Nordic Semi nRF52 832 memory layout

Ruuvi Version 3.x.x

From armgcc/ruuvi_firmware.ld:

MEMORY
{
                                                    /* Leave room for SoftDevice RAM */
  RAM                         (rwx) : ORIGIN = 0x20002450, LENGTH =  0xDBB0  /*  ends at FFFF */
/* bootloader                                       75000 .. 7AB77                  */
  bootloader_settings_page      (r) : ORIGIN = 0x0007F000, LENGTH =  0x1000
  mbr_params_page               (r) : ORIGIN = 0x0007E000, LENGTH =  0x1000
  FLASH                        (rx) : ORIGIN = 0x00026000, LENGTH = 0x4F000  /*    through 0x75000 (i.e.FDS start) */
  uicr_bootloader_start_address (r) : ORIGIN = 0x00000FF8, LENGTH =       4    /* contains 0x75000                */
  uicr_mbr_params_page          (r) : ORIGIN = 0x00000FFC, LENGTH =       4    /* contains 0x7E000                */
}

See armgcc/_build/*.map)

RAM

     2001 0000 top o stack __StackTop = (ORIGIN (RAM) + LENGTH (RAM))
                            used for local variables
     2000 E000 __StackLimit = (__StackTop - SIZEOF (.stack_dummy))
                                 nRF52832 64KB RAM 
     2000 5FFF                   nRF52811 24KB RAM     Doesn't fit
  Memory address shown here are only an example
      …        
unused RAM for growth    with debugging, No DPS310,TMP117,NTC or PHOTO
      …       
   .bss.                                     10000 - 786C = 34707 aka 33KB

      *(COMMON)  
     2000 786C  __bss_end__      (9/2/21)  3.30.3  tests +DEBUG see the .map

     2000 7694  _SEGGER_RTT

      COMMON   
     
     2000  766C heap_end.5377
      2000  7668 __malloc_sbrk_start 
      2000  7664 __malloc_free_list  

     2000 7660 m_t4t_active   nfc_t4t_lib_al.c (last  defined)

     2000 7554 nfc_rx_buffer (256.)                 big?

     2000 70E8 _acUpBuffer  (512. x200 SEGGER_RTT.c 
                    ~~~ look here if RTT not running 
     2000 70d8 _acDownBuffer
    …
     2000 69C0 m_log_data nrf_log_frontend.c (1,060) !

     2000 6750 m_pi    peer_id   ??
     2000 65C8 buffer_memory peer_database ??  `
    …
     2000 53E4 m_log_output_block fb4 app_log.c history BIG!! aka 1005 words
     2000 4430 m_log_input_block  fb4 app_log.c history BIG!! aka 1005 words don;t copy to RAM !! 
     2000 4428 m_log_config 

     2000 3d1c m_pages  

     2000 3D00 m_log_level 

     2000 348c m_scan_queue_nrf_queue_buffer

     2000 2E3C m_adv_queue_nrf_queue_buffer 4f0 

     2000 3940 nrf5_sdk15_nfc_state 1a0 ruuvi_nrf5_sdk15_communication_nfc.c 

     2000 390C nfc_tx_buf 
     2000 38D8 nfc_id_buf 
     2000 38d4 nfc_fw_buf 
     2000 3870 nfc_addr_buf 


     2000 29C0 rx_data  e8(232) ruuvi_interface_communication_nfc_test.c      

     2000 2AC0 rx_data  e8(232) ruuvi_interface_communication_ble_gatt_test.  

     
    …
     2000 2994 m_adv
     2000 2990 m_timeout      
     2000 298F m_has_sent  ruuvi_interface_communication_ble_gatt_test
     2000 298E m_has_received 
     2000 298D m_has_disconnected
     2000 298C m_has_connected   
     2000 2978 m_channel         ruuvi_interface_communication_ble_advertising_test.c   

     2000 2975 level_int         ruuvi_driver_sensor_test.c 
     2000 2974 fifo_int          

     2000 2958 __bss_start__ 

     2000 2940 m_fs   fds.c .fs_data
     2000 2940 __data_end__
      … 
     2000 2450 __data_start__   defined in .ld. See map as of 9/01/21


     2000 244F SoftDevice RAM
        …
     2000 0000 SoftDevice RAM


    
    special FLASH 
     1000 10FC UICR->CUSTOMER[32]
     1000 1080 UICR->CUSTOMER[0]
     1000 1000 UICR

     1000 0204 " 
     1000 0208 APPROTECT  Access port protection  blocks debugger access to all CPU registers and memory-mapped addresses.
     1000 0200 Mapping of the nRESET
     1000 0000 FICR



    Code RAM
     0080 0000  unused by Ruuvi Firmware

Some systems copy portions of the code from FLASH to RAM which is faster and requires less power (especially if this allows for the FLASH to be powered off.

FLASH

    0007 FFFF 
    0003 0000  nRF52811 192K Flash 
    0007 F000 '  Bootloader settings. See nrfjprog
    0007 E000   mbr_params_page
    0007 F050 ,
        …     settings

                          unused

   0007 AB77    bootloader
   0007 A000   DFU Bootloader, data, and MBR parameters 
   0007 5000    bootloader  uicr_bootloader_start_address

    0007 5000 __stop_storage_flash = . + 15000 (from .ld)  EXCLUSIVE i.e. 0007 4FFF is last used address

                  Flash Data Storage

     __start_storage_flash  (from .ld) lomgmem uses 50000

bytes unused for growth of code

As of 3.31.1 11/11/21

__exidx_end from .map

    0004 B380  .ARM.exidx    
     4C0B0   FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
     4C0A0   000311F9 00000000 00000000 FFFFFFFF 
     4C090   00026225 00026201 00000000 00000000 
     4C080   00000000 00000000 00000000 00000001 
     4C070   00000000 00000000 00000000 00000000 
     4C060   00000000 00000000 53410000 00494943 
     4C050   00000000 00000000 00000000 00000000 
     4C040   FFFFFFFF 0000FFFF 53410001 00494943 
     4C030   0004B951 0004B951 FFFFFFFF FFFFFFFF 
     4C020   0004B951 0004B951 0004B951 0004B951 
     4C010   0004B708 0004B951 0004B951 0004B951 
     4C000   00043B05 00042F2D 00000000 0004B73E 
     4BFF0   00000000 00000000 00000000 00000000   

.rodata.pow.str1.4
    4 B960   70 6F 77 00 70 6F 77 66  00 00 00 00 73 71 72 74  pow.powf....sqrt
    4 B330 __start_log_backends 
   .sdh
    4 b88c  _ruuvi_log

    4 B794 i_nrfx_clock
    .log_const_data

.mem_section_dummy_rom

address vary 
    4b2xx  .crypto_data   

  .rodata  strings to initalize function's literals LOG("compiled...

.rodata._setlocale_r.str1.1 0004Af80       8 libc_nano.a(lib_a-locale.o)
0004AFxx 43 00 50 4F 53 49 58 00  2E 00                    C.POSIX...
.rodata._printf_i.str1.1    0004Af9C      22 libc_nano.a(lib_a-nano-vfprintf_i.o)
0004AFxx                                49 4E 46 00 69 6E            INF.in
0004AFxx 66 00 4E 41 4E 00 6E 61  6E 00 30 00 30 31 32 33  f.NAN.nan.0.0123
0004AFxx 34 35 36 37 38 39 41 42  43 44 45 46 00 30 31 32  456789ABCDEF.012
0004AFxx 33 34 35 36 37 38 39 61  62 63 64 65 66 00 00 20  3456789abcdef.. 

    0004 8D40   .rodata.setup.str1.4 main.c
00048D40 2E 2E 2F 2E 2E 2F 2E 2E  2F 6D 61 69 6E 2E 63 00  ../../../main.c.
00048D50 22 73 65 6E 73 6F 72 73  22 3A 20 7B 0D 0A 00 00  "sensors": {....
00048D60 7B 0D 0A 22 66 69 72 6D  77 61 72 65 22 3A 22 52  {.."firmware":"R
00048D70 75 75 76 69 20 46 57 20  76 33 2E 33 30 2E 33 22  uuvi FW v3.30.3"
00048D80 2C 0D 0A 00 22 63 6F 6D  70 69 6C 65 64 5F 6F 6E  ,..."compiled_on
00048D90 22 3A 22 53 65 70 20 20  36 20 32 30 32 31 20 32  ":"Sep  6 2021 2
00048DA0 30 3A 33 35 3A 31 32 22  2C 0D 0A 00 22 62 6F 61  0:35:12",..."boa
00048EB0 69 20 46 57 00 00 00 00  76 33 2E 33 30 2E 33 00  i FW....v3.30.3.
00048EC0 2B 64 65 62 75 67 00 00  43 68 65 63 6B 20 50 43  +debug..C


    0004 7880
                                            gatt_cache_manager.c
   .text.  Program code
    0004 7874 _fini 
    0004 785Co __errno
 
       Library routines 

     0004 12xx       gcc_startup_nrf52.S IRQ Handlers

     0004 0Dxx nrfx_nfct_rx 

     0003 E1xx  SEGGER_RTT_Init 

     0003 c2xx  nrf_log_frontend_std_0

     0003 B8xx is_busy 
     0003 B8xx      10 nrf_fstorage_sd.c ??   SD??

     0003 5Bxx app_log_process
   
     0003 xxxx      00 BE  BKPT  #0  app_error.c
                        DSB       #15   DataSyncBarrier
                        LDR       R1, [PC, #+0x18]
                        LDR       R3, [PC, #+0x1C]
                        LDR       R2, [R1, #+0x0C]
                        AND       R2, R2, #0x700
                        ORRS      R3, R2
                        STR       R3, [R1, #+0x0C]  store
                        BX        R3
                        
                        MOVW      R4, #0xFFC  R4<
                        LDR       R0, [R4]
                        MOV       R6, #0x10001000 R60003 49xx  main
     0003 49xx  setup
     0003 49xx  app_on_error    
 
     0003 33xx NFC

     0003 29xx rt_adv_send_data

     0003 1xxx ri_yield_init

     0003 1xxx ri_scheduler_init

     0003 1xxx  WDT_IRQHandler

     0003 1xxx fds_stat
     0003 1xxx fds_init

     0002 fxxx ri_rtc_millis

     0002 fxxx ri_log

     0002 exxx  ri_flash_record_get 

                sd_ble_gap_adv_set_configure   ruuvi_nrf5_sdk15_communication_ble_advertising.c
     0002 dxxx  ri_comm_id_get                 ruuvi_nrf5_sdk15_communication.c
                
                sensor code
               
     0002 6000  gcc_startup_nrf52.S, _start , __isr_vector 

     0002 5140 = 2A 86 08 01 9F 09 16 CB  32 7F 0B 6C F4 10 C0 00
     0002 2000 |
     0002 1000 | 
     0002 0000-'
               
     0001 F000 __ISR_vector

     0001 5CCE  SEV  
     0001 5CD0: WFE  
     0001 5CD2: LDRB      R7, [R4, #+0x01]
     0001 5CD4: LDRB      R0, [R4]
     0001 5CD6: STRB      R0, [R4, #+0x01]
     0001 5CD8: LDR       R5, [R6, #+0x200]
     0001 5CDC: BL        #-0x148E0s

     00001400:   LDR       R0, [PC, #+0x40]
     00001402:   BX        LR
     00015CE0:   BICS      R5, R0
     00015CE2:   BNE       #+0x0A
     00015CE4:   LDR       R0, [R6, #+0x204]
     00015CE8:   CBNZ      R0, #+0x04
     00015CF0:   BL        #-0x9DDA

     0000BF1A:   LDR       R1, [PC, #+0xD0]
     0000BF1C:   LDR       R0, [PC, #+0xD4]
     0000BF1E:   SUBS      R1, R1, #4
     0000BF20:   STR       R0, [R1]
     0000BF22:   BX        LR
          
     00015CF4:   MOVS      R0, #0
     00015CF6:   POP       {R4-R8,PC}

     0000122E:   PUSH      {R0}
     00001230:   LDR       R0, [SP, #+0x04]
     00001232:   MOV       LR, R0
     00001234:   POP       {R0}
     00001236:   ADD       SP, SP, #4
     00001238:   POP       {R1-R4,PC}

     00077CBE:   SVC       #65

     00077CC0:   BX        LR

     00077E18:   B         #-0x10
     00077E0C:   BL        #+0x2660

     0007A470:   LDR       R3, [PC, #+0x0C]
     0007A472:   LDR       R3, [R3, #+0x400]
     0007A476:   CBZ       R3, #+0x02
     0007A478:   B         #-0xB0

     0007A3CC:   LDR       R2, [PC, #+0x28]
     0007A3CE:   LDR       R3, [R2, #+0x400]
     0007A3D2:   CBZ       R3, #+0x1E
     0007A3D4:   LDR       R0, [PC, #+0x24]
     0007A3D6:   MOVS      R3, #0
     0007A3D8:   LDR       R1, [R2, #+0x508] <--,
     0007A3DC:   LSRS      R1, R3               |
     0007A3DE:   LSLS      R1, R1, #31          |
     0007A3E0:   IT        MI                   |
     0007A3E2:   ADD       R1, R3, #0x180       |
     0007A3E6:   ADD       R3, R3, #0x01        |
     0007A3EA:   IT        MI                   |
     0007A3EC:   STR       R0, [R2, R1, LSL #2] |
     0007A3F0:   CMP       R3, #7               |
     0007A3F2:   BNE       #-0x1E  ---->--------'
     0007A3F4:   BX        LR
     00077E10:   BL        #-0x292C
     000754E8:   PUSH      {R3-R7,LR}
     000754EA:   LDR       R4, [PC, #+0x48]
     000754EC:   LDR       R5, [PC, #+0x48]
     000754EE:   MOV       R6, R4
     000754F0:   LDRB      R2, [R4]
     000754F2:   LDRB      R3, [R5]
     000754F4:   CMP       R2, R3
     000754F6:   BNE       #+0x00
     000754F8:   POP       {R3-R7,PC}
     00077E14:   BL        #-0x15A

     00077CBE:   SVC       #65   -----------

     00000AA4:   TST       LR, #0x04
     00000AA8:   ITE       EQ
     00000AAA:   MRS       R1, MSP
     00000AAE:   MRS       R1, PSP
     00000AB2:   LDR       R0, [R1, #+0x18]
     00000AB4:   SUBS      R0, #2
     00000AB6:   LDRB      R0, [R0]
     00000AB8:   CMP       R0, #24
     00000ABA:   BNE       #+0x06 --->---------,
                                                |
     00000AC4:   LDR       R2, [PC, #+0x1C] <--'
     00000AC6:   LDR       R2, [R2]
     00000AC8:   ADDS      R2, #44
     00000ACA:   LDR       R2, [R2]

     00024B74:   MOVS      R0, #4
     00024B76:   MOV       R1, LR





     0000 0FFC addres of uicr_mbr_params_page 7E000
     0000 0FF8 address of uicr_bootloader_start_address 7F000

                        
SoftDevice   end

     0000 1000 = 80 13 00 20 19 4B 02 00  05 C0 00 00 7F 4A 02 00  
     0000 0FF0 = FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF
…
     0000 0B00 = FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF 
     0000 0AF0 = 00 10 00 00 00 00 00 00  00 FF FF FF 00 90 D0 03  

     0000 0110  F000 BCAC F640 71FC 6808 F04F 2210 1C40 
     0000 0100  093B 0000 B51F F000 F803 E88D 000F BD1F 
     0000 00F0  0913 0000 091D 0000 0927 0000 0931 0000 
     0000 00E0  08EB 0000 08F5 0000 08FF 0000 0909 0000 
     0000 00D0  08C3 0000 08CD 0000 08D7 0000 08E1 0000 
     0000 00C0  089B 0000 08A5 0000 08AF 0000 08B9 0000 
     0000 00B0  0873 0000 087D 0000 0887 0000 0891 0000 
     0000 00A0  084B 0000 0855 0000 085F 0000 0869 0000 
     0000 0090  0823 0000 082D 0000 0837 0000 0841 0000 
     0000 0080  07FB 0000 0805 0000 080F 0000 0819 0000 
     0000 0070  07D3 0000 07DD 0000 07E7 0000 07F1 0000 
     0000 0060  07AB 0000 07B5 0000 07BF 0000 07C9 0000 
     0000 0050  0783 0000 078D 0000 0797 0000 07A1 0000 
     0000 0040  075B 0000 0765 0000 076F 0000 0779 0000 
     0000 0030  073D 0000 0000 0000 0747 0000 0751 0000 

     0000 0020  0000 0000 0000 0000 0000 0000 0AA5 0000 
     0000 0010  071F 0000 0729 0000 0733 0000 0000 0000 
     0000 0000  0400 2000 0A81 0000 0715 0000 0A61 0000 

     Master Boot Record (MBR)  20000400 0A81 715 A61  71F 729 733 00000000  0AA5



          0A80 execution starts here:
    
           A80 LDR R3,[PC, #+18]   /17 04   i.e.  00000417
           A82 BX R3    -> 417

A84              LDR       R2, [PC, #+0x18]
A86              STR       R0, [R2]
A88              LDR       R1, [R0]
A8A 08 88        MSR       MSP, R1
A8E              LDR       R0, [R0, #+0x04]
A90              BX        R0                    75374    LDR       R0, [PC, #+0x40]


           416 MOVW  R4, #FFC / 7E000
           41A LDR   R0,[R4]
             C MOV   R6, #10001000   
           420 ADDS  R0,R0,#1  7E001
422              BEQ       #+0x46
424              LDR       R0, [R4]
426              ADDS      R0, R0, #1
428              BEQ       #+0x18
42A              LDR       R0, [R4]
42C              ADDS      R0, R0, #1
42E              BEQ       #+0x3E
430              LDR       R5, [R4]
432              LDR       R0, [R4]
434              ADD       R5, R5, #0x80
438              ADDS      R0, R0, #1
43A              BEQ       #+0x36
43C              LDR       R7, [R4]
43E              LDRB      R0, [R7, #+0x04]
440              CMP       R0, #170
442              BEQ       #+0x32
444              MOVW      R0, #0xFF8
448              LDR       R1, [R0]
44A              ADDS      R1, R1, #1
44C              BEQ       #+0x84
44E              LDR       R1, [R0]
450              ADDS      R1, R1, #1
452              BEQ       #+0x8A
454              LDR       R1, [R0]
456              ADDS      R1, R1, #1
458              BEQ       #+0x7C
45A              LDR       R1, [R0]
45C              LDR       R1, [R1]
45E              ADDS      R1, R1, #1
460              BEQ       #+0x7C
462              LDR       R1, [R0]
464              ADDS      R1, R1, #1
466              BEQ       #+0x72
468              LDR       R0, [R0]
46A              B         #+0x7C          ^
4EA              BL        #+0x596 ---> A84

4EE              B         #-0x04
4F0              DSB       #15
4F4              LDR       R0, [PC, #+0x98]
4F6              LDR       R1, [R0]
4F8              LDR       R2, [PC, #+0x98]
4FA              AND       R1, R1, #0x700
4FE              ORRS      R1, R2
500              STR       R1, [R0]
502              DSB       #15
                  ...
           A84
           A8E LDR     R0, [R0,#+4]   75375
           A90 BX      R0
         75364 LDR  R0., [PC, #+40]`

Peripheral Instances

ID Base Address Peripheral Instance 0 4000 0000 Clock control POWER Power control BPROT Block Protect 1 4000 1000 RADIO 2.4 GHz radio 2 4000 2000 UARTE0 with EasyDMA 3 4000 3000 SPI master/slave SPIM0 SPI master 0 SPIS0 SPI slave 0 TWIM0 Two-wire master 0 TWIS0 interface slave 4 4000 4000 SPIM1, SPIS1, SPI1 TWI1, TWIS1, TWIM1 5 4000 5000 NFCT 6 4000 6000 GPIOTE 7 4000 7000 SAADC 8 4000 8000 TIMER0 9 4000 9000 TIMER1 10 4000 A000 TIMER2 11 4000 B000 RTC0 12 4000 C000 TEMPerature sensor 13 4000 D000 RNG Random number generator 14 4000 E000 ECB AES Electronic Codebook (ECB) 15 4000 F000 CCM AES CCM mode encryption 15 4000 F000 ARR Accelerated address resolver

ID Base Address Peripheral Instance 16 4001 0000 WDT 17 4001 1000 RTC1 18 4001 2000 QDEC Quadrature decoder 19 4001 3000 LPCOMP, COMP 20 4001 4000 SWI0 Software interrupt EGU0 Event generator unit 21 4001 5000 EGU1, SWI1 22 4001 6000 EFU2, SWI2 23 4001 7000 EGU3, SWi3 24 4001 8000 EGU4, SWI4 25 4001 9000 EGU5, SWI4 26 4001 A000 TIMER3 27 4001 B000 TIMER4 28 4001 C000 PWM0 29 4001 D000 PDM Pulse-Density Modulation (digital microphone interface) 30 4001 E000 NVMC 31 4001 F000 PPI

ID Base Address Peripheral Instance 32 4002 0000 MWU 33 4002 1000 PWM1 34 4002 2000 PWM2 35 4002 3000 SPI2, SPIS2, SPIM2 36 4002 4000 RTC2 37 4002 5000 I2S 38 4002 6000 FPU 0 5000 0000 GPIO, P0

WDT §40 RWS Nordic RWS
mem32 40010400 1	1 running	Example 00000001
40010504	Counter Reload Value	Example 012C0000
4001050C	01 run while sleep 10 run while debugging	Example 00000001 Run while sleep, not while debugging

FIELDDETECTED, FIELDLOST

NFC §42
40005404	ERRORSTATUS Error Status register
40005504	FRAMEDELAYMIN	Minimum frame delay
40005590	NFCID1_LAST Last NFCID1 part	(4, 7 or 10 bytes ID)
40005594		7 or 10 bytes ID
40005598		10 bytes ID
40005FFC	power??	nrfx_nfc

IPSR 0 = Thread mode 2 = NMI 3 = HardFault 4 = MemManage 5 = BusFault 6 = UsageFault 11 = SVCall 14 = PendSV 15 = SysTick 16 = IRQ0 . n+15 = IRQ(n-1)[a].

ISR

From version 1.2.x See nRF52.h mem32 1F000,64 0001 F000 = 20010000 00028A6D 00028A95 00028A97 0001 F010 = 00028A99 00028A9B 00028A9D 00000000 0001 F020 = 00000000 00000000 00000000 00028A9F 0001 F030 = 00028AA1 00000000 00028AA3 00028AA5 0001 F040 = 0002489D 00028AA7 00028AA7 00025421 0001 F050 = 00028AA7 00028491 00024CD5 00025831 0001 F060 = 000254B9 00025581 00025649 00028AA7 0001 F070 = 00028AA7 00024F9D 00028AA7 00028AA7 0001 F080 = 00023359 00027445 00028AA7 00028AA7 0001 F090 = 00027509 00028AA7 000289ED 00028AA7 0001 F0A0 = 00028AA7 00028AA7 00025711 0002821D 0001 F0B0 = 00028AA7 00028AA7 00000000 00000000 0001 F0C0 = 00028AA7 00028AA7 00028AA7 00028AA7 0001 F0D0 = 00025079 00028AA7 00028AA7 00000000 0001 F0E0 = 00000000 00000000 00000000 00000000

nRF52 has no means of detecting stack overflow.
Use Memory Watch Unit (MWU) to implement stack overflow detection.

Master Boot Record Param Page

0007 F000 = 699C5732 00000002 00000001 00000001 
0007 F010 = 00000000 00000000 000262A0 4CA0A93F  0 0   _start  ? 
0007 F020 = 00000001 00000000 00000000 00000000 
0007 F030 = 00000000 00000000 00000000 00000000 
0007 F040 = 00000000 00000000 00000000 00000000 
0007 F050 = 00000000 00000000 00000000 FFFFFFFF 
…
0007 F250 = FFFFFFFF FFFFFFFF FFFFFFFF 0F25ED9A 
0007 F260 = FFFFFF00 FFFFFFFF FFFFFFFF FFFFFFFF 
0007 F270 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 
0007 F280 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 
0007 F290 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 
0007 F2A0 = A93F01FF FFFF4CA0 FFFFFFFF FFFFFFFF 
0007 F2B0 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 
0007 F2C0 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 
0007 F2D0 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 
0007 F2E0 = FF00FFFF FFFFFFFF FFFFFFFF FFFFFFFF 

0007 E000 - duplicate of 0007 F000 - 0007 FFFF

Keil ARM compiler