diff options
| author | Marcin Bukat <marcin.bukat@gmail.com> | 2012-10-26 12:55:13 +0200 |
|---|---|---|
| committer | Marcin Bukat <marcin.bukat@gmail.com> | 2013-03-11 08:33:18 +0100 |
| commit | 027c035a4e4b24e64bbb4d907f143a208c68675b (patch) | |
| tree | 1e5107d50fb49c9eb74dc2689eadaf826340b553 /firmware | |
| parent | 44c32f84051549454cc1dfdc2ceb2191266b857f (diff) | |
jz4740: a few minor fixes
This was spotted while playing with qemu-jz:
1) rockbox reads TECR and TESR which are described as write-only
registers. Datasheet doesn't mention what happens if they are
readed. Apparently this doesn't have fatal side effects.
It comes down to two defines from jz4740.h
__tcu_stop_counter(n) and __tcu_start_counter(n) which use
read-modify-write sequence.
2) rockbox accesses out of bound offset 0xd4 in DMA memspace.
It comes from dis_irq() in system-jz4740.c. NUM_DMA is 6 but
DMA channels are 0-5 so (irq <= IRQ_DMA_0 + NUM_DMA)) bound
check is wrong.
This are *NOT* tested on device.
Change-Id: I29dff6a4f828030877b7d50fbcc98866478b9e3d
Reviewed-on: http://gerrit.rockbox.org/338
Reviewed-by: Bertrik Sikken <bertrik@sikken.nl>
Tested-by: Purling Nayuki <cyq.yzfl@gmail.com>
Reviewed-by: Marcin Bukat <marcin.bukat@gmail.com>
Diffstat (limited to 'firmware')
| -rw-r--r-- | firmware/export/jz4740.h | 4 | ||||
| -rw-r--r-- | firmware/target/mips/ingenic_jz47xx/system-jz4740.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/firmware/export/jz4740.h b/firmware/export/jz4740.h index 820b43f880..379c9f8aaa 100644 --- a/firmware/export/jz4740.h +++ b/firmware/export/jz4740.h @@ -3546,8 +3546,8 @@ static __inline__ void __cpm_select_msc_hs_clk(int sd) #define __tcu_set_pwm_output_shutdown_graceful(n) ( REG_TCU_TCSR((n)) &= ~TCU_TCSR_PWM_SD ) #define __tcu_set_pwm_output_shutdown_abrupt(n) ( REG_TCU_TCSR((n)) |= TCU_TCSR_PWM_SD ) -#define __tcu_start_counter(n) ( REG_TCU_TESR |= (1 << (n)) ) -#define __tcu_stop_counter(n) ( REG_TCU_TECR |= (1 << (n)) ) +#define __tcu_start_counter(n) ( REG_TCU_TESR = (1 << (n)) ) +#define __tcu_stop_counter(n) ( REG_TCU_TECR = (1 << (n)) ) #define __tcu_half_match_flag(n) ( REG_TCU_TFR & (1 << ((n) + 16)) ) #define __tcu_full_match_flag(n) ( REG_TCU_TFR & (1 << (n)) ) diff --git a/firmware/target/mips/ingenic_jz47xx/system-jz4740.c b/firmware/target/mips/ingenic_jz47xx/system-jz4740.c index f7df690dd5..ab232baf65 100644 --- a/firmware/target/mips/ingenic_jz47xx/system-jz4740.c +++ b/firmware/target/mips/ingenic_jz47xx/system-jz4740.c @@ -137,7 +137,7 @@ static void dis_irq(unsigned int irq) if (!gpio_irq_mask[t]) __intc_mask_irq(IRQ_GPIO0 - t); } - else if ((irq >= IRQ_DMA_0) && (irq <= IRQ_DMA_0 + NUM_DMA)) + else if ((irq >= IRQ_DMA_0) && (irq < IRQ_DMA_0 + NUM_DMA)) { __dmac_channel_disable_irq(irq - IRQ_DMA_0); dma_irq_mask &= ~(1 << (irq - IRQ_DMA_0)); |