jz4740: a few minor fixes

This was spotted while playing with qemu-jz:
1) rockbox reads TECR and TESR which are described as write-only
   registers. Datasheet doesn't mention what happens if they are
   readed. Apparently this doesn't have fatal side effects.
   It comes down to two defines from jz4740.h
   __tcu_stop_counter(n) and __tcu_start_counter(n) which use
   read-modify-write sequence.

2) rockbox accesses out of bound offset 0xd4 in DMA memspace.
   It comes from dis_irq() in system-jz4740.c. NUM_DMA is 6 but
   DMA channels are 0-5 so (irq <= IRQ_DMA_0 + NUM_DMA)) bound
   check is wrong.

This are *NOT* tested on device.

Change-Id: I29dff6a4f828030877b7d50fbcc98866478b9e3d
Reviewed-on: http://gerrit.rockbox.org/338
Reviewed-by: Bertrik Sikken <bertrik@sikken.nl>
Tested-by: Purling Nayuki <cyq.yzfl@gmail.com>
Reviewed-by: Marcin Bukat <marcin.bukat@gmail.com>

2 files changed, 3 insertions, 3 deletions

diff --git a/firmware/export/jz4740.h b/firmware/export/jz4740.h
index 820b43f880..379c9f8aaa 100644
--- a/firmware/export/jz4740.h
+++ b/firmware/export/jz4740.h
@@ -3546,8 +3546,8 @@ static __inline__ void __cpm_select_msc_hs_clk(int sd)
 #define __tcu_set_pwm_output_shutdown_graceful(n)    ( REG_TCU_TCSR((n)) &= ~TCU_TCSR_PWM_SD )
 #define __tcu_set_pwm_output_shutdown_abrupt(n)        ( REG_TCU_TCSR((n)) |= TCU_TCSR_PWM_SD )
 
-#define __tcu_start_counter(n)        ( REG_TCU_TESR |= (1 << (n)) )
-#define __tcu_stop_counter(n)        ( REG_TCU_TECR |= (1 << (n)) )
+#define __tcu_start_counter(n)        ( REG_TCU_TESR = (1 << (n)) )
+#define __tcu_stop_counter(n)        ( REG_TCU_TECR = (1 << (n)) )
 
 #define __tcu_half_match_flag(n)    ( REG_TCU_TFR & (1 << ((n) + 16)) )
 #define __tcu_full_match_flag(n)    ( REG_TCU_TFR & (1 << (n)) )
diff --git a/firmware/target/mips/ingenic_jz47xx/system-jz4740.c b/firmware/target/mips/ingenic_jz47xx/system-jz4740.c
index f7df690dd5..ab232baf65 100644
--- a/firmware/target/mips/ingenic_jz47xx/system-jz4740.c
+++ b/firmware/target/mips/ingenic_jz47xx/system-jz4740.c
@@ -137,7 +137,7 @@ static void dis_irq(unsigned int irq)
         if (!gpio_irq_mask[t])
             __intc_mask_irq(IRQ_GPIO0 - t);
     }
-    else if ((irq >= IRQ_DMA_0) && (irq <= IRQ_DMA_0 + NUM_DMA))
+    else if ((irq >= IRQ_DMA_0) && (irq < IRQ_DMA_0 + NUM_DMA))
     {
         __dmac_channel_disable_irq(irq - IRQ_DMA_0);
         dma_irq_mask &= ~(1 << (irq - IRQ_DMA_0));