With V4.0.2.5 BLE scan never starts

ircama

**With V4.0.2.5 BLE scan never starts - blc_ll_setExtScanEnable() returns BLE_SUCCESS but no event is produced, then the firmware freezes** Hello Telink support, we hit a blocking problem with **tc_ble_sdk V4.0.2.5** on the B85 (TLSR825x) and we would like to know whether scanning is supposed to work at all on this release. | item      | value                                                                                 | | --------- | ------------------------------------------------------------------------------------- | | SDK       | tc_ble_sdk`V4.0.2.5`                                                                  | | Library   | `proj_lib/liblt_8258.a` (`CHIP_TYPE_825x`) — the *only* file we change between tests | | Toolchain | Telink TC32 ELF GCC 4.3                                                               | With V4.0.2.5 an application that only **scans** cannot work at all: * `blc_ll_setExtScanParam()` and `blc_ll_setExtScanEnable()` (extended scanning, 1M PHY) return   `BLE_SUCCESS`; * no controller event is ever delivered (no `HCI_SUB_EVT_LE_EXTENDED_ADVERTISING_REPORT`, no   `HCI_SUB_EVT_LE_ADVERTISING_REPORT`), and the LL state word `g_lcll_state` never becomes   non-zero; * the main loop (`blc_sdk_main_loop()`) then stops running: the board freezes. Legacy scanning (`blc_ll_setScanParameter()` / `blc_ll_setScanEnable()`) behaves the same way, so this is not specific to the extended-scanning path. Please, check example at [https://github.com/telink-semi/tc_ble_sdk/issues/1#issuecomment-5738750942](https://github.com/telink-semi/tc_ble_sdk/issues/1#issuecomment-5738750942). The same source tree, the same makefiles, the same board; **only** `proj_lib/liblt_8258.a` is swapped (sha256 prefix of the tested file in brackets): | library                 | extended scan, 1M             | extended scan, 1M + Coded | legacy scan, 1M | | ----------------------- | ----------------------------- | ------------------------- | --------------- | | V4.0.2.1 [`9d48e36e…`] | works                         | works                     | works           | | V4.0.2.5 [`32e898ce…`] | **no scan** (freeze or reset) | **no scan**               | **no scan**     | UART output with the same binary, only the library changed. Questions: - Is scanning (extended and/or legacy) supported in V4.0.2.5 on the B85 / `liblt_8258.a`? - If yes, which initialization step or API call are we missing? Our sequence is now identical to `vendor/feature_test/feature_ext_scan/app.c`. - Since `blc_ll_setExtScanParam()` / `blc_ll_setExtScanEnable()` return `BLE_SUCCESS` while nothing happens, the application has no way to detect the condition — could this be turned into an error return? Thanks!

ircama

Additional note. Using extended scanning only, Coded PHY (`blc_ll_initExtendedScanning_module()` + `blc_ll_setExtScanParam(..., SCAN_PHY_CODED, 0, 0, 0, SCAN_TYPE_PASSIVE, SCAN_INTERVAL_150MS, SCAN_WINDOW_100MS)` + `blc_ll_setExtScanEnable()`), following `SDK/vendor/feature_test/feature_ext_scan/app.c`. Two problems: 1. The examples do not show `blc_ll_init2MPhyCodedPhy_feature()`. It is not called in the Coded    branch of `feature_ext_scan/app.c` (nor in `feature_per_adv_sync/app.c`) and it is not mentioned    in the comments of `ext_scan.h`. Without it, extended scanning does not start at all (no    advertising report, neither 1M nor Coded) and on V4.0.2.3/.5 the firmware stops about one second after the scan is enabled. Please consider adding it to the example and to the documentation; finding this by trial and error is very costly. 2. With `blc_ll_init2MPhyCodedPhy_feature()` added, Coded PHY receiving still does not work on    V4.0.2.3 and V4.0.2.5: no advertising report is ever generated, and at the first Coded packet    the RF interrupt is entered and never exits. The identical application code built against V4.0.2.1 receives the Coded advertisements correctly. From the return addresses left on the interrupt stack at the moment of the lock-up (mapped to the library symbols) the active chain is: ``` blc_sdk_irq_handler blt_ll_rx_start_tick_check blt_aux_scan_start irq_scan_rx_primary_channel blt_insert_aux_scan_future_task blt_ext_adv_rx_process   <-- innermost frame: at the call to blt_add_aux_scan_future_task ``` Questions: - is `blc_ll_init2MPhyCodedPhy_feature()` mandatory for extended scanning on Coded PHY (and should the example be updated)? - How to allow receiving the Coded PHY on TLSR825x in V4.0.2.3/.5?

TL_WENJING

Thank you for your feedback. We will confirm this issue and provide you with a response and solution as soon as possible.

TL_HAOJIE

hello： 1. 4.0.2.5 liblt\_8258.a supports ext\_scan. 2. I did a preliminary check with our SDK. Using your parameter configuration based on acl\_central\_demo, advertising events can be reported. Please re-verify with our original SDK.[extscandiff.zip](https://forum.telink-semi.cn/forum.php?mod=attachment&aid=MjM0MnwzYzUxMzVjOXwxNzg5OTA2ODY1fDcxNXww) You may test with the provided diff file. The test results are as follows: 

ircama

Thanks for the patch and for the test. Could you confirm which `scan_phys` your test used — `SCAN_PHY_1M` as in the diff, or did you change it to `SCAN_PHY_CODED`? The log line `HCI_SUB_EVT_LE_EXTENDED_ADVERTISING_REPORT` is the same for 1M and Coded PHY, so the screenshot does not tell which one was scanned. With `SCAN_PHY_CODED` (plus `blc_ll_init2MPhyCodedPhy_feature()`, which our configuration calls) the firmware **freezes** on 4.0.2.3/4.0.2.5 as soon as a Coded PHY packet arrives — the RF interrupt is entered and never returns, and no report is delivered — while the same code on 4.0.2.1 works. Could you run your test with `SCAN_PHY_CODED`? For that you need a transmitter that really advertises on LE Coded PHY. <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102906&ptid=98909" target="_blank"><font color="#999999">TL_HAOJIE 发表于 2026-9-20 20:22</font></a></font><br /> hello：<br /> <br /> 1. 4.0.2.5 liblt\_8258.a supports ext\_scan.</blockquote></div><br />

TL_HAOJIE

Ok，I set up a adv device that only adv coded PHY and switched SCAN_PHY_CODED, and it's still working fine. Perhaps you're running out of RAM， could you check your .lst file?

ircama

[codedphyscanrepro.zip](https://forum.telink-semi.cn/forum.php?mod=attachment&aid=MjM1OXw2MWU2MTE4ZHwxNzkwMjc3Mzg0fDgzfDA%3D) I confirm the issue. Please check the attached archive. It contains a complete, self-contained small example, including a README, with the code and firmware required to reproduce the bug with SDK V4.0.2.5. The same code works with SDK V4.0.2.1. Building just requires a Linux system. ```bash unzip coded_phy_scan_repro.zip rm coded_phy_scan_repro.zip chmod 777 install_sdk.sh ``` Compiling the code: `./install_sdk.sh && make`. I use this tool to flash the firmware: `python3 tools/Telink_Tools.py --port COM5 burn CodedPhyTest.bin` This can be used to test: `python3 tools/monitor.py com5`. The README includes the test results. <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102938&ptid=98909" target="_blank"><font color="#999999">TL_HAOJIE 发表于 2026-9-23 16:47</font></a></font><br /> Ok，I set up a adv device that only adv coded PHY and switched SCAN_PHY_CODED, and it's still workin ...</blockquote></div><br />

TL_HAOJIE

ok, I will try it.

TL_TONGWEI

hello： I conducted the verification using our SDK in the Telink IoT Studio development environment. Using extended scanning only, Coded PHY (`blc_ll_initExtendedScanning_module()` + `blc_ll_setExtScanParam(..., SCAN_PHY_CODED, 0, 0, 0, SCAN_TYPE_PASSIVE, SCAN_INTERVAL_150MS, SCAN_WINDOW_100MS)` + `blc_ll_setExtScanEnable()`), based on acl\_central\_demo, It receives the Coded advertisements correctly，Coded PHY EXT advertising events can be reported. Please re-verify with our original SDK.[codedextscandiff.zip](https://forum.telink-semi.cn/forum.php?mod=attachment&aid=MjM4OHw3ZDU1ODBmM3wxNzkwNTg1NjE5fDEyOTV8MA%3D%3D) You may test with the provided diff file. The test results are as follows:  03 03 indicates that both Primary PHY and Secondary PHY are LE Coded with S=8 data coding.

ircama

Thanks very much for your tests! The issue was in my application: the Link Layer was not initialised the way the reference acl_central_demo does - the ACL central role, the ACL FIFOs and the controller data handler were missing - blc_ll_initPeriodicAdvertisingSynchronization_module() was enabled although it is never used, and each scan window was equal to its scan interval (100% duty cycle per PHY, 200% with 1M + Coded enabled together). I'll look into these points further over the next few days. <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102971&ptid=98909" target="_blank"><font color="#999999">TL_TONGWEI 发表于 2026-9-28 17:03</font></a></font><br /> hello：<br /> <br /> I conducted the verification using our SDK in the Telink IoT Studio development environment ...</blockquote></div><br />