DFU on custom board, memory problem


Currently, I'm trying to flash my custom board that has nRF52832 with an uart application that I integrated buttonless DFU. I'm running into a problem where when I try to flash my hex file that has the following combination :

  • Softdevice
  • Bootloader
  • Application
  • Bootloader setting

I got the following error :

"ERROR: The file specified is not a valid hex file, has data outside valid areas"

"ERROR: or does not have data in valid areas."

From what I understand, it is an error on the memory side where my program might have passed its limit. But I don't know how to fix it. I'm not sure the type of model of my nRF52832, but on nRF Connect, it says that it is NRF52832_xxAB_REV1, Core RAM: 32KiB and Core ROM: 256KiB in pages of 4KiB. I'm using SES with SDK 16.0.0

  • Hello,

    I see. You have the small version of the nRF52832, and I suspect that both the bootloader and the bootloader settings page hex files are configured for the 512 variant (not the 256 variant).

    If you try to flash only the bootloader or only the bootloader settings file without merging them, does it give the same message?

    Go to your project settings for the bootloader, and change all the start addresses according to your flash size. The range of the flash is:

    512kB variant: 0x0000 0000 -> 0x0008 0000

    256kB variant: 0x0000 0000 -> 0x0004 0000

    So what you need to do is to change the bootloader start address to move all the flash placement settings to match your flash size. 

    Most important are the settings in Section Placement Macros:

    And you can also change the settings in Memory Segments:

    Then you may need to edit your section placement macros in the flash_placement.xml file, mainly the "bootloader_settings_page" and "mbr_params_page". You find this file by right clicking your project from the project explorer in SES, and select "Edit Section Placement".

    Then you need to set the correct size for your bootloader settings file. This is done when you generate them:

    >nrfutil settings generate --help
    Usage: nrfutil settings generate [OPTIONS] HEX_FILE
      --family [NRF51|NRF52|NRF52QFAB|NRF52810|NRF52840]
                                      nRF IC family: NRF51 or NRF52 or NRF52QFAB
                                      or NRF52810 or NRF52840  [required]
      --application TEXT              The application firmware file. This can be
                                      omitted ifthe target IC does not contain an
                                      application in flash.Requires --application-
                                      version or --application-version-string.
      --application-version INTEGER   The application version.
      --application-version-string TEXT
                                      The application version string, e.g.
                                      "2.7.31". Will be converted to an integer,
                                      e.g. 207031.
      --bootloader-version INTEGER    The bootloader version.  [required]
      --bl-settings-version INTEGER   The Bootloader settings version.Defined in
                                      nrf_dfu_types.h, the following apply to
                                      released SDKs:
                                      |SDK12.0.0 - SDK15.2.0|1|
                                      |SDK15.3.0 -          |2|  [required]
      --start-address INTEGER         Custom start address for the settings page.
                                      If not specified, then the last page of the
                                      flash is used.
      --no-backup                     Do not overwrite DFU settings backup page.
                                      If not specified, than the resulting .hex
                                      file will contain a copy of DFU settings,
                                      that will overwrite contents of DFU settings
                                      backup page.
      --backup-address INTEGER        Address of the DFU settings backup page
                                      inside flash. By default, the backup page
                                      address is placed one page below DFU
                                      settings. The value is precalculated based
                                      on configured settings address
                                      (<DFU_settings_address> - 0x1000).
                                      The method of boot validation for
                                      The method of boot validation for
      --softdevice FILE               The SoftDevice firmware file. Must be given
                                      if SD Boot Validation is used.
      --key-file FILE                 The private (signing) key in PEM format.
                                      Needed for ECDSA Boot Validation.
      --help                          Show this message and exit.

    Try to use the --family NRF52QDAB option, and it will put the start address for this file to 0x0003F000 instead of 0x0007F000.

    Best regards,


  • Hello,

    I did some changes to my bootloader's Section Placement Macros as following :

    I only changed the FLASH_PH_SIZE and FLASH_START. I did not make any changes to Memory Segments and flash_placement.xml file as I'm not sure what and how exactly to modify it into. So I would like your recommendation on what these modifications should be, please. Then I tried to reflash the program with the new setting for the bootloader and there was no more error but our custom board does not seem to be working. Nothing was advertising.

    A weird remark I notice was, I flashed my custom board with the bootloader with the default setting as shown in the following image :

    nRF Connect managed to see the custom board advertising DFUTarg and I was able to DFU the custom board with my uart application that was integrated with buttonless DFU.

  • Oh, I didn't catch that it was a separate issue. So where did you want to place the bootloader? Did you try to move it to where you want it? Looks like you can move it something like 0x9000 up. Did you try to do so?

  • With the following configurations, the bootloader used up about 35.4kB of RAM, which does not leave me enough space for my application :


    Flash placement : 

    <!DOCTYPE Linker_Placement_File>
    <Root name="Flash Section Placement">
      <MemorySegment name="FLASH" start="$(FLASH_PH_START)" size="$(FLASH_PH_SIZE)">
        <ProgramSection load="no" name=".reserved_flash" start="$(FLASH_PH_START)" size="$(FLASH_START)-$(FLASH_PH_START)" />
        <ProgramSection alignment="0x100" load="Yes" name=".vectors" start="$(FLASH_START)" />
        <ProgramSection alignment="4" load="Yes" name=".init" />
        <ProgramSection alignment="4" load="Yes" name=".init_rodata" />
        <ProgramSection alignment="4" load="Yes" name=".text" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".crypto_data" inputsections="*(SORT(.crypto_data*))" address_symbol="__start_crypto_data" end_symbol="__stop_crypto_data" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".nrf_queue" inputsections="*(.nrf_queue*)" address_symbol="__start_nrf_queue" end_symbol="__stop_nrf_queue" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".dfu_trans" inputsections="*(SORT(.dfu_trans*))" address_symbol="__start_dfu_trans" end_symbol="__stop_dfu_trans" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".svc_data" inputsections="*(.svc_data*)" address_symbol="__start_svc_data" end_symbol="__stop_svc_data" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_const_data" inputsections="*(SORT(.log_const_data*))" address_symbol="__start_log_const_data" end_symbol="__stop_log_const_data" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".nrf_balloc" inputsections="*(.nrf_balloc*)" address_symbol="__start_nrf_balloc" end_symbol="__stop_nrf_balloc" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_backends" inputsections="*(SORT(.log_backends*))" address_symbol="__start_log_backends" end_symbol="__stop_log_backends" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_ble_observers" inputsections="*(SORT(.sdh_ble_observers*))" address_symbol="__start_sdh_ble_observers" end_symbol="__stop_sdh_ble_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_state_observers" inputsections="*(SORT(.sdh_state_observers*))" address_symbol="__start_sdh_state_observers" end_symbol="__stop_sdh_state_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_stack_observers" inputsections="*(SORT(.sdh_stack_observers*))" address_symbol="__start_sdh_stack_observers" end_symbol="__stop_sdh_stack_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_req_observers" inputsections="*(SORT(.sdh_req_observers*))" address_symbol="__start_sdh_req_observers" end_symbol="__stop_sdh_req_observers" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".sdh_soc_observers" inputsections="*(SORT(.sdh_soc_observers*))" address_symbol="__start_sdh_soc_observers" end_symbol="__stop_sdh_soc_observers" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".nrf_sections" address_symbol="__start_nrf_sections" />
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_dynamic_data"  inputsections="*(SORT(.log_dynamic_data*))" runin=".log_dynamic_data_run"/>
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".log_filter_data"  inputsections="*(SORT(.log_filter_data*))" runin=".log_filter_data_run"/>
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".fs_data"  inputsections="*(.fs_data*)" runin=".fs_data_run"/>
        <ProgramSection alignment="4" load="Yes" name=".dtors" />
        <ProgramSection alignment="4" load="Yes" name=".ctors" />
        <ProgramSection alignment="4" load="Yes" name=".rodata" />
        <ProgramSection alignment="4" load="Yes" name=".ARM.exidx" address_symbol="__exidx_start" end_symbol="__exidx_end" />
        <ProgramSection alignment="4" load="Yes" runin=".fast_run" name=".fast" />
        <ProgramSection alignment="4" load="Yes" runin=".data_run" name=".data" />
        <ProgramSection alignment="4" load="Yes" runin=".tdata_run" name=".tdata" />
      <MemorySegment name="RAM" start="$(RAM_PH_START)" size="$(RAM_PH_SIZE)">
        <ProgramSection load="no" name=".reserved_ram" start="$(RAM_PH_START)" size="$(RAM_START)-$(RAM_PH_START)" />
        <ProgramSection alignment="0x100" load="No" name=".vectors_ram" start="$(RAM_START)" address_symbol="__app_ram_start__"/>
        <ProgramSection alignment="4" keep="Yes" load="No" name=".nrf_sections_run" address_symbol="__start_nrf_sections_run" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".log_dynamic_data_run" address_symbol="__start_log_dynamic_data" end_symbol="__stop_log_dynamic_data" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".log_filter_data_run" address_symbol="__start_log_filter_data" end_symbol="__stop_log_filter_data" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".fs_data_run" address_symbol="__start_fs_data" end_symbol="__stop_fs_data" />
        <ProgramSection alignment="4" keep="Yes" load="No" name=".nrf_sections_run_end" address_symbol="__end_nrf_sections_run" />
        <ProgramSection alignment="4" load="No" name=".fast_run" />
        <ProgramSection alignment="4" load="No" name=".data_run" />
        <ProgramSection alignment="4" load="No" name=".tdata_run" />
        <ProgramSection alignment="4" load="No" name=".bss" />
        <ProgramSection alignment="4" load="No" name=".tbss" />
        <ProgramSection alignment="4" load="No" name=".non_init" />
        <ProgramSection alignment="4" size="__HEAPSIZE__" load="No" name=".heap" />
        <ProgramSection alignment="8" size="__STACKSIZE__" load="No" place_from_segment_end="Yes" name=".stack"  address_symbol="__StackLimit" end_symbol="__StackTop"/>
        <ProgramSection alignment="8" size="__STACKSIZE_PROCESS__" load="No" name=".stack_process" />
      <MemorySegment name="mbr_params_page" start="0x0003E000" size="0x1000">
        <ProgramSection alignment="4" keep="Yes" load="No" name=".mbr_params_page" address_symbol="__start_mbr_params_page" end_symbol="__stop_mbr_params_page" start = "0x0003E000" size="0x1000" />
      <MemorySegment name="bootloader_settings_page" start="0x0003F000" size="0x1000">
        <ProgramSection alignment="4" keep="Yes" load="No" name=".bootloader_settings_page" address_symbol="__start_bootloader_settings_page" end_symbol="__stop_bootloader_settings_page" start = "0x0003F000" size="0x1000" />
      <MemorySegment name="uicr_bootloader_start_address" start="0x10001014" size="0x4">
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".uicr_bootloader_start_address" address_symbol="__start_uicr_bootloader_start_address" end_symbol="__stop_uicr_bootloader_start_address" start = "0x10001014" size="0x4" />
      <MemorySegment name="uicr_mbr_params_page" start="0x10001018" size="0x4">
        <ProgramSection alignment="4" keep="Yes" load="Yes" name=".uicr_mbr_params_page" address_symbol="__start_uicr_mbr_params_page" end_symbol="__stop_uicr_mbr_params_page" start = "0x10001018" size="0x4" />

    Before any changes were made, it only uses, as you said, 20kB of RAM. Is it because due to the changing of softdevice that causes it to increase? 

  • We are really short staffed in support due to summer holidays. Can you please  try running this on a DK with full flash and RAM to make sure that everything else is working before you take on the smaller variant?

    Some of it is probably because of the increased RAM by the softdevice yes. 


    Fikri Saman said:
    I was able to compile and build the project. I also managed to flash it on my custom board. But the placement of the bootloader will cause some trouble.

     What trouble are you actually having?

  • try running this on a DK with full flash and RAM

    I ran the original bootloader (PCA10040E S112 debug) on my nRF52832 DK and it was working well. Though I am not sure what you mean by full flash and RAM but here is what the memory layout looks like : 

     What trouble are you actually having?

    I flashed the PCA10040E debug version that I modified to use S132 on my DK and this is the memory layout : 

    It seems to me that there is not enough space for my main application. Here is what I got when I tried to DFU my main application : 

    <info> app: Inside main
    <debug> app: In nrf_bootloader_init
    <debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
    <debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
    <warning> nrf_dfu_settings: Resetting bootloader settings since neither the settings page nor the backup are valid (CRC error).
    <debug> nrf_dfu_settings: Writing settings...
    <debug> nrf_dfu_settings: Erasing old settings at: 0x0003F000
    <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0003F000, lending 0
    ding 0
    <info> nrf_dfu_settings: Backing up settings page to address 0x3E000.
    <debug> nrf_dfu_settings: Writing settings...
    <debug> nrf_dfu_settings: Erasing old settings at: 0x0003E000
    <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0003E000, len=1 pages), queue usage: 1
    <debug> nrf_dfu_flash: Flash erase success: addr=0x0003E000, pending 0
    <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0003E000, src=0x20007ACC, len=896 bytes), queue usage: 1
    ding 0
    <info> app: Entering DFU mode.
    <debug> app: Initializing transports (found: 1)
    <debug> nrf_dfu_ble: Initializing BLE DFU transport
    <debug> nrf_dfu_ble: Setting up vector table: 0x00031000
    <debug> nrf_dfu_ble: Enabling SoftDevice.
    <debug> nrf_dfu_ble: Configuring BLE stack.
    <debug> nrf_dfu_ble: Enabling the BLE stack.
    <debug> nrf_dfu_ble: No advertising name found
    <debug> nrf_dfu_ble: Using default advertising name
    <debug> nrf_dfu_ble: Advertising...
    <debug> app: Enter main loop
    <debug> nrf_dfu_ble: Connected
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 12
    <debug> nrf_dfu_ble: min_conn_interval: 12
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 600
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 6
    <debug> nrf_dfu_ble: min_conn_interval: 6
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 500
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 12
    <debug> nrf_dfu_ble: min_conn_interval: 12
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 600
    <debug> nrf_dfu_ble: Received BLE_GATTS_EVT_EXCHANGE_MTU_REQUEST (request: 517, reply: 247).
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_DATA_LENGTH_UPDATE_REQUEST.
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_DATA_LENGTH_UPDATE (251, max_rx_time 2120).
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (command)
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_ble: Set receipt notif
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_RECEIPT_NOTIF_SET
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> app: Shutting down transports (found: 1)
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)
    <debug> app: timer_stop (0x20005984)
    <debug> app: timer_activate (0x20005984)
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_ble: Buffer 0x200066B0 acquired, len 141 (244)
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (command)
    <debug> nrf_dfu_ble: Freeing buffer 0x200066B0
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (command)
    <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
    <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (command)
    <debug> nrf_dfu_validation: PB: Init packet data len: 64
    <info> nrf_dfu_validation: Signature required. Checking signature.
    <info> nrf_dfu_validation: Calculating hash (len: 64)
    <info> nrf_dfu_validation: Verify signature
    <info> nrf_dfu_validation: Image verified
    <debug> app: Enter nrf_dfu_cache_prepare()
    <debug> app: required_size: 0x9268.
    <debug> app: single_bank: false.
    <debug> app: keep_app: false.
    <debug> app: pass: 0.
    <debug> app: cache_address: 0x26000.
    <debug> app: cache_too_small: true.
    <debug> app: keep_firmware: false.
    <debug> app: delete_more: true.
    <debug> app: pass: 1.
    <debug> app: cache_address: 0x26000.
    <debug> app: cache_too_small: true.
    <debug> app: keep_firmware: true.
    <warning> nrf_dfu_ble: DFU request 4 failed with error: 0x4
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 6
    <debug> nrf_dfu_ble: min_conn_interval: 6
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 500
    <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
    <debug> nrf_dfu_ble: max_conn_interval: 12
    <debug> nrf_dfu_ble: min_conn_interval: 12
    <debug> nrf_dfu_ble: slave_latency: 0
    <debug> nrf_dfu_ble: conn_sup_timeout: 600

  • Then there is not enough space to run on the small chip. I am sorry. You need to use the big version, or use a smaller application and an older SDK that has a smaller bootloader. There is nothing more we can do about this.

Reply Children