telink_zigbee_ble_concurrent_sdk-2.4.1.0 issue

TL_HUANLI

I added the blc\_smp\_setSecurityParameters interface in our SDK according to your changes, and it works fine. If you're not sure whether it's caused by your other changes, you can just modify one place in the original SDK to verify. The exception I'm talking about is a RISC-V exception. You can read the exception\_mepc pointer and check it against the .lst file to see what caused the exception.  Please distinguish between the 8258 and 721x chips. The interfaces of these two chips aren't directly compatible; there are differences. For 721x, please refer to: 

wes58

> I added the blc\_smp\_setSecurityParameters interface in our SDK according  to your changes, and it works fine. If you're not sure whether it's  caused by your other changes, you can just modify one place in the  original SDK to verify. That was the only change I had in sampleGatewayMultiBLE.c. When I commented this line out it worked. When I left it in the file then it failed. I tried multiple times with the same results. I will try your exception handler and see what I get. Otherwise I will leave it with flash protection enabled. Regarding the second issue I will try it to make it the same as app_bleOtaWrite that you wrote. Thank you very much for your help.

wes58

Here is my last test for this exception. I installed SDK on another computer and tested sampleGateway by making changes to app_config.h and sampleGatewayMultiBLE.c with FLASH_PROTECT_ENABLE disabled (0). Below are results: ``` ********** working **************** app_config.h #define BLE_OTA_SERVER_ENABLE     0 #define ZBHCI_UART                                  1 sampleGatewayMultiBLE.c blc_smp_setSecurityParameters(Bondable_Mode, 1, LE_Secure_Connection, 0, 0, IO_CAPABILITY_DISPLAY_ONLY); ********** working **************** app_config.h #define BLE_OTA_SERVER_ENABLE     1 #define ZBHCI_UART                                  0 sampleGatewayMultiBLE.c blc_smp_setSecurityParameters(Bondable_Mode, 1, LE_Secure_Connection, 0, 0, IO_CAPABILITY_DISPLAY_ONLY); *********** exception!!! *************** app_config.h #define BLE_OTA_SERVER_ENABLE     1 #define ZBHCI_UART                                  1 sampleGatewayMultiBLE.c blc_smp_setSecurityParameters(Bondable_Mode, 1, LE_Secure_Connection, 0, 0, IO_CAPABILITY_DISPLAY_ONLY); not working ********** working **************** app_config.h #define BLE_OTA_SERVER_ENABLE     1 #define ZBHCI_UART                                  1 sampleGatewayMultiBLE.c //blc_smp_setSecurityParameters(Bondable_Mode, 1, LE_Secure_Connection, 0, 0, IO_CAPABILITY_DISPLAY_ONLY); ``` As you can see, I couldn't have function blc_smp_setSecurityParameters() and both ZBHCI_UART and ZBHCI_OTA_SERVER_ENABLE. I checked exception values see the picture below for sampleGateway and my ported application. By the way, It is confusing to have exception handler function **static void zGWSysException(void)** defined in sampleGateway.c when it is never called - at least in TL7218. The function that is called is located in plic_isr.c. In plic_isr.c I also saw the function trap_entry(). ``` /** * @brief       This function service to handle all the platform pre-defined interrupt or exception. * @return      none   */   _attribute_ram_code_sec_noinline_ void trap_entry(void) __attribute__((interrupt("machine"), aligned(4)));   __attribute__((weak)) void trap_entry(void) ``` When is this function called?  Here is part of my application .lst file which refers to exception_mepc address: ``` 20033a44 <blt_acl_conn_mainloop_task>: blt_acl_conn_mainloop_task(): 20033a44:        1141                        c.addi        sp,-16 20033a46:        00800737                  lui        a4,0x800 20033a4a:        c606                        c.swsp        ra,12(sp) 20033a4c:        02e50463                  beq        a0,a4,0x20033a74 <blt_acl_conn_mainloop_task+0x30> 20033a50:        00400737                  lui        a4,0x400 20033a54:        04e50663                  beq        a0,a4,0x20033aa0 <blt_acl_conn_mainloop_task+0x5c> 20033a58:        80000737                  lui        a4,0x80000 20033a5c:        0ce50263                  beq        a0,a4,0x20033b20 <blt_acl_conn_mainloop_task+0xdc> 20033a60:        00001737                  lui        a4,0x1 20033a64:        00e50c63                  beq        a0,a4,0x20033a7c <blt_acl_conn_mainloop_task+0x38> 20033a68:        00000513                  li        a0,0 20033a6c:        40b2                        c.lwsp        ra,12(sp) 20033a6e:        0141                        c.addi        sp,16 20033a70:        00008067                  ret 20033a74:        4a40d0ef                  jal        ra,0x20040f18 <blt_ll_acl_conn_mainloop.isra.0> 20033a78:        ff1ff06f                  j        0x20033a68 <blt_acl_conn_mainloop_task+0x24> 20040f18 <blt_ll_acl_conn_mainloop.isra.0>: blt_ll_acl_conn_mainloop.isra.0(): 20040f18:        711d                        c.addi16sp        sp,-96 ``` As I understad **`exception_mcause`** The reason for the crash code 2 is for an Illegal Instruction and **`excption_mtval`** The illegal address the code tried to read, write, or jump to. How to fix it? <i class="pstatus"> 本帖最后由 wes58 于 2026-9-14 11:09 编辑 </i><br /> <br />

TL_HUANLI

You can check based on my changes using the V2.4.1.0 SDK. I guess you want to do BLE pairing by entering a pincode, right? I've already verified that it works fine and I can set up a Zigbee network via BLE. [codechange.zip](https://forum.telink-semi.cn/forum.php?mod=attachment&aid=MjI0MHw5NDEwYjRhNHwxNzg5NDM3ODU4fDEwMHww)

wes58

Hi, The libdrivers_tl721x.a is the same the you posted before The changes in the code are (almost) the same that I had. In sampleGateway.c, the change in sampleGwSysException(void) is what I tried before. As I wrote in my previous post, this function is never called. In sampleGatewayMultiBLE.c I also had those changes because I used a function to set default pincode in my app. I have MTU set to 200 In app_config.h the setting of the board is not important to me because I am using BOARD_ML7218D_MERCURY What you didn't have in your patch for app_config.h and what is the problem  is below - which I wrote in my previous post: ``` #define BLE_OTA_SERVER_ENABLE     1 #define ZBHCI_UART                                  1 ``` That's what is causing the exception. You can't have `blc_smp_setSecurityParameters(Bondable_Mode, 1, LE_Secure_Connection, 0, 0, IO_CAPABILITY_DISPLAY_ONLY);` ,`ZBHCI_UART 1` and `BLE_OTA_SERVER_ENABLE 1`. You can only have `blc_smp_setSecurityParameters(Bondable_Mode, 1, LE_Secure_Connection, 0, 0, IO_CAPABILITY_DISPLAY_ONLY);` and either `ZBHCI_UART 1` **OR** `BLE_OTA_SERVER_ENABLE 1` - not both of them set to 1. I tried all the combinations as you could see in my previous post. You can see what exception_mepc address for sampleGateway is 0xFFFFFFFE??? Could you set both of them to 1 and try if it works? <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102850&ptid=98603" target="_blank"><font color="#999999">TL_HUANLI 发表于 2026-9-15 10:07</font></a></font><br /> You can check based on my changes using the V2.4.1.0 SDK. I guess you want to do BLE pairing by ente ...</blockquote></div><br />

TL_HUANLI

Please first check if your code runs normally according to my changes, and verify that the original SDK is fine. On that basis, add your own code bit by bit. When you find a problem, generate a patch of your changes and send it to us. Otherwise, it's hard to pinpoint the issue.

wes58

<div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102856&ptid=98603" target="_blank"><font color="#999999">TL_HUANLI 发表于 2026-9-16 09:48</font></a></font> Please first check if your code runs normally according to my changes, and verify that the original  ...</blockquote></div> [ The code with your changes works fine. The only app I am using for the testing is the sampleGateway with your changes. The only change (addition) I made, as I said before, was to change - `ZBHCI_UART 1` and `BLE_OTA_SERVER_ENABLE 1`. And this change is causing an exception - as I said in my last 2 posts. I have attached a files with yours and mine changes. By the way your I couldn't apply your patch file. I had to do it manually. But that's not important.   [changessampleGW.7z](https://forum.telink-semi.cn/forum.php?mod=attachment&aid=MjI0NnxlMDBiMzdlY3wxNzg5NTI4NjYxfDk5fDA%3D) <i class="pstatus"> 本帖最后由 wes58 于 2026-9-16 11:21 编辑 </i><br /> <br />

TL_HUANLI

 If you enable both ZBHCI\_UART and BLE\_OTA\_SERVER\_ENABLE at the same time, the code will indeed get stuck. The reason is that if the firmware is over 256KB and BLE\_OTA\_SERVER\_ENABLE is turned on, the protocol stack will check the 0x40000 address and erase starting from 0x40000， which results in part of the firmware being erased. The ZBHCI\_UART macro is for enabling serial communication. From what you described, if you want to control Zigbee data via BLE, then you don’t need to enable this macro. BLE\_OTA\_SERVER\_ENABLE the purpose of this macro is to upgrade firmware via BLE. You can confirm whether this feature is needed

wes58

Thank you for your explanation. So it is not because BLE_OTA_SERVER_ENABLE is enabled (1) but because of the size of the firmware. Now it makes sense why my ported from TLSR8258 app fails. I realized that I don't need BLE_OTA_SERVER_ENABLE because to upgrade ZigBee devices there is a function: ``` #ifdef ZCL_OTA_SUPPORT ota_init(OTA_TYPE_SERVER, (af_simple_descriptor_t *)&zGW_simpleDesc, &zGW_otaInfo, NULL); #endif ``` I have enabled `ZBHCI_BLE` and `ZBHCI_UART`. I need `ZBHCI_UART` because the gateway is connected to ESP32 which sends messages to my phone app and notifications to Google Firebase Notification Service via WiFi. The application works fine - I haven't tried it for a long time yet - until I want to upgrade other Zigbee devices and send `ZBHCI_CMD_OTA_START_REQUEST` command `5502100005340002C3E200AA` to start OTA file transfer to the gateway. It crashes in function `zbhci_uartOTAHandle(void *arg)` as you can see on the picture below. And if the firmware size if bigger than 256k, it doesn't matter if FLASH_PROTECT_ENABLE is enabled or not.  When it crashes the exception is exception_mcause = 2. After I press Reset in BDT it crashes and exception_mcause = 4 - because part of the firmware was overwritten before it doesn't run anymore. Here is the firmware size with the same functionality for TLSR8258 and TL7218 TLSR8258_ZGateway.bin **223 KB (229,076 bytes)** TL7218_ZGateway.bin **266 KB (273,076 bytes)** Why is it that much bigger? I bought ML7218D1-MERCURY-M0-PE11 module (it cost me 3 times more than TLSR8258) because I wanted to add OLED display to the gateway, but it looks like I can't do it. 2M flash TL7218 can't do what 1M flash TLSR8258 has been doing for the last couple of years! What are my options? Since I only use OTA to upgrade other ZigBee devices (not gateway!) can I change `FLASH_ADDR_OF_OTA_IMAGE` to a different memory address? It is 2M flash so this should be possible. If yes, how to ensure that this area is reserved and not written to? I think that Telink should change memory mapping for 2M flash devices because there is not much code that you can add to you example sampleGateway to exceed size limit. Coud you please advise? Someone shoud have a look at the forum design. I tried to write response 3 times and at some point everything is cleared and I have to start again.

wes58

Hi TL_HUANLI I have a reminder that you replied to my post, but I can't see your reply > 2 hours ago[TL\_HUANLI](https://forum.telink-semi.cn/home.php?mod=space&uid=100) Responded to your post [telink\_zigbee\_ble\_concurrent\_sdk-2.4.1.0 issue](https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&ptid=98603&pid=102890)[View](https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102890&ptid=98603)