Index: Librarier/bt_rom/format/xip.format
===================================================================
--- /YC1121E/SoftCode/1121EB/branch/HciDongle/Librarier/bt_rom/format/xip.format	(revision 4810)
+++ /YC1121E/SoftCode/1121EB/branch/HciDongle/Librarier/bt_rom/format/xip.format	(working copy)
@@ -23,7 +23,8 @@
 
 (//Z_CODE 
 0x01 ZCODE_ENTER_ADDRESS
-
+0x17f00 ZCODE_BUFF_M0_USER_ADDR
+0xff00	ZCODE_BUFF_M0_ADDR_PTR
 256 ZCODE_BUFF_SIZE
 64 ZCODE_CODE_SIZE
 0xff ZCODE_FLAG
Index: ModuleDemo/25_OTA/bt_demo/BT/patch/patch.prog
===================================================================
--- /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/BT/patch/patch.prog	(revision 4810)
+++ /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/BT/patch/patch.prog	(working copy)
@@ -231,6 +231,8 @@
 	call wdt_disable_watchdog
 endif //FUNCTION_WATCH_DOG
 
+	arg CLOCK_OFF_MRAM,queue
+	call clk_on
 	// Be-careful, mark register may loss, reason unknow.
 	call p_lpm_load_mark,wake
 	
@@ -3066,22 +3068,33 @@
 	store 3,mem_flash_address
 	setarg ZCODE_BUFF_SIZE
 	store 2,mem_flash_trans_length
-	setarg mem_zcode_buff_user
+//	setarg mem_zcode_buff_user
+	setarg ZCODE_BUFF_M0_USER_ADDR
 	store 2,mem_flash_data_address
 	call qspi_get_lock
 	call check_m0_qspi_lock_and_pause
 	fetch 1,core_qspi_ctrl
 	store 1,mem_pdatatemp
-	call qspi_read
+	call p_mqspi_read
 	fetch 1,mem_pdatatemp
 	store 1,core_qspi_ctrl
 
 	jam 0,mem_qspi_lock_flag_respin
-	//call qspi_free_lock
-
-	setarg mem_zcode_buff_user
+	setarg ZCODE_BUFF_M0_ADDR_PTR
 	branch zcode_entrance0
 
+	
+p_mqspi_read:
+	call check_m0_qspi_lock_and_pause
+	fetch 1,core_qspi_ctrl
+	copy pdata,regb
+	setarg 0x05
+	store 1,core_qspi_ctrl
+	call qspi_mmode		
+	fetch 1,core_qspi_delay
+	copy pdata,regc
+	branch mqspi_read+10
+
 
 ifdef TEST_QUEUE_DEBUG
 //input: pdata
Index: ModuleDemo/25_OTA/bt_demo/BT/sched/user.dat
===================================================================
--- /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/BT/sched/user.dat	(revision 4810)
+++ /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/BT/sched/user.dat	(working copy)
@@ -239,7 +239,7 @@
 mem_audio_output_setting: 01
 
 
-mem_mram_qspi_tx_addr:00 60
+mem_mram_qspi_tx_addr:00 df
 
 mem_vp_addr:
 000000 000000
Index: ModuleDemo/25_OTA/bt_demo/CM0/Prj/MDK/Objects/yc11xx.sct
===================================================================
--- /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/CM0/Prj/MDK/Objects/yc11xx.sct	(revision 4810)
+++ /YC1121E/SoftCode/1121EB/branch/HciDongle/ModuleDemo/25_OTA/bt_demo/CM0/Prj/MDK/Objects/yc11xx.sct	(working copy)
@@ -10,7 +10,7 @@
 	.ANY (+RO)
   }
 	; if change this, must change startup.s __initial_sp
-	 RW_IRAM1 0x10010000 0x7fff  {  ; RW data
+	 RW_IRAM1 0x10010000 0x7eff  {  ; RW data
 	.ANY (+RW +ZI)
 	}
 }