On Fri, 2017-07-07 at 16:08 +0800, Keyon Jie wrote:

We should copy from [inbox_base + offset(0 here)] src to msg->rx_data dst here, otherwise, copying to 0 dst will crash the firmware here.

Applied after fixing up as it did not apply to 1.0-dev.

Thanks

Liam

Reported-by: Luo Xionghu xionghu.luo@intel.com Signed-off-by: Keyon Jie yang.jie@linux.intel.com

---

src/ipc/byt-ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ipc/byt-ipc.c b/src/ipc/byt-ipc.c index b1bec23..ef30bbc 100644 --- a/src/ipc/byt-ipc.c +++ b/src/ipc/byt-ipc.c @@ -68,7 +68,7 @@ static void do_notify(void)

/* copy the data returned from DSP */ if (msg->rx_size && msg->rx_size < MSG_MAX_SIZE)

• mailbox_inbox_read(0, msg->rx_data, msg->rx_size);
  

• mailbox_inbox_read(msg->rx_data, 0, msg->rx_size);
  
  

  /* any callback ? */ if (msg->cb)