diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index 19494b88be36c43f92a49e1b44fa98c284c3b544..eb8bd15df48923ff8ca59b7933c4b0593f0809a8 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -168,8 +168,10 @@ static void pxa2xx_cm_write(void *opaque, target_phys_addr_t addr,
         break;
 
     case OSCC:
-        s->cm_regs[addr >> 2] &= ~0x6e;
+        s->cm_regs[addr >> 2] &= ~0x6c;
         s->cm_regs[addr >> 2] |= value & 0x6e;
+        if ((value >> 1) & 1)			/* OON */
+            s->cm_regs[addr >> 2] |= 1 << 0;	/* Oscillator is now stable */
         break;
 
     default:
diff --git a/hw/pxa2xx_timer.c b/hw/pxa2xx_timer.c
index 3ab71493262cd610060ea52ecaa83299ef862a83..8c083595c6ebec9c06ea3da276011a2d2b2d2883 100644
--- a/hw/pxa2xx_timer.c
+++ b/hw/pxa2xx_timer.c
@@ -364,7 +364,7 @@ static void pxa2xx_timer_tick4(void *opaque)
     struct pxa2xx_timer4_s *t = (struct pxa2xx_timer4_s *) opaque;
     pxa2xx_timer_info *i = (pxa2xx_timer_info *) t->info;
 
-    pxa2xx_timer_tick4(opaque);
+    pxa2xx_timer_tick(opaque);
     if (t->control & (1 << 3))
         t->clock = 0;
     if (t->control & (1 << 6))