Index: ModuleDemo/25_OTA/bt_demo/BT/patch/patch.prog
===================================================================
--- /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/BT/patch/patch.prog	(revision 4629)
+++ /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/BT/patch/patch.prog	(working copy)
@@ -1075,9 +1075,14 @@
 
 
 ipc_rx_data_buf_sub_free_buf:
+	call ipc_rx_data_buf_free_ipc_work
 	fetchr regb,3,mem_ipc_data_rx_buf_payload_ptr
 	branch free_buffer
-
+ipc_rx_data_buf_free_ipc_work:
+	call p_ipc_rx_restore_contr
+	arg 3,loopcnt
+	arg mem_ipc_data_rx_buf_payload_ptr,contw
+	branch ipc_rx_block_read
 
 ipc_rx_data_buf:
 	// ipc total length
@@ -1085,9 +1090,16 @@
 	// subType
 	call ipc_rx_byte_read
 	store 1,mem_ipc_data_rx_buf_subtype
-	arg 3,loopcnt
-	arg mem_ipc_data_rx_buf_payload_ptr,contw
-	call ipc_rx_block_read
+	call p_ipc_rx_store_contr
+	
+	fetch 1,mem_ipc_data_rx_buf_subtype
+	beq IPC_DATA_SUBTYPE_FREE,ipc_rx_data_buf_sub_free_buf
+
+	// make sure have buffer to do this.
+	call malloc_buffer_is_full
+	rtn blank
+
+	call ipc_rx_data_buf_free_ipc_work
 
 ifdef TEST_QUEUE_DEBUG
 	arg 0x7000,rega
@@ -1099,7 +1111,6 @@
 endif
 
 	fetch 1,mem_ipc_data_rx_buf_subtype
-	beq IPC_DATA_SUBTYPE_FREE,ipc_rx_data_buf_sub_free_buf
 	beq IPC_DATA_SUBTYPE_HCI,ipc_rx_data_buf_sub_hci_data
 	branch assert
 
@@ -1209,8 +1220,13 @@
 
 	increase 3,pdata // evt type(04), evt code
 	store 2,mem_alloc_buffer_len
-	call malloc_buffer_is_enough
-	rtn blank
+	//call malloc_buffer_is_enough
+	//rtn blank
+
+	arg mem_alloc_big_block,rega
+	call p_queue_get_len
+	sub pdata,2,null
+	rtn positive
 
 	jam HCI_EVENT_LE_META_EVENT,mem_mesh_event_head_event_code
 	call p_hci_prepare_send_event