG-Pvh7&|CaW2{{k{R*aR<g}4
zaux&d^_J4uIs^OpM0ic_#cE&EbsA@**D30ys7)+X_up2~zXS^Cj!-(hs?MdP&gJ)g
zdN{@P%h27D_&(56@+jrTgER)sRtj!B2Yg@j-@AN(WYRdLFa2p<`F%KB9Iq)Greb)N
z^9$X>r~Fu<20=17d#%;;HTF~3ci}4?O7Wmt?7X}K5w~-1&;wnkk)%kYd%O5qrv@K1
znH?BMUN7I(#1Y%LfZy`C+$iL{ipZ7^nqAr6JH7A^VE20s5-bgUqc(+k<r&*DJ~ADo
z_}2mdIx?Z2lcK5~B{RwNpa!xvW4~aTfVIm&cYdaRkPvSM25ryT$4O7cT0-m8mdpop
z_MwFj536mVRkf}6Lt{1Xfqu~!N6x;caU%{UPjJ)t%UrB0dj4AQ^-$joXWSWd%%n5i
zzn9xYEw;Cw<6zD47}R;(Jpq<k561ZC1Ow^I+(ILjMya#0HI#Ai-?O?bK{5UVXfjVn
zaWr8+be^Zkwj$AE)@<UWM-#i`Jcnj`ZL0@(PLZCIF*jQM$?F_^eeU;065)97eW5Mr
zJHam8V@`ytLA6%{9qQ~a!0&yUU*dPE275e}pXr+3M+5E*afhlSLD!1#u&`eRXFI!I
z@!wH4_9t#Konl1nW!0ISA>YtM_p4@5WQyd1UYMiGvQ^8EUFB?VbfsmGt55s&YOLjq
z*aOS^!I$@o;P4}+*T@U{{hVd0s0U4duS)+ajJ|+lYxU4O8p(+c;x51J=|35|0L4Ho
zzDq6u2J)aGVGWW}<pgxv_d+*|WE+JvLxuFd3Tav}1zy2cv<{n}_J^RZC$Q=dE;cX}
zQlh@sw4b&C_#7)v#@;*d0Oh<70pIB?Y`s336X2Wqy(7h~A-d-Et2b>i9nd2nL#?Uy
z%#NPXo+8#WE<oB&g@jqjKN=!i|2?vA(4RzjTrU|#Wn3k{oX!GYP4UnB`tVQn5Jw9!
z*QwG@>J^S$1lC8Ky4QEd5muG+uSSa?V+{52@Gr589}v+W>Hjn7mVQ!zzQ*qBzaR1a
zz-GUM4ZVrTXpiJU+vyLPzXSG3IiN}a(v8+1AYJ(Nksp4N>BPKQZNCvVf;r&)v%1-*
zu+OmP2Tyj4{KcPoi2G1atUx@yKL^qD8LrcsF4Hu2-xz2f@o+Bm?<qLF^>c|E$G!u!
zMr;=h>KJB18+oJGdxZAYu#fHQ>yh~GRu=u6k?^-tSVZcM(m0Wf8K(c?n<|O$Ms-yE
zv6cXjBtr2>!uVaGj>?BoC29Klw^wRf2EzB1ChGB33*$_ov~mdP6t#`;kK>e5O%07o
zxFs*;lZ6B)evGRrAJa55h04dXkc%?*YWQl;P@5>XZIbWAYMeZAHD9p$%$4lW$K^Zc
z(pXpO8{gy0_8Hs_GZ?4Ay{K|`rNIqvyDQg=NWCg^_kZ1LmQonjZE$~yH(#P8-Y#C?
zJyW$9Uv$Y}`nk_6uAA|!D?PZg>=W$ws0DDpi%2K@oIN+d*l!PV(#^_k7q+0xl;HDy
zWl}jkzGQO5uRBd}KkVo2odJTK{_+c{_DGNv5h?0t@Eh^7`0e#`_?7)Ue#3qZey{np
z`0erQ@XM^#<Cm;W!LQ;s;5Xqn7UA?8J$b!ykq=e@_e&QZLi;Cz5A?O~-~{_40S>J{
z6foJ3h8*@|AzqRri>qkce^%T6liKzxYTGZXZSPgv-lMktlG^reKW+Pue%kgQ)V6p1
zN863jD^i)B>vVEt=%HxW)xBLNhMwMe-u1_JtCRt6+OexH&g|RSPQSs!3}s*y-Q_yo
z(ciN7sfwp==^pZ$6?-Lfw}0xL_^y#zDq?ncb9_@Jd`ZXq)x9|L8nycJe7QPkS6xr|
zY5Fdm=9Ja<c_mgZEx~y-x*psK@8{$4d`I{aFFhF95MmE8MM8kZ#o^*{X>e(A>2T?B
zrQkB)`Z*qlmK};-xk5+d;$Fbn-JTF@xf<dvh)A;h7}8t54;d`b_ADJClO==*u5Ut4
z%f*o2@+Hdt24x>c*@sYe70Nz<vMW&bew3|7*-DhX4`uH~*`X+FMOib-7NG24l+8og
z9MJaFO64QfUPEIzN{JIz8z(93CMJskQ1pPJ1r$D%!~hw%ru!j$C+7DNoIvaO?V77+
zlGp$)yxh>5ORTiE@6DQP_r4|peio$<0Vh6LY8lIHIfkd)<)&HKHM;uF$>YT2d}<j$
zR3B5P$61aPoWA(7__!K<m};$n)z+CXHEBH2@IMpR_mfAzL|hi^OjKqX%M7K@yNtoJ
zh)#-~a$0g1BNAzG?qi5Ke~j)gPFE7-gTsy4Ph6&Q0rjZuB_93-eCB#-2&_TL?;3C(
z_;?W)WOByCo;KPBwZ&7*WIXJ|x}bCDJqEkJoqicZDb58)P@5xbfmKzBhi?Eh+CN(F
zUyvCkE!x>!3J?2I2LJ6sYALtfP0z){hoH)ok{07^&d7`O-9MD$S2-(9y+>1-*Xy+Z
zROd~#4(&HdRl;8?yPIi0;pb?V;h*4#;dJ_ghT*TcQqFCSc3-WHh7tE_Ds~i~hCl5^
zWlJ>N&D{KBP=;@iTGHs37Wi{C3YhBV8`|j?7vMX^8G1r8an3<6)k33>hu@7cJ4QC8
zc<6Zd0MZOaH$$U7(NViF>ccTcP-mt6`nYS<eLg)CM$B_9K45rKjEsV}1*c5`2j_8s
zr){u5NRP`|kl<A3e6MjXXuwd9`HxkVRnN*rgpz+HB3bWeai=kM)M`pCqV#JECe>=1
zTdkI<$gQ@}vK7~@pbI_JMj8t@$#<18!?P_oJ1_w@^Wm_lOa9x+B^G{jy?SmS73T^}
zxCTtj+I&Lx_%&G95p&rz2eh_5K1u9BkFZ}?#)?bT)MjPufwAHaHN8QZ3)`~|qx(nn
zkNASaxCxMp3m_p^o#>c2iH;Mktr{WH^9jz0S}7gc*WENeX)K2oTq~9I(!K0F8lT`u
zv%iabn&WQ!+d)>mQH8%y86(cJ6aXW2QJj3o-e9%=gzWbZLA<+jb-CpHHHAf?4}Io@
z{P?Dk+cfxQ6eG?*GRsnoTK;G!?bSqDN^4E_W8yPoUvO@7*J`A{DQ~o%>|mHD;Dw>@
zwD=xXO>4ihemIF0D>x>{ZooZb6HXc+T_CEv2qU<oD-jL<CSd@6vea+6P}@%Sx3KoY
zri*Jg<wqi|*)*>IzB|Bc`s6oYv}JidH~eEWF%pv-o&sZL*B9jx#4gf0O+Ee_=m}Oz
zm+Z$w0Q+ogaM_TV^Xd5!@8Fqdy)n=xwfTM_FWZFgFi1=EINx>O@vCW^u7^x0Zq;MY
z;}M&pJzY`6m;UXlk+ZgzU}kQH&*9VH*c?Y+WNnE^BWv~2Xyku@`2AO0XHTnVTivnn
zX4Nl9<Tab-KK9|cz0ug4^xIXYmV#LYWfmW`3}ptt@(qTKC<D9ALtUnF<0p%Kxp>x{
zrY8$wY*g?58#Ese1f~`uVw&23yuO#<Z;ypHz{lPXXK{Q;pG7*u^IeF(qw$4Q(@C9?
z`aftoKktvC+_I?$I8|^NDbBx7epika{bmLl?V&dy+hBLsw}29F<&g8Tob)OJ&&UU#
zP1TAAdJK<_^?V_J?T?1XCdkk^*Sy2Y3yf9Ud56W&;1speY}G<kgfT?oX(&zo#L)7b
zfV$Gqpy?qG>7@~o7L52S(6h-c%--=^c*u*_!|yZ1b20RZoW6)yxSpq1HM^J~<G2#a
z7w5_PM_$8uvb%k(8W|T0^VnB^1WTI|{#%@_kHJ<c06)h=%vh`V6~26?gliQ<0bm#U
zV}jzxIK%iq;D?@B8b@(~m~A)ix8d^s3^&48DFPk$JkNn1{?TZ-753~Eupa+5aBKOk
zp4(<&jIk)r^!T~xk|;g<qMp~u_>hOMWuDAWwtHuK_=afs*#z>i*QEXzz5!dg+0pRY
zM6^n+xj0&7r4SY`f!2LF;)f)oa-qHVW{mEG*iAEu^<B^%WW#Om;(UjF5zYu&s~72{
z{!wa+8}CU&-+<+*unD(OAJjmFTJm(#*{HtB;rTIynp5d>A@*YWrjedYA^ZK%zSl5;
zBF}|Tk>`hHMfeH_J+)zuA9ke%FsIP25kqX{VV%=TOX7|uEBewO^QpG9Rs-)O4=HhD
zZ)59Vym=UQX4vy%bTxQFO@EtMVs?s)+)dGI;HrD#v|k@2m<tu!D*<L4{jQ{P0eA=h
zF9W_$Qk+wtPb%?Hoc|YnF4WF_7Wb{V>TvDG^=Dj%aqYwPCN6!8(PP9cyc?r4z7x@4
zyRmDbZEZo?qFhD%NHqL;?0sPNrpS+>W2lqB_oJ9HjWiW;Jbrx00&DavW()r!*`kqZ
z`(mvBd;Z^}$u)}Rn_6Ihz}mz+^wRgTV70>PO4m}2#J(Z7Y?3{W%u>!y<0iAj?9<%H
zVP^{Ql?rNUr8cW~l=tyPC62$jH21=S{EwTTkUfIEbRf=mJcjQLFjLY3TLFQ$OF`ap
z-TGOtIGc=+Ys({i(bd4X(!+>{mfKL1d=#Rk7v%p0#SSQlN2PK!vxUlTve}4lC3pk^
zJ0blxkEw|Tq#2Rqc#?a@7qDYX6S>XA41Eo=x(>b;O}%C_FYQp0Fu1xR_+d5mO4!#2
z!4?^WJt3`+?;x!tX1#RZ8-&mZ@PJI1$FdbWyu4?q)|D9%O7)UMJ}DD(QR#8~mZ<d{
zE&pz}#G*&LqT23>4((9d_FX@<O=~7wzp=0Nj$YdOPw_NvoZBYb#k<H3dRnTG3?;*u
z!(=#nVFGcAx8$xqEahd*fB#M{)!#fc_2uRvWVyS-J<aWPlft`lmP{?=$LHkpd8s7l
zS5r&g%FBLmDiNklb-u+<m_Cg;{}<QipONj4-D(v_;(Q7}UYr*EY!0r+Ze`vA*F9#w
z{N)4B5MtIzm)dC@eXh8$`6U;3zB#f^JxMTEwmO+&3(gYE?8jK=$`%42G{fQRIeI6)
z&pFZ5GNYLvY|#FrnLo))oF|(FQiPbZ;=7txHE~^j7c&WU1R_{k@y(r1cV>38sqHpB
z1K)AB*c+lPE^OZ8BIiwQx1uGd+FB3tnMt=bXKI;K1gC5P!Fj7}alGi#oTj$sD<5NC
zAz2xG{eg6@We847kWXr+-zxK?+?Q|TjNVUlJt0WG@|MN|aaXTA*Du<^@rZ#{3SskL
z9V66Opxw&R&L>QKGZ{Hde50N3D$rKA#H-T>a#+rIsUT&HIKTZ^7fH!N&1%G0lZ^4r
z_Rq5RL%w%Dsr`GGkeVs(cMbZanlQCl`?=01QdSHZx1Sltbv~sdBj=qRhrB1XMdB~y
z_w$|Lp7qL&RF~NJOW8_DB&EyX#tA(;Q!GSMubd5K?WbqRQG?)QvT`z%5m}d5AiqE5
zc6oFog|v=k9Jk5-DaO(xog6m~`ZuxEP0McYCoYuVAL)`uJD56G^G?@S=T_zZ$~6L3
z?q5Nsu25**C%6&f?XrL5FHzrp`JGkMarcPK6eWC*QrKJ{8n>Sa?{zV$3~k@Qb#6#K
z4c}$HNIfsLy~N=|@AtuacM=vgo49>C^?+uI^eYG7wb!&{iO;C<cDXd#p`JmEH%_V4
zQM(9@iaMvT4NRRyq_*QzYW@gSmVBg8&$-k>hL#Um*1Q2{4;c+PC$&w^v*H^$bmzbA
z&U0i~guBY!@k2<4y*-%kX@7ojmN@n5Q;bHuZwQr_L~v31>0$^uC$}BRMO~(OA+3Fm
zu&7%#Ki6F~_q$L{OQ3_lkry?cZXA-ZRPJ=8ogQ!g3c5|kX{%4bm@0f<`RJNU_XXM0
zKUla<8qZ#y#}t1X>cDSD$nDFXu0k2li`q`N78<?^C-?M16;A%?5#nAI(!b%20Xz!X
zQb{3ipT76MwXl%A0@&w5UHCnZKGF!~bl|C8N!C!p#}(?qPxcCNeC@E2SxtWzK3I}x
zI!f=aPW^ws-!=76<S}r!Lp^P<T|CswIx@Qocuzambu<6jV0us2EbaH5X^ZQjW?Orf
zs1u(?e7q9=Hf|BA-JO1)?~PtoXzo0oQGWS2SMYINuCDV*o|uop*7#>v`X~CXLOrEt
zO840b#+Dv%p&m{mxZ%HPhjx)BM7S#kx5Y~$+OBUx^o)X|<!Qu68$?F+@;(C%2(gK%
ze<)6HR)#5DLWnJ^-RnAz*`^*$oRuig5TO_E){6ZAJqu-DkDtZ)2ksC*^k`?PDJ!ap
zl4ebmzZVjtgulraAu@IkDYVR;pw8{n=Qr7X++{sy_a<Zb9)%T?o~HO7@q5|}H2NkP
zCCS*XA|6KGxEt%cqXnlD1a%g2OvmVb+0_5{yK}0eZ52Gd12JAibFug?=4Q-<6Y<4}
z<9)w13wB@+q|(it`|9+}!=3JeerKs>L?e4A#+jYTFW!z&dF*vWG0+n~Od-y<A&N;x
z3@pwHiu^>rgzd`L{XukI3El|#xT0IU6xB@G=yJ;ZEfr!<&^-9KEF7i0xkd3VraR<K
zjWkkT4=*y#LdNuFJ*3}vG1!n1pFzJ&Sf$dV68<km5APS{@XulnQ4jCWaqJb%pj8@M
zZ=9nky}#9<e(O;Q4}!kSe`dftGv4k>&~y69vdm40-lty+?NI$MrFsiJ1A8_0k1DR#
zSk2d#RcmUWt=872it9u&{2$f2+A8>VeIh&q57Sc}6VV@yc&q9qDpsu3Tx|tv?M1DN
z)tb`lWwjHOa3L*Onk+d)u~w1ViYlgdZxxHu+FDKNMHM!EkI06HIlwk56)3g0YELy&
zdlBXM%@x&Op#{VaSx0AEt7u=6@UA5;qNEk&DyrF9Yn8V4#_YX6y}u66oUm4-Rg~I`
zQWt4oQF3(d#s4UY6G4dzl-o;NRiV*x7*o~wTzdMyO0=S<$#&)VUX;984Qx!P0LJ#B
z+{K^DRs2-$>-hLwoaR0`zEy9zRh^+ZF~*jL=&~f7lXx$Mu0L%|jL()&s^@YaKa6>i
z;J;6Umz>6pF!ef|zhnyO6aD&xPWk}fo~#o4_41GCw@?bHNla9^wkujXq_CM8sXadl
z)IsS)AEW+ueS;ofGei_=%&eCCBx-BYH`v9o>I!i@#!R^w;(RqN_~wsR1D@ssR3cD+
zsTR~@LrN19n|M{XxC2^&8z=Io;ZE0*4DltbL^<Hu0b)K%ZUbzGsD23$eD(AZ3nUWl
z<1zG^(sesxFHE@qSCp}u#q4?$)~;Viu~w<yrg$srKm?yj?fbr{8GR>pXLTtjll^`N
z<wmHr>y>Xp`nq#E9o|r=E$W->df4G@xu4M(A=;(|mNt6-6W(Sw&{j8KC(fTWH592M
zKN&YQWbf0XL|Qx;s!}28QHMg@fI4`K)JnBZc3+)0<A9{rxf(mJt{=O4P2RzPaUkw!
zr5t8MdVZ9#X#-RTzP^r}f2#(v=lW`s8>84yaxNdke}7P`>3W>C4^HNsRH$U3x-o^@
z9&<EZheWM;ziBH`ZCE=Yxh;R3B5oJ6dini`pcfHq0{qZ8qc5QWfCf<eo9JZmx?b>+
znojBhe~()6{m7{(4ZrVh?1hx%GhIF2L3%78QESv&%4E^7Zw9uYINg9cbZvwcNUh^n
zXxsuFZ!_K)u+ygLy{Jt~QNQ#q)b77;s=6j^>T8j<@H}d=4Yb78X#WOUm-h8ZwO#6Q
zQo?@4&_H`m^H-@g4GkWoA5?CGPm0p^&Pc9mC!+Se^^I8~V$c245RpFs*r2PY9oR_D
z{{qFON-!D~;0EVRR96^}noeTe6}1B!N$tsv(lp9N2~S5ZjccLl62&fB`qE>OrV;2=
z?v7O4$WP*@0OcuknlGsNNr;(0gPw){Q;Q@{Vn<Yde~N0&O^wiznaMBmo453mP1*G`
z)tMg=DZl(Qr@<FJxXz~yw~994r67V50{wE;I)9R*21ZP;WjB<FX<dFj&Zk9eu&O|k
zMy!aHqxAbNz9{nYT>4}KJ=agCsbpmSxky{@w{zK>Mm3XB73cZ7!9KdDWwa*fui~KZ
z-2%N2M2?2$Ov|Rv(+1daYJslNd>4;%yKg4$5>5NE8z|5G2@yP$a_F4xKtwpV6Kx?~
zi*%W|KuuqY(=xZI>8Fry1tw{kwUJ_^a0W~yh`1X7O3?2URGwWQVYkl&FXF2?z3g^P
zozRetD7d=bF{)<Y58SH7`aBP3{QnPQUji6ab?$%ey|ZPqO%^aD2(u)Rg=Gkf2vjCB
zVaTF}#SO4^k_kGKfJCtBv$jmwMAX+n)Iy>y8f$^Hkbrs5$fF6M)#__I14$*IHArP7
zQ9B_6Gg;^V`|h2@pw{;nGxywc&+?t`ob#RUobxS;8ddcZu#P0#3u_l-E9d%S5#X^o
zWw$j&g_bD0b2PK9s_vY))u;vgM(l7`4=eX6_OcfuF<P+u03;s`b3ghic=1FlNfJgK
zqBh75^1B7p(m8-qd)GuH9^$*V^7ftF3*79KqpW&GFmD=J3drTsQ3B3Wp2%nUM=2Z=
zw%H@fVv^o((e$tQXMfi)$vXR$7yH<L)z_Njt?0X?h?x52Sld-!S7rVssHu{JF8YG$
zjSvECIPoR_EbU^N`gm88$Th0KHRkp%O_cYfDn~e`37|Pb)n!kXH3svQX2>%Ht#3-b
zDS~ukgl-p$?cdqUs<{`J1$R!P(}M8_m?0GS<M49pc=X>}I5Yl}2T&QOQ2T_11uKK5
zMFJ!}6Dn@SnJUY&dvqctcqJ&*DykP+72=MAdW`F%o|MMBe{k#<fAGaVPLsWN{2^$z
z^`Q;M^Af+ypV6#><S)*7`lcMRPof%`KIVWWXqz_v;0nNhFi1D$ii1?XCzu4xBmrAl
zVxBeqF|eyN@^#@*4A!`X7<-iVIBdGdpj@X|b3^yZ*u{Z0N3v^U4&9f8^Upp`dzY8i
zr99N}67G;|JcT%4dL4Ww@tWu(3-(};%+r7;y9pEpGVZ`kv4<!&(WZrcvqfr0ls2u8
zC?)l@u}=*cvMF^RPW)91Fh^!1$1OMGB&=^CXd>-MKsjBZz$IXaLK0oaj&0BYzc91g
zN2tov{W;c3kxJwRFF7q;f8KPdcw}uE3=&<G>ii1jjD)>|yodu@=`Rk>MtpcRL3(vK
z+&-8<vu10KSax!-jrQz0yKtUEyC6yTM&YXo&AgekENK^n(ct1S7Eg+`N+lj0vwHnD
zNbOh%ImvCj^!2BMq85&*>w}%Fi|+TI0WNb;$0SH4Y{z*hS=!77)g%nQ5R_mg%>E)s
zZ6F*zgV@Y4UELJC<>nDA{~T~gSd%b$8!$kaO%G#sp7<`U!ao5PMlie_`A9clB%S_S
zJ&-K+z>?7(_)}jF_+OH}d^)7+apA=1uAo6{?)qS3E}kQOF;B#;)E84x;>a4P8>F#7
zkikADpcuh_Oprgc5V#<oJa*75j)-AczRm|+!+}{?wMlAcdMI98*{GL>14~2idAUN#
zJ_L<VmRGT~0X!l-2XQ`0Jt(*CZHNWuW}3od7x<>MyX3{)C2#Is8lNMsVcI_9F<Qfj
zR{wIy*GTCgd`x>!uFU#p4M}(TLN8#pVy!^9OAOO`qpEi#(Rs))>^E@QB!aGzyX^z)
z*n%{ImcrsiA7?{vSJBS)4QQ*4%yCdQl^pbKzWR*Dgg(;XRw;4+aKMedW;UqKFzzD9
z*B_jK6^>=2&UZlhS75Br8kW&F0aQnBwKq<|%Ht9WaH6tvkx-pv)nQIGg9iB;oBFr+
zOgWSv!Q)h_gy?a0{86@NIq2JX^Z;pxjt7mRmTe7FWeviXVWNzth$$kTS&OvCWT|`l
zxMlXEub5RIv+gAfHa$e@$Ip(eFv5mMWG*-7#}!|Sb7l`lHuRyePe&eYboWkqj5TMX
z17+JodYsz)-snW1?p@jzJOC|J3N3u%$H8<hNh!+OF)HDeVHgIK2-{_#*296>VmQ-U
zkwhavBjT9)Hu{O(=z%@hBRa9BD6tzI4qSp{uIsp>N2cOxXvYt$DcJERLl)g+Rd#RT
zh66X@JsuQ`KM>uMt|IB$zXPUhP(2f1DWA0FXtF}l4(lcU(g;WrinZ~F?h6_;D=@wb
zOo<rrkVZ-MVI_>hsnl+?61u4vN04(J2Gm-N3wAIm8mr21;0iQf9KiPPLUc}5(R37}
zAaQgI>}@!si3#Uz8~)DdjH5E29MWK|O9J1k24|7VoQP`(ap`hvuV-Y;&V|;|mu_i%
z62@u>4vjQEE5hTm3c5EJ#4))GtM@0tys8-JmF~5gQX_g&)y;ql=PqMr#&Te27<WI*
z8X=kW3=c_M>D)bY5SoRHE@OmCI)xm3;-EK*b~jX8Q)<vY*V!wwwG*u=wOEmrc`aCx
zl}wLWV63$6vd+j|+Pm~7;K-_T?l!ZlJHV@HtwJ^IFb(USOxJjq-Z{(4!7kWv;JIO;
zHs6{o&h;I`tFb?%*vesPy%-MsVwh+j#T^j!)Q4f+LGR?mGPG88?ks#M8&gK<Xc-TT
zmT~`R89RoLGg<Y|IC=H^-Afbbv_9o1>}&Tbs!ax=`lj6ST=6W`Al0b^#OsH(PGv1t
z_S|GEB+R<`sGa5nNVRkPilg0b$T=*04re>E+G_K^K9<++U6ObqrIxEsu4UEW_`uW9
zD!X;S)yNr=ApK2zOv7FBAm7SmS9tFYY8NSL5==|+yyR6@N$vb>NRJwijloerv|6NZ
z0a)dfLOQgWTPRd3Yk%kQh<!tx)j-2U>yB55%b=ADeXS6wpn^`B6|mgC+p0gr4CY{_
z@k#JFyLhG59Bf@=4(?wB&MO(5ik7pk#)xo1e}1Px@3QLEX!TAZ$=aL*Zf(IZ{Kx39
zE^^ueq+2&cp%n*S#jJgBD91{1iGy?!M5|m@<qEt<4f0j=HU;;Zsgc>%f`j*=&#X8P
zF!?4`W?NT?@3-MyUS;x)t4#jA`p9hX%d|_lGsxF21+)dAVc>wk{R{^_8KND`8mwpR
zrQtyCVDz=NC+V#KJ1UA<h?QlTb@jnv?Ehu8>TV%|_@+GMWP{-PgbCK{12h)<20pnW
z%vx|@6=3fj$hw(Yx7?b2i0W+(7J?2hIGBBaL3iYiK9rDY!Ma7?WWg+~%*#;YaG-gR
zuTemQOu1*4bv1O7|8hl@2`Tb{Sy(+u0`PYO%a**=vdlWU-_;k<6Pguq6jG17hXcC@
zgni0M@dt3qI2Bg(u*XhpfsU$HQLnU^LFcDx^vHc+Kvo;wb3i>IcNyw>bwFAXe=;Di
zHP{aJ@Dcj@Soks!s_CX+%K2|#9EO&)u$Ojh%aQM)L1AAuczet>;*s676B!O945?rx
zdCk#+gUO1*cD`0Rq5at?w@ta*gRfTzdzV|^TAB~eZ#Xb-Am928)H6q+R$3JG1asUm
zGjKZ`xE*jWI4~g>t2eZDs3eLt3<AOhfaQ=GD{yR3s9`Uz6mblh8Q|0`a%sbXfdOFZ
zR%+QEuTX<q8b&nPY~uH7EPNHW@C|R0^$>0<4|w^#Z+PcI=7`}>S(xNtu;1PQ%fAZu
z*`SMQ{H_Y<6~otvXg8;VnKEFf$9SCgx0aB7V5HHKEX!#;lSRAPttF5S+?Z_B7Q{QU
zbp@8m`9}wOu5#I{ocVIru5VuByiYE)QEl7;zgNH$ya;ZFCws=0Npdn&X4eg6Muy8&
zk16x-?JTp+%`FIe^?(WaN|J4VBbh0{dH}qR$sEf7I|Rr6Z+~~V!J4nm1wAUny1jU}
zd21J}VM22sdNFKr69-!e(V}EHY$7n&K+v#i;gDdMr<3K$e47U($pz5@;s9&;@=}Br
zwiLgU2euNllus7UXaAmjKAbR%@<*wB>creQtY%7nYXk59#YP_1h4^Ux@asK14=WXH
zV?|0!<`YLNqI=W~)?8RZV=`{fk74%^n$4=Sah@YVXAIXOgQX1L34%@4G!U2o{ZU9-
zFj)4tet7h0QNR0SC<*tqCv^(npZZAmu?lHP*5%V+ZWZ0x7WrR#?CGO)GB0uMnW!NT
z5@W{(<~L_O!7ZvYt38e<B>U^Ip&vNj&)s&#6RW-EovekdmWUVFztEDt_}NjbLRy1b
zlv*R{w3oEt;sM2nI(eSLw-s{3-q4|R&ixnNb+4q6PB3xlfVxAS*9TotQ&(l&pO1cs
zeAAGxL(KOO@_i`gyMTNu@&1?cRWyB!b5W9z)9UyG<8k6R5P*#Wgvk~jNz7TgtSIfb
zC{2#ix^<HPg{d$8pdK+#iY0!n^LtY;8;=K*3X}4yA^G1hJCvE!G6D8>RC?R2;lP_g
zvc03#4+oB5KO%(=1*vr@2ROvO9!xm^kBSKWCP<t;mDYf}=;)pTPJLh?FciEWd<?-$
zdJYX3$Nvj^rgYb|3(#{`r<QD+G(q#X$iMxOiGc85K~97)0}%3V)79v>URd#y8FkQa
zH(ia5`x0+*;~~5i`FB3@xi`8;A!LH9o^pdm`i@3*VPpYXq)``wPG=;wz%n}I_F>~C
zq=AI_vyZ&*m2_uEVGF}o(e!tmNM!qXfwZkf-DvkL^v)fyB%svfbZr4n3xUBkBFx7g
z$pXwT2Gs{M5%;%Y31+7VbA|||>1sJ(j_%18^nh~34N#7QJoykTMMw8!a#DCg;e;Fd
z!8S_;J4{2^i%1fW6z&Se0pk?<JVfW26uJ)W3rSL)gPwwtNxMC=$w{qkeWc!d5Bh;*
z4o2G>?hE3pW2n8{Ke0O{{*ZU)qrL5YG_s!vmBPZAN~b&Ue2_N|K>x;o+Ufwa?jVI;
z4=pY<eFtLt@+%Qyo}=*Y(0o8lq31&O+JvmXdLnS{M(;JDxz@NtxZjCNcQ{2Kj;gt9
zmn1`zQmc<R7>BXEZ-~;Bh0+SAd~ZE=w44)R`3XX^#8Ov{se5H;Lb&cbQFmchm1jb@
z?)yXOx(TS^pF_D_PbX>(aj+>SKrQ+CpkTrY8}8zY{D&S<=gED)g^qfJ*tbRg`bVyL
zOT|5cBttQFToZ1gcWpg{u~3NovOLq(XXE6)?V`my%>OVQnvZ=1>26&K?Kj8a9wfth
z8aZx94%5}zI5}!uhZ@~O(r9`m?wWVLG>4kv^PXvt`|b^C8#U;oSkdNVf8a<c26|%+
zuzVfs=JZZ0*_^mznC`z62l`=|Qrk?BGyxJ*C_?g*E7HTeNR9~OUUL$EO*iH3MA;dz
zDxqrZ3w#=!sE3Ab6$gKzH-((mNhtG|&={MH=d(jv@rG_GZe(4$MTq$t`pKrNe~D87
z_87pvQG~t7?*+CbeN4hlMbnzRD%25xoSU|B6<Tmu^jCK;L9YpAn0)(Pci+(o{ad;3
zlVNC`^tf1mAQQVtsZEz43CtN28t*{P?LkGo@L~Fc&IcXP0_hJBjLCrHM?)O+L_>j<
zfQ>X(HHdp}NIQkzOk5n^TEREd9!>76A9jlNC=6&<6245vGak<rJQMJ|X^3_}{n*oG
z!M1A9onf7zU5~OO(SC~m1iKKjOd^PyuLSj$;VD+%QRtt~3k8CMF*AZ5U0y%VH+UU+
z1QSBMj$jPIHXXq=fG5=#7$!X|+&m6z(mE;koKWDa;h1Sbk4i^<=^ZAE<tYf200VmT
zbF{~W6<KRk9b|?Sj98uVd5RDGagc5|6?sE}j=nxG;e4cziT2X`|2^ohrfF9LS2YQJ
zl?|U8L5#zRc_!d68q^{=FBteJlze+~ekZj2<-Q)YmB%Q0XqZ133kaTvTyi3w&kS<4
z<Fo=Wj6Ds)`{xKfCZ6<lbMZ$$8Y9s1Jp-q7lxxSZK}Wf^467lTNpLO0m?L-yF0w~V
zr_Aa}?_#IQpN|I&FNR<zV9!usJ#L#bpx-?dcz7tfFy;mtARNH>n>7@89DS|DC>Vmy
zpkz;AC@^bi3HIMN&QY=_qsof{$NMq#A3M=|yttdZgcAbZEuhxbA=uq)S+Ys8&q^}r
z5qa1RLx<}$a=b^Dd3A!A2foz8c}%#Y(wrE{qiOm=yup|U>~6))^IA{ZL6ZJD8A>}y
zbLgvq=?7^JT^TUx<^r$Bhv*4<GjKPxanPhsJ4hkO1?uODp^dP-M=@^>!ctrH5^!qK
zur@LfXoD32nsqC3Qc%~*p?-{r1mluJCPQ>j0(Ss)EQZF<9|nkuV8tu$_KrIwKNy!s
z@|{%PeAF;bEI9|EABmwwgEx!MUkt`-`F%InldSn;gJhRjYjvQN<i$YZrQGPVil#F-
z_ZbKKl_awVyZl%&9>C2ic>*ANyze*1p`PbZ`Yh;g4Pop^R2}wu5aK}JhcI^H4#@K}
zA@TkKLPO9E)mm3z4AYpX!k@1x<<69%*^cApXBuX>lM9nY?|(Pi^&qR7E}pDv3XldJ
z>-|rYXMq2|zJQ}Imu`@u=^*zt4048E8?3t)-eTKi6W|Y&Y=8$LH%$8e#8a~Spo;<d
z%D2e&I{bCLwYY)NSoJ|h1X3QMSm66bNa@quDI5lk#Cb8%$*qIxBK4h-cl-*pxbtWT
z-ePBC$HPF8X+{?e#!Tyh_Pg%}eu&!XYkFE7Gvo8PJ#wD|_I`pm#Y!xaSCNb|>>Zn^
z#JD@-?vU4T`(%4;6GzG>TdZ#k2(>BlsCG(&uQmLfk+0fWfCBf>%I~R@&MJqgRt?5C
zZaxY_rD#<qS~b6st4+ZP)Guh2dpZc2X?VBJy6zVCej0ofp2{BGjlW98p$VW^slzdU
zm}#A2twG(lTB+Vb*huspWqP83s|I3bC}AbxU(nC~+aQBhW@uiKZ(;<j@Tm%Ln?W@6
zOYCIHEA14K(*Av5zloa@Gi_-XQ-XTSyFL8@(;(YRlD%@@*#Y?ZYGk#auH87%>1MT$
za+7T1>Sg+rRr2a+ah7fAW3{lTvW(Td;yMu=Z#?VjmL;@D&4~F}c5QGI*>HLtnux0G
z*RQocI$~R(4z!A^U3l!a&Y5yud*qDZ$7~;^F3+vI=H959Rd=m*(+Wt==isjfY3UoQ
zk;-b_l#a3*ZYb*<{QaJ8KGB#iQ$vEVAO2aI;D<)$iN+Y4C(7<SWkTB_xvU-1NqzmW
z&lB|4%eXd9yTr?CXvdRa>xZ3#ABpsve8rCN7&KNiO|OAZ;|w?F@rQUF`Mjz+Mt*PV
z%ribd(HCVrfju3|ns^>NUQ@IioH|y}uV52OX{>JS52*SzfTDMpY(@76xPGKIl5ZZF
zM~!%|7*BDlWn6oIph^5*E9U^|>7X9-pS3h$P7qAQH@<*XBovr2oQIJU4T)+x+1csB
z=y616$<8T&)!LmMGFdxx1Z9(<4=0E*$@1%MT<yN~nvARGK3RYBF{UFc9kShW-=%(%
zj-OXF@6I$USHl_3tgkmEz`igyH)i^EkJg$f@?Co|)|j5g+Ctna$qs&jG5&J@m%#d`
z!Pi|=il*Kv^gtXMcWmugmug{86_)>MW%>&U#TbQy37}372dNZp??@>O-Ylbt--V}v
z+MR;Gb!A;Mg;M0F+qr!Sh0BBKk>F95X$oQrd1DB=qzTqmjB?Ps{-a)QAC<N|sEXvU
zHcN12;ycdV`!7H@a-(d&*q0+~9rY*8zdu~l{Cpoyhv>fIlb~%2q%?<U_uC&xM2|%p
zS2mOXHMxhhAES|$=3{^0;Xcl~uSSVhEEaWb|K%B982h1c_)Y8Yp^MF?O@k)oTP?A3
zQljWIGWI}foPQI1qrj5ka%=1X=9|{XUQ*(8H(z{P*hh8z)lFX}^udA$zUAP{FZVFt
z^uAMGqQOS^f0+Dp+!7n02fQ1$%!Xdy+aEX;e7#mymGZ>w#x&~x{`AJzYhc;6A{uFp
zC+ccs`^ZY{S2(G@>X`%xBmOYWs(dFE(4|BfDiok8fO2+9T=%BeYL7SGjQTr*ukF+7
zDRe#<QO~N!9lZHKG_=T>?+f@MABWZQPkox^*K3n1{?|*XPU751xsO7p#PmXqd|z}u
zy}N_Q!|Rl^hU65sH|#Tm(s56M7PSxF28iG6qxEwU#=YcEAOWk-ygmj9D0EAoWXXua
zv-;)~&bfi}aLwWm(U%3{j(Zq#B8Sp`J!R2U=>{6-pEyM~UA=jED(cyRG}z(cZs17h
zYv?rpGrY5%wESP*HM-ww>DEhw)Q06=uNr&bVb~g$IRCWe|G;i{WFI+Y`A1&vN9R0L
z?`Ps3JCl>bBQSpwR2Qnh1t+VaG?#;SV+|l%G~eb48LUInEG`_30IZp?Q4|bZ?1$8>
zo;c6Upa3qLt0hYSk>bvQ@(T{o&Md*EdAnk1k)MMMyWA&lCK+})$*}Y3xryK$+k)*u
zrq|~l#i`i42=Qk*;QC;{B*TvJZ`ldSNu<|rZ`fu2BxtOHWuP<nA<eJ)@4Mr^+q=j!
zN_JOi7g>AHCQUTGsOPJ<>B-BQUT>S~nCf@kGS&AB<x*d+a;l9#K=-o^p-wxUg8V+T
zUwj@2*~I7TA+7k_AL=Zo?=Oe;i_g6woA`Voq%Ee?Q+SqzR8JIe@@%NHge(g^9ojEG
zw?ayh-ZzJ|B}SYdHYiEAGTHXJXM-;m-ZUAn=+VepQWi|uV$Qmt#{JSP;9*%%!jTc-
zjlpixd70f^+D$qyv&lzIH|es>?k?#jT^4$-6Q8AIh1a+Bo#3>pcY^8oOU0kI>Xi4c
zpk`W)?XF;y_^T3sW%ym~5Ix4hPPhv&op<CS9sNd$zbf%pHcd0<h-8P2^iG*#*)2^I
z@2FpYp1~p&Y;=?i(HW+}<C>P<v40x;RBAcxIMJtftRPs(gCl8ZCnb{?DY6n)zup3$
zKJ{zs*9&+`Hi%3^_3I5{>^bk|X^L~N_f!bvO90y3T6jj){@p9uCDQVyU{m((26%zv
z1cME>S3u1Sj#{M!TEEi^3_c&ch}-am8R~4Ag~|9!aty=jG}&ob;=zgjP|nqzw<sX@
z3_BmOMh`|uVS<TD8W>cdqy%63$}G<%cs;~uS@D_8P^^bXAJ+<fvAwuN43!ikk2sR*
zifP?7l#m~BOW1R`ypwG2m{R!kV;ur0aPS0dVhy@d-ZH=2aUJvceT4b+4?28aF701Z
zn<9S1=&bhl_zU@myDFOEZ-?I^w2%B2?Pw4Xg8#MJ@m8L6lHmJ@Gelcu)f{$lWGPOl
zmRAP@@q=~nnKW#%bSd~u%WF0TxM7?FqrdcpHI5EPJgl0?-BFq2;Ok!CxQryv1jo&J
z5z4z;&IVu5OmLj+6?FKETNc!@f@4vc5pFuAmSyUp51p8o1n*&VN`Bq}53oF+InEuM
zFJwZq*4hDonWuUcdb8!6qqR53MrCkDZkCDB$@kF#pRZ!6Jg*y;@5M88!1EOG$MH`x
z(p#ppRqU>sIqlNU7j73EZ#cY;3kroVN}+@f&rjPYHAc<2%froF0pE*zVLhfEzKXtp
z2gmfX3Cep~2=CDOju6o6d(9ag<iU`opF>)UPlYjHaAcOzh)A#)Y<5SN)8O9>{O|_5
zjpX3!9RE=OYZnP;A$t#HK+|K85x^ftOAz-Gx45NK+;7UFl7#P+#Acks+VD8)ZFARp
z3BCn@Z)9|O23#0ZHOh31&i@OhEXO(Jboe*ir!2>B66`4*aAi4G;rUlQf1_YMw^Y`{
zdXCBW<4UGIg0b|P=tq!G|4WAeTaX6yzceRa5^JqhwqtHqh0|Q`_|mJIA-JPvs64_<
z1#na&yx&f?sowQ0_Lf5<(zRGam;*JT+3=`ThVWl)!?5y7{t8ReuXlXlJ$7yXOqrC<
zV6a{GigO{GsH-$5SXL)y+1+C9y~3{mLD6XLdaq1`K;z+O#-NN<@Qlz62p0Q8hwY9`
zr!;<fyWRE+Z@1%TjUqIg2%6~wO5ky|yc^I=9caZ23Uq9v7DIoRzTYf<UnAdqt>nmX
zV7!>(ddDVlewAXpjm)odXKkZ6TY;%}FnVyKhny5sqg;F~4|#*oi09L<b=>V0N7rb&
zFZ-o*waU%c<{;fa!|8Iob?ZN68Ex<x2I^HuKEuK^4W2SoFBdIzoRi<&UJoCxSsu|d
znOI^KYChc$N^~ogT7}xp?Zi<n_N$N7iFB}Tt;}2GW2#TQ3#m^wEkr91^;cRKIy&SZ
z0SmA9lYdYieZsu*EJe6%8Cq3k`~a|5L5rW`@uro+GBM1uPN8>pjH$U+c?x~>bF?OJ
z$@Px&m&u+Kg^zW#T`n&pZ0&`-GGS{kV0MaF*lXMiY&9Pq4ity6@W;!Pj>eyq?(T59
zeZbalk?xLgx<i+FjNj*6mmFPX(0Ji?oAsWIa?D?zyY*-{H#x=QEEoL4W`t*s^BlyN
zClEflA=cAXzCr~Ko8uNVcAMcHICCA|eXVwG!Le@hhJ1|c#r}`~fHA@?zIG1J3vBVV
zHaxMWh$AGbpQ!t9xEXDqIp%}nca<er%F2lv9K!D@duBPe0B;FY4~5JtsRl7*zXVEx
z-bFc=#OEdS#XsSp3N#6|-HP^o(nl2kddC9b@1s7V@b7obxomLk!}pBC-_8B5n7amF
zlac$6;oK>gsTKb*3N@`p+6VZSOK624Tte*z-_A|6&JzT6Vi~pE=4-(}3<q8gm(lk*
z-Tg(mUg5|uM+{DkVFyJ^x+)v6BGWqjta<L)40zP#l#4u>j@_^m^xrOL{sH)`l_=b^
zwzc_@V#;HXyl8aA`(&}jx0`%#xe}C$_BxuUe%ngmOsE4Lbz|LGa|0c{4|EiN4%BIZ
ztVJ{YIHT6cQ9j^V^M85%2#Rz2?E>T>v37HZ;j0y+LEy5M;Ju(=GFBytwu3$!h(^=>
zt(1n(n(MaY39#zGTRR<>9H)B~hLx7jum<InwDt-bE_(&zjK>Ciy|C8Nduu_pdGa|n
zwa!r{;xNHd2h1t@Xy&=V1C*iODB)Q57R<c=z^v{I5~a&q(gTWG>Sg+OyqN_bdWly6
ztLCW_F@%wTmb<35d3P#3nAr?B6Fpu&OAXi);PZX4f9Vm({tqU@EBeWfe|l4zsUP{+
ztDsj2e%FSty{?&?{dXLR%9k*1^+t*qnr(@+jo^K=KkbMa^<Dvm>$FD#Y7_V%UOZnK
zOV38v(l_6c(RvCwHwUe=MDOJA`BDq~@P@PZ%L+7TDXnt&iZ%GrFijjubLt1uEH((X
z8Q@!&3kC3FvtMt9Pe>lLWlQmDU|p#{RZQ<NnhS3;JouAS;3>fol<>u8L48&z=e5iA
zTWsJm-~o%{&4}GAg^)hp=h_Up1wE(VQX=sdr|>-0E5vizygkfWh|ioA)U&6ga0!L^
z(hH6YF<b4h?+dTEu57xgcV!=eK6{lm9yNj6)StqBj@lcGHo!xw$i0|t^z`vt=;`k)
zIc2MLTmWt9v<t-o<mG6NMA{@g5zcwc8w<SdB!uJe1v<&{+b=mUh^H|DvhuviP(tS%
zR2O*R4L>SSdCtIMpy2BiY+2Jih1Xq1y6Ja4kSWEZwqw^!o3FY_FZ_Ow#-Z`CiXXe(
z@F4FpuEJ9s%f?3VPaelvwDV-ILMQi}6-QWNOPoPz$g?yI^n$xGWqs<dZx&0iEpls|
zRKk3Bf>Yz9nZwN{f4>RN3o)&|3hh5V3C>TvF02<C$GAeIv?aA9Su2)mvv@$_+B{Bz
zWLc7XnOIJud*wH!_?A0Yq8x&x)w9ysj1dW3WSyj(8``}Hi|waz7;IW}y8!J(xwT3e
zYc;q(6ER<7E`x0&2lyjUWxK%!o5--=0k7KJ^tO7(B);6iEllDbKgP{m;>mJOb*@pZ
znv_+z&@|g3fN#rLnbFB-MY{#MuL7meWAyN`Iqpt})+eweOQ-D&xDkwm4Sqa#3s>93
zx0zpg;qxFwH2Ke%)xi^2pxbEeI%yx5A7_e0$%bN)K8x`5L1PCTC8udOI1f3&Hx@JP
z=iYLs4zR4AgxldTEN1&9l=|5)m3q13EcANMh`dIu>o=iTS4fG!zKW)qqd1r{ih<?8
zK#_!jm4ty-vBnx^Y-@+DfeVUaNGtOOU4hz!^~oWvNp=ZBG5rCgpE3py8DTu6jlsj;
z{w*G!5h4B)@KAAL2=^)ke-PTFwJgwX7h7yci?KI>PP;g7&=&ZaT&i%4_p=9OR;Byo
z!=?<qJO13PW7>=?H#Y?<tt_Hlx1kZ^c&2;GxqZiAA7t|;e3@%q)M?A$+^&pn&%%O>
z57T@wU_L}zP9emmT=dQ>I4km-XKi15$s^N0(KeRe?t%3rygh&`tVYZc9)9m#8~*N@
zYmMm47|jvzY9Yh=A=%%Xp5rkT=r)Mui`0_J$67C#dVXGcbJ6kj=U8^zagjeezV`SH
z{Mo0$`>Hx{-bEbNpYa?D1c$a*DW*fNZJ&GmBXCm*e$ytCZ$>4BiI+0qJ;CxG-sW1z
z!6KxV;hs12ws(g09g$;e3)380hlg+<yT4lvKCKPALE`WP_i>TGJHFNceqYsoG{3Xl
z6Sld;TTUXh53#?`*RGRdqj)KHHDZ64Zwtp7!?BYQ`)dCFaBOQh_8$sW`^)*AQY^gX
zN+s+?>`VFD^<uexQ%SfsxvG74zU|>~tUg>DVxP_5KN1@+#Xf)%cI4YeN?0MqPC~3J
zfB#6VS&BV}5`LE7ITD*K#dh$j_Mhf!QSQs4l_`pSSz9C1v{w`qqX&0lgqX12HTJL#
z<ek_At7769NjM80EJcWIe|5v!LX3x^v&d)i)w-}ZH=joMJnh%B&m+|Xf~Nicf{Wi<
z+N)zq`w7nYSLC-r&I)a(dRHb`j`p}7Kpz+t9$rV|s}^^0NiA}#-r*J^+Lt2rHU`*{
z8nRIYyKy%k(Vm0&o#FVTaQs=&kc9<p!RIv6xHKh5;~w*5GT$=NrgZ4Q()lcns~YoS
z|6dMclxb<CVMNZRF-Bp%-}DG^eP@&ugFnsYYi}JM3cNN*e2m;mX==fdA4c3>oIT_%
zxz_RC<+;|sTyE@fZP@HDIl_spnG<f!DoBe-Sd*-MnM%|m#>v{3;1Mwyzsf7+y*He9
zd^qo&;rIu_@#=8=JtDnWQz+Qh6m~f1j3LLC?37mWEn-NaKZWOtNU{f|%;w?u7(AP}
zs+$q!N{EA_bsc;~IG?$MLhv(#=SaR&Vw{wZx6^kim)TBjq0@;|;Sgp{sT61A&EZfh
zzeNgRR-76MmGEoDbbiwc^GL|NWh9h+3Za+9lKBV2>GbB2Q2Z8z=xZl`N(zCa;2$C$
zghw5%cuFvsO3a9TS-V1Z4^CWmYQZy@d7r6d3t|awQ^~23(27=!NvTvB-x}N&4ksbJ
zlfp*9Z%Sx|&+>|;q0NiAFwe2r_h!u<6Fu!13;4c?_zLFR?jkNjEw1f%(Kn{?@l2Fy
zG$mh5cl;-K0A?f}AmL&+I3Gdavu0w2or4wj77y(bcrMDF<=9>@L0Q<6<!HxFnYaq#
z%fXXtNLG^hrfj+IoHm{L{#coMPL+Q1Ifn3;E^fXuJsG|@G`>>qac%;827mPLB`(9U
zu`tf>Dkhn+PrMn93cRsd0WZ`2-K#;~T{z$PuoGpY1znY~=S+xeuXI75y&ZECt%FTV
zR}u5wTS>Q2?u&H#`1!~;1L9^f-z}Bw>PMAiUGYyy<(k=!?=OtDzTZ?!<<B&^C!9m>
z2Nt<i^xVL^5&J-k$M-+DBRh^TYOz=1xwr}WUpB7BY0Sh*In_9s`JMu72%)x07t&0w
z6VpgL8Rk<}@>yFhHuShQ|4NESuK|+Dvx(<J?w0}GE|0%cY!j&7G0?nQ+*;8h<U6io
z;>`Wok#yn=ZMp7r;>R>5_e|$|y^5*-VVUVnM@YDdyQOg;(1Vk=Wt`E(h+mx1d925T
zS^r}(FVCi+|Hc)hd|&^uq)xH?ibVGp#Cd8ocoLtOXSw3|%JFV*&fVg9-dt|hde$(|
z0}r;>e7^sYc;hO!z{LFr_&qw$1Aa(i)->5ImDwegX}s+I+VQ7e#T0Hp;rrUrjj%BO
zLX4t^Q#1@*_sKooV|ZHPX#eURi;-0KBw%EroA7bcBVpr27#q#*Op!hmSTcYO!ohb>
zAAjd1Y|!rRHLnEMufuJvaewJ}r&p1BJK9RE9-I5kfgb;xz~xTBvX^Zrq*+sbS%Qn^
zh!S&TvH#w~Tvno+#>$%JbjO1tKYd>~6<PT7V^q-y+z$JmoBb~y_WjRrVE&1ytXsor
zjIhG_nP`P`6RdE41uLA>!e3eiS5~|D<w3V8tJB+>HCg%+p4soYWhnVRabA0HCTH3l
zJMta-3bx_D#qW6{XMU2tZwP%J#_CF7@&R!BJ*EfVlrUmj>>qao<ICr&SnSsv$pXi(
zFcgm9bj*n^S@6Wp+Bbx{Xm68*Hf{mri~S!QW@usRVaQ6`Y$K4Y#AttD8;$k{7W+3G
zp%e+g0koap5@GS1W+Mgm%bSiM&EhW!&YATRoZ?(zlNb9}9-)?AqLxgaco``s*L*JZ
z<6{5YhrbX<?P7luLfzuXCF+y|Kfzx(Xy3E(GWI0vKIUmpQqiQvy@9mzkVA4rfJHyr
zdl<r;w@&1|lWyR=Go2%+L1iN$JN66Vy}>v8hEIZWYh)+nr-H;$pAGZZXM(0Mf1Sbw
zaI5bR^VF|!^PA#EVHpbi5xMD%fZ1a`Nmhe%<dlbYCJ8>(m=mD+;M#vDmU<a=zy<~O
zo1^W*{(#!`E7<?X=`I^-m$ak!zuRRm9@zni?GkqzkA&N`{)TovINC1SH+*lq#M~=J
z+O?9}Wgl%9?Pn5v+6~{FY*D)weyd$VK{ZZ4m?g<lMLTbCZz(G{gB8f&udrLXnC28H
zx<rcv#Diz@X@ygGN^$Z+T7~sKEq@x%8mAtT`8CDTH?{c9Jo=5K_G^mkuI-o&kGb%*
zn~bvode(er&tE&b=VxQ~{Nfn_c*2o00(vJNapYYN_+AIs7!r~!rY<fHx8RzQHo;>|
zx!LF1SYxj#*Nad06_%Y~+2TmBoWdVZ<I<ukSc!YI9Gty9g|j!#K(}gi(<Rm*?YnJE
zI;+6>lo*S5W#MYao})ZYY)<vcadK1Rh>zNW^9})cJxy&x8nQ<^2-_%=;18ag>X<ka
zI$N(f;3B-mYkSR+*J1+g+oR0IDa~i$cNyFa<-*(b$h($#Zg^L*JvY2-SOW5^ke;Rg
z)g3%B7+8Y+_yIF_j!l0b-s#`-5*(xpLH|<nRZY)2)Yu&<+TGCg;|w3-oY5Cjo!F~X
zw(o|0--JRQ9*#*e-tSF9TpZ$J;Ln=k{t@c(-lzPceYx^-J5Jl6zoF9B$f*??wni>1
zEP^j5debsW{eI}ISofx;Nq4|+B&^KsHtWuiEK0eJt9>CjkI80p>A0cnkqJ{h)#kJ_
z50_n6>f2ukPB*eNK5JWW-ZBn;iz7U;1zhbV+lpj;i3+xc=Ng$dx>LyF-102B_|0Ct
zBKfrvpBLZQw&0v)WT9e$6)kUJGR3lq8B;;AH5qbuVn&=B=P?<#;5Vc2yd(Z?^qw>R
zZL@7Pe$jW%l((tp^xyNX1}RS2E+B<~aX#S(QX~{mnw4cKZ(EA1@w*l2qkkYhrB)QK
zE(09JHTd09d;z&m(`*vqXG+B~I&YRiqHi~BFATyj*QdezT}mt6jqBX!f~m%NU4o$V
zlur!0(f`A(=zlf(zsIBOESso7+(I#qox8i4tP}%-dI8UAMqo>uWR-W0l;Oqrr1NaT
z8|oKr;H4j{LJqR>ozm<=dh*cBw6O)avo~-$Ds5YEx<*^lxx-en-=5$|!|XH)Sr(c_
zpfM{GY)GR)ZLHHiAM%QW;eHtzldv&_GWaZ+_54wj&+D?3J$grBa~5tF1tF`1Gq}VW
zrWyBjTFSVr@vxn1F0qu9m*L!3(7Q7o&O+u)Hcvn(*#ym@nd1?vwnVjPbs9)xvCuaq
zg<&<4H1a8Ul^fTYsQb!0QP=G)D?6jS-p-dj*;o~vr{yvuJ(*>C>~}I@KiL(WX9Nsd
z!q;P+y0S|SQ%16NVut|fWk_8_I&AyQ{T_Q6&d)rN7~6(2OP0LDP?o#UP?DSdne7Ak
zvon;u=QWg>5M#=|=GB*FlnL27SlXsKGD?zjt6{U*u#U@$^02ft_}C;!$y!@lNxhe(
z;+(dxy!GN;RXuLs4JFh9TL?47Cd`=bfxY8RoL(hLS$7RP8b?|Th;5h3>4xc&opR)d
zws~df_vyxZ$7fhE;8_5BNlVvBq25;K)R$bcaRz%yRvG2UDxn^$I3b&{*<W^KYz@t@
zN;y)4V3_5Vhf6F$zu!=zLtoPF<qg_!f0MmQ^faqjT16!<jVVknqdlcsJTsom7uZr9
z>H>prv&G<lQZV=*uo!$w;aQuaFlrXznWX(lig{#SxaA5s+fyuqgpDJ)q`*;Q+vP|G
zH71X8$u>nn)U4oa*tm)$8@u1mN26+<v0`a!dBxIT(<E4xoNMGT0?!@g+^X~^JzV1y
zShz<oEF&p{7lL!}b%UEI6PH$RCK{9HnOCH&g$3m(q-y<<Bh9}*EzS3i{ASA%pG^KE
z+go%hD`<U_nW^iva2#`BdMow86Ofi5%(8Tk=LOWN0{@*_bX@G)<2K%^sKx0B(kXE3
zJ>RpyF{v=wJj1;pJhrnC8X4OppT2uYn$OgyH{s+mAzbFTme@P=Wd|G=9g|ze!clMI
z#rfY%v~n3)Zl7a(-kYd9hgtA<FQ4|bS4i7FroR%JT&a>hQL=eRQq`frHF&dUqp`Np
zSaBXNli^hQtE0Dhxaq*;^hLmAGVaJw8^#jw$hh=uH@(kcXgyP<1A~mdCU`EwCjhnF
zJ1F7ja=0xMTf#I;g!TgbcuYqr5gyf@Mu*nFU#s=KgA;0#PsWU5>!uqo;EeS>$hExd
zB|7GUENx>8Nz@*0d5CDuGH&-vfDy6}B8)2lV<zY#(U~Nx&|rgCgE<;5!|LXApm!SN
z(CF?^WdKqRX*3ZY&LEUBq@QEVEF*cN%#zQ%RhWz1j1=tab^iT2o$noPf+fc%<1%d4
z5*}%%8_Ub!$EmHXxxDOxlC|#&*C>^9$}1QwC0&r1lvYQqjMcIQpL_WdNUqxc<mC*F
zm`O)Q+fysHXK%|UYLAKA%}x89M(*^@o`^=iF{_ya)tal-h*sdx8WT4S(91Tu5o-dZ
zCT_}`X25Toce}M@oF~np`1Q#6ohy#tG}{|Ae&thqlNHvkcjdpewO$bt_!2gS2TrDI
zm~L&^S4yr;$c#Rhf9$npp}0;Q!MM8%&e4Jbf;JmU{s=kD2uHCEGSIWY0W9Ejm%PO^
z=jFH|<%&>lyc;d7IR)NF@0%>j)(FKhjf4w^7Dy!tLWlR8?_5p1qr`SYeVUQ_)Yk2=
z@4prHQ!2w_n8q(zT^Sj>0dee7Oi6g$24Jx=f#yG`KFQ3t9i8dP!HPEr@6_Yzz}XxV
z^*hOyE+iTA<M9RYg>jAv=J9U)ns8z|Gr=8y!@PVK7R0t=JZ(q6Glb?~&8aw%sPkc-
zeeLB_170EZ+L(Dpvb&f$m<L??Cs!1|c=sre-Xy=Ww?axl)%rhJ>3R2BhrH1co=tM=
znoemx(F_W>X%2}qV@d<jCtH%I_|8v*&s7>7tV;zN6vIr@cea>te`WIJVy3)<{uH!&
zQ2FWXv*LGxiLJjaA^LWH5}&E);Iu>=L~hFXXRnZT=bd+Zjya0OHA9a6v!L&qY_Ey)
zH5Q(cXvXesmgt!P9)jlgAH2uJF>%bs=@-IU4bAOZ`1vErEu70%N-NPZtV9>Z8!TEq
z=;r&FO`-#r;N|p2N^r*g-4e+HTDwPDgX$dEXF2LhxK3FXr7Z!(7;XGFB})+h*J#Pj
zVH)$>(UQrkk3@l&h#sGQ=gEfONi8^xM0a+W3dbQdLWLnm-%s>uI=CS4RU(c0Pf%1?
z`bKZ_X*;Dki?wfIs6Ryg{7Ep$MZDZN>tvjLCzQ=L!=H$O8R}snoN41b-|7i1?gh_Q
z+}E07TEd^Bn~g54@oba5v`&;=t1Bg`179Wi!`lwo^T9x2A8b%g`!VFo_Ln}mj?K6S
zve^P8FTW0H%P)c>6Kan*I7_FKvrNsKZ{jRkCpSN*i{;qpd39$t!n)5&585u4*&GqF
zjN%LjH(%!uE~oem*o0<#v^uhU^P5oKaRcZyPN5g*paQA3oX3j$DrT>VS6h;8ZC4`F
z&IVO+nHHUIe~#L6I;hgoip*g}e$B~e@+~!Z<M|rfCD@I3ZGeY517yY^Sqaa3&}8uk
zJA=Sck=(kSybtaf4E!TlwvNwKeqE)Od%7IBL)f77Xbce-6EjV|Z7#io&kT6@8n)-A
zud5a?y%t(vfB8yy61p9sPw*u9_hwgy<3OpJU|gZL9dcwgs~r#G&BbS1)R3)eyAuBp
zp9x5=wQl6Dxi(t6l#21T%Vh#$-g%0<_Wm!pYwjnwYulc}N_1@}-m0E>xbcm$_k+xK
zsqCTh@s7zBL-`c{Q%RF8OS@Fcn`|EkS;d3vrurr;Z?pU_Qndx=i!)f}p6a-%*;~#n
zjxD|H@H*KHvXs_#MfMECX=&RPRXxq~N$%Ub6pGs{)~<+%{4SL$!7*jsilV%($jHJj
zHU1Qe$)?*Z<3Th38f4nnoV!Zrccx};_CI<=@8B{Y_ughX6J)K(4a%*;U!-E1|Ec?}
zU24TN-{L51R}@-zxa_}hQuT@FL8ofQdCz!<)yE!e_fqYtR6BPQ>dfhi;BvZD+*Dsh
z*(^(@Z?QV3OU=cN)LYIn^F7c*spj;AdmfmFKH_kegV(Pv5hZ1R3F9de6e^u>u_6zU
zkGCBx!`;UNAA5?Os*Da#9Q@6&;x@1H7+SxV>W^~+`cA{T+tCXW{1J*7zKVw@S!Vd3
z`iZqG24!sXQVa9M6cN<AdvAk9YL%fL^Wr2VK_Z)F26-o!RlZK<NrjeRqM^LB$(xwf
z>rOTFd0SgUJ|FbRw!<pXc<5;VA%yv1J+Q7ls5v>gS!JNvHK(&=oh)-9B%vO%bJ?HS
zKP!LDo`E}eozJv9$LCs3<1oW!@Ej<`k-J_2+D5ZYGu+x-QvPCanI^8Hq#PDNvP+PY
zTR{0)<`oa6m1xTV{Musd8djD_V;^$ax_EylZergB6m4FO;W(^@gs>)zhi3dhU`<Hx
z_|>{IK}{vWC0G~HT)5_no$nE<*h@6-iMqOn(vRyM84ld;X`J|VX)>HRv(e!8dmLm`
zYBMZapJf>bzJx80vt4x1EmW-MS7I9^`g{bQ2Mi7sdXQ$NOw{fGuH)hWTbJh)>i+_;
z5r%x;0B{%!*rEa3iv(M-1Y5S}vvou-02N@`F~mSI7C7ks>q-2&v<sYcX7te&e(D6r
z0?-M|a`=7nu@%X-2-KUWFDV7Z@WW#b<b(;&yyult0rcT)7)Js4;m{Oc3&YXlCCinB
zqdyNz_3Lh^-#YYG^9+aHvD2WMVJ}sA%7GW-EDbP^vFCTi#nCPm_mc)lwa&I!=%&&}
z=Lb?N`@EKQI3*O+o*Wx<@DA=)y+63Z+{NiQ8_9NP3|oPVilqYlT($Pfv>f&nCre3o
z!?h05Blu&G!}S&Mj+VktgR-qP=4TsD6h^i{eo<ZIV``@5v}IN<jZHmug*|@i3ja7i
zJ*wp$E51eD1PN#sBXs|#EC%QKrH(}SW0bqMbw$NYf^3GWWxOrXrx}gWBIX`jqTjVS
zoW{>Kt6E;7n8ndjF28H0%998ws;CyL-*ubS=laE|U{q%!<b)!_<-$6L=XLHb`aTEW
zA5ARgX8_ii;~suG-;>Cjd^c4-cYB&+Tvv>IQVZl#LD}`TT?L7bq?VsrFDuP0iH=ks
zCrh-c4;A?mWioi#&TCoX<0J11YNwI4cCyrUUrW999>)~F>#=(vHJ?6h%Q0>N#Ul<D
z9w{z$T6UupcNfaj$nLTw>eau8-*oee;KXTWd?R@$%7gEKb?o<~Z+}NS?vmh%h!{|3
zctAT=1=F8f6->JQoh6<t+{2zLf-c&<Dwz7zf14xl)IRmcC2~9`KJ_az=YGy?_P`p;
zeAwAhoeRn;rb4>!eLNGVM#FlQazOp`y~w$=ky}jGi9Ukg%5<Mb^&Xz1DR!+!nPa~D
zT~E;W)u`cK<Wr)=(Y$`weEOE#$SslqlS214*+Y)0KG)+9*<yM^w_!ZQMD>Ig{Uazd
zrTR^e=60D<bN#MI$x8cQ5%)30!zTmcWx2@zzj(i=kwd;6ibsJ<BYjEC1x_EewFwK_
zZ^UG0YHpV+7v%w?AJErZIdJMiccrizGRU2JbC=6x@|%qJ+0q)-B)jF~galg(#^b~m
z72Yvo*~AtpHj=2vFXvi!(>(!v+pvj>Wh{~H*Yh$N%lsQGtBmPGUuP+5F3m+>o%FH{
zd>vb}ud@U-+e|)F#Yx!w5?+xxmUQvvWQ)Ae2I=|;oMGI(Qf<+835>Ut*x*6i9umlE
zu*|v_cP|=7cD2WQDo&J5Omq)GZ`YNw9X<lqH`~EaX$5<!7JOTd$i11t$C-?r_6w{d
zHO?x<=j|H(`C={pYMi@q(u#BIk{ah3<xg5_oW$4EKvGZd3vJZ<pUu|$@kHEe8<i^)
z&XDD&9K~<opBnYw3~sO5IUgr=#Pu-4F^nyy9oJbtu@^9v4brI{o!WML{ykJ8*C*1u
z@wkVmb=HbL5y*Nr*`0#Fl2BFi0OTV_PJqAsfwC@nLBCKIOD}L&q4gstd?xXPFIB_{
z?r_98o@^_@v!W!qxCY~ZnQOr5@j5Oe)ngXlR)ec!8!5aRdM=dWJW|MXYRjumP)nR1
zw_Q=<O*)?;ZjfoU23sj%U2ESKG&9W!vtMTBGiq!yvI<nP+SZ0$d@o=m8L7S48|4_)
zztQ51hE73EzB*SG^%HIYf9)b_>I$0n4+P#Dm|%d^Qq>ArlVLf8k=tNth0{usAUd&4
z8vL4#w$j&wnJ)YDq{UMU&0w4Tw!*0$A-#S(t1f~(@+=Xbe;&3!Uwf2g-R2?d^;Dh-
z79#%+X;iJQ<9mA^Ey7u+31=E+cG_F=JgeSwRKFebV$+$UZQhYm8gaUF%=6^Lc=Y`G
z0aMD;7>y78+tK)I$edL>Yn7k2+shK*U1fKPy~O^!{&{!`Icnc-f1X>g=V&czVOhU(
zv&`Rm*ozBc1%jY$K|P!On~zW{LRo^;zN-HuxT*-Qqc|n0pna&8xxOFIe;mbg^B6oQ
zd<W0FhQGnH{s-|~SQzmgJdYb*(Rm}Tu6q9+h8Z{$3Cq%4J?$L`eAqAHaOrn&_!Z`H
zt#gf1(>8+pUP#p(L=R#<D=xOzI9DkD+^&C~W&R10gR9HzWyuxxGT?SL;rQDa?roOF
zL)++hm=6qZ`Trab8@w#@A7gsQ2S_&iOTX1Sn?`#Fo(;8k!_Fb~jc@4=SYp@-KIiU!
zm9Em74mqHgpf8zs{NTED?AbWq`|yaQIS#EUqYB>6m|&d3<H_5h>uyMQ$X<|FbG}!D
zl+TNlj%KA*0Y3nltJ59k^7t-wthrq2j#o}-SEX*lX|Y0-or)7wZHt;YUq0?VDd&<P
zm#PE|38IDsXYBM~WaoOl=JIMK*UqP2^yZc)`m{36txdh)l@)BUFMfO8+t?{pV8yhZ
z^)85INz@k8l$X#NSj5#S4sg)_9|&~yb+30>S=K{zr@i?h&k-j#vlKE3%y7B{)(CxC
zw3VgbhWbMAQpe`OioVi@7Q#vm?7H!G&Nmx&aPRPB<`bNcqJ^g8N^0M#EXPmE$73HN
zcdsswQ|j7P`Wkz3=bG{)S!6pbmUJ&oMlHT`A#R>(Mgh)>10L>{fxv5hB(2UFKNVZZ
z8Gdh<PI1PIcv)S(2O3j+>dW?P-up*e9PmaK)YxAMra@vXvK{-`z`y!Fhuos86kfbi
zJIQy|oKNWeE@<Ah2$MrD!Ux@h5FOr&b1$4V8MivQEcjwYZg-y+kk!GP1GIK==dvG^
zat<h^c!whLl}}^$A7kBvlLYud>Z`QQYp%n2KeN}_Nkb-%PKZDwAL!p2H2F@uO4h5p
zl>*aMn_smnJH(Wm>g=$}DX!FXBQ(c&say+v8p1N@VAoOu2WrU6i+oiAusru<3Hn<g
zjLT+2(y6N;lldMGX&t8>+)VJ!!fBhPBh9`X{q<yUXQRPk1wQJ^lPvq~bVf1<E3Cmz
zr<n#ZO;Hd!;;(2OmhuGui<?v2r->6s8J6-3kZ|N?Dmvg5Axm&`z7%-i{Rp${zH*IE
z#pb(>V!5RCRcH5jE#=9wr1leyusNz$z=|PZ%{R=e)j?qzAEgfR)A$&5P=*jUO^q~X
zmwe^X&eQ&A05-HVwWRB_*L?geWFW((GE3bUc;RtSwa&Y$oaD9C?)Y#T9yLpC(%OIQ
zU0oiJ`);*c9sa5v{i?Iy=~d+K3#YBJF7=9dUpd_yitU^no)1OOpdX{d{kS$*X`TB6
z{rKj;?Z=4k?MGhh$CD)jda{b6{zLC2@CTtiKH7&b4v+1_xDKt@L(KQ*5cQ%-Y}Jju
z_#XCO)QebuLtlD@UrW9C{15ixe9X{qdNI?T8OGK~FRqqFwg03MRwg3vhQB$CL(;?a
z#SGUkx$e>4)(?NA@!{Tj551Kv<{s$<8d=m+Kl{O+S||3D20cYHm3l%mrl)><Lr>ik
z?x{tXt0R4db79<Exo~SV@{cj$;hI==#p&LyB?b89N_OE_Y5stI^%st+A1Qpq@^EtW
z2QEm@nAICk_qJvi;MbMC3%{o95Ae&f)ti{UVAH8`O%uyp=h^bG>H6TKvaYQ-58bmV
zviMZ*DSPBkPxbQlLj0OnK8xQi7Q|+M_*3;`kxun5c%PEzX7kxXKY#U9Y2=g8vygFy
zI+L(=je4cUvKHLXrmbtY!UMT0yWp|Yy?=@qU`1@#V;??t`r-4j>c>y_=4>p$@0OBX
z_}#kV1N@p+R0g$LrUiWFN@%WD!gCivUl}yu>B2J=PZOSLlm^c!cvk8wgH!S3^rw5R
zLM5yUS3+N&GgQJ(C@5EEtfwJZrcIFv{-+WWERn^LPHuKBf4WqHQCM5=6&!N(%~te{
zYvoqV8={Fx)=qK0VC}Fl!#>Owv`G7xD@v>d5wnM&!zj1r;l>W5n`q>+I(vH9>w2AY
zsw1kJgHF>z$G$ru6?a{R{fS0cXp4MFU0)6R4A0|FSs(M^e2nGeu=K*Eb$W?{d^8Bp
z$LRsjW9+%Srh)6%NIs7<1_ICZD}Dt#N|2|gR7tqcGc{wZ`i6q{HEJDcr5Le8E|em|
zA=19Lh~kwZwGMuzaeImtVA<DRy6^S7KMj7o8+KT(4?m%(wJc%hW;W6@sRL;$J_a1O
z0;&t(G5+q+I`TnR$72rt!vkIvb^rIEqL!O2x4svvsQ%PD&gZfex;euod!3VL_;k;|
zxGZQDu}zoO3fQTs1i{99cY=Ry03}^rem6Iz9krCy*w>Vw<KM)3)gSoPFixbAmZWPa
z&2DZY(m;O4zPkJj|7KePPGzt*WY?fyw2nW(o(uD>8mwwYIkxSvU!oj#rEtc-(VA)c
zIo?A<^xomQ?!9FH+)LDaiJKr_3n(`G*B{};cB~wf>9h|~{GISHWD`UAgHgKuVkmd;
zQhDb?LRLC*M)!>8IG+qS*zCXa2(48@)<ie#%4l9KjgT>4kyvg{xZJ5!?t@gWp2`(N
zH&eM{C~2_sL43#8gh3W<D~%R?vL}(&14^HM<h6BzHC{&Fd6A1Ae?&|Ez8`@t3|P=u
z?Efot4;3O6;nIjUQh%SOz3$v7rqOYXXa-}NlNhr(FNyTMA9k_GYYvs!F|d`3q}~CZ
z@A_6LyE?TF6UNFLgPO*=@;duh-dERY!Q(OC-@!3n^O&HU9)cfVwyDTxixRoK)3Pe+
z5qY%}<K^%G)nEeDpL!JV@{QFA>#JJie>Suc?^4#bro2`$sa>mW@e(JbYKK)I73I2X
zU@3T@x0VE9=SM5{-ao|NtoJgXRs059C}Mms`h!+(*UBD`VqYqFy_3C_@tGATdrk3W
z6>2qh#k{#Iu4K>AGMBO@{_QfGs>X9PV<Yt1bWZ#V%MWgh*cTu5{!vQFTMkv8?A@+E
zwCN;hM;CsD_{>K+c!7T<n5A_-dg#%cfj0^N$%F9WDdL_>lklEy75TDCUVE=s1)h0?
zUY{<Hv<d49ZI*S<+P1Fy&~|!VWU;Wmu-LNx+2XD1KP;w`I-DnnH0Cr$=d)rzkyZ>V
z5<Ij%xK`$Ol1_xdgW2oA${7d$@%=7tZktRTFWLRJW_j%@!Pq|1M>3r4;*=M-OoBfq
z8X0xvg~tpIGkTdzyQ{OOd8C|=`nPa#;c{Z&>%r@h*Ip1JM@#w?<Lna;XFUhbk=gKz
zS=R0)%19jES&G#Tfrnw~%iVSdd_p-g^C3xm6@H=S8l1{%yR+KNomEvwcYeMe7LPXf
zxtk#OJ;Sr`_)fE-Lt97^!K$h{XGFESKH-W)31y&!1pB;xmNtU#k^#cE#QBI^0DQ@(
z<8E$_F_J908UEs34GHF}S9h7;hrU*1eoFIBb8m-gkH`CC#9#C6H1C9Up0}m-6p;T+
z>>rn}pJx}Z$xToEoU2@?X^N16!$-{@4szCXP*mny+TYr1(P~cYFINGJOdAk=8trIE
z0;Pv9SDeyfJr>U`5}NtP;V-3M;$ewj?gH+*J)GD_w_zrH?zve0N-$CTN^qQ!%Q$oN
z!qJJI1WO{FHEb$^hSH_A7vZfBHUh=@|5uFuR|hat5z`owrK>!!d0{t%xwuwu=UOkQ
zTh#zjw=ZdaSjO@pLK<%Bi9f$#pTm5MhWp`9O4{c<NK&_(Wp0+LmB#MVBYPd@JA~Z}
z+2|SB>)7<-95>J$PY=)W{{ct5)RTtY4)YC(mY&XgzPsPiC?|>go&UuwPq|^gW9u8c
z-+@g>(UQQo_d5;Xmv)DDI)@P6gYzbBYS62~SeEuVziz{*yz6Cgm$OgY;k*QXi3>@4
z8^XaiyBeZ`Cg0y&vJ7^$+x6)eaXvX4$3AA0*erHh^y16APnC0-YUtgqq`TvUmAHEh
z!B&p8nWfn~31j`Z*$f4iV}eUL1o!E34tnp;;4W}%9^AX7|I_{Ra4KF*^_W<$DNQPw
z=`yW~1I+ixP=BDl|B|@-Tr2KA-}k)X<Yv5!6_<9O8K9^af$e)o`eQDrfP(r&EA2fE
zSk)no%hIi$f_xgcb7A)YD};x3pN8=6^JY+AjdG#b8~uSz(3q!oY#o-RJ5ditA=Z_{
zeKgM&h^xWKJfm4wirwlry+<`v25;=WLhQ$BxBA`<V^N}C7@2ABj`Sn;zP%&;s1JIz
zqy6}WwEp)uc)5(l{=6f6MwI(xvxMWt{w0ticWqwm&pATaUgW(b_SRzmt>O5&Sc|!=
zKY5JdIsOi22iH%t<JlV^qPu@-2hCb!7$YNedRv30N%;M?FJhQbn*+IAc};=^w)ZW{
z8uCV*U=c*gaf?mXKolEm?6lU98&<?CmPR_D(PN}oRTFVJ0=OJrdmY}b87xp!3{QLy
zz6%bLD3rnsI26R(nx?Hb+yOu)_yfl~s9Ei#+VrUNG;)#Nack#rh&fx2RxC|4n(m_-
zHBFY1LdVt;&lP@-!4l;>RhI8GSRyU7jv-%(m=Ajd3BuE4MaVwEauV@$9|RuXumg7f
zIPk8*Yz{u`T`T3)GK_||Lh8aIfB%XU2kF<-z5Ggex=@}iDUVn5x62CaKm!$!!6NRe
z-%EPv@8aNYNuj1G#X%f#|1xM0^qTWlTUchE+g>i1mF`-Zyv<&IA7p)HI6nXfzQE_T
zVHeFY9=u{5&M$63xd!Kjqx;OWJa*^Yyd)D#?{c%OX%|+r>1{9LuLFO{u<md_H?ysS
zGqxr3v)b<Gv)lIZv)j(|bK33~=C<t<=Cz#{ZfTn+o8Pudc57RWY(X1t&SFIh%g{z+
zD`*5WoxrK?aSBzu<uz&l%j?p<NmQevkyf*c!xXmFQ`mNZ!pnY3;bpH;*z_9;n?P%z
zS0&OK?MoEaR?}Ba6@@j=Q<&`n4I=z30e%Qas?N}m5jGt)Y52McCmAaVU$Bp~8+H+~
z6P7_btZ$ewE}f&_9a3Utqa1NRkfU=<jzyz6;(s8=dt-7KMsp<nK#s#>a;QghO!$Eu
zFOJF4Gd$7`?GNO5YD|uEqd9axki$MEN6Tmq!w=*r7?b0T(HyBikYm=E9M6yDnDPTT
zl7@?}CV^fPWqmZ9gBhM~h@w2O?Ihqll$%TaF0Vcf%HR@C+fIWjm;{;iw2f?~28QGX
zQvSP!FX4+zxMU*?5}!h&LHX_4_uzy=FO8oLvVIjFKXXUnz2)0E#*DbuF*zoV=1}}V
zj^B;RA&5EPMN#wu{B*<Y8(JA2-v`N8+jC=beK9mLB80RE*}tC+8^`4N>u8?nAAoJu
zm>f;v9E5!_&nWiC!etth<K;0qBL8hmrjE(6brdSq4?q<&CP$f=BaUe7a-y+4L}O?1
z)<RI(gtN<W!nY*0&;5)n(6+LC4Y(eewh9(7mWk9dszp}F8LIJK1S&>r&<OpN=sAy3
zz-1RfFO|mG*jD}p_H)S_E>Uhx(~gD+JyH=3GH|<TEHWL&PXa86V*LHLnD(%kHs*Wb
zjJW|$f=$N8waB!x!YcbW(0v2jj)n}>C(^v{sc*Ab-v^_xaX*mODW-i>Ogs5oYYy;e
zv;d14XK8IAEV_V2T6YMGwC;>ua{^vzy&30;!P;YYCirb8-jfoQ;Og??46qHBUW#bl
za4o~15$EQ>_$OF5E)a!Zb}mfYiLR56XohwPGy)#Mz9#|LpDSTsIH<(fj~OIu)zkyO
zg{5`OWR~!~c)e*9uRF#5U-hm2r`3}1i;<xa+D(R_2-V0q&@>hK+c)lLpqm$tEXh5B
zT@fTK$Bu(P4-gcsVO(>!^0`%_#GkxVcmke5it2D5oRoqU8oun+x$w*c4=@bU?wTg@
z8zLaZZb-jtPV6+pn@Be=<2$yQ4OZnj%cNJ$D)M!dg)}pRUOtzz?lLo^#9iSXJpKZR
z6Rg#U0~dt*!#?kq*8N}j9spj!12rJ@xmCqfupmh75v<{|vREcb+iRL4ttF7SP`OcF
zA)~)(0ndHO+<b6HdcFd&NIBrS<`t|X;Us(|Ugv=z^KqRKT6#W@r}JU^hKE_MbL|3c
zuJ!J4V8i1NKeVy9bglGiURV5ZxpR{v{I<~v@5km18y?N33^{i#u~_CA=bP2JE3@ZY
zX3sOT+gGr)4?ntg;{&A+{xm&<MXS|!l+V#pj&&PQ=*9(FcAGVS#gcn-Zohp=?jlxE
z?A$oLgo<5T%I;aa(fQziAPN3k#xaKf#s5a0Go~=5QprLyXJl|nxsqd>>lmA<W1IC%
zd05L#uO3+Z{#kZDzTMT)bHP{{di{;(6OSBjcO6)KmYM#rYk%wc_{y~%`U|EvwCwdG
zluxPL4CV37Y!0h*MTh@N*j7&9BFFrWq!E*DW?49V6?Se%ceT0%(+(G7Cet|qxn-tZ
zE*50WWx}7#wAID%eTyr&j8#sSX|~3)$q@)4WvooIO9kr)f=s1hv9kEB2{4zT*`k^(
z)s)3h(=BX=tJP#P8ilILB)MjLk}Ap9>0r;gf)kY&=SL|74lr)PZ4cXWa&ruO+U07s
z&5uz!*>+A)$P_Yui$WprTLppp3E-9O+@T7?xrLwxpsgm8%Y=uFZEa;tX4-}@z7W(h
z)6*`dQtiw$S^#hu=*bH9OB|soq0t?yQN?OvS&R_3En+gm2ec@DTLNP#o7ofsei{>8
zI~l9;?cMJ-jc40ju1=$nRH+e?wi!EJE(?36)t3}?c~ioK33Bck#tF)Q-HQGm$M*2v
zuln9kn*YRn@$db<ue@fqJ@!YPE>6w1yILz2^Ea`r|F6A!kB*``0|5R_W;3%POR@n9
zoAAg4fr?0+Bm&{pY={V$SSla^)Uca<BvV2*ZW543$-YQ76o^L;XvHE_tJZ3@Ra=U*
zSsuP>P6Vrh2sLT}Ep16jv{AO%es^Yf^H4meJ*VgNk8i{7&SWQ(dw=)4-@UVBW_!Y-
zj&Ir$w(IQSEjr#WhVhN)0RCxAf*|-4cy2WKcu^3%B9C`L@QHjjYcqYo*fFT4JXSlz
zDjco7*MrT|lMLQYo!&1;akQ7sornW$+n^_k$F?2Kn$#H3i*XJF&4dMfFc4^nHg2XK
zyrXfa*zSG<YwCbL6Oxb&uSJb(em!ny3}Sq!ytr3%G&09&u&c8Zuw^k0j7F2mXq07(
zCFEHHx>TKk$M%ni5a3h89aY$h9#0}{$JQ4BgP~?lDz_GPA_`u{QV<gGz>DKb;|y30
zZ0V2=0-<=b^JWx|twAh+10MX?&c2A46R$6e;?!6yWcIH$i->4&L@V1DALCiQ*w=Ju
zzBha?{sVKEpZ7z2KNTQ^4{Xh=b7Hmde{;}6OoV1$hkXUtqumu_h1qyLV#sS2z~{kh
zGa!WkVyOA>(O28g^mKNFuwyhtgpk)GK+sZ?KPE-wxdy<#*n_3R3TfRlpf!Kog0(UR
zd^A{avjN@0>%mNsnP~K}2Ez^=Z)LWERo#m1%AUP?Z1HGVXj^JN$lx8`0Hb3DMc8Vx
zp%w%#0J4GC;ev*v)-VSGmX46e2wOWk<jzjL+}PPESweWJ21CDkCP7Oi0;#D6!}hke
zlD4*%R339zq_-5dc|sl0iVtBvI%pO$Wm%HtOhL!KQ3^he8^#{eczh^?X1%@#iw=E>
zKuZTv1bmA6Xx#$_@Tj@&MhF^>nMRCWt;QJTEacT3mnmWwh~h96L%hqd3=&O%s?Gmh
z{!nxNf1W=OXh39P%f!cu0U2jRJX~T)wSRw#@(su$ef_I1=yYr^TAIOR5?#Ywf@wwz
zs~a$~F|lDviMJdU19}p{i>Uy|0UQ8)o=_<SGdVsnNgbRpuQ%v0cZyoBQXg6V!r1o(
z8npdpYaP<(@vyyE<V2HSuE9NeF;g{SEDD0C6TIhjLZc`Oy%A0Uo(qVr9hk7ZkwhFH
zI$E)JD&QAHOjFG)kBeH$@?#<|XQhT_99cuM9v=lyGt>lwdK^5pfz2!#dsfEkjrq=>
znE-;W89&Lzn3k3T*kPGP1OA1-nm7KZ#q{@Jp%(grgGz}xUgq__U=5~VEhFf4Mqlcn
zVm5(k#IQ7@k&U2O)N5gD$Rf!`!L-#VTSA`H!I_{0{NV_fg2P=T<tk~Q7_+BfFk!cs
zEWFe#8%^U1?(PVA*yQ1>8KDdUI2a2_@tiORf>CM=8H{C&=xE@^GeZvsO?(!l&Mw$X
zY9P&nV6+Xi5RL`6I%8nto*JalK-CfkhE)>|oM6nyM)SuX8z4Q}cp*;;+J2uEKN0T5
zv60DyY%|7~WT{}B0>MZm6l!aK^>AXydpIfN^)$e8HGl#=5X);{KhibfNT<!^2G@c$
zSs+#I2YxY@^#_h}IC~ph54C%!<6S<RyI@Q5#%=uv@jypd<V04J=qO$ZO<Za|)<+x3
zMd7L=`6{(a7;Jq#IobwTicVhdH?qOKF?5v*1v$ZF61Z4m)~0wqE|ceQilg=HZ>mjz
z)dq)<9_*I^Z9>B8!hd~Th5(zLUS&cuFub%NQ-h}m(;e=<@hfc-8@h33J$q1mX;G#P
zC3<KS@tO%HQLBiLB{6Kg{+l%5e|CViw$|aU1AF|yr&g(uoK~d@s$G&(aj#u(bvxi@
ztF6xE-XN9Zp$wE3F8S^(X^F!wRVfvfvGv=l@h7YCoADo7;Bxg_v$@>v`kK1FmtT0J
zaMC|Ntm<mH{KDO1uUx|oUH7i@iEWQo?OFQ8=bKiT5?3V8{xs*<BL{BM%}Lv>PhH@h
z__rAwui1Ocv%fLrAI#UCe)lJ@jUD4H``~fI<h2J%TXvL9R_<#*anIpR(#f1n`**)M
z_tI#?QyVgl&R=otwQW-`Mtb-7xTe)*hj#z;+~QX&dmov1$;mB0_U5kc7d!LqX_H?5
z(aginTw&OVl8FyjPTT&+gA?xg)Al7l|DftXYtlXZOSV~Q+<PgHZLDo+HO+459J1-P
z3d^$PKEq#M9(%~AA9;A@rO#Rq=5B6Z{c+v6@{^y2UoP49N!pI1&m0+k-{i&D{RJ-z
za_pVWy~7gc&tBHNQat_c$zahh-<<K*=H|>hdY|q(m>1sVeec5AiMuY1ID6@Vm-4z!
zJ#pidjSn1r{;ApvKQ7EY72ZF}`C@Xf&79Tz`hA;rx<5!>dHl{Z>qg3F<s+VdET44e
zlh%`q73JK4(z(+<x^BhU_J>}X|Fbbu3|x3;Yr$>9JzF*pe`j%V*`AU;@9Z6Ws^gi^
z&EuEO&yny5*coeYx1*-2zCv<4?ygtd4m-pej2)y(wGJDswbe_``l>1@uXk6gF@guH
zS?jD-ioF2Jt#%0)3&3fut&`Ma+U)FX2_(C#+5ttbnhkCiEK;tVlRs4|-yjva6g;-B
zb4ZJ-ZP_f?Fb-k;8VOGs90{N=j2-p@yZs&SAA%JhTe4a_Ek)0Ipa_cm($S*6ua+W!
z2;SKCv1hi76YKab;ahBR4%`WcxG;B!JA+>*_%r>#xH-55`{l#frg&q^I4J~3Q2((d
z^?NuYfTU!@(7f!tY+0&P);i|q%DL0!Jb7BSJToU3&$F#i>gKLR4~N_A$eZSzE+gyE
zAt2}E=G{1L`i%UURy^m*;r!mxC55+YoemdgN!3=n71X6HTcrcvb5NJpIo!1hzGDI5
zzH;C}0Sv)AD<4iep~_XwS`gbp?ZWsrg;Zm8*E+P-iUA#Ry_;>k-sP^cL#^Frb=z0h
zI;?J6CAMmGy~gb-$G1m7saCM#vZPR3<G?zsSMVK@@>*r1qX1lMfW4yrR=CMoztjOv
zSADfzGE1<;VRK=zH%Mz;b_Y&Ba9XUDotd(-<J1gvct={*H1<8c1l$ebNTioF<W+8k
zh0~93FMF$X_P&MBo<H-8gM+tya8%F8JG_@yzISc=)c3=C62#=D_Fd)sZh!ivGhb|R
z{(i%Ow~bd?jxTsPec9H>7rrp+Ur*}OQo>gryUTIx(Mju1&sxaZ_nU6}ouHq%8uV8z
zpijFC-!Q;3_b+PypJnxBuiZA$7C!Qa-*yG|j(XymFV7!}ZO^u4%e#*}cxwL4{oVWW
zE>89SfM0*v{Fv?B`9nPm=3W2c<rAaUe0E#wj7syb-)Jw(SyP(VK4s+I)XleCys&dm
zLq_jM^FCf&Y<cV3-<i`s`}60Pwmm0|bsTDZaNX^{yZHQt`)56MYT7HSKCRHo+=9<L
zu*|VC;`vKDLDVO)b+){(kpuHk9y}QWu)iT<pD*kQ;BbMTVG;XG2bf;X!NN~CcHJ#o
z9ZL~)1&~z(VCm~StUX!#f(P*ZQE8DuImd_J9;%EhnK(~(!l3*a&tl;w7_8}wGHx{}
z*P9Ji13QPxZm^Un6S^bz37w*@#9E@TvxiEo36|C_S4)v4Svie+(JR-QbtjUQ_t`$K
zNw(^XS1IZlFL<45yhbRV!-waKM4xfJJOj_g0V%=!<<SI~TFjgAz49r`j$dCK>JoF)
zmDh2PW0c8@3|OvorH$<~E8RMwI9+M}Rk}4DucY9yrdw9x89cqN5v_&YV9mn&O6y8x
zad*U))g7_k|K+1y_}SQ951B_54=GxOSGQzm7pu>B#nM%H?aLGRJ4}l479*BB1JB#R
z-!VSJn#{`G9Vs8LZhf_~$Nti~SB%vm7CZDz0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{
z0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2J
zBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr
zKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{
z0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2J
zBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr
lKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0{@M`zX56(-l_lq

literal 0
HcmV?d00001

diff --git a/stm32/mk4-bootloader/releases/3.3.0/bootloader.dfu b/stm32/mk4-bootloader/releases/3.3.0/bootloader.dfu
new file mode 100644
index 0000000000000000000000000000000000000000..709a842e853733671632b6d6812bca53b14d5a73
GIT binary patch
literal 114997
zcmd?Sdw3K@)<0f-nVHT^E&~aW8_+WoAY=dsf)Fn1FcX@A071oFL|g}gI7tv9=*q6I
z%YZjjT#x{AkzEAcO+YXS#5H0zDCoMbtTPHOHx)%0L%eh#VLEf`-=}(l>%QOjeV*U<
zd4B)>$kWr+)m5jePMve=)H$b`(j^bwelIiRZH6#&7p}PP-UkUo2)TXks8OSE|NrSf
z;V96N9J@e}Cd4Q<6Cw=6H5iu#mkrktT+CnDzjA-&|El|IBJ{tZOUDs`u>adzLJBK}
zi|*w$zgbavpYK6&jAL}k$T5yFW5h+jL3ZV`>dFW26{jz&7$q7-<6K|mN^xb)!isyv
zCCgWcEACzPphcYV(8>qJ(XP4f8-8=|!WCLMBKKFyWz|tG69yNHiz9M=kLQZWlwW2>
z3%)0$a+x7Pg}+cUjgY)D(ww`@B{OX9lDuWlHgGb-ky^5|f7xBWbB2Ob{XC+Dm5)c1
zmaMX@8Eow*xhLAWG38x;_lb6$<3ziGq-<pCh-^{JjcFbtKOIXe%dN6fc#HC?C^V*)
z*-7MQ6;s3A3LhnA)=3ECoO6^B&@+l>!TT@V^BL#LW^)T8vJEw@Ic2m@eyvZO?AKuQ
z(|Yv7sVTm9d?}4;QTrLr*JpNVC3jh`GnWnYnr97n-sxTAD{_u@Zug$`GL@+_`Z%r5
zoQ3lj2HN#vP8I96$a==;&Rs;re}qWe^}Y~QCA58_-a?M59O;MFS2ka7KXZ2Gtm}Q~
zTbAn^<7B-Hd?TEt-tE4OnWLR+yl2toJKmg1i<4P6ztZY-EzGTAWu9HTkYa%4jxD5P
z>TQp<g?4Crv@LeV?LHf@bi0?%2IFLBWLCNHoVf_kC_|s=`|HpDJ2m}(|EABxoQ&C5
zNXk1`Qc}vh$ovmVrz`ya;M8dFvUEZk*-lD{JVj~!mXw~7{*Q7dTCQeV+tu<7y6O6|
z4}5Ibg+-a}e|TvQX^T_*e@`y(B%<5a_`ECgd_yO>hx^1doh^OFm44=tM$-APlXU-%
zG<3^@$F>nMO{|%gj?0RR;9}^#ja*0(YnuPikS5t)WNKHu{z_R+l|^QloL=f<Yn!_L
z%h{de>czE;BfpSbd40_n-<stfb|4u`{G^ox$rW;yIsDUKgwV8(DPZO@_c8mKFr#Ph
zVfV0qVcXb`*bbK1oR&g~Y*NE}RbKKOVI;DnP)d{M_K+P<O{b~*d!F#5$*X&KDfa@g
zi72gxpF`PgEv7o1JX7JVX&o#>({sVAWTC09yz9akojgk!F45c#3M=oAJOo;^cKH|O
zdUJiQF8^)xj%V$TXD#2_MOGx=lk3mD<!S!j?zP3Dlv|~7cP~CnwWgheK#i=txMx9G
zUe&p#y`3Mjcew7D!t7v+@&jDa-~dyU8Til+NwW41&mA*)`LP%oLS$o1l!*LFjK~j1
zc=@IHbBzwn;%rYjO00<efYfZH?vJ&HW@#y3j2Ut<G;{i_8G>)RFH_=<ZT70+aDv%c
z44z<v9!QJd0ooiu`)!=r$=bQ#Vv&<S?db?n$gDg*!piqW=o@2z!^POy04twYZwnET
zmG`N$LyQ;+5v!@5t7GK(5mOy2Hv`Wj0QuI~0zl{w2*wycD7%d*m>VKCMw^SjC3uMx
zuI`%oT4Bxf5MRUx#3DA}DRRoeHN?jE&hFvfQWIWd<tshRHnL+l#-Bl0d6-HHi5&Fn
z3W@+TIlsGlOIu%KwwDbWY$sRtuPKrWB~Jc*EJSG?yj&N8oD*5+63DwgUlCzBm3!xi
z@H^ZWpC-b3+@Ht&1)A?CV*YvDd*R>T3;)VN(Rv4Zm?q~dv}IPVQbL!At-Ndf14*i!
z*IV+lgP*k%n_$1`^cUZ9vMwd9Prsaj)}e&<X;G}<61{&IdsVxC5UbPfC*v<`_jQTg
zxbt$U^5P|eRycW$`hu48h*GPyHVUn&VQX(&e?F+|UjM-55VLc!eM&%onz0WGu=c{h
zq(-)2+ogN$lLJfaJ;4vfu@{oq()ZST_TWo1_RI!t{Ns?T&|B%vm2{ng?ppA7my+eK
z#FI1i@WDcfku%~e&~|bTzv+Ebb&!!&b(2QPAKFvfSet6I*Zk_zK9P}o;-uitOGm^W
z%#t6YP{SYe)+#^9%0dsto?gvHuQ~fZ4NGjsz*68$D|@)N>;$dtBRyj;F}-j8-1}z4
zK}MqeI?<Ez)4T1x?*<*TuQE@%!A?u8YqJ(G@|!)R&?&#~H-T0+_Xt+X>!~uM(Ne3Q
z!Z{Krh1qSX1?o3RDpbQOdZC36uyTW90W4PD6>HOG;6rT&7WS67bih<k=jrWO5@Vkq
z*rkkcm>L=RbMO{p$Na2F#hl~?h<$a}*w^S=n)={?L9U3r_YI!SWccc?VXvK1YWkRm
zmz~#jH`Ey9BN56ee>spFx?ZF4fLSugA4NBO!|W`(_T!>j7Z+sYT?wXO?>Doq9l&!>
zkO2F8;v>O_&qXLNGdu96Vu$NHl$@Vv$9yDl%=Y&FsRNjIcKASwg~RdH7{5iEgDbtG
zdH4Vw1Bd<#0c*kXZ&-P_;>%~{-$zB8A>_+9$klPd#scmft=^}-_3k>528o<1znHk=
zo5P)CIeW%f_M(gZ#E71aRfxP%`TmlrVA?mNjp`#cR3`y{ZoNo^-INERpB%#7IKwm@
za{6|+!rPy9MS}vK{69VE%k<N)zp0t_<6jSaP6#JrEjJUwi$vr_p_$0lJuKSPYuGpq
zo~L;WdpP99derbgRf?ta;CDmwU=J^U(8I`Ys8q_0kLQ;`pBqiA+bhmg?5H?fk+V2=
z@%BYK7UfjrR_yJ5(EXqCooZWZ_)jV$KbT1G<q9T9p&R4@3Db;BXd4Dj(=fb{O36Qw
z^F4M|Sm*X_oAx>#H`URA2da;ln;Cg0dUFI<N`jH6CrY3ZGV<Tzo)$)SC2s6(gAII$
zId{e=M~%ihut6D(ahz5h_^s$Uscd$fW7t!p@U%dCa(5B#IC6_-a`JtEJupG!GfLrf
z!75_DejP7t5o>n)2-Z?H{18TymLL`ju=Qs=kH_<H4Lfx)gZx)TkA5)n(kL%4>0#x*
zJtd9VC^@HR09qT;L&x49sZ9!aP!Stjzco8E@!r|O%P&S4`9hrU9mC&)yzGv}LYi($
z#}7Qb1AI`q{VBx@WHOb_??ZM|Ieign85fn^Ynw1j#SGx)zcu&E6w%PkSf5i2#B3>-
zH#&*@K$KXaH9wGis>0LtH;bcbod$*x)$nI3^Hc7fQBKpBYnpXZx<m?Ib&+#5t&Y3Z
z@W(1MHXJGed|pa}F2B)fwm=VyGCzYq@n`VIMu$rxWZyxx_1hBXzgs9gQqr70GkuoL
zx8K!2z;_B{ft6TNWjR*fwRUBN7dlDBMf{SQY}@g6JvYQFN)!T-XB{bNrDG%x#_4Dt
zT{e0~j_-Nb(+%?ix!xPf9J9_Yr5eZC#b=kYxHFrW9nj{f=7Jpt*X6&Rtz~y+oZw!~
zIBxgZyj*<}Crf(h2<mz<bSA<U?6zUAF_x>>*=PwvErE{p?-IcX_6l-aoLHT`IBts=
zk@I?-`6=i1h#Fq6va%=PZL~;64`U_rtC5uHIl%U9prWs0DGiQR{q$?0IT+6kzkJ3<
z=R8K|S|FaOnAZ`wN}4IA)$r45-|2ePyzyuA^hD(6c>i7G-}AaElEnL!#J_RAETYYU
z{HM2u0<NR^r3M~w?^XwDa8rH;_s;)-d)v?8&WzYr9ctv{)w(>r=@c{8A{9wK@XUA7
z5v7$_A=Ge7;``9TRmt3x7(4cA=-)jU35vfjX2GaQ8|}l$cG>+Bv}Zl)<*1Xie!Tm$
z9{2l?exyf0Yu4m^36b)y-3w>ANkMtnZy(qa?d<lCENt@+*)0{XBKD~P^e`n)UvP>U
zH(HvZ^>Al&cIg|PBx693??~Yeb$eG2KX<a*`(Rq25)@kB!KbL<yAm^`v<{x3BYHl1
zPvmLLxc9+o=>{qF!UL<4aQ+x&$DIx3tXe3qW;lh(V{RGHcsXyz)b4ZG*$U*s4N|4#
zk!F^v;jxLAn{JX`|JnEtK-Pq!mWI}E<;Upw&CR<Ts=!5RahAkD`vfOWA`zxDvvW-b
z3)tO3qlS}735(>%+`AL3Y>5{(>ZYgR$&nBn%&pw?6j6bW_bb55p)iwpE&oC}yrya<
zexHA$f!K_`F%hnt4eDsy8<=5#bWQ{>9rn-i4Ux^pH#^yk{=xFgpQMwH->0J=rq318
zTYmXjQ@Naxni?_1hF(rhO|R5POxL8#srrB7Z9pLn<(J**<uZp7>9OU=w_i>*>3W}y
zo$ADymrbc}b}|{v)}snJ+V6Bg5svBs>7PD*Bt0?%siVjVDE!e8mkow@uaf-K2p5})
z^fd3^e9RxlJAY40Uc1@-p7#f`;M8fw>y>0i|32<CZId~Jq0>K2k32)Se>}I9L+jih
z{-p@J(ew23%j;9qBdOOKIyaUVUDl`H6c{$U!8JLc@AfZga82yJm-ODp_1?z@JX6Oa
zO;9Ga%`j9Lss{||a=QMn-l4vKx%+kbZ%J*t+1cMc)VsvjuZ#3PE%E*dPyWHlcYpF;
z@*QC3YUM6@nc|y5Wa!xtGxT(b9r|gA8+tOt5B)f#8yX1dhyIi5=sauyJn?AjUpDc8
zH_F|ZzpR&VHB!1~QbtGEt4xs2U`m8lvM)2Kivv0zXZr==BKm9A2$#6gO=nQ&#r(}-
zWrM*kwULY=x`-ic16DC_HBb45UDg|(@=n8D(D00B{d-=k%<1)=ehIi4#{#dPD#C>}
z((0tR(_KzaA04oiZF4yST(`esn`>0>eMIlQsP|qNm@~C7FmEdGW)o~joGYhh1`qjc
zmvy>kuMPK9&gQMq?iJp>+I_G0qISRNWybs-I@H%8#`aZ+wOt5tw$DSn?R-dQI~&s5
zPX8Q7zz@kM9<DOSmDR>T&#9SaY+SRjX4)E9F5H!OI;SALwgGEiG1W;-Zu)y{;oA%8
z@3Bgz_GqQQ%kMaPl{jG?nMSQ2{ES;G8JEz^2IeeO!`D=S+DtGfoNsNz4qxA{qxVFE
zxa(slxB1LnN4-pt*35n6<0h=M;x1fQLUJ=HoEzAv-0cV`1xGnqWlb%9Wr4`RYQ)<7
z$T#_#x-TrZ$xhDXg;vMiavFWSg9IL1#8ul{=)3jUMKCt5BGAr^pX4@FK3@4`)g<?{
z%1Q3O;W8jy?B=`3!;{=5FIUal**238`b>q%>#m-8nPm%7bKShm^H%rk-Q*sj?O4^+
z%dBn|T4PwD&9so%xFzU`m@Ubzj2H_Il$yG0mbZpRwqKnxNZP0@a4>ed;%vlz^F=>{
zUN3OyWN%_Kde7Jm(&;9r{Chtc`P%@MrVj@=+v9k%*Jt&;Qb8<-x=FcZ$;-;k{+AWW
zEVO0%UREaig*G>AcE{T@`&bsgtd!Dx@7^kuy~hxQPS{0m&-7-}QE2x&^}j+rH*k~*
zTFGm?xM61#V>btrciovA6?W1m-isU9N&JO=3NtBl<;4xmq@7I{pQ0r$wj?1lZB`$J
z=?6@zf#j(|qiC}&+3PEAVQOu@vp#0iP9LQUaTzJW9$oBn!RFiH+hj1E`f9_bCZ>p^
zE!od{{~kgs_S}{K2+eNcL`EAg!S4bGOQq?WmHF=kbn-{>qj?Rk)=$0<vEp~QWMDMx
z9wZUl0Y&eic>PQ%^e1sU0Jtq!a~-!$af;i8KE}RAI@@FnG<L6D?Uehj+3O>Ar<}fq
zFLKJJHFvZymY=sRNSwBgkQ=T9$S65LVeF|IwwSl)x9NKO*aQsQmH_X?m<{kBaPNJk
z;?h%pddd)__8ih{&!P9PG|J>pA66uhj(+x;`I^ONJ}f_TFe9)7$xb%co70%Yjxm_L
z-`tBOIv;cnn4xqQh`l5TNDi7R4(_S40Xn%S4IC6S#7@z+YL+|YP5!gKO-;a$*oter
zua9hI3;`>wuPkd_Qhx2n6+66)h0fmOL~{0Q%jmxGx3B#sG+(nzz1BN7lmgm9WRxS2
zY<)x^IhTdKbNOr=ol828XT7;ApKZIif%cc{REue!FKu|eX=^XtWCU%#T;DGY`jhj0
zW`m24`zJdWwSSSJ$#Gq5wD_L&Wx_f-AaEULgU@{68-{l1Gdpop6R<8`f5)Akq4ju%
zcaZc(r+UjRUDdDY<ioMu9Vx^)Rqa~*8fQrl86PpAkEmm2COl2+n?s@8N3LVYTFn-%
zM!g-rkAcP9M;3-yOV=gVqFfr;u1*=O(OSC0?K=bt;-R_slTw3^`EGCFHQAFXkr#}>
z<)H+x(d}l9*NOZYxSUe64)(Jom-{s?|Hw~95zG-8N#qTFUZbhKRiL3c8lT@|p_J7J
zeVj9N@etoj6)!#Y<x^=vXw~3jyVtJqv)zlaI4F0boZ}*Tc42w7Z+)8$d`Wq;8mj=6
z8EhM^=XcY3^Yq+F)CT`2Yg>Jkif#@j`8ppGBgxgZzAu1<B+M;snU8$pE3PT_(|P|C
z`Cs}PL1V7qIn+L&q&r%1E%e!tyLPoPxQEhXIUAt%S&s68M%z1lX2^G1Vq5??)=xco
zT{fg&sP&yOq@2opL=TDc^D!L=-SXe0LV4(s{5_Be??rca2;>ddi=X_U&0)IOh|!}T
z;+sJ_lYap>oI+3Y9yu8Ld4Jxf>rB_t<*k9_>XL@lB~9!K{U={ELdG1!l^r5PX-<_=
zd;_J$wgJ$k?{phHLRn+<YNr~W9VwC~NDkO$?vC4h_EMWy!MaBGkoj}7Nlo*M4SLA>
zEXbps31WlqWyC$flsZl>iH|EAKjRZ+o3m0X?^=C(N}U@1P%WPEa<|`IDbc5QRi>Vn
zd^kQv!k!$dC*$-vFD_a~qXZ`x#LK(nVytqDk~Lmc`A)Lvcy~i4+fBwK^Y*Aj{#9bo
z46K3`$(-$K{)|FfGF_|Y{*-=B%|@vUy{$i~_M4H~TgtCymXRGhT>3y?Pa^!3`f{fe
zUZgid!?j)vix;7P)H*dTPUONwKJ|v&!U}}oa^k8{2a{E}6kJ3dyzwD*FvZQ1uZd8D
zy;th2wAn;X1$Lmhc$0QD<7tZ|SPLbS?1k0r?KV4Xh@y9)SGcj+^?eZVDa;4e!I`K(
zys>Q6C_5W8tr}xDp7DYIPO5^H?m0~Il=#sM7CJm5MzN>XVW&;4Y-)IA4>L9bi^hh;
z;t}1!l2$X|5cz|+)n_W(;W7usM|_R8-`rw1o!(oyx7%+!)EyYC``BBlD_jp>1tXeU
z308K}HnuPM(9!I!G|hUVLD%tEKVIUV=jC4~cwmUzPBw}dgHG;NDD<6iky@%n9d>6I
zFm~vlQ{Vyl#fuF((9Zz$>MdBe=QQd&QyIrVHT*oDN*V`wIJrq71)`L%$rRY<<GOC=
zyp%e!nUnirH^2J!BJ7AL#k`t0t!%qR*X?(q&%N`wCy}J0xiMy+8S})+6|l<R5ohWh
zXz?Yqk=>$48-C?P2(@pRATfZnH}PKRe)REST(EU)B+yS7_%oR8>A>3OJq;1R>`b|C
z!zh})v4P0;_*P}TL$w=%!vJrdGSs7nA4Sg{7lt4;8<x<?0U~E(M=#XVS$Y6Ap+50J
zo=T+eMn8Oq1lUfGM=?vX4wS^jvwJN!Lg2Z^{+`7aHT;6o53q|A{e`KGnMe&$G6B1<
zDoSQh-KVfP*;+D?pQB`Wu7pywI*%%8p07h`p2JkX1zq|vrYQDseoCVv>!iH89(mhw
zDW4Ic9``rS5aDgyKf+ZmU$AjA<}W1H9Se2VT<E=|t?eX3(r0|EtaG@#YPffBPlZ2+
zSTtXZcRTgv$aS|_yUf;H*jW6xVNIlKJ)X8}^{H=+?nCJQe9FwX8;GcrAA;p<qr)a=
z!*aIKq1hdZPqZ6t+^`HA8Nv>QM|OO<Y!D{HUZP7e)}3e{P;#O@>%J51Ia}eWy(4vt
zc}xGTDO>ci5}PjR>h$s+)dqVYj~&7Avb<Vq)tp3sD@tl7)@H+};9PN{eNahWovrMa
zP1f2I?fJhx(Jn3-y=B}MgIpJ(y@AH)roFki6sh8ii!UzaaHl$*Z5dr7Y)foE*?jgc
zb)&7li}x<&aOY~doqO*`8E)^rd++CP=WF?$d#kmaioMk~`ldn+&rzo&wJgnF>-Xsi
zA$^$4viX(J3dYP|m|OWV7dx3#X`a!?#RqdM1BTKz2D4zIC1k&AK76t+NI+ULsFl?9
zmi)N4q~=G&JV%bP#L%4LNtt1s-Z$4IyQ3*(JC?e-{3~`W-idMfSJH7MX`1>Ssm&;G
z8I~f<6a2W9Zkf1mr?UrGLbHJONs;laVa5(G+qrJc4)0x+#Lk}OAtA5Dw7m_=*_ivL
zQvbKP+23NESy4Hkm`|zU3#w3d(aUv~7GLyMRNh7Or*x=wE=FyaYIsc>l`gDvQc;fP
zJFjUz(EY^yM4k|RAGR3(LSr3~?}-}gk@hCSyA#ahtHDJ08I?US3Y?P_WyT64B!xFA
z&=i>B)PNeUQ~S>xF#A+H8AD~FJ?d!8LVJ552jY=JZ%0TNd)P%iGv5bQz)`~+)ihWR
ziTp!^a()N((P`2&JxU6{3<_gkb;&6CkeY^mK^DWVF82EQsg1n>*WhLrx)Sl->g)U4
z6YXqqHT;9QHEQ@4Kwqd*&sB=YBwvb{8wK>_SFz99S(_d?pTQr|4I2t#2|CnpX`8bb
zt_Sy;=5-C6v{WLUqAuHar_U;J?+C^FU0G5Xz3B_cW7U*d#@S1yu5VczT{~U}d;{Q*
ziqUoBYES^B)d0iUKluab+|YfQPRfNPpvJF;e@LidvpO<Q*TJV2-g#c(&DByPv`L|@
z0l(Za1J(Khf^{J<Lgbl|RV@PaXCjY^m|Ki!ONmaDiZyIK91$Azo^D{bbn3sbm&HzI
ziW)xqSBf9H_R+RCzRhUsz|FJPHK^eRNW^s!x|UL3f@slWts=4sDT6c~w&z&Ssdn=d
zbS-%(GOV!}t(}Nd`*(Vy8vZUZqNQ2uC)Is#2<l`*l-l;GH2qcNrpDnY{d&C6!^+QU
zb%=a><Ym;`kr+HvoOKd2!gq?~WA{0?NzMh{2BZ9@==Hf?oyf=Y)_5N3S8MhAf<DGX
zGEOX&GLCQgHiJBlt6EB%ku@`0%30M{VeYDQ?r~B3T{tMhg8he{l9qJ9crcy@7}GTv
zbUx%Y*Xf7a+z)&Kyj)7+W+u`#NK+cn<TcWComRv72_mZDI}$<}tcTXKi&SfF#o5KV
z_tMA|m9-)QB*{tVH9i{O%&sy|yrGDb*fVDIU|5uZdNO8a%&MXkq|IJ=j}N$z<DjDi
zrB2ExFTfYUp(PIMHN``FkkRabbndR}A2rQsGty@2B{IaeO0}DUWTenGL=wktc3le+
zc~1|q71xZAbQg%d3v1tw9tO{%1fHR~(FI1J`b$X*JOo4ypHX4saPU$TJ=u?*oWM$%
z?8$9CG(~OrCV6IW+KjZ+o6bhs*+VIe%8&Y1s__s4TZt`Yrm=jWG<20ZDkaF=D2{#0
zr37_eSVkc2GQDyu8PyeJim!xdUud7?=4Tt&14#-T*>hd5o1t7!O;vU&0(Kkcn&S43
z)5PYJo>PcJ4L?G4l@>}}3u427<25l#m%H$;tdU!lEYF^?;*AeB`^Ukn6EVUCaWd?3
z&bN2o>Z9`ELJq~eNj|6OC3A}~Uc7-y8CQHsV?V%k#N;Mc4o0aDpdm{2Ayb3gs<rP`
z!;^qJBIdT3P%<y}W9V@g6G-tWArXF9BL7Aqg_nZYu>L;}8lrSY=Wqwof5LSTS4lIa
zs1o=LYI@Q=lr|FK!LbZLTM|{nU&qw2K5m43dR`GFXy|iI@_OY};L-r?qZ3}SFQat4
zfDhP29<0snUjX+#T<`?~wo(0m6Dz}%s<w6TxT=%px#mr&nP$dbHPhK0GBl$dl}h7P
z3bQS_M!|PiN($DwbfC2RmBW$8p^=$eQDaiR`zq{wHO=`_txI<f{NMYwruE$g|6K5p
zbA+2I?hNV64DjsC@g2nuX`^qAt0zDT!+~rsT`%9j+D8Qa92yaIn<2A#;K@ESf=j1#
z`7Oc4A1`I0$!LBbSS)y0EGX?#zWh|J7{nFxr``BvPCxEqgLE}q4$1^Qwo!O=Ev0gA
zCH7NOv&o28I(R*Ep2kn9;lHT-2&=?wtZU<~R68}wD^z~+cOd~|uU8oxkqxlI5}C9y
zC9$B;3cbu~28|nL)-E*JzN}2q^C$aM{+;VN#Y_qZ*)o4q_7hsWGl{dNSuY7gn1Z3O
zX08?=#e7^)7Zc{DubaBDo1h+`so7ZyV^YJH)mP!+E&=~gy${hR(|0WVpz=07dlI?_
zU}GHr@yC@3*4)RO*NljW1Ln|H<~q4qDD_;?>DOQ;Gi&mUx7Wz6eH7*q+Jj*(cmXD7
zx4~Kn>$#f~kRs`qrtWOYZd>V0_UXIem!Xx-`c<Uh_b#1uK;fO4!QoQFpc_k>eMg(9
zKY5qJi~SUKGWKLa*j#4rQgp<YyTG+ziYQTRCTVV&3Tv7?5HVbW6S{L7#pD(E2?gg7
zVBn!PLg*fZ8C@;y?Rc9buj!>-(mL@3QN#CvLszTBI^44qdkbJ<#8&A;CHsQT7Etp2
z*|M0y2enieSuO;QRqoV}I`!E4eXgBNW6v>T+C%3Rvp*YF{7`_I^i9wTzl(6wkW!mu
zDSbbe6lQ$}yU=7tBn4cjAw6GVHoVcfIzwpV-A>Xq^(f|quIsP^l!bx;b1VFk@|t6n
zc{=VC{FN2lqEADVuG|WIP#gn#e>X(&PU(sVz4F+>v4}=d!+aa1<+nh~6?cDpV`kZo
z`=L`>cig-4{<RIzV{KI5%P1qz%F}1$db6$b7Xm&z-|M_4usgiYD=F5q)I+)`cM-MC
zA?DGmE7PMSwM&BvK+Ck<5rmkpx1ok-wPiL71-vD#g8?4PRR(fVClYzSO7%2&q8!2n
zzEBC$T~-?QL{|fJ?kI<hY**Z*)5vjMv6bYt107sin)F`&x4^!TGFozizY0~Zke5v7
z%^Jkfm?M+g(#fR!sKGT{*amrf2)lIN-WlAcFoa@GdF<^bTK8WG$iTo?gM?0oDFkmF
zj}!5SkfZsDhJn&9MRY!=q>2yQ`Wl~ue7`vGIVHvM9Bd-bDMs>~Vlsob6M74aK38I&
z&g@I;Oks2)C=;^(sYEHfuXI;^SAyA>^ol;3U}3R<7dAn6y9RJ6sa3=8t4Ya)XDe%Q
zV1};1#=+yhMr~Di;(XKJbiIUV<q(C(!5`Tl@AoHbLMNQlW@t{nbN9a6_0v07o80`z
z24c+`#!1w#-e2qkiyZY4bM+#i%!ZV@fG9my{!I)p>S=0iY@$SCby)e)SV~#$x&w+J
z?p%d&J6OEutgQS%Y_#_N5F+FTW6g;`rq?u2vDCr4%UA`#-Jt3;_=7N?H)72yOY{T0
zX|bH?qLrrRpf!s`Q)RJ!Wz0UV)2#0&Q5`l*;*JZ&hg??Zux6}Pw9JH9+H_v4H#WvY
z{?NP|VrljC{s189>eGPPjCdinv%s!F^`|)cREj&*l_*cY(_lJ4HPu4w_|>o{o@LRa
zPAS&hc%0ZW>-E?@^2L<TX*|*0!92kJF-q-9G^HSwSx-|}qda;=Q$IunE3f6XM>%V%
zmijvSgN?DKb()yGI#7v&mCvDkT4ynyS@~4db%iNrf#<xs14=61ei&u(cD(lXy=cF(
zQLl2HBD-6|#88QQPbjW+jRhvgY0#rls#o6ps^Pe;W)|pYqU4qsOCj+6GIaErh%qZ{
zQNvr}qU6%_NbuHJ>Zkn>xL~H!h>PF0QQXutr%OC6wQ9Ia<+pRlU#4zsq1KPHiJF#|
zo2=3W%M|3knwSheeKI~=a^k5Zp)2eR0K>%5oKf~f!yzTpK}SJssnB`S9Xg4#6-m5>
z)H+3OzZ#yOSd7~D#VuOx9Mt|HKxv<}QF@_#)(^HJ7B!{;`mZs9j(AOrSitQho2}A2
zT5d^#au4+&JDiB6Y^C+F!dcfh_$|D|qTc)juTffioRi*Y`K(>f@H@b{=3o;uoY}-~
zGzZ_gYOvahQiHp|&p#9ygP+0fZ}qk+MsbfnTS|qTVQi6*Nm4?YSPeR2R8H1Fzqy2K
z59nie{Ag33!t@}u(7df_b!zyuR_bohzh+DGL_>_HC-gnW)rAZ6R=!=@(<ySmQuoo-
z=;>?JyTzUv>4}GH;^mi*8Z#o#M99!`Sv0-ZA&r@F`5kss)Be1*mcHT%c)8W^5wu(Z
zOW)+6c(cAk;E4V5`4)J;#s-8D%cQgLgozpd3JN0*W3?=RMaCltod%AR6^_bDcE3wf
zE!mK2YofYNk%6W!-GLpj3)gcrUd@^#z3F#K69>YlAA5;Rky+-=b&Q-~24M6JXnRP!
zSxOzRtuz~`ZYVeJhgB{^;_9+2{eg);M>7zGs)j$(BHC^W?rUN#{ZMxk>Kc%@`v@dc
zYyhZ!W`wmpr|29%;1`;*tsmlqQXCe^W=jE&7$H@8NLBqD_%xluW}{pPUYj7%nm0uZ
z(0gdAB$5Lg8BG;OGH@3mg+@h2Yo%%;qGX2@BCut!(3VUZrT<xFb_k8}@UfU#Vi3Fh
z8gLm7Fgrwx8D1>9n?|hdn^?2J4`%G6t1u=Sv+QW0^SlkEg|_7~!;6vt3Xz)+VD!xM
zeDCNBqbc<~Mn6Xzy$7S`wb5r{^y{=(yqh8Q0?{1w_`{xj$hy9DeK58+BmFciP+X(}
z7yK}+DGt$Uv-PRZ0XEWsjg%T-1=uiQ1<G);h@%v=_-P93aL+_Uix?Q1KG>6GrL|bO
zz9$8Dij$XnMoTp3QjaK&1Wsz2jnX>J-d-RQ$h~8b+;nxh4Sn>sjP_M&tJFq}yHFc<
zeq3mYhlhi%1;|ori_=R_BU)wv)?AzkiLB{)V`}QT>-8Q)y=_`O5?_USX|WlQM+Jbt
zp|_nuXa_r&PDc1DBuXh%Dm_MbR0AN1&AXUdsv|eWneFVp5~NNfj<$SFN-yiJYb`81
zf@-)r2L1=UNOWFH)gX5N;2W`z9-Ik1Xp3vjWuEC%b1g`BJ(}L;ezw6N_1z_oTqiv*
z4U+hPXCxcw2afwolx!`NToSR+R@%_(K#MpsJD>-Ll3JHkhF;S*O?cyLVGockv^1;b
z)gdptrAXpFa4ddcG2LU)F_1RO6Lej917k^(ZvF$Ojb&z>+n%P4<vwT^w+2@XN_(we
zy}omBD*FB70O-?;rur|Z6X<BB?%)v2RIBm>_#sQA(R2O8uZayYX<s+>9ab){6`oW2
zi-x*>R{itODP~YbAOCYoUr<Hn9HYFYN3^EZQwaMM1J)s$dPT{x>b2Bvg|1vQZ>KU)
z%lS-kT1qeLtecw1^ZoWuk?44z#!hZ@w1kdm4aPF<nTCwQzPt3`@{Q7VNUJR1E(bfy
zJrWr?@UwjMjH^3=I2WV*iyn5rII>7e=_u_}*Ctx2q$%ieOJw6j$pYIwY}smI3p17*
z@d|8HUm!l#NLzU-i8uH-iq?Uu`b&C5qL&~NeOw?PZC#A8mg8hk6P4@BqWq}gQfeD7
zYV#lAB;kl>)Zk!2Qz`6|o0=$vK)=$Y8!gd}68@IbF7n`>-gmR2@Oa?OdA!MPfo0=^
z!o`(~vo*?IYxw}{BAr9n8wO>yL94NHn*KE=n$*AEjuf_FPk{qNbZ4SEsGO(%60A6&
z$#lRy8Ko=g7oZO(R^9U6+%s`1bzrlSN~o6C3l)|pO{?1)p)jxSR*znNoK3|lMmh6Z
z#G-NL6Om+OfYW7erM3{Jp6<XZT!=E_c$wqpwJmVL?!l#XaD0}+r_z3zn>RLOVLhbs
z_?(i3JsPR)16_}<!Y@PwZGF5m;%H%{Jx%%O^HEqFZj6|FM??y~BK}@}I~37jMk&^&
zM6xk|{0JF4KOH<fa<i`BK=+hK)$r1o(8x@V1b=~22h}?e<Nbxd1TE7YFOB#<<KLxR
zK->l!SdKaE>Di@x>9E-qtiRtmez14pe#w!SqPPDTEZND`PTXJnEl2o`-~sbuPYN*6
z7bmN@x<q(M-0Mk!u7s$2SSyJ9I^d2UeTUs1ylZ-?b#h&b+@a1dOY7dXg6k|`Ztq>)
zp2g~xw=UCf9>NcuJJJ#4Z}g9hKo%Q&$k2KFN)R)CK=CeA!_7*o;<aD}!6-_Aj{`j=
zM?9eLp@17wr_OFwN^UJJhxJpL8sV>=GyLjQ`iKRHndjwY1H|Ft@SA5kM$&)7Ny&bD
z>AP1qumo#2*{X&=hn4I}#J;~BxY6@FSRLqUMk%EWw&F>Ft`Mx4z!rS&c%!curB1EP
z(0UrR@3G>1hb;&G&wsACvu<8(iu{sF&pHHF%&Ql~^Pz0?(2O2#Rbj8HIMJS7EW!?!
zUauGb85&woHM#9EQut1=f4u=|J6e1z*uRdKXT!T^9`OS3@T5YlYb<ost?1_%^mBiZ
z+K$pNw}{R`pGHeW{BwvY=n7H(aMJY=@xVAuB2Yb&;F<0#*STt7vFInUK{IAq-(#Xy
zXm*am=OH#cZzI()h8}b==MX2=N-56SVufU&Jj<e2u(6H%F@*J%{MgHfHO*Tao_D3g
zFHEC|*<d!Ho>Sm=i#U(K3P@lD4_Kwq;J>dTI_Y!^JpnT~Va9%frV10Z-!x@IEGLaG
zrs;u*VdStbGIF+-qOtgeQh%&$;OHBBwDHmLK%*>B!&ORZV<LPj_K=l`v{l1%6JjGX
zHWBuy#t}av0*+b|=e?1%f$Ufaiad{4EcjwPZKP9mTnoV-1^a=stfu+wQs+#%JEjrA
z&or<|kxgU=jS^;iql8&4N|@&Gy*WI~Zeq1ELT`@1a+^3U$BdkF@FAHsk5R^lx&s;S
z!n5wxX_3V7@RaC~vd?`7Tllg6=ey!)l2UZzboGoa8CM(+7ecBZvoS+-^#eR9o8d>h
z5&p8$csM`W3O?-Xu}bmq#+Vs;iyqW=PXc@X+jaG+9$l?rOFWzsz5eF5M21a3uCAWu
z$0J7IHfaa=FVG7qL3|<Niiw$cgl5LVVNUOfB|W8@KM48bn^R`-Ry*S3=ovA{JJ}WI
zt<}BHBAzG4slAyvSlFz#Hi*NM(F05^``G|bEc|zMc#DV_`V{!f>CDo3&x~_*eLxwE
zoDWzOF3s%^uY8h5`XF9_t20h#<W%fV=)2j_K}4MY856T&e@I)sGyX4)KB)hO(ukvZ
z3*Ft;rQzMhm<Ap7zKhX4{Vuf>m}2n!bu8&G*9Ao@->EP(?<`gZde85T3Si(D?x*d8
zDBQjkuZ^NM{B;eLE!6M(50%y|MLcjK{HJ(!%W}DbPz}`TGsB8A01+voeZcvX@UM#Y
zOx$0^J>z`EGUv6`D{9@wV1=(3@j+S8U6&9dehD7Cmwb-jCFEQv*;XRVsXEa6x}KyQ
z2i?LOpWTuO52s#Z${S-Nu!B6`fSy3N@j-7&K`aO2^`TW@O+_yU#l%KhPL%p!B+ztW
z1s3+v{&(OMASslC0wj31DzwDHtV(v;z3qUw1v<1E#+d|2F&=bPjCtVeb>OvY(QFFO
zLGc3HrjoiZnSWe^))`C%w0~;Q&cS=H6Hl}=rQBxhP+?#AD#$|qX=gyt^0^>g1s{Xg
z?9(8#gWJyTe8y#y2XmX-p2@ASZg-7syDOL2sw(zZypJ{QxdsBC61Cz~MR2aMa8i)n
z$#st83*^E4UKe|2ASi5G;$rUJ&NN;6q`~%Ur?V+N5ph_Gd@=@G%nSVfF_Iqr;Sqg(
zca(u<$!&zT2#8)l+}6VG99YWj+~qnGe8u&zkMpfMjQcOKWIfKJ6ZtJzYccvnxG1q)
zt|V#DW~tnjoBKiYPL)Q3x(h+wyP%V&;9W);-KqRGLC;gsoysKaK-RU`rDZrtCK{*(
zWsK$pJmTsPy8(@Zp!)ut_!ppoO8$IkUiPeFx%nUKjx9RSo%SfVG-DQ5OEtcX6Fkl*
zZ28szzm<WQux8AUPJopMGbG;?C9pPtXZGts)AXG$nuglYyW1WF4O6diX0r=ked;$h
z%;ew)r<TM-_!lv8VIq8c%!?Dj=2p!<2tGD9Z`OE;k#CMt{)vMQm^vQ(SQ<_8(UZ|E
zl&8GsXiftjcrBhL5l)Zo*7h5ptJQS8OztY!dQC3pbJVY94+pKjG;oO!NW;9n1*pX0
z1Mbx5l~A<=eq@CM`4acxt1h$mR<BKBaR%#Jke-MjZIm}C-p$RdFAFf%0rzYmlg@vf
zbSj)tBHin2pk?G?51scI);B6A65)5FHCm6hsEY<wOM}Pu?oUj6us<Q%{)BSxzu{B9
zGL`j{=q$bvPlRuZ>wBX=eu2Fbd~xxD76JT{<Sfc#J)xEN-9L)P8_STP&uct%3A0{!
zq#Dth^MbEc!BefD2-!x*x)Aby{R(P*Opzap7M9t)6F~#7Epp)bcIf*mcD7T3)HXRD
z_96%9?uQtq4B8&ne<|PkZo3I?*c8xdMKlrqB9;h$nGiJHq8fgvMEKL#do3N+!e%!#
z(vAwcx20ugMFr?qYIvBMfL3lQt5s?oBGz|6E1l;oT&#mkqwnvE{~eV00RJ9-ef%*^
zCQ&&^$4B>@#PT=HHf-^6_-PA&6TDb`#y~pX^+V?sIO(OTq5GVOtNJzp4`X3jpta{k
z@!kr?cCmsKmCI>}pJ-KHbd;aXMC^2G8#9aygXa#i<4T0I3~szw?Zz5<u_6&RMsL-6
z=tK|aIcXhnv8`*B%UUsCH|7+vU0n3%s#fI>8~Obcr72Q2aMz3zDev6z+d*t8Z^>LW
z(w-t`z*E6?s$){@FSa>~Gi#U$<(G4EXwDDR;t4!24W>7yb()2js#4KwHQX;z*9cte
z(s5#=3Hln9q!SXf^}BTMoupEq=6nz<l%{FB%tTlO_N|FjU_Sv_=V<g+GY(FksxFt8
z>pDWI;GJD@12FMPFja%*OHf?gSCMA(4BJ~lUdY;?x{tG@Kmsg>R!x2Je+@w{;{;X)
zfxPdTAY}nN74X#WQZgKQE!QzbM*St22*Y3h(>%^|9&a}-5f|^rye-uoptGmj2i=X%
z9knN}gCwQWeLJYw5BfN35Kr|fD_TnF;CAOZ#4%D&uMs`@6{zYD*dI{~L#5=Xp;S?t
zNQ4i@D<wM4!Z<y@j1ltR(YAP;o<tjTe@ZMbYqW7+jM9cv-t4E;;p}|Tzr(<u+FM1r
zp~81kS-df`aV9wTNHj+tmthL#$SE0Rf$3$|pL)ZeN`&9)SuWqFd*A|SO@sGHFby;|
zMO)uu@f?}SumrHan)~kKJJ%C6j99+Hg+b8<sSle$-~9smy%;-_Uk3ZWmhq7!WxV$S
ztg}zz5~aS_wd{%a#r&Lz<;X(D_&~+7yuO)oDr*Q9PUk>7eR{avZ^E9(p2ga%8+C#2
zY%mxP_TBHn*)C7Y35EBQttFuJVwJPNBDgUPCx~3q9JE=aFw(azWUE`^tVZDLEw!O#
zI`;F4@amq6)xO5-G|on^Q`Ae*La9L8f7?L+GAN)cLh10THkYzCm*4m5;S|>|Lw8H!
z`#^Weqm&yD(ipVDQgGur;QONg-evt{v(71h=}+s-@5R}ocum<*4Z|y)Ul<-f<;My&
z0FuGkW2>I0v!BAg3t#C_iwD$V=jH8>xSe~09_Ts^Bt;(8)5*^~HSnO>;=nladic&p
zjueg!_^ppC4Pwr#h-~?w$(8NB(+mFqcE8sk!P3w-YEzh7p0PFKBlAIue*^GuAmi&e
zIjZSV3X@C^s3%)8_KVi>Si6jL=V$H%3GrrNz_y%yocvU*IkZ-5$#O7fA6oeEu+|n@
z)!KSLG)DIx=ofu)<m_u4JN#hs1UHSp%*DDQ@YjN`hk9o?<IbRC2A$!)J={iWvAy*i
z2WyVUsLkW<@vzK#FvdS87)W2{78<EEQk#t}p^St7p4FuZit!&nlX(V;qw)Kp^E^ei
z7D*n9ZX+i@n%Je}Idt1<TRgyXiu{~{xzP(JuXFJAx!)T}gyTK;g*Kz_1iNsLB@wO$
z)m{y>YqLKezxU~WiQgqU?C~^yrfYgH4Y)I;?V64RT`R)F!hRK;?d*KTe@EGvpSa0<
zijlCF)n;<Kazi8CuUbHnDY6TCVU8xtRxUesl`DLsGcAK$ecCT*v6j<g4=n2gU*0c*
z!;Y9=BQFU1IqMWj08M|dN&hO0elW+@3eY<m$cc91F2C&QI|;e~#Xu~+OBoCd<UvEi
z8YHJG3Fx%%g>II}Rtjml2I+kb($ruIyn-!g9X3Dx4?#nBVC5fNY+wkaL|u=0KWzi>
zIaZp4y?5XN%6T6GzSCLIa(y%>z&G=HMo3#ibj|BiXWnc+ARr(^tEu(Oj-Jt;BGxl5
zLfTG&gjvBq8X{Z%J+g1mpG0_U4;e{iTqVDZ&H`Ue@z48u@lW*-M>DbP)TEu<BObX3
ztPekRukVf{tS0AQjTS-180+HUUt$;EFCrZ2`!ng5eo}<K#_sF8AMyRbW}ieMdJ|F5
z9?65Y(-$&-JM5E6K$8HZ3#~suI`QixKl~)qiDi@4egkX-v%&di4YN*RpJC4ro@^iS
zi$8S}_o43CVCnS!97NM+xK8Uj%~RQZqoH}k!@1DEC*$<i&n0dg`wq|=DZF6R#xMig
z$QwQ0Bebu^eQa-EkHmMku;}0PgujKtB63%h#))K1H~$acR7r$4Xrt<jwFG!15sF6=
z#_w`%R6dL<Nz>QAy;9TMAHJ_NNx)YvOf$sN%0Z+<(l@|Aj#ElCH8d*Wmb{ct77(2H
zF|DF}Ow-I{Dj&~6E-Kio;j2AE3MHj=qjD!!<K&5}d7{l{sbq&duG~3?#=279_#R)j
z&*-k7&Nz+kg_XN2jc$0`UAbOF>Qz~~{_9qYoWihfqx(y|`4T1ZcF}zAnW{zjqDuzT
z$9-ne&gsv((t|t7KEZyES^)REh<w7&*>eMo{q`Uy->lwtVKd514nE&oCY2NLC6gn5
z!)b#1VLxy02oUV_mt9D;M}nk?$WcFo--w^ZZ;zkDuj1$N8}{q)d(E%MZ@1roUuKPf
zU$Q0zzpCGe--O>(gwt>I<n@Y$K3E0ZFI{*D?Vkuf(A&O)6YY-#IJEvyz-&Jna@dcB
zcv*=os-kWGS!?@GTHCK^ZNIFwy;o~{kJk1}THCw*wCz9oY1@C$+TQgaZ8t=($Ylc8
z;pE7WL($HwdppexJ-ze1>yK?VIRoCbV^>|A#kZr4euIY@!oVuJ%XPfHuXXQJ6;IvL
zHRv@P_DYs6|CBrNT_cNJ#BBHG_@>DCl8*PQdvWG9YV+m!at+X~I-l^<^j!wsDVy)}
zN~~OZg7au}J-8Fz&&QQ{j_@U3elW5=#2#Xb!~lzn!^Pv$;nL$W;1Y19;4<R+IUa|U
z9g1GLLPz7`UclMi?htFe8se>pNV5JI60F~cj8<rS*7lIu8bSouHzB9>V#sg(5@mmb
zvJa!|LnylvWgkG<<tTeU%2uOnCCc81viG9w5R|o{tOaEUqwGMG%|qE7(Dv0z^&`z*
zLt{8fi4#^ECn@M6W~&iU1VGUP3Li>hfb?J8^$@-j^ZN)+pmqOt_0=;;YycNtZb;1~
zR$kNlX7#muUy}hpi_(XP6Q3-#jAb?-!&B}u^Gxg-UA^bzabj{FwG1GtkJ%~UEJq4X
zUwm17T#G(TwN=1s>r9v%b)IPWpNZ@H$)jH)E(>-hDl<)G#?t3qrr=pbC&f-Vt+|U3
ziL@y9F~podM)wz|D+%(!;il{-E>pRHdert35B~x_b3q;iYf$pL2Al^zUc?2No$;`z
zm9{}`@zgRI4?D3g7#xDfXcyY(moe1hTyO-nIkHw*Rn>U-20)|zqxJp;nNiZLpT(u{
zurFos-!7n*^1{36xp?>xG?`M;Y?{THc!|FIhkE=fXQQe2Xe#r1owlFqys6cp{U)hu
z_)B$n6YVGb9Bm5x6Z}w|PJhri>=jqaxh>JItF_TE;$F?gj^fksr@g3dj)uFKn|}-{
z@C{N+8vW7&e~v~0Q{8-h8~x$}e5W`=Pe>-tIS6tsH2Qe>-59fdL}QAFj&~0rO;-)m
zb=nghwF{#@9AiXnR@$zQyGGmR(=%bjGRNuzh9}0zNO)Ut+7xhb9tU{Z3j2fnxRM14
zPIb=r8s>lojCGj*SXEi|%v?k$`Bxy4^?nw28e>PTrqm)zzqVl3tfsluTA7O6YAY>U
zaoq~Kz(Z}Mv2deuR~a)b+lsRT<6$!&28+7vzpY$m;Wrnwa|5Y3S764~Z$j3l6N<;L
z!@7=`%f{KDwQcc<Qa5^p{kl3vTB4;ksbda|k+y5;_39kho(nO$e?<R?FF1@H54kuW
z5_08<_6ZZ|IMLe5;SxQc;GCeB)1iIcP2-csa9F|ha!C)}%g&|o363=TySS%0?zX=j
zWThK5_zTq0(oE}MU}R?$C*QF*Smi&V`2B+r@9tbxE<1lsVNvKqo;jgBzH!7>9ljaG
zNb`=&v=*b5KiWZiHG!7W+mij5@XVMOoLk+sI{9zv8!ac>8RiLiVdy(OzDHHl(x<Es
zPGZFdA5&sC;GVG&Ck>DuENQz46S$)@5e@$)VFZ4%v~Rgk+fMeku=c{Hi)%OKM<TD@
zIJWP;JHTr~@*6PvvOJ#~{;?StiP;TLfhn`|i}DC!7ipcwZvPGR1S_RW_Txc-eKt0*
zY|xB(^!$i-;Ec207-*B)e7{hZZp3#O<i!HccingVY8q$gCgY1+1nhY{Qe(8cGm7}q
zzg;zPww4mi%+2sQd>R~+<LHg7Es<zstssv={s)NPf5mn7w05@D9Sd*L{DMSTy>ZTC
zAD-JAjlD^~U1e?_JacfF)kiHunZd7o17Rb|z;5$Ur@7qp$s%7ao(-qz$wC+#wY&cY
z-N*fbsRf9brZyn2?<M%#W8wAivG>7Q93RqWk<RdZ7ozWId?D3zQm3c>51P);`=hG2
zZ0rV3Ra_>D^Y4@2m18Bpg@HzU=ncp=*xiL@P~xo|a$Z)FUPa&;`QWoDdg(y7@zF7!
zFO;wS(eRiA88Z8tcNlqrvFSVRuo~-~l3t#rS%``-hDbaOrKz77TAmY7R~YMc-Q*!b
z9v*4Nh`$0oo8989?Z1VGym%e_K7%|LL!T(=3yGEMetKn-iwQE0E1`U8t|C108qSm5
z?PImbxLBCSzWO6r+SKsh;%r?Ewn`EBIUZuh*rc!U<uf&0t0D>jyU-sK6hEfvrvCvy
z^vu#&iVMVSyK%n_m-lD55x+_i>A2^54s`R6M#C+zXD^5K__u*u%Ww7EHWOovMRBIb
z&qWtU>Dd?UyiUf4JbW#46@HT4JHx}*N5ju1kcYh{^}q1-*vid{hSwybRa(tO(JC8-
zuxK%~?#mHBBpH<pZ9O+*bRWcSnn7&ug6<$2ZhIH!JM0T_M$lHh&>;7XQd`_OPa66L
zEKh+=xRv^#`m5BEXOPcEg+_<x#}H~xq0a@_iwTV*JeNZD`=NcWW&%Z?3!x&<4@-;i
z6%Kl8!xBI2N)2F6p<N?}*v7*;r<WJU9gQ~hr7z}FYiW%R-bo%(;>MnamVtQlFzn2*
z=f~)3@PwBBHnG^^loq-hqu0Py_rz(xK1eVZD)d(Z%vkzeN%aEo4*p*Xe4nH^r#_!l
z;-NVIFZx`dpYts4TX5~fwHw!;aUI6B57(Qxgl3b+gjskuMrV8nqQQ1!*FxLcjI>p~
ziujRe`19EN!0b(tA4A7bCxP!rF=aY=3gUSD_>cwG=$XuB{zbA`C)f7ISpWC@zekg6
z6wNm`!~TG^iFXL{_ljt<!RkuaQk~4cp)_w)JdVs#&Q9Ydv!v|P+=!uP3h<Q*YH6i5
zt9R7*@kJ$$zqvH`!u<S?o1RcSqP?^~&UZY9?+q}M(*j!nfw#*+-g@2oS*JQ1O^|EL
zB7D)+z}V8mh=*2MQImWWqNV5O{{+PjD2PX;ax}A<%5JjBgl{EyL;^b@{Wg!ekp-mb
zk>q%id&U>AV@s2`O~e9y4YRryz7}1bZWAwWSCcTfokj4&>gv?6uNOjLWB~Srv_8Ir
zw1QX!`Mx&@p%LH#g)on0t9E#K&rq!^Ga{A>vO_tk5KB?%ar~BO^&HLrZnwlLpj}C8
z_e8sX2yOeWpW3E1lda#_+j@HsZT+Ws8aK{ulWo#nWIH`ARX~Q2q0C`2jJ+_PIHg;1
zR~?q~vgW;iCztAP8j|{Q(;%|UUE!YU_PR;IT{(-V6!7D6^7*_}lJl!6C2!?rKRAVm
zQ>QrJ;>S;$%AEg;>+{dZw#RO@Nh5GRg&!wP4SqHo*JHObZ-MI`vt0i2foBM@801TB
zG>$%3TF~^8i#y*GS*x8Sn4{R7OtBSb31;+RY;zPVfe)JD@bw(QiSKhxFgH(c;s+Y_
z|7hY*G85)17LgPo=B)Uxrj?Ccr{Bd)L>-Zc))stor^B6@-DGaPO<>?V&X#&Yw8aHY
zdtBtax%F1G<kVX0Mm{s~wx&!ybBf@UEg(2=RjiH|UAoiM)_mn-%qt`-gRei3jx`Ly
zX$kU4&9qw;ex&>IZJf#biJ?0L$yeUoFj(5vqs;M3c5pmmVATTHJXptYEf#3EdbHyS
zGv7o;43*w!<2wiID_qjmY5h4YXS_T(WwbP}?N}#C$wJL)#8{JzaZUEmvi3v1cRZ>8
zd#9M1DeZR+_@tUJwORYQjwe!<4;s6l8On7$WgsKwo*j$4C-p_rFO>K5o#38z>Wx&F
z*zilmMo1*3)9A(tJv&n@MpCbw4Q1`8XUI{5;AFCTGL#Wno0zY>KlyfLR0D;ymSr5b
zDgMc((jy%lHx~LgvF@Cj-PT81pu9iArHpbgJ6%mXTwk4Anfoi(a9Fv21(~{BrFEa+
zhD*0A{t>@KefQ;eR!+m+BQcZJ@I7ilQ(b86ej>it$)qy0eIwVgKJ_$wm-!O)ywvs(
zhY!8q2kYHQSkwxoZPTa+G*hBqIry%vra4P`MvJ%0rO^&`3}U=-N@XXti_oa3b1GZU
z?6gYMc6>_9AFj!gk5uY8mz&9u@<B_R*5m9Uqa)|!)=7Cbd?SbM{I}kDjtq@(SGhZW
z2r00)2lG8`&kxL!rd)lB(Mk6WqVkf6E=oV03?b)~)+4#7%QP*Zwa*b2b*tv(x~t}V
z7piFvwDULelCHyzLlV}?9j>&~<1Al6x5+qd^NAQ!h3_jLU32NaAbZ*e3)afx*voU7
z;%`Ik_-zllec97ADC2lZ-{ICn!`I;Co?f8A$v-_@+N(kOH@wk+M<H7)DdcU__WrjP
z7O+<U`&_6Kzvt0M8ljvHJk_bm8fy5sN<H|=ULlUJ4K^~H`S0Qfi}TD!>HXCy|M&O1
zrW}eq2JUufrwz7Ahk95?X6Inu)5dk)%zrkJ-qUqU`g~{J?0TrFuq{h6NKYd^UJZX6
zw@TFRPQTChMh`1CbsWzqzkHk<{PE6QL&uXmu^fY~@z1XGPlV0_fzmUj`|Jc$m>zJU
z9!?^-;lF8vc9AAVxGP4t)k`A!&Tm5WjDn;2X~ahxB}Vh|J_8L1v5BaEC{A!zhACJ~
zNMTl+*L57TO+A=6D^Z>yK`-8|m-+yD7RtUJKa2AZ+#!C*(T-AcR#X=yO}Z$5FC<0@
ze^X(EDA+xu&@y*|I=4-m*J$@~mj%x5O~&v&3M(c(P4PYA_w*NN^i48Kk}153co=2F
zZmjQ)W}He8wOPn9AEWoBQ~vMo&MA)8mGJcT$9NIV#p1h|n=lhj#1|uu_x+YE*nvHe
zN;h-vtJ5+Mcen@lIZHJo8reG`&g@8j@pibzW3MBMfu8tb3UIy+QA`SAU~yJZ;wSJW
zY-hgV50djr@J7hT<z3RHsBZEGms8<ysgSyZmVw6=@hIiZ&8l}1-63ymppo(dyvR5U
z851l5q~CWj*pLyQLBC8`rO~4r{x4O4_lt7)XEBE)!25F?dqoRqmB!YaX6s7tZ!v1$
zdQ`&$pzrdZ8S&17x4RPboPM$_a}%QX>DNNrHUCSgV5MhZug3mS#nqas`P#B-UG1~g
z`r1@!twe_XquNkg1>deuf@k1ida7dr`lFL>)x1Q-s;!!<tw624sCBVgS9-mye!Lnk
zpe0L_B?qatDpFff#nkStVo_ROt1G>z!KUvK+3+w2*e10CrS?|ssb*>~q8z`eqWUYe
zfY>41sBBvm?Mo8gwZuh~w4q!@HCt<|(%0UYz4xd0*Wp<bwraGBQhQPABJC?mj>^6G
zA0=@jC{clOdugj0G+GX0sv4I|Pybg*HuN;vt`gsik{7Fijqw%0*j|*o_*1!xpUQn5
zAD4^M+$YDi2-aJ*8JZnq3eyl>mV|Q>@8!_-rwxg5*~&@nT<+tCF)uRw_i6Bw)3_0)
z&VcimOaXnOU!O3@AK=@QRZ^cG{t;m_rI4D$1dVGuqosoinwSy#^AkZGlum>g^|uT4
z0={O5DAJfkEB8sXuu-VDOJlSZ;&_aid@;oNYMSxQAH5Dd%?GGNp#D-lsHYGqT}*1^
zHQnM4Xa#PZ$e)TkT}v{gm#`A$fM@$j`6#&+upN^2B|z}i(?_h3NVJc~&}T~5ZHT=v
z<NjY!#%7VS>&#fYejUYHrG1;?t*8SLd}gih`=S=~o$NeoNI9A8_d6&zT&rEDeiIUQ
zo--KmhC*%D-elLo4qur28I2L5ZCYVzqxV1IZFW6vbv<_C{8@8-kv8&^adUn4J^>}t
z;=xdr21!623UNK^;4M-sv^v?nb>55vl2+$x?6|gm?CLRl2Li@{xTA$~SRvB$qD-Ma
zKy~2j>&W@HY9M>AuQs_civ1+#@-h7P2erD+$65QpWX?&IN*1acQ@Cw0N8@!!)SCC3
z))LKzwF8pd`p3!AHYuxz-;W4-39%-?4~;YW5*h$#0JXn~PLi(c1s`eYq%QFHs14tb
zoPyHu`|ieGNKHP|)#Dwc#{d$wM!ls@l8pPNV+)GY4X8ucMp%KgI)0VLEzt2c;f)bH
zZJOST+O!n)OYcJMzWb(VYtqKv7HJF5qb6HVOKgeut*3QqU!T<4r5-0W>{pHTwC6N`
zrB>5e??L)O^)~pVC~fbE<Z5;zYR_BOkR>7Z+&>i&`Tc+mx_a7yjpY2#S6!L}qfr5F
zaLxp6h4E<VB*tA)JFt<|p4=!+qg>SRH008_7Md<m?UJ=OJqBqSfllS_2-S`JBz^{?
zJcUm4MJ+!GG4p58v(SHPk;F;th{o?vQLVYL0Xi}>=|z6i<{q*!yKaUy^TQ+Mm!IZz
z_@W2b@wD+)sStP>96<?@ez|I`Kgm)3Bj(q#>r14xPQQTjX^}!$RUk<tHpI$N`u!GP
z6nS|LeJTV!*G;3TWMuxiNNdlxbJ&|kHj$AP=lPujeRNOD=*`eyr2*f&MSAa#939P>
znoXal_Os*E0$ro|P9EoW-%Q*knfGPaQ=a(~B6uj}&^g<Vh;VKP+CsV(=`v})mcA6H
zWp2~bPa)q1OwuxIBE?AI4A}p}*tY;iRh;|JIcHzlgk<voLxOO!n?N2smhcdP%4Rn#
zd8px`RlwFwHt22w62Yq1+Opv#qTU9g77}gISPP_u1kAmrT$%t{t=_h~kW>O%qf}NB
zwHvaqo9F(2-#MEY)O!D7_RN_xk8i%2`R1FM?_p(-xEqg=pgAl`b9Prhzpnsu5ms~h
z_<hP+@lYb9;A;D3OPqZyW~&P8^Ig#KSJh~$ABS}$#XeZOAX_=tAB_Ny&8fSs$r`jo
z-JPSGW7Tx$#I8Xt*f(N_yJlFuU$u`tABoX|-3K7~V3_;CPr!>OSV@vF>M*rIafsg|
zpq9=7l-j#CBH=LKy^Xi;;-2T`Bp+kdD}#B{$x=WrmyQx}p7MA;%Rffp=&;QmNfwjz
zev4*&$v^YkhRN1BFTc>o4rsp8C2d3BB}PQoufW=_`Kl`OFF{?E5_HiQOmBn`V8h8T
z_-AMr)6~bi5+$xt1FkW*cUgk6CsjSdF--)`5vneGvaHdVuQWrRCTM+A>rD})8zXeP
zSWN$}URKS$uspbHI-M3wILHj4z#oTKSSO(W-o%;lpFDudIF;HbEGk$PG%Xe&=^0;f
zE6!9|mfe#gQG%C)LanNLkyRz_IH<?CKI%z%y!!{oe(?ui=;L(R`z9QQW?LWHV7wsn
zyZl+*YDoU#oTqQ<Vf$pNk?ErkT7tIe6ArBe{D*>cQ?5Eh<$HpOz)T{rl_lj_+aC?P
zN+Vwv4Mk&(TZFMkX-~kWdo;>*N;NlhpNd%$SbH?PHu~_ri8%l4<HWnXv@YeLju&x<
zT;nOk`O<6PGl|zkA6c*mgJhl#JlRd4D3EanW{N#Tv57V<>YF1`JEF8{eMBj#r;UAD
zz>rO;`*7l~S%^6@2RUxJ87E<Vi$D`;M*_;}3I#3!LllzfI(BS>2Ka@U(>_8~p6buB
zR!USNFL=pm>H72LOT{B=%V3b`qFm>fC}$+>9poh(&`STw;2gw<R}-YyhQsZH@ic3;
z<w#{G1>0!Pp0gY0IkXFsb#GL@n$WD9Nz0OUK^P4#9%J#8RI6O#u`#RHZ-Ug0MUa!+
z&dXnaGAL=`NV-1Q$-3x%|7qYd2X#z_RKgCNhmxhuY*0<Y;PXKlR>JJhgVYAX;nRrC
z4Aa%k!CP(~!Sc@lhm18DleYl_gxT~kX6H-q@+$meU||HqE0B+L14h#6ztICpQV%R0
z?SVh_<$(Vs*~_OwnjRNUjP42=M03}Bn{x3S>5KUiZsoq1h7w2Cz?4B63j`VLa{`JH
z{6`1*!;63m;>lwM&C-Y%hUM#gz%?A0ja8eZc4ma)q?L_&X*jSf^p2M+l<h;%_+)t%
z%NoEV(sK~!lhlJs>%N8<aBillJa&O^$h%8k+FkPI-eqw)(i$fA8IRK%Mzs1DL%v2z
z2jOGddvaygKkG=k%NKecvlVLv!d+6B)*DT|BazNShGD;f6B7x#O76Dzuwx6-2wDb<
z7k!)!y<J5++t;D3HZsRS*)&Sfw*}g>IurUxhg+qD1H%C~_L|wCI>We&oKSygB33w-
zjXK`~<zI=hLTgw?-$YOyrPbaz6)TTRD8PxzuEj!iqBR9`su?uM*Vxp*qi5>j{0JVW
zQYA!>v*V7jy(>W9CZGpMJ9GkQ6t!$ym@4ZKwhR+xG(}96@XT7|Jtj-t+s7@pAA8xX
z`H*!lWw7ZXQ9pi8WQ7qnJR)<sxj(A-LYgysF|wf#g?&2mh~v6<DWk19lN>199@68~
z=66OX`gGs2w%|c%p;Bnk<39?fizKC}Xve68SB7C2P$F!Xfm#m-=1Ad8YegcB0G)(m
z>f3RT??Dgj#U9a#HARix=y2c?By(LSR6Pm}S3^5~SWUr>KMAtvCab!8D>odt3GZ>B
zSp30pJ?R>fuKhb;$_CXl0haQ~YmX(VRPC@{;xCPWB%xFrfB4>@LAMg)yTFuy5f5pU
zR3BEtD4a^|K`Wt~ig5%v*I_^{VqCC8iQ}-U3<s`2^Th#d|29PDR25CfFbWbz$H2aZ
zv%2VT-nQXyjm}sq^NArH*1AOSy;^V<smzJEh7gyowDx*N#_T+39ev@J$0uQ|hTzc2
z<Fg_>KC7U6b5R<TyRmwI6wIrNhF<ADt0^_2Cso@FxNz<=W@fAahK6zXv%C?KSx@tj
z#Ffw8GY6qrxcD+gxU5si!6y!Sqi9b<wKcg0?Q@;GqF6V{np}$&S)JE{6<N*nm<7g4
z>u&4J+-1GXZUT<1Db77+c6BFsHPI?m!w%E1-pNuL@6tPGTRGST8xA}>EY#*(lcc%6
zb9fE*hZI{mEUy>Cfu9c(?W4GZlAii7tUKtPoK%Kr)#lE|m$ETsl#Z5h|7aQajh3-<
z_yki_|CCc!zuUbmo=)qNkHNlnud3Q)5UOv=EzgzCQVnvQYCybUSahmuv9jkTSs`K8
z%}4Dr$3v=}<5wQ*c0<l#(X%+)QPftO|Mj7=cHh#3i^;WIby6*>2FC}UhE~~a1FlBS
zkO=8-;$s@_QU>`}F1x~ePf%Q}s);u(!}F3?T_v~k(;+=-JU#|T{m^QWzXf2GQx2t|
z&D<iPT3!2Fk4Neo;;aT5CRumBOk4)7T<B|+L<LoJ%B+Ir_B~epVP-G~GmTGx$Jx!R
zt>$3sVsr4oVsKtb;8aA;x&|Y{1^xM50=+A$*PzwAghXp|BDl4M!|)%If_0G-3y^O8
z5QSDAd<C=ifuS5L#U%{VNf51aS(PjC9yQ2U(c4tqYo<nKTMG`|i$1gBJiz3eT$ycM
zDZSr@cV(5yH@-6IciN+Kz%SD-;m#mmyA044fQEqs0{1f<_-KfBFl(`%u@{E}xr5`b
zwLL*^1=vwh%p$BT%dKk;4P*bWsMU505yUs;AtxII*C$N0W*?-n*f;Re6=C+mgR231
z??Beg)VdYc?88)VYp@V>c;TV!gABSOcl4ozObga6`lbkGVP#&98ixbTgM5t&8f5Cd
zv#o2Oll+$}noLNM56s5uNfLm+9az5f&6efXDgCa#h@Q~wh+~j?+%p{5Ga&3&PmVi?
zQ^skqqK7?pLJM?MMOD4pVg{X`rqd($!2w0>xSoUBiMh*B*DC|^iumIJWv#(>sE3cx
z*T=w@fly611ye744dXDhtc88FV_SiI4-N|Zv%%YAt`U#yrk%)eAbv;#E6Hn*6&y-Z
z6}I!W@(JxvN4agv-5z|cLfE&$`sT8HaDKyq`2+dZuc4kb3bopzswbFZkDGzp;lS;H
zd*Q)}xmdlStwSYItYHukE(9!x%~*kBf<g^@VU>hq$jktzW{FE14h#$cQ@2vf_IiaH
z+|n?j$z~J3PiNt)xJ9pf6Rn4FQ+d$K?|a=l4>Cs#f9k?S2ZR0g23Y=8xz7b%Oy_r1
zK(83SMkKpA70i?YJ3Yn|yuY=C>;of>NU|(v@Jy2IX1A6=I&f2xO)Q9WWTzBZrsN+R
z=();euXg4uS-ZY@t@B=`&_=a!3;kXJPw*nR8J^-9TPDfLP?=pflo=T=Q#+>2zqhl@
zHaE90=+y%z<SR+C{f%U%0P8{UIwo@r1MCnS`@j9&;Rb7gHW&1$5bO4mJ?3p)u!afE
zedxuoDNP(~A&iqG!(kJF!3KhkRSSm&!~7IQp2D|fK$cvPEFccBmM<<vh_I#jtvs-m
zAW}X>IG_DH^7(MWEXg0G@~M+@W3ig4`E3on|L2={SQp~Q@kd_k;dxl8V4EtETQVO%
zRxz$e%V5og#WyD5_WU?@51~1%IveLXGIYjpEecr5@SP;sG))76iO?T~qy>Xzf9w0l
zo|5#tPlXb3UwbM=<@-|~={{B=Ey=ok9L%kvJKG}vi;q5aj85idu00bq<UwNW_`rhZ
ztjD><b!M%{@wjY%9X9j>C;GYDu6Sa^Yu+g$WVIx`!2X3u`r_wCtqO?-tt7QZ(rGV>
z;Nk(r`zgvim2Vs5hP|P~>74s7Dc8NSMmoX7r32~?ZC)RAK}}tiv41}HKJraRz78qh
zgUI*3l<y+)X{7sK%2(0!A<jifLQYKK4^F^|<3Ip53J@k+cqB1r>9V4<-=H)lO6yLU
z3@A)}afkGXc|t1js}#RC8ME<3FtIQ(zZ#PN4Rb=7i7gXhZ%3oI%^nWC5hU9?qJB7V
z6#Ef5bT~+@OFqaU_O)R0L3mU|=+{Bw?5VT{+(nP;Dd4mR2LeOE`@qK#yrk#QfN}i4
zuxCnlO}ha-XLX8X+oTDazeWBX4^IMw{|a&vgc*R4cbl$`i|vIKKZP*``t7ExF|l9Z
zO=&!gw<7<phd=X<>rn}r;HszIppm|_QCk>UfEMYrg`m?Ji7l{<4!M2UcnRqsVgAg+
z?|Nn3*-_ZS@KrSZ9VZgmK3*VgYe_fSJsZ7q2P_Gwbva#Ifzv`@aIFOM@rSbj^9w=k
zp-ja6ZCHlcDZ!i}L20^L4w%RFWD9ygx$*`m$3vcc2$rJ9^<;8#cw*ti8~VXETLU{x
zL)eSR5|0$_3dI8B6#6Vg=b03`4($tBQk{dIf||*@J+jG3t!;g{-upxJ1IZkWwl~}t
z#8*dCd%1sNcS`&r@6Jbi+xuu_KOQQDg)>b`%E9M?ym0{fHwM&J2bfb1QRubMl0wtB
zAf_+Blpy9g3hxOm0K^n}He|1j&-$w;0_Se@UK5&UjXjL}ov3t&Q}W@cnYV6f5;Q4A
zeZ-+yjOG19l&&n4Ryg%L>#?KdoCM2{5t=QPx_V6At3ngQb>E4)3$v;`6T@}i7fMf=
zh#LMml-u=Gf@p|^O)&v#$<GA^6HeH07gyvz{IE7p>H7_I)FY(6E%Mhte9c=b?Ga=d
zim~IGa0|U_>tT$ALgZKEnXWz)tMu)VEZ$-Mhw0D)>?25b>q_W=ITrUI8P+q%aXWID
zuGYpXQR8~l=pK?s)622fybI(x)D)NZbc51&Pe^Rkp^suDn~(j0qoHW%jWxjXb&Q+S
zJFR4M;*Mdu|56?7hh<8!nILHbB&JY=>?K#Chj)=25yrjl6#klS%G-sqGhkIh)7TgI
zI5<fU4c#gZ{z7jGIjxgX<}aWzHU-aThD7OxZW(T5T`7wZ^A+@yO;`UCs{-uNfPIq$
zdy(G@Y{~kVgqw<{wRu&jBLF!!v2it8a76M~cMn0Y3uTym2V8gG(Fy%qrSGF*Xr1)9
zSbrcByGXfBmmmqu8RHx8K+YXORlV?j`UB1f9MA&k4-kw=faC{59P~s(fmMKwG*)$p
zduK?TN^d4E7H_TKn`w`x^wkeLC3_SGv?~!`rr;TeXEL7gc-}NbJD`5->9Sy3HR#T;
zP82tw>`1hq;y=PJge;Q?lIANxy>)o1)prc~=kr5>;9&I3peH4-ALko<3V8$*LVOCr
z7=mp&f@=UzsxL51dRVx59M+|EQtr8-z?Z|((}NyO3iYLTm@JkjBUAzm=+V#PJT9!r
zqET~*8Imz#Q;g41eBh6Rbi1j_8wzyv^?3>BBYjM?m*)TPK!0^jyBoNw$>^(W_}mC$
z98StJ0f*y2Et2wrfe%7Sw<qOyLd#$2>p@$2jG_mJ`9m>);5o=8C*b+?AXhtH6o6su
zX%IdzSLiYEq_3NcKl0HSftK$bIGsYdb`Bd-DA(3uEhIAuuH_hW1P{SQ_K4|}Sv&b{
z>{R&+ae(245bOl(9SUr~ZF2_nyN3b~4UH>|zJUe^2QmI;4+S1WUyB$8L(mzN?FkG8
zW)CgJ{`<x`O7>(lc~RhaKZO2cCwh;Uc9WNILcqHP)Vd}FyPGXbH_P@}Nd`S454&OL
zaGgPpcgQktiXi2IFST$U6Yi*VCr9$=nm(6qFy;fh+i>%|&XabCq`yvu(hkua`f^~#
zA(}&1223gQfY%d4^aQ;bxSQHIXws)0q7dW)_4B0ACRpC1m^TJtsjYe`IJI%GHZl-s
zgB1aqbt`j{QP--WevF8C<I=+>!?>P!?jY(|0*#;F4-gf>idWq29e-GPC^nDeJE^<{
zsA0TRat=a2kV1<GZ<d}vAB++C{WsT>tofsZWS3a9I?zh;Vj%NUZuD72(^;JRjEDV7
zlG%e@eykYx<7SmS0gyf3cbj8T&$B3fHuSfKFm`0B4tqTaaiH%*7(1~CmHC;Fcz+(D
zA?SvR)|D8;G$yL>=W9y7Gr4Gv<AnL?hMDf9!X(N2-;H)X$f~A`C##wQq(R4e|I_6e
z;Qy~L;ONVx8)RrYD18lsoT1kS>#l{j*f!e)_yZ*y;6ca@lfFOkl<Z#UVnDv~O|rcX
ze_d}bX<#%~eUK4>lt(BA_<jLW`ZRY6he0E8UQBdy+n}~cduQYwzXUDrJQjkt*g4qo
zFi>Qg(FKFi(|e%(?z@2>qIUY4o|4AQggkDq(&vD^pCC@L5{i^nB%=&_$0jN<_RiQl
zlr`Lb#a`Q_k+R7a>+1tTZL%_|ozmcI4L^6}t2i4_;2v829d*)K<uKK%!}!L{M`5TG
zt;$5J7Bq6T$vA=fIjwR}1tBvH@77t@-NL?)gO9*d*&}=KSE)KY5fm$RIQsXqtW&Ku
zsQXqc)msP~iN0e@PZV(VK=e#CtR(yk`q_UQWYEeC%`fszihvb9O#yB*h=zWFoh*5!
zohnh<zYiQRadV@mFY97zP;X_or$1mCWcx_6SLr)906$-itoGw|n<hEkto9LZvTc05
zLZ7@^Sv^jgWn24LEi9@mXEiUoP6j6!&$+r4@$FGFqd!z!8{AAboL++_q9*&bYpsur
z*cPY*t>S7I9lxz}mNKP1a%S*Dwx3d$=hj_wZ_>=JyVkmSB_!u_@K=Mh^o`ZXWwmZj
zM_COwlyx5de$O<YY)n^ZAwk#=|13@LL!<DF!x)<{$?iK9Lfc`bq8-vnef_Y{6ZF<A
zxHe8)>SZ;w<B7NR!_L7EB>GLhVn=uk8Y{Y{SHY)ohMV*F!+Z+)ysA1*esAi`Ge11p
z7iBz&Jsr!MbOAeF(>OOcb*!LY!X}j3Sl!qk(Dds7Mei`#itZ0^{YY&j-#iMB7V%yw
zp5oRhxc2@)lk~k-$pO+cK|SU_YiYuqAee}6d>*SvC@^z44<lzBB&z9TXO|13$1yHT
zab5+i*6!+1DB7VTsF(tMI6;a@QeJQ4YWHu@Wn4Y~(T1CkvlOz@q1dDJUFs+4`1wWi
z?@Y6DHJst>hI&&x><e@AqGw$9h}Hy&@7jm4#`HAS7U5P&ap-f5@t69)0M<VazUG=*
zH0@5I2jbAUV{6B{R115mu>4o6&|gF-+9(`~2X%TVNTqQ5MoMAuW*J5NE<6p??h^d1
ztLmC5l&n0{&h3vcToFu<1dp;@R}fvu8$-|~jkmU9l!M;&AM<kisk9YAO(ci4S%xbU
z-*M*Ne-XNon-mA6z8qQWs6T1`{r;NnXZvwFME4aR1#Md)r8z{q-~K=XdMwhos+s(+
zDLth9I1XuPKK2J5>f@~YYt(4P5=qzgU!DntG4BgU-mv}-y4Y;`bZAn(*%C81If_mr
zV-BXq`ZvQj3M?6}u*Mu@zUh7JMKw-$^QE^%eN@L^-SlN*A1rv_TMoYbVlVT}=sWEt
z8f=9Bhbce9EwKT5z<XfJZ0NOp{ejcL*J>42$&b%zOr!qqPj7s!29{kb#v!foWL=G7
zKUs<W5+~JHJ(B@p#P6qD)o-N&y5uNBg$gtUP|it??cV%q?TN;lQGZA9)%~KLLKlJ&
z^{jgQp_>nmgBCgSeGXsb<FQ))sZZDZT5V#*|9UCaDV!Ur_fzP!lwPP&?jKiA@9yA<
z@H!>0AvuNZ4g1ZYblel5MeT#P0pd6MX#HG_aWDH5h{x(PzmEX|3f<BtTQZ{X?7q2$
zb8p~0T(kMZ^kt#6;~s{b$l<hKO<g=qzJbR1Cr;5#S8raCih6b;4R(0A8#o&J3OddI
z4DW0wulSdDZOU&%y7kf_wPA(VtHs`T7`BFG&OdF%Kd{>!*+))Y@qw57!FdnW`>C|Y
z&gA6q2+SV^wT0Smz{zST&E??TSOdrw%{O^M2J4VCiwg%M0Ba^}6a@pH^h0V^Pn>6F
zPym<B)siKENNMLl`2`1PXO>{o{h?x6k)MMMyV9p@CK+}m$*}Y3xe4GL+k)*urq|~l
z!>QQY2=V7Q;QCO%EW?iRZ`lRONu<~BXxMH3C}^yLWuUY7BF!)R@4e&R+q=j!N_JOi
z7g>AHCQUTGr01)*>B-BQUT>S`nC5rgGR^mM^)g?sdYX+tNcXc1p-wxUg8VLYKzbew
z*`()dAyIlB2z3_I_m@Hkr02enO?o~b5{v2d6rN=v)e{ArJQM0HA<IHfg$_v1ZIDu=
z_bnl@#EA351~utcCfQ!|Z1lyzn<nE`Jvv28^1_K*%~=<<xL=wLJS-2&I5Hx<DcDUq
zFLSy}yGiF|4*96*CS8^}-6h?m%R<lf(zBGT@cOpB6`Wr6RxllZsrVDCPJ8bP>ZaG&
z?g~apzZ&URf!{R_$zvSsgu4LK1xGH@(QlOWtC4;c({*!?%68aD@06*Q-_kVcj`|H3
z7%Wo3Mn}mIonab0uIcF=2d2YMrO1inC7<3gf?y#Jj-;WTm_%Nr$VyoK1`B-p)UT`G
zAmAz6ATkZrZ!k!)=e=8|tIogHQz4Kq0cdlJ@Qf<{-7DE85_wawDf@N<yufjS!3Nta
zpk@X~t=a;u-x&o4pATNdZTP|rb+*jHB>W{hhGBJ@>@+O(;6#5Y=jyIoRFHdyosSr!
z2cx4f-b5u0460C4yf1xKmgf?@9%8ht{M2SB*2ANZYo)%}UR)xDN{W$38cB7<wC);8
z$d9-s>^WT7Nw#-P$$a|p4gnN6coH_T23^T-n&0lYj(Pkp!hHIB9X>CY_Aj|j5kFvb
zR{J~rh5W-^6-{xs!*3DVM}CWTHV6p8|61(?D^EH}@O{J?##t5B9CmSJDNd+XRtE!d
zgLUwkG;FbSsrXFGt2Pz5VVnb_zx0JQjt)m0tePm@QJLf6>t5ivj6}~w$IW>W>bqOc
z1)tYVbe!rHQt%hMJea}?jz?uixapKyk*SA1bV6Ptyob>#`2`0&!18?Ncy~;`kO|FN
zYX|&gp6*rY&6e|y*4`W&mBAUg*(OFO-^T`gzKUhaylz;&m(I`u&y&O-$34MFZ<)?k
zvAb&K#ATh&-!3>_cX%BaRVrVUN(~*JpR`YIjGB3uhnuw$z8CkwdQ3fh6@3m5j_G9+
z)jw<@yhG<ZLO`$YGiP*=2Sb*A9%(H;4aR`Mky%C~BHm)K*&SU@gMSO~!yD{2l7p*r
z{6_(-UBsV*>^+nLO^-rG0Dl-QLEKB+;+9Wwzb=bP624Uun|U5<!(*to&0Xsy_!a`b
zk<sZHaA8c<sM9ez|1X%b9Ou<D;NNh+x*WfWu%~p;mE~BC=U?&swTkuJQdtk{IVRta
zDw%i`W9e1Nk077^mkt58APwk$c}~12)mp1=$K0$6r@7wog;z6Ea7WG5c!XIh;HXA;
zx1DTLz3o}zEr&*=Yl)692WmpI;SsqE;lJ93Vda(l6_%!7?|9F9{Mvz83OSv@V7u&<
z=0Y}6S9wmbtWM0byQSRwgkJ)JqS4&-UWEjK&cn}&Mj5N&8KD~xEb)hq*d3WpdHnKr
zyY1)RZpTj>C1^GiG&2U&z~dTaH=vm|(25xp=-5szhW;*nzghaeR=MR`$<g7!1S!S!
zj?L2iD#dsknP273+D2)%0#k2c^x#GhIVq+_z2sUR@&=(1&!=DOxZ5j@uF-T~^vmgL
z)myI3MY?~6)8%;UHhj!7+Tb$`)T@qshJ|SwJY{HJDq7??ue`av9zI;NJd$TJsl+PO
ze5N0i=vFGV3bmWtiKANL*B-5t=wRJCg}2DZG#_~vQJ-vHgjOEzue2_5bSOUn7GCQo
z|DZhjgn5-&s&Lr~w5rPZ9$>G67C*=1O_ak5Da^7?qjz?Wskv5t8h!LLv?g!q^^Oad
z$(|I2k9V|PE-xc&?Ss5BVQU{?c1l>-XWR#DH6Ixc6o;|!$IFzC#-E(-?r^&Oz}9b&
z?v8M}!<TuC-)CKy99?D5c;WV#^`4A!%wL|n^;kDICE4RF7yQF!glCQS9Kx5!5k9ps
z#?w{4QUeZ~;}$k{o8cWeb3NXDt#)qV@ow|Re2nWQ{tthTF~Tjmb{@}*Y{|7YJh7%o
zBP6PysQa(EnQfms7J%Y+mBm}i%842r#_wr+W;wSIZ}C(Qh0Lp{1}S8}1WJP5MLCzG
z=Oy&TKjEPYGzqociuQffM-=~h$3o!mgFd40?{>_+Y;f$y_lzUo&i%HOy9QsAko%9}
z+{u@z75^~`HLXVC{d~(Mv_cRrp>~6B*JfJh34%JQj9PBXwcziE122Wk==+TB{-Rtj
zbL5vJ8YjlEgCdfy%0{fnv<^RGo_8(-9(6hOVo#=H59|c}x67G-5I$>V3ipg{U4EpL
z@;D?f8eMTdMNIMSCf}Q`c(tm%j^?S~whA~C>Oe=`Sa;UmKu7Nd9mSsmby^^6(F{M%
zs5Nqw4|vA>U!FgL;@p0_0C`BP-P{rQYQ<;}xU8jkFDRITRY|7ppw9-P(R6<+r{S~a
zxh;7DtUB=4PRAw3nO>D)mE}{cK{+L@y@HO*UdcG)@c~~itabF>T2O7Ca-L1AbCgLq
zjJMPQbE-a?c`on(WvDkwINrS#Gw(kztNVgP>GGELfTEUqnf@(rX2JVj;uXNEdFmt#
zVI-jCu4!%FU1|?zHp9(CkC)HV0`_?Ld|%>Ub`-MzgGum;eyZc2-sEQLM?U5%=vBPm
zwec&jYt|P39Y>?`WsF<BkrIaHSR!pBc;DhrJ8DL~S3u!9?U8`m1U`tD&X>m0v(dHm
zjkgrEo<h#eLF+8hJ0*O+)B-=e;oN<S0v%dPs~o;!4Spm{6GzgV{+={T41#SY_|_Fd
z0sPn;(3{~Ck_T<sTD%5WSL;s~(>sjj!rKfF{^T@xN^k@veDOI@pOxzQ?MnSt8@LR3
zz~Xo_V)w}*q>uBtwm@z{&*`_8$h^gAJWuxuaa=ZU4|5jMGiN3B>}fe%LSer2qT^!p
zHaqP5!Yi&Tn{Mh|*+-$zUM0q%CUBej)7Z~Zdt=ZBcu1AF7qg9?K7K1b{hcMJZMBYz
zpe>ztp;&;t9L<qPn~W#IIgfc`f!Ce*a2&osCs}#>CFe!yG$ue+o;Mpx=$wP<0x!Jr
z2L&3>Sy&7de4T<VYlf%ry30s6{jU2n<#^O~{F-UYRX6E{-{;XebUs$`BexqK<Xy(q
zcuHg0*a-f~<2Z+Qp6XSlC_U$-5th&rYfu~VEDZy_;I2$rAG_<Dr4nq5-8v_gu)rPf
z)H!M9aC6AtZ@lwjbZf6l{HG`0`H|O!^+M+uUx<{p#Fj*B#WFFA2PCd7<7G&eC%TtQ
z<s`UQeO-!gg>x0kAxK(1tDMakk-$aPDayIA-HWi)ej10trp31l&`wlZtJE=8gZonn
z^EKu&*fw&2KLS;@8*H$N4Er7Ms?E)4t9MN1%N^XJMDDTU+^nUZEax=mTFvUoS%r&C
zb1VY*wwzTNoqX0fw?Ow*pcHzH9zG_=-RTg00!y@X+RlO-!ARKX$8(QxwM}}P^`#d+
z4?;wf|BP83Jb4AWjn=MH_VM|#rbv`*D3<861Wz9{cEC|`x^{!}uoHY^F%v)YmOE1b
z%bLl!9S*}{wqHW2pAJ*0mpjfuulKCPYs9#I9g1;<)cEVGXqq*OgQ=q!SOE+a$rxBg
z7-*GhtYOBscGw!Ys49lEGH*yJ(3-G5Ipj6TE<-4#KZx{G$KW9&jEA%_c=+4D#lzDQ
z#D4-FDozgJUWMQfLYuUf1={UWi|uGJ_9oD2m*x%H0zZ?>RE`OL_JG2wcAt94l%aRW
zou7SN%*b+cQ?b%2BHB|nHewvla!)<K|2XV}Y}t%2^Q?<IZ5f=~mC@~4RPf0|G#?C@
z50RGB2(hW3c;^?KllaYZwy(V8k?Egk8%uBZz<Lti?#C5YBjyMXzxS?<fA`F@Ms#M3
z<_LI2$gsXo_V;Gwcnk$88>R9kYDwi|trtu^KdZdC=){KeEW7Q5#Gjp5cj5;A?Bn3Q
zRUJ6*A`a`%cn$@ELtCvB)1egG=biWf+*G{ZwAtjFSxI5yr3`qFx4eV5dDii;2q`k$
z^M?N5ooRhb;@H~4G>6vVA>79v=+=TyYr}4kI6T39LgMdEtTTY$*R&tY?=1I(Z7%Va
zQwZ%x?C<i$^>S<!FUPJy>~HgJ;aFohb_!x&$v+T|Z4Jl%L#1hdDZf*Wg|}R}gnfv8
zF<;yumFqW^glki3+V|w!9ty|m!?hvynfwDIv2k+j{U~8)zHOw0m2&K4#JchijKrGd
z*z+jir}>>DvDtEL2d`=WNxq13Uy`g$QS3`%jY8L6QBaH?+=UTh!g|-(!#0w4ViT;2
zNn<4b9C)x~A*TJ6jq3_A9*WK(pUGG2!rt6`2H^{|U(ddPRQC(I_WKGx`OeZ_8B^Mi
zamK$gzYTI$Xgk%rD&BIe$8|sYz^L-@DKx%naTk}^qO|HAZXu$58B%X&fE}qJ8%3}i
z_wW(zIf&mCj!z87p92k9RL~ZDRws{3Q@lLxF;AxOEhBA8hYl>A&(gT6F)#7|<p@TZ
zNFxm+at@6#3hVu*hl%SutEL$I>9$;Z^T<%()j{H8lvYYp3y%B<;`ZU}A#drmj(0B4
zv;O6BV~=a&7Jtc6PHN5EaBEgWT1>{8Z0*ZbqLnaC*1iOfgvq$oUODeQ;k*;VdG8Fz
z-ye?GhU0%I(TlZ(f^BVKhl9=-a%@RXc_rT}g;e^}c&>~jdr<0Z9)6F(vq`JE8DXx3
zI5=9@!B>RynM)`HKQnla<U1|J$@zFYeV22Y?bH@Joj4s1Vdj*|aYo)84z==I<q&4Y
z>5)(gzfMZ$H?1^}gv?t<LfNMgdPypoe;}MrZypK7ZAFN_cJim?5I73{LE=Gp)X|Ek
z41=k}jM$gNm5LwY#ATNVp25ufOeI?pOK_V?PLG6Ewqi`mr7HN=;P!Ah5#e1FHVS@I
zd@FpGS1b!{S;B>RjwQY~YVMfiX~$T=_szstFy9UraT!`^ZNH1YF`bWRl1!s1>63KF
ze}V^KM&beDKj{YNBM5xfEUd6|vBKWsp<M#cMY*#aI|?SM3tO@r?bs<3S3!I^cyb-d
zN;2Qnt@oZ6)0yv&m8s`7={KKe2!G+?7O2yc;EO}&E9D;JCbFmTNB>^rG8~%<WBsmT
zk{SERo8hRy8=D>QvXsAjb;!FL=Ns>LqHMIFt1{-i332U}F6gtjV{W2#uxaTkV!nGS
z=@!cU37tNEHuBAYxLM41OC`JdK_yvN{1Z~SX0_w{^P{crH`P-4vrO)Z=aKvV#cmBf
zH}Y=8-rwT!{SWTQP9Th0?3H*fX+r*&jB9WjGpSNZHBMo^CjlEmsIAh4G*jxNH1bY{
z`81V$*49rNdR$w6DaWJN0Lhd&#PcEdOMq^-$KNTn2~_VmXx=SuQL+g6mg~4QbANg?
zoj5~Vt~;IhF`dah%lS^PYTAETW;xRl5^mydX&eaj;N)#NXEZV57iV@J?=fN4|47Qq
zv#IF6@de4>)qgCpQ!2kA!TmXLo;n?##3$xit~kDQyxp5~w{)I2kDI-LH4OB?gY7k+
z?|)?8xXLXsY5xI!kIwUeACj0gO>xU*cFAQLFT1~T{Ha$pl^am`zH)RUEKIl<t?J=a
z4FlJGN>BF~o|ZV;zk0`FB-K3`7+K^de4O&g*f<%+MzcFpq7Ma@3}AzB@a@yb-+Bof
zw7YxNE5r4xa9eBKUpU_CRi)mJwo<Fd=6++K$NvU!xeKuDV;c);)|6kC;i5UB#vEDV
zzvl>-mEfkavbH(h@qoln-y2Rv7C!wLRWt&3z`o}e{|iTa|1%s|a55_E)^HjltZ;rR
zS>fCaE1X}#3g`6jmsY`*)h>N`z-`Lv^tNVAk-vmz_B(C`O1@W`*B+e7nYP4?e8;|m
zZTxTPd!EFZpQ7&@L!X7Qx(b-QAKZSA>HarljM$d=#~;P`^0_LO_;p9K!11dLg(El}
zbD~QYJh8L(4WTaD+a#imTLJkJ|9eLmT9|qSveGu&2qdd8+V9^^qy7FR{*6Z|MLci-
zZRa;7Sp23rNP+$G=A%fn<O_mxR=o_TG*{S^CH_@Msil{wB~vC{Mv5slpUM5W#Q%pQ
zpG%{5iN6V<ZfWEab;^OC;Ljbj@7Z)2dy@4Z^0X(ZXcBR6An!bskQ@<U(U0~XhA`)y
zB5~e{H*nsW&XLogvXPJ-`-Sk{;Ol+EM?s}EvJ>)CLE@;-h575VK~tE&PUZr*)%S;a
z>X*3%O|he}3<ds(+;m33>@l81tHC*P%0oMoc%Np>3D5#??Z1^uy^K0wg97`_(RN{f
zK<)Y^?Em9*myNVb-ckJD?Xnk->;R;8NxO}Q!|mE|L%SXrZ5QnuzO!9Y?v*3$T1D-$
zkG6~UGx0ug<JTu!)UHL}XqQk>jnfZiNwiea&Rg1BDhkeG1v2<6?3OO3I}M61(;@-!
z;F)})a2iiJPFYB+u-+%~XYj0X>LHn5Q!IbeO5e<*-$-h|rnv6f&N=Xy3tziQI2)j6
z&A0aawWE7}HfGN+oe_X1962MPcj6I8-j#swHE@j~A<<&$;$m?Nt{Z6+JjRrpeXdP4
z_L_3N^mJcg+3}XGj(E#y{P8p{Et-N=xJS#u+1ryid*cjrt423nQVsIH+s5Rx3Y<?#
zv3OS(u5s)=#^c21bgvR8H#Ls9sI55f5P;V+)Hb9cd!&P~jWQYj;JImzNwc7{^{N9d
z!dtwyR~>mRCeXgU>Rg=Cd>VdNz|BxDyj_pHi_CMwyN2z(;a$h#kza%KEd8(U;K{+j
zQtZbMnz{3A#=G!N|Bjd7AYBOhmz=L@dd8u}?nu?{hOQrHcpvACzL4hRKDD}i5A6HK
z7xM6MOp@__ZzAGi5f=@A))e=TP?z^!_2=y?)R)_F+6Mg%jaZ|kR_NGTrJ}G1zMSYy
zWR&{d&^f8@%}tZ<fZs@1ncHJdIZLuA<u<PN`QUt}n8T&xhO$Q?O!HKm)6PCrc3rJ+
ze?B<F$kO<%?ZNrWIruG(@F*5?wU=xwlk_DT*czT^Wa79^A&YY>vy{>|d-2MoS4(_e
zd}G^#bC;8aiiuXVyoD)L%O_<_1I5;5DBTGev2L8lWZZ(^jKT|!xIduxoN<3J+t%P0
zedkR61NEH#JHFK*#cA6`q!2L9Cw@<g_yS6^sx0{rmf~vsZbSNU-;<tFs|weY0gmDt
z{BAA2h+JoAHc9X^wQ4z?H!C2~w+FTt2H}_M<KTTRwUzG1Q{3l+smA$Tf{@}VpA>YX
z|A$-A|625ak4N2EHc5xLMN%9)e|IxkDFz1h0-n>2z?PV3Rd$Y);l=o*^K8N!>X&Tb
zr5~?C4zlu{-0VVn^3cr0m;&6{8@LoIZF_KrPAuu%X)8Hkk9VYDb{d5&3(X?Xm{svM
zq|u=^)@fe=dBwqSzl@AY*cd_?e3rs`;h4$iby><DxudW-3%84ckX6DNTv83wjr%(-
zWn9(-*v>VVSW3#vaPBMU-I)$&A#)~~CnA(&g67by2?$kNqFTfh9i*{X=<AZguo_7k
z`82%BjqglI`O-TnrQ2Ipc2<48oiBT$u_`!U<T4{YnPqzHcQRo=*%h2`1PmhK>(S1X
zvP%wAMv`?>hXCniNL@raZ2Qgq9(x(i&peSB+lDerma@Z8mb=JMlAHah?LGLjGnBmJ
zHI$hUW6Hkf)t6<I3E3&Iv`uwnlqBU=!)CK#J(m^bVQFdbu}P4UwYId9dM`=EIc;Bh
z>!rJ@dfdJnN~i_45N3)^m^s4(d&iqOy+)F<?izM9j<gsM+b)&U4bvq%<;V|h_bSlu
zGmQ0)PqAXavjFyzmabDmy{*ovFS%sn4EB<&GRl!vLOoV-QZaLjzwGGP8k%91a-;^q
zFx#sPmso;+zoA5jzNFpD8^myblf6mwG^<!vMI|qbE=($;J*8GUGoHd1*peOE0)uah
z#o&KJF!=Ac7<_8s8JnswYBu4Sr2R;Wd1PL=l`1&fQ!R&tjU%a~z)@q{?MMPOCXaGS
zHdR5??BE>OxQZkjyWh-5qiVjfVp(f>#j;@2WLTA)XXG#f&mZI5n)D|;T;o(&xJNH6
zCn<yHgLCn9qnjubmsW2k8k6UlU!<;u1?4EDYW;yD&3_;*&G(k_X3J8aLiq#Rn{+BG
zh`uSz)OAKUfjKavmHOauNJ|iAS-QvbJZjZ||4uDBA@%JE8*f$B;&cS*RJiqC;92OH
zT$p5@>0THf+gS*WjBS!n-!ml7XX?|NaB>+RE^~ZK%pLl&gN{!eQ(DHtQE%g=`QJ>m
zayeOUpKE;1n~-uIv*7PuKJ6*5khWt?f5kVsQe}IhWb=@uszZTm@Mh0OV{N0c(mY<S
zz^U|?$8Pg*Gl0n%i-E}`+>xO+j3wZaap~D^dY{YCdZtMS1{r;g_k04M0Mv5tpp2i(
z;kHa_3DYbI+KcexF$1MUcr<q!9isn$DEi*Q3AM?mU`DBRGmIB;#`+HATHf{&9dkjJ
zwy}jIYLB!$NVH}-x93H`2-yb-#+86E6LgX2Orlk2u)(XrTpgETb#p18cRJ+IrQD&(
z0Hhq!=psCvK`3QNKi8O9M)F3PC7*h$Fc-O*$=KJY_z$F{_}=0sT5@~}F2iOm;gNQR
zvAhg^oZ8Bo%gZjRS^MsAjdD4sy@J6~(glf0d3D6fSglz2nU^nt<f`pYUe3^nnRIlt
zJ+)GM_O)!L_L#Um-1N_A<j&aQiD={-vzj?jt$CtOvI2+Jn7HYHUa`rISQ8*MaZ}$g
z1Ag25+pQ(zJ!uZruSUl2JZb!<*<PpdtDNeaqOx|qt^AFx^@<SBm$0cka56*3Qr4Ay
zspi^*%yH-QkH6Y16xT^37<YHUxgsbaXtSZ@kC4NRa1`4h13eoYz(OwNlDC-Vyb?F0
zToKBRbEAbdr@{N^eN!aa8lgD4k#ND#0=XnX=<t61ovVp+l-O>lPd8GZ*17}s{kOq>
zN@aKq)A%K;D<fk!AdOv$DG86;04!F<)BFe3Cz<)SW3xOtSn=lKoq9YSIGbyteka+|
zMI>W>BCa5=FxD~AJi(1$6HZKL#k=Efn3r$Eg4hm>ryb~bhR|HBITa@pQhb<aUwQe|
zfLBPpHfElY>@H>w<^h-f(G}It-#*5pH_5N;t&kGXwEhoPdfvUxp=>mSXOq&pwo{%@
zG=l<ennTjenA$+}$(HCTzVqYYvz0~%>(YP*MKjZkT`eZuUzvQlm?>|eKLt?_DnEmL
zTKrZpq4hT<MBgq<<}+0toJh1m;--v$_6k{d-g&p@xT9EFGnD8*3;M3f_Np{rW8fKy
zX6(LZnVt#YA!vU8-g{gc6US|wei5wI(A=(tpFfh^!ntgvyb>M9O7w|zgGH+c-FzRn
z$#mcnyqw-h3C_B|T_RaPYxl@&P@Mz&EJs}l*Qv;&v?YKTqmBQ%WEtZB8ZEgwOk;jC
zS~6Mnkty&}$>Y;+J=yR(DT2dDaA$|9a4bS2R2Xvf{Y0N;fC~a&CDEw=1Vx3VZ}c{w
zwo9I~So;=*`a{&u9|aR##LJDhPQlrCeAyf`{D~Ntp&k~(nHbmkW>08IFL<`%zSd;Z
zQvN*MY;<9bXPfP%b&~8_T`5T&_$tXC-VVr~4+aYRV1sh{k04iep!9+DY~~Lkn=L@{
z@~e<o{s}lTq4ubQvvfK+%e1@&Ce9){xdl00EXPLAtGluhPWiO-knNK)n<GMzQJmr6
z7Nq!tD=0n#Hlf*GF@-GO{5q6(!T>srQ|N^$P=VB1E?~ud1+&-0Yb{B(wkr{7=YpEp
zOiPOIK#taOCa6iF6`8||{Hl}B<XdX+#`86{ORyX7+6WJI2FQ#-vJ#&6pvmG7b_Ri?
zBBgZ)c^}+682Cr9Y(1Z;{;Eo=^mI9Jhp<uY(HSB>Nys$$w!8EWJ~QCqYuMhKzN%Wt
z^dhvt{_>^p1avz>AK^*z@6E0Z$H7u9!MIXuJM748);b=*n~Tr3XdzqGb|vmXJ`<2!
zYu&_Mb8WJAsZ|qfm&*jiy!9k^?cJYq*W8bD*S0^2mFU_oyj4B^P~+=m?*^IeQrUy$
z6C6`4hVrTYCljYwmUU^=H`zW6vWf@RPxDPt-)8w=q-qN;kY=#LJ<V}bv$vdE5>tBF
z;dQc^WGSufisEU8)6%vpntGb&lijy>sZ_UFtX&Zi`CS@KykqM6l|^}7k&%U6TKuV0
zQ%tv6CV*!CHORzQox4jHbf#u*@jr4@@8B{Y^WJ7T8)U7>4a%*-U!-cf|H=ETU0T(2
z-;yY6R}@-zr0l<NQuUGN0jFl>1<wSB)yE!a_fqYtR6BPQ>dfhi;BvY&+%#WB*=$Ru
zZ;3XiOUuQM)LYIn^F7c*spj;AdmfmFKH_kegV(PqktAh*0plq$6q*#@5>*}`pI|#w
zhP#jZKlBtkH5nbASooV^#cf{oakPFP)gS8y^qq$Fx1$$i_#;#^eH9N)w#@WD`D1HW
zG|JfSr55H%DI%zK_uK}H)EYxQ=EW&Uf<!he49ZR}t9-q}lL{@t1VedglQ$u&*PUwU
z^R~8zd_L%r?SNIH3DD90eF*czdT@PvP<Ludv&KNPYi?)BdPU|UNJ2em=dwSwe_H;k
zJp*^{DL&JR9G`0ijl&F^!E>+_NA7wRXdBHo-EeDjN%;%G<+|94l5$u8$u2=oZXxAo
znO8iNR;Dcj@N0{)YgknxkA28xr^NX?aTEJCplI{z3@2bUB!o3#0yN_X0&7Eh$1m5P
z4eBZhF2TB(=E5~s%mR;4#a^UwPt?^tlzu|*$Z+6xPv^w1OPArqnT-y&-{T>pQk!8B
zeU{}M_!71v*7k{mZlPj4zm(b_)90h`JYaBW(1SE96_R!ba2*>9*t$HYQUB+FjWFc%
z27tpDz%~xBy+E)P%dlm8K3z}r0#E^_okI*1W1)lYzn;LaOI+xrGouf#@Y5zb7J^P#
zR>1F*kF89yMWEh1eMu=Oh94elASX<C<~=W$3ZM_?!Z-@R4~MS!S{RNVFIlc69Q}D%
zu0Q35`mIB6HqUhE9lH#gnf6kRryO`O&ej3*7<+zKY%J|kaX)E*RO=jzg>EWsbbcVW
zvd?Q-k5fWH>&dY(2k+o+)%$}h&0SmyXCv7TonaerQL#*bpR3khg~(w~ajKMLH(cu>
zJ%T?5Ib2^6?`SFfIH=fGV}7RLWMO0r<QKI?KBi?NCze^cG&b$@753QaEBs^pjHs5k
ztoRmn6C|Knw9x&ZifEkYmpT&Qk5TE~-W3%+8L}CgmI<~5pKdfpM9dFu34Yg>a2h|`
zqG@@NVwQ}PbNOAfG@b-VQAM>_{jS@rKG)Ar2ctR@ASV<VE*I80Jg;$g(f7Id{zyVG
zKNGM<pYZTA_?`sb<h!Zz+1t|`<GZ4jlUpE{3d*jx?Jh`gB)0s-dRc95NpPh4I7Na@
zd$`D#piscec3#U;A0K&FP@GQI+R0May)E_DA3CP`U61|{QuFE4w;tyfQas{d;gRA}
zr)M|Had)9So#HNAf?oSO_)Ryj3{IME#y668qCEHxSjT=({N{JG<1QJVh=>7gh6l7`
zbuj(e)xpHu-&*Rq!ad}<BBYFSuMVa@`QPRUJjEyfxKxSfq$huA=G@Pk%^p}|SpYjb
zn)5+L#WYCwy^CkUv~jRrr5?~ebq{hbYvh)Yb)pa8w=&(Q)4YS{Xo}ryQ0AELe%Isl
zeGO{32l><}aWt>rwSd0mHgby<z@*T<UGbn}n$PvvgSP0N&}|qG(NR62#s3H@OsRg;
zBe`9s)Lg&o5wg<$SHyit@$kujcttMq|1aKu*vKK@PSqp8rIEfQ<N~LU*xH1J?Kfhw
zGc~u%m5cI#(f8=<tsFRYp}SI80~zE_y}8R}GWku$du?frT9V!JaYDQ;8RKzMiw5r)
zv20R{92-g0;}`R+d+443zHQhf)pC}=4(NG>f@S^<mQ}{|p|7(PHJ9e1uTFVc2ELB1
z+1FWunr$YZsp1rDehDut980@+bCN|_XoGZp1kNz-UZu5&T>|4RB{q1_wuc0=8mzGH
z!`+LHkzMTxo{E!YlM>tm(A#w-?|_eh4b67&Q=(um6~VXVNZgwle4NS1iJxN~sc}}R
zK5N(MFBFUTt8wnZNh{8+OKO~F)jw{jaS~rs14%u-FSJSTe<oY+#}jdDY*em7I7^nF
za#X*De`?f!Gq}BK=K`G65!b^E$1%2;IKH!dQZHaC8>CY^I<@Wg{ClV*u1}(O6L1ev
z>#UW0B9QfLvO5KTC84V30mw&=oB)6EJ!M_;f_|YamR{hlLhDCP_)O9XU#f%=+~G)b
zJjqsqXGKX;aSg@+GuMFA<5RedRF7GDTLZ3+ZKCiR=($je3rL|z(OO<{f?DGAxb2D>
zZ}RyJaf3`04YpFkx@g}XG&9{vvtME6Giq!KvI<nP#@2>id@o=m8L55P8|4_azZP*u
zL#Lo7U!ALp`Uy9Hzj6^Zbp=fa1_JL4Of*1hscI#x$*>&4$ZfE+!ilmZNQ%@Z9e&M5
zTj^`TOqcyR(&DLwX0XkETj8{hkY2xoRTn`XdA5YlKM&iVt3AfDZu5}!dMeKZ3z2_^
zG^&`=@tr-77U8VZgfk5@JL4^Rj#ckHrr&{ivH9$=Ht$F&jX2#o?s;NT9D07kfGPPY
zjK&B5?P&ZJWX`Icwd#-C?Pc-suCk}ZUSfYv{~SDp9JBARKgTWHd#o0<u&m#@S>|s%
z?1e?J0zuHWpq?%MEk~&pp)5geU)6sSTvY_uF`SZA&^}aTuJ6Y4A4l=rJO<D4-@^0m
z;ji(m|6V*77Djvv&*O(zcHW4qtKNTyVFu1b#<DzD&v*v{@Au0%T=p#-eu;Tp>s+hW
zwT<Au7g9Bc(1V!Is!!T$oGaCTZr4A@GXDh0!8K*}vZM-o8E`v?aQsaS_cqJpp>1?L
zEC7bL{(p{#jb4`dk1@UD10-AgrQhhC&7-{o&xYdNuyaU#<6E{9mKb({&$+u_lTv9-
zhaAw0(3i|RacF%y_H3N*U3f&&oq*PqQ3G#hOfXL6@#O8$bvL9t6wfQGIo~Tm%I8H&
zN3+_hf**j)HR%p>d0dw^#$2v;$Ehc_Yf`u4v{)s{PQ?nEw#ChyFCX`wlyhm2OH~7g
zcu7NoGj@6~vU9y&b9uFzYv)rx@#dB%_(TQg7E>>J6$M-EOa3tb57;SHV8yhZ^Dc~G
ziPRR;)EChjSj0_H9ps?@KM?5Z>)zn9vaAQ`PJ7FPo}*4~Rw-l>nBhzbtP%P|w3Vgb
zhWbMAQpe`QioV*07Q#vm?7H!G&Nl~kaPRPB<`bNcpoOLrYHHu=EXR+_Ctx3<bgwCo
zRj0IT^fmUR&b8%<ipX|YEa_gBgj#&(L)?7L%mSPh2Rz&@1A$ljNLrmUek`?+GyKjj
zpW;lA@Uo_SFEpn3)R*kny!VZ^IN*&esIk8sOoPN&WIOh=fq(UV2DwF7DZF^4c9QR^
zxgXK{UC_L15vGJ(gb%t0Av(Md=UzB#GH!EnS@6Y*-0nURkk!GP1GIK==W+m)axN&P
zbcZ7Gl}};!A8p->lLYud>Z`QQZ?406KeN}_Nkb-<PKZDw@9*ChH2KcBN;YV_)dEYY
zHosz5cStEW*V$o}Q(CF%Mrf|_Qn?6y8p1N@VAnDO2WrSGi+oiAusrWn3Hn<gj4S3q
z(y6N;lldMCiH<W4ZWefF;fzh!k!D|k{(2&~tI^=F0v~ndiIxL)IwP5j71m&<(@cYu
zrYHy<@s~x1r99sM!j@$B8REoIhNb)>BpkU}st$NX$P(O~FBu+qKfo-zw_NAbumx_T
zR4!?K)!98>OL>wavHfHtY>sMGuwqD9^9}P_ZBUrbM`?rnbUs=eR3OAn*CNfirC)l)
z`Qi@-U_(n+OS(S$%qPx41~ObKv($}&7aj*S>%FVXNnT6qjti&ZQM248(f%Xvn({c@
zcWd3+@K<s4Yl{6&uPT3kIBk`6nODO5su|u;Oy`vFd?<Pv{Wvb%kL!Y!)_LF4k8k|j
zevJ6ee&nToJXIo~C#yK>KlENae+b&+qkZ_o@Yp_#?GU9NV!l6zs25FAt8VPYcd-AW
zUc~wv`ob&xO76wyzPA?_V1|C(i<$1sFt$c|ag8FX{l|^4G7)(<{LNt;k{+fndbob+
zb&q&kKm3u#g?sBA^j4CTd!!d=WKmE3^m}`1z0^}W^c2lh>IvPLp8C-ZJ@vzIPc6n=
z9qB8a3*+X>g<GSMe~bwa)x>Bk&h&08DZnpRvKzl@^LzBGzj#dhaN)z2hmyv<=YsT%
zS-a^>Z)<h|eqGtS@oUO{55Fv1yP4?=HlHrnHL=X~o~;j=t`9z<=-P(!(7l@@i%<8S
zwnzTtbT4l&#IJePGx*(VL2UN>KhZuK>D2z5_o;bq4xcUb^H)!oMm_;O3k7GWGYRX~
zYFAk->%a|d-nMQVJdnGx3m!ew`=>YoR>XEc`u?M59=Z^tee6tc&ZYwVZY|l3-)$@3
z!>?&&Wl$8E2>8sE&|IyA=PrW2GHAflg=Z?BCOp$94W3i+tkhQqr{T%z&-7Y_N>~-H
zguXmysDzzRP_E1vPeZUwOjZc~C*$KSk;RctZcZ(Krc{PeSXb{A97^=fHuQ~a)i%r<
zqKS#tPHDbi?XWPze#{oMNc_tcHP(WNIYZE4R9f?JV~5dAG;(>JJw5Doz0Nt!5mn7W
zr)iO6|DBMEyRN|gL?<k=MZT!5uZDew=kTYlkA8mv#_|bRdg0PKy+lDi7=-8J^nmA4
z_H16$!1Ze+pT`*kfoJ<wzl0qn$kS7*MBL|@nlV;=L&19+MMqjGM(mIarATl{wC_!#
zc%?|40>9F@J;e&J{3|cr_xjx*2S3~cJ1p0SA6L~{ma_A+8tIwXfix8#0*+e&)kW|a
zfA@%ve9+Yim_z^YfEPvG|2?Rx<>n}@@5HF8KlYCIxh#cl&Tz?I=Oh|F!}BjL3tB~N
z^QCnHc4`_yurc4A;9na+N!OI$%}s4bEhRPfwdLpeH?Usy2Yxw>6KSL+=^9G2hns{n
zkl(SdDL>1<(H4(W8LSQ2HRu=7@q5^FVZPOaRm~{JwgdJ{)Wfc1&iFT4Gfh9kduWK>
zJ3QCDm+YT;iJC8U6Xfdv#TNgDqny-^RfCEY@j;5e6CQ?aQYe2gD&>F_${oB^-ua-A
zm5!X_dM0q3PXQck@!xrr)+!-uk{fnqbgz^~D44HEDmN!w?lda*0V-Ed<w~KOsaz?P
zIN13BzT<2BARA{Z9Vhu@Pb94els@C=tLp`8oPxgd5*Iz;s7U_4ABHUqSkPGF|0{G4
zRT359(ug)vf1jbf?z||bOW_#N490Y)FlKXJl<0du>|&AE94fP8U>g@ny#qYo^^H<?
zcZv=Z#>(r1y2iTlI{TO2SJsQ*@tE)L;25uYOwdga!H+N7T;#JwNnG9;MHTgkvf7F9
za%6yNFahe1Jt}zl#_ELiRV(p78{3F?DQjC>UaOkiE{ZK);)FEqunMH1Tz3sD0}u4(
z(je^oh*IzUL+Z_XFY{TYZ?J_T#rL8=XytaT>hY-dr-Iiz)ms^tS#he@6jxTE)nZr7
zo4aC5_8u#9scYi?P-fHAc#dUkf?ivS6TiZWLz^P@$3?w+j8gKJ!<DCccjymqJ_Xv*
zg<l~q^AQeS;9m}AiOxq3KXNnhCgVS85I#I5+;eF%-qWoTUslPB_jonnnMdgLnes@R
zu)fe{S^tb}+xquyXVym+3mXcHEgPOG-nQZWVmhhAd4fb^&R}#tBlQz$#jqm5L+gWU
zRemSwL>N4ny$-CLvG5<?@8agQDWvg|-EV7F)~*(e?IV4pz}YTNd4bDB_+z4xQCD7g
z+~6>ym$|gNI(wQ&%K4ywD;FCsCmOyUydGukMImyuq>nMqKJswZ^WYqr4ZoOW?Ovjc
z#NnNzSaAqE3`<|(wmaYx%8{85N#d*U3pLN+R9D-b)n@LTrg~iGXB%MgXiJ~F33A^v
zJ&R84G8;O?LXrs9RMj~ns<rj;S7b`403{^Y=l8R;5qy^n5WZ#3N8$qDOFkWUb90T6
zWYNv=7w;NKFkij8+x#x{wIcJAn|GOeJ2ZPe-X9_Uns1kR7p(LAL0(S*`A?<(arydr
z_Q^G+>G7X&mFsm)5ejhlsQLXt&YBL2%6!ZETYD{{?&N`T4Y0_>faKF?XG0<=J$$+1
zloso;bZ!yf%s&QyDg81JOZ;*daM$hOq&~V0GvPDOC*>~(6U3K;<BeR#*<%-vP4dKB
z66ma9a}hL@F0K0n-uhr8P@4aL#pr)!05cUajUh$4#sixdc0-tpYxQ=n^Mbln4G?wv
zg64;1EFU7I;ijJW^BeX#%(r;BAO57|ea-_Ub-P93W~rh)cApyA>oDJ8>|V%5&&XcK
zrkCcpf#!I6c#i)MIO1iVH0*YmZ%DHAbiwoO{f<sOS=#UXFJ^i24f`Ei-`M>QY&uGo
z1irc7X#l^pC%n@+jPPEZH;Ji1uLfgT-sk+P4Wsg|m!w_JerbpEBKRdPB=2nq2Vd`M
zhzgo~e{(4^*wt>=$Dhaglx#fvkWFT@*%`@;FYi8G&Sh$$ceje}j^kJ1?lA;gIbt(Q
zvv(54`f;-v3ar2cmvad2Gvyrg-k-)@;MhF4cT4}L`)A=)yp-xusa#W<Trx|^w5kp=
z-@`-wf%^VS((ZGewEKM5^SYCp`8HNu+I?n#qJ9Ew-!sx5^FReu)F-06_cUNthcqrr
zw|WZlY240(-2<!;9@>2x!n@C#L49@VMN)6{2R1`vp4zc(Sds2TJs5>pSB~`2JX<KO
z1|#!~W?3nAt6%pX)leC{vG)qGAE({wJ2#9)nSNnproBDVkJ$V6j`X8G=oLr%@pF0o
z?{DyO8B6?mNBN8>_o-$X$4mT6Aw}-mvc#Wrl(4<ndr9i8CH`B(@$;}2b6J1#7{hb?
zEzAzCpJvB1H$X&p|MCu+wJ0z~M(FhR23?czyX~JxGodyIa=FTycnfUrThuk=jX2&S
zNRs0go1%dzHrCkbtsyt8h*vC&bU>rWNU@qG;&KFVIlOos-mMudP*V&~d=I`04w5L8
z!wfhSq};luZ8qEiKqmM-$6Kgb>!jNBsPhbRk=}7@=WvKQTaQ&NOE8-5r5bfjmXbop
zwi3@3ey+h1<vd-M?=)B<EwqjyUx}0tdjuK6Gh{``KGAXt@pK;q9^bGNcK$f<uEHD+
zKI~nql+_B1hBrgn!XkhF%47%W*VDcHDtNk3pDQVkQ}wqi3hO`vRgl3V?yBEQdgyQC
z;BIN5t|{3;9C810Xb|+8^VV2cW}e$#E|}HsT7|OBUVblReHA!A00+L%=e1!M%`qOl
zVja#eZb7*Q=fz|D&9gmr=e)c`6HD)Mv#jYC*RUCFFX68Pe@U?Ja343Tt%EbRCGoS{
z?&GuD_VaVvF7R{P?i1#<?HA^^T@Y?*o1|FKwpwv(Ta9928*a{GBnr#WMq?{z1T&q)
zsqP61RlMmniT~wwiEj|qsA#0stl|iTZS@qk9i;H`-%xn@s}wf<n!+Z~8t7F?v_^c9
z!eTXj)m2eg_Z)@UZqOjY&r;xraHQ!B4H;q6QJ03Vn{kq{itq*dNPA!x5j$Z8q{I4#
z3FGoP`rRQlRyN8J`#m{2$K+T%nj`Lea=bGphha2F;`ih@GA4(1G{?m6$??LN96iG$
z?GV2w$CG1noFC1R@;y21V{){N<}iFuj)E~cULVbo`aL;jkIC`eXpX7hlOu7s=xQS9
zHBr__!a11XsfH-Z1KUml&O^C*)bGmbGoTDE;f(DJsDepQSkKtVR%&2KSs>@XYxokr
zxP(hK!XWV}G#b?3tbH#|DD?99=^*P@;qfzX6y96DnPbd|YaNqg(r6CV_vHBPm>hzX
z16~v*FThVV%(<bJ;qiTle6>A0CfDafBO^jci%|Ug*|2F$p1+Rf8TUP~tsax3DV&3_
zFXb7<{#dw7V{*JSCP(DIZOODTIkt^LrTHGHqQ~SYlXAooja@-Bwufl!Y~ET3DjR=p
z1y1;u#`L+LRs`Bsm9GWYqY$fL0b{vDEu&f#g`A-p??s?uv<8jPUzwis7zJE*5%f}N
zoQ-YeUtm9%yx|h%)-~;Hh|nVy(I5l2hsGjH!T5=X1yPK@|CZ7ok<vzgC!EnYz)7$v
z*!UKOs3@$me+}K&u<dNfKz$O;`;PjyNcFup3LE!5X`NEqH>9*vzOm*2k46iym~oEQ
z7Q&(nSfq7_ut@99*fl5MmDii`o@lH+c4xfbX5u}`QSq)WFU|nlVCkiZ)(zKk{26g>
z4vc?<b>kvY_~qxrw4LZW`G{s{mp~)nVeEV2f&F<h_Ju=gjQ!|AvQ|w!@EcfK$4qAN
z--*|oM)A5!>i^Z>=zm%*3BMQ_DxuwE2ue_mj00U$k-vS@&IY=9;mDHQ!`Kx;!gB05
z`11fk(Hh1zcPpP;B}x1#JB7#L8KkHV_rZzDSfSy|UYiTgOz;51AnmSeBEKO5QtW~B
zyYA#JGrWm(^9sIWyV+n>pSMhY#jGJ;M_EWSE9m8OIqPmSLrUBg-ofK9fH=WgjW}>Y
zxIgUkeqlZEx$l196+BP_LZ4YROalvo)E>baE-Q;=lC-_9DbiX3i3^Pz<rOmen;!7o
zo5U>ucckYl5Q~%po@-vgIucIASK@W<4>BLu86nd1IXs;Y**8AKa-HiIin-Ri!-0*D
zJ@nwF;?i~Ut9gC#L*>rRj_}(iC%hk<H*S0+n=<6wwbWvnZ(Ly3=B~<KV3{-D%x+)F
z);;vdx=r_&KJb(D3^q=yy`y}tNIBMTM4_7&itILP{>r8I<lKJy(%i+YqS(1<MhO+W
zu9W?7-6rP)|A8d<Z#l;p{+Iq6dCr{5)M_;g&6=6Psg-JuZK-2yRtnpqXX+y&Gre+f
z$-C#+g}8QCN6$rLW$3lnpG!D;q}_FJ$vI~F{q6&;7vd_{b?7geUKiPGM=76Ly#>nS
zTi9Gy=^7XQD`DF>fr}jTJCa69x`k!o@KxBg1Kri?5==W?jG0X51>{zkcDq=RF_#H{
z3ez?h!}qPO;Br<uMWNdk!=^+agp@G~-EIx6BM1tOj>RbAw#CC-hHk57id<6`Lru4^
zovv1s&1e*=Dif8u9f_JmU#EjT;|fkvf3hG-C2)XoD{gz()>B)e*;6i8t8GEF+R1is
zf=Z!M@LN?Xf!`(w+>ZgTV%JVh7|yK(H2`fjnOr736l_~7V+zxDgz<%-R+yf0F^y(d
zp3wq;!$40_v0vZ_O%09i7@a0Y7sH~3*zFNh7(Spyaogh=OWwk!67bWR;M&Dlm2ckx
zw`l^~?s9b+g~UpokhtC0>2g`v)2+V5sLPw<Cr(syPcu$X|La!t_xS(U-n~ahQJnz*
z|0c7U*(3|u0EJC>WP(6NByJLc0HN6s5iqe-ULmNkn|;8Pkd2#!cggI7u%SRact9%_
zp<1<8tF78nOq=DQV&z1zDu_^`7SK{lO0W&G&Gx%9yPJpNIqf+;r+<7Kc6TN_ncVxk
z-~H~LB{K^<5-xsz?Wie#O}=_RdhPRz(_vHUv^IrHhD}PSx-ek~_&dX*j^Dg7?9e&F
z8+E*24C5Qo0sPaL1VQj8@Z3=F@uDDjMIP^h;1l_5)@J&Ev8_){d8~GbRXAFEuY%3f
znF8K+o!)Pb;%F~h+7SoXwm~I|$F?2Hn$#H3i*XJF&4ihJFc7GZHg2XKyhCxP*zSG<
zYwCbL6Oxb&uSJb(em!ny3}Sq!ytr3%G&08tu(Q1#uw^k0j7F2mXf&Ix){wFSbg4Q6
zkL@23A;71G+bXdY6(te2V(SZl!BAb0%B_U$h=P}~6odpk@Zz|#I0IG#TRNnJKq%hq
zyak10YY+?IfPx>}*&PuD@%pkTPL0JvX3tu)h=>M9w6fjtF_P7beNBYM2g48IKd^-P
z=|9BxQvpKwz}CDv7gh`ZHwP`mL}=u7*jI2p+FdbLn2lEvLtcvjJ_WDMfD{6Vp~i!U
z-)KG4+1?hyj!_>GLS99HptU-GSbve{>H+&=CzcK?q;=1L*8Fh`*2)<0(O|*NdUXr0
zf|(*S(dc6hh8;TI%4`Lzx(VBrJ$v=o;?c0sw$yx(!8@=XhQ<tvvDM6m8W6Yum<_xR
z7c?BThB*+hwuKZUY-(#Wx3}xf4ejlcHH4RHF!ZQr5;R33keX^RY&~|Y^w_bcR339z
zq^k_JD517!#gmzj4jP3_vsp5mGX)*{Mj7}xZUB2o<ME*g8uj{4EIM>20xcax5%4MM
zqjeAH#iQoB+aYK)W*RYiwHjlTvyfMFT&9R!Ad16O4Dl|*GDtK5sy6?3`9sb5|9SpE
zpk9%MEfXIrdS#qJ@o<SH)t>z+%GWE4boa0BpwqFvXlVwMNpuZ!38on>tZu`|#>9px
zCEjva4CqV*FQx(<2XFxJDWNh5W^#ODk~%nHUa!|-?i96Lr9QI!g|Y7o)NA|A);gq5
zQP^Ir=0ua<T#bA5Vy0@qSQG?NCwMRDga%O*x+0tmJQomK+Av{xBZ)XZw6$RGl)*2E
zn5G(89v8Kg<;O%`!AcE{II@P!dVCa=MyL)3^*DHH1Di!Mc9zHLjrq=>nE-;W5kJYr
zn3mQbu){Kodi)E2HE;Y+i|OygLe268`;-!MyqVYgg4LLUwTz(G8GWgJin$p~g9fA-
zjcf$PqTURfLRQIa6il0pW@|`E?VAZo!5@xr{c*U9^uIwGD8cM07);phB`YsAnvJFr
zg%7la6gGMIYDQQB0UV5lq<Bs!fMApwLk43RBRU$m@yyVPK@*<^sk00Ak{U?UAsB4~
zEresit<D(OxTgkbG*GpKfnl{72Tm~NW25=wkM)oqZM=}uA8o(Sik}D%;@HS!LiS0+
zOlGNYgbcw*BosQ<`o_V;koRCx$g9-DLN$N_oe;}wUq8}q#*t2&%k`}VYqCJ9+7J9<
zEbI3k<#6`aw;pQuP{+G`Hh006<c(W;4&s5fu*iw5CecxRIc(-q^RYhKNG=LD9LX1}
zRl;EF?#a<Mz*4mHdcTnk?hT<ER4B*^CX>L$60<hN^KqFxhf^G_XMa;|0<1PTgmhxR
z3}_P)Ru}&3>yiv?c6x&eN$>E|f=msbPE2>W`-ZQyNo?rGnf25@@ufwXHk9b0LBwk&
zm_)52K9<C=@p^7jkN?>LwwfBJrxqOX1D_gsndGv`l~CoDT(W27YMaLiciQZ=ZqHh&
z0uN=NtZ43cr$}?14yjUJwmi1JpbCGo3cnfup_y)Xk2Sm7<Eg8z?SA>?w~EI6^P|d+
zrYkQ$F#P&WT)$QCyPn?iMCI;z*Z#47ktuOe%GA$tjy%5q4qZXoE`91u@957bt-EQ@
zT`&B`lz$*!cl!OG934K)yX4$chOsO6mo;r$GFINvdScDN_0q|l_4{_cGVStE!?SBM
z4$oM0<mi_1mm*!eeca}yOPY86^!%JRmUlfq{j!T&c;xM!S6^w*cchJZ?MIUjx^jg9
zgGxs~wtT|YKOPvh=1*Ja{`_3!{+6UQ{HyjUY1{|>pIled)MA=i-=4hw=rZg4g+9Yy
zUmM=+(+@s4`SKSn2XZ&GF8!o-M8(O^!mpKX`7~|Y;pYzx+%a~}Eq}qwf*g5oL)U=B
z8B^ysmW!v~KN&3k<=d0q+0dAIZ`X4j2lB!@y&qgWJ9_8kL1!;N{Aymusi$urx9;Hs
zFFjjx@yA8Er^5S&xL!%=vRkqm-`uf&yXRa=`SJVCtQu@SYd)m>ec_n<p0S;rBg^Oa
zmra}S@hywawm$m$jGqk~XW+uyTMF+PsBGLY@Vz-DOLmv;es9n4Q*F<O?i@L9MvjC>
zz^+((dz{skb;~4=^MN|q<8(l*!Pr5nRO7V6N_(B;s;jJoiaJk~8Y6hHnzhPSDLV?G
z!sd{0u@GFgnp#Ocrp?aImOyg2tDI2mu3qb5!6N0FbMnVa6>Ftpw~WWuwN7bvl|7pU
z8^$55ULoNrgM$I|MX|$PV7I^F{Ufm9V^da>(p3C{0>x15mkt+qe>D{YMDWJ8k3F+x
zoLI+i3EyIi1#llUb78KTJA+>*_%l7fxB}dQ{qg~9Q@pWdoD>2isQ=iK`aPTxKvIgK
zUtV@zwppr`S30NVnsX<b^UM>n&69I-@jTmQa_zL0=;8EOoOu&m6V1rlFB!}^xp}uw
zm^dkavJKC<a=N}ZZ*I}uTBpOsDN>cqVFPt3%f8%+?>VT;tDK%18Q-yhaCbTIpa7Eb
z&dP_APN;NOu@=O(P`fa`O(9j=JT*>jby=?tx!S`vUhVc&I-tg3w|N{(Yn(QZeL1#j
zbiLZ+uE4iPK(3Op<FcesQ|-h$td{W|l8PF6owE?!D}cSC{#LldRX5KGE_Yp(L$XLP
z*J*cSvDZo~-3}*CKX6*Cm7STgvg6bYba+Qv)im}!y#(BC;Yg&5HRKI$MMV>jZ(Z_E
z%hbKIUbt}P7YF)o`^b>a!S{Nvlz(t@>-Z1DyA#Be&8<5t_AYqt)ic*Nx_-ZQ|GUQP
zO~+?GmOg*eQ?p(k@~>y~Y5l|3pS<6B<cTq>PfwY}+V`7o`&^(Oy%hA<t)Nf4AKx&*
zGWRTM&!1)WWv|^c+8#dihu?Mt_6&LY`7bXt$F^tNvgKWe9yv8*^1iEk^Dd3|{(xV7
z#qy;6{DtPunbU9m=*o#9E55j=WzurXuit82lCz>LuXWtuJ*gY+x^!{-?)r?bkEee!
zr^Ncsx4%=+I`tnf&O7#^Fx=VP@W`qKzq|C(#fPRmduqb#i$7bYmAMI@w_%xMWyJHB
zbb_c)V(V;qZvzLGemp1{0<ga!VxKRp1aP>(&#;JnrUOi@;$YUN9J}t8y_Thj+Cs>x
z2C#Pb9oC+#eL(?ye^i=nkk9kscl*gBN=HxEoiNCM#<N(sQ3hN3?2Nk&@~sww&A`r~
zau}?o@~Ep3$EbEuS86Mj+1W#-wghWShr6lRnj)XZz3AneExHpa@`r36H>KG0C5vVC
zj2FC4HC`hW&*8)KMWWBRUXg+4;((N3`SNfAj4$CW_+I(A`NwZ933Z6M>GGSn$6@l=
z*#<0Ex_pf7Gb`OTsw7=*{8hRw9j~OI*wU@#cm_|Gdr(W!Rj_5@z1&tV&$$}0XI+ih
z9{Tc$4*YEFjz=v+N|K8g<JB$M*~RKJUa@pBUi<O{{tlCDyvvB?&cO3_@OO;Nu%)na
zUyW3ZRJXoS*<*ic-6h8A5Q`mpCIJ#40TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq
z5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*
zAOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}
z0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq
z5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*
zAOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}0TLhq5+DH*AOR8}
t0TLhq5+DH*AOR8}0TLhq5+DH*Ac6lz03hw0UzfoxxbqI<%thOh{|(Mb>P-Lu

literal 0
HcmV?d00001

diff --git a/stm32/mk4-bootloader/releases/3.3.0/bootloader.lss b/stm32/mk4-bootloader/releases/3.3.0/bootloader.lss
new file mode 100644
index 00000000..b388a590
--- /dev/null
+++ b/stm32/mk4-bootloader/releases/3.3.0/bootloader.lss
@@ -0,0 +1,34693 @@
+
+bootloader.elf:     file format elf32-littlearm
+
+Sections:
+Idx Name          Size      VMA       LMA       File off  Algn
+  0 .text         0000ead0  08000000  08000000  00010000  2**8
+                  CONTENTS, ALLOC, LOAD, READONLY, CODE
+  1 .relocate     00000150  2009e000  0800ead0  0002e000  2**2
+                  CONTENTS, ALLOC, LOAD, READONLY, CODE
+  2 .bss          000002e8  2009e150  0800ec20  0002e150  2**2
+                  ALLOC
+  3 .stack        00000800  2009e438  0800ef08  0002e150  2**0
+                  ALLOC
+  4 .debug_info   0002bd2d  00000000  00000000  0002e150  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+  5 .debug_abbrev 00005f71  00000000  00000000  00059e7d  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+  6 .debug_loc    00014618  00000000  00000000  0005fdee  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+  7 .debug_aranges 000010d0  00000000  00000000  00074406  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+  8 .debug_ranges 00002168  00000000  00000000  000754d6  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+  9 .debug_macro  0003253d  00000000  00000000  0007763e  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+ 10 .debug_line   0001dece  00000000  00000000  000a9b7b  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+ 11 .debug_str    0011cbf4  00000000  00000000  000c7a49  2**0
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+ 12 .comment      00000049  00000000  00000000  001e463d  2**0
+                  CONTENTS, READONLY
+ 13 .ARM.attributes 00000032  00000000  00000000  001e4686  2**0
+                  CONTENTS, READONLY
+ 14 .debug_frame  00003714  00000000  00000000  001e46b8  2**2
+                  CONTENTS, READONLY, DEBUGGING, OCTETS
+
+Disassembly of section .text:
+
+08000000 <_sfixed>:
+ 8000000:	200a0000 	.word	0x200a0000
+ 8000004:	080000b5 	.word	0x080000b5
+ 8000008:	0800001d 	.word	0x0800001d
+ 800000c:	0800001f 	.word	0x0800001f
+ 8000010:	08000021 	.word	0x08000021
+ 8000014:	08000023 	.word	0x08000023
+ 8000018:	08000025 	.word	0x08000025
+
+0800001c <NMI_Handler>:
+ 800001c:	be01      	bkpt	0x0001
+
+0800001e <HardFault_Handler>:
+ 800001e:	be02      	bkpt	0x0002
+
+08000020 <MemManage_Handler>:
+ 8000020:	be03      	bkpt	0x0003
+
+08000022 <BusFault_Handler>:
+ 8000022:	be04      	bkpt	0x0004
+
+08000024 <UsageFault_Handler>:
+ 8000024:	be05      	bkpt	0x0005
+ 8000026:	e7fe      	b.n	8000026 <UsageFault_Handler+0x2>
+
+08000028 <bootloader_info>:
+	...
+ 8000040:	08000305 	.word	0x08000305
+
+08000044 <my_version_code>:
+ 8000044:	00000200 	.word	0x00000200
+	...
+ 8000060:	20296328 	.word	0x20296328
+ 8000064:	79706f43 	.word	0x79706f43
+ 8000068:	68676972 	.word	0x68676972
+ 800006c:	30322074 	.word	0x30322074
+ 8000070:	322d3831 	.word	0x322d3831
+ 8000074:	20323230 	.word	0x20323230
+ 8000078:	43207962 	.word	0x43207962
+ 800007c:	6b6e696f 	.word	0x6b6e696f
+ 8000080:	20657469 	.word	0x20657469
+ 8000084:	2e636e49 	.word	0x2e636e49
+ 8000088:	0a200a20 	.word	0x0a200a20
+ 800008c:	73696854 	.word	0x73696854
+ 8000090:	61707320 	.word	0x61707320
+ 8000094:	66206563 	.word	0x66206563
+ 8000098:	7220726f 	.word	0x7220726f
+ 800009c:	21746e65 	.word	0x21746e65
+ 80000a0:	73754a20 	.word	0x73754a20
+ 80000a4:	42312074 	.word	0x42312074
+ 80000a8:	792f4354 	.word	0x792f4354
+ 80000ac:	2e726165 	.word	0x2e726165
+ 80000b0:	0a200a20 	.word	0x0a200a20
+
+080000b4 <reset_entry>:
+ 80000b4:	f000 f816 	bl	80000e4 <firewall_setup>
+ 80000b8:	f04f 30ff 	mov.w	r0, #4294967295	; 0xffffffff
+ 80000bc:	f04f 0100 	mov.w	r1, #0
+ 80000c0:	f04f 0200 	mov.w	r2, #0
+ 80000c4:	f04f 0300 	mov.w	r3, #0
+ 80000c8:	f000 f91c 	bl	8000304 <callgate_entry0>
+ 80000cc:	f248 0120 	movw	r1, #32800	; 0x8020
+ 80000d0:	ea4f 3101 	mov.w	r1, r1, lsl #12
+ 80000d4:	6808      	ldr	r0, [r1, #0]
+ 80000d6:	4685      	mov	sp, r0
+ 80000d8:	f04f 0001 	mov.w	r0, #1
+ 80000dc:	f8d1 e004 	ldr.w	lr, [r1, #4]
+ 80000e0:	4770      	bx	lr
+	...
+
+080000e4 <firewall_setup>:
+    void
+firewall_setup(void)
+{
+    // This is critical: without the clock enabled to "SYSCFG" we
+    // can't tell the FW is enabled or not! Enabling it would also not work
+    __HAL_RCC_SYSCFG_CLK_ENABLE();
+ 80000e4:	4b1b      	ldr	r3, [pc, #108]	; (8000154 <firewall_setup+0x70>)
+{
+ 80000e6:	b500      	push	{lr}
+    __HAL_RCC_SYSCFG_CLK_ENABLE();
+ 80000e8:	6e1a      	ldr	r2, [r3, #96]	; 0x60
+ 80000ea:	f042 0201 	orr.w	r2, r2, #1
+ 80000ee:	661a      	str	r2, [r3, #96]	; 0x60
+ 80000f0:	6e1b      	ldr	r3, [r3, #96]	; 0x60
+{
+ 80000f2:	b08b      	sub	sp, #44	; 0x2c
+    __HAL_RCC_SYSCFG_CLK_ENABLE();
+ 80000f4:	f003 0301 	and.w	r3, r3, #1
+ 80000f8:	9300      	str	r3, [sp, #0]
+ 80000fa:	9b00      	ldr	r3, [sp, #0]
+
+    if(__HAL_FIREWALL_IS_ENABLED()) {
+ 80000fc:	4b16      	ldr	r3, [pc, #88]	; (8000158 <firewall_setup+0x74>)
+ 80000fe:	685b      	ldr	r3, [r3, #4]
+ 8000100:	07db      	lsls	r3, r3, #31
+ 8000102:	d524      	bpl.n	800014e <firewall_setup+0x6a>
+    // REMINDERS: 
+    // - cannot debug anything in boot loader w/ firewall enabled (no readback, no bkpt)
+    // - when RDP=2, this protection still important or else python can read pairing secret
+    // - in factory mode (RDP!=2), it's nice to have this disabled so we can debug still
+    // - could look at RDP level here, but it would be harder to completely reset the bag number!
+    if(check_all_ones_raw(rom_secrets->bag_number, sizeof(rom_secrets->bag_number))) {
+ 8000104:	4815      	ldr	r0, [pc, #84]	; (800015c <firewall_setup+0x78>)
+ 8000106:	2120      	movs	r1, #32
+ 8000108:	f002 fac4 	bl	8002694 <check_all_ones_raw>
+ 800010c:	b9f8      	cbnz	r0, 800014e <firewall_setup+0x6a>
+    // for debug builds, never enable firewall
+    return;
+#endif
+
+    extern int firewall_starts;       // see startup.S ... aligned@256 (0x08000300)
+    uint32_t    start = (uint32_t)&firewall_starts;
+ 800010e:	4b14      	ldr	r3, [pc, #80]	; (8000160 <firewall_setup+0x7c>)
+    uint32_t    len = BL_FLASH_SIZE - (start - BL_FLASH_BASE);
+ 8000110:	4a14      	ldr	r2, [pc, #80]	; (8000164 <firewall_setup+0x80>)
+    //   but sensitive stuff is still there (which would allow bypass)
+    // - so it's important to enable option bytes to set write-protect flash of entire bootloader
+    // - to disable debug and complete protection, must enable write-protect "level 2" (RDP=2)
+    //
+
+    FIREWALL_InitTypeDef init = {
+ 8000112:	9302      	str	r3, [sp, #8]
+    uint32_t    len = BL_FLASH_SIZE - (start - BL_FLASH_BASE);
+ 8000114:	1ad3      	subs	r3, r2, r3
+    FIREWALL_InitTypeDef init = {
+ 8000116:	e9cd 3203 	strd	r3, r2, [sp, #12]
+ 800011a:	f44f 4380 	mov.w	r3, #16384	; 0x4000
+ 800011e:	e9cd 3005 	strd	r3, r0, [sp, #20]
+ 8000122:	e9cd 0007 	strd	r0, r0, [sp, #28]
+ 8000126:	9009      	str	r0, [sp, #36]	; 0x24
+        .VDataSegmentLength = 0,
+        .VolatileDataExecution = 0,
+        .VolatileDataShared = 0,
+    };
+
+    int rv = HAL_FIREWALL_Config((FIREWALL_InitTypeDef *)&init);
+ 8000128:	a802      	add	r0, sp, #8
+ 800012a:	f000 f821 	bl	8000170 <HAL_FIREWALL_Config>
+    if(rv) {
+ 800012e:	b110      	cbz	r0, 8000136 <firewall_setup+0x52>
+        INCONSISTENT("fw");
+ 8000130:	480d      	ldr	r0, [pc, #52]	; (8000168 <firewall_setup+0x84>)
+ 8000132:	f000 fc89 	bl	8000a48 <fatal_error>
+    }
+
+    __HAL_FIREWALL_PREARM_DISABLE();
+ 8000136:	4b0d      	ldr	r3, [pc, #52]	; (800016c <firewall_setup+0x88>)
+ 8000138:	6a1a      	ldr	r2, [r3, #32]
+ 800013a:	f022 0201 	bic.w	r2, r2, #1
+ 800013e:	621a      	str	r2, [r3, #32]
+ 8000140:	6a1b      	ldr	r3, [r3, #32]
+ 8000142:	f003 0301 	and.w	r3, r3, #1
+ 8000146:	9301      	str	r3, [sp, #4]
+ 8000148:	9b01      	ldr	r3, [sp, #4]
+    HAL_FIREWALL_EnableFirewall();
+ 800014a:	f000 f88b 	bl	8000264 <HAL_FIREWALL_EnableFirewall>
+}
+ 800014e:	b00b      	add	sp, #44	; 0x2c
+ 8000150:	f85d fb04 	ldr.w	pc, [sp], #4
+ 8000154:	40021000 	.word	0x40021000
+ 8000158:	40010000 	.word	0x40010000
+ 800015c:	0801c050 	.word	0x0801c050
+ 8000160:	08000300 	.word	0x08000300
+ 8000164:	0801c000 	.word	0x0801c000
+ 8000168:	0800d760 	.word	0x0800d760
+ 800016c:	40011c00 	.word	0x40011c00
+
+08000170 <HAL_FIREWALL_Config>:
+  * @param fw_init: Firewall initialization structure
+  * @note  The API returns HAL_ERROR if the Firewall is already enabled.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HAL_FIREWALL_Config(FIREWALL_InitTypeDef * fw_init)
+{
+ 8000170:	b573      	push	{r0, r1, r4, r5, r6, lr}
+  /* Check the Firewall initialization structure allocation */
+  if(fw_init == NULL)
+ 8000172:	b910      	cbnz	r0, 800017a <HAL_FIREWALL_Config+0xa>
+  {
+    return HAL_ERROR;
+ 8000174:	2001      	movs	r0, #1
+  /* Set Firewall Configuration Register VDE and VDS bits
+     (volatile data execution and shared configuration) */
+  MODIFY_REG(FIREWALL->CR, FW_CR_VDS|FW_CR_VDE, fw_init->VolatileDataExecution|fw_init->VolatileDataShared);
+
+  return HAL_OK;
+}
+ 8000176:	b002      	add	sp, #8
+ 8000178:	bd70      	pop	{r4, r5, r6, pc}
+  __HAL_RCC_FIREWALL_CLK_ENABLE();
+ 800017a:	4b19      	ldr	r3, [pc, #100]	; (80001e0 <HAL_FIREWALL_Config+0x70>)
+ 800017c:	6e1a      	ldr	r2, [r3, #96]	; 0x60
+ 800017e:	f042 0280 	orr.w	r2, r2, #128	; 0x80
+ 8000182:	661a      	str	r2, [r3, #96]	; 0x60
+ 8000184:	6e1b      	ldr	r3, [r3, #96]	; 0x60
+ 8000186:	f003 0380 	and.w	r3, r3, #128	; 0x80
+ 800018a:	9301      	str	r3, [sp, #4]
+ 800018c:	9b01      	ldr	r3, [sp, #4]
+  if (__HAL_FIREWALL_IS_ENABLED() != RESET)
+ 800018e:	4b15      	ldr	r3, [pc, #84]	; (80001e4 <HAL_FIREWALL_Config+0x74>)
+ 8000190:	685b      	ldr	r3, [r3, #4]
+ 8000192:	07db      	lsls	r3, r3, #31
+ 8000194:	d5ee      	bpl.n	8000174 <HAL_FIREWALL_Config+0x4>
+  if (fw_init->CodeSegmentLength != 0U)
+ 8000196:	6841      	ldr	r1, [r0, #4]
+    if (fw_init->NonVDataSegmentLength < 0x100U)
+ 8000198:	68c2      	ldr	r2, [r0, #12]
+  if (fw_init->CodeSegmentLength != 0U)
+ 800019a:	b109      	cbz	r1, 80001a0 <HAL_FIREWALL_Config+0x30>
+    if (fw_init->NonVDataSegmentLength < 0x100U)
+ 800019c:	2aff      	cmp	r2, #255	; 0xff
+ 800019e:	d9e9      	bls.n	8000174 <HAL_FIREWALL_Config+0x4>
+  WRITE_REG(FIREWALL->CSSA, (FW_CSSA_ADD & fw_init->CodeSegmentStartAddress));
+ 80001a0:	6803      	ldr	r3, [r0, #0]
+ 80001a2:	4e11      	ldr	r6, [pc, #68]	; (80001e8 <HAL_FIREWALL_Config+0x78>)
+  if (fw_init->VDataSegmentLength != 0U)
+ 80001a4:	6944      	ldr	r4, [r0, #20]
+  WRITE_REG(FIREWALL->CSSA, (FW_CSSA_ADD & fw_init->CodeSegmentStartAddress));
+ 80001a6:	ea03 0506 	and.w	r5, r3, r6
+ 80001aa:	4b10      	ldr	r3, [pc, #64]	; (80001ec <HAL_FIREWALL_Config+0x7c>)
+ 80001ac:	601d      	str	r5, [r3, #0]
+  WRITE_REG(FIREWALL->CSL, (FW_CSL_LENG & fw_init->CodeSegmentLength));
+ 80001ae:	4d10      	ldr	r5, [pc, #64]	; (80001f0 <HAL_FIREWALL_Config+0x80>)
+ 80001b0:	4029      	ands	r1, r5
+ 80001b2:	6059      	str	r1, [r3, #4]
+  WRITE_REG(FIREWALL->NVDSSA, (FW_NVDSSA_ADD & fw_init->NonVDataSegmentStartAddress));
+ 80001b4:	6881      	ldr	r1, [r0, #8]
+  WRITE_REG(FIREWALL->NVDSL, (FW_NVDSL_LENG & fw_init->NonVDataSegmentLength));
+ 80001b6:	402a      	ands	r2, r5
+  WRITE_REG(FIREWALL->NVDSSA, (FW_NVDSSA_ADD & fw_init->NonVDataSegmentStartAddress));
+ 80001b8:	4031      	ands	r1, r6
+ 80001ba:	6099      	str	r1, [r3, #8]
+  WRITE_REG(FIREWALL->NVDSL, (FW_NVDSL_LENG & fw_init->NonVDataSegmentLength));
+ 80001bc:	60da      	str	r2, [r3, #12]
+  WRITE_REG(FIREWALL->VDSSA, (FW_VDSSA_ADD & fw_init->VDataSegmentStartAddress));
+ 80001be:	6901      	ldr	r1, [r0, #16]
+ 80001c0:	4a0c      	ldr	r2, [pc, #48]	; (80001f4 <HAL_FIREWALL_Config+0x84>)
+ 80001c2:	4011      	ands	r1, r2
+  WRITE_REG(FIREWALL->VDSL, (FW_VDSL_LENG & fw_init->VDataSegmentLength));
+ 80001c4:	4022      	ands	r2, r4
+  WRITE_REG(FIREWALL->VDSSA, (FW_VDSSA_ADD & fw_init->VDataSegmentStartAddress));
+ 80001c6:	6119      	str	r1, [r3, #16]
+  WRITE_REG(FIREWALL->VDSL, (FW_VDSL_LENG & fw_init->VDataSegmentLength));
+ 80001c8:	615a      	str	r2, [r3, #20]
+  MODIFY_REG(FIREWALL->CR, FW_CR_VDS|FW_CR_VDE, fw_init->VolatileDataExecution|fw_init->VolatileDataShared);
+ 80001ca:	e9d0 2006 	ldrd	r2, r0, [r0, #24]
+ 80001ce:	6a19      	ldr	r1, [r3, #32]
+ 80001d0:	4302      	orrs	r2, r0
+ 80001d2:	f021 0106 	bic.w	r1, r1, #6
+ 80001d6:	430a      	orrs	r2, r1
+ 80001d8:	621a      	str	r2, [r3, #32]
+  return HAL_OK;
+ 80001da:	2000      	movs	r0, #0
+ 80001dc:	e7cb      	b.n	8000176 <HAL_FIREWALL_Config+0x6>
+ 80001de:	bf00      	nop
+ 80001e0:	40021000 	.word	0x40021000
+ 80001e4:	40010000 	.word	0x40010000
+ 80001e8:	00ffff00 	.word	0x00ffff00
+ 80001ec:	40011c00 	.word	0x40011c00
+ 80001f0:	003fff00 	.word	0x003fff00
+ 80001f4:	0003ffc0 	.word	0x0003ffc0
+
+080001f8 <HAL_FIREWALL_GetConfig>:
+void HAL_FIREWALL_GetConfig(FIREWALL_InitTypeDef * fw_config)
+{
+
+  /* Enable Firewall clock, in case no Firewall configuration has been carried
+     out up to this point */
+  __HAL_RCC_FIREWALL_CLK_ENABLE();
+ 80001f8:	4b15      	ldr	r3, [pc, #84]	; (8000250 <HAL_FIREWALL_GetConfig+0x58>)
+ 80001fa:	6e1a      	ldr	r2, [r3, #96]	; 0x60
+{
+ 80001fc:	b573      	push	{r0, r1, r4, r5, r6, lr}
+  __HAL_RCC_FIREWALL_CLK_ENABLE();
+ 80001fe:	f042 0280 	orr.w	r2, r2, #128	; 0x80
+ 8000202:	661a      	str	r2, [r3, #96]	; 0x60
+ 8000204:	6e1b      	ldr	r3, [r3, #96]	; 0x60
+
+  /* Retrieve code segment protection setting */
+  fw_config->CodeSegmentStartAddress = (READ_REG(FIREWALL->CSSA) & FW_CSSA_ADD);
+ 8000206:	4e13      	ldr	r6, [pc, #76]	; (8000254 <HAL_FIREWALL_GetConfig+0x5c>)
+  fw_config->CodeSegmentLength = (READ_REG(FIREWALL->CSL) & FW_CSL_LENG);
+ 8000208:	4d13      	ldr	r5, [pc, #76]	; (8000258 <HAL_FIREWALL_GetConfig+0x60>)
+  __HAL_RCC_FIREWALL_CLK_ENABLE();
+ 800020a:	f003 0380 	and.w	r3, r3, #128	; 0x80
+ 800020e:	9301      	str	r3, [sp, #4]
+ 8000210:	9b01      	ldr	r3, [sp, #4]
+  fw_config->CodeSegmentStartAddress = (READ_REG(FIREWALL->CSSA) & FW_CSSA_ADD);
+ 8000212:	4b12      	ldr	r3, [pc, #72]	; (800025c <HAL_FIREWALL_GetConfig+0x64>)
+ 8000214:	681a      	ldr	r2, [r3, #0]
+ 8000216:	4032      	ands	r2, r6
+ 8000218:	6002      	str	r2, [r0, #0]
+  fw_config->CodeSegmentLength = (READ_REG(FIREWALL->CSL) & FW_CSL_LENG);
+ 800021a:	685c      	ldr	r4, [r3, #4]
+ 800021c:	402c      	ands	r4, r5
+ 800021e:	6044      	str	r4, [r0, #4]
+
+  /* Retrieve non volatile data segment protection setting */
+  fw_config->NonVDataSegmentStartAddress = (READ_REG(FIREWALL->NVDSSA) & FW_NVDSSA_ADD);
+ 8000220:	6899      	ldr	r1, [r3, #8]
+  fw_config->NonVDataSegmentLength = (READ_REG(FIREWALL->NVDSL) & FW_NVDSL_LENG);
+
+  /* Retrieve volatile data segment protection setting */
+  fw_config->VDataSegmentStartAddress = (READ_REG(FIREWALL->VDSSA) & FW_VDSSA_ADD);
+ 8000222:	4c0f      	ldr	r4, [pc, #60]	; (8000260 <HAL_FIREWALL_GetConfig+0x68>)
+  fw_config->NonVDataSegmentStartAddress = (READ_REG(FIREWALL->NVDSSA) & FW_NVDSSA_ADD);
+ 8000224:	4031      	ands	r1, r6
+ 8000226:	6081      	str	r1, [r0, #8]
+  fw_config->NonVDataSegmentLength = (READ_REG(FIREWALL->NVDSL) & FW_NVDSL_LENG);
+ 8000228:	68da      	ldr	r2, [r3, #12]
+ 800022a:	402a      	ands	r2, r5
+ 800022c:	60c2      	str	r2, [r0, #12]
+  fw_config->VDataSegmentStartAddress = (READ_REG(FIREWALL->VDSSA) & FW_VDSSA_ADD);
+ 800022e:	6919      	ldr	r1, [r3, #16]
+ 8000230:	4021      	ands	r1, r4
+ 8000232:	6101      	str	r1, [r0, #16]
+  fw_config->VDataSegmentLength = (READ_REG(FIREWALL->VDSL) & FW_VDSL_LENG);
+ 8000234:	695a      	ldr	r2, [r3, #20]
+ 8000236:	4022      	ands	r2, r4
+ 8000238:	6142      	str	r2, [r0, #20]
+
+  /* Retrieve volatile data execution setting */
+  fw_config->VolatileDataExecution = (READ_REG(FIREWALL->CR) & FW_CR_VDE);
+ 800023a:	6a1a      	ldr	r2, [r3, #32]
+ 800023c:	f002 0204 	and.w	r2, r2, #4
+ 8000240:	6182      	str	r2, [r0, #24]
+
+  /* Retrieve volatile data shared setting */
+  fw_config->VolatileDataShared = (READ_REG(FIREWALL->CR) & FW_CR_VDS);
+ 8000242:	6a1b      	ldr	r3, [r3, #32]
+ 8000244:	f003 0302 	and.w	r3, r3, #2
+ 8000248:	61c3      	str	r3, [r0, #28]
+
+  return;
+}
+ 800024a:	b002      	add	sp, #8
+ 800024c:	bd70      	pop	{r4, r5, r6, pc}
+ 800024e:	bf00      	nop
+ 8000250:	40021000 	.word	0x40021000
+ 8000254:	00ffff00 	.word	0x00ffff00
+ 8000258:	003fff00 	.word	0x003fff00
+ 800025c:	40011c00 	.word	0x40011c00
+ 8000260:	0003ffc0 	.word	0x0003ffc0
+
+08000264 <HAL_FIREWALL_EnableFirewall>:
+  * @retval None
+  */
+void HAL_FIREWALL_EnableFirewall(void)
+{
+  /* Clears FWDIS bit of SYSCFG CFGR1 register */
+  CLEAR_BIT(SYSCFG->CFGR1, SYSCFG_CFGR1_FWDIS);
+ 8000264:	4a02      	ldr	r2, [pc, #8]	; (8000270 <HAL_FIREWALL_EnableFirewall+0xc>)
+ 8000266:	6853      	ldr	r3, [r2, #4]
+ 8000268:	f023 0301 	bic.w	r3, r3, #1
+ 800026c:	6053      	str	r3, [r2, #4]
+
+}
+ 800026e:	4770      	bx	lr
+ 8000270:	40010000 	.word	0x40010000
+
+08000274 <HAL_FIREWALL_EnablePreArmFlag>:
+  * @retval None
+  */
+void HAL_FIREWALL_EnablePreArmFlag(void)
+{
+  /* Set FPA bit */
+  SET_BIT(FIREWALL->CR, FW_CR_FPA);
+ 8000274:	4a02      	ldr	r2, [pc, #8]	; (8000280 <HAL_FIREWALL_EnablePreArmFlag+0xc>)
+ 8000276:	6a13      	ldr	r3, [r2, #32]
+ 8000278:	f043 0301 	orr.w	r3, r3, #1
+ 800027c:	6213      	str	r3, [r2, #32]
+}
+ 800027e:	4770      	bx	lr
+ 8000280:	40011c00 	.word	0x40011c00
+
+08000284 <HAL_FIREWALL_DisablePreArmFlag>:
+  * @retval None
+  */
+void HAL_FIREWALL_DisablePreArmFlag(void)
+{
+  /* Clear FPA bit */
+  CLEAR_BIT(FIREWALL->CR, FW_CR_FPA);
+ 8000284:	4a02      	ldr	r2, [pc, #8]	; (8000290 <HAL_FIREWALL_DisablePreArmFlag+0xc>)
+ 8000286:	6a13      	ldr	r3, [r2, #32]
+ 8000288:	f023 0301 	bic.w	r3, r3, #1
+ 800028c:	6213      	str	r3, [r2, #32]
+}
+ 800028e:	4770      	bx	lr
+ 8000290:	40011c00 	.word	0x40011c00
+	...
+
+08000300 <_firewall_start>:
+ 8000300:	0f193a11 	.word	0x0f193a11
+
+08000304 <callgate_entry0>:
+ 8000304:	f24e 0900 	movw	r9, #57344	; 0xe000
+ 8000308:	f2c2 0909 	movt	r9, #8201	; 0x2009
+ 800030c:	f44f 5a00 	mov.w	sl, #8192	; 0x2000
+ 8000310:	44ca      	add	sl, r9
+
+08000312 <wipe_loop1>:
+ 8000312:	f849 ab04 	str.w	sl, [r9], #4
+ 8000316:	45d1      	cmp	r9, sl
+ 8000318:	d1fb      	bne.n	8000312 <wipe_loop1>
+ 800031a:	46ea      	mov	sl, sp
+ 800031c:	46cd      	mov	sp, r9
+ 800031e:	e92d 4400 	stmdb	sp!, {sl, lr}
+
+08000322 <dispatcher>:
+ 8000322:	f000 f841 	bl	80003a8 <firewall_dispatch>
+ 8000326:	e8bd 4400 	ldmia.w	sp!, {sl, lr}
+ 800032a:	46d5      	mov	sp, sl
+ 800032c:	f24e 0900 	movw	r9, #57344	; 0xe000
+ 8000330:	f2c2 0909 	movt	r9, #8201	; 0x2009
+ 8000334:	f44f 5a00 	mov.w	sl, #8192	; 0x2000
+ 8000338:	44ca      	add	sl, r9
+
+0800033a <wipe_loop2>:
+ 800033a:	f849 0b04 	str.w	r0, [r9], #4
+ 800033e:	45d1      	cmp	r9, sl
+ 8000340:	d1fb      	bne.n	800033a <wipe_loop2>
+ 8000342:	4770      	bx	lr
+
+08000344 <__NVIC_SystemReset>:
+  \details Acts as a special kind of Data Memory Barrier.
+           It completes when all explicit memory accesses before this instruction complete.
+ */
+__STATIC_FORCEINLINE void __DSB(void)
+{
+  __ASM volatile ("dsb 0xF":::"memory");
+ 8000344:	f3bf 8f4f 	dsb	sy
+__NO_RETURN __STATIC_INLINE void __NVIC_SystemReset(void)
+{
+  __DSB();                                                          /* Ensure all outstanding memory accesses included
+                                                                       buffered write are completed before reset */
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 8000348:	4905      	ldr	r1, [pc, #20]	; (8000360 <__NVIC_SystemReset+0x1c>)
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 800034a:	4b06      	ldr	r3, [pc, #24]	; (8000364 <__NVIC_SystemReset+0x20>)
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 800034c:	68ca      	ldr	r2, [r1, #12]
+ 800034e:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 8000352:	4313      	orrs	r3, r2
+ 8000354:	60cb      	str	r3, [r1, #12]
+ 8000356:	f3bf 8f4f 	dsb	sy
+                            SCB_AIRCR_SYSRESETREQ_Msk    );         /* Keep priority group unchanged */
+  __DSB();                                                          /* Ensure completion of memory access */
+
+  for(;;)                                                           /* wait until reset */
+  {
+    __NOP();
+ 800035a:	bf00      	nop
+  for(;;)                                                           /* wait until reset */
+ 800035c:	e7fd      	b.n	800035a <__NVIC_SystemReset+0x16>
+ 800035e:	bf00      	nop
+ 8000360:	e000ed00 	.word	0xe000ed00
+ 8000364:	05fa0004 	.word	0x05fa0004
+
+08000368 <good_addr>:
+good_addr(const uint8_t *b, int minlen, int len, bool readonly)
+{
+    uint32_t x = (uint32_t)b;
+
+    if(minlen) {
+        if(!b) return EFAULT;               // gave no buffer
+ 8000368:	b198      	cbz	r0, 8000392 <good_addr+0x2a>
+        if(len < minlen) return ERANGE;     // too small
+ 800036a:	4291      	cmp	r1, r2
+ 800036c:	dc13      	bgt.n	8000396 <good_addr+0x2e>
+    }
+        
+    if((x >= SRAM1_BASE) && ((x+len) <= BL_SRAM_BASE)) {
+ 800036e:	f1b0 5f00 	cmp.w	r0, #536870912	; 0x20000000
+ 8000372:	d303      	bcc.n	800037c <good_addr+0x14>
+ 8000374:	490b      	ldr	r1, [pc, #44]	; (80003a4 <good_addr+0x3c>)
+ 8000376:	4402      	add	r2, r0
+ 8000378:	428a      	cmp	r2, r1
+ 800037a:	d90e      	bls.n	800039a <good_addr+0x32>
+        // ok: it's inside the SRAM areas, up to where we start
+        return 0;
+    }
+
+    if(!readonly) {
+ 800037c:	b17b      	cbz	r3, 800039e <good_addr+0x36>
+        return EPERM;
+    }
+
+    if((x >= FIRMWARE_START) && (x - FIRMWARE_START) < FW_MAX_LENGTH_MK4) {
+ 800037e:	f100 4077 	add.w	r0, r0, #4143972352	; 0xf7000000
+ 8000382:	f500 007e 	add.w	r0, r0, #16646144	; 0xfe0000
+        // inside flash of main firmware (happens for QSTR's)
+        return 0;
+    }
+
+    return EACCES;
+ 8000386:	f5b0 1ff0 	cmp.w	r0, #1966080	; 0x1e0000
+ 800038a:	bf34      	ite	cc
+ 800038c:	2000      	movcc	r0, #0
+ 800038e:	200d      	movcs	r0, #13
+ 8000390:	4770      	bx	lr
+        if(!b) return EFAULT;               // gave no buffer
+ 8000392:	200e      	movs	r0, #14
+ 8000394:	4770      	bx	lr
+        if(len < minlen) return ERANGE;     // too small
+ 8000396:	2022      	movs	r0, #34	; 0x22
+ 8000398:	4770      	bx	lr
+        return 0;
+ 800039a:	2000      	movs	r0, #0
+ 800039c:	4770      	bx	lr
+        return EPERM;
+ 800039e:	2001      	movs	r0, #1
+}
+ 80003a0:	4770      	bx	lr
+ 80003a2:	bf00      	nop
+ 80003a4:	2009e000 	.word	0x2009e000
+
+080003a8 <firewall_dispatch>:
+//
+    __attribute__ ((used))
+    int
+firewall_dispatch(int method_num, uint8_t *buf_io, int len_in,
+                        uint32_t arg2, uint32_t incoming_sp, uint32_t incoming_lr)
+{
+ 80003a8:	b570      	push	{r4, r5, r6, lr}
+ 80003aa:	b09e      	sub	sp, #120	; 0x78
+ 80003ac:	460d      	mov	r5, r1
+ 80003ae:	9c23      	ldr	r4, [sp, #140]	; 0x8c
+ 80003b0:	9301      	str	r3, [sp, #4]
+  __ASM volatile ("cpsid i" : : : "memory");
+ 80003b2:	b672      	cpsid	i
+    // in case the caller didn't already, but would just lead to a crash anyway
+    __disable_irq();
+
+    // "1=any code executed outside the protected segment will close the Firewall"
+    // "0=.. will reset the processor"
+    __HAL_FIREWALL_PREARM_DISABLE();
+ 80003b4:	4ba5      	ldr	r3, [pc, #660]	; (800064c <firewall_dispatch+0x2a4>)
+ 80003b6:	6a19      	ldr	r1, [r3, #32]
+ 80003b8:	f021 0101 	bic.w	r1, r1, #1
+ 80003bc:	6219      	str	r1, [r3, #32]
+ 80003be:	6a1b      	ldr	r3, [r3, #32]
+ 80003c0:	f003 0301 	and.w	r3, r3, #1
+ 80003c4:	9302      	str	r3, [sp, #8]
+    //   using read/write in place.
+    // - use arg2 use when a simple number is needed; never a pointer!
+    // - mpy may provide a pointer to flash if we give it a qstr or small value, and if
+    //   we're reading only, that's fine.
+
+    if(len_in > 1024) {     // arbitrary max, increase as needed
+ 80003c6:	f5b2 6f80 	cmp.w	r2, #1024	; 0x400
+    __HAL_FIREWALL_PREARM_DISABLE();
+ 80003ca:	9b02      	ldr	r3, [sp, #8]
+    if(len_in > 1024) {     // arbitrary max, increase as needed
+ 80003cc:	f300 82e3 	bgt.w	8000996 <firewall_dispatch+0x5ee>
+
+    // Use these macros
+#define REQUIRE_IN_ONLY(x)   if((rv = good_addr(buf_io, (x), len_in, true))) { goto fail; }
+#define REQUIRE_OUT(x)       if((rv = good_addr(buf_io, (x), len_in, false))) { goto fail; }
+
+    switch(method_num) {
+ 80003d0:	3001      	adds	r0, #1
+ 80003d2:	281c      	cmp	r0, #28
+ 80003d4:	f200 81b6 	bhi.w	8000744 <firewall_dispatch+0x39c>
+ 80003d8:	e8df f010 	tbh	[pc, r0, lsl #1]
+ 80003dc:	001d02f9 	.word	0x001d02f9
+ 80003e0:	00800034 	.word	0x00800034
+ 80003e4:	00d100bd 	.word	0x00d100bd
+ 80003e8:	01f300f2 	.word	0x01f300f2
+ 80003ec:	01b401b4 	.word	0x01b401b4
+ 80003f0:	01b401b4 	.word	0x01b401b4
+ 80003f4:	00fa01b4 	.word	0x00fa01b4
+ 80003f8:	01b401b4 	.word	0x01b401b4
+ 80003fc:	01240105 	.word	0x01240105
+ 8000400:	01670154 	.word	0x01670154
+ 8000404:	01f701ab 	.word	0x01f701ab
+ 8000408:	025f0206 	.word	0x025f0206
+ 800040c:	02b702a2 	.word	0x02b702a2
+ 8000410:	02cf02bf 	.word	0x02cf02bf
+ 8000414:	02eb      	.short	0x02eb
+        case 0: {
+            REQUIRE_OUT(64);
+ 8000416:	2300      	movs	r3, #0
+ 8000418:	2140      	movs	r1, #64	; 0x40
+ 800041a:	4628      	mov	r0, r5
+ 800041c:	9200      	str	r2, [sp, #0]
+ 800041e:	f7ff ffa3 	bl	8000368 <good_addr>
+ 8000422:	4604      	mov	r4, r0
+ 8000424:	bb48      	cbnz	r0, 800047a <firewall_dispatch+0xd2>
+
+            // Return my version string
+            memset(buf_io, 0, len_in);
+ 8000426:	4601      	mov	r1, r0
+ 8000428:	9a00      	ldr	r2, [sp, #0]
+ 800042a:	4628      	mov	r0, r5
+ 800042c:	f00d f954 	bl	800d6d8 <memset>
+            strlcpy((char *)buf_io, version_string, len_in);
+ 8000430:	9a00      	ldr	r2, [sp, #0]
+ 8000432:	4987      	ldr	r1, [pc, #540]	; (8000650 <firewall_dispatch+0x2a8>)
+ 8000434:	4628      	mov	r0, r5
+ 8000436:	f00d f96d 	bl	800d714 <strlcpy>
+
+            rv = strlen(version_string);
+ 800043a:	4885      	ldr	r0, [pc, #532]	; (8000650 <firewall_dispatch+0x2a8>)
+ 800043c:	f00d f97f 	bl	800d73e <strlen>
+            ae_setup();
+            ae_keep_alive();
+            switch(arg2) {
+                default:
+                case 0:     // read state
+                    rv = ae_get_gpio();
+ 8000440:	4604      	mov	r4, r0
+                    break;
+ 8000442:	e01a      	b.n	800047a <firewall_dispatch+0xd2>
+            REQUIRE_OUT(32);
+ 8000444:	2300      	movs	r3, #0
+ 8000446:	2120      	movs	r1, #32
+ 8000448:	4628      	mov	r0, r5
+ 800044a:	f7ff ff8d 	bl	8000368 <good_addr>
+ 800044e:	4604      	mov	r4, r0
+ 8000450:	b998      	cbnz	r0, 800047a <firewall_dispatch+0xd2>
+            sha256_init(&ctx);
+ 8000452:	a80b      	add	r0, sp, #44	; 0x2c
+ 8000454:	f005 f84c 	bl	80054f0 <sha256_init>
+            sha256_update(&ctx, (void *)&arg2, 4);
+ 8000458:	2204      	movs	r2, #4
+ 800045a:	eb0d 0102 	add.w	r1, sp, r2
+ 800045e:	a80b      	add	r0, sp, #44	; 0x2c
+ 8000460:	f005 f854 	bl	800550c <sha256_update>
+            sha256_update(&ctx, (void *)BL_FLASH_BASE, BL_FLASH_SIZE);
+ 8000464:	f04f 6100 	mov.w	r1, #134217728	; 0x8000000
+ 8000468:	a80b      	add	r0, sp, #44	; 0x2c
+ 800046a:	f44f 32e0 	mov.w	r2, #114688	; 0x1c000
+ 800046e:	f005 f84d 	bl	800550c <sha256_update>
+            sha256_final(&ctx, buf_io);
+ 8000472:	4629      	mov	r1, r5
+ 8000474:	a80b      	add	r0, sp, #44	; 0x2c
+ 8000476:	f005 f88f 	bl	8005598 <sha256_final>
+
+fail:
+
+    // Precaution: we don't want to leave SE1 authorized for any specific keys,
+    // perhaps due to an error path we didn't see. Always reset the chip.
+    ae_reset_chip();
+ 800047a:	f002 faab 	bl	80029d4 <ae_reset_chip>
+
+    // Unlikely it matters, but clear flash memory cache.
+    __HAL_FLASH_DATA_CACHE_DISABLE();
+ 800047e:	4b75      	ldr	r3, [pc, #468]	; (8000654 <firewall_dispatch+0x2ac>)
+ 8000480:	681a      	ldr	r2, [r3, #0]
+ 8000482:	f422 6280 	bic.w	r2, r2, #1024	; 0x400
+ 8000486:	601a      	str	r2, [r3, #0]
+    __HAL_FLASH_DATA_CACHE_RESET();
+ 8000488:	681a      	ldr	r2, [r3, #0]
+ 800048a:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 800048e:	601a      	str	r2, [r3, #0]
+ 8000490:	681a      	ldr	r2, [r3, #0]
+ 8000492:	f422 5280 	bic.w	r2, r2, #4096	; 0x1000
+ 8000496:	601a      	str	r2, [r3, #0]
+    __HAL_FLASH_DATA_CACHE_ENABLE();
+ 8000498:	681a      	ldr	r2, [r3, #0]
+ 800049a:	f442 6280 	orr.w	r2, r2, #1024	; 0x400
+ 800049e:	601a      	str	r2, [r3, #0]
+
+    // .. and instruction memory (flash cache too?)
+    __HAL_FLASH_INSTRUCTION_CACHE_DISABLE();
+ 80004a0:	681a      	ldr	r2, [r3, #0]
+ 80004a2:	f422 7200 	bic.w	r2, r2, #512	; 0x200
+ 80004a6:	601a      	str	r2, [r3, #0]
+    __HAL_FLASH_INSTRUCTION_CACHE_RESET();
+ 80004a8:	681a      	ldr	r2, [r3, #0]
+ 80004aa:	f442 6200 	orr.w	r2, r2, #2048	; 0x800
+ 80004ae:	601a      	str	r2, [r3, #0]
+ 80004b0:	681a      	ldr	r2, [r3, #0]
+ 80004b2:	f422 6200 	bic.w	r2, r2, #2048	; 0x800
+ 80004b6:	601a      	str	r2, [r3, #0]
+    __HAL_FLASH_INSTRUCTION_CACHE_ENABLE();
+ 80004b8:	681a      	ldr	r2, [r3, #0]
+ 80004ba:	f442 7200 	orr.w	r2, r2, #512	; 0x200
+ 80004be:	601a      	str	r2, [r3, #0]
+
+    // authorize return from firewall into user's code
+    __HAL_FIREWALL_PREARM_ENABLE();
+ 80004c0:	f5a3 3382 	sub.w	r3, r3, #66560	; 0x10400
+
+    return rv;
+}
+ 80004c4:	4620      	mov	r0, r4
+    __HAL_FIREWALL_PREARM_ENABLE();
+ 80004c6:	6a1a      	ldr	r2, [r3, #32]
+ 80004c8:	f042 0201 	orr.w	r2, r2, #1
+ 80004cc:	621a      	str	r2, [r3, #32]
+ 80004ce:	6a1b      	ldr	r3, [r3, #32]
+ 80004d0:	f003 0301 	and.w	r3, r3, #1
+ 80004d4:	930b      	str	r3, [sp, #44]	; 0x2c
+ 80004d6:	9b0b      	ldr	r3, [sp, #44]	; 0x2c
+}
+ 80004d8:	b01e      	add	sp, #120	; 0x78
+ 80004da:	bd70      	pop	{r4, r5, r6, pc}
+// Write bag number (probably a string)
+void flash_save_bag_number(const uint8_t new_number[32]);
+
+// Are we operating in level2?
+static inline bool flash_is_security_level2(void) {
+    rng_delay();
+ 80004dc:	f002 f964 	bl	80027a8 <rng_delay>
+    return ((FLASH->OPTR & FLASH_OPTR_RDP_Msk) == 0xCC);
+ 80004e0:	4b5c      	ldr	r3, [pc, #368]	; (8000654 <firewall_dispatch+0x2ac>)
+ 80004e2:	6a1b      	ldr	r3, [r3, #32]
+ 80004e4:	b2db      	uxtb	r3, r3
+ 80004e6:	f1a3 02cc 	sub.w	r2, r3, #204	; 0xcc
+ 80004ea:	4255      	negs	r5, r2
+ 80004ec:	4155      	adcs	r5, r2
+            switch(arg2) {
+ 80004ee:	9a01      	ldr	r2, [sp, #4]
+ 80004f0:	2a02      	cmp	r2, #2
+ 80004f2:	d01c      	beq.n	800052e <firewall_dispatch+0x186>
+ 80004f4:	2a03      	cmp	r2, #3
+ 80004f6:	d01f      	beq.n	8000538 <firewall_dispatch+0x190>
+ 80004f8:	2a01      	cmp	r2, #1
+ 80004fa:	d013      	beq.n	8000524 <firewall_dispatch+0x17c>
+                    if(secure) {
+ 80004fc:	2bcc      	cmp	r3, #204	; 0xcc
+ 80004fe:	f000 8216 	beq.w	800092e <firewall_dispatch+0x586>
+                    puts("Die: DFU");
+ 8000502:	4855      	ldr	r0, [pc, #340]	; (8000658 <firewall_dispatch+0x2b0>)
+                    scr = screen_upgrading;     // was screen_dfu, but limited audience
+ 8000504:	4c55      	ldr	r4, [pc, #340]	; (800065c <firewall_dispatch+0x2b4>)
+                    puts("Die: DFU");
+ 8000506:	f004 fc83 	bl	8004e10 <puts>
+            bool secure = flash_is_security_level2();
+ 800050a:	2500      	movs	r5, #0
+            oled_setup();
+ 800050c:	f000 fc0a 	bl	8000d24 <oled_setup>
+            oled_show(scr);
+ 8000510:	4620      	mov	r0, r4
+ 8000512:	f000 fca5 	bl	8000e60 <oled_show>
+            wipe_all_sram();
+ 8000516:	f000 fa77 	bl	8000a08 <wipe_all_sram>
+            psram_wipe();
+ 800051a:	f004 fda1 	bl	8005060 <psram_wipe>
+            if(secure) {
+ 800051e:	b18d      	cbz	r5, 8000544 <firewall_dispatch+0x19c>
+                LOCKUP_FOREVER();
+ 8000520:	bf30      	wfi
+ 8000522:	e7fd      	b.n	8000520 <firewall_dispatch+0x178>
+                    puts("Die: Downgrade");
+ 8000524:	484e      	ldr	r0, [pc, #312]	; (8000660 <firewall_dispatch+0x2b8>)
+                    scr = screen_downgrade;
+ 8000526:	4c4f      	ldr	r4, [pc, #316]	; (8000664 <firewall_dispatch+0x2bc>)
+                    puts("Die: Downgrade");
+ 8000528:	f004 fc72 	bl	8004e10 <puts>
+                    break;
+ 800052c:	e7ee      	b.n	800050c <firewall_dispatch+0x164>
+                    puts("Die: Blankish");
+ 800052e:	484e      	ldr	r0, [pc, #312]	; (8000668 <firewall_dispatch+0x2c0>)
+                    scr = screen_blankish;
+ 8000530:	4c4e      	ldr	r4, [pc, #312]	; (800066c <firewall_dispatch+0x2c4>)
+                    puts("Die: Blankish");
+ 8000532:	f004 fc6d 	bl	8004e10 <puts>
+                    break;
+ 8000536:	e7e9      	b.n	800050c <firewall_dispatch+0x164>
+                    puts("Die: Brick");
+ 8000538:	484d      	ldr	r0, [pc, #308]	; (8000670 <firewall_dispatch+0x2c8>)
+                    scr = screen_brick;
+ 800053a:	4c4e      	ldr	r4, [pc, #312]	; (8000674 <firewall_dispatch+0x2cc>)
+                    puts("Die: Brick");
+ 800053c:	f004 fc68 	bl	8004e10 <puts>
+                    secure = true;      // no point going into DFU, if even possible
+ 8000540:	2501      	movs	r5, #1
+                    break;
+ 8000542:	e7e3      	b.n	800050c <firewall_dispatch+0x164>
+                memcpy(dfu_flag->magic, REBOOT_TO_DFU, sizeof(dfu_flag->magic));
+ 8000544:	494c      	ldr	r1, [pc, #304]	; (8000678 <firewall_dispatch+0x2d0>)
+ 8000546:	4a4d      	ldr	r2, [pc, #308]	; (800067c <firewall_dispatch+0x2d4>)
+ 8000548:	6808      	ldr	r0, [r1, #0]
+ 800054a:	6849      	ldr	r1, [r1, #4]
+ 800054c:	4613      	mov	r3, r2
+ 800054e:	c303      	stmia	r3!, {r0, r1}
+                dfu_flag->screen = scr;
+ 8000550:	6094      	str	r4, [r2, #8]
+                NVIC_SystemReset();
+ 8000552:	f7ff fef7 	bl	8000344 <__NVIC_SystemReset>
+            switch(arg2) { 
+ 8000556:	9b01      	ldr	r3, [sp, #4]
+ 8000558:	f033 0302 	bics.w	r3, r3, #2
+ 800055c:	d102      	bne.n	8000564 <firewall_dispatch+0x1bc>
+                    oled_show(screen_logout);
+ 800055e:	4848      	ldr	r0, [pc, #288]	; (8000680 <firewall_dispatch+0x2d8>)
+ 8000560:	f000 fc7e 	bl	8000e60 <oled_show>
+            wipe_all_sram();
+ 8000564:	f000 fa50 	bl	8000a08 <wipe_all_sram>
+            psram_wipe();
+ 8000568:	f004 fd7a 	bl	8005060 <psram_wipe>
+            if(arg2 == 2) {
+ 800056c:	9b01      	ldr	r3, [sp, #4]
+ 800056e:	2b02      	cmp	r3, #2
+ 8000570:	d103      	bne.n	800057a <firewall_dispatch+0x1d2>
+                delay_ms(100);
+ 8000572:	2064      	movs	r0, #100	; 0x64
+ 8000574:	f003 f9d6 	bl	8003924 <delay_ms>
+ 8000578:	e7eb      	b.n	8000552 <firewall_dispatch+0x1aa>
+            LOCKUP_FOREVER();
+ 800057a:	bf30      	wfi
+ 800057c:	e7fd      	b.n	800057a <firewall_dispatch+0x1d2>
+            ae_setup();
+ 800057e:	f002 fa37 	bl	80029f0 <ae_setup>
+            ae_keep_alive();
+ 8000582:	f002 fa67 	bl	8002a54 <ae_keep_alive>
+            switch(arg2) {
+ 8000586:	9b01      	ldr	r3, [sp, #4]
+ 8000588:	2b02      	cmp	r3, #2
+ 800058a:	d00a      	beq.n	80005a2 <firewall_dispatch+0x1fa>
+ 800058c:	2b03      	cmp	r3, #3
+ 800058e:	d00a      	beq.n	80005a6 <firewall_dispatch+0x1fe>
+ 8000590:	2b01      	cmp	r3, #1
+ 8000592:	d002      	beq.n	800059a <firewall_dispatch+0x1f2>
+                    rv = ae_get_gpio();
+ 8000594:	f002 ffdc 	bl	8003550 <ae_get_gpio>
+ 8000598:	e752      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = ae_set_gpio(0);
+ 800059a:	2000      	movs	r0, #0
+                    rv = ae_set_gpio(1);
+ 800059c:	f002 ffaa 	bl	80034f4 <ae_set_gpio>
+ 80005a0:	e74e      	b.n	8000440 <firewall_dispatch+0x98>
+ 80005a2:	2001      	movs	r0, #1
+ 80005a4:	e7fa      	b.n	800059c <firewall_dispatch+0x1f4>
+                    checksum_flash(fw_digest, world_digest, 0);
+ 80005a6:	2200      	movs	r2, #0
+ 80005a8:	a90b      	add	r1, sp, #44	; 0x2c
+ 80005aa:	a803      	add	r0, sp, #12
+ 80005ac:	f001 fa5a 	bl	8001a64 <checksum_flash>
+                    rv = ae_set_gpio_secure(world_digest);
+ 80005b0:	a80b      	add	r0, sp, #44	; 0x2c
+ 80005b2:	f002 ffb5 	bl	8003520 <ae_set_gpio_secure>
+ 80005b6:	4604      	mov	r4, r0
+                    oled_show(screen_blankish);
+ 80005b8:	482c      	ldr	r0, [pc, #176]	; (800066c <firewall_dispatch+0x2c4>)
+ 80005ba:	f000 fc51 	bl	8000e60 <oled_show>
+                    break;
+ 80005be:	e75c      	b.n	800047a <firewall_dispatch+0xd2>
+            ae_setup();
+ 80005c0:	f002 fa16 	bl	80029f0 <ae_setup>
+            rv = (ae_pair_unlock() != 0);
+ 80005c4:	f002 fc0a 	bl	8002ddc <ae_pair_unlock>
+ 80005c8:	1e04      	subs	r4, r0, #0
+ 80005ca:	bf18      	it	ne
+ 80005cc:	2401      	movne	r4, #1
+            break;
+ 80005ce:	e754      	b.n	800047a <firewall_dispatch+0xd2>
+            REQUIRE_OUT(1);
+ 80005d0:	2300      	movs	r3, #0
+ 80005d2:	2101      	movs	r1, #1
+ 80005d4:	4628      	mov	r0, r5
+ 80005d6:	f7ff fec7 	bl	8000368 <good_addr>
+ 80005da:	4604      	mov	r4, r0
+ 80005dc:	2800      	cmp	r0, #0
+ 80005de:	f47f af4c 	bne.w	800047a <firewall_dispatch+0xd2>
+            buf_io[0] = 0;          // NOT SUPPORTED on Mk4
+ 80005e2:	7028      	strb	r0, [r5, #0]
+            break;
+ 80005e4:	e749      	b.n	800047a <firewall_dispatch+0xd2>
+            if(len_in != 4 && len_in != 32 && len_in != 72) {
+ 80005e6:	2a04      	cmp	r2, #4
+ 80005e8:	d004      	beq.n	80005f4 <firewall_dispatch+0x24c>
+ 80005ea:	2a20      	cmp	r2, #32
+ 80005ec:	d002      	beq.n	80005f4 <firewall_dispatch+0x24c>
+ 80005ee:	2a48      	cmp	r2, #72	; 0x48
+ 80005f0:	f040 81d1 	bne.w	8000996 <firewall_dispatch+0x5ee>
+                REQUIRE_OUT(4);
+ 80005f4:	2300      	movs	r3, #0
+ 80005f6:	2104      	movs	r1, #4
+ 80005f8:	4628      	mov	r0, r5
+ 80005fa:	9200      	str	r2, [sp, #0]
+ 80005fc:	f7ff feb4 	bl	8000368 <good_addr>
+ 8000600:	4604      	mov	r4, r0
+ 8000602:	2800      	cmp	r0, #0
+ 8000604:	f47f af39 	bne.w	800047a <firewall_dispatch+0xd2>
+                ae_setup();
+ 8000608:	f002 f9f2 	bl	80029f0 <ae_setup>
+                if(ae_read_data_slot(arg2 & 0xf, buf_io, len_in)) {
+ 800060c:	9801      	ldr	r0, [sp, #4]
+ 800060e:	9a00      	ldr	r2, [sp, #0]
+ 8000610:	4629      	mov	r1, r5
+ 8000612:	f000 000f 	and.w	r0, r0, #15
+ 8000616:	f002 ff27 	bl	8003468 <ae_read_data_slot>
+            if(rv) {
+ 800061a:	2800      	cmp	r0, #0
+ 800061c:	f000 80d1 	beq.w	80007c2 <firewall_dispatch+0x41a>
+                rv = EIO;
+ 8000620:	2405      	movs	r4, #5
+ 8000622:	e72a      	b.n	800047a <firewall_dispatch+0xd2>
+            REQUIRE_OUT(MAX_PIN_LEN);
+ 8000624:	2300      	movs	r3, #0
+ 8000626:	2120      	movs	r1, #32
+ 8000628:	4628      	mov	r0, r5
+ 800062a:	f7ff fe9d 	bl	8000368 <good_addr>
+ 800062e:	4604      	mov	r4, r0
+ 8000630:	2800      	cmp	r0, #0
+ 8000632:	f47f af22 	bne.w	800047a <firewall_dispatch+0xd2>
+            if((arg2 < 1) || (arg2 > MAX_PIN_LEN)) {
+ 8000636:	9901      	ldr	r1, [sp, #4]
+ 8000638:	1e4b      	subs	r3, r1, #1
+ 800063a:	2b1f      	cmp	r3, #31
+ 800063c:	f200 81ab 	bhi.w	8000996 <firewall_dispatch+0x5ee>
+                if(pin_prefix_words((char *)buf_io, arg2, (uint32_t *)buf_io)) {
+ 8000640:	462a      	mov	r2, r5
+ 8000642:	4628      	mov	r0, r5
+ 8000644:	f003 fc8e 	bl	8003f64 <pin_prefix_words>
+ 8000648:	e7e7      	b.n	800061a <firewall_dispatch+0x272>
+ 800064a:	bf00      	nop
+ 800064c:	40011c00 	.word	0x40011c00
+ 8000650:	0800e7a8 	.word	0x0800e7a8
+ 8000654:	40022000 	.word	0x40022000
+ 8000658:	0800d766 	.word	0x0800d766
+ 800065c:	0800e211 	.word	0x0800e211
+ 8000660:	0800d76f 	.word	0x0800d76f
+ 8000664:	0800db00 	.word	0x0800db00
+ 8000668:	0800d77e 	.word	0x0800d77e
+ 800066c:	0800d864 	.word	0x0800d864
+ 8000670:	0800d78c 	.word	0x0800d78c
+ 8000674:	0800d891 	.word	0x0800d891
+ 8000678:	0800d797 	.word	0x0800d797
+ 800067c:	20008000 	.word	0x20008000
+ 8000680:	0800dc1c 	.word	0x0800dc1c
+            REQUIRE_OUT(32);
+ 8000684:	2300      	movs	r3, #0
+ 8000686:	2120      	movs	r1, #32
+ 8000688:	4628      	mov	r0, r5
+ 800068a:	f7ff fe6d 	bl	8000368 <good_addr>
+ 800068e:	4604      	mov	r4, r0
+ 8000690:	2800      	cmp	r0, #0
+ 8000692:	f47f aef2 	bne.w	800047a <firewall_dispatch+0xd2>
+            memset(buf_io, 0x55, 32);       // to help show errors
+ 8000696:	2220      	movs	r2, #32
+ 8000698:	2155      	movs	r1, #85	; 0x55
+ 800069a:	4628      	mov	r0, r5
+ 800069c:	f00d f81c 	bl	800d6d8 <memset>
+            rng_buffer(buf_io, 32);
+ 80006a0:	2120      	movs	r1, #32
+ 80006a2:	4628      	mov	r0, r5
+ 80006a4:	f002 f86a 	bl	800277c <rng_buffer>
+            break;
+ 80006a8:	e6e7      	b.n	800047a <firewall_dispatch+0xd2>
+            REQUIRE_OUT(PIN_ATTEMPT_SIZE_V2);
+ 80006aa:	2300      	movs	r3, #0
+ 80006ac:	f44f 718c 	mov.w	r1, #280	; 0x118
+ 80006b0:	4628      	mov	r0, r5
+ 80006b2:	9200      	str	r2, [sp, #0]
+ 80006b4:	f7ff fe58 	bl	8000368 <good_addr>
+ 80006b8:	4604      	mov	r4, r0
+ 80006ba:	2800      	cmp	r0, #0
+ 80006bc:	f47f aedd 	bne.w	800047a <firewall_dispatch+0xd2>
+            switch(arg2) {
+ 80006c0:	e9dd 2300 	ldrd	r2, r3, [sp]
+ 80006c4:	2b08      	cmp	r3, #8
+ 80006c6:	d83d      	bhi.n	8000744 <firewall_dispatch+0x39c>
+ 80006c8:	e8df f003 	tbb	[pc, r3]
+ 80006cc:	110d0905 	.word	0x110d0905
+ 80006d0:	221d1915 	.word	0x221d1915
+ 80006d4:	26          	.byte	0x26
+ 80006d5:	00          	.byte	0x00
+                    rv = pin_setup_attempt(args);
+ 80006d6:	4628      	mov	r0, r5
+ 80006d8:	f003 fc62 	bl	8003fa0 <pin_setup_attempt>
+ 80006dc:	e6b0      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = pin_delay(args);
+ 80006de:	4628      	mov	r0, r5
+ 80006e0:	f003 fccc 	bl	800407c <pin_delay>
+ 80006e4:	e6ac      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = pin_login_attempt(args);
+ 80006e6:	4628      	mov	r0, r5
+ 80006e8:	f003 fcca 	bl	8004080 <pin_login_attempt>
+ 80006ec:	e6a8      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = pin_change(args);
+ 80006ee:	4628      	mov	r0, r5
+ 80006f0:	f003 fdd4 	bl	800429c <pin_change>
+ 80006f4:	e6a4      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = pin_fetch_secret(args);
+ 80006f6:	4628      	mov	r0, r5
+ 80006f8:	f003 fe88 	bl	800440c <pin_fetch_secret>
+ 80006fc:	e6a0      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = pin_firmware_greenlight(args);
+ 80006fe:	4628      	mov	r0, r5
+ 8000700:	f004 f844 	bl	800478c <pin_firmware_greenlight>
+ 8000704:	e69c      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = pin_long_secret(args, NULL);
+ 8000706:	2100      	movs	r1, #0
+                    rv = pin_long_secret(args, &buf_io[PIN_ATTEMPT_SIZE_V2]);
+ 8000708:	4628      	mov	r0, r5
+ 800070a:	f003 ff81 	bl	8004610 <pin_long_secret>
+ 800070e:	e697      	b.n	8000440 <firewall_dispatch+0x98>
+                    rv = pin_firmware_upgrade(args);
+ 8000710:	4628      	mov	r0, r5
+ 8000712:	f004 f87b 	bl	800480c <pin_firmware_upgrade>
+ 8000716:	e693      	b.n	8000440 <firewall_dispatch+0x98>
+                    REQUIRE_OUT(PIN_ATTEMPT_SIZE_V2 + AE_LONG_SECRET_LEN);
+ 8000718:	2300      	movs	r3, #0
+ 800071a:	f44f 712e 	mov.w	r1, #696	; 0x2b8
+ 800071e:	4628      	mov	r0, r5
+ 8000720:	f7ff fe22 	bl	8000368 <good_addr>
+ 8000724:	4604      	mov	r4, r0
+ 8000726:	2800      	cmp	r0, #0
+ 8000728:	f47f aea7 	bne.w	800047a <firewall_dispatch+0xd2>
+                    rv = pin_long_secret(args, &buf_io[PIN_ATTEMPT_SIZE_V2]);
+ 800072c:	f505 718c 	add.w	r1, r5, #280	; 0x118
+ 8000730:	e7ea      	b.n	8000708 <firewall_dispatch+0x360>
+            switch(arg2) {
+ 8000732:	9b01      	ldr	r3, [sp, #4]
+ 8000734:	2b64      	cmp	r3, #100	; 0x64
+ 8000736:	d041      	beq.n	80007bc <firewall_dispatch+0x414>
+ 8000738:	d806      	bhi.n	8000748 <firewall_dispatch+0x3a0>
+ 800073a:	2b01      	cmp	r3, #1
+ 800073c:	d01e      	beq.n	800077c <firewall_dispatch+0x3d4>
+ 800073e:	2b02      	cmp	r3, #2
+ 8000740:	d028      	beq.n	8000794 <firewall_dispatch+0x3ec>
+ 8000742:	b13b      	cbz	r3, 8000754 <firewall_dispatch+0x3ac>
+ 8000744:	2402      	movs	r4, #2
+ 8000746:	e698      	b.n	800047a <firewall_dispatch+0xd2>
+ 8000748:	2b65      	cmp	r3, #101	; 0x65
+ 800074a:	d03c      	beq.n	80007c6 <firewall_dispatch+0x41e>
+ 800074c:	2b66      	cmp	r3, #102	; 0x66
+ 800074e:	d1f9      	bne.n	8000744 <firewall_dispatch+0x39c>
+                    flash_lockdown_hard(OB_RDP_LEVEL_2);        // No change possible after this.
+ 8000750:	20cc      	movs	r0, #204	; 0xcc
+ 8000752:	e034      	b.n	80007be <firewall_dispatch+0x416>
+                    REQUIRE_OUT(32);
+ 8000754:	2120      	movs	r1, #32
+ 8000756:	4628      	mov	r0, r5
+ 8000758:	f7ff fe06 	bl	8000368 <good_addr>
+ 800075c:	4604      	mov	r4, r0
+ 800075e:	2800      	cmp	r0, #0
+ 8000760:	f47f ae8b 	bne.w	800047a <firewall_dispatch+0xd2>
+                    memcpy(buf_io, rom_secrets->bag_number, 32);
+ 8000764:	4aa1      	ldr	r2, [pc, #644]	; (80009ec <firewall_dispatch+0x644>)
+ 8000766:	4ea2      	ldr	r6, [pc, #648]	; (80009f0 <firewall_dispatch+0x648>)
+ 8000768:	4613      	mov	r3, r2
+ 800076a:	cb03      	ldmia	r3!, {r0, r1}
+ 800076c:	42b3      	cmp	r3, r6
+ 800076e:	6028      	str	r0, [r5, #0]
+ 8000770:	6069      	str	r1, [r5, #4]
+ 8000772:	461a      	mov	r2, r3
+ 8000774:	f105 0508 	add.w	r5, r5, #8
+ 8000778:	d1f6      	bne.n	8000768 <firewall_dispatch+0x3c0>
+ 800077a:	e67e      	b.n	800047a <firewall_dispatch+0xd2>
+                    REQUIRE_IN_ONLY(32);
+ 800077c:	2120      	movs	r1, #32
+ 800077e:	4628      	mov	r0, r5
+ 8000780:	f7ff fdf2 	bl	8000368 <good_addr>
+ 8000784:	4604      	mov	r4, r0
+ 8000786:	2800      	cmp	r0, #0
+ 8000788:	f47f ae77 	bne.w	800047a <firewall_dispatch+0xd2>
+                    flash_save_bag_number(buf_io);
+ 800078c:	4628      	mov	r0, r5
+ 800078e:	f001 fd0f 	bl	80021b0 <flash_save_bag_number>
+                    break;
+ 8000792:	e672      	b.n	800047a <firewall_dispatch+0xd2>
+                    REQUIRE_OUT(1);
+ 8000794:	2300      	movs	r3, #0
+ 8000796:	2101      	movs	r1, #1
+ 8000798:	4628      	mov	r0, r5
+ 800079a:	f7ff fde5 	bl	8000368 <good_addr>
+ 800079e:	4604      	mov	r4, r0
+ 80007a0:	2800      	cmp	r0, #0
+ 80007a2:	f47f ae6a 	bne.w	800047a <firewall_dispatch+0xd2>
+    rng_delay();
+ 80007a6:	f001 ffff 	bl	80027a8 <rng_delay>
+    return ((FLASH->OPTR & FLASH_OPTR_RDP_Msk) == 0xCC);
+ 80007aa:	4b92      	ldr	r3, [pc, #584]	; (80009f4 <firewall_dispatch+0x64c>)
+ 80007ac:	6a1b      	ldr	r3, [r3, #32]
+ 80007ae:	b2db      	uxtb	r3, r3
+                    buf_io[0] = (flash_is_security_level2() ? 2 : 0xff);
+ 80007b0:	2bcc      	cmp	r3, #204	; 0xcc
+ 80007b2:	bf0c      	ite	eq
+ 80007b4:	2302      	moveq	r3, #2
+ 80007b6:	23ff      	movne	r3, #255	; 0xff
+                    buf_io[0] = 32;
+ 80007b8:	702b      	strb	r3, [r5, #0]
+                    break;
+ 80007ba:	e65e      	b.n	800047a <firewall_dispatch+0xd2>
+                    flash_lockdown_hard(OB_RDP_LEVEL_0);        // wipes contents of flash (1->0)
+ 80007bc:	20aa      	movs	r0, #170	; 0xaa
+                    flash_lockdown_hard(OB_RDP_LEVEL_2);        // No change possible after this.
+ 80007be:	f001 fdf9 	bl	80023b4 <flash_lockdown_hard>
+    int rv = 0;
+ 80007c2:	2400      	movs	r4, #0
+                    break;
+ 80007c4:	e659      	b.n	800047a <firewall_dispatch+0xd2>
+                    flash_lockdown_hard(OB_RDP_LEVEL_1);        // Can only do 0->1 (experiments)
+ 80007c6:	20bb      	movs	r0, #187	; 0xbb
+ 80007c8:	e7f9      	b.n	80007be <firewall_dispatch+0x416>
+            REQUIRE_OUT(128);
+ 80007ca:	2300      	movs	r3, #0
+ 80007cc:	2180      	movs	r1, #128	; 0x80
+ 80007ce:	4628      	mov	r0, r5
+ 80007d0:	f7ff fdca 	bl	8000368 <good_addr>
+ 80007d4:	4604      	mov	r4, r0
+ 80007d6:	2800      	cmp	r0, #0
+ 80007d8:	f47f ae4f 	bne.w	800047a <firewall_dispatch+0xd2>
+            ae_setup();
+ 80007dc:	f002 f908 	bl	80029f0 <ae_setup>
+            rv = ae_config_read(buf_io);
+ 80007e0:	4628      	mov	r0, r5
+ 80007e2:	f002 ff06 	bl	80035f2 <ae_config_read>
+ 80007e6:	e718      	b.n	800061a <firewall_dispatch+0x272>
+            switch(arg2) {
+ 80007e8:	9b01      	ldr	r3, [sp, #4]
+ 80007ea:	2b03      	cmp	r3, #3
+ 80007ec:	d8aa      	bhi.n	8000744 <firewall_dispatch+0x39c>
+ 80007ee:	e8df f003 	tbb	[pc, r3]
+ 80007f2:	0f02      	.short	0x0f02
+ 80007f4:	441d      	.short	0x441d
+                    REQUIRE_OUT(8);
+ 80007f6:	2300      	movs	r3, #0
+ 80007f8:	2108      	movs	r1, #8
+ 80007fa:	4628      	mov	r0, r5
+ 80007fc:	f7ff fdb4 	bl	8000368 <good_addr>
+ 8000800:	4604      	mov	r4, r0
+ 8000802:	2800      	cmp	r0, #0
+ 8000804:	f47f ae39 	bne.w	800047a <firewall_dispatch+0xd2>
+                    get_min_version(buf_io);
+ 8000808:	4628      	mov	r0, r5
+ 800080a:	f001 f9bb 	bl	8001b84 <get_min_version>
+                    break;
+ 800080e:	e634      	b.n	800047a <firewall_dispatch+0xd2>
+                    REQUIRE_IN_ONLY(8);
+ 8000810:	2301      	movs	r3, #1
+ 8000812:	2108      	movs	r1, #8
+ 8000814:	4628      	mov	r0, r5
+ 8000816:	f7ff fda7 	bl	8000368 <good_addr>
+ 800081a:	4604      	mov	r4, r0
+ 800081c:	2800      	cmp	r0, #0
+ 800081e:	f47f ae2c 	bne.w	800047a <firewall_dispatch+0xd2>
+                    rv = check_is_downgrade(buf_io, NULL);
+ 8000822:	4601      	mov	r1, r0
+ 8000824:	4628      	mov	r0, r5
+ 8000826:	f001 f9cd 	bl	8001bc4 <check_is_downgrade>
+ 800082a:	e609      	b.n	8000440 <firewall_dispatch+0x98>
+                    REQUIRE_IN_ONLY(8);
+ 800082c:	2301      	movs	r3, #1
+ 800082e:	2108      	movs	r1, #8
+ 8000830:	4628      	mov	r0, r5
+ 8000832:	f7ff fd99 	bl	8000368 <good_addr>
+ 8000836:	4604      	mov	r4, r0
+ 8000838:	2800      	cmp	r0, #0
+ 800083a:	f47f ae1e 	bne.w	800047a <firewall_dispatch+0xd2>
+                    if(buf_io[0] < 0x10 || buf_io[0] >= 0x40) {
+ 800083e:	782b      	ldrb	r3, [r5, #0]
+ 8000840:	3b10      	subs	r3, #16
+                        rv = ERANGE;
+ 8000842:	2b2f      	cmp	r3, #47	; 0x2f
+                    } if(check_is_downgrade(buf_io, NULL)) {
+ 8000844:	4601      	mov	r1, r0
+ 8000846:	4628      	mov	r0, r5
+                        rv = ERANGE;
+ 8000848:	bf88      	it	hi
+ 800084a:	2422      	movhi	r4, #34	; 0x22
+                    } if(check_is_downgrade(buf_io, NULL)) {
+ 800084c:	f001 f9ba 	bl	8001bc4 <check_is_downgrade>
+ 8000850:	2800      	cmp	r0, #0
+ 8000852:	f040 80c8 	bne.w	80009e6 <firewall_dispatch+0x63e>
+                        get_min_version(min);
+ 8000856:	a80b      	add	r0, sp, #44	; 0x2c
+ 8000858:	f001 f994 	bl	8001b84 <get_min_version>
+                        if(memcmp(min, buf_io, 8) == 0) {
+ 800085c:	2208      	movs	r2, #8
+ 800085e:	4629      	mov	r1, r5
+ 8000860:	a80b      	add	r0, sp, #44	; 0x2c
+ 8000862:	f00c ff01 	bl	800d668 <memcmp>
+ 8000866:	2800      	cmp	r0, #0
+ 8000868:	f000 80bd 	beq.w	80009e6 <firewall_dispatch+0x63e>
+                            if(record_highwater_version(buf_io)) {
+ 800086c:	4628      	mov	r0, r5
+ 800086e:	f001 fdbb 	bl	80023e8 <record_highwater_version>
+                                rv = ENOMEM;
+ 8000872:	2800      	cmp	r0, #0
+ 8000874:	bf18      	it	ne
+ 8000876:	240c      	movne	r4, #12
+ 8000878:	e5ff      	b.n	800047a <firewall_dispatch+0xd2>
+                    REQUIRE_OUT(4);
+ 800087a:	2300      	movs	r3, #0
+ 800087c:	2104      	movs	r1, #4
+ 800087e:	4628      	mov	r0, r5
+ 8000880:	f7ff fd72 	bl	8000368 <good_addr>
+ 8000884:	4604      	mov	r4, r0
+ 8000886:	2800      	cmp	r0, #0
+ 8000888:	f47f adf7 	bne.w	800047a <firewall_dispatch+0xd2>
+                    ae_setup();
+ 800088c:	f002 f8b0 	bl	80029f0 <ae_setup>
+                    rv = ae_get_counter((uint32_t *)buf_io, 0) ? EIO: 0;
+ 8000890:	4621      	mov	r1, r4
+ 8000892:	4628      	mov	r0, r5
+ 8000894:	f002 fc9d 	bl	80031d2 <ae_get_counter>
+ 8000898:	e6bf      	b.n	800061a <firewall_dispatch+0x272>
+            REQUIRE_OUT(PIN_ATTEMPT_SIZE_V2 + sizeof(trick_slot_t));
+ 800089a:	2300      	movs	r3, #0
+ 800089c:	f44f 71cc 	mov.w	r1, #408	; 0x198
+ 80008a0:	4628      	mov	r0, r5
+ 80008a2:	f7ff fd61 	bl	8000368 <good_addr>
+ 80008a6:	4604      	mov	r4, r0
+ 80008a8:	2800      	cmp	r0, #0
+ 80008aa:	f47f ade6 	bne.w	800047a <firewall_dispatch+0xd2>
+            rv = pin_check_logged_in(args, &trick_mode);
+ 80008ae:	a90b      	add	r1, sp, #44	; 0x2c
+ 80008b0:	4628      	mov	r0, r5
+ 80008b2:	f003 fcc1 	bl	8004238 <pin_check_logged_in>
+            if(rv) goto fail;
+ 80008b6:	4604      	mov	r4, r0
+ 80008b8:	2800      	cmp	r0, #0
+ 80008ba:	f47f adde 	bne.w	800047a <firewall_dispatch+0xd2>
+            if(trick_mode) {
+ 80008be:	f89d 302c 	ldrb.w	r3, [sp, #44]	; 0x2c
+ 80008c2:	b10b      	cbz	r3, 80008c8 <firewall_dispatch+0x520>
+                mcu_key_clear(NULL);
+ 80008c4:	f001 fdde 	bl	8002484 <mcu_key_clear>
+            switch(arg2) {
+ 80008c8:	9b01      	ldr	r3, [sp, #4]
+ 80008ca:	2b01      	cmp	r3, #1
+            trick_slot_t *slot = (trick_slot_t *)(&buf_io[PIN_ATTEMPT_SIZE_V2]);
+ 80008cc:	f505 728c 	add.w	r2, r5, #280	; 0x118
+            switch(arg2) {
+ 80008d0:	d00c      	beq.n	80008ec <firewall_dispatch+0x544>
+ 80008d2:	2b02      	cmp	r3, #2
+ 80008d4:	d01b      	beq.n	800090e <firewall_dispatch+0x566>
+ 80008d6:	2b00      	cmp	r3, #0
+ 80008d8:	f47f af34 	bne.w	8000744 <firewall_dispatch+0x39c>
+                    if(!trick_mode) {
+ 80008dc:	f89d 302c 	ldrb.w	r3, [sp, #44]	; 0x2c
+ 80008e0:	2b00      	cmp	r3, #0
+ 80008e2:	f47f adca 	bne.w	800047a <firewall_dispatch+0xd2>
+                        se2_clear_tricks();
+ 80008e6:	f007 fa63 	bl	8007db0 <se2_clear_tricks>
+ 80008ea:	e5c6      	b.n	800047a <firewall_dispatch+0xd2>
+                    if(trick_mode) {
+ 80008ec:	f89d 102c 	ldrb.w	r1, [sp, #44]	; 0x2c
+ 80008f0:	2900      	cmp	r1, #0
+ 80008f2:	f47f af27 	bne.w	8000744 <firewall_dispatch+0x39c>
+                        if(slot->pin_len > 16) {
+ 80008f6:	f8d5 1170 	ldr.w	r1, [r5, #368]	; 0x170
+ 80008fa:	2910      	cmp	r1, #16
+ 80008fc:	dc4b      	bgt.n	8000996 <firewall_dispatch+0x5ee>
+                        if(se2_test_trick_pin(slot->pin, slot->pin_len, slot, true)) {
+ 80008fe:	f505 70b0 	add.w	r0, r5, #352	; 0x160
+ 8000902:	f007 fabb 	bl	8007e7c <se2_test_trick_pin>
+ 8000906:	2800      	cmp	r0, #0
+ 8000908:	f47f adb7 	bne.w	800047a <firewall_dispatch+0xd2>
+ 800090c:	e71a      	b.n	8000744 <firewall_dispatch+0x39c>
+                    if(!trick_mode) {
+ 800090e:	f89d 302c 	ldrb.w	r3, [sp, #44]	; 0x2c
+ 8000912:	2b00      	cmp	r3, #0
+ 8000914:	f47f adb1 	bne.w	800047a <firewall_dispatch+0xd2>
+                        rv = se2_save_trick(slot);
+ 8000918:	4610      	mov	r0, r2
+ 800091a:	f007 fbcf 	bl	80080bc <se2_save_trick>
+ 800091e:	e58f      	b.n	8000440 <firewall_dispatch+0x98>
+            if(arg2 == 0xBeef) {
+ 8000920:	9b01      	ldr	r3, [sp, #4]
+ 8000922:	f64b 62ef 	movw	r2, #48879	; 0xbeef
+ 8000926:	4293      	cmp	r3, r2
+ 8000928:	d103      	bne.n	8000932 <firewall_dispatch+0x58a>
+                fast_wipe();
+ 800092a:	f001 fe9d 	bl	8002668 <fast_wipe>
+            rv = EPERM;
+ 800092e:	2401      	movs	r4, #1
+ 8000930:	e5a3      	b.n	800047a <firewall_dispatch+0xd2>
+            } else if(arg2 == 0xDead) {
+ 8000932:	f64d 62ad 	movw	r2, #57005	; 0xdead
+ 8000936:	4293      	cmp	r3, r2
+ 8000938:	d1f9      	bne.n	800092e <firewall_dispatch+0x586>
+                mcu_key_clear(NULL);
+ 800093a:	2000      	movs	r0, #0
+ 800093c:	f001 fda2 	bl	8002484 <mcu_key_clear>
+                oled_show(screen_wiped);
+ 8000940:	482d      	ldr	r0, [pc, #180]	; (80009f8 <firewall_dispatch+0x650>)
+ 8000942:	f000 fa8d 	bl	8000e60 <oled_show>
+                LOCKUP_FOREVER();
+ 8000946:	bf30      	wfi
+ 8000948:	e7fd      	b.n	8000946 <firewall_dispatch+0x59e>
+            if(arg2 == 0xDead) fast_brick();
+ 800094a:	9a01      	ldr	r2, [sp, #4]
+ 800094c:	f64d 63ad 	movw	r3, #57005	; 0xdead
+ 8000950:	429a      	cmp	r2, r3
+ 8000952:	d1ec      	bne.n	800092e <firewall_dispatch+0x586>
+ 8000954:	f001 fe5a 	bl	800260c <fast_brick>
+ 8000958:	e7e9      	b.n	800092e <firewall_dispatch+0x586>
+            REQUIRE_OUT(8);
+ 800095a:	2300      	movs	r3, #0
+ 800095c:	2108      	movs	r1, #8
+ 800095e:	4628      	mov	r0, r5
+ 8000960:	f7ff fd02 	bl	8000368 <good_addr>
+ 8000964:	4604      	mov	r4, r0
+ 8000966:	2800      	cmp	r0, #0
+ 8000968:	f47f ad87 	bne.w	800047a <firewall_dispatch+0xd2>
+            mcu_key_usage(avail, consumed, total);
+ 800096c:	f105 0208 	add.w	r2, r5, #8
+ 8000970:	1d29      	adds	r1, r5, #4
+ 8000972:	4628      	mov	r0, r5
+ 8000974:	f001 fdb4 	bl	80024e0 <mcu_key_usage>
+            break;
+ 8000978:	e57f      	b.n	800047a <firewall_dispatch+0xd2>
+            REQUIRE_OUT(33);
+ 800097a:	2300      	movs	r3, #0
+ 800097c:	2121      	movs	r1, #33	; 0x21
+ 800097e:	4628      	mov	r0, r5
+ 8000980:	f7ff fcf2 	bl	8000368 <good_addr>
+ 8000984:	4604      	mov	r4, r0
+ 8000986:	2800      	cmp	r0, #0
+ 8000988:	f47f ad77 	bne.w	800047a <firewall_dispatch+0xd2>
+            switch(arg2) {
+ 800098c:	9b01      	ldr	r3, [sp, #4]
+ 800098e:	2b01      	cmp	r3, #1
+ 8000990:	d003      	beq.n	800099a <firewall_dispatch+0x5f2>
+ 8000992:	2b02      	cmp	r3, #2
+ 8000994:	d008      	beq.n	80009a8 <firewall_dispatch+0x600>
+        rv = ERANGE;
+ 8000996:	2422      	movs	r4, #34	; 0x22
+ 8000998:	e56f      	b.n	800047a <firewall_dispatch+0xd2>
+                    ae_setup();
+ 800099a:	f002 f829 	bl	80029f0 <ae_setup>
+                    ae_secure_random(&buf_io[1]);
+ 800099e:	1c68      	adds	r0, r5, #1
+ 80009a0:	f002 fb8e 	bl	80030c0 <ae_secure_random>
+                    buf_io[0] = 32;
+ 80009a4:	2320      	movs	r3, #32
+ 80009a6:	e707      	b.n	80007b8 <firewall_dispatch+0x410>
+                    se2_read_rng(&buf_io[1]);
+ 80009a8:	1c68      	adds	r0, r5, #1
+ 80009aa:	f007 fd6b 	bl	8008484 <se2_read_rng>
+                    buf_io[0] = 8;
+ 80009ae:	2308      	movs	r3, #8
+ 80009b0:	e702      	b.n	80007b8 <firewall_dispatch+0x410>
+            REQUIRE_OUT(80);
+ 80009b2:	2300      	movs	r3, #0
+ 80009b4:	2150      	movs	r1, #80	; 0x50
+ 80009b6:	4628      	mov	r0, r5
+ 80009b8:	f7ff fcd6 	bl	8000368 <good_addr>
+ 80009bc:	4604      	mov	r4, r0
+ 80009be:	2800      	cmp	r0, #0
+ 80009c0:	f47f ad5b 	bne.w	800047a <firewall_dispatch+0xd2>
+            strcpy((char *)buf_io, "ATECC608B\nDS28C36B");
+ 80009c4:	490d      	ldr	r1, [pc, #52]	; (80009fc <firewall_dispatch+0x654>)
+ 80009c6:	4628      	mov	r0, r5
+ 80009c8:	f00c fe9c 	bl	800d704 <strcpy>
+            break;
+ 80009cc:	e555      	b.n	800047a <firewall_dispatch+0xd2>
+            if(incoming_lr <= BL_FLASH_BASE || incoming_lr >= (uint32_t)&firewall_starts) {
+ 80009ce:	f1b4 6f00 	cmp.w	r4, #134217728	; 0x8000000
+ 80009d2:	d902      	bls.n	80009da <firewall_dispatch+0x632>
+ 80009d4:	4b0a      	ldr	r3, [pc, #40]	; (8000a00 <firewall_dispatch+0x658>)
+ 80009d6:	429c      	cmp	r4, r3
+ 80009d8:	d302      	bcc.n	80009e0 <firewall_dispatch+0x638>
+                fatal_error("LR");
+ 80009da:	480a      	ldr	r0, [pc, #40]	; (8000a04 <firewall_dispatch+0x65c>)
+ 80009dc:	f000 f834 	bl	8000a48 <fatal_error>
+                system_startup();
+ 80009e0:	f000 f890 	bl	8000b04 <system_startup>
+            break;
+ 80009e4:	e6ed      	b.n	80007c2 <firewall_dispatch+0x41a>
+                        rv = EAGAIN;
+ 80009e6:	240b      	movs	r4, #11
+ 80009e8:	e547      	b.n	800047a <firewall_dispatch+0xd2>
+ 80009ea:	bf00      	nop
+ 80009ec:	0801c050 	.word	0x0801c050
+ 80009f0:	0801c070 	.word	0x0801c070
+ 80009f4:	40022000 	.word	0x40022000
+ 80009f8:	0800e396 	.word	0x0800e396
+ 80009fc:	0800d7a0 	.word	0x0800d7a0
+ 8000a00:	08000300 	.word	0x08000300
+ 8000a04:	0800d7b3 	.word	0x0800d7b3
+
+08000a08 <wipe_all_sram>:
+//
+    static inline void
+memset4(uint32_t *dest, uint32_t value, uint32_t byte_len)
+{
+    for(; byte_len; byte_len-=4, dest++) {
+        *dest = value;
+ 8000a08:	4a0a      	ldr	r2, [pc, #40]	; (8000a34 <wipe_all_sram+0x2c>)
+    for(; byte_len; byte_len-=4, dest++) {
+ 8000a0a:	490b      	ldr	r1, [pc, #44]	; (8000a38 <wipe_all_sram+0x30>)
+
+// wipe_all_sram()
+//
+    void
+wipe_all_sram(void)
+{
+ 8000a0c:	f04f 5300 	mov.w	r3, #536870912	; 0x20000000
+        *dest = value;
+ 8000a10:	f843 2b04 	str.w	r2, [r3], #4
+    for(; byte_len; byte_len-=4, dest++) {
+ 8000a14:	428b      	cmp	r3, r1
+ 8000a16:	d1fb      	bne.n	8000a10 <wipe_all_sram+0x8>
+ 8000a18:	4908      	ldr	r1, [pc, #32]	; (8000a3c <wipe_all_sram+0x34>)
+ 8000a1a:	f04f 5380 	mov.w	r3, #268435456	; 0x10000000
+        *dest = value;
+ 8000a1e:	f843 2b04 	str.w	r2, [r3], #4
+    for(; byte_len; byte_len-=4, dest++) {
+ 8000a22:	428b      	cmp	r3, r1
+ 8000a24:	d1fb      	bne.n	8000a1e <wipe_all_sram+0x16>
+ 8000a26:	4b06      	ldr	r3, [pc, #24]	; (8000a40 <wipe_all_sram+0x38>)
+ 8000a28:	4906      	ldr	r1, [pc, #24]	; (8000a44 <wipe_all_sram+0x3c>)
+        *dest = value;
+ 8000a2a:	f843 2b04 	str.w	r2, [r3], #4
+    for(; byte_len; byte_len-=4, dest++) {
+ 8000a2e:	428b      	cmp	r3, r1
+ 8000a30:	d1fb      	bne.n	8000a2a <wipe_all_sram+0x22>
+    STATIC_ASSERT((SRAM3_BASE + SRAM3_SIZE) - BL_SRAM_BASE == 8192);
+
+    memset4((void *)SRAM1_BASE, noise, SRAM1_SIZE_MAX);
+    memset4((void *)SRAM2_BASE, noise, SRAM2_SIZE);
+    memset4((void *)SRAM3_BASE, noise, SRAM3_SIZE - (BL_SRAM_BASE - SRAM3_BASE));
+}
+ 8000a32:	4770      	bx	lr
+ 8000a34:	deadbeef 	.word	0xdeadbeef
+ 8000a38:	20030000 	.word	0x20030000
+ 8000a3c:	10010000 	.word	0x10010000
+ 8000a40:	20040000 	.word	0x20040000
+ 8000a44:	20042000 	.word	0x20042000
+
+08000a48 <fatal_error>:
+
+// fatal_error(const char *msg)
+//
+    void __attribute__((noreturn))
+fatal_error(const char *msgvoid)
+{
+ 8000a48:	b508      	push	{r3, lr}
+    oled_setup();
+ 8000a4a:	f000 f96b 	bl	8000d24 <oled_setup>
+    oled_show(screen_fatal);
+ 8000a4e:	4802      	ldr	r0, [pc, #8]	; (8000a58 <fatal_error+0x10>)
+ 8000a50:	f000 fa06 	bl	8000e60 <oled_show>
+    BREAKPOINT;
+#endif
+
+    // Maybe should do a reset after a delay, like with
+    // the watchdog timer or something.
+    LOCKUP_FOREVER();
+ 8000a54:	bf30      	wfi
+ 8000a56:	e7fd      	b.n	8000a54 <fatal_error+0xc>
+ 8000a58:	0800dbd8 	.word	0x0800dbd8
+
+08000a5c <fatal_mitm>:
+
+// fatal_mitm()
+//
+    void __attribute__((noreturn))
+fatal_mitm(void)
+{
+ 8000a5c:	b508      	push	{r3, lr}
+    oled_setup();
+ 8000a5e:	f000 f961 	bl	8000d24 <oled_setup>
+    oled_show(screen_mitm);
+ 8000a62:	4803      	ldr	r0, [pc, #12]	; (8000a70 <fatal_mitm+0x14>)
+ 8000a64:	f000 f9fc 	bl	8000e60 <oled_show>
+
+#ifdef RELEASE
+    wipe_all_sram();
+ 8000a68:	f7ff ffce 	bl	8000a08 <wipe_all_sram>
+#endif
+
+    LOCKUP_FOREVER();
+ 8000a6c:	bf30      	wfi
+ 8000a6e:	e7fd      	b.n	8000a6c <fatal_mitm+0x10>
+ 8000a70:	0800dcdc 	.word	0x0800dcdc
+
+08000a74 <enter_dfu>:
+
+// enter_dfu()
+//
+    void __attribute__((noreturn))
+enter_dfu(void)
+{
+ 8000a74:	b507      	push	{r0, r1, r2, lr}
+    puts("enter_dfu()");
+ 8000a76:	481f      	ldr	r0, [pc, #124]	; (8000af4 <enter_dfu+0x80>)
+ 8000a78:	f004 f9ca 	bl	8004e10 <puts>
+
+    // clear the green light, if set
+    ae_setup();
+ 8000a7c:	f001 ffb8 	bl	80029f0 <ae_setup>
+    ae_set_gpio(0);
+ 8000a80:	2000      	movs	r0, #0
+ 8000a82:	f002 fd37 	bl	80034f4 <ae_set_gpio>
+
+    // Reset huge parts of the chip
+    __HAL_RCC_APB1_FORCE_RESET();
+ 8000a86:	4b1c      	ldr	r3, [pc, #112]	; (8000af8 <enter_dfu+0x84>)
+ 8000a88:	f04f 31ff 	mov.w	r1, #4294967295	; 0xffffffff
+    __HAL_RCC_APB1_RELEASE_RESET();
+ 8000a8c:	2200      	movs	r2, #0
+    __HAL_RCC_APB1_FORCE_RESET();
+ 8000a8e:	6399      	str	r1, [r3, #56]	; 0x38
+ 8000a90:	63d9      	str	r1, [r3, #60]	; 0x3c
+    __HAL_RCC_APB1_RELEASE_RESET();
+ 8000a92:	639a      	str	r2, [r3, #56]	; 0x38
+ 8000a94:	63da      	str	r2, [r3, #60]	; 0x3c
+
+    __HAL_RCC_APB2_FORCE_RESET();
+ 8000a96:	6419      	str	r1, [r3, #64]	; 0x40
+    __HAL_RCC_APB2_RELEASE_RESET();
+ 8000a98:	641a      	str	r2, [r3, #64]	; 0x40
+
+    __HAL_RCC_AHB1_FORCE_RESET();
+ 8000a9a:	6299      	str	r1, [r3, #40]	; 0x28
+    __HAL_RCC_AHB1_RELEASE_RESET();
+ 8000a9c:	629a      	str	r2, [r3, #40]	; 0x28
+    // But not this; it borks things.
+    __HAL_RCC_AHB2_FORCE_RESET();
+    __HAL_RCC_AHB2_RELEASE_RESET();
+#endif
+
+    __HAL_RCC_AHB3_FORCE_RESET();
+ 8000a9e:	6319      	str	r1, [r3, #48]	; 0x30
+    __HAL_RCC_AHB3_RELEASE_RESET();
+ 8000aa0:	631a      	str	r2, [r3, #48]	; 0x30
+
+    __HAL_FIREWALL_PREARM_ENABLE();
+ 8000aa2:	f5a3 4374 	sub.w	r3, r3, #62464	; 0xf400
+ 8000aa6:	6a1a      	ldr	r2, [r3, #32]
+ 8000aa8:	f042 0201 	orr.w	r2, r2, #1
+ 8000aac:	621a      	str	r2, [r3, #32]
+ 8000aae:	6a1b      	ldr	r3, [r3, #32]
+ 8000ab0:	f003 0301 	and.w	r3, r3, #1
+ 8000ab4:	9301      	str	r3, [sp, #4]
+ 8000ab6:	9b01      	ldr	r3, [sp, #4]
+
+    // Wipe all of memory SRAM, just in case 
+    // there is some way to trick us into DFU
+    // after sensitive content in place.
+    wipe_all_sram();
+ 8000ab8:	f7ff ffa6 	bl	8000a08 <wipe_all_sram>
+    rng_delay();
+ 8000abc:	f001 fe74 	bl	80027a8 <rng_delay>
+    return ((FLASH->OPTR & FLASH_OPTR_RDP_Msk) == 0xCC);
+ 8000ac0:	4b0e      	ldr	r3, [pc, #56]	; (8000afc <enter_dfu+0x88>)
+ 8000ac2:	6a1b      	ldr	r3, [r3, #32]
+ 8000ac4:	b2db      	uxtb	r3, r3
+
+    if(flash_is_security_level2()) {
+ 8000ac6:	2bcc      	cmp	r3, #204	; 0xcc
+ 8000ac8:	d101      	bne.n	8000ace <enter_dfu+0x5a>
+        // cannot do DFU in RDP=2, so just die. Helps to preserve screen
+        LOCKUP_FOREVER();
+ 8000aca:	bf30      	wfi
+ 8000acc:	e7fd      	b.n	8000aca <enter_dfu+0x56>
+    }
+
+    // Reset clocks.
+    HAL_RCC_DeInit();
+ 8000ace:	f007 fe17 	bl	8008700 <HAL_RCC_DeInit>
+
+    // move system ROM into 0x0
+    __HAL_SYSCFG_REMAPMEMORY_SYSTEMFLASH();
+ 8000ad2:	4a0b      	ldr	r2, [pc, #44]	; (8000b00 <enter_dfu+0x8c>)
+ 8000ad4:	6813      	ldr	r3, [r2, #0]
+ 8000ad6:	f023 0307 	bic.w	r3, r3, #7
+ 8000ada:	f043 0301 	orr.w	r3, r3, #1
+ 8000ade:	6013      	str	r3, [r2, #0]
+
+    // need this here?!
+    asm("nop; nop; nop; nop;");
+ 8000ae0:	bf00      	nop
+ 8000ae2:	bf00      	nop
+ 8000ae4:	bf00      	nop
+ 8000ae6:	bf00      	nop
+
+    // simulate a reset vector
+    __ASM volatile ("movs r0, #0\n"
+ 8000ae8:	2000      	movs	r0, #0
+ 8000aea:	6803      	ldr	r3, [r0, #0]
+ 8000aec:	f383 8808 	msr	MSP, r3
+ 8000af0:	6843      	ldr	r3, [r0, #4]
+ 8000af2:	4798      	blx	r3
+                    "ldr r3, [r0, #4]\n"
+                    "blx r3"
+        : : : "r0", "r3");      // also SP
+
+    // NOT-REACHED.
+    __builtin_unreachable();
+ 8000af4:	0800d7b6 	.word	0x0800d7b6
+ 8000af8:	40021000 	.word	0x40021000
+ 8000afc:	40022000 	.word	0x40022000
+ 8000b00:	40010000 	.word	0x40010000
+
+08000b04 <system_startup>:
+{
+ 8000b04:	b510      	push	{r4, lr}
+    system_init0();
+ 8000b06:	f001 f99b 	bl	8001e40 <system_init0>
+    clocks_setup();
+ 8000b0a:	f001 f9bb 	bl	8001e84 <clocks_setup>
+    rng_setup();            // needs to be super early
+ 8000b0e:	f001 fe09 	bl	8002724 <rng_setup>
+    rng_delay();
+ 8000b12:	f001 fe49 	bl	80027a8 <rng_delay>
+    if(!check_all_ones(rom_secrets->bag_number, sizeof(rom_secrets->bag_number))
+ 8000b16:	4838      	ldr	r0, [pc, #224]	; (8000bf8 <system_startup+0xf4>)
+ 8000b18:	2120      	movs	r1, #32
+ 8000b1a:	f001 fdc7 	bl	80026ac <check_all_ones>
+ 8000b1e:	b948      	cbnz	r0, 8000b34 <system_startup+0x30>
+    rng_delay();
+ 8000b20:	f001 fe42 	bl	80027a8 <rng_delay>
+    return ((FLASH->OPTR & FLASH_OPTR_RDP_Msk) == 0xCC);
+ 8000b24:	4b35      	ldr	r3, [pc, #212]	; (8000bfc <system_startup+0xf8>)
+ 8000b26:	6a1b      	ldr	r3, [r3, #32]
+ 8000b28:	b2db      	uxtb	r3, r3
+            && !flash_is_security_level2()
+ 8000b2a:	2bcc      	cmp	r3, #204	; 0xcc
+ 8000b2c:	d002      	beq.n	8000b34 <system_startup+0x30>
+        flash_lockdown_hard(OB_RDP_LEVEL_2);
+ 8000b2e:	20cc      	movs	r0, #204	; 0xcc
+ 8000b30:	f001 fc40 	bl	80023b4 <flash_lockdown_hard>
+    gpio_setup();
+ 8000b34:	f002 ff06 	bl	8003944 <gpio_setup>
+    uint32_t reset_reason = RCC->CSR;
+ 8000b38:	4c31      	ldr	r4, [pc, #196]	; (8000c00 <system_startup+0xfc>)
+    console_setup();
+ 8000b3a:	f004 f88f 	bl	8004c5c <console_setup>
+    puts2(BOOT_BANNER);
+ 8000b3e:	4831      	ldr	r0, [pc, #196]	; (8000c04 <system_startup+0x100>)
+ 8000b40:	f004 f8d8 	bl	8004cf4 <puts2>
+    puts(version_string);
+ 8000b44:	4830      	ldr	r0, [pc, #192]	; (8000c08 <system_startup+0x104>)
+ 8000b46:	f004 f963 	bl	8004e10 <puts>
+    uint32_t reset_reason = RCC->CSR;
+ 8000b4a:	f8d4 3094 	ldr.w	r3, [r4, #148]	; 0x94
+    if(reset_reason & RCC_CSR_FWRSTF) {
+ 8000b4e:	01db      	lsls	r3, r3, #7
+ 8000b50:	d502      	bpl.n	8000b58 <system_startup+0x54>
+        puts(">FIREWALLED<");
+ 8000b52:	482e      	ldr	r0, [pc, #184]	; (8000c0c <system_startup+0x108>)
+ 8000b54:	f004 f95c 	bl	8004e10 <puts>
+    SET_BIT(RCC->CSR, RCC_CSR_RMVF);
+ 8000b58:	f8d4 3094 	ldr.w	r3, [r4, #148]	; 0x94
+ 8000b5c:	f443 0300 	orr.w	r3, r3, #8388608	; 0x800000
+ 8000b60:	f8c4 3094 	str.w	r3, [r4, #148]	; 0x94
+    if(memcmp(dfu_flag->magic, REBOOT_TO_DFU, sizeof(dfu_flag->magic)) == 0) {
+ 8000b64:	4c2a      	ldr	r4, [pc, #168]	; (8000c10 <system_startup+0x10c>)
+    pin_setup0();
+ 8000b66:	f003 f967 	bl	8003e38 <pin_setup0>
+    rng_delay();
+ 8000b6a:	f001 fe1d 	bl	80027a8 <rng_delay>
+    oled_setup();
+ 8000b6e:	f000 f8d9 	bl	8000d24 <oled_setup>
+    if(memcmp(dfu_flag->magic, REBOOT_TO_DFU, sizeof(dfu_flag->magic)) == 0) {
+ 8000b72:	4928      	ldr	r1, [pc, #160]	; (8000c14 <system_startup+0x110>)
+ 8000b74:	2208      	movs	r2, #8
+ 8000b76:	4620      	mov	r0, r4
+ 8000b78:	f00c fd76 	bl	800d668 <memcmp>
+ 8000b7c:	b928      	cbnz	r0, 8000b8a <system_startup+0x86>
+        dfu_flag->magic[0] = 0;
+ 8000b7e:	7020      	strb	r0, [r4, #0]
+        oled_show(dfu_flag->screen);
+ 8000b80:	68a0      	ldr	r0, [r4, #8]
+ 8000b82:	f000 f96d 	bl	8000e60 <oled_show>
+        enter_dfu();
+ 8000b86:	f7ff ff75 	bl	8000a74 <enter_dfu>
+    rng_delay();
+ 8000b8a:	f001 fe0d 	bl	80027a8 <rng_delay>
+    oled_show_progress(screen_verify, 0);
+ 8000b8e:	2100      	movs	r1, #0
+ 8000b90:	4821      	ldr	r0, [pc, #132]	; (8000c18 <system_startup+0x114>)
+ 8000b92:	f000 f9a7 	bl	8000ee4 <oled_show_progress>
+    wipe_all_sram();
+ 8000b96:	f7ff ff37 	bl	8000a08 <wipe_all_sram>
+    ae_setup();
+ 8000b9a:	f001 ff29 	bl	80029f0 <ae_setup>
+    ae_set_gpio(0);         // turn light red
+ 8000b9e:	2000      	movs	r0, #0
+ 8000ba0:	f002 fca8 	bl	80034f4 <ae_set_gpio>
+    se2_setup();
+ 8000ba4:	f007 f8be 	bl	8007d24 <se2_setup>
+    se2_probe();
+ 8000ba8:	f006 fe42 	bl	8007830 <se2_probe>
+    flash_setup();
+ 8000bac:	f001 fb6c 	bl	8002288 <flash_setup>
+    psram_setup();
+ 8000bb0:	f004 f966 	bl	8004e80 <psram_setup>
+    if(ae_pair_unlock() != 0) {
+ 8000bb4:	f002 f912 	bl	8002ddc <ae_pair_unlock>
+ 8000bb8:	b138      	cbz	r0, 8000bca <system_startup+0xc6>
+        oled_show(screen_brick);
+ 8000bba:	4818      	ldr	r0, [pc, #96]	; (8000c1c <system_startup+0x118>)
+ 8000bbc:	f000 f950 	bl	8000e60 <oled_show>
+        puts("pair-bricked");
+ 8000bc0:	4817      	ldr	r0, [pc, #92]	; (8000c20 <system_startup+0x11c>)
+ 8000bc2:	f004 f925 	bl	8004e10 <puts>
+        LOCKUP_FOREVER();
+ 8000bc6:	bf30      	wfi
+ 8000bc8:	e7fd      	b.n	8000bc6 <system_startup+0xc2>
+    puts2("Verify: ");
+ 8000bca:	4816      	ldr	r0, [pc, #88]	; (8000c24 <system_startup+0x120>)
+ 8000bcc:	f004 f892 	bl	8004cf4 <puts2>
+    bool main_ok = verify_firmware();
+ 8000bd0:	f001 f8ba 	bl	8001d48 <verify_firmware>
+    if(main_ok) {
+ 8000bd4:	b120      	cbz	r0, 8000be0 <system_startup+0xdc>
+}
+ 8000bd6:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+        oled_show(screen_blankish);
+ 8000bda:	4813      	ldr	r0, [pc, #76]	; (8000c28 <system_startup+0x124>)
+ 8000bdc:	f000 b940 	b.w	8000e60 <oled_show>
+    psram_recover_firmware();
+ 8000be0:	f004 fa9c 	bl	800511c <psram_recover_firmware>
+    rng_delay();
+ 8000be4:	f001 fde0 	bl	80027a8 <rng_delay>
+    return ((FLASH->OPTR & FLASH_OPTR_RDP_Msk) == 0xCC);
+ 8000be8:	4b04      	ldr	r3, [pc, #16]	; (8000bfc <system_startup+0xf8>)
+ 8000bea:	6a1b      	ldr	r3, [r3, #32]
+ 8000bec:	b2db      	uxtb	r3, r3
+    if(!flash_is_security_level2()) {
+ 8000bee:	2bcc      	cmp	r3, #204	; 0xcc
+ 8000bf0:	d1c9      	bne.n	8000b86 <system_startup+0x82>
+    while(1) sdcard_recovery();
+ 8000bf2:	f004 fc43 	bl	800547c <sdcard_recovery>
+ 8000bf6:	e7fc      	b.n	8000bf2 <system_startup+0xee>
+ 8000bf8:	0801c050 	.word	0x0801c050
+ 8000bfc:	40022000 	.word	0x40022000
+ 8000c00:	40021000 	.word	0x40021000
+ 8000c04:	0800d7c2 	.word	0x0800d7c2
+ 8000c08:	0800e7a8 	.word	0x0800e7a8
+ 8000c0c:	0800d7d6 	.word	0x0800d7d6
+ 8000c10:	20008000 	.word	0x20008000
+ 8000c14:	0800d797 	.word	0x0800d797
+ 8000c18:	0800e2c8 	.word	0x0800e2c8
+ 8000c1c:	0800d891 	.word	0x0800d891
+ 8000c20:	0800d7e3 	.word	0x0800d7e3
+ 8000c24:	0800d7f0 	.word	0x0800d7f0
+ 8000c28:	0800d864 	.word	0x0800d864
+
+08000c2c <write_bytes>:
+    static inline void
+write_bytes(int len, const uint8_t *buf)
+{
+#ifndef DISABLE_OLED
+    // send via SPI(1)
+    HAL_SPI_Transmit(&spi_port, (uint8_t *)buf, len, HAL_MAX_DELAY);
+ 8000c2c:	b282      	uxth	r2, r0
+ 8000c2e:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8000c32:	4801      	ldr	r0, [pc, #4]	; (8000c38 <write_bytes+0xc>)
+ 8000c34:	f000 bc1c 	b.w	8001470 <HAL_SPI_Transmit>
+ 8000c38:	2009e154 	.word	0x2009e154
+
+08000c3c <oled_write_cmd>:
+
+// oled_write_cmd()
+//
+    void
+oled_write_cmd(uint8_t cmd)
+{
+ 8000c3c:	b507      	push	{r0, r1, r2, lr}
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000c3e:	2201      	movs	r2, #1
+{
+ 8000c40:	f88d 0007 	strb.w	r0, [sp, #7]
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000c44:	2110      	movs	r1, #16
+ 8000c46:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000c4a:	f000 fb71 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, DC_PIN, 0);
+ 8000c4e:	2200      	movs	r2, #0
+ 8000c50:	f44f 7180 	mov.w	r1, #256	; 0x100
+ 8000c54:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000c58:	f000 fb6a 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 0);
+ 8000c5c:	2200      	movs	r2, #0
+ 8000c5e:	2110      	movs	r1, #16
+ 8000c60:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000c64:	f000 fb64 	bl	8001330 <HAL_GPIO_WritePin>
+
+    write_bytes(1, &cmd);
+ 8000c68:	f10d 0107 	add.w	r1, sp, #7
+ 8000c6c:	2001      	movs	r0, #1
+ 8000c6e:	f7ff ffdd 	bl	8000c2c <write_bytes>
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000c72:	2201      	movs	r2, #1
+ 8000c74:	2110      	movs	r1, #16
+ 8000c76:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000c7a:	f000 fb59 	bl	8001330 <HAL_GPIO_WritePin>
+}
+ 8000c7e:	b003      	add	sp, #12
+ 8000c80:	f85d fb04 	ldr.w	pc, [sp], #4
+
+08000c84 <oled_write_cmd_sequence>:
+
+// oled_write_cmd_sequence()
+//
+    void
+oled_write_cmd_sequence(int len, const uint8_t *cmds)
+{
+ 8000c84:	b570      	push	{r4, r5, r6, lr}
+ 8000c86:	4605      	mov	r5, r0
+ 8000c88:	460e      	mov	r6, r1
+    for(int i=0; i<len; i++) {
+ 8000c8a:	2400      	movs	r4, #0
+ 8000c8c:	42ac      	cmp	r4, r5
+ 8000c8e:	db00      	blt.n	8000c92 <oled_write_cmd_sequence+0xe>
+        oled_write_cmd(cmds[i]);
+    }
+}
+ 8000c90:	bd70      	pop	{r4, r5, r6, pc}
+        oled_write_cmd(cmds[i]);
+ 8000c92:	5d30      	ldrb	r0, [r6, r4]
+ 8000c94:	f7ff ffd2 	bl	8000c3c <oled_write_cmd>
+    for(int i=0; i<len; i++) {
+ 8000c98:	3401      	adds	r4, #1
+ 8000c9a:	e7f7      	b.n	8000c8c <oled_write_cmd_sequence+0x8>
+
+08000c9c <oled_write_data>:
+
+// oled_write_data()
+//
+    void
+oled_write_data(int len, const uint8_t *pixels)
+{
+ 8000c9c:	b538      	push	{r3, r4, r5, lr}
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000c9e:	2201      	movs	r2, #1
+{
+ 8000ca0:	4604      	mov	r4, r0
+ 8000ca2:	460d      	mov	r5, r1
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000ca4:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000ca8:	2110      	movs	r1, #16
+ 8000caa:	f000 fb41 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, DC_PIN, 1);
+ 8000cae:	2201      	movs	r2, #1
+ 8000cb0:	f44f 7180 	mov.w	r1, #256	; 0x100
+ 8000cb4:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000cb8:	f000 fb3a 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 0);
+ 8000cbc:	2200      	movs	r2, #0
+ 8000cbe:	2110      	movs	r1, #16
+ 8000cc0:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000cc4:	f000 fb34 	bl	8001330 <HAL_GPIO_WritePin>
+
+    write_bytes(len, pixels);
+ 8000cc8:	4629      	mov	r1, r5
+ 8000cca:	4620      	mov	r0, r4
+ 8000ccc:	f7ff ffae 	bl	8000c2c <write_bytes>
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+}
+ 8000cd0:	e8bd 4038 	ldmia.w	sp!, {r3, r4, r5, lr}
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000cd4:	2201      	movs	r2, #1
+ 8000cd6:	2110      	movs	r1, #16
+ 8000cd8:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000cdc:	f000 bb28 	b.w	8001330 <HAL_GPIO_WritePin>
+
+08000ce0 <oled_spi_setup>:
+//
+// Just setup SPI, do not reset display, etc.
+//
+    void
+oled_spi_setup(void)
+{
+ 8000ce0:	b538      	push	{r3, r4, r5, lr}
+#ifndef DISABLE_OLED
+    // might already be setup
+    if(spi_port.Instance == SPI1) return;
+ 8000ce2:	4c0e      	ldr	r4, [pc, #56]	; (8000d1c <oled_spi_setup+0x3c>)
+ 8000ce4:	4d0e      	ldr	r5, [pc, #56]	; (8000d20 <oled_spi_setup+0x40>)
+ 8000ce6:	6823      	ldr	r3, [r4, #0]
+ 8000ce8:	42ab      	cmp	r3, r5
+ 8000cea:	d016      	beq.n	8000d1a <oled_spi_setup+0x3a>
+
+    memset(&spi_port, 0, sizeof(spi_port));
+ 8000cec:	f104 0008 	add.w	r0, r4, #8
+ 8000cf0:	225c      	movs	r2, #92	; 0x5c
+ 8000cf2:	2100      	movs	r1, #0
+ 8000cf4:	f00c fcf0 	bl	800d6d8 <memset>
+
+    spi_port.Instance = SPI1;
+
+    // see SPI_InitTypeDef
+    spi_port.Init.Mode = SPI_MODE_MASTER;
+ 8000cf8:	f44f 7382 	mov.w	r3, #260	; 0x104
+ 8000cfc:	6063      	str	r3, [r4, #4]
+    spi_port.Init.Direction = SPI_DIRECTION_2LINES;
+    spi_port.Init.DataSize = SPI_DATASIZE_8BIT;
+ 8000cfe:	f44f 63e0 	mov.w	r3, #1792	; 0x700
+ 8000d02:	60e3      	str	r3, [r4, #12]
+    spi_port.Init.CLKPolarity = SPI_POLARITY_LOW;
+    spi_port.Init.CLKPhase = SPI_PHASE_1EDGE;
+    spi_port.Init.NSS = SPI_NSS_SOFT;
+    spi_port.Init.BaudRatePrescaler = SPI_BAUDRATEPRESCALER_16;    // conservative
+ 8000d04:	f44f 7000 	mov.w	r0, #512	; 0x200
+ 8000d08:	2318      	movs	r3, #24
+ 8000d0a:	e9c4 0306 	strd	r0, r3, [r4, #24]
+    spi_port.Instance = SPI1;
+ 8000d0e:	6025      	str	r5, [r4, #0]
+    spi_port.Init.FirstBit = SPI_FIRSTBIT_MSB;
+    spi_port.Init.TIMode = SPI_TIMODE_DISABLED;
+    spi_port.Init.CRCCalculation = SPI_CRCCALCULATION_DISABLED;
+
+    HAL_SPI_Init(&spi_port);
+ 8000d10:	4620      	mov	r0, r4
+#endif
+}
+ 8000d12:	e8bd 4038 	ldmia.w	sp!, {r3, r4, r5, lr}
+    HAL_SPI_Init(&spi_port);
+ 8000d16:	f000 bb4d 	b.w	80013b4 <HAL_SPI_Init>
+}
+ 8000d1a:	bd38      	pop	{r3, r4, r5, pc}
+ 8000d1c:	2009e154 	.word	0x2009e154
+ 8000d20:	40013000 	.word	0x40013000
+
+08000d24 <oled_setup>:
+//
+// Ok to call this lots.
+//
+    void
+oled_setup(void)
+{
+ 8000d24:	b530      	push	{r4, r5, lr}
+    puts("oled disabled");return;     // disable so I can use MCO
+#endif
+
+    static uint32_t inited;
+
+    if(inited == 0x238a572F) {
+ 8000d26:	4b31      	ldr	r3, [pc, #196]	; (8000dec <oled_setup+0xc8>)
+ 8000d28:	4a31      	ldr	r2, [pc, #196]	; (8000df0 <oled_setup+0xcc>)
+ 8000d2a:	6819      	ldr	r1, [r3, #0]
+ 8000d2c:	4291      	cmp	r1, r2
+{
+ 8000d2e:	b089      	sub	sp, #36	; 0x24
+    if(inited == 0x238a572F) {
+ 8000d30:	d058      	beq.n	8000de4 <oled_setup+0xc0>
+        return;
+    }
+    inited = 0x238a572F;
+ 8000d32:	601a      	str	r2, [r3, #0]
+
+    // enable some internal clocks
+    __HAL_RCC_GPIOA_CLK_ENABLE();
+ 8000d34:	4b2f      	ldr	r3, [pc, #188]	; (8000df4 <oled_setup+0xd0>)
+    __HAL_RCC_SPI1_CLK_ENABLE();
+
+    // simple pins
+    GPIO_InitTypeDef setup = {
+ 8000d36:	4d30      	ldr	r5, [pc, #192]	; (8000df8 <oled_setup+0xd4>)
+    __HAL_RCC_GPIOA_CLK_ENABLE();
+ 8000d38:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8000d3a:	f042 0201 	orr.w	r2, r2, #1
+ 8000d3e:	64da      	str	r2, [r3, #76]	; 0x4c
+ 8000d40:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8000d42:	f002 0201 	and.w	r2, r2, #1
+ 8000d46:	9201      	str	r2, [sp, #4]
+ 8000d48:	9a01      	ldr	r2, [sp, #4]
+    __HAL_RCC_SPI1_CLK_ENABLE();
+ 8000d4a:	6e1a      	ldr	r2, [r3, #96]	; 0x60
+ 8000d4c:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 8000d50:	661a      	str	r2, [r3, #96]	; 0x60
+ 8000d52:	6e1b      	ldr	r3, [r3, #96]	; 0x60
+ 8000d54:	f403 5380 	and.w	r3, r3, #4096	; 0x1000
+ 8000d58:	9302      	str	r3, [sp, #8]
+ 8000d5a:	9b02      	ldr	r3, [sp, #8]
+    GPIO_InitTypeDef setup = {
+ 8000d5c:	cd0f      	ldmia	r5!, {r0, r1, r2, r3}
+ 8000d5e:	ac03      	add	r4, sp, #12
+ 8000d60:	c40f      	stmia	r4!, {r0, r1, r2, r3}
+ 8000d62:	682b      	ldr	r3, [r5, #0]
+ 8000d64:	6023      	str	r3, [r4, #0]
+        .Mode = GPIO_MODE_OUTPUT_PP,
+        .Pull = GPIO_NOPULL,
+        .Speed = GPIO_SPEED_FREQ_MEDIUM,
+        .Alternate = 0,
+    };
+    HAL_GPIO_Init(GPIOA, &setup);
+ 8000d66:	a903      	add	r1, sp, #12
+ 8000d68:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000d6c:	f000 f966 	bl	800103c <HAL_GPIO_Init>
+
+    // starting values
+    HAL_GPIO_WritePin(GPIOA, RESET_PIN | CS_PIN | DC_PIN, 1);
+ 8000d70:	2201      	movs	r2, #1
+ 8000d72:	f44f 71a8 	mov.w	r1, #336	; 0x150
+ 8000d76:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000d7a:	f000 fad9 	bl	8001330 <HAL_GPIO_WritePin>
+
+    // SPI pins
+    setup.Pin = SPI_SCK | SPI_MOSI;
+    setup.Mode = GPIO_MODE_AF_PP;
+ 8000d7e:	2402      	movs	r4, #2
+ 8000d80:	23a0      	movs	r3, #160	; 0xa0
+ 8000d82:	e9cd 3403 	strd	r3, r4, [sp, #12]
+    setup.Alternate = GPIO_AF5_SPI1;
+    HAL_GPIO_Init(GPIOA, &setup);
+ 8000d86:	a903      	add	r1, sp, #12
+    setup.Alternate = GPIO_AF5_SPI1;
+ 8000d88:	2305      	movs	r3, #5
+    HAL_GPIO_Init(GPIOA, &setup);
+ 8000d8a:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+    setup.Alternate = GPIO_AF5_SPI1;
+ 8000d8e:	9307      	str	r3, [sp, #28]
+    HAL_GPIO_Init(GPIOA, &setup);
+ 8000d90:	f000 f954 	bl	800103c <HAL_GPIO_Init>
+
+    // lock the RESET pin so that St's DFU code doesn't clear screen
+    // it might be trying to use it as a MISO signal for SPI loading
+    HAL_GPIO_LockPin(GPIOA, RESET_PIN | CS_PIN | DC_PIN);
+ 8000d94:	f44f 71a8 	mov.w	r1, #336	; 0x150
+ 8000d98:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000d9c:	f000 fad1 	bl	8001342 <HAL_GPIO_LockPin>
+
+    // 10ms low-going pulse on reset pin
+    delay_ms(1);
+ 8000da0:	2001      	movs	r0, #1
+ 8000da2:	f002 fdbf 	bl	8003924 <delay_ms>
+    HAL_GPIO_WritePin(GPIOA, RESET_PIN, 0);
+ 8000da6:	2200      	movs	r2, #0
+ 8000da8:	2140      	movs	r1, #64	; 0x40
+ 8000daa:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000dae:	f000 fabf 	bl	8001330 <HAL_GPIO_WritePin>
+    delay_ms(10);
+ 8000db2:	200a      	movs	r0, #10
+ 8000db4:	f002 fdb6 	bl	8003924 <delay_ms>
+    HAL_GPIO_WritePin(GPIOA, RESET_PIN, 1);
+ 8000db8:	2201      	movs	r2, #1
+ 8000dba:	2140      	movs	r1, #64	; 0x40
+ 8000dbc:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000dc0:	f000 fab6 	bl	8001330 <HAL_GPIO_WritePin>
+
+    oled_spi_setup();
+ 8000dc4:	f7ff ff8c 	bl	8000ce0 <oled_spi_setup>
+    // this code:
+    //      '0x37c', '0x1700', '0x603'
+    //SPI1->CR1 = 0x354;
+
+    // write a sequence to reset things
+    if(is_mk5()) {
+ 8000dc8:	f002 fe48 	bl	8003a5c <is_mk5>
+ 8000dcc:	b160      	cbz	r0, 8000de8 <oled_setup+0xc4>
+        // note: +12v is always on now, this line supports older revs
+        HAL_GPIO_WritePin(GPIOC, VCC_EN_PIN, 1);
+ 8000dce:	4621      	mov	r1, r4
+ 8000dd0:	480a      	ldr	r0, [pc, #40]	; (8000dfc <oled_setup+0xd8>)
+ 8000dd2:	2201      	movs	r2, #1
+ 8000dd4:	f000 faac 	bl	8001330 <HAL_GPIO_WritePin>
+
+        oled_write_cmd_sequence(sizeof(reset_commands_mk5), reset_commands_mk5);
+ 8000dd8:	4909      	ldr	r1, [pc, #36]	; (8000e00 <oled_setup+0xdc>)
+    } else {
+        oled_write_cmd_sequence(sizeof(reset_commands_mk4), reset_commands_mk4);
+ 8000dda:	2019      	movs	r0, #25
+ 8000ddc:	f7ff ff52 	bl	8000c84 <oled_write_cmd_sequence>
+    }
+
+    rng_delay();
+ 8000de0:	f001 fce2 	bl	80027a8 <rng_delay>
+}
+ 8000de4:	b009      	add	sp, #36	; 0x24
+ 8000de6:	bd30      	pop	{r4, r5, pc}
+        oled_write_cmd_sequence(sizeof(reset_commands_mk4), reset_commands_mk4);
+ 8000de8:	4906      	ldr	r1, [pc, #24]	; (8000e04 <oled_setup+0xe0>)
+ 8000dea:	e7f6      	b.n	8000dda <oled_setup+0xb6>
+ 8000dec:	2009e150 	.word	0x2009e150
+ 8000df0:	238a572f 	.word	0x238a572f
+ 8000df4:	40021000 	.word	0x40021000
+ 8000df8:	0800d7fc 	.word	0x0800d7fc
+ 8000dfc:	48000800 	.word	0x48000800
+ 8000e00:	0800d845 	.word	0x0800d845
+ 8000e04:	0800d82c 	.word	0x0800d82c
+
+08000e08 <oled_show_raw>:
+//
+// No decompression.
+//
+    void
+oled_show_raw(uint32_t len, const uint8_t *pixels)
+{
+ 8000e08:	b538      	push	{r3, r4, r5, lr}
+ 8000e0a:	4604      	mov	r4, r0
+ 8000e0c:	460d      	mov	r5, r1
+    oled_setup();
+ 8000e0e:	f7ff ff89 	bl	8000d24 <oled_setup>
+
+    oled_write_cmd_sequence(sizeof(before_show), before_show);
+ 8000e12:	4912      	ldr	r1, [pc, #72]	; (8000e5c <oled_show_raw+0x54>)
+ 8000e14:	2006      	movs	r0, #6
+ 8000e16:	f7ff ff35 	bl	8000c84 <oled_write_cmd_sequence>
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000e1a:	2201      	movs	r2, #1
+ 8000e1c:	2110      	movs	r1, #16
+ 8000e1e:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000e22:	f000 fa85 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, DC_PIN, 1);
+ 8000e26:	2201      	movs	r2, #1
+ 8000e28:	f44f 7180 	mov.w	r1, #256	; 0x100
+ 8000e2c:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000e30:	f000 fa7e 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 0);
+ 8000e34:	2200      	movs	r2, #0
+ 8000e36:	2110      	movs	r1, #16
+ 8000e38:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000e3c:	f000 fa78 	bl	8001330 <HAL_GPIO_WritePin>
+
+    write_bytes(len, pixels);
+ 8000e40:	4629      	mov	r1, r5
+ 8000e42:	4620      	mov	r0, r4
+ 8000e44:	f7ff fef2 	bl	8000c2c <write_bytes>
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000e48:	2201      	movs	r2, #1
+ 8000e4a:	2110      	movs	r1, #16
+ 8000e4c:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000e50:	f000 fa6e 	bl	8001330 <HAL_GPIO_WritePin>
+    rng_delay();
+}
+ 8000e54:	e8bd 4038 	ldmia.w	sp!, {r3, r4, r5, lr}
+    rng_delay();
+ 8000e58:	f001 bca6 	b.w	80027a8 <rng_delay>
+ 8000e5c:	0800d826 	.word	0x0800d826
+
+08000e60 <oled_show>:
+//
+// Perform simple RLE decompression.
+//
+    void
+oled_show(const uint8_t *pixels)
+{
+ 8000e60:	b530      	push	{r4, r5, lr}
+ 8000e62:	b0a1      	sub	sp, #132	; 0x84
+ 8000e64:	4604      	mov	r4, r0
+    oled_setup();
+ 8000e66:	f7ff ff5d 	bl	8000d24 <oled_setup>
+
+    oled_write_cmd_sequence(sizeof(before_show), before_show);
+ 8000e6a:	491d      	ldr	r1, [pc, #116]	; (8000ee0 <oled_show+0x80>)
+ 8000e6c:	2006      	movs	r0, #6
+ 8000e6e:	f7ff ff09 	bl	8000c84 <oled_write_cmd_sequence>
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000e72:	2201      	movs	r2, #1
+ 8000e74:	2110      	movs	r1, #16
+ 8000e76:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000e7a:	f000 fa59 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, DC_PIN, 1);
+ 8000e7e:	2201      	movs	r2, #1
+ 8000e80:	f44f 7180 	mov.w	r1, #256	; 0x100
+ 8000e84:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000e88:	f000 fa52 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 0);
+ 8000e8c:	2200      	movs	r2, #0
+ 8000e8e:	2110      	movs	r1, #16
+ 8000e90:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000e94:	f000 fa4c 	bl	8001330 <HAL_GPIO_WritePin>
+    uint8_t         buf[127];
+    const uint8_t *p = pixels;
+
+    // NOTE: must also update code in oled_show_progress, which dups this heavily.
+    while(1) {
+        uint8_t hdr = *(p++);
+ 8000e98:	7823      	ldrb	r3, [r4, #0]
+        if(!hdr) break;
+ 8000e9a:	b1b3      	cbz	r3, 8000eca <oled_show+0x6a>
+
+        uint8_t len = hdr & 0x7f;
+ 8000e9c:	f003 057f 	and.w	r5, r3, #127	; 0x7f
+        if(hdr & 0x80) {
+ 8000ea0:	061b      	lsls	r3, r3, #24
+ 8000ea2:	d50b      	bpl.n	8000ebc <oled_show+0x5c>
+        uint8_t hdr = *(p++);
+ 8000ea4:	3401      	adds	r4, #1
+            // random bytes follow
+            memcpy(buf, p, len);
+ 8000ea6:	4621      	mov	r1, r4
+ 8000ea8:	462a      	mov	r2, r5
+ 8000eaa:	4668      	mov	r0, sp
+ 8000eac:	f00c fbec 	bl	800d688 <memcpy>
+            p += len;
+ 8000eb0:	442c      	add	r4, r5
+            // repeat same byte
+            memset(buf, *p, len);
+            p++;
+        }
+
+        write_bytes(len, buf);
+ 8000eb2:	4669      	mov	r1, sp
+ 8000eb4:	4628      	mov	r0, r5
+ 8000eb6:	f7ff feb9 	bl	8000c2c <write_bytes>
+    while(1) {
+ 8000eba:	e7ed      	b.n	8000e98 <oled_show+0x38>
+            memset(buf, *p, len);
+ 8000ebc:	7861      	ldrb	r1, [r4, #1]
+ 8000ebe:	462a      	mov	r2, r5
+ 8000ec0:	4668      	mov	r0, sp
+ 8000ec2:	f00c fc09 	bl	800d6d8 <memset>
+            p++;
+ 8000ec6:	3402      	adds	r4, #2
+ 8000ec8:	e7f3      	b.n	8000eb2 <oled_show+0x52>
+    }
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000eca:	2201      	movs	r2, #1
+ 8000ecc:	2110      	movs	r1, #16
+ 8000ece:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000ed2:	f000 fa2d 	bl	8001330 <HAL_GPIO_WritePin>
+    rng_delay();
+ 8000ed6:	f001 fc67 	bl	80027a8 <rng_delay>
+}
+ 8000eda:	b021      	add	sp, #132	; 0x84
+ 8000edc:	bd30      	pop	{r4, r5, pc}
+ 8000ede:	bf00      	nop
+ 8000ee0:	0800d826 	.word	0x0800d826
+
+08000ee4 <oled_show_progress>:
+//
+// Perform simple RLE decompression, and add a bar on final screen line.
+//
+    void
+oled_show_progress(const uint8_t *pixels, int progress)
+{
+ 8000ee4:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+ 8000ee8:	b0a1      	sub	sp, #132	; 0x84
+ 8000eea:	460d      	mov	r5, r1
+ 8000eec:	4606      	mov	r6, r0
+    oled_setup();
+ 8000eee:	f7ff ff19 	bl	8000d24 <oled_setup>
+
+    oled_write_cmd_sequence(sizeof(before_show), before_show);
+ 8000ef2:	493b      	ldr	r1, [pc, #236]	; (8000fe0 <oled_show_progress+0xfc>)
+ 8000ef4:	2006      	movs	r0, #6
+ 8000ef6:	f7ff fec5 	bl	8000c84 <oled_write_cmd_sequence>
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000efa:	2201      	movs	r2, #1
+ 8000efc:	2110      	movs	r1, #16
+ 8000efe:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000f02:	f000 fa15 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, DC_PIN, 1);
+ 8000f06:	2201      	movs	r2, #1
+ 8000f08:	f44f 7180 	mov.w	r1, #256	; 0x100
+ 8000f0c:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000f10:	f000 fa0e 	bl	8001330 <HAL_GPIO_WritePin>
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 0);
+ 8000f14:	2110      	movs	r1, #16
+ 8000f16:	2200      	movs	r2, #0
+ 8000f18:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000f1c:	f000 fa08 	bl	8001330 <HAL_GPIO_WritePin>
+
+    uint8_t         buf[127];
+    const uint8_t *p = pixels;
+
+    const uint16_t p_start = 896;
+    uint32_t p_count = 1280 * progress / 1000;
+ 8000f20:	f44f 61a0 	mov.w	r1, #1280	; 0x500
+ 8000f24:	434d      	muls	r5, r1
+ 8000f26:	2400      	movs	r4, #0
+ 8000f28:	f44f 717a 	mov.w	r1, #1000	; 0x3e8
+ 8000f2c:	fb95 f5f1 	sdiv	r5, r5, r1
+
+    if(p_count > 128) p_count = 128;
+ 8000f30:	2d80      	cmp	r5, #128	; 0x80
+ 8000f32:	bf28      	it	cs
+ 8000f34:	2580      	movcs	r5, #128	; 0x80
+    uint32_t p_count = 1280 * progress / 1000;
+ 8000f36:	46a0      	mov	r8, r4
+
+    bool last_line = false;
+
+    uint16_t offset = 0;
+    while(1) {
+        uint8_t hdr = *(p++);
+ 8000f38:	7833      	ldrb	r3, [r6, #0]
+        if(hdr == 0) break;
+ 8000f3a:	2b00      	cmp	r3, #0
+ 8000f3c:	d045      	beq.n	8000fca <oled_show_progress+0xe6>
+
+        uint8_t len = hdr & 0x7f;
+ 8000f3e:	f003 097f 	and.w	r9, r3, #127	; 0x7f
+        if(hdr & 0x80) {
+ 8000f42:	061b      	lsls	r3, r3, #24
+ 8000f44:	d524      	bpl.n	8000f90 <oled_show_progress+0xac>
+        uint8_t hdr = *(p++);
+ 8000f46:	3601      	adds	r6, #1
+            // random bytes follow
+            memcpy(buf, p, len);
+ 8000f48:	4631      	mov	r1, r6
+ 8000f4a:	464a      	mov	r2, r9
+ 8000f4c:	4668      	mov	r0, sp
+ 8000f4e:	f00c fb9b 	bl	800d688 <memcpy>
+            p += len;
+ 8000f52:	444e      	add	r6, r9
+            // repeat same byte
+            memset(buf, *p, len);
+            p++;
+        }
+
+        if(!last_line && (offset+len) >= p_start) {
+ 8000f54:	f1b8 0f00 	cmp.w	r8, #0
+ 8000f58:	d117      	bne.n	8000f8a <oled_show_progress+0xa6>
+ 8000f5a:	eb04 0309 	add.w	r3, r4, r9
+ 8000f5e:	f5b3 7f60 	cmp.w	r3, #896	; 0x380
+ 8000f62:	db29      	blt.n	8000fb8 <oled_show_progress+0xd4>
+            last_line = true;
+
+            // adjust so we're aligned w/ last line
+            int h = p_start - offset;
+            if(h) {
+ 8000f64:	f5d4 7460 	rsbs	r4, r4, #896	; 0x380
+ 8000f68:	d00d      	beq.n	8000f86 <oled_show_progress+0xa2>
+                write_bytes(h, buf);
+ 8000f6a:	4669      	mov	r1, sp
+ 8000f6c:	4620      	mov	r0, r4
+                memmove(buf, buf+h, len-h);
+ 8000f6e:	eba9 0904 	sub.w	r9, r9, r4
+                write_bytes(h, buf);
+ 8000f72:	f7ff fe5b 	bl	8000c2c <write_bytes>
+                memmove(buf, buf+h, len-h);
+ 8000f76:	464a      	mov	r2, r9
+ 8000f78:	eb0d 0104 	add.w	r1, sp, r4
+ 8000f7c:	4668      	mov	r0, sp
+ 8000f7e:	f00c fb91 	bl	800d6a4 <memmove>
+                len -= h;
+ 8000f82:	fa5f f989 	uxtb.w	r9, r9
+                offset += h;
+ 8000f86:	f44f 7460 	mov.w	r4, #896	; 0x380
+            }
+        }
+
+        if(last_line) {
+ 8000f8a:	466b      	mov	r3, sp
+    while(1) {
+ 8000f8c:	462f      	mov	r7, r5
+ 8000f8e:	e00c      	b.n	8000faa <oled_show_progress+0xc6>
+            memset(buf, *p, len);
+ 8000f90:	7871      	ldrb	r1, [r6, #1]
+ 8000f92:	464a      	mov	r2, r9
+ 8000f94:	4668      	mov	r0, sp
+ 8000f96:	f00c fb9f 	bl	800d6d8 <memset>
+            p++;
+ 8000f9a:	3602      	adds	r6, #2
+ 8000f9c:	e7da      	b.n	8000f54 <oled_show_progress+0x70>
+            for(int j=0; (p_count > 0) && (j<len); j++, p_count--) {
+                buf[j] |= 0x80;
+ 8000f9e:	7819      	ldrb	r1, [r3, #0]
+ 8000fa0:	f061 017f 	orn	r1, r1, #127	; 0x7f
+ 8000fa4:	f803 1b01 	strb.w	r1, [r3], #1
+            for(int j=0; (p_count > 0) && (j<len); j++, p_count--) {
+ 8000fa8:	3f01      	subs	r7, #1
+ 8000faa:	b117      	cbz	r7, 8000fb2 <oled_show_progress+0xce>
+ 8000fac:	1bea      	subs	r2, r5, r7
+ 8000fae:	454a      	cmp	r2, r9
+ 8000fb0:	dbf5      	blt.n	8000f9e <oled_show_progress+0xba>
+ 8000fb2:	f04f 0801 	mov.w	r8, #1
+ 8000fb6:	e000      	b.n	8000fba <oled_show_progress+0xd6>
+ 8000fb8:	462f      	mov	r7, r5
+            }
+        }
+
+        write_bytes(len, buf);
+ 8000fba:	4669      	mov	r1, sp
+ 8000fbc:	4648      	mov	r0, r9
+        offset += len;
+ 8000fbe:	444c      	add	r4, r9
+        write_bytes(len, buf);
+ 8000fc0:	f7ff fe34 	bl	8000c2c <write_bytes>
+        offset += len;
+ 8000fc4:	b2a4      	uxth	r4, r4
+    while(1) {
+ 8000fc6:	463d      	mov	r5, r7
+ 8000fc8:	e7b6      	b.n	8000f38 <oled_show_progress+0x54>
+    }
+
+    HAL_GPIO_WritePin(GPIOA, CS_PIN, 1);
+ 8000fca:	2201      	movs	r2, #1
+ 8000fcc:	2110      	movs	r1, #16
+ 8000fce:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 8000fd2:	f000 f9ad 	bl	8001330 <HAL_GPIO_WritePin>
+    rng_delay();
+ 8000fd6:	f001 fbe7 	bl	80027a8 <rng_delay>
+}
+ 8000fda:	b021      	add	sp, #132	; 0x84
+ 8000fdc:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+ 8000fe0:	0800d826 	.word	0x0800d826
+
+08000fe4 <oled_factory_busy>:
+
+// oled_factory_busy()
+//
+    void
+oled_factory_busy(void)
+{
+ 8000fe4:	b510      	push	{r4, lr}
+ 8000fe6:	b0a0      	sub	sp, #128	; 0x80
+ 8000fe8:	466a      	mov	r2, sp
+ 8000fea:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8000fee:	4614      	mov	r4, r2
+    
+    uint8_t data[128];
+
+    for(int x=0; x<128; x++) {
+        // each byte here is a vertical column, 8 pixels tall, MSB at bottom
+        data[x] = (1<<(7 - (x%8)));
+ 8000ff0:	2001      	movs	r0, #1
+ 8000ff2:	f003 0107 	and.w	r1, r3, #7
+    for(int x=0; x<128; x++) {
+ 8000ff6:	3b01      	subs	r3, #1
+        data[x] = (1<<(7 - (x%8)));
+ 8000ff8:	fa00 f101 	lsl.w	r1, r0, r1
+    for(int x=0; x<128; x++) {
+ 8000ffc:	f113 0f81 	cmn.w	r3, #129	; 0x81
+        data[x] = (1<<(7 - (x%8)));
+ 8001000:	f802 1b01 	strb.w	r1, [r2], #1
+    for(int x=0; x<128; x++) {
+ 8001004:	d1f5      	bne.n	8000ff2 <oled_factory_busy+0xe>
+    }
+
+    oled_write_cmd_sequence(sizeof(setup), setup);
+ 8001006:	490a      	ldr	r1, [pc, #40]	; (8001030 <oled_factory_busy+0x4c>)
+ 8001008:	2006      	movs	r0, #6
+ 800100a:	f7ff fe3b 	bl	8000c84 <oled_write_cmd_sequence>
+    oled_write_data(sizeof(data), data);
+ 800100e:	4621      	mov	r1, r4
+ 8001010:	2080      	movs	r0, #128	; 0x80
+ 8001012:	f7ff fe43 	bl	8000c9c <oled_write_data>
+    if(is_mk5()) {
+ 8001016:	f002 fd21 	bl	8003a5c <is_mk5>
+ 800101a:	b128      	cbz	r0, 8001028 <oled_factory_busy+0x44>
+        oled_write_cmd_sequence(sizeof(animate_mk5), animate_mk5);
+ 800101c:	4905      	ldr	r1, [pc, #20]	; (8001034 <oled_factory_busy+0x50>)
+ 800101e:	200d      	movs	r0, #13
+    } else {
+        oled_write_cmd_sequence(sizeof(animate_mk4), animate_mk4);
+ 8001020:	f7ff fe30 	bl	8000c84 <oled_write_cmd_sequence>
+    }
+}
+ 8001024:	b020      	add	sp, #128	; 0x80
+ 8001026:	bd10      	pop	{r4, pc}
+        oled_write_cmd_sequence(sizeof(animate_mk4), animate_mk4);
+ 8001028:	4903      	ldr	r1, [pc, #12]	; (8001038 <oled_factory_busy+0x54>)
+ 800102a:	2009      	movs	r0, #9
+ 800102c:	e7f8      	b.n	8001020 <oled_factory_busy+0x3c>
+ 800102e:	bf00      	nop
+ 8001030:	0800d85e 	.word	0x0800d85e
+ 8001034:	0800d819 	.word	0x0800d819
+ 8001038:	0800d810 	.word	0x0800d810
+
+0800103c <HAL_GPIO_Init>:
+  * @param  GPIO_Init: pointer to a GPIO_InitTypeDef structure that contains
+  *         the configuration information for the specified GPIO peripheral.
+  * @retval None
+  */
+void HAL_GPIO_Init(GPIO_TypeDef  *GPIOx, GPIO_InitTypeDef *GPIO_Init)
+{
+ 800103c:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+      /*--------------------- EXTI Mode Configuration ------------------------*/
+      /* Configure the External Interrupt or event for the current IO */
+      if((GPIO_Init->Mode & EXTI_MODE) == EXTI_MODE)
+      {
+        /* Enable SYSCFG Clock */
+        __HAL_RCC_SYSCFG_CLK_ENABLE();
+ 8001040:	f8df 81b4 	ldr.w	r8, [pc, #436]	; 80011f8 <HAL_GPIO_Init+0x1bc>
+        temp &= ~(((uint32_t)0x0F) << (4 * (position & 0x03)));
+        temp |= (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03)));
+        SYSCFG->EXTICR[position >> 2] = temp;
+
+        /* Clear EXTI line configuration */
+        temp = EXTI->IMR1;
+ 8001044:	4c6a      	ldr	r4, [pc, #424]	; (80011f0 <HAL_GPIO_Init+0x1b4>)
+        temp |= (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03)));
+ 8001046:	f8df 91b4 	ldr.w	r9, [pc, #436]	; 80011fc <HAL_GPIO_Init+0x1c0>
+{
+ 800104a:	b085      	sub	sp, #20
+  uint32_t position = 0x00;
+ 800104c:	2300      	movs	r3, #0
+  while (((GPIO_Init->Pin) >> position) != RESET)
+ 800104e:	680a      	ldr	r2, [r1, #0]
+ 8001050:	fa32 f503 	lsrs.w	r5, r2, r3
+ 8001054:	d102      	bne.n	800105c <HAL_GPIO_Init+0x20>
+      }
+    }
+
+    position++;
+  }
+}
+ 8001056:	b005      	add	sp, #20
+ 8001058:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+    iocurrent = (GPIO_Init->Pin) & (1U << position);
+ 800105c:	2701      	movs	r7, #1
+ 800105e:	409f      	lsls	r7, r3
+    if(iocurrent)
+ 8001060:	403a      	ands	r2, r7
+ 8001062:	f000 80b4 	beq.w	80011ce <HAL_GPIO_Init+0x192>
+      if((GPIO_Init->Mode == GPIO_MODE_AF_PP) || (GPIO_Init->Mode == GPIO_MODE_AF_OD))
+ 8001066:	684d      	ldr	r5, [r1, #4]
+ 8001068:	f025 0a10 	bic.w	sl, r5, #16
+ 800106c:	f1ba 0f02 	cmp.w	sl, #2
+ 8001070:	d116      	bne.n	80010a0 <HAL_GPIO_Init+0x64>
+        temp = GPIOx->AFR[position >> 3];
+ 8001072:	ea4f 0ed3 	mov.w	lr, r3, lsr #3
+ 8001076:	eb00 0e8e 	add.w	lr, r0, lr, lsl #2
+        temp &= ~((uint32_t)0xF << ((uint32_t)(position & (uint32_t)0x07) * 4)) ;
+ 800107a:	f003 0b07 	and.w	fp, r3, #7
+        temp = GPIOx->AFR[position >> 3];
+ 800107e:	f8de 6020 	ldr.w	r6, [lr, #32]
+        temp &= ~((uint32_t)0xF << ((uint32_t)(position & (uint32_t)0x07) * 4)) ;
+ 8001082:	ea4f 0b8b 	mov.w	fp, fp, lsl #2
+ 8001086:	f04f 0c0f 	mov.w	ip, #15
+ 800108a:	fa0c fc0b 	lsl.w	ip, ip, fp
+ 800108e:	ea26 0c0c 	bic.w	ip, r6, ip
+        temp |= ((uint32_t)(GPIO_Init->Alternate) << (((uint32_t)position & (uint32_t)0x07) * 4));
+ 8001092:	690e      	ldr	r6, [r1, #16]
+ 8001094:	fa06 f60b 	lsl.w	r6, r6, fp
+ 8001098:	ea46 060c 	orr.w	r6, r6, ip
+        GPIOx->AFR[position >> 3] = temp;
+ 800109c:	f8ce 6020 	str.w	r6, [lr, #32]
+      temp = GPIOx->MODER;
+ 80010a0:	f8d0 b000 	ldr.w	fp, [r0]
+      temp &= ~(GPIO_MODER_MODE0 << (position * 2));
+ 80010a4:	ea4f 0e43 	mov.w	lr, r3, lsl #1
+ 80010a8:	f04f 0c03 	mov.w	ip, #3
+ 80010ac:	fa0c fc0e 	lsl.w	ip, ip, lr
+ 80010b0:	ea6f 060c 	mvn.w	r6, ip
+ 80010b4:	ea2b 0b0c 	bic.w	fp, fp, ip
+      temp |= ((GPIO_Init->Mode & GPIO_MODE) << (position * 2));
+ 80010b8:	f005 0c03 	and.w	ip, r5, #3
+ 80010bc:	fa0c fc0e 	lsl.w	ip, ip, lr
+      if((GPIO_Init->Mode == GPIO_MODE_OUTPUT_PP) || (GPIO_Init->Mode == GPIO_MODE_AF_PP) ||
+ 80010c0:	f10a 3aff 	add.w	sl, sl, #4294967295	; 0xffffffff
+      temp |= ((GPIO_Init->Mode & GPIO_MODE) << (position * 2));
+ 80010c4:	ea4c 0c0b 	orr.w	ip, ip, fp
+      if((GPIO_Init->Mode == GPIO_MODE_OUTPUT_PP) || (GPIO_Init->Mode == GPIO_MODE_AF_PP) ||
+ 80010c8:	f1ba 0f01 	cmp.w	sl, #1
+      temp &= ~(GPIO_MODER_MODE0 << (position * 2));
+ 80010cc:	9601      	str	r6, [sp, #4]
+      GPIOx->MODER = temp;
+ 80010ce:	f8c0 c000 	str.w	ip, [r0]
+      if((GPIO_Init->Mode == GPIO_MODE_OUTPUT_PP) || (GPIO_Init->Mode == GPIO_MODE_AF_PP) ||
+ 80010d2:	d815      	bhi.n	8001100 <HAL_GPIO_Init+0xc4>
+        temp = GPIOx->OSPEEDR;
+ 80010d4:	f8d0 c008 	ldr.w	ip, [r0, #8]
+        temp &= ~(GPIO_OSPEEDR_OSPEED0 << (position * 2));
+ 80010d8:	ea06 0c0c 	and.w	ip, r6, ip
+        temp |= (GPIO_Init->Speed << (position * 2));
+ 80010dc:	68ce      	ldr	r6, [r1, #12]
+ 80010de:	fa06 fa0e 	lsl.w	sl, r6, lr
+ 80010e2:	ea4a 0c0c 	orr.w	ip, sl, ip
+        GPIOx->OSPEEDR = temp;
+ 80010e6:	f8c0 c008 	str.w	ip, [r0, #8]
+        temp = GPIOx->OTYPER;
+ 80010ea:	f8d0 c004 	ldr.w	ip, [r0, #4]
+        temp &= ~(GPIO_OTYPER_OT0 << position) ;
+ 80010ee:	ea2c 0707 	bic.w	r7, ip, r7
+        temp |= (((GPIO_Init->Mode & GPIO_OUTPUT_TYPE) >> 4) << position);
+ 80010f2:	f3c5 1c00 	ubfx	ip, r5, #4, #1
+ 80010f6:	fa0c fc03 	lsl.w	ip, ip, r3
+ 80010fa:	ea4c 0707 	orr.w	r7, ip, r7
+        GPIOx->OTYPER = temp;
+ 80010fe:	6047      	str	r7, [r0, #4]
+      temp = GPIOx->PUPDR;
+ 8001100:	68c7      	ldr	r7, [r0, #12]
+      temp &= ~(GPIO_PUPDR_PUPD0 << (position * 2));
+ 8001102:	9e01      	ldr	r6, [sp, #4]
+ 8001104:	4037      	ands	r7, r6
+      temp |= ((GPIO_Init->Pull) << (position * 2));
+ 8001106:	688e      	ldr	r6, [r1, #8]
+ 8001108:	fa06 f60e 	lsl.w	r6, r6, lr
+ 800110c:	433e      	orrs	r6, r7
+      GPIOx->PUPDR = temp;
+ 800110e:	60c6      	str	r6, [r0, #12]
+      if((GPIO_Init->Mode & EXTI_MODE) == EXTI_MODE)
+ 8001110:	00ee      	lsls	r6, r5, #3
+ 8001112:	d55c      	bpl.n	80011ce <HAL_GPIO_Init+0x192>
+        __HAL_RCC_SYSCFG_CLK_ENABLE();
+ 8001114:	f8d8 6060 	ldr.w	r6, [r8, #96]	; 0x60
+ 8001118:	f046 0601 	orr.w	r6, r6, #1
+ 800111c:	f8c8 6060 	str.w	r6, [r8, #96]	; 0x60
+ 8001120:	f8d8 6060 	ldr.w	r6, [r8, #96]	; 0x60
+ 8001124:	f023 0703 	bic.w	r7, r3, #3
+ 8001128:	f107 4780 	add.w	r7, r7, #1073741824	; 0x40000000
+ 800112c:	f006 0601 	and.w	r6, r6, #1
+ 8001130:	f507 3780 	add.w	r7, r7, #65536	; 0x10000
+ 8001134:	9603      	str	r6, [sp, #12]
+        temp &= ~(((uint32_t)0x0F) << (4 * (position & 0x03)));
+ 8001136:	f003 0c03 	and.w	ip, r3, #3
+        __HAL_RCC_SYSCFG_CLK_ENABLE();
+ 800113a:	9e03      	ldr	r6, [sp, #12]
+        temp = SYSCFG->EXTICR[position >> 2];
+ 800113c:	f8d7 a008 	ldr.w	sl, [r7, #8]
+        temp &= ~(((uint32_t)0x0F) << (4 * (position & 0x03)));
+ 8001140:	f04f 0e0f 	mov.w	lr, #15
+ 8001144:	ea4f 0c8c 	mov.w	ip, ip, lsl #2
+ 8001148:	fa0e f60c 	lsl.w	r6, lr, ip
+        temp |= (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03)));
+ 800114c:	f1b0 4f90 	cmp.w	r0, #1207959552	; 0x48000000
+        temp &= ~(((uint32_t)0x0F) << (4 * (position & 0x03)));
+ 8001150:	ea2a 0e06 	bic.w	lr, sl, r6
+        temp |= (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03)));
+ 8001154:	d03d      	beq.n	80011d2 <HAL_GPIO_Init+0x196>
+ 8001156:	4e27      	ldr	r6, [pc, #156]	; (80011f4 <HAL_GPIO_Init+0x1b8>)
+ 8001158:	42b0      	cmp	r0, r6
+ 800115a:	d03c      	beq.n	80011d6 <HAL_GPIO_Init+0x19a>
+ 800115c:	f506 6680 	add.w	r6, r6, #1024	; 0x400
+ 8001160:	42b0      	cmp	r0, r6
+ 8001162:	d03a      	beq.n	80011da <HAL_GPIO_Init+0x19e>
+ 8001164:	f506 6680 	add.w	r6, r6, #1024	; 0x400
+ 8001168:	42b0      	cmp	r0, r6
+ 800116a:	d038      	beq.n	80011de <HAL_GPIO_Init+0x1a2>
+ 800116c:	f506 6680 	add.w	r6, r6, #1024	; 0x400
+ 8001170:	42b0      	cmp	r0, r6
+ 8001172:	d036      	beq.n	80011e2 <HAL_GPIO_Init+0x1a6>
+ 8001174:	f506 6680 	add.w	r6, r6, #1024	; 0x400
+ 8001178:	42b0      	cmp	r0, r6
+ 800117a:	d034      	beq.n	80011e6 <HAL_GPIO_Init+0x1aa>
+ 800117c:	4548      	cmp	r0, r9
+ 800117e:	d034      	beq.n	80011ea <HAL_GPIO_Init+0x1ae>
+ 8001180:	f506 6600 	add.w	r6, r6, #2048	; 0x800
+ 8001184:	42b0      	cmp	r0, r6
+ 8001186:	bf0c      	ite	eq
+ 8001188:	2607      	moveq	r6, #7
+ 800118a:	2608      	movne	r6, #8
+ 800118c:	fa06 f60c 	lsl.w	r6, r6, ip
+ 8001190:	ea46 060e 	orr.w	r6, r6, lr
+        SYSCFG->EXTICR[position >> 2] = temp;
+ 8001194:	60be      	str	r6, [r7, #8]
+        temp = EXTI->IMR1;
+ 8001196:	6826      	ldr	r6, [r4, #0]
+        temp &= ~((uint32_t)iocurrent);
+ 8001198:	43d7      	mvns	r7, r2
+        if((GPIO_Init->Mode & GPIO_MODE_IT) == GPIO_MODE_IT)
+ 800119a:	f415 3f80 	tst.w	r5, #65536	; 0x10000
+        temp &= ~((uint32_t)iocurrent);
+ 800119e:	bf0c      	ite	eq
+ 80011a0:	403e      	andeq	r6, r7
+          temp |= iocurrent;
+ 80011a2:	4316      	orrne	r6, r2
+        EXTI->IMR1 = temp;
+ 80011a4:	6026      	str	r6, [r4, #0]
+        temp = EXTI->EMR1;
+ 80011a6:	6866      	ldr	r6, [r4, #4]
+        if((GPIO_Init->Mode & GPIO_MODE_EVT) == GPIO_MODE_EVT)
+ 80011a8:	f415 3f00 	tst.w	r5, #131072	; 0x20000
+        temp &= ~((uint32_t)iocurrent);
+ 80011ac:	bf0c      	ite	eq
+ 80011ae:	403e      	andeq	r6, r7
+          temp |= iocurrent;
+ 80011b0:	4316      	orrne	r6, r2
+        EXTI->EMR1 = temp;
+ 80011b2:	6066      	str	r6, [r4, #4]
+        temp = EXTI->RTSR1;
+ 80011b4:	68a6      	ldr	r6, [r4, #8]
+        if((GPIO_Init->Mode & RISING_EDGE) == RISING_EDGE)
+ 80011b6:	f415 1f80 	tst.w	r5, #1048576	; 0x100000
+        temp &= ~((uint32_t)iocurrent);
+ 80011ba:	bf0c      	ite	eq
+ 80011bc:	403e      	andeq	r6, r7
+          temp |= iocurrent;
+ 80011be:	4316      	orrne	r6, r2
+        EXTI->RTSR1 = temp;
+ 80011c0:	60a6      	str	r6, [r4, #8]
+        temp = EXTI->FTSR1;
+ 80011c2:	68e6      	ldr	r6, [r4, #12]
+        if((GPIO_Init->Mode & FALLING_EDGE) == FALLING_EDGE)
+ 80011c4:	02ad      	lsls	r5, r5, #10
+        temp &= ~((uint32_t)iocurrent);
+ 80011c6:	bf54      	ite	pl
+ 80011c8:	403e      	andpl	r6, r7
+          temp |= iocurrent;
+ 80011ca:	4316      	orrmi	r6, r2
+        EXTI->FTSR1 = temp;
+ 80011cc:	60e6      	str	r6, [r4, #12]
+    position++;
+ 80011ce:	3301      	adds	r3, #1
+ 80011d0:	e73d      	b.n	800104e <HAL_GPIO_Init+0x12>
+        temp |= (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03)));
+ 80011d2:	2600      	movs	r6, #0
+ 80011d4:	e7da      	b.n	800118c <HAL_GPIO_Init+0x150>
+ 80011d6:	2601      	movs	r6, #1
+ 80011d8:	e7d8      	b.n	800118c <HAL_GPIO_Init+0x150>
+ 80011da:	2602      	movs	r6, #2
+ 80011dc:	e7d6      	b.n	800118c <HAL_GPIO_Init+0x150>
+ 80011de:	2603      	movs	r6, #3
+ 80011e0:	e7d4      	b.n	800118c <HAL_GPIO_Init+0x150>
+ 80011e2:	2604      	movs	r6, #4
+ 80011e4:	e7d2      	b.n	800118c <HAL_GPIO_Init+0x150>
+ 80011e6:	2605      	movs	r6, #5
+ 80011e8:	e7d0      	b.n	800118c <HAL_GPIO_Init+0x150>
+ 80011ea:	2606      	movs	r6, #6
+ 80011ec:	e7ce      	b.n	800118c <HAL_GPIO_Init+0x150>
+ 80011ee:	bf00      	nop
+ 80011f0:	40010400 	.word	0x40010400
+ 80011f4:	48000400 	.word	0x48000400
+ 80011f8:	40021000 	.word	0x40021000
+ 80011fc:	48001800 	.word	0x48001800
+
+08001200 <HAL_GPIO_DeInit>:
+  * @param  GPIO_Pin: specifies the port bit to be written.
+  *         This parameter can be one of GPIO_PIN_x where x can be (0..15).
+  * @retval None
+  */
+void HAL_GPIO_DeInit(GPIO_TypeDef  *GPIOx, uint32_t GPIO_Pin)
+{
+ 8001200:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+      {
+        tmp = ((uint32_t)0x0F) << (4 * (position & 0x03));
+        SYSCFG->EXTICR[position >> 2] &= ~tmp;
+
+        /* Clear EXTI line configuration */
+        EXTI->IMR1 &= ~((uint32_t)iocurrent);
+ 8001204:	4c43      	ldr	r4, [pc, #268]	; (8001314 <HAL_GPIO_DeInit+0x114>)
+      if(tmp == (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03))))
+ 8001206:	f8df a114 	ldr.w	sl, [pc, #276]	; 800131c <HAL_GPIO_DeInit+0x11c>
+ 800120a:	f8df b114 	ldr.w	fp, [pc, #276]	; 8001320 <HAL_GPIO_DeInit+0x120>
+  uint32_t position = 0x00;
+ 800120e:	2200      	movs	r2, #0
+    iocurrent = (GPIO_Pin) & (1U << position);
+ 8001210:	f04f 0901 	mov.w	r9, #1
+  while ((GPIO_Pin >> position) != RESET)
+ 8001214:	fa31 f302 	lsrs.w	r3, r1, r2
+ 8001218:	d101      	bne.n	800121e <HAL_GPIO_DeInit+0x1e>
+      }
+    }
+
+    position++;
+  }
+}
+ 800121a:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+    iocurrent = (GPIO_Pin) & (1U << position);
+ 800121e:	fa09 f802 	lsl.w	r8, r9, r2
+    if (iocurrent)
+ 8001222:	ea18 0c01 	ands.w	ip, r8, r1
+ 8001226:	d064      	beq.n	80012f2 <HAL_GPIO_DeInit+0xf2>
+      GPIOx->MODER |= (GPIO_MODER_MODE0 << (position * 2));
+ 8001228:	6805      	ldr	r5, [r0, #0]
+ 800122a:	2303      	movs	r3, #3
+ 800122c:	0056      	lsls	r6, r2, #1
+ 800122e:	fa03 f606 	lsl.w	r6, r3, r6
+      GPIOx->AFR[position >> 3] &= ~((uint32_t)0xF << ((uint32_t)(position & (uint32_t)0x07) * 4)) ;
+ 8001232:	fa22 fe03 	lsr.w	lr, r2, r3
+      GPIOx->MODER |= (GPIO_MODER_MODE0 << (position * 2));
+ 8001236:	4335      	orrs	r5, r6
+ 8001238:	eb00 0e8e 	add.w	lr, r0, lr, lsl #2
+ 800123c:	6005      	str	r5, [r0, #0]
+      GPIOx->AFR[position >> 3] &= ~((uint32_t)0xF << ((uint32_t)(position & (uint32_t)0x07) * 4)) ;
+ 800123e:	f8de 5020 	ldr.w	r5, [lr, #32]
+ 8001242:	f002 0707 	and.w	r7, r2, #7
+ 8001246:	462b      	mov	r3, r5
+ 8001248:	00bf      	lsls	r7, r7, #2
+ 800124a:	250f      	movs	r5, #15
+ 800124c:	fa05 f707 	lsl.w	r7, r5, r7
+ 8001250:	ea23 0707 	bic.w	r7, r3, r7
+ 8001254:	f8ce 7020 	str.w	r7, [lr, #32]
+      GPIOx->OSPEEDR &= ~(GPIO_OSPEEDR_OSPEED0 << (position * 2));
+ 8001258:	6887      	ldr	r7, [r0, #8]
+ 800125a:	ea27 0706 	bic.w	r7, r7, r6
+ 800125e:	6087      	str	r7, [r0, #8]
+      GPIOx->OTYPER  &= ~(GPIO_OTYPER_OT0 << position) ;
+ 8001260:	6847      	ldr	r7, [r0, #4]
+ 8001262:	ea27 0708 	bic.w	r7, r7, r8
+ 8001266:	6047      	str	r7, [r0, #4]
+      GPIOx->PUPDR &= ~(GPIO_PUPDR_PUPD0 << (position * 2));
+ 8001268:	68c7      	ldr	r7, [r0, #12]
+ 800126a:	ea27 0606 	bic.w	r6, r7, r6
+ 800126e:	60c6      	str	r6, [r0, #12]
+      tmp = SYSCFG->EXTICR[position >> 2];
+ 8001270:	f022 0603 	bic.w	r6, r2, #3
+ 8001274:	f106 4680 	add.w	r6, r6, #1073741824	; 0x40000000
+ 8001278:	f506 3680 	add.w	r6, r6, #65536	; 0x10000
+      tmp &= (((uint32_t)0x0F) << (4 * (position & 0x03)));
+ 800127c:	f002 0703 	and.w	r7, r2, #3
+      tmp = SYSCFG->EXTICR[position >> 2];
+ 8001280:	f8d6 e008 	ldr.w	lr, [r6, #8]
+      tmp &= (((uint32_t)0x0F) << (4 * (position & 0x03)));
+ 8001284:	00bf      	lsls	r7, r7, #2
+ 8001286:	40bd      	lsls	r5, r7
+      if(tmp == (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03))))
+ 8001288:	f1b0 4f90 	cmp.w	r0, #1207959552	; 0x48000000
+      tmp &= (((uint32_t)0x0F) << (4 * (position & 0x03)));
+ 800128c:	ea05 0e0e 	and.w	lr, r5, lr
+      if(tmp == (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03))))
+ 8001290:	d031      	beq.n	80012f6 <HAL_GPIO_DeInit+0xf6>
+ 8001292:	4b21      	ldr	r3, [pc, #132]	; (8001318 <HAL_GPIO_DeInit+0x118>)
+ 8001294:	4298      	cmp	r0, r3
+ 8001296:	d030      	beq.n	80012fa <HAL_GPIO_DeInit+0xfa>
+ 8001298:	f503 6380 	add.w	r3, r3, #1024	; 0x400
+ 800129c:	4298      	cmp	r0, r3
+ 800129e:	d02e      	beq.n	80012fe <HAL_GPIO_DeInit+0xfe>
+ 80012a0:	f503 6380 	add.w	r3, r3, #1024	; 0x400
+ 80012a4:	4298      	cmp	r0, r3
+ 80012a6:	d02c      	beq.n	8001302 <HAL_GPIO_DeInit+0x102>
+ 80012a8:	f503 6380 	add.w	r3, r3, #1024	; 0x400
+ 80012ac:	4298      	cmp	r0, r3
+ 80012ae:	d02a      	beq.n	8001306 <HAL_GPIO_DeInit+0x106>
+ 80012b0:	f503 6380 	add.w	r3, r3, #1024	; 0x400
+ 80012b4:	4298      	cmp	r0, r3
+ 80012b6:	d028      	beq.n	800130a <HAL_GPIO_DeInit+0x10a>
+ 80012b8:	4550      	cmp	r0, sl
+ 80012ba:	d028      	beq.n	800130e <HAL_GPIO_DeInit+0x10e>
+ 80012bc:	4558      	cmp	r0, fp
+ 80012be:	bf0c      	ite	eq
+ 80012c0:	2307      	moveq	r3, #7
+ 80012c2:	2308      	movne	r3, #8
+ 80012c4:	40bb      	lsls	r3, r7
+ 80012c6:	4573      	cmp	r3, lr
+ 80012c8:	d113      	bne.n	80012f2 <HAL_GPIO_DeInit+0xf2>
+        SYSCFG->EXTICR[position >> 2] &= ~tmp;
+ 80012ca:	68b3      	ldr	r3, [r6, #8]
+ 80012cc:	ea23 0505 	bic.w	r5, r3, r5
+ 80012d0:	60b5      	str	r5, [r6, #8]
+        EXTI->IMR1 &= ~((uint32_t)iocurrent);
+ 80012d2:	6823      	ldr	r3, [r4, #0]
+ 80012d4:	ea23 030c 	bic.w	r3, r3, ip
+ 80012d8:	6023      	str	r3, [r4, #0]
+        EXTI->EMR1 &= ~((uint32_t)iocurrent);
+ 80012da:	6863      	ldr	r3, [r4, #4]
+ 80012dc:	ea23 030c 	bic.w	r3, r3, ip
+ 80012e0:	6063      	str	r3, [r4, #4]
+        EXTI->RTSR1 &= ~((uint32_t)iocurrent);
+ 80012e2:	68a3      	ldr	r3, [r4, #8]
+ 80012e4:	ea23 030c 	bic.w	r3, r3, ip
+ 80012e8:	60a3      	str	r3, [r4, #8]
+        EXTI->FTSR1 &= ~((uint32_t)iocurrent);
+ 80012ea:	68e3      	ldr	r3, [r4, #12]
+ 80012ec:	ea23 030c 	bic.w	r3, r3, ip
+ 80012f0:	60e3      	str	r3, [r4, #12]
+    position++;
+ 80012f2:	3201      	adds	r2, #1
+ 80012f4:	e78e      	b.n	8001214 <HAL_GPIO_DeInit+0x14>
+      if(tmp == (GPIO_GET_INDEX(GPIOx) << (4 * (position & 0x03))))
+ 80012f6:	2300      	movs	r3, #0
+ 80012f8:	e7e4      	b.n	80012c4 <HAL_GPIO_DeInit+0xc4>
+ 80012fa:	2301      	movs	r3, #1
+ 80012fc:	e7e2      	b.n	80012c4 <HAL_GPIO_DeInit+0xc4>
+ 80012fe:	2302      	movs	r3, #2
+ 8001300:	e7e0      	b.n	80012c4 <HAL_GPIO_DeInit+0xc4>
+ 8001302:	2303      	movs	r3, #3
+ 8001304:	e7de      	b.n	80012c4 <HAL_GPIO_DeInit+0xc4>
+ 8001306:	2304      	movs	r3, #4
+ 8001308:	e7dc      	b.n	80012c4 <HAL_GPIO_DeInit+0xc4>
+ 800130a:	2305      	movs	r3, #5
+ 800130c:	e7da      	b.n	80012c4 <HAL_GPIO_DeInit+0xc4>
+ 800130e:	2306      	movs	r3, #6
+ 8001310:	e7d8      	b.n	80012c4 <HAL_GPIO_DeInit+0xc4>
+ 8001312:	bf00      	nop
+ 8001314:	40010400 	.word	0x40010400
+ 8001318:	48000400 	.word	0x48000400
+ 800131c:	48001800 	.word	0x48001800
+ 8001320:	48001c00 	.word	0x48001c00
+
+08001324 <HAL_GPIO_ReadPin>:
+  GPIO_PinState bitstatus;
+
+  /* Check the parameters */
+  assert_param(IS_GPIO_PIN(GPIO_Pin));
+
+  if((GPIOx->IDR & GPIO_Pin) != (uint32_t)GPIO_PIN_RESET)
+ 8001324:	6903      	ldr	r3, [r0, #16]
+ 8001326:	4219      	tst	r1, r3
+  else
+  {
+    bitstatus = GPIO_PIN_RESET;
+  }
+  return bitstatus;
+}
+ 8001328:	bf14      	ite	ne
+ 800132a:	2001      	movne	r0, #1
+ 800132c:	2000      	moveq	r0, #0
+ 800132e:	4770      	bx	lr
+
+08001330 <HAL_GPIO_WritePin>:
+{
+  /* Check the parameters */
+  assert_param(IS_GPIO_PIN(GPIO_Pin));
+  assert_param(IS_GPIO_PIN_ACTION(PinState));
+
+  if(PinState != GPIO_PIN_RESET)
+ 8001330:	b10a      	cbz	r2, 8001336 <HAL_GPIO_WritePin+0x6>
+  {
+    GPIOx->BSRR = (uint32_t)GPIO_Pin;
+ 8001332:	6181      	str	r1, [r0, #24]
+ 8001334:	4770      	bx	lr
+  }
+  else
+  {
+    GPIOx->BRR = (uint32_t)GPIO_Pin;
+ 8001336:	6281      	str	r1, [r0, #40]	; 0x28
+  }
+}
+ 8001338:	4770      	bx	lr
+
+0800133a <HAL_GPIO_TogglePin>:
+void HAL_GPIO_TogglePin(GPIO_TypeDef* GPIOx, uint16_t GPIO_Pin)
+{
+  /* Check the parameters */
+  assert_param(IS_GPIO_PIN(GPIO_Pin));
+
+  GPIOx->ODR ^= GPIO_Pin;
+ 800133a:	6943      	ldr	r3, [r0, #20]
+ 800133c:	4059      	eors	r1, r3
+ 800133e:	6141      	str	r1, [r0, #20]
+}
+ 8001340:	4770      	bx	lr
+
+08001342 <HAL_GPIO_LockPin>:
+  * @param  GPIO_Pin: specifies the port bits to be locked.
+  *         This parameter can be any combination of GPIO_Pin_x where x can be (0..15).
+  * @retval None
+  */
+HAL_StatusTypeDef HAL_GPIO_LockPin(GPIO_TypeDef* GPIOx, uint16_t GPIO_Pin)
+{
+ 8001342:	b082      	sub	sp, #8
+  __IO uint32_t tmp = GPIO_LCKR_LCKK;
+ 8001344:	f44f 3380 	mov.w	r3, #65536	; 0x10000
+ 8001348:	9301      	str	r3, [sp, #4]
+  /* Check the parameters */
+  assert_param(IS_GPIO_LOCK_INSTANCE(GPIOx));
+  assert_param(IS_GPIO_PIN(GPIO_Pin));
+
+  /* Apply lock key write sequence */
+  tmp |= GPIO_Pin;
+ 800134a:	9b01      	ldr	r3, [sp, #4]
+ 800134c:	430b      	orrs	r3, r1
+ 800134e:	9301      	str	r3, [sp, #4]
+  /* Set LCKx bit(s): LCKK='1' + LCK[15-0] */
+  GPIOx->LCKR = tmp;
+ 8001350:	9b01      	ldr	r3, [sp, #4]
+ 8001352:	61c3      	str	r3, [r0, #28]
+  /* Reset LCKx bit(s): LCKK='0' + LCK[15-0] */
+  GPIOx->LCKR = GPIO_Pin;
+ 8001354:	61c1      	str	r1, [r0, #28]
+  /* Set LCKx bit(s): LCKK='1' + LCK[15-0] */
+  GPIOx->LCKR = tmp;
+ 8001356:	9b01      	ldr	r3, [sp, #4]
+ 8001358:	61c3      	str	r3, [r0, #28]
+  /* Read LCKK bit*/
+  tmp = GPIOx->LCKR;
+ 800135a:	69c3      	ldr	r3, [r0, #28]
+ 800135c:	9301      	str	r3, [sp, #4]
+
+  if((GPIOx->LCKR & GPIO_LCKR_LCKK) != RESET)
+ 800135e:	69c0      	ldr	r0, [r0, #28]
+ 8001360:	f480 3080 	eor.w	r0, r0, #65536	; 0x10000
+  }
+  else
+  {
+    return HAL_ERROR;
+  }
+}
+ 8001364:	f3c0 4000 	ubfx	r0, r0, #16, #1
+ 8001368:	b002      	add	sp, #8
+ 800136a:	4770      	bx	lr
+
+0800136c <HAL_GPIO_EXTI_Callback>:
+  UNUSED(GPIO_Pin);
+
+  /* NOTE: This function should not be modified, when the callback is needed,
+           the HAL_GPIO_EXTI_Callback could be implemented in the user file
+   */
+}
+ 800136c:	4770      	bx	lr
+	...
+
+08001370 <HAL_GPIO_EXTI_IRQHandler>:
+  if(__HAL_GPIO_EXTI_GET_IT(GPIO_Pin) != RESET)
+ 8001370:	4a04      	ldr	r2, [pc, #16]	; (8001384 <HAL_GPIO_EXTI_IRQHandler+0x14>)
+ 8001372:	6951      	ldr	r1, [r2, #20]
+ 8001374:	4201      	tst	r1, r0
+{
+ 8001376:	b508      	push	{r3, lr}
+  if(__HAL_GPIO_EXTI_GET_IT(GPIO_Pin) != RESET)
+ 8001378:	d002      	beq.n	8001380 <HAL_GPIO_EXTI_IRQHandler+0x10>
+    __HAL_GPIO_EXTI_CLEAR_IT(GPIO_Pin);
+ 800137a:	6150      	str	r0, [r2, #20]
+    HAL_GPIO_EXTI_Callback(GPIO_Pin);
+ 800137c:	f7ff fff6 	bl	800136c <HAL_GPIO_EXTI_Callback>
+}
+ 8001380:	bd08      	pop	{r3, pc}
+ 8001382:	bf00      	nop
+ 8001384:	40010400 	.word	0x40010400
+
+08001388 <SPI_EndRxTxTransaction.isra.0>:
+static HAL_StatusTypeDef SPI_WaitFifoStateUntilTimeout(SPI_HandleTypeDef *hspi, uint32_t Fifo, uint32_t State,
+                                                       uint32_t Timeout, uint32_t Tickstart)
+{
+  __IO uint8_t tmpreg;
+
+  while ((hspi->Instance->SR & Fifo) != State)
+ 8001388:	6803      	ldr	r3, [r0, #0]
+static HAL_StatusTypeDef SPI_EndRxTxTransaction(SPI_HandleTypeDef *hspi, uint32_t Timeout, uint32_t Tickstart)
+ 800138a:	b082      	sub	sp, #8
+  while ((hspi->Instance->SR & Fifo) != State)
+ 800138c:	689a      	ldr	r2, [r3, #8]
+ 800138e:	f412 5fc0 	tst.w	r2, #6144	; 0x1800
+ 8001392:	d1fb      	bne.n	800138c <SPI_EndRxTxTransaction.isra.0+0x4>
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef SPI_WaitFlagStateUntilTimeout(SPI_HandleTypeDef *hspi, uint32_t Flag, uint32_t State,
+                                                       uint32_t Timeout, uint32_t Tickstart)
+{
+  while ((__HAL_SPI_GET_FLAG(hspi, Flag) ? SET : RESET) != State)
+ 8001394:	689a      	ldr	r2, [r3, #8]
+ 8001396:	0612      	lsls	r2, r2, #24
+ 8001398:	d4fc      	bmi.n	8001394 <SPI_EndRxTxTransaction.isra.0+0xc>
+  while ((hspi->Instance->SR & Fifo) != State)
+ 800139a:	6898      	ldr	r0, [r3, #8]
+ 800139c:	f410 60c0 	ands.w	r0, r0, #1536	; 0x600
+ 80013a0:	d101      	bne.n	80013a6 <SPI_EndRxTxTransaction.isra.0+0x1e>
+}
+ 80013a2:	b002      	add	sp, #8
+ 80013a4:	4770      	bx	lr
+      tmpreg = *((__IO uint8_t *)&hspi->Instance->DR);
+ 80013a6:	7b1a      	ldrb	r2, [r3, #12]
+ 80013a8:	b2d2      	uxtb	r2, r2
+ 80013aa:	f88d 2007 	strb.w	r2, [sp, #7]
+      UNUSED(tmpreg);
+ 80013ae:	f89d 2007 	ldrb.w	r2, [sp, #7]
+ 80013b2:	e7f2      	b.n	800139a <SPI_EndRxTxTransaction.isra.0+0x12>
+
+080013b4 <HAL_SPI_Init>:
+{
+ 80013b4:	b5f0      	push	{r4, r5, r6, r7, lr}
+  if (hspi == NULL)
+ 80013b6:	2800      	cmp	r0, #0
+ 80013b8:	d054      	beq.n	8001464 <HAL_SPI_Init+0xb0>
+  if (hspi->State == HAL_SPI_STATE_RESET)
+ 80013ba:	f890 305d 	ldrb.w	r3, [r0, #93]	; 0x5d
+  if (hspi->Init.TIMode == SPI_TIMODE_DISABLE)
+ 80013be:	f8d0 c024 	ldr.w	ip, [r0, #36]	; 0x24
+  if (hspi->State == HAL_SPI_STATE_RESET)
+ 80013c2:	f003 02ff 	and.w	r2, r3, #255	; 0xff
+ 80013c6:	b90b      	cbnz	r3, 80013cc <HAL_SPI_Init+0x18>
+    hspi->Lock = HAL_UNLOCKED;
+ 80013c8:	f880 205c 	strb.w	r2, [r0, #92]	; 0x5c
+  __HAL_SPI_DISABLE(hspi);
+ 80013cc:	6801      	ldr	r1, [r0, #0]
+  if (hspi->Init.DataSize > SPI_DATASIZE_8BIT)
+ 80013ce:	68c2      	ldr	r2, [r0, #12]
+  hspi->State = HAL_SPI_STATE_BUSY;
+ 80013d0:	2302      	movs	r3, #2
+ 80013d2:	f880 305d 	strb.w	r3, [r0, #93]	; 0x5d
+  __HAL_SPI_DISABLE(hspi);
+ 80013d6:	680b      	ldr	r3, [r1, #0]
+  if (hspi->Init.DataSize > SPI_DATASIZE_8BIT)
+ 80013d8:	f5b2 6fe0 	cmp.w	r2, #1792	; 0x700
+  __HAL_SPI_DISABLE(hspi);
+ 80013dc:	f023 0340 	bic.w	r3, r3, #64	; 0x40
+ 80013e0:	600b      	str	r3, [r1, #0]
+  if (hspi->Init.DataSize > SPI_DATASIZE_8BIT)
+ 80013e2:	f04f 0300 	mov.w	r3, #0
+ 80013e6:	d83f      	bhi.n	8001468 <HAL_SPI_Init+0xb4>
+    frxth = SPI_RXFIFO_THRESHOLD_QF;
+ 80013e8:	f44f 5580 	mov.w	r5, #4096	; 0x1000
+  if ((hspi->Init.DataSize != SPI_DATASIZE_16BIT) && (hspi->Init.DataSize != SPI_DATASIZE_8BIT))
+ 80013ec:	d000      	beq.n	80013f0 <HAL_SPI_Init+0x3c>
+    hspi->Init.CRCCalculation = SPI_CRCCALCULATION_DISABLE;
+ 80013ee:	6283      	str	r3, [r0, #40]	; 0x28
+  if (hspi->Init.CRCLength == SPI_CRC_LENGTH_DATASIZE)
+ 80013f0:	6b03      	ldr	r3, [r0, #48]	; 0x30
+ 80013f2:	b92b      	cbnz	r3, 8001400 <HAL_SPI_Init+0x4c>
+    if (hspi->Init.DataSize > SPI_DATASIZE_8BIT)
+ 80013f4:	f5b2 6fe0 	cmp.w	r2, #1792	; 0x700
+      hspi->Init.CRCLength = SPI_CRC_LENGTH_16BIT;
+ 80013f8:	bf8c      	ite	hi
+ 80013fa:	2302      	movhi	r3, #2
+      hspi->Init.CRCLength = SPI_CRC_LENGTH_8BIT;
+ 80013fc:	2301      	movls	r3, #1
+ 80013fe:	6303      	str	r3, [r0, #48]	; 0x30
+  WRITE_REG(hspi->Instance->CR1, (hspi->Init.Mode | hspi->Init.Direction |
+ 8001400:	e9d0 3701 	ldrd	r3, r7, [r0, #4]
+ 8001404:	433b      	orrs	r3, r7
+ 8001406:	6907      	ldr	r7, [r0, #16]
+ 8001408:	6984      	ldr	r4, [r0, #24]
+ 800140a:	6a86      	ldr	r6, [r0, #40]	; 0x28
+ 800140c:	433b      	orrs	r3, r7
+ 800140e:	6947      	ldr	r7, [r0, #20]
+ 8001410:	433b      	orrs	r3, r7
+ 8001412:	69c7      	ldr	r7, [r0, #28]
+ 8001414:	433b      	orrs	r3, r7
+ 8001416:	6a07      	ldr	r7, [r0, #32]
+ 8001418:	433b      	orrs	r3, r7
+ 800141a:	4333      	orrs	r3, r6
+ 800141c:	f404 7700 	and.w	r7, r4, #512	; 0x200
+ 8001420:	433b      	orrs	r3, r7
+ 8001422:	600b      	str	r3, [r1, #0]
+  if (hspi->Init.CRCLength == SPI_CRC_LENGTH_16BIT)
+ 8001424:	6b03      	ldr	r3, [r0, #48]	; 0x30
+ 8001426:	2b02      	cmp	r3, #2
+    hspi->Instance->CR1 |= SPI_CR1_CRCL;
+ 8001428:	bf02      	ittt	eq
+ 800142a:	680b      	ldreq	r3, [r1, #0]
+ 800142c:	f443 6300 	orreq.w	r3, r3, #2048	; 0x800
+ 8001430:	600b      	streq	r3, [r1, #0]
+  WRITE_REG(hspi->Instance->CR2, (((hspi->Init.NSS >> 16U) & SPI_CR2_SSOE) | hspi->Init.TIMode |
+ 8001432:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 8001434:	ea4c 0202 	orr.w	r2, ip, r2
+ 8001438:	0c24      	lsrs	r4, r4, #16
+ 800143a:	431a      	orrs	r2, r3
+ 800143c:	f004 0404 	and.w	r4, r4, #4
+ 8001440:	4322      	orrs	r2, r4
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 8001442:	f5b6 5f00 	cmp.w	r6, #8192	; 0x2000
+    WRITE_REG(hspi->Instance->CRCPR, hspi->Init.CRCPolynomial);
+ 8001446:	bf08      	it	eq
+ 8001448:	6ac3      	ldreq	r3, [r0, #44]	; 0x2c
+  WRITE_REG(hspi->Instance->CR2, (((hspi->Init.NSS >> 16U) & SPI_CR2_SSOE) | hspi->Init.TIMode |
+ 800144a:	ea45 0502 	orr.w	r5, r5, r2
+ 800144e:	604d      	str	r5, [r1, #4]
+  hspi->State     = HAL_SPI_STATE_READY;
+ 8001450:	f04f 0201 	mov.w	r2, #1
+    WRITE_REG(hspi->Instance->CRCPR, hspi->Init.CRCPolynomial);
+ 8001454:	bf08      	it	eq
+ 8001456:	610b      	streq	r3, [r1, #16]
+  hspi->ErrorCode = HAL_SPI_ERROR_NONE;
+ 8001458:	2300      	movs	r3, #0
+ 800145a:	6603      	str	r3, [r0, #96]	; 0x60
+  hspi->State     = HAL_SPI_STATE_READY;
+ 800145c:	f880 205d 	strb.w	r2, [r0, #93]	; 0x5d
+  return HAL_OK;
+ 8001460:	4618      	mov	r0, r3
+}
+ 8001462:	bdf0      	pop	{r4, r5, r6, r7, pc}
+    return HAL_ERROR;
+ 8001464:	2001      	movs	r0, #1
+ 8001466:	e7fc      	b.n	8001462 <HAL_SPI_Init+0xae>
+    frxth = SPI_RXFIFO_THRESHOLD_HF;
+ 8001468:	461d      	mov	r5, r3
+  if ((hspi->Init.DataSize != SPI_DATASIZE_16BIT) && (hspi->Init.DataSize != SPI_DATASIZE_8BIT))
+ 800146a:	f5b2 6f70 	cmp.w	r2, #3840	; 0xf00
+ 800146e:	e7bd      	b.n	80013ec <HAL_SPI_Init+0x38>
+
+08001470 <HAL_SPI_Transmit>:
+{
+ 8001470:	e92d 41f3 	stmdb	sp!, {r0, r1, r4, r5, r6, r7, r8, lr}
+ 8001474:	461e      	mov	r6, r3
+  __HAL_LOCK(hspi);
+ 8001476:	f890 305c 	ldrb.w	r3, [r0, #92]	; 0x5c
+ 800147a:	2b01      	cmp	r3, #1
+{
+ 800147c:	4604      	mov	r4, r0
+ 800147e:	460d      	mov	r5, r1
+ 8001480:	4690      	mov	r8, r2
+  __HAL_LOCK(hspi);
+ 8001482:	f000 809c 	beq.w	80015be <HAL_SPI_Transmit+0x14e>
+ 8001486:	2301      	movs	r3, #1
+ 8001488:	f880 305c 	strb.w	r3, [r0, #92]	; 0x5c
+  tickstart = HAL_GetTick();
+ 800148c:	f005 fe60 	bl	8007150 <HAL_GetTick>
+  if (hspi->State != HAL_SPI_STATE_READY)
+ 8001490:	f894 305d 	ldrb.w	r3, [r4, #93]	; 0x5d
+ 8001494:	2b01      	cmp	r3, #1
+  tickstart = HAL_GetTick();
+ 8001496:	4607      	mov	r7, r0
+  if (hspi->State != HAL_SPI_STATE_READY)
+ 8001498:	b2d8      	uxtb	r0, r3
+ 800149a:	f040 808e 	bne.w	80015ba <HAL_SPI_Transmit+0x14a>
+  if ((pData == NULL) || (Size == 0U))
+ 800149e:	2d00      	cmp	r5, #0
+ 80014a0:	d07a      	beq.n	8001598 <HAL_SPI_Transmit+0x128>
+ 80014a2:	f1b8 0f00 	cmp.w	r8, #0
+ 80014a6:	d077      	beq.n	8001598 <HAL_SPI_Transmit+0x128>
+  hspi->State       = HAL_SPI_STATE_BUSY_TX;
+ 80014a8:	2303      	movs	r3, #3
+ 80014aa:	f884 305d 	strb.w	r3, [r4, #93]	; 0x5d
+  if (hspi->Init.Direction == SPI_DIRECTION_1LINE)
+ 80014ae:	68a3      	ldr	r3, [r4, #8]
+    SPI_1LINE_TX(hspi);
+ 80014b0:	6822      	ldr	r2, [r4, #0]
+  hspi->pTxBuffPtr  = (uint8_t *)pData;
+ 80014b2:	63a5      	str	r5, [r4, #56]	; 0x38
+  hspi->ErrorCode   = HAL_SPI_ERROR_NONE;
+ 80014b4:	2100      	movs	r1, #0
+  if (hspi->Init.Direction == SPI_DIRECTION_1LINE)
+ 80014b6:	f5b3 4f00 	cmp.w	r3, #32768	; 0x8000
+  hspi->ErrorCode   = HAL_SPI_ERROR_NONE;
+ 80014ba:	6621      	str	r1, [r4, #96]	; 0x60
+  hspi->TxXferCount = Size;
+ 80014bc:	f8a4 803e 	strh.w	r8, [r4, #62]	; 0x3e
+  hspi->RxXferCount = 0U;
+ 80014c0:	f8a4 1046 	strh.w	r1, [r4, #70]	; 0x46
+    SPI_1LINE_TX(hspi);
+ 80014c4:	bf08      	it	eq
+ 80014c6:	6813      	ldreq	r3, [r2, #0]
+  hspi->TxXferSize  = Size;
+ 80014c8:	f8a4 803c 	strh.w	r8, [r4, #60]	; 0x3c
+    SPI_1LINE_TX(hspi);
+ 80014cc:	bf08      	it	eq
+ 80014ce:	f443 4380 	orreq.w	r3, r3, #16384	; 0x4000
+  hspi->RxISR       = NULL;
+ 80014d2:	e9c4 1113 	strd	r1, r1, [r4, #76]	; 0x4c
+  hspi->pRxBuffPtr  = (uint8_t *)NULL;
+ 80014d6:	6421      	str	r1, [r4, #64]	; 0x40
+  hspi->RxXferSize  = 0U;
+ 80014d8:	f8a4 1044 	strh.w	r1, [r4, #68]	; 0x44
+    SPI_1LINE_TX(hspi);
+ 80014dc:	bf08      	it	eq
+ 80014de:	6013      	streq	r3, [r2, #0]
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 80014e0:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 80014e2:	f5b3 5f00 	cmp.w	r3, #8192	; 0x2000
+ 80014e6:	d107      	bne.n	80014f8 <HAL_SPI_Transmit+0x88>
+    SPI_RESET_CRC(hspi);
+ 80014e8:	6813      	ldr	r3, [r2, #0]
+ 80014ea:	f423 5300 	bic.w	r3, r3, #8192	; 0x2000
+ 80014ee:	6013      	str	r3, [r2, #0]
+ 80014f0:	6813      	ldr	r3, [r2, #0]
+ 80014f2:	f443 5300 	orr.w	r3, r3, #8192	; 0x2000
+ 80014f6:	6013      	str	r3, [r2, #0]
+  if ((hspi->Instance->CR1 & SPI_CR1_SPE) != SPI_CR1_SPE)
+ 80014f8:	6813      	ldr	r3, [r2, #0]
+ 80014fa:	0659      	lsls	r1, r3, #25
+    __HAL_SPI_ENABLE(hspi);
+ 80014fc:	bf5e      	ittt	pl
+ 80014fe:	6813      	ldrpl	r3, [r2, #0]
+ 8001500:	f043 0340 	orrpl.w	r3, r3, #64	; 0x40
+ 8001504:	6013      	strpl	r3, [r2, #0]
+    if ((hspi->Init.Mode == SPI_MODE_SLAVE) || (hspi->TxXferCount == 0x01U))
+ 8001506:	6863      	ldr	r3, [r4, #4]
+ 8001508:	b11b      	cbz	r3, 8001512 <HAL_SPI_Transmit+0xa2>
+ 800150a:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 800150c:	b29b      	uxth	r3, r3
+ 800150e:	2b01      	cmp	r3, #1
+ 8001510:	d110      	bne.n	8001534 <HAL_SPI_Transmit+0xc4>
+      if (hspi->TxXferCount > 1U)
+ 8001512:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 8001514:	b29b      	uxth	r3, r3
+ 8001516:	2b01      	cmp	r3, #1
+ 8001518:	d905      	bls.n	8001526 <HAL_SPI_Transmit+0xb6>
+        hspi->Instance->DR = *((uint16_t *)pData);
+ 800151a:	f835 3b02 	ldrh.w	r3, [r5], #2
+ 800151e:	60d3      	str	r3, [r2, #12]
+          hspi->TxXferCount -= 2U;
+ 8001520:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 8001522:	3b02      	subs	r3, #2
+ 8001524:	e004      	b.n	8001530 <HAL_SPI_Transmit+0xc0>
+        *((__IO uint8_t *)&hspi->Instance->DR) = (*pData++);
+ 8001526:	f815 3b01 	ldrb.w	r3, [r5], #1
+ 800152a:	7313      	strb	r3, [r2, #12]
+        hspi->TxXferCount--;
+ 800152c:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 800152e:	3b01      	subs	r3, #1
+ 8001530:	b29b      	uxth	r3, r3
+ 8001532:	87e3      	strh	r3, [r4, #62]	; 0x3e
+    while (hspi->TxXferCount > 0U)
+ 8001534:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 8001536:	b29b      	uxth	r3, r3
+ 8001538:	b9e3      	cbnz	r3, 8001574 <HAL_SPI_Transmit+0x104>
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 800153a:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 800153c:	f5b3 5f00 	cmp.w	r3, #8192	; 0x2000
+    SET_BIT(hspi->Instance->CR1, SPI_CR1_CRCNEXT);
+ 8001540:	bf01      	itttt	eq
+ 8001542:	6822      	ldreq	r2, [r4, #0]
+ 8001544:	6813      	ldreq	r3, [r2, #0]
+ 8001546:	f443 5380 	orreq.w	r3, r3, #4096	; 0x1000
+ 800154a:	6013      	streq	r3, [r2, #0]
+  if (SPI_EndRxTxTransaction(hspi, Timeout, tickstart) != HAL_OK)
+ 800154c:	4620      	mov	r0, r4
+ 800154e:	f7ff ff1b 	bl	8001388 <SPI_EndRxTxTransaction.isra.0>
+ 8001552:	b108      	cbz	r0, 8001558 <HAL_SPI_Transmit+0xe8>
+    hspi->ErrorCode = HAL_SPI_ERROR_FLAG;
+ 8001554:	2320      	movs	r3, #32
+ 8001556:	6623      	str	r3, [r4, #96]	; 0x60
+  if (hspi->Init.Direction == SPI_DIRECTION_2LINES)
+ 8001558:	68a3      	ldr	r3, [r4, #8]
+ 800155a:	b933      	cbnz	r3, 800156a <HAL_SPI_Transmit+0xfa>
+    __HAL_SPI_CLEAR_OVRFLAG(hspi);
+ 800155c:	9301      	str	r3, [sp, #4]
+ 800155e:	6823      	ldr	r3, [r4, #0]
+ 8001560:	68da      	ldr	r2, [r3, #12]
+ 8001562:	9201      	str	r2, [sp, #4]
+ 8001564:	689b      	ldr	r3, [r3, #8]
+ 8001566:	9301      	str	r3, [sp, #4]
+ 8001568:	9b01      	ldr	r3, [sp, #4]
+  if (hspi->ErrorCode != HAL_SPI_ERROR_NONE)
+ 800156a:	6e20      	ldr	r0, [r4, #96]	; 0x60
+    errorcode = HAL_BUSY;
+ 800156c:	3800      	subs	r0, #0
+ 800156e:	bf18      	it	ne
+ 8001570:	2001      	movne	r0, #1
+error:
+ 8001572:	e011      	b.n	8001598 <HAL_SPI_Transmit+0x128>
+      if (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_TXE))
+ 8001574:	6823      	ldr	r3, [r4, #0]
+ 8001576:	689a      	ldr	r2, [r3, #8]
+ 8001578:	0792      	lsls	r2, r2, #30
+ 800157a:	d50b      	bpl.n	8001594 <HAL_SPI_Transmit+0x124>
+        if (hspi->TxXferCount > 1U)
+ 800157c:	8fe2      	ldrh	r2, [r4, #62]	; 0x3e
+ 800157e:	b292      	uxth	r2, r2
+ 8001580:	2a01      	cmp	r2, #1
+ 8001582:	d903      	bls.n	800158c <HAL_SPI_Transmit+0x11c>
+          hspi->Instance->DR = *((uint16_t *)pData);
+ 8001584:	f835 2b02 	ldrh.w	r2, [r5], #2
+ 8001588:	60da      	str	r2, [r3, #12]
+ 800158a:	e7c9      	b.n	8001520 <HAL_SPI_Transmit+0xb0>
+          *((__IO uint8_t *)&hspi->Instance->DR) = (*pData++);
+ 800158c:	f815 2b01 	ldrb.w	r2, [r5], #1
+ 8001590:	731a      	strb	r2, [r3, #12]
+          hspi->TxXferCount--;
+ 8001592:	e7cb      	b.n	800152c <HAL_SPI_Transmit+0xbc>
+        if ((Timeout == 0U) || ((Timeout != HAL_MAX_DELAY) && ((HAL_GetTick() - tickstart) >=  Timeout)))
+ 8001594:	b94e      	cbnz	r6, 80015aa <HAL_SPI_Transmit+0x13a>
+          errorcode = HAL_TIMEOUT;
+ 8001596:	2003      	movs	r0, #3
+  hspi->State = HAL_SPI_STATE_READY;
+ 8001598:	2301      	movs	r3, #1
+ 800159a:	f884 305d 	strb.w	r3, [r4, #93]	; 0x5d
+  __HAL_UNLOCK(hspi);
+ 800159e:	2300      	movs	r3, #0
+ 80015a0:	f884 305c 	strb.w	r3, [r4, #92]	; 0x5c
+}
+ 80015a4:	b002      	add	sp, #8
+ 80015a6:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+        if ((Timeout == 0U) || ((Timeout != HAL_MAX_DELAY) && ((HAL_GetTick() - tickstart) >=  Timeout)))
+ 80015aa:	1c73      	adds	r3, r6, #1
+ 80015ac:	d0c2      	beq.n	8001534 <HAL_SPI_Transmit+0xc4>
+ 80015ae:	f005 fdcf 	bl	8007150 <HAL_GetTick>
+ 80015b2:	1bc0      	subs	r0, r0, r7
+ 80015b4:	42b0      	cmp	r0, r6
+ 80015b6:	d3bd      	bcc.n	8001534 <HAL_SPI_Transmit+0xc4>
+ 80015b8:	e7ed      	b.n	8001596 <HAL_SPI_Transmit+0x126>
+    errorcode = HAL_BUSY;
+ 80015ba:	2002      	movs	r0, #2
+ 80015bc:	e7ec      	b.n	8001598 <HAL_SPI_Transmit+0x128>
+  __HAL_LOCK(hspi);
+ 80015be:	2002      	movs	r0, #2
+ 80015c0:	e7f0      	b.n	80015a4 <HAL_SPI_Transmit+0x134>
+
+080015c2 <HAL_SPI_TransmitReceive>:
+  * @param  Timeout: Timeout duration
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HAL_SPI_TransmitReceive(SPI_HandleTypeDef *hspi, uint8_t *pTxData, uint8_t *pRxData, uint16_t Size,
+                                          uint32_t Timeout)
+{
+ 80015c2:	e92d 43f7 	stmdb	sp!, {r0, r1, r2, r4, r5, r6, r7, r8, r9, lr}
+ 80015c6:	461e      	mov	r6, r3
+  uint32_t tmp = 0U, tmp1 = 0U;
+#if (USE_SPI_CRC != 0U)
+  __IO uint16_t tmpreg = 0U;
+ 80015c8:	2300      	movs	r3, #0
+ 80015ca:	f8ad 3006 	strh.w	r3, [sp, #6]
+
+  /* Check Direction parameter */
+  assert_param(IS_SPI_DIRECTION_2LINES(hspi->Init.Direction));
+
+  /* Process Locked */
+  __HAL_LOCK(hspi);
+ 80015ce:	f890 305c 	ldrb.w	r3, [r0, #92]	; 0x5c
+{
+ 80015d2:	f8dd 8028 	ldr.w	r8, [sp, #40]	; 0x28
+  __HAL_LOCK(hspi);
+ 80015d6:	2b01      	cmp	r3, #1
+{
+ 80015d8:	4604      	mov	r4, r0
+ 80015da:	460d      	mov	r5, r1
+ 80015dc:	4617      	mov	r7, r2
+  __HAL_LOCK(hspi);
+ 80015de:	f000 8124 	beq.w	800182a <HAL_SPI_TransmitReceive+0x268>
+ 80015e2:	2301      	movs	r3, #1
+ 80015e4:	f880 305c 	strb.w	r3, [r0, #92]	; 0x5c
+
+  /* Init tickstart for timeout management*/
+  tickstart = HAL_GetTick();
+ 80015e8:	f005 fdb2 	bl	8007150 <HAL_GetTick>
+
+  tmp  = hspi->State;
+ 80015ec:	f894 305d 	ldrb.w	r3, [r4, #93]	; 0x5d
+  tmp1 = hspi->Init.Mode;
+ 80015f0:	6861      	ldr	r1, [r4, #4]
+
+  if (!((tmp == HAL_SPI_STATE_READY) || \
+ 80015f2:	2b01      	cmp	r3, #1
+  tickstart = HAL_GetTick();
+ 80015f4:	4681      	mov	r9, r0
+  tmp  = hspi->State;
+ 80015f6:	b2da      	uxtb	r2, r3
+  if (!((tmp == HAL_SPI_STATE_READY) || \
+ 80015f8:	d00a      	beq.n	8001610 <HAL_SPI_TransmitReceive+0x4e>
+ 80015fa:	f5b1 7f82 	cmp.w	r1, #260	; 0x104
+ 80015fe:	f040 8112 	bne.w	8001826 <HAL_SPI_TransmitReceive+0x264>
+        ((tmp1 == SPI_MODE_MASTER) && (hspi->Init.Direction == SPI_DIRECTION_2LINES) && (tmp == HAL_SPI_STATE_BUSY_RX))))
+ 8001602:	68a3      	ldr	r3, [r4, #8]
+ 8001604:	2b00      	cmp	r3, #0
+ 8001606:	f040 810e 	bne.w	8001826 <HAL_SPI_TransmitReceive+0x264>
+ 800160a:	2a04      	cmp	r2, #4
+ 800160c:	f040 810b 	bne.w	8001826 <HAL_SPI_TransmitReceive+0x264>
+  {
+    errorcode = HAL_BUSY;
+    goto error;
+  }
+
+  if ((pTxData == NULL) || (pRxData == NULL) || (Size == 0U))
+ 8001610:	b955      	cbnz	r5, 8001628 <HAL_SPI_TransmitReceive+0x66>
+  {
+    errorcode = HAL_ERROR;
+ 8001612:	2101      	movs	r1, #1
+  {
+    errorcode = HAL_ERROR;
+  }
+
+error :
+  hspi->State = HAL_SPI_STATE_READY;
+ 8001614:	2301      	movs	r3, #1
+ 8001616:	f884 305d 	strb.w	r3, [r4, #93]	; 0x5d
+  __HAL_UNLOCK(hspi);
+ 800161a:	2300      	movs	r3, #0
+ 800161c:	f884 305c 	strb.w	r3, [r4, #92]	; 0x5c
+  return errorcode;
+}
+ 8001620:	4608      	mov	r0, r1
+ 8001622:	b003      	add	sp, #12
+ 8001624:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+  if ((pTxData == NULL) || (pRxData == NULL) || (Size == 0U))
+ 8001628:	2f00      	cmp	r7, #0
+ 800162a:	d0f2      	beq.n	8001612 <HAL_SPI_TransmitReceive+0x50>
+ 800162c:	2e00      	cmp	r6, #0
+ 800162e:	d0f0      	beq.n	8001612 <HAL_SPI_TransmitReceive+0x50>
+  if (hspi->State != HAL_SPI_STATE_BUSY_RX)
+ 8001630:	f894 305d 	ldrb.w	r3, [r4, #93]	; 0x5d
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 8001634:	6aa2      	ldr	r2, [r4, #40]	; 0x28
+  hspi->pRxBuffPtr  = (uint8_t *)pRxData;
+ 8001636:	6427      	str	r7, [r4, #64]	; 0x40
+  if (hspi->State != HAL_SPI_STATE_BUSY_RX)
+ 8001638:	2b04      	cmp	r3, #4
+    hspi->State = HAL_SPI_STATE_BUSY_TX_RX;
+ 800163a:	bf1c      	itt	ne
+ 800163c:	2305      	movne	r3, #5
+ 800163e:	f884 305d 	strbne.w	r3, [r4, #93]	; 0x5d
+  hspi->ErrorCode   = HAL_SPI_ERROR_NONE;
+ 8001642:	2300      	movs	r3, #0
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 8001644:	f5b2 5f00 	cmp.w	r2, #8192	; 0x2000
+  hspi->ErrorCode   = HAL_SPI_ERROR_NONE;
+ 8001648:	6623      	str	r3, [r4, #96]	; 0x60
+  hspi->TxISR       = NULL;
+ 800164a:	e9c4 3313 	strd	r3, r3, [r4, #76]	; 0x4c
+  hspi->RxXferCount = Size;
+ 800164e:	f8a4 6046 	strh.w	r6, [r4, #70]	; 0x46
+    SPI_RESET_CRC(hspi);
+ 8001652:	6823      	ldr	r3, [r4, #0]
+  hspi->RxXferSize  = Size;
+ 8001654:	f8a4 6044 	strh.w	r6, [r4, #68]	; 0x44
+  hspi->pTxBuffPtr  = (uint8_t *)pTxData;
+ 8001658:	63a5      	str	r5, [r4, #56]	; 0x38
+  hspi->TxXferCount = Size;
+ 800165a:	87e6      	strh	r6, [r4, #62]	; 0x3e
+  hspi->TxXferSize  = Size;
+ 800165c:	87a6      	strh	r6, [r4, #60]	; 0x3c
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 800165e:	d107      	bne.n	8001670 <HAL_SPI_TransmitReceive+0xae>
+    SPI_RESET_CRC(hspi);
+ 8001660:	681a      	ldr	r2, [r3, #0]
+ 8001662:	f422 5200 	bic.w	r2, r2, #8192	; 0x2000
+ 8001666:	601a      	str	r2, [r3, #0]
+ 8001668:	681a      	ldr	r2, [r3, #0]
+ 800166a:	f442 5200 	orr.w	r2, r2, #8192	; 0x2000
+ 800166e:	601a      	str	r2, [r3, #0]
+  if ((hspi->Init.DataSize > SPI_DATASIZE_8BIT) || (hspi->RxXferCount > 1U))
+ 8001670:	68e2      	ldr	r2, [r4, #12]
+ 8001672:	f5b2 6fe0 	cmp.w	r2, #1792	; 0x700
+ 8001676:	d804      	bhi.n	8001682 <HAL_SPI_TransmitReceive+0xc0>
+ 8001678:	f8b4 2046 	ldrh.w	r2, [r4, #70]	; 0x46
+ 800167c:	b292      	uxth	r2, r2
+ 800167e:	2a01      	cmp	r2, #1
+ 8001680:	d94e      	bls.n	8001720 <HAL_SPI_TransmitReceive+0x15e>
+    CLEAR_BIT(hspi->Instance->CR2, SPI_RXFIFO_THRESHOLD);
+ 8001682:	685a      	ldr	r2, [r3, #4]
+ 8001684:	f422 5280 	bic.w	r2, r2, #4096	; 0x1000
+    SET_BIT(hspi->Instance->CR2, SPI_RXFIFO_THRESHOLD);
+ 8001688:	605a      	str	r2, [r3, #4]
+  if ((hspi->Instance->CR1 & SPI_CR1_SPE) != SPI_CR1_SPE)
+ 800168a:	681a      	ldr	r2, [r3, #0]
+ 800168c:	0650      	lsls	r0, r2, #25
+    __HAL_SPI_ENABLE(hspi);
+ 800168e:	bf5e      	ittt	pl
+ 8001690:	681a      	ldrpl	r2, [r3, #0]
+ 8001692:	f042 0240 	orrpl.w	r2, r2, #64	; 0x40
+ 8001696:	601a      	strpl	r2, [r3, #0]
+    if ((hspi->Init.Mode == SPI_MODE_SLAVE) || (hspi->TxXferCount == 0x01U))
+ 8001698:	b119      	cbz	r1, 80016a2 <HAL_SPI_TransmitReceive+0xe0>
+ 800169a:	8fe2      	ldrh	r2, [r4, #62]	; 0x3e
+ 800169c:	b292      	uxth	r2, r2
+ 800169e:	2a01      	cmp	r2, #1
+ 80016a0:	d10a      	bne.n	80016b8 <HAL_SPI_TransmitReceive+0xf6>
+      if (hspi->TxXferCount > 1U)
+ 80016a2:	8fe2      	ldrh	r2, [r4, #62]	; 0x3e
+ 80016a4:	b292      	uxth	r2, r2
+ 80016a6:	2a01      	cmp	r2, #1
+ 80016a8:	d93e      	bls.n	8001728 <HAL_SPI_TransmitReceive+0x166>
+        hspi->Instance->DR = *((uint16_t *)pTxData);
+ 80016aa:	f835 2b02 	ldrh.w	r2, [r5], #2
+ 80016ae:	60da      	str	r2, [r3, #12]
+        hspi->TxXferCount -= 2U;
+ 80016b0:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 80016b2:	3b02      	subs	r3, #2
+ 80016b4:	b29b      	uxth	r3, r3
+ 80016b6:	87e3      	strh	r3, [r4, #62]	; 0x3e
+        txallowed = 1U;
+ 80016b8:	2601      	movs	r6, #1
+    while ((hspi->TxXferCount > 0U) || (hspi->RxXferCount > 0U))
+ 80016ba:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 80016bc:	b29b      	uxth	r3, r3
+ 80016be:	2b00      	cmp	r3, #0
+ 80016c0:	d138      	bne.n	8001734 <HAL_SPI_TransmitReceive+0x172>
+ 80016c2:	f8b4 3046 	ldrh.w	r3, [r4, #70]	; 0x46
+ 80016c6:	b29b      	uxth	r3, r3
+ 80016c8:	2b00      	cmp	r3, #0
+ 80016ca:	d133      	bne.n	8001734 <HAL_SPI_TransmitReceive+0x172>
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 80016cc:	6aa2      	ldr	r2, [r4, #40]	; 0x28
+      if (txallowed && (hspi->TxXferCount > 0U) && (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_TXE)))
+ 80016ce:	6823      	ldr	r3, [r4, #0]
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 80016d0:	f5b2 5f00 	cmp.w	r2, #8192	; 0x2000
+ 80016d4:	d10d      	bne.n	80016f2 <HAL_SPI_TransmitReceive+0x130>
+  while ((__HAL_SPI_GET_FLAG(hspi, Flag) ? SET : RESET) != State)
+ 80016d6:	689a      	ldr	r2, [r3, #8]
+ 80016d8:	07d1      	lsls	r1, r2, #31
+ 80016da:	d5fc      	bpl.n	80016d6 <HAL_SPI_TransmitReceive+0x114>
+    if (hspi->Init.DataSize == SPI_DATASIZE_16BIT)
+ 80016dc:	68e2      	ldr	r2, [r4, #12]
+ 80016de:	f5b2 6f70 	cmp.w	r2, #3840	; 0xf00
+ 80016e2:	f040 8092 	bne.w	800180a <HAL_SPI_TransmitReceive+0x248>
+      tmpreg = hspi->Instance->DR;
+ 80016e6:	68da      	ldr	r2, [r3, #12]
+ 80016e8:	b292      	uxth	r2, r2
+        tmpreg = *(__IO uint8_t *)&hspi->Instance->DR;
+ 80016ea:	f8ad 2006 	strh.w	r2, [sp, #6]
+        UNUSED(tmpreg);
+ 80016ee:	f8bd 2006 	ldrh.w	r2, [sp, #6]
+  if (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_CRCERR))
+ 80016f2:	6899      	ldr	r1, [r3, #8]
+ 80016f4:	f011 0110 	ands.w	r1, r1, #16
+ 80016f8:	d007      	beq.n	800170a <HAL_SPI_TransmitReceive+0x148>
+    SET_BIT(hspi->ErrorCode, HAL_SPI_ERROR_CRC);
+ 80016fa:	6e22      	ldr	r2, [r4, #96]	; 0x60
+ 80016fc:	f042 0202 	orr.w	r2, r2, #2
+ 8001700:	6622      	str	r2, [r4, #96]	; 0x60
+    __HAL_SPI_CLEAR_CRCERRFLAG(hspi);
+ 8001702:	f64f 72ef 	movw	r2, #65519	; 0xffef
+ 8001706:	609a      	str	r2, [r3, #8]
+    errorcode = HAL_ERROR;
+ 8001708:	2101      	movs	r1, #1
+  if (SPI_EndRxTxTransaction(hspi, Timeout, tickstart) != HAL_OK)
+ 800170a:	4620      	mov	r0, r4
+ 800170c:	f7ff fe3c 	bl	8001388 <SPI_EndRxTxTransaction.isra.0>
+ 8001710:	b108      	cbz	r0, 8001716 <HAL_SPI_TransmitReceive+0x154>
+    hspi->ErrorCode = HAL_SPI_ERROR_FLAG;
+ 8001712:	2320      	movs	r3, #32
+ 8001714:	6623      	str	r3, [r4, #96]	; 0x60
+  if (hspi->ErrorCode != HAL_SPI_ERROR_NONE)
+ 8001716:	6e23      	ldr	r3, [r4, #96]	; 0x60
+ 8001718:	2b00      	cmp	r3, #0
+ 800171a:	f47f af7a 	bne.w	8001612 <HAL_SPI_TransmitReceive+0x50>
+ 800171e:	e779      	b.n	8001614 <HAL_SPI_TransmitReceive+0x52>
+    SET_BIT(hspi->Instance->CR2, SPI_RXFIFO_THRESHOLD);
+ 8001720:	685a      	ldr	r2, [r3, #4]
+ 8001722:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 8001726:	e7af      	b.n	8001688 <HAL_SPI_TransmitReceive+0xc6>
+        *(__IO uint8_t *)&hspi->Instance->DR = (*pTxData++);
+ 8001728:	f815 2b01 	ldrb.w	r2, [r5], #1
+ 800172c:	731a      	strb	r2, [r3, #12]
+        hspi->TxXferCount--;
+ 800172e:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 8001730:	3b01      	subs	r3, #1
+ 8001732:	e7bf      	b.n	80016b4 <HAL_SPI_TransmitReceive+0xf2>
+      if (txallowed && (hspi->TxXferCount > 0U) && (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_TXE)))
+ 8001734:	2e00      	cmp	r6, #0
+ 8001736:	d030      	beq.n	800179a <HAL_SPI_TransmitReceive+0x1d8>
+ 8001738:	8fe3      	ldrh	r3, [r4, #62]	; 0x3e
+ 800173a:	b29b      	uxth	r3, r3
+ 800173c:	2b00      	cmp	r3, #0
+ 800173e:	d02c      	beq.n	800179a <HAL_SPI_TransmitReceive+0x1d8>
+ 8001740:	6823      	ldr	r3, [r4, #0]
+ 8001742:	689a      	ldr	r2, [r3, #8]
+ 8001744:	0792      	lsls	r2, r2, #30
+ 8001746:	d528      	bpl.n	800179a <HAL_SPI_TransmitReceive+0x1d8>
+        if (hspi->TxXferCount > 1U)
+ 8001748:	8fe2      	ldrh	r2, [r4, #62]	; 0x3e
+ 800174a:	b292      	uxth	r2, r2
+ 800174c:	2a01      	cmp	r2, #1
+          hspi->Instance->DR = *((uint16_t *)pTxData);
+ 800174e:	bf8b      	itete	hi
+ 8001750:	f835 2b02 	ldrhhi.w	r2, [r5], #2
+          *(__IO uint8_t *)&hspi->Instance->DR = (*pTxData++);
+ 8001754:	f815 2b01 	ldrbls.w	r2, [r5], #1
+          hspi->Instance->DR = *((uint16_t *)pTxData);
+ 8001758:	60da      	strhi	r2, [r3, #12]
+          *(__IO uint8_t *)&hspi->Instance->DR = (*pTxData++);
+ 800175a:	731a      	strbls	r2, [r3, #12]
+          hspi->TxXferCount -= 2U;
+ 800175c:	bf8b      	itete	hi
+ 800175e:	8fe3      	ldrhhi	r3, [r4, #62]	; 0x3e
+          hspi->TxXferCount--;
+ 8001760:	8fe3      	ldrhls	r3, [r4, #62]	; 0x3e
+          hspi->TxXferCount -= 2U;
+ 8001762:	3b02      	subhi	r3, #2
+          hspi->TxXferCount--;
+ 8001764:	f103 33ff 	addls.w	r3, r3, #4294967295	; 0xffffffff
+ 8001768:	b29b      	uxth	r3, r3
+ 800176a:	87e3      	strh	r3, [r4, #62]	; 0x3e
+        if ((hspi->TxXferCount == 0U) && (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE))
+ 800176c:	8fe6      	ldrh	r6, [r4, #62]	; 0x3e
+ 800176e:	b2b6      	uxth	r6, r6
+ 8001770:	b996      	cbnz	r6, 8001798 <HAL_SPI_TransmitReceive+0x1d6>
+ 8001772:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 8001774:	f5b3 5f00 	cmp.w	r3, #8192	; 0x2000
+ 8001778:	d10f      	bne.n	800179a <HAL_SPI_TransmitReceive+0x1d8>
+          if (((hspi->Instance->CR1 & SPI_CR1_MSTR) == 0U) && ((hspi->Instance->CR2 & SPI_CR2_NSSP) == SPI_CR2_NSSP))
+ 800177a:	6823      	ldr	r3, [r4, #0]
+ 800177c:	681a      	ldr	r2, [r3, #0]
+ 800177e:	0756      	lsls	r6, r2, #29
+ 8001780:	d406      	bmi.n	8001790 <HAL_SPI_TransmitReceive+0x1ce>
+ 8001782:	685a      	ldr	r2, [r3, #4]
+ 8001784:	0710      	lsls	r0, r2, #28
+            SET_BIT(hspi->Instance->CR1, SPI_CR1_SSM);
+ 8001786:	bf42      	ittt	mi
+ 8001788:	681a      	ldrmi	r2, [r3, #0]
+ 800178a:	f442 7200 	orrmi.w	r2, r2, #512	; 0x200
+ 800178e:	601a      	strmi	r2, [r3, #0]
+          SET_BIT(hspi->Instance->CR1, SPI_CR1_CRCNEXT);
+ 8001790:	681a      	ldr	r2, [r3, #0]
+ 8001792:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 8001796:	601a      	str	r2, [r3, #0]
+        txallowed = 0U;
+ 8001798:	2600      	movs	r6, #0
+      if ((hspi->RxXferCount > 0U) && (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_RXNE)))
+ 800179a:	f8b4 3046 	ldrh.w	r3, [r4, #70]	; 0x46
+ 800179e:	b29b      	uxth	r3, r3
+ 80017a0:	b1e3      	cbz	r3, 80017dc <HAL_SPI_TransmitReceive+0x21a>
+ 80017a2:	6821      	ldr	r1, [r4, #0]
+ 80017a4:	688b      	ldr	r3, [r1, #8]
+ 80017a6:	f013 0301 	ands.w	r3, r3, #1
+ 80017aa:	d017      	beq.n	80017dc <HAL_SPI_TransmitReceive+0x21a>
+        if (hspi->RxXferCount > 1U)
+ 80017ac:	f8b4 2046 	ldrh.w	r2, [r4, #70]	; 0x46
+ 80017b0:	b292      	uxth	r2, r2
+ 80017b2:	2a01      	cmp	r2, #1
+ 80017b4:	d91f      	bls.n	80017f6 <HAL_SPI_TransmitReceive+0x234>
+          *((uint16_t *)pRxData) = hspi->Instance->DR;
+ 80017b6:	68ca      	ldr	r2, [r1, #12]
+ 80017b8:	f827 2b02 	strh.w	r2, [r7], #2
+          hspi->RxXferCount -= 2U;
+ 80017bc:	f8b4 2046 	ldrh.w	r2, [r4, #70]	; 0x46
+ 80017c0:	3a02      	subs	r2, #2
+ 80017c2:	b292      	uxth	r2, r2
+ 80017c4:	f8a4 2046 	strh.w	r2, [r4, #70]	; 0x46
+          if (hspi->RxXferCount <= 1U)
+ 80017c8:	f8b4 2046 	ldrh.w	r2, [r4, #70]	; 0x46
+ 80017cc:	b292      	uxth	r2, r2
+ 80017ce:	2a01      	cmp	r2, #1
+ 80017d0:	d803      	bhi.n	80017da <HAL_SPI_TransmitReceive+0x218>
+            SET_BIT(hspi->Instance->CR2, SPI_RXFIFO_THRESHOLD);
+ 80017d2:	684a      	ldr	r2, [r1, #4]
+ 80017d4:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 80017d8:	604a      	str	r2, [r1, #4]
+        txallowed = 1U;
+ 80017da:	461e      	mov	r6, r3
+      if ((Timeout != HAL_MAX_DELAY) && ((HAL_GetTick() - tickstart) >=  Timeout))
+ 80017dc:	f1b8 3fff 	cmp.w	r8, #4294967295	; 0xffffffff
+ 80017e0:	f43f af6b 	beq.w	80016ba <HAL_SPI_TransmitReceive+0xf8>
+ 80017e4:	f005 fcb4 	bl	8007150 <HAL_GetTick>
+ 80017e8:	eba0 0009 	sub.w	r0, r0, r9
+ 80017ec:	4540      	cmp	r0, r8
+ 80017ee:	f4ff af64 	bcc.w	80016ba <HAL_SPI_TransmitReceive+0xf8>
+        errorcode = HAL_TIMEOUT;
+ 80017f2:	2103      	movs	r1, #3
+ 80017f4:	e70e      	b.n	8001614 <HAL_SPI_TransmitReceive+0x52>
+          (*(uint8_t *)pRxData++) = *(__IO uint8_t *)&hspi->Instance->DR;
+ 80017f6:	7b0a      	ldrb	r2, [r1, #12]
+ 80017f8:	f807 2b01 	strb.w	r2, [r7], #1
+          hspi->RxXferCount--;
+ 80017fc:	f8b4 1046 	ldrh.w	r1, [r4, #70]	; 0x46
+ 8001800:	3901      	subs	r1, #1
+ 8001802:	b289      	uxth	r1, r1
+ 8001804:	f8a4 1046 	strh.w	r1, [r4, #70]	; 0x46
+ 8001808:	e7e7      	b.n	80017da <HAL_SPI_TransmitReceive+0x218>
+      tmpreg = *(__IO uint8_t *)&hspi->Instance->DR;
+ 800180a:	7b1a      	ldrb	r2, [r3, #12]
+ 800180c:	f8ad 2006 	strh.w	r2, [sp, #6]
+      UNUSED(tmpreg);
+ 8001810:	f8bd 2006 	ldrh.w	r2, [sp, #6]
+      if (hspi->Init.CRCLength == SPI_CRC_LENGTH_16BIT)
+ 8001814:	6b22      	ldr	r2, [r4, #48]	; 0x30
+ 8001816:	2a02      	cmp	r2, #2
+ 8001818:	f47f af6b 	bne.w	80016f2 <HAL_SPI_TransmitReceive+0x130>
+  while ((__HAL_SPI_GET_FLAG(hspi, Flag) ? SET : RESET) != State)
+ 800181c:	689a      	ldr	r2, [r3, #8]
+ 800181e:	07d2      	lsls	r2, r2, #31
+ 8001820:	d5fc      	bpl.n	800181c <HAL_SPI_TransmitReceive+0x25a>
+        tmpreg = *(__IO uint8_t *)&hspi->Instance->DR;
+ 8001822:	7b1a      	ldrb	r2, [r3, #12]
+ 8001824:	e761      	b.n	80016ea <HAL_SPI_TransmitReceive+0x128>
+    errorcode = HAL_BUSY;
+ 8001826:	2102      	movs	r1, #2
+ 8001828:	e6f4      	b.n	8001614 <HAL_SPI_TransmitReceive+0x52>
+  __HAL_LOCK(hspi);
+ 800182a:	2102      	movs	r1, #2
+ 800182c:	e6f8      	b.n	8001620 <HAL_SPI_TransmitReceive+0x5e>
+
+0800182e <HAL_SPI_Receive>:
+{
+ 800182e:	e92d 41ff 	stmdb	sp!, {r0, r1, r2, r3, r4, r5, r6, r7, r8, lr}
+ 8001832:	461f      	mov	r7, r3
+  __IO uint16_t tmpreg = 0U;
+ 8001834:	2300      	movs	r3, #0
+ 8001836:	f8ad 300e 	strh.w	r3, [sp, #14]
+  if ((hspi->Init.Mode == SPI_MODE_MASTER) && (hspi->Init.Direction == SPI_DIRECTION_2LINES))
+ 800183a:	6843      	ldr	r3, [r0, #4]
+ 800183c:	f5b3 7f82 	cmp.w	r3, #260	; 0x104
+{
+ 8001840:	4604      	mov	r4, r0
+ 8001842:	460e      	mov	r6, r1
+ 8001844:	4615      	mov	r5, r2
+  if ((hspi->Init.Mode == SPI_MODE_MASTER) && (hspi->Init.Direction == SPI_DIRECTION_2LINES))
+ 8001846:	d10c      	bne.n	8001862 <HAL_SPI_Receive+0x34>
+ 8001848:	6883      	ldr	r3, [r0, #8]
+ 800184a:	b953      	cbnz	r3, 8001862 <HAL_SPI_Receive+0x34>
+    hspi->State = HAL_SPI_STATE_BUSY_RX;
+ 800184c:	2304      	movs	r3, #4
+ 800184e:	f880 305d 	strb.w	r3, [r0, #93]	; 0x5d
+    return HAL_SPI_TransmitReceive(hspi, pData, pData, Size, Timeout);
+ 8001852:	4613      	mov	r3, r2
+ 8001854:	9700      	str	r7, [sp, #0]
+ 8001856:	460a      	mov	r2, r1
+ 8001858:	f7ff feb3 	bl	80015c2 <HAL_SPI_TransmitReceive>
+}
+ 800185c:	b004      	add	sp, #16
+ 800185e:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+  __HAL_LOCK(hspi);
+ 8001862:	f894 305c 	ldrb.w	r3, [r4, #92]	; 0x5c
+ 8001866:	2b01      	cmp	r3, #1
+ 8001868:	f000 80dd 	beq.w	8001a26 <HAL_SPI_Receive+0x1f8>
+ 800186c:	2301      	movs	r3, #1
+ 800186e:	f884 305c 	strb.w	r3, [r4, #92]	; 0x5c
+  tickstart = HAL_GetTick();
+ 8001872:	f005 fc6d 	bl	8007150 <HAL_GetTick>
+  if (hspi->State != HAL_SPI_STATE_READY)
+ 8001876:	f894 305d 	ldrb.w	r3, [r4, #93]	; 0x5d
+ 800187a:	2b01      	cmp	r3, #1
+  tickstart = HAL_GetTick();
+ 800187c:	4680      	mov	r8, r0
+  if (hspi->State != HAL_SPI_STATE_READY)
+ 800187e:	b2d8      	uxtb	r0, r3
+ 8001880:	f040 80cf 	bne.w	8001a22 <HAL_SPI_Receive+0x1f4>
+  if ((pData == NULL) || (Size == 0U))
+ 8001884:	2e00      	cmp	r6, #0
+ 8001886:	f000 8092 	beq.w	80019ae <HAL_SPI_Receive+0x180>
+ 800188a:	2d00      	cmp	r5, #0
+ 800188c:	f000 808f 	beq.w	80019ae <HAL_SPI_Receive+0x180>
+  hspi->State       = HAL_SPI_STATE_BUSY_RX;
+ 8001890:	2304      	movs	r3, #4
+ 8001892:	f884 305d 	strb.w	r3, [r4, #93]	; 0x5d
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 8001896:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+  hspi->RxXferSize  = Size;
+ 8001898:	f8a4 5044 	strh.w	r5, [r4, #68]	; 0x44
+  hspi->ErrorCode   = HAL_SPI_ERROR_NONE;
+ 800189c:	2100      	movs	r1, #0
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 800189e:	f5b3 5f00 	cmp.w	r3, #8192	; 0x2000
+  hspi->ErrorCode   = HAL_SPI_ERROR_NONE;
+ 80018a2:	6621      	str	r1, [r4, #96]	; 0x60
+  hspi->TxISR       = NULL;
+ 80018a4:	e9c4 1113 	strd	r1, r1, [r4, #76]	; 0x4c
+  hspi->RxXferCount = Size;
+ 80018a8:	f8a4 5046 	strh.w	r5, [r4, #70]	; 0x46
+  hspi->pRxBuffPtr  = (uint8_t *)pData;
+ 80018ac:	6426      	str	r6, [r4, #64]	; 0x40
+    SPI_RESET_CRC(hspi);
+ 80018ae:	6825      	ldr	r5, [r4, #0]
+  hspi->pTxBuffPtr  = (uint8_t *)NULL;
+ 80018b0:	63a1      	str	r1, [r4, #56]	; 0x38
+  hspi->TxXferSize  = 0U;
+ 80018b2:	87a1      	strh	r1, [r4, #60]	; 0x3c
+  hspi->TxXferCount = 0U;
+ 80018b4:	87e1      	strh	r1, [r4, #62]	; 0x3e
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 80018b6:	d10d      	bne.n	80018d4 <HAL_SPI_Receive+0xa6>
+    SPI_RESET_CRC(hspi);
+ 80018b8:	682b      	ldr	r3, [r5, #0]
+ 80018ba:	f423 5300 	bic.w	r3, r3, #8192	; 0x2000
+ 80018be:	602b      	str	r3, [r5, #0]
+ 80018c0:	682b      	ldr	r3, [r5, #0]
+ 80018c2:	f443 5300 	orr.w	r3, r3, #8192	; 0x2000
+ 80018c6:	602b      	str	r3, [r5, #0]
+    hspi->RxXferCount--;
+ 80018c8:	f8b4 3046 	ldrh.w	r3, [r4, #70]	; 0x46
+ 80018cc:	3b01      	subs	r3, #1
+ 80018ce:	b29b      	uxth	r3, r3
+ 80018d0:	f8a4 3046 	strh.w	r3, [r4, #70]	; 0x46
+  if (hspi->Init.DataSize > SPI_DATASIZE_8BIT)
+ 80018d4:	68e3      	ldr	r3, [r4, #12]
+ 80018d6:	f5b3 6fe0 	cmp.w	r3, #1792	; 0x700
+    CLEAR_BIT(hspi->Instance->CR2, SPI_RXFIFO_THRESHOLD);
+ 80018da:	686b      	ldr	r3, [r5, #4]
+ 80018dc:	bf8c      	ite	hi
+ 80018de:	f423 5380 	bichi.w	r3, r3, #4096	; 0x1000
+    SET_BIT(hspi->Instance->CR2, SPI_RXFIFO_THRESHOLD);
+ 80018e2:	f443 5380 	orrls.w	r3, r3, #4096	; 0x1000
+ 80018e6:	606b      	str	r3, [r5, #4]
+  if (hspi->Init.Direction == SPI_DIRECTION_1LINE)
+ 80018e8:	68a3      	ldr	r3, [r4, #8]
+ 80018ea:	f5b3 4f00 	cmp.w	r3, #32768	; 0x8000
+    SPI_1LINE_RX(hspi);
+ 80018ee:	bf02      	ittt	eq
+ 80018f0:	682b      	ldreq	r3, [r5, #0]
+ 80018f2:	f423 4380 	biceq.w	r3, r3, #16384	; 0x4000
+ 80018f6:	602b      	streq	r3, [r5, #0]
+  if ((hspi->Instance->CR1 & SPI_CR1_SPE) != SPI_CR1_SPE)
+ 80018f8:	682b      	ldr	r3, [r5, #0]
+ 80018fa:	0658      	lsls	r0, r3, #25
+ 80018fc:	d403      	bmi.n	8001906 <HAL_SPI_Receive+0xd8>
+    __HAL_SPI_ENABLE(hspi);
+ 80018fe:	682b      	ldr	r3, [r5, #0]
+ 8001900:	f043 0340 	orr.w	r3, r3, #64	; 0x40
+ 8001904:	602b      	str	r3, [r5, #0]
+    while (hspi->RxXferCount > 0U)
+ 8001906:	f8b4 3046 	ldrh.w	r3, [r4, #70]	; 0x46
+      if (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_RXNE))
+ 800190a:	6822      	ldr	r2, [r4, #0]
+    while (hspi->RxXferCount > 0U)
+ 800190c:	b29b      	uxth	r3, r3
+ 800190e:	2b00      	cmp	r3, #0
+ 8001910:	d13e      	bne.n	8001990 <HAL_SPI_Receive+0x162>
+  if (hspi->Init.CRCCalculation == SPI_CRCCALCULATION_ENABLE)
+ 8001912:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 8001914:	f5b3 5f00 	cmp.w	r3, #8192	; 0x2000
+ 8001918:	d11c      	bne.n	8001954 <HAL_SPI_Receive+0x126>
+    SET_BIT(hspi->Instance->CR1, SPI_CR1_CRCNEXT);
+ 800191a:	6813      	ldr	r3, [r2, #0]
+ 800191c:	f443 5380 	orr.w	r3, r3, #4096	; 0x1000
+ 8001920:	6013      	str	r3, [r2, #0]
+  while ((__HAL_SPI_GET_FLAG(hspi, Flag) ? SET : RESET) != State)
+ 8001922:	6893      	ldr	r3, [r2, #8]
+ 8001924:	07df      	lsls	r7, r3, #31
+ 8001926:	d5fc      	bpl.n	8001922 <HAL_SPI_Receive+0xf4>
+    if (hspi->Init.DataSize > SPI_DATASIZE_8BIT)
+ 8001928:	68e3      	ldr	r3, [r4, #12]
+ 800192a:	f5b3 6fe0 	cmp.w	r3, #1792	; 0x700
+      (*(uint8_t *)pData) = *(__IO uint8_t *)&hspi->Instance->DR;
+ 800192e:	bf95      	itete	ls
+ 8001930:	7b13      	ldrbls	r3, [r2, #12]
+      *((uint16_t *)pData) = hspi->Instance->DR;
+ 8001932:	68d3      	ldrhi	r3, [r2, #12]
+      (*(uint8_t *)pData) = *(__IO uint8_t *)&hspi->Instance->DR;
+ 8001934:	7033      	strbls	r3, [r6, #0]
+      *((uint16_t *)pData) = hspi->Instance->DR;
+ 8001936:	8033      	strhhi	r3, [r6, #0]
+  while ((__HAL_SPI_GET_FLAG(hspi, Flag) ? SET : RESET) != State)
+ 8001938:	6823      	ldr	r3, [r4, #0]
+ 800193a:	689a      	ldr	r2, [r3, #8]
+ 800193c:	07d6      	lsls	r6, r2, #31
+ 800193e:	d5fc      	bpl.n	800193a <HAL_SPI_Receive+0x10c>
+    if (hspi->Init.DataSize == SPI_DATASIZE_16BIT)
+ 8001940:	68e1      	ldr	r1, [r4, #12]
+ 8001942:	f5b1 6f70 	cmp.w	r1, #3840	; 0xf00
+ 8001946:	d142      	bne.n	80019ce <HAL_SPI_Receive+0x1a0>
+      tmpreg = hspi->Instance->DR;
+ 8001948:	68db      	ldr	r3, [r3, #12]
+ 800194a:	b29b      	uxth	r3, r3
+        tmpreg = *(__IO uint8_t *)&hspi->Instance->DR;
+ 800194c:	f8ad 300e 	strh.w	r3, [sp, #14]
+        UNUSED(tmpreg);
+ 8001950:	f8bd 300e 	ldrh.w	r3, [sp, #14]
+  * @param  Tickstart: tick start value
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef SPI_EndRxTransaction(SPI_HandleTypeDef *hspi,  uint32_t Timeout, uint32_t Tickstart)
+{
+  if ((hspi->Init.Mode == SPI_MODE_MASTER) && ((hspi->Init.Direction == SPI_DIRECTION_1LINE)
+ 8001954:	6861      	ldr	r1, [r4, #4]
+ 8001956:	6823      	ldr	r3, [r4, #0]
+ 8001958:	f5b1 7f82 	cmp.w	r1, #260	; 0x104
+ 800195c:	d10a      	bne.n	8001974 <HAL_SPI_Receive+0x146>
+ 800195e:	68a2      	ldr	r2, [r4, #8]
+ 8001960:	f5b2 4f00 	cmp.w	r2, #32768	; 0x8000
+ 8001964:	d002      	beq.n	800196c <HAL_SPI_Receive+0x13e>
+                                               || (hspi->Init.Direction == SPI_DIRECTION_2LINES_RXONLY)))
+ 8001966:	f5b2 6f80 	cmp.w	r2, #1024	; 0x400
+ 800196a:	d103      	bne.n	8001974 <HAL_SPI_Receive+0x146>
+  {
+    /* Disable SPI peripheral */
+    __HAL_SPI_DISABLE(hspi);
+ 800196c:	681a      	ldr	r2, [r3, #0]
+ 800196e:	f022 0240 	bic.w	r2, r2, #64	; 0x40
+ 8001972:	601a      	str	r2, [r3, #0]
+  while ((__HAL_SPI_GET_FLAG(hspi, Flag) ? SET : RESET) != State)
+ 8001974:	689a      	ldr	r2, [r3, #8]
+ 8001976:	0610      	lsls	r0, r2, #24
+ 8001978:	d4fc      	bmi.n	8001974 <HAL_SPI_Receive+0x146>
+  {
+    SET_BIT(hspi->ErrorCode, HAL_SPI_ERROR_FLAG);
+    return HAL_TIMEOUT;
+  }
+
+  if ((hspi->Init.Mode == SPI_MODE_MASTER) && ((hspi->Init.Direction == SPI_DIRECTION_1LINE)
+ 800197a:	f5b1 7f82 	cmp.w	r1, #260	; 0x104
+ 800197e:	d036      	beq.n	80019ee <HAL_SPI_Receive+0x1c0>
+  if (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_CRCERR))
+ 8001980:	689a      	ldr	r2, [r3, #8]
+ 8001982:	06d2      	lsls	r2, r2, #27
+ 8001984:	d445      	bmi.n	8001a12 <HAL_SPI_Receive+0x1e4>
+  if (hspi->ErrorCode != HAL_SPI_ERROR_NONE)
+ 8001986:	6e20      	ldr	r0, [r4, #96]	; 0x60
+    errorcode = HAL_BUSY;
+ 8001988:	3800      	subs	r0, #0
+ 800198a:	bf18      	it	ne
+ 800198c:	2001      	movne	r0, #1
+error :
+ 800198e:	e00e      	b.n	80019ae <HAL_SPI_Receive+0x180>
+      if (__HAL_SPI_GET_FLAG(hspi, SPI_FLAG_RXNE))
+ 8001990:	6893      	ldr	r3, [r2, #8]
+ 8001992:	07d9      	lsls	r1, r3, #31
+ 8001994:	d509      	bpl.n	80019aa <HAL_SPI_Receive+0x17c>
+        (* (uint8_t *)pData) = *(__IO uint8_t *)&hspi->Instance->DR;
+ 8001996:	7b13      	ldrb	r3, [r2, #12]
+ 8001998:	f806 3b01 	strb.w	r3, [r6], #1
+        hspi->RxXferCount--;
+ 800199c:	f8b4 3046 	ldrh.w	r3, [r4, #70]	; 0x46
+ 80019a0:	3b01      	subs	r3, #1
+ 80019a2:	b29b      	uxth	r3, r3
+ 80019a4:	f8a4 3046 	strh.w	r3, [r4, #70]	; 0x46
+ 80019a8:	e7ad      	b.n	8001906 <HAL_SPI_Receive+0xd8>
+        if ((Timeout == 0U) || ((Timeout != HAL_MAX_DELAY) && ((HAL_GetTick() - tickstart) >=  Timeout)))
+ 80019aa:	b93f      	cbnz	r7, 80019bc <HAL_SPI_Receive+0x18e>
+          errorcode = HAL_TIMEOUT;
+ 80019ac:	2003      	movs	r0, #3
+  hspi->State = HAL_SPI_STATE_READY;
+ 80019ae:	2301      	movs	r3, #1
+ 80019b0:	f884 305d 	strb.w	r3, [r4, #93]	; 0x5d
+  __HAL_UNLOCK(hspi);
+ 80019b4:	2300      	movs	r3, #0
+ 80019b6:	f884 305c 	strb.w	r3, [r4, #92]	; 0x5c
+  return errorcode;
+ 80019ba:	e74f      	b.n	800185c <HAL_SPI_Receive+0x2e>
+        if ((Timeout == 0U) || ((Timeout != HAL_MAX_DELAY) && ((HAL_GetTick() - tickstart) >=  Timeout)))
+ 80019bc:	1c7b      	adds	r3, r7, #1
+ 80019be:	d0a2      	beq.n	8001906 <HAL_SPI_Receive+0xd8>
+ 80019c0:	f005 fbc6 	bl	8007150 <HAL_GetTick>
+ 80019c4:	eba0 0008 	sub.w	r0, r0, r8
+ 80019c8:	42b8      	cmp	r0, r7
+ 80019ca:	d39c      	bcc.n	8001906 <HAL_SPI_Receive+0xd8>
+ 80019cc:	e7ee      	b.n	80019ac <HAL_SPI_Receive+0x17e>
+      tmpreg = *(__IO uint8_t *)&hspi->Instance->DR;
+ 80019ce:	7b1a      	ldrb	r2, [r3, #12]
+ 80019d0:	f8ad 200e 	strh.w	r2, [sp, #14]
+      if ((hspi->Init.DataSize == SPI_DATASIZE_8BIT) && (hspi->Init.CRCLength == SPI_CRC_LENGTH_16BIT))
+ 80019d4:	f5b1 6fe0 	cmp.w	r1, #1792	; 0x700
+      UNUSED(tmpreg);
+ 80019d8:	f8bd 200e 	ldrh.w	r2, [sp, #14]
+      if ((hspi->Init.DataSize == SPI_DATASIZE_8BIT) && (hspi->Init.CRCLength == SPI_CRC_LENGTH_16BIT))
+ 80019dc:	d1ba      	bne.n	8001954 <HAL_SPI_Receive+0x126>
+ 80019de:	6b22      	ldr	r2, [r4, #48]	; 0x30
+ 80019e0:	2a02      	cmp	r2, #2
+ 80019e2:	d1b7      	bne.n	8001954 <HAL_SPI_Receive+0x126>
+  while ((__HAL_SPI_GET_FLAG(hspi, Flag) ? SET : RESET) != State)
+ 80019e4:	689a      	ldr	r2, [r3, #8]
+ 80019e6:	07d5      	lsls	r5, r2, #31
+ 80019e8:	d5fc      	bpl.n	80019e4 <HAL_SPI_Receive+0x1b6>
+        tmpreg = *(__IO uint8_t *)&hspi->Instance->DR;
+ 80019ea:	7b1b      	ldrb	r3, [r3, #12]
+ 80019ec:	e7ae      	b.n	800194c <HAL_SPI_Receive+0x11e>
+  if ((hspi->Init.Mode == SPI_MODE_MASTER) && ((hspi->Init.Direction == SPI_DIRECTION_1LINE)
+ 80019ee:	68a2      	ldr	r2, [r4, #8]
+ 80019f0:	f5b2 4f00 	cmp.w	r2, #32768	; 0x8000
+ 80019f4:	d002      	beq.n	80019fc <HAL_SPI_Receive+0x1ce>
+                                               || (hspi->Init.Direction == SPI_DIRECTION_2LINES_RXONLY)))
+ 80019f6:	f5b2 6f80 	cmp.w	r2, #1024	; 0x400
+ 80019fa:	d1c1      	bne.n	8001980 <HAL_SPI_Receive+0x152>
+  while ((hspi->Instance->SR & Fifo) != State)
+ 80019fc:	689a      	ldr	r2, [r3, #8]
+ 80019fe:	f412 6fc0 	tst.w	r2, #1536	; 0x600
+ 8001a02:	d0bd      	beq.n	8001980 <HAL_SPI_Receive+0x152>
+      tmpreg = *((__IO uint8_t *)&hspi->Instance->DR);
+ 8001a04:	7b1a      	ldrb	r2, [r3, #12]
+ 8001a06:	b2d2      	uxtb	r2, r2
+ 8001a08:	f88d 200d 	strb.w	r2, [sp, #13]
+      UNUSED(tmpreg);
+ 8001a0c:	f89d 200d 	ldrb.w	r2, [sp, #13]
+ 8001a10:	e7f4      	b.n	80019fc <HAL_SPI_Receive+0x1ce>
+    SET_BIT(hspi->ErrorCode, HAL_SPI_ERROR_CRC);
+ 8001a12:	6e22      	ldr	r2, [r4, #96]	; 0x60
+ 8001a14:	f042 0202 	orr.w	r2, r2, #2
+ 8001a18:	6622      	str	r2, [r4, #96]	; 0x60
+    __HAL_SPI_CLEAR_CRCERRFLAG(hspi);
+ 8001a1a:	f64f 72ef 	movw	r2, #65519	; 0xffef
+ 8001a1e:	609a      	str	r2, [r3, #8]
+ 8001a20:	e7b1      	b.n	8001986 <HAL_SPI_Receive+0x158>
+    errorcode = HAL_BUSY;
+ 8001a22:	2002      	movs	r0, #2
+ 8001a24:	e7c3      	b.n	80019ae <HAL_SPI_Receive+0x180>
+  __HAL_LOCK(hspi);
+ 8001a26:	2002      	movs	r0, #2
+ 8001a28:	e718      	b.n	800185c <HAL_SPI_Receive+0x2e>
+	...
+
+08001a2c <checksum_more>:
+
+// checksum_more()
+//
+    static void
+checksum_more(SHA256_CTX *ctx, uint32_t *total, const uint8_t *addr, int len)
+{
+ 8001a2c:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+ 8001a2e:	460c      	mov	r4, r1
+    // mk4 has hardware hash engine, and no DFU button
+    int percent = ((*total) * 100) / TOTAL_CHECKSUM_LEN;
+ 8001a30:	6809      	ldr	r1, [r1, #0]
+{
+ 8001a32:	461d      	mov	r5, r3
+    int percent = ((*total) * 100) / TOTAL_CHECKSUM_LEN;
+ 8001a34:	2364      	movs	r3, #100	; 0x64
+{
+ 8001a36:	4617      	mov	r7, r2
+ 8001a38:	4606      	mov	r6, r0
+    int percent = ((*total) * 100) / TOTAL_CHECKSUM_LEN;
+ 8001a3a:	4359      	muls	r1, r3
+    puts2("Verify %0x");
+    puthex2(percent);
+    putchar('\n');
+#endif
+
+    oled_show_progress(screen_verify, percent);
+ 8001a3c:	4807      	ldr	r0, [pc, #28]	; (8001a5c <checksum_more+0x30>)
+ 8001a3e:	4b08      	ldr	r3, [pc, #32]	; (8001a60 <checksum_more+0x34>)
+ 8001a40:	fbb1 f1f3 	udiv	r1, r1, r3
+ 8001a44:	f7ff fa4e 	bl	8000ee4 <oled_show_progress>
+
+    sha256_update(ctx, addr, len);
+ 8001a48:	462a      	mov	r2, r5
+ 8001a4a:	4639      	mov	r1, r7
+ 8001a4c:	4630      	mov	r0, r6
+ 8001a4e:	f003 fd5d 	bl	800550c <sha256_update>
+    *total += len;
+ 8001a52:	6823      	ldr	r3, [r4, #0]
+ 8001a54:	442b      	add	r3, r5
+ 8001a56:	6023      	str	r3, [r4, #0]
+}
+ 8001a58:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+ 8001a5a:	bf00      	nop
+ 8001a5c:	0800e2c8 	.word	0x0800e2c8
+ 8001a60:	0018541c 	.word	0x0018541c
+
+08001a64 <checksum_flash>:
+
+// checksum_flash()
+//
+    void
+checksum_flash(uint8_t fw_digest[32], uint8_t world_digest[32], uint32_t fw_length)
+{
+ 8001a64:	b570      	push	{r4, r5, r6, lr}
+ 8001a66:	b09c      	sub	sp, #112	; 0x70
+ 8001a68:	4606      	mov	r6, r0
+ 8001a6a:	460d      	mov	r5, r1
+ 8001a6c:	4614      	mov	r4, r2
+    const uint8_t *start = (const uint8_t *)FIRMWARE_START;
+
+    rng_delay();
+ 8001a6e:	f000 fe9b 	bl	80027a8 <rng_delay>
+
+    SHA256_CTX  ctx;
+    uint32_t    total_len = 0;
+ 8001a72:	2300      	movs	r3, #0
+ 8001a74:	9300      	str	r3, [sp, #0]
+
+    if(fw_length == 0) {
+ 8001a76:	2c00      	cmp	r4, #0
+ 8001a78:	d15f      	bne.n	8001b3a <checksum_flash+0xd6>
+        uint8_t first[32];
+        sha256_init(&ctx);
+ 8001a7a:	a809      	add	r0, sp, #36	; 0x24
+ 8001a7c:	f003 fd38 	bl	80054f0 <sha256_init>
+
+        // use length from header in flash
+        fw_length = FW_HDR->firmware_length;
+ 8001a80:	4b36      	ldr	r3, [pc, #216]	; (8001b5c <checksum_flash+0xf8>)
+
+        // start of firmware (just after we end) to header
+        checksum_more(&ctx, &total_len, start, FW_HEADER_OFFSET + FW_HEADER_SIZE - 64);
+ 8001a82:	4a37      	ldr	r2, [pc, #220]	; (8001b60 <checksum_flash+0xfc>)
+        fw_length = FW_HDR->firmware_length;
+ 8001a84:	f8d3 4098 	ldr.w	r4, [r3, #152]	; 0x98
+        checksum_more(&ctx, &total_len, start, FW_HEADER_OFFSET + FW_HEADER_SIZE - 64);
+ 8001a88:	4669      	mov	r1, sp
+ 8001a8a:	f44f 537f 	mov.w	r3, #16320	; 0x3fc0
+ 8001a8e:	a809      	add	r0, sp, #36	; 0x24
+ 8001a90:	f7ff ffcc 	bl	8001a2c <checksum_more>
+
+        // from after header to end
+        checksum_more(&ctx, &total_len, start + FW_HEADER_OFFSET + FW_HEADER_SIZE, 
+ 8001a94:	4a33      	ldr	r2, [pc, #204]	; (8001b64 <checksum_flash+0x100>)
+ 8001a96:	f5a4 4380 	sub.w	r3, r4, #16384	; 0x4000
+ 8001a9a:	4669      	mov	r1, sp
+ 8001a9c:	a809      	add	r0, sp, #36	; 0x24
+ 8001a9e:	f7ff ffc5 	bl	8001a2c <checksum_more>
+                                fw_length - (FW_HEADER_OFFSET + FW_HEADER_SIZE));
+
+        sha256_final(&ctx, first);
+ 8001aa2:	a901      	add	r1, sp, #4
+ 8001aa4:	a809      	add	r0, sp, #36	; 0x24
+ 8001aa6:	f003 fd77 	bl	8005598 <sha256_final>
+
+        // double SHA256
+        sha256_single(first, sizeof(first), fw_digest);
+ 8001aaa:	4632      	mov	r2, r6
+ 8001aac:	2120      	movs	r1, #32
+ 8001aae:	a801      	add	r0, sp, #4
+ 8001ab0:	f003 fd86 	bl	80055c0 <sha256_single>
+        // fw_digest should already be populated by caller
+        total_len = fw_length - 64;
+    }
+
+    // start over, and get the rest of flash. All of it.
+    sha256_init(&ctx);
+ 8001ab4:	a809      	add	r0, sp, #36	; 0x24
+ 8001ab6:	f003 fd1b 	bl	80054f0 <sha256_init>
+
+    // .. and chain in what we have so far
+    sha256_update(&ctx, fw_digest, 32);
+ 8001aba:	2220      	movs	r2, #32
+ 8001abc:	4631      	mov	r1, r6
+ 8001abe:	a809      	add	r0, sp, #36	; 0x24
+ 8001ac0:	f003 fd24 	bl	800550c <sha256_update>
+
+    // Bootloader, including pairing secret area, but excluding MCU keys.
+    const uint8_t *base = (const uint8_t *)BL_FLASH_BASE;
+    checksum_more(&ctx, &total_len, base, ((uint8_t *)MCU_KEYS)-base);
+ 8001ac4:	f44f 33f0 	mov.w	r3, #122880	; 0x1e000
+ 8001ac8:	f04f 6200 	mov.w	r2, #134217728	; 0x8000000
+ 8001acc:	4669      	mov	r1, sp
+ 8001ace:	a809      	add	r0, sp, #36	; 0x24
+ 8001ad0:	f7ff ffac 	bl	8001a2c <checksum_more>
+
+    // Probably-blank area after firmware, and filesystem area.
+    // Important: firmware images (fw_length) must be aligned with flash erase unit size (4k).
+    const uint8_t *fs = start + fw_length;
+    const uint8_t *last = base + MAIN_FLASH_SIZE;
+    checksum_more(&ctx, &total_len, fs, last-fs);
+ 8001ad4:	f104 6200 	add.w	r2, r4, #134217728	; 0x8000000
+ 8001ad8:	f5c4 13b0 	rsb	r3, r4, #1441792	; 0x160000
+ 8001adc:	f502 3200 	add.w	r2, r2, #131072	; 0x20000
+ 8001ae0:	4669      	mov	r1, sp
+ 8001ae2:	a809      	add	r0, sp, #36	; 0x24
+ 8001ae4:	f7ff ffa2 	bl	8001a2c <checksum_more>
+
+    rng_delay();
+ 8001ae8:	f000 fe5e 	bl	80027a8 <rng_delay>
+
+    // OTP area
+    checksum_more(&ctx, &total_len, (void *)0x1fff7000, 0x400);
+ 8001aec:	4a1e      	ldr	r2, [pc, #120]	; (8001b68 <checksum_flash+0x104>)
+ 8001aee:	f44f 6380 	mov.w	r3, #1024	; 0x400
+ 8001af2:	4669      	mov	r1, sp
+ 8001af4:	a809      	add	r0, sp, #36	; 0x24
+ 8001af6:	f7ff ff99 	bl	8001a2c <checksum_more>
+
+    // "just in case" ... the option bytes (2 banks)
+    checksum_more(&ctx, &total_len, (void *)0x1fff7800, 0x28);
+ 8001afa:	4a1c      	ldr	r2, [pc, #112]	; (8001b6c <checksum_flash+0x108>)
+ 8001afc:	2328      	movs	r3, #40	; 0x28
+ 8001afe:	4669      	mov	r1, sp
+ 8001b00:	a809      	add	r0, sp, #36	; 0x24
+ 8001b02:	f7ff ff93 	bl	8001a2c <checksum_more>
+    checksum_more(&ctx, &total_len, (void *)0x1ffff800, 0x28);
+ 8001b06:	4a1a      	ldr	r2, [pc, #104]	; (8001b70 <checksum_flash+0x10c>)
+ 8001b08:	2328      	movs	r3, #40	; 0x28
+ 8001b0a:	4669      	mov	r1, sp
+ 8001b0c:	a809      	add	r0, sp, #36	; 0x24
+ 8001b0e:	f7ff ff8d 	bl	8001a2c <checksum_more>
+
+    // System ROM (they say it can't change, but clearly
+    // implemented as flash cells)
+    checksum_more(&ctx, &total_len, (void *)0x1fff0000, 0x7000);
+ 8001b12:	4a18      	ldr	r2, [pc, #96]	; (8001b74 <checksum_flash+0x110>)
+ 8001b14:	f44f 43e0 	mov.w	r3, #28672	; 0x7000
+ 8001b18:	4669      	mov	r1, sp
+ 8001b1a:	a809      	add	r0, sp, #36	; 0x24
+ 8001b1c:	f7ff ff86 	bl	8001a2c <checksum_more>
+
+    // device serial number, just for kicks
+    checksum_more(&ctx, &total_len, (void *)0x1fff7590, 12);
+ 8001b20:	4a15      	ldr	r2, [pc, #84]	; (8001b78 <checksum_flash+0x114>)
+ 8001b22:	230c      	movs	r3, #12
+ 8001b24:	4669      	mov	r1, sp
+ 8001b26:	a809      	add	r0, sp, #36	; 0x24
+ 8001b28:	f7ff ff80 	bl	8001a2c <checksum_more>
+
+    ASSERT(total_len == TOTAL_CHECKSUM_LEN);
+ 8001b2c:	4b13      	ldr	r3, [pc, #76]	; (8001b7c <checksum_flash+0x118>)
+ 8001b2e:	9a00      	ldr	r2, [sp, #0]
+ 8001b30:	429a      	cmp	r2, r3
+ 8001b32:	d006      	beq.n	8001b42 <checksum_flash+0xde>
+ 8001b34:	4812      	ldr	r0, [pc, #72]	; (8001b80 <checksum_flash+0x11c>)
+ 8001b36:	f7fe ff87 	bl	8000a48 <fatal_error>
+        total_len = fw_length - 64;
+ 8001b3a:	f1a4 0340 	sub.w	r3, r4, #64	; 0x40
+ 8001b3e:	9300      	str	r3, [sp, #0]
+ 8001b40:	e7b8      	b.n	8001ab4 <checksum_flash+0x50>
+    
+    sha256_final(&ctx, world_digest);
+ 8001b42:	4629      	mov	r1, r5
+ 8001b44:	a809      	add	r0, sp, #36	; 0x24
+ 8001b46:	f003 fd27 	bl	8005598 <sha256_final>
+
+    // double SHA256 (a bitcoin fetish)
+    sha256_single(world_digest, 32, world_digest);
+ 8001b4a:	462a      	mov	r2, r5
+ 8001b4c:	2120      	movs	r1, #32
+ 8001b4e:	4628      	mov	r0, r5
+ 8001b50:	f003 fd36 	bl	80055c0 <sha256_single>
+
+    rng_delay();
+ 8001b54:	f000 fe28 	bl	80027a8 <rng_delay>
+}
+ 8001b58:	b01c      	add	sp, #112	; 0x70
+ 8001b5a:	bd70      	pop	{r4, r5, r6, pc}
+ 8001b5c:	08023f00 	.word	0x08023f00
+ 8001b60:	08020000 	.word	0x08020000
+ 8001b64:	08024000 	.word	0x08024000
+ 8001b68:	1fff7000 	.word	0x1fff7000
+ 8001b6c:	1fff7800 	.word	0x1fff7800
+ 8001b70:	1ffff800 	.word	0x1ffff800
+ 8001b74:	1fff0000 	.word	0x1fff0000
+ 8001b78:	1fff7590 	.word	0x1fff7590
+ 8001b7c:	0018541c 	.word	0x0018541c
+ 8001b80:	0800e466 	.word	0x0800e466
+
+08001b84 <get_min_version>:
+// Scan the OTP area and determine what the current min-version (timestamp)
+// we can allow. All zeros if any if okay.
+//
+    void
+get_min_version(uint8_t min_version[8])
+{
+ 8001b84:	b570      	push	{r4, r5, r6, lr}
+ 8001b86:	4604      	mov	r4, r0
+    const uint8_t *otp = (const uint8_t *)OPT_FLASH_BASE;
+ 8001b88:	4d0c      	ldr	r5, [pc, #48]	; (8001bbc <get_min_version+0x38>)
+
+    rng_delay();
+    memset(min_version, 0, 8);
+
+    for(int i=0; i<NUM_OPT_SLOTS; i++, otp+=8) {
+ 8001b8a:	4e0d      	ldr	r6, [pc, #52]	; (8001bc0 <get_min_version+0x3c>)
+    rng_delay();
+ 8001b8c:	f000 fe0c 	bl	80027a8 <rng_delay>
+    memset(min_version, 0, 8);
+ 8001b90:	2300      	movs	r3, #0
+ 8001b92:	6023      	str	r3, [r4, #0]
+ 8001b94:	6063      	str	r3, [r4, #4]
+        // is it programmed?
+        if(otp[0] == 0xff) continue;
+
+        // is it a timestamp value?
+        if(otp[0] >= 0x40) continue;
+        if(otp[0] < 0x10) continue;
+ 8001b96:	782b      	ldrb	r3, [r5, #0]
+ 8001b98:	3b10      	subs	r3, #16
+ 8001b9a:	2b2f      	cmp	r3, #47	; 0x2f
+ 8001b9c:	d80a      	bhi.n	8001bb4 <get_min_version+0x30>
+
+        if(memcmp(otp, min_version, 8) > 0) {
+ 8001b9e:	4621      	mov	r1, r4
+ 8001ba0:	2208      	movs	r2, #8
+ 8001ba2:	4628      	mov	r0, r5
+ 8001ba4:	f00b fd60 	bl	800d668 <memcmp>
+ 8001ba8:	2800      	cmp	r0, #0
+            memcpy(min_version, otp, 8);
+ 8001baa:	bfc1      	itttt	gt
+ 8001bac:	462b      	movgt	r3, r5
+ 8001bae:	cb03      	ldmiagt	r3!, {r0, r1}
+ 8001bb0:	6020      	strgt	r0, [r4, #0]
+ 8001bb2:	6061      	strgt	r1, [r4, #4]
+    for(int i=0; i<NUM_OPT_SLOTS; i++, otp+=8) {
+ 8001bb4:	3508      	adds	r5, #8
+ 8001bb6:	42b5      	cmp	r5, r6
+ 8001bb8:	d1ed      	bne.n	8001b96 <get_min_version+0x12>
+        }
+    }
+}
+ 8001bba:	bd70      	pop	{r4, r5, r6, pc}
+ 8001bbc:	1fff7000 	.word	0x1fff7000
+ 8001bc0:	1fff7400 	.word	0x1fff7400
+
+08001bc4 <check_is_downgrade>:
+
+// check_is_downgrade()
+//
+    bool
+check_is_downgrade(const uint8_t timestamp[8], const char *version)
+{
+ 8001bc4:	b513      	push	{r0, r1, r4, lr}
+ 8001bc6:	4604      	mov	r4, r0
+#ifndef FOR_Q1_ONLY
+    if(version) {
+ 8001bc8:	b129      	cbz	r1, 8001bd6 <check_is_downgrade+0x12>
+        int major = (version[1] == '.') ? (version[0]-'0') : 10;
+ 8001bca:	784b      	ldrb	r3, [r1, #1]
+ 8001bcc:	2b2e      	cmp	r3, #46	; 0x2e
+ 8001bce:	d102      	bne.n	8001bd6 <check_is_downgrade+0x12>
+        if(major < 3) {
+ 8001bd0:	780b      	ldrb	r3, [r1, #0]
+ 8001bd2:	2b32      	cmp	r3, #50	; 0x32
+ 8001bd4:	d90a      	bls.n	8001bec <check_is_downgrade+0x28>
+    }
+#endif
+
+    // look at FW_HDR->timestamp and compare to a growing list in main flash OTP
+    uint8_t min[8];
+    get_min_version(min);
+ 8001bd6:	4668      	mov	r0, sp
+ 8001bd8:	f7ff ffd4 	bl	8001b84 <get_min_version>
+
+    return (memcmp(timestamp, min, 8) < 0);
+ 8001bdc:	2208      	movs	r2, #8
+ 8001bde:	4669      	mov	r1, sp
+ 8001be0:	4620      	mov	r0, r4
+ 8001be2:	f00b fd41 	bl	800d668 <memcmp>
+ 8001be6:	0fc0      	lsrs	r0, r0, #31
+}
+ 8001be8:	b002      	add	sp, #8
+ 8001bea:	bd10      	pop	{r4, pc}
+            return true;
+ 8001bec:	2001      	movs	r0, #1
+ 8001bee:	e7fb      	b.n	8001be8 <check_is_downgrade+0x24>
+
+08001bf0 <warn_fishy_firmware>:
+
+// warn_fishy_firmware()
+//
+    void
+warn_fishy_firmware(const uint8_t *pixels)
+{
+ 8001bf0:	b538      	push	{r3, r4, r5, lr}
+ 8001bf2:	4605      	mov	r5, r0
+    const int wait = 100;
+#else
+    const int wait = 10;
+#endif
+    
+    for(int i=0; i < wait; i++) {
+ 8001bf4:	2400      	movs	r4, #0
+        oled_show_progress(pixels, (i*100)/wait);
+ 8001bf6:	4621      	mov	r1, r4
+ 8001bf8:	4628      	mov	r0, r5
+ 8001bfa:	f7ff f973 	bl	8000ee4 <oled_show_progress>
+    for(int i=0; i < wait; i++) {
+ 8001bfe:	3401      	adds	r4, #1
+
+        delay_ms(250);
+ 8001c00:	20fa      	movs	r0, #250	; 0xfa
+ 8001c02:	f001 fe8f 	bl	8003924 <delay_ms>
+    for(int i=0; i < wait; i++) {
+ 8001c06:	2c64      	cmp	r4, #100	; 0x64
+ 8001c08:	d1f5      	bne.n	8001bf6 <warn_fishy_firmware+0x6>
+    }
+}
+ 8001c0a:	bd38      	pop	{r3, r4, r5, pc}
+
+08001c0c <verify_header>:
+
+// verify_header()
+//
+    bool
+verify_header(const coldcardFirmwareHeader_t *hdr)
+{
+ 8001c0c:	b510      	push	{r4, lr}
+ 8001c0e:	4604      	mov	r4, r0
+    rng_delay();
+ 8001c10:	f000 fdca 	bl	80027a8 <rng_delay>
+
+    if(hdr->magic_value != FW_HEADER_MAGIC) goto fail;
+ 8001c14:	6822      	ldr	r2, [r4, #0]
+ 8001c16:	4b0b      	ldr	r3, [pc, #44]	; (8001c44 <verify_header+0x38>)
+ 8001c18:	429a      	cmp	r2, r3
+ 8001c1a:	d110      	bne.n	8001c3e <verify_header+0x32>
+    if(hdr->version_string[0] == 0x0) goto fail;
+ 8001c1c:	7b20      	ldrb	r0, [r4, #12]
+ 8001c1e:	b168      	cbz	r0, 8001c3c <verify_header+0x30>
+    if(hdr->timestamp[0] >= 0x40) goto fail;        // 22 yr product lifetime
+ 8001c20:	7923      	ldrb	r3, [r4, #4]
+ 8001c22:	2b3f      	cmp	r3, #63	; 0x3f
+ 8001c24:	d80b      	bhi.n	8001c3e <verify_header+0x32>
+    if(hdr->firmware_length < FW_MIN_LENGTH) goto fail;
+ 8001c26:	69a3      	ldr	r3, [r4, #24]
+ 8001c28:	f5a3 2380 	sub.w	r3, r3, #262144	; 0x40000
+ 8001c2c:	f5b3 1fd0 	cmp.w	r3, #1703936	; 0x1a0000
+ 8001c30:	d205      	bcs.n	8001c3e <verify_header+0x32>
+    if(hdr->firmware_length >= FW_MAX_LENGTH_MK4) goto fail;
+    if(hdr->pubkey_num >= NUM_KNOWN_PUBKEYS) goto fail;
+ 8001c32:	6960      	ldr	r0, [r4, #20]
+ 8001c34:	2805      	cmp	r0, #5
+ 8001c36:	bf8c      	ite	hi
+ 8001c38:	2000      	movhi	r0, #0
+ 8001c3a:	2001      	movls	r0, #1
+
+    return true;
+fail:
+    return false;
+}
+ 8001c3c:	bd10      	pop	{r4, pc}
+    return false;
+ 8001c3e:	2000      	movs	r0, #0
+ 8001c40:	e7fc      	b.n	8001c3c <verify_header+0x30>
+ 8001c42:	bf00      	nop
+ 8001c44:	cc001234 	.word	0xcc001234
+
+08001c48 <verify_signature>:
+//
+// Given double-sha256 over the firmware bytes, check the signature.
+//
+    bool
+verify_signature(const coldcardFirmwareHeader_t *hdr, const uint8_t fw_check[32])
+{
+ 8001c48:	b530      	push	{r4, r5, lr}
+    // this takes a few ms at least, not fast.
+    int ok = uECC_verify(approved_pubkeys[hdr->pubkey_num], fw_check, 32,
+ 8001c4a:	6943      	ldr	r3, [r0, #20]
+ 8001c4c:	4d0b      	ldr	r5, [pc, #44]	; (8001c7c <verify_signature+0x34>)
+{
+ 8001c4e:	b085      	sub	sp, #20
+    int ok = uECC_verify(approved_pubkeys[hdr->pubkey_num], fw_check, 32,
+ 8001c50:	eb05 1583 	add.w	r5, r5, r3, lsl #6
+{
+ 8001c54:	4604      	mov	r4, r0
+ 8001c56:	9103      	str	r1, [sp, #12]
+    int ok = uECC_verify(approved_pubkeys[hdr->pubkey_num], fw_check, 32,
+ 8001c58:	f004 fe76 	bl	8006948 <uECC_secp256k1>
+ 8001c5c:	f104 0340 	add.w	r3, r4, #64	; 0x40
+ 8001c60:	9903      	ldr	r1, [sp, #12]
+ 8001c62:	9000      	str	r0, [sp, #0]
+ 8001c64:	2220      	movs	r2, #32
+ 8001c66:	4628      	mov	r0, r5
+ 8001c68:	f005 f8f5 	bl	8006e56 <uECC_verify>
+ 8001c6c:	4604      	mov	r4, r0
+                                    hdr->signature, uECC_secp256k1());
+
+    //puts(ok ? "Sig ok" : "Sig fail");
+    rng_delay();
+ 8001c6e:	f000 fd9b 	bl	80027a8 <rng_delay>
+
+    return ok;
+}
+ 8001c72:	1e20      	subs	r0, r4, #0
+ 8001c74:	bf18      	it	ne
+ 8001c76:	2001      	movne	r0, #1
+ 8001c78:	b005      	add	sp, #20
+ 8001c7a:	bd30      	pop	{r4, r5, pc}
+ 8001c7c:	0800e4e0 	.word	0x0800e4e0
+
+08001c80 <verify_firmware_in_ram>:
+// Check hdr, and even signature of protential new firmware in PSRAM.
+// Returns checksum needed for 608
+//
+    bool
+verify_firmware_in_ram(const uint8_t *start, uint32_t len, uint8_t world_check[32])
+{
+ 8001c80:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+    const coldcardFirmwareHeader_t *hdr = (const coldcardFirmwareHeader_t *)
+ 8001c84:	f500 567e 	add.w	r6, r0, #16256	; 0x3f80
+{
+ 8001c88:	b09c      	sub	sp, #112	; 0x70
+ 8001c8a:	4605      	mov	r5, r0
+                                                    (start + FW_HEADER_OFFSET);
+    uint8_t fw_digest[32];
+
+    // check basics like verison, hw compat, etc
+    if(!verify_header(hdr)) goto fail;
+ 8001c8c:	4630      	mov	r0, r6
+{
+ 8001c8e:	4617      	mov	r7, r2
+    if(!verify_header(hdr)) goto fail;
+ 8001c90:	f7ff ffbc 	bl	8001c0c <verify_header>
+ 8001c94:	4604      	mov	r4, r0
+ 8001c96:	b150      	cbz	r0, 8001cae <verify_firmware_in_ram+0x2e>
+
+    if(check_is_downgrade(hdr->timestamp, (const char *)hdr->version_string)) {
+ 8001c98:	f106 010c 	add.w	r1, r6, #12
+ 8001c9c:	1d30      	adds	r0, r6, #4
+ 8001c9e:	f7ff ff91 	bl	8001bc4 <check_is_downgrade>
+ 8001ca2:	4604      	mov	r4, r0
+ 8001ca4:	b138      	cbz	r0, 8001cb6 <verify_firmware_in_ram+0x36>
+        puts("downgrade");
+ 8001ca6:	481e      	ldr	r0, [pc, #120]	; (8001d20 <verify_firmware_in_ram+0xa0>)
+ 8001ca8:	f003 f8b2 	bl	8004e10 <puts>
+
+    checksum_flash(fw_digest, world_check, hdr->firmware_length);
+
+    return true;
+fail:
+    return false;
+ 8001cac:	2400      	movs	r4, #0
+}
+ 8001cae:	4620      	mov	r0, r4
+ 8001cb0:	b01c      	add	sp, #112	; 0x70
+ 8001cb2:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+    rng_delay();
+ 8001cb6:	f000 fd77 	bl	80027a8 <rng_delay>
+                            hdr->firmware_length - (FW_HEADER_OFFSET + FW_HEADER_SIZE));
+ 8001cba:	f505 5840 	add.w	r8, r5, #12288	; 0x3000
+    sha256_init(&ctx);
+ 8001cbe:	a809      	add	r0, sp, #36	; 0x24
+    uint32_t    total_len = 0;
+ 8001cc0:	9400      	str	r4, [sp, #0]
+    sha256_init(&ctx);
+ 8001cc2:	f003 fc15 	bl	80054f0 <sha256_init>
+    checksum_more(&ctx, &total_len, start, FW_HEADER_OFFSET + FW_HEADER_SIZE - 64);
+ 8001cc6:	f44f 537f 	mov.w	r3, #16320	; 0x3fc0
+ 8001cca:	462a      	mov	r2, r5
+ 8001ccc:	4669      	mov	r1, sp
+ 8001cce:	a809      	add	r0, sp, #36	; 0x24
+ 8001cd0:	f7ff feac 	bl	8001a2c <checksum_more>
+                            hdr->firmware_length - (FW_HEADER_OFFSET + FW_HEADER_SIZE));
+ 8001cd4:	f8d8 3f98 	ldr.w	r3, [r8, #3992]	; 0xf98
+    checksum_more(&ctx, &total_len, start + FW_HEADER_OFFSET + FW_HEADER_SIZE, 
+ 8001cd8:	f505 4280 	add.w	r2, r5, #16384	; 0x4000
+ 8001cdc:	f5a3 4380 	sub.w	r3, r3, #16384	; 0x4000
+ 8001ce0:	4669      	mov	r1, sp
+ 8001ce2:	a809      	add	r0, sp, #36	; 0x24
+ 8001ce4:	f7ff fea2 	bl	8001a2c <checksum_more>
+    sha256_final(&ctx, fw_digest);
+ 8001ce8:	a901      	add	r1, sp, #4
+ 8001cea:	a809      	add	r0, sp, #36	; 0x24
+ 8001cec:	f003 fc54 	bl	8005598 <sha256_final>
+    sha256_single(fw_digest, 32, fw_digest);
+ 8001cf0:	aa01      	add	r2, sp, #4
+ 8001cf2:	4610      	mov	r0, r2
+ 8001cf4:	2120      	movs	r1, #32
+ 8001cf6:	f003 fc63 	bl	80055c0 <sha256_single>
+    rng_delay();
+ 8001cfa:	f000 fd55 	bl	80027a8 <rng_delay>
+    if(!verify_signature(hdr, fw_digest)) {
+ 8001cfe:	a901      	add	r1, sp, #4
+ 8001d00:	4630      	mov	r0, r6
+ 8001d02:	f7ff ffa1 	bl	8001c48 <verify_signature>
+ 8001d06:	4604      	mov	r4, r0
+ 8001d08:	b918      	cbnz	r0, 8001d12 <verify_firmware_in_ram+0x92>
+        puts("sig fail");
+ 8001d0a:	4806      	ldr	r0, [pc, #24]	; (8001d24 <verify_firmware_in_ram+0xa4>)
+ 8001d0c:	f003 f880 	bl	8004e10 <puts>
+        goto fail;
+ 8001d10:	e7cd      	b.n	8001cae <verify_firmware_in_ram+0x2e>
+    checksum_flash(fw_digest, world_check, hdr->firmware_length);
+ 8001d12:	f8d8 2f98 	ldr.w	r2, [r8, #3992]	; 0xf98
+ 8001d16:	4639      	mov	r1, r7
+ 8001d18:	a801      	add	r0, sp, #4
+ 8001d1a:	f7ff fea3 	bl	8001a64 <checksum_flash>
+    return true;
+ 8001d1e:	e7c6      	b.n	8001cae <verify_firmware_in_ram+0x2e>
+ 8001d20:	0800e46d 	.word	0x0800e46d
+ 8001d24:	0800e477 	.word	0x0800e477
+
+08001d28 <verify_world_checksum>:
+// - don't set the light at this point.
+// - requires bootloader to have been unchanged since world_check recorded (debug issue)
+//
+    bool
+verify_world_checksum(const uint8_t world_check[32])
+{
+ 8001d28:	b507      	push	{r0, r1, r2, lr}
+ 8001d2a:	9001      	str	r0, [sp, #4]
+    ae_setup();
+ 8001d2c:	f000 fe60 	bl	80029f0 <ae_setup>
+    ae_pair_unlock();
+ 8001d30:	f001 f854 	bl	8002ddc <ae_pair_unlock>
+
+    return (ae_checkmac_hard(KEYNUM_firmware, world_check) == 0);
+ 8001d34:	9901      	ldr	r1, [sp, #4]
+ 8001d36:	200e      	movs	r0, #14
+ 8001d38:	f001 f9de 	bl	80030f8 <ae_checkmac_hard>
+}
+ 8001d3c:	fab0 f080 	clz	r0, r0
+ 8001d40:	0940      	lsrs	r0, r0, #5
+ 8001d42:	b003      	add	sp, #12
+ 8001d44:	f85d fb04 	ldr.w	pc, [sp], #4
+
+08001d48 <verify_firmware>:
+
+// verify_firmware()
+//
+    bool
+verify_firmware(void)
+{
+ 8001d48:	b570      	push	{r4, r5, r6, lr}
+    STATIC_ASSERT(sizeof(coldcardFirmwareHeader_t) == FW_HEADER_SIZE);
+
+    rng_delay();
+
+    // watch for unprogrammed header. and some 
+    if(FW_HDR->version_string[0] == 0xff) goto blank;
+ 8001d4a:	4e2a      	ldr	r6, [pc, #168]	; (8001df4 <verify_firmware+0xac>)
+{
+ 8001d4c:	b090      	sub	sp, #64	; 0x40
+    rng_delay();
+ 8001d4e:	f000 fd2b 	bl	80027a8 <rng_delay>
+    if(FW_HDR->version_string[0] == 0xff) goto blank;
+ 8001d52:	f896 308c 	ldrb.w	r3, [r6, #140]	; 0x8c
+ 8001d56:	2bff      	cmp	r3, #255	; 0xff
+ 8001d58:	d107      	bne.n	8001d6a <verify_firmware+0x22>
+    puts("corrupt firmware");
+    oled_show(screen_corrupt);
+    return false;
+
+blank:
+    puts("no firmware");
+ 8001d5a:	4827      	ldr	r0, [pc, #156]	; (8001df8 <verify_firmware+0xb0>)
+    puts("corrupt firmware");
+ 8001d5c:	f003 f858 	bl	8004e10 <puts>
+    oled_show(screen_corrupt);
+ 8001d60:	4826      	ldr	r0, [pc, #152]	; (8001dfc <verify_firmware+0xb4>)
+ 8001d62:	f7ff f87d 	bl	8000e60 <oled_show>
+    return false;
+ 8001d66:	2400      	movs	r4, #0
+ 8001d68:	e030      	b.n	8001dcc <verify_firmware+0x84>
+    if(!verify_header(FW_HDR)) goto fail;
+ 8001d6a:	4825      	ldr	r0, [pc, #148]	; (8001e00 <verify_firmware+0xb8>)
+ 8001d6c:	f7ff ff4e 	bl	8001c0c <verify_header>
+ 8001d70:	2800      	cmp	r0, #0
+ 8001d72:	d03c      	beq.n	8001dee <verify_firmware+0xa6>
+    rng_delay();
+ 8001d74:	f000 fd18 	bl	80027a8 <rng_delay>
+    checksum_flash(fw_check, world_check, 0);
+ 8001d78:	2200      	movs	r2, #0
+ 8001d7a:	a908      	add	r1, sp, #32
+ 8001d7c:	4668      	mov	r0, sp
+ 8001d7e:	f7ff fe71 	bl	8001a64 <checksum_flash>
+    rng_delay();
+ 8001d82:	f000 fd11 	bl	80027a8 <rng_delay>
+    if(!verify_signature(FW_HDR, fw_check)) goto fail;
+ 8001d86:	481e      	ldr	r0, [pc, #120]	; (8001e00 <verify_firmware+0xb8>)
+ 8001d88:	4669      	mov	r1, sp
+ 8001d8a:	f7ff ff5d 	bl	8001c48 <verify_signature>
+ 8001d8e:	4604      	mov	r4, r0
+ 8001d90:	b368      	cbz	r0, 8001dee <verify_firmware+0xa6>
+    int not_green = ae_set_gpio_secure(world_check);
+ 8001d92:	a808      	add	r0, sp, #32
+ 8001d94:	f001 fbc4 	bl	8003520 <ae_set_gpio_secure>
+ 8001d98:	4605      	mov	r5, r0
+    rng_delay();
+ 8001d9a:	f000 fd05 	bl	80027a8 <rng_delay>
+    rng_delay();
+ 8001d9e:	f000 fd03 	bl	80027a8 <rng_delay>
+    return ((FLASH->OPTR & FLASH_OPTR_RDP_Msk) == 0xCC);
+ 8001da2:	4b18      	ldr	r3, [pc, #96]	; (8001e04 <verify_firmware+0xbc>)
+ 8001da4:	6a1b      	ldr	r3, [r3, #32]
+ 8001da6:	b2db      	uxtb	r3, r3
+    if(!flash_is_security_level2() && not_green) {
+ 8001da8:	2bcc      	cmp	r3, #204	; 0xcc
+ 8001daa:	d008      	beq.n	8001dbe <verify_firmware+0x76>
+ 8001dac:	b18d      	cbz	r5, 8001dd2 <verify_firmware+0x8a>
+        oled_show_progress(screen_verify, 100);
+ 8001dae:	4816      	ldr	r0, [pc, #88]	; (8001e08 <verify_firmware+0xc0>)
+ 8001db0:	2164      	movs	r1, #100	; 0x64
+ 8001db2:	f7ff f897 	bl	8000ee4 <oled_show_progress>
+        puts("Factory boot");
+ 8001db6:	4815      	ldr	r0, [pc, #84]	; (8001e0c <verify_firmware+0xc4>)
+        puts("Good firmware");
+ 8001db8:	f003 f82a 	bl	8004e10 <puts>
+ 8001dbc:	e006      	b.n	8001dcc <verify_firmware+0x84>
+    } else if(not_green) {
+ 8001dbe:	b145      	cbz	r5, 8001dd2 <verify_firmware+0x8a>
+        puts("WARN: Red light");
+ 8001dc0:	4813      	ldr	r0, [pc, #76]	; (8001e10 <verify_firmware+0xc8>)
+ 8001dc2:	f003 f825 	bl	8004e10 <puts>
+        warn_fishy_firmware(screen_red_light);
+ 8001dc6:	4813      	ldr	r0, [pc, #76]	; (8001e14 <verify_firmware+0xcc>)
+        warn_fishy_firmware(screen_devmode);
+ 8001dc8:	f7ff ff12 	bl	8001bf0 <warn_fishy_firmware>
+    oled_show(screen_corrupt);
+
+    return false;
+}
+ 8001dcc:	4620      	mov	r0, r4
+ 8001dce:	b010      	add	sp, #64	; 0x40
+ 8001dd0:	bd70      	pop	{r4, r5, r6, pc}
+    } else if(FW_HDR->pubkey_num == 0) {
+ 8001dd2:	f8d6 3094 	ldr.w	r3, [r6, #148]	; 0x94
+ 8001dd6:	b923      	cbnz	r3, 8001de2 <verify_firmware+0x9a>
+        puts("WARN: Unsigned firmware");
+ 8001dd8:	480f      	ldr	r0, [pc, #60]	; (8001e18 <verify_firmware+0xd0>)
+ 8001dda:	f003 f819 	bl	8004e10 <puts>
+        warn_fishy_firmware(screen_devmode);
+ 8001dde:	480f      	ldr	r0, [pc, #60]	; (8001e1c <verify_firmware+0xd4>)
+ 8001de0:	e7f2      	b.n	8001dc8 <verify_firmware+0x80>
+        oled_show_progress(screen_verify, 100);
+ 8001de2:	4809      	ldr	r0, [pc, #36]	; (8001e08 <verify_firmware+0xc0>)
+ 8001de4:	2164      	movs	r1, #100	; 0x64
+ 8001de6:	f7ff f87d 	bl	8000ee4 <oled_show_progress>
+        puts("Good firmware");
+ 8001dea:	480d      	ldr	r0, [pc, #52]	; (8001e20 <verify_firmware+0xd8>)
+ 8001dec:	e7e4      	b.n	8001db8 <verify_firmware+0x70>
+    puts("corrupt firmware");
+ 8001dee:	480d      	ldr	r0, [pc, #52]	; (8001e24 <verify_firmware+0xdc>)
+ 8001df0:	e7b4      	b.n	8001d5c <verify_firmware+0x14>
+ 8001df2:	bf00      	nop
+ 8001df4:	08023f00 	.word	0x08023f00
+ 8001df8:	0800e480 	.word	0x0800e480
+ 8001dfc:	0800d8fb 	.word	0x0800d8fb
+ 8001e00:	08023f80 	.word	0x08023f80
+ 8001e04:	40022000 	.word	0x40022000
+ 8001e08:	0800e2c8 	.word	0x0800e2c8
+ 8001e0c:	0800e48c 	.word	0x0800e48c
+ 8001e10:	0800e499 	.word	0x0800e499
+ 8001e14:	0800ddf8 	.word	0x0800ddf8
+ 8001e18:	0800e4a9 	.word	0x0800e4a9
+ 8001e1c:	0800d9b8 	.word	0x0800d9b8
+ 8001e20:	0800e4c1 	.word	0x0800e4c1
+ 8001e24:	0800e4cf 	.word	0x0800e4cf
+
+08001e28 <systick_setup>:
+    void
+systick_setup(void)
+{
+    const uint32_t ticks = HCLK_FREQUENCY/1000;
+
+    SysTick->LOAD = (ticks - 1);
+ 8001e28:	f04f 23e0 	mov.w	r3, #3758153728	; 0xe000e000
+ 8001e2c:	4a03      	ldr	r2, [pc, #12]	; (8001e3c <systick_setup+0x14>)
+ 8001e2e:	615a      	str	r2, [r3, #20]
+    SysTick->VAL = 0;
+ 8001e30:	2200      	movs	r2, #0
+ 8001e32:	619a      	str	r2, [r3, #24]
+    SysTick->CTRL = SYSTICK_CLKSOURCE_HCLK | SysTick_CTRL_ENABLE_Msk;
+ 8001e34:	2205      	movs	r2, #5
+ 8001e36:	611a      	str	r2, [r3, #16]
+}
+ 8001e38:	4770      	bx	lr
+ 8001e3a:	bf00      	nop
+ 8001e3c:	0001d4bf 	.word	0x0001d4bf
+
+08001e40 <system_init0>:
+  SCB->VTOR = VECT_TAB_BASE_ADDRESS | VECT_TAB_OFFSET;
+#endif
+
+  /* FPU settings ------------------------------------------------------------*/
+#if (__FPU_PRESENT == 1) && (__FPU_USED == 1)
+  SCB->CPACR |= ((3UL << 20U)|(3UL << 22U));  /* set CP10 and CP11 Full Access */
+ 8001e40:	4a0e      	ldr	r2, [pc, #56]	; (8001e7c <system_init0+0x3c>)
+ 8001e42:	f8d2 3088 	ldr.w	r3, [r2, #136]	; 0x88
+ 8001e46:	f443 0370 	orr.w	r3, r3, #15728640	; 0xf00000
+ 8001e4a:	f8c2 3088 	str.w	r3, [r2, #136]	; 0x88
+#endif
+
+  /* Reset the RCC clock configuration to the default reset state ------------*/
+  /* Set MSION bit */
+  RCC->CR |= RCC_CR_MSION;
+ 8001e4e:	4b0c      	ldr	r3, [pc, #48]	; (8001e80 <system_init0+0x40>)
+ 8001e50:	681a      	ldr	r2, [r3, #0]
+
+  /* Reset CFGR register */
+  RCC->CFGR = 0x00000000U;
+ 8001e52:	2100      	movs	r1, #0
+  RCC->CR |= RCC_CR_MSION;
+ 8001e54:	f042 0201 	orr.w	r2, r2, #1
+ 8001e58:	601a      	str	r2, [r3, #0]
+  RCC->CFGR = 0x00000000U;
+ 8001e5a:	6099      	str	r1, [r3, #8]
+
+  /* Reset HSEON, CSSON , HSION, and PLLON bits */
+  RCC->CR &= 0xEAF6FFFFU;
+ 8001e5c:	681a      	ldr	r2, [r3, #0]
+ 8001e5e:	f022 52a8 	bic.w	r2, r2, #352321536	; 0x15000000
+ 8001e62:	f422 2210 	bic.w	r2, r2, #589824	; 0x90000
+ 8001e66:	601a      	str	r2, [r3, #0]
+
+  /* Reset PLLCFGR register */
+  RCC->PLLCFGR = 0x00001000U;
+ 8001e68:	f44f 5280 	mov.w	r2, #4096	; 0x1000
+ 8001e6c:	60da      	str	r2, [r3, #12]
+
+  /* Reset HSEBYP bit */
+  RCC->CR &= 0xFFFBFFFFU;
+ 8001e6e:	681a      	ldr	r2, [r3, #0]
+ 8001e70:	f422 2280 	bic.w	r2, r2, #262144	; 0x40000
+ 8001e74:	601a      	str	r2, [r3, #0]
+
+  /* Disable all interrupts */
+  RCC->CIER = 0x00000000U;
+ 8001e76:	6199      	str	r1, [r3, #24]
+}
+ 8001e78:	4770      	bx	lr
+ 8001e7a:	bf00      	nop
+ 8001e7c:	e000ed00 	.word	0xe000ed00
+ 8001e80:	40021000 	.word	0x40021000
+
+08001e84 <clocks_setup>:
+
+// clocks_setup()
+//
+    void
+clocks_setup(void)
+{
+ 8001e84:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+
+    // setup power supplies
+    HAL_PWREx_ControlVoltageScaling(PWR_REGULATOR_VOLTAGE_SCALE1_BOOST);
+
+    // Configure LSE Drive Capability
+    __HAL_RCC_LSEDRIVE_CONFIG(RCC_LSEDRIVE_LOW);
+ 8001e88:	4c41      	ldr	r4, [pc, #260]	; (8001f90 <clocks_setup+0x10c>)
+{
+ 8001e8a:	b0c1      	sub	sp, #260	; 0x104
+    HAL_PWREx_ControlVoltageScaling(PWR_REGULATOR_VOLTAGE_SCALE1_BOOST);
+ 8001e8c:	2000      	movs	r0, #0
+ 8001e8e:	f005 f975 	bl	800717c <HAL_PWREx_ControlVoltageScaling>
+    __HAL_RCC_LSEDRIVE_CONFIG(RCC_LSEDRIVE_LOW);
+ 8001e92:	f8d4 3090 	ldr.w	r3, [r4, #144]	; 0x90
+ 8001e96:	f023 0318 	bic.w	r3, r3, #24
+ 8001e9a:	f8c4 3090 	str.w	r3, [r4, #144]	; 0x90
+
+    // Enable HSE Oscillator and activate PLL with HSE as source
+    RCC_OscInitStruct.OscillatorType = RCC_OSCILLATORTYPE_HSE;
+
+    RCC_OscInitStruct.HSEState = RCC_HSE_ON;
+ 8001e9e:	2201      	movs	r2, #1
+ 8001ea0:	f44f 3380 	mov.w	r3, #65536	; 0x10000
+ 8001ea4:	e9cd 230a 	strd	r2, r3, [sp, #40]	; 0x28
+    RCC_OscInitStruct.LSEState = RCC_LSE_OFF;
+    RCC_OscInitStruct.MSIState = RCC_MSI_OFF;
+
+    RCC_OscInitStruct.PLL.PLLSource = RCC_PLLSOURCE_HSE;
+    RCC_OscInitStruct.PLL.PLLState = RCC_PLL_ON;
+ 8001ea8:	2703      	movs	r7, #3
+
+    // Select PLL as system clock source and configure
+    // the HCLK, PCLK1 and PCLK2 clocks dividers
+    RCC_ClkInitStruct.ClockType = (RCC_CLOCKTYPE_SYSCLK | RCC_CLOCKTYPE_HCLK 
+ 8001eaa:	230f      	movs	r3, #15
+    RCC_OscInitStruct.LSEState = RCC_LSE_OFF;
+ 8001eac:	2500      	movs	r5, #0
+    RCC_OscInitStruct.PLL.PLLState = RCC_PLL_ON;
+ 8001eae:	2602      	movs	r6, #2
+                                    | RCC_CLOCKTYPE_PCLK1 | RCC_CLOCKTYPE_PCLK2);
+    RCC_ClkInitStruct.SYSCLKSource = RCC_SYSCLKSOURCE_PLLCLK;
+ 8001eb0:	e9cd 3705 	strd	r3, r7, [sp, #20]
+
+    RCC_OscInitStruct.PLL.PLLM = CKCC_CLK_PLLM;
+    RCC_OscInitStruct.PLL.PLLN = CKCC_CLK_PLLN;
+    RCC_OscInitStruct.PLL.PLLP = CKCC_CLK_PLLP;
+ 8001eb4:	f04f 0807 	mov.w	r8, #7
+ 8001eb8:	233c      	movs	r3, #60	; 0x3c
+    RCC_OscInitStruct.PLL.PLLQ = CKCC_CLK_PLLQ;
+ 8001eba:	f04f 0905 	mov.w	r9, #5
+
+    RCC_ClkInitStruct.AHBCLKDivider = RCC_SYSCLK_DIV1;
+    RCC_ClkInitStruct.APB1CLKDivider = RCC_HCLK_DIV1;
+    RCC_ClkInitStruct.APB2CLKDivider = RCC_HCLK_DIV1;
+
+    HAL_RCC_OscConfig(&RCC_OscInitStruct);
+ 8001ebe:	a80a      	add	r0, sp, #40	; 0x28
+    RCC_OscInitStruct.PLL.PLLP = CKCC_CLK_PLLP;
+ 8001ec0:	e9cd 3817 	strd	r3, r8, [sp, #92]	; 0x5c
+    RCC_OscInitStruct.PLL.PLLState = RCC_PLL_ON;
+ 8001ec4:	e9cd 6714 	strd	r6, r7, [sp, #80]	; 0x50
+    RCC_OscInitStruct.PLL.PLLR = CKCC_CLK_PLLR;
+ 8001ec8:	e9cd 9619 	strd	r9, r6, [sp, #100]	; 0x64
+    RCC_ClkInitStruct.APB1CLKDivider = RCC_HCLK_DIV1;
+ 8001ecc:	e9cd 5507 	strd	r5, r5, [sp, #28]
+    RCC_OscInitStruct.LSEState = RCC_LSE_OFF;
+ 8001ed0:	950c      	str	r5, [sp, #48]	; 0x30
+    RCC_OscInitStruct.MSIState = RCC_MSI_OFF;
+ 8001ed2:	9510      	str	r5, [sp, #64]	; 0x40
+    RCC_OscInitStruct.PLL.PLLM = CKCC_CLK_PLLM;
+ 8001ed4:	9616      	str	r6, [sp, #88]	; 0x58
+    RCC_ClkInitStruct.APB2CLKDivider = RCC_HCLK_DIV1;
+ 8001ed6:	9509      	str	r5, [sp, #36]	; 0x24
+    HAL_RCC_OscConfig(&RCC_OscInitStruct);
+ 8001ed8:	f006 fcf8 	bl	80088cc <HAL_RCC_OscConfig>
+
+    HAL_RCC_ClockConfig(&RCC_ClkInitStruct, FLASH_LATENCY_5);
+ 8001edc:	4649      	mov	r1, r9
+ 8001ede:	a805      	add	r0, sp, #20
+ 8001ee0:	f006 ffa2 	bl	8008e28 <HAL_RCC_ClockConfig>
+
+    // DIS-able MSI-Hardware auto calibration mode with LSE
+    CLEAR_BIT(RCC->CR, RCC_CR_MSIPLLEN);
+ 8001ee4:	6823      	ldr	r3, [r4, #0]
+ 8001ee6:	f023 0304 	bic.w	r3, r3, #4
+ 8001eea:	6023      	str	r3, [r4, #0]
+
+    RCC_PeriphCLKInitTypeDef PeriphClkInitStruct;
+    PeriphClkInitStruct.PeriphClockSelection = RCC_PERIPHCLK_SAI1|RCC_PERIPHCLK_I2C2
+ 8001eec:	4b29      	ldr	r3, [pc, #164]	; (8001f94 <clocks_setup+0x110>)
+ 8001eee:	931b      	str	r3, [sp, #108]	; 0x6c
+
+    // PLLSAI is used to clock USB, ADC, I2C1 and RNG. The frequency is
+    // HSE(8MHz)/PLLM(2)*PLLSAI1N(24)/PLLSAIQ(2) = 48MHz.
+    //
+    PeriphClkInitStruct.Sai1ClockSelection = RCC_SAI1CLKSOURCE_PLLSAI1;
+    PeriphClkInitStruct.AdcClockSelection = RCC_ADCCLKSOURCE_PLLSAI1;
+ 8001ef0:	f04f 5380 	mov.w	r3, #268435456	; 0x10000000
+ 8001ef4:	933b      	str	r3, [sp, #236]	; 0xec
+    PeriphClkInitStruct.UsbClockSelection = RCC_USBCLKSOURCE_PLLSAI1;
+ 8001ef6:	f04f 6380 	mov.w	r3, #67108864	; 0x4000000
+ 8001efa:	9338      	str	r3, [sp, #224]	; 0xe0
+    PeriphClkInitStruct.RTCClockSelection = RCC_RTCCLKSOURCE_HSE_DIV32; // but unused
+    PeriphClkInitStruct.RngClockSelection = RCC_RNGCLKSOURCE_PLLSAI1;
+ 8001efc:	933a      	str	r3, [sp, #232]	; 0xe8
+
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1Source = RCC_PLLSOURCE_HSE;
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1M = 2;
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1N = 24;
+ 8001efe:	2318      	movs	r3, #24
+    PeriphClkInitStruct.RTCClockSelection = RCC_RTCCLKSOURCE_HSE_DIV32; // but unused
+ 8001f00:	f44f 7240 	mov.w	r2, #768	; 0x300
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1P = RCC_PLLP_DIV7;
+ 8001f04:	e9cd 381e 	strd	r3, r8, [sp, #120]	; 0x78
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1R = RCC_PLLR_DIV2;
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1ClockOut = RCC_PLLSAI1_SAI1CLK
+                                                 |RCC_PLLSAI1_48M2CLK
+                                                 |RCC_PLLSAI1_ADC1CLK;
+
+    HAL_RCCEx_PeriphCLKConfig(&PeriphClkInitStruct);
+ 8001f08:	a81b      	add	r0, sp, #108	; 0x6c
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1ClockOut = RCC_PLLSAI1_SAI1CLK
+ 8001f0a:	4b23      	ldr	r3, [pc, #140]	; (8001f98 <clocks_setup+0x114>)
+    PeriphClkInitStruct.RTCClockSelection = RCC_RTCCLKSOURCE_HSE_DIV32; // but unused
+ 8001f0c:	923f      	str	r2, [sp, #252]	; 0xfc
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1ClockOut = RCC_PLLSAI1_SAI1CLK
+ 8001f0e:	9322      	str	r3, [sp, #136]	; 0x88
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1M = 2;
+ 8001f10:	e9cd 761c 	strd	r7, r6, [sp, #112]	; 0x70
+    PeriphClkInitStruct.PLLSAI1.PLLSAI1R = RCC_PLLR_DIV2;
+ 8001f14:	e9cd 6620 	strd	r6, r6, [sp, #128]	; 0x80
+    PeriphClkInitStruct.I2c2ClockSelection = RCC_I2C2CLKSOURCE_PCLK1;
+ 8001f18:	9531      	str	r5, [sp, #196]	; 0xc4
+    PeriphClkInitStruct.Sai1ClockSelection = RCC_SAI1CLKSOURCE_PLLSAI1;
+ 8001f1a:	9536      	str	r5, [sp, #216]	; 0xd8
+    HAL_RCCEx_PeriphCLKConfig(&PeriphClkInitStruct);
+ 8001f1c:	f007 faa8 	bl	8009470 <HAL_RCCEx_PeriphCLKConfig>
+
+    __HAL_RCC_RTC_ENABLE();
+ 8001f20:	f8d4 3090 	ldr.w	r3, [r4, #144]	; 0x90
+ 8001f24:	f443 4300 	orr.w	r3, r3, #32768	; 0x8000
+ 8001f28:	f8c4 3090 	str.w	r3, [r4, #144]	; 0x90
+    __HAL_RCC_HASH_CLK_ENABLE();        // for SHA256
+ 8001f2c:	6ce3      	ldr	r3, [r4, #76]	; 0x4c
+ 8001f2e:	f443 3300 	orr.w	r3, r3, #131072	; 0x20000
+ 8001f32:	64e3      	str	r3, [r4, #76]	; 0x4c
+ 8001f34:	6ce3      	ldr	r3, [r4, #76]	; 0x4c
+ 8001f36:	f403 3300 	and.w	r3, r3, #131072	; 0x20000
+ 8001f3a:	9301      	str	r3, [sp, #4]
+ 8001f3c:	9b01      	ldr	r3, [sp, #4]
+    __HAL_RCC_SPI1_CLK_ENABLE();        // for OLED
+ 8001f3e:	6e23      	ldr	r3, [r4, #96]	; 0x60
+ 8001f40:	f443 5380 	orr.w	r3, r3, #4096	; 0x1000
+ 8001f44:	6623      	str	r3, [r4, #96]	; 0x60
+ 8001f46:	6e23      	ldr	r3, [r4, #96]	; 0x60
+ 8001f48:	f403 5380 	and.w	r3, r3, #4096	; 0x1000
+ 8001f4c:	9302      	str	r3, [sp, #8]
+ 8001f4e:	9b02      	ldr	r3, [sp, #8]
+    //__HAL_RCC_SPI2_CLK_ENABLE();        // for SPI flash
+    __HAL_RCC_DMAMUX1_CLK_ENABLE();     // (need this) because code missing in mpy?
+ 8001f50:	6ca3      	ldr	r3, [r4, #72]	; 0x48
+ 8001f52:	f043 0304 	orr.w	r3, r3, #4
+ 8001f56:	64a3      	str	r3, [r4, #72]	; 0x48
+ 8001f58:	6ca3      	ldr	r3, [r4, #72]	; 0x48
+ 8001f5a:	f003 0304 	and.w	r3, r3, #4
+ 8001f5e:	9303      	str	r3, [sp, #12]
+ 8001f60:	9b03      	ldr	r3, [sp, #12]
+
+    // for SE2
+    __HAL_RCC_I2C2_CLK_ENABLE();
+ 8001f62:	6da3      	ldr	r3, [r4, #88]	; 0x58
+ 8001f64:	f443 0380 	orr.w	r3, r3, #4194304	; 0x400000
+ 8001f68:	65a3      	str	r3, [r4, #88]	; 0x58
+ 8001f6a:	6da3      	ldr	r3, [r4, #88]	; 0x58
+ 8001f6c:	f403 0380 	and.w	r3, r3, #4194304	; 0x400000
+ 8001f70:	9304      	str	r3, [sp, #16]
+ 8001f72:	9b04      	ldr	r3, [sp, #16]
+    __HAL_RCC_I2C2_FORCE_RESET();
+ 8001f74:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 8001f76:	f443 0380 	orr.w	r3, r3, #4194304	; 0x400000
+ 8001f7a:	63a3      	str	r3, [r4, #56]	; 0x38
+    __HAL_RCC_I2C2_RELEASE_RESET();
+ 8001f7c:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 8001f7e:	f423 0380 	bic.w	r3, r3, #4194304	; 0x400000
+ 8001f82:	63a3      	str	r3, [r4, #56]	; 0x38
+
+    // setup SYSTICK, but we don't have the irq hooked up and not using HAL
+    // but we use it in polling mode for delay_ms()
+    systick_setup();
+ 8001f84:	f7ff ff50 	bl	8001e28 <systick_setup>
+
+}
+ 8001f88:	b041      	add	sp, #260	; 0x104
+ 8001f8a:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+ 8001f8e:	bf00      	nop
+ 8001f90:	40021000 	.word	0x40021000
+ 8001f94:	00066880 	.word	0x00066880
+ 8001f98:	01110000 	.word	0x01110000
+
+08001f9c <flash_ob_lock.part.0>:
+    } else {
+
+        // write changes to OB flash bytes
+
+        // Set OPTSTRT bit
+        SET_BIT(FLASH->CR, FLASH_CR_OPTSTRT);
+ 8001f9c:	4b13      	ldr	r3, [pc, #76]	; (8001fec <flash_ob_lock.part.0+0x50>)
+ 8001f9e:	695a      	ldr	r2, [r3, #20]
+ 8001fa0:	f442 3200 	orr.w	r2, r2, #131072	; 0x20000
+ 8001fa4:	615a      	str	r2, [r3, #20]
+    while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_BSY)) {
+ 8001fa6:	691a      	ldr	r2, [r3, #16]
+ 8001fa8:	03d2      	lsls	r2, r2, #15
+ 8001faa:	d4fc      	bmi.n	8001fa6 <flash_ob_lock.part.0+0xa>
+    uint32_t error = (FLASH->SR & FLASH_FLAG_SR_ERRORS);
+ 8001fac:	6919      	ldr	r1, [r3, #16]
+    if(error) {
+ 8001fae:	4a10      	ldr	r2, [pc, #64]	; (8001ff0 <flash_ob_lock.part.0+0x54>)
+ 8001fb0:	4211      	tst	r1, r2
+ 8001fb2:	d104      	bne.n	8001fbe <flash_ob_lock.part.0+0x22>
+    if (__HAL_FLASH_GET_FLAG(FLASH_FLAG_EOP)) {
+ 8001fb4:	691a      	ldr	r2, [r3, #16]
+ 8001fb6:	07d0      	lsls	r0, r2, #31
+        __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_EOP);
+ 8001fb8:	bf44      	itt	mi
+ 8001fba:	2201      	movmi	r2, #1
+ 8001fbc:	611a      	strmi	r2, [r3, #16]
+
+        /// Wait for update to complete
+        _flash_wait_done();
+
+        // lock OB again.
+        SET_BIT(FLASH->CR, FLASH_CR_OPTLOCK);
+ 8001fbe:	4b0b      	ldr	r3, [pc, #44]	; (8001fec <flash_ob_lock.part.0+0x50>)
+ 8001fc0:	695a      	ldr	r2, [r3, #20]
+ 8001fc2:	f042 4280 	orr.w	r2, r2, #1073741824	; 0x40000000
+ 8001fc6:	615a      	str	r2, [r3, #20]
+
+        // include "launch" to make them take effect NOW
+        SET_BIT(FLASH->CR, FLASH_CR_OBL_LAUNCH);
+ 8001fc8:	695a      	ldr	r2, [r3, #20]
+ 8001fca:	f042 6200 	orr.w	r2, r2, #134217728	; 0x8000000
+ 8001fce:	615a      	str	r2, [r3, #20]
+    while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_BSY)) {
+ 8001fd0:	691a      	ldr	r2, [r3, #16]
+ 8001fd2:	03d1      	lsls	r1, r2, #15
+ 8001fd4:	d4fc      	bmi.n	8001fd0 <flash_ob_lock.part.0+0x34>
+    uint32_t error = (FLASH->SR & FLASH_FLAG_SR_ERRORS);
+ 8001fd6:	6919      	ldr	r1, [r3, #16]
+    if(error) {
+ 8001fd8:	4a05      	ldr	r2, [pc, #20]	; (8001ff0 <flash_ob_lock.part.0+0x54>)
+ 8001fda:	4211      	tst	r1, r2
+ 8001fdc:	d104      	bne.n	8001fe8 <flash_ob_lock.part.0+0x4c>
+    if (__HAL_FLASH_GET_FLAG(FLASH_FLAG_EOP)) {
+ 8001fde:	691a      	ldr	r2, [r3, #16]
+ 8001fe0:	07d2      	lsls	r2, r2, #31
+        __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_EOP);
+ 8001fe2:	bf44      	itt	mi
+ 8001fe4:	2201      	movmi	r2, #1
+ 8001fe6:	611a      	strmi	r2, [r3, #16]
+
+        _flash_wait_done();
+    }
+}
+ 8001fe8:	4770      	bx	lr
+ 8001fea:	bf00      	nop
+ 8001fec:	40022000 	.word	0x40022000
+ 8001ff0:	0002c3fa 	.word	0x0002c3fa
+
+08001ff4 <flash_setup0>:
+{
+ 8001ff4:	b507      	push	{r0, r1, r2, lr}
+    memcpy(&_srelocate, &_etext, ((uint32_t)&_erelocate)-(uint32_t)&_srelocate);
+ 8001ff6:	4809      	ldr	r0, [pc, #36]	; (800201c <flash_setup0+0x28>)
+ 8001ff8:	4a09      	ldr	r2, [pc, #36]	; (8002020 <flash_setup0+0x2c>)
+ 8001ffa:	490a      	ldr	r1, [pc, #40]	; (8002024 <flash_setup0+0x30>)
+ 8001ffc:	1a12      	subs	r2, r2, r0
+ 8001ffe:	f00b fb43 	bl	800d688 <memcpy>
+    __HAL_RCC_FLASH_CLK_ENABLE();
+ 8002002:	4b09      	ldr	r3, [pc, #36]	; (8002028 <flash_setup0+0x34>)
+ 8002004:	6c9a      	ldr	r2, [r3, #72]	; 0x48
+ 8002006:	f442 7280 	orr.w	r2, r2, #256	; 0x100
+ 800200a:	649a      	str	r2, [r3, #72]	; 0x48
+ 800200c:	6c9b      	ldr	r3, [r3, #72]	; 0x48
+ 800200e:	f403 7380 	and.w	r3, r3, #256	; 0x100
+ 8002012:	9301      	str	r3, [sp, #4]
+ 8002014:	9b01      	ldr	r3, [sp, #4]
+}
+ 8002016:	b003      	add	sp, #12
+ 8002018:	f85d fb04 	ldr.w	pc, [sp], #4
+ 800201c:	2009e000 	.word	0x2009e000
+ 8002020:	2009e150 	.word	0x2009e150
+ 8002024:	0800ead0 	.word	0x0800ead0
+ 8002028:	40021000 	.word	0x40021000
+
+0800202c <flash_lock>:
+    SET_BIT(FLASH->CR, FLASH_CR_LOCK);
+ 800202c:	4a02      	ldr	r2, [pc, #8]	; (8002038 <flash_lock+0xc>)
+ 800202e:	6953      	ldr	r3, [r2, #20]
+ 8002030:	f043 4300 	orr.w	r3, r3, #2147483648	; 0x80000000
+ 8002034:	6153      	str	r3, [r2, #20]
+}
+ 8002036:	4770      	bx	lr
+ 8002038:	40022000 	.word	0x40022000
+
+0800203c <flash_unlock>:
+{
+ 800203c:	b508      	push	{r3, lr}
+    if(READ_BIT(FLASH->CR, FLASH_CR_LOCK)) {
+ 800203e:	4b08      	ldr	r3, [pc, #32]	; (8002060 <flash_unlock+0x24>)
+ 8002040:	695a      	ldr	r2, [r3, #20]
+ 8002042:	2a00      	cmp	r2, #0
+ 8002044:	da0a      	bge.n	800205c <flash_unlock+0x20>
+        WRITE_REG(FLASH->KEYR, FLASH_KEY1);
+ 8002046:	4a07      	ldr	r2, [pc, #28]	; (8002064 <flash_unlock+0x28>)
+ 8002048:	609a      	str	r2, [r3, #8]
+        WRITE_REG(FLASH->KEYR, FLASH_KEY2);
+ 800204a:	f102 3288 	add.w	r2, r2, #2290649224	; 0x88888888
+ 800204e:	609a      	str	r2, [r3, #8]
+        if(READ_BIT(FLASH->CR, FLASH_CR_LOCK)) {
+ 8002050:	695b      	ldr	r3, [r3, #20]
+ 8002052:	2b00      	cmp	r3, #0
+ 8002054:	da02      	bge.n	800205c <flash_unlock+0x20>
+            INCONSISTENT("failed to unlock");
+ 8002056:	4804      	ldr	r0, [pc, #16]	; (8002068 <flash_unlock+0x2c>)
+ 8002058:	f7fe fcf6 	bl	8000a48 <fatal_error>
+}
+ 800205c:	bd08      	pop	{r3, pc}
+ 800205e:	bf00      	nop
+ 8002060:	40022000 	.word	0x40022000
+ 8002064:	45670123 	.word	0x45670123
+ 8002068:	0800d760 	.word	0x0800d760
+
+0800206c <flash_ob_lock>:
+{
+ 800206c:	b510      	push	{r4, lr}
+    if(!lock) {
+ 800206e:	b980      	cbnz	r0, 8002092 <flash_ob_lock+0x26>
+        if(READ_BIT(FLASH->CR, FLASH_CR_OPTLOCK)) {
+ 8002070:	4c0a      	ldr	r4, [pc, #40]	; (800209c <flash_ob_lock+0x30>)
+ 8002072:	6963      	ldr	r3, [r4, #20]
+ 8002074:	005a      	lsls	r2, r3, #1
+ 8002076:	d510      	bpl.n	800209a <flash_ob_lock+0x2e>
+            flash_unlock();
+ 8002078:	f7ff ffe0 	bl	800203c <flash_unlock>
+            WRITE_REG(FLASH->OPTKEYR, FLASH_OPTKEY1);
+ 800207c:	4b08      	ldr	r3, [pc, #32]	; (80020a0 <flash_ob_lock+0x34>)
+ 800207e:	60e3      	str	r3, [r4, #12]
+            WRITE_REG(FLASH->OPTKEYR, FLASH_OPTKEY2);
+ 8002080:	f103 3344 	add.w	r3, r3, #1145324612	; 0x44444444
+ 8002084:	60e3      	str	r3, [r4, #12]
+            if(READ_BIT(FLASH->CR, FLASH_CR_OPTLOCK)) {
+ 8002086:	6963      	ldr	r3, [r4, #20]
+ 8002088:	005b      	lsls	r3, r3, #1
+ 800208a:	d506      	bpl.n	800209a <flash_ob_lock+0x2e>
+                INCONSISTENT("failed to OB unlock");
+ 800208c:	4805      	ldr	r0, [pc, #20]	; (80020a4 <flash_ob_lock+0x38>)
+ 800208e:	f7fe fcdb 	bl	8000a48 <fatal_error>
+}
+ 8002092:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+ 8002096:	f7ff bf81 	b.w	8001f9c <flash_ob_lock.part.0>
+ 800209a:	bd10      	pop	{r4, pc}
+ 800209c:	40022000 	.word	0x40022000
+ 80020a0:	08192a3b 	.word	0x08192a3b
+ 80020a4:	0800d760 	.word	0x0800d760
+
+080020a8 <pick_pairing_secret>:
+
+// pick_pairing_secret()
+//
+    static void
+pick_pairing_secret(void)
+{
+ 80020a8:	b570      	push	{r4, r5, r6, lr}
+ 80020aa:	f5ad 6d85 	sub.w	sp, sp, #1064	; 0x428
+    // important the RNG works here. ok to call setup multiple times.
+    rng_setup();
+ 80020ae:	f000 fb39 	bl	8002724 <rng_setup>
+ 80020b2:	24c8      	movs	r4, #200	; 0xc8
+#else
+    // Demo to anyone watching that the RNG is working, but likely only
+    // to be seen by production team during initial powerup.
+    uint8_t    tmp[1024];
+    for(int i=0; i<200; i++) {
+        rng_buffer(tmp, sizeof(tmp));
+ 80020b4:	f44f 6180 	mov.w	r1, #1024	; 0x400
+ 80020b8:	a80a      	add	r0, sp, #40	; 0x28
+ 80020ba:	f000 fb5f 	bl	800277c <rng_buffer>
+
+        oled_show_raw(sizeof(tmp), (void *)tmp);
+ 80020be:	a90a      	add	r1, sp, #40	; 0x28
+ 80020c0:	f44f 6080 	mov.w	r0, #1024	; 0x400
+ 80020c4:	f7fe fea0 	bl	8000e08 <oled_show_raw>
+    for(int i=0; i<200; i++) {
+ 80020c8:	3c01      	subs	r4, #1
+ 80020ca:	d1f3      	bne.n	80020b4 <pick_pairing_secret+0xc>
+    }
+
+    oled_factory_busy();
+ 80020cc:	f7fe ff8a 	bl	8000fe4 <oled_factory_busy>
+#endif
+
+    // .. but don't use those numbers, because those are semi-public now.
+    uint32_t secret[8];
+    for(int i=0; i<8; i++) {
+ 80020d0:	ad02      	add	r5, sp, #8
+    oled_factory_busy();
+ 80020d2:	462e      	mov	r6, r5
+        secret[i] = rng_sample();
+ 80020d4:	f000 fb14 	bl	8002700 <rng_sample>
+    for(int i=0; i<8; i++) {
+ 80020d8:	3401      	adds	r4, #1
+ 80020da:	2c08      	cmp	r4, #8
+        secret[i] = rng_sample();
+ 80020dc:	f846 0b04 	str.w	r0, [r6], #4
+    for(int i=0; i<8; i++) {
+ 80020e0:	d1f8      	bne.n	80020d4 <pick_pairing_secret+0x2c>
+    }
+
+    // enforce policy that first word is not all ones (so it never
+    // looks like unprogrammed flash).
+    while(secret[0] == ~0) {
+ 80020e2:	682b      	ldr	r3, [r5, #0]
+ 80020e4:	3301      	adds	r3, #1
+ 80020e6:	d00c      	beq.n	8002102 <pick_pairing_secret+0x5a>
+
+    // Write pairing secret into flash
+    {
+        uint32_t dest = (uint32_t)&rom_secrets->pairing_secret;
+
+        flash_unlock();
+ 80020e8:	f7ff ffa8 	bl	800203c <flash_unlock>
+        uint32_t dest = (uint32_t)&rom_secrets->pairing_secret;
+ 80020ec:	4c16      	ldr	r4, [pc, #88]	; (8002148 <pick_pairing_secret+0xa0>)
+        for(int i=0; i<8; i+=2, dest += 8) {
+ 80020ee:	4e17      	ldr	r6, [pc, #92]	; (800214c <pick_pairing_secret+0xa4>)
+            uint64_t    val = (((uint64_t)secret[i]) << 32) | secret[i+1];
+
+            if(flash_burn(dest, val)) {
+ 80020f0:	e9d5 3200 	ldrd	r3, r2, [r5]
+ 80020f4:	4620      	mov	r0, r4
+ 80020f6:	f00b fb2b 	bl	800d750 <__flash_burn_veneer>
+ 80020fa:	b130      	cbz	r0, 800210a <pick_pairing_secret+0x62>
+                INCONSISTENT("flash fail");
+ 80020fc:	4814      	ldr	r0, [pc, #80]	; (8002150 <pick_pairing_secret+0xa8>)
+ 80020fe:	f7fe fca3 	bl	8000a48 <fatal_error>
+        secret[0] = rng_sample();
+ 8002102:	f000 fafd 	bl	8002700 <rng_sample>
+ 8002106:	6028      	str	r0, [r5, #0]
+ 8002108:	e7eb      	b.n	80020e2 <pick_pairing_secret+0x3a>
+        for(int i=0; i<8; i+=2, dest += 8) {
+ 800210a:	3408      	adds	r4, #8
+ 800210c:	42b4      	cmp	r4, r6
+ 800210e:	f105 0508 	add.w	r5, r5, #8
+ 8002112:	d1ed      	bne.n	80020f0 <pick_pairing_secret+0x48>
+            }
+        }
+        flash_lock();
+ 8002114:	f7ff ff8a 	bl	800202c <flash_lock>
+                                + sizeof(rom_secrets->mcu_hmac_key);
+
+        STATIC_ASSERT(offsetof(rom_secrets_t, hash_cache_secret) % 8 == 0);
+        STATIC_ASSERT(blen % 8 == 0);
+
+        flash_unlock();
+ 8002118:	f7ff ff90 	bl	800203c <flash_unlock>
+        uint32_t dest = (uint32_t)&rom_secrets->hash_cache_secret;
+ 800211c:	4c0d      	ldr	r4, [pc, #52]	; (8002154 <pick_pairing_secret+0xac>)
+        for(int i=0; i<blen; i+=8, dest += 8) {
+ 800211e:	4d0e      	ldr	r5, [pc, #56]	; (8002158 <pick_pairing_secret+0xb0>)
+            uint64_t    val = ((uint64_t)rng_sample() << 32) | rng_sample();
+ 8002120:	f000 faee 	bl	8002700 <rng_sample>
+ 8002124:	9001      	str	r0, [sp, #4]
+ 8002126:	f000 faeb 	bl	8002700 <rng_sample>
+
+            if(flash_burn(dest, val)) {
+ 800212a:	9b01      	ldr	r3, [sp, #4]
+            uint64_t    val = ((uint64_t)rng_sample() << 32) | rng_sample();
+ 800212c:	4602      	mov	r2, r0
+            if(flash_burn(dest, val)) {
+ 800212e:	4620      	mov	r0, r4
+ 8002130:	f00b fb0e 	bl	800d750 <__flash_burn_veneer>
+ 8002134:	2800      	cmp	r0, #0
+ 8002136:	d1e1      	bne.n	80020fc <pick_pairing_secret+0x54>
+        for(int i=0; i<blen; i+=8, dest += 8) {
+ 8002138:	3408      	adds	r4, #8
+ 800213a:	42ac      	cmp	r4, r5
+ 800213c:	d1f0      	bne.n	8002120 <pick_pairing_secret+0x78>
+                INCONSISTENT("flash fail");
+            }
+        }
+        flash_lock();
+ 800213e:	f7ff ff75 	bl	800202c <flash_lock>
+    }
+    
+}
+ 8002142:	f50d 6d85 	add.w	sp, sp, #1064	; 0x428
+ 8002146:	bd70      	pop	{r4, r5, r6, pc}
+ 8002148:	0801c000 	.word	0x0801c000
+ 800214c:	0801c020 	.word	0x0801c020
+ 8002150:	0800d760 	.word	0x0800d760
+ 8002154:	0801c070 	.word	0x0801c070
+ 8002158:	0801c0b0 	.word	0x0801c0b0
+
+0800215c <flash_save_ae_serial>:
+//
+// Write the serial number of ATECC608 into flash forever.
+//
+    void
+flash_save_ae_serial(const uint8_t serial[9])
+{
+ 800215c:	b51f      	push	{r0, r1, r2, r3, r4, lr}
+ 800215e:	4602      	mov	r2, r0
+    uint64_t    tmp[2];
+    memset(&tmp, 0x0, sizeof(tmp));
+ 8002160:	2300      	movs	r3, #0
+    memcpy(&tmp, serial, 9);
+ 8002162:	6800      	ldr	r0, [r0, #0]
+ 8002164:	6851      	ldr	r1, [r2, #4]
+ 8002166:	7a12      	ldrb	r2, [r2, #8]
+    memset(&tmp, 0x0, sizeof(tmp));
+ 8002168:	e9cd 3302 	strd	r3, r3, [sp, #8]
+    memcpy(&tmp, serial, 9);
+ 800216c:	466b      	mov	r3, sp
+ 800216e:	c303      	stmia	r3!, {r0, r1}
+ 8002170:	701a      	strb	r2, [r3, #0]
+
+    flash_setup0();
+ 8002172:	f7ff ff3f 	bl	8001ff4 <flash_setup0>
+    flash_unlock();
+ 8002176:	f7ff ff61 	bl	800203c <flash_unlock>
+
+    if(flash_burn((uint32_t)&rom_secrets->ae_serial_number[0], tmp[0])) {
+ 800217a:	e9dd 2300 	ldrd	r2, r3, [sp]
+ 800217e:	4809      	ldr	r0, [pc, #36]	; (80021a4 <flash_save_ae_serial+0x48>)
+ 8002180:	f00b fae6 	bl	800d750 <__flash_burn_veneer>
+ 8002184:	b110      	cbz	r0, 800218c <flash_save_ae_serial+0x30>
+        INCONSISTENT("fail1");
+ 8002186:	4808      	ldr	r0, [pc, #32]	; (80021a8 <flash_save_ae_serial+0x4c>)
+ 8002188:	f7fe fc5e 	bl	8000a48 <fatal_error>
+    }
+    if(flash_burn((uint32_t)&rom_secrets->ae_serial_number[1], tmp[1])) {
+ 800218c:	e9dd 2302 	ldrd	r2, r3, [sp, #8]
+ 8002190:	4806      	ldr	r0, [pc, #24]	; (80021ac <flash_save_ae_serial+0x50>)
+ 8002192:	f00b fadd 	bl	800d750 <__flash_burn_veneer>
+ 8002196:	2800      	cmp	r0, #0
+ 8002198:	d1f5      	bne.n	8002186 <flash_save_ae_serial+0x2a>
+        INCONSISTENT("fail2");
+    }
+
+    flash_lock();
+}
+ 800219a:	b005      	add	sp, #20
+ 800219c:	f85d eb04 	ldr.w	lr, [sp], #4
+    flash_lock();
+ 80021a0:	f7ff bf44 	b.w	800202c <flash_lock>
+ 80021a4:	0801c040 	.word	0x0801c040
+ 80021a8:	0800d760 	.word	0x0800d760
+ 80021ac:	0801c048 	.word	0x0801c048
+
+080021b0 <flash_save_bag_number>:
+//
+// Write bag number (probably a string)
+//
+    void
+flash_save_bag_number(const uint8_t new_number[32])
+{
+ 80021b0:	b570      	push	{r4, r5, r6, lr}
+ 80021b2:	b088      	sub	sp, #32
+    uint32_t dest = (uint32_t)&rom_secrets->bag_number[0];
+    uint64_t tmp[4] = { 0 };
+    uint64_t *src = tmp;
+
+    STATIC_ASSERT(sizeof(tmp) == 32);
+    memcpy(tmp, new_number, 32);
+ 80021b4:	4603      	mov	r3, r0
+ 80021b6:	466c      	mov	r4, sp
+ 80021b8:	f100 0520 	add.w	r5, r0, #32
+ 80021bc:	6818      	ldr	r0, [r3, #0]
+ 80021be:	6859      	ldr	r1, [r3, #4]
+ 80021c0:	4622      	mov	r2, r4
+ 80021c2:	c203      	stmia	r2!, {r0, r1}
+ 80021c4:	3308      	adds	r3, #8
+ 80021c6:	42ab      	cmp	r3, r5
+ 80021c8:	4614      	mov	r4, r2
+ 80021ca:	d1f7      	bne.n	80021bc <flash_save_bag_number+0xc>
+
+    flash_setup0();
+ 80021cc:	f7ff ff12 	bl	8001ff4 <flash_setup0>
+    flash_unlock();
+ 80021d0:	f7ff ff34 	bl	800203c <flash_unlock>
+    uint32_t dest = (uint32_t)&rom_secrets->bag_number[0];
+ 80021d4:	4d09      	ldr	r5, [pc, #36]	; (80021fc <flash_save_bag_number+0x4c>)
+
+    // NOTE: can only write once! No provision for read/check/update.
+    for(int i=0; i<(32/8); i++, dest+=8, src++) {
+ 80021d6:	4e0a      	ldr	r6, [pc, #40]	; (8002200 <flash_save_bag_number+0x50>)
+ 80021d8:	466c      	mov	r4, sp
+        if(flash_burn(dest, *src)) {
+ 80021da:	e8f4 2302 	ldrd	r2, r3, [r4], #8
+ 80021de:	4628      	mov	r0, r5
+ 80021e0:	f00b fab6 	bl	800d750 <__flash_burn_veneer>
+ 80021e4:	b110      	cbz	r0, 80021ec <flash_save_bag_number+0x3c>
+            INCONSISTENT("fail write");
+ 80021e6:	4807      	ldr	r0, [pc, #28]	; (8002204 <flash_save_bag_number+0x54>)
+ 80021e8:	f7fe fc2e 	bl	8000a48 <fatal_error>
+    for(int i=0; i<(32/8); i++, dest+=8, src++) {
+ 80021ec:	3508      	adds	r5, #8
+ 80021ee:	42b5      	cmp	r5, r6
+ 80021f0:	d1f3      	bne.n	80021da <flash_save_bag_number+0x2a>
+        }
+    }
+
+    flash_lock();
+}
+ 80021f2:	b008      	add	sp, #32
+ 80021f4:	e8bd 4070 	ldmia.w	sp!, {r4, r5, r6, lr}
+    flash_lock();
+ 80021f8:	f7ff bf18 	b.w	800202c <flash_lock>
+ 80021fc:	0801c050 	.word	0x0801c050
+ 8002200:	0801c070 	.word	0x0801c070
+ 8002204:	0800d760 	.word	0x0800d760
+
+08002208 <flash_save_se2_data>:
+// Save bunch of stuff related to SE2. Allow updates to sections that are
+// given as ones at this point.
+//
+    void
+flash_save_se2_data(const se2_secrets_t *se2)
+{
+ 8002208:	e92d 41f3 	stmdb	sp!, {r0, r1, r4, r5, r6, r7, r8, lr}
+ 800220c:	4605      	mov	r5, r0
+    uint8_t *dest = (uint8_t *)&rom_secrets->se2;
+ 800220e:	4c1a      	ldr	r4, [pc, #104]	; (8002278 <flash_save_se2_data+0x70>)
+    STATIC_ASSERT(offsetof(rom_secrets_t, se2) % 8 == 0);
+
+    flash_setup0();
+    flash_unlock();
+
+    for(int i=0; i<(sizeof(se2_secrets_t)/8); i++, dest+=8, src+=8) {
+ 8002210:	f8df 8070 	ldr.w	r8, [pc, #112]	; 8002284 <flash_save_se2_data+0x7c>
+    flash_setup0();
+ 8002214:	f7ff feee 	bl	8001ff4 <flash_setup0>
+    flash_unlock();
+ 8002218:	f7ff ff10 	bl	800203c <flash_unlock>
+    for(int i=0; i<(sizeof(se2_secrets_t)/8); i++, dest+=8, src+=8) {
+ 800221c:	1b2d      	subs	r5, r5, r4
+ 800221e:	eb05 0c04 	add.w	ip, r5, r4
+        uint64_t val;
+        memcpy(&val, src, sizeof(val));
+ 8002222:	5928      	ldr	r0, [r5, r4]
+ 8002224:	f8dc 1004 	ldr.w	r1, [ip, #4]
+ 8002228:	466b      	mov	r3, sp
+
+        // don't write if all ones or already written correctly
+        if(val == ~0) continue;
+ 800222a:	f1b1 3fff 	cmp.w	r1, #4294967295	; 0xffffffff
+ 800222e:	bf08      	it	eq
+ 8002230:	f1b0 3fff 	cmpeq.w	r0, #4294967295	; 0xffffffff
+        memcpy(&val, src, sizeof(val));
+ 8002234:	c303      	stmia	r3!, {r0, r1}
+        if(val == ~0) continue;
+ 8002236:	4607      	mov	r7, r0
+ 8002238:	460e      	mov	r6, r1
+ 800223a:	d015      	beq.n	8002268 <flash_save_se2_data+0x60>
+        if(check_equal(dest, src, 8)) continue;
+ 800223c:	2208      	movs	r2, #8
+ 800223e:	4661      	mov	r1, ip
+ 8002240:	4620      	mov	r0, r4
+ 8002242:	f000 fa4c 	bl	80026de <check_equal>
+ 8002246:	b978      	cbnz	r0, 8002268 <flash_save_se2_data+0x60>
+
+        // can't write if not ones already
+        ASSERT(check_all_ones(dest, 8));
+ 8002248:	2108      	movs	r1, #8
+ 800224a:	4620      	mov	r0, r4
+ 800224c:	f000 fa2e 	bl	80026ac <check_all_ones>
+ 8002250:	b910      	cbnz	r0, 8002258 <flash_save_se2_data+0x50>
+ 8002252:	480a      	ldr	r0, [pc, #40]	; (800227c <flash_save_se2_data+0x74>)
+
+        if(flash_burn((uint32_t)dest, val)) {
+            INCONSISTENT("fail write");
+ 8002254:	f7fe fbf8 	bl	8000a48 <fatal_error>
+        if(flash_burn((uint32_t)dest, val)) {
+ 8002258:	463a      	mov	r2, r7
+ 800225a:	4633      	mov	r3, r6
+ 800225c:	4620      	mov	r0, r4
+ 800225e:	f00b fa77 	bl	800d750 <__flash_burn_veneer>
+ 8002262:	b108      	cbz	r0, 8002268 <flash_save_se2_data+0x60>
+            INCONSISTENT("fail write");
+ 8002264:	4806      	ldr	r0, [pc, #24]	; (8002280 <flash_save_se2_data+0x78>)
+ 8002266:	e7f5      	b.n	8002254 <flash_save_se2_data+0x4c>
+    for(int i=0; i<(sizeof(se2_secrets_t)/8); i++, dest+=8, src+=8) {
+ 8002268:	3408      	adds	r4, #8
+ 800226a:	4544      	cmp	r4, r8
+ 800226c:	d1d7      	bne.n	800221e <flash_save_se2_data+0x16>
+        }
+    }
+
+    flash_lock();
+}
+ 800226e:	b002      	add	sp, #8
+ 8002270:	e8bd 41f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, lr}
+    flash_lock();
+ 8002274:	f7ff beda 	b.w	800202c <flash_lock>
+ 8002278:	0801c0b0 	.word	0x0801c0b0
+ 800227c:	0800e466 	.word	0x0800e466
+ 8002280:	0800d760 	.word	0x0800d760
+ 8002284:	0801c190 	.word	0x0801c190
+
+08002288 <flash_setup>:
+//
+// This is really a state-machine, to recover boards that are booted w/ missing AE chip.
+//
+    void
+flash_setup(void)
+{
+ 8002288:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+
+    // see if we have picked a pairing secret yet.
+    // NOTE: critical section for glitching (at least in past versions)
+    //  - check_all.. functions have a rng_delay in them already
+    rng_delay();
+    bool blank_ps = check_all_ones(rom_secrets->pairing_secret, 32);
+ 800228c:	4d3e      	ldr	r5, [pc, #248]	; (8002388 <flash_setup+0x100>)
+{
+ 800228e:	b088      	sub	sp, #32
+    flash_setup0();
+ 8002290:	f7ff feb0 	bl	8001ff4 <flash_setup0>
+    rng_delay();
+ 8002294:	f000 fa88 	bl	80027a8 <rng_delay>
+    bool blank_ps = check_all_ones(rom_secrets->pairing_secret, 32);
+ 8002298:	2120      	movs	r1, #32
+ 800229a:	4628      	mov	r0, r5
+ 800229c:	f000 fa06 	bl	80026ac <check_all_ones>
+    bool zeroed_ps = check_all_zeros(rom_secrets->pairing_secret, 32);
+ 80022a0:	2120      	movs	r1, #32
+    bool blank_ps = check_all_ones(rom_secrets->pairing_secret, 32);
+ 80022a2:	4606      	mov	r6, r0
+    bool zeroed_ps = check_all_zeros(rom_secrets->pairing_secret, 32);
+ 80022a4:	4628      	mov	r0, r5
+ 80022a6:	f000 fa0b 	bl	80026c0 <check_all_zeros>
+    bool blank_xor = check_all_ones(rom_secrets->pairing_secret_xor, 32);
+ 80022aa:	2120      	movs	r1, #32
+    bool zeroed_ps = check_all_zeros(rom_secrets->pairing_secret, 32);
+ 80022ac:	4607      	mov	r7, r0
+    bool blank_xor = check_all_ones(rom_secrets->pairing_secret_xor, 32);
+ 80022ae:	4837      	ldr	r0, [pc, #220]	; (800238c <flash_setup+0x104>)
+ 80022b0:	f000 f9fc 	bl	80026ac <check_all_ones>
+    bool blank_ae = (~rom_secrets->ae_serial_number[0] == 0);
+ 80022b4:	e9d5 8510 	ldrd	r8, r5, [r5, #64]	; 0x40
+    bool blank_xor = check_all_ones(rom_secrets->pairing_secret_xor, 32);
+ 80022b8:	4604      	mov	r4, r0
+    rng_delay();
+ 80022ba:	f000 fa75 	bl	80027a8 <rng_delay>
+
+    if(zeroed_ps) {
+ 80022be:	b127      	cbz	r7, 80022ca <flash_setup+0x42>
+        // fast brick process leaves us w/ zero pairing secret
+        oled_show(screen_brick);
+ 80022c0:	4833      	ldr	r0, [pc, #204]	; (8002390 <flash_setup+0x108>)
+ 80022c2:	f7fe fdcd 	bl	8000e60 <oled_show>
+        LOCKUP_FOREVER();
+ 80022c6:	bf30      	wfi
+ 80022c8:	e7fd      	b.n	80022c6 <flash_setup+0x3e>
+    }
+
+    if(blank_ps) {
+ 80022ca:	b10e      	cbz	r6, 80022d0 <flash_setup+0x48>
+        // get some good entropy, save it.
+        pick_pairing_secret();
+ 80022cc:	f7ff feec 	bl	80020a8 <pick_pairing_secret>
+
+        blank_ps = false;
+    }
+
+    if(blank_xor || blank_ae) {
+ 80022d0:	b92c      	cbnz	r4, 80022de <flash_setup+0x56>
+ 80022d2:	f1b5 3fff 	cmp.w	r5, #4294967295	; 0xffffffff
+ 80022d6:	bf08      	it	eq
+ 80022d8:	f1b8 3fff 	cmpeq.w	r8, #4294967295	; 0xffffffff
+ 80022dc:	d12f      	bne.n	800233e <flash_setup+0xb6>
+
+        // setup the SE2 (mostly). handles failures by dying
+        se2_setup_config();
+ 80022de:	f005 fb07 	bl	80078f0 <se2_setup_config>
+
+        // configure and lock-down the SE1
+        int rv = ae_setup_config();
+ 80022e2:	f001 f99b 	bl	800361c <ae_setup_config>
+ 80022e6:	4605      	mov	r5, r0
+
+        rng_delay();
+ 80022e8:	f000 fa5e 	bl	80027a8 <rng_delay>
+        if(rv) {
+ 80022ec:	b13d      	cbz	r5, 80022fe <flash_setup+0x76>
+            // Hardware fail speaking to AE chip ... be careful not to brick here.
+            // Do not continue!! We might fix the board, or add missing pullup, etc.
+            oled_show(screen_se1_issue);
+ 80022ee:	4829      	ldr	r0, [pc, #164]	; (8002394 <flash_setup+0x10c>)
+ 80022f0:	f7fe fdb6 	bl	8000e60 <oled_show>
+            puts("SE1 config fail");
+ 80022f4:	4828      	ldr	r0, [pc, #160]	; (8002398 <flash_setup+0x110>)
+ 80022f6:	f002 fd8b 	bl	8004e10 <puts>
+
+            LOCKUP_FOREVER();
+ 80022fa:	bf30      	wfi
+ 80022fc:	e7fd      	b.n	80022fa <flash_setup+0x72>
+        }
+
+        rng_delay();
+ 80022fe:	f000 fa53 	bl	80027a8 <rng_delay>
+        if(blank_xor) {
+ 8002302:	b1a4      	cbz	r4, 800232e <flash_setup+0xa6>
+    flash_unlock();
+ 8002304:	f7ff fe9a 	bl	800203c <flash_unlock>
+    uint64_t *src = (uint64_t *)&rom_secrets->pairing_secret;
+ 8002308:	4c1f      	ldr	r4, [pc, #124]	; (8002388 <flash_setup+0x100>)
+    for(int i=0; i<(32/8); i++, dest+=8, src++) {
+ 800230a:	4d20      	ldr	r5, [pc, #128]	; (800238c <flash_setup+0x104>)
+        uint64_t    val = ~(*src);
+ 800230c:	e9d4 2300 	ldrd	r2, r3, [r4]
+        if(flash_burn(dest, val)) {
+ 8002310:	f104 0020 	add.w	r0, r4, #32
+ 8002314:	43d2      	mvns	r2, r2
+ 8002316:	43db      	mvns	r3, r3
+ 8002318:	f00b fa1a 	bl	800d750 <__flash_burn_veneer>
+ 800231c:	b110      	cbz	r0, 8002324 <flash_setup+0x9c>
+            INCONSISTENT("flash xor fail");
+ 800231e:	481f      	ldr	r0, [pc, #124]	; (800239c <flash_setup+0x114>)
+ 8002320:	f7fe fb92 	bl	8000a48 <fatal_error>
+    for(int i=0; i<(32/8); i++, dest+=8, src++) {
+ 8002324:	3408      	adds	r4, #8
+ 8002326:	42ac      	cmp	r4, r5
+ 8002328:	d1f0      	bne.n	800230c <flash_setup+0x84>
+    flash_lock();
+ 800232a:	f7ff fe7f 	bl	800202c <flash_lock>
+        // Q: just do it (we warned them)
+        extern void turn_power_off(void);
+        turn_power_off();
+#else
+        // Mk: operator must do it
+        oled_show(screen_replug);
+ 800232e:	481c      	ldr	r0, [pc, #112]	; (80023a0 <flash_setup+0x118>)
+ 8002330:	f7fe fd96 	bl	8000e60 <oled_show>
+        puts("replug required");
+ 8002334:	481b      	ldr	r0, [pc, #108]	; (80023a4 <flash_setup+0x11c>)
+ 8002336:	f002 fd6b 	bl	8004e10 <puts>
+        LOCKUP_FOREVER();
+ 800233a:	bf30      	wfi
+ 800233c:	e7fd      	b.n	800233a <flash_setup+0xb2>
+
+    rng_delay();
+    if(!blank_ps && !blank_xor) {
+        // check the XOR value also written: 2 phase commit
+        uint8_t tmp[32];
+        memcpy(tmp, rom_secrets->pairing_secret, 32);
+ 800233e:	4d12      	ldr	r5, [pc, #72]	; (8002388 <flash_setup+0x100>)
+    rng_delay();
+ 8002340:	f000 fa32 	bl	80027a8 <rng_delay>
+        memcpy(tmp, rom_secrets->pairing_secret, 32);
+ 8002344:	cd0f      	ldmia	r5!, {r0, r1, r2, r3}
+ 8002346:	466c      	mov	r4, sp
+ 8002348:	c40f      	stmia	r4!, {r0, r1, r2, r3}
+ 800234a:	e895 000f 	ldmia.w	r5, {r0, r1, r2, r3}
+ 800234e:	e884 000f 	stmia.w	r4, {r0, r1, r2, r3}
+ 8002352:	466b      	mov	r3, sp
+ 8002354:	4a0d      	ldr	r2, [pc, #52]	; (800238c <flash_setup+0x104>)
+bool check_equal(const void *aV, const void *bV, int len);
+
+// XOR-mixin more bytes; acc = acc XOR more for each byte
+void static inline xor_mixin(uint8_t *acc, const uint8_t *more, int len)
+{
+	for(; len; len--, more++, acc++) {
+ 8002356:	4c14      	ldr	r4, [pc, #80]	; (80023a8 <flash_setup+0x120>)
+ 8002358:	4618      	mov	r0, r3
+		*(acc) ^= *(more);
+ 800235a:	7819      	ldrb	r1, [r3, #0]
+ 800235c:	f812 5b01 	ldrb.w	r5, [r2], #1
+ 8002360:	4069      	eors	r1, r5
+	for(; len; len--, more++, acc++) {
+ 8002362:	42a2      	cmp	r2, r4
+		*(acc) ^= *(more);
+ 8002364:	f803 1b01 	strb.w	r1, [r3], #1
+	for(; len; len--, more++, acc++) {
+ 8002368:	d1f7      	bne.n	800235a <flash_setup+0xd2>
+        xor_mixin(tmp, rom_secrets->pairing_secret_xor, 32);
+
+        if(!check_all_ones(tmp, 32)) {
+ 800236a:	2120      	movs	r1, #32
+ 800236c:	f000 f99e 	bl	80026ac <check_all_ones>
+ 8002370:	b938      	cbnz	r0, 8002382 <flash_setup+0xfa>
+            oled_show(screen_corrupt);
+ 8002372:	480e      	ldr	r0, [pc, #56]	; (80023ac <flash_setup+0x124>)
+ 8002374:	f7fe fd74 	bl	8000e60 <oled_show>
+            puts("corrupt pair sec");
+ 8002378:	480d      	ldr	r0, [pc, #52]	; (80023b0 <flash_setup+0x128>)
+ 800237a:	f002 fd49 	bl	8004e10 <puts>
+
+            // dfu won't save them here, so just die
+            LOCKUP_FOREVER();
+ 800237e:	bf30      	wfi
+ 8002380:	e7fd      	b.n	800237e <flash_setup+0xf6>
+    // That's fine if we intend to ship units locked already.
+    
+    // Do NOT do write every boot, as it might wear-out
+    // the flash bits in OB.
+
+}
+ 8002382:	b008      	add	sp, #32
+ 8002384:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+ 8002388:	0801c000 	.word	0x0801c000
+ 800238c:	0801c020 	.word	0x0801c020
+ 8002390:	0800d891 	.word	0x0800d891
+ 8002394:	0800dfad 	.word	0x0800dfad
+ 8002398:	0800e660 	.word	0x0800e660
+ 800239c:	0800d760 	.word	0x0800d760
+ 80023a0:	0800df4c 	.word	0x0800df4c
+ 80023a4:	0800e670 	.word	0x0800e670
+ 80023a8:	0801c040 	.word	0x0801c040
+ 80023ac:	0800d8fb 	.word	0x0800d8fb
+ 80023b0:	0800e680 	.word	0x0800e680
+
+080023b4 <flash_lockdown_hard>:
+// 
+// This is a one-way trip. Might need power cycle to (fully?) take effect.
+//
+    void
+flash_lockdown_hard(uint8_t rdp_level_code)
+{
+ 80023b4:	b510      	push	{r4, lr}
+ 80023b6:	4604      	mov	r4, r0
+#if RELEASE
+    flash_setup0();
+ 80023b8:	f7ff fe1c 	bl	8001ff4 <flash_setup0>
+
+    // see FLASH_OB_WRPConfig()
+
+    flash_ob_lock(false);
+ 80023bc:	2000      	movs	r0, #0
+ 80023be:	f7ff fe55 	bl	800206c <flash_ob_lock>
+        // lock first 128k-8k against any writes
+        FLASH->WRP1AR = (num_pages_locked << 16);
+ 80023c2:	4b08      	ldr	r3, [pc, #32]	; (80023e4 <flash_lockdown_hard+0x30>)
+ 80023c4:	f44f 2260 	mov.w	r2, #917504	; 0xe0000
+ 80023c8:	62da      	str	r2, [r3, #44]	; 0x2c
+        FLASH->WRP1BR = 0xff;      // unused.
+ 80023ca:	22ff      	movs	r2, #255	; 0xff
+ 80023cc:	631a      	str	r2, [r3, #48]	; 0x30
+        FLASH->WRP2AR = 0xff;      // unused.
+ 80023ce:	64da      	str	r2, [r3, #76]	; 0x4c
+        FLASH->WRP2BR = 0xff;      // unused.
+ 80023d0:	651a      	str	r2, [r3, #80]	; 0x50
+        //    the RDP level is decreased from Level 1 to Level 0)."
+        // - D-bus access blocked, even for code running inside the PCROP area! (AN4758)
+        //   So literal values and constant tables and such would need special linking.
+
+        // set protection level
+        uint32_t was = FLASH->OPTR & ~0xff;
+ 80023d2:	6a1a      	ldr	r2, [r3, #32]
+ 80023d4:	f022 02ff 	bic.w	r2, r2, #255	; 0xff
+        FLASH->OPTR = was | rdp_level_code;    // select level X, other values as observed
+ 80023d8:	4322      	orrs	r2, r4
+ 80023da:	621a      	str	r2, [r3, #32]
+#else
+    puts2("flash_lockdown_hard(");
+    puthex2(rdp_level_code);
+    puts(") skipped");
+#endif
+}
+ 80023dc:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+ 80023e0:	f7ff bddc 	b.w	8001f9c <flash_ob_lock.part.0>
+ 80023e4:	40022000 	.word	0x40022000
+
+080023e8 <record_highwater_version>:
+
+// record_highwater_version()
+//
+    int
+record_highwater_version(const uint8_t timestamp[8])
+{
+ 80023e8:	b537      	push	{r0, r1, r2, r4, r5, lr}
+    const uint8_t *otp = (const uint8_t *)OPT_FLASH_BASE;
+
+    ASSERT(timestamp[0] < 0x40);
+    ASSERT(timestamp[0] >= 0x10);
+ 80023ea:	7802      	ldrb	r2, [r0, #0]
+ 80023ec:	3a10      	subs	r2, #16
+ 80023ee:	2a2f      	cmp	r2, #47	; 0x2f
+{
+ 80023f0:	4603      	mov	r3, r0
+    ASSERT(timestamp[0] >= 0x10);
+ 80023f2:	d902      	bls.n	80023fa <record_highwater_version+0x12>
+    ASSERT(timestamp[0] < 0x40);
+ 80023f4:	4810      	ldr	r0, [pc, #64]	; (8002438 <record_highwater_version+0x50>)
+ 80023f6:	f7fe fb27 	bl	8000a48 <fatal_error>
+
+    uint64_t val = 0;
+    memcpy(&val, timestamp, 8);
+ 80023fa:	6800      	ldr	r0, [r0, #0]
+ 80023fc:	6859      	ldr	r1, [r3, #4]
+    const uint8_t *otp = (const uint8_t *)OPT_FLASH_BASE;
+ 80023fe:	4c0f      	ldr	r4, [pc, #60]	; (800243c <record_highwater_version+0x54>)
+
+    // just write to first blank slot we can find.
+    for(int i=0; i<NUM_OPT_SLOTS; i++, otp+=8) {
+ 8002400:	4d0f      	ldr	r5, [pc, #60]	; (8002440 <record_highwater_version+0x58>)
+    memcpy(&val, timestamp, 8);
+ 8002402:	466a      	mov	r2, sp
+ 8002404:	c203      	stmia	r2!, {r0, r1}
+        if(check_all_ones(otp, 8)) {
+ 8002406:	2108      	movs	r1, #8
+ 8002408:	4620      	mov	r0, r4
+ 800240a:	f000 f94f 	bl	80026ac <check_all_ones>
+ 800240e:	b168      	cbz	r0, 800242c <record_highwater_version+0x44>
+            // write here.
+            flash_setup0();
+ 8002410:	f7ff fdf0 	bl	8001ff4 <flash_setup0>
+            flash_unlock();
+ 8002414:	f7ff fe12 	bl	800203c <flash_unlock>
+                flash_burn((uint32_t)otp, val);
+ 8002418:	e9dd 2300 	ldrd	r2, r3, [sp]
+ 800241c:	4620      	mov	r0, r4
+ 800241e:	f00b f997 	bl	800d750 <__flash_burn_veneer>
+            flash_lock();
+ 8002422:	f7ff fe03 	bl	800202c <flash_lock>
+
+            return 0;
+ 8002426:	2000      	movs	r0, #0
+        }
+    }
+
+    // no space.
+    return 1;
+}
+ 8002428:	b003      	add	sp, #12
+ 800242a:	bd30      	pop	{r4, r5, pc}
+    for(int i=0; i<NUM_OPT_SLOTS; i++, otp+=8) {
+ 800242c:	3408      	adds	r4, #8
+ 800242e:	42ac      	cmp	r4, r5
+ 8002430:	d1e9      	bne.n	8002406 <record_highwater_version+0x1e>
+    return 1;
+ 8002432:	2001      	movs	r0, #1
+ 8002434:	e7f8      	b.n	8002428 <record_highwater_version+0x40>
+ 8002436:	bf00      	nop
+ 8002438:	0800e466 	.word	0x0800e466
+ 800243c:	1fff7000 	.word	0x1fff7000
+ 8002440:	1fff7400 	.word	0x1fff7400
+
+08002444 <mcu_key_get>:
+
+// mcu_key_get()
+//
+    const mcu_key_t *
+mcu_key_get(bool *valid)
+{
+ 8002444:	b570      	push	{r4, r5, r6, lr}
+    // get current "mcu_key" value; first byte will never be 0x0 or 0xff
+    // - except if no key set yet/recently wiped
+    // - if none set, returns ptr to first available slot which will be all ones
+    const mcu_key_t *ptr = MCU_KEYS, *avail=NULL;
+
+    for(int i=0; i<NUM_MCU_KEYS; i++, ptr++) {
+ 8002446:	4a0d      	ldr	r2, [pc, #52]	; (800247c <mcu_key_get+0x38>)
+    const mcu_key_t *ptr = MCU_KEYS, *avail=NULL;
+ 8002448:	4c0d      	ldr	r4, [pc, #52]	; (8002480 <mcu_key_get+0x3c>)
+{
+ 800244a:	4606      	mov	r6, r0
+    const mcu_key_t *ptr = MCU_KEYS, *avail=NULL;
+ 800244c:	2500      	movs	r5, #0
+        if(ptr->value[0] == 0xff) {
+ 800244e:	7823      	ldrb	r3, [r4, #0]
+ 8002450:	2bff      	cmp	r3, #255	; 0xff
+ 8002452:	d10b      	bne.n	800246c <mcu_key_get+0x28>
+            if(!avail) {
+ 8002454:	2d00      	cmp	r5, #0
+ 8002456:	bf08      	it	eq
+ 8002458:	4625      	moveq	r5, r4
+    for(int i=0; i<NUM_MCU_KEYS; i++, ptr++) {
+ 800245a:	3420      	adds	r4, #32
+ 800245c:	4294      	cmp	r4, r2
+ 800245e:	d1f6      	bne.n	800244e <mcu_key_get+0xa>
+            *valid = true;
+            return ptr;
+        }
+    }
+
+    rng_delay();
+ 8002460:	f000 f9a2 	bl	80027a8 <rng_delay>
+    *valid = false;
+ 8002464:	2300      	movs	r3, #0
+ 8002466:	7033      	strb	r3, [r6, #0]
+    return avail;
+ 8002468:	462c      	mov	r4, r5
+ 800246a:	e005      	b.n	8002478 <mcu_key_get+0x34>
+        } else if(ptr->value[0] != 0x00) {
+ 800246c:	2b00      	cmp	r3, #0
+ 800246e:	d0f4      	beq.n	800245a <mcu_key_get+0x16>
+            rng_delay();
+ 8002470:	f000 f99a 	bl	80027a8 <rng_delay>
+            *valid = true;
+ 8002474:	2301      	movs	r3, #1
+ 8002476:	7033      	strb	r3, [r6, #0]
+}
+ 8002478:	4620      	mov	r0, r4
+ 800247a:	bd70      	pop	{r4, r5, r6, pc}
+ 800247c:	08020000 	.word	0x08020000
+ 8002480:	0801e000 	.word	0x0801e000
+
+08002484 <mcu_key_clear>:
+
+// mcu_key_clear()
+//
+    void
+mcu_key_clear(const mcu_key_t *cur)
+{
+ 8002484:	b513      	push	{r0, r1, r4, lr}
+    if(!cur) {
+ 8002486:	4604      	mov	r4, r0
+ 8002488:	b938      	cbnz	r0, 800249a <mcu_key_clear+0x16>
+        bool valid;
+        cur = mcu_key_get(&valid);
+ 800248a:	f10d 0007 	add.w	r0, sp, #7
+ 800248e:	f7ff ffd9 	bl	8002444 <mcu_key_get>
+
+        if(!valid) return;
+ 8002492:	f89d 3007 	ldrb.w	r3, [sp, #7]
+        cur = mcu_key_get(&valid);
+ 8002496:	4604      	mov	r4, r0
+        if(!valid) return;
+ 8002498:	b1fb      	cbz	r3, 80024da <mcu_key_clear+0x56>
+    }
+
+    // no delays here since decision has been made, and don't 
+    // want to give them more time to interrupt us
+    flash_setup0();
+ 800249a:	f7ff fdab 	bl	8001ff4 <flash_setup0>
+    flash_unlock();
+ 800249e:	f7ff fdcd 	bl	800203c <flash_unlock>
+        uint32_t  pos = (uint32_t)cur;
+        flash_burn(pos, 0); pos += 8;
+ 80024a2:	2200      	movs	r2, #0
+ 80024a4:	2300      	movs	r3, #0
+ 80024a6:	4620      	mov	r0, r4
+ 80024a8:	f00b f952 	bl	800d750 <__flash_burn_veneer>
+        flash_burn(pos, 0); pos += 8;
+ 80024ac:	2200      	movs	r2, #0
+ 80024ae:	2300      	movs	r3, #0
+ 80024b0:	f104 0008 	add.w	r0, r4, #8
+ 80024b4:	f00b f94c 	bl	800d750 <__flash_burn_veneer>
+        flash_burn(pos, 0); pos += 8;
+ 80024b8:	2200      	movs	r2, #0
+ 80024ba:	2300      	movs	r3, #0
+ 80024bc:	f104 0010 	add.w	r0, r4, #16
+ 80024c0:	f00b f946 	bl	800d750 <__flash_burn_veneer>
+        flash_burn(pos, 0);
+ 80024c4:	2200      	movs	r2, #0
+ 80024c6:	2300      	movs	r3, #0
+ 80024c8:	f104 0018 	add.w	r0, r4, #24
+ 80024cc:	f00b f940 	bl	800d750 <__flash_burn_veneer>
+    flash_lock();
+}
+ 80024d0:	b002      	add	sp, #8
+ 80024d2:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+    flash_lock();
+ 80024d6:	f7ff bda9 	b.w	800202c <flash_lock>
+}
+ 80024da:	b002      	add	sp, #8
+ 80024dc:	bd10      	pop	{r4, pc}
+	...
+
+080024e0 <mcu_key_usage>:
+
+// mcu_key_usage()
+//
+    void
+mcu_key_usage(int *avail_out, int *consumed_out, int *total_out)
+{
+ 80024e0:	b5f0      	push	{r4, r5, r6, r7, lr}
+    const mcu_key_t *ptr = MCU_KEYS;
+    int avail = 0, used = 0;
+ 80024e2:	2300      	movs	r3, #0
+    const mcu_key_t *ptr = MCU_KEYS;
+ 80024e4:	4c09      	ldr	r4, [pc, #36]	; (800250c <mcu_key_usage+0x2c>)
+
+    for(int i=0; i<NUM_MCU_KEYS; i++, ptr++) {
+ 80024e6:	4f0a      	ldr	r7, [pc, #40]	; (8002510 <mcu_key_usage+0x30>)
+    int avail = 0, used = 0;
+ 80024e8:	461d      	mov	r5, r3
+        if(ptr->value[0] == 0xff) {
+ 80024ea:	7826      	ldrb	r6, [r4, #0]
+ 80024ec:	2eff      	cmp	r6, #255	; 0xff
+ 80024ee:	d109      	bne.n	8002504 <mcu_key_usage+0x24>
+            avail ++;
+ 80024f0:	3501      	adds	r5, #1
+    for(int i=0; i<NUM_MCU_KEYS; i++, ptr++) {
+ 80024f2:	3420      	adds	r4, #32
+ 80024f4:	42bc      	cmp	r4, r7
+ 80024f6:	d1f8      	bne.n	80024ea <mcu_key_usage+0xa>
+        } else if(ptr->value[0] == 0x00) {
+            used ++;
+        }
+    }
+
+    *avail_out = avail;
+ 80024f8:	6005      	str	r5, [r0, #0]
+    *consumed_out = used;
+ 80024fa:	600b      	str	r3, [r1, #0]
+    *total_out = NUM_MCU_KEYS;
+ 80024fc:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 8002500:	6013      	str	r3, [r2, #0]
+}
+ 8002502:	bdf0      	pop	{r4, r5, r6, r7, pc}
+        } else if(ptr->value[0] == 0x00) {
+ 8002504:	2e00      	cmp	r6, #0
+ 8002506:	d1f4      	bne.n	80024f2 <mcu_key_usage+0x12>
+            used ++;
+ 8002508:	3301      	adds	r3, #1
+ 800250a:	e7f2      	b.n	80024f2 <mcu_key_usage+0x12>
+ 800250c:	0801e000 	.word	0x0801e000
+ 8002510:	08020000 	.word	0x08020000
+
+08002514 <mcu_key_pick>:
+
+// mcu_key_pick()
+//
+    const mcu_key_t *
+mcu_key_pick(void)
+{
+ 8002514:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8002516:	b08b      	sub	sp, #44	; 0x2c
+    mcu_key_t       n;
+
+    // get some good entropy, and whiten it just in case.
+    do { 
+        rng_buffer(n.value, 32);
+ 8002518:	ad02      	add	r5, sp, #8
+ 800251a:	2120      	movs	r1, #32
+ 800251c:	4628      	mov	r0, r5
+ 800251e:	f000 f92d 	bl	800277c <rng_buffer>
+        sha256_single(n.value, 32, n.value);
+ 8002522:	462a      	mov	r2, r5
+ 8002524:	2120      	movs	r1, #32
+ 8002526:	4628      	mov	r0, r5
+ 8002528:	f003 f84a 	bl	80055c0 <sha256_single>
+        sha256_single(n.value, 32, n.value);
+ 800252c:	462a      	mov	r2, r5
+ 800252e:	2120      	movs	r1, #32
+ 8002530:	4628      	mov	r0, r5
+ 8002532:	f003 f845 	bl	80055c0 <sha256_single>
+    } while(n.value[0] == 0x0 || n.value[0] == 0xff);
+ 8002536:	f89d 3008 	ldrb.w	r3, [sp, #8]
+ 800253a:	3b01      	subs	r3, #1
+ 800253c:	b2db      	uxtb	r3, r3
+ 800253e:	2bfd      	cmp	r3, #253	; 0xfd
+ 8002540:	d8eb      	bhi.n	800251a <mcu_key_pick+0x6>
+
+    int err = 0;
+    const mcu_key_t *cur;
+
+    do {
+        bool valid = false; 
+ 8002542:	2300      	movs	r3, #0
+        cur = mcu_key_get(&valid);
+ 8002544:	4668      	mov	r0, sp
+        bool valid = false; 
+ 8002546:	f88d 3000 	strb.w	r3, [sp]
+        cur = mcu_key_get(&valid);
+ 800254a:	f7ff ff7b 	bl	8002444 <mcu_key_get>
+
+        if(!cur) {
+ 800254e:	4604      	mov	r4, r0
+ 8002550:	b938      	cbnz	r0, 8002562 <mcu_key_pick+0x4e>
+            // no free slots. we are brick.
+            puts("mcu full");
+ 8002552:	4828      	ldr	r0, [pc, #160]	; (80025f4 <mcu_key_pick+0xe0>)
+ 8002554:	f002 fc5c 	bl	8004e10 <puts>
+            oled_show(screen_brick);
+ 8002558:	4827      	ldr	r0, [pc, #156]	; (80025f8 <mcu_key_pick+0xe4>)
+ 800255a:	f7fe fc81 	bl	8000e60 <oled_show>
+
+            LOCKUP_FOREVER();
+ 800255e:	bf30      	wfi
+ 8002560:	e7fd      	b.n	800255e <mcu_key_pick+0x4a>
+        }
+
+        if(valid) {
+ 8002562:	f89d 3000 	ldrb.w	r3, [sp]
+ 8002566:	b14b      	cbz	r3, 800257c <mcu_key_pick+0x68>
+            // clear existing key, if it's defined.
+            ASSERT(cur->value[0] != 0x00);
+ 8002568:	7803      	ldrb	r3, [r0, #0]
+ 800256a:	3b01      	subs	r3, #1
+ 800256c:	b2db      	uxtb	r3, r3
+ 800256e:	2bfd      	cmp	r3, #253	; 0xfd
+ 8002570:	d902      	bls.n	8002578 <mcu_key_pick+0x64>
+ 8002572:	4822      	ldr	r0, [pc, #136]	; (80025fc <mcu_key_pick+0xe8>)
+ 8002574:	f7fe fa68 	bl	8000a48 <fatal_error>
+            ASSERT(cur->value[0] != 0xff);
+
+            mcu_key_clear(cur);
+ 8002578:	f7ff ff84 	bl	8002484 <mcu_key_clear>
+            continue;
+        }
+    } while(0);
+    
+    // burn it
+    flash_setup0();
+ 800257c:	f7ff fd3a 	bl	8001ff4 <flash_setup0>
+    flash_unlock();
+ 8002580:	f7ff fd5c 	bl	800203c <flash_unlock>
+        uint32_t  pos = (uint32_t)cur;
+        const uint8_t   *fr = n.value;
+
+        for(int i=0; i<32; i+= 8, pos += 8, fr += 8) {
+ 8002584:	2700      	movs	r7, #0
+            uint64_t v;
+            memcpy(&v, fr, sizeof(v));
+ 8002586:	19ea      	adds	r2, r5, r7
+ 8002588:	59e8      	ldr	r0, [r5, r7]
+ 800258a:	6851      	ldr	r1, [r2, #4]
+ 800258c:	466b      	mov	r3, sp
+ 800258e:	c303      	stmia	r3!, {r0, r1}
+
+            err = flash_burn(pos, v);
+ 8002590:	19e0      	adds	r0, r4, r7
+ 8002592:	e9dd 2300 	ldrd	r2, r3, [sp]
+ 8002596:	f00b f8db 	bl	800d750 <__flash_burn_veneer>
+            if(err) break;
+ 800259a:	4606      	mov	r6, r0
+ 800259c:	b910      	cbnz	r0, 80025a4 <mcu_key_pick+0x90>
+        for(int i=0; i<32; i+= 8, pos += 8, fr += 8) {
+ 800259e:	3708      	adds	r7, #8
+ 80025a0:	2f20      	cmp	r7, #32
+ 80025a2:	d1f0      	bne.n	8002586 <mcu_key_pick+0x72>
+        }
+    flash_lock();
+ 80025a4:	f7ff fd42 	bl	800202c <flash_lock>
+
+    // NOTE: Errors not expected, but lets be graceful about them.
+
+    if(err) {
+ 80025a8:	b166      	cbz	r6, 80025c4 <mcu_key_pick+0xb0>
+        // what to do?
+        puts("burn fail: ");
+ 80025aa:	4815      	ldr	r0, [pc, #84]	; (8002600 <mcu_key_pick+0xec>)
+ 80025ac:	f002 fc30 	bl	8004e10 <puts>
+        puthex2(err);
+ 80025b0:	b2f0      	uxtb	r0, r6
+ 80025b2:	f002 fbd1 	bl	8004d58 <puthex2>
+        putchar('\n');
+ 80025b6:	200a      	movs	r0, #10
+ 80025b8:	f002 fbb0 	bl	8004d1c <putchar>
+        return NULL;
+    }
+
+    if(after != cur || !check_equal(after->value, n.value, 32)) {
+        puts("bad val?");
+        return NULL;
+ 80025bc:	2400      	movs	r4, #0
+    }
+
+    return cur;
+}
+ 80025be:	4620      	mov	r0, r4
+ 80025c0:	b00b      	add	sp, #44	; 0x2c
+ 80025c2:	bdf0      	pop	{r4, r5, r6, r7, pc}
+    const mcu_key_t *after = mcu_key_get(&valid);
+ 80025c4:	4668      	mov	r0, sp
+    bool valid = false; 
+ 80025c6:	f88d 6000 	strb.w	r6, [sp]
+    const mcu_key_t *after = mcu_key_get(&valid);
+ 80025ca:	f7ff ff3b 	bl	8002444 <mcu_key_get>
+    if(!valid) {
+ 80025ce:	f89d 2000 	ldrb.w	r2, [sp]
+ 80025d2:	b91a      	cbnz	r2, 80025dc <mcu_key_pick+0xc8>
+        puts("!valid?");
+ 80025d4:	480b      	ldr	r0, [pc, #44]	; (8002604 <mcu_key_pick+0xf0>)
+        puts("bad val?");
+ 80025d6:	f002 fc1b 	bl	8004e10 <puts>
+ 80025da:	e7ef      	b.n	80025bc <mcu_key_pick+0xa8>
+    if(after != cur || !check_equal(after->value, n.value, 32)) {
+ 80025dc:	4284      	cmp	r4, r0
+ 80025de:	d001      	beq.n	80025e4 <mcu_key_pick+0xd0>
+        puts("bad val?");
+ 80025e0:	4809      	ldr	r0, [pc, #36]	; (8002608 <mcu_key_pick+0xf4>)
+ 80025e2:	e7f8      	b.n	80025d6 <mcu_key_pick+0xc2>
+    if(after != cur || !check_equal(after->value, n.value, 32)) {
+ 80025e4:	2220      	movs	r2, #32
+ 80025e6:	4629      	mov	r1, r5
+ 80025e8:	f000 f879 	bl	80026de <check_equal>
+ 80025ec:	2800      	cmp	r0, #0
+ 80025ee:	d1e6      	bne.n	80025be <mcu_key_pick+0xaa>
+ 80025f0:	e7f6      	b.n	80025e0 <mcu_key_pick+0xcc>
+ 80025f2:	bf00      	nop
+ 80025f4:	0800e691 	.word	0x0800e691
+ 80025f8:	0800d891 	.word	0x0800d891
+ 80025fc:	0800e466 	.word	0x0800e466
+ 8002600:	0800e69a 	.word	0x0800e69a
+ 8002604:	0800e6a6 	.word	0x0800e6a6
+ 8002608:	0800e6ae 	.word	0x0800e6ae
+
+0800260c <fast_brick>:
+
+// fast_brick()
+//
+    void
+fast_brick(void)
+{
+ 800260c:	b538      	push	{r3, r4, r5, lr}
+#ifndef RELEASE
+    puts2("DISABLED fast brick... ");
+    oled_show(screen_brick);
+#else
+    // do a fast wipe of our key
+    mcu_key_clear(NULL);
+ 800260e:	2000      	movs	r0, #0
+ 8002610:	f7ff ff38 	bl	8002484 <mcu_key_clear>
+
+    // brick SE1 for future
+    ae_brick_myself();
+ 8002614:	f001 f970 	bl	80038f8 <ae_brick_myself>
+
+    // NOTE: could brick SE1 (somewhat) by dec'ing the counter, which will
+    // invalidate all PIN hashes
+
+    // no going back from that -- but for privacy, wipe more stuff
+    oled_show(screen_brick);
+ 8002618:	480e      	ldr	r0, [pc, #56]	; (8002654 <fast_brick+0x48>)
+        uint32_t bot = (uint32_t)MCU_KEYS;
+        flash_page_erase(bot);
+
+        // 2: LFS area first, since holds settings (AES'ed w/ lost key, but yeah)
+        // 3: the firmware, not a secret anyway
+        for(uint32_t pos=(FLASH_BASE + 0x200000 - FLASH_ERASE_SIZE); 
+ 800261a:	4c0f      	ldr	r4, [pc, #60]	; (8002658 <fast_brick+0x4c>)
+ 800261c:	4d0f      	ldr	r5, [pc, #60]	; (800265c <fast_brick+0x50>)
+    oled_show(screen_brick);
+ 800261e:	f7fe fc1f 	bl	8000e60 <oled_show>
+    puts2("fast brick... ");
+ 8002622:	480f      	ldr	r0, [pc, #60]	; (8002660 <fast_brick+0x54>)
+ 8002624:	f002 fb66 	bl	8004cf4 <puts2>
+    flash_setup0();
+ 8002628:	f7ff fce4 	bl	8001ff4 <flash_setup0>
+    flash_unlock();
+ 800262c:	f7ff fd06 	bl	800203c <flash_unlock>
+        flash_page_erase(bot);
+ 8002630:	480a      	ldr	r0, [pc, #40]	; (800265c <fast_brick+0x50>)
+ 8002632:	f00b f891 	bl	800d758 <__flash_page_erase_veneer>
+                pos > bot; pos -= FLASH_ERASE_SIZE) {
+            flash_page_erase(pos);
+ 8002636:	4620      	mov	r0, r4
+                pos > bot; pos -= FLASH_ERASE_SIZE) {
+ 8002638:	f5a4 5480 	sub.w	r4, r4, #4096	; 0x1000
+            flash_page_erase(pos);
+ 800263c:	f00b f88c 	bl	800d758 <__flash_page_erase_veneer>
+        for(uint32_t pos=(FLASH_BASE + 0x200000 - FLASH_ERASE_SIZE); 
+ 8002640:	42ac      	cmp	r4, r5
+ 8002642:	d1f8      	bne.n	8002636 <fast_brick+0x2a>
+        }
+    flash_lock();
+    puts(" done");
+ 8002644:	4807      	ldr	r0, [pc, #28]	; (8002664 <fast_brick+0x58>)
+    flash_lock();
+ 8002646:	f7ff fcf1 	bl	800202c <flash_lock>
+    puts(" done");
+ 800264a:	f002 fbe1 	bl	8004e10 <puts>
+#endif
+
+    LOCKUP_FOREVER();
+ 800264e:	bf30      	wfi
+ 8002650:	e7fd      	b.n	800264e <fast_brick+0x42>
+ 8002652:	bf00      	nop
+ 8002654:	0800d891 	.word	0x0800d891
+ 8002658:	081ff000 	.word	0x081ff000
+ 800265c:	0801e000 	.word	0x0801e000
+ 8002660:	0800e6b7 	.word	0x0800e6b7
+ 8002664:	0800e6c6 	.word	0x0800e6c6
+
+08002668 <fast_wipe>:
+
+// fast_wipe()
+//
+    void
+fast_wipe(void)
+{
+ 8002668:	b508      	push	{r3, lr}
+    // dump (part of) the main seed key and become a new Coldcard
+    // - lots of other code can and will detect a missing MCU key as "blank"
+    // - and the check value on main seed will be garbage now
+    mcu_key_clear(NULL);
+ 800266a:	2000      	movs	r0, #0
+ 800266c:	f7ff ff0a 	bl	8002484 <mcu_key_clear>
+  __ASM volatile ("dsb 0xF":::"memory");
+ 8002670:	f3bf 8f4f 	dsb	sy
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 8002674:	4905      	ldr	r1, [pc, #20]	; (800268c <fast_wipe+0x24>)
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 8002676:	4b06      	ldr	r3, [pc, #24]	; (8002690 <fast_wipe+0x28>)
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 8002678:	68ca      	ldr	r2, [r1, #12]
+ 800267a:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 800267e:	4313      	orrs	r3, r2
+ 8002680:	60cb      	str	r3, [r1, #12]
+ 8002682:	f3bf 8f4f 	dsb	sy
+    __NOP();
+ 8002686:	bf00      	nop
+  for(;;)                                                           /* wait until reset */
+ 8002688:	e7fd      	b.n	8002686 <fast_wipe+0x1e>
+ 800268a:	bf00      	nop
+ 800268c:	e000ed00 	.word	0xe000ed00
+ 8002690:	05fa0004 	.word	0x05fa0004
+
+08002694 <check_all_ones_raw>:
+check_all_ones_raw(const void *ptrV, int len)
+{
+	uint8_t rv = 0xff;
+	const uint8_t *ptr = (const uint8_t *)ptrV;
+
+	for(; len; len--, ptr++) {
+ 8002694:	4401      	add	r1, r0
+	uint8_t rv = 0xff;
+ 8002696:	23ff      	movs	r3, #255	; 0xff
+	for(; len; len--, ptr++) {
+ 8002698:	4288      	cmp	r0, r1
+ 800269a:	d103      	bne.n	80026a4 <check_all_ones_raw+0x10>
+		rv &= *ptr;
+	}
+
+	return (rv == 0xff);
+}
+ 800269c:	3bff      	subs	r3, #255	; 0xff
+ 800269e:	4258      	negs	r0, r3
+ 80026a0:	4158      	adcs	r0, r3
+ 80026a2:	4770      	bx	lr
+		rv &= *ptr;
+ 80026a4:	f810 2b01 	ldrb.w	r2, [r0], #1
+ 80026a8:	4013      	ands	r3, r2
+	for(; len; len--, ptr++) {
+ 80026aa:	e7f5      	b.n	8002698 <check_all_ones_raw+0x4>
+
+080026ac <check_all_ones>:
+//
+// Return T if all bytes are 0xFF
+//
+	bool
+check_all_ones(const void *ptrV, int len)
+{
+ 80026ac:	b507      	push	{r0, r1, r2, lr}
+	bool rv = check_all_ones_raw(ptrV, len);
+ 80026ae:	f7ff fff1 	bl	8002694 <check_all_ones_raw>
+ 80026b2:	9001      	str	r0, [sp, #4]
+
+    rng_delay();
+ 80026b4:	f000 f878 	bl	80027a8 <rng_delay>
+
+	return rv;
+}
+ 80026b8:	9801      	ldr	r0, [sp, #4]
+ 80026ba:	b003      	add	sp, #12
+ 80026bc:	f85d fb04 	ldr.w	pc, [sp], #4
+
+080026c0 <check_all_zeros>:
+//
+// Return T if all bytes are 0x00
+//
+	bool
+check_all_zeros(const void *ptrV, int len)
+{
+ 80026c0:	b510      	push	{r4, lr}
+ 80026c2:	4401      	add	r1, r0
+	uint8_t rv = 0x0;
+ 80026c4:	2400      	movs	r4, #0
+	const uint8_t *ptr = (const uint8_t *)ptrV;
+
+	for(; len; len--, ptr++) {
+ 80026c6:	4288      	cmp	r0, r1
+ 80026c8:	d105      	bne.n	80026d6 <check_all_zeros+0x16>
+		rv |= *ptr;
+	}
+
+    rng_delay();
+ 80026ca:	f000 f86d 	bl	80027a8 <rng_delay>
+	return (rv == 0x00);
+}
+ 80026ce:	fab4 f084 	clz	r0, r4
+ 80026d2:	0940      	lsrs	r0, r0, #5
+ 80026d4:	bd10      	pop	{r4, pc}
+		rv |= *ptr;
+ 80026d6:	f810 3b01 	ldrb.w	r3, [r0], #1
+ 80026da:	431c      	orrs	r4, r3
+	for(; len; len--, ptr++) {
+ 80026dc:	e7f3      	b.n	80026c6 <check_all_zeros+0x6>
+
+080026de <check_equal>:
+	const uint8_t *left = (const uint8_t *)aV;
+	const uint8_t *right = (const uint8_t *)bV;
+    uint8_t diff = 0;
+    int i;
+
+    for (i = 0; i < len; i++) {
+ 80026de:	2300      	movs	r3, #0
+{
+ 80026e0:	b570      	push	{r4, r5, r6, lr}
+    uint8_t diff = 0;
+ 80026e2:	461c      	mov	r4, r3
+    for (i = 0; i < len; i++) {
+ 80026e4:	4293      	cmp	r3, r2
+ 80026e6:	db05      	blt.n	80026f4 <check_equal+0x16>
+        diff |= (left[i] ^ right[i]);
+    }
+
+    rng_delay();
+ 80026e8:	f000 f85e 	bl	80027a8 <rng_delay>
+    return (diff == 0);
+}
+ 80026ec:	fab4 f084 	clz	r0, r4
+ 80026f0:	0940      	lsrs	r0, r0, #5
+ 80026f2:	bd70      	pop	{r4, r5, r6, pc}
+        diff |= (left[i] ^ right[i]);
+ 80026f4:	5cc5      	ldrb	r5, [r0, r3]
+ 80026f6:	5cce      	ldrb	r6, [r1, r3]
+ 80026f8:	4075      	eors	r5, r6
+ 80026fa:	432c      	orrs	r4, r5
+    for (i = 0; i < len; i++) {
+ 80026fc:	3301      	adds	r3, #1
+ 80026fe:	e7f1      	b.n	80026e4 <check_equal+0x6>
+
+08002700 <rng_sample>:
+        }
+
+        // Get the new number
+        uint32_t rv = RNG->DR;
+
+        if(rv != last_rng_result && rv) {
+ 8002700:	4b06      	ldr	r3, [pc, #24]	; (800271c <rng_sample+0x1c>)
+        while(!(RNG->SR & RNG_FLAG_DRDY)) {
+ 8002702:	4a07      	ldr	r2, [pc, #28]	; (8002720 <rng_sample+0x20>)
+        if(rv != last_rng_result && rv) {
+ 8002704:	6819      	ldr	r1, [r3, #0]
+        while(!(RNG->SR & RNG_FLAG_DRDY)) {
+ 8002706:	6850      	ldr	r0, [r2, #4]
+ 8002708:	07c0      	lsls	r0, r0, #31
+ 800270a:	d5fc      	bpl.n	8002706 <rng_sample+0x6>
+        uint32_t rv = RNG->DR;
+ 800270c:	6890      	ldr	r0, [r2, #8]
+        if(rv != last_rng_result && rv) {
+ 800270e:	4281      	cmp	r1, r0
+ 8002710:	d0f9      	beq.n	8002706 <rng_sample+0x6>
+ 8002712:	2800      	cmp	r0, #0
+ 8002714:	d0f7      	beq.n	8002706 <rng_sample+0x6>
+            last_rng_result = rv;
+ 8002716:	6018      	str	r0, [r3, #0]
+
+        // keep trying if not a new number
+    }
+
+    // NOT-REACHED
+}
+ 8002718:	4770      	bx	lr
+ 800271a:	bf00      	nop
+ 800271c:	2009e1b8 	.word	0x2009e1b8
+ 8002720:	50060800 	.word	0x50060800
+
+08002724 <rng_setup>:
+    if(RNG->CR & RNG_CR_RNGEN) {
+ 8002724:	4b12      	ldr	r3, [pc, #72]	; (8002770 <rng_setup+0x4c>)
+ 8002726:	681a      	ldr	r2, [r3, #0]
+ 8002728:	0752      	lsls	r2, r2, #29
+{
+ 800272a:	b513      	push	{r0, r1, r4, lr}
+    if(RNG->CR & RNG_CR_RNGEN) {
+ 800272c:	d41d      	bmi.n	800276a <rng_setup+0x46>
+    __HAL_RCC_RNG_CLK_ENABLE();
+ 800272e:	4a11      	ldr	r2, [pc, #68]	; (8002774 <rng_setup+0x50>)
+ 8002730:	6cd1      	ldr	r1, [r2, #76]	; 0x4c
+ 8002732:	f441 2180 	orr.w	r1, r1, #262144	; 0x40000
+ 8002736:	64d1      	str	r1, [r2, #76]	; 0x4c
+ 8002738:	6cd2      	ldr	r2, [r2, #76]	; 0x4c
+ 800273a:	f402 2280 	and.w	r2, r2, #262144	; 0x40000
+ 800273e:	9201      	str	r2, [sp, #4]
+ 8002740:	9a01      	ldr	r2, [sp, #4]
+    RNG->CR |= RNG_CR_RNGEN;
+ 8002742:	681a      	ldr	r2, [r3, #0]
+ 8002744:	f042 0204 	orr.w	r2, r2, #4
+ 8002748:	601a      	str	r2, [r3, #0]
+    uint32_t chk = rng_sample();
+ 800274a:	f7ff ffd9 	bl	8002700 <rng_sample>
+ 800274e:	4604      	mov	r4, r0
+    uint32_t chk2 = rng_sample();
+ 8002750:	f7ff ffd6 	bl	8002700 <rng_sample>
+    if(chk == 0 || chk == ~0
+ 8002754:	1e63      	subs	r3, r4, #1
+ 8002756:	3303      	adds	r3, #3
+ 8002758:	d804      	bhi.n	8002764 <rng_setup+0x40>
+        || chk2 == 0 || chk2 == ~0
+ 800275a:	1e43      	subs	r3, r0, #1
+ 800275c:	3303      	adds	r3, #3
+ 800275e:	d801      	bhi.n	8002764 <rng_setup+0x40>
+        || chk == chk2
+ 8002760:	4284      	cmp	r4, r0
+ 8002762:	d102      	bne.n	800276a <rng_setup+0x46>
+        INCONSISTENT("bad rng");
+ 8002764:	4804      	ldr	r0, [pc, #16]	; (8002778 <rng_setup+0x54>)
+ 8002766:	f7fe f96f 	bl	8000a48 <fatal_error>
+}
+ 800276a:	b002      	add	sp, #8
+ 800276c:	bd10      	pop	{r4, pc}
+ 800276e:	bf00      	nop
+ 8002770:	50060800 	.word	0x50060800
+ 8002774:	40021000 	.word	0x40021000
+ 8002778:	0800d760 	.word	0x0800d760
+
+0800277c <rng_buffer>:
+
+// rng_buffer()
+//
+    void
+rng_buffer(uint8_t *result, int len)
+{
+ 800277c:	b573      	push	{r0, r1, r4, r5, r6, lr}
+ 800277e:	460c      	mov	r4, r1
+ 8002780:	1845      	adds	r5, r0, r1
+    while(len > 0) {
+ 8002782:	2c00      	cmp	r4, #0
+ 8002784:	eba5 0604 	sub.w	r6, r5, r4
+ 8002788:	dc01      	bgt.n	800278e <rng_buffer+0x12>
+        memcpy(result, &t, MIN(4, len));
+
+        len -= 4;
+        result += 4;
+    }
+}
+ 800278a:	b002      	add	sp, #8
+ 800278c:	bd70      	pop	{r4, r5, r6, pc}
+        uint32_t    t = rng_sample();
+ 800278e:	f7ff ffb7 	bl	8002700 <rng_sample>
+        memcpy(result, &t, MIN(4, len));
+ 8002792:	2c04      	cmp	r4, #4
+ 8002794:	4622      	mov	r2, r4
+        uint32_t    t = rng_sample();
+ 8002796:	9001      	str	r0, [sp, #4]
+        memcpy(result, &t, MIN(4, len));
+ 8002798:	bfa8      	it	ge
+ 800279a:	2204      	movge	r2, #4
+ 800279c:	a901      	add	r1, sp, #4
+ 800279e:	4630      	mov	r0, r6
+ 80027a0:	f00a ff72 	bl	800d688 <memcpy>
+        len -= 4;
+ 80027a4:	3c04      	subs	r4, #4
+        result += 4;
+ 80027a6:	e7ec      	b.n	8002782 <rng_buffer+0x6>
+
+080027a8 <rng_delay>:
+//
+// Call anytime. Delays for a random time period to fustrate glitchers.
+//
+    void
+rng_delay(void)
+{
+ 80027a8:	b508      	push	{r3, lr}
+    uint32_t    r = rng_sample() % 8;
+ 80027aa:	f7ff ffa9 	bl	8002700 <rng_sample>
+    uint32_t    cnt = (1<<r);
+ 80027ae:	2301      	movs	r3, #1
+    uint32_t    r = rng_sample() % 8;
+ 80027b0:	f000 0007 	and.w	r0, r0, #7
+    uint32_t    cnt = (1<<r);
+ 80027b4:	fa03 f000 	lsl.w	r0, r3, r0
+
+    while(cnt) {
+        asm("nop");         // need this to keep from being optimized away, check bootloader.lss
+ 80027b8:	bf00      	nop
+    while(cnt) {
+ 80027ba:	3801      	subs	r0, #1
+ 80027bc:	d1fc      	bne.n	80027b8 <rng_delay+0x10>
+        cnt--;
+    }
+}
+ 80027be:	bd08      	pop	{r3, pc}
+
+080027c0 <_send_byte>:
+    static inline void
+_send_byte(uint8_t ch)
+{
+    // reset timeout timer (Systick)
+    uint32_t    ticks = 0;
+    SysTick->VAL = 0;
+ 80027c0:	f04f 22e0 	mov.w	r2, #3758153728	; 0xe000e000
+{
+ 80027c4:	b510      	push	{r4, lr}
+    SysTick->VAL = 0;
+ 80027c6:	2300      	movs	r3, #0
+
+    while(!(MY_UART->ISR & UART_FLAG_TXE)) {
+ 80027c8:	4c07      	ldr	r4, [pc, #28]	; (80027e8 <_send_byte+0x28>)
+    SysTick->VAL = 0;
+ 80027ca:	6193      	str	r3, [r2, #24]
+    while(!(MY_UART->ISR & UART_FLAG_TXE)) {
+ 80027cc:	230b      	movs	r3, #11
+ 80027ce:	69e1      	ldr	r1, [r4, #28]
+ 80027d0:	0609      	lsls	r1, r1, #24
+ 80027d2:	d404      	bmi.n	80027de <_send_byte+0x1e>
+        // busy-wait until able to send (no fifo?)
+        if(SysTick->CTRL & SysTick_CTRL_COUNTFLAG_Msk) {
+ 80027d4:	6911      	ldr	r1, [r2, #16]
+ 80027d6:	03c9      	lsls	r1, r1, #15
+ 80027d8:	d5f9      	bpl.n	80027ce <_send_byte+0xe>
+            // failsafe timeout
+            ticks += 1;
+            if(ticks > 10) break;
+ 80027da:	3b01      	subs	r3, #1
+ 80027dc:	d1f7      	bne.n	80027ce <_send_byte+0xe>
+        }
+    }
+    MY_UART->TDR = ch;
+ 80027de:	4b02      	ldr	r3, [pc, #8]	; (80027e8 <_send_byte+0x28>)
+ 80027e0:	b280      	uxth	r0, r0
+ 80027e2:	8518      	strh	r0, [r3, #40]	; 0x28
+}
+ 80027e4:	bd10      	pop	{r4, pc}
+ 80027e6:	bf00      	nop
+ 80027e8:	40004c00 	.word	0x40004c00
+
+080027ec <_send_bits>:
+
+// _send_bits()
+//
+    static void
+_send_bits(uint8_t tx)
+{
+ 80027ec:	b570      	push	{r4, r5, r6, lr}
+ 80027ee:	4606      	mov	r6, r0
+ 80027f0:	2508      	movs	r5, #8
+    // serialize and send one byte
+    uint8_t     mask = 0x1;
+ 80027f2:	2401      	movs	r4, #1
+
+    for(int i=0; i<8; i++, mask <<= 1) {
+        uint8_t h = (tx & mask) ? BIT1 : BIT0;
+ 80027f4:	4226      	tst	r6, r4
+
+        _send_byte(h);
+ 80027f6:	bf14      	ite	ne
+ 80027f8:	207f      	movne	r0, #127	; 0x7f
+ 80027fa:	207d      	moveq	r0, #125	; 0x7d
+ 80027fc:	f7ff ffe0 	bl	80027c0 <_send_byte>
+    for(int i=0; i<8; i++, mask <<= 1) {
+ 8002800:	0064      	lsls	r4, r4, #1
+ 8002802:	3d01      	subs	r5, #1
+ 8002804:	b2e4      	uxtb	r4, r4
+ 8002806:	d1f5      	bne.n	80027f4 <_send_bits+0x8>
+    }
+}
+ 8002808:	bd70      	pop	{r4, r5, r6, pc}
+
+0800280a <_send_serialized>:
+
+// _send_serialized()
+//
+    static void
+_send_serialized(const uint8_t *buf, int len)
+{
+ 800280a:	b538      	push	{r3, r4, r5, lr}
+ 800280c:	4604      	mov	r4, r0
+ 800280e:	1845      	adds	r5, r0, r1
+    for(int i=0; i<len; i++) {
+        _send_bits(buf[i]);
+ 8002810:	f814 0b01 	ldrb.w	r0, [r4], #1
+ 8002814:	f7ff ffea 	bl	80027ec <_send_bits>
+    for(int i=0; i<len; i++) {
+ 8002818:	42ac      	cmp	r4, r5
+ 800281a:	d1f9      	bne.n	8002810 <_send_serialized+0x6>
+    }
+}
+ 800281c:	bd38      	pop	{r3, r4, r5, pc}
+	...
+
+08002820 <_flush_rx>:
+//
+    static inline void
+_flush_rx(void)
+{
+    // reset timeout timer (Systick)
+    SysTick->VAL = 0;
+ 8002820:	f04f 23e0 	mov.w	r3, #3758153728	; 0xe000e000
+ 8002824:	2200      	movs	r2, #0
+
+    while(!(MY_UART->ISR & UART_FLAG_TC)) {
+ 8002826:	490b      	ldr	r1, [pc, #44]	; (8002854 <_flush_rx+0x34>)
+    SysTick->VAL = 0;
+ 8002828:	619a      	str	r2, [r3, #24]
+    while(!(MY_UART->ISR & UART_FLAG_TC)) {
+ 800282a:	69ca      	ldr	r2, [r1, #28]
+ 800282c:	0652      	lsls	r2, r2, #25
+ 800282e:	d402      	bmi.n	8002836 <_flush_rx+0x16>
+        // wait for last bit(byte) to be serialized and sent
+
+        if(SysTick->CTRL & SysTick_CTRL_COUNTFLAG_Msk) {
+ 8002830:	691a      	ldr	r2, [r3, #16]
+ 8002832:	03d0      	lsls	r0, r2, #15
+ 8002834:	d5f9      	bpl.n	800282a <_flush_rx+0xa>
+            break;
+        }
+    }
+
+    // We actually need this delay here!
+    __NOP();
+ 8002836:	bf00      	nop
+    __NOP();
+ 8002838:	bf00      	nop
+    __NOP();
+ 800283a:	bf00      	nop
+    __NOP();
+ 800283c:	bf00      	nop
+    __NOP();
+ 800283e:	bf00      	nop
+    __NOP();
+ 8002840:	bf00      	nop
+    __NOP();
+ 8002842:	bf00      	nop
+    __NOP();
+ 8002844:	bf00      	nop
+
+    // clear junk in rx buffer
+    MY_UART->RQR = USART_RQR_RXFRQ;
+ 8002846:	4b03      	ldr	r3, [pc, #12]	; (8002854 <_flush_rx+0x34>)
+ 8002848:	2208      	movs	r2, #8
+ 800284a:	831a      	strh	r2, [r3, #24]
+
+    // clear overrun error
+    // clear rx timeout flag
+    // clear framing error
+    MY_UART->ICR = USART_ICR_ORECF | USART_ICR_RTOCF | USART_ICR_FECF;
+ 800284c:	f640 020a 	movw	r2, #2058	; 0x80a
+ 8002850:	621a      	str	r2, [r3, #32]
+}
+ 8002852:	4770      	bx	lr
+ 8002854:	40004c00 	.word	0x40004c00
+
+08002858 <crc16_chain>:
+    uint16_t crc_register = 0;
+    uint16_t polynom = 0x8005;
+    uint8_t shift_register;
+    uint8_t data_bit, crc_bit;
+    
+    crc_register = (((uint16_t) crc[0]) & 0x00FF) | (((uint16_t) crc[1]) << 8);
+ 8002858:	8813      	ldrh	r3, [r2, #0]
+{
+ 800285a:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 800285c:	4408      	add	r0, r1
+
+         // Shift CRC to the left by 1.
+         crc_register <<= 1; 
+
+         if ((data_bit ^ crc_bit) != 0)
+            crc_register ^= polynom;
+ 800285e:	f248 0605 	movw	r6, #32773	; 0x8005
+    for (counter = 0; counter < length; counter++) {
+ 8002862:	4281      	cmp	r1, r0
+ 8002864:	d103      	bne.n	800286e <crc16_chain+0x16>
+      }  
+    }
+        
+    crc[0] = (uint8_t) (crc_register & 0x00FF);
+ 8002866:	7013      	strb	r3, [r2, #0]
+    crc[1] = (uint8_t) (crc_register >> 8);
+ 8002868:	0a1b      	lsrs	r3, r3, #8
+ 800286a:	7053      	strb	r3, [r2, #1]
+}   
+ 800286c:	bdf0      	pop	{r4, r5, r6, r7, pc}
+         data_bit = (data[counter] & shift_register) ? 1 : 0;
+ 800286e:	f811 7b01 	ldrb.w	r7, [r1], #1
+ 8002872:	2508      	movs	r5, #8
+      for (shift_register = 0x01; shift_register > 0x00; shift_register <<= 1) {
+ 8002874:	2401      	movs	r4, #1
+         data_bit = (data[counter] & shift_register) ? 1 : 0;
+ 8002876:	4227      	tst	r7, r4
+         crc_bit = crc_register >> 15;
+ 8002878:	ea4f 3cd3 	mov.w	ip, r3, lsr #15
+         if ((data_bit ^ crc_bit) != 0)
+ 800287c:	bf18      	it	ne
+ 800287e:	f04f 0e01 	movne.w	lr, #1
+         crc_register <<= 1; 
+ 8002882:	ea4f 0343 	mov.w	r3, r3, lsl #1
+         if ((data_bit ^ crc_bit) != 0)
+ 8002886:	bf08      	it	eq
+ 8002888:	f04f 0e00 	moveq.w	lr, #0
+ 800288c:	45e6      	cmp	lr, ip
+         crc_register <<= 1; 
+ 800288e:	b29b      	uxth	r3, r3
+            crc_register ^= polynom;
+ 8002890:	bf18      	it	ne
+ 8002892:	4073      	eorne	r3, r6
+      for (shift_register = 0x01; shift_register > 0x00; shift_register <<= 1) {
+ 8002894:	0064      	lsls	r4, r4, #1
+ 8002896:	3d01      	subs	r5, #1
+ 8002898:	b2e4      	uxtb	r4, r4
+ 800289a:	d1ec      	bne.n	8002876 <crc16_chain+0x1e>
+ 800289c:	e7e1      	b.n	8002862 <crc16_chain+0xa>
+
+0800289e <ae_check_crc>:
+
+// ae_check_crc()
+//
+	static bool
+ae_check_crc(const uint8_t *data, uint8_t length)
+{
+ 800289e:	b573      	push	{r0, r1, r4, r5, r6, lr}
+	uint8_t obs[2] = { 0, 0 };
+
+	if(data[0] != length) {
+ 80028a0:	7806      	ldrb	r6, [r0, #0]
+	uint8_t obs[2] = { 0, 0 };
+ 80028a2:	2400      	movs	r4, #0
+	if(data[0] != length) {
+ 80028a4:	428e      	cmp	r6, r1
+{
+ 80028a6:	4605      	mov	r5, r0
+	uint8_t obs[2] = { 0, 0 };
+ 80028a8:	f8ad 4004 	strh.w	r4, [sp, #4]
+	if(data[0] != length) {
+ 80028ac:	d113      	bne.n	80028d6 <ae_check_crc+0x38>
+		// length is wrong
+        STATS(crc_len_error++);
+		return false;
+	}
+
+	crc16_chain(length-2, data, obs);
+ 80028ae:	4629      	mov	r1, r5
+ 80028b0:	1eb0      	subs	r0, r6, #2
+
+	return (obs[0] == data[length-2] && obs[1] == data[length-1]);
+ 80028b2:	4435      	add	r5, r6
+	crc16_chain(length-2, data, obs);
+ 80028b4:	aa01      	add	r2, sp, #4
+ 80028b6:	b2c0      	uxtb	r0, r0
+ 80028b8:	f7ff ffce 	bl	8002858 <crc16_chain>
+	return (obs[0] == data[length-2] && obs[1] == data[length-1]);
+ 80028bc:	f89d 2004 	ldrb.w	r2, [sp, #4]
+ 80028c0:	f815 3c02 	ldrb.w	r3, [r5, #-2]
+ 80028c4:	429a      	cmp	r2, r3
+ 80028c6:	d106      	bne.n	80028d6 <ae_check_crc+0x38>
+ 80028c8:	f815 4c01 	ldrb.w	r4, [r5, #-1]
+ 80028cc:	f89d 0005 	ldrb.w	r0, [sp, #5]
+ 80028d0:	1a23      	subs	r3, r4, r0
+ 80028d2:	425c      	negs	r4, r3
+ 80028d4:	415c      	adcs	r4, r3
+		return false;
+ 80028d6:	4620      	mov	r0, r4
+}
+ 80028d8:	b002      	add	sp, #8
+ 80028da:	bd70      	pop	{r4, r5, r6, pc}
+
+080028dc <ae_wake>:
+{
+ 80028dc:	b508      	push	{r3, lr}
+    _send_byte(0x00);
+ 80028de:	2000      	movs	r0, #0
+ 80028e0:	f7ff ff6e 	bl	80027c0 <_send_byte>
+    delay_ms(3);     // measured: ~2.9ms
+ 80028e4:	2003      	movs	r0, #3
+ 80028e6:	f001 f81d 	bl	8003924 <delay_ms>
+}
+ 80028ea:	e8bd 4008 	ldmia.w	sp!, {r3, lr}
+    _flush_rx();
+ 80028ee:	f7ff bf97 	b.w	8002820 <_flush_rx>
+
+080028f2 <ae_send_idle>:
+{
+ 80028f2:	b508      	push	{r3, lr}
+    ae_wake();
+ 80028f4:	f7ff fff2 	bl	80028dc <ae_wake>
+}
+ 80028f8:	e8bd 4008 	ldmia.w	sp!, {r3, lr}
+    _send_bits(IOFLAG_IDLE);
+ 80028fc:	20bb      	movs	r0, #187	; 0xbb
+ 80028fe:	f7ff bf75 	b.w	80027ec <_send_bits>
+	...
+
+08002904 <ae_read_response>:
+{
+ 8002904:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+    int max_expect = (max_len+1) * 8;
+ 8002908:	3101      	adds	r1, #1
+    uint8_t raw[max_expect];
+ 800290a:	466b      	mov	r3, sp
+ 800290c:	eba3 03c1 	sub.w	r3, r3, r1, lsl #3
+{
+ 8002910:	af00      	add	r7, sp, #0
+ 8002912:	4606      	mov	r6, r0
+    uint8_t raw[max_expect];
+ 8002914:	469d      	mov	sp, r3
+    _send_bits(IOFLAG_TX);
+ 8002916:	2088      	movs	r0, #136	; 0x88
+    int max_expect = (max_len+1) * 8;
+ 8002918:	00cd      	lsls	r5, r1, #3
+    _send_bits(IOFLAG_TX);
+ 800291a:	f7ff ff67 	bl	80027ec <_send_bits>
+    _flush_rx();
+ 800291e:	f7ff ff7f 	bl	8002820 <_flush_rx>
+    int actual = 0;
+ 8002922:	2200      	movs	r2, #0
+    while(!(MY_UART->ISR & UART_FLAG_RXNE) && !(MY_UART->ISR & UART_FLAG_RTOF)) {
+ 8002924:	4829      	ldr	r0, [pc, #164]	; (80029cc <ae_read_response+0xc8>)
+    uint8_t raw[max_expect];
+ 8002926:	466c      	mov	r4, sp
+    for(uint8_t *p = raw; ; actual++) {
+ 8002928:	4669      	mov	r1, sp
+    SysTick->VAL = 0;
+ 800292a:	f04f 2ce0 	mov.w	ip, #3758153728	; 0xe000e000
+ 800292e:	4696      	mov	lr, r2
+ 8002930:	f8cc e018 	str.w	lr, [ip, #24]
+    while(!(MY_UART->ISR & UART_FLAG_RXNE) && !(MY_UART->ISR & UART_FLAG_RTOF)) {
+ 8002934:	2305      	movs	r3, #5
+ 8002936:	f8d0 801c 	ldr.w	r8, [r0, #28]
+ 800293a:	f018 0f20 	tst.w	r8, #32
+ 800293e:	d104      	bne.n	800294a <ae_read_response+0x46>
+ 8002940:	f8d0 801c 	ldr.w	r8, [r0, #28]
+ 8002944:	f418 6f00 	tst.w	r8, #2048	; 0x800
+ 8002948:	d008      	beq.n	800295c <ae_read_response+0x58>
+    if(MY_UART->ISR & UART_FLAG_RXNE) {
+ 800294a:	69c3      	ldr	r3, [r0, #28]
+ 800294c:	069b      	lsls	r3, r3, #26
+ 800294e:	d52e      	bpl.n	80029ae <ae_read_response+0xaa>
+        return MY_UART->RDR & 0x7f;
+ 8002950:	8c83      	ldrh	r3, [r0, #36]	; 0x24
+        if(actual < max_expect) {
+ 8002952:	42aa      	cmp	r2, r5
+        return MY_UART->RDR & 0x7f;
+ 8002954:	b29b      	uxth	r3, r3
+        if(actual < max_expect) {
+ 8002956:	db34      	blt.n	80029c2 <ae_read_response+0xbe>
+    for(uint8_t *p = raw; ; actual++) {
+ 8002958:	3201      	adds	r2, #1
+ 800295a:	e7e9      	b.n	8002930 <ae_read_response+0x2c>
+        if(SysTick->CTRL & SysTick_CTRL_COUNTFLAG_Msk) {
+ 800295c:	f8dc 8010 	ldr.w	r8, [ip, #16]
+ 8002960:	f418 3f80 	tst.w	r8, #65536	; 0x10000
+ 8002964:	d0e7      	beq.n	8002936 <ae_read_response+0x32>
+            if(ticks >= 5) {
+ 8002966:	3b01      	subs	r3, #1
+ 8002968:	d1e5      	bne.n	8002936 <ae_read_response+0x32>
+    actual &= ~7;
+ 800296a:	f022 0107 	bic.w	r1, r2, #7
+    while(from_len > 0) {
+ 800296e:	3d08      	subs	r5, #8
+ 8002970:	4425      	add	r5, r4
+ 8002972:	4623      	mov	r3, r4
+ 8002974:	4421      	add	r1, r4
+ 8002976:	1ac8      	subs	r0, r1, r3
+ 8002978:	2800      	cmp	r0, #0
+ 800297a:	dd14      	ble.n	80029a6 <ae_read_response+0xa2>
+ 800297c:	f103 3cff 	add.w	ip, r3, #4294967295	; 0xffffffff
+        uint8_t rv = 0, mask = 0x1;
+ 8002980:	2001      	movs	r0, #1
+ 8002982:	2400      	movs	r4, #0
+        for(int i=0; i<8; i++, mask <<= 1) {
+ 8002984:	f103 0e07 	add.w	lr, r3, #7
+            if(from[i] == BIT1) {
+ 8002988:	f81c 8f01 	ldrb.w	r8, [ip, #1]!
+ 800298c:	f1b8 0f7f 	cmp.w	r8, #127	; 0x7f
+                rv |= mask;
+ 8002990:	bf08      	it	eq
+ 8002992:	4304      	orreq	r4, r0
+        for(int i=0; i<8; i++, mask <<= 1) {
+ 8002994:	0040      	lsls	r0, r0, #1
+ 8002996:	45f4      	cmp	ip, lr
+ 8002998:	b2c0      	uxtb	r0, r0
+ 800299a:	d1f5      	bne.n	8002988 <ae_read_response+0x84>
+        from += 8;
+ 800299c:	3308      	adds	r3, #8
+        if(max_into <= 0) break;
+ 800299e:	42ab      	cmp	r3, r5
+        *(into++) = rv;
+ 80029a0:	f806 4b01 	strb.w	r4, [r6], #1
+        if(max_into <= 0) break;
+ 80029a4:	d1e7      	bne.n	8002976 <ae_read_response+0x72>
+    return actual / 8;
+ 80029a6:	10d0      	asrs	r0, r2, #3
+}
+ 80029a8:	46bd      	mov	sp, r7
+ 80029aa:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+    if(MY_UART->ISR & UART_FLAG_RTOF) {
+ 80029ae:	69c3      	ldr	r3, [r0, #28]
+ 80029b0:	051b      	lsls	r3, r3, #20
+ 80029b2:	d503      	bpl.n	80029bc <ae_read_response+0xb8>
+        MY_UART->ICR = USART_ICR_RTOCF;
+ 80029b4:	f44f 6300 	mov.w	r3, #2048	; 0x800
+ 80029b8:	6203      	str	r3, [r0, #32]
+        if(ch < 0) {
+ 80029ba:	e7d6      	b.n	800296a <ae_read_response+0x66>
+    INCONSISTENT("rxf");
+ 80029bc:	4804      	ldr	r0, [pc, #16]	; (80029d0 <ae_read_response+0xcc>)
+ 80029be:	f7fe f843 	bl	8000a48 <fatal_error>
+            *(p++) = ch;
+ 80029c2:	f003 037f 	and.w	r3, r3, #127	; 0x7f
+ 80029c6:	f801 3b01 	strb.w	r3, [r1], #1
+ 80029ca:	e7c5      	b.n	8002958 <ae_read_response+0x54>
+ 80029cc:	40004c00 	.word	0x40004c00
+ 80029d0:	0800d760 	.word	0x0800d760
+
+080029d4 <ae_reset_chip>:
+    if(ae_chip_is_setup == AE_CHIP_IS_SETUP) {
+ 80029d4:	4b04      	ldr	r3, [pc, #16]	; (80029e8 <ae_reset_chip+0x14>)
+ 80029d6:	681a      	ldr	r2, [r3, #0]
+ 80029d8:	4b04      	ldr	r3, [pc, #16]	; (80029ec <ae_reset_chip+0x18>)
+ 80029da:	429a      	cmp	r2, r3
+ 80029dc:	d102      	bne.n	80029e4 <ae_reset_chip+0x10>
+        _send_bits(IOFLAG_SLEEP);
+ 80029de:	20cc      	movs	r0, #204	; 0xcc
+ 80029e0:	f7ff bf04 	b.w	80027ec <_send_bits>
+}
+ 80029e4:	4770      	bx	lr
+ 80029e6:	bf00      	nop
+ 80029e8:	2009e1bc 	.word	0x2009e1bc
+ 80029ec:	35d25d63 	.word	0x35d25d63
+
+080029f0 <ae_setup>:
+    __HAL_RCC_UART4_CLK_ENABLE();
+ 80029f0:	4b13      	ldr	r3, [pc, #76]	; (8002a40 <ae_setup+0x50>)
+ 80029f2:	6d9a      	ldr	r2, [r3, #88]	; 0x58
+ 80029f4:	f442 2200 	orr.w	r2, r2, #524288	; 0x80000
+ 80029f8:	659a      	str	r2, [r3, #88]	; 0x58
+ 80029fa:	6d9b      	ldr	r3, [r3, #88]	; 0x58
+{
+ 80029fc:	b082      	sub	sp, #8
+    __HAL_RCC_UART4_CLK_ENABLE();
+ 80029fe:	f403 2300 	and.w	r3, r3, #524288	; 0x80000
+ 8002a02:	9301      	str	r3, [sp, #4]
+ 8002a04:	9b01      	ldr	r3, [sp, #4]
+    MY_UART->CR1 = 0;
+ 8002a06:	4b0f      	ldr	r3, [pc, #60]	; (8002a44 <ae_setup+0x54>)
+ 8002a08:	2200      	movs	r2, #0
+ 8002a0a:	601a      	str	r2, [r3, #0]
+    MY_UART->CR1 = 0x1000002d & ~(0
+ 8002a0c:	4a0e      	ldr	r2, [pc, #56]	; (8002a48 <ae_setup+0x58>)
+ 8002a0e:	601a      	str	r2, [r3, #0]
+    MY_UART->RTOR = 24;                  // timeout in bit periods: 3 chars or so
+ 8002a10:	2218      	movs	r2, #24
+ 8002a12:	615a      	str	r2, [r3, #20]
+    MY_UART->CR2 = USART_CR2_RTOEN;      // rx timeout enable
+ 8002a14:	f44f 0200 	mov.w	r2, #8388608	; 0x800000
+ 8002a18:	605a      	str	r2, [r3, #4]
+    MY_UART->CR3 = USART_CR3_HDSEL | USART_CR3_ONEBIT;
+ 8002a1a:	f640 0208 	movw	r2, #2056	; 0x808
+ 8002a1e:	609a      	str	r2, [r3, #8]
+    MY_UART->BRR = 521;                 // 230400 bps @ 120 Mhz SYSCLK
+ 8002a20:	f240 2209 	movw	r2, #521	; 0x209
+ 8002a24:	60da      	str	r2, [r3, #12]
+    MY_UART->ICR = USART_ICR_RTOCF;
+ 8002a26:	f44f 6200 	mov.w	r2, #2048	; 0x800
+ 8002a2a:	621a      	str	r2, [r3, #32]
+    MY_UART->CR1 |= USART_CR1_UE;
+ 8002a2c:	681a      	ldr	r2, [r3, #0]
+ 8002a2e:	f042 0201 	orr.w	r2, r2, #1
+ 8002a32:	601a      	str	r2, [r3, #0]
+    ae_chip_is_setup = AE_CHIP_IS_SETUP;
+ 8002a34:	4b05      	ldr	r3, [pc, #20]	; (8002a4c <ae_setup+0x5c>)
+ 8002a36:	4a06      	ldr	r2, [pc, #24]	; (8002a50 <ae_setup+0x60>)
+ 8002a38:	601a      	str	r2, [r3, #0]
+}
+ 8002a3a:	b002      	add	sp, #8
+ 8002a3c:	4770      	bx	lr
+ 8002a3e:	bf00      	nop
+ 8002a40:	40021000 	.word	0x40021000
+ 8002a44:	40004c00 	.word	0x40004c00
+ 8002a48:	1000002c 	.word	0x1000002c
+ 8002a4c:	2009e1bc 	.word	0x2009e1bc
+ 8002a50:	35d25d63 	.word	0x35d25d63
+
+08002a54 <ae_keep_alive>:
+	ae_send_idle();
+ 8002a54:	f7ff bf4d 	b.w	80028f2 <ae_send_idle>
+
+08002a58 <ae_read1>:
+// Read a one-byte status/error code response from chip. It's wrapped as 4 bytes: 
+//	(len=4) (value) (crc16) (crc16)
+//
+	int
+ae_read1(void)
+{
+ 8002a58:	b513      	push	{r0, r1, r4, lr}
+ 8002a5a:	2408      	movs	r4, #8
+	uint8_t msg[4];
+
+	for(int retry=7; retry >= 0; retry--) {
+        // tell it we want to read a response, read it, and deserialize
+        int rv = ae_read_response(msg, 4);
+ 8002a5c:	2104      	movs	r1, #4
+ 8002a5e:	eb0d 0001 	add.w	r0, sp, r1
+ 8002a62:	f7ff ff4f 	bl	8002904 <ae_read_response>
+
+        if(rv == 0) {
+ 8002a66:	4601      	mov	r1, r0
+ 8002a68:	b938      	cbnz	r0, 8002a7a <ae_read1+0x22>
+            // nothing heard, it's probably still processing
+            ERR("not rdy");
+            STATS(not_ready++);
+
+            delay_ms(5);
+ 8002a6a:	2005      	movs	r0, #5
+ 8002a6c:	f000 ff5a 	bl	8003924 <delay_ms>
+	for(int retry=7; retry >= 0; retry--) {
+ 8002a70:	3c01      	subs	r4, #1
+ 8002a72:	d1f3      	bne.n	8002a5c <ae_read1+0x4>
+	try_again:
+        STATS(l1_retry++);
+	}
+
+	// fail.
+	return -1;
+ 8002a74:	f04f 30ff 	mov.w	r0, #4294967295	; 0xffffffff
+ 8002a78:	e008      	b.n	8002a8c <ae_read1+0x34>
+        if(rv != 4) {
+ 8002a7a:	2804      	cmp	r0, #4
+ 8002a7c:	d1f8      	bne.n	8002a70 <ae_read1+0x18>
+		if(!ae_check_crc(msg, 4)) {
+ 8002a7e:	a801      	add	r0, sp, #4
+ 8002a80:	f7ff ff0d 	bl	800289e <ae_check_crc>
+ 8002a84:	2800      	cmp	r0, #0
+ 8002a86:	d0f3      	beq.n	8002a70 <ae_read1+0x18>
+		return msg[1];
+ 8002a88:	f89d 0005 	ldrb.w	r0, [sp, #5]
+}
+ 8002a8c:	b002      	add	sp, #8
+ 8002a8e:	bd10      	pop	{r4, pc}
+
+08002a90 <ae_read_n>:
+// Read and check CRC over N bytes, wrapped in 3-bytes of framing overhead.
+// Return -1 for timeout, zero for normal, and one-byte error code otherwise.
+//
+	int
+ae_read_n(uint8_t len, uint8_t *body)
+{
+ 8002a90:	e92d 43f8 	stmdb	sp!, {r3, r4, r5, r6, r7, r8, r9, lr}
+    uint8_t tmp[1+len+2];
+ 8002a94:	f100 030a 	add.w	r3, r0, #10
+ 8002a98:	f403 73fc 	and.w	r3, r3, #504	; 0x1f8
+{
+ 8002a9c:	af00      	add	r7, sp, #0
+    uint8_t tmp[1+len+2];
+ 8002a9e:	ebad 0d03 	sub.w	sp, sp, r3
+{
+ 8002aa2:	460d      	mov	r5, r1
+    uint8_t tmp[1+len+2];
+ 8002aa4:	1cc6      	adds	r6, r0, #3
+ 8002aa6:	46e8      	mov	r8, sp
+ 8002aa8:	f04f 0908 	mov.w	r9, #8
+
+	for(int retry=7; retry >= 0; retry--) {
+
+        int actual = ae_read_response(tmp, len+3);
+ 8002aac:	4631      	mov	r1, r6
+ 8002aae:	4640      	mov	r0, r8
+ 8002ab0:	f7ff ff28 	bl	8002904 <ae_read_response>
+        if(actual < 4) {
+ 8002ab4:	2803      	cmp	r0, #3
+        int actual = ae_read_response(tmp, len+3);
+ 8002ab6:	4604      	mov	r4, r0
+        if(actual < 4) {
+ 8002ab8:	dc0b      	bgt.n	8002ad2 <ae_read_n+0x42>
+
+            if(actual == 0) {
+ 8002aba:	b910      	cbnz	r0, 8002ac2 <ae_read_n+0x32>
+                // nothing heard, it's probably still processing
+                delay_ms(5);
+ 8002abc:	2005      	movs	r0, #5
+ 8002abe:	f000 ff31 	bl	8003924 <delay_ms>
+
+		return 0;
+
+	try_again:
+        STATS(ln_retry++);
+        ae_wake();
+ 8002ac2:	f7ff ff0b 	bl	80028dc <ae_wake>
+	for(int retry=7; retry >= 0; retry--) {
+ 8002ac6:	f1b9 0901 	subs.w	r9, r9, #1
+ 8002aca:	d1ef      	bne.n	8002aac <ae_read_n+0x1c>
+	}
+
+	return -1;
+ 8002acc:	f04f 30ff 	mov.w	r0, #4294967295	; 0xffffffff
+ 8002ad0:	e007      	b.n	8002ae2 <ae_read_n+0x52>
+        uint8_t resp_len = tmp[0];
+ 8002ad2:	f898 3000 	ldrb.w	r3, [r8]
+		if(resp_len != (len + 3)) {
+ 8002ad6:	42b3      	cmp	r3, r6
+ 8002ad8:	d006      	beq.n	8002ae8 <ae_read_n+0x58>
+            if(resp_len == 4) {
+ 8002ada:	2b04      	cmp	r3, #4
+ 8002adc:	d1f1      	bne.n	8002ac2 <ae_read_n+0x32>
+                return tmp[1];
+ 8002ade:	f898 0001 	ldrb.w	r0, [r8, #1]
+}
+ 8002ae2:	46bd      	mov	sp, r7
+ 8002ae4:	e8bd 83f8 	ldmia.w	sp!, {r3, r4, r5, r6, r7, r8, r9, pc}
+		if(!ae_check_crc(tmp, actual)) {
+ 8002ae8:	b2c1      	uxtb	r1, r0
+ 8002aea:	4640      	mov	r0, r8
+ 8002aec:	f7ff fed7 	bl	800289e <ae_check_crc>
+ 8002af0:	2800      	cmp	r0, #0
+ 8002af2:	d0e6      	beq.n	8002ac2 <ae_read_n+0x32>
+        memcpy(body, tmp+1, actual-3);
+ 8002af4:	1ee2      	subs	r2, r4, #3
+ 8002af6:	f108 0101 	add.w	r1, r8, #1
+ 8002afa:	4628      	mov	r0, r5
+ 8002afc:	f00a fdc4 	bl	800d688 <memcpy>
+		return 0;
+ 8002b00:	2000      	movs	r0, #0
+ 8002b02:	e7ee      	b.n	8002ae2 <ae_read_n+0x52>
+
+08002b04 <ae_send_n>:
+
+// ae_send_n()
+//
+	void
+ae_send_n(aeopcode_t opcode, uint8_t p1, uint16_t p2, const uint8_t *data, uint8_t data_len) 
+{
+ 8002b04:	b530      	push	{r4, r5, lr}
+ 8002b06:	b085      	sub	sp, #20
+ 8002b08:	461d      	mov	r5, r3
+ 8002b0a:	f89d 4020 	ldrb.w	r4, [sp, #32]
+		uint8_t	framed_len;
+		uint8_t	op;
+		uint8_t	p1;
+		uint8_t	p2_lsb;
+		uint8_t	p2_msb;
+	} known = { 
+ 8002b0e:	f88d 200c 	strb.w	r2, [sp, #12]
+ 8002b12:	2377      	movs	r3, #119	; 0x77
+ 8002b14:	0a12      	lsrs	r2, r2, #8
+ 8002b16:	f88d 3008 	strb.w	r3, [sp, #8]
+        .ioflag = IOFLAG_CMD,
+		.framed_len = (data_len + 7),		// 7 = (1 len) + (4 bytes of msg) + (2 crc)
+ 8002b1a:	1de3      	adds	r3, r4, #7
+	} known = { 
+ 8002b1c:	f88d 3009 	strb.w	r3, [sp, #9]
+ 8002b20:	f88d 200d 	strb.w	r2, [sp, #13]
+ 8002b24:	f88d 000a 	strb.w	r0, [sp, #10]
+ 8002b28:	f88d 100b 	strb.w	r1, [sp, #11]
+    STATS(last_op = opcode);
+    STATS(last_p1 = p1);
+    STATS(last_p2 = p2);
+
+    // important to wake chip at this point.
+    ae_wake();
+ 8002b2c:	f7ff fed6 	bl	80028dc <ae_wake>
+
+    _send_serialized((const uint8_t *)&known, sizeof(known));
+ 8002b30:	2106      	movs	r1, #6
+ 8002b32:	a802      	add	r0, sp, #8
+ 8002b34:	f7ff fe69 	bl	800280a <_send_serialized>
+
+	// CRC will start from frame_len onwards
+	uint8_t crc[2] = {0, 0};
+ 8002b38:	2300      	movs	r3, #0
+	crc16_chain(sizeof(known)-1, &known.framed_len, crc);
+ 8002b3a:	aa01      	add	r2, sp, #4
+ 8002b3c:	f10d 0109 	add.w	r1, sp, #9
+ 8002b40:	2005      	movs	r0, #5
+	uint8_t crc[2] = {0, 0};
+ 8002b42:	f8ad 3004 	strh.w	r3, [sp, #4]
+	crc16_chain(sizeof(known)-1, &known.framed_len, crc);
+ 8002b46:	f7ff fe87 	bl	8002858 <crc16_chain>
+
+	// insert a variable-length body area (sometimes)
+	if(data_len) {
+ 8002b4a:	b144      	cbz	r4, 8002b5e <ae_send_n+0x5a>
+        _send_serialized(data, data_len);
+ 8002b4c:	4621      	mov	r1, r4
+ 8002b4e:	4628      	mov	r0, r5
+ 8002b50:	f7ff fe5b 	bl	800280a <_send_serialized>
+		
+		crc16_chain(data_len, data, crc);
+ 8002b54:	aa01      	add	r2, sp, #4
+ 8002b56:	4629      	mov	r1, r5
+ 8002b58:	4620      	mov	r0, r4
+ 8002b5a:	f7ff fe7d 	bl	8002858 <crc16_chain>
+	}
+
+	// send final CRC bytes
+    _send_serialized(crc, 2);
+ 8002b5e:	2102      	movs	r1, #2
+ 8002b60:	a801      	add	r0, sp, #4
+ 8002b62:	f7ff fe52 	bl	800280a <_send_serialized>
+}
+ 8002b66:	b005      	add	sp, #20
+ 8002b68:	bd30      	pop	{r4, r5, pc}
+
+08002b6a <ae_send>:
+{
+ 8002b6a:	b507      	push	{r0, r1, r2, lr}
+	ae_send_n(opcode, p1, p2, NULL, 0);
+ 8002b6c:	2300      	movs	r3, #0
+ 8002b6e:	9300      	str	r3, [sp, #0]
+ 8002b70:	f7ff ffc8 	bl	8002b04 <ae_send_n>
+}
+ 8002b74:	b003      	add	sp, #12
+ 8002b76:	f85d fb04 	ldr.w	pc, [sp], #4
+
+08002b7a <ae_get_info>:
+//
+// Do Info(p1=2) command, and return result.
+//
+	uint16_t
+ae_get_info(void)
+{
+ 8002b7a:	b507      	push	{r0, r1, r2, lr}
+	// not doing error checking here
+	ae_send(OP_Info, 0x2, 0);
+ 8002b7c:	2200      	movs	r2, #0
+ 8002b7e:	2102      	movs	r1, #2
+ 8002b80:	2030      	movs	r0, #48	; 0x30
+ 8002b82:	f7ff fff2 	bl	8002b6a <ae_send>
+
+	// note: always returns 4 bytes, but most are garbage and unused.
+	uint8_t tmp[4];
+	ae_read_n(4, tmp);
+ 8002b86:	a901      	add	r1, sp, #4
+ 8002b88:	2004      	movs	r0, #4
+ 8002b8a:	f7ff ff81 	bl	8002a90 <ae_read_n>
+
+	return (tmp[0] << 8) | tmp[1];
+ 8002b8e:	f8bd 0004 	ldrh.w	r0, [sp, #4]
+ 8002b92:	ba40      	rev16	r0, r0
+}
+ 8002b94:	b280      	uxth	r0, r0
+ 8002b96:	b003      	add	sp, #12
+ 8002b98:	f85d fb04 	ldr.w	pc, [sp], #4
+
+08002b9c <ae_load_nonce>:
+// Load Tempkey with a specific value. Resulting Tempkey cannot be
+// used with many commands/keys, but is needed for signing.
+//
+	int
+ae_load_nonce(const uint8_t nonce[32])
+{
+ 8002b9c:	b507      	push	{r0, r1, r2, lr}
+    // p1=3
+	ae_send_n(OP_Nonce, 3, 0, nonce, 32);          // 608a ok
+ 8002b9e:	2220      	movs	r2, #32
+{
+ 8002ba0:	4603      	mov	r3, r0
+	ae_send_n(OP_Nonce, 3, 0, nonce, 32);          // 608a ok
+ 8002ba2:	9200      	str	r2, [sp, #0]
+ 8002ba4:	2103      	movs	r1, #3
+ 8002ba6:	2200      	movs	r2, #0
+ 8002ba8:	2016      	movs	r0, #22
+ 8002baa:	f7ff ffab 	bl	8002b04 <ae_send_n>
+
+    return ae_read1();
+}
+ 8002bae:	b003      	add	sp, #12
+ 8002bb0:	f85d eb04 	ldr.w	lr, [sp], #4
+    return ae_read1();
+ 8002bb4:	f7ff bf50 	b.w	8002a58 <ae_read1>
+
+08002bb8 <ae_load_msgdigest>:
+// Load 32bytes of message digest  with a specific value.
+// Needed for signing.
+//
+	int
+ae_load_msgdigest(const uint8_t md[32])
+{
+ 8002bb8:	b507      	push	{r0, r1, r2, lr}
+	ae_send_n(OP_Nonce, (1<<6) | 3, 0, md, 32);
+ 8002bba:	2220      	movs	r2, #32
+{
+ 8002bbc:	4603      	mov	r3, r0
+	ae_send_n(OP_Nonce, (1<<6) | 3, 0, md, 32);
+ 8002bbe:	9200      	str	r2, [sp, #0]
+ 8002bc0:	2143      	movs	r1, #67	; 0x43
+ 8002bc2:	2200      	movs	r2, #0
+ 8002bc4:	2016      	movs	r0, #22
+ 8002bc6:	f7ff ff9d 	bl	8002b04 <ae_send_n>
+
+    return ae_read1();
+}
+ 8002bca:	b003      	add	sp, #12
+ 8002bcc:	f85d eb04 	ldr.w	lr, [sp], #4
+    return ae_read1();
+ 8002bd0:	f7ff bf42 	b.w	8002a58 <ae_read1>
+
+08002bd4 <ae_pick_nonce>:
+// Load Tempkey with a nonce value that we both know, but
+// is random and we both know is random! Tricky!
+//
+	int
+ae_pick_nonce(const uint8_t num_in[20], uint8_t tempkey[32])
+{
+ 8002bd4:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8002bd6:	b09f      	sub	sp, #124	; 0x7c
+	// We provide some 20 bytes of randomness to chip
+	// The chip must provide 32-bytes of random-ness,
+	// so no choice in args to OP.Nonce here (due to ReqRandom).
+	ae_send_n(OP_Nonce, 0, 0, num_in, 20);
+ 8002bd8:	2200      	movs	r2, #0
+ 8002bda:	2714      	movs	r7, #20
+ 8002bdc:	4603      	mov	r3, r0
+{
+ 8002bde:	4605      	mov	r5, r0
+ 8002be0:	460e      	mov	r6, r1
+	ae_send_n(OP_Nonce, 0, 0, num_in, 20);
+ 8002be2:	2016      	movs	r0, #22
+ 8002be4:	4611      	mov	r1, r2
+ 8002be6:	9700      	str	r7, [sp, #0]
+ 8002be8:	f7ff ff8c 	bl	8002b04 <ae_send_n>
+
+	// Nonce command returns the RNG result, but not contents of TempKey
+	uint8_t randout[32];
+	int rv = ae_read_n(32, randout);
+ 8002bec:	a903      	add	r1, sp, #12
+ 8002bee:	2020      	movs	r0, #32
+ 8002bf0:	f7ff ff4e 	bl	8002a90 <ae_read_n>
+	RET_IF_BAD(rv);
+ 8002bf4:	4604      	mov	r4, r0
+ 8002bf6:	b9e0      	cbnz	r0, 8002c32 <ae_pick_nonce+0x5e>
+	//
+	//		return sha256(rndout + num_in + b'\x16\0\0').digest()
+	//
+	SHA256_CTX ctx;
+
+    sha256_init(&ctx);
+ 8002bf8:	a80b      	add	r0, sp, #44	; 0x2c
+ 8002bfa:	f002 fc79 	bl	80054f0 <sha256_init>
+    sha256_update(&ctx, randout, 32);
+ 8002bfe:	2220      	movs	r2, #32
+ 8002c00:	a903      	add	r1, sp, #12
+ 8002c02:	a80b      	add	r0, sp, #44	; 0x2c
+ 8002c04:	f002 fc82 	bl	800550c <sha256_update>
+    sha256_update(&ctx, num_in, 20);
+ 8002c08:	463a      	mov	r2, r7
+ 8002c0a:	4629      	mov	r1, r5
+ 8002c0c:	a80b      	add	r0, sp, #44	; 0x2c
+ 8002c0e:	f002 fc7d 	bl	800550c <sha256_update>
+	const uint8_t fixed[3] = { 0x16, 0, 0 };
+ 8002c12:	4b09      	ldr	r3, [pc, #36]	; (8002c38 <ae_pick_nonce+0x64>)
+ 8002c14:	881a      	ldrh	r2, [r3, #0]
+ 8002c16:	f8ad 2008 	strh.w	r2, [sp, #8]
+ 8002c1a:	789b      	ldrb	r3, [r3, #2]
+ 8002c1c:	f88d 300a 	strb.w	r3, [sp, #10]
+    sha256_update(&ctx, fixed, 3);
+ 8002c20:	a902      	add	r1, sp, #8
+ 8002c22:	a80b      	add	r0, sp, #44	; 0x2c
+ 8002c24:	2203      	movs	r2, #3
+ 8002c26:	f002 fc71 	bl	800550c <sha256_update>
+
+    sha256_final(&ctx, tempkey);
+ 8002c2a:	4631      	mov	r1, r6
+ 8002c2c:	a80b      	add	r0, sp, #44	; 0x2c
+ 8002c2e:	f002 fcb3 	bl	8005598 <sha256_final>
+
+	return 0;
+}
+ 8002c32:	4620      	mov	r0, r4
+ 8002c34:	b01f      	add	sp, #124	; 0x7c
+ 8002c36:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8002c38:	0800e6fa 	.word	0x0800e6fa
+
+08002c3c <ae_is_correct_tempkey>:
+// Check that TempKey is holding what we think it does. Uses the MAC
+// command over contents of Tempkey and our shared secret.
+//
+    bool
+ae_is_correct_tempkey(const uint8_t expected_tempkey[32])
+{
+ 8002c3c:	b570      	push	{r4, r5, r6, lr}
+    const uint8_t mode =   (1<<6)     // include full serial number
+                         | (0<<2)     // TempKey.SourceFlag == 0 == 'rand'
+                         | (0<<1)     // first 32 bytes are the shared secret
+                         | (1<<0);    // second 32 bytes are tempkey
+
+	ae_send(OP_MAC, mode, KEYNUM_pairing);
+ 8002c3e:	2141      	movs	r1, #65	; 0x41
+{
+ 8002c40:	b0a8      	sub	sp, #160	; 0xa0
+ 8002c42:	4604      	mov	r4, r0
+	ae_send(OP_MAC, mode, KEYNUM_pairing);
+ 8002c44:	2201      	movs	r2, #1
+ 8002c46:	2008      	movs	r0, #8
+ 8002c48:	f7ff ff8f 	bl	8002b6a <ae_send>
+
+    // read chip's answer
+	uint8_t resp[32];
+	int rv = ae_read_n(32, resp);
+ 8002c4c:	a905      	add	r1, sp, #20
+ 8002c4e:	2020      	movs	r0, #32
+ 8002c50:	f7ff ff1e 	bl	8002a90 <ae_read_n>
+    if(rv) return false;
+ 8002c54:	2800      	cmp	r0, #0
+ 8002c56:	d135      	bne.n	8002cc4 <ae_is_correct_tempkey+0x88>
+	ae_send_idle();
+ 8002c58:	f7ff fe4b 	bl	80028f2 <ae_send_idle>
+    ae_keep_alive();
+
+    // Duplicate the hash process, and then compare.
+	SHA256_CTX ctx;
+
+    sha256_init(&ctx);
+ 8002c5c:	a815      	add	r0, sp, #84	; 0x54
+ 8002c5e:	f002 fc47 	bl	80054f0 <sha256_init>
+    sha256_update(&ctx, rom_secrets->pairing_secret, 32);
+ 8002c62:	4919      	ldr	r1, [pc, #100]	; (8002cc8 <ae_is_correct_tempkey+0x8c>)
+ 8002c64:	2220      	movs	r2, #32
+ 8002c66:	a815      	add	r0, sp, #84	; 0x54
+ 8002c68:	f002 fc50 	bl	800550c <sha256_update>
+    sha256_update(&ctx, expected_tempkey, 32);
+ 8002c6c:	2220      	movs	r2, #32
+ 8002c6e:	4621      	mov	r1, r4
+ 8002c70:	a815      	add	r0, sp, #84	; 0x54
+ 8002c72:	f002 fc4b 	bl	800550c <sha256_update>
+
+	const uint8_t fixed[16] = { OP_MAC, mode, KEYNUM_pairing, 0x0,
+ 8002c76:	4b15      	ldr	r3, [pc, #84]	; (8002ccc <ae_is_correct_tempkey+0x90>)
+ 8002c78:	aa01      	add	r2, sp, #4
+ 8002c7a:	f103 0610 	add.w	r6, r3, #16
+ 8002c7e:	4615      	mov	r5, r2
+ 8002c80:	6818      	ldr	r0, [r3, #0]
+ 8002c82:	6859      	ldr	r1, [r3, #4]
+ 8002c84:	4614      	mov	r4, r2
+ 8002c86:	c403      	stmia	r4!, {r0, r1}
+ 8002c88:	3308      	adds	r3, #8
+ 8002c8a:	42b3      	cmp	r3, r6
+ 8002c8c:	4622      	mov	r2, r4
+ 8002c8e:	d1f7      	bne.n	8002c80 <ae_is_correct_tempkey+0x44>
+                                    0,0,0,0, 0,0,0,0,       // eight zeros
+                                    0,0,0,                  // three zeros
+                                    0xEE };
+    sha256_update(&ctx, fixed, sizeof(fixed));
+ 8002c90:	2210      	movs	r2, #16
+ 8002c92:	4629      	mov	r1, r5
+ 8002c94:	a815      	add	r0, sp, #84	; 0x54
+ 8002c96:	f002 fc39 	bl	800550c <sha256_update>
+
+    sha256_update(&ctx, ((const uint8_t *)rom_secrets->ae_serial_number)+4, 4);
+ 8002c9a:	490d      	ldr	r1, [pc, #52]	; (8002cd0 <ae_is_correct_tempkey+0x94>)
+ 8002c9c:	2204      	movs	r2, #4
+ 8002c9e:	a815      	add	r0, sp, #84	; 0x54
+ 8002ca0:	f002 fc34 	bl	800550c <sha256_update>
+    sha256_update(&ctx, ((const uint8_t *)rom_secrets->ae_serial_number)+0, 4);
+ 8002ca4:	2204      	movs	r2, #4
+ 8002ca6:	490b      	ldr	r1, [pc, #44]	; (8002cd4 <ae_is_correct_tempkey+0x98>)
+ 8002ca8:	a815      	add	r0, sp, #84	; 0x54
+ 8002caa:	f002 fc2f 	bl	800550c <sha256_update>
+	// this verifies no problem.
+	ASSERT(ctx.datalen + (ctx.bitlen/8) == 32+32+1+1+2+8+3+1+4+2+2);        // == 88
+#endif
+
+    uint8_t         actual[32];
+    sha256_final(&ctx, actual);
+ 8002cae:	a90d      	add	r1, sp, #52	; 0x34
+ 8002cb0:	a815      	add	r0, sp, #84	; 0x54
+ 8002cb2:	f002 fc71 	bl	8005598 <sha256_final>
+
+    return check_equal(actual, resp, 32);
+ 8002cb6:	2220      	movs	r2, #32
+ 8002cb8:	a905      	add	r1, sp, #20
+ 8002cba:	a80d      	add	r0, sp, #52	; 0x34
+ 8002cbc:	f7ff fd0f 	bl	80026de <check_equal>
+}
+ 8002cc0:	b028      	add	sp, #160	; 0xa0
+ 8002cc2:	bd70      	pop	{r4, r5, r6, pc}
+    if(rv) return false;
+ 8002cc4:	2000      	movs	r0, #0
+ 8002cc6:	e7fb      	b.n	8002cc0 <ae_is_correct_tempkey+0x84>
+ 8002cc8:	0801c000 	.word	0x0801c000
+ 8002ccc:	0800e6fd 	.word	0x0800e6fd
+ 8002cd0:	0801c044 	.word	0x0801c044
+ 8002cd4:	0801c040 	.word	0x0801c040
+
+08002cd8 <ae_checkmac>:
+// inside the 508a/608a, like use of a specific key, but not for us to
+// authenticate the 508a/608a or its contents/state.
+//
+    int
+ae_checkmac(uint8_t keynum, const uint8_t secret[32])
+{
+ 8002cd8:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 8002cdc:	b0c2      	sub	sp, #264	; 0x108
+
+	// Since this is part of the hash, we want random bytes
+	// for our "other data". Also a number for "numin" of nonce
+	uint8_t od[32], numin[20];
+
+	rng_buffer(od, sizeof(od));
+ 8002cde:	ad0b      	add	r5, sp, #44	; 0x2c
+{
+ 8002ce0:	4607      	mov	r7, r0
+ 8002ce2:	460e      	mov	r6, r1
+	rng_buffer(od, sizeof(od));
+ 8002ce4:	4628      	mov	r0, r5
+ 8002ce6:	2120      	movs	r1, #32
+ 8002ce8:	f7ff fd48 	bl	800277c <rng_buffer>
+	rng_buffer(numin, sizeof(numin));
+ 8002cec:	2114      	movs	r1, #20
+ 8002cee:	a806      	add	r0, sp, #24
+ 8002cf0:	f7ff fd44 	bl	800277c <rng_buffer>
+	ae_send_idle();
+ 8002cf4:	f7ff fdfd 	bl	80028f2 <ae_send_idle>
+
+    // need this one, want to reset watchdog to this point.
+	ae_keep_alive();
+
+	// - load tempkey with a known nonce value
+	uint8_t zeros[8] = {0};
+ 8002cf8:	2300      	movs	r3, #0
+	uint8_t tempkey[32];
+	rv = ae_pick_nonce(numin, tempkey);
+ 8002cfa:	a913      	add	r1, sp, #76	; 0x4c
+ 8002cfc:	a806      	add	r0, sp, #24
+	uint8_t zeros[8] = {0};
+ 8002cfe:	e9cd 3304 	strd	r3, r3, [sp, #16]
+	rv = ae_pick_nonce(numin, tempkey);
+ 8002d02:	f7ff ff67 	bl	8002bd4 <ae_pick_nonce>
+	RET_IF_BAD(rv);
+ 8002d06:	4604      	mov	r4, r0
+ 8002d08:	2800      	cmp	r0, #0
+ 8002d0a:	d15d      	bne.n	8002dc8 <ae_checkmac+0xf0>
+
+	// - hash nonce and lots of other bits together
+	SHA256_CTX ctx;
+    sha256_init(&ctx);
+ 8002d0c:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d0e:	f002 fbef 	bl	80054f0 <sha256_init>
+
+    // shared secret is 32 bytes from flash
+    sha256_update(&ctx, secret, 32);
+ 8002d12:	2220      	movs	r2, #32
+ 8002d14:	4631      	mov	r1, r6
+ 8002d16:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d18:	f002 fbf8 	bl	800550c <sha256_update>
+
+    sha256_update(&ctx, tempkey, 32);
+ 8002d1c:	2220      	movs	r2, #32
+ 8002d1e:	a913      	add	r1, sp, #76	; 0x4c
+ 8002d20:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d22:	f002 fbf3 	bl	800550c <sha256_update>
+    sha256_update(&ctx, &od[0], 4);
+ 8002d26:	2204      	movs	r2, #4
+ 8002d28:	4629      	mov	r1, r5
+ 8002d2a:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d2c:	f002 fbee 	bl	800550c <sha256_update>
+
+    sha256_update(&ctx, zeros, 8);
+ 8002d30:	2208      	movs	r2, #8
+ 8002d32:	a904      	add	r1, sp, #16
+ 8002d34:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d36:	f002 fbe9 	bl	800550c <sha256_update>
+
+    sha256_update(&ctx, &od[4], 3);
+ 8002d3a:	2203      	movs	r2, #3
+ 8002d3c:	a90c      	add	r1, sp, #48	; 0x30
+ 8002d3e:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d40:	f002 fbe4 	bl	800550c <sha256_update>
+
+	uint8_t ee = 0xEE;
+ 8002d44:	23ee      	movs	r3, #238	; 0xee
+    sha256_update(&ctx, &ee, 1);
+ 8002d46:	2201      	movs	r2, #1
+ 8002d48:	f10d 010b 	add.w	r1, sp, #11
+ 8002d4c:	a81b      	add	r0, sp, #108	; 0x6c
+	uint8_t ee = 0xEE;
+ 8002d4e:	f88d 300b 	strb.w	r3, [sp, #11]
+    sha256_update(&ctx, &ee, 1);
+ 8002d52:	f002 fbdb 	bl	800550c <sha256_update>
+    sha256_update(&ctx, &od[7], 4);
+ 8002d56:	2204      	movs	r2, #4
+ 8002d58:	f10d 0133 	add.w	r1, sp, #51	; 0x33
+ 8002d5c:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d5e:	f002 fbd5 	bl	800550c <sha256_update>
+
+	uint8_t snp[2] = { 0x01, 0x23 };
+ 8002d62:	f242 3301 	movw	r3, #8961	; 0x2301
+    sha256_update(&ctx, snp, 2);
+ 8002d66:	2202      	movs	r2, #2
+ 8002d68:	a903      	add	r1, sp, #12
+ 8002d6a:	a81b      	add	r0, sp, #108	; 0x6c
+	uint8_t snp[2] = { 0x01, 0x23 };
+ 8002d6c:	f8ad 300c 	strh.w	r3, [sp, #12]
+    sha256_update(&ctx, snp, 2);
+ 8002d70:	f002 fbcc 	bl	800550c <sha256_update>
+    sha256_update(&ctx, &od[11], 2);
+ 8002d74:	2202      	movs	r2, #2
+ 8002d76:	f10d 0137 	add.w	r1, sp, #55	; 0x37
+ 8002d7a:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d7c:	f002 fbc6 	bl	800550c <sha256_update>
+		uint8_t		resp[32];
+		uint8_t		od[13];
+	} req;
+
+    // content doesn't matter, but nice and visible:
+    memcpy(req.ch3, copyright_msg, 32);
+ 8002d80:	4b15      	ldr	r3, [pc, #84]	; (8002dd8 <ae_checkmac+0x100>)
+ 8002d82:	ac2e      	add	r4, sp, #184	; 0xb8
+ 8002d84:	f103 0220 	add.w	r2, r3, #32
+ 8002d88:	46a0      	mov	r8, r4
+ 8002d8a:	6818      	ldr	r0, [r3, #0]
+ 8002d8c:	6859      	ldr	r1, [r3, #4]
+ 8002d8e:	4626      	mov	r6, r4
+ 8002d90:	c603      	stmia	r6!, {r0, r1}
+ 8002d92:	3308      	adds	r3, #8
+ 8002d94:	4293      	cmp	r3, r2
+ 8002d96:	4634      	mov	r4, r6
+ 8002d98:	d1f7      	bne.n	8002d8a <ae_checkmac+0xb2>
+	// this verifies no problem.
+	int l = (ctx.blocks * 64) + ctx.npartial;
+	ASSERT(l == 32+32+4+8+3+1+4+2+2);			// == 88
+#endif
+
+    sha256_final(&ctx, req.resp);
+ 8002d9a:	a936      	add	r1, sp, #216	; 0xd8
+ 8002d9c:	a81b      	add	r0, sp, #108	; 0x6c
+ 8002d9e:	f002 fbfb 	bl	8005598 <sha256_final>
+	memcpy(req.od, od, 13);
+ 8002da2:	e895 000f 	ldmia.w	r5, {r0, r1, r2, r3}
+ 8002da6:	ac3e      	add	r4, sp, #248	; 0xf8
+ 8002da8:	c407      	stmia	r4!, {r0, r1, r2}
+ 8002daa:	7023      	strb	r3, [r4, #0]
+
+	STATIC_ASSERT(sizeof(req) == 32 + 32 + 13);
+
+	// Give our answer to the chip.
+	ae_send_n(OP_CheckMac, 0x01, keynum, (uint8_t *)&req, sizeof(req));
+ 8002dac:	234d      	movs	r3, #77	; 0x4d
+ 8002dae:	9300      	str	r3, [sp, #0]
+ 8002db0:	463a      	mov	r2, r7
+ 8002db2:	4643      	mov	r3, r8
+ 8002db4:	2101      	movs	r1, #1
+ 8002db6:	2028      	movs	r0, #40	; 0x28
+ 8002db8:	f7ff fea4 	bl	8002b04 <ae_send_n>
+
+	rv = ae_read1();
+ 8002dbc:	f7ff fe4c 	bl	8002a58 <ae_read1>
+	if(rv != 0) {
+ 8002dc0:	4604      	mov	r4, r0
+ 8002dc2:	b928      	cbnz	r0, 8002dd0 <ae_checkmac+0xf8>
+	ae_send_idle();
+ 8002dc4:	f7ff fd95 	bl	80028f2 <ae_send_idle>
+
+	// just in case ... always restart watchdog timer.
+	ae_keep_alive();
+
+	return 0;
+}
+ 8002dc8:	4620      	mov	r0, r4
+ 8002dca:	b042      	add	sp, #264	; 0x108
+ 8002dcc:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+		return -1;
+ 8002dd0:	f04f 34ff 	mov.w	r4, #4294967295	; 0xffffffff
+ 8002dd4:	e7f8      	b.n	8002dc8 <ae_checkmac+0xf0>
+ 8002dd6:	bf00      	nop
+ 8002dd8:	0800e6cc 	.word	0x0800e6cc
+
+08002ddc <ae_pair_unlock>:
+    return ae_checkmac(KEYNUM_pairing, rom_secrets->pairing_secret);
+ 8002ddc:	4901      	ldr	r1, [pc, #4]	; (8002de4 <ae_pair_unlock+0x8>)
+ 8002dde:	2001      	movs	r0, #1
+ 8002de0:	f7ff bf7a 	b.w	8002cd8 <ae_checkmac>
+ 8002de4:	0801c000 	.word	0x0801c000
+
+08002de8 <ae_sign_authed>:
+// Sign a message (already digested)
+//
+	int
+ae_sign_authed(uint8_t keynum, const uint8_t msg_hash[32],
+                uint8_t signature[64], int auth_kn, const uint8_t auth_digest[32])
+{
+ 8002de8:	b570      	push	{r4, r5, r6, lr}
+ 8002dea:	460e      	mov	r6, r1
+ 8002dec:	4604      	mov	r4, r0
+ 8002dee:	4615      	mov	r5, r2
+    // indicate we know the PIN
+    ae_pair_unlock();
+ 8002df0:	f7ff fff4 	bl	8002ddc <ae_pair_unlock>
+    int rv = ae_checkmac(KEYNUM_main_pin, auth_digest);
+ 8002df4:	9904      	ldr	r1, [sp, #16]
+ 8002df6:	2003      	movs	r0, #3
+ 8002df8:	f7ff ff6e 	bl	8002cd8 <ae_checkmac>
+    RET_IF_BAD(rv);
+ 8002dfc:	b990      	cbnz	r0, 8002e24 <ae_sign_authed+0x3c>
+
+    // send what we need signed
+	rv = ae_load_msgdigest(msg_hash);
+ 8002dfe:	4630      	mov	r0, r6
+ 8002e00:	f7ff feda 	bl	8002bb8 <ae_load_msgdigest>
+	RET_IF_BAD(rv);
+ 8002e04:	b970      	cbnz	r0, 8002e24 <ae_sign_authed+0x3c>
+
+    do {
+        ae_send(OP_Sign, (7<<5), keynum);
+ 8002e06:	b2a4      	uxth	r4, r4
+ 8002e08:	4622      	mov	r2, r4
+ 8002e0a:	21e0      	movs	r1, #224	; 0xe0
+ 8002e0c:	2041      	movs	r0, #65	; 0x41
+ 8002e0e:	f7ff feac 	bl	8002b6a <ae_send>
+
+        delay_ms(60);     // min time for processing
+ 8002e12:	203c      	movs	r0, #60	; 0x3c
+ 8002e14:	f000 fd86 	bl	8003924 <delay_ms>
+
+        rv = ae_read_n(64, signature);
+ 8002e18:	4629      	mov	r1, r5
+ 8002e1a:	2040      	movs	r0, #64	; 0x40
+ 8002e1c:	f7ff fe38 	bl	8002a90 <ae_read_n>
+    } while(rv == AE_ECC_FAULT);
+ 8002e20:	2805      	cmp	r0, #5
+ 8002e22:	d0f1      	beq.n	8002e08 <ae_sign_authed+0x20>
+
+	return rv;
+}
+ 8002e24:	bd70      	pop	{r4, r5, r6, pc}
+	...
+
+08002e28 <ae_gen_ecc_key>:
+
+// ae_gen_ecc_key()
+//
+    int
+ae_gen_ecc_key(uint8_t keynum, uint8_t pubkey_out[64])
+{
+ 8002e28:	b530      	push	{r4, r5, lr}
+    int rv;
+    uint8_t junk[3] = { 0 };
+ 8002e2a:	4b0f      	ldr	r3, [pc, #60]	; (8002e68 <ae_gen_ecc_key+0x40>)
+{
+ 8002e2c:	b085      	sub	sp, #20
+    uint8_t junk[3] = { 0 };
+ 8002e2e:	f8b3 3013 	ldrh.w	r3, [r3, #19]
+ 8002e32:	f8ad 300c 	strh.w	r3, [sp, #12]
+ 8002e36:	2300      	movs	r3, #0
+{
+ 8002e38:	460c      	mov	r4, r1
+    uint8_t junk[3] = { 0 };
+ 8002e3a:	f88d 300e 	strb.w	r3, [sp, #14]
+
+    do {
+        ae_send_n(OP_GenKey, (1<<2), keynum, junk, 3);
+ 8002e3e:	4605      	mov	r5, r0
+ 8002e40:	2303      	movs	r3, #3
+ 8002e42:	462a      	mov	r2, r5
+ 8002e44:	2104      	movs	r1, #4
+ 8002e46:	9300      	str	r3, [sp, #0]
+ 8002e48:	2040      	movs	r0, #64	; 0x40
+ 8002e4a:	ab03      	add	r3, sp, #12
+ 8002e4c:	f7ff fe5a 	bl	8002b04 <ae_send_n>
+
+        delay_ms(100);     // to avoid timeouts
+ 8002e50:	2064      	movs	r0, #100	; 0x64
+ 8002e52:	f000 fd67 	bl	8003924 <delay_ms>
+
+        rv = ae_read_n(64, pubkey_out);
+ 8002e56:	4621      	mov	r1, r4
+ 8002e58:	2040      	movs	r0, #64	; 0x40
+ 8002e5a:	f7ff fe19 	bl	8002a90 <ae_read_n>
+    } while(rv == AE_ECC_FAULT);
+ 8002e5e:	2805      	cmp	r0, #5
+ 8002e60:	d0ee      	beq.n	8002e40 <ae_gen_ecc_key+0x18>
+
+    return rv;
+}
+ 8002e62:	b005      	add	sp, #20
+ 8002e64:	bd30      	pop	{r4, r5, pc}
+ 8002e66:	bf00      	nop
+ 8002e68:	0800e6fa 	.word	0x0800e6fa
+
+08002e6c <ae_hmac32>:
+// 508a: Different opcode, OP_HMAC does exactly 32 bytes w/ less steps.
+// 608a: Use old SHA256 command, but with new flags.
+//
+    int
+ae_hmac32(uint8_t keynum, const uint8_t msg[32], uint8_t digest[32])
+{
+ 8002e6c:	b530      	push	{r4, r5, lr}
+ 8002e6e:	b085      	sub	sp, #20
+ 8002e70:	4615      	mov	r5, r2
+ 8002e72:	9103      	str	r1, [sp, #12]
+    // Start SHA w/ HMAC setup
+	ae_send(OP_SHA, 4, keynum);        // 4 = HMAC_Init
+ 8002e74:	4602      	mov	r2, r0
+ 8002e76:	2104      	movs	r1, #4
+ 8002e78:	2047      	movs	r0, #71	; 0x47
+ 8002e7a:	f7ff fe76 	bl	8002b6a <ae_send>
+
+    // expect zero, meaning "ready"
+    int rv = ae_read1();
+ 8002e7e:	f7ff fdeb 	bl	8002a58 <ae_read1>
+    RET_IF_BAD(rv);
+ 8002e82:	b970      	cbnz	r0, 8002ea2 <ae_hmac32+0x36>
+
+    // send the contents to be hashed
+	ae_send_n(OP_SHA, (3<<6) | 2, 32, msg, 32); // 2 = Finalize, 3=Place output
+ 8002e84:	2420      	movs	r4, #32
+ 8002e86:	9b03      	ldr	r3, [sp, #12]
+ 8002e88:	9400      	str	r4, [sp, #0]
+ 8002e8a:	4622      	mov	r2, r4
+ 8002e8c:	21c2      	movs	r1, #194	; 0xc2
+ 8002e8e:	2047      	movs	r0, #71	; 0x47
+ 8002e90:	f7ff fe38 	bl	8002b04 <ae_send_n>
+    
+    // read result
+    return ae_read_n(32, digest);
+ 8002e94:	4629      	mov	r1, r5
+ 8002e96:	4620      	mov	r0, r4
+}
+ 8002e98:	b005      	add	sp, #20
+ 8002e9a:	e8bd 4030 	ldmia.w	sp!, {r4, r5, lr}
+    return ae_read_n(32, digest);
+ 8002e9e:	f7ff bdf7 	b.w	8002a90 <ae_read_n>
+}
+ 8002ea2:	b005      	add	sp, #20
+ 8002ea4:	bd30      	pop	{r4, r5, pc}
+
+08002ea6 <ae_get_serial>:
+//
+// Return the serial number: it's 9 bytes, altho 3 are fixed.
+//
+	int
+ae_get_serial(uint8_t serial[6])
+{
+ 8002ea6:	b510      	push	{r4, lr}
+	ae_send(OP_Read, 0x80, 0x0);
+ 8002ea8:	2200      	movs	r2, #0
+{
+ 8002eaa:	b08c      	sub	sp, #48	; 0x30
+	ae_send(OP_Read, 0x80, 0x0);
+ 8002eac:	2180      	movs	r1, #128	; 0x80
+{
+ 8002eae:	4604      	mov	r4, r0
+	ae_send(OP_Read, 0x80, 0x0);
+ 8002eb0:	2002      	movs	r0, #2
+ 8002eb2:	f7ff fe5a 	bl	8002b6a <ae_send>
+
+	uint8_t temp[32];
+	int rv = ae_read_n(32, temp);
+ 8002eb6:	a904      	add	r1, sp, #16
+ 8002eb8:	2020      	movs	r0, #32
+ 8002eba:	f7ff fde9 	bl	8002a90 <ae_read_n>
+	RET_IF_BAD(rv);
+ 8002ebe:	4603      	mov	r3, r0
+ 8002ec0:	b9b8      	cbnz	r0, 8002ef2 <ae_get_serial+0x4c>
+
+    // reformat to 9 bytes.
+    uint8_t ts[9];
+	memcpy(ts, &temp[0], 4);
+	memcpy(&ts[4], &temp[8], 5);
+ 8002ec2:	e9dd 0106 	ldrd	r0, r1, [sp, #24]
+ 8002ec6:	9a04      	ldr	r2, [sp, #16]
+ 8002ec8:	f88d 100c 	strb.w	r1, [sp, #12]
+
+    // check the hard-coded values
+    if((ts[0] != 0x01) || (ts[1] != 0x23) || (ts[8] != 0xEE)) return 1;
+ 8002ecc:	b2d1      	uxtb	r1, r2
+ 8002ece:	2901      	cmp	r1, #1
+	memcpy(ts, &temp[0], 4);
+ 8002ed0:	9201      	str	r2, [sp, #4]
+	memcpy(&ts[4], &temp[8], 5);
+ 8002ed2:	9002      	str	r0, [sp, #8]
+    if((ts[0] != 0x01) || (ts[1] != 0x23) || (ts[8] != 0xEE)) return 1;
+ 8002ed4:	d110      	bne.n	8002ef8 <ae_get_serial+0x52>
+ 8002ed6:	f3c2 2207 	ubfx	r2, r2, #8, #8
+ 8002eda:	2a23      	cmp	r2, #35	; 0x23
+ 8002edc:	d10c      	bne.n	8002ef8 <ae_get_serial+0x52>
+ 8002ede:	f89d 200c 	ldrb.w	r2, [sp, #12]
+ 8002ee2:	2aee      	cmp	r2, #238	; 0xee
+ 8002ee4:	d10a      	bne.n	8002efc <ae_get_serial+0x56>
+
+    // save only the unique bits.
+    memcpy(serial, ts+2, 6);
+ 8002ee6:	f8dd 2006 	ldr.w	r2, [sp, #6]
+ 8002eea:	6022      	str	r2, [r4, #0]
+ 8002eec:	f8bd 200a 	ldrh.w	r2, [sp, #10]
+ 8002ef0:	80a2      	strh	r2, [r4, #4]
+
+	return 0;
+}
+ 8002ef2:	4618      	mov	r0, r3
+ 8002ef4:	b00c      	add	sp, #48	; 0x30
+ 8002ef6:	bd10      	pop	{r4, pc}
+    if((ts[0] != 0x01) || (ts[1] != 0x23) || (ts[8] != 0xEE)) return 1;
+ 8002ef8:	2301      	movs	r3, #1
+ 8002efa:	e7fa      	b.n	8002ef2 <ae_get_serial+0x4c>
+ 8002efc:	460b      	mov	r3, r1
+ 8002efe:	e7f8      	b.n	8002ef2 <ae_get_serial+0x4c>
+
+08002f00 <ae_probe>:
+{
+ 8002f00:	b513      	push	{r0, r1, r4, lr}
+    ae_wake();
+ 8002f02:	f7ff fceb 	bl	80028dc <ae_wake>
+    _send_bits(IOFLAG_SLEEP);
+ 8002f06:	20cc      	movs	r0, #204	; 0xcc
+ 8002f08:	f7ff fc70 	bl	80027ec <_send_bits>
+    ae_wake();
+ 8002f0c:	f7ff fce6 	bl	80028dc <ae_wake>
+    ae_read1();
+ 8002f10:	f7ff fda2 	bl	8002a58 <ae_read1>
+	uint8_t chk = ae_read1();
+ 8002f14:	f7ff fda0 	bl	8002a58 <ae_read1>
+	if(chk != AE_AFTER_WAKE) return "wk fl";
+ 8002f18:	b2c0      	uxtb	r0, r0
+ 8002f1a:	2811      	cmp	r0, #17
+ 8002f1c:	d10e      	bne.n	8002f3c <ae_probe+0x3c>
+	if(ae_get_serial(serial)) return "no ser";
+ 8002f1e:	4668      	mov	r0, sp
+ 8002f20:	f7ff ffc1 	bl	8002ea6 <ae_get_serial>
+ 8002f24:	4604      	mov	r4, r0
+ 8002f26:	b938      	cbnz	r0, 8002f38 <ae_probe+0x38>
+    ae_wake();
+ 8002f28:	f7ff fcd8 	bl	80028dc <ae_wake>
+    _send_bits(IOFLAG_SLEEP);
+ 8002f2c:	20cc      	movs	r0, #204	; 0xcc
+ 8002f2e:	f7ff fc5d 	bl	80027ec <_send_bits>
+	return NULL;
+ 8002f32:	4620      	mov	r0, r4
+}
+ 8002f34:	b002      	add	sp, #8
+ 8002f36:	bd10      	pop	{r4, pc}
+	if(ae_get_serial(serial)) return "no ser";
+ 8002f38:	4801      	ldr	r0, [pc, #4]	; (8002f40 <ae_probe+0x40>)
+ 8002f3a:	e7fb      	b.n	8002f34 <ae_probe+0x34>
+	if(chk != AE_AFTER_WAKE) return "wk fl";
+ 8002f3c:	4801      	ldr	r0, [pc, #4]	; (8002f44 <ae_probe+0x44>)
+ 8002f3e:	e7f9      	b.n	8002f34 <ae_probe+0x34>
+ 8002f40:	0800e6ed 	.word	0x0800e6ed
+ 8002f44:	0800e6f4 	.word	0x0800e6f4
+
+08002f48 <ae_write_data_slot>:
+//
+// -- can also lock it.
+//
+    int
+ae_write_data_slot(int slot_num, const uint8_t *data, int len, bool lock_it)
+{
+ 8002f48:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 8002f4c:	4699      	mov	r9, r3
+    ASSERT(len >= 32);
+ 8002f4e:	f1a2 0320 	sub.w	r3, r2, #32
+{
+ 8002f52:	b085      	sub	sp, #20
+    ASSERT(len >= 32);
+ 8002f54:	f5b3 7fc0 	cmp.w	r3, #384	; 0x180
+{
+ 8002f58:	4604      	mov	r4, r0
+ 8002f5a:	af02      	add	r7, sp, #8
+ 8002f5c:	460d      	mov	r5, r1
+ 8002f5e:	4690      	mov	r8, r2
+    ASSERT(len >= 32);
+ 8002f60:	d902      	bls.n	8002f68 <ae_write_data_slot+0x20>
+ 8002f62:	482d      	ldr	r0, [pc, #180]	; (8003018 <ae_write_data_slot+0xd0>)
+ 8002f64:	f7fd fd70 	bl	8000a48 <fatal_error>
+    ASSERT(len <= 416);
+
+    for(int blk=0, xlen=len; xlen>0; blk++, xlen-=32) {
+        // have to write each "block" of 32-bytes, separately
+        // zone => data
+        ae_send_n(OP_Write, 0x80|2, (blk<<8) | (slot_num<<3), data+(blk*32), 32);
+ 8002f68:	ea4f 0ac0 	mov.w	sl, r0, lsl #3
+ 8002f6c:	fa0f fa8a 	sxth.w	sl, sl
+ 8002f70:	2600      	movs	r6, #0
+ 8002f72:	f04f 0b20 	mov.w	fp, #32
+ 8002f76:	ebc6 3246 	rsb	r2, r6, r6, lsl #13
+ 8002f7a:	ea4a 02c2 	orr.w	r2, sl, r2, lsl #3
+ 8002f7e:	b292      	uxth	r2, r2
+ 8002f80:	1bab      	subs	r3, r5, r6
+ 8002f82:	2182      	movs	r1, #130	; 0x82
+ 8002f84:	2012      	movs	r0, #18
+ 8002f86:	f8cd b000 	str.w	fp, [sp]
+ 8002f8a:	f7ff fdbb 	bl	8002b04 <ae_send_n>
+
+        int rv = ae_read1();
+ 8002f8e:	f7ff fd63 	bl	8002a58 <ae_read1>
+        RET_IF_BAD(rv);
+ 8002f92:	2800      	cmp	r0, #0
+ 8002f94:	d13c      	bne.n	8003010 <ae_write_data_slot+0xc8>
+    for(int blk=0, xlen=len; xlen>0; blk++, xlen-=32) {
+ 8002f96:	3e20      	subs	r6, #32
+ 8002f98:	eb06 0308 	add.w	r3, r6, r8
+ 8002f9c:	2b00      	cmp	r3, #0
+ 8002f9e:	dcea      	bgt.n	8002f76 <ae_write_data_slot+0x2e>
+    }
+
+    if(lock_it) {
+ 8002fa0:	f1b9 0f00 	cmp.w	r9, #0
+ 8002fa4:	d034      	beq.n	8003010 <ae_write_data_slot+0xc8>
+        ASSERT(slot_num != 8);          // no support for mega slot 8
+ 8002fa6:	2c08      	cmp	r4, #8
+    if(lock_it) {
+ 8002fa8:	466e      	mov	r6, sp
+        ASSERT(slot_num != 8);          // no support for mega slot 8
+ 8002faa:	d0da      	beq.n	8002f62 <ae_write_data_slot+0x1a>
+        ASSERT(len == 32);              // probably not a limitation here
+ 8002fac:	f1b8 0f20 	cmp.w	r8, #32
+ 8002fb0:	d1d7      	bne.n	8002f62 <ae_write_data_slot+0x1a>
+
+        // Assume 36/72-byte long slot, which will be partially written, and rest
+        // should be ones.
+        const int slot_len = (slot_num <= 7) ? 36 : 72;
+ 8002fb2:	2c08      	cmp	r4, #8
+ 8002fb4:	bfb4      	ite	lt
+ 8002fb6:	f04f 0824 	movlt.w	r8, #36	; 0x24
+ 8002fba:	f04f 0848 	movge.w	r8, #72	; 0x48
+        uint8_t copy[slot_len];
+ 8002fbe:	f108 0307 	add.w	r3, r8, #7
+ 8002fc2:	f003 03f8 	and.w	r3, r3, #248	; 0xf8
+ 8002fc6:	ebad 0d03 	sub.w	sp, sp, r3
+ 8002fca:	ab02      	add	r3, sp, #8
+
+        memset(copy, 0xff, slot_len);
+ 8002fcc:	4642      	mov	r2, r8
+ 8002fce:	21ff      	movs	r1, #255	; 0xff
+ 8002fd0:	4618      	mov	r0, r3
+ 8002fd2:	f00a fb81 	bl	800d6d8 <memset>
+        memcpy(copy, data, len);
+ 8002fd6:	f105 0120 	add.w	r1, r5, #32
+        memset(copy, 0xff, slot_len);
+ 8002fda:	4603      	mov	r3, r0
+        memcpy(copy, data, len);
+ 8002fdc:	4602      	mov	r2, r0
+ 8002fde:	f855 0b04 	ldr.w	r0, [r5], #4
+ 8002fe2:	f842 0b04 	str.w	r0, [r2], #4
+ 8002fe6:	428d      	cmp	r5, r1
+ 8002fe8:	d1f9      	bne.n	8002fde <ae_write_data_slot+0x96>
+
+        // calc expected CRC
+        uint8_t crc[2] = {0, 0};
+ 8002fea:	2200      	movs	r2, #0
+        crc16_chain(slot_len, copy, crc);
+ 8002fec:	4619      	mov	r1, r3
+        uint8_t crc[2] = {0, 0};
+ 8002fee:	80ba      	strh	r2, [r7, #4]
+        crc16_chain(slot_len, copy, crc);
+ 8002ff0:	4640      	mov	r0, r8
+ 8002ff2:	1d3a      	adds	r2, r7, #4
+ 8002ff4:	f7ff fc30 	bl	8002858 <crc16_chain>
+
+        // do the lock
+        ae_send(OP_Lock, 2 | (slot_num << 2), (crc[1]<<8) | crc[0]);
+ 8002ff8:	00a1      	lsls	r1, r4, #2
+ 8002ffa:	f041 0102 	orr.w	r1, r1, #2
+ 8002ffe:	88ba      	ldrh	r2, [r7, #4]
+ 8003000:	f001 01fe 	and.w	r1, r1, #254	; 0xfe
+ 8003004:	2017      	movs	r0, #23
+ 8003006:	f7ff fdb0 	bl	8002b6a <ae_send>
+
+        int rv = ae_read1();
+ 800300a:	f7ff fd25 	bl	8002a58 <ae_read1>
+        RET_IF_BAD(rv);
+ 800300e:	46b5      	mov	sp, r6
+    }
+
+    return 0;
+}
+ 8003010:	370c      	adds	r7, #12
+ 8003012:	46bd      	mov	sp, r7
+ 8003014:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+ 8003018:	0800e466 	.word	0x0800e466
+
+0800301c <ae_gendig_slot>:
+
+// ae_gendig_slot()
+//
+    int
+ae_gendig_slot(int slot_num, const uint8_t slot_contents[32], uint8_t digest[32])
+{
+ 800301c:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 800301e:	b0ab      	sub	sp, #172	; 0xac
+ 8003020:	4605      	mov	r5, r0
+ 8003022:	460f      	mov	r7, r1
+    // Construct a digest on the device (and here) that depends on the secret
+    // contents of a specific slot.
+    uint8_t num_in[20], tempkey[32];
+
+	rng_buffer(num_in, sizeof(num_in));
+ 8003024:	a803      	add	r0, sp, #12
+ 8003026:	2114      	movs	r1, #20
+{
+ 8003028:	4616      	mov	r6, r2
+	rng_buffer(num_in, sizeof(num_in));
+ 800302a:	f7ff fba7 	bl	800277c <rng_buffer>
+	int rv = ae_pick_nonce(num_in, tempkey);
+ 800302e:	a90f      	add	r1, sp, #60	; 0x3c
+ 8003030:	a803      	add	r0, sp, #12
+ 8003032:	f7ff fdcf 	bl	8002bd4 <ae_pick_nonce>
+    RET_IF_BAD(rv);
+ 8003036:	4604      	mov	r4, r0
+ 8003038:	2800      	cmp	r0, #0
+ 800303a:	d13d      	bne.n	80030b8 <ae_gendig_slot+0x9c>
+
+    //using Zone=2="Data" => "KeyID specifies a slot in the Data zone"
+    ae_send(OP_GenDig, 0x2, slot_num);
+ 800303c:	b2aa      	uxth	r2, r5
+ 800303e:	2102      	movs	r1, #2
+ 8003040:	2015      	movs	r0, #21
+ 8003042:	f7ff fd92 	bl	8002b6a <ae_send>
+
+    rv = ae_read1();
+ 8003046:	f7ff fd07 	bl	8002a58 <ae_read1>
+    RET_IF_BAD(rv);
+ 800304a:	4604      	mov	r4, r0
+ 800304c:	bba0      	cbnz	r0, 80030b8 <ae_gendig_slot+0x9c>
+	ae_send_idle();
+ 800304e:	f7ff fc50 	bl	80028f2 <ae_send_idle>
+    //   msg = hkey + b'\x15\x02' + ustruct.pack("<H", slot_num)
+    //   msg += b'\xee\x01\x23' + (b'\0'*25) + challenge
+    //   assert len(msg) == 32+1+1+2+1+2+25+32
+    //
+	SHA256_CTX ctx;
+    sha256_init(&ctx);
+ 8003052:	a817      	add	r0, sp, #92	; 0x5c
+ 8003054:	f002 fa4c 	bl	80054f0 <sha256_init>
+
+	uint8_t args[7] = { OP_GenDig, 2, slot_num, 0, 0xEE, 0x01, 0x23 };
+ 8003058:	2302      	movs	r3, #2
+ 800305a:	f88d 3005 	strb.w	r3, [sp, #5]
+ 800305e:	23ee      	movs	r3, #238	; 0xee
+ 8003060:	f88d 3008 	strb.w	r3, [sp, #8]
+ 8003064:	2301      	movs	r3, #1
+ 8003066:	2215      	movs	r2, #21
+ 8003068:	f88d 3009 	strb.w	r3, [sp, #9]
+    uint8_t zeros[25] = { 0 };
+ 800306c:	4621      	mov	r1, r4
+	uint8_t args[7] = { OP_GenDig, 2, slot_num, 0, 0xEE, 0x01, 0x23 };
+ 800306e:	2323      	movs	r3, #35	; 0x23
+    uint8_t zeros[25] = { 0 };
+ 8003070:	a809      	add	r0, sp, #36	; 0x24
+	uint8_t args[7] = { OP_GenDig, 2, slot_num, 0, 0xEE, 0x01, 0x23 };
+ 8003072:	f88d 300a 	strb.w	r3, [sp, #10]
+ 8003076:	f88d 2004 	strb.w	r2, [sp, #4]
+ 800307a:	f88d 5006 	strb.w	r5, [sp, #6]
+ 800307e:	f88d 4007 	strb.w	r4, [sp, #7]
+    uint8_t zeros[25] = { 0 };
+ 8003082:	9408      	str	r4, [sp, #32]
+ 8003084:	f00a fb28 	bl	800d6d8 <memset>
+
+    sha256_update(&ctx, slot_contents, 32);
+ 8003088:	2220      	movs	r2, #32
+ 800308a:	4639      	mov	r1, r7
+ 800308c:	a817      	add	r0, sp, #92	; 0x5c
+ 800308e:	f002 fa3d 	bl	800550c <sha256_update>
+    sha256_update(&ctx, args, sizeof(args));
+ 8003092:	2207      	movs	r2, #7
+ 8003094:	a901      	add	r1, sp, #4
+ 8003096:	a817      	add	r0, sp, #92	; 0x5c
+ 8003098:	f002 fa38 	bl	800550c <sha256_update>
+    sha256_update(&ctx, zeros, sizeof(zeros));
+ 800309c:	2219      	movs	r2, #25
+ 800309e:	a908      	add	r1, sp, #32
+ 80030a0:	a817      	add	r0, sp, #92	; 0x5c
+ 80030a2:	f002 fa33 	bl	800550c <sha256_update>
+    sha256_update(&ctx, tempkey, 32);
+ 80030a6:	a90f      	add	r1, sp, #60	; 0x3c
+ 80030a8:	a817      	add	r0, sp, #92	; 0x5c
+ 80030aa:	2220      	movs	r2, #32
+ 80030ac:	f002 fa2e 	bl	800550c <sha256_update>
+
+    sha256_final(&ctx, digest);
+ 80030b0:	4631      	mov	r1, r6
+ 80030b2:	a817      	add	r0, sp, #92	; 0x5c
+ 80030b4:	f002 fa70 	bl	8005598 <sha256_final>
+
+    return 0;
+}
+ 80030b8:	4620      	mov	r0, r4
+ 80030ba:	b02b      	add	sp, #172	; 0xac
+ 80030bc:	bdf0      	pop	{r4, r5, r6, r7, pc}
+	...
+
+080030c0 <ae_secure_random>:
+{
+ 80030c0:	b507      	push	{r0, r1, r2, lr}
+ 80030c2:	4602      	mov	r2, r0
+    int rv = ae_gendig_slot(KEYNUM_pairing, rom_secrets->pairing_secret, randout);
+ 80030c4:	9001      	str	r0, [sp, #4]
+ 80030c6:	490b      	ldr	r1, [pc, #44]	; (80030f4 <ae_secure_random+0x34>)
+ 80030c8:	2001      	movs	r0, #1
+ 80030ca:	f7ff ffa7 	bl	800301c <ae_gendig_slot>
+    if(rv || !ae_is_correct_tempkey(randout)) {
+ 80030ce:	9a01      	ldr	r2, [sp, #4]
+ 80030d0:	b108      	cbz	r0, 80030d6 <ae_secure_random+0x16>
+        fatal_mitm();
+ 80030d2:	f7fd fcc3 	bl	8000a5c <fatal_mitm>
+    if(rv || !ae_is_correct_tempkey(randout)) {
+ 80030d6:	4610      	mov	r0, r2
+ 80030d8:	9201      	str	r2, [sp, #4]
+ 80030da:	f7ff fdaf 	bl	8002c3c <ae_is_correct_tempkey>
+ 80030de:	2800      	cmp	r0, #0
+ 80030e0:	d0f7      	beq.n	80030d2 <ae_secure_random+0x12>
+    sha256_single(randout, 32, randout);
+ 80030e2:	9a01      	ldr	r2, [sp, #4]
+ 80030e4:	2120      	movs	r1, #32
+ 80030e6:	4610      	mov	r0, r2
+}
+ 80030e8:	b003      	add	sp, #12
+ 80030ea:	f85d eb04 	ldr.w	lr, [sp], #4
+    sha256_single(randout, 32, randout);
+ 80030ee:	f002 ba67 	b.w	80055c0 <sha256_single>
+ 80030f2:	bf00      	nop
+ 80030f4:	0801c000 	.word	0x0801c000
+
+080030f8 <ae_checkmac_hard>:
+{
+ 80030f8:	b510      	push	{r4, lr}
+ 80030fa:	b088      	sub	sp, #32
+    int rv = ae_gendig_slot(keynum, secret, digest);
+ 80030fc:	466a      	mov	r2, sp
+ 80030fe:	f7ff ff8d 	bl	800301c <ae_gendig_slot>
+    RET_IF_BAD(rv);
+ 8003102:	4604      	mov	r4, r0
+ 8003104:	b930      	cbnz	r0, 8003114 <ae_checkmac_hard+0x1c>
+    if(!ae_is_correct_tempkey(digest)) return -2;
+ 8003106:	4668      	mov	r0, sp
+ 8003108:	f7ff fd98 	bl	8002c3c <ae_is_correct_tempkey>
+ 800310c:	2800      	cmp	r0, #0
+ 800310e:	bf08      	it	eq
+ 8003110:	f06f 0401 	mvneq.w	r4, #1
+}
+ 8003114:	4620      	mov	r0, r4
+ 8003116:	b008      	add	sp, #32
+ 8003118:	bd10      	pop	{r4, pc}
+
+0800311a <ae_gendig_counter>:
+// the digest should be, and ask the chip to do the same. Verify we match
+// using MAC command (done elsewhere).
+//
+    int
+ae_gendig_counter(int counter_num, const uint32_t expected_value, uint8_t digest[32])
+{
+ 800311a:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 800311c:	b0ad      	sub	sp, #180	; 0xb4
+ 800311e:	4605      	mov	r5, r0
+ 8003120:	9101      	str	r1, [sp, #4]
+    uint8_t num_in[20], tempkey[32];
+
+	rng_buffer(num_in, sizeof(num_in));
+ 8003122:	a804      	add	r0, sp, #16
+ 8003124:	2114      	movs	r1, #20
+{
+ 8003126:	4616      	mov	r6, r2
+	rng_buffer(num_in, sizeof(num_in));
+ 8003128:	f7ff fb28 	bl	800277c <rng_buffer>
+	int rv = ae_pick_nonce(num_in, tempkey);
+ 800312c:	a909      	add	r1, sp, #36	; 0x24
+ 800312e:	a804      	add	r0, sp, #16
+ 8003130:	f7ff fd50 	bl	8002bd4 <ae_pick_nonce>
+    RET_IF_BAD(rv);
+ 8003134:	4604      	mov	r4, r0
+ 8003136:	2800      	cmp	r0, #0
+ 8003138:	d148      	bne.n	80031cc <ae_gendig_counter+0xb2>
+
+    //using Zone=4="Counter" => "KeyID specifies the monotonic counter ID"
+    ae_send(OP_GenDig, 0x4, counter_num);
+ 800313a:	b2aa      	uxth	r2, r5
+ 800313c:	2104      	movs	r1, #4
+ 800313e:	2015      	movs	r0, #21
+ 8003140:	f7ff fd13 	bl	8002b6a <ae_send>
+
+    rv = ae_read1();
+ 8003144:	f7ff fc88 	bl	8002a58 <ae_read1>
+    RET_IF_BAD(rv);
+ 8003148:	4604      	mov	r4, r0
+ 800314a:	2800      	cmp	r0, #0
+ 800314c:	d13e      	bne.n	80031cc <ae_gendig_counter+0xb2>
+	ae_send_idle();
+ 800314e:	f7ff fbd0 	bl	80028f2 <ae_send_idle>
+    //   msg = hkey + b'\x15\x02' + ustruct.pack("<H", slot_num)
+    //   msg += b'\xee\x01\x23' + (b'\0'*25) + challenge
+    //   assert len(msg) == 32+1+1+2+1+2+25+32
+    //
+	SHA256_CTX ctx;
+    sha256_init(&ctx);
+ 8003152:	a819      	add	r0, sp, #100	; 0x64
+ 8003154:	f002 f9cc 	bl	80054f0 <sha256_init>
+
+    uint8_t zeros[32] = { 0 };
+ 8003158:	221c      	movs	r2, #28
+ 800315a:	4621      	mov	r1, r4
+ 800315c:	a812      	add	r0, sp, #72	; 0x48
+ 800315e:	9411      	str	r4, [sp, #68]	; 0x44
+ 8003160:	f00a faba 	bl	800d6d8 <memset>
+	uint8_t args[8] = { OP_GenDig, 0x4, counter_num, 0,  0xEE, 0x01, 0x23, 0x0 };
+ 8003164:	2315      	movs	r3, #21
+ 8003166:	f88d 3008 	strb.w	r3, [sp, #8]
+ 800316a:	23ee      	movs	r3, #238	; 0xee
+ 800316c:	f88d 300c 	strb.w	r3, [sp, #12]
+ 8003170:	2301      	movs	r3, #1
+ 8003172:	2704      	movs	r7, #4
+ 8003174:	f88d 300d 	strb.w	r3, [sp, #13]
+
+    sha256_update(&ctx, zeros, 32);
+ 8003178:	2220      	movs	r2, #32
+	uint8_t args[8] = { OP_GenDig, 0x4, counter_num, 0,  0xEE, 0x01, 0x23, 0x0 };
+ 800317a:	2323      	movs	r3, #35	; 0x23
+    sha256_update(&ctx, zeros, 32);
+ 800317c:	a911      	add	r1, sp, #68	; 0x44
+ 800317e:	a819      	add	r0, sp, #100	; 0x64
+	uint8_t args[8] = { OP_GenDig, 0x4, counter_num, 0,  0xEE, 0x01, 0x23, 0x0 };
+ 8003180:	f88d 300e 	strb.w	r3, [sp, #14]
+ 8003184:	f88d 7009 	strb.w	r7, [sp, #9]
+ 8003188:	f88d 500a 	strb.w	r5, [sp, #10]
+ 800318c:	f88d 400b 	strb.w	r4, [sp, #11]
+ 8003190:	f88d 400f 	strb.w	r4, [sp, #15]
+    sha256_update(&ctx, zeros, 32);
+ 8003194:	f002 f9ba 	bl	800550c <sha256_update>
+    sha256_update(&ctx, args, sizeof(args));
+ 8003198:	2208      	movs	r2, #8
+ 800319a:	eb0d 0102 	add.w	r1, sp, r2
+ 800319e:	a819      	add	r0, sp, #100	; 0x64
+ 80031a0:	f002 f9b4 	bl	800550c <sha256_update>
+    sha256_update(&ctx, (const uint8_t *)&expected_value, 4);
+ 80031a4:	463a      	mov	r2, r7
+ 80031a6:	eb0d 0107 	add.w	r1, sp, r7
+ 80031aa:	a819      	add	r0, sp, #100	; 0x64
+ 80031ac:	f002 f9ae 	bl	800550c <sha256_update>
+    sha256_update(&ctx, zeros, 20);
+ 80031b0:	2214      	movs	r2, #20
+ 80031b2:	a911      	add	r1, sp, #68	; 0x44
+ 80031b4:	a819      	add	r0, sp, #100	; 0x64
+ 80031b6:	f002 f9a9 	bl	800550c <sha256_update>
+    sha256_update(&ctx, tempkey, 32);
+ 80031ba:	a909      	add	r1, sp, #36	; 0x24
+ 80031bc:	a819      	add	r0, sp, #100	; 0x64
+ 80031be:	2220      	movs	r2, #32
+ 80031c0:	f002 f9a4 	bl	800550c <sha256_update>
+
+    sha256_final(&ctx, digest);
+ 80031c4:	4631      	mov	r1, r6
+ 80031c6:	a819      	add	r0, sp, #100	; 0x64
+ 80031c8:	f002 f9e6 	bl	8005598 <sha256_final>
+
+    return 0;
+}
+ 80031cc:	4620      	mov	r0, r4
+ 80031ce:	b02d      	add	sp, #180	; 0xb4
+ 80031d0:	bdf0      	pop	{r4, r5, r6, r7, pc}
+
+080031d2 <ae_get_counter>:
+{
+ 80031d2:	b570      	push	{r4, r5, r6, lr}
+    ae_send(OP_Counter, 0x0, counter_number);
+ 80031d4:	460a      	mov	r2, r1
+{
+ 80031d6:	b088      	sub	sp, #32
+ 80031d8:	4606      	mov	r6, r0
+ 80031da:	460d      	mov	r5, r1
+    ae_send(OP_Counter, 0x0, counter_number);
+ 80031dc:	2024      	movs	r0, #36	; 0x24
+ 80031de:	2100      	movs	r1, #0
+ 80031e0:	f7ff fcc3 	bl	8002b6a <ae_send>
+    int rv = ae_read_n(4, (uint8_t *)result);
+ 80031e4:	4631      	mov	r1, r6
+ 80031e6:	2004      	movs	r0, #4
+ 80031e8:	f7ff fc52 	bl	8002a90 <ae_read_n>
+    RET_IF_BAD(rv);
+ 80031ec:	4604      	mov	r4, r0
+ 80031ee:	b960      	cbnz	r0, 800320a <ae_get_counter+0x38>
+    rv = ae_gendig_counter(counter_number, *result, digest);
+ 80031f0:	6831      	ldr	r1, [r6, #0]
+ 80031f2:	466a      	mov	r2, sp
+ 80031f4:	4628      	mov	r0, r5
+ 80031f6:	f7ff ff90 	bl	800311a <ae_gendig_counter>
+	RET_IF_BAD(rv);
+ 80031fa:	4604      	mov	r4, r0
+ 80031fc:	b928      	cbnz	r0, 800320a <ae_get_counter+0x38>
+    if(!ae_is_correct_tempkey(digest)) {
+ 80031fe:	4668      	mov	r0, sp
+ 8003200:	f7ff fd1c 	bl	8002c3c <ae_is_correct_tempkey>
+ 8003204:	b908      	cbnz	r0, 800320a <ae_get_counter+0x38>
+        fatal_mitm();
+ 8003206:	f7fd fc29 	bl	8000a5c <fatal_mitm>
+}
+ 800320a:	4620      	mov	r0, r4
+ 800320c:	b008      	add	sp, #32
+ 800320e:	bd70      	pop	{r4, r5, r6, pc}
+
+08003210 <ae_add_counter>:
+{
+ 8003210:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+ 8003214:	4606      	mov	r6, r0
+ 8003216:	b089      	sub	sp, #36	; 0x24
+ 8003218:	460d      	mov	r5, r1
+ 800321a:	4617      	mov	r7, r2
+    for(int i=0; i<incr; i++) {
+ 800321c:	f04f 0800 	mov.w	r8, #0
+        ae_send(OP_Counter, 0x1, counter_number);
+ 8003220:	fa1f f981 	uxth.w	r9, r1
+    for(int i=0; i<incr; i++) {
+ 8003224:	45b8      	cmp	r8, r7
+ 8003226:	db0c      	blt.n	8003242 <ae_add_counter+0x32>
+    int rv = ae_gendig_counter(counter_number, *result, digest);
+ 8003228:	6831      	ldr	r1, [r6, #0]
+ 800322a:	466a      	mov	r2, sp
+ 800322c:	4628      	mov	r0, r5
+ 800322e:	f7ff ff74 	bl	800311a <ae_gendig_counter>
+	RET_IF_BAD(rv);
+ 8003232:	4604      	mov	r4, r0
+ 8003234:	b998      	cbnz	r0, 800325e <ae_add_counter+0x4e>
+    if(!ae_is_correct_tempkey(digest)) {
+ 8003236:	4668      	mov	r0, sp
+ 8003238:	f7ff fd00 	bl	8002c3c <ae_is_correct_tempkey>
+ 800323c:	b978      	cbnz	r0, 800325e <ae_add_counter+0x4e>
+        fatal_mitm();
+ 800323e:	f7fd fc0d 	bl	8000a5c <fatal_mitm>
+        ae_send(OP_Counter, 0x1, counter_number);
+ 8003242:	464a      	mov	r2, r9
+ 8003244:	2101      	movs	r1, #1
+ 8003246:	2024      	movs	r0, #36	; 0x24
+ 8003248:	f7ff fc8f 	bl	8002b6a <ae_send>
+        int rv = ae_read_n(4, (uint8_t *)result);
+ 800324c:	4631      	mov	r1, r6
+ 800324e:	2004      	movs	r0, #4
+ 8003250:	f7ff fc1e 	bl	8002a90 <ae_read_n>
+        RET_IF_BAD(rv);
+ 8003254:	4604      	mov	r4, r0
+ 8003256:	b910      	cbnz	r0, 800325e <ae_add_counter+0x4e>
+    for(int i=0; i<incr; i++) {
+ 8003258:	f108 0801 	add.w	r8, r8, #1
+ 800325c:	e7e2      	b.n	8003224 <ae_add_counter+0x14>
+}
+ 800325e:	4620      	mov	r0, r4
+ 8003260:	b009      	add	sp, #36	; 0x24
+ 8003262:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+
+08003266 <ae_encrypted_read32>:
+// ae_encrypted_read32()
+//
+    int
+ae_encrypted_read32(int data_slot, int blk,
+                    int read_kn, const uint8_t read_key[32], uint8_t data[32])
+{
+ 8003266:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8003268:	b08b      	sub	sp, #44	; 0x2c
+ 800326a:	4617      	mov	r7, r2
+ 800326c:	460e      	mov	r6, r1
+ 800326e:	9d10      	ldr	r5, [sp, #64]	; 0x40
+ 8003270:	9301      	str	r3, [sp, #4]
+ 8003272:	4604      	mov	r4, r0
+    uint8_t     digest[32];
+
+    ae_pair_unlock();
+ 8003274:	f7ff fdb2 	bl	8002ddc <ae_pair_unlock>
+
+    int rv = ae_gendig_slot(read_kn, read_key, digest);
+ 8003278:	9901      	ldr	r1, [sp, #4]
+ 800327a:	aa02      	add	r2, sp, #8
+ 800327c:	4638      	mov	r0, r7
+ 800327e:	f7ff fecd 	bl	800301c <ae_gendig_slot>
+    RET_IF_BAD(rv);
+ 8003282:	b9c0      	cbnz	r0, 80032b6 <ae_encrypted_read32+0x50>
+
+    // read nth 32-byte "block"
+    ae_send(OP_Read, 0x82, (blk << 8) | (data_slot<<3));
+ 8003284:	00e4      	lsls	r4, r4, #3
+ 8003286:	ea44 2206 	orr.w	r2, r4, r6, lsl #8
+ 800328a:	2182      	movs	r1, #130	; 0x82
+ 800328c:	2002      	movs	r0, #2
+ 800328e:	b292      	uxth	r2, r2
+ 8003290:	f7ff fc6b 	bl	8002b6a <ae_send>
+
+    rv = ae_read_n(32, data);
+ 8003294:	4629      	mov	r1, r5
+ 8003296:	2020      	movs	r0, #32
+ 8003298:	f7ff fbfa 	bl	8002a90 <ae_read_n>
+    RET_IF_BAD(rv);
+ 800329c:	b958      	cbnz	r0, 80032b6 <ae_encrypted_read32+0x50>
+ 800329e:	1e6a      	subs	r2, r5, #1
+ 80032a0:	ab02      	add	r3, sp, #8
+ 80032a2:	351f      	adds	r5, #31
+		*(acc) ^= *(more);
+ 80032a4:	f812 1f01 	ldrb.w	r1, [r2, #1]!
+ 80032a8:	f813 4b01 	ldrb.w	r4, [r3], #1
+	for(; len; len--, more++, acc++) {
+ 80032ac:	4295      	cmp	r5, r2
+		*(acc) ^= *(more);
+ 80032ae:	ea81 0104 	eor.w	r1, r1, r4
+ 80032b2:	7011      	strb	r1, [r2, #0]
+	for(; len; len--, more++, acc++) {
+ 80032b4:	d1f6      	bne.n	80032a4 <ae_encrypted_read32+0x3e>
+
+    xor_mixin(data, digest, 32);
+
+    return 0;
+}
+ 80032b6:	b00b      	add	sp, #44	; 0x2c
+ 80032b8:	bdf0      	pop	{r4, r5, r6, r7, pc}
+	...
+
+080032bc <ae_encrypted_read>:
+
+// ae_encrypted_read()
+//
+    int
+ae_encrypted_read(int data_slot, int read_kn, const uint8_t read_key[32], uint8_t *data, int len)
+{
+ 80032bc:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+ 80032c0:	b08b      	sub	sp, #44	; 0x2c
+ 80032c2:	4607      	mov	r7, r0
+ 80032c4:	9d12      	ldr	r5, [sp, #72]	; 0x48
+    // not clear if chip supports 4-byte encrypted reads 
+    ASSERT((len == 32) || (len == 72));
+ 80032c6:	2d20      	cmp	r5, #32
+{
+ 80032c8:	4688      	mov	r8, r1
+ 80032ca:	4691      	mov	r9, r2
+ 80032cc:	461e      	mov	r6, r3
+    ASSERT((len == 32) || (len == 72));
+ 80032ce:	d004      	beq.n	80032da <ae_encrypted_read+0x1e>
+ 80032d0:	2d48      	cmp	r5, #72	; 0x48
+ 80032d2:	d002      	beq.n	80032da <ae_encrypted_read+0x1e>
+ 80032d4:	4815      	ldr	r0, [pc, #84]	; (800332c <ae_encrypted_read+0x70>)
+ 80032d6:	f7fd fbb7 	bl	8000a48 <fatal_error>
+
+    int rv = ae_encrypted_read32(data_slot, 0, read_kn, read_key, data);
+ 80032da:	9600      	str	r6, [sp, #0]
+ 80032dc:	464b      	mov	r3, r9
+ 80032de:	4642      	mov	r2, r8
+ 80032e0:	2100      	movs	r1, #0
+ 80032e2:	4638      	mov	r0, r7
+ 80032e4:	f7ff ffbf 	bl	8003266 <ae_encrypted_read32>
+    RET_IF_BAD(rv);
+ 80032e8:	4604      	mov	r4, r0
+ 80032ea:	b9d0      	cbnz	r0, 8003322 <ae_encrypted_read+0x66>
+
+    if(len == 32) return 0;
+ 80032ec:	2d20      	cmp	r5, #32
+ 80032ee:	d018      	beq.n	8003322 <ae_encrypted_read+0x66>
+
+    rv = ae_encrypted_read32(data_slot, 1, read_kn, read_key, data+32);
+ 80032f0:	f106 0320 	add.w	r3, r6, #32
+ 80032f4:	9300      	str	r3, [sp, #0]
+ 80032f6:	4642      	mov	r2, r8
+ 80032f8:	464b      	mov	r3, r9
+ 80032fa:	2101      	movs	r1, #1
+ 80032fc:	4638      	mov	r0, r7
+ 80032fe:	f7ff ffb2 	bl	8003266 <ae_encrypted_read32>
+    RET_IF_BAD(rv);
+ 8003302:	4604      	mov	r4, r0
+ 8003304:	b968      	cbnz	r0, 8003322 <ae_encrypted_read+0x66>
+
+    uint8_t tmp[32];
+    rv = ae_encrypted_read32(data_slot, 2, read_kn, read_key, tmp);
+ 8003306:	ad02      	add	r5, sp, #8
+ 8003308:	9500      	str	r5, [sp, #0]
+ 800330a:	464b      	mov	r3, r9
+ 800330c:	4642      	mov	r2, r8
+ 800330e:	2102      	movs	r1, #2
+ 8003310:	4638      	mov	r0, r7
+ 8003312:	f7ff ffa8 	bl	8003266 <ae_encrypted_read32>
+    RET_IF_BAD(rv);
+ 8003316:	4604      	mov	r4, r0
+ 8003318:	b918      	cbnz	r0, 8003322 <ae_encrypted_read+0x66>
+
+    memcpy(data+64, tmp, 72-64);
+ 800331a:	462a      	mov	r2, r5
+ 800331c:	ca03      	ldmia	r2!, {r0, r1}
+ 800331e:	6430      	str	r0, [r6, #64]	; 0x40
+ 8003320:	6471      	str	r1, [r6, #68]	; 0x44
+
+    return 0;
+}
+ 8003322:	4620      	mov	r0, r4
+ 8003324:	b00b      	add	sp, #44	; 0x2c
+ 8003326:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+ 800332a:	bf00      	nop
+ 800332c:	0800e466 	.word	0x0800e466
+
+08003330 <ae_encrypted_write32>:
+// ae_encrypted_write()
+//
+    int
+ae_encrypted_write32(int data_slot, int blk, int write_kn,
+                        const uint8_t write_key[32], const uint8_t data[32])
+{
+ 8003330:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 8003334:	b0b8      	sub	sp, #224	; 0xe0
+ 8003336:	4617      	mov	r7, r2
+ 8003338:	460d      	mov	r5, r1
+ 800333a:	9e3e      	ldr	r6, [sp, #248]	; 0xf8
+ 800333c:	9303      	str	r3, [sp, #12]
+ 800333e:	4604      	mov	r4, r0
+    uint8_t digest[32];
+
+    ae_pair_unlock();
+ 8003340:	f7ff fd4c 	bl	8002ddc <ae_pair_unlock>
+
+    // generate a hash over shared secret and rng
+    int rv = ae_gendig_slot(write_kn, write_key, digest);
+ 8003344:	9903      	ldr	r1, [sp, #12]
+ 8003346:	aa0d      	add	r2, sp, #52	; 0x34
+ 8003348:	4638      	mov	r0, r7
+ 800334a:	f7ff fe67 	bl	800301c <ae_gendig_slot>
+    RET_IF_BAD(rv);
+ 800334e:	2800      	cmp	r0, #0
+ 8003350:	d151      	bne.n	80033f6 <ae_encrypted_write32+0xc6>
+ 8003352:	1e72      	subs	r2, r6, #1
+ 8003354:	af0d      	add	r7, sp, #52	; 0x34
+ 8003356:	a915      	add	r1, sp, #84	; 0x54
+ 8003358:	f106 0c1f 	add.w	ip, r6, #31
+
+    // encrypt the data to be written, and append an authenticating MAC
+    uint8_t body[32 + 32];
+
+    for(int i=0; i<32; i++) {
+        body[i] = data[i] ^ digest[i];
+ 800335c:	f812 ef01 	ldrb.w	lr, [r2, #1]!
+ 8003360:	f817 0b01 	ldrb.w	r0, [r7], #1
+    for(int i=0; i<32; i++) {
+ 8003364:	4562      	cmp	r2, ip
+        body[i] = data[i] ^ digest[i];
+ 8003366:	ea80 000e 	eor.w	r0, r0, lr
+ 800336a:	f801 0b01 	strb.w	r0, [r1], #1
+    for(int i=0; i<32; i++) {
+ 800336e:	d1f5      	bne.n	800335c <ae_encrypted_write32+0x2c>
+	//	    + (b'\0'*25)
+	//	    + new_value)
+	//	assert len(msg) == 32+1+1+2+1+2+25+32
+	//		
+	SHA256_CTX ctx;
+    sha256_init(&ctx);
+ 8003370:	a825      	add	r0, sp, #148	; 0x94
+ 8003372:	f002 f8bd 	bl	80054f0 <sha256_init>
+
+    uint8_t p1 = 0x80|2;        // 32 bytes into a data slot
+    uint8_t p2_lsb = (data_slot << 3); 
+    uint8_t p2_msb = blk;
+
+	uint8_t args[7] = { OP_Write, p1, p2_lsb, p2_msb, 0xEE, 0x01, 0x23 };
+ 8003376:	22ee      	movs	r2, #238	; 0xee
+ 8003378:	f88d 2014 	strb.w	r2, [sp, #20]
+ 800337c:	2201      	movs	r2, #1
+ 800337e:	f88d 2015 	strb.w	r2, [sp, #21]
+    uint8_t p2_lsb = (data_slot << 3); 
+ 8003382:	00e4      	lsls	r4, r4, #3
+	uint8_t args[7] = { OP_Write, p1, p2_lsb, p2_msb, 0xEE, 0x01, 0x23 };
+ 8003384:	2223      	movs	r2, #35	; 0x23
+    uint8_t zeros[25] = { 0 };
+ 8003386:	2100      	movs	r1, #0
+    uint8_t p2_lsb = (data_slot << 3); 
+ 8003388:	b2e4      	uxtb	r4, r4
+	uint8_t args[7] = { OP_Write, p1, p2_lsb, p2_msb, 0xEE, 0x01, 0x23 };
+ 800338a:	2712      	movs	r7, #18
+ 800338c:	f04f 0882 	mov.w	r8, #130	; 0x82
+ 8003390:	f88d 2016 	strb.w	r2, [sp, #22]
+    uint8_t zeros[25] = { 0 };
+ 8003394:	a807      	add	r0, sp, #28
+ 8003396:	2215      	movs	r2, #21
+ 8003398:	9106      	str	r1, [sp, #24]
+	uint8_t args[7] = { OP_Write, p1, p2_lsb, p2_msb, 0xEE, 0x01, 0x23 };
+ 800339a:	f88d 7010 	strb.w	r7, [sp, #16]
+ 800339e:	f88d 8011 	strb.w	r8, [sp, #17]
+ 80033a2:	f88d 4012 	strb.w	r4, [sp, #18]
+    uint8_t p2_msb = blk;
+ 80033a6:	f88d 5013 	strb.w	r5, [sp, #19]
+    uint8_t zeros[25] = { 0 };
+ 80033aa:	f00a f995 	bl	800d6d8 <memset>
+
+    sha256_update(&ctx, digest, 32);
+ 80033ae:	2220      	movs	r2, #32
+ 80033b0:	a90d      	add	r1, sp, #52	; 0x34
+ 80033b2:	a825      	add	r0, sp, #148	; 0x94
+ 80033b4:	f002 f8aa 	bl	800550c <sha256_update>
+    sha256_update(&ctx, args, sizeof(args));
+ 80033b8:	2207      	movs	r2, #7
+ 80033ba:	a904      	add	r1, sp, #16
+ 80033bc:	a825      	add	r0, sp, #148	; 0x94
+ 80033be:	f002 f8a5 	bl	800550c <sha256_update>
+    sha256_update(&ctx, zeros, sizeof(zeros));
+ 80033c2:	2219      	movs	r2, #25
+ 80033c4:	a906      	add	r1, sp, #24
+ 80033c6:	a825      	add	r0, sp, #148	; 0x94
+ 80033c8:	f002 f8a0 	bl	800550c <sha256_update>
+    sha256_update(&ctx, data, 32);
+ 80033cc:	2220      	movs	r2, #32
+ 80033ce:	4631      	mov	r1, r6
+ 80033d0:	a825      	add	r0, sp, #148	; 0x94
+ 80033d2:	f002 f89b 	bl	800550c <sha256_update>
+
+    sha256_final(&ctx, &body[32]);
+ 80033d6:	a91d      	add	r1, sp, #116	; 0x74
+ 80033d8:	a825      	add	r0, sp, #148	; 0x94
+ 80033da:	f002 f8dd 	bl	8005598 <sha256_final>
+
+    ae_send_n(OP_Write, p1, (p2_msb << 8) | p2_lsb, body, sizeof(body));
+ 80033de:	2140      	movs	r1, #64	; 0x40
+ 80033e0:	ea44 2205 	orr.w	r2, r4, r5, lsl #8
+ 80033e4:	b292      	uxth	r2, r2
+ 80033e6:	9100      	str	r1, [sp, #0]
+ 80033e8:	ab15      	add	r3, sp, #84	; 0x54
+ 80033ea:	4641      	mov	r1, r8
+ 80033ec:	4638      	mov	r0, r7
+ 80033ee:	f7ff fb89 	bl	8002b04 <ae_send_n>
+
+    return ae_read1();
+ 80033f2:	f7ff fb31 	bl	8002a58 <ae_read1>
+}
+ 80033f6:	b038      	add	sp, #224	; 0xe0
+ 80033f8:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+
+080033fc <ae_encrypted_write>:
+// ae_encrypted_write()
+//
+    int
+ae_encrypted_write(int data_slot, int write_kn, const uint8_t write_key[32],
+                        const uint8_t *data, int len)
+{
+ 80033fc:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 8003400:	b08a      	sub	sp, #40	; 0x28
+    ASSERT(data_slot >= 0);
+    ASSERT(data_slot <= 15);
+ 8003402:	280f      	cmp	r0, #15
+{
+ 8003404:	9d12      	ldr	r5, [sp, #72]	; 0x48
+ 8003406:	4606      	mov	r6, r0
+ 8003408:	460f      	mov	r7, r1
+ 800340a:	4690      	mov	r8, r2
+ 800340c:	4699      	mov	r9, r3
+    ASSERT(data_slot <= 15);
+ 800340e:	d902      	bls.n	8003416 <ae_encrypted_write+0x1a>
+    ASSERT(data_slot >= 0);
+ 8003410:	4814      	ldr	r0, [pc, #80]	; (8003464 <ae_encrypted_write+0x68>)
+ 8003412:	f7fd fb19 	bl	8000a48 <fatal_error>
+
+    for(int blk=0; blk<3 && len>0; blk++, len-=32) {
+ 8003416:	2400      	movs	r4, #0
+        int here = MIN(32, len);
+
+        // be nice and don't read past end of input buffer
+        uint8_t     tmp[32] = { 0 };
+ 8003418:	46a2      	mov	sl, r4
+    for(int blk=0; blk<3 && len>0; blk++, len-=32) {
+ 800341a:	2d00      	cmp	r5, #0
+ 800341c:	dd1d      	ble.n	800345a <ae_encrypted_write+0x5e>
+        uint8_t     tmp[32] = { 0 };
+ 800341e:	221c      	movs	r2, #28
+ 8003420:	2100      	movs	r1, #0
+ 8003422:	a803      	add	r0, sp, #12
+ 8003424:	f8cd a008 	str.w	sl, [sp, #8]
+ 8003428:	f00a f956 	bl	800d6d8 <memset>
+        memcpy(tmp, data+(32*blk), here);
+ 800342c:	ab02      	add	r3, sp, #8
+ 800342e:	2d20      	cmp	r5, #32
+ 8003430:	462a      	mov	r2, r5
+ 8003432:	eb09 1144 	add.w	r1, r9, r4, lsl #5
+ 8003436:	bfa8      	it	ge
+ 8003438:	2220      	movge	r2, #32
+ 800343a:	4618      	mov	r0, r3
+ 800343c:	f00a f924 	bl	800d688 <memcpy>
+
+        int rv = ae_encrypted_write32(data_slot, blk, write_kn, write_key, tmp);
+ 8003440:	4643      	mov	r3, r8
+ 8003442:	9000      	str	r0, [sp, #0]
+ 8003444:	463a      	mov	r2, r7
+ 8003446:	4621      	mov	r1, r4
+ 8003448:	4630      	mov	r0, r6
+ 800344a:	f7ff ff71 	bl	8003330 <ae_encrypted_write32>
+        RET_IF_BAD(rv);
+ 800344e:	b928      	cbnz	r0, 800345c <ae_encrypted_write+0x60>
+    for(int blk=0; blk<3 && len>0; blk++, len-=32) {
+ 8003450:	3401      	adds	r4, #1
+ 8003452:	2c03      	cmp	r4, #3
+ 8003454:	f1a5 0520 	sub.w	r5, r5, #32
+ 8003458:	d1df      	bne.n	800341a <ae_encrypted_write+0x1e>
+    }
+
+    return 0;
+ 800345a:	2000      	movs	r0, #0
+}
+ 800345c:	b00a      	add	sp, #40	; 0x28
+ 800345e:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+ 8003462:	bf00      	nop
+ 8003464:	0800e466 	.word	0x0800e466
+
+08003468 <ae_read_data_slot>:
+
+// ae_read_data_slot()
+//
+    int
+ae_read_data_slot(int slot_num, uint8_t *data, int len)
+{
+ 8003468:	b570      	push	{r4, r5, r6, lr}
+    ASSERT((len == 4) || (len == 32) || (len == 72));
+ 800346a:	2a04      	cmp	r2, #4
+{
+ 800346c:	b088      	sub	sp, #32
+ 800346e:	460d      	mov	r5, r1
+ 8003470:	4616      	mov	r6, r2
+    ASSERT((len == 4) || (len == 32) || (len == 72));
+ 8003472:	d006      	beq.n	8003482 <ae_read_data_slot+0x1a>
+ 8003474:	2a20      	cmp	r2, #32
+ 8003476:	d038      	beq.n	80034ea <ae_read_data_slot+0x82>
+ 8003478:	2a48      	cmp	r2, #72	; 0x48
+ 800347a:	d036      	beq.n	80034ea <ae_read_data_slot+0x82>
+ 800347c:	481c      	ldr	r0, [pc, #112]	; (80034f0 <ae_read_data_slot+0x88>)
+ 800347e:	f7fd fae3 	bl	8000a48 <fatal_error>
+
+    // zone => data
+    // only reading first block of 32 bytes. ignore the rest
+    ae_send(OP_Read, (len == 4 ? 0x00 : 0x80) | 2, (slot_num<<3));
+ 8003482:	2102      	movs	r1, #2
+ 8003484:	00c4      	lsls	r4, r0, #3
+ 8003486:	b2a2      	uxth	r2, r4
+ 8003488:	2002      	movs	r0, #2
+ 800348a:	f7ff fb6e 	bl	8002b6a <ae_send>
+
+    int rv = ae_read_n((len == 4) ? 4 : 32, data);
+ 800348e:	2e04      	cmp	r6, #4
+ 8003490:	4629      	mov	r1, r5
+ 8003492:	bf0c      	ite	eq
+ 8003494:	2004      	moveq	r0, #4
+ 8003496:	2020      	movne	r0, #32
+ 8003498:	f7ff fafa 	bl	8002a90 <ae_read_n>
+    RET_IF_BAD(rv);
+ 800349c:	4603      	mov	r3, r0
+ 800349e:	bb08      	cbnz	r0, 80034e4 <ae_read_data_slot+0x7c>
+
+    if(len == 72) {
+ 80034a0:	2e48      	cmp	r6, #72	; 0x48
+ 80034a2:	d11f      	bne.n	80034e4 <ae_read_data_slot+0x7c>
+        // read second block
+        ae_send(OP_Read, 0x82, (1<<8) | (slot_num<<3));
+ 80034a4:	b224      	sxth	r4, r4
+ 80034a6:	f444 7280 	orr.w	r2, r4, #256	; 0x100
+ 80034aa:	b292      	uxth	r2, r2
+ 80034ac:	2182      	movs	r1, #130	; 0x82
+ 80034ae:	2002      	movs	r0, #2
+ 80034b0:	f7ff fb5b 	bl	8002b6a <ae_send>
+
+        int rv = ae_read_n(32, data+32);
+ 80034b4:	f105 0120 	add.w	r1, r5, #32
+ 80034b8:	2020      	movs	r0, #32
+ 80034ba:	f7ff fae9 	bl	8002a90 <ae_read_n>
+        RET_IF_BAD(rv);
+ 80034be:	4603      	mov	r3, r0
+ 80034c0:	b980      	cbnz	r0, 80034e4 <ae_read_data_slot+0x7c>
+
+        // read third block, but only using part of it
+        uint8_t     tmp[32];
+        ae_send(OP_Read, 0x82, (2<<8) | (slot_num<<3));
+ 80034c2:	f444 7400 	orr.w	r4, r4, #512	; 0x200
+ 80034c6:	b2a2      	uxth	r2, r4
+ 80034c8:	2182      	movs	r1, #130	; 0x82
+ 80034ca:	2002      	movs	r0, #2
+ 80034cc:	f7ff fb4d 	bl	8002b6a <ae_send>
+
+        rv = ae_read_n(32, tmp);
+ 80034d0:	4669      	mov	r1, sp
+ 80034d2:	2020      	movs	r0, #32
+ 80034d4:	f7ff fadc 	bl	8002a90 <ae_read_n>
+        RET_IF_BAD(rv);
+ 80034d8:	4603      	mov	r3, r0
+ 80034da:	b918      	cbnz	r0, 80034e4 <ae_read_data_slot+0x7c>
+
+        memcpy(data+64, tmp, 72-64);
+ 80034dc:	466a      	mov	r2, sp
+ 80034de:	ca03      	ldmia	r2!, {r0, r1}
+ 80034e0:	6428      	str	r0, [r5, #64]	; 0x40
+ 80034e2:	6469      	str	r1, [r5, #68]	; 0x44
+    }
+
+    return 0;
+}
+ 80034e4:	4618      	mov	r0, r3
+ 80034e6:	b008      	add	sp, #32
+ 80034e8:	bd70      	pop	{r4, r5, r6, pc}
+    ae_send(OP_Read, (len == 4 ? 0x00 : 0x80) | 2, (slot_num<<3));
+ 80034ea:	2182      	movs	r1, #130	; 0x82
+ 80034ec:	e7ca      	b.n	8003484 <ae_read_data_slot+0x1c>
+ 80034ee:	bf00      	nop
+ 80034f0:	0800e466 	.word	0x0800e466
+
+080034f4 <ae_set_gpio>:
+
+// ae_set_gpio()
+//
+    int
+ae_set_gpio(int state)
+{
+ 80034f4:	b513      	push	{r0, r1, r4, lr}
+    // 1=turn on green, 0=red light (if not yet configured to be secure)
+    ae_send(OP_Info, 3, 2 | (!!state));
+ 80034f6:	1e04      	subs	r4, r0, #0
+ 80034f8:	bf14      	ite	ne
+ 80034fa:	2203      	movne	r2, #3
+ 80034fc:	2202      	moveq	r2, #2
+ 80034fe:	2103      	movs	r1, #3
+ 8003500:	2030      	movs	r0, #48	; 0x30
+ 8003502:	f7ff fb32 	bl	8002b6a <ae_send>
+
+    // "Always return the current state in the first byte followed by three bytes of 0x00"
+    // - simple 1/0, in LSB.
+    uint8_t resp[4];
+
+    int rv = ae_read_n(4, resp);
+ 8003506:	a901      	add	r1, sp, #4
+ 8003508:	2004      	movs	r0, #4
+ 800350a:	f7ff fac1 	bl	8002a90 <ae_read_n>
+	RET_IF_BAD(rv);
+ 800350e:	b928      	cbnz	r0, 800351c <ae_set_gpio+0x28>
+
+    return (resp[0] != state) ? -1 : 0;
+ 8003510:	f89d 0004 	ldrb.w	r0, [sp, #4]
+ 8003514:	1b00      	subs	r0, r0, r4
+ 8003516:	bf18      	it	ne
+ 8003518:	f04f 30ff 	movne.w	r0, #4294967295	; 0xffffffff
+}
+ 800351c:	b002      	add	sp, #8
+ 800351e:	bd10      	pop	{r4, pc}
+
+08003520 <ae_set_gpio_secure>:
+//
+// Set the GPIO using secure hash generated somehow already.
+//
+    int
+ae_set_gpio_secure(uint8_t digest[32])
+{
+ 8003520:	b538      	push	{r3, r4, r5, lr}
+ 8003522:	4605      	mov	r5, r0
+    ae_pair_unlock();
+ 8003524:	f7ff fc5a 	bl	8002ddc <ae_pair_unlock>
+    ae_checkmac(KEYNUM_firmware, digest);
+ 8003528:	4629      	mov	r1, r5
+ 800352a:	200e      	movs	r0, #14
+ 800352c:	f7ff fbd4 	bl	8002cd8 <ae_checkmac>
+
+    int rv = ae_set_gpio(1);
+ 8003530:	2001      	movs	r0, #1
+ 8003532:	f7ff ffdf 	bl	80034f4 <ae_set_gpio>
+
+    if(rv == 0) {
+ 8003536:	4604      	mov	r4, r0
+ 8003538:	b940      	cbnz	r0, 800354c <ae_set_gpio_secure+0x2c>
+        // trust that readback, and so do a verify that the chip has 
+        // the digest we think it does. If MitM wanted to turn off the output,
+        // they can do that anytime regardless. We just don't want them to be
+        // able to fake it being set, and therefore bypass the
+        // "unsigned firmware" delay and warning.
+        ae_pair_unlock();
+ 800353a:	f7ff fc4f 	bl	8002ddc <ae_pair_unlock>
+
+        if(ae_checkmac_hard(KEYNUM_firmware, digest) != 0) {
+ 800353e:	4629      	mov	r1, r5
+ 8003540:	200e      	movs	r0, #14
+ 8003542:	f7ff fdd9 	bl	80030f8 <ae_checkmac_hard>
+ 8003546:	b108      	cbz	r0, 800354c <ae_set_gpio_secure+0x2c>
+            fatal_mitm();
+ 8003548:	f7fd fa88 	bl	8000a5c <fatal_mitm>
+        }
+    }
+
+    return rv;
+}
+ 800354c:	4620      	mov	r0, r4
+ 800354e:	bd38      	pop	{r3, r4, r5, pc}
+
+08003550 <ae_get_gpio>:
+//
+// IMPORTANT: do not trust this result, could be MitM'ed.
+//
+	uint8_t
+ae_get_gpio(void)
+{
+ 8003550:	b507      	push	{r0, r1, r2, lr}
+	// not doing error checking here
+	ae_send(OP_Info, 0x3, 0);
+ 8003552:	2200      	movs	r2, #0
+ 8003554:	2103      	movs	r1, #3
+ 8003556:	2030      	movs	r0, #48	; 0x30
+ 8003558:	f7ff fb07 	bl	8002b6a <ae_send>
+
+	// note: always returns 4 bytes, but most are garbage and unused.
+	uint8_t tmp[4];
+	ae_read_n(4, tmp);
+ 800355c:	a901      	add	r1, sp, #4
+ 800355e:	2004      	movs	r0, #4
+ 8003560:	f7ff fa96 	bl	8002a90 <ae_read_n>
+
+	return tmp[0];
+}
+ 8003564:	f89d 0004 	ldrb.w	r0, [sp, #4]
+ 8003568:	b003      	add	sp, #12
+ 800356a:	f85d fb04 	ldr.w	pc, [sp], #4
+
+0800356e <ae_read_config_word>:
+//
+// Read a 4-byte area from config area, or -1 if fail.
+//
+    int
+ae_read_config_word(int offset, uint8_t *dest)
+{
+ 800356e:	b510      	push	{r4, lr}
+    offset &= 0x7f;
+
+    // read 32 bits (aligned)
+    ae_send(OP_Read, 0x00, offset/4);
+ 8003570:	f3c0 0284 	ubfx	r2, r0, #2, #5
+{
+ 8003574:	460c      	mov	r4, r1
+    ae_send(OP_Read, 0x00, offset/4);
+ 8003576:	2002      	movs	r0, #2
+ 8003578:	2100      	movs	r1, #0
+ 800357a:	f7ff faf6 	bl	8002b6a <ae_send>
+
+	int rv = ae_read_n(4, dest);
+ 800357e:	4621      	mov	r1, r4
+ 8003580:	2004      	movs	r0, #4
+ 8003582:	f7ff fa85 	bl	8002a90 <ae_read_n>
+    if(rv) return -1;
+ 8003586:	3800      	subs	r0, #0
+ 8003588:	bf18      	it	ne
+ 800358a:	2001      	movne	r0, #1
+
+    return 0;
+}
+ 800358c:	4240      	negs	r0, r0
+ 800358e:	bd10      	pop	{r4, pc}
+
+08003590 <ae_read_config_byte>:
+{
+ 8003590:	b513      	push	{r0, r1, r4, lr}
+ 8003592:	4604      	mov	r4, r0
+    ae_read_config_word(offset, tmp);
+ 8003594:	a901      	add	r1, sp, #4
+ 8003596:	f7ff ffea 	bl	800356e <ae_read_config_word>
+	return tmp[offset % 4];
+ 800359a:	4263      	negs	r3, r4
+ 800359c:	f003 0303 	and.w	r3, r3, #3
+ 80035a0:	f004 0403 	and.w	r4, r4, #3
+ 80035a4:	bf58      	it	pl
+ 80035a6:	425c      	negpl	r4, r3
+ 80035a8:	f104 0308 	add.w	r3, r4, #8
+ 80035ac:	eb0d 0403 	add.w	r4, sp, r3
+}
+ 80035b0:	f814 0c04 	ldrb.w	r0, [r4, #-4]
+ 80035b4:	b002      	add	sp, #8
+ 80035b6:	bd10      	pop	{r4, pc}
+
+080035b8 <ae_destroy_key>:
+
+// ae_destroy_key()
+//
+    int
+ae_destroy_key(int keynum)
+{
+ 80035b8:	b510      	push	{r4, lr}
+ 80035ba:	b090      	sub	sp, #64	; 0x40
+	uint8_t numin[20];
+
+	// Load tempkey with a known (random) nonce value
+	rng_buffer(numin, sizeof(numin));
+ 80035bc:	2114      	movs	r1, #20
+{
+ 80035be:	4604      	mov	r4, r0
+	rng_buffer(numin, sizeof(numin));
+ 80035c0:	a803      	add	r0, sp, #12
+ 80035c2:	f7ff f8db 	bl	800277c <rng_buffer>
+    ae_send_n(OP_Nonce, 0, 0, numin, 20);
+ 80035c6:	2314      	movs	r3, #20
+ 80035c8:	2200      	movs	r2, #0
+ 80035ca:	9300      	str	r3, [sp, #0]
+ 80035cc:	4611      	mov	r1, r2
+ 80035ce:	2016      	movs	r0, #22
+ 80035d0:	ab03      	add	r3, sp, #12
+ 80035d2:	f7ff fa97 	bl	8002b04 <ae_send_n>
+
+	// Nonce command returns the RNG result, not contents of TempKey,
+    // but since we are destroying, no need to calculate what it is.
+	uint8_t randout[32];
+	int rv = ae_read_n(32, randout);
+ 80035d6:	a908      	add	r1, sp, #32
+ 80035d8:	2020      	movs	r0, #32
+ 80035da:	f7ff fa59 	bl	8002a90 <ae_read_n>
+	RET_IF_BAD(rv);
+ 80035de:	b930      	cbnz	r0, 80035ee <ae_destroy_key+0x36>
+
+    // do a "DeriveKey" operation, based on that!
+	ae_send(OP_DeriveKey, 0x00, keynum);
+ 80035e0:	4601      	mov	r1, r0
+ 80035e2:	b2a2      	uxth	r2, r4
+ 80035e4:	201c      	movs	r0, #28
+ 80035e6:	f7ff fac0 	bl	8002b6a <ae_send>
+
+    return ae_read1();
+ 80035ea:	f7ff fa35 	bl	8002a58 <ae_read1>
+}
+ 80035ee:	b010      	add	sp, #64	; 0x40
+ 80035f0:	bd10      	pop	{r4, pc}
+
+080035f2 <ae_config_read>:
+
+// ae_config_read()
+//
+    int 
+ae_config_read(uint8_t config[128])
+{
+ 80035f2:	b538      	push	{r3, r4, r5, lr}
+ 80035f4:	4605      	mov	r5, r0
+    for(int blk=0; blk<4; blk++) {
+ 80035f6:	2400      	movs	r4, #0
+        // read 32 bytes (aligned) from config "zone"
+        ae_send(OP_Read, 0x80, blk<<3);
+ 80035f8:	00e2      	lsls	r2, r4, #3
+ 80035fa:	2180      	movs	r1, #128	; 0x80
+ 80035fc:	2002      	movs	r0, #2
+ 80035fe:	b292      	uxth	r2, r2
+ 8003600:	f7ff fab3 	bl	8002b6a <ae_send>
+
+        int rv = ae_read_n(32, &config[32*blk]);
+ 8003604:	eb05 1144 	add.w	r1, r5, r4, lsl #5
+ 8003608:	2020      	movs	r0, #32
+ 800360a:	f7ff fa41 	bl	8002a90 <ae_read_n>
+        if(rv) return EIO;
+ 800360e:	b918      	cbnz	r0, 8003618 <ae_config_read+0x26>
+    for(int blk=0; blk<4; blk++) {
+ 8003610:	3401      	adds	r4, #1
+ 8003612:	2c04      	cmp	r4, #4
+ 8003614:	d1f0      	bne.n	80035f8 <ae_config_read+0x6>
+    }
+
+    return 0;
+}
+ 8003616:	bd38      	pop	{r3, r4, r5, pc}
+        if(rv) return EIO;
+ 8003618:	2005      	movs	r0, #5
+ 800361a:	e7fc      	b.n	8003616 <ae_config_read+0x24>
+
+0800361c <ae_setup_config>:
+// us to write the (existing) pairing secret into, they would see the pairing
+// secret in cleartext. They could then restore original chip and access freely.
+//
+    int
+ae_setup_config(void)
+{
+ 800361c:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 800361e:	2405      	movs	r4, #5
+ 8003620:	f5ad 7d41 	sub.w	sp, sp, #772	; 0x304
+    // Need to wake up AE, since many things happen before this point.
+    for(int retry=0; retry<5; retry++) {
+        if(!ae_probe()) break;
+ 8003624:	f7ff fc6c 	bl	8002f00 <ae_probe>
+ 8003628:	b108      	cbz	r0, 800362e <ae_setup_config+0x12>
+    for(int retry=0; retry<5; retry++) {
+ 800362a:	3c01      	subs	r4, #1
+ 800362c:	d1fa      	bne.n	8003624 <ae_setup_config+0x8>
+    // Is data zone is locked?
+    // Allow rest of function to happen if it's not.
+
+#if 1
+    //  0x55 = unlocked; 0x00 = locked
+    bool data_locked = (ae_read_config_byte(86) != 0x55);
+ 800362e:	2056      	movs	r0, #86	; 0x56
+ 8003630:	f7ff ffae 	bl	8003590 <ae_read_config_byte>
+    if(data_locked) return 0;       // basically success
+ 8003634:	2855      	cmp	r0, #85	; 0x55
+ 8003636:	f040 80df 	bne.w	80037f8 <ae_setup_config+0x1dc>
+
+    // To lock, we need a CRC over whole thing, but we
+    // only set a few values... plus the serial number is
+    // in there, so start with some readout.
+    uint8_t config[128];
+    int rv = ae_config_read(config);
+ 800363a:	a838      	add	r0, sp, #224	; 0xe0
+ 800363c:	f7ff ffd9 	bl	80035f2 <ae_config_read>
+    if(rv) return rv;
+ 8003640:	4604      	mov	r4, r0
+ 8003642:	2800      	cmp	r0, #0
+ 8003644:	f040 80d9 	bne.w	80037fa <ae_setup_config+0x1de>
+    uint8_t config[128];
+    while(ae_config_read(config)) ;
+#endif
+
+    // verify some fixed values
+    ASSERT(config[0] == 0x01);
+ 8003648:	f89d 30e0 	ldrb.w	r3, [sp, #224]	; 0xe0
+ 800364c:	2b01      	cmp	r3, #1
+ 800364e:	d002      	beq.n	8003656 <ae_setup_config+0x3a>
+ 8003650:	486f      	ldr	r0, [pc, #444]	; (8003810 <ae_setup_config+0x1f4>)
+
+        ae_keep_alive();
+
+        // lock config zone
+        if(ae_lock_config_zone(config)) {
+            INCONSISTENT("conf lock");
+ 8003652:	f7fd f9f9 	bl	8000a48 <fatal_error>
+    ASSERT(config[1] == 0x23);
+ 8003656:	f89d 30e1 	ldrb.w	r3, [sp, #225]	; 0xe1
+ 800365a:	2b23      	cmp	r3, #35	; 0x23
+ 800365c:	d1f8      	bne.n	8003650 <ae_setup_config+0x34>
+    ASSERT(config[12] == 0xee);
+ 800365e:	f89d 30ec 	ldrb.w	r3, [sp, #236]	; 0xec
+ 8003662:	2bee      	cmp	r3, #238	; 0xee
+ 8003664:	d1f4      	bne.n	8003650 <ae_setup_config+0x34>
+    int8_t partno = ((config[6]>>4)&0xf);
+ 8003666:	f89d 30e6 	ldrb.w	r3, [sp, #230]	; 0xe6
+    ASSERT(partno == 6);
+ 800366a:	091b      	lsrs	r3, r3, #4
+ 800366c:	2b06      	cmp	r3, #6
+ 800366e:	d1ef      	bne.n	8003650 <ae_setup_config+0x34>
+	memcpy(serial, &config[0], 4);
+ 8003670:	9b38      	ldr	r3, [sp, #224]	; 0xe0
+ 8003672:	9303      	str	r3, [sp, #12]
+	memcpy(&serial[4], &config[8], 5);
+ 8003674:	ab3a      	add	r3, sp, #232	; 0xe8
+ 8003676:	e893 0003 	ldmia.w	r3, {r0, r1}
+ 800367a:	9004      	str	r0, [sp, #16]
+ 800367c:	f88d 1014 	strb.w	r1, [sp, #20]
+    if(check_all_ones(rom_secrets->ae_serial_number, 9)) {
+ 8003680:	4864      	ldr	r0, [pc, #400]	; (8003814 <ae_setup_config+0x1f8>)
+ 8003682:	2109      	movs	r1, #9
+ 8003684:	f7ff f812 	bl	80026ac <check_all_ones>
+ 8003688:	b110      	cbz	r0, 8003690 <ae_setup_config+0x74>
+        flash_save_ae_serial(serial);
+ 800368a:	a803      	add	r0, sp, #12
+ 800368c:	f7fe fd66 	bl	800215c <flash_save_ae_serial>
+    if(!check_equal(rom_secrets->ae_serial_number, serial, 9)) {
+ 8003690:	4860      	ldr	r0, [pc, #384]	; (8003814 <ae_setup_config+0x1f8>)
+ 8003692:	2209      	movs	r2, #9
+ 8003694:	a903      	add	r1, sp, #12
+ 8003696:	f7ff f822 	bl	80026de <check_equal>
+ 800369a:	2800      	cmp	r0, #0
+ 800369c:	f000 80b6 	beq.w	800380c <ae_setup_config+0x1f0>
+    if(config[87] == 0x55) {
+ 80036a0:	f89d 3137 	ldrb.w	r3, [sp, #311]	; 0x137
+ 80036a4:	2b55      	cmp	r3, #85	; 0x55
+ 80036a6:	d12b      	bne.n	8003700 <ae_setup_config+0xe4>
+        memcpy(&config[16], config_1, sizeof(config_1));
+ 80036a8:	495b      	ldr	r1, [pc, #364]	; (8003818 <ae_setup_config+0x1fc>)
+ 80036aa:	2244      	movs	r2, #68	; 0x44
+ 80036ac:	a83c      	add	r0, sp, #240	; 0xf0
+ 80036ae:	f009 ffeb 	bl	800d688 <memcpy>
+        memcpy(&config[90], config_2, sizeof(config_2));
+ 80036b2:	4b5a      	ldr	r3, [pc, #360]	; (800381c <ae_setup_config+0x200>)
+ 80036b4:	f50d 729d 	add.w	r2, sp, #314	; 0x13a
+ 80036b8:	f103 0124 	add.w	r1, r3, #36	; 0x24
+ 80036bc:	f853 0b04 	ldr.w	r0, [r3], #4
+ 80036c0:	f842 0b04 	str.w	r0, [r2], #4
+ 80036c4:	428b      	cmp	r3, r1
+ 80036c6:	d1f9      	bne.n	80036bc <ae_setup_config+0xa0>
+ 80036c8:	881b      	ldrh	r3, [r3, #0]
+ 80036ca:	8013      	strh	r3, [r2, #0]
+    for(int n=16; n<128; n+= 4) {
+ 80036cc:	2510      	movs	r5, #16
+        ae_send_n(OP_Write, 0, n/4, &config[n], 4);
+ 80036ce:	2604      	movs	r6, #4
+        if(n == 84) continue;       // that word not writable
+ 80036d0:	2d54      	cmp	r5, #84	; 0x54
+ 80036d2:	d130      	bne.n	8003736 <ae_setup_config+0x11a>
+    for(int n=16; n<128; n+= 4) {
+ 80036d4:	3504      	adds	r5, #4
+ 80036d6:	2d80      	cmp	r5, #128	; 0x80
+ 80036d8:	d1fa      	bne.n	80036d0 <ae_setup_config+0xb4>
+	ae_send_idle();
+ 80036da:	f7ff f90a 	bl	80028f2 <ae_send_idle>
+    uint8_t crc[2] = {0, 0};
+ 80036de:	2600      	movs	r6, #0
+    crc16_chain(128, config, crc);
+ 80036e0:	aa58      	add	r2, sp, #352	; 0x160
+ 80036e2:	a938      	add	r1, sp, #224	; 0xe0
+ 80036e4:	4628      	mov	r0, r5
+    uint8_t crc[2] = {0, 0};
+ 80036e6:	f8ad 6160 	strh.w	r6, [sp, #352]	; 0x160
+    crc16_chain(128, config, crc);
+ 80036ea:	f7ff f8b5 	bl	8002858 <crc16_chain>
+    ae_send(OP_Lock, 0x0, (crc[1]<<8) | crc[0]);
+ 80036ee:	f8bd 2160 	ldrh.w	r2, [sp, #352]	; 0x160
+ 80036f2:	4631      	mov	r1, r6
+ 80036f4:	2017      	movs	r0, #23
+ 80036f6:	f7ff fa38 	bl	8002b6a <ae_send>
+    return ae_read1();
+ 80036fa:	f7ff f9ad 	bl	8002a58 <ae_read1>
+        if(ae_lock_config_zone(config)) {
+ 80036fe:	bb38      	cbnz	r0, 8003750 <ae_setup_config+0x134>
+    // Load data zone with some known values.
+    // The datazone still unlocked, so no encryption needed (nor possible).
+    
+    // will use zeros for all PIN codes, and customer-defined-secret starting values
+    uint8_t     zeros[72];
+    memset(zeros, 0, sizeof(zeros));
+ 8003700:	2248      	movs	r2, #72	; 0x48
+ 8003702:	2100      	movs	r1, #0
+ 8003704:	a826      	add	r0, sp, #152	; 0x98
+ 8003706:	f009 ffe7 	bl	800d6d8 <memset>
+                se2_save_auth_pubkey(pubkey);
+                break;
+            }
+
+            case 0:
+                if(ae_write_data_slot(kn, (const uint8_t *)copyright_msg, 32, true)) {
+ 800370a:	4e45      	ldr	r6, [pc, #276]	; (8003820 <ae_setup_config+0x204>)
+ 800370c:	f8bd 5138 	ldrh.w	r5, [sp, #312]	; 0x138
+                if(ae_write_data_slot(kn, rom_secrets->pairing_secret, 32, false)) {
+ 8003710:	4f44      	ldr	r7, [pc, #272]	; (8003824 <ae_setup_config+0x208>)
+	ae_send_idle();
+ 8003712:	f7ff f8ee 	bl	80028f2 <ae_send_idle>
+        if(!(unlocked & (1<<kn))) {
+ 8003716:	fa45 f304 	asr.w	r3, r5, r4
+ 800371a:	07db      	lsls	r3, r3, #31
+ 800371c:	d55e      	bpl.n	80037dc <ae_setup_config+0x1c0>
+        switch(kn) {
+ 800371e:	2c0e      	cmp	r4, #14
+ 8003720:	d85c      	bhi.n	80037dc <ae_setup_config+0x1c0>
+ 8003722:	e8df f004 	tbb	[pc, r4]
+ 8003726:	176e      	.short	0x176e
+ 8003728:	29202920 	.word	0x29202920
+ 800372c:	2d304c3e 	.word	0x2d304c3e
+ 8003730:	2d2d2d2d 	.word	0x2d2d2d2d
+ 8003734:	29          	.byte	0x29
+ 8003735:	00          	.byte	0x00
+        ae_send_n(OP_Write, 0, n/4, &config[n], 4);
+ 8003736:	ab38      	add	r3, sp, #224	; 0xe0
+ 8003738:	442b      	add	r3, r5
+ 800373a:	f3c5 028f 	ubfx	r2, r5, #2, #16
+ 800373e:	2100      	movs	r1, #0
+ 8003740:	2012      	movs	r0, #18
+ 8003742:	9600      	str	r6, [sp, #0]
+ 8003744:	f7ff f9de 	bl	8002b04 <ae_send_n>
+		int rv = ae_read1();
+ 8003748:	f7ff f986 	bl	8002a58 <ae_read1>
+        if(rv) return rv;
+ 800374c:	2800      	cmp	r0, #0
+ 800374e:	d0c1      	beq.n	80036d4 <ae_setup_config+0xb8>
+            INCONSISTENT("conf lock");
+ 8003750:	4835      	ldr	r0, [pc, #212]	; (8003828 <ae_setup_config+0x20c>)
+ 8003752:	e77e      	b.n	8003652 <ae_setup_config+0x36>
+                if(ae_write_data_slot(kn, rom_secrets->pairing_secret, 32, false)) {
+ 8003754:	2300      	movs	r3, #0
+ 8003756:	2220      	movs	r2, #32
+ 8003758:	4639      	mov	r1, r7
+ 800375a:	2001      	movs	r0, #1
+                if(ae_write_data_slot(kn, (const uint8_t *)copyright_msg, 32, true)) {
+ 800375c:	f7ff fbf4 	bl	8002f48 <ae_write_data_slot>
+ 8003760:	2800      	cmp	r0, #0
+ 8003762:	d03b      	beq.n	80037dc <ae_setup_config+0x1c0>
+ 8003764:	e7f4      	b.n	8003750 <ae_setup_config+0x134>
+                    rng_buffer(tmp, sizeof(tmp));
+ 8003766:	2120      	movs	r1, #32
+ 8003768:	a806      	add	r0, sp, #24
+ 800376a:	f7ff f807 	bl	800277c <rng_buffer>
+                    if(ae_write_data_slot(kn, tmp, 32, true)) {
+ 800376e:	2301      	movs	r3, #1
+ 8003770:	2220      	movs	r2, #32
+ 8003772:	a906      	add	r1, sp, #24
+                if(ae_write_data_slot(kn, zeros, 32, false)) {
+ 8003774:	4620      	mov	r0, r4
+ 8003776:	e7f1      	b.n	800375c <ae_setup_config+0x140>
+ 8003778:	2300      	movs	r3, #0
+ 800377a:	2220      	movs	r2, #32
+ 800377c:	a926      	add	r1, sp, #152	; 0x98
+ 800377e:	e7f9      	b.n	8003774 <ae_setup_config+0x158>
+                if(ae_write_data_slot(kn, zeros, 72, false)) {
+ 8003780:	2300      	movs	r3, #0
+ 8003782:	2248      	movs	r2, #72	; 0x48
+ 8003784:	e7fa      	b.n	800377c <ae_setup_config+0x160>
+                uint8_t long_zeros[416] = {0};
+ 8003786:	2300      	movs	r3, #0
+ 8003788:	4619      	mov	r1, r3
+ 800378a:	f44f 72ce 	mov.w	r2, #412	; 0x19c
+ 800378e:	a859      	add	r0, sp, #356	; 0x164
+ 8003790:	9358      	str	r3, [sp, #352]	; 0x160
+ 8003792:	f009 ffa1 	bl	800d6d8 <memset>
+                if(ae_write_data_slot(kn, long_zeros, 416, false)) {
+ 8003796:	2300      	movs	r3, #0
+ 8003798:	f44f 72d0 	mov.w	r2, #416	; 0x1a0
+ 800379c:	a958      	add	r1, sp, #352	; 0x160
+ 800379e:	2008      	movs	r0, #8
+ 80037a0:	e7dc      	b.n	800375c <ae_setup_config+0x140>
+                uint32_t     buf[32/4] = { 1024, 1024 };
+ 80037a2:	2218      	movs	r2, #24
+ 80037a4:	2100      	movs	r1, #0
+ 80037a6:	a810      	add	r0, sp, #64	; 0x40
+ 80037a8:	f009 ff96 	bl	800d6d8 <memset>
+ 80037ac:	f44f 6380 	mov.w	r3, #1024	; 0x400
+ 80037b0:	e9cd 330e 	strd	r3, r3, [sp, #56]	; 0x38
+                if(ae_write_data_slot(KEYNUM_match_count, (const uint8_t *)buf,sizeof(buf),false)) {
+ 80037b4:	2220      	movs	r2, #32
+ 80037b6:	2300      	movs	r3, #0
+ 80037b8:	a90e      	add	r1, sp, #56	; 0x38
+ 80037ba:	2006      	movs	r0, #6
+ 80037bc:	e7ce      	b.n	800375c <ae_setup_config+0x140>
+                if(ae_checkmac_hard(KEYNUM_main_pin, zeros) != 0) {
+ 80037be:	a926      	add	r1, sp, #152	; 0x98
+ 80037c0:	2003      	movs	r0, #3
+ 80037c2:	f7ff fc99 	bl	80030f8 <ae_checkmac_hard>
+ 80037c6:	2800      	cmp	r0, #0
+ 80037c8:	d1c2      	bne.n	8003750 <ae_setup_config+0x134>
+                if(ae_gen_ecc_key(KEYNUM_joiner_key, pubkey)) {
+ 80037ca:	a916      	add	r1, sp, #88	; 0x58
+ 80037cc:	2007      	movs	r0, #7
+ 80037ce:	f7ff fb2b 	bl	8002e28 <ae_gen_ecc_key>
+ 80037d2:	2800      	cmp	r0, #0
+ 80037d4:	d1bc      	bne.n	8003750 <ae_setup_config+0x134>
+                se2_save_auth_pubkey(pubkey);
+ 80037d6:	a816      	add	r0, sp, #88	; 0x58
+ 80037d8:	f004 f94e 	bl	8007a78 <se2_save_auth_pubkey>
+    for(int kn=0; kn<16; kn++) {
+ 80037dc:	3401      	adds	r4, #1
+ 80037de:	2c10      	cmp	r4, #16
+ 80037e0:	d197      	bne.n	8003712 <ae_setup_config+0xf6>
+	ae_send_idle();
+ 80037e2:	f7ff f886 	bl	80028f2 <ae_send_idle>
+    ae_send(OP_Lock, 0x81, 0x0000);
+ 80037e6:	2200      	movs	r2, #0
+ 80037e8:	2181      	movs	r1, #129	; 0x81
+ 80037ea:	2017      	movs	r0, #23
+ 80037ec:	f7ff f9bd 	bl	8002b6a <ae_send>
+    return ae_read1();
+ 80037f0:	f7ff f932 	bl	8002a58 <ae_read1>
+        }
+    }
+
+    // lock the data zone and effectively enter normal operation.
+    ae_keep_alive();
+    if(ae_lock_data_zone()) {
+ 80037f4:	2800      	cmp	r0, #0
+ 80037f6:	d1ab      	bne.n	8003750 <ae_setup_config+0x134>
+    if(data_locked) return 0;       // basically success
+ 80037f8:	2400      	movs	r4, #0
+        INCONSISTENT("data lock");
+    }
+
+    return 0;
+}
+ 80037fa:	4620      	mov	r0, r4
+ 80037fc:	f50d 7d41 	add.w	sp, sp, #772	; 0x304
+ 8003800:	bdf0      	pop	{r4, r5, r6, r7, pc}
+                if(ae_write_data_slot(kn, (const uint8_t *)copyright_msg, 32, true)) {
+ 8003802:	2301      	movs	r3, #1
+ 8003804:	2220      	movs	r2, #32
+ 8003806:	4631      	mov	r1, r6
+ 8003808:	2000      	movs	r0, #0
+ 800380a:	e7a7      	b.n	800375c <ae_setup_config+0x140>
+        return EPERM;
+ 800380c:	2401      	movs	r4, #1
+ 800380e:	e7f4      	b.n	80037fa <ae_setup_config+0x1de>
+ 8003810:	0800e466 	.word	0x0800e466
+ 8003814:	0801c040 	.word	0x0801c040
+ 8003818:	0800e710 	.word	0x0800e710
+ 800381c:	0800e754 	.word	0x0800e754
+ 8003820:	0800e6cc 	.word	0x0800e6cc
+ 8003824:	0801c000 	.word	0x0801c000
+ 8003828:	0800d760 	.word	0x0800d760
+
+0800382c <ae_stretch_iter>:
+// - but our time to do each iteration is limited by software SHA256 in ae_pair_unlock
+//
+    int
+ae_stretch_iter(const uint8_t start[32], uint8_t end[32], int iterations)
+{
+    ASSERT(start != end);           // we can't work inplace
+ 800382c:	4288      	cmp	r0, r1
+{
+ 800382e:	b570      	push	{r4, r5, r6, lr}
+ 8003830:	460c      	mov	r4, r1
+ 8003832:	4615      	mov	r5, r2
+    ASSERT(start != end);           // we can't work inplace
+ 8003834:	d102      	bne.n	800383c <ae_stretch_iter+0x10>
+ 8003836:	4810      	ldr	r0, [pc, #64]	; (8003878 <ae_stretch_iter+0x4c>)
+ 8003838:	f7fd f906 	bl	8000a48 <fatal_error>
+    memcpy(end, start, 32);
+ 800383c:	460b      	mov	r3, r1
+ 800383e:	f100 0220 	add.w	r2, r0, #32
+ 8003842:	f850 1b04 	ldr.w	r1, [r0], #4
+ 8003846:	f843 1b04 	str.w	r1, [r3], #4
+ 800384a:	4290      	cmp	r0, r2
+ 800384c:	d1f9      	bne.n	8003842 <ae_stretch_iter+0x16>
+
+    for(int i=0; i<iterations; i++) {
+ 800384e:	2600      	movs	r6, #0
+ 8003850:	42ae      	cmp	r6, r5
+ 8003852:	db01      	blt.n	8003858 <ae_stretch_iter+0x2c>
+
+        int rv = ae_hmac32(KEYNUM_pin_stretch, end, end);
+        RET_IF_BAD(rv);
+    }
+
+    return 0;
+ 8003854:	2000      	movs	r0, #0
+}
+ 8003856:	bd70      	pop	{r4, r5, r6, pc}
+        if(ae_pair_unlock()) return -2;
+ 8003858:	f7ff fac0 	bl	8002ddc <ae_pair_unlock>
+ 800385c:	b940      	cbnz	r0, 8003870 <ae_stretch_iter+0x44>
+        int rv = ae_hmac32(KEYNUM_pin_stretch, end, end);
+ 800385e:	4622      	mov	r2, r4
+ 8003860:	4621      	mov	r1, r4
+ 8003862:	2002      	movs	r0, #2
+ 8003864:	f7ff fb02 	bl	8002e6c <ae_hmac32>
+        RET_IF_BAD(rv);
+ 8003868:	2800      	cmp	r0, #0
+ 800386a:	d1f4      	bne.n	8003856 <ae_stretch_iter+0x2a>
+    for(int i=0; i<iterations; i++) {
+ 800386c:	3601      	adds	r6, #1
+ 800386e:	e7ef      	b.n	8003850 <ae_stretch_iter+0x24>
+        if(ae_pair_unlock()) return -2;
+ 8003870:	f06f 0001 	mvn.w	r0, #1
+ 8003874:	e7ef      	b.n	8003856 <ae_stretch_iter+0x2a>
+ 8003876:	bf00      	nop
+ 8003878:	0800e466 	.word	0x0800e466
+
+0800387c <ae_mixin_key>:
+// Apply HMAC using secret in chip as a HMAC key, then encrypt
+// the result a little because read in clear over bus.
+//
+    int
+ae_mixin_key(uint8_t keynum, const uint8_t start[32], uint8_t end[32])
+{
+ 800387c:	b570      	push	{r4, r5, r6, lr}
+ 800387e:	b096      	sub	sp, #88	; 0x58
+    ASSERT(start != end);           // we can't work inplace
+ 8003880:	4291      	cmp	r1, r2
+{
+ 8003882:	460e      	mov	r6, r1
+ 8003884:	4614      	mov	r4, r2
+ 8003886:	f88d 0007 	strb.w	r0, [sp, #7]
+    ASSERT(start != end);           // we can't work inplace
+ 800388a:	d102      	bne.n	8003892 <ae_mixin_key+0x16>
+ 800388c:	4818      	ldr	r0, [pc, #96]	; (80038f0 <ae_mixin_key+0x74>)
+ 800388e:	f7fd f8db 	bl	8000a48 <fatal_error>
+
+    if(ae_pair_unlock()) return -1;
+ 8003892:	f7ff faa3 	bl	8002ddc <ae_pair_unlock>
+ 8003896:	bb40      	cbnz	r0, 80038ea <ae_mixin_key+0x6e>
+
+    ASSERT(keynum != 0);
+ 8003898:	f89d 0007 	ldrb.w	r0, [sp, #7]
+ 800389c:	2800      	cmp	r0, #0
+ 800389e:	d0f5      	beq.n	800388c <ae_mixin_key+0x10>
+    int rv = ae_hmac32(keynum, start, end);
+ 80038a0:	4622      	mov	r2, r4
+ 80038a2:	4631      	mov	r1, r6
+ 80038a4:	f7ff fae2 	bl	8002e6c <ae_hmac32>
+    RET_IF_BAD(rv);
+ 80038a8:	4605      	mov	r5, r0
+ 80038aa:	b9d8      	cbnz	r0, 80038e4 <ae_mixin_key+0x68>
+    // use the value provided in cleartext[sic--it's not] write back shortly (to test it).
+    // Solution: one more SHA256, and to be safe, mixin lots of values!
+
+	SHA256_CTX ctx;
+
+    sha256_init(&ctx);
+ 80038ac:	a803      	add	r0, sp, #12
+ 80038ae:	f001 fe1f 	bl	80054f0 <sha256_init>
+    sha256_update(&ctx, rom_secrets->pairing_secret, 32);
+ 80038b2:	4910      	ldr	r1, [pc, #64]	; (80038f4 <ae_mixin_key+0x78>)
+ 80038b4:	2220      	movs	r2, #32
+ 80038b6:	a803      	add	r0, sp, #12
+ 80038b8:	f001 fe28 	bl	800550c <sha256_update>
+    sha256_update(&ctx, start, 32);
+ 80038bc:	2220      	movs	r2, #32
+ 80038be:	4631      	mov	r1, r6
+ 80038c0:	a803      	add	r0, sp, #12
+ 80038c2:	f001 fe23 	bl	800550c <sha256_update>
+    sha256_update(&ctx, &keynum, 1);
+ 80038c6:	2201      	movs	r2, #1
+ 80038c8:	f10d 0107 	add.w	r1, sp, #7
+ 80038cc:	a803      	add	r0, sp, #12
+ 80038ce:	f001 fe1d 	bl	800550c <sha256_update>
+    sha256_update(&ctx, end, 32);
+ 80038d2:	4621      	mov	r1, r4
+ 80038d4:	a803      	add	r0, sp, #12
+ 80038d6:	2220      	movs	r2, #32
+ 80038d8:	f001 fe18 	bl	800550c <sha256_update>
+    sha256_final(&ctx, end);
+ 80038dc:	4621      	mov	r1, r4
+ 80038de:	a803      	add	r0, sp, #12
+ 80038e0:	f001 fe5a 	bl	8005598 <sha256_final>
+
+    return 0;
+}
+ 80038e4:	4628      	mov	r0, r5
+ 80038e6:	b016      	add	sp, #88	; 0x58
+ 80038e8:	bd70      	pop	{r4, r5, r6, pc}
+    if(ae_pair_unlock()) return -1;
+ 80038ea:	f04f 35ff 	mov.w	r5, #4294967295	; 0xffffffff
+ 80038ee:	e7f9      	b.n	80038e4 <ae_mixin_key+0x68>
+ 80038f0:	0800e466 	.word	0x0800e466
+ 80038f4:	0801c000 	.word	0x0801c000
+
+080038f8 <ae_brick_myself>:
+// Immediately destroy the pairing secret so that we become
+// a useless brick. Ignore errors but retry.
+//
+    void
+ae_brick_myself(void)
+{
+ 80038f8:	b510      	push	{r4, lr}
+    for(int retry=0; retry<10; retry++) {
+ 80038fa:	2400      	movs	r4, #0
+        ae_reset_chip();
+ 80038fc:	f7ff f86a 	bl	80029d4 <ae_reset_chip>
+
+        if(retry) rng_delay();
+ 8003900:	b10c      	cbz	r4, 8003906 <ae_brick_myself+0xe>
+ 8003902:	f7fe ff51 	bl	80027a8 <rng_delay>
+
+        ae_pair_unlock();
+ 8003906:	f7ff fa69 	bl	8002ddc <ae_pair_unlock>
+
+        // Concern: MitM could block this by trashing our write
+        // - but they have to do it without causing CRC or other comm error
+        // - ten times
+        int rv = ae_destroy_key(KEYNUM_pairing);
+ 800390a:	2001      	movs	r0, #1
+ 800390c:	f7ff fe54 	bl	80035b8 <ae_destroy_key>
+        if(rv == 0) break;
+ 8003910:	b120      	cbz	r0, 800391c <ae_brick_myself+0x24>
+    for(int retry=0; retry<10; retry++) {
+ 8003912:	3401      	adds	r4, #1
+
+        rng_delay();
+ 8003914:	f7fe ff48 	bl	80027a8 <rng_delay>
+    for(int retry=0; retry<10; retry++) {
+ 8003918:	2c0a      	cmp	r4, #10
+ 800391a:	d1ef      	bne.n	80038fc <ae_brick_myself+0x4>
+    }
+
+    ae_reset_chip();
+}
+ 800391c:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+    ae_reset_chip();
+ 8003920:	f7ff b858 	b.w	80029d4 <ae_reset_chip>
+
+08003924 <delay_ms>:
+//
+    void
+delay_ms(int ms)
+{
+    // Clear the COUNTFLAG and reset value to zero
+    SysTick->VAL = 0;
+ 8003924:	f04f 23e0 	mov.w	r3, #3758153728	; 0xe000e000
+ 8003928:	2200      	movs	r2, #0
+ 800392a:	619a      	str	r2, [r3, #24]
+    //SysTick->CTRL;  
+
+    // Wait for ticks to happen
+    while(ms > 0) {
+ 800392c:	2800      	cmp	r0, #0
+ 800392e:	dc00      	bgt.n	8003932 <delay_ms+0xe>
+        if(SysTick->CTRL & SysTick_CTRL_COUNTFLAG_Msk) {
+            ms--;
+        }
+    }
+}
+ 8003930:	4770      	bx	lr
+        if(SysTick->CTRL & SysTick_CTRL_COUNTFLAG_Msk) {
+ 8003932:	691a      	ldr	r2, [r3, #16]
+ 8003934:	03d2      	lsls	r2, r2, #15
+            ms--;
+ 8003936:	bf48      	it	mi
+ 8003938:	f100 30ff 	addmi.w	r0, r0, #4294967295	; 0xffffffff
+ 800393c:	e7f6      	b.n	800392c <delay_ms+0x8>
+
+0800393e <HAL_Delay>:
+// Replace HAL version which needs interrupts
+//
+    void
+HAL_Delay(uint32_t Delay)
+{
+    delay_ms(Delay);
+ 800393e:	f7ff bff1 	b.w	8003924 <delay_ms>
+	...
+
+08003944 <gpio_setup>:
+    // NOTES:
+    // - try not to limit PCB changes for future revs; leave unused unchanged.
+    // - oled_setup() uses pins on PA4 thru PA8
+
+    // enable clock to GPIO's ... we will be using them all at some point
+    __HAL_RCC_GPIOA_CLK_ENABLE();
+ 8003944:	4b40      	ldr	r3, [pc, #256]	; (8003a48 <gpio_setup+0x104>)
+{
+ 8003946:	b570      	push	{r4, r5, r6, lr}
+    __HAL_RCC_GPIOA_CLK_ENABLE();
+ 8003948:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+    __HAL_RCC_GPIOC_CLK_ENABLE();
+    __HAL_RCC_GPIOD_CLK_ENABLE();
+    __HAL_RCC_GPIOE_CLK_ENABLE();
+
+    {   // Onewire bus pins used for ATECC608 comms
+        GPIO_InitTypeDef setup = {
+ 800394a:	4c40      	ldr	r4, [pc, #256]	; (8003a4c <gpio_setup+0x108>)
+    __HAL_RCC_GPIOA_CLK_ENABLE();
+ 800394c:	f042 0201 	orr.w	r2, r2, #1
+ 8003950:	64da      	str	r2, [r3, #76]	; 0x4c
+ 8003952:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+{
+ 8003954:	b08a      	sub	sp, #40	; 0x28
+    __HAL_RCC_GPIOA_CLK_ENABLE();
+ 8003956:	f002 0201 	and.w	r2, r2, #1
+ 800395a:	9200      	str	r2, [sp, #0]
+ 800395c:	9a00      	ldr	r2, [sp, #0]
+    __HAL_RCC_GPIOB_CLK_ENABLE();
+ 800395e:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8003960:	f042 0202 	orr.w	r2, r2, #2
+ 8003964:	64da      	str	r2, [r3, #76]	; 0x4c
+ 8003966:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8003968:	f002 0202 	and.w	r2, r2, #2
+ 800396c:	9201      	str	r2, [sp, #4]
+ 800396e:	9a01      	ldr	r2, [sp, #4]
+    __HAL_RCC_GPIOC_CLK_ENABLE();
+ 8003970:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8003972:	f042 0204 	orr.w	r2, r2, #4
+ 8003976:	64da      	str	r2, [r3, #76]	; 0x4c
+ 8003978:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 800397a:	f002 0204 	and.w	r2, r2, #4
+ 800397e:	9202      	str	r2, [sp, #8]
+ 8003980:	9a02      	ldr	r2, [sp, #8]
+    __HAL_RCC_GPIOD_CLK_ENABLE();
+ 8003982:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8003984:	f042 0208 	orr.w	r2, r2, #8
+ 8003988:	64da      	str	r2, [r3, #76]	; 0x4c
+ 800398a:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 800398c:	f002 0208 	and.w	r2, r2, #8
+ 8003990:	9203      	str	r2, [sp, #12]
+ 8003992:	9a03      	ldr	r2, [sp, #12]
+    __HAL_RCC_GPIOE_CLK_ENABLE();
+ 8003994:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8003996:	f042 0210 	orr.w	r2, r2, #16
+ 800399a:	64da      	str	r2, [r3, #76]	; 0x4c
+ 800399c:	6cdb      	ldr	r3, [r3, #76]	; 0x4c
+ 800399e:	f003 0310 	and.w	r3, r3, #16
+ 80039a2:	9304      	str	r3, [sp, #16]
+ 80039a4:	9b04      	ldr	r3, [sp, #16]
+        GPIO_InitTypeDef setup = {
+ 80039a6:	cc0f      	ldmia	r4!, {r0, r1, r2, r3}
+ 80039a8:	ad05      	add	r5, sp, #20
+ 80039aa:	c50f      	stmia	r5!, {r0, r1, r2, r3}
+ 80039ac:	6823      	ldr	r3, [r4, #0]
+ 80039ae:	602b      	str	r3, [r5, #0]
+            .Mode = GPIO_MODE_AF_OD,
+            .Pull = GPIO_NOPULL,
+            .Speed = GPIO_SPEED_FREQ_MEDIUM,
+            .Alternate = GPIO_AF8_UART4,
+        };
+        HAL_GPIO_Init(ONEWIRE_PORT, &setup);
+ 80039b0:	a905      	add	r1, sp, #20
+ 80039b2:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 80039b6:	f7fd fb41 	bl	800103c <HAL_GPIO_Init>
+    }
+
+    // Bugfix: re-init of console port pins seems to wreck
+    // the mpy uart code, so avoid after first time.
+    if(USART1->BRR == 0) {
+ 80039ba:	4b25      	ldr	r3, [pc, #148]	; (8003a50 <gpio_setup+0x10c>)
+ 80039bc:	68de      	ldr	r6, [r3, #12]
+ 80039be:	b9ae      	cbnz	r6, 80039ec <gpio_setup+0xa8>
+        // debug console: USART1 = PA9=Tx & PA10=Rx
+        GPIO_InitTypeDef setup = {
+ 80039c0:	3404      	adds	r4, #4
+ 80039c2:	cc0f      	ldmia	r4!, {r0, r1, r2, r3}
+ 80039c4:	ad05      	add	r5, sp, #20
+ 80039c6:	c50f      	stmia	r5!, {r0, r1, r2, r3}
+ 80039c8:	6823      	ldr	r3, [r4, #0]
+ 80039ca:	602b      	str	r3, [r5, #0]
+            .Mode = GPIO_MODE_AF_PP,
+            .Pull = GPIO_NOPULL,
+            .Speed = GPIO_SPEED_FREQ_MEDIUM,
+            .Alternate = GPIO_AF7_USART1,
+        };
+        HAL_GPIO_Init(GPIOA, &setup);
+ 80039cc:	a905      	add	r1, sp, #20
+ 80039ce:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+ 80039d2:	f7fd fb33 	bl	800103c <HAL_GPIO_Init>
+
+        setup.Pin = GPIO_PIN_10;
+ 80039d6:	f44f 6380 	mov.w	r3, #1024	; 0x400
+        setup.Mode = GPIO_MODE_INPUT;
+ 80039da:	e9cd 3605 	strd	r3, r6, [sp, #20]
+        setup.Pull = GPIO_PULLUP;
+        HAL_GPIO_Init(GPIOA, &setup);
+ 80039de:	a905      	add	r1, sp, #20
+        setup.Pull = GPIO_PULLUP;
+ 80039e0:	2301      	movs	r3, #1
+        HAL_GPIO_Init(GPIOA, &setup);
+ 80039e2:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+        setup.Pull = GPIO_PULLUP;
+ 80039e6:	9307      	str	r3, [sp, #28]
+        HAL_GPIO_Init(GPIOA, &setup);
+ 80039e8:	f7fd fb28 	bl	800103c <HAL_GPIO_Init>
+    // USB active LED: PC6
+    // Mk5 (disconnected & unused on Mk4):
+    //   PC0: early experiments, unused
+    //   PC1: +12v en for OLED
+    // - but by rev E, neither being used, but keep support for older revs
+    {   GPIO_InitTypeDef setup = {
+ 80039ec:	2400      	movs	r4, #0
+ 80039ee:	23c3      	movs	r3, #195	; 0xc3
+ 80039f0:	2501      	movs	r5, #1
+            .Mode = GPIO_MODE_OUTPUT_PP,
+            .Pull = GPIO_NOPULL,
+            .Speed = GPIO_SPEED_FREQ_LOW,
+        };
+
+        HAL_GPIO_Init(GPIOC, &setup);
+ 80039f2:	a905      	add	r1, sp, #20
+ 80039f4:	4817      	ldr	r0, [pc, #92]	; (8003a54 <gpio_setup+0x110>)
+    {   GPIO_InitTypeDef setup = {
+ 80039f6:	9409      	str	r4, [sp, #36]	; 0x24
+ 80039f8:	e9cd 3505 	strd	r3, r5, [sp, #20]
+ 80039fc:	e9cd 4407 	strd	r4, r4, [sp, #28]
+        HAL_GPIO_Init(GPIOC, &setup);
+ 8003a00:	f7fd fb1c 	bl	800103c <HAL_GPIO_Init>
+
+        HAL_GPIO_WritePin(GPIOC, setup.Pin, 0);    // turn all off
+ 8003a04:	f8bd 1014 	ldrh.w	r1, [sp, #20]
+ 8003a08:	4812      	ldr	r0, [pc, #72]	; (8003a54 <gpio_setup+0x110>)
+ 8003a0a:	4622      	mov	r2, r4
+ 8003a0c:	f7fd fc90 	bl	8001330 <HAL_GPIO_WritePin>
+    }
+
+    // SD card detect switch: PC13
+    {   GPIO_InitTypeDef setup = {
+ 8003a10:	2210      	movs	r2, #16
+ 8003a12:	4621      	mov	r1, r4
+ 8003a14:	a806      	add	r0, sp, #24
+ 8003a16:	f009 fe5f 	bl	800d6d8 <memset>
+ 8003a1a:	f44f 5300 	mov.w	r3, #8192	; 0x2000
+            .Pin = GPIO_PIN_13,
+            .Mode = GPIO_MODE_INPUT,
+            .Pull = GPIO_PULLUP,
+            .Speed = GPIO_SPEED_FREQ_LOW,
+        };
+        HAL_GPIO_Init(GPIOC, &setup);
+ 8003a1e:	a905      	add	r1, sp, #20
+ 8003a20:	480c      	ldr	r0, [pc, #48]	; (8003a54 <gpio_setup+0x110>)
+    {   GPIO_InitTypeDef setup = {
+ 8003a22:	9305      	str	r3, [sp, #20]
+ 8003a24:	9507      	str	r5, [sp, #28]
+        HAL_GPIO_Init(GPIOC, &setup);
+ 8003a26:	f7fd fb09 	bl	800103c <HAL_GPIO_Init>
+    }
+
+    // Strapping pins (Mk5, but all disconnected on Mk4): PE0-3
+    // - important to have the internal pull-ups enabled on these
+    // - PE0: low if Mk5
+    {   GPIO_InitTypeDef setup = {
+ 8003a2a:	2210      	movs	r2, #16
+ 8003a2c:	4621      	mov	r1, r4
+ 8003a2e:	a806      	add	r0, sp, #24
+ 8003a30:	f009 fe52 	bl	800d6d8 <memset>
+ 8003a34:	230f      	movs	r3, #15
+            .Pin = GPIO_PIN_0 | GPIO_PIN_1 | GPIO_PIN_2 | GPIO_PIN_3,
+            .Mode = GPIO_MODE_INPUT,
+            .Pull = GPIO_PULLUP,
+            .Speed = GPIO_SPEED_FREQ_LOW,
+        };
+        HAL_GPIO_Init(GPIOE, &setup);
+ 8003a36:	4808      	ldr	r0, [pc, #32]	; (8003a58 <gpio_setup+0x114>)
+    {   GPIO_InitTypeDef setup = {
+ 8003a38:	9305      	str	r3, [sp, #20]
+        HAL_GPIO_Init(GPIOE, &setup);
+ 8003a3a:	a905      	add	r1, sp, #20
+    {   GPIO_InitTypeDef setup = {
+ 8003a3c:	9507      	str	r5, [sp, #28]
+        HAL_GPIO_Init(GPIOE, &setup);
+ 8003a3e:	f7fd fafd 	bl	800103c <HAL_GPIO_Init>
+
+    // elsewhere...
+    //HAL_GPIO_WritePin(GPIOB, GPIO_PIN_13, 1);
+    //HAL_GPIO_WritePin(GPIOB, GPIO_PIN_13, 0);
+#endif
+}
+ 8003a42:	b00a      	add	sp, #40	; 0x28
+ 8003a44:	bd70      	pop	{r4, r5, r6, pc}
+ 8003a46:	bf00      	nop
+ 8003a48:	40021000 	.word	0x40021000
+ 8003a4c:	0800e77c 	.word	0x0800e77c
+ 8003a50:	40013800 	.word	0x40013800
+ 8003a54:	48000800 	.word	0x48000800
+ 8003a58:	48001000 	.word	0x48001000
+
+08003a5c <is_mk5>:
+
+// is_mk5()
+//
+    bool
+is_mk5(void)
+{
+ 8003a5c:	b508      	push	{r3, lr}
+    // sample the PE0 strapping pin to know if mk4 or 5
+    return !HAL_GPIO_ReadPin(GPIOE, GPIO_PIN_0);
+ 8003a5e:	2101      	movs	r1, #1
+ 8003a60:	4803      	ldr	r0, [pc, #12]	; (8003a70 <is_mk5+0x14>)
+ 8003a62:	f7fd fc5f 	bl	8001324 <HAL_GPIO_ReadPin>
+}
+ 8003a66:	fab0 f080 	clz	r0, r0
+ 8003a6a:	0940      	lsrs	r0, r0, #5
+ 8003a6c:	bd08      	pop	{r3, pc}
+ 8003a6e:	bf00      	nop
+ 8003a70:	48001000 	.word	0x48001000
+
+08003a74 <reboot_nonce>:
+
+// reboot_nonce()
+//
+    static inline void
+reboot_nonce(SHA256_CTX *ctx)
+{
+ 8003a74:	b537      	push	{r0, r1, r2, r4, r5, lr}
+    uint32_t    a = CRC->INIT;
+ 8003a76:	4d09      	ldr	r5, [pc, #36]	; (8003a9c <reboot_nonce+0x28>)
+    sha256_update(ctx, (const uint8_t *)&a, 4);
+ 8003a78:	2204      	movs	r2, #4
+    uint32_t    a = CRC->INIT;
+ 8003a7a:	692b      	ldr	r3, [r5, #16]
+ 8003a7c:	9301      	str	r3, [sp, #4]
+    sha256_update(ctx, (const uint8_t *)&a, 4);
+ 8003a7e:	eb0d 0102 	add.w	r1, sp, r2
+{
+ 8003a82:	4604      	mov	r4, r0
+    sha256_update(ctx, (const uint8_t *)&a, 4);
+ 8003a84:	f001 fd42 	bl	800550c <sha256_update>
+
+    a = CRC->POL;
+    sha256_update(ctx, (const uint8_t *)&a, 4);
+ 8003a88:	2204      	movs	r2, #4
+    a = CRC->POL;
+ 8003a8a:	696b      	ldr	r3, [r5, #20]
+ 8003a8c:	9301      	str	r3, [sp, #4]
+    sha256_update(ctx, (const uint8_t *)&a, 4);
+ 8003a8e:	eb0d 0102 	add.w	r1, sp, r2
+ 8003a92:	4620      	mov	r0, r4
+ 8003a94:	f001 fd3a 	bl	800550c <sha256_update>
+}
+ 8003a98:	b003      	add	sp, #12
+ 8003a9a:	bd30      	pop	{r4, r5, pc}
+ 8003a9c:	40023000 	.word	0x40023000
+
+08003aa0 <pin_hash>:
+//
+// Hash up a string of digits into 32-bytes of goodness.
+//
+    static void
+pin_hash(const char *pin, int pin_len, uint8_t result[32], uint32_t purpose)
+{
+ 8003aa0:	b570      	push	{r4, r5, r6, lr}
+ 8003aa2:	b096      	sub	sp, #88	; 0x58
+    ASSERT(pin_len <= MAX_PIN_LEN);
+ 8003aa4:	2920      	cmp	r1, #32
+{
+ 8003aa6:	4606      	mov	r6, r0
+ 8003aa8:	460d      	mov	r5, r1
+ 8003aaa:	4614      	mov	r4, r2
+ 8003aac:	9301      	str	r3, [sp, #4]
+    ASSERT(pin_len <= MAX_PIN_LEN);
+ 8003aae:	dd02      	ble.n	8003ab6 <pin_hash+0x16>
+ 8003ab0:	4817      	ldr	r0, [pc, #92]	; (8003b10 <pin_hash+0x70>)
+ 8003ab2:	f7fc ffc9 	bl	8000a48 <fatal_error>
+
+    if(pin_len == 0) {
+ 8003ab6:	b929      	cbnz	r1, 8003ac4 <pin_hash+0x24>
+        // zero-length PIN is considered the "blank" one: all zero
+        memset(result, 0, 32);
+ 8003ab8:	2220      	movs	r2, #32
+ 8003aba:	4620      	mov	r0, r4
+ 8003abc:	f009 fe0c 	bl	800d6d8 <memset>
+    // and run that thru SE2 as well
+    se2_pin_hash(result, purpose);
+
+    // and a second-sha256 on that, just in case.
+    sha256_single(result, 32, result);
+}
+ 8003ac0:	b016      	add	sp, #88	; 0x58
+ 8003ac2:	bd70      	pop	{r4, r5, r6, pc}
+    sha256_init(&ctx);
+ 8003ac4:	a803      	add	r0, sp, #12
+ 8003ac6:	f001 fd13 	bl	80054f0 <sha256_init>
+    sha256_update(&ctx, rom_secrets->hash_cache_secret, 32);
+ 8003aca:	a803      	add	r0, sp, #12
+ 8003acc:	4911      	ldr	r1, [pc, #68]	; (8003b14 <pin_hash+0x74>)
+ 8003ace:	2220      	movs	r2, #32
+ 8003ad0:	f001 fd1c 	bl	800550c <sha256_update>
+    sha256_update(&ctx, (uint8_t *)&purpose, 4);
+ 8003ad4:	2204      	movs	r2, #4
+ 8003ad6:	eb0d 0102 	add.w	r1, sp, r2
+ 8003ada:	a803      	add	r0, sp, #12
+ 8003adc:	f001 fd16 	bl	800550c <sha256_update>
+    sha256_update(&ctx, (uint8_t *)pin, pin_len);
+ 8003ae0:	462a      	mov	r2, r5
+ 8003ae2:	4631      	mov	r1, r6
+ 8003ae4:	a803      	add	r0, sp, #12
+ 8003ae6:	f001 fd11 	bl	800550c <sha256_update>
+    sha256_update(&ctx, rom_secrets->pairing_secret, 32);
+ 8003aea:	2220      	movs	r2, #32
+ 8003aec:	a803      	add	r0, sp, #12
+ 8003aee:	490a      	ldr	r1, [pc, #40]	; (8003b18 <pin_hash+0x78>)
+ 8003af0:	f001 fd0c 	bl	800550c <sha256_update>
+    sha256_final(&ctx, result);
+ 8003af4:	4621      	mov	r1, r4
+ 8003af6:	a803      	add	r0, sp, #12
+ 8003af8:	f001 fd4e 	bl	8005598 <sha256_final>
+    se2_pin_hash(result, purpose);
+ 8003afc:	9901      	ldr	r1, [sp, #4]
+ 8003afe:	4620      	mov	r0, r4
+ 8003b00:	f004 fc32 	bl	8008368 <se2_pin_hash>
+    sha256_single(result, 32, result);
+ 8003b04:	4622      	mov	r2, r4
+ 8003b06:	2120      	movs	r1, #32
+ 8003b08:	4620      	mov	r0, r4
+ 8003b0a:	f001 fd59 	bl	80055c0 <sha256_single>
+ 8003b0e:	e7d7      	b.n	8003ac0 <pin_hash+0x20>
+ 8003b10:	0800e466 	.word	0x0800e466
+ 8003b14:	0801c070 	.word	0x0801c070
+ 8003b18:	0801c000 	.word	0x0801c000
+
+08003b1c <_hmac_attempt>:
+//
+// Maybe should be proper HMAC from fips std? Can be changed later.
+//
+    static void
+_hmac_attempt(const pinAttempt_t *args, uint8_t result[32])
+{
+ 8003b1c:	b530      	push	{r4, r5, lr}
+ 8003b1e:	b095      	sub	sp, #84	; 0x54
+ 8003b20:	4604      	mov	r4, r0
+	SHA256_CTX ctx;
+
+    sha256_init(&ctx);
+ 8003b22:	a801      	add	r0, sp, #4
+{
+ 8003b24:	460d      	mov	r5, r1
+    sha256_init(&ctx);
+ 8003b26:	f001 fce3 	bl	80054f0 <sha256_init>
+    sha256_update(&ctx, rom_secrets->pairing_secret, 32);
+ 8003b2a:	4911      	ldr	r1, [pc, #68]	; (8003b70 <_hmac_attempt+0x54>)
+ 8003b2c:	2220      	movs	r2, #32
+ 8003b2e:	a801      	add	r0, sp, #4
+ 8003b30:	f001 fcec 	bl	800550c <sha256_update>
+    reboot_nonce(&ctx);
+ 8003b34:	a801      	add	r0, sp, #4
+ 8003b36:	f7ff ff9d 	bl	8003a74 <reboot_nonce>
+    sha256_update(&ctx, (uint8_t *)args, offsetof(pinAttempt_t, hmac));
+ 8003b3a:	2244      	movs	r2, #68	; 0x44
+ 8003b3c:	4621      	mov	r1, r4
+ 8003b3e:	a801      	add	r0, sp, #4
+ 8003b40:	f001 fce4 	bl	800550c <sha256_update>
+
+    if(args->magic_value == PA_MAGIC_V2) {
+ 8003b44:	6822      	ldr	r2, [r4, #0]
+ 8003b46:	4b0b      	ldr	r3, [pc, #44]	; (8003b74 <_hmac_attempt+0x58>)
+ 8003b48:	429a      	cmp	r2, r3
+ 8003b4a:	d105      	bne.n	8003b58 <_hmac_attempt+0x3c>
+        sha256_update(&ctx, (uint8_t *)args->cached_main_pin,
+ 8003b4c:	2220      	movs	r2, #32
+ 8003b4e:	f104 01f8 	add.w	r1, r4, #248	; 0xf8
+ 8003b52:	a801      	add	r0, sp, #4
+ 8003b54:	f001 fcda 	bl	800550c <sha256_update>
+                                msizeof(pinAttempt_t, cached_main_pin));
+    }
+
+    sha256_final(&ctx, result);
+ 8003b58:	4629      	mov	r1, r5
+ 8003b5a:	a801      	add	r0, sp, #4
+ 8003b5c:	f001 fd1c 	bl	8005598 <sha256_final>
+
+    // and a second-sha256 on that, just in case.
+    sha256_single(result, 32, result);
+ 8003b60:	462a      	mov	r2, r5
+ 8003b62:	2120      	movs	r1, #32
+ 8003b64:	4628      	mov	r0, r5
+ 8003b66:	f001 fd2b 	bl	80055c0 <sha256_single>
+}
+ 8003b6a:	b015      	add	sp, #84	; 0x54
+ 8003b6c:	bd30      	pop	{r4, r5, pc}
+ 8003b6e:	bf00      	nop
+ 8003b70:	0801c000 	.word	0x0801c000
+ 8003b74:	2eaf6312 	.word	0x2eaf6312
+
+08003b78 <_validate_attempt>:
+
+// _validate_attempt()
+//
+    static int
+_validate_attempt(const pinAttempt_t *args, bool first_time)
+{
+ 8003b78:	b510      	push	{r4, lr}
+ 8003b7a:	4604      	mov	r4, r0
+ 8003b7c:	b088      	sub	sp, #32
+    if(first_time) {
+ 8003b7e:	b969      	cbnz	r1, 8003b9c <_validate_attempt+0x24>
+        // no hmac needed for setup call
+    } else {
+        // if hmac is defined, better be right.
+        uint8_t     actual[32];
+
+        _hmac_attempt(args, actual);
+ 8003b80:	4669      	mov	r1, sp
+ 8003b82:	f7ff ffcb 	bl	8003b1c <_hmac_attempt>
+
+        if(!check_equal(actual, args->hmac, 32)) {
+ 8003b86:	2220      	movs	r2, #32
+ 8003b88:	f104 0144 	add.w	r1, r4, #68	; 0x44
+ 8003b8c:	4668      	mov	r0, sp
+ 8003b8e:	f7fe fda6 	bl	80026de <check_equal>
+ 8003b92:	b918      	cbnz	r0, 8003b9c <_validate_attempt+0x24>
+            // hmac is wrong?
+            return EPIN_HMAC_FAIL;
+ 8003b94:	f06f 0063 	mvn.w	r0, #99	; 0x63
+    if((args->change_flags & CHANGE__MASK) != args->change_flags) return EPIN_RANGE_ERR;
+
+    if((args->is_secondary & 0x1) != args->is_secondary) return EPIN_RANGE_ERR;
+        
+    return 0;
+}
+ 8003b98:	b008      	add	sp, #32
+ 8003b9a:	bd10      	pop	{r4, pc}
+    if(args->magic_value == PA_MAGIC_V2) {
+ 8003b9c:	6822      	ldr	r2, [r4, #0]
+ 8003b9e:	4b10      	ldr	r3, [pc, #64]	; (8003be0 <_validate_attempt+0x68>)
+ 8003ba0:	429a      	cmp	r2, r3
+ 8003ba2:	d117      	bne.n	8003bd4 <_validate_attempt+0x5c>
+    if(args->pin_len > MAX_PIN_LEN) return EPIN_RANGE_ERR;
+ 8003ba4:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 8003ba6:	2b20      	cmp	r3, #32
+ 8003ba8:	dc17      	bgt.n	8003bda <_validate_attempt+0x62>
+    if(args->old_pin_len > MAX_PIN_LEN) return EPIN_RANGE_ERR;
+ 8003baa:	f8d4 3088 	ldr.w	r3, [r4, #136]	; 0x88
+ 8003bae:	2b20      	cmp	r3, #32
+ 8003bb0:	dc13      	bgt.n	8003bda <_validate_attempt+0x62>
+    if(args->new_pin_len > MAX_PIN_LEN) return EPIN_RANGE_ERR;
+ 8003bb2:	f8d4 30ac 	ldr.w	r3, [r4, #172]	; 0xac
+ 8003bb6:	2b20      	cmp	r3, #32
+ 8003bb8:	dc0f      	bgt.n	8003bda <_validate_attempt+0x62>
+    if((args->change_flags & CHANGE__MASK) != args->change_flags) return EPIN_RANGE_ERR;
+ 8003bba:	6e63      	ldr	r3, [r4, #100]	; 0x64
+ 8003bbc:	f640 727f 	movw	r2, #3967	; 0xf7f
+ 8003bc0:	4393      	bics	r3, r2
+ 8003bc2:	d10a      	bne.n	8003bda <_validate_attempt+0x62>
+    if((args->is_secondary & 0x1) != args->is_secondary) return EPIN_RANGE_ERR;
+ 8003bc4:	6863      	ldr	r3, [r4, #4]
+    return 0;
+ 8003bc6:	f033 0301 	bics.w	r3, r3, #1
+ 8003bca:	bf14      	ite	ne
+ 8003bcc:	f06f 0066 	mvnne.w	r0, #102	; 0x66
+ 8003bd0:	2000      	moveq	r0, #0
+ 8003bd2:	e7e1      	b.n	8003b98 <_validate_attempt+0x20>
+        return EPIN_BAD_MAGIC;
+ 8003bd4:	f06f 0065 	mvn.w	r0, #101	; 0x65
+ 8003bd8:	e7de      	b.n	8003b98 <_validate_attempt+0x20>
+    if((args->is_secondary & 0x1) != args->is_secondary) return EPIN_RANGE_ERR;
+ 8003bda:	f06f 0066 	mvn.w	r0, #102	; 0x66
+ 8003bde:	e7db      	b.n	8003b98 <_validate_attempt+0x20>
+ 8003be0:	2eaf6312 	.word	0x2eaf6312
+
+08003be4 <warmup_ae>:
+
+// warmup_ae()
+//
+    static int
+warmup_ae(void)
+{
+ 8003be4:	b510      	push	{r4, lr}
+    ae_setup();
+ 8003be6:	f7fe ff03 	bl	80029f0 <ae_setup>
+ 8003bea:	2405      	movs	r4, #5
+
+    for(int retry=0; retry<5; retry++) {
+        if(!ae_probe()) break;
+ 8003bec:	f7ff f988 	bl	8002f00 <ae_probe>
+ 8003bf0:	b108      	cbz	r0, 8003bf6 <warmup_ae+0x12>
+    for(int retry=0; retry<5; retry++) {
+ 8003bf2:	3c01      	subs	r4, #1
+ 8003bf4:	d1fa      	bne.n	8003bec <warmup_ae+0x8>
+    }
+
+    if(ae_pair_unlock()) return -1;
+ 8003bf6:	f7ff f8f1 	bl	8002ddc <ae_pair_unlock>
+ 8003bfa:	4604      	mov	r4, r0
+ 8003bfc:	b918      	cbnz	r0, 8003c06 <warmup_ae+0x22>
+
+    // reset watchdog timer
+    ae_keep_alive();
+ 8003bfe:	f7fe ff29 	bl	8002a54 <ae_keep_alive>
+
+    return 0;
+}
+ 8003c02:	4620      	mov	r0, r4
+ 8003c04:	bd10      	pop	{r4, pc}
+    if(ae_pair_unlock()) return -1;
+ 8003c06:	f04f 34ff 	mov.w	r4, #4294967295	; 0xffffffff
+ 8003c0a:	e7fa      	b.n	8003c02 <warmup_ae+0x1e>
+
+08003c0c <_read_slot_as_counter>:
+{
+ 8003c0c:	b530      	push	{r4, r5, lr}
+ 8003c0e:	b091      	sub	sp, #68	; 0x44
+    uint32_t padded[32/4] = { 0 };
+ 8003c10:	2220      	movs	r2, #32
+{
+ 8003c12:	4604      	mov	r4, r0
+ 8003c14:	460d      	mov	r5, r1
+    uint32_t padded[32/4] = { 0 };
+ 8003c16:	4668      	mov	r0, sp
+ 8003c18:	2100      	movs	r1, #0
+ 8003c1a:	f009 fd5d 	bl	800d6d8 <memset>
+    ae_pair_unlock();
+ 8003c1e:	f7ff f8dd 	bl	8002ddc <ae_pair_unlock>
+    if(ae_read_data_slot(slot, (uint8_t *)padded, 32)) return -1;
+ 8003c22:	2220      	movs	r2, #32
+ 8003c24:	4669      	mov	r1, sp
+ 8003c26:	4620      	mov	r0, r4
+ 8003c28:	f7ff fc1e 	bl	8003468 <ae_read_data_slot>
+ 8003c2c:	b120      	cbz	r0, 8003c38 <_read_slot_as_counter+0x2c>
+ 8003c2e:	f04f 34ff 	mov.w	r4, #4294967295	; 0xffffffff
+}
+ 8003c32:	4620      	mov	r0, r4
+ 8003c34:	b011      	add	sp, #68	; 0x44
+ 8003c36:	bd30      	pop	{r4, r5, pc}
+    ae_pair_unlock();
+ 8003c38:	f7ff f8d0 	bl	8002ddc <ae_pair_unlock>
+    if(ae_gendig_slot(slot, (const uint8_t *)padded, tempkey)) return -1;
+ 8003c3c:	4620      	mov	r0, r4
+ 8003c3e:	aa08      	add	r2, sp, #32
+ 8003c40:	4669      	mov	r1, sp
+ 8003c42:	f7ff f9eb 	bl	800301c <ae_gendig_slot>
+ 8003c46:	4604      	mov	r4, r0
+ 8003c48:	2800      	cmp	r0, #0
+ 8003c4a:	d1f0      	bne.n	8003c2e <_read_slot_as_counter+0x22>
+    if(!ae_is_correct_tempkey(tempkey)) fatal_mitm();
+ 8003c4c:	a808      	add	r0, sp, #32
+ 8003c4e:	f7fe fff5 	bl	8002c3c <ae_is_correct_tempkey>
+ 8003c52:	b908      	cbnz	r0, 8003c58 <_read_slot_as_counter+0x4c>
+ 8003c54:	f7fc ff02 	bl	8000a5c <fatal_mitm>
+    *dest = padded[0];
+ 8003c58:	9b00      	ldr	r3, [sp, #0]
+ 8003c5a:	602b      	str	r3, [r5, #0]
+    return 0;
+ 8003c5c:	e7e9      	b.n	8003c32 <_read_slot_as_counter+0x26>
+
+08003c5e <get_last_success>:
+{
+ 8003c5e:	b530      	push	{r4, r5, lr}
+ 8003c60:	b095      	sub	sp, #84	; 0x54
+ 8003c62:	4605      	mov	r5, r0
+    ae_pair_unlock();
+ 8003c64:	f7ff f8ba 	bl	8002ddc <ae_pair_unlock>
+    uint32_t padded[32/4] = { 0 };
+ 8003c68:	2220      	movs	r2, #32
+ 8003c6a:	2100      	movs	r1, #0
+ 8003c6c:	a804      	add	r0, sp, #16
+ 8003c6e:	f009 fd33 	bl	800d6d8 <memset>
+    if(ae_read_data_slot(slot, (uint8_t *)padded, 32)) return -1;
+ 8003c72:	2220      	movs	r2, #32
+ 8003c74:	a904      	add	r1, sp, #16
+ 8003c76:	2005      	movs	r0, #5
+ 8003c78:	f7ff fbf6 	bl	8003468 <ae_read_data_slot>
+ 8003c7c:	b118      	cbz	r0, 8003c86 <get_last_success+0x28>
+ 8003c7e:	f04f 30ff 	mov.w	r0, #4294967295	; 0xffffffff
+}
+ 8003c82:	b015      	add	sp, #84	; 0x54
+ 8003c84:	bd30      	pop	{r4, r5, pc}
+    ae_pair_unlock();
+ 8003c86:	f7ff f8a9 	bl	8002ddc <ae_pair_unlock>
+    if(ae_gendig_slot(slot, (const uint8_t *)padded, tempkey)) return -1;
+ 8003c8a:	aa0c      	add	r2, sp, #48	; 0x30
+ 8003c8c:	a904      	add	r1, sp, #16
+ 8003c8e:	2005      	movs	r0, #5
+ 8003c90:	f7ff f9c4 	bl	800301c <ae_gendig_slot>
+ 8003c94:	4604      	mov	r4, r0
+ 8003c96:	2800      	cmp	r0, #0
+ 8003c98:	d1f1      	bne.n	8003c7e <get_last_success+0x20>
+    if(!ae_is_correct_tempkey(tempkey)) fatal_mitm();
+ 8003c9a:	a80c      	add	r0, sp, #48	; 0x30
+ 8003c9c:	f7fe ffce 	bl	8002c3c <ae_is_correct_tempkey>
+ 8003ca0:	b908      	cbnz	r0, 8003ca6 <get_last_success+0x48>
+ 8003ca2:	f7fc fedb 	bl	8000a5c <fatal_mitm>
+    if(_read_slot_as_counter(KEYNUM_lastgood, &lastgood)) return -1;
+ 8003ca6:	a901      	add	r1, sp, #4
+ 8003ca8:	2005      	movs	r0, #5
+    uint32_t lastgood=0, match_count=0, counter=0;
+ 8003caa:	e9cd 4401 	strd	r4, r4, [sp, #4]
+ 8003cae:	9403      	str	r4, [sp, #12]
+    if(_read_slot_as_counter(KEYNUM_lastgood, &lastgood)) return -1;
+ 8003cb0:	f7ff ffac 	bl	8003c0c <_read_slot_as_counter>
+ 8003cb4:	2800      	cmp	r0, #0
+ 8003cb6:	d1e2      	bne.n	8003c7e <get_last_success+0x20>
+    if(_read_slot_as_counter(KEYNUM_match_count, &match_count)) return -1;
+ 8003cb8:	a902      	add	r1, sp, #8
+ 8003cba:	2006      	movs	r0, #6
+ 8003cbc:	f7ff ffa6 	bl	8003c0c <_read_slot_as_counter>
+ 8003cc0:	4601      	mov	r1, r0
+ 8003cc2:	2800      	cmp	r0, #0
+ 8003cc4:	d1db      	bne.n	8003c7e <get_last_success+0x20>
+    if(ae_get_counter(&counter, 0)) return -1;
+ 8003cc6:	a803      	add	r0, sp, #12
+ 8003cc8:	f7ff fa83 	bl	80031d2 <ae_get_counter>
+ 8003ccc:	2800      	cmp	r0, #0
+ 8003cce:	d1d6      	bne.n	8003c7e <get_last_success+0x20>
+    if(lastgood > counter) {
+ 8003cd0:	9a01      	ldr	r2, [sp, #4]
+ 8003cd2:	9903      	ldr	r1, [sp, #12]
+    match_count &= ~31;
+ 8003cd4:	9b02      	ldr	r3, [sp, #8]
+    if(lastgood > counter) {
+ 8003cd6:	428a      	cmp	r2, r1
+    match_count &= ~31;
+ 8003cd8:	f023 031f 	bic.w	r3, r3, #31
+        args->num_fails = counter - lastgood;
+ 8003cdc:	bf94      	ite	ls
+ 8003cde:	1a8a      	subls	r2, r1, r2
+        args->num_fails = 99;
+ 8003ce0:	2263      	movhi	r2, #99	; 0x63
+    if(counter < match_count) {
+ 8003ce2:	4299      	cmp	r1, r3
+        args->attempts_left = match_count - counter;
+ 8003ce4:	bf34      	ite	cc
+ 8003ce6:	1a5b      	subcc	r3, r3, r1
+        args->attempts_left = 0;
+ 8003ce8:	2300      	movcs	r3, #0
+ 8003cea:	636a      	str	r2, [r5, #52]	; 0x34
+ 8003cec:	63ab      	str	r3, [r5, #56]	; 0x38
+ 8003cee:	e7c8      	b.n	8003c82 <get_last_success+0x24>
+
+08003cf0 <updates_for_good_login>:
+
+// updates_for_good_login()
+//
+    static int
+updates_for_good_login(uint8_t digest[32])
+{
+ 8003cf0:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8003cf2:	b08d      	sub	sp, #52	; 0x34
+    // User got the main PIN right: update the attempt counters,
+    // to document this (lastgood) and also bump the match counter if needed
+
+    uint32_t count;
+    int rv = ae_get_counter(&count, 0);
+ 8003cf4:	2100      	movs	r1, #0
+{
+ 8003cf6:	4606      	mov	r6, r0
+    int rv = ae_get_counter(&count, 0);
+ 8003cf8:	a802      	add	r0, sp, #8
+ 8003cfa:	f7ff fa6a 	bl	80031d2 <ae_get_counter>
+    if(rv) goto fail;
+ 8003cfe:	4601      	mov	r1, r0
+ 8003d00:	2800      	cmp	r0, #0
+ 8003d02:	d13b      	bne.n	8003d7c <updates_for_good_login+0x8c>
+
+    // Challenge: Have to update both the counter, and the target match value because
+    // no other way to have exact value.
+
+    uint32_t mc = (count + MAX_TARGET_ATTEMPTS + 32) & ~31;
+ 8003d04:	9b02      	ldr	r3, [sp, #8]
+ 8003d06:	f103 042d 	add.w	r4, r3, #45	; 0x2d
+ 8003d0a:	f024 041f 	bic.w	r4, r4, #31
+    ASSERT(mc >= count);
+ 8003d0e:	42a3      	cmp	r3, r4
+ 8003d10:	d902      	bls.n	8003d18 <updates_for_good_login+0x28>
+ 8003d12:	481d      	ldr	r0, [pc, #116]	; (8003d88 <updates_for_good_login+0x98>)
+ 8003d14:	f7fc fe98 	bl	8000a48 <fatal_error>
+
+    int bump = (mc - MAX_TARGET_ATTEMPTS) - count;
+ 8003d18:	1ae3      	subs	r3, r4, r3
+ 8003d1a:	f1a3 050d 	sub.w	r5, r3, #13
+    ASSERT(bump >= 1);
+ 8003d1e:	3b0e      	subs	r3, #14
+ 8003d20:	2b1f      	cmp	r3, #31
+ 8003d22:	d8f6      	bhi.n	8003d12 <updates_for_good_login+0x22>
+    // Would rather update the counter first, so that a hostile interruption can't increase
+    // attempts (altho the attacker knows the pin at that point?!) .. but chip won't
+    // let the counter go past the match value, so that has to be first.
+
+    // set the new "match count"
+    {   uint32_t    tmp[32/4] = {mc, mc} ;
+ 8003d24:	2218      	movs	r2, #24
+ 8003d26:	eb0d 0002 	add.w	r0, sp, r2
+        rv = ae_encrypted_write(KEYNUM_match_count, KEYNUM_main_pin, digest, (void *)tmp, 32);
+ 8003d2a:	2720      	movs	r7, #32
+    {   uint32_t    tmp[32/4] = {mc, mc} ;
+ 8003d2c:	f009 fcd4 	bl	800d6d8 <memset>
+        rv = ae_encrypted_write(KEYNUM_match_count, KEYNUM_main_pin, digest, (void *)tmp, 32);
+ 8003d30:	2103      	movs	r1, #3
+ 8003d32:	9700      	str	r7, [sp, #0]
+ 8003d34:	ab04      	add	r3, sp, #16
+ 8003d36:	4632      	mov	r2, r6
+ 8003d38:	2006      	movs	r0, #6
+    {   uint32_t    tmp[32/4] = {mc, mc} ;
+ 8003d3a:	e9cd 4404 	strd	r4, r4, [sp, #16]
+        rv = ae_encrypted_write(KEYNUM_match_count, KEYNUM_main_pin, digest, (void *)tmp, 32);
+ 8003d3e:	f7ff fb5d 	bl	80033fc <ae_encrypted_write>
+        if(rv) goto fail;
+ 8003d42:	4601      	mov	r1, r0
+ 8003d44:	b9d0      	cbnz	r0, 8003d7c <updates_for_good_login+0x8c>
+    }
+
+    // incr the counter a bunch to get to that-13
+    uint32_t new_count = 0;
+ 8003d46:	9003      	str	r0, [sp, #12]
+    rv = ae_add_counter(&new_count, 0, bump);
+ 8003d48:	462a      	mov	r2, r5
+ 8003d4a:	a803      	add	r0, sp, #12
+ 8003d4c:	f7ff fa60 	bl	8003210 <ae_add_counter>
+    if(rv) goto fail;
+ 8003d50:	4601      	mov	r1, r0
+ 8003d52:	b998      	cbnz	r0, 8003d7c <updates_for_good_login+0x8c>
+
+    ASSERT(new_count == count + bump);
+ 8003d54:	9b02      	ldr	r3, [sp, #8]
+ 8003d56:	441d      	add	r5, r3
+ 8003d58:	9b03      	ldr	r3, [sp, #12]
+ 8003d5a:	429d      	cmp	r5, r3
+ 8003d5c:	d1d9      	bne.n	8003d12 <updates_for_good_login+0x22>
+    ASSERT(mc > new_count);
+ 8003d5e:	42a5      	cmp	r5, r4
+ 8003d60:	d2d7      	bcs.n	8003d12 <updates_for_good_login+0x22>
+
+    // Update the "last good" counter
+    {   uint32_t    tmp[32/4] = {new_count, 0 };
+ 8003d62:	221c      	movs	r2, #28
+ 8003d64:	a805      	add	r0, sp, #20
+ 8003d66:	f009 fcb7 	bl	800d6d8 <memset>
+        rv = ae_encrypted_write(KEYNUM_lastgood, KEYNUM_main_pin, digest, (void *)tmp, 32);
+ 8003d6a:	9700      	str	r7, [sp, #0]
+ 8003d6c:	ab04      	add	r3, sp, #16
+ 8003d6e:	4632      	mov	r2, r6
+ 8003d70:	2103      	movs	r1, #3
+ 8003d72:	2005      	movs	r0, #5
+    {   uint32_t    tmp[32/4] = {new_count, 0 };
+ 8003d74:	9504      	str	r5, [sp, #16]
+        rv = ae_encrypted_write(KEYNUM_lastgood, KEYNUM_main_pin, digest, (void *)tmp, 32);
+ 8003d76:	f7ff fb41 	bl	80033fc <ae_encrypted_write>
+        if(rv) goto fail;
+ 8003d7a:	b118      	cbz	r0, 8003d84 <updates_for_good_login+0x94>
+    // just be reducing attempts.
+
+    return 0;
+
+fail:
+    ae_reset_chip();
+ 8003d7c:	f7fe fe2a 	bl	80029d4 <ae_reset_chip>
+    return EPIN_AE_FAIL;
+ 8003d80:	f06f 0069 	mvn.w	r0, #105	; 0x69
+}
+ 8003d84:	b00d      	add	sp, #52	; 0x34
+ 8003d86:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8003d88:	0800e466 	.word	0x0800e466
+
+08003d8c <pin_hash_attempt>:
+{
+ 8003d8c:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8003d8e:	4615      	mov	r5, r2
+ 8003d90:	b089      	sub	sp, #36	; 0x24
+    if(pin_len == 0) {
+ 8003d92:	460c      	mov	r4, r1
+ 8003d94:	b931      	cbnz	r1, 8003da4 <pin_hash_attempt+0x18>
+        memset(result, 0, 32);
+ 8003d96:	2220      	movs	r2, #32
+ 8003d98:	4628      	mov	r0, r5
+ 8003d9a:	f009 fc9d 	bl	800d6d8 <memset>
+}
+ 8003d9e:	4620      	mov	r0, r4
+ 8003da0:	b009      	add	sp, #36	; 0x24
+ 8003da2:	bdf0      	pop	{r4, r5, r6, r7, pc}
+    pin_hash(pin, pin_len, tmp, PIN_PURPOSE_NORMAL);
+ 8003da4:	4b0f      	ldr	r3, [pc, #60]	; (8003de4 <pin_hash_attempt+0x58>)
+ 8003da6:	466a      	mov	r2, sp
+ 8003da8:	f7ff fe7a 	bl	8003aa0 <pin_hash>
+    int rv = ae_stretch_iter(tmp, result, KDF_ITER_PIN);
+ 8003dac:	2208      	movs	r2, #8
+ 8003dae:	4629      	mov	r1, r5
+ 8003db0:	4668      	mov	r0, sp
+ 8003db2:	f7ff fd3b 	bl	800382c <ae_stretch_iter>
+    if(rv) return EPIN_AE_FAIL;
+ 8003db6:	4604      	mov	r4, r0
+ 8003db8:	b988      	cbnz	r0, 8003dde <pin_hash_attempt+0x52>
+    memcpy(tmp, result, 32);
+ 8003dba:	462b      	mov	r3, r5
+ 8003dbc:	466e      	mov	r6, sp
+ 8003dbe:	f105 0720 	add.w	r7, r5, #32
+ 8003dc2:	6818      	ldr	r0, [r3, #0]
+ 8003dc4:	6859      	ldr	r1, [r3, #4]
+ 8003dc6:	4632      	mov	r2, r6
+ 8003dc8:	c203      	stmia	r2!, {r0, r1}
+ 8003dca:	3308      	adds	r3, #8
+ 8003dcc:	42bb      	cmp	r3, r7
+ 8003dce:	4616      	mov	r6, r2
+ 8003dd0:	d1f7      	bne.n	8003dc2 <pin_hash_attempt+0x36>
+    ae_mixin_key(KEYNUM_pin_attempt, tmp, result);
+ 8003dd2:	462a      	mov	r2, r5
+ 8003dd4:	4669      	mov	r1, sp
+ 8003dd6:	2004      	movs	r0, #4
+ 8003dd8:	f7ff fd50 	bl	800387c <ae_mixin_key>
+    return 0;
+ 8003ddc:	e7df      	b.n	8003d9e <pin_hash_attempt+0x12>
+    if(rv) return EPIN_AE_FAIL;
+ 8003dde:	f06f 0469 	mvn.w	r4, #105	; 0x69
+ 8003de2:	e7dc      	b.n	8003d9e <pin_hash_attempt+0x12>
+ 8003de4:	334d1858 	.word	0x334d1858
+
+08003de8 <set_is_trick.part.0>:
+set_is_trick(pinAttempt_t *args, const trick_slot_t *slot)
+ 8003de8:	b5f0      	push	{r4, r5, r6, r7, lr}
+    args->delay_achieved = slot->tc_arg;
+ 8003dea:	88cb      	ldrh	r3, [r1, #6]
+ 8003dec:	62c3      	str	r3, [r0, #44]	; 0x2c
+set_is_trick(pinAttempt_t *args, const trick_slot_t *slot)
+ 8003dee:	f5ad 7d0d 	sub.w	sp, sp, #564	; 0x234
+    memcpy(key, &args->private_state, sizeof(args->private_state));
+ 8003df2:	6c03      	ldr	r3, [r0, #64]	; 0x40
+    memcpy(key+4, rom_secrets->hash_cache_secret+4, sizeof(rom_secrets->hash_cache_secret)-4);
+ 8003df4:	4d0f      	ldr	r5, [pc, #60]	; (8003e34 <set_is_trick.part.0+0x4c>)
+    memcpy(key, &args->private_state, sizeof(args->private_state));
+ 8003df6:	9303      	str	r3, [sp, #12]
+set_is_trick(pinAttempt_t *args, const trick_slot_t *slot)
+ 8003df8:	4606      	mov	r6, r0
+ 8003dfa:	460f      	mov	r7, r1
+    memcpy(key+4, rom_secrets->hash_cache_secret+4, sizeof(rom_secrets->hash_cache_secret)-4);
+ 8003dfc:	cd0f      	ldmia	r5!, {r0, r1, r2, r3}
+ 8003dfe:	ac04      	add	r4, sp, #16
+ 8003e00:	c40f      	stmia	r4!, {r0, r1, r2, r3}
+ 8003e02:	e895 0007 	ldmia.w	r5, {r0, r1, r2}
+ 8003e06:	e884 0007 	stmia.w	r4, {r0, r1, r2}
+    aes_init(&ctx);
+ 8003e0a:	a80b      	add	r0, sp, #44	; 0x2c
+ 8003e0c:	f004 fb5a 	bl	80084c4 <aes_init>
+    aes_add(&ctx, (uint8_t *)slot, 32);
+ 8003e10:	4639      	mov	r1, r7
+ 8003e12:	a80b      	add	r0, sp, #44	; 0x2c
+ 8003e14:	2220      	movs	r2, #32
+ 8003e16:	f004 fb5b 	bl	80084d0 <aes_add>
+    aes_done(&ctx, args->cached_main_pin, 32, key, NULL);
+ 8003e1a:	2300      	movs	r3, #0
+ 8003e1c:	9300      	str	r3, [sp, #0]
+ 8003e1e:	2220      	movs	r2, #32
+ 8003e20:	ab03      	add	r3, sp, #12
+ 8003e22:	f106 01f8 	add.w	r1, r6, #248	; 0xf8
+ 8003e26:	a80b      	add	r0, sp, #44	; 0x2c
+ 8003e28:	f004 fb68 	bl	80084fc <aes_done>
+}
+ 8003e2c:	f50d 7d0d 	add.w	sp, sp, #564	; 0x234
+ 8003e30:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8003e32:	bf00      	nop
+ 8003e34:	0801c074 	.word	0x0801c074
+
+08003e38 <pin_setup0>:
+    __HAL_RCC_CRC_CLK_ENABLE();
+ 8003e38:	4b09      	ldr	r3, [pc, #36]	; (8003e60 <pin_setup0+0x28>)
+ 8003e3a:	6c9a      	ldr	r2, [r3, #72]	; 0x48
+{
+ 8003e3c:	b513      	push	{r0, r1, r4, lr}
+    __HAL_RCC_CRC_CLK_ENABLE();
+ 8003e3e:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 8003e42:	649a      	str	r2, [r3, #72]	; 0x48
+ 8003e44:	6c9b      	ldr	r3, [r3, #72]	; 0x48
+    CRC->INIT = rng_sample();
+ 8003e46:	4c07      	ldr	r4, [pc, #28]	; (8003e64 <pin_setup0+0x2c>)
+    __HAL_RCC_CRC_CLK_ENABLE();
+ 8003e48:	f403 5380 	and.w	r3, r3, #4096	; 0x1000
+ 8003e4c:	9301      	str	r3, [sp, #4]
+ 8003e4e:	9b01      	ldr	r3, [sp, #4]
+    CRC->INIT = rng_sample();
+ 8003e50:	f7fe fc56 	bl	8002700 <rng_sample>
+ 8003e54:	6120      	str	r0, [r4, #16]
+    CRC->POL = rng_sample();
+ 8003e56:	f7fe fc53 	bl	8002700 <rng_sample>
+ 8003e5a:	6160      	str	r0, [r4, #20]
+}
+ 8003e5c:	b002      	add	sp, #8
+ 8003e5e:	bd10      	pop	{r4, pc}
+ 8003e60:	40021000 	.word	0x40021000
+ 8003e64:	40023000 	.word	0x40023000
+
+08003e68 <pin_cache_get_key>:
+{
+ 8003e68:	b510      	push	{r4, lr}
+ 8003e6a:	b094      	sub	sp, #80	; 0x50
+ 8003e6c:	4604      	mov	r4, r0
+    sha256_init(&ctx);
+ 8003e6e:	a801      	add	r0, sp, #4
+ 8003e70:	f001 fb3e 	bl	80054f0 <sha256_init>
+    reboot_nonce(&ctx);
+ 8003e74:	a801      	add	r0, sp, #4
+ 8003e76:	f7ff fdfd 	bl	8003a74 <reboot_nonce>
+    sha256_update(&ctx, rom_secrets->hash_cache_secret, 32);
+ 8003e7a:	2220      	movs	r2, #32
+ 8003e7c:	a801      	add	r0, sp, #4
+ 8003e7e:	4904      	ldr	r1, [pc, #16]	; (8003e90 <pin_cache_get_key+0x28>)
+ 8003e80:	f001 fb44 	bl	800550c <sha256_update>
+    sha256_final(&ctx, key);
+ 8003e84:	4621      	mov	r1, r4
+ 8003e86:	a801      	add	r0, sp, #4
+ 8003e88:	f001 fb86 	bl	8005598 <sha256_final>
+}
+ 8003e8c:	b014      	add	sp, #80	; 0x50
+ 8003e8e:	bd10      	pop	{r4, pc}
+ 8003e90:	0801c070 	.word	0x0801c070
+
+08003e94 <pin_cache_save>:
+{
+ 8003e94:	b530      	push	{r4, r5, lr}
+ 8003e96:	460d      	mov	r5, r1
+ 8003e98:	b089      	sub	sp, #36	; 0x24
+ 8003e9a:	4604      	mov	r4, r0
+    if(!check_all_zeros(digest, 32)) {
+ 8003e9c:	2120      	movs	r1, #32
+ 8003e9e:	4628      	mov	r0, r5
+ 8003ea0:	f7fe fc0e 	bl	80026c0 <check_all_zeros>
+ 8003ea4:	b9a0      	cbnz	r0, 8003ed0 <pin_cache_save+0x3c>
+        pin_cache_get_key(value);
+ 8003ea6:	4668      	mov	r0, sp
+ 8003ea8:	f7ff ffde 	bl	8003e68 <pin_cache_get_key>
+ 8003eac:	466b      	mov	r3, sp
+ 8003eae:	f105 0120 	add.w	r1, r5, #32
+		*(acc) ^= *(more);
+ 8003eb2:	781a      	ldrb	r2, [r3, #0]
+ 8003eb4:	f815 0b01 	ldrb.w	r0, [r5], #1
+ 8003eb8:	4042      	eors	r2, r0
+	for(; len; len--, more++, acc++) {
+ 8003eba:	428d      	cmp	r5, r1
+		*(acc) ^= *(more);
+ 8003ebc:	f803 2b01 	strb.w	r2, [r3], #1
+	for(; len; len--, more++, acc++) {
+ 8003ec0:	d1f7      	bne.n	8003eb2 <pin_cache_save+0x1e>
+    ASSERT(args->magic_value == PA_MAGIC_V2);
+ 8003ec2:	6822      	ldr	r2, [r4, #0]
+ 8003ec4:	4b0d      	ldr	r3, [pc, #52]	; (8003efc <pin_cache_save+0x68>)
+ 8003ec6:	429a      	cmp	r2, r3
+ 8003ec8:	d008      	beq.n	8003edc <pin_cache_save+0x48>
+ 8003eca:	480d      	ldr	r0, [pc, #52]	; (8003f00 <pin_cache_save+0x6c>)
+ 8003ecc:	f7fc fdbc 	bl	8000a48 <fatal_error>
+        memset(value, 0, 32);
+ 8003ed0:	2220      	movs	r2, #32
+ 8003ed2:	2100      	movs	r1, #0
+ 8003ed4:	4668      	mov	r0, sp
+ 8003ed6:	f009 fbff 	bl	800d6d8 <memset>
+ 8003eda:	e7f2      	b.n	8003ec2 <pin_cache_save+0x2e>
+    memcpy(args->cached_main_pin, value, 32);
+ 8003edc:	466b      	mov	r3, sp
+ 8003ede:	f104 02f8 	add.w	r2, r4, #248	; 0xf8
+ 8003ee2:	ad08      	add	r5, sp, #32
+ 8003ee4:	461c      	mov	r4, r3
+ 8003ee6:	cc03      	ldmia	r4!, {r0, r1}
+ 8003ee8:	42ac      	cmp	r4, r5
+ 8003eea:	6010      	str	r0, [r2, #0]
+ 8003eec:	6051      	str	r1, [r2, #4]
+ 8003eee:	4623      	mov	r3, r4
+ 8003ef0:	f102 0208 	add.w	r2, r2, #8
+ 8003ef4:	d1f6      	bne.n	8003ee4 <pin_cache_save+0x50>
+}
+ 8003ef6:	b009      	add	sp, #36	; 0x24
+ 8003ef8:	bd30      	pop	{r4, r5, pc}
+ 8003efa:	bf00      	nop
+ 8003efc:	2eaf6312 	.word	0x2eaf6312
+ 8003f00:	0800e466 	.word	0x0800e466
+
+08003f04 <pin_cache_restore>:
+{
+ 8003f04:	b510      	push	{r4, lr}
+    ASSERT(args->magic_value == PA_MAGIC_V2);
+ 8003f06:	6802      	ldr	r2, [r0, #0]
+ 8003f08:	4b14      	ldr	r3, [pc, #80]	; (8003f5c <pin_cache_restore+0x58>)
+ 8003f0a:	429a      	cmp	r2, r3
+{
+ 8003f0c:	b088      	sub	sp, #32
+ 8003f0e:	460c      	mov	r4, r1
+    ASSERT(args->magic_value == PA_MAGIC_V2);
+ 8003f10:	d002      	beq.n	8003f18 <pin_cache_restore+0x14>
+ 8003f12:	4813      	ldr	r0, [pc, #76]	; (8003f60 <pin_cache_restore+0x5c>)
+ 8003f14:	f7fc fd98 	bl	8000a48 <fatal_error>
+    memcpy(digest, args->cached_main_pin, 32);
+ 8003f18:	f100 03f8 	add.w	r3, r0, #248	; 0xf8
+ 8003f1c:	460a      	mov	r2, r1
+ 8003f1e:	f500 708c 	add.w	r0, r0, #280	; 0x118
+ 8003f22:	f853 1b04 	ldr.w	r1, [r3], #4
+ 8003f26:	f842 1b04 	str.w	r1, [r2], #4
+ 8003f2a:	4283      	cmp	r3, r0
+ 8003f2c:	d1f9      	bne.n	8003f22 <pin_cache_restore+0x1e>
+    if(!check_all_zeros(digest, 32)) {
+ 8003f2e:	2120      	movs	r1, #32
+ 8003f30:	4620      	mov	r0, r4
+ 8003f32:	f7fe fbc5 	bl	80026c0 <check_all_zeros>
+ 8003f36:	b970      	cbnz	r0, 8003f56 <pin_cache_restore+0x52>
+        pin_cache_get_key(key);
+ 8003f38:	4668      	mov	r0, sp
+ 8003f3a:	f7ff ff95 	bl	8003e68 <pin_cache_get_key>
+ 8003f3e:	1e62      	subs	r2, r4, #1
+ 8003f40:	466b      	mov	r3, sp
+ 8003f42:	341f      	adds	r4, #31
+		*(acc) ^= *(more);
+ 8003f44:	f812 1f01 	ldrb.w	r1, [r2, #1]!
+ 8003f48:	f813 0b01 	ldrb.w	r0, [r3], #1
+	for(; len; len--, more++, acc++) {
+ 8003f4c:	42a2      	cmp	r2, r4
+		*(acc) ^= *(more);
+ 8003f4e:	ea81 0100 	eor.w	r1, r1, r0
+ 8003f52:	7011      	strb	r1, [r2, #0]
+	for(; len; len--, more++, acc++) {
+ 8003f54:	d1f6      	bne.n	8003f44 <pin_cache_restore+0x40>
+}
+ 8003f56:	b008      	add	sp, #32
+ 8003f58:	bd10      	pop	{r4, pc}
+ 8003f5a:	bf00      	nop
+ 8003f5c:	2eaf6312 	.word	0x2eaf6312
+ 8003f60:	0800e466 	.word	0x0800e466
+
+08003f64 <pin_prefix_words>:
+{
+ 8003f64:	b530      	push	{r4, r5, lr}
+ 8003f66:	b091      	sub	sp, #68	; 0x44
+    pin_hash(pin_prefix, prefix_len, tmp, PIN_PURPOSE_WORDS);
+ 8003f68:	4b0b      	ldr	r3, [pc, #44]	; (8003f98 <pin_prefix_words+0x34>)
+{
+ 8003f6a:	4615      	mov	r5, r2
+    pin_hash(pin_prefix, prefix_len, tmp, PIN_PURPOSE_WORDS);
+ 8003f6c:	466a      	mov	r2, sp
+ 8003f6e:	f7ff fd97 	bl	8003aa0 <pin_hash>
+    ae_setup();
+ 8003f72:	f7fe fd3d 	bl	80029f0 <ae_setup>
+    int rv = ae_stretch_iter(tmp, digest, KDF_ITER_WORDS);
+ 8003f76:	2206      	movs	r2, #6
+ 8003f78:	a908      	add	r1, sp, #32
+ 8003f7a:	4668      	mov	r0, sp
+ 8003f7c:	f7ff fc56 	bl	800382c <ae_stretch_iter>
+ 8003f80:	4604      	mov	r4, r0
+    ae_reset_chip();
+ 8003f82:	f7fe fd27 	bl	80029d4 <ae_reset_chip>
+	if(rv) return -1;
+ 8003f86:	b924      	cbnz	r4, 8003f92 <pin_prefix_words+0x2e>
+    memcpy(result, digest, 4);
+ 8003f88:	9b08      	ldr	r3, [sp, #32]
+ 8003f8a:	602b      	str	r3, [r5, #0]
+}
+ 8003f8c:	4620      	mov	r0, r4
+ 8003f8e:	b011      	add	sp, #68	; 0x44
+ 8003f90:	bd30      	pop	{r4, r5, pc}
+	if(rv) return -1;
+ 8003f92:	f04f 34ff 	mov.w	r4, #4294967295	; 0xffffffff
+ 8003f96:	e7f9      	b.n	8003f8c <pin_prefix_words+0x28>
+ 8003f98:	2e6d6773 	.word	0x2e6d6773
+
+08003f9c <calc_delay_required>:
+}
+ 8003f9c:	2000      	movs	r0, #0
+ 8003f9e:	4770      	bx	lr
+
+08003fa0 <pin_setup_attempt>:
+{
+ 8003fa0:	b5f0      	push	{r4, r5, r6, r7, lr}
+    int rv = _validate_attempt(args, true);
+ 8003fa2:	2101      	movs	r1, #1
+{
+ 8003fa4:	b091      	sub	sp, #68	; 0x44
+ 8003fa6:	4605      	mov	r5, r0
+    int rv = _validate_attempt(args, true);
+ 8003fa8:	f7ff fde6 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 8003fac:	4604      	mov	r4, r0
+ 8003fae:	bb28      	cbnz	r0, 8003ffc <pin_setup_attempt+0x5c>
+    if(args->is_secondary) {
+ 8003fb0:	686b      	ldr	r3, [r5, #4]
+ 8003fb2:	2b00      	cmp	r3, #0
+ 8003fb4:	d158      	bne.n	8004068 <pin_setup_attempt+0xc8>
+    int     pin_len = args->pin_len;
+ 8003fb6:	6aaf      	ldr	r7, [r5, #40]	; 0x28
+    memcpy(pin_copy, args->pin, pin_len);
+ 8003fb8:	f105 0608 	add.w	r6, r5, #8
+ 8003fbc:	463a      	mov	r2, r7
+ 8003fbe:	4631      	mov	r1, r6
+ 8003fc0:	4668      	mov	r0, sp
+ 8003fc2:	f009 fb61 	bl	800d688 <memcpy>
+    memset(args, 0, PIN_ATTEMPT_SIZE_V2);
+ 8003fc6:	f44f 728c 	mov.w	r2, #280	; 0x118
+ 8003fca:	4621      	mov	r1, r4
+ 8003fcc:	4628      	mov	r0, r5
+ 8003fce:	f009 fb83 	bl	800d6d8 <memset>
+    args->magic_value = PA_MAGIC_V2;
+ 8003fd2:	4b28      	ldr	r3, [pc, #160]	; (8004074 <pin_setup_attempt+0xd4>)
+ 8003fd4:	602b      	str	r3, [r5, #0]
+    memcpy(args->pin, pin_copy, pin_len);
+ 8003fd6:	463a      	mov	r2, r7
+ 8003fd8:	4669      	mov	r1, sp
+    args->pin_len = pin_len;
+ 8003fda:	62af      	str	r7, [r5, #40]	; 0x28
+    memcpy(args->pin, pin_copy, pin_len);
+ 8003fdc:	4630      	mov	r0, r6
+ 8003fde:	f009 fb53 	bl	800d688 <memcpy>
+    if(warmup_ae()) {
+ 8003fe2:	f7ff fdff 	bl	8003be4 <warmup_ae>
+ 8003fe6:	2800      	cmp	r0, #0
+ 8003fe8:	d141      	bne.n	800406e <pin_setup_attempt+0xce>
+    if(get_last_success(args)) {
+ 8003fea:	4628      	mov	r0, r5
+ 8003fec:	f7ff fe37 	bl	8003c5e <get_last_success>
+ 8003ff0:	4604      	mov	r4, r0
+ 8003ff2:	b130      	cbz	r0, 8004002 <pin_setup_attempt+0x62>
+        ae_reset_chip();
+ 8003ff4:	f7fe fcee 	bl	80029d4 <ae_reset_chip>
+        return EPIN_AE_FAIL;
+ 8003ff8:	f06f 0469 	mvn.w	r4, #105	; 0x69
+}
+ 8003ffc:	4620      	mov	r0, r4
+ 8003ffe:	b011      	add	sp, #68	; 0x44
+ 8004000:	bdf0      	pop	{r4, r5, r6, r7, pc}
+    uint8_t blank[32] = {0};
+ 8004002:	4601      	mov	r1, r0
+ 8004004:	221c      	movs	r2, #28
+    args->delay_achieved = 0;
+ 8004006:	e9c5 000b 	strd	r0, r0, [r5, #44]	; 0x2c
+    uint8_t blank[32] = {0};
+ 800400a:	9008      	str	r0, [sp, #32]
+ 800400c:	a809      	add	r0, sp, #36	; 0x24
+ 800400e:	f009 fb63 	bl	800d6d8 <memset>
+    ae_reset_chip();
+ 8004012:	f7fe fcdf 	bl	80029d4 <ae_reset_chip>
+    ae_pair_unlock();
+ 8004016:	f7fe fee1 	bl	8002ddc <ae_pair_unlock>
+    int is_blank = (ae_checkmac_hard(keynum, blank) == 0);
+ 800401a:	a908      	add	r1, sp, #32
+ 800401c:	2003      	movs	r0, #3
+ 800401e:	f7ff f86b 	bl	80030f8 <ae_checkmac_hard>
+ 8004022:	4606      	mov	r6, r0
+    ae_reset_chip();
+ 8004024:	f7fe fcd6 	bl	80029d4 <ae_reset_chip>
+    if(pin_is_blank(KEYNUM_main_pin)) {
+ 8004028:	b9c6      	cbnz	r6, 800405c <pin_setup_attempt+0xbc>
+        args->state_flags |= PA_SUCCESSFUL | PA_IS_BLANK;
+ 800402a:	6beb      	ldr	r3, [r5, #60]	; 0x3c
+        const uint8_t zeros[32] = {0};
+ 800402c:	9408      	str	r4, [sp, #32]
+        args->state_flags |= PA_SUCCESSFUL | PA_IS_BLANK;
+ 800402e:	f043 0303 	orr.w	r3, r3, #3
+ 8004032:	63eb      	str	r3, [r5, #60]	; 0x3c
+        const uint8_t zeros[32] = {0};
+ 8004034:	221c      	movs	r2, #28
+ 8004036:	4621      	mov	r1, r4
+ 8004038:	a809      	add	r0, sp, #36	; 0x24
+ 800403a:	f009 fb4d 	bl	800d6d8 <memset>
+        pin_cache_save(args, zeros);
+ 800403e:	a908      	add	r1, sp, #32
+ 8004040:	4628      	mov	r0, r5
+ 8004042:	f7ff ff27 	bl	8003e94 <pin_cache_save>
+    args->private_state = ((rng_sample() & ~1) | is_trick_pin) ^ rom_secrets->hash_cache_secret[0];
+ 8004046:	f7fe fb5b 	bl	8002700 <rng_sample>
+ 800404a:	4b0b      	ldr	r3, [pc, #44]	; (8004078 <pin_setup_attempt+0xd8>)
+ 800404c:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 8004050:	f020 0001 	bic.w	r0, r0, #1
+        args->delay_achieved = 0;
+ 8004054:	e9c5 440b 	strd	r4, r4, [r5, #44]	; 0x2c
+    args->private_state = ((rng_sample() & ~1) | is_trick_pin) ^ rom_secrets->hash_cache_secret[0];
+ 8004058:	4058      	eors	r0, r3
+ 800405a:	6428      	str	r0, [r5, #64]	; 0x40
+    _hmac_attempt(args, args->hmac);
+ 800405c:	f105 0144 	add.w	r1, r5, #68	; 0x44
+ 8004060:	4628      	mov	r0, r5
+ 8004062:	f7ff fd5b 	bl	8003b1c <_hmac_attempt>
+}
+ 8004066:	e7c9      	b.n	8003ffc <pin_setup_attempt+0x5c>
+        return EPIN_PRIMARY_ONLY;
+ 8004068:	f06f 0471 	mvn.w	r4, #113	; 0x71
+ 800406c:	e7c6      	b.n	8003ffc <pin_setup_attempt+0x5c>
+        return EPIN_I_AM_BRICK;
+ 800406e:	f06f 0468 	mvn.w	r4, #104	; 0x68
+ 8004072:	e7c3      	b.n	8003ffc <pin_setup_attempt+0x5c>
+ 8004074:	2eaf6312 	.word	0x2eaf6312
+ 8004078:	0801c000 	.word	0x0801c000
+
+0800407c <pin_delay>:
+}
+ 800407c:	2000      	movs	r0, #0
+ 800407e:	4770      	bx	lr
+
+08004080 <pin_login_attempt>:
+//
+// Do the PIN check, and return a value. Or fail.
+//
+    int
+pin_login_attempt(pinAttempt_t *args)
+{
+ 8004080:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+    bool deltamode = false;
+    char tmp_pin[32];
+
+    int rv = _validate_attempt(args, false);
+ 8004084:	2100      	movs	r1, #0
+{
+ 8004086:	b0c7      	sub	sp, #284	; 0x11c
+ 8004088:	4604      	mov	r4, r0
+    int rv = _validate_attempt(args, false);
+ 800408a:	f7ff fd75 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 800408e:	4605      	mov	r5, r0
+ 8004090:	2800      	cmp	r0, #0
+ 8004092:	d179      	bne.n	8004188 <pin_login_attempt+0x108>
+
+    if(args->state_flags & PA_SUCCESSFUL) {
+ 8004094:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 8004096:	07d9      	lsls	r1, r3, #31
+ 8004098:	f100 80c5 	bmi.w	8004226 <pin_login_attempt+0x1a6>
+    }
+
+    // Mk4: Check SE2 first to see if this is a "trick" pin.
+    // - this call may have side-effects, like wiping keys, bricking, etc.
+    trick_slot_t    slot;
+    bool is_trick = se2_test_trick_pin(args->pin, args->pin_len, &slot, false);
+ 800409c:	f104 0808 	add.w	r8, r4, #8
+ 80040a0:	4603      	mov	r3, r0
+ 80040a2:	6aa1      	ldr	r1, [r4, #40]	; 0x28
+ 80040a4:	aa26      	add	r2, sp, #152	; 0x98
+ 80040a6:	4640      	mov	r0, r8
+ 80040a8:	f003 fee8 	bl	8007e7c <se2_test_trick_pin>
+    
+    if(is_trick) {
+ 80040ac:	4606      	mov	r6, r0
+ 80040ae:	2800      	cmp	r0, #0
+ 80040b0:	d04b      	beq.n	800414a <pin_login_attempt+0xca>
+        // Mark as success
+        args->state_flags = PA_SUCCESSFUL;
+        args->num_fails = 0;
+        args->attempts_left = MAX_TARGET_ATTEMPTS;
+
+        bool wipe = (slot.tc_flags & TC_WIPE) && !(slot.tc_flags & (TC_WORD_WALLET|TC_XPRV_WALLET));
+ 80040b2:	f9bd 209c 	ldrsh.w	r2, [sp, #156]	; 0x9c
+        args->num_fails = 0;
+ 80040b6:	6365      	str	r5, [r4, #52]	; 0x34
+        args->state_flags = PA_SUCCESSFUL;
+ 80040b8:	2301      	movs	r3, #1
+ 80040ba:	63e3      	str	r3, [r4, #60]	; 0x3c
+        bool wipe = (slot.tc_flags & TC_WIPE) && !(slot.tc_flags & (TC_WORD_WALLET|TC_XPRV_WALLET));
+ 80040bc:	2a00      	cmp	r2, #0
+        args->attempts_left = MAX_TARGET_ATTEMPTS;
+ 80040be:	f04f 030d 	mov.w	r3, #13
+ 80040c2:	63a3      	str	r3, [r4, #56]	; 0x38
+        bool wipe = (slot.tc_flags & TC_WIPE) && !(slot.tc_flags & (TC_WORD_WALLET|TC_XPRV_WALLET));
+ 80040c4:	f8bd 309c 	ldrh.w	r3, [sp, #156]	; 0x9c
+ 80040c8:	da4f      	bge.n	800416a <pin_login_attempt+0xea>
+ 80040ca:	f413 5fc0 	tst.w	r3, #6144	; 0x1800
+ 80040ce:	bf0c      	ite	eq
+ 80040d0:	2701      	moveq	r7, #1
+ 80040d2:	2700      	movne	r7, #0
+        if(check_all_zeros(slot.xdata, 32) || wipe) {
+ 80040d4:	2120      	movs	r1, #32
+ 80040d6:	a828      	add	r0, sp, #160	; 0xa0
+ 80040d8:	f7fe faf2 	bl	80026c0 <check_all_zeros>
+ 80040dc:	b900      	cbnz	r0, 80040e0 <pin_login_attempt+0x60>
+ 80040de:	b11f      	cbz	r7, 80040e8 <pin_login_attempt+0x68>
+            args->state_flags |= PA_ZERO_SECRET;
+ 80040e0:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 80040e2:	f043 0310 	orr.w	r3, r3, #16
+ 80040e6:	63e3      	str	r3, [r4, #60]	; 0x3c
+    args->private_state = ((rng_sample() & ~1) | is_trick_pin) ^ rom_secrets->hash_cache_secret[0];
+ 80040e8:	f7fe fb0a 	bl	8002700 <rng_sample>
+ 80040ec:	4b51      	ldr	r3, [pc, #324]	; (8004234 <pin_login_attempt+0x1b4>)
+ 80040ee:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 80040f2:	f040 0001 	orr.w	r0, r0, #1
+ 80040f6:	4058      	eors	r0, r3
+    args->delay_required = (slot->tc_flags & ~TC_HIDDEN_MASK);
+ 80040f8:	f8bd 309c 	ldrh.w	r3, [sp, #156]	; 0x9c
+    args->private_state = ((rng_sample() & ~1) | is_trick_pin) ^ rom_secrets->hash_cache_secret[0];
+ 80040fc:	6420      	str	r0, [r4, #64]	; 0x40
+    args->delay_required = (slot->tc_flags & ~TC_HIDDEN_MASK);
+ 80040fe:	f423 4278 	bic.w	r2, r3, #63488	; 0xf800
+ 8004102:	6322      	str	r2, [r4, #48]	; 0x30
+    if(slot->tc_flags & TC_DELTA_MODE) {
+ 8004104:	055a      	lsls	r2, r3, #21
+ 8004106:	d532      	bpl.n	800416e <pin_login_attempt+0xee>
+        args->delay_achieved = 0;
+ 8004108:	2300      	movs	r3, #0
+ 800410a:	62e3      	str	r3, [r4, #44]	; 0x2c
+    memcpy(tmp_pin, pin, pin_len);
+ 800410c:	6aa7      	ldr	r7, [r4, #40]	; 0x28
+            // Thug gave wrong PIN, but we are going to let them 
+            // past (by calculating correct PIN, up to 4 digits different),
+            // and the mpy firmware can do tricky stuff to protect funds
+            // even though the private key is known at that point.
+            deltamode = true;
+            apply_pin_delta(args->pin, args->pin_len, slot.tc_arg, tmp_pin);
+ 800410e:	f8bd 909e 	ldrh.w	r9, [sp, #158]	; 0x9e
+    memcpy(tmp_pin, pin, pin_len);
+ 8004112:	ab04      	add	r3, sp, #16
+ 8004114:	463a      	mov	r2, r7
+ 8004116:	4641      	mov	r1, r8
+ 8004118:	4618      	mov	r0, r3
+ 800411a:	f009 fab5 	bl	800d688 <memcpy>
+    tmp_pin[pin_len] = 0;
+ 800411e:	2200      	movs	r2, #0
+ 8004120:	55c2      	strb	r2, [r0, r7]
+    char *p = &tmp_pin[pin_len-1];
+ 8004122:	1e7a      	subs	r2, r7, #1
+ 8004124:	4402      	add	r2, r0
+ 8004126:	2104      	movs	r1, #4
+        if(*p == '-') p--;
+ 8004128:	7813      	ldrb	r3, [r2, #0]
+ 800412a:	2b2d      	cmp	r3, #45	; 0x2d
+ 800412c:	f009 030f 	and.w	r3, r9, #15
+ 8004130:	bf08      	it	eq
+ 8004132:	f102 32ff 	addeq.w	r2, r2, #4294967295	; 0xffffffff
+        if((here >= 0) && (here <= 9)) {
+ 8004136:	2b09      	cmp	r3, #9
+            *p = '0' + here; 
+ 8004138:	bf9c      	itt	ls
+ 800413a:	3330      	addls	r3, #48	; 0x30
+ 800413c:	7013      	strbls	r3, [r2, #0]
+    for(int i=0; i<4; i++, p--) {
+ 800413e:	3901      	subs	r1, #1
+        replacement >>= 4;
+ 8004140:	ea4f 1919 	mov.w	r9, r9, lsr #4
+    for(int i=0; i<4; i++, p--) {
+ 8004144:	f102 32ff 	add.w	r2, r2, #4294967295	; 0xffffffff
+ 8004148:	d1ee      	bne.n	8004128 <pin_login_attempt+0xa8>
+        return 0;
+    }
+
+real_login:
+    // unlock the AE chip
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 800414a:	f7ff fd4b 	bl	8003be4 <warmup_ae>
+ 800414e:	2800      	cmp	r0, #0
+ 8004150:	d16c      	bne.n	800422c <pin_login_attempt+0x1ac>
+
+    // hash up the pin now, assuming we'll use it on main PIN
+    uint8_t     digest[32];
+    rv = pin_hash_attempt(deltamode ? tmp_pin : args->pin, args->pin_len, digest);
+ 8004152:	b10e      	cbz	r6, 8004158 <pin_login_attempt+0xd8>
+ 8004154:	f10d 0810 	add.w	r8, sp, #16
+ 8004158:	6aa1      	ldr	r1, [r4, #40]	; 0x28
+ 800415a:	aa0c      	add	r2, sp, #48	; 0x30
+ 800415c:	4640      	mov	r0, r8
+ 800415e:	f7ff fe15 	bl	8003d8c <pin_hash_attempt>
+    if(rv) return EPIN_AE_FAIL;
+ 8004162:	b1a8      	cbz	r0, 8004190 <pin_login_attempt+0x110>
+
+        rv = ae_encrypted_read(KEYNUM_secret, KEYNUM_main_pin, digest, ts, AE_SECRET_LEN);
+        if(rv) {
+            ae_reset_chip();
+
+            return EPIN_AE_FAIL;
+ 8004164:	f06f 0569 	mvn.w	r5, #105	; 0x69
+ 8004168:	e00e      	b.n	8004188 <pin_login_attempt+0x108>
+        bool wipe = (slot.tc_flags & TC_WIPE) && !(slot.tc_flags & (TC_WORD_WALLET|TC_XPRV_WALLET));
+ 800416a:	462f      	mov	r7, r5
+ 800416c:	e7b2      	b.n	80040d4 <pin_login_attempt+0x54>
+ 800416e:	a926      	add	r1, sp, #152	; 0x98
+ 8004170:	4620      	mov	r0, r4
+ 8004172:	f7ff fe39 	bl	8003de8 <set_is_trick.part.0>
+        if(slot.tc_flags & TC_DELTA_MODE) {
+ 8004176:	f8bd 309c 	ldrh.w	r3, [sp, #156]	; 0x9c
+ 800417a:	055b      	lsls	r3, r3, #21
+ 800417c:	d4c6      	bmi.n	800410c <pin_login_attempt+0x8c>
+    _hmac_attempt(args, args->hmac);
+ 800417e:	f104 0144 	add.w	r1, r4, #68	; 0x44
+ 8004182:	4620      	mov	r0, r4
+ 8004184:	f7ff fcca 	bl	8003b1c <_hmac_attempt>
+    }
+
+    _sign_attempt(args);
+
+    return 0;
+}
+ 8004188:	4628      	mov	r0, r5
+ 800418a:	b047      	add	sp, #284	; 0x11c
+ 800418c:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+    ae_reset_chip();
+ 8004190:	f7fe fc20 	bl	80029d4 <ae_reset_chip>
+    ae_pair_unlock();
+ 8004194:	f7fe fe22 	bl	8002ddc <ae_pair_unlock>
+    return (ae_checkmac_hard(KEYNUM_main_pin, digest) == 0);
+ 8004198:	a90c      	add	r1, sp, #48	; 0x30
+ 800419a:	2003      	movs	r0, #3
+ 800419c:	f7fe ffac 	bl	80030f8 <ae_checkmac_hard>
+    if(!is_main_pin(digest)) {
+ 80041a0:	b130      	cbz	r0, 80041b0 <pin_login_attempt+0x130>
+        se2_handle_bad_pin(args->num_fails + 1);
+ 80041a2:	6b60      	ldr	r0, [r4, #52]	; 0x34
+ 80041a4:	3001      	adds	r0, #1
+ 80041a6:	f003 ff45 	bl	8008034 <se2_handle_bad_pin>
+        return EPIN_AUTH_FAIL;
+ 80041aa:	f06f 056f 	mvn.w	r5, #111	; 0x6f
+ 80041ae:	e7eb      	b.n	8004188 <pin_login_attempt+0x108>
+    rv = updates_for_good_login(digest);
+ 80041b0:	a80c      	add	r0, sp, #48	; 0x30
+ 80041b2:	f7ff fd9d 	bl	8003cf0 <updates_for_good_login>
+    if(rv) return EPIN_AE_FAIL;
+ 80041b6:	4607      	mov	r7, r0
+ 80041b8:	2800      	cmp	r0, #0
+ 80041ba:	d1d3      	bne.n	8004164 <pin_login_attempt+0xe4>
+    pin_cache_save(args, digest);
+ 80041bc:	a90c      	add	r1, sp, #48	; 0x30
+ 80041be:	4620      	mov	r0, r4
+ 80041c0:	f7ff fe68 	bl	8003e94 <pin_cache_save>
+    args->state_flags = PA_SUCCESSFUL;
+ 80041c4:	2301      	movs	r3, #1
+ 80041c6:	63e3      	str	r3, [r4, #60]	; 0x3c
+    args->num_fails = 0;
+ 80041c8:	6367      	str	r7, [r4, #52]	; 0x34
+    args->attempts_left = MAX_TARGET_ATTEMPTS;
+ 80041ca:	230d      	movs	r3, #13
+        rv = ae_encrypted_read(KEYNUM_secret, KEYNUM_main_pin, digest, ts, AE_SECRET_LEN);
+ 80041cc:	2748      	movs	r7, #72	; 0x48
+    args->attempts_left = MAX_TARGET_ATTEMPTS;
+ 80041ce:	63a3      	str	r3, [r4, #56]	; 0x38
+        rv = ae_encrypted_read(KEYNUM_secret, KEYNUM_main_pin, digest, ts, AE_SECRET_LEN);
+ 80041d0:	9700      	str	r7, [sp, #0]
+ 80041d2:	ab14      	add	r3, sp, #80	; 0x50
+ 80041d4:	aa0c      	add	r2, sp, #48	; 0x30
+ 80041d6:	2103      	movs	r1, #3
+ 80041d8:	2009      	movs	r0, #9
+ 80041da:	f7ff f86f 	bl	80032bc <ae_encrypted_read>
+        if(rv) {
+ 80041de:	b110      	cbz	r0, 80041e6 <pin_login_attempt+0x166>
+            ae_reset_chip();
+ 80041e0:	f7fe fbf8 	bl	80029d4 <ae_reset_chip>
+ 80041e4:	e7be      	b.n	8004164 <pin_login_attempt+0xe4>
+        ae_reset_chip();
+ 80041e6:	f7fe fbf5 	bl	80029d4 <ae_reset_chip>
+        mcu_key_get(&mcu_key_valid);
+ 80041ea:	f10d 000f 	add.w	r0, sp, #15
+ 80041ee:	f7fe f929 	bl	8002444 <mcu_key_get>
+        if(check_all_zeros(ts, AE_SECRET_LEN) || !mcu_key_valid) {
+ 80041f2:	4639      	mov	r1, r7
+ 80041f4:	a814      	add	r0, sp, #80	; 0x50
+ 80041f6:	f7fe fa63 	bl	80026c0 <check_all_zeros>
+ 80041fa:	b910      	cbnz	r0, 8004202 <pin_login_attempt+0x182>
+ 80041fc:	f89d 300f 	ldrb.w	r3, [sp, #15]
+ 8004200:	b91b      	cbnz	r3, 800420a <pin_login_attempt+0x18a>
+            args->state_flags |= PA_ZERO_SECRET;
+ 8004202:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 8004204:	f043 0310 	orr.w	r3, r3, #16
+ 8004208:	63e3      	str	r3, [r4, #60]	; 0x3c
+    if(!deltamode) {
+ 800420a:	2e00      	cmp	r6, #0
+ 800420c:	d1b7      	bne.n	800417e <pin_login_attempt+0xfe>
+    args->private_state = ((rng_sample() & ~1) | is_trick_pin) ^ rom_secrets->hash_cache_secret[0];
+ 800420e:	f7fe fa77 	bl	8002700 <rng_sample>
+ 8004212:	4b08      	ldr	r3, [pc, #32]	; (8004234 <pin_login_attempt+0x1b4>)
+ 8004214:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 8004218:	f020 0001 	bic.w	r0, r0, #1
+ 800421c:	4058      	eors	r0, r3
+        args->delay_achieved = 0;
+ 800421e:	e9c4 660b 	strd	r6, r6, [r4, #44]	; 0x2c
+    args->private_state = ((rng_sample() & ~1) | is_trick_pin) ^ rom_secrets->hash_cache_secret[0];
+ 8004222:	6420      	str	r0, [r4, #64]	; 0x40
+        return;
+ 8004224:	e7ab      	b.n	800417e <pin_login_attempt+0xfe>
+        return EPIN_WRONG_SUCCESS;
+ 8004226:	f06f 056c 	mvn.w	r5, #108	; 0x6c
+ 800422a:	e7ad      	b.n	8004188 <pin_login_attempt+0x108>
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 800422c:	f06f 0568 	mvn.w	r5, #104	; 0x68
+ 8004230:	e7aa      	b.n	8004188 <pin_login_attempt+0x108>
+ 8004232:	bf00      	nop
+ 8004234:	0801c000 	.word	0x0801c000
+
+08004238 <pin_check_logged_in>:
+//
+// Verify we know the main PIN, but don't do anything with it.
+//
+    int
+pin_check_logged_in(const pinAttempt_t *args, bool *is_trick)
+{
+ 8004238:	b570      	push	{r4, r5, r6, lr}
+ 800423a:	460e      	mov	r6, r1
+ 800423c:	b088      	sub	sp, #32
+    int rv = _validate_attempt(args, false);
+ 800423e:	2100      	movs	r1, #0
+{
+ 8004240:	4605      	mov	r5, r0
+    int rv = _validate_attempt(args, false);
+ 8004242:	f7ff fc99 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 8004246:	4604      	mov	r4, r0
+ 8004248:	b980      	cbnz	r0, 800426c <pin_check_logged_in+0x34>
+
+    if((args->state_flags & PA_SUCCESSFUL) != PA_SUCCESSFUL) {
+ 800424a:	6beb      	ldr	r3, [r5, #60]	; 0x3c
+ 800424c:	07da      	lsls	r2, r3, #31
+ 800424e:	d520      	bpl.n	8004292 <pin_check_logged_in+0x5a>
+    bool is_trick = ((args->private_state ^ rom_secrets->hash_cache_secret[0]) & 0x1);
+ 8004250:	4b11      	ldr	r3, [pc, #68]	; (8004298 <pin_check_logged_in+0x60>)
+ 8004252:	6c2a      	ldr	r2, [r5, #64]	; 0x40
+ 8004254:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 8004258:	4053      	eors	r3, r2
+        // must come here with a successful PIN login (so it's rate limited nicely)
+        return EPIN_WRONG_SUCCESS;
+    }
+
+    if(get_is_trick(args, NULL)) {
+ 800425a:	07db      	lsls	r3, r3, #31
+ 800425c:	d509      	bpl.n	8004272 <pin_check_logged_in+0x3a>
+        // they used a trick pin to get this far. Amuse them more.
+        *is_trick = true;
+ 800425e:	2301      	movs	r3, #1
+ 8004260:	7033      	strb	r3, [r6, #0]
+
+        // should calibrate this, but smart money will just look at the bus
+        delay_ms(10);
+ 8004262:	200a      	movs	r0, #10
+ 8004264:	f7ff fb5e 	bl	8003924 <delay_ms>
+        rng_delay();
+ 8004268:	f7fe fa9e 	bl	80027a8 <rng_delay>
+        int rv = ae_checkmac(KEYNUM_main_pin, auth_digest);
+        if(rv) return EPIN_AUTH_FAIL;
+    }
+
+    return 0;
+}
+ 800426c:	4620      	mov	r0, r4
+ 800426e:	b008      	add	sp, #32
+ 8004270:	bd70      	pop	{r4, r5, r6, pc}
+        pin_cache_restore(args, auth_digest);
+ 8004272:	4669      	mov	r1, sp
+        *is_trick = false;
+ 8004274:	7030      	strb	r0, [r6, #0]
+        pin_cache_restore(args, auth_digest);
+ 8004276:	4628      	mov	r0, r5
+ 8004278:	f7ff fe44 	bl	8003f04 <pin_cache_restore>
+        ae_pair_unlock();
+ 800427c:	f7fe fdae 	bl	8002ddc <ae_pair_unlock>
+        int rv = ae_checkmac(KEYNUM_main_pin, auth_digest);
+ 8004280:	4669      	mov	r1, sp
+ 8004282:	2003      	movs	r0, #3
+ 8004284:	f7fe fd28 	bl	8002cd8 <ae_checkmac>
+        if(rv) return EPIN_AUTH_FAIL;
+ 8004288:	1e04      	subs	r4, r0, #0
+ 800428a:	bf18      	it	ne
+ 800428c:	f06f 046f 	mvnne.w	r4, #111	; 0x6f
+ 8004290:	e7ec      	b.n	800426c <pin_check_logged_in+0x34>
+        return EPIN_WRONG_SUCCESS;
+ 8004292:	f06f 046c 	mvn.w	r4, #108	; 0x6c
+ 8004296:	e7e9      	b.n	800426c <pin_check_logged_in+0x34>
+ 8004298:	0801c000 	.word	0x0801c000
+
+0800429c <pin_change>:
+//
+// Change the PIN and/or the secret. (Must also know the previous value, or it must be blank)
+//
+    int
+pin_change(pinAttempt_t *args)
+{
+ 800429c:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+    // Validate args and signature
+    int rv = _validate_attempt(args, false);
+ 80042a0:	2100      	movs	r1, #0
+{
+ 80042a2:	b0a4      	sub	sp, #144	; 0x90
+ 80042a4:	4604      	mov	r4, r0
+    int rv = _validate_attempt(args, false);
+ 80042a6:	f7ff fc67 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 80042aa:	4605      	mov	r5, r0
+ 80042ac:	2800      	cmp	r0, #0
+ 80042ae:	f040 8094 	bne.w	80043da <pin_change+0x13e>
+
+    if((args->state_flags & PA_SUCCESSFUL) != PA_SUCCESSFUL) {
+ 80042b2:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 80042b4:	07d9      	lsls	r1, r3, #31
+ 80042b6:	f140 809c 	bpl.w	80043f2 <pin_change+0x156>
+        // must come here with a successful PIN login (so it's rate limited nicely)
+        return EPIN_WRONG_SUCCESS;
+    }
+
+    if(args->state_flags & PA_IS_BLANK) {
+ 80042ba:	079a      	lsls	r2, r3, #30
+ 80042bc:	d502      	bpl.n	80042c4 <pin_change+0x28>
+        // if blank, must provide blank value
+        if(args->pin_len) return EPIN_RANGE_ERR;
+ 80042be:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 80042c0:	2b00      	cmp	r3, #0
+ 80042c2:	d158      	bne.n	8004376 <pin_change+0xda>
+    }
+
+    // Look at change flags.
+    const uint32_t cf = args->change_flags;
+
+    ASSERT(!args->is_secondary);
+ 80042c4:	6863      	ldr	r3, [r4, #4]
+    const uint32_t cf = args->change_flags;
+ 80042c6:	f8d4 9064 	ldr.w	r9, [r4, #100]	; 0x64
+    ASSERT(!args->is_secondary);
+ 80042ca:	b113      	cbz	r3, 80042d2 <pin_change+0x36>
+ 80042cc:	484c      	ldr	r0, [pc, #304]	; (8004400 <pin_change+0x164>)
+ 80042ce:	f7fc fbbb 	bl	8000a48 <fatal_error>
+    if(cf & CHANGE_SECONDARY_WALLET_PIN) {
+        // obsolete secondary support, can't support.
+        return EPIN_BAD_REQUEST;
+    }
+    if(cf & (CHANGE_DURESS_PIN | CHANGE_DURESS_SECRET | CHANGE_BRICKME_PIN)) {
+ 80042d2:	f019 0f36 	tst.w	r9, #54	; 0x36
+ 80042d6:	d10b      	bne.n	80042f0 <pin_change+0x54>
+        // we need some new API for trick PIN lookup/changes. 
+        return EPIN_BAD_REQUEST;
+    }
+    if(!(cf & (CHANGE_WALLET_PIN | CHANGE_SECRET))) {
+ 80042d8:	f019 0f09 	tst.w	r9, #9
+ 80042dc:	d04b      	beq.n	8004376 <pin_change+0xda>
+    bool is_trick = ((args->private_state ^ rom_secrets->hash_cache_secret[0]) & 0x1);
+ 80042de:	4b49      	ldr	r3, [pc, #292]	; (8004404 <pin_change+0x168>)
+ 80042e0:	6c22      	ldr	r2, [r4, #64]	; 0x40
+ 80042e2:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 80042e6:	4053      	eors	r3, r2
+    // If they authorized w/ a trick PIN, new policy is to wipe ourselves if
+    // they try to change PIN code or the secret.
+    //  - it's hard to fake them out here, and they may be onto us.
+    //  - this protects the seed, but does end the game somewhat
+    //  - all trick PINs will still be in effect, and looks like random reset
+    if(get_is_trick(args, NULL)) {
+ 80042e8:	07db      	lsls	r3, r3, #31
+ 80042ea:	d504      	bpl.n	80042f6 <pin_change+0x5a>
+        // User is a thug.. kill secret and reboot w/o any notice
+        fast_wipe();
+ 80042ec:	f7fe f9bc 	bl	8002668 <fast_wipe>
+        return EPIN_BAD_REQUEST;
+ 80042f0:	f06f 0567 	mvn.w	r5, #103	; 0x67
+ 80042f4:	e071      	b.n	80043da <pin_change+0x13e>
+        // NOT-REACHED
+        return EPIN_BAD_REQUEST;
+    }
+
+    // unlock the AE chip
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 80042f6:	f7ff fc75 	bl	8003be4 <warmup_ae>
+ 80042fa:	4605      	mov	r5, r0
+ 80042fc:	2800      	cmp	r0, #0
+ 80042fe:	d17b      	bne.n	80043f8 <pin_change+0x15c>
+    // If they tricked us to get to this point, doesn't matter as
+    // below SE1 validates it all again.
+
+    // Restore cached version of PIN digest: fast
+    uint8_t required_digest[32]; 
+    pin_cache_restore(args, required_digest);
+ 8004300:	f10d 0808 	add.w	r8, sp, #8
+ 8004304:	4641      	mov	r1, r8
+ 8004306:	4620      	mov	r0, r4
+ 8004308:	f7ff fdfc 	bl	8003f04 <pin_cache_restore>
+
+    // Calculate new PIN hashed value: will be slow to do
+    if(cf & CHANGE_WALLET_PIN) {
+ 800430c:	f019 0f01 	tst.w	r9, #1
+ 8004310:	d021      	beq.n	8004356 <pin_change+0xba>
+        uint8_t new_digest[32]; 
+        rv = pin_hash_attempt(args->new_pin, args->new_pin_len, new_digest);
+ 8004312:	f8d4 10ac 	ldr.w	r1, [r4, #172]	; 0xac
+ 8004316:	aa12      	add	r2, sp, #72	; 0x48
+ 8004318:	f104 008c 	add.w	r0, r4, #140	; 0x8c
+ 800431c:	f7ff fd36 	bl	8003d8c <pin_hash_attempt>
+        if(rv) goto ae_fail;
+ 8004320:	2800      	cmp	r0, #0
+ 8004322:	d161      	bne.n	80043e8 <pin_change+0x14c>
+
+        if(ae_encrypted_write(KEYNUM_main_pin, KEYNUM_main_pin, required_digest, new_digest, 32)) {
+ 8004324:	2320      	movs	r3, #32
+ 8004326:	2103      	movs	r1, #3
+ 8004328:	9300      	str	r3, [sp, #0]
+ 800432a:	4642      	mov	r2, r8
+ 800432c:	ab12      	add	r3, sp, #72	; 0x48
+ 800432e:	4608      	mov	r0, r1
+ 8004330:	f7ff f864 	bl	80033fc <ae_encrypted_write>
+ 8004334:	2800      	cmp	r0, #0
+ 8004336:	d157      	bne.n	80043e8 <pin_change+0x14c>
+            goto ae_fail;
+        }
+
+        memcpy(required_digest, new_digest, 32);
+ 8004338:	af12      	add	r7, sp, #72	; 0x48
+ 800433a:	cf0f      	ldmia	r7!, {r0, r1, r2, r3}
+ 800433c:	4646      	mov	r6, r8
+ 800433e:	c60f      	stmia	r6!, {r0, r1, r2, r3}
+ 8004340:	e897 000f 	ldmia.w	r7, {r0, r1, r2, r3}
+ 8004344:	e886 000f 	stmia.w	r6, {r0, r1, r2, r3}
+
+        // main pin is changing; reset counter to zero (good login) and our cache
+        pin_cache_save(args, new_digest);
+ 8004348:	4620      	mov	r0, r4
+ 800434a:	a912      	add	r1, sp, #72	; 0x48
+ 800434c:	f7ff fda2 	bl	8003e94 <pin_cache_save>
+
+        updates_for_good_login(new_digest);
+ 8004350:	a812      	add	r0, sp, #72	; 0x48
+ 8004352:	f7ff fccd 	bl	8003cf0 <updates_for_good_login>
+    }
+
+    // Recording new secret.
+    // Note the required_digest might have just changed above.
+    if(cf & CHANGE_SECRET) {
+ 8004356:	f019 0f08 	tst.w	r9, #8
+ 800435a:	d037      	beq.n	80043cc <pin_change+0x130>
+    int which = (args->change_flags >> 8) & 0xf;
+ 800435c:	6e63      	ldr	r3, [r4, #100]	; 0x64
+ 800435e:	121b      	asrs	r3, r3, #8
+    switch(which) {
+ 8004360:	f013 020c 	ands.w	r2, r3, #12
+ 8004364:	d107      	bne.n	8004376 <pin_change+0xda>
+ 8004366:	4928      	ldr	r1, [pc, #160]	; (8004408 <pin_change+0x16c>)
+    int which = (args->change_flags >> 8) & 0xf;
+ 8004368:	f003 030f 	and.w	r3, r3, #15
+ 800436c:	f911 a003 	ldrsb.w	sl, [r1, r3]
+        uint8_t     tmp[AE_SECRET_LEN];
+        uint8_t     check[32];
+
+        // what slot (key number) are updating? (probably: KEYNUM_secret)
+        int         target_slot = keynum_for_secret(args);
+        if(target_slot < 0) return EPIN_RANGE_ERR;
+ 8004370:	f1ba 0f00 	cmp.w	sl, #0
+ 8004374:	da02      	bge.n	800437c <pin_change+0xe0>
+        if(args->pin_len) return EPIN_RANGE_ERR;
+ 8004376:	f06f 0566 	mvn.w	r5, #102	; 0x66
+ 800437a:	e02e      	b.n	80043da <pin_change+0x13e>
+
+        se2_encrypt_secret(args->secret, AE_SECRET_LEN, 0, tmp, check, required_digest);
+ 800437c:	f104 07b0 	add.w	r7, r4, #176	; 0xb0
+ 8004380:	ae0a      	add	r6, sp, #40	; 0x28
+ 8004382:	ab12      	add	r3, sp, #72	; 0x48
+ 8004384:	2148      	movs	r1, #72	; 0x48
+
+        // write into two slots
+        if(ae_encrypted_write(target_slot, KEYNUM_main_pin,
+ 8004386:	f04f 0948 	mov.w	r9, #72	; 0x48
+        se2_encrypt_secret(args->secret, AE_SECRET_LEN, 0, tmp, check, required_digest);
+ 800438a:	f8cd 8004 	str.w	r8, [sp, #4]
+ 800438e:	9600      	str	r6, [sp, #0]
+ 8004390:	4638      	mov	r0, r7
+ 8004392:	f003 ff33 	bl	80081fc <se2_encrypt_secret>
+        if(ae_encrypted_write(target_slot, KEYNUM_main_pin,
+ 8004396:	2103      	movs	r1, #3
+ 8004398:	f8cd 9000 	str.w	r9, [sp]
+ 800439c:	eb0d 0309 	add.w	r3, sp, r9
+ 80043a0:	4642      	mov	r2, r8
+ 80043a2:	4650      	mov	r0, sl
+ 80043a4:	f7ff f82a 	bl	80033fc <ae_encrypted_write>
+ 80043a8:	4601      	mov	r1, r0
+ 80043aa:	b9e8      	cbnz	r0, 80043e8 <pin_change+0x14c>
+                                        required_digest, tmp, AE_SECRET_LEN)){
+            goto ae_fail;
+        }
+        if(ae_encrypted_write32(KEYNUM_check_secret, 0, KEYNUM_main_pin, required_digest, check)){
+ 80043ac:	9600      	str	r6, [sp, #0]
+ 80043ae:	4643      	mov	r3, r8
+ 80043b0:	2203      	movs	r2, #3
+ 80043b2:	200a      	movs	r0, #10
+ 80043b4:	f7fe ffbc 	bl	8003330 <ae_encrypted_write32>
+ 80043b8:	b9b0      	cbnz	r0, 80043e8 <pin_change+0x14c>
+            goto ae_fail;
+        }
+
+        // update the zero-secret flag to be correct.
+        if(cf & CHANGE_SECRET) {
+            if(check_all_zeros(args->secret, AE_SECRET_LEN)) {
+ 80043ba:	4649      	mov	r1, r9
+ 80043bc:	4638      	mov	r0, r7
+ 80043be:	f7fe f97f 	bl	80026c0 <check_all_zeros>
+ 80043c2:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 80043c4:	b168      	cbz	r0, 80043e2 <pin_change+0x146>
+                args->state_flags |= PA_ZERO_SECRET;
+ 80043c6:	f043 0310 	orr.w	r3, r3, #16
+ 80043ca:	63e3      	str	r3, [r4, #60]	; 0x3c
+                args->state_flags &= ~PA_ZERO_SECRET;
+            }
+        }
+    }
+
+    ae_reset_chip();
+ 80043cc:	f7fe fb02 	bl	80029d4 <ae_reset_chip>
+    _hmac_attempt(args, args->hmac);
+ 80043d0:	f104 0144 	add.w	r1, r4, #68	; 0x44
+ 80043d4:	4620      	mov	r0, r4
+ 80043d6:	f7ff fba1 	bl	8003b1c <_hmac_attempt>
+
+ae_fail:
+    ae_reset_chip();
+
+    return EPIN_AE_FAIL;
+}
+ 80043da:	4628      	mov	r0, r5
+ 80043dc:	b024      	add	sp, #144	; 0x90
+ 80043de:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+                args->state_flags &= ~PA_ZERO_SECRET;
+ 80043e2:	f023 0310 	bic.w	r3, r3, #16
+ 80043e6:	e7f0      	b.n	80043ca <pin_change+0x12e>
+    ae_reset_chip();
+ 80043e8:	f7fe faf4 	bl	80029d4 <ae_reset_chip>
+    return EPIN_AE_FAIL;
+ 80043ec:	f06f 0569 	mvn.w	r5, #105	; 0x69
+ 80043f0:	e7f3      	b.n	80043da <pin_change+0x13e>
+        return EPIN_WRONG_SUCCESS;
+ 80043f2:	f06f 056c 	mvn.w	r5, #108	; 0x6c
+ 80043f6:	e7f0      	b.n	80043da <pin_change+0x13e>
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 80043f8:	f06f 0568 	mvn.w	r5, #104	; 0x68
+ 80043fc:	e7ed      	b.n	80043da <pin_change+0x13e>
+ 80043fe:	bf00      	nop
+ 8004400:	0800e466 	.word	0x0800e466
+ 8004404:	0801c000 	.word	0x0801c000
+ 8004408:	0800e7a4 	.word	0x0800e7a4
+
+0800440c <pin_fetch_secret>:
+// To encourage not keeping the secret in memory, a way to fetch it after you've already
+// proven you know the PIN.
+//
+    int
+pin_fetch_secret(pinAttempt_t *args)
+{
+ 800440c:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+    // Validate args and signature
+    int rv = _validate_attempt(args, false);
+ 8004410:	2100      	movs	r1, #0
+{
+ 8004412:	f5ad 7d38 	sub.w	sp, sp, #736	; 0x2e0
+ 8004416:	4604      	mov	r4, r0
+    int rv = _validate_attempt(args, false);
+ 8004418:	f7ff fbae 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 800441c:	4605      	mov	r5, r0
+ 800441e:	2800      	cmp	r0, #0
+ 8004420:	d144      	bne.n	80044ac <pin_fetch_secret+0xa0>
+
+    if((args->state_flags & PA_SUCCESSFUL) != PA_SUCCESSFUL) {
+ 8004422:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 8004424:	07db      	lsls	r3, r3, #31
+ 8004426:	f140 80e3 	bpl.w	80045f0 <pin_fetch_secret+0x1e4>
+        // must come here with a successful PIN login (so it's rate limited nicely)
+        return EPIN_WRONG_SUCCESS;
+    }
+    if(args->change_flags & CHANGE_DURESS_SECRET) {
+ 800442a:	6e65      	ldr	r5, [r4, #100]	; 0x64
+ 800442c:	f015 0510 	ands.w	r5, r5, #16
+ 8004430:	f040 80e1 	bne.w	80045f6 <pin_fetch_secret+0x1ea>
+
+    // fetch the already-hashed pin
+    // - no real need to re-prove PIN knowledge.
+    // - if they tricked us, doesn't matter as below the SE validates it all again
+    uint8_t     digest[32];
+    pin_cache_restore(args, digest);
+ 8004434:	f10d 081c 	add.w	r8, sp, #28
+ 8004438:	4641      	mov	r1, r8
+ 800443a:	4620      	mov	r0, r4
+ 800443c:	f7ff fd62 	bl	8003f04 <pin_cache_restore>
+    bool is_trick = ((args->private_state ^ rom_secrets->hash_cache_secret[0]) & 0x1);
+ 8004440:	4b70      	ldr	r3, [pc, #448]	; (8004604 <pin_fetch_secret+0x1f8>)
+ 8004442:	6c26      	ldr	r6, [r4, #64]	; 0x40
+ 8004444:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 8004448:	4073      	eors	r3, r6
+    if(!slot || !is_trick) return is_trick;
+ 800444a:	07df      	lsls	r7, r3, #31
+ 800444c:	d577      	bpl.n	800453e <pin_fetch_secret+0x132>
+    memset(slot, 0, sizeof(trick_slot_t));
+ 800444e:	2280      	movs	r2, #128	; 0x80
+ 8004450:	4629      	mov	r1, r5
+ 8004452:	a817      	add	r0, sp, #92	; 0x5c
+ 8004454:	f009 f940 	bl	800d6d8 <memset>
+    if(args->delay_required & TC_DELTA_MODE) {
+ 8004458:	6b23      	ldr	r3, [r4, #48]	; 0x30
+ 800445a:	0558      	lsls	r0, r3, #21
+ 800445c:	d52b      	bpl.n	80044b6 <pin_fetch_secret+0xaa>
+        slot->tc_flags = args->delay_required;
+ 800445e:	f8ad 3060 	strh.w	r3, [sp, #96]	; 0x60
+        slot->slot_num = -1;        // unknown
+ 8004462:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8004466:	9317      	str	r3, [sp, #92]	; 0x5c
+
+    // determine if we should proceed under duress
+    trick_slot_t slot;
+    bool is_trick = get_is_trick(args, &slot);
+
+    if(is_trick && !(slot.tc_flags & TC_DELTA_MODE)) {
+ 8004468:	f8bd 6060 	ldrh.w	r6, [sp, #96]	; 0x60
+ 800446c:	f416 6180 	ands.w	r1, r6, #1024	; 0x400
+ 8004470:	d165      	bne.n	800453e <pin_fetch_secret+0x132>
+        // emulate a 24-word wallet, or xprv based wallet
+        // see stash.py for encoding details
+        memset(args->secret, 0, AE_SECRET_LEN);
+ 8004472:	2248      	movs	r2, #72	; 0x48
+ 8004474:	f104 00b0 	add.w	r0, r4, #176	; 0xb0
+ 8004478:	f009 f92e 	bl	800d6d8 <memset>
+
+        if(slot.tc_flags & TC_WORD_WALLET) {
+ 800447c:	04f1      	lsls	r1, r6, #19
+ 800447e:	d54c      	bpl.n	800451a <pin_fetch_secret+0x10e>
+            if(check_all_zeros(&slot.xdata[16], 16)) {
+ 8004480:	ae1d      	add	r6, sp, #116	; 0x74
+ 8004482:	2110      	movs	r1, #16
+ 8004484:	4630      	mov	r0, r6
+ 8004486:	f7fe f91b 	bl	80026c0 <check_all_zeros>
+                // 2nd half is zeros, must be 12-word wallet
+                args->secret[0] = 0x80;         // 12 word phrase
+                memcpy(&args->secret[1], slot.xdata, 16);
+ 800448a:	f104 03b1 	add.w	r3, r4, #177	; 0xb1
+            if(check_all_zeros(&slot.xdata[16], 16)) {
+ 800448e:	2800      	cmp	r0, #0
+ 8004490:	d034      	beq.n	80044fc <pin_fetch_secret+0xf0>
+                args->secret[0] = 0x80;         // 12 word phrase
+ 8004492:	2280      	movs	r2, #128	; 0x80
+ 8004494:	f884 20b0 	strb.w	r2, [r4, #176]	; 0xb0
+                memcpy(&args->secret[1], slot.xdata, 16);
+ 8004498:	ac19      	add	r4, sp, #100	; 0x64
+ 800449a:	4622      	mov	r2, r4
+ 800449c:	ca03      	ldmia	r2!, {r0, r1}
+ 800449e:	42b2      	cmp	r2, r6
+ 80044a0:	6018      	str	r0, [r3, #0]
+ 80044a2:	6059      	str	r1, [r3, #4]
+ 80044a4:	4614      	mov	r4, r2
+ 80044a6:	f103 0308 	add.w	r3, r3, #8
+ 80044aa:	d1f6      	bne.n	800449a <pin_fetch_secret+0x8e>
+    ae_reset_chip();
+
+    if(rv) return EPIN_AE_FAIL;
+
+    return 0;
+}
+ 80044ac:	4628      	mov	r0, r5
+ 80044ae:	f50d 7d38 	add.w	sp, sp, #736	; 0x2e0
+ 80044b2:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+    memcpy(key+4, rom_secrets->hash_cache_secret+4, sizeof(rom_secrets->hash_cache_secret)-4);
+ 80044b6:	4f54      	ldr	r7, [pc, #336]	; (8004608 <pin_fetch_secret+0x1fc>)
+    memcpy(key, &args->private_state, sizeof(args->private_state));
+ 80044b8:	960f      	str	r6, [sp, #60]	; 0x3c
+    memcpy(key+4, rom_secrets->hash_cache_secret+4, sizeof(rom_secrets->hash_cache_secret)-4);
+ 80044ba:	cf0f      	ldmia	r7!, {r0, r1, r2, r3}
+ 80044bc:	ae10      	add	r6, sp, #64	; 0x40
+ 80044be:	c60f      	stmia	r6!, {r0, r1, r2, r3}
+ 80044c0:	e897 0007 	ldmia.w	r7, {r0, r1, r2}
+ 80044c4:	e886 0007 	stmia.w	r6, {r0, r1, r2}
+        aes_init(&ctx);
+ 80044c8:	a837      	add	r0, sp, #220	; 0xdc
+ 80044ca:	f003 fffb 	bl	80084c4 <aes_init>
+        aes_add(&ctx, args->cached_main_pin, 32);
+ 80044ce:	2220      	movs	r2, #32
+ 80044d0:	f104 01f8 	add.w	r1, r4, #248	; 0xf8
+ 80044d4:	a837      	add	r0, sp, #220	; 0xdc
+ 80044d6:	f003 fffb 	bl	80084d0 <aes_add>
+        aes_done(&ctx, (uint8_t *)slot, 32, key, NULL);
+ 80044da:	a917      	add	r1, sp, #92	; 0x5c
+ 80044dc:	9500      	str	r5, [sp, #0]
+ 80044de:	ab0f      	add	r3, sp, #60	; 0x3c
+ 80044e0:	2220      	movs	r2, #32
+ 80044e2:	a837      	add	r0, sp, #220	; 0xdc
+ 80044e4:	f004 f80a 	bl	80084fc <aes_done>
+        if(slot->tc_flags & (TC_WORD_WALLET|TC_XPRV_WALLET)) {
+ 80044e8:	f8bd 1060 	ldrh.w	r1, [sp, #96]	; 0x60
+ 80044ec:	f411 5fc0 	tst.w	r1, #6144	; 0x1800
+ 80044f0:	d0ba      	beq.n	8004468 <pin_fetch_secret+0x5c>
+            se2_read_trick_data(slot->slot_num, slot->tc_flags, slot->xdata);
+ 80044f2:	9817      	ldr	r0, [sp, #92]	; 0x5c
+ 80044f4:	aa19      	add	r2, sp, #100	; 0x64
+ 80044f6:	f003 fc87 	bl	8007e08 <se2_read_trick_data>
+    if(is_trick && !(slot.tc_flags & TC_DELTA_MODE)) {
+ 80044fa:	e7b5      	b.n	8004468 <pin_fetch_secret+0x5c>
+                args->secret[0] = 0x82;         // 24 word phrase
+ 80044fc:	2282      	movs	r2, #130	; 0x82
+ 80044fe:	f884 20b0 	strb.w	r2, [r4, #176]	; 0xb0
+                memcpy(&args->secret[1], slot.xdata, 32);
+ 8004502:	ae21      	add	r6, sp, #132	; 0x84
+ 8004504:	aa19      	add	r2, sp, #100	; 0x64
+ 8004506:	4614      	mov	r4, r2
+ 8004508:	cc03      	ldmia	r4!, {r0, r1}
+ 800450a:	42b4      	cmp	r4, r6
+ 800450c:	6018      	str	r0, [r3, #0]
+ 800450e:	6059      	str	r1, [r3, #4]
+ 8004510:	4622      	mov	r2, r4
+ 8004512:	f103 0308 	add.w	r3, r3, #8
+ 8004516:	d1f6      	bne.n	8004506 <pin_fetch_secret+0xfa>
+ 8004518:	e7c8      	b.n	80044ac <pin_fetch_secret+0xa0>
+        } else if(slot.tc_flags & TC_XPRV_WALLET) {
+ 800451a:	0532      	lsls	r2, r6, #20
+ 800451c:	d5c6      	bpl.n	80044ac <pin_fetch_secret+0xa0>
+            args->secret[0] = 0x01;         // XPRV mode
+ 800451e:	2301      	movs	r3, #1
+ 8004520:	f884 30b0 	strb.w	r3, [r4, #176]	; 0xb0
+            memcpy(&args->secret[1], slot.xdata, 64);
+ 8004524:	aa19      	add	r2, sp, #100	; 0x64
+ 8004526:	34b1      	adds	r4, #177	; 0xb1
+ 8004528:	ae29      	add	r6, sp, #164	; 0xa4
+ 800452a:	4613      	mov	r3, r2
+ 800452c:	cb03      	ldmia	r3!, {r0, r1}
+ 800452e:	42b3      	cmp	r3, r6
+ 8004530:	6020      	str	r0, [r4, #0]
+ 8004532:	6061      	str	r1, [r4, #4]
+ 8004534:	461a      	mov	r2, r3
+ 8004536:	f104 0408 	add.w	r4, r4, #8
+ 800453a:	d1f6      	bne.n	800452a <pin_fetch_secret+0x11e>
+ 800453c:	e7b6      	b.n	80044ac <pin_fetch_secret+0xa0>
+    int which = (args->change_flags >> 8) & 0xf;
+ 800453e:	6e63      	ldr	r3, [r4, #100]	; 0x64
+ 8004540:	121b      	asrs	r3, r3, #8
+    switch(which) {
+ 8004542:	f013 0f0c 	tst.w	r3, #12
+ 8004546:	d159      	bne.n	80045fc <pin_fetch_secret+0x1f0>
+ 8004548:	4a30      	ldr	r2, [pc, #192]	; (800460c <pin_fetch_secret+0x200>)
+    int which = (args->change_flags >> 8) & 0xf;
+ 800454a:	f003 030f 	and.w	r3, r3, #15
+ 800454e:	f912 9003 	ldrsb.w	r9, [r2, r3]
+    if(kn < 0) return EPIN_RANGE_ERR;
+ 8004552:	f1b9 0f00 	cmp.w	r9, #0
+ 8004556:	db51      	blt.n	80045fc <pin_fetch_secret+0x1f0>
+ 8004558:	2703      	movs	r7, #3
+        rv = ae_encrypted_read(kn, KEYNUM_main_pin, digest, tmp, AE_SECRET_LEN);
+ 800455a:	f04f 0a48 	mov.w	sl, #72	; 0x48
+ 800455e:	2103      	movs	r1, #3
+ 8004560:	f8cd a000 	str.w	sl, [sp]
+ 8004564:	ab37      	add	r3, sp, #220	; 0xdc
+ 8004566:	4642      	mov	r2, r8
+ 8004568:	4648      	mov	r0, r9
+ 800456a:	f7fe fea7 	bl	80032bc <ae_encrypted_read>
+        if(rv) continue;
+ 800456e:	4601      	mov	r1, r0
+ 8004570:	b130      	cbz	r0, 8004580 <pin_fetch_secret+0x174>
+    for(int retry=0; retry<3; retry++) {
+ 8004572:	3f01      	subs	r7, #1
+ 8004574:	d1f3      	bne.n	800455e <pin_fetch_secret+0x152>
+    ae_reset_chip();
+ 8004576:	f7fe fa2d 	bl	80029d4 <ae_reset_chip>
+    if(rv) return EPIN_AE_FAIL;
+ 800457a:	f06f 0569 	mvn.w	r5, #105	; 0x69
+ 800457e:	e795      	b.n	80044ac <pin_fetch_secret+0xa0>
+        rv = ae_encrypted_read32(KEYNUM_check_secret, 0, KEYNUM_main_pin, digest, check);
+ 8004580:	ae0f      	add	r6, sp, #60	; 0x3c
+ 8004582:	9600      	str	r6, [sp, #0]
+ 8004584:	4643      	mov	r3, r8
+ 8004586:	2203      	movs	r2, #3
+ 8004588:	200a      	movs	r0, #10
+ 800458a:	f7fe fe6c 	bl	8003266 <ae_encrypted_read32>
+        if(rv) continue;
+ 800458e:	4605      	mov	r5, r0
+ 8004590:	2800      	cmp	r0, #0
+ 8004592:	d1ee      	bne.n	8004572 <pin_fetch_secret+0x166>
+    se2_decrypt_secret(args->secret, AE_SECRET_LEN, 0, tmp, check, digest, &is_valid);
+ 8004594:	f10d 071b 	add.w	r7, sp, #27
+ 8004598:	f104 00b0 	add.w	r0, r4, #176	; 0xb0
+ 800459c:	ab37      	add	r3, sp, #220	; 0xdc
+ 800459e:	e9cd 8701 	strd	r8, r7, [sp, #4]
+ 80045a2:	9600      	str	r6, [sp, #0]
+ 80045a4:	462a      	mov	r2, r5
+ 80045a6:	2148      	movs	r1, #72	; 0x48
+ 80045a8:	9005      	str	r0, [sp, #20]
+ 80045aa:	f003 fe7d 	bl	80082a8 <se2_decrypt_secret>
+    if(!is_valid) {
+ 80045ae:	f89d 301b 	ldrb.w	r3, [sp, #27]
+ 80045b2:	9805      	ldr	r0, [sp, #20]
+ 80045b4:	b993      	cbnz	r3, 80045dc <pin_fetch_secret+0x1d0>
+        memset(args->secret, 0, AE_SECRET_LEN);
+ 80045b6:	2248      	movs	r2, #72	; 0x48
+ 80045b8:	4629      	mov	r1, r5
+ 80045ba:	f009 f88d 	bl	800d6d8 <memset>
+        if(!(args->state_flags & PA_ZERO_SECRET)) {
+ 80045be:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 80045c0:	06db      	lsls	r3, r3, #27
+ 80045c2:	d408      	bmi.n	80045d6 <pin_fetch_secret+0x1ca>
+            args->state_flags |= PA_ZERO_SECRET;
+ 80045c4:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 80045c6:	f043 0310 	orr.w	r3, r3, #16
+ 80045ca:	63e3      	str	r3, [r4, #60]	; 0x3c
+    _hmac_attempt(args, args->hmac);
+ 80045cc:	f104 0144 	add.w	r1, r4, #68	; 0x44
+ 80045d0:	4620      	mov	r0, r4
+ 80045d2:	f7ff faa3 	bl	8003b1c <_hmac_attempt>
+    ae_reset_chip();
+ 80045d6:	f7fe f9fd 	bl	80029d4 <ae_reset_chip>
+    if(rv) return EPIN_AE_FAIL;
+ 80045da:	e767      	b.n	80044ac <pin_fetch_secret+0xa0>
+        if(!args->secret[0] && check_all_zeros(args->secret, AE_SECRET_LEN)) {
+ 80045dc:	f894 30b0 	ldrb.w	r3, [r4, #176]	; 0xb0
+ 80045e0:	2b00      	cmp	r3, #0
+ 80045e2:	d1f8      	bne.n	80045d6 <pin_fetch_secret+0x1ca>
+ 80045e4:	2148      	movs	r1, #72	; 0x48
+ 80045e6:	f7fe f86b 	bl	80026c0 <check_all_zeros>
+ 80045ea:	2800      	cmp	r0, #0
+ 80045ec:	d0f3      	beq.n	80045d6 <pin_fetch_secret+0x1ca>
+ 80045ee:	e7e9      	b.n	80045c4 <pin_fetch_secret+0x1b8>
+        return EPIN_WRONG_SUCCESS;
+ 80045f0:	f06f 056c 	mvn.w	r5, #108	; 0x6c
+ 80045f4:	e75a      	b.n	80044ac <pin_fetch_secret+0xa0>
+        return EPIN_BAD_REQUEST;
+ 80045f6:	f06f 0567 	mvn.w	r5, #103	; 0x67
+ 80045fa:	e757      	b.n	80044ac <pin_fetch_secret+0xa0>
+    if(kn < 0) return EPIN_RANGE_ERR;
+ 80045fc:	f06f 0566 	mvn.w	r5, #102	; 0x66
+ 8004600:	e754      	b.n	80044ac <pin_fetch_secret+0xa0>
+ 8004602:	bf00      	nop
+ 8004604:	0801c000 	.word	0x0801c000
+ 8004608:	0801c074 	.word	0x0801c074
+ 800460c:	0800e7a4 	.word	0x0800e7a4
+
+08004610 <pin_long_secret>:
+// - new API so whole thing provided in one shot? encryption issues: provide
+//   "dest" and all 416 bytes end up there (read case only).
+//
+    int
+pin_long_secret(pinAttempt_t *args, uint8_t *dest)
+{
+ 8004610:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+ 8004614:	460f      	mov	r7, r1
+ 8004616:	b099      	sub	sp, #100	; 0x64
+    // Validate args and signature
+    int rv = _validate_attempt(args, false);
+ 8004618:	2100      	movs	r1, #0
+{
+ 800461a:	4606      	mov	r6, r0
+    int rv = _validate_attempt(args, false);
+ 800461c:	f7ff faac 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 8004620:	4604      	mov	r4, r0
+ 8004622:	b9b8      	cbnz	r0, 8004654 <pin_long_secret+0x44>
+
+    if((args->state_flags & PA_SUCCESSFUL) != PA_SUCCESSFUL) {
+ 8004624:	6bf3      	ldr	r3, [r6, #60]	; 0x3c
+ 8004626:	07da      	lsls	r2, r3, #31
+ 8004628:	f140 80a5 	bpl.w	8004776 <pin_long_secret+0x166>
+    bool is_trick = ((args->private_state ^ rom_secrets->hash_cache_secret[0]) & 0x1);
+ 800462c:	4b55      	ldr	r3, [pc, #340]	; (8004784 <pin_long_secret+0x174>)
+ 800462e:	6c32      	ldr	r2, [r6, #64]	; 0x40
+ 8004630:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 8004634:	4053      	eors	r3, r2
+    }
+
+    // determine if we should proceed under duress/in some trick way
+    bool is_trick = get_is_trick(args, NULL);
+
+    if(is_trick) {
+ 8004636:	07db      	lsls	r3, r3, #31
+ 8004638:	d510      	bpl.n	800465c <pin_long_secret+0x4c>
+        // Not supported in trick mode. Pretend it's all zeros. Accept all writes.
+        memset(args->secret, 0, 32);
+ 800463a:	4601      	mov	r1, r0
+ 800463c:	2220      	movs	r2, #32
+ 800463e:	f106 00b0 	add.w	r0, r6, #176	; 0xb0
+ 8004642:	f009 f849 	bl	800d6d8 <memset>
+        if(dest) memset(dest, 0, AE_LONG_SECRET_LEN);
+ 8004646:	b12f      	cbz	r7, 8004654 <pin_long_secret+0x44>
+ 8004648:	f44f 72d0 	mov.w	r2, #416	; 0x1a0
+ 800464c:	4621      	mov	r1, r4
+ 800464e:	4638      	mov	r0, r7
+ 8004650:	f009 f842 	bl	800d6d8 <memset>
+
+se2_fail:
+    ae_reset_chip();
+
+    return EPIN_SE2_FAIL;
+}
+ 8004654:	4620      	mov	r0, r4
+ 8004656:	b019      	add	sp, #100	; 0x64
+ 8004658:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+    int blk = (args->change_flags >> 8) & 0xf;
+ 800465c:	6e73      	ldr	r3, [r6, #100]	; 0x64
+ 800465e:	f3c3 2803 	ubfx	r8, r3, #8, #4
+    if(blk > 13) return EPIN_RANGE_ERR;
+ 8004662:	f1b8 0f0d 	cmp.w	r8, #13
+ 8004666:	f300 8089 	bgt.w	800477c <pin_long_secret+0x16c>
+    pin_cache_restore(args, digest);
+ 800466a:	a908      	add	r1, sp, #32
+ 800466c:	4630      	mov	r0, r6
+ 800466e:	f7ff fc49 	bl	8003f04 <pin_cache_restore>
+    if(!(args->change_flags & CHANGE_SECRET)) {
+ 8004672:	6e71      	ldr	r1, [r6, #100]	; 0x64
+ 8004674:	f011 0908 	ands.w	r9, r1, #8
+ 8004678:	d156      	bne.n	8004728 <pin_long_secret+0x118>
+        if(!dest) {
+ 800467a:	bb27      	cbnz	r7, 80046c6 <pin_long_secret+0xb6>
+            rv = ae_encrypted_read32(KEYNUM_long_secret, blk, KEYNUM_main_pin, digest, tmp);
+ 800467c:	af10      	add	r7, sp, #64	; 0x40
+ 800467e:	9700      	str	r7, [sp, #0]
+ 8004680:	ab08      	add	r3, sp, #32
+ 8004682:	2203      	movs	r2, #3
+ 8004684:	4641      	mov	r1, r8
+ 8004686:	2008      	movs	r0, #8
+ 8004688:	f7fe fded 	bl	8003266 <ae_encrypted_read32>
+            if(rv) goto fail;
+ 800468c:	4605      	mov	r5, r0
+ 800468e:	2800      	cmp	r0, #0
+ 8004690:	d16a      	bne.n	8004768 <pin_long_secret+0x158>
+            se2_decrypt_secret(args->secret, 32, blk*32, tmp, NULL, digest, &is_valid);
+ 8004692:	f10d 031f 	add.w	r3, sp, #31
+ 8004696:	9302      	str	r3, [sp, #8]
+ 8004698:	ab08      	add	r3, sp, #32
+ 800469a:	f106 00b0 	add.w	r0, r6, #176	; 0xb0
+ 800469e:	e9cd 4300 	strd	r4, r3, [sp]
+ 80046a2:	ea4f 1248 	mov.w	r2, r8, lsl #5
+ 80046a6:	463b      	mov	r3, r7
+ 80046a8:	2120      	movs	r1, #32
+ 80046aa:	9005      	str	r0, [sp, #20]
+ 80046ac:	f003 fdfc 	bl	80082a8 <se2_decrypt_secret>
+            if(!is_valid) {
+ 80046b0:	f89d 301f 	ldrb.w	r3, [sp, #31]
+ 80046b4:	9805      	ldr	r0, [sp, #20]
+ 80046b6:	b91b      	cbnz	r3, 80046c0 <pin_long_secret+0xb0>
+                memset(args->secret, 0, 32);
+ 80046b8:	2220      	movs	r2, #32
+ 80046ba:	4621      	mov	r1, r4
+                memset(dest, 0, AE_LONG_SECRET_LEN);
+ 80046bc:	f009 f80c 	bl	800d6d8 <memset>
+    ae_reset_chip();
+ 80046c0:	f7fe f988 	bl	80029d4 <ae_reset_chip>
+    if(rv) return EPIN_AE_FAIL;
+ 80046c4:	e7c6      	b.n	8004654 <pin_long_secret+0x44>
+ 80046c6:	463e      	mov	r6, r7
+                rv = ae_encrypted_read32(KEYNUM_long_secret, blk, KEYNUM_main_pin, digest, p);
+ 80046c8:	9600      	str	r6, [sp, #0]
+ 80046ca:	ab08      	add	r3, sp, #32
+ 80046cc:	2203      	movs	r2, #3
+ 80046ce:	4649      	mov	r1, r9
+ 80046d0:	2008      	movs	r0, #8
+ 80046d2:	f7fe fdc8 	bl	8003266 <ae_encrypted_read32>
+                if(rv) goto fail;
+ 80046d6:	4605      	mov	r5, r0
+ 80046d8:	2800      	cmp	r0, #0
+ 80046da:	d145      	bne.n	8004768 <pin_long_secret+0x158>
+            for(blk=0; blk<13; blk++, p += 32) {
+ 80046dc:	f109 0901 	add.w	r9, r9, #1
+ 80046e0:	f1b9 0f0d 	cmp.w	r9, #13
+ 80046e4:	f106 0620 	add.w	r6, r6, #32
+ 80046e8:	d1ee      	bne.n	80046c8 <pin_long_secret+0xb8>
+            ASSERT(p == dest+AE_LONG_SECRET_LEN);
+ 80046ea:	f507 73d0 	add.w	r3, r7, #416	; 0x1a0
+ 80046ee:	429e      	cmp	r6, r3
+ 80046f0:	d002      	beq.n	80046f8 <pin_long_secret+0xe8>
+ 80046f2:	4825      	ldr	r0, [pc, #148]	; (8004788 <pin_long_secret+0x178>)
+ 80046f4:	f7fc f9a8 	bl	8000a48 <fatal_error>
+            se2_decrypt_secret(dest, AE_LONG_SECRET_LEN, 0, dest, NULL, digest, &is_valid);
+ 80046f8:	ab10      	add	r3, sp, #64	; 0x40
+ 80046fa:	9302      	str	r3, [sp, #8]
+ 80046fc:	ab08      	add	r3, sp, #32
+ 80046fe:	e9cd 0300 	strd	r0, r3, [sp]
+ 8004702:	4602      	mov	r2, r0
+ 8004704:	463b      	mov	r3, r7
+ 8004706:	f44f 71d0 	mov.w	r1, #416	; 0x1a0
+ 800470a:	4638      	mov	r0, r7
+ 800470c:	f003 fdcc 	bl	80082a8 <se2_decrypt_secret>
+            if(!is_valid) {
+ 8004710:	f89d 4040 	ldrb.w	r4, [sp, #64]	; 0x40
+ 8004714:	b924      	cbnz	r4, 8004720 <pin_long_secret+0x110>
+                memset(dest, 0, AE_LONG_SECRET_LEN);
+ 8004716:	f44f 72d0 	mov.w	r2, #416	; 0x1a0
+ 800471a:	4621      	mov	r1, r4
+ 800471c:	4638      	mov	r0, r7
+ 800471e:	e7cd      	b.n	80046bc <pin_long_secret+0xac>
+    ae_reset_chip();
+ 8004720:	f7fe f958 	bl	80029d4 <ae_reset_chip>
+    return 0;
+ 8004724:	462c      	mov	r4, r5
+ 8004726:	e795      	b.n	8004654 <pin_long_secret+0x44>
+        uint8_t tmp[32] = {0};
+ 8004728:	221c      	movs	r2, #28
+ 800472a:	4621      	mov	r1, r4
+ 800472c:	a811      	add	r0, sp, #68	; 0x44
+ 800472e:	9410      	str	r4, [sp, #64]	; 0x40
+        if(se2_encrypt_secret(args->secret, 32, blk*32, tmp, NULL, digest)) {
+ 8004730:	ad10      	add	r5, sp, #64	; 0x40
+        uint8_t tmp[32] = {0};
+ 8004732:	f008 ffd1 	bl	800d6d8 <memset>
+        if(se2_encrypt_secret(args->secret, 32, blk*32, tmp, NULL, digest)) {
+ 8004736:	ab08      	add	r3, sp, #32
+ 8004738:	e9cd 4300 	strd	r4, r3, [sp]
+ 800473c:	ea4f 1248 	mov.w	r2, r8, lsl #5
+ 8004740:	462b      	mov	r3, r5
+ 8004742:	2120      	movs	r1, #32
+ 8004744:	f106 00b0 	add.w	r0, r6, #176	; 0xb0
+ 8004748:	f003 fd58 	bl	80081fc <se2_encrypt_secret>
+ 800474c:	b120      	cbz	r0, 8004758 <pin_long_secret+0x148>
+    ae_reset_chip();
+ 800474e:	f7fe f941 	bl	80029d4 <ae_reset_chip>
+    return EPIN_SE2_FAIL;
+ 8004752:	f06f 0472 	mvn.w	r4, #114	; 0x72
+ 8004756:	e77d      	b.n	8004654 <pin_long_secret+0x44>
+        rv = ae_encrypted_write32(KEYNUM_long_secret, blk, KEYNUM_main_pin, digest, tmp);
+ 8004758:	9500      	str	r5, [sp, #0]
+ 800475a:	ab08      	add	r3, sp, #32
+ 800475c:	2203      	movs	r2, #3
+ 800475e:	4641      	mov	r1, r8
+ 8004760:	2008      	movs	r0, #8
+ 8004762:	f7fe fde5 	bl	8003330 <ae_encrypted_write32>
+ 8004766:	4605      	mov	r5, r0
+    ae_reset_chip();
+ 8004768:	f7fe f934 	bl	80029d4 <ae_reset_chip>
+    if(rv) return EPIN_AE_FAIL;
+ 800476c:	2d00      	cmp	r5, #0
+ 800476e:	bf18      	it	ne
+ 8004770:	f06f 0469 	mvnne.w	r4, #105	; 0x69
+ 8004774:	e76e      	b.n	8004654 <pin_long_secret+0x44>
+        return EPIN_WRONG_SUCCESS;
+ 8004776:	f06f 046c 	mvn.w	r4, #108	; 0x6c
+ 800477a:	e76b      	b.n	8004654 <pin_long_secret+0x44>
+    if(blk > 13) return EPIN_RANGE_ERR;
+ 800477c:	f06f 0466 	mvn.w	r4, #102	; 0x66
+ 8004780:	e768      	b.n	8004654 <pin_long_secret+0x44>
+ 8004782:	bf00      	nop
+ 8004784:	0801c000 	.word	0x0801c000
+ 8004788:	0800e466 	.word	0x0800e466
+
+0800478c <pin_firmware_greenlight>:
+//
+// Record current flash checksum and make green light go on.
+//
+    int
+pin_firmware_greenlight(pinAttempt_t *args)
+{
+ 800478c:	b530      	push	{r4, r5, lr}
+    // Validate args and signature
+    int rv = _validate_attempt(args, false);
+ 800478e:	2100      	movs	r1, #0
+{
+ 8004790:	b09b      	sub	sp, #108	; 0x6c
+ 8004792:	4604      	mov	r4, r0
+    int rv = _validate_attempt(args, false);
+ 8004794:	f7ff f9f0 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 8004798:	bb20      	cbnz	r0, 80047e4 <pin_firmware_greenlight+0x58>
+
+    if((args->state_flags & PA_SUCCESSFUL) != PA_SUCCESSFUL) {
+ 800479a:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 800479c:	07da      	lsls	r2, r3, #31
+ 800479e:	d529      	bpl.n	80047f4 <pin_firmware_greenlight+0x68>
+        // must come here with a successful PIN login (so it's rate limited nicely)
+        return EPIN_WRONG_SUCCESS;
+    }
+
+    if(args->is_secondary) {
+ 80047a0:	6865      	ldr	r5, [r4, #4]
+ 80047a2:	bb55      	cbnz	r5, 80047fa <pin_firmware_greenlight+0x6e>
+        return EPIN_PRIMARY_ONLY;
+    }
+
+    // load existing PIN's hash
+    uint8_t     digest[32];
+    pin_cache_restore(args, digest);
+ 80047a4:	a902      	add	r1, sp, #8
+ 80047a6:	4620      	mov	r0, r4
+ 80047a8:	f7ff fbac 	bl	8003f04 <pin_cache_restore>
+
+    // step 1: calc the value to use
+    uint8_t fw_check[32], world_check[32];
+    checksum_flash(fw_check, world_check, 0);
+ 80047ac:	462a      	mov	r2, r5
+ 80047ae:	a912      	add	r1, sp, #72	; 0x48
+ 80047b0:	a80a      	add	r0, sp, #40	; 0x28
+ 80047b2:	f7fd f957 	bl	8001a64 <checksum_flash>
+
+    // step 2: write it out to chip.
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 80047b6:	f7ff fa15 	bl	8003be4 <warmup_ae>
+ 80047ba:	bb08      	cbnz	r0, 8004800 <pin_firmware_greenlight+0x74>
+    bool is_trick = ((args->private_state ^ rom_secrets->hash_cache_secret[0]) & 0x1);
+ 80047bc:	4b12      	ldr	r3, [pc, #72]	; (8004808 <pin_firmware_greenlight+0x7c>)
+ 80047be:	6c22      	ldr	r2, [r4, #64]	; 0x40
+ 80047c0:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 80047c4:	4053      	eors	r3, r2
+
+    // under duress, we can't fake this, but we go through the motions anyway
+    if(!get_is_trick(args, NULL)) {
+ 80047c6:	07db      	lsls	r3, r3, #31
+ 80047c8:	d40e      	bmi.n	80047e8 <pin_firmware_greenlight+0x5c>
+        rv = ae_encrypted_write(KEYNUM_firmware, KEYNUM_main_pin, digest, world_check, 32);
+ 80047ca:	2320      	movs	r3, #32
+ 80047cc:	9300      	str	r3, [sp, #0]
+ 80047ce:	aa02      	add	r2, sp, #8
+ 80047d0:	ab12      	add	r3, sp, #72	; 0x48
+ 80047d2:	2103      	movs	r1, #3
+ 80047d4:	200e      	movs	r0, #14
+ 80047d6:	f7fe fe11 	bl	80033fc <ae_encrypted_write>
+
+        if(rv) {
+ 80047da:	b128      	cbz	r0, 80047e8 <pin_firmware_greenlight+0x5c>
+            ae_reset_chip();
+ 80047dc:	f7fe f8fa 	bl	80029d4 <ae_reset_chip>
+
+            return EPIN_AE_FAIL;
+ 80047e0:	f06f 0069 	mvn.w	r0, #105	; 0x69
+
+        return EPIN_AE_FAIL;
+    }
+
+    return 0;
+}
+ 80047e4:	b01b      	add	sp, #108	; 0x6c
+ 80047e6:	bd30      	pop	{r4, r5, pc}
+    rv = ae_set_gpio_secure(world_check);
+ 80047e8:	a812      	add	r0, sp, #72	; 0x48
+ 80047ea:	f7fe fe99 	bl	8003520 <ae_set_gpio_secure>
+    if(rv) {
+ 80047ee:	2800      	cmp	r0, #0
+ 80047f0:	d0f8      	beq.n	80047e4 <pin_firmware_greenlight+0x58>
+ 80047f2:	e7f3      	b.n	80047dc <pin_firmware_greenlight+0x50>
+        return EPIN_WRONG_SUCCESS;
+ 80047f4:	f06f 006c 	mvn.w	r0, #108	; 0x6c
+ 80047f8:	e7f4      	b.n	80047e4 <pin_firmware_greenlight+0x58>
+        return EPIN_PRIMARY_ONLY;
+ 80047fa:	f06f 0071 	mvn.w	r0, #113	; 0x71
+ 80047fe:	e7f1      	b.n	80047e4 <pin_firmware_greenlight+0x58>
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 8004800:	f06f 0068 	mvn.w	r0, #104	; 0x68
+ 8004804:	e7ee      	b.n	80047e4 <pin_firmware_greenlight+0x58>
+ 8004806:	bf00      	nop
+ 8004808:	0801c000 	.word	0x0801c000
+
+0800480c <pin_firmware_upgrade>:
+// Update the system firmware via file in PSRAM. Arrange for 
+// light to stay green through out process.
+//
+    int
+pin_firmware_upgrade(pinAttempt_t *args)
+{
+ 800480c:	b570      	push	{r4, r5, r6, lr}
+    // Validate args and signature
+    int rv = _validate_attempt(args, false);
+ 800480e:	2100      	movs	r1, #0
+{
+ 8004810:	b092      	sub	sp, #72	; 0x48
+ 8004812:	4604      	mov	r4, r0
+    int rv = _validate_attempt(args, false);
+ 8004814:	f7ff f9b0 	bl	8003b78 <_validate_attempt>
+    if(rv) return rv;
+ 8004818:	2800      	cmp	r0, #0
+ 800481a:	d14e      	bne.n	80048ba <pin_firmware_upgrade+0xae>
+
+    if((args->state_flags & PA_SUCCESSFUL) != PA_SUCCESSFUL) {
+ 800481c:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 800481e:	07da      	lsls	r2, r3, #31
+ 8004820:	d54d      	bpl.n	80048be <pin_firmware_upgrade+0xb2>
+        // must come here with a successful PIN login
+        return EPIN_WRONG_SUCCESS;
+    }
+
+    if(args->change_flags != CHANGE_FIRMWARE) {
+ 8004822:	6e63      	ldr	r3, [r4, #100]	; 0x64
+ 8004824:	2b40      	cmp	r3, #64	; 0x40
+ 8004826:	d11c      	bne.n	8004862 <pin_firmware_upgrade+0x56>
+    }
+
+    // expecting start/length relative to psram start
+    uint32_t *about = (uint32_t *)args->secret;
+    uint32_t start = about[0];
+    uint32_t len = about[1];
+ 8004828:	e9d4 562c 	ldrd	r5, r6, [r4, #176]	; 0xb0
+
+    if(len < 32768) return EPIN_RANGE_ERR;
+ 800482c:	f5a6 4300 	sub.w	r3, r6, #32768	; 0x8000
+ 8004830:	f5b3 1ffc 	cmp.w	r3, #2064384	; 0x1f8000
+ 8004834:	d846      	bhi.n	80048c4 <pin_firmware_upgrade+0xb8>
+    if(len > 2<<20) return EPIN_RANGE_ERR;
+    if(start+len > PSRAM_SIZE) return EPIN_RANGE_ERR;
+ 8004836:	19ab      	adds	r3, r5, r6
+ 8004838:	f5b3 0f00 	cmp.w	r3, #8388608	; 0x800000
+ 800483c:	d842      	bhi.n	80048c4 <pin_firmware_upgrade+0xb8>
+
+    const uint8_t *data = (const uint8_t *)PSRAM_BASE+start;
+ 800483e:	f105 4510 	add.w	r5, r5, #2415919104	; 0x90000000
+
+    // verify a firmware image that's in RAM, and calc its digest
+    // - also applies watermark policy, etc
+    uint8_t world_check[32];
+    bool ok = verify_firmware_in_ram(data, len, world_check);
+ 8004842:	aa02      	add	r2, sp, #8
+ 8004844:	4631      	mov	r1, r6
+ 8004846:	4628      	mov	r0, r5
+ 8004848:	f7fd fa1a 	bl	8001c80 <verify_firmware_in_ram>
+    if(!ok) {
+ 800484c:	2800      	cmp	r0, #0
+ 800484e:	d03c      	beq.n	80048ca <pin_firmware_upgrade+0xbe>
+    bool is_trick = ((args->private_state ^ rom_secrets->hash_cache_secret[0]) & 0x1);
+ 8004850:	4b21      	ldr	r3, [pc, #132]	; (80048d8 <pin_firmware_upgrade+0xcc>)
+ 8004852:	6c22      	ldr	r2, [r4, #64]	; 0x40
+ 8004854:	f893 3070 	ldrb.w	r3, [r3, #112]	; 0x70
+ 8004858:	4053      	eors	r3, r2
+        return EPIN_AUTH_FAIL;
+    }
+
+    // under duress, we can't fake this, so kill ourselves.
+    if(get_is_trick(args, NULL)) {
+ 800485a:	07db      	lsls	r3, r3, #31
+ 800485c:	d504      	bpl.n	8004868 <pin_firmware_upgrade+0x5c>
+        // User is a thug.. kill secret and reboot w/o any notice
+        fast_wipe();
+ 800485e:	f7fd ff03 	bl	8002668 <fast_wipe>
+        return EPIN_BAD_REQUEST;
+ 8004862:	f06f 0067 	mvn.w	r0, #103	; 0x67
+ 8004866:	e028      	b.n	80048ba <pin_firmware_upgrade+0xae>
+        return EPIN_BAD_REQUEST;
+    }
+
+    // load existing PIN's hash
+    uint8_t     digest[32];
+    pin_cache_restore(args, digest);
+ 8004868:	a90a      	add	r1, sp, #40	; 0x28
+ 800486a:	4620      	mov	r0, r4
+ 800486c:	f7ff fb4a 	bl	8003f04 <pin_cache_restore>
+
+    // step 1: calc the value to use, see above
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 8004870:	f7ff f9b8 	bl	8003be4 <warmup_ae>
+ 8004874:	bb60      	cbnz	r0, 80048d0 <pin_firmware_upgrade+0xc4>
+
+    // step 2: write it out to chip.
+    rv = ae_encrypted_write(KEYNUM_firmware, KEYNUM_main_pin, digest, world_check, 32);
+ 8004876:	2320      	movs	r3, #32
+ 8004878:	9300      	str	r3, [sp, #0]
+ 800487a:	aa0a      	add	r2, sp, #40	; 0x28
+ 800487c:	ab02      	add	r3, sp, #8
+ 800487e:	2103      	movs	r1, #3
+ 8004880:	200e      	movs	r0, #14
+ 8004882:	f7fe fdbb 	bl	80033fc <ae_encrypted_write>
+    if(rv) goto fail;
+ 8004886:	b9a0      	cbnz	r0, 80048b2 <pin_firmware_upgrade+0xa6>
+
+    // this turns on green light
+    rv = ae_set_gpio_secure(world_check);
+ 8004888:	a802      	add	r0, sp, #8
+ 800488a:	f7fe fe49 	bl	8003520 <ae_set_gpio_secure>
+    if(rv) goto fail;
+ 800488e:	b980      	cbnz	r0, 80048b2 <pin_firmware_upgrade+0xa6>
+
+    // -- point of no return -- 
+
+    // burn it, shows progress
+    psram_do_upgrade(data, len);
+ 8004890:	4631      	mov	r1, r6
+ 8004892:	4628      	mov	r0, r5
+ 8004894:	f000 fbf4 	bl	8005080 <psram_do_upgrade>
+ 8004898:	f3bf 8f4f 	dsb	sy
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 800489c:	490f      	ldr	r1, [pc, #60]	; (80048dc <pin_firmware_upgrade+0xd0>)
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 800489e:	4b10      	ldr	r3, [pc, #64]	; (80048e0 <pin_firmware_upgrade+0xd4>)
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 80048a0:	68ca      	ldr	r2, [r1, #12]
+ 80048a2:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 80048a6:	4313      	orrs	r3, r2
+ 80048a8:	60cb      	str	r3, [r1, #12]
+ 80048aa:	f3bf 8f4f 	dsb	sy
+    __NOP();
+ 80048ae:	bf00      	nop
+  for(;;)                                                           /* wait until reset */
+ 80048b0:	e7fd      	b.n	80048ae <pin_firmware_upgrade+0xa2>
+    NVIC_SystemReset();
+
+    return 0;
+
+fail:
+    ae_reset_chip();
+ 80048b2:	f7fe f88f 	bl	80029d4 <ae_reset_chip>
+
+    return EPIN_AE_FAIL;
+ 80048b6:	f06f 0069 	mvn.w	r0, #105	; 0x69
+}
+ 80048ba:	b012      	add	sp, #72	; 0x48
+ 80048bc:	bd70      	pop	{r4, r5, r6, pc}
+        return EPIN_WRONG_SUCCESS;
+ 80048be:	f06f 006c 	mvn.w	r0, #108	; 0x6c
+ 80048c2:	e7fa      	b.n	80048ba <pin_firmware_upgrade+0xae>
+    if(len < 32768) return EPIN_RANGE_ERR;
+ 80048c4:	f06f 0066 	mvn.w	r0, #102	; 0x66
+ 80048c8:	e7f7      	b.n	80048ba <pin_firmware_upgrade+0xae>
+        return EPIN_AUTH_FAIL;
+ 80048ca:	f06f 006f 	mvn.w	r0, #111	; 0x6f
+ 80048ce:	e7f4      	b.n	80048ba <pin_firmware_upgrade+0xae>
+    if(warmup_ae()) return EPIN_I_AM_BRICK;
+ 80048d0:	f06f 0068 	mvn.w	r0, #104	; 0x68
+ 80048d4:	e7f1      	b.n	80048ba <pin_firmware_upgrade+0xae>
+ 80048d6:	bf00      	nop
+ 80048d8:	0801c000 	.word	0x0801c000
+ 80048dc:	e000ed00 	.word	0xe000ed00
+ 80048e0:	05fa0004 	.word	0x05fa0004
+
+080048e4 <strcat_hex>:
+
+// strcat_hex()
+//
+	void
+strcat_hex(char *msg, const void *d, int len)
+{
+ 80048e4:	b570      	push	{r4, r5, r6, lr}
+ 80048e6:	4616      	mov	r6, r2
+ 80048e8:	4604      	mov	r4, r0
+ 80048ea:	460d      	mov	r5, r1
+	char *p = msg+strlen(msg);
+ 80048ec:	f008 ff27 	bl	800d73e <strlen>
+	const uint8_t *h = (const uint8_t *)d;
+
+	for(; len; len--, h++) {
+		*(p++) = hexmap[(*h>>4) & 0xf];
+ 80048f0:	4a0b      	ldr	r2, [pc, #44]	; (8004920 <strcat_hex+0x3c>)
+	char *p = msg+strlen(msg);
+ 80048f2:	4420      	add	r0, r4
+	for(; len; len--, h++) {
+ 80048f4:	1e69      	subs	r1, r5, #1
+ 80048f6:	eb00 0646 	add.w	r6, r0, r6, lsl #1
+ 80048fa:	42b0      	cmp	r0, r6
+ 80048fc:	d102      	bne.n	8004904 <strcat_hex+0x20>
+		*(p++) = hexmap[(*h>>0) & 0xf];
+	}
+
+	*(p++) = 0;
+ 80048fe:	2300      	movs	r3, #0
+ 8004900:	7003      	strb	r3, [r0, #0]
+}
+ 8004902:	bd70      	pop	{r4, r5, r6, pc}
+		*(p++) = hexmap[(*h>>4) & 0xf];
+ 8004904:	f811 3f01 	ldrb.w	r3, [r1, #1]!
+ 8004908:	091b      	lsrs	r3, r3, #4
+ 800490a:	5cd3      	ldrb	r3, [r2, r3]
+ 800490c:	f800 3b02 	strb.w	r3, [r0], #2
+		*(p++) = hexmap[(*h>>0) & 0xf];
+ 8004910:	780b      	ldrb	r3, [r1, #0]
+ 8004912:	f003 030f 	and.w	r3, r3, #15
+ 8004916:	5cd3      	ldrb	r3, [r2, r3]
+ 8004918:	f800 3c01 	strb.w	r3, [r0, #-1]
+	for(; len; len--, h++) {
+ 800491c:	e7ed      	b.n	80048fa <strcat_hex+0x16>
+ 800491e:	bf00      	nop
+ 8004920:	0800e7da 	.word	0x0800e7da
+
+08004924 <HAL_USART_Init>:
+  *         parameters in the USART_InitTypeDef and initialize the associated handle.
+  * @param  husart USART handle.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HAL_USART_Init(USART_HandleTypeDef *husart)
+{
+ 8004924:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+  /* Check the USART handle allocation */
+  if (husart == NULL)
+ 8004926:	4604      	mov	r4, r0
+ 8004928:	b910      	cbnz	r0, 8004930 <HAL_USART_Init+0xc>
+  {
+    return HAL_ERROR;
+ 800492a:	2501      	movs	r5, #1
+  /* Enable the Peripheral */
+  __HAL_USART_ENABLE(husart);
+
+  /* TEACK and/or REACK to check before moving husart->State to Ready */
+  return (USART_CheckIdleState(husart));
+}
+ 800492c:	4628      	mov	r0, r5
+ 800492e:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+  if (husart->State == HAL_USART_STATE_RESET)
+ 8004930:	f890 3059 	ldrb.w	r3, [r0, #89]	; 0x59
+ 8004934:	f003 02ff 	and.w	r2, r3, #255	; 0xff
+ 8004938:	b90b      	cbnz	r3, 800493e <HAL_USART_Init+0x1a>
+    husart->Lock = HAL_UNLOCKED;
+ 800493a:	f880 2058 	strb.w	r2, [r0, #88]	; 0x58
+  __HAL_USART_DISABLE(husart);
+ 800493e:	6823      	ldr	r3, [r4, #0]
+  tmpreg = (uint32_t)husart->Init.WordLength | husart->Init.Parity | husart->Init.Mode | USART_CR1_OVER8;
+ 8004940:	6921      	ldr	r1, [r4, #16]
+  husart->State = HAL_USART_STATE_BUSY;
+ 8004942:	2502      	movs	r5, #2
+ 8004944:	f884 5059 	strb.w	r5, [r4, #89]	; 0x59
+  __HAL_USART_DISABLE(husart);
+ 8004948:	681a      	ldr	r2, [r3, #0]
+ 800494a:	f022 0201 	bic.w	r2, r2, #1
+ 800494e:	601a      	str	r2, [r3, #0]
+  tmpreg = (uint32_t)husart->Init.WordLength | husart->Init.Parity | husart->Init.Mode | USART_CR1_OVER8;
+ 8004950:	68a2      	ldr	r2, [r4, #8]
+  MODIFY_REG(husart->Instance->CR1, USART_CR1_FIELDS, tmpreg);
+ 8004952:	6818      	ldr	r0, [r3, #0]
+  tmpreg = (uint32_t)husart->Init.WordLength | husart->Init.Parity | husart->Init.Mode | USART_CR1_OVER8;
+ 8004954:	430a      	orrs	r2, r1
+  MODIFY_REG(husart->Instance->CR1, USART_CR1_FIELDS, tmpreg);
+ 8004956:	49a9      	ldr	r1, [pc, #676]	; (8004bfc <HAL_USART_Init+0x2d8>)
+ 8004958:	4001      	ands	r1, r0
+ 800495a:	430a      	orrs	r2, r1
+ 800495c:	6961      	ldr	r1, [r4, #20]
+  MODIFY_REG(husart->Instance->CR2, USART_CR2_FIELDS, tmpreg);
+ 800495e:	69a0      	ldr	r0, [r4, #24]
+  MODIFY_REG(husart->Instance->CR1, USART_CR1_FIELDS, tmpreg);
+ 8004960:	430a      	orrs	r2, r1
+ 8004962:	f442 4200 	orr.w	r2, r2, #32768	; 0x8000
+ 8004966:	601a      	str	r2, [r3, #0]
+  MODIFY_REG(husart->Instance->CR2, USART_CR2_FIELDS, tmpreg);
+ 8004968:	6859      	ldr	r1, [r3, #4]
+ 800496a:	6a22      	ldr	r2, [r4, #32]
+ 800496c:	f421 517c 	bic.w	r1, r1, #16128	; 0x3f00
+ 8004970:	f021 0109 	bic.w	r1, r1, #9
+ 8004974:	4302      	orrs	r2, r0
+ 8004976:	430a      	orrs	r2, r1
+ 8004978:	69e1      	ldr	r1, [r4, #28]
+ 800497a:	430a      	orrs	r2, r1
+ 800497c:	68e1      	ldr	r1, [r4, #12]
+ 800497e:	430a      	orrs	r2, r1
+ 8004980:	f442 6200 	orr.w	r2, r2, #2048	; 0x800
+ 8004984:	605a      	str	r2, [r3, #4]
+  MODIFY_REG(husart->Instance->PRESC, USART_PRESC_PRESCALER, husart->Init.ClockPrescaler);
+ 8004986:	6ad9      	ldr	r1, [r3, #44]	; 0x2c
+ 8004988:	6a62      	ldr	r2, [r4, #36]	; 0x24
+ 800498a:	f021 010f 	bic.w	r1, r1, #15
+ 800498e:	4311      	orrs	r1, r2
+ 8004990:	62d9      	str	r1, [r3, #44]	; 0x2c
+  USART_GETCLOCKSOURCE(husart, clocksource);
+ 8004992:	499b      	ldr	r1, [pc, #620]	; (8004c00 <HAL_USART_Init+0x2dc>)
+ 8004994:	428b      	cmp	r3, r1
+ 8004996:	d10e      	bne.n	80049b6 <HAL_USART_Init+0x92>
+ 8004998:	4b9a      	ldr	r3, [pc, #616]	; (8004c04 <HAL_USART_Init+0x2e0>)
+ 800499a:	f8d3 3088 	ldr.w	r3, [r3, #136]	; 0x88
+ 800499e:	f003 0303 	and.w	r3, r3, #3
+ 80049a2:	42ab      	cmp	r3, r5
+ 80049a4:	f000 80cd 	beq.w	8004b42 <HAL_USART_Init+0x21e>
+ 80049a8:	2b03      	cmp	r3, #3
+ 80049aa:	d01a      	beq.n	80049e2 <HAL_USART_Init+0xbe>
+ 80049ac:	2b01      	cmp	r3, #1
+ 80049ae:	d153      	bne.n	8004a58 <HAL_USART_Init+0x134>
+      pclk = HAL_RCC_GetSysClockFreq();
+ 80049b0:	f003 ff3e 	bl	8008830 <HAL_RCC_GetSysClockFreq>
+ 80049b4:	e052      	b.n	8004a5c <HAL_USART_Init+0x138>
+  USART_GETCLOCKSOURCE(husart, clocksource);
+ 80049b6:	4994      	ldr	r1, [pc, #592]	; (8004c08 <HAL_USART_Init+0x2e4>)
+ 80049b8:	428b      	cmp	r3, r1
+ 80049ba:	d13c      	bne.n	8004a36 <HAL_USART_Init+0x112>
+ 80049bc:	4b91      	ldr	r3, [pc, #580]	; (8004c04 <HAL_USART_Init+0x2e0>)
+ 80049be:	f8d3 3088 	ldr.w	r3, [r3, #136]	; 0x88
+ 80049c2:	f003 030c 	and.w	r3, r3, #12
+ 80049c6:	2b08      	cmp	r3, #8
+ 80049c8:	f000 80bb 	beq.w	8004b42 <HAL_USART_Init+0x21e>
+ 80049cc:	d807      	bhi.n	80049de <HAL_USART_Init+0xba>
+ 80049ce:	2b00      	cmp	r3, #0
+ 80049d0:	f000 80b4 	beq.w	8004b3c <HAL_USART_Init+0x218>
+ 80049d4:	2b04      	cmp	r3, #4
+ 80049d6:	d0eb      	beq.n	80049b0 <HAL_USART_Init+0x8c>
+  uint32_t usartdiv                    = 0x00000000;
+ 80049d8:	2300      	movs	r3, #0
+      ret = HAL_ERROR;
+ 80049da:	2501      	movs	r5, #1
+ 80049dc:	e06e      	b.n	8004abc <HAL_USART_Init+0x198>
+  USART_GETCLOCKSOURCE(husart, clocksource);
+ 80049de:	2b0c      	cmp	r3, #12
+ 80049e0:	d1fa      	bne.n	80049d8 <HAL_USART_Init+0xb4>
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(LSE_VALUE, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 80049e2:	2a00      	cmp	r2, #0
+ 80049e4:	f000 80fb 	beq.w	8004bde <HAL_USART_Init+0x2ba>
+ 80049e8:	2a01      	cmp	r2, #1
+ 80049ea:	f000 80fa 	beq.w	8004be2 <HAL_USART_Init+0x2be>
+ 80049ee:	2a02      	cmp	r2, #2
+ 80049f0:	f000 80f9 	beq.w	8004be6 <HAL_USART_Init+0x2c2>
+ 80049f4:	2a03      	cmp	r2, #3
+ 80049f6:	f000 80f8 	beq.w	8004bea <HAL_USART_Init+0x2c6>
+ 80049fa:	2a04      	cmp	r2, #4
+ 80049fc:	f000 80f7 	beq.w	8004bee <HAL_USART_Init+0x2ca>
+ 8004a00:	2a05      	cmp	r2, #5
+ 8004a02:	f000 80f6 	beq.w	8004bf2 <HAL_USART_Init+0x2ce>
+ 8004a06:	2a06      	cmp	r2, #6
+ 8004a08:	f000 80f5 	beq.w	8004bf6 <HAL_USART_Init+0x2d2>
+ 8004a0c:	2a07      	cmp	r2, #7
+ 8004a0e:	f000 8101 	beq.w	8004c14 <HAL_USART_Init+0x2f0>
+ 8004a12:	2a08      	cmp	r2, #8
+ 8004a14:	f000 8100 	beq.w	8004c18 <HAL_USART_Init+0x2f4>
+ 8004a18:	2a09      	cmp	r2, #9
+ 8004a1a:	f000 80ff 	beq.w	8004c1c <HAL_USART_Init+0x2f8>
+ 8004a1e:	2a0a      	cmp	r2, #10
+ 8004a20:	f000 80fe 	beq.w	8004c20 <HAL_USART_Init+0x2fc>
+ 8004a24:	2a0b      	cmp	r2, #11
+ 8004a26:	bf14      	ite	ne
+ 8004a28:	2201      	movne	r2, #1
+ 8004a2a:	f44f 7280 	moveq.w	r2, #256	; 0x100
+ 8004a2e:	6861      	ldr	r1, [r4, #4]
+ 8004a30:	f44f 4300 	mov.w	r3, #32768	; 0x8000
+ 8004a34:	e0a1      	b.n	8004b7a <HAL_USART_Init+0x256>
+  USART_GETCLOCKSOURCE(husart, clocksource);
+ 8004a36:	4975      	ldr	r1, [pc, #468]	; (8004c0c <HAL_USART_Init+0x2e8>)
+ 8004a38:	428b      	cmp	r3, r1
+ 8004a3a:	d1cd      	bne.n	80049d8 <HAL_USART_Init+0xb4>
+ 8004a3c:	4b71      	ldr	r3, [pc, #452]	; (8004c04 <HAL_USART_Init+0x2e0>)
+ 8004a3e:	f8d3 3088 	ldr.w	r3, [r3, #136]	; 0x88
+ 8004a42:	f003 0330 	and.w	r3, r3, #48	; 0x30
+ 8004a46:	2b20      	cmp	r3, #32
+ 8004a48:	d07b      	beq.n	8004b42 <HAL_USART_Init+0x21e>
+ 8004a4a:	d803      	bhi.n	8004a54 <HAL_USART_Init+0x130>
+ 8004a4c:	2b00      	cmp	r3, #0
+ 8004a4e:	d075      	beq.n	8004b3c <HAL_USART_Init+0x218>
+ 8004a50:	2b10      	cmp	r3, #16
+ 8004a52:	e7c0      	b.n	80049d6 <HAL_USART_Init+0xb2>
+ 8004a54:	2b30      	cmp	r3, #48	; 0x30
+ 8004a56:	e7c3      	b.n	80049e0 <HAL_USART_Init+0xbc>
+      pclk = HAL_RCC_GetPCLK2Freq();
+ 8004a58:	f004 faf8 	bl	800904c <HAL_RCC_GetPCLK2Freq>
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(pclk, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004a5c:	6a62      	ldr	r2, [r4, #36]	; 0x24
+ 8004a5e:	2a00      	cmp	r2, #0
+ 8004a60:	f000 80a7 	beq.w	8004bb2 <HAL_USART_Init+0x28e>
+ 8004a64:	2a01      	cmp	r2, #1
+ 8004a66:	f000 80a6 	beq.w	8004bb6 <HAL_USART_Init+0x292>
+ 8004a6a:	2a02      	cmp	r2, #2
+ 8004a6c:	f000 80a5 	beq.w	8004bba <HAL_USART_Init+0x296>
+ 8004a70:	2a03      	cmp	r2, #3
+ 8004a72:	f000 80a4 	beq.w	8004bbe <HAL_USART_Init+0x29a>
+ 8004a76:	2a04      	cmp	r2, #4
+ 8004a78:	f000 80a3 	beq.w	8004bc2 <HAL_USART_Init+0x29e>
+ 8004a7c:	2a05      	cmp	r2, #5
+ 8004a7e:	f000 80a2 	beq.w	8004bc6 <HAL_USART_Init+0x2a2>
+ 8004a82:	2a06      	cmp	r2, #6
+ 8004a84:	f000 80a1 	beq.w	8004bca <HAL_USART_Init+0x2a6>
+ 8004a88:	2a07      	cmp	r2, #7
+ 8004a8a:	f000 80a0 	beq.w	8004bce <HAL_USART_Init+0x2aa>
+ 8004a8e:	2a08      	cmp	r2, #8
+ 8004a90:	f000 809f 	beq.w	8004bd2 <HAL_USART_Init+0x2ae>
+ 8004a94:	2a09      	cmp	r2, #9
+ 8004a96:	f000 809e 	beq.w	8004bd6 <HAL_USART_Init+0x2b2>
+ 8004a9a:	2a0a      	cmp	r2, #10
+ 8004a9c:	f000 809d 	beq.w	8004bda <HAL_USART_Init+0x2b6>
+ 8004aa0:	2a0b      	cmp	r2, #11
+ 8004aa2:	bf14      	ite	ne
+ 8004aa4:	2201      	movne	r2, #1
+ 8004aa6:	f44f 7280 	moveq.w	r2, #256	; 0x100
+ 8004aaa:	6861      	ldr	r1, [r4, #4]
+ 8004aac:	fbb0 f0f2 	udiv	r0, r0, r2
+ 8004ab0:	084b      	lsrs	r3, r1, #1
+ 8004ab2:	eb03 0340 	add.w	r3, r3, r0, lsl #1
+  HAL_StatusTypeDef ret                = HAL_OK;
+ 8004ab6:	2500      	movs	r5, #0
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(LSE_VALUE, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004ab8:	fbb3 f3f1 	udiv	r3, r3, r1
+  if ((usartdiv >= USART_BRR_MIN) && (usartdiv <= USART_BRR_MAX))
+ 8004abc:	f1a3 0110 	sub.w	r1, r3, #16
+ 8004ac0:	f64f 72ef 	movw	r2, #65519	; 0xffef
+ 8004ac4:	4291      	cmp	r1, r2
+    brrtemp = (uint16_t)(usartdiv & 0xFFF0U);
+ 8004ac6:	bf9f      	itttt	ls
+ 8004ac8:	f023 020f 	bicls.w	r2, r3, #15
+ 8004acc:	b292      	uxthls	r2, r2
+    brrtemp |= (uint16_t)((usartdiv & (uint16_t)0x000FU) >> 1U);
+ 8004ace:	f3c3 0342 	ubfxls	r3, r3, #1, #3
+    husart->Instance->BRR = brrtemp;
+ 8004ad2:	6821      	ldrls	r1, [r4, #0]
+ 8004ad4:	bf9a      	itte	ls
+ 8004ad6:	4313      	orrls	r3, r2
+ 8004ad8:	60cb      	strls	r3, [r1, #12]
+    ret = HAL_ERROR;
+ 8004ada:	2501      	movhi	r5, #1
+  husart->NbTxDataToProcess = 1U;
+ 8004adc:	2301      	movs	r3, #1
+  husart->RxISR   = NULL;
+ 8004ade:	2200      	movs	r2, #0
+  if (USART_SetConfig(husart) == HAL_ERROR)
+ 8004ae0:	429d      	cmp	r5, r3
+  husart->TxISR   = NULL;
+ 8004ae2:	e9c4 2212 	strd	r2, r2, [r4, #72]	; 0x48
+  husart->NbTxDataToProcess = 1U;
+ 8004ae6:	87a3      	strh	r3, [r4, #60]	; 0x3c
+  husart->NbRxDataToProcess = 1U;
+ 8004ae8:	8763      	strh	r3, [r4, #58]	; 0x3a
+  if (USART_SetConfig(husart) == HAL_ERROR)
+ 8004aea:	f43f af1e 	beq.w	800492a <HAL_USART_Init+0x6>
+  husart->Instance->CR2 &= ~USART_CR2_LINEN;
+ 8004aee:	6823      	ldr	r3, [r4, #0]
+ 8004af0:	6859      	ldr	r1, [r3, #4]
+ 8004af2:	f421 4180 	bic.w	r1, r1, #16384	; 0x4000
+ 8004af6:	6059      	str	r1, [r3, #4]
+  husart->Instance->CR3 &= ~(USART_CR3_SCEN | USART_CR3_HDSEL | USART_CR3_IREN);
+ 8004af8:	6899      	ldr	r1, [r3, #8]
+ 8004afa:	f021 012a 	bic.w	r1, r1, #42	; 0x2a
+ 8004afe:	6099      	str	r1, [r3, #8]
+  __HAL_USART_ENABLE(husart);
+ 8004b00:	6819      	ldr	r1, [r3, #0]
+ 8004b02:	f041 0101 	orr.w	r1, r1, #1
+ 8004b06:	6019      	str	r1, [r3, #0]
+  husart->ErrorCode = HAL_USART_ERROR_NONE;
+ 8004b08:	65e2      	str	r2, [r4, #92]	; 0x5c
+  tickstart = HAL_GetTick();
+ 8004b0a:	f002 fb21 	bl	8007150 <HAL_GetTick>
+  if ((husart->Instance->CR1 & USART_CR1_TE) == USART_CR1_TE)
+ 8004b0e:	6823      	ldr	r3, [r4, #0]
+ 8004b10:	681b      	ldr	r3, [r3, #0]
+ 8004b12:	071a      	lsls	r2, r3, #28
+  tickstart = HAL_GetTick();
+ 8004b14:	4607      	mov	r7, r0
+  if ((husart->Instance->CR1 & USART_CR1_TE) == USART_CR1_TE)
+ 8004b16:	f100 8085 	bmi.w	8004c24 <HAL_USART_Init+0x300>
+  if ((husart->Instance->CR1 & USART_CR1_RE) == USART_CR1_RE)
+ 8004b1a:	6823      	ldr	r3, [r4, #0]
+ 8004b1c:	681b      	ldr	r3, [r3, #0]
+ 8004b1e:	075b      	lsls	r3, r3, #29
+ 8004b20:	d505      	bpl.n	8004b2e <HAL_USART_Init+0x20a>
+  while ((__HAL_USART_GET_FLAG(husart, Flag) ? SET : RESET) == Status)
+ 8004b22:	6823      	ldr	r3, [r4, #0]
+ 8004b24:	69de      	ldr	r6, [r3, #28]
+ 8004b26:	f416 0680 	ands.w	r6, r6, #4194304	; 0x400000
+ 8004b2a:	f000 808e 	beq.w	8004c4a <HAL_USART_Init+0x326>
+  husart->State = HAL_USART_STATE_READY;
+ 8004b2e:	2301      	movs	r3, #1
+ 8004b30:	f884 3059 	strb.w	r3, [r4, #89]	; 0x59
+  __HAL_UNLOCK(husart);
+ 8004b34:	2300      	movs	r3, #0
+ 8004b36:	f884 3058 	strb.w	r3, [r4, #88]	; 0x58
+  return HAL_OK;
+ 8004b3a:	e6f7      	b.n	800492c <HAL_USART_Init+0x8>
+      pclk = HAL_RCC_GetPCLK1Freq();
+ 8004b3c:	f004 fa74 	bl	8009028 <HAL_RCC_GetPCLK1Freq>
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(pclk, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004b40:	e78c      	b.n	8004a5c <HAL_USART_Init+0x138>
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(HSI_VALUE, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004b42:	b302      	cbz	r2, 8004b86 <HAL_USART_Init+0x262>
+ 8004b44:	2a01      	cmp	r2, #1
+ 8004b46:	d020      	beq.n	8004b8a <HAL_USART_Init+0x266>
+ 8004b48:	2a02      	cmp	r2, #2
+ 8004b4a:	d020      	beq.n	8004b8e <HAL_USART_Init+0x26a>
+ 8004b4c:	2a03      	cmp	r2, #3
+ 8004b4e:	d020      	beq.n	8004b92 <HAL_USART_Init+0x26e>
+ 8004b50:	2a04      	cmp	r2, #4
+ 8004b52:	d020      	beq.n	8004b96 <HAL_USART_Init+0x272>
+ 8004b54:	2a05      	cmp	r2, #5
+ 8004b56:	d020      	beq.n	8004b9a <HAL_USART_Init+0x276>
+ 8004b58:	2a06      	cmp	r2, #6
+ 8004b5a:	d020      	beq.n	8004b9e <HAL_USART_Init+0x27a>
+ 8004b5c:	2a07      	cmp	r2, #7
+ 8004b5e:	d020      	beq.n	8004ba2 <HAL_USART_Init+0x27e>
+ 8004b60:	2a08      	cmp	r2, #8
+ 8004b62:	d020      	beq.n	8004ba6 <HAL_USART_Init+0x282>
+ 8004b64:	2a09      	cmp	r2, #9
+ 8004b66:	d020      	beq.n	8004baa <HAL_USART_Init+0x286>
+ 8004b68:	2a0a      	cmp	r2, #10
+ 8004b6a:	d020      	beq.n	8004bae <HAL_USART_Init+0x28a>
+ 8004b6c:	2a0b      	cmp	r2, #11
+ 8004b6e:	bf14      	ite	ne
+ 8004b70:	2201      	movne	r2, #1
+ 8004b72:	f44f 7280 	moveq.w	r2, #256	; 0x100
+ 8004b76:	6861      	ldr	r1, [r4, #4]
+ 8004b78:	4b25      	ldr	r3, [pc, #148]	; (8004c10 <HAL_USART_Init+0x2ec>)
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(LSE_VALUE, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004b7a:	fbb3 f2f2 	udiv	r2, r3, r2
+ 8004b7e:	084b      	lsrs	r3, r1, #1
+ 8004b80:	eb03 0342 	add.w	r3, r3, r2, lsl #1
+ 8004b84:	e797      	b.n	8004ab6 <HAL_USART_Init+0x192>
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(HSI_VALUE, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004b86:	2201      	movs	r2, #1
+ 8004b88:	e7f5      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004b8a:	2202      	movs	r2, #2
+ 8004b8c:	e7f3      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004b8e:	2204      	movs	r2, #4
+ 8004b90:	e7f1      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004b92:	2206      	movs	r2, #6
+ 8004b94:	e7ef      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004b96:	2208      	movs	r2, #8
+ 8004b98:	e7ed      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004b9a:	220a      	movs	r2, #10
+ 8004b9c:	e7eb      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004b9e:	220c      	movs	r2, #12
+ 8004ba0:	e7e9      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004ba2:	2210      	movs	r2, #16
+ 8004ba4:	e7e7      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004ba6:	2220      	movs	r2, #32
+ 8004ba8:	e7e5      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004baa:	2240      	movs	r2, #64	; 0x40
+ 8004bac:	e7e3      	b.n	8004b76 <HAL_USART_Init+0x252>
+ 8004bae:	2280      	movs	r2, #128	; 0x80
+ 8004bb0:	e7e1      	b.n	8004b76 <HAL_USART_Init+0x252>
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(pclk, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004bb2:	2201      	movs	r2, #1
+ 8004bb4:	e779      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bb6:	2202      	movs	r2, #2
+ 8004bb8:	e777      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bba:	2204      	movs	r2, #4
+ 8004bbc:	e775      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bbe:	2206      	movs	r2, #6
+ 8004bc0:	e773      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bc2:	2208      	movs	r2, #8
+ 8004bc4:	e771      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bc6:	220a      	movs	r2, #10
+ 8004bc8:	e76f      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bca:	220c      	movs	r2, #12
+ 8004bcc:	e76d      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bce:	2210      	movs	r2, #16
+ 8004bd0:	e76b      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bd2:	2220      	movs	r2, #32
+ 8004bd4:	e769      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bd6:	2240      	movs	r2, #64	; 0x40
+ 8004bd8:	e767      	b.n	8004aaa <HAL_USART_Init+0x186>
+ 8004bda:	2280      	movs	r2, #128	; 0x80
+ 8004bdc:	e765      	b.n	8004aaa <HAL_USART_Init+0x186>
+      usartdiv = (uint32_t)(USART_DIV_SAMPLING8(LSE_VALUE, husart->Init.BaudRate, husart->Init.ClockPrescaler));
+ 8004bde:	2201      	movs	r2, #1
+ 8004be0:	e725      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004be2:	2202      	movs	r2, #2
+ 8004be4:	e723      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004be6:	2204      	movs	r2, #4
+ 8004be8:	e721      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004bea:	2206      	movs	r2, #6
+ 8004bec:	e71f      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004bee:	2208      	movs	r2, #8
+ 8004bf0:	e71d      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004bf2:	220a      	movs	r2, #10
+ 8004bf4:	e71b      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004bf6:	220c      	movs	r2, #12
+ 8004bf8:	e719      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004bfa:	bf00      	nop
+ 8004bfc:	cfff69f3 	.word	0xcfff69f3
+ 8004c00:	40013800 	.word	0x40013800
+ 8004c04:	40021000 	.word	0x40021000
+ 8004c08:	40004400 	.word	0x40004400
+ 8004c0c:	40004800 	.word	0x40004800
+ 8004c10:	00f42400 	.word	0x00f42400
+ 8004c14:	2210      	movs	r2, #16
+ 8004c16:	e70a      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004c18:	2220      	movs	r2, #32
+ 8004c1a:	e708      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004c1c:	2240      	movs	r2, #64	; 0x40
+ 8004c1e:	e706      	b.n	8004a2e <HAL_USART_Init+0x10a>
+ 8004c20:	2280      	movs	r2, #128	; 0x80
+ 8004c22:	e704      	b.n	8004a2e <HAL_USART_Init+0x10a>
+  while ((__HAL_USART_GET_FLAG(husart, Flag) ? SET : RESET) == Status)
+ 8004c24:	6823      	ldr	r3, [r4, #0]
+ 8004c26:	69de      	ldr	r6, [r3, #28]
+ 8004c28:	f416 1600 	ands.w	r6, r6, #2097152	; 0x200000
+ 8004c2c:	f47f af75 	bne.w	8004b1a <HAL_USART_Init+0x1f6>
+      if (((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 8004c30:	f002 fa8e 	bl	8007150 <HAL_GetTick>
+ 8004c34:	1bc0      	subs	r0, r0, r7
+ 8004c36:	f5b0 7f7a 	cmp.w	r0, #1000	; 0x3e8
+ 8004c3a:	d9f3      	bls.n	8004c24 <HAL_USART_Init+0x300>
+        husart->State = HAL_USART_STATE_READY;
+ 8004c3c:	2301      	movs	r3, #1
+ 8004c3e:	f884 3059 	strb.w	r3, [r4, #89]	; 0x59
+        __HAL_UNLOCK(husart);
+ 8004c42:	f884 6058 	strb.w	r6, [r4, #88]	; 0x58
+      return HAL_TIMEOUT;
+ 8004c46:	2503      	movs	r5, #3
+ 8004c48:	e670      	b.n	800492c <HAL_USART_Init+0x8>
+      if (((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 8004c4a:	f002 fa81 	bl	8007150 <HAL_GetTick>
+ 8004c4e:	1bc0      	subs	r0, r0, r7
+ 8004c50:	f5b0 7f7a 	cmp.w	r0, #1000	; 0x3e8
+ 8004c54:	f67f af65 	bls.w	8004b22 <HAL_USART_Init+0x1fe>
+ 8004c58:	e7f0      	b.n	8004c3c <HAL_USART_Init+0x318>
+ 8004c5a:	bf00      	nop
+
+08004c5c <console_setup>:
+    __HAL_RCC_USART1_CONFIG(RCC_USART1CLKSOURCE_SYSCLK);
+ 8004c5c:	4b14      	ldr	r3, [pc, #80]	; (8004cb0 <console_setup+0x54>)
+ 8004c5e:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8004c62:	f022 0203 	bic.w	r2, r2, #3
+ 8004c66:	f042 0201 	orr.w	r2, r2, #1
+{
+ 8004c6a:	b513      	push	{r0, r1, r4, lr}
+    __HAL_RCC_USART1_CONFIG(RCC_USART1CLKSOURCE_SYSCLK);
+ 8004c6c:	f8c3 2088 	str.w	r2, [r3, #136]	; 0x88
+    __HAL_RCC_USART1_CLK_ENABLE();
+ 8004c70:	6e1a      	ldr	r2, [r3, #96]	; 0x60
+    memset(&con, 0, sizeof(con));
+ 8004c72:	4c10      	ldr	r4, [pc, #64]	; (8004cb4 <console_setup+0x58>)
+    __HAL_RCC_USART1_CLK_ENABLE();
+ 8004c74:	f442 4280 	orr.w	r2, r2, #16384	; 0x4000
+ 8004c78:	661a      	str	r2, [r3, #96]	; 0x60
+ 8004c7a:	6e1b      	ldr	r3, [r3, #96]	; 0x60
+ 8004c7c:	f403 4380 	and.w	r3, r3, #16384	; 0x4000
+ 8004c80:	9301      	str	r3, [sp, #4]
+    memset(&con, 0, sizeof(con));
+ 8004c82:	2258      	movs	r2, #88	; 0x58
+ 8004c84:	2100      	movs	r1, #0
+ 8004c86:	f104 0008 	add.w	r0, r4, #8
+    __HAL_RCC_USART1_CLK_ENABLE();
+ 8004c8a:	9b01      	ldr	r3, [sp, #4]
+    memset(&con, 0, sizeof(con));
+ 8004c8c:	f008 fd24 	bl	800d6d8 <memset>
+    con.Init.BaudRate = 115200;
+ 8004c90:	4a09      	ldr	r2, [pc, #36]	; (8004cb8 <console_setup+0x5c>)
+ 8004c92:	f44f 33e1 	mov.w	r3, #115200	; 0x1c200
+ 8004c96:	e9c4 2300 	strd	r2, r3, [r4]
+    HAL_StatusTypeDef rv = HAL_USART_Init(&con);
+ 8004c9a:	4620      	mov	r0, r4
+    con.Init.Mode = USART_MODE_TX_RX;
+ 8004c9c:	230c      	movs	r3, #12
+ 8004c9e:	6163      	str	r3, [r4, #20]
+    HAL_StatusTypeDef rv = HAL_USART_Init(&con);
+ 8004ca0:	f7ff fe40 	bl	8004924 <HAL_USART_Init>
+    ASSERT(rv == HAL_OK);
+ 8004ca4:	b110      	cbz	r0, 8004cac <console_setup+0x50>
+ 8004ca6:	4805      	ldr	r0, [pc, #20]	; (8004cbc <console_setup+0x60>)
+ 8004ca8:	f7fb fece 	bl	8000a48 <fatal_error>
+}
+ 8004cac:	b002      	add	sp, #8
+ 8004cae:	bd10      	pop	{r4, pc}
+ 8004cb0:	40021000 	.word	0x40021000
+ 8004cb4:	2009e1c0 	.word	0x2009e1c0
+ 8004cb8:	40013800 	.word	0x40013800
+ 8004cbc:	0800e466 	.word	0x0800e466
+
+08004cc0 <HAL_USART_Transmit>:
+  * @param  Timeout Timeout duration.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HAL_USART_Transmit(USART_HandleTypeDef *husart, uint8_t *pTxData, uint16_t Size, uint32_t Timeout)
+{
+    while(Size > 0U) {
+ 8004cc0:	4b0b      	ldr	r3, [pc, #44]	; (8004cf0 <HAL_USART_Transmit+0x30>)
+ 8004cc2:	440a      	add	r2, r1
+ 8004cc4:	4291      	cmp	r1, r2
+ 8004cc6:	d10b      	bne.n	8004ce0 <HAL_USART_Transmit+0x20>
+        MY_UART->TDR = *pTxData;
+        pTxData++;
+        Size --;
+    }
+
+    while(!(MY_UART->ISR & UART_FLAG_TC)) {
+ 8004cc8:	69da      	ldr	r2, [r3, #28]
+ 8004cca:	0652      	lsls	r2, r2, #25
+ 8004ccc:	d5fc      	bpl.n	8004cc8 <HAL_USART_Transmit+0x8>
+        // wait for final byte to be sent
+    }
+
+    // Clear Transmission Complete Flag
+    MY_UART->ICR = USART_CLEAR_TCF;
+ 8004cce:	2240      	movs	r2, #64	; 0x40
+ 8004cd0:	621a      	str	r2, [r3, #32]
+
+    // Clear overrun flag and discard the received data
+    MY_UART->ICR = USART_CLEAR_OREF;
+ 8004cd2:	2208      	movs	r2, #8
+ 8004cd4:	621a      	str	r2, [r3, #32]
+    MY_UART->RQR = USART_RXDATA_FLUSH_REQUEST;
+ 8004cd6:	831a      	strh	r2, [r3, #24]
+    MY_UART->RQR = USART_TXDATA_FLUSH_REQUEST;
+ 8004cd8:	2210      	movs	r2, #16
+ 8004cda:	831a      	strh	r2, [r3, #24]
+
+    return HAL_OK;
+}
+ 8004cdc:	2000      	movs	r0, #0
+ 8004cde:	4770      	bx	lr
+        while(!(MY_UART->ISR & UART_FLAG_TXE)) {
+ 8004ce0:	69d8      	ldr	r0, [r3, #28]
+ 8004ce2:	0600      	lsls	r0, r0, #24
+ 8004ce4:	d5fc      	bpl.n	8004ce0 <HAL_USART_Transmit+0x20>
+        MY_UART->TDR = *pTxData;
+ 8004ce6:	f811 0b01 	ldrb.w	r0, [r1], #1
+ 8004cea:	8518      	strh	r0, [r3, #40]	; 0x28
+        Size --;
+ 8004cec:	e7ea      	b.n	8004cc4 <HAL_USART_Transmit+0x4>
+ 8004cee:	bf00      	nop
+ 8004cf0:	40013800 	.word	0x40013800
+
+08004cf4 <puts2>:
+{
+ 8004cf4:	b510      	push	{r4, lr}
+ 8004cf6:	4604      	mov	r4, r0
+    rng_delay();
+ 8004cf8:	f7fd fd56 	bl	80027a8 <rng_delay>
+    HAL_USART_Transmit(&con, (uint8_t *)msg, strlen(msg), HAL_MAX_DELAY);
+ 8004cfc:	4620      	mov	r0, r4
+ 8004cfe:	f008 fd1e 	bl	800d73e <strlen>
+ 8004d02:	4621      	mov	r1, r4
+ 8004d04:	b282      	uxth	r2, r0
+ 8004d06:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8004d0a:	4803      	ldr	r0, [pc, #12]	; (8004d18 <puts2+0x24>)
+ 8004d0c:	f7ff ffd8 	bl	8004cc0 <HAL_USART_Transmit>
+}
+ 8004d10:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+    rng_delay();
+ 8004d14:	f7fd bd48 	b.w	80027a8 <rng_delay>
+ 8004d18:	2009e1c0 	.word	0x2009e1c0
+
+08004d1c <putchar>:
+{
+ 8004d1c:	b513      	push	{r0, r1, r4, lr}
+ 8004d1e:	4604      	mov	r4, r0
+    uint8_t cb = c;
+ 8004d20:	f88d 0007 	strb.w	r0, [sp, #7]
+    rng_delay();
+ 8004d24:	f7fd fd40 	bl	80027a8 <rng_delay>
+    if(cb != '\n') {
+ 8004d28:	f89d 3007 	ldrb.w	r3, [sp, #7]
+        HAL_USART_Transmit(&con, (uint8_t *)CRLF, 2, HAL_MAX_DELAY);
+ 8004d2c:	4808      	ldr	r0, [pc, #32]	; (8004d50 <putchar+0x34>)
+    if(cb != '\n') {
+ 8004d2e:	2b0a      	cmp	r3, #10
+        HAL_USART_Transmit(&con, (uint8_t *)CRLF, 2, HAL_MAX_DELAY);
+ 8004d30:	bf08      	it	eq
+ 8004d32:	4908      	ldreq	r1, [pc, #32]	; (8004d54 <putchar+0x38>)
+        HAL_USART_Transmit(&con, &cb, 1, HAL_MAX_DELAY);
+ 8004d34:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8004d38:	bf1a      	itte	ne
+ 8004d3a:	2201      	movne	r2, #1
+ 8004d3c:	f10d 0107 	addne.w	r1, sp, #7
+        HAL_USART_Transmit(&con, (uint8_t *)CRLF, 2, HAL_MAX_DELAY);
+ 8004d40:	2202      	moveq	r2, #2
+ 8004d42:	f7ff ffbd 	bl	8004cc0 <HAL_USART_Transmit>
+    rng_delay();
+ 8004d46:	f7fd fd2f 	bl	80027a8 <rng_delay>
+}
+ 8004d4a:	4620      	mov	r0, r4
+ 8004d4c:	b002      	add	sp, #8
+ 8004d4e:	bd10      	pop	{r4, pc}
+ 8004d50:	2009e1c0 	.word	0x2009e1c0
+ 8004d54:	0800e7d7 	.word	0x0800e7d7
+
+08004d58 <puthex2>:
+{
+ 8004d58:	b538      	push	{r3, r4, r5, lr}
+	putchar(hexmap[(b>>4) & 0xf]);
+ 8004d5a:	4d06      	ldr	r5, [pc, #24]	; (8004d74 <puthex2+0x1c>)
+ 8004d5c:	0903      	lsrs	r3, r0, #4
+{
+ 8004d5e:	4604      	mov	r4, r0
+	putchar(hexmap[(b>>0) & 0xf]);
+ 8004d60:	f004 040f 	and.w	r4, r4, #15
+	putchar(hexmap[(b>>4) & 0xf]);
+ 8004d64:	5ce8      	ldrb	r0, [r5, r3]
+ 8004d66:	f7ff ffd9 	bl	8004d1c <putchar>
+	putchar(hexmap[(b>>0) & 0xf]);
+ 8004d6a:	5d28      	ldrb	r0, [r5, r4]
+}
+ 8004d6c:	e8bd 4038 	ldmia.w	sp!, {r3, r4, r5, lr}
+	putchar(hexmap[(b>>0) & 0xf]);
+ 8004d70:	f7ff bfd4 	b.w	8004d1c <putchar>
+ 8004d74:	0800e7da 	.word	0x0800e7da
+
+08004d78 <puthex4>:
+{
+ 8004d78:	b538      	push	{r3, r4, r5, lr}
+	putchar(hexmap[(w>>12) & 0xf]);
+ 8004d7a:	4d0b      	ldr	r5, [pc, #44]	; (8004da8 <puthex4+0x30>)
+ 8004d7c:	0b03      	lsrs	r3, r0, #12
+{
+ 8004d7e:	4604      	mov	r4, r0
+	putchar(hexmap[(w>>12) & 0xf]);
+ 8004d80:	5ce8      	ldrb	r0, [r5, r3]
+ 8004d82:	f7ff ffcb 	bl	8004d1c <putchar>
+	putchar(hexmap[(w>>8) & 0xf]);
+ 8004d86:	f3c4 2303 	ubfx	r3, r4, #8, #4
+ 8004d8a:	5ce8      	ldrb	r0, [r5, r3]
+ 8004d8c:	f7ff ffc6 	bl	8004d1c <putchar>
+	putchar(hexmap[(w>>4) & 0xf]);
+ 8004d90:	f3c4 1303 	ubfx	r3, r4, #4, #4
+	putchar(hexmap[(w>>0) & 0xf]);
+ 8004d94:	f004 040f 	and.w	r4, r4, #15
+	putchar(hexmap[(w>>4) & 0xf]);
+ 8004d98:	5ce8      	ldrb	r0, [r5, r3]
+ 8004d9a:	f7ff ffbf 	bl	8004d1c <putchar>
+	putchar(hexmap[(w>>0) & 0xf]);
+ 8004d9e:	5d28      	ldrb	r0, [r5, r4]
+}
+ 8004da0:	e8bd 4038 	ldmia.w	sp!, {r3, r4, r5, lr}
+	putchar(hexmap[(w>>0) & 0xf]);
+ 8004da4:	f7ff bfba 	b.w	8004d1c <putchar>
+ 8004da8:	0800e7da 	.word	0x0800e7da
+
+08004dac <puthex8>:
+{
+ 8004dac:	b510      	push	{r4, lr}
+ 8004dae:	4604      	mov	r4, r0
+    puthex4(w >> 16);
+ 8004db0:	0c00      	lsrs	r0, r0, #16
+ 8004db2:	f7ff ffe1 	bl	8004d78 <puthex4>
+    puthex4(w & 0xffff);
+ 8004db6:	b2a0      	uxth	r0, r4
+}
+ 8004db8:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+    puthex4(w & 0xffff);
+ 8004dbc:	f7ff bfdc 	b.w	8004d78 <puthex4>
+
+08004dc0 <putdec4>:
+{
+ 8004dc0:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+ 8004dc2:	4605      	mov	r5, r0
+ 8004dc4:	2604      	movs	r6, #4
+    for(int m=1000; m; m /= 10) {
+ 8004dc6:	f44f 747a 	mov.w	r4, #1000	; 0x3e8
+            char n = '0' + ((w / m) % 10);
+ 8004dca:	270a      	movs	r7, #10
+        if(w >= m) {
+ 8004dcc:	42a5      	cmp	r5, r4
+ 8004dce:	db09      	blt.n	8004de4 <putdec4+0x24>
+            char n = '0' + ((w / m) % 10);
+ 8004dd0:	fb95 f3f4 	sdiv	r3, r5, r4
+ 8004dd4:	fb93 f0f7 	sdiv	r0, r3, r7
+ 8004dd8:	fb07 3310 	mls	r3, r7, r0, r3
+ 8004ddc:	3330      	adds	r3, #48	; 0x30
+            putchar(n);
+ 8004dde:	b2d8      	uxtb	r0, r3
+ 8004de0:	f7ff ff9c 	bl	8004d1c <putchar>
+    for(int m=1000; m; m /= 10) {
+ 8004de4:	fb94 f4f7 	sdiv	r4, r4, r7
+ 8004de8:	3e01      	subs	r6, #1
+ 8004dea:	d1ef      	bne.n	8004dcc <putdec4+0xc>
+}
+ 8004dec:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+
+08004dee <hex_dump>:
+{
+ 8004dee:	b570      	push	{r4, r5, r6, lr}
+ 8004df0:	4606      	mov	r6, r0
+ 8004df2:	460d      	mov	r5, r1
+    for(int i=0; i<len; i++) {
+ 8004df4:	2400      	movs	r4, #0
+ 8004df6:	42ac      	cmp	r4, r5
+ 8004df8:	db04      	blt.n	8004e04 <hex_dump+0x16>
+}
+ 8004dfa:	e8bd 4070 	ldmia.w	sp!, {r4, r5, r6, lr}
+    putchar('\n');
+ 8004dfe:	200a      	movs	r0, #10
+ 8004e00:	f7ff bf8c 	b.w	8004d1c <putchar>
+        puthex2(data[i]);
+ 8004e04:	5d30      	ldrb	r0, [r6, r4]
+ 8004e06:	f7ff ffa7 	bl	8004d58 <puthex2>
+    for(int i=0; i<len; i++) {
+ 8004e0a:	3401      	adds	r4, #1
+ 8004e0c:	e7f3      	b.n	8004df6 <hex_dump+0x8>
+	...
+
+08004e10 <puts>:
+{
+ 8004e10:	b513      	push	{r0, r1, r4, lr}
+ 8004e12:	9001      	str	r0, [sp, #4]
+    int ln = strlen(msg);
+ 8004e14:	f008 fc93 	bl	800d73e <strlen>
+ 8004e18:	4604      	mov	r4, r0
+    rng_delay();
+ 8004e1a:	f7fd fcc5 	bl	80027a8 <rng_delay>
+    if(ln) HAL_USART_Transmit(&con, (uint8_t *)msg, ln, HAL_MAX_DELAY);
+ 8004e1e:	9901      	ldr	r1, [sp, #4]
+ 8004e20:	b12c      	cbz	r4, 8004e2e <puts+0x1e>
+ 8004e22:	4809      	ldr	r0, [pc, #36]	; (8004e48 <puts+0x38>)
+ 8004e24:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8004e28:	b2a2      	uxth	r2, r4
+ 8004e2a:	f7ff ff49 	bl	8004cc0 <HAL_USART_Transmit>
+    HAL_USART_Transmit(&con, (uint8_t *)CRLF, 2, HAL_MAX_DELAY);
+ 8004e2e:	4907      	ldr	r1, [pc, #28]	; (8004e4c <puts+0x3c>)
+ 8004e30:	4805      	ldr	r0, [pc, #20]	; (8004e48 <puts+0x38>)
+ 8004e32:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8004e36:	2202      	movs	r2, #2
+ 8004e38:	f7ff ff42 	bl	8004cc0 <HAL_USART_Transmit>
+    rng_delay();
+ 8004e3c:	f7fd fcb4 	bl	80027a8 <rng_delay>
+}
+ 8004e40:	2001      	movs	r0, #1
+ 8004e42:	b002      	add	sp, #8
+ 8004e44:	bd10      	pop	{r4, pc}
+ 8004e46:	bf00      	nop
+ 8004e48:	2009e1c0 	.word	0x2009e1c0
+ 8004e4c:	0800e7d7 	.word	0x0800e7d7
+
+08004e50 <psram_send_byte>:
+
+// psram_send_byte()
+//
+    void
+psram_send_byte(OSPI_HandleTypeDef  *qh, uint8_t cmd_byte, bool is_quad)
+{   
+ 8004e50:	b570      	push	{r4, r5, r6, lr}
+ 8004e52:	b094      	sub	sp, #80	; 0x50
+ 8004e54:	4604      	mov	r4, r0
+ 8004e56:	460e      	mov	r6, r1
+ 8004e58:	4615      	mov	r5, r2
+    // Send single-byte commands to the PSRAM chip. Quad mode or normal SPI.
+
+    OSPI_RegularCmdTypeDef cmd = {
+ 8004e5a:	2100      	movs	r1, #0
+ 8004e5c:	2250      	movs	r2, #80	; 0x50
+ 8004e5e:	4668      	mov	r0, sp
+ 8004e60:	f008 fc3a 	bl	800d6d8 <memset>
+        .OperationType = HAL_OSPI_OPTYPE_COMMON_CFG,
+        .Instruction = cmd_byte,                    // Exit Quad Mode
+        .InstructionMode = is_quad ? HAL_OSPI_INSTRUCTION_4_LINES : HAL_OSPI_INSTRUCTION_1_LINE,
+ 8004e64:	2d00      	cmp	r5, #0
+ 8004e66:	bf14      	ite	ne
+ 8004e68:	2303      	movne	r3, #3
+ 8004e6a:	2301      	moveq	r3, #1
+        .DataMode = HAL_OSPI_DATA_NONE,
+        .NbData = 0,                        // how much to read in bytes
+    };
+
+    // Start and finish a "Indirection functional mode" request
+    HAL_OSPI_Command(qh, &cmd, HAL_MAX_DELAY);
+ 8004e6c:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 8004e70:	4669      	mov	r1, sp
+ 8004e72:	4620      	mov	r0, r4
+    OSPI_RegularCmdTypeDef cmd = {
+ 8004e74:	9602      	str	r6, [sp, #8]
+ 8004e76:	9303      	str	r3, [sp, #12]
+    HAL_OSPI_Command(qh, &cmd, HAL_MAX_DELAY);
+ 8004e78:	f006 f884 	bl	800af84 <HAL_OSPI_Command>
+}
+ 8004e7c:	b014      	add	sp, #80	; 0x50
+ 8004e7e:	bd70      	pop	{r4, r5, r6, pc}
+
+08004e80 <psram_setup>:
+
+// psram_setup()
+//
+    void
+psram_setup(void)
+{
+ 8004e80:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 8004e84:	b0c6      	sub	sp, #280	; 0x118
+    // Using OSPI1 block
+    OSPI_HandleTypeDef  qh = { 0 };
+ 8004e86:	2250      	movs	r2, #80	; 0x50
+ 8004e88:	2100      	movs	r1, #0
+ 8004e8a:	a80a      	add	r0, sp, #40	; 0x28
+ 8004e8c:	f008 fc24 	bl	800d6d8 <memset>
+
+    // enable clocks
+    __HAL_RCC_OSPI1_CLK_ENABLE();
+ 8004e90:	4b6a      	ldr	r3, [pc, #424]	; (800503c <psram_setup+0x1bc>)
+    // reset module
+    __HAL_RCC_OSPI1_FORCE_RESET();
+    __HAL_RCC_OSPI1_RELEASE_RESET();
+
+   // configure pins: Port E PE10-PE15
+    GPIO_InitTypeDef setup = {
+ 8004e92:	4c6b      	ldr	r4, [pc, #428]	; (8005040 <psram_setup+0x1c0>)
+    __HAL_RCC_OSPI1_CLK_ENABLE();
+ 8004e94:	6d1a      	ldr	r2, [r3, #80]	; 0x50
+ 8004e96:	f442 7280 	orr.w	r2, r2, #256	; 0x100
+ 8004e9a:	651a      	str	r2, [r3, #80]	; 0x50
+ 8004e9c:	6d1a      	ldr	r2, [r3, #80]	; 0x50
+ 8004e9e:	f402 7280 	and.w	r2, r2, #256	; 0x100
+ 8004ea2:	9201      	str	r2, [sp, #4]
+ 8004ea4:	9a01      	ldr	r2, [sp, #4]
+    __HAL_RCC_GPIOE_CLK_ENABLE();
+ 8004ea6:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8004ea8:	f042 0210 	orr.w	r2, r2, #16
+ 8004eac:	64da      	str	r2, [r3, #76]	; 0x4c
+ 8004eae:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8004eb0:	f002 0210 	and.w	r2, r2, #16
+ 8004eb4:	9202      	str	r2, [sp, #8]
+ 8004eb6:	9a02      	ldr	r2, [sp, #8]
+    __HAL_RCC_OSPI1_FORCE_RESET();
+ 8004eb8:	6b1a      	ldr	r2, [r3, #48]	; 0x30
+ 8004eba:	f442 7280 	orr.w	r2, r2, #256	; 0x100
+ 8004ebe:	631a      	str	r2, [r3, #48]	; 0x30
+    __HAL_RCC_OSPI1_RELEASE_RESET();
+ 8004ec0:	6b1a      	ldr	r2, [r3, #48]	; 0x30
+ 8004ec2:	f422 7280 	bic.w	r2, r2, #256	; 0x100
+ 8004ec6:	631a      	str	r2, [r3, #48]	; 0x30
+    GPIO_InitTypeDef setup = {
+ 8004ec8:	cc0f      	ldmia	r4!, {r0, r1, r2, r3}
+ 8004eca:	ad05      	add	r5, sp, #20
+ 8004ecc:	c50f      	stmia	r5!, {r0, r1, r2, r3}
+ 8004ece:	6823      	ldr	r3, [r4, #0]
+        .Mode = GPIO_MODE_AF_PP,            // not sure
+        .Pull = GPIO_NOPULL,                // not sure
+        .Speed = GPIO_SPEED_FREQ_VERY_HIGH,
+        .Alternate = GPIO_AF10_OCTOSPIM_P1,
+    };
+    HAL_GPIO_Init(GPIOE, &setup);
+ 8004ed0:	485c      	ldr	r0, [pc, #368]	; (8005044 <psram_setup+0x1c4>)
+    GPIO_InitTypeDef setup = {
+ 8004ed2:	602b      	str	r3, [r5, #0]
+    HAL_GPIO_Init(GPIOE, &setup);
+ 8004ed4:	a905      	add	r1, sp, #20
+ 8004ed6:	f7fc f8b1 	bl	800103c <HAL_GPIO_Init>
+
+
+    // Config operational values
+    qh.Instance = OCTOSPI1;
+    qh.Init.FifoThreshold = 1;                          // ?? unused
+ 8004eda:	4b5b      	ldr	r3, [pc, #364]	; (8005048 <psram_setup+0x1c8>)
+ 8004edc:	2701      	movs	r7, #1
+    qh.Init.DualQuad = HAL_OSPI_DUALQUAD_DISABLE;
+    qh.Init.MemoryType = HAL_OSPI_MEMTYPE_MICRON;       // want standard mode (but octo only?)
+    qh.Init.DeviceSize = 24;                    // assume max size, actual is 8Mbyte
+ 8004ede:	2218      	movs	r2, #24
+    qh.Init.FifoThreshold = 1;                          // ?? unused
+ 8004ee0:	e9cd 370a 	strd	r3, r7, [sp, #40]	; 0x28
+    qh.Init.ChipSelectHighTime = 1;             // 1, maxed out, seems to work
+ 8004ee4:	e9cd 270e 	strd	r2, r7, [sp, #56]	; 0x38
+    qh.Init.DualQuad = HAL_OSPI_DUALQUAD_DISABLE;
+ 8004ee8:	2300      	movs	r3, #0
+    qh.Init.DelayHoldQuarterCycle = HAL_OSPI_DHQC_ENABLE;       // maybe?
+ 8004eea:	f04f 5280 	mov.w	r2, #268435456	; 0x10000000
+    qh.Init.FreeRunningClock = HAL_OSPI_FREERUNCLK_DISABLE;     // required!
+    qh.Init.ClockMode = HAL_OSPI_CLOCK_MODE_0;  // low clock between ops (required, see errata)
+#if HCLK_FREQUENCY == 80000000
+    qh.Init.ClockPrescaler = 1;                 // prescaler (1=>80Mhz, 2=>40Mhz, etc)
+#elif HCLK_FREQUENCY == 120000000
+    qh.Init.ClockPrescaler = 2;                 // prescaler (1=>120Mhz, 2=>60Mhz, etc)
+ 8004eee:	f04f 0802 	mov.w	r8, #2
+#else
+#   error "testing needed"
+#endif
+    qh.Init.DelayBlockBypass = HAL_OSPI_DELAY_BLOCK_BYPASSED;        // dont need it?
+ 8004ef2:	f04f 0908 	mov.w	r9, #8
+    // - (during reads) 3 => 400ns  4 => 660ns   5+ => 1us 
+    // - LATER: Errata 2.8.1 => says shall not use
+    qh.Init.ChipSelectBoundary = 0;
+
+    // module init 
+    HAL_StatusTypeDef rv = HAL_OSPI_Init(&qh);
+ 8004ef6:	a80a      	add	r0, sp, #40	; 0x28
+    qh.Init.MemoryType = HAL_OSPI_MEMTYPE_MICRON;       // want standard mode (but octo only?)
+ 8004ef8:	e9cd 330c 	strd	r3, r3, [sp, #48]	; 0x30
+    qh.Init.ClockMode = HAL_OSPI_CLOCK_MODE_0;  // low clock between ops (required, see errata)
+ 8004efc:	e9cd 3310 	strd	r3, r3, [sp, #64]	; 0x40
+    qh.Init.ChipSelectBoundary = 0;
+ 8004f00:	e9cd 3915 	strd	r3, r9, [sp, #84]	; 0x54
+    qh.Init.DelayHoldQuarterCycle = HAL_OSPI_DHQC_ENABLE;       // maybe?
+ 8004f04:	9214      	str	r2, [sp, #80]	; 0x50
+    qh.Init.ClockPrescaler = 2;                 // prescaler (1=>120Mhz, 2=>60Mhz, etc)
+ 8004f06:	f8cd 8048 	str.w	r8, [sp, #72]	; 0x48
+    HAL_StatusTypeDef rv = HAL_OSPI_Init(&qh);
+ 8004f0a:	f005 ffd1 	bl	800aeb0 <HAL_OSPI_Init>
+    ASSERT(rv == HAL_OK);
+ 8004f0e:	4606      	mov	r6, r0
+ 8004f10:	b110      	cbz	r0, 8004f18 <psram_setup+0x98>
+ 8004f12:	484e      	ldr	r0, [pc, #312]	; (800504c <psram_setup+0x1cc>)
+ 8004f14:	f7fb fd98 	bl	8000a48 <fatal_error>
+
+    // do some SPI commands first
+
+    // Exit Quad mode, to get to a known state, after first power-up
+    psram_send_byte(&qh, 0xf5, true);
+ 8004f18:	463a      	mov	r2, r7
+ 8004f1a:	21f5      	movs	r1, #245	; 0xf5
+ 8004f1c:	a80a      	add	r0, sp, #40	; 0x28
+ 8004f1e:	f7ff ff97 	bl	8004e50 <psram_send_byte>
+
+    // Chip Reset sequence
+    psram_send_byte(&qh, 0x66, false);      // reset enable
+ 8004f22:	4632      	mov	r2, r6
+ 8004f24:	2166      	movs	r1, #102	; 0x66
+ 8004f26:	a80a      	add	r0, sp, #40	; 0x28
+ 8004f28:	f7ff ff92 	bl	8004e50 <psram_send_byte>
+
+    // Read Electronic ID
+    // - length not clear from datasheet, but repeats after 8 bytes
+    uint8_t psram_chip_eid[8];
+
+    {   OSPI_RegularCmdTypeDef cmd = {
+ 8004f2c:	ad32      	add	r5, sp, #200	; 0xc8
+    psram_send_byte(&qh, 0x99, false);      // reset
+ 8004f2e:	4632      	mov	r2, r6
+ 8004f30:	2199      	movs	r1, #153	; 0x99
+ 8004f32:	a80a      	add	r0, sp, #40	; 0x28
+ 8004f34:	f7ff ff8c 	bl	8004e50 <psram_send_byte>
+    {   OSPI_RegularCmdTypeDef cmd = {
+ 8004f38:	2250      	movs	r2, #80	; 0x50
+ 8004f3a:	4631      	mov	r1, r6
+ 8004f3c:	4628      	mov	r0, r5
+ 8004f3e:	f008 fbcb 	bl	800d6d8 <memset>
+ 8004f42:	239f      	movs	r3, #159	; 0x9f
+ 8004f44:	e9cd 3734 	strd	r3, r7, [sp, #208]	; 0xd0
+ 8004f48:	f44f 5a00 	mov.w	sl, #8192	; 0x2000
+ 8004f4c:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 8004f50:	e9cd 3a39 	strd	r3, sl, [sp, #228]	; 0xe4
+            .DataMode = HAL_OSPI_DATA_1_LINE,
+            .NbData = sizeof(psram_chip_eid),                        // how much to read in bytes
+        };
+
+        // Start a "Indirection functional mode" request
+        rv = HAL_OSPI_Command(&qh, &cmd, HAL_MAX_DELAY);
+ 8004f54:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+    {   OSPI_RegularCmdTypeDef cmd = {
+ 8004f58:	f04f 7380 	mov.w	r3, #16777216	; 0x1000000
+        rv = HAL_OSPI_Command(&qh, &cmd, HAL_MAX_DELAY);
+ 8004f5c:	4629      	mov	r1, r5
+ 8004f5e:	a80a      	add	r0, sp, #40	; 0x28
+    {   OSPI_RegularCmdTypeDef cmd = {
+ 8004f60:	e9cd 3940 	strd	r3, r9, [sp, #256]	; 0x100
+        rv = HAL_OSPI_Command(&qh, &cmd, HAL_MAX_DELAY);
+ 8004f64:	f006 f80e 	bl	800af84 <HAL_OSPI_Command>
+        if(rv != HAL_OK) goto fail;
+ 8004f68:	2800      	cmp	r0, #0
+ 8004f6a:	d15d      	bne.n	8005028 <psram_setup+0x1a8>
+
+        rv = HAL_OSPI_Receive(&qh, psram_chip_eid, HAL_MAX_DELAY);
+ 8004f6c:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 8004f70:	a903      	add	r1, sp, #12
+ 8004f72:	a80a      	add	r0, sp, #40	; 0x28
+ 8004f74:	f006 f938 	bl	800b1e8 <HAL_OSPI_Receive>
+        if(rv != HAL_OK) goto fail;
+ 8004f78:	4606      	mov	r6, r0
+ 8004f7a:	2800      	cmp	r0, #0
+ 8004f7c:	d154      	bne.n	8005028 <psram_setup+0x1a8>
+    }
+
+    //puts2("PSRAM EID: "); 
+    //hex_dump(psram_chip_eid, sizeof(psram_chip_eid));
+    ASSERT(psram_chip_eid[0] == 0x0d);
+ 8004f7e:	f89d 300c 	ldrb.w	r3, [sp, #12]
+ 8004f82:	2b0d      	cmp	r3, #13
+ 8004f84:	d1c5      	bne.n	8004f12 <psram_setup+0x92>
+    ASSERT(psram_chip_eid[1] == 0x5d);
+ 8004f86:	f89d 300d 	ldrb.w	r3, [sp, #13]
+ 8004f8a:	2b5d      	cmp	r3, #93	; 0x5d
+ 8004f8c:	d1c1      	bne.n	8004f12 <psram_setup+0x92>
+    // .. other bits seem pretty similar between devices, they don't claim they are UUID
+
+    // Put into Quad mode
+    psram_send_byte(&qh, 0x35, false);  // 0x35 = Enter Quad Mode
+ 8004f8e:	4602      	mov	r2, r0
+ 8004f90:	2135      	movs	r1, #53	; 0x35
+ 8004f92:	a80a      	add	r0, sp, #40	; 0x28
+ 8004f94:	f7ff ff5c 	bl	8004e50 <psram_send_byte>
+
+    // Configure read/write cycles for mem-mapped mode
+    {   OSPI_RegularCmdTypeDef cmd = {
+ 8004f98:	4631      	mov	r1, r6
+ 8004f9a:	224c      	movs	r2, #76	; 0x4c
+ 8004f9c:	a81f      	add	r0, sp, #124	; 0x7c
+ 8004f9e:	f008 fb9b 	bl	800d6d8 <memset>
+ 8004fa2:	f04f 0903 	mov.w	r9, #3
+ 8004fa6:	f8cd 8078 	str.w	r8, [sp, #120]	; 0x78
+ 8004faa:	f8cd 8080 	str.w	r8, [sp, #128]	; 0x80
+            .DataMode = HAL_OSPI_DATA_4_LINES,
+            .NbData = 0,                        // don't care / TBD?
+        };
+
+        // Config for write
+        rv = HAL_OSPI_Command(&qh, &cmd, HAL_MAX_DELAY);
+ 8004fae:	a91e      	add	r1, sp, #120	; 0x78
+    {   OSPI_RegularCmdTypeDef cmd = {
+ 8004fb0:	f44f 7840 	mov.w	r8, #768	; 0x300
+ 8004fb4:	f04f 7640 	mov.w	r6, #50331648	; 0x3000000
+        rv = HAL_OSPI_Command(&qh, &cmd, HAL_MAX_DELAY);
+ 8004fb8:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 8004fbc:	a80a      	add	r0, sp, #40	; 0x28
+    {   OSPI_RegularCmdTypeDef cmd = {
+ 8004fbe:	e9cd 8a25 	strd	r8, sl, [sp, #148]	; 0x94
+ 8004fc2:	f8cd 9084 	str.w	r9, [sp, #132]	; 0x84
+ 8004fc6:	962c      	str	r6, [sp, #176]	; 0xb0
+        rv = HAL_OSPI_Command(&qh, &cmd, HAL_MAX_DELAY);
+ 8004fc8:	f005 ffdc 	bl	800af84 <HAL_OSPI_Command>
+        if(rv != HAL_OK) goto fail;
+ 8004fcc:	4601      	mov	r1, r0
+ 8004fce:	bb58      	cbnz	r0, 8005028 <psram_setup+0x1a8>
+
+        // .. for read
+        OSPI_RegularCmdTypeDef cmd2 = {
+ 8004fd0:	224c      	movs	r2, #76	; 0x4c
+ 8004fd2:	a833      	add	r0, sp, #204	; 0xcc
+ 8004fd4:	f008 fb80 	bl	800d6d8 <memset>
+ 8004fd8:	23eb      	movs	r3, #235	; 0xeb
+ 8004fda:	e9cd 3934 	strd	r3, r9, [sp, #208]	; 0xd0
+            .DataMode = HAL_OSPI_DATA_4_LINES,
+            .NbData = 0,                        // don't care / TBD?
+        };
+
+        // Config for read
+        rv = HAL_OSPI_Command(&qh, &cmd2, HAL_MAX_DELAY);
+ 8004fde:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+        OSPI_RegularCmdTypeDef cmd2 = {
+ 8004fe2:	2306      	movs	r3, #6
+        rv = HAL_OSPI_Command(&qh, &cmd2, HAL_MAX_DELAY);
+ 8004fe4:	4629      	mov	r1, r5
+ 8004fe6:	a80a      	add	r0, sp, #40	; 0x28
+        OSPI_RegularCmdTypeDef cmd2 = {
+ 8004fe8:	e9cd 8a39 	strd	r8, sl, [sp, #228]	; 0xe4
+ 8004fec:	9732      	str	r7, [sp, #200]	; 0xc8
+ 8004fee:	9640      	str	r6, [sp, #256]	; 0x100
+ 8004ff0:	9343      	str	r3, [sp, #268]	; 0x10c
+        rv = HAL_OSPI_Command(&qh, &cmd2, HAL_MAX_DELAY);
+ 8004ff2:	f005 ffc7 	bl	800af84 <HAL_OSPI_Command>
+        if(rv != HAL_OK) goto fail;
+ 8004ff6:	b9b8      	cbnz	r0, 8005028 <psram_setup+0x1a8>
+    }
+
+    // config for memmap
+    {   OSPI_MemoryMappedTypeDef mmap = {
+ 8004ff8:	e9d4 0101 	ldrd	r0, r1, [r4, #4]
+ 8004ffc:	e885 0003 	stmia.w	r5, {r0, r1}
+           // Need this so that CS lines returns to inactive sometimes.
+          .TimeOutActivation = HAL_OSPI_TIMEOUT_COUNTER_ENABLE,
+          .TimeOutPeriod = 16,          // no idea, max value 0xffff
+        };
+
+        rv = HAL_OSPI_MemoryMapped(&qh, &mmap);
+ 8005000:	4629      	mov	r1, r5
+ 8005002:	a80a      	add	r0, sp, #40	; 0x28
+ 8005004:	f006 f9d6 	bl	800b3b4 <HAL_OSPI_MemoryMapped>
+        if(rv != HAL_OK) goto fail;
+ 8005008:	b970      	cbnz	r0, 8005028 <psram_setup+0x1a8>
+#else
+    // Only a quick operational check only here. Non-destructive.
+    {   __IO uint32_t    *ptr = (uint32_t *)(PSRAM_BASE+PSRAM_SIZE-4);
+        uint32_t    tmp;
+
+        tmp = *ptr;
+ 800500a:	4b11      	ldr	r3, [pc, #68]	; (8005050 <psram_setup+0x1d0>)
+        *ptr = 0x55aa1234;
+ 800500c:	4a11      	ldr	r2, [pc, #68]	; (8005054 <psram_setup+0x1d4>)
+        tmp = *ptr;
+ 800500e:	f8d3 1ffc 	ldr.w	r1, [r3, #4092]	; 0xffc
+        *ptr = 0x55aa1234;
+ 8005012:	f8c3 2ffc 	str.w	r2, [r3, #4092]	; 0xffc
+        if(*ptr != 0x55aa1234) goto fail;
+ 8005016:	f8d3 0ffc 	ldr.w	r0, [r3, #4092]	; 0xffc
+ 800501a:	4290      	cmp	r0, r2
+ 800501c:	d104      	bne.n	8005028 <psram_setup+0x1a8>
+        *ptr = tmp;
+ 800501e:	f8c3 1ffc 	str.w	r1, [r3, #4092]	; 0xffc
+
+    oled_setup();
+    oled_show(screen_fatal);
+
+    LOCKUP_FOREVER();
+}
+ 8005022:	b046      	add	sp, #280	; 0x118
+ 8005024:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+    puts("PSRAM fail");
+ 8005028:	480b      	ldr	r0, [pc, #44]	; (8005058 <psram_setup+0x1d8>)
+ 800502a:	f7ff fef1 	bl	8004e10 <puts>
+    oled_setup();
+ 800502e:	f7fb fe79 	bl	8000d24 <oled_setup>
+    oled_show(screen_fatal);
+ 8005032:	480a      	ldr	r0, [pc, #40]	; (800505c <psram_setup+0x1dc>)
+ 8005034:	f7fb ff14 	bl	8000e60 <oled_show>
+    LOCKUP_FOREVER();
+ 8005038:	bf30      	wfi
+ 800503a:	e7fd      	b.n	8005038 <psram_setup+0x1b8>
+ 800503c:	40021000 	.word	0x40021000
+ 8005040:	0800e818 	.word	0x0800e818
+ 8005044:	48001000 	.word	0x48001000
+ 8005048:	a0001000 	.word	0xa0001000
+ 800504c:	0800e466 	.word	0x0800e466
+ 8005050:	907ff000 	.word	0x907ff000
+ 8005054:	55aa1234 	.word	0x55aa1234
+ 8005058:	0800e7ea 	.word	0x0800e7ea
+ 800505c:	0800dbd8 	.word	0x0800dbd8
+
+08005060 <psram_wipe>:
+
+// psram_wipe()
+//
+    void
+psram_wipe(void)
+{
+ 8005060:	b508      	push	{r3, lr}
+    if(OCTOSPI1->CR == 0) return;       // PSRAM not enabled (yet?)
+ 8005062:	4b06      	ldr	r3, [pc, #24]	; (800507c <psram_wipe+0x1c>)
+ 8005064:	681b      	ldr	r3, [r3, #0]
+ 8005066:	b143      	cbz	r3, 800507a <psram_wipe+0x1a>
+
+    // Fast! But real; maybe 150ms
+    //puts2("PSRAM Wipe: ");
+    memset4((uint32_t *)PSRAM_BASE, rng_sample(), PSRAM_SIZE);
+ 8005068:	f7fd fb4a 	bl	8002700 <rng_sample>
+ 800506c:	f04f 4310 	mov.w	r3, #2415919104	; 0x90000000
+        *dest = value;
+ 8005070:	f843 0b04 	str.w	r0, [r3], #4
+    for(; byte_len; byte_len-=4, dest++) {
+ 8005074:	f113 4fdf 	cmn.w	r3, #1870659584	; 0x6f800000
+ 8005078:	d1fa      	bne.n	8005070 <psram_wipe+0x10>
+    //puts("done");
+}
+ 800507a:	bd08      	pop	{r3, pc}
+ 800507c:	a0001000 	.word	0xa0001000
+
+08005080 <psram_do_upgrade>:
+// NOTE: Incoming start address is typically not aligned.
+//
+    void
+psram_do_upgrade(const uint8_t *start, uint32_t size)
+{
+    ASSERT(size >= FW_MIN_LENGTH);
+ 8005080:	f5b1 2f80 	cmp.w	r1, #262144	; 0x40000
+{
+ 8005084:	e92d 43f7 	stmdb	sp!, {r0, r1, r2, r4, r5, r6, r7, r8, r9, lr}
+ 8005088:	4606      	mov	r6, r0
+ 800508a:	460d      	mov	r5, r1
+    ASSERT(size >= FW_MIN_LENGTH);
+ 800508c:	d202      	bcs.n	8005094 <psram_do_upgrade+0x14>
+ 800508e:	481e      	ldr	r0, [pc, #120]	; (8005108 <psram_do_upgrade+0x88>)
+ 8005090:	f7fb fcda 	bl	8000a48 <fatal_error>
+
+    // In case of reset/crash, we can recover, so save
+    // what we need for that -- yes, we will re-verify signatures
+    volatile recovery_header_t   *h = RECHDR_POS;
+    h->start = start;
+ 8005094:	4b1d      	ldr	r3, [pc, #116]	; (800510c <psram_do_upgrade+0x8c>)
+    h->size = size;
+    h->magic1 = RECHDR_MAGIC1;
+ 8005096:	4a1e      	ldr	r2, [pc, #120]	; (8005110 <psram_do_upgrade+0x90>)
+    h->start = start;
+ 8005098:	6058      	str	r0, [r3, #4]
+    h->size = size;
+ 800509a:	6099      	str	r1, [r3, #8]
+    h->magic1 = RECHDR_MAGIC1;
+ 800509c:	601a      	str	r2, [r3, #0]
+    h->magic2 = RECHDR_MAGIC2;
+ 800509e:	4a1d      	ldr	r2, [pc, #116]	; (8005114 <psram_do_upgrade+0x94>)
+ 80050a0:	60da      	str	r2, [r3, #12]
+
+    flash_setup0();
+ 80050a2:	f7fc ffa7 	bl	8001ff4 <flash_setup0>
+    flash_unlock();
+ 80050a6:	f7fc ffc9 	bl	800203c <flash_unlock>
+    for(uint32_t pos=0; pos < size; pos += 8) {
+        uint32_t dest = FIRMWARE_START+pos;
+
+        if(dest % (4*FLASH_ERASE_SIZE) == 0) {
+            // show some progress
+            oled_show_progress(screen_upgrading, pos*100/size);
+ 80050aa:	f8df 906c 	ldr.w	r9, [pc, #108]	; 8005118 <psram_do_upgrade+0x98>
+    for(uint32_t pos=0; pos < size; pos += 8) {
+ 80050ae:	2400      	movs	r4, #0
+            oled_show_progress(screen_upgrading, pos*100/size);
+ 80050b0:	f04f 0864 	mov.w	r8, #100	; 0x64
+        uint32_t dest = FIRMWARE_START+pos;
+ 80050b4:	f104 6700 	add.w	r7, r4, #134217728	; 0x8000000
+        if(dest % (4*FLASH_ERASE_SIZE) == 0) {
+ 80050b8:	f3c4 030d 	ubfx	r3, r4, #0, #14
+ 80050bc:	f507 3700 	add.w	r7, r7, #131072	; 0x20000
+ 80050c0:	b933      	cbnz	r3, 80050d0 <psram_do_upgrade+0x50>
+            oled_show_progress(screen_upgrading, pos*100/size);
+ 80050c2:	fb08 f104 	mul.w	r1, r8, r4
+ 80050c6:	4648      	mov	r0, r9
+ 80050c8:	fbb1 f1f5 	udiv	r1, r1, r5
+ 80050cc:	f7fb ff0a 	bl	8000ee4 <oled_show_progress>
+        }
+
+        if(dest % FLASH_ERASE_SIZE == 0) {
+ 80050d0:	f3c7 030b 	ubfx	r3, r7, #0, #12
+ 80050d4:	b923      	cbnz	r3, 80050e0 <psram_do_upgrade+0x60>
+            // page erase as we go
+            rv = flash_page_erase(dest);
+ 80050d6:	4638      	mov	r0, r7
+ 80050d8:	f008 fb3e 	bl	800d758 <__flash_page_erase_veneer>
+                puts2("erase rv=");
+                puthex2(rv);
+                putchar('\n');
+            }
+#endif
+            ASSERT(rv == 0);
+ 80050dc:	2800      	cmp	r0, #0
+ 80050de:	d1d6      	bne.n	800508e <psram_do_upgrade+0xe>
+        }
+
+        memcpy(&tmp, start+pos, 8);
+ 80050e0:	1932      	adds	r2, r6, r4
+ 80050e2:	5930      	ldr	r0, [r6, r4]
+ 80050e4:	6851      	ldr	r1, [r2, #4]
+ 80050e6:	466b      	mov	r3, sp
+ 80050e8:	c303      	stmia	r3!, {r0, r1}
+        rv = flash_burn(dest, tmp);
+ 80050ea:	4638      	mov	r0, r7
+ 80050ec:	e9dd 2300 	ldrd	r2, r3, [sp]
+ 80050f0:	f008 fb2e 	bl	800d750 <__flash_burn_veneer>
+            puts2(" addr=");
+            puthex8(dest);
+            putchar('\n');
+        }
+#endif
+        ASSERT(rv == 0);
+ 80050f4:	2800      	cmp	r0, #0
+ 80050f6:	d1ca      	bne.n	800508e <psram_do_upgrade+0xe>
+    for(uint32_t pos=0; pos < size; pos += 8) {
+ 80050f8:	3408      	adds	r4, #8
+ 80050fa:	42a5      	cmp	r5, r4
+ 80050fc:	d8da      	bhi.n	80050b4 <psram_do_upgrade+0x34>
+    }
+
+    flash_lock();
+}
+ 80050fe:	b003      	add	sp, #12
+ 8005100:	e8bd 43f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, lr}
+    flash_lock();
+ 8005104:	f7fc bf92 	b.w	800202c <flash_lock>
+ 8005108:	0800e466 	.word	0x0800e466
+ 800510c:	907ff800 	.word	0x907ff800
+ 8005110:	dbcc8350 	.word	0xdbcc8350
+ 8005114:	bafcfba3 	.word	0xbafcfba3
+ 8005118:	0800e211 	.word	0x0800e211
+
+0800511c <psram_recover_firmware>:
+{
+ 800511c:	b510      	push	{r4, lr}
+    if(    (h->magic1 != RECHDR_MAGIC1)
+ 800511e:	4c1f      	ldr	r4, [pc, #124]	; (800519c <psram_recover_firmware+0x80>)
+ 8005120:	4b1f      	ldr	r3, [pc, #124]	; (80051a0 <psram_recover_firmware+0x84>)
+ 8005122:	6822      	ldr	r2, [r4, #0]
+ 8005124:	429a      	cmp	r2, r3
+{
+ 8005126:	b088      	sub	sp, #32
+    if(    (h->magic1 != RECHDR_MAGIC1)
+ 8005128:	d113      	bne.n	8005152 <psram_recover_firmware+0x36>
+        || (h->magic2 != RECHDR_MAGIC2)
+ 800512a:	68e2      	ldr	r2, [r4, #12]
+ 800512c:	4b1d      	ldr	r3, [pc, #116]	; (80051a4 <psram_recover_firmware+0x88>)
+ 800512e:	429a      	cmp	r2, r3
+ 8005130:	d10f      	bne.n	8005152 <psram_recover_firmware+0x36>
+        || ((uint32_t)h->start < PSRAM_BASE) 
+ 8005132:	6863      	ldr	r3, [r4, #4]
+ 8005134:	f1b3 4f10 	cmp.w	r3, #2415919104	; 0x90000000
+ 8005138:	d30b      	bcc.n	8005152 <psram_recover_firmware+0x36>
+        || ((uint32_t)h->start >= PSRAM_BASE+(PSRAM_SIZE/2)) 
+ 800513a:	6862      	ldr	r2, [r4, #4]
+ 800513c:	4b1a      	ldr	r3, [pc, #104]	; (80051a8 <psram_recover_firmware+0x8c>)
+ 800513e:	429a      	cmp	r2, r3
+ 8005140:	d807      	bhi.n	8005152 <psram_recover_firmware+0x36>
+        || (h->size > FW_MAX_LENGTH_MK4) 
+ 8005142:	68a3      	ldr	r3, [r4, #8]
+ 8005144:	f5b3 1ff0 	cmp.w	r3, #1966080	; 0x1e0000
+ 8005148:	d803      	bhi.n	8005152 <psram_recover_firmware+0x36>
+        || (h->size < FW_MIN_LENGTH)
+ 800514a:	68a3      	ldr	r3, [r4, #8]
+ 800514c:	f5b3 2f80 	cmp.w	r3, #262144	; 0x40000
+ 8005150:	d205      	bcs.n	800515e <psram_recover_firmware+0x42>
+        puts("PSR: nada");
+ 8005152:	4816      	ldr	r0, [pc, #88]	; (80051ac <psram_recover_firmware+0x90>)
+        puts("PSR: version");
+ 8005154:	f7ff fe5c 	bl	8004e10 <puts>
+}
+ 8005158:	2000      	movs	r0, #0
+ 800515a:	b008      	add	sp, #32
+ 800515c:	bd10      	pop	{r4, pc}
+    bool ok = verify_firmware_in_ram(h->start, h->size, world_check);
+ 800515e:	6860      	ldr	r0, [r4, #4]
+ 8005160:	68a1      	ldr	r1, [r4, #8]
+ 8005162:	466a      	mov	r2, sp
+ 8005164:	f7fc fd8c 	bl	8001c80 <verify_firmware_in_ram>
+    if(!ok) {
+ 8005168:	b908      	cbnz	r0, 800516e <psram_recover_firmware+0x52>
+        puts("PSR: !check");
+ 800516a:	4811      	ldr	r0, [pc, #68]	; (80051b0 <psram_recover_firmware+0x94>)
+ 800516c:	e7f2      	b.n	8005154 <psram_recover_firmware+0x38>
+    if(!verify_world_checksum(world_check)) {
+ 800516e:	4668      	mov	r0, sp
+ 8005170:	f7fc fdda 	bl	8001d28 <verify_world_checksum>
+ 8005174:	b908      	cbnz	r0, 800517a <psram_recover_firmware+0x5e>
+        puts("PSR: version");
+ 8005176:	480f      	ldr	r0, [pc, #60]	; (80051b4 <psram_recover_firmware+0x98>)
+ 8005178:	e7ec      	b.n	8005154 <psram_recover_firmware+0x38>
+    psram_do_upgrade(h->start, h->size);
+ 800517a:	6860      	ldr	r0, [r4, #4]
+ 800517c:	68a1      	ldr	r1, [r4, #8]
+ 800517e:	f7ff ff7f 	bl	8005080 <psram_do_upgrade>
+ 8005182:	f3bf 8f4f 	dsb	sy
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 8005186:	490c      	ldr	r1, [pc, #48]	; (80051b8 <psram_recover_firmware+0x9c>)
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 8005188:	4b0c      	ldr	r3, [pc, #48]	; (80051bc <psram_recover_firmware+0xa0>)
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 800518a:	68ca      	ldr	r2, [r1, #12]
+ 800518c:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 8005190:	4313      	orrs	r3, r2
+ 8005192:	60cb      	str	r3, [r1, #12]
+ 8005194:	f3bf 8f4f 	dsb	sy
+    __NOP();
+ 8005198:	bf00      	nop
+  for(;;)                                                           /* wait until reset */
+ 800519a:	e7fd      	b.n	8005198 <psram_recover_firmware+0x7c>
+ 800519c:	907ff800 	.word	0x907ff800
+ 80051a0:	dbcc8350 	.word	0xdbcc8350
+ 80051a4:	bafcfba3 	.word	0xbafcfba3
+ 80051a8:	903fffff 	.word	0x903fffff
+ 80051ac:	0800e7f5 	.word	0x0800e7f5
+ 80051b0:	0800e7ff 	.word	0x0800e7ff
+ 80051b4:	0800e80b 	.word	0x0800e80b
+ 80051b8:	e000ed00 	.word	0xe000ed00
+ 80051bc:	05fa0004 	.word	0x05fa0004
+
+080051c0 <sdcard_light>:
+
+// sdcard_light()
+//
+    void inline
+sdcard_light(bool on)
+{
+ 80051c0:	4602      	mov	r2, r0
+    HAL_GPIO_WritePin(GPIOC, GPIO_PIN_7, !!on);    // turn LED off
+ 80051c2:	2180      	movs	r1, #128	; 0x80
+ 80051c4:	4801      	ldr	r0, [pc, #4]	; (80051cc <sdcard_light+0xc>)
+ 80051c6:	f7fc b8b3 	b.w	8001330 <HAL_GPIO_WritePin>
+ 80051ca:	bf00      	nop
+ 80051cc:	48000800 	.word	0x48000800
+
+080051d0 <sdcard_is_inserted>:
+
+// sdcard_is_inserted()
+//
+    bool
+sdcard_is_inserted(void)
+{
+ 80051d0:	b508      	push	{r3, lr}
+#ifdef FOR_Q1_ONLY
+    return !HAL_GPIO_ReadPin(GPIOD, GPIO_PIN_3);        // PD3 - inserted when low (Q)
+#else
+    return !!HAL_GPIO_ReadPin(GPIOC, GPIO_PIN_13);      // PC13 - inserted when high (Mk4)
+ 80051d2:	f44f 5100 	mov.w	r1, #8192	; 0x2000
+ 80051d6:	4803      	ldr	r0, [pc, #12]	; (80051e4 <sdcard_is_inserted+0x14>)
+ 80051d8:	f7fc f8a4 	bl	8001324 <HAL_GPIO_ReadPin>
+#endif
+}
+ 80051dc:	3800      	subs	r0, #0
+ 80051de:	bf18      	it	ne
+ 80051e0:	2001      	movne	r0, #1
+ 80051e2:	bd08      	pop	{r3, pc}
+ 80051e4:	48000800 	.word	0x48000800
+
+080051e8 <sdcard_try_file>:
+
+// sdcard_try_file()
+//
+    void
+sdcard_try_file(uint32_t blk_pos)
+{
+ 80051e8:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 80051ec:	4606      	mov	r6, r0
+ 80051ee:	f5ad 7d0a 	sub.w	sp, sp, #552	; 0x228
+    oled_show(screen_verify);
+ 80051f2:	4832      	ldr	r0, [pc, #200]	; (80052bc <sdcard_try_file+0xd4>)
+    uint8_t *ps = (uint8_t *)PSRAM_BASE;
+    //uint8_t buf[512*8];      // half of all our SRAM 0x00002000
+    uint8_t buf[512];      // slower, but works.
+    
+    for(uint32_t off = 0; off < FW_MAX_LENGTH_MK4; off += sizeof(buf)) {
+        int rv = HAL_SD_ReadBlocks(&hsd, buf, blk_pos+(off/512), sizeof(buf)/512, 60000);
+ 80051f4:	f8df 80e4 	ldr.w	r8, [pc, #228]	; 80052dc <sdcard_try_file+0xf4>
+    oled_show(screen_verify);
+ 80051f8:	f7fb fe32 	bl	8000e60 <oled_show>
+    for(uint32_t off = 0; off < FW_MAX_LENGTH_MK4; off += sizeof(buf)) {
+ 80051fc:	2500      	movs	r5, #0
+        int rv = HAL_SD_ReadBlocks(&hsd, buf, blk_pos+(off/512), sizeof(buf)/512, 60000);
+ 80051fe:	f64e 2760 	movw	r7, #60000	; 0xea60
+ 8005202:	9700      	str	r7, [sp, #0]
+ 8005204:	2301      	movs	r3, #1
+ 8005206:	eb06 2255 	add.w	r2, r6, r5, lsr #9
+ 800520a:	a90a      	add	r1, sp, #40	; 0x28
+ 800520c:	4640      	mov	r0, r8
+ 800520e:	f006 fe4d 	bl	800beac <HAL_SD_ReadBlocks>
+        if(rv != HAL_OK) {
+ 8005212:	4604      	mov	r4, r0
+ 8005214:	b130      	cbz	r0, 8005224 <sdcard_try_file+0x3c>
+            puts("long read fail");
+ 8005216:	482a      	ldr	r0, [pc, #168]	; (80052c0 <sdcard_try_file+0xd8>)
+
+    // Check we have the **right** firmware, based on the world check sum
+    // but don't set the light at this point.
+    // - this includes check over bootrom (ourselves)
+    if(!verify_world_checksum(world_check)) {
+        puts("wrong world");
+ 8005218:	f7ff fdfa 	bl	8004e10 <puts>
+    // Do the upgrade, using PSRAM data.
+    psram_do_upgrade(start, len);
+
+    // done
+    NVIC_SystemReset();
+}
+ 800521c:	f50d 7d0a 	add.w	sp, sp, #552	; 0x228
+ 8005220:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+        memcpy(ps + off, buf, sizeof(buf));
+ 8005224:	f105 4010 	add.w	r0, r5, #2415919104	; 0x90000000
+ 8005228:	f44f 7200 	mov.w	r2, #512	; 0x200
+ 800522c:	a90a      	add	r1, sp, #40	; 0x28
+    for(uint32_t off = 0; off < FW_MAX_LENGTH_MK4; off += sizeof(buf)) {
+ 800522e:	f505 7500 	add.w	r5, r5, #512	; 0x200
+        memcpy(ps + off, buf, sizeof(buf));
+ 8005232:	f008 fa29 	bl	800d688 <memcpy>
+    for(uint32_t off = 0; off < FW_MAX_LENGTH_MK4; off += sizeof(buf)) {
+ 8005236:	f5b5 1ff0 	cmp.w	r5, #1966080	; 0x1e0000
+ 800523a:	d1e2      	bne.n	8005202 <sdcard_try_file+0x1a>
+    for(int idx=0; idx<file->targets; idx++) {
+ 800523c:	f04f 4310 	mov.w	r3, #2415919104	; 0x90000000
+            if(elem->addr == FIRMWARE_START) {
+ 8005240:	4d20      	ldr	r5, [pc, #128]	; (80052c4 <sdcard_try_file+0xdc>)
+    for(int idx=0; idx<file->targets; idx++) {
+ 8005242:	7a99      	ldrb	r1, [r3, #10]
+ 8005244:	4620      	mov	r0, r4
+    ptr += sizeof(DFUFile_t);
+ 8005246:	330b      	adds	r3, #11
+    for(int idx=0; idx<file->targets; idx++) {
+ 8005248:	4288      	cmp	r0, r1
+ 800524a:	db01      	blt.n	8005250 <sdcard_try_file+0x68>
+    puts("DFU parse fail");
+ 800524c:	481e      	ldr	r0, [pc, #120]	; (80052c8 <sdcard_try_file+0xe0>)
+ 800524e:	e7e3      	b.n	8005218 <sdcard_try_file+0x30>
+        for(int ei=0; ei<target->elements; ei++) {
+ 8005250:	f8d3 610e 	ldr.w	r6, [r3, #270]	; 0x10e
+ 8005254:	2200      	movs	r2, #0
+        ptr += sizeof(DFUTarget_t);
+ 8005256:	f503 7389 	add.w	r3, r3, #274	; 0x112
+        for(int ei=0; ei<target->elements; ei++) {
+ 800525a:	42b2      	cmp	r2, r6
+ 800525c:	d101      	bne.n	8005262 <sdcard_try_file+0x7a>
+    for(int idx=0; idx<file->targets; idx++) {
+ 800525e:	3001      	adds	r0, #1
+ 8005260:	e7f2      	b.n	8005248 <sdcard_try_file+0x60>
+            ptr += sizeof(DFUElement_t);
+ 8005262:	461c      	mov	r4, r3
+            if(elem->addr == FIRMWARE_START) {
+ 8005264:	f854 7b08 	ldr.w	r7, [r4], #8
+ 8005268:	42af      	cmp	r7, r5
+ 800526a:	d110      	bne.n	800528e <sdcard_try_file+0xa6>
+                *target_size = elem->size;
+ 800526c:	685d      	ldr	r5, [r3, #4]
+    bool ok = verify_firmware_in_ram(start, len, world_check);
+ 800526e:	aa02      	add	r2, sp, #8
+ 8005270:	4629      	mov	r1, r5
+ 8005272:	4620      	mov	r0, r4
+ 8005274:	f7fc fd04 	bl	8001c80 <verify_firmware_in_ram>
+    if(!ok) return;
+ 8005278:	2800      	cmp	r0, #0
+ 800527a:	d0cf      	beq.n	800521c <sdcard_try_file+0x34>
+    puts("good firmware");
+ 800527c:	4813      	ldr	r0, [pc, #76]	; (80052cc <sdcard_try_file+0xe4>)
+ 800527e:	f7ff fdc7 	bl	8004e10 <puts>
+    if(!verify_world_checksum(world_check)) {
+ 8005282:	a802      	add	r0, sp, #8
+ 8005284:	f7fc fd50 	bl	8001d28 <verify_world_checksum>
+ 8005288:	b920      	cbnz	r0, 8005294 <sdcard_try_file+0xac>
+        puts("wrong world");
+ 800528a:	4811      	ldr	r0, [pc, #68]	; (80052d0 <sdcard_try_file+0xe8>)
+ 800528c:	e7c4      	b.n	8005218 <sdcard_try_file+0x30>
+        for(int ei=0; ei<target->elements; ei++) {
+ 800528e:	3201      	adds	r2, #1
+            ptr += sizeof(DFUElement_t);
+ 8005290:	4623      	mov	r3, r4
+ 8005292:	e7e2      	b.n	800525a <sdcard_try_file+0x72>
+    sdcard_light(false);
+ 8005294:	2000      	movs	r0, #0
+ 8005296:	f7ff ff93 	bl	80051c0 <sdcard_light>
+    psram_do_upgrade(start, len);
+ 800529a:	4629      	mov	r1, r5
+ 800529c:	4620      	mov	r0, r4
+ 800529e:	f7ff feef 	bl	8005080 <psram_do_upgrade>
+ 80052a2:	f3bf 8f4f 	dsb	sy
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 80052a6:	490b      	ldr	r1, [pc, #44]	; (80052d4 <sdcard_try_file+0xec>)
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 80052a8:	4b0b      	ldr	r3, [pc, #44]	; (80052d8 <sdcard_try_file+0xf0>)
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 80052aa:	68ca      	ldr	r2, [r1, #12]
+ 80052ac:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 80052b0:	4313      	orrs	r3, r2
+ 80052b2:	60cb      	str	r3, [r1, #12]
+ 80052b4:	f3bf 8f4f 	dsb	sy
+    __NOP();
+ 80052b8:	bf00      	nop
+  for(;;)                                                           /* wait until reset */
+ 80052ba:	e7fd      	b.n	80052b8 <sdcard_try_file+0xd0>
+ 80052bc:	0800e2c8 	.word	0x0800e2c8
+ 80052c0:	0800e834 	.word	0x0800e834
+ 80052c4:	08020000 	.word	0x08020000
+ 80052c8:	0800e843 	.word	0x0800e843
+ 80052cc:	0800e852 	.word	0x0800e852
+ 80052d0:	0800e860 	.word	0x0800e860
+ 80052d4:	e000ed00 	.word	0xe000ed00
+ 80052d8:	05fa0004 	.word	0x05fa0004
+ 80052dc:	2009e220 	.word	0x2009e220
+
+080052e0 <sdcard_search>:
+
+// sdcard_search()
+//
+    void
+sdcard_search(void)
+{
+ 80052e0:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+    oled_show(screen_search);
+ 80052e4:	4854      	ldr	r0, [pc, #336]	; (8005438 <sdcard_search+0x158>)
+{
+ 80052e6:	f5ad 7d04 	sub.w	sp, sp, #528	; 0x210
+    oled_show(screen_search);
+ 80052ea:	f7fb fdb9 	bl	8000e60 <oled_show>
+
+    if(!sdcard_is_inserted()) return;
+ 80052ee:	f7ff ff6f 	bl	80051d0 <sdcard_is_inserted>
+ 80052f2:	2800      	cmp	r0, #0
+ 80052f4:	d07a      	beq.n	80053ec <sdcard_search+0x10c>
+    __HAL_RCC_SDMMC1_CLK_ENABLE();
+ 80052f6:	4f51      	ldr	r7, [pc, #324]	; (800543c <sdcard_search+0x15c>)
+
+    uint32_t num_blocks;
+
+    // open card (power it) and get details, do setup
+    puts2("sdcard_search: ");
+ 80052f8:	4851      	ldr	r0, [pc, #324]	; (8005440 <sdcard_search+0x160>)
+    {   GPIO_InitTypeDef setup = {
+ 80052fa:	4c52      	ldr	r4, [pc, #328]	; (8005444 <sdcard_search+0x164>)
+    puts2("sdcard_search: ");
+ 80052fc:	f7ff fcfa 	bl	8004cf4 <puts2>
+    __HAL_RCC_SDMMC1_CLK_ENABLE();
+ 8005300:	6cfb      	ldr	r3, [r7, #76]	; 0x4c
+ 8005302:	f443 0380 	orr.w	r3, r3, #4194304	; 0x400000
+ 8005306:	64fb      	str	r3, [r7, #76]	; 0x4c
+ 8005308:	6cfb      	ldr	r3, [r7, #76]	; 0x4c
+ 800530a:	f403 0380 	and.w	r3, r3, #4194304	; 0x400000
+ 800530e:	9303      	str	r3, [sp, #12]
+ 8005310:	9b03      	ldr	r3, [sp, #12]
+    {   GPIO_InitTypeDef setup = {
+ 8005312:	cc0f      	ldmia	r4!, {r0, r1, r2, r3}
+ 8005314:	ad04      	add	r5, sp, #16
+ 8005316:	c50f      	stmia	r5!, {r0, r1, r2, r3}
+ 8005318:	f854 3b04 	ldr.w	r3, [r4], #4
+ 800531c:	602b      	str	r3, [r5, #0]
+        HAL_GPIO_Init(GPIOC, &setup);
+ 800531e:	484a      	ldr	r0, [pc, #296]	; (8005448 <sdcard_search+0x168>)
+ 8005320:	a904      	add	r1, sp, #16
+ 8005322:	f7fb fe8b 	bl	800103c <HAL_GPIO_Init>
+    {   GPIO_InitTypeDef setup = {
+ 8005326:	cc0f      	ldmia	r4!, {r0, r1, r2, r3}
+ 8005328:	ae04      	add	r6, sp, #16
+ 800532a:	c60f      	stmia	r6!, {r0, r1, r2, r3}
+ 800532c:	6823      	ldr	r3, [r4, #0]
+ 800532e:	602b      	str	r3, [r5, #0]
+        HAL_GPIO_Init(GPIOD, &setup);
+ 8005330:	a904      	add	r1, sp, #16
+ 8005332:	4846      	ldr	r0, [pc, #280]	; (800544c <sdcard_search+0x16c>)
+    memset(&hsd, 0, sizeof(SD_HandleTypeDef));
+ 8005334:	4d46      	ldr	r5, [pc, #280]	; (8005450 <sdcard_search+0x170>)
+        HAL_GPIO_Init(GPIOD, &setup);
+ 8005336:	f7fb fe81 	bl	800103c <HAL_GPIO_Init>
+    __HAL_RCC_SDMMC1_FORCE_RESET();
+ 800533a:	6afb      	ldr	r3, [r7, #44]	; 0x2c
+ 800533c:	f443 0380 	orr.w	r3, r3, #4194304	; 0x400000
+ 8005340:	62fb      	str	r3, [r7, #44]	; 0x2c
+    __HAL_RCC_SDMMC1_RELEASE_RESET();
+ 8005342:	6afb      	ldr	r3, [r7, #44]	; 0x2c
+ 8005344:	f423 0380 	bic.w	r3, r3, #4194304	; 0x400000
+ 8005348:	62fb      	str	r3, [r7, #44]	; 0x2c
+    sdcard_setup();
+    delay_ms(100);
+ 800534a:	2064      	movs	r0, #100	; 0x64
+ 800534c:	f7fe faea 	bl	8003924 <delay_ms>
+    memset(&hsd, 0, sizeof(SD_HandleTypeDef));
+ 8005350:	2280      	movs	r2, #128	; 0x80
+ 8005352:	2100      	movs	r1, #0
+ 8005354:	4628      	mov	r0, r5
+ 8005356:	f008 f9bf 	bl	800d6d8 <memset>
+    puts2("sdcard_probe: ");
+ 800535a:	483e      	ldr	r0, [pc, #248]	; (8005454 <sdcard_search+0x174>)
+ 800535c:	f7ff fcca 	bl	8004cf4 <puts2>
+    hsd.Init.ClockEdge = SDMMC_CLOCK_EDGE_RISING;
+ 8005360:	4a3d      	ldr	r2, [pc, #244]	; (8005458 <sdcard_search+0x178>)
+ 8005362:	2300      	movs	r3, #0
+ 8005364:	e9c5 2300 	strd	r2, r3, [r5]
+    hsd.Init.ClockPowerSave = SDMMC_CLOCK_POWER_SAVE_ENABLE;
+ 8005368:	f44f 5280 	mov.w	r2, #4096	; 0x1000
+    hsd.Init.BusWide = SDMMC_BUS_WIDE_1B;
+ 800536c:	e9c5 2302 	strd	r2, r3, [r5, #8]
+    hsd.Init.HardwareFlowControl = SDMMC_HARDWARE_FLOW_CONTROL_DISABLE;
+ 8005370:	612b      	str	r3, [r5, #16]
+    int rv = HAL_SD_Init(&hsd);
+ 8005372:	4628      	mov	r0, r5
+    hsd.Init.ClockDiv = SDMMC_TRANSFER_CLK_DIV;
+ 8005374:	2303      	movs	r3, #3
+ 8005376:	616b      	str	r3, [r5, #20]
+    int rv = HAL_SD_Init(&hsd);
+ 8005378:	f007 fb12 	bl	800c9a0 <HAL_SD_Init>
+    if(rv != HAL_OK) {
+ 800537c:	4604      	mov	r4, r0
+ 800537e:	b130      	cbz	r0, 800538e <sdcard_search+0xae>
+        puts("init fail");
+ 8005380:	4836      	ldr	r0, [pc, #216]	; (800545c <sdcard_search+0x17c>)
+            oled_show_progress(screen_search, pos*100 / num_blocks);
+            sdcard_light(true);
+        }
+    }
+
+}
+ 8005382:	f50d 7d04 	add.w	sp, sp, #528	; 0x210
+ 8005386:	e8bd 41f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, lr}
+        puts("bsize?");
+ 800538a:	f7ff bd41 	b.w	8004e10 <puts>
+    sdcard_light(true);
+ 800538e:	2001      	movs	r0, #1
+ 8005390:	f7ff ff16 	bl	80051c0 <sdcard_light>
+    rv = HAL_SD_ConfigSpeedBusOperation(&hsd, SDMMC_SPEED_MODE_AUTO);
+ 8005394:	4621      	mov	r1, r4
+ 8005396:	4628      	mov	r0, r5
+ 8005398:	f007 fbda 	bl	800cb50 <HAL_SD_ConfigSpeedBusOperation>
+    if(rv != HAL_OK) {
+ 800539c:	b108      	cbz	r0, 80053a2 <sdcard_search+0xc2>
+        puts("speed");
+ 800539e:	4830      	ldr	r0, [pc, #192]	; (8005460 <sdcard_search+0x180>)
+ 80053a0:	e7ef      	b.n	8005382 <sdcard_search+0xa2>
+    rv = HAL_SD_ConfigWideBusOperation(&hsd, SDMMC_BUS_WIDE_4B);
+ 80053a2:	f44f 4180 	mov.w	r1, #16384	; 0x4000
+ 80053a6:	4628      	mov	r0, r5
+ 80053a8:	f007 fa24 	bl	800c7f4 <HAL_SD_ConfigWideBusOperation>
+    if(rv != HAL_OK) {
+ 80053ac:	4604      	mov	r4, r0
+ 80053ae:	b108      	cbz	r0, 80053b4 <sdcard_search+0xd4>
+        puts("wide");
+ 80053b0:	482c      	ldr	r0, [pc, #176]	; (8005464 <sdcard_search+0x184>)
+ 80053b2:	e7e6      	b.n	8005382 <sdcard_search+0xa2>
+    if(hsd.SdCard.BlockSize != 512) {
+ 80053b4:	6d2b      	ldr	r3, [r5, #80]	; 0x50
+ 80053b6:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 80053ba:	d001      	beq.n	80053c0 <sdcard_search+0xe0>
+        puts("bsize?");
+ 80053bc:	482a      	ldr	r0, [pc, #168]	; (8005468 <sdcard_search+0x188>)
+ 80053be:	e7e0      	b.n	8005382 <sdcard_search+0xa2>
+    puts("ok");
+ 80053c0:	482a      	ldr	r0, [pc, #168]	; (800546c <sdcard_search+0x18c>)
+    *num_blocks = hsd.SdCard.BlockNbr;
+ 80053c2:	6cee      	ldr	r6, [r5, #76]	; 0x4c
+        if(memcmp(blk, "DfuSe", 5) == 0) {
+ 80053c4:	4f2a      	ldr	r7, [pc, #168]	; (8005470 <sdcard_search+0x190>)
+            oled_show_progress(screen_search, pos*100 / num_blocks);
+ 80053c6:	f8df 8070 	ldr.w	r8, [pc, #112]	; 8005438 <sdcard_search+0x158>
+    puts("ok");
+ 80053ca:	f7ff fd21 	bl	8004e10 <puts>
+    for(int pos=0; pos<num_blocks; pos += 1) {
+ 80053ce:	42b4      	cmp	r4, r6
+ 80053d0:	d00c      	beq.n	80053ec <sdcard_search+0x10c>
+        int rv = HAL_SD_ReadBlocks(&hsd, blk, pos, 1, 60000);
+ 80053d2:	f64e 2360 	movw	r3, #60000	; 0xea60
+ 80053d6:	9300      	str	r3, [sp, #0]
+ 80053d8:	4622      	mov	r2, r4
+ 80053da:	2301      	movs	r3, #1
+ 80053dc:	a904      	add	r1, sp, #16
+ 80053de:	4628      	mov	r0, r5
+ 80053e0:	f006 fd64 	bl	800beac <HAL_SD_ReadBlocks>
+        if(rv != HAL_OK) {
+ 80053e4:	b130      	cbz	r0, 80053f4 <sdcard_search+0x114>
+            puts("fail read");
+ 80053e6:	4823      	ldr	r0, [pc, #140]	; (8005474 <sdcard_search+0x194>)
+ 80053e8:	f7ff fd12 	bl	8004e10 <puts>
+}
+ 80053ec:	f50d 7d04 	add.w	sp, sp, #528	; 0x210
+ 80053f0:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+        if(memcmp(blk, "DfuSe", 5) == 0) {
+ 80053f4:	2205      	movs	r2, #5
+ 80053f6:	4639      	mov	r1, r7
+ 80053f8:	a804      	add	r0, sp, #16
+ 80053fa:	f008 f935 	bl	800d668 <memcmp>
+ 80053fe:	b9b0      	cbnz	r0, 800542e <sdcard_search+0x14e>
+            puts2("found @ ");
+ 8005400:	481d      	ldr	r0, [pc, #116]	; (8005478 <sdcard_search+0x198>)
+ 8005402:	f7ff fc77 	bl	8004cf4 <puts2>
+            puthex8(pos);
+ 8005406:	4620      	mov	r0, r4
+ 8005408:	f7ff fcd0 	bl	8004dac <puthex8>
+            putchar('\n');
+ 800540c:	200a      	movs	r0, #10
+ 800540e:	f7ff fc85 	bl	8004d1c <putchar>
+            sdcard_try_file(pos);
+ 8005412:	4620      	mov	r0, r4
+ 8005414:	f7ff fee8 	bl	80051e8 <sdcard_try_file>
+            oled_show_progress(screen_search, pos*100 / num_blocks);
+ 8005418:	2164      	movs	r1, #100	; 0x64
+ 800541a:	4640      	mov	r0, r8
+ 800541c:	4361      	muls	r1, r4
+ 800541e:	fbb1 f1f6 	udiv	r1, r1, r6
+ 8005422:	f7fb fd5f 	bl	8000ee4 <oled_show_progress>
+            sdcard_light(true);
+ 8005426:	2001      	movs	r0, #1
+ 8005428:	f7ff feca 	bl	80051c0 <sdcard_light>
+ 800542c:	e001      	b.n	8005432 <sdcard_search+0x152>
+        if(pos % 128 == 0) {
+ 800542e:	0663      	lsls	r3, r4, #25
+ 8005430:	d0f2      	beq.n	8005418 <sdcard_search+0x138>
+    for(int pos=0; pos<num_blocks; pos += 1) {
+ 8005432:	3401      	adds	r4, #1
+ 8005434:	e7cb      	b.n	80053ce <sdcard_search+0xee>
+ 8005436:	bf00      	nop
+ 8005438:	0800e0ff 	.word	0x0800e0ff
+ 800543c:	40021000 	.word	0x40021000
+ 8005440:	0800e86c 	.word	0x0800e86c
+ 8005444:	0800e8d4 	.word	0x0800e8d4
+ 8005448:	48000800 	.word	0x48000800
+ 800544c:	48000c00 	.word	0x48000c00
+ 8005450:	2009e220 	.word	0x2009e220
+ 8005454:	0800e87c 	.word	0x0800e87c
+ 8005458:	50062400 	.word	0x50062400
+ 800545c:	0800e88b 	.word	0x0800e88b
+ 8005460:	0800e895 	.word	0x0800e895
+ 8005464:	0800e89b 	.word	0x0800e89b
+ 8005468:	0800e8a0 	.word	0x0800e8a0
+ 800546c:	0800e8a7 	.word	0x0800e8a7
+ 8005470:	0800e8b4 	.word	0x0800e8b4
+ 8005474:	0800e8aa 	.word	0x0800e8aa
+ 8005478:	0800e8ba 	.word	0x0800e8ba
+
+0800547c <sdcard_recovery>:
+
+// sdcard_recovery()
+//
+    void
+sdcard_recovery(void)
+{
+ 800547c:	b508      	push	{r3, lr}
+    // Use SDCard to recover. Must be precise version they tried to
+    // install before, and will be slow AF.
+
+    puts("Recovery mode.");
+ 800547e:	480b      	ldr	r0, [pc, #44]	; (80054ac <sdcard_recovery+0x30>)
+    while(1) {
+        // .. need them to insert a card
+        
+        sdcard_light(false);
+        while(!sdcard_is_inserted()) {
+            oled_show(screen_recovery);
+ 8005480:	4c0b      	ldr	r4, [pc, #44]	; (80054b0 <sdcard_recovery+0x34>)
+    puts("Recovery mode.");
+ 8005482:	f7ff fcc5 	bl	8004e10 <puts>
+        sdcard_light(false);
+ 8005486:	2000      	movs	r0, #0
+ 8005488:	f7ff fe9a 	bl	80051c0 <sdcard_light>
+        while(!sdcard_is_inserted()) {
+ 800548c:	f7ff fea0 	bl	80051d0 <sdcard_is_inserted>
+ 8005490:	b128      	cbz	r0, 800549e <sdcard_recovery+0x22>
+            delay_ms(200);
+        }
+            
+        // look for binary, will reset system if successful
+        sdcard_light(true);
+ 8005492:	2001      	movs	r0, #1
+ 8005494:	f7ff fe94 	bl	80051c0 <sdcard_light>
+        sdcard_search();
+ 8005498:	f7ff ff22 	bl	80052e0 <sdcard_search>
+        sdcard_light(false);
+ 800549c:	e7f3      	b.n	8005486 <sdcard_recovery+0xa>
+            oled_show(screen_recovery);
+ 800549e:	4620      	mov	r0, r4
+ 80054a0:	f7fb fcde 	bl	8000e60 <oled_show>
+            delay_ms(200);
+ 80054a4:	20c8      	movs	r0, #200	; 0xc8
+ 80054a6:	f7fe fa3d 	bl	8003924 <delay_ms>
+ 80054aa:	e7ef      	b.n	800548c <sdcard_recovery+0x10>
+ 80054ac:	0800e8c3 	.word	0x0800e8c3
+ 80054b0:	0800dcfe 	.word	0x0800dcfe
+
+080054b4 <HAL_HASHEx_SHA256_Accmlt>:
+#include <string.h>
+
+// so we don't need stm32l4xx_hal_hash_ex.c
+HAL_StatusTypeDef HAL_HASHEx_SHA256_Accmlt(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size)
+{
+  return HASH_Accumulate(hhash, pInBuffer, Size,HASH_ALGOSELECTION_SHA256);
+ 80054b4:	4b01      	ldr	r3, [pc, #4]	; (80054bc <HAL_HASHEx_SHA256_Accmlt+0x8>)
+ 80054b6:	f005 ba41 	b.w	800a93c <HASH_Accumulate>
+ 80054ba:	bf00      	nop
+ 80054bc:	00040080 	.word	0x00040080
+
+080054c0 <HAL_HASHEx_SHA256_Start>:
+}
+
+HAL_StatusTypeDef HAL_HASHEx_SHA256_Start(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size, uint8_t* pOutBuffer, uint32_t Timeout)
+{
+ 80054c0:	b513      	push	{r0, r1, r4, lr}
+  return HASH_Start(hhash, pInBuffer, Size, pOutBuffer, Timeout, HASH_ALGOSELECTION_SHA256);
+ 80054c2:	4c04      	ldr	r4, [pc, #16]	; (80054d4 <HAL_HASHEx_SHA256_Start+0x14>)
+ 80054c4:	9401      	str	r4, [sp, #4]
+ 80054c6:	9c04      	ldr	r4, [sp, #16]
+ 80054c8:	9400      	str	r4, [sp, #0]
+ 80054ca:	f005 f993 	bl	800a7f4 <HASH_Start>
+}
+ 80054ce:	b002      	add	sp, #8
+ 80054d0:	bd10      	pop	{r4, pc}
+ 80054d2:	bf00      	nop
+ 80054d4:	00040080 	.word	0x00040080
+
+080054d8 <HAL_HMACEx_SHA256_Start>:
+
+HAL_StatusTypeDef HAL_HMACEx_SHA256_Start(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size, uint8_t* pOutBuffer, uint32_t Timeout)
+{
+ 80054d8:	b513      	push	{r0, r1, r4, lr}
+  return HMAC_Start(hhash, pInBuffer, Size, pOutBuffer, Timeout, HASH_ALGOSELECTION_SHA256);
+ 80054da:	4c04      	ldr	r4, [pc, #16]	; (80054ec <HAL_HMACEx_SHA256_Start+0x14>)
+ 80054dc:	9401      	str	r4, [sp, #4]
+ 80054de:	9c04      	ldr	r4, [sp, #16]
+ 80054e0:	9400      	str	r4, [sp, #0]
+ 80054e2:	f005 fbc9 	bl	800ac78 <HMAC_Start>
+}
+ 80054e6:	b002      	add	sp, #8
+ 80054e8:	bd10      	pop	{r4, pc}
+ 80054ea:	bf00      	nop
+ 80054ec:	00040080 	.word	0x00040080
+
+080054f0 <sha256_init>:
+
+void sha256_init(SHA256_CTX *ctx)
+{
+ 80054f0:	b510      	push	{r4, lr}
+    memset(ctx, 0, sizeof(SHA256_CTX));
+ 80054f2:	2248      	movs	r2, #72	; 0x48
+{
+ 80054f4:	4604      	mov	r4, r0
+    memset(ctx, 0, sizeof(SHA256_CTX));
+ 80054f6:	2100      	movs	r1, #0
+ 80054f8:	3004      	adds	r0, #4
+ 80054fa:	f008 f8ed 	bl	800d6d8 <memset>
+
+#if 1
+    ctx->num_pending = 0;
+    ctx->hh.Init.DataType = HASH_DATATYPE_8B;
+ 80054fe:	2320      	movs	r3, #32
+ 8005500:	6023      	str	r3, [r4, #0]
+    HAL_HASH_Init(&ctx->hh);
+ 8005502:	4620      	mov	r0, r4
+    __HAL_HASH_RESET_MDMAT();
+
+    MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT,
+            HASH_ALGOSELECTION_SHA256 | HASH_CR_INIT);
+#endif
+}
+ 8005504:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+    HAL_HASH_Init(&ctx->hh);
+ 8005508:	f005 b802 	b.w	800a510 <HAL_HASH_Init>
+
+0800550c <sha256_update>:
+
+void sha256_update(SHA256_CTX *ctx, const uint8_t data[], uint32_t len)
+{
+ 800550c:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+    HAL_StatusTypeDef rv;
+
+    // clear out any pending bytes
+    if(ctx->num_pending + len >= 4) {
+ 800550e:	f890 3048 	ldrb.w	r3, [r0, #72]	; 0x48
+ 8005512:	4413      	add	r3, r2
+ 8005514:	2b03      	cmp	r3, #3
+{
+ 8005516:	4605      	mov	r5, r0
+ 8005518:	460e      	mov	r6, r1
+ 800551a:	4614      	mov	r4, r2
+    if(ctx->num_pending + len >= 4) {
+ 800551c:	d818      	bhi.n	8005550 <sha256_update+0x44>
+        }
+    }
+
+    // write full blocks
+    uint32_t blocks = len / 4;
+    if(blocks) {
+ 800551e:	2c03      	cmp	r4, #3
+ 8005520:	d926      	bls.n	8005570 <sha256_update+0x64>
+#if 1
+        rv = HAL_HASHEx_SHA256_Accumulate(&ctx->hh, (uint8_t *)data, blocks*4);
+ 8005522:	f024 0703 	bic.w	r7, r4, #3
+ 8005526:	463a      	mov	r2, r7
+ 8005528:	4631      	mov	r1, r6
+ 800552a:	4628      	mov	r0, r5
+ 800552c:	f7ff ffc2 	bl	80054b4 <HAL_HASHEx_SHA256_Accmlt>
+        ASSERT(rv == HAL_OK);
+ 8005530:	b9c8      	cbnz	r0, 8005566 <sha256_update+0x5a>
+            uint32_t    tmp;
+            memcpy(&tmp, data, 4);
+            HASH->DIN = tmp;
+        }
+#endif
+        len -= blocks*4;
+ 8005532:	f004 0403 	and.w	r4, r4, #3
+        data += blocks*4;
+ 8005536:	443e      	add	r6, r7
+ 8005538:	e01a      	b.n	8005570 <sha256_update+0x64>
+            ctx->pending[ctx->num_pending++] = *data;
+ 800553a:	1c5a      	adds	r2, r3, #1
+ 800553c:	b2d2      	uxtb	r2, r2
+ 800553e:	f885 2048 	strb.w	r2, [r5, #72]	; 0x48
+ 8005542:	442b      	add	r3, r5
+ 8005544:	f816 1b01 	ldrb.w	r1, [r6], #1
+ 8005548:	f883 1044 	strb.w	r1, [r3, #68]	; 0x44
+            if(!len) break;
+ 800554c:	3c01      	subs	r4, #1
+ 800554e:	d00d      	beq.n	800556c <sha256_update+0x60>
+        while(ctx->num_pending != 4) {
+ 8005550:	f895 3048 	ldrb.w	r3, [r5, #72]	; 0x48
+ 8005554:	2b04      	cmp	r3, #4
+ 8005556:	d1f0      	bne.n	800553a <sha256_update+0x2e>
+            rv = HAL_HASHEx_SHA256_Accumulate(&ctx->hh, ctx->pending, 4);
+ 8005558:	2204      	movs	r2, #4
+ 800555a:	f105 0144 	add.w	r1, r5, #68	; 0x44
+ 800555e:	4628      	mov	r0, r5
+ 8005560:	f7ff ffa8 	bl	80054b4 <HAL_HASHEx_SHA256_Accmlt>
+            ASSERT(rv == HAL_OK);
+ 8005564:	b140      	cbz	r0, 8005578 <sha256_update+0x6c>
+ 8005566:	480b      	ldr	r0, [pc, #44]	; (8005594 <sha256_update+0x88>)
+ 8005568:	f7fb fa6e 	bl	8000a48 <fatal_error>
+        if(ctx->num_pending == 4) {
+ 800556c:	2a04      	cmp	r2, #4
+ 800556e:	d0f3      	beq.n	8005558 <sha256_update+0x4c>
+ 8005570:	4434      	add	r4, r6
+    }
+
+    // save runt for later
+    ASSERT(len <= 3);
+    while(len) {
+ 8005572:	42b4      	cmp	r4, r6
+ 8005574:	d103      	bne.n	800557e <sha256_update+0x72>
+        ctx->pending[ctx->num_pending++] = *data;
+        data++;
+        len--;
+    }
+}
+ 8005576:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+            ctx->num_pending = 0;
+ 8005578:	f885 0048 	strb.w	r0, [r5, #72]	; 0x48
+ 800557c:	e7cf      	b.n	800551e <sha256_update+0x12>
+        ctx->pending[ctx->num_pending++] = *data;
+ 800557e:	f895 3048 	ldrb.w	r3, [r5, #72]	; 0x48
+ 8005582:	1c5a      	adds	r2, r3, #1
+ 8005584:	f885 2048 	strb.w	r2, [r5, #72]	; 0x48
+ 8005588:	442b      	add	r3, r5
+ 800558a:	f816 2b01 	ldrb.w	r2, [r6], #1
+ 800558e:	f883 2044 	strb.w	r2, [r3, #68]	; 0x44
+        len--;
+ 8005592:	e7ee      	b.n	8005572 <sha256_update+0x66>
+ 8005594:	0800e466 	.word	0x0800e466
+
+08005598 <sha256_final>:
+
+void sha256_final(SHA256_CTX *ctx, uint8_t digest[32])
+{
+ 8005598:	b513      	push	{r0, r1, r4, lr}
+    // Do final 0-3 bytes, pad and return digest.
+#if 1
+    HAL_StatusTypeDef rv = HAL_HASHEx_SHA256_Start(&ctx->hh,
+ 800559a:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 800559e:	9200      	str	r2, [sp, #0]
+{
+ 80055a0:	460b      	mov	r3, r1
+    HAL_StatusTypeDef rv = HAL_HASHEx_SHA256_Start(&ctx->hh,
+ 80055a2:	f890 2048 	ldrb.w	r2, [r0, #72]	; 0x48
+ 80055a6:	f100 0144 	add.w	r1, r0, #68	; 0x44
+ 80055aa:	f7ff ff89 	bl	80054c0 <HAL_HASHEx_SHA256_Start>
+                                ctx->pending, ctx->num_pending, digest, HAL_MAX_DELAY);
+    ASSERT(rv == HAL_OK);
+ 80055ae:	b110      	cbz	r0, 80055b6 <sha256_final+0x1e>
+ 80055b0:	4802      	ldr	r0, [pc, #8]	; (80055bc <sha256_final+0x24>)
+ 80055b2:	f7fb fa49 	bl	8000a48 <fatal_error>
+    tmp = __REV(HASH_DIGEST->HR[6]);
+    memcpy(out, &tmp, 4); out += 4;
+    tmp = __REV(HASH_DIGEST->HR[7]);
+    memcpy(out, &tmp, 4);
+#endif
+}
+ 80055b6:	b002      	add	sp, #8
+ 80055b8:	bd10      	pop	{r4, pc}
+ 80055ba:	bf00      	nop
+ 80055bc:	0800e466 	.word	0x0800e466
+
+080055c0 <sha256_single>:
+//
+// single-shot version (best)
+//
+    void
+sha256_single(const uint8_t data[], uint32_t len, uint8_t digest[32])
+{
+ 80055c0:	b530      	push	{r4, r5, lr}
+ 80055c2:	b097      	sub	sp, #92	; 0x5c
+ 80055c4:	4604      	mov	r4, r0
+ 80055c6:	460d      	mov	r5, r1
+ 80055c8:	9203      	str	r2, [sp, #12]
+    HASH_HandleTypeDef  hh = {0};
+ 80055ca:	2100      	movs	r1, #0
+ 80055cc:	2240      	movs	r2, #64	; 0x40
+ 80055ce:	a806      	add	r0, sp, #24
+ 80055d0:	f008 f882 	bl	800d6d8 <memset>
+
+    hh.Init.DataType = HASH_DATATYPE_8B;
+ 80055d4:	2220      	movs	r2, #32
+
+    HAL_HASH_Init(&hh);
+ 80055d6:	a805      	add	r0, sp, #20
+    hh.Init.DataType = HASH_DATATYPE_8B;
+ 80055d8:	9205      	str	r2, [sp, #20]
+    HAL_HASH_Init(&hh);
+ 80055da:	f004 ff99 	bl	800a510 <HAL_HASH_Init>
+
+    // It's called "Start" but it handles the runt packet, so really can only
+    // be used once at end of message, or for whole message.
+    HAL_StatusTypeDef rv = HAL_HASHEx_SHA256_Start(&hh, (uint8_t *)data, len,
+ 80055de:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 80055e2:	9200      	str	r2, [sp, #0]
+ 80055e4:	9b03      	ldr	r3, [sp, #12]
+ 80055e6:	462a      	mov	r2, r5
+ 80055e8:	4621      	mov	r1, r4
+ 80055ea:	a805      	add	r0, sp, #20
+ 80055ec:	f7ff ff68 	bl	80054c0 <HAL_HASHEx_SHA256_Start>
+                                                    digest, HAL_MAX_DELAY);
+    ASSERT(rv == HAL_OK);
+ 80055f0:	b110      	cbz	r0, 80055f8 <sha256_single+0x38>
+ 80055f2:	4802      	ldr	r0, [pc, #8]	; (80055fc <sha256_single+0x3c>)
+ 80055f4:	f7fb fa28 	bl	8000a48 <fatal_error>
+}
+ 80055f8:	b017      	add	sp, #92	; 0x5c
+ 80055fa:	bd30      	pop	{r4, r5, pc}
+ 80055fc:	0800e466 	.word	0x0800e466
+
+08005600 <hmac_sha256_init>:
+// hmac_sha256_init()
+//
+    void
+hmac_sha256_init(HMAC_CTX *ctx)
+{
+    memset(ctx, 0, sizeof(HMAC_CTX));
+ 8005600:	f44f 7282 	mov.w	r2, #260	; 0x104
+ 8005604:	2100      	movs	r1, #0
+ 8005606:	f008 b867 	b.w	800d6d8 <memset>
+	...
+
+0800560c <hmac_sha256_update>:
+
+// hmac_sha256_update()
+//
+    void
+hmac_sha256_update(HMAC_CTX *ctx, const uint8_t data[], uint32_t len)
+{
+ 800560c:	b538      	push	{r3, r4, r5, lr}
+ 800560e:	4604      	mov	r4, r0
+    // simple append
+    ASSERT(ctx->num_pending + len < sizeof(ctx->pending));
+ 8005610:	f8d0 0100 	ldr.w	r0, [r0, #256]	; 0x100
+ 8005614:	1883      	adds	r3, r0, r2
+ 8005616:	2bff      	cmp	r3, #255	; 0xff
+{
+ 8005618:	4615      	mov	r5, r2
+    ASSERT(ctx->num_pending + len < sizeof(ctx->pending));
+ 800561a:	d902      	bls.n	8005622 <hmac_sha256_update+0x16>
+ 800561c:	4805      	ldr	r0, [pc, #20]	; (8005634 <hmac_sha256_update+0x28>)
+ 800561e:	f7fb fa13 	bl	8000a48 <fatal_error>
+
+    memcpy(ctx->pending+ctx->num_pending, data, len);
+ 8005622:	4420      	add	r0, r4
+ 8005624:	f008 f830 	bl	800d688 <memcpy>
+
+    ctx->num_pending += len;
+ 8005628:	f8d4 2100 	ldr.w	r2, [r4, #256]	; 0x100
+ 800562c:	442a      	add	r2, r5
+ 800562e:	f8c4 2100 	str.w	r2, [r4, #256]	; 0x100
+}
+ 8005632:	bd38      	pop	{r3, r4, r5, pc}
+ 8005634:	0800e466 	.word	0x0800e466
+
+08005638 <hmac_sha256_final>:
+
+// hmac_sha256_final()
+//
+    void
+hmac_sha256_final(HMAC_CTX *ctx, const uint8_t key[32], uint8_t digest[32])
+{
+ 8005638:	b530      	push	{r4, r5, lr}
+ 800563a:	b097      	sub	sp, #92	; 0x5c
+ 800563c:	4604      	mov	r4, r0
+ 800563e:	460d      	mov	r5, r1
+ 8005640:	9203      	str	r2, [sp, #12]
+    HASH_HandleTypeDef  hh = {0};
+ 8005642:	2100      	movs	r1, #0
+ 8005644:	2238      	movs	r2, #56	; 0x38
+ 8005646:	a808      	add	r0, sp, #32
+ 8005648:	f008 f846 	bl	800d6d8 <memset>
+
+    hh.Init.DataType = HASH_DATATYPE_8B;
+ 800564c:	2220      	movs	r2, #32
+    hh.Init.pKey = (uint8_t *)key;      // const viol due to API dumbness
+    hh.Init.KeySize = 32;
+
+    HAL_HASH_Init(&hh);
+ 800564e:	a805      	add	r0, sp, #20
+    hh.Init.KeySize = 32;
+ 8005650:	e9cd 2506 	strd	r2, r5, [sp, #24]
+    hh.Init.DataType = HASH_DATATYPE_8B;
+ 8005654:	9205      	str	r2, [sp, #20]
+    HAL_HASH_Init(&hh);
+ 8005656:	f004 ff5b 	bl	800a510 <HAL_HASH_Init>
+
+    HAL_StatusTypeDef rv = HAL_HMACEx_SHA256_Start(&hh,
+ 800565a:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 800565e:	9200      	str	r2, [sp, #0]
+ 8005660:	9b03      	ldr	r3, [sp, #12]
+ 8005662:	f8d4 2100 	ldr.w	r2, [r4, #256]	; 0x100
+ 8005666:	4621      	mov	r1, r4
+ 8005668:	a805      	add	r0, sp, #20
+ 800566a:	f7ff ff35 	bl	80054d8 <HAL_HMACEx_SHA256_Start>
+                                ctx->pending, ctx->num_pending, digest, HAL_MAX_DELAY);
+    ASSERT(rv == HAL_OK);
+ 800566e:	b110      	cbz	r0, 8005676 <hmac_sha256_final+0x3e>
+ 8005670:	4802      	ldr	r0, [pc, #8]	; (800567c <hmac_sha256_final+0x44>)
+ 8005672:	f7fb f9e9 	bl	8000a48 <fatal_error>
+}
+ 8005676:	b017      	add	sp, #92	; 0x5c
+ 8005678:	bd30      	pop	{r4, r5, pc}
+ 800567a:	bf00      	nop
+ 800567c:	0800e466 	.word	0x0800e466
+
+08005680 <uECC_vli_mult>:
+
+#if !asm_mult
+uECC_VLI_API void uECC_vli_mult(uECC_word_t *result,
+                                const uECC_word_t *left,
+                                const uECC_word_t *right,
+                                wordcount_t num_words) {
+ 8005680:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+    );
+    
+#else /* Thumb-1 */
+    uint32_t r4, r5, r6, r7;
+
+    __asm__ volatile (
+ 8005684:	3b01      	subs	r3, #1
+ 8005686:	009b      	lsls	r3, r3, #2
+ 8005688:	4698      	mov	r8, r3
+ 800568a:	005b      	lsls	r3, r3, #1
+ 800568c:	4699      	mov	r9, r3
+ 800568e:	2300      	movs	r3, #0
+ 8005690:	2400      	movs	r4, #0
+ 8005692:	2500      	movs	r5, #0
+ 8005694:	2600      	movs	r6, #0
+ 8005696:	b401      	push	{r0}
+ 8005698:	2700      	movs	r7, #0
+ 800569a:	e002      	b.n	80056a2 <uECC_vli_mult+0x22>
+ 800569c:	0037      	movs	r7, r6
+ 800569e:	4640      	mov	r0, r8
+ 80056a0:	1a3f      	subs	r7, r7, r0
+ 80056a2:	b478      	push	{r3, r4, r5, r6}
+ 80056a4:	1bf0      	subs	r0, r6, r7
+ 80056a6:	5814      	ldr	r4, [r2, r0]
+ 80056a8:	59c8      	ldr	r0, [r1, r7]
+ 80056aa:	0c03      	lsrs	r3, r0, #16
+ 80056ac:	b280      	uxth	r0, r0
+ 80056ae:	0c25      	lsrs	r5, r4, #16
+ 80056b0:	b2a4      	uxth	r4, r4
+ 80056b2:	001e      	movs	r6, r3
+ 80056b4:	436e      	muls	r6, r5
+ 80056b6:	4363      	muls	r3, r4
+ 80056b8:	4345      	muls	r5, r0
+ 80056ba:	4360      	muls	r0, r4
+ 80056bc:	2400      	movs	r4, #0
+ 80056be:	195b      	adds	r3, r3, r5
+ 80056c0:	4164      	adcs	r4, r4
+ 80056c2:	0424      	lsls	r4, r4, #16
+ 80056c4:	1936      	adds	r6, r6, r4
+ 80056c6:	041c      	lsls	r4, r3, #16
+ 80056c8:	0c1b      	lsrs	r3, r3, #16
+ 80056ca:	1900      	adds	r0, r0, r4
+ 80056cc:	415e      	adcs	r6, r3
+ 80056ce:	bc38      	pop	{r3, r4, r5}
+ 80056d0:	181b      	adds	r3, r3, r0
+ 80056d2:	4174      	adcs	r4, r6
+ 80056d4:	2000      	movs	r0, #0
+ 80056d6:	4145      	adcs	r5, r0
+ 80056d8:	bc40      	pop	{r6}
+ 80056da:	3704      	adds	r7, #4
+ 80056dc:	4547      	cmp	r7, r8
+ 80056de:	dc01      	bgt.n	80056e4 <uECC_vli_mult+0x64>
+ 80056e0:	42b7      	cmp	r7, r6
+ 80056e2:	ddde      	ble.n	80056a2 <uECC_vli_mult+0x22>
+ 80056e4:	9800      	ldr	r0, [sp, #0]
+ 80056e6:	5183      	str	r3, [r0, r6]
+ 80056e8:	4623      	mov	r3, r4
+ 80056ea:	462c      	mov	r4, r5
+ 80056ec:	2500      	movs	r5, #0
+ 80056ee:	3604      	adds	r6, #4
+ 80056f0:	4546      	cmp	r6, r8
+ 80056f2:	ddd1      	ble.n	8005698 <uECC_vli_mult+0x18>
+ 80056f4:	454e      	cmp	r6, r9
+ 80056f6:	ddd1      	ble.n	800569c <uECC_vli_mult+0x1c>
+ 80056f8:	5183      	str	r3, [r0, r6]
+ 80056fa:	bc01      	pop	{r0}
+          [r5] "=&l" (r5), [r6] "=&l" (r6), [r7] "=&l" (r7)
+        : [r0] "l" (result), [r1] "l" (left), [r2] "l" (right)
+        : "r8", "r9", "cc", "memory"
+    );
+#endif
+}
+ 80056fc:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+
+08005700 <uECC_vli_clear>:
+
+#if !asm_clear
+uECC_VLI_API void uECC_vli_clear(uECC_word_t *vli, wordcount_t num_words) {
+    wordcount_t i;
+    for (i = 0; i < num_words; ++i) {
+        vli[i] = 0;
+ 8005700:	ea21 71e1 	bic.w	r1, r1, r1, asr #31
+ 8005704:	008a      	lsls	r2, r1, #2
+ 8005706:	2100      	movs	r1, #0
+ 8005708:	f007 bfe6 	b.w	800d6d8 <memset>
+
+0800570c <uECC_vli_isZero>:
+}
+#endif /* !asm_clear */
+
+/* Constant-time comparison to zero - secure way to compare long integers */
+/* Returns 1 if vli == 0, 0 otherwise. */
+uECC_VLI_API uECC_word_t uECC_vli_isZero(const uECC_word_t *vli, wordcount_t num_words) {
+ 800570c:	b510      	push	{r4, lr}
+    uECC_word_t bits = 0;
+    wordcount_t i;
+    for (i = 0; i < num_words; ++i) {
+ 800570e:	2300      	movs	r3, #0
+    uECC_word_t bits = 0;
+ 8005710:	461a      	mov	r2, r3
+    for (i = 0; i < num_words; ++i) {
+ 8005712:	b25c      	sxtb	r4, r3
+ 8005714:	42a1      	cmp	r1, r4
+ 8005716:	dc03      	bgt.n	8005720 <uECC_vli_isZero+0x14>
+        bits |= vli[i];
+    }
+    return (bits == 0);
+}
+ 8005718:	fab2 f082 	clz	r0, r2
+ 800571c:	0940      	lsrs	r0, r0, #5
+ 800571e:	bd10      	pop	{r4, pc}
+        bits |= vli[i];
+ 8005720:	f850 4023 	ldr.w	r4, [r0, r3, lsl #2]
+ 8005724:	3301      	adds	r3, #1
+ 8005726:	4322      	orrs	r2, r4
+    for (i = 0; i < num_words; ++i) {
+ 8005728:	e7f3      	b.n	8005712 <uECC_vli_isZero+0x6>
+
+0800572a <uECC_vli_testBit>:
+
+/* Returns nonzero if bit 'bit' of vli is set. */
+uECC_VLI_API uECC_word_t uECC_vli_testBit(const uECC_word_t *vli, bitcount_t bit) {
+    return (vli[bit >> uECC_WORD_BITS_SHIFT] & ((uECC_word_t)1 << (bit & uECC_WORD_BITS_MASK)));
+ 800572a:	114a      	asrs	r2, r1, #5
+ 800572c:	2301      	movs	r3, #1
+ 800572e:	f850 0022 	ldr.w	r0, [r0, r2, lsl #2]
+ 8005732:	f001 011f 	and.w	r1, r1, #31
+ 8005736:	fa03 f101 	lsl.w	r1, r3, r1
+}
+ 800573a:	4008      	ands	r0, r1
+ 800573c:	4770      	bx	lr
+
+0800573e <uECC_vli_numBits>:
+/* Counts the number of words in vli. */
+static wordcount_t vli_numDigits(const uECC_word_t *vli, const wordcount_t max_words) {
+    wordcount_t i;
+    /* Search from the end until we find a non-zero digit.
+       We do it in reverse because we expect that most digits will be nonzero. */
+    for (i = max_words - 1; i >= 0 && vli[i] == 0; --i) {
+ 800573e:	3901      	subs	r1, #1
+
+    return (i + 1);
+}
+
+/* Counts the number of bits required to represent vli. */
+uECC_VLI_API bitcount_t uECC_vli_numBits(const uECC_word_t *vli, const wordcount_t max_words) {
+ 8005740:	b510      	push	{r4, lr}
+ 8005742:	b249      	sxtb	r1, r1
+    for (i = max_words - 1; i >= 0 && vli[i] == 0; --i) {
+ 8005744:	1d04      	adds	r4, r0, #4
+ 8005746:	060a      	lsls	r2, r1, #24
+ 8005748:	b2cb      	uxtb	r3, r1
+ 800574a:	d404      	bmi.n	8005756 <uECC_vli_numBits+0x18>
+ 800574c:	3901      	subs	r1, #1
+ 800574e:	f854 2021 	ldr.w	r2, [r4, r1, lsl #2]
+ 8005752:	2a00      	cmp	r2, #0
+ 8005754:	d0f7      	beq.n	8005746 <uECC_vli_numBits+0x8>
+    return (i + 1);
+ 8005756:	3301      	adds	r3, #1
+ 8005758:	b25b      	sxtb	r3, r3
+    uECC_word_t i;
+    uECC_word_t digit;
+
+    wordcount_t num_digits = vli_numDigits(vli, max_words);
+    if (num_digits == 0) {
+ 800575a:	b173      	cbz	r3, 800577a <uECC_vli_numBits+0x3c>
+        return 0;
+    }
+
+    digit = vli[num_digits - 1];
+ 800575c:	f103 4280 	add.w	r2, r3, #1073741824	; 0x40000000
+ 8005760:	3a01      	subs	r2, #1
+ 8005762:	f850 2022 	ldr.w	r2, [r0, r2, lsl #2]
+    for (i = 0; digit; ++i) {
+ 8005766:	2000      	movs	r0, #0
+ 8005768:	b922      	cbnz	r2, 8005774 <uECC_vli_numBits+0x36>
+        digit >>= 1;
+    }
+
+    return (((bitcount_t)(num_digits - 1) << uECC_WORD_BITS_SHIFT) + i);
+ 800576a:	3b01      	subs	r3, #1
+ 800576c:	eb00 1343 	add.w	r3, r0, r3, lsl #5
+ 8005770:	b218      	sxth	r0, r3
+}
+ 8005772:	bd10      	pop	{r4, pc}
+        digit >>= 1;
+ 8005774:	0852      	lsrs	r2, r2, #1
+    for (i = 0; digit; ++i) {
+ 8005776:	3001      	adds	r0, #1
+ 8005778:	e7f6      	b.n	8005768 <uECC_vli_numBits+0x2a>
+        return 0;
+ 800577a:	4618      	mov	r0, r3
+ 800577c:	e7f9      	b.n	8005772 <uECC_vli_numBits+0x34>
+
+0800577e <uECC_vli_set>:
+
+/* Sets dest = src. */
+#if !asm_set
+uECC_VLI_API void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src, wordcount_t num_words) {
+ 800577e:	b510      	push	{r4, lr}
+    wordcount_t i;
+    for (i = 0; i < num_words; ++i) {
+ 8005780:	2300      	movs	r3, #0
+ 8005782:	b25c      	sxtb	r4, r3
+ 8005784:	42a2      	cmp	r2, r4
+ 8005786:	dc00      	bgt.n	800578a <uECC_vli_set+0xc>
+        dest[i] = src[i];
+    }
+}
+ 8005788:	bd10      	pop	{r4, pc}
+        dest[i] = src[i];
+ 800578a:	f851 4023 	ldr.w	r4, [r1, r3, lsl #2]
+ 800578e:	f840 4023 	str.w	r4, [r0, r3, lsl #2]
+    for (i = 0; i < num_words; ++i) {
+ 8005792:	3301      	adds	r3, #1
+ 8005794:	e7f5      	b.n	8005782 <uECC_vli_set+0x4>
+
+08005796 <uECC_vli_cmp_unsafe>:
+#endif /* !asm_set */
+
+/* Returns sign of left - right. */
+static cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left,
+                                       const uECC_word_t *right,
+                                       wordcount_t num_words) {
+ 8005796:	b510      	push	{r4, lr}
+    wordcount_t i;
+    for (i = num_words - 1; i >= 0; --i) {
+ 8005798:	3a01      	subs	r2, #1
+ 800579a:	b252      	sxtb	r2, r2
+ 800579c:	0613      	lsls	r3, r2, #24
+ 800579e:	d501      	bpl.n	80057a4 <uECC_vli_cmp_unsafe+0xe>
+            return 1;
+        } else if (left[i] < right[i]) {
+            return -1;
+        }
+    }
+    return 0;
+ 80057a0:	2000      	movs	r0, #0
+}
+ 80057a2:	bd10      	pop	{r4, pc}
+        if (left[i] > right[i]) {
+ 80057a4:	f850 4022 	ldr.w	r4, [r0, r2, lsl #2]
+ 80057a8:	f851 3022 	ldr.w	r3, [r1, r2, lsl #2]
+ 80057ac:	429c      	cmp	r4, r3
+ 80057ae:	d805      	bhi.n	80057bc <uECC_vli_cmp_unsafe+0x26>
+        } else if (left[i] < right[i]) {
+ 80057b0:	f102 32ff 	add.w	r2, r2, #4294967295	; 0xffffffff
+ 80057b4:	d2f2      	bcs.n	800579c <uECC_vli_cmp_unsafe+0x6>
+            return -1;
+ 80057b6:	f04f 30ff 	mov.w	r0, #4294967295	; 0xffffffff
+ 80057ba:	e7f2      	b.n	80057a2 <uECC_vli_cmp_unsafe+0xc>
+            return 1;
+ 80057bc:	2001      	movs	r0, #1
+ 80057be:	e7f0      	b.n	80057a2 <uECC_vli_cmp_unsafe+0xc>
+
+080057c0 <uECC_vli_rshift1>:
+#if !asm_rshift1
+uECC_VLI_API void uECC_vli_rshift1(uECC_word_t *vli, wordcount_t num_words) {
+    uECC_word_t *end = vli;
+    uECC_word_t carry = 0;
+    
+    vli += num_words;
+ 80057c0:	eb00 0181 	add.w	r1, r0, r1, lsl #2
+    uECC_word_t carry = 0;
+ 80057c4:	2300      	movs	r3, #0
+    while (vli-- > end) {
+ 80057c6:	4288      	cmp	r0, r1
+ 80057c8:	d300      	bcc.n	80057cc <uECC_vli_rshift1+0xc>
+        uECC_word_t temp = *vli;
+        *vli = (temp >> 1) | carry;
+        carry = temp << (uECC_WORD_BITS - 1);
+    }
+}
+ 80057ca:	4770      	bx	lr
+        uECC_word_t temp = *vli;
+ 80057cc:	f851 2d04 	ldr.w	r2, [r1, #-4]!
+        *vli = (temp >> 1) | carry;
+ 80057d0:	ea43 0352 	orr.w	r3, r3, r2, lsr #1
+ 80057d4:	600b      	str	r3, [r1, #0]
+        carry = temp << (uECC_WORD_BITS - 1);
+ 80057d6:	07d3      	lsls	r3, r2, #31
+ 80057d8:	e7f5      	b.n	80057c6 <uECC_vli_rshift1+0x6>
+
+080057da <uECC_vli_modMult>:
+/* Computes result = (left * right) % mod. */
+uECC_VLI_API void uECC_vli_modMult(uECC_word_t *result,
+                                   const uECC_word_t *left,
+                                   const uECC_word_t *right,
+                                   const uECC_word_t *mod,
+                                   wordcount_t num_words) {
+ 80057da:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 80057de:	b0b5      	sub	sp, #212	; 0xd4
+ 80057e0:	461f      	mov	r7, r3
+ 80057e2:	f99d 50f8 	ldrsb.w	r5, [sp, #248]	; 0xf8
+ 80057e6:	4680      	mov	r8, r0
+    uECC_word_t product[2 * uECC_MAX_WORDS];
+    uECC_vli_mult(product, left, right, num_words);
+ 80057e8:	462b      	mov	r3, r5
+ 80057ea:	a804      	add	r0, sp, #16
+ 80057ec:	f7ff ff48 	bl	8005680 <uECC_vli_mult>
+    uECC_word_t *v[2] = {tmp, product};
+ 80057f0:	ab24      	add	r3, sp, #144	; 0x90
+ 80057f2:	e9cd 3002 	strd	r3, r0, [sp, #8]
+    bitcount_t shift = (num_words * 2 * uECC_WORD_BITS) - uECC_vli_numBits(mod, num_words);
+ 80057f6:	4629      	mov	r1, r5
+ 80057f8:	4638      	mov	r0, r7
+ 80057fa:	f7ff ffa0 	bl	800573e <uECC_vli_numBits>
+ 80057fe:	ebc0 1085 	rsb	r0, r0, r5, lsl #6
+ 8005802:	b204      	sxth	r4, r0
+    wordcount_t word_shift = shift / uECC_WORD_BITS;
+ 8005804:	2c00      	cmp	r4, #0
+ 8005806:	4626      	mov	r6, r4
+ 8005808:	bfb8      	it	lt
+ 800580a:	f104 061f 	addlt.w	r6, r4, #31
+    wordcount_t bit_shift = shift % uECC_WORD_BITS;
+ 800580e:	4263      	negs	r3, r4
+    wordcount_t word_shift = shift / uECC_WORD_BITS;
+ 8005810:	f346 1647 	sbfx	r6, r6, #5, #8
+    wordcount_t bit_shift = shift % uECC_WORD_BITS;
+ 8005814:	f003 031f 	and.w	r3, r3, #31
+ 8005818:	f004 091f 	and.w	r9, r4, #31
+    uECC_vli_clear(mod_multiple, word_shift);
+ 800581c:	4631      	mov	r1, r6
+    wordcount_t bit_shift = shift % uECC_WORD_BITS;
+ 800581e:	bf58      	it	pl
+ 8005820:	f1c3 0900 	rsbpl	r9, r3, #0
+    uECC_vli_clear(mod_multiple, word_shift);
+ 8005824:	a814      	add	r0, sp, #80	; 0x50
+ 8005826:	f7ff ff6b 	bl	8005700 <uECC_vli_clear>
+    if (bit_shift > 0) {
+ 800582a:	f1b9 0f00 	cmp.w	r9, #0
+ 800582e:	b236      	sxth	r6, r6
+ 8005830:	dd2b      	ble.n	800588a <uECC_vli_modMult+0xb0>
+ 8005832:	ab14      	add	r3, sp, #80	; 0x50
+    uECC_word_t carry = 0;
+ 8005834:	2200      	movs	r2, #0
+ 8005836:	eb03 0686 	add.w	r6, r3, r6, lsl #2
+            carry = mod[index] >> (uECC_WORD_BITS - bit_shift);
+ 800583a:	f1c9 0c20 	rsb	ip, r9, #32
+        for(index = 0; index < (uECC_word_t)num_words; ++index) {
+ 800583e:	4613      	mov	r3, r2
+ 8005840:	42ab      	cmp	r3, r5
+ 8005842:	d317      	bcc.n	8005874 <uECC_vli_modMult+0x9a>
+        for (i = 0; i < num_words * 2; ++i) {
+ 8005844:	006b      	lsls	r3, r5, #1
+ 8005846:	9301      	str	r3, [sp, #4]
+        uECC_vli_rshift1(mod_multiple + num_words, num_words);
+ 8005848:	ab14      	add	r3, sp, #80	; 0x50
+ 800584a:	eb03 0985 	add.w	r9, r3, r5, lsl #2
+        mod_multiple[num_words - 1] |= mod_multiple[num_words] << (uECC_WORD_BITS - 1);
+ 800584e:	1e6f      	subs	r7, r5, #1
+ 8005850:	ab34      	add	r3, sp, #208	; 0xd0
+        uECC_vli_rshift1(mod_multiple + num_words, num_words);
+ 8005852:	2601      	movs	r6, #1
+        mod_multiple[num_words - 1] |= mod_multiple[num_words] << (uECC_WORD_BITS - 1);
+ 8005854:	eb03 0787 	add.w	r7, r3, r7, lsl #2
+    for (index = 1; shift >= 0; --shift) {
+ 8005858:	2c00      	cmp	r4, #0
+ 800585a:	da54      	bge.n	8005906 <uECC_vli_modMult+0x12c>
+    uECC_vli_set(result, v[index], num_words);
+ 800585c:	ab34      	add	r3, sp, #208	; 0xd0
+ 800585e:	eb03 0686 	add.w	r6, r3, r6, lsl #2
+ 8005862:	462a      	mov	r2, r5
+ 8005864:	f856 1cc8 	ldr.w	r1, [r6, #-200]
+ 8005868:	4640      	mov	r0, r8
+ 800586a:	f7ff ff88 	bl	800577e <uECC_vli_set>
+    uECC_vli_mmod(result, product, mod, num_words);
+}
+ 800586e:	b035      	add	sp, #212	; 0xd4
+ 8005870:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+            mod_multiple[word_shift + index] = (mod[index] << bit_shift) | carry;
+ 8005874:	f857 0023 	ldr.w	r0, [r7, r3, lsl #2]
+ 8005878:	fa00 f109 	lsl.w	r1, r0, r9
+ 800587c:	430a      	orrs	r2, r1
+ 800587e:	f846 2b04 	str.w	r2, [r6], #4
+        for(index = 0; index < (uECC_word_t)num_words; ++index) {
+ 8005882:	3301      	adds	r3, #1
+            carry = mod[index] >> (uECC_WORD_BITS - bit_shift);
+ 8005884:	fa20 f20c 	lsr.w	r2, r0, ip
+        for(index = 0; index < (uECC_word_t)num_words; ++index) {
+ 8005888:	e7da      	b.n	8005840 <uECC_vli_modMult+0x66>
+        uECC_vli_set(mod_multiple + word_shift, mod, num_words);
+ 800588a:	ab14      	add	r3, sp, #80	; 0x50
+ 800588c:	462a      	mov	r2, r5
+ 800588e:	4639      	mov	r1, r7
+ 8005890:	eb03 0086 	add.w	r0, r3, r6, lsl #2
+ 8005894:	f7ff ff73 	bl	800577e <uECC_vli_set>
+ 8005898:	e7d4      	b.n	8005844 <uECC_vli_modMult+0x6a>
+            uECC_word_t diff = v[index][i] - mod_multiple[i] - borrow;
+ 800589a:	fa0f fe82 	sxth.w	lr, r2
+ 800589e:	f85a 3cc8 	ldr.w	r3, [sl, #-200]
+ 80058a2:	f853 b02e 	ldr.w	fp, [r3, lr, lsl #2]
+ 80058a6:	ab34      	add	r3, sp, #208	; 0xd0
+ 80058a8:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 80058ac:	3001      	adds	r0, #1
+ 80058ae:	f852 3c80 	ldr.w	r3, [r2, #-128]
+ 80058b2:	440b      	add	r3, r1
+ 80058b4:	ebbb 0303 	subs.w	r3, fp, r3
+ 80058b8:	bf34      	ite	cc
+ 80058ba:	2201      	movcc	r2, #1
+ 80058bc:	2200      	movcs	r2, #0
+            if (diff != v[index][i]) {
+ 80058be:	459b      	cmp	fp, r3
+                borrow = (diff > v[index][i]);
+ 80058c0:	bf18      	it	ne
+ 80058c2:	4611      	movne	r1, r2
+            v[1 - index][i] = diff;
+ 80058c4:	f85c 2cc8 	ldr.w	r2, [ip, #-200]
+ 80058c8:	f842 302e 	str.w	r3, [r2, lr, lsl #2]
+        for (i = 0; i < num_words * 2; ++i) {
+ 80058cc:	9b01      	ldr	r3, [sp, #4]
+ 80058ce:	b242      	sxtb	r2, r0
+ 80058d0:	429a      	cmp	r2, r3
+ 80058d2:	dbe2      	blt.n	800589a <uECC_vli_modMult+0xc0>
+        index = !(index ^ borrow); /* Swap the index if there was no borrow */
+ 80058d4:	1a73      	subs	r3, r6, r1
+ 80058d6:	425e      	negs	r6, r3
+        uECC_vli_rshift1(mod_multiple, num_words);
+ 80058d8:	4629      	mov	r1, r5
+ 80058da:	a814      	add	r0, sp, #80	; 0x50
+        index = !(index ^ borrow); /* Swap the index if there was no borrow */
+ 80058dc:	415e      	adcs	r6, r3
+        uECC_vli_rshift1(mod_multiple, num_words);
+ 80058de:	f7ff ff6f 	bl	80057c0 <uECC_vli_rshift1>
+        mod_multiple[num_words - 1] |= mod_multiple[num_words] << (uECC_WORD_BITS - 1);
+ 80058e2:	ab34      	add	r3, sp, #208	; 0xd0
+ 80058e4:	eb03 0385 	add.w	r3, r3, r5, lsl #2
+        uECC_vli_rshift1(mod_multiple + num_words, num_words);
+ 80058e8:	4629      	mov	r1, r5
+        mod_multiple[num_words - 1] |= mod_multiple[num_words] << (uECC_WORD_BITS - 1);
+ 80058ea:	f853 2c80 	ldr.w	r2, [r3, #-128]
+ 80058ee:	f857 3c80 	ldr.w	r3, [r7, #-128]
+ 80058f2:	ea43 73c2 	orr.w	r3, r3, r2, lsl #31
+ 80058f6:	f847 3c80 	str.w	r3, [r7, #-128]
+        uECC_vli_rshift1(mod_multiple + num_words, num_words);
+ 80058fa:	4648      	mov	r0, r9
+ 80058fc:	3c01      	subs	r4, #1
+ 80058fe:	f7ff ff5f 	bl	80057c0 <uECC_vli_rshift1>
+    for (index = 1; shift >= 0; --shift) {
+ 8005902:	b224      	sxth	r4, r4
+ 8005904:	e7a8      	b.n	8005858 <uECC_vli_modMult+0x7e>
+            uECC_word_t diff = v[index][i] - mod_multiple[i] - borrow;
+ 8005906:	ab34      	add	r3, sp, #208	; 0xd0
+ 8005908:	2000      	movs	r0, #0
+            v[1 - index][i] = diff;
+ 800590a:	f1c6 0c01 	rsb	ip, r6, #1
+        uECC_word_t borrow = 0;
+ 800590e:	4601      	mov	r1, r0
+            uECC_word_t diff = v[index][i] - mod_multiple[i] - borrow;
+ 8005910:	eb03 0a86 	add.w	sl, r3, r6, lsl #2
+            v[1 - index][i] = diff;
+ 8005914:	eb03 0c8c 	add.w	ip, r3, ip, lsl #2
+ 8005918:	e7d8      	b.n	80058cc <uECC_vli_modMult+0xf2>
+
+0800591a <uECC_vli_modMult_fast>:
+
+uECC_VLI_API void uECC_vli_modMult_fast(uECC_word_t *result,
+                                        const uECC_word_t *left,
+                                        const uECC_word_t *right,
+                                        uECC_Curve curve) {
+ 800591a:	b530      	push	{r4, r5, lr}
+ 800591c:	461c      	mov	r4, r3
+ 800591e:	b091      	sub	sp, #68	; 0x44
+ 8005920:	4605      	mov	r5, r0
+    uECC_word_t product[2 * uECC_MAX_WORDS];
+    uECC_vli_mult(product, left, right, curve->num_words);
+ 8005922:	f993 3000 	ldrsb.w	r3, [r3]
+ 8005926:	4668      	mov	r0, sp
+ 8005928:	f7ff feaa 	bl	8005680 <uECC_vli_mult>
+#if (uECC_OPTIMIZATION_LEVEL > 0)
+    curve->mmod_fast(result, product);
+ 800592c:	4601      	mov	r1, r0
+ 800592e:	f8d4 30b0 	ldr.w	r3, [r4, #176]	; 0xb0
+ 8005932:	4628      	mov	r0, r5
+ 8005934:	4798      	blx	r3
+#else
+    uECC_vli_mmod(result, product, curve->p, curve->num_words);
+#endif
+}
+ 8005936:	b011      	add	sp, #68	; 0x44
+ 8005938:	bd30      	pop	{r4, r5, pc}
+
+0800593a <uECC_vli_modSquare_fast>:
+}
+#endif /* uECC_ENABLE_VLI_API */
+
+uECC_VLI_API void uECC_vli_modSquare_fast(uECC_word_t *result,
+                                          const uECC_word_t *left,
+                                          uECC_Curve curve) {
+ 800593a:	4613      	mov	r3, r2
+    uECC_vli_modMult_fast(result, left, left, curve);
+ 800593c:	460a      	mov	r2, r1
+ 800593e:	f7ff bfec 	b.w	800591a <uECC_vli_modMult_fast>
+
+08005942 <apply_z>:
+
+/* Modify (x1, y1) => (x1 * z^2, y1 * z^3) */
+static void apply_z(uECC_word_t * X1,
+                    uECC_word_t * Y1,
+                    const uECC_word_t * const Z,
+                    uECC_Curve curve) {
+ 8005942:	b570      	push	{r4, r5, r6, lr}
+ 8005944:	4614      	mov	r4, r2
+ 8005946:	b08a      	sub	sp, #40	; 0x28
+ 8005948:	4606      	mov	r6, r0
+ 800594a:	460d      	mov	r5, r1
+    uECC_word_t t1[uECC_MAX_WORDS];
+
+    uECC_vli_modSquare_fast(t1, Z, curve);    /* z^2 */
+ 800594c:	461a      	mov	r2, r3
+ 800594e:	4621      	mov	r1, r4
+ 8005950:	a802      	add	r0, sp, #8
+ 8005952:	9301      	str	r3, [sp, #4]
+ 8005954:	f7ff fff1 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modMult_fast(X1, X1, t1, curve); /* x1 * z^2 */
+ 8005958:	9b01      	ldr	r3, [sp, #4]
+ 800595a:	aa02      	add	r2, sp, #8
+ 800595c:	4631      	mov	r1, r6
+ 800595e:	4630      	mov	r0, r6
+ 8005960:	f7ff ffdb 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modMult_fast(t1, t1, Z, curve);  /* z^3 */
+ 8005964:	a902      	add	r1, sp, #8
+ 8005966:	9b01      	ldr	r3, [sp, #4]
+ 8005968:	4622      	mov	r2, r4
+ 800596a:	4608      	mov	r0, r1
+ 800596c:	f7ff ffd5 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modMult_fast(Y1, Y1, t1, curve); /* y1 * z^3 */
+ 8005970:	9b01      	ldr	r3, [sp, #4]
+ 8005972:	aa02      	add	r2, sp, #8
+ 8005974:	4629      	mov	r1, r5
+ 8005976:	4628      	mov	r0, r5
+ 8005978:	f7ff ffcf 	bl	800591a <uECC_vli_modMult_fast>
+}
+ 800597c:	b00a      	add	sp, #40	; 0x28
+ 800597e:	bd70      	pop	{r4, r5, r6, pc}
+
+08005980 <uECC_vli_nativeToBytes>:
+
+#else
+
+uECC_VLI_API void uECC_vli_nativeToBytes(uint8_t *bytes,
+                                         int num_bytes,
+                                         const uECC_word_t *native) {
+ 8005980:	b5f0      	push	{r4, r5, r6, r7, lr}
+    wordcount_t i;
+    for (i = 0; i < num_bytes; ++i) {
+ 8005982:	2500      	movs	r5, #0
+        unsigned b = num_bytes - 1 - i;
+ 8005984:	1e4f      	subs	r7, r1, #1
+ 8005986:	b26c      	sxtb	r4, r5
+    for (i = 0; i < num_bytes; ++i) {
+ 8005988:	428c      	cmp	r4, r1
+ 800598a:	f105 0501 	add.w	r5, r5, #1
+ 800598e:	db00      	blt.n	8005992 <uECC_vli_nativeToBytes+0x12>
+        bytes[i] = native[b / uECC_WORD_SIZE] >> (8 * (b % uECC_WORD_SIZE));
+    }
+}
+ 8005990:	bdf0      	pop	{r4, r5, r6, r7, pc}
+        unsigned b = num_bytes - 1 - i;
+ 8005992:	1b3b      	subs	r3, r7, r4
+        bytes[i] = native[b / uECC_WORD_SIZE] >> (8 * (b % uECC_WORD_SIZE));
+ 8005994:	f023 0603 	bic.w	r6, r3, #3
+ 8005998:	f003 0303 	and.w	r3, r3, #3
+ 800599c:	5996      	ldr	r6, [r2, r6]
+ 800599e:	00db      	lsls	r3, r3, #3
+ 80059a0:	fa26 f303 	lsr.w	r3, r6, r3
+ 80059a4:	5503      	strb	r3, [r0, r4]
+    for (i = 0; i < num_bytes; ++i) {
+ 80059a6:	e7ee      	b.n	8005986 <uECC_vli_nativeToBytes+0x6>
+
+080059a8 <uECC_vli_bytesToNative>:
+
+uECC_VLI_API void uECC_vli_bytesToNative(uECC_word_t *native,
+                                         const uint8_t *bytes,
+                                         int num_bytes) {
+ 80059a8:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+ 80059aa:	460e      	mov	r6, r1
+    wordcount_t i;
+    uECC_vli_clear(native, (num_bytes + (uECC_WORD_SIZE - 1)) / uECC_WORD_SIZE);
+ 80059ac:	1cd1      	adds	r1, r2, #3
+ 80059ae:	bf48      	it	mi
+ 80059b0:	1d91      	addmi	r1, r2, #6
+                                         int num_bytes) {
+ 80059b2:	4614      	mov	r4, r2
+    uECC_vli_clear(native, (num_bytes + (uECC_WORD_SIZE - 1)) / uECC_WORD_SIZE);
+ 80059b4:	f341 0187 	sbfx	r1, r1, #2, #8
+                                         int num_bytes) {
+ 80059b8:	4605      	mov	r5, r0
+    for (i = 0; i < num_bytes; ++i) {
+        unsigned b = num_bytes - 1 - i;
+ 80059ba:	1e67      	subs	r7, r4, #1
+    uECC_vli_clear(native, (num_bytes + (uECC_WORD_SIZE - 1)) / uECC_WORD_SIZE);
+ 80059bc:	f7ff fea0 	bl	8005700 <uECC_vli_clear>
+    for (i = 0; i < num_bytes; ++i) {
+ 80059c0:	2000      	movs	r0, #0
+ 80059c2:	b242      	sxtb	r2, r0
+ 80059c4:	42a2      	cmp	r2, r4
+ 80059c6:	f100 0001 	add.w	r0, r0, #1
+ 80059ca:	db00      	blt.n	80059ce <uECC_vli_bytesToNative+0x26>
+        native[b / uECC_WORD_SIZE] |= 
+            (uECC_word_t)bytes[i] << (8 * (b % uECC_WORD_SIZE));
+    }
+}
+ 80059cc:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+        unsigned b = num_bytes - 1 - i;
+ 80059ce:	1abb      	subs	r3, r7, r2
+        native[b / uECC_WORD_SIZE] |= 
+ 80059d0:	f023 0103 	bic.w	r1, r3, #3
+            (uECC_word_t)bytes[i] << (8 * (b % uECC_WORD_SIZE));
+ 80059d4:	5cb2      	ldrb	r2, [r6, r2]
+ 80059d6:	f003 0303 	and.w	r3, r3, #3
+ 80059da:	00db      	lsls	r3, r3, #3
+ 80059dc:	fa02 f303 	lsl.w	r3, r2, r3
+        native[b / uECC_WORD_SIZE] |= 
+ 80059e0:	586a      	ldr	r2, [r5, r1]
+ 80059e2:	431a      	orrs	r2, r3
+ 80059e4:	506a      	str	r2, [r5, r1]
+    for (i = 0; i < num_bytes; ++i) {
+ 80059e6:	e7ec      	b.n	80059c2 <uECC_vli_bytesToNative+0x1a>
+
+080059e8 <HMAC_init>:
+    return 0;
+}
+
+/* Compute an HMAC using K as a key (as in RFC 6979). Note that K is always
+   the same size as the hash result size. */
+static void HMAC_init(uECC_HashContext *hash_context, const uint8_t *K) {
+ 80059e8:	b570      	push	{r4, r5, r6, lr}
+    uint8_t *pad = hash_context->tmp + 2 * hash_context->result_size;
+ 80059ea:	e9d0 3504 	ldrd	r3, r5, [r0, #16]
+static void HMAC_init(uECC_HashContext *hash_context, const uint8_t *K) {
+ 80059ee:	4604      	mov	r4, r0
+    uint8_t *pad = hash_context->tmp + 2 * hash_context->result_size;
+ 80059f0:	eb05 0543 	add.w	r5, r5, r3, lsl #1
+    unsigned i;
+    for (i = 0; i < hash_context->result_size; ++i)
+ 80059f4:	2300      	movs	r3, #0
+ 80059f6:	6922      	ldr	r2, [r4, #16]
+ 80059f8:	429a      	cmp	r2, r3
+ 80059fa:	d80d      	bhi.n	8005a18 <HMAC_init+0x30>
+        pad[i] = K[i] ^ 0x36;
+    for (; i < hash_context->block_size; ++i)
+        pad[i] = 0x36;
+ 80059fc:	2136      	movs	r1, #54	; 0x36
+    for (; i < hash_context->block_size; ++i)
+ 80059fe:	68e2      	ldr	r2, [r4, #12]
+ 8005a00:	429a      	cmp	r2, r3
+ 8005a02:	d80f      	bhi.n	8005a24 <HMAC_init+0x3c>
+
+    hash_context->init_hash(hash_context);
+ 8005a04:	6823      	ldr	r3, [r4, #0]
+ 8005a06:	4620      	mov	r0, r4
+ 8005a08:	4798      	blx	r3
+    hash_context->update_hash(hash_context, pad, hash_context->block_size);
+ 8005a0a:	6863      	ldr	r3, [r4, #4]
+ 8005a0c:	68e2      	ldr	r2, [r4, #12]
+ 8005a0e:	4629      	mov	r1, r5
+ 8005a10:	4620      	mov	r0, r4
+}
+ 8005a12:	e8bd 4070 	ldmia.w	sp!, {r4, r5, r6, lr}
+    hash_context->update_hash(hash_context, pad, hash_context->block_size);
+ 8005a16:	4718      	bx	r3
+        pad[i] = K[i] ^ 0x36;
+ 8005a18:	5cca      	ldrb	r2, [r1, r3]
+ 8005a1a:	f082 0236 	eor.w	r2, r2, #54	; 0x36
+ 8005a1e:	54ea      	strb	r2, [r5, r3]
+    for (i = 0; i < hash_context->result_size; ++i)
+ 8005a20:	3301      	adds	r3, #1
+ 8005a22:	e7e8      	b.n	80059f6 <HMAC_init+0xe>
+        pad[i] = 0x36;
+ 8005a24:	54e9      	strb	r1, [r5, r3]
+    for (; i < hash_context->block_size; ++i)
+ 8005a26:	3301      	adds	r3, #1
+ 8005a28:	e7e9      	b.n	80059fe <HMAC_init+0x16>
+
+08005a2a <HMAC_update>:
+
+static void HMAC_update(uECC_HashContext *hash_context,
+                        const uint8_t *message,
+                        unsigned message_size) {
+    hash_context->update_hash(hash_context, message, message_size);
+ 8005a2a:	6843      	ldr	r3, [r0, #4]
+ 8005a2c:	4718      	bx	r3
+
+08005a2e <HMAC_finish>:
+}
+
+static void HMAC_finish(uECC_HashContext *hash_context, const uint8_t *K, uint8_t *result) {
+ 8005a2e:	b570      	push	{r4, r5, r6, lr}
+    uint8_t *pad = hash_context->tmp + 2 * hash_context->result_size;
+ 8005a30:	e9d0 3604 	ldrd	r3, r6, [r0, #16]
+static void HMAC_finish(uECC_HashContext *hash_context, const uint8_t *K, uint8_t *result) {
+ 8005a34:	4604      	mov	r4, r0
+    uint8_t *pad = hash_context->tmp + 2 * hash_context->result_size;
+ 8005a36:	eb06 0643 	add.w	r6, r6, r3, lsl #1
+static void HMAC_finish(uECC_HashContext *hash_context, const uint8_t *K, uint8_t *result) {
+ 8005a3a:	4615      	mov	r5, r2
+    unsigned i;
+    for (i = 0; i < hash_context->result_size; ++i)
+ 8005a3c:	2300      	movs	r3, #0
+ 8005a3e:	6922      	ldr	r2, [r4, #16]
+ 8005a40:	429a      	cmp	r2, r3
+ 8005a42:	d81a      	bhi.n	8005a7a <HMAC_finish+0x4c>
+        pad[i] = K[i] ^ 0x5c;
+    for (; i < hash_context->block_size; ++i)
+        pad[i] = 0x5c;
+ 8005a44:	215c      	movs	r1, #92	; 0x5c
+    for (; i < hash_context->block_size; ++i)
+ 8005a46:	68e2      	ldr	r2, [r4, #12]
+ 8005a48:	429a      	cmp	r2, r3
+ 8005a4a:	d81c      	bhi.n	8005a86 <HMAC_finish+0x58>
+
+    hash_context->finish_hash(hash_context, result);
+ 8005a4c:	4629      	mov	r1, r5
+ 8005a4e:	68a3      	ldr	r3, [r4, #8]
+ 8005a50:	4620      	mov	r0, r4
+ 8005a52:	4798      	blx	r3
+
+    hash_context->init_hash(hash_context);
+ 8005a54:	6823      	ldr	r3, [r4, #0]
+ 8005a56:	4620      	mov	r0, r4
+ 8005a58:	4798      	blx	r3
+    hash_context->update_hash(hash_context, pad, hash_context->block_size);
+ 8005a5a:	6863      	ldr	r3, [r4, #4]
+ 8005a5c:	68e2      	ldr	r2, [r4, #12]
+ 8005a5e:	4631      	mov	r1, r6
+ 8005a60:	4620      	mov	r0, r4
+ 8005a62:	4798      	blx	r3
+    hash_context->update_hash(hash_context, result, hash_context->result_size);
+ 8005a64:	6863      	ldr	r3, [r4, #4]
+ 8005a66:	6922      	ldr	r2, [r4, #16]
+ 8005a68:	4629      	mov	r1, r5
+ 8005a6a:	4620      	mov	r0, r4
+ 8005a6c:	4798      	blx	r3
+    hash_context->finish_hash(hash_context, result);
+ 8005a6e:	68a3      	ldr	r3, [r4, #8]
+ 8005a70:	4629      	mov	r1, r5
+ 8005a72:	4620      	mov	r0, r4
+}
+ 8005a74:	e8bd 4070 	ldmia.w	sp!, {r4, r5, r6, lr}
+    hash_context->finish_hash(hash_context, result);
+ 8005a78:	4718      	bx	r3
+        pad[i] = K[i] ^ 0x5c;
+ 8005a7a:	5cca      	ldrb	r2, [r1, r3]
+ 8005a7c:	f082 025c 	eor.w	r2, r2, #92	; 0x5c
+ 8005a80:	54f2      	strb	r2, [r6, r3]
+    for (i = 0; i < hash_context->result_size; ++i)
+ 8005a82:	3301      	adds	r3, #1
+ 8005a84:	e7db      	b.n	8005a3e <HMAC_finish+0x10>
+        pad[i] = 0x5c;
+ 8005a86:	54f1      	strb	r1, [r6, r3]
+    for (; i < hash_context->block_size; ++i)
+ 8005a88:	3301      	adds	r3, #1
+ 8005a8a:	e7dc      	b.n	8005a46 <HMAC_finish+0x18>
+
+08005a8c <update_V>:
+
+/* V = HMAC_K(V) */
+static void update_V(uECC_HashContext *hash_context, uint8_t *K, uint8_t *V) {
+ 8005a8c:	b570      	push	{r4, r5, r6, lr}
+ 8005a8e:	4604      	mov	r4, r0
+ 8005a90:	4615      	mov	r5, r2
+ 8005a92:	460e      	mov	r6, r1
+    HMAC_init(hash_context, K);
+ 8005a94:	f7ff ffa8 	bl	80059e8 <HMAC_init>
+    HMAC_update(hash_context, V, hash_context->result_size);
+ 8005a98:	6922      	ldr	r2, [r4, #16]
+ 8005a9a:	4629      	mov	r1, r5
+ 8005a9c:	4620      	mov	r0, r4
+ 8005a9e:	f7ff ffc4 	bl	8005a2a <HMAC_update>
+    HMAC_finish(hash_context, K, V);
+ 8005aa2:	462a      	mov	r2, r5
+ 8005aa4:	4631      	mov	r1, r6
+ 8005aa6:	4620      	mov	r0, r4
+}
+ 8005aa8:	e8bd 4070 	ldmia.w	sp!, {r4, r5, r6, lr}
+    HMAC_finish(hash_context, K, V);
+ 8005aac:	f7ff bfbf 	b.w	8005a2e <HMAC_finish>
+
+08005ab0 <uECC_vli_sub.constprop.0>:
+uECC_VLI_API uECC_word_t uECC_vli_sub(uECC_word_t *result,
+ 8005ab0:	b530      	push	{r4, r5, lr}
+    __asm__ volatile (
+ 8005ab2:	2300      	movs	r3, #0
+ 8005ab4:	c910      	ldmia	r1!, {r4}
+ 8005ab6:	ca20      	ldmia	r2!, {r5}
+ 8005ab8:	1b64      	subs	r4, r4, r5
+ 8005aba:	c010      	stmia	r0!, {r4}
+ 8005abc:	c910      	ldmia	r1!, {r4}
+ 8005abe:	ca20      	ldmia	r2!, {r5}
+ 8005ac0:	41ac      	sbcs	r4, r5
+ 8005ac2:	c010      	stmia	r0!, {r4}
+ 8005ac4:	c910      	ldmia	r1!, {r4}
+ 8005ac6:	ca20      	ldmia	r2!, {r5}
+ 8005ac8:	41ac      	sbcs	r4, r5
+ 8005aca:	c010      	stmia	r0!, {r4}
+ 8005acc:	c910      	ldmia	r1!, {r4}
+ 8005ace:	ca20      	ldmia	r2!, {r5}
+ 8005ad0:	41ac      	sbcs	r4, r5
+ 8005ad2:	c010      	stmia	r0!, {r4}
+ 8005ad4:	c910      	ldmia	r1!, {r4}
+ 8005ad6:	ca20      	ldmia	r2!, {r5}
+ 8005ad8:	41ac      	sbcs	r4, r5
+ 8005ada:	c010      	stmia	r0!, {r4}
+ 8005adc:	c910      	ldmia	r1!, {r4}
+ 8005ade:	ca20      	ldmia	r2!, {r5}
+ 8005ae0:	41ac      	sbcs	r4, r5
+ 8005ae2:	c010      	stmia	r0!, {r4}
+ 8005ae4:	c910      	ldmia	r1!, {r4}
+ 8005ae6:	ca20      	ldmia	r2!, {r5}
+ 8005ae8:	41ac      	sbcs	r4, r5
+ 8005aea:	c010      	stmia	r0!, {r4}
+ 8005aec:	c910      	ldmia	r1!, {r4}
+ 8005aee:	ca20      	ldmia	r2!, {r5}
+ 8005af0:	41ac      	sbcs	r4, r5
+ 8005af2:	c010      	stmia	r0!, {r4}
+ 8005af4:	415b      	adcs	r3, r3
+}
+ 8005af6:	fab3 f083 	clz	r0, r3
+ 8005afa:	0940      	lsrs	r0, r0, #5
+ 8005afc:	bd30      	pop	{r4, r5, pc}
+
+08005afe <bits2int>:
+                     uECC_Curve curve) {
+ 8005afe:	e92d 43f8 	stmdb	sp!, {r3, r4, r5, r6, r7, r8, r9, lr}
+ 8005b02:	4698      	mov	r8, r3
+    unsigned num_n_bytes = BITS_TO_BYTES(curve->num_n_bits);
+ 8005b04:	f9b3 3002 	ldrsh.w	r3, [r3, #2]
+    unsigned num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8005b08:	f113 041f 	adds.w	r4, r3, #31
+ 8005b0c:	bf48      	it	mi
+ 8005b0e:	f103 043e 	addmi.w	r4, r3, #62	; 0x3e
+    unsigned num_n_bytes = BITS_TO_BYTES(curve->num_n_bits);
+ 8005b12:	1ddd      	adds	r5, r3, #7
+ 8005b14:	bf48      	it	mi
+ 8005b16:	f103 050e 	addmi.w	r5, r3, #14
+    unsigned num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8005b1a:	1166      	asrs	r6, r4, #5
+    unsigned num_n_bytes = BITS_TO_BYTES(curve->num_n_bits);
+ 8005b1c:	10ec      	asrs	r4, r5, #3
+ 8005b1e:	4294      	cmp	r4, r2
+    uECC_vli_clear(native, num_n_words);
+ 8005b20:	b275      	sxtb	r5, r6
+ 8005b22:	bf28      	it	cs
+ 8005b24:	4614      	movcs	r4, r2
+                     uECC_Curve curve) {
+ 8005b26:	4607      	mov	r7, r0
+ 8005b28:	4689      	mov	r9, r1
+    uECC_vli_clear(native, num_n_words);
+ 8005b2a:	4629      	mov	r1, r5
+ 8005b2c:	f7ff fde8 	bl	8005700 <uECC_vli_clear>
+    uECC_vli_bytesToNative(native, bits, bits_size);
+ 8005b30:	4622      	mov	r2, r4
+ 8005b32:	4649      	mov	r1, r9
+ 8005b34:	4638      	mov	r0, r7
+ 8005b36:	f7ff ff37 	bl	80059a8 <uECC_vli_bytesToNative>
+    if (bits_size * 8 <= (unsigned)curve->num_n_bits) {
+ 8005b3a:	f9b8 2002 	ldrsh.w	r2, [r8, #2]
+ 8005b3e:	ebb2 0fc4 	cmp.w	r2, r4, lsl #3
+ 8005b42:	ea4f 03c4 	mov.w	r3, r4, lsl #3
+ 8005b46:	d21f      	bcs.n	8005b88 <bits2int+0x8a>
+    int shift = bits_size * 8 - curve->num_n_bits;
+ 8005b48:	1a9b      	subs	r3, r3, r2
+    uECC_word_t *ptr = native + num_n_words;
+ 8005b4a:	eb07 0486 	add.w	r4, r7, r6, lsl #2
+    uECC_word_t carry = 0;
+ 8005b4e:	2100      	movs	r1, #0
+        carry = temp << (uECC_WORD_BITS - shift);
+ 8005b50:	f1c3 0620 	rsb	r6, r3, #32
+    while (ptr-- > native) {
+ 8005b54:	42a7      	cmp	r7, r4
+ 8005b56:	d30e      	bcc.n	8005b76 <bits2int+0x78>
+    if (uECC_vli_cmp_unsafe(curve->n, native, num_n_words) != 1) {
+ 8005b58:	f108 0824 	add.w	r8, r8, #36	; 0x24
+ 8005b5c:	462a      	mov	r2, r5
+ 8005b5e:	4639      	mov	r1, r7
+ 8005b60:	4640      	mov	r0, r8
+ 8005b62:	f7ff fe18 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 8005b66:	2801      	cmp	r0, #1
+ 8005b68:	d00e      	beq.n	8005b88 <bits2int+0x8a>
+        uECC_vli_sub(native, native, curve->n, num_n_words);
+ 8005b6a:	4642      	mov	r2, r8
+ 8005b6c:	4638      	mov	r0, r7
+}
+ 8005b6e:	e8bd 43f8 	ldmia.w	sp!, {r3, r4, r5, r6, r7, r8, r9, lr}
+        uECC_vli_sub(native, native, curve->n, num_n_words);
+ 8005b72:	f7ff bf9d 	b.w	8005ab0 <uECC_vli_sub.constprop.0>
+        uECC_word_t temp = *ptr;
+ 8005b76:	f854 0d04 	ldr.w	r0, [r4, #-4]!
+        *ptr = (temp >> shift) | carry;
+ 8005b7a:	fa20 f203 	lsr.w	r2, r0, r3
+ 8005b7e:	430a      	orrs	r2, r1
+ 8005b80:	6022      	str	r2, [r4, #0]
+        carry = temp << (uECC_WORD_BITS - shift);
+ 8005b82:	fa00 f106 	lsl.w	r1, r0, r6
+ 8005b86:	e7e5      	b.n	8005b54 <bits2int+0x56>
+}
+ 8005b88:	e8bd 83f8 	ldmia.w	sp!, {r3, r4, r5, r6, r7, r8, r9, pc}
+
+08005b8c <uECC_vli_cmp>:
+                                      wordcount_t num_words) {
+ 8005b8c:	b530      	push	{r4, r5, lr}
+ 8005b8e:	b089      	sub	sp, #36	; 0x24
+ 8005b90:	4615      	mov	r5, r2
+    uECC_word_t neg = !!uECC_vli_sub(tmp, left, right, num_words);
+ 8005b92:	460a      	mov	r2, r1
+ 8005b94:	4601      	mov	r1, r0
+ 8005b96:	4668      	mov	r0, sp
+ 8005b98:	f7ff ff8a 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    uECC_word_t equal = uECC_vli_isZero(tmp, num_words);
+ 8005b9c:	4629      	mov	r1, r5
+    uECC_word_t neg = !!uECC_vli_sub(tmp, left, right, num_words);
+ 8005b9e:	4604      	mov	r4, r0
+    uECC_word_t equal = uECC_vli_isZero(tmp, num_words);
+ 8005ba0:	4668      	mov	r0, sp
+ 8005ba2:	f7ff fdb3 	bl	800570c <uECC_vli_isZero>
+    uECC_word_t neg = !!uECC_vli_sub(tmp, left, right, num_words);
+ 8005ba6:	3c00      	subs	r4, #0
+ 8005ba8:	bf18      	it	ne
+ 8005baa:	2401      	movne	r4, #1
+    return (!equal - 2 * neg);
+ 8005bac:	0064      	lsls	r4, r4, #1
+}
+ 8005bae:	2800      	cmp	r0, #0
+ 8005bb0:	bf14      	ite	ne
+ 8005bb2:	4260      	negne	r0, r4
+ 8005bb4:	f1c4 0001 	rsbeq	r0, r4, #1
+ 8005bb8:	b009      	add	sp, #36	; 0x24
+ 8005bba:	bd30      	pop	{r4, r5, pc}
+
+08005bbc <uECC_generate_random_int>:
+                                          wordcount_t num_words) {
+ 8005bbc:	e92d 4ff8 	stmdb	sp!, {r3, r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 8005bc0:	460f      	mov	r7, r1
+    if (!g_rng_function) {
+ 8005bc2:	f8df a06c 	ldr.w	sl, [pc, #108]	; 8005c30 <uECC_generate_random_int+0x74>
+                                          wordcount_t num_words) {
+ 8005bc6:	4606      	mov	r6, r0
+    bitcount_t num_bits = uECC_vli_numBits(top, num_words);
+ 8005bc8:	4611      	mov	r1, r2
+ 8005bca:	4638      	mov	r0, r7
+                                          wordcount_t num_words) {
+ 8005bcc:	4614      	mov	r4, r2
+    bitcount_t num_bits = uECC_vli_numBits(top, num_words);
+ 8005bce:	f7ff fdb6 	bl	800573e <uECC_vli_numBits>
+    if (!g_rng_function) {
+ 8005bd2:	f8da 3000 	ldr.w	r3, [sl]
+ 8005bd6:	b303      	cbz	r3, 8005c1a <uECC_generate_random_int+0x5e>
+        if (!g_rng_function((uint8_t *)random, num_words * uECC_WORD_SIZE)) {
+ 8005bd8:	2504      	movs	r5, #4
+        random[num_words - 1] &= mask >> ((bitcount_t)(num_words * uECC_WORD_SIZE * 8 - num_bits));
+ 8005bda:	ebc0 1044 	rsb	r0, r0, r4, lsl #5
+        if (!g_rng_function((uint8_t *)random, num_words * uECC_WORD_SIZE)) {
+ 8005bde:	fb14 fb05 	smulbb	fp, r4, r5
+        random[num_words - 1] &= mask >> ((bitcount_t)(num_words * uECC_WORD_SIZE * 8 - num_bits));
+ 8005be2:	b200      	sxth	r0, r0
+ 8005be4:	fb05 6504 	mla	r5, r5, r4, r6
+ 8005be8:	f04f 38ff 	mov.w	r8, #4294967295	; 0xffffffff
+ 8005bec:	3d04      	subs	r5, #4
+ 8005bee:	fa28 f800 	lsr.w	r8, r8, r0
+ 8005bf2:	f04f 0940 	mov.w	r9, #64	; 0x40
+        if (!g_rng_function((uint8_t *)random, num_words * uECC_WORD_SIZE)) {
+ 8005bf6:	f8da 3000 	ldr.w	r3, [sl]
+ 8005bfa:	4659      	mov	r1, fp
+ 8005bfc:	4630      	mov	r0, r6
+ 8005bfe:	4798      	blx	r3
+ 8005c00:	b158      	cbz	r0, 8005c1a <uECC_generate_random_int+0x5e>
+        random[num_words - 1] &= mask >> ((bitcount_t)(num_words * uECC_WORD_SIZE * 8 - num_bits));
+ 8005c02:	682b      	ldr	r3, [r5, #0]
+ 8005c04:	ea03 0308 	and.w	r3, r3, r8
+ 8005c08:	602b      	str	r3, [r5, #0]
+        if (!uECC_vli_isZero(random, num_words) &&
+ 8005c0a:	4621      	mov	r1, r4
+ 8005c0c:	4630      	mov	r0, r6
+ 8005c0e:	f7ff fd7d 	bl	800570c <uECC_vli_isZero>
+ 8005c12:	b120      	cbz	r0, 8005c1e <uECC_generate_random_int+0x62>
+    for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
+ 8005c14:	f1b9 0901 	subs.w	r9, r9, #1
+ 8005c18:	d1ed      	bne.n	8005bf6 <uECC_generate_random_int+0x3a>
+        return 0;
+ 8005c1a:	2000      	movs	r0, #0
+ 8005c1c:	e006      	b.n	8005c2c <uECC_generate_random_int+0x70>
+		        uECC_vli_cmp(top, random, num_words) == 1) {
+ 8005c1e:	4622      	mov	r2, r4
+ 8005c20:	4631      	mov	r1, r6
+ 8005c22:	4638      	mov	r0, r7
+ 8005c24:	f7ff ffb2 	bl	8005b8c <uECC_vli_cmp>
+        if (!uECC_vli_isZero(random, num_words) &&
+ 8005c28:	2801      	cmp	r0, #1
+ 8005c2a:	d1f3      	bne.n	8005c14 <uECC_generate_random_int+0x58>
+}
+ 8005c2c:	e8bd 8ff8 	ldmia.w	sp!, {r3, r4, r5, r6, r7, r8, r9, sl, fp, pc}
+ 8005c30:	2009e2a0 	.word	0x2009e2a0
+
+08005c34 <uECC_vli_add.constprop.0>:
+uECC_VLI_API uECC_word_t uECC_vli_add(uECC_word_t *result,
+ 8005c34:	b530      	push	{r4, r5, lr}
+    __asm__ volatile (
+ 8005c36:	4603      	mov	r3, r0
+ 8005c38:	2000      	movs	r0, #0
+ 8005c3a:	c910      	ldmia	r1!, {r4}
+ 8005c3c:	ca20      	ldmia	r2!, {r5}
+ 8005c3e:	1964      	adds	r4, r4, r5
+ 8005c40:	c310      	stmia	r3!, {r4}
+ 8005c42:	c910      	ldmia	r1!, {r4}
+ 8005c44:	ca20      	ldmia	r2!, {r5}
+ 8005c46:	416c      	adcs	r4, r5
+ 8005c48:	c310      	stmia	r3!, {r4}
+ 8005c4a:	c910      	ldmia	r1!, {r4}
+ 8005c4c:	ca20      	ldmia	r2!, {r5}
+ 8005c4e:	416c      	adcs	r4, r5
+ 8005c50:	c310      	stmia	r3!, {r4}
+ 8005c52:	c910      	ldmia	r1!, {r4}
+ 8005c54:	ca20      	ldmia	r2!, {r5}
+ 8005c56:	416c      	adcs	r4, r5
+ 8005c58:	c310      	stmia	r3!, {r4}
+ 8005c5a:	c910      	ldmia	r1!, {r4}
+ 8005c5c:	ca20      	ldmia	r2!, {r5}
+ 8005c5e:	416c      	adcs	r4, r5
+ 8005c60:	c310      	stmia	r3!, {r4}
+ 8005c62:	c910      	ldmia	r1!, {r4}
+ 8005c64:	ca20      	ldmia	r2!, {r5}
+ 8005c66:	416c      	adcs	r4, r5
+ 8005c68:	c310      	stmia	r3!, {r4}
+ 8005c6a:	c910      	ldmia	r1!, {r4}
+ 8005c6c:	ca20      	ldmia	r2!, {r5}
+ 8005c6e:	416c      	adcs	r4, r5
+ 8005c70:	c310      	stmia	r3!, {r4}
+ 8005c72:	c910      	ldmia	r1!, {r4}
+ 8005c74:	ca20      	ldmia	r2!, {r5}
+ 8005c76:	416c      	adcs	r4, r5
+ 8005c78:	c310      	stmia	r3!, {r4}
+ 8005c7a:	4140      	adcs	r0, r0
+}
+ 8005c7c:	bd30      	pop	{r4, r5, pc}
+
+08005c7e <regularize_k>:
+                                uECC_Curve curve) {
+ 8005c7e:	b573      	push	{r0, r1, r4, r5, r6, lr}
+ 8005c80:	460d      	mov	r5, r1
+ 8005c82:	4616      	mov	r6, r2
+    uECC_word_t carry = uECC_vli_add(k0, k, curve->n, num_n_words) ||
+ 8005c84:	4601      	mov	r1, r0
+ 8005c86:	f103 0224 	add.w	r2, r3, #36	; 0x24
+ 8005c8a:	4628      	mov	r0, r5
+ 8005c8c:	9201      	str	r2, [sp, #4]
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8005c8e:	f9b3 4002 	ldrsh.w	r4, [r3, #2]
+    uECC_word_t carry = uECC_vli_add(k0, k, curve->n, num_n_words) ||
+ 8005c92:	f7ff ffcf 	bl	8005c34 <uECC_vli_add.constprop.0>
+ 8005c96:	9a01      	ldr	r2, [sp, #4]
+ 8005c98:	b9c8      	cbnz	r0, 8005cce <regularize_k+0x50>
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8005c9a:	f114 031f 	adds.w	r3, r4, #31
+ 8005c9e:	bf48      	it	mi
+ 8005ca0:	f104 033e 	addmi.w	r3, r4, #62	; 0x3e
+        (num_n_bits < ((bitcount_t)num_n_words * uECC_WORD_SIZE * 8) &&
+ 8005ca4:	f343 1347 	sbfx	r3, r3, #5, #8
+    uECC_word_t carry = uECC_vli_add(k0, k, curve->n, num_n_words) ||
+ 8005ca8:	ebb4 1f43 	cmp.w	r4, r3, lsl #5
+ 8005cac:	da11      	bge.n	8005cd2 <regularize_k+0x54>
+         uECC_vli_testBit(k0, num_n_bits));
+ 8005cae:	4621      	mov	r1, r4
+ 8005cb0:	4628      	mov	r0, r5
+ 8005cb2:	9201      	str	r2, [sp, #4]
+ 8005cb4:	f7ff fd39 	bl	800572a <uECC_vli_testBit>
+ 8005cb8:	9a01      	ldr	r2, [sp, #4]
+        (num_n_bits < ((bitcount_t)num_n_words * uECC_WORD_SIZE * 8) &&
+ 8005cba:	1e04      	subs	r4, r0, #0
+ 8005cbc:	bf18      	it	ne
+ 8005cbe:	2401      	movne	r4, #1
+    uECC_vli_add(k1, k0, curve->n, num_n_words);
+ 8005cc0:	4629      	mov	r1, r5
+ 8005cc2:	4630      	mov	r0, r6
+ 8005cc4:	f7ff ffb6 	bl	8005c34 <uECC_vli_add.constprop.0>
+}
+ 8005cc8:	4620      	mov	r0, r4
+ 8005cca:	b002      	add	sp, #8
+ 8005ccc:	bd70      	pop	{r4, r5, r6, pc}
+    uECC_word_t carry = uECC_vli_add(k0, k, curve->n, num_n_words) ||
+ 8005cce:	2401      	movs	r4, #1
+ 8005cd0:	e7f6      	b.n	8005cc0 <regularize_k+0x42>
+ 8005cd2:	2400      	movs	r4, #0
+ 8005cd4:	e7f4      	b.n	8005cc0 <regularize_k+0x42>
+
+08005cd6 <omega_mult_secp256k1>:
+    /* add the 2^32 multiple */
+    result[4 + num_words_secp256k1] =
+        uECC_vli_add(result + 4, result + 4, right, num_words_secp256k1); 
+}
+#elif uECC_WORD_SIZE == 4
+static void omega_mult_secp256k1(uint32_t * result, const uint32_t * right) {
+ 8005cd6:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+ 8005cd8:	460a      	mov	r2, r1
+    /* Multiply by (2^9 + 2^8 + 2^7 + 2^6 + 2^4 + 1). */
+    uint32_t carry = 0;
+ 8005cda:	2300      	movs	r3, #0
+static void omega_mult_secp256k1(uint32_t * result, const uint32_t * right) {
+ 8005cdc:	4604      	mov	r4, r0
+ 8005cde:	3904      	subs	r1, #4
+ 8005ce0:	3804      	subs	r0, #4
+ 8005ce2:	f102 071c 	add.w	r7, r2, #28
+    wordcount_t k;
+    
+    for (k = 0; k < num_words_secp256k1; ++k) {
+        uint64_t p = (uint64_t)0x3D1 * right[k] + carry;
+ 8005ce6:	469e      	mov	lr, r3
+ 8005ce8:	f240 35d1 	movw	r5, #977	; 0x3d1
+ 8005cec:	f851 6f04 	ldr.w	r6, [r1, #4]!
+ 8005cf0:	46f4      	mov	ip, lr
+ 8005cf2:	fbe6 3c05 	umlal	r3, ip, r6, r5
+    for (k = 0; k < num_words_secp256k1; ++k) {
+ 8005cf6:	428f      	cmp	r7, r1
+        result[k] = p;
+ 8005cf8:	f840 3f04 	str.w	r3, [r0, #4]!
+        carry = p >> 32;
+ 8005cfc:	4663      	mov	r3, ip
+    for (k = 0; k < num_words_secp256k1; ++k) {
+ 8005cfe:	d1f5      	bne.n	8005cec <omega_mult_secp256k1+0x16>
+    }
+    result[num_words_secp256k1] = carry;
+    /* add the 2^32 multiple */
+    result[1 + num_words_secp256k1] =
+        uECC_vli_add(result + 1, result + 1, right, num_words_secp256k1); 
+ 8005d00:	1d21      	adds	r1, r4, #4
+    result[num_words_secp256k1] = carry;
+ 8005d02:	f8c4 c020 	str.w	ip, [r4, #32]
+        uECC_vli_add(result + 1, result + 1, right, num_words_secp256k1); 
+ 8005d06:	4608      	mov	r0, r1
+ 8005d08:	f7ff ff94 	bl	8005c34 <uECC_vli_add.constprop.0>
+    result[1 + num_words_secp256k1] =
+ 8005d0c:	6260      	str	r0, [r4, #36]	; 0x24
+}
+ 8005d0e:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+
+08005d10 <vli_mmod_fast_secp256k1>:
+static void vli_mmod_fast_secp256k1(uECC_word_t *result, uECC_word_t *product) {
+ 8005d10:	b570      	push	{r4, r5, r6, lr}
+ 8005d12:	b090      	sub	sp, #64	; 0x40
+ 8005d14:	460e      	mov	r6, r1
+ 8005d16:	4604      	mov	r4, r0
+    uECC_vli_clear(tmp, num_words_secp256k1);
+ 8005d18:	2108      	movs	r1, #8
+ 8005d1a:	4668      	mov	r0, sp
+ 8005d1c:	f7ff fcf0 	bl	8005700 <uECC_vli_clear>
+    uECC_vli_clear(tmp + num_words_secp256k1, num_words_secp256k1);
+ 8005d20:	2108      	movs	r1, #8
+ 8005d22:	a808      	add	r0, sp, #32
+ 8005d24:	f7ff fcec 	bl	8005700 <uECC_vli_clear>
+    omega_mult_secp256k1(tmp, product + num_words_secp256k1); /* (Rq, q) = q * c */
+ 8005d28:	f106 0120 	add.w	r1, r6, #32
+ 8005d2c:	4668      	mov	r0, sp
+ 8005d2e:	f7ff ffd2 	bl	8005cd6 <omega_mult_secp256k1>
+    carry = uECC_vli_add(result, product, tmp, num_words_secp256k1); /* (C, r) = r + q       */
+ 8005d32:	466a      	mov	r2, sp
+ 8005d34:	4631      	mov	r1, r6
+ 8005d36:	4620      	mov	r0, r4
+ 8005d38:	f7ff ff7c 	bl	8005c34 <uECC_vli_add.constprop.0>
+    uECC_vli_clear(product, num_words_secp256k1);
+ 8005d3c:	2108      	movs	r1, #8
+    carry = uECC_vli_add(result, product, tmp, num_words_secp256k1); /* (C, r) = r + q       */
+ 8005d3e:	4605      	mov	r5, r0
+    uECC_vli_clear(product, num_words_secp256k1);
+ 8005d40:	4630      	mov	r0, r6
+ 8005d42:	f7ff fcdd 	bl	8005700 <uECC_vli_clear>
+    omega_mult_secp256k1(product, tmp + num_words_secp256k1); /* Rq*c */
+ 8005d46:	4630      	mov	r0, r6
+ 8005d48:	a908      	add	r1, sp, #32
+ 8005d4a:	f7ff ffc4 	bl	8005cd6 <omega_mult_secp256k1>
+    carry += uECC_vli_add(result, result, product, num_words_secp256k1); /* (C1, r) = r + Rq*c */
+ 8005d4e:	4632      	mov	r2, r6
+ 8005d50:	4621      	mov	r1, r4
+ 8005d52:	4620      	mov	r0, r4
+ 8005d54:	f7ff ff6e 	bl	8005c34 <uECC_vli_add.constprop.0>
+        uECC_vli_sub(result, result, curve_secp256k1.p, num_words_secp256k1);
+ 8005d58:	4e0b      	ldr	r6, [pc, #44]	; (8005d88 <vli_mmod_fast_secp256k1+0x78>)
+    carry += uECC_vli_add(result, result, product, num_words_secp256k1); /* (C1, r) = r + Rq*c */
+ 8005d5a:	4405      	add	r5, r0
+    while (carry > 0) {
+ 8005d5c:	b96d      	cbnz	r5, 8005d7a <vli_mmod_fast_secp256k1+0x6a>
+    if (uECC_vli_cmp_unsafe(result, curve_secp256k1.p, num_words_secp256k1) > 0) {
+ 8005d5e:	490a      	ldr	r1, [pc, #40]	; (8005d88 <vli_mmod_fast_secp256k1+0x78>)
+ 8005d60:	2208      	movs	r2, #8
+ 8005d62:	4620      	mov	r0, r4
+ 8005d64:	f7ff fd17 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 8005d68:	2800      	cmp	r0, #0
+ 8005d6a:	dd04      	ble.n	8005d76 <vli_mmod_fast_secp256k1+0x66>
+        uECC_vli_sub(result, result, curve_secp256k1.p, num_words_secp256k1);
+ 8005d6c:	460a      	mov	r2, r1
+ 8005d6e:	4620      	mov	r0, r4
+ 8005d70:	4621      	mov	r1, r4
+ 8005d72:	f7ff fe9d 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+}
+ 8005d76:	b010      	add	sp, #64	; 0x40
+ 8005d78:	bd70      	pop	{r4, r5, r6, pc}
+        uECC_vli_sub(result, result, curve_secp256k1.p, num_words_secp256k1);
+ 8005d7a:	4632      	mov	r2, r6
+ 8005d7c:	4621      	mov	r1, r4
+ 8005d7e:	4620      	mov	r0, r4
+        --carry;
+ 8005d80:	3d01      	subs	r5, #1
+        uECC_vli_sub(result, result, curve_secp256k1.p, num_words_secp256k1);
+ 8005d82:	f7ff fe95 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+ 8005d86:	e7e9      	b.n	8005d5c <vli_mmod_fast_secp256k1+0x4c>
+ 8005d88:	0800e900 	.word	0x0800e900
+
+08005d8c <vli_mmod_fast_secp256r1>:
+static void vli_mmod_fast_secp256r1(uint32_t *result, uint32_t *product) {
+ 8005d8c:	e92d 44f0 	stmdb	sp!, {r4, r5, r6, r7, sl, lr}
+    uECC_vli_set(result, product, num_words_secp256r1);
+ 8005d90:	2208      	movs	r2, #8
+static void vli_mmod_fast_secp256r1(uint32_t *result, uint32_t *product) {
+ 8005d92:	b088      	sub	sp, #32
+    uECC_vli_set(result, product, num_words_secp256r1);
+ 8005d94:	f7ff fcf3 	bl	800577e <uECC_vli_set>
+    tmp[3] = product[11];
+ 8005d98:	6acb      	ldr	r3, [r1, #44]	; 0x2c
+ 8005d9a:	9303      	str	r3, [sp, #12]
+    tmp[4] = product[12];
+ 8005d9c:	6b0b      	ldr	r3, [r1, #48]	; 0x30
+ 8005d9e:	9304      	str	r3, [sp, #16]
+    tmp[5] = product[13];
+ 8005da0:	6b4b      	ldr	r3, [r1, #52]	; 0x34
+ 8005da2:	9305      	str	r3, [sp, #20]
+    tmp[6] = product[14];
+ 8005da4:	6b8b      	ldr	r3, [r1, #56]	; 0x38
+ 8005da6:	9306      	str	r3, [sp, #24]
+static void vli_mmod_fast_secp256r1(uint32_t *result, uint32_t *product) {
+ 8005da8:	460c      	mov	r4, r1
+ 8005daa:	4682      	mov	sl, r0
+    tmp[0] = tmp[1] = tmp[2] = 0;
+ 8005dac:	2700      	movs	r7, #0
+    tmp[7] = product[15];
+ 8005dae:	6bcb      	ldr	r3, [r1, #60]	; 0x3c
+ 8005db0:	9307      	str	r3, [sp, #28]
+    carry = uECC_vli_add(tmp, tmp, tmp, num_words_secp256r1);
+ 8005db2:	466a      	mov	r2, sp
+ 8005db4:	4669      	mov	r1, sp
+ 8005db6:	4668      	mov	r0, sp
+    tmp[0] = tmp[1] = tmp[2] = 0;
+ 8005db8:	e9cd 7701 	strd	r7, r7, [sp, #4]
+ 8005dbc:	9700      	str	r7, [sp, #0]
+    carry = uECC_vli_add(tmp, tmp, tmp, num_words_secp256r1);
+ 8005dbe:	f7ff ff39 	bl	8005c34 <uECC_vli_add.constprop.0>
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005dc2:	466a      	mov	r2, sp
+    carry = uECC_vli_add(tmp, tmp, tmp, num_words_secp256r1);
+ 8005dc4:	4605      	mov	r5, r0
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005dc6:	4651      	mov	r1, sl
+ 8005dc8:	4650      	mov	r0, sl
+ 8005dca:	f7ff ff33 	bl	8005c34 <uECC_vli_add.constprop.0>
+    tmp[3] = product[12];
+ 8005dce:	6b23      	ldr	r3, [r4, #48]	; 0x30
+ 8005dd0:	9303      	str	r3, [sp, #12]
+    tmp[4] = product[13];
+ 8005dd2:	6b63      	ldr	r3, [r4, #52]	; 0x34
+ 8005dd4:	9304      	str	r3, [sp, #16]
+    tmp[5] = product[14];
+ 8005dd6:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 8005dd8:	9305      	str	r3, [sp, #20]
+    tmp[6] = product[15];
+ 8005dda:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005ddc:	4405      	add	r5, r0
+    carry += uECC_vli_add(tmp, tmp, tmp, num_words_secp256r1);
+ 8005dde:	466a      	mov	r2, sp
+ 8005de0:	4669      	mov	r1, sp
+ 8005de2:	4668      	mov	r0, sp
+    tmp[7] = 0;
+ 8005de4:	e9cd 3706 	strd	r3, r7, [sp, #24]
+    carry += uECC_vli_add(tmp, tmp, tmp, num_words_secp256r1);
+ 8005de8:	f7ff ff24 	bl	8005c34 <uECC_vli_add.constprop.0>
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005dec:	466a      	mov	r2, sp
+    carry += uECC_vli_add(tmp, tmp, tmp, num_words_secp256r1);
+ 8005dee:	4405      	add	r5, r0
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005df0:	4651      	mov	r1, sl
+ 8005df2:	4650      	mov	r0, sl
+ 8005df4:	f7ff ff1e 	bl	8005c34 <uECC_vli_add.constprop.0>
+    tmp[0] = product[8];
+ 8005df8:	6a23      	ldr	r3, [r4, #32]
+ 8005dfa:	9300      	str	r3, [sp, #0]
+    tmp[1] = product[9];
+ 8005dfc:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 8005dfe:	9301      	str	r3, [sp, #4]
+    tmp[2] = product[10];
+ 8005e00:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 8005e02:	9302      	str	r3, [sp, #8]
+    tmp[6] = product[14];
+ 8005e04:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 8005e06:	9306      	str	r3, [sp, #24]
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005e08:	4405      	add	r5, r0
+    tmp[7] = product[15];
+ 8005e0a:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 8005e0c:	9307      	str	r3, [sp, #28]
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005e0e:	466a      	mov	r2, sp
+ 8005e10:	4651      	mov	r1, sl
+ 8005e12:	4650      	mov	r0, sl
+    tmp[3] = tmp[4] = tmp[5] = 0;
+ 8005e14:	e9cd 7704 	strd	r7, r7, [sp, #16]
+ 8005e18:	9703      	str	r7, [sp, #12]
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005e1a:	f7ff ff0b 	bl	8005c34 <uECC_vli_add.constprop.0>
+    tmp[0] = product[9];
+ 8005e1e:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 8005e20:	9300      	str	r3, [sp, #0]
+    tmp[1] = product[10];
+ 8005e22:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+    tmp[4] = product[14];
+ 8005e24:	6ba2      	ldr	r2, [r4, #56]	; 0x38
+    tmp[1] = product[10];
+ 8005e26:	9301      	str	r3, [sp, #4]
+    tmp[2] = product[11];
+ 8005e28:	6ae3      	ldr	r3, [r4, #44]	; 0x2c
+ 8005e2a:	9302      	str	r3, [sp, #8]
+    tmp[4] = product[14];
+ 8005e2c:	9204      	str	r2, [sp, #16]
+    tmp[3] = product[13];
+ 8005e2e:	6b63      	ldr	r3, [r4, #52]	; 0x34
+    tmp[5] = product[15];
+ 8005e30:	6be2      	ldr	r2, [r4, #60]	; 0x3c
+    tmp[3] = product[13];
+ 8005e32:	9303      	str	r3, [sp, #12]
+    tmp[6] = product[13];
+ 8005e34:	e9cd 2305 	strd	r2, r3, [sp, #20]
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005e38:	182e      	adds	r6, r5, r0
+    tmp[7] = product[8];
+ 8005e3a:	6a23      	ldr	r3, [r4, #32]
+ 8005e3c:	9307      	str	r3, [sp, #28]
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005e3e:	466a      	mov	r2, sp
+ 8005e40:	4651      	mov	r1, sl
+ 8005e42:	4650      	mov	r0, sl
+ 8005e44:	f7ff fef6 	bl	8005c34 <uECC_vli_add.constprop.0>
+    tmp[0] = product[11];
+ 8005e48:	6ae3      	ldr	r3, [r4, #44]	; 0x2c
+ 8005e4a:	9300      	str	r3, [sp, #0]
+    tmp[1] = product[12];
+ 8005e4c:	6b23      	ldr	r3, [r4, #48]	; 0x30
+ 8005e4e:	9301      	str	r3, [sp, #4]
+    tmp[2] = product[13];
+ 8005e50:	6b63      	ldr	r3, [r4, #52]	; 0x34
+ 8005e52:	9302      	str	r3, [sp, #8]
+    tmp[6] = product[8];
+ 8005e54:	6a23      	ldr	r3, [r4, #32]
+ 8005e56:	9306      	str	r3, [sp, #24]
+    carry += uECC_vli_add(result, result, tmp, num_words_secp256r1);
+ 8005e58:	1835      	adds	r5, r6, r0
+    tmp[7] = product[10];
+ 8005e5a:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 8005e5c:	9307      	str	r3, [sp, #28]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005e5e:	466a      	mov	r2, sp
+ 8005e60:	4651      	mov	r1, sl
+ 8005e62:	4650      	mov	r0, sl
+    tmp[3] = tmp[4] = tmp[5] = 0;
+ 8005e64:	e9cd 7704 	strd	r7, r7, [sp, #16]
+ 8005e68:	9703      	str	r7, [sp, #12]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005e6a:	f7ff fe21 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    tmp[0] = product[12];
+ 8005e6e:	6b23      	ldr	r3, [r4, #48]	; 0x30
+ 8005e70:	9300      	str	r3, [sp, #0]
+    tmp[1] = product[13];
+ 8005e72:	6b63      	ldr	r3, [r4, #52]	; 0x34
+ 8005e74:	9301      	str	r3, [sp, #4]
+    tmp[2] = product[14];
+ 8005e76:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 8005e78:	9302      	str	r3, [sp, #8]
+    tmp[3] = product[15];
+ 8005e7a:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 8005e7c:	9303      	str	r3, [sp, #12]
+    tmp[6] = product[9];
+ 8005e7e:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 8005e80:	9306      	str	r3, [sp, #24]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005e82:	1a2e      	subs	r6, r5, r0
+    tmp[7] = product[11];
+ 8005e84:	6ae3      	ldr	r3, [r4, #44]	; 0x2c
+ 8005e86:	9307      	str	r3, [sp, #28]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005e88:	466a      	mov	r2, sp
+ 8005e8a:	4651      	mov	r1, sl
+ 8005e8c:	4650      	mov	r0, sl
+    tmp[4] = tmp[5] = 0;
+ 8005e8e:	e9cd 7704 	strd	r7, r7, [sp, #16]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005e92:	f7ff fe0d 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    tmp[0] = product[13];
+ 8005e96:	6b63      	ldr	r3, [r4, #52]	; 0x34
+ 8005e98:	9300      	str	r3, [sp, #0]
+    tmp[1] = product[14];
+ 8005e9a:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 8005e9c:	9301      	str	r3, [sp, #4]
+    tmp[2] = product[15];
+ 8005e9e:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 8005ea0:	9302      	str	r3, [sp, #8]
+    tmp[3] = product[8];
+ 8005ea2:	6a23      	ldr	r3, [r4, #32]
+ 8005ea4:	9303      	str	r3, [sp, #12]
+    tmp[4] = product[9];
+ 8005ea6:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 8005ea8:	9304      	str	r3, [sp, #16]
+    tmp[5] = product[10];
+ 8005eaa:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005eac:	1a36      	subs	r6, r6, r0
+    tmp[6] = 0;
+ 8005eae:	e9cd 3705 	strd	r3, r7, [sp, #20]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005eb2:	466a      	mov	r2, sp
+    tmp[7] = product[12];
+ 8005eb4:	6b23      	ldr	r3, [r4, #48]	; 0x30
+ 8005eb6:	9307      	str	r3, [sp, #28]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005eb8:	4651      	mov	r1, sl
+ 8005eba:	4650      	mov	r0, sl
+ 8005ebc:	f7ff fdf8 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    tmp[0] = product[14];
+ 8005ec0:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 8005ec2:	9300      	str	r3, [sp, #0]
+    tmp[1] = product[15];
+ 8005ec4:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+    tmp[2] = 0;
+ 8005ec6:	e9cd 3701 	strd	r3, r7, [sp, #4]
+    tmp[3] = product[9];
+ 8005eca:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 8005ecc:	9303      	str	r3, [sp, #12]
+    tmp[4] = product[10];
+ 8005ece:	6aa3      	ldr	r3, [r4, #40]	; 0x28
+ 8005ed0:	9304      	str	r3, [sp, #16]
+    tmp[5] = product[11];
+ 8005ed2:	6ae3      	ldr	r3, [r4, #44]	; 0x2c
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005ed4:	1a36      	subs	r6, r6, r0
+    tmp[6] = 0;
+ 8005ed6:	e9cd 3705 	strd	r3, r7, [sp, #20]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005eda:	466a      	mov	r2, sp
+    tmp[7] = product[13];
+ 8005edc:	6b63      	ldr	r3, [r4, #52]	; 0x34
+ 8005ede:	9307      	str	r3, [sp, #28]
+    carry -= uECC_vli_sub(result, result, tmp, num_words_secp256r1);
+ 8005ee0:	4651      	mov	r1, sl
+ 8005ee2:	4650      	mov	r0, sl
+ 8005ee4:	f7ff fde4 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    if (carry < 0) {
+ 8005ee8:	1a36      	subs	r6, r6, r0
+            carry += uECC_vli_add(result, result, curve_secp256r1.p, num_words_secp256r1);
+ 8005eea:	4c0d      	ldr	r4, [pc, #52]	; (8005f20 <vli_mmod_fast_secp256r1+0x194>)
+    if (carry < 0) {
+ 8005eec:	d40e      	bmi.n	8005f0c <vli_mmod_fast_secp256r1+0x180>
+        while (carry || uECC_vli_cmp_unsafe(curve_secp256r1.p, result, num_words_secp256r1) != 1) {
+ 8005eee:	b936      	cbnz	r6, 8005efe <vli_mmod_fast_secp256r1+0x172>
+ 8005ef0:	2208      	movs	r2, #8
+ 8005ef2:	4651      	mov	r1, sl
+ 8005ef4:	4620      	mov	r0, r4
+ 8005ef6:	f7ff fc4e 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 8005efa:	2801      	cmp	r0, #1
+ 8005efc:	d00d      	beq.n	8005f1a <vli_mmod_fast_secp256r1+0x18e>
+            carry -= uECC_vli_sub(result, result, curve_secp256r1.p, num_words_secp256r1);
+ 8005efe:	4622      	mov	r2, r4
+ 8005f00:	4651      	mov	r1, sl
+ 8005f02:	4650      	mov	r0, sl
+ 8005f04:	f7ff fdd4 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+ 8005f08:	1a36      	subs	r6, r6, r0
+ 8005f0a:	e7f0      	b.n	8005eee <vli_mmod_fast_secp256r1+0x162>
+            carry += uECC_vli_add(result, result, curve_secp256r1.p, num_words_secp256r1);
+ 8005f0c:	4622      	mov	r2, r4
+ 8005f0e:	4651      	mov	r1, sl
+ 8005f10:	4650      	mov	r0, sl
+ 8005f12:	f7ff fe8f 	bl	8005c34 <uECC_vli_add.constprop.0>
+        } while (carry < 0);
+ 8005f16:	1836      	adds	r6, r6, r0
+ 8005f18:	d4f8      	bmi.n	8005f0c <vli_mmod_fast_secp256r1+0x180>
+}
+ 8005f1a:	b008      	add	sp, #32
+ 8005f1c:	e8bd 84f0 	ldmia.w	sp!, {r4, r5, r6, r7, sl, pc}
+ 8005f20:	0800e9b4 	.word	0x0800e9b4
+
+08005f24 <mod_sqrt_default>:
+static void mod_sqrt_default(uECC_word_t *a, uECC_Curve curve) {
+ 8005f24:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8005f26:	b091      	sub	sp, #68	; 0x44
+ 8005f28:	460d      	mov	r5, r1
+    uECC_word_t p1[uECC_MAX_WORDS] = {1};
+ 8005f2a:	221c      	movs	r2, #28
+ 8005f2c:	2100      	movs	r1, #0
+static void mod_sqrt_default(uECC_word_t *a, uECC_Curve curve) {
+ 8005f2e:	4606      	mov	r6, r0
+    uECC_word_t p1[uECC_MAX_WORDS] = {1};
+ 8005f30:	a801      	add	r0, sp, #4
+ 8005f32:	f007 fbd1 	bl	800d6d8 <memset>
+ 8005f36:	2401      	movs	r4, #1
+    uECC_word_t l_result[uECC_MAX_WORDS] = {1};
+ 8005f38:	221c      	movs	r2, #28
+ 8005f3a:	2100      	movs	r1, #0
+ 8005f3c:	a809      	add	r0, sp, #36	; 0x24
+    uECC_word_t p1[uECC_MAX_WORDS] = {1};
+ 8005f3e:	9400      	str	r4, [sp, #0]
+    uECC_word_t l_result[uECC_MAX_WORDS] = {1};
+ 8005f40:	f007 fbca 	bl	800d6d8 <memset>
+    wordcount_t num_words = curve->num_words;
+ 8005f44:	4629      	mov	r1, r5
+    uECC_vli_add(p1, curve->p, p1, num_words); /* p1 = curve_p + 1 */
+ 8005f46:	466a      	mov	r2, sp
+    wordcount_t num_words = curve->num_words;
+ 8005f48:	f911 7b04 	ldrsb.w	r7, [r1], #4
+    uECC_word_t l_result[uECC_MAX_WORDS] = {1};
+ 8005f4c:	9408      	str	r4, [sp, #32]
+    uECC_vli_add(p1, curve->p, p1, num_words); /* p1 = curve_p + 1 */
+ 8005f4e:	4668      	mov	r0, sp
+ 8005f50:	f7ff fe70 	bl	8005c34 <uECC_vli_add.constprop.0>
+    for (i = uECC_vli_numBits(p1, num_words) - 1; i > 1; --i) {
+ 8005f54:	4639      	mov	r1, r7
+ 8005f56:	4668      	mov	r0, sp
+ 8005f58:	f7ff fbf1 	bl	800573e <uECC_vli_numBits>
+ 8005f5c:	1e44      	subs	r4, r0, #1
+ 8005f5e:	b224      	sxth	r4, r4
+ 8005f60:	2c01      	cmp	r4, #1
+ 8005f62:	dc06      	bgt.n	8005f72 <mod_sqrt_default+0x4e>
+    uECC_vli_set(a, l_result, num_words);
+ 8005f64:	463a      	mov	r2, r7
+ 8005f66:	a908      	add	r1, sp, #32
+ 8005f68:	4630      	mov	r0, r6
+ 8005f6a:	f7ff fc08 	bl	800577e <uECC_vli_set>
+}
+ 8005f6e:	b011      	add	sp, #68	; 0x44
+ 8005f70:	bdf0      	pop	{r4, r5, r6, r7, pc}
+        uECC_vli_modSquare_fast(l_result, l_result, curve);
+ 8005f72:	a908      	add	r1, sp, #32
+ 8005f74:	4608      	mov	r0, r1
+ 8005f76:	462a      	mov	r2, r5
+ 8005f78:	f7ff fcdf 	bl	800593a <uECC_vli_modSquare_fast>
+        if (uECC_vli_testBit(p1, i)) {
+ 8005f7c:	4621      	mov	r1, r4
+ 8005f7e:	4668      	mov	r0, sp
+ 8005f80:	f7ff fbd3 	bl	800572a <uECC_vli_testBit>
+ 8005f84:	b128      	cbz	r0, 8005f92 <mod_sqrt_default+0x6e>
+            uECC_vli_modMult_fast(l_result, l_result, a, curve);
+ 8005f86:	a908      	add	r1, sp, #32
+ 8005f88:	462b      	mov	r3, r5
+ 8005f8a:	4632      	mov	r2, r6
+ 8005f8c:	4608      	mov	r0, r1
+ 8005f8e:	f7ff fcc4 	bl	800591a <uECC_vli_modMult_fast>
+    for (i = uECC_vli_numBits(p1, num_words) - 1; i > 1; --i) {
+ 8005f92:	3c01      	subs	r4, #1
+ 8005f94:	e7e3      	b.n	8005f5e <mod_sqrt_default+0x3a>
+
+08005f96 <vli_modInv_update>:
+    if (!EVEN(uv)) {
+ 8005f96:	6803      	ldr	r3, [r0, #0]
+                              wordcount_t num_words) {
+ 8005f98:	b570      	push	{r4, r5, r6, lr}
+    if (!EVEN(uv)) {
+ 8005f9a:	f013 0601 	ands.w	r6, r3, #1
+                              wordcount_t num_words) {
+ 8005f9e:	4605      	mov	r5, r0
+ 8005fa0:	4614      	mov	r4, r2
+    if (!EVEN(uv)) {
+ 8005fa2:	d004      	beq.n	8005fae <vli_modInv_update+0x18>
+        carry = uECC_vli_add(uv, uv, mod, num_words);
+ 8005fa4:	460a      	mov	r2, r1
+ 8005fa6:	4601      	mov	r1, r0
+ 8005fa8:	f7ff fe44 	bl	8005c34 <uECC_vli_add.constprop.0>
+ 8005fac:	4606      	mov	r6, r0
+    uECC_vli_rshift1(uv, num_words);
+ 8005fae:	4621      	mov	r1, r4
+ 8005fb0:	4628      	mov	r0, r5
+ 8005fb2:	f7ff fc05 	bl	80057c0 <uECC_vli_rshift1>
+    if (carry) {
+ 8005fb6:	b146      	cbz	r6, 8005fca <vli_modInv_update+0x34>
+        uv[num_words - 1] |= HIGH_BIT_SET;
+ 8005fb8:	f104 4280 	add.w	r2, r4, #1073741824	; 0x40000000
+ 8005fbc:	3a01      	subs	r2, #1
+ 8005fbe:	f855 3022 	ldr.w	r3, [r5, r2, lsl #2]
+ 8005fc2:	f043 4300 	orr.w	r3, r3, #2147483648	; 0x80000000
+ 8005fc6:	f845 3022 	str.w	r3, [r5, r2, lsl #2]
+}
+ 8005fca:	bd70      	pop	{r4, r5, r6, pc}
+
+08005fcc <uECC_vli_modInv>:
+                                  wordcount_t num_words) {
+ 8005fcc:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8005fce:	460f      	mov	r7, r1
+ 8005fd0:	b0a1      	sub	sp, #132	; 0x84
+ 8005fd2:	4606      	mov	r6, r0
+    if (uECC_vli_isZero(input, num_words)) {
+ 8005fd4:	4619      	mov	r1, r3
+ 8005fd6:	4638      	mov	r0, r7
+                                  wordcount_t num_words) {
+ 8005fd8:	4615      	mov	r5, r2
+ 8005fda:	461c      	mov	r4, r3
+    if (uECC_vli_isZero(input, num_words)) {
+ 8005fdc:	f7ff fb96 	bl	800570c <uECC_vli_isZero>
+ 8005fe0:	b128      	cbz	r0, 8005fee <uECC_vli_modInv+0x22>
+        uECC_vli_clear(result, num_words);
+ 8005fe2:	4630      	mov	r0, r6
+}
+ 8005fe4:	b021      	add	sp, #132	; 0x84
+ 8005fe6:	e8bd 40f0 	ldmia.w	sp!, {r4, r5, r6, r7, lr}
+        uECC_vli_clear(result, num_words);
+ 8005fea:	f7ff bb89 	b.w	8005700 <uECC_vli_clear>
+    uECC_vli_set(a, input, num_words);
+ 8005fee:	4622      	mov	r2, r4
+ 8005ff0:	4639      	mov	r1, r7
+ 8005ff2:	4668      	mov	r0, sp
+ 8005ff4:	f7ff fbc3 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(b, mod, num_words);
+ 8005ff8:	4629      	mov	r1, r5
+ 8005ffa:	a808      	add	r0, sp, #32
+ 8005ffc:	f7ff fbbf 	bl	800577e <uECC_vli_set>
+    uECC_vli_clear(u, num_words);
+ 8006000:	4621      	mov	r1, r4
+ 8006002:	a810      	add	r0, sp, #64	; 0x40
+ 8006004:	f7ff fb7c 	bl	8005700 <uECC_vli_clear>
+    u[0] = 1;
+ 8006008:	2301      	movs	r3, #1
+    uECC_vli_clear(v, num_words);
+ 800600a:	4621      	mov	r1, r4
+ 800600c:	a818      	add	r0, sp, #96	; 0x60
+    u[0] = 1;
+ 800600e:	9310      	str	r3, [sp, #64]	; 0x40
+    uECC_vli_clear(v, num_words);
+ 8006010:	f7ff fb76 	bl	8005700 <uECC_vli_clear>
+    while ((cmpResult = uECC_vli_cmp_unsafe(a, b, num_words)) != 0) {
+ 8006014:	4622      	mov	r2, r4
+ 8006016:	a908      	add	r1, sp, #32
+ 8006018:	4668      	mov	r0, sp
+ 800601a:	f7ff fbbc 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 800601e:	b930      	cbnz	r0, 800602e <uECC_vli_modInv+0x62>
+    uECC_vli_set(result, u, num_words);
+ 8006020:	4622      	mov	r2, r4
+ 8006022:	a910      	add	r1, sp, #64	; 0x40
+ 8006024:	4630      	mov	r0, r6
+ 8006026:	f7ff fbaa 	bl	800577e <uECC_vli_set>
+}
+ 800602a:	b021      	add	sp, #132	; 0x84
+ 800602c:	bdf0      	pop	{r4, r5, r6, r7, pc}
+        if (EVEN(a)) {
+ 800602e:	9b00      	ldr	r3, [sp, #0]
+ 8006030:	07da      	lsls	r2, r3, #31
+ 8006032:	d409      	bmi.n	8006048 <uECC_vli_modInv+0x7c>
+            uECC_vli_rshift1(a, num_words);
+ 8006034:	4621      	mov	r1, r4
+ 8006036:	4668      	mov	r0, sp
+ 8006038:	f7ff fbc2 	bl	80057c0 <uECC_vli_rshift1>
+            vli_modInv_update(u, mod, num_words);
+ 800603c:	4622      	mov	r2, r4
+ 800603e:	4629      	mov	r1, r5
+ 8006040:	a810      	add	r0, sp, #64	; 0x40
+            vli_modInv_update(v, mod, num_words);
+ 8006042:	f7ff ffa8 	bl	8005f96 <vli_modInv_update>
+ 8006046:	e7e5      	b.n	8006014 <uECC_vli_modInv+0x48>
+        } else if (EVEN(b)) {
+ 8006048:	9b08      	ldr	r3, [sp, #32]
+ 800604a:	07db      	lsls	r3, r3, #31
+ 800604c:	d407      	bmi.n	800605e <uECC_vli_modInv+0x92>
+            uECC_vli_rshift1(b, num_words);
+ 800604e:	4621      	mov	r1, r4
+ 8006050:	a808      	add	r0, sp, #32
+ 8006052:	f7ff fbb5 	bl	80057c0 <uECC_vli_rshift1>
+            vli_modInv_update(v, mod, num_words);
+ 8006056:	4622      	mov	r2, r4
+ 8006058:	4629      	mov	r1, r5
+ 800605a:	a818      	add	r0, sp, #96	; 0x60
+ 800605c:	e7f1      	b.n	8006042 <uECC_vli_modInv+0x76>
+        } else if (cmpResult > 0) {
+ 800605e:	2800      	cmp	r0, #0
+ 8006060:	dd1a      	ble.n	8006098 <uECC_vli_modInv+0xcc>
+            uECC_vli_sub(a, a, b, num_words);
+ 8006062:	aa08      	add	r2, sp, #32
+ 8006064:	4669      	mov	r1, sp
+ 8006066:	4668      	mov	r0, sp
+ 8006068:	f7ff fd22 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+            uECC_vli_rshift1(a, num_words);
+ 800606c:	4621      	mov	r1, r4
+ 800606e:	4668      	mov	r0, sp
+ 8006070:	f7ff fba6 	bl	80057c0 <uECC_vli_rshift1>
+            if (uECC_vli_cmp_unsafe(u, v, num_words) < 0) {
+ 8006074:	4622      	mov	r2, r4
+ 8006076:	a918      	add	r1, sp, #96	; 0x60
+ 8006078:	a810      	add	r0, sp, #64	; 0x40
+ 800607a:	f7ff fb8c 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 800607e:	2800      	cmp	r0, #0
+ 8006080:	da04      	bge.n	800608c <uECC_vli_modInv+0xc0>
+                uECC_vli_add(u, u, mod, num_words);
+ 8006082:	a910      	add	r1, sp, #64	; 0x40
+ 8006084:	462a      	mov	r2, r5
+ 8006086:	4608      	mov	r0, r1
+ 8006088:	f7ff fdd4 	bl	8005c34 <uECC_vli_add.constprop.0>
+            uECC_vli_sub(u, u, v, num_words);
+ 800608c:	a910      	add	r1, sp, #64	; 0x40
+ 800608e:	aa18      	add	r2, sp, #96	; 0x60
+ 8006090:	4608      	mov	r0, r1
+ 8006092:	f7ff fd0d 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+ 8006096:	e7d1      	b.n	800603c <uECC_vli_modInv+0x70>
+            uECC_vli_sub(b, b, a, num_words);
+ 8006098:	466a      	mov	r2, sp
+ 800609a:	a808      	add	r0, sp, #32
+ 800609c:	f7ff fd08 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+            uECC_vli_rshift1(b, num_words);
+ 80060a0:	4621      	mov	r1, r4
+ 80060a2:	a808      	add	r0, sp, #32
+ 80060a4:	f7ff fb8c 	bl	80057c0 <uECC_vli_rshift1>
+            if (uECC_vli_cmp_unsafe(v, u, num_words) < 0) {
+ 80060a8:	4622      	mov	r2, r4
+ 80060aa:	a910      	add	r1, sp, #64	; 0x40
+ 80060ac:	a818      	add	r0, sp, #96	; 0x60
+ 80060ae:	f7ff fb72 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 80060b2:	2800      	cmp	r0, #0
+ 80060b4:	da04      	bge.n	80060c0 <uECC_vli_modInv+0xf4>
+                uECC_vli_add(v, v, mod, num_words);
+ 80060b6:	a918      	add	r1, sp, #96	; 0x60
+ 80060b8:	462a      	mov	r2, r5
+ 80060ba:	4608      	mov	r0, r1
+ 80060bc:	f7ff fdba 	bl	8005c34 <uECC_vli_add.constprop.0>
+            uECC_vli_sub(v, v, u, num_words);
+ 80060c0:	a918      	add	r1, sp, #96	; 0x60
+ 80060c2:	aa10      	add	r2, sp, #64	; 0x40
+ 80060c4:	4608      	mov	r0, r1
+ 80060c6:	f7ff fcf3 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+ 80060ca:	e7c4      	b.n	8006056 <uECC_vli_modInv+0x8a>
+
+080060cc <uECC_vli_modAdd>:
+                                  wordcount_t num_words) {
+ 80060cc:	b570      	push	{r4, r5, r6, lr}
+ 80060ce:	4604      	mov	r4, r0
+ 80060d0:	f99d 6010 	ldrsb.w	r6, [sp, #16]
+ 80060d4:	461d      	mov	r5, r3
+    uECC_word_t carry = uECC_vli_add(result, left, right, num_words);
+ 80060d6:	f7ff fdad 	bl	8005c34 <uECC_vli_add.constprop.0>
+    if (carry || uECC_vli_cmp_unsafe(mod, result, num_words) != 1) {
+ 80060da:	b930      	cbnz	r0, 80060ea <uECC_vli_modAdd+0x1e>
+ 80060dc:	4632      	mov	r2, r6
+ 80060de:	4621      	mov	r1, r4
+ 80060e0:	4628      	mov	r0, r5
+ 80060e2:	f7ff fb58 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 80060e6:	2801      	cmp	r0, #1
+ 80060e8:	d006      	beq.n	80060f8 <uECC_vli_modAdd+0x2c>
+        uECC_vli_sub(result, result, mod, num_words);
+ 80060ea:	462a      	mov	r2, r5
+ 80060ec:	4621      	mov	r1, r4
+ 80060ee:	4620      	mov	r0, r4
+}
+ 80060f0:	e8bd 4070 	ldmia.w	sp!, {r4, r5, r6, lr}
+        uECC_vli_sub(result, result, mod, num_words);
+ 80060f4:	f7ff bcdc 	b.w	8005ab0 <uECC_vli_sub.constprop.0>
+}
+ 80060f8:	bd70      	pop	{r4, r5, r6, pc}
+
+080060fa <x_side_secp256k1>:
+static void x_side_secp256k1(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve) {
+ 80060fa:	b573      	push	{r0, r1, r4, r5, r6, lr}
+ 80060fc:	4604      	mov	r4, r0
+ 80060fe:	4615      	mov	r5, r2
+ 8006100:	460e      	mov	r6, r1
+    uECC_vli_modSquare_fast(result, x, curve);                                /* r = x^2 */
+ 8006102:	f7ff fc1a 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modMult_fast(result, result, x, curve);                          /* r = x^3 */
+ 8006106:	462b      	mov	r3, r5
+ 8006108:	4632      	mov	r2, r6
+ 800610a:	4621      	mov	r1, r4
+ 800610c:	4620      	mov	r0, r4
+ 800610e:	f7ff fc04 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modAdd(result, result, curve->b, curve->p, num_words_secp256k1); /* r = x^3 + b */
+ 8006112:	2308      	movs	r3, #8
+ 8006114:	9300      	str	r3, [sp, #0]
+ 8006116:	f105 0284 	add.w	r2, r5, #132	; 0x84
+ 800611a:	1d2b      	adds	r3, r5, #4
+ 800611c:	4621      	mov	r1, r4
+ 800611e:	4620      	mov	r0, r4
+ 8006120:	f7ff ffd4 	bl	80060cc <uECC_vli_modAdd>
+}
+ 8006124:	b002      	add	sp, #8
+ 8006126:	bd70      	pop	{r4, r5, r6, pc}
+
+08006128 <uECC_vli_modSub.isra.0>:
+uECC_VLI_API void uECC_vli_modSub(uECC_word_t *result,
+ 8006128:	b538      	push	{r3, r4, r5, lr}
+ 800612a:	4604      	mov	r4, r0
+ 800612c:	461d      	mov	r5, r3
+    uECC_word_t l_borrow = uECC_vli_sub(result, left, right, num_words);
+ 800612e:	f7ff fcbf 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    if (l_borrow) {
+ 8006132:	b130      	cbz	r0, 8006142 <uECC_vli_modSub.isra.0+0x1a>
+        uECC_vli_add(result, result, mod, num_words);
+ 8006134:	462a      	mov	r2, r5
+ 8006136:	4621      	mov	r1, r4
+ 8006138:	4620      	mov	r0, r4
+}
+ 800613a:	e8bd 4038 	ldmia.w	sp!, {r3, r4, r5, lr}
+        uECC_vli_add(result, result, mod, num_words);
+ 800613e:	f7ff bd79 	b.w	8005c34 <uECC_vli_add.constprop.0>
+}
+ 8006142:	bd38      	pop	{r3, r4, r5, pc}
+
+08006144 <XYcZ_addC>:
+                      uECC_Curve curve) {
+ 8006144:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 8006148:	b09a      	sub	sp, #104	; 0x68
+ 800614a:	4615      	mov	r5, r2
+ 800614c:	9f22      	ldr	r7, [sp, #136]	; 0x88
+    wordcount_t num_words = curve->num_words;
+ 800614e:	463c      	mov	r4, r7
+                      uECC_Curve curve) {
+ 8006150:	4698      	mov	r8, r3
+    wordcount_t num_words = curve->num_words;
+ 8006152:	f914 ab04 	ldrsb.w	sl, [r4], #4
+                      uECC_Curve curve) {
+ 8006156:	4606      	mov	r6, r0
+ 8006158:	4689      	mov	r9, r1
+    uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
+ 800615a:	4623      	mov	r3, r4
+ 800615c:	4602      	mov	r2, r0
+ 800615e:	4629      	mov	r1, r5
+ 8006160:	a802      	add	r0, sp, #8
+ 8006162:	f7ff ffe1 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSquare_fast(t5, t5, curve);                  /* t5 = (x2 - x1)^2 = A */
+ 8006166:	a902      	add	r1, sp, #8
+ 8006168:	463a      	mov	r2, r7
+ 800616a:	4608      	mov	r0, r1
+ 800616c:	f7ff fbe5 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modMult_fast(X1, X1, t5, curve);                /* t1 = x1*A = B */
+ 8006170:	463b      	mov	r3, r7
+ 8006172:	aa02      	add	r2, sp, #8
+ 8006174:	4631      	mov	r1, r6
+ 8006176:	4630      	mov	r0, r6
+ 8006178:	f7ff fbcf 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modMult_fast(X2, X2, t5, curve);                /* t3 = x2*A = C */
+ 800617c:	463b      	mov	r3, r7
+ 800617e:	aa02      	add	r2, sp, #8
+ 8006180:	4629      	mov	r1, r5
+ 8006182:	4628      	mov	r0, r5
+ 8006184:	f7ff fbc9 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modAdd(t5, Y2, Y1, curve->p, num_words); /* t5 = y2 + y1 */
+ 8006188:	4623      	mov	r3, r4
+ 800618a:	464a      	mov	r2, r9
+ 800618c:	4641      	mov	r1, r8
+ 800618e:	a802      	add	r0, sp, #8
+ 8006190:	f8cd a000 	str.w	sl, [sp]
+ 8006194:	f7ff ff9a 	bl	80060cc <uECC_vli_modAdd>
+    uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
+ 8006198:	4623      	mov	r3, r4
+ 800619a:	464a      	mov	r2, r9
+ 800619c:	4641      	mov	r1, r8
+ 800619e:	4640      	mov	r0, r8
+ 80061a0:	f7ff ffc2 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(t6, X2, X1, curve->p, num_words); /* t6 = C - B */
+ 80061a4:	4623      	mov	r3, r4
+ 80061a6:	4632      	mov	r2, r6
+ 80061a8:	4629      	mov	r1, r5
+ 80061aa:	a80a      	add	r0, sp, #40	; 0x28
+ 80061ac:	f7ff ffbc 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(Y1, Y1, t6, curve);                /* t2 = y1 * (C - B) = E */
+ 80061b0:	463b      	mov	r3, r7
+ 80061b2:	aa0a      	add	r2, sp, #40	; 0x28
+ 80061b4:	4649      	mov	r1, r9
+ 80061b6:	4648      	mov	r0, r9
+ 80061b8:	f7ff fbaf 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modAdd(t6, X1, X2, curve->p, num_words); /* t6 = B + C */
+ 80061bc:	4623      	mov	r3, r4
+ 80061be:	462a      	mov	r2, r5
+ 80061c0:	4631      	mov	r1, r6
+ 80061c2:	a80a      	add	r0, sp, #40	; 0x28
+ 80061c4:	f8cd a000 	str.w	sl, [sp]
+ 80061c8:	f7ff ff80 	bl	80060cc <uECC_vli_modAdd>
+    uECC_vli_modSquare_fast(X2, Y2, curve);                  /* t3 = (y2 - y1)^2 = D */
+ 80061cc:	463a      	mov	r2, r7
+ 80061ce:	4641      	mov	r1, r8
+ 80061d0:	4628      	mov	r0, r5
+ 80061d2:	f7ff fbb2 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modSub(X2, X2, t6, curve->p, num_words); /* t3 = D - (B + C) = x3 */
+ 80061d6:	4623      	mov	r3, r4
+ 80061d8:	aa0a      	add	r2, sp, #40	; 0x28
+ 80061da:	4629      	mov	r1, r5
+ 80061dc:	4628      	mov	r0, r5
+ 80061de:	f7ff ffa3 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(t7, X1, X2, curve->p, num_words); /* t7 = B - x3 */
+ 80061e2:	4623      	mov	r3, r4
+ 80061e4:	462a      	mov	r2, r5
+ 80061e6:	4631      	mov	r1, r6
+ 80061e8:	a812      	add	r0, sp, #72	; 0x48
+ 80061ea:	f7ff ff9d 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(Y2, Y2, t7, curve);                /* t4 = (y2 - y1)*(B - x3) */
+ 80061ee:	463b      	mov	r3, r7
+ 80061f0:	aa12      	add	r2, sp, #72	; 0x48
+ 80061f2:	4641      	mov	r1, r8
+ 80061f4:	4640      	mov	r0, r8
+ 80061f6:	f7ff fb90 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = (y2 - y1)*(B - x3) - E = y3 */
+ 80061fa:	4623      	mov	r3, r4
+ 80061fc:	464a      	mov	r2, r9
+ 80061fe:	4641      	mov	r1, r8
+ 8006200:	4640      	mov	r0, r8
+ 8006202:	f7ff ff91 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSquare_fast(t7, t5, curve);                  /* t7 = (y2 + y1)^2 = F */
+ 8006206:	463a      	mov	r2, r7
+ 8006208:	a902      	add	r1, sp, #8
+ 800620a:	a812      	add	r0, sp, #72	; 0x48
+ 800620c:	f7ff fb95 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modSub(t7, t7, t6, curve->p, num_words); /* t7 = F - (B + C) = x3' */
+ 8006210:	a912      	add	r1, sp, #72	; 0x48
+ 8006212:	4623      	mov	r3, r4
+ 8006214:	aa0a      	add	r2, sp, #40	; 0x28
+ 8006216:	4608      	mov	r0, r1
+ 8006218:	f7ff ff86 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(t6, t7, X1, curve->p, num_words); /* t6 = x3' - B */
+ 800621c:	4623      	mov	r3, r4
+ 800621e:	4632      	mov	r2, r6
+ 8006220:	a912      	add	r1, sp, #72	; 0x48
+ 8006222:	a80a      	add	r0, sp, #40	; 0x28
+ 8006224:	f7ff ff80 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(t6, t6, t5, curve);                /* t6 = (y2+y1)*(x3' - B) */
+ 8006228:	a90a      	add	r1, sp, #40	; 0x28
+ 800622a:	463b      	mov	r3, r7
+ 800622c:	aa02      	add	r2, sp, #8
+ 800622e:	4608      	mov	r0, r1
+ 8006230:	f7ff fb73 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSub(Y1, t6, Y1, curve->p, num_words); /* t2 = (y2+y1)*(x3' - B) - E = y3' */
+ 8006234:	4623      	mov	r3, r4
+ 8006236:	464a      	mov	r2, r9
+ 8006238:	a90a      	add	r1, sp, #40	; 0x28
+ 800623a:	4648      	mov	r0, r9
+ 800623c:	f7ff ff74 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_set(X1, t7, num_words);
+ 8006240:	4652      	mov	r2, sl
+ 8006242:	a912      	add	r1, sp, #72	; 0x48
+ 8006244:	4630      	mov	r0, r6
+ 8006246:	f7ff fa9a 	bl	800577e <uECC_vli_set>
+}
+ 800624a:	b01a      	add	sp, #104	; 0x68
+ 800624c:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+
+08006250 <XYcZ_add>:
+                     uECC_Curve curve) {
+ 8006250:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 8006254:	b088      	sub	sp, #32
+ 8006256:	4614      	mov	r4, r2
+ 8006258:	f8dd 8040 	ldr.w	r8, [sp, #64]	; 0x40
+    wordcount_t num_words = curve->num_words;
+ 800625c:	4645      	mov	r5, r8
+                     uECC_Curve curve) {
+ 800625e:	461e      	mov	r6, r3
+    wordcount_t num_words = curve->num_words;
+ 8006260:	f915 ab04 	ldrsb.w	sl, [r5], #4
+                     uECC_Curve curve) {
+ 8006264:	4607      	mov	r7, r0
+ 8006266:	4689      	mov	r9, r1
+    uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
+ 8006268:	462b      	mov	r3, r5
+ 800626a:	4602      	mov	r2, r0
+ 800626c:	4621      	mov	r1, r4
+ 800626e:	4668      	mov	r0, sp
+ 8006270:	f7ff ff5a 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSquare_fast(t5, t5, curve);                  /* t5 = (x2 - x1)^2 = A */
+ 8006274:	4642      	mov	r2, r8
+ 8006276:	4669      	mov	r1, sp
+ 8006278:	4668      	mov	r0, sp
+ 800627a:	f7ff fb5e 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modMult_fast(X1, X1, t5, curve);                /* t1 = x1*A = B */
+ 800627e:	4643      	mov	r3, r8
+ 8006280:	466a      	mov	r2, sp
+ 8006282:	4639      	mov	r1, r7
+ 8006284:	4638      	mov	r0, r7
+ 8006286:	f7ff fb48 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modMult_fast(X2, X2, t5, curve);                /* t3 = x2*A = C */
+ 800628a:	4643      	mov	r3, r8
+ 800628c:	466a      	mov	r2, sp
+ 800628e:	4621      	mov	r1, r4
+ 8006290:	4620      	mov	r0, r4
+ 8006292:	f7ff fb42 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
+ 8006296:	462b      	mov	r3, r5
+ 8006298:	464a      	mov	r2, r9
+ 800629a:	4631      	mov	r1, r6
+ 800629c:	4630      	mov	r0, r6
+ 800629e:	f7ff ff43 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSquare_fast(t5, Y2, curve);                  /* t5 = (y2 - y1)^2 = D */
+ 80062a2:	4642      	mov	r2, r8
+ 80062a4:	4631      	mov	r1, r6
+ 80062a6:	4668      	mov	r0, sp
+ 80062a8:	f7ff fb47 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modSub(t5, t5, X1, curve->p, num_words); /* t5 = D - B */
+ 80062ac:	462b      	mov	r3, r5
+ 80062ae:	463a      	mov	r2, r7
+ 80062b0:	4669      	mov	r1, sp
+ 80062b2:	4668      	mov	r0, sp
+ 80062b4:	f7ff ff38 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(t5, t5, X2, curve->p, num_words); /* t5 = D - B - C = x3 */
+ 80062b8:	462b      	mov	r3, r5
+ 80062ba:	4622      	mov	r2, r4
+ 80062bc:	4669      	mov	r1, sp
+ 80062be:	4668      	mov	r0, sp
+ 80062c0:	f7ff ff32 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(X2, X2, X1, curve->p, num_words); /* t3 = C - B */
+ 80062c4:	462b      	mov	r3, r5
+ 80062c6:	463a      	mov	r2, r7
+ 80062c8:	4621      	mov	r1, r4
+ 80062ca:	4620      	mov	r0, r4
+ 80062cc:	f7ff ff2c 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(Y1, Y1, X2, curve);                /* t2 = y1*(C - B) */
+ 80062d0:	4643      	mov	r3, r8
+ 80062d2:	4622      	mov	r2, r4
+ 80062d4:	4649      	mov	r1, r9
+ 80062d6:	4648      	mov	r0, r9
+ 80062d8:	f7ff fb1f 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSub(X2, X1, t5, curve->p, num_words); /* t3 = B - x3 */
+ 80062dc:	462b      	mov	r3, r5
+ 80062de:	466a      	mov	r2, sp
+ 80062e0:	4639      	mov	r1, r7
+ 80062e2:	4620      	mov	r0, r4
+ 80062e4:	f7ff ff20 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(Y2, Y2, X2, curve);                /* t4 = (y2 - y1)*(B - x3) */
+ 80062e8:	4643      	mov	r3, r8
+ 80062ea:	4622      	mov	r2, r4
+ 80062ec:	4631      	mov	r1, r6
+ 80062ee:	4630      	mov	r0, r6
+ 80062f0:	f7ff fb13 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y3 */
+ 80062f4:	462b      	mov	r3, r5
+ 80062f6:	464a      	mov	r2, r9
+ 80062f8:	4631      	mov	r1, r6
+ 80062fa:	4630      	mov	r0, r6
+ 80062fc:	f7ff ff14 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_set(X2, t5, num_words);
+ 8006300:	4652      	mov	r2, sl
+ 8006302:	4669      	mov	r1, sp
+ 8006304:	4620      	mov	r0, r4
+ 8006306:	f7ff fa3a 	bl	800577e <uECC_vli_set>
+}
+ 800630a:	b008      	add	sp, #32
+ 800630c:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+
+08006310 <EccPoint_mult>:
+                          uECC_Curve curve) {
+ 8006310:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 8006314:	b0b1      	sub	sp, #196	; 0xc4
+ 8006316:	e9cd 0102 	strd	r0, r1, [sp, #8]
+ 800631a:	9c3b      	ldr	r4, [sp, #236]	; 0xec
+ 800631c:	9204      	str	r2, [sp, #16]
+    wordcount_t num_words = curve->num_words;
+ 800631e:	f994 9000 	ldrsb.w	r9, [r4]
+    uECC_vli_set(Rx[1], point, num_words);
+ 8006322:	a818      	add	r0, sp, #96	; 0x60
+ 8006324:	464a      	mov	r2, r9
+                          uECC_Curve curve) {
+ 8006326:	461d      	mov	r5, r3
+    uECC_vli_set(Rx[1], point, num_words);
+ 8006328:	f7ff fa29 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(Ry[1], point + num_words, num_words);
+ 800632c:	ea4f 0389 	mov.w	r3, r9, lsl #2
+ 8006330:	9305      	str	r3, [sp, #20]
+ 8006332:	9b03      	ldr	r3, [sp, #12]
+ 8006334:	eb03 0a89 	add.w	sl, r3, r9, lsl #2
+ 8006338:	4651      	mov	r1, sl
+ 800633a:	a828      	add	r0, sp, #160	; 0xa0
+ 800633c:	f7ff fa1f 	bl	800577e <uECC_vli_set>
+    wordcount_t num_words = curve->num_words;
+ 8006340:	f994 2000 	ldrsb.w	r2, [r4]
+    if (initial_Z) {
+ 8006344:	2d00      	cmp	r5, #0
+ 8006346:	f000 8082 	beq.w	800644e <EccPoint_mult+0x13e>
+        uECC_vli_set(z, initial_Z, num_words);
+ 800634a:	4629      	mov	r1, r5
+ 800634c:	a808      	add	r0, sp, #32
+ 800634e:	f7ff fa16 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(X2, X1, num_words);
+ 8006352:	af10      	add	r7, sp, #64	; 0x40
+ 8006354:	a918      	add	r1, sp, #96	; 0x60
+ 8006356:	4638      	mov	r0, r7
+    uECC_vli_set(Y2, Y1, num_words);
+ 8006358:	f10d 0880 	add.w	r8, sp, #128	; 0x80
+    uECC_vli_set(X2, X1, num_words);
+ 800635c:	f7ff fa0f 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(Y2, Y1, num_words);
+ 8006360:	a928      	add	r1, sp, #160	; 0xa0
+ 8006362:	4640      	mov	r0, r8
+ 8006364:	f7ff fa0b 	bl	800577e <uECC_vli_set>
+    apply_z(X1, Y1, z, curve);
+ 8006368:	4623      	mov	r3, r4
+ 800636a:	aa08      	add	r2, sp, #32
+ 800636c:	a818      	add	r0, sp, #96	; 0x60
+ 800636e:	f7ff fae8 	bl	8005942 <apply_z>
+    curve->double_jacobian(X1, Y1, z, curve);
+ 8006372:	f8d4 50a4 	ldr.w	r5, [r4, #164]	; 0xa4
+ 8006376:	4623      	mov	r3, r4
+ 8006378:	aa08      	add	r2, sp, #32
+ 800637a:	a928      	add	r1, sp, #160	; 0xa0
+ 800637c:	a818      	add	r0, sp, #96	; 0x60
+ 800637e:	47a8      	blx	r5
+    apply_z(X2, Y2, z, curve);
+ 8006380:	4623      	mov	r3, r4
+ 8006382:	aa08      	add	r2, sp, #32
+ 8006384:	4641      	mov	r1, r8
+ 8006386:	4638      	mov	r0, r7
+ 8006388:	f7ff fadb 	bl	8005942 <apply_z>
+    for (i = num_bits - 2; i > 0; --i) {
+ 800638c:	f9bd 50e8 	ldrsh.w	r5, [sp, #232]	; 0xe8
+ 8006390:	3d02      	subs	r5, #2
+ 8006392:	b22d      	sxth	r5, r5
+ 8006394:	2d00      	cmp	r5, #0
+ 8006396:	dc63      	bgt.n	8006460 <EccPoint_mult+0x150>
+    return (vli[bit >> uECC_WORD_BITS_SHIFT] & ((uECC_word_t)1 << (bit & uECC_WORD_BITS_MASK)));
+ 8006398:	9b04      	ldr	r3, [sp, #16]
+ 800639a:	681d      	ldr	r5, [r3, #0]
+    XYcZ_addC(Rx[1 - nb], Ry[1 - nb], Rx[nb], Ry[nb], curve);
+ 800639c:	9400      	str	r4, [sp, #0]
+    return (vli[bit >> uECC_WORD_BITS_SHIFT] & ((uECC_word_t)1 << (bit & uECC_WORD_BITS_MASK)));
+ 800639e:	f005 0601 	and.w	r6, r5, #1
+    XYcZ_addC(Rx[1 - nb], Ry[1 - nb], Rx[nb], Ry[nb], curve);
+ 80063a2:	ab10      	add	r3, sp, #64	; 0x40
+ 80063a4:	eb03 1746 	add.w	r7, r3, r6, lsl #5
+ 80063a8:	43ed      	mvns	r5, r5
+ 80063aa:	ab20      	add	r3, sp, #128	; 0x80
+ 80063ac:	eb03 1646 	add.w	r6, r3, r6, lsl #5
+ 80063b0:	f005 0501 	and.w	r5, r5, #1
+ 80063b4:	ab10      	add	r3, sp, #64	; 0x40
+ 80063b6:	eb03 1845 	add.w	r8, r3, r5, lsl #5
+ 80063ba:	ab20      	add	r3, sp, #128	; 0x80
+ 80063bc:	eb03 1545 	add.w	r5, r3, r5, lsl #5
+ 80063c0:	462b      	mov	r3, r5
+ 80063c2:	4642      	mov	r2, r8
+ 80063c4:	4631      	mov	r1, r6
+ 80063c6:	4638      	mov	r0, r7
+    uECC_vli_modSub(z, Rx[1], Rx[0], curve->p, num_words); /* X1 - X0 */
+ 80063c8:	f104 0b04 	add.w	fp, r4, #4
+    XYcZ_addC(Rx[1 - nb], Ry[1 - nb], Rx[nb], Ry[nb], curve);
+ 80063cc:	f7ff feba 	bl	8006144 <XYcZ_addC>
+    uECC_vli_modSub(z, Rx[1], Rx[0], curve->p, num_words); /* X1 - X0 */
+ 80063d0:	465b      	mov	r3, fp
+ 80063d2:	aa10      	add	r2, sp, #64	; 0x40
+ 80063d4:	a918      	add	r1, sp, #96	; 0x60
+ 80063d6:	a808      	add	r0, sp, #32
+ 80063d8:	f7ff fea6 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(z, z, Ry[1 - nb], curve);               /* Yb * (X1 - X0) */
+ 80063dc:	a908      	add	r1, sp, #32
+ 80063de:	4623      	mov	r3, r4
+ 80063e0:	4632      	mov	r2, r6
+ 80063e2:	4608      	mov	r0, r1
+ 80063e4:	f7ff fa99 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modMult_fast(z, z, point, curve);                    /* xP * Yb * (X1 - X0) */
+ 80063e8:	a908      	add	r1, sp, #32
+ 80063ea:	9a03      	ldr	r2, [sp, #12]
+ 80063ec:	4623      	mov	r3, r4
+ 80063ee:	4608      	mov	r0, r1
+ 80063f0:	f7ff fa93 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modInv(z, z, curve->p, num_words);            /* 1 / (xP * Yb * (X1 - X0)) */
+ 80063f4:	a908      	add	r1, sp, #32
+ 80063f6:	464b      	mov	r3, r9
+ 80063f8:	465a      	mov	r2, fp
+ 80063fa:	4608      	mov	r0, r1
+ 80063fc:	f7ff fde6 	bl	8005fcc <uECC_vli_modInv>
+    uECC_vli_modMult_fast(z, z, point + num_words, curve); 
+ 8006400:	a908      	add	r1, sp, #32
+ 8006402:	4623      	mov	r3, r4
+ 8006404:	4652      	mov	r2, sl
+ 8006406:	4608      	mov	r0, r1
+ 8006408:	f7ff fa87 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modMult_fast(z, z, Rx[1 - nb], curve); /* Xb * yP / (xP * Yb * (X1 - X0)) */
+ 800640c:	a908      	add	r1, sp, #32
+ 800640e:	4623      	mov	r3, r4
+ 8006410:	463a      	mov	r2, r7
+ 8006412:	4608      	mov	r0, r1
+ 8006414:	f7ff fa81 	bl	800591a <uECC_vli_modMult_fast>
+    XYcZ_add(Rx[nb], Ry[nb], Rx[1 - nb], Ry[1 - nb], curve);
+ 8006418:	4633      	mov	r3, r6
+ 800641a:	463a      	mov	r2, r7
+ 800641c:	4629      	mov	r1, r5
+ 800641e:	4640      	mov	r0, r8
+ 8006420:	9400      	str	r4, [sp, #0]
+ 8006422:	f7ff ff15 	bl	8006250 <XYcZ_add>
+    apply_z(Rx[0], Ry[0], z, curve);
+ 8006426:	4623      	mov	r3, r4
+ 8006428:	aa08      	add	r2, sp, #32
+ 800642a:	a920      	add	r1, sp, #128	; 0x80
+ 800642c:	a810      	add	r0, sp, #64	; 0x40
+ 800642e:	f7ff fa88 	bl	8005942 <apply_z>
+    uECC_vli_set(result, Rx[0], num_words);
+ 8006432:	9802      	ldr	r0, [sp, #8]
+ 8006434:	464a      	mov	r2, r9
+ 8006436:	a910      	add	r1, sp, #64	; 0x40
+ 8006438:	f7ff f9a1 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(result + num_words, Ry[0], num_words);
+ 800643c:	9802      	ldr	r0, [sp, #8]
+ 800643e:	9b05      	ldr	r3, [sp, #20]
+ 8006440:	a920      	add	r1, sp, #128	; 0x80
+ 8006442:	4418      	add	r0, r3
+ 8006444:	f7ff f99b 	bl	800577e <uECC_vli_set>
+}
+ 8006448:	b031      	add	sp, #196	; 0xc4
+ 800644a:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+        uECC_vli_clear(z, num_words);
+ 800644e:	4611      	mov	r1, r2
+ 8006450:	a808      	add	r0, sp, #32
+ 8006452:	9206      	str	r2, [sp, #24]
+ 8006454:	f7ff f954 	bl	8005700 <uECC_vli_clear>
+        z[0] = 1;
+ 8006458:	2301      	movs	r3, #1
+ 800645a:	9a06      	ldr	r2, [sp, #24]
+ 800645c:	9308      	str	r3, [sp, #32]
+ 800645e:	e778      	b.n	8006352 <EccPoint_mult+0x42>
+        nb = !uECC_vli_testBit(scalar, i);
+ 8006460:	4629      	mov	r1, r5
+ 8006462:	9804      	ldr	r0, [sp, #16]
+ 8006464:	f7ff f961 	bl	800572a <uECC_vli_testBit>
+ 8006468:	fab0 f680 	clz	r6, r0
+ 800646c:	0976      	lsrs	r6, r6, #5
+        XYcZ_addC(Rx[1 - nb], Ry[1 - nb], Rx[nb], Ry[nb], curve);
+ 800646e:	f1c6 0101 	rsb	r1, r6, #1
+ 8006472:	eb07 1b46 	add.w	fp, r7, r6, lsl #5
+ 8006476:	eb08 1646 	add.w	r6, r8, r6, lsl #5
+ 800647a:	eb07 1041 	add.w	r0, r7, r1, lsl #5
+ 800647e:	4633      	mov	r3, r6
+ 8006480:	eb08 1141 	add.w	r1, r8, r1, lsl #5
+ 8006484:	465a      	mov	r2, fp
+ 8006486:	9400      	str	r4, [sp, #0]
+ 8006488:	e9cd 0106 	strd	r0, r1, [sp, #24]
+ 800648c:	f7ff fe5a 	bl	8006144 <XYcZ_addC>
+        XYcZ_add(Rx[nb], Ry[nb], Rx[1 - nb], Ry[1 - nb], curve);
+ 8006490:	9907      	ldr	r1, [sp, #28]
+ 8006492:	9806      	ldr	r0, [sp, #24]
+ 8006494:	9400      	str	r4, [sp, #0]
+ 8006496:	460b      	mov	r3, r1
+ 8006498:	4602      	mov	r2, r0
+ 800649a:	4631      	mov	r1, r6
+ 800649c:	4658      	mov	r0, fp
+ 800649e:	f7ff fed7 	bl	8006250 <XYcZ_add>
+    for (i = num_bits - 2; i > 0; --i) {
+ 80064a2:	3d01      	subs	r5, #1
+ 80064a4:	e775      	b.n	8006392 <EccPoint_mult+0x82>
+
+080064a6 <EccPoint_compute_public_key>:
+                                               uECC_Curve curve) {
+ 80064a6:	b530      	push	{r4, r5, lr}
+ 80064a8:	4614      	mov	r4, r2
+ 80064aa:	b095      	sub	sp, #84	; 0x54
+ 80064ac:	4605      	mov	r5, r0
+    uECC_word_t *p2[2] = {tmp1, tmp2};
+ 80064ae:	aa0c      	add	r2, sp, #48	; 0x30
+    carry = regularize_k(private, tmp1, tmp2, curve);
+ 80064b0:	4623      	mov	r3, r4
+                                               uECC_Curve curve) {
+ 80064b2:	4608      	mov	r0, r1
+    uECC_word_t *p2[2] = {tmp1, tmp2};
+ 80064b4:	a904      	add	r1, sp, #16
+ 80064b6:	9102      	str	r1, [sp, #8]
+ 80064b8:	9203      	str	r2, [sp, #12]
+    carry = regularize_k(private, tmp1, tmp2, curve);
+ 80064ba:	f7ff fbe0 	bl	8005c7e <regularize_k>
+    EccPoint_mult(result, curve->G, p2[!carry], 0, curve->num_n_bits + 1, curve);
+ 80064be:	fab0 f380 	clz	r3, r0
+ 80064c2:	095b      	lsrs	r3, r3, #5
+ 80064c4:	aa14      	add	r2, sp, #80	; 0x50
+ 80064c6:	eb02 0283 	add.w	r2, r2, r3, lsl #2
+ 80064ca:	8863      	ldrh	r3, [r4, #2]
+ 80064cc:	9401      	str	r4, [sp, #4]
+ 80064ce:	3301      	adds	r3, #1
+ 80064d0:	b21b      	sxth	r3, r3
+ 80064d2:	9300      	str	r3, [sp, #0]
+ 80064d4:	f852 2c48 	ldr.w	r2, [r2, #-72]
+ 80064d8:	2300      	movs	r3, #0
+ 80064da:	f104 0144 	add.w	r1, r4, #68	; 0x44
+ 80064de:	4628      	mov	r0, r5
+ 80064e0:	f7ff ff16 	bl	8006310 <EccPoint_mult>
+    if (EccPoint_isZero(result, curve)) {
+ 80064e4:	7821      	ldrb	r1, [r4, #0]
+ 80064e6:	0049      	lsls	r1, r1, #1
+ 80064e8:	b249      	sxtb	r1, r1
+ 80064ea:	4628      	mov	r0, r5
+ 80064ec:	f7ff f90e 	bl	800570c <uECC_vli_isZero>
+}
+ 80064f0:	fab0 f080 	clz	r0, r0
+ 80064f4:	0940      	lsrs	r0, r0, #5
+ 80064f6:	b015      	add	sp, #84	; 0x54
+ 80064f8:	bd30      	pop	{r4, r5, pc}
+	...
+
+080064fc <uECC_sign_with_k>:
+                            uECC_Curve curve) {
+ 80064fc:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 8006500:	ed2d 8b02 	vpush	{d8}
+ 8006504:	b0a7      	sub	sp, #156	; 0x9c
+ 8006506:	461e      	mov	r6, r3
+ 8006508:	9d33      	ldr	r5, [sp, #204]	; 0xcc
+    wordcount_t num_words = curve->num_words;
+ 800650a:	f995 a000 	ldrsb.w	sl, [r5]
+                            uECC_Curve curve) {
+ 800650e:	ee08 1a10 	vmov	s16, r1
+ 8006512:	4683      	mov	fp, r0
+    uECC_word_t *k2[2] = {tmp, s};
+ 8006514:	f10d 0918 	add.w	r9, sp, #24
+ 8006518:	ab0e      	add	r3, sp, #56	; 0x38
+    if (uECC_vli_isZero(k, num_words) || uECC_vli_cmp(curve->n, k, num_n_words) != 1) {
+ 800651a:	4651      	mov	r1, sl
+ 800651c:	4630      	mov	r0, r6
+                            uECC_Curve curve) {
+ 800651e:	ee08 2a90 	vmov	s17, r2
+    uECC_word_t *k2[2] = {tmp, s};
+ 8006522:	f8cd 9010 	str.w	r9, [sp, #16]
+ 8006526:	9305      	str	r3, [sp, #20]
+    if (uECC_vli_isZero(k, num_words) || uECC_vli_cmp(curve->n, k, num_n_words) != 1) {
+ 8006528:	f7ff f8f0 	bl	800570c <uECC_vli_isZero>
+ 800652c:	b128      	cbz	r0, 800653a <uECC_sign_with_k+0x3e>
+        return 0;
+ 800652e:	2000      	movs	r0, #0
+}
+ 8006530:	b027      	add	sp, #156	; 0x9c
+ 8006532:	ecbd 8b02 	vpop	{d8}
+ 8006536:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 800653a:	f9b5 8002 	ldrsh.w	r8, [r5, #2]
+ 800653e:	f118 041f 	adds.w	r4, r8, #31
+ 8006542:	bf48      	it	mi
+ 8006544:	f108 043e 	addmi.w	r4, r8, #62	; 0x3e
+ 8006548:	f344 1447 	sbfx	r4, r4, #5, #8
+    if (uECC_vli_isZero(k, num_words) || uECC_vli_cmp(curve->n, k, num_n_words) != 1) {
+ 800654c:	f105 0724 	add.w	r7, r5, #36	; 0x24
+ 8006550:	4622      	mov	r2, r4
+ 8006552:	4631      	mov	r1, r6
+ 8006554:	4638      	mov	r0, r7
+ 8006556:	f7ff fb19 	bl	8005b8c <uECC_vli_cmp>
+ 800655a:	2801      	cmp	r0, #1
+ 800655c:	9003      	str	r0, [sp, #12]
+ 800655e:	d1e6      	bne.n	800652e <uECC_sign_with_k+0x32>
+    carry = regularize_k(k, tmp, s, curve);
+ 8006560:	462b      	mov	r3, r5
+ 8006562:	aa0e      	add	r2, sp, #56	; 0x38
+ 8006564:	4649      	mov	r1, r9
+ 8006566:	4630      	mov	r0, r6
+ 8006568:	f7ff fb89 	bl	8005c7e <regularize_k>
+    EccPoint_mult(p, curve->G, k2[!carry], 0, num_n_bits + 1, curve);
+ 800656c:	fab0 f080 	clz	r0, r0
+ 8006570:	ab26      	add	r3, sp, #152	; 0x98
+ 8006572:	0940      	lsrs	r0, r0, #5
+ 8006574:	f108 0801 	add.w	r8, r8, #1
+ 8006578:	eb03 0080 	add.w	r0, r3, r0, lsl #2
+ 800657c:	fa0f f388 	sxth.w	r3, r8
+ 8006580:	9300      	str	r3, [sp, #0]
+ 8006582:	9501      	str	r5, [sp, #4]
+ 8006584:	f850 2c88 	ldr.w	r2, [r0, #-136]
+ 8006588:	f105 0144 	add.w	r1, r5, #68	; 0x44
+ 800658c:	a816      	add	r0, sp, #88	; 0x58
+ 800658e:	2300      	movs	r3, #0
+ 8006590:	f7ff febe 	bl	8006310 <EccPoint_mult>
+    if (uECC_vli_isZero(p, num_words)) {
+ 8006594:	4651      	mov	r1, sl
+ 8006596:	a816      	add	r0, sp, #88	; 0x58
+ 8006598:	f7ff f8b8 	bl	800570c <uECC_vli_isZero>
+ 800659c:	2800      	cmp	r0, #0
+ 800659e:	d1c6      	bne.n	800652e <uECC_sign_with_k+0x32>
+	uECC_recid = (p[curve->num_words] & 0x01);
+ 80065a0:	f995 3000 	ldrsb.w	r3, [r5]
+ 80065a4:	aa26      	add	r2, sp, #152	; 0x98
+ 80065a6:	eb02 0383 	add.w	r3, r2, r3, lsl #2
+ 80065aa:	4a3b      	ldr	r2, [pc, #236]	; (8006698 <uECC_sign_with_k+0x19c>)
+ 80065ac:	f853 3c40 	ldr.w	r3, [r3, #-64]
+ 80065b0:	f003 0301 	and.w	r3, r3, #1
+ 80065b4:	7013      	strb	r3, [r2, #0]
+    if (!g_rng_function) {
+ 80065b6:	4b39      	ldr	r3, [pc, #228]	; (800669c <uECC_sign_with_k+0x1a0>)
+ 80065b8:	681b      	ldr	r3, [r3, #0]
+ 80065ba:	2b00      	cmp	r3, #0
+ 80065bc:	d163      	bne.n	8006686 <uECC_sign_with_k+0x18a>
+        uECC_vli_clear(tmp, num_n_words);
+ 80065be:	4621      	mov	r1, r4
+ 80065c0:	4648      	mov	r0, r9
+ 80065c2:	f7ff f89d 	bl	8005700 <uECC_vli_clear>
+        tmp[0] = 1;
+ 80065c6:	9b03      	ldr	r3, [sp, #12]
+ 80065c8:	9306      	str	r3, [sp, #24]
+    uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k' = rand * k */
+ 80065ca:	463b      	mov	r3, r7
+ 80065cc:	aa06      	add	r2, sp, #24
+ 80065ce:	4631      	mov	r1, r6
+ 80065d0:	4630      	mov	r0, r6
+ 80065d2:	9400      	str	r4, [sp, #0]
+ 80065d4:	f7ff f901 	bl	80057da <uECC_vli_modMult>
+    uECC_vli_modInv(k, k, curve->n, num_n_words);       /* k = 1 / k' */
+ 80065d8:	4623      	mov	r3, r4
+ 80065da:	463a      	mov	r2, r7
+ 80065dc:	4631      	mov	r1, r6
+ 80065de:	4630      	mov	r0, r6
+ 80065e0:	f7ff fcf4 	bl	8005fcc <uECC_vli_modInv>
+    uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k = 1 / k */
+ 80065e4:	463b      	mov	r3, r7
+ 80065e6:	aa06      	add	r2, sp, #24
+ 80065e8:	4631      	mov	r1, r6
+ 80065ea:	4630      	mov	r0, r6
+ 80065ec:	9400      	str	r4, [sp, #0]
+ 80065ee:	f7ff f8f4 	bl	80057da <uECC_vli_modMult>
+    uECC_vli_nativeToBytes(signature, curve->num_bytes, p); /* store r */
+ 80065f2:	f995 1001 	ldrsb.w	r1, [r5, #1]
+ 80065f6:	9832      	ldr	r0, [sp, #200]	; 0xc8
+ 80065f8:	aa16      	add	r2, sp, #88	; 0x58
+ 80065fa:	f7ff f9c1 	bl	8005980 <uECC_vli_nativeToBytes>
+    uECC_vli_bytesToNative(tmp, private_key, BITS_TO_BYTES(curve->num_n_bits)); /* tmp = d */
+ 80065fe:	f9b5 3002 	ldrsh.w	r3, [r5, #2]
+ 8006602:	1dda      	adds	r2, r3, #7
+ 8006604:	bf48      	it	mi
+ 8006606:	f103 020e 	addmi.w	r2, r3, #14
+ 800660a:	10d2      	asrs	r2, r2, #3
+ 800660c:	4659      	mov	r1, fp
+ 800660e:	a806      	add	r0, sp, #24
+ 8006610:	f7ff f9ca 	bl	80059a8 <uECC_vli_bytesToNative>
+    s[num_n_words - 1] = 0;
+ 8006614:	aa26      	add	r2, sp, #152	; 0x98
+ 8006616:	1e63      	subs	r3, r4, #1
+ 8006618:	eb02 0383 	add.w	r3, r2, r3, lsl #2
+ 800661c:	2200      	movs	r2, #0
+    uECC_vli_set(s, p, num_words);
+ 800661e:	a80e      	add	r0, sp, #56	; 0x38
+    s[num_n_words - 1] = 0;
+ 8006620:	f843 2c60 	str.w	r2, [r3, #-96]
+    uECC_vli_set(s, p, num_words);
+ 8006624:	a916      	add	r1, sp, #88	; 0x58
+ 8006626:	4652      	mov	r2, sl
+ 8006628:	f7ff f8a9 	bl	800577e <uECC_vli_set>
+    uECC_vli_modMult(s, tmp, s, curve->n, num_n_words); /* s = r*d */
+ 800662c:	4602      	mov	r2, r0
+ 800662e:	463b      	mov	r3, r7
+ 8006630:	a906      	add	r1, sp, #24
+ 8006632:	9400      	str	r4, [sp, #0]
+ 8006634:	f7ff f8d1 	bl	80057da <uECC_vli_modMult>
+    bits2int(tmp, message_hash, hash_size, curve);
+ 8006638:	ee18 2a90 	vmov	r2, s17
+ 800663c:	ee18 1a10 	vmov	r1, s16
+ 8006640:	462b      	mov	r3, r5
+ 8006642:	a806      	add	r0, sp, #24
+ 8006644:	f7ff fa5b 	bl	8005afe <bits2int>
+    uECC_vli_modAdd(s, tmp, s, curve->n, num_n_words); /* s = e + r*d */
+ 8006648:	aa0e      	add	r2, sp, #56	; 0x38
+ 800664a:	4610      	mov	r0, r2
+ 800664c:	463b      	mov	r3, r7
+ 800664e:	a906      	add	r1, sp, #24
+ 8006650:	9400      	str	r4, [sp, #0]
+ 8006652:	f7ff fd3b 	bl	80060cc <uECC_vli_modAdd>
+    uECC_vli_modMult(s, s, k, curve->n, num_n_words);  /* s = (e + r*d) / k */
+ 8006656:	a90e      	add	r1, sp, #56	; 0x38
+ 8006658:	4608      	mov	r0, r1
+ 800665a:	463b      	mov	r3, r7
+ 800665c:	4632      	mov	r2, r6
+ 800665e:	9400      	str	r4, [sp, #0]
+ 8006660:	f7ff f8bb 	bl	80057da <uECC_vli_modMult>
+    if (uECC_vli_numBits(s, num_n_words) > (bitcount_t)curve->num_bytes * 8) {
+ 8006664:	4621      	mov	r1, r4
+ 8006666:	a80e      	add	r0, sp, #56	; 0x38
+ 8006668:	f7ff f869 	bl	800573e <uECC_vli_numBits>
+ 800666c:	f995 1001 	ldrsb.w	r1, [r5, #1]
+ 8006670:	ebb0 0fc1 	cmp.w	r0, r1, lsl #3
+ 8006674:	f73f af5b 	bgt.w	800652e <uECC_sign_with_k+0x32>
+    uECC_vli_nativeToBytes(signature + curve->num_bytes, curve->num_bytes, s);
+ 8006678:	9b32      	ldr	r3, [sp, #200]	; 0xc8
+ 800667a:	aa0e      	add	r2, sp, #56	; 0x38
+ 800667c:	1858      	adds	r0, r3, r1
+ 800667e:	f7ff f97f 	bl	8005980 <uECC_vli_nativeToBytes>
+    return 1;
+ 8006682:	2001      	movs	r0, #1
+ 8006684:	e754      	b.n	8006530 <uECC_sign_with_k+0x34>
+    } else if (!uECC_generate_random_int(tmp, curve->n, num_n_words)) {
+ 8006686:	4622      	mov	r2, r4
+ 8006688:	4639      	mov	r1, r7
+ 800668a:	4648      	mov	r0, r9
+ 800668c:	f7ff fa96 	bl	8005bbc <uECC_generate_random_int>
+ 8006690:	2800      	cmp	r0, #0
+ 8006692:	d19a      	bne.n	80065ca <uECC_sign_with_k+0xce>
+ 8006694:	e74b      	b.n	800652e <uECC_sign_with_k+0x32>
+ 8006696:	bf00      	nop
+ 8006698:	2009e2a4 	.word	0x2009e2a4
+ 800669c:	2009e2a0 	.word	0x2009e2a0
+
+080066a0 <double_jacobian_secp256k1>:
+                                      uECC_Curve curve) {
+ 80066a0:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+ 80066a4:	4605      	mov	r5, r0
+ 80066a6:	b093      	sub	sp, #76	; 0x4c
+ 80066a8:	460c      	mov	r4, r1
+    if (uECC_vli_isZero(Z1, num_words_secp256k1)) {
+ 80066aa:	4610      	mov	r0, r2
+ 80066ac:	2108      	movs	r1, #8
+                                      uECC_Curve curve) {
+ 80066ae:	4617      	mov	r7, r2
+ 80066b0:	461e      	mov	r6, r3
+    if (uECC_vli_isZero(Z1, num_words_secp256k1)) {
+ 80066b2:	f7ff f82b 	bl	800570c <uECC_vli_isZero>
+ 80066b6:	2800      	cmp	r0, #0
+ 80066b8:	d161      	bne.n	800677e <double_jacobian_secp256k1+0xde>
+    uECC_vli_modSquare_fast(t5, Y1, curve);   /* t5 = y1^2 */
+ 80066ba:	4632      	mov	r2, r6
+ 80066bc:	4621      	mov	r1, r4
+ 80066be:	a80a      	add	r0, sp, #40	; 0x28
+ 80066c0:	f7ff f93b 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modMult_fast(t4, X1, t5, curve); /* t4 = x1*y1^2 = A */
+ 80066c4:	4633      	mov	r3, r6
+ 80066c6:	aa0a      	add	r2, sp, #40	; 0x28
+ 80066c8:	4629      	mov	r1, r5
+ 80066ca:	a802      	add	r0, sp, #8
+ 80066cc:	f7ff f925 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSquare_fast(X1, X1, curve);   /* t1 = x1^2 */
+ 80066d0:	4632      	mov	r2, r6
+ 80066d2:	4629      	mov	r1, r5
+ 80066d4:	4628      	mov	r0, r5
+ 80066d6:	f7ff f930 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modSquare_fast(t5, t5, curve);   /* t5 = y1^4 */
+ 80066da:	a90a      	add	r1, sp, #40	; 0x28
+ 80066dc:	4608      	mov	r0, r1
+ 80066de:	4632      	mov	r2, r6
+ 80066e0:	f7ff f92b 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modAdd(Y1, X1, X1, curve->p, num_words_secp256k1); /* t2 = 2*x1^2 */
+ 80066e4:	f04f 0808 	mov.w	r8, #8
+    uECC_vli_modMult_fast(Z1, Y1, Z1, curve); /* t3 = y1*z1 = z3 */
+ 80066e8:	463a      	mov	r2, r7
+ 80066ea:	4638      	mov	r0, r7
+ 80066ec:	4633      	mov	r3, r6
+ 80066ee:	4621      	mov	r1, r4
+    uECC_vli_modAdd(Y1, X1, X1, curve->p, num_words_secp256k1); /* t2 = 2*x1^2 */
+ 80066f0:	1d37      	adds	r7, r6, #4
+    uECC_vli_modMult_fast(Z1, Y1, Z1, curve); /* t3 = y1*z1 = z3 */
+ 80066f2:	f7ff f912 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modAdd(Y1, X1, X1, curve->p, num_words_secp256k1); /* t2 = 2*x1^2 */
+ 80066f6:	463b      	mov	r3, r7
+ 80066f8:	462a      	mov	r2, r5
+ 80066fa:	4629      	mov	r1, r5
+ 80066fc:	4620      	mov	r0, r4
+ 80066fe:	f8cd 8000 	str.w	r8, [sp]
+ 8006702:	f7ff fce3 	bl	80060cc <uECC_vli_modAdd>
+    uECC_vli_modAdd(Y1, Y1, X1, curve->p, num_words_secp256k1); /* t2 = 3*x1^2 */
+ 8006706:	463b      	mov	r3, r7
+ 8006708:	f8cd 8000 	str.w	r8, [sp]
+ 800670c:	462a      	mov	r2, r5
+ 800670e:	4621      	mov	r1, r4
+ 8006710:	4620      	mov	r0, r4
+ 8006712:	f7ff fcdb 	bl	80060cc <uECC_vli_modAdd>
+    return (vli[bit >> uECC_WORD_BITS_SHIFT] & ((uECC_word_t)1 << (bit & uECC_WORD_BITS_MASK)));
+ 8006716:	6823      	ldr	r3, [r4, #0]
+    if (uECC_vli_testBit(Y1, 0)) {
+ 8006718:	07db      	lsls	r3, r3, #31
+ 800671a:	d533      	bpl.n	8006784 <double_jacobian_secp256k1+0xe4>
+        uECC_word_t carry = uECC_vli_add(Y1, Y1, curve->p, num_words_secp256k1);
+ 800671c:	463a      	mov	r2, r7
+ 800671e:	4621      	mov	r1, r4
+ 8006720:	4620      	mov	r0, r4
+ 8006722:	f7ff fa87 	bl	8005c34 <uECC_vli_add.constprop.0>
+        uECC_vli_rshift1(Y1, num_words_secp256k1);
+ 8006726:	4641      	mov	r1, r8
+        uECC_word_t carry = uECC_vli_add(Y1, Y1, curve->p, num_words_secp256k1);
+ 8006728:	4681      	mov	r9, r0
+        uECC_vli_rshift1(Y1, num_words_secp256k1);
+ 800672a:	4620      	mov	r0, r4
+ 800672c:	f7ff f848 	bl	80057c0 <uECC_vli_rshift1>
+        Y1[num_words_secp256k1 - 1] |= carry << (uECC_WORD_BITS - 1);
+ 8006730:	69e3      	ldr	r3, [r4, #28]
+ 8006732:	ea43 73c9 	orr.w	r3, r3, r9, lsl #31
+ 8006736:	61e3      	str	r3, [r4, #28]
+    uECC_vli_modSquare_fast(X1, Y1, curve);                     /* t1 = B^2 */
+ 8006738:	4632      	mov	r2, r6
+ 800673a:	4621      	mov	r1, r4
+ 800673c:	4628      	mov	r0, r5
+ 800673e:	f7ff f8fc 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modSub(X1, X1, t4, curve->p, num_words_secp256k1); /* t1 = B^2 - A */
+ 8006742:	463b      	mov	r3, r7
+ 8006744:	aa02      	add	r2, sp, #8
+ 8006746:	4629      	mov	r1, r5
+ 8006748:	4628      	mov	r0, r5
+ 800674a:	f7ff fced 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(X1, X1, t4, curve->p, num_words_secp256k1); /* t1 = B^2 - 2A = x3 */
+ 800674e:	463b      	mov	r3, r7
+ 8006750:	aa02      	add	r2, sp, #8
+ 8006752:	4629      	mov	r1, r5
+ 8006754:	4628      	mov	r0, r5
+ 8006756:	f7ff fce7 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(t4, t4, X1, curve->p, num_words_secp256k1); /* t4 = A - x3 */
+ 800675a:	a902      	add	r1, sp, #8
+ 800675c:	4608      	mov	r0, r1
+ 800675e:	463b      	mov	r3, r7
+ 8006760:	462a      	mov	r2, r5
+ 8006762:	f7ff fce1 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(Y1, Y1, t4, curve);                   /* t2 = B * (A - x3) */
+ 8006766:	4633      	mov	r3, r6
+ 8006768:	aa02      	add	r2, sp, #8
+ 800676a:	4621      	mov	r1, r4
+ 800676c:	4620      	mov	r0, r4
+ 800676e:	f7ff f8d4 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSub(Y1, Y1, t5, curve->p, num_words_secp256k1); /* t2 = B * (A - x3) - y1^4 = y3 */
+ 8006772:	463b      	mov	r3, r7
+ 8006774:	aa0a      	add	r2, sp, #40	; 0x28
+ 8006776:	4621      	mov	r1, r4
+ 8006778:	4620      	mov	r0, r4
+ 800677a:	f7ff fcd5 	bl	8006128 <uECC_vli_modSub.isra.0>
+}
+ 800677e:	b013      	add	sp, #76	; 0x4c
+ 8006780:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+        uECC_vli_rshift1(Y1, num_words_secp256k1);
+ 8006784:	4641      	mov	r1, r8
+ 8006786:	4620      	mov	r0, r4
+ 8006788:	f7ff f81a 	bl	80057c0 <uECC_vli_rshift1>
+ 800678c:	e7d4      	b.n	8006738 <double_jacobian_secp256k1+0x98>
+
+0800678e <x_side_default>:
+static void x_side_default(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve) {
+ 800678e:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 8006792:	b08a      	sub	sp, #40	; 0x28
+ 8006794:	4604      	mov	r4, r0
+ 8006796:	4615      	mov	r5, r2
+ 8006798:	460e      	mov	r6, r1
+    uECC_word_t _3[uECC_MAX_WORDS] = {3}; /* -a = 3 */
+ 800679a:	221c      	movs	r2, #28
+ 800679c:	2100      	movs	r1, #0
+ 800679e:	a803      	add	r0, sp, #12
+ 80067a0:	f006 ff9a 	bl	800d6d8 <memset>
+    uECC_vli_modSub(result, result, _3, curve->p, num_words);       /* r = x^2 - 3 */
+ 80067a4:	1d2f      	adds	r7, r5, #4
+    uECC_word_t _3[uECC_MAX_WORDS] = {3}; /* -a = 3 */
+ 80067a6:	2303      	movs	r3, #3
+    uECC_vli_modSquare_fast(result, x, curve);                             /* r = x^2 */
+ 80067a8:	462a      	mov	r2, r5
+ 80067aa:	4631      	mov	r1, r6
+ 80067ac:	4620      	mov	r0, r4
+    wordcount_t num_words = curve->num_words;
+ 80067ae:	f995 8000 	ldrsb.w	r8, [r5]
+    uECC_word_t _3[uECC_MAX_WORDS] = {3}; /* -a = 3 */
+ 80067b2:	9302      	str	r3, [sp, #8]
+    uECC_vli_modSquare_fast(result, x, curve);                             /* r = x^2 */
+ 80067b4:	f7ff f8c1 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modSub(result, result, _3, curve->p, num_words);       /* r = x^2 - 3 */
+ 80067b8:	463b      	mov	r3, r7
+ 80067ba:	aa02      	add	r2, sp, #8
+ 80067bc:	4621      	mov	r1, r4
+ 80067be:	4620      	mov	r0, r4
+ 80067c0:	f7ff fcb2 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(result, result, x, curve);                       /* r = x^3 - 3x */
+ 80067c4:	462b      	mov	r3, r5
+ 80067c6:	4632      	mov	r2, r6
+ 80067c8:	4621      	mov	r1, r4
+ 80067ca:	4620      	mov	r0, r4
+ 80067cc:	f7ff f8a5 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modAdd(result, result, curve->b, curve->p, num_words); /* r = x^3 - 3x + b */
+ 80067d0:	f8cd 8000 	str.w	r8, [sp]
+ 80067d4:	463b      	mov	r3, r7
+ 80067d6:	f105 0284 	add.w	r2, r5, #132	; 0x84
+ 80067da:	4621      	mov	r1, r4
+ 80067dc:	4620      	mov	r0, r4
+ 80067de:	f7ff fc75 	bl	80060cc <uECC_vli_modAdd>
+}
+ 80067e2:	b00a      	add	sp, #40	; 0x28
+ 80067e4:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+
+080067e8 <double_jacobian_default>:
+                                    uECC_Curve curve) {
+ 80067e8:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+    wordcount_t num_words = curve->num_words;
+ 80067ec:	f993 8000 	ldrsb.w	r8, [r3]
+                                    uECC_Curve curve) {
+ 80067f0:	b092      	sub	sp, #72	; 0x48
+ 80067f2:	4604      	mov	r4, r0
+ 80067f4:	4689      	mov	r9, r1
+    if (uECC_vli_isZero(Z1, num_words)) {
+ 80067f6:	4610      	mov	r0, r2
+ 80067f8:	4641      	mov	r1, r8
+                                    uECC_Curve curve) {
+ 80067fa:	4615      	mov	r5, r2
+ 80067fc:	461e      	mov	r6, r3
+    if (uECC_vli_isZero(Z1, num_words)) {
+ 80067fe:	f7fe ff85 	bl	800570c <uECC_vli_isZero>
+ 8006802:	2800      	cmp	r0, #0
+ 8006804:	f040 808e 	bne.w	8006924 <double_jacobian_default+0x13c>
+    uECC_vli_modSquare_fast(t4, Y1, curve);   /* t4 = y1^2 */
+ 8006808:	4632      	mov	r2, r6
+ 800680a:	4649      	mov	r1, r9
+ 800680c:	a802      	add	r0, sp, #8
+ 800680e:	f7ff f894 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modMult_fast(t5, X1, t4, curve); /* t5 = x1*y1^2 = A */
+ 8006812:	4633      	mov	r3, r6
+ 8006814:	aa02      	add	r2, sp, #8
+ 8006816:	4621      	mov	r1, r4
+ 8006818:	a80a      	add	r0, sp, #40	; 0x28
+ 800681a:	f7ff f87e 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSquare_fast(t4, t4, curve);   /* t4 = y1^4 */
+ 800681e:	a902      	add	r1, sp, #8
+ 8006820:	4608      	mov	r0, r1
+ 8006822:	4632      	mov	r2, r6
+ 8006824:	f7ff f889 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modMult_fast(Y1, Y1, Z1, curve); /* t2 = y1*z1 = z3 */
+ 8006828:	4633      	mov	r3, r6
+ 800682a:	462a      	mov	r2, r5
+ 800682c:	4649      	mov	r1, r9
+ 800682e:	4648      	mov	r0, r9
+ 8006830:	f7ff f873 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modAdd(X1, X1, Z1, curve->p, num_words); /* t1 = x1 + z1^2 */
+ 8006834:	1d37      	adds	r7, r6, #4
+    uECC_vli_modSquare_fast(Z1, Z1, curve);   /* t3 = z1^2 */
+ 8006836:	4632      	mov	r2, r6
+ 8006838:	4629      	mov	r1, r5
+ 800683a:	4628      	mov	r0, r5
+ 800683c:	f7ff f87d 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modAdd(X1, X1, Z1, curve->p, num_words); /* t1 = x1 + z1^2 */
+ 8006840:	463b      	mov	r3, r7
+ 8006842:	462a      	mov	r2, r5
+ 8006844:	4621      	mov	r1, r4
+ 8006846:	4620      	mov	r0, r4
+ 8006848:	f8cd 8000 	str.w	r8, [sp]
+ 800684c:	f7ff fc3e 	bl	80060cc <uECC_vli_modAdd>
+    uECC_vli_modAdd(Z1, Z1, Z1, curve->p, num_words); /* t3 = 2*z1^2 */
+ 8006850:	463b      	mov	r3, r7
+ 8006852:	462a      	mov	r2, r5
+ 8006854:	4629      	mov	r1, r5
+ 8006856:	4628      	mov	r0, r5
+ 8006858:	f8cd 8000 	str.w	r8, [sp]
+ 800685c:	f7ff fc36 	bl	80060cc <uECC_vli_modAdd>
+    uECC_vli_modSub(Z1, X1, Z1, curve->p, num_words); /* t3 = x1 - z1^2 */
+ 8006860:	463b      	mov	r3, r7
+ 8006862:	462a      	mov	r2, r5
+ 8006864:	4621      	mov	r1, r4
+ 8006866:	4628      	mov	r0, r5
+ 8006868:	f7ff fc5e 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(X1, X1, Z1, curve);                /* t1 = x1^2 - z1^4 */
+ 800686c:	4633      	mov	r3, r6
+ 800686e:	462a      	mov	r2, r5
+ 8006870:	4621      	mov	r1, r4
+ 8006872:	4620      	mov	r0, r4
+ 8006874:	f7ff f851 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modAdd(Z1, X1, X1, curve->p, num_words); /* t3 = 2*(x1^2 - z1^4) */
+ 8006878:	463b      	mov	r3, r7
+ 800687a:	4622      	mov	r2, r4
+ 800687c:	4621      	mov	r1, r4
+ 800687e:	4628      	mov	r0, r5
+ 8006880:	f8cd 8000 	str.w	r8, [sp]
+ 8006884:	f7ff fc22 	bl	80060cc <uECC_vli_modAdd>
+    uECC_vli_modAdd(X1, X1, Z1, curve->p, num_words); /* t1 = 3*(x1^2 - z1^4) */
+ 8006888:	463b      	mov	r3, r7
+ 800688a:	f8cd 8000 	str.w	r8, [sp]
+ 800688e:	462a      	mov	r2, r5
+ 8006890:	4621      	mov	r1, r4
+ 8006892:	4620      	mov	r0, r4
+ 8006894:	f7ff fc1a 	bl	80060cc <uECC_vli_modAdd>
+ 8006898:	6823      	ldr	r3, [r4, #0]
+    if (uECC_vli_testBit(X1, 0)) {
+ 800689a:	07db      	lsls	r3, r3, #31
+ 800689c:	d545      	bpl.n	800692a <double_jacobian_default+0x142>
+        uECC_word_t l_carry = uECC_vli_add(X1, X1, curve->p, num_words);
+ 800689e:	463a      	mov	r2, r7
+ 80068a0:	4621      	mov	r1, r4
+ 80068a2:	4620      	mov	r0, r4
+ 80068a4:	f7ff f9c6 	bl	8005c34 <uECC_vli_add.constprop.0>
+        uECC_vli_rshift1(X1, num_words);
+ 80068a8:	4641      	mov	r1, r8
+        uECC_word_t l_carry = uECC_vli_add(X1, X1, curve->p, num_words);
+ 80068aa:	4682      	mov	sl, r0
+        uECC_vli_rshift1(X1, num_words);
+ 80068ac:	4620      	mov	r0, r4
+ 80068ae:	f7fe ff87 	bl	80057c0 <uECC_vli_rshift1>
+        X1[num_words - 1] |= l_carry << (uECC_WORD_BITS - 1);
+ 80068b2:	f108 4380 	add.w	r3, r8, #1073741824	; 0x40000000
+ 80068b6:	3b01      	subs	r3, #1
+ 80068b8:	f854 2023 	ldr.w	r2, [r4, r3, lsl #2]
+ 80068bc:	ea42 72ca 	orr.w	r2, r2, sl, lsl #31
+ 80068c0:	f844 2023 	str.w	r2, [r4, r3, lsl #2]
+    uECC_vli_modSquare_fast(Z1, X1, curve);                  /* t3 = B^2 */
+ 80068c4:	4632      	mov	r2, r6
+ 80068c6:	4621      	mov	r1, r4
+ 80068c8:	4628      	mov	r0, r5
+ 80068ca:	f7ff f836 	bl	800593a <uECC_vli_modSquare_fast>
+    uECC_vli_modSub(Z1, Z1, t5, curve->p, num_words); /* t3 = B^2 - A */
+ 80068ce:	463b      	mov	r3, r7
+ 80068d0:	aa0a      	add	r2, sp, #40	; 0x28
+ 80068d2:	4629      	mov	r1, r5
+ 80068d4:	4628      	mov	r0, r5
+ 80068d6:	f7ff fc27 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(Z1, Z1, t5, curve->p, num_words); /* t3 = B^2 - 2A = x3 */
+ 80068da:	463b      	mov	r3, r7
+ 80068dc:	aa0a      	add	r2, sp, #40	; 0x28
+ 80068de:	4629      	mov	r1, r5
+ 80068e0:	4628      	mov	r0, r5
+ 80068e2:	f7ff fc21 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modSub(t5, t5, Z1, curve->p, num_words); /* t5 = A - x3 */
+ 80068e6:	a90a      	add	r1, sp, #40	; 0x28
+ 80068e8:	4608      	mov	r0, r1
+ 80068ea:	463b      	mov	r3, r7
+ 80068ec:	462a      	mov	r2, r5
+ 80068ee:	f7ff fc1b 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_modMult_fast(X1, X1, t5, curve);                /* t1 = B * (A - x3) */
+ 80068f2:	4633      	mov	r3, r6
+ 80068f4:	aa0a      	add	r2, sp, #40	; 0x28
+ 80068f6:	4621      	mov	r1, r4
+ 80068f8:	4620      	mov	r0, r4
+ 80068fa:	f7ff f80e 	bl	800591a <uECC_vli_modMult_fast>
+    uECC_vli_modSub(t4, X1, t4, curve->p, num_words); /* t4 = B * (A - x3) - y1^4 = y3 */
+ 80068fe:	aa02      	add	r2, sp, #8
+ 8006900:	463b      	mov	r3, r7
+ 8006902:	4610      	mov	r0, r2
+ 8006904:	4621      	mov	r1, r4
+ 8006906:	f7ff fc0f 	bl	8006128 <uECC_vli_modSub.isra.0>
+    uECC_vli_set(X1, Z1, num_words);
+ 800690a:	4642      	mov	r2, r8
+ 800690c:	4629      	mov	r1, r5
+ 800690e:	4620      	mov	r0, r4
+ 8006910:	f7fe ff35 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(Z1, Y1, num_words);
+ 8006914:	4649      	mov	r1, r9
+ 8006916:	4628      	mov	r0, r5
+ 8006918:	f7fe ff31 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(Y1, t4, num_words);
+ 800691c:	a902      	add	r1, sp, #8
+ 800691e:	4648      	mov	r0, r9
+ 8006920:	f7fe ff2d 	bl	800577e <uECC_vli_set>
+}
+ 8006924:	b012      	add	sp, #72	; 0x48
+ 8006926:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+        uECC_vli_rshift1(X1, num_words);
+ 800692a:	4641      	mov	r1, r8
+ 800692c:	4620      	mov	r0, r4
+ 800692e:	f7fe ff47 	bl	80057c0 <uECC_vli_rshift1>
+ 8006932:	e7c7      	b.n	80068c4 <double_jacobian_default+0xdc>
+
+08006934 <uECC_set_rng>:
+    g_rng_function = rng_function;
+ 8006934:	4b01      	ldr	r3, [pc, #4]	; (800693c <uECC_set_rng+0x8>)
+ 8006936:	6018      	str	r0, [r3, #0]
+}
+ 8006938:	4770      	bx	lr
+ 800693a:	bf00      	nop
+ 800693c:	2009e2a0 	.word	0x2009e2a0
+
+08006940 <uECC_secp256r1>:
+uECC_Curve uECC_secp256r1(void) { return &curve_secp256r1; }
+ 8006940:	4800      	ldr	r0, [pc, #0]	; (8006944 <uECC_secp256r1+0x4>)
+ 8006942:	4770      	bx	lr
+ 8006944:	0800e9b0 	.word	0x0800e9b0
+
+08006948 <uECC_secp256k1>:
+uECC_Curve uECC_secp256k1(void) { return &curve_secp256k1; }
+ 8006948:	4800      	ldr	r0, [pc, #0]	; (800694c <uECC_secp256k1+0x4>)
+ 800694a:	4770      	bx	lr
+ 800694c:	0800e8fc 	.word	0x0800e8fc
+
+08006950 <uECC_make_key>:
+                  uECC_Curve curve) {
+ 8006950:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 8006954:	4605      	mov	r5, r0
+ 8006956:	b098      	sub	sp, #96	; 0x60
+ 8006958:	460f      	mov	r7, r1
+ 800695a:	4614      	mov	r4, r2
+ 800695c:	2640      	movs	r6, #64	; 0x40
+        if (!uECC_generate_random_int(private, curve->n, BITS_TO_WORDS(curve->num_n_bits))) {
+ 800695e:	f102 0824 	add.w	r8, r2, #36	; 0x24
+ 8006962:	f9b4 3002 	ldrsh.w	r3, [r4, #2]
+ 8006966:	f113 021f 	adds.w	r2, r3, #31
+ 800696a:	bf48      	it	mi
+ 800696c:	f103 023e 	addmi.w	r2, r3, #62	; 0x3e
+ 8006970:	f342 1247 	sbfx	r2, r2, #5, #8
+ 8006974:	4641      	mov	r1, r8
+ 8006976:	4668      	mov	r0, sp
+ 8006978:	f7ff f920 	bl	8005bbc <uECC_generate_random_int>
+ 800697c:	b330      	cbz	r0, 80069cc <uECC_make_key+0x7c>
+        if (EccPoint_compute_public_key(public, private, curve)) {
+ 800697e:	4622      	mov	r2, r4
+ 8006980:	4669      	mov	r1, sp
+ 8006982:	a808      	add	r0, sp, #32
+ 8006984:	f7ff fd8f 	bl	80064a6 <EccPoint_compute_public_key>
+ 8006988:	b1f0      	cbz	r0, 80069c8 <uECC_make_key+0x78>
+            uECC_vli_nativeToBytes(private_key, BITS_TO_BYTES(curve->num_n_bits), private);
+ 800698a:	f9b4 3002 	ldrsh.w	r3, [r4, #2]
+ 800698e:	1dd9      	adds	r1, r3, #7
+ 8006990:	bf48      	it	mi
+ 8006992:	f103 010e 	addmi.w	r1, r3, #14
+ 8006996:	466a      	mov	r2, sp
+ 8006998:	10c9      	asrs	r1, r1, #3
+ 800699a:	4638      	mov	r0, r7
+ 800699c:	f7fe fff0 	bl	8005980 <uECC_vli_nativeToBytes>
+            uECC_vli_nativeToBytes(public_key, curve->num_bytes, public);
+ 80069a0:	f994 1001 	ldrsb.w	r1, [r4, #1]
+ 80069a4:	aa08      	add	r2, sp, #32
+ 80069a6:	4628      	mov	r0, r5
+ 80069a8:	f7fe ffea 	bl	8005980 <uECC_vli_nativeToBytes>
+                public_key + curve->num_bytes, curve->num_bytes, public + curve->num_words);
+ 80069ac:	f994 1001 	ldrsb.w	r1, [r4, #1]
+ 80069b0:	f994 2000 	ldrsb.w	r2, [r4]
+            uECC_vli_nativeToBytes(
+ 80069b4:	ab08      	add	r3, sp, #32
+ 80069b6:	1868      	adds	r0, r5, r1
+ 80069b8:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 80069bc:	f7fe ffe0 	bl	8005980 <uECC_vli_nativeToBytes>
+            return 1;
+ 80069c0:	2001      	movs	r0, #1
+}
+ 80069c2:	b018      	add	sp, #96	; 0x60
+ 80069c4:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+    for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
+ 80069c8:	3e01      	subs	r6, #1
+ 80069ca:	d1ca      	bne.n	8006962 <uECC_make_key+0x12>
+            return 0;
+ 80069cc:	2000      	movs	r0, #0
+ 80069ce:	e7f8      	b.n	80069c2 <uECC_make_key+0x72>
+
+080069d0 <uECC_shared_secret>:
+                       uECC_Curve curve) {
+ 80069d0:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 80069d4:	461c      	mov	r4, r3
+    wordcount_t num_bytes = curve->num_bytes;
+ 80069d6:	f993 6001 	ldrsb.w	r6, [r3, #1]
+    wordcount_t num_words = curve->num_words;
+ 80069da:	f993 9000 	ldrsb.w	r9, [r3]
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 80069de:	f9b3 3002 	ldrsh.w	r3, [r3, #2]
+                       uECC_Curve curve) {
+ 80069e2:	b0a6      	sub	sp, #152	; 0x98
+ 80069e4:	4617      	mov	r7, r2
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 80069e6:	1dda      	adds	r2, r3, #7
+ 80069e8:	bf48      	it	mi
+ 80069ea:	f103 020e 	addmi.w	r2, r3, #14
+    uECC_word_t *p2[2] = {private, tmp};
+ 80069ee:	f10d 0818 	add.w	r8, sp, #24
+                       uECC_Curve curve) {
+ 80069f2:	4605      	mov	r5, r0
+    uECC_word_t *p2[2] = {private, tmp};
+ 80069f4:	f10d 0a38 	add.w	sl, sp, #56	; 0x38
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 80069f8:	10d2      	asrs	r2, r2, #3
+ 80069fa:	4640      	mov	r0, r8
+    uECC_word_t *p2[2] = {private, tmp};
+ 80069fc:	f8cd 8010 	str.w	r8, [sp, #16]
+ 8006a00:	f8cd a014 	str.w	sl, [sp, #20]
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 8006a04:	f7fe ffd0 	bl	80059a8 <uECC_vli_bytesToNative>
+    uECC_vli_bytesToNative(public, public_key, num_bytes);
+ 8006a08:	4629      	mov	r1, r5
+ 8006a0a:	4632      	mov	r2, r6
+ 8006a0c:	a816      	add	r0, sp, #88	; 0x58
+ 8006a0e:	f7fe ffcb 	bl	80059a8 <uECC_vli_bytesToNative>
+    uECC_vli_bytesToNative(public + num_words, public_key + num_bytes, num_bytes);
+ 8006a12:	ab16      	add	r3, sp, #88	; 0x58
+ 8006a14:	19a9      	adds	r1, r5, r6
+ 8006a16:	eb03 0089 	add.w	r0, r3, r9, lsl #2
+ 8006a1a:	4632      	mov	r2, r6
+ 8006a1c:	f7fe ffc4 	bl	80059a8 <uECC_vli_bytesToNative>
+    carry = regularize_k(private, private, tmp, curve);
+ 8006a20:	4623      	mov	r3, r4
+ 8006a22:	4652      	mov	r2, sl
+ 8006a24:	4641      	mov	r1, r8
+ 8006a26:	4640      	mov	r0, r8
+ 8006a28:	f7ff f929 	bl	8005c7e <regularize_k>
+    if (g_rng_function) {
+ 8006a2c:	4b19      	ldr	r3, [pc, #100]	; (8006a94 <uECC_shared_secret+0xc4>)
+ 8006a2e:	681b      	ldr	r3, [r3, #0]
+    carry = regularize_k(private, private, tmp, curve);
+ 8006a30:	4605      	mov	r5, r0
+    if (g_rng_function) {
+ 8006a32:	b163      	cbz	r3, 8006a4e <uECC_shared_secret+0x7e>
+        if (!uECC_generate_random_int(p2[carry], curve->p, num_words)) {
+ 8006a34:	ab26      	add	r3, sp, #152	; 0x98
+ 8006a36:	eb03 0380 	add.w	r3, r3, r0, lsl #2
+ 8006a3a:	464a      	mov	r2, r9
+ 8006a3c:	f853 3c88 	ldr.w	r3, [r3, #-136]
+ 8006a40:	9303      	str	r3, [sp, #12]
+ 8006a42:	4618      	mov	r0, r3
+ 8006a44:	1d21      	adds	r1, r4, #4
+ 8006a46:	f7ff f8b9 	bl	8005bbc <uECC_generate_random_int>
+ 8006a4a:	9b03      	ldr	r3, [sp, #12]
+ 8006a4c:	b1f0      	cbz	r0, 8006a8c <uECC_shared_secret+0xbc>
+    EccPoint_mult(public, public, p2[!carry], initial_Z, curve->num_n_bits + 1, curve);
+ 8006a4e:	fab5 f185 	clz	r1, r5
+ 8006a52:	aa26      	add	r2, sp, #152	; 0x98
+ 8006a54:	0949      	lsrs	r1, r1, #5
+ 8006a56:	eb02 0181 	add.w	r1, r2, r1, lsl #2
+ 8006a5a:	8862      	ldrh	r2, [r4, #2]
+ 8006a5c:	9401      	str	r4, [sp, #4]
+ 8006a5e:	3201      	adds	r2, #1
+ 8006a60:	b212      	sxth	r2, r2
+ 8006a62:	9200      	str	r2, [sp, #0]
+ 8006a64:	f851 2c88 	ldr.w	r2, [r1, #-136]
+ 8006a68:	a916      	add	r1, sp, #88	; 0x58
+ 8006a6a:	4608      	mov	r0, r1
+ 8006a6c:	f7ff fc50 	bl	8006310 <EccPoint_mult>
+    uECC_vli_nativeToBytes(secret, num_bytes, public);
+ 8006a70:	aa16      	add	r2, sp, #88	; 0x58
+ 8006a72:	4631      	mov	r1, r6
+ 8006a74:	4638      	mov	r0, r7
+ 8006a76:	f7fe ff83 	bl	8005980 <uECC_vli_nativeToBytes>
+    return !EccPoint_isZero(public, curve);
+ 8006a7a:	7821      	ldrb	r1, [r4, #0]
+ 8006a7c:	0049      	lsls	r1, r1, #1
+ 8006a7e:	b249      	sxtb	r1, r1
+ 8006a80:	4610      	mov	r0, r2
+ 8006a82:	f7fe fe43 	bl	800570c <uECC_vli_isZero>
+ 8006a86:	fab0 f080 	clz	r0, r0
+ 8006a8a:	0940      	lsrs	r0, r0, #5
+}
+ 8006a8c:	b026      	add	sp, #152	; 0x98
+ 8006a8e:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+ 8006a92:	bf00      	nop
+ 8006a94:	2009e2a0 	.word	0x2009e2a0
+
+08006a98 <uECC_compress>:
+void uECC_compress(const uint8_t *public_key, uint8_t *compressed, uECC_Curve curve) {
+ 8006a98:	b530      	push	{r4, r5, lr}
+    for (i = 0; i < curve->num_bytes; ++i) {
+ 8006a9a:	2400      	movs	r4, #0
+ 8006a9c:	f992 5001 	ldrsb.w	r5, [r2, #1]
+ 8006aa0:	b263      	sxtb	r3, r4
+ 8006aa2:	429d      	cmp	r5, r3
+ 8006aa4:	dc08      	bgt.n	8006ab8 <uECC_compress+0x20>
+    compressed[0] = 2 + (public_key[curve->num_bytes * 2 - 1] & 0x01);
+ 8006aa6:	eb00 0045 	add.w	r0, r0, r5, lsl #1
+ 8006aaa:	f810 3c01 	ldrb.w	r3, [r0, #-1]
+ 8006aae:	f003 0301 	and.w	r3, r3, #1
+ 8006ab2:	3302      	adds	r3, #2
+ 8006ab4:	700b      	strb	r3, [r1, #0]
+}
+ 8006ab6:	bd30      	pop	{r4, r5, pc}
+        compressed[i+1] = public_key[i];
+ 8006ab8:	5cc5      	ldrb	r5, [r0, r3]
+ 8006aba:	440b      	add	r3, r1
+ 8006abc:	3401      	adds	r4, #1
+ 8006abe:	705d      	strb	r5, [r3, #1]
+    for (i = 0; i < curve->num_bytes; ++i) {
+ 8006ac0:	e7ec      	b.n	8006a9c <uECC_compress+0x4>
+
+08006ac2 <uECC_decompress>:
+void uECC_decompress(const uint8_t *compressed, uint8_t *public_key, uECC_Curve curve) {
+ 8006ac2:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+    uECC_word_t *y = point + curve->num_words;
+ 8006ac6:	f992 8000 	ldrsb.w	r8, [r2]
+void uECC_decompress(const uint8_t *compressed, uint8_t *public_key, uECC_Curve curve) {
+ 8006aca:	b090      	sub	sp, #64	; 0x40
+ 8006acc:	4614      	mov	r4, r2
+ 8006ace:	4607      	mov	r7, r0
+    uECC_vli_bytesToNative(point, compressed + 1, curve->num_bytes);
+ 8006ad0:	f992 2001 	ldrsb.w	r2, [r2, #1]
+    uECC_word_t *y = point + curve->num_words;
+ 8006ad4:	eb0d 0588 	add.w	r5, sp, r8, lsl #2
+void uECC_decompress(const uint8_t *compressed, uint8_t *public_key, uECC_Curve curve) {
+ 8006ad8:	460e      	mov	r6, r1
+    uECC_vli_bytesToNative(point, compressed + 1, curve->num_bytes);
+ 8006ada:	1c41      	adds	r1, r0, #1
+ 8006adc:	4668      	mov	r0, sp
+ 8006ade:	f7fe ff63 	bl	80059a8 <uECC_vli_bytesToNative>
+    curve->x_side(y, point, curve);
+ 8006ae2:	4622      	mov	r2, r4
+ 8006ae4:	f8d4 30ac 	ldr.w	r3, [r4, #172]	; 0xac
+ 8006ae8:	4669      	mov	r1, sp
+ 8006aea:	4628      	mov	r0, r5
+ 8006aec:	4798      	blx	r3
+    curve->mod_sqrt(y, curve);
+ 8006aee:	f8d4 30a8 	ldr.w	r3, [r4, #168]	; 0xa8
+ 8006af2:	4621      	mov	r1, r4
+ 8006af4:	4628      	mov	r0, r5
+ 8006af6:	4798      	blx	r3
+    if ((y[0] & 0x01) != (compressed[0] & 0x01)) {
+ 8006af8:	783b      	ldrb	r3, [r7, #0]
+ 8006afa:	f85d 2028 	ldr.w	r2, [sp, r8, lsl #2]
+ 8006afe:	4053      	eors	r3, r2
+ 8006b00:	07db      	lsls	r3, r3, #31
+ 8006b02:	d504      	bpl.n	8006b0e <uECC_decompress+0x4c>
+        uECC_vli_sub(y, curve->p, y, curve->num_words);
+ 8006b04:	462a      	mov	r2, r5
+ 8006b06:	1d21      	adds	r1, r4, #4
+ 8006b08:	4628      	mov	r0, r5
+ 8006b0a:	f7fe ffd1 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    uECC_vli_nativeToBytes(public_key, curve->num_bytes, point);
+ 8006b0e:	f994 1001 	ldrsb.w	r1, [r4, #1]
+ 8006b12:	466a      	mov	r2, sp
+ 8006b14:	4630      	mov	r0, r6
+ 8006b16:	f7fe ff33 	bl	8005980 <uECC_vli_nativeToBytes>
+    uECC_vli_nativeToBytes(public_key + curve->num_bytes, curve->num_bytes, y);
+ 8006b1a:	f994 1001 	ldrsb.w	r1, [r4, #1]
+ 8006b1e:	462a      	mov	r2, r5
+ 8006b20:	1870      	adds	r0, r6, r1
+ 8006b22:	f7fe ff2d 	bl	8005980 <uECC_vli_nativeToBytes>
+}
+ 8006b26:	b010      	add	sp, #64	; 0x40
+ 8006b28:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+
+08006b2c <uECC_valid_point>:
+int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve) {
+ 8006b2c:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+    if (EccPoint_isZero(point, curve)) {
+ 8006b30:	780d      	ldrb	r5, [r1, #0]
+    wordcount_t num_words = curve->num_words;
+ 8006b32:	f991 2000 	ldrsb.w	r2, [r1]
+int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve) {
+ 8006b36:	b092      	sub	sp, #72	; 0x48
+ 8006b38:	460e      	mov	r6, r1
+    if (EccPoint_isZero(point, curve)) {
+ 8006b3a:	0069      	lsls	r1, r5, #1
+ 8006b3c:	b249      	sxtb	r1, r1
+int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve) {
+ 8006b3e:	4607      	mov	r7, r0
+    wordcount_t num_words = curve->num_words;
+ 8006b40:	9201      	str	r2, [sp, #4]
+    if (EccPoint_isZero(point, curve)) {
+ 8006b42:	f7fe fde3 	bl	800570c <uECC_vli_isZero>
+ 8006b46:	4604      	mov	r4, r0
+ 8006b48:	bb80      	cbnz	r0, 8006bac <uECC_valid_point+0x80>
+    if (uECC_vli_cmp_unsafe(curve->p, point, num_words) != 1 ||
+ 8006b4a:	f106 0804 	add.w	r8, r6, #4
+ 8006b4e:	9a01      	ldr	r2, [sp, #4]
+ 8006b50:	4639      	mov	r1, r7
+ 8006b52:	4640      	mov	r0, r8
+ 8006b54:	f7fe fe1f 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 8006b58:	2801      	cmp	r0, #1
+ 8006b5a:	d11a      	bne.n	8006b92 <uECC_valid_point+0x66>
+            uECC_vli_cmp_unsafe(curve->p, point + num_words, num_words) != 1) {
+ 8006b5c:	9a01      	ldr	r2, [sp, #4]
+ 8006b5e:	4640      	mov	r0, r8
+ 8006b60:	eb07 0182 	add.w	r1, r7, r2, lsl #2
+ 8006b64:	f7fe fe17 	bl	8005796 <uECC_vli_cmp_unsafe>
+    if (uECC_vli_cmp_unsafe(curve->p, point, num_words) != 1 ||
+ 8006b68:	2801      	cmp	r0, #1
+ 8006b6a:	d112      	bne.n	8006b92 <uECC_valid_point+0x66>
+    uECC_vli_modSquare_fast(tmp1, point + num_words, curve);
+ 8006b6c:	4632      	mov	r2, r6
+ 8006b6e:	a802      	add	r0, sp, #8
+    curve->x_side(tmp2, point, curve); /* tmp2 = x^3 + ax + b */
+ 8006b70:	f10d 0828 	add.w	r8, sp, #40	; 0x28
+    uECC_vli_modSquare_fast(tmp1, point + num_words, curve);
+ 8006b74:	f7fe fee1 	bl	800593a <uECC_vli_modSquare_fast>
+    curve->x_side(tmp2, point, curve); /* tmp2 = x^3 + ax + b */
+ 8006b78:	f8d6 30ac 	ldr.w	r3, [r6, #172]	; 0xac
+ 8006b7c:	4632      	mov	r2, r6
+ 8006b7e:	4639      	mov	r1, r7
+ 8006b80:	4640      	mov	r0, r8
+ 8006b82:	4798      	blx	r3
+    for (i = num_words - 1; i >= 0; --i) {
+ 8006b84:	1e6b      	subs	r3, r5, #1
+ 8006b86:	b25b      	sxtb	r3, r3
+ 8006b88:	061a      	lsls	r2, r3, #24
+ 8006b8a:	d506      	bpl.n	8006b9a <uECC_valid_point+0x6e>
+    return (diff == 0);
+ 8006b8c:	fab4 f484 	clz	r4, r4
+ 8006b90:	0964      	lsrs	r4, r4, #5
+}
+ 8006b92:	4620      	mov	r0, r4
+ 8006b94:	b012      	add	sp, #72	; 0x48
+ 8006b96:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+        diff |= (left[i] ^ right[i]);
+ 8006b9a:	aa02      	add	r2, sp, #8
+ 8006b9c:	f858 1023 	ldr.w	r1, [r8, r3, lsl #2]
+ 8006ba0:	f852 2023 	ldr.w	r2, [r2, r3, lsl #2]
+ 8006ba4:	404a      	eors	r2, r1
+ 8006ba6:	4314      	orrs	r4, r2
+    for (i = num_words - 1; i >= 0; --i) {
+ 8006ba8:	3b01      	subs	r3, #1
+ 8006baa:	e7ed      	b.n	8006b88 <uECC_valid_point+0x5c>
+        return 0;
+ 8006bac:	2400      	movs	r4, #0
+ 8006bae:	e7f0      	b.n	8006b92 <uECC_valid_point+0x66>
+
+08006bb0 <uECC_valid_public_key>:
+int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve) {
+ 8006bb0:	b530      	push	{r4, r5, lr}
+ 8006bb2:	460c      	mov	r4, r1
+ 8006bb4:	b091      	sub	sp, #68	; 0x44
+    uECC_vli_bytesToNative(public, public_key, curve->num_bytes);
+ 8006bb6:	f991 2001 	ldrsb.w	r2, [r1, #1]
+int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve) {
+ 8006bba:	4605      	mov	r5, r0
+    uECC_vli_bytesToNative(public, public_key, curve->num_bytes);
+ 8006bbc:	4601      	mov	r1, r0
+ 8006bbe:	4668      	mov	r0, sp
+ 8006bc0:	f7fe fef2 	bl	80059a8 <uECC_vli_bytesToNative>
+        public + curve->num_words, public_key + curve->num_bytes, curve->num_bytes);
+ 8006bc4:	f994 2001 	ldrsb.w	r2, [r4, #1]
+ 8006bc8:	f994 0000 	ldrsb.w	r0, [r4]
+    uECC_vli_bytesToNative(
+ 8006bcc:	18a9      	adds	r1, r5, r2
+ 8006bce:	eb0d 0080 	add.w	r0, sp, r0, lsl #2
+ 8006bd2:	f7fe fee9 	bl	80059a8 <uECC_vli_bytesToNative>
+    return uECC_valid_point(public, curve);
+ 8006bd6:	4621      	mov	r1, r4
+ 8006bd8:	4668      	mov	r0, sp
+ 8006bda:	f7ff ffa7 	bl	8006b2c <uECC_valid_point>
+}
+ 8006bde:	b011      	add	sp, #68	; 0x44
+ 8006be0:	bd30      	pop	{r4, r5, pc}
+
+08006be2 <uECC_compute_public_key>:
+int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key, uECC_Curve curve) {
+ 8006be2:	b570      	push	{r4, r5, r6, lr}
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 8006be4:	f9b2 3002 	ldrsh.w	r3, [r2, #2]
+int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key, uECC_Curve curve) {
+ 8006be8:	4614      	mov	r4, r2
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 8006bea:	1dda      	adds	r2, r3, #7
+ 8006bec:	bf48      	it	mi
+ 8006bee:	f103 020e 	addmi.w	r2, r3, #14
+int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key, uECC_Curve curve) {
+ 8006bf2:	b098      	sub	sp, #96	; 0x60
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 8006bf4:	10d2      	asrs	r2, r2, #3
+int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key, uECC_Curve curve) {
+ 8006bf6:	460e      	mov	r6, r1
+    uECC_vli_bytesToNative(private, private_key, BITS_TO_BYTES(curve->num_n_bits));
+ 8006bf8:	4601      	mov	r1, r0
+ 8006bfa:	4668      	mov	r0, sp
+ 8006bfc:	f7fe fed4 	bl	80059a8 <uECC_vli_bytesToNative>
+    if (uECC_vli_isZero(private, BITS_TO_WORDS(curve->num_n_bits))) {
+ 8006c00:	f9b4 3002 	ldrsh.w	r3, [r4, #2]
+ 8006c04:	f113 021f 	adds.w	r2, r3, #31
+ 8006c08:	bf48      	it	mi
+ 8006c0a:	f103 023e 	addmi.w	r2, r3, #62	; 0x3e
+ 8006c0e:	f342 1147 	sbfx	r1, r2, #5, #8
+ 8006c12:	4668      	mov	r0, sp
+ 8006c14:	f7fe fd7a 	bl	800570c <uECC_vli_isZero>
+ 8006c18:	b110      	cbz	r0, 8006c20 <uECC_compute_public_key+0x3e>
+        return 0;
+ 8006c1a:	2000      	movs	r0, #0
+}
+ 8006c1c:	b018      	add	sp, #96	; 0x60
+ 8006c1e:	bd70      	pop	{r4, r5, r6, pc}
+    if (uECC_vli_cmp(curve->n, private, BITS_TO_WORDS(curve->num_n_bits)) != 1) {
+ 8006c20:	460a      	mov	r2, r1
+ 8006c22:	f104 0024 	add.w	r0, r4, #36	; 0x24
+ 8006c26:	4669      	mov	r1, sp
+ 8006c28:	f7fe ffb0 	bl	8005b8c <uECC_vli_cmp>
+ 8006c2c:	2801      	cmp	r0, #1
+ 8006c2e:	4605      	mov	r5, r0
+ 8006c30:	d1f3      	bne.n	8006c1a <uECC_compute_public_key+0x38>
+    if (!EccPoint_compute_public_key(public, private, curve)) {
+ 8006c32:	4622      	mov	r2, r4
+ 8006c34:	4669      	mov	r1, sp
+ 8006c36:	a808      	add	r0, sp, #32
+ 8006c38:	f7ff fc35 	bl	80064a6 <EccPoint_compute_public_key>
+ 8006c3c:	2800      	cmp	r0, #0
+ 8006c3e:	d0ec      	beq.n	8006c1a <uECC_compute_public_key+0x38>
+    uECC_vli_nativeToBytes(public_key, curve->num_bytes, public);
+ 8006c40:	f994 1001 	ldrsb.w	r1, [r4, #1]
+ 8006c44:	aa08      	add	r2, sp, #32
+ 8006c46:	4630      	mov	r0, r6
+ 8006c48:	f7fe fe9a 	bl	8005980 <uECC_vli_nativeToBytes>
+        public_key + curve->num_bytes, curve->num_bytes, public + curve->num_words);
+ 8006c4c:	f994 1001 	ldrsb.w	r1, [r4, #1]
+ 8006c50:	f994 2000 	ldrsb.w	r2, [r4]
+    uECC_vli_nativeToBytes(
+ 8006c54:	ab08      	add	r3, sp, #32
+ 8006c56:	1870      	adds	r0, r6, r1
+ 8006c58:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 8006c5c:	f7fe fe90 	bl	8005980 <uECC_vli_nativeToBytes>
+    return 1;
+ 8006c60:	4628      	mov	r0, r5
+ 8006c62:	e7db      	b.n	8006c1c <uECC_compute_public_key+0x3a>
+
+08006c64 <uECC_sign>:
+              uECC_Curve curve) {
+ 8006c64:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 8006c68:	b08a      	sub	sp, #40	; 0x28
+ 8006c6a:	4605      	mov	r5, r0
+ 8006c6c:	f8dd 9048 	ldr.w	r9, [sp, #72]	; 0x48
+ 8006c70:	460e      	mov	r6, r1
+ 8006c72:	4617      	mov	r7, r2
+ 8006c74:	4698      	mov	r8, r3
+ 8006c76:	2440      	movs	r4, #64	; 0x40
+        if (!uECC_generate_random_int(k, curve->n, BITS_TO_WORDS(curve->num_n_bits))) {
+ 8006c78:	f109 0a24 	add.w	sl, r9, #36	; 0x24
+ 8006c7c:	f9b9 3002 	ldrsh.w	r3, [r9, #2]
+ 8006c80:	f113 021f 	adds.w	r2, r3, #31
+ 8006c84:	bf48      	it	mi
+ 8006c86:	f103 023e 	addmi.w	r2, r3, #62	; 0x3e
+ 8006c8a:	f342 1247 	sbfx	r2, r2, #5, #8
+ 8006c8e:	4651      	mov	r1, sl
+ 8006c90:	a802      	add	r0, sp, #8
+ 8006c92:	f7fe ff93 	bl	8005bbc <uECC_generate_random_int>
+ 8006c96:	b150      	cbz	r0, 8006cae <uECC_sign+0x4a>
+        if (uECC_sign_with_k(private_key, message_hash, hash_size, k, signature, curve)) {
+ 8006c98:	e9cd 8900 	strd	r8, r9, [sp]
+ 8006c9c:	ab02      	add	r3, sp, #8
+ 8006c9e:	463a      	mov	r2, r7
+ 8006ca0:	4631      	mov	r1, r6
+ 8006ca2:	4628      	mov	r0, r5
+ 8006ca4:	f7ff fc2a 	bl	80064fc <uECC_sign_with_k>
+ 8006ca8:	b928      	cbnz	r0, 8006cb6 <uECC_sign+0x52>
+    for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
+ 8006caa:	3c01      	subs	r4, #1
+ 8006cac:	d1e6      	bne.n	8006c7c <uECC_sign+0x18>
+            return 0;
+ 8006cae:	2000      	movs	r0, #0
+}
+ 8006cb0:	b00a      	add	sp, #40	; 0x28
+ 8006cb2:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+            return 1;
+ 8006cb6:	2001      	movs	r0, #1
+ 8006cb8:	e7fa      	b.n	8006cb0 <uECC_sign+0x4c>
+
+08006cba <uECC_sign_deterministic>:
+int uECC_sign_deterministic(const uint8_t *private_key,
+                            const uint8_t *message_hash,
+                            unsigned hash_size,
+                            uECC_HashContext *hash_context,
+                            uint8_t *signature,
+                            uECC_Curve curve) {
+ 8006cba:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 8006cbe:	b091      	sub	sp, #68	; 0x44
+ 8006cc0:	4693      	mov	fp, r2
+    uint8_t *K = hash_context->tmp;
+    uint8_t *V = K + hash_context->result_size;
+    wordcount_t num_bytes = curve->num_bytes;
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8006cc2:	9a1b      	ldr	r2, [sp, #108]	; 0x6c
+ 8006cc4:	f9b2 8002 	ldrsh.w	r8, [r2, #2]
+    uint8_t *V = K + hash_context->result_size;
+ 8006cc8:	e9d3 6504 	ldrd	r6, r5, [r3, #16]
+                            uECC_Curve curve) {
+ 8006ccc:	461c      	mov	r4, r3
+    wordcount_t num_bytes = curve->num_bytes;
+ 8006cce:	9b1b      	ldr	r3, [sp, #108]	; 0x6c
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8006cd0:	f118 071f 	adds.w	r7, r8, #31
+ 8006cd4:	bf48      	it	mi
+ 8006cd6:	f108 073e 	addmi.w	r7, r8, #62	; 0x3e
+    bitcount_t num_n_bits = curve->num_n_bits;
+    uECC_word_t tries;
+    unsigned i;
+    for (i = 0; i < hash_context->result_size; ++i) {
+ 8006cda:	2200      	movs	r2, #0
+    wordcount_t num_bytes = curve->num_bytes;
+ 8006cdc:	f993 3001 	ldrsb.w	r3, [r3, #1]
+                            uECC_Curve curve) {
+ 8006ce0:	4681      	mov	r9, r0
+ 8006ce2:	468a      	mov	sl, r1
+    uint8_t *V = K + hash_context->result_size;
+ 8006ce4:	442e      	add	r6, r5
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8006ce6:	f347 1747 	sbfx	r7, r7, #5, #8
+        V[i] = 0x01;
+ 8006cea:	2001      	movs	r0, #1
+        K[i] = 0;
+ 8006cec:	4694      	mov	ip, r2
+    for (i = 0; i < hash_context->result_size; ++i) {
+ 8006cee:	6921      	ldr	r1, [r4, #16]
+ 8006cf0:	4291      	cmp	r1, r2
+ 8006cf2:	f200 8086 	bhi.w	8006e02 <uECC_sign_deterministic+0x148>
+    }
+    
+    /* K = HMAC_K(V || 0x00 || int2octets(x) || h(m)) */
+    HMAC_init(hash_context, K);
+ 8006cf6:	4629      	mov	r1, r5
+ 8006cf8:	4620      	mov	r0, r4
+ 8006cfa:	9303      	str	r3, [sp, #12]
+ 8006cfc:	f7fe fe74 	bl	80059e8 <HMAC_init>
+    V[hash_context->result_size] = 0x00;
+ 8006d00:	6922      	ldr	r2, [r4, #16]
+ 8006d02:	2100      	movs	r1, #0
+ 8006d04:	54b1      	strb	r1, [r6, r2]
+    HMAC_update(hash_context, V, hash_context->result_size + 1);
+ 8006d06:	6922      	ldr	r2, [r4, #16]
+ 8006d08:	4631      	mov	r1, r6
+ 8006d0a:	3201      	adds	r2, #1
+ 8006d0c:	4620      	mov	r0, r4
+ 8006d0e:	f7fe fe8c 	bl	8005a2a <HMAC_update>
+    HMAC_update(hash_context, private_key, num_bytes);
+ 8006d12:	9b03      	ldr	r3, [sp, #12]
+ 8006d14:	4649      	mov	r1, r9
+ 8006d16:	461a      	mov	r2, r3
+ 8006d18:	4620      	mov	r0, r4
+ 8006d1a:	f7fe fe86 	bl	8005a2a <HMAC_update>
+    HMAC_update(hash_context, message_hash, hash_size);
+ 8006d1e:	465a      	mov	r2, fp
+ 8006d20:	4651      	mov	r1, sl
+ 8006d22:	4620      	mov	r0, r4
+ 8006d24:	f7fe fe81 	bl	8005a2a <HMAC_update>
+    HMAC_finish(hash_context, K, K);
+ 8006d28:	462a      	mov	r2, r5
+ 8006d2a:	4629      	mov	r1, r5
+ 8006d2c:	4620      	mov	r0, r4
+ 8006d2e:	f7fe fe7e 	bl	8005a2e <HMAC_finish>
+
+    update_V(hash_context, K, V);
+ 8006d32:	4632      	mov	r2, r6
+ 8006d34:	4629      	mov	r1, r5
+ 8006d36:	4620      	mov	r0, r4
+ 8006d38:	f7fe fea8 	bl	8005a8c <update_V>
+    
+    /* K = HMAC_K(V || 0x01 || int2octets(x) || h(m)) */
+    HMAC_init(hash_context, K);
+ 8006d3c:	4629      	mov	r1, r5
+ 8006d3e:	4620      	mov	r0, r4
+ 8006d40:	f7fe fe52 	bl	80059e8 <HMAC_init>
+    V[hash_context->result_size] = 0x01;
+ 8006d44:	6922      	ldr	r2, [r4, #16]
+ 8006d46:	2101      	movs	r1, #1
+ 8006d48:	54b1      	strb	r1, [r6, r2]
+    HMAC_update(hash_context, V, hash_context->result_size + 1);
+ 8006d4a:	6922      	ldr	r2, [r4, #16]
+ 8006d4c:	4620      	mov	r0, r4
+ 8006d4e:	440a      	add	r2, r1
+ 8006d50:	4631      	mov	r1, r6
+ 8006d52:	f7fe fe6a 	bl	8005a2a <HMAC_update>
+    HMAC_update(hash_context, private_key, num_bytes);
+ 8006d56:	9b03      	ldr	r3, [sp, #12]
+ 8006d58:	4649      	mov	r1, r9
+ 8006d5a:	461a      	mov	r2, r3
+ 8006d5c:	4620      	mov	r0, r4
+ 8006d5e:	f7fe fe64 	bl	8005a2a <HMAC_update>
+    HMAC_update(hash_context, message_hash, hash_size);
+ 8006d62:	465a      	mov	r2, fp
+ 8006d64:	4651      	mov	r1, sl
+ 8006d66:	4620      	mov	r0, r4
+ 8006d68:	f7fe fe5f 	bl	8005a2a <HMAC_update>
+    HMAC_finish(hash_context, K, K);
+ 8006d6c:	462a      	mov	r2, r5
+ 8006d6e:	4629      	mov	r1, r5
+ 8006d70:	4620      	mov	r0, r4
+ 8006d72:	f7fe fe5c 	bl	8005a2e <HMAC_finish>
+
+    update_V(hash_context, K, V);
+ 8006d76:	4632      	mov	r2, r6
+ 8006d78:	4629      	mov	r1, r5
+ 8006d7a:	4620      	mov	r0, r4
+ 8006d7c:	f7fe fe86 	bl	8005a8c <update_V>
+        wordcount_t T_bytes = 0;
+        for (;;) {
+            update_V(hash_context, K, V);
+            for (i = 0; i < hash_context->result_size; ++i) {
+                T_ptr[T_bytes++] = V[i];
+                if (T_bytes >= num_n_words * uECC_WORD_SIZE) {
+ 8006d80:	00bb      	lsls	r3, r7, #2
+ 8006d82:	9304      	str	r3, [sp, #16]
+                    goto filled;
+                }
+            }
+        }
+    filled:
+        if ((bitcount_t)num_n_words * uECC_WORD_SIZE * 8 > num_n_bits) {
+ 8006d84:	017b      	lsls	r3, r7, #5
+ 8006d86:	9305      	str	r3, [sp, #20]
+            uECC_word_t mask = (uECC_word_t)-1;
+            T[num_n_words - 1] &=
+                mask >> ((bitcount_t)(num_n_words * uECC_WORD_SIZE * 8 - num_n_bits));
+ 8006d88:	ebc8 1347 	rsb	r3, r8, r7, lsl #5
+ 8006d8c:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 8006d90:	b21b      	sxth	r3, r3
+ 8006d92:	fa22 f303 	lsr.w	r3, r2, r3
+ 8006d96:	9306      	str	r3, [sp, #24]
+ 8006d98:	2340      	movs	r3, #64	; 0x40
+ 8006d9a:	9303      	str	r3, [sp, #12]
+            T[num_n_words - 1] &=
+ 8006d9c:	4417      	add	r7, r2
+ 8006d9e:	446b      	add	r3, sp
+ 8006da0:	eb03 0787 	add.w	r7, r3, r7, lsl #2
+        wordcount_t T_bytes = 0;
+ 8006da4:	2300      	movs	r3, #0
+            update_V(hash_context, K, V);
+ 8006da6:	4632      	mov	r2, r6
+ 8006da8:	4629      	mov	r1, r5
+ 8006daa:	4620      	mov	r0, r4
+ 8006dac:	9307      	str	r3, [sp, #28]
+ 8006dae:	f7fe fe6d 	bl	8005a8c <update_V>
+            for (i = 0; i < hash_context->result_size; ++i) {
+ 8006db2:	6920      	ldr	r0, [r4, #16]
+ 8006db4:	9b07      	ldr	r3, [sp, #28]
+ 8006db6:	4631      	mov	r1, r6
+ 8006db8:	4430      	add	r0, r6
+ 8006dba:	461a      	mov	r2, r3
+                T_ptr[T_bytes++] = V[i];
+ 8006dbc:	ab08      	add	r3, sp, #32
+ 8006dbe:	eb03 0c02 	add.w	ip, r3, r2
+            for (i = 0; i < hash_context->result_size; ++i) {
+ 8006dc2:	4288      	cmp	r0, r1
+ 8006dc4:	4613      	mov	r3, r2
+ 8006dc6:	f102 0201 	add.w	r2, r2, #1
+ 8006dca:	b252      	sxtb	r2, r2
+ 8006dcc:	d0eb      	beq.n	8006da6 <uECC_sign_deterministic+0xec>
+                T_ptr[T_bytes++] = V[i];
+ 8006dce:	f811 3b01 	ldrb.w	r3, [r1], #1
+ 8006dd2:	f88c 3000 	strb.w	r3, [ip]
+                if (T_bytes >= num_n_words * uECC_WORD_SIZE) {
+ 8006dd6:	9b04      	ldr	r3, [sp, #16]
+ 8006dd8:	4293      	cmp	r3, r2
+ 8006dda:	dcef      	bgt.n	8006dbc <uECC_sign_deterministic+0x102>
+        if ((bitcount_t)num_n_words * uECC_WORD_SIZE * 8 > num_n_bits) {
+ 8006ddc:	9b05      	ldr	r3, [sp, #20]
+ 8006dde:	4598      	cmp	r8, r3
+ 8006de0:	db14      	blt.n	8006e0c <uECC_sign_deterministic+0x152>
+        }
+    
+        if (uECC_sign_with_k(private_key, message_hash, hash_size, T, signature, curve)) {
+ 8006de2:	9b1b      	ldr	r3, [sp, #108]	; 0x6c
+ 8006de4:	9301      	str	r3, [sp, #4]
+ 8006de6:	9b1a      	ldr	r3, [sp, #104]	; 0x68
+ 8006de8:	9300      	str	r3, [sp, #0]
+ 8006dea:	465a      	mov	r2, fp
+ 8006dec:	ab08      	add	r3, sp, #32
+ 8006dee:	4651      	mov	r1, sl
+ 8006df0:	4648      	mov	r0, r9
+ 8006df2:	f7ff fb83 	bl	80064fc <uECC_sign_with_k>
+ 8006df6:	b180      	cbz	r0, 8006e1a <uECC_sign_deterministic+0x160>
+            return 1;
+ 8006df8:	2301      	movs	r3, #1
+        HMAC_finish(hash_context, K, K);
+
+        update_V(hash_context, K, V);
+    }
+    return 0;
+}
+ 8006dfa:	4618      	mov	r0, r3
+ 8006dfc:	b011      	add	sp, #68	; 0x44
+ 8006dfe:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+        V[i] = 0x01;
+ 8006e02:	54b0      	strb	r0, [r6, r2]
+        K[i] = 0;
+ 8006e04:	f805 c002 	strb.w	ip, [r5, r2]
+    for (i = 0; i < hash_context->result_size; ++i) {
+ 8006e08:	3201      	adds	r2, #1
+ 8006e0a:	e770      	b.n	8006cee <uECC_sign_deterministic+0x34>
+            T[num_n_words - 1] &=
+ 8006e0c:	f857 3c20 	ldr.w	r3, [r7, #-32]
+ 8006e10:	9a06      	ldr	r2, [sp, #24]
+ 8006e12:	4013      	ands	r3, r2
+ 8006e14:	f847 3c20 	str.w	r3, [r7, #-32]
+ 8006e18:	e7e3      	b.n	8006de2 <uECC_sign_deterministic+0x128>
+ 8006e1a:	9007      	str	r0, [sp, #28]
+        HMAC_init(hash_context, K);
+ 8006e1c:	4629      	mov	r1, r5
+ 8006e1e:	4620      	mov	r0, r4
+ 8006e20:	f7fe fde2 	bl	80059e8 <HMAC_init>
+        V[hash_context->result_size] = 0x00;
+ 8006e24:	6922      	ldr	r2, [r4, #16]
+ 8006e26:	9b07      	ldr	r3, [sp, #28]
+ 8006e28:	54b3      	strb	r3, [r6, r2]
+        HMAC_update(hash_context, V, hash_context->result_size + 1);
+ 8006e2a:	6922      	ldr	r2, [r4, #16]
+ 8006e2c:	4631      	mov	r1, r6
+ 8006e2e:	3201      	adds	r2, #1
+ 8006e30:	4620      	mov	r0, r4
+ 8006e32:	f7fe fdfa 	bl	8005a2a <HMAC_update>
+        HMAC_finish(hash_context, K, K);
+ 8006e36:	462a      	mov	r2, r5
+ 8006e38:	4629      	mov	r1, r5
+ 8006e3a:	4620      	mov	r0, r4
+ 8006e3c:	f7fe fdf7 	bl	8005a2e <HMAC_finish>
+        update_V(hash_context, K, V);
+ 8006e40:	4632      	mov	r2, r6
+ 8006e42:	4629      	mov	r1, r5
+ 8006e44:	4620      	mov	r0, r4
+ 8006e46:	f7fe fe21 	bl	8005a8c <update_V>
+    for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
+ 8006e4a:	9b03      	ldr	r3, [sp, #12]
+ 8006e4c:	3b01      	subs	r3, #1
+ 8006e4e:	9303      	str	r3, [sp, #12]
+ 8006e50:	9b07      	ldr	r3, [sp, #28]
+ 8006e52:	d1a7      	bne.n	8006da4 <uECC_sign_deterministic+0xea>
+ 8006e54:	e7d1      	b.n	8006dfa <uECC_sign_deterministic+0x140>
+
+08006e56 <uECC_verify>:
+
+int uECC_verify(const uint8_t *public_key,
+                const uint8_t *message_hash,
+                unsigned hash_size,
+                const uint8_t *signature,
+                uECC_Curve curve) {
+ 8006e56:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 8006e5a:	ed2d 8b02 	vpush	{d8}
+ 8006e5e:	b0fb      	sub	sp, #492	; 0x1ec
+ 8006e60:	461c      	mov	r4, r3
+ 8006e62:	9d86      	ldr	r5, [sp, #536]	; 0x218
+    const uECC_word_t *point;
+    bitcount_t num_bits;
+    bitcount_t i;
+    uECC_word_t r[uECC_MAX_WORDS], s[uECC_MAX_WORDS];
+    wordcount_t num_words = curve->num_words;
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8006e64:	f9b5 3002 	ldrsh.w	r3, [r5, #2]
+    wordcount_t num_words = curve->num_words;
+ 8006e68:	f995 8000 	ldrsb.w	r8, [r5]
+    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
+ 8006e6c:	f113 061f 	adds.w	r6, r3, #31
+ 8006e70:	bf48      	it	mi
+ 8006e72:	f103 063e 	addmi.w	r6, r3, #62	; 0x3e
+ 8006e76:	f346 1647 	sbfx	r6, r6, #5, #8
+    
+    rx[num_n_words - 1] = 0;
+ 8006e7a:	f106 3aff 	add.w	sl, r6, #4294967295	; 0xffffffff
+                uECC_Curve curve) {
+ 8006e7e:	4691      	mov	r9, r2
+    rx[num_n_words - 1] = 0;
+ 8006e80:	aa22      	add	r2, sp, #136	; 0x88
+ 8006e82:	2300      	movs	r3, #0
+ 8006e84:	f842 302a 	str.w	r3, [r2, sl, lsl #2]
+    r[num_n_words - 1] = 0;
+ 8006e88:	aa7a      	add	r2, sp, #488	; 0x1e8
+ 8006e8a:	eb02 028a 	add.w	r2, r2, sl, lsl #2
+                uECC_Curve curve) {
+ 8006e8e:	4607      	mov	r7, r0
+    r[num_n_words - 1] = 0;
+ 8006e90:	f842 3cc0 	str.w	r3, [r2, #-192]
+    s[num_n_words - 1] = 0;
+ 8006e94:	f842 3ca0 	str.w	r3, [r2, #-160]
+                uECC_Curve curve) {
+ 8006e98:	ee08 1a90 	vmov	s17, r1
+
+    uECC_vli_bytesToNative(public, public_key, curve->num_bytes);
+ 8006e9c:	f995 2001 	ldrsb.w	r2, [r5, #1]
+ 8006ea0:	4601      	mov	r1, r0
+ 8006ea2:	a85a      	add	r0, sp, #360	; 0x168
+ 8006ea4:	f7fe fd80 	bl	80059a8 <uECC_vli_bytesToNative>
+    uECC_vli_bytesToNative(
+        public + num_words, public_key + curve->num_bytes, curve->num_bytes);
+ 8006ea8:	ea4f 0388 	mov.w	r3, r8, lsl #2
+ 8006eac:	f995 2001 	ldrsb.w	r2, [r5, #1]
+ 8006eb0:	9304      	str	r3, [sp, #16]
+    uECC_vli_bytesToNative(
+ 8006eb2:	ab5a      	add	r3, sp, #360	; 0x168
+ 8006eb4:	eb03 0388 	add.w	r3, r3, r8, lsl #2
+ 8006eb8:	4618      	mov	r0, r3
+ 8006eba:	18b9      	adds	r1, r7, r2
+ 8006ebc:	ee08 3a10 	vmov	s16, r3
+ 8006ec0:	f7fe fd72 	bl	80059a8 <uECC_vli_bytesToNative>
+    uECC_vli_bytesToNative(r, signature, curve->num_bytes);
+ 8006ec4:	4621      	mov	r1, r4
+ 8006ec6:	f995 2001 	ldrsb.w	r2, [r5, #1]
+ 8006eca:	a84a      	add	r0, sp, #296	; 0x128
+ 8006ecc:	f7fe fd6c 	bl	80059a8 <uECC_vli_bytesToNative>
+    uECC_vli_bytesToNative(s, signature + curve->num_bytes, curve->num_bytes);
+ 8006ed0:	f995 2001 	ldrsb.w	r2, [r5, #1]
+ 8006ed4:	a852      	add	r0, sp, #328	; 0x148
+ 8006ed6:	18a1      	adds	r1, r4, r2
+ 8006ed8:	f7fe fd66 	bl	80059a8 <uECC_vli_bytesToNative>
+    
+    /* r, s must not be 0. */
+    if (uECC_vli_isZero(r, num_words) || uECC_vli_isZero(s, num_words)) {
+ 8006edc:	4641      	mov	r1, r8
+ 8006ede:	a84a      	add	r0, sp, #296	; 0x128
+ 8006ee0:	f7fe fc14 	bl	800570c <uECC_vli_isZero>
+ 8006ee4:	2300      	movs	r3, #0
+ 8006ee6:	4604      	mov	r4, r0
+ 8006ee8:	2800      	cmp	r0, #0
+ 8006eea:	f040 812b 	bne.w	8007144 <uECC_verify+0x2ee>
+ 8006eee:	a852      	add	r0, sp, #328	; 0x148
+ 8006ef0:	f7fe fc0c 	bl	800570c <uECC_vli_isZero>
+ 8006ef4:	9002      	str	r0, [sp, #8]
+ 8006ef6:	2800      	cmp	r0, #0
+ 8006ef8:	f040 8126 	bne.w	8007148 <uECC_verify+0x2f2>
+        return 0;
+    }
+
+    /* r, s must be < n. */
+    if (uECC_vli_cmp_unsafe(curve->n, r, num_n_words) != 1 ||
+ 8006efc:	f105 0b24 	add.w	fp, r5, #36	; 0x24
+ 8006f00:	4632      	mov	r2, r6
+ 8006f02:	a94a      	add	r1, sp, #296	; 0x128
+ 8006f04:	4658      	mov	r0, fp
+ 8006f06:	f7fe fc46 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 8006f0a:	2801      	cmp	r0, #1
+ 8006f0c:	f040 811e 	bne.w	800714c <uECC_verify+0x2f6>
+            uECC_vli_cmp_unsafe(curve->n, s, num_n_words) != 1) {
+ 8006f10:	4632      	mov	r2, r6
+ 8006f12:	a952      	add	r1, sp, #328	; 0x148
+ 8006f14:	4658      	mov	r0, fp
+ 8006f16:	f7fe fc3e 	bl	8005796 <uECC_vli_cmp_unsafe>
+    if (uECC_vli_cmp_unsafe(curve->n, r, num_n_words) != 1 ||
+ 8006f1a:	2801      	cmp	r0, #1
+            uECC_vli_cmp_unsafe(curve->n, s, num_n_words) != 1) {
+ 8006f1c:	9005      	str	r0, [sp, #20]
+    if (uECC_vli_cmp_unsafe(curve->n, r, num_n_words) != 1 ||
+ 8006f1e:	f040 8115 	bne.w	800714c <uECC_verify+0x2f6>
+        return 0;
+    }
+
+    /* Calculate u1 and u2. */
+    uECC_vli_modInv(z, s, curve->n, num_n_words); /* z = 1/s */
+ 8006f22:	ac1a      	add	r4, sp, #104	; 0x68
+    u1[num_n_words - 1] = 0;
+ 8006f24:	af0a      	add	r7, sp, #40	; 0x28
+    uECC_vli_modInv(z, s, curve->n, num_n_words); /* z = 1/s */
+ 8006f26:	4633      	mov	r3, r6
+ 8006f28:	465a      	mov	r2, fp
+ 8006f2a:	4620      	mov	r0, r4
+ 8006f2c:	f7ff f84e 	bl	8005fcc <uECC_vli_modInv>
+    u1[num_n_words - 1] = 0;
+ 8006f30:	9b02      	ldr	r3, [sp, #8]
+ 8006f32:	f847 302a 	str.w	r3, [r7, sl, lsl #2]
+    bits2int(u1, message_hash, hash_size, curve);
+ 8006f36:	464a      	mov	r2, r9
+ 8006f38:	4638      	mov	r0, r7
+ 8006f3a:	ee18 1a90 	vmov	r1, s17
+ 8006f3e:	462b      	mov	r3, r5
+ 8006f40:	f7fe fddd 	bl	8005afe <bits2int>
+    uECC_vli_modMult(u1, u1, z, curve->n, num_n_words); /* u1 = e/s */
+ 8006f44:	4639      	mov	r1, r7
+ 8006f46:	4638      	mov	r0, r7
+ 8006f48:	465b      	mov	r3, fp
+ 8006f4a:	4622      	mov	r2, r4
+ 8006f4c:	9600      	str	r6, [sp, #0]
+ 8006f4e:	f7fe fc44 	bl	80057da <uECC_vli_modMult>
+    uECC_vli_modMult(u2, r, z, curve->n, num_n_words); /* u2 = r/s */
+    
+    /* Calculate sum = G + Q. */
+    uECC_vli_set(sum, public, num_words);
+ 8006f52:	f50d 7ad4 	add.w	sl, sp, #424	; 0x1a8
+    uECC_vli_modMult(u2, r, z, curve->n, num_n_words); /* u2 = r/s */
+ 8006f56:	465b      	mov	r3, fp
+ 8006f58:	4622      	mov	r2, r4
+ 8006f5a:	a94a      	add	r1, sp, #296	; 0x128
+ 8006f5c:	a812      	add	r0, sp, #72	; 0x48
+ 8006f5e:	9600      	str	r6, [sp, #0]
+ 8006f60:	f7fe fc3b 	bl	80057da <uECC_vli_modMult>
+    uECC_vli_set(sum, public, num_words);
+ 8006f64:	4642      	mov	r2, r8
+ 8006f66:	4650      	mov	r0, sl
+ 8006f68:	a95a      	add	r1, sp, #360	; 0x168
+ 8006f6a:	f7fe fc08 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(sum + num_words, public + num_words, num_words);
+ 8006f6e:	9b04      	ldr	r3, [sp, #16]
+ 8006f70:	eb0a 0903 	add.w	r9, sl, r3
+ 8006f74:	ee18 1a10 	vmov	r1, s16
+ 8006f78:	4648      	mov	r0, r9
+ 8006f7a:	f7fe fc00 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(tx, curve->G, num_words);
+ 8006f7e:	f105 0344 	add.w	r3, r5, #68	; 0x44
+ 8006f82:	4619      	mov	r1, r3
+ 8006f84:	a832      	add	r0, sp, #200	; 0xc8
+ 8006f86:	9303      	str	r3, [sp, #12]
+ 8006f88:	f7fe fbf9 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(ty, curve->G + num_words, num_words);
+ 8006f8c:	e9dd 3103 	ldrd	r3, r1, [sp, #12]
+ 8006f90:	a83a      	add	r0, sp, #232	; 0xe8
+ 8006f92:	1859      	adds	r1, r3, r1
+ 8006f94:	f7fe fbf3 	bl	800577e <uECC_vli_set>
+    uECC_vli_modSub(z, sum, tx, curve->p, num_words); /* z = x2 - x1 */
+ 8006f98:	1d2b      	adds	r3, r5, #4
+ 8006f9a:	ee08 3a10 	vmov	s16, r3
+ 8006f9e:	4651      	mov	r1, sl
+ 8006fa0:	aa32      	add	r2, sp, #200	; 0xc8
+ 8006fa2:	4620      	mov	r0, r4
+ 8006fa4:	f7ff f8c0 	bl	8006128 <uECC_vli_modSub.isra.0>
+    XYcZ_add(tx, ty, sum, sum + num_words, curve);
+ 8006fa8:	464b      	mov	r3, r9
+ 8006faa:	4652      	mov	r2, sl
+ 8006fac:	a93a      	add	r1, sp, #232	; 0xe8
+ 8006fae:	a832      	add	r0, sp, #200	; 0xc8
+ 8006fb0:	9500      	str	r5, [sp, #0]
+ 8006fb2:	f7ff f94d 	bl	8006250 <XYcZ_add>
+    uECC_vli_modInv(z, z, curve->p, num_words); /* z = 1/z */
+ 8006fb6:	ee18 2a10 	vmov	r2, s16
+ 8006fba:	4643      	mov	r3, r8
+ 8006fbc:	4621      	mov	r1, r4
+ 8006fbe:	4620      	mov	r0, r4
+ 8006fc0:	f7ff f804 	bl	8005fcc <uECC_vli_modInv>
+    apply_z(sum, sum + num_words, z, curve);
+ 8006fc4:	462b      	mov	r3, r5
+ 8006fc6:	4649      	mov	r1, r9
+ 8006fc8:	4650      	mov	r0, sl
+ 8006fca:	4622      	mov	r2, r4
+ 8006fcc:	f7fe fcb9 	bl	8005942 <apply_z>
+    
+    /* Use Shamir's trick to calculate u1*G + u2*Q */
+    points[0] = 0;
+ 8006fd0:	9a02      	ldr	r2, [sp, #8]
+ 8006fd2:	9206      	str	r2, [sp, #24]
+    points[1] = curve->G;
+ 8006fd4:	9a03      	ldr	r2, [sp, #12]
+ 8006fd6:	9207      	str	r2, [sp, #28]
+    points[2] = public;
+    points[3] = sum;
+    num_bits = smax(uECC_vli_numBits(u1, num_n_words),
+ 8006fd8:	4631      	mov	r1, r6
+    points[2] = public;
+ 8006fda:	aa5a      	add	r2, sp, #360	; 0x168
+    num_bits = smax(uECC_vli_numBits(u1, num_n_words),
+ 8006fdc:	4638      	mov	r0, r7
+    points[3] = sum;
+ 8006fde:	e9cd 2a08 	strd	r2, sl, [sp, #32]
+    num_bits = smax(uECC_vli_numBits(u1, num_n_words),
+ 8006fe2:	f7fe fbac 	bl	800573e <uECC_vli_numBits>
+ 8006fe6:	4631      	mov	r1, r6
+ 8006fe8:	4682      	mov	sl, r0
+ 8006fea:	a812      	add	r0, sp, #72	; 0x48
+ 8006fec:	f7fe fba7 	bl	800573e <uECC_vli_numBits>
+    return (a > b ? a : b);
+ 8006ff0:	4550      	cmp	r0, sl
+ 8006ff2:	bfb8      	it	lt
+ 8006ff4:	4650      	movlt	r0, sl
+                    uECC_vli_numBits(u2, num_n_words));
+    
+    point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
+ 8006ff6:	fa1f f980 	uxth.w	r9, r0
+ 8006ffa:	f109 31ff 	add.w	r1, r9, #4294967295	; 0xffffffff
+ 8006ffe:	b209      	sxth	r1, r1
+ 8007000:	4638      	mov	r0, r7
+ 8007002:	9103      	str	r1, [sp, #12]
+ 8007004:	f7fe fb91 	bl	800572a <uECC_vli_testBit>
+                   ((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
+ 8007008:	9903      	ldr	r1, [sp, #12]
+    point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
+ 800700a:	1e07      	subs	r7, r0, #0
+                   ((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
+ 800700c:	a812      	add	r0, sp, #72	; 0x48
+    point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
+ 800700e:	bf18      	it	ne
+ 8007010:	2701      	movne	r7, #1
+                   ((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
+ 8007012:	f7fe fb8a 	bl	800572a <uECC_vli_testBit>
+ 8007016:	2800      	cmp	r0, #0
+ 8007018:	bf14      	ite	ne
+ 800701a:	2002      	movne	r0, #2
+ 800701c:	2000      	moveq	r0, #0
+    point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
+ 800701e:	ab06      	add	r3, sp, #24
+ 8007020:	4307      	orrs	r7, r0
+    uECC_vli_set(rx, point, num_words);
+ 8007022:	4642      	mov	r2, r8
+    point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
+ 8007024:	f853 1027 	ldr.w	r1, [r3, r7, lsl #2]
+    uECC_vli_set(rx, point, num_words);
+ 8007028:	a822      	add	r0, sp, #136	; 0x88
+ 800702a:	f7fe fba8 	bl	800577e <uECC_vli_set>
+    uECC_vli_set(ry, point + num_words, num_words);
+ 800702e:	9b04      	ldr	r3, [sp, #16]
+ 8007030:	f10d 0aa8 	add.w	sl, sp, #168	; 0xa8
+ 8007034:	4419      	add	r1, r3
+ 8007036:	4650      	mov	r0, sl
+ 8007038:	f7fe fba1 	bl	800577e <uECC_vli_set>
+    uECC_vli_clear(z, num_words);
+ 800703c:	4641      	mov	r1, r8
+ 800703e:	4620      	mov	r0, r4
+ 8007040:	f7fe fb5e 	bl	8005700 <uECC_vli_clear>
+    z[0] = 1;
+ 8007044:	9b05      	ldr	r3, [sp, #20]
+ 8007046:	6023      	str	r3, [r4, #0]
+
+    for (i = num_bits - 2; i >= 0; --i) {
+ 8007048:	f1a9 0902 	sub.w	r9, r9, #2
+ 800704c:	ab22      	add	r3, sp, #136	; 0x88
+ 800704e:	fa0f f989 	sxth.w	r9, r9
+ 8007052:	9303      	str	r3, [sp, #12]
+ 8007054:	f1b9 0f00 	cmp.w	r9, #0
+ 8007058:	da26      	bge.n	80070a8 <uECC_verify+0x252>
+            XYcZ_add(tx, ty, rx, ry, curve);
+            uECC_vli_modMult_fast(z, z, tz, curve);
+        }
+    }
+
+    uECC_vli_modInv(z, z, curve->p, num_words); /* Z = 1/Z */
+ 800705a:	ee18 2a10 	vmov	r2, s16
+ 800705e:	4643      	mov	r3, r8
+ 8007060:	4621      	mov	r1, r4
+ 8007062:	4620      	mov	r0, r4
+ 8007064:	f7fe ffb2 	bl	8005fcc <uECC_vli_modInv>
+    apply_z(rx, ry, z, curve);
+ 8007068:	9803      	ldr	r0, [sp, #12]
+ 800706a:	462b      	mov	r3, r5
+ 800706c:	4622      	mov	r2, r4
+ 800706e:	4651      	mov	r1, sl
+ 8007070:	f7fe fc67 	bl	8005942 <apply_z>
+    
+    /* v = x1 (mod n) */
+    if (uECC_vli_cmp_unsafe(curve->n, rx, num_n_words) != 1) {
+ 8007074:	9903      	ldr	r1, [sp, #12]
+ 8007076:	4632      	mov	r2, r6
+ 8007078:	4658      	mov	r0, fp
+ 800707a:	f7fe fb8c 	bl	8005796 <uECC_vli_cmp_unsafe>
+ 800707e:	2801      	cmp	r0, #1
+ 8007080:	d003      	beq.n	800708a <uECC_verify+0x234>
+        uECC_vli_sub(rx, rx, curve->n, num_n_words);
+ 8007082:	465a      	mov	r2, fp
+ 8007084:	4608      	mov	r0, r1
+ 8007086:	f7fe fd13 	bl	8005ab0 <uECC_vli_sub.constprop.0>
+    for (i = num_words - 1; i >= 0; --i) {
+ 800708a:	f108 33ff 	add.w	r3, r8, #4294967295	; 0xffffffff
+ 800708e:	b25b      	sxtb	r3, r3
+        diff |= (left[i] ^ right[i]);
+ 8007090:	a94a      	add	r1, sp, #296	; 0x128
+    for (i = num_words - 1; i >= 0; --i) {
+ 8007092:	061a      	lsls	r2, r3, #24
+ 8007094:	d54b      	bpl.n	800712e <uECC_verify+0x2d8>
+    return (diff == 0);
+ 8007096:	9b02      	ldr	r3, [sp, #8]
+ 8007098:	fab3 f083 	clz	r0, r3
+ 800709c:	0940      	lsrs	r0, r0, #5
+    }
+
+    /* Accept only if v == r. */
+    return (int)(uECC_vli_equal(rx, r, num_words));
+}
+ 800709e:	b07b      	add	sp, #492	; 0x1ec
+ 80070a0:	ecbd 8b02 	vpop	{d8}
+ 80070a4:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+        curve->double_jacobian(rx, ry, z, curve);
+ 80070a8:	462b      	mov	r3, r5
+ 80070aa:	4622      	mov	r2, r4
+ 80070ac:	f8d5 70a4 	ldr.w	r7, [r5, #164]	; 0xa4
+ 80070b0:	9803      	ldr	r0, [sp, #12]
+ 80070b2:	4651      	mov	r1, sl
+ 80070b4:	47b8      	blx	r7
+        index = (!!uECC_vli_testBit(u1, i)) | ((!!uECC_vli_testBit(u2, i)) << 1);
+ 80070b6:	4649      	mov	r1, r9
+ 80070b8:	a80a      	add	r0, sp, #40	; 0x28
+ 80070ba:	f7fe fb36 	bl	800572a <uECC_vli_testBit>
+ 80070be:	4649      	mov	r1, r9
+ 80070c0:	1e07      	subs	r7, r0, #0
+ 80070c2:	a812      	add	r0, sp, #72	; 0x48
+ 80070c4:	bf18      	it	ne
+ 80070c6:	2701      	movne	r7, #1
+ 80070c8:	f7fe fb2f 	bl	800572a <uECC_vli_testBit>
+ 80070cc:	2800      	cmp	r0, #0
+ 80070ce:	bf14      	ite	ne
+ 80070d0:	2002      	movne	r0, #2
+ 80070d2:	2000      	moveq	r0, #0
+ 80070d4:	4307      	orrs	r7, r0
+        point = points[index];
+ 80070d6:	ab06      	add	r3, sp, #24
+ 80070d8:	f853 1027 	ldr.w	r1, [r3, r7, lsl #2]
+        if (point) {
+ 80070dc:	b311      	cbz	r1, 8007124 <uECC_verify+0x2ce>
+            uECC_vli_set(tx, point, num_words);
+ 80070de:	4642      	mov	r2, r8
+ 80070e0:	a832      	add	r0, sp, #200	; 0xc8
+ 80070e2:	f7fe fb4c 	bl	800577e <uECC_vli_set>
+            uECC_vli_set(ty, point + num_words, num_words);
+ 80070e6:	9b04      	ldr	r3, [sp, #16]
+ 80070e8:	a83a      	add	r0, sp, #232	; 0xe8
+ 80070ea:	4419      	add	r1, r3
+ 80070ec:	f7fe fb47 	bl	800577e <uECC_vli_set>
+            apply_z(tx, ty, z, curve);
+ 80070f0:	4601      	mov	r1, r0
+ 80070f2:	462b      	mov	r3, r5
+ 80070f4:	4622      	mov	r2, r4
+ 80070f6:	a832      	add	r0, sp, #200	; 0xc8
+ 80070f8:	f7fe fc23 	bl	8005942 <apply_z>
+            uECC_vli_modSub(tz, rx, tx, curve->p, num_words); /* Z = x2 - x1 */
+ 80070fc:	ee18 3a10 	vmov	r3, s16
+ 8007100:	9903      	ldr	r1, [sp, #12]
+ 8007102:	aa32      	add	r2, sp, #200	; 0xc8
+ 8007104:	a842      	add	r0, sp, #264	; 0x108
+ 8007106:	f7ff f80f 	bl	8006128 <uECC_vli_modSub.isra.0>
+            XYcZ_add(tx, ty, rx, ry, curve);
+ 800710a:	9a03      	ldr	r2, [sp, #12]
+ 800710c:	9500      	str	r5, [sp, #0]
+ 800710e:	4653      	mov	r3, sl
+ 8007110:	a93a      	add	r1, sp, #232	; 0xe8
+ 8007112:	a832      	add	r0, sp, #200	; 0xc8
+ 8007114:	f7ff f89c 	bl	8006250 <XYcZ_add>
+            uECC_vli_modMult_fast(z, z, tz, curve);
+ 8007118:	462b      	mov	r3, r5
+ 800711a:	aa42      	add	r2, sp, #264	; 0x108
+ 800711c:	4621      	mov	r1, r4
+ 800711e:	4620      	mov	r0, r4
+ 8007120:	f7fe fbfb 	bl	800591a <uECC_vli_modMult_fast>
+    for (i = num_bits - 2; i >= 0; --i) {
+ 8007124:	f109 39ff 	add.w	r9, r9, #4294967295	; 0xffffffff
+ 8007128:	fa0f f989 	sxth.w	r9, r9
+ 800712c:	e792      	b.n	8007054 <uECC_verify+0x1fe>
+        diff |= (left[i] ^ right[i]);
+ 800712e:	9a03      	ldr	r2, [sp, #12]
+ 8007130:	f851 0023 	ldr.w	r0, [r1, r3, lsl #2]
+ 8007134:	f852 2023 	ldr.w	r2, [r2, r3, lsl #2]
+ 8007138:	4042      	eors	r2, r0
+ 800713a:	9802      	ldr	r0, [sp, #8]
+ 800713c:	4310      	orrs	r0, r2
+ 800713e:	9002      	str	r0, [sp, #8]
+    for (i = num_words - 1; i >= 0; --i) {
+ 8007140:	3b01      	subs	r3, #1
+ 8007142:	e7a6      	b.n	8007092 <uECC_verify+0x23c>
+        return 0;
+ 8007144:	4618      	mov	r0, r3
+ 8007146:	e7aa      	b.n	800709e <uECC_verify+0x248>
+ 8007148:	4620      	mov	r0, r4
+ 800714a:	e7a8      	b.n	800709e <uECC_verify+0x248>
+ 800714c:	9802      	ldr	r0, [sp, #8]
+ 800714e:	e7a6      	b.n	800709e <uECC_verify+0x248>
+
+08007150 <HAL_GetTick>:
+const uint32_t MSIRangeTable[12] = {100000, 200000, 400000, 800000, 1000000, 2000000, \
+                                  4000000, 8000000, 16000000, 24000000, 32000000, 48000000};
+uint32_t SystemCoreClock;
+
+// TODO: cleanup HAL stuff to not use this
+uint32_t HAL_GetTick(void) { return 53; }
+ 8007150:	2035      	movs	r0, #53	; 0x35
+ 8007152:	4770      	bx	lr
+
+08007154 <HAL_InitTick>:
+uint32_t uwTickPrio = 0;            /* (1UL << __NVIC_PRIO_BITS); * Invalid priority */
+
+// unwanted junk from stm32l4xx_hal_rcc.c
+HAL_StatusTypeDef HAL_InitTick (uint32_t TickPriority) { return 0; }
+ 8007154:	2000      	movs	r0, #0
+ 8007156:	4770      	bx	lr
+
+08007158 <HAL_PWREx_GetVoltageRange>:
+  *         or PWR_REGULATOR_VOLTAGE_SCALE1_BOOST when applicable)
+  */
+uint32_t HAL_PWREx_GetVoltageRange(void)
+{
+#if defined(PWR_CR5_R1MODE)
+    if (READ_BIT(PWR->CR1, PWR_CR1_VOS) == PWR_REGULATOR_VOLTAGE_SCALE2)
+ 8007158:	4b07      	ldr	r3, [pc, #28]	; (8007178 <HAL_PWREx_GetVoltageRange+0x20>)
+ 800715a:	6818      	ldr	r0, [r3, #0]
+ 800715c:	f400 60c0 	and.w	r0, r0, #1536	; 0x600
+ 8007160:	f5b0 6f80 	cmp.w	r0, #1024	; 0x400
+ 8007164:	d006      	beq.n	8007174 <HAL_PWREx_GetVoltageRange+0x1c>
+    {
+      return PWR_REGULATOR_VOLTAGE_SCALE2;
+    }
+    else if (READ_BIT(PWR->CR5, PWR_CR5_R1MODE) == PWR_CR5_R1MODE)
+ 8007166:	f8d3 0080 	ldr.w	r0, [r3, #128]	; 0x80
+    {
+      /* PWR_CR5_R1MODE bit set means that Range 1 Boost is disabled */
+      return PWR_REGULATOR_VOLTAGE_SCALE1;
+ 800716a:	f410 7080 	ands.w	r0, r0, #256	; 0x100
+ 800716e:	bf18      	it	ne
+ 8007170:	f44f 7000 	movne.w	r0, #512	; 0x200
+      return PWR_REGULATOR_VOLTAGE_SCALE1_BOOST;
+    }
+#else
+  return  (PWR->CR1 & PWR_CR1_VOS);
+#endif
+}
+ 8007174:	4770      	bx	lr
+ 8007176:	bf00      	nop
+ 8007178:	40007000 	.word	0x40007000
+
+0800717c <HAL_PWREx_ControlVoltageScaling>:
+  uint32_t wait_loop_index;
+
+  assert_param(IS_PWR_VOLTAGE_SCALING_RANGE(VoltageScaling));
+
+#if defined(PWR_CR5_R1MODE)
+  if (VoltageScaling == PWR_REGULATOR_VOLTAGE_SCALE1_BOOST)
+ 800717c:	4b29      	ldr	r3, [pc, #164]	; (8007224 <HAL_PWREx_ControlVoltageScaling+0xa8>)
+  {
+    /* If current range is range 2 */
+    if (READ_BIT(PWR->CR1, PWR_CR1_VOS) == PWR_REGULATOR_VOLTAGE_SCALE2)
+ 800717e:	681a      	ldr	r2, [r3, #0]
+  if (VoltageScaling == PWR_REGULATOR_VOLTAGE_SCALE1_BOOST)
+ 8007180:	bb30      	cbnz	r0, 80071d0 <HAL_PWREx_ControlVoltageScaling+0x54>
+    if (READ_BIT(PWR->CR1, PWR_CR1_VOS) == PWR_REGULATOR_VOLTAGE_SCALE2)
+ 8007182:	f402 62c0 	and.w	r2, r2, #1536	; 0x600
+ 8007186:	f5b2 6f80 	cmp.w	r2, #1024	; 0x400
+    {
+      /* Make sure Range 1 Boost is enabled */
+      CLEAR_BIT(PWR->CR5, PWR_CR5_R1MODE);
+ 800718a:	f8d3 2080 	ldr.w	r2, [r3, #128]	; 0x80
+ 800718e:	f422 7280 	bic.w	r2, r2, #256	; 0x100
+ 8007192:	f8c3 2080 	str.w	r2, [r3, #128]	; 0x80
+    if (READ_BIT(PWR->CR1, PWR_CR1_VOS) == PWR_REGULATOR_VOLTAGE_SCALE2)
+ 8007196:	d11a      	bne.n	80071ce <HAL_PWREx_ControlVoltageScaling+0x52>
+
+      /* Set Range 1 */
+      MODIFY_REG(PWR->CR1, PWR_CR1_VOS, PWR_REGULATOR_VOLTAGE_SCALE1);
+ 8007198:	681a      	ldr	r2, [r3, #0]
+ 800719a:	f422 62c0 	bic.w	r2, r2, #1536	; 0x600
+ 800719e:	f442 7200 	orr.w	r2, r2, #512	; 0x200
+ 80071a2:	601a      	str	r2, [r3, #0]
+
+      /* Wait until VOSF is cleared */
+      wait_loop_index = ((PWR_FLAG_SETTING_DELAY_US * SystemCoreClock) / 1000000U) + 1;
+ 80071a4:	4a20      	ldr	r2, [pc, #128]	; (8007228 <HAL_PWREx_ControlVoltageScaling+0xac>)
+ 80071a6:	6812      	ldr	r2, [r2, #0]
+ 80071a8:	2132      	movs	r1, #50	; 0x32
+ 80071aa:	434a      	muls	r2, r1
+ 80071ac:	491f      	ldr	r1, [pc, #124]	; (800722c <HAL_PWREx_ControlVoltageScaling+0xb0>)
+ 80071ae:	fbb2 f2f1 	udiv	r2, r2, r1
+ 80071b2:	3201      	adds	r2, #1
+      while ((HAL_IS_BIT_SET(PWR->SR2, PWR_SR2_VOSF)) && (wait_loop_index != 0U))
+ 80071b4:	6959      	ldr	r1, [r3, #20]
+ 80071b6:	0549      	lsls	r1, r1, #21
+ 80071b8:	d500      	bpl.n	80071bc <HAL_PWREx_ControlVoltageScaling+0x40>
+ 80071ba:	b922      	cbnz	r2, 80071c6 <HAL_PWREx_ControlVoltageScaling+0x4a>
+      {
+        wait_loop_index--;
+      }
+      if (HAL_IS_BIT_SET(PWR->SR2, PWR_SR2_VOSF))
+ 80071bc:	695b      	ldr	r3, [r3, #20]
+ 80071be:	0558      	lsls	r0, r3, #21
+ 80071c0:	d403      	bmi.n	80071ca <HAL_PWREx_ControlVoltageScaling+0x4e>
+      /* No need to wait for VOSF to be cleared for this transition */
+    }
+  }
+#endif
+
+  return HAL_OK;
+ 80071c2:	2000      	movs	r0, #0
+}
+ 80071c4:	4770      	bx	lr
+        wait_loop_index--;
+ 80071c6:	3a01      	subs	r2, #1
+ 80071c8:	e7f4      	b.n	80071b4 <HAL_PWREx_ControlVoltageScaling+0x38>
+        return HAL_TIMEOUT;
+ 80071ca:	2003      	movs	r0, #3
+ 80071cc:	4770      	bx	lr
+      CLEAR_BIT(PWR->CR5, PWR_CR5_R1MODE);
+ 80071ce:	4770      	bx	lr
+  else if (VoltageScaling == PWR_REGULATOR_VOLTAGE_SCALE1)
+ 80071d0:	f5b0 7f00 	cmp.w	r0, #512	; 0x200
+ 80071d4:	d11f      	bne.n	8007216 <HAL_PWREx_ControlVoltageScaling+0x9a>
+    if (READ_BIT(PWR->CR1, PWR_CR1_VOS) == PWR_REGULATOR_VOLTAGE_SCALE2)
+ 80071d6:	f402 62c0 	and.w	r2, r2, #1536	; 0x600
+ 80071da:	f5b2 6f80 	cmp.w	r2, #1024	; 0x400
+      SET_BIT(PWR->CR5, PWR_CR5_R1MODE);
+ 80071de:	f8d3 2080 	ldr.w	r2, [r3, #128]	; 0x80
+ 80071e2:	f442 7280 	orr.w	r2, r2, #256	; 0x100
+ 80071e6:	f8c3 2080 	str.w	r2, [r3, #128]	; 0x80
+    if (READ_BIT(PWR->CR1, PWR_CR1_VOS) == PWR_REGULATOR_VOLTAGE_SCALE2)
+ 80071ea:	d1ea      	bne.n	80071c2 <HAL_PWREx_ControlVoltageScaling+0x46>
+      MODIFY_REG(PWR->CR1, PWR_CR1_VOS, PWR_REGULATOR_VOLTAGE_SCALE1);
+ 80071ec:	681a      	ldr	r2, [r3, #0]
+ 80071ee:	f422 62c0 	bic.w	r2, r2, #1536	; 0x600
+ 80071f2:	f442 7200 	orr.w	r2, r2, #512	; 0x200
+ 80071f6:	601a      	str	r2, [r3, #0]
+      wait_loop_index = ((PWR_FLAG_SETTING_DELAY_US * SystemCoreClock) / 1000000U) + 1;
+ 80071f8:	4a0b      	ldr	r2, [pc, #44]	; (8007228 <HAL_PWREx_ControlVoltageScaling+0xac>)
+ 80071fa:	6812      	ldr	r2, [r2, #0]
+ 80071fc:	2132      	movs	r1, #50	; 0x32
+ 80071fe:	434a      	muls	r2, r1
+ 8007200:	490a      	ldr	r1, [pc, #40]	; (800722c <HAL_PWREx_ControlVoltageScaling+0xb0>)
+ 8007202:	fbb2 f2f1 	udiv	r2, r2, r1
+ 8007206:	3201      	adds	r2, #1
+      while ((HAL_IS_BIT_SET(PWR->SR2, PWR_SR2_VOSF)) && (wait_loop_index != 0U))
+ 8007208:	6959      	ldr	r1, [r3, #20]
+ 800720a:	0549      	lsls	r1, r1, #21
+ 800720c:	d5d6      	bpl.n	80071bc <HAL_PWREx_ControlVoltageScaling+0x40>
+ 800720e:	2a00      	cmp	r2, #0
+ 8007210:	d0d4      	beq.n	80071bc <HAL_PWREx_ControlVoltageScaling+0x40>
+        wait_loop_index--;
+ 8007212:	3a01      	subs	r2, #1
+ 8007214:	e7f8      	b.n	8007208 <HAL_PWREx_ControlVoltageScaling+0x8c>
+    MODIFY_REG(PWR->CR1, PWR_CR1_VOS, PWR_REGULATOR_VOLTAGE_SCALE2);
+ 8007216:	f422 62c0 	bic.w	r2, r2, #1536	; 0x600
+ 800721a:	f442 6280 	orr.w	r2, r2, #1024	; 0x400
+ 800721e:	601a      	str	r2, [r3, #0]
+ 8007220:	e7cf      	b.n	80071c2 <HAL_PWREx_ControlVoltageScaling+0x46>
+ 8007222:	bf00      	nop
+ 8007224:	40007000 	.word	0x40007000
+ 8007228:	2009e2a8 	.word	0x2009e2a8
+ 800722c:	000f4240 	.word	0x000f4240
+
+08007230 <HAL_SDEx_DriveTransceiver_1_8V_Callback>:
+
+__weak void HAL_SDEx_DriveTransceiver_1_8V_Callback(FlagStatus status)
+{
+    // unused?
+}
+ 8007230:	4770      	bx	lr
+	...
+
+08007234 <__NVIC_SystemReset>:
+ 8007234:	f3bf 8f4f 	dsb	sy
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 8007238:	4905      	ldr	r1, [pc, #20]	; (8007250 <__NVIC_SystemReset+0x1c>)
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 800723a:	4b06      	ldr	r3, [pc, #24]	; (8007254 <__NVIC_SystemReset+0x20>)
+                           (SCB->AIRCR & SCB_AIRCR_PRIGROUP_Msk) |
+ 800723c:	68ca      	ldr	r2, [r1, #12]
+ 800723e:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+  SCB->AIRCR  = (uint32_t)((0x5FAUL << SCB_AIRCR_VECTKEY_Pos)    |
+ 8007242:	4313      	orrs	r3, r2
+ 8007244:	60cb      	str	r3, [r1, #12]
+ 8007246:	f3bf 8f4f 	dsb	sy
+    __NOP();
+ 800724a:	bf00      	nop
+  for(;;)                                                           /* wait until reset */
+ 800724c:	e7fd      	b.n	800724a <__NVIC_SystemReset+0x16>
+ 800724e:	bf00      	nop
+ 8007250:	e000ed00 	.word	0xe000ed00
+ 8007254:	05fa0004 	.word	0x05fa0004
+
+08007258 <xor_mixin>:
+{
+ 8007258:	b510      	push	{r4, lr}
+ 800725a:	3801      	subs	r0, #1
+ 800725c:	440a      	add	r2, r1
+		*(acc) ^= *(more);
+ 800725e:	f811 4b01 	ldrb.w	r4, [r1], #1
+ 8007262:	f810 3f01 	ldrb.w	r3, [r0, #1]!
+	for(; len; len--, more++, acc++) {
+ 8007266:	4291      	cmp	r1, r2
+		*(acc) ^= *(more);
+ 8007268:	ea83 0304 	eor.w	r3, r3, r4
+ 800726c:	7003      	strb	r3, [r0, #0]
+	for(; len; len--, more++, acc++) {
+ 800726e:	d1f6      	bne.n	800725e <xor_mixin+0x6>
+	}
+}
+ 8007270:	bd10      	pop	{r4, pc}
+	...
+
+08007274 <se2_write1>:
+
+// se2_write1()
+//
+    static bool
+se2_write1(uint8_t cmd, uint8_t arg)
+{
+ 8007274:	b51f      	push	{r0, r1, r2, r3, r4, lr}
+    uint8_t data[3] = { cmd, 1, arg };
+ 8007276:	2301      	movs	r3, #1
+ 8007278:	f88d 300d 	strb.w	r3, [sp, #13]
+
+    HAL_StatusTypeDef rv = HAL_I2C_Master_Transmit(&i2c_port, I2C_ADDR, 
+ 800727c:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+    uint8_t data[3] = { cmd, 1, arg };
+ 8007280:	f88d 000c 	strb.w	r0, [sp, #12]
+ 8007284:	f88d 100e 	strb.w	r1, [sp, #14]
+    HAL_StatusTypeDef rv = HAL_I2C_Master_Transmit(&i2c_port, I2C_ADDR, 
+ 8007288:	9300      	str	r3, [sp, #0]
+ 800728a:	aa03      	add	r2, sp, #12
+ 800728c:	2303      	movs	r3, #3
+ 800728e:	2136      	movs	r1, #54	; 0x36
+ 8007290:	4804      	ldr	r0, [pc, #16]	; (80072a4 <se2_write1+0x30>)
+ 8007292:	f004 fb7f 	bl	800b994 <HAL_I2C_Master_Transmit>
+                                                    data, sizeof(data), HAL_MAX_DELAY);
+
+    return (rv != HAL_OK);
+}
+ 8007296:	3800      	subs	r0, #0
+ 8007298:	bf18      	it	ne
+ 800729a:	2001      	movne	r0, #1
+ 800729c:	b005      	add	sp, #20
+ 800729e:	f85d fb04 	ldr.w	pc, [sp], #4
+ 80072a2:	bf00      	nop
+ 80072a4:	2009e3ec 	.word	0x2009e3ec
+
+080072a8 <se2_write2>:
+
+// se2_write2()
+//
+    static bool
+se2_write2(uint8_t cmd, uint8_t arg1, uint8_t arg2)
+{
+ 80072a8:	b51f      	push	{r0, r1, r2, r3, r4, lr}
+    uint8_t data[4] = { cmd, 2, arg1, arg2 };
+ 80072aa:	2302      	movs	r3, #2
+ 80072ac:	f88d 300d 	strb.w	r3, [sp, #13]
+
+    HAL_StatusTypeDef rv = HAL_I2C_Master_Transmit(&i2c_port, I2C_ADDR,
+ 80072b0:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+    uint8_t data[4] = { cmd, 2, arg1, arg2 };
+ 80072b4:	f88d 000c 	strb.w	r0, [sp, #12]
+ 80072b8:	f88d 100e 	strb.w	r1, [sp, #14]
+ 80072bc:	f88d 200f 	strb.w	r2, [sp, #15]
+    HAL_StatusTypeDef rv = HAL_I2C_Master_Transmit(&i2c_port, I2C_ADDR,
+ 80072c0:	9300      	str	r3, [sp, #0]
+ 80072c2:	aa03      	add	r2, sp, #12
+ 80072c4:	2304      	movs	r3, #4
+ 80072c6:	2136      	movs	r1, #54	; 0x36
+ 80072c8:	4804      	ldr	r0, [pc, #16]	; (80072dc <se2_write2+0x34>)
+ 80072ca:	f004 fb63 	bl	800b994 <HAL_I2C_Master_Transmit>
+                                                    data, sizeof(data), HAL_MAX_DELAY);
+
+    return (rv != HAL_OK);
+}
+ 80072ce:	3800      	subs	r0, #0
+ 80072d0:	bf18      	it	ne
+ 80072d2:	2001      	movne	r0, #1
+ 80072d4:	b005      	add	sp, #20
+ 80072d6:	f85d fb04 	ldr.w	pc, [sp], #4
+ 80072da:	bf00      	nop
+ 80072dc:	2009e3ec 	.word	0x2009e3ec
+
+080072e0 <se2_write_n>:
+
+// se2_write_n()
+//
+    static bool
+se2_write_n(uint8_t cmd, uint8_t *param1, const uint8_t *data_in, uint8_t len)
+{
+ 80072e0:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 80072e2:	460d      	mov	r5, r1
+    uint8_t data[2 + (param1?1:0) + len], *p = data;
+ 80072e4:	2d00      	cmp	r5, #0
+ 80072e6:	bf14      	ite	ne
+ 80072e8:	2403      	movne	r4, #3
+ 80072ea:	2402      	moveq	r4, #2
+ 80072ec:	441c      	add	r4, r3
+{
+ 80072ee:	4611      	mov	r1, r2
+    uint8_t data[2 + (param1?1:0) + len], *p = data;
+ 80072f0:	f104 0207 	add.w	r2, r4, #7
+{
+ 80072f4:	b083      	sub	sp, #12
+    uint8_t data[2 + (param1?1:0) + len], *p = data;
+ 80072f6:	f402 727e 	and.w	r2, r2, #1016	; 0x3f8
+{
+ 80072fa:	af02      	add	r7, sp, #8
+    uint8_t data[2 + (param1?1:0) + len], *p = data;
+ 80072fc:	ebad 0d02 	sub.w	sp, sp, r2
+ 8007300:	ae02      	add	r6, sp, #8
+
+    *(p++) = cmd;
+    *(p++) = sizeof(data) - 2;
+ 8007302:	f1a4 0202 	sub.w	r2, r4, #2
+    *(p++) = cmd;
+ 8007306:	f88d 0008 	strb.w	r0, [sp, #8]
+    *(p++) = sizeof(data) - 2;
+ 800730a:	7072      	strb	r2, [r6, #1]
+    if(param1) {
+        *(p++) = *param1;
+ 800730c:	bf1b      	ittet	ne
+ 800730e:	782a      	ldrbne	r2, [r5, #0]
+ 8007310:	70b2      	strbne	r2, [r6, #2]
+    *(p++) = sizeof(data) - 2;
+ 8007312:	f10d 000a 	addeq.w	r0, sp, #10
+        *(p++) = *param1;
+ 8007316:	f10d 000b 	addne.w	r0, sp, #11
+    }
+    if(len) {
+ 800731a:	b113      	cbz	r3, 8007322 <se2_write_n+0x42>
+        memcpy(p, data_in, len);
+ 800731c:	461a      	mov	r2, r3
+ 800731e:	f006 f9b3 	bl	800d688 <memcpy>
+    }
+
+    HAL_StatusTypeDef rv = HAL_I2C_Master_Transmit(&i2c_port, I2C_ADDR,
+ 8007322:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8007326:	9300      	str	r3, [sp, #0]
+ 8007328:	4632      	mov	r2, r6
+ 800732a:	4623      	mov	r3, r4
+ 800732c:	2136      	movs	r1, #54	; 0x36
+ 800732e:	4804      	ldr	r0, [pc, #16]	; (8007340 <se2_write_n+0x60>)
+ 8007330:	f004 fb30 	bl	800b994 <HAL_I2C_Master_Transmit>
+                                                    data, sizeof(data), HAL_MAX_DELAY);
+
+    return (rv != HAL_OK);
+}
+ 8007334:	3800      	subs	r0, #0
+ 8007336:	bf18      	it	ne
+ 8007338:	2001      	movne	r0, #1
+ 800733a:	3704      	adds	r7, #4
+ 800733c:	46bd      	mov	sp, r7
+ 800733e:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8007340:	2009e3ec 	.word	0x2009e3ec
+
+08007344 <rng_for_uECC>:
+
+// rng_for_uECC()
+//
+    static int
+rng_for_uECC(uint8_t *dest, unsigned size)
+{
+ 8007344:	b508      	push	{r3, lr}
+    'dest' was filled with random data, or 0 if the random data could not be generated.
+    The filled-in values should be either truly random, or from a cryptographically-secure PRNG.
+
+    typedef int (*uECC_RNG_Function)(uint8_t *dest, unsigned size);
+    */
+    rng_buffer(dest, size);
+ 8007346:	f7fb fa19 	bl	800277c <rng_buffer>
+
+    return 1;
+}
+ 800734a:	2001      	movs	r0, #1
+ 800734c:	bd08      	pop	{r3, pc}
+	...
+
+08007350 <se2_write_buffer>:
+{
+ 8007350:	b508      	push	{r3, lr}
+ 8007352:	4602      	mov	r2, r0
+    CALL_CHECK(se2_write_n(0x87, NULL, data, len));
+ 8007354:	b2cb      	uxtb	r3, r1
+ 8007356:	2087      	movs	r0, #135	; 0x87
+ 8007358:	2100      	movs	r1, #0
+ 800735a:	f7ff ffc1 	bl	80072e0 <se2_write_n>
+ 800735e:	b118      	cbz	r0, 8007368 <se2_write_buffer+0x18>
+ 8007360:	4802      	ldr	r0, [pc, #8]	; (800736c <se2_write_buffer+0x1c>)
+ 8007362:	21c1      	movs	r1, #193	; 0xc1
+ 8007364:	f006 f9c6 	bl	800d6f4 <longjmp>
+}
+ 8007368:	bd08      	pop	{r3, pc}
+ 800736a:	bf00      	nop
+ 800736c:	2009e390 	.word	0x2009e390
+
+08007370 <se2_read_n>:
+{
+ 8007370:	e92d 43f7 	stmdb	sp!, {r0, r1, r2, r4, r5, r6, r7, r8, r9, lr}
+        HAL_StatusTypeDef rv = HAL_I2C_Master_Receive(&i2c_port, I2C_ADDR, rx, len, HAL_MAX_DELAY);
+ 8007374:	f8df 9044 	ldr.w	r9, [pc, #68]	; 80073bc <se2_read_n+0x4c>
+{
+ 8007378:	4604      	mov	r4, r0
+ 800737a:	460d      	mov	r5, r1
+ 800737c:	f44f 7696 	mov.w	r6, #300	; 0x12c
+        HAL_StatusTypeDef rv = HAL_I2C_Master_Receive(&i2c_port, I2C_ADDR, rx, len, HAL_MAX_DELAY);
+ 8007380:	b287      	uxth	r7, r0
+ 8007382:	f04f 38ff 	mov.w	r8, #4294967295	; 0xffffffff
+ 8007386:	f8cd 8000 	str.w	r8, [sp]
+ 800738a:	463b      	mov	r3, r7
+ 800738c:	462a      	mov	r2, r5
+ 800738e:	2136      	movs	r1, #54	; 0x36
+ 8007390:	4648      	mov	r0, r9
+ 8007392:	f004 fbb3 	bl	800bafc <HAL_I2C_Master_Receive>
+        if(rv == HAL_OK) {
+ 8007396:	b938      	cbnz	r0, 80073a8 <se2_read_n+0x38>
+            if(rx[0] != len-1) {
+ 8007398:	782b      	ldrb	r3, [r5, #0]
+ 800739a:	3c01      	subs	r4, #1
+ 800739c:	42a3      	cmp	r3, r4
+ 800739e:	d10a      	bne.n	80073b6 <se2_read_n+0x46>
+            return rx[1];
+ 80073a0:	7868      	ldrb	r0, [r5, #1]
+}
+ 80073a2:	b003      	add	sp, #12
+ 80073a4:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+        delay_ms(1);
+ 80073a8:	2001      	movs	r0, #1
+ 80073aa:	f7fc fabb 	bl	8003924 <delay_ms>
+    for(int tries=0; tries<300; tries++) {
+ 80073ae:	3e01      	subs	r6, #1
+ 80073b0:	d1e9      	bne.n	8007386 <se2_read_n+0x16>
+    return RC_NO_ACK;
+ 80073b2:	200f      	movs	r0, #15
+ 80073b4:	e7f5      	b.n	80073a2 <se2_read_n+0x32>
+                return RC_WRONG_SIZE;
+ 80073b6:	201f      	movs	r0, #31
+ 80073b8:	e7f3      	b.n	80073a2 <se2_read_n+0x32>
+ 80073ba:	bf00      	nop
+ 80073bc:	2009e3ec 	.word	0x2009e3ec
+
+080073c0 <se2_read1>:
+{
+ 80073c0:	b507      	push	{r0, r1, r2, lr}
+    return se2_read_n(2, rx);
+ 80073c2:	2002      	movs	r0, #2
+ 80073c4:	a901      	add	r1, sp, #4
+ 80073c6:	f7ff ffd3 	bl	8007370 <se2_read_n>
+}
+ 80073ca:	b003      	add	sp, #12
+ 80073cc:	f85d fb04 	ldr.w	pc, [sp], #4
+
+080073d0 <se2_write_page>:
+{
+ 80073d0:	b507      	push	{r0, r1, r2, lr}
+    CALL_CHECK(se2_write_n(0x96, &page_num, data, 32));
+ 80073d2:	2320      	movs	r3, #32
+{
+ 80073d4:	460a      	mov	r2, r1
+ 80073d6:	f88d 0007 	strb.w	r0, [sp, #7]
+    CALL_CHECK(se2_write_n(0x96, &page_num, data, 32));
+ 80073da:	f10d 0107 	add.w	r1, sp, #7
+ 80073de:	2096      	movs	r0, #150	; 0x96
+ 80073e0:	f7ff ff7e 	bl	80072e0 <se2_write_n>
+ 80073e4:	b118      	cbz	r0, 80073ee <se2_write_page+0x1e>
+ 80073e6:	21cb      	movs	r1, #203	; 0xcb
+    CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 80073e8:	4805      	ldr	r0, [pc, #20]	; (8007400 <se2_write_page+0x30>)
+ 80073ea:	f006 f983 	bl	800d6f4 <longjmp>
+ 80073ee:	f7ff ffe7 	bl	80073c0 <se2_read1>
+ 80073f2:	28aa      	cmp	r0, #170	; 0xaa
+ 80073f4:	d001      	beq.n	80073fa <se2_write_page+0x2a>
+ 80073f6:	21cd      	movs	r1, #205	; 0xcd
+ 80073f8:	e7f6      	b.n	80073e8 <se2_write_page+0x18>
+}
+ 80073fa:	b003      	add	sp, #12
+ 80073fc:	f85d fb04 	ldr.w	pc, [sp], #4
+ 8007400:	2009e390 	.word	0x2009e390
+
+08007404 <se2_pick_keypair>:
+    ASSERT(pubkey_num < 2);
+ 8007404:	2801      	cmp	r0, #1
+{
+ 8007406:	b508      	push	{r3, lr}
+    ASSERT(pubkey_num < 2);
+ 8007408:	d902      	bls.n	8007410 <se2_pick_keypair+0xc>
+ 800740a:	480a      	ldr	r0, [pc, #40]	; (8007434 <se2_pick_keypair+0x30>)
+ 800740c:	f7f9 fb1c 	bl	8000a48 <fatal_error>
+    CALL_CHECK(se2_write1(0xcb, (wpe <<6) | pubkey_num));
+ 8007410:	ea40 1181 	orr.w	r1, r0, r1, lsl #6
+ 8007414:	b2c9      	uxtb	r1, r1
+ 8007416:	20cb      	movs	r0, #203	; 0xcb
+ 8007418:	f7ff ff2c 	bl	8007274 <se2_write1>
+ 800741c:	b118      	cbz	r0, 8007426 <se2_pick_keypair+0x22>
+ 800741e:	21d9      	movs	r1, #217	; 0xd9
+    CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 8007420:	4805      	ldr	r0, [pc, #20]	; (8007438 <se2_pick_keypair+0x34>)
+ 8007422:	f006 f967 	bl	800d6f4 <longjmp>
+ 8007426:	f7ff ffcb 	bl	80073c0 <se2_read1>
+ 800742a:	28aa      	cmp	r0, #170	; 0xaa
+ 800742c:	d001      	beq.n	8007432 <se2_pick_keypair+0x2e>
+ 800742e:	21db      	movs	r1, #219	; 0xdb
+ 8007430:	e7f6      	b.n	8007420 <se2_pick_keypair+0x1c>
+}
+ 8007432:	bd08      	pop	{r3, pc}
+ 8007434:	0800e466 	.word	0x0800e466
+ 8007438:	2009e390 	.word	0x2009e390
+
+0800743c <se2_verify_page>:
+{
+ 800743c:	b570      	push	{r4, r5, r6, lr}
+ 800743e:	b0dc      	sub	sp, #368	; 0x170
+ 8007440:	460d      	mov	r5, r1
+ 8007442:	f88d 0007 	strb.w	r0, [sp, #7]
+    rng_buffer(chal, sizeof(chal));
+ 8007446:	2120      	movs	r1, #32
+ 8007448:	a802      	add	r0, sp, #8
+{
+ 800744a:	4616      	mov	r6, r2
+ 800744c:	461c      	mov	r4, r3
+    rng_buffer(chal, sizeof(chal));
+ 800744e:	f7fb f995 	bl	800277c <rng_buffer>
+    se2_write_buffer(chal, sizeof(chal));
+ 8007452:	2120      	movs	r1, #32
+ 8007454:	a802      	add	r0, sp, #8
+ 8007456:	f7ff ff7b 	bl	8007350 <se2_write_buffer>
+    CALL_CHECK(se2_write1(0xa5, (keynum<<5) | page_num));
+ 800745a:	f89d 3007 	ldrb.w	r3, [sp, #7]
+ 800745e:	ea43 1146 	orr.w	r1, r3, r6, lsl #5
+ 8007462:	b2c9      	uxtb	r1, r1
+ 8007464:	20a5      	movs	r0, #165	; 0xa5
+ 8007466:	f7ff ff05 	bl	8007274 <se2_write1>
+ 800746a:	b118      	cbz	r0, 8007474 <se2_verify_page+0x38>
+ 800746c:	21eb      	movs	r1, #235	; 0xeb
+    CHECK_RIGHT(se2_read_n(sizeof(check), check) == RC_SUCCESS);
+ 800746e:	481e      	ldr	r0, [pc, #120]	; (80074e8 <se2_verify_page+0xac>)
+ 8007470:	f006 f940 	bl	800d6f4 <longjmp>
+ 8007474:	a912      	add	r1, sp, #72	; 0x48
+ 8007476:	2022      	movs	r0, #34	; 0x22
+ 8007478:	f7ff ff7a 	bl	8007370 <se2_read_n>
+ 800747c:	28aa      	cmp	r0, #170	; 0xaa
+ 800747e:	d001      	beq.n	8007484 <se2_verify_page+0x48>
+ 8007480:	21ee      	movs	r1, #238	; 0xee
+ 8007482:	e7f4      	b.n	800746e <se2_verify_page+0x32>
+    hmac_sha256_init(&ctx);
+ 8007484:	a81b      	add	r0, sp, #108	; 0x6c
+ 8007486:	f7fe f8bb 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, SE2_SECRETS->romid, 8);
+ 800748a:	4b18      	ldr	r3, [pc, #96]	; (80074ec <se2_verify_page+0xb0>)
+ 800748c:	4918      	ldr	r1, [pc, #96]	; (80074f0 <se2_verify_page+0xb4>)
+ 800748e:	f893 20b0 	ldrb.w	r2, [r3, #176]	; 0xb0
+ 8007492:	33b0      	adds	r3, #176	; 0xb0
+ 8007494:	2aff      	cmp	r2, #255	; 0xff
+ 8007496:	bf18      	it	ne
+ 8007498:	4619      	movne	r1, r3
+ 800749a:	a81b      	add	r0, sp, #108	; 0x6c
+ 800749c:	2208      	movs	r2, #8
+ 800749e:	3160      	adds	r1, #96	; 0x60
+ 80074a0:	f7fe f8b4 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, data, 32);
+ 80074a4:	4629      	mov	r1, r5
+ 80074a6:	a81b      	add	r0, sp, #108	; 0x6c
+ 80074a8:	2220      	movs	r2, #32
+ 80074aa:	f7fe f8af 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, chal, 32);
+ 80074ae:	a902      	add	r1, sp, #8
+ 80074b0:	a81b      	add	r0, sp, #108	; 0x6c
+ 80074b2:	2220      	movs	r2, #32
+ 80074b4:	f7fe f8aa 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, &page_num, 1);
+ 80074b8:	f10d 0107 	add.w	r1, sp, #7
+ 80074bc:	a81b      	add	r0, sp, #108	; 0x6c
+ 80074be:	2201      	movs	r2, #1
+ 80074c0:	f7fe f8a4 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, DEV_MANID, 2);
+ 80074c4:	a81b      	add	r0, sp, #108	; 0x6c
+ 80074c6:	490b      	ldr	r1, [pc, #44]	; (80074f4 <se2_verify_page+0xb8>)
+ 80074c8:	2202      	movs	r2, #2
+ 80074ca:	f7fe f89f 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_final(&ctx, secret, expect);
+ 80074ce:	aa0a      	add	r2, sp, #40	; 0x28
+ 80074d0:	4621      	mov	r1, r4
+ 80074d2:	a81b      	add	r0, sp, #108	; 0x6c
+ 80074d4:	f7fe f8b0 	bl	8005638 <hmac_sha256_final>
+    return check_equal(expect, check+2, 32);
+ 80074d8:	2220      	movs	r2, #32
+ 80074da:	f10d 014a 	add.w	r1, sp, #74	; 0x4a
+ 80074de:	a80a      	add	r0, sp, #40	; 0x28
+ 80074e0:	f7fb f8fd 	bl	80026de <check_equal>
+}
+ 80074e4:	b05c      	add	sp, #368	; 0x170
+ 80074e6:	bd70      	pop	{r4, r5, r6, pc}
+ 80074e8:	2009e390 	.word	0x2009e390
+ 80074ec:	0801c000 	.word	0x0801c000
+ 80074f0:	2009e2b0 	.word	0x2009e2b0
+ 80074f4:	0800eacc 	.word	0x0800eacc
+
+080074f8 <se2_read_page>:
+{
+ 80074f8:	b570      	push	{r4, r5, r6, lr}
+ 80074fa:	4604      	mov	r4, r0
+ 80074fc:	b08a      	sub	sp, #40	; 0x28
+ 80074fe:	460d      	mov	r5, r1
+    CALL_CHECK(se2_write1(0x69, page_num));
+ 8007500:	4601      	mov	r1, r0
+ 8007502:	2069      	movs	r0, #105	; 0x69
+{
+ 8007504:	4616      	mov	r6, r2
+    CALL_CHECK(se2_write1(0x69, page_num));
+ 8007506:	f7ff feb5 	bl	8007274 <se2_write1>
+ 800750a:	b120      	cbz	r0, 8007516 <se2_read_page+0x1e>
+ 800750c:	f44f 7185 	mov.w	r1, #266	; 0x10a
+    CHECK_RIGHT(se2_read_n(sizeof(rx), rx) == RC_SUCCESS);
+ 8007510:	481c      	ldr	r0, [pc, #112]	; (8007584 <se2_read_page+0x8c>)
+ 8007512:	f006 f8ef 	bl	800d6f4 <longjmp>
+ 8007516:	a901      	add	r1, sp, #4
+ 8007518:	2022      	movs	r0, #34	; 0x22
+ 800751a:	f7ff ff29 	bl	8007370 <se2_read_n>
+ 800751e:	28aa      	cmp	r0, #170	; 0xaa
+ 8007520:	d002      	beq.n	8007528 <se2_read_page+0x30>
+ 8007522:	f240 110d 	movw	r1, #269	; 0x10d
+ 8007526:	e7f3      	b.n	8007510 <se2_read_page+0x18>
+    CHECK_RIGHT(rx[0] == 33);
+ 8007528:	f89d 3004 	ldrb.w	r3, [sp, #4]
+ 800752c:	2b21      	cmp	r3, #33	; 0x21
+ 800752e:	d002      	beq.n	8007536 <se2_read_page+0x3e>
+ 8007530:	f240 110f 	movw	r1, #271	; 0x10f
+ 8007534:	e7ec      	b.n	8007510 <se2_read_page+0x18>
+    CHECK_RIGHT(rx[1] == RC_SUCCESS);
+ 8007536:	f89d 3005 	ldrb.w	r3, [sp, #5]
+ 800753a:	2baa      	cmp	r3, #170	; 0xaa
+ 800753c:	d002      	beq.n	8007544 <se2_read_page+0x4c>
+ 800753e:	f44f 7188 	mov.w	r1, #272	; 0x110
+ 8007542:	e7e5      	b.n	8007510 <se2_read_page+0x18>
+    memcpy(data, rx+2, 32);
+ 8007544:	f10d 0306 	add.w	r3, sp, #6
+ 8007548:	462a      	mov	r2, r5
+ 800754a:	f10d 0126 	add.w	r1, sp, #38	; 0x26
+ 800754e:	f853 0b04 	ldr.w	r0, [r3], #4
+ 8007552:	f842 0b04 	str.w	r0, [r2], #4
+ 8007556:	428b      	cmp	r3, r1
+ 8007558:	d1f9      	bne.n	800754e <se2_read_page+0x56>
+    if(!verify) return;
+ 800755a:	b186      	cbz	r6, 800757e <se2_read_page+0x86>
+    CHECK_RIGHT(se2_verify_page(page_num, data, 0, SE2_SECRETS->pairing));
+ 800755c:	4b0a      	ldr	r3, [pc, #40]	; (8007588 <se2_read_page+0x90>)
+ 800755e:	4a0b      	ldr	r2, [pc, #44]	; (800758c <se2_read_page+0x94>)
+ 8007560:	f893 10b0 	ldrb.w	r1, [r3, #176]	; 0xb0
+ 8007564:	4b0a      	ldr	r3, [pc, #40]	; (8007590 <se2_read_page+0x98>)
+ 8007566:	4620      	mov	r0, r4
+ 8007568:	29ff      	cmp	r1, #255	; 0xff
+ 800756a:	bf18      	it	ne
+ 800756c:	4613      	movne	r3, r2
+ 800756e:	2200      	movs	r2, #0
+ 8007570:	4629      	mov	r1, r5
+ 8007572:	f7ff ff63 	bl	800743c <se2_verify_page>
+ 8007576:	b910      	cbnz	r0, 800757e <se2_read_page+0x86>
+ 8007578:	f44f 718b 	mov.w	r1, #278	; 0x116
+ 800757c:	e7c8      	b.n	8007510 <se2_read_page+0x18>
+}
+ 800757e:	b00a      	add	sp, #40	; 0x28
+ 8007580:	bd70      	pop	{r4, r5, r6, pc}
+ 8007582:	bf00      	nop
+ 8007584:	2009e390 	.word	0x2009e390
+ 8007588:	0801c000 	.word	0x0801c000
+ 800758c:	0801c0b0 	.word	0x0801c0b0
+ 8007590:	2009e2b0 	.word	0x2009e2b0
+
+08007594 <se2_read_encrypted>:
+{
+ 8007594:	b570      	push	{r4, r5, r6, lr}
+ 8007596:	b0d6      	sub	sp, #344	; 0x158
+ 8007598:	461e      	mov	r6, r3
+    ASSERT((keynum == 0) || (keynum == 2));
+ 800759a:	f032 0302 	bics.w	r3, r2, #2
+{
+ 800759e:	460c      	mov	r4, r1
+ 80075a0:	4615      	mov	r5, r2
+ 80075a2:	f88d 0007 	strb.w	r0, [sp, #7]
+    ASSERT((keynum == 0) || (keynum == 2));
+ 80075a6:	d002      	beq.n	80075ae <se2_read_encrypted+0x1a>
+ 80075a8:	4831      	ldr	r0, [pc, #196]	; (8007670 <se2_read_encrypted+0xdc>)
+ 80075aa:	f7f9 fa4d 	bl	8000a48 <fatal_error>
+    CALL_CHECK(se2_write1(0x4b, (keynum << 6) | page_num));
+ 80075ae:	f89d 1007 	ldrb.w	r1, [sp, #7]
+ 80075b2:	ea41 1182 	orr.w	r1, r1, r2, lsl #6
+ 80075b6:	b2c9      	uxtb	r1, r1
+ 80075b8:	204b      	movs	r0, #75	; 0x4b
+ 80075ba:	f7ff fe5b 	bl	8007274 <se2_write1>
+ 80075be:	b120      	cbz	r0, 80075ca <se2_read_encrypted+0x36>
+ 80075c0:	f44f 71b3 	mov.w	r1, #358	; 0x166
+    CHECK_RIGHT(se2_read_n(sizeof(rx), rx) == RC_SUCCESS);
+ 80075c4:	482b      	ldr	r0, [pc, #172]	; (8007674 <se2_read_encrypted+0xe0>)
+ 80075c6:	f006 f895 	bl	800d6f4 <longjmp>
+ 80075ca:	a90a      	add	r1, sp, #40	; 0x28
+ 80075cc:	202a      	movs	r0, #42	; 0x2a
+ 80075ce:	f7ff fecf 	bl	8007370 <se2_read_n>
+ 80075d2:	28aa      	cmp	r0, #170	; 0xaa
+ 80075d4:	d002      	beq.n	80075dc <se2_read_encrypted+0x48>
+ 80075d6:	f240 1169 	movw	r1, #361	; 0x169
+ 80075da:	e7f3      	b.n	80075c4 <se2_read_encrypted+0x30>
+    CHECK_RIGHT(rx[1] == RC_SUCCESS);
+ 80075dc:	f89d 3029 	ldrb.w	r3, [sp, #41]	; 0x29
+ 80075e0:	2baa      	cmp	r3, #170	; 0xaa
+ 80075e2:	d002      	beq.n	80075ea <se2_read_encrypted+0x56>
+ 80075e4:	f240 116b 	movw	r1, #363	; 0x16b
+ 80075e8:	e7ec      	b.n	80075c4 <se2_read_encrypted+0x30>
+    memcpy(data, rx+2+8, 32);
+ 80075ea:	f10d 0332 	add.w	r3, sp, #50	; 0x32
+ 80075ee:	4622      	mov	r2, r4
+ 80075f0:	f10d 0152 	add.w	r1, sp, #82	; 0x52
+ 80075f4:	f853 0b04 	ldr.w	r0, [r3], #4
+ 80075f8:	f842 0b04 	str.w	r0, [r2], #4
+ 80075fc:	428b      	cmp	r3, r1
+ 80075fe:	d1f9      	bne.n	80075f4 <se2_read_encrypted+0x60>
+    hmac_sha256_init(&ctx);
+ 8007600:	a815      	add	r0, sp, #84	; 0x54
+ 8007602:	f7fd fffd 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, chal, 8);
+ 8007606:	2208      	movs	r2, #8
+ 8007608:	f10d 012a 	add.w	r1, sp, #42	; 0x2a
+ 800760c:	a815      	add	r0, sp, #84	; 0x54
+ 800760e:	f7fd fffd 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, SE2_SECRETS->romid, 8);
+ 8007612:	4b19      	ldr	r3, [pc, #100]	; (8007678 <se2_read_encrypted+0xe4>)
+ 8007614:	4919      	ldr	r1, [pc, #100]	; (800767c <se2_read_encrypted+0xe8>)
+ 8007616:	f893 20b0 	ldrb.w	r2, [r3, #176]	; 0xb0
+ 800761a:	33b0      	adds	r3, #176	; 0xb0
+ 800761c:	2aff      	cmp	r2, #255	; 0xff
+ 800761e:	bf18      	it	ne
+ 8007620:	4619      	movne	r1, r3
+ 8007622:	3160      	adds	r1, #96	; 0x60
+ 8007624:	2208      	movs	r2, #8
+ 8007626:	a815      	add	r0, sp, #84	; 0x54
+ 8007628:	f7fd fff0 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, &page_num, 1);
+ 800762c:	2201      	movs	r2, #1
+ 800762e:	f10d 0107 	add.w	r1, sp, #7
+ 8007632:	a815      	add	r0, sp, #84	; 0x54
+ 8007634:	f7fd ffea 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, DEV_MANID, 2);
+ 8007638:	4911      	ldr	r1, [pc, #68]	; (8007680 <se2_read_encrypted+0xec>)
+ 800763a:	2202      	movs	r2, #2
+ 800763c:	a815      	add	r0, sp, #84	; 0x54
+ 800763e:	f7fd ffe5 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_final(&ctx, secret, otp);
+ 8007642:	aa02      	add	r2, sp, #8
+ 8007644:	4631      	mov	r1, r6
+ 8007646:	a815      	add	r0, sp, #84	; 0x54
+ 8007648:	f7fd fff6 	bl	8005638 <hmac_sha256_final>
+    xor_mixin(data, otp, 32);
+ 800764c:	2220      	movs	r2, #32
+ 800764e:	a902      	add	r1, sp, #8
+ 8007650:	4620      	mov	r0, r4
+ 8007652:	f7ff fe01 	bl	8007258 <xor_mixin>
+    CHECK_RIGHT(se2_verify_page(page_num, data, keynum, secret));
+ 8007656:	f89d 0007 	ldrb.w	r0, [sp, #7]
+ 800765a:	4633      	mov	r3, r6
+ 800765c:	462a      	mov	r2, r5
+ 800765e:	4621      	mov	r1, r4
+ 8007660:	f7ff feec 	bl	800743c <se2_verify_page>
+ 8007664:	b910      	cbnz	r0, 800766c <se2_read_encrypted+0xd8>
+ 8007666:	f44f 71c0 	mov.w	r1, #384	; 0x180
+ 800766a:	e7ab      	b.n	80075c4 <se2_read_encrypted+0x30>
+}
+ 800766c:	b056      	add	sp, #344	; 0x158
+ 800766e:	bd70      	pop	{r4, r5, r6, pc}
+ 8007670:	0800e466 	.word	0x0800e466
+ 8007674:	2009e390 	.word	0x2009e390
+ 8007678:	0801c000 	.word	0x0801c000
+ 800767c:	2009e2b0 	.word	0x2009e2b0
+ 8007680:	0800eacc 	.word	0x0800eacc
+
+08007684 <se2_write_encrypted>:
+{
+ 8007684:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 8007688:	460e      	mov	r6, r1
+    ASSERT((keynum == 0) || (keynum == 2));
+ 800768a:	f032 0102 	bics.w	r1, r2, #2
+{
+ 800768e:	b0e4      	sub	sp, #400	; 0x190
+ 8007690:	4604      	mov	r4, r0
+ 8007692:	4617      	mov	r7, r2
+ 8007694:	4698      	mov	r8, r3
+    ASSERT((keynum == 0) || (keynum == 2));
+ 8007696:	d002      	beq.n	800769e <se2_write_encrypted+0x1a>
+ 8007698:	4849      	ldr	r0, [pc, #292]	; (80077c0 <se2_write_encrypted+0x13c>)
+ 800769a:	f7f9 f9d5 	bl	8000a48 <fatal_error>
+    se2_read_encrypted(page_num, old_data, keynum, secret);
+ 800769e:	a901      	add	r1, sp, #4
+ 80076a0:	f7ff ff78 	bl	8007594 <se2_read_encrypted>
+    uint8_t PGDV = page_num | 0x80;
+ 80076a4:	f064 037f 	orn	r3, r4, #127	; 0x7f
+    rng_buffer(&chal_check[32], 8);
+ 80076a8:	2108      	movs	r1, #8
+ 80076aa:	a821      	add	r0, sp, #132	; 0x84
+    uint8_t PGDV = page_num | 0x80;
+ 80076ac:	f88d 3002 	strb.w	r3, [sp, #2]
+    rng_buffer(&chal_check[32], 8);
+ 80076b0:	f7fb f864 	bl	800277c <rng_buffer>
+    hmac_sha256_init(&ctx);
+ 80076b4:	a823      	add	r0, sp, #140	; 0x8c
+ 80076b6:	f7fd ffa3 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, &chal_check[32], 8);
+ 80076ba:	2208      	movs	r2, #8
+ 80076bc:	a921      	add	r1, sp, #132	; 0x84
+ 80076be:	a823      	add	r0, sp, #140	; 0x8c
+ 80076c0:	f7fd ffa4 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, SE2_SECRETS->romid, 8);
+ 80076c4:	4b3f      	ldr	r3, [pc, #252]	; (80077c4 <se2_write_encrypted+0x140>)
+ 80076c6:	4940      	ldr	r1, [pc, #256]	; (80077c8 <se2_write_encrypted+0x144>)
+ 80076c8:	f893 20b0 	ldrb.w	r2, [r3, #176]	; 0xb0
+ 80076cc:	33b0      	adds	r3, #176	; 0xb0
+ 80076ce:	2aff      	cmp	r2, #255	; 0xff
+ 80076d0:	bf18      	it	ne
+ 80076d2:	4619      	movne	r1, r3
+ 80076d4:	3160      	adds	r1, #96	; 0x60
+ 80076d6:	2208      	movs	r2, #8
+ 80076d8:	a823      	add	r0, sp, #140	; 0x8c
+ 80076da:	f7fd ff97 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, &PGDV, 1);
+ 80076de:	2201      	movs	r2, #1
+ 80076e0:	f10d 0102 	add.w	r1, sp, #2
+ 80076e4:	a823      	add	r0, sp, #140	; 0x8c
+ 80076e6:	f7fd ff91 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, DEV_MANID, 2);
+ 80076ea:	4938      	ldr	r1, [pc, #224]	; (80077cc <se2_write_encrypted+0x148>)
+ 80076ec:	2202      	movs	r2, #2
+ 80076ee:	a823      	add	r0, sp, #140	; 0x8c
+ 80076f0:	f7fd ff8c 	bl	800560c <hmac_sha256_update>
+    ASSERT(ctx.num_pending == 19);
+ 80076f4:	9b63      	ldr	r3, [sp, #396]	; 0x18c
+ 80076f6:	2b13      	cmp	r3, #19
+ 80076f8:	d1ce      	bne.n	8007698 <se2_write_encrypted+0x14>
+    hmac_sha256_final(&ctx, secret, otp);
+ 80076fa:	aa09      	add	r2, sp, #36	; 0x24
+ 80076fc:	4641      	mov	r1, r8
+ 80076fe:	a823      	add	r0, sp, #140	; 0x8c
+ 8007700:	f7fd ff9a 	bl	8005638 <hmac_sha256_final>
+    memcpy(tmp, data, 32);
+ 8007704:	4635      	mov	r5, r6
+ 8007706:	aa11      	add	r2, sp, #68	; 0x44
+ 8007708:	f106 0c20 	add.w	ip, r6, #32
+ 800770c:	6828      	ldr	r0, [r5, #0]
+ 800770e:	6869      	ldr	r1, [r5, #4]
+ 8007710:	4613      	mov	r3, r2
+ 8007712:	c303      	stmia	r3!, {r0, r1}
+ 8007714:	3508      	adds	r5, #8
+ 8007716:	4565      	cmp	r5, ip
+ 8007718:	461a      	mov	r2, r3
+ 800771a:	d1f7      	bne.n	800770c <se2_write_encrypted+0x88>
+    xor_mixin(tmp, otp, 32);
+ 800771c:	2220      	movs	r2, #32
+ 800771e:	a909      	add	r1, sp, #36	; 0x24
+ 8007720:	a811      	add	r0, sp, #68	; 0x44
+ 8007722:	f7ff fd99 	bl	8007258 <xor_mixin>
+    hmac_sha256_init(&ctx);
+ 8007726:	a823      	add	r0, sp, #140	; 0x8c
+ 8007728:	f7fd ff6a 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, SE2_SECRETS->romid, 8);
+ 800772c:	4b25      	ldr	r3, [pc, #148]	; (80077c4 <se2_write_encrypted+0x140>)
+ 800772e:	4926      	ldr	r1, [pc, #152]	; (80077c8 <se2_write_encrypted+0x144>)
+ 8007730:	f893 20b0 	ldrb.w	r2, [r3, #176]	; 0xb0
+ 8007734:	33b0      	adds	r3, #176	; 0xb0
+ 8007736:	2aff      	cmp	r2, #255	; 0xff
+ 8007738:	bf18      	it	ne
+ 800773a:	4619      	movne	r1, r3
+ 800773c:	3160      	adds	r1, #96	; 0x60
+ 800773e:	2208      	movs	r2, #8
+ 8007740:	a823      	add	r0, sp, #140	; 0x8c
+ 8007742:	f7fd ff63 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, old_data, 32);
+ 8007746:	2220      	movs	r2, #32
+ 8007748:	a901      	add	r1, sp, #4
+ 800774a:	a823      	add	r0, sp, #140	; 0x8c
+ 800774c:	f7fd ff5e 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, data, 32);
+ 8007750:	2220      	movs	r2, #32
+ 8007752:	4631      	mov	r1, r6
+ 8007754:	a823      	add	r0, sp, #140	; 0x8c
+ 8007756:	f7fd ff59 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, &PGDV, 1);
+ 800775a:	2201      	movs	r2, #1
+ 800775c:	f10d 0102 	add.w	r1, sp, #2
+ 8007760:	a823      	add	r0, sp, #140	; 0x8c
+ 8007762:	f7fd ff53 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, DEV_MANID, 2);
+ 8007766:	4919      	ldr	r1, [pc, #100]	; (80077cc <se2_write_encrypted+0x148>)
+ 8007768:	2202      	movs	r2, #2
+ 800776a:	a823      	add	r0, sp, #140	; 0x8c
+ 800776c:	f7fd ff4e 	bl	800560c <hmac_sha256_update>
+    ASSERT(ctx.num_pending == 75);
+ 8007770:	9b63      	ldr	r3, [sp, #396]	; 0x18c
+ 8007772:	2b4b      	cmp	r3, #75	; 0x4b
+ 8007774:	d190      	bne.n	8007698 <se2_write_encrypted+0x14>
+    hmac_sha256_final(&ctx, secret, chal_check);
+ 8007776:	aa19      	add	r2, sp, #100	; 0x64
+ 8007778:	4641      	mov	r1, r8
+ 800777a:	a823      	add	r0, sp, #140	; 0x8c
+ 800777c:	f7fd ff5c 	bl	8005638 <hmac_sha256_final>
+    se2_write_buffer(chal_check, sizeof(chal_check));
+ 8007780:	2128      	movs	r1, #40	; 0x28
+ 8007782:	a819      	add	r0, sp, #100	; 0x64
+ 8007784:	f7ff fde4 	bl	8007350 <se2_write_buffer>
+    uint8_t pn = (keynum << 6) | page_num;
+ 8007788:	ea44 1487 	orr.w	r4, r4, r7, lsl #6
+    CALL_CHECK(se2_write_n(0x99, &pn, tmp, 32));
+ 800778c:	2320      	movs	r3, #32
+ 800778e:	aa11      	add	r2, sp, #68	; 0x44
+ 8007790:	f10d 0103 	add.w	r1, sp, #3
+ 8007794:	2099      	movs	r0, #153	; 0x99
+    uint8_t pn = (keynum << 6) | page_num;
+ 8007796:	f88d 4003 	strb.w	r4, [sp, #3]
+    CALL_CHECK(se2_write_n(0x99, &pn, tmp, 32));
+ 800779a:	f7ff fda1 	bl	80072e0 <se2_write_n>
+ 800779e:	b120      	cbz	r0, 80077aa <se2_write_encrypted+0x126>
+ 80077a0:	f44f 71aa 	mov.w	r1, #340	; 0x154
+    CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 80077a4:	480a      	ldr	r0, [pc, #40]	; (80077d0 <se2_write_encrypted+0x14c>)
+ 80077a6:	f005 ffa5 	bl	800d6f4 <longjmp>
+ 80077aa:	f7ff fe09 	bl	80073c0 <se2_read1>
+ 80077ae:	28aa      	cmp	r0, #170	; 0xaa
+ 80077b0:	d002      	beq.n	80077b8 <se2_write_encrypted+0x134>
+ 80077b2:	f44f 71ab 	mov.w	r1, #342	; 0x156
+ 80077b6:	e7f5      	b.n	80077a4 <se2_write_encrypted+0x120>
+}
+ 80077b8:	b064      	add	sp, #400	; 0x190
+ 80077ba:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+ 80077be:	bf00      	nop
+ 80077c0:	0800e466 	.word	0x0800e466
+ 80077c4:	0801c000 	.word	0x0801c000
+ 80077c8:	2009e2b0 	.word	0x2009e2b0
+ 80077cc:	0800eacc 	.word	0x0800eacc
+ 80077d0:	2009e390 	.word	0x2009e390
+
+080077d4 <se2_get_protection>:
+{
+ 80077d4:	b508      	push	{r3, lr}
+ 80077d6:	4601      	mov	r1, r0
+    CALL_CHECK(se2_write1(0xaa, page_num));
+ 80077d8:	20aa      	movs	r0, #170	; 0xaa
+ 80077da:	f7ff fd4b 	bl	8007274 <se2_write1>
+ 80077de:	b120      	cbz	r0, 80077ea <se2_get_protection+0x16>
+ 80077e0:	4804      	ldr	r0, [pc, #16]	; (80077f4 <se2_get_protection+0x20>)
+ 80077e2:	f240 118b 	movw	r1, #395	; 0x18b
+ 80077e6:	f005 ff85 	bl	800d6f4 <longjmp>
+}
+ 80077ea:	e8bd 4008 	ldmia.w	sp!, {r3, lr}
+    return se2_read1();
+ 80077ee:	f7ff bde7 	b.w	80073c0 <se2_read1>
+ 80077f2:	bf00      	nop
+ 80077f4:	2009e390 	.word	0x2009e390
+
+080077f8 <se2_set_protection>:
+{
+ 80077f8:	b538      	push	{r3, r4, r5, lr}
+ 80077fa:	460c      	mov	r4, r1
+ 80077fc:	4605      	mov	r5, r0
+    if(se2_get_protection(page_num) == flags) {
+ 80077fe:	f7ff ffe9 	bl	80077d4 <se2_get_protection>
+ 8007802:	42a0      	cmp	r0, r4
+ 8007804:	d011      	beq.n	800782a <se2_set_protection+0x32>
+    CALL_CHECK(se2_write2(0xc3, page_num, flags));
+ 8007806:	4622      	mov	r2, r4
+ 8007808:	4629      	mov	r1, r5
+ 800780a:	20c3      	movs	r0, #195	; 0xc3
+ 800780c:	f7ff fd4c 	bl	80072a8 <se2_write2>
+ 8007810:	b120      	cbz	r0, 800781c <se2_set_protection+0x24>
+ 8007812:	f240 119b 	movw	r1, #411	; 0x19b
+    CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 8007816:	4805      	ldr	r0, [pc, #20]	; (800782c <se2_set_protection+0x34>)
+ 8007818:	f005 ff6c 	bl	800d6f4 <longjmp>
+ 800781c:	f7ff fdd0 	bl	80073c0 <se2_read1>
+ 8007820:	28aa      	cmp	r0, #170	; 0xaa
+ 8007822:	d002      	beq.n	800782a <se2_set_protection+0x32>
+ 8007824:	f240 119d 	movw	r1, #413	; 0x19d
+ 8007828:	e7f5      	b.n	8007816 <se2_set_protection+0x1e>
+}
+ 800782a:	bd38      	pop	{r3, r4, r5, pc}
+ 800782c:	2009e390 	.word	0x2009e390
+
+08007830 <se2_probe>:
+{
+ 8007830:	b500      	push	{lr}
+    if(setjmp(error_env)) {
+ 8007832:	4812      	ldr	r0, [pc, #72]	; (800787c <se2_probe+0x4c>)
+{
+ 8007834:	b089      	sub	sp, #36	; 0x24
+    if(setjmp(error_env)) {
+ 8007836:	f005 ff57 	bl	800d6e8 <setjmp>
+ 800783a:	b120      	cbz	r0, 8007846 <se2_probe+0x16>
+        oled_show(screen_se2_issue);
+ 800783c:	4810      	ldr	r0, [pc, #64]	; (8007880 <se2_probe+0x50>)
+ 800783e:	f7f9 fb0f 	bl	8000e60 <oled_show>
+        LOCKUP_FOREVER();
+ 8007842:	bf30      	wfi
+ 8007844:	e7fd      	b.n	8007842 <se2_probe+0x12>
+    rng_delay();
+ 8007846:	f7fa ffaf 	bl	80027a8 <rng_delay>
+    if(rom_secrets->se2.pairing[0] == 0xff) {
+ 800784a:	4b0e      	ldr	r3, [pc, #56]	; (8007884 <se2_probe+0x54>)
+ 800784c:	f893 30b0 	ldrb.w	r3, [r3, #176]	; 0xb0
+ 8007850:	2bff      	cmp	r3, #255	; 0xff
+ 8007852:	d00f      	beq.n	8007874 <se2_probe+0x44>
+        se2_read_page(PGN_ROM_OPTIONS, tmp, true);
+ 8007854:	2201      	movs	r2, #1
+ 8007856:	4669      	mov	r1, sp
+ 8007858:	201c      	movs	r0, #28
+ 800785a:	f7ff fe4d 	bl	80074f8 <se2_read_page>
+        CHECK_RIGHT(check_equal(&tmp[24], rom_secrets->se2.romid, 8));
+ 800785e:	490a      	ldr	r1, [pc, #40]	; (8007888 <se2_probe+0x58>)
+ 8007860:	2208      	movs	r2, #8
+ 8007862:	a806      	add	r0, sp, #24
+ 8007864:	f7fa ff3b 	bl	80026de <check_equal>
+ 8007868:	b920      	cbnz	r0, 8007874 <se2_probe+0x44>
+ 800786a:	4804      	ldr	r0, [pc, #16]	; (800787c <se2_probe+0x4c>)
+ 800786c:	f240 11b5 	movw	r1, #437	; 0x1b5
+ 8007870:	f005 ff40 	bl	800d6f4 <longjmp>
+}
+ 8007874:	b009      	add	sp, #36	; 0x24
+ 8007876:	f85d fb04 	ldr.w	pc, [sp], #4
+ 800787a:	bf00      	nop
+ 800787c:	2009e390 	.word	0x2009e390
+ 8007880:	0800e054 	.word	0x0800e054
+ 8007884:	0801c000 	.word	0x0801c000
+ 8007888:	0801c110 	.word	0x0801c110
+
+0800788c <se2_clear_volatile>:
+{
+ 800788c:	b510      	push	{r4, lr}
+    if(setjmp(error_env)) fatal_mitm();
+ 800788e:	4817      	ldr	r0, [pc, #92]	; (80078ec <se2_clear_volatile+0x60>)
+{
+ 8007890:	b088      	sub	sp, #32
+    if(setjmp(error_env)) fatal_mitm();
+ 8007892:	f005 ff29 	bl	800d6e8 <setjmp>
+ 8007896:	4604      	mov	r4, r0
+ 8007898:	b108      	cbz	r0, 800789e <se2_clear_volatile+0x12>
+ 800789a:	f7f9 f8df 	bl	8000a5c <fatal_mitm>
+    uint8_t z32[32] = {0};
+ 800789e:	221c      	movs	r2, #28
+ 80078a0:	4601      	mov	r1, r0
+ 80078a2:	9000      	str	r0, [sp, #0]
+ 80078a4:	a801      	add	r0, sp, #4
+ 80078a6:	f005 ff17 	bl	800d6d8 <memset>
+    se2_write_page(PGN_PUBKEY_S+0, z32);
+ 80078aa:	4669      	mov	r1, sp
+ 80078ac:	201e      	movs	r0, #30
+ 80078ae:	f7ff fd8f 	bl	80073d0 <se2_write_page>
+    se2_write_page(PGN_PUBKEY_S+1, z32);
+ 80078b2:	4669      	mov	r1, sp
+ 80078b4:	201f      	movs	r0, #31
+ 80078b6:	f7ff fd8b 	bl	80073d0 <se2_write_page>
+    se2_write_buffer(z32, 32);
+ 80078ba:	2120      	movs	r1, #32
+ 80078bc:	4668      	mov	r0, sp
+ 80078be:	f7ff fd47 	bl	8007350 <se2_write_buffer>
+    CALL_CHECK(se2_write2(0x3c, (2<<6), 0));
+ 80078c2:	4622      	mov	r2, r4
+ 80078c4:	2180      	movs	r1, #128	; 0x80
+ 80078c6:	203c      	movs	r0, #60	; 0x3c
+ 80078c8:	f7ff fcee 	bl	80072a8 <se2_write2>
+ 80078cc:	b120      	cbz	r0, 80078d8 <se2_clear_volatile+0x4c>
+ 80078ce:	f240 11cd 	movw	r1, #461	; 0x1cd
+    CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 80078d2:	4806      	ldr	r0, [pc, #24]	; (80078ec <se2_clear_volatile+0x60>)
+ 80078d4:	f005 ff0e 	bl	800d6f4 <longjmp>
+ 80078d8:	f7ff fd72 	bl	80073c0 <se2_read1>
+ 80078dc:	28aa      	cmp	r0, #170	; 0xaa
+ 80078de:	d002      	beq.n	80078e6 <se2_clear_volatile+0x5a>
+ 80078e0:	f44f 71e7 	mov.w	r1, #462	; 0x1ce
+ 80078e4:	e7f5      	b.n	80078d2 <se2_clear_volatile+0x46>
+}
+ 80078e6:	b008      	add	sp, #32
+ 80078e8:	bd10      	pop	{r4, pc}
+ 80078ea:	bf00      	nop
+ 80078ec:	2009e390 	.word	0x2009e390
+
+080078f0 <se2_setup_config>:
+{
+ 80078f0:	b570      	push	{r4, r5, r6, lr}
+    if((setjmp(error_env))) {
+ 80078f2:	485b      	ldr	r0, [pc, #364]	; (8007a60 <se2_setup_config+0x170>)
+{
+ 80078f4:	b090      	sub	sp, #64	; 0x40
+    if((setjmp(error_env))) {
+ 80078f6:	f005 fef7 	bl	800d6e8 <setjmp>
+ 80078fa:	4604      	mov	r4, r0
+ 80078fc:	b120      	cbz	r0, 8007908 <se2_setup_config+0x18>
+        oled_show(screen_se2_issue);
+ 80078fe:	4859      	ldr	r0, [pc, #356]	; (8007a64 <se2_setup_config+0x174>)
+ 8007900:	f7f9 faae 	bl	8000e60 <oled_show>
+        LOCKUP_FOREVER();
+ 8007904:	bf30      	wfi
+ 8007906:	e7fd      	b.n	8007904 <se2_setup_config+0x14>
+    if(rom_secrets->se2.pairing[0] != 0xff) {
+ 8007908:	4b57      	ldr	r3, [pc, #348]	; (8007a68 <se2_setup_config+0x178>)
+ 800790a:	f893 10b0 	ldrb.w	r1, [r3, #176]	; 0xb0
+ 800790e:	29ff      	cmp	r1, #255	; 0xff
+ 8007910:	f040 80a0 	bne.w	8007a54 <se2_setup_config+0x164>
+    memset(&_tbd, 0xff, sizeof(_tbd));
+ 8007914:	4d55      	ldr	r5, [pc, #340]	; (8007a6c <se2_setup_config+0x17c>)
+ 8007916:	22e0      	movs	r2, #224	; 0xe0
+ 8007918:	4628      	mov	r0, r5
+ 800791a:	f005 fedd 	bl	800d6d8 <memset>
+    rng_buffer(_tbd.tpin_key, 32);
+ 800791e:	2120      	movs	r1, #32
+ 8007920:	f105 0080 	add.w	r0, r5, #128	; 0x80
+ 8007924:	f7fa ff2a 	bl	800277c <rng_buffer>
+    se2_read_page(PGN_ROM_OPTIONS, tmp, false);
+ 8007928:	4622      	mov	r2, r4
+ 800792a:	4669      	mov	r1, sp
+ 800792c:	201c      	movs	r0, #28
+ 800792e:	f7ff fde3 	bl	80074f8 <se2_read_page>
+    ASSERT(tmp[1] == 0x00);     // check ANON is not set
+ 8007932:	f89d 3001 	ldrb.w	r3, [sp, #1]
+ 8007936:	b113      	cbz	r3, 800793e <se2_setup_config+0x4e>
+ 8007938:	484d      	ldr	r0, [pc, #308]	; (8007a70 <se2_setup_config+0x180>)
+ 800793a:	f7f9 f885 	bl	8000a48 <fatal_error>
+    memcpy(_tbd.romid, tmp+24, 8);
+ 800793e:	ab06      	add	r3, sp, #24
+ 8007940:	cb03      	ldmia	r3!, {r0, r1}
+ 8007942:	6628      	str	r0, [r5, #96]	; 0x60
+ 8007944:	6669      	str	r1, [r5, #100]	; 0x64
+    rng_buffer(tmp, 32);
+ 8007946:	4668      	mov	r0, sp
+ 8007948:	2120      	movs	r1, #32
+ 800794a:	f7fa ff17 	bl	800277c <rng_buffer>
+    se2_write_page(PGN_SECRET_B, tmp);
+ 800794e:	4669      	mov	r1, sp
+ 8007950:	201a      	movs	r0, #26
+ 8007952:	f7ff fd3d 	bl	80073d0 <se2_write_page>
+    se2_pick_keypair(0, true);
+ 8007956:	2101      	movs	r1, #1
+ 8007958:	4620      	mov	r0, r4
+ 800795a:	f7ff fd53 	bl	8007404 <se2_pick_keypair>
+    se2_read_page(PGN_PUBKEY_A,   &_tbd.pubkey_A[0], false);
+ 800795e:	4622      	mov	r2, r4
+ 8007960:	f105 0120 	add.w	r1, r5, #32
+ 8007964:	2010      	movs	r0, #16
+ 8007966:	f7ff fdc7 	bl	80074f8 <se2_read_page>
+    memset(tmp, 0, 32);
+ 800796a:	2620      	movs	r6, #32
+    se2_read_page(PGN_PUBKEY_A+1, &_tbd.pubkey_A[32], false);
+ 800796c:	4622      	mov	r2, r4
+ 800796e:	f105 0140 	add.w	r1, r5, #64	; 0x40
+ 8007972:	2011      	movs	r0, #17
+ 8007974:	f7ff fdc0 	bl	80074f8 <se2_read_page>
+    memset(tmp, 0, 32);
+ 8007978:	4632      	mov	r2, r6
+ 800797a:	4621      	mov	r1, r4
+ 800797c:	4668      	mov	r0, sp
+ 800797e:	f005 feab 	bl	800d6d8 <memset>
+    se2_write_page(PGN_PRIVKEY_B, tmp);
+ 8007982:	4669      	mov	r1, sp
+ 8007984:	2017      	movs	r0, #23
+ 8007986:	f7ff fd23 	bl	80073d0 <se2_write_page>
+    se2_write_page(PGN_PRIVKEY_B+1, tmp);
+ 800798a:	4669      	mov	r1, sp
+ 800798c:	2018      	movs	r0, #24
+ 800798e:	f7ff fd1f 	bl	80073d0 <se2_write_page>
+    se2_write_page(PGN_PUBKEY_B, tmp);
+ 8007992:	4669      	mov	r1, sp
+ 8007994:	2012      	movs	r0, #18
+ 8007996:	f7ff fd1b 	bl	80073d0 <se2_write_page>
+    se2_write_page(PGN_PUBKEY_B+1, tmp);
+ 800799a:	4669      	mov	r1, sp
+ 800799c:	2013      	movs	r0, #19
+ 800799e:	f7ff fd17 	bl	80073d0 <se2_write_page>
+        rng_buffer(_tbd.pairing, 32);
+ 80079a2:	4631      	mov	r1, r6
+ 80079a4:	4628      	mov	r0, r5
+ 80079a6:	f7fa fee9 	bl	800277c <rng_buffer>
+    } while(_tbd.pairing[0] == 0xff);
+ 80079aa:	782b      	ldrb	r3, [r5, #0]
+ 80079ac:	2bff      	cmp	r3, #255	; 0xff
+ 80079ae:	d0f8      	beq.n	80079a2 <se2_setup_config+0xb2>
+    se2_write_page(PGN_SECRET_A, _tbd.pairing);
+ 80079b0:	4629      	mov	r1, r5
+ 80079b2:	2019      	movs	r0, #25
+    rng_buffer(tmp, 32);
+ 80079b4:	466d      	mov	r5, sp
+    se2_write_page(PGN_SECRET_A, _tbd.pairing);
+ 80079b6:	f7ff fd0b 	bl	80073d0 <se2_write_page>
+    rng_buffer(tmp, 32);
+ 80079ba:	2120      	movs	r1, #32
+ 80079bc:	4628      	mov	r0, r5
+ 80079be:	f7fa fedd 	bl	800277c <rng_buffer>
+    se2_write_page(PGN_SE2_EASY_KEY, tmp);
+ 80079c2:	4629      	mov	r1, r5
+ 80079c4:	200e      	movs	r0, #14
+ 80079c6:	f7ff fd03 	bl	80073d0 <se2_write_page>
+    memset(tmp, 0, 32);
+ 80079ca:	2220      	movs	r2, #32
+ 80079cc:	2100      	movs	r1, #0
+ 80079ce:	4628      	mov	r0, r5
+ 80079d0:	f005 fe82 	bl	800d6d8 <memset>
+    for(int pn=0; pn <= PGN_LAST_TRICK; pn++) {
+ 80079d4:	4626      	mov	r6, r4
+        se2_write_page(pn, tmp);
+ 80079d6:	b2f0      	uxtb	r0, r6
+ 80079d8:	4629      	mov	r1, r5
+    for(int pn=0; pn <= PGN_LAST_TRICK; pn++) {
+ 80079da:	3601      	adds	r6, #1
+        se2_write_page(pn, tmp);
+ 80079dc:	f7ff fcf8 	bl	80073d0 <se2_write_page>
+    for(int pn=0; pn <= PGN_LAST_TRICK; pn++) {
+ 80079e0:	2e0e      	cmp	r6, #14
+ 80079e2:	d1f8      	bne.n	80079d6 <se2_setup_config+0xe6>
+    flash_save_se2_data(&_tbd);
+ 80079e4:	4821      	ldr	r0, [pc, #132]	; (8007a6c <se2_setup_config+0x17c>)
+ 80079e6:	f7fa fc0f 	bl	8002208 <flash_save_se2_data>
+    se2_set_protection(PGN_SECRET_A, PROT_WP);
+ 80079ea:	2102      	movs	r1, #2
+ 80079ec:	2019      	movs	r0, #25
+ 80079ee:	f7ff ff03 	bl	80077f8 <se2_set_protection>
+    se2_set_protection(PGN_SECRET_B, PROT_WP);
+ 80079f2:	2102      	movs	r1, #2
+ 80079f4:	201a      	movs	r0, #26
+ 80079f6:	f7ff feff 	bl	80077f8 <se2_set_protection>
+    se2_set_protection(PGN_PUBKEY_A, PROT_WP);
+ 80079fa:	2102      	movs	r1, #2
+ 80079fc:	2010      	movs	r0, #16
+ 80079fe:	f7ff fefb 	bl	80077f8 <se2_set_protection>
+    se2_set_protection(PGN_PUBKEY_B, PROT_WP);
+ 8007a02:	2102      	movs	r1, #2
+ 8007a04:	2012      	movs	r0, #18
+ 8007a06:	f7ff fef7 	bl	80077f8 <se2_set_protection>
+    se2_set_protection(PGN_SE2_EASY_KEY, PROT_EPH);
+ 8007a0a:	2110      	movs	r1, #16
+ 8007a0c:	4630      	mov	r0, r6
+ 8007a0e:	f7ff fef3 	bl	80077f8 <se2_set_protection>
+        se2_set_protection(pn, PROT_EPH);
+ 8007a12:	2510      	movs	r5, #16
+ 8007a14:	b2e0      	uxtb	r0, r4
+ 8007a16:	4629      	mov	r1, r5
+    for(int pn=0; pn <= PGN_LAST_TRICK; pn++) {
+ 8007a18:	3401      	adds	r4, #1
+        se2_set_protection(pn, PROT_EPH);
+ 8007a1a:	f7ff feed 	bl	80077f8 <se2_set_protection>
+    for(int pn=0; pn <= PGN_LAST_TRICK; pn++) {
+ 8007a1e:	2c0e      	cmp	r4, #14
+ 8007a20:	d1f8      	bne.n	8007a14 <se2_setup_config+0x124>
+    se2_set_protection(PGN_ROM_OPTIONS, PROT_APH);       // not planning to change
+ 8007a22:	2108      	movs	r1, #8
+ 8007a24:	201c      	movs	r0, #28
+ 8007a26:	f7ff fee7 	bl	80077f8 <se2_set_protection>
+    se2_read_page(PGN_DEC_COUNTER, tmp, false);
+ 8007a2a:	2200      	movs	r2, #0
+ 8007a2c:	a908      	add	r1, sp, #32
+ 8007a2e:	201b      	movs	r0, #27
+ 8007a30:	f7ff fd62 	bl	80074f8 <se2_read_page>
+    if(tmp[2] == 0xff) {
+ 8007a34:	f89d 3022 	ldrb.w	r3, [sp, #34]	; 0x22
+ 8007a38:	2bff      	cmp	r3, #255	; 0xff
+ 8007a3a:	d10d      	bne.n	8007a58 <se2_setup_config+0x168>
+        tmp[0] = val & 0x0ff;
+ 8007a3c:	2380      	movs	r3, #128	; 0x80
+ 8007a3e:	f88d 3020 	strb.w	r3, [sp, #32]
+        se2_write_page(PGN_DEC_COUNTER, tmp);
+ 8007a42:	a908      	add	r1, sp, #32
+        tmp[1] = (val >> 8) & 0x0ff;
+ 8007a44:	2300      	movs	r3, #0
+        se2_write_page(PGN_DEC_COUNTER, tmp);
+ 8007a46:	201b      	movs	r0, #27
+        tmp[1] = (val >> 8) & 0x0ff;
+ 8007a48:	f88d 3021 	strb.w	r3, [sp, #33]	; 0x21
+        tmp[2] = (val >> 16) & 0x01;
+ 8007a4c:	f88d 3022 	strb.w	r3, [sp, #34]	; 0x22
+        se2_write_page(PGN_DEC_COUNTER, tmp);
+ 8007a50:	f7ff fcbe 	bl	80073d0 <se2_write_page>
+}
+ 8007a54:	b010      	add	sp, #64	; 0x40
+ 8007a56:	bd70      	pop	{r4, r5, r6, pc}
+        puts("ctr set?");        // not expected, but keep going
+ 8007a58:	4806      	ldr	r0, [pc, #24]	; (8007a74 <se2_setup_config+0x184>)
+ 8007a5a:	f7fd f9d9 	bl	8004e10 <puts>
+ 8007a5e:	e7f9      	b.n	8007a54 <se2_setup_config+0x164>
+ 8007a60:	2009e390 	.word	0x2009e390
+ 8007a64:	0800e054 	.word	0x0800e054
+ 8007a68:	0801c000 	.word	0x0801c000
+ 8007a6c:	2009e2b0 	.word	0x2009e2b0
+ 8007a70:	0800e466 	.word	0x0800e466
+ 8007a74:	0800eaac 	.word	0x0800eaac
+
+08007a78 <se2_save_auth_pubkey>:
+{
+ 8007a78:	b510      	push	{r4, lr}
+ 8007a7a:	b08a      	sub	sp, #40	; 0x28
+ 8007a7c:	9001      	str	r0, [sp, #4]
+    if(setjmp(error_env)) fatal_mitm();
+ 8007a7e:	481e      	ldr	r0, [pc, #120]	; (8007af8 <se2_save_auth_pubkey+0x80>)
+ 8007a80:	f005 fe32 	bl	800d6e8 <setjmp>
+ 8007a84:	b108      	cbz	r0, 8007a8a <se2_save_auth_pubkey+0x12>
+ 8007a86:	f7f8 ffe9 	bl	8000a5c <fatal_mitm>
+    ASSERT(check_all_ones(rom_secrets->se2.auth_pubkey, 64));
+ 8007a8a:	481c      	ldr	r0, [pc, #112]	; (8007afc <se2_save_auth_pubkey+0x84>)
+ 8007a8c:	2140      	movs	r1, #64	; 0x40
+ 8007a8e:	f7fa fe0d 	bl	80026ac <check_all_ones>
+ 8007a92:	b910      	cbnz	r0, 8007a9a <se2_save_auth_pubkey+0x22>
+ 8007a94:	481a      	ldr	r0, [pc, #104]	; (8007b00 <se2_save_auth_pubkey+0x88>)
+ 8007a96:	f7f8 ffd7 	bl	8000a48 <fatal_error>
+    memcpy(&_tbd, &rom_secrets->se2, sizeof(_tbd));
+ 8007a9a:	4c1a      	ldr	r4, [pc, #104]	; (8007b04 <se2_save_auth_pubkey+0x8c>)
+ 8007a9c:	491a      	ldr	r1, [pc, #104]	; (8007b08 <se2_save_auth_pubkey+0x90>)
+ 8007a9e:	22e0      	movs	r2, #224	; 0xe0
+ 8007aa0:	4620      	mov	r0, r4
+ 8007aa2:	f005 fdf1 	bl	800d688 <memcpy>
+    rng_buffer(tmp, 32);
+ 8007aa6:	2120      	movs	r1, #32
+ 8007aa8:	a802      	add	r0, sp, #8
+ 8007aaa:	f7fa fe67 	bl	800277c <rng_buffer>
+    se2_write_page(PGN_SE2_HARD_KEY, tmp);
+ 8007aae:	a902      	add	r1, sp, #8
+ 8007ab0:	200f      	movs	r0, #15
+ 8007ab2:	f7ff fc8d 	bl	80073d0 <se2_write_page>
+    se2_write_page(PGN_PUBKEY_C, &pubkey[0]);
+ 8007ab6:	9901      	ldr	r1, [sp, #4]
+ 8007ab8:	2014      	movs	r0, #20
+ 8007aba:	f7ff fc89 	bl	80073d0 <se2_write_page>
+    se2_write_page(PGN_PUBKEY_C+1, &pubkey[32]);
+ 8007abe:	9b01      	ldr	r3, [sp, #4]
+ 8007ac0:	2015      	movs	r0, #21
+ 8007ac2:	f103 0120 	add.w	r1, r3, #32
+ 8007ac6:	f7ff fc83 	bl	80073d0 <se2_write_page>
+    memcpy(_tbd.auth_pubkey, pubkey, 64);
+ 8007aca:	9b01      	ldr	r3, [sp, #4]
+ 8007acc:	34a0      	adds	r4, #160	; 0xa0
+ 8007ace:	f103 0240 	add.w	r2, r3, #64	; 0x40
+ 8007ad2:	f853 1b04 	ldr.w	r1, [r3], #4
+ 8007ad6:	f844 1b04 	str.w	r1, [r4], #4
+ 8007ada:	4293      	cmp	r3, r2
+ 8007adc:	d1f9      	bne.n	8007ad2 <se2_save_auth_pubkey+0x5a>
+    flash_save_se2_data(&_tbd);
+ 8007ade:	4809      	ldr	r0, [pc, #36]	; (8007b04 <se2_save_auth_pubkey+0x8c>)
+ 8007ae0:	f7fa fb92 	bl	8002208 <flash_save_se2_data>
+    se2_set_protection(PGN_SE2_HARD_KEY, PROT_WP | PROT_ECH | PROT_ECW);
+ 8007ae4:	21c2      	movs	r1, #194	; 0xc2
+ 8007ae6:	200f      	movs	r0, #15
+ 8007ae8:	f7ff fe86 	bl	80077f8 <se2_set_protection>
+    se2_set_protection(PGN_PUBKEY_C, PROT_WP | PROT_RP | PROT_AUTH);
+ 8007aec:	2123      	movs	r1, #35	; 0x23
+ 8007aee:	2014      	movs	r0, #20
+ 8007af0:	f7ff fe82 	bl	80077f8 <se2_set_protection>
+}
+ 8007af4:	b00a      	add	sp, #40	; 0x28
+ 8007af6:	bd10      	pop	{r4, pc}
+ 8007af8:	2009e390 	.word	0x2009e390
+ 8007afc:	0801c150 	.word	0x0801c150
+ 8007b00:	0800e466 	.word	0x0800e466
+ 8007b04:	2009e2b0 	.word	0x2009e2b0
+ 8007b08:	0801c0b0 	.word	0x0801c0b0
+
+08007b0c <trick_pin_hash>:
+{
+ 8007b0c:	b530      	push	{r4, r5, lr}
+ 8007b0e:	4614      	mov	r4, r2
+    ASSERT(pin_len >= 0);           // 12-12 typical, but empty = blank PIN
+ 8007b10:	1e0a      	subs	r2, r1, #0
+{
+ 8007b12:	b0c5      	sub	sp, #276	; 0x114
+ 8007b14:	4605      	mov	r5, r0
+    ASSERT(pin_len >= 0);           // 12-12 typical, but empty = blank PIN
+ 8007b16:	da02      	bge.n	8007b1e <trick_pin_hash+0x12>
+ 8007b18:	4812      	ldr	r0, [pc, #72]	; (8007b64 <trick_pin_hash+0x58>)
+ 8007b1a:	f7f8 ff95 	bl	8000a48 <fatal_error>
+    hmac_sha256_init(&ctx);
+ 8007b1e:	a803      	add	r0, sp, #12
+ 8007b20:	9201      	str	r2, [sp, #4]
+ 8007b22:	f7fd fd6d 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, (uint8_t *)pin, pin_len);
+ 8007b26:	9a01      	ldr	r2, [sp, #4]
+ 8007b28:	4629      	mov	r1, r5
+ 8007b2a:	a803      	add	r0, sp, #12
+ 8007b2c:	f7fd fd6e 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_final(&ctx, SE2_SECRETS->tpin_key, tpin_hash);
+ 8007b30:	4b0d      	ldr	r3, [pc, #52]	; (8007b68 <trick_pin_hash+0x5c>)
+ 8007b32:	490e      	ldr	r1, [pc, #56]	; (8007b6c <trick_pin_hash+0x60>)
+ 8007b34:	f893 20b0 	ldrb.w	r2, [r3, #176]	; 0xb0
+ 8007b38:	33b0      	adds	r3, #176	; 0xb0
+ 8007b3a:	2aff      	cmp	r2, #255	; 0xff
+ 8007b3c:	bf18      	it	ne
+ 8007b3e:	4619      	movne	r1, r3
+ 8007b40:	a803      	add	r0, sp, #12
+ 8007b42:	4622      	mov	r2, r4
+ 8007b44:	3180      	adds	r1, #128	; 0x80
+ 8007b46:	f7fd fd77 	bl	8005638 <hmac_sha256_final>
+    sha256_single(tpin_hash, 32, tpin_hash);
+ 8007b4a:	4622      	mov	r2, r4
+ 8007b4c:	4620      	mov	r0, r4
+ 8007b4e:	2120      	movs	r1, #32
+ 8007b50:	f7fd fd36 	bl	80055c0 <sha256_single>
+    sha256_single(tpin_hash, 32, tpin_hash);
+ 8007b54:	4622      	mov	r2, r4
+ 8007b56:	2120      	movs	r1, #32
+ 8007b58:	4620      	mov	r0, r4
+ 8007b5a:	f7fd fd31 	bl	80055c0 <sha256_single>
+}
+ 8007b5e:	b045      	add	sp, #276	; 0x114
+ 8007b60:	bd30      	pop	{r4, r5, pc}
+ 8007b62:	bf00      	nop
+ 8007b64:	0800e466 	.word	0x0800e466
+ 8007b68:	0801c000 	.word	0x0801c000
+ 8007b6c:	2009e2b0 	.word	0x2009e2b0
+
+08007b70 <p256_gen_keypair>:
+
+// p256_gen_keypair()
+//
+    void
+p256_gen_keypair(uint8_t privkey[32], uint8_t pubkey[64])
+{
+ 8007b70:	b538      	push	{r3, r4, r5, lr}
+ 8007b72:	4605      	mov	r5, r0
+    uECC_set_rng(rng_for_uECC);
+ 8007b74:	4808      	ldr	r0, [pc, #32]	; (8007b98 <p256_gen_keypair+0x28>)
+{
+ 8007b76:	460c      	mov	r4, r1
+    uECC_set_rng(rng_for_uECC);
+ 8007b78:	f7fe fedc 	bl	8006934 <uECC_set_rng>
+
+    int ok = uECC_make_key(pubkey, privkey, uECC_secp256r1());
+ 8007b7c:	f7fe fee0 	bl	8006940 <uECC_secp256r1>
+ 8007b80:	4629      	mov	r1, r5
+ 8007b82:	4602      	mov	r2, r0
+ 8007b84:	4620      	mov	r0, r4
+ 8007b86:	f7fe fee3 	bl	8006950 <uECC_make_key>
+    ASSERT(ok == 1);
+ 8007b8a:	2801      	cmp	r0, #1
+ 8007b8c:	d002      	beq.n	8007b94 <p256_gen_keypair+0x24>
+ 8007b8e:	4803      	ldr	r0, [pc, #12]	; (8007b9c <p256_gen_keypair+0x2c>)
+ 8007b90:	f7f8 ff5a 	bl	8000a48 <fatal_error>
+}
+ 8007b94:	bd38      	pop	{r3, r4, r5, pc}
+ 8007b96:	bf00      	nop
+ 8007b98:	08007345 	.word	0x08007345
+ 8007b9c:	0800e466 	.word	0x0800e466
+
+08007ba0 <ps256_ecdh>:
+
+// ps256_ecdh()
+//
+    void
+ps256_ecdh(const uint8_t pubkey[64], const uint8_t privkey[32], uint8_t result[32])
+{
+ 8007ba0:	b513      	push	{r0, r1, r4, lr}
+ 8007ba2:	4604      	mov	r4, r0
+    uECC_set_rng(rng_for_uECC);
+ 8007ba4:	4809      	ldr	r0, [pc, #36]	; (8007bcc <ps256_ecdh+0x2c>)
+{
+ 8007ba6:	e9cd 2100 	strd	r2, r1, [sp]
+    uECC_set_rng(rng_for_uECC);
+ 8007baa:	f7fe fec3 	bl	8006934 <uECC_set_rng>
+
+    int ok = uECC_shared_secret(pubkey, privkey, result, uECC_secp256r1());
+ 8007bae:	f7fe fec7 	bl	8006940 <uECC_secp256r1>
+ 8007bb2:	e9dd 2100 	ldrd	r2, r1, [sp]
+ 8007bb6:	4603      	mov	r3, r0
+ 8007bb8:	4620      	mov	r0, r4
+ 8007bba:	f7fe ff09 	bl	80069d0 <uECC_shared_secret>
+    ASSERT(ok == 1);
+ 8007bbe:	2801      	cmp	r0, #1
+ 8007bc0:	d002      	beq.n	8007bc8 <ps256_ecdh+0x28>
+ 8007bc2:	4803      	ldr	r0, [pc, #12]	; (8007bd0 <ps256_ecdh+0x30>)
+ 8007bc4:	f7f8 ff40 	bl	8000a48 <fatal_error>
+}
+ 8007bc8:	b002      	add	sp, #8
+ 8007bca:	bd10      	pop	{r4, pc}
+ 8007bcc:	08007345 	.word	0x08007345
+ 8007bd0:	0800e466 	.word	0x0800e466
+
+08007bd4 <se2_read_hard_secret>:
+
+// se2_read_hard_secret()
+//
+    static bool
+se2_read_hard_secret(uint8_t hard_key[32], const uint8_t pin_digest[32])
+{
+ 8007bd4:	b510      	push	{r4, lr}
+ 8007bd6:	b0e8      	sub	sp, #416	; 0x1a0
+ 8007bd8:	e9cd 0102 	strd	r0, r1, [sp, #8]
+    if(setjmp(error_env)) {
+ 8007bdc:	4836      	ldr	r0, [pc, #216]	; (8007cb8 <se2_read_hard_secret+0xe4>)
+ 8007bde:	f005 fd83 	bl	800d6e8 <setjmp>
+ 8007be2:	2800      	cmp	r0, #0
+ 8007be4:	d165      	bne.n	8007cb2 <se2_read_hard_secret+0xde>
+    //
+    SHA256_CTX ctx;
+
+    // pick a temp key pair, share public part w/ SE2
+    uint8_t tmp_privkey[32], tmp_pubkey[64];
+    p256_gen_keypair(tmp_privkey, tmp_pubkey);
+ 8007be6:	a925      	add	r1, sp, #148	; 0x94
+ 8007be8:	a805      	add	r0, sp, #20
+ 8007bea:	f7ff ffc1 	bl	8007b70 <p256_gen_keypair>
+
+    // - this can be mitm-ed, but we sign it next so doesn't matter
+    se2_write_page(PGN_PUBKEY_S, &tmp_pubkey[0]);
+ 8007bee:	a925      	add	r1, sp, #148	; 0x94
+ 8007bf0:	201e      	movs	r0, #30
+ 8007bf2:	f7ff fbed 	bl	80073d0 <se2_write_page>
+    se2_write_page(PGN_PUBKEY_S+1, &tmp_pubkey[32]);
+ 8007bf6:	a92d      	add	r1, sp, #180	; 0xb4
+ 8007bf8:	201f      	movs	r0, #31
+ 8007bfa:	f7ff fbe9 	bl	80073d0 <se2_write_page>
+
+    // pick nonce
+    uint8_t chal[32+32];
+    rng_buffer(chal, sizeof(chal));
+ 8007bfe:	2140      	movs	r1, #64	; 0x40
+ 8007c00:	a835      	add	r0, sp, #212	; 0xd4
+ 8007c02:	f7fa fdbb 	bl	800277c <rng_buffer>
+    se2_write_buffer(chal, sizeof(chal));
+ 8007c06:	2140      	movs	r1, #64	; 0x40
+ 8007c08:	a835      	add	r0, sp, #212	; 0xd4
+ 8007c0a:	f7ff fba1 	bl	8007350 <se2_write_buffer>
+
+    // md = ngu.hash.sha256s(T_pubkey + chal[0:32])
+    sha256_init(&ctx);
+ 8007c0e:	a855      	add	r0, sp, #340	; 0x154
+ 8007c10:	f7fd fc6e 	bl	80054f0 <sha256_init>
+    sha256_update(&ctx, tmp_pubkey, 64);
+ 8007c14:	2240      	movs	r2, #64	; 0x40
+ 8007c16:	a925      	add	r1, sp, #148	; 0x94
+ 8007c18:	a855      	add	r0, sp, #340	; 0x154
+ 8007c1a:	f7fd fc77 	bl	800550c <sha256_update>
+    sha256_update(&ctx, chal, 32);      // only first 32 bytes
+ 8007c1e:	2220      	movs	r2, #32
+ 8007c20:	a935      	add	r1, sp, #212	; 0xd4
+ 8007c22:	a855      	add	r0, sp, #340	; 0x154
+ 8007c24:	f7fd fc72 	bl	800550c <sha256_update>
+
+    uint8_t md[32];
+    sha256_final(&ctx, md);
+ 8007c28:	a90d      	add	r1, sp, #52	; 0x34
+ 8007c2a:	a855      	add	r0, sp, #340	; 0x154
+ 8007c2c:	f7fd fcb4 	bl	8005598 <sha256_final>
+    // Get that digest signed by SE1 now, and doing that requires
+    // the main pin, because the required slot requires auth by that key.
+    // - this is the critical step attackers would not be able to emulate w/o SE1 contents
+    // - fails here if PIN wrong
+    uint8_t signature[64];
+    int arc = ae_sign_authed(KEYNUM_joiner_key, md, signature, KEYNUM_main_pin, pin_digest);
+ 8007c30:	9b03      	ldr	r3, [sp, #12]
+ 8007c32:	9300      	str	r3, [sp, #0]
+ 8007c34:	aa45      	add	r2, sp, #276	; 0x114
+ 8007c36:	2303      	movs	r3, #3
+ 8007c38:	a90d      	add	r1, sp, #52	; 0x34
+ 8007c3a:	2007      	movs	r0, #7
+ 8007c3c:	f7fb f8d4 	bl	8002de8 <ae_sign_authed>
+    CHECK_RIGHT(arc == 0);
+ 8007c40:	4604      	mov	r4, r0
+ 8007c42:	b120      	cbz	r0, 8007c4e <se2_read_hard_secret+0x7a>
+ 8007c44:	f240 4152 	movw	r1, #1106	; 0x452
+
+    // "Authenticate ECDSA Public Key" = 0xA8
+    // cs_offset=32   ecdh_keynum=0=pubA ECDH=1 WR=0
+    uint8_t param = ((32-1) << 3) | (0 << 2) | 0x2;
+    se2_write_n(0xA8, &param, signature, 64);
+    CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 8007c48:	481b      	ldr	r0, [pc, #108]	; (8007cb8 <se2_read_hard_secret+0xe4>)
+ 8007c4a:	f005 fd53 	bl	800d6f4 <longjmp>
+    uint8_t param = ((32-1) << 3) | (0 << 2) | 0x2;
+ 8007c4e:	23fa      	movs	r3, #250	; 0xfa
+ 8007c50:	f88d 3013 	strb.w	r3, [sp, #19]
+    se2_write_n(0xA8, &param, signature, 64);
+ 8007c54:	aa45      	add	r2, sp, #276	; 0x114
+ 8007c56:	2340      	movs	r3, #64	; 0x40
+ 8007c58:	f10d 0113 	add.w	r1, sp, #19
+ 8007c5c:	20a8      	movs	r0, #168	; 0xa8
+ 8007c5e:	f7ff fb3f 	bl	80072e0 <se2_write_n>
+    CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 8007c62:	f7ff fbad 	bl	80073c0 <se2_read1>
+ 8007c66:	28aa      	cmp	r0, #170	; 0xaa
+ 8007c68:	d002      	beq.n	8007c70 <se2_read_hard_secret+0x9c>
+ 8007c6a:	f44f 618b 	mov.w	r1, #1112	; 0x458
+ 8007c6e:	e7eb      	b.n	8007c48 <se2_read_hard_secret+0x74>
+
+    uint8_t shared_x[32], shared_secret[32];
+    ps256_ecdh(rom_secrets->se2.pubkey_A, tmp_privkey, shared_x);
+ 8007c70:	aa15      	add	r2, sp, #84	; 0x54
+ 8007c72:	a905      	add	r1, sp, #20
+ 8007c74:	4811      	ldr	r0, [pc, #68]	; (8007cbc <se2_read_hard_secret+0xe8>)
+ 8007c76:	f7ff ff93 	bl	8007ba0 <ps256_ecdh>
+
+    // shared secret S will be SHA over X of shared ECDH point + chal[32:]
+    //  s = ngu.hash.sha256s(x + chal[32:])
+    sha256_init(&ctx);
+ 8007c7a:	a855      	add	r0, sp, #340	; 0x154
+ 8007c7c:	f7fd fc38 	bl	80054f0 <sha256_init>
+    sha256_update(&ctx, shared_x, 32);
+ 8007c80:	2220      	movs	r2, #32
+ 8007c82:	a915      	add	r1, sp, #84	; 0x54
+ 8007c84:	a855      	add	r0, sp, #340	; 0x154
+ 8007c86:	f7fd fc41 	bl	800550c <sha256_update>
+    sha256_update(&ctx, &chal[32], 32);      // second half
+ 8007c8a:	2220      	movs	r2, #32
+ 8007c8c:	a93d      	add	r1, sp, #244	; 0xf4
+ 8007c8e:	a855      	add	r0, sp, #340	; 0x154
+ 8007c90:	f7fd fc3c 	bl	800550c <sha256_update>
+    sha256_final(&ctx, shared_secret);
+ 8007c94:	a91d      	add	r1, sp, #116	; 0x74
+ 8007c96:	a855      	add	r0, sp, #340	; 0x154
+ 8007c98:	f7fd fc7e 	bl	8005598 <sha256_final>
+
+    se2_read_encrypted(PGN_SE2_HARD_KEY, hard_key, 2, shared_secret);
+ 8007c9c:	200f      	movs	r0, #15
+ 8007c9e:	9902      	ldr	r1, [sp, #8]
+ 8007ca0:	ab1d      	add	r3, sp, #116	; 0x74
+ 8007ca2:	2202      	movs	r2, #2
+ 8007ca4:	f7ff fc76 	bl	8007594 <se2_read_encrypted>
+
+    // CONCERN: secret "S" is retained in SE2's sram. No API to clear it.
+    // - but you'd need to see our copy of that value to make use of it
+    // - and PIN checked already to get here, so you could re-do anyway
+    se2_clear_volatile();
+ 8007ca8:	f7ff fdf0 	bl	800788c <se2_clear_volatile>
+
+    return false;
+ 8007cac:	4620      	mov	r0, r4
+}
+ 8007cae:	b068      	add	sp, #416	; 0x1a0
+ 8007cb0:	bd10      	pop	{r4, pc}
+        return true;
+ 8007cb2:	2001      	movs	r0, #1
+ 8007cb4:	e7fb      	b.n	8007cae <se2_read_hard_secret+0xda>
+ 8007cb6:	bf00      	nop
+ 8007cb8:	2009e390 	.word	0x2009e390
+ 8007cbc:	0801c0d0 	.word	0x0801c0d0
+
+08007cc0 <se2_calc_seed_key>:
+
+// se2_calc_seed_key()
+//
+    static bool
+se2_calc_seed_key(uint8_t aes_key[32], const mcu_key_t *mcu_key, const uint8_t pin_digest[32])
+{
+ 8007cc0:	b570      	push	{r4, r5, r6, lr}
+ 8007cc2:	b0d2      	sub	sp, #328	; 0x148
+ 8007cc4:	4614      	mov	r4, r2
+    // Gather key parts from all over. Combine them w/ HMAC into a AES-256 key
+    uint8_t se1_easy_key[32], se1_hard_key[32];
+    se2_read_encrypted(PGN_SE2_EASY_KEY, se1_easy_key, 0, rom_secrets->se2.pairing);
+ 8007cc6:	4b15      	ldr	r3, [pc, #84]	; (8007d1c <se2_calc_seed_key+0x5c>)
+ 8007cc8:	2200      	movs	r2, #0
+{
+ 8007cca:	4605      	mov	r5, r0
+ 8007ccc:	460e      	mov	r6, r1
+    se2_read_encrypted(PGN_SE2_EASY_KEY, se1_easy_key, 0, rom_secrets->se2.pairing);
+ 8007cce:	200e      	movs	r0, #14
+ 8007cd0:	a901      	add	r1, sp, #4
+ 8007cd2:	f7ff fc5f 	bl	8007594 <se2_read_encrypted>
+
+    if(se2_read_hard_secret(se1_hard_key, pin_digest)) return true;
+ 8007cd6:	4621      	mov	r1, r4
+ 8007cd8:	a809      	add	r0, sp, #36	; 0x24
+ 8007cda:	f7ff ff7b 	bl	8007bd4 <se2_read_hard_secret>
+ 8007cde:	4604      	mov	r4, r0
+ 8007ce0:	b9c8      	cbnz	r0, 8007d16 <se2_calc_seed_key+0x56>
+
+    HMAC_CTX ctx;
+    hmac_sha256_init(&ctx);
+ 8007ce2:	a811      	add	r0, sp, #68	; 0x44
+ 8007ce4:	f7fd fc8c 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, mcu_key->value, 32);
+ 8007ce8:	2220      	movs	r2, #32
+ 8007cea:	4631      	mov	r1, r6
+ 8007cec:	a811      	add	r0, sp, #68	; 0x44
+ 8007cee:	f7fd fc8d 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, se1_hard_key, 32);
+ 8007cf2:	2220      	movs	r2, #32
+ 8007cf4:	a909      	add	r1, sp, #36	; 0x24
+ 8007cf6:	a811      	add	r0, sp, #68	; 0x44
+ 8007cf8:	f7fd fc88 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, se1_easy_key, 32);
+ 8007cfc:	2220      	movs	r2, #32
+ 8007cfe:	a901      	add	r1, sp, #4
+ 8007d00:	a811      	add	r0, sp, #68	; 0x44
+ 8007d02:	f7fd fc83 	bl	800560c <hmac_sha256_update>
+
+    // combine them all using anther MCU key via HMAC-SHA256
+    hmac_sha256_final(&ctx, rom_secrets->mcu_hmac_key, aes_key);
+ 8007d06:	a811      	add	r0, sp, #68	; 0x44
+ 8007d08:	4905      	ldr	r1, [pc, #20]	; (8007d20 <se2_calc_seed_key+0x60>)
+ 8007d0a:	462a      	mov	r2, r5
+ 8007d0c:	f7fd fc94 	bl	8005638 <hmac_sha256_final>
+    hmac_sha256_init(&ctx);     // clear secrets
+ 8007d10:	a811      	add	r0, sp, #68	; 0x44
+ 8007d12:	f7fd fc75 	bl	8005600 <hmac_sha256_init>
+
+    return false;
+}
+ 8007d16:	4620      	mov	r0, r4
+ 8007d18:	b052      	add	sp, #328	; 0x148
+ 8007d1a:	bd70      	pop	{r4, r5, r6, pc}
+ 8007d1c:	0801c0b0 	.word	0x0801c0b0
+ 8007d20:	0801c090 	.word	0x0801c090
+
+08007d24 <se2_setup>:
+{
+ 8007d24:	b5f0      	push	{r4, r5, r6, r7, lr}
+    if(i2c_port.Instance == I2C2) {
+ 8007d26:	4e1b      	ldr	r6, [pc, #108]	; (8007d94 <se2_setup+0x70>)
+ 8007d28:	4f1b      	ldr	r7, [pc, #108]	; (8007d98 <se2_setup+0x74>)
+ 8007d2a:	6833      	ldr	r3, [r6, #0]
+ 8007d2c:	42bb      	cmp	r3, r7
+{
+ 8007d2e:	b089      	sub	sp, #36	; 0x24
+    if(i2c_port.Instance == I2C2) {
+ 8007d30:	d02e      	beq.n	8007d90 <se2_setup+0x6c>
+    __HAL_RCC_GPIOB_CLK_ENABLE();
+ 8007d32:	4b1a      	ldr	r3, [pc, #104]	; (8007d9c <se2_setup+0x78>)
+    GPIO_InitTypeDef setup = {
+ 8007d34:	4d1a      	ldr	r5, [pc, #104]	; (8007da0 <se2_setup+0x7c>)
+    __HAL_RCC_GPIOB_CLK_ENABLE();
+ 8007d36:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8007d38:	f042 0202 	orr.w	r2, r2, #2
+ 8007d3c:	64da      	str	r2, [r3, #76]	; 0x4c
+ 8007d3e:	6cda      	ldr	r2, [r3, #76]	; 0x4c
+ 8007d40:	f002 0202 	and.w	r2, r2, #2
+ 8007d44:	9201      	str	r2, [sp, #4]
+ 8007d46:	9a01      	ldr	r2, [sp, #4]
+    __HAL_RCC_I2C2_CLK_ENABLE();
+ 8007d48:	6d9a      	ldr	r2, [r3, #88]	; 0x58
+ 8007d4a:	f442 0280 	orr.w	r2, r2, #4194304	; 0x400000
+ 8007d4e:	659a      	str	r2, [r3, #88]	; 0x58
+ 8007d50:	6d9b      	ldr	r3, [r3, #88]	; 0x58
+ 8007d52:	f403 0380 	and.w	r3, r3, #4194304	; 0x400000
+ 8007d56:	9302      	str	r3, [sp, #8]
+ 8007d58:	9b02      	ldr	r3, [sp, #8]
+    GPIO_InitTypeDef setup = {
+ 8007d5a:	cd0f      	ldmia	r5!, {r0, r1, r2, r3}
+ 8007d5c:	ac03      	add	r4, sp, #12
+ 8007d5e:	c40f      	stmia	r4!, {r0, r1, r2, r3}
+ 8007d60:	682b      	ldr	r3, [r5, #0]
+    HAL_GPIO_Init(GPIOB, &setup);
+ 8007d62:	4810      	ldr	r0, [pc, #64]	; (8007da4 <se2_setup+0x80>)
+    GPIO_InitTypeDef setup = {
+ 8007d64:	6023      	str	r3, [r4, #0]
+    HAL_GPIO_Init(GPIOB, &setup);
+ 8007d66:	a903      	add	r1, sp, #12
+ 8007d68:	f7f9 f968 	bl	800103c <HAL_GPIO_Init>
+    memset(&i2c_port, 0, sizeof(i2c_port));
+ 8007d6c:	2244      	movs	r2, #68	; 0x44
+ 8007d6e:	2100      	movs	r1, #0
+ 8007d70:	f106 0008 	add.w	r0, r6, #8
+ 8007d74:	f005 fcb0 	bl	800d6d8 <memset>
+    i2c_port.Init.AddressingMode = I2C_ADDRESSINGMODE_7BIT;
+ 8007d78:	2301      	movs	r3, #1
+ 8007d7a:	60f3      	str	r3, [r6, #12]
+    HAL_StatusTypeDef rv = HAL_I2C_Init(&i2c_port);
+ 8007d7c:	4630      	mov	r0, r6
+    i2c_port.Init.Timing = 0x00b03fb8;     // 400khz "fast mode" in CubeMX @ 120Mhz (measured ok)
+ 8007d7e:	4b0a      	ldr	r3, [pc, #40]	; (8007da8 <se2_setup+0x84>)
+    i2c_port.Instance = I2C2;
+ 8007d80:	6037      	str	r7, [r6, #0]
+    i2c_port.Init.Timing = 0x00b03fb8;     // 400khz "fast mode" in CubeMX @ 120Mhz (measured ok)
+ 8007d82:	6073      	str	r3, [r6, #4]
+    HAL_StatusTypeDef rv = HAL_I2C_Init(&i2c_port);
+ 8007d84:	f003 fdb4 	bl	800b8f0 <HAL_I2C_Init>
+    ASSERT(rv == HAL_OK);
+ 8007d88:	b110      	cbz	r0, 8007d90 <se2_setup+0x6c>
+ 8007d8a:	4808      	ldr	r0, [pc, #32]	; (8007dac <se2_setup+0x88>)
+ 8007d8c:	f7f8 fe5c 	bl	8000a48 <fatal_error>
+}
+ 8007d90:	b009      	add	sp, #36	; 0x24
+ 8007d92:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8007d94:	2009e3ec 	.word	0x2009e3ec
+ 8007d98:	40005800 	.word	0x40005800
+ 8007d9c:	40021000 	.word	0x40021000
+ 8007da0:	0800eab8 	.word	0x0800eab8
+ 8007da4:	48000400 	.word	0x48000400
+ 8007da8:	00b03fb8 	.word	0x00b03fb8
+ 8007dac:	0800e466 	.word	0x0800e466
+
+08007db0 <se2_clear_tricks>:
+{
+ 8007db0:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8007db2:	b089      	sub	sp, #36	; 0x24
+    se2_setup();
+ 8007db4:	f7ff ffb6 	bl	8007d24 <se2_setup>
+    if(setjmp(error_env)) fatal_mitm();
+ 8007db8:	480f      	ldr	r0, [pc, #60]	; (8007df8 <se2_clear_tricks+0x48>)
+ 8007dba:	f005 fc95 	bl	800d6e8 <setjmp>
+ 8007dbe:	4604      	mov	r4, r0
+ 8007dc0:	b108      	cbz	r0, 8007dc6 <se2_clear_tricks+0x16>
+ 8007dc2:	f7f8 fe4b 	bl	8000a5c <fatal_mitm>
+    uint8_t tmp[32] = {0};
+ 8007dc6:	9000      	str	r0, [sp, #0]
+ 8007dc8:	4601      	mov	r1, r0
+ 8007dca:	221c      	movs	r2, #28
+ 8007dcc:	a801      	add	r0, sp, #4
+ 8007dce:	f005 fc83 	bl	800d6d8 <memset>
+        se2_write_encrypted(pn, tmp, 0, SE2_SECRETS->pairing);
+ 8007dd2:	4f0a      	ldr	r7, [pc, #40]	; (8007dfc <se2_clear_tricks+0x4c>)
+ 8007dd4:	4e0a      	ldr	r6, [pc, #40]	; (8007e00 <se2_clear_tricks+0x50>)
+ 8007dd6:	4d0b      	ldr	r5, [pc, #44]	; (8007e04 <se2_clear_tricks+0x54>)
+ 8007dd8:	f897 30b0 	ldrb.w	r3, [r7, #176]	; 0xb0
+ 8007ddc:	b2e0      	uxtb	r0, r4
+ 8007dde:	2bff      	cmp	r3, #255	; 0xff
+ 8007de0:	bf0c      	ite	eq
+ 8007de2:	4633      	moveq	r3, r6
+ 8007de4:	462b      	movne	r3, r5
+ 8007de6:	2200      	movs	r2, #0
+ 8007de8:	4669      	mov	r1, sp
+    for(int pn=0; pn <= PGN_LAST_TRICK; pn++) {
+ 8007dea:	3401      	adds	r4, #1
+        se2_write_encrypted(pn, tmp, 0, SE2_SECRETS->pairing);
+ 8007dec:	f7ff fc4a 	bl	8007684 <se2_write_encrypted>
+    for(int pn=0; pn <= PGN_LAST_TRICK; pn++) {
+ 8007df0:	2c0e      	cmp	r4, #14
+ 8007df2:	d1f1      	bne.n	8007dd8 <se2_clear_tricks+0x28>
+}
+ 8007df4:	b009      	add	sp, #36	; 0x24
+ 8007df6:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8007df8:	2009e390 	.word	0x2009e390
+ 8007dfc:	0801c000 	.word	0x0801c000
+ 8007e00:	2009e2b0 	.word	0x2009e2b0
+ 8007e04:	0801c0b0 	.word	0x0801c0b0
+
+08007e08 <se2_read_trick_data>:
+{
+ 8007e08:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 8007e0a:	b087      	sub	sp, #28
+ 8007e0c:	e9cd 0102 	strd	r0, r1, [sp, #8]
+    if(setjmp(error_env)) fatal_mitm();
+ 8007e10:	4816      	ldr	r0, [pc, #88]	; (8007e6c <se2_read_trick_data+0x64>)
+{
+ 8007e12:	9201      	str	r2, [sp, #4]
+    if(setjmp(error_env)) fatal_mitm();
+ 8007e14:	f005 fc68 	bl	800d6e8 <setjmp>
+ 8007e18:	b108      	cbz	r0, 8007e1e <se2_read_trick_data+0x16>
+ 8007e1a:	f7f8 fe1f 	bl	8000a5c <fatal_mitm>
+    se2_read_encrypted(slot_num+1, &data[0], 0, SE2_SECRETS->pairing);
+ 8007e1e:	4f14      	ldr	r7, [pc, #80]	; (8007e70 <se2_read_trick_data+0x68>)
+ 8007e20:	9005      	str	r0, [sp, #20]
+    se2_setup();
+ 8007e22:	f7ff ff7f 	bl	8007d24 <se2_setup>
+    se2_read_encrypted(slot_num+1, &data[0], 0, SE2_SECRETS->pairing);
+ 8007e26:	f89d 4008 	ldrb.w	r4, [sp, #8]
+ 8007e2a:	f897 30b0 	ldrb.w	r3, [r7, #176]	; 0xb0
+ 8007e2e:	4e11      	ldr	r6, [pc, #68]	; (8007e74 <se2_read_trick_data+0x6c>)
+ 8007e30:	4d11      	ldr	r5, [pc, #68]	; (8007e78 <se2_read_trick_data+0x70>)
+ 8007e32:	9a05      	ldr	r2, [sp, #20]
+ 8007e34:	9901      	ldr	r1, [sp, #4]
+ 8007e36:	9204      	str	r2, [sp, #16]
+ 8007e38:	1c60      	adds	r0, r4, #1
+ 8007e3a:	2bff      	cmp	r3, #255	; 0xff
+ 8007e3c:	bf0c      	ite	eq
+ 8007e3e:	4633      	moveq	r3, r6
+ 8007e40:	462b      	movne	r3, r5
+ 8007e42:	b2c0      	uxtb	r0, r0
+ 8007e44:	f7ff fba6 	bl	8007594 <se2_read_encrypted>
+    if(tc_flags & TC_XPRV_WALLET) {
+ 8007e48:	9b03      	ldr	r3, [sp, #12]
+ 8007e4a:	051b      	lsls	r3, r3, #20
+ 8007e4c:	d50c      	bpl.n	8007e68 <se2_read_trick_data+0x60>
+        se2_read_encrypted(slot_num+2, &data[32], 0, SE2_SECRETS->pairing);
+ 8007e4e:	f897 30b0 	ldrb.w	r3, [r7, #176]	; 0xb0
+ 8007e52:	9901      	ldr	r1, [sp, #4]
+ 8007e54:	9a04      	ldr	r2, [sp, #16]
+ 8007e56:	3402      	adds	r4, #2
+ 8007e58:	2bff      	cmp	r3, #255	; 0xff
+ 8007e5a:	bf0c      	ite	eq
+ 8007e5c:	4633      	moveq	r3, r6
+ 8007e5e:	462b      	movne	r3, r5
+ 8007e60:	3120      	adds	r1, #32
+ 8007e62:	b2e0      	uxtb	r0, r4
+ 8007e64:	f7ff fb96 	bl	8007594 <se2_read_encrypted>
+}
+ 8007e68:	b007      	add	sp, #28
+ 8007e6a:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8007e6c:	2009e390 	.word	0x2009e390
+ 8007e70:	0801c000 	.word	0x0801c000
+ 8007e74:	2009e2b0 	.word	0x2009e2b0
+ 8007e78:	0801c0b0 	.word	0x0801c0b0
+
+08007e7c <se2_test_trick_pin>:
+{
+ 8007e7c:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 8007e80:	b0fe      	sub	sp, #504	; 0x1f8
+ 8007e82:	e9cd 1002 	strd	r1, r0, [sp, #8]
+ 8007e86:	e9cd 2300 	strd	r2, r3, [sp]
+    se2_setup();
+ 8007e8a:	f7ff ff4b 	bl	8007d24 <se2_setup>
+    if(setjmp(error_env)) {
+ 8007e8e:	4864      	ldr	r0, [pc, #400]	; (8008020 <se2_test_trick_pin+0x1a4>)
+ 8007e90:	f005 fc2a 	bl	800d6e8 <setjmp>
+ 8007e94:	4604      	mov	r4, r0
+ 8007e96:	b138      	cbz	r0, 8007ea8 <se2_test_trick_pin+0x2c>
+        if(!safety_mode) fatal_mitm();
+ 8007e98:	9b01      	ldr	r3, [sp, #4]
+ 8007e9a:	b11b      	cbz	r3, 8007ea4 <se2_test_trick_pin+0x28>
+        return false;
+ 8007e9c:	2000      	movs	r0, #0
+}
+ 8007e9e:	b07e      	add	sp, #504	; 0x1f8
+ 8007ea0:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+        if(!safety_mode) fatal_mitm();
+ 8007ea4:	f7f8 fdda 	bl	8000a5c <fatal_mitm>
+    if(!pin_len) return false;
+ 8007ea8:	9b02      	ldr	r3, [sp, #8]
+ 8007eaa:	2b00      	cmp	r3, #0
+ 8007eac:	d0f6      	beq.n	8007e9c <se2_test_trick_pin+0x20>
+    trick_pin_hash(pin, pin_len, tpin_hash);
+ 8007eae:	9803      	ldr	r0, [sp, #12]
+        se2_read_encrypted(pn, slots[i], 0, SE2_SECRETS->pairing);
+ 8007eb0:	f8df a174 	ldr.w	sl, [pc, #372]	; 8008028 <se2_test_trick_pin+0x1ac>
+ 8007eb4:	f8df 9174 	ldr.w	r9, [pc, #372]	; 800802c <se2_test_trick_pin+0x1b0>
+ 8007eb8:	f8df 8174 	ldr.w	r8, [pc, #372]	; 8008030 <se2_test_trick_pin+0x1b4>
+    trick_pin_hash(pin, pin_len, tpin_hash);
+ 8007ebc:	aa06      	add	r2, sp, #24
+ 8007ebe:	4619      	mov	r1, r3
+ 8007ec0:	f7ff fe24 	bl	8007b0c <trick_pin_hash>
+ 8007ec4:	ad0e      	add	r5, sp, #56	; 0x38
+ 8007ec6:	462f      	mov	r7, r5
+    int pn = PGN_TRICK(0);
+ 8007ec8:	4626      	mov	r6, r4
+        se2_read_encrypted(pn, slots[i], 0, SE2_SECRETS->pairing);
+ 8007eca:	f89a 30b0 	ldrb.w	r3, [sl, #176]	; 0xb0
+ 8007ece:	4639      	mov	r1, r7
+ 8007ed0:	2bff      	cmp	r3, #255	; 0xff
+ 8007ed2:	bf0c      	ite	eq
+ 8007ed4:	464b      	moveq	r3, r9
+ 8007ed6:	4643      	movne	r3, r8
+ 8007ed8:	b2f0      	uxtb	r0, r6
+ 8007eda:	2200      	movs	r2, #0
+    for(int i=0; i<NUM_TRICKS; i++, pn++) {
+ 8007edc:	3601      	adds	r6, #1
+        se2_read_encrypted(pn, slots[i], 0, SE2_SECRETS->pairing);
+ 8007ede:	f7ff fb59 	bl	8007594 <se2_read_encrypted>
+    for(int i=0; i<NUM_TRICKS; i++, pn++) {
+ 8007ee2:	2e0e      	cmp	r6, #14
+ 8007ee4:	f107 0720 	add.w	r7, r7, #32
+ 8007ee8:	d1ef      	bne.n	8007eca <se2_test_trick_pin+0x4e>
+    se2_clear_volatile();
+ 8007eea:	f7ff fccf 	bl	800788c <se2_clear_volatile>
+    uint32_t blank = 0;
+ 8007eee:	2700      	movs	r7, #0
+    int found = -1;
+ 8007ef0:	f04f 36ff 	mov.w	r6, #4294967295	; 0xffffffff
+        if(check_equal(here, tpin_hash, 28)) {
+ 8007ef4:	f04f 091c 	mov.w	r9, #28
+        blank |= (!!check_all_zeros(here, 32)) << i;
+ 8007ef8:	f04f 0820 	mov.w	r8, #32
+        if(check_equal(here, tpin_hash, 28)) {
+ 8007efc:	464a      	mov	r2, r9
+ 8007efe:	a906      	add	r1, sp, #24
+ 8007f00:	4628      	mov	r0, r5
+ 8007f02:	f7fa fbec 	bl	80026de <check_equal>
+        blank |= (!!check_all_zeros(here, 32)) << i;
+ 8007f06:	4641      	mov	r1, r8
+        if(check_equal(here, tpin_hash, 28)) {
+ 8007f08:	2800      	cmp	r0, #0
+ 8007f0a:	bf18      	it	ne
+ 8007f0c:	4626      	movne	r6, r4
+        blank |= (!!check_all_zeros(here, 32)) << i;
+ 8007f0e:	4628      	mov	r0, r5
+ 8007f10:	f7fa fbd6 	bl	80026c0 <check_all_zeros>
+ 8007f14:	40a0      	lsls	r0, r4
+    for(int i=0; i<NUM_TRICKS; i++) {
+ 8007f16:	3401      	adds	r4, #1
+ 8007f18:	2c0e      	cmp	r4, #14
+        blank |= (!!check_all_zeros(here, 32)) << i;
+ 8007f1a:	ea47 0700 	orr.w	r7, r7, r0
+    for(int i=0; i<NUM_TRICKS; i++) {
+ 8007f1e:	f105 0520 	add.w	r5, r5, #32
+ 8007f22:	d1eb      	bne.n	8007efc <se2_test_trick_pin+0x80>
+    rng_delay();
+ 8007f24:	f7fa fc40 	bl	80027a8 <rng_delay>
+    memset(found_slot, 0, sizeof(trick_slot_t));
+ 8007f28:	9800      	ldr	r0, [sp, #0]
+ 8007f2a:	2280      	movs	r2, #128	; 0x80
+ 8007f2c:	2100      	movs	r1, #0
+ 8007f2e:	f005 fbd3 	bl	800d6d8 <memset>
+    if(safety_mode) {
+ 8007f32:	9b01      	ldr	r3, [sp, #4]
+ 8007f34:	b10b      	cbz	r3, 8007f3a <se2_test_trick_pin+0xbe>
+        found_slot->blank_slots = blank;
+ 8007f36:	9b00      	ldr	r3, [sp, #0]
+ 8007f38:	65df      	str	r7, [r3, #92]	; 0x5c
+    if(found >= 0) {
+ 8007f3a:	1c72      	adds	r2, r6, #1
+ 8007f3c:	d069      	beq.n	8008012 <se2_test_trick_pin+0x196>
+        found_slot->slot_num = found;
+ 8007f3e:	9b00      	ldr	r3, [sp, #0]
+ 8007f40:	0174      	lsls	r4, r6, #5
+ 8007f42:	601e      	str	r6, [r3, #0]
+        memcpy(meta, &slots[found][28], 4);
+ 8007f44:	ab15      	add	r3, sp, #84	; 0x54
+        xor_mixin(meta, &tpin_hash[28], 4);
+ 8007f46:	2204      	movs	r2, #4
+        memcpy(meta, &slots[found][28], 4);
+ 8007f48:	591b      	ldr	r3, [r3, r4]
+ 8007f4a:	9305      	str	r3, [sp, #20]
+        xor_mixin(meta, &tpin_hash[28], 4);
+ 8007f4c:	a90d      	add	r1, sp, #52	; 0x34
+ 8007f4e:	a805      	add	r0, sp, #20
+ 8007f50:	f7ff f982 	bl	8007258 <xor_mixin>
+        memcpy(&found_slot->tc_flags, &meta[0], 2);
+ 8007f54:	9b00      	ldr	r3, [sp, #0]
+ 8007f56:	f8bd 5014 	ldrh.w	r5, [sp, #20]
+        memcpy(&found_slot->tc_arg, &meta[2], 2);
+ 8007f5a:	9a00      	ldr	r2, [sp, #0]
+        memcpy(&found_slot->tc_flags, &meta[0], 2);
+ 8007f5c:	809d      	strh	r5, [r3, #4]
+        memcpy(&found_slot->tc_arg, &meta[2], 2);
+ 8007f5e:	f8bd 3016 	ldrh.w	r3, [sp, #22]
+ 8007f62:	80d3      	strh	r3, [r2, #6]
+        if(todo & TC_WORD_WALLET) {
+ 8007f64:	04eb      	lsls	r3, r5, #19
+ 8007f66:	d513      	bpl.n	8007f90 <se2_test_trick_pin+0x114>
+            if(found+1 < NUM_TRICKS) {
+ 8007f68:	2e0c      	cmp	r6, #12
+ 8007f6a:	dc0e      	bgt.n	8007f8a <se2_test_trick_pin+0x10e>
+                memcpy(found_slot->xdata, &slots[found+1][0], 32);
+ 8007f6c:	f504 73fc 	add.w	r3, r4, #504	; 0x1f8
+ 8007f70:	eb0d 0403 	add.w	r4, sp, r3
+ 8007f74:	f5a4 73d0 	sub.w	r3, r4, #416	; 0x1a0
+ 8007f78:	3208      	adds	r2, #8
+ 8007f7a:	f5a4 74c0 	sub.w	r4, r4, #384	; 0x180
+ 8007f7e:	f853 1b04 	ldr.w	r1, [r3], #4
+ 8007f82:	f842 1b04 	str.w	r1, [r2], #4
+ 8007f86:	42a3      	cmp	r3, r4
+ 8007f88:	d1f9      	bne.n	8007f7e <se2_test_trick_pin+0x102>
+        if(!safety_mode && todo) {
+ 8007f8a:	9b01      	ldr	r3, [sp, #4]
+ 8007f8c:	b33b      	cbz	r3, 8007fde <se2_test_trick_pin+0x162>
+ 8007f8e:	e03e      	b.n	800800e <se2_test_trick_pin+0x192>
+        } else if(todo & TC_XPRV_WALLET) {
+ 8007f90:	052f      	lsls	r7, r5, #20
+ 8007f92:	d521      	bpl.n	8007fd8 <se2_test_trick_pin+0x15c>
+            if(found+2 < NUM_TRICKS) {
+ 8007f94:	2e0b      	cmp	r6, #11
+ 8007f96:	dcf8      	bgt.n	8007f8a <se2_test_trick_pin+0x10e>
+                memcpy(&found_slot->xdata[0], &slots[found+1][0], 32);
+ 8007f98:	9900      	ldr	r1, [sp, #0]
+ 8007f9a:	f504 73fc 	add.w	r3, r4, #504	; 0x1f8
+ 8007f9e:	446b      	add	r3, sp
+ 8007fa0:	f5a3 72d0 	sub.w	r2, r3, #416	; 0x1a0
+ 8007fa4:	3108      	adds	r1, #8
+ 8007fa6:	f5a3 73c0 	sub.w	r3, r3, #384	; 0x180
+ 8007faa:	f852 0b04 	ldr.w	r0, [r2], #4
+ 8007fae:	f841 0b04 	str.w	r0, [r1], #4
+ 8007fb2:	429a      	cmp	r2, r3
+ 8007fb4:	d1f9      	bne.n	8007faa <se2_test_trick_pin+0x12e>
+                memcpy(&found_slot->xdata[32], &slots[found+2][0], 32);
+ 8007fb6:	f504 73fc 	add.w	r3, r4, #504	; 0x1f8
+ 8007fba:	9a00      	ldr	r2, [sp, #0]
+ 8007fbc:	eb0d 0403 	add.w	r4, sp, r3
+ 8007fc0:	f5a4 73c0 	sub.w	r3, r4, #384	; 0x180
+ 8007fc4:	3228      	adds	r2, #40	; 0x28
+ 8007fc6:	f5a4 74b0 	sub.w	r4, r4, #352	; 0x160
+ 8007fca:	f853 1b04 	ldr.w	r1, [r3], #4
+ 8007fce:	f842 1b04 	str.w	r1, [r2], #4
+ 8007fd2:	42a3      	cmp	r3, r4
+ 8007fd4:	d1f9      	bne.n	8007fca <se2_test_trick_pin+0x14e>
+ 8007fd6:	e7d8      	b.n	8007f8a <se2_test_trick_pin+0x10e>
+        if(!safety_mode && todo) {
+ 8007fd8:	9b01      	ldr	r3, [sp, #4]
+ 8007fda:	b9c3      	cbnz	r3, 800800e <se2_test_trick_pin+0x192>
+ 8007fdc:	b1bd      	cbz	r5, 800800e <se2_test_trick_pin+0x192>
+            if(todo & TC_WIPE) {
+ 8007fde:	0428      	lsls	r0, r5, #16
+ 8007fe0:	d50a      	bpl.n	8007ff8 <se2_test_trick_pin+0x17c>
+                mcu_key_clear(NULL);
+ 8007fe2:	2000      	movs	r0, #0
+ 8007fe4:	f7fa fa4e 	bl	8002484 <mcu_key_clear>
+                if(todo == TC_WIPE) {
+ 8007fe8:	f5b5 4f00 	cmp.w	r5, #32768	; 0x8000
+ 8007fec:	d104      	bne.n	8007ff8 <se2_test_trick_pin+0x17c>
+                    oled_show(screen_wiped);
+ 8007fee:	480d      	ldr	r0, [pc, #52]	; (8008024 <se2_test_trick_pin+0x1a8>)
+ 8007ff0:	f7f8 ff36 	bl	8000e60 <oled_show>
+                    LOCKUP_FOREVER();
+ 8007ff4:	bf30      	wfi
+ 8007ff6:	e7fd      	b.n	8007ff4 <se2_test_trick_pin+0x178>
+            if(todo & TC_BRICK) {
+ 8007ff8:	0469      	lsls	r1, r5, #17
+ 8007ffa:	d403      	bmi.n	8008004 <se2_test_trick_pin+0x188>
+            if(todo & TC_REBOOT) {
+ 8007ffc:	05aa      	lsls	r2, r5, #22
+ 8007ffe:	d504      	bpl.n	800800a <se2_test_trick_pin+0x18e>
+                NVIC_SystemReset();
+ 8008000:	f7ff f918 	bl	8007234 <__NVIC_SystemReset>
+                fast_brick();
+ 8008004:	f7fa fb02 	bl	800260c <fast_brick>
+ 8008008:	e7f8      	b.n	8007ffc <se2_test_trick_pin+0x180>
+            if(todo & TC_FAKE_OUT) {
+ 800800a:	04ab      	lsls	r3, r5, #18
+ 800800c:	d401      	bmi.n	8008012 <se2_test_trick_pin+0x196>
+        return true;
+ 800800e:	2001      	movs	r0, #1
+ 8008010:	e745      	b.n	8007e9e <se2_test_trick_pin+0x22>
+        found_slot->slot_num = -1;
+ 8008012:	9a00      	ldr	r2, [sp, #0]
+ 8008014:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8008018:	6013      	str	r3, [r2, #0]
+        rng_delay();
+ 800801a:	f7fa fbc5 	bl	80027a8 <rng_delay>
+ 800801e:	e73d      	b.n	8007e9c <se2_test_trick_pin+0x20>
+ 8008020:	2009e390 	.word	0x2009e390
+ 8008024:	0800e396 	.word	0x0800e396
+ 8008028:	0801c000 	.word	0x0801c000
+ 800802c:	2009e2b0 	.word	0x2009e2b0
+ 8008030:	0801c0b0 	.word	0x0801c0b0
+
+08008034 <se2_handle_bad_pin>:
+{
+ 8008034:	b510      	push	{r4, lr}
+ 8008036:	b0a2      	sub	sp, #136	; 0x88
+ 8008038:	4604      	mov	r4, r0
+    bool is_trick = se2_test_trick_pin("!p", 2, &slot, true);
+ 800803a:	2301      	movs	r3, #1
+ 800803c:	481d      	ldr	r0, [pc, #116]	; (80080b4 <se2_handle_bad_pin+0x80>)
+ 800803e:	aa02      	add	r2, sp, #8
+ 8008040:	2102      	movs	r1, #2
+ 8008042:	f7ff ff1b 	bl	8007e7c <se2_test_trick_pin>
+    if(!is_trick) return;
+ 8008046:	b390      	cbz	r0, 80080ae <se2_handle_bad_pin+0x7a>
+    if(num_fails >= slot.tc_arg) {
+ 8008048:	f8bd 300e 	ldrh.w	r3, [sp, #14]
+ 800804c:	42a3      	cmp	r3, r4
+ 800804e:	dc2e      	bgt.n	80080ae <se2_handle_bad_pin+0x7a>
+        if(slot.tc_flags & TC_WIPE) {
+ 8008050:	f9bd 300c 	ldrsh.w	r3, [sp, #12]
+ 8008054:	f8bd 000c 	ldrh.w	r0, [sp, #12]
+ 8008058:	2b00      	cmp	r3, #0
+ 800805a:	da1c      	bge.n	8008096 <se2_handle_bad_pin+0x62>
+            if(slot.tc_flags & TC_BRICK) {
+ 800805c:	f410 4080 	ands.w	r0, r0, #16384	; 0x4000
+ 8008060:	d00d      	beq.n	800807e <se2_handle_bad_pin+0x4a>
+                const mcu_key_t *cur = mcu_key_get(&valid);
+ 8008062:	f10d 0007 	add.w	r0, sp, #7
+ 8008066:	f7fa f9ed 	bl	8002444 <mcu_key_get>
+                if(valid) {
+ 800806a:	f89d 3007 	ldrb.w	r3, [sp, #7]
+ 800806e:	b193      	cbz	r3, 8008096 <se2_handle_bad_pin+0x62>
+                    mcu_key_clear(cur);
+ 8008070:	f7fa fa08 	bl	8002484 <mcu_key_clear>
+                    oled_show(screen_wiped);
+ 8008074:	4810      	ldr	r0, [pc, #64]	; (80080b8 <se2_handle_bad_pin+0x84>)
+ 8008076:	f7f8 fef3 	bl	8000e60 <oled_show>
+                    LOCKUP_FOREVER();
+ 800807a:	bf30      	wfi
+ 800807c:	e7fd      	b.n	800807a <se2_handle_bad_pin+0x46>
+                mcu_key_clear(NULL);  // does valid key check
+ 800807e:	f7fa fa01 	bl	8002484 <mcu_key_clear>
+                if(slot.tc_flags == TC_WIPE) {
+ 8008082:	f8bd 300c 	ldrh.w	r3, [sp, #12]
+ 8008086:	f5b3 4f00 	cmp.w	r3, #32768	; 0x8000
+ 800808a:	d104      	bne.n	8008096 <se2_handle_bad_pin+0x62>
+                    oled_show(screen_wiped);
+ 800808c:	480a      	ldr	r0, [pc, #40]	; (80080b8 <se2_handle_bad_pin+0x84>)
+ 800808e:	f7f8 fee7 	bl	8000e60 <oled_show>
+                    LOCKUP_FOREVER();
+ 8008092:	bf30      	wfi
+ 8008094:	e7fd      	b.n	8008092 <se2_handle_bad_pin+0x5e>
+        if(slot.tc_flags & TC_BRICK) {
+ 8008096:	f8bd 300c 	ldrh.w	r3, [sp, #12]
+ 800809a:	045a      	lsls	r2, r3, #17
+ 800809c:	d501      	bpl.n	80080a2 <se2_handle_bad_pin+0x6e>
+            fast_brick();
+ 800809e:	f7fa fab5 	bl	800260c <fast_brick>
+        if(slot.tc_flags & TC_REBOOT) {
+ 80080a2:	f8bd 300c 	ldrh.w	r3, [sp, #12]
+ 80080a6:	059b      	lsls	r3, r3, #22
+ 80080a8:	d501      	bpl.n	80080ae <se2_handle_bad_pin+0x7a>
+            NVIC_SystemReset();
+ 80080aa:	f7ff f8c3 	bl	8007234 <__NVIC_SystemReset>
+}
+ 80080ae:	b022      	add	sp, #136	; 0x88
+ 80080b0:	bd10      	pop	{r4, pc}
+ 80080b2:	bf00      	nop
+ 80080b4:	0800eab5 	.word	0x0800eab5
+ 80080b8:	0800e396 	.word	0x0800e396
+
+080080bc <se2_save_trick>:
+{
+ 80080bc:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 80080c0:	b094      	sub	sp, #80	; 0x50
+ 80080c2:	9001      	str	r0, [sp, #4]
+    se2_setup();
+ 80080c4:	f7ff fe2e 	bl	8007d24 <se2_setup>
+    if(setjmp(error_env)) {
+ 80080c8:	4848      	ldr	r0, [pc, #288]	; (80081ec <se2_save_trick+0x130>)
+ 80080ca:	f005 fb0d 	bl	800d6e8 <setjmp>
+ 80080ce:	4604      	mov	r4, r0
+ 80080d0:	2800      	cmp	r0, #0
+ 80080d2:	f040 8088 	bne.w	80081e6 <se2_save_trick+0x12a>
+    if((config->slot_num < 0) || (config->slot_num >= NUM_TRICKS) ) {
+ 80080d6:	9b01      	ldr	r3, [sp, #4]
+ 80080d8:	681b      	ldr	r3, [r3, #0]
+ 80080da:	2b0d      	cmp	r3, #13
+ 80080dc:	d804      	bhi.n	80080e8 <se2_save_trick+0x2c>
+    if((config->slot_num >= NUM_TRICKS-1) && (config->tc_flags & TC_WORD_WALLET) ) {
+ 80080de:	d106      	bne.n	80080ee <se2_save_trick+0x32>
+ 80080e0:	9b01      	ldr	r3, [sp, #4]
+ 80080e2:	889b      	ldrh	r3, [r3, #4]
+ 80080e4:	04d9      	lsls	r1, r3, #19
+ 80080e6:	d504      	bpl.n	80080f2 <se2_save_trick+0x36>
+        return EPIN_RANGE_ERR;
+ 80080e8:	f06f 0466 	mvn.w	r4, #102	; 0x66
+ 80080ec:	e01f      	b.n	800812e <se2_save_trick+0x72>
+    if((config->slot_num >= NUM_TRICKS-2) && (config->tc_flags & TC_XPRV_WALLET) ) {
+ 80080ee:	2b0c      	cmp	r3, #12
+ 80080f0:	d103      	bne.n	80080fa <se2_save_trick+0x3e>
+ 80080f2:	9b01      	ldr	r3, [sp, #4]
+ 80080f4:	889b      	ldrh	r3, [r3, #4]
+ 80080f6:	051a      	lsls	r2, r3, #20
+ 80080f8:	d4f6      	bmi.n	80080e8 <se2_save_trick+0x2c>
+    if(config->pin_len > sizeof(config->pin)) {
+ 80080fa:	9b01      	ldr	r3, [sp, #4]
+ 80080fc:	6d99      	ldr	r1, [r3, #88]	; 0x58
+ 80080fe:	2910      	cmp	r1, #16
+ 8008100:	d8f2      	bhi.n	80080e8 <se2_save_trick+0x2c>
+    if(config->blank_slots) {
+ 8008102:	6ddd      	ldr	r5, [r3, #92]	; 0x5c
+ 8008104:	b31d      	cbz	r5, 800814e <se2_save_trick+0x92>
+        uint8_t zeros[32] = { 0 };
+ 8008106:	2100      	movs	r1, #0
+ 8008108:	221c      	movs	r2, #28
+ 800810a:	a805      	add	r0, sp, #20
+ 800810c:	9104      	str	r1, [sp, #16]
+ 800810e:	f005 fae3 	bl	800d6d8 <memset>
+                se2_write_encrypted(PGN_TRICK(i), zeros, 0, SE2_SECRETS->pairing);
+ 8008112:	f8df 80e4 	ldr.w	r8, [pc, #228]	; 80081f8 <se2_save_trick+0x13c>
+ 8008116:	4f36      	ldr	r7, [pc, #216]	; (80081f0 <se2_save_trick+0x134>)
+ 8008118:	4e36      	ldr	r6, [pc, #216]	; (80081f4 <se2_save_trick+0x138>)
+        for(int i=0; i<NUM_TRICKS; i++) {
+ 800811a:	4625      	mov	r5, r4
+            if(mask & config->blank_slots) {
+ 800811c:	9a01      	ldr	r2, [sp, #4]
+            uint32_t mask = (1 << i);
+ 800811e:	2301      	movs	r3, #1
+            if(mask & config->blank_slots) {
+ 8008120:	6dd2      	ldr	r2, [r2, #92]	; 0x5c
+            uint32_t mask = (1 << i);
+ 8008122:	40ab      	lsls	r3, r5
+            if(mask & config->blank_slots) {
+ 8008124:	4213      	tst	r3, r2
+ 8008126:	d106      	bne.n	8008136 <se2_save_trick+0x7a>
+        for(int i=0; i<NUM_TRICKS; i++) {
+ 8008128:	3501      	adds	r5, #1
+ 800812a:	2d0e      	cmp	r5, #14
+ 800812c:	d1f6      	bne.n	800811c <se2_save_trick+0x60>
+}
+ 800812e:	4620      	mov	r0, r4
+ 8008130:	b014      	add	sp, #80	; 0x50
+ 8008132:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+                se2_write_encrypted(PGN_TRICK(i), zeros, 0, SE2_SECRETS->pairing);
+ 8008136:	f898 30b0 	ldrb.w	r3, [r8, #176]	; 0xb0
+ 800813a:	2200      	movs	r2, #0
+ 800813c:	2bff      	cmp	r3, #255	; 0xff
+ 800813e:	bf0c      	ite	eq
+ 8008140:	463b      	moveq	r3, r7
+ 8008142:	4633      	movne	r3, r6
+ 8008144:	a904      	add	r1, sp, #16
+ 8008146:	b2e8      	uxtb	r0, r5
+ 8008148:	f7ff fa9c 	bl	8007684 <se2_write_encrypted>
+ 800814c:	e7ec      	b.n	8008128 <se2_save_trick+0x6c>
+        trick_pin_hash(config->pin, config->pin_len, tpin_digest);
+ 800814e:	9b01      	ldr	r3, [sp, #4]
+        se2_write_encrypted(PGN_TRICK(config->slot_num), tpin_digest, 0, SE2_SECRETS->pairing);
+ 8008150:	f8df 80a4 	ldr.w	r8, [pc, #164]	; 80081f8 <se2_save_trick+0x13c>
+ 8008154:	4f26      	ldr	r7, [pc, #152]	; (80081f0 <se2_save_trick+0x134>)
+ 8008156:	4e27      	ldr	r6, [pc, #156]	; (80081f4 <se2_save_trick+0x138>)
+        trick_pin_hash(config->pin, config->pin_len, tpin_digest);
+ 8008158:	f103 0048 	add.w	r0, r3, #72	; 0x48
+ 800815c:	aa0c      	add	r2, sp, #48	; 0x30
+ 800815e:	f7ff fcd5 	bl	8007b0c <trick_pin_hash>
+        memcpy(&meta[0], &config->tc_flags, 2);
+ 8008162:	9b01      	ldr	r3, [sp, #4]
+ 8008164:	889b      	ldrh	r3, [r3, #4]
+ 8008166:	f8ad 300c 	strh.w	r3, [sp, #12]
+        memcpy(&meta[2], &config->tc_arg, 2);
+ 800816a:	9b01      	ldr	r3, [sp, #4]
+        xor_mixin(&tpin_digest[28], meta, 4);
+ 800816c:	2204      	movs	r2, #4
+        memcpy(&meta[2], &config->tc_arg, 2);
+ 800816e:	88db      	ldrh	r3, [r3, #6]
+ 8008170:	f8ad 300e 	strh.w	r3, [sp, #14]
+        xor_mixin(&tpin_digest[28], meta, 4);
+ 8008174:	a903      	add	r1, sp, #12
+ 8008176:	a813      	add	r0, sp, #76	; 0x4c
+ 8008178:	f7ff f86e 	bl	8007258 <xor_mixin>
+        se2_write_encrypted(PGN_TRICK(config->slot_num), tpin_digest, 0, SE2_SECRETS->pairing);
+ 800817c:	f898 30b0 	ldrb.w	r3, [r8, #176]	; 0xb0
+ 8008180:	9801      	ldr	r0, [sp, #4]
+ 8008182:	2bff      	cmp	r3, #255	; 0xff
+ 8008184:	bf0c      	ite	eq
+ 8008186:	463b      	moveq	r3, r7
+ 8008188:	4633      	movne	r3, r6
+ 800818a:	7800      	ldrb	r0, [r0, #0]
+ 800818c:	462a      	mov	r2, r5
+ 800818e:	a90c      	add	r1, sp, #48	; 0x30
+ 8008190:	f7ff fa78 	bl	8007684 <se2_write_encrypted>
+        if(config->tc_flags & (TC_WORD_WALLET | TC_XPRV_WALLET)) {
+ 8008194:	9b01      	ldr	r3, [sp, #4]
+ 8008196:	889b      	ldrh	r3, [r3, #4]
+ 8008198:	f403 53c0 	and.w	r3, r3, #6144	; 0x1800
+ 800819c:	b9a3      	cbnz	r3, 80081c8 <se2_save_trick+0x10c>
+        if(config->tc_flags & TC_XPRV_WALLET) {
+ 800819e:	9b01      	ldr	r3, [sp, #4]
+ 80081a0:	889b      	ldrh	r3, [r3, #4]
+ 80081a2:	051b      	lsls	r3, r3, #20
+ 80081a4:	d5c3      	bpl.n	800812e <se2_save_trick+0x72>
+            se2_write_encrypted(PGN_TRICK(config->slot_num+2), &config->xdata[32],
+ 80081a6:	9901      	ldr	r1, [sp, #4]
+                                                                    0, SE2_SECRETS->pairing);
+ 80081a8:	4b13      	ldr	r3, [pc, #76]	; (80081f8 <se2_save_trick+0x13c>)
+            se2_write_encrypted(PGN_TRICK(config->slot_num+2), &config->xdata[32],
+ 80081aa:	f851 0b28 	ldr.w	r0, [r1], #40
+                                                                    0, SE2_SECRETS->pairing);
+ 80081ae:	f893 50b0 	ldrb.w	r5, [r3, #176]	; 0xb0
+            se2_write_encrypted(PGN_TRICK(config->slot_num+2), &config->xdata[32],
+ 80081b2:	4a10      	ldr	r2, [pc, #64]	; (80081f4 <se2_save_trick+0x138>)
+ 80081b4:	4b0e      	ldr	r3, [pc, #56]	; (80081f0 <se2_save_trick+0x134>)
+ 80081b6:	3002      	adds	r0, #2
+ 80081b8:	2dff      	cmp	r5, #255	; 0xff
+ 80081ba:	bf18      	it	ne
+ 80081bc:	4613      	movne	r3, r2
+ 80081be:	b2c0      	uxtb	r0, r0
+ 80081c0:	2200      	movs	r2, #0
+ 80081c2:	f7ff fa5f 	bl	8007684 <se2_write_encrypted>
+ 80081c6:	e7b2      	b.n	800812e <se2_save_trick+0x72>
+            se2_write_encrypted(PGN_TRICK(config->slot_num+1), &config->xdata[0],
+ 80081c8:	9901      	ldr	r1, [sp, #4]
+                                                                    0, SE2_SECRETS->pairing);
+ 80081ca:	f898 30b0 	ldrb.w	r3, [r8, #176]	; 0xb0
+            se2_write_encrypted(PGN_TRICK(config->slot_num+1), &config->xdata[0],
+ 80081ce:	f851 0b08 	ldr.w	r0, [r1], #8
+ 80081d2:	3001      	adds	r0, #1
+ 80081d4:	2bff      	cmp	r3, #255	; 0xff
+ 80081d6:	bf0c      	ite	eq
+ 80081d8:	463b      	moveq	r3, r7
+ 80081da:	4633      	movne	r3, r6
+ 80081dc:	462a      	mov	r2, r5
+ 80081de:	b2c0      	uxtb	r0, r0
+ 80081e0:	f7ff fa50 	bl	8007684 <se2_write_encrypted>
+ 80081e4:	e7db      	b.n	800819e <se2_save_trick+0xe2>
+        return EPIN_SE2_FAIL;
+ 80081e6:	f06f 0472 	mvn.w	r4, #114	; 0x72
+ 80081ea:	e7a0      	b.n	800812e <se2_save_trick+0x72>
+ 80081ec:	2009e390 	.word	0x2009e390
+ 80081f0:	2009e2b0 	.word	0x2009e2b0
+ 80081f4:	0801c0b0 	.word	0x0801c0b0
+ 80081f8:	0801c000 	.word	0x0801c000
+
+080081fc <se2_encrypt_secret>:
+//
+    bool
+se2_encrypt_secret(const uint8_t secret[], int secret_len, int offset, 
+    uint8_t main_slot[], uint8_t *check_value,
+    const uint8_t pin_digest[32])
+{
+ 80081fc:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 8008200:	f5ad 7d10 	sub.w	sp, sp, #576	; 0x240
+ 8008204:	4699      	mov	r9, r3
+ 8008206:	4682      	mov	sl, r0
+ 8008208:	460f      	mov	r7, r1
+ 800820a:	4614      	mov	r4, r2
+ 800820c:	f8dd 8260 	ldr.w	r8, [sp, #608]	; 0x260
+    se2_setup();
+ 8008210:	f7ff fd88 	bl	8007d24 <se2_setup>
+
+    bool is_valid;
+    const mcu_key_t *cur = mcu_key_get(&is_valid);
+ 8008214:	f10d 000b 	add.w	r0, sp, #11
+ 8008218:	f7fa f914 	bl	8002444 <mcu_key_get>
+
+    if(!is_valid) {
+ 800821c:	f89d 300b 	ldrb.w	r3, [sp, #11]
+ 8008220:	b953      	cbnz	r3, 8008238 <se2_encrypt_secret+0x3c>
+        if(!check_value) {
+ 8008222:	f1b8 0f00 	cmp.w	r8, #0
+ 8008226:	d105      	bne.n	8008234 <se2_encrypt_secret+0x38>
+            // problem: we are not writing the check value but it would be changed.
+            // ie: change long secret before real secret--unlikely
+            return true;
+ 8008228:	2501      	movs	r5, #1
+        ctx.num_pending = 32;
+        aes_done(&ctx, check_value, 32, aes_key, nonce);
+    }
+
+    return false;
+}
+ 800822a:	4628      	mov	r0, r5
+ 800822c:	f50d 7d10 	add.w	sp, sp, #576	; 0x240
+ 8008230:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+        cur = mcu_key_pick();     
+ 8008234:	f7fa f96e 	bl	8002514 <mcu_key_pick>
+    if(se2_calc_seed_key(aes_key, cur, pin_digest)) return true;
+ 8008238:	4601      	mov	r1, r0
+ 800823a:	9a99      	ldr	r2, [sp, #612]	; 0x264
+ 800823c:	a807      	add	r0, sp, #28
+ 800823e:	f7ff fd3f 	bl	8007cc0 <se2_calc_seed_key>
+ 8008242:	4605      	mov	r5, r0
+ 8008244:	2800      	cmp	r0, #0
+ 8008246:	d1ef      	bne.n	8008228 <se2_encrypt_secret+0x2c>
+    memcpy(nonce, rom_secrets->mcu_hmac_key, sizeof(nonce)-1);
+ 8008248:	4b16      	ldr	r3, [pc, #88]	; (80082a4 <se2_encrypt_secret+0xa8>)
+ 800824a:	cb0f      	ldmia	r3, {r0, r1, r2, r3}
+ 800824c:	ae03      	add	r6, sp, #12
+ 800824e:	46b4      	mov	ip, r6
+ 8008250:	e8ac 0007 	stmia.w	ip!, {r0, r1, r2}
+    nonce[15] = offset / AES_BLOCK_SIZE;
+ 8008254:	2c00      	cmp	r4, #0
+    memcpy(nonce, rom_secrets->mcu_hmac_key, sizeof(nonce)-1);
+ 8008256:	f82c 3b02 	strh.w	r3, [ip], #2
+    nonce[15] = offset / AES_BLOCK_SIZE;
+ 800825a:	bfb8      	it	lt
+ 800825c:	340f      	addlt	r4, #15
+    memcpy(nonce, rom_secrets->mcu_hmac_key, sizeof(nonce)-1);
+ 800825e:	0c1b      	lsrs	r3, r3, #16
+ 8008260:	f88c 3000 	strb.w	r3, [ip]
+    aes_init(&ctx);
+ 8008264:	a80f      	add	r0, sp, #60	; 0x3c
+    nonce[15] = offset / AES_BLOCK_SIZE;
+ 8008266:	1124      	asrs	r4, r4, #4
+ 8008268:	73f4      	strb	r4, [r6, #15]
+    aes_init(&ctx);
+ 800826a:	f000 f92b 	bl	80084c4 <aes_init>
+    aes_add(&ctx, secret, secret_len);
+ 800826e:	463a      	mov	r2, r7
+ 8008270:	4651      	mov	r1, sl
+ 8008272:	a80f      	add	r0, sp, #60	; 0x3c
+ 8008274:	f000 f92c 	bl	80084d0 <aes_add>
+    aes_done(&ctx, main_slot, secret_len, aes_key, nonce);
+ 8008278:	9600      	str	r6, [sp, #0]
+ 800827a:	ab07      	add	r3, sp, #28
+ 800827c:	463a      	mov	r2, r7
+ 800827e:	4649      	mov	r1, r9
+ 8008280:	a80f      	add	r0, sp, #60	; 0x3c
+ 8008282:	f000 f93b 	bl	80084fc <aes_done>
+    if(check_value) {
+ 8008286:	f1b8 0f00 	cmp.w	r8, #0
+ 800828a:	d0ce      	beq.n	800822a <se2_encrypt_secret+0x2e>
+        aes_init(&ctx);
+ 800828c:	a80f      	add	r0, sp, #60	; 0x3c
+ 800828e:	f000 f919 	bl	80084c4 <aes_init>
+        ctx.num_pending = 32;
+ 8008292:	2220      	movs	r2, #32
+        aes_done(&ctx, check_value, 32, aes_key, nonce);
+ 8008294:	9600      	str	r6, [sp, #0]
+ 8008296:	ab07      	add	r3, sp, #28
+ 8008298:	4641      	mov	r1, r8
+ 800829a:	a80f      	add	r0, sp, #60	; 0x3c
+        ctx.num_pending = 32;
+ 800829c:	928f      	str	r2, [sp, #572]	; 0x23c
+        aes_done(&ctx, check_value, 32, aes_key, nonce);
+ 800829e:	f000 f92d 	bl	80084fc <aes_done>
+ 80082a2:	e7c2      	b.n	800822a <se2_encrypt_secret+0x2e>
+ 80082a4:	0801c090 	.word	0x0801c090
+
+080082a8 <se2_decrypt_secret>:
+//
+    void
+se2_decrypt_secret(uint8_t secret[], int secret_len, int offset,
+        const uint8_t main_slot[], const uint8_t *check_value,
+        const uint8_t pin_digest[32], bool *is_valid)
+{
+ 80082a8:	b530      	push	{r4, r5, lr}
+ 80082aa:	f5ad 7d1f 	sub.w	sp, sp, #636	; 0x27c
+ 80082ae:	e9cd 2306 	strd	r2, r3, [sp, #24]
+ 80082b2:	9005      	str	r0, [sp, #20]
+ 80082b4:	9103      	str	r1, [sp, #12]
+    se2_setup();
+ 80082b6:	f7ff fd35 	bl	8007d24 <se2_setup>
+
+    const mcu_key_t *cur = mcu_key_get(is_valid);
+ 80082ba:	98a4      	ldr	r0, [sp, #656]	; 0x290
+ 80082bc:	f7fa f8c2 	bl	8002444 <mcu_key_get>
+    if(!*is_valid) {
+ 80082c0:	9ba4      	ldr	r3, [sp, #656]	; 0x290
+    const mcu_key_t *cur = mcu_key_get(is_valid);
+ 80082c2:	9004      	str	r0, [sp, #16]
+    if(!*is_valid) {
+ 80082c4:	781b      	ldrb	r3, [r3, #0]
+ 80082c6:	b133      	cbz	r3, 80082d6 <se2_decrypt_secret+0x2e>
+        // no key set? won't be able to decrypt.
+        return;
+    }
+
+    int line_num;
+    if((line_num = setjmp(error_env))) {
+ 80082c8:	4825      	ldr	r0, [pc, #148]	; (8008360 <se2_decrypt_secret+0xb8>)
+ 80082ca:	f005 fa0d 	bl	800d6e8 <setjmp>
+ 80082ce:	b128      	cbz	r0, 80082dc <se2_decrypt_secret+0x34>
+        // internal failures / broken i2c buses will come here
+        *is_valid = false;
+ 80082d0:	9aa4      	ldr	r2, [sp, #656]	; 0x290
+ 80082d2:	2300      	movs	r3, #0
+ 80082d4:	7013      	strb	r3, [r2, #0]
+
+    // decrypt the real data
+    aes_init(&ctx);
+    aes_add(&ctx, main_slot, secret_len);
+    aes_done(&ctx, secret, secret_len, aes_key, nonce);
+}
+ 80082d6:	f50d 7d1f 	add.w	sp, sp, #636	; 0x27c
+ 80082da:	bd30      	pop	{r4, r5, pc}
+    if(se2_calc_seed_key(aes_key, cur, pin_digest)) {
+ 80082dc:	9aa3      	ldr	r2, [sp, #652]	; 0x28c
+ 80082de:	9904      	ldr	r1, [sp, #16]
+ 80082e0:	a80d      	add	r0, sp, #52	; 0x34
+ 80082e2:	f7ff fced 	bl	8007cc0 <se2_calc_seed_key>
+ 80082e6:	2800      	cmp	r0, #0
+ 80082e8:	d1f2      	bne.n	80082d0 <se2_decrypt_secret+0x28>
+    memcpy(nonce, rom_secrets->mcu_hmac_key, sizeof(nonce)-1);
+ 80082ea:	4b1e      	ldr	r3, [pc, #120]	; (8008364 <se2_decrypt_secret+0xbc>)
+ 80082ec:	cb0f      	ldmia	r3, {r0, r1, r2, r3}
+ 80082ee:	ad09      	add	r5, sp, #36	; 0x24
+ 80082f0:	462c      	mov	r4, r5
+ 80082f2:	c407      	stmia	r4!, {r0, r1, r2}
+ 80082f4:	f824 3b02 	strh.w	r3, [r4], #2
+ 80082f8:	0c1b      	lsrs	r3, r3, #16
+ 80082fa:	7023      	strb	r3, [r4, #0]
+    nonce[15] = offset / AES_BLOCK_SIZE;
+ 80082fc:	9b06      	ldr	r3, [sp, #24]
+ 80082fe:	2b00      	cmp	r3, #0
+ 8008300:	bfb8      	it	lt
+ 8008302:	330f      	addlt	r3, #15
+ 8008304:	111b      	asrs	r3, r3, #4
+ 8008306:	73eb      	strb	r3, [r5, #15]
+    if(check_value) {
+ 8008308:	9ba2      	ldr	r3, [sp, #648]	; 0x288
+ 800830a:	b1bb      	cbz	r3, 800833c <se2_decrypt_secret+0x94>
+        aes_init(&ctx);
+ 800830c:	a81d      	add	r0, sp, #116	; 0x74
+ 800830e:	f000 f8d9 	bl	80084c4 <aes_init>
+        aes_add(&ctx, check_value, 32);
+ 8008312:	99a2      	ldr	r1, [sp, #648]	; 0x288
+ 8008314:	2220      	movs	r2, #32
+ 8008316:	a81d      	add	r0, sp, #116	; 0x74
+ 8008318:	f000 f8da 	bl	80084d0 <aes_add>
+        aes_done(&ctx, got, 32, aes_key, nonce);
+ 800831c:	ab09      	add	r3, sp, #36	; 0x24
+ 800831e:	9300      	str	r3, [sp, #0]
+ 8008320:	a915      	add	r1, sp, #84	; 0x54
+ 8008322:	a81d      	add	r0, sp, #116	; 0x74
+ 8008324:	ab0d      	add	r3, sp, #52	; 0x34
+ 8008326:	2220      	movs	r2, #32
+ 8008328:	f000 f8e8 	bl	80084fc <aes_done>
+        if(!check_all_zeros(got, 32)) {
+ 800832c:	2120      	movs	r1, #32
+ 800832e:	a815      	add	r0, sp, #84	; 0x54
+ 8008330:	f7fa f9c6 	bl	80026c0 <check_all_zeros>
+ 8008334:	b910      	cbnz	r0, 800833c <se2_decrypt_secret+0x94>
+            *is_valid = false;
+ 8008336:	9ba4      	ldr	r3, [sp, #656]	; 0x290
+ 8008338:	7018      	strb	r0, [r3, #0]
+            return;
+ 800833a:	e7cc      	b.n	80082d6 <se2_decrypt_secret+0x2e>
+    aes_init(&ctx);
+ 800833c:	a81d      	add	r0, sp, #116	; 0x74
+ 800833e:	f000 f8c1 	bl	80084c4 <aes_init>
+    aes_add(&ctx, main_slot, secret_len);
+ 8008342:	9a03      	ldr	r2, [sp, #12]
+ 8008344:	9907      	ldr	r1, [sp, #28]
+ 8008346:	a81d      	add	r0, sp, #116	; 0x74
+ 8008348:	f000 f8c2 	bl	80084d0 <aes_add>
+    aes_done(&ctx, secret, secret_len, aes_key, nonce);
+ 800834c:	ab09      	add	r3, sp, #36	; 0x24
+ 800834e:	9300      	str	r3, [sp, #0]
+ 8008350:	9a03      	ldr	r2, [sp, #12]
+ 8008352:	9905      	ldr	r1, [sp, #20]
+ 8008354:	ab0d      	add	r3, sp, #52	; 0x34
+ 8008356:	a81d      	add	r0, sp, #116	; 0x74
+ 8008358:	f000 f8d0 	bl	80084fc <aes_done>
+ 800835c:	e7bb      	b.n	80082d6 <se2_decrypt_secret+0x2e>
+ 800835e:	bf00      	nop
+ 8008360:	2009e390 	.word	0x2009e390
+ 8008364:	0801c090 	.word	0x0801c090
+
+08008368 <se2_pin_hash>:
+//
+// Hash up a PIN code for login attempt: to tie it into SE2's contents.
+//
+    void
+se2_pin_hash(uint8_t digest_io[32], uint32_t purpose)
+{
+ 8008368:	b5f0      	push	{r4, r5, r6, r7, lr}
+    if(purpose != PIN_PURPOSE_NORMAL) {
+ 800836a:	4b41      	ldr	r3, [pc, #260]	; (8008470 <se2_pin_hash+0x108>)
+{
+ 800836c:	b0d5      	sub	sp, #340	; 0x154
+    if(purpose != PIN_PURPOSE_NORMAL) {
+ 800836e:	4299      	cmp	r1, r3
+{
+ 8008370:	e9cd 0100 	strd	r0, r1, [sp]
+    if(purpose != PIN_PURPOSE_NORMAL) {
+ 8008374:	d17a      	bne.n	800846c <se2_pin_hash+0x104>
+        // do nothing except for real PIN case (ie. not for prefix words)
+        return;
+    }
+
+    se2_setup();
+ 8008376:	f7ff fcd5 	bl	8007d24 <se2_setup>
+    if((setjmp(error_env))) {
+ 800837a:	483e      	ldr	r0, [pc, #248]	; (8008474 <se2_pin_hash+0x10c>)
+ 800837c:	f005 f9b4 	bl	800d6e8 <setjmp>
+ 8008380:	4604      	mov	r4, r0
+ 8008382:	b120      	cbz	r0, 800838e <se2_pin_hash+0x26>
+        oled_show(screen_se2_issue);
+ 8008384:	483c      	ldr	r0, [pc, #240]	; (8008478 <se2_pin_hash+0x110>)
+ 8008386:	f7f8 fd6b 	bl	8000e60 <oled_show>
+
+        LOCKUP_FOREVER();
+ 800838a:	bf30      	wfi
+ 800838c:	e7fd      	b.n	800838a <se2_pin_hash+0x22>
+    uint8_t     rx[34];     // 2 bytes of len+status, then 32 bytes of data
+    uint8_t     tmp[32];
+    HMAC_CTX    ctx;
+
+    // HMAC(key=tpin_key, msg=given hash so far)
+    hmac_sha256_init(&ctx);
+ 800838e:	a813      	add	r0, sp, #76	; 0x4c
+ 8008390:	f7fd f936 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, digest_io, 32);
+ 8008394:	9900      	ldr	r1, [sp, #0]
+ 8008396:	2220      	movs	r2, #32
+ 8008398:	a813      	add	r0, sp, #76	; 0x4c
+ 800839a:	f7fd f937 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, (uint8_t *)&purpose, 4);
+ 800839e:	2204      	movs	r2, #4
+ 80083a0:	eb0d 0102 	add.w	r1, sp, r2
+ 80083a4:	a813      	add	r0, sp, #76	; 0x4c
+ 80083a6:	f7fd f931 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_final(&ctx, SE2_SECRETS->tpin_key, tmp);
+ 80083aa:	4b34      	ldr	r3, [pc, #208]	; (800847c <se2_pin_hash+0x114>)
+ 80083ac:	4934      	ldr	r1, [pc, #208]	; (8008480 <se2_pin_hash+0x118>)
+ 80083ae:	f893 20b0 	ldrb.w	r2, [r3, #176]	; 0xb0
+ 80083b2:	33b0      	adds	r3, #176	; 0xb0
+ 80083b4:	2aff      	cmp	r2, #255	; 0xff
+ 80083b6:	bf18      	it	ne
+ 80083b8:	4619      	movne	r1, r3
+ 80083ba:	3180      	adds	r1, #128	; 0x80
+ 80083bc:	aa02      	add	r2, sp, #8
+ 80083be:	a813      	add	r0, sp, #76	; 0x4c
+ 80083c0:	f7fd f93a 	bl	8005638 <hmac_sha256_final>
+
+    // NOTE: exposed as cleartext here
+    se2_write_buffer(tmp, 32);
+ 80083c4:	2120      	movs	r1, #32
+ 80083c6:	a802      	add	r0, sp, #8
+ 80083c8:	f7fe ffc2 	bl	8007350 <se2_write_buffer>
+ 80083cc:	25aa      	movs	r5, #170	; 0xaa
+            se2_write_buffer(rx+2, 32);
+        }
+
+        // HMAC(key=secret-B, msg=consts+easy_key+buffer+consts)
+        // - result put in secret-S (ram)
+        CALL_CHECK(se2_write2(0x3c, (2<<6) | (1<<4) | PGN_SE2_EASY_KEY, 0));
+ 80083ce:	269e      	movs	r6, #158	; 0x9e
+ 80083d0:	273c      	movs	r7, #60	; 0x3c
+ 80083d2:	4622      	mov	r2, r4
+ 80083d4:	4631      	mov	r1, r6
+ 80083d6:	4638      	mov	r0, r7
+ 80083d8:	f7fe ff66 	bl	80072a8 <se2_write2>
+ 80083dc:	b150      	cbz	r0, 80083f4 <se2_pin_hash+0x8c>
+ 80083de:	f240 511d 	movw	r1, #1309	; 0x51d
+        CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 80083e2:	4824      	ldr	r0, [pc, #144]	; (8008474 <se2_pin_hash+0x10c>)
+ 80083e4:	f005 f986 	bl	800d6f4 <longjmp>
+            se2_write_buffer(rx+2, 32);
+ 80083e8:	2120      	movs	r1, #32
+ 80083ea:	f10d 002a 	add.w	r0, sp, #42	; 0x2a
+ 80083ee:	f7fe ffaf 	bl	8007350 <se2_write_buffer>
+ 80083f2:	e7ee      	b.n	80083d2 <se2_pin_hash+0x6a>
+        CHECK_RIGHT(se2_read1() == RC_SUCCESS);
+ 80083f4:	f7fe ffe4 	bl	80073c0 <se2_read1>
+ 80083f8:	28aa      	cmp	r0, #170	; 0xaa
+ 80083fa:	d002      	beq.n	8008402 <se2_pin_hash+0x9a>
+ 80083fc:	f240 511e 	movw	r1, #1310	; 0x51e
+ 8008400:	e7ef      	b.n	80083e2 <se2_pin_hash+0x7a>
+
+        // HMAC(key=S, msg=counter+junk), so we have something to read out
+        // - not 100% clear what contents of 'buffer' are here, but seems
+        //   to be deterministic and unchanged from prev command
+        CALL_CHECK(se2_write1(0xa5, (2<<5) | PGN_DEC_COUNTER));
+ 8008402:	215b      	movs	r1, #91	; 0x5b
+ 8008404:	20a5      	movs	r0, #165	; 0xa5
+ 8008406:	f7fe ff35 	bl	8007274 <se2_write1>
+ 800840a:	b110      	cbz	r0, 8008412 <se2_pin_hash+0xaa>
+ 800840c:	f240 5123 	movw	r1, #1315	; 0x523
+ 8008410:	e7e7      	b.n	80083e2 <se2_pin_hash+0x7a>
+
+        CHECK_RIGHT(se2_read_n(sizeof(rx), rx) == RC_SUCCESS);
+ 8008412:	a90a      	add	r1, sp, #40	; 0x28
+ 8008414:	2022      	movs	r0, #34	; 0x22
+ 8008416:	f7fe ffab 	bl	8007370 <se2_read_n>
+ 800841a:	28aa      	cmp	r0, #170	; 0xaa
+ 800841c:	d002      	beq.n	8008424 <se2_pin_hash+0xbc>
+ 800841e:	f240 5125 	movw	r1, #1317	; 0x525
+ 8008422:	e7de      	b.n	80083e2 <se2_pin_hash+0x7a>
+        CHECK_RIGHT(rx[1] == RC_SUCCESS);
+ 8008424:	f89d 3029 	ldrb.w	r3, [sp, #41]	; 0x29
+ 8008428:	2baa      	cmp	r3, #170	; 0xaa
+ 800842a:	d002      	beq.n	8008432 <se2_pin_hash+0xca>
+ 800842c:	f240 5126 	movw	r1, #1318	; 0x526
+ 8008430:	e7d7      	b.n	80083e2 <se2_pin_hash+0x7a>
+    for(int i=0; i<SE2_STRETCH_ITER; i++) {
+ 8008432:	3d01      	subs	r5, #1
+ 8008434:	d1d8      	bne.n	80083e8 <se2_pin_hash+0x80>
+    }
+
+    // one final HMAC because we had to read cleartext from bus
+    hmac_sha256_init(&ctx);
+ 8008436:	a813      	add	r0, sp, #76	; 0x4c
+ 8008438:	f7fd f8e2 	bl	8005600 <hmac_sha256_init>
+    hmac_sha256_update(&ctx, rx+2, 32);
+ 800843c:	2220      	movs	r2, #32
+ 800843e:	f10d 012a 	add.w	r1, sp, #42	; 0x2a
+ 8008442:	a813      	add	r0, sp, #76	; 0x4c
+ 8008444:	f7fd f8e2 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_update(&ctx, digest_io, 32);
+ 8008448:	9900      	ldr	r1, [sp, #0]
+ 800844a:	2220      	movs	r2, #32
+ 800844c:	a813      	add	r0, sp, #76	; 0x4c
+ 800844e:	f7fd f8dd 	bl	800560c <hmac_sha256_update>
+    hmac_sha256_final(&ctx, SE2_SECRETS->tpin_key, digest_io);
+ 8008452:	4b0a      	ldr	r3, [pc, #40]	; (800847c <se2_pin_hash+0x114>)
+ 8008454:	490a      	ldr	r1, [pc, #40]	; (8008480 <se2_pin_hash+0x118>)
+ 8008456:	f893 20b0 	ldrb.w	r2, [r3, #176]	; 0xb0
+ 800845a:	33b0      	adds	r3, #176	; 0xb0
+ 800845c:	2aff      	cmp	r2, #255	; 0xff
+ 800845e:	bf18      	it	ne
+ 8008460:	4619      	movne	r1, r3
+ 8008462:	3180      	adds	r1, #128	; 0x80
+ 8008464:	9a00      	ldr	r2, [sp, #0]
+ 8008466:	a813      	add	r0, sp, #76	; 0x4c
+ 8008468:	f7fd f8e6 	bl	8005638 <hmac_sha256_final>
+}
+ 800846c:	b055      	add	sp, #340	; 0x154
+ 800846e:	bdf0      	pop	{r4, r5, r6, r7, pc}
+ 8008470:	334d1858 	.word	0x334d1858
+ 8008474:	2009e390 	.word	0x2009e390
+ 8008478:	0800e054 	.word	0x0800e054
+ 800847c:	0801c000 	.word	0x0801c000
+ 8008480:	2009e2b0 	.word	0x2009e2b0
+
+08008484 <se2_read_rng>:
+//
+// Read some random bytes, which we know cannot be MitM'ed.
+//
+    void
+se2_read_rng(uint8_t value[8])
+{
+ 8008484:	b500      	push	{lr}
+ 8008486:	b08b      	sub	sp, #44	; 0x2c
+ 8008488:	9001      	str	r0, [sp, #4]
+    // funny business means MitM here
+    se2_setup();
+ 800848a:	f7ff fc4b 	bl	8007d24 <se2_setup>
+    if(setjmp(error_env)) fatal_mitm();
+ 800848e:	4809      	ldr	r0, [pc, #36]	; (80084b4 <se2_read_rng+0x30>)
+ 8008490:	f005 f92a 	bl	800d6e8 <setjmp>
+ 8008494:	b108      	cbz	r0, 800849a <se2_read_rng+0x16>
+ 8008496:	f7f8 fae1 	bl	8000a5c <fatal_mitm>
+
+    // read a field with "RPS" bytes, and verify those were read true
+    uint8_t tmp[32];
+    se2_read_page(PGN_ROM_OPTIONS, tmp, true);
+ 800849a:	a902      	add	r1, sp, #8
+ 800849c:	2201      	movs	r2, #1
+ 800849e:	201c      	movs	r0, #28
+ 80084a0:	f7ff f82a 	bl	80074f8 <se2_read_page>
+
+    memcpy(value, &tmp[4], 8);
+ 80084a4:	ab03      	add	r3, sp, #12
+ 80084a6:	cb03      	ldmia	r3!, {r0, r1}
+ 80084a8:	9b01      	ldr	r3, [sp, #4]
+ 80084aa:	6018      	str	r0, [r3, #0]
+ 80084ac:	6059      	str	r1, [r3, #4]
+}
+ 80084ae:	b00b      	add	sp, #44	; 0x2c
+ 80084b0:	f85d fb04 	ldr.w	pc, [sp], #4
+ 80084b4:	2009e390 	.word	0x2009e390
+
+080084b8 <word_pump_bytes>:
+    uint32_t rv;
+
+    if(((uint32_t)src) & 0x3) {
+        memcpy(&rv, *src, 4);
+    } else {
+        rv = *(uint32_t *)(*src);
+ 80084b8:	6803      	ldr	r3, [r0, #0]
+ 80084ba:	f853 2b04 	ldr.w	r2, [r3], #4
+    }
+    (*src) += 4;
+ 80084be:	6003      	str	r3, [r0, #0]
+
+    return __REV(rv);
+}
+ 80084c0:	ba10      	rev	r0, r2
+ 80084c2:	4770      	bx	lr
+
+080084c4 <aes_init>:
+    memset(ctx, 0, sizeof(AES_CTX));
+ 80084c4:	f44f 7201 	mov.w	r2, #516	; 0x204
+ 80084c8:	2100      	movs	r1, #0
+ 80084ca:	f005 b905 	b.w	800d6d8 <memset>
+	...
+
+080084d0 <aes_add>:
+{
+ 80084d0:	b538      	push	{r3, r4, r5, lr}
+ 80084d2:	4605      	mov	r5, r0
+    memcpy(ctx->pending+ctx->num_pending, data_in, len);
+ 80084d4:	f8d0 0200 	ldr.w	r0, [r0, #512]	; 0x200
+ 80084d8:	4428      	add	r0, r5
+{
+ 80084da:	4614      	mov	r4, r2
+    memcpy(ctx->pending+ctx->num_pending, data_in, len);
+ 80084dc:	f005 f8d4 	bl	800d688 <memcpy>
+    ctx->num_pending += len;
+ 80084e0:	f8d5 2200 	ldr.w	r2, [r5, #512]	; 0x200
+ 80084e4:	4422      	add	r2, r4
+    ASSERT(ctx->num_pending < sizeof(ctx->pending));
+ 80084e6:	f5b2 7f00 	cmp.w	r2, #512	; 0x200
+    ctx->num_pending += len;
+ 80084ea:	f8c5 2200 	str.w	r2, [r5, #512]	; 0x200
+    ASSERT(ctx->num_pending < sizeof(ctx->pending));
+ 80084ee:	d302      	bcc.n	80084f6 <aes_add+0x26>
+ 80084f0:	4801      	ldr	r0, [pc, #4]	; (80084f8 <aes_add+0x28>)
+ 80084f2:	f7f8 faa9 	bl	8000a48 <fatal_error>
+}
+ 80084f6:	bd38      	pop	{r3, r4, r5, pc}
+ 80084f8:	0800e466 	.word	0x0800e466
+
+080084fc <aes_done>:
+//
+// Do the decryption.
+//
+    void
+aes_done(AES_CTX *ctx, uint8_t data_out[], uint32_t len, const uint8_t key[32], const uint8_t nonce[AES_BLOCK_SIZE])
+{
+ 80084fc:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+ 8008500:	4688      	mov	r8, r1
+ 8008502:	4611      	mov	r1, r2
+    ASSERT(len <= ctx->num_pending);
+ 8008504:	f8d0 2200 	ldr.w	r2, [r0, #512]	; 0x200
+{
+ 8008508:	b085      	sub	sp, #20
+    ASSERT(len <= ctx->num_pending);
+ 800850a:	428a      	cmp	r2, r1
+{
+ 800850c:	f8dd 9030 	ldr.w	r9, [sp, #48]	; 0x30
+ 8008510:	4606      	mov	r6, r0
+    ASSERT(len <= ctx->num_pending);
+ 8008512:	d202      	bcs.n	800851a <aes_done+0x1e>
+ 8008514:	4858      	ldr	r0, [pc, #352]	; (8008678 <aes_done+0x17c>)
+ 8008516:	f7f8 fa97 	bl	8000a48 <fatal_error>
+
+    // enable clock to block
+    __HAL_RCC_AES_CLK_ENABLE();
+ 800851a:	4d58      	ldr	r5, [pc, #352]	; (800867c <aes_done+0x180>)
+
+    // most changes have to be made w/ module disabled
+    AES->CR &= ~AES_CR_EN;
+ 800851c:	4c58      	ldr	r4, [pc, #352]	; (8008680 <aes_done+0x184>)
+    __HAL_RCC_AES_CLK_ENABLE();
+ 800851e:	6cea      	ldr	r2, [r5, #76]	; 0x4c
+ 8008520:	f442 3280 	orr.w	r2, r2, #65536	; 0x10000
+ 8008524:	64ea      	str	r2, [r5, #76]	; 0x4c
+ 8008526:	6cea      	ldr	r2, [r5, #76]	; 0x4c
+ 8008528:	f402 3280 	and.w	r2, r2, #65536	; 0x10000
+ 800852c:	9201      	str	r2, [sp, #4]
+ 800852e:	9a01      	ldr	r2, [sp, #4]
+    AES->CR &= ~AES_CR_EN;
+ 8008530:	6822      	ldr	r2, [r4, #0]
+ 8008532:	f022 0201 	bic.w	r2, r2, #1
+ 8008536:	6022      	str	r2, [r4, #0]
+
+    // set the key size and operation mode
+    MODIFY_REG(AES->CR, AES_CR_KEYSIZE, CRYP_KEYSIZE_256B);
+ 8008538:	6822      	ldr	r2, [r4, #0]
+ 800853a:	f442 2280 	orr.w	r2, r2, #262144	; 0x40000
+ 800853e:	6022      	str	r2, [r4, #0]
+    MODIFY_REG(AES->CR, AES_CR_DATATYPE|AES_CR_MODE|AES_CR_CHMOD, 
+ 8008540:	6827      	ldr	r7, [r4, #0]
+ 8008542:	f427 3780 	bic.w	r7, r7, #65536	; 0x10000
+ 8008546:	f027 077e 	bic.w	r7, r7, #126	; 0x7e
+ 800854a:	f047 0744 	orr.w	r7, r7, #68	; 0x44
+ 800854e:	6027      	str	r7, [r4, #0]
+            CRYP_DATATYPE_8B | CRYP_ALGOMODE_ENCRYPT | CRYP_CHAINMODE_AES_CTR);
+
+    // load key and IV values
+    const uint8_t *K = key;
+    AES->KEYR7 = word_pump_bytes(&K);
+ 8008550:	a802      	add	r0, sp, #8
+    const uint8_t *K = key;
+ 8008552:	9302      	str	r3, [sp, #8]
+    AES->KEYR7 = word_pump_bytes(&K);
+ 8008554:	f7ff ffb0 	bl	80084b8 <word_pump_bytes>
+ 8008558:	63e0      	str	r0, [r4, #60]	; 0x3c
+    AES->KEYR6 = word_pump_bytes(&K);
+ 800855a:	a802      	add	r0, sp, #8
+ 800855c:	f7ff ffac 	bl	80084b8 <word_pump_bytes>
+ 8008560:	63a0      	str	r0, [r4, #56]	; 0x38
+    AES->KEYR5 = word_pump_bytes(&K);
+ 8008562:	a802      	add	r0, sp, #8
+ 8008564:	f7ff ffa8 	bl	80084b8 <word_pump_bytes>
+ 8008568:	6360      	str	r0, [r4, #52]	; 0x34
+    AES->KEYR4 = word_pump_bytes(&K);
+ 800856a:	a802      	add	r0, sp, #8
+ 800856c:	f7ff ffa4 	bl	80084b8 <word_pump_bytes>
+ 8008570:	6320      	str	r0, [r4, #48]	; 0x30
+    AES->KEYR3 = word_pump_bytes(&K);
+ 8008572:	a802      	add	r0, sp, #8
+ 8008574:	f7ff ffa0 	bl	80084b8 <word_pump_bytes>
+ 8008578:	61e0      	str	r0, [r4, #28]
+    AES->KEYR2 = word_pump_bytes(&K);
+ 800857a:	a802      	add	r0, sp, #8
+ 800857c:	f7ff ff9c 	bl	80084b8 <word_pump_bytes>
+ 8008580:	61a0      	str	r0, [r4, #24]
+    AES->KEYR1 = word_pump_bytes(&K);
+ 8008582:	a802      	add	r0, sp, #8
+ 8008584:	f7ff ff98 	bl	80084b8 <word_pump_bytes>
+ 8008588:	6160      	str	r0, [r4, #20]
+    AES->KEYR0 = word_pump_bytes(&K);
+ 800858a:	a802      	add	r0, sp, #8
+ 800858c:	f7ff ff94 	bl	80084b8 <word_pump_bytes>
+ 8008590:	6120      	str	r0, [r4, #16]
+
+    if(nonce) {
+ 8008592:	f1b9 0f00 	cmp.w	r9, #0
+ 8008596:	d045      	beq.n	8008624 <aes_done+0x128>
+        const uint8_t *N = nonce;
+        AES->IVR3 = word_pump_bytes(&N);
+ 8008598:	a803      	add	r0, sp, #12
+        const uint8_t *N = nonce;
+ 800859a:	f8cd 900c 	str.w	r9, [sp, #12]
+        AES->IVR3 = word_pump_bytes(&N);
+ 800859e:	f7ff ff8b 	bl	80084b8 <word_pump_bytes>
+ 80085a2:	62e0      	str	r0, [r4, #44]	; 0x2c
+        AES->IVR2 = word_pump_bytes(&N);
+ 80085a4:	a803      	add	r0, sp, #12
+ 80085a6:	f7ff ff87 	bl	80084b8 <word_pump_bytes>
+ 80085aa:	62a0      	str	r0, [r4, #40]	; 0x28
+        AES->IVR1 = word_pump_bytes(&N);
+ 80085ac:	a803      	add	r0, sp, #12
+ 80085ae:	f7ff ff83 	bl	80084b8 <word_pump_bytes>
+ 80085b2:	6260      	str	r0, [r4, #36]	; 0x24
+        AES->IVR0 = word_pump_bytes(&N);
+ 80085b4:	a803      	add	r0, sp, #12
+ 80085b6:	f7ff ff7f 	bl	80084b8 <word_pump_bytes>
+ 80085ba:	6220      	str	r0, [r4, #32]
+        AES->IVR1 = 0;
+        AES->IVR0 = 0;          // maybe should be byte-swapped one, but whatever
+    }
+
+    // Enable the Peripheral
+    AES->CR |= AES_CR_EN;
+ 80085bc:	4b30      	ldr	r3, [pc, #192]	; (8008680 <aes_done+0x184>)
+ 80085be:	681a      	ldr	r2, [r3, #0]
+
+    ASSERT((((uint32_t)&ctx->pending) & 3) == 0);      // safe because of special attr
+ 80085c0:	07b0      	lsls	r0, r6, #30
+    AES->CR |= AES_CR_EN;
+ 80085c2:	f042 0201 	orr.w	r2, r2, #1
+ 80085c6:	601a      	str	r2, [r3, #0]
+    ASSERT((((uint32_t)&ctx->pending) & 3) == 0);      // safe because of special attr
+ 80085c8:	d1a4      	bne.n	8008514 <aes_done+0x18>
+
+    uint32_t    *p = (uint32_t *)ctx->pending;
+    for(int i=0; i < ctx->num_pending; i += 16) {
+ 80085ca:	f06f 070f 	mvn.w	r7, #15
+ 80085ce:	f8d6 0200 	ldr.w	r0, [r6, #512]	; 0x200
+ 80085d2:	f106 0410 	add.w	r4, r6, #16
+ 80085d6:	1bbf      	subs	r7, r7, r6
+ 80085d8:	193a      	adds	r2, r7, r4
+ 80085da:	4282      	cmp	r2, r0
+ 80085dc:	db2b      	blt.n	8008636 <aes_done+0x13a>
+        *out = AES->DOUTR; out++;
+        *out = AES->DOUTR; out++;
+        *out = AES->DOUTR;
+    }
+
+    memcpy(data_out, ctx->pending, len);
+ 80085de:	460a      	mov	r2, r1
+ 80085e0:	4640      	mov	r0, r8
+ 80085e2:	4631      	mov	r1, r6
+ 80085e4:	f005 f850 	bl	800d688 <memcpy>
+
+    memset(ctx, 0, sizeof(AES_CTX));
+ 80085e8:	f44f 7201 	mov.w	r2, #516	; 0x204
+ 80085ec:	2100      	movs	r1, #0
+ 80085ee:	4630      	mov	r0, r6
+ 80085f0:	f005 f872 	bl	800d6d8 <memset>
+
+    // reset state of chip block, and leave clock off as well
+    __HAL_RCC_AES_CLK_ENABLE();
+ 80085f4:	6ceb      	ldr	r3, [r5, #76]	; 0x4c
+ 80085f6:	f443 3380 	orr.w	r3, r3, #65536	; 0x10000
+ 80085fa:	64eb      	str	r3, [r5, #76]	; 0x4c
+ 80085fc:	6ceb      	ldr	r3, [r5, #76]	; 0x4c
+ 80085fe:	f403 3380 	and.w	r3, r3, #65536	; 0x10000
+ 8008602:	9303      	str	r3, [sp, #12]
+ 8008604:	9b03      	ldr	r3, [sp, #12]
+    __HAL_RCC_AES_FORCE_RESET();
+ 8008606:	6aeb      	ldr	r3, [r5, #44]	; 0x2c
+ 8008608:	f443 3380 	orr.w	r3, r3, #65536	; 0x10000
+ 800860c:	62eb      	str	r3, [r5, #44]	; 0x2c
+    __HAL_RCC_AES_RELEASE_RESET();
+ 800860e:	6aeb      	ldr	r3, [r5, #44]	; 0x2c
+ 8008610:	f423 3380 	bic.w	r3, r3, #65536	; 0x10000
+ 8008614:	62eb      	str	r3, [r5, #44]	; 0x2c
+    __HAL_RCC_AES_CLK_DISABLE();
+ 8008616:	6ceb      	ldr	r3, [r5, #76]	; 0x4c
+ 8008618:	f423 3380 	bic.w	r3, r3, #65536	; 0x10000
+ 800861c:	64eb      	str	r3, [r5, #76]	; 0x4c
+}
+ 800861e:	b005      	add	sp, #20
+ 8008620:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+        AES->IVR3 = 0;
+ 8008624:	f8c4 902c 	str.w	r9, [r4, #44]	; 0x2c
+        AES->IVR2 = 0;
+ 8008628:	f8c4 9028 	str.w	r9, [r4, #40]	; 0x28
+        AES->IVR1 = 0;
+ 800862c:	f8c4 9024 	str.w	r9, [r4, #36]	; 0x24
+        AES->IVR0 = 0;          // maybe should be byte-swapped one, but whatever
+ 8008630:	f8c4 9020 	str.w	r9, [r4, #32]
+ 8008634:	e7c2      	b.n	80085bc <aes_done+0xc0>
+        AES->DINR = *p; p++;
+ 8008636:	f854 2c10 	ldr.w	r2, [r4, #-16]
+ 800863a:	609a      	str	r2, [r3, #8]
+        AES->DINR = *p; p++;
+ 800863c:	f854 2c0c 	ldr.w	r2, [r4, #-12]
+ 8008640:	609a      	str	r2, [r3, #8]
+        AES->DINR = *p; p++;
+ 8008642:	f854 2c08 	ldr.w	r2, [r4, #-8]
+ 8008646:	609a      	str	r2, [r3, #8]
+        AES->DINR = *p; p++;
+ 8008648:	f854 2c04 	ldr.w	r2, [r4, #-4]
+ 800864c:	609a      	str	r2, [r3, #8]
+        while(HAL_IS_BIT_CLR(AES->SR, AES_SR_CCF)) {
+ 800864e:	685a      	ldr	r2, [r3, #4]
+ 8008650:	07d2      	lsls	r2, r2, #31
+ 8008652:	d5fc      	bpl.n	800864e <aes_done+0x152>
+        SET_BIT(AES->CR, CRYP_CCF_CLEAR);
+ 8008654:	681a      	ldr	r2, [r3, #0]
+ 8008656:	f042 0280 	orr.w	r2, r2, #128	; 0x80
+ 800865a:	601a      	str	r2, [r3, #0]
+        *out = AES->DOUTR; out++;
+ 800865c:	68da      	ldr	r2, [r3, #12]
+ 800865e:	f844 2c10 	str.w	r2, [r4, #-16]
+        *out = AES->DOUTR; out++;
+ 8008662:	68da      	ldr	r2, [r3, #12]
+ 8008664:	f844 2c0c 	str.w	r2, [r4, #-12]
+        *out = AES->DOUTR; out++;
+ 8008668:	68da      	ldr	r2, [r3, #12]
+ 800866a:	f844 2c08 	str.w	r2, [r4, #-8]
+        *out = AES->DOUTR;
+ 800866e:	68da      	ldr	r2, [r3, #12]
+ 8008670:	f844 2c04 	str.w	r2, [r4, #-4]
+    for(int i=0; i < ctx->num_pending; i += 16) {
+ 8008674:	3410      	adds	r4, #16
+ 8008676:	e7af      	b.n	80085d8 <aes_done+0xdc>
+ 8008678:	0800e466 	.word	0x0800e466
+ 800867c:	40021000 	.word	0x40021000
+ 8008680:	50060000 	.word	0x50060000
+
+08008684 <RCC_SetFlashLatencyFromMSIRange>:
+            voltage range.
+  * @param  msirange  MSI range value from RCC_MSIRANGE_0 to RCC_MSIRANGE_11
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef RCC_SetFlashLatencyFromMSIRange(uint32_t msirange)
+{
+ 8008684:	b537      	push	{r0, r1, r2, r4, r5, lr}
+  uint32_t vos;
+  uint32_t latency = FLASH_LATENCY_0;  /* default value 0WS */
+
+  if(__HAL_RCC_PWR_IS_CLK_ENABLED())
+ 8008686:	4d1c      	ldr	r5, [pc, #112]	; (80086f8 <RCC_SetFlashLatencyFromMSIRange+0x74>)
+ 8008688:	6dab      	ldr	r3, [r5, #88]	; 0x58
+ 800868a:	00da      	lsls	r2, r3, #3
+{
+ 800868c:	4604      	mov	r4, r0
+  if(__HAL_RCC_PWR_IS_CLK_ENABLED())
+ 800868e:	d518      	bpl.n	80086c2 <RCC_SetFlashLatencyFromMSIRange+0x3e>
+  {
+    vos = HAL_PWREx_GetVoltageRange();
+ 8008690:	f7fe fd62 	bl	8007158 <HAL_PWREx_GetVoltageRange>
+    __HAL_RCC_PWR_CLK_ENABLE();
+    vos = HAL_PWREx_GetVoltageRange();
+    __HAL_RCC_PWR_CLK_DISABLE();
+  }
+
+  if(vos == PWR_REGULATOR_VOLTAGE_SCALE1)
+ 8008694:	f5b0 7f00 	cmp.w	r0, #512	; 0x200
+ 8008698:	d123      	bne.n	80086e2 <RCC_SetFlashLatencyFromMSIRange+0x5e>
+  {
+    if(msirange > RCC_MSIRANGE_8)
+ 800869a:	2c80      	cmp	r4, #128	; 0x80
+ 800869c:	d928      	bls.n	80086f0 <RCC_SetFlashLatencyFromMSIRange+0x6c>
+        latency = FLASH_LATENCY_2; /* 2WS */
+      }
+      else
+      {
+        /* MSI 24Mhz or 32Mhz */
+        latency = FLASH_LATENCY_1; /* 1WS */
+ 800869e:	2ca0      	cmp	r4, #160	; 0xa0
+ 80086a0:	bf8c      	ite	hi
+ 80086a2:	2002      	movhi	r0, #2
+ 80086a4:	2001      	movls	r0, #1
+      /* else MSI < 8Mhz default FLASH_LATENCY_0 0WS */
+    }
+#endif
+  }
+
+  __HAL_FLASH_SET_LATENCY(latency);
+ 80086a6:	4a15      	ldr	r2, [pc, #84]	; (80086fc <RCC_SetFlashLatencyFromMSIRange+0x78>)
+ 80086a8:	6813      	ldr	r3, [r2, #0]
+ 80086aa:	f023 030f 	bic.w	r3, r3, #15
+ 80086ae:	4303      	orrs	r3, r0
+ 80086b0:	6013      	str	r3, [r2, #0]
+
+  /* Check that the new number of wait states is taken into account to access the Flash
+     memory by reading the FLASH_ACR register */
+  if(__HAL_FLASH_GET_LATENCY() != latency)
+ 80086b2:	6813      	ldr	r3, [r2, #0]
+ 80086b4:	f003 030f 	and.w	r3, r3, #15
+  {
+    return HAL_ERROR;
+  }
+
+  return HAL_OK;
+}
+ 80086b8:	1a18      	subs	r0, r3, r0
+ 80086ba:	bf18      	it	ne
+ 80086bc:	2001      	movne	r0, #1
+ 80086be:	b003      	add	sp, #12
+ 80086c0:	bd30      	pop	{r4, r5, pc}
+    __HAL_RCC_PWR_CLK_ENABLE();
+ 80086c2:	6dab      	ldr	r3, [r5, #88]	; 0x58
+ 80086c4:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+ 80086c8:	65ab      	str	r3, [r5, #88]	; 0x58
+ 80086ca:	6dab      	ldr	r3, [r5, #88]	; 0x58
+ 80086cc:	f003 5380 	and.w	r3, r3, #268435456	; 0x10000000
+ 80086d0:	9301      	str	r3, [sp, #4]
+ 80086d2:	9b01      	ldr	r3, [sp, #4]
+    vos = HAL_PWREx_GetVoltageRange();
+ 80086d4:	f7fe fd40 	bl	8007158 <HAL_PWREx_GetVoltageRange>
+    __HAL_RCC_PWR_CLK_DISABLE();
+ 80086d8:	6dab      	ldr	r3, [r5, #88]	; 0x58
+ 80086da:	f023 5380 	bic.w	r3, r3, #268435456	; 0x10000000
+ 80086de:	65ab      	str	r3, [r5, #88]	; 0x58
+ 80086e0:	e7d8      	b.n	8008694 <RCC_SetFlashLatencyFromMSIRange+0x10>
+    if(msirange >= RCC_MSIRANGE_8)
+ 80086e2:	2c7f      	cmp	r4, #127	; 0x7f
+ 80086e4:	d806      	bhi.n	80086f4 <RCC_SetFlashLatencyFromMSIRange+0x70>
+      if(msirange == RCC_MSIRANGE_7)
+ 80086e6:	f1a4 0370 	sub.w	r3, r4, #112	; 0x70
+ 80086ea:	4258      	negs	r0, r3
+ 80086ec:	4158      	adcs	r0, r3
+ 80086ee:	e7da      	b.n	80086a6 <RCC_SetFlashLatencyFromMSIRange+0x22>
+  uint32_t latency = FLASH_LATENCY_0;  /* default value 0WS */
+ 80086f0:	2000      	movs	r0, #0
+ 80086f2:	e7d8      	b.n	80086a6 <RCC_SetFlashLatencyFromMSIRange+0x22>
+        latency = FLASH_LATENCY_2; /* 2WS */
+ 80086f4:	2002      	movs	r0, #2
+ 80086f6:	e7d6      	b.n	80086a6 <RCC_SetFlashLatencyFromMSIRange+0x22>
+ 80086f8:	40021000 	.word	0x40021000
+ 80086fc:	40022000 	.word	0x40022000
+
+08008700 <HAL_RCC_DeInit>:
+{
+ 8008700:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+  SET_BIT(RCC->CR, RCC_CR_MSION);
+ 8008702:	4c32      	ldr	r4, [pc, #200]	; (80087cc <HAL_RCC_DeInit+0xcc>)
+ 8008704:	6823      	ldr	r3, [r4, #0]
+ 8008706:	f043 0301 	orr.w	r3, r3, #1
+ 800870a:	6023      	str	r3, [r4, #0]
+  tickstart = HAL_GetTick();
+ 800870c:	f7fe fd20 	bl	8007150 <HAL_GetTick>
+ 8008710:	4605      	mov	r5, r0
+  while(READ_BIT(RCC->CR, RCC_CR_MSIRDY) == 0U)
+ 8008712:	6823      	ldr	r3, [r4, #0]
+ 8008714:	079b      	lsls	r3, r3, #30
+ 8008716:	d543      	bpl.n	80087a0 <HAL_RCC_DeInit+0xa0>
+  MODIFY_REG(RCC->CR, RCC_CR_MSIRANGE, RCC_MSIRANGE_6);
+ 8008718:	6823      	ldr	r3, [r4, #0]
+  SystemCoreClock = MSI_VALUE;
+ 800871a:	4a2d      	ldr	r2, [pc, #180]	; (80087d0 <HAL_RCC_DeInit+0xd0>)
+  MODIFY_REG(RCC->CR, RCC_CR_MSIRANGE, RCC_MSIRANGE_6);
+ 800871c:	f023 03f0 	bic.w	r3, r3, #240	; 0xf0
+ 8008720:	f043 0360 	orr.w	r3, r3, #96	; 0x60
+ 8008724:	6023      	str	r3, [r4, #0]
+  CLEAR_REG(RCC->CFGR);
+ 8008726:	2300      	movs	r3, #0
+ 8008728:	60a3      	str	r3, [r4, #8]
+  SystemCoreClock = MSI_VALUE;
+ 800872a:	4b2a      	ldr	r3, [pc, #168]	; (80087d4 <HAL_RCC_DeInit+0xd4>)
+ 800872c:	601a      	str	r2, [r3, #0]
+  if(HAL_InitTick(uwTickPrio) != HAL_OK)
+ 800872e:	4b2a      	ldr	r3, [pc, #168]	; (80087d8 <HAL_RCC_DeInit+0xd8>)
+ 8008730:	6818      	ldr	r0, [r3, #0]
+ 8008732:	f7fe fd0f 	bl	8007154 <HAL_InitTick>
+ 8008736:	4605      	mov	r5, r0
+ 8008738:	2800      	cmp	r0, #0
+ 800873a:	d145      	bne.n	80087c8 <HAL_RCC_DeInit+0xc8>
+  tickstart = HAL_GetTick();
+ 800873c:	f7fe fd08 	bl	8007150 <HAL_GetTick>
+    if((HAL_GetTick() - tickstart) > CLOCKSWITCH_TIMEOUT_VALUE)
+ 8008740:	f241 3788 	movw	r7, #5000	; 0x1388
+  tickstart = HAL_GetTick();
+ 8008744:	4606      	mov	r6, r0
+  while(READ_BIT(RCC->CFGR, RCC_CFGR_SWS) != RCC_CFGR_SWS_MSI)
+ 8008746:	68a3      	ldr	r3, [r4, #8]
+ 8008748:	f013 0f0c 	tst.w	r3, #12
+ 800874c:	d130      	bne.n	80087b0 <HAL_RCC_DeInit+0xb0>
+  CLEAR_BIT(RCC->CR, RCC_CR_HSEON | RCC_CR_HSION | RCC_CR_HSIKERON| RCC_CR_HSIASFS | RCC_CR_PLLON | RCC_CR_PLLSAI1ON | RCC_CR_PLLSAI2ON);
+ 800874e:	6822      	ldr	r2, [r4, #0]
+ 8008750:	4b22      	ldr	r3, [pc, #136]	; (80087dc <HAL_RCC_DeInit+0xdc>)
+ 8008752:	4013      	ands	r3, r2
+ 8008754:	6023      	str	r3, [r4, #0]
+  tickstart = HAL_GetTick();
+ 8008756:	f7fe fcfb 	bl	8007150 <HAL_GetTick>
+ 800875a:	4606      	mov	r6, r0
+  while(READ_BIT(RCC->CR, RCC_CR_PLLRDY | RCC_CR_PLLSAI1RDY | RCC_CR_PLLSAI2RDY) != 0U)
+ 800875c:	6823      	ldr	r3, [r4, #0]
+ 800875e:	f013 5328 	ands.w	r3, r3, #704643072	; 0x2a000000
+ 8008762:	d12b      	bne.n	80087bc <HAL_RCC_DeInit+0xbc>
+  CLEAR_REG(RCC->PLLCFGR);
+ 8008764:	60e3      	str	r3, [r4, #12]
+  SET_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN_4 );
+ 8008766:	68e2      	ldr	r2, [r4, #12]
+ 8008768:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 800876c:	60e2      	str	r2, [r4, #12]
+  CLEAR_REG(RCC->PLLSAI1CFGR);
+ 800876e:	6123      	str	r3, [r4, #16]
+  SET_BIT(RCC->PLLSAI1CFGR,  RCC_PLLSAI1CFGR_PLLSAI1N_4 );
+ 8008770:	6922      	ldr	r2, [r4, #16]
+ 8008772:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 8008776:	6122      	str	r2, [r4, #16]
+  CLEAR_REG(RCC->PLLSAI2CFGR);
+ 8008778:	6163      	str	r3, [r4, #20]
+  SET_BIT(RCC->PLLSAI2CFGR,  RCC_PLLSAI2CFGR_PLLSAI2N_4 );
+ 800877a:	6962      	ldr	r2, [r4, #20]
+ 800877c:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+ 8008780:	6162      	str	r2, [r4, #20]
+  CLEAR_BIT(RCC->CR, RCC_CR_HSEBYP);
+ 8008782:	6822      	ldr	r2, [r4, #0]
+ 8008784:	f422 2280 	bic.w	r2, r2, #262144	; 0x40000
+ 8008788:	6022      	str	r2, [r4, #0]
+  CLEAR_REG(RCC->CIER);
+ 800878a:	61a3      	str	r3, [r4, #24]
+  WRITE_REG(RCC->CICR, 0xFFFFFFFFU);
+ 800878c:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 8008790:	6223      	str	r3, [r4, #32]
+  SET_BIT(RCC->CSR, RCC_CSR_RMVF);
+ 8008792:	f8d4 3094 	ldr.w	r3, [r4, #148]	; 0x94
+ 8008796:	f443 0300 	orr.w	r3, r3, #8388608	; 0x800000
+ 800879a:	f8c4 3094 	str.w	r3, [r4, #148]	; 0x94
+  return HAL_OK;
+ 800879e:	e005      	b.n	80087ac <HAL_RCC_DeInit+0xac>
+    if((HAL_GetTick() - tickstart) > MSI_TIMEOUT_VALUE)
+ 80087a0:	f7fe fcd6 	bl	8007150 <HAL_GetTick>
+ 80087a4:	1b40      	subs	r0, r0, r5
+ 80087a6:	2802      	cmp	r0, #2
+ 80087a8:	d9b3      	bls.n	8008712 <HAL_RCC_DeInit+0x12>
+      return HAL_TIMEOUT;
+ 80087aa:	2503      	movs	r5, #3
+}
+ 80087ac:	4628      	mov	r0, r5
+ 80087ae:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+    if((HAL_GetTick() - tickstart) > CLOCKSWITCH_TIMEOUT_VALUE)
+ 80087b0:	f7fe fcce 	bl	8007150 <HAL_GetTick>
+ 80087b4:	1b80      	subs	r0, r0, r6
+ 80087b6:	42b8      	cmp	r0, r7
+ 80087b8:	d9c5      	bls.n	8008746 <HAL_RCC_DeInit+0x46>
+ 80087ba:	e7f6      	b.n	80087aa <HAL_RCC_DeInit+0xaa>
+    if((HAL_GetTick() - tickstart) > PLL_TIMEOUT_VALUE)
+ 80087bc:	f7fe fcc8 	bl	8007150 <HAL_GetTick>
+ 80087c0:	1b80      	subs	r0, r0, r6
+ 80087c2:	2802      	cmp	r0, #2
+ 80087c4:	d9ca      	bls.n	800875c <HAL_RCC_DeInit+0x5c>
+ 80087c6:	e7f0      	b.n	80087aa <HAL_RCC_DeInit+0xaa>
+    return HAL_ERROR;
+ 80087c8:	2501      	movs	r5, #1
+ 80087ca:	e7ef      	b.n	80087ac <HAL_RCC_DeInit+0xac>
+ 80087cc:	40021000 	.word	0x40021000
+ 80087d0:	003d0900 	.word	0x003d0900
+ 80087d4:	2009e2a8 	.word	0x2009e2a8
+ 80087d8:	2009e2ac 	.word	0x2009e2ac
+ 80087dc:	eafef4ff 	.word	0xeafef4ff
+
+080087e0 <HAL_RCC_MCOConfig>:
+{
+ 80087e0:	b570      	push	{r4, r5, r6, lr}
+  __MCO1_CLK_ENABLE();
+ 80087e2:	4c12      	ldr	r4, [pc, #72]	; (800882c <HAL_RCC_MCOConfig+0x4c>)
+ 80087e4:	6ce3      	ldr	r3, [r4, #76]	; 0x4c
+ 80087e6:	f043 0301 	orr.w	r3, r3, #1
+ 80087ea:	64e3      	str	r3, [r4, #76]	; 0x4c
+ 80087ec:	6ce3      	ldr	r3, [r4, #76]	; 0x4c
+{
+ 80087ee:	b086      	sub	sp, #24
+  __MCO1_CLK_ENABLE();
+ 80087f0:	f003 0301 	and.w	r3, r3, #1
+ 80087f4:	9300      	str	r3, [sp, #0]
+ 80087f6:	9b00      	ldr	r3, [sp, #0]
+{
+ 80087f8:	4616      	mov	r6, r2
+  GPIO_InitStruct.Mode = GPIO_MODE_AF_PP;
+ 80087fa:	2302      	movs	r3, #2
+ 80087fc:	f44f 7280 	mov.w	r2, #256	; 0x100
+ 8008800:	e9cd 2301 	strd	r2, r3, [sp, #4]
+{
+ 8008804:	460d      	mov	r5, r1
+  GPIO_InitStruct.Speed = GPIO_SPEED_FREQ_HIGH;
+ 8008806:	9304      	str	r3, [sp, #16]
+  HAL_GPIO_Init(MCO1_GPIO_PORT, &GPIO_InitStruct);
+ 8008808:	a901      	add	r1, sp, #4
+  GPIO_InitStruct.Pull = GPIO_NOPULL;
+ 800880a:	2300      	movs	r3, #0
+  HAL_GPIO_Init(MCO1_GPIO_PORT, &GPIO_InitStruct);
+ 800880c:	f04f 4090 	mov.w	r0, #1207959552	; 0x48000000
+  GPIO_InitStruct.Pull = GPIO_NOPULL;
+ 8008810:	9303      	str	r3, [sp, #12]
+  GPIO_InitStruct.Alternate = GPIO_AF0_MCO;
+ 8008812:	9305      	str	r3, [sp, #20]
+  HAL_GPIO_Init(MCO1_GPIO_PORT, &GPIO_InitStruct);
+ 8008814:	f7f8 fc12 	bl	800103c <HAL_GPIO_Init>
+  MODIFY_REG(RCC->CFGR, (RCC_CFGR_MCOSEL | RCC_CFGR_MCOPRE), (RCC_MCOSource | RCC_MCODiv ));
+ 8008818:	68a3      	ldr	r3, [r4, #8]
+ 800881a:	f023 43fe 	bic.w	r3, r3, #2130706432	; 0x7f000000
+ 800881e:	ea43 0206 	orr.w	r2, r3, r6
+ 8008822:	432a      	orrs	r2, r5
+ 8008824:	60a2      	str	r2, [r4, #8]
+}
+ 8008826:	b006      	add	sp, #24
+ 8008828:	bd70      	pop	{r4, r5, r6, pc}
+ 800882a:	bf00      	nop
+ 800882c:	40021000 	.word	0x40021000
+
+08008830 <HAL_RCC_GetSysClockFreq>:
+  sysclk_source = __HAL_RCC_GET_SYSCLK_SOURCE();
+ 8008830:	4b22      	ldr	r3, [pc, #136]	; (80088bc <HAL_RCC_GetSysClockFreq+0x8c>)
+ 8008832:	689a      	ldr	r2, [r3, #8]
+  pll_oscsource = __HAL_RCC_GET_PLL_OSCSOURCE();
+ 8008834:	68d9      	ldr	r1, [r3, #12]
+  if((sysclk_source == RCC_CFGR_SWS_MSI) ||
+ 8008836:	f012 020c 	ands.w	r2, r2, #12
+ 800883a:	d005      	beq.n	8008848 <HAL_RCC_GetSysClockFreq+0x18>
+ 800883c:	2a0c      	cmp	r2, #12
+ 800883e:	d115      	bne.n	800886c <HAL_RCC_GetSysClockFreq+0x3c>
+  pll_oscsource = __HAL_RCC_GET_PLL_OSCSOURCE();
+ 8008840:	f001 0103 	and.w	r1, r1, #3
+     ((sysclk_source == RCC_CFGR_SWS_PLL) && (pll_oscsource == RCC_PLLSOURCE_MSI)))
+ 8008844:	2901      	cmp	r1, #1
+ 8008846:	d118      	bne.n	800887a <HAL_RCC_GetSysClockFreq+0x4a>
+    if(READ_BIT(RCC->CR, RCC_CR_MSIRGSEL) == 0U)
+ 8008848:	6819      	ldr	r1, [r3, #0]
+    msirange = MSIRangeTable[msirange];
+ 800884a:	481d      	ldr	r0, [pc, #116]	; (80088c0 <HAL_RCC_GetSysClockFreq+0x90>)
+    if(READ_BIT(RCC->CR, RCC_CR_MSIRGSEL) == 0U)
+ 800884c:	0709      	lsls	r1, r1, #28
+      msirange = READ_BIT(RCC->CSR, RCC_CSR_MSISRANGE) >> RCC_CSR_MSISRANGE_Pos;
+ 800884e:	bf55      	itete	pl
+ 8008850:	f8d3 1094 	ldrpl.w	r1, [r3, #148]	; 0x94
+      msirange = READ_BIT(RCC->CR, RCC_CR_MSIRANGE) >> RCC_CR_MSIRANGE_Pos;
+ 8008854:	6819      	ldrmi	r1, [r3, #0]
+      msirange = READ_BIT(RCC->CSR, RCC_CSR_MSISRANGE) >> RCC_CSR_MSISRANGE_Pos;
+ 8008856:	f3c1 2103 	ubfxpl	r1, r1, #8, #4
+      msirange = READ_BIT(RCC->CR, RCC_CR_MSIRANGE) >> RCC_CR_MSIRANGE_Pos;
+ 800885a:	f3c1 1103 	ubfxmi	r1, r1, #4, #4
+    msirange = MSIRangeTable[msirange];
+ 800885e:	f850 0021 	ldr.w	r0, [r0, r1, lsl #2]
+    if(sysclk_source == RCC_CFGR_SWS_MSI)
+ 8008862:	b34a      	cbz	r2, 80088b8 <HAL_RCC_GetSysClockFreq+0x88>
+  if(sysclk_source == RCC_CFGR_SWS_PLL)
+ 8008864:	2a0c      	cmp	r2, #12
+ 8008866:	d009      	beq.n	800887c <HAL_RCC_GetSysClockFreq+0x4c>
+ 8008868:	2000      	movs	r0, #0
+  return sysclockfreq;
+ 800886a:	4770      	bx	lr
+  else if(sysclk_source == RCC_CFGR_SWS_HSI)
+ 800886c:	2a04      	cmp	r2, #4
+ 800886e:	d022      	beq.n	80088b6 <HAL_RCC_GetSysClockFreq+0x86>
+  else if(sysclk_source == RCC_CFGR_SWS_HSE)
+ 8008870:	2a08      	cmp	r2, #8
+ 8008872:	4814      	ldr	r0, [pc, #80]	; (80088c4 <HAL_RCC_GetSysClockFreq+0x94>)
+ 8008874:	bf18      	it	ne
+ 8008876:	2000      	movne	r0, #0
+ 8008878:	4770      	bx	lr
+  uint32_t msirange = 0U, sysclockfreq = 0U;
+ 800887a:	2000      	movs	r0, #0
+    pllsource = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC);
+ 800887c:	68da      	ldr	r2, [r3, #12]
+ 800887e:	f002 0203 	and.w	r2, r2, #3
+    switch (pllsource)
+ 8008882:	2a02      	cmp	r2, #2
+ 8008884:	d015      	beq.n	80088b2 <HAL_RCC_GetSysClockFreq+0x82>
+ 8008886:	490f      	ldr	r1, [pc, #60]	; (80088c4 <HAL_RCC_GetSysClockFreq+0x94>)
+ 8008888:	2a03      	cmp	r2, #3
+ 800888a:	bf08      	it	eq
+ 800888c:	4608      	moveq	r0, r1
+    pllm = (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U ;
+ 800888e:	68d9      	ldr	r1, [r3, #12]
+    pllvco = (pllvco * (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos)) / pllm;
+ 8008890:	68da      	ldr	r2, [r3, #12]
+ 8008892:	f3c2 2206 	ubfx	r2, r2, #8, #7
+ 8008896:	4342      	muls	r2, r0
+    pllr = ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLR) >> RCC_PLLCFGR_PLLR_Pos) + 1U ) * 2U;
+ 8008898:	68d8      	ldr	r0, [r3, #12]
+ 800889a:	f3c0 6041 	ubfx	r0, r0, #25, #2
+    pllm = (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U ;
+ 800889e:	f3c1 1103 	ubfx	r1, r1, #4, #4
+    pllr = ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLR) >> RCC_PLLCFGR_PLLR_Pos) + 1U ) * 2U;
+ 80088a2:	3001      	adds	r0, #1
+    pllm = (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U ;
+ 80088a4:	3101      	adds	r1, #1
+    pllr = ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLR) >> RCC_PLLCFGR_PLLR_Pos) + 1U ) * 2U;
+ 80088a6:	0040      	lsls	r0, r0, #1
+    pllvco = (pllvco * (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos)) / pllm;
+ 80088a8:	fbb2 f2f1 	udiv	r2, r2, r1
+    sysclockfreq = pllvco / pllr;
+ 80088ac:	fbb2 f0f0 	udiv	r0, r2, r0
+ 80088b0:	4770      	bx	lr
+      pllvco = HSI_VALUE;
+ 80088b2:	4805      	ldr	r0, [pc, #20]	; (80088c8 <HAL_RCC_GetSysClockFreq+0x98>)
+ 80088b4:	e7eb      	b.n	800888e <HAL_RCC_GetSysClockFreq+0x5e>
+    sysclockfreq = HSI_VALUE;
+ 80088b6:	4804      	ldr	r0, [pc, #16]	; (80088c8 <HAL_RCC_GetSysClockFreq+0x98>)
+}
+ 80088b8:	4770      	bx	lr
+ 80088ba:	bf00      	nop
+ 80088bc:	40021000 	.word	0x40021000
+ 80088c0:	0800ea7c 	.word	0x0800ea7c
+ 80088c4:	007a1200 	.word	0x007a1200
+ 80088c8:	00f42400 	.word	0x00f42400
+
+080088cc <HAL_RCC_OscConfig>:
+{
+ 80088cc:	e92d 43f7 	stmdb	sp!, {r0, r1, r2, r4, r5, r6, r7, r8, r9, lr}
+  if(RCC_OscInitStruct == NULL)
+ 80088d0:	4605      	mov	r5, r0
+ 80088d2:	b908      	cbnz	r0, 80088d8 <HAL_RCC_OscConfig+0xc>
+          return HAL_ERROR;
+ 80088d4:	2001      	movs	r0, #1
+ 80088d6:	e047      	b.n	8008968 <HAL_RCC_OscConfig+0x9c>
+  sysclk_source = __HAL_RCC_GET_SYSCLK_SOURCE();
+ 80088d8:	4c94      	ldr	r4, [pc, #592]	; (8008b2c <HAL_RCC_OscConfig+0x260>)
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_MSI) == RCC_OSCILLATORTYPE_MSI)
+ 80088da:	6803      	ldr	r3, [r0, #0]
+  sysclk_source = __HAL_RCC_GET_SYSCLK_SOURCE();
+ 80088dc:	68a6      	ldr	r6, [r4, #8]
+  pll_config = __HAL_RCC_GET_PLL_OSCSOURCE();
+ 80088de:	68e7      	ldr	r7, [r4, #12]
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_MSI) == RCC_OSCILLATORTYPE_MSI)
+ 80088e0:	06db      	lsls	r3, r3, #27
+  sysclk_source = __HAL_RCC_GET_SYSCLK_SOURCE();
+ 80088e2:	f006 060c 	and.w	r6, r6, #12
+  pll_config = __HAL_RCC_GET_PLL_OSCSOURCE();
+ 80088e6:	f007 0703 	and.w	r7, r7, #3
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_MSI) == RCC_OSCILLATORTYPE_MSI)
+ 80088ea:	d575      	bpl.n	80089d8 <HAL_RCC_OscConfig+0x10c>
+    if((sysclk_source == RCC_CFGR_SWS_MSI) ||
+ 80088ec:	b11e      	cbz	r6, 80088f6 <HAL_RCC_OscConfig+0x2a>
+ 80088ee:	2e0c      	cmp	r6, #12
+ 80088f0:	d154      	bne.n	800899c <HAL_RCC_OscConfig+0xd0>
+       ((sysclk_source == RCC_CFGR_SWS_PLL) && (pll_config == RCC_PLLSOURCE_MSI)))
+ 80088f2:	2f01      	cmp	r7, #1
+ 80088f4:	d152      	bne.n	800899c <HAL_RCC_OscConfig+0xd0>
+      if((READ_BIT(RCC->CR, RCC_CR_MSIRDY) != 0U) && (RCC_OscInitStruct->MSIState == RCC_MSI_OFF))
+ 80088f6:	6823      	ldr	r3, [r4, #0]
+ 80088f8:	0798      	lsls	r0, r3, #30
+ 80088fa:	d502      	bpl.n	8008902 <HAL_RCC_OscConfig+0x36>
+ 80088fc:	69ab      	ldr	r3, [r5, #24]
+ 80088fe:	2b00      	cmp	r3, #0
+ 8008900:	d0e8      	beq.n	80088d4 <HAL_RCC_OscConfig+0x8>
+        if(RCC_OscInitStruct->MSIClockRange > __HAL_RCC_GET_MSI_RANGE())
+ 8008902:	6823      	ldr	r3, [r4, #0]
+ 8008904:	6a28      	ldr	r0, [r5, #32]
+ 8008906:	0719      	lsls	r1, r3, #28
+ 8008908:	bf56      	itet	pl
+ 800890a:	f8d4 3094 	ldrpl.w	r3, [r4, #148]	; 0x94
+ 800890e:	6823      	ldrmi	r3, [r4, #0]
+ 8008910:	091b      	lsrpl	r3, r3, #4
+ 8008912:	f003 03f0 	and.w	r3, r3, #240	; 0xf0
+ 8008916:	4298      	cmp	r0, r3
+ 8008918:	d929      	bls.n	800896e <HAL_RCC_OscConfig+0xa2>
+          if(RCC_SetFlashLatencyFromMSIRange(RCC_OscInitStruct->MSIClockRange) != HAL_OK)
+ 800891a:	f7ff feb3 	bl	8008684 <RCC_SetFlashLatencyFromMSIRange>
+ 800891e:	2800      	cmp	r0, #0
+ 8008920:	d1d8      	bne.n	80088d4 <HAL_RCC_OscConfig+0x8>
+          __HAL_RCC_MSI_RANGE_CONFIG(RCC_OscInitStruct->MSIClockRange);
+ 8008922:	6823      	ldr	r3, [r4, #0]
+ 8008924:	f043 0308 	orr.w	r3, r3, #8
+ 8008928:	6023      	str	r3, [r4, #0]
+ 800892a:	6823      	ldr	r3, [r4, #0]
+ 800892c:	6a2a      	ldr	r2, [r5, #32]
+ 800892e:	f023 03f0 	bic.w	r3, r3, #240	; 0xf0
+ 8008932:	4313      	orrs	r3, r2
+ 8008934:	6023      	str	r3, [r4, #0]
+          __HAL_RCC_MSI_CALIBRATIONVALUE_ADJUST(RCC_OscInitStruct->MSICalibrationValue);
+ 8008936:	6863      	ldr	r3, [r4, #4]
+ 8008938:	69ea      	ldr	r2, [r5, #28]
+ 800893a:	f423 437f 	bic.w	r3, r3, #65280	; 0xff00
+ 800893e:	ea43 2302 	orr.w	r3, r3, r2, lsl #8
+ 8008942:	6063      	str	r3, [r4, #4]
+        SystemCoreClock = HAL_RCC_GetSysClockFreq() >> (AHBPrescTable[READ_BIT(RCC->CFGR, RCC_CFGR_HPRE) >> RCC_CFGR_HPRE_Pos] & 0x1FU);
+ 8008944:	f7ff ff74 	bl	8008830 <HAL_RCC_GetSysClockFreq>
+ 8008948:	68a3      	ldr	r3, [r4, #8]
+ 800894a:	4a79      	ldr	r2, [pc, #484]	; (8008b30 <HAL_RCC_OscConfig+0x264>)
+ 800894c:	f3c3 1303 	ubfx	r3, r3, #4, #4
+ 8008950:	5cd3      	ldrb	r3, [r2, r3]
+ 8008952:	f003 031f 	and.w	r3, r3, #31
+ 8008956:	40d8      	lsrs	r0, r3
+ 8008958:	4b76      	ldr	r3, [pc, #472]	; (8008b34 <HAL_RCC_OscConfig+0x268>)
+ 800895a:	6018      	str	r0, [r3, #0]
+        status = HAL_InitTick(uwTickPrio);
+ 800895c:	4b76      	ldr	r3, [pc, #472]	; (8008b38 <HAL_RCC_OscConfig+0x26c>)
+ 800895e:	6818      	ldr	r0, [r3, #0]
+ 8008960:	f7fe fbf8 	bl	8007154 <HAL_InitTick>
+        if(status != HAL_OK)
+ 8008964:	2800      	cmp	r0, #0
+ 8008966:	d037      	beq.n	80089d8 <HAL_RCC_OscConfig+0x10c>
+}
+ 8008968:	b003      	add	sp, #12
+ 800896a:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+          __HAL_RCC_MSI_RANGE_CONFIG(RCC_OscInitStruct->MSIClockRange);
+ 800896e:	6823      	ldr	r3, [r4, #0]
+ 8008970:	f043 0308 	orr.w	r3, r3, #8
+ 8008974:	6023      	str	r3, [r4, #0]
+ 8008976:	6823      	ldr	r3, [r4, #0]
+ 8008978:	f023 03f0 	bic.w	r3, r3, #240	; 0xf0
+ 800897c:	4303      	orrs	r3, r0
+ 800897e:	6023      	str	r3, [r4, #0]
+          __HAL_RCC_MSI_CALIBRATIONVALUE_ADJUST(RCC_OscInitStruct->MSICalibrationValue);
+ 8008980:	6863      	ldr	r3, [r4, #4]
+ 8008982:	69ea      	ldr	r2, [r5, #28]
+ 8008984:	f423 437f 	bic.w	r3, r3, #65280	; 0xff00
+ 8008988:	ea43 2302 	orr.w	r3, r3, r2, lsl #8
+ 800898c:	6063      	str	r3, [r4, #4]
+          if(sysclk_source == RCC_CFGR_SWS_MSI)
+ 800898e:	2e00      	cmp	r6, #0
+ 8008990:	d1d8      	bne.n	8008944 <HAL_RCC_OscConfig+0x78>
+            if(RCC_SetFlashLatencyFromMSIRange(RCC_OscInitStruct->MSIClockRange) != HAL_OK)
+ 8008992:	f7ff fe77 	bl	8008684 <RCC_SetFlashLatencyFromMSIRange>
+ 8008996:	2800      	cmp	r0, #0
+ 8008998:	d0d4      	beq.n	8008944 <HAL_RCC_OscConfig+0x78>
+ 800899a:	e79b      	b.n	80088d4 <HAL_RCC_OscConfig+0x8>
+      if(RCC_OscInitStruct->MSIState != RCC_MSI_OFF)
+ 800899c:	69ab      	ldr	r3, [r5, #24]
+ 800899e:	2b00      	cmp	r3, #0
+ 80089a0:	d03a      	beq.n	8008a18 <HAL_RCC_OscConfig+0x14c>
+        __HAL_RCC_MSI_ENABLE();
+ 80089a2:	6823      	ldr	r3, [r4, #0]
+ 80089a4:	f043 0301 	orr.w	r3, r3, #1
+ 80089a8:	6023      	str	r3, [r4, #0]
+        tickstart = HAL_GetTick();
+ 80089aa:	f7fe fbd1 	bl	8007150 <HAL_GetTick>
+ 80089ae:	4680      	mov	r8, r0
+        while(READ_BIT(RCC->CR, RCC_CR_MSIRDY) == 0U)
+ 80089b0:	6823      	ldr	r3, [r4, #0]
+ 80089b2:	079a      	lsls	r2, r3, #30
+ 80089b4:	d528      	bpl.n	8008a08 <HAL_RCC_OscConfig+0x13c>
+        __HAL_RCC_MSI_RANGE_CONFIG(RCC_OscInitStruct->MSIClockRange);
+ 80089b6:	6823      	ldr	r3, [r4, #0]
+ 80089b8:	f043 0308 	orr.w	r3, r3, #8
+ 80089bc:	6023      	str	r3, [r4, #0]
+ 80089be:	6823      	ldr	r3, [r4, #0]
+ 80089c0:	6a2a      	ldr	r2, [r5, #32]
+ 80089c2:	f023 03f0 	bic.w	r3, r3, #240	; 0xf0
+ 80089c6:	4313      	orrs	r3, r2
+ 80089c8:	6023      	str	r3, [r4, #0]
+        __HAL_RCC_MSI_CALIBRATIONVALUE_ADJUST(RCC_OscInitStruct->MSICalibrationValue);
+ 80089ca:	6863      	ldr	r3, [r4, #4]
+ 80089cc:	69ea      	ldr	r2, [r5, #28]
+ 80089ce:	f423 437f 	bic.w	r3, r3, #65280	; 0xff00
+ 80089d2:	ea43 2302 	orr.w	r3, r3, r2, lsl #8
+ 80089d6:	6063      	str	r3, [r4, #4]
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_HSE) == RCC_OSCILLATORTYPE_HSE)
+ 80089d8:	682b      	ldr	r3, [r5, #0]
+ 80089da:	07d8      	lsls	r0, r3, #31
+ 80089dc:	d42d      	bmi.n	8008a3a <HAL_RCC_OscConfig+0x16e>
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_HSI) == RCC_OSCILLATORTYPE_HSI)
+ 80089de:	682b      	ldr	r3, [r5, #0]
+ 80089e0:	0799      	lsls	r1, r3, #30
+ 80089e2:	d46b      	bmi.n	8008abc <HAL_RCC_OscConfig+0x1f0>
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_LSI) == RCC_OSCILLATORTYPE_LSI)
+ 80089e4:	682b      	ldr	r3, [r5, #0]
+ 80089e6:	0718      	lsls	r0, r3, #28
+ 80089e8:	f100 80a8 	bmi.w	8008b3c <HAL_RCC_OscConfig+0x270>
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_LSE) == RCC_OSCILLATORTYPE_LSE)
+ 80089ec:	682b      	ldr	r3, [r5, #0]
+ 80089ee:	0759      	lsls	r1, r3, #29
+ 80089f0:	f100 80ce 	bmi.w	8008b90 <HAL_RCC_OscConfig+0x2c4>
+  if(((RCC_OscInitStruct->OscillatorType) & RCC_OSCILLATORTYPE_HSI48) == RCC_OSCILLATORTYPE_HSI48)
+ 80089f4:	682b      	ldr	r3, [r5, #0]
+ 80089f6:	069f      	lsls	r7, r3, #26
+ 80089f8:	f100 8137 	bmi.w	8008c6a <HAL_RCC_OscConfig+0x39e>
+  if(RCC_OscInitStruct->PLL.PLLState != RCC_PLL_NONE)
+ 80089fc:	6aab      	ldr	r3, [r5, #40]	; 0x28
+ 80089fe:	2b00      	cmp	r3, #0
+ 8008a00:	f040 815d 	bne.w	8008cbe <HAL_RCC_OscConfig+0x3f2>
+  return HAL_OK;
+ 8008a04:	2000      	movs	r0, #0
+ 8008a06:	e7af      	b.n	8008968 <HAL_RCC_OscConfig+0x9c>
+          if((HAL_GetTick() - tickstart) > MSI_TIMEOUT_VALUE)
+ 8008a08:	f7fe fba2 	bl	8007150 <HAL_GetTick>
+ 8008a0c:	eba0 0008 	sub.w	r0, r0, r8
+ 8008a10:	2802      	cmp	r0, #2
+ 8008a12:	d9cd      	bls.n	80089b0 <HAL_RCC_OscConfig+0xe4>
+            return HAL_TIMEOUT;
+ 8008a14:	2003      	movs	r0, #3
+ 8008a16:	e7a7      	b.n	8008968 <HAL_RCC_OscConfig+0x9c>
+        __HAL_RCC_MSI_DISABLE();
+ 8008a18:	6823      	ldr	r3, [r4, #0]
+ 8008a1a:	f023 0301 	bic.w	r3, r3, #1
+ 8008a1e:	6023      	str	r3, [r4, #0]
+        tickstart = HAL_GetTick();
+ 8008a20:	f7fe fb96 	bl	8007150 <HAL_GetTick>
+ 8008a24:	4680      	mov	r8, r0
+        while(READ_BIT(RCC->CR, RCC_CR_MSIRDY) != 0U)
+ 8008a26:	6823      	ldr	r3, [r4, #0]
+ 8008a28:	079b      	lsls	r3, r3, #30
+ 8008a2a:	d5d5      	bpl.n	80089d8 <HAL_RCC_OscConfig+0x10c>
+          if((HAL_GetTick() - tickstart) > MSI_TIMEOUT_VALUE)
+ 8008a2c:	f7fe fb90 	bl	8007150 <HAL_GetTick>
+ 8008a30:	eba0 0008 	sub.w	r0, r0, r8
+ 8008a34:	2802      	cmp	r0, #2
+ 8008a36:	d9f6      	bls.n	8008a26 <HAL_RCC_OscConfig+0x15a>
+ 8008a38:	e7ec      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+    if((sysclk_source == RCC_CFGR_SWS_HSE) ||
+ 8008a3a:	2e08      	cmp	r6, #8
+ 8008a3c:	d003      	beq.n	8008a46 <HAL_RCC_OscConfig+0x17a>
+ 8008a3e:	2e0c      	cmp	r6, #12
+ 8008a40:	d108      	bne.n	8008a54 <HAL_RCC_OscConfig+0x188>
+       ((sysclk_source == RCC_CFGR_SWS_PLL) && (pll_config == RCC_PLLSOURCE_HSE)))
+ 8008a42:	2f03      	cmp	r7, #3
+ 8008a44:	d106      	bne.n	8008a54 <HAL_RCC_OscConfig+0x188>
+      if((READ_BIT(RCC->CR, RCC_CR_HSERDY) != 0U) && (RCC_OscInitStruct->HSEState == RCC_HSE_OFF))
+ 8008a46:	6823      	ldr	r3, [r4, #0]
+ 8008a48:	039a      	lsls	r2, r3, #14
+ 8008a4a:	d5c8      	bpl.n	80089de <HAL_RCC_OscConfig+0x112>
+ 8008a4c:	686b      	ldr	r3, [r5, #4]
+ 8008a4e:	2b00      	cmp	r3, #0
+ 8008a50:	d1c5      	bne.n	80089de <HAL_RCC_OscConfig+0x112>
+ 8008a52:	e73f      	b.n	80088d4 <HAL_RCC_OscConfig+0x8>
+      __HAL_RCC_HSE_CONFIG(RCC_OscInitStruct->HSEState);
+ 8008a54:	686b      	ldr	r3, [r5, #4]
+ 8008a56:	f5b3 3f80 	cmp.w	r3, #65536	; 0x10000
+ 8008a5a:	d110      	bne.n	8008a7e <HAL_RCC_OscConfig+0x1b2>
+ 8008a5c:	6823      	ldr	r3, [r4, #0]
+ 8008a5e:	f443 3380 	orr.w	r3, r3, #65536	; 0x10000
+ 8008a62:	6023      	str	r3, [r4, #0]
+        tickstart = HAL_GetTick();
+ 8008a64:	f7fe fb74 	bl	8007150 <HAL_GetTick>
+ 8008a68:	4680      	mov	r8, r0
+        while(READ_BIT(RCC->CR, RCC_CR_HSERDY) == 0U)
+ 8008a6a:	6823      	ldr	r3, [r4, #0]
+ 8008a6c:	039b      	lsls	r3, r3, #14
+ 8008a6e:	d4b6      	bmi.n	80089de <HAL_RCC_OscConfig+0x112>
+          if((HAL_GetTick() - tickstart) > HSE_TIMEOUT_VALUE)
+ 8008a70:	f7fe fb6e 	bl	8007150 <HAL_GetTick>
+ 8008a74:	eba0 0008 	sub.w	r0, r0, r8
+ 8008a78:	2864      	cmp	r0, #100	; 0x64
+ 8008a7a:	d9f6      	bls.n	8008a6a <HAL_RCC_OscConfig+0x19e>
+ 8008a7c:	e7ca      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+      __HAL_RCC_HSE_CONFIG(RCC_OscInitStruct->HSEState);
+ 8008a7e:	f5b3 2fa0 	cmp.w	r3, #327680	; 0x50000
+ 8008a82:	d104      	bne.n	8008a8e <HAL_RCC_OscConfig+0x1c2>
+ 8008a84:	6823      	ldr	r3, [r4, #0]
+ 8008a86:	f443 2380 	orr.w	r3, r3, #262144	; 0x40000
+ 8008a8a:	6023      	str	r3, [r4, #0]
+ 8008a8c:	e7e6      	b.n	8008a5c <HAL_RCC_OscConfig+0x190>
+ 8008a8e:	6822      	ldr	r2, [r4, #0]
+ 8008a90:	f422 3280 	bic.w	r2, r2, #65536	; 0x10000
+ 8008a94:	6022      	str	r2, [r4, #0]
+ 8008a96:	6822      	ldr	r2, [r4, #0]
+ 8008a98:	f422 2280 	bic.w	r2, r2, #262144	; 0x40000
+ 8008a9c:	6022      	str	r2, [r4, #0]
+      if(RCC_OscInitStruct->HSEState != RCC_HSE_OFF)
+ 8008a9e:	2b00      	cmp	r3, #0
+ 8008aa0:	d1e0      	bne.n	8008a64 <HAL_RCC_OscConfig+0x198>
+        tickstart = HAL_GetTick();
+ 8008aa2:	f7fe fb55 	bl	8007150 <HAL_GetTick>
+ 8008aa6:	4680      	mov	r8, r0
+        while(READ_BIT(RCC->CR, RCC_CR_HSERDY) != 0U)
+ 8008aa8:	6823      	ldr	r3, [r4, #0]
+ 8008aaa:	0398      	lsls	r0, r3, #14
+ 8008aac:	d597      	bpl.n	80089de <HAL_RCC_OscConfig+0x112>
+          if((HAL_GetTick() - tickstart) > HSE_TIMEOUT_VALUE)
+ 8008aae:	f7fe fb4f 	bl	8007150 <HAL_GetTick>
+ 8008ab2:	eba0 0008 	sub.w	r0, r0, r8
+ 8008ab6:	2864      	cmp	r0, #100	; 0x64
+ 8008ab8:	d9f6      	bls.n	8008aa8 <HAL_RCC_OscConfig+0x1dc>
+ 8008aba:	e7ab      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+    if((sysclk_source == RCC_CFGR_SWS_HSI) ||
+ 8008abc:	2e04      	cmp	r6, #4
+ 8008abe:	d003      	beq.n	8008ac8 <HAL_RCC_OscConfig+0x1fc>
+ 8008ac0:	2e0c      	cmp	r6, #12
+ 8008ac2:	d110      	bne.n	8008ae6 <HAL_RCC_OscConfig+0x21a>
+       ((sysclk_source == RCC_CFGR_SWS_PLL) && (pll_config == RCC_PLLSOURCE_HSI)))
+ 8008ac4:	2f02      	cmp	r7, #2
+ 8008ac6:	d10e      	bne.n	8008ae6 <HAL_RCC_OscConfig+0x21a>
+      if((READ_BIT(RCC->CR, RCC_CR_HSIRDY) != 0U) && (RCC_OscInitStruct->HSIState == RCC_HSI_OFF))
+ 8008ac8:	6823      	ldr	r3, [r4, #0]
+ 8008aca:	0559      	lsls	r1, r3, #21
+ 8008acc:	d503      	bpl.n	8008ad6 <HAL_RCC_OscConfig+0x20a>
+ 8008ace:	68eb      	ldr	r3, [r5, #12]
+ 8008ad0:	2b00      	cmp	r3, #0
+ 8008ad2:	f43f aeff 	beq.w	80088d4 <HAL_RCC_OscConfig+0x8>
+        __HAL_RCC_HSI_CALIBRATIONVALUE_ADJUST(RCC_OscInitStruct->HSICalibrationValue);
+ 8008ad6:	6863      	ldr	r3, [r4, #4]
+ 8008ad8:	692a      	ldr	r2, [r5, #16]
+ 8008ada:	f023 43fe 	bic.w	r3, r3, #2130706432	; 0x7f000000
+ 8008ade:	ea43 6302 	orr.w	r3, r3, r2, lsl #24
+ 8008ae2:	6063      	str	r3, [r4, #4]
+ 8008ae4:	e77e      	b.n	80089e4 <HAL_RCC_OscConfig+0x118>
+      if(RCC_OscInitStruct->HSIState != RCC_HSI_OFF)
+ 8008ae6:	68eb      	ldr	r3, [r5, #12]
+ 8008ae8:	b17b      	cbz	r3, 8008b0a <HAL_RCC_OscConfig+0x23e>
+        __HAL_RCC_HSI_ENABLE();
+ 8008aea:	6823      	ldr	r3, [r4, #0]
+ 8008aec:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 8008af0:	6023      	str	r3, [r4, #0]
+        tickstart = HAL_GetTick();
+ 8008af2:	f7fe fb2d 	bl	8007150 <HAL_GetTick>
+ 8008af6:	4607      	mov	r7, r0
+        while(READ_BIT(RCC->CR, RCC_CR_HSIRDY) == 0U)
+ 8008af8:	6823      	ldr	r3, [r4, #0]
+ 8008afa:	055a      	lsls	r2, r3, #21
+ 8008afc:	d4eb      	bmi.n	8008ad6 <HAL_RCC_OscConfig+0x20a>
+          if((HAL_GetTick() - tickstart) > HSI_TIMEOUT_VALUE)
+ 8008afe:	f7fe fb27 	bl	8007150 <HAL_GetTick>
+ 8008b02:	1bc0      	subs	r0, r0, r7
+ 8008b04:	2802      	cmp	r0, #2
+ 8008b06:	d9f7      	bls.n	8008af8 <HAL_RCC_OscConfig+0x22c>
+ 8008b08:	e784      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+        __HAL_RCC_HSI_DISABLE();
+ 8008b0a:	6823      	ldr	r3, [r4, #0]
+ 8008b0c:	f423 7380 	bic.w	r3, r3, #256	; 0x100
+ 8008b10:	6023      	str	r3, [r4, #0]
+        tickstart = HAL_GetTick();
+ 8008b12:	f7fe fb1d 	bl	8007150 <HAL_GetTick>
+ 8008b16:	4607      	mov	r7, r0
+        while(READ_BIT(RCC->CR, RCC_CR_HSIRDY) != 0U)
+ 8008b18:	6823      	ldr	r3, [r4, #0]
+ 8008b1a:	055b      	lsls	r3, r3, #21
+ 8008b1c:	f57f af62 	bpl.w	80089e4 <HAL_RCC_OscConfig+0x118>
+          if((HAL_GetTick() - tickstart) > HSI_TIMEOUT_VALUE)
+ 8008b20:	f7fe fb16 	bl	8007150 <HAL_GetTick>
+ 8008b24:	1bc0      	subs	r0, r0, r7
+ 8008b26:	2802      	cmp	r0, #2
+ 8008b28:	d9f6      	bls.n	8008b18 <HAL_RCC_OscConfig+0x24c>
+ 8008b2a:	e773      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+ 8008b2c:	40021000 	.word	0x40021000
+ 8008b30:	0800ea64 	.word	0x0800ea64
+ 8008b34:	2009e2a8 	.word	0x2009e2a8
+ 8008b38:	2009e2ac 	.word	0x2009e2ac
+    if(RCC_OscInitStruct->LSIState != RCC_LSI_OFF)
+ 8008b3c:	696b      	ldr	r3, [r5, #20]
+ 8008b3e:	b19b      	cbz	r3, 8008b68 <HAL_RCC_OscConfig+0x29c>
+      __HAL_RCC_LSI_ENABLE();
+ 8008b40:	f8d4 3094 	ldr.w	r3, [r4, #148]	; 0x94
+ 8008b44:	f043 0301 	orr.w	r3, r3, #1
+ 8008b48:	f8c4 3094 	str.w	r3, [r4, #148]	; 0x94
+      tickstart = HAL_GetTick();
+ 8008b4c:	f7fe fb00 	bl	8007150 <HAL_GetTick>
+ 8008b50:	4607      	mov	r7, r0
+      while(READ_BIT(RCC->CSR, RCC_CSR_LSIRDY) == 0U)
+ 8008b52:	f8d4 3094 	ldr.w	r3, [r4, #148]	; 0x94
+ 8008b56:	079a      	lsls	r2, r3, #30
+ 8008b58:	f53f af48 	bmi.w	80089ec <HAL_RCC_OscConfig+0x120>
+        if((HAL_GetTick() - tickstart) > LSI_TIMEOUT_VALUE)
+ 8008b5c:	f7fe faf8 	bl	8007150 <HAL_GetTick>
+ 8008b60:	1bc0      	subs	r0, r0, r7
+ 8008b62:	2802      	cmp	r0, #2
+ 8008b64:	d9f5      	bls.n	8008b52 <HAL_RCC_OscConfig+0x286>
+ 8008b66:	e755      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+      __HAL_RCC_LSI_DISABLE();
+ 8008b68:	f8d4 3094 	ldr.w	r3, [r4, #148]	; 0x94
+ 8008b6c:	f023 0301 	bic.w	r3, r3, #1
+ 8008b70:	f8c4 3094 	str.w	r3, [r4, #148]	; 0x94
+      tickstart = HAL_GetTick();
+ 8008b74:	f7fe faec 	bl	8007150 <HAL_GetTick>
+ 8008b78:	4607      	mov	r7, r0
+      while(READ_BIT(RCC->CSR, RCC_CSR_LSIRDY) != 0U)
+ 8008b7a:	f8d4 3094 	ldr.w	r3, [r4, #148]	; 0x94
+ 8008b7e:	079b      	lsls	r3, r3, #30
+ 8008b80:	f57f af34 	bpl.w	80089ec <HAL_RCC_OscConfig+0x120>
+        if((HAL_GetTick() - tickstart) > LSI_TIMEOUT_VALUE)
+ 8008b84:	f7fe fae4 	bl	8007150 <HAL_GetTick>
+ 8008b88:	1bc0      	subs	r0, r0, r7
+ 8008b8a:	2802      	cmp	r0, #2
+ 8008b8c:	d9f5      	bls.n	8008b7a <HAL_RCC_OscConfig+0x2ae>
+ 8008b8e:	e741      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+    if(HAL_IS_BIT_CLR(RCC->APB1ENR1, RCC_APB1ENR1_PWREN))
+ 8008b90:	6da3      	ldr	r3, [r4, #88]	; 0x58
+ 8008b92:	00df      	lsls	r7, r3, #3
+ 8008b94:	d429      	bmi.n	8008bea <HAL_RCC_OscConfig+0x31e>
+      __HAL_RCC_PWR_CLK_ENABLE();
+ 8008b96:	6da3      	ldr	r3, [r4, #88]	; 0x58
+ 8008b98:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+ 8008b9c:	65a3      	str	r3, [r4, #88]	; 0x58
+ 8008b9e:	6da3      	ldr	r3, [r4, #88]	; 0x58
+ 8008ba0:	f003 5380 	and.w	r3, r3, #268435456	; 0x10000000
+ 8008ba4:	9301      	str	r3, [sp, #4]
+ 8008ba6:	9b01      	ldr	r3, [sp, #4]
+      pwrclkchanged = SET;
+ 8008ba8:	f04f 0801 	mov.w	r8, #1
+    if(HAL_IS_BIT_CLR(PWR->CR1, PWR_CR1_DBP))
+ 8008bac:	4f9c      	ldr	r7, [pc, #624]	; (8008e20 <HAL_RCC_OscConfig+0x554>)
+ 8008bae:	683b      	ldr	r3, [r7, #0]
+ 8008bb0:	05d8      	lsls	r0, r3, #23
+ 8008bb2:	d51d      	bpl.n	8008bf0 <HAL_RCC_OscConfig+0x324>
+    __HAL_RCC_LSE_CONFIG(RCC_OscInitStruct->LSEState);
+ 8008bb4:	68ab      	ldr	r3, [r5, #8]
+ 8008bb6:	2b01      	cmp	r3, #1
+ 8008bb8:	d12b      	bne.n	8008c12 <HAL_RCC_OscConfig+0x346>
+ 8008bba:	f8d4 3090 	ldr.w	r3, [r4, #144]	; 0x90
+ 8008bbe:	f043 0301 	orr.w	r3, r3, #1
+ 8008bc2:	f8c4 3090 	str.w	r3, [r4, #144]	; 0x90
+      tickstart = HAL_GetTick();
+ 8008bc6:	f7fe fac3 	bl	8007150 <HAL_GetTick>
+        if((HAL_GetTick() - tickstart) > RCC_LSE_TIMEOUT_VALUE)
+ 8008bca:	f241 3988 	movw	r9, #5000	; 0x1388
+      tickstart = HAL_GetTick();
+ 8008bce:	4607      	mov	r7, r0
+      while(READ_BIT(RCC->BDCR, RCC_BDCR_LSERDY) == 0U)
+ 8008bd0:	f8d4 3090 	ldr.w	r3, [r4, #144]	; 0x90
+ 8008bd4:	079a      	lsls	r2, r3, #30
+ 8008bd6:	d542      	bpl.n	8008c5e <HAL_RCC_OscConfig+0x392>
+    if(pwrclkchanged == SET)
+ 8008bd8:	f1b8 0f00 	cmp.w	r8, #0
+ 8008bdc:	f43f af0a 	beq.w	80089f4 <HAL_RCC_OscConfig+0x128>
+      __HAL_RCC_PWR_CLK_DISABLE();
+ 8008be0:	6da3      	ldr	r3, [r4, #88]	; 0x58
+ 8008be2:	f023 5380 	bic.w	r3, r3, #268435456	; 0x10000000
+ 8008be6:	65a3      	str	r3, [r4, #88]	; 0x58
+ 8008be8:	e704      	b.n	80089f4 <HAL_RCC_OscConfig+0x128>
+    FlagStatus       pwrclkchanged = RESET;
+ 8008bea:	f04f 0800 	mov.w	r8, #0
+ 8008bee:	e7dd      	b.n	8008bac <HAL_RCC_OscConfig+0x2e0>
+      SET_BIT(PWR->CR1, PWR_CR1_DBP);
+ 8008bf0:	683b      	ldr	r3, [r7, #0]
+ 8008bf2:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 8008bf6:	603b      	str	r3, [r7, #0]
+      tickstart = HAL_GetTick();
+ 8008bf8:	f7fe faaa 	bl	8007150 <HAL_GetTick>
+ 8008bfc:	4681      	mov	r9, r0
+      while(HAL_IS_BIT_CLR(PWR->CR1, PWR_CR1_DBP))
+ 8008bfe:	683b      	ldr	r3, [r7, #0]
+ 8008c00:	05d9      	lsls	r1, r3, #23
+ 8008c02:	d4d7      	bmi.n	8008bb4 <HAL_RCC_OscConfig+0x2e8>
+        if((HAL_GetTick() - tickstart) > RCC_DBP_TIMEOUT_VALUE)
+ 8008c04:	f7fe faa4 	bl	8007150 <HAL_GetTick>
+ 8008c08:	eba0 0009 	sub.w	r0, r0, r9
+ 8008c0c:	2802      	cmp	r0, #2
+ 8008c0e:	d9f6      	bls.n	8008bfe <HAL_RCC_OscConfig+0x332>
+ 8008c10:	e700      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+    __HAL_RCC_LSE_CONFIG(RCC_OscInitStruct->LSEState);
+ 8008c12:	2b05      	cmp	r3, #5
+ 8008c14:	d106      	bne.n	8008c24 <HAL_RCC_OscConfig+0x358>
+ 8008c16:	f8d4 3090 	ldr.w	r3, [r4, #144]	; 0x90
+ 8008c1a:	f043 0304 	orr.w	r3, r3, #4
+ 8008c1e:	f8c4 3090 	str.w	r3, [r4, #144]	; 0x90
+ 8008c22:	e7ca      	b.n	8008bba <HAL_RCC_OscConfig+0x2ee>
+ 8008c24:	f8d4 2090 	ldr.w	r2, [r4, #144]	; 0x90
+ 8008c28:	f022 0201 	bic.w	r2, r2, #1
+ 8008c2c:	f8c4 2090 	str.w	r2, [r4, #144]	; 0x90
+ 8008c30:	f8d4 2090 	ldr.w	r2, [r4, #144]	; 0x90
+ 8008c34:	f022 0204 	bic.w	r2, r2, #4
+ 8008c38:	f8c4 2090 	str.w	r2, [r4, #144]	; 0x90
+    if(RCC_OscInitStruct->LSEState != RCC_LSE_OFF)
+ 8008c3c:	2b00      	cmp	r3, #0
+ 8008c3e:	d1c2      	bne.n	8008bc6 <HAL_RCC_OscConfig+0x2fa>
+      tickstart = HAL_GetTick();
+ 8008c40:	f7fe fa86 	bl	8007150 <HAL_GetTick>
+        if((HAL_GetTick() - tickstart) > RCC_LSE_TIMEOUT_VALUE)
+ 8008c44:	f241 3988 	movw	r9, #5000	; 0x1388
+      tickstart = HAL_GetTick();
+ 8008c48:	4607      	mov	r7, r0
+      while(READ_BIT(RCC->BDCR, RCC_BDCR_LSERDY) != 0U)
+ 8008c4a:	f8d4 3090 	ldr.w	r3, [r4, #144]	; 0x90
+ 8008c4e:	079b      	lsls	r3, r3, #30
+ 8008c50:	d5c2      	bpl.n	8008bd8 <HAL_RCC_OscConfig+0x30c>
+        if((HAL_GetTick() - tickstart) > RCC_LSE_TIMEOUT_VALUE)
+ 8008c52:	f7fe fa7d 	bl	8007150 <HAL_GetTick>
+ 8008c56:	1bc0      	subs	r0, r0, r7
+ 8008c58:	4548      	cmp	r0, r9
+ 8008c5a:	d9f6      	bls.n	8008c4a <HAL_RCC_OscConfig+0x37e>
+ 8008c5c:	e6da      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+        if((HAL_GetTick() - tickstart) > RCC_LSE_TIMEOUT_VALUE)
+ 8008c5e:	f7fe fa77 	bl	8007150 <HAL_GetTick>
+ 8008c62:	1bc0      	subs	r0, r0, r7
+ 8008c64:	4548      	cmp	r0, r9
+ 8008c66:	d9b3      	bls.n	8008bd0 <HAL_RCC_OscConfig+0x304>
+ 8008c68:	e6d4      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+    if(RCC_OscInitStruct->HSI48State != RCC_HSI48_OFF)
+ 8008c6a:	6a6b      	ldr	r3, [r5, #36]	; 0x24
+ 8008c6c:	b19b      	cbz	r3, 8008c96 <HAL_RCC_OscConfig+0x3ca>
+      __HAL_RCC_HSI48_ENABLE();
+ 8008c6e:	f8d4 3098 	ldr.w	r3, [r4, #152]	; 0x98
+ 8008c72:	f043 0301 	orr.w	r3, r3, #1
+ 8008c76:	f8c4 3098 	str.w	r3, [r4, #152]	; 0x98
+      tickstart = HAL_GetTick();
+ 8008c7a:	f7fe fa69 	bl	8007150 <HAL_GetTick>
+ 8008c7e:	4607      	mov	r7, r0
+      while(READ_BIT(RCC->CRRCR, RCC_CRRCR_HSI48RDY) == 0U)
+ 8008c80:	f8d4 3098 	ldr.w	r3, [r4, #152]	; 0x98
+ 8008c84:	0798      	lsls	r0, r3, #30
+ 8008c86:	f53f aeb9 	bmi.w	80089fc <HAL_RCC_OscConfig+0x130>
+        if((HAL_GetTick() - tickstart) > HSI48_TIMEOUT_VALUE)
+ 8008c8a:	f7fe fa61 	bl	8007150 <HAL_GetTick>
+ 8008c8e:	1bc0      	subs	r0, r0, r7
+ 8008c90:	2802      	cmp	r0, #2
+ 8008c92:	d9f5      	bls.n	8008c80 <HAL_RCC_OscConfig+0x3b4>
+ 8008c94:	e6be      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+      __HAL_RCC_HSI48_DISABLE();
+ 8008c96:	f8d4 3098 	ldr.w	r3, [r4, #152]	; 0x98
+ 8008c9a:	f023 0301 	bic.w	r3, r3, #1
+ 8008c9e:	f8c4 3098 	str.w	r3, [r4, #152]	; 0x98
+      tickstart = HAL_GetTick();
+ 8008ca2:	f7fe fa55 	bl	8007150 <HAL_GetTick>
+ 8008ca6:	4607      	mov	r7, r0
+      while(READ_BIT(RCC->CRRCR, RCC_CRRCR_HSI48RDY) != 0U)
+ 8008ca8:	f8d4 3098 	ldr.w	r3, [r4, #152]	; 0x98
+ 8008cac:	0799      	lsls	r1, r3, #30
+ 8008cae:	f57f aea5 	bpl.w	80089fc <HAL_RCC_OscConfig+0x130>
+        if((HAL_GetTick() - tickstart) > HSI48_TIMEOUT_VALUE)
+ 8008cb2:	f7fe fa4d 	bl	8007150 <HAL_GetTick>
+ 8008cb6:	1bc0      	subs	r0, r0, r7
+ 8008cb8:	2802      	cmp	r0, #2
+ 8008cba:	d9f5      	bls.n	8008ca8 <HAL_RCC_OscConfig+0x3dc>
+ 8008cbc:	e6aa      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+    if(RCC_OscInitStruct->PLL.PLLState == RCC_PLL_ON)
+ 8008cbe:	2b02      	cmp	r3, #2
+ 8008cc0:	f040 808c 	bne.w	8008ddc <HAL_RCC_OscConfig+0x510>
+      pll_config = RCC->PLLCFGR;
+ 8008cc4:	68e3      	ldr	r3, [r4, #12]
+      if((READ_BIT(pll_config, RCC_PLLCFGR_PLLSRC)  != RCC_OscInitStruct->PLL.PLLSource) ||
+ 8008cc6:	6aea      	ldr	r2, [r5, #44]	; 0x2c
+ 8008cc8:	f003 0103 	and.w	r1, r3, #3
+ 8008ccc:	4291      	cmp	r1, r2
+ 8008cce:	d122      	bne.n	8008d16 <HAL_RCC_OscConfig+0x44a>
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLM)    != ((RCC_OscInitStruct->PLL.PLLM - 1U) << RCC_PLLCFGR_PLLM_Pos)) ||
+ 8008cd0:	6b29      	ldr	r1, [r5, #48]	; 0x30
+ 8008cd2:	f003 02f0 	and.w	r2, r3, #240	; 0xf0
+ 8008cd6:	3901      	subs	r1, #1
+      if((READ_BIT(pll_config, RCC_PLLCFGR_PLLSRC)  != RCC_OscInitStruct->PLL.PLLSource) ||
+ 8008cd8:	ebb2 1f01 	cmp.w	r2, r1, lsl #4
+ 8008cdc:	d11b      	bne.n	8008d16 <HAL_RCC_OscConfig+0x44a>
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLN)    != (RCC_OscInitStruct->PLL.PLLN << RCC_PLLCFGR_PLLN_Pos)) ||
+ 8008cde:	6b69      	ldr	r1, [r5, #52]	; 0x34
+ 8008ce0:	f403 42fe 	and.w	r2, r3, #32512	; 0x7f00
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLM)    != ((RCC_OscInitStruct->PLL.PLLM - 1U) << RCC_PLLCFGR_PLLM_Pos)) ||
+ 8008ce4:	ebb2 2f01 	cmp.w	r2, r1, lsl #8
+ 8008ce8:	d115      	bne.n	8008d16 <HAL_RCC_OscConfig+0x44a>
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLPDIV) != (RCC_OscInitStruct->PLL.PLLP << RCC_PLLCFGR_PLLPDIV_Pos)) ||
+ 8008cea:	6ba9      	ldr	r1, [r5, #56]	; 0x38
+ 8008cec:	f003 4278 	and.w	r2, r3, #4160749568	; 0xf8000000
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLN)    != (RCC_OscInitStruct->PLL.PLLN << RCC_PLLCFGR_PLLN_Pos)) ||
+ 8008cf0:	ebb2 6fc1 	cmp.w	r2, r1, lsl #27
+ 8008cf4:	d10f      	bne.n	8008d16 <HAL_RCC_OscConfig+0x44a>
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLQ)    != ((((RCC_OscInitStruct->PLL.PLLQ) >> 1U) - 1U) << RCC_PLLCFGR_PLLQ_Pos)) ||
+ 8008cf6:	6bea      	ldr	r2, [r5, #60]	; 0x3c
+ 8008cf8:	0852      	lsrs	r2, r2, #1
+ 8008cfa:	f403 01c0 	and.w	r1, r3, #6291456	; 0x600000
+ 8008cfe:	3a01      	subs	r2, #1
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLPDIV) != (RCC_OscInitStruct->PLL.PLLP << RCC_PLLCFGR_PLLPDIV_Pos)) ||
+ 8008d00:	ebb1 5f42 	cmp.w	r1, r2, lsl #21
+ 8008d04:	d107      	bne.n	8008d16 <HAL_RCC_OscConfig+0x44a>
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLR)    != ((((RCC_OscInitStruct->PLL.PLLR) >> 1U) - 1U) << RCC_PLLCFGR_PLLR_Pos)))
+ 8008d06:	6c2a      	ldr	r2, [r5, #64]	; 0x40
+ 8008d08:	0852      	lsrs	r2, r2, #1
+ 8008d0a:	f003 63c0 	and.w	r3, r3, #100663296	; 0x6000000
+ 8008d0e:	3a01      	subs	r2, #1
+         (READ_BIT(pll_config, RCC_PLLCFGR_PLLQ)    != ((((RCC_OscInitStruct->PLL.PLLQ) >> 1U) - 1U) << RCC_PLLCFGR_PLLQ_Pos)) ||
+ 8008d10:	ebb3 6f42 	cmp.w	r3, r2, lsl #25
+ 8008d14:	d049      	beq.n	8008daa <HAL_RCC_OscConfig+0x4de>
+        if(sysclk_source != RCC_CFGR_SWS_PLL)
+ 8008d16:	2e0c      	cmp	r6, #12
+ 8008d18:	f43f addc 	beq.w	80088d4 <HAL_RCC_OscConfig+0x8>
+          if((READ_BIT(RCC->CR, RCC_CR_PLLSAI1ON) != 0U)
+ 8008d1c:	6823      	ldr	r3, [r4, #0]
+ 8008d1e:	015a      	lsls	r2, r3, #5
+ 8008d20:	f53f add8 	bmi.w	80088d4 <HAL_RCC_OscConfig+0x8>
+             || (READ_BIT(RCC->CR, RCC_CR_PLLSAI2ON) != 0U)
+ 8008d24:	6823      	ldr	r3, [r4, #0]
+ 8008d26:	00db      	lsls	r3, r3, #3
+ 8008d28:	f53f add4 	bmi.w	80088d4 <HAL_RCC_OscConfig+0x8>
+            __HAL_RCC_PLL_DISABLE();
+ 8008d2c:	6823      	ldr	r3, [r4, #0]
+ 8008d2e:	f023 7380 	bic.w	r3, r3, #16777216	; 0x1000000
+ 8008d32:	6023      	str	r3, [r4, #0]
+            tickstart = HAL_GetTick();
+ 8008d34:	f7fe fa0c 	bl	8007150 <HAL_GetTick>
+ 8008d38:	4606      	mov	r6, r0
+            while(READ_BIT(RCC->CR, RCC_CR_PLLRDY) != 0U)
+ 8008d3a:	6823      	ldr	r3, [r4, #0]
+ 8008d3c:	019f      	lsls	r7, r3, #6
+ 8008d3e:	d42e      	bmi.n	8008d9e <HAL_RCC_OscConfig+0x4d2>
+            __HAL_RCC_PLL_CONFIG(RCC_OscInitStruct->PLL.PLLSource,
+ 8008d40:	68e2      	ldr	r2, [r4, #12]
+ 8008d42:	4b38      	ldr	r3, [pc, #224]	; (8008e24 <HAL_RCC_OscConfig+0x558>)
+ 8008d44:	4013      	ands	r3, r2
+ 8008d46:	6aea      	ldr	r2, [r5, #44]	; 0x2c
+ 8008d48:	4313      	orrs	r3, r2
+ 8008d4a:	6b6a      	ldr	r2, [r5, #52]	; 0x34
+ 8008d4c:	ea43 2302 	orr.w	r3, r3, r2, lsl #8
+ 8008d50:	6baa      	ldr	r2, [r5, #56]	; 0x38
+ 8008d52:	ea43 63c2 	orr.w	r3, r3, r2, lsl #27
+ 8008d56:	6b2a      	ldr	r2, [r5, #48]	; 0x30
+ 8008d58:	3a01      	subs	r2, #1
+ 8008d5a:	ea43 1302 	orr.w	r3, r3, r2, lsl #4
+ 8008d5e:	6bea      	ldr	r2, [r5, #60]	; 0x3c
+ 8008d60:	0852      	lsrs	r2, r2, #1
+ 8008d62:	3a01      	subs	r2, #1
+ 8008d64:	ea43 5342 	orr.w	r3, r3, r2, lsl #21
+ 8008d68:	6c2a      	ldr	r2, [r5, #64]	; 0x40
+ 8008d6a:	0852      	lsrs	r2, r2, #1
+ 8008d6c:	3a01      	subs	r2, #1
+ 8008d6e:	ea43 6342 	orr.w	r3, r3, r2, lsl #25
+ 8008d72:	60e3      	str	r3, [r4, #12]
+            __HAL_RCC_PLL_ENABLE();
+ 8008d74:	6823      	ldr	r3, [r4, #0]
+ 8008d76:	f043 7380 	orr.w	r3, r3, #16777216	; 0x1000000
+ 8008d7a:	6023      	str	r3, [r4, #0]
+            __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_SYSCLK);
+ 8008d7c:	68e3      	ldr	r3, [r4, #12]
+ 8008d7e:	f043 7380 	orr.w	r3, r3, #16777216	; 0x1000000
+ 8008d82:	60e3      	str	r3, [r4, #12]
+            tickstart = HAL_GetTick();
+ 8008d84:	f7fe f9e4 	bl	8007150 <HAL_GetTick>
+ 8008d88:	4605      	mov	r5, r0
+            while(READ_BIT(RCC->CR, RCC_CR_PLLRDY) == 0U)
+ 8008d8a:	6823      	ldr	r3, [r4, #0]
+ 8008d8c:	0198      	lsls	r0, r3, #6
+ 8008d8e:	f53f ae39 	bmi.w	8008a04 <HAL_RCC_OscConfig+0x138>
+              if((HAL_GetTick() - tickstart) > PLL_TIMEOUT_VALUE)
+ 8008d92:	f7fe f9dd 	bl	8007150 <HAL_GetTick>
+ 8008d96:	1b40      	subs	r0, r0, r5
+ 8008d98:	2802      	cmp	r0, #2
+ 8008d9a:	d9f6      	bls.n	8008d8a <HAL_RCC_OscConfig+0x4be>
+ 8008d9c:	e63a      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+              if((HAL_GetTick() - tickstart) > PLL_TIMEOUT_VALUE)
+ 8008d9e:	f7fe f9d7 	bl	8007150 <HAL_GetTick>
+ 8008da2:	1b80      	subs	r0, r0, r6
+ 8008da4:	2802      	cmp	r0, #2
+ 8008da6:	d9c8      	bls.n	8008d3a <HAL_RCC_OscConfig+0x46e>
+ 8008da8:	e634      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+        if(READ_BIT(RCC->CR, RCC_CR_PLLRDY) == 0U)
+ 8008daa:	6823      	ldr	r3, [r4, #0]
+ 8008dac:	0199      	lsls	r1, r3, #6
+ 8008dae:	f53f ae29 	bmi.w	8008a04 <HAL_RCC_OscConfig+0x138>
+          __HAL_RCC_PLL_ENABLE();
+ 8008db2:	6823      	ldr	r3, [r4, #0]
+ 8008db4:	f043 7380 	orr.w	r3, r3, #16777216	; 0x1000000
+ 8008db8:	6023      	str	r3, [r4, #0]
+          __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_SYSCLK);
+ 8008dba:	68e3      	ldr	r3, [r4, #12]
+ 8008dbc:	f043 7380 	orr.w	r3, r3, #16777216	; 0x1000000
+ 8008dc0:	60e3      	str	r3, [r4, #12]
+          tickstart = HAL_GetTick();
+ 8008dc2:	f7fe f9c5 	bl	8007150 <HAL_GetTick>
+ 8008dc6:	4605      	mov	r5, r0
+          while(READ_BIT(RCC->CR, RCC_CR_PLLRDY) == 0U)
+ 8008dc8:	6823      	ldr	r3, [r4, #0]
+ 8008dca:	019a      	lsls	r2, r3, #6
+ 8008dcc:	f53f ae1a 	bmi.w	8008a04 <HAL_RCC_OscConfig+0x138>
+            if((HAL_GetTick() - tickstart) > PLL_TIMEOUT_VALUE)
+ 8008dd0:	f7fe f9be 	bl	8007150 <HAL_GetTick>
+ 8008dd4:	1b40      	subs	r0, r0, r5
+ 8008dd6:	2802      	cmp	r0, #2
+ 8008dd8:	d9f6      	bls.n	8008dc8 <HAL_RCC_OscConfig+0x4fc>
+ 8008dda:	e61b      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+      if(sysclk_source != RCC_CFGR_SWS_PLL)
+ 8008ddc:	2e0c      	cmp	r6, #12
+ 8008dde:	f43f ad79 	beq.w	80088d4 <HAL_RCC_OscConfig+0x8>
+        __HAL_RCC_PLL_DISABLE();
+ 8008de2:	6823      	ldr	r3, [r4, #0]
+ 8008de4:	f023 7380 	bic.w	r3, r3, #16777216	; 0x1000000
+ 8008de8:	6023      	str	r3, [r4, #0]
+        if(READ_BIT(RCC->CR, (RCC_CR_PLLSAI1RDY | RCC_CR_PLLSAI2RDY)) == 0U)
+ 8008dea:	6823      	ldr	r3, [r4, #0]
+ 8008dec:	f013 5f20 	tst.w	r3, #671088640	; 0x28000000
+          MODIFY_REG(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC, RCC_PLLSOURCE_NONE);
+ 8008df0:	bf02      	ittt	eq
+ 8008df2:	68e3      	ldreq	r3, [r4, #12]
+ 8008df4:	f023 0303 	biceq.w	r3, r3, #3
+ 8008df8:	60e3      	streq	r3, [r4, #12]
+        __HAL_RCC_PLLCLKOUT_DISABLE(RCC_PLL_SYSCLK | RCC_PLL_48M1CLK | RCC_PLL_SAI3CLK);
+ 8008dfa:	68e3      	ldr	r3, [r4, #12]
+ 8008dfc:	f023 7388 	bic.w	r3, r3, #17825792	; 0x1100000
+ 8008e00:	f423 3380 	bic.w	r3, r3, #65536	; 0x10000
+ 8008e04:	60e3      	str	r3, [r4, #12]
+        tickstart = HAL_GetTick();
+ 8008e06:	f7fe f9a3 	bl	8007150 <HAL_GetTick>
+ 8008e0a:	4605      	mov	r5, r0
+        while(READ_BIT(RCC->CR, RCC_CR_PLLRDY) != 0U)
+ 8008e0c:	6823      	ldr	r3, [r4, #0]
+ 8008e0e:	019b      	lsls	r3, r3, #6
+ 8008e10:	f57f adf8 	bpl.w	8008a04 <HAL_RCC_OscConfig+0x138>
+          if((HAL_GetTick() - tickstart) > PLL_TIMEOUT_VALUE)
+ 8008e14:	f7fe f99c 	bl	8007150 <HAL_GetTick>
+ 8008e18:	1b40      	subs	r0, r0, r5
+ 8008e1a:	2802      	cmp	r0, #2
+ 8008e1c:	d9f6      	bls.n	8008e0c <HAL_RCC_OscConfig+0x540>
+ 8008e1e:	e5f9      	b.n	8008a14 <HAL_RCC_OscConfig+0x148>
+ 8008e20:	40007000 	.word	0x40007000
+ 8008e24:	019d800c 	.word	0x019d800c
+
+08008e28 <HAL_RCC_ClockConfig>:
+{
+ 8008e28:	e92d 43f8 	stmdb	sp!, {r3, r4, r5, r6, r7, r8, r9, lr}
+ 8008e2c:	460e      	mov	r6, r1
+  if(RCC_ClkInitStruct == NULL)
+ 8008e2e:	4605      	mov	r5, r0
+ 8008e30:	b910      	cbnz	r0, 8008e38 <HAL_RCC_ClockConfig+0x10>
+    return HAL_ERROR;
+ 8008e32:	2001      	movs	r0, #1
+}
+ 8008e34:	e8bd 83f8 	ldmia.w	sp!, {r3, r4, r5, r6, r7, r8, r9, pc}
+  if(FLatency > __HAL_FLASH_GET_LATENCY())
+ 8008e38:	4a6f      	ldr	r2, [pc, #444]	; (8008ff8 <HAL_RCC_ClockConfig+0x1d0>)
+ 8008e3a:	6813      	ldr	r3, [r2, #0]
+ 8008e3c:	f003 030f 	and.w	r3, r3, #15
+ 8008e40:	428b      	cmp	r3, r1
+ 8008e42:	d335      	bcc.n	8008eb0 <HAL_RCC_ClockConfig+0x88>
+  if(((RCC_ClkInitStruct->ClockType) & RCC_CLOCKTYPE_SYSCLK) == RCC_CLOCKTYPE_SYSCLK)
+ 8008e44:	6829      	ldr	r1, [r5, #0]
+ 8008e46:	f011 0701 	ands.w	r7, r1, #1
+ 8008e4a:	d13c      	bne.n	8008ec6 <HAL_RCC_ClockConfig+0x9e>
+  if(((RCC_ClkInitStruct->ClockType) & RCC_CLOCKTYPE_HCLK) == RCC_CLOCKTYPE_HCLK)
+ 8008e4c:	682a      	ldr	r2, [r5, #0]
+ 8008e4e:	0791      	lsls	r1, r2, #30
+ 8008e50:	f140 80b7 	bpl.w	8008fc2 <HAL_RCC_ClockConfig+0x19a>
+    MODIFY_REG(RCC->CFGR, RCC_CFGR_HPRE, RCC_ClkInitStruct->AHBCLKDivider);
+ 8008e54:	4969      	ldr	r1, [pc, #420]	; (8008ffc <HAL_RCC_ClockConfig+0x1d4>)
+ 8008e56:	68a8      	ldr	r0, [r5, #8]
+ 8008e58:	688b      	ldr	r3, [r1, #8]
+ 8008e5a:	f023 03f0 	bic.w	r3, r3, #240	; 0xf0
+ 8008e5e:	4303      	orrs	r3, r0
+      MODIFY_REG(RCC->CFGR, RCC_CFGR_HPRE, RCC_SYSCLK_DIV1);
+ 8008e60:	608b      	str	r3, [r1, #8]
+  if(FLatency < __HAL_FLASH_GET_LATENCY())
+ 8008e62:	4965      	ldr	r1, [pc, #404]	; (8008ff8 <HAL_RCC_ClockConfig+0x1d0>)
+ 8008e64:	680b      	ldr	r3, [r1, #0]
+ 8008e66:	f003 030f 	and.w	r3, r3, #15
+ 8008e6a:	42b3      	cmp	r3, r6
+ 8008e6c:	f200 80b1 	bhi.w	8008fd2 <HAL_RCC_ClockConfig+0x1aa>
+  if(((RCC_ClkInitStruct->ClockType) & RCC_CLOCKTYPE_PCLK1) == RCC_CLOCKTYPE_PCLK1)
+ 8008e70:	f012 0f04 	tst.w	r2, #4
+ 8008e74:	4c61      	ldr	r4, [pc, #388]	; (8008ffc <HAL_RCC_ClockConfig+0x1d4>)
+ 8008e76:	f040 80b8 	bne.w	8008fea <HAL_RCC_ClockConfig+0x1c2>
+  if(((RCC_ClkInitStruct->ClockType) & RCC_CLOCKTYPE_PCLK2) == RCC_CLOCKTYPE_PCLK2)
+ 8008e7a:	0713      	lsls	r3, r2, #28
+ 8008e7c:	d506      	bpl.n	8008e8c <HAL_RCC_ClockConfig+0x64>
+    MODIFY_REG(RCC->CFGR, RCC_CFGR_PPRE2, ((RCC_ClkInitStruct->APB2CLKDivider) << 3U));
+ 8008e7e:	68a3      	ldr	r3, [r4, #8]
+ 8008e80:	692a      	ldr	r2, [r5, #16]
+ 8008e82:	f423 5360 	bic.w	r3, r3, #14336	; 0x3800
+ 8008e86:	ea43 03c2 	orr.w	r3, r3, r2, lsl #3
+ 8008e8a:	60a3      	str	r3, [r4, #8]
+  SystemCoreClock = HAL_RCC_GetSysClockFreq() >> (AHBPrescTable[READ_BIT(RCC->CFGR, RCC_CFGR_HPRE) >> RCC_CFGR_HPRE_Pos] & 0x1FU);
+ 8008e8c:	f7ff fcd0 	bl	8008830 <HAL_RCC_GetSysClockFreq>
+ 8008e90:	68a3      	ldr	r3, [r4, #8]
+ 8008e92:	4a5b      	ldr	r2, [pc, #364]	; (8009000 <HAL_RCC_ClockConfig+0x1d8>)
+ 8008e94:	f3c3 1303 	ubfx	r3, r3, #4, #4
+ 8008e98:	5cd3      	ldrb	r3, [r2, r3]
+ 8008e9a:	f003 031f 	and.w	r3, r3, #31
+ 8008e9e:	40d8      	lsrs	r0, r3
+ 8008ea0:	4b58      	ldr	r3, [pc, #352]	; (8009004 <HAL_RCC_ClockConfig+0x1dc>)
+ 8008ea2:	6018      	str	r0, [r3, #0]
+  status = HAL_InitTick(uwTickPrio);
+ 8008ea4:	4b58      	ldr	r3, [pc, #352]	; (8009008 <HAL_RCC_ClockConfig+0x1e0>)
+ 8008ea6:	6818      	ldr	r0, [r3, #0]
+}
+ 8008ea8:	e8bd 43f8 	ldmia.w	sp!, {r3, r4, r5, r6, r7, r8, r9, lr}
+  status = HAL_InitTick(uwTickPrio);
+ 8008eac:	f7fe b952 	b.w	8007154 <HAL_InitTick>
+    __HAL_FLASH_SET_LATENCY(FLatency);
+ 8008eb0:	6813      	ldr	r3, [r2, #0]
+ 8008eb2:	f023 030f 	bic.w	r3, r3, #15
+ 8008eb6:	430b      	orrs	r3, r1
+ 8008eb8:	6013      	str	r3, [r2, #0]
+    if(__HAL_FLASH_GET_LATENCY() != FLatency)
+ 8008eba:	6813      	ldr	r3, [r2, #0]
+ 8008ebc:	f003 030f 	and.w	r3, r3, #15
+ 8008ec0:	428b      	cmp	r3, r1
+ 8008ec2:	d1b6      	bne.n	8008e32 <HAL_RCC_ClockConfig+0xa>
+ 8008ec4:	e7be      	b.n	8008e44 <HAL_RCC_ClockConfig+0x1c>
+    if(RCC_ClkInitStruct->SYSCLKSource == RCC_SYSCLKSOURCE_PLLCLK)
+ 8008ec6:	686b      	ldr	r3, [r5, #4]
+ 8008ec8:	4c4c      	ldr	r4, [pc, #304]	; (8008ffc <HAL_RCC_ClockConfig+0x1d4>)
+ 8008eca:	2b03      	cmp	r3, #3
+ 8008ecc:	d163      	bne.n	8008f96 <HAL_RCC_ClockConfig+0x16e>
+      if(READ_BIT(RCC->CR, RCC_CR_PLLRDY) == 0U)
+ 8008ece:	6823      	ldr	r3, [r4, #0]
+ 8008ed0:	019b      	lsls	r3, r3, #6
+ 8008ed2:	d5ae      	bpl.n	8008e32 <HAL_RCC_ClockConfig+0xa>
+static uint32_t RCC_GetSysClockFreqFromPLLSource(void)
+{
+  uint32_t msirange = 0U;
+  uint32_t pllvco, pllsource, pllr, pllm, sysclockfreq;  /* no init needed */
+
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() == RCC_PLLSOURCE_MSI)
+ 8008ed4:	68e3      	ldr	r3, [r4, #12]
+ 8008ed6:	f003 0303 	and.w	r3, r3, #3
+ 8008eda:	2b01      	cmp	r3, #1
+ 8008edc:	d145      	bne.n	8008f6a <HAL_RCC_ClockConfig+0x142>
+  {
+    /* Get MSI range source */
+    if(READ_BIT(RCC->CR, RCC_CR_MSIRGSEL) == 0U)
+ 8008ede:	6823      	ldr	r3, [r4, #0]
+    else
+    { /* MSIRANGE from RCC_CR applies */
+      msirange = READ_BIT(RCC->CR, RCC_CR_MSIRANGE) >> RCC_CR_MSIRANGE_Pos;
+    }
+    /*MSI frequency range in HZ*/
+    msirange = MSIRangeTable[msirange];
+ 8008ee0:	4a4a      	ldr	r2, [pc, #296]	; (800900c <HAL_RCC_ClockConfig+0x1e4>)
+    if(READ_BIT(RCC->CR, RCC_CR_MSIRGSEL) == 0U)
+ 8008ee2:	071f      	lsls	r7, r3, #28
+      msirange = READ_BIT(RCC->CSR, RCC_CSR_MSISRANGE) >> RCC_CSR_MSISRANGE_Pos;
+ 8008ee4:	bf55      	itete	pl
+ 8008ee6:	f8d4 3094 	ldrpl.w	r3, [r4, #148]	; 0x94
+      msirange = READ_BIT(RCC->CR, RCC_CR_MSIRANGE) >> RCC_CR_MSIRANGE_Pos;
+ 8008eea:	6823      	ldrmi	r3, [r4, #0]
+      msirange = READ_BIT(RCC->CSR, RCC_CSR_MSISRANGE) >> RCC_CSR_MSISRANGE_Pos;
+ 8008eec:	f3c3 2303 	ubfxpl	r3, r3, #8, #4
+      msirange = READ_BIT(RCC->CR, RCC_CR_MSIRANGE) >> RCC_CR_MSIRANGE_Pos;
+ 8008ef0:	f3c3 1303 	ubfxmi	r3, r3, #4, #4
+    msirange = MSIRangeTable[msirange];
+ 8008ef4:	f852 2023 	ldr.w	r2, [r2, r3, lsl #2]
+  }
+
+  /* PLL_VCO = (HSE_VALUE or HSI_VALUE or MSI_VALUE) * PLLN / PLLM
+     SYSCLK = PLL_VCO / PLLR
+   */
+  pllsource = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC);
+ 8008ef8:	68e3      	ldr	r3, [r4, #12]
+ 8008efa:	f003 0303 	and.w	r3, r3, #3
+
+  switch (pllsource)
+ 8008efe:	2b02      	cmp	r3, #2
+ 8008f00:	d035      	beq.n	8008f6e <HAL_RCC_ClockConfig+0x146>
+ 8008f02:	4843      	ldr	r0, [pc, #268]	; (8009010 <HAL_RCC_ClockConfig+0x1e8>)
+ 8008f04:	2b03      	cmp	r3, #3
+ 8008f06:	bf08      	it	eq
+ 8008f08:	4602      	moveq	r2, r0
+  case RCC_PLLSOURCE_MSI:  /* MSI used as PLL clock source */
+  default:
+    pllvco = msirange;
+    break;
+  }
+  pllm = (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U ;
+ 8008f0a:	68e0      	ldr	r0, [r4, #12]
+  pllvco = (pllvco * (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos)) / pllm;
+ 8008f0c:	68e3      	ldr	r3, [r4, #12]
+ 8008f0e:	f3c3 2306 	ubfx	r3, r3, #8, #7
+ 8008f12:	4353      	muls	r3, r2
+  pllr = ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLR) >> RCC_PLLCFGR_PLLR_Pos) + 1U ) * 2U;
+ 8008f14:	68e2      	ldr	r2, [r4, #12]
+ 8008f16:	f3c2 6241 	ubfx	r2, r2, #25, #2
+  pllm = (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U ;
+ 8008f1a:	f3c0 1003 	ubfx	r0, r0, #4, #4
+  pllr = ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLR) >> RCC_PLLCFGR_PLLR_Pos) + 1U ) * 2U;
+ 8008f1e:	3201      	adds	r2, #1
+ 8008f20:	0052      	lsls	r2, r2, #1
+  pllm = (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U ;
+ 8008f22:	3001      	adds	r0, #1
+  pllvco = (pllvco * (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos)) / pllm;
+ 8008f24:	fbb3 f3f0 	udiv	r3, r3, r0
+  sysclockfreq = pllvco / pllr;
+ 8008f28:	fbb3 f3f2 	udiv	r3, r3, r2
+      if(RCC_GetSysClockFreqFromPLLSource() > 80000000U)
+ 8008f2c:	4a39      	ldr	r2, [pc, #228]	; (8009014 <HAL_RCC_ClockConfig+0x1ec>)
+ 8008f2e:	4293      	cmp	r3, r2
+ 8008f30:	d81f      	bhi.n	8008f72 <HAL_RCC_ClockConfig+0x14a>
+  uint32_t hpre = RCC_SYSCLK_DIV1;
+ 8008f32:	2700      	movs	r7, #0
+    MODIFY_REG(RCC->CFGR, RCC_CFGR_SW, RCC_ClkInitStruct->SYSCLKSource);
+ 8008f34:	68a3      	ldr	r3, [r4, #8]
+ 8008f36:	686a      	ldr	r2, [r5, #4]
+ 8008f38:	f023 0303 	bic.w	r3, r3, #3
+ 8008f3c:	4313      	orrs	r3, r2
+ 8008f3e:	60a3      	str	r3, [r4, #8]
+    tickstart = HAL_GetTick();
+ 8008f40:	f7fe f906 	bl	8007150 <HAL_GetTick>
+      if((HAL_GetTick() - tickstart) > CLOCKSWITCH_TIMEOUT_VALUE)
+ 8008f44:	f241 3988 	movw	r9, #5000	; 0x1388
+    tickstart = HAL_GetTick();
+ 8008f48:	4680      	mov	r8, r0
+    while(__HAL_RCC_GET_SYSCLK_SOURCE() != (RCC_ClkInitStruct->SYSCLKSource << RCC_CFGR_SWS_Pos))
+ 8008f4a:	68a3      	ldr	r3, [r4, #8]
+ 8008f4c:	686a      	ldr	r2, [r5, #4]
+ 8008f4e:	f003 030c 	and.w	r3, r3, #12
+ 8008f52:	ebb3 0f82 	cmp.w	r3, r2, lsl #2
+ 8008f56:	f43f af79 	beq.w	8008e4c <HAL_RCC_ClockConfig+0x24>
+      if((HAL_GetTick() - tickstart) > CLOCKSWITCH_TIMEOUT_VALUE)
+ 8008f5a:	f7fe f8f9 	bl	8007150 <HAL_GetTick>
+ 8008f5e:	eba0 0008 	sub.w	r0, r0, r8
+ 8008f62:	4548      	cmp	r0, r9
+ 8008f64:	d9f1      	bls.n	8008f4a <HAL_RCC_ClockConfig+0x122>
+        return HAL_TIMEOUT;
+ 8008f66:	2003      	movs	r0, #3
+ 8008f68:	e764      	b.n	8008e34 <HAL_RCC_ClockConfig+0xc>
+  uint32_t msirange = 0U;
+ 8008f6a:	2200      	movs	r2, #0
+ 8008f6c:	e7c4      	b.n	8008ef8 <HAL_RCC_ClockConfig+0xd0>
+    pllvco = HSI_VALUE;
+ 8008f6e:	4a2a      	ldr	r2, [pc, #168]	; (8009018 <HAL_RCC_ClockConfig+0x1f0>)
+ 8008f70:	e7cb      	b.n	8008f0a <HAL_RCC_ClockConfig+0xe2>
+        if(READ_BIT(RCC->CFGR, RCC_CFGR_HPRE) == RCC_SYSCLK_DIV1)
+ 8008f72:	68a3      	ldr	r3, [r4, #8]
+ 8008f74:	f013 0ff0 	tst.w	r3, #240	; 0xf0
+ 8008f78:	d107      	bne.n	8008f8a <HAL_RCC_ClockConfig+0x162>
+        MODIFY_REG(RCC->CFGR, RCC_CFGR_HPRE, RCC_SYSCLK_DIV2);
+ 8008f7a:	68a3      	ldr	r3, [r4, #8]
+ 8008f7c:	f023 03f0 	bic.w	r3, r3, #240	; 0xf0
+ 8008f80:	f043 0380 	orr.w	r3, r3, #128	; 0x80
+ 8008f84:	60a3      	str	r3, [r4, #8]
+        hpre = RCC_SYSCLK_DIV2;
+ 8008f86:	2780      	movs	r7, #128	; 0x80
+ 8008f88:	e7d4      	b.n	8008f34 <HAL_RCC_ClockConfig+0x10c>
+        else if((((RCC_ClkInitStruct->ClockType) & RCC_CLOCKTYPE_HCLK) == RCC_CLOCKTYPE_HCLK) && (RCC_ClkInitStruct->AHBCLKDivider == RCC_SYSCLK_DIV1))
+ 8008f8a:	0788      	lsls	r0, r1, #30
+ 8008f8c:	d5d1      	bpl.n	8008f32 <HAL_RCC_ClockConfig+0x10a>
+ 8008f8e:	68ab      	ldr	r3, [r5, #8]
+ 8008f90:	2b00      	cmp	r3, #0
+ 8008f92:	d1ce      	bne.n	8008f32 <HAL_RCC_ClockConfig+0x10a>
+ 8008f94:	e7f1      	b.n	8008f7a <HAL_RCC_ClockConfig+0x152>
+      if(RCC_ClkInitStruct->SYSCLKSource == RCC_SYSCLKSOURCE_HSE)
+ 8008f96:	2b02      	cmp	r3, #2
+ 8008f98:	d10a      	bne.n	8008fb0 <HAL_RCC_ClockConfig+0x188>
+        if(READ_BIT(RCC->CR, RCC_CR_HSERDY) == 0U)
+ 8008f9a:	6823      	ldr	r3, [r4, #0]
+ 8008f9c:	f413 3f00 	tst.w	r3, #131072	; 0x20000
+        if(READ_BIT(RCC->CR, RCC_CR_HSIRDY) == 0U)
+ 8008fa0:	f43f af47 	beq.w	8008e32 <HAL_RCC_ClockConfig+0xa>
+      if(HAL_RCC_GetSysClockFreq() > 80000000U)
+ 8008fa4:	f7ff fc44 	bl	8008830 <HAL_RCC_GetSysClockFreq>
+ 8008fa8:	4b1a      	ldr	r3, [pc, #104]	; (8009014 <HAL_RCC_ClockConfig+0x1ec>)
+ 8008faa:	4298      	cmp	r0, r3
+ 8008fac:	d9c1      	bls.n	8008f32 <HAL_RCC_ClockConfig+0x10a>
+ 8008fae:	e7e4      	b.n	8008f7a <HAL_RCC_ClockConfig+0x152>
+      else if(RCC_ClkInitStruct->SYSCLKSource == RCC_SYSCLKSOURCE_MSI)
+ 8008fb0:	b91b      	cbnz	r3, 8008fba <HAL_RCC_ClockConfig+0x192>
+        if(READ_BIT(RCC->CR, RCC_CR_MSIRDY) == 0U)
+ 8008fb2:	6823      	ldr	r3, [r4, #0]
+ 8008fb4:	f013 0f02 	tst.w	r3, #2
+ 8008fb8:	e7f2      	b.n	8008fa0 <HAL_RCC_ClockConfig+0x178>
+        if(READ_BIT(RCC->CR, RCC_CR_HSIRDY) == 0U)
+ 8008fba:	6823      	ldr	r3, [r4, #0]
+ 8008fbc:	f413 6f80 	tst.w	r3, #1024	; 0x400
+ 8008fc0:	e7ee      	b.n	8008fa0 <HAL_RCC_ClockConfig+0x178>
+    if(hpre == RCC_SYSCLK_DIV2)
+ 8008fc2:	2f80      	cmp	r7, #128	; 0x80
+ 8008fc4:	f47f af4d 	bne.w	8008e62 <HAL_RCC_ClockConfig+0x3a>
+      MODIFY_REG(RCC->CFGR, RCC_CFGR_HPRE, RCC_SYSCLK_DIV1);
+ 8008fc8:	490c      	ldr	r1, [pc, #48]	; (8008ffc <HAL_RCC_ClockConfig+0x1d4>)
+ 8008fca:	688b      	ldr	r3, [r1, #8]
+ 8008fcc:	f023 03f0 	bic.w	r3, r3, #240	; 0xf0
+ 8008fd0:	e746      	b.n	8008e60 <HAL_RCC_ClockConfig+0x38>
+    __HAL_FLASH_SET_LATENCY(FLatency);
+ 8008fd2:	680b      	ldr	r3, [r1, #0]
+ 8008fd4:	f023 030f 	bic.w	r3, r3, #15
+ 8008fd8:	4333      	orrs	r3, r6
+ 8008fda:	600b      	str	r3, [r1, #0]
+    if(__HAL_FLASH_GET_LATENCY() != FLatency)
+ 8008fdc:	680b      	ldr	r3, [r1, #0]
+ 8008fde:	f003 030f 	and.w	r3, r3, #15
+ 8008fe2:	42b3      	cmp	r3, r6
+ 8008fe4:	f47f af25 	bne.w	8008e32 <HAL_RCC_ClockConfig+0xa>
+ 8008fe8:	e742      	b.n	8008e70 <HAL_RCC_ClockConfig+0x48>
+    MODIFY_REG(RCC->CFGR, RCC_CFGR_PPRE1, RCC_ClkInitStruct->APB1CLKDivider);
+ 8008fea:	68a3      	ldr	r3, [r4, #8]
+ 8008fec:	68e9      	ldr	r1, [r5, #12]
+ 8008fee:	f423 63e0 	bic.w	r3, r3, #1792	; 0x700
+ 8008ff2:	430b      	orrs	r3, r1
+ 8008ff4:	60a3      	str	r3, [r4, #8]
+ 8008ff6:	e740      	b.n	8008e7a <HAL_RCC_ClockConfig+0x52>
+ 8008ff8:	40022000 	.word	0x40022000
+ 8008ffc:	40021000 	.word	0x40021000
+ 8009000:	0800ea64 	.word	0x0800ea64
+ 8009004:	2009e2a8 	.word	0x2009e2a8
+ 8009008:	2009e2ac 	.word	0x2009e2ac
+ 800900c:	0800ea7c 	.word	0x0800ea7c
+ 8009010:	007a1200 	.word	0x007a1200
+ 8009014:	04c4b400 	.word	0x04c4b400
+ 8009018:	00f42400 	.word	0x00f42400
+
+0800901c <HAL_RCC_GetHCLKFreq>:
+}
+ 800901c:	4b01      	ldr	r3, [pc, #4]	; (8009024 <HAL_RCC_GetHCLKFreq+0x8>)
+ 800901e:	6818      	ldr	r0, [r3, #0]
+ 8009020:	4770      	bx	lr
+ 8009022:	bf00      	nop
+ 8009024:	2009e2a8 	.word	0x2009e2a8
+
+08009028 <HAL_RCC_GetPCLK1Freq>:
+  return (HAL_RCC_GetHCLKFreq() >> (APBPrescTable[READ_BIT(RCC->CFGR, RCC_CFGR_PPRE1) >> RCC_CFGR_PPRE1_Pos] & 0x1FU));
+ 8009028:	4b05      	ldr	r3, [pc, #20]	; (8009040 <HAL_RCC_GetPCLK1Freq+0x18>)
+ 800902a:	4a06      	ldr	r2, [pc, #24]	; (8009044 <HAL_RCC_GetPCLK1Freq+0x1c>)
+ 800902c:	689b      	ldr	r3, [r3, #8]
+ 800902e:	f3c3 2302 	ubfx	r3, r3, #8, #3
+ 8009032:	5cd3      	ldrb	r3, [r2, r3]
+ 8009034:	4a04      	ldr	r2, [pc, #16]	; (8009048 <HAL_RCC_GetPCLK1Freq+0x20>)
+ 8009036:	6810      	ldr	r0, [r2, #0]
+ 8009038:	f003 031f 	and.w	r3, r3, #31
+}
+ 800903c:	40d8      	lsrs	r0, r3
+ 800903e:	4770      	bx	lr
+ 8009040:	40021000 	.word	0x40021000
+ 8009044:	0800ea74 	.word	0x0800ea74
+ 8009048:	2009e2a8 	.word	0x2009e2a8
+
+0800904c <HAL_RCC_GetPCLK2Freq>:
+  return (HAL_RCC_GetHCLKFreq()>> (APBPrescTable[READ_BIT(RCC->CFGR, RCC_CFGR_PPRE2) >> RCC_CFGR_PPRE2_Pos] & 0x1FU));
+ 800904c:	4b05      	ldr	r3, [pc, #20]	; (8009064 <HAL_RCC_GetPCLK2Freq+0x18>)
+ 800904e:	4a06      	ldr	r2, [pc, #24]	; (8009068 <HAL_RCC_GetPCLK2Freq+0x1c>)
+ 8009050:	689b      	ldr	r3, [r3, #8]
+ 8009052:	f3c3 23c2 	ubfx	r3, r3, #11, #3
+ 8009056:	5cd3      	ldrb	r3, [r2, r3]
+ 8009058:	4a04      	ldr	r2, [pc, #16]	; (800906c <HAL_RCC_GetPCLK2Freq+0x20>)
+ 800905a:	6810      	ldr	r0, [r2, #0]
+ 800905c:	f003 031f 	and.w	r3, r3, #31
+}
+ 8009060:	40d8      	lsrs	r0, r3
+ 8009062:	4770      	bx	lr
+ 8009064:	40021000 	.word	0x40021000
+ 8009068:	0800ea74 	.word	0x0800ea74
+ 800906c:	2009e2a8 	.word	0x2009e2a8
+
+08009070 <HAL_RCC_GetOscConfig>:
+  RCC_OscInitStruct->OscillatorType = RCC_OSCILLATORTYPE_HSE | RCC_OSCILLATORTYPE_HSI | RCC_OSCILLATORTYPE_MSI | \
+ 8009070:	233f      	movs	r3, #63	; 0x3f
+ 8009072:	6003      	str	r3, [r0, #0]
+  if(READ_BIT(RCC->CR, RCC_CR_HSEBYP) == RCC_CR_HSEBYP)
+ 8009074:	4b2e      	ldr	r3, [pc, #184]	; (8009130 <HAL_RCC_GetOscConfig+0xc0>)
+ 8009076:	681a      	ldr	r2, [r3, #0]
+ 8009078:	0351      	lsls	r1, r2, #13
+ 800907a:	d54a      	bpl.n	8009112 <HAL_RCC_GetOscConfig+0xa2>
+    RCC_OscInitStruct->HSEState = RCC_HSE_BYPASS;
+ 800907c:	f44f 22a0 	mov.w	r2, #327680	; 0x50000
+    RCC_OscInitStruct->HSEState = RCC_HSE_OFF;
+ 8009080:	6042      	str	r2, [r0, #4]
+  if(READ_BIT(RCC->CR, RCC_CR_MSION) == RCC_CR_MSION)
+ 8009082:	681a      	ldr	r2, [r3, #0]
+ 8009084:	f002 0201 	and.w	r2, r2, #1
+ 8009088:	6182      	str	r2, [r0, #24]
+  RCC_OscInitStruct->MSICalibrationValue = READ_BIT(RCC->ICSCR, RCC_ICSCR_MSITRIM) >> RCC_ICSCR_MSITRIM_Pos;
+ 800908a:	685a      	ldr	r2, [r3, #4]
+ 800908c:	f3c2 2207 	ubfx	r2, r2, #8, #8
+ 8009090:	61c2      	str	r2, [r0, #28]
+  RCC_OscInitStruct->MSIClockRange = READ_BIT(RCC->CR, RCC_CR_MSIRANGE);
+ 8009092:	681a      	ldr	r2, [r3, #0]
+ 8009094:	f002 02f0 	and.w	r2, r2, #240	; 0xf0
+ 8009098:	6202      	str	r2, [r0, #32]
+  if(READ_BIT(RCC->CR, RCC_CR_HSION) == RCC_CR_HSION)
+ 800909a:	681a      	ldr	r2, [r3, #0]
+    RCC_OscInitStruct->HSIState = RCC_HSI_ON;
+ 800909c:	f402 7280 	and.w	r2, r2, #256	; 0x100
+ 80090a0:	60c2      	str	r2, [r0, #12]
+  RCC_OscInitStruct->HSICalibrationValue = READ_BIT(RCC->ICSCR, RCC_ICSCR_HSITRIM) >> RCC_ICSCR_HSITRIM_Pos;
+ 80090a2:	685a      	ldr	r2, [r3, #4]
+ 80090a4:	f3c2 6206 	ubfx	r2, r2, #24, #7
+ 80090a8:	6102      	str	r2, [r0, #16]
+  if(READ_BIT(RCC->BDCR, RCC_BDCR_LSEBYP) == RCC_BDCR_LSEBYP)
+ 80090aa:	f8d3 2090 	ldr.w	r2, [r3, #144]	; 0x90
+ 80090ae:	0752      	lsls	r2, r2, #29
+ 80090b0:	d536      	bpl.n	8009120 <HAL_RCC_GetOscConfig+0xb0>
+      RCC_OscInitStruct->LSEState = RCC_LSE_BYPASS;
+ 80090b2:	2205      	movs	r2, #5
+    RCC_OscInitStruct->LSEState = RCC_LSE_OFF;
+ 80090b4:	6082      	str	r2, [r0, #8]
+  if(READ_BIT(RCC->CSR, RCC_CSR_LSION) == RCC_CSR_LSION)
+ 80090b6:	f8d3 2094 	ldr.w	r2, [r3, #148]	; 0x94
+ 80090ba:	f002 0201 	and.w	r2, r2, #1
+ 80090be:	6142      	str	r2, [r0, #20]
+  if(READ_BIT(RCC->CRRCR, RCC_CRRCR_HSI48ON) == RCC_CRRCR_HSI48ON)
+ 80090c0:	f8d3 2098 	ldr.w	r2, [r3, #152]	; 0x98
+ 80090c4:	f002 0201 	and.w	r2, r2, #1
+ 80090c8:	6242      	str	r2, [r0, #36]	; 0x24
+  if(READ_BIT(RCC->CR, RCC_CR_PLLON) == RCC_CR_PLLON)
+ 80090ca:	681a      	ldr	r2, [r3, #0]
+    RCC_OscInitStruct->PLL.PLLState = RCC_PLL_OFF;
+ 80090cc:	f012 7f80 	tst.w	r2, #16777216	; 0x1000000
+ 80090d0:	bf14      	ite	ne
+ 80090d2:	2202      	movne	r2, #2
+ 80090d4:	2201      	moveq	r2, #1
+ 80090d6:	6282      	str	r2, [r0, #40]	; 0x28
+  RCC_OscInitStruct->PLL.PLLSource = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC);
+ 80090d8:	68da      	ldr	r2, [r3, #12]
+ 80090da:	f002 0203 	and.w	r2, r2, #3
+ 80090de:	62c2      	str	r2, [r0, #44]	; 0x2c
+  RCC_OscInitStruct->PLL.PLLM = (READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U;
+ 80090e0:	68da      	ldr	r2, [r3, #12]
+ 80090e2:	f3c2 1203 	ubfx	r2, r2, #4, #4
+ 80090e6:	3201      	adds	r2, #1
+ 80090e8:	6302      	str	r2, [r0, #48]	; 0x30
+  RCC_OscInitStruct->PLL.PLLN = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 80090ea:	68da      	ldr	r2, [r3, #12]
+ 80090ec:	f3c2 2206 	ubfx	r2, r2, #8, #7
+ 80090f0:	6342      	str	r2, [r0, #52]	; 0x34
+  RCC_OscInitStruct->PLL.PLLQ = (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U);
+ 80090f2:	68da      	ldr	r2, [r3, #12]
+ 80090f4:	f3c2 5241 	ubfx	r2, r2, #21, #2
+ 80090f8:	3201      	adds	r2, #1
+ 80090fa:	0052      	lsls	r2, r2, #1
+ 80090fc:	63c2      	str	r2, [r0, #60]	; 0x3c
+  RCC_OscInitStruct->PLL.PLLR = (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLR) >> RCC_PLLCFGR_PLLR_Pos) + 1U) << 1U);
+ 80090fe:	68da      	ldr	r2, [r3, #12]
+ 8009100:	f3c2 6241 	ubfx	r2, r2, #25, #2
+ 8009104:	3201      	adds	r2, #1
+ 8009106:	0052      	lsls	r2, r2, #1
+ 8009108:	6402      	str	r2, [r0, #64]	; 0x40
+  RCC_OscInitStruct->PLL.PLLP = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLPDIV) >> RCC_PLLCFGR_PLLPDIV_Pos;
+ 800910a:	68db      	ldr	r3, [r3, #12]
+ 800910c:	0edb      	lsrs	r3, r3, #27
+ 800910e:	6383      	str	r3, [r0, #56]	; 0x38
+}
+ 8009110:	4770      	bx	lr
+  else if(READ_BIT(RCC->CR, RCC_CR_HSEON) == RCC_CR_HSEON)
+ 8009112:	681a      	ldr	r2, [r3, #0]
+ 8009114:	f412 3280 	ands.w	r2, r2, #65536	; 0x10000
+    RCC_OscInitStruct->HSEState = RCC_HSE_ON;
+ 8009118:	bf18      	it	ne
+ 800911a:	f44f 3280 	movne.w	r2, #65536	; 0x10000
+ 800911e:	e7af      	b.n	8009080 <HAL_RCC_GetOscConfig+0x10>
+  else if(READ_BIT(RCC->BDCR, RCC_BDCR_LSEON) == RCC_BDCR_LSEON)
+ 8009120:	f8d3 2090 	ldr.w	r2, [r3, #144]	; 0x90
+ 8009124:	f012 0201 	ands.w	r2, r2, #1
+      RCC_OscInitStruct->LSEState = RCC_LSE_ON;
+ 8009128:	bf18      	it	ne
+ 800912a:	2201      	movne	r2, #1
+ 800912c:	e7c2      	b.n	80090b4 <HAL_RCC_GetOscConfig+0x44>
+ 800912e:	bf00      	nop
+ 8009130:	40021000 	.word	0x40021000
+
+08009134 <HAL_RCC_GetClockConfig>:
+  RCC_ClkInitStruct->ClockType = RCC_CLOCKTYPE_SYSCLK | RCC_CLOCKTYPE_HCLK | RCC_CLOCKTYPE_PCLK1 | RCC_CLOCKTYPE_PCLK2;
+ 8009134:	230f      	movs	r3, #15
+ 8009136:	6003      	str	r3, [r0, #0]
+  RCC_ClkInitStruct->SYSCLKSource = READ_BIT(RCC->CFGR, RCC_CFGR_SW);
+ 8009138:	4b0b      	ldr	r3, [pc, #44]	; (8009168 <HAL_RCC_GetClockConfig+0x34>)
+ 800913a:	689a      	ldr	r2, [r3, #8]
+ 800913c:	f002 0203 	and.w	r2, r2, #3
+ 8009140:	6042      	str	r2, [r0, #4]
+  RCC_ClkInitStruct->AHBCLKDivider = READ_BIT(RCC->CFGR, RCC_CFGR_HPRE);
+ 8009142:	689a      	ldr	r2, [r3, #8]
+ 8009144:	f002 02f0 	and.w	r2, r2, #240	; 0xf0
+ 8009148:	6082      	str	r2, [r0, #8]
+  RCC_ClkInitStruct->APB1CLKDivider = READ_BIT(RCC->CFGR, RCC_CFGR_PPRE1);
+ 800914a:	689a      	ldr	r2, [r3, #8]
+ 800914c:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+ 8009150:	60c2      	str	r2, [r0, #12]
+  RCC_ClkInitStruct->APB2CLKDivider = (READ_BIT(RCC->CFGR, RCC_CFGR_PPRE2) >> 3U);
+ 8009152:	689b      	ldr	r3, [r3, #8]
+ 8009154:	08db      	lsrs	r3, r3, #3
+ 8009156:	f403 63e0 	and.w	r3, r3, #1792	; 0x700
+ 800915a:	6103      	str	r3, [r0, #16]
+  *pFLatency = __HAL_FLASH_GET_LATENCY();
+ 800915c:	4b03      	ldr	r3, [pc, #12]	; (800916c <HAL_RCC_GetClockConfig+0x38>)
+ 800915e:	681b      	ldr	r3, [r3, #0]
+ 8009160:	f003 030f 	and.w	r3, r3, #15
+ 8009164:	600b      	str	r3, [r1, #0]
+}
+ 8009166:	4770      	bx	lr
+ 8009168:	40021000 	.word	0x40021000
+ 800916c:	40022000 	.word	0x40022000
+
+08009170 <HAL_RCC_EnableCSS>:
+  SET_BIT(RCC->CR, RCC_CR_CSSON) ;
+ 8009170:	4a02      	ldr	r2, [pc, #8]	; (800917c <HAL_RCC_EnableCSS+0xc>)
+ 8009172:	6813      	ldr	r3, [r2, #0]
+ 8009174:	f443 2300 	orr.w	r3, r3, #524288	; 0x80000
+ 8009178:	6013      	str	r3, [r2, #0]
+}
+ 800917a:	4770      	bx	lr
+ 800917c:	40021000 	.word	0x40021000
+
+08009180 <HAL_RCC_CSSCallback>:
+}
+ 8009180:	4770      	bx	lr
+	...
+
+08009184 <HAL_RCC_NMI_IRQHandler>:
+{
+ 8009184:	b510      	push	{r4, lr}
+  if(__HAL_RCC_GET_IT(RCC_IT_CSS))
+ 8009186:	4c05      	ldr	r4, [pc, #20]	; (800919c <HAL_RCC_NMI_IRQHandler+0x18>)
+ 8009188:	69e3      	ldr	r3, [r4, #28]
+ 800918a:	05db      	lsls	r3, r3, #23
+ 800918c:	d504      	bpl.n	8009198 <HAL_RCC_NMI_IRQHandler+0x14>
+    HAL_RCC_CSSCallback();
+ 800918e:	f7ff fff7 	bl	8009180 <HAL_RCC_CSSCallback>
+    __HAL_RCC_CLEAR_IT(RCC_IT_CSS);
+ 8009192:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 8009196:	6223      	str	r3, [r4, #32]
+}
+ 8009198:	bd10      	pop	{r4, pc}
+ 800919a:	bf00      	nop
+ 800919c:	40021000 	.word	0x40021000
+
+080091a0 <RCCEx_GetSAIxPeriphCLKFreq>:
+#if defined(RCC_PLLP_SUPPORT)
+  uint32_t pllp = 0U;
+#endif /* RCC_PLLP_SUPPORT */
+
+  /* Handle SAIs */
+  if(PeriphClk == RCC_PERIPHCLK_SAI1)
+ 80091a0:	f5b0 6f00 	cmp.w	r0, #2048	; 0x800
+ 80091a4:	4a3d      	ldr	r2, [pc, #244]	; (800929c <RCCEx_GetSAIxPeriphCLKFreq+0xfc>)
+ 80091a6:	d108      	bne.n	80091ba <RCCEx_GetSAIxPeriphCLKFreq+0x1a>
+  {
+    srcclk = __HAL_RCC_GET_SAI1_SOURCE();
+ 80091a8:	f8d2 309c 	ldr.w	r3, [r2, #156]	; 0x9c
+ 80091ac:	f003 03e0 	and.w	r3, r3, #224	; 0xe0
+    if(srcclk == RCC_SAI1CLKSOURCE_PIN)
+ 80091b0:	2b60      	cmp	r3, #96	; 0x60
+ 80091b2:	d12d      	bne.n	8009210 <RCCEx_GetSAIxPeriphCLKFreq+0x70>
+    {
+      frequency = EXTERNAL_SAI1_CLOCK_VALUE;
+ 80091b4:	f64b 3080 	movw	r0, #48000	; 0xbb80
+ 80091b8:	4770      	bx	lr
+    /* Else, PLL clock output to check below */
+  }
+#if defined(SAI2)
+  else
+  {
+    if(PeriphClk == RCC_PERIPHCLK_SAI2)
+ 80091ba:	f5b0 5f80 	cmp.w	r0, #4096	; 0x1000
+ 80091be:	d12a      	bne.n	8009216 <RCCEx_GetSAIxPeriphCLKFreq+0x76>
+    {
+      srcclk = __HAL_RCC_GET_SAI2_SOURCE();
+ 80091c0:	f8d2 309c 	ldr.w	r3, [r2, #156]	; 0x9c
+ 80091c4:	f403 63e0 	and.w	r3, r3, #1792	; 0x700
+      if(srcclk == RCC_SAI2CLKSOURCE_PIN)
+ 80091c8:	f5b3 7f40 	cmp.w	r3, #768	; 0x300
+ 80091cc:	d0f2      	beq.n	80091b4 <RCCEx_GetSAIxPeriphCLKFreq+0x14>
+  if(frequency == 0U)
+  {
+    pllvco = InputFrequency;
+
+#if defined(SAI2)
+    if((srcclk == RCC_SAI1CLKSOURCE_PLL) || (srcclk == RCC_SAI2CLKSOURCE_PLL))
+ 80091ce:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 80091d2:	d15c      	bne.n	800928e <RCCEx_GetSAIxPeriphCLKFreq+0xee>
+    {
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLRDY) && (__HAL_RCC_GET_PLLCLKOUT_CONFIG(RCC_PLL_SAI3CLK) != 0U))
+ 80091d4:	6810      	ldr	r0, [r2, #0]
+ 80091d6:	f010 7000 	ands.w	r0, r0, #33554432	; 0x2000000
+ 80091da:	d05d      	beq.n	8009298 <RCCEx_GetSAIxPeriphCLKFreq+0xf8>
+ 80091dc:	68d0      	ldr	r0, [r2, #12]
+ 80091de:	f410 3080 	ands.w	r0, r0, #65536	; 0x10000
+ 80091e2:	d059      	beq.n	8009298 <RCCEx_GetSAIxPeriphCLKFreq+0xf8>
+      {
+        /* f(PLL Source) / PLLM */
+        pllvco = (pllvco / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 80091e4:	68d0      	ldr	r0, [r2, #12]
+ 80091e6:	f3c0 1003 	ubfx	r0, r0, #4, #4
+ 80091ea:	3001      	adds	r0, #1
+ 80091ec:	fbb1 f0f0 	udiv	r0, r1, r0
+        /* f(PLLSAI3CLK) = f(VCO input) * PLLN / PLLP */
+        plln = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 80091f0:	68d1      	ldr	r1, [r2, #12]
+#if defined(RCC_PLLP_DIV_2_31_SUPPORT)
+        pllp = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLPDIV) >> RCC_PLLCFGR_PLLPDIV_Pos;
+ 80091f2:	68d3      	ldr	r3, [r2, #12]
+#endif
+        if(pllp == 0U)
+ 80091f4:	0edb      	lsrs	r3, r3, #27
+        plln = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 80091f6:	f3c1 2106 	ubfx	r1, r1, #8, #7
+        if(pllp == 0U)
+ 80091fa:	d105      	bne.n	8009208 <RCCEx_GetSAIxPeriphCLKFreq+0x68>
+        {
+          if(READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLP) != 0U)
+ 80091fc:	68d3      	ldr	r3, [r2, #12]
+          {
+            pllp = 17U;
+          }
+          else
+          {
+            pllp = 7U;
+ 80091fe:	f413 3f00 	tst.w	r3, #131072	; 0x20000
+ 8009202:	bf14      	ite	ne
+ 8009204:	2311      	movne	r3, #17
+ 8009206:	2307      	moveq	r3, #7
+          }
+        }
+        frequency = (pllvco * plln) / pllp;
+ 8009208:	4348      	muls	r0, r1
+ 800920a:	fbb0 f0f3 	udiv	r0, r0, r3
+ 800920e:	4770      	bx	lr
+    if((srcclk == RCC_SAI1CLKSOURCE_PLL) || (srcclk == RCC_SAI2CLKSOURCE_PLL))
+ 8009210:	2b40      	cmp	r3, #64	; 0x40
+ 8009212:	d0df      	beq.n	80091d4 <RCCEx_GetSAIxPeriphCLKFreq+0x34>
+    else if(srcclk == 0U)  /* RCC_SAI1CLKSOURCE_PLLSAI1 || RCC_SAI2CLKSOURCE_PLLSAI1 */
+ 8009214:	b9ab      	cbnz	r3, 8009242 <RCCEx_GetSAIxPeriphCLKFreq+0xa2>
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLSAI1RDY) && (__HAL_RCC_GET_PLLSAI1CLKOUT_CONFIG(RCC_PLLSAI1_SAI1CLK) != 0U))
+ 8009216:	6810      	ldr	r0, [r2, #0]
+ 8009218:	f010 6000 	ands.w	r0, r0, #134217728	; 0x8000000
+ 800921c:	d03c      	beq.n	8009298 <RCCEx_GetSAIxPeriphCLKFreq+0xf8>
+ 800921e:	6910      	ldr	r0, [r2, #16]
+ 8009220:	f410 3080 	ands.w	r0, r0, #65536	; 0x10000
+ 8009224:	d038      	beq.n	8009298 <RCCEx_GetSAIxPeriphCLKFreq+0xf8>
+        pllvco = (pllvco / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009226:	6913      	ldr	r3, [r2, #16]
+        plln = READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1N) >> RCC_PLLSAI1CFGR_PLLSAI1N_Pos;
+ 8009228:	6910      	ldr	r0, [r2, #16]
+        pllvco = (pllvco / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 800922a:	f3c3 1303 	ubfx	r3, r3, #4, #4
+ 800922e:	3301      	adds	r3, #1
+ 8009230:	fbb1 f1f3 	udiv	r1, r1, r3
+        pllp = READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1PDIV) >> RCC_PLLSAI1CFGR_PLLSAI1PDIV_Pos;
+ 8009234:	6913      	ldr	r3, [r2, #16]
+        if(pllp == 0U)
+ 8009236:	0edb      	lsrs	r3, r3, #27
+        plln = READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1N) >> RCC_PLLSAI1CFGR_PLLSAI1N_Pos;
+ 8009238:	f3c0 2006 	ubfx	r0, r0, #8, #7
+        if(pllp == 0U)
+ 800923c:	d1e4      	bne.n	8009208 <RCCEx_GetSAIxPeriphCLKFreq+0x68>
+          if(READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1P) != 0U)
+ 800923e:	6913      	ldr	r3, [r2, #16]
+ 8009240:	e7dd      	b.n	80091fe <RCCEx_GetSAIxPeriphCLKFreq+0x5e>
+    else if((srcclk == RCC_SAI1CLKSOURCE_HSI) || (srcclk == RCC_SAI2CLKSOURCE_HSI))
+ 8009242:	2b80      	cmp	r3, #128	; 0x80
+ 8009244:	d106      	bne.n	8009254 <RCCEx_GetSAIxPeriphCLKFreq+0xb4>
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_HSIRDY))
+ 8009246:	6810      	ldr	r0, [r2, #0]
+        frequency = HSI_VALUE;
+ 8009248:	4b15      	ldr	r3, [pc, #84]	; (80092a0 <RCCEx_GetSAIxPeriphCLKFreq+0x100>)
+ 800924a:	f410 6080 	ands.w	r0, r0, #1024	; 0x400
+ 800924e:	bf18      	it	ne
+ 8009250:	4618      	movne	r0, r3
+ 8009252:	4770      	bx	lr
+    else if((srcclk == RCC_SAI1CLKSOURCE_PLLSAI2) || (srcclk == RCC_SAI2CLKSOURCE_PLLSAI2))
+ 8009254:	2b20      	cmp	r3, #32
+ 8009256:	d002      	beq.n	800925e <RCCEx_GetSAIxPeriphCLKFreq+0xbe>
+ 8009258:	f5b3 7f80 	cmp.w	r3, #256	; 0x100
+ 800925c:	d115      	bne.n	800928a <RCCEx_GetSAIxPeriphCLKFreq+0xea>
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLSAI2RDY) && (__HAL_RCC_GET_PLLSAI2CLKOUT_CONFIG(RCC_PLLSAI2_SAI2CLK) != 0U))
+ 800925e:	6810      	ldr	r0, [r2, #0]
+ 8009260:	f010 5000 	ands.w	r0, r0, #536870912	; 0x20000000
+ 8009264:	d018      	beq.n	8009298 <RCCEx_GetSAIxPeriphCLKFreq+0xf8>
+ 8009266:	6950      	ldr	r0, [r2, #20]
+ 8009268:	f410 3080 	ands.w	r0, r0, #65536	; 0x10000
+ 800926c:	d014      	beq.n	8009298 <RCCEx_GetSAIxPeriphCLKFreq+0xf8>
+        pllvco = (pllvco / ((READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2M) >> RCC_PLLSAI2CFGR_PLLSAI2M_Pos) + 1U));
+ 800926e:	6953      	ldr	r3, [r2, #20]
+ 8009270:	f3c3 1303 	ubfx	r3, r3, #4, #4
+ 8009274:	3301      	adds	r3, #1
+ 8009276:	fbb1 f0f3 	udiv	r0, r1, r3
+        plln = READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2N) >> RCC_PLLSAI2CFGR_PLLSAI2N_Pos;
+ 800927a:	6951      	ldr	r1, [r2, #20]
+        pllp = READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2PDIV) >> RCC_PLLSAI2CFGR_PLLSAI2PDIV_Pos;
+ 800927c:	6953      	ldr	r3, [r2, #20]
+        if(pllp == 0U)
+ 800927e:	0edb      	lsrs	r3, r3, #27
+        plln = READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2N) >> RCC_PLLSAI2CFGR_PLLSAI2N_Pos;
+ 8009280:	f3c1 2106 	ubfx	r1, r1, #8, #7
+        if(pllp == 0U)
+ 8009284:	d1c0      	bne.n	8009208 <RCCEx_GetSAIxPeriphCLKFreq+0x68>
+          if(READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2P) != 0U)
+ 8009286:	6953      	ldr	r3, [r2, #20]
+ 8009288:	e7b9      	b.n	80091fe <RCCEx_GetSAIxPeriphCLKFreq+0x5e>
+ 800928a:	2000      	movs	r0, #0
+      /* No clock source, frequency default init at 0 */
+    }
+  }
+
+
+  return frequency;
+ 800928c:	4770      	bx	lr
+    else if(srcclk == 0U)  /* RCC_SAI1CLKSOURCE_PLLSAI1 || RCC_SAI2CLKSOURCE_PLLSAI1 */
+ 800928e:	2b00      	cmp	r3, #0
+ 8009290:	d0c1      	beq.n	8009216 <RCCEx_GetSAIxPeriphCLKFreq+0x76>
+    else if((srcclk == RCC_SAI1CLKSOURCE_HSI) || (srcclk == RCC_SAI2CLKSOURCE_HSI))
+ 8009292:	f5b3 6f80 	cmp.w	r3, #1024	; 0x400
+ 8009296:	e7d5      	b.n	8009244 <RCCEx_GetSAIxPeriphCLKFreq+0xa4>
+}
+ 8009298:	4770      	bx	lr
+ 800929a:	bf00      	nop
+ 800929c:	40021000 	.word	0x40021000
+ 80092a0:	00f42400 	.word	0x00f42400
+
+080092a4 <RCCEx_PLLSAI1_Config>:
+{
+ 80092a4:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() != RCC_PLLSOURCE_NONE)
+ 80092a6:	4c3c      	ldr	r4, [pc, #240]	; (8009398 <RCCEx_PLLSAI1_Config+0xf4>)
+    if((__HAL_RCC_GET_PLL_OSCSOURCE() != PllSai1->PLLSAI1Source)
+ 80092a8:	6803      	ldr	r3, [r0, #0]
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() != RCC_PLLSOURCE_NONE)
+ 80092aa:	68e2      	ldr	r2, [r4, #12]
+{
+ 80092ac:	4605      	mov	r5, r0
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() != RCC_PLLSOURCE_NONE)
+ 80092ae:	0790      	lsls	r0, r2, #30
+{
+ 80092b0:	460f      	mov	r7, r1
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() != RCC_PLLSOURCE_NONE)
+ 80092b2:	d023      	beq.n	80092fc <RCCEx_PLLSAI1_Config+0x58>
+    if((__HAL_RCC_GET_PLL_OSCSOURCE() != PllSai1->PLLSAI1Source)
+ 80092b4:	68e2      	ldr	r2, [r4, #12]
+ 80092b6:	f002 0203 	and.w	r2, r2, #3
+ 80092ba:	429a      	cmp	r2, r3
+ 80092bc:	d16a      	bne.n	8009394 <RCCEx_PLLSAI1_Config+0xf0>
+       ||
+ 80092be:	2a00      	cmp	r2, #0
+ 80092c0:	d068      	beq.n	8009394 <RCCEx_PLLSAI1_Config+0xf0>
+    __HAL_RCC_PLLSAI1_DISABLE();
+ 80092c2:	6823      	ldr	r3, [r4, #0]
+ 80092c4:	f023 6380 	bic.w	r3, r3, #67108864	; 0x4000000
+ 80092c8:	6023      	str	r3, [r4, #0]
+    tickstart = HAL_GetTick();
+ 80092ca:	f7fd ff41 	bl	8007150 <HAL_GetTick>
+ 80092ce:	4606      	mov	r6, r0
+    while(READ_BIT(RCC->CR, RCC_CR_PLLSAI1RDY) != 0U)
+ 80092d0:	6823      	ldr	r3, [r4, #0]
+ 80092d2:	011a      	lsls	r2, r3, #4
+ 80092d4:	d42d      	bmi.n	8009332 <RCCEx_PLLSAI1_Config+0x8e>
+        MODIFY_REG(RCC->PLLSAI1CFGR,
+ 80092d6:	68ab      	ldr	r3, [r5, #8]
+ 80092d8:	021e      	lsls	r6, r3, #8
+ 80092da:	686b      	ldr	r3, [r5, #4]
+ 80092dc:	3b01      	subs	r3, #1
+ 80092de:	0118      	lsls	r0, r3, #4
+      if(Divider == DIVIDER_P_UPDATE)
+ 80092e0:	b377      	cbz	r7, 8009340 <RCCEx_PLLSAI1_Config+0x9c>
+      else if(Divider == DIVIDER_Q_UPDATE)
+ 80092e2:	2f01      	cmp	r7, #1
+ 80092e4:	d145      	bne.n	8009372 <RCCEx_PLLSAI1_Config+0xce>
+        MODIFY_REG(RCC->PLLSAI1CFGR,
+ 80092e6:	692b      	ldr	r3, [r5, #16]
+ 80092e8:	6927      	ldr	r7, [r4, #16]
+ 80092ea:	085b      	lsrs	r3, r3, #1
+ 80092ec:	1e59      	subs	r1, r3, #1
+ 80092ee:	4b2b      	ldr	r3, [pc, #172]	; (800939c <RCCEx_PLLSAI1_Config+0xf8>)
+ 80092f0:	403b      	ands	r3, r7
+ 80092f2:	4333      	orrs	r3, r6
+ 80092f4:	4303      	orrs	r3, r0
+ 80092f6:	ea43 5341 	orr.w	r3, r3, r1, lsl #21
+ 80092fa:	e029      	b.n	8009350 <RCCEx_PLLSAI1_Config+0xac>
+    switch(PllSai1->PLLSAI1Source)
+ 80092fc:	2b02      	cmp	r3, #2
+ 80092fe:	d00d      	beq.n	800931c <RCCEx_PLLSAI1_Config+0x78>
+ 8009300:	2b03      	cmp	r3, #3
+ 8009302:	d00f      	beq.n	8009324 <RCCEx_PLLSAI1_Config+0x80>
+ 8009304:	2b01      	cmp	r3, #1
+ 8009306:	d145      	bne.n	8009394 <RCCEx_PLLSAI1_Config+0xf0>
+      if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_MSIRDY))
+ 8009308:	6822      	ldr	r2, [r4, #0]
+ 800930a:	f012 0f02 	tst.w	r2, #2
+        if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSEBYP))
+ 800930e:	d041      	beq.n	8009394 <RCCEx_PLLSAI1_Config+0xf0>
+      MODIFY_REG(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC, PllSai1->PLLSAI1Source);
+ 8009310:	68e0      	ldr	r0, [r4, #12]
+ 8009312:	f020 0003 	bic.w	r0, r0, #3
+ 8009316:	4318      	orrs	r0, r3
+ 8009318:	60e0      	str	r0, [r4, #12]
+  if(status == HAL_OK)
+ 800931a:	e7d2      	b.n	80092c2 <RCCEx_PLLSAI1_Config+0x1e>
+      if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSIRDY))
+ 800931c:	6822      	ldr	r2, [r4, #0]
+ 800931e:	f412 6f80 	tst.w	r2, #1024	; 0x400
+ 8009322:	e7f4      	b.n	800930e <RCCEx_PLLSAI1_Config+0x6a>
+      if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSERDY))
+ 8009324:	6822      	ldr	r2, [r4, #0]
+ 8009326:	0391      	lsls	r1, r2, #14
+ 8009328:	d4f2      	bmi.n	8009310 <RCCEx_PLLSAI1_Config+0x6c>
+        if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSEBYP))
+ 800932a:	6822      	ldr	r2, [r4, #0]
+ 800932c:	f412 2f80 	tst.w	r2, #262144	; 0x40000
+ 8009330:	e7ed      	b.n	800930e <RCCEx_PLLSAI1_Config+0x6a>
+      if((HAL_GetTick() - tickstart) > PLLSAI1_TIMEOUT_VALUE)
+ 8009332:	f7fd ff0d 	bl	8007150 <HAL_GetTick>
+ 8009336:	1b80      	subs	r0, r0, r6
+ 8009338:	2802      	cmp	r0, #2
+ 800933a:	d9c9      	bls.n	80092d0 <RCCEx_PLLSAI1_Config+0x2c>
+        status = HAL_TIMEOUT;
+ 800933c:	2003      	movs	r0, #3
+}
+ 800933e:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+        MODIFY_REG(RCC->PLLSAI1CFGR,
+ 8009340:	68e9      	ldr	r1, [r5, #12]
+ 8009342:	6922      	ldr	r2, [r4, #16]
+ 8009344:	ea46 63c1 	orr.w	r3, r6, r1, lsl #27
+ 8009348:	4915      	ldr	r1, [pc, #84]	; (80093a0 <RCCEx_PLLSAI1_Config+0xfc>)
+ 800934a:	4011      	ands	r1, r2
+ 800934c:	430b      	orrs	r3, r1
+ 800934e:	4303      	orrs	r3, r0
+        MODIFY_REG(RCC->PLLSAI1CFGR,
+ 8009350:	6123      	str	r3, [r4, #16]
+      __HAL_RCC_PLLSAI1_ENABLE();
+ 8009352:	6823      	ldr	r3, [r4, #0]
+ 8009354:	f043 6380 	orr.w	r3, r3, #67108864	; 0x4000000
+ 8009358:	6023      	str	r3, [r4, #0]
+      tickstart = HAL_GetTick();
+ 800935a:	f7fd fef9 	bl	8007150 <HAL_GetTick>
+ 800935e:	4606      	mov	r6, r0
+      while(READ_BIT(RCC->CR, RCC_CR_PLLSAI1RDY) == 0U)
+ 8009360:	6823      	ldr	r3, [r4, #0]
+ 8009362:	011b      	lsls	r3, r3, #4
+ 8009364:	d510      	bpl.n	8009388 <RCCEx_PLLSAI1_Config+0xe4>
+        __HAL_RCC_PLLSAI1CLKOUT_ENABLE(PllSai1->PLLSAI1ClockOut);
+ 8009366:	6923      	ldr	r3, [r4, #16]
+ 8009368:	69aa      	ldr	r2, [r5, #24]
+ 800936a:	4313      	orrs	r3, r2
+ 800936c:	6123      	str	r3, [r4, #16]
+ 800936e:	2000      	movs	r0, #0
+  return status;
+ 8009370:	e7e5      	b.n	800933e <RCCEx_PLLSAI1_Config+0x9a>
+        MODIFY_REG(RCC->PLLSAI1CFGR,
+ 8009372:	696b      	ldr	r3, [r5, #20]
+ 8009374:	6921      	ldr	r1, [r4, #16]
+ 8009376:	085b      	lsrs	r3, r3, #1
+ 8009378:	1e5a      	subs	r2, r3, #1
+ 800937a:	4b0a      	ldr	r3, [pc, #40]	; (80093a4 <RCCEx_PLLSAI1_Config+0x100>)
+ 800937c:	400b      	ands	r3, r1
+ 800937e:	4333      	orrs	r3, r6
+ 8009380:	4303      	orrs	r3, r0
+ 8009382:	ea43 6342 	orr.w	r3, r3, r2, lsl #25
+ 8009386:	e7e3      	b.n	8009350 <RCCEx_PLLSAI1_Config+0xac>
+        if((HAL_GetTick() - tickstart) > PLLSAI1_TIMEOUT_VALUE)
+ 8009388:	f7fd fee2 	bl	8007150 <HAL_GetTick>
+ 800938c:	1b80      	subs	r0, r0, r6
+ 800938e:	2802      	cmp	r0, #2
+ 8009390:	d9e6      	bls.n	8009360 <RCCEx_PLLSAI1_Config+0xbc>
+ 8009392:	e7d3      	b.n	800933c <RCCEx_PLLSAI1_Config+0x98>
+      status = HAL_ERROR;
+ 8009394:	2001      	movs	r0, #1
+ 8009396:	e7d2      	b.n	800933e <RCCEx_PLLSAI1_Config+0x9a>
+ 8009398:	40021000 	.word	0x40021000
+ 800939c:	ff9f800f 	.word	0xff9f800f
+ 80093a0:	07ff800f 	.word	0x07ff800f
+ 80093a4:	f9ff800f 	.word	0xf9ff800f
+
+080093a8 <RCCEx_PLLSAI2_Config.constprop.0>:
+static HAL_StatusTypeDef RCCEx_PLLSAI2_Config(RCC_PLLSAI2InitTypeDef *PllSai2, uint32_t Divider)
+ 80093a8:	b570      	push	{r4, r5, r6, lr}
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() != RCC_PLLSOURCE_NONE)
+ 80093aa:	4c2f      	ldr	r4, [pc, #188]	; (8009468 <RCCEx_PLLSAI2_Config.constprop.0+0xc0>)
+    if((__HAL_RCC_GET_PLL_OSCSOURCE() != PllSai2->PLLSAI2Source)
+ 80093ac:	6803      	ldr	r3, [r0, #0]
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() != RCC_PLLSOURCE_NONE)
+ 80093ae:	68e2      	ldr	r2, [r4, #12]
+static HAL_StatusTypeDef RCCEx_PLLSAI2_Config(RCC_PLLSAI2InitTypeDef *PllSai2, uint32_t Divider)
+ 80093b0:	4605      	mov	r5, r0
+  if(__HAL_RCC_GET_PLL_OSCSOURCE() != RCC_PLLSOURCE_NONE)
+ 80093b2:	0790      	lsls	r0, r2, #30
+ 80093b4:	d026      	beq.n	8009404 <RCCEx_PLLSAI2_Config.constprop.0+0x5c>
+    if((__HAL_RCC_GET_PLL_OSCSOURCE() != PllSai2->PLLSAI2Source)
+ 80093b6:	68e2      	ldr	r2, [r4, #12]
+ 80093b8:	f002 0203 	and.w	r2, r2, #3
+ 80093bc:	429a      	cmp	r2, r3
+ 80093be:	d151      	bne.n	8009464 <RCCEx_PLLSAI2_Config.constprop.0+0xbc>
+       ||
+ 80093c0:	2a00      	cmp	r2, #0
+ 80093c2:	d04f      	beq.n	8009464 <RCCEx_PLLSAI2_Config.constprop.0+0xbc>
+    __HAL_RCC_PLLSAI2_DISABLE();
+ 80093c4:	6823      	ldr	r3, [r4, #0]
+ 80093c6:	f023 5380 	bic.w	r3, r3, #268435456	; 0x10000000
+ 80093ca:	6023      	str	r3, [r4, #0]
+    tickstart = HAL_GetTick();
+ 80093cc:	f7fd fec0 	bl	8007150 <HAL_GetTick>
+ 80093d0:	4606      	mov	r6, r0
+    while(READ_BIT(RCC->CR, RCC_CR_PLLSAI2RDY) != 0U)
+ 80093d2:	6823      	ldr	r3, [r4, #0]
+ 80093d4:	009a      	lsls	r2, r3, #2
+ 80093d6:	d430      	bmi.n	800943a <RCCEx_PLLSAI2_Config.constprop.0+0x92>
+        MODIFY_REG(RCC->PLLSAI2CFGR,
+ 80093d8:	e9d5 2302 	ldrd	r2, r3, [r5, #8]
+ 80093dc:	06db      	lsls	r3, r3, #27
+ 80093de:	6961      	ldr	r1, [r4, #20]
+ 80093e0:	ea43 2302 	orr.w	r3, r3, r2, lsl #8
+ 80093e4:	4a21      	ldr	r2, [pc, #132]	; (800946c <RCCEx_PLLSAI2_Config.constprop.0+0xc4>)
+ 80093e6:	400a      	ands	r2, r1
+ 80093e8:	4313      	orrs	r3, r2
+ 80093ea:	686a      	ldr	r2, [r5, #4]
+ 80093ec:	3a01      	subs	r2, #1
+ 80093ee:	ea43 1302 	orr.w	r3, r3, r2, lsl #4
+ 80093f2:	6163      	str	r3, [r4, #20]
+      __HAL_RCC_PLLSAI2_ENABLE();
+ 80093f4:	6823      	ldr	r3, [r4, #0]
+ 80093f6:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+ 80093fa:	6023      	str	r3, [r4, #0]
+      tickstart = HAL_GetTick();
+ 80093fc:	f7fd fea8 	bl	8007150 <HAL_GetTick>
+ 8009400:	4606      	mov	r6, r0
+      while(READ_BIT(RCC->CR, RCC_CR_PLLSAI2RDY) == 0U)
+ 8009402:	e026      	b.n	8009452 <RCCEx_PLLSAI2_Config.constprop.0+0xaa>
+    switch(PllSai2->PLLSAI2Source)
+ 8009404:	2b02      	cmp	r3, #2
+ 8009406:	d00d      	beq.n	8009424 <RCCEx_PLLSAI2_Config.constprop.0+0x7c>
+ 8009408:	2b03      	cmp	r3, #3
+ 800940a:	d00f      	beq.n	800942c <RCCEx_PLLSAI2_Config.constprop.0+0x84>
+ 800940c:	2b01      	cmp	r3, #1
+ 800940e:	d129      	bne.n	8009464 <RCCEx_PLLSAI2_Config.constprop.0+0xbc>
+      if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_MSIRDY))
+ 8009410:	6822      	ldr	r2, [r4, #0]
+ 8009412:	f012 0f02 	tst.w	r2, #2
+        if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSEBYP))
+ 8009416:	d025      	beq.n	8009464 <RCCEx_PLLSAI2_Config.constprop.0+0xbc>
+      MODIFY_REG(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC, PllSai2->PLLSAI2Source);
+ 8009418:	68e0      	ldr	r0, [r4, #12]
+ 800941a:	f020 0003 	bic.w	r0, r0, #3
+ 800941e:	4318      	orrs	r0, r3
+ 8009420:	60e0      	str	r0, [r4, #12]
+  if(status == HAL_OK)
+ 8009422:	e7cf      	b.n	80093c4 <RCCEx_PLLSAI2_Config.constprop.0+0x1c>
+      if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSIRDY))
+ 8009424:	6822      	ldr	r2, [r4, #0]
+ 8009426:	f412 6f80 	tst.w	r2, #1024	; 0x400
+ 800942a:	e7f4      	b.n	8009416 <RCCEx_PLLSAI2_Config.constprop.0+0x6e>
+      if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSERDY))
+ 800942c:	6822      	ldr	r2, [r4, #0]
+ 800942e:	0391      	lsls	r1, r2, #14
+ 8009430:	d4f2      	bmi.n	8009418 <RCCEx_PLLSAI2_Config.constprop.0+0x70>
+        if(HAL_IS_BIT_CLR(RCC->CR, RCC_CR_HSEBYP))
+ 8009432:	6822      	ldr	r2, [r4, #0]
+ 8009434:	f412 2f80 	tst.w	r2, #262144	; 0x40000
+ 8009438:	e7ed      	b.n	8009416 <RCCEx_PLLSAI2_Config.constprop.0+0x6e>
+      if((HAL_GetTick() - tickstart) > PLLSAI2_TIMEOUT_VALUE)
+ 800943a:	f7fd fe89 	bl	8007150 <HAL_GetTick>
+ 800943e:	1b80      	subs	r0, r0, r6
+ 8009440:	2802      	cmp	r0, #2
+ 8009442:	d9c6      	bls.n	80093d2 <RCCEx_PLLSAI2_Config.constprop.0+0x2a>
+        status = HAL_TIMEOUT;
+ 8009444:	2003      	movs	r0, #3
+}
+ 8009446:	bd70      	pop	{r4, r5, r6, pc}
+        if((HAL_GetTick() - tickstart) > PLLSAI2_TIMEOUT_VALUE)
+ 8009448:	f7fd fe82 	bl	8007150 <HAL_GetTick>
+ 800944c:	1b80      	subs	r0, r0, r6
+ 800944e:	2802      	cmp	r0, #2
+ 8009450:	d8f8      	bhi.n	8009444 <RCCEx_PLLSAI2_Config.constprop.0+0x9c>
+      while(READ_BIT(RCC->CR, RCC_CR_PLLSAI2RDY) == 0U)
+ 8009452:	6823      	ldr	r3, [r4, #0]
+ 8009454:	009b      	lsls	r3, r3, #2
+ 8009456:	d5f7      	bpl.n	8009448 <RCCEx_PLLSAI2_Config.constprop.0+0xa0>
+        __HAL_RCC_PLLSAI2CLKOUT_ENABLE(PllSai2->PLLSAI2ClockOut);
+ 8009458:	6963      	ldr	r3, [r4, #20]
+ 800945a:	69aa      	ldr	r2, [r5, #24]
+ 800945c:	4313      	orrs	r3, r2
+ 800945e:	6163      	str	r3, [r4, #20]
+ 8009460:	2000      	movs	r0, #0
+  return status;
+ 8009462:	e7f0      	b.n	8009446 <RCCEx_PLLSAI2_Config.constprop.0+0x9e>
+      status = HAL_ERROR;
+ 8009464:	2001      	movs	r0, #1
+ 8009466:	e7ee      	b.n	8009446 <RCCEx_PLLSAI2_Config.constprop.0+0x9e>
+ 8009468:	40021000 	.word	0x40021000
+ 800946c:	07ff800f 	.word	0x07ff800f
+
+08009470 <HAL_RCCEx_PeriphCLKConfig>:
+{
+ 8009470:	e92d 47f3 	stmdb	sp!, {r0, r1, r4, r5, r6, r7, r8, r9, sl, lr}
+  if((((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_SAI1) == RCC_PERIPHCLK_SAI1))
+ 8009474:	6806      	ldr	r6, [r0, #0]
+ 8009476:	f416 6600 	ands.w	r6, r6, #2048	; 0x800
+{
+ 800947a:	4604      	mov	r4, r0
+  if((((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_SAI1) == RCC_PERIPHCLK_SAI1))
+ 800947c:	d007      	beq.n	800948e <HAL_RCCEx_PeriphCLKConfig+0x1e>
+    switch(PeriphClkInit->Sai1ClockSelection)
+ 800947e:	6ec1      	ldr	r1, [r0, #108]	; 0x6c
+ 8009480:	2940      	cmp	r1, #64	; 0x40
+ 8009482:	d022      	beq.n	80094ca <HAL_RCCEx_PeriphCLKConfig+0x5a>
+ 8009484:	d812      	bhi.n	80094ac <HAL_RCCEx_PeriphCLKConfig+0x3c>
+ 8009486:	b331      	cbz	r1, 80094d6 <HAL_RCCEx_PeriphCLKConfig+0x66>
+ 8009488:	2920      	cmp	r1, #32
+ 800948a:	d02b      	beq.n	80094e4 <HAL_RCCEx_PeriphCLKConfig+0x74>
+ 800948c:	2601      	movs	r6, #1
+  if((((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_SAI2) == RCC_PERIPHCLK_SAI2))
+ 800948e:	6823      	ldr	r3, [r4, #0]
+ 8009490:	04db      	lsls	r3, r3, #19
+ 8009492:	d509      	bpl.n	80094a8 <HAL_RCCEx_PeriphCLKConfig+0x38>
+    switch(PeriphClkInit->Sai2ClockSelection)
+ 8009494:	6f21      	ldr	r1, [r4, #112]	; 0x70
+ 8009496:	f5b1 7f00 	cmp.w	r1, #512	; 0x200
+ 800949a:	d02f      	beq.n	80094fc <HAL_RCCEx_PeriphCLKConfig+0x8c>
+ 800949c:	d826      	bhi.n	80094ec <HAL_RCCEx_PeriphCLKConfig+0x7c>
+ 800949e:	b399      	cbz	r1, 8009508 <HAL_RCCEx_PeriphCLKConfig+0x98>
+ 80094a0:	f5b1 7f80 	cmp.w	r1, #256	; 0x100
+ 80094a4:	d073      	beq.n	800958e <HAL_RCCEx_PeriphCLKConfig+0x11e>
+ 80094a6:	2601      	movs	r6, #1
+ 80094a8:	4635      	mov	r5, r6
+ 80094aa:	e03c      	b.n	8009526 <HAL_RCCEx_PeriphCLKConfig+0xb6>
+    switch(PeriphClkInit->Sai1ClockSelection)
+ 80094ac:	2960      	cmp	r1, #96	; 0x60
+ 80094ae:	d001      	beq.n	80094b4 <HAL_RCCEx_PeriphCLKConfig+0x44>
+ 80094b0:	2980      	cmp	r1, #128	; 0x80
+ 80094b2:	d1eb      	bne.n	800948c <HAL_RCCEx_PeriphCLKConfig+0x1c>
+      __HAL_RCC_SAI1_CONFIG(PeriphClkInit->Sai1ClockSelection);
+ 80094b4:	4a3b      	ldr	r2, [pc, #236]	; (80095a4 <HAL_RCCEx_PeriphCLKConfig+0x134>)
+ 80094b6:	6ee1      	ldr	r1, [r4, #108]	; 0x6c
+ 80094b8:	f8d2 309c 	ldr.w	r3, [r2, #156]	; 0x9c
+ 80094bc:	f023 03e0 	bic.w	r3, r3, #224	; 0xe0
+ 80094c0:	430b      	orrs	r3, r1
+ 80094c2:	f8c2 309c 	str.w	r3, [r2, #156]	; 0x9c
+ 80094c6:	2600      	movs	r6, #0
+ 80094c8:	e7e1      	b.n	800948e <HAL_RCCEx_PeriphCLKConfig+0x1e>
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_SAI3CLK);
+ 80094ca:	4a36      	ldr	r2, [pc, #216]	; (80095a4 <HAL_RCCEx_PeriphCLKConfig+0x134>)
+ 80094cc:	68d3      	ldr	r3, [r2, #12]
+ 80094ce:	f443 3380 	orr.w	r3, r3, #65536	; 0x10000
+ 80094d2:	60d3      	str	r3, [r2, #12]
+    if(ret == HAL_OK)
+ 80094d4:	e7ee      	b.n	80094b4 <HAL_RCCEx_PeriphCLKConfig+0x44>
+      ret = RCCEx_PLLSAI1_Config(&(PeriphClkInit->PLLSAI1), DIVIDER_P_UPDATE);
+ 80094d6:	3004      	adds	r0, #4
+ 80094d8:	f7ff fee4 	bl	80092a4 <RCCEx_PLLSAI1_Config>
+      ret = RCCEx_PLLSAI2_Config(&(PeriphClkInit->PLLSAI2), DIVIDER_P_UPDATE);
+ 80094dc:	4606      	mov	r6, r0
+    if(ret == HAL_OK)
+ 80094de:	2800      	cmp	r0, #0
+ 80094e0:	d1d5      	bne.n	800948e <HAL_RCCEx_PeriphCLKConfig+0x1e>
+ 80094e2:	e7e7      	b.n	80094b4 <HAL_RCCEx_PeriphCLKConfig+0x44>
+      ret = RCCEx_PLLSAI2_Config(&(PeriphClkInit->PLLSAI2), DIVIDER_P_UPDATE);
+ 80094e4:	3020      	adds	r0, #32
+ 80094e6:	f7ff ff5f 	bl	80093a8 <RCCEx_PLLSAI2_Config.constprop.0>
+ 80094ea:	e7f7      	b.n	80094dc <HAL_RCCEx_PeriphCLKConfig+0x6c>
+    switch(PeriphClkInit->Sai2ClockSelection)
+ 80094ec:	f5b1 7f40 	cmp.w	r1, #768	; 0x300
+ 80094f0:	d002      	beq.n	80094f8 <HAL_RCCEx_PeriphCLKConfig+0x88>
+ 80094f2:	f5b1 6f80 	cmp.w	r1, #1024	; 0x400
+ 80094f6:	d1d6      	bne.n	80094a6 <HAL_RCCEx_PeriphCLKConfig+0x36>
+ 80094f8:	4635      	mov	r5, r6
+ 80094fa:	e009      	b.n	8009510 <HAL_RCCEx_PeriphCLKConfig+0xa0>
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_SAI3CLK);
+ 80094fc:	4a29      	ldr	r2, [pc, #164]	; (80095a4 <HAL_RCCEx_PeriphCLKConfig+0x134>)
+ 80094fe:	68d3      	ldr	r3, [r2, #12]
+ 8009500:	f443 3380 	orr.w	r3, r3, #65536	; 0x10000
+ 8009504:	60d3      	str	r3, [r2, #12]
+      break;
+ 8009506:	e7f7      	b.n	80094f8 <HAL_RCCEx_PeriphCLKConfig+0x88>
+      ret = RCCEx_PLLSAI1_Config(&(PeriphClkInit->PLLSAI1), DIVIDER_P_UPDATE);
+ 8009508:	1d20      	adds	r0, r4, #4
+ 800950a:	f7ff fecb 	bl	80092a4 <RCCEx_PLLSAI1_Config>
+      ret = RCCEx_PLLSAI2_Config(&(PeriphClkInit->PLLSAI2), DIVIDER_P_UPDATE);
+ 800950e:	4605      	mov	r5, r0
+    if(ret == HAL_OK)
+ 8009510:	2d00      	cmp	r5, #0
+ 8009512:	d141      	bne.n	8009598 <HAL_RCCEx_PeriphCLKConfig+0x128>
+      __HAL_RCC_SAI2_CONFIG(PeriphClkInit->Sai2ClockSelection);
+ 8009514:	4a23      	ldr	r2, [pc, #140]	; (80095a4 <HAL_RCCEx_PeriphCLKConfig+0x134>)
+ 8009516:	6f21      	ldr	r1, [r4, #112]	; 0x70
+ 8009518:	f8d2 309c 	ldr.w	r3, [r2, #156]	; 0x9c
+ 800951c:	f423 63e0 	bic.w	r3, r3, #1792	; 0x700
+ 8009520:	430b      	orrs	r3, r1
+ 8009522:	f8c2 309c 	str.w	r3, [r2, #156]	; 0x9c
+  if((PeriphClkInit->PeriphClockSelection & RCC_PERIPHCLK_RTC) == RCC_PERIPHCLK_RTC)
+ 8009526:	6823      	ldr	r3, [r4, #0]
+ 8009528:	039f      	lsls	r7, r3, #14
+ 800952a:	f140 817d 	bpl.w	8009828 <HAL_RCCEx_PeriphCLKConfig+0x3b8>
+    if(__HAL_RCC_PWR_IS_CLK_DISABLED() != 0U)
+ 800952e:	4f1d      	ldr	r7, [pc, #116]	; (80095a4 <HAL_RCCEx_PeriphCLKConfig+0x134>)
+ 8009530:	6dbb      	ldr	r3, [r7, #88]	; 0x58
+ 8009532:	00d8      	lsls	r0, r3, #3
+ 8009534:	d432      	bmi.n	800959c <HAL_RCCEx_PeriphCLKConfig+0x12c>
+      __HAL_RCC_PWR_CLK_ENABLE();
+ 8009536:	6dbb      	ldr	r3, [r7, #88]	; 0x58
+ 8009538:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+ 800953c:	65bb      	str	r3, [r7, #88]	; 0x58
+ 800953e:	6dbb      	ldr	r3, [r7, #88]	; 0x58
+ 8009540:	f003 5380 	and.w	r3, r3, #268435456	; 0x10000000
+ 8009544:	9301      	str	r3, [sp, #4]
+ 8009546:	9b01      	ldr	r3, [sp, #4]
+      pwrclkchanged = SET;
+ 8009548:	f04f 0801 	mov.w	r8, #1
+    SET_BIT(PWR->CR1, PWR_CR1_DBP);
+ 800954c:	f8df 9058 	ldr.w	r9, [pc, #88]	; 80095a8 <HAL_RCCEx_PeriphCLKConfig+0x138>
+ 8009550:	f8d9 3000 	ldr.w	r3, [r9]
+ 8009554:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 8009558:	f8c9 3000 	str.w	r3, [r9]
+    tickstart = HAL_GetTick();
+ 800955c:	f7fd fdf8 	bl	8007150 <HAL_GetTick>
+ 8009560:	4682      	mov	sl, r0
+    while(READ_BIT(PWR->CR1, PWR_CR1_DBP) == 0U)
+ 8009562:	f8d9 3000 	ldr.w	r3, [r9]
+ 8009566:	05d9      	lsls	r1, r3, #23
+ 8009568:	d520      	bpl.n	80095ac <HAL_RCCEx_PeriphCLKConfig+0x13c>
+    if(ret == HAL_OK)
+ 800956a:	bb35      	cbnz	r5, 80095ba <HAL_RCCEx_PeriphCLKConfig+0x14a>
+      tmpregister = READ_BIT(RCC->BDCR, RCC_BDCR_RTCSEL);
+ 800956c:	f8d7 3090 	ldr.w	r3, [r7, #144]	; 0x90
+      if((tmpregister != RCC_RTCCLKSOURCE_NONE) && (tmpregister != PeriphClkInit->RTCClockSelection))
+ 8009570:	f413 7340 	ands.w	r3, r3, #768	; 0x300
+ 8009574:	f040 812e 	bne.w	80097d4 <HAL_RCCEx_PeriphCLKConfig+0x364>
+        __HAL_RCC_RTC_CONFIG(PeriphClkInit->RTCClockSelection);
+ 8009578:	f8d7 3090 	ldr.w	r3, [r7, #144]	; 0x90
+ 800957c:	f8d4 2090 	ldr.w	r2, [r4, #144]	; 0x90
+ 8009580:	f423 7340 	bic.w	r3, r3, #768	; 0x300
+ 8009584:	4313      	orrs	r3, r2
+ 8009586:	f8c7 3090 	str.w	r3, [r7, #144]	; 0x90
+ 800958a:	4635      	mov	r5, r6
+ 800958c:	e015      	b.n	80095ba <HAL_RCCEx_PeriphCLKConfig+0x14a>
+      ret = RCCEx_PLLSAI2_Config(&(PeriphClkInit->PLLSAI2), DIVIDER_P_UPDATE);
+ 800958e:	f104 0020 	add.w	r0, r4, #32
+ 8009592:	f7ff ff09 	bl	80093a8 <RCCEx_PLLSAI2_Config.constprop.0>
+ 8009596:	e7ba      	b.n	800950e <HAL_RCCEx_PeriphCLKConfig+0x9e>
+ 8009598:	462e      	mov	r6, r5
+ 800959a:	e7c4      	b.n	8009526 <HAL_RCCEx_PeriphCLKConfig+0xb6>
+    FlagStatus       pwrclkchanged = RESET;
+ 800959c:	f04f 0800 	mov.w	r8, #0
+ 80095a0:	e7d4      	b.n	800954c <HAL_RCCEx_PeriphCLKConfig+0xdc>
+ 80095a2:	bf00      	nop
+ 80095a4:	40021000 	.word	0x40021000
+ 80095a8:	40007000 	.word	0x40007000
+      if((HAL_GetTick() - tickstart) > RCC_DBP_TIMEOUT_VALUE)
+ 80095ac:	f7fd fdd0 	bl	8007150 <HAL_GetTick>
+ 80095b0:	eba0 000a 	sub.w	r0, r0, sl
+ 80095b4:	2802      	cmp	r0, #2
+ 80095b6:	d9d4      	bls.n	8009562 <HAL_RCCEx_PeriphCLKConfig+0xf2>
+        ret = HAL_TIMEOUT;
+ 80095b8:	2503      	movs	r5, #3
+    if(pwrclkchanged == SET)
+ 80095ba:	f1b8 0f00 	cmp.w	r8, #0
+ 80095be:	d003      	beq.n	80095c8 <HAL_RCCEx_PeriphCLKConfig+0x158>
+      __HAL_RCC_PWR_CLK_DISABLE();
+ 80095c0:	6dbb      	ldr	r3, [r7, #88]	; 0x58
+ 80095c2:	f023 5380 	bic.w	r3, r3, #268435456	; 0x10000000
+ 80095c6:	65bb      	str	r3, [r7, #88]	; 0x58
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_USART1) == RCC_PERIPHCLK_USART1)
+ 80095c8:	6823      	ldr	r3, [r4, #0]
+ 80095ca:	07d8      	lsls	r0, r3, #31
+ 80095cc:	d508      	bpl.n	80095e0 <HAL_RCCEx_PeriphCLKConfig+0x170>
+    __HAL_RCC_USART1_CONFIG(PeriphClkInit->Usart1ClockSelection);
+ 80095ce:	49b2      	ldr	r1, [pc, #712]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 80095d0:	6be0      	ldr	r0, [r4, #60]	; 0x3c
+ 80095d2:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 80095d6:	f022 0203 	bic.w	r2, r2, #3
+ 80095da:	4302      	orrs	r2, r0
+ 80095dc:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_USART2) == RCC_PERIPHCLK_USART2)
+ 80095e0:	0799      	lsls	r1, r3, #30
+ 80095e2:	d508      	bpl.n	80095f6 <HAL_RCCEx_PeriphCLKConfig+0x186>
+    __HAL_RCC_USART2_CONFIG(PeriphClkInit->Usart2ClockSelection);
+ 80095e4:	49ac      	ldr	r1, [pc, #688]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 80095e6:	6c20      	ldr	r0, [r4, #64]	; 0x40
+ 80095e8:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 80095ec:	f022 020c 	bic.w	r2, r2, #12
+ 80095f0:	4302      	orrs	r2, r0
+ 80095f2:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_USART3) == RCC_PERIPHCLK_USART3)
+ 80095f6:	075a      	lsls	r2, r3, #29
+ 80095f8:	d508      	bpl.n	800960c <HAL_RCCEx_PeriphCLKConfig+0x19c>
+    __HAL_RCC_USART3_CONFIG(PeriphClkInit->Usart3ClockSelection);
+ 80095fa:	49a7      	ldr	r1, [pc, #668]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 80095fc:	6c60      	ldr	r0, [r4, #68]	; 0x44
+ 80095fe:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 8009602:	f022 0230 	bic.w	r2, r2, #48	; 0x30
+ 8009606:	4302      	orrs	r2, r0
+ 8009608:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_UART4) == RCC_PERIPHCLK_UART4)
+ 800960c:	071f      	lsls	r7, r3, #28
+ 800960e:	d508      	bpl.n	8009622 <HAL_RCCEx_PeriphCLKConfig+0x1b2>
+    __HAL_RCC_UART4_CONFIG(PeriphClkInit->Uart4ClockSelection);
+ 8009610:	49a1      	ldr	r1, [pc, #644]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009612:	6ca0      	ldr	r0, [r4, #72]	; 0x48
+ 8009614:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 8009618:	f022 02c0 	bic.w	r2, r2, #192	; 0xc0
+ 800961c:	4302      	orrs	r2, r0
+ 800961e:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_UART5) == RCC_PERIPHCLK_UART5)
+ 8009622:	06de      	lsls	r6, r3, #27
+ 8009624:	d508      	bpl.n	8009638 <HAL_RCCEx_PeriphCLKConfig+0x1c8>
+    __HAL_RCC_UART5_CONFIG(PeriphClkInit->Uart5ClockSelection);
+ 8009626:	499c      	ldr	r1, [pc, #624]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009628:	6ce0      	ldr	r0, [r4, #76]	; 0x4c
+ 800962a:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 800962e:	f422 7240 	bic.w	r2, r2, #768	; 0x300
+ 8009632:	4302      	orrs	r2, r0
+ 8009634:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_LPUART1) == RCC_PERIPHCLK_LPUART1)
+ 8009638:	0698      	lsls	r0, r3, #26
+ 800963a:	d508      	bpl.n	800964e <HAL_RCCEx_PeriphCLKConfig+0x1de>
+    __HAL_RCC_LPUART1_CONFIG(PeriphClkInit->Lpuart1ClockSelection);
+ 800963c:	4996      	ldr	r1, [pc, #600]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 800963e:	6d20      	ldr	r0, [r4, #80]	; 0x50
+ 8009640:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 8009644:	f422 6240 	bic.w	r2, r2, #3072	; 0xc00
+ 8009648:	4302      	orrs	r2, r0
+ 800964a:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_LPTIM1) == (RCC_PERIPHCLK_LPTIM1))
+ 800964e:	0599      	lsls	r1, r3, #22
+ 8009650:	d508      	bpl.n	8009664 <HAL_RCCEx_PeriphCLKConfig+0x1f4>
+    __HAL_RCC_LPTIM1_CONFIG(PeriphClkInit->Lptim1ClockSelection);
+ 8009652:	4991      	ldr	r1, [pc, #580]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009654:	6e60      	ldr	r0, [r4, #100]	; 0x64
+ 8009656:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 800965a:	f422 2240 	bic.w	r2, r2, #786432	; 0xc0000
+ 800965e:	4302      	orrs	r2, r0
+ 8009660:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_LPTIM2) == (RCC_PERIPHCLK_LPTIM2))
+ 8009664:	055a      	lsls	r2, r3, #21
+ 8009666:	d508      	bpl.n	800967a <HAL_RCCEx_PeriphCLKConfig+0x20a>
+    __HAL_RCC_LPTIM2_CONFIG(PeriphClkInit->Lptim2ClockSelection);
+ 8009668:	498b      	ldr	r1, [pc, #556]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 800966a:	6ea0      	ldr	r0, [r4, #104]	; 0x68
+ 800966c:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 8009670:	f422 1240 	bic.w	r2, r2, #3145728	; 0x300000
+ 8009674:	4302      	orrs	r2, r0
+ 8009676:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_I2C1) == RCC_PERIPHCLK_I2C1)
+ 800967a:	065f      	lsls	r7, r3, #25
+ 800967c:	d508      	bpl.n	8009690 <HAL_RCCEx_PeriphCLKConfig+0x220>
+    __HAL_RCC_I2C1_CONFIG(PeriphClkInit->I2c1ClockSelection);
+ 800967e:	4986      	ldr	r1, [pc, #536]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009680:	6d60      	ldr	r0, [r4, #84]	; 0x54
+ 8009682:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 8009686:	f422 5240 	bic.w	r2, r2, #12288	; 0x3000
+ 800968a:	4302      	orrs	r2, r0
+ 800968c:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_I2C2) == RCC_PERIPHCLK_I2C2)
+ 8009690:	061e      	lsls	r6, r3, #24
+ 8009692:	d508      	bpl.n	80096a6 <HAL_RCCEx_PeriphCLKConfig+0x236>
+    __HAL_RCC_I2C2_CONFIG(PeriphClkInit->I2c2ClockSelection);
+ 8009694:	4980      	ldr	r1, [pc, #512]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009696:	6da0      	ldr	r0, [r4, #88]	; 0x58
+ 8009698:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 800969c:	f422 4240 	bic.w	r2, r2, #49152	; 0xc000
+ 80096a0:	4302      	orrs	r2, r0
+ 80096a2:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_I2C3) == RCC_PERIPHCLK_I2C3)
+ 80096a6:	05d8      	lsls	r0, r3, #23
+ 80096a8:	d508      	bpl.n	80096bc <HAL_RCCEx_PeriphCLKConfig+0x24c>
+    __HAL_RCC_I2C3_CONFIG(PeriphClkInit->I2c3ClockSelection);
+ 80096aa:	497b      	ldr	r1, [pc, #492]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 80096ac:	6de0      	ldr	r0, [r4, #92]	; 0x5c
+ 80096ae:	f8d1 2088 	ldr.w	r2, [r1, #136]	; 0x88
+ 80096b2:	f422 3240 	bic.w	r2, r2, #196608	; 0x30000
+ 80096b6:	4302      	orrs	r2, r0
+ 80096b8:	f8c1 2088 	str.w	r2, [r1, #136]	; 0x88
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_I2C4) == RCC_PERIPHCLK_I2C4)
+ 80096bc:	02d9      	lsls	r1, r3, #11
+ 80096be:	d508      	bpl.n	80096d2 <HAL_RCCEx_PeriphCLKConfig+0x262>
+    __HAL_RCC_I2C4_CONFIG(PeriphClkInit->I2c4ClockSelection);
+ 80096c0:	4975      	ldr	r1, [pc, #468]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 80096c2:	6e20      	ldr	r0, [r4, #96]	; 0x60
+ 80096c4:	f8d1 209c 	ldr.w	r2, [r1, #156]	; 0x9c
+ 80096c8:	f022 0203 	bic.w	r2, r2, #3
+ 80096cc:	4302      	orrs	r2, r0
+ 80096ce:	f8c1 209c 	str.w	r2, [r1, #156]	; 0x9c
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_USB) == (RCC_PERIPHCLK_USB))
+ 80096d2:	049a      	lsls	r2, r3, #18
+ 80096d4:	d510      	bpl.n	80096f8 <HAL_RCCEx_PeriphCLKConfig+0x288>
+    __HAL_RCC_USB_CONFIG(PeriphClkInit->UsbClockSelection);
+ 80096d6:	4a70      	ldr	r2, [pc, #448]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 80096d8:	6f61      	ldr	r1, [r4, #116]	; 0x74
+ 80096da:	f8d2 3088 	ldr.w	r3, [r2, #136]	; 0x88
+ 80096de:	f023 6340 	bic.w	r3, r3, #201326592	; 0xc000000
+ 80096e2:	430b      	orrs	r3, r1
+    if(PeriphClkInit->UsbClockSelection == RCC_USBCLKSOURCE_PLL)
+ 80096e4:	f1b1 6f00 	cmp.w	r1, #134217728	; 0x8000000
+    __HAL_RCC_USB_CONFIG(PeriphClkInit->UsbClockSelection);
+ 80096e8:	f8c2 3088 	str.w	r3, [r2, #136]	; 0x88
+    if(PeriphClkInit->UsbClockSelection == RCC_USBCLKSOURCE_PLL)
+ 80096ec:	f040 809e 	bne.w	800982c <HAL_RCCEx_PeriphCLKConfig+0x3bc>
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_48M1CLK);
+ 80096f0:	68d3      	ldr	r3, [r2, #12]
+ 80096f2:	f443 1380 	orr.w	r3, r3, #1048576	; 0x100000
+ 80096f6:	60d3      	str	r3, [r2, #12]
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_SDMMC1) == (RCC_PERIPHCLK_SDMMC1))
+ 80096f8:	6823      	ldr	r3, [r4, #0]
+ 80096fa:	031b      	lsls	r3, r3, #12
+ 80096fc:	d50f      	bpl.n	800971e <HAL_RCCEx_PeriphCLKConfig+0x2ae>
+    __HAL_RCC_SDMMC1_CONFIG(PeriphClkInit->Sdmmc1ClockSelection);
+ 80096fe:	6fa1      	ldr	r1, [r4, #120]	; 0x78
+ 8009700:	4b65      	ldr	r3, [pc, #404]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009702:	f5b1 4f80 	cmp.w	r1, #16384	; 0x4000
+ 8009706:	f8d3 209c 	ldr.w	r2, [r3, #156]	; 0x9c
+ 800970a:	f040 809b 	bne.w	8009844 <HAL_RCCEx_PeriphCLKConfig+0x3d4>
+ 800970e:	f442 4280 	orr.w	r2, r2, #16384	; 0x4000
+ 8009712:	f8c3 209c 	str.w	r2, [r3, #156]	; 0x9c
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_SAI3CLK);
+ 8009716:	68da      	ldr	r2, [r3, #12]
+ 8009718:	f442 3280 	orr.w	r2, r2, #65536	; 0x10000
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_48M1CLK);
+ 800971c:	60da      	str	r2, [r3, #12]
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_RNG) == (RCC_PERIPHCLK_RNG))
+ 800971e:	6823      	ldr	r3, [r4, #0]
+ 8009720:	035f      	lsls	r7, r3, #13
+ 8009722:	d510      	bpl.n	8009746 <HAL_RCCEx_PeriphCLKConfig+0x2d6>
+    __HAL_RCC_RNG_CONFIG(PeriphClkInit->RngClockSelection);
+ 8009724:	4a5c      	ldr	r2, [pc, #368]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009726:	6fe1      	ldr	r1, [r4, #124]	; 0x7c
+ 8009728:	f8d2 3088 	ldr.w	r3, [r2, #136]	; 0x88
+ 800972c:	f023 6340 	bic.w	r3, r3, #201326592	; 0xc000000
+ 8009730:	430b      	orrs	r3, r1
+    if(PeriphClkInit->RngClockSelection == RCC_RNGCLKSOURCE_PLL)
+ 8009732:	f1b1 6f00 	cmp.w	r1, #134217728	; 0x8000000
+    __HAL_RCC_RNG_CONFIG(PeriphClkInit->RngClockSelection);
+ 8009736:	f8c2 3088 	str.w	r3, [r2, #136]	; 0x88
+    if(PeriphClkInit->RngClockSelection == RCC_RNGCLKSOURCE_PLL)
+ 800973a:	f040 80a1 	bne.w	8009880 <HAL_RCCEx_PeriphCLKConfig+0x410>
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_48M1CLK);
+ 800973e:	68d3      	ldr	r3, [r2, #12]
+ 8009740:	f443 1380 	orr.w	r3, r3, #1048576	; 0x100000
+ 8009744:	60d3      	str	r3, [r2, #12]
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_ADC) == RCC_PERIPHCLK_ADC)
+ 8009746:	6823      	ldr	r3, [r4, #0]
+ 8009748:	045e      	lsls	r6, r3, #17
+ 800974a:	d513      	bpl.n	8009774 <HAL_RCCEx_PeriphCLKConfig+0x304>
+    __HAL_RCC_ADC_CONFIG(PeriphClkInit->AdcClockSelection);
+ 800974c:	4952      	ldr	r1, [pc, #328]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 800974e:	f8d4 2080 	ldr.w	r2, [r4, #128]	; 0x80
+ 8009752:	f8d1 3088 	ldr.w	r3, [r1, #136]	; 0x88
+ 8009756:	f023 5340 	bic.w	r3, r3, #805306368	; 0x30000000
+ 800975a:	4313      	orrs	r3, r2
+    if(PeriphClkInit->AdcClockSelection == RCC_ADCCLKSOURCE_PLLSAI1)
+ 800975c:	f1b2 5f80 	cmp.w	r2, #268435456	; 0x10000000
+    __HAL_RCC_ADC_CONFIG(PeriphClkInit->AdcClockSelection);
+ 8009760:	f8c1 3088 	str.w	r3, [r1, #136]	; 0x88
+    if(PeriphClkInit->AdcClockSelection == RCC_ADCCLKSOURCE_PLLSAI1)
+ 8009764:	d106      	bne.n	8009774 <HAL_RCCEx_PeriphCLKConfig+0x304>
+      ret = RCCEx_PLLSAI1_Config(&(PeriphClkInit->PLLSAI1), DIVIDER_R_UPDATE);
+ 8009766:	2102      	movs	r1, #2
+ 8009768:	1d20      	adds	r0, r4, #4
+ 800976a:	f7ff fd9b 	bl	80092a4 <RCCEx_PLLSAI1_Config>
+      if(ret != HAL_OK)
+ 800976e:	2800      	cmp	r0, #0
+ 8009770:	bf18      	it	ne
+ 8009772:	4605      	movne	r5, r0
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_DFSDM1) == RCC_PERIPHCLK_DFSDM1)
+ 8009774:	6822      	ldr	r2, [r4, #0]
+ 8009776:	03d0      	lsls	r0, r2, #15
+ 8009778:	d509      	bpl.n	800978e <HAL_RCCEx_PeriphCLKConfig+0x31e>
+    __HAL_RCC_DFSDM1_CONFIG(PeriphClkInit->Dfsdm1ClockSelection);
+ 800977a:	4947      	ldr	r1, [pc, #284]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 800977c:	f8d4 0084 	ldr.w	r0, [r4, #132]	; 0x84
+ 8009780:	f8d1 309c 	ldr.w	r3, [r1, #156]	; 0x9c
+ 8009784:	f023 0304 	bic.w	r3, r3, #4
+ 8009788:	4303      	orrs	r3, r0
+ 800978a:	f8c1 309c 	str.w	r3, [r1, #156]	; 0x9c
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_DFSDM1AUDIO) == RCC_PERIPHCLK_DFSDM1AUDIO)
+ 800978e:	0291      	lsls	r1, r2, #10
+ 8009790:	d509      	bpl.n	80097a6 <HAL_RCCEx_PeriphCLKConfig+0x336>
+    __HAL_RCC_DFSDM1AUDIO_CONFIG(PeriphClkInit->Dfsdm1AudioClockSelection);
+ 8009792:	4941      	ldr	r1, [pc, #260]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 8009794:	f8d4 0088 	ldr.w	r0, [r4, #136]	; 0x88
+ 8009798:	f8d1 309c 	ldr.w	r3, [r1, #156]	; 0x9c
+ 800979c:	f023 0318 	bic.w	r3, r3, #24
+ 80097a0:	4303      	orrs	r3, r0
+ 80097a2:	f8c1 309c 	str.w	r3, [r1, #156]	; 0x9c
+  if(((PeriphClkInit->PeriphClockSelection) & RCC_PERIPHCLK_OSPI) == RCC_PERIPHCLK_OSPI)
+ 80097a6:	01d3      	lsls	r3, r2, #7
+ 80097a8:	d510      	bpl.n	80097cc <HAL_RCCEx_PeriphCLKConfig+0x35c>
+    __HAL_RCC_OSPI_CONFIG(PeriphClkInit->OspiClockSelection);
+ 80097aa:	4a3b      	ldr	r2, [pc, #236]	; (8009898 <HAL_RCCEx_PeriphCLKConfig+0x428>)
+ 80097ac:	f8d4 108c 	ldr.w	r1, [r4, #140]	; 0x8c
+ 80097b0:	f8d2 309c 	ldr.w	r3, [r2, #156]	; 0x9c
+ 80097b4:	f423 1340 	bic.w	r3, r3, #3145728	; 0x300000
+ 80097b8:	430b      	orrs	r3, r1
+ 80097ba:	f8c2 309c 	str.w	r3, [r2, #156]	; 0x9c
+    if(PeriphClkInit->OspiClockSelection == RCC_OSPICLKSOURCE_PLL)
+ 80097be:	f5b1 1f00 	cmp.w	r1, #2097152	; 0x200000
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_48M1CLK);
+ 80097c2:	bf02      	ittt	eq
+ 80097c4:	68d3      	ldreq	r3, [r2, #12]
+ 80097c6:	f443 1380 	orreq.w	r3, r3, #1048576	; 0x100000
+ 80097ca:	60d3      	streq	r3, [r2, #12]
+}
+ 80097cc:	4628      	mov	r0, r5
+ 80097ce:	b002      	add	sp, #8
+ 80097d0:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+      if((tmpregister != RCC_RTCCLKSOURCE_NONE) && (tmpregister != PeriphClkInit->RTCClockSelection))
+ 80097d4:	f8d4 2090 	ldr.w	r2, [r4, #144]	; 0x90
+ 80097d8:	429a      	cmp	r2, r3
+ 80097da:	f43f aecd 	beq.w	8009578 <HAL_RCCEx_PeriphCLKConfig+0x108>
+        tmpregister = READ_BIT(RCC->BDCR, ~(RCC_BDCR_RTCSEL));
+ 80097de:	f8d7 2090 	ldr.w	r2, [r7, #144]	; 0x90
+        __HAL_RCC_BACKUPRESET_FORCE();
+ 80097e2:	f8d7 3090 	ldr.w	r3, [r7, #144]	; 0x90
+ 80097e6:	f443 3380 	orr.w	r3, r3, #65536	; 0x10000
+ 80097ea:	f8c7 3090 	str.w	r3, [r7, #144]	; 0x90
+        __HAL_RCC_BACKUPRESET_RELEASE();
+ 80097ee:	f8d7 3090 	ldr.w	r3, [r7, #144]	; 0x90
+        tmpregister = READ_BIT(RCC->BDCR, ~(RCC_BDCR_RTCSEL));
+ 80097f2:	f422 7140 	bic.w	r1, r2, #768	; 0x300
+        __HAL_RCC_BACKUPRESET_RELEASE();
+ 80097f6:	f423 3380 	bic.w	r3, r3, #65536	; 0x10000
+      if (HAL_IS_BIT_SET(tmpregister, RCC_BDCR_LSEON))
+ 80097fa:	07d2      	lsls	r2, r2, #31
+        __HAL_RCC_BACKUPRESET_RELEASE();
+ 80097fc:	f8c7 3090 	str.w	r3, [r7, #144]	; 0x90
+        RCC->BDCR = tmpregister;
+ 8009800:	f8c7 1090 	str.w	r1, [r7, #144]	; 0x90
+      if (HAL_IS_BIT_SET(tmpregister, RCC_BDCR_LSEON))
+ 8009804:	f57f aeb8 	bpl.w	8009578 <HAL_RCCEx_PeriphCLKConfig+0x108>
+        tickstart = HAL_GetTick();
+ 8009808:	f7fd fca2 	bl	8007150 <HAL_GetTick>
+          if((HAL_GetTick() - tickstart) > RCC_LSE_TIMEOUT_VALUE)
+ 800980c:	f241 3988 	movw	r9, #5000	; 0x1388
+        tickstart = HAL_GetTick();
+ 8009810:	4605      	mov	r5, r0
+        while(READ_BIT(RCC->BDCR, RCC_BDCR_LSERDY) == 0U)
+ 8009812:	f8d7 3090 	ldr.w	r3, [r7, #144]	; 0x90
+ 8009816:	079b      	lsls	r3, r3, #30
+ 8009818:	f53f aeae 	bmi.w	8009578 <HAL_RCCEx_PeriphCLKConfig+0x108>
+          if((HAL_GetTick() - tickstart) > RCC_LSE_TIMEOUT_VALUE)
+ 800981c:	f7fd fc98 	bl	8007150 <HAL_GetTick>
+ 8009820:	1b40      	subs	r0, r0, r5
+ 8009822:	4548      	cmp	r0, r9
+ 8009824:	d9f5      	bls.n	8009812 <HAL_RCCEx_PeriphCLKConfig+0x3a2>
+ 8009826:	e6c7      	b.n	80095b8 <HAL_RCCEx_PeriphCLKConfig+0x148>
+ 8009828:	4635      	mov	r5, r6
+ 800982a:	e6cd      	b.n	80095c8 <HAL_RCCEx_PeriphCLKConfig+0x158>
+      if(PeriphClkInit->UsbClockSelection == RCC_USBCLKSOURCE_PLLSAI1)
+ 800982c:	f1b1 6f80 	cmp.w	r1, #67108864	; 0x4000000
+ 8009830:	f47f af62 	bne.w	80096f8 <HAL_RCCEx_PeriphCLKConfig+0x288>
+        ret = RCCEx_PLLSAI1_Config(&(PeriphClkInit->PLLSAI1), DIVIDER_Q_UPDATE);
+ 8009834:	2101      	movs	r1, #1
+ 8009836:	1d20      	adds	r0, r4, #4
+ 8009838:	f7ff fd34 	bl	80092a4 <RCCEx_PLLSAI1_Config>
+        if(ret != HAL_OK)
+ 800983c:	2800      	cmp	r0, #0
+ 800983e:	bf18      	it	ne
+ 8009840:	4605      	movne	r5, r0
+ 8009842:	e759      	b.n	80096f8 <HAL_RCCEx_PeriphCLKConfig+0x288>
+    __HAL_RCC_SDMMC1_CONFIG(PeriphClkInit->Sdmmc1ClockSelection);
+ 8009844:	f422 4280 	bic.w	r2, r2, #16384	; 0x4000
+ 8009848:	f8c3 209c 	str.w	r2, [r3, #156]	; 0x9c
+ 800984c:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8009850:	f022 6240 	bic.w	r2, r2, #201326592	; 0xc000000
+ 8009854:	430a      	orrs	r2, r1
+    if(PeriphClkInit->Sdmmc1ClockSelection == RCC_SDMMC1CLKSOURCE_PLL)   /* PLL "Q" ? */
+ 8009856:	f1b1 6f00 	cmp.w	r1, #134217728	; 0x8000000
+    __HAL_RCC_SDMMC1_CONFIG(PeriphClkInit->Sdmmc1ClockSelection);
+ 800985a:	f8c3 2088 	str.w	r2, [r3, #136]	; 0x88
+    if(PeriphClkInit->Sdmmc1ClockSelection == RCC_SDMMC1CLKSOURCE_PLL)   /* PLL "Q" ? */
+ 800985e:	d103      	bne.n	8009868 <HAL_RCCEx_PeriphCLKConfig+0x3f8>
+      __HAL_RCC_PLLCLKOUT_ENABLE(RCC_PLL_48M1CLK);
+ 8009860:	68da      	ldr	r2, [r3, #12]
+ 8009862:	f442 1280 	orr.w	r2, r2, #1048576	; 0x100000
+ 8009866:	e759      	b.n	800971c <HAL_RCCEx_PeriphCLKConfig+0x2ac>
+    else if(PeriphClkInit->Sdmmc1ClockSelection == RCC_SDMMC1CLKSOURCE_PLLSAI1)
+ 8009868:	f1b1 6f80 	cmp.w	r1, #67108864	; 0x4000000
+ 800986c:	f47f af57 	bne.w	800971e <HAL_RCCEx_PeriphCLKConfig+0x2ae>
+      ret = RCCEx_PLLSAI1_Config(&(PeriphClkInit->PLLSAI1), DIVIDER_Q_UPDATE);
+ 8009870:	2101      	movs	r1, #1
+ 8009872:	1d20      	adds	r0, r4, #4
+ 8009874:	f7ff fd16 	bl	80092a4 <RCCEx_PLLSAI1_Config>
+      if(ret != HAL_OK)
+ 8009878:	2800      	cmp	r0, #0
+ 800987a:	bf18      	it	ne
+ 800987c:	4605      	movne	r5, r0
+ 800987e:	e74e      	b.n	800971e <HAL_RCCEx_PeriphCLKConfig+0x2ae>
+    else if(PeriphClkInit->RngClockSelection == RCC_RNGCLKSOURCE_PLLSAI1)
+ 8009880:	f1b1 6f80 	cmp.w	r1, #67108864	; 0x4000000
+ 8009884:	f47f af5f 	bne.w	8009746 <HAL_RCCEx_PeriphCLKConfig+0x2d6>
+      ret = RCCEx_PLLSAI1_Config(&(PeriphClkInit->PLLSAI1), DIVIDER_Q_UPDATE);
+ 8009888:	2101      	movs	r1, #1
+ 800988a:	1d20      	adds	r0, r4, #4
+ 800988c:	f7ff fd0a 	bl	80092a4 <RCCEx_PLLSAI1_Config>
+      if(ret != HAL_OK)
+ 8009890:	2800      	cmp	r0, #0
+ 8009892:	bf18      	it	ne
+ 8009894:	4605      	movne	r5, r0
+ 8009896:	e756      	b.n	8009746 <HAL_RCCEx_PeriphCLKConfig+0x2d6>
+ 8009898:	40021000 	.word	0x40021000
+
+0800989c <HAL_RCCEx_GetPeriphCLKConfig>:
+  PeriphClkInit->PeriphClockSelection = RCC_PERIPHCLK_USART1  | RCC_PERIPHCLK_USART2 | RCC_PERIPHCLK_USART3 | RCC_PERIPHCLK_UART4  | RCC_PERIPHCLK_UART5  | \
+ 800989c:	4b5b      	ldr	r3, [pc, #364]	; (8009a0c <HAL_RCCEx_GetPeriphCLKConfig+0x170>)
+ 800989e:	6003      	str	r3, [r0, #0]
+  PeriphClkInit->PLLSAI1.PLLSAI1Source = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC) >> RCC_PLLCFGR_PLLSRC_Pos;
+ 80098a0:	4b5b      	ldr	r3, [pc, #364]	; (8009a10 <HAL_RCCEx_GetPeriphCLKConfig+0x174>)
+ 80098a2:	68d9      	ldr	r1, [r3, #12]
+ 80098a4:	f001 0103 	and.w	r1, r1, #3
+ 80098a8:	6041      	str	r1, [r0, #4]
+  PeriphClkInit->PLLSAI1.PLLSAI1M = (READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U;
+ 80098aa:	691a      	ldr	r2, [r3, #16]
+ 80098ac:	f3c2 1203 	ubfx	r2, r2, #4, #4
+ 80098b0:	3201      	adds	r2, #1
+ 80098b2:	6082      	str	r2, [r0, #8]
+  PeriphClkInit->PLLSAI1.PLLSAI1N = READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1N) >> RCC_PLLSAI1CFGR_PLLSAI1N_Pos;
+ 80098b4:	691a      	ldr	r2, [r3, #16]
+ 80098b6:	f3c2 2206 	ubfx	r2, r2, #8, #7
+ 80098ba:	60c2      	str	r2, [r0, #12]
+  PeriphClkInit->PLLSAI1.PLLSAI1P = ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1P) >> RCC_PLLSAI1CFGR_PLLSAI1P_Pos) << 4U) + 7U;
+ 80098bc:	691a      	ldr	r2, [r3, #16]
+ 80098be:	0b52      	lsrs	r2, r2, #13
+ 80098c0:	f002 0210 	and.w	r2, r2, #16
+ 80098c4:	3207      	adds	r2, #7
+ 80098c6:	6102      	str	r2, [r0, #16]
+  PeriphClkInit->PLLSAI1.PLLSAI1Q = ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1Q) >> RCC_PLLSAI1CFGR_PLLSAI1Q_Pos) + 1U) * 2U;
+ 80098c8:	691a      	ldr	r2, [r3, #16]
+ 80098ca:	f3c2 5241 	ubfx	r2, r2, #21, #2
+ 80098ce:	3201      	adds	r2, #1
+ 80098d0:	0052      	lsls	r2, r2, #1
+ 80098d2:	6142      	str	r2, [r0, #20]
+  PeriphClkInit->PLLSAI1.PLLSAI1R = ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1R) >> RCC_PLLSAI1CFGR_PLLSAI1R_Pos) + 1U) * 2U;
+ 80098d4:	691a      	ldr	r2, [r3, #16]
+  PeriphClkInit->PLLSAI2.PLLSAI2Source = PeriphClkInit->PLLSAI1.PLLSAI1Source;
+ 80098d6:	6201      	str	r1, [r0, #32]
+  PeriphClkInit->PLLSAI1.PLLSAI1R = ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1R) >> RCC_PLLSAI1CFGR_PLLSAI1R_Pos) + 1U) * 2U;
+ 80098d8:	f3c2 6241 	ubfx	r2, r2, #25, #2
+ 80098dc:	3201      	adds	r2, #1
+ 80098de:	0052      	lsls	r2, r2, #1
+ 80098e0:	6182      	str	r2, [r0, #24]
+  PeriphClkInit->PLLSAI2.PLLSAI2M = (READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2M) >> RCC_PLLSAI2CFGR_PLLSAI2M_Pos) + 1U;
+ 80098e2:	695a      	ldr	r2, [r3, #20]
+ 80098e4:	f3c2 1203 	ubfx	r2, r2, #4, #4
+ 80098e8:	3201      	adds	r2, #1
+ 80098ea:	6242      	str	r2, [r0, #36]	; 0x24
+  PeriphClkInit->PLLSAI2.PLLSAI2N = READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2N) >> RCC_PLLSAI2CFGR_PLLSAI2N_Pos;
+ 80098ec:	695a      	ldr	r2, [r3, #20]
+ 80098ee:	f3c2 2206 	ubfx	r2, r2, #8, #7
+ 80098f2:	6282      	str	r2, [r0, #40]	; 0x28
+  PeriphClkInit->PLLSAI2.PLLSAI2P = ((READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2P) >> RCC_PLLSAI2CFGR_PLLSAI2P_Pos) << 4U) + 7U;
+ 80098f4:	695a      	ldr	r2, [r3, #20]
+ 80098f6:	0b52      	lsrs	r2, r2, #13
+ 80098f8:	f002 0210 	and.w	r2, r2, #16
+ 80098fc:	3207      	adds	r2, #7
+ 80098fe:	62c2      	str	r2, [r0, #44]	; 0x2c
+  PeriphClkInit->PLLSAI2.PLLSAI2Q = ((READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2Q) >> RCC_PLLSAI2CFGR_PLLSAI2Q_Pos) + 1U) * 2U;
+ 8009900:	695a      	ldr	r2, [r3, #20]
+ 8009902:	f3c2 5241 	ubfx	r2, r2, #21, #2
+ 8009906:	3201      	adds	r2, #1
+ 8009908:	0052      	lsls	r2, r2, #1
+ 800990a:	6302      	str	r2, [r0, #48]	; 0x30
+  PeriphClkInit->PLLSAI2.PLLSAI2R = ((READ_BIT(RCC->PLLSAI2CFGR, RCC_PLLSAI2CFGR_PLLSAI2R)>> RCC_PLLSAI2CFGR_PLLSAI2R_Pos) + 1U) * 2U;
+ 800990c:	695a      	ldr	r2, [r3, #20]
+ 800990e:	f3c2 6241 	ubfx	r2, r2, #25, #2
+ 8009912:	3201      	adds	r2, #1
+ 8009914:	0052      	lsls	r2, r2, #1
+ 8009916:	6342      	str	r2, [r0, #52]	; 0x34
+  PeriphClkInit->Usart1ClockSelection  = __HAL_RCC_GET_USART1_SOURCE();
+ 8009918:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 800991c:	f002 0203 	and.w	r2, r2, #3
+ 8009920:	63c2      	str	r2, [r0, #60]	; 0x3c
+  PeriphClkInit->Usart2ClockSelection  = __HAL_RCC_GET_USART2_SOURCE();
+ 8009922:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8009926:	f002 020c 	and.w	r2, r2, #12
+ 800992a:	6402      	str	r2, [r0, #64]	; 0x40
+  PeriphClkInit->Usart3ClockSelection  = __HAL_RCC_GET_USART3_SOURCE();
+ 800992c:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8009930:	f002 0230 	and.w	r2, r2, #48	; 0x30
+ 8009934:	6442      	str	r2, [r0, #68]	; 0x44
+  PeriphClkInit->Uart4ClockSelection   = __HAL_RCC_GET_UART4_SOURCE();
+ 8009936:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 800993a:	f002 02c0 	and.w	r2, r2, #192	; 0xc0
+ 800993e:	6482      	str	r2, [r0, #72]	; 0x48
+  PeriphClkInit->Uart5ClockSelection   = __HAL_RCC_GET_UART5_SOURCE();
+ 8009940:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8009944:	f402 7240 	and.w	r2, r2, #768	; 0x300
+ 8009948:	64c2      	str	r2, [r0, #76]	; 0x4c
+  PeriphClkInit->Lpuart1ClockSelection = __HAL_RCC_GET_LPUART1_SOURCE();
+ 800994a:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 800994e:	f402 6240 	and.w	r2, r2, #3072	; 0xc00
+ 8009952:	6502      	str	r2, [r0, #80]	; 0x50
+  PeriphClkInit->I2c1ClockSelection    = __HAL_RCC_GET_I2C1_SOURCE();
+ 8009954:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8009958:	f402 5240 	and.w	r2, r2, #12288	; 0x3000
+ 800995c:	6542      	str	r2, [r0, #84]	; 0x54
+  PeriphClkInit->I2c2ClockSelection    = __HAL_RCC_GET_I2C2_SOURCE();
+ 800995e:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8009962:	f402 4240 	and.w	r2, r2, #49152	; 0xc000
+ 8009966:	6582      	str	r2, [r0, #88]	; 0x58
+  PeriphClkInit->I2c3ClockSelection    = __HAL_RCC_GET_I2C3_SOURCE();
+ 8009968:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 800996c:	f402 3240 	and.w	r2, r2, #196608	; 0x30000
+ 8009970:	65c2      	str	r2, [r0, #92]	; 0x5c
+  PeriphClkInit->I2c4ClockSelection    = __HAL_RCC_GET_I2C4_SOURCE();
+ 8009972:	f8d3 209c 	ldr.w	r2, [r3, #156]	; 0x9c
+ 8009976:	f002 0203 	and.w	r2, r2, #3
+ 800997a:	6602      	str	r2, [r0, #96]	; 0x60
+  PeriphClkInit->Lptim1ClockSelection  = __HAL_RCC_GET_LPTIM1_SOURCE();
+ 800997c:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 8009980:	f402 2240 	and.w	r2, r2, #786432	; 0xc0000
+ 8009984:	6642      	str	r2, [r0, #100]	; 0x64
+  PeriphClkInit->Lptim2ClockSelection  = __HAL_RCC_GET_LPTIM2_SOURCE();
+ 8009986:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 800998a:	f402 1240 	and.w	r2, r2, #3145728	; 0x300000
+ 800998e:	6682      	str	r2, [r0, #104]	; 0x68
+  PeriphClkInit->Sai1ClockSelection    = __HAL_RCC_GET_SAI1_SOURCE();
+ 8009990:	f8d3 209c 	ldr.w	r2, [r3, #156]	; 0x9c
+ 8009994:	f002 02e0 	and.w	r2, r2, #224	; 0xe0
+ 8009998:	66c2      	str	r2, [r0, #108]	; 0x6c
+  PeriphClkInit->Sai2ClockSelection    = __HAL_RCC_GET_SAI2_SOURCE();
+ 800999a:	f8d3 209c 	ldr.w	r2, [r3, #156]	; 0x9c
+ 800999e:	f402 62e0 	and.w	r2, r2, #1792	; 0x700
+ 80099a2:	6702      	str	r2, [r0, #112]	; 0x70
+  PeriphClkInit->RTCClockSelection     = __HAL_RCC_GET_RTC_SOURCE();
+ 80099a4:	f8d3 2090 	ldr.w	r2, [r3, #144]	; 0x90
+ 80099a8:	f402 7240 	and.w	r2, r2, #768	; 0x300
+ 80099ac:	f8c0 2090 	str.w	r2, [r0, #144]	; 0x90
+  PeriphClkInit->UsbClockSelection   = __HAL_RCC_GET_USB_SOURCE();
+ 80099b0:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 80099b4:	f002 6240 	and.w	r2, r2, #201326592	; 0xc000000
+ 80099b8:	6742      	str	r2, [r0, #116]	; 0x74
+  PeriphClkInit->Sdmmc1ClockSelection   = __HAL_RCC_GET_SDMMC1_SOURCE();
+ 80099ba:	f8d3 209c 	ldr.w	r2, [r3, #156]	; 0x9c
+ 80099be:	0452      	lsls	r2, r2, #17
+ 80099c0:	bf56      	itet	pl
+ 80099c2:	f8d3 2088 	ldrpl.w	r2, [r3, #136]	; 0x88
+ 80099c6:	f44f 4280 	movmi.w	r2, #16384	; 0x4000
+ 80099ca:	f002 6240 	andpl.w	r2, r2, #201326592	; 0xc000000
+ 80099ce:	6782      	str	r2, [r0, #120]	; 0x78
+  PeriphClkInit->RngClockSelection   = __HAL_RCC_GET_RNG_SOURCE();
+ 80099d0:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 80099d4:	f002 6240 	and.w	r2, r2, #201326592	; 0xc000000
+ 80099d8:	67c2      	str	r2, [r0, #124]	; 0x7c
+  PeriphClkInit->AdcClockSelection     = __HAL_RCC_GET_ADC_SOURCE();
+ 80099da:	f8d3 2088 	ldr.w	r2, [r3, #136]	; 0x88
+ 80099de:	f002 5240 	and.w	r2, r2, #805306368	; 0x30000000
+ 80099e2:	f8c0 2080 	str.w	r2, [r0, #128]	; 0x80
+  PeriphClkInit->Dfsdm1ClockSelection  = __HAL_RCC_GET_DFSDM1_SOURCE();
+ 80099e6:	f8d3 209c 	ldr.w	r2, [r3, #156]	; 0x9c
+ 80099ea:	f002 0204 	and.w	r2, r2, #4
+ 80099ee:	f8c0 2084 	str.w	r2, [r0, #132]	; 0x84
+  PeriphClkInit->Dfsdm1AudioClockSelection  = __HAL_RCC_GET_DFSDM1AUDIO_SOURCE();
+ 80099f2:	f8d3 209c 	ldr.w	r2, [r3, #156]	; 0x9c
+ 80099f6:	f002 0218 	and.w	r2, r2, #24
+ 80099fa:	f8c0 2088 	str.w	r2, [r0, #136]	; 0x88
+  PeriphClkInit->OspiClockSelection = __HAL_RCC_GET_OSPI_SOURCE();
+ 80099fe:	f8d3 309c 	ldr.w	r3, [r3, #156]	; 0x9c
+ 8009a02:	f403 1340 	and.w	r3, r3, #3145728	; 0x300000
+ 8009a06:	f8c0 308c 	str.w	r3, [r0, #140]	; 0x8c
+}
+ 8009a0a:	4770      	bx	lr
+ 8009a0c:	013f7fff 	.word	0x013f7fff
+ 8009a10:	40021000 	.word	0x40021000
+
+08009a14 <HAL_RCCEx_GetPeriphCLKFreq>:
+  if(PeriphClk == RCC_PERIPHCLK_RTC)
+ 8009a14:	f5b0 3f00 	cmp.w	r0, #131072	; 0x20000
+{
+ 8009a18:	b4f0      	push	{r4, r5, r6, r7}
+ 8009a1a:	4d9a      	ldr	r5, [pc, #616]	; (8009c84 <HAL_RCCEx_GetPeriphCLKFreq+0x270>)
+  if(PeriphClk == RCC_PERIPHCLK_RTC)
+ 8009a1c:	d11c      	bne.n	8009a58 <HAL_RCCEx_GetPeriphCLKFreq+0x44>
+    srcclk = __HAL_RCC_GET_RTC_SOURCE();
+ 8009a1e:	f8d5 3090 	ldr.w	r3, [r5, #144]	; 0x90
+ 8009a22:	f403 7340 	and.w	r3, r3, #768	; 0x300
+    switch(srcclk)
+ 8009a26:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 8009a2a:	f000 8085 	beq.w	8009b38 <HAL_RCCEx_GetPeriphCLKFreq+0x124>
+ 8009a2e:	f5b3 7f40 	cmp.w	r3, #768	; 0x300
+ 8009a32:	d00a      	beq.n	8009a4a <HAL_RCCEx_GetPeriphCLKFreq+0x36>
+ 8009a34:	f5b3 7f80 	cmp.w	r3, #256	; 0x100
+ 8009a38:	d154      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+          if(HAL_IS_BIT_SET(RCC->BDCR, RCC_BDCR_LSERDY))
+ 8009a3a:	f8d5 0090 	ldr.w	r0, [r5, #144]	; 0x90
+        frequency = LSE_VALUE;
+ 8009a3e:	f010 0002 	ands.w	r0, r0, #2
+ 8009a42:	bf18      	it	ne
+ 8009a44:	f44f 4000 	movne.w	r0, #32768	; 0x8000
+ 8009a48:	e11a      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_HSERDY))
+ 8009a4a:	6828      	ldr	r0, [r5, #0]
+        frequency = HSE_VALUE / 32U;
+ 8009a4c:	4b8e      	ldr	r3, [pc, #568]	; (8009c88 <HAL_RCCEx_GetPeriphCLKFreq+0x274>)
+ 8009a4e:	f410 3000 	ands.w	r0, r0, #131072	; 0x20000
+            frequency = HSI_VALUE;
+ 8009a52:	bf18      	it	ne
+ 8009a54:	4618      	movne	r0, r3
+ 8009a56:	e113      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+    pll_oscsource = __HAL_RCC_GET_PLL_OSCSOURCE();
+ 8009a58:	68eb      	ldr	r3, [r5, #12]
+ 8009a5a:	f003 0303 	and.w	r3, r3, #3
+    switch(pll_oscsource)
+ 8009a5e:	2b02      	cmp	r3, #2
+ 8009a60:	d02f      	beq.n	8009ac2 <HAL_RCCEx_GetPeriphCLKFreq+0xae>
+ 8009a62:	2b03      	cmp	r3, #3
+ 8009a64:	d034      	beq.n	8009ad0 <HAL_RCCEx_GetPeriphCLKFreq+0xbc>
+ 8009a66:	2b01      	cmp	r3, #1
+ 8009a68:	d137      	bne.n	8009ada <HAL_RCCEx_GetPeriphCLKFreq+0xc6>
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_MSIRDY))
+ 8009a6a:	6829      	ldr	r1, [r5, #0]
+ 8009a6c:	f011 0102 	ands.w	r1, r1, #2
+ 8009a70:	d00c      	beq.n	8009a8c <HAL_RCCEx_GetPeriphCLKFreq+0x78>
+        pllvco = MSIRangeTable[(__HAL_RCC_GET_MSI_RANGE() >> 4U)];
+ 8009a72:	682b      	ldr	r3, [r5, #0]
+ 8009a74:	4a85      	ldr	r2, [pc, #532]	; (8009c8c <HAL_RCCEx_GetPeriphCLKFreq+0x278>)
+ 8009a76:	0719      	lsls	r1, r3, #28
+ 8009a78:	bf4b      	itete	mi
+ 8009a7a:	682b      	ldrmi	r3, [r5, #0]
+ 8009a7c:	f8d5 3094 	ldrpl.w	r3, [r5, #148]	; 0x94
+ 8009a80:	f3c3 1303 	ubfxmi	r3, r3, #4, #4
+ 8009a84:	f3c3 2303 	ubfxpl	r3, r3, #8, #4
+ 8009a88:	f852 1023 	ldr.w	r1, [r2, r3, lsl #2]
+    switch(PeriphClk)
+ 8009a8c:	f5b0 6f80 	cmp.w	r0, #1024	; 0x400
+ 8009a90:	f000 8226 	beq.w	8009ee0 <HAL_RCCEx_GetPeriphCLKFreq+0x4cc>
+ 8009a94:	d858      	bhi.n	8009b48 <HAL_RCCEx_GetPeriphCLKFreq+0x134>
+ 8009a96:	2820      	cmp	r0, #32
+ 8009a98:	f000 81be 	beq.w	8009e18 <HAL_RCCEx_GetPeriphCLKFreq+0x404>
+ 8009a9c:	d824      	bhi.n	8009ae8 <HAL_RCCEx_GetPeriphCLKFreq+0xd4>
+ 8009a9e:	2808      	cmp	r0, #8
+ 8009aa0:	d81d      	bhi.n	8009ade <HAL_RCCEx_GetPeriphCLKFreq+0xca>
+ 8009aa2:	2800      	cmp	r0, #0
+ 8009aa4:	f000 80ec 	beq.w	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+ 8009aa8:	3801      	subs	r0, #1
+ 8009aaa:	2807      	cmp	r0, #7
+ 8009aac:	d81a      	bhi.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+ 8009aae:	e8df f010 	tbh	[pc, r0, lsl #1]
+ 8009ab2:	0164      	.short	0x0164
+ 8009ab4:	00190177 	.word	0x00190177
+ 8009ab8:	00190189 	.word	0x00190189
+ 8009abc:	00190019 	.word	0x00190019
+ 8009ac0:	0196      	.short	0x0196
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_HSIRDY))
+ 8009ac2:	6829      	ldr	r1, [r5, #0]
+        pllvco = HSI_VALUE;
+ 8009ac4:	4b72      	ldr	r3, [pc, #456]	; (8009c90 <HAL_RCCEx_GetPeriphCLKFreq+0x27c>)
+ 8009ac6:	f411 6180 	ands.w	r1, r1, #1024	; 0x400
+        pllvco = HSE_VALUE;
+ 8009aca:	bf18      	it	ne
+ 8009acc:	4619      	movne	r1, r3
+ 8009ace:	e7dd      	b.n	8009a8c <HAL_RCCEx_GetPeriphCLKFreq+0x78>
+      if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_HSERDY))
+ 8009ad0:	6829      	ldr	r1, [r5, #0]
+        pllvco = HSE_VALUE;
+ 8009ad2:	4b70      	ldr	r3, [pc, #448]	; (8009c94 <HAL_RCCEx_GetPeriphCLKFreq+0x280>)
+ 8009ad4:	f411 3100 	ands.w	r1, r1, #131072	; 0x20000
+ 8009ad8:	e7f7      	b.n	8009aca <HAL_RCCEx_GetPeriphCLKFreq+0xb6>
+    switch(pll_oscsource)
+ 8009ada:	2100      	movs	r1, #0
+ 8009adc:	e7d6      	b.n	8009a8c <HAL_RCCEx_GetPeriphCLKFreq+0x78>
+    switch(PeriphClk)
+ 8009ade:	2810      	cmp	r0, #16
+ 8009ae0:	f000 818a 	beq.w	8009df8 <HAL_RCCEx_GetPeriphCLKFreq+0x3e4>
+ 8009ae4:	2000      	movs	r0, #0
+ 8009ae6:	e0cb      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+ 8009ae8:	f5b0 7f80 	cmp.w	r0, #256	; 0x100
+ 8009aec:	f000 81ea 	beq.w	8009ec4 <HAL_RCCEx_GetPeriphCLKFreq+0x4b0>
+ 8009af0:	d80f      	bhi.n	8009b12 <HAL_RCCEx_GetPeriphCLKFreq+0xfe>
+ 8009af2:	2840      	cmp	r0, #64	; 0x40
+ 8009af4:	f000 81d5 	beq.w	8009ea2 <HAL_RCCEx_GetPeriphCLKFreq+0x48e>
+ 8009af8:	2880      	cmp	r0, #128	; 0x80
+ 8009afa:	d1f3      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+        srcclk = __HAL_RCC_GET_I2C2_SOURCE();
+ 8009afc:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009b00:	f403 4340 	and.w	r3, r3, #49152	; 0xc000
+        switch(srcclk)
+ 8009b04:	f5b3 4f80 	cmp.w	r3, #16384	; 0x4000
+ 8009b08:	f000 8157 	beq.w	8009dba <HAL_RCCEx_GetPeriphCLKFreq+0x3a6>
+ 8009b0c:	f5b3 4f00 	cmp.w	r3, #32768	; 0x8000
+ 8009b10:	e1d0      	b.n	8009eb4 <HAL_RCCEx_GetPeriphCLKFreq+0x4a0>
+    switch(PeriphClk)
+ 8009b12:	f5b0 7f00 	cmp.w	r0, #512	; 0x200
+ 8009b16:	d1e5      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+        srcclk = __HAL_RCC_GET_LPTIM1_SOURCE();
+ 8009b18:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009b1c:	f403 2340 	and.w	r3, r3, #786432	; 0xc0000
+        switch(srcclk)
+ 8009b20:	f5b3 2f00 	cmp.w	r3, #524288	; 0x80000
+ 8009b24:	f000 8137 	beq.w	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009b28:	f200 81d7 	bhi.w	8009eda <HAL_RCCEx_GetPeriphCLKFreq+0x4c6>
+ 8009b2c:	2b00      	cmp	r3, #0
+ 8009b2e:	f000 81c6 	beq.w	8009ebe <HAL_RCCEx_GetPeriphCLKFreq+0x4aa>
+ 8009b32:	f5b3 2f80 	cmp.w	r3, #262144	; 0x40000
+ 8009b36:	d1d5      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+          if(HAL_IS_BIT_SET(RCC->CSR, RCC_CSR_LSIRDY))
+ 8009b38:	f8d5 0094 	ldr.w	r0, [r5, #148]	; 0x94
+              frequency = LSI_VALUE;
+ 8009b3c:	f010 0002 	ands.w	r0, r0, #2
+ 8009b40:	bf18      	it	ne
+ 8009b42:	f44f 40fa 	movne.w	r0, #32000	; 0x7d00
+ 8009b46:	e09b      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+    switch(PeriphClk)
+ 8009b48:	f5b0 2f80 	cmp.w	r0, #262144	; 0x40000
+ 8009b4c:	d040      	beq.n	8009bd0 <HAL_RCCEx_GetPeriphCLKFreq+0x1bc>
+ 8009b4e:	d819      	bhi.n	8009b84 <HAL_RCCEx_GetPeriphCLKFreq+0x170>
+ 8009b50:	f5b0 5f00 	cmp.w	r0, #8192	; 0x2000
+ 8009b54:	d03c      	beq.n	8009bd0 <HAL_RCCEx_GetPeriphCLKFreq+0x1bc>
+ 8009b56:	d808      	bhi.n	8009b6a <HAL_RCCEx_GetPeriphCLKFreq+0x156>
+ 8009b58:	f5b0 6f00 	cmp.w	r0, #2048	; 0x800
+ 8009b5c:	d002      	beq.n	8009b64 <HAL_RCCEx_GetPeriphCLKFreq+0x150>
+ 8009b5e:	f5b0 5f80 	cmp.w	r0, #4096	; 0x1000
+ 8009b62:	d1bf      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+}
+ 8009b64:	bcf0      	pop	{r4, r5, r6, r7}
+          frequency = RCCEx_GetSAIxPeriphCLKFreq(RCC_PERIPHCLK_SAI1, pllvco);
+ 8009b66:	f7ff bb1b 	b.w	80091a0 <RCCEx_GetSAIxPeriphCLKFreq>
+    switch(PeriphClk)
+ 8009b6a:	f5b0 4f80 	cmp.w	r0, #16384	; 0x4000
+ 8009b6e:	f000 8163 	beq.w	8009e38 <HAL_RCCEx_GetPeriphCLKFreq+0x424>
+ 8009b72:	f5b0 3f80 	cmp.w	r0, #65536	; 0x10000
+ 8009b76:	d1b5      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+        srcclk = __HAL_RCC_GET_DFSDM1_SOURCE();
+ 8009b78:	f8d5 309c 	ldr.w	r3, [r5, #156]	; 0x9c
+        if(srcclk == RCC_DFSDM1CLKSOURCE_PCLK2)
+ 8009b7c:	075a      	lsls	r2, r3, #29
+ 8009b7e:	f100 811c 	bmi.w	8009dba <HAL_RCCEx_GetPeriphCLKFreq+0x3a6>
+ 8009b82:	e105      	b.n	8009d90 <HAL_RCCEx_GetPeriphCLKFreq+0x37c>
+    switch(PeriphClk)
+ 8009b84:	f5b0 1f00 	cmp.w	r0, #2097152	; 0x200000
+ 8009b88:	f000 817c 	beq.w	8009e84 <HAL_RCCEx_GetPeriphCLKFreq+0x470>
+ 8009b8c:	d80f      	bhi.n	8009bae <HAL_RCCEx_GetPeriphCLKFreq+0x19a>
+ 8009b8e:	f5b0 2f00 	cmp.w	r0, #524288	; 0x80000
+ 8009b92:	f000 8081 	beq.w	8009c98 <HAL_RCCEx_GetPeriphCLKFreq+0x284>
+ 8009b96:	f5b0 1f80 	cmp.w	r0, #1048576	; 0x100000
+ 8009b9a:	d1a3      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+        srcclk = __HAL_RCC_GET_I2C4_SOURCE();
+ 8009b9c:	f8d5 309c 	ldr.w	r3, [r5, #156]	; 0x9c
+ 8009ba0:	f003 0303 	and.w	r3, r3, #3
+        switch(srcclk)
+ 8009ba4:	2b01      	cmp	r3, #1
+ 8009ba6:	f000 8108 	beq.w	8009dba <HAL_RCCEx_GetPeriphCLKFreq+0x3a6>
+ 8009baa:	2b02      	cmp	r3, #2
+ 8009bac:	e182      	b.n	8009eb4 <HAL_RCCEx_GetPeriphCLKFreq+0x4a0>
+    switch(PeriphClk)
+ 8009bae:	f1b0 7f80 	cmp.w	r0, #16777216	; 0x1000000
+ 8009bb2:	d197      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+        srcclk = __HAL_RCC_GET_OSPI_SOURCE();
+ 8009bb4:	f8d5 309c 	ldr.w	r3, [r5, #156]	; 0x9c
+ 8009bb8:	f403 1340 	and.w	r3, r3, #3145728	; 0x300000
+        switch(srcclk)
+ 8009bbc:	f5b3 1f80 	cmp.w	r3, #1048576	; 0x100000
+ 8009bc0:	d033      	beq.n	8009c2a <HAL_RCCEx_GetPeriphCLKFreq+0x216>
+ 8009bc2:	f5b3 1f00 	cmp.w	r3, #2097152	; 0x200000
+ 8009bc6:	f000 819c 	beq.w	8009f02 <HAL_RCCEx_GetPeriphCLKFreq+0x4ee>
+ 8009bca:	2b00      	cmp	r3, #0
+ 8009bcc:	d18a      	bne.n	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+ 8009bce:	e0f4      	b.n	8009dba <HAL_RCCEx_GetPeriphCLKFreq+0x3a6>
+        srcclk = READ_BIT(RCC->CCIPR, RCC_CCIPR_CLK48SEL);
+ 8009bd0:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009bd4:	f003 6340 	and.w	r3, r3, #201326592	; 0xc000000
+        switch(srcclk)
+ 8009bd8:	f1b3 6f00 	cmp.w	r3, #134217728	; 0x8000000
+ 8009bdc:	d037      	beq.n	8009c4e <HAL_RCCEx_GetPeriphCLKFreq+0x23a>
+ 8009bde:	d820      	bhi.n	8009c22 <HAL_RCCEx_GetPeriphCLKFreq+0x20e>
+ 8009be0:	2b00      	cmp	r3, #0
+ 8009be2:	f000 80c4 	beq.w	8009d6e <HAL_RCCEx_GetPeriphCLKFreq+0x35a>
+ 8009be6:	f1b3 6f80 	cmp.w	r3, #67108864	; 0x4000000
+ 8009bea:	f47f af7b 	bne.w	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLSAI1RDY))
+ 8009bee:	6828      	ldr	r0, [r5, #0]
+ 8009bf0:	f010 6000 	ands.w	r0, r0, #134217728	; 0x8000000
+ 8009bf4:	d044      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            if(HAL_IS_BIT_SET(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1QEN))
+ 8009bf6:	6928      	ldr	r0, [r5, #16]
+ 8009bf8:	f410 1080 	ands.w	r0, r0, #1048576	; 0x100000
+ 8009bfc:	d040      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+              plln = READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1N) >> RCC_PLLSAI1CFGR_PLLSAI1N_Pos;
+ 8009bfe:	692f      	ldr	r7, [r5, #16]
+ 8009c00:	f3c7 2706 	ubfx	r7, r7, #8, #7
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009c04:	4379      	muls	r1, r7
+ 8009c06:	692f      	ldr	r7, [r5, #16]
+              frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1Q) >> RCC_PLLSAI1CFGR_PLLSAI1Q_Pos) + 1U) << 1U));
+ 8009c08:	6928      	ldr	r0, [r5, #16]
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009c0a:	f3c7 1703 	ubfx	r7, r7, #4, #4
+ 8009c0e:	3701      	adds	r7, #1
+ 8009c10:	fbb1 f1f7 	udiv	r1, r1, r7
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009c14:	f3c0 5041 	ubfx	r0, r0, #21, #2
+ 8009c18:	3001      	adds	r0, #1
+ 8009c1a:	0040      	lsls	r0, r0, #1
+ 8009c1c:	fbb1 f0f0 	udiv	r0, r1, r0
+ 8009c20:	e02e      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+ 8009c22:	f1b3 6f40 	cmp.w	r3, #201326592	; 0xc000000
+ 8009c26:	f47f af5d 	bne.w	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_MSIRDY))
+ 8009c2a:	6828      	ldr	r0, [r5, #0]
+ 8009c2c:	f010 0002 	ands.w	r0, r0, #2
+ 8009c30:	d026      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            frequency = MSIRangeTable[(__HAL_RCC_GET_MSI_RANGE() >> 4U)];
+ 8009c32:	682b      	ldr	r3, [r5, #0]
+ 8009c34:	4a15      	ldr	r2, [pc, #84]	; (8009c8c <HAL_RCCEx_GetPeriphCLKFreq+0x278>)
+ 8009c36:	071b      	lsls	r3, r3, #28
+ 8009c38:	bf4b      	itete	mi
+ 8009c3a:	682b      	ldrmi	r3, [r5, #0]
+ 8009c3c:	f8d5 3094 	ldrpl.w	r3, [r5, #148]	; 0x94
+ 8009c40:	f3c3 1303 	ubfxmi	r3, r3, #4, #4
+ 8009c44:	f3c3 2303 	ubfxpl	r3, r3, #8, #4
+ 8009c48:	f852 0023 	ldr.w	r0, [r2, r3, lsl #2]
+ 8009c4c:	e018      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLRDY))
+ 8009c4e:	6828      	ldr	r0, [r5, #0]
+ 8009c50:	f010 7000 	ands.w	r0, r0, #33554432	; 0x2000000
+ 8009c54:	d014      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            if(HAL_IS_BIT_SET(RCC->PLLCFGR, RCC_PLLCFGR_PLLQEN))
+ 8009c56:	68e8      	ldr	r0, [r5, #12]
+ 8009c58:	f410 1080 	ands.w	r0, r0, #1048576	; 0x100000
+ 8009c5c:	d010      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+              plln = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 8009c5e:	68e8      	ldr	r0, [r5, #12]
+ 8009c60:	f3c0 2006 	ubfx	r0, r0, #8, #7
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009c64:	4348      	muls	r0, r1
+ 8009c66:	68e9      	ldr	r1, [r5, #12]
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009c68:	68ed      	ldr	r5, [r5, #12]
+ 8009c6a:	f3c5 5541 	ubfx	r5, r5, #21, #2
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009c6e:	f3c1 1103 	ubfx	r1, r1, #4, #4
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009c72:	3501      	adds	r5, #1
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009c74:	3101      	adds	r1, #1
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009c76:	006d      	lsls	r5, r5, #1
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009c78:	fbb0 f0f1 	udiv	r0, r0, r1
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009c7c:	fbb0 f0f5 	udiv	r0, r0, r5
+}
+ 8009c80:	bcf0      	pop	{r4, r5, r6, r7}
+ 8009c82:	4770      	bx	lr
+ 8009c84:	40021000 	.word	0x40021000
+ 8009c88:	0003d090 	.word	0x0003d090
+ 8009c8c:	0800ea7c 	.word	0x0800ea7c
+ 8009c90:	00f42400 	.word	0x00f42400
+ 8009c94:	007a1200 	.word	0x007a1200
+      if(HAL_IS_BIT_SET(RCC->CCIPR2, RCC_CCIPR2_SDMMCSEL))  /* PLL "P" ? */
+ 8009c98:	f8d5 009c 	ldr.w	r0, [r5, #156]	; 0x9c
+ 8009c9c:	f410 4080 	ands.w	r0, r0, #16384	; 0x4000
+ 8009ca0:	d01f      	beq.n	8009ce2 <HAL_RCCEx_GetPeriphCLKFreq+0x2ce>
+        if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLRDY))
+ 8009ca2:	6828      	ldr	r0, [r5, #0]
+ 8009ca4:	f010 7000 	ands.w	r0, r0, #33554432	; 0x2000000
+ 8009ca8:	d0ea      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+          if(HAL_IS_BIT_SET(RCC->PLLCFGR, RCC_PLLCFGR_PLLPEN))
+ 8009caa:	68e8      	ldr	r0, [r5, #12]
+ 8009cac:	f410 3080 	ands.w	r0, r0, #65536	; 0x10000
+ 8009cb0:	d0e6      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            plln = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 8009cb2:	68ee      	ldr	r6, [r5, #12]
+ 8009cb4:	f3c6 2606 	ubfx	r6, r6, #8, #7
+            pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009cb8:	fb01 f006 	mul.w	r0, r1, r6
+ 8009cbc:	68ee      	ldr	r6, [r5, #12]
+            pllp = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLPDIV) >> RCC_PLLCFGR_PLLPDIV_Pos;
+ 8009cbe:	68eb      	ldr	r3, [r5, #12]
+            pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009cc0:	f3c6 1603 	ubfx	r6, r6, #4, #4
+            if(pllp == 0U)
+ 8009cc4:	0edb      	lsrs	r3, r3, #27
+            pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009cc6:	f106 0601 	add.w	r6, r6, #1
+ 8009cca:	fbb0 f0f6 	udiv	r0, r0, r6
+            if(pllp == 0U)
+ 8009cce:	d105      	bne.n	8009cdc <HAL_RCCEx_GetPeriphCLKFreq+0x2c8>
+              if(READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLP) != 0U)
+ 8009cd0:	68eb      	ldr	r3, [r5, #12]
+                pllp = 7U;
+ 8009cd2:	f413 3f00 	tst.w	r3, #131072	; 0x20000
+ 8009cd6:	bf14      	ite	ne
+ 8009cd8:	2311      	movne	r3, #17
+ 8009cda:	2307      	moveq	r3, #7
+            frequency = (pllvco / pllp);
+ 8009cdc:	fbb0 f0f3 	udiv	r0, r0, r3
+ 8009ce0:	e7ce      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+        srcclk = READ_BIT(RCC->CCIPR, RCC_CCIPR_CLK48SEL);
+ 8009ce2:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009ce6:	f003 6340 	and.w	r3, r3, #201326592	; 0xc000000
+        switch(srcclk)
+ 8009cea:	f1b3 6f00 	cmp.w	r3, #134217728	; 0x8000000
+ 8009cee:	d024      	beq.n	8009d3a <HAL_RCCEx_GetPeriphCLKFreq+0x326>
+ 8009cf0:	d81e      	bhi.n	8009d30 <HAL_RCCEx_GetPeriphCLKFreq+0x31c>
+ 8009cf2:	2b00      	cmp	r3, #0
+ 8009cf4:	d03b      	beq.n	8009d6e <HAL_RCCEx_GetPeriphCLKFreq+0x35a>
+ 8009cf6:	f1b3 6f80 	cmp.w	r3, #67108864	; 0x4000000
+ 8009cfa:	d1c1      	bne.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLSAI1RDY))
+ 8009cfc:	6828      	ldr	r0, [r5, #0]
+ 8009cfe:	f010 6000 	ands.w	r0, r0, #134217728	; 0x8000000
+ 8009d02:	d0bd      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            if(HAL_IS_BIT_SET(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1QEN))
+ 8009d04:	6928      	ldr	r0, [r5, #16]
+ 8009d06:	f410 1080 	ands.w	r0, r0, #1048576	; 0x100000
+ 8009d0a:	d0b9      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+              plln = READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1N) >> RCC_PLLSAI1CFGR_PLLSAI1N_Pos;
+ 8009d0c:	692a      	ldr	r2, [r5, #16]
+ 8009d0e:	f3c2 2206 	ubfx	r2, r2, #8, #7
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009d12:	434a      	muls	r2, r1
+ 8009d14:	6929      	ldr	r1, [r5, #16]
+              frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1Q) >> RCC_PLLSAI1CFGR_PLLSAI1Q_Pos) + 1U) << 1U));
+ 8009d16:	6928      	ldr	r0, [r5, #16]
+ 8009d18:	f3c0 5041 	ubfx	r0, r0, #21, #2
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009d1c:	f3c1 1103 	ubfx	r1, r1, #4, #4
+              frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1Q) >> RCC_PLLSAI1CFGR_PLLSAI1Q_Pos) + 1U) << 1U));
+ 8009d20:	3001      	adds	r0, #1
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009d22:	3101      	adds	r1, #1
+              frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1Q) >> RCC_PLLSAI1CFGR_PLLSAI1Q_Pos) + 1U) << 1U));
+ 8009d24:	0040      	lsls	r0, r0, #1
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009d26:	fbb2 f2f1 	udiv	r2, r2, r1
+              frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1Q) >> RCC_PLLSAI1CFGR_PLLSAI1Q_Pos) + 1U) << 1U));
+ 8009d2a:	fbb2 f0f0 	udiv	r0, r2, r0
+ 8009d2e:	e7a7      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+ 8009d30:	f1b3 6f40 	cmp.w	r3, #201326592	; 0xc000000
+ 8009d34:	f43f af79 	beq.w	8009c2a <HAL_RCCEx_GetPeriphCLKFreq+0x216>
+ 8009d38:	e7a2      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLRDY))
+ 8009d3a:	6828      	ldr	r0, [r5, #0]
+ 8009d3c:	f010 7000 	ands.w	r0, r0, #33554432	; 0x2000000
+ 8009d40:	d09e      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            if(HAL_IS_BIT_SET(RCC->PLLCFGR, RCC_PLLCFGR_PLLQEN))
+ 8009d42:	68e8      	ldr	r0, [r5, #12]
+ 8009d44:	f410 1080 	ands.w	r0, r0, #1048576	; 0x100000
+ 8009d48:	d09a      	beq.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+              plln = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 8009d4a:	68ec      	ldr	r4, [r5, #12]
+ 8009d4c:	f3c4 2406 	ubfx	r4, r4, #8, #7
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009d50:	434c      	muls	r4, r1
+ 8009d52:	68e9      	ldr	r1, [r5, #12]
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009d54:	68e8      	ldr	r0, [r5, #12]
+ 8009d56:	f3c0 5041 	ubfx	r0, r0, #21, #2
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009d5a:	f3c1 1103 	ubfx	r1, r1, #4, #4
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009d5e:	3001      	adds	r0, #1
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009d60:	3101      	adds	r1, #1
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009d62:	0040      	lsls	r0, r0, #1
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009d64:	fbb4 f4f1 	udiv	r4, r4, r1
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009d68:	fbb4 f0f0 	udiv	r0, r4, r0
+ 8009d6c:	e788      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+          if(HAL_IS_BIT_SET(RCC->CRRCR, RCC_CRRCR_HSI48RDY)) /* HSI48 ? */
+ 8009d6e:	f8d5 0098 	ldr.w	r0, [r5, #152]	; 0x98
+            frequency = HSI48_VALUE;
+ 8009d72:	4b6f      	ldr	r3, [pc, #444]	; (8009f30 <HAL_RCCEx_GetPeriphCLKFreq+0x51c>)
+ 8009d74:	f010 0002 	ands.w	r0, r0, #2
+ 8009d78:	e66b      	b.n	8009a52 <HAL_RCCEx_GetPeriphCLKFreq+0x3e>
+        srcclk = __HAL_RCC_GET_USART1_SOURCE();
+ 8009d7a:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009d7e:	f003 0303 	and.w	r3, r3, #3
+        switch(srcclk)
+ 8009d82:	2b02      	cmp	r3, #2
+ 8009d84:	d007      	beq.n	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009d86:	2b03      	cmp	r3, #3
+ 8009d88:	f43f ae57 	beq.w	8009a3a <HAL_RCCEx_GetPeriphCLKFreq+0x26>
+ 8009d8c:	2b01      	cmp	r3, #1
+ 8009d8e:	d014      	beq.n	8009dba <HAL_RCCEx_GetPeriphCLKFreq+0x3a6>
+}
+ 8009d90:	bcf0      	pop	{r4, r5, r6, r7}
+          frequency = HAL_RCC_GetPCLK2Freq();
+ 8009d92:	f7ff b95b 	b.w	800904c <HAL_RCC_GetPCLK2Freq>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_HSIRDY))
+ 8009d96:	6828      	ldr	r0, [r5, #0]
+            frequency = HSI_VALUE;
+ 8009d98:	4b66      	ldr	r3, [pc, #408]	; (8009f34 <HAL_RCCEx_GetPeriphCLKFreq+0x520>)
+ 8009d9a:	f410 6080 	ands.w	r0, r0, #1024	; 0x400
+ 8009d9e:	e658      	b.n	8009a52 <HAL_RCCEx_GetPeriphCLKFreq+0x3e>
+        srcclk = __HAL_RCC_GET_USART2_SOURCE();
+ 8009da0:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009da4:	f003 030c 	and.w	r3, r3, #12
+        switch(srcclk)
+ 8009da8:	2b08      	cmp	r3, #8
+ 8009daa:	d0f4      	beq.n	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009dac:	d808      	bhi.n	8009dc0 <HAL_RCCEx_GetPeriphCLKFreq+0x3ac>
+ 8009dae:	2b00      	cmp	r3, #0
+ 8009db0:	f000 8085 	beq.w	8009ebe <HAL_RCCEx_GetPeriphCLKFreq+0x4aa>
+ 8009db4:	2b04      	cmp	r3, #4
+ 8009db6:	f47f ae95 	bne.w	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+}
+ 8009dba:	bcf0      	pop	{r4, r5, r6, r7}
+          frequency = HAL_RCC_GetSysClockFreq();
+ 8009dbc:	f7fe bd38 	b.w	8008830 <HAL_RCC_GetSysClockFreq>
+ 8009dc0:	2b0c      	cmp	r3, #12
+ 8009dc2:	e639      	b.n	8009a38 <HAL_RCCEx_GetPeriphCLKFreq+0x24>
+        srcclk = __HAL_RCC_GET_USART3_SOURCE();
+ 8009dc4:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009dc8:	f003 0330 	and.w	r3, r3, #48	; 0x30
+        switch(srcclk)
+ 8009dcc:	2b20      	cmp	r3, #32
+ 8009dce:	d0e2      	beq.n	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009dd0:	d803      	bhi.n	8009dda <HAL_RCCEx_GetPeriphCLKFreq+0x3c6>
+ 8009dd2:	2b00      	cmp	r3, #0
+ 8009dd4:	d073      	beq.n	8009ebe <HAL_RCCEx_GetPeriphCLKFreq+0x4aa>
+ 8009dd6:	2b10      	cmp	r3, #16
+ 8009dd8:	e7ed      	b.n	8009db6 <HAL_RCCEx_GetPeriphCLKFreq+0x3a2>
+ 8009dda:	2b30      	cmp	r3, #48	; 0x30
+ 8009ddc:	e62c      	b.n	8009a38 <HAL_RCCEx_GetPeriphCLKFreq+0x24>
+        srcclk = __HAL_RCC_GET_UART4_SOURCE();
+ 8009dde:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009de2:	f003 03c0 	and.w	r3, r3, #192	; 0xc0
+        switch(srcclk)
+ 8009de6:	2b80      	cmp	r3, #128	; 0x80
+ 8009de8:	d0d5      	beq.n	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009dea:	d803      	bhi.n	8009df4 <HAL_RCCEx_GetPeriphCLKFreq+0x3e0>
+ 8009dec:	2b00      	cmp	r3, #0
+ 8009dee:	d066      	beq.n	8009ebe <HAL_RCCEx_GetPeriphCLKFreq+0x4aa>
+ 8009df0:	2b40      	cmp	r3, #64	; 0x40
+ 8009df2:	e7e0      	b.n	8009db6 <HAL_RCCEx_GetPeriphCLKFreq+0x3a2>
+ 8009df4:	2bc0      	cmp	r3, #192	; 0xc0
+ 8009df6:	e61f      	b.n	8009a38 <HAL_RCCEx_GetPeriphCLKFreq+0x24>
+        srcclk = __HAL_RCC_GET_UART5_SOURCE();
+ 8009df8:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009dfc:	f403 7340 	and.w	r3, r3, #768	; 0x300
+        switch(srcclk)
+ 8009e00:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 8009e04:	d0c7      	beq.n	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009e06:	d804      	bhi.n	8009e12 <HAL_RCCEx_GetPeriphCLKFreq+0x3fe>
+ 8009e08:	2b00      	cmp	r3, #0
+ 8009e0a:	d058      	beq.n	8009ebe <HAL_RCCEx_GetPeriphCLKFreq+0x4aa>
+ 8009e0c:	f5b3 7f80 	cmp.w	r3, #256	; 0x100
+ 8009e10:	e7d1      	b.n	8009db6 <HAL_RCCEx_GetPeriphCLKFreq+0x3a2>
+ 8009e12:	f5b3 7f40 	cmp.w	r3, #768	; 0x300
+ 8009e16:	e60f      	b.n	8009a38 <HAL_RCCEx_GetPeriphCLKFreq+0x24>
+        srcclk = __HAL_RCC_GET_LPUART1_SOURCE();
+ 8009e18:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009e1c:	f403 6340 	and.w	r3, r3, #3072	; 0xc00
+        switch(srcclk)
+ 8009e20:	f5b3 6f00 	cmp.w	r3, #2048	; 0x800
+ 8009e24:	d0b7      	beq.n	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009e26:	d804      	bhi.n	8009e32 <HAL_RCCEx_GetPeriphCLKFreq+0x41e>
+ 8009e28:	2b00      	cmp	r3, #0
+ 8009e2a:	d048      	beq.n	8009ebe <HAL_RCCEx_GetPeriphCLKFreq+0x4aa>
+ 8009e2c:	f5b3 6f80 	cmp.w	r3, #1024	; 0x400
+ 8009e30:	e7c1      	b.n	8009db6 <HAL_RCCEx_GetPeriphCLKFreq+0x3a2>
+ 8009e32:	f5b3 6f40 	cmp.w	r3, #3072	; 0xc00
+ 8009e36:	e5ff      	b.n	8009a38 <HAL_RCCEx_GetPeriphCLKFreq+0x24>
+        srcclk = __HAL_RCC_GET_ADC_SOURCE();
+ 8009e38:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009e3c:	f003 5340 	and.w	r3, r3, #805306368	; 0x30000000
+        switch(srcclk)
+ 8009e40:	f1b3 5f80 	cmp.w	r3, #268435456	; 0x10000000
+ 8009e44:	d002      	beq.n	8009e4c <HAL_RCCEx_GetPeriphCLKFreq+0x438>
+ 8009e46:	f1b3 5f40 	cmp.w	r3, #805306368	; 0x30000000
+ 8009e4a:	e7b4      	b.n	8009db6 <HAL_RCCEx_GetPeriphCLKFreq+0x3a2>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLSAI1RDY) && (__HAL_RCC_GET_PLLSAI1CLKOUT_CONFIG(RCC_PLLSAI1_ADC1CLK) != 0U))
+ 8009e4c:	6828      	ldr	r0, [r5, #0]
+ 8009e4e:	f010 6000 	ands.w	r0, r0, #134217728	; 0x8000000
+ 8009e52:	f43f af15 	beq.w	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+ 8009e56:	6928      	ldr	r0, [r5, #16]
+ 8009e58:	f010 7080 	ands.w	r0, r0, #16777216	; 0x1000000
+ 8009e5c:	f43f af10 	beq.w	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            plln = READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1N) >> RCC_PLLSAI1CFGR_PLLSAI1N_Pos;
+ 8009e60:	692b      	ldr	r3, [r5, #16]
+ 8009e62:	f3c3 2306 	ubfx	r3, r3, #8, #7
+            pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009e66:	434b      	muls	r3, r1
+ 8009e68:	6929      	ldr	r1, [r5, #16]
+            frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1R) >> RCC_PLLSAI1CFGR_PLLSAI1R_Pos) + 1U) << 1U));
+ 8009e6a:	6928      	ldr	r0, [r5, #16]
+ 8009e6c:	f3c0 6041 	ubfx	r0, r0, #25, #2
+            pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009e70:	f3c1 1103 	ubfx	r1, r1, #4, #4
+            frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1R) >> RCC_PLLSAI1CFGR_PLLSAI1R_Pos) + 1U) << 1U));
+ 8009e74:	3001      	adds	r0, #1
+            pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009e76:	3101      	adds	r1, #1
+            frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1R) >> RCC_PLLSAI1CFGR_PLLSAI1R_Pos) + 1U) << 1U));
+ 8009e78:	0040      	lsls	r0, r0, #1
+            pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1M) >> RCC_PLLSAI1CFGR_PLLSAI1M_Pos) + 1U));
+ 8009e7a:	fbb3 f3f1 	udiv	r3, r3, r1
+            frequency = (pllvco / (((READ_BIT(RCC->PLLSAI1CFGR, RCC_PLLSAI1CFGR_PLLSAI1R) >> RCC_PLLSAI1CFGR_PLLSAI1R_Pos) + 1U) << 1U));
+ 8009e7e:	fbb3 f0f0 	udiv	r0, r3, r0
+ 8009e82:	e6fd      	b.n	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+        srcclk = __HAL_RCC_GET_DFSDM1AUDIO_SOURCE();
+ 8009e84:	f8d5 309c 	ldr.w	r3, [r5, #156]	; 0x9c
+ 8009e88:	f003 0318 	and.w	r3, r3, #24
+        switch(srcclk)
+ 8009e8c:	2b08      	cmp	r3, #8
+ 8009e8e:	d082      	beq.n	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009e90:	2b10      	cmp	r3, #16
+ 8009e92:	f43f aeca 	beq.w	8009c2a <HAL_RCCEx_GetPeriphCLKFreq+0x216>
+ 8009e96:	2b00      	cmp	r3, #0
+ 8009e98:	f47f ae24 	bne.w	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+          frequency = RCCEx_GetSAIxPeriphCLKFreq(RCC_PERIPHCLK_SAI1, pllvco);
+ 8009e9c:	f44f 6000 	mov.w	r0, #2048	; 0x800
+ 8009ea0:	e660      	b.n	8009b64 <HAL_RCCEx_GetPeriphCLKFreq+0x150>
+        srcclk = __HAL_RCC_GET_I2C1_SOURCE();
+ 8009ea2:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009ea6:	f403 5340 	and.w	r3, r3, #12288	; 0x3000
+        switch(srcclk)
+ 8009eaa:	f5b3 5f80 	cmp.w	r3, #4096	; 0x1000
+ 8009eae:	d084      	beq.n	8009dba <HAL_RCCEx_GetPeriphCLKFreq+0x3a6>
+ 8009eb0:	f5b3 5f00 	cmp.w	r3, #8192	; 0x2000
+ 8009eb4:	f43f af6f 	beq.w	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009eb8:	2b00      	cmp	r3, #0
+ 8009eba:	f47f ae13 	bne.w	8009ae4 <HAL_RCCEx_GetPeriphCLKFreq+0xd0>
+}
+ 8009ebe:	bcf0      	pop	{r4, r5, r6, r7}
+          frequency = HAL_RCC_GetPCLK1Freq();
+ 8009ec0:	f7ff b8b2 	b.w	8009028 <HAL_RCC_GetPCLK1Freq>
+        srcclk = __HAL_RCC_GET_I2C3_SOURCE();
+ 8009ec4:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009ec8:	f403 3340 	and.w	r3, r3, #196608	; 0x30000
+        switch(srcclk)
+ 8009ecc:	f5b3 3f80 	cmp.w	r3, #65536	; 0x10000
+ 8009ed0:	f43f af73 	beq.w	8009dba <HAL_RCCEx_GetPeriphCLKFreq+0x3a6>
+ 8009ed4:	f5b3 3f00 	cmp.w	r3, #131072	; 0x20000
+ 8009ed8:	e7ec      	b.n	8009eb4 <HAL_RCCEx_GetPeriphCLKFreq+0x4a0>
+ 8009eda:	f5b3 2f40 	cmp.w	r3, #786432	; 0xc0000
+ 8009ede:	e5ab      	b.n	8009a38 <HAL_RCCEx_GetPeriphCLKFreq+0x24>
+       srcclk = __HAL_RCC_GET_LPTIM2_SOURCE();
+ 8009ee0:	f8d5 3088 	ldr.w	r3, [r5, #136]	; 0x88
+ 8009ee4:	f403 1340 	and.w	r3, r3, #3145728	; 0x300000
+        switch(srcclk)
+ 8009ee8:	f5b3 1f00 	cmp.w	r3, #2097152	; 0x200000
+ 8009eec:	f43f af53 	beq.w	8009d96 <HAL_RCCEx_GetPeriphCLKFreq+0x382>
+ 8009ef0:	d804      	bhi.n	8009efc <HAL_RCCEx_GetPeriphCLKFreq+0x4e8>
+ 8009ef2:	2b00      	cmp	r3, #0
+ 8009ef4:	d0e3      	beq.n	8009ebe <HAL_RCCEx_GetPeriphCLKFreq+0x4aa>
+ 8009ef6:	f5b3 1f80 	cmp.w	r3, #1048576	; 0x100000
+ 8009efa:	e61c      	b.n	8009b36 <HAL_RCCEx_GetPeriphCLKFreq+0x122>
+ 8009efc:	f5b3 1f40 	cmp.w	r3, #3145728	; 0x300000
+ 8009f00:	e59a      	b.n	8009a38 <HAL_RCCEx_GetPeriphCLKFreq+0x24>
+          if(HAL_IS_BIT_SET(RCC->CR, RCC_CR_PLLRDY))
+ 8009f02:	6828      	ldr	r0, [r5, #0]
+ 8009f04:	f010 7000 	ands.w	r0, r0, #33554432	; 0x2000000
+ 8009f08:	f43f aeba 	beq.w	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+            if(HAL_IS_BIT_SET(RCC->PLLCFGR, RCC_PLLCFGR_PLLQEN))
+ 8009f0c:	68e8      	ldr	r0, [r5, #12]
+ 8009f0e:	f410 1080 	ands.w	r0, r0, #1048576	; 0x100000
+ 8009f12:	f43f aeb5 	beq.w	8009c80 <HAL_RCCEx_GetPeriphCLKFreq+0x26c>
+              plln = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 8009f16:	68e8      	ldr	r0, [r5, #12]
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009f18:	68eb      	ldr	r3, [r5, #12]
+              plln = READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLN) >> RCC_PLLCFGR_PLLN_Pos;
+ 8009f1a:	f3c0 2006 	ubfx	r0, r0, #8, #7
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009f1e:	f3c3 1303 	ubfx	r3, r3, #4, #4
+ 8009f22:	4341      	muls	r1, r0
+ 8009f24:	3301      	adds	r3, #1
+              frequency = (pllvco / (((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLQ) >> RCC_PLLCFGR_PLLQ_Pos) + 1U) << 1U));
+ 8009f26:	68e8      	ldr	r0, [r5, #12]
+              pllvco = ((pllvco * plln) / ((READ_BIT(RCC->PLLCFGR, RCC_PLLCFGR_PLLM) >> RCC_PLLCFGR_PLLM_Pos) + 1U));
+ 8009f28:	fbb1 f1f3 	udiv	r1, r1, r3
+ 8009f2c:	e672      	b.n	8009c14 <HAL_RCCEx_GetPeriphCLKFreq+0x200>
+ 8009f2e:	bf00      	nop
+ 8009f30:	02dc6c00 	.word	0x02dc6c00
+ 8009f34:	00f42400 	.word	0x00f42400
+
+08009f38 <HAL_RCCEx_EnablePLLSAI1>:
+{
+ 8009f38:	b570      	push	{r4, r5, r6, lr}
+  __HAL_RCC_PLLSAI1_DISABLE();
+ 8009f3a:	4c20      	ldr	r4, [pc, #128]	; (8009fbc <HAL_RCCEx_EnablePLLSAI1+0x84>)
+ 8009f3c:	6823      	ldr	r3, [r4, #0]
+ 8009f3e:	f023 6380 	bic.w	r3, r3, #67108864	; 0x4000000
+ 8009f42:	6023      	str	r3, [r4, #0]
+{
+ 8009f44:	4605      	mov	r5, r0
+  tickstart = HAL_GetTick();
+ 8009f46:	f7fd f903 	bl	8007150 <HAL_GetTick>
+ 8009f4a:	4606      	mov	r6, r0
+  while(READ_BIT(RCC->CR, RCC_CR_PLLSAI1RDY) != 0U)
+ 8009f4c:	6823      	ldr	r3, [r4, #0]
+ 8009f4e:	011a      	lsls	r2, r3, #4
+ 8009f50:	d423      	bmi.n	8009f9a <HAL_RCCEx_EnablePLLSAI1+0x62>
+    __HAL_RCC_PLLSAI1_CONFIG(PLLSAI1Init->PLLSAI1M, PLLSAI1Init->PLLSAI1N, PLLSAI1Init->PLLSAI1P, PLLSAI1Init->PLLSAI1Q, PLLSAI1Init->PLLSAI1R);
+ 8009f52:	e9d5 2302 	ldrd	r2, r3, [r5, #8]
+ 8009f56:	06db      	lsls	r3, r3, #27
+ 8009f58:	6921      	ldr	r1, [r4, #16]
+ 8009f5a:	ea43 2302 	orr.w	r3, r3, r2, lsl #8
+ 8009f5e:	4a18      	ldr	r2, [pc, #96]	; (8009fc0 <HAL_RCCEx_EnablePLLSAI1+0x88>)
+ 8009f60:	400a      	ands	r2, r1
+ 8009f62:	4313      	orrs	r3, r2
+ 8009f64:	686a      	ldr	r2, [r5, #4]
+ 8009f66:	3a01      	subs	r2, #1
+ 8009f68:	ea43 1302 	orr.w	r3, r3, r2, lsl #4
+ 8009f6c:	692a      	ldr	r2, [r5, #16]
+ 8009f6e:	0852      	lsrs	r2, r2, #1
+ 8009f70:	3a01      	subs	r2, #1
+ 8009f72:	ea43 5342 	orr.w	r3, r3, r2, lsl #21
+ 8009f76:	696a      	ldr	r2, [r5, #20]
+ 8009f78:	0852      	lsrs	r2, r2, #1
+ 8009f7a:	3a01      	subs	r2, #1
+ 8009f7c:	ea43 6342 	orr.w	r3, r3, r2, lsl #25
+ 8009f80:	6123      	str	r3, [r4, #16]
+    __HAL_RCC_PLLSAI1CLKOUT_ENABLE(PLLSAI1Init->PLLSAI1ClockOut);
+ 8009f82:	6923      	ldr	r3, [r4, #16]
+ 8009f84:	69aa      	ldr	r2, [r5, #24]
+ 8009f86:	4313      	orrs	r3, r2
+ 8009f88:	6123      	str	r3, [r4, #16]
+    __HAL_RCC_PLLSAI1_ENABLE();
+ 8009f8a:	6823      	ldr	r3, [r4, #0]
+ 8009f8c:	f043 6380 	orr.w	r3, r3, #67108864	; 0x4000000
+ 8009f90:	6023      	str	r3, [r4, #0]
+    tickstart = HAL_GetTick();
+ 8009f92:	f7fd f8dd 	bl	8007150 <HAL_GetTick>
+ 8009f96:	4605      	mov	r5, r0
+    while(READ_BIT(RCC->CR, RCC_CR_PLLSAI1RDY) == 0U)
+ 8009f98:	e00b      	b.n	8009fb2 <HAL_RCCEx_EnablePLLSAI1+0x7a>
+    if((HAL_GetTick() - tickstart) > PLLSAI1_TIMEOUT_VALUE)
+ 8009f9a:	f7fd f8d9 	bl	8007150 <HAL_GetTick>
+ 8009f9e:	1b80      	subs	r0, r0, r6
+ 8009fa0:	2802      	cmp	r0, #2
+ 8009fa2:	d9d3      	bls.n	8009f4c <HAL_RCCEx_EnablePLLSAI1+0x14>
+      status = HAL_TIMEOUT;
+ 8009fa4:	2003      	movs	r0, #3
+}
+ 8009fa6:	bd70      	pop	{r4, r5, r6, pc}
+      if((HAL_GetTick() - tickstart) > PLLSAI1_TIMEOUT_VALUE)
+ 8009fa8:	f7fd f8d2 	bl	8007150 <HAL_GetTick>
+ 8009fac:	1b40      	subs	r0, r0, r5
+ 8009fae:	2802      	cmp	r0, #2
+ 8009fb0:	d8f8      	bhi.n	8009fa4 <HAL_RCCEx_EnablePLLSAI1+0x6c>
+    while(READ_BIT(RCC->CR, RCC_CR_PLLSAI1RDY) == 0U)
+ 8009fb2:	6823      	ldr	r3, [r4, #0]
+ 8009fb4:	011b      	lsls	r3, r3, #4
+ 8009fb6:	d5f7      	bpl.n	8009fa8 <HAL_RCCEx_EnablePLLSAI1+0x70>
+ 8009fb8:	2000      	movs	r0, #0
+  return status;
+ 8009fba:	e7f4      	b.n	8009fa6 <HAL_RCCEx_EnablePLLSAI1+0x6e>
+ 8009fbc:	40021000 	.word	0x40021000
+ 8009fc0:	019d800f 	.word	0x019d800f
+
+08009fc4 <HAL_RCCEx_DisablePLLSAI1>:
+{
+ 8009fc4:	b538      	push	{r3, r4, r5, lr}
+  __HAL_RCC_PLLSAI1_DISABLE();
+ 8009fc6:	4c11      	ldr	r4, [pc, #68]	; (800a00c <HAL_RCCEx_DisablePLLSAI1+0x48>)
+ 8009fc8:	6823      	ldr	r3, [r4, #0]
+ 8009fca:	f023 6380 	bic.w	r3, r3, #67108864	; 0x4000000
+ 8009fce:	6023      	str	r3, [r4, #0]
+  tickstart = HAL_GetTick();
+ 8009fd0:	f7fd f8be 	bl	8007150 <HAL_GetTick>
+ 8009fd4:	4605      	mov	r5, r0
+  while(READ_BIT(RCC->CR, RCC_CR_PLLSAI1RDY) != 0U)
+ 8009fd6:	6823      	ldr	r3, [r4, #0]
+ 8009fd8:	f013 6300 	ands.w	r3, r3, #134217728	; 0x8000000
+ 8009fdc:	d10f      	bne.n	8009ffe <HAL_RCCEx_DisablePLLSAI1+0x3a>
+  HAL_StatusTypeDef status = HAL_OK;
+ 8009fde:	4618      	mov	r0, r3
+  __HAL_RCC_PLLSAI1CLKOUT_DISABLE(RCC_PLLSAI1CFGR_PLLSAI1PEN|RCC_PLLSAI1CFGR_PLLSAI1QEN|RCC_PLLSAI1CFGR_PLLSAI1REN);
+ 8009fe0:	6923      	ldr	r3, [r4, #16]
+ 8009fe2:	f023 7388 	bic.w	r3, r3, #17825792	; 0x1100000
+ 8009fe6:	f423 3380 	bic.w	r3, r3, #65536	; 0x10000
+ 8009fea:	6123      	str	r3, [r4, #16]
+  if(READ_BIT(RCC->CR, (RCC_CR_PLLRDY | RCC_CR_PLLSAI2RDY)) == 0U)
+ 8009fec:	6823      	ldr	r3, [r4, #0]
+ 8009fee:	f013 5f08 	tst.w	r3, #570425344	; 0x22000000
+    MODIFY_REG(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC, RCC_PLLSOURCE_NONE);
+ 8009ff2:	bf02      	ittt	eq
+ 8009ff4:	68e3      	ldreq	r3, [r4, #12]
+ 8009ff6:	f023 0303 	biceq.w	r3, r3, #3
+ 8009ffa:	60e3      	streq	r3, [r4, #12]
+}
+ 8009ffc:	bd38      	pop	{r3, r4, r5, pc}
+    if((HAL_GetTick() - tickstart) > PLLSAI1_TIMEOUT_VALUE)
+ 8009ffe:	f7fd f8a7 	bl	8007150 <HAL_GetTick>
+ 800a002:	1b40      	subs	r0, r0, r5
+ 800a004:	2802      	cmp	r0, #2
+ 800a006:	d9e6      	bls.n	8009fd6 <HAL_RCCEx_DisablePLLSAI1+0x12>
+      status = HAL_TIMEOUT;
+ 800a008:	2003      	movs	r0, #3
+ 800a00a:	e7e9      	b.n	8009fe0 <HAL_RCCEx_DisablePLLSAI1+0x1c>
+ 800a00c:	40021000 	.word	0x40021000
+
+0800a010 <HAL_RCCEx_EnablePLLSAI2>:
+{
+ 800a010:	b570      	push	{r4, r5, r6, lr}
+  __HAL_RCC_PLLSAI2_DISABLE();
+ 800a012:	4c20      	ldr	r4, [pc, #128]	; (800a094 <HAL_RCCEx_EnablePLLSAI2+0x84>)
+ 800a014:	6823      	ldr	r3, [r4, #0]
+ 800a016:	f023 5380 	bic.w	r3, r3, #268435456	; 0x10000000
+ 800a01a:	6023      	str	r3, [r4, #0]
+{
+ 800a01c:	4605      	mov	r5, r0
+  tickstart = HAL_GetTick();
+ 800a01e:	f7fd f897 	bl	8007150 <HAL_GetTick>
+ 800a022:	4606      	mov	r6, r0
+  while(READ_BIT(RCC->CR, RCC_CR_PLLSAI2RDY) != 0U)
+ 800a024:	6823      	ldr	r3, [r4, #0]
+ 800a026:	009a      	lsls	r2, r3, #2
+ 800a028:	d423      	bmi.n	800a072 <HAL_RCCEx_EnablePLLSAI2+0x62>
+    __HAL_RCC_PLLSAI2_CONFIG(PLLSAI2Init->PLLSAI2M, PLLSAI2Init->PLLSAI2N, PLLSAI2Init->PLLSAI2P, PLLSAI2Init->PLLSAI2Q, PLLSAI2Init->PLLSAI2R);
+ 800a02a:	e9d5 2302 	ldrd	r2, r3, [r5, #8]
+ 800a02e:	06db      	lsls	r3, r3, #27
+ 800a030:	6961      	ldr	r1, [r4, #20]
+ 800a032:	ea43 2302 	orr.w	r3, r3, r2, lsl #8
+ 800a036:	4a18      	ldr	r2, [pc, #96]	; (800a098 <HAL_RCCEx_EnablePLLSAI2+0x88>)
+ 800a038:	400a      	ands	r2, r1
+ 800a03a:	4313      	orrs	r3, r2
+ 800a03c:	686a      	ldr	r2, [r5, #4]
+ 800a03e:	3a01      	subs	r2, #1
+ 800a040:	ea43 1302 	orr.w	r3, r3, r2, lsl #4
+ 800a044:	692a      	ldr	r2, [r5, #16]
+ 800a046:	0852      	lsrs	r2, r2, #1
+ 800a048:	3a01      	subs	r2, #1
+ 800a04a:	ea43 5342 	orr.w	r3, r3, r2, lsl #21
+ 800a04e:	696a      	ldr	r2, [r5, #20]
+ 800a050:	0852      	lsrs	r2, r2, #1
+ 800a052:	3a01      	subs	r2, #1
+ 800a054:	ea43 6342 	orr.w	r3, r3, r2, lsl #25
+ 800a058:	6163      	str	r3, [r4, #20]
+    __HAL_RCC_PLLSAI2CLKOUT_ENABLE(PLLSAI2Init->PLLSAI2ClockOut);
+ 800a05a:	6963      	ldr	r3, [r4, #20]
+ 800a05c:	69aa      	ldr	r2, [r5, #24]
+ 800a05e:	4313      	orrs	r3, r2
+ 800a060:	6163      	str	r3, [r4, #20]
+    __HAL_RCC_PLLSAI2_ENABLE();
+ 800a062:	6823      	ldr	r3, [r4, #0]
+ 800a064:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+ 800a068:	6023      	str	r3, [r4, #0]
+    tickstart = HAL_GetTick();
+ 800a06a:	f7fd f871 	bl	8007150 <HAL_GetTick>
+ 800a06e:	4605      	mov	r5, r0
+    while(READ_BIT(RCC->CR, RCC_CR_PLLSAI2RDY) == 0U)
+ 800a070:	e00b      	b.n	800a08a <HAL_RCCEx_EnablePLLSAI2+0x7a>
+    if((HAL_GetTick() - tickstart) > PLLSAI2_TIMEOUT_VALUE)
+ 800a072:	f7fd f86d 	bl	8007150 <HAL_GetTick>
+ 800a076:	1b80      	subs	r0, r0, r6
+ 800a078:	2802      	cmp	r0, #2
+ 800a07a:	d9d3      	bls.n	800a024 <HAL_RCCEx_EnablePLLSAI2+0x14>
+      status = HAL_TIMEOUT;
+ 800a07c:	2003      	movs	r0, #3
+}
+ 800a07e:	bd70      	pop	{r4, r5, r6, pc}
+      if((HAL_GetTick() - tickstart) > PLLSAI2_TIMEOUT_VALUE)
+ 800a080:	f7fd f866 	bl	8007150 <HAL_GetTick>
+ 800a084:	1b40      	subs	r0, r0, r5
+ 800a086:	2802      	cmp	r0, #2
+ 800a088:	d8f8      	bhi.n	800a07c <HAL_RCCEx_EnablePLLSAI2+0x6c>
+    while(READ_BIT(RCC->CR, RCC_CR_PLLSAI2RDY) == 0U)
+ 800a08a:	6823      	ldr	r3, [r4, #0]
+ 800a08c:	009b      	lsls	r3, r3, #2
+ 800a08e:	d5f7      	bpl.n	800a080 <HAL_RCCEx_EnablePLLSAI2+0x70>
+ 800a090:	2000      	movs	r0, #0
+  return status;
+ 800a092:	e7f4      	b.n	800a07e <HAL_RCCEx_EnablePLLSAI2+0x6e>
+ 800a094:	40021000 	.word	0x40021000
+ 800a098:	019d800f 	.word	0x019d800f
+
+0800a09c <HAL_RCCEx_DisablePLLSAI2>:
+{
+ 800a09c:	b538      	push	{r3, r4, r5, lr}
+  __HAL_RCC_PLLSAI2_DISABLE();
+ 800a09e:	4c11      	ldr	r4, [pc, #68]	; (800a0e4 <HAL_RCCEx_DisablePLLSAI2+0x48>)
+ 800a0a0:	6823      	ldr	r3, [r4, #0]
+ 800a0a2:	f023 5380 	bic.w	r3, r3, #268435456	; 0x10000000
+ 800a0a6:	6023      	str	r3, [r4, #0]
+  tickstart = HAL_GetTick();
+ 800a0a8:	f7fd f852 	bl	8007150 <HAL_GetTick>
+ 800a0ac:	4605      	mov	r5, r0
+  while(READ_BIT(RCC->CR, RCC_CR_PLLSAI2RDY) != 0U)
+ 800a0ae:	6823      	ldr	r3, [r4, #0]
+ 800a0b0:	f013 5300 	ands.w	r3, r3, #536870912	; 0x20000000
+ 800a0b4:	d10f      	bne.n	800a0d6 <HAL_RCCEx_DisablePLLSAI2+0x3a>
+  HAL_StatusTypeDef status = HAL_OK;
+ 800a0b6:	4618      	mov	r0, r3
+  __HAL_RCC_PLLSAI2CLKOUT_DISABLE(RCC_PLLSAI2CFGR_PLLSAI2PEN|RCC_PLLSAI2CFGR_PLLSAI2QEN|RCC_PLLSAI2CFGR_PLLSAI2REN);
+ 800a0b8:	6963      	ldr	r3, [r4, #20]
+ 800a0ba:	f023 7388 	bic.w	r3, r3, #17825792	; 0x1100000
+ 800a0be:	f423 3380 	bic.w	r3, r3, #65536	; 0x10000
+ 800a0c2:	6163      	str	r3, [r4, #20]
+  if(READ_BIT(RCC->CR, (RCC_CR_PLLRDY | RCC_CR_PLLSAI1RDY)) == 0U)
+ 800a0c4:	6823      	ldr	r3, [r4, #0]
+ 800a0c6:	f013 6f20 	tst.w	r3, #167772160	; 0xa000000
+    MODIFY_REG(RCC->PLLCFGR, RCC_PLLCFGR_PLLSRC, RCC_PLLSOURCE_NONE);
+ 800a0ca:	bf02      	ittt	eq
+ 800a0cc:	68e3      	ldreq	r3, [r4, #12]
+ 800a0ce:	f023 0303 	biceq.w	r3, r3, #3
+ 800a0d2:	60e3      	streq	r3, [r4, #12]
+}
+ 800a0d4:	bd38      	pop	{r3, r4, r5, pc}
+    if((HAL_GetTick() - tickstart) > PLLSAI2_TIMEOUT_VALUE)
+ 800a0d6:	f7fd f83b 	bl	8007150 <HAL_GetTick>
+ 800a0da:	1b40      	subs	r0, r0, r5
+ 800a0dc:	2802      	cmp	r0, #2
+ 800a0de:	d9e6      	bls.n	800a0ae <HAL_RCCEx_DisablePLLSAI2+0x12>
+      status = HAL_TIMEOUT;
+ 800a0e0:	2003      	movs	r0, #3
+ 800a0e2:	e7e9      	b.n	800a0b8 <HAL_RCCEx_DisablePLLSAI2+0x1c>
+ 800a0e4:	40021000 	.word	0x40021000
+
+0800a0e8 <HAL_RCCEx_WakeUpStopCLKConfig>:
+  __HAL_RCC_WAKEUPSTOP_CLK_CONFIG(WakeUpClk);
+ 800a0e8:	4a03      	ldr	r2, [pc, #12]	; (800a0f8 <HAL_RCCEx_WakeUpStopCLKConfig+0x10>)
+ 800a0ea:	6893      	ldr	r3, [r2, #8]
+ 800a0ec:	f423 4300 	bic.w	r3, r3, #32768	; 0x8000
+ 800a0f0:	4318      	orrs	r0, r3
+ 800a0f2:	6090      	str	r0, [r2, #8]
+}
+ 800a0f4:	4770      	bx	lr
+ 800a0f6:	bf00      	nop
+ 800a0f8:	40021000 	.word	0x40021000
+
+0800a0fc <HAL_RCCEx_StandbyMSIRangeConfig>:
+  __HAL_RCC_MSI_STANDBY_RANGE_CONFIG(MSIRange);
+ 800a0fc:	4a04      	ldr	r2, [pc, #16]	; (800a110 <HAL_RCCEx_StandbyMSIRangeConfig+0x14>)
+ 800a0fe:	f8d2 3094 	ldr.w	r3, [r2, #148]	; 0x94
+ 800a102:	f423 6370 	bic.w	r3, r3, #3840	; 0xf00
+ 800a106:	ea43 1000 	orr.w	r0, r3, r0, lsl #4
+ 800a10a:	f8c2 0094 	str.w	r0, [r2, #148]	; 0x94
+}
+ 800a10e:	4770      	bx	lr
+ 800a110:	40021000 	.word	0x40021000
+
+0800a114 <HAL_RCCEx_EnableLSECSS>:
+  SET_BIT(RCC->BDCR, RCC_BDCR_LSECSSON);
+ 800a114:	4a03      	ldr	r2, [pc, #12]	; (800a124 <HAL_RCCEx_EnableLSECSS+0x10>)
+ 800a116:	f8d2 3090 	ldr.w	r3, [r2, #144]	; 0x90
+ 800a11a:	f043 0320 	orr.w	r3, r3, #32
+ 800a11e:	f8c2 3090 	str.w	r3, [r2, #144]	; 0x90
+}
+ 800a122:	4770      	bx	lr
+ 800a124:	40021000 	.word	0x40021000
+
+0800a128 <HAL_RCCEx_DisableLSECSS>:
+  CLEAR_BIT(RCC->BDCR, RCC_BDCR_LSECSSON) ;
+ 800a128:	4b05      	ldr	r3, [pc, #20]	; (800a140 <HAL_RCCEx_DisableLSECSS+0x18>)
+ 800a12a:	f8d3 2090 	ldr.w	r2, [r3, #144]	; 0x90
+ 800a12e:	f022 0220 	bic.w	r2, r2, #32
+ 800a132:	f8c3 2090 	str.w	r2, [r3, #144]	; 0x90
+  __HAL_RCC_DISABLE_IT(RCC_IT_LSECSS);
+ 800a136:	699a      	ldr	r2, [r3, #24]
+ 800a138:	f422 7200 	bic.w	r2, r2, #512	; 0x200
+ 800a13c:	619a      	str	r2, [r3, #24]
+}
+ 800a13e:	4770      	bx	lr
+ 800a140:	40021000 	.word	0x40021000
+
+0800a144 <HAL_RCCEx_EnableLSECSS_IT>:
+  SET_BIT(RCC->BDCR, RCC_BDCR_LSECSSON) ;
+ 800a144:	4b0a      	ldr	r3, [pc, #40]	; (800a170 <HAL_RCCEx_EnableLSECSS_IT+0x2c>)
+ 800a146:	f8d3 2090 	ldr.w	r2, [r3, #144]	; 0x90
+ 800a14a:	f042 0220 	orr.w	r2, r2, #32
+ 800a14e:	f8c3 2090 	str.w	r2, [r3, #144]	; 0x90
+  __HAL_RCC_ENABLE_IT(RCC_IT_LSECSS);
+ 800a152:	699a      	ldr	r2, [r3, #24]
+ 800a154:	f442 7200 	orr.w	r2, r2, #512	; 0x200
+ 800a158:	619a      	str	r2, [r3, #24]
+  __HAL_RCC_LSECSS_EXTI_ENABLE_IT();
+ 800a15a:	f5a3 3386 	sub.w	r3, r3, #68608	; 0x10c00
+ 800a15e:	681a      	ldr	r2, [r3, #0]
+ 800a160:	f442 2200 	orr.w	r2, r2, #524288	; 0x80000
+ 800a164:	601a      	str	r2, [r3, #0]
+  __HAL_RCC_LSECSS_EXTI_ENABLE_RISING_EDGE();
+ 800a166:	689a      	ldr	r2, [r3, #8]
+ 800a168:	f442 2200 	orr.w	r2, r2, #524288	; 0x80000
+ 800a16c:	609a      	str	r2, [r3, #8]
+}
+ 800a16e:	4770      	bx	lr
+ 800a170:	40021000 	.word	0x40021000
+
+0800a174 <HAL_RCCEx_LSECSS_Callback>:
+}
+ 800a174:	4770      	bx	lr
+	...
+
+0800a178 <HAL_RCCEx_LSECSS_IRQHandler>:
+{
+ 800a178:	b510      	push	{r4, lr}
+  if(__HAL_RCC_GET_IT(RCC_IT_LSECSS))
+ 800a17a:	4c05      	ldr	r4, [pc, #20]	; (800a190 <HAL_RCCEx_LSECSS_IRQHandler+0x18>)
+ 800a17c:	69e3      	ldr	r3, [r4, #28]
+ 800a17e:	059b      	lsls	r3, r3, #22
+ 800a180:	d504      	bpl.n	800a18c <HAL_RCCEx_LSECSS_IRQHandler+0x14>
+    HAL_RCCEx_LSECSS_Callback();
+ 800a182:	f7ff fff7 	bl	800a174 <HAL_RCCEx_LSECSS_Callback>
+    __HAL_RCC_CLEAR_IT(RCC_IT_LSECSS);
+ 800a186:	f44f 7300 	mov.w	r3, #512	; 0x200
+ 800a18a:	6223      	str	r3, [r4, #32]
+}
+ 800a18c:	bd10      	pop	{r4, pc}
+ 800a18e:	bf00      	nop
+ 800a190:	40021000 	.word	0x40021000
+
+0800a194 <HAL_RCCEx_EnableMSIPLLMode>:
+  SET_BIT(RCC->CR, RCC_CR_MSIPLLEN) ;
+ 800a194:	4a02      	ldr	r2, [pc, #8]	; (800a1a0 <HAL_RCCEx_EnableMSIPLLMode+0xc>)
+ 800a196:	6813      	ldr	r3, [r2, #0]
+ 800a198:	f043 0304 	orr.w	r3, r3, #4
+ 800a19c:	6013      	str	r3, [r2, #0]
+}
+ 800a19e:	4770      	bx	lr
+ 800a1a0:	40021000 	.word	0x40021000
+
+0800a1a4 <HAL_RCCEx_DisableMSIPLLMode>:
+  CLEAR_BIT(RCC->CR, RCC_CR_MSIPLLEN) ;
+ 800a1a4:	4a02      	ldr	r2, [pc, #8]	; (800a1b0 <HAL_RCCEx_DisableMSIPLLMode+0xc>)
+ 800a1a6:	6813      	ldr	r3, [r2, #0]
+ 800a1a8:	f023 0304 	bic.w	r3, r3, #4
+ 800a1ac:	6013      	str	r3, [r2, #0]
+}
+ 800a1ae:	4770      	bx	lr
+ 800a1b0:	40021000 	.word	0x40021000
+
+0800a1b4 <HAL_RCCEx_OCTOSPIDelayConfig>:
+  MODIFY_REG(RCC->DLYCFGR, RCC_DLYCFGR_OCTOSPI1_DLY|RCC_DLYCFGR_OCTOSPI2_DLY, (Delay1 | (Delay2 << RCC_DLYCFGR_OCTOSPI2_DLY_Pos))) ;
+ 800a1b4:	4a05      	ldr	r2, [pc, #20]	; (800a1cc <HAL_RCCEx_OCTOSPIDelayConfig+0x18>)
+ 800a1b6:	f8d2 30a4 	ldr.w	r3, [r2, #164]	; 0xa4
+ 800a1ba:	f023 03ff 	bic.w	r3, r3, #255	; 0xff
+ 800a1be:	4318      	orrs	r0, r3
+ 800a1c0:	ea40 1101 	orr.w	r1, r0, r1, lsl #4
+ 800a1c4:	f8c2 10a4 	str.w	r1, [r2, #164]	; 0xa4
+}
+ 800a1c8:	4770      	bx	lr
+ 800a1ca:	bf00      	nop
+ 800a1cc:	40021000 	.word	0x40021000
+
+0800a1d0 <HAL_RCCEx_CRSConfig>:
+  __HAL_RCC_CRS_FORCE_RESET();
+ 800a1d0:	4b10      	ldr	r3, [pc, #64]	; (800a214 <HAL_RCCEx_CRSConfig+0x44>)
+ 800a1d2:	6b9a      	ldr	r2, [r3, #56]	; 0x38
+ 800a1d4:	f042 7280 	orr.w	r2, r2, #16777216	; 0x1000000
+ 800a1d8:	639a      	str	r2, [r3, #56]	; 0x38
+  __HAL_RCC_CRS_RELEASE_RESET();
+ 800a1da:	6b9a      	ldr	r2, [r3, #56]	; 0x38
+ 800a1dc:	f022 7280 	bic.w	r2, r2, #16777216	; 0x1000000
+ 800a1e0:	639a      	str	r2, [r3, #56]	; 0x38
+  value = (pInit->Prescaler | pInit->Source | pInit->Polarity);
+ 800a1e2:	e9d0 3200 	ldrd	r3, r2, [r0]
+ 800a1e6:	4313      	orrs	r3, r2
+ 800a1e8:	6882      	ldr	r2, [r0, #8]
+ 800a1ea:	4313      	orrs	r3, r2
+  value |= pInit->ReloadValue;
+ 800a1ec:	68c2      	ldr	r2, [r0, #12]
+ 800a1ee:	4313      	orrs	r3, r2
+  value |= (pInit->ErrorLimitValue << CRS_CFGR_FELIM_Pos);
+ 800a1f0:	6902      	ldr	r2, [r0, #16]
+ 800a1f2:	ea43 4302 	orr.w	r3, r3, r2, lsl #16
+  WRITE_REG(CRS->CFGR, value);
+ 800a1f6:	4a08      	ldr	r2, [pc, #32]	; (800a218 <HAL_RCCEx_CRSConfig+0x48>)
+ 800a1f8:	6053      	str	r3, [r2, #4]
+  MODIFY_REG(CRS->CR, CRS_CR_TRIM, (pInit->HSI48CalibrationValue << CRS_CR_TRIM_Pos));
+ 800a1fa:	6813      	ldr	r3, [r2, #0]
+ 800a1fc:	6941      	ldr	r1, [r0, #20]
+ 800a1fe:	f423 537c 	bic.w	r3, r3, #16128	; 0x3f00
+ 800a202:	ea43 2301 	orr.w	r3, r3, r1, lsl #8
+ 800a206:	6013      	str	r3, [r2, #0]
+  SET_BIT(CRS->CR, CRS_CR_AUTOTRIMEN | CRS_CR_CEN);
+ 800a208:	6813      	ldr	r3, [r2, #0]
+ 800a20a:	f043 0360 	orr.w	r3, r3, #96	; 0x60
+ 800a20e:	6013      	str	r3, [r2, #0]
+}
+ 800a210:	4770      	bx	lr
+ 800a212:	bf00      	nop
+ 800a214:	40021000 	.word	0x40021000
+ 800a218:	40006000 	.word	0x40006000
+
+0800a21c <HAL_RCCEx_CRSSoftwareSynchronizationGenerate>:
+  SET_BIT(CRS->CR, CRS_CR_SWSYNC);
+ 800a21c:	4a02      	ldr	r2, [pc, #8]	; (800a228 <HAL_RCCEx_CRSSoftwareSynchronizationGenerate+0xc>)
+ 800a21e:	6813      	ldr	r3, [r2, #0]
+ 800a220:	f043 0380 	orr.w	r3, r3, #128	; 0x80
+ 800a224:	6013      	str	r3, [r2, #0]
+}
+ 800a226:	4770      	bx	lr
+ 800a228:	40006000 	.word	0x40006000
+
+0800a22c <HAL_RCCEx_CRSGetSynchronizationInfo>:
+  pSynchroInfo->ReloadValue = (READ_BIT(CRS->CFGR, CRS_CFGR_RELOAD));
+ 800a22c:	4b07      	ldr	r3, [pc, #28]	; (800a24c <HAL_RCCEx_CRSGetSynchronizationInfo+0x20>)
+ 800a22e:	685a      	ldr	r2, [r3, #4]
+ 800a230:	b292      	uxth	r2, r2
+ 800a232:	6002      	str	r2, [r0, #0]
+  pSynchroInfo->HSI48CalibrationValue = (READ_BIT(CRS->CR, CRS_CR_TRIM) >> CRS_CR_TRIM_Pos);
+ 800a234:	681a      	ldr	r2, [r3, #0]
+ 800a236:	f3c2 2205 	ubfx	r2, r2, #8, #6
+ 800a23a:	6042      	str	r2, [r0, #4]
+  pSynchroInfo->FreqErrorCapture = (READ_BIT(CRS->ISR, CRS_ISR_FECAP) >> CRS_ISR_FECAP_Pos);
+ 800a23c:	689a      	ldr	r2, [r3, #8]
+ 800a23e:	0c12      	lsrs	r2, r2, #16
+ 800a240:	6082      	str	r2, [r0, #8]
+  pSynchroInfo->FreqErrorDirection = (READ_BIT(CRS->ISR, CRS_ISR_FEDIR));
+ 800a242:	689b      	ldr	r3, [r3, #8]
+ 800a244:	f403 4300 	and.w	r3, r3, #32768	; 0x8000
+ 800a248:	60c3      	str	r3, [r0, #12]
+}
+ 800a24a:	4770      	bx	lr
+ 800a24c:	40006000 	.word	0x40006000
+
+0800a250 <HAL_RCCEx_CRSWaitSynchronization>:
+{
+ 800a250:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+ 800a252:	4605      	mov	r5, r0
+  tickstart = HAL_GetTick();
+ 800a254:	f7fc ff7c 	bl	8007150 <HAL_GetTick>
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCOK))
+ 800a258:	4c1e      	ldr	r4, [pc, #120]	; (800a2d4 <HAL_RCCEx_CRSWaitSynchronization+0x84>)
+  tickstart = HAL_GetTick();
+ 800a25a:	4606      	mov	r6, r0
+      __HAL_RCC_CRS_CLEAR_FLAG(RCC_CRS_FLAG_SYNCOK);
+ 800a25c:	2701      	movs	r7, #1
+    if(Timeout != HAL_MAX_DELAY)
+ 800a25e:	1c68      	adds	r0, r5, #1
+ 800a260:	d12f      	bne.n	800a2c2 <HAL_RCCEx_CRSWaitSynchronization+0x72>
+        crsstatus = RCC_CRS_TIMEOUT;
+ 800a262:	2000      	movs	r0, #0
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCOK))
+ 800a264:	68a2      	ldr	r2, [r4, #8]
+ 800a266:	07d1      	lsls	r1, r2, #31
+      __HAL_RCC_CRS_CLEAR_FLAG(RCC_CRS_FLAG_SYNCOK);
+ 800a268:	bf48      	it	mi
+ 800a26a:	60e7      	strmi	r7, [r4, #12]
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCWARN))
+ 800a26c:	68a2      	ldr	r2, [r4, #8]
+      crsstatus |= RCC_CRS_SYNCOK;
+ 800a26e:	bf48      	it	mi
+ 800a270:	f040 0002 	orrmi.w	r0, r0, #2
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCWARN))
+ 800a274:	0792      	lsls	r2, r2, #30
+      __HAL_RCC_CRS_CLEAR_FLAG(RCC_CRS_FLAG_SYNCWARN);
+ 800a276:	bf44      	itt	mi
+ 800a278:	2202      	movmi	r2, #2
+ 800a27a:	60e2      	strmi	r2, [r4, #12]
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_TRIMOVF))
+ 800a27c:	68a2      	ldr	r2, [r4, #8]
+      crsstatus |= RCC_CRS_SYNCWARN;
+ 800a27e:	bf48      	it	mi
+ 800a280:	f040 0004 	orrmi.w	r0, r0, #4
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_TRIMOVF))
+ 800a284:	0553      	lsls	r3, r2, #21
+      __HAL_RCC_CRS_CLEAR_FLAG(RCC_CRS_FLAG_TRIMOVF);
+ 800a286:	bf44      	itt	mi
+ 800a288:	2204      	movmi	r2, #4
+ 800a28a:	60e2      	strmi	r2, [r4, #12]
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCERR))
+ 800a28c:	68a2      	ldr	r2, [r4, #8]
+      crsstatus |= RCC_CRS_TRIMOVF;
+ 800a28e:	bf48      	it	mi
+ 800a290:	f040 0020 	orrmi.w	r0, r0, #32
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCERR))
+ 800a294:	05d1      	lsls	r1, r2, #23
+      __HAL_RCC_CRS_CLEAR_FLAG(RCC_CRS_FLAG_SYNCERR);
+ 800a296:	bf44      	itt	mi
+ 800a298:	2204      	movmi	r2, #4
+ 800a29a:	60e2      	strmi	r2, [r4, #12]
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCMISS))
+ 800a29c:	68a2      	ldr	r2, [r4, #8]
+      crsstatus |= RCC_CRS_SYNCERR;
+ 800a29e:	bf48      	it	mi
+ 800a2a0:	f040 0008 	orrmi.w	r0, r0, #8
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_SYNCMISS))
+ 800a2a4:	0592      	lsls	r2, r2, #22
+      __HAL_RCC_CRS_CLEAR_FLAG(RCC_CRS_FLAG_SYNCMISS);
+ 800a2a6:	bf44      	itt	mi
+ 800a2a8:	2204      	movmi	r2, #4
+ 800a2aa:	60e2      	strmi	r2, [r4, #12]
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_ESYNC))
+ 800a2ac:	68a2      	ldr	r2, [r4, #8]
+      crsstatus |= RCC_CRS_SYNCMISS;
+ 800a2ae:	bf48      	it	mi
+ 800a2b0:	f040 0010 	orrmi.w	r0, r0, #16
+    if(__HAL_RCC_CRS_GET_FLAG(RCC_CRS_FLAG_ESYNC))
+ 800a2b4:	0713      	lsls	r3, r2, #28
+      __HAL_RCC_CRS_CLEAR_FLAG(RCC_CRS_FLAG_ESYNC);
+ 800a2b6:	bf44      	itt	mi
+ 800a2b8:	2208      	movmi	r2, #8
+ 800a2ba:	60e2      	strmi	r2, [r4, #12]
+  } while(RCC_CRS_NONE == crsstatus);
+ 800a2bc:	2800      	cmp	r0, #0
+ 800a2be:	d0ce      	beq.n	800a25e <HAL_RCCEx_CRSWaitSynchronization+0xe>
+}
+ 800a2c0:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+      if(((HAL_GetTick() - tickstart) > Timeout) || (Timeout == 0U))
+ 800a2c2:	f7fc ff45 	bl	8007150 <HAL_GetTick>
+ 800a2c6:	1b80      	subs	r0, r0, r6
+ 800a2c8:	42a8      	cmp	r0, r5
+ 800a2ca:	d801      	bhi.n	800a2d0 <HAL_RCCEx_CRSWaitSynchronization+0x80>
+ 800a2cc:	2d00      	cmp	r5, #0
+ 800a2ce:	d1c8      	bne.n	800a262 <HAL_RCCEx_CRSWaitSynchronization+0x12>
+        crsstatus = RCC_CRS_TIMEOUT;
+ 800a2d0:	2001      	movs	r0, #1
+ 800a2d2:	e7c7      	b.n	800a264 <HAL_RCCEx_CRSWaitSynchronization+0x14>
+ 800a2d4:	40006000 	.word	0x40006000
+
+0800a2d8 <HAL_RCCEx_CRS_SyncOkCallback>:
+ 800a2d8:	4770      	bx	lr
+
+0800a2da <HAL_RCCEx_CRS_SyncWarnCallback>:
+ 800a2da:	4770      	bx	lr
+
+0800a2dc <HAL_RCCEx_CRS_ExpectedSyncCallback>:
+ 800a2dc:	4770      	bx	lr
+
+0800a2de <HAL_RCCEx_CRS_ErrorCallback>:
+}
+ 800a2de:	4770      	bx	lr
+
+0800a2e0 <HAL_RCCEx_CRS_IRQHandler>:
+  uint32_t itflags = READ_REG(CRS->ISR);
+ 800a2e0:	491b      	ldr	r1, [pc, #108]	; (800a350 <HAL_RCCEx_CRS_IRQHandler+0x70>)
+{
+ 800a2e2:	b508      	push	{r3, lr}
+  uint32_t itflags = READ_REG(CRS->ISR);
+ 800a2e4:	688b      	ldr	r3, [r1, #8]
+  uint32_t itsources = READ_REG(CRS->CR);
+ 800a2e6:	680a      	ldr	r2, [r1, #0]
+  if(((itflags & RCC_CRS_FLAG_SYNCOK) != 0U) && ((itsources & RCC_CRS_IT_SYNCOK) != 0U))
+ 800a2e8:	07d8      	lsls	r0, r3, #31
+ 800a2ea:	d506      	bpl.n	800a2fa <HAL_RCCEx_CRS_IRQHandler+0x1a>
+ 800a2ec:	07d0      	lsls	r0, r2, #31
+ 800a2ee:	d504      	bpl.n	800a2fa <HAL_RCCEx_CRS_IRQHandler+0x1a>
+    WRITE_REG(CRS->ICR, CRS_ICR_SYNCOKC);
+ 800a2f0:	2301      	movs	r3, #1
+ 800a2f2:	60cb      	str	r3, [r1, #12]
+    HAL_RCCEx_CRS_SyncOkCallback();
+ 800a2f4:	f7ff fff0 	bl	800a2d8 <HAL_RCCEx_CRS_SyncOkCallback>
+}
+ 800a2f8:	bd08      	pop	{r3, pc}
+  else if(((itflags & RCC_CRS_FLAG_SYNCWARN) != 0U) && ((itsources & RCC_CRS_IT_SYNCWARN) != 0U))
+ 800a2fa:	0798      	lsls	r0, r3, #30
+ 800a2fc:	d507      	bpl.n	800a30e <HAL_RCCEx_CRS_IRQHandler+0x2e>
+ 800a2fe:	0791      	lsls	r1, r2, #30
+ 800a300:	d505      	bpl.n	800a30e <HAL_RCCEx_CRS_IRQHandler+0x2e>
+    WRITE_REG(CRS->ICR, CRS_ICR_SYNCWARNC);
+ 800a302:	4b13      	ldr	r3, [pc, #76]	; (800a350 <HAL_RCCEx_CRS_IRQHandler+0x70>)
+ 800a304:	2202      	movs	r2, #2
+ 800a306:	60da      	str	r2, [r3, #12]
+    HAL_RCCEx_CRS_SyncWarnCallback();
+ 800a308:	f7ff ffe7 	bl	800a2da <HAL_RCCEx_CRS_SyncWarnCallback>
+ 800a30c:	e7f4      	b.n	800a2f8 <HAL_RCCEx_CRS_IRQHandler+0x18>
+  else if(((itflags & RCC_CRS_FLAG_ESYNC) != 0U) && ((itsources & RCC_CRS_IT_ESYNC) != 0U))
+ 800a30e:	0718      	lsls	r0, r3, #28
+ 800a310:	d507      	bpl.n	800a322 <HAL_RCCEx_CRS_IRQHandler+0x42>
+ 800a312:	0711      	lsls	r1, r2, #28
+ 800a314:	d505      	bpl.n	800a322 <HAL_RCCEx_CRS_IRQHandler+0x42>
+    WRITE_REG(CRS->ICR, CRS_ICR_ESYNCC);
+ 800a316:	4b0e      	ldr	r3, [pc, #56]	; (800a350 <HAL_RCCEx_CRS_IRQHandler+0x70>)
+ 800a318:	2208      	movs	r2, #8
+ 800a31a:	60da      	str	r2, [r3, #12]
+    HAL_RCCEx_CRS_ExpectedSyncCallback();
+ 800a31c:	f7ff ffde 	bl	800a2dc <HAL_RCCEx_CRS_ExpectedSyncCallback>
+ 800a320:	e7ea      	b.n	800a2f8 <HAL_RCCEx_CRS_IRQHandler+0x18>
+    if(((itflags & RCC_CRS_FLAG_ERR) != 0U) && ((itsources & RCC_CRS_IT_ERR) != 0U))
+ 800a322:	0758      	lsls	r0, r3, #29
+ 800a324:	d5e8      	bpl.n	800a2f8 <HAL_RCCEx_CRS_IRQHandler+0x18>
+ 800a326:	0751      	lsls	r1, r2, #29
+ 800a328:	d5e6      	bpl.n	800a2f8 <HAL_RCCEx_CRS_IRQHandler+0x18>
+        crserror |= RCC_CRS_SYNCERR;
+ 800a32a:	f413 7080 	ands.w	r0, r3, #256	; 0x100
+ 800a32e:	bf18      	it	ne
+ 800a330:	2008      	movne	r0, #8
+      if((itflags & RCC_CRS_FLAG_SYNCMISS) != 0U)
+ 800a332:	059a      	lsls	r2, r3, #22
+        crserror |= RCC_CRS_SYNCMISS;
+ 800a334:	bf48      	it	mi
+ 800a336:	f040 0010 	orrmi.w	r0, r0, #16
+      if((itflags & RCC_CRS_FLAG_TRIMOVF) != 0U)
+ 800a33a:	055b      	lsls	r3, r3, #21
+      WRITE_REG(CRS->ICR, CRS_ICR_ERRC);
+ 800a33c:	4b04      	ldr	r3, [pc, #16]	; (800a350 <HAL_RCCEx_CRS_IRQHandler+0x70>)
+ 800a33e:	f04f 0204 	mov.w	r2, #4
+        crserror |= RCC_CRS_TRIMOVF;
+ 800a342:	bf48      	it	mi
+ 800a344:	f040 0020 	orrmi.w	r0, r0, #32
+      WRITE_REG(CRS->ICR, CRS_ICR_ERRC);
+ 800a348:	60da      	str	r2, [r3, #12]
+      HAL_RCCEx_CRS_ErrorCallback(crserror);
+ 800a34a:	f7ff ffc8 	bl	800a2de <HAL_RCCEx_CRS_ErrorCallback>
+}
+ 800a34e:	e7d3      	b.n	800a2f8 <HAL_RCCEx_CRS_IRQHandler+0x18>
+ 800a350:	40006000 	.word	0x40006000
+
+0800a354 <HASH_WriteData>:
+  *         processing is suspended when possible and the Peripheral feeding point reached at
+  *         suspension time is stored in the handle for resumption later on.
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef HASH_WriteData(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size)
+{
+ 800a354:	b573      	push	{r0, r1, r4, r5, r6, lr}
+  __IO uint32_t inputaddr = (uint32_t) pInBuffer;
+
+  for(buffercounter = 0U; buffercounter < Size; buffercounter+=4U)
+  {
+    /* Write input data 4 bytes at a time */
+    HASH->DIN = *(uint32_t*)inputaddr;
+ 800a356:	4d1e      	ldr	r5, [pc, #120]	; (800a3d0 <HASH_WriteData+0x7c>)
+  __IO uint32_t inputaddr = (uint32_t) pInBuffer;
+ 800a358:	9101      	str	r1, [sp, #4]
+{
+ 800a35a:	4604      	mov	r4, r0
+  for(buffercounter = 0U; buffercounter < Size; buffercounter+=4U)
+ 800a35c:	2100      	movs	r1, #0
+ 800a35e:	4291      	cmp	r1, r2
+ 800a360:	d221      	bcs.n	800a3a6 <HASH_WriteData+0x52>
+    HASH->DIN = *(uint32_t*)inputaddr;
+ 800a362:	9b01      	ldr	r3, [sp, #4]
+ 800a364:	681b      	ldr	r3, [r3, #0]
+ 800a366:	606b      	str	r3, [r5, #4]
+    inputaddr+=4U;
+ 800a368:	9b01      	ldr	r3, [sp, #4]
+
+    /* If the suspension flag has been raised and if the processing is not about
+    to end, suspend processing */
+    if ((hhash->SuspendRequest == HAL_HASH_SUSPEND) && ((buffercounter+4U) < Size))
+ 800a36a:	f894 0036 	ldrb.w	r0, [r4, #54]	; 0x36
+    inputaddr+=4U;
+ 800a36e:	3304      	adds	r3, #4
+    if ((hhash->SuspendRequest == HAL_HASH_SUSPEND) && ((buffercounter+4U) < Size))
+ 800a370:	2801      	cmp	r0, #1
+    inputaddr+=4U;
+ 800a372:	9301      	str	r3, [sp, #4]
+    if ((hhash->SuspendRequest == HAL_HASH_SUSPEND) && ((buffercounter+4U) < Size))
+ 800a374:	f101 0304 	add.w	r3, r1, #4
+ 800a378:	d127      	bne.n	800a3ca <HASH_WriteData+0x76>
+ 800a37a:	4293      	cmp	r3, r2
+ 800a37c:	d225      	bcs.n	800a3ca <HASH_WriteData+0x76>
+    {
+      /* Wait for DINIS = 1, which occurs when 16 32-bit locations are free
+      in the input buffer */
+      if (__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))
+ 800a37e:	6a6e      	ldr	r6, [r5, #36]	; 0x24
+ 800a380:	07f6      	lsls	r6, r6, #31
+ 800a382:	d522      	bpl.n	800a3ca <HASH_WriteData+0x76>
+        /* Reset SuspendRequest */
+        hhash->SuspendRequest = HAL_HASH_SUSPEND_NONE;
+
+        /* Depending whether the key or the input data were fed to the Peripheral, the feeding point
+        reached at suspension time is not saved in the same handle fields */
+        if ((hhash->Phase == HAL_HASH_PHASE_PROCESS) || (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_2))
+ 800a384:	f894 302d 	ldrb.w	r3, [r4, #45]	; 0x2d
+        hhash->SuspendRequest = HAL_HASH_SUSPEND_NONE;
+ 800a388:	2500      	movs	r5, #0
+        if ((hhash->Phase == HAL_HASH_PHASE_PROCESS) || (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_2))
+ 800a38a:	2b02      	cmp	r3, #2
+        hhash->SuspendRequest = HAL_HASH_SUSPEND_NONE;
+ 800a38c:	f884 5036 	strb.w	r5, [r4, #54]	; 0x36
+        if ((hhash->Phase == HAL_HASH_PHASE_PROCESS) || (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_2))
+ 800a390:	d001      	beq.n	800a396 <HASH_WriteData+0x42>
+ 800a392:	2b04      	cmp	r3, #4
+ 800a394:	d109      	bne.n	800a3aa <HASH_WriteData+0x56>
+        {
+          /* Save current reading and writing locations of Input and Output buffers */
+          hhash->pHashInBuffPtr =  (uint8_t *)inputaddr;
+          /* Save the number of bytes that remain to be processed at this point */
+          hhash->HashInCount    =  Size - (buffercounter + 4U);
+ 800a396:	3a04      	subs	r2, #4
+          hhash->pHashInBuffPtr =  (uint8_t *)inputaddr;
+ 800a398:	9b01      	ldr	r3, [sp, #4]
+ 800a39a:	60e3      	str	r3, [r4, #12]
+          hhash->HashInCount    =  Size - (buffercounter + 4U);
+ 800a39c:	1a52      	subs	r2, r2, r1
+ 800a39e:	6222      	str	r2, [r4, #32]
+          __HAL_UNLOCK(hhash);
+          return HAL_ERROR;
+        }
+
+        /* Set the HASH state to Suspended and exit to stop entering data */
+        hhash->State = HAL_HASH_STATE_SUSPENDED;
+ 800a3a0:	2308      	movs	r3, #8
+ 800a3a2:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+      } /* if (__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))  */
+    } /* if ((hhash->SuspendRequest == HAL_HASH_SUSPEND) && ((buffercounter+4) < Size)) */
+  }   /* for(buffercounter = 0; buffercounter < Size; buffercounter+=4)                 */
+
+  /* At this point, all the data have been entered to the Peripheral: exit */
+  return  HAL_OK;
+ 800a3a6:	2000      	movs	r0, #0
+ 800a3a8:	e00d      	b.n	800a3c6 <HASH_WriteData+0x72>
+        else if ((hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_1) || (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_3))
+ 800a3aa:	2b03      	cmp	r3, #3
+ 800a3ac:	d001      	beq.n	800a3b2 <HASH_WriteData+0x5e>
+ 800a3ae:	2b05      	cmp	r3, #5
+ 800a3b0:	d105      	bne.n	800a3be <HASH_WriteData+0x6a>
+          hhash->HashKeyCount  =  Size - (buffercounter + 4U);
+ 800a3b2:	3a04      	subs	r2, #4
+          hhash->pHashKeyBuffPtr  =  (uint8_t *)inputaddr;
+ 800a3b4:	9b01      	ldr	r3, [sp, #4]
+ 800a3b6:	6163      	str	r3, [r4, #20]
+          hhash->HashKeyCount  =  Size - (buffercounter + 4U);
+ 800a3b8:	1a52      	subs	r2, r2, r1
+ 800a3ba:	62a2      	str	r2, [r4, #40]	; 0x28
+ 800a3bc:	e7f0      	b.n	800a3a0 <HASH_WriteData+0x4c>
+          hhash->State = HAL_HASH_STATE_READY;
+ 800a3be:	f884 0035 	strb.w	r0, [r4, #53]	; 0x35
+          __HAL_UNLOCK(hhash);
+ 800a3c2:	f884 5034 	strb.w	r5, [r4, #52]	; 0x34
+}
+ 800a3c6:	b002      	add	sp, #8
+ 800a3c8:	bd70      	pop	{r4, r5, r6, pc}
+ 800a3ca:	4619      	mov	r1, r3
+ 800a3cc:	e7c7      	b.n	800a35e <HASH_WriteData+0xa>
+ 800a3ce:	bf00      	nop
+ 800a3d0:	50060400 	.word	0x50060400
+
+0800a3d4 <HASH_GetDigest>:
+  */
+static void HASH_GetDigest(uint8_t *pMsgDigest, uint8_t Size)
+{
+  uint32_t msgdigest = (uint32_t)pMsgDigest;
+
+  switch(Size)
+ 800a3d4:	291c      	cmp	r1, #28
+ 800a3d6:	d027      	beq.n	800a428 <HASH_GetDigest+0x54>
+ 800a3d8:	d804      	bhi.n	800a3e4 <HASH_GetDigest+0x10>
+ 800a3da:	2910      	cmp	r1, #16
+ 800a3dc:	d005      	beq.n	800a3ea <HASH_GetDigest+0x16>
+ 800a3de:	2914      	cmp	r1, #20
+ 800a3e0:	d011      	beq.n	800a406 <HASH_GetDigest+0x32>
+ 800a3e2:	4770      	bx	lr
+ 800a3e4:	2920      	cmp	r1, #32
+ 800a3e6:	d037      	beq.n	800a458 <HASH_GetDigest+0x84>
+ 800a3e8:	4770      	bx	lr
+  {
+    /* Read the message digest */
+    case 16:  /* MD5 */
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[0]);
+ 800a3ea:	4b29      	ldr	r3, [pc, #164]	; (800a490 <HASH_GetDigest+0xbc>)
+ 800a3ec:	68da      	ldr	r2, [r3, #12]
+  \return               Reversed value
+ */
+__STATIC_FORCEINLINE uint32_t __REV(uint32_t value)
+{
+#if (__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)
+  return __builtin_bswap32(value);
+ 800a3ee:	ba12      	rev	r2, r2
+ 800a3f0:	6002      	str	r2, [r0, #0]
+      msgdigest+=4U;
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[1]);
+ 800a3f2:	691a      	ldr	r2, [r3, #16]
+ 800a3f4:	ba12      	rev	r2, r2
+ 800a3f6:	6042      	str	r2, [r0, #4]
+      msgdigest+=4U;
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[2]);
+ 800a3f8:	695a      	ldr	r2, [r3, #20]
+ 800a3fa:	ba12      	rev	r2, r2
+ 800a3fc:	6082      	str	r2, [r0, #8]
+      msgdigest+=4U;
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[3]);
+ 800a3fe:	699b      	ldr	r3, [r3, #24]
+ 800a400:	ba1b      	rev	r3, r3
+ 800a402:	60c3      	str	r3, [r0, #12]
+    break;
+ 800a404:	4770      	bx	lr
+    case 20:  /* SHA1 */
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[0]);
+ 800a406:	4b22      	ldr	r3, [pc, #136]	; (800a490 <HASH_GetDigest+0xbc>)
+ 800a408:	68da      	ldr	r2, [r3, #12]
+ 800a40a:	ba12      	rev	r2, r2
+ 800a40c:	6002      	str	r2, [r0, #0]
+      msgdigest+=4U;
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[1]);
+ 800a40e:	691a      	ldr	r2, [r3, #16]
+ 800a410:	ba12      	rev	r2, r2
+ 800a412:	6042      	str	r2, [r0, #4]
+      msgdigest+=4U;
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[2]);
+ 800a414:	695a      	ldr	r2, [r3, #20]
+ 800a416:	ba12      	rev	r2, r2
+ 800a418:	6082      	str	r2, [r0, #8]
+      msgdigest+=4U;
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[3]);
+ 800a41a:	699a      	ldr	r2, [r3, #24]
+ 800a41c:	ba12      	rev	r2, r2
+ 800a41e:	60c2      	str	r2, [r0, #12]
+      msgdigest+=4U;
+      *(uint32_t*)(msgdigest) = __REV(HASH->HR[4]);
+ 800a420:	69db      	ldr	r3, [r3, #28]
+ 800a422:	ba1b      	rev	r3, r3
+ 800a424:	6103      	str	r3, [r0, #16]
+    break;
+ 800a426:	4770      	bx	lr
+  case 28:  /* SHA224 */
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[0]);
+ 800a428:	4b19      	ldr	r3, [pc, #100]	; (800a490 <HASH_GetDigest+0xbc>)
+ 800a42a:	68da      	ldr	r2, [r3, #12]
+ 800a42c:	ba12      	rev	r2, r2
+ 800a42e:	6002      	str	r2, [r0, #0]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[1]);
+ 800a430:	691a      	ldr	r2, [r3, #16]
+ 800a432:	ba12      	rev	r2, r2
+ 800a434:	6042      	str	r2, [r0, #4]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[2]);
+ 800a436:	695a      	ldr	r2, [r3, #20]
+ 800a438:	ba12      	rev	r2, r2
+ 800a43a:	6082      	str	r2, [r0, #8]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[3]);
+ 800a43c:	699a      	ldr	r2, [r3, #24]
+ 800a43e:	ba12      	rev	r2, r2
+ 800a440:	60c2      	str	r2, [r0, #12]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[4]);
+ 800a442:	69db      	ldr	r3, [r3, #28]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH_DIGEST->HR[5]);
+ 800a444:	4a13      	ldr	r2, [pc, #76]	; (800a494 <HASH_GetDigest+0xc0>)
+ 800a446:	ba1b      	rev	r3, r3
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[4]);
+ 800a448:	6103      	str	r3, [r0, #16]
+    *(uint32_t*)(msgdigest) = __REV(HASH_DIGEST->HR[5]);
+ 800a44a:	6a53      	ldr	r3, [r2, #36]	; 0x24
+ 800a44c:	ba1b      	rev	r3, r3
+ 800a44e:	6143      	str	r3, [r0, #20]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH_DIGEST->HR[6]);
+ 800a450:	6a93      	ldr	r3, [r2, #40]	; 0x28
+ 800a452:	ba1b      	rev	r3, r3
+ 800a454:	6183      	str	r3, [r0, #24]
+    break;
+ 800a456:	4770      	bx	lr
+  case 32:   /* SHA256 */
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[0]);
+ 800a458:	4b0d      	ldr	r3, [pc, #52]	; (800a490 <HASH_GetDigest+0xbc>)
+ 800a45a:	68da      	ldr	r2, [r3, #12]
+ 800a45c:	ba12      	rev	r2, r2
+ 800a45e:	6002      	str	r2, [r0, #0]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[1]);
+ 800a460:	691a      	ldr	r2, [r3, #16]
+ 800a462:	ba12      	rev	r2, r2
+ 800a464:	6042      	str	r2, [r0, #4]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[2]);
+ 800a466:	695a      	ldr	r2, [r3, #20]
+ 800a468:	ba12      	rev	r2, r2
+ 800a46a:	6082      	str	r2, [r0, #8]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[3]);
+ 800a46c:	699a      	ldr	r2, [r3, #24]
+ 800a46e:	ba12      	rev	r2, r2
+ 800a470:	60c2      	str	r2, [r0, #12]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH->HR[4]);
+ 800a472:	69db      	ldr	r3, [r3, #28]
+ 800a474:	ba1b      	rev	r3, r3
+ 800a476:	6103      	str	r3, [r0, #16]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH_DIGEST->HR[5]);
+ 800a478:	4b06      	ldr	r3, [pc, #24]	; (800a494 <HASH_GetDigest+0xc0>)
+ 800a47a:	6a5a      	ldr	r2, [r3, #36]	; 0x24
+ 800a47c:	ba12      	rev	r2, r2
+ 800a47e:	6142      	str	r2, [r0, #20]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH_DIGEST->HR[6]);
+ 800a480:	6a9a      	ldr	r2, [r3, #40]	; 0x28
+ 800a482:	ba12      	rev	r2, r2
+ 800a484:	6182      	str	r2, [r0, #24]
+    msgdigest+=4U;
+    *(uint32_t*)(msgdigest) = __REV(HASH_DIGEST->HR[7]);
+ 800a486:	6adb      	ldr	r3, [r3, #44]	; 0x2c
+ 800a488:	ba1b      	rev	r3, r3
+ 800a48a:	61c3      	str	r3, [r0, #28]
+    break;
+    default:
+    break;
+  }
+}
+ 800a48c:	4770      	bx	lr
+ 800a48e:	bf00      	nop
+ 800a490:	50060400 	.word	0x50060400
+ 800a494:	50060700 	.word	0x50060700
+
+0800a498 <HASH_WaitOnFlagUntilTimeout>:
+  * @param  Status the Flag status (SET or RESET).
+  * @param  Timeout Timeout duration.
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef HASH_WaitOnFlagUntilTimeout(HASH_HandleTypeDef *hhash, uint32_t Flag, FlagStatus Status, uint32_t Timeout)
+{
+ 800a498:	e92d 43f8 	stmdb	sp!, {r3, r4, r5, r6, r7, r8, r9, lr}
+ 800a49c:	4604      	mov	r4, r0
+ 800a49e:	460e      	mov	r6, r1
+ 800a4a0:	4691      	mov	r9, r2
+ 800a4a2:	461d      	mov	r5, r3
+  uint32_t tickstart = HAL_GetTick();
+ 800a4a4:	f7fc fe54 	bl	8007150 <HAL_GetTick>
+ 800a4a8:	f8df 805c 	ldr.w	r8, [pc, #92]	; 800a508 <HASH_WaitOnFlagUntilTimeout+0x70>
+ 800a4ac:	4607      	mov	r7, r0
+
+  /* Wait until flag is set */
+  if(Status == RESET)
+ 800a4ae:	f1b9 0f00 	cmp.w	r9, #0
+ 800a4b2:	d021      	beq.n	800a4f8 <HASH_WaitOnFlagUntilTimeout+0x60>
+      }
+    }
+  }
+  else
+  {
+    while(__HAL_HASH_GET_FLAG(Flag) != RESET)
+ 800a4b4:	f8d8 3024 	ldr.w	r3, [r8, #36]	; 0x24
+ 800a4b8:	ea36 0303 	bics.w	r3, r6, r3
+ 800a4bc:	d121      	bne.n	800a502 <HASH_WaitOnFlagUntilTimeout+0x6a>
+    {
+      /* Check for the Timeout */
+      if(Timeout != HAL_MAX_DELAY)
+ 800a4be:	1c6b      	adds	r3, r5, #1
+ 800a4c0:	d0f8      	beq.n	800a4b4 <HASH_WaitOnFlagUntilTimeout+0x1c>
+      {
+        if(((HAL_GetTick()-tickstart) > Timeout) || (Timeout == 0U))
+ 800a4c2:	f7fc fe45 	bl	8007150 <HAL_GetTick>
+ 800a4c6:	1bc0      	subs	r0, r0, r7
+ 800a4c8:	42a8      	cmp	r0, r5
+ 800a4ca:	d80a      	bhi.n	800a4e2 <HASH_WaitOnFlagUntilTimeout+0x4a>
+ 800a4cc:	2d00      	cmp	r5, #0
+ 800a4ce:	d1f1      	bne.n	800a4b4 <HASH_WaitOnFlagUntilTimeout+0x1c>
+ 800a4d0:	e007      	b.n	800a4e2 <HASH_WaitOnFlagUntilTimeout+0x4a>
+      if(Timeout != HAL_MAX_DELAY)
+ 800a4d2:	1c6a      	adds	r2, r5, #1
+ 800a4d4:	d010      	beq.n	800a4f8 <HASH_WaitOnFlagUntilTimeout+0x60>
+        if(((HAL_GetTick()-tickstart) > Timeout) || (Timeout == 0U))
+ 800a4d6:	f7fc fe3b 	bl	8007150 <HAL_GetTick>
+ 800a4da:	1bc0      	subs	r0, r0, r7
+ 800a4dc:	42a8      	cmp	r0, r5
+ 800a4de:	d800      	bhi.n	800a4e2 <HASH_WaitOnFlagUntilTimeout+0x4a>
+ 800a4e0:	b955      	cbnz	r5, 800a4f8 <HASH_WaitOnFlagUntilTimeout+0x60>
+        {
+          /* Set State to Ready to be able to restart later on */
+          hhash->State  = HAL_HASH_STATE_READY;
+ 800a4e2:	2301      	movs	r3, #1
+ 800a4e4:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+          /* Store time out issue in handle status */
+          hhash->Status = HAL_TIMEOUT;
+
+          /* Process Unlocked */
+          __HAL_UNLOCK(hhash);
+ 800a4e8:	2200      	movs	r2, #0
+          hhash->Status = HAL_TIMEOUT;
+ 800a4ea:	2303      	movs	r3, #3
+ 800a4ec:	f884 302c 	strb.w	r3, [r4, #44]	; 0x2c
+          __HAL_UNLOCK(hhash);
+ 800a4f0:	f884 2034 	strb.w	r2, [r4, #52]	; 0x34
+
+          return HAL_TIMEOUT;
+ 800a4f4:	4618      	mov	r0, r3
+ 800a4f6:	e005      	b.n	800a504 <HASH_WaitOnFlagUntilTimeout+0x6c>
+    while(__HAL_HASH_GET_FLAG(Flag) == RESET)
+ 800a4f8:	f8d8 3024 	ldr.w	r3, [r8, #36]	; 0x24
+ 800a4fc:	ea36 0303 	bics.w	r3, r6, r3
+ 800a500:	d1e7      	bne.n	800a4d2 <HASH_WaitOnFlagUntilTimeout+0x3a>
+        }
+      }
+    }
+  }
+  return HAL_OK;
+ 800a502:	2000      	movs	r0, #0
+}
+ 800a504:	e8bd 83f8 	ldmia.w	sp!, {r3, r4, r5, r6, r7, r8, r9, pc}
+ 800a508:	50060400 	.word	0x50060400
+
+0800a50c <HAL_HASH_MspInit>:
+}
+ 800a50c:	4770      	bx	lr
+	...
+
+0800a510 <HAL_HASH_Init>:
+{
+ 800a510:	b538      	push	{r3, r4, r5, lr}
+  if(hhash == NULL)
+ 800a512:	4604      	mov	r4, r0
+ 800a514:	b328      	cbz	r0, 800a562 <HAL_HASH_Init+0x52>
+  if(hhash->State == HAL_HASH_STATE_RESET)
+ 800a516:	f890 3035 	ldrb.w	r3, [r0, #53]	; 0x35
+ 800a51a:	f003 02ff 	and.w	r2, r3, #255	; 0xff
+ 800a51e:	b91b      	cbnz	r3, 800a528 <HAL_HASH_Init+0x18>
+    hhash->Lock = HAL_UNLOCKED;
+ 800a520:	f880 2034 	strb.w	r2, [r0, #52]	; 0x34
+    HAL_HASH_MspInit(hhash);
+ 800a524:	f7ff fff2 	bl	800a50c <HAL_HASH_MspInit>
+  hhash->HashInCount = 0;
+ 800a528:	2000      	movs	r0, #0
+  MODIFY_REG(HASH->CR, HASH_CR_DATATYPE, hhash->Init.DataType);
+ 800a52a:	4a0f      	ldr	r2, [pc, #60]	; (800a568 <HAL_HASH_Init+0x58>)
+  hhash->HashBuffSize = 0;
+ 800a52c:	61e0      	str	r0, [r4, #28]
+  hhash->State = HAL_HASH_STATE_BUSY;
+ 800a52e:	2302      	movs	r3, #2
+  hhash->Phase = HAL_HASH_PHASE_READY;
+ 800a530:	2101      	movs	r1, #1
+  hhash->State = HAL_HASH_STATE_BUSY;
+ 800a532:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+  hhash->Phase = HAL_HASH_PHASE_READY;
+ 800a536:	f884 102d 	strb.w	r1, [r4, #45]	; 0x2d
+  hhash->HashInCount = 0;
+ 800a53a:	6220      	str	r0, [r4, #32]
+  hhash->SuspendRequest = HAL_HASH_SUSPEND_NONE;
+ 800a53c:	86e0      	strh	r0, [r4, #54]	; 0x36
+  hhash->HashITCounter = 0;
+ 800a53e:	6260      	str	r0, [r4, #36]	; 0x24
+  hhash->NbWordsAlreadyPushed = 0;
+ 800a540:	63a0      	str	r0, [r4, #56]	; 0x38
+  MODIFY_REG(HASH->CR, HASH_CR_DATATYPE, hhash->Init.DataType);
+ 800a542:	6813      	ldr	r3, [r2, #0]
+ 800a544:	6825      	ldr	r5, [r4, #0]
+ 800a546:	f023 0330 	bic.w	r3, r3, #48	; 0x30
+ 800a54a:	432b      	orrs	r3, r5
+ 800a54c:	6013      	str	r3, [r2, #0]
+__HAL_HASH_RESET_MDMAT();
+ 800a54e:	6813      	ldr	r3, [r2, #0]
+ 800a550:	f423 5300 	bic.w	r3, r3, #8192	; 0x2000
+ 800a554:	6013      	str	r3, [r2, #0]
+  hhash->State = HAL_HASH_STATE_READY;
+ 800a556:	f884 1035 	strb.w	r1, [r4, #53]	; 0x35
+  hhash->Status = HAL_OK;
+ 800a55a:	f884 002c 	strb.w	r0, [r4, #44]	; 0x2c
+  hhash->ErrorCode = HAL_HASH_ERROR_NONE;
+ 800a55e:	63e0      	str	r0, [r4, #60]	; 0x3c
+}
+ 800a560:	bd38      	pop	{r3, r4, r5, pc}
+    return HAL_ERROR;
+ 800a562:	2001      	movs	r0, #1
+ 800a564:	e7fc      	b.n	800a560 <HAL_HASH_Init+0x50>
+ 800a566:	bf00      	nop
+ 800a568:	50060400 	.word	0x50060400
+
+0800a56c <HAL_HASH_MspDeInit>:
+ 800a56c:	4770      	bx	lr
+
+0800a56e <HAL_HASH_InCpltCallback>:
+ 800a56e:	4770      	bx	lr
+
+0800a570 <HAL_HASH_DgstCpltCallback>:
+ 800a570:	4770      	bx	lr
+
+0800a572 <HAL_HASH_ErrorCallback>:
+ 800a572:	4770      	bx	lr
+
+0800a574 <HAL_HASH_IRQHandler>:
+{
+ 800a574:	b570      	push	{r4, r5, r6, lr}
+  *         suspension time is stored in the handle for resumption later on.
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef HASH_IT(HASH_HandleTypeDef *hhash)
+{
+  if (hhash->State == HAL_HASH_STATE_BUSY)
+ 800a576:	f890 3035 	ldrb.w	r3, [r0, #53]	; 0x35
+ 800a57a:	2b02      	cmp	r3, #2
+{
+ 800a57c:	4604      	mov	r4, r0
+  if (hhash->State == HAL_HASH_STATE_BUSY)
+ 800a57e:	b2da      	uxtb	r2, r3
+ 800a580:	f040 80e7 	bne.w	800a752 <HAL_HASH_IRQHandler+0x1de>
+  {
+    /* ITCounter must not be equal to 0 at this point. Report an error if this is the case. */
+    if(hhash->HashITCounter == 0U)
+ 800a584:	6a43      	ldr	r3, [r0, #36]	; 0x24
+ 800a586:	4d74      	ldr	r5, [pc, #464]	; (800a758 <HAL_HASH_IRQHandler+0x1e4>)
+ 800a588:	b94b      	cbnz	r3, 800a59e <HAL_HASH_IRQHandler+0x2a>
+    {
+      /* Disable Interrupts */
+      __HAL_HASH_DISABLE_IT(HASH_IT_DINI|HASH_IT_DCI);
+ 800a58a:	6a2b      	ldr	r3, [r5, #32]
+ 800a58c:	f023 0303 	bic.w	r3, r3, #3
+ 800a590:	622b      	str	r3, [r5, #32]
+      /* HASH state set back to Ready to prevent any issue in user code
+         present in HAL_HASH_ErrorCallback() */
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a592:	2301      	movs	r3, #1
+ 800a594:	f880 3035 	strb.w	r3, [r0, #53]	; 0x35
+  hhash->Status = HASH_IT(hhash);
+ 800a598:	f884 302c 	strb.w	r3, [r4, #44]	; 0x2c
+  if (hhash->Status != HAL_OK)
+ 800a59c:	e099      	b.n	800a6d2 <HAL_HASH_IRQHandler+0x15e>
+      return HAL_ERROR;
+    }
+    else if (hhash->HashITCounter == 1U)
+ 800a59e:	6a43      	ldr	r3, [r0, #36]	; 0x24
+ 800a5a0:	2b01      	cmp	r3, #1
+    }
+    else
+    {
+      /* Cruise speed reached, HashITCounter remains equal to 3 until the end of
+        the HASH processing or the end of the current step for HMAC processing. */
+      hhash->HashITCounter = 3U;
+ 800a5a2:	bf16      	itet	ne
+ 800a5a4:	2303      	movne	r3, #3
+      hhash->HashITCounter = 2U;
+ 800a5a6:	6242      	streq	r2, [r0, #36]	; 0x24
+      hhash->HashITCounter = 3U;
+ 800a5a8:	6243      	strne	r3, [r0, #36]	; 0x24
+    }
+
+    /* If digest is ready */
+    if (__HAL_HASH_GET_FLAG(HASH_FLAG_DCIS))
+ 800a5aa:	6a6b      	ldr	r3, [r5, #36]	; 0x24
+ 800a5ac:	f013 0302 	ands.w	r3, r3, #2
+ 800a5b0:	d022      	beq.n	800a5f8 <HAL_HASH_IRQHandler+0x84>
+    {
+      /* Read the digest */
+      HASH_GetDigest(hhash->pHashOutBuffPtr, HASH_DIGEST_LENGTH());
+ 800a5b2:	682a      	ldr	r2, [r5, #0]
+ 800a5b4:	4b69      	ldr	r3, [pc, #420]	; (800a75c <HAL_HASH_IRQHandler+0x1e8>)
+ 800a5b6:	6900      	ldr	r0, [r0, #16]
+ 800a5b8:	421a      	tst	r2, r3
+ 800a5ba:	d019      	beq.n	800a5f0 <HAL_HASH_IRQHandler+0x7c>
+ 800a5bc:	682a      	ldr	r2, [r5, #0]
+ 800a5be:	401a      	ands	r2, r3
+ 800a5c0:	f5b2 2f80 	cmp.w	r2, #262144	; 0x40000
+ 800a5c4:	d016      	beq.n	800a5f4 <HAL_HASH_IRQHandler+0x80>
+ 800a5c6:	682a      	ldr	r2, [r5, #0]
+ 800a5c8:	4393      	bics	r3, r2
+ 800a5ca:	bf0c      	ite	eq
+ 800a5cc:	2120      	moveq	r1, #32
+ 800a5ce:	2110      	movne	r1, #16
+ 800a5d0:	f7ff ff00 	bl	800a3d4 <HASH_GetDigest>
+
+      /* Disable Interrupts */
+      __HAL_HASH_DISABLE_IT(HASH_IT_DINI|HASH_IT_DCI);
+ 800a5d4:	6a2b      	ldr	r3, [r5, #32]
+ 800a5d6:	f023 0303 	bic.w	r3, r3, #3
+ 800a5da:	622b      	str	r3, [r5, #32]
+      /* Change the HASH state */
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a5dc:	2301      	movs	r3, #1
+ 800a5de:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+      /* Reset HASH state machine */
+      hhash->Phase = HAL_HASH_PHASE_READY;
+ 800a5e2:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+      /* Call digest computation complete call back */
+#if (USE_HAL_HASH_REGISTER_CALLBACKS == 1)
+      hhash->DgstCpltCallback(hhash);
+#else
+      HAL_HASH_DgstCpltCallback(hhash);
+ 800a5e6:	4620      	mov	r0, r4
+ 800a5e8:	f7ff ffc2 	bl	800a570 <HAL_HASH_DgstCpltCallback>
+    hhash->Status = HAL_OK;
+ 800a5ec:	2300      	movs	r3, #0
+ 800a5ee:	e015      	b.n	800a61c <HAL_HASH_IRQHandler+0xa8>
+      HASH_GetDigest(hhash->pHashOutBuffPtr, HASH_DIGEST_LENGTH());
+ 800a5f0:	2114      	movs	r1, #20
+ 800a5f2:	e7ed      	b.n	800a5d0 <HAL_HASH_IRQHandler+0x5c>
+ 800a5f4:	211c      	movs	r1, #28
+ 800a5f6:	e7eb      	b.n	800a5d0 <HAL_HASH_IRQHandler+0x5c>
+
+      return HAL_OK;
+    }
+
+    /* If Peripheral ready to accept new data */
+    if (__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))
+ 800a5f8:	6a6a      	ldr	r2, [r5, #36]	; 0x24
+ 800a5fa:	07d2      	lsls	r2, r2, #31
+ 800a5fc:	d5f6      	bpl.n	800a5ec <HAL_HASH_IRQHandler+0x78>
+    {
+
+      /* If the suspension flag has been raised and if the processing is not about
+         to end, suspend processing */
+      if ( (hhash->HashInCount != 0U) &&  (hhash->SuspendRequest == HAL_HASH_SUSPEND))
+ 800a5fe:	6a02      	ldr	r2, [r0, #32]
+ 800a600:	b17a      	cbz	r2, 800a622 <HAL_HASH_IRQHandler+0xae>
+ 800a602:	f890 2036 	ldrb.w	r2, [r0, #54]	; 0x36
+ 800a606:	2a01      	cmp	r2, #1
+ 800a608:	d10b      	bne.n	800a622 <HAL_HASH_IRQHandler+0xae>
+      {
+        /* Disable Interrupts */
+        __HAL_HASH_DISABLE_IT(HASH_IT_DINI|HASH_IT_DCI);
+ 800a60a:	6a2a      	ldr	r2, [r5, #32]
+ 800a60c:	f022 0203 	bic.w	r2, r2, #3
+ 800a610:	622a      	str	r2, [r5, #32]
+
+        /* Reset SuspendRequest */
+        hhash->SuspendRequest = HAL_HASH_SUSPEND_NONE;
+
+        /* Change the HASH state */
+        hhash->State = HAL_HASH_STATE_SUSPENDED;
+ 800a612:	2208      	movs	r2, #8
+        hhash->SuspendRequest = HAL_HASH_SUSPEND_NONE;
+ 800a614:	f880 3036 	strb.w	r3, [r0, #54]	; 0x36
+        hhash->State = HAL_HASH_STATE_SUSPENDED;
+ 800a618:	f880 2035 	strb.w	r2, [r0, #53]	; 0x35
+    hhash->Status = HAL_OK;
+ 800a61c:	f884 302c 	strb.w	r3, [r4, #44]	; 0x2c
+}
+ 800a620:	e076      	b.n	800a710 <HAL_HASH_IRQHandler+0x19c>
+  uint32_t buffercounter;
+  uint32_t inputcounter;
+  uint32_t ret = HASH_DIGEST_CALCULATION_NOT_STARTED;
+
+  /* If there are more than 64 bytes remaining to be entered */
+  if(hhash->HashInCount > 64U)
+ 800a622:	6a21      	ldr	r1, [r4, #32]
+  {
+    inputaddr = (uint32_t)hhash->pHashInBuffPtr;
+ 800a624:	68e3      	ldr	r3, [r4, #12]
+  if(hhash->HashInCount > 64U)
+ 800a626:	2940      	cmp	r1, #64	; 0x40
+    inputaddr = (uint32_t)hhash->pHashInBuffPtr;
+ 800a628:	461a      	mov	r2, r3
+  if(hhash->HashInCount > 64U)
+ 800a62a:	d91c      	bls.n	800a666 <HAL_HASH_IRQHandler+0xf2>
+ 800a62c:	f103 0140 	add.w	r1, r3, #64	; 0x40
+    /* Write the Input block in the Data IN register
+      (16 32-bit words, or 64 bytes are entered) */
+    for(buffercounter = 0U; buffercounter < 64U; buffercounter+=4U)
+    {
+      HASH->DIN = *(uint32_t*)inputaddr;
+ 800a630:	f853 0b04 	ldr.w	r0, [r3], #4
+ 800a634:	6068      	str	r0, [r5, #4]
+    for(buffercounter = 0U; buffercounter < 64U; buffercounter+=4U)
+ 800a636:	4299      	cmp	r1, r3
+ 800a638:	d1fa      	bne.n	800a630 <HAL_HASH_IRQHandler+0xbc>
+      inputaddr+=4U;
+    }
+    /* If this is the start of input data entering, an additional word
+      must be entered to start up the HASH processing */
+    if(hhash->HashITCounter == 2U)
+ 800a63a:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 800a63c:	2b02      	cmp	r3, #2
+ 800a63e:	d10d      	bne.n	800a65c <HAL_HASH_IRQHandler+0xe8>
+    {
+      HASH->DIN = *(uint32_t*)inputaddr;
+ 800a640:	680b      	ldr	r3, [r1, #0]
+ 800a642:	606b      	str	r3, [r5, #4]
+      if(hhash->HashInCount >= 68U)
+ 800a644:	6a23      	ldr	r3, [r4, #32]
+ 800a646:	2b43      	cmp	r3, #67	; 0x43
+ 800a648:	d905      	bls.n	800a656 <HAL_HASH_IRQHandler+0xe2>
+      {
+        /* There are still data waiting to be entered in the Peripheral.
+           Decrement buffer counter and set pointer to the proper
+           memory location for the next data entering round. */
+        hhash->HashInCount -= 68U;
+ 800a64a:	6a23      	ldr	r3, [r4, #32]
+ 800a64c:	3b44      	subs	r3, #68	; 0x44
+ 800a64e:	6223      	str	r3, [r4, #32]
+        hhash->pHashInBuffPtr+= 68U;
+ 800a650:	3244      	adds	r2, #68	; 0x44
+    {
+      /* 64 bytes have been entered and there are still some remaining:
+         Decrement buffer counter and set pointer to the proper
+        memory location for the next data entering round.*/
+      hhash->HashInCount -= 64U;
+      hhash->pHashInBuffPtr+= 64U;
+ 800a652:	60e2      	str	r2, [r4, #12]
+    /* Reset buffer counter */
+    hhash->HashInCount = 0;
+  }
+
+  /* Return whether or digest calculation has started */
+  return ret;
+ 800a654:	e7ca      	b.n	800a5ec <HAL_HASH_IRQHandler+0x78>
+        hhash->HashInCount = 0U;
+ 800a656:	2300      	movs	r3, #0
+ 800a658:	6223      	str	r3, [r4, #32]
+  return ret;
+ 800a65a:	e7c7      	b.n	800a5ec <HAL_HASH_IRQHandler+0x78>
+      hhash->HashInCount -= 64U;
+ 800a65c:	6a23      	ldr	r3, [r4, #32]
+ 800a65e:	3b40      	subs	r3, #64	; 0x40
+ 800a660:	6223      	str	r3, [r4, #32]
+      hhash->pHashInBuffPtr+= 64U;
+ 800a662:	3240      	adds	r2, #64	; 0x40
+ 800a664:	e7f5      	b.n	800a652 <HAL_HASH_IRQHandler+0xde>
+    inputcounter = hhash->HashInCount;
+ 800a666:	6a22      	ldr	r2, [r4, #32]
+    __HAL_HASH_DISABLE_IT(HASH_IT_DINI);
+ 800a668:	6a29      	ldr	r1, [r5, #32]
+    for(buffercounter = 0U; buffercounter < ((inputcounter+3U)/4U); buffercounter++)
+ 800a66a:	3203      	adds	r2, #3
+    __HAL_HASH_DISABLE_IT(HASH_IT_DINI);
+ 800a66c:	f021 0101 	bic.w	r1, r1, #1
+ 800a670:	f022 0203 	bic.w	r2, r2, #3
+ 800a674:	6229      	str	r1, [r5, #32]
+    for(buffercounter = 0U; buffercounter < ((inputcounter+3U)/4U); buffercounter++)
+ 800a676:	441a      	add	r2, r3
+ 800a678:	4293      	cmp	r3, r2
+ 800a67a:	d10b      	bne.n	800a694 <HAL_HASH_IRQHandler+0x120>
+    if (hhash->Accumulation == 1U)
+ 800a67c:	6c23      	ldr	r3, [r4, #64]	; 0x40
+ 800a67e:	2b01      	cmp	r3, #1
+ 800a680:	d10c      	bne.n	800a69c <HAL_HASH_IRQHandler+0x128>
+      hhash->Accumulation = 0U;
+ 800a682:	2500      	movs	r5, #0
+ 800a684:	6425      	str	r5, [r4, #64]	; 0x40
+        HAL_HASH_InCpltCallback(hhash);
+ 800a686:	4620      	mov	r0, r4
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a688:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+        HAL_HASH_InCpltCallback(hhash);
+ 800a68c:	f7ff ff6f 	bl	800a56e <HAL_HASH_InCpltCallback>
+    hhash->HashInCount = 0;
+ 800a690:	6225      	str	r5, [r4, #32]
+  return ret;
+ 800a692:	e7ab      	b.n	800a5ec <HAL_HASH_IRQHandler+0x78>
+      HASH->DIN = *(uint32_t*)inputaddr;
+ 800a694:	f853 1b04 	ldr.w	r1, [r3], #4
+ 800a698:	6069      	str	r1, [r5, #4]
+    for(buffercounter = 0U; buffercounter < ((inputcounter+3U)/4U); buffercounter++)
+ 800a69a:	e7ed      	b.n	800a678 <HAL_HASH_IRQHandler+0x104>
+      __HAL_HASH_START_DIGEST();
+ 800a69c:	68ab      	ldr	r3, [r5, #8]
+ 800a69e:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 800a6a2:	60ab      	str	r3, [r5, #8]
+    hhash->HashInCount = 0;
+ 800a6a4:	2300      	movs	r3, #0
+ 800a6a6:	6223      	str	r3, [r4, #32]
+        HAL_HASH_InCpltCallback(hhash);
+ 800a6a8:	4620      	mov	r0, r4
+ 800a6aa:	f7ff ff60 	bl	800a56e <HAL_HASH_InCpltCallback>
+        if (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_1)
+ 800a6ae:	f894 602d 	ldrb.w	r6, [r4, #45]	; 0x2d
+ 800a6b2:	2e03      	cmp	r6, #3
+ 800a6b4:	d12d      	bne.n	800a712 <HAL_HASH_IRQHandler+0x19e>
+          if (HASH_WaitOnFlagUntilTimeout(hhash, HASH_FLAG_BUSY, SET, HASH_TIMEOUTVALUE) != HAL_OK)
+ 800a6b6:	f44f 737a 	mov.w	r3, #1000	; 0x3e8
+ 800a6ba:	2201      	movs	r2, #1
+ 800a6bc:	2108      	movs	r1, #8
+ 800a6be:	4620      	mov	r0, r4
+ 800a6c0:	f7ff feea 	bl	800a498 <HASH_WaitOnFlagUntilTimeout>
+ 800a6c4:	b168      	cbz	r0, 800a6e2 <HAL_HASH_IRQHandler+0x16e>
+            __HAL_HASH_DISABLE_IT(HASH_IT_DINI|HASH_IT_DCI);
+ 800a6c6:	6a2b      	ldr	r3, [r5, #32]
+ 800a6c8:	f023 0303 	bic.w	r3, r3, #3
+ 800a6cc:	622b      	str	r3, [r5, #32]
+  hhash->Status = HASH_IT(hhash);
+ 800a6ce:	f884 602c 	strb.w	r6, [r4, #44]	; 0x2c
+    hhash->ErrorCode |= HAL_HASH_ERROR_IT;
+ 800a6d2:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 800a6d4:	f043 0301 	orr.w	r3, r3, #1
+ 800a6d8:	63e3      	str	r3, [r4, #60]	; 0x3c
+    HAL_HASH_ErrorCallback(hhash);
+ 800a6da:	4620      	mov	r0, r4
+ 800a6dc:	f7ff ff49 	bl	800a572 <HAL_HASH_ErrorCallback>
+ 800a6e0:	e784      	b.n	800a5ec <HAL_HASH_IRQHandler+0x78>
+          hhash->Phase = HAL_HASH_PHASE_HMAC_STEP_2;        /* Move phase from Step 1 to Step 2 */
+ 800a6e2:	2304      	movs	r3, #4
+ 800a6e4:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+          __HAL_HASH_SET_NBVALIDBITS(hhash->HashBuffSize);  /* Set NBLW for the input message */
+ 800a6e8:	68ab      	ldr	r3, [r5, #8]
+ 800a6ea:	69e2      	ldr	r2, [r4, #28]
+ 800a6ec:	f023 031f 	bic.w	r3, r3, #31
+ 800a6f0:	f002 0103 	and.w	r1, r2, #3
+ 800a6f4:	ea43 03c1 	orr.w	r3, r3, r1, lsl #3
+ 800a6f8:	60ab      	str	r3, [r5, #8]
+          hhash->pHashInBuffPtr = hhash->pHashMsgBuffPtr;   /* Set the input data address */
+ 800a6fa:	69a3      	ldr	r3, [r4, #24]
+          hhash->HashInCount = hhash->HashBuffSize;         /* Set the input data size (in bytes) */
+ 800a6fc:	6222      	str	r2, [r4, #32]
+          hhash->pHashInBuffPtr = hhash->Init.pKey;          /* Set the key address */
+ 800a6fe:	60e3      	str	r3, [r4, #12]
+          hhash->HashITCounter = 1;                          /* Set ITCounter to 1 to indicate the start of a new phase */
+ 800a700:	2301      	movs	r3, #1
+ 800a702:	6263      	str	r3, [r4, #36]	; 0x24
+          __HAL_HASH_ENABLE_IT(HASH_IT_DINI);                /* Enable IT (was disabled in HASH_Write_Block_Data) */
+ 800a704:	6a2b      	ldr	r3, [r5, #32]
+ 800a706:	f043 0301 	orr.w	r3, r3, #1
+ 800a70a:	622b      	str	r3, [r5, #32]
+  hhash->Status = HASH_IT(hhash);
+ 800a70c:	f884 002c 	strb.w	r0, [r4, #44]	; 0x2c
+}
+ 800a710:	bd70      	pop	{r4, r5, r6, pc}
+        else if (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_2)
+ 800a712:	2e04      	cmp	r6, #4
+ 800a714:	f47f af6a 	bne.w	800a5ec <HAL_HASH_IRQHandler+0x78>
+          if (HASH_WaitOnFlagUntilTimeout(hhash, HASH_FLAG_BUSY, SET, HASH_TIMEOUTVALUE) != HAL_OK)
+ 800a718:	f44f 737a 	mov.w	r3, #1000	; 0x3e8
+ 800a71c:	2201      	movs	r2, #1
+ 800a71e:	2108      	movs	r1, #8
+ 800a720:	4620      	mov	r0, r4
+ 800a722:	f7ff feb9 	bl	800a498 <HASH_WaitOnFlagUntilTimeout>
+ 800a726:	b128      	cbz	r0, 800a734 <HAL_HASH_IRQHandler+0x1c0>
+            __HAL_HASH_DISABLE_IT(HASH_IT_DINI|HASH_IT_DCI);
+ 800a728:	6a2b      	ldr	r3, [r5, #32]
+ 800a72a:	f023 0303 	bic.w	r3, r3, #3
+ 800a72e:	622b      	str	r3, [r5, #32]
+  hhash->Status = HASH_IT(hhash);
+ 800a730:	2303      	movs	r3, #3
+ 800a732:	e731      	b.n	800a598 <HAL_HASH_IRQHandler+0x24>
+          hhash->Phase = HAL_HASH_PHASE_HMAC_STEP_3;         /* Move phase from Step 2 to Step 3 */
+ 800a734:	2305      	movs	r3, #5
+ 800a736:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+          __HAL_HASH_SET_NBVALIDBITS(hhash->Init.KeySize);   /* Set NBLW for the key */
+ 800a73a:	68ab      	ldr	r3, [r5, #8]
+ 800a73c:	6862      	ldr	r2, [r4, #4]
+ 800a73e:	f023 031f 	bic.w	r3, r3, #31
+ 800a742:	f002 0103 	and.w	r1, r2, #3
+ 800a746:	ea43 03c1 	orr.w	r3, r3, r1, lsl #3
+ 800a74a:	60ab      	str	r3, [r5, #8]
+          hhash->pHashInBuffPtr = hhash->Init.pKey;          /* Set the key address */
+ 800a74c:	68a3      	ldr	r3, [r4, #8]
+          hhash->HashInCount = hhash->Init.KeySize;          /* Set the key size (in bytes) */
+ 800a74e:	6222      	str	r2, [r4, #32]
+          hhash->pHashInBuffPtr = hhash->Init.pKey;          /* Set the key address */
+ 800a750:	e7d5      	b.n	800a6fe <HAL_HASH_IRQHandler+0x18a>
+  hhash->Status = HASH_IT(hhash);
+ 800a752:	2302      	movs	r3, #2
+ 800a754:	e720      	b.n	800a598 <HAL_HASH_IRQHandler+0x24>
+ 800a756:	bf00      	nop
+ 800a758:	50060400 	.word	0x50060400
+ 800a75c:	00040080 	.word	0x00040080
+
+0800a760 <HAL_HASH_GetState>:
+  return hhash->State;
+ 800a760:	f890 0035 	ldrb.w	r0, [r0, #53]	; 0x35
+}
+ 800a764:	4770      	bx	lr
+
+0800a766 <HAL_HASH_GetStatus>:
+}
+ 800a766:	f890 002c 	ldrb.w	r0, [r0, #44]	; 0x2c
+ 800a76a:	4770      	bx	lr
+
+0800a76c <HAL_HASH_ContextSaving>:
+  *(uint32_t*)(mem_ptr) = READ_BIT(HASH->IMR,HASH_IT_DINI|HASH_IT_DCI);
+ 800a76c:	4b0e      	ldr	r3, [pc, #56]	; (800a7a8 <HAL_HASH_ContextSaving+0x3c>)
+ 800a76e:	6a1a      	ldr	r2, [r3, #32]
+ 800a770:	f002 0203 	and.w	r2, r2, #3
+ 800a774:	600a      	str	r2, [r1, #0]
+  *(uint32_t*)(mem_ptr) = READ_BIT(HASH->STR,HASH_STR_NBLW);
+ 800a776:	689a      	ldr	r2, [r3, #8]
+ 800a778:	f002 021f 	and.w	r2, r2, #31
+ 800a77c:	604a      	str	r2, [r1, #4]
+  *(uint32_t*)(mem_ptr) = READ_BIT(HASH->CR,HASH_CR_DMAE|HASH_CR_DATATYPE|HASH_CR_MODE|HASH_CR_ALGO|HASH_CR_LKEY|HASH_CR_MDMAT);
+ 800a77e:	681b      	ldr	r3, [r3, #0]
+  for (i = HASH_NUMBER_OF_CSR_REGISTERS; i >0U; i--)
+ 800a780:	4a0a      	ldr	r2, [pc, #40]	; (800a7ac <HAL_HASH_ContextSaving+0x40>)
+  *(uint32_t*)(mem_ptr) = READ_BIT(HASH->CR,HASH_CR_DMAE|HASH_CR_DATATYPE|HASH_CR_MODE|HASH_CR_ALGO|HASH_CR_LKEY|HASH_CR_MDMAT);
+ 800a782:	f023 437f 	bic.w	r3, r3, #4278190080	; 0xff000000
+ 800a786:	f423 037a 	bic.w	r3, r3, #16384000	; 0xfa0000
+ 800a78a:	f423 435f 	bic.w	r3, r3, #57088	; 0xdf00
+ 800a78e:	f023 0307 	bic.w	r3, r3, #7
+ 800a792:	608b      	str	r3, [r1, #8]
+  uint32_t csr_ptr = (uint32_t)HASH->CSR;
+ 800a794:	4b06      	ldr	r3, [pc, #24]	; (800a7b0 <HAL_HASH_ContextSaving+0x44>)
+  mem_ptr+=4U;
+ 800a796:	310c      	adds	r1, #12
+    *(uint32_t*)(mem_ptr) = *(uint32_t*)(csr_ptr);
+ 800a798:	f853 0b04 	ldr.w	r0, [r3], #4
+ 800a79c:	f841 0b04 	str.w	r0, [r1], #4
+  for (i = HASH_NUMBER_OF_CSR_REGISTERS; i >0U; i--)
+ 800a7a0:	4293      	cmp	r3, r2
+ 800a7a2:	d1f9      	bne.n	800a798 <HAL_HASH_ContextSaving+0x2c>
+}
+ 800a7a4:	4770      	bx	lr
+ 800a7a6:	bf00      	nop
+ 800a7a8:	50060400 	.word	0x50060400
+ 800a7ac:	500605d0 	.word	0x500605d0
+ 800a7b0:	500604f8 	.word	0x500604f8
+
+0800a7b4 <HAL_HASH_ContextRestoring>:
+  WRITE_REG(HASH->IMR, (*(uint32_t*)(mem_ptr)));
+ 800a7b4:	4b0a      	ldr	r3, [pc, #40]	; (800a7e0 <HAL_HASH_ContextRestoring+0x2c>)
+ 800a7b6:	680a      	ldr	r2, [r1, #0]
+ 800a7b8:	621a      	str	r2, [r3, #32]
+  WRITE_REG(HASH->STR, (*(uint32_t*)(mem_ptr)));
+ 800a7ba:	684a      	ldr	r2, [r1, #4]
+ 800a7bc:	609a      	str	r2, [r3, #8]
+  WRITE_REG(HASH->CR, (*(uint32_t*)(mem_ptr)));
+ 800a7be:	688a      	ldr	r2, [r1, #8]
+ 800a7c0:	601a      	str	r2, [r3, #0]
+  __HAL_HASH_INIT();
+ 800a7c2:	681a      	ldr	r2, [r3, #0]
+ 800a7c4:	f042 0204 	orr.w	r2, r2, #4
+ 800a7c8:	601a      	str	r2, [r3, #0]
+  for (i = HASH_NUMBER_OF_CSR_REGISTERS; i >0U; i--)
+ 800a7ca:	4a06      	ldr	r2, [pc, #24]	; (800a7e4 <HAL_HASH_ContextRestoring+0x30>)
+  mem_ptr+=4U;
+ 800a7cc:	310c      	adds	r1, #12
+  uint32_t csr_ptr = (uint32_t)HASH->CSR;
+ 800a7ce:	33f8      	adds	r3, #248	; 0xf8
+    WRITE_REG((*(uint32_t*)(csr_ptr)), (*(uint32_t*)(mem_ptr)));
+ 800a7d0:	f851 0b04 	ldr.w	r0, [r1], #4
+ 800a7d4:	f843 0b04 	str.w	r0, [r3], #4
+  for (i = HASH_NUMBER_OF_CSR_REGISTERS; i >0U; i--)
+ 800a7d8:	4293      	cmp	r3, r2
+ 800a7da:	d1f9      	bne.n	800a7d0 <HAL_HASH_ContextRestoring+0x1c>
+}
+ 800a7dc:	4770      	bx	lr
+ 800a7de:	bf00      	nop
+ 800a7e0:	50060400 	.word	0x50060400
+ 800a7e4:	500605d0 	.word	0x500605d0
+
+0800a7e8 <HAL_HASH_SwFeed_ProcessSuspend>:
+  hhash->SuspendRequest = HAL_HASH_SUSPEND;
+ 800a7e8:	2301      	movs	r3, #1
+ 800a7ea:	f880 3036 	strb.w	r3, [r0, #54]	; 0x36
+}
+ 800a7ee:	4770      	bx	lr
+
+0800a7f0 <HAL_HASH_GetError>:
+  return hhash->ErrorCode;
+ 800a7f0:	6bc0      	ldr	r0, [r0, #60]	; 0x3c
+}
+ 800a7f2:	4770      	bx	lr
+
+0800a7f4 <HASH_Start>:
+  * @param  Timeout Timeout value.
+  * @param  Algorithm HASH algorithm.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HASH_Start(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size, uint8_t* pOutBuffer, uint32_t Timeout, uint32_t Algorithm)
+{
+ 800a7f4:	b5f8      	push	{r3, r4, r5, r6, r7, lr}
+ 800a7f6:	461e      	mov	r6, r3
+  uint8_t *pInBuffer_tmp;  /* input data address, input parameter of HASH_WriteData()         */
+  uint32_t Size_tmp; /* input data size (in bytes), input parameter of HASH_WriteData() */
+  HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800a7f8:	f890 3035 	ldrb.w	r3, [r0, #53]	; 0x35
+
+
+  /* Initiate HASH processing in case of start or resumption */
+if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800a7fc:	2b01      	cmp	r3, #1
+{
+ 800a7fe:	4604      	mov	r4, r0
+  HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800a800:	b2d8      	uxtb	r0, r3
+if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800a802:	d001      	beq.n	800a808 <HASH_Start+0x14>
+ 800a804:	2808      	cmp	r0, #8
+ 800a806:	d17a      	bne.n	800a8fe <HASH_Start+0x10a>
+  {
+    /* Check input parameters */
+    if ((pInBuffer == NULL) || (pOutBuffer == NULL))
+ 800a808:	b101      	cbz	r1, 800a80c <HASH_Start+0x18>
+ 800a80a:	b926      	cbnz	r6, 800a816 <HASH_Start+0x22>
+    {
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a80c:	2501      	movs	r5, #1
+ 800a80e:	f884 5035 	strb.w	r5, [r4, #53]	; 0x35
+  }
+  else
+  {
+    return HAL_BUSY;
+  }
+}
+ 800a812:	4628      	mov	r0, r5
+ 800a814:	bdf8      	pop	{r3, r4, r5, r6, r7, pc}
+    __HAL_LOCK(hhash);
+ 800a816:	f894 3034 	ldrb.w	r3, [r4, #52]	; 0x34
+ 800a81a:	2b01      	cmp	r3, #1
+ 800a81c:	d06f      	beq.n	800a8fe <HASH_Start+0x10a>
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800a81e:	f894 302d 	ldrb.w	r3, [r4, #45]	; 0x2d
+    __HAL_LOCK(hhash);
+ 800a822:	2501      	movs	r5, #1
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800a824:	42ab      	cmp	r3, r5
+    __HAL_LOCK(hhash);
+ 800a826:	f884 5034 	strb.w	r5, [r4, #52]	; 0x34
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800a82a:	d148      	bne.n	800a8be <HASH_Start+0xca>
+      MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_CR_INIT);
+ 800a82c:	4f36      	ldr	r7, [pc, #216]	; (800a908 <HASH_Start+0x114>)
+ 800a82e:	9b07      	ldr	r3, [sp, #28]
+      hhash->State = HAL_HASH_STATE_BUSY;
+ 800a830:	f04f 0c02 	mov.w	ip, #2
+ 800a834:	f884 c035 	strb.w	ip, [r4, #53]	; 0x35
+      MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_CR_INIT);
+ 800a838:	683d      	ldr	r5, [r7, #0]
+ 800a83a:	f425 25a0 	bic.w	r5, r5, #327680	; 0x50000
+ 800a83e:	f025 05c4 	bic.w	r5, r5, #196	; 0xc4
+ 800a842:	431d      	orrs	r5, r3
+ 800a844:	f045 0504 	orr.w	r5, r5, #4
+ 800a848:	603d      	str	r5, [r7, #0]
+      __HAL_HASH_SET_NBVALIDBITS(Size);
+ 800a84a:	68b8      	ldr	r0, [r7, #8]
+ 800a84c:	f002 0303 	and.w	r3, r2, #3
+ 800a850:	f020 001f 	bic.w	r0, r0, #31
+ 800a854:	ea40 03c3 	orr.w	r3, r0, r3, lsl #3
+ 800a858:	60bb      	str	r3, [r7, #8]
+      hhash->Phase = HAL_HASH_PHASE_PROCESS;
+ 800a85a:	f884 c02d 	strb.w	ip, [r4, #45]	; 0x2d
+    hhash->Status = HASH_WriteData(hhash, pInBuffer_tmp, Size_tmp);
+ 800a85e:	4620      	mov	r0, r4
+ 800a860:	f7ff fd78 	bl	800a354 <HASH_WriteData>
+ 800a864:	4605      	mov	r5, r0
+ 800a866:	f884 002c 	strb.w	r0, [r4, #44]	; 0x2c
+    if (hhash->Status != HAL_OK)
+ 800a86a:	2800      	cmp	r0, #0
+ 800a86c:	d1d1      	bne.n	800a812 <HASH_Start+0x1e>
+    if (hhash->State != HAL_HASH_STATE_SUSPENDED)
+ 800a86e:	f894 3035 	ldrb.w	r3, [r4, #53]	; 0x35
+ 800a872:	2b08      	cmp	r3, #8
+ 800a874:	d03b      	beq.n	800a8ee <HASH_Start+0xfa>
+      __HAL_HASH_START_DIGEST();
+ 800a876:	4f24      	ldr	r7, [pc, #144]	; (800a908 <HASH_Start+0x114>)
+ 800a878:	68bb      	ldr	r3, [r7, #8]
+ 800a87a:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 800a87e:	60bb      	str	r3, [r7, #8]
+      if (HASH_WaitOnFlagUntilTimeout(hhash, HASH_FLAG_DCIS, RESET, Timeout) != HAL_OK)
+ 800a880:	4602      	mov	r2, r0
+ 800a882:	9b06      	ldr	r3, [sp, #24]
+ 800a884:	2102      	movs	r1, #2
+ 800a886:	4620      	mov	r0, r4
+ 800a888:	f7ff fe06 	bl	800a498 <HASH_WaitOnFlagUntilTimeout>
+ 800a88c:	2800      	cmp	r0, #0
+ 800a88e:	d138      	bne.n	800a902 <HASH_Start+0x10e>
+      HASH_GetDigest(pOutBuffer, HASH_DIGEST_LENGTH());
+ 800a890:	683a      	ldr	r2, [r7, #0]
+ 800a892:	4b1e      	ldr	r3, [pc, #120]	; (800a90c <HASH_Start+0x118>)
+ 800a894:	421a      	tst	r2, r3
+ 800a896:	d02e      	beq.n	800a8f6 <HASH_Start+0x102>
+ 800a898:	683a      	ldr	r2, [r7, #0]
+ 800a89a:	401a      	ands	r2, r3
+ 800a89c:	f5b2 2f80 	cmp.w	r2, #262144	; 0x40000
+ 800a8a0:	d02b      	beq.n	800a8fa <HASH_Start+0x106>
+ 800a8a2:	683a      	ldr	r2, [r7, #0]
+ 800a8a4:	4393      	bics	r3, r2
+ 800a8a6:	bf0c      	ite	eq
+ 800a8a8:	2120      	moveq	r1, #32
+ 800a8aa:	2110      	movne	r1, #16
+ 800a8ac:	4630      	mov	r0, r6
+ 800a8ae:	f7ff fd91 	bl	800a3d4 <HASH_GetDigest>
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a8b2:	2301      	movs	r3, #1
+ 800a8b4:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+      hhash->Phase = HAL_HASH_PHASE_READY;
+ 800a8b8:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+ 800a8bc:	e017      	b.n	800a8ee <HASH_Start+0xfa>
+    else if (hhash->Phase == HAL_HASH_PHASE_PROCESS)
+ 800a8be:	2b02      	cmp	r3, #2
+ 800a8c0:	d113      	bne.n	800a8ea <HASH_Start+0xf6>
+      if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800a8c2:	f894 3035 	ldrb.w	r3, [r4, #53]	; 0x35
+ 800a8c6:	2b08      	cmp	r3, #8
+        __HAL_HASH_SET_NBVALIDBITS(Size);
+ 800a8c8:	bf15      	itete	ne
+ 800a8ca:	4d0f      	ldrne	r5, [pc, #60]	; (800a908 <HASH_Start+0x114>)
+        Size_tmp = hhash->HashInCount;
+ 800a8cc:	6a22      	ldreq	r2, [r4, #32]
+        __HAL_HASH_SET_NBVALIDBITS(Size);
+ 800a8ce:	68a8      	ldrne	r0, [r5, #8]
+        pInBuffer_tmp = hhash->pHashInBuffPtr;
+ 800a8d0:	68e1      	ldreq	r1, [r4, #12]
+        __HAL_HASH_SET_NBVALIDBITS(Size);
+ 800a8d2:	bf1f      	itttt	ne
+ 800a8d4:	f002 0303 	andne.w	r3, r2, #3
+ 800a8d8:	f020 001f 	bicne.w	r0, r0, #31
+ 800a8dc:	ea40 03c3 	orrne.w	r3, r0, r3, lsl #3
+ 800a8e0:	60ab      	strne	r3, [r5, #8]
+      hhash->State = HAL_HASH_STATE_BUSY;
+ 800a8e2:	2302      	movs	r3, #2
+ 800a8e4:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+ 800a8e8:	e7b9      	b.n	800a85e <HASH_Start+0x6a>
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a8ea:	f884 5035 	strb.w	r5, [r4, #53]	; 0x35
+    __HAL_UNLOCK(hhash);
+ 800a8ee:	2300      	movs	r3, #0
+ 800a8f0:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+    return HAL_OK;
+ 800a8f4:	e78d      	b.n	800a812 <HASH_Start+0x1e>
+      HASH_GetDigest(pOutBuffer, HASH_DIGEST_LENGTH());
+ 800a8f6:	2114      	movs	r1, #20
+ 800a8f8:	e7d8      	b.n	800a8ac <HASH_Start+0xb8>
+ 800a8fa:	211c      	movs	r1, #28
+ 800a8fc:	e7d6      	b.n	800a8ac <HASH_Start+0xb8>
+    return HAL_BUSY;
+ 800a8fe:	2502      	movs	r5, #2
+ 800a900:	e787      	b.n	800a812 <HASH_Start+0x1e>
+        return HAL_TIMEOUT;
+ 800a902:	2503      	movs	r5, #3
+ 800a904:	e785      	b.n	800a812 <HASH_Start+0x1e>
+ 800a906:	bf00      	nop
+ 800a908:	50060400 	.word	0x50060400
+ 800a90c:	00040080 	.word	0x00040080
+
+0800a910 <HAL_HASH_MD5_Start>:
+{
+ 800a910:	b513      	push	{r0, r1, r4, lr}
+  return HASH_Start(hhash, pInBuffer, Size, pOutBuffer, Timeout, HASH_ALGOSELECTION_MD5);
+ 800a912:	2480      	movs	r4, #128	; 0x80
+ 800a914:	9401      	str	r4, [sp, #4]
+ 800a916:	9c04      	ldr	r4, [sp, #16]
+ 800a918:	9400      	str	r4, [sp, #0]
+ 800a91a:	f7ff ff6b 	bl	800a7f4 <HASH_Start>
+}
+ 800a91e:	b002      	add	sp, #8
+ 800a920:	bd10      	pop	{r4, pc}
+
+0800a922 <HAL_HASH_MD5_Accmlt_End>:
+ 800a922:	f7ff bff5 	b.w	800a910 <HAL_HASH_MD5_Start>
+
+0800a926 <HAL_HASH_SHA1_Start>:
+{
+ 800a926:	b513      	push	{r0, r1, r4, lr}
+  return HASH_Start(hhash, pInBuffer, Size, pOutBuffer, Timeout, HASH_ALGOSELECTION_SHA1);
+ 800a928:	2400      	movs	r4, #0
+ 800a92a:	9401      	str	r4, [sp, #4]
+ 800a92c:	9c04      	ldr	r4, [sp, #16]
+ 800a92e:	9400      	str	r4, [sp, #0]
+ 800a930:	f7ff ff60 	bl	800a7f4 <HASH_Start>
+}
+ 800a934:	b002      	add	sp, #8
+ 800a936:	bd10      	pop	{r4, pc}
+
+0800a938 <HAL_HASH_SHA1_Accmlt_End>:
+ 800a938:	f7ff bff5 	b.w	800a926 <HAL_HASH_SHA1_Start>
+
+0800a93c <HASH_Accumulate>:
+  * @param  Size length of the input buffer in bytes, must be a multiple of 4.
+  * @param  Algorithm HASH algorithm.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HASH_Accumulate(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size, uint32_t Algorithm)
+{
+ 800a93c:	b570      	push	{r4, r5, r6, lr}
+  uint8_t *pInBuffer_tmp;   /* input data address, input parameter of HASH_WriteData()         */
+  uint32_t Size_tmp;  /* input data size (in bytes), input parameter of HASH_WriteData() */
+  HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800a93e:	f890 5035 	ldrb.w	r5, [r0, #53]	; 0x35
+{
+ 800a942:	4604      	mov	r4, r0
+
+  /* Make sure the input buffer size (in bytes) is a multiple of 4 */
+  if ((Size % 4U) != 0U)
+ 800a944:	0790      	lsls	r0, r2, #30
+  HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800a946:	b2ed      	uxtb	r5, r5
+  if ((Size % 4U) != 0U)
+ 800a948:	d13e      	bne.n	800a9c8 <HASH_Accumulate+0x8c>
+  {
+    return  HAL_ERROR;
+  }
+
+  /* Initiate HASH processing in case of start or resumption */
+if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800a94a:	2d01      	cmp	r5, #1
+ 800a94c:	d001      	beq.n	800a952 <HASH_Accumulate+0x16>
+ 800a94e:	2d08      	cmp	r5, #8
+ 800a950:	d13c      	bne.n	800a9cc <HASH_Accumulate+0x90>
+  {
+    /* Check input parameters */
+    if ((pInBuffer == NULL) || (Size == 0U))
+ 800a952:	b101      	cbz	r1, 800a956 <HASH_Accumulate+0x1a>
+ 800a954:	b91a      	cbnz	r2, 800a95e <HASH_Accumulate+0x22>
+    {
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a956:	2001      	movs	r0, #1
+ 800a958:	f884 0035 	strb.w	r0, [r4, #53]	; 0x35
+  {
+    return HAL_BUSY;
+  }
+
+
+}
+ 800a95c:	bd70      	pop	{r4, r5, r6, pc}
+    __HAL_LOCK(hhash);
+ 800a95e:	f894 0034 	ldrb.w	r0, [r4, #52]	; 0x34
+ 800a962:	2801      	cmp	r0, #1
+ 800a964:	d032      	beq.n	800a9cc <HASH_Accumulate+0x90>
+ 800a966:	2001      	movs	r0, #1
+ 800a968:	f884 0034 	strb.w	r0, [r4, #52]	; 0x34
+    if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800a96c:	f894 0035 	ldrb.w	r0, [r4, #53]	; 0x35
+ 800a970:	2808      	cmp	r0, #8
+ 800a972:	f04f 0002 	mov.w	r0, #2
+      hhash->State = HAL_HASH_STATE_BUSY;
+ 800a976:	f884 0035 	strb.w	r0, [r4, #53]	; 0x35
+    if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800a97a:	d113      	bne.n	800a9a4 <HASH_Accumulate+0x68>
+      pInBuffer_tmp = hhash->pHashInBuffPtr;  /* pInBuffer_tmp is set to the input data address */
+ 800a97c:	68e1      	ldr	r1, [r4, #12]
+      Size_tmp = hhash->HashInCount;          /* Size_tmp contains the input data size in bytes */
+ 800a97e:	6a22      	ldr	r2, [r4, #32]
+    hhash->Status = HASH_WriteData(hhash, pInBuffer_tmp, Size_tmp);
+ 800a980:	4620      	mov	r0, r4
+ 800a982:	f7ff fce7 	bl	800a354 <HASH_WriteData>
+ 800a986:	f884 002c 	strb.w	r0, [r4, #44]	; 0x2c
+    if (hhash->Status != HAL_OK)
+ 800a98a:	2800      	cmp	r0, #0
+ 800a98c:	d1e6      	bne.n	800a95c <HASH_Accumulate+0x20>
+    if (hhash->State != HAL_HASH_STATE_SUSPENDED)
+ 800a98e:	f894 3035 	ldrb.w	r3, [r4, #53]	; 0x35
+ 800a992:	2b08      	cmp	r3, #8
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a994:	bf1c      	itt	ne
+ 800a996:	2301      	movne	r3, #1
+ 800a998:	f884 3035 	strbne.w	r3, [r4, #53]	; 0x35
+    __HAL_UNLOCK(hhash);
+ 800a99c:	2300      	movs	r3, #0
+ 800a99e:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+    return HAL_OK;
+ 800a9a2:	e7db      	b.n	800a95c <HASH_Accumulate+0x20>
+      if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800a9a4:	f894 002d 	ldrb.w	r0, [r4, #45]	; 0x2d
+ 800a9a8:	2801      	cmp	r0, #1
+ 800a9aa:	d109      	bne.n	800a9c0 <HASH_Accumulate+0x84>
+        MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_CR_INIT);
+ 800a9ac:	4e08      	ldr	r6, [pc, #32]	; (800a9d0 <HASH_Accumulate+0x94>)
+ 800a9ae:	6830      	ldr	r0, [r6, #0]
+ 800a9b0:	f420 20a0 	bic.w	r0, r0, #327680	; 0x50000
+ 800a9b4:	f020 00c4 	bic.w	r0, r0, #196	; 0xc4
+ 800a9b8:	4318      	orrs	r0, r3
+ 800a9ba:	f040 0004 	orr.w	r0, r0, #4
+ 800a9be:	6030      	str	r0, [r6, #0]
+      hhash->Phase = HAL_HASH_PHASE_PROCESS;
+ 800a9c0:	2302      	movs	r3, #2
+ 800a9c2:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+ 800a9c6:	e7db      	b.n	800a980 <HASH_Accumulate+0x44>
+    return  HAL_ERROR;
+ 800a9c8:	2001      	movs	r0, #1
+ 800a9ca:	e7c7      	b.n	800a95c <HASH_Accumulate+0x20>
+    return HAL_BUSY;
+ 800a9cc:	2002      	movs	r0, #2
+ 800a9ce:	e7c5      	b.n	800a95c <HASH_Accumulate+0x20>
+ 800a9d0:	50060400 	.word	0x50060400
+
+0800a9d4 <HAL_HASH_MD5_Accmlt>:
+  return  HASH_Accumulate(hhash, pInBuffer, Size,HASH_ALGOSELECTION_MD5);
+ 800a9d4:	2380      	movs	r3, #128	; 0x80
+ 800a9d6:	f7ff bfb1 	b.w	800a93c <HASH_Accumulate>
+
+0800a9da <HAL_HASH_SHA1_Accmlt>:
+  return  HASH_Accumulate(hhash, pInBuffer, Size,HASH_ALGOSELECTION_SHA1);
+ 800a9da:	2300      	movs	r3, #0
+ 800a9dc:	f7ff bfae 	b.w	800a93c <HASH_Accumulate>
+
+0800a9e0 <HASH_Accumulate_IT>:
+  * @param  Size length of the input buffer in bytes, must be a multiple of 4.
+  * @param  Algorithm HASH algorithm.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HASH_Accumulate_IT(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size, uint32_t Algorithm)
+{
+ 800a9e0:	b567      	push	{r0, r1, r2, r5, r6, lr}
+  HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800a9e2:	f890 5035 	ldrb.w	r5, [r0, #53]	; 0x35
+  __IO uint32_t inputaddr = (uint32_t) pInBuffer;
+ 800a9e6:	9101      	str	r1, [sp, #4]
+  uint32_t SizeVar = Size;
+
+  /* Make sure the input buffer size (in bytes) is a multiple of 4 */
+  if ((Size % 4U) != 0U)
+ 800a9e8:	0796      	lsls	r6, r2, #30
+  HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800a9ea:	b2ed      	uxtb	r5, r5
+  if ((Size % 4U) != 0U)
+ 800a9ec:	d154      	bne.n	800aa98 <HASH_Accumulate_IT+0xb8>
+  {
+    return  HAL_ERROR;
+  }
+
+  /* Initiate HASH processing in case of start or resumption */
+  if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800a9ee:	2d01      	cmp	r5, #1
+ 800a9f0:	d001      	beq.n	800a9f6 <HASH_Accumulate_IT+0x16>
+ 800a9f2:	2d08      	cmp	r5, #8
+ 800a9f4:	d152      	bne.n	800aa9c <HASH_Accumulate_IT+0xbc>
+  {
+    /* Check input parameters */
+    if ((pInBuffer == NULL) || (Size == 0U))
+ 800a9f6:	b101      	cbz	r1, 800a9fa <HASH_Accumulate_IT+0x1a>
+ 800a9f8:	b92a      	cbnz	r2, 800aa06 <HASH_Accumulate_IT+0x26>
+    {
+      hhash->State = HAL_HASH_STATE_READY;
+ 800a9fa:	2301      	movs	r3, #1
+ 800a9fc:	f880 3035 	strb.w	r3, [r0, #53]	; 0x35
+  else
+  {
+    return HAL_BUSY;
+  }
+
+}
+ 800aa00:	4618      	mov	r0, r3
+ 800aa02:	b003      	add	sp, #12
+ 800aa04:	bd60      	pop	{r5, r6, pc}
+    __HAL_LOCK(hhash);
+ 800aa06:	f890 1034 	ldrb.w	r1, [r0, #52]	; 0x34
+ 800aa0a:	2901      	cmp	r1, #1
+ 800aa0c:	d046      	beq.n	800aa9c <HASH_Accumulate_IT+0xbc>
+ 800aa0e:	2101      	movs	r1, #1
+ 800aa10:	f880 1034 	strb.w	r1, [r0, #52]	; 0x34
+    if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800aa14:	f890 1035 	ldrb.w	r1, [r0, #53]	; 0x35
+ 800aa18:	4d21      	ldr	r5, [pc, #132]	; (800aaa0 <HASH_Accumulate_IT+0xc0>)
+ 800aa1a:	2908      	cmp	r1, #8
+ 800aa1c:	f04f 0102 	mov.w	r1, #2
+      hhash->State = HAL_HASH_STATE_BUSY;
+ 800aa20:	f880 1035 	strb.w	r1, [r0, #53]	; 0x35
+    if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800aa24:	d109      	bne.n	800aa3a <HASH_Accumulate_IT+0x5a>
+    hhash->Accumulation = 1U;
+ 800aa26:	2301      	movs	r3, #1
+ 800aa28:	6403      	str	r3, [r0, #64]	; 0x40
+    __HAL_UNLOCK(hhash);
+ 800aa2a:	2300      	movs	r3, #0
+ 800aa2c:	f880 3034 	strb.w	r3, [r0, #52]	; 0x34
+    __HAL_HASH_ENABLE_IT(HASH_IT_DINI);
+ 800aa30:	6a2a      	ldr	r2, [r5, #32]
+ 800aa32:	f042 0201 	orr.w	r2, r2, #1
+ 800aa36:	622a      	str	r2, [r5, #32]
+    return HAL_OK;
+ 800aa38:	e7e2      	b.n	800aa00 <HASH_Accumulate_IT+0x20>
+      if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800aa3a:	f890 602d 	ldrb.w	r6, [r0, #45]	; 0x2d
+ 800aa3e:	2e01      	cmp	r6, #1
+ 800aa40:	d11b      	bne.n	800aa7a <HASH_Accumulate_IT+0x9a>
+        MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_CR_INIT);
+ 800aa42:	6829      	ldr	r1, [r5, #0]
+ 800aa44:	f421 21a0 	bic.w	r1, r1, #327680	; 0x50000
+ 800aa48:	f021 01c4 	bic.w	r1, r1, #196	; 0xc4
+ 800aa4c:	4319      	orrs	r1, r3
+ 800aa4e:	f041 0104 	orr.w	r1, r1, #4
+ 800aa52:	6029      	str	r1, [r5, #0]
+        hhash->HashITCounter = 1;
+ 800aa54:	6246      	str	r6, [r0, #36]	; 0x24
+      hhash->Phase = HAL_HASH_PHASE_PROCESS;
+ 800aa56:	2302      	movs	r3, #2
+ 800aa58:	f880 302d 	strb.w	r3, [r0, #45]	; 0x2d
+      while((!(__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))) && (SizeVar > 0U))
+ 800aa5c:	6a6b      	ldr	r3, [r5, #36]	; 0x24
+ 800aa5e:	07d9      	lsls	r1, r3, #31
+ 800aa60:	d400      	bmi.n	800aa64 <HASH_Accumulate_IT+0x84>
+ 800aa62:	b96a      	cbnz	r2, 800aa80 <HASH_Accumulate_IT+0xa0>
+      if ((!(__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))) || (SizeVar == 0U))
+ 800aa64:	6a6b      	ldr	r3, [r5, #36]	; 0x24
+ 800aa66:	07db      	lsls	r3, r3, #31
+ 800aa68:	d500      	bpl.n	800aa6c <HASH_Accumulate_IT+0x8c>
+ 800aa6a:	b98a      	cbnz	r2, 800aa90 <HASH_Accumulate_IT+0xb0>
+        hhash->State = HAL_HASH_STATE_READY;
+ 800aa6c:	2301      	movs	r3, #1
+ 800aa6e:	f880 3035 	strb.w	r3, [r0, #53]	; 0x35
+        __HAL_UNLOCK(hhash);
+ 800aa72:	2300      	movs	r3, #0
+ 800aa74:	f880 3034 	strb.w	r3, [r0, #52]	; 0x34
+        return HAL_OK;
+ 800aa78:	e7c2      	b.n	800aa00 <HASH_Accumulate_IT+0x20>
+         hhash->HashITCounter = 3; /* 'cruise-speed' reached during a previous buffer processing */
+ 800aa7a:	2303      	movs	r3, #3
+ 800aa7c:	6243      	str	r3, [r0, #36]	; 0x24
+ 800aa7e:	e7ea      	b.n	800aa56 <HASH_Accumulate_IT+0x76>
+        HASH->DIN = *(uint32_t*)inputaddr;
+ 800aa80:	9b01      	ldr	r3, [sp, #4]
+ 800aa82:	681b      	ldr	r3, [r3, #0]
+ 800aa84:	606b      	str	r3, [r5, #4]
+        inputaddr+=4U;
+ 800aa86:	9b01      	ldr	r3, [sp, #4]
+ 800aa88:	3304      	adds	r3, #4
+ 800aa8a:	9301      	str	r3, [sp, #4]
+        SizeVar-=4U;
+ 800aa8c:	3a04      	subs	r2, #4
+ 800aa8e:	e7e5      	b.n	800aa5c <HASH_Accumulate_IT+0x7c>
+      hhash->HashInCount = SizeVar;               /* Counter used to keep track of number of data
+ 800aa90:	6202      	str	r2, [r0, #32]
+      hhash->pHashInBuffPtr = (uint8_t *)inputaddr;       /* Points at data which will be fed to the Peripheral at
+ 800aa92:	9b01      	ldr	r3, [sp, #4]
+ 800aa94:	60c3      	str	r3, [r0, #12]
+ 800aa96:	e7c6      	b.n	800aa26 <HASH_Accumulate_IT+0x46>
+    return  HAL_ERROR;
+ 800aa98:	2301      	movs	r3, #1
+ 800aa9a:	e7b1      	b.n	800aa00 <HASH_Accumulate_IT+0x20>
+    return HAL_BUSY;
+ 800aa9c:	2302      	movs	r3, #2
+ 800aa9e:	e7af      	b.n	800aa00 <HASH_Accumulate_IT+0x20>
+ 800aaa0:	50060400 	.word	0x50060400
+
+0800aaa4 <HAL_HASH_MD5_Accmlt_IT>:
+  return  HASH_Accumulate_IT(hhash, pInBuffer, Size,HASH_ALGOSELECTION_MD5);
+ 800aaa4:	2380      	movs	r3, #128	; 0x80
+ 800aaa6:	f7ff bf9b 	b.w	800a9e0 <HASH_Accumulate_IT>
+
+0800aaaa <HAL_HASH_SHA1_Accmlt_IT>:
+  return  HASH_Accumulate_IT(hhash, pInBuffer, Size,HASH_ALGOSELECTION_SHA1);
+ 800aaaa:	2300      	movs	r3, #0
+ 800aaac:	f7ff bf98 	b.w	800a9e0 <HASH_Accumulate_IT>
+
+0800aab0 <HASH_Start_IT>:
+  * @param  pOutBuffer pointer to the computed digest.
+  * @param  Algorithm HASH algorithm.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HASH_Start_IT(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size, uint8_t* pOutBuffer, uint32_t Algorithm)
+{
+ 800aab0:	b573      	push	{r0, r1, r4, r5, r6, lr}
+   HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800aab2:	f890 4035 	ldrb.w	r4, [r0, #53]	; 0x35
+  __IO uint32_t inputaddr = (uint32_t) pInBuffer;
+ 800aab6:	9101      	str	r1, [sp, #4]
+  uint32_t polling_step = 0U;
+  uint32_t initialization_skipped = 0U;
+  uint32_t SizeVar = Size;
+
+  /* If State is ready or suspended, start or resume IT-based HASH processing */
+if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800aab8:	2c01      	cmp	r4, #1
+   HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800aaba:	b2e5      	uxtb	r5, r4
+if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800aabc:	d001      	beq.n	800aac2 <HASH_Start_IT+0x12>
+ 800aabe:	2d08      	cmp	r5, #8
+ 800aac0:	d17f      	bne.n	800abc2 <HASH_Start_IT+0x112>
+  {
+    /* Check input parameters */
+    if ((pInBuffer == NULL) || (Size == 0U) || (pOutBuffer == NULL))
+ 800aac2:	b109      	cbz	r1, 800aac8 <HASH_Start_IT+0x18>
+ 800aac4:	b102      	cbz	r2, 800aac8 <HASH_Start_IT+0x18>
+ 800aac6:	b92b      	cbnz	r3, 800aad4 <HASH_Start_IT+0x24>
+    {
+      hhash->State = HAL_HASH_STATE_READY;
+ 800aac8:	2201      	movs	r2, #1
+ 800aaca:	f880 2035 	strb.w	r2, [r0, #53]	; 0x35
+  else
+  {
+    return HAL_BUSY;
+  }
+
+}
+ 800aace:	4610      	mov	r0, r2
+ 800aad0:	b002      	add	sp, #8
+ 800aad2:	bd70      	pop	{r4, r5, r6, pc}
+    __HAL_LOCK(hhash);
+ 800aad4:	f890 4034 	ldrb.w	r4, [r0, #52]	; 0x34
+ 800aad8:	2c01      	cmp	r4, #1
+ 800aada:	f04f 0402 	mov.w	r4, #2
+ 800aade:	d072      	beq.n	800abc6 <HASH_Start_IT+0x116>
+    hhash->State = HAL_HASH_STATE_BUSY;
+ 800aae0:	f880 4035 	strb.w	r4, [r0, #53]	; 0x35
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800aae4:	f890 402d 	ldrb.w	r4, [r0, #45]	; 0x2d
+    __HAL_LOCK(hhash);
+ 800aae8:	2601      	movs	r6, #1
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800aaea:	42b4      	cmp	r4, r6
+    __HAL_LOCK(hhash);
+ 800aaec:	f880 6034 	strb.w	r6, [r0, #52]	; 0x34
+    hhash->HashITCounter = 1;
+ 800aaf0:	4c36      	ldr	r4, [pc, #216]	; (800abcc <HASH_Start_IT+0x11c>)
+ 800aaf2:	6246      	str	r6, [r0, #36]	; 0x24
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800aaf4:	d115      	bne.n	800ab22 <HASH_Start_IT+0x72>
+      MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_CR_INIT);
+ 800aaf6:	6825      	ldr	r5, [r4, #0]
+ 800aaf8:	9e06      	ldr	r6, [sp, #24]
+ 800aafa:	f425 25a0 	bic.w	r5, r5, #327680	; 0x50000
+ 800aafe:	f025 05c4 	bic.w	r5, r5, #196	; 0xc4
+ 800ab02:	4335      	orrs	r5, r6
+ 800ab04:	f045 0504 	orr.w	r5, r5, #4
+ 800ab08:	6025      	str	r5, [r4, #0]
+     __HAL_HASH_SET_NBVALIDBITS(SizeVar);
+ 800ab0a:	68a6      	ldr	r6, [r4, #8]
+ 800ab0c:	f002 0503 	and.w	r5, r2, #3
+ 800ab10:	f026 061f 	bic.w	r6, r6, #31
+ 800ab14:	ea46 05c5 	orr.w	r5, r6, r5, lsl #3
+ 800ab18:	60a5      	str	r5, [r4, #8]
+      hhash->pHashOutBuffPtr = pOutBuffer;     /* Points at the computed digest */
+ 800ab1a:	e9c0 1303 	strd	r1, r3, [r0, #12]
+      hhash->HashInCount = SizeVar;            /* Counter used to keep track of number of data
+ 800ab1e:	6202      	str	r2, [r0, #32]
+  uint32_t initialization_skipped = 0U;
+ 800ab20:	2600      	movs	r6, #0
+    hhash->Phase = HAL_HASH_PHASE_PROCESS;
+ 800ab22:	2102      	movs	r1, #2
+ 800ab24:	f880 102d 	strb.w	r1, [r0, #45]	; 0x2d
+  uint32_t polling_step = 0U;
+ 800ab28:	2100      	movs	r1, #0
+    while((!(__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))) && (SizeVar > 3U))
+ 800ab2a:	6a65      	ldr	r5, [r4, #36]	; 0x24
+ 800ab2c:	07ed      	lsls	r5, r5, #31
+ 800ab2e:	d401      	bmi.n	800ab34 <HASH_Start_IT+0x84>
+ 800ab30:	2a03      	cmp	r2, #3
+ 800ab32:	d80d      	bhi.n	800ab50 <HASH_Start_IT+0xa0>
+    if (polling_step == 1U)
+ 800ab34:	b349      	cbz	r1, 800ab8a <HASH_Start_IT+0xda>
+      if (SizeVar == 0U)
+ 800ab36:	b9a2      	cbnz	r2, 800ab62 <HASH_Start_IT+0xb2>
+        hhash->pHashOutBuffPtr = pOutBuffer;     /* Points at the computed digest */
+ 800ab38:	6103      	str	r3, [r0, #16]
+         __HAL_HASH_START_DIGEST();
+ 800ab3a:	68a3      	ldr	r3, [r4, #8]
+ 800ab3c:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 800ab40:	60a3      	str	r3, [r4, #8]
+        __HAL_UNLOCK(hhash);
+ 800ab42:	f880 2034 	strb.w	r2, [r0, #52]	; 0x34
+        __HAL_HASH_ENABLE_IT(HASH_IT_DCI);
+ 800ab46:	6a23      	ldr	r3, [r4, #32]
+ 800ab48:	f043 0302 	orr.w	r3, r3, #2
+    __HAL_HASH_ENABLE_IT(HASH_IT_DINI|HASH_IT_DCI);
+ 800ab4c:	6223      	str	r3, [r4, #32]
+    return HAL_OK;
+ 800ab4e:	e7be      	b.n	800aace <HASH_Start_IT+0x1e>
+      HASH->DIN = *(uint32_t*)inputaddr;
+ 800ab50:	9901      	ldr	r1, [sp, #4]
+ 800ab52:	6809      	ldr	r1, [r1, #0]
+ 800ab54:	6061      	str	r1, [r4, #4]
+      inputaddr+=4U;
+ 800ab56:	9901      	ldr	r1, [sp, #4]
+ 800ab58:	3104      	adds	r1, #4
+ 800ab5a:	9101      	str	r1, [sp, #4]
+      SizeVar-=4U;
+ 800ab5c:	3a04      	subs	r2, #4
+      polling_step = 1U; /* note that some words are entered before enabling the interrupt */
+ 800ab5e:	2101      	movs	r1, #1
+ 800ab60:	e7e3      	b.n	800ab2a <HASH_Start_IT+0x7a>
+      else if (__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))
+ 800ab62:	6a61      	ldr	r1, [r4, #36]	; 0x24
+        __HAL_HASH_SET_NBVALIDBITS(SizeVar);  /* Update the configuration of the number of valid bits in last word of the message */
+ 800ab64:	f002 0503 	and.w	r5, r2, #3
+      else if (__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))
+ 800ab68:	f011 0101 	ands.w	r1, r1, #1
+        __HAL_HASH_SET_NBVALIDBITS(SizeVar);  /* Update the configuration of the number of valid bits in last word of the message */
+ 800ab6c:	ea4f 05c5 	mov.w	r5, r5, lsl #3
+      else if (__HAL_HASH_GET_FLAG(HASH_FLAG_DINIS))
+ 800ab70:	d012      	beq.n	800ab98 <HASH_Start_IT+0xe8>
+        hhash->HashInCount = SizeVar;
+ 800ab72:	6202      	str	r2, [r0, #32]
+        hhash->pHashInBuffPtr = (uint8_t *)inputaddr;
+ 800ab74:	9a01      	ldr	r2, [sp, #4]
+ 800ab76:	60c2      	str	r2, [r0, #12]
+        __HAL_HASH_SET_NBVALIDBITS(SizeVar);  /* Update the configuration of the number of valid bits in last word of the message */
+ 800ab78:	68a2      	ldr	r2, [r4, #8]
+ 800ab7a:	f022 021f 	bic.w	r2, r2, #31
+ 800ab7e:	432a      	orrs	r2, r5
+ 800ab80:	60a2      	str	r2, [r4, #8]
+        hhash->pHashOutBuffPtr = pOutBuffer;  /* Points at the computed digest */
+ 800ab82:	6103      	str	r3, [r0, #16]
+        if (initialization_skipped == 1U)
+ 800ab84:	b10e      	cbz	r6, 800ab8a <HASH_Start_IT+0xda>
+          hhash->HashITCounter = 3; /* 'cruise-speed' reached during a previous buffer processing */
+ 800ab86:	2303      	movs	r3, #3
+ 800ab88:	6243      	str	r3, [r0, #36]	; 0x24
+    __HAL_UNLOCK(hhash);
+ 800ab8a:	2200      	movs	r2, #0
+ 800ab8c:	f880 2034 	strb.w	r2, [r0, #52]	; 0x34
+    __HAL_HASH_ENABLE_IT(HASH_IT_DINI|HASH_IT_DCI);
+ 800ab90:	6a23      	ldr	r3, [r4, #32]
+ 800ab92:	f043 0303 	orr.w	r3, r3, #3
+ 800ab96:	e7d9      	b.n	800ab4c <HASH_Start_IT+0x9c>
+        __HAL_HASH_SET_NBVALIDBITS(SizeVar);
+ 800ab98:	68a2      	ldr	r2, [r4, #8]
+ 800ab9a:	f022 021f 	bic.w	r2, r2, #31
+ 800ab9e:	432a      	orrs	r2, r5
+ 800aba0:	60a2      	str	r2, [r4, #8]
+        HASH->DIN = *(uint32_t*)inputaddr;
+ 800aba2:	9a01      	ldr	r2, [sp, #4]
+ 800aba4:	6812      	ldr	r2, [r2, #0]
+ 800aba6:	6062      	str	r2, [r4, #4]
+        hhash->pHashOutBuffPtr = pOutBuffer;     /* Points at the computed digest */
+ 800aba8:	6103      	str	r3, [r0, #16]
+         __HAL_HASH_START_DIGEST();
+ 800abaa:	68a3      	ldr	r3, [r4, #8]
+ 800abac:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 800abb0:	60a3      	str	r3, [r4, #8]
+        __HAL_UNLOCK(hhash);
+ 800abb2:	f880 1034 	strb.w	r1, [r0, #52]	; 0x34
+        __HAL_HASH_ENABLE_IT(HASH_IT_DCI);
+ 800abb6:	6a23      	ldr	r3, [r4, #32]
+ 800abb8:	f043 0302 	orr.w	r3, r3, #2
+ 800abbc:	6223      	str	r3, [r4, #32]
+        return HAL_OK;
+ 800abbe:	460a      	mov	r2, r1
+ 800abc0:	e785      	b.n	800aace <HASH_Start_IT+0x1e>
+    return HAL_BUSY;
+ 800abc2:	2202      	movs	r2, #2
+ 800abc4:	e783      	b.n	800aace <HASH_Start_IT+0x1e>
+ 800abc6:	4622      	mov	r2, r4
+ 800abc8:	e781      	b.n	800aace <HASH_Start_IT+0x1e>
+ 800abca:	bf00      	nop
+ 800abcc:	50060400 	.word	0x50060400
+
+0800abd0 <HAL_HASH_MD5_Start_IT>:
+{
+ 800abd0:	b513      	push	{r0, r1, r4, lr}
+  return HASH_Start_IT(hhash, pInBuffer, Size, pOutBuffer,HASH_ALGOSELECTION_MD5);
+ 800abd2:	2480      	movs	r4, #128	; 0x80
+ 800abd4:	9400      	str	r4, [sp, #0]
+ 800abd6:	f7ff ff6b 	bl	800aab0 <HASH_Start_IT>
+}
+ 800abda:	b002      	add	sp, #8
+ 800abdc:	bd10      	pop	{r4, pc}
+
+0800abde <HAL_HASH_MD5_Accmlt_End_IT>:
+ 800abde:	f7ff bff7 	b.w	800abd0 <HAL_HASH_MD5_Start_IT>
+
+0800abe2 <HAL_HASH_SHA1_Start_IT>:
+{
+ 800abe2:	b513      	push	{r0, r1, r4, lr}
+  return HASH_Start_IT(hhash, pInBuffer, Size, pOutBuffer,HASH_ALGOSELECTION_SHA1);
+ 800abe4:	2400      	movs	r4, #0
+ 800abe6:	9400      	str	r4, [sp, #0]
+ 800abe8:	f7ff ff62 	bl	800aab0 <HASH_Start_IT>
+}
+ 800abec:	b002      	add	sp, #8
+ 800abee:	bd10      	pop	{r4, pc}
+
+0800abf0 <HAL_HASH_SHA1_Accmlt_End_IT>:
+ 800abf0:	f7ff bff7 	b.w	800abe2 <HAL_HASH_SHA1_Start_IT>
+
+0800abf4 <HASH_Finish>:
+  * @param  pOutBuffer pointer to the computed digest.
+  * @param  Timeout Timeout value.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HASH_Finish(HASH_HandleTypeDef *hhash, uint8_t* pOutBuffer, uint32_t Timeout)
+{
+ 800abf4:	b570      	push	{r4, r5, r6, lr}
+ 800abf6:	4613      	mov	r3, r2
+
+  if(hhash->State == HAL_HASH_STATE_READY)
+ 800abf8:	f890 2035 	ldrb.w	r2, [r0, #53]	; 0x35
+ 800abfc:	2a01      	cmp	r2, #1
+{
+ 800abfe:	4605      	mov	r5, r0
+ 800ac00:	460e      	mov	r6, r1
+  if(hhash->State == HAL_HASH_STATE_READY)
+ 800ac02:	b2d4      	uxtb	r4, r2
+ 800ac04:	d12f      	bne.n	800ac66 <HASH_Finish+0x72>
+  {
+    /* Check parameter */
+    if (pOutBuffer == NULL)
+ 800ac06:	b341      	cbz	r1, 800ac5a <HASH_Finish+0x66>
+    {
+      return  HAL_ERROR;
+    }
+
+    /* Process Locked */
+    __HAL_LOCK(hhash);
+ 800ac08:	f890 2034 	ldrb.w	r2, [r0, #52]	; 0x34
+ 800ac0c:	2a01      	cmp	r2, #1
+ 800ac0e:	f04f 0102 	mov.w	r1, #2
+ 800ac12:	d028      	beq.n	800ac66 <HASH_Finish+0x72>
+ 800ac14:	f880 4034 	strb.w	r4, [r0, #52]	; 0x34
+
+    /* Change the HASH state to busy */
+    hhash->State = HAL_HASH_STATE_BUSY;
+ 800ac18:	f880 1035 	strb.w	r1, [r0, #53]	; 0x35
+
+    /* Wait for DCIS flag to be set */
+    if (HASH_WaitOnFlagUntilTimeout(hhash, HASH_FLAG_DCIS, RESET, Timeout) != HAL_OK)
+ 800ac1c:	2200      	movs	r2, #0
+ 800ac1e:	f7ff fc3b 	bl	800a498 <HASH_WaitOnFlagUntilTimeout>
+ 800ac22:	4604      	mov	r4, r0
+ 800ac24:	bb08      	cbnz	r0, 800ac6a <HASH_Finish+0x76>
+    {
+      return HAL_TIMEOUT;
+    }
+
+    /* Read the message digest */
+    HASH_GetDigest(pOutBuffer, HASH_DIGEST_LENGTH());
+ 800ac26:	4a12      	ldr	r2, [pc, #72]	; (800ac70 <HASH_Finish+0x7c>)
+ 800ac28:	4b12      	ldr	r3, [pc, #72]	; (800ac74 <HASH_Finish+0x80>)
+ 800ac2a:	6811      	ldr	r1, [r2, #0]
+ 800ac2c:	4219      	tst	r1, r3
+ 800ac2e:	d016      	beq.n	800ac5e <HASH_Finish+0x6a>
+ 800ac30:	6811      	ldr	r1, [r2, #0]
+ 800ac32:	4019      	ands	r1, r3
+ 800ac34:	f5b1 2f80 	cmp.w	r1, #262144	; 0x40000
+ 800ac38:	d013      	beq.n	800ac62 <HASH_Finish+0x6e>
+ 800ac3a:	6812      	ldr	r2, [r2, #0]
+ 800ac3c:	4393      	bics	r3, r2
+ 800ac3e:	bf0c      	ite	eq
+ 800ac40:	2120      	moveq	r1, #32
+ 800ac42:	2110      	movne	r1, #16
+ 800ac44:	4630      	mov	r0, r6
+ 800ac46:	f7ff fbc5 	bl	800a3d4 <HASH_GetDigest>
+
+    /* Change the HASH state to ready */
+    hhash->State = HAL_HASH_STATE_READY;
+ 800ac4a:	2301      	movs	r3, #1
+ 800ac4c:	f885 3035 	strb.w	r3, [r5, #53]	; 0x35
+
+    /* Reset HASH state machine */
+    hhash->Phase = HAL_HASH_PHASE_READY;
+ 800ac50:	f885 302d 	strb.w	r3, [r5, #45]	; 0x2d
+
+    /* Process UnLock */
+    __HAL_UNLOCK(hhash);
+ 800ac54:	2300      	movs	r3, #0
+ 800ac56:	f885 3034 	strb.w	r3, [r5, #52]	; 0x34
+  else
+  {
+    return HAL_BUSY;
+  }
+
+}
+ 800ac5a:	4620      	mov	r0, r4
+ 800ac5c:	bd70      	pop	{r4, r5, r6, pc}
+    HASH_GetDigest(pOutBuffer, HASH_DIGEST_LENGTH());
+ 800ac5e:	2114      	movs	r1, #20
+ 800ac60:	e7f0      	b.n	800ac44 <HASH_Finish+0x50>
+ 800ac62:	211c      	movs	r1, #28
+ 800ac64:	e7ee      	b.n	800ac44 <HASH_Finish+0x50>
+    return HAL_BUSY;
+ 800ac66:	2402      	movs	r4, #2
+ 800ac68:	e7f7      	b.n	800ac5a <HASH_Finish+0x66>
+      return HAL_TIMEOUT;
+ 800ac6a:	2403      	movs	r4, #3
+ 800ac6c:	e7f5      	b.n	800ac5a <HASH_Finish+0x66>
+ 800ac6e:	bf00      	nop
+ 800ac70:	50060400 	.word	0x50060400
+ 800ac74:	00040080 	.word	0x00040080
+
+0800ac78 <HMAC_Start>:
+  * @param  Timeout Timeout value.
+  * @param  Algorithm HASH algorithm.
+  * @retval HAL status
+  */
+HAL_StatusTypeDef HMAC_Start(HASH_HandleTypeDef *hhash, uint8_t *pInBuffer, uint32_t Size, uint8_t* pOutBuffer, uint32_t Timeout, uint32_t Algorithm)
+{
+ 800ac78:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 800ac7c:	4604      	mov	r4, r0
+    HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800ac7e:	f890 0035 	ldrb.w	r0, [r0, #53]	; 0x35
+
+   /* If State is ready or suspended, start or resume polling-based HASH processing */
+if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800ac82:	2801      	cmp	r0, #1
+{
+ 800ac84:	e9dd 7e06 	ldrd	r7, lr, [sp, #24]
+    HAL_HASH_StateTypeDef State_tmp = hhash->State;
+ 800ac88:	b2c5      	uxtb	r5, r0
+if((State_tmp == HAL_HASH_STATE_READY) || (State_tmp == HAL_HASH_STATE_SUSPENDED))
+ 800ac8a:	d002      	beq.n	800ac92 <HMAC_Start+0x1a>
+ 800ac8c:	2d08      	cmp	r5, #8
+ 800ac8e:	f040 80df 	bne.w	800ae50 <HMAC_Start+0x1d8>
+  {
+    /* Check input parameters */
+    if ((pInBuffer == NULL) || /*(Size == 0U) ||*/ (hhash->Init.pKey == NULL) || (hhash->Init.KeySize == 0U) || (pOutBuffer == NULL))
+ 800ac92:	b139      	cbz	r1, 800aca4 <HMAC_Start+0x2c>
+ 800ac94:	f8d4 c008 	ldr.w	ip, [r4, #8]
+ 800ac98:	f1bc 0f00 	cmp.w	ip, #0
+ 800ac9c:	d002      	beq.n	800aca4 <HMAC_Start+0x2c>
+ 800ac9e:	6865      	ldr	r5, [r4, #4]
+ 800aca0:	b105      	cbz	r5, 800aca4 <HMAC_Start+0x2c>
+ 800aca2:	b923      	cbnz	r3, 800acae <HMAC_Start+0x36>
+    {
+      hhash->State = HAL_HASH_STATE_READY;
+ 800aca4:	2001      	movs	r0, #1
+ 800aca6:	f884 0035 	strb.w	r0, [r4, #53]	; 0x35
+    return HMAC_Processing(hhash, Timeout);
+
+  }
+  else
+  {
+    return HAL_BUSY;
+ 800acaa:	4605      	mov	r5, r0
+ 800acac:	e05b      	b.n	800ad66 <HMAC_Start+0xee>
+    __HAL_LOCK(hhash);
+ 800acae:	f894 0034 	ldrb.w	r0, [r4, #52]	; 0x34
+ 800acb2:	2801      	cmp	r0, #1
+ 800acb4:	f04f 0002 	mov.w	r0, #2
+ 800acb8:	d0f7      	beq.n	800acaa <HMAC_Start+0x32>
+    hhash->State = HAL_HASH_STATE_BUSY;
+ 800acba:	f884 0035 	strb.w	r0, [r4, #53]	; 0x35
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800acbe:	f894 002d 	ldrb.w	r0, [r4, #45]	; 0x2d
+    __HAL_LOCK(hhash);
+ 800acc2:	2601      	movs	r6, #1
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800acc4:	42b0      	cmp	r0, r6
+    __HAL_LOCK(hhash);
+ 800acc6:	f884 6034 	strb.w	r6, [r4, #52]	; 0x34
+    if(hhash->Phase == HAL_HASH_PHASE_READY)
+ 800acca:	d118      	bne.n	800acfe <HMAC_Start+0x86>
+      if(hhash->Init.KeySize > 64U)
+ 800accc:	4e61      	ldr	r6, [pc, #388]	; (800ae54 <HMAC_Start+0x1dc>)
+ 800acce:	f8df 818c 	ldr.w	r8, [pc, #396]	; 800ae5c <HMAC_Start+0x1e4>
+        MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_ALGOMODE_HMAC | HASH_HMAC_KEYTYPE_LONGKEY | HASH_CR_INIT);
+ 800acd2:	6830      	ldr	r0, [r6, #0]
+ 800acd4:	ea00 0008 	and.w	r0, r0, r8
+ 800acd8:	ea40 000e 	orr.w	r0, r0, lr
+      if(hhash->Init.KeySize > 64U)
+ 800acdc:	2d40      	cmp	r5, #64	; 0x40
+        MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_ALGOMODE_HMAC | HASH_HMAC_KEYTYPE_LONGKEY | HASH_CR_INIT);
+ 800acde:	bf88      	it	hi
+ 800ace0:	f440 3080 	orrhi.w	r0, r0, #65536	; 0x10000
+        MODIFY_REG(HASH->CR, HASH_CR_LKEY|HASH_CR_ALGO|HASH_CR_MODE|HASH_CR_INIT, Algorithm | HASH_ALGOMODE_HMAC | HASH_CR_INIT);
+ 800ace4:	f040 0044 	orr.w	r0, r0, #68	; 0x44
+ 800ace8:	6030      	str	r0, [r6, #0]
+      hhash->pHashInBuffPtr   = pInBuffer;             /* Input data address, HMAC_Processing input parameter for Step 2     */
+ 800acea:	e9c4 1303 	strd	r1, r3, [r4, #12]
+      hhash->Phase = HAL_HASH_PHASE_HMAC_STEP_1;
+ 800acee:	2003      	movs	r0, #3
+      hhash->HashInCount      = Size;                  /* Input data size, HMAC_Processing input parameter for Step 2        */
+ 800acf0:	6222      	str	r2, [r4, #32]
+      hhash->Phase = HAL_HASH_PHASE_HMAC_STEP_1;
+ 800acf2:	f884 002d 	strb.w	r0, [r4, #45]	; 0x2d
+      hhash->HashBuffSize     = Size;                  /* Store the input buffer size for the whole HMAC process             */
+ 800acf6:	61e2      	str	r2, [r4, #28]
+      hhash->pHashKeyBuffPtr  = hhash->Init.pKey;      /* Key address, HMAC_Processing input parameter for Step 1 and Step 3 */
+ 800acf8:	f8c4 c014 	str.w	ip, [r4, #20]
+      hhash->HashKeyCount     = hhash->Init.KeySize;   /* Key size, HMAC_Processing input parameter for Step 1 and Step 3    */
+ 800acfc:	62a5      	str	r5, [r4, #40]	; 0x28
+  if ((hhash->Phase != HAL_HASH_PHASE_HMAC_STEP_1) && (hhash->Phase != HAL_HASH_PHASE_HMAC_STEP_2) && (hhash->Phase != HAL_HASH_PHASE_HMAC_STEP_3))
+ 800acfe:	f894 302d 	ldrb.w	r3, [r4, #45]	; 0x2d
+ 800ad02:	1eda      	subs	r2, r3, #3
+ 800ad04:	2a02      	cmp	r2, #2
+ 800ad06:	d906      	bls.n	800ad16 <HMAC_Start+0x9e>
+    hhash->State = HAL_HASH_STATE_READY;
+ 800ad08:	2001      	movs	r0, #1
+    __HAL_UNLOCK(hhash);
+ 800ad0a:	2300      	movs	r3, #0
+    hhash->State = HAL_HASH_STATE_READY;
+ 800ad0c:	f884 0035 	strb.w	r0, [r4, #53]	; 0x35
+    __HAL_UNLOCK(hhash);
+ 800ad10:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+    return HAL_ERROR;
+ 800ad14:	e7c9      	b.n	800acaa <HMAC_Start+0x32>
+  if (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_1)
+ 800ad16:	2b03      	cmp	r3, #3
+ 800ad18:	4e4e      	ldr	r6, [pc, #312]	; (800ae54 <HMAC_Start+0x1dc>)
+ 800ad1a:	d155      	bne.n	800adc8 <HMAC_Start+0x150>
+    __HAL_HASH_SET_NBVALIDBITS(hhash->Init.KeySize);
+ 800ad1c:	68b3      	ldr	r3, [r6, #8]
+    hhash->Status = HASH_WriteData(hhash, hhash->pHashKeyBuffPtr, hhash->HashKeyCount);
+ 800ad1e:	6961      	ldr	r1, [r4, #20]
+    __HAL_HASH_SET_NBVALIDBITS(hhash->Init.KeySize);
+ 800ad20:	f023 031f 	bic.w	r3, r3, #31
+ 800ad24:	f005 0503 	and.w	r5, r5, #3
+ 800ad28:	ea43 05c5 	orr.w	r5, r3, r5, lsl #3
+ 800ad2c:	60b5      	str	r5, [r6, #8]
+    hhash->Status = HASH_WriteData(hhash, hhash->pHashKeyBuffPtr, hhash->HashKeyCount);
+ 800ad2e:	6aa2      	ldr	r2, [r4, #40]	; 0x28
+ 800ad30:	4620      	mov	r0, r4
+ 800ad32:	f7ff fb0f 	bl	800a354 <HASH_WriteData>
+ 800ad36:	4605      	mov	r5, r0
+ 800ad38:	f884 002c 	strb.w	r0, [r4, #44]	; 0x2c
+    if (hhash->Status != HAL_OK)
+ 800ad3c:	b998      	cbnz	r0, 800ad66 <HMAC_Start+0xee>
+    if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800ad3e:	f894 3035 	ldrb.w	r3, [r4, #53]	; 0x35
+ 800ad42:	2b08      	cmp	r3, #8
+ 800ad44:	d103      	bne.n	800ad4e <HMAC_Start+0xd6>
+      __HAL_UNLOCK(hhash);
+ 800ad46:	2000      	movs	r0, #0
+ 800ad48:	f884 0034 	strb.w	r0, [r4, #52]	; 0x34
+      return HAL_OK;
+ 800ad4c:	e7ad      	b.n	800acaa <HMAC_Start+0x32>
+    __HAL_HASH_START_DIGEST();
+ 800ad4e:	68b3      	ldr	r3, [r6, #8]
+ 800ad50:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 800ad54:	60b3      	str	r3, [r6, #8]
+    if (HASH_WaitOnFlagUntilTimeout(hhash, HASH_FLAG_BUSY, SET, Timeout) != HAL_OK)
+ 800ad56:	2201      	movs	r2, #1
+ 800ad58:	463b      	mov	r3, r7
+ 800ad5a:	2108      	movs	r1, #8
+ 800ad5c:	4620      	mov	r0, r4
+ 800ad5e:	f7ff fb9b 	bl	800a498 <HASH_WaitOnFlagUntilTimeout>
+ 800ad62:	b118      	cbz	r0, 800ad6c <HMAC_Start+0xf4>
+      return HAL_TIMEOUT;
+ 800ad64:	2503      	movs	r5, #3
+  }
+}
+ 800ad66:	4628      	mov	r0, r5
+ 800ad68:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+    hhash->Phase = HAL_HASH_PHASE_HMAC_STEP_2;
+ 800ad6c:	2304      	movs	r3, #4
+ 800ad6e:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+    __HAL_HASH_SET_NBVALIDBITS(hhash->HashBuffSize);
+ 800ad72:	68b3      	ldr	r3, [r6, #8]
+ 800ad74:	69e2      	ldr	r2, [r4, #28]
+    hhash->Status = HASH_WriteData(hhash, hhash->pHashInBuffPtr, hhash->HashInCount);
+ 800ad76:	68e1      	ldr	r1, [r4, #12]
+    __HAL_HASH_SET_NBVALIDBITS(hhash->HashBuffSize);
+ 800ad78:	f002 0203 	and.w	r2, r2, #3
+ 800ad7c:	f023 031f 	bic.w	r3, r3, #31
+ 800ad80:	ea43 03c2 	orr.w	r3, r3, r2, lsl #3
+ 800ad84:	60b3      	str	r3, [r6, #8]
+    hhash->Status = HASH_WriteData(hhash, hhash->pHashInBuffPtr, hhash->HashInCount);
+ 800ad86:	6a22      	ldr	r2, [r4, #32]
+ 800ad88:	4620      	mov	r0, r4
+ 800ad8a:	f7ff fae3 	bl	800a354 <HASH_WriteData>
+ 800ad8e:	4605      	mov	r5, r0
+ 800ad90:	f884 002c 	strb.w	r0, [r4, #44]	; 0x2c
+    if (hhash->Status != HAL_OK)
+ 800ad94:	2800      	cmp	r0, #0
+ 800ad96:	d1e6      	bne.n	800ad66 <HMAC_Start+0xee>
+    if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800ad98:	f894 3035 	ldrb.w	r3, [r4, #53]	; 0x35
+ 800ad9c:	2b08      	cmp	r3, #8
+ 800ad9e:	d0d2      	beq.n	800ad46 <HMAC_Start+0xce>
+    __HAL_HASH_START_DIGEST();
+ 800ada0:	68b3      	ldr	r3, [r6, #8]
+ 800ada2:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 800ada6:	60b3      	str	r3, [r6, #8]
+    if (HASH_WaitOnFlagUntilTimeout(hhash, HASH_FLAG_BUSY, SET, Timeout) != HAL_OK)
+ 800ada8:	2201      	movs	r2, #1
+ 800adaa:	463b      	mov	r3, r7
+ 800adac:	2108      	movs	r1, #8
+ 800adae:	4620      	mov	r0, r4
+ 800adb0:	f7ff fb72 	bl	800a498 <HASH_WaitOnFlagUntilTimeout>
+ 800adb4:	2800      	cmp	r0, #0
+ 800adb6:	d1d5      	bne.n	800ad64 <HMAC_Start+0xec>
+    hhash->Phase = HAL_HASH_PHASE_HMAC_STEP_3;
+ 800adb8:	2305      	movs	r3, #5
+ 800adba:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+    hhash->pHashKeyBuffPtr = hhash->Init.pKey;
+ 800adbe:	68a3      	ldr	r3, [r4, #8]
+ 800adc0:	6163      	str	r3, [r4, #20]
+    hhash->HashKeyCount    = hhash->Init.KeySize;
+ 800adc2:	6863      	ldr	r3, [r4, #4]
+ 800adc4:	62a3      	str	r3, [r4, #40]	; 0x28
+  if (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_3)
+ 800adc6:	e001      	b.n	800adcc <HMAC_Start+0x154>
+  if (hhash->Phase == HAL_HASH_PHASE_HMAC_STEP_2)
+ 800adc8:	2b04      	cmp	r3, #4
+ 800adca:	d0d2      	beq.n	800ad72 <HMAC_Start+0xfa>
+    __HAL_HASH_SET_NBVALIDBITS(hhash->Init.KeySize);
+ 800adcc:	68b3      	ldr	r3, [r6, #8]
+ 800adce:	6862      	ldr	r2, [r4, #4]
+    hhash->Status = HASH_WriteData(hhash, hhash->pHashKeyBuffPtr, hhash->HashKeyCount);
+ 800add0:	6961      	ldr	r1, [r4, #20]
+    __HAL_HASH_SET_NBVALIDBITS(hhash->Init.KeySize);
+ 800add2:	f002 0203 	and.w	r2, r2, #3
+ 800add6:	f023 031f 	bic.w	r3, r3, #31
+ 800adda:	ea43 03c2 	orr.w	r3, r3, r2, lsl #3
+ 800adde:	60b3      	str	r3, [r6, #8]
+    hhash->Status = HASH_WriteData(hhash, hhash->pHashKeyBuffPtr, hhash->HashKeyCount);
+ 800ade0:	6aa2      	ldr	r2, [r4, #40]	; 0x28
+ 800ade2:	4620      	mov	r0, r4
+ 800ade4:	f7ff fab6 	bl	800a354 <HASH_WriteData>
+ 800ade8:	4605      	mov	r5, r0
+ 800adea:	f884 002c 	strb.w	r0, [r4, #44]	; 0x2c
+    if (hhash->Status != HAL_OK)
+ 800adee:	2800      	cmp	r0, #0
+ 800adf0:	d1b9      	bne.n	800ad66 <HMAC_Start+0xee>
+    if (hhash->State == HAL_HASH_STATE_SUSPENDED)
+ 800adf2:	f894 3035 	ldrb.w	r3, [r4, #53]	; 0x35
+ 800adf6:	2b08      	cmp	r3, #8
+ 800adf8:	d0a5      	beq.n	800ad46 <HMAC_Start+0xce>
+    __HAL_HASH_START_DIGEST();
+ 800adfa:	68b3      	ldr	r3, [r6, #8]
+ 800adfc:	f443 7380 	orr.w	r3, r3, #256	; 0x100
+ 800ae00:	60b3      	str	r3, [r6, #8]
+     if (HASH_WaitOnFlagUntilTimeout(hhash, HASH_FLAG_DCIS, RESET, Timeout) != HAL_OK)
+ 800ae02:	4602      	mov	r2, r0
+ 800ae04:	463b      	mov	r3, r7
+ 800ae06:	2102      	movs	r1, #2
+ 800ae08:	4620      	mov	r0, r4
+ 800ae0a:	f7ff fb45 	bl	800a498 <HASH_WaitOnFlagUntilTimeout>
+ 800ae0e:	4605      	mov	r5, r0
+ 800ae10:	2800      	cmp	r0, #0
+ 800ae12:	d1a7      	bne.n	800ad64 <HMAC_Start+0xec>
+    HASH_GetDigest(hhash->pHashOutBuffPtr, HASH_DIGEST_LENGTH());
+ 800ae14:	6832      	ldr	r2, [r6, #0]
+ 800ae16:	4b10      	ldr	r3, [pc, #64]	; (800ae58 <HMAC_Start+0x1e0>)
+ 800ae18:	6920      	ldr	r0, [r4, #16]
+ 800ae1a:	421a      	tst	r2, r3
+ 800ae1c:	d014      	beq.n	800ae48 <HMAC_Start+0x1d0>
+ 800ae1e:	6832      	ldr	r2, [r6, #0]
+ 800ae20:	401a      	ands	r2, r3
+ 800ae22:	f5b2 2f80 	cmp.w	r2, #262144	; 0x40000
+ 800ae26:	d011      	beq.n	800ae4c <HMAC_Start+0x1d4>
+ 800ae28:	6832      	ldr	r2, [r6, #0]
+ 800ae2a:	4393      	bics	r3, r2
+ 800ae2c:	bf0c      	ite	eq
+ 800ae2e:	2120      	moveq	r1, #32
+ 800ae30:	2110      	movne	r1, #16
+ 800ae32:	f7ff facf 	bl	800a3d4 <HASH_GetDigest>
+    hhash->Phase = HAL_HASH_PHASE_READY;
+ 800ae36:	2301      	movs	r3, #1
+ 800ae38:	f884 302d 	strb.w	r3, [r4, #45]	; 0x2d
+   hhash->State = HAL_HASH_STATE_READY;
+ 800ae3c:	f884 3035 	strb.w	r3, [r4, #53]	; 0x35
+   __HAL_UNLOCK(hhash);
+ 800ae40:	2300      	movs	r3, #0
+ 800ae42:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+   return HAL_OK;
+ 800ae46:	e78e      	b.n	800ad66 <HMAC_Start+0xee>
+    HASH_GetDigest(hhash->pHashOutBuffPtr, HASH_DIGEST_LENGTH());
+ 800ae48:	2114      	movs	r1, #20
+ 800ae4a:	e7f2      	b.n	800ae32 <HMAC_Start+0x1ba>
+ 800ae4c:	211c      	movs	r1, #28
+ 800ae4e:	e7f0      	b.n	800ae32 <HMAC_Start+0x1ba>
+    return HAL_BUSY;
+ 800ae50:	2502      	movs	r5, #2
+ 800ae52:	e788      	b.n	800ad66 <HMAC_Start+0xee>
+ 800ae54:	50060400 	.word	0x50060400
+ 800ae58:	00040080 	.word	0x00040080
+ 800ae5c:	fffaff3b 	.word	0xfffaff3b
+
+0800ae60 <OSPI_WaitFlagStateUntilTimeout>:
+  * @param  Tickstart : Tick start value
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef OSPI_WaitFlagStateUntilTimeout(OSPI_HandleTypeDef *hospi, uint32_t Flag,
+                                                        FlagStatus State, uint32_t Tickstart, uint32_t Timeout)
+{
+ 800ae60:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 800ae64:	f8dd 8018 	ldr.w	r8, [sp, #24]
+ 800ae68:	4604      	mov	r4, r0
+ 800ae6a:	460e      	mov	r6, r1
+ 800ae6c:	4615      	mov	r5, r2
+ 800ae6e:	461f      	mov	r7, r3
+  /* Wait until flag is in expected state */
+  while((__HAL_OSPI_GET_FLAG(hospi, Flag)) != State)
+ 800ae70:	6822      	ldr	r2, [r4, #0]
+ 800ae72:	6a13      	ldr	r3, [r2, #32]
+ 800ae74:	4233      	tst	r3, r6
+ 800ae76:	bf14      	ite	ne
+ 800ae78:	2301      	movne	r3, #1
+ 800ae7a:	2300      	moveq	r3, #0
+ 800ae7c:	42ab      	cmp	r3, r5
+ 800ae7e:	d101      	bne.n	800ae84 <OSPI_WaitFlagStateUntilTimeout+0x24>
+
+        return HAL_ERROR;
+      }
+    }
+  }
+  return HAL_OK;
+ 800ae80:	2000      	movs	r0, #0
+ 800ae82:	e012      	b.n	800aeaa <OSPI_WaitFlagStateUntilTimeout+0x4a>
+    if (Timeout != HAL_MAX_DELAY)
+ 800ae84:	f1b8 3fff 	cmp.w	r8, #4294967295	; 0xffffffff
+ 800ae88:	d0f3      	beq.n	800ae72 <OSPI_WaitFlagStateUntilTimeout+0x12>
+      if(((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 800ae8a:	f7fc f961 	bl	8007150 <HAL_GetTick>
+ 800ae8e:	1bc0      	subs	r0, r0, r7
+ 800ae90:	4540      	cmp	r0, r8
+ 800ae92:	d802      	bhi.n	800ae9a <OSPI_WaitFlagStateUntilTimeout+0x3a>
+ 800ae94:	f1b8 0f00 	cmp.w	r8, #0
+ 800ae98:	d1ea      	bne.n	800ae70 <OSPI_WaitFlagStateUntilTimeout+0x10>
+        hospi->State     = HAL_OSPI_STATE_ERROR;
+ 800ae9a:	f44f 7300 	mov.w	r3, #512	; 0x200
+ 800ae9e:	6463      	str	r3, [r4, #68]	; 0x44
+        hospi->ErrorCode |= HAL_OSPI_ERROR_TIMEOUT;
+ 800aea0:	6ca3      	ldr	r3, [r4, #72]	; 0x48
+ 800aea2:	f043 0301 	orr.w	r3, r3, #1
+ 800aea6:	64a3      	str	r3, [r4, #72]	; 0x48
+ 800aea8:	2001      	movs	r0, #1
+}
+ 800aeaa:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+
+0800aeae <HAL_OSPI_MspInit>:
+}
+ 800aeae:	4770      	bx	lr
+
+0800aeb0 <HAL_OSPI_Init>:
+{
+ 800aeb0:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 800aeb2:	b085      	sub	sp, #20
+ 800aeb4:	4604      	mov	r4, r0
+  uint32_t tickstart = HAL_GetTick();
+ 800aeb6:	f7fc f94b 	bl	8007150 <HAL_GetTick>
+ 800aeba:	4603      	mov	r3, r0
+  if (hospi == NULL)
+ 800aebc:	2c00      	cmp	r4, #0
+ 800aebe:	d05d      	beq.n	800af7c <HAL_OSPI_Init+0xcc>
+    hospi->ErrorCode = HAL_OSPI_ERROR_NONE;
+ 800aec0:	2000      	movs	r0, #0
+ 800aec2:	64a0      	str	r0, [r4, #72]	; 0x48
+    if (hospi->State == HAL_OSPI_STATE_RESET)
+ 800aec4:	6c66      	ldr	r6, [r4, #68]	; 0x44
+ 800aec6:	2e00      	cmp	r6, #0
+ 800aec8:	d156      	bne.n	800af78 <HAL_OSPI_Init+0xc8>
+      HAL_OSPI_MspInit(hospi);
+ 800aeca:	4620      	mov	r0, r4
+ 800aecc:	9303      	str	r3, [sp, #12]
+ 800aece:	f7ff ffee 	bl	800aeae <HAL_OSPI_MspInit>
+      MODIFY_REG(hospi->Instance->DCR1,
+ 800aed2:	6b20      	ldr	r0, [r4, #48]	; 0x30
+ 800aed4:	68e1      	ldr	r1, [r4, #12]
+ 800aed6:	6825      	ldr	r5, [r4, #0]
+      status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_BUSY, RESET, tickstart, hospi->Timeout);
+ 800aed8:	9b03      	ldr	r3, [sp, #12]
+      MODIFY_REG(hospi->Instance->DCR1,
+ 800aeda:	68af      	ldr	r7, [r5, #8]
+ 800aedc:	4301      	orrs	r1, r0
+ 800aede:	69e0      	ldr	r0, [r4, #28]
+ 800aee0:	4301      	orrs	r1, r0
+ 800aee2:	4827      	ldr	r0, [pc, #156]	; (800af80 <HAL_OSPI_Init+0xd0>)
+ 800aee4:	4038      	ands	r0, r7
+ 800aee6:	4301      	orrs	r1, r0
+ 800aee8:	6920      	ldr	r0, [r4, #16]
+ 800aeea:	3801      	subs	r0, #1
+ 800aeec:	ea41 4100 	orr.w	r1, r1, r0, lsl #16
+ 800aef0:	6960      	ldr	r0, [r4, #20]
+ 800aef2:	3801      	subs	r0, #1
+  hospi->Timeout = Timeout;
+ 800aef4:	f241 3288 	movw	r2, #5000	; 0x1388
+      MODIFY_REG(hospi->Instance->DCR1,
+ 800aef8:	ea41 2100 	orr.w	r1, r1, r0, lsl #8
+  hospi->Timeout = Timeout;
+ 800aefc:	64e2      	str	r2, [r4, #76]	; 0x4c
+      MODIFY_REG(hospi->Instance->DCR1,
+ 800aefe:	60a9      	str	r1, [r5, #8]
+      hospi->Instance->DCR3 = (hospi->Init.ChipSelectBoundary << OCTOSPI_DCR3_CSBOUND_Pos);
+ 800af00:	6ae1      	ldr	r1, [r4, #44]	; 0x2c
+      MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FTHRES, ((hospi->Init.FifoThreshold - 1U) << OCTOSPI_CR_FTHRES_Pos));
+ 800af02:	6860      	ldr	r0, [r4, #4]
+      hospi->Instance->DCR3 = (hospi->Init.ChipSelectBoundary << OCTOSPI_DCR3_CSBOUND_Pos);
+ 800af04:	0409      	lsls	r1, r1, #16
+ 800af06:	6129      	str	r1, [r5, #16]
+      MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FTHRES, ((hospi->Init.FifoThreshold - 1U) << OCTOSPI_CR_FTHRES_Pos));
+ 800af08:	6829      	ldr	r1, [r5, #0]
+ 800af0a:	3801      	subs	r0, #1
+ 800af0c:	f421 51f8 	bic.w	r1, r1, #7936	; 0x1f00
+ 800af10:	ea41 2100 	orr.w	r1, r1, r0, lsl #8
+ 800af14:	6029      	str	r1, [r5, #0]
+      status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_BUSY, RESET, tickstart, hospi->Timeout);
+ 800af16:	4620      	mov	r0, r4
+ 800af18:	9200      	str	r2, [sp, #0]
+ 800af1a:	2120      	movs	r1, #32
+ 800af1c:	4632      	mov	r2, r6
+ 800af1e:	f7ff ff9f 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+      if (status == HAL_OK)
+ 800af22:	bb48      	cbnz	r0, 800af78 <HAL_OSPI_Init+0xc8>
+        MODIFY_REG(hospi->Instance->DCR2, OCTOSPI_DCR2_PRESCALER, ((hospi->Init.ClockPrescaler - 1U) << OCTOSPI_DCR2_PRESCALER_Pos));
+ 800af24:	6823      	ldr	r3, [r4, #0]
+ 800af26:	6a22      	ldr	r2, [r4, #32]
+ 800af28:	68d9      	ldr	r1, [r3, #12]
+ 800af2a:	3a01      	subs	r2, #1
+ 800af2c:	f021 01ff 	bic.w	r1, r1, #255	; 0xff
+ 800af30:	430a      	orrs	r2, r1
+ 800af32:	60da      	str	r2, [r3, #12]
+        MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_DQM, hospi->Init.DualQuad);
+ 800af34:	681a      	ldr	r2, [r3, #0]
+ 800af36:	68a1      	ldr	r1, [r4, #8]
+ 800af38:	f022 0240 	bic.w	r2, r2, #64	; 0x40
+ 800af3c:	430a      	orrs	r2, r1
+ 800af3e:	601a      	str	r2, [r3, #0]
+        MODIFY_REG(hospi->Instance->TCR, (OCTOSPI_TCR_SSHIFT | OCTOSPI_TCR_DHQC), (hospi->Init.SampleShifting | hospi->Init.DelayHoldQuarterCycle));
+ 800af40:	e9d4 2509 	ldrd	r2, r5, [r4, #36]	; 0x24
+ 800af44:	f8d3 1108 	ldr.w	r1, [r3, #264]	; 0x108
+ 800af48:	432a      	orrs	r2, r5
+ 800af4a:	f021 41a0 	bic.w	r1, r1, #1342177280	; 0x50000000
+ 800af4e:	430a      	orrs	r2, r1
+ 800af50:	f8c3 2108 	str.w	r2, [r3, #264]	; 0x108
+        __HAL_OSPI_ENABLE(hospi);
+ 800af54:	681a      	ldr	r2, [r3, #0]
+ 800af56:	f042 0201 	orr.w	r2, r2, #1
+ 800af5a:	601a      	str	r2, [r3, #0]
+        if (hospi->Init.FreeRunningClock == HAL_OSPI_FREERUNCLK_ENABLE)
+ 800af5c:	69a2      	ldr	r2, [r4, #24]
+ 800af5e:	2a02      	cmp	r2, #2
+          SET_BIT(hospi->Instance->DCR1, OCTOSPI_DCR1_FRCK);
+ 800af60:	bf02      	ittt	eq
+ 800af62:	689a      	ldreq	r2, [r3, #8]
+ 800af64:	f042 0202 	orreq.w	r2, r2, #2
+ 800af68:	609a      	streq	r2, [r3, #8]
+        if (hospi->Init.MemoryType == HAL_OSPI_MEMTYPE_HYPERBUS)
+ 800af6a:	68e3      	ldr	r3, [r4, #12]
+ 800af6c:	f1b3 6f80 	cmp.w	r3, #67108864	; 0x4000000
+          hospi->State = HAL_OSPI_STATE_HYPERBUS_INIT;
+ 800af70:	bf0c      	ite	eq
+ 800af72:	2301      	moveq	r3, #1
+          hospi->State = HAL_OSPI_STATE_READY;
+ 800af74:	2302      	movne	r3, #2
+ 800af76:	6463      	str	r3, [r4, #68]	; 0x44
+}
+ 800af78:	b005      	add	sp, #20
+ 800af7a:	bdf0      	pop	{r4, r5, r6, r7, pc}
+    status = HAL_ERROR;
+ 800af7c:	2001      	movs	r0, #1
+ 800af7e:	e7fb      	b.n	800af78 <HAL_OSPI_Init+0xc8>
+ 800af80:	f8e0f8f4 	.word	0xf8e0f8f4
+
+0800af84 <HAL_OSPI_Command>:
+{
+ 800af84:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 800af88:	4605      	mov	r5, r0
+ 800af8a:	b085      	sub	sp, #20
+ 800af8c:	460c      	mov	r4, r1
+ 800af8e:	9202      	str	r2, [sp, #8]
+  uint32_t tickstart = HAL_GetTick();
+ 800af90:	f7fc f8de 	bl	8007150 <HAL_GetTick>
+  state = hospi->State;
+ 800af94:	6c6a      	ldr	r2, [r5, #68]	; 0x44
+  if (((state == HAL_OSPI_STATE_READY)         && (hospi->Init.MemoryType != HAL_OSPI_MEMTYPE_HYPERBUS)) ||
+ 800af96:	2a02      	cmp	r2, #2
+  uint32_t tickstart = HAL_GetTick();
+ 800af98:	ee07 0a90 	vmov	s15, r0
+  if (((state == HAL_OSPI_STATE_READY)         && (hospi->Init.MemoryType != HAL_OSPI_MEMTYPE_HYPERBUS)) ||
+ 800af9c:	d105      	bne.n	800afaa <HAL_OSPI_Command+0x26>
+ 800af9e:	68ea      	ldr	r2, [r5, #12]
+ 800afa0:	f1b2 6f80 	cmp.w	r2, #67108864	; 0x4000000
+ 800afa4:	d107      	bne.n	800afb6 <HAL_OSPI_Command+0x32>
+    hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800afa6:	2310      	movs	r3, #16
+ 800afa8:	e109      	b.n	800b1be <HAL_OSPI_Command+0x23a>
+  if (((state == HAL_OSPI_STATE_READY)         && (hospi->Init.MemoryType != HAL_OSPI_MEMTYPE_HYPERBUS)) ||
+ 800afaa:	2a14      	cmp	r2, #20
+ 800afac:	f040 8084 	bne.w	800b0b8 <HAL_OSPI_Command+0x134>
+      ((state == HAL_OSPI_STATE_READ_CMD_CFG)  && (cmd->OperationType == HAL_OSPI_OPTYPE_WRITE_CFG))     ||
+ 800afb0:	6822      	ldr	r2, [r4, #0]
+ 800afb2:	2a02      	cmp	r2, #2
+      ((state == HAL_OSPI_STATE_WRITE_CMD_CFG) && (cmd->OperationType == HAL_OSPI_OPTYPE_READ_CFG)))
+ 800afb4:	d1f7      	bne.n	800afa6 <HAL_OSPI_Command+0x22>
+    status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_BUSY, RESET, tickstart, Timeout);
+ 800afb6:	9a02      	ldr	r2, [sp, #8]
+ 800afb8:	9200      	str	r2, [sp, #0]
+ 800afba:	ee17 3a90 	vmov	r3, s15
+ 800afbe:	2200      	movs	r2, #0
+ 800afc0:	2120      	movs	r1, #32
+ 800afc2:	4628      	mov	r0, r5
+ 800afc4:	edcd 7a03 	vstr	s15, [sp, #12]
+ 800afc8:	f7ff ff4a 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+    if (status == HAL_OK)
+ 800afcc:	eddd 7a03 	vldr	s15, [sp, #12]
+ 800afd0:	2800      	cmp	r0, #0
+ 800afd2:	f040 80b9 	bne.w	800b148 <HAL_OSPI_Command+0x1c4>
+{
+  HAL_StatusTypeDef status = HAL_OK;
+  __IO uint32_t *ccr_reg, *tcr_reg, *ir_reg, *abr_reg;
+
+  /* Re-initialize the value of the functional mode */
+  MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FMODE, 0U);
+ 800afd6:	6829      	ldr	r1, [r5, #0]
+      hospi->ErrorCode = HAL_OSPI_ERROR_NONE;
+ 800afd8:	64a8      	str	r0, [r5, #72]	; 0x48
+  MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FMODE, 0U);
+ 800afda:	680a      	ldr	r2, [r1, #0]
+ 800afdc:	f022 5240 	bic.w	r2, r2, #805306368	; 0x30000000
+ 800afe0:	600a      	str	r2, [r1, #0]
+
+  /* Configure the flash ID */
+  if (hospi->Init.DualQuad == HAL_OSPI_DUALQUAD_DISABLE)
+ 800afe2:	68aa      	ldr	r2, [r5, #8]
+ 800afe4:	b92a      	cbnz	r2, 800aff2 <HAL_OSPI_Command+0x6e>
+  {
+    MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FSEL, cmd->FlashId);
+ 800afe6:	680a      	ldr	r2, [r1, #0]
+ 800afe8:	6866      	ldr	r6, [r4, #4]
+ 800afea:	f022 0280 	bic.w	r2, r2, #128	; 0x80
+ 800afee:	4332      	orrs	r2, r6
+ 800aff0:	600a      	str	r2, [r1, #0]
+  }
+
+  if (cmd->OperationType == HAL_OSPI_OPTYPE_WRITE_CFG)
+ 800aff2:	6822      	ldr	r2, [r4, #0]
+    ir_reg  = &(hospi->Instance->IR);
+    abr_reg = &(hospi->Instance->ABR);
+  }
+
+  /* Configure the CCR register with DQS and SIOO modes */
+  *ccr_reg = (cmd->DQSMode | cmd->SIOOMode);
+ 800aff4:	e9d4 6712 	ldrd	r6, r7, [r4, #72]	; 0x48
+  if (cmd->OperationType == HAL_OSPI_OPTYPE_WRITE_CFG)
+ 800aff8:	2a02      	cmp	r2, #2
+    ccr_reg = &(hospi->Instance->WCCR);
+ 800affa:	bf0c      	ite	eq
+ 800affc:	f501 72c0 	addeq.w	r2, r1, #384	; 0x180
+    ccr_reg = &(hospi->Instance->CCR);
+ 800b000:	f501 7280 	addne.w	r2, r1, #256	; 0x100
+  *ccr_reg = (cmd->DQSMode | cmd->SIOOMode);
+ 800b004:	ea46 0607 	orr.w	r6, r6, r7
+ 800b008:	6016      	str	r6, [r2, #0]
+
+  if (cmd->AlternateBytesMode != HAL_OSPI_ALTERNATE_BYTES_NONE)
+ 800b00a:	6ae6      	ldr	r6, [r4, #44]	; 0x2c
+    tcr_reg = &(hospi->Instance->WTCR);
+ 800b00c:	bf03      	ittte	eq
+ 800b00e:	f501 7cc4 	addeq.w	ip, r1, #392	; 0x188
+    ir_reg  = &(hospi->Instance->WIR);
+ 800b012:	f501 7ec8 	addeq.w	lr, r1, #400	; 0x190
+    abr_reg = &(hospi->Instance->WABR);
+ 800b016:	f501 78d0 	addeq.w	r8, r1, #416	; 0x1a0
+    tcr_reg = &(hospi->Instance->TCR);
+ 800b01a:	f501 7c84 	addne.w	ip, r1, #264	; 0x108
+    ir_reg  = &(hospi->Instance->IR);
+ 800b01e:	bf1c      	itt	ne
+ 800b020:	f501 7e88 	addne.w	lr, r1, #272	; 0x110
+    abr_reg = &(hospi->Instance->ABR);
+ 800b024:	f501 7890 	addne.w	r8, r1, #288	; 0x120
+  if (cmd->AlternateBytesMode != HAL_OSPI_ALTERNATE_BYTES_NONE)
+ 800b028:	b16e      	cbz	r6, 800b046 <HAL_OSPI_Command+0xc2>
+  {
+    /* Configure the ABR register with alternate bytes value */
+    *abr_reg = cmd->AlternateBytes;
+ 800b02a:	6aa6      	ldr	r6, [r4, #40]	; 0x28
+ 800b02c:	f8c8 6000 	str.w	r6, [r8]
+
+    /* Configure the CCR register with alternate bytes communication parameters */
+    MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_ABMODE | OCTOSPI_CCR_ABDTR | OCTOSPI_CCR_ABSIZE),
+ 800b030:	6ae3      	ldr	r3, [r4, #44]	; 0x2c
+ 800b032:	6b67      	ldr	r7, [r4, #52]	; 0x34
+ 800b034:	6816      	ldr	r6, [r2, #0]
+ 800b036:	431f      	orrs	r7, r3
+ 800b038:	6b23      	ldr	r3, [r4, #48]	; 0x30
+ 800b03a:	f426 187c 	bic.w	r8, r6, #4128768	; 0x3f0000
+ 800b03e:	431f      	orrs	r7, r3
+ 800b040:	ea47 0708 	orr.w	r7, r7, r8
+ 800b044:	6017      	str	r7, [r2, #0]
+                           (cmd->AlternateBytesMode | cmd->AlternateBytesDtrMode | cmd->AlternateBytesSize));
+  }
+
+  /* Configure the TCR register with the number of dummy cycles */
+  MODIFY_REG((*tcr_reg), OCTOSPI_TCR_DCYC, cmd->DummyCycles);
+ 800b046:	f8dc 7000 	ldr.w	r7, [ip]
+ 800b04a:	6c66      	ldr	r6, [r4, #68]	; 0x44
+ 800b04c:	f027 071f 	bic.w	r7, r7, #31
+ 800b050:	433e      	orrs	r6, r7
+ 800b052:	f8cc 6000 	str.w	r6, [ip]
+
+  if (cmd->DataMode != HAL_OSPI_DATA_NONE)
+ 800b056:	f8d4 c038 	ldr.w	ip, [r4, #56]	; 0x38
+ 800b05a:	f1bc 0f00 	cmp.w	ip, #0
+ 800b05e:	d004      	beq.n	800b06a <HAL_OSPI_Command+0xe6>
+  {
+    if (cmd->OperationType == HAL_OSPI_OPTYPE_COMMON_CFG)
+ 800b060:	6827      	ldr	r7, [r4, #0]
+ 800b062:	b917      	cbnz	r7, 800b06a <HAL_OSPI_Command+0xe6>
+    {
+      /* Configure the DLR register with the number of data */
+      hospi->Instance->DLR = (cmd->NbData - 1U);
+ 800b064:	6be7      	ldr	r7, [r4, #60]	; 0x3c
+ 800b066:	3f01      	subs	r7, #1
+ 800b068:	640f      	str	r7, [r1, #64]	; 0x40
+    }
+  }
+
+  if (cmd->InstructionMode != HAL_OSPI_INSTRUCTION_NONE)
+ 800b06a:	68e6      	ldr	r6, [r4, #12]
+  {
+    if (cmd->AddressMode != HAL_OSPI_ADDRESS_NONE)
+ 800b06c:	69e7      	ldr	r7, [r4, #28]
+  if (cmd->InstructionMode != HAL_OSPI_INSTRUCTION_NONE)
+ 800b06e:	2e00      	cmp	r6, #0
+ 800b070:	f000 8082 	beq.w	800b178 <HAL_OSPI_Command+0x1f4>
+      if (cmd->DataMode != HAL_OSPI_DATA_NONE)
+      {
+        /* ---- Command with instruction, address and data ---- */
+
+        /* Configure the CCR register with all communication parameters */
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_IMODE  | OCTOSPI_CCR_IDTR  | OCTOSPI_CCR_ISIZE  |
+ 800b074:	e9d4 8904 	ldrd	r8, r9, [r4, #16]
+    if (cmd->AddressMode != HAL_OSPI_ADDRESS_NONE)
+ 800b078:	2f00      	cmp	r7, #0
+ 800b07a:	d040      	beq.n	800b0fe <HAL_OSPI_Command+0x17a>
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_IMODE  | OCTOSPI_CCR_IDTR  | OCTOSPI_CCR_ISIZE  |
+ 800b07c:	e9d4 ab08 	ldrd	sl, fp, [r4, #32]
+      if (cmd->DataMode != HAL_OSPI_DATA_NONE)
+ 800b080:	f1bc 0f00 	cmp.w	ip, #0
+ 800b084:	d01e      	beq.n	800b0c4 <HAL_OSPI_Command+0x140>
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_IMODE  | OCTOSPI_CCR_IDTR  | OCTOSPI_CCR_ISIZE  |
+ 800b086:	ea4c 0606 	orr.w	r6, ip, r6
+ 800b08a:	433e      	orrs	r6, r7
+ 800b08c:	ea46 0909 	orr.w	r9, r6, r9
+ 800b090:	ea49 0808 	orr.w	r8, r9, r8
+ 800b094:	6813      	ldr	r3, [r2, #0]
+ 800b096:	6c26      	ldr	r6, [r4, #64]	; 0x40
+ 800b098:	4f52      	ldr	r7, [pc, #328]	; (800b1e4 <HAL_OSPI_Command+0x260>)
+ 800b09a:	ea48 0b0b 	orr.w	fp, r8, fp
+ 800b09e:	ea4b 0b0a 	orr.w	fp, fp, sl
+ 800b0a2:	ea4b 0606 	orr.w	r6, fp, r6
+ 800b0a6:	401f      	ands	r7, r3
+ 800b0a8:	433e      	orrs	r6, r7
+
+        /* The DHQC bit is linked with DDTR bit which should be activated */
+        if ((hospi->Init.DelayHoldQuarterCycle == HAL_OSPI_DHQC_ENABLE) &&
+            (cmd->InstructionDtrMode == HAL_OSPI_INSTRUCTION_DTR_ENABLE))
+        {
+          MODIFY_REG((*ccr_reg), OCTOSPI_CCR_DDTR, HAL_OSPI_DATA_DTR_ENABLE);
+ 800b0aa:	6016      	str	r6, [r2, #0]
+        }
+      }
+
+      /* Configure the IR register with the instruction value */
+      *ir_reg = cmd->Instruction;
+ 800b0ac:	68a2      	ldr	r2, [r4, #8]
+ 800b0ae:	f8ce 2000 	str.w	r2, [lr]
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_ADMODE | OCTOSPI_CCR_ADDTR | OCTOSPI_CCR_ADSIZE),
+                               (cmd->AddressMode | cmd->AddressDtrMode | cmd->AddressSize));
+      }
+
+      /* Configure the AR register with the instruction value */
+      hospi->Instance->AR = cmd->Address;
+ 800b0b2:	69a2      	ldr	r2, [r4, #24]
+ 800b0b4:	648a      	str	r2, [r1, #72]	; 0x48
+      if (status == HAL_OK)
+ 800b0b6:	e038      	b.n	800b12a <HAL_OSPI_Command+0x1a6>
+      ((state == HAL_OSPI_STATE_READ_CMD_CFG)  && (cmd->OperationType == HAL_OSPI_OPTYPE_WRITE_CFG))     ||
+ 800b0b8:	2a24      	cmp	r2, #36	; 0x24
+ 800b0ba:	f47f af74 	bne.w	800afa6 <HAL_OSPI_Command+0x22>
+      ((state == HAL_OSPI_STATE_WRITE_CMD_CFG) && (cmd->OperationType == HAL_OSPI_OPTYPE_READ_CFG)))
+ 800b0be:	6822      	ldr	r2, [r4, #0]
+ 800b0c0:	2a01      	cmp	r2, #1
+ 800b0c2:	e777      	b.n	800afb4 <HAL_OSPI_Command+0x30>
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_IMODE  | OCTOSPI_CCR_IDTR  | OCTOSPI_CCR_ISIZE  |
+ 800b0c4:	433e      	orrs	r6, r7
+ 800b0c6:	f8d2 c000 	ldr.w	ip, [r2]
+ 800b0ca:	ea46 0609 	orr.w	r6, r6, r9
+ 800b0ce:	ea46 0608 	orr.w	r6, r6, r8
+ 800b0d2:	ea46 060b 	orr.w	r6, r6, fp
+ 800b0d6:	f42c 5c7c 	bic.w	ip, ip, #16128	; 0x3f00
+ 800b0da:	ea46 060a 	orr.w	r6, r6, sl
+ 800b0de:	f02c 0c3f 	bic.w	ip, ip, #63	; 0x3f
+ 800b0e2:	ea46 060c 	orr.w	r6, r6, ip
+ 800b0e6:	6016      	str	r6, [r2, #0]
+        if ((hospi->Init.DelayHoldQuarterCycle == HAL_OSPI_DHQC_ENABLE) &&
+ 800b0e8:	6aae      	ldr	r6, [r5, #40]	; 0x28
+ 800b0ea:	f1b6 5f80 	cmp.w	r6, #268435456	; 0x10000000
+ 800b0ee:	d1dd      	bne.n	800b0ac <HAL_OSPI_Command+0x128>
+ 800b0f0:	6966      	ldr	r6, [r4, #20]
+ 800b0f2:	2e08      	cmp	r6, #8
+ 800b0f4:	d1da      	bne.n	800b0ac <HAL_OSPI_Command+0x128>
+          MODIFY_REG((*ccr_reg), OCTOSPI_CCR_DDTR, HAL_OSPI_DATA_DTR_ENABLE);
+ 800b0f6:	6816      	ldr	r6, [r2, #0]
+ 800b0f8:	f046 6600 	orr.w	r6, r6, #134217728	; 0x8000000
+ 800b0fc:	e7d5      	b.n	800b0aa <HAL_OSPI_Command+0x126>
+      if (cmd->DataMode != HAL_OSPI_DATA_NONE)
+ 800b0fe:	f1bc 0f00 	cmp.w	ip, #0
+ 800b102:	d024      	beq.n	800b14e <HAL_OSPI_Command+0x1ca>
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_IMODE | OCTOSPI_CCR_IDTR | OCTOSPI_CCR_ISIZE |
+ 800b104:	ea4c 0106 	orr.w	r1, ip, r6
+ 800b108:	6817      	ldr	r7, [r2, #0]
+ 800b10a:	6c26      	ldr	r6, [r4, #64]	; 0x40
+ 800b10c:	ea41 0109 	orr.w	r1, r1, r9
+ 800b110:	ea41 0108 	orr.w	r1, r1, r8
+ 800b114:	f027 6a70 	bic.w	sl, r7, #251658240	; 0xf000000
+ 800b118:	4331      	orrs	r1, r6
+ 800b11a:	f02a 0a3f 	bic.w	sl, sl, #63	; 0x3f
+ 800b11e:	ea41 010a 	orr.w	r1, r1, sl
+          MODIFY_REG((*ccr_reg), OCTOSPI_CCR_DDTR, HAL_OSPI_DATA_DTR_ENABLE);
+ 800b122:	6011      	str	r1, [r2, #0]
+      *ir_reg = cmd->Instruction;
+ 800b124:	68a2      	ldr	r2, [r4, #8]
+ 800b126:	f8ce 2000 	str.w	r2, [lr]
+        if (cmd->DataMode == HAL_OSPI_DATA_NONE)
+ 800b12a:	6ba2      	ldr	r2, [r4, #56]	; 0x38
+ 800b12c:	2a00      	cmp	r2, #0
+ 800b12e:	d149      	bne.n	800b1c4 <HAL_OSPI_Command+0x240>
+          status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_TC, SET, tickstart, Timeout);
+ 800b130:	9b02      	ldr	r3, [sp, #8]
+ 800b132:	9300      	str	r3, [sp, #0]
+ 800b134:	2201      	movs	r2, #1
+ 800b136:	ee17 3a90 	vmov	r3, s15
+ 800b13a:	2102      	movs	r1, #2
+ 800b13c:	4628      	mov	r0, r5
+ 800b13e:	f7ff fe8f 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+          __HAL_OSPI_CLEAR_FLAG(hospi, HAL_OSPI_FLAG_TC);
+ 800b142:	682b      	ldr	r3, [r5, #0]
+ 800b144:	2202      	movs	r2, #2
+ 800b146:	625a      	str	r2, [r3, #36]	; 0x24
+}
+ 800b148:	b005      	add	sp, #20
+ 800b14a:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_IMODE | OCTOSPI_CCR_IDTR | OCTOSPI_CCR_ISIZE),
+ 800b14e:	6811      	ldr	r1, [r2, #0]
+ 800b150:	ea46 0609 	orr.w	r6, r6, r9
+ 800b154:	ea46 0808 	orr.w	r8, r6, r8
+ 800b158:	f021 063f 	bic.w	r6, r1, #63	; 0x3f
+ 800b15c:	ea48 0606 	orr.w	r6, r8, r6
+ 800b160:	6016      	str	r6, [r2, #0]
+        if ((hospi->Init.DelayHoldQuarterCycle == HAL_OSPI_DHQC_ENABLE) &&
+ 800b162:	6aa9      	ldr	r1, [r5, #40]	; 0x28
+ 800b164:	f1b1 5f80 	cmp.w	r1, #268435456	; 0x10000000
+ 800b168:	d1dc      	bne.n	800b124 <HAL_OSPI_Command+0x1a0>
+ 800b16a:	6961      	ldr	r1, [r4, #20]
+ 800b16c:	2908      	cmp	r1, #8
+ 800b16e:	d1d9      	bne.n	800b124 <HAL_OSPI_Command+0x1a0>
+          MODIFY_REG((*ccr_reg), OCTOSPI_CCR_DDTR, HAL_OSPI_DATA_DTR_ENABLE);
+ 800b170:	6811      	ldr	r1, [r2, #0]
+ 800b172:	f041 6100 	orr.w	r1, r1, #134217728	; 0x8000000
+ 800b176:	e7d4      	b.n	800b122 <HAL_OSPI_Command+0x19e>
+    if (cmd->AddressMode != HAL_OSPI_ADDRESS_NONE)
+ 800b178:	b307      	cbz	r7, 800b1bc <HAL_OSPI_Command+0x238>
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_IMODE  | OCTOSPI_CCR_IDTR  | OCTOSPI_CCR_ISIZE  |
+ 800b17a:	e9d4 9808 	ldrd	r9, r8, [r4, #32]
+      if (cmd->DataMode != HAL_OSPI_DATA_NONE)
+ 800b17e:	f1bc 0f00 	cmp.w	ip, #0
+ 800b182:	d011      	beq.n	800b1a8 <HAL_OSPI_Command+0x224>
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_ADMODE | OCTOSPI_CCR_ADDTR | OCTOSPI_CCR_ADSIZE |
+ 800b184:	f8d2 e000 	ldr.w	lr, [r2]
+ 800b188:	6c23      	ldr	r3, [r4, #64]	; 0x40
+ 800b18a:	ea4c 0607 	orr.w	r6, ip, r7
+ 800b18e:	ea46 0608 	orr.w	r6, r6, r8
+ 800b192:	ea46 0609 	orr.w	r6, r6, r9
+ 800b196:	f02e 6e70 	bic.w	lr, lr, #251658240	; 0xf000000
+ 800b19a:	431e      	orrs	r6, r3
+ 800b19c:	f42e 5e7c 	bic.w	lr, lr, #16128	; 0x3f00
+ 800b1a0:	ea46 060e 	orr.w	r6, r6, lr
+        MODIFY_REG((*ccr_reg), (OCTOSPI_CCR_ADMODE | OCTOSPI_CCR_ADDTR | OCTOSPI_CCR_ADSIZE),
+ 800b1a4:	6016      	str	r6, [r2, #0]
+ 800b1a6:	e784      	b.n	800b0b2 <HAL_OSPI_Command+0x12e>
+ 800b1a8:	f8d2 c000 	ldr.w	ip, [r2]
+ 800b1ac:	ea48 0607 	orr.w	r6, r8, r7
+ 800b1b0:	ea46 0609 	orr.w	r6, r6, r9
+ 800b1b4:	f42c 577c 	bic.w	r7, ip, #16128	; 0x3f00
+ 800b1b8:	433e      	orrs	r6, r7
+ 800b1ba:	e7f3      	b.n	800b1a4 <HAL_OSPI_Command+0x220>
+    }
+    else
+    {
+      /* ---- Invalid command configuration (no instruction, no address) ---- */
+      status = HAL_ERROR;
+      hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_PARAM;
+ 800b1bc:	2308      	movs	r3, #8
+    hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800b1be:	64ab      	str	r3, [r5, #72]	; 0x48
+    status = HAL_ERROR;
+ 800b1c0:	2001      	movs	r0, #1
+ 800b1c2:	e7c1      	b.n	800b148 <HAL_OSPI_Command+0x1c4>
+          if (cmd->OperationType == HAL_OSPI_OPTYPE_COMMON_CFG)
+ 800b1c4:	6823      	ldr	r3, [r4, #0]
+ 800b1c6:	b90b      	cbnz	r3, 800b1cc <HAL_OSPI_Command+0x248>
+              hospi->State = HAL_OSPI_STATE_CMD_CFG;
+ 800b1c8:	2304      	movs	r3, #4
+ 800b1ca:	e005      	b.n	800b1d8 <HAL_OSPI_Command+0x254>
+          else if (cmd->OperationType == HAL_OSPI_OPTYPE_READ_CFG)
+ 800b1cc:	2b01      	cmp	r3, #1
+            if (hospi->State == HAL_OSPI_STATE_WRITE_CMD_CFG)
+ 800b1ce:	6c6b      	ldr	r3, [r5, #68]	; 0x44
+          else if (cmd->OperationType == HAL_OSPI_OPTYPE_READ_CFG)
+ 800b1d0:	d104      	bne.n	800b1dc <HAL_OSPI_Command+0x258>
+            if (hospi->State == HAL_OSPI_STATE_WRITE_CMD_CFG)
+ 800b1d2:	2b24      	cmp	r3, #36	; 0x24
+ 800b1d4:	d0f8      	beq.n	800b1c8 <HAL_OSPI_Command+0x244>
+              hospi->State = HAL_OSPI_STATE_READ_CMD_CFG;
+ 800b1d6:	2314      	movs	r3, #20
+              hospi->State = HAL_OSPI_STATE_WRITE_CMD_CFG;
+ 800b1d8:	646b      	str	r3, [r5, #68]	; 0x44
+ 800b1da:	e7b5      	b.n	800b148 <HAL_OSPI_Command+0x1c4>
+            if (hospi->State == HAL_OSPI_STATE_READ_CMD_CFG)
+ 800b1dc:	2b14      	cmp	r3, #20
+ 800b1de:	d0f3      	beq.n	800b1c8 <HAL_OSPI_Command+0x244>
+              hospi->State = HAL_OSPI_STATE_WRITE_CMD_CFG;
+ 800b1e0:	2324      	movs	r3, #36	; 0x24
+ 800b1e2:	e7f9      	b.n	800b1d8 <HAL_OSPI_Command+0x254>
+ 800b1e4:	f0ffc0c0 	.word	0xf0ffc0c0
+
+0800b1e8 <HAL_OSPI_Receive>:
+{
+ 800b1e8:	b5f0      	push	{r4, r5, r6, r7, lr}
+ 800b1ea:	4604      	mov	r4, r0
+ 800b1ec:	b085      	sub	sp, #20
+ 800b1ee:	460f      	mov	r7, r1
+ 800b1f0:	4616      	mov	r6, r2
+  uint32_t tickstart = HAL_GetTick();
+ 800b1f2:	f7fb ffad 	bl	8007150 <HAL_GetTick>
+  __IO uint32_t *data_reg = &hospi->Instance->DR;
+ 800b1f6:	6825      	ldr	r5, [r4, #0]
+  uint32_t tickstart = HAL_GetTick();
+ 800b1f8:	4603      	mov	r3, r0
+  uint32_t addr_reg = hospi->Instance->AR;
+ 800b1fa:	6ca8      	ldr	r0, [r5, #72]	; 0x48
+  uint32_t ir_reg = hospi->Instance->IR;
+ 800b1fc:	f8d5 c110 	ldr.w	ip, [r5, #272]	; 0x110
+  if (pData == NULL)
+ 800b200:	b91f      	cbnz	r7, 800b20a <HAL_OSPI_Receive+0x22>
+    hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_PARAM;
+ 800b202:	2308      	movs	r3, #8
+      hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800b204:	64a3      	str	r3, [r4, #72]	; 0x48
+      status = HAL_ERROR;
+ 800b206:	2001      	movs	r0, #1
+ 800b208:	e034      	b.n	800b274 <HAL_OSPI_Receive+0x8c>
+    if (hospi->State == HAL_OSPI_STATE_CMD_CFG)
+ 800b20a:	6c62      	ldr	r2, [r4, #68]	; 0x44
+ 800b20c:	2a04      	cmp	r2, #4
+ 800b20e:	d13b      	bne.n	800b288 <HAL_OSPI_Receive+0xa0>
+      hospi->XferCount = READ_REG(hospi->Instance->DLR) + 1U;
+ 800b210:	6c2a      	ldr	r2, [r5, #64]	; 0x40
+      hospi->pBuffPtr  = pData;
+ 800b212:	6367      	str	r7, [r4, #52]	; 0x34
+      hospi->XferCount = READ_REG(hospi->Instance->DLR) + 1U;
+ 800b214:	3201      	adds	r2, #1
+ 800b216:	63e2      	str	r2, [r4, #60]	; 0x3c
+      hospi->XferSize  = hospi->XferCount;
+ 800b218:	6be2      	ldr	r2, [r4, #60]	; 0x3c
+ 800b21a:	63a2      	str	r2, [r4, #56]	; 0x38
+      MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FMODE, OSPI_FUNCTIONAL_MODE_INDIRECT_READ);
+ 800b21c:	6829      	ldr	r1, [r5, #0]
+      if (hospi->Init.MemoryType == HAL_OSPI_MEMTYPE_HYPERBUS)
+ 800b21e:	68e2      	ldr	r2, [r4, #12]
+      MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FMODE, OSPI_FUNCTIONAL_MODE_INDIRECT_READ);
+ 800b220:	f021 5140 	bic.w	r1, r1, #805306368	; 0x30000000
+ 800b224:	f041 5180 	orr.w	r1, r1, #268435456	; 0x10000000
+      if (hospi->Init.MemoryType == HAL_OSPI_MEMTYPE_HYPERBUS)
+ 800b228:	f1b2 6f80 	cmp.w	r2, #67108864	; 0x4000000
+      MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FMODE, OSPI_FUNCTIONAL_MODE_INDIRECT_READ);
+ 800b22c:	6029      	str	r1, [r5, #0]
+      if (hospi->Init.MemoryType == HAL_OSPI_MEMTYPE_HYPERBUS)
+ 800b22e:	d123      	bne.n	800b278 <HAL_OSPI_Receive+0x90>
+          WRITE_REG(hospi->Instance->AR, addr_reg);
+ 800b230:	64a8      	str	r0, [r5, #72]	; 0x48
+        status = OSPI_WaitFlagStateUntilTimeout(hospi, (HAL_OSPI_FLAG_FT | HAL_OSPI_FLAG_TC), SET, tickstart, Timeout);
+ 800b232:	9600      	str	r6, [sp, #0]
+ 800b234:	2201      	movs	r2, #1
+ 800b236:	2106      	movs	r1, #6
+ 800b238:	4620      	mov	r0, r4
+ 800b23a:	9303      	str	r3, [sp, #12]
+ 800b23c:	f7ff fe10 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+        if (status != HAL_OK)
+ 800b240:	b9c0      	cbnz	r0, 800b274 <HAL_OSPI_Receive+0x8c>
+        *hospi->pBuffPtr = *((__IO uint8_t *)data_reg);
+ 800b242:	6b62      	ldr	r2, [r4, #52]	; 0x34
+ 800b244:	f895 1050 	ldrb.w	r1, [r5, #80]	; 0x50
+ 800b248:	7011      	strb	r1, [r2, #0]
+        hospi->pBuffPtr++;
+ 800b24a:	6b62      	ldr	r2, [r4, #52]	; 0x34
+      } while(hospi->XferCount > 0U);
+ 800b24c:	9b03      	ldr	r3, [sp, #12]
+        hospi->pBuffPtr++;
+ 800b24e:	3201      	adds	r2, #1
+ 800b250:	6362      	str	r2, [r4, #52]	; 0x34
+        hospi->XferCount--;
+ 800b252:	6be2      	ldr	r2, [r4, #60]	; 0x3c
+ 800b254:	3a01      	subs	r2, #1
+ 800b256:	63e2      	str	r2, [r4, #60]	; 0x3c
+      } while(hospi->XferCount > 0U);
+ 800b258:	6be2      	ldr	r2, [r4, #60]	; 0x3c
+ 800b25a:	2a00      	cmp	r2, #0
+ 800b25c:	d1e9      	bne.n	800b232 <HAL_OSPI_Receive+0x4a>
+        status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_TC, SET, tickstart, Timeout);
+ 800b25e:	9600      	str	r6, [sp, #0]
+ 800b260:	2201      	movs	r2, #1
+ 800b262:	2102      	movs	r1, #2
+ 800b264:	4620      	mov	r0, r4
+ 800b266:	f7ff fdfb 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+        if (status == HAL_OK)
+ 800b26a:	b918      	cbnz	r0, 800b274 <HAL_OSPI_Receive+0x8c>
+          __HAL_OSPI_CLEAR_FLAG(hospi, HAL_OSPI_FLAG_TC);
+ 800b26c:	6822      	ldr	r2, [r4, #0]
+ 800b26e:	2302      	movs	r3, #2
+ 800b270:	6253      	str	r3, [r2, #36]	; 0x24
+          hospi->State = HAL_OSPI_STATE_READY;
+ 800b272:	6463      	str	r3, [r4, #68]	; 0x44
+}
+ 800b274:	b005      	add	sp, #20
+ 800b276:	bdf0      	pop	{r4, r5, r6, r7, pc}
+        if (READ_BIT(hospi->Instance->CCR, OCTOSPI_CCR_ADMODE) != HAL_OSPI_ADDRESS_NONE)
+ 800b278:	f8d5 2100 	ldr.w	r2, [r5, #256]	; 0x100
+ 800b27c:	f412 6fe0 	tst.w	r2, #1792	; 0x700
+ 800b280:	d1d6      	bne.n	800b230 <HAL_OSPI_Receive+0x48>
+          WRITE_REG(hospi->Instance->IR, ir_reg);
+ 800b282:	f8c5 c110 	str.w	ip, [r5, #272]	; 0x110
+ 800b286:	e7d4      	b.n	800b232 <HAL_OSPI_Receive+0x4a>
+      hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800b288:	2310      	movs	r3, #16
+ 800b28a:	e7bb      	b.n	800b204 <HAL_OSPI_Receive+0x1c>
+
+0800b28c <HAL_OSPI_AutoPolling>:
+{
+ 800b28c:	e92d 41ff 	stmdb	sp!, {r0, r1, r2, r3, r4, r5, r6, r7, r8, lr}
+ 800b290:	4604      	mov	r4, r0
+ 800b292:	4616      	mov	r6, r2
+ 800b294:	460d      	mov	r5, r1
+  uint32_t tickstart = HAL_GetTick();
+ 800b296:	f7fb ff5b 	bl	8007150 <HAL_GetTick>
+  uint32_t addr_reg = hospi->Instance->AR;
+ 800b29a:	6822      	ldr	r2, [r4, #0]
+ 800b29c:	6c97      	ldr	r7, [r2, #72]	; 0x48
+  uint32_t ir_reg = hospi->Instance->IR;
+ 800b29e:	f8d2 8110 	ldr.w	r8, [r2, #272]	; 0x110
+  if ((hospi->State == HAL_OSPI_STATE_CMD_CFG) && (cfg->AutomaticStop == HAL_OSPI_AUTOMATIC_STOP_ENABLE))
+ 800b2a2:	6c62      	ldr	r2, [r4, #68]	; 0x44
+ 800b2a4:	2a04      	cmp	r2, #4
+  uint32_t tickstart = HAL_GetTick();
+ 800b2a6:	4603      	mov	r3, r0
+  if ((hospi->State == HAL_OSPI_STATE_CMD_CFG) && (cfg->AutomaticStop == HAL_OSPI_AUTOMATIC_STOP_ENABLE))
+ 800b2a8:	d13c      	bne.n	800b324 <HAL_OSPI_AutoPolling+0x98>
+ 800b2aa:	68ea      	ldr	r2, [r5, #12]
+ 800b2ac:	f5b2 0f80 	cmp.w	r2, #4194304	; 0x400000
+ 800b2b0:	d138      	bne.n	800b324 <HAL_OSPI_AutoPolling+0x98>
+    status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_BUSY, RESET, tickstart, Timeout);
+ 800b2b2:	9003      	str	r0, [sp, #12]
+ 800b2b4:	9600      	str	r6, [sp, #0]
+ 800b2b6:	2200      	movs	r2, #0
+ 800b2b8:	2120      	movs	r1, #32
+ 800b2ba:	4620      	mov	r0, r4
+ 800b2bc:	f7ff fdd0 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+    if (status == HAL_OK)
+ 800b2c0:	bb28      	cbnz	r0, 800b30e <HAL_OSPI_AutoPolling+0x82>
+      WRITE_REG (hospi->Instance->PSMAR, cfg->Match);
+ 800b2c2:	6822      	ldr	r2, [r4, #0]
+ 800b2c4:	6829      	ldr	r1, [r5, #0]
+ 800b2c6:	f8c2 1088 	str.w	r1, [r2, #136]	; 0x88
+      WRITE_REG (hospi->Instance->PSMKR, cfg->Mask);
+ 800b2ca:	6869      	ldr	r1, [r5, #4]
+ 800b2cc:	f8c2 1080 	str.w	r1, [r2, #128]	; 0x80
+      WRITE_REG (hospi->Instance->PIR,   cfg->Interval);
+ 800b2d0:	6929      	ldr	r1, [r5, #16]
+ 800b2d2:	f8c2 1090 	str.w	r1, [r2, #144]	; 0x90
+      MODIFY_REG(hospi->Instance->CR,    (OCTOSPI_CR_PMM | OCTOSPI_CR_APMS | OCTOSPI_CR_FMODE),
+ 800b2d6:	e9d5 1502 	ldrd	r1, r5, [r5, #8]
+ 800b2da:	6810      	ldr	r0, [r2, #0]
+      if (hospi->Init.MemoryType == HAL_OSPI_MEMTYPE_HYPERBUS)
+ 800b2dc:	9b03      	ldr	r3, [sp, #12]
+      MODIFY_REG(hospi->Instance->CR,    (OCTOSPI_CR_PMM | OCTOSPI_CR_APMS | OCTOSPI_CR_FMODE),
+ 800b2de:	4329      	orrs	r1, r5
+ 800b2e0:	f020 5043 	bic.w	r0, r0, #817889280	; 0x30c00000
+ 800b2e4:	4301      	orrs	r1, r0
+ 800b2e6:	f041 5100 	orr.w	r1, r1, #536870912	; 0x20000000
+ 800b2ea:	6011      	str	r1, [r2, #0]
+      if (hospi->Init.MemoryType == HAL_OSPI_MEMTYPE_HYPERBUS)
+ 800b2ec:	68e1      	ldr	r1, [r4, #12]
+ 800b2ee:	f1b1 6f80 	cmp.w	r1, #67108864	; 0x4000000
+ 800b2f2:	d10f      	bne.n	800b314 <HAL_OSPI_AutoPolling+0x88>
+          WRITE_REG(hospi->Instance->AR, addr_reg);
+ 800b2f4:	6497      	str	r7, [r2, #72]	; 0x48
+      status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_SM, SET, tickstart, Timeout);
+ 800b2f6:	9600      	str	r6, [sp, #0]
+ 800b2f8:	2201      	movs	r2, #1
+ 800b2fa:	2108      	movs	r1, #8
+ 800b2fc:	4620      	mov	r0, r4
+ 800b2fe:	f7ff fdaf 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+      if (status == HAL_OK)
+ 800b302:	b920      	cbnz	r0, 800b30e <HAL_OSPI_AutoPolling+0x82>
+        __HAL_OSPI_CLEAR_FLAG(hospi, HAL_OSPI_FLAG_SM);
+ 800b304:	6823      	ldr	r3, [r4, #0]
+ 800b306:	2208      	movs	r2, #8
+ 800b308:	625a      	str	r2, [r3, #36]	; 0x24
+        hospi->State = HAL_OSPI_STATE_READY;
+ 800b30a:	2302      	movs	r3, #2
+ 800b30c:	6463      	str	r3, [r4, #68]	; 0x44
+}
+ 800b30e:	b004      	add	sp, #16
+ 800b310:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+        if (READ_BIT(hospi->Instance->CCR, OCTOSPI_CCR_ADMODE) != HAL_OSPI_ADDRESS_NONE)
+ 800b314:	f8d2 1100 	ldr.w	r1, [r2, #256]	; 0x100
+ 800b318:	f411 6fe0 	tst.w	r1, #1792	; 0x700
+ 800b31c:	d1ea      	bne.n	800b2f4 <HAL_OSPI_AutoPolling+0x68>
+          WRITE_REG(hospi->Instance->IR, ir_reg);
+ 800b31e:	f8c2 8110 	str.w	r8, [r2, #272]	; 0x110
+ 800b322:	e7e8      	b.n	800b2f6 <HAL_OSPI_AutoPolling+0x6a>
+    hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800b324:	2310      	movs	r3, #16
+ 800b326:	64a3      	str	r3, [r4, #72]	; 0x48
+    status = HAL_ERROR;
+ 800b328:	2001      	movs	r0, #1
+ 800b32a:	e7f0      	b.n	800b30e <HAL_OSPI_AutoPolling+0x82>
+
+0800b32c <HAL_OSPI_AutoPolling_IT>:
+{
+ 800b32c:	b5f7      	push	{r0, r1, r2, r4, r5, r6, r7, lr}
+ 800b32e:	4604      	mov	r4, r0
+ 800b330:	460f      	mov	r7, r1
+  uint32_t tickstart = HAL_GetTick();
+ 800b332:	f7fb ff0d 	bl	8007150 <HAL_GetTick>
+  uint32_t addr_reg = hospi->Instance->AR;
+ 800b336:	6822      	ldr	r2, [r4, #0]
+ 800b338:	6c95      	ldr	r5, [r2, #72]	; 0x48
+  uint32_t ir_reg = hospi->Instance->IR;
+ 800b33a:	f8d2 6110 	ldr.w	r6, [r2, #272]	; 0x110
+  if (hospi->State == HAL_OSPI_STATE_CMD_CFG)
+ 800b33e:	6c62      	ldr	r2, [r4, #68]	; 0x44
+ 800b340:	2a04      	cmp	r2, #4
+  uint32_t tickstart = HAL_GetTick();
+ 800b342:	4603      	mov	r3, r0
+  if (hospi->State == HAL_OSPI_STATE_CMD_CFG)
+ 800b344:	d132      	bne.n	800b3ac <HAL_OSPI_AutoPolling_IT+0x80>
+    status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_BUSY, RESET, tickstart, hospi->Timeout);
+ 800b346:	6ce2      	ldr	r2, [r4, #76]	; 0x4c
+ 800b348:	9200      	str	r2, [sp, #0]
+ 800b34a:	2120      	movs	r1, #32
+ 800b34c:	2200      	movs	r2, #0
+ 800b34e:	4620      	mov	r0, r4
+ 800b350:	f7ff fd86 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+    if (status == HAL_OK)
+ 800b354:	bb00      	cbnz	r0, 800b398 <HAL_OSPI_AutoPolling_IT+0x6c>
+      WRITE_REG (hospi->Instance->PSMAR, cfg->Match);
+ 800b356:	6823      	ldr	r3, [r4, #0]
+ 800b358:	683a      	ldr	r2, [r7, #0]
+ 800b35a:	f8c3 2088 	str.w	r2, [r3, #136]	; 0x88
+      WRITE_REG (hospi->Instance->PSMKR, cfg->Mask);
+ 800b35e:	687a      	ldr	r2, [r7, #4]
+ 800b360:	f8c3 2080 	str.w	r2, [r3, #128]	; 0x80
+      WRITE_REG (hospi->Instance->PIR,   cfg->Interval);
+ 800b364:	693a      	ldr	r2, [r7, #16]
+ 800b366:	f8c3 2090 	str.w	r2, [r3, #144]	; 0x90
+      MODIFY_REG(hospi->Instance->CR,    (OCTOSPI_CR_PMM | OCTOSPI_CR_APMS | OCTOSPI_CR_FMODE),
+ 800b36a:	e9d7 2702 	ldrd	r2, r7, [r7, #8]
+ 800b36e:	6819      	ldr	r1, [r3, #0]
+ 800b370:	433a      	orrs	r2, r7
+ 800b372:	f021 5143 	bic.w	r1, r1, #817889280	; 0x30c00000
+ 800b376:	430a      	orrs	r2, r1
+ 800b378:	f042 5200 	orr.w	r2, r2, #536870912	; 0x20000000
+ 800b37c:	601a      	str	r2, [r3, #0]
+      __HAL_OSPI_CLEAR_FLAG(hospi, HAL_OSPI_FLAG_TE | HAL_OSPI_FLAG_SM);
+ 800b37e:	2209      	movs	r2, #9
+ 800b380:	625a      	str	r2, [r3, #36]	; 0x24
+      hospi->State = HAL_OSPI_STATE_BUSY_AUTO_POLLING;
+ 800b382:	2248      	movs	r2, #72	; 0x48
+ 800b384:	6462      	str	r2, [r4, #68]	; 0x44
+      __HAL_OSPI_ENABLE_IT(hospi, HAL_OSPI_IT_SM | HAL_OSPI_IT_TE);
+ 800b386:	681a      	ldr	r2, [r3, #0]
+ 800b388:	f442 2210 	orr.w	r2, r2, #589824	; 0x90000
+ 800b38c:	601a      	str	r2, [r3, #0]
+      if (hospi->Init.MemoryType == HAL_OSPI_MEMTYPE_HYPERBUS)
+ 800b38e:	68e2      	ldr	r2, [r4, #12]
+ 800b390:	f1b2 6f80 	cmp.w	r2, #67108864	; 0x4000000
+ 800b394:	d102      	bne.n	800b39c <HAL_OSPI_AutoPolling_IT+0x70>
+          WRITE_REG(hospi->Instance->AR, addr_reg);
+ 800b396:	649d      	str	r5, [r3, #72]	; 0x48
+}
+ 800b398:	b003      	add	sp, #12
+ 800b39a:	bdf0      	pop	{r4, r5, r6, r7, pc}
+        if (READ_BIT(hospi->Instance->CCR, OCTOSPI_CCR_ADMODE) != HAL_OSPI_ADDRESS_NONE)
+ 800b39c:	f8d3 2100 	ldr.w	r2, [r3, #256]	; 0x100
+ 800b3a0:	f412 6fe0 	tst.w	r2, #1792	; 0x700
+ 800b3a4:	d1f7      	bne.n	800b396 <HAL_OSPI_AutoPolling_IT+0x6a>
+          WRITE_REG(hospi->Instance->IR, ir_reg);
+ 800b3a6:	f8c3 6110 	str.w	r6, [r3, #272]	; 0x110
+ 800b3aa:	e7f5      	b.n	800b398 <HAL_OSPI_AutoPolling_IT+0x6c>
+    hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800b3ac:	2310      	movs	r3, #16
+ 800b3ae:	64a3      	str	r3, [r4, #72]	; 0x48
+    status = HAL_ERROR;
+ 800b3b0:	2001      	movs	r0, #1
+ 800b3b2:	e7f1      	b.n	800b398 <HAL_OSPI_AutoPolling_IT+0x6c>
+
+0800b3b4 <HAL_OSPI_MemoryMapped>:
+{
+ 800b3b4:	b573      	push	{r0, r1, r4, r5, r6, lr}
+ 800b3b6:	4604      	mov	r4, r0
+ 800b3b8:	460d      	mov	r5, r1
+  uint32_t tickstart = HAL_GetTick();
+ 800b3ba:	f7fb fec9 	bl	8007150 <HAL_GetTick>
+  if (hospi->State == HAL_OSPI_STATE_CMD_CFG)
+ 800b3be:	6c62      	ldr	r2, [r4, #68]	; 0x44
+ 800b3c0:	2a04      	cmp	r2, #4
+  uint32_t tickstart = HAL_GetTick();
+ 800b3c2:	4603      	mov	r3, r0
+  if (hospi->State == HAL_OSPI_STATE_CMD_CFG)
+ 800b3c4:	d121      	bne.n	800b40a <HAL_OSPI_MemoryMapped+0x56>
+    status = OSPI_WaitFlagStateUntilTimeout(hospi, HAL_OSPI_FLAG_BUSY, RESET, tickstart, hospi->Timeout);
+ 800b3c6:	6ce2      	ldr	r2, [r4, #76]	; 0x4c
+ 800b3c8:	9200      	str	r2, [sp, #0]
+ 800b3ca:	2120      	movs	r1, #32
+ 800b3cc:	2200      	movs	r2, #0
+ 800b3ce:	4620      	mov	r0, r4
+ 800b3d0:	f7ff fd46 	bl	800ae60 <OSPI_WaitFlagStateUntilTimeout>
+    if (status == HAL_OK)
+ 800b3d4:	b9b8      	cbnz	r0, 800b406 <HAL_OSPI_MemoryMapped+0x52>
+      if (cfg->TimeOutActivation == HAL_OSPI_TIMEOUT_COUNTER_ENABLE)
+ 800b3d6:	682e      	ldr	r6, [r5, #0]
+        WRITE_REG(hospi->Instance->LPTR, cfg->TimeOutPeriod);
+ 800b3d8:	6822      	ldr	r2, [r4, #0]
+      hospi->State = HAL_OSPI_STATE_BUSY_MEM_MAPPED;
+ 800b3da:	2388      	movs	r3, #136	; 0x88
+      if (cfg->TimeOutActivation == HAL_OSPI_TIMEOUT_COUNTER_ENABLE)
+ 800b3dc:	2e08      	cmp	r6, #8
+      hospi->State = HAL_OSPI_STATE_BUSY_MEM_MAPPED;
+ 800b3de:	6463      	str	r3, [r4, #68]	; 0x44
+      if (cfg->TimeOutActivation == HAL_OSPI_TIMEOUT_COUNTER_ENABLE)
+ 800b3e0:	d108      	bne.n	800b3f4 <HAL_OSPI_MemoryMapped+0x40>
+        WRITE_REG(hospi->Instance->LPTR, cfg->TimeOutPeriod);
+ 800b3e2:	686b      	ldr	r3, [r5, #4]
+ 800b3e4:	f8c2 3130 	str.w	r3, [r2, #304]	; 0x130
+        __HAL_OSPI_CLEAR_FLAG(hospi, HAL_OSPI_FLAG_TO);
+ 800b3e8:	2310      	movs	r3, #16
+ 800b3ea:	6253      	str	r3, [r2, #36]	; 0x24
+        __HAL_OSPI_ENABLE_IT(hospi, HAL_OSPI_IT_TO);
+ 800b3ec:	6811      	ldr	r1, [r2, #0]
+ 800b3ee:	f441 1180 	orr.w	r1, r1, #1048576	; 0x100000
+ 800b3f2:	6011      	str	r1, [r2, #0]
+      MODIFY_REG(hospi->Instance->CR, (OCTOSPI_CR_TCEN | OCTOSPI_CR_FMODE),
+ 800b3f4:	6813      	ldr	r3, [r2, #0]
+ 800b3f6:	f023 5340 	bic.w	r3, r3, #805306368	; 0x30000000
+ 800b3fa:	f023 0308 	bic.w	r3, r3, #8
+ 800b3fe:	4333      	orrs	r3, r6
+ 800b400:	f043 5340 	orr.w	r3, r3, #805306368	; 0x30000000
+ 800b404:	6013      	str	r3, [r2, #0]
+}
+ 800b406:	b002      	add	sp, #8
+ 800b408:	bd70      	pop	{r4, r5, r6, pc}
+    hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800b40a:	2310      	movs	r3, #16
+ 800b40c:	64a3      	str	r3, [r4, #72]	; 0x48
+    status = HAL_ERROR;
+ 800b40e:	2001      	movs	r0, #1
+ 800b410:	e7f9      	b.n	800b406 <HAL_OSPI_MemoryMapped+0x52>
+
+0800b412 <HAL_OSPI_SetFifoThreshold>:
+  if ((hospi->State & OSPI_BUSY_STATE_MASK) == 0U)
+ 800b412:	6c43      	ldr	r3, [r0, #68]	; 0x44
+ 800b414:	f013 0308 	ands.w	r3, r3, #8
+ 800b418:	d10a      	bne.n	800b430 <HAL_OSPI_SetFifoThreshold+0x1e>
+    hospi->Init.FifoThreshold = Threshold;
+ 800b41a:	6041      	str	r1, [r0, #4]
+    MODIFY_REG(hospi->Instance->CR, OCTOSPI_CR_FTHRES, ((hospi->Init.FifoThreshold-1U) << OCTOSPI_CR_FTHRES_Pos));
+ 800b41c:	6800      	ldr	r0, [r0, #0]
+ 800b41e:	6802      	ldr	r2, [r0, #0]
+ 800b420:	3901      	subs	r1, #1
+ 800b422:	f422 52f8 	bic.w	r2, r2, #7936	; 0x1f00
+ 800b426:	ea42 2101 	orr.w	r1, r2, r1, lsl #8
+ 800b42a:	6001      	str	r1, [r0, #0]
+  HAL_StatusTypeDef status = HAL_OK;
+ 800b42c:	4618      	mov	r0, r3
+ 800b42e:	4770      	bx	lr
+    hospi->ErrorCode = HAL_OSPI_ERROR_INVALID_SEQUENCE;
+ 800b430:	2310      	movs	r3, #16
+ 800b432:	6483      	str	r3, [r0, #72]	; 0x48
+    status = HAL_ERROR;
+ 800b434:	2001      	movs	r0, #1
+}
+ 800b436:	4770      	bx	lr
+
+0800b438 <HAL_OSPI_GetFifoThreshold>:
+  return ((READ_BIT(hospi->Instance->CR, OCTOSPI_CR_FTHRES) >> OCTOSPI_CR_FTHRES_Pos) + 1U);
+ 800b438:	6803      	ldr	r3, [r0, #0]
+ 800b43a:	6818      	ldr	r0, [r3, #0]
+ 800b43c:	f3c0 2004 	ubfx	r0, r0, #8, #5
+}
+ 800b440:	3001      	adds	r0, #1
+ 800b442:	4770      	bx	lr
+
+0800b444 <HAL_OSPI_SetTimeout>:
+  hospi->Timeout = Timeout;
+ 800b444:	64c1      	str	r1, [r0, #76]	; 0x4c
+}
+ 800b446:	2000      	movs	r0, #0
+ 800b448:	4770      	bx	lr
+
+0800b44a <HAL_OSPI_GetError>:
+  return hospi->ErrorCode;
+ 800b44a:	6c80      	ldr	r0, [r0, #72]	; 0x48
+}
+ 800b44c:	4770      	bx	lr
+
+0800b44e <HAL_OSPI_GetState>:
+  return hospi->State;
+ 800b44e:	6c40      	ldr	r0, [r0, #68]	; 0x44
+}
+ 800b450:	4770      	bx	lr
+	...
+
+0800b454 <HAL_OSPIM_Config>:
+{
+ 800b454:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+  if (hospi->Instance == OCTOSPI1)
+ 800b458:	6802      	ldr	r2, [r0, #0]
+    other_instance = 0U;
+ 800b45a:	4bbf      	ldr	r3, [pc, #764]	; (800b758 <HAL_OSPIM_Config+0x304>)
+  * @retval HAL status
+  */
+static HAL_StatusTypeDef OSPIM_GetConfig(uint8_t instance_nb, OSPIM_CfgTypeDef *cfg)
+{
+  HAL_StatusTypeDef status = HAL_OK;
+  uint32_t reg, value = 0U;
+ 800b45c:	f8df 8304 	ldr.w	r8, [pc, #772]	; 800b764 <HAL_OSPIM_Config+0x310>
+    other_instance = 0U;
+ 800b460:	429a      	cmp	r2, r3
+{
+ 800b462:	b08b      	sub	sp, #44	; 0x2c
+    }
+
+    /* Get the information about the instance */
+    for (index = 0U; index < OSPI_IOM_NB_PORTS; index ++)
+    {
+      reg = OCTOSPIM->PCR[index];
+ 800b464:	4bbd      	ldr	r3, [pc, #756]	; (800b75c <HAL_OSPIM_Config+0x308>)
+    other_instance = 0U;
+ 800b466:	bf0b      	itete	eq
+ 800b468:	f04f 0a01 	moveq.w	sl, #1
+ 800b46c:	f04f 0a00 	movne.w	sl, #0
+ 800b470:	2000      	moveq	r0, #0
+ 800b472:	2001      	movne	r0, #1
+  for (index = 0U; index < OSPI_NB_INSTANCE; index++)
+ 800b474:	466a      	mov	r2, sp
+    instance = 1U;
+ 800b476:	2501      	movs	r5, #1
+    cfg->ClkPort    = 0U;
+ 800b478:	2700      	movs	r7, #0
+    cfg->DQSPort    = 0U;
+ 800b47a:	e9c2 7700 	strd	r7, r7, [r2]
+    cfg->IOLowPort  = 0U;
+ 800b47e:	e9c2 7702 	strd	r7, r7, [r2, #8]
+  uint32_t reg, value = 0U;
+ 800b482:	2d02      	cmp	r5, #2
+ 800b484:	bf0c      	ite	eq
+ 800b486:	46c4      	moveq	ip, r8
+ 800b488:	f04f 0c00 	movne.w	ip, #0
+    cfg->IOHighPort = 0U;
+ 800b48c:	6117      	str	r7, [r2, #16]
+    for (index = 0U; index < OSPI_IOM_NB_PORTS; index ++)
+ 800b48e:	f04f 0e00 	mov.w	lr, #0
+      reg = OCTOSPIM->PCR[index];
+ 800b492:	eb03 048e 	add.w	r4, r3, lr, lsl #2
+      {
+        /* The clock is enabled on this port */
+        if ((reg & OCTOSPIM_PCR_CLKSRC) == (value & OCTOSPIM_PCR_CLKSRC))
+        {
+          /* The clock correspond to the instance passed as parameter */
+          cfg->ClkPort = index+1U;
+ 800b496:	f10e 0601 	add.w	r6, lr, #1
+      reg = OCTOSPIM->PCR[index];
+ 800b49a:	6864      	ldr	r4, [r4, #4]
+      if ((reg & OCTOSPIM_PCR_CLKEN) != 0U)
+ 800b49c:	f014 0f01 	tst.w	r4, #1
+ 800b4a0:	d005      	beq.n	800b4ae <HAL_OSPIM_Config+0x5a>
+        if ((reg & OCTOSPIM_PCR_CLKSRC) == (value & OCTOSPIM_PCR_CLKSRC))
+ 800b4a2:	ea84 0e0c 	eor.w	lr, r4, ip
+ 800b4a6:	f01e 0f02 	tst.w	lr, #2
+          cfg->ClkPort = index+1U;
+ 800b4aa:	bf08      	it	eq
+ 800b4ac:	6016      	streq	r6, [r2, #0]
+        }
+      }
+
+      if ((reg & OCTOSPIM_PCR_DQSEN) != 0U)
+ 800b4ae:	f014 0f10 	tst.w	r4, #16
+ 800b4b2:	d005      	beq.n	800b4c0 <HAL_OSPIM_Config+0x6c>
+      {
+        /* The DQS is enabled on this port */
+        if ((reg & OCTOSPIM_PCR_DQSSRC) == (value & OCTOSPIM_PCR_DQSSRC))
+ 800b4b4:	ea84 0e0c 	eor.w	lr, r4, ip
+ 800b4b8:	f01e 0f20 	tst.w	lr, #32
+        {
+          /* The DQS correspond to the instance passed as parameter */
+          cfg->DQSPort = index+1U;
+ 800b4bc:	bf08      	it	eq
+ 800b4be:	6056      	streq	r6, [r2, #4]
+        }
+      }
+
+      if ((reg & OCTOSPIM_PCR_NCSEN) != 0U)
+ 800b4c0:	f414 7f80 	tst.w	r4, #256	; 0x100
+ 800b4c4:	d005      	beq.n	800b4d2 <HAL_OSPIM_Config+0x7e>
+      {
+        /* The nCS is enabled on this port */
+        if ((reg & OCTOSPIM_PCR_NCSSRC) == (value & OCTOSPIM_PCR_NCSSRC))
+ 800b4c6:	ea84 0e0c 	eor.w	lr, r4, ip
+ 800b4ca:	f41e 7f00 	tst.w	lr, #512	; 0x200
+        {
+          /* The nCS correspond to the instance passed as parameter */
+          cfg->NCSPort = index+1U;
+ 800b4ce:	bf08      	it	eq
+ 800b4d0:	6096      	streq	r6, [r2, #8]
+        }
+      }
+
+      if ((reg & OCTOSPIM_PCR_IOLEN) != 0U)
+ 800b4d2:	f414 3f80 	tst.w	r4, #65536	; 0x10000
+ 800b4d6:	d00d      	beq.n	800b4f4 <HAL_OSPIM_Config+0xa0>
+      {
+        /* The IO Low is enabled on this port */
+        if ((reg & OCTOSPIM_PCR_IOLSRC_1) == (value & OCTOSPIM_PCR_IOLSRC_1))
+ 800b4d8:	ea84 0e0c 	eor.w	lr, r4, ip
+ 800b4dc:	f41e 2f80 	tst.w	lr, #262144	; 0x40000
+ 800b4e0:	d108      	bne.n	800b4f4 <HAL_OSPIM_Config+0xa0>
+        {
+          /* The IO Low correspond to the instance passed as parameter */
+          if ((reg & OCTOSPIM_PCR_IOLSRC_0) == 0U)
+ 800b4e2:	f414 3f00 	tst.w	r4, #131072	; 0x20000
+          {
+            cfg->IOLowPort = (OCTOSPIM_PCR_IOLEN | (index+1U));
+ 800b4e6:	bf0c      	ite	eq
+ 800b4e8:	f446 3e80 	orreq.w	lr, r6, #65536	; 0x10000
+          }
+          else
+          {
+            cfg->IOLowPort = (OCTOSPIM_PCR_IOHEN | (index+1U));
+ 800b4ec:	f046 7e80 	orrne.w	lr, r6, #16777216	; 0x1000000
+ 800b4f0:	f8c2 e00c 	str.w	lr, [r2, #12]
+          }
+        }
+      }
+
+      if ((reg & OCTOSPIM_PCR_IOHEN) != 0U)
+ 800b4f4:	f014 7f80 	tst.w	r4, #16777216	; 0x1000000
+ 800b4f8:	d00b      	beq.n	800b512 <HAL_OSPIM_Config+0xbe>
+      {
+        /* The IO High is enabled on this port */
+        if ((reg & OCTOSPIM_PCR_IOHSRC_1) == (value & OCTOSPIM_PCR_IOHSRC_1))
+ 800b4fa:	ea84 0e0c 	eor.w	lr, r4, ip
+ 800b4fe:	f01e 6f80 	tst.w	lr, #67108864	; 0x4000000
+ 800b502:	d106      	bne.n	800b512 <HAL_OSPIM_Config+0xbe>
+        {
+          /* The IO High correspond to the instance passed as parameter */
+          if ((reg & OCTOSPIM_PCR_IOHSRC_0) == 0U)
+ 800b504:	01a4      	lsls	r4, r4, #6
+          {
+            cfg->IOHighPort = (OCTOSPIM_PCR_IOLEN | (index+1U));
+ 800b506:	bf54      	ite	pl
+ 800b508:	f446 3480 	orrpl.w	r4, r6, #65536	; 0x10000
+          }
+          else
+          {
+            cfg->IOHighPort = (OCTOSPIM_PCR_IOHEN | (index+1U));
+ 800b50c:	f046 7480 	orrmi.w	r4, r6, #16777216	; 0x1000000
+ 800b510:	6114      	str	r4, [r2, #16]
+    for (index = 0U; index < OSPI_IOM_NB_PORTS; index ++)
+ 800b512:	2e02      	cmp	r6, #2
+ 800b514:	f04f 0e01 	mov.w	lr, #1
+ 800b518:	d1bb      	bne.n	800b492 <HAL_OSPIM_Config+0x3e>
+  for (index = 0U; index < OSPI_NB_INSTANCE; index++)
+ 800b51a:	2d02      	cmp	r5, #2
+ 800b51c:	f102 0214 	add.w	r2, r2, #20
+ 800b520:	f040 8117 	bne.w	800b752 <HAL_OSPIM_Config+0x2fe>
+    if ((OCTOSPI1->CR & OCTOSPI_CR_EN) != 0U)
+ 800b524:	4c8c      	ldr	r4, [pc, #560]	; (800b758 <HAL_OSPIM_Config+0x304>)
+ 800b526:	6825      	ldr	r5, [r4, #0]
+ 800b528:	ea15 050e 	ands.w	r5, r5, lr
+      CLEAR_BIT(OCTOSPI1->CR, OCTOSPI_CR_EN);
+ 800b52c:	bf1e      	ittt	ne
+ 800b52e:	6822      	ldrne	r2, [r4, #0]
+ 800b530:	f022 0201 	bicne.w	r2, r2, #1
+ 800b534:	6022      	strne	r2, [r4, #0]
+    if ((OCTOSPI2->CR & OCTOSPI_CR_EN) != 0U)
+ 800b536:	4a8a      	ldr	r2, [pc, #552]	; (800b760 <HAL_OSPIM_Config+0x30c>)
+ 800b538:	6814      	ldr	r4, [r2, #0]
+      ospi_enabled |= 0x1U;
+ 800b53a:	bf18      	it	ne
+ 800b53c:	4675      	movne	r5, lr
+    if ((OCTOSPI2->CR & OCTOSPI_CR_EN) != 0U)
+ 800b53e:	07e6      	lsls	r6, r4, #31
+      CLEAR_BIT(OCTOSPI2->CR, OCTOSPI_CR_EN);
+ 800b540:	bf42      	ittt	mi
+ 800b542:	6814      	ldrmi	r4, [r2, #0]
+ 800b544:	f024 0401 	bicmi.w	r4, r4, #1
+ 800b548:	6014      	strmi	r4, [r2, #0]
+    CLEAR_BIT(OCTOSPIM->PCR[(IOM_cfg[instance].NCSPort-1U)], OCTOSPIM_PCR_NCSEN);
+ 800b54a:	aa0a      	add	r2, sp, #40	; 0x28
+ 800b54c:	f04f 0414 	mov.w	r4, #20
+ 800b550:	fb04 2400 	mla	r4, r4, r0, r2
+      ospi_enabled |= 0x2U;
+ 800b554:	bf48      	it	mi
+ 800b556:	f045 0b02 	orrmi.w	fp, r5, #2
+    CLEAR_BIT(OCTOSPIM->PCR[(IOM_cfg[instance].NCSPort-1U)], OCTOSPIM_PCR_NCSEN);
+ 800b55a:	f854 2c20 	ldr.w	r2, [r4, #-32]
+ 800b55e:	f102 32ff 	add.w	r2, r2, #4294967295	; 0xffffffff
+ 800b562:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 800b566:	bf58      	it	pl
+ 800b568:	46ab      	movpl	fp, r5
+ 800b56a:	6856      	ldr	r6, [r2, #4]
+ 800b56c:	f426 7680 	bic.w	r6, r6, #256	; 0x100
+ 800b570:	6056      	str	r6, [r2, #4]
+      if (IOM_cfg[instance].ClkPort != 0U)
+ 800b572:	f854 2c28 	ldr.w	r2, [r4, #-40]
+ 800b576:	b382      	cbz	r2, 800b5da <HAL_OSPIM_Config+0x186>
+        CLEAR_BIT(OCTOSPIM->PCR[(IOM_cfg[instance].ClkPort-1U)], OCTOSPIM_PCR_CLKEN);
+ 800b578:	3a01      	subs	r2, #1
+ 800b57a:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 800b57e:	6856      	ldr	r6, [r2, #4]
+ 800b580:	f026 0601 	bic.w	r6, r6, #1
+ 800b584:	6056      	str	r6, [r2, #4]
+        if (IOM_cfg[instance].DQSPort != 0U)
+ 800b586:	f854 2c24 	ldr.w	r2, [r4, #-36]
+ 800b58a:	b132      	cbz	r2, 800b59a <HAL_OSPIM_Config+0x146>
+          CLEAR_BIT(OCTOSPIM->PCR[(IOM_cfg[instance].DQSPort-1U)], OCTOSPIM_PCR_DQSEN);
+ 800b58c:	3a01      	subs	r2, #1
+ 800b58e:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 800b592:	6854      	ldr	r4, [r2, #4]
+ 800b594:	f024 0410 	bic.w	r4, r4, #16
+ 800b598:	6054      	str	r4, [r2, #4]
+        if (IOM_cfg[instance].IOLowPort != HAL_OSPIM_IOPORT_NONE)
+ 800b59a:	2214      	movs	r2, #20
+ 800b59c:	ac0a      	add	r4, sp, #40	; 0x28
+ 800b59e:	fb02 4200 	mla	r2, r2, r0, r4
+ 800b5a2:	f852 2c1c 	ldr.w	r2, [r2, #-28]
+ 800b5a6:	b142      	cbz	r2, 800b5ba <HAL_OSPIM_Config+0x166>
+          CLEAR_BIT(OCTOSPIM->PCR[((IOM_cfg[instance].IOLowPort-1U)& OSPI_IOM_PORT_MASK)], OCTOSPIM_PCR_IOLEN);
+ 800b5a8:	3a01      	subs	r2, #1
+ 800b5aa:	f002 0201 	and.w	r2, r2, #1
+ 800b5ae:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 800b5b2:	6854      	ldr	r4, [r2, #4]
+ 800b5b4:	f424 3480 	bic.w	r4, r4, #65536	; 0x10000
+ 800b5b8:	6054      	str	r4, [r2, #4]
+        if (IOM_cfg[instance].IOHighPort != HAL_OSPIM_IOPORT_NONE)
+ 800b5ba:	2214      	movs	r2, #20
+ 800b5bc:	ac0a      	add	r4, sp, #40	; 0x28
+ 800b5be:	fb02 4200 	mla	r2, r2, r0, r4
+ 800b5c2:	f852 2c18 	ldr.w	r2, [r2, #-24]
+ 800b5c6:	b142      	cbz	r2, 800b5da <HAL_OSPIM_Config+0x186>
+          CLEAR_BIT(OCTOSPIM->PCR[((IOM_cfg[instance].IOHighPort-1U)& OSPI_IOM_PORT_MASK)], OCTOSPIM_PCR_IOHEN);
+ 800b5c8:	3a01      	subs	r2, #1
+ 800b5ca:	f002 0201 	and.w	r2, r2, #1
+ 800b5ce:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 800b5d2:	6854      	ldr	r4, [r2, #4]
+ 800b5d4:	f024 7480 	bic.w	r4, r4, #16777216	; 0x1000000
+ 800b5d8:	6054      	str	r4, [r2, #4]
+    if ((cfg->ClkPort == IOM_cfg[other_instance].ClkPort) || (cfg->DQSPort == IOM_cfg[other_instance].DQSPort)     ||
+ 800b5da:	aa0a      	add	r2, sp, #40	; 0x28
+ 800b5dc:	f04f 0914 	mov.w	r9, #20
+ 800b5e0:	fb09 290a 	mla	r9, r9, sl, r2
+ 800b5e4:	f8d1 c000 	ldr.w	ip, [r1]
+ 800b5e8:	f859 8c28 	ldr.w	r8, [r9, #-40]
+        (cfg->IOHighPort == IOM_cfg[other_instance].IOHighPort))
+ 800b5ec:	f859 4c18 	ldr.w	r4, [r9, #-24]
+    if ((cfg->ClkPort == IOM_cfg[other_instance].ClkPort) || (cfg->DQSPort == IOM_cfg[other_instance].DQSPort)     ||
+ 800b5f0:	45c4      	cmp	ip, r8
+        (cfg->NCSPort == IOM_cfg[other_instance].NCSPort) || (cfg->IOLowPort == IOM_cfg[other_instance].IOLowPort) ||
+ 800b5f2:	e9d1 6e01 	ldrd	r6, lr, [r1, #4]
+        (cfg->IOHighPort == IOM_cfg[other_instance].IOHighPort))
+ 800b5f6:	e9d1 2103 	ldrd	r2, r1, [r1, #12]
+    if ((cfg->ClkPort == IOM_cfg[other_instance].ClkPort) || (cfg->DQSPort == IOM_cfg[other_instance].DQSPort)     ||
+ 800b5fa:	d00d      	beq.n	800b618 <HAL_OSPIM_Config+0x1c4>
+ 800b5fc:	f859 7c24 	ldr.w	r7, [r9, #-36]
+ 800b600:	42b7      	cmp	r7, r6
+ 800b602:	d009      	beq.n	800b618 <HAL_OSPIM_Config+0x1c4>
+ 800b604:	f859 7c20 	ldr.w	r7, [r9, #-32]
+ 800b608:	45be      	cmp	lr, r7
+ 800b60a:	d005      	beq.n	800b618 <HAL_OSPIM_Config+0x1c4>
+        (cfg->NCSPort == IOM_cfg[other_instance].NCSPort) || (cfg->IOLowPort == IOM_cfg[other_instance].IOLowPort) ||
+ 800b60c:	f859 7c1c 	ldr.w	r7, [r9, #-28]
+ 800b610:	4297      	cmp	r7, r2
+ 800b612:	d001      	beq.n	800b618 <HAL_OSPIM_Config+0x1c4>
+ 800b614:	428c      	cmp	r4, r1
+ 800b616:	d142      	bne.n	800b69e <HAL_OSPIM_Config+0x24a>
+        CLEAR_BIT(OCTOSPIM->PCR[(IOM_cfg[other_instance].ClkPort-1U)], OCTOSPIM_PCR_CLKEN);
+ 800b618:	f108 38ff 	add.w	r8, r8, #4294967295	; 0xffffffff
+ 800b61c:	eb03 0888 	add.w	r8, r3, r8, lsl #2
+ 800b620:	f8d8 7004 	ldr.w	r7, [r8, #4]
+ 800b624:	f027 0701 	bic.w	r7, r7, #1
+ 800b628:	f8c8 7004 	str.w	r7, [r8, #4]
+        if (IOM_cfg[other_instance].DQSPort != 0U)
+ 800b62c:	2714      	movs	r7, #20
+ 800b62e:	f10d 0828 	add.w	r8, sp, #40	; 0x28
+ 800b632:	fb07 870a 	mla	r7, r7, sl, r8
+ 800b636:	f857 7c24 	ldr.w	r7, [r7, #-36]
+ 800b63a:	b147      	cbz	r7, 800b64e <HAL_OSPIM_Config+0x1fa>
+          CLEAR_BIT(OCTOSPIM->PCR[(IOM_cfg[other_instance].DQSPort-1U)], OCTOSPIM_PCR_DQSEN);
+ 800b63c:	3f01      	subs	r7, #1
+ 800b63e:	eb03 0787 	add.w	r7, r3, r7, lsl #2
+ 800b642:	f8d7 8004 	ldr.w	r8, [r7, #4]
+ 800b646:	f028 0810 	bic.w	r8, r8, #16
+ 800b64a:	f8c7 8004 	str.w	r8, [r7, #4]
+        CLEAR_BIT(OCTOSPIM->PCR[(IOM_cfg[other_instance].NCSPort-1U)], OCTOSPIM_PCR_NCSEN);
+ 800b64e:	2714      	movs	r7, #20
+ 800b650:	f10d 0828 	add.w	r8, sp, #40	; 0x28
+ 800b654:	fb07 8a0a 	mla	sl, r7, sl, r8
+ 800b658:	f85a 7c20 	ldr.w	r7, [sl, #-32]
+ 800b65c:	3f01      	subs	r7, #1
+ 800b65e:	eb03 0787 	add.w	r7, r3, r7, lsl #2
+ 800b662:	f8d7 8004 	ldr.w	r8, [r7, #4]
+ 800b666:	f428 7880 	bic.w	r8, r8, #256	; 0x100
+ 800b66a:	f8c7 8004 	str.w	r8, [r7, #4]
+        if (IOM_cfg[other_instance].IOLowPort != HAL_OSPIM_IOPORT_NONE)
+ 800b66e:	f85a 7c1c 	ldr.w	r7, [sl, #-28]
+ 800b672:	b157      	cbz	r7, 800b68a <HAL_OSPIM_Config+0x236>
+          CLEAR_BIT(OCTOSPIM->PCR[((IOM_cfg[other_instance].IOLowPort-1U)& OSPI_IOM_PORT_MASK)], OCTOSPIM_PCR_IOLEN);
+ 800b674:	3f01      	subs	r7, #1
+ 800b676:	f007 0701 	and.w	r7, r7, #1
+ 800b67a:	eb03 0787 	add.w	r7, r3, r7, lsl #2
+ 800b67e:	f8d7 8004 	ldr.w	r8, [r7, #4]
+ 800b682:	f428 3880 	bic.w	r8, r8, #65536	; 0x10000
+ 800b686:	f8c7 8004 	str.w	r8, [r7, #4]
+        if (IOM_cfg[other_instance].IOHighPort != HAL_OSPIM_IOPORT_NONE)
+ 800b68a:	b144      	cbz	r4, 800b69e <HAL_OSPIM_Config+0x24a>
+          CLEAR_BIT(OCTOSPIM->PCR[((IOM_cfg[other_instance].IOHighPort-1U)& OSPI_IOM_PORT_MASK)], OCTOSPIM_PCR_IOHEN);
+ 800b68c:	3c01      	subs	r4, #1
+ 800b68e:	f004 0401 	and.w	r4, r4, #1
+ 800b692:	eb03 0484 	add.w	r4, r3, r4, lsl #2
+ 800b696:	6867      	ldr	r7, [r4, #4]
+ 800b698:	f027 7780 	bic.w	r7, r7, #16777216	; 0x1000000
+ 800b69c:	6067      	str	r7, [r4, #4]
+    MODIFY_REG(OCTOSPIM->PCR[(cfg->NCSPort-1U)], (OCTOSPIM_PCR_NCSEN | OCTOSPIM_PCR_NCSSRC), (OCTOSPIM_PCR_NCSEN | (instance << OCTOSPIM_PCR_NCSSRC_Pos)));
+ 800b69e:	f10e 3eff 	add.w	lr, lr, #4294967295	; 0xffffffff
+ 800b6a2:	eb03 0e8e 	add.w	lr, r3, lr, lsl #2
+      MODIFY_REG(OCTOSPIM->PCR[(cfg->ClkPort-1U)], (OCTOSPIM_PCR_CLKEN | OCTOSPIM_PCR_CLKSRC), (OCTOSPIM_PCR_CLKEN | (instance << OCTOSPIM_PCR_CLKSRC_Pos)));
+ 800b6a6:	f10c 3cff 	add.w	ip, ip, #4294967295	; 0xffffffff
+    MODIFY_REG(OCTOSPIM->PCR[(cfg->NCSPort-1U)], (OCTOSPIM_PCR_NCSEN | OCTOSPIM_PCR_NCSSRC), (OCTOSPIM_PCR_NCSEN | (instance << OCTOSPIM_PCR_NCSSRC_Pos)));
+ 800b6aa:	f8de 4004 	ldr.w	r4, [lr, #4]
+ 800b6ae:	f424 7440 	bic.w	r4, r4, #768	; 0x300
+ 800b6b2:	ea44 2440 	orr.w	r4, r4, r0, lsl #9
+ 800b6b6:	f444 7480 	orr.w	r4, r4, #256	; 0x100
+      MODIFY_REG(OCTOSPIM->PCR[(cfg->ClkPort-1U)], (OCTOSPIM_PCR_CLKEN | OCTOSPIM_PCR_CLKSRC), (OCTOSPIM_PCR_CLKEN | (instance << OCTOSPIM_PCR_CLKSRC_Pos)));
+ 800b6ba:	eb03 0c8c 	add.w	ip, r3, ip, lsl #2
+    MODIFY_REG(OCTOSPIM->PCR[(cfg->NCSPort-1U)], (OCTOSPIM_PCR_NCSEN | OCTOSPIM_PCR_NCSSRC), (OCTOSPIM_PCR_NCSEN | (instance << OCTOSPIM_PCR_NCSSRC_Pos)));
+ 800b6be:	f8ce 4004 	str.w	r4, [lr, #4]
+      MODIFY_REG(OCTOSPIM->PCR[(cfg->ClkPort-1U)], (OCTOSPIM_PCR_CLKEN | OCTOSPIM_PCR_CLKSRC), (OCTOSPIM_PCR_CLKEN | (instance << OCTOSPIM_PCR_CLKSRC_Pos)));
+ 800b6c2:	f8dc 4004 	ldr.w	r4, [ip, #4]
+ 800b6c6:	f024 0403 	bic.w	r4, r4, #3
+ 800b6ca:	ea44 0440 	orr.w	r4, r4, r0, lsl #1
+ 800b6ce:	f044 0401 	orr.w	r4, r4, #1
+ 800b6d2:	f8cc 4004 	str.w	r4, [ip, #4]
+      if (cfg->DQSPort != 0U)
+ 800b6d6:	b156      	cbz	r6, 800b6ee <HAL_OSPIM_Config+0x29a>
+        MODIFY_REG(OCTOSPIM->PCR[(cfg->DQSPort-1U)], (OCTOSPIM_PCR_DQSEN | OCTOSPIM_PCR_DQSSRC), (OCTOSPIM_PCR_DQSEN | (instance << OCTOSPIM_PCR_DQSSRC_Pos)));
+ 800b6d8:	3e01      	subs	r6, #1
+ 800b6da:	eb03 0686 	add.w	r6, r3, r6, lsl #2
+ 800b6de:	6874      	ldr	r4, [r6, #4]
+ 800b6e0:	f024 0430 	bic.w	r4, r4, #48	; 0x30
+ 800b6e4:	ea44 1440 	orr.w	r4, r4, r0, lsl #5
+ 800b6e8:	f044 0410 	orr.w	r4, r4, #16
+ 800b6ec:	6074      	str	r4, [r6, #4]
+      if ((cfg->IOLowPort & OCTOSPIM_PCR_IOLEN) != 0U)
+ 800b6ee:	03d4      	lsls	r4, r2, #15
+ 800b6f0:	d53a      	bpl.n	800b768 <HAL_OSPIM_Config+0x314>
+        MODIFY_REG(OCTOSPIM->PCR[((cfg->IOLowPort-1U)& OSPI_IOM_PORT_MASK)], (OCTOSPIM_PCR_IOLEN | OCTOSPIM_PCR_IOLSRC),
+ 800b6f2:	3a01      	subs	r2, #1
+ 800b6f4:	f002 0201 	and.w	r2, r2, #1
+ 800b6f8:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 800b6fc:	6854      	ldr	r4, [r2, #4]
+ 800b6fe:	f424 24e0 	bic.w	r4, r4, #458752	; 0x70000
+ 800b702:	ea44 4480 	orr.w	r4, r4, r0, lsl #18
+ 800b706:	f444 3480 	orr.w	r4, r4, #65536	; 0x10000
+        MODIFY_REG(OCTOSPIM->PCR[((cfg->IOLowPort-1U)& OSPI_IOM_PORT_MASK)], (OCTOSPIM_PCR_IOHEN | OCTOSPIM_PCR_IOHSRC),
+ 800b70a:	6054      	str	r4, [r2, #4]
+      if ((cfg->IOHighPort & OCTOSPIM_PCR_IOLEN) != 0U)
+ 800b70c:	03ca      	lsls	r2, r1, #15
+ 800b70e:	d53a      	bpl.n	800b786 <HAL_OSPIM_Config+0x332>
+        MODIFY_REG(OCTOSPIM->PCR[((cfg->IOHighPort-1U)& OSPI_IOM_PORT_MASK)], (OCTOSPIM_PCR_IOLEN | OCTOSPIM_PCR_IOLSRC),
+ 800b710:	3901      	subs	r1, #1
+ 800b712:	f001 0101 	and.w	r1, r1, #1
+ 800b716:	eb03 0381 	add.w	r3, r3, r1, lsl #2
+ 800b71a:	685a      	ldr	r2, [r3, #4]
+ 800b71c:	f422 22e0 	bic.w	r2, r2, #458752	; 0x70000
+ 800b720:	ea42 4080 	orr.w	r0, r2, r0, lsl #18
+ 800b724:	f440 3040 	orr.w	r0, r0, #196608	; 0x30000
+        MODIFY_REG(OCTOSPIM->PCR[((cfg->IOHighPort-1U)& OSPI_IOM_PORT_MASK)], (OCTOSPIM_PCR_IOHEN | OCTOSPIM_PCR_IOHSRC),
+ 800b728:	6058      	str	r0, [r3, #4]
+    if ((ospi_enabled & 0x1U) != 0U)
+ 800b72a:	b125      	cbz	r5, 800b736 <HAL_OSPIM_Config+0x2e2>
+      SET_BIT(OCTOSPI1->CR, OCTOSPI_CR_EN);
+ 800b72c:	4a0a      	ldr	r2, [pc, #40]	; (800b758 <HAL_OSPIM_Config+0x304>)
+ 800b72e:	6813      	ldr	r3, [r2, #0]
+ 800b730:	f043 0301 	orr.w	r3, r3, #1
+ 800b734:	6013      	str	r3, [r2, #0]
+    if ((ospi_enabled & 0x2U) != 0U)
+ 800b736:	f01b 0f02 	tst.w	fp, #2
+      SET_BIT(OCTOSPI2->CR, OCTOSPI_CR_EN);
+ 800b73a:	bf1c      	itt	ne
+ 800b73c:	4a08      	ldrne	r2, [pc, #32]	; (800b760 <HAL_OSPIM_Config+0x30c>)
+ 800b73e:	6813      	ldrne	r3, [r2, #0]
+}
+ 800b740:	f04f 0000 	mov.w	r0, #0
+      SET_BIT(OCTOSPI2->CR, OCTOSPI_CR_EN);
+ 800b744:	bf1c      	itt	ne
+ 800b746:	f043 0301 	orrne.w	r3, r3, #1
+ 800b74a:	6013      	strne	r3, [r2, #0]
+}
+ 800b74c:	b00b      	add	sp, #44	; 0x2c
+ 800b74e:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+ 800b752:	4635      	mov	r5, r6
+ 800b754:	e691      	b.n	800b47a <HAL_OSPIM_Config+0x26>
+ 800b756:	bf00      	nop
+ 800b758:	a0001000 	.word	0xa0001000
+ 800b75c:	50061c00 	.word	0x50061c00
+ 800b760:	a0001400 	.word	0xa0001400
+ 800b764:	04040222 	.word	0x04040222
+      else if (cfg->IOLowPort != HAL_OSPIM_IOPORT_NONE)
+ 800b768:	2a00      	cmp	r2, #0
+ 800b76a:	d0cf      	beq.n	800b70c <HAL_OSPIM_Config+0x2b8>
+        MODIFY_REG(OCTOSPIM->PCR[((cfg->IOLowPort-1U)& OSPI_IOM_PORT_MASK)], (OCTOSPIM_PCR_IOHEN | OCTOSPIM_PCR_IOHSRC),
+ 800b76c:	3a01      	subs	r2, #1
+ 800b76e:	f002 0201 	and.w	r2, r2, #1
+ 800b772:	eb03 0282 	add.w	r2, r3, r2, lsl #2
+ 800b776:	6854      	ldr	r4, [r2, #4]
+ 800b778:	f024 64e0 	bic.w	r4, r4, #117440512	; 0x7000000
+ 800b77c:	ea44 6480 	orr.w	r4, r4, r0, lsl #26
+ 800b780:	f044 7480 	orr.w	r4, r4, #16777216	; 0x1000000
+ 800b784:	e7c1      	b.n	800b70a <HAL_OSPIM_Config+0x2b6>
+      else if (cfg->IOHighPort != HAL_OSPIM_IOPORT_NONE)
+ 800b786:	2900      	cmp	r1, #0
+ 800b788:	d0cf      	beq.n	800b72a <HAL_OSPIM_Config+0x2d6>
+        MODIFY_REG(OCTOSPIM->PCR[((cfg->IOHighPort-1U)& OSPI_IOM_PORT_MASK)], (OCTOSPIM_PCR_IOHEN | OCTOSPIM_PCR_IOHSRC),
+ 800b78a:	3901      	subs	r1, #1
+ 800b78c:	f001 0101 	and.w	r1, r1, #1
+ 800b790:	eb03 0381 	add.w	r3, r3, r1, lsl #2
+ 800b794:	685a      	ldr	r2, [r3, #4]
+ 800b796:	f022 62e0 	bic.w	r2, r2, #117440512	; 0x7000000
+ 800b79a:	ea42 6080 	orr.w	r0, r2, r0, lsl #26
+ 800b79e:	f040 7040 	orr.w	r0, r0, #50331648	; 0x3000000
+ 800b7a2:	e7c1      	b.n	800b728 <HAL_OSPIM_Config+0x2d4>
+
+0800b7a4 <I2C_TransferConfig>:
+  *     @arg @ref I2C_GENERATE_START_WRITE Generate Restart for write request.
+  * @retval None
+  */
+static void I2C_TransferConfig(I2C_HandleTypeDef *hi2c, uint16_t DevAddress, uint8_t Size, uint32_t Mode,
+                               uint32_t Request)
+{
+ 800b7a4:	b530      	push	{r4, r5, lr}
+ 800b7a6:	9d03      	ldr	r5, [sp, #12]
+  assert_param(IS_I2C_ALL_INSTANCE(hi2c->Instance));
+  assert_param(IS_TRANSFER_MODE(Mode));
+  assert_param(IS_TRANSFER_REQUEST(Request));
+
+  /* update CR2 register */
+  MODIFY_REG(hi2c->Instance->CR2,
+ 800b7a8:	6804      	ldr	r4, [r0, #0]
+ 800b7aa:	ea45 4202 	orr.w	r2, r5, r2, lsl #16
+ 800b7ae:	431a      	orrs	r2, r3
+ 800b7b0:	4b05      	ldr	r3, [pc, #20]	; (800b7c8 <I2C_TransferConfig+0x24>)
+ 800b7b2:	6860      	ldr	r0, [r4, #4]
+ 800b7b4:	f3c1 0109 	ubfx	r1, r1, #0, #10
+ 800b7b8:	ea43 5355 	orr.w	r3, r3, r5, lsr #21
+ 800b7bc:	430a      	orrs	r2, r1
+ 800b7be:	ea20 0003 	bic.w	r0, r0, r3
+ 800b7c2:	4302      	orrs	r2, r0
+ 800b7c4:	6062      	str	r2, [r4, #4]
+             ((I2C_CR2_SADD | I2C_CR2_NBYTES | I2C_CR2_RELOAD | I2C_CR2_AUTOEND | \
+               (I2C_CR2_RD_WRN & (uint32_t)(Request >> (31U - I2C_CR2_RD_WRN_Pos))) | I2C_CR2_START | I2C_CR2_STOP)), \
+             (uint32_t)(((uint32_t)DevAddress & I2C_CR2_SADD) |
+                        (((uint32_t)Size << I2C_CR2_NBYTES_Pos) & I2C_CR2_NBYTES) | (uint32_t)Mode | (uint32_t)Request));
+}
+ 800b7c6:	bd30      	pop	{r4, r5, pc}
+ 800b7c8:	03ff63ff 	.word	0x03ff63ff
+
+0800b7cc <I2C_IsAcknowledgeFailed>:
+  if (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_AF) == SET)
+ 800b7cc:	6803      	ldr	r3, [r0, #0]
+{
+ 800b7ce:	b570      	push	{r4, r5, r6, lr}
+ 800b7d0:	4604      	mov	r4, r0
+  if (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_AF) == SET)
+ 800b7d2:	6998      	ldr	r0, [r3, #24]
+ 800b7d4:	f010 0010 	ands.w	r0, r0, #16
+{
+ 800b7d8:	460d      	mov	r5, r1
+ 800b7da:	4616      	mov	r6, r2
+  if (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_AF) == SET)
+ 800b7dc:	d116      	bne.n	800b80c <I2C_IsAcknowledgeFailed+0x40>
+}
+ 800b7de:	bd70      	pop	{r4, r5, r6, pc}
+      if (Timeout != HAL_MAX_DELAY)
+ 800b7e0:	1c6a      	adds	r2, r5, #1
+ 800b7e2:	d014      	beq.n	800b80e <I2C_IsAcknowledgeFailed+0x42>
+        if (((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 800b7e4:	f7fb fcb4 	bl	8007150 <HAL_GetTick>
+ 800b7e8:	1b80      	subs	r0, r0, r6
+ 800b7ea:	4285      	cmp	r5, r0
+ 800b7ec:	d300      	bcc.n	800b7f0 <I2C_IsAcknowledgeFailed+0x24>
+ 800b7ee:	b96d      	cbnz	r5, 800b80c <I2C_IsAcknowledgeFailed+0x40>
+          hi2c->ErrorCode |= HAL_I2C_ERROR_TIMEOUT;
+ 800b7f0:	6c63      	ldr	r3, [r4, #68]	; 0x44
+ 800b7f2:	f043 0320 	orr.w	r3, r3, #32
+    hi2c->ErrorCode |= HAL_I2C_ERROR_AF;
+ 800b7f6:	6463      	str	r3, [r4, #68]	; 0x44
+    hi2c->State = HAL_I2C_STATE_READY;
+ 800b7f8:	2320      	movs	r3, #32
+ 800b7fa:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+    hi2c->Mode = HAL_I2C_MODE_NONE;
+ 800b7fe:	2300      	movs	r3, #0
+ 800b800:	f884 3042 	strb.w	r3, [r4, #66]	; 0x42
+    __HAL_UNLOCK(hi2c);
+ 800b804:	f884 3040 	strb.w	r3, [r4, #64]	; 0x40
+    return HAL_ERROR;
+ 800b808:	2001      	movs	r0, #1
+ 800b80a:	e7e8      	b.n	800b7de <I2C_IsAcknowledgeFailed+0x12>
+    while (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_STOPF) == RESET)
+ 800b80c:	6823      	ldr	r3, [r4, #0]
+ 800b80e:	699a      	ldr	r2, [r3, #24]
+ 800b810:	0690      	lsls	r0, r2, #26
+ 800b812:	d5e5      	bpl.n	800b7e0 <I2C_IsAcknowledgeFailed+0x14>
+    __HAL_I2C_CLEAR_FLAG(hi2c, I2C_FLAG_AF);
+ 800b814:	2210      	movs	r2, #16
+ 800b816:	61da      	str	r2, [r3, #28]
+    __HAL_I2C_CLEAR_FLAG(hi2c, I2C_FLAG_STOPF);
+ 800b818:	2220      	movs	r2, #32
+ 800b81a:	61da      	str	r2, [r3, #28]
+  if (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_TXIS) != RESET)
+ 800b81c:	699a      	ldr	r2, [r3, #24]
+ 800b81e:	0791      	lsls	r1, r2, #30
+    hi2c->Instance->TXDR = 0x00U;
+ 800b820:	bf44      	itt	mi
+ 800b822:	2200      	movmi	r2, #0
+ 800b824:	629a      	strmi	r2, [r3, #40]	; 0x28
+  if (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_TXE) == RESET)
+ 800b826:	699a      	ldr	r2, [r3, #24]
+ 800b828:	07d2      	lsls	r2, r2, #31
+    __HAL_I2C_CLEAR_FLAG(hi2c, I2C_FLAG_TXE);
+ 800b82a:	bf5e      	ittt	pl
+ 800b82c:	699a      	ldrpl	r2, [r3, #24]
+ 800b82e:	f042 0201 	orrpl.w	r2, r2, #1
+ 800b832:	619a      	strpl	r2, [r3, #24]
+    I2C_RESET_CR2(hi2c);
+ 800b834:	685a      	ldr	r2, [r3, #4]
+ 800b836:	f022 72ff 	bic.w	r2, r2, #33423360	; 0x1fe0000
+ 800b83a:	f422 328b 	bic.w	r2, r2, #71168	; 0x11600
+ 800b83e:	f422 72ff 	bic.w	r2, r2, #510	; 0x1fe
+ 800b842:	f022 0201 	bic.w	r2, r2, #1
+ 800b846:	605a      	str	r2, [r3, #4]
+    hi2c->ErrorCode |= HAL_I2C_ERROR_AF;
+ 800b848:	6c63      	ldr	r3, [r4, #68]	; 0x44
+ 800b84a:	f043 0304 	orr.w	r3, r3, #4
+ 800b84e:	e7d2      	b.n	800b7f6 <I2C_IsAcknowledgeFailed+0x2a>
+
+0800b850 <I2C_WaitOnFlagUntilTimeout>:
+{
+ 800b850:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 800b854:	9f06      	ldr	r7, [sp, #24]
+ 800b856:	4604      	mov	r4, r0
+ 800b858:	4688      	mov	r8, r1
+ 800b85a:	4616      	mov	r6, r2
+ 800b85c:	461d      	mov	r5, r3
+  while (__HAL_I2C_GET_FLAG(hi2c, Flag) == Status)
+ 800b85e:	6822      	ldr	r2, [r4, #0]
+ 800b860:	6993      	ldr	r3, [r2, #24]
+ 800b862:	ea38 0303 	bics.w	r3, r8, r3
+ 800b866:	bf0c      	ite	eq
+ 800b868:	2301      	moveq	r3, #1
+ 800b86a:	2300      	movne	r3, #0
+ 800b86c:	42b3      	cmp	r3, r6
+ 800b86e:	d001      	beq.n	800b874 <I2C_WaitOnFlagUntilTimeout+0x24>
+  return HAL_OK;
+ 800b870:	2000      	movs	r0, #0
+ 800b872:	e015      	b.n	800b8a0 <I2C_WaitOnFlagUntilTimeout+0x50>
+    if (Timeout != HAL_MAX_DELAY)
+ 800b874:	1c6b      	adds	r3, r5, #1
+ 800b876:	d0f3      	beq.n	800b860 <I2C_WaitOnFlagUntilTimeout+0x10>
+      if (((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 800b878:	f7fb fc6a 	bl	8007150 <HAL_GetTick>
+ 800b87c:	1bc0      	subs	r0, r0, r7
+ 800b87e:	42a8      	cmp	r0, r5
+ 800b880:	d801      	bhi.n	800b886 <I2C_WaitOnFlagUntilTimeout+0x36>
+ 800b882:	2d00      	cmp	r5, #0
+ 800b884:	d1eb      	bne.n	800b85e <I2C_WaitOnFlagUntilTimeout+0xe>
+        hi2c->ErrorCode |= HAL_I2C_ERROR_TIMEOUT;
+ 800b886:	6c63      	ldr	r3, [r4, #68]	; 0x44
+ 800b888:	f043 0320 	orr.w	r3, r3, #32
+ 800b88c:	6463      	str	r3, [r4, #68]	; 0x44
+        hi2c->State = HAL_I2C_STATE_READY;
+ 800b88e:	2320      	movs	r3, #32
+ 800b890:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+        hi2c->Mode = HAL_I2C_MODE_NONE;
+ 800b894:	2300      	movs	r3, #0
+ 800b896:	f884 3042 	strb.w	r3, [r4, #66]	; 0x42
+        __HAL_UNLOCK(hi2c);
+ 800b89a:	f884 3040 	strb.w	r3, [r4, #64]	; 0x40
+ 800b89e:	2001      	movs	r0, #1
+}
+ 800b8a0:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+
+0800b8a4 <I2C_WaitOnSTOPFlagUntilTimeout>:
+{
+ 800b8a4:	b570      	push	{r4, r5, r6, lr}
+ 800b8a6:	4604      	mov	r4, r0
+ 800b8a8:	460d      	mov	r5, r1
+ 800b8aa:	4616      	mov	r6, r2
+  while (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_STOPF) == RESET)
+ 800b8ac:	6823      	ldr	r3, [r4, #0]
+ 800b8ae:	699b      	ldr	r3, [r3, #24]
+ 800b8b0:	069b      	lsls	r3, r3, #26
+ 800b8b2:	d501      	bpl.n	800b8b8 <I2C_WaitOnSTOPFlagUntilTimeout+0x14>
+  return HAL_OK;
+ 800b8b4:	2000      	movs	r0, #0
+}
+ 800b8b6:	bd70      	pop	{r4, r5, r6, pc}
+    if (I2C_IsAcknowledgeFailed(hi2c, Timeout, Tickstart) != HAL_OK)
+ 800b8b8:	4632      	mov	r2, r6
+ 800b8ba:	4629      	mov	r1, r5
+ 800b8bc:	4620      	mov	r0, r4
+ 800b8be:	f7ff ff85 	bl	800b7cc <I2C_IsAcknowledgeFailed>
+ 800b8c2:	b990      	cbnz	r0, 800b8ea <I2C_WaitOnSTOPFlagUntilTimeout+0x46>
+    if (((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 800b8c4:	f7fb fc44 	bl	8007150 <HAL_GetTick>
+ 800b8c8:	1b80      	subs	r0, r0, r6
+ 800b8ca:	42a8      	cmp	r0, r5
+ 800b8cc:	d801      	bhi.n	800b8d2 <I2C_WaitOnSTOPFlagUntilTimeout+0x2e>
+ 800b8ce:	2d00      	cmp	r5, #0
+ 800b8d0:	d1ec      	bne.n	800b8ac <I2C_WaitOnSTOPFlagUntilTimeout+0x8>
+        hi2c->ErrorCode |= HAL_I2C_ERROR_TIMEOUT;
+ 800b8d2:	6c63      	ldr	r3, [r4, #68]	; 0x44
+ 800b8d4:	f043 0320 	orr.w	r3, r3, #32
+ 800b8d8:	6463      	str	r3, [r4, #68]	; 0x44
+        hi2c->State = HAL_I2C_STATE_READY;
+ 800b8da:	2320      	movs	r3, #32
+ 800b8dc:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+        hi2c->Mode = HAL_I2C_MODE_NONE;
+ 800b8e0:	2300      	movs	r3, #0
+ 800b8e2:	f884 3042 	strb.w	r3, [r4, #66]	; 0x42
+        __HAL_UNLOCK(hi2c);
+ 800b8e6:	f884 3040 	strb.w	r3, [r4, #64]	; 0x40
+      return HAL_ERROR;
+ 800b8ea:	2001      	movs	r0, #1
+ 800b8ec:	e7e3      	b.n	800b8b6 <I2C_WaitOnSTOPFlagUntilTimeout+0x12>
+
+0800b8ee <HAL_I2C_MspInit>:
+}
+ 800b8ee:	4770      	bx	lr
+
+0800b8f0 <HAL_I2C_Init>:
+{
+ 800b8f0:	b510      	push	{r4, lr}
+  if (hi2c == NULL)
+ 800b8f2:	4604      	mov	r4, r0
+ 800b8f4:	2800      	cmp	r0, #0
+ 800b8f6:	d04a      	beq.n	800b98e <HAL_I2C_Init+0x9e>
+  if (hi2c->State == HAL_I2C_STATE_RESET)
+ 800b8f8:	f890 3041 	ldrb.w	r3, [r0, #65]	; 0x41
+ 800b8fc:	f003 02ff 	and.w	r2, r3, #255	; 0xff
+ 800b900:	b91b      	cbnz	r3, 800b90a <HAL_I2C_Init+0x1a>
+    hi2c->Lock = HAL_UNLOCKED;
+ 800b902:	f880 2040 	strb.w	r2, [r0, #64]	; 0x40
+    HAL_I2C_MspInit(hi2c);
+ 800b906:	f7ff fff2 	bl	800b8ee <HAL_I2C_MspInit>
+  hi2c->State = HAL_I2C_STATE_BUSY;
+ 800b90a:	2324      	movs	r3, #36	; 0x24
+ 800b90c:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+  __HAL_I2C_DISABLE(hi2c);
+ 800b910:	6823      	ldr	r3, [r4, #0]
+ 800b912:	681a      	ldr	r2, [r3, #0]
+ 800b914:	f022 0201 	bic.w	r2, r2, #1
+ 800b918:	601a      	str	r2, [r3, #0]
+  hi2c->Instance->TIMINGR = hi2c->Init.Timing & TIMING_CLEAR_MASK;
+ 800b91a:	6862      	ldr	r2, [r4, #4]
+ 800b91c:	f022 6270 	bic.w	r2, r2, #251658240	; 0xf000000
+ 800b920:	611a      	str	r2, [r3, #16]
+  hi2c->Instance->OAR1 &= ~I2C_OAR1_OA1EN;
+ 800b922:	689a      	ldr	r2, [r3, #8]
+ 800b924:	f422 4200 	bic.w	r2, r2, #32768	; 0x8000
+ 800b928:	609a      	str	r2, [r3, #8]
+    hi2c->Instance->OAR1 = (I2C_OAR1_OA1EN | hi2c->Init.OwnAddress1);
+ 800b92a:	e9d4 2102 	ldrd	r2, r1, [r4, #8]
+  if (hi2c->Init.AddressingMode == I2C_ADDRESSINGMODE_7BIT)
+ 800b92e:	2901      	cmp	r1, #1
+ 800b930:	d124      	bne.n	800b97c <HAL_I2C_Init+0x8c>
+    hi2c->Instance->OAR1 = (I2C_OAR1_OA1EN | hi2c->Init.OwnAddress1);
+ 800b932:	f442 4200 	orr.w	r2, r2, #32768	; 0x8000
+ 800b936:	609a      	str	r2, [r3, #8]
+  hi2c->Instance->CR2 |= (I2C_CR2_AUTOEND | I2C_CR2_NACK);
+ 800b938:	685a      	ldr	r2, [r3, #4]
+ 800b93a:	f042 7200 	orr.w	r2, r2, #33554432	; 0x2000000
+ 800b93e:	f442 4200 	orr.w	r2, r2, #32768	; 0x8000
+ 800b942:	605a      	str	r2, [r3, #4]
+  hi2c->Instance->OAR2 &= ~I2C_DUALADDRESS_ENABLE;
+ 800b944:	68da      	ldr	r2, [r3, #12]
+ 800b946:	f422 4200 	bic.w	r2, r2, #32768	; 0x8000
+ 800b94a:	60da      	str	r2, [r3, #12]
+  hi2c->Instance->OAR2 = (hi2c->Init.DualAddressMode | hi2c->Init.OwnAddress2 | (hi2c->Init.OwnAddress2Masks << 8));
+ 800b94c:	e9d4 2104 	ldrd	r2, r1, [r4, #16]
+ 800b950:	430a      	orrs	r2, r1
+ 800b952:	69a1      	ldr	r1, [r4, #24]
+ 800b954:	ea42 2201 	orr.w	r2, r2, r1, lsl #8
+ 800b958:	60da      	str	r2, [r3, #12]
+  hi2c->Instance->CR1 = (hi2c->Init.GeneralCallMode | hi2c->Init.NoStretchMode);
+ 800b95a:	e9d4 2107 	ldrd	r2, r1, [r4, #28]
+ 800b95e:	430a      	orrs	r2, r1
+ 800b960:	601a      	str	r2, [r3, #0]
+  __HAL_I2C_ENABLE(hi2c);
+ 800b962:	681a      	ldr	r2, [r3, #0]
+ 800b964:	f042 0201 	orr.w	r2, r2, #1
+ 800b968:	601a      	str	r2, [r3, #0]
+  hi2c->ErrorCode = HAL_I2C_ERROR_NONE;
+ 800b96a:	2000      	movs	r0, #0
+  hi2c->State = HAL_I2C_STATE_READY;
+ 800b96c:	2320      	movs	r3, #32
+  hi2c->ErrorCode = HAL_I2C_ERROR_NONE;
+ 800b96e:	6460      	str	r0, [r4, #68]	; 0x44
+  hi2c->State = HAL_I2C_STATE_READY;
+ 800b970:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+  hi2c->PreviousState = I2C_STATE_NONE;
+ 800b974:	6320      	str	r0, [r4, #48]	; 0x30
+  hi2c->Mode = HAL_I2C_MODE_NONE;
+ 800b976:	f884 0042 	strb.w	r0, [r4, #66]	; 0x42
+}
+ 800b97a:	bd10      	pop	{r4, pc}
+    hi2c->Instance->OAR1 = (I2C_OAR1_OA1EN | I2C_OAR1_OA1MODE | hi2c->Init.OwnAddress1);
+ 800b97c:	f442 4204 	orr.w	r2, r2, #33792	; 0x8400
+  if (hi2c->Init.AddressingMode == I2C_ADDRESSINGMODE_10BIT)
+ 800b980:	2902      	cmp	r1, #2
+    hi2c->Instance->OAR1 = (I2C_OAR1_OA1EN | I2C_OAR1_OA1MODE | hi2c->Init.OwnAddress1);
+ 800b982:	609a      	str	r2, [r3, #8]
+    hi2c->Instance->CR2 = (I2C_CR2_ADD10);
+ 800b984:	bf04      	itt	eq
+ 800b986:	f44f 6200 	moveq.w	r2, #2048	; 0x800
+ 800b98a:	605a      	streq	r2, [r3, #4]
+ 800b98c:	e7d4      	b.n	800b938 <HAL_I2C_Init+0x48>
+    return HAL_ERROR;
+ 800b98e:	2001      	movs	r0, #1
+ 800b990:	e7f3      	b.n	800b97a <HAL_I2C_Init+0x8a>
+
+0800b992 <HAL_I2C_MspDeInit>:
+ 800b992:	4770      	bx	lr
+
+0800b994 <HAL_I2C_Master_Transmit>:
+{
+ 800b994:	e92d 47f3 	stmdb	sp!, {r0, r1, r4, r5, r6, r7, r8, r9, sl, lr}
+ 800b998:	4698      	mov	r8, r3
+  if (hi2c->State == HAL_I2C_STATE_READY)
+ 800b99a:	f890 3041 	ldrb.w	r3, [r0, #65]	; 0x41
+{
+ 800b99e:	9f0a      	ldr	r7, [sp, #40]	; 0x28
+  if (hi2c->State == HAL_I2C_STATE_READY)
+ 800b9a0:	2b20      	cmp	r3, #32
+{
+ 800b9a2:	4604      	mov	r4, r0
+ 800b9a4:	460e      	mov	r6, r1
+ 800b9a6:	4691      	mov	r9, r2
+  if (hi2c->State == HAL_I2C_STATE_READY)
+ 800b9a8:	f040 80a3 	bne.w	800baf2 <HAL_I2C_Master_Transmit+0x15e>
+    __HAL_LOCK(hi2c);
+ 800b9ac:	f890 3040 	ldrb.w	r3, [r0, #64]	; 0x40
+ 800b9b0:	2b01      	cmp	r3, #1
+ 800b9b2:	f000 809e 	beq.w	800baf2 <HAL_I2C_Master_Transmit+0x15e>
+ 800b9b6:	f04f 0a01 	mov.w	sl, #1
+ 800b9ba:	f880 a040 	strb.w	sl, [r0, #64]	; 0x40
+    tickstart = HAL_GetTick();
+ 800b9be:	f7fb fbc7 	bl	8007150 <HAL_GetTick>
+    if (I2C_WaitOnFlagUntilTimeout(hi2c, I2C_FLAG_BUSY, SET, I2C_TIMEOUT_BUSY, tickstart) != HAL_OK)
+ 800b9c2:	2319      	movs	r3, #25
+    tickstart = HAL_GetTick();
+ 800b9c4:	4605      	mov	r5, r0
+    if (I2C_WaitOnFlagUntilTimeout(hi2c, I2C_FLAG_BUSY, SET, I2C_TIMEOUT_BUSY, tickstart) != HAL_OK)
+ 800b9c6:	9000      	str	r0, [sp, #0]
+ 800b9c8:	4652      	mov	r2, sl
+ 800b9ca:	f44f 4100 	mov.w	r1, #32768	; 0x8000
+ 800b9ce:	4620      	mov	r0, r4
+ 800b9d0:	f7ff ff3e 	bl	800b850 <I2C_WaitOnFlagUntilTimeout>
+ 800b9d4:	b118      	cbz	r0, 800b9de <HAL_I2C_Master_Transmit+0x4a>
+        return HAL_ERROR;
+ 800b9d6:	2001      	movs	r0, #1
+}
+ 800b9d8:	b002      	add	sp, #8
+ 800b9da:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+    hi2c->State     = HAL_I2C_STATE_BUSY_TX;
+ 800b9de:	2321      	movs	r3, #33	; 0x21
+ 800b9e0:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+    hi2c->Mode      = HAL_I2C_MODE_MASTER;
+ 800b9e4:	2310      	movs	r3, #16
+ 800b9e6:	f884 3042 	strb.w	r3, [r4, #66]	; 0x42
+    hi2c->ErrorCode = HAL_I2C_ERROR_NONE;
+ 800b9ea:	6460      	str	r0, [r4, #68]	; 0x44
+    hi2c->XferCount = Size;
+ 800b9ec:	f8a4 802a 	strh.w	r8, [r4, #42]	; 0x2a
+    if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800b9f0:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+    hi2c->pBuffPtr  = pData;
+ 800b9f2:	f8c4 9024 	str.w	r9, [r4, #36]	; 0x24
+    if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800b9f6:	b29b      	uxth	r3, r3
+ 800b9f8:	2bff      	cmp	r3, #255	; 0xff
+    hi2c->XferISR   = NULL;
+ 800b9fa:	6360      	str	r0, [r4, #52]	; 0x34
+    if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800b9fc:	4b3e      	ldr	r3, [pc, #248]	; (800baf8 <HAL_I2C_Master_Transmit+0x164>)
+ 800b9fe:	d927      	bls.n	800ba50 <HAL_I2C_Master_Transmit+0xbc>
+      hi2c->XferSize = MAX_NBYTE_SIZE;
+ 800ba00:	22ff      	movs	r2, #255	; 0xff
+ 800ba02:	8522      	strh	r2, [r4, #40]	; 0x28
+      I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_RELOAD_MODE, I2C_GENERATE_START_WRITE);
+ 800ba04:	9300      	str	r3, [sp, #0]
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_RELOAD_MODE, I2C_NO_STARTSTOP);
+ 800ba06:	f04f 7380 	mov.w	r3, #16777216	; 0x1000000
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800ba0a:	4631      	mov	r1, r6
+ 800ba0c:	4620      	mov	r0, r4
+ 800ba0e:	f7ff fec9 	bl	800b7a4 <I2C_TransferConfig>
+    while (hi2c->XferCount > 0U)
+ 800ba12:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+ 800ba14:	b29b      	uxth	r3, r3
+ 800ba16:	2b00      	cmp	r3, #0
+ 800ba18:	d13e      	bne.n	800ba98 <HAL_I2C_Master_Transmit+0x104>
+    if (I2C_WaitOnSTOPFlagUntilTimeout(hi2c, Timeout, tickstart) != HAL_OK)
+ 800ba1a:	462a      	mov	r2, r5
+ 800ba1c:	4639      	mov	r1, r7
+ 800ba1e:	4620      	mov	r0, r4
+ 800ba20:	f7ff ff40 	bl	800b8a4 <I2C_WaitOnSTOPFlagUntilTimeout>
+ 800ba24:	2800      	cmp	r0, #0
+ 800ba26:	d1d6      	bne.n	800b9d6 <HAL_I2C_Master_Transmit+0x42>
+    __HAL_I2C_CLEAR_FLAG(hi2c, I2C_FLAG_STOPF);
+ 800ba28:	6823      	ldr	r3, [r4, #0]
+ 800ba2a:	2120      	movs	r1, #32
+ 800ba2c:	61d9      	str	r1, [r3, #28]
+    I2C_RESET_CR2(hi2c);
+ 800ba2e:	685a      	ldr	r2, [r3, #4]
+ 800ba30:	f022 72ff 	bic.w	r2, r2, #33423360	; 0x1fe0000
+ 800ba34:	f422 328b 	bic.w	r2, r2, #71168	; 0x11600
+ 800ba38:	f422 72ff 	bic.w	r2, r2, #510	; 0x1fe
+ 800ba3c:	f022 0201 	bic.w	r2, r2, #1
+ 800ba40:	605a      	str	r2, [r3, #4]
+    hi2c->State = HAL_I2C_STATE_READY;
+ 800ba42:	f884 1041 	strb.w	r1, [r4, #65]	; 0x41
+    __HAL_UNLOCK(hi2c);
+ 800ba46:	f884 0040 	strb.w	r0, [r4, #64]	; 0x40
+    hi2c->Mode  = HAL_I2C_MODE_NONE;
+ 800ba4a:	f884 0042 	strb.w	r0, [r4, #66]	; 0x42
+    return HAL_OK;
+ 800ba4e:	e7c3      	b.n	800b9d8 <HAL_I2C_Master_Transmit+0x44>
+      hi2c->XferSize = hi2c->XferCount;
+ 800ba50:	8d62      	ldrh	r2, [r4, #42]	; 0x2a
+      I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_GENERATE_START_WRITE);
+ 800ba52:	9300      	str	r3, [sp, #0]
+      hi2c->XferSize = hi2c->XferCount;
+ 800ba54:	b292      	uxth	r2, r2
+ 800ba56:	8522      	strh	r2, [r4, #40]	; 0x28
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800ba58:	f04f 7300 	mov.w	r3, #33554432	; 0x2000000
+ 800ba5c:	b2d2      	uxtb	r2, r2
+ 800ba5e:	e7d4      	b.n	800ba0a <HAL_I2C_Master_Transmit+0x76>
+    if (I2C_IsAcknowledgeFailed(hi2c, Timeout, Tickstart) != HAL_OK)
+ 800ba60:	462a      	mov	r2, r5
+ 800ba62:	4639      	mov	r1, r7
+ 800ba64:	4620      	mov	r0, r4
+ 800ba66:	f7ff feb1 	bl	800b7cc <I2C_IsAcknowledgeFailed>
+ 800ba6a:	2800      	cmp	r0, #0
+ 800ba6c:	d1b3      	bne.n	800b9d6 <HAL_I2C_Master_Transmit+0x42>
+    if (Timeout != HAL_MAX_DELAY)
+ 800ba6e:	1c7a      	adds	r2, r7, #1
+ 800ba70:	d012      	beq.n	800ba98 <HAL_I2C_Master_Transmit+0x104>
+      if (((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 800ba72:	f7fb fb6d 	bl	8007150 <HAL_GetTick>
+ 800ba76:	1b40      	subs	r0, r0, r5
+ 800ba78:	4287      	cmp	r7, r0
+ 800ba7a:	d300      	bcc.n	800ba7e <HAL_I2C_Master_Transmit+0xea>
+ 800ba7c:	b967      	cbnz	r7, 800ba98 <HAL_I2C_Master_Transmit+0x104>
+        hi2c->ErrorCode |= HAL_I2C_ERROR_TIMEOUT;
+ 800ba7e:	6c63      	ldr	r3, [r4, #68]	; 0x44
+ 800ba80:	f043 0320 	orr.w	r3, r3, #32
+ 800ba84:	6463      	str	r3, [r4, #68]	; 0x44
+        hi2c->State = HAL_I2C_STATE_READY;
+ 800ba86:	2320      	movs	r3, #32
+ 800ba88:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+        hi2c->Mode = HAL_I2C_MODE_NONE;
+ 800ba8c:	2300      	movs	r3, #0
+ 800ba8e:	f884 3042 	strb.w	r3, [r4, #66]	; 0x42
+        __HAL_UNLOCK(hi2c);
+ 800ba92:	f884 3040 	strb.w	r3, [r4, #64]	; 0x40
+ 800ba96:	e79e      	b.n	800b9d6 <HAL_I2C_Master_Transmit+0x42>
+  while (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_TXIS) == RESET)
+ 800ba98:	6822      	ldr	r2, [r4, #0]
+ 800ba9a:	6993      	ldr	r3, [r2, #24]
+ 800ba9c:	079b      	lsls	r3, r3, #30
+ 800ba9e:	d5df      	bpl.n	800ba60 <HAL_I2C_Master_Transmit+0xcc>
+      hi2c->Instance->TXDR = *hi2c->pBuffPtr;
+ 800baa0:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 800baa2:	f813 1b01 	ldrb.w	r1, [r3], #1
+ 800baa6:	6291      	str	r1, [r2, #40]	; 0x28
+      hi2c->pBuffPtr++;
+ 800baa8:	6263      	str	r3, [r4, #36]	; 0x24
+      hi2c->XferCount--;
+ 800baaa:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+      hi2c->XferSize--;
+ 800baac:	8d22      	ldrh	r2, [r4, #40]	; 0x28
+      hi2c->XferCount--;
+ 800baae:	3b01      	subs	r3, #1
+ 800bab0:	b29b      	uxth	r3, r3
+ 800bab2:	8563      	strh	r3, [r4, #42]	; 0x2a
+      if ((hi2c->XferCount != 0U) && (hi2c->XferSize == 0U))
+ 800bab4:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+      hi2c->XferSize--;
+ 800bab6:	3a01      	subs	r2, #1
+ 800bab8:	b292      	uxth	r2, r2
+      if ((hi2c->XferCount != 0U) && (hi2c->XferSize == 0U))
+ 800baba:	b29b      	uxth	r3, r3
+      hi2c->XferSize--;
+ 800babc:	8522      	strh	r2, [r4, #40]	; 0x28
+      if ((hi2c->XferCount != 0U) && (hi2c->XferSize == 0U))
+ 800babe:	2b00      	cmp	r3, #0
+ 800bac0:	d0a7      	beq.n	800ba12 <HAL_I2C_Master_Transmit+0x7e>
+ 800bac2:	2a00      	cmp	r2, #0
+ 800bac4:	d1a5      	bne.n	800ba12 <HAL_I2C_Master_Transmit+0x7e>
+        if (I2C_WaitOnFlagUntilTimeout(hi2c, I2C_FLAG_TCR, RESET, Timeout, tickstart) != HAL_OK)
+ 800bac6:	9500      	str	r5, [sp, #0]
+ 800bac8:	463b      	mov	r3, r7
+ 800baca:	2180      	movs	r1, #128	; 0x80
+ 800bacc:	4620      	mov	r0, r4
+ 800bace:	f7ff febf 	bl	800b850 <I2C_WaitOnFlagUntilTimeout>
+ 800bad2:	2800      	cmp	r0, #0
+ 800bad4:	f47f af7f 	bne.w	800b9d6 <HAL_I2C_Master_Transmit+0x42>
+        if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800bad8:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+ 800bada:	b29b      	uxth	r3, r3
+ 800badc:	2bff      	cmp	r3, #255	; 0xff
+ 800bade:	d903      	bls.n	800bae8 <HAL_I2C_Master_Transmit+0x154>
+          hi2c->XferSize = MAX_NBYTE_SIZE;
+ 800bae0:	22ff      	movs	r2, #255	; 0xff
+ 800bae2:	8522      	strh	r2, [r4, #40]	; 0x28
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_RELOAD_MODE, I2C_NO_STARTSTOP);
+ 800bae4:	9000      	str	r0, [sp, #0]
+ 800bae6:	e78e      	b.n	800ba06 <HAL_I2C_Master_Transmit+0x72>
+          hi2c->XferSize = hi2c->XferCount;
+ 800bae8:	8d62      	ldrh	r2, [r4, #42]	; 0x2a
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800baea:	9000      	str	r0, [sp, #0]
+          hi2c->XferSize = hi2c->XferCount;
+ 800baec:	b292      	uxth	r2, r2
+ 800baee:	8522      	strh	r2, [r4, #40]	; 0x28
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800baf0:	e7b2      	b.n	800ba58 <HAL_I2C_Master_Transmit+0xc4>
+    return HAL_BUSY;
+ 800baf2:	2002      	movs	r0, #2
+ 800baf4:	e770      	b.n	800b9d8 <HAL_I2C_Master_Transmit+0x44>
+ 800baf6:	bf00      	nop
+ 800baf8:	80002000 	.word	0x80002000
+
+0800bafc <HAL_I2C_Master_Receive>:
+{
+ 800bafc:	e92d 47f3 	stmdb	sp!, {r0, r1, r4, r5, r6, r7, r8, r9, sl, lr}
+ 800bb00:	4698      	mov	r8, r3
+  if (hi2c->State == HAL_I2C_STATE_READY)
+ 800bb02:	f890 3041 	ldrb.w	r3, [r0, #65]	; 0x41
+{
+ 800bb06:	9f0a      	ldr	r7, [sp, #40]	; 0x28
+  if (hi2c->State == HAL_I2C_STATE_READY)
+ 800bb08:	2b20      	cmp	r3, #32
+{
+ 800bb0a:	4604      	mov	r4, r0
+ 800bb0c:	460e      	mov	r6, r1
+ 800bb0e:	4691      	mov	r9, r2
+  if (hi2c->State == HAL_I2C_STATE_READY)
+ 800bb10:	f040 80be 	bne.w	800bc90 <HAL_I2C_Master_Receive+0x194>
+    __HAL_LOCK(hi2c);
+ 800bb14:	f890 3040 	ldrb.w	r3, [r0, #64]	; 0x40
+ 800bb18:	2b01      	cmp	r3, #1
+ 800bb1a:	f000 80b9 	beq.w	800bc90 <HAL_I2C_Master_Receive+0x194>
+ 800bb1e:	f04f 0a01 	mov.w	sl, #1
+ 800bb22:	f880 a040 	strb.w	sl, [r0, #64]	; 0x40
+    tickstart = HAL_GetTick();
+ 800bb26:	f7fb fb13 	bl	8007150 <HAL_GetTick>
+    if (I2C_WaitOnFlagUntilTimeout(hi2c, I2C_FLAG_BUSY, SET, I2C_TIMEOUT_BUSY, tickstart) != HAL_OK)
+ 800bb2a:	2319      	movs	r3, #25
+    tickstart = HAL_GetTick();
+ 800bb2c:	4605      	mov	r5, r0
+    if (I2C_WaitOnFlagUntilTimeout(hi2c, I2C_FLAG_BUSY, SET, I2C_TIMEOUT_BUSY, tickstart) != HAL_OK)
+ 800bb2e:	9000      	str	r0, [sp, #0]
+ 800bb30:	4652      	mov	r2, sl
+ 800bb32:	f44f 4100 	mov.w	r1, #32768	; 0x8000
+ 800bb36:	4620      	mov	r0, r4
+ 800bb38:	f7ff fe8a 	bl	800b850 <I2C_WaitOnFlagUntilTimeout>
+ 800bb3c:	b118      	cbz	r0, 800bb46 <HAL_I2C_Master_Receive+0x4a>
+        return HAL_ERROR;
+ 800bb3e:	2001      	movs	r0, #1
+}
+ 800bb40:	b002      	add	sp, #8
+ 800bb42:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+    hi2c->State     = HAL_I2C_STATE_BUSY_RX;
+ 800bb46:	2322      	movs	r3, #34	; 0x22
+ 800bb48:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+    hi2c->Mode      = HAL_I2C_MODE_MASTER;
+ 800bb4c:	2310      	movs	r3, #16
+ 800bb4e:	f884 3042 	strb.w	r3, [r4, #66]	; 0x42
+    hi2c->ErrorCode = HAL_I2C_ERROR_NONE;
+ 800bb52:	6460      	str	r0, [r4, #68]	; 0x44
+    hi2c->XferCount = Size;
+ 800bb54:	f8a4 802a 	strh.w	r8, [r4, #42]	; 0x2a
+    if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800bb58:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+    hi2c->pBuffPtr  = pData;
+ 800bb5a:	f8c4 9024 	str.w	r9, [r4, #36]	; 0x24
+    if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800bb5e:	b29b      	uxth	r3, r3
+ 800bb60:	2bff      	cmp	r3, #255	; 0xff
+    hi2c->XferISR   = NULL;
+ 800bb62:	6360      	str	r0, [r4, #52]	; 0x34
+    if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800bb64:	4b4b      	ldr	r3, [pc, #300]	; (800bc94 <HAL_I2C_Master_Receive+0x198>)
+ 800bb66:	d909      	bls.n	800bb7c <HAL_I2C_Master_Receive+0x80>
+      hi2c->XferSize = MAX_NBYTE_SIZE;
+ 800bb68:	22ff      	movs	r2, #255	; 0xff
+ 800bb6a:	8522      	strh	r2, [r4, #40]	; 0x28
+      I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_RELOAD_MODE, I2C_GENERATE_START_READ);
+ 800bb6c:	9300      	str	r3, [sp, #0]
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_RELOAD_MODE, I2C_NO_STARTSTOP);
+ 800bb6e:	f04f 7380 	mov.w	r3, #16777216	; 0x1000000
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800bb72:	4631      	mov	r1, r6
+ 800bb74:	4620      	mov	r0, r4
+ 800bb76:	f7ff fe15 	bl	800b7a4 <I2C_TransferConfig>
+ 800bb7a:	e052      	b.n	800bc22 <HAL_I2C_Master_Receive+0x126>
+      hi2c->XferSize = hi2c->XferCount;
+ 800bb7c:	8d62      	ldrh	r2, [r4, #42]	; 0x2a
+      I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_GENERATE_START_READ);
+ 800bb7e:	9300      	str	r3, [sp, #0]
+      hi2c->XferSize = hi2c->XferCount;
+ 800bb80:	b292      	uxth	r2, r2
+ 800bb82:	8522      	strh	r2, [r4, #40]	; 0x28
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800bb84:	f04f 7300 	mov.w	r3, #33554432	; 0x2000000
+ 800bb88:	b2d2      	uxtb	r2, r2
+ 800bb8a:	e7f2      	b.n	800bb72 <HAL_I2C_Master_Receive+0x76>
+        __HAL_I2C_CLEAR_FLAG(hi2c, I2C_FLAG_STOPF);
+ 800bb8c:	2120      	movs	r1, #32
+ 800bb8e:	61d9      	str	r1, [r3, #28]
+        I2C_RESET_CR2(hi2c);
+ 800bb90:	685a      	ldr	r2, [r3, #4]
+ 800bb92:	f022 72ff 	bic.w	r2, r2, #33423360	; 0x1fe0000
+ 800bb96:	f422 328b 	bic.w	r2, r2, #71168	; 0x11600
+ 800bb9a:	f422 72ff 	bic.w	r2, r2, #510	; 0x1fe
+ 800bb9e:	f022 0201 	bic.w	r2, r2, #1
+ 800bba2:	605a      	str	r2, [r3, #4]
+        hi2c->ErrorCode = HAL_I2C_ERROR_NONE;
+ 800bba4:	2300      	movs	r3, #0
+ 800bba6:	6463      	str	r3, [r4, #68]	; 0x44
+        hi2c->State = HAL_I2C_STATE_READY;
+ 800bba8:	f884 1041 	strb.w	r1, [r4, #65]	; 0x41
+        hi2c->Mode = HAL_I2C_MODE_NONE;
+ 800bbac:	f884 3042 	strb.w	r3, [r4, #66]	; 0x42
+      __HAL_UNLOCK(hi2c);
+ 800bbb0:	f884 3040 	strb.w	r3, [r4, #64]	; 0x40
+ 800bbb4:	e7c3      	b.n	800bb3e <HAL_I2C_Master_Receive+0x42>
+    if (((HAL_GetTick() - Tickstart) > Timeout) || (Timeout == 0U))
+ 800bbb6:	f7fb facb 	bl	8007150 <HAL_GetTick>
+ 800bbba:	1b40      	subs	r0, r0, r5
+ 800bbbc:	4287      	cmp	r7, r0
+ 800bbbe:	d300      	bcc.n	800bbc2 <HAL_I2C_Master_Receive+0xc6>
+ 800bbc0:	b947      	cbnz	r7, 800bbd4 <HAL_I2C_Master_Receive+0xd8>
+      hi2c->ErrorCode |= HAL_I2C_ERROR_TIMEOUT;
+ 800bbc2:	6c63      	ldr	r3, [r4, #68]	; 0x44
+ 800bbc4:	f043 0320 	orr.w	r3, r3, #32
+ 800bbc8:	6463      	str	r3, [r4, #68]	; 0x44
+      hi2c->State = HAL_I2C_STATE_READY;
+ 800bbca:	2320      	movs	r3, #32
+ 800bbcc:	f884 3041 	strb.w	r3, [r4, #65]	; 0x41
+      __HAL_UNLOCK(hi2c);
+ 800bbd0:	2300      	movs	r3, #0
+ 800bbd2:	e7ed      	b.n	800bbb0 <HAL_I2C_Master_Receive+0xb4>
+  while (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_RXNE) == RESET)
+ 800bbd4:	6823      	ldr	r3, [r4, #0]
+ 800bbd6:	699b      	ldr	r3, [r3, #24]
+ 800bbd8:	075b      	lsls	r3, r3, #29
+ 800bbda:	d410      	bmi.n	800bbfe <HAL_I2C_Master_Receive+0x102>
+    if (I2C_IsAcknowledgeFailed(hi2c, Timeout, Tickstart) != HAL_OK)
+ 800bbdc:	462a      	mov	r2, r5
+ 800bbde:	4639      	mov	r1, r7
+ 800bbe0:	4620      	mov	r0, r4
+ 800bbe2:	f7ff fdf3 	bl	800b7cc <I2C_IsAcknowledgeFailed>
+ 800bbe6:	2800      	cmp	r0, #0
+ 800bbe8:	d1a9      	bne.n	800bb3e <HAL_I2C_Master_Receive+0x42>
+    if (__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_STOPF) == SET)
+ 800bbea:	6823      	ldr	r3, [r4, #0]
+ 800bbec:	699a      	ldr	r2, [r3, #24]
+ 800bbee:	0691      	lsls	r1, r2, #26
+ 800bbf0:	d5e1      	bpl.n	800bbb6 <HAL_I2C_Master_Receive+0xba>
+      if ((__HAL_I2C_GET_FLAG(hi2c, I2C_FLAG_RXNE) == SET) && (hi2c->XferSize > 0U))
+ 800bbf2:	699a      	ldr	r2, [r3, #24]
+ 800bbf4:	0752      	lsls	r2, r2, #29
+ 800bbf6:	d5c9      	bpl.n	800bb8c <HAL_I2C_Master_Receive+0x90>
+ 800bbf8:	8d22      	ldrh	r2, [r4, #40]	; 0x28
+ 800bbfa:	2a00      	cmp	r2, #0
+ 800bbfc:	d0c6      	beq.n	800bb8c <HAL_I2C_Master_Receive+0x90>
+      *hi2c->pBuffPtr = (uint8_t)hi2c->Instance->RXDR;
+ 800bbfe:	6823      	ldr	r3, [r4, #0]
+ 800bc00:	6a5a      	ldr	r2, [r3, #36]	; 0x24
+ 800bc02:	6a63      	ldr	r3, [r4, #36]	; 0x24
+ 800bc04:	701a      	strb	r2, [r3, #0]
+      hi2c->pBuffPtr++;
+ 800bc06:	6a63      	ldr	r3, [r4, #36]	; 0x24
+      hi2c->XferSize--;
+ 800bc08:	8d22      	ldrh	r2, [r4, #40]	; 0x28
+      hi2c->pBuffPtr++;
+ 800bc0a:	3301      	adds	r3, #1
+ 800bc0c:	6263      	str	r3, [r4, #36]	; 0x24
+      hi2c->XferCount--;
+ 800bc0e:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+ 800bc10:	3b01      	subs	r3, #1
+ 800bc12:	b29b      	uxth	r3, r3
+ 800bc14:	8563      	strh	r3, [r4, #42]	; 0x2a
+      if ((hi2c->XferCount != 0U) && (hi2c->XferSize == 0U))
+ 800bc16:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+      hi2c->XferSize--;
+ 800bc18:	3a01      	subs	r2, #1
+ 800bc1a:	b292      	uxth	r2, r2
+      if ((hi2c->XferCount != 0U) && (hi2c->XferSize == 0U))
+ 800bc1c:	b29b      	uxth	r3, r3
+      hi2c->XferSize--;
+ 800bc1e:	8522      	strh	r2, [r4, #40]	; 0x28
+      if ((hi2c->XferCount != 0U) && (hi2c->XferSize == 0U))
+ 800bc20:	b9f3      	cbnz	r3, 800bc60 <HAL_I2C_Master_Receive+0x164>
+    while (hi2c->XferCount > 0U)
+ 800bc22:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+ 800bc24:	b29b      	uxth	r3, r3
+ 800bc26:	2b00      	cmp	r3, #0
+ 800bc28:	d1d4      	bne.n	800bbd4 <HAL_I2C_Master_Receive+0xd8>
+    if (I2C_WaitOnSTOPFlagUntilTimeout(hi2c, Timeout, tickstart) != HAL_OK)
+ 800bc2a:	462a      	mov	r2, r5
+ 800bc2c:	4639      	mov	r1, r7
+ 800bc2e:	4620      	mov	r0, r4
+ 800bc30:	f7ff fe38 	bl	800b8a4 <I2C_WaitOnSTOPFlagUntilTimeout>
+ 800bc34:	2800      	cmp	r0, #0
+ 800bc36:	d182      	bne.n	800bb3e <HAL_I2C_Master_Receive+0x42>
+    __HAL_I2C_CLEAR_FLAG(hi2c, I2C_FLAG_STOPF);
+ 800bc38:	6823      	ldr	r3, [r4, #0]
+ 800bc3a:	2120      	movs	r1, #32
+ 800bc3c:	61d9      	str	r1, [r3, #28]
+    I2C_RESET_CR2(hi2c);
+ 800bc3e:	685a      	ldr	r2, [r3, #4]
+ 800bc40:	f022 72ff 	bic.w	r2, r2, #33423360	; 0x1fe0000
+ 800bc44:	f422 328b 	bic.w	r2, r2, #71168	; 0x11600
+ 800bc48:	f422 72ff 	bic.w	r2, r2, #510	; 0x1fe
+ 800bc4c:	f022 0201 	bic.w	r2, r2, #1
+ 800bc50:	605a      	str	r2, [r3, #4]
+    hi2c->State = HAL_I2C_STATE_READY;
+ 800bc52:	f884 1041 	strb.w	r1, [r4, #65]	; 0x41
+    __HAL_UNLOCK(hi2c);
+ 800bc56:	f884 0040 	strb.w	r0, [r4, #64]	; 0x40
+    hi2c->Mode  = HAL_I2C_MODE_NONE;
+ 800bc5a:	f884 0042 	strb.w	r0, [r4, #66]	; 0x42
+    return HAL_OK;
+ 800bc5e:	e76f      	b.n	800bb40 <HAL_I2C_Master_Receive+0x44>
+      if ((hi2c->XferCount != 0U) && (hi2c->XferSize == 0U))
+ 800bc60:	2a00      	cmp	r2, #0
+ 800bc62:	d1de      	bne.n	800bc22 <HAL_I2C_Master_Receive+0x126>
+        if (I2C_WaitOnFlagUntilTimeout(hi2c, I2C_FLAG_TCR, RESET, Timeout, tickstart) != HAL_OK)
+ 800bc64:	9500      	str	r5, [sp, #0]
+ 800bc66:	463b      	mov	r3, r7
+ 800bc68:	2180      	movs	r1, #128	; 0x80
+ 800bc6a:	4620      	mov	r0, r4
+ 800bc6c:	f7ff fdf0 	bl	800b850 <I2C_WaitOnFlagUntilTimeout>
+ 800bc70:	2800      	cmp	r0, #0
+ 800bc72:	f47f af64 	bne.w	800bb3e <HAL_I2C_Master_Receive+0x42>
+        if (hi2c->XferCount > MAX_NBYTE_SIZE)
+ 800bc76:	8d63      	ldrh	r3, [r4, #42]	; 0x2a
+ 800bc78:	b29b      	uxth	r3, r3
+ 800bc7a:	2bff      	cmp	r3, #255	; 0xff
+ 800bc7c:	d903      	bls.n	800bc86 <HAL_I2C_Master_Receive+0x18a>
+          hi2c->XferSize = MAX_NBYTE_SIZE;
+ 800bc7e:	22ff      	movs	r2, #255	; 0xff
+ 800bc80:	8522      	strh	r2, [r4, #40]	; 0x28
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_RELOAD_MODE, I2C_NO_STARTSTOP);
+ 800bc82:	9000      	str	r0, [sp, #0]
+ 800bc84:	e773      	b.n	800bb6e <HAL_I2C_Master_Receive+0x72>
+          hi2c->XferSize = hi2c->XferCount;
+ 800bc86:	8d62      	ldrh	r2, [r4, #42]	; 0x2a
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800bc88:	9000      	str	r0, [sp, #0]
+          hi2c->XferSize = hi2c->XferCount;
+ 800bc8a:	b292      	uxth	r2, r2
+ 800bc8c:	8522      	strh	r2, [r4, #40]	; 0x28
+          I2C_TransferConfig(hi2c, DevAddress, (uint8_t)hi2c->XferSize, I2C_AUTOEND_MODE, I2C_NO_STARTSTOP);
+ 800bc8e:	e779      	b.n	800bb84 <HAL_I2C_Master_Receive+0x88>
+    return HAL_BUSY;
+ 800bc90:	2002      	movs	r0, #2
+ 800bc92:	e755      	b.n	800bb40 <HAL_I2C_Master_Receive+0x44>
+ 800bc94:	80002400 	.word	0x80002400
+
+0800bc98 <SD_FindSCR>:
+  * @param  hsd Pointer to SD handle
+  * @param  pSCR pointer to the buffer that will contain the SCR value
+  * @retval error state
+  */
+static uint32_t SD_FindSCR(SD_HandleTypeDef *hsd, uint32_t *pSCR)
+{
+ 800bc98:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+ 800bc9c:	b086      	sub	sp, #24
+ 800bc9e:	4605      	mov	r5, r0
+ 800bca0:	4688      	mov	r8, r1
+  SDMMC_DataInitTypeDef config;
+  uint32_t errorstate;
+  uint32_t tickstart = HAL_GetTick();
+ 800bca2:	f7fb fa55 	bl	8007150 <HAL_GetTick>
+  uint32_t index = 0U;
+  uint32_t tempscr[2U] = {0UL, 0UL};
+  uint32_t *scr = pSCR;
+
+  /* Set Block Size To 8 Bytes */
+  errorstate = SDMMC_CmdBlockLength(hsd->Instance, 8U);
+ 800bca6:	2108      	movs	r1, #8
+  uint32_t tickstart = HAL_GetTick();
+ 800bca8:	4681      	mov	r9, r0
+  errorstate = SDMMC_CmdBlockLength(hsd->Instance, 8U);
+ 800bcaa:	6828      	ldr	r0, [r5, #0]
+ 800bcac:	f001 f996 	bl	800cfdc <SDMMC_CmdBlockLength>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800bcb0:	4604      	mov	r4, r0
+ 800bcb2:	bb48      	cbnz	r0, 800bd08 <SD_FindSCR+0x70>
+  {
+    return errorstate;
+  }
+
+  /* Send CMD55 APP_CMD with argument as card's RCA */
+  errorstate = SDMMC_CmdAppCommand(hsd->Instance, (uint32_t)((hsd->SdCard.RelCardAdd) << 16U));
+ 800bcb4:	6ca9      	ldr	r1, [r5, #72]	; 0x48
+ 800bcb6:	6828      	ldr	r0, [r5, #0]
+ 800bcb8:	0409      	lsls	r1, r1, #16
+ 800bcba:	f001 fac8 	bl	800d24e <SDMMC_CmdAppCommand>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800bcbe:	4604      	mov	r4, r0
+ 800bcc0:	bb10      	cbnz	r0, 800bd08 <SD_FindSCR+0x70>
+  {
+    return errorstate;
+  }
+
+  config.DataTimeOut   = SDMMC_DATATIMEOUT;
+  config.DataLength    = 8U;
+ 800bcc2:	f04f 30ff 	mov.w	r0, #4294967295	; 0xffffffff
+ 800bcc6:	2308      	movs	r3, #8
+ 800bcc8:	e9cd 0300 	strd	r0, r3, [sp]
+  config.DataBlockSize = SDMMC_DATABLOCK_SIZE_8B;
+  config.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800bccc:	2630      	movs	r6, #48	; 0x30
+ 800bcce:	2302      	movs	r3, #2
+ 800bcd0:	e9cd 6302 	strd	r6, r3, [sp, #8]
+  config.TransferMode  = SDMMC_TRANSFER_MODE_BLOCK;
+  config.DPSM          = SDMMC_DPSM_ENABLE;
+  (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800bcd4:	4669      	mov	r1, sp
+  config.DPSM          = SDMMC_DPSM_ENABLE;
+ 800bcd6:	2301      	movs	r3, #1
+  (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800bcd8:	6828      	ldr	r0, [r5, #0]
+  config.TransferMode  = SDMMC_TRANSFER_MODE_BLOCK;
+ 800bcda:	9404      	str	r4, [sp, #16]
+  config.DPSM          = SDMMC_DPSM_ENABLE;
+ 800bcdc:	9305      	str	r3, [sp, #20]
+  (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800bcde:	f001 f8a1 	bl	800ce24 <SDMMC_ConfigData>
+
+  /* Send ACMD51 SD_APP_SEND_SCR with argument as 0 */
+  errorstate = SDMMC_CmdSendSCR(hsd->Instance);
+ 800bce2:	6828      	ldr	r0, [r5, #0]
+ 800bce4:	f001 fae7 	bl	800d2b6 <SDMMC_CmdSendSCR>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800bce8:	4604      	mov	r4, r0
+ 800bcea:	b968      	cbnz	r0, 800bd08 <SD_FindSCR+0x70>
+  uint32_t tempscr[2U] = {0UL, 0UL};
+ 800bcec:	4607      	mov	r7, r0
+ 800bcee:	4606      	mov	r6, r0
+  {
+    return errorstate;
+  }
+
+#if defined(STM32L4P5xx) || defined(STM32L4Q5xx) || defined(STM32L4R5xx) || defined(STM32L4R7xx) || defined(STM32L4R9xx) || defined(STM32L4S5xx) || defined(STM32L4S7xx) || defined(STM32L4S9xx)
+  while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DBCKEND | SDMMC_FLAG_DATAEND))
+ 800bcf0:	f240 5a2a 	movw	sl, #1322	; 0x52a
+ 800bcf4:	6828      	ldr	r0, [r5, #0]
+ 800bcf6:	6b42      	ldr	r2, [r0, #52]	; 0x34
+ 800bcf8:	ea12 0f0a 	tst.w	r2, sl
+  {
+    if((!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXFIFOE)) && (index == 0U))
+ 800bcfc:	6b42      	ldr	r2, [r0, #52]	; 0x34
+  while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DBCKEND | SDMMC_FLAG_DATAEND))
+ 800bcfe:	d007      	beq.n	800bd10 <SD_FindSCR+0x78>
+      return HAL_SD_ERROR_TIMEOUT;
+    }
+  }
+#endif /* STM32L4P5xx || STM32L4Q5xx || STM32L4R5xx || STM32L4R7xx || STM32L4R9xx || STM32L4S5xx || STM32L4S7xx || STM32L4S9xx */
+
+  if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DTIMEOUT))
+ 800bd00:	0712      	lsls	r2, r2, #28
+ 800bd02:	d519      	bpl.n	800bd38 <SD_FindSCR+0xa0>
+  {
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DTIMEOUT);
+ 800bd04:	2408      	movs	r4, #8
+
+    return HAL_SD_ERROR_DATA_CRC_FAIL;
+  }
+  else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+  {
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800bd06:	6384      	str	r4, [r0, #56]	; 0x38
+            ((tempscr[0] & SDMMC_16TO23BITS) >> 8) | ((tempscr[0] & SDMMC_24TO31BITS) >> 24));
+
+  }
+
+  return HAL_SD_ERROR_NONE;
+}
+ 800bd08:	4620      	mov	r0, r4
+ 800bd0a:	b006      	add	sp, #24
+ 800bd0c:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+    if((!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXFIFOE)) && (index == 0U))
+ 800bd10:	0311      	lsls	r1, r2, #12
+ 800bd12:	d408      	bmi.n	800bd26 <SD_FindSCR+0x8e>
+ 800bd14:	b93c      	cbnz	r4, 800bd26 <SD_FindSCR+0x8e>
+      tempscr[0] = SDMMC_ReadFIFO(hsd->Instance);
+ 800bd16:	f001 f849 	bl	800cdac <SDMMC_ReadFIFO>
+ 800bd1a:	4606      	mov	r6, r0
+      tempscr[1] = SDMMC_ReadFIFO(hsd->Instance);
+ 800bd1c:	6828      	ldr	r0, [r5, #0]
+ 800bd1e:	f001 f845 	bl	800cdac <SDMMC_ReadFIFO>
+      index++;
+ 800bd22:	2401      	movs	r4, #1
+      tempscr[1] = SDMMC_ReadFIFO(hsd->Instance);
+ 800bd24:	4607      	mov	r7, r0
+    if((HAL_GetTick() - tickstart) >=  SDMMC_DATATIMEOUT)
+ 800bd26:	f7fb fa13 	bl	8007150 <HAL_GetTick>
+ 800bd2a:	eba0 0009 	sub.w	r0, r0, r9
+ 800bd2e:	3001      	adds	r0, #1
+ 800bd30:	d1e0      	bne.n	800bcf4 <SD_FindSCR+0x5c>
+      return HAL_SD_ERROR_TIMEOUT;
+ 800bd32:	f04f 4400 	mov.w	r4, #2147483648	; 0x80000000
+ 800bd36:	e7e7      	b.n	800bd08 <SD_FindSCR+0x70>
+  else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DCRCFAIL))
+ 800bd38:	6b42      	ldr	r2, [r0, #52]	; 0x34
+ 800bd3a:	0793      	lsls	r3, r2, #30
+ 800bd3c:	d501      	bpl.n	800bd42 <SD_FindSCR+0xaa>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DCRCFAIL);
+ 800bd3e:	2402      	movs	r4, #2
+ 800bd40:	e7e1      	b.n	800bd06 <SD_FindSCR+0x6e>
+  else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+ 800bd42:	6b44      	ldr	r4, [r0, #52]	; 0x34
+ 800bd44:	f014 0420 	ands.w	r4, r4, #32
+ 800bd48:	d001      	beq.n	800bd4e <SD_FindSCR+0xb6>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800bd4a:	2420      	movs	r4, #32
+ 800bd4c:	e7db      	b.n	800bd06 <SD_FindSCR+0x6e>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_DATA_FLAGS);
+ 800bd4e:	4a04      	ldr	r2, [pc, #16]	; (800bd60 <SD_FindSCR+0xc8>)
+ 800bd50:	6382      	str	r2, [r0, #56]	; 0x38
+    *scr = (((tempscr[1] & SDMMC_0TO7BITS) << 24)  | ((tempscr[1] & SDMMC_8TO15BITS) << 8) |\
+ 800bd52:	ba3f      	rev	r7, r7
+ 800bd54:	ba36      	rev	r6, r6
+ 800bd56:	f8c8 7000 	str.w	r7, [r8]
+    *scr = (((tempscr[0] & SDMMC_0TO7BITS) << 24)  | ((tempscr[0] & SDMMC_8TO15BITS) << 8) |\
+ 800bd5a:	f8c8 6004 	str.w	r6, [r8, #4]
+  return HAL_SD_ERROR_NONE;
+ 800bd5e:	e7d3      	b.n	800bd08 <SD_FindSCR+0x70>
+ 800bd60:	18000f3a 	.word	0x18000f3a
+
+0800bd64 <SD_UltraHighSpeed>:
+  *         of PLL to have SDMMCCK clock between 50 and 120 MHz
+  * @param  hsd SD handle
+  * @retval SD Card error state
+  */
+static uint32_t SD_UltraHighSpeed(SD_HandleTypeDef *hsd)
+{
+ 800bd64:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+  uint32_t errorstate = HAL_SD_ERROR_NONE;
+  SDMMC_DataInitTypeDef sdmmc_datainitstructure;
+  uint32_t SD_hs[16]  = {0};
+ 800bd68:	2640      	movs	r6, #64	; 0x40
+{
+ 800bd6a:	b096      	sub	sp, #88	; 0x58
+ 800bd6c:	4605      	mov	r5, r0
+  uint32_t SD_hs[16]  = {0};
+ 800bd6e:	4632      	mov	r2, r6
+ 800bd70:	2100      	movs	r1, #0
+ 800bd72:	a806      	add	r0, sp, #24
+ 800bd74:	f001 fcb0 	bl	800d6d8 <memset>
+  uint32_t count, loop = 0 ;
+  uint32_t Timeout = HAL_GetTick();
+ 800bd78:	f7fb f9ea 	bl	8007150 <HAL_GetTick>
+
+  if(hsd->SdCard.CardSpeed == CARD_NORMAL_SPEED)
+ 800bd7c:	6deb      	ldr	r3, [r5, #92]	; 0x5c
+  uint32_t Timeout = HAL_GetTick();
+ 800bd7e:	4680      	mov	r8, r0
+  if(hsd->SdCard.CardSpeed == CARD_NORMAL_SPEED)
+ 800bd80:	2b00      	cmp	r3, #0
+ 800bd82:	d067      	beq.n	800be54 <SD_UltraHighSpeed+0xf0>
+  {
+     /* Standard Speed Card <= 12.5Mhz  */
+     return HAL_SD_ERROR_REQUEST_NOT_APPLICABLE;
+  }
+
+  if((hsd->SdCard.CardSpeed == CARD_ULTRA_HIGH_SPEED) &&
+ 800bd84:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 800bd88:	d167      	bne.n	800be5a <SD_UltraHighSpeed+0xf6>
+ 800bd8a:	69af      	ldr	r7, [r5, #24]
+ 800bd8c:	2f01      	cmp	r7, #1
+ 800bd8e:	d164      	bne.n	800be5a <SD_UltraHighSpeed+0xf6>
+     (hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE))
+  {
+    /* Initialize the Data control register */
+    hsd->Instance->DCTRL = 0;
+ 800bd90:	6828      	ldr	r0, [r5, #0]
+ 800bd92:	2300      	movs	r3, #0
+ 800bd94:	62c3      	str	r3, [r0, #44]	; 0x2c
+    errorstate = SDMMC_CmdBlockLength(hsd->Instance, 64U);
+ 800bd96:	4631      	mov	r1, r6
+ 800bd98:	f001 f920 	bl	800cfdc <SDMMC_CmdBlockLength>
+
+    if (errorstate != HAL_SD_ERROR_NONE)
+ 800bd9c:	4604      	mov	r4, r0
+ 800bd9e:	2800      	cmp	r0, #0
+ 800bda0:	d13e      	bne.n	800be20 <SD_UltraHighSpeed+0xbc>
+    {
+      return errorstate;
+    }
+
+    /* Configure the SD DPSM (Data Path State Machine) */
+    sdmmc_datainitstructure.DataTimeOut   = SDMMC_DATATIMEOUT;
+ 800bda2:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+    sdmmc_datainitstructure.DataLength    = 64U;
+ 800bda6:	e9cd 3600 	strd	r3, r6, [sp]
+    sdmmc_datainitstructure.DataBlockSize = SDMMC_DATABLOCK_SIZE_64B ;
+    sdmmc_datainitstructure.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+    sdmmc_datainitstructure.TransferMode  = SDMMC_TRANSFER_MODE_BLOCK;
+    sdmmc_datainitstructure.DPSM          = SDMMC_DPSM_ENABLE;
+ 800bdaa:	e9cd 0704 	strd	r0, r7, [sp, #16]
+    sdmmc_datainitstructure.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800bdae:	2660      	movs	r6, #96	; 0x60
+ 800bdb0:	2302      	movs	r3, #2
+
+    if ( SDMMC_ConfigData(hsd->Instance, &sdmmc_datainitstructure) != HAL_OK)
+ 800bdb2:	6828      	ldr	r0, [r5, #0]
+ 800bdb4:	4669      	mov	r1, sp
+    sdmmc_datainitstructure.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800bdb6:	e9cd 6302 	strd	r6, r3, [sp, #8]
+    if ( SDMMC_ConfigData(hsd->Instance, &sdmmc_datainitstructure) != HAL_OK)
+ 800bdba:	f001 f833 	bl	800ce24 <SDMMC_ConfigData>
+ 800bdbe:	2800      	cmp	r0, #0
+ 800bdc0:	d14d      	bne.n	800be5e <SD_UltraHighSpeed+0xfa>
+    {
+      return (HAL_SD_ERROR_GENERAL_UNKNOWN_ERR);
+    }
+
+    errorstate = SDMMC_CmdSwitch(hsd->Instance, SDMMC_SDR104_SWITCH_PATTERN);
+ 800bdc2:	492a      	ldr	r1, [pc, #168]	; (800be6c <SD_UltraHighSpeed+0x108>)
+ 800bdc4:	6828      	ldr	r0, [r5, #0]
+ 800bdc6:	f001 fa74 	bl	800d2b2 <SDMMC_CmdSwitch>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800bdca:	4604      	mov	r4, r0
+ 800bdcc:	bb40      	cbnz	r0, 800be20 <SD_UltraHighSpeed+0xbc>
+  uint32_t count, loop = 0 ;
+ 800bdce:	4607      	mov	r7, r0
+    {
+      return errorstate;
+    }
+
+    while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DBCKEND| SDMMC_FLAG_DATAEND ))
+ 800bdd0:	f240 592a 	movw	r9, #1322	; 0x52a
+ 800bdd4:	682b      	ldr	r3, [r5, #0]
+ 800bdd6:	6b5e      	ldr	r6, [r3, #52]	; 0x34
+ 800bdd8:	ea16 0609 	ands.w	r6, r6, r9
+ 800bddc:	d005      	beq.n	800bdea <SD_UltraHighSpeed+0x86>
+        hsd->State= HAL_SD_STATE_READY;
+        return HAL_SD_ERROR_TIMEOUT;
+      }
+    }
+
+    if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DTIMEOUT))
+ 800bdde:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800bde0:	0711      	lsls	r1, r2, #28
+ 800bde2:	d521      	bpl.n	800be28 <SD_UltraHighSpeed+0xc4>
+    {
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DTIMEOUT);
+ 800bde4:	2208      	movs	r2, #8
+ 800bde6:	639a      	str	r2, [r3, #56]	; 0x38
+
+      return errorstate;
+ 800bde8:	e01a      	b.n	800be20 <SD_UltraHighSpeed+0xbc>
+      if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXFIFOHF))
+ 800bdea:	6b5b      	ldr	r3, [r3, #52]	; 0x34
+ 800bdec:	0418      	lsls	r0, r3, #16
+ 800bdee:	d50b      	bpl.n	800be08 <SD_UltraHighSpeed+0xa4>
+ 800bdf0:	ab06      	add	r3, sp, #24
+ 800bdf2:	eb03 1a47 	add.w	sl, r3, r7, lsl #5
+          SD_hs[(8U*loop)+count]  = SDMMC_ReadFIFO(hsd->Instance);
+ 800bdf6:	6828      	ldr	r0, [r5, #0]
+ 800bdf8:	f000 ffd8 	bl	800cdac <SDMMC_ReadFIFO>
+        for (count = 0U; count < 8U; count++)
+ 800bdfc:	3601      	adds	r6, #1
+ 800bdfe:	2e08      	cmp	r6, #8
+          SD_hs[(8U*loop)+count]  = SDMMC_ReadFIFO(hsd->Instance);
+ 800be00:	f84a 0b04 	str.w	r0, [sl], #4
+        for (count = 0U; count < 8U; count++)
+ 800be04:	d1f7      	bne.n	800bdf6 <SD_UltraHighSpeed+0x92>
+        loop ++;
+ 800be06:	3701      	adds	r7, #1
+      if((HAL_GetTick()-Timeout) >=  SDMMC_DATATIMEOUT)
+ 800be08:	f7fb f9a2 	bl	8007150 <HAL_GetTick>
+ 800be0c:	eba0 0008 	sub.w	r0, r0, r8
+ 800be10:	3001      	adds	r0, #1
+ 800be12:	d1df      	bne.n	800bdd4 <SD_UltraHighSpeed+0x70>
+        hsd->ErrorCode = HAL_SD_ERROR_TIMEOUT;
+ 800be14:	f04f 4400 	mov.w	r4, #2147483648	; 0x80000000
+        hsd->State= HAL_SD_STATE_READY;
+ 800be18:	2301      	movs	r3, #1
+        hsd->ErrorCode = HAL_SD_ERROR_TIMEOUT;
+ 800be1a:	63ac      	str	r4, [r5, #56]	; 0x38
+        hsd->State= HAL_SD_STATE_READY;
+ 800be1c:	f885 3034 	strb.w	r3, [r5, #52]	; 0x34
+#endif /* (DLYB_SDMMC1) || (DLYB_SDMMC2) */
+    }
+  }
+
+  return errorstate;
+}
+ 800be20:	4620      	mov	r0, r4
+ 800be22:	b016      	add	sp, #88	; 0x58
+ 800be24:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+    else if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DCRCFAIL))
+ 800be28:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800be2a:	0792      	lsls	r2, r2, #30
+ 800be2c:	d502      	bpl.n	800be34 <SD_UltraHighSpeed+0xd0>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DCRCFAIL);
+ 800be2e:	2402      	movs	r4, #2
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800be30:	639c      	str	r4, [r3, #56]	; 0x38
+      return errorstate;
+ 800be32:	e7f5      	b.n	800be20 <SD_UltraHighSpeed+0xbc>
+    else if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+ 800be34:	6b5c      	ldr	r4, [r3, #52]	; 0x34
+ 800be36:	f014 0420 	ands.w	r4, r4, #32
+ 800be3a:	d001      	beq.n	800be40 <SD_UltraHighSpeed+0xdc>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800be3c:	2420      	movs	r4, #32
+ 800be3e:	e7f7      	b.n	800be30 <SD_UltraHighSpeed+0xcc>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_DATA_FLAGS);
+ 800be40:	4a0b      	ldr	r2, [pc, #44]	; (800be70 <SD_UltraHighSpeed+0x10c>)
+ 800be42:	639a      	str	r2, [r3, #56]	; 0x38
+    if ((((uint8_t*)SD_hs)[13] & 2U) != 2U)
+ 800be44:	f89d 3025 	ldrb.w	r3, [sp, #37]	; 0x25
+ 800be48:	079b      	lsls	r3, r3, #30
+ 800be4a:	d50b      	bpl.n	800be64 <SD_UltraHighSpeed+0x100>
+      HAL_SDEx_DriveTransceiver_1_8V_Callback(SET);
+ 800be4c:	2001      	movs	r0, #1
+ 800be4e:	f7fb f9ef 	bl	8007230 <HAL_SDEx_DriveTransceiver_1_8V_Callback>
+ 800be52:	e7e5      	b.n	800be20 <SD_UltraHighSpeed+0xbc>
+     return HAL_SD_ERROR_REQUEST_NOT_APPLICABLE;
+ 800be54:	f04f 6480 	mov.w	r4, #67108864	; 0x4000000
+ 800be58:	e7e2      	b.n	800be20 <SD_UltraHighSpeed+0xbc>
+  uint32_t errorstate = HAL_SD_ERROR_NONE;
+ 800be5a:	2400      	movs	r4, #0
+ 800be5c:	e7e0      	b.n	800be20 <SD_UltraHighSpeed+0xbc>
+      return (HAL_SD_ERROR_GENERAL_UNKNOWN_ERR);
+ 800be5e:	f44f 3480 	mov.w	r4, #65536	; 0x10000
+ 800be62:	e7dd      	b.n	800be20 <SD_UltraHighSpeed+0xbc>
+      errorstate = SDMMC_ERROR_UNSUPPORTED_FEATURE;
+ 800be64:	f04f 5480 	mov.w	r4, #268435456	; 0x10000000
+ 800be68:	e7da      	b.n	800be20 <SD_UltraHighSpeed+0xbc>
+ 800be6a:	bf00      	nop
+ 800be6c:	80ff1f03 	.word	0x80ff1f03
+ 800be70:	18000f3a 	.word	0x18000f3a
+
+0800be74 <HAL_SD_MspInit>:
+}
+ 800be74:	4770      	bx	lr
+
+0800be76 <HAL_SD_MspDeInit>:
+ 800be76:	4770      	bx	lr
+
+0800be78 <HAL_SD_DeInit>:
+{
+ 800be78:	b510      	push	{r4, lr}
+  if(hsd == NULL)
+ 800be7a:	4604      	mov	r4, r0
+ 800be7c:	b198      	cbz	r0, 800bea6 <HAL_SD_DeInit+0x2e>
+  hsd->State = HAL_SD_STATE_BUSY;
+ 800be7e:	2303      	movs	r3, #3
+ 800be80:	f880 3034 	strb.w	r3, [r0, #52]	; 0x34
+  if(hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE)
+ 800be84:	6983      	ldr	r3, [r0, #24]
+ 800be86:	2b01      	cmp	r3, #1
+ 800be88:	d102      	bne.n	800be90 <HAL_SD_DeInit+0x18>
+    HAL_SDEx_DriveTransceiver_1_8V_Callback(RESET);
+ 800be8a:	2000      	movs	r0, #0
+ 800be8c:	f7fb f9d0 	bl	8007230 <HAL_SDEx_DriveTransceiver_1_8V_Callback>
+  (void)SDMMC_PowerState_OFF(hsd->Instance);
+ 800be90:	6820      	ldr	r0, [r4, #0]
+ 800be92:	f000 ffa3 	bl	800cddc <SDMMC_PowerState_OFF>
+  HAL_SD_MspDeInit(hsd);
+ 800be96:	4620      	mov	r0, r4
+ 800be98:	f7ff ffed 	bl	800be76 <HAL_SD_MspDeInit>
+  hsd->ErrorCode = HAL_SD_ERROR_NONE;
+ 800be9c:	2000      	movs	r0, #0
+ 800be9e:	63a0      	str	r0, [r4, #56]	; 0x38
+  hsd->State = HAL_SD_STATE_RESET;
+ 800bea0:	f884 0034 	strb.w	r0, [r4, #52]	; 0x34
+}
+ 800bea4:	bd10      	pop	{r4, pc}
+    return HAL_ERROR;
+ 800bea6:	2001      	movs	r0, #1
+ 800bea8:	e7fc      	b.n	800bea4 <HAL_SD_DeInit+0x2c>
+	...
+
+0800beac <HAL_SD_ReadBlocks>:
+{
+ 800beac:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 800beb0:	b087      	sub	sp, #28
+ 800beb2:	4604      	mov	r4, r0
+ 800beb4:	460e      	mov	r6, r1
+ 800beb6:	4692      	mov	sl, r2
+ 800beb8:	461f      	mov	r7, r3
+  uint32_t tickstart = HAL_GetTick();
+ 800beba:	f7fb f949 	bl	8007150 <HAL_GetTick>
+ 800bebe:	4681      	mov	r9, r0
+  if(NULL == pData)
+ 800bec0:	b936      	cbnz	r6, 800bed0 <HAL_SD_ReadBlocks+0x24>
+    hsd->ErrorCode |= HAL_SD_ERROR_PARAM;
+ 800bec2:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800bec4:	f043 6300 	orr.w	r3, r3, #134217728	; 0x8000000
+    hsd->ErrorCode |= HAL_SD_ERROR_BUSY;
+ 800bec8:	63a3      	str	r3, [r4, #56]	; 0x38
+    return HAL_ERROR;
+ 800beca:	f04f 0801 	mov.w	r8, #1
+ 800bece:	e011      	b.n	800bef4 <HAL_SD_ReadBlocks+0x48>
+  if(hsd->State == HAL_SD_STATE_READY)
+ 800bed0:	f894 3034 	ldrb.w	r3, [r4, #52]	; 0x34
+ 800bed4:	2b01      	cmp	r3, #1
+ 800bed6:	fa5f f883 	uxtb.w	r8, r3
+ 800beda:	f040 80c3 	bne.w	800c064 <HAL_SD_ReadBlocks+0x1b8>
+    if((add + NumberOfBlocks) > (hsd->SdCard.LogBlockNbr))
+ 800bede:	6d62      	ldr	r2, [r4, #84]	; 0x54
+ 800bee0:	eb0a 0307 	add.w	r3, sl, r7
+    hsd->ErrorCode = HAL_SD_ERROR_NONE;
+ 800bee4:	2100      	movs	r1, #0
+    if((add + NumberOfBlocks) > (hsd->SdCard.LogBlockNbr))
+ 800bee6:	4293      	cmp	r3, r2
+    hsd->ErrorCode = HAL_SD_ERROR_NONE;
+ 800bee8:	63a1      	str	r1, [r4, #56]	; 0x38
+    if((add + NumberOfBlocks) > (hsd->SdCard.LogBlockNbr))
+ 800beea:	d907      	bls.n	800befc <HAL_SD_ReadBlocks+0x50>
+      hsd->ErrorCode |= HAL_SD_ERROR_ADDR_OUT_OF_RANGE;
+ 800beec:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800beee:	f043 7300 	orr.w	r3, r3, #33554432	; 0x2000000
+ 800bef2:	63a3      	str	r3, [r4, #56]	; 0x38
+}
+ 800bef4:	4640      	mov	r0, r8
+ 800bef6:	b007      	add	sp, #28
+ 800bef8:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+    hsd->State = HAL_SD_STATE_BUSY;
+ 800befc:	2303      	movs	r3, #3
+ 800befe:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+    if(hsd->SdCard.CardType != CARD_SDHC_SDXC)
+ 800bf02:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+    hsd->Instance->DCTRL = 0U;
+ 800bf04:	6820      	ldr	r0, [r4, #0]
+    if(hsd->SdCard.CardType != CARD_SDHC_SDXC)
+ 800bf06:	2b01      	cmp	r3, #1
+    config.DataTimeOut   = SDMMC_DATATIMEOUT;
+ 800bf08:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 800bf0c:	9300      	str	r3, [sp, #0]
+    config.DataLength    = NumberOfBlocks * BLOCKSIZE;
+ 800bf0e:	ea4f 2347 	mov.w	r3, r7, lsl #9
+ 800bf12:	9301      	str	r3, [sp, #4]
+    config.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800bf14:	f04f 0502 	mov.w	r5, #2
+ 800bf18:	f04f 0390 	mov.w	r3, #144	; 0x90
+ 800bf1c:	e9cd 3502 	strd	r3, r5, [sp, #8]
+    hsd->Instance->DCTRL = 0U;
+ 800bf20:	62c1      	str	r1, [r0, #44]	; 0x2c
+    config.TransferMode  = SDMMC_TRANSFER_MODE_BLOCK;
+ 800bf22:	f04f 0300 	mov.w	r3, #0
+    (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800bf26:	4669      	mov	r1, sp
+    config.DPSM          = SDMMC_DPSM_DISABLE;
+ 800bf28:	e9cd 3304 	strd	r3, r3, [sp, #16]
+      add *= 512U;
+ 800bf2c:	bf18      	it	ne
+ 800bf2e:	ea4f 2a4a 	movne.w	sl, sl, lsl #9
+    (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800bf32:	f000 ff77 	bl	800ce24 <SDMMC_ConfigData>
+    __SDMMC_CMDTRANS_ENABLE( hsd->Instance);
+ 800bf36:	6820      	ldr	r0, [r4, #0]
+ 800bf38:	68c3      	ldr	r3, [r0, #12]
+    if(NumberOfBlocks > 1U)
+ 800bf3a:	2f01      	cmp	r7, #1
+    __SDMMC_CMDTRANS_ENABLE( hsd->Instance);
+ 800bf3c:	f043 0340 	orr.w	r3, r3, #64	; 0x40
+ 800bf40:	60c3      	str	r3, [r0, #12]
+    if(NumberOfBlocks > 1U)
+ 800bf42:	d910      	bls.n	800bf66 <HAL_SD_ReadBlocks+0xba>
+      hsd->Context = SD_CONTEXT_READ_MULTIPLE_BLOCK;
+ 800bf44:	6325      	str	r5, [r4, #48]	; 0x30
+      errorstate = SDMMC_CmdReadMultiBlock(hsd->Instance, add);
+ 800bf46:	4651      	mov	r1, sl
+ 800bf48:	f001 f87a 	bl	800d040 <SDMMC_CmdReadMultiBlock>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800bf4c:	b188      	cbz	r0, 800bf72 <HAL_SD_ReadBlocks+0xc6>
+          __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800bf4e:	6823      	ldr	r3, [r4, #0]
+ 800bf50:	4a46      	ldr	r2, [pc, #280]	; (800c06c <HAL_SD_ReadBlocks+0x1c0>)
+ 800bf52:	639a      	str	r2, [r3, #56]	; 0x38
+          hsd->ErrorCode |= errorstate;
+ 800bf54:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800bf56:	4318      	orrs	r0, r3
+ 800bf58:	63a0      	str	r0, [r4, #56]	; 0x38
+      hsd->State = HAL_SD_STATE_READY;
+ 800bf5a:	2301      	movs	r3, #1
+ 800bf5c:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      hsd->Context = SD_CONTEXT_NONE;
+ 800bf60:	2300      	movs	r3, #0
+ 800bf62:	6323      	str	r3, [r4, #48]	; 0x30
+      return HAL_ERROR;
+ 800bf64:	e7c6      	b.n	800bef4 <HAL_SD_ReadBlocks+0x48>
+      hsd->Context = SD_CONTEXT_READ_SINGLE_BLOCK;
+ 800bf66:	2301      	movs	r3, #1
+ 800bf68:	6323      	str	r3, [r4, #48]	; 0x30
+      errorstate = SDMMC_CmdReadSingleBlock(hsd->Instance, add);
+ 800bf6a:	4651      	mov	r1, sl
+ 800bf6c:	f001 f84f 	bl	800d00e <SDMMC_CmdReadSingleBlock>
+ 800bf70:	e7ec      	b.n	800bf4c <HAL_SD_ReadBlocks+0xa0>
+    dataremaining = config.DataLength;
+ 800bf72:	9d01      	ldr	r5, [sp, #4]
+    while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DATAEND))
+ 800bf74:	6820      	ldr	r0, [r4, #0]
+ 800bf76:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 800bf78:	f413 7f95 	tst.w	r3, #298	; 0x12a
+ 800bf7c:	d01b      	beq.n	800bfb6 <HAL_SD_ReadBlocks+0x10a>
+    __SDMMC_CMDTRANS_DISABLE( hsd->Instance);
+ 800bf7e:	68c3      	ldr	r3, [r0, #12]
+ 800bf80:	f023 0340 	bic.w	r3, r3, #64	; 0x40
+ 800bf84:	60c3      	str	r3, [r0, #12]
+    if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DATAEND) && (NumberOfBlocks > 1U))
+ 800bf86:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 800bf88:	05db      	lsls	r3, r3, #23
+ 800bf8a:	d508      	bpl.n	800bf9e <HAL_SD_ReadBlocks+0xf2>
+ 800bf8c:	2f01      	cmp	r7, #1
+ 800bf8e:	d906      	bls.n	800bf9e <HAL_SD_ReadBlocks+0xf2>
+      if(hsd->SdCard.CardType != CARD_SECURED)
+ 800bf90:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 800bf92:	2b03      	cmp	r3, #3
+ 800bf94:	d003      	beq.n	800bf9e <HAL_SD_ReadBlocks+0xf2>
+        errorstate = SDMMC_CmdStopTransfer(hsd->Instance);
+ 800bf96:	f001 f91b 	bl	800d1d0 <SDMMC_CmdStopTransfer>
+        if(errorstate != HAL_SD_ERROR_NONE)
+ 800bf9a:	2800      	cmp	r0, #0
+ 800bf9c:	d1d7      	bne.n	800bf4e <HAL_SD_ReadBlocks+0xa2>
+    if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DTIMEOUT))
+ 800bf9e:	6823      	ldr	r3, [r4, #0]
+ 800bfa0:	6b58      	ldr	r0, [r3, #52]	; 0x34
+ 800bfa2:	f010 0008 	ands.w	r0, r0, #8
+ 800bfa6:	d038      	beq.n	800c01a <HAL_SD_ReadBlocks+0x16e>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800bfa8:	4a30      	ldr	r2, [pc, #192]	; (800c06c <HAL_SD_ReadBlocks+0x1c0>)
+ 800bfaa:	639a      	str	r2, [r3, #56]	; 0x38
+      hsd->ErrorCode |= HAL_SD_ERROR_DATA_TIMEOUT;
+ 800bfac:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800bfae:	f043 0308 	orr.w	r3, r3, #8
+ 800bfb2:	63a3      	str	r3, [r4, #56]	; 0x38
+ 800bfb4:	e7d1      	b.n	800bf5a <HAL_SD_ReadBlocks+0xae>
+      if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXFIFOHF) && (dataremaining > 0U))
+ 800bfb6:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 800bfb8:	041a      	lsls	r2, r3, #16
+ 800bfba:	d518      	bpl.n	800bfee <HAL_SD_ReadBlocks+0x142>
+ 800bfbc:	b1bd      	cbz	r5, 800bfee <HAL_SD_ReadBlocks+0x142>
+ 800bfbe:	f106 0a04 	add.w	sl, r6, #4
+ 800bfc2:	f106 0b24 	add.w	fp, r6, #36	; 0x24
+          data = SDMMC_ReadFIFO(hsd->Instance);
+ 800bfc6:	6820      	ldr	r0, [r4, #0]
+ 800bfc8:	f000 fef0 	bl	800cdac <SDMMC_ReadFIFO>
+          *tempbuff = (uint8_t)((data >> 8U) & 0xFFU);
+ 800bfcc:	0a02      	lsrs	r2, r0, #8
+ 800bfce:	f80a 2c03 	strb.w	r2, [sl, #-3]
+          *tempbuff = (uint8_t)((data >> 16U) & 0xFFU);
+ 800bfd2:	0c02      	lsrs	r2, r0, #16
+ 800bfd4:	f80a 2c02 	strb.w	r2, [sl, #-2]
+          *tempbuff = (uint8_t)((data >> 24U) & 0xFFU);
+ 800bfd8:	0e02      	lsrs	r2, r0, #24
+          *tempbuff = (uint8_t)(data & 0xFFU);
+ 800bfda:	f80a 0c04 	strb.w	r0, [sl, #-4]
+          *tempbuff = (uint8_t)((data >> 24U) & 0xFFU);
+ 800bfde:	f80a 2c01 	strb.w	r2, [sl, #-1]
+        for(count = 0U; count < 8U; count++)
+ 800bfe2:	f10a 0a04 	add.w	sl, sl, #4
+ 800bfe6:	45d3      	cmp	fp, sl
+ 800bfe8:	d1ed      	bne.n	800bfc6 <HAL_SD_ReadBlocks+0x11a>
+          tempbuff++;
+ 800bfea:	3620      	adds	r6, #32
+          dataremaining--;
+ 800bfec:	3d20      	subs	r5, #32
+      if(((HAL_GetTick()-tickstart) >=  Timeout) || (Timeout == 0U))
+ 800bfee:	f7fb f8af 	bl	8007150 <HAL_GetTick>
+ 800bff2:	9b10      	ldr	r3, [sp, #64]	; 0x40
+ 800bff4:	eba0 0009 	sub.w	r0, r0, r9
+ 800bff8:	4298      	cmp	r0, r3
+ 800bffa:	d3bb      	bcc.n	800bf74 <HAL_SD_ReadBlocks+0xc8>
+        __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800bffc:	6823      	ldr	r3, [r4, #0]
+ 800bffe:	4a1b      	ldr	r2, [pc, #108]	; (800c06c <HAL_SD_ReadBlocks+0x1c0>)
+ 800c000:	639a      	str	r2, [r3, #56]	; 0x38
+        hsd->ErrorCode |= HAL_SD_ERROR_TIMEOUT;
+ 800c002:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c004:	f043 4300 	orr.w	r3, r3, #2147483648	; 0x80000000
+ 800c008:	63a3      	str	r3, [r4, #56]	; 0x38
+        hsd->State= HAL_SD_STATE_READY;
+ 800c00a:	2301      	movs	r3, #1
+ 800c00c:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+        hsd->Context = SD_CONTEXT_NONE;
+ 800c010:	2300      	movs	r3, #0
+ 800c012:	6323      	str	r3, [r4, #48]	; 0x30
+        return HAL_TIMEOUT;
+ 800c014:	f04f 0803 	mov.w	r8, #3
+ 800c018:	e76c      	b.n	800bef4 <HAL_SD_ReadBlocks+0x48>
+    else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DCRCFAIL))
+ 800c01a:	6b59      	ldr	r1, [r3, #52]	; 0x34
+ 800c01c:	f011 0102 	ands.w	r1, r1, #2
+ 800c020:	d00a      	beq.n	800c038 <HAL_SD_ReadBlocks+0x18c>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c022:	4a12      	ldr	r2, [pc, #72]	; (800c06c <HAL_SD_ReadBlocks+0x1c0>)
+ 800c024:	639a      	str	r2, [r3, #56]	; 0x38
+      hsd->ErrorCode |= HAL_SD_ERROR_DATA_CRC_FAIL;
+ 800c026:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c028:	f043 0302 	orr.w	r3, r3, #2
+ 800c02c:	63a3      	str	r3, [r4, #56]	; 0x38
+      hsd->State = HAL_SD_STATE_READY;
+ 800c02e:	2301      	movs	r3, #1
+ 800c030:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      hsd->Context = SD_CONTEXT_NONE;
+ 800c034:	6320      	str	r0, [r4, #48]	; 0x30
+      return HAL_ERROR;
+ 800c036:	e75d      	b.n	800bef4 <HAL_SD_ReadBlocks+0x48>
+    else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+ 800c038:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c03a:	f012 0220 	ands.w	r2, r2, #32
+ 800c03e:	d00a      	beq.n	800c056 <HAL_SD_ReadBlocks+0x1aa>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c040:	4a0a      	ldr	r2, [pc, #40]	; (800c06c <HAL_SD_ReadBlocks+0x1c0>)
+ 800c042:	639a      	str	r2, [r3, #56]	; 0x38
+      hsd->ErrorCode |= HAL_SD_ERROR_RX_OVERRUN;
+ 800c044:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c046:	f043 0320 	orr.w	r3, r3, #32
+ 800c04a:	63a3      	str	r3, [r4, #56]	; 0x38
+      hsd->State = HAL_SD_STATE_READY;
+ 800c04c:	2301      	movs	r3, #1
+ 800c04e:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      hsd->Context = SD_CONTEXT_NONE;
+ 800c052:	6321      	str	r1, [r4, #48]	; 0x30
+      return HAL_ERROR;
+ 800c054:	e74e      	b.n	800bef4 <HAL_SD_ReadBlocks+0x48>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_DATA_FLAGS);
+ 800c056:	4906      	ldr	r1, [pc, #24]	; (800c070 <HAL_SD_ReadBlocks+0x1c4>)
+ 800c058:	6399      	str	r1, [r3, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c05a:	2301      	movs	r3, #1
+ 800c05c:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+    return HAL_OK;
+ 800c060:	4690      	mov	r8, r2
+ 800c062:	e747      	b.n	800bef4 <HAL_SD_ReadBlocks+0x48>
+    hsd->ErrorCode |= HAL_SD_ERROR_BUSY;
+ 800c064:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c066:	f043 5300 	orr.w	r3, r3, #536870912	; 0x20000000
+ 800c06a:	e72d      	b.n	800bec8 <HAL_SD_ReadBlocks+0x1c>
+ 800c06c:	1fe00fff 	.word	0x1fe00fff
+ 800c070:	18000f3a 	.word	0x18000f3a
+
+0800c074 <HAL_SD_WriteBlocks>:
+{
+ 800c074:	e92d 4ff0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, lr}
+ 800c078:	b089      	sub	sp, #36	; 0x24
+ 800c07a:	4604      	mov	r4, r0
+ 800c07c:	460d      	mov	r5, r1
+ 800c07e:	4692      	mov	sl, r2
+ 800c080:	461f      	mov	r7, r3
+  uint32_t tickstart = HAL_GetTick();
+ 800c082:	f7fb f865 	bl	8007150 <HAL_GetTick>
+ 800c086:	4681      	mov	r9, r0
+  if(NULL == pData)
+ 800c088:	b935      	cbnz	r5, 800c098 <HAL_SD_WriteBlocks+0x24>
+    hsd->ErrorCode |= HAL_SD_ERROR_PARAM;
+ 800c08a:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c08c:	f043 6300 	orr.w	r3, r3, #134217728	; 0x8000000
+    hsd->ErrorCode |= HAL_SD_ERROR_BUSY;
+ 800c090:	63a3      	str	r3, [r4, #56]	; 0x38
+    return HAL_ERROR;
+ 800c092:	f04f 0801 	mov.w	r8, #1
+ 800c096:	e011      	b.n	800c0bc <HAL_SD_WriteBlocks+0x48>
+  if(hsd->State == HAL_SD_STATE_READY)
+ 800c098:	f894 3034 	ldrb.w	r3, [r4, #52]	; 0x34
+ 800c09c:	2b01      	cmp	r3, #1
+ 800c09e:	fa5f f883 	uxtb.w	r8, r3
+ 800c0a2:	f040 80b4 	bne.w	800c20e <HAL_SD_WriteBlocks+0x19a>
+    if((add + NumberOfBlocks) > (hsd->SdCard.LogBlockNbr))
+ 800c0a6:	6d62      	ldr	r2, [r4, #84]	; 0x54
+ 800c0a8:	eb0a 0307 	add.w	r3, sl, r7
+    hsd->ErrorCode = HAL_SD_ERROR_NONE;
+ 800c0ac:	2100      	movs	r1, #0
+    if((add + NumberOfBlocks) > (hsd->SdCard.LogBlockNbr))
+ 800c0ae:	4293      	cmp	r3, r2
+    hsd->ErrorCode = HAL_SD_ERROR_NONE;
+ 800c0b0:	63a1      	str	r1, [r4, #56]	; 0x38
+    if((add + NumberOfBlocks) > (hsd->SdCard.LogBlockNbr))
+ 800c0b2:	d907      	bls.n	800c0c4 <HAL_SD_WriteBlocks+0x50>
+      hsd->ErrorCode |= HAL_SD_ERROR_ADDR_OUT_OF_RANGE;
+ 800c0b4:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c0b6:	f043 7300 	orr.w	r3, r3, #33554432	; 0x2000000
+ 800c0ba:	63a3      	str	r3, [r4, #56]	; 0x38
+}
+ 800c0bc:	4640      	mov	r0, r8
+ 800c0be:	b009      	add	sp, #36	; 0x24
+ 800c0c0:	e8bd 8ff0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, fp, pc}
+    hsd->State = HAL_SD_STATE_BUSY;
+ 800c0c4:	2303      	movs	r3, #3
+ 800c0c6:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+    if(hsd->SdCard.CardType != CARD_SDHC_SDXC)
+ 800c0ca:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+    hsd->Instance->DCTRL = 0U;
+ 800c0cc:	6820      	ldr	r0, [r4, #0]
+    if(hsd->SdCard.CardType != CARD_SDHC_SDXC)
+ 800c0ce:	2b01      	cmp	r3, #1
+    config.DataTimeOut   = SDMMC_DATATIMEOUT;
+ 800c0d0:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+ 800c0d4:	9302      	str	r3, [sp, #8]
+    config.DataLength    = NumberOfBlocks * BLOCKSIZE;
+ 800c0d6:	ea4f 2347 	mov.w	r3, r7, lsl #9
+    hsd->Instance->DCTRL = 0U;
+ 800c0da:	62c1      	str	r1, [r0, #44]	; 0x2c
+    config.DataLength    = NumberOfBlocks * BLOCKSIZE;
+ 800c0dc:	9303      	str	r3, [sp, #12]
+    config.TransferDir   = SDMMC_TRANSFER_DIR_TO_CARD;
+ 800c0de:	f04f 0190 	mov.w	r1, #144	; 0x90
+ 800c0e2:	f04f 0300 	mov.w	r3, #0
+ 800c0e6:	e9cd 1304 	strd	r1, r3, [sp, #16]
+    (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800c0ea:	a902      	add	r1, sp, #8
+    config.DPSM          = SDMMC_DPSM_DISABLE;
+ 800c0ec:	e9cd 3306 	strd	r3, r3, [sp, #24]
+      add *= 512U;
+ 800c0f0:	bf18      	it	ne
+ 800c0f2:	ea4f 2a4a 	movne.w	sl, sl, lsl #9
+    (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800c0f6:	f000 fe95 	bl	800ce24 <SDMMC_ConfigData>
+    __SDMMC_CMDTRANS_ENABLE( hsd->Instance);
+ 800c0fa:	6820      	ldr	r0, [r4, #0]
+ 800c0fc:	68c3      	ldr	r3, [r0, #12]
+    if(NumberOfBlocks > 1U)
+ 800c0fe:	2f01      	cmp	r7, #1
+    __SDMMC_CMDTRANS_ENABLE( hsd->Instance);
+ 800c100:	f043 0340 	orr.w	r3, r3, #64	; 0x40
+ 800c104:	60c3      	str	r3, [r0, #12]
+    if(NumberOfBlocks > 1U)
+ 800c106:	d911      	bls.n	800c12c <HAL_SD_WriteBlocks+0xb8>
+      hsd->Context = SD_CONTEXT_WRITE_MULTIPLE_BLOCK;
+ 800c108:	2320      	movs	r3, #32
+ 800c10a:	6323      	str	r3, [r4, #48]	; 0x30
+      errorstate = SDMMC_CmdWriteMultiBlock(hsd->Instance, add);
+ 800c10c:	4651      	mov	r1, sl
+ 800c10e:	f000 ffc9 	bl	800d0a4 <SDMMC_CmdWriteMultiBlock>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c112:	b188      	cbz	r0, 800c138 <HAL_SD_WriteBlocks+0xc4>
+          __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c114:	6823      	ldr	r3, [r4, #0]
+ 800c116:	4a40      	ldr	r2, [pc, #256]	; (800c218 <HAL_SD_WriteBlocks+0x1a4>)
+ 800c118:	639a      	str	r2, [r3, #56]	; 0x38
+          hsd->ErrorCode |= errorstate;
+ 800c11a:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c11c:	4318      	orrs	r0, r3
+ 800c11e:	63a0      	str	r0, [r4, #56]	; 0x38
+      hsd->State = HAL_SD_STATE_READY;
+ 800c120:	2301      	movs	r3, #1
+ 800c122:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      hsd->Context = SD_CONTEXT_NONE;
+ 800c126:	2300      	movs	r3, #0
+ 800c128:	6323      	str	r3, [r4, #48]	; 0x30
+      return HAL_ERROR;
+ 800c12a:	e7c7      	b.n	800c0bc <HAL_SD_WriteBlocks+0x48>
+      hsd->Context = SD_CONTEXT_WRITE_SINGLE_BLOCK;
+ 800c12c:	2310      	movs	r3, #16
+ 800c12e:	6323      	str	r3, [r4, #48]	; 0x30
+      errorstate = SDMMC_CmdWriteSingleBlock(hsd->Instance, add);
+ 800c130:	4651      	mov	r1, sl
+ 800c132:	f000 ff9e 	bl	800d072 <SDMMC_CmdWriteSingleBlock>
+ 800c136:	e7ec      	b.n	800c112 <HAL_SD_WriteBlocks+0x9e>
+    dataremaining = config.DataLength;
+ 800c138:	9e03      	ldr	r6, [sp, #12]
+    while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_TXUNDERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DATAEND))
+ 800c13a:	6820      	ldr	r0, [r4, #0]
+ 800c13c:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 800c13e:	f413 7f8d 	tst.w	r3, #282	; 0x11a
+ 800c142:	d01b      	beq.n	800c17c <HAL_SD_WriteBlocks+0x108>
+    __SDMMC_CMDTRANS_DISABLE( hsd->Instance);
+ 800c144:	68c3      	ldr	r3, [r0, #12]
+ 800c146:	f023 0340 	bic.w	r3, r3, #64	; 0x40
+ 800c14a:	60c3      	str	r3, [r0, #12]
+    if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DATAEND) && (NumberOfBlocks > 1U))
+ 800c14c:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 800c14e:	05db      	lsls	r3, r3, #23
+ 800c150:	d508      	bpl.n	800c164 <HAL_SD_WriteBlocks+0xf0>
+ 800c152:	2f01      	cmp	r7, #1
+ 800c154:	d906      	bls.n	800c164 <HAL_SD_WriteBlocks+0xf0>
+      if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c156:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 800c158:	2b03      	cmp	r3, #3
+ 800c15a:	d003      	beq.n	800c164 <HAL_SD_WriteBlocks+0xf0>
+        errorstate = SDMMC_CmdStopTransfer(hsd->Instance);
+ 800c15c:	f001 f838 	bl	800d1d0 <SDMMC_CmdStopTransfer>
+        if(errorstate != HAL_SD_ERROR_NONE)
+ 800c160:	2800      	cmp	r0, #0
+ 800c162:	d1d7      	bne.n	800c114 <HAL_SD_WriteBlocks+0xa0>
+    if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DTIMEOUT))
+ 800c164:	6823      	ldr	r3, [r4, #0]
+ 800c166:	6b58      	ldr	r0, [r3, #52]	; 0x34
+ 800c168:	f010 0008 	ands.w	r0, r0, #8
+ 800c16c:	d02a      	beq.n	800c1c4 <HAL_SD_WriteBlocks+0x150>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c16e:	4a2a      	ldr	r2, [pc, #168]	; (800c218 <HAL_SD_WriteBlocks+0x1a4>)
+ 800c170:	639a      	str	r2, [r3, #56]	; 0x38
+      hsd->ErrorCode |= HAL_SD_ERROR_DATA_TIMEOUT;
+ 800c172:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c174:	f043 0308 	orr.w	r3, r3, #8
+ 800c178:	63a3      	str	r3, [r4, #56]	; 0x38
+ 800c17a:	e7d1      	b.n	800c120 <HAL_SD_WriteBlocks+0xac>
+      if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_TXFIFOHE) && (dataremaining > 0U))
+ 800c17c:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 800c17e:	045a      	lsls	r2, r3, #17
+ 800c180:	d50c      	bpl.n	800c19c <HAL_SD_WriteBlocks+0x128>
+ 800c182:	b15e      	cbz	r6, 800c19c <HAL_SD_WriteBlocks+0x128>
+ 800c184:	f105 0b20 	add.w	fp, r5, #32
+          data |= ((uint32_t)(*tempbuff) << 24U);
+ 800c188:	f855 3b04 	ldr.w	r3, [r5], #4
+          (void)SDMMC_WriteFIFO(hsd->Instance, &data);
+ 800c18c:	6820      	ldr	r0, [r4, #0]
+          data |= ((uint32_t)(*tempbuff) << 24U);
+ 800c18e:	9301      	str	r3, [sp, #4]
+          (void)SDMMC_WriteFIFO(hsd->Instance, &data);
+ 800c190:	a901      	add	r1, sp, #4
+ 800c192:	f000 fe0e 	bl	800cdb2 <SDMMC_WriteFIFO>
+        for(count = 0U; count < 8U; count++)
+ 800c196:	45ab      	cmp	fp, r5
+ 800c198:	d1f6      	bne.n	800c188 <HAL_SD_WriteBlocks+0x114>
+          dataremaining--;
+ 800c19a:	3e20      	subs	r6, #32
+      if(((HAL_GetTick()-tickstart) >=  Timeout) || (Timeout == 0U))
+ 800c19c:	f7fa ffd8 	bl	8007150 <HAL_GetTick>
+ 800c1a0:	9b12      	ldr	r3, [sp, #72]	; 0x48
+ 800c1a2:	eba0 0009 	sub.w	r0, r0, r9
+ 800c1a6:	4298      	cmp	r0, r3
+ 800c1a8:	d3c7      	bcc.n	800c13a <HAL_SD_WriteBlocks+0xc6>
+        __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c1aa:	6823      	ldr	r3, [r4, #0]
+ 800c1ac:	4a1a      	ldr	r2, [pc, #104]	; (800c218 <HAL_SD_WriteBlocks+0x1a4>)
+ 800c1ae:	639a      	str	r2, [r3, #56]	; 0x38
+        hsd->ErrorCode |= errorstate;
+ 800c1b0:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c1b2:	63a3      	str	r3, [r4, #56]	; 0x38
+        hsd->State = HAL_SD_STATE_READY;
+ 800c1b4:	2301      	movs	r3, #1
+ 800c1b6:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+        hsd->Context = SD_CONTEXT_NONE;
+ 800c1ba:	2300      	movs	r3, #0
+ 800c1bc:	6323      	str	r3, [r4, #48]	; 0x30
+        return HAL_TIMEOUT;
+ 800c1be:	f04f 0803 	mov.w	r8, #3
+ 800c1c2:	e77b      	b.n	800c0bc <HAL_SD_WriteBlocks+0x48>
+    else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DCRCFAIL))
+ 800c1c4:	6b59      	ldr	r1, [r3, #52]	; 0x34
+ 800c1c6:	f011 0102 	ands.w	r1, r1, #2
+ 800c1ca:	d00a      	beq.n	800c1e2 <HAL_SD_WriteBlocks+0x16e>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c1cc:	4a12      	ldr	r2, [pc, #72]	; (800c218 <HAL_SD_WriteBlocks+0x1a4>)
+ 800c1ce:	639a      	str	r2, [r3, #56]	; 0x38
+      hsd->ErrorCode |= HAL_SD_ERROR_DATA_CRC_FAIL;
+ 800c1d0:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c1d2:	f043 0302 	orr.w	r3, r3, #2
+ 800c1d6:	63a3      	str	r3, [r4, #56]	; 0x38
+      hsd->State = HAL_SD_STATE_READY;
+ 800c1d8:	2301      	movs	r3, #1
+ 800c1da:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      hsd->Context = SD_CONTEXT_NONE;
+ 800c1de:	6320      	str	r0, [r4, #48]	; 0x30
+      return HAL_ERROR;
+ 800c1e0:	e76c      	b.n	800c0bc <HAL_SD_WriteBlocks+0x48>
+    else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_TXUNDERR))
+ 800c1e2:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c1e4:	f012 0210 	ands.w	r2, r2, #16
+ 800c1e8:	d00a      	beq.n	800c200 <HAL_SD_WriteBlocks+0x18c>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c1ea:	4a0b      	ldr	r2, [pc, #44]	; (800c218 <HAL_SD_WriteBlocks+0x1a4>)
+ 800c1ec:	639a      	str	r2, [r3, #56]	; 0x38
+      hsd->ErrorCode |= HAL_SD_ERROR_TX_UNDERRUN;
+ 800c1ee:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c1f0:	f043 0310 	orr.w	r3, r3, #16
+ 800c1f4:	63a3      	str	r3, [r4, #56]	; 0x38
+      hsd->State = HAL_SD_STATE_READY;
+ 800c1f6:	2301      	movs	r3, #1
+ 800c1f8:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      hsd->Context = SD_CONTEXT_NONE;
+ 800c1fc:	6321      	str	r1, [r4, #48]	; 0x30
+      return HAL_ERROR;
+ 800c1fe:	e75d      	b.n	800c0bc <HAL_SD_WriteBlocks+0x48>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_DATA_FLAGS);
+ 800c200:	4906      	ldr	r1, [pc, #24]	; (800c21c <HAL_SD_WriteBlocks+0x1a8>)
+ 800c202:	6399      	str	r1, [r3, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c204:	2301      	movs	r3, #1
+ 800c206:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+    return HAL_OK;
+ 800c20a:	4690      	mov	r8, r2
+ 800c20c:	e756      	b.n	800c0bc <HAL_SD_WriteBlocks+0x48>
+    hsd->ErrorCode |= HAL_SD_ERROR_BUSY;
+ 800c20e:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c210:	f043 5300 	orr.w	r3, r3, #536870912	; 0x20000000
+ 800c214:	e73c      	b.n	800c090 <HAL_SD_WriteBlocks+0x1c>
+ 800c216:	bf00      	nop
+ 800c218:	1fe00fff 	.word	0x1fe00fff
+ 800c21c:	18000f3a 	.word	0x18000f3a
+
+0800c220 <HAL_SD_GetState>:
+  return hsd->State;
+ 800c220:	f890 0034 	ldrb.w	r0, [r0, #52]	; 0x34
+}
+ 800c224:	4770      	bx	lr
+
+0800c226 <HAL_SD_GetError>:
+  return hsd->ErrorCode;
+ 800c226:	6b80      	ldr	r0, [r0, #56]	; 0x38
+}
+ 800c228:	4770      	bx	lr
+
+0800c22a <HAL_SD_TxCpltCallback>:
+ 800c22a:	4770      	bx	lr
+
+0800c22c <HAL_SD_RxCpltCallback>:
+ 800c22c:	4770      	bx	lr
+
+0800c22e <HAL_SD_ErrorCallback>:
+ 800c22e:	4770      	bx	lr
+
+0800c230 <HAL_SD_AbortCallback>:
+ 800c230:	4770      	bx	lr
+	...
+
+0800c234 <HAL_SD_GetCardCSD>:
+  pCSD->CSDStruct = (uint8_t)((hsd->CSD[0] & 0xC0000000U) >> 30U);
+ 800c234:	6e03      	ldr	r3, [r0, #96]	; 0x60
+ 800c236:	0f9a      	lsrs	r2, r3, #30
+ 800c238:	700a      	strb	r2, [r1, #0]
+  pCSD->SysSpecVersion = (uint8_t)((hsd->CSD[0] & 0x3C000000U) >> 26U);
+ 800c23a:	f3c3 6283 	ubfx	r2, r3, #26, #4
+ 800c23e:	704a      	strb	r2, [r1, #1]
+  pCSD->Reserved1 = (uint8_t)((hsd->CSD[0] & 0x03000000U) >> 24U);
+ 800c240:	f3c3 6201 	ubfx	r2, r3, #24, #2
+ 800c244:	708a      	strb	r2, [r1, #2]
+  pCSD->TAAC = (uint8_t)((hsd->CSD[0] & 0x00FF0000U) >> 16U);
+ 800c246:	f3c3 4207 	ubfx	r2, r3, #16, #8
+ 800c24a:	70ca      	strb	r2, [r1, #3]
+  pCSD->NSAC = (uint8_t)((hsd->CSD[0] & 0x0000FF00U) >> 8U);
+ 800c24c:	f3c3 2207 	ubfx	r2, r3, #8, #8
+  pCSD->MaxBusClkFrec = (uint8_t)(hsd->CSD[0] & 0x000000FFU);
+ 800c250:	b2db      	uxtb	r3, r3
+  pCSD->NSAC = (uint8_t)((hsd->CSD[0] & 0x0000FF00U) >> 8U);
+ 800c252:	710a      	strb	r2, [r1, #4]
+  pCSD->MaxBusClkFrec = (uint8_t)(hsd->CSD[0] & 0x000000FFU);
+ 800c254:	714b      	strb	r3, [r1, #5]
+  pCSD->CardComdClasses = (uint16_t)((hsd->CSD[1] & 0xFFF00000U) >> 20U);
+ 800c256:	6e43      	ldr	r3, [r0, #100]	; 0x64
+ 800c258:	0d1a      	lsrs	r2, r3, #20
+ 800c25a:	80ca      	strh	r2, [r1, #6]
+  pCSD->RdBlockLen = (uint8_t)((hsd->CSD[1] & 0x000F0000U) >> 16U);
+ 800c25c:	f3c3 4203 	ubfx	r2, r3, #16, #4
+ 800c260:	720a      	strb	r2, [r1, #8]
+  pCSD->PartBlockRead   = (uint8_t)((hsd->CSD[1] & 0x00008000U) >> 15U);
+ 800c262:	f3c3 32c0 	ubfx	r2, r3, #15, #1
+ 800c266:	724a      	strb	r2, [r1, #9]
+  pCSD->WrBlockMisalign = (uint8_t)((hsd->CSD[1] & 0x00004000U) >> 14U);
+ 800c268:	f3c3 3280 	ubfx	r2, r3, #14, #1
+ 800c26c:	728a      	strb	r2, [r1, #10]
+  pCSD->RdBlockMisalign = (uint8_t)((hsd->CSD[1] & 0x00002000U) >> 13U);
+ 800c26e:	f3c3 3240 	ubfx	r2, r3, #13, #1
+ 800c272:	72ca      	strb	r2, [r1, #11]
+  pCSD->DSRImpl = (uint8_t)((hsd->CSD[1] & 0x00001000U) >> 12U);
+ 800c274:	f3c3 3200 	ubfx	r2, r3, #12, #1
+ 800c278:	730a      	strb	r2, [r1, #12]
+  pCSD->Reserved2 = 0U; /*!< Reserved */
+ 800c27a:	2200      	movs	r2, #0
+ 800c27c:	734a      	strb	r2, [r1, #13]
+  if(hsd->SdCard.CardType == CARD_SDSC)
+ 800c27e:	6bc2      	ldr	r2, [r0, #60]	; 0x3c
+{
+ 800c280:	b510      	push	{r4, lr}
+  if(hsd->SdCard.CardType == CARD_SDSC)
+ 800c282:	2a00      	cmp	r2, #0
+ 800c284:	d16c      	bne.n	800c360 <HAL_SD_GetCardCSD+0x12c>
+    pCSD->DeviceSize = (((hsd->CSD[1] & 0x000003FFU) << 2U) | ((hsd->CSD[2] & 0xC0000000U) >> 30U));
+ 800c286:	6e82      	ldr	r2, [r0, #104]	; 0x68
+ 800c288:	f640 74fc 	movw	r4, #4092	; 0xffc
+ 800c28c:	ea04 0383 	and.w	r3, r4, r3, lsl #2
+ 800c290:	ea43 7392 	orr.w	r3, r3, r2, lsr #30
+ 800c294:	610b      	str	r3, [r1, #16]
+    pCSD->MaxRdCurrentVDDMin = (uint8_t)((hsd->CSD[2] & 0x38000000U) >> 27U);
+ 800c296:	f3c2 63c2 	ubfx	r3, r2, #27, #3
+ 800c29a:	750b      	strb	r3, [r1, #20]
+    pCSD->MaxRdCurrentVDDMax = (uint8_t)((hsd->CSD[2] & 0x07000000U) >> 24U);
+ 800c29c:	f3c2 6302 	ubfx	r3, r2, #24, #3
+ 800c2a0:	754b      	strb	r3, [r1, #21]
+    pCSD->MaxWrCurrentVDDMin = (uint8_t)((hsd->CSD[2] & 0x00E00000U) >> 21U);
+ 800c2a2:	f3c2 5342 	ubfx	r3, r2, #21, #3
+ 800c2a6:	758b      	strb	r3, [r1, #22]
+    pCSD->MaxWrCurrentVDDMax = (uint8_t)((hsd->CSD[2] & 0x001C0000U) >> 18U);
+ 800c2a8:	f3c2 4382 	ubfx	r3, r2, #18, #3
+    pCSD->DeviceSizeMul = (uint8_t)((hsd->CSD[2] & 0x00038000U) >> 15U);
+ 800c2ac:	f3c2 32c2 	ubfx	r2, r2, #15, #3
+    pCSD->MaxWrCurrentVDDMax = (uint8_t)((hsd->CSD[2] & 0x001C0000U) >> 18U);
+ 800c2b0:	75cb      	strb	r3, [r1, #23]
+    pCSD->DeviceSizeMul = (uint8_t)((hsd->CSD[2] & 0x00038000U) >> 15U);
+ 800c2b2:	760a      	strb	r2, [r1, #24]
+    hsd->SdCard.BlockNbr  = (pCSD->DeviceSize + 1U) ;
+ 800c2b4:	690b      	ldr	r3, [r1, #16]
+    hsd->SdCard.BlockNbr *= (1UL << ((pCSD->DeviceSizeMul & 0x07U) + 2U));
+ 800c2b6:	7e0a      	ldrb	r2, [r1, #24]
+ 800c2b8:	f002 0207 	and.w	r2, r2, #7
+    hsd->SdCard.BlockNbr  = (pCSD->DeviceSize + 1U) ;
+ 800c2bc:	3301      	adds	r3, #1
+    hsd->SdCard.BlockNbr *= (1UL << ((pCSD->DeviceSizeMul & 0x07U) + 2U));
+ 800c2be:	3202      	adds	r2, #2
+ 800c2c0:	fa03 f202 	lsl.w	r2, r3, r2
+ 800c2c4:	64c2      	str	r2, [r0, #76]	; 0x4c
+    hsd->SdCard.BlockSize = (1UL << (pCSD->RdBlockLen & 0x0FU));
+ 800c2c6:	7a0b      	ldrb	r3, [r1, #8]
+ 800c2c8:	f003 040f 	and.w	r4, r3, #15
+ 800c2cc:	2301      	movs	r3, #1
+ 800c2ce:	40a3      	lsls	r3, r4
+ 800c2d0:	6503      	str	r3, [r0, #80]	; 0x50
+    hsd->SdCard.LogBlockNbr =  (hsd->SdCard.BlockNbr) * ((hsd->SdCard.BlockSize) / 512U);
+ 800c2d2:	0a5b      	lsrs	r3, r3, #9
+ 800c2d4:	4353      	muls	r3, r2
+ 800c2d6:	6543      	str	r3, [r0, #84]	; 0x54
+    hsd->SdCard.LogBlockSize = 512U;
+ 800c2d8:	f44f 7300 	mov.w	r3, #512	; 0x200
+    hsd->SdCard.LogBlockSize = hsd->SdCard.BlockSize;
+ 800c2dc:	6583      	str	r3, [r0, #88]	; 0x58
+  pCSD->EraseGrSize = (uint8_t)((hsd->CSD[2] & 0x00004000U) >> 14U);
+ 800c2de:	6e83      	ldr	r3, [r0, #104]	; 0x68
+ 800c2e0:	f3c3 3280 	ubfx	r2, r3, #14, #1
+ 800c2e4:	764a      	strb	r2, [r1, #25]
+  pCSD->EraseGrMul = (uint8_t)((hsd->CSD[2] & 0x00003F80U) >> 7U);
+ 800c2e6:	f3c3 12c6 	ubfx	r2, r3, #7, #7
+  pCSD->WrProtectGrSize = (uint8_t)(hsd->CSD[2] & 0x0000007FU);
+ 800c2ea:	f003 037f 	and.w	r3, r3, #127	; 0x7f
+  pCSD->EraseGrMul = (uint8_t)((hsd->CSD[2] & 0x00003F80U) >> 7U);
+ 800c2ee:	768a      	strb	r2, [r1, #26]
+  pCSD->WrProtectGrSize = (uint8_t)(hsd->CSD[2] & 0x0000007FU);
+ 800c2f0:	76cb      	strb	r3, [r1, #27]
+  pCSD->WrProtectGrEnable = (uint8_t)((hsd->CSD[3] & 0x80000000U) >> 31U);
+ 800c2f2:	6ec3      	ldr	r3, [r0, #108]	; 0x6c
+ 800c2f4:	0fda      	lsrs	r2, r3, #31
+ 800c2f6:	770a      	strb	r2, [r1, #28]
+  pCSD->ManDeflECC = (uint8_t)((hsd->CSD[3] & 0x60000000U) >> 29U);
+ 800c2f8:	f3c3 7241 	ubfx	r2, r3, #29, #2
+ 800c2fc:	774a      	strb	r2, [r1, #29]
+  pCSD->WrSpeedFact = (uint8_t)((hsd->CSD[3] & 0x1C000000U) >> 26U);
+ 800c2fe:	f3c3 6282 	ubfx	r2, r3, #26, #3
+ 800c302:	778a      	strb	r2, [r1, #30]
+  pCSD->MaxWrBlockLen= (uint8_t)((hsd->CSD[3] & 0x03C00000U) >> 22U);
+ 800c304:	f3c3 5283 	ubfx	r2, r3, #22, #4
+ 800c308:	77ca      	strb	r2, [r1, #31]
+  pCSD->WriteBlockPaPartial = (uint8_t)((hsd->CSD[3] & 0x00200000U) >> 21U);
+ 800c30a:	f3c3 5240 	ubfx	r2, r3, #21, #1
+ 800c30e:	f881 2020 	strb.w	r2, [r1, #32]
+  pCSD->Reserved3 = 0;
+ 800c312:	2000      	movs	r0, #0
+  pCSD->ContentProtectAppli = (uint8_t)((hsd->CSD[3] & 0x00010000U) >> 16U);
+ 800c314:	f3c3 4200 	ubfx	r2, r3, #16, #1
+  pCSD->Reserved3 = 0;
+ 800c318:	f881 0021 	strb.w	r0, [r1, #33]	; 0x21
+  pCSD->ContentProtectAppli = (uint8_t)((hsd->CSD[3] & 0x00010000U) >> 16U);
+ 800c31c:	f881 2022 	strb.w	r2, [r1, #34]	; 0x22
+  pCSD->FileFormatGroup = (uint8_t)((hsd->CSD[3] & 0x00008000U) >> 15U);
+ 800c320:	f3c3 32c0 	ubfx	r2, r3, #15, #1
+ 800c324:	f881 2023 	strb.w	r2, [r1, #35]	; 0x23
+  pCSD->CopyFlag = (uint8_t)((hsd->CSD[3] & 0x00004000U) >> 14U);
+ 800c328:	f3c3 3280 	ubfx	r2, r3, #14, #1
+ 800c32c:	f881 2024 	strb.w	r2, [r1, #36]	; 0x24
+  pCSD->PermWrProtect = (uint8_t)((hsd->CSD[3] & 0x00002000U) >> 13U);
+ 800c330:	f3c3 3240 	ubfx	r2, r3, #13, #1
+ 800c334:	f881 2025 	strb.w	r2, [r1, #37]	; 0x25
+  pCSD->TempWrProtect = (uint8_t)((hsd->CSD[3] & 0x00001000U) >> 12U);
+ 800c338:	f3c3 3200 	ubfx	r2, r3, #12, #1
+ 800c33c:	f881 2026 	strb.w	r2, [r1, #38]	; 0x26
+  pCSD->FileFormat = (uint8_t)((hsd->CSD[3] & 0x00000C00U) >> 10U);
+ 800c340:	f3c3 2281 	ubfx	r2, r3, #10, #2
+ 800c344:	f881 2027 	strb.w	r2, [r1, #39]	; 0x27
+  pCSD->ECC= (uint8_t)((hsd->CSD[3] & 0x00000300U) >> 8U);
+ 800c348:	f3c3 2201 	ubfx	r2, r3, #8, #2
+  pCSD->CSD_CRC = (uint8_t)((hsd->CSD[3] & 0x000000FEU) >> 1U);
+ 800c34c:	f3c3 0346 	ubfx	r3, r3, #1, #7
+  pCSD->ECC= (uint8_t)((hsd->CSD[3] & 0x00000300U) >> 8U);
+ 800c350:	f881 2028 	strb.w	r2, [r1, #40]	; 0x28
+  pCSD->CSD_CRC = (uint8_t)((hsd->CSD[3] & 0x000000FEU) >> 1U);
+ 800c354:	f881 3029 	strb.w	r3, [r1, #41]	; 0x29
+  pCSD->Reserved4 = 1;
+ 800c358:	2301      	movs	r3, #1
+ 800c35a:	f881 302a 	strb.w	r3, [r1, #42]	; 0x2a
+}
+ 800c35e:	bd10      	pop	{r4, pc}
+  else if(hsd->SdCard.CardType == CARD_SDHC_SDXC)
+ 800c360:	2a01      	cmp	r2, #1
+ 800c362:	d10f      	bne.n	800c384 <HAL_SD_GetCardCSD+0x150>
+    pCSD->DeviceSize = (((hsd->CSD[1] & 0x0000003FU) << 16U) | ((hsd->CSD[2] & 0xFFFF0000U) >> 16U));
+ 800c364:	f8b0 206a 	ldrh.w	r2, [r0, #106]	; 0x6a
+ 800c368:	041b      	lsls	r3, r3, #16
+ 800c36a:	f403 137c 	and.w	r3, r3, #4128768	; 0x3f0000
+ 800c36e:	4313      	orrs	r3, r2
+ 800c370:	610b      	str	r3, [r1, #16]
+    hsd->SdCard.BlockNbr = ((pCSD->DeviceSize + 1U) * 1024U);
+ 800c372:	690b      	ldr	r3, [r1, #16]
+ 800c374:	3301      	adds	r3, #1
+ 800c376:	029b      	lsls	r3, r3, #10
+ 800c378:	64c3      	str	r3, [r0, #76]	; 0x4c
+    hsd->SdCard.LogBlockNbr = hsd->SdCard.BlockNbr;
+ 800c37a:	6543      	str	r3, [r0, #84]	; 0x54
+    hsd->SdCard.BlockSize = 512U;
+ 800c37c:	f44f 7300 	mov.w	r3, #512	; 0x200
+ 800c380:	6503      	str	r3, [r0, #80]	; 0x50
+ 800c382:	e7ab      	b.n	800c2dc <HAL_SD_GetCardCSD+0xa8>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c384:	6803      	ldr	r3, [r0, #0]
+ 800c386:	4a05      	ldr	r2, [pc, #20]	; (800c39c <HAL_SD_GetCardCSD+0x168>)
+ 800c388:	639a      	str	r2, [r3, #56]	; 0x38
+    hsd->ErrorCode |= HAL_SD_ERROR_UNSUPPORTED_FEATURE;
+ 800c38a:	6b83      	ldr	r3, [r0, #56]	; 0x38
+ 800c38c:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+ 800c390:	6383      	str	r3, [r0, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c392:	2301      	movs	r3, #1
+ 800c394:	f880 3034 	strb.w	r3, [r0, #52]	; 0x34
+    return HAL_ERROR;
+ 800c398:	4618      	mov	r0, r3
+ 800c39a:	e7e0      	b.n	800c35e <HAL_SD_GetCardCSD+0x12a>
+ 800c39c:	1fe00fff 	.word	0x1fe00fff
+
+0800c3a0 <HAL_SD_InitCard>:
+{
+ 800c3a0:	e92d 43f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, lr}
+  Init.ClockEdge           = SDMMC_CLOCK_EDGE_RISING;
+ 800c3a4:	2300      	movs	r3, #0
+{
+ 800c3a6:	b099      	sub	sp, #100	; 0x64
+ 800c3a8:	4604      	mov	r4, r0
+  sdmmc_clk = HAL_RCCEx_GetPeriphCLKFreq(RCC_PERIPHCLK_SDMMC1);
+ 800c3aa:	f44f 2000 	mov.w	r0, #524288	; 0x80000
+  Init.ClockPowerSave      = SDMMC_CLOCK_POWER_SAVE_DISABLE;
+ 800c3ae:	e9cd 3307 	strd	r3, r3, [sp, #28]
+  Init.HardwareFlowControl = SDMMC_HARDWARE_FLOW_CONTROL_DISABLE;
+ 800c3b2:	e9cd 3309 	strd	r3, r3, [sp, #36]	; 0x24
+  sdmmc_clk = HAL_RCCEx_GetPeriphCLKFreq(RCC_PERIPHCLK_SDMMC1);
+ 800c3b6:	f7fd fb2d 	bl	8009a14 <HAL_RCCEx_GetPeriphCLKFreq>
+  if (sdmmc_clk == 0U)
+ 800c3ba:	4605      	mov	r5, r0
+ 800c3bc:	b948      	cbnz	r0, 800c3d2 <HAL_SD_InitCard+0x32>
+      hsd->State = HAL_SD_STATE_READY;
+ 800c3be:	2501      	movs	r5, #1
+      hsd->ErrorCode = SDMMC_ERROR_INVALID_PARAMETER;
+ 800c3c0:	f04f 6300 	mov.w	r3, #134217728	; 0x8000000
+      hsd->State = HAL_SD_STATE_READY;
+ 800c3c4:	f884 5034 	strb.w	r5, [r4, #52]	; 0x34
+      hsd->ErrorCode = SDMMC_ERROR_INVALID_PARAMETER;
+ 800c3c8:	63a3      	str	r3, [r4, #56]	; 0x38
+}
+ 800c3ca:	4628      	mov	r0, r5
+ 800c3cc:	b019      	add	sp, #100	; 0x64
+ 800c3ce:	e8bd 83f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, pc}
+  Init.Transceiver = hsd->Init.Transceiver;
+ 800c3d2:	69a3      	ldr	r3, [r4, #24]
+    hsd->Instance->POWER |= SDMMC_POWER_DIRPOL;
+ 800c3d4:	6827      	ldr	r7, [r4, #0]
+  Init.Transceiver = hsd->Init.Transceiver;
+ 800c3d6:	930c      	str	r3, [sp, #48]	; 0x30
+  if(hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE)
+ 800c3d8:	2b01      	cmp	r3, #1
+    hsd->Instance->POWER |= SDMMC_POWER_DIRPOL;
+ 800c3da:	bf08      	it	eq
+ 800c3dc:	683b      	ldreq	r3, [r7, #0]
+  Init.ClockDiv = sdmmc_clk / (2U * SD_INIT_FREQ);
+ 800c3de:	4e99      	ldr	r6, [pc, #612]	; (800c644 <HAL_SD_InitCard+0x2a4>)
+ 800c3e0:	fbb0 f6f6 	udiv	r6, r0, r6
+    hsd->Instance->POWER |= SDMMC_POWER_DIRPOL;
+ 800c3e4:	bf04      	itt	eq
+ 800c3e6:	f043 0310 	orreq.w	r3, r3, #16
+ 800c3ea:	603b      	streq	r3, [r7, #0]
+  status = SDMMC_Init(hsd->Instance, Init);
+ 800c3ec:	960b      	str	r6, [sp, #44]	; 0x2c
+ 800c3ee:	ab0a      	add	r3, sp, #40	; 0x28
+ 800c3f0:	e893 0007 	ldmia.w	r3, {r0, r1, r2}
+ 800c3f4:	e88d 0007 	stmia.w	sp, {r0, r1, r2}
+ 800c3f8:	ab07      	add	r3, sp, #28
+ 800c3fa:	cb0e      	ldmia	r3, {r1, r2, r3}
+ 800c3fc:	4638      	mov	r0, r7
+ 800c3fe:	f000 fcbb 	bl	800cd78 <SDMMC_Init>
+  if(status != HAL_OK)
+ 800c402:	b108      	cbz	r0, 800c408 <HAL_SD_InitCard+0x68>
+    return HAL_ERROR;
+ 800c404:	2501      	movs	r5, #1
+ 800c406:	e7e0      	b.n	800c3ca <HAL_SD_InitCard+0x2a>
+  status = SDMMC_PowerState_ON(hsd->Instance);
+ 800c408:	6820      	ldr	r0, [r4, #0]
+ 800c40a:	f000 fcd7 	bl	800cdbc <SDMMC_PowerState_ON>
+  if(status != HAL_OK)
+ 800c40e:	4607      	mov	r7, r0
+ 800c410:	2800      	cmp	r0, #0
+ 800c412:	d1f7      	bne.n	800c404 <HAL_SD_InitCard+0x64>
+  sdmmc_clk = sdmmc_clk/(2U*Init.ClockDiv);
+ 800c414:	0076      	lsls	r6, r6, #1
+  HAL_Delay(1U+ (74U*1000U/(sdmmc_clk)));
+ 800c416:	488c      	ldr	r0, [pc, #560]	; (800c648 <HAL_SD_InitCard+0x2a8>)
+  sdmmc_clk = sdmmc_clk/(2U*Init.ClockDiv);
+ 800c418:	fbb5 f5f6 	udiv	r5, r5, r6
+  HAL_Delay(1U+ (74U*1000U/(sdmmc_clk)));
+ 800c41c:	fbb0 f0f5 	udiv	r0, r0, r5
+ 800c420:	3001      	adds	r0, #1
+ 800c422:	f7f7 fa8c 	bl	800393e <HAL_Delay>
+  __IO uint32_t count = 0U;
+ 800c426:	9706      	str	r7, [sp, #24]
+  uint32_t tickstart = HAL_GetTick();
+ 800c428:	f7fa fe92 	bl	8007150 <HAL_GetTick>
+ 800c42c:	4606      	mov	r6, r0
+  errorstate = SDMMC_CmdGoIdleState(hsd->Instance);
+ 800c42e:	6820      	ldr	r0, [r4, #0]
+ 800c430:	f000 fd18 	bl	800ce64 <SDMMC_CmdGoIdleState>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c434:	4605      	mov	r5, r0
+ 800c436:	b940      	cbnz	r0, 800c44a <HAL_SD_InitCard+0xaa>
+  errorstate = SDMMC_CmdOperCond(hsd->Instance);
+ 800c438:	6820      	ldr	r0, [r4, #0]
+ 800c43a:	f001 f8fd 	bl	800d638 <SDMMC_CmdOperCond>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c43e:	b158      	cbz	r0, 800c458 <HAL_SD_InitCard+0xb8>
+    errorstate = SDMMC_CmdGoIdleState(hsd->Instance);
+ 800c440:	6820      	ldr	r0, [r4, #0]
+    hsd->SdCard.CardVersion = CARD_V1_X;
+ 800c442:	6425      	str	r5, [r4, #64]	; 0x40
+    errorstate = SDMMC_CmdGoIdleState(hsd->Instance);
+ 800c444:	f000 fd0e 	bl	800ce64 <SDMMC_CmdGoIdleState>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c448:	b180      	cbz	r0, 800c46c <HAL_SD_InitCard+0xcc>
+    hsd->State = HAL_SD_STATE_READY;
+ 800c44a:	2501      	movs	r5, #1
+ 800c44c:	f884 5034 	strb.w	r5, [r4, #52]	; 0x34
+    hsd->ErrorCode |= errorstate;
+ 800c450:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c452:	4318      	orrs	r0, r3
+ 800c454:	63a0      	str	r0, [r4, #56]	; 0x38
+    return HAL_ERROR;
+ 800c456:	e7b8      	b.n	800c3ca <HAL_SD_InitCard+0x2a>
+    hsd->SdCard.CardVersion = CARD_V2_X;
+ 800c458:	2301      	movs	r3, #1
+ 800c45a:	6423      	str	r3, [r4, #64]	; 0x40
+    errorstate = SDMMC_CmdAppCommand(hsd->Instance, 0);
+ 800c45c:	6820      	ldr	r0, [r4, #0]
+ 800c45e:	2100      	movs	r1, #0
+ 800c460:	f000 fef5 	bl	800d24e <SDMMC_CmdAppCommand>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c464:	b128      	cbz	r0, 800c472 <HAL_SD_InitCard+0xd2>
+    return HAL_SD_ERROR_UNSUPPORTED_FEATURE;
+ 800c466:	f04f 5080 	mov.w	r0, #268435456	; 0x10000000
+ 800c46a:	e7ee      	b.n	800c44a <HAL_SD_InitCard+0xaa>
+  if( hsd->SdCard.CardVersion == CARD_V2_X)
+ 800c46c:	6c23      	ldr	r3, [r4, #64]	; 0x40
+ 800c46e:	2b01      	cmp	r3, #1
+ 800c470:	d0f4      	beq.n	800c45c <HAL_SD_InitCard+0xbc>
+    errorstate = SDMMC_CmdAppOperCommand(hsd->Instance, SDMMC_VOLTAGE_WINDOW_SD | SDMMC_HIGH_CAPACITY | SD_SWITCH_1_8V_CAPACITY);
+ 800c472:	f8df 91dc 	ldr.w	r9, [pc, #476]	; 800c650 <HAL_SD_InitCard+0x2b0>
+{
+ 800c476:	2700      	movs	r7, #0
+  while((count < SDMMC_MAX_VOLT_TRIAL) && (validvoltage == 0U))
+ 800c478:	f64f 78fe 	movw	r8, #65534	; 0xfffe
+ 800c47c:	9b06      	ldr	r3, [sp, #24]
+ 800c47e:	4543      	cmp	r3, r8
+ 800c480:	d800      	bhi.n	800c484 <HAL_SD_InitCard+0xe4>
+ 800c482:	b12f      	cbz	r7, 800c490 <HAL_SD_InitCard+0xf0>
+  if(count >= SDMMC_MAX_VOLT_TRIAL)
+ 800c484:	9b06      	ldr	r3, [sp, #24]
+ 800c486:	4543      	cmp	r3, r8
+ 800c488:	d918      	bls.n	800c4bc <HAL_SD_InitCard+0x11c>
+    return HAL_SD_ERROR_INVALID_VOLTRANGE;
+ 800c48a:	f04f 7080 	mov.w	r0, #16777216	; 0x1000000
+ 800c48e:	e7dc      	b.n	800c44a <HAL_SD_InitCard+0xaa>
+    errorstate = SDMMC_CmdAppCommand(hsd->Instance, 0);
+ 800c490:	6820      	ldr	r0, [r4, #0]
+ 800c492:	4639      	mov	r1, r7
+ 800c494:	f000 fedb 	bl	800d24e <SDMMC_CmdAppCommand>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c498:	2800      	cmp	r0, #0
+ 800c49a:	d1d6      	bne.n	800c44a <HAL_SD_InitCard+0xaa>
+    errorstate = SDMMC_CmdAppOperCommand(hsd->Instance, SDMMC_VOLTAGE_WINDOW_SD | SDMMC_HIGH_CAPACITY | SD_SWITCH_1_8V_CAPACITY);
+ 800c49c:	6820      	ldr	r0, [r4, #0]
+ 800c49e:	4649      	mov	r1, r9
+ 800c4a0:	f001 f816 	bl	800d4d0 <SDMMC_CmdAppOperCommand>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c4a4:	2800      	cmp	r0, #0
+ 800c4a6:	d1de      	bne.n	800c466 <HAL_SD_InitCard+0xc6>
+    response = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1);
+ 800c4a8:	4639      	mov	r1, r7
+ 800c4aa:	6820      	ldr	r0, [r4, #0]
+ 800c4ac:	f000 fcb7 	bl	800ce1e <SDMMC_GetResponse>
+    count++;
+ 800c4b0:	9b06      	ldr	r3, [sp, #24]
+ 800c4b2:	3301      	adds	r3, #1
+    response = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1);
+ 800c4b4:	4605      	mov	r5, r0
+    validvoltage = (((response >> 31U) == 1U) ? 1U : 0U);
+ 800c4b6:	0fc7      	lsrs	r7, r0, #31
+    count++;
+ 800c4b8:	9306      	str	r3, [sp, #24]
+ 800c4ba:	e7df      	b.n	800c47c <HAL_SD_InitCard+0xdc>
+  if((response & SDMMC_HIGH_CAPACITY) == SDMMC_HIGH_CAPACITY) /* (response &= SD_HIGH_CAPACITY) */
+ 800c4bc:	f015 4380 	ands.w	r3, r5, #1073741824	; 0x40000000
+ 800c4c0:	d04b      	beq.n	800c55a <HAL_SD_InitCard+0x1ba>
+    hsd->SdCard.CardType = CARD_SDHC_SDXC;
+ 800c4c2:	2301      	movs	r3, #1
+ 800c4c4:	63e3      	str	r3, [r4, #60]	; 0x3c
+    if(hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE)
+ 800c4c6:	69a3      	ldr	r3, [r4, #24]
+    errorstate = SDMMC_CmdAppCommand(hsd->Instance, 0);
+ 800c4c8:	6820      	ldr	r0, [r4, #0]
+    if(hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE)
+ 800c4ca:	2b01      	cmp	r3, #1
+ 800c4cc:	d12d      	bne.n	800c52a <HAL_SD_InitCard+0x18a>
+      if((response & SD_SWITCH_1_8V_CAPACITY) == SD_SWITCH_1_8V_CAPACITY)
+ 800c4ce:	01ef      	lsls	r7, r5, #7
+ 800c4d0:	d52b      	bpl.n	800c52a <HAL_SD_InitCard+0x18a>
+        hsd->SdCard.CardSpeed = CARD_ULTRA_HIGH_SPEED;
+ 800c4d2:	f44f 7300 	mov.w	r3, #512	; 0x200
+ 800c4d6:	65e3      	str	r3, [r4, #92]	; 0x5c
+        hsd->Instance->POWER |= SDMMC_POWER_VSWITCHEN;
+ 800c4d8:	6803      	ldr	r3, [r0, #0]
+ 800c4da:	f043 0308 	orr.w	r3, r3, #8
+ 800c4de:	6003      	str	r3, [r0, #0]
+        errorstate = SDMMC_CmdVoltageSwitch(hsd->Instance);
+ 800c4e0:	f000 ff4e 	bl	800d380 <SDMMC_CmdVoltageSwitch>
+        if(errorstate != HAL_SD_ERROR_NONE)
+ 800c4e4:	2800      	cmp	r0, #0
+ 800c4e6:	d1b0      	bne.n	800c44a <HAL_SD_InitCard+0xaa>
+        while(( hsd->Instance->STA & SDMMC_FLAG_CKSTOP) != SDMMC_FLAG_CKSTOP)
+ 800c4e8:	6823      	ldr	r3, [r4, #0]
+ 800c4ea:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c4ec:	0155      	lsls	r5, r2, #5
+ 800c4ee:	d526      	bpl.n	800c53e <HAL_SD_InitCard+0x19e>
+        hsd->Instance->ICR = SDMMC_FLAG_CKSTOP;
+ 800c4f0:	f04f 6280 	mov.w	r2, #67108864	; 0x4000000
+ 800c4f4:	639a      	str	r2, [r3, #56]	; 0x38
+        if(( hsd->Instance->STA & SDMMC_FLAG_BUSYD0) != SDMMC_FLAG_BUSYD0)
+ 800c4f6:	6b5b      	ldr	r3, [r3, #52]	; 0x34
+ 800c4f8:	02d8      	lsls	r0, r3, #11
+ 800c4fa:	d5b4      	bpl.n	800c466 <HAL_SD_InitCard+0xc6>
+          HAL_SDEx_DriveTransceiver_1_8V_Callback(SET);
+ 800c4fc:	2001      	movs	r0, #1
+ 800c4fe:	f7fa fe97 	bl	8007230 <HAL_SDEx_DriveTransceiver_1_8V_Callback>
+          hsd->Instance->POWER |= SDMMC_POWER_VSWITCH;
+ 800c502:	6822      	ldr	r2, [r4, #0]
+ 800c504:	6813      	ldr	r3, [r2, #0]
+ 800c506:	f043 0304 	orr.w	r3, r3, #4
+ 800c50a:	6013      	str	r3, [r2, #0]
+          while(( hsd->Instance->STA & SDMMC_FLAG_VSWEND) != SDMMC_FLAG_VSWEND)
+ 800c50c:	6823      	ldr	r3, [r4, #0]
+ 800c50e:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c510:	0191      	lsls	r1, r2, #6
+ 800c512:	d51c      	bpl.n	800c54e <HAL_SD_InitCard+0x1ae>
+          hsd->Instance->ICR = SDMMC_FLAG_VSWEND;
+ 800c514:	f04f 7200 	mov.w	r2, #33554432	; 0x2000000
+ 800c518:	639a      	str	r2, [r3, #56]	; 0x38
+          if(( hsd->Instance->STA & SDMMC_FLAG_BUSYD0) == SDMMC_FLAG_BUSYD0)
+ 800c51a:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c51c:	02d2      	lsls	r2, r2, #11
+ 800c51e:	d4b4      	bmi.n	800c48a <HAL_SD_InitCard+0xea>
+          hsd->Instance->POWER = 0x13U;
+ 800c520:	2213      	movs	r2, #19
+ 800c522:	601a      	str	r2, [r3, #0]
+          hsd->Instance->ICR = 0xFFFFFFFFU;
+ 800c524:	f04f 32ff 	mov.w	r2, #4294967295	; 0xffffffff
+ 800c528:	639a      	str	r2, [r3, #56]	; 0x38
+  uint16_t sd_rca = 1U;
+ 800c52a:	2301      	movs	r3, #1
+  if(SDMMC_GetPowerState(hsd->Instance) == 0U)
+ 800c52c:	6820      	ldr	r0, [r4, #0]
+  uint16_t sd_rca = 1U;
+ 800c52e:	f8ad 3016 	strh.w	r3, [sp, #22]
+  if(SDMMC_GetPowerState(hsd->Instance) == 0U)
+ 800c532:	f000 fc59 	bl	800cde8 <SDMMC_GetPowerState>
+ 800c536:	b990      	cbnz	r0, 800c55e <HAL_SD_InitCard+0x1be>
+    return HAL_SD_ERROR_REQUEST_NOT_APPLICABLE;
+ 800c538:	f04f 6080 	mov.w	r0, #67108864	; 0x4000000
+ 800c53c:	e785      	b.n	800c44a <HAL_SD_InitCard+0xaa>
+          if((HAL_GetTick() - tickstart) >=  SDMMC_DATATIMEOUT)
+ 800c53e:	f7fa fe07 	bl	8007150 <HAL_GetTick>
+ 800c542:	1b80      	subs	r0, r0, r6
+ 800c544:	3001      	adds	r0, #1
+ 800c546:	d1cf      	bne.n	800c4e8 <HAL_SD_InitCard+0x148>
+            return HAL_SD_ERROR_TIMEOUT;
+ 800c548:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+ 800c54c:	e77d      	b.n	800c44a <HAL_SD_InitCard+0xaa>
+            if((HAL_GetTick() - tickstart) >=  SDMMC_DATATIMEOUT)
+ 800c54e:	f7fa fdff 	bl	8007150 <HAL_GetTick>
+ 800c552:	1b80      	subs	r0, r0, r6
+ 800c554:	3001      	adds	r0, #1
+ 800c556:	d1d9      	bne.n	800c50c <HAL_SD_InitCard+0x16c>
+ 800c558:	e7f6      	b.n	800c548 <HAL_SD_InitCard+0x1a8>
+    hsd->SdCard.CardType = CARD_SDSC;
+ 800c55a:	63e3      	str	r3, [r4, #60]	; 0x3c
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c55c:	e7e5      	b.n	800c52a <HAL_SD_InitCard+0x18a>
+  if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c55e:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 800c560:	2b03      	cmp	r3, #3
+ 800c562:	d045      	beq.n	800c5f0 <HAL_SD_InitCard+0x250>
+    errorstate = SDMMC_CmdSendCID(hsd->Instance);
+ 800c564:	6820      	ldr	r0, [r4, #0]
+ 800c566:	f000 ff65 	bl	800d434 <SDMMC_CmdSendCID>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c56a:	2800      	cmp	r0, #0
+ 800c56c:	f47f af6d 	bne.w	800c44a <HAL_SD_InitCard+0xaa>
+      hsd->CID[0U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1);
+ 800c570:	4601      	mov	r1, r0
+ 800c572:	6820      	ldr	r0, [r4, #0]
+ 800c574:	f000 fc53 	bl	800ce1e <SDMMC_GetResponse>
+      hsd->CID[1U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP2);
+ 800c578:	2104      	movs	r1, #4
+      hsd->CID[0U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1);
+ 800c57a:	6720      	str	r0, [r4, #112]	; 0x70
+      hsd->CID[1U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP2);
+ 800c57c:	6820      	ldr	r0, [r4, #0]
+ 800c57e:	f000 fc4e 	bl	800ce1e <SDMMC_GetResponse>
+      hsd->CID[2U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP3);
+ 800c582:	2108      	movs	r1, #8
+      hsd->CID[1U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP2);
+ 800c584:	6760      	str	r0, [r4, #116]	; 0x74
+      hsd->CID[2U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP3);
+ 800c586:	6820      	ldr	r0, [r4, #0]
+ 800c588:	f000 fc49 	bl	800ce1e <SDMMC_GetResponse>
+      hsd->CID[3U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP4);
+ 800c58c:	210c      	movs	r1, #12
+      hsd->CID[2U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP3);
+ 800c58e:	67a0      	str	r0, [r4, #120]	; 0x78
+      hsd->CID[3U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP4);
+ 800c590:	6820      	ldr	r0, [r4, #0]
+ 800c592:	f000 fc44 	bl	800ce1e <SDMMC_GetResponse>
+  if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c596:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+      hsd->CID[3U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP4);
+ 800c598:	67e0      	str	r0, [r4, #124]	; 0x7c
+  if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c59a:	2b03      	cmp	r3, #3
+ 800c59c:	d028      	beq.n	800c5f0 <HAL_SD_InitCard+0x250>
+    errorstate = SDMMC_CmdSetRelAdd(hsd->Instance, &sd_rca);
+ 800c59e:	6820      	ldr	r0, [r4, #0]
+ 800c5a0:	f10d 0116 	add.w	r1, sp, #22
+ 800c5a4:	f001 f804 	bl	800d5b0 <SDMMC_CmdSetRelAdd>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c5a8:	2800      	cmp	r0, #0
+ 800c5aa:	f47f af4e 	bne.w	800c44a <HAL_SD_InitCard+0xaa>
+  if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c5ae:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+    errorstate = SDMMC_CmdSendCSD(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c5b0:	6820      	ldr	r0, [r4, #0]
+  if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c5b2:	2b03      	cmp	r3, #3
+ 800c5b4:	d01c      	beq.n	800c5f0 <HAL_SD_InitCard+0x250>
+    hsd->SdCard.RelCardAdd = sd_rca;
+ 800c5b6:	f8bd 1016 	ldrh.w	r1, [sp, #22]
+ 800c5ba:	64a1      	str	r1, [r4, #72]	; 0x48
+    errorstate = SDMMC_CmdSendCSD(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c5bc:	0409      	lsls	r1, r1, #16
+ 800c5be:	f000 ff4f 	bl	800d460 <SDMMC_CmdSendCSD>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c5c2:	2800      	cmp	r0, #0
+ 800c5c4:	f47f af41 	bne.w	800c44a <HAL_SD_InitCard+0xaa>
+      hsd->CSD[0U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1);
+ 800c5c8:	4601      	mov	r1, r0
+ 800c5ca:	6820      	ldr	r0, [r4, #0]
+ 800c5cc:	f000 fc27 	bl	800ce1e <SDMMC_GetResponse>
+      hsd->CSD[1U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP2);
+ 800c5d0:	2104      	movs	r1, #4
+      hsd->CSD[0U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1);
+ 800c5d2:	6620      	str	r0, [r4, #96]	; 0x60
+      hsd->CSD[1U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP2);
+ 800c5d4:	6820      	ldr	r0, [r4, #0]
+ 800c5d6:	f000 fc22 	bl	800ce1e <SDMMC_GetResponse>
+      hsd->CSD[2U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP3);
+ 800c5da:	2108      	movs	r1, #8
+      hsd->CSD[1U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP2);
+ 800c5dc:	6660      	str	r0, [r4, #100]	; 0x64
+      hsd->CSD[2U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP3);
+ 800c5de:	6820      	ldr	r0, [r4, #0]
+ 800c5e0:	f000 fc1d 	bl	800ce1e <SDMMC_GetResponse>
+      hsd->CSD[3U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP4);
+ 800c5e4:	210c      	movs	r1, #12
+      hsd->CSD[2U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP3);
+ 800c5e6:	66a0      	str	r0, [r4, #104]	; 0x68
+      hsd->CSD[3U] = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP4);
+ 800c5e8:	6820      	ldr	r0, [r4, #0]
+ 800c5ea:	f000 fc18 	bl	800ce1e <SDMMC_GetResponse>
+ 800c5ee:	66e0      	str	r0, [r4, #108]	; 0x6c
+  hsd->SdCard.Class = (SDMMC_GetResponse(hsd->Instance, SDMMC_RESP2) >> 20U);
+ 800c5f0:	2104      	movs	r1, #4
+ 800c5f2:	6820      	ldr	r0, [r4, #0]
+ 800c5f4:	f000 fc13 	bl	800ce1e <SDMMC_GetResponse>
+ 800c5f8:	0d00      	lsrs	r0, r0, #20
+ 800c5fa:	6460      	str	r0, [r4, #68]	; 0x44
+  if (HAL_SD_GetCardCSD(hsd, &CSD) != HAL_OK)
+ 800c5fc:	a90d      	add	r1, sp, #52	; 0x34
+ 800c5fe:	4620      	mov	r0, r4
+ 800c600:	f7ff fe18 	bl	800c234 <HAL_SD_GetCardCSD>
+ 800c604:	4605      	mov	r5, r0
+ 800c606:	2800      	cmp	r0, #0
+ 800c608:	f47f af2d 	bne.w	800c466 <HAL_SD_InitCard+0xc6>
+  errorstate = SDMMC_CmdSelDesel(hsd->Instance, (uint32_t)(((uint32_t)hsd->SdCard.RelCardAdd) << 16U));
+ 800c60c:	6ca2      	ldr	r2, [r4, #72]	; 0x48
+ 800c60e:	4603      	mov	r3, r0
+ 800c610:	0412      	lsls	r2, r2, #16
+ 800c612:	6820      	ldr	r0, [r4, #0]
+ 800c614:	f000 fe02 	bl	800d21c <SDMMC_CmdSelDesel>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c618:	2800      	cmp	r0, #0
+ 800c61a:	f47f af16 	bne.w	800c44a <HAL_SD_InitCard+0xaa>
+  errorstate = SDMMC_CmdBlockLength(hsd->Instance, BLOCKSIZE);
+ 800c61e:	6820      	ldr	r0, [r4, #0]
+ 800c620:	f44f 7100 	mov.w	r1, #512	; 0x200
+ 800c624:	f000 fcda 	bl	800cfdc <SDMMC_CmdBlockLength>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c628:	2800      	cmp	r0, #0
+ 800c62a:	f43f aece 	beq.w	800c3ca <HAL_SD_InitCard+0x2a>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c62e:	6823      	ldr	r3, [r4, #0]
+ 800c630:	4a06      	ldr	r2, [pc, #24]	; (800c64c <HAL_SD_InitCard+0x2ac>)
+ 800c632:	639a      	str	r2, [r3, #56]	; 0x38
+    hsd->ErrorCode |= errorstate;
+ 800c634:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c636:	2501      	movs	r5, #1
+    hsd->ErrorCode |= errorstate;
+ 800c638:	4318      	orrs	r0, r3
+ 800c63a:	63a0      	str	r0, [r4, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c63c:	f884 5034 	strb.w	r5, [r4, #52]	; 0x34
+    return HAL_ERROR;
+ 800c640:	e6c3      	b.n	800c3ca <HAL_SD_InitCard+0x2a>
+ 800c642:	bf00      	nop
+ 800c644:	000c3500 	.word	0x000c3500
+ 800c648:	00012110 	.word	0x00012110
+ 800c64c:	1fe00fff 	.word	0x1fe00fff
+ 800c650:	c1100000 	.word	0xc1100000
+
+0800c654 <HAL_SD_GetCardStatus>:
+{
+ 800c654:	e92d 41f0 	stmdb	sp!, {r4, r5, r6, r7, r8, lr}
+ 800c658:	b096      	sub	sp, #88	; 0x58
+ 800c65a:	4604      	mov	r4, r0
+ 800c65c:	460d      	mov	r5, r1
+  uint32_t tickstart = HAL_GetTick();
+ 800c65e:	f7fa fd77 	bl	8007150 <HAL_GetTick>
+  if((SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1) & SDMMC_CARD_LOCKED) == SDMMC_CARD_LOCKED)
+ 800c662:	2100      	movs	r1, #0
+  uint32_t tickstart = HAL_GetTick();
+ 800c664:	4606      	mov	r6, r0
+  if((SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1) & SDMMC_CARD_LOCKED) == SDMMC_CARD_LOCKED)
+ 800c666:	6820      	ldr	r0, [r4, #0]
+ 800c668:	f000 fbd9 	bl	800ce1e <SDMMC_GetResponse>
+ 800c66c:	0183      	lsls	r3, r0, #6
+ 800c66e:	d50b      	bpl.n	800c688 <HAL_SD_GetCardStatus+0x34>
+    return HAL_SD_ERROR_LOCK_UNLOCK_FAILED;
+ 800c670:	f44f 6000 	mov.w	r0, #2048	; 0x800
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c674:	6823      	ldr	r3, [r4, #0]
+ 800c676:	4a54      	ldr	r2, [pc, #336]	; (800c7c8 <HAL_SD_GetCardStatus+0x174>)
+ 800c678:	639a      	str	r2, [r3, #56]	; 0x38
+    hsd->ErrorCode |= errorstate;
+ 800c67a:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c67c:	2501      	movs	r5, #1
+    hsd->ErrorCode |= errorstate;
+ 800c67e:	4318      	orrs	r0, r3
+ 800c680:	63a0      	str	r0, [r4, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c682:	f884 5034 	strb.w	r5, [r4, #52]	; 0x34
+    status = HAL_ERROR;
+ 800c686:	e08a      	b.n	800c79e <HAL_SD_GetCardStatus+0x14a>
+  errorstate = SDMMC_CmdBlockLength(hsd->Instance, 64U);
+ 800c688:	6820      	ldr	r0, [r4, #0]
+ 800c68a:	2140      	movs	r1, #64	; 0x40
+ 800c68c:	f000 fca6 	bl	800cfdc <SDMMC_CmdBlockLength>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c690:	b110      	cbz	r0, 800c698 <HAL_SD_GetCardStatus+0x44>
+    hsd->ErrorCode |= HAL_SD_ERROR_NONE;
+ 800c692:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c694:	63a3      	str	r3, [r4, #56]	; 0x38
+    return errorstate;
+ 800c696:	e7ed      	b.n	800c674 <HAL_SD_GetCardStatus+0x20>
+  errorstate = SDMMC_CmdAppCommand(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c698:	6ca1      	ldr	r1, [r4, #72]	; 0x48
+ 800c69a:	6820      	ldr	r0, [r4, #0]
+ 800c69c:	0409      	lsls	r1, r1, #16
+ 800c69e:	f000 fdd6 	bl	800d24e <SDMMC_CmdAppCommand>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c6a2:	2800      	cmp	r0, #0
+ 800c6a4:	d1f5      	bne.n	800c692 <HAL_SD_GetCardStatus+0x3e>
+  config.DataLength    = 64U;
+ 800c6a6:	2340      	movs	r3, #64	; 0x40
+ 800c6a8:	f04f 37ff 	mov.w	r7, #4294967295	; 0xffffffff
+ 800c6ac:	e9cd 7300 	strd	r7, r3, [sp]
+  config.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800c6b0:	f04f 0c60 	mov.w	ip, #96	; 0x60
+ 800c6b4:	2302      	movs	r3, #2
+ 800c6b6:	e9cd c302 	strd	ip, r3, [sp, #8]
+  config.TransferMode  = SDMMC_TRANSFER_MODE_BLOCK;
+ 800c6ba:	9004      	str	r0, [sp, #16]
+  config.DPSM          = SDMMC_DPSM_ENABLE;
+ 800c6bc:	2301      	movs	r3, #1
+  (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800c6be:	6820      	ldr	r0, [r4, #0]
+  config.DPSM          = SDMMC_DPSM_ENABLE;
+ 800c6c0:	9305      	str	r3, [sp, #20]
+  (void)SDMMC_ConfigData(hsd->Instance, &config);
+ 800c6c2:	4669      	mov	r1, sp
+ 800c6c4:	f000 fbae 	bl	800ce24 <SDMMC_ConfigData>
+  errorstate = SDMMC_CmdStatusRegister(hsd->Instance);
+ 800c6c8:	6820      	ldr	r0, [r4, #0]
+ 800c6ca:	f000 fe40 	bl	800d34e <SDMMC_CmdStatusRegister>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c6ce:	2800      	cmp	r0, #0
+ 800c6d0:	d1df      	bne.n	800c692 <HAL_SD_GetCardStatus+0x3e>
+  uint32_t *pData = pSDstatus;
+ 800c6d2:	af06      	add	r7, sp, #24
+  while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DATAEND))
+ 800c6d4:	6823      	ldr	r3, [r4, #0]
+ 800c6d6:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c6d8:	f412 7f95 	tst.w	r2, #298	; 0x12a
+ 800c6dc:	d00a      	beq.n	800c6f4 <HAL_SD_GetCardStatus+0xa0>
+  if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DTIMEOUT))
+ 800c6de:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c6e0:	0711      	lsls	r1, r2, #28
+ 800c6e2:	d46f      	bmi.n	800c7c4 <HAL_SD_GetCardStatus+0x170>
+  else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DCRCFAIL))
+ 800c6e4:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800c6e6:	0792      	lsls	r2, r2, #30
+ 800c6e8:	d46a      	bmi.n	800c7c0 <HAL_SD_GetCardStatus+0x16c>
+  else if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+ 800c6ea:	6b5b      	ldr	r3, [r3, #52]	; 0x34
+ 800c6ec:	069b      	lsls	r3, r3, #26
+ 800c6ee:	d51e      	bpl.n	800c72e <HAL_SD_GetCardStatus+0xda>
+    return HAL_SD_ERROR_RX_OVERRUN;
+ 800c6f0:	2020      	movs	r0, #32
+ 800c6f2:	e7bf      	b.n	800c674 <HAL_SD_GetCardStatus+0x20>
+    if(__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXFIFOHF))
+ 800c6f4:	6b5b      	ldr	r3, [r3, #52]	; 0x34
+ 800c6f6:	0418      	lsls	r0, r3, #16
+ 800c6f8:	d508      	bpl.n	800c70c <HAL_SD_GetCardStatus+0xb8>
+ 800c6fa:	f107 0820 	add.w	r8, r7, #32
+        *pData = SDMMC_ReadFIFO(hsd->Instance);
+ 800c6fe:	6820      	ldr	r0, [r4, #0]
+ 800c700:	f000 fb54 	bl	800cdac <SDMMC_ReadFIFO>
+ 800c704:	f847 0b04 	str.w	r0, [r7], #4
+      for(count = 0U; count < 8U; count++)
+ 800c708:	45b8      	cmp	r8, r7
+ 800c70a:	d1f8      	bne.n	800c6fe <HAL_SD_GetCardStatus+0xaa>
+    if((HAL_GetTick() - tickstart) >=  SDMMC_DATATIMEOUT)
+ 800c70c:	f7fa fd20 	bl	8007150 <HAL_GetTick>
+ 800c710:	1b80      	subs	r0, r0, r6
+ 800c712:	3001      	adds	r0, #1
+ 800c714:	d1de      	bne.n	800c6d4 <HAL_SD_GetCardStatus+0x80>
+      return HAL_SD_ERROR_TIMEOUT;
+ 800c716:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c71a:	e7ab      	b.n	800c674 <HAL_SD_GetCardStatus+0x20>
+    *pData = SDMMC_ReadFIFO(hsd->Instance);
+ 800c71c:	f000 fb46 	bl	800cdac <SDMMC_ReadFIFO>
+ 800c720:	f847 0b04 	str.w	r0, [r7], #4
+    if((HAL_GetTick() - tickstart) >=  SDMMC_DATATIMEOUT)
+ 800c724:	f7fa fd14 	bl	8007150 <HAL_GetTick>
+ 800c728:	1b80      	subs	r0, r0, r6
+ 800c72a:	3001      	adds	r0, #1
+ 800c72c:	d0f3      	beq.n	800c716 <HAL_SD_GetCardStatus+0xc2>
+  while ((__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DPSMACT)))
+ 800c72e:	6820      	ldr	r0, [r4, #0]
+ 800c730:	6b43      	ldr	r3, [r0, #52]	; 0x34
+ 800c732:	f413 5380 	ands.w	r3, r3, #4096	; 0x1000
+ 800c736:	d1f1      	bne.n	800c71c <HAL_SD_GetCardStatus+0xc8>
+    pStatus->DataBusWidth = (uint8_t)((sd_status[0] & 0xC0U) >> 6U);
+ 800c738:	9906      	ldr	r1, [sp, #24]
+  __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_DATA_FLAGS);
+ 800c73a:	4a24      	ldr	r2, [pc, #144]	; (800c7cc <HAL_SD_GetCardStatus+0x178>)
+ 800c73c:	6382      	str	r2, [r0, #56]	; 0x38
+    pStatus->DataBusWidth = (uint8_t)((sd_status[0] & 0xC0U) >> 6U);
+ 800c73e:	f3c1 1281 	ubfx	r2, r1, #6, #2
+ 800c742:	702a      	strb	r2, [r5, #0]
+    pStatus->SecuredMode = (uint8_t)((sd_status[0] & 0x20U) >> 5U);
+ 800c744:	f3c1 1240 	ubfx	r2, r1, #5, #1
+ 800c748:	706a      	strb	r2, [r5, #1]
+    pStatus->CardType = (uint16_t)(((sd_status[0] & 0x00FF0000U) >> 8U) | ((sd_status[0] & 0xFF000000U) >> 24U));
+ 800c74a:	0a0a      	lsrs	r2, r1, #8
+ 800c74c:	f022 02ff 	bic.w	r2, r2, #255	; 0xff
+ 800c750:	ea42 6211 	orr.w	r2, r2, r1, lsr #24
+ 800c754:	b292      	uxth	r2, r2
+ 800c756:	806a      	strh	r2, [r5, #2]
+    pStatus->ProtectedAreaSize = (((sd_status[1] & 0xFFU) << 24U)    | ((sd_status[1] & 0xFF00U) << 8U) |
+ 800c758:	9a07      	ldr	r2, [sp, #28]
+ 800c75a:	ba12      	rev	r2, r2
+ 800c75c:	606a      	str	r2, [r5, #4]
+    pStatus->SpeedClass = (uint8_t)(sd_status[2] & 0xFFU);
+ 800c75e:	9a08      	ldr	r2, [sp, #32]
+ 800c760:	b2d1      	uxtb	r1, r2
+ 800c762:	7229      	strb	r1, [r5, #8]
+    pStatus->PerformanceMove = (uint8_t)((sd_status[2] & 0xFF00U) >> 8U);
+ 800c764:	f3c2 2107 	ubfx	r1, r2, #8, #8
+ 800c768:	7269      	strb	r1, [r5, #9]
+    pStatus->AllocationUnitSize = (uint8_t)((sd_status[2] & 0xF00000U) >> 20U);
+ 800c76a:	f3c2 5103 	ubfx	r1, r2, #20, #4
+ 800c76e:	72a9      	strb	r1, [r5, #10]
+    pStatus->EraseSize = (uint16_t)(((sd_status[2] & 0xFF000000U) >> 16U) | (sd_status[3] & 0xFFU));
+ 800c770:	9909      	ldr	r1, [sp, #36]	; 0x24
+ 800c772:	0c12      	lsrs	r2, r2, #16
+ 800c774:	b2c8      	uxtb	r0, r1
+ 800c776:	f022 02ff 	bic.w	r2, r2, #255	; 0xff
+ 800c77a:	4302      	orrs	r2, r0
+ 800c77c:	81aa      	strh	r2, [r5, #12]
+    pStatus->EraseTimeout = (uint8_t)((sd_status[3] & 0xFC00U) >> 10U);
+ 800c77e:	f3c1 2285 	ubfx	r2, r1, #10, #6
+ 800c782:	73aa      	strb	r2, [r5, #14]
+    pStatus->EraseOffset = (uint8_t)((sd_status[3] & 0x0300U) >> 8U);
+ 800c784:	f3c1 2201 	ubfx	r2, r1, #8, #2
+ 800c788:	73ea      	strb	r2, [r5, #15]
+    pStatus->UhsSpeedGrade = (uint8_t)((sd_status[3] & 0x00F0U) >> 4U);
+ 800c78a:	f3c1 1203 	ubfx	r2, r1, #4, #4
+ 800c78e:	742a      	strb	r2, [r5, #16]
+    pStatus->UhsAllocationUnitSize = (uint8_t)(sd_status[3] & 0x000FU) ;
+ 800c790:	f001 010f 	and.w	r1, r1, #15
+    pStatus->VideoSpeedClass = (uint8_t)((sd_status[4] & 0xFF000000U) >> 24U);
+ 800c794:	f89d 202b 	ldrb.w	r2, [sp, #43]	; 0x2b
+    pStatus->UhsAllocationUnitSize = (uint8_t)(sd_status[3] & 0x000FU) ;
+ 800c798:	7469      	strb	r1, [r5, #17]
+    pStatus->VideoSpeedClass = (uint8_t)((sd_status[4] & 0xFF000000U) >> 24U);
+ 800c79a:	74aa      	strb	r2, [r5, #18]
+  HAL_StatusTypeDef status = HAL_OK;
+ 800c79c:	461d      	mov	r5, r3
+  errorstate = SDMMC_CmdBlockLength(hsd->Instance, BLOCKSIZE);
+ 800c79e:	6820      	ldr	r0, [r4, #0]
+ 800c7a0:	f44f 7100 	mov.w	r1, #512	; 0x200
+ 800c7a4:	f000 fc1a 	bl	800cfdc <SDMMC_CmdBlockLength>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c7a8:	b130      	cbz	r0, 800c7b8 <HAL_SD_GetCardStatus+0x164>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c7aa:	6823      	ldr	r3, [r4, #0]
+ 800c7ac:	4a06      	ldr	r2, [pc, #24]	; (800c7c8 <HAL_SD_GetCardStatus+0x174>)
+ 800c7ae:	639a      	str	r2, [r3, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c7b0:	2501      	movs	r5, #1
+    hsd->ErrorCode = errorstate;
+ 800c7b2:	63a0      	str	r0, [r4, #56]	; 0x38
+    hsd->State = HAL_SD_STATE_READY;
+ 800c7b4:	f884 5034 	strb.w	r5, [r4, #52]	; 0x34
+}
+ 800c7b8:	4628      	mov	r0, r5
+ 800c7ba:	b016      	add	sp, #88	; 0x58
+ 800c7bc:	e8bd 81f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, pc}
+    return HAL_SD_ERROR_DATA_CRC_FAIL;
+ 800c7c0:	2002      	movs	r0, #2
+ 800c7c2:	e757      	b.n	800c674 <HAL_SD_GetCardStatus+0x20>
+    return HAL_SD_ERROR_DATA_TIMEOUT;
+ 800c7c4:	2008      	movs	r0, #8
+ 800c7c6:	e755      	b.n	800c674 <HAL_SD_GetCardStatus+0x20>
+ 800c7c8:	1fe00fff 	.word	0x1fe00fff
+ 800c7cc:	18000f3a 	.word	0x18000f3a
+
+0800c7d0 <HAL_SD_GetCardInfo>:
+  pCardInfo->CardType     = (uint32_t)(hsd->SdCard.CardType);
+ 800c7d0:	6bc3      	ldr	r3, [r0, #60]	; 0x3c
+ 800c7d2:	600b      	str	r3, [r1, #0]
+  pCardInfo->CardVersion  = (uint32_t)(hsd->SdCard.CardVersion);
+ 800c7d4:	6c03      	ldr	r3, [r0, #64]	; 0x40
+ 800c7d6:	604b      	str	r3, [r1, #4]
+  pCardInfo->Class        = (uint32_t)(hsd->SdCard.Class);
+ 800c7d8:	6c43      	ldr	r3, [r0, #68]	; 0x44
+ 800c7da:	608b      	str	r3, [r1, #8]
+  pCardInfo->RelCardAdd   = (uint32_t)(hsd->SdCard.RelCardAdd);
+ 800c7dc:	6c83      	ldr	r3, [r0, #72]	; 0x48
+ 800c7de:	60cb      	str	r3, [r1, #12]
+  pCardInfo->BlockNbr     = (uint32_t)(hsd->SdCard.BlockNbr);
+ 800c7e0:	6cc3      	ldr	r3, [r0, #76]	; 0x4c
+ 800c7e2:	610b      	str	r3, [r1, #16]
+  pCardInfo->BlockSize    = (uint32_t)(hsd->SdCard.BlockSize);
+ 800c7e4:	6d03      	ldr	r3, [r0, #80]	; 0x50
+ 800c7e6:	614b      	str	r3, [r1, #20]
+  pCardInfo->LogBlockNbr  = (uint32_t)(hsd->SdCard.LogBlockNbr);
+ 800c7e8:	6d43      	ldr	r3, [r0, #84]	; 0x54
+ 800c7ea:	618b      	str	r3, [r1, #24]
+  pCardInfo->LogBlockSize = (uint32_t)(hsd->SdCard.LogBlockSize);
+ 800c7ec:	6d83      	ldr	r3, [r0, #88]	; 0x58
+ 800c7ee:	61cb      	str	r3, [r1, #28]
+}
+ 800c7f0:	2000      	movs	r0, #0
+ 800c7f2:	4770      	bx	lr
+
+0800c7f4 <HAL_SD_ConfigWideBusOperation>:
+{
+ 800c7f4:	b530      	push	{r4, r5, lr}
+  hsd->State = HAL_SD_STATE_BUSY;
+ 800c7f6:	2303      	movs	r3, #3
+ 800c7f8:	f880 3034 	strb.w	r3, [r0, #52]	; 0x34
+  if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c7fc:	6bc3      	ldr	r3, [r0, #60]	; 0x3c
+ 800c7fe:	2b03      	cmp	r3, #3
+{
+ 800c800:	b08b      	sub	sp, #44	; 0x2c
+ 800c802:	4604      	mov	r4, r0
+ 800c804:	460d      	mov	r5, r1
+  if(hsd->SdCard.CardType != CARD_SECURED)
+ 800c806:	d002      	beq.n	800c80e <HAL_SD_ConfigWideBusOperation+0x1a>
+    if(WideMode == SDMMC_BUS_WIDE_8B)
+ 800c808:	f5b1 4f00 	cmp.w	r1, #32768	; 0x8000
+ 800c80c:	d103      	bne.n	800c816 <HAL_SD_ConfigWideBusOperation+0x22>
+    hsd->ErrorCode |= HAL_SD_ERROR_UNSUPPORTED_FEATURE;
+ 800c80e:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c810:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+ 800c814:	e049      	b.n	800c8aa <HAL_SD_ConfigWideBusOperation+0xb6>
+    else if(WideMode == SDMMC_BUS_WIDE_4B)
+ 800c816:	f5b1 4f80 	cmp.w	r1, #16384	; 0x4000
+ 800c81a:	d123      	bne.n	800c864 <HAL_SD_ConfigWideBusOperation+0x70>
+  uint32_t scr[2U] = {0UL, 0UL};
+ 800c81c:	2100      	movs	r1, #0
+  if((SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1) & SDMMC_CARD_LOCKED) == SDMMC_CARD_LOCKED)
+ 800c81e:	6800      	ldr	r0, [r0, #0]
+  uint32_t scr[2U] = {0UL, 0UL};
+ 800c820:	e9cd 1104 	strd	r1, r1, [sp, #16]
+  if((SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1) & SDMMC_CARD_LOCKED) == SDMMC_CARD_LOCKED)
+ 800c824:	f000 fafb 	bl	800ce1e <SDMMC_GetResponse>
+ 800c828:	0180      	lsls	r0, r0, #6
+ 800c82a:	d435      	bmi.n	800c898 <HAL_SD_ConfigWideBusOperation+0xa4>
+  errorstate = SD_FindSCR(hsd, scr);
+ 800c82c:	a904      	add	r1, sp, #16
+ 800c82e:	4620      	mov	r0, r4
+ 800c830:	f7ff fa32 	bl	800bc98 <SD_FindSCR>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c834:	b960      	cbnz	r0, 800c850 <HAL_SD_ConfigWideBusOperation+0x5c>
+  if((scr[1U] & SDMMC_WIDE_BUS_SUPPORT) != SDMMC_ALLZERO)
+ 800c836:	9b05      	ldr	r3, [sp, #20]
+ 800c838:	0359      	lsls	r1, r3, #13
+ 800c83a:	d530      	bpl.n	800c89e <HAL_SD_ConfigWideBusOperation+0xaa>
+    errorstate = SDMMC_CmdAppCommand(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c83c:	6ca1      	ldr	r1, [r4, #72]	; 0x48
+ 800c83e:	6820      	ldr	r0, [r4, #0]
+ 800c840:	0409      	lsls	r1, r1, #16
+ 800c842:	f000 fd04 	bl	800d24e <SDMMC_CmdAppCommand>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c846:	b918      	cbnz	r0, 800c850 <HAL_SD_ConfigWideBusOperation+0x5c>
+    errorstate = SDMMC_CmdBusWidth(hsd->Instance, 2U);
+ 800c848:	2102      	movs	r1, #2
+    errorstate = SDMMC_CmdBusWidth(hsd->Instance, 0U);
+ 800c84a:	6820      	ldr	r0, [r4, #0]
+ 800c84c:	f000 fd18 	bl	800d280 <SDMMC_CmdBusWidth>
+      hsd->ErrorCode |= errorstate;
+ 800c850:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c852:	4318      	orrs	r0, r3
+ 800c854:	63a0      	str	r0, [r4, #56]	; 0x38
+  if(hsd->ErrorCode != HAL_SD_ERROR_NONE)
+ 800c856:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c858:	b34b      	cbz	r3, 800c8ae <HAL_SD_ConfigWideBusOperation+0xba>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c85a:	6823      	ldr	r3, [r4, #0]
+ 800c85c:	4a42      	ldr	r2, [pc, #264]	; (800c968 <HAL_SD_ConfigWideBusOperation+0x174>)
+ 800c85e:	639a      	str	r2, [r3, #56]	; 0x38
+      status = HAL_ERROR;
+ 800c860:	2501      	movs	r5, #1
+ 800c862:	e054      	b.n	800c90e <HAL_SD_ConfigWideBusOperation+0x11a>
+    else if(WideMode == SDMMC_BUS_WIDE_1B)
+ 800c864:	b9f1      	cbnz	r1, 800c8a4 <HAL_SD_ConfigWideBusOperation+0xb0>
+  if((SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1) & SDMMC_CARD_LOCKED) == SDMMC_CARD_LOCKED)
+ 800c866:	6800      	ldr	r0, [r0, #0]
+  uint32_t scr[2U] = {0UL, 0UL};
+ 800c868:	e9cd 1104 	strd	r1, r1, [sp, #16]
+  if((SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1) & SDMMC_CARD_LOCKED) == SDMMC_CARD_LOCKED)
+ 800c86c:	f000 fad7 	bl	800ce1e <SDMMC_GetResponse>
+ 800c870:	0182      	lsls	r2, r0, #6
+ 800c872:	d411      	bmi.n	800c898 <HAL_SD_ConfigWideBusOperation+0xa4>
+  errorstate = SD_FindSCR(hsd, scr);
+ 800c874:	a904      	add	r1, sp, #16
+ 800c876:	4620      	mov	r0, r4
+ 800c878:	f7ff fa0e 	bl	800bc98 <SD_FindSCR>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c87c:	2800      	cmp	r0, #0
+ 800c87e:	d1e7      	bne.n	800c850 <HAL_SD_ConfigWideBusOperation+0x5c>
+  if((scr[1U] & SDMMC_SINGLE_BUS_SUPPORT) != SDMMC_ALLZERO)
+ 800c880:	9b05      	ldr	r3, [sp, #20]
+ 800c882:	03db      	lsls	r3, r3, #15
+ 800c884:	d50b      	bpl.n	800c89e <HAL_SD_ConfigWideBusOperation+0xaa>
+    errorstate = SDMMC_CmdAppCommand(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c886:	6ca1      	ldr	r1, [r4, #72]	; 0x48
+ 800c888:	6820      	ldr	r0, [r4, #0]
+ 800c88a:	0409      	lsls	r1, r1, #16
+ 800c88c:	f000 fcdf 	bl	800d24e <SDMMC_CmdAppCommand>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800c890:	2800      	cmp	r0, #0
+ 800c892:	d1dd      	bne.n	800c850 <HAL_SD_ConfigWideBusOperation+0x5c>
+    errorstate = SDMMC_CmdBusWidth(hsd->Instance, 0U);
+ 800c894:	4601      	mov	r1, r0
+ 800c896:	e7d8      	b.n	800c84a <HAL_SD_ConfigWideBusOperation+0x56>
+    return HAL_SD_ERROR_LOCK_UNLOCK_FAILED;
+ 800c898:	f44f 6000 	mov.w	r0, #2048	; 0x800
+ 800c89c:	e7d8      	b.n	800c850 <HAL_SD_ConfigWideBusOperation+0x5c>
+    return HAL_SD_ERROR_REQUEST_NOT_APPLICABLE;
+ 800c89e:	f04f 6080 	mov.w	r0, #67108864	; 0x4000000
+ 800c8a2:	e7d5      	b.n	800c850 <HAL_SD_ConfigWideBusOperation+0x5c>
+      hsd->ErrorCode |= HAL_SD_ERROR_PARAM;
+ 800c8a4:	6b83      	ldr	r3, [r0, #56]	; 0x38
+ 800c8a6:	f043 6300 	orr.w	r3, r3, #134217728	; 0x8000000
+    hsd->ErrorCode |= HAL_SD_ERROR_UNSUPPORTED_FEATURE;
+ 800c8aa:	63a3      	str	r3, [r4, #56]	; 0x38
+ 800c8ac:	e7d3      	b.n	800c856 <HAL_SD_ConfigWideBusOperation+0x62>
+    sdmmc_clk = HAL_RCCEx_GetPeriphCLKFreq(RCC_PERIPHCLK_SDMMC1);
+ 800c8ae:	f44f 2000 	mov.w	r0, #524288	; 0x80000
+ 800c8b2:	f7fd f8af 	bl	8009a14 <HAL_RCCEx_GetPeriphCLKFreq>
+    if (sdmmc_clk != 0U)
+ 800c8b6:	2800      	cmp	r0, #0
+ 800c8b8:	d051      	beq.n	800c95e <HAL_SD_ConfigWideBusOperation+0x16a>
+      Init.ClockEdge           = hsd->Init.ClockEdge;
+ 800c8ba:	6863      	ldr	r3, [r4, #4]
+ 800c8bc:	9304      	str	r3, [sp, #16]
+      Init.ClockPowerSave      = hsd->Init.ClockPowerSave;
+ 800c8be:	68a3      	ldr	r3, [r4, #8]
+      if (hsd->Init.ClockDiv >= (sdmmc_clk / (2U * SD_NORMAL_SPEED_FREQ)))
+ 800c8c0:	492a      	ldr	r1, [pc, #168]	; (800c96c <HAL_SD_ConfigWideBusOperation+0x178>)
+ 800c8c2:	fbb0 f2f1 	udiv	r2, r0, r1
+      Init.BusWide             = WideMode;
+ 800c8c6:	e9cd 3505 	strd	r3, r5, [sp, #20]
+      Init.HardwareFlowControl = hsd->Init.HardwareFlowControl;
+ 800c8ca:	6923      	ldr	r3, [r4, #16]
+ 800c8cc:	9307      	str	r3, [sp, #28]
+      if (hsd->Init.ClockDiv >= (sdmmc_clk / (2U * SD_NORMAL_SPEED_FREQ)))
+ 800c8ce:	6963      	ldr	r3, [r4, #20]
+ 800c8d0:	4293      	cmp	r3, r2
+ 800c8d2:	d301      	bcc.n	800c8d8 <HAL_SD_ConfigWideBusOperation+0xe4>
+            Init.ClockDiv = sdmmc_clk / (2U * SD_NORMAL_SPEED_FREQ);
+ 800c8d4:	9308      	str	r3, [sp, #32]
+ 800c8d6:	e00d      	b.n	800c8f4 <HAL_SD_ConfigWideBusOperation+0x100>
+      else if (hsd->SdCard.CardSpeed == CARD_ULTRA_HIGH_SPEED)
+ 800c8d8:	6de5      	ldr	r5, [r4, #92]	; 0x5c
+ 800c8da:	f5b5 7f00 	cmp.w	r5, #512	; 0x200
+ 800c8de:	d0f9      	beq.n	800c8d4 <HAL_SD_ConfigWideBusOperation+0xe0>
+      else if (hsd->SdCard.CardSpeed == CARD_HIGH_SPEED)
+ 800c8e0:	f5b5 7f80 	cmp.w	r5, #256	; 0x100
+ 800c8e4:	d12e      	bne.n	800c944 <HAL_SD_ConfigWideBusOperation+0x150>
+        if (hsd->Init.ClockDiv == 0U)
+ 800c8e6:	bb3b      	cbnz	r3, 800c938 <HAL_SD_ConfigWideBusOperation+0x144>
+          if (sdmmc_clk > SD_HIGH_SPEED_FREQ)
+ 800c8e8:	4288      	cmp	r0, r1
+ 800c8ea:	d923      	bls.n	800c934 <HAL_SD_ConfigWideBusOperation+0x140>
+            Init.ClockDiv = sdmmc_clk / (2U * SD_HIGH_SPEED_FREQ);
+ 800c8ec:	4b20      	ldr	r3, [pc, #128]	; (800c970 <HAL_SD_ConfigWideBusOperation+0x17c>)
+ 800c8ee:	fbb0 f0f3 	udiv	r0, r0, r3
+ 800c8f2:	9008      	str	r0, [sp, #32]
+      Init.Transceiver = hsd->Init.Transceiver;
+ 800c8f4:	69a3      	ldr	r3, [r4, #24]
+ 800c8f6:	9309      	str	r3, [sp, #36]	; 0x24
+      (void)SDMMC_Init(hsd->Instance, Init);
+ 800c8f8:	ab0a      	add	r3, sp, #40	; 0x28
+ 800c8fa:	e913 0007 	ldmdb	r3, {r0, r1, r2}
+ 800c8fe:	e88d 0007 	stmia.w	sp, {r0, r1, r2}
+ 800c902:	ab04      	add	r3, sp, #16
+ 800c904:	cb0e      	ldmia	r3, {r1, r2, r3}
+ 800c906:	6820      	ldr	r0, [r4, #0]
+ 800c908:	f000 fa36 	bl	800cd78 <SDMMC_Init>
+  HAL_StatusTypeDef status = HAL_OK;
+ 800c90c:	2500      	movs	r5, #0
+  errorstate = SDMMC_CmdBlockLength(hsd->Instance, BLOCKSIZE);
+ 800c90e:	6820      	ldr	r0, [r4, #0]
+ 800c910:	f44f 7100 	mov.w	r1, #512	; 0x200
+ 800c914:	f000 fb62 	bl	800cfdc <SDMMC_CmdBlockLength>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c918:	b130      	cbz	r0, 800c928 <HAL_SD_ConfigWideBusOperation+0x134>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800c91a:	6823      	ldr	r3, [r4, #0]
+ 800c91c:	4a12      	ldr	r2, [pc, #72]	; (800c968 <HAL_SD_ConfigWideBusOperation+0x174>)
+ 800c91e:	639a      	str	r2, [r3, #56]	; 0x38
+    hsd->ErrorCode |= errorstate;
+ 800c920:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c922:	4318      	orrs	r0, r3
+ 800c924:	63a0      	str	r0, [r4, #56]	; 0x38
+    status = HAL_ERROR;
+ 800c926:	2501      	movs	r5, #1
+  hsd->State = HAL_SD_STATE_READY;
+ 800c928:	2301      	movs	r3, #1
+}
+ 800c92a:	4628      	mov	r0, r5
+  hsd->State = HAL_SD_STATE_READY;
+ 800c92c:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+}
+ 800c930:	b00b      	add	sp, #44	; 0x2c
+ 800c932:	bd30      	pop	{r4, r5, pc}
+            Init.ClockDiv = hsd->Init.ClockDiv;
+ 800c934:	2300      	movs	r3, #0
+ 800c936:	e7cd      	b.n	800c8d4 <HAL_SD_ConfigWideBusOperation+0xe0>
+          if ((sdmmc_clk/(2U * hsd->Init.ClockDiv)) > SD_HIGH_SPEED_FREQ)
+ 800c938:	005a      	lsls	r2, r3, #1
+ 800c93a:	fbb0 f2f2 	udiv	r2, r0, r2
+ 800c93e:	428a      	cmp	r2, r1
+ 800c940:	d9c8      	bls.n	800c8d4 <HAL_SD_ConfigWideBusOperation+0xe0>
+ 800c942:	e7d3      	b.n	800c8ec <HAL_SD_ConfigWideBusOperation+0xf8>
+        if (hsd->Init.ClockDiv == 0U)
+ 800c944:	490b      	ldr	r1, [pc, #44]	; (800c974 <HAL_SD_ConfigWideBusOperation+0x180>)
+ 800c946:	b91b      	cbnz	r3, 800c950 <HAL_SD_ConfigWideBusOperation+0x15c>
+          if (sdmmc_clk > SD_NORMAL_SPEED_FREQ)
+ 800c948:	4288      	cmp	r0, r1
+ 800c94a:	d9f3      	bls.n	800c934 <HAL_SD_ConfigWideBusOperation+0x140>
+            Init.ClockDiv = sdmmc_clk / (2U * SD_NORMAL_SPEED_FREQ);
+ 800c94c:	9208      	str	r2, [sp, #32]
+ 800c94e:	e7d1      	b.n	800c8f4 <HAL_SD_ConfigWideBusOperation+0x100>
+          if ((sdmmc_clk/(2U * hsd->Init.ClockDiv)) > SD_NORMAL_SPEED_FREQ)
+ 800c950:	005d      	lsls	r5, r3, #1
+ 800c952:	fbb0 f0f5 	udiv	r0, r0, r5
+            Init.ClockDiv = sdmmc_clk / (2U * SD_NORMAL_SPEED_FREQ);
+ 800c956:	4288      	cmp	r0, r1
+ 800c958:	bf88      	it	hi
+ 800c95a:	4613      	movhi	r3, r2
+ 800c95c:	e7ba      	b.n	800c8d4 <HAL_SD_ConfigWideBusOperation+0xe0>
+      hsd->ErrorCode |= SDMMC_ERROR_INVALID_PARAMETER;
+ 800c95e:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800c960:	f043 6300 	orr.w	r3, r3, #134217728	; 0x8000000
+ 800c964:	63a3      	str	r3, [r4, #56]	; 0x38
+ 800c966:	e77b      	b.n	800c860 <HAL_SD_ConfigWideBusOperation+0x6c>
+ 800c968:	1fe00fff 	.word	0x1fe00fff
+ 800c96c:	02faf080 	.word	0x02faf080
+ 800c970:	05f5e100 	.word	0x05f5e100
+ 800c974:	017d7840 	.word	0x017d7840
+
+0800c978 <HAL_SD_GetCardState>:
+  errorstate = SDMMC_CmdSendStatus(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c978:	6c81      	ldr	r1, [r0, #72]	; 0x48
+{
+ 800c97a:	b510      	push	{r4, lr}
+  errorstate = SDMMC_CmdSendStatus(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c97c:	0409      	lsls	r1, r1, #16
+{
+ 800c97e:	4604      	mov	r4, r0
+  errorstate = SDMMC_CmdSendStatus(hsd->Instance, (uint32_t)(hsd->SdCard.RelCardAdd << 16U));
+ 800c980:	6800      	ldr	r0, [r0, #0]
+ 800c982:	f000 fccb 	bl	800d31c <SDMMC_CmdSendStatus>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800c986:	4601      	mov	r1, r0
+ 800c988:	b928      	cbnz	r0, 800c996 <HAL_SD_GetCardState+0x1e>
+  *pCardStatus = SDMMC_GetResponse(hsd->Instance, SDMMC_RESP1);
+ 800c98a:	6820      	ldr	r0, [r4, #0]
+ 800c98c:	f000 fa47 	bl	800ce1e <SDMMC_GetResponse>
+}
+ 800c990:	f3c0 2043 	ubfx	r0, r0, #9, #4
+ 800c994:	bd10      	pop	{r4, pc}
+    hsd->ErrorCode |= errorstate;
+ 800c996:	6ba0      	ldr	r0, [r4, #56]	; 0x38
+ 800c998:	4308      	orrs	r0, r1
+ 800c99a:	63a0      	str	r0, [r4, #56]	; 0x38
+  uint32_t resp1 = 0;
+ 800c99c:	2000      	movs	r0, #0
+ 800c99e:	e7f7      	b.n	800c990 <HAL_SD_GetCardState+0x18>
+
+0800c9a0 <HAL_SD_Init>:
+{
+ 800c9a0:	b570      	push	{r4, r5, r6, lr}
+  if(hsd == NULL)
+ 800c9a2:	4604      	mov	r4, r0
+{
+ 800c9a4:	b086      	sub	sp, #24
+  if(hsd == NULL)
+ 800c9a6:	b918      	cbnz	r0, 800c9b0 <HAL_SD_Init+0x10>
+    return HAL_ERROR;
+ 800c9a8:	2501      	movs	r5, #1
+}
+ 800c9aa:	4628      	mov	r0, r5
+ 800c9ac:	b006      	add	sp, #24
+ 800c9ae:	bd70      	pop	{r4, r5, r6, pc}
+  if(hsd->State == HAL_SD_STATE_RESET)
+ 800c9b0:	f890 3034 	ldrb.w	r3, [r0, #52]	; 0x34
+ 800c9b4:	f003 02ff 	and.w	r2, r3, #255	; 0xff
+ 800c9b8:	b913      	cbnz	r3, 800c9c0 <HAL_SD_Init+0x20>
+    hsd->Lock = HAL_UNLOCKED;
+ 800c9ba:	7702      	strb	r2, [r0, #28]
+    HAL_SD_MspInit(hsd);
+ 800c9bc:	f7ff fa5a 	bl	800be74 <HAL_SD_MspInit>
+  hsd->State = HAL_SD_STATE_BUSY;
+ 800c9c0:	2303      	movs	r3, #3
+ 800c9c2:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+  if (HAL_SD_InitCard(hsd) != HAL_OK)
+ 800c9c6:	4620      	mov	r0, r4
+ 800c9c8:	f7ff fcea 	bl	800c3a0 <HAL_SD_InitCard>
+ 800c9cc:	2800      	cmp	r0, #0
+ 800c9ce:	d1eb      	bne.n	800c9a8 <HAL_SD_Init+0x8>
+  if( HAL_SD_GetCardStatus(hsd, &CardStatus) != HAL_OK)
+ 800c9d0:	a901      	add	r1, sp, #4
+ 800c9d2:	4620      	mov	r0, r4
+ 800c9d4:	f7ff fe3e 	bl	800c654 <HAL_SD_GetCardStatus>
+ 800c9d8:	2800      	cmp	r0, #0
+ 800c9da:	d1e5      	bne.n	800c9a8 <HAL_SD_Init+0x8>
+  if ((hsd->SdCard.CardType == CARD_SDHC_SDXC) && ((speedgrade != 0U) || (unitsize != 0U)))
+ 800c9dc:	6be1      	ldr	r1, [r4, #60]	; 0x3c
+  speedgrade = CardStatus.UhsSpeedGrade;
+ 800c9de:	f89d 2014 	ldrb.w	r2, [sp, #20]
+  unitsize = CardStatus.UhsAllocationUnitSize;
+ 800c9e2:	f89d 3015 	ldrb.w	r3, [sp, #21]
+  if ((hsd->SdCard.CardType == CARD_SDHC_SDXC) && ((speedgrade != 0U) || (unitsize != 0U)))
+ 800c9e6:	2901      	cmp	r1, #1
+  speedgrade = CardStatus.UhsSpeedGrade;
+ 800c9e8:	b2d2      	uxtb	r2, r2
+  unitsize = CardStatus.UhsAllocationUnitSize;
+ 800c9ea:	b2db      	uxtb	r3, r3
+  if ((hsd->SdCard.CardType == CARD_SDHC_SDXC) && ((speedgrade != 0U) || (unitsize != 0U)))
+ 800c9ec:	d11c      	bne.n	800ca28 <HAL_SD_Init+0x88>
+ 800c9ee:	4313      	orrs	r3, r2
+    hsd->SdCard.CardSpeed = CARD_ULTRA_HIGH_SPEED;
+ 800c9f0:	bf14      	ite	ne
+ 800c9f2:	f44f 7300 	movne.w	r3, #512	; 0x200
+      hsd->SdCard.CardSpeed  = CARD_HIGH_SPEED;
+ 800c9f6:	f44f 7380 	moveq.w	r3, #256	; 0x100
+ 800c9fa:	65e3      	str	r3, [r4, #92]	; 0x5c
+  if(HAL_SD_ConfigWideBusOperation(hsd, hsd->Init.BusWide) != HAL_OK)
+ 800c9fc:	68e1      	ldr	r1, [r4, #12]
+ 800c9fe:	4620      	mov	r0, r4
+ 800ca00:	f7ff fef8 	bl	800c7f4 <HAL_SD_ConfigWideBusOperation>
+ 800ca04:	4605      	mov	r5, r0
+ 800ca06:	2800      	cmp	r0, #0
+ 800ca08:	d1ce      	bne.n	800c9a8 <HAL_SD_Init+0x8>
+  tickstart = HAL_GetTick();
+ 800ca0a:	f7fa fba1 	bl	8007150 <HAL_GetTick>
+ 800ca0e:	4606      	mov	r6, r0
+  while((HAL_SD_GetCardState(hsd) != HAL_SD_CARD_TRANSFER))
+ 800ca10:	4620      	mov	r0, r4
+ 800ca12:	f7ff ffb1 	bl	800c978 <HAL_SD_GetCardState>
+ 800ca16:	2804      	cmp	r0, #4
+ 800ca18:	d108      	bne.n	800ca2c <HAL_SD_Init+0x8c>
+  hsd->ErrorCode = HAL_SD_ERROR_NONE;
+ 800ca1a:	2300      	movs	r3, #0
+ 800ca1c:	63a3      	str	r3, [r4, #56]	; 0x38
+  hsd->Context = SD_CONTEXT_NONE;
+ 800ca1e:	6323      	str	r3, [r4, #48]	; 0x30
+  hsd->State = HAL_SD_STATE_READY;
+ 800ca20:	2301      	movs	r3, #1
+ 800ca22:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+  return HAL_OK;
+ 800ca26:	e7c0      	b.n	800c9aa <HAL_SD_Init+0xa>
+      hsd->SdCard.CardSpeed  = CARD_NORMAL_SPEED;
+ 800ca28:	65e0      	str	r0, [r4, #92]	; 0x5c
+ 800ca2a:	e7e7      	b.n	800c9fc <HAL_SD_Init+0x5c>
+    if((HAL_GetTick()-tickstart) >=  SDMMC_DATATIMEOUT)
+ 800ca2c:	f7fa fb90 	bl	8007150 <HAL_GetTick>
+ 800ca30:	1b80      	subs	r0, r0, r6
+ 800ca32:	3001      	adds	r0, #1
+ 800ca34:	d1ec      	bne.n	800ca10 <HAL_SD_Init+0x70>
+      hsd->ErrorCode = HAL_SD_ERROR_TIMEOUT;
+ 800ca36:	f04f 4300 	mov.w	r3, #2147483648	; 0x80000000
+ 800ca3a:	63a3      	str	r3, [r4, #56]	; 0x38
+      hsd->State= HAL_SD_STATE_READY;
+ 800ca3c:	2301      	movs	r3, #1
+ 800ca3e:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      hsd->Context = SD_CONTEXT_NONE;
+ 800ca42:	2300      	movs	r3, #0
+ 800ca44:	6323      	str	r3, [r4, #48]	; 0x30
+      return HAL_TIMEOUT;
+ 800ca46:	2503      	movs	r5, #3
+ 800ca48:	e7af      	b.n	800c9aa <HAL_SD_Init+0xa>
+	...
+
+0800ca4c <SD_HighSpeed>:
+{
+ 800ca4c:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+  uint32_t SD_hs[16]  = {0};
+ 800ca50:	2640      	movs	r6, #64	; 0x40
+{
+ 800ca52:	b096      	sub	sp, #88	; 0x58
+ 800ca54:	4605      	mov	r5, r0
+  uint32_t SD_hs[16]  = {0};
+ 800ca56:	4632      	mov	r2, r6
+ 800ca58:	2100      	movs	r1, #0
+ 800ca5a:	a806      	add	r0, sp, #24
+ 800ca5c:	f000 fe3c 	bl	800d6d8 <memset>
+  uint32_t Timeout = HAL_GetTick();
+ 800ca60:	f7fa fb76 	bl	8007150 <HAL_GetTick>
+  if(hsd->SdCard.CardSpeed == CARD_NORMAL_SPEED)
+ 800ca64:	6deb      	ldr	r3, [r5, #92]	; 0x5c
+  uint32_t Timeout = HAL_GetTick();
+ 800ca66:	4680      	mov	r8, r0
+  if(hsd->SdCard.CardSpeed == CARD_NORMAL_SPEED)
+ 800ca68:	2b00      	cmp	r3, #0
+ 800ca6a:	d066      	beq.n	800cb3a <SD_HighSpeed+0xee>
+  if(hsd->SdCard.CardSpeed == CARD_HIGH_SPEED)
+ 800ca6c:	f5b3 7f80 	cmp.w	r3, #256	; 0x100
+ 800ca70:	d004      	beq.n	800ca7c <SD_HighSpeed+0x30>
+  uint32_t errorstate = HAL_SD_ERROR_NONE;
+ 800ca72:	2400      	movs	r4, #0
+}
+ 800ca74:	4620      	mov	r0, r4
+ 800ca76:	b016      	add	sp, #88	; 0x58
+ 800ca78:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+    hsd->Instance->DCTRL = 0;
+ 800ca7c:	6828      	ldr	r0, [r5, #0]
+ 800ca7e:	2300      	movs	r3, #0
+ 800ca80:	62c3      	str	r3, [r0, #44]	; 0x2c
+    errorstate = SDMMC_CmdBlockLength(hsd->Instance, 64U);
+ 800ca82:	4631      	mov	r1, r6
+ 800ca84:	f000 faaa 	bl	800cfdc <SDMMC_CmdBlockLength>
+    if (errorstate != HAL_SD_ERROR_NONE)
+ 800ca88:	4604      	mov	r4, r0
+ 800ca8a:	2800      	cmp	r0, #0
+ 800ca8c:	d1f2      	bne.n	800ca74 <SD_HighSpeed+0x28>
+    sdmmc_datainitstructure.DataTimeOut   = SDMMC_DATATIMEOUT;
+ 800ca8e:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+    sdmmc_datainitstructure.DataLength    = 64U;
+ 800ca92:	e9cd 3600 	strd	r3, r6, [sp]
+    sdmmc_datainitstructure.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800ca96:	2260      	movs	r2, #96	; 0x60
+ 800ca98:	2302      	movs	r3, #2
+ 800ca9a:	e9cd 2302 	strd	r2, r3, [sp, #8]
+    sdmmc_datainitstructure.TransferMode  = SDMMC_TRANSFER_MODE_BLOCK;
+ 800ca9e:	9004      	str	r0, [sp, #16]
+    sdmmc_datainitstructure.DPSM          = SDMMC_DPSM_ENABLE;
+ 800caa0:	2301      	movs	r3, #1
+    if ( SDMMC_ConfigData(hsd->Instance, &sdmmc_datainitstructure) != HAL_OK)
+ 800caa2:	6828      	ldr	r0, [r5, #0]
+    sdmmc_datainitstructure.DPSM          = SDMMC_DPSM_ENABLE;
+ 800caa4:	9305      	str	r3, [sp, #20]
+    if ( SDMMC_ConfigData(hsd->Instance, &sdmmc_datainitstructure) != HAL_OK)
+ 800caa6:	4669      	mov	r1, sp
+ 800caa8:	f000 f9bc 	bl	800ce24 <SDMMC_ConfigData>
+ 800caac:	2800      	cmp	r0, #0
+ 800caae:	d147      	bne.n	800cb40 <SD_HighSpeed+0xf4>
+    errorstate = SDMMC_CmdSwitch(hsd->Instance,SDMMC_SDR25_SWITCH_PATTERN);
+ 800cab0:	4925      	ldr	r1, [pc, #148]	; (800cb48 <SD_HighSpeed+0xfc>)
+ 800cab2:	6828      	ldr	r0, [r5, #0]
+ 800cab4:	f000 fbfd 	bl	800d2b2 <SDMMC_CmdSwitch>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800cab8:	4604      	mov	r4, r0
+ 800caba:	2800      	cmp	r0, #0
+ 800cabc:	d1da      	bne.n	800ca74 <SD_HighSpeed+0x28>
+  uint32_t count, loop = 0 ;
+ 800cabe:	4607      	mov	r7, r0
+    while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DBCKEND| SDMMC_FLAG_DATAEND ))
+ 800cac0:	f240 592a 	movw	r9, #1322	; 0x52a
+ 800cac4:	682b      	ldr	r3, [r5, #0]
+ 800cac6:	6b5e      	ldr	r6, [r3, #52]	; 0x34
+ 800cac8:	ea16 0609 	ands.w	r6, r6, r9
+ 800cacc:	d005      	beq.n	800cada <SD_HighSpeed+0x8e>
+    if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DTIMEOUT))
+ 800cace:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800cad0:	0710      	lsls	r0, r2, #28
+ 800cad2:	d51e      	bpl.n	800cb12 <SD_HighSpeed+0xc6>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DTIMEOUT);
+ 800cad4:	2208      	movs	r2, #8
+ 800cad6:	639a      	str	r2, [r3, #56]	; 0x38
+      return errorstate;
+ 800cad8:	e7cc      	b.n	800ca74 <SD_HighSpeed+0x28>
+      if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXFIFOHF))
+ 800cada:	6b5b      	ldr	r3, [r3, #52]	; 0x34
+ 800cadc:	041b      	lsls	r3, r3, #16
+ 800cade:	d50b      	bpl.n	800caf8 <SD_HighSpeed+0xac>
+ 800cae0:	ab06      	add	r3, sp, #24
+ 800cae2:	eb03 1a47 	add.w	sl, r3, r7, lsl #5
+          SD_hs[(8U*loop)+count]  = SDMMC_ReadFIFO(hsd->Instance);
+ 800cae6:	6828      	ldr	r0, [r5, #0]
+ 800cae8:	f000 f960 	bl	800cdac <SDMMC_ReadFIFO>
+        for (count = 0U; count < 8U; count++)
+ 800caec:	3601      	adds	r6, #1
+ 800caee:	2e08      	cmp	r6, #8
+          SD_hs[(8U*loop)+count]  = SDMMC_ReadFIFO(hsd->Instance);
+ 800caf0:	f84a 0b04 	str.w	r0, [sl], #4
+        for (count = 0U; count < 8U; count++)
+ 800caf4:	d1f7      	bne.n	800cae6 <SD_HighSpeed+0x9a>
+        loop ++;
+ 800caf6:	3701      	adds	r7, #1
+      if((HAL_GetTick()-Timeout) >=  SDMMC_DATATIMEOUT)
+ 800caf8:	f7fa fb2a 	bl	8007150 <HAL_GetTick>
+ 800cafc:	eba0 0008 	sub.w	r0, r0, r8
+ 800cb00:	3001      	adds	r0, #1
+ 800cb02:	d1df      	bne.n	800cac4 <SD_HighSpeed+0x78>
+        hsd->ErrorCode = HAL_SD_ERROR_TIMEOUT;
+ 800cb04:	f04f 4400 	mov.w	r4, #2147483648	; 0x80000000
+        hsd->State= HAL_SD_STATE_READY;
+ 800cb08:	2301      	movs	r3, #1
+        hsd->ErrorCode = HAL_SD_ERROR_TIMEOUT;
+ 800cb0a:	63ac      	str	r4, [r5, #56]	; 0x38
+        hsd->State= HAL_SD_STATE_READY;
+ 800cb0c:	f885 3034 	strb.w	r3, [r5, #52]	; 0x34
+        return HAL_SD_ERROR_TIMEOUT;
+ 800cb10:	e7b0      	b.n	800ca74 <SD_HighSpeed+0x28>
+    else if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DCRCFAIL))
+ 800cb12:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800cb14:	0791      	lsls	r1, r2, #30
+ 800cb16:	d502      	bpl.n	800cb1e <SD_HighSpeed+0xd2>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DCRCFAIL);
+ 800cb18:	2402      	movs	r4, #2
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800cb1a:	639c      	str	r4, [r3, #56]	; 0x38
+      return errorstate;
+ 800cb1c:	e7aa      	b.n	800ca74 <SD_HighSpeed+0x28>
+    else if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+ 800cb1e:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800cb20:	0692      	lsls	r2, r2, #26
+ 800cb22:	d501      	bpl.n	800cb28 <SD_HighSpeed+0xdc>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800cb24:	2420      	movs	r4, #32
+ 800cb26:	e7f8      	b.n	800cb1a <SD_HighSpeed+0xce>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_DATA_FLAGS);
+ 800cb28:	4a08      	ldr	r2, [pc, #32]	; (800cb4c <SD_HighSpeed+0x100>)
+ 800cb2a:	639a      	str	r2, [r3, #56]	; 0x38
+    if ((((uint8_t*)SD_hs)[13] & 2U) != 2U)
+ 800cb2c:	f89d 3025 	ldrb.w	r3, [sp, #37]	; 0x25
+ 800cb30:	079b      	lsls	r3, r3, #30
+ 800cb32:	d49e      	bmi.n	800ca72 <SD_HighSpeed+0x26>
+      errorstate = SDMMC_ERROR_UNSUPPORTED_FEATURE;
+ 800cb34:	f04f 5480 	mov.w	r4, #268435456	; 0x10000000
+ 800cb38:	e79c      	b.n	800ca74 <SD_HighSpeed+0x28>
+     return HAL_SD_ERROR_REQUEST_NOT_APPLICABLE;
+ 800cb3a:	f04f 6480 	mov.w	r4, #67108864	; 0x4000000
+ 800cb3e:	e799      	b.n	800ca74 <SD_HighSpeed+0x28>
+      return (HAL_SD_ERROR_GENERAL_UNKNOWN_ERR);
+ 800cb40:	f44f 3480 	mov.w	r4, #65536	; 0x10000
+ 800cb44:	e796      	b.n	800ca74 <SD_HighSpeed+0x28>
+ 800cb46:	bf00      	nop
+ 800cb48:	80ffff01 	.word	0x80ffff01
+ 800cb4c:	18000f3a 	.word	0x18000f3a
+
+0800cb50 <HAL_SD_ConfigSpeedBusOperation>:
+{
+ 800cb50:	e92d 47f0 	stmdb	sp!, {r4, r5, r6, r7, r8, r9, sl, lr}
+  hsd->State = HAL_SD_STATE_BUSY;
+ 800cb54:	2303      	movs	r3, #3
+ 800cb56:	f880 3034 	strb.w	r3, [r0, #52]	; 0x34
+  if(hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE)
+ 800cb5a:	6983      	ldr	r3, [r0, #24]
+ 800cb5c:	2b01      	cmp	r3, #1
+{
+ 800cb5e:	b096      	sub	sp, #88	; 0x58
+ 800cb60:	4604      	mov	r4, r0
+  if(hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE)
+ 800cb62:	f040 80cf 	bne.w	800cd04 <HAL_SD_ConfigSpeedBusOperation+0x1b4>
+    switch (SpeedMode)
+ 800cb66:	2904      	cmp	r1, #4
+ 800cb68:	f200 80eb 	bhi.w	800cd42 <HAL_SD_ConfigSpeedBusOperation+0x1f2>
+ 800cb6c:	e8df f011 	tbh	[pc, r1, lsl #1]
+ 800cb70:	00150005 	.word	0x00150005
+ 800cb74:	001e00dc 	.word	0x001e00dc
+ 800cb78:	0031      	.short	0x0031
+        if ((hsd->SdCard.CardSpeed  == CARD_ULTRA_HIGH_SPEED) ||
+ 800cb7a:	6dc3      	ldr	r3, [r0, #92]	; 0x5c
+ 800cb7c:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 800cb80:	d002      	beq.n	800cb88 <HAL_SD_ConfigSpeedBusOperation+0x38>
+ 800cb82:	6bc2      	ldr	r2, [r0, #60]	; 0x3c
+ 800cb84:	2a01      	cmp	r2, #1
+ 800cb86:	d10a      	bne.n	800cb9e <HAL_SD_ConfigSpeedBusOperation+0x4e>
+          hsd->Instance->CLKCR |= 0x00100000U;
+ 800cb88:	6822      	ldr	r2, [r4, #0]
+ 800cb8a:	6853      	ldr	r3, [r2, #4]
+ 800cb8c:	f443 1380 	orr.w	r3, r3, #1048576	; 0x100000
+ 800cb90:	6053      	str	r3, [r2, #4]
+          if (SD_UltraHighSpeed(hsd) != HAL_SD_ERROR_NONE)
+ 800cb92:	4620      	mov	r0, r4
+ 800cb94:	f7ff f8e6 	bl	800bd64 <SD_UltraHighSpeed>
+ 800cb98:	b920      	cbnz	r0, 800cba4 <HAL_SD_ConfigSpeedBusOperation+0x54>
+    switch (SpeedMode)
+ 800cb9a:	2500      	movs	r5, #0
+ 800cb9c:	e063      	b.n	800cc66 <HAL_SD_ConfigSpeedBusOperation+0x116>
+        else if (hsd->SdCard.CardSpeed  == CARD_HIGH_SPEED)
+ 800cb9e:	f5b3 7f80 	cmp.w	r3, #256	; 0x100
+            (hsd->SdCard.CardSpeed  == CARD_HIGH_SPEED) ||
+ 800cba2:	d1fa      	bne.n	800cb9a <HAL_SD_ConfigSpeedBusOperation+0x4a>
+          if (SD_HighSpeed(hsd) != HAL_SD_ERROR_NONE)
+ 800cba4:	4620      	mov	r0, r4
+ 800cba6:	f7ff ff51 	bl	800ca4c <SD_HighSpeed>
+ 800cbaa:	e00f      	b.n	800cbcc <HAL_SD_ConfigSpeedBusOperation+0x7c>
+        if ((hsd->SdCard.CardSpeed  == CARD_ULTRA_HIGH_SPEED) ||
+ 800cbac:	6dc3      	ldr	r3, [r0, #92]	; 0x5c
+ 800cbae:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 800cbb2:	d003      	beq.n	800cbbc <HAL_SD_ConfigSpeedBusOperation+0x6c>
+ 800cbb4:	6bc3      	ldr	r3, [r0, #60]	; 0x3c
+ 800cbb6:	2b01      	cmp	r3, #1
+ 800cbb8:	f040 8089 	bne.w	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+          hsd->Instance->CLKCR |= 0x00100000U;
+ 800cbbc:	6822      	ldr	r2, [r4, #0]
+ 800cbbe:	6853      	ldr	r3, [r2, #4]
+ 800cbc0:	f443 1380 	orr.w	r3, r3, #1048576	; 0x100000
+ 800cbc4:	6053      	str	r3, [r2, #4]
+          if (SD_UltraHighSpeed(hsd) != HAL_SD_ERROR_NONE)
+ 800cbc6:	4620      	mov	r0, r4
+ 800cbc8:	f7ff f8cc 	bl	800bd64 <SD_UltraHighSpeed>
+          if (SD_HighSpeed(hsd) != HAL_SD_ERROR_NONE)
+ 800cbcc:	2800      	cmp	r0, #0
+ 800cbce:	d0e4      	beq.n	800cb9a <HAL_SD_ConfigSpeedBusOperation+0x4a>
+ 800cbd0:	e07d      	b.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+        if ((hsd->SdCard.CardSpeed  == CARD_ULTRA_HIGH_SPEED) ||
+ 800cbd2:	6dc3      	ldr	r3, [r0, #92]	; 0x5c
+ 800cbd4:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 800cbd8:	d002      	beq.n	800cbe0 <HAL_SD_ConfigSpeedBusOperation+0x90>
+ 800cbda:	6bc3      	ldr	r3, [r0, #60]	; 0x3c
+ 800cbdc:	2b01      	cmp	r3, #1
+ 800cbde:	d176      	bne.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+          hsd->Instance->CLKCR |= 0x00100000U;
+ 800cbe0:	6822      	ldr	r2, [r4, #0]
+ 800cbe2:	6853      	ldr	r3, [r2, #4]
+  */
+static uint32_t SD_DDR_Mode(SD_HandleTypeDef *hsd)
+{
+  uint32_t errorstate = HAL_SD_ERROR_NONE;
+  SDMMC_DataInitTypeDef sdmmc_datainitstructure;
+  uint32_t SD_hs[16]  = {0};
+ 800cbe4:	2540      	movs	r5, #64	; 0x40
+          hsd->Instance->CLKCR |= 0x00100000U;
+ 800cbe6:	f443 1380 	orr.w	r3, r3, #1048576	; 0x100000
+ 800cbea:	6053      	str	r3, [r2, #4]
+  uint32_t SD_hs[16]  = {0};
+ 800cbec:	2100      	movs	r1, #0
+ 800cbee:	462a      	mov	r2, r5
+ 800cbf0:	a806      	add	r0, sp, #24
+ 800cbf2:	f000 fd71 	bl	800d6d8 <memset>
+  uint32_t count, loop = 0 ;
+  uint32_t Timeout = HAL_GetTick();
+ 800cbf6:	f7fa faab 	bl	8007150 <HAL_GetTick>
+
+  if(hsd->SdCard.CardSpeed == CARD_NORMAL_SPEED)
+ 800cbfa:	6de3      	ldr	r3, [r4, #92]	; 0x5c
+  uint32_t Timeout = HAL_GetTick();
+ 800cbfc:	4680      	mov	r8, r0
+  if(hsd->SdCard.CardSpeed == CARD_NORMAL_SPEED)
+ 800cbfe:	2b00      	cmp	r3, #0
+ 800cc00:	d065      	beq.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+  {
+     /* Standard Speed Card <= 12.5Mhz  */
+     return HAL_SD_ERROR_REQUEST_NOT_APPLICABLE;
+  }
+
+  if((hsd->SdCard.CardSpeed == CARD_ULTRA_HIGH_SPEED) &&
+ 800cc02:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 800cc06:	d1c8      	bne.n	800cb9a <HAL_SD_ConfigSpeedBusOperation+0x4a>
+ 800cc08:	69a6      	ldr	r6, [r4, #24]
+ 800cc0a:	2e01      	cmp	r6, #1
+ 800cc0c:	d1c5      	bne.n	800cb9a <HAL_SD_ConfigSpeedBusOperation+0x4a>
+     (hsd->Init.Transceiver == SDMMC_TRANSCEIVER_ENABLE))
+  {
+    /* Initialize the Data control register */
+    hsd->Instance->DCTRL = 0;
+ 800cc0e:	6820      	ldr	r0, [r4, #0]
+ 800cc10:	2300      	movs	r3, #0
+ 800cc12:	62c3      	str	r3, [r0, #44]	; 0x2c
+    errorstate = SDMMC_CmdBlockLength(hsd->Instance, 64U);
+ 800cc14:	4629      	mov	r1, r5
+ 800cc16:	f000 f9e1 	bl	800cfdc <SDMMC_CmdBlockLength>
+
+    if (errorstate != HAL_SD_ERROR_NONE)
+ 800cc1a:	2800      	cmp	r0, #0
+ 800cc1c:	d157      	bne.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+    {
+      return errorstate;
+    }
+
+    /* Configure the SD DPSM (Data Path State Machine) */
+    sdmmc_datainitstructure.DataTimeOut   = SDMMC_DATATIMEOUT;
+ 800cc1e:	f04f 33ff 	mov.w	r3, #4294967295	; 0xffffffff
+    sdmmc_datainitstructure.DataLength    = 64U;
+ 800cc22:	e9cd 3500 	strd	r3, r5, [sp]
+    sdmmc_datainitstructure.DataBlockSize = SDMMC_DATABLOCK_SIZE_64B ;
+    sdmmc_datainitstructure.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+    sdmmc_datainitstructure.TransferMode  = SDMMC_TRANSFER_MODE_BLOCK;
+    sdmmc_datainitstructure.DPSM          = SDMMC_DPSM_ENABLE;
+ 800cc26:	e9cd 0604 	strd	r0, r6, [sp, #16]
+    sdmmc_datainitstructure.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800cc2a:	2260      	movs	r2, #96	; 0x60
+ 800cc2c:	2302      	movs	r3, #2
+
+    if ( SDMMC_ConfigData(hsd->Instance, &sdmmc_datainitstructure) != HAL_OK)
+ 800cc2e:	6820      	ldr	r0, [r4, #0]
+ 800cc30:	4669      	mov	r1, sp
+    sdmmc_datainitstructure.TransferDir   = SDMMC_TRANSFER_DIR_TO_SDMMC;
+ 800cc32:	e9cd 2302 	strd	r2, r3, [sp, #8]
+    if ( SDMMC_ConfigData(hsd->Instance, &sdmmc_datainitstructure) != HAL_OK)
+ 800cc36:	f000 f8f5 	bl	800ce24 <SDMMC_ConfigData>
+ 800cc3a:	4605      	mov	r5, r0
+ 800cc3c:	2800      	cmp	r0, #0
+ 800cc3e:	d146      	bne.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+    {
+      return (HAL_SD_ERROR_GENERAL_UNKNOWN_ERR);
+    }
+
+    errorstate = SDMMC_CmdSwitch(hsd->Instance, SDMMC_DDR50_SWITCH_PATTERN);
+ 800cc40:	494a      	ldr	r1, [pc, #296]	; (800cd6c <HAL_SD_ConfigSpeedBusOperation+0x21c>)
+ 800cc42:	6820      	ldr	r0, [r4, #0]
+ 800cc44:	f000 fb35 	bl	800d2b2 <SDMMC_CmdSwitch>
+    if(errorstate != HAL_SD_ERROR_NONE)
+ 800cc48:	4607      	mov	r7, r0
+ 800cc4a:	2800      	cmp	r0, #0
+ 800cc4c:	d13f      	bne.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+    {
+      return errorstate;
+    }
+
+    while(!__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR | SDMMC_FLAG_DCRCFAIL | SDMMC_FLAG_DTIMEOUT | SDMMC_FLAG_DBCKEND| SDMMC_FLAG_DATAEND ))
+ 800cc4e:	f240 592a 	movw	r9, #1322	; 0x52a
+ 800cc52:	6823      	ldr	r3, [r4, #0]
+ 800cc54:	6b5e      	ldr	r6, [r3, #52]	; 0x34
+ 800cc56:	ea16 0609 	ands.w	r6, r6, r9
+ 800cc5a:	d01d      	beq.n	800cc98 <HAL_SD_ConfigSpeedBusOperation+0x148>
+        hsd->State= HAL_SD_STATE_READY;
+        return HAL_SD_ERROR_TIMEOUT;
+      }
+    }
+
+    if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DTIMEOUT))
+ 800cc5c:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800cc5e:	0710      	lsls	r0, r2, #28
+ 800cc60:	d53b      	bpl.n	800ccda <HAL_SD_ConfigSpeedBusOperation+0x18a>
+    {
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DTIMEOUT);
+ 800cc62:	2208      	movs	r2, #8
+ 800cc64:	639a      	str	r2, [r3, #56]	; 0x38
+  tickstart = HAL_GetTick();
+ 800cc66:	f7fa fa73 	bl	8007150 <HAL_GetTick>
+ 800cc6a:	4606      	mov	r6, r0
+  while ((HAL_SD_GetCardState(hsd) != HAL_SD_CARD_TRANSFER))
+ 800cc6c:	4620      	mov	r0, r4
+ 800cc6e:	f7ff fe83 	bl	800c978 <HAL_SD_GetCardState>
+ 800cc72:	2804      	cmp	r0, #4
+ 800cc74:	d169      	bne.n	800cd4a <HAL_SD_ConfigSpeedBusOperation+0x1fa>
+  errorstate = SDMMC_CmdBlockLength(hsd->Instance, BLOCKSIZE);
+ 800cc76:	6820      	ldr	r0, [r4, #0]
+ 800cc78:	f44f 7100 	mov.w	r1, #512	; 0x200
+ 800cc7c:	f000 f9ae 	bl	800cfdc <SDMMC_CmdBlockLength>
+  if(errorstate != HAL_SD_ERROR_NONE)
+ 800cc80:	b130      	cbz	r0, 800cc90 <HAL_SD_ConfigSpeedBusOperation+0x140>
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_FLAGS);
+ 800cc82:	6823      	ldr	r3, [r4, #0]
+ 800cc84:	4a3a      	ldr	r2, [pc, #232]	; (800cd70 <HAL_SD_ConfigSpeedBusOperation+0x220>)
+ 800cc86:	639a      	str	r2, [r3, #56]	; 0x38
+    hsd->ErrorCode |= errorstate;
+ 800cc88:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800cc8a:	4318      	orrs	r0, r3
+ 800cc8c:	63a0      	str	r0, [r4, #56]	; 0x38
+    status = HAL_ERROR;
+ 800cc8e:	2501      	movs	r5, #1
+  hsd->State = HAL_SD_STATE_READY;
+ 800cc90:	2301      	movs	r3, #1
+ 800cc92:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+  return status;
+ 800cc96:	e064      	b.n	800cd62 <HAL_SD_ConfigSpeedBusOperation+0x212>
+      if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXFIFOHF))
+ 800cc98:	6b5b      	ldr	r3, [r3, #52]	; 0x34
+ 800cc9a:	041b      	lsls	r3, r3, #16
+ 800cc9c:	d50b      	bpl.n	800ccb6 <HAL_SD_ConfigSpeedBusOperation+0x166>
+ 800cc9e:	ab06      	add	r3, sp, #24
+ 800cca0:	eb03 1a47 	add.w	sl, r3, r7, lsl #5
+          SD_hs[(8U*loop)+count]  = SDMMC_ReadFIFO(hsd->Instance);
+ 800cca4:	6820      	ldr	r0, [r4, #0]
+ 800cca6:	f000 f881 	bl	800cdac <SDMMC_ReadFIFO>
+        for (count = 0U; count < 8U; count++)
+ 800ccaa:	3601      	adds	r6, #1
+ 800ccac:	2e08      	cmp	r6, #8
+          SD_hs[(8U*loop)+count]  = SDMMC_ReadFIFO(hsd->Instance);
+ 800ccae:	f84a 0b04 	str.w	r0, [sl], #4
+        for (count = 0U; count < 8U; count++)
+ 800ccb2:	d1f7      	bne.n	800cca4 <HAL_SD_ConfigSpeedBusOperation+0x154>
+        loop ++;
+ 800ccb4:	3701      	adds	r7, #1
+      if((HAL_GetTick()-Timeout) >=  SDMMC_DATATIMEOUT)
+ 800ccb6:	f7fa fa4b 	bl	8007150 <HAL_GetTick>
+ 800ccba:	eba0 0008 	sub.w	r0, r0, r8
+ 800ccbe:	3001      	adds	r0, #1
+ 800ccc0:	d1c7      	bne.n	800cc52 <HAL_SD_ConfigSpeedBusOperation+0x102>
+        hsd->ErrorCode = HAL_SD_ERROR_TIMEOUT;
+ 800ccc2:	f04f 4300 	mov.w	r3, #2147483648	; 0x80000000
+ 800ccc6:	63a3      	str	r3, [r4, #56]	; 0x38
+        hsd->State= HAL_SD_STATE_READY;
+ 800ccc8:	2301      	movs	r3, #1
+ 800ccca:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+          hsd->ErrorCode |= HAL_SD_ERROR_UNSUPPORTED_FEATURE;
+ 800ccce:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800ccd0:	f043 5380 	orr.w	r3, r3, #268435456	; 0x10000000
+        hsd->ErrorCode |= HAL_SD_ERROR_PARAM;
+ 800ccd4:	63a3      	str	r3, [r4, #56]	; 0x38
+        status = HAL_ERROR;
+ 800ccd6:	2501      	movs	r5, #1
+        break;
+ 800ccd8:	e7c5      	b.n	800cc66 <HAL_SD_ConfigSpeedBusOperation+0x116>
+
+      return errorstate;
+    }
+    else if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_DCRCFAIL))
+ 800ccda:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800ccdc:	0791      	lsls	r1, r2, #30
+ 800ccde:	d502      	bpl.n	800cce6 <HAL_SD_ConfigSpeedBusOperation+0x196>
+    {
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_DCRCFAIL);
+ 800cce0:	2202      	movs	r2, #2
+
+      return errorstate;
+    }
+    else if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+    {
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800cce2:	639a      	str	r2, [r3, #56]	; 0x38
+
+      errorstate = SDMMC_ERROR_RX_OVERRUN;
+
+      return errorstate;
+ 800cce4:	e7f3      	b.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+    else if (__HAL_SD_GET_FLAG(hsd, SDMMC_FLAG_RXOVERR))
+ 800cce6:	6b5a      	ldr	r2, [r3, #52]	; 0x34
+ 800cce8:	0692      	lsls	r2, r2, #26
+ 800ccea:	d501      	bpl.n	800ccf0 <HAL_SD_ConfigSpeedBusOperation+0x1a0>
+      __HAL_SD_CLEAR_FLAG(hsd, SDMMC_FLAG_RXOVERR);
+ 800ccec:	2220      	movs	r2, #32
+ 800ccee:	e7f8      	b.n	800cce2 <HAL_SD_ConfigSpeedBusOperation+0x192>
+    {
+      /* No error flag set */
+    }
+
+    /* Clear all the static flags */
+    __HAL_SD_CLEAR_FLAG(hsd, SDMMC_STATIC_DATA_FLAGS);
+ 800ccf0:	4a20      	ldr	r2, [pc, #128]	; (800cd74 <HAL_SD_ConfigSpeedBusOperation+0x224>)
+ 800ccf2:	639a      	str	r2, [r3, #56]	; 0x38
+
+    /* Test if the switch mode  is ok */
+    if ((((uint8_t*)SD_hs)[13] & 2U) != 2U)
+ 800ccf4:	f89d 3025 	ldrb.w	r3, [sp, #37]	; 0x25
+ 800ccf8:	079b      	lsls	r3, r3, #30
+ 800ccfa:	d5e8      	bpl.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+    else
+    {
+#if defined (USE_HAL_SD_REGISTER_CALLBACKS) && (USE_HAL_SD_REGISTER_CALLBACKS == 1U)
+      hsd->DriveTransceiver_1_8V_Callback(SET);
+#else
+      HAL_SDEx_DriveTransceiver_1_8V_Callback(SET);
+ 800ccfc:	2001      	movs	r0, #1
+ 800ccfe:	f7fa fa97 	bl	8007230 <HAL_SDEx_DriveTransceiver_1_8V_Callback>
+ 800cd02:	e7b0      	b.n	800cc66 <HAL_SD_ConfigSpeedBusOperation+0x116>
+    switch (SpeedMode)
+ 800cd04:	2901      	cmp	r1, #1
+ 800cd06:	f43f af48 	beq.w	800cb9a <HAL_SD_ConfigSpeedBusOperation+0x4a>
+ 800cd0a:	2902      	cmp	r1, #2
+ 800cd0c:	d00c      	beq.n	800cd28 <HAL_SD_ConfigSpeedBusOperation+0x1d8>
+ 800cd0e:	b9c1      	cbnz	r1, 800cd42 <HAL_SD_ConfigSpeedBusOperation+0x1f2>
+        if ((hsd->SdCard.CardSpeed  == CARD_ULTRA_HIGH_SPEED) ||
+ 800cd10:	6dc3      	ldr	r3, [r0, #92]	; 0x5c
+ 800cd12:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 800cd16:	f43f af45 	beq.w	800cba4 <HAL_SD_ConfigSpeedBusOperation+0x54>
+ 800cd1a:	f5b3 7f80 	cmp.w	r3, #256	; 0x100
+ 800cd1e:	f43f af41 	beq.w	800cba4 <HAL_SD_ConfigSpeedBusOperation+0x54>
+            (hsd->SdCard.CardSpeed  == CARD_HIGH_SPEED) ||
+ 800cd22:	6bc3      	ldr	r3, [r0, #60]	; 0x3c
+ 800cd24:	2b01      	cmp	r3, #1
+ 800cd26:	e73c      	b.n	800cba2 <HAL_SD_ConfigSpeedBusOperation+0x52>
+        if ((hsd->SdCard.CardSpeed  == CARD_ULTRA_HIGH_SPEED) ||
+ 800cd28:	6de3      	ldr	r3, [r4, #92]	; 0x5c
+ 800cd2a:	f5b3 7f00 	cmp.w	r3, #512	; 0x200
+ 800cd2e:	f43f af39 	beq.w	800cba4 <HAL_SD_ConfigSpeedBusOperation+0x54>
+ 800cd32:	f5b3 7f80 	cmp.w	r3, #256	; 0x100
+ 800cd36:	f43f af35 	beq.w	800cba4 <HAL_SD_ConfigSpeedBusOperation+0x54>
+            (hsd->SdCard.CardSpeed  == CARD_HIGH_SPEED) ||
+ 800cd3a:	6be3      	ldr	r3, [r4, #60]	; 0x3c
+ 800cd3c:	2b01      	cmp	r3, #1
+ 800cd3e:	d1c6      	bne.n	800ccce <HAL_SD_ConfigSpeedBusOperation+0x17e>
+ 800cd40:	e730      	b.n	800cba4 <HAL_SD_ConfigSpeedBusOperation+0x54>
+        hsd->ErrorCode |= HAL_SD_ERROR_PARAM;
+ 800cd42:	6ba3      	ldr	r3, [r4, #56]	; 0x38
+ 800cd44:	f043 6300 	orr.w	r3, r3, #134217728	; 0x8000000
+ 800cd48:	e7c4      	b.n	800ccd4 <HAL_SD_ConfigSpeedBusOperation+0x184>
+    if ((HAL_GetTick() - tickstart) >=  SDMMC_DATATIMEOUT)
+ 800cd4a:	f7fa fa01 	bl	8007150 <HAL_GetTick>
+ 800cd4e:	1b80      	subs	r0, r0, r6
+ 800cd50:	3001      	adds	r0, #1
+ 800cd52:	d18b      	bne.n	800cc6c <HAL_SD_ConfigSpeedBusOperation+0x11c>
+      hsd->ErrorCode = HAL_SD_ERROR_TIMEOUT;
+ 800cd54:	f04f 4300 	mov.w	r3, #2147483648	; 0x80000000
+ 800cd58:	63a3      	str	r3, [r4, #56]	; 0x38
+      hsd->State = HAL_SD_STATE_READY;
+ 800cd5a:	2301      	movs	r3, #1
+ 800cd5c:	f884 3034 	strb.w	r3, [r4, #52]	; 0x34
+      return HAL_TIMEOUT;
+ 800cd60:	2503      	movs	r5, #3
+}
+ 800cd62:	4628      	mov	r0, r5
+ 800cd64:	b016      	add	sp, #88	; 0x58
+ 800cd66:	e8bd 87f0 	ldmia.w	sp!, {r4, r5, r6, r7, r8, r9, sl, pc}
+ 800cd6a:	bf00      	nop
+ 800cd6c:	80ffff04 	.word	0x80ffff04
+ 800cd70:	1fe00fff 	.word	0x1fe00fff
+ 800cd74:	18000f3a 	.word	0x18000f3a
+
+0800cd78 <SDMMC_Init>:
+  * @param  SDMMCx Pointer to SDMMC register base
+  * @param  Init SDMMC initialization structure
+  * @retval HAL status
+  */
+HAL_StatusTypeDef SDMMC_Init(SDMMC_TypeDef *SDMMCx, SDMMC_InitTypeDef Init)
+{
+ 800cd78:	b084      	sub	sp, #16
+ 800cd7a:	b510      	push	{r4, lr}
+ 800cd7c:	ac03      	add	r4, sp, #12
+ 800cd7e:	e884 000e 	stmia.w	r4, {r1, r2, r3}
+
+  /* Set SDMMC configuration parameters */
+#if !defined(STM32L4P5xx) && !defined(STM32L4Q5xx) && !defined(STM32L4R5xx) && !defined(STM32L4R7xx) && !defined(STM32L4R9xx) && !defined(STM32L4S5xx) && !defined(STM32L4S7xx) && !defined(STM32L4S9xx)
+  tmpreg |= Init.ClockBypass;
+#endif
+  tmpreg |= (Init.ClockEdge           |\
+ 800cd82:	9b03      	ldr	r3, [sp, #12]
+             Init.HardwareFlowControl |\
+             Init.ClockDiv
+             );
+
+  /* Write to SDMMC CLKCR */
+  MODIFY_REG(SDMMCx->CLKCR, CLKCR_CLEAR_MASK, tmpreg);
+ 800cd84:	6841      	ldr	r1, [r0, #4]
+  tmpreg |= (Init.ClockEdge           |\
+ 800cd86:	4313      	orrs	r3, r2
+             Init.ClockPowerSave      |\
+ 800cd88:	9a05      	ldr	r2, [sp, #20]
+ 800cd8a:	4313      	orrs	r3, r2
+             Init.BusWide             |\
+ 800cd8c:	9a06      	ldr	r2, [sp, #24]
+ 800cd8e:	4313      	orrs	r3, r2
+             Init.HardwareFlowControl |\
+ 800cd90:	9a07      	ldr	r2, [sp, #28]
+
+  return HAL_OK;
+}
+ 800cd92:	e8bd 4010 	ldmia.w	sp!, {r4, lr}
+             Init.HardwareFlowControl |\
+ 800cd96:	4313      	orrs	r3, r2
+  MODIFY_REG(SDMMCx->CLKCR, CLKCR_CLEAR_MASK, tmpreg);
+ 800cd98:	4a03      	ldr	r2, [pc, #12]	; (800cda8 <SDMMC_Init+0x30>)
+ 800cd9a:	400a      	ands	r2, r1
+ 800cd9c:	4313      	orrs	r3, r2
+ 800cd9e:	6043      	str	r3, [r0, #4]
+}
+ 800cda0:	b004      	add	sp, #16
+ 800cda2:	2000      	movs	r0, #0
+ 800cda4:	4770      	bx	lr
+ 800cda6:	bf00      	nop
+ 800cda8:	ffc02c00 	.word	0xffc02c00
+
+0800cdac <SDMMC_ReadFIFO>:
+  * @retval HAL status
+  */
+uint32_t SDMMC_ReadFIFO(SDMMC_TypeDef *SDMMCx)
+{
+  /* Read data from Rx FIFO */
+  return (SDMMCx->FIFO);
+ 800cdac:	f8d0 0080 	ldr.w	r0, [r0, #128]	; 0x80
+}
+ 800cdb0:	4770      	bx	lr
+
+0800cdb2 <SDMMC_WriteFIFO>:
+  * @retval HAL status
+  */
+HAL_StatusTypeDef SDMMC_WriteFIFO(SDMMC_TypeDef *SDMMCx, uint32_t *pWriteData)
+{
+  /* Write data to FIFO */
+  SDMMCx->FIFO = *pWriteData;
+ 800cdb2:	680b      	ldr	r3, [r1, #0]
+ 800cdb4:	f8c0 3080 	str.w	r3, [r0, #128]	; 0x80
+
+  return HAL_OK;
+}
+ 800cdb8:	2000      	movs	r0, #0
+ 800cdba:	4770      	bx	lr
+
+0800cdbc <SDMMC_PowerState_ON>:
+  * @brief  Set SDMMC Power state to ON.
+  * @param  SDMMCx Pointer to SDMMC register base
+  * @retval HAL status
+  */
+HAL_StatusTypeDef SDMMC_PowerState_ON(SDMMC_TypeDef *SDMMCx)
+{
+ 800cdbc:	b508      	push	{r3, lr}
+  /* Set power state to ON */
+#if defined(STM32L4P5xx) || defined(STM32L4Q5xx) || defined(STM32L4R5xx) || defined(STM32L4R7xx) || defined(STM32L4R9xx) || defined(STM32L4S5xx) || defined(STM32L4S7xx) || defined(STM32L4S9xx)
+  SDMMCx->POWER |= SDMMC_POWER_PWRCTRL;
+ 800cdbe:	6803      	ldr	r3, [r0, #0]
+ 800cdc0:	f043 0303 	orr.w	r3, r3, #3
+ 800cdc4:	6003      	str	r3, [r0, #0]
+  SDMMCx->POWER = SDMMC_POWER_PWRCTRL;
+#endif /* STM32L4P5xx || STM32L4Q5xx || STM32L4R5xx || STM32L4R7xx || STM32L4R9xx || STM32L4S5xx || STM32L4S7xx || STM32L4S9xx */
+
+  /* 1ms: required power up waiting time before starting the SD initialization
+  sequence */
+  HAL_Delay(2);
+ 800cdc6:	2002      	movs	r0, #2
+ 800cdc8:	f7f6 fdb9 	bl	800393e <HAL_Delay>
+
+  return HAL_OK;
+}
+ 800cdcc:	2000      	movs	r0, #0
+ 800cdce:	bd08      	pop	{r3, pc}
+
+0800cdd0 <SDMMC_PowerState_Cycle>:
+  * @retval HAL status
+  */
+HAL_StatusTypeDef SDMMC_PowerState_Cycle(SDMMC_TypeDef *SDMMCx)
+{
+  /* Set power state to Power Cycle*/
+  SDMMCx->POWER |= SDMMC_POWER_PWRCTRL_1;
+ 800cdd0:	6803      	ldr	r3, [r0, #0]
+ 800cdd2:	f043 0302 	orr.w	r3, r3, #2
+ 800cdd6:	6003      	str	r3, [r0, #0]
+
+  return HAL_OK;
+}
+ 800cdd8:	2000      	movs	r0, #0
+ 800cdda:	4770      	bx	lr
+
+0800cddc <SDMMC_PowerState_OFF>:
+  */
+HAL_StatusTypeDef SDMMC_PowerState_OFF(SDMMC_TypeDef *SDMMCx)
+{
+  /* Set power state to OFF */
+#if defined(STM32L4P5xx) || defined(STM32L4Q5xx) || defined(STM32L4R5xx) || defined(STM32L4R7xx) || defined(STM32L4R9xx) || defined(STM32L4S5xx) || defined(STM32L4S7xx) || defined(STM32L4S9xx)
+  SDMMCx->POWER &= ~(SDMMC_POWER_PWRCTRL);
+ 800cddc:	6803      	ldr	r3, [r0, #0]
+ 800cdde:	f023 0303 	bic.w	r3, r3, #3
+ 800cde2:	6003      	str	r3, [r0, #0]
+#else
+  SDMMCx->POWER = (uint32_t)0x00000000;
+#endif /* STM32L4P5xx || STM32L4Q5xx || STM32L4R5xx || STM32L4R7xx || STM32L4R9xx || STM32L4S5xx || STM32L4S7xx || STM32L4S9xx */
+
+  return HAL_OK;
+}
+ 800cde4:	2000      	movs	r0, #0
+ 800cde6:	4770      	bx	lr
+
+0800cde8 <SDMMC_GetPowerState>:
+  *            - 0x02: Power UP
+  *            - 0x03: Power ON
+  */
+uint32_t SDMMC_GetPowerState(SDMMC_TypeDef *SDMMCx)
+{
+  return (SDMMCx->POWER & SDMMC_POWER_PWRCTRL);
+ 800cde8:	6800      	ldr	r0, [r0, #0]
+}
+ 800cdea:	f000 0003 	and.w	r0, r0, #3
+ 800cdee:	4770      	bx	lr
+
+0800cdf0 <SDMMC_SendCommand>:
+  assert_param(IS_SDMMC_RESPONSE(Command->Response));
+  assert_param(IS_SDMMC_WAIT(Command->WaitForInterrupt));
+  assert_param(IS_SDMMC_CPSM(Command->CPSM));
+
+  /* Set the SDMMC Argument value */
+  SDMMCx->ARG = Command->Argument;
+ 800cdf0:	680b      	ldr	r3, [r1, #0]
+{
+ 800cdf2:	b510      	push	{r4, lr}
+  SDMMCx->ARG = Command->Argument;
+ 800cdf4:	6083      	str	r3, [r0, #8]
+
+  /* Set SDMMC command parameters */
+  tmpreg |= (uint32_t)(Command->CmdIndex         |\
+ 800cdf6:	e9d1 3201 	ldrd	r3, r2, [r1, #4]
+ 800cdfa:	4313      	orrs	r3, r2
+                       Command->Response         |\
+ 800cdfc:	68ca      	ldr	r2, [r1, #12]
+                       Command->WaitForInterrupt |\
+                       Command->CPSM);
+
+  /* Write to SDMMC CMD register */
+  MODIFY_REG(SDMMCx->CMD, CMD_CLEAR_MASK, tmpreg);
+ 800cdfe:	68c4      	ldr	r4, [r0, #12]
+                       Command->Response         |\
+ 800ce00:	4313      	orrs	r3, r2
+                       Command->WaitForInterrupt |\
+ 800ce02:	690a      	ldr	r2, [r1, #16]
+ 800ce04:	4313      	orrs	r3, r2
+  MODIFY_REG(SDMMCx->CMD, CMD_CLEAR_MASK, tmpreg);
+ 800ce06:	4a03      	ldr	r2, [pc, #12]	; (800ce14 <SDMMC_SendCommand+0x24>)
+ 800ce08:	4022      	ands	r2, r4
+ 800ce0a:	4313      	orrs	r3, r2
+ 800ce0c:	60c3      	str	r3, [r0, #12]
+
+  return HAL_OK;
+}
+ 800ce0e:	2000      	movs	r0, #0
+ 800ce10:	bd10      	pop	{r4, pc}
+ 800ce12:	bf00      	nop
+ 800ce14:	fffee0c0 	.word	0xfffee0c0
+
+0800ce18 <SDMMC_GetCommandResponse>:
+  * @param  SDMMCx Pointer to SDMMC register base
+  * @retval Command index of the last command response received
+  */
+uint8_t SDMMC_GetCommandResponse(SDMMC_TypeDef *SDMMCx)
+{
+  return (uint8_t)(SDMMCx->RESPCMD);
+ 800ce18:	6900      	ldr	r0, [r0, #16]
+}
+ 800ce1a:	b2c0      	uxtb	r0, r0
+ 800ce1c:	4770      	bx	lr
+
+0800ce1e <SDMMC_GetResponse>:
+
+  /* Check the parameters */
+  assert_param(IS_SDMMC_RESP(Response));
+
+  /* Get the response */
+  tmp = (uint32_t)(&(SDMMCx->RESP1)) + Response;
+ 800ce1e:	3014      	adds	r0, #20
+
+  return (*(__IO uint32_t *) tmp);
+ 800ce20:	5840      	ldr	r0, [r0, r1]
+}
+ 800ce22:	4770      	bx	lr
+
+0800ce24 <SDMMC_ConfigData>:
+  assert_param(IS_SDMMC_TRANSFER_DIR(Data->TransferDir));
+  assert_param(IS_SDMMC_TRANSFER_MODE(Data->TransferMode));
+  assert_param(IS_SDMMC_DPSM(Data->DPSM));
+
+  /* Set the SDMMC Data TimeOut value */
+  SDMMCx->DTIMER = Data->DataTimeOut;
+ 800ce24:	680b      	ldr	r3, [r1, #0]
+{
+ 800ce26:	b510      	push	{r4, lr}
+  SDMMCx->DTIMER = Data->DataTimeOut;
+ 800ce28:	6243      	str	r3, [r0, #36]	; 0x24
+
+  /* Set the SDMMC DataLength value */
+  SDMMCx->DLEN = Data->DataLength;
+ 800ce2a:	684b      	ldr	r3, [r1, #4]
+ 800ce2c:	6283      	str	r3, [r0, #40]	; 0x28
+
+  /* Set the SDMMC data configuration parameters */
+  tmpreg |= (uint32_t)(Data->DataBlockSize |\
+ 800ce2e:	e9d1 3402 	ldrd	r3, r4, [r1, #8]
+ 800ce32:	4323      	orrs	r3, r4
+                       Data->TransferDir   |\
+ 800ce34:	690c      	ldr	r4, [r1, #16]
+                       Data->TransferMode  |\
+                       Data->DPSM);
+
+  /* Write to SDMMC DCTRL */
+  MODIFY_REG(SDMMCx->DCTRL, DCTRL_CLEAR_MASK, tmpreg);
+ 800ce36:	6ac2      	ldr	r2, [r0, #44]	; 0x2c
+                       Data->TransferMode  |\
+ 800ce38:	6949      	ldr	r1, [r1, #20]
+                       Data->TransferDir   |\
+ 800ce3a:	4323      	orrs	r3, r4
+                       Data->TransferMode  |\
+ 800ce3c:	430b      	orrs	r3, r1
+  MODIFY_REG(SDMMCx->DCTRL, DCTRL_CLEAR_MASK, tmpreg);
+ 800ce3e:	f022 02ff 	bic.w	r2, r2, #255	; 0xff
+ 800ce42:	4313      	orrs	r3, r2
+ 800ce44:	62c3      	str	r3, [r0, #44]	; 0x2c
+
+  return HAL_OK;
+
+}
+ 800ce46:	2000      	movs	r0, #0
+ 800ce48:	bd10      	pop	{r4, pc}
+
+0800ce4a <SDMMC_GetDataCounter>:
+  * @param  SDMMCx Pointer to SDMMC register base
+  * @retval Number of remaining data bytes to be transferred
+  */
+uint32_t SDMMC_GetDataCounter(SDMMC_TypeDef *SDMMCx)
+{
+  return (SDMMCx->DCOUNT);
+ 800ce4a:	6b00      	ldr	r0, [r0, #48]	; 0x30
+}
+ 800ce4c:	4770      	bx	lr
+
+0800ce4e <SDMMC_GetFIFOCount>:
+ 800ce4e:	f8d0 0080 	ldr.w	r0, [r0, #128]	; 0x80
+ 800ce52:	4770      	bx	lr
+
+0800ce54 <SDMMC_SetSDMMCReadWaitMode>:
+{
+  /* Check the parameters */
+  assert_param(IS_SDMMC_READWAIT_MODE(SDMMC_ReadWaitMode));
+
+  /* Set SDMMC read wait mode */
+  MODIFY_REG(SDMMCx->DCTRL, SDMMC_DCTRL_RWMOD, SDMMC_ReadWaitMode);
+ 800ce54:	6ac3      	ldr	r3, [r0, #44]	; 0x2c
+ 800ce56:	f423 6380 	bic.w	r3, r3, #1024	; 0x400
+ 800ce5a:	4319      	orrs	r1, r3
+ 800ce5c:	62c1      	str	r1, [r0, #44]	; 0x2c
+
+  return HAL_OK;
+}
+ 800ce5e:	2000      	movs	r0, #0
+ 800ce60:	4770      	bx	lr
+	...
+
+0800ce64 <SDMMC_CmdGoIdleState>:
+  * @brief  Send the Go Idle State command and check the response.
+  * @param  SDMMCx Pointer to SDMMC register base
+  * @retval HAL status
+  */
+uint32_t SDMMC_CmdGoIdleState(SDMMC_TypeDef *SDMMCx)
+{
+ 800ce64:	b510      	push	{r4, lr}
+  SDMMC_CmdInitTypeDef  sdmmc_cmdinit;
+  uint32_t errorstate;
+
+  sdmmc_cmdinit.Argument         = 0U;
+ 800ce66:	2300      	movs	r3, #0
+{
+ 800ce68:	b086      	sub	sp, #24
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_GO_IDLE_STATE;
+ 800ce6a:	e9cd 3301 	strd	r3, r3, [sp, #4]
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_NO;
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800ce6e:	e9cd 3303 	strd	r3, r3, [sp, #12]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800ce72:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800ce74:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+ 800ce78:	9305      	str	r3, [sp, #20]
+{
+ 800ce7a:	4604      	mov	r4, r0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800ce7c:	f7ff ffb8 	bl	800cdf0 <SDMMC_SendCommand>
+  */
+static uint32_t SDMMC_GetCmdError(SDMMC_TypeDef *SDMMCx)
+{
+  /* 8 is the number of required instructions cycles for the below loop statement.
+  The SDMMC_CMDTIMEOUT is expressed in ms */
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800ce80:	4b0a      	ldr	r3, [pc, #40]	; (800ceac <SDMMC_CmdGoIdleState+0x48>)
+ 800ce82:	f44f 52fa 	mov.w	r2, #8000	; 0x1f40
+ 800ce86:	681b      	ldr	r3, [r3, #0]
+ 800ce88:	fbb3 f3f2 	udiv	r3, r3, r2
+ 800ce8c:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800ce90:	4353      	muls	r3, r2
+
+  do
+  {
+    if (count-- == 0U)
+ 800ce92:	3b01      	subs	r3, #1
+ 800ce94:	d307      	bcc.n	800cea6 <SDMMC_CmdGoIdleState+0x42>
+    {
+      return SDMMC_ERROR_TIMEOUT;
+    }
+
+  }while(!__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CMDSENT));
+ 800ce96:	6b62      	ldr	r2, [r4, #52]	; 0x34
+ 800ce98:	0612      	lsls	r2, r2, #24
+ 800ce9a:	d5fa      	bpl.n	800ce92 <SDMMC_CmdGoIdleState+0x2e>
+
+  /* Clear all the static flags */
+  __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_STATIC_CMD_FLAGS);
+ 800ce9c:	4b04      	ldr	r3, [pc, #16]	; (800ceb0 <SDMMC_CmdGoIdleState+0x4c>)
+ 800ce9e:	63a3      	str	r3, [r4, #56]	; 0x38
+
+  return SDMMC_ERROR_NONE;
+ 800cea0:	2000      	movs	r0, #0
+}
+ 800cea2:	b006      	add	sp, #24
+ 800cea4:	bd10      	pop	{r4, pc}
+      return SDMMC_ERROR_TIMEOUT;
+ 800cea6:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+  return errorstate;
+ 800ceaa:	e7fa      	b.n	800cea2 <SDMMC_CmdGoIdleState+0x3e>
+ 800ceac:	2009e2a8 	.word	0x2009e2a8
+ 800ceb0:	002000c5 	.word	0x002000c5
+
+0800ceb4 <SDMMC_GetCmdResp1>:
+  uint32_t count = Timeout * (SystemCoreClock / 8U /1000U);
+ 800ceb4:	4b45      	ldr	r3, [pc, #276]	; (800cfcc <SDMMC_GetCmdResp1+0x118>)
+{
+ 800ceb6:	b510      	push	{r4, lr}
+  uint32_t count = Timeout * (SystemCoreClock / 8U /1000U);
+ 800ceb8:	681b      	ldr	r3, [r3, #0]
+{
+ 800ceba:	4604      	mov	r4, r0
+  uint32_t count = Timeout * (SystemCoreClock / 8U /1000U);
+ 800cebc:	f44f 50fa 	mov.w	r0, #8000	; 0x1f40
+ 800cec0:	fbb3 f3f0 	udiv	r3, r3, r0
+  }while(((sta_reg & (SDMMC_FLAG_CCRCFAIL | SDMMC_FLAG_CMDREND | SDMMC_FLAG_CTIMEOUT | SDMMC_FLAG_BUSYD0END)) == 0U) ||
+ 800cec4:	4842      	ldr	r0, [pc, #264]	; (800cfd0 <SDMMC_GetCmdResp1+0x11c>)
+  uint32_t count = Timeout * (SystemCoreClock / 8U /1000U);
+ 800cec6:	435a      	muls	r2, r3
+    if (count-- == 0U)
+ 800cec8:	2a00      	cmp	r2, #0
+ 800ceca:	d048      	beq.n	800cf5e <SDMMC_GetCmdResp1+0xaa>
+    sta_reg = SDMMCx->STA;
+ 800cecc:	6b63      	ldr	r3, [r4, #52]	; 0x34
+         ((sta_reg & SDMMC_FLAG_CMDACT) != 0U ));
+ 800cece:	4203      	tst	r3, r0
+ 800ced0:	d007      	beq.n	800cee2 <SDMMC_GetCmdResp1+0x2e>
+  }while(((sta_reg & (SDMMC_FLAG_CCRCFAIL | SDMMC_FLAG_CMDREND | SDMMC_FLAG_CTIMEOUT | SDMMC_FLAG_BUSYD0END)) == 0U) ||
+ 800ced2:	049b      	lsls	r3, r3, #18
+ 800ced4:	d405      	bmi.n	800cee2 <SDMMC_GetCmdResp1+0x2e>
+  if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT))
+ 800ced6:	6b63      	ldr	r3, [r4, #52]	; 0x34
+ 800ced8:	0758      	lsls	r0, r3, #29
+ 800ceda:	d504      	bpl.n	800cee6 <SDMMC_GetCmdResp1+0x32>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT);
+ 800cedc:	2004      	movs	r0, #4
+ 800cede:	63a0      	str	r0, [r4, #56]	; 0x38
+}
+ 800cee0:	bd10      	pop	{r4, pc}
+ 800cee2:	3a01      	subs	r2, #1
+ 800cee4:	e7f0      	b.n	800cec8 <SDMMC_GetCmdResp1+0x14>
+  else if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL))
+ 800cee6:	6b60      	ldr	r0, [r4, #52]	; 0x34
+ 800cee8:	f010 0001 	ands.w	r0, r0, #1
+ 800ceec:	d002      	beq.n	800cef4 <SDMMC_GetCmdResp1+0x40>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL);
+ 800ceee:	2301      	movs	r3, #1
+ 800cef0:	63a3      	str	r3, [r4, #56]	; 0x38
+    return SDMMC_ERROR_CMD_CRC_FAIL;
+ 800cef2:	e7f5      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+  __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_STATIC_CMD_FLAGS);
+ 800cef4:	4b37      	ldr	r3, [pc, #220]	; (800cfd4 <SDMMC_GetCmdResp1+0x120>)
+ 800cef6:	63a3      	str	r3, [r4, #56]	; 0x38
+  return (uint8_t)(SDMMCx->RESPCMD);
+ 800cef8:	6923      	ldr	r3, [r4, #16]
+  if(SDMMC_GetCommandResponse(SDMMCx) != SD_CMD)
+ 800cefa:	b2db      	uxtb	r3, r3
+ 800cefc:	4299      	cmp	r1, r3
+ 800cefe:	d131      	bne.n	800cf64 <SDMMC_GetCmdResp1+0xb0>
+  return (*(__IO uint32_t *) tmp);
+ 800cf00:	6963      	ldr	r3, [r4, #20]
+  if((response_r1 & SDMMC_OCR_ERRORBITS) == SDMMC_ALLZERO)
+ 800cf02:	4835      	ldr	r0, [pc, #212]	; (800cfd8 <SDMMC_GetCmdResp1+0x124>)
+ 800cf04:	4018      	ands	r0, r3
+ 800cf06:	2800      	cmp	r0, #0
+ 800cf08:	d0ea      	beq.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+  else if((response_r1 & SDMMC_OCR_ADDR_OUT_OF_RANGE) == SDMMC_OCR_ADDR_OUT_OF_RANGE)
+ 800cf0a:	2b00      	cmp	r3, #0
+ 800cf0c:	db2c      	blt.n	800cf68 <SDMMC_GetCmdResp1+0xb4>
+  else if((response_r1 & SDMMC_OCR_ADDR_MISALIGNED) == SDMMC_OCR_ADDR_MISALIGNED)
+ 800cf0e:	005a      	lsls	r2, r3, #1
+ 800cf10:	d42d      	bmi.n	800cf6e <SDMMC_GetCmdResp1+0xba>
+  else if((response_r1 & SDMMC_OCR_BLOCK_LEN_ERR) == SDMMC_OCR_BLOCK_LEN_ERR)
+ 800cf12:	009c      	lsls	r4, r3, #2
+ 800cf14:	d42d      	bmi.n	800cf72 <SDMMC_GetCmdResp1+0xbe>
+  else if((response_r1 & SDMMC_OCR_ERASE_SEQ_ERR) == SDMMC_OCR_ERASE_SEQ_ERR)
+ 800cf16:	00d9      	lsls	r1, r3, #3
+ 800cf18:	d42d      	bmi.n	800cf76 <SDMMC_GetCmdResp1+0xc2>
+  else if((response_r1 & SDMMC_OCR_BAD_ERASE_PARAM) == SDMMC_OCR_BAD_ERASE_PARAM)
+ 800cf1a:	011a      	lsls	r2, r3, #4
+ 800cf1c:	d42e      	bmi.n	800cf7c <SDMMC_GetCmdResp1+0xc8>
+  else if((response_r1 & SDMMC_OCR_WRITE_PROT_VIOLATION) == SDMMC_OCR_WRITE_PROT_VIOLATION)
+ 800cf1e:	015c      	lsls	r4, r3, #5
+ 800cf20:	d42f      	bmi.n	800cf82 <SDMMC_GetCmdResp1+0xce>
+  else if((response_r1 & SDMMC_OCR_LOCK_UNLOCK_FAILED) == SDMMC_OCR_LOCK_UNLOCK_FAILED)
+ 800cf22:	01d9      	lsls	r1, r3, #7
+ 800cf24:	d430      	bmi.n	800cf88 <SDMMC_GetCmdResp1+0xd4>
+  else if((response_r1 & SDMMC_OCR_COM_CRC_FAILED) == SDMMC_OCR_COM_CRC_FAILED)
+ 800cf26:	021a      	lsls	r2, r3, #8
+ 800cf28:	d431      	bmi.n	800cf8e <SDMMC_GetCmdResp1+0xda>
+  else if((response_r1 & SDMMC_OCR_ILLEGAL_CMD) == SDMMC_OCR_ILLEGAL_CMD)
+ 800cf2a:	025c      	lsls	r4, r3, #9
+ 800cf2c:	d432      	bmi.n	800cf94 <SDMMC_GetCmdResp1+0xe0>
+  else if((response_r1 & SDMMC_OCR_CARD_ECC_FAILED) == SDMMC_OCR_CARD_ECC_FAILED)
+ 800cf2e:	0299      	lsls	r1, r3, #10
+ 800cf30:	d433      	bmi.n	800cf9a <SDMMC_GetCmdResp1+0xe6>
+  else if((response_r1 & SDMMC_OCR_CC_ERROR) == SDMMC_OCR_CC_ERROR)
+ 800cf32:	02da      	lsls	r2, r3, #11
+ 800cf34:	d434      	bmi.n	800cfa0 <SDMMC_GetCmdResp1+0xec>
+  else if((response_r1 & SDMMC_OCR_STREAM_READ_UNDERRUN) == SDMMC_OCR_STREAM_READ_UNDERRUN)
+ 800cf36:	035c      	lsls	r4, r3, #13
+ 800cf38:	d435      	bmi.n	800cfa6 <SDMMC_GetCmdResp1+0xf2>
+  else if((response_r1 & SDMMC_OCR_STREAM_WRITE_OVERRUN) == SDMMC_OCR_STREAM_WRITE_OVERRUN)
+ 800cf3a:	0399      	lsls	r1, r3, #14
+ 800cf3c:	d436      	bmi.n	800cfac <SDMMC_GetCmdResp1+0xf8>
+  else if((response_r1 & SDMMC_OCR_CID_CSD_OVERWRITE) == SDMMC_OCR_CID_CSD_OVERWRITE)
+ 800cf3e:	03da      	lsls	r2, r3, #15
+ 800cf40:	d437      	bmi.n	800cfb2 <SDMMC_GetCmdResp1+0xfe>
+  else if((response_r1 & SDMMC_OCR_WP_ERASE_SKIP) == SDMMC_OCR_WP_ERASE_SKIP)
+ 800cf42:	041c      	lsls	r4, r3, #16
+ 800cf44:	d438      	bmi.n	800cfb8 <SDMMC_GetCmdResp1+0x104>
+  else if((response_r1 & SDMMC_OCR_CARD_ECC_DISABLED) == SDMMC_OCR_CARD_ECC_DISABLED)
+ 800cf46:	0459      	lsls	r1, r3, #17
+ 800cf48:	d439      	bmi.n	800cfbe <SDMMC_GetCmdResp1+0x10a>
+  else if((response_r1 & SDMMC_OCR_ERASE_RESET) == SDMMC_OCR_ERASE_RESET)
+ 800cf4a:	049a      	lsls	r2, r3, #18
+ 800cf4c:	d43a      	bmi.n	800cfc4 <SDMMC_GetCmdResp1+0x110>
+    return SDMMC_ERROR_GENERAL_UNKNOWN_ERR;
+ 800cf4e:	f013 0f08 	tst.w	r3, #8
+ 800cf52:	bf14      	ite	ne
+ 800cf54:	f44f 0000 	movne.w	r0, #8388608	; 0x800000
+ 800cf58:	f44f 3080 	moveq.w	r0, #65536	; 0x10000
+ 800cf5c:	e7c0      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+      return SDMMC_ERROR_TIMEOUT;
+ 800cf5e:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+ 800cf62:	e7bd      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_CMD_CRC_FAIL;
+ 800cf64:	2001      	movs	r0, #1
+ 800cf66:	e7bb      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_ADDR_OUT_OF_RANGE;
+ 800cf68:	f04f 7000 	mov.w	r0, #33554432	; 0x2000000
+ 800cf6c:	e7b8      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_ADDR_MISALIGNED;
+ 800cf6e:	2040      	movs	r0, #64	; 0x40
+ 800cf70:	e7b6      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_BLOCK_LEN_ERR;
+ 800cf72:	2080      	movs	r0, #128	; 0x80
+ 800cf74:	e7b4      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_ERASE_SEQ_ERR;
+ 800cf76:	f44f 7080 	mov.w	r0, #256	; 0x100
+ 800cf7a:	e7b1      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_BAD_ERASE_PARAM;
+ 800cf7c:	f44f 7000 	mov.w	r0, #512	; 0x200
+ 800cf80:	e7ae      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_WRITE_PROT_VIOLATION;
+ 800cf82:	f44f 6080 	mov.w	r0, #1024	; 0x400
+ 800cf86:	e7ab      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_LOCK_UNLOCK_FAILED;
+ 800cf88:	f44f 6000 	mov.w	r0, #2048	; 0x800
+ 800cf8c:	e7a8      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_COM_CRC_FAILED;
+ 800cf8e:	f44f 5080 	mov.w	r0, #4096	; 0x1000
+ 800cf92:	e7a5      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_ILLEGAL_CMD;
+ 800cf94:	f44f 5000 	mov.w	r0, #8192	; 0x2000
+ 800cf98:	e7a2      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_CARD_ECC_FAILED;
+ 800cf9a:	f44f 4080 	mov.w	r0, #16384	; 0x4000
+ 800cf9e:	e79f      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_CC_ERR;
+ 800cfa0:	f44f 4000 	mov.w	r0, #32768	; 0x8000
+ 800cfa4:	e79c      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_STREAM_READ_UNDERRUN;
+ 800cfa6:	f44f 3000 	mov.w	r0, #131072	; 0x20000
+ 800cfaa:	e799      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_STREAM_WRITE_OVERRUN;
+ 800cfac:	f44f 2080 	mov.w	r0, #262144	; 0x40000
+ 800cfb0:	e796      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_CID_CSD_OVERWRITE;
+ 800cfb2:	f44f 2000 	mov.w	r0, #524288	; 0x80000
+ 800cfb6:	e793      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_WP_ERASE_SKIP;
+ 800cfb8:	f44f 1080 	mov.w	r0, #1048576	; 0x100000
+ 800cfbc:	e790      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_CARD_ECC_DISABLED;
+ 800cfbe:	f44f 1000 	mov.w	r0, #2097152	; 0x200000
+ 800cfc2:	e78d      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+    return SDMMC_ERROR_ERASE_RESET;
+ 800cfc4:	f44f 0080 	mov.w	r0, #4194304	; 0x400000
+ 800cfc8:	e78a      	b.n	800cee0 <SDMMC_GetCmdResp1+0x2c>
+ 800cfca:	bf00      	nop
+ 800cfcc:	2009e2a8 	.word	0x2009e2a8
+ 800cfd0:	00200045 	.word	0x00200045
+ 800cfd4:	002000c5 	.word	0x002000c5
+ 800cfd8:	fdffe008 	.word	0xfdffe008
+
+0800cfdc <SDMMC_CmdBlockLength>:
+{
+ 800cfdc:	b530      	push	{r4, r5, lr}
+ 800cfde:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800cfe0:	2510      	movs	r5, #16
+ 800cfe2:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800cfe6:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800cfea:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800cfec:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)BlockSize;
+ 800cff0:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800cff2:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800cff4:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800cff6:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800cffa:	f7ff fef9 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SET_BLOCKLEN, SDMMC_CMDTIMEOUT);
+ 800cffe:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d002:	4629      	mov	r1, r5
+ 800d004:	4620      	mov	r0, r4
+ 800d006:	f7ff ff55 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d00a:	b007      	add	sp, #28
+ 800d00c:	bd30      	pop	{r4, r5, pc}
+
+0800d00e <SDMMC_CmdReadSingleBlock>:
+{
+ 800d00e:	b530      	push	{r4, r5, lr}
+ 800d010:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d012:	2511      	movs	r5, #17
+ 800d014:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d018:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d01c:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d01e:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)ReadAdd;
+ 800d022:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d024:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d026:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d028:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d02c:	f7ff fee0 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_READ_SINGLE_BLOCK, SDMMC_CMDTIMEOUT);
+ 800d030:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d034:	4629      	mov	r1, r5
+ 800d036:	4620      	mov	r0, r4
+ 800d038:	f7ff ff3c 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d03c:	b007      	add	sp, #28
+ 800d03e:	bd30      	pop	{r4, r5, pc}
+
+0800d040 <SDMMC_CmdReadMultiBlock>:
+{
+ 800d040:	b530      	push	{r4, r5, lr}
+ 800d042:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d044:	2512      	movs	r5, #18
+ 800d046:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d04a:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d04e:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d050:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)ReadAdd;
+ 800d054:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d056:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d058:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d05a:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d05e:	f7ff fec7 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_READ_MULT_BLOCK, SDMMC_CMDTIMEOUT);
+ 800d062:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d066:	4629      	mov	r1, r5
+ 800d068:	4620      	mov	r0, r4
+ 800d06a:	f7ff ff23 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d06e:	b007      	add	sp, #28
+ 800d070:	bd30      	pop	{r4, r5, pc}
+
+0800d072 <SDMMC_CmdWriteSingleBlock>:
+{
+ 800d072:	b530      	push	{r4, r5, lr}
+ 800d074:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d076:	2518      	movs	r5, #24
+ 800d078:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d07c:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d080:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d082:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)WriteAdd;
+ 800d086:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d088:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d08a:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d08c:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d090:	f7ff feae 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_WRITE_SINGLE_BLOCK, SDMMC_CMDTIMEOUT);
+ 800d094:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d098:	4629      	mov	r1, r5
+ 800d09a:	4620      	mov	r0, r4
+ 800d09c:	f7ff ff0a 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d0a0:	b007      	add	sp, #28
+ 800d0a2:	bd30      	pop	{r4, r5, pc}
+
+0800d0a4 <SDMMC_CmdWriteMultiBlock>:
+{
+ 800d0a4:	b530      	push	{r4, r5, lr}
+ 800d0a6:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d0a8:	2519      	movs	r5, #25
+ 800d0aa:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d0ae:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d0b2:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d0b4:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)WriteAdd;
+ 800d0b8:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d0ba:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d0bc:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d0be:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d0c2:	f7ff fe95 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_WRITE_MULT_BLOCK, SDMMC_CMDTIMEOUT);
+ 800d0c6:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d0ca:	4629      	mov	r1, r5
+ 800d0cc:	4620      	mov	r0, r4
+ 800d0ce:	f7ff fef1 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d0d2:	b007      	add	sp, #28
+ 800d0d4:	bd30      	pop	{r4, r5, pc}
+
+0800d0d6 <SDMMC_CmdSDEraseStartAdd>:
+{
+ 800d0d6:	b530      	push	{r4, r5, lr}
+ 800d0d8:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d0da:	2520      	movs	r5, #32
+ 800d0dc:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d0e0:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d0e4:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d0e6:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)StartAdd;
+ 800d0ea:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d0ec:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d0ee:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d0f0:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d0f4:	f7ff fe7c 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SD_ERASE_GRP_START, SDMMC_CMDTIMEOUT);
+ 800d0f8:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d0fc:	4629      	mov	r1, r5
+ 800d0fe:	4620      	mov	r0, r4
+ 800d100:	f7ff fed8 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d104:	b007      	add	sp, #28
+ 800d106:	bd30      	pop	{r4, r5, pc}
+
+0800d108 <SDMMC_CmdSDEraseEndAdd>:
+{
+ 800d108:	b530      	push	{r4, r5, lr}
+ 800d10a:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d10c:	2521      	movs	r5, #33	; 0x21
+ 800d10e:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d112:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d116:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d118:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)EndAdd;
+ 800d11c:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d11e:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d120:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d122:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d126:	f7ff fe63 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SD_ERASE_GRP_END, SDMMC_CMDTIMEOUT);
+ 800d12a:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d12e:	4629      	mov	r1, r5
+ 800d130:	4620      	mov	r0, r4
+ 800d132:	f7ff febf 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d136:	b007      	add	sp, #28
+ 800d138:	bd30      	pop	{r4, r5, pc}
+
+0800d13a <SDMMC_CmdEraseStartAdd>:
+{
+ 800d13a:	b530      	push	{r4, r5, lr}
+ 800d13c:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d13e:	2523      	movs	r5, #35	; 0x23
+ 800d140:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d144:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d148:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d14a:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)StartAdd;
+ 800d14e:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d150:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d152:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d154:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d158:	f7ff fe4a 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_ERASE_GRP_START, SDMMC_CMDTIMEOUT);
+ 800d15c:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d160:	4629      	mov	r1, r5
+ 800d162:	4620      	mov	r0, r4
+ 800d164:	f7ff fea6 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d168:	b007      	add	sp, #28
+ 800d16a:	bd30      	pop	{r4, r5, pc}
+
+0800d16c <SDMMC_CmdEraseEndAdd>:
+{
+ 800d16c:	b530      	push	{r4, r5, lr}
+ 800d16e:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d170:	2524      	movs	r5, #36	; 0x24
+ 800d172:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d176:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d17a:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d17c:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)EndAdd;
+ 800d180:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d182:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d184:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d186:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d18a:	f7ff fe31 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_ERASE_GRP_END, SDMMC_CMDTIMEOUT);
+ 800d18e:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d192:	4629      	mov	r1, r5
+ 800d194:	4620      	mov	r0, r4
+ 800d196:	f7ff fe8d 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d19a:	b007      	add	sp, #28
+ 800d19c:	bd30      	pop	{r4, r5, pc}
+
+0800d19e <SDMMC_CmdErase>:
+{
+ 800d19e:	b530      	push	{r4, r5, lr}
+ 800d1a0:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d1a2:	2526      	movs	r5, #38	; 0x26
+ 800d1a4:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d1a8:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d1ac:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d1ae:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = EraseType;
+ 800d1b2:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d1b4:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d1b6:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d1b8:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d1bc:	f7ff fe18 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_ERASE, SDMMC_MAXERASETIMEOUT);
+ 800d1c0:	f24f 6218 	movw	r2, #63000	; 0xf618
+ 800d1c4:	4629      	mov	r1, r5
+ 800d1c6:	4620      	mov	r0, r4
+ 800d1c8:	f7ff fe74 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d1cc:	b007      	add	sp, #28
+ 800d1ce:	bd30      	pop	{r4, r5, pc}
+
+0800d1d0 <SDMMC_CmdStopTransfer>:
+{
+ 800d1d0:	b530      	push	{r4, r5, lr}
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_STOP_TRANSMISSION;
+ 800d1d2:	2300      	movs	r3, #0
+{
+ 800d1d4:	b087      	sub	sp, #28
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_STOP_TRANSMISSION;
+ 800d1d6:	250c      	movs	r5, #12
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d1d8:	f44f 7280 	mov.w	r2, #256	; 0x100
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800d1dc:	e9cd 2303 	strd	r2, r3, [sp, #12]
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_STOP_TRANSMISSION;
+ 800d1e0:	e9cd 3501 	strd	r3, r5, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d1e4:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+ 800d1e8:	9305      	str	r3, [sp, #20]
+  __SDMMC_CMDSTOP_ENABLE(SDMMCx);
+ 800d1ea:	68c3      	ldr	r3, [r0, #12]
+ 800d1ec:	f043 0380 	orr.w	r3, r3, #128	; 0x80
+ 800d1f0:	60c3      	str	r3, [r0, #12]
+  __SDMMC_CMDTRANS_DISABLE(SDMMCx);
+ 800d1f2:	68c3      	ldr	r3, [r0, #12]
+ 800d1f4:	f023 0340 	bic.w	r3, r3, #64	; 0x40
+{
+ 800d1f8:	4604      	mov	r4, r0
+  __SDMMC_CMDTRANS_DISABLE(SDMMCx);
+ 800d1fa:	60c3      	str	r3, [r0, #12]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d1fc:	a901      	add	r1, sp, #4
+ 800d1fe:	f7ff fdf7 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_STOP_TRANSMISSION, SDMMC_STOPTRANSFERTIMEOUT);
+ 800d202:	4a05      	ldr	r2, [pc, #20]	; (800d218 <SDMMC_CmdStopTransfer+0x48>)
+ 800d204:	4629      	mov	r1, r5
+ 800d206:	4620      	mov	r0, r4
+ 800d208:	f7ff fe54 	bl	800ceb4 <SDMMC_GetCmdResp1>
+  __SDMMC_CMDSTOP_DISABLE(SDMMCx);
+ 800d20c:	68e3      	ldr	r3, [r4, #12]
+ 800d20e:	f023 0380 	bic.w	r3, r3, #128	; 0x80
+ 800d212:	60e3      	str	r3, [r4, #12]
+}
+ 800d214:	b007      	add	sp, #28
+ 800d216:	bd30      	pop	{r4, r5, pc}
+ 800d218:	05f5e100 	.word	0x05f5e100
+
+0800d21c <SDMMC_CmdSelDesel>:
+{
+ 800d21c:	b530      	push	{r4, r5, lr}
+ 800d21e:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d220:	2507      	movs	r5, #7
+ 800d222:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d226:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d22a:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d22c:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)Addr;
+ 800d230:	9201      	str	r2, [sp, #4]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d232:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d234:	2200      	movs	r2, #0
+ 800d236:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d23a:	f7ff fdd9 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SEL_DESEL_CARD, SDMMC_CMDTIMEOUT);
+ 800d23e:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d242:	4629      	mov	r1, r5
+ 800d244:	4620      	mov	r0, r4
+ 800d246:	f7ff fe35 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d24a:	b007      	add	sp, #28
+ 800d24c:	bd30      	pop	{r4, r5, pc}
+
+0800d24e <SDMMC_CmdAppCommand>:
+{
+ 800d24e:	b530      	push	{r4, r5, lr}
+ 800d250:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d252:	2537      	movs	r5, #55	; 0x37
+ 800d254:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d258:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d25c:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d25e:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)Argument;
+ 800d262:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d264:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d266:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d268:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d26c:	f7ff fdc0 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_APP_CMD, SDMMC_CMDTIMEOUT);
+ 800d270:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d274:	4629      	mov	r1, r5
+ 800d276:	4620      	mov	r0, r4
+ 800d278:	f7ff fe1c 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d27c:	b007      	add	sp, #28
+ 800d27e:	bd30      	pop	{r4, r5, pc}
+
+0800d280 <SDMMC_CmdBusWidth>:
+{
+ 800d280:	b530      	push	{r4, r5, lr}
+ 800d282:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d284:	2506      	movs	r5, #6
+ 800d286:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d28a:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d28e:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d290:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = (uint32_t)BusWidth;
+ 800d294:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d296:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d298:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d29a:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d29e:	f7ff fda7 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_APP_SD_SET_BUSWIDTH, SDMMC_CMDTIMEOUT);
+ 800d2a2:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d2a6:	4629      	mov	r1, r5
+ 800d2a8:	4620      	mov	r0, r4
+ 800d2aa:	f7ff fe03 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d2ae:	b007      	add	sp, #28
+ 800d2b0:	bd30      	pop	{r4, r5, pc}
+
+0800d2b2 <SDMMC_CmdSwitch>:
+ 800d2b2:	f7ff bfe5 	b.w	800d280 <SDMMC_CmdBusWidth>
+
+0800d2b6 <SDMMC_CmdSendSCR>:
+{
+ 800d2b6:	b530      	push	{r4, r5, lr}
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SD_APP_SEND_SCR;
+ 800d2b8:	2300      	movs	r3, #0
+{
+ 800d2ba:	b087      	sub	sp, #28
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SD_APP_SEND_SCR;
+ 800d2bc:	2533      	movs	r5, #51	; 0x33
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d2be:	f44f 7280 	mov.w	r2, #256	; 0x100
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800d2c2:	e9cd 2303 	strd	r2, r3, [sp, #12]
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SD_APP_SEND_SCR;
+ 800d2c6:	e9cd 3501 	strd	r3, r5, [sp, #4]
+{
+ 800d2ca:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d2cc:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d2d0:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d2d2:	9305      	str	r3, [sp, #20]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d2d4:	f7ff fd8c 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SD_APP_SEND_SCR, SDMMC_CMDTIMEOUT);
+ 800d2d8:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d2dc:	4629      	mov	r1, r5
+ 800d2de:	4620      	mov	r0, r4
+ 800d2e0:	f7ff fde8 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d2e4:	b007      	add	sp, #28
+ 800d2e6:	bd30      	pop	{r4, r5, pc}
+
+0800d2e8 <SDMMC_CmdSetRelAddMmc>:
+{
+ 800d2e8:	b530      	push	{r4, r5, lr}
+ 800d2ea:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d2ec:	2503      	movs	r5, #3
+  sdmmc_cmdinit.Argument         = ((uint32_t)RCA << 16U);
+ 800d2ee:	0409      	lsls	r1, r1, #16
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d2f0:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d2f4:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d2f8:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d2fa:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = ((uint32_t)RCA << 16U);
+ 800d2fe:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d300:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d302:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d304:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d308:	f7ff fd72 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SET_REL_ADDR, SDMMC_CMDTIMEOUT);
+ 800d30c:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d310:	4629      	mov	r1, r5
+ 800d312:	4620      	mov	r0, r4
+ 800d314:	f7ff fdce 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d318:	b007      	add	sp, #28
+ 800d31a:	bd30      	pop	{r4, r5, pc}
+
+0800d31c <SDMMC_CmdSendStatus>:
+{
+ 800d31c:	b530      	push	{r4, r5, lr}
+ 800d31e:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d320:	250d      	movs	r5, #13
+ 800d322:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d326:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d32a:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d32c:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = Argument;
+ 800d330:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d332:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d334:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d336:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d33a:	f7ff fd59 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SEND_STATUS, SDMMC_CMDTIMEOUT);
+ 800d33e:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d342:	4629      	mov	r1, r5
+ 800d344:	4620      	mov	r0, r4
+ 800d346:	f7ff fdb5 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d34a:	b007      	add	sp, #28
+ 800d34c:	bd30      	pop	{r4, r5, pc}
+
+0800d34e <SDMMC_CmdStatusRegister>:
+{
+ 800d34e:	b530      	push	{r4, r5, lr}
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SD_APP_STATUS;
+ 800d350:	2300      	movs	r3, #0
+{
+ 800d352:	b087      	sub	sp, #28
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SD_APP_STATUS;
+ 800d354:	250d      	movs	r5, #13
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d356:	f44f 7280 	mov.w	r2, #256	; 0x100
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800d35a:	e9cd 2303 	strd	r2, r3, [sp, #12]
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SD_APP_STATUS;
+ 800d35e:	e9cd 3501 	strd	r3, r5, [sp, #4]
+{
+ 800d362:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d364:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d368:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d36a:	9305      	str	r3, [sp, #20]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d36c:	f7ff fd40 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_SD_APP_STATUS, SDMMC_CMDTIMEOUT);
+ 800d370:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d374:	4629      	mov	r1, r5
+ 800d376:	4620      	mov	r0, r4
+ 800d378:	f7ff fd9c 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d37c:	b007      	add	sp, #28
+ 800d37e:	bd30      	pop	{r4, r5, pc}
+
+0800d380 <SDMMC_CmdVoltageSwitch>:
+{
+ 800d380:	b530      	push	{r4, r5, lr}
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_VOLTAGE_SWITCH;
+ 800d382:	2300      	movs	r3, #0
+{
+ 800d384:	b087      	sub	sp, #28
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_VOLTAGE_SWITCH;
+ 800d386:	250b      	movs	r5, #11
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d388:	f44f 7280 	mov.w	r2, #256	; 0x100
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800d38c:	e9cd 2303 	strd	r2, r3, [sp, #12]
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_VOLTAGE_SWITCH;
+ 800d390:	e9cd 3501 	strd	r3, r5, [sp, #4]
+{
+ 800d394:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d396:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d39a:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d39c:	9305      	str	r3, [sp, #20]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d39e:	f7ff fd27 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_VOLTAGE_SWITCH, SDMMC_CMDTIMEOUT);
+ 800d3a2:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d3a6:	4629      	mov	r1, r5
+ 800d3a8:	4620      	mov	r0, r4
+ 800d3aa:	f7ff fd83 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d3ae:	b007      	add	sp, #28
+ 800d3b0:	bd30      	pop	{r4, r5, pc}
+
+0800d3b2 <SDMMC_CmdSendEXTCSD>:
+{
+ 800d3b2:	b530      	push	{r4, r5, lr}
+ 800d3b4:	b087      	sub	sp, #28
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d3b6:	2508      	movs	r5, #8
+ 800d3b8:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d3bc:	e9cd 5302 	strd	r5, r3, [sp, #8]
+{
+ 800d3c0:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d3c2:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  sdmmc_cmdinit.Argument         = Argument;
+ 800d3c6:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d3c8:	2200      	movs	r2, #0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d3ca:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d3cc:	e9cd 2304 	strd	r2, r3, [sp, #16]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d3d0:	f7ff fd0e 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp1(SDMMCx, SDMMC_CMD_HS_SEND_EXT_CSD,SDMMC_CMDTIMEOUT);
+ 800d3d4:	f241 3288 	movw	r2, #5000	; 0x1388
+ 800d3d8:	4629      	mov	r1, r5
+ 800d3da:	4620      	mov	r0, r4
+ 800d3dc:	f7ff fd6a 	bl	800ceb4 <SDMMC_GetCmdResp1>
+}
+ 800d3e0:	b007      	add	sp, #28
+ 800d3e2:	bd30      	pop	{r4, r5, pc}
+
+0800d3e4 <SDMMC_GetCmdResp2>:
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d3e4:	4b11      	ldr	r3, [pc, #68]	; (800d42c <SDMMC_GetCmdResp2+0x48>)
+ 800d3e6:	f44f 51fa 	mov.w	r1, #8000	; 0x1f40
+ 800d3ea:	681b      	ldr	r3, [r3, #0]
+ 800d3ec:	fbb3 f3f1 	udiv	r3, r3, r1
+ 800d3f0:	f241 3188 	movw	r1, #5000	; 0x1388
+{
+ 800d3f4:	4602      	mov	r2, r0
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d3f6:	434b      	muls	r3, r1
+    if (count-- == 0U)
+ 800d3f8:	3b01      	subs	r3, #1
+ 800d3fa:	d313      	bcc.n	800d424 <SDMMC_GetCmdResp2+0x40>
+    sta_reg = SDMMCx->STA;
+ 800d3fc:	6b51      	ldr	r1, [r2, #52]	; 0x34
+         ((sta_reg & SDMMC_FLAG_CMDACT) != 0U ));
+ 800d3fe:	f011 0f45 	tst.w	r1, #69	; 0x45
+ 800d402:	d0f9      	beq.n	800d3f8 <SDMMC_GetCmdResp2+0x14>
+  }while(((sta_reg & (SDMMC_FLAG_CCRCFAIL | SDMMC_FLAG_CMDREND | SDMMC_FLAG_CTIMEOUT)) == 0U) ||
+ 800d404:	0489      	lsls	r1, r1, #18
+ 800d406:	d4f7      	bmi.n	800d3f8 <SDMMC_GetCmdResp2+0x14>
+  if (__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT))
+ 800d408:	6b53      	ldr	r3, [r2, #52]	; 0x34
+ 800d40a:	075b      	lsls	r3, r3, #29
+ 800d40c:	d502      	bpl.n	800d414 <SDMMC_GetCmdResp2+0x30>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT);
+ 800d40e:	2004      	movs	r0, #4
+ 800d410:	6390      	str	r0, [r2, #56]	; 0x38
+    return SDMMC_ERROR_CMD_RSP_TIMEOUT;
+ 800d412:	4770      	bx	lr
+  else if (__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL))
+ 800d414:	6b50      	ldr	r0, [r2, #52]	; 0x34
+ 800d416:	f010 0001 	ands.w	r0, r0, #1
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_STATIC_CMD_FLAGS);
+ 800d41a:	bf0c      	ite	eq
+ 800d41c:	4b04      	ldreq	r3, [pc, #16]	; (800d430 <SDMMC_GetCmdResp2+0x4c>)
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL);
+ 800d41e:	2301      	movne	r3, #1
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_STATIC_CMD_FLAGS);
+ 800d420:	6393      	str	r3, [r2, #56]	; 0x38
+  return SDMMC_ERROR_NONE;
+ 800d422:	4770      	bx	lr
+      return SDMMC_ERROR_TIMEOUT;
+ 800d424:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+}
+ 800d428:	4770      	bx	lr
+ 800d42a:	bf00      	nop
+ 800d42c:	2009e2a8 	.word	0x2009e2a8
+ 800d430:	002000c5 	.word	0x002000c5
+
+0800d434 <SDMMC_CmdSendCID>:
+{
+ 800d434:	b510      	push	{r4, lr}
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_ALL_SEND_CID;
+ 800d436:	2300      	movs	r3, #0
+{
+ 800d438:	b086      	sub	sp, #24
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_ALL_SEND_CID;
+ 800d43a:	2202      	movs	r2, #2
+ 800d43c:	e9cd 3201 	strd	r3, r2, [sp, #4]
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_LONG;
+ 800d440:	f44f 7240 	mov.w	r2, #768	; 0x300
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800d444:	e9cd 2303 	strd	r2, r3, [sp, #12]
+{
+ 800d448:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d44a:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d44e:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d450:	9305      	str	r3, [sp, #20]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d452:	f7ff fccd 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp2(SDMMCx);
+ 800d456:	4620      	mov	r0, r4
+ 800d458:	f7ff ffc4 	bl	800d3e4 <SDMMC_GetCmdResp2>
+}
+ 800d45c:	b006      	add	sp, #24
+ 800d45e:	bd10      	pop	{r4, pc}
+
+0800d460 <SDMMC_CmdSendCSD>:
+{
+ 800d460:	b510      	push	{r4, lr}
+ 800d462:	b086      	sub	sp, #24
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_LONG;
+ 800d464:	2209      	movs	r2, #9
+ 800d466:	f44f 7340 	mov.w	r3, #768	; 0x300
+ 800d46a:	e9cd 2302 	strd	r2, r3, [sp, #8]
+  sdmmc_cmdinit.Argument         = Argument;
+ 800d46e:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d470:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+ 800d474:	2100      	movs	r1, #0
+ 800d476:	e9cd 1304 	strd	r1, r3, [sp, #16]
+{
+ 800d47a:	4604      	mov	r4, r0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d47c:	a901      	add	r1, sp, #4
+ 800d47e:	f7ff fcb7 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp2(SDMMCx);
+ 800d482:	4620      	mov	r0, r4
+ 800d484:	f7ff ffae 	bl	800d3e4 <SDMMC_GetCmdResp2>
+}
+ 800d488:	b006      	add	sp, #24
+ 800d48a:	bd10      	pop	{r4, pc}
+
+0800d48c <SDMMC_GetCmdResp3>:
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d48c:	4b0e      	ldr	r3, [pc, #56]	; (800d4c8 <SDMMC_GetCmdResp3+0x3c>)
+ 800d48e:	f44f 51fa 	mov.w	r1, #8000	; 0x1f40
+ 800d492:	681b      	ldr	r3, [r3, #0]
+ 800d494:	fbb3 f3f1 	udiv	r3, r3, r1
+ 800d498:	f241 3188 	movw	r1, #5000	; 0x1388
+{
+ 800d49c:	4602      	mov	r2, r0
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d49e:	434b      	muls	r3, r1
+    if (count-- == 0U)
+ 800d4a0:	3b01      	subs	r3, #1
+ 800d4a2:	d30e      	bcc.n	800d4c2 <SDMMC_GetCmdResp3+0x36>
+    sta_reg = SDMMCx->STA;
+ 800d4a4:	6b51      	ldr	r1, [r2, #52]	; 0x34
+         ((sta_reg & SDMMC_FLAG_CMDACT) != 0U ));
+ 800d4a6:	f011 0f45 	tst.w	r1, #69	; 0x45
+ 800d4aa:	d0f9      	beq.n	800d4a0 <SDMMC_GetCmdResp3+0x14>
+  }while(((sta_reg & (SDMMC_FLAG_CCRCFAIL | SDMMC_FLAG_CMDREND | SDMMC_FLAG_CTIMEOUT)) == 0U) ||
+ 800d4ac:	0489      	lsls	r1, r1, #18
+ 800d4ae:	d4f7      	bmi.n	800d4a0 <SDMMC_GetCmdResp3+0x14>
+  if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT))
+ 800d4b0:	6b50      	ldr	r0, [r2, #52]	; 0x34
+ 800d4b2:	f010 0004 	ands.w	r0, r0, #4
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT);
+ 800d4b6:	bf15      	itete	ne
+ 800d4b8:	2004      	movne	r0, #4
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_STATIC_CMD_FLAGS);
+ 800d4ba:	4b04      	ldreq	r3, [pc, #16]	; (800d4cc <SDMMC_GetCmdResp3+0x40>)
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT);
+ 800d4bc:	6390      	strne	r0, [r2, #56]	; 0x38
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_STATIC_CMD_FLAGS);
+ 800d4be:	6393      	streq	r3, [r2, #56]	; 0x38
+  return SDMMC_ERROR_NONE;
+ 800d4c0:	4770      	bx	lr
+      return SDMMC_ERROR_TIMEOUT;
+ 800d4c2:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+}
+ 800d4c6:	4770      	bx	lr
+ 800d4c8:	2009e2a8 	.word	0x2009e2a8
+ 800d4cc:	002000c5 	.word	0x002000c5
+
+0800d4d0 <SDMMC_CmdAppOperCommand>:
+{
+ 800d4d0:	b510      	push	{r4, lr}
+ 800d4d2:	b086      	sub	sp, #24
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d4d4:	2229      	movs	r2, #41	; 0x29
+ 800d4d6:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d4da:	e9cd 2302 	strd	r2, r3, [sp, #8]
+  sdmmc_cmdinit.Argument         = Argument;
+ 800d4de:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d4e0:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+ 800d4e4:	2100      	movs	r1, #0
+ 800d4e6:	e9cd 1304 	strd	r1, r3, [sp, #16]
+{
+ 800d4ea:	4604      	mov	r4, r0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d4ec:	a901      	add	r1, sp, #4
+ 800d4ee:	f7ff fc7f 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp3(SDMMCx);
+ 800d4f2:	4620      	mov	r0, r4
+ 800d4f4:	f7ff ffca 	bl	800d48c <SDMMC_GetCmdResp3>
+}
+ 800d4f8:	b006      	add	sp, #24
+ 800d4fa:	bd10      	pop	{r4, pc}
+
+0800d4fc <SDMMC_CmdOpCondition>:
+{
+ 800d4fc:	b510      	push	{r4, lr}
+ 800d4fe:	b086      	sub	sp, #24
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d500:	2201      	movs	r2, #1
+ 800d502:	f44f 7380 	mov.w	r3, #256	; 0x100
+ 800d506:	e9cd 2302 	strd	r2, r3, [sp, #8]
+  sdmmc_cmdinit.Argument         = Argument;
+ 800d50a:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d50c:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+ 800d510:	2100      	movs	r1, #0
+ 800d512:	e9cd 1304 	strd	r1, r3, [sp, #16]
+{
+ 800d516:	4604      	mov	r4, r0
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d518:	a901      	add	r1, sp, #4
+ 800d51a:	f7ff fc69 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp3(SDMMCx);
+ 800d51e:	4620      	mov	r0, r4
+ 800d520:	f7ff ffb4 	bl	800d48c <SDMMC_GetCmdResp3>
+}
+ 800d524:	b006      	add	sp, #24
+ 800d526:	bd10      	pop	{r4, pc}
+
+0800d528 <SDMMC_GetCmdResp6>:
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d528:	4b1f      	ldr	r3, [pc, #124]	; (800d5a8 <SDMMC_GetCmdResp6+0x80>)
+{
+ 800d52a:	b510      	push	{r4, lr}
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d52c:	681b      	ldr	r3, [r3, #0]
+{
+ 800d52e:	4604      	mov	r4, r0
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d530:	f44f 50fa 	mov.w	r0, #8000	; 0x1f40
+ 800d534:	fbb3 f3f0 	udiv	r3, r3, r0
+ 800d538:	f241 3088 	movw	r0, #5000	; 0x1388
+ 800d53c:	4343      	muls	r3, r0
+    if (count-- == 0U)
+ 800d53e:	3b01      	subs	r3, #1
+ 800d540:	d329      	bcc.n	800d596 <SDMMC_GetCmdResp6+0x6e>
+    sta_reg = SDMMCx->STA;
+ 800d542:	6b60      	ldr	r0, [r4, #52]	; 0x34
+         ((sta_reg & SDMMC_FLAG_CMDACT) != 0U ));
+ 800d544:	f010 0f45 	tst.w	r0, #69	; 0x45
+ 800d548:	d0f9      	beq.n	800d53e <SDMMC_GetCmdResp6+0x16>
+  }while(((sta_reg & (SDMMC_FLAG_CCRCFAIL | SDMMC_FLAG_CMDREND | SDMMC_FLAG_CTIMEOUT)) == 0U) ||
+ 800d54a:	0480      	lsls	r0, r0, #18
+ 800d54c:	d4f7      	bmi.n	800d53e <SDMMC_GetCmdResp6+0x16>
+  if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT))
+ 800d54e:	6b63      	ldr	r3, [r4, #52]	; 0x34
+ 800d550:	0758      	lsls	r0, r3, #29
+ 800d552:	d502      	bpl.n	800d55a <SDMMC_GetCmdResp6+0x32>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT);
+ 800d554:	2004      	movs	r0, #4
+ 800d556:	63a0      	str	r0, [r4, #56]	; 0x38
+}
+ 800d558:	bd10      	pop	{r4, pc}
+  else if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL))
+ 800d55a:	6b60      	ldr	r0, [r4, #52]	; 0x34
+ 800d55c:	f010 0001 	ands.w	r0, r0, #1
+ 800d560:	d002      	beq.n	800d568 <SDMMC_GetCmdResp6+0x40>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL);
+ 800d562:	2301      	movs	r3, #1
+ 800d564:	63a3      	str	r3, [r4, #56]	; 0x38
+    return SDMMC_ERROR_CMD_CRC_FAIL;
+ 800d566:	e7f7      	b.n	800d558 <SDMMC_GetCmdResp6+0x30>
+  return (uint8_t)(SDMMCx->RESPCMD);
+ 800d568:	6923      	ldr	r3, [r4, #16]
+  if(SDMMC_GetCommandResponse(SDMMCx) != SD_CMD)
+ 800d56a:	b2db      	uxtb	r3, r3
+ 800d56c:	4299      	cmp	r1, r3
+ 800d56e:	d115      	bne.n	800d59c <SDMMC_GetCmdResp6+0x74>
+  __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_STATIC_CMD_FLAGS);
+ 800d570:	4b0e      	ldr	r3, [pc, #56]	; (800d5ac <SDMMC_GetCmdResp6+0x84>)
+ 800d572:	63a3      	str	r3, [r4, #56]	; 0x38
+  return (*(__IO uint32_t *) tmp);
+ 800d574:	6963      	ldr	r3, [r4, #20]
+  if((response_r1 & (SDMMC_R6_GENERAL_UNKNOWN_ERROR | SDMMC_R6_ILLEGAL_CMD | SDMMC_R6_COM_CRC_FAILED)) == SDMMC_ALLZERO)
+ 800d576:	f413 4060 	ands.w	r0, r3, #57344	; 0xe000
+ 800d57a:	d102      	bne.n	800d582 <SDMMC_GetCmdResp6+0x5a>
+    *pRCA = (uint16_t) (response_r1 >> 16);
+ 800d57c:	0c1b      	lsrs	r3, r3, #16
+ 800d57e:	8013      	strh	r3, [r2, #0]
+    return SDMMC_ERROR_NONE;
+ 800d580:	e7ea      	b.n	800d558 <SDMMC_GetCmdResp6+0x30>
+  else if((response_r1 & SDMMC_R6_ILLEGAL_CMD) == SDMMC_R6_ILLEGAL_CMD)
+ 800d582:	045a      	lsls	r2, r3, #17
+ 800d584:	d40c      	bmi.n	800d5a0 <SDMMC_GetCmdResp6+0x78>
+    return SDMMC_ERROR_GENERAL_UNKNOWN_ERR;
+ 800d586:	f413 4f00 	tst.w	r3, #32768	; 0x8000
+ 800d58a:	bf14      	ite	ne
+ 800d58c:	f44f 5080 	movne.w	r0, #4096	; 0x1000
+ 800d590:	f44f 3080 	moveq.w	r0, #65536	; 0x10000
+ 800d594:	e7e0      	b.n	800d558 <SDMMC_GetCmdResp6+0x30>
+      return SDMMC_ERROR_TIMEOUT;
+ 800d596:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+ 800d59a:	e7dd      	b.n	800d558 <SDMMC_GetCmdResp6+0x30>
+    return SDMMC_ERROR_CMD_CRC_FAIL;
+ 800d59c:	2001      	movs	r0, #1
+ 800d59e:	e7db      	b.n	800d558 <SDMMC_GetCmdResp6+0x30>
+    return SDMMC_ERROR_ILLEGAL_CMD;
+ 800d5a0:	f44f 5000 	mov.w	r0, #8192	; 0x2000
+ 800d5a4:	e7d8      	b.n	800d558 <SDMMC_GetCmdResp6+0x30>
+ 800d5a6:	bf00      	nop
+ 800d5a8:	2009e2a8 	.word	0x2009e2a8
+ 800d5ac:	002000c5 	.word	0x002000c5
+
+0800d5b0 <SDMMC_CmdSetRelAdd>:
+{
+ 800d5b0:	b530      	push	{r4, r5, lr}
+ 800d5b2:	b089      	sub	sp, #36	; 0x24
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SET_REL_ADDR;
+ 800d5b4:	2300      	movs	r3, #0
+{
+ 800d5b6:	9101      	str	r1, [sp, #4]
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SET_REL_ADDR;
+ 800d5b8:	2503      	movs	r5, #3
+  sdmmc_cmdinit.Response         = SDMMC_RESPONSE_SHORT;
+ 800d5ba:	f44f 7180 	mov.w	r1, #256	; 0x100
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800d5be:	e9cd 1305 	strd	r1, r3, [sp, #20]
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_SET_REL_ADDR;
+ 800d5c2:	e9cd 3503 	strd	r3, r5, [sp, #12]
+{
+ 800d5c6:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d5c8:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d5cc:	a903      	add	r1, sp, #12
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d5ce:	9307      	str	r3, [sp, #28]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d5d0:	f7ff fc0e 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp6(SDMMCx, SDMMC_CMD_SET_REL_ADDR, pRCA);
+ 800d5d4:	9a01      	ldr	r2, [sp, #4]
+ 800d5d6:	4629      	mov	r1, r5
+ 800d5d8:	4620      	mov	r0, r4
+ 800d5da:	f7ff ffa5 	bl	800d528 <SDMMC_GetCmdResp6>
+}
+ 800d5de:	b009      	add	sp, #36	; 0x24
+ 800d5e0:	bd30      	pop	{r4, r5, pc}
+	...
+
+0800d5e4 <SDMMC_GetCmdResp7>:
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d5e4:	4b13      	ldr	r3, [pc, #76]	; (800d634 <SDMMC_GetCmdResp7+0x50>)
+ 800d5e6:	f44f 51fa 	mov.w	r1, #8000	; 0x1f40
+ 800d5ea:	681b      	ldr	r3, [r3, #0]
+ 800d5ec:	fbb3 f3f1 	udiv	r3, r3, r1
+ 800d5f0:	f241 3188 	movw	r1, #5000	; 0x1388
+{
+ 800d5f4:	4602      	mov	r2, r0
+  uint32_t count = SDMMC_CMDTIMEOUT * (SystemCoreClock / 8U /1000U);
+ 800d5f6:	434b      	muls	r3, r1
+    if (count-- == 0U)
+ 800d5f8:	3b01      	subs	r3, #1
+ 800d5fa:	d317      	bcc.n	800d62c <SDMMC_GetCmdResp7+0x48>
+    sta_reg = SDMMCx->STA;
+ 800d5fc:	6b51      	ldr	r1, [r2, #52]	; 0x34
+         ((sta_reg & SDMMC_FLAG_CMDACT) != 0U ));
+ 800d5fe:	f011 0f45 	tst.w	r1, #69	; 0x45
+ 800d602:	d0f9      	beq.n	800d5f8 <SDMMC_GetCmdResp7+0x14>
+  }while(((sta_reg & (SDMMC_FLAG_CCRCFAIL | SDMMC_FLAG_CMDREND | SDMMC_FLAG_CTIMEOUT)) == 0U) ||
+ 800d604:	0488      	lsls	r0, r1, #18
+ 800d606:	d4f7      	bmi.n	800d5f8 <SDMMC_GetCmdResp7+0x14>
+  if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT))
+ 800d608:	6b53      	ldr	r3, [r2, #52]	; 0x34
+ 800d60a:	0759      	lsls	r1, r3, #29
+ 800d60c:	d502      	bpl.n	800d614 <SDMMC_GetCmdResp7+0x30>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CTIMEOUT);
+ 800d60e:	2004      	movs	r0, #4
+ 800d610:	6390      	str	r0, [r2, #56]	; 0x38
+    return SDMMC_ERROR_CMD_RSP_TIMEOUT;
+ 800d612:	4770      	bx	lr
+  else if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL))
+ 800d614:	6b50      	ldr	r0, [r2, #52]	; 0x34
+ 800d616:	f010 0001 	ands.w	r0, r0, #1
+ 800d61a:	d002      	beq.n	800d622 <SDMMC_GetCmdResp7+0x3e>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CCRCFAIL);
+ 800d61c:	2301      	movs	r3, #1
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CMDREND);
+ 800d61e:	6393      	str	r3, [r2, #56]	; 0x38
+ 800d620:	4770      	bx	lr
+  if(__SDMMC_GET_FLAG(SDMMCx, SDMMC_FLAG_CMDREND))
+ 800d622:	6b53      	ldr	r3, [r2, #52]	; 0x34
+ 800d624:	065b      	lsls	r3, r3, #25
+ 800d626:	d503      	bpl.n	800d630 <SDMMC_GetCmdResp7+0x4c>
+    __SDMMC_CLEAR_FLAG(SDMMCx, SDMMC_FLAG_CMDREND);
+ 800d628:	2340      	movs	r3, #64	; 0x40
+ 800d62a:	e7f8      	b.n	800d61e <SDMMC_GetCmdResp7+0x3a>
+      return SDMMC_ERROR_TIMEOUT;
+ 800d62c:	f04f 4000 	mov.w	r0, #2147483648	; 0x80000000
+}
+ 800d630:	4770      	bx	lr
+ 800d632:	bf00      	nop
+ 800d634:	2009e2a8 	.word	0x2009e2a8
+
+0800d638 <SDMMC_CmdOperCond>:
+{
+ 800d638:	b510      	push	{r4, lr}
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_HS_SEND_EXT_CSD;
+ 800d63a:	f44f 72d5 	mov.w	r2, #426	; 0x1aa
+{
+ 800d63e:	b086      	sub	sp, #24
+  sdmmc_cmdinit.CmdIndex         = SDMMC_CMD_HS_SEND_EXT_CSD;
+ 800d640:	2308      	movs	r3, #8
+ 800d642:	e9cd 2301 	strd	r2, r3, [sp, #4]
+  sdmmc_cmdinit.WaitForInterrupt = SDMMC_WAIT_NO;
+ 800d646:	f44f 7180 	mov.w	r1, #256	; 0x100
+ 800d64a:	2300      	movs	r3, #0
+ 800d64c:	e9cd 1303 	strd	r1, r3, [sp, #12]
+{
+ 800d650:	4604      	mov	r4, r0
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d652:	f44f 5380 	mov.w	r3, #4096	; 0x1000
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d656:	a901      	add	r1, sp, #4
+  sdmmc_cmdinit.CPSM             = SDMMC_CPSM_ENABLE;
+ 800d658:	9305      	str	r3, [sp, #20]
+  (void)SDMMC_SendCommand(SDMMCx, &sdmmc_cmdinit);
+ 800d65a:	f7ff fbc9 	bl	800cdf0 <SDMMC_SendCommand>
+  errorstate = SDMMC_GetCmdResp7(SDMMCx);
+ 800d65e:	4620      	mov	r0, r4
+ 800d660:	f7ff ffc0 	bl	800d5e4 <SDMMC_GetCmdResp7>
+}
+ 800d664:	b006      	add	sp, #24
+ 800d666:	bd10      	pop	{r4, pc}
+
+0800d668 <memcmp>:
+ 800d668:	b510      	push	{r4, lr}
+ 800d66a:	3901      	subs	r1, #1
+ 800d66c:	4402      	add	r2, r0
+ 800d66e:	4290      	cmp	r0, r2
+ 800d670:	d101      	bne.n	800d676 <memcmp+0xe>
+ 800d672:	2000      	movs	r0, #0
+ 800d674:	e005      	b.n	800d682 <memcmp+0x1a>
+ 800d676:	7803      	ldrb	r3, [r0, #0]
+ 800d678:	f811 4f01 	ldrb.w	r4, [r1, #1]!
+ 800d67c:	42a3      	cmp	r3, r4
+ 800d67e:	d001      	beq.n	800d684 <memcmp+0x1c>
+ 800d680:	1b18      	subs	r0, r3, r4
+ 800d682:	bd10      	pop	{r4, pc}
+ 800d684:	3001      	adds	r0, #1
+ 800d686:	e7f2      	b.n	800d66e <memcmp+0x6>
+
+0800d688 <memcpy>:
+ 800d688:	440a      	add	r2, r1
+ 800d68a:	4291      	cmp	r1, r2
+ 800d68c:	f100 33ff 	add.w	r3, r0, #4294967295	; 0xffffffff
+ 800d690:	d100      	bne.n	800d694 <memcpy+0xc>
+ 800d692:	4770      	bx	lr
+ 800d694:	b510      	push	{r4, lr}
+ 800d696:	f811 4b01 	ldrb.w	r4, [r1], #1
+ 800d69a:	f803 4f01 	strb.w	r4, [r3, #1]!
+ 800d69e:	4291      	cmp	r1, r2
+ 800d6a0:	d1f9      	bne.n	800d696 <memcpy+0xe>
+ 800d6a2:	bd10      	pop	{r4, pc}
+
+0800d6a4 <memmove>:
+ 800d6a4:	4288      	cmp	r0, r1
+ 800d6a6:	b510      	push	{r4, lr}
+ 800d6a8:	eb01 0402 	add.w	r4, r1, r2
+ 800d6ac:	d902      	bls.n	800d6b4 <memmove+0x10>
+ 800d6ae:	4284      	cmp	r4, r0
+ 800d6b0:	4623      	mov	r3, r4
+ 800d6b2:	d807      	bhi.n	800d6c4 <memmove+0x20>
+ 800d6b4:	1e43      	subs	r3, r0, #1
+ 800d6b6:	42a1      	cmp	r1, r4
+ 800d6b8:	d008      	beq.n	800d6cc <memmove+0x28>
+ 800d6ba:	f811 2b01 	ldrb.w	r2, [r1], #1
+ 800d6be:	f803 2f01 	strb.w	r2, [r3, #1]!
+ 800d6c2:	e7f8      	b.n	800d6b6 <memmove+0x12>
+ 800d6c4:	4402      	add	r2, r0
+ 800d6c6:	4601      	mov	r1, r0
+ 800d6c8:	428a      	cmp	r2, r1
+ 800d6ca:	d100      	bne.n	800d6ce <memmove+0x2a>
+ 800d6cc:	bd10      	pop	{r4, pc}
+ 800d6ce:	f813 4d01 	ldrb.w	r4, [r3, #-1]!
+ 800d6d2:	f802 4d01 	strb.w	r4, [r2, #-1]!
+ 800d6d6:	e7f7      	b.n	800d6c8 <memmove+0x24>
+
+0800d6d8 <memset>:
+ 800d6d8:	4402      	add	r2, r0
+ 800d6da:	4603      	mov	r3, r0
+ 800d6dc:	4293      	cmp	r3, r2
+ 800d6de:	d100      	bne.n	800d6e2 <memset+0xa>
+ 800d6e0:	4770      	bx	lr
+ 800d6e2:	f803 1b01 	strb.w	r1, [r3], #1
+ 800d6e6:	e7f9      	b.n	800d6dc <memset+0x4>
+
+0800d6e8 <setjmp>:
+ 800d6e8:	46ec      	mov	ip, sp
+ 800d6ea:	e8a0 5ff0 	stmia.w	r0!, {r4, r5, r6, r7, r8, r9, sl, fp, ip, lr}
+ 800d6ee:	f04f 0000 	mov.w	r0, #0
+ 800d6f2:	4770      	bx	lr
+
+0800d6f4 <longjmp>:
+ 800d6f4:	e8b0 5ff0 	ldmia.w	r0!, {r4, r5, r6, r7, r8, r9, sl, fp, ip, lr}
+ 800d6f8:	46e5      	mov	sp, ip
+ 800d6fa:	0008      	movs	r0, r1
+ 800d6fc:	bf08      	it	eq
+ 800d6fe:	2001      	moveq	r0, #1
+ 800d700:	4770      	bx	lr
+ 800d702:	bf00      	nop
+
+0800d704 <strcpy>:
+ 800d704:	4603      	mov	r3, r0
+ 800d706:	f811 2b01 	ldrb.w	r2, [r1], #1
+ 800d70a:	f803 2b01 	strb.w	r2, [r3], #1
+ 800d70e:	2a00      	cmp	r2, #0
+ 800d710:	d1f9      	bne.n	800d706 <strcpy+0x2>
+ 800d712:	4770      	bx	lr
+
+0800d714 <strlcpy>:
+ 800d714:	b510      	push	{r4, lr}
+ 800d716:	460b      	mov	r3, r1
+ 800d718:	b162      	cbz	r2, 800d734 <strlcpy+0x20>
+ 800d71a:	3a01      	subs	r2, #1
+ 800d71c:	d008      	beq.n	800d730 <strlcpy+0x1c>
+ 800d71e:	f813 4b01 	ldrb.w	r4, [r3], #1
+ 800d722:	f800 4b01 	strb.w	r4, [r0], #1
+ 800d726:	2c00      	cmp	r4, #0
+ 800d728:	d1f7      	bne.n	800d71a <strlcpy+0x6>
+ 800d72a:	1a58      	subs	r0, r3, r1
+ 800d72c:	3801      	subs	r0, #1
+ 800d72e:	bd10      	pop	{r4, pc}
+ 800d730:	2200      	movs	r2, #0
+ 800d732:	7002      	strb	r2, [r0, #0]
+ 800d734:	f813 2b01 	ldrb.w	r2, [r3], #1
+ 800d738:	2a00      	cmp	r2, #0
+ 800d73a:	d1fb      	bne.n	800d734 <strlcpy+0x20>
+ 800d73c:	e7f5      	b.n	800d72a <strlcpy+0x16>
+
+0800d73e <strlen>:
+ 800d73e:	4603      	mov	r3, r0
+ 800d740:	f813 2b01 	ldrb.w	r2, [r3], #1
+ 800d744:	2a00      	cmp	r2, #0
+ 800d746:	d1fb      	bne.n	800d740 <strlen+0x2>
+ 800d748:	1a18      	subs	r0, r3, r0
+ 800d74a:	3801      	subs	r0, #1
+ 800d74c:	4770      	bx	lr
+	...
+
+0800d750 <__flash_burn_veneer>:
+ 800d750:	f85f f000 	ldr.w	pc, [pc]	; 800d754 <__flash_burn_veneer+0x4>
+ 800d754:	2009e001 	.word	0x2009e001
+
+0800d758 <__flash_page_erase_veneer>:
+ 800d758:	f85f f000 	ldr.w	pc, [pc]	; 800d75c <__flash_page_erase_veneer+0x4>
+ 800d75c:	2009e08d 	.word	0x2009e08d
+ 800d760:	6f636e69 	.word	0x6f636e69
+ 800d764:	006e      	.short	0x006e
+ 800d766:	6944      	.short	0x6944
+ 800d768:	44203a65 	.word	0x44203a65
+ 800d76c:	44005546 	.word	0x44005546
+ 800d770:	203a6569 	.word	0x203a6569
+ 800d774:	6e776f44 	.word	0x6e776f44
+ 800d778:	64617267 	.word	0x64617267
+ 800d77c:	69440065 	.word	0x69440065
+ 800d780:	42203a65 	.word	0x42203a65
+ 800d784:	6b6e616c 	.word	0x6b6e616c
+ 800d788:	00687369 	.word	0x00687369
+ 800d78c:	3a656944 	.word	0x3a656944
+ 800d790:	69724220 	.word	0x69724220
+ 800d794:	42006b63 	.word	0x42006b63
+ 800d798:	32746f6f 	.word	0x32746f6f
+ 800d79c:	00554644 	.word	0x00554644
+ 800d7a0:	43455441 	.word	0x43455441
+ 800d7a4:	38303643 	.word	0x38303643
+ 800d7a8:	53440a42 	.word	0x53440a42
+ 800d7ac:	33433832 	.word	0x33433832
+ 800d7b0:	4c004236 	.word	0x4c004236
+ 800d7b4:	0052      	.short	0x0052
+ 800d7b6:	6e65      	.short	0x6e65
+ 800d7b8:	5f726574 	.word	0x5f726574
+ 800d7bc:	28756664 	.word	0x28756664
+ 800d7c0:	0029      	.short	0x0029
+ 800d7c2:	0a0d      	.short	0x0a0d
+ 800d7c4:	346b4d0a 	.word	0x346b4d0a
+ 800d7c8:	6f6f4220 	.word	0x6f6f4220
+ 800d7cc:	616f6c74 	.word	0x616f6c74
+ 800d7d0:	3a726564 	.word	0x3a726564
+ 800d7d4:	463e0020 	.word	0x463e0020
+ 800d7d8:	57455249 	.word	0x57455249
+ 800d7dc:	454c4c41 	.word	0x454c4c41
+ 800d7e0:	70003c44 	.word	0x70003c44
+ 800d7e4:	2d726961 	.word	0x2d726961
+ 800d7e8:	63697262 	.word	0x63697262
+ 800d7ec:	0064656b 	.word	0x0064656b
+ 800d7f0:	69726556 	.word	0x69726556
+ 800d7f4:	203a7966 	.word	0x203a7966
+ 800d7f8:	00000000 	.word	0x00000000
+ 800d7fc:	00000150 	.word	0x00000150
+ 800d800:	00000001 	.word	0x00000001
+ 800d804:	00000000 	.word	0x00000000
+ 800d808:	00000001 	.word	0x00000001
+ 800d80c:	00000000 	.word	0x00000000
+
+0800d810 <animate_mk4.0>:
+ 800d810:	0700262e ff000707                        .&....../
+
+0800d819 <animate_mk5.1>:
+ 800d819:	0701292e 00010705 0000a37f               .)........../
+
+0800d826 <before_show>:
+ 800d826:	227f0021                                 !.."..
+
+0800d82c <reset_commands_mk4>:
+ 800d82c:	400020ae c83fa8a1 12da00d3 f1d980d5     . .@..?.........
+ 800d83c:	ff8130db 148da6a4                        .0.......
+
+0800d845 <reset_commands_mk5>:
+ 800d845:	a880d5ae 4000d33f c0a08aad 658112da     ....?..@.......e
+ 800d855:	40db22d9 a40020a6                        .".@. ...
+
+0800d85e <setup.2>:
+ 800d85e:	227f0021                                 !.."..
+
+0800d864 <screen_blankish>:
+ 800d864:	007f007f 0034007f 000d8081 000d8081     ......4.........
+ 800d874:	00628081 01030183 0183000b 000b0103     ..b.............
+ 800d884:	01030183 007f007f 0034007f               ..........4..
+
+0800d891 <screen_brick>:
+ 800d891:	007f007f 002b007f 8803f881 0000f085     ......+.........
+ 800d8a1:	400380c0 00008086 03d84040 04808100     ...@....@@......
+ 800d8b1:	00808a40 800000f8 80000040 80834004     @.......@....@..
+ 800d8c1:	40038000 50f88082 041f8100 000f8310     ...@...P........
+ 800d8d1:	8100091f 8100031f 8a10040f 021f0008     ................
+ 800d8e1:	10080403 12040f00 0f001383 08821003     ................
+ 800d8f1:	7f007f1f 2b007f00                        .......+..
+
+0800d8fb <screen_corrupt>:
+ 800d8fb:	0037007f 40c08086 03303060 05188190     ..7....@`00.....
+ 800d90b:	08188510 68e0f018 f8808b00 38e1071c     .......h.......8
+ 800d91b:	0103060c 82000b01 006820ff 0e7fc182     ......... h.....
+ 800d92b:	80808700 0e3860c0 85006907 04060301     .....`8..i......
+ 800d93b:	82020406 02030606 01030383 f881005e     ............^...
+ 800d94b:	08868804 40400000 820003d8 400380c0     ......@@.......@
+ 800d95b:	c000808a 40804040 04c00080 00c08300     ....@@.@........
+ 800d96b:	84400400 80c00080 80834003 40048000     ..@......@.....@
+ 800d97b:	08008087 30488808 1f810043 1f810009     ......H0C.......
+ 800d98b:	1f810003 1f8f0006 00070000 100f001f     ................
+ 800d99b:	0f100f08 11030e00 001f0984 8100061f     ................
+ 800d9ab:	8412040f 1b000013 0026007f               ..........&..
+
+0800d9b8 <screen_devmode>:
+ 800d9b8:	002c007f 00888003 98f09000 1640d0a0     ..,...........@.
+ 800d9c8:	80808400 180330e0 18031081 80e03084     .....0.......0..
+ 800d9d8:	89004380 0c18f0c0 191373e6 89010519     .C.......s......
+ 800d9e8:	07030100 000039ef 92001501 f9ede702     .....9..........
+ 800d9f8:	783818c8 78381838 f9c81838 0042e7ed     ..8x8.8x8.....B.
+ 800da08:	e03d0f85 000a0180 70c08085 0017023f     ..=........p?...
+ 800da18:	07fcf883 7e870304 640464fc 03047efc     .......~.d.d.~..
+ 800da28:	f0fc0783 01840043 06020301 03028306     ....C...........
+ 800da38:	82001b01 06060703 06030781 06060781     ................
+ 800da48:	2e030782 03f88100 e0108408 40040000     ...............@
+ 800da58:	c0008084 83400380 03800080 c0808440     ......@.....@...
+ 800da68:	40048000 c0008084 81400380 81000380     ...@......@.....
+ 800da78:	81000bf8 830804f0 04c00030 00c08300     ........0.......
+ 800da88:	84400480 f0400080 00834003 40048000     ..@...@..@.....@
+ 800da98:	c0008088 40804040 81000380 81001bf8     ....@@.@........
+ 800daa8:	8410031f 0e000708 09841103 041f001f     ................
+ 800dab8:	001f8300 84880347 0f007f84 13831204     ....G...........
+ 800dac8:	00081f00 000b1b81 10040f81 0f000c83     ................
+ 800dad8:	08841003 0409001f 000c8412 10030f00     ................
+ 800dae8:	0f000883 0f881004 00001f00 031f0007     ................
+ 800daf8:	7f1b8100 00001000                       ........
+
+0800db00 <screen_downgrade>:
+ 800db00:	0035007f 00f0f095 6060c080 10103030     ..5.......``00..
+ 800db10:	10101818 60603030 006b80c0 0c040f04     ....00``..k.....
+ 800db20:	ff820003 840007ff e0fc0f03 c083006c     ............l...
+ 800db30:	00058080 0603018c 80800006 0f3c70c0     .............p<.
+ 800db40:	8e006d01 03030101 06060202 03030202     .m..............
+ 800db50:	00570101 0803f881 00e01084 83400480     ..W...........@.
+ 800db60:	04c00080 00c08400 400380c0 80008083     ...........@....
+ 800db70:	80854003 80c000c0 80834003 40040000     .@.......@.....@
+ 800db80:	80008083 80844003 048000f8 00808740     .....@......@...
+ 800db90:	48880808 81003c30 8410031f 0f000708     ...H0<..........
+ 800dba0:	0f8a1004 08100f00 000f100f 8300041f     ................
+ 800dbb0:	0347001f 7f848488 00061f00 11030e81     ..G.............
+ 800dbc0:	001f0984 8410030f 0f001f08 13841204     ................
+ 800dbd0:	7f1b0000 00002200                       ....."..
+
+0800dbd8 <screen_fatal>:
+ 800dbd8:	007f007f 0036007f 90fc9089 0090fc90     ......6.........
+ 800dbe8:	4203fc40 f000048b 00c00000 fc4000f0     @..B..........@.
+ 800dbf8:	04814203 03840066 03030000 05078100     .B..f...........
+ 800dc08:	04038900 03040302 7f070000 7f007f00     ................
+ 800dc18:	00003900                                .9..
+
+0800dc1c <screen_logout>:
+ 800dc1c:	0035007f c0078081 00064081 6f808082     ..5......@.....o
+ 800dc2c:	ffff8200 c0070006 c7c3c189 f0f8dcce     ................
+ 800dc3c:	0068c0e0 06ff7f82 068081c0 70608800     ..h...........`p
+ 800dc4c:	070e1c38 007f0103 f8810050 80810006     8.......P.......
+ 800dc5c:	80834004 40038000 00c08084 83400480     .@.....@......@.
+ 800dc6c:	04c00080 00c08400 4003f040 f8810009     ........@..@....
+ 800dc7c:	10840803 048000e0 00808440 400380c0     ........@......@
+ 800dc8c:	80008083 80814004 1f810034 00821005     .....@..4.......
+ 800dc9c:	8310040f 0347000f 7f848488 10040f00     ......G.........
+ 800dcac:	0f000f83 08851003 0f00001f 08811003     ................
+ 800dcbc:	1f810008 08841003 040f0007 000f8310     ................
+ 800dccc:	8300041f 040f001f 7f138112 00001b00     ................
+
+0800dcdc <screen_mitm>:
+ 800dcdc:	007f007f 0043007f 0c30c083 01060073     ......C...0.s...
+ 800dcec:	0c300084 06000403 7f007f01 39007f00     ..0............9
+	...
+
+0800dcfe <screen_recovery>:
+ 800dcfe:	0031007f c0e06084 85001080 f030e0e0     ..1..`........0.
+ 800dd0e:	863008f0 6020f0f0 004f80c0 c189c00c     ..0... `..O.....
+ 800dd1e:	dccec7c3 c0e0f0f8 ff8f0009 0f0f00ff     ................
+ 800dd2e:	cc8c0c0c cccc4ccc 00030f8f feff0183     .....L..........
+ 800dd3e:	808a0057 3870e0c0 03070e1c 82000a01     W.....p8........
+ 800dd4e:	0004ffff 301f0689 30302030 0004061f     .......00 00....
+ 800dd5e:	57ffff82 01018200 01820012 82031101     ...W............
+ 800dd6e:	00410101 f8080889 00000808 400380c0     ..A............@
+ 800dd7e:	80008083 80834004 40048000 c0008084     .....@.....@....
+ 800dd8e:	84400380 f0400080 00094003 0804f081     ..@...@..@......
+ 800dd9e:	00003083 80844004 0380c000 00808340     .0...@......@...
+ 800ddae:	82400380 0034f880 1f101088 00001010     ..@...4.........
+ 800ddbe:	8300041f 0409001f 000c8312 8312040f     ................
+ 800ddce:	071f0013 030f8100 08088110 040f8100     ................
+ 800ddde:	000c8310 8411030e 1f001f09 0f810006     ................
+ 800ddee:	08821003 1b007f1f                        ..........
+
+0800ddf8 <screen_red_light>:
+ 800ddf8:	002c007f 00888003 98f09000 1640d0a0     ..,...........@.
+ 800de08:	80808400 180330e0 18031081 80e03084     .....0.......0..
+ 800de18:	89004380 0c18f0c0 191373e6 89010519     .C.......s......
+ 800de28:	07030100 000039ef 92001501 f9ede702     .....9..........
+ 800de38:	783818c8 78381838 f9c81838 0042e7ed     ..8x8.8x8.....B.
+ 800de48:	e03d0f85 000a0180 70c08085 0017023f     ..=........p?...
+ 800de58:	07fcf883 7e870304 640464fc 03047efc     .......~.d.d.~..
+ 800de68:	f0fc0783 01840043 06020301 03028306     ....C...........
+ 800de78:	82001b01 06060703 06030781 06060781     ................
+ 800de88:	2b030782 03f88100 e0108408 40040000     ...+...........@
+ 800de98:	c0008084 83400380 03800080 c0808440     ......@.....@...
+ 800dea8:	40048000 c0008084 81400380 81000380     ...@......@.....
+ 800deb8:	81000bf8 830804f0 04000030 00808340     ........0...@...
+ 800dec8:	840004c0 f04000c0 00034003 d8404083     ......@..@...@@.
+ 800ded8:	80810003 80844004 0380c000 03808140     .....@......@...
+ 800dee8:	14f88100 031f8100 07088410 11030e00     ................
+ 800def8:	001f0984 8300041f 0347001f 7f848488     ..........G.....
+ 800df08:	12040f00 1f001383 1b810008 0f81000b     ................
+ 800df18:	0c831004 11030e00 001f0984 8510030f     ................
+ 800df28:	00001f08 8110030f 81000408 8100031f     ................
+ 800df38:	8310040f 041f000f 031f8100 7f1b8100     ................
+ 800df48:	00000c00                                ....
+
+0800df4c <screen_replug>:
+ 800df4c:	007f007f 002f007f 0804f881 8000f083     ....../.........
+ 800df5c:	80844004 0380c000 00808440 0005f800     .@......@.......
+ 800df6c:	0004c081 8000c083 80824003 880057c0     .........@...W..
+ 800df7c:	0503011f 0f001009 13841204 03047f00     ................
+ 800df8c:	00078408 10030f00 0f000083 08841003     ................
+ 800df9c:	0347001f 7f848288 007f007f 002e007f     ..G.............
+	...
+
+0800dfad <screen_se1_issue>:
+ 800dfad:	0035007f 04808082 60c08300 83180530     ..5........`0...
+ 800dfbd:	04c07030 6b808100 ff018600 070606fe     0p.....k........
+ 800dfcd:	e6810604 07860604 fffe0607 03006901     .............i..
+ 800dfdd:	bf078401 000580e0 0005ff81 bfe08084     ................
+ 800dfed:	69010307 07068300 89010303 06060203     ...i............
+ 800dffd:	02020607 83010303 62060703 04f88100     ...........b....
+ 800e00d:	00f88900 0830c000 060000f8 70008980     ......0........p
+ 800e01d:	08088888 04f80010 00088688 f8102040     ............@ ..
+ 800e02d:	0f810059 0f831004 02030300 00021f83     Y...............
+ 800e03d:	00890406 11101008 1f000e11 00041005     ................
+ 800e04d:	007f1f81                                 .......
+
+0800e054 <screen_se2_issue>:
+ 800e054:	0035007f 04808082 60c08300 83180530     ..5........`0...
+ 800e064:	04c07030 6b808100 ff018600 070606fe     0p.....k........
+ 800e074:	e6810604 07860604 fffe0607 03006901     .............i..
+ 800e084:	bf078401 000580e0 0005ff81 bfe08084     ................
+ 800e094:	69010307 07068300 89010303 06060203     ...i............
+ 800e0a4:	02020607 83010303 62060703 04f88100     ...........b....
+ 800e0b4:	00f88300 824804f8 80060088 88700089     ......H.......p.
+ 800e0c4:	10080888 8804f800 30000883 88820803     ...........0....
+ 800e0d4:	81005770 8310040f 0408000f 000f8210     pW..............
+ 800e0e4:	00890406 11101008 1f000e11 00871005     ................
+ 800e0f4:	11121418 007f1010                        ........,..
+
+0800e0ff <screen_search>:
+ 800e0ff:	0028007f 2060c085 18061030 60301085     ..(...` 0.....0`
+ 800e10f:	000f80c0 30e0e085 3008f0f0 20f0f086     .......0...0... 
+ 800e11f:	4c80c060 fffc8300 82000e01 000eff03     `..L............
+ 800e12f:	00ffff8f 0c0c0f0f 4ccccc8c 0f8fcccc     ...........L....
+ 800e13f:	01830003 004bfeff 0c060389 20303018     ......K......00 
+ 800e14f:	20036020 18103089 e0713f1e 000b80c0      `. .0...?q.....
+ 800e15f:	04ffff82 1f068900 30203030 04061f30     ........00 00...
+ 800e16f:	ffff8200 0184005e 09060703 01018200     ....^...........
+ 800e17f:	01820311 88003c01 08888870 80001008     .....<..p.......
+ 800e18f:	80834004 40040000 c0008084 83400380     .@.....@......@.
+ 800e19f:	04800080 00808440 400380f8 00008086     ....@......@....
+ 800e1af:	03d84040 80c08200 80834003 40038000     @@.......@.....@
+ 800e1bf:	42c08082 10088800 0e111110 12040f00     ...B............
+ 800e1cf:	0e001383 09841103 061f001f 040f8100     ................
+ 800e1df:	00088310 8100041f 8100041f 8100031f     ................
+ 800e1ef:	8300041f 0347001f 7f848788 38100000     ......G........8
+ 800e1ff:	83000410 04103810 38108300 19007f10     .....8.....8....
+	...
+
+0800e211 <screen_upgrading>:
+ 800e211:	0035007f 0e80c082 6a800600 ffff8200     ..5........j....
+ 800e221:	80900005 603060c0 63c080c0 30181c37     .....`0`...c7..0
+ 800e231:	691e3f20 ffff8800 ceccc0c0 c005c1c7      ?.i............
+ 800e241:	c009c181 007f8081 f8810056 f8840004     ........V.......
+ 800e251:	0380c000 00808340 85400380 c000c080     ....@.....@.....
+ 800e261:	83400380 04000080 00808340 87400380     ..@.....@.....@.
+ 800e271:	0000f880 03d84040 80c08200 80834003     ....@@.......@..
+ 800e281:	40038000 42c08082 040f8100 000f8410     ...@...B........
+ 800e291:	0803047f 47000783 84848803 061f007f     .......G........
+ 800e2a1:	030e8100 1f098411 10030f00 041f0882     ................
+ 800e2b1:	031f8100 041f8100 001f8300 82880347     ............G...
+ 800e2c1:	007f7f84                                 ...."..
+
+0800e2c8 <screen_verify>:
+ 800e2c8:	0038007f 60c08085 10033020 1018188a     ..8....` 0......
+ 800e2d8:	60303010 6b80c060 fce08400 00070107     .00``..k........
+ 800e2e8:	07ffff82 0f038400 0068e0fc 380f0187     ..........h....8
+ 800e2f8:	8080c060 018c0005 00060703 70c08080     `..............p
+ 800e308:	6d010f3c 01018e00 02020303 02020606     <..m............
+ 800e318:	01010303 f881005a f8830004 40048000     ....Z..........@
+ 800e328:	c0008084 86400380 40000080 0004d840     ......@....@@...
+ 800e338:	0803f081 c0001083 c0860004 40400000     ..............@@
+ 800e348:	820003d8 400380c0 80008083 80824003     .......@.....@..
+ 800e358:	880042c0 18180601 0f000106 13831204     .B..............
+ 800e368:	00091f00 00031f81 031f0182 00008301     ................
+ 800e378:	82880347 00047f84 00031f81 00041f81     G...............
+ 800e388:	47001f83 84828803 22007f7f               ...G......."..
+
+0800e396 <screen_wiped>:
+ 800e396:	0038007f 60c08084 82000420 0004f8f8     ..8....` .......
+ 800e3a6:	c0606084 84006b80 0307fce0 ff820007     .``..k..........
+ 800e3b6:	840007ff e0fc0f03 01870068 c060380f     ........h....8`.
+ 800e3c6:	000a8080 c0808087 010f3c70 018e006d     ........p<..m...
+ 800e3d6:	02030301 02060602 01030302 88005701     .............W..
+ 800e3e6:	08888870 80001008 80834004 40048000     p........@.....@
+ 800e3f6:	80008083 80824003 810008f8 860004f8     .....@..........
+ 800e406:	400000f8 0003d840 0380c082 00808340     ...@@.......@...
+ 800e416:	83400480 03800080 f8808240 0888003b     ..@.....@...;...
+ 800e426:	11111010 040f000e 00138312 8312040f     ................
+ 800e436:	030f0013 1f088210 07860008 18070718     ................
+ 800e446:	81000407 8200031f 0803047f 0f000783     ................
+ 800e456:	13831204 10030f00 7f1f0882 00001e00     ................
+ 800e466:	65737361 64007472 676e776f 65646172     assert.downgrade
+ 800e476:	67697300 69616620 6f6e006c 72696620     .sig fail.no fir
+ 800e486:	7261776d 61460065 726f7463 6f622079     mware.Factory bo
+ 800e496:	5700746f 3a4e5241 64655220 67696c20     ot.WARN: Red lig
+ 800e4a6:	57007468 3a4e5241 736e5520 656e6769     ht.WARN: Unsigne
+ 800e4b6:	69662064 61776d72 47006572 20646f6f     d firmware.Good 
+ 800e4c6:	6d726966 65726177 726f6300 74707572     firmware.corrupt
+ 800e4d6:	72696620 7261776d                         firmware.
+
+0800e4e0 <approved_pubkeys>:
+ 800e4e0:	2641cbb4 f36ce1f7 71b4f28f 0123fb1d     ..A&..l....q..#.
+ 800e4f0:	66d6760d 6ca38aa7 f6f9539b 0518587b     .v.f...l.S..{X..
+ 800e500:	e93b0b58 b89fc431 113c0444 470f0896     X.;.1...D.<....G
+ 800e510:	37ed2581 4a9e237a 3818b7af da0438ba     .%.7z#.J...8.8..
+ 800e520:	1dc8a2d6 df5e811c 6d290ca6 8d8f57b8     ......^...)m.W..
+ 800e530:	9269295e c178d1ce 31d7207b b596a17b     ^)i...x.{ .1{...
+ 800e540:	0c1bef3d c31a79aa c8c45845 ffeb2d8a     =....y..EX...-..
+ 800e550:	01829bfe bc5e5f87 4fe5a596 9ffe68c7     ....._^....O.h..
+ 800e560:	0166ef42 95cfc456 38f0b5f4 c5261164     B.f.V......8d.&.
+ 800e570:	66c13999 14120632 689c254c bad38c35     .9.f2...L%.h5...
+ 800e580:	8cde7824 6cdfab52 7809bfb8 3a63bb03     $x..R..l...x..c:
+ 800e590:	0ed90111 8f737aa4 7f3b18bf c87b0af0     .....zs...;...{.
+ 800e5a0:	56546067 c5ec0c82 0882bc1d ef39c116     g`TV..........9.
+ 800e5b0:	32babff5 e35fce7c d7621e74 4cc5fce9     ...2|._.t.b....L
+ 800e5c0:	8d11e88a 13c2adc3 2a4f2992 a4f8d2ea     .........)O*....
+ 800e5d0:	fe7cd5c4 3b450512 07598954 88d7d6da     ..|...E;T.Y.....
+ 800e5e0:	37cfb143 1f897cd2 f3acfe5b 95fc33ba     C..7.|..[....3..
+ 800e5f0:	dde7d981 14ef9525 bb97efdd a7d8f333     ....%.......3...
+ 800e600:	977a2b34 73aab3ba 32419de7 17a1fcd8     4+z....s..A2....
+ 800e610:	fe0bb566 89214063 8e7b92c9 590bdf72     f...c@!...{.r..Y
+ 800e620:	76dc5cd0 30dd3016 56f180c2 61a85c26     .\.v.0.0...V&\.a
+ 800e630:	69694fd7 3d57b8e5 582ae235 c69acedd     .Oii..W=5.*X....
+ 800e640:	2b1ca945 8efc010c 13513fbf 137c7e80     E..+.....?Q..~|.
+ 800e650:	5e4b4fd5 d59b4c9b e0d81d9e 2246c0ad     .OK^.L........F"
+ 800e660:	20314553 666e6f63 66206769 006c6961     SE1 config fail.
+ 800e670:	6c706572 72206775 69757165 00646572     replug required.
+ 800e680:	72726f63 20747075 72696170 63657320     corrupt pair sec
+ 800e690:	75636d00 6c756620 7562006c 66206e72     .mcu full.burn f
+ 800e6a0:	3a6c6961 76210020 64696c61 6162003f     ail: .!valid?.ba
+ 800e6b0:	61762064 66003f6c 20747361 63697262     d val?.fast bric
+ 800e6c0:	2e2e2e6b 64200020 00656e6f 79706f43     k... . done.Copy
+ 800e6d0:	68676972 30322074 202d3831 43207962     right 2018- by C
+ 800e6e0:	6b6e696f 20657469 2e636e49 206f6e00     oinkite Inc..no 
+ 800e6f0:	00726573 66206b77 0016006c 01410800     ser.wk fl.....A.
+	...
+ 800e70c:	000000ee 006100e1 218f0000 438f808f     ......a....!...C
+ 800e71c:	430080af 20834300 43c343c3 43c343c3     ...C.C. .C.C.C.C
+ 800e72c:	43c343c3 0000438f ffffffff 00000000     .C.C.C..........
+ 800e73c:	ffffffff 00000000 00000000 000000f0     ................
+	...
+ 800e754:	00001502 003c0000 01bc005c 01bc01fc     ......<.\.......
+ 800e764:	01dc01dc 03dc03d1 03dc03dc 03dc03dc     ................
+ 800e774:	01dc03dc 0000003c 00000001 00000012     ....<...........
+ 800e784:	00000000 00000001 00000008 00000200     ................
+ 800e794:	00000002 00000000 00000001 00000007     ................
+
+0800e7a4 <CSWTCH.38>:
+ 800e7a4:	0d0c0b09                                ....
+
+0800e7a8 <version_string>:
+ 800e7a8:	2e332e33 69742030 323d656d 30363230     3.3.0 time=20260
+ 800e7b8:	2e353033 32313930 67203034 6d3d7469     305.091240 git=m
+ 800e7c8:	65747361 33654072 30366635 0d006465     aster@e35f60ed..
+ 800e7d8:	                                         ..
+
+0800e7da <hexmap>:
+ 800e7da:	33323130 37363534 62613938 66656463     0123456789abcdef
+ 800e7ea:	41525350 6166204d 50006c69 203a5253     PSRAM fail.PSR: 
+ 800e7fa:	6164616e 52535000 6321203a 6b636568     nada.PSR: !check
+ 800e80a:	52535000 6576203a 6f697372 fc00006e     .PSR: version...
+ 800e81a:	00020000 00000000 00030000 000a0000     ................
+ 800e82a:	00080000 00100000 6f6c0000 7220676e     ..........long r
+ 800e83a:	20646165 6c696166 55464400 72617020     ead fail.DFU par
+ 800e84a:	66206573 006c6961 646f6f67 72696620     se fail.good fir
+ 800e85a:	7261776d 72770065 20676e6f 6c726f77     mware.wrong worl
+ 800e86a:	64730064 64726163 6165735f 3a686372     d.sdcard_search:
+ 800e87a:	64730020 64726163 6f72705f 203a6562      .sdcard_probe: 
+ 800e88a:	696e6900 61662074 73006c69 64656570     .init fail.speed
+ 800e89a:	64697700 73620065 3f657a69 006b6f00     .wide.bsize?.ok.
+ 800e8aa:	6c696166 61657220 66440064 00655375     fail read.DfuSe.
+ 800e8ba:	6e756f66 20402064 63655200 7265766f     found @ .Recover
+ 800e8ca:	6f6d2079 002e6564 1f000000 00020000     y mode..........
+ 800e8da:	00010000 00030000 000c0000 00040000     ................
+ 800e8ea:	00020000 00010000 00030000 000c0000     ................
+	...
+
+0800e8fc <curve_secp256k1>:
+ 800e8fc:	01002008 fffffc2f fffffffe ffffffff     . ../...........
+ 800e90c:	ffffffff ffffffff ffffffff ffffffff     ................
+ 800e91c:	ffffffff d0364141 bfd25e8c af48a03b     ....AA6..^..;.H.
+ 800e92c:	baaedce6 fffffffe ffffffff ffffffff     ................
+ 800e93c:	ffffffff 16f81798 59f2815b 2dce28d9     ........[..Y.(.-
+ 800e94c:	029bfcdb ce870b07 55a06295 f9dcbbac     .........b.U....
+ 800e95c:	79be667e fb10d4b8 9c47d08f a6855419     ~f.y......G..T..
+ 800e96c:	fd17b448 0e1108a8 5da4fbfc 26a3c465     H..........]e..&
+ 800e97c:	483ada77 00000007 00000000 00000000     w.:H............
+	...
+ 800e9a0:	080066a1 08005f25 080060fb 08005d11     .f..%_...`...]..
+
+0800e9b0 <curve_secp256r1>:
+ 800e9b0:	01002008 ffffffff ffffffff ffffffff     . ..............
+	...
+ 800e9cc:	00000001 ffffffff fc632551 f3b9cac2     ........Q%c.....
+ 800e9dc:	a7179e84 bce6faad ffffffff ffffffff     ................
+ 800e9ec:	00000000 ffffffff d898c296 f4a13945     ............E9..
+ 800e9fc:	2deb33a0 77037d81 63a440f2 f8bce6e5     .3.-.}.w.@.c....
+ 800ea0c:	e12c4247 6b17d1f2 37bf51f5 cbb64068     GB,....k.Q.7h@..
+ 800ea1c:	6b315ece 2bce3357 7c0f9e16 8ee7eb4a     .^1kW3.+...|J...
+ 800ea2c:	fe1a7f9b 4fe342e2 27d2604b 3bce3c3e     .....B.OK`.'><.;
+ 800ea3c:	cc53b0f6 651d06b0 769886bc b3ebbd55     ..S....e...vU...
+ 800ea4c:	aa3a93e7 5ac635d8 080067e9 08005f25     ..:..5.Z.g..%_..
+ 800ea5c:	0800678f 08005d8d                       .g...]..
+
+0800ea64 <AHBPrescTable>:
+	...
+ 800ea6c:	04030201 09080706                       ........
+
+0800ea74 <APBPrescTable>:
+ 800ea74:	00000000 04030201                       ........
+
+0800ea7c <MSIRangeTable>:
+ 800ea7c:	000186a0 00030d40 00061a80 000c3500     ....@........5..
+ 800ea8c:	000f4240 001e8480 003d0900 007a1200     @B........=...z.
+ 800ea9c:	00f42400 016e3600 01e84800 02dc6c00     .$...6n..H...l..
+ 800eaac:	20727463 3f746573 00702100 00006000     ctr set?.!p..`..
+ 800eabc:	00000012 00000000 00000003 00000004     ................
+
+0800eacc <DEV_MANID>:
+ 800eacc:	00008000                                ....
+
+Disassembly of section .relocate:
+
+2009e000 <flash_burn>:
+{
+2009e000:	b530      	push	{r4, r5, lr}
+    while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_BSY)) {
+2009e002:	4920      	ldr	r1, [pc, #128]	; (2009e084 <flash_burn+0x84>)
+2009e004:	690c      	ldr	r4, [r1, #16]
+2009e006:	03e5      	lsls	r5, r4, #15
+2009e008:	d4fc      	bmi.n	2009e004 <flash_burn+0x4>
+    uint32_t error = (FLASH->SR & FLASH_FLAG_SR_ERRORS);
+2009e00a:	690d      	ldr	r5, [r1, #16]
+    if(error) {
+2009e00c:	4c1e      	ldr	r4, [pc, #120]	; (2009e088 <flash_burn+0x88>)
+2009e00e:	4225      	tst	r5, r4
+2009e010:	d104      	bne.n	2009e01c <flash_burn+0x1c>
+    if (__HAL_FLASH_GET_FLAG(FLASH_FLAG_EOP)) {
+2009e012:	690c      	ldr	r4, [r1, #16]
+2009e014:	07e4      	lsls	r4, r4, #31
+        __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_EOP);
+2009e016:	bf44      	itt	mi
+2009e018:	2401      	movmi	r4, #1
+2009e01a:	610c      	strmi	r4, [r1, #16]
+    FLASH->SR = FLASH->SR & FLASH_FLAG_SR_ERRORS;
+2009e01c:	4919      	ldr	r1, [pc, #100]	; (2009e084 <flash_burn+0x84>)
+2009e01e:	4d1a      	ldr	r5, [pc, #104]	; (2009e088 <flash_burn+0x88>)
+2009e020:	690c      	ldr	r4, [r1, #16]
+2009e022:	402c      	ands	r4, r5
+2009e024:	610c      	str	r4, [r1, #16]
+    __HAL_FLASH_DATA_CACHE_DISABLE();
+2009e026:	680c      	ldr	r4, [r1, #0]
+2009e028:	f424 6480 	bic.w	r4, r4, #1024	; 0x400
+2009e02c:	600c      	str	r4, [r1, #0]
+    CLEAR_BIT(FLASH->CR, (FLASH_CR_PG | FLASH_CR_MER1 | FLASH_CR_PER | FLASH_CR_PNB));      // added
+2009e02e:	694c      	ldr	r4, [r1, #20]
+2009e030:	f424 64ff 	bic.w	r4, r4, #2040	; 0x7f8
+2009e034:	f024 0407 	bic.w	r4, r4, #7
+2009e038:	614c      	str	r4, [r1, #20]
+    SET_BIT(FLASH->CR, FLASH_CR_PG);
+2009e03a:	694c      	ldr	r4, [r1, #20]
+2009e03c:	f044 0401 	orr.w	r4, r4, #1
+2009e040:	614c      	str	r4, [r1, #20]
+    *(__IO uint32_t *)(address) = (uint32_t)val;
+2009e042:	6002      	str	r2, [r0, #0]
+  __ASM volatile ("isb 0xF":::"memory");
+2009e044:	f3bf 8f6f 	isb	sy
+    *(__IO uint32_t *)(address+4) = (uint32_t)(val >> 32);
+2009e048:	6043      	str	r3, [r0, #4]
+    while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_BSY)) {
+2009e04a:	690b      	ldr	r3, [r1, #16]
+2009e04c:	03da      	lsls	r2, r3, #15
+2009e04e:	d4fc      	bmi.n	2009e04a <flash_burn+0x4a>
+    uint32_t error = (FLASH->SR & FLASH_FLAG_SR_ERRORS);
+2009e050:	6908      	ldr	r0, [r1, #16]
+    if(error) {
+2009e052:	4028      	ands	r0, r5
+2009e054:	d104      	bne.n	2009e060 <flash_burn+0x60>
+    if (__HAL_FLASH_GET_FLAG(FLASH_FLAG_EOP)) {
+2009e056:	690b      	ldr	r3, [r1, #16]
+2009e058:	07db      	lsls	r3, r3, #31
+        __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_EOP);
+2009e05a:	bf44      	itt	mi
+2009e05c:	2301      	movmi	r3, #1
+2009e05e:	610b      	strmi	r3, [r1, #16]
+    CLEAR_BIT(FLASH->CR, FLASH_CR_PG);
+2009e060:	4b08      	ldr	r3, [pc, #32]	; (2009e084 <flash_burn+0x84>)
+2009e062:	695a      	ldr	r2, [r3, #20]
+2009e064:	f022 0201 	bic.w	r2, r2, #1
+2009e068:	615a      	str	r2, [r3, #20]
+    __HAL_FLASH_DATA_CACHE_RESET();
+2009e06a:	681a      	ldr	r2, [r3, #0]
+2009e06c:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+2009e070:	601a      	str	r2, [r3, #0]
+2009e072:	681a      	ldr	r2, [r3, #0]
+2009e074:	f422 5280 	bic.w	r2, r2, #4096	; 0x1000
+2009e078:	601a      	str	r2, [r3, #0]
+    __HAL_FLASH_DATA_CACHE_ENABLE();
+2009e07a:	681a      	ldr	r2, [r3, #0]
+2009e07c:	f442 6280 	orr.w	r2, r2, #1024	; 0x400
+2009e080:	601a      	str	r2, [r3, #0]
+}
+2009e082:	bd30      	pop	{r4, r5, pc}
+2009e084:	40022000 	.word	0x40022000
+2009e088:	0002c3fa 	.word	0x0002c3fa
+
+2009e08c <flash_page_erase>:
+    if(page_num < ((BL_FLASH_SIZE + BL_NVROM_SIZE) / FLASH_ERASE_SIZE)) {
+2009e08c:	4b2d      	ldr	r3, [pc, #180]	; (2009e144 <flash_page_erase+0xb8>)
+2009e08e:	4003      	ands	r3, r0
+{
+2009e090:	b510      	push	{r4, lr}
+    if(page_num < ((BL_FLASH_SIZE + BL_NVROM_SIZE) / FLASH_ERASE_SIZE)) {
+2009e092:	2b00      	cmp	r3, #0
+2009e094:	d054      	beq.n	2009e140 <flash_page_erase+0xb4>
+    while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_BSY)) {
+2009e096:	4b2c      	ldr	r3, [pc, #176]	; (2009e148 <flash_page_erase+0xbc>)
+    page_num &= 0xff;
+2009e098:	f3c0 3207 	ubfx	r2, r0, #12, #8
+    while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_BSY)) {
+2009e09c:	6919      	ldr	r1, [r3, #16]
+2009e09e:	03c9      	lsls	r1, r1, #15
+2009e0a0:	d4fc      	bmi.n	2009e09c <flash_page_erase+0x10>
+    uint32_t error = (FLASH->SR & FLASH_FLAG_SR_ERRORS);
+2009e0a2:	691c      	ldr	r4, [r3, #16]
+    if(error) {
+2009e0a4:	4929      	ldr	r1, [pc, #164]	; (2009e14c <flash_page_erase+0xc0>)
+2009e0a6:	420c      	tst	r4, r1
+2009e0a8:	d104      	bne.n	2009e0b4 <flash_page_erase+0x28>
+    if (__HAL_FLASH_GET_FLAG(FLASH_FLAG_EOP)) {
+2009e0aa:	6919      	ldr	r1, [r3, #16]
+2009e0ac:	07cc      	lsls	r4, r1, #31
+        __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_EOP);
+2009e0ae:	bf44      	itt	mi
+2009e0b0:	2101      	movmi	r1, #1
+2009e0b2:	6119      	strmi	r1, [r3, #16]
+    FLASH->SR = FLASH->SR & 0xffff;
+2009e0b4:	4b24      	ldr	r3, [pc, #144]	; (2009e148 <flash_page_erase+0xbc>)
+2009e0b6:	6919      	ldr	r1, [r3, #16]
+2009e0b8:	b289      	uxth	r1, r1
+2009e0ba:	6119      	str	r1, [r3, #16]
+    __HAL_FLASH_DATA_CACHE_DISABLE();
+2009e0bc:	6819      	ldr	r1, [r3, #0]
+2009e0be:	f421 6180 	bic.w	r1, r1, #1024	; 0x400
+2009e0c2:	6019      	str	r1, [r3, #0]
+        SET_BIT(FLASH->CR, FLASH_CR_BKER);
+2009e0c4:	6959      	ldr	r1, [r3, #20]
+    if(bank2) {
+2009e0c6:	f010 6ffe 	tst.w	r0, #133169152	; 0x7f00000
+        SET_BIT(FLASH->CR, FLASH_CR_BKER);
+2009e0ca:	bf14      	ite	ne
+2009e0cc:	f441 6100 	orrne.w	r1, r1, #2048	; 0x800
+        CLEAR_BIT(FLASH->CR, FLASH_CR_BKER);
+2009e0d0:	f421 6100 	biceq.w	r1, r1, #2048	; 0x800
+2009e0d4:	6159      	str	r1, [r3, #20]
+    MODIFY_REG(FLASH->CR, FLASH_CR_PNB, (page_num << POSITION_VAL(FLASH_CR_PNB)));
+2009e0d6:	6959      	ldr	r1, [r3, #20]
+  uint32_t result;
+
+#if ((defined (__ARM_ARCH_7M__      ) && (__ARM_ARCH_7M__      == 1)) || \
+     (defined (__ARM_ARCH_7EM__     ) && (__ARM_ARCH_7EM__     == 1)) || \
+     (defined (__ARM_ARCH_8M_MAIN__ ) && (__ARM_ARCH_8M_MAIN__ == 1))    )
+   __ASM volatile ("rbit %0, %1" : "=r" (result) : "r" (value) );
+2009e0d8:	f44f 63ff 	mov.w	r3, #2040	; 0x7f8
+2009e0dc:	f421 61ff 	bic.w	r1, r1, #2040	; 0x7f8
+2009e0e0:	fa93 f3a3 	rbit	r3, r3
+   */
+  if (value == 0U)
+  {
+    return 32U;
+  }
+  return __builtin_clz(value);
+2009e0e4:	fab3 f383 	clz	r3, r3
+2009e0e8:	409a      	lsls	r2, r3
+2009e0ea:	4b17      	ldr	r3, [pc, #92]	; (2009e148 <flash_page_erase+0xbc>)
+2009e0ec:	430a      	orrs	r2, r1
+2009e0ee:	615a      	str	r2, [r3, #20]
+    SET_BIT(FLASH->CR, FLASH_CR_PER);
+2009e0f0:	695a      	ldr	r2, [r3, #20]
+2009e0f2:	f042 0202 	orr.w	r2, r2, #2
+2009e0f6:	615a      	str	r2, [r3, #20]
+    SET_BIT(FLASH->CR, FLASH_CR_STRT);
+2009e0f8:	695a      	ldr	r2, [r3, #20]
+2009e0fa:	f442 3280 	orr.w	r2, r2, #65536	; 0x10000
+2009e0fe:	615a      	str	r2, [r3, #20]
+    while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_BSY)) {
+2009e100:	691a      	ldr	r2, [r3, #16]
+2009e102:	03d1      	lsls	r1, r2, #15
+2009e104:	d4fc      	bmi.n	2009e100 <flash_page_erase+0x74>
+    uint32_t error = (FLASH->SR & FLASH_FLAG_SR_ERRORS);
+2009e106:	6918      	ldr	r0, [r3, #16]
+2009e108:	4a10      	ldr	r2, [pc, #64]	; (2009e14c <flash_page_erase+0xc0>)
+    if(error) {
+2009e10a:	4010      	ands	r0, r2
+2009e10c:	d104      	bne.n	2009e118 <flash_page_erase+0x8c>
+    if (__HAL_FLASH_GET_FLAG(FLASH_FLAG_EOP)) {
+2009e10e:	691a      	ldr	r2, [r3, #16]
+2009e110:	07d2      	lsls	r2, r2, #31
+        __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_EOP);
+2009e112:	bf44      	itt	mi
+2009e114:	2201      	movmi	r2, #1
+2009e116:	611a      	strmi	r2, [r3, #16]
+    CLEAR_BIT(FLASH->CR, (FLASH_CR_PER | FLASH_CR_PNB));
+2009e118:	4b0b      	ldr	r3, [pc, #44]	; (2009e148 <flash_page_erase+0xbc>)
+2009e11a:	695a      	ldr	r2, [r3, #20]
+2009e11c:	f422 62ff 	bic.w	r2, r2, #2040	; 0x7f8
+2009e120:	f022 0202 	bic.w	r2, r2, #2
+2009e124:	615a      	str	r2, [r3, #20]
+    __HAL_FLASH_DATA_CACHE_RESET();
+2009e126:	681a      	ldr	r2, [r3, #0]
+2009e128:	f442 5280 	orr.w	r2, r2, #4096	; 0x1000
+2009e12c:	601a      	str	r2, [r3, #0]
+2009e12e:	681a      	ldr	r2, [r3, #0]
+2009e130:	f422 5280 	bic.w	r2, r2, #4096	; 0x1000
+2009e134:	601a      	str	r2, [r3, #0]
+    __HAL_FLASH_DATA_CACHE_ENABLE();
+2009e136:	681a      	ldr	r2, [r3, #0]
+2009e138:	f442 6280 	orr.w	r2, r2, #1024	; 0x400
+2009e13c:	601a      	str	r2, [r3, #0]
+}
+2009e13e:	bd10      	pop	{r4, pc}
+        return 1;
+2009e140:	2001      	movs	r0, #1
+2009e142:	e7fc      	b.n	2009e13e <flash_page_erase+0xb2>
+2009e144:	07fe0000 	.word	0x07fe0000
+2009e148:	40022000 	.word	0x40022000
+2009e14c:	0002c3fa 	.word	0x0002c3fa
diff --git a/stm32/mk4-bootloader/releases/README.md b/stm32/mk4-bootloader/releases/README.md
index 65ea319e..7403eb80 100644
--- a/stm32/mk4-bootloader/releases/README.md
+++ b/stm32/mk4-bootloader/releases/README.md
@@ -14,3 +14,4 @@ Github is nearly free, so why not capture all the actual bits!
 - V3.1.5 - bugfix so slot 10 of trick pins is usable
 - V3.2.0 - share code with Q bootrom, no changes for Mk4 operation.
 - V3.2.1 - enable omitted if wrong PIN options & fix "Wipe -> Wallet" trick pin option
+- V3.3.0 - new hardware support, no functional changes