diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index 19494b88be..eb8bd15df4 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -168,8 +168,10 @@ static void pxa2xx_cm_write(void *opaque, target_phys_addr_t addr,
         break;
 
     case OSCC:
-        s->cm_regs[addr >> 2] &= ~0x6e;
+        s->cm_regs[addr >> 2] &= ~0x6c;
         s->cm_regs[addr >> 2] |= value & 0x6e;
+        if ((value >> 1) & 1)			/* OON */
+            s->cm_regs[addr >> 2] |= 1 << 0;	/* Oscillator is now stable */
         break;
 
     default:
diff --git a/hw/pxa2xx_timer.c b/hw/pxa2xx_timer.c
index 3ab7149326..8c083595c6 100644
--- a/hw/pxa2xx_timer.c
+++ b/hw/pxa2xx_timer.c
@@ -364,7 +364,7 @@ static void pxa2xx_timer_tick4(void *opaque)
     struct pxa2xx_timer4_s *t = (struct pxa2xx_timer4_s *) opaque;
     pxa2xx_timer_info *i = (pxa2xx_timer_info *) t->info;
 
-    pxa2xx_timer_tick4(opaque);
+    pxa2xx_timer_tick(opaque);
     if (t->control & (1 << 3))
         t->clock = 0;
     if (t->control & (1 << 6))