DFU on custom board, memory problem


Currently, I'm trying to flash my custom board that has nRF52832 with an uart application that I integrated buttonless DFU. I'm running into a problem where when I try to flash my hex file that has the following combination :

  • Softdevice
  • Bootloader
  • Application
  • Bootloader setting

I got the following error :

"ERROR: The file specified is not a valid hex file, has data outside valid areas"

"ERROR: or does not have data in valid areas."

From what I understand, it is an error on the memory side where my program might have passed its limit. But I don't know how to fix it. I'm not sure the type of model of my nRF52832, but on nRF Connect, it says that it is NRF52832_xxAB_REV1, Core RAM: 32KiB and Core ROM: 256KiB in pages of 4KiB. I'm using SES with SDK 16.0.0

  • Hello,

    I see. You have the small version of the nRF52832, and I suspect that both the bootloader and the bootloader settings page hex files are configured for the 512 variant (not the 256 variant).

    If you try to flash only the bootloader or only the bootloader settings file without merging them, does it give the same message?

    Go to your project settings for the bootloader, and change all the start addresses according to your flash size. The range of the flash is:

    512kB variant: 0x0000 0000 -> 0x0008 0000

    256kB variant: 0x0000 0000 -> 0x0004 0000

    So what you need to do is to change the bootloader start address to move all the flash placement settings to match your flash size. 

    Most important are the settings in Section Placement Macros:

    And you can also change the settings in Memory Segments:

    Then you may need to edit your section placement macros in the flash_placement.xml file, mainly the "bootloader_settings_page" and "mbr_params_page". You find this file by right clicking your project from the project explorer in SES, and select "Edit Section Placement".

    Then you need to set the correct size for your bootloader settings file. This is done when you generate them:

    >nrfutil settings generate --help
    Usage: nrfutil settings generate [OPTIONS] HEX_FILE
      --family [NRF51|NRF52|NRF52QFAB|NRF52810|NRF52840]
                                      nRF IC family: NRF51 or NRF52 or NRF52QFAB
                                      or NRF52810 or NRF52840  [required]
      --application TEXT              The application firmware file. This can be
                                      omitted ifthe target IC does not contain an
                                      application in flash.Requires --application-
                                      version or --application-version-string.
      --application-version INTEGER   The application version.
      --application-version-string TEXT
                                      The application version string, e.g.
                                      "2.7.31". Will be converted to an integer,
                                      e.g. 207031.
      --bootloader-version INTEGER    The bootloader version.  [required]
      --bl-settings-version INTEGER   The Bootloader settings version.Defined in
                                      nrf_dfu_types.h, the following apply to
                                      released SDKs:
                                      |SDK12.0.0 - SDK15.2.0|1|
                                      |SDK15.3.0 -          |2|  [required]
      --start-address INTEGER         Custom start address for the settings page.
                                      If not specified, then the last page of the
                                      flash is used.
      --no-backup                     Do not overwrite DFU settings backup page.
                                      If not specified, than the resulting .hex
                                      file will contain a copy of DFU settings,
                                      that will overwrite contents of DFU settings
                                      backup page.
      --backup-address INTEGER        Address of the DFU settings backup page
                                      inside flash. By default, the backup page
                                      address is placed one page below DFU
                                      settings. The value is precalculated based
                                      on configured settings address
                                      (<DFU_settings_address> - 0x1000).
                                      The method of boot validation for
                                      The method of boot validation for
      --softdevice FILE               The SoftDevice firmware file. Must be given
                                      if SD Boot Validation is used.
      --key-file FILE                 The private (signing) key in PEM format.
                                      Needed for ECDSA Boot Validation.
      --help                          Show this message and exit.

    Try to use the --family NRF52QDAB option, and it will put the start address for this file to 0x0003F000 instead of 0x0007F000.

    Best regards,


  • Hello,

    I did some changes to my bootloader's Section Placement Macros as following :

    I only changed the FLASH_PH_SIZE and FLASH_START. I did not make any changes to Memory Segments and flash_placement.xml file as I'm not sure what and how exactly to modify it into. So I would like your recommendation on what these modifications should be, please. Then I tried to reflash the program with the new setting for the bootloader and there was no more error but our custom board does not seem to be working. Nothing was advertising.

    A weird remark I notice was, I flashed my custom board with the bootloader with the default setting as shown in the following image :

    nRF Connect managed to see the custom board advertising DFUTarg and I was able to DFU the custom board with my uart application that was integrated with buttonless DFU.

  • Fikri Saman said:
    I modified the bootloader_debug with the settings that you sent me before and got the following errors :

     What does your flash_placement.xml look like? And what does your project settings->Code->build->memory Segments setting look like? And what does your project settings->Code->linker->Section Placement Macros look like?

    And for the two last ones, remember to select "Common" before checking them:


    Fikri Saman said:
    I don't think I understand what you're demanding. Are you asking about my custom board or the equipment I used to program my custom board?

     I am asking about your custom board. Does it contain an LFXTAL? That would be the X2 in this figure:

    To run a debug session:

    If you set NRF_FPRINTF_FLAG_AUTOMATIC_CR_ON_LF_ENABLED to 0 in sdk_config, you will get the RTT output in Segger Embedded Studio.

    Best regards,


  • Here are my Section Placement Macros :

    My flash_placement.xml :

    <!DOCTYPE Linker_Placement_File>
    <Root name="Flash Section Placement">
      <MemorySegment name="FLASH" start="$(FLASH_PH_START)" size="$(FLASH_PH_SIZE)">
        <ProgramSection load="no" name=".reserved_flash" start="$(FLASH_PH_START)" size="$(FLASH_START)-$(FLASH_PH_START)" />
        <ProgramSection alignment="0x100" load="Yes" name=".vectors" start="$(FLASH_START)" />
        <ProgramSection alignment="4" load="Yes" name=".init" />
        <ProgramSection alignment="4" load="Yes" name=".init_rodata" />
        <ProgramSection alignment="4" load="Yes" name=".text" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".crypto_data" inputsections="*(SORT(.crypto_data*))" address_symbol="__start_crypto_data" end_symbol="__stop_crypto_data" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".nrf_queue" inputsections="*(.nrf_queue*)" address_symbol="__start_nrf_queue" end_symbol="__stop_nrf_queue" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".dfu_trans" inputsections="*(SORT(.dfu_trans*))" address_symbol="__start_dfu_trans" end_symbol="__stop_dfu_trans" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".svc_data" inputsections="*(.svc_data*)" address_symbol="__start_svc_data" end_symbol="__stop_svc_data" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_const_data" inputsections="*(SORT(.log_const_data*))" address_symbol="__start_log_const_data" end_symbol="__stop_log_const_data" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".nrf_balloc" inputsections="*(.nrf_balloc*)" address_symbol="__start_nrf_balloc" end_symbol="__stop_nrf_balloc" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_backends" inputsections="*(SORT(.log_backends*))" address_symbol="__start_log_backends" end_symbol="__stop_log_backends" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_ble_observers" inputsections="*(SORT(.sdh_ble_observers*))" address_symbol="__start_sdh_ble_observers" end_symbol="__stop_sdh_ble_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_state_observers" inputsections="*(SORT(.sdh_state_observers*))" address_symbol="__start_sdh_state_observers" end_symbol="__stop_sdh_state_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_stack_observers" inputsections="*(SORT(.sdh_stack_observers*))" address_symbol="__start_sdh_stack_observers" end_symbol="__stop_sdh_stack_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_req_observers" inputsections="*(SORT(.sdh_req_observers*))" address_symbol="__start_sdh_req_observers" end_symbol="__stop_sdh_req_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_soc_observers" inputsections="*(SORT(.sdh_soc_observers*))" address_symbol="__start_sdh_soc_observers" end_symbol="__stop_sdh_soc_observers" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".nrf_sections" address_symbol="__start_nrf_sections" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_dynamic_data"  inputsections="*(SORT(.log_dynamic_data*))" runin=".log_dynamic_data_run"/>
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_filter_data"  inputsections="*(SORT(.log_filter_data*))" runin=".log_filter_data_run"/>
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".fs_data"  inputsections="*(.fs_data*)" runin=".fs_data_run"/>
        <ProgramSection alignment="4" load="Yes" name=".dtors" />
        <ProgramSection alignment="4" load="Yes" name=".ctors" />
        <ProgramSection alignment="4" load="Yes" name=".rodata" />
        <ProgramSection alignment="4" load="Yes" name=".ARM.exidx" address_symbol="__exidx_start" end_symbol="__exidx_end" />
        <ProgramSection alignment="4" load="Yes" runin=".fast_run" name=".fast" />
        <ProgramSection alignment="4" load="Yes" runin=".data_run" name=".data" />
        <ProgramSection alignment="4" load="Yes" runin=".tdata_run" name=".tdata" />
      <MemorySegment name="RAM" start="$(RAM_PH_START)" size="$(RAM_PH_SIZE)">
        <ProgramSection load="no" name=".reserved_ram" start="$(RAM_PH_START)" size="$(RAM_START)-$(RAM_PH_START)" />
        <ProgramSection alignment="0x100" load="No" name=".vectors_ram" start="$(RAM_START)" address_symbol="__app_ram_start__"/>
        <ProgramSection alignment="4" keep="Yes" load="No" name=".nrf_sections_run" address_symbol="__start_nrf_sections_run" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".log_dynamic_data_run" address_symbol="__start_log_dynamic_data" end_symbol="__stop_log_dynamic_data" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".log_filter_data_run" address_symbol="__start_log_filter_data" end_symbol="__stop_log_filter_data" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".fs_data_run" address_symbol="__start_fs_data" end_symbol="__stop_fs_data" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".nrf_sections_run_end" address_symbol="__end_nrf_sections_run" />
        <ProgramSection alignment="4" load="No" name=".fast_run" />
        <ProgramSection alignment="4" load="No" name=".data_run" />
        <ProgramSection alignment="4" load="No" name=".tdata_run" />
        <ProgramSection alignment="4" load="No" name=".bss" />
        <ProgramSection alignment="4" load="No" name=".tbss" />
        <ProgramSection alignment="4" load="No" name=".non_init" />
        <ProgramSection alignment="4" size="__HEAPSIZE__" load="No" name=".heap" />
        <ProgramSection alignment="8" size="__STACKSIZE__" load="No" place_from_segment_end="Yes" name=".stack"  address_symbol="__StackLimit" end_symbol="__StackTop"/>
        <ProgramSection alignment="8" size="__STACKSIZE_PROCESS__" load="No" name=".stack_process" />
      <MemorySegment name="bootloader_settings_page" start="0x0003F000" size="0x1000">
        <ProgramSection alignment="4" keep="Yes" load="No" name=".bootloader_settings_page" address_symbol="__start_bootloader_settings_page" end_symbol="__stop_bootloader_settings_page" start = "0x0003F000" size="0x1000" />
      <MemorySegment name="mbr_params_page" start="0x0003E000" size="0x1000">
        <ProgramSection alignment="4" keep="Yes" load="No" name=".mbr_params_page" address_symbol="__start_mbr_params_page" end_symbol="__stop_mbr_params_page" start = "0x0003E000" size="0x1000" />
      <MemorySegment name="uicr_bootloader_start_address" start="0x10001014" size="0x4">
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".uicr_bootloader_start_address" address_symbol="__start_uicr_bootloader_start_address" end_symbol="__stop_uicr_bootloader_start_address" start = "0x10001014" size="0x4" />
      <MemorySegment name="uicr_mbr_params_page" start="0x10001018" size="0x4">
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".uicr_mbr_params_page" address_symbol="__start_uicr_mbr_params_page" end_symbol="__stop_uicr_mbr_params_page" start = "0x10001018" size="0x4" />

    My memory segments :

    FLASH RX 0x0 0x40000;RAM RWX 0x20000000 0x8000;uicr_bootloader_start_address RX 0x10001014 0x4;bootloader_settings_page RX 0x0003F000 0x1000;uicr_mbr_params_page RX 0x10001018 0x4;mbr_params_page RX 0x0003E000 0x1000

    They are all the same as the ones you sent me before and yet I still have these errors :

    Does it contain an LFXTAL?

    Yes, it does contain an LFXTAL.

    Concerning the debug session, if I run a debug session, wouldn't it erase the current program on my custom board? And which program do I have to run the debug session since there are the bootloader and the main application on my custom board

  • pca10040_s132_ble_debug_256k.zip

    Try this one. I did not change anything but the three things I mentioned in the previous reply. flash_placement.xml, build->memory segments, and linker->Section placement macros.

    In SES it is possible to attach the debugger if the .hex file is already flashed. Try to do this. To do so, try to use (toolbar->) Target -> Attach Debugger. If you do this, SES will not program anything.

    However, I suspect that you will run into some issues. Looking at the placement of the files, it looks like there is not enough RAM to run your application:

    The application uses 42.4kB RAM, and your nRF52 only has 32kB. This is the case for the previous (non _debug) project I sent as well. It uses 33.8kB (close, but still more than 32kB.

    It looks like the bootloader from SDK16 is too large for the 256/32 variant of the nRF52832.

    Perhaps you should consider moving to the 512/64 version?

    Alternatively, see if you can port the pca10040e bootloader project. It only uses 20kB of RAM, but you need to change it to using the S132 if that is what you are using.



  • However, I suspect that you will run into some issues. Looking at the placement of the files, it looks like there is not enough RAM to run your application:

    Yes, you are correct. I got these errors :

    <warning> app: Aborting. Cannot fit new firmware on device
    <error> nrf_dfu_validation: Can't find room for update

    Alternatively, see if you can port the pca10040e bootloader project. It only uses 20kB of RAM, but you need to change it to using the S132 if that is what you are using.

    I'm not sure if my porting was correct, but here is what I did. I changed s112 to s132 in Code->Preprocessor->Preprocessor Definitions. Then I changed the header files in User Include Directories :

    • ../../../../../components/softdevice/s132/headers
    • ../../../../../components/softdevice/s132/headers/nrf52

    I flashed and did a debug session on the bootloader, tried to update it with the main application got the following problem :

    <info> app: Inside main
    <debug> app: In nrf_bootloader_init
    <debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
    <debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
    <warning> nrf_dfu_settings: Resetting bootloader settings since neither the settings page nor the backup are valid (CRC error).
    <debug> nrf_dfu_settings: Writing settings...
    <debug> nrf_dfu_settings: Erasing old settings at: 0x0002F000
    <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0002F000, len=1 pages), queue usage: 0
    <debug> nrf_dfu_flash: Flash erase success: addr=0x0002F000, pending 0
    <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002F000, src=0x200040AC, len=896 bytes), queue usage: 1
    <debug> nrf_dfu_flash: Flash write success: addr=0x0002F000, pending 0
    <info> nrf_dfu_settings: Backing up settings page to address 0x2E000.
    <debug> nrf_dfu_settings: Writing settings...
    <debug> nrf_dfu_settings: Erasing old settings at: 0x0002E000
    <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0002E000, len=1 pages), queue usage: 1
    <debug> nrf_dfu_flash: Flash erase success: addr=0x0002E000, pending 0
    <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002E000, src=0x2000442C, len=896 bytes), queue usage: 1
    <debug> nrf_dfu_flash: Flash write success: addr=0x0002E000, pending 0
    <debug> app: Enter nrf_bootloader_fw_activate
    <info> app: No firmware to activate.
    <info> app: Boot validation failed. No valid app to boot.
    <debug> app: DFU mode because app is not valid.
    <info> nrf_bootloader_wdt: WDT is not enabled
    <debug> app: in weak nrf_dfu_init_user
    <debug> app: timer_stop (0x200022E4)
    <debug> app: timer_activate (0x200022E4)
    <info> app: Entering DFU mode.
    <debug> app: Initializing transports (found: 1)
    <debug> nrf_dfu_ble: Initializing BLE DFU transport
    <debug> nrf_dfu_ble: Setting up vector table: 0x00022000
    <debug> nrf_dfu_ble: Enabling SoftDevice.
    <debug> nrf_dfu_ble: Configuring BLE stack.
    <debug> nrf_dfu_ble: Enabling the BLE stack.
    <debug> nrf_dfu_ble: No advertising name found
    <debug> nrf_dfu_ble: Using default advertising name
    <debug> nrf_dfu_ble: Advertising...
    <debug> nrf_dfu_ble: BLE DFU transport initialized.
    <debug> nrf_dfu_flash: Initializing nrf_fstorage_sd backend.
    <debug> app: Enter main loop
    <debug> nrf_dfu_ble: Connected
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 12
    <debug> nrf_dfu_ble: min_conn_interval: 12
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 600
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 6
    <debug> nrf_dfu_ble: min_conn_interval: 6
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 500
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 12
    <debug> nrf_dfu_ble: min_conn_interval: 12
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 600
    <debug> nrf_dfu_ble: Received BLE_GATTS_EVT_EXCHANGE_MTU_REQUEST (request: 517, reply: 247).
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (command)
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_ble: Set receipt notif
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_RECEIPT_NOTIF_SET
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> app: Shutting down transports (found: 1)
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)
    <debug> app: timer_stop (0x200022E4)
    <debug> app: timer_activate (0x200022E4)
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_ble: Buffer 0x20003010 acquired, len 141 (244)
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (command)
    <debug> nrf_dfu_ble: Freeing buffer 0x20003010
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (command)
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (command)
    <debug> nrf_dfu_validation: PB: Init packet data len: 64
    <info> nrf_dfu_validation: Signature required. Checking signature.
    <info> nrf_dfu_validation: Calculating hash (len: 64)
    <info> nrf_dfu_validation: Verify signature
    <info> nrf_dfu_validation: Image verified
    <warning> nrf_dfu_ver_validation: SD req not met.
    <warning> nrf_dfu_validation: Prevalidation failed.
    <debug> nrf_dfu_validation: Init command:
    <debug> nrf_dfu_validation:  08 00 10 34 1A 02 CB 01|...4....
    <debug> nrf_dfu_validation:  20 00 28 00 30 00 38 E8| .(.0.8.
    <debug> nrf_dfu_validation:  A4 02 42 24 08 03 12 20|..B$... 
    <debug> nrf_dfu_validation:  A1 A0 1E 6C 6E 4B 18 64|...lnK.d
    <debug> nrf_dfu_validation:  19 B2 A3 53 3F C0 4C 84|...S?.L.
    <debug> nrf_dfu_validation:  0F 04 F1 15 A0 DD 21 2B|......!+
    <debug> nrf_dfu_validation:  15 92 BB 11 6B AB DF DB|....k...
    <debug> nrf_dfu_validation:  48 00 52 04 08 01 12 00|H.R.....
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0xB
    <warning> nrf_dfu_ble: DFU request 4 failed with error: 0xB
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 6
    <debug> nrf_dfu_ble: min_conn_interval: 6
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 500
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 12
    <debug> nrf_dfu_ble: min_conn_interval: 12
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 600

Reply Children