Nordic Semiconductor deprecated the nRF5 SDK in favor of the nRF Connect SDK (NCS), but provides no official DFU path to migrate already-shipped devices over BLE. This post details a practical workaround for the nRF52840 using external SPI flash. The approach involves: DFU-ing a modified nRF5 bootloader that disables ACL flash protection, creating a custom BLE service to stream a merged NCS binary (MCUBoot + application) into external SPI flash, then executing RAM-resident code with interrupts disabled to erase internal flash and copy the new image starting at address 0. Key implementation details include using GCC's section attribute to relocate code to RAM, polling-based NVMC writes, XIP memory-mapped access to QSPI flash, and disabling IRQs before erasing interrupt vectors. The method has been confirmed working on both nRF52840 and nRF52833.
