14 files changed, 6013 insertions, 0 deletions

diff --git a/src/core/arm/interpreter/mmu/arm1176jzf_s_mmu.cpp b/src/core/arm/interpreter/mmu/arm1176jzf_s_mmu.cpp
new file mode 100644
index 000000000..a32f076b9
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/arm1176jzf_s_mmu.cpp
@@ -0,0 +1,1132 @@
+/*
+    arm1176jzf_s_mmu.c - ARM920T Memory Management Unit emulation.
+    Copyright (C) 2003 Skyeye Develop Group
+    for help please send mail to <skyeye-developer@lists.gro.clinux.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+#include <assert.h>
+#include <string.h>
+#include <stdint.h>
+
+#include "core/mem_map.h"
+
+#include "core/arm/interpreter/skyeye_defs.h"
+
+#include "core/arm/interpreter/armdefs.h"
+//#include "bank_defs.h"
+#if 0
+#define TLB_SIZE 1024 * 1024
+#define ASID 255
+static uint32_t tlb_entry_array[TLB_SIZE][ASID];
+static inline void invalidate_all_tlb(ARMul_State *state){
+    memset(&tlb_entry_array[0], 0xFF, sizeof(uint32_t) * TLB_SIZE * ASID);
+}
+static inline void invalidate_by_mva(ARMul_State *state, ARMword va){
+    memset(&tlb_entry_array[va >> 12][va & 0xFF], 0xFF, sizeof(uint32_t));
+    return;
+}
+static inline void invalidate_by_asid(ARMul_State *state, ARMword asid){
+    int i;
+    for(i = 0; i < TLB_SIZE; i++)
+        memset(&tlb_entry_array[i][asid & 0xFF], 0xFF, sizeof(uint32_t));
+    return;
+}
+
+static uint32_t get_phys_page(ARMul_State* state, ARMword va){
+    uint32_t phys_page = tlb_entry_array[va >> 12][state->mmu.context_id & 0xFF];
+    //printf("In %s, for va=0x%x, page=0x%x\n", __func__, va, phys_page);
+    return phys_page;
+}
+
+static inline void insert_tlb(ARMul_State* state, ARMword va, ARMword pa){
+    //printf("In %s, insert va=0x%x, pa=0x%x\n", __FUNCTION__, va, pa);
+    //printf("In %s, insert va=0x%x, va>>12=0x%x, pa=0x%x, pa>>12=0x%x\n", __FUNCTION__, va, va >> 12, pa, pa >> 12);
+    tlb_entry_array[va >> 12][state->mmu.context_id & 0xFF] = pa >> 12;
+
+    return;
+}
+#endif
+#define BANK0_START 0x50000000
+static void* mem_ptr = NULL;
+
+static int exclusive_detect(ARMul_State* state, ARMword addr){
+    #if 0
+    for(int i = 0; i < 128; i++){
+        if(state->exclusive_tag_array[i] == addr)
+            return 0;
+    }
+    #endif
+    if(state->exclusive_tag_array[0] == addr)
+        return 0;
+    else
+        return -1;
+}
+
+static void add_exclusive_addr(ARMul_State* state, ARMword addr){
+    #if 0
+    for(int i = 0; i < 128; i++){
+        if(state->exclusive_tag_array[i] == 0xffffffff){
+            state->exclusive_tag_array[i] = addr;
+            //printf("In %s, add  addr 0x%x\n", __func__, addr);
+            return;
+        }
+    }
+    printf("In %s ,can not monitor the addr, out of array\n", __FUNCTION__);
+    #endif
+    state->exclusive_tag_array[0] = addr;
+    return;
+}
+
+static void remove_exclusive(ARMul_State* state, ARMword addr){
+    #if 0
+    int i;
+    for(i = 0; i < 128; i++){
+        if(state->exclusive_tag_array[i] == addr){
+            state->exclusive_tag_array[i] = 0xffffffff;
+            //printf("In %s, remove  addr 0x%x\n", __func__, addr);
+            return;
+        }
+    }
+    #endif
+    state->exclusive_tag_array[0] = 0xFFFFFFFF;
+}
+
+/* This function encodes table 8-2 Interpreting AP bits,
+   returning non-zero if access is allowed. */
+static int
+check_perms (ARMul_State *state, int ap, int read)
+{
+    int s, r, user;
+
+    s = state->mmu.control & CONTROL_SYSTEM;
+    r = state->mmu.control & CONTROL_ROM;
+    /* chy 2006-02-15 , should consider system mode, don't conside 26bit mode */
+//    printf("ap is %x, user is %x, s is %x, read is %x\n", ap, user, s, read);
+//    printf("mode is %x\n", state->Mode);
+    user = (state->Mode == USER32MODE) || (state->Mode == USER26MODE) || (state->Mode == SYSTEM32MODE);
+
+    switch (ap) {
+    case 0:
+        return read && ((s && !user) || r);
+    case 1:
+        return !user;
+    case 2:
+        return read || !user;
+    case 3:
+        return 1;
+    }
+    return 0;
+}
+
+#if 0
+fault_t
+check_access (ARMul_State *state, ARMword virt_addr, tlb_entry_t *tlb,
+          int read)
+{
+    int access;
+
+    state->mmu.last_domain = tlb->domain;
+    access = (state->mmu.domain_access_control >> (tlb->domain * 2)) & 3;
+    if ((access == 0) || (access == 2)) {
+        /* It's unclear from the documentation whether this
+           should always raise a section domain fault, or if
+           it should be a page domain fault in the case of an
+           L1 that describes a page table.  In the ARM710T
+           datasheets, "Figure 8-9: Sequence for checking faults"
+           seems to indicate the former, while "Table 8-4: Priority
+           encoding of fault status" gives a value for FS[3210] in
+           the event of a domain fault for a page.  Hmm. */
+        return SECTION_DOMAIN_FAULT;
+    }
+    if (access == 1) {
+        /* client access - check perms */
+        int subpage, ap;
+#if 0
+        switch (tlb->mapping) {
+            /*ks 2004-05-09
+             *   only for XScale
+             *   Extend Small Page(ESP) Format
+             *   31-12 bits    the base addr of ESP
+             *   11-10 bits    SBZ
+             *   9-6   bits    TEX
+             *   5-4   bits    AP
+             *   3     bit     C
+             *   2     bit     B
+             *   1-0   bits    11
+             * */
+        case TLB_ESMALLPAGE:    /* xj */
+            subpage = 0;
+            /* printf("TLB_ESMALLPAGE virt_addr=0x%x  \n",virt_addr ); */
+            break;
+
+        case TLB_TINYPAGE:
+            subpage = 0;
+            /* printf("TLB_TINYPAGE virt_addr=0x%x  \n",virt_addr ); */
+            break;
+
+        case TLB_SMALLPAGE:
+            subpage = (virt_addr >> 10) & 3;
+            break;
+        case TLB_LARGEPAGE:
+            subpage = (virt_addr >> 14) & 3;
+            break;
+        case TLB_SECTION:
+            subpage = 3;
+            break;
+        default:
+            assert (0);
+            subpage = 0;    /* cleans a warning */
+        }
+        ap = (tlb->perms >> (subpage * 2 + 4)) & 3;
+        if (!check_perms (state, ap, read)) {
+            if (tlb->mapping == TLB_SECTION) {
+                return SECTION_PERMISSION_FAULT;
+            } else {
+                return SUBPAGE_PERMISSION_FAULT;
+            }
+        }
+#endif
+    } else {            /* access == 3 */
+        /* manager access - don't check perms */
+    }
+    return NO_FAULT;
+}
+#endif
+
+#if 0
+fault_t
+mmu_translate (ARMul_State *state, ARMword virt_addr, ARMword *phys_addr)
+#endif
+
+/*  ap: AP bits value.
+ *  sop: section or page description  0:section 1:page
+ */
+fault_t
+mmu_translate (ARMul_State *state, ARMword virt_addr, ARMword *phys_addr, int *ap, int *sop)
+{
+    {
+        /* walk the translation tables */
+        ARMword l1addr, l1desc;
+        if (state->mmu.translation_table_ctrl && virt_addr << state->mmu.translation_table_ctrl >> (32 - state->mmu.translation_table_ctrl - 1)) {
+            l1addr = state->mmu.translation_table_base1;
+            l1addr = (((l1addr >> 14) << 14) | (virt_addr >> 18)) & ~3;
+        } else {
+            l1addr = state->mmu.translation_table_base0;
+            l1addr = (((l1addr >> (14 - state->mmu.translation_table_ctrl)) << (14 - state->mmu.translation_table_ctrl)) | (virt_addr << state->mmu.translation_table_ctrl) >> (18 + state->mmu.translation_table_ctrl)) & ~3;
+        }
+
+        /* l1desc = mem_read_word (state, l1addr); */
+        if (state->space.conf_obj != NULL)
+            state->space.read(state->space.conf_obj, l1addr, &l1desc, 4);
+        else
+            l1desc = Memory::Read32(l1addr); //mem_read_raw(32, l1addr, &l1desc);
+
+        #if 0
+        if (virt_addr == 0xc000d2bc) {
+                printf("mmu_control is %x\n", state->mmu.translation_table_ctrl);
+                printf("mmu_table_0 is %x\n", state->mmu.translation_table_base0);
+                printf("mmu_table_1 is %x\n", state->mmu.translation_table_base1);
+                printf("l1addr is %x l1desc is %x\n", l1addr, l1desc);
+ //               exit(-1);
+        }
+        #endif
+        switch (l1desc & 3) {
+        case 0:
+        case 3:
+            /*
+             * according to Figure 3-9 Sequence for checking faults in arm manual,
+             * section translation fault should be returned here.
+             */
+            {
+                return SECTION_TRANSLATION_FAULT;
+            }
+        case 1:
+            /* coarse page table */
+            {
+                ARMword l2addr, l2desc;
+
+
+                l2addr = l1desc & 0xFFFFFC00;
+                l2addr = (l2addr |
+                      ((virt_addr & 0x000FF000) >> 10)) &
+                    ~3;
+                if(state->space.conf_obj != NULL)
+                    state->space.read(state->space.conf_obj, l2addr, &l2desc, 4);
+                else
+                    l2desc = Memory::Read32(l2addr); //mem_read_raw(32, l2addr, &l2desc);
+                    
+                /* chy 2003-09-02 for xscale */
+                *ap = (l2desc >> 4) & 0x3;
+                *sop = 1;    /* page */
+
+                switch (l2desc & 3) {
+                case 0:
+                    return PAGE_TRANSLATION_FAULT;
+                    break;
+                case 1:
+                    *phys_addr = (l2desc & 0xFFFF0000) | (virt_addr & 0x0000FFFF);
+                    break;
+                case 2:
+                case 3:
+                    *phys_addr = (l2desc & 0xFFFFF000) | (virt_addr & 0x00000FFF);
+                    break;
+
+                }
+            }
+            break;
+        case 2:
+            /* section */
+
+            *ap = (l1desc >> 10) & 3;
+            *sop = 0;     /* section */
+            #if 0
+            if (virt_addr == 0xc000d2bc) {
+                    printf("mmu_control is %x\n", state->mmu.translation_table_ctrl);
+                    printf("mmu_table_0 is %x\n", state->mmu.translation_table_base0);
+                    printf("mmu_table_1 is %x\n", state->mmu.translation_table_base1);
+                    printf("l1addr is %x l1desc is %x\n", l1addr, l1desc);
+//                    printf("l2addr is %x l2desc is %x\n", l2addr, l2desc);
+                    printf("ap is %x, sop is %x\n", *ap, *sop);
+                    printf("mode is %d\n", state->Mode);
+//                      exit(-1);
+            }
+            #endif
+
+            if (l1desc & 0x30000)
+                *phys_addr = (l1desc & 0xFF000000) | (virt_addr & 0x00FFFFFF);
+            else
+                *phys_addr = (l1desc & 0xFFF00000) | (virt_addr & 0x000FFFFF);
+            break;
+        }
+    }
+    return NO_FAULT;
+}
+
+
+static fault_t arm1176jzf_s_mmu_write (ARMul_State *state, ARMword va,
+                  ARMword data, ARMword datatype);
+static fault_t arm1176jzf_s_mmu_read (ARMul_State *state, ARMword va,
+                 ARMword *data, ARMword datatype);
+
+int
+arm1176jzf_s_mmu_init (ARMul_State *state)
+{
+    state->mmu.control = 0x50078;
+    state->mmu.translation_table_base = 0xDEADC0DE;
+    state->mmu.domain_access_control = 0xDEADC0DE;
+    state->mmu.fault_status = 0;
+    state->mmu.fault_address = 0;
+    state->mmu.process_id = 0;
+    state->mmu.context_id = 0;
+    state->mmu.thread_uro_id = 0;
+    //invalidate_all_tlb(state);
+
+    return No_exp;
+}
+
+void
+arm1176jzf_s_mmu_exit (ARMul_State *state)
+{
+}
+
+
+static fault_t
+arm1176jzf_s_mmu_load_instr (ARMul_State *state, ARMword va, ARMword *instr)
+{
+    fault_t fault;
+    int c;            /* cache bit */
+    ARMword pa;        /* physical addr */
+    ARMword perm;        /* physical addr access permissions */
+    int ap, sop;
+
+    static int debug_count = 0;    /* used for debug */
+
+    //DEBUG_LOG(ARM11, "va = %x\n", va);
+
+    va = mmu_pid_va_map (va);
+    if (MMU_Enabled) {
+//            printf("MMU enabled.\n");
+//            sleep(1);
+            /* align check */
+        if ((va & (WORD_SIZE - 1)) && MMU_Aligned) {
+            DEBUG_LOG(ARM11, "align\n");
+            return ALIGNMENT_FAULT;
+        } else
+            va &= ~(WORD_SIZE - 1);
+
+        /* translate tlb */
+        fault = mmu_translate (state, va, &pa, &ap, &sop);
+        if (fault) {
+            DEBUG_LOG(ARM11, "translate\n");
+            printf("va=0x%x, icounter=%lld, fault=%d\n", va, state->NumInstrs, fault);
+            return fault;
+        }
+
+
+        /* no tlb, only check permission */
+        if (!check_perms(state, ap, 1)) {
+            if (sop == 0) {
+                return SECTION_PERMISSION_FAULT;
+            } else {
+                return SUBPAGE_PERMISSION_FAULT;
+            }
+        }
+
+#if 0
+        /*check access */
+        fault = check_access (state, va, tlb, 1);
+        if (fault) {
+            DEBUG_LOG(ARM11, "check_fault\n");
+            return fault;
+        }
+#endif
+    }
+
+    /*if MMU disabled or C flag is set alloc cache */
+    if (MMU_Disabled) {
+//            printf("MMU disabled.\n");
+//            sleep(1);
+        pa = va;
+    }
+    if(state->space.conf_obj == NULL)
+        state->space.read(state->space.conf_obj, pa, instr, 4);
+    else
+        *instr = Memory::Read32(pa); //mem_read_raw(32, pa, instr);
+
+    return NO_FAULT;
+}
+
+static fault_t
+arm1176jzf_s_mmu_read_byte (ARMul_State *state, ARMword virt_addr, ARMword *data)
+{
+    /* ARMword temp,offset; */
+    fault_t fault;
+    fault = arm1176jzf_s_mmu_read (state, virt_addr, data, ARM_BYTE_TYPE);
+    return fault;
+}
+
+static fault_t
+arm1176jzf_s_mmu_read_halfword (ARMul_State *state, ARMword virt_addr,
+               ARMword *data)
+{
+    /* ARMword temp,offset; */
+    fault_t fault;
+    fault = arm1176jzf_s_mmu_read (state, virt_addr, data, ARM_HALFWORD_TYPE);
+    return fault;
+}
+
+static fault_t
+arm1176jzf_s_mmu_read_word (ARMul_State *state, ARMword virt_addr, ARMword *data)
+{
+    return arm1176jzf_s_mmu_read (state, virt_addr, data, ARM_WORD_TYPE);
+}
+
+static fault_t
+arm1176jzf_s_mmu_read (ARMul_State *state, ARMword va, ARMword *data,
+          ARMword datatype)
+{
+    fault_t fault;
+    ARMword pa, real_va, temp, offset;
+    ARMword perm;        /* physical addr access permissions */
+    int ap, sop;
+
+    //DEBUG_LOG(ARM11, "va = %x\n", va);
+
+    va = mmu_pid_va_map (va);
+    real_va = va;
+    /* if MMU disabled, memory_read */
+    if (MMU_Disabled) {
+//            printf("MMU disabled cpu_id:%x addr:%x.\n", state->mmu.process_id, va);
+//            sleep(1);
+
+        /* *data = mem_read_word(state, va); */
+        if (datatype == ARM_BYTE_TYPE)
+            /* *data = mem_read_byte (state, va); */
+            if(state->space.conf_obj != NULL)
+                state->space.read(state->space.conf_obj, va, data, 1);
+            else
+                *data = Memory::Read8(va); //mem_read_raw(8, va, data);
+        else if (datatype == ARM_HALFWORD_TYPE)
+            /* *data = mem_read_halfword (state, va); */
+            if(state->space.conf_obj != NULL)
+                state->space.read(state->space.conf_obj, va, data, 2);
+            else
+                *data = Memory::Read16(va); //mem_read_raw(16, va, data);
+        else if (datatype == ARM_WORD_TYPE)
+            /* *data = mem_read_word (state, va); */
+            if(state->space.conf_obj != NULL)
+                state->space.read(state->space.conf_obj, va, data, 4);
+            else
+                *data = Memory::Read32(va); //mem_read_raw(32, va, data);
+        else {
+            ERROR_LOG(ARM11, "SKYEYE:1 arm1176jzf_s_mmu_read error: unknown data type %d\n", datatype);
+        }
+
+        return NO_FAULT;
+    }
+//    printf("MMU enabled.\n");
+//    sleep(1);
+
+    /* align check */
+    if (((va & 3) && (datatype == ARM_WORD_TYPE) && MMU_Aligned) ||
+        ((va & 1) && (datatype == ARM_HALFWORD_TYPE) && MMU_Aligned)) {
+        DEBUG_LOG(ARM11, "align\n");
+        return ALIGNMENT_FAULT;
+    }
+
+    /* va &= ~(WORD_SIZE - 1); */
+    #if 0
+    uint32_t page_base;
+    page_base = get_phys_page(state, va);
+    if((page_base & 0xFFF) == 0){
+        pa = (page_base << 12) | (va & 0xFFF);
+        goto skip_translation;
+    }
+    #endif
+    /*translate va to tlb */
+#if 0
+    fault = mmu_translate (state, va, ARM920T_D_TLB (), &tlb);
+#endif
+    fault = mmu_translate (state, va, &pa, &ap, &sop);
+#if 0
+    if(va ==0xbebb1774 || state->Reg[15] == 0x400ff594){
+                //printf("In %s, current=0x%x. mode is %x, pc=0x%x\n", __FUNCTION__, state->CurrInstr, state->Mode, state->Reg[15]);
+                printf("In %s, ap is %d, sop is %d, va=0x%x, pa=0x%x, fault=%d, data=0x%x\n", __FUNCTION__, ap, sop, va, pa, fault, data);
+                int i;
+                for(i = 0; i < 16; i++)
+                        printf("Reg[%d]=0x%x\t", i, state->Reg[i]);
+                printf("\n");
+        }
+#endif
+    if (fault) {
+        DEBUG_LOG(ARM11, "translate\n");
+        //printf("mmu read fault at %x\n", va);
+        //printf("fault is %d\n", fault);
+        return fault;
+    }
+//    printf("va is %x pa is %x\n", va, pa);
+
+    /* no tlb, only check permission */
+    if (!check_perms(state, ap, 1)) {
+        if (sop == 0) {
+            return SECTION_PERMISSION_FAULT;
+        } else {
+            return SUBPAGE_PERMISSION_FAULT;
+        }
+    }
+#if 0
+    /*check access permission */
+    fault = check_access (state, va, tlb, 1);
+    if (fault)
+        return fault;
+#endif
+
+    //insert_tlb(state, va, pa);
+skip_translation:
+        /* *data = mem_read_word(state, pa); */
+    if (datatype == ARM_BYTE_TYPE) {
+        /* *data = mem_read_byte (state, pa | (real_va & 3)); */
+        if(state->space.conf_obj != NULL)
+            state->space.read(state->space.conf_obj, pa | (real_va & 3), data, 1);
+        else
+            *data = Memory::Read8(pa | (real_va & 3)); //mem_read_raw(8, pa | (real_va & 3), data);
+        /* mem_read_raw(32, pa | (real_va & 3), data); */
+    } else if (datatype == ARM_HALFWORD_TYPE) {
+        /* *data = mem_read_halfword (state, pa | (real_va & 2)); */
+        if(state->space.conf_obj != NULL)
+            state->space.read(state->space.conf_obj, pa | (real_va & 3), data, 2);
+        else
+            *data = Memory::Read16(pa | (real_va & 3)); //mem_read_raw(16, pa | (real_va & 3), data);
+        /* mem_read_raw(32, pa | (real_va & 2), data); */
+    } else if (datatype == ARM_WORD_TYPE)
+        /* *data = mem_read_word (state, pa); */
+        if(state->space.conf_obj != NULL)    
+            state->space.read(state->space.conf_obj, pa , data, 4);
+        else
+            *data = Memory::Read32(pa); //mem_read_raw(32, pa, data);
+    else {
+        ERROR_LOG(ARM11, "SKYEYE:2 arm1176jzf_s_mmu_read error: unknown data type %d\n", datatype);
+    }
+    if(0 && (va == 0x2869c)){
+                printf("In %s, pa is %x va=0x%x, value is %x pc %x, instr=0x%x\n", __FUNCTION__, pa, va, *data, state->Reg[15], state->CurrInstr);
+    }
+
+    /* ldrex or ldrexb */
+    if(((state->CurrInstr & 0x0FF000F0) == 0x01900090) ||
+        ((state->CurrInstr & 0x0FF000F0) == 0x01d00090)){
+        int rn = (state->CurrInstr & 0xF0000) >> 16;
+        if(state->Reg[rn] == va){
+            add_exclusive_addr(state, pa | (real_va & 3));
+            state->exclusive_access_state = 1;
+        }
+    }
+#if 0
+    if (state->pc == 0xc011a868) {
+            printf("pa is %x value is %x size is %x\n", pa, data, datatype);
+            printf("icounter is %lld\n", state->NumInstrs);
+//            exit(-1);
+    }
+#endif
+
+    return NO_FAULT;
+}
+
+
+static fault_t
+arm1176jzf_s_mmu_write_byte (ARMul_State *state, ARMword virt_addr, ARMword data)
+{
+    return arm1176jzf_s_mmu_write (state, virt_addr, data, ARM_BYTE_TYPE);
+}
+
+static fault_t
+arm1176jzf_s_mmu_write_halfword (ARMul_State *state, ARMword virt_addr,
+                ARMword data)
+{
+    return arm1176jzf_s_mmu_write (state, virt_addr, data, ARM_HALFWORD_TYPE);
+}
+
+static fault_t
+arm1176jzf_s_mmu_write_word (ARMul_State *state, ARMword virt_addr, ARMword data)
+{
+    return arm1176jzf_s_mmu_write (state, virt_addr, data, ARM_WORD_TYPE);
+}
+
+
+
+static fault_t
+arm1176jzf_s_mmu_write (ARMul_State *state, ARMword va, ARMword data,
+           ARMword datatype)
+{
+    int b;
+    ARMword pa, real_va;
+    ARMword perm;        /* physical addr access permissions */
+    fault_t fault;
+    int ap, sop;
+
+#if 0
+    /8 for sky_printk debugger.*/
+    if (va == 0xffffffff) {
+        putchar((char)data);
+        return 0;
+    }
+    if (va == 0xBfffffff) {
+        putchar((char)data);
+        return 0;
+    }
+#endif
+
+    //DEBUG_LOG(ARM11, "va = %x, val = %x\n", va, data);
+    va = mmu_pid_va_map (va);
+    real_va = va;
+
+    if (MMU_Disabled) {
+        /* mem_write_word(state, va, data); */
+        if (datatype == ARM_BYTE_TYPE)
+            /* mem_write_byte (state, va, data); */
+            if(state->space.conf_obj != NULL)
+                state->space.write(state->space.conf_obj, va, &data, 1);
+            else
+                Memory::Write8(va, data);
+        else if (datatype == ARM_HALFWORD_TYPE)
+            /* mem_write_halfword (state, va, data); */
+            if(state->space.conf_obj != NULL)
+                state->space.write(state->space.conf_obj, va, &data, 2);
+            else
+                Memory::Write16(va, data);
+        else if (datatype == ARM_WORD_TYPE)
+            /* mem_write_word (state, va, data); */
+            if(state->space.conf_obj != NULL)
+                state->space.write(state->space.conf_obj, va, &data, 4);
+            else
+                Memory::Write32(va, data);
+        else {
+            ERROR_LOG (ARM11, "SKYEYE:1 arm1176jzf_s_mmu_write error: unknown data type %d\n", datatype);
+        }
+        goto finished_write;
+        //return 0;
+    }
+    /*align check */
+    /* if ((va & (WORD_SIZE - 1)) && MMU_Aligned){ */
+    if (((va & 3) && (datatype == ARM_WORD_TYPE) && MMU_Aligned) ||
+        ((va & 1) && (datatype == ARM_HALFWORD_TYPE) && MMU_Aligned)) {
+        DEBUG_LOG(ARM11, "align\n");
+        return ALIGNMENT_FAULT;
+    }
+    va &= ~(WORD_SIZE - 1);
+    #if 0
+    uint32_t page_base;
+    page_base = get_phys_page(state, va);
+    if((page_base & 0xFFF) == 0){
+        pa = (page_base << 12) | (va & 0xFFF);
+        goto skip_translation;
+    }
+    #endif
+    /*tlb translate */
+    fault = mmu_translate (state, va, &pa, &ap, &sop);
+#if 0
+    if(va ==0xbebb1774 || state->Reg[15] == 0x40102334){
+                //printf("In %s, current=0x%x. mode is %x, pc=0x%x\n", __FUNCTION__, state->CurrInstr, state->Mode, state->Reg[15]);
+                printf("In %s, ap is %d, sop is %d, va=0x%x, pa=0x%x, fault=%d, data=0x%x\n", __FUNCTION__, ap, sop, va, pa, fault, data);
+                int i;
+                for(i = 0; i < 16; i++)
+                        printf("Reg[%d]=0x%x\t", i, state->Reg[i]);
+                printf("\n");
+        }
+#endif
+    if (fault) {
+        DEBUG_LOG(ARM11, "translate\n");
+        //printf("mmu write fault at %x\n", va);
+        return fault;
+    }
+//    printf("va is %x pa is %x\n", va, pa);
+
+    /* no tlb, only check permission */
+    if (!check_perms(state, ap, 0)) {
+        if (sop == 0) {
+            return SECTION_PERMISSION_FAULT;
+        } else {
+            return SUBPAGE_PERMISSION_FAULT;
+        }
+    }
+
+#if 0
+    /* tlb check access */
+    fault = check_access (state, va, tlb, 0);
+    if (fault) {
+        DEBUG_LOG(ARM11, "check_access\n");
+        return fault;
+    }
+#endif
+#if 0
+    if (pa <= 0x502860ff && (pa + 1 << datatype) > 0x502860ff) {
+            printf("pa is %x value is %x size is %x\n", pa, data, datatype);
+    }
+#endif
+#if 0
+    if (state->pc == 0xc011a878) {
+            printf("write pa is %x value is %x size is %x\n", pa, data, datatype);
+            printf("icounter is %lld\n", state->NumInstrs);
+            exit(-1);
+    }
+#endif
+    //insert_tlb(state, va, pa);
+skip_translation:
+    /* strex */
+    if(((state->CurrInstr & 0x0FF000F0) == 0x01800090) ||
+        ((state->CurrInstr & 0x0FF000F0) == 0x01c00090)){
+        /* failed , the address is monitord now. */
+        int dest_reg = (state->CurrInstr & 0xF000) >> 12;
+        if((exclusive_detect(state, pa | (real_va & 3)) == 0) && (state->exclusive_access_state == 1)){
+            remove_exclusive(state, pa | (real_va & 3));
+            state->Reg[dest_reg] = 0;
+            state->exclusive_access_state = 0;
+        }
+        else{
+            state->Reg[dest_reg] = 1;
+            //printf("In %s, try to strex a monitored address 0x%x\n", __FUNCTION__, pa);
+            return NO_FAULT;
+        }
+    }
+
+    if (datatype == ARM_BYTE_TYPE) {
+        /* mem_write_byte (state,
+                (pa | (real_va & 3)),
+                data);
+        */
+        if(state->space.conf_obj != NULL)
+            state->space.write(state->space.conf_obj, (pa | (real_va & 3)), &data, 1);
+        else
+            Memory::Write8((pa | (real_va & 3)), data);
+
+    } else if (datatype == ARM_HALFWORD_TYPE)
+        /* mem_write_halfword (state,
+                    (pa |
+                     (real_va & 2)),
+                    data);
+        */
+        if(state->space.conf_obj != NULL)
+            state->space.write(state->space.conf_obj, (pa | (real_va & 3)), &data, 2);
+        else
+            Memory::Write16((pa | (real_va & 3)), data);
+    else if (datatype == ARM_WORD_TYPE)
+        /* mem_write_word (state, pa, data); */
+        if(state->space.conf_obj != NULL)
+            state->space.write(state->space.conf_obj, pa, &data, 4);
+        else
+            Memory::Write32(pa, data);
+#if 0
+    if (state->NumInstrs > 236403) {
+            printf("write memory\n");
+                printf("pa is %x value is %x size is %x\n", pa, data, datatype);
+                printf("icounter is %lld\n", state->NumInstrs);
+    }
+#endif
+finished_write:
+#if DIFF_WRITE
+    if(state->icounter > state->debug_icounter){
+        if(state->CurrWrite >= 17 ){
+            printf("Wrong write array, 0x%x",  state->CurrWrite);
+            exit(-1);
+        }
+        uint32 record_data = data;
+        if(datatype == ARM_BYTE_TYPE)
+            record_data &= 0xFF;
+        if(datatype == ARM_HALFWORD_TYPE)
+            record_data &= 0xFFFF;
+
+        state->WriteAddr[state->CurrWrite] = pa | (real_va & 3);
+        state->WriteData[state->CurrWrite] = record_data;
+        state->WritePc[state->CurrWrite] = state->Reg[15];
+        state->CurrWrite++;
+        //printf("In %s, pc=0x%x, addr=0x%x, data=0x%x, CFlag=%d\n", __FUNCTION__, state->Reg[15],  pa | (real_va & 3), record_data, state->CFlag);
+    }
+#endif
+
+    return NO_FAULT;
+}
+
+ARMword
+arm1176jzf_s_mmu_mrc (ARMul_State *state, ARMword instr, ARMword *value)
+{
+    int creg = BITS (16, 19) & 0xf;
+    int OPC_1 = BITS (21, 23) & 0x7;
+    int OPC_2 = BITS (5, 7) & 0x7;
+    ARMword data;
+
+    switch (creg) {
+    case MMU_ID:
+        if (OPC_2 == 0) {
+            data = state->cpu->cpu_val;
+        } else if (OPC_2 == 1) {
+            /* Cache type:
+             * 000 0110 1 000 101 110 0 10 000 101 110 0 10
+             * */
+            data = 0x0D172172;
+        }
+        break;
+    case MMU_CONTROL:
+        /*
+         * 6:3          read as 1
+         * 10           read as 0
+         * 18,16    read as 1
+         * */
+        data = (state->mmu.control | 0x50078) & 0xFFFFFBFF;
+        break;
+    case MMU_TRANSLATION_TABLE_BASE:
+#if 0
+        data = state->mmu.translation_table_base;
+#endif
+        switch (OPC_2) {
+        case 0:
+            data = state->mmu.translation_table_base0;
+            break;
+        case 1:
+            data = state->mmu.translation_table_base1;
+            break;
+        case 2:
+            data = state->mmu.translation_table_ctrl;
+            break;
+        default:
+            printf ("mmu_mrc read UNKNOWN - p15 c2 opcode2 %d\n", OPC_2);
+            break;
+        }
+        break;
+    case MMU_DOMAIN_ACCESS_CONTROL:
+        data = state->mmu.domain_access_control;
+        break;
+    case MMU_FAULT_STATUS:
+        /* OPC_2 = 0: data FSR value
+         * */
+        if (OPC_2 == 0)
+            data = state->mmu.fault_status;
+        if (OPC_2 == 1)
+            data = state->mmu.fault_statusi;
+        break;
+    case MMU_FAULT_ADDRESS:
+        data = state->mmu.fault_address;
+        break;
+    case MMU_PID:
+        //data = state->mmu.process_id;
+        if(OPC_2 == 0)
+            data = state->mmu.process_id;
+        else if(OPC_2 == 1)
+            data = state->mmu.context_id;
+        else if(OPC_2 == 3){
+            data = state->mmu.thread_uro_id;
+        }
+        else{
+            printf ("mmu_mcr read UNKNOWN - reg %d\n", creg);
+        }
+        //printf("SKYEYE In %s, read pid 0x%x, OPC_2 %d, instr=0x%x\n", __FUNCTION__, data, OPC_2, instr);
+        //exit(-1);
+        break;
+    default:
+        printf ("mmu_mrc read UNKNOWN - reg %d\n", creg);
+        data = 0;
+        break;
+    }
+/*      printf("\t\t\t\t\tpc = 0x%08x\n", state->Reg[15]); */
+    *value = data;
+    return data;
+}
+
+
+static ARMword
+arm1176jzf_s_mmu_mcr (ARMul_State *state, ARMword instr, ARMword value)
+{
+    int creg = BITS (16, 19) & 0xf;
+    int CRm = BITS (0, 3) & 0xf;
+    int OPC_1 = BITS (21, 23) & 0x7;
+    int OPC_2 = BITS (5, 7) & 0x7;
+    if (!strncmp (state->cpu->cpu_arch_name, "armv6", 5)) {
+        switch (creg) {
+        case MMU_CONTROL:
+        /*
+         * 6:3          read as 1
+         * 10           read as 0
+         * 18,16    read as 1
+         * */
+            if(OPC_2 == 0)
+                state->mmu.control = (value | 0x50078) & 0xFFFFFBFF;
+            else if(OPC_2 == 1)
+                state->mmu.auxiliary_control = value;
+            else if(OPC_2 == 2)
+                state->mmu.coprocessor_access_control = value;
+            else
+                fprintf(stderr, "In %s, wrong OPC_2 %d\n", __FUNCTION__, OPC_2);
+            break;
+        case MMU_TRANSLATION_TABLE_BASE:
+            switch (OPC_2) {
+                /* int i; */
+                case 0:
+#if 0
+                /* TTBR0 */
+                    if (state->mmu.translation_table_ctrl & 0x7) {
+                        for (i = 0; i <= state->mmu.translation_table_ctrl; i++)
+                            state->mmu.translation_table_base0 &= ~(1 << (5 + i));
+                    }
+#endif
+                    state->mmu.translation_table_base0 = (value);
+                    break;
+                case 1:
+#if 0
+                /* TTBR1 */
+                    if (state->mmu.translation_table_ctrl & 0x7) {
+                        for (i = 0; i <= state->mmu.translation_table_ctrl; i++)
+                            state->mmu.translation_table_base1 &= 1 << (5 + i);
+                    }
+#endif
+                    state->mmu.translation_table_base1 = (value);
+                    break;
+                case 2:
+                /* TTBC */
+                    state->mmu.translation_table_ctrl = value & 0x7;
+                    break;
+                default:
+                    printf ("mmu_mcr wrote UNKNOWN - cp15 c2 opcode2 %d\n", OPC_2);
+                    break;
+            }
+            //printf("SKYEYE In %s, write TLB_BASE 0x%x OPC_2=%d instr=0x%x\n", __FUNCTION__, value, OPC_2, instr);
+            //invalidate_all_tlb(state);
+            break;
+        case MMU_DOMAIN_ACCESS_CONTROL:
+        /* printf("mmu_mcr wrote DACR         "); */
+            state->mmu.domain_access_control = value;
+            break;
+
+        case MMU_FAULT_STATUS:
+            if (OPC_2 == 0)
+                state->mmu.fault_status = value & 0xFF;
+            if (OPC_2 == 1) {
+                printf("set fault status instr\n");
+            }
+            break;
+        case MMU_FAULT_ADDRESS:
+            state->mmu.fault_address = value;
+            break;
+
+        case MMU_CACHE_OPS:
+            break;
+        case MMU_TLB_OPS:
+            {
+                switch(CRm){
+                case 5: /* ITLB */
+                {
+                    switch(OPC_2){
+                        case 0: /* invalidate all */
+                            //invalidate_all_tlb(state);
+                            break;
+                        case 1: /* invalidate by MVA */
+                            //invalidate_by_mva(state, value);
+                            break;
+                        case 2: /* invalidate by asid */
+                            //invalidate_by_asid(state, value);
+                            break;
+                        default:
+                            printf ("mmu_mcr wrote UNKNOWN - reg %d\n", creg);
+                            break;
+                    }
+                    break;
+                }
+                case 6: /* DTLB */
+                {
+                    switch(OPC_2){
+                        case 0: /* invalidate all */
+                            //invalidate_all_tlb(state);
+                            break;
+                        case 1: /* invalidate by MVA */
+                            //invalidate_by_mva(state, value);
+                            break;
+                        case 2: /* invalidate by asid */
+                            //invalidate_by_asid(state, value);
+                            break;
+                        default:
+                            printf ("mmu_mcr wrote UNKNOWN - reg %d\n", creg);
+                            break;
+                    }
+                    break;
+                }
+                case 7: /* Unified TLB */
+                {
+                    switch(OPC_2){
+                        case 0: /* invalidate all */
+                            //invalidate_all_tlb(state);
+                            break;
+                        case 1: /* invalidate by MVA */
+                            //invalidate_by_mva(state, value);
+                            break;
+                        case 2: /* invalidate by asid */
+                            //invalidate_by_asid(state, value);
+                            break;
+                        default:
+                            printf ("mmu_mcr wrote UNKNOWN - reg %d\n", creg);
+                            break;
+                    }
+                    break;
+                }
+
+                default:
+                    printf ("mmu_mcr wrote UNKNOWN - reg %d, CRm=%d\n", creg, CRm);
+                    break;
+                }
+            //printf("SKYEYE In %s, write TLB 0x%x OPC_1=%d, OPC_2=%d , CRm=%d instr=0x%x\n", __FUNCTION__, value, OPC_1, OPC_2, CRm, instr);
+            }
+            break;
+        case MMU_CACHE_LOCKDOWN:
+            /*
+             * FIXME: cache lock down*/
+            break;
+        case MMU_TLB_LOCKDOWN:
+            printf("SKYEYE In %s, write TLB_LOCKDOWN 0x%x OPC_2=%d instr=0x%x\n", __FUNCTION__, value, OPC_2, instr);
+            /* FIXME:tlb lock down */
+            break;
+        case MMU_PID:
+            //printf("SKYEYE In %s, write pid 0x%x OPC_2=%d instr=0x%x\n", __FUNCTION__, value, OPC_2, instr);
+            //state->mmu.process_id = value;
+            /*0:24 should be zero. */
+            //state->mmu.process_id = value & 0xfe000000;
+            if(OPC_2 == 0)
+                state->mmu.process_id = value;
+            else if(OPC_2 == 1)
+                state->mmu.context_id = value;
+            else if(OPC_2 == 3){
+                state->mmu.thread_uro_id = value;
+            }
+            else{
+                printf ("mmu_mcr wrote UNKNOWN - reg %d\n", creg);
+            }
+            break;
+
+        default:
+            printf ("mmu_mcr wrote UNKNOWN - reg %d\n", creg);
+            break;
+        }
+    }
+
+    return No_exp;
+}
+
+///* teawater add for arm2x86 2005.06.19------------------------------------------- */
+//static int
+//arm1176jzf_s_mmu_v2p_dbct (ARMul_State *state, ARMword virt_addr,
+//              ARMword *phys_addr)
+//{
+//    fault_t fault;
+//    int ap, sop;
+//
+//    ARMword perm;        /* physical addr access permissions */
+//    virt_addr = mmu_pid_va_map (virt_addr);
+//    if (MMU_Enabled) {
+//
+//        /*align check */
+//        if ((virt_addr & (WORD_SIZE - 1)) && MMU_Aligned) {
+//            DEBUG_LOG(ARM11, "align\n");
+//            return ALIGNMENT_FAULT;
+//        } else
+//            virt_addr &= ~(WORD_SIZE - 1);
+//
+//        /*translate tlb */
+//        fault = mmu_translate (state, virt_addr, phys_addr, &ap, &sop);
+//        if (fault) {
+//            DEBUG_LOG(ARM11, "translate\n");
+//            return fault;
+//        }
+//
+//        /* permission check */
+//        if (!check_perms(state, ap, 1)) {
+//            if (sop == 0) {
+//                return SECTION_PERMISSION_FAULT;
+//            } else {
+//                return SUBPAGE_PERMISSION_FAULT;
+//            }
+//        }
+//#if 0
+//        /*check access */
+//        fault = check_access (state, virt_addr, tlb, 1);
+//        if (fault) {
+//            DEBUG_LOG(ARM11, "check_fault\n");
+//            return fault;
+//        }
+//#endif
+//    }
+//
+//    if (MMU_Disabled) {
+//        *phys_addr = virt_addr;
+//    }
+//
+//    return 0;
+//}
+
+/* AJ2D-------------------------------------------------------------------------- */
+
+/*arm1176jzf-s mmu_ops_t*/
+mmu_ops_t arm1176jzf_s_mmu_ops = {
+    arm1176jzf_s_mmu_init,
+    arm1176jzf_s_mmu_exit,
+    arm1176jzf_s_mmu_read_byte,
+    arm1176jzf_s_mmu_write_byte,
+    arm1176jzf_s_mmu_read_halfword,
+    arm1176jzf_s_mmu_write_halfword,
+    arm1176jzf_s_mmu_read_word,
+    arm1176jzf_s_mmu_write_word,
+    arm1176jzf_s_mmu_load_instr,
+    arm1176jzf_s_mmu_mcr,
+    arm1176jzf_s_mmu_mrc
+/* teawater add for arm2x86 2005.06.19------------------------------------------- */
+/*    arm1176jzf_s_mmu_v2p_dbct, */
+/* AJ2D-------------------------------------------------------------------------- */
+};
diff --git a/src/core/arm/interpreter/mmu/arm1176jzf_s_mmu.h b/src/core/arm/interpreter/mmu/arm1176jzf_s_mmu.h
new file mode 100644
index 000000000..299c6b46b
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/arm1176jzf_s_mmu.h
@@ -0,0 +1,37 @@
+/*
+    arm1176JZF-S_mmu.h - ARM1176JZF-S Memory Management Unit emulation.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+#ifndef _ARM1176JZF_S_MMU_H_
+#define _ARM1176JZF_S_MMU_H_
+
+#if 0
+typedef struct arm1176jzf-s_mmu_s
+{
+    tlb_t i_tlb;
+    cache_t i_cache;
+
+    tlb_t d_tlb;
+    cache_t d_cache;
+    wb_t wb_t;
+} arm1176jzf-s_mmu_t;
+#endif
+extern mmu_ops_t arm1176jzf_s_mmu_ops;
+
+ARMword
+arm1176jzf_s_mmu_mrc (ARMul_State *state, ARMword instr, ARMword *value);
+#endif /*_ARM1176JZF_S_MMU_H_*/
diff --git a/src/core/arm/interpreter/mmu/cache.cpp b/src/core/arm/interpreter/mmu/cache.cpp
new file mode 100644
index 000000000..f3c4e0531
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/cache.cpp
@@ -0,0 +1,370 @@
+#include "core/arm/interpreter/armdefs.h"
+
+/* mmu cache init
+ *
+ * @cache_t :cache_t to init
+ * @width	:cache line width in byte
+ * @way		:way of each cache set
+ * @set		:cache set num
+ *
+ * $ -1: error
+ * 	 0: sucess
+ */
+int
+mmu_cache_init (cache_s * cache_t, int width, int way, int set, int w_mode)
+{
+	int i, j;
+	cache_set_t *sets;
+	cache_line_t *lines;
+
+	/*alloc cache set */
+	sets = NULL;
+	lines = NULL;
+	//fprintf(stderr, "mmu_cache_init: mallloc beg size %d,sets 0x%x\n", sizeof(cache_set_t) * set,sets);
+	//exit(-1);
+	sets = (cache_set_t *) malloc (sizeof (cache_set_t) * set);
+	if (sets == NULL) {
+		ERROR_LOG(ARM11, "set malloc size %d\n", sizeof (cache_set_t) * set);
+		goto sets_error;
+	}
+	//fprintf(stderr, "mmu_cache_init: mallloc end sets 0x%x\n", sets);
+	cache_t->sets = sets;
+
+	/*init cache set */
+	for (i = 0; i < set; i++) {
+		/*alloc cache line */
+		lines = (cache_line_t *) malloc (sizeof (cache_line_t) * way);
+		if (lines == NULL) {
+			ERROR_LOG(ARM11, "line malloc size %d\n",
+				 sizeof (cache_line_t) * way);
+			goto lines_error;
+		}
+		/*init cache line */
+		for (j = 0; j < way; j++) {
+			lines[j].tag = 0;	//invalid
+			lines[j].data = (ARMword *) malloc (width);
+			if (lines[j].data == NULL) {
+				ERROR_LOG(ARM11, "data alloc size %d\n", width);
+				goto data_error;
+			}
+		}
+
+		sets[i].lines = lines;
+		sets[i].cycle = 0;
+
+	}
+	cache_t->width = width;
+	cache_t->set = set;
+	cache_t->way = way;
+	cache_t->w_mode = w_mode;
+	return 0;
+
+      data_error:
+	/*free data */
+	while (j-- > 0)
+		free (lines[j].data);
+	/*free data error line */
+	free (lines);
+      lines_error:
+	/*free lines already alloced */
+	while (i-- > 0) {
+		for (j = 0; j < way; j++)
+			free (sets[i].lines[j].data);
+		free (sets[i].lines);
+	}
+	/*free sets */
+	free (sets);
+      sets_error:
+	return -1;
+};
+
+/* free a cache_t's inner data, the ptr self is not freed,
+ * when needed do like below:
+ * 		mmu_cache_exit(cache);
+ * 		free(cache_t);
+ *
+ * @cache_t : the cache_t to free
+ */
+
+void
+mmu_cache_exit (cache_s * cache_t)
+{
+	int i, j;
+	cache_set_t *sets, *set;
+	cache_line_t *lines, *line;
+
+	/*free all set */
+	sets = cache_t->sets;
+	for (set = sets, i = 0; i < cache_t->set; i++, set++) {
+		/*free all line */
+		lines = set->lines;
+		for (line = lines, j = 0; j < cache_t->way; j++, line++)
+			free (line->data);
+		free (lines);
+	}
+	free (sets);
+}
+
+/* mmu cache search
+ *
+ * @state	:ARMul_State
+ * @cache_t	:cache_t to search
+ * @va		:virtual address
+ *
+ * $	NULL:	no cache match
+ * 		cache	:cache matched
+ */
+cache_line_t *
+mmu_cache_search (ARMul_State * state, cache_s * cache_t, ARMword va)
+{
+	int i;
+	int set = va_cache_set (va, cache_t);
+	ARMword tag = va_cache_align (va, cache_t);
+	cache_line_t *cache;
+
+	cache_set_t *cache_set = cache_t->sets + set;
+	for (i = 0, cache = cache_set->lines; i < cache_t->way; i++, cache++) {
+		if ((cache->tag & TAG_VALID_FLAG)
+		    && (tag == va_cache_align (cache->tag, cache_t)))
+			return cache;
+	}
+	return NULL;
+}
+
+/* mmu cache search by set/index
+ *
+ * @state	:ARMul_State
+ * @cache_t	:cache_t to search
+ * @index	:set/index value. 
+ *
+ * $	NULL:	no cache match
+ * 		cache	:cache matched
+ */
+cache_line_t *
+mmu_cache_search_by_index (ARMul_State * state, cache_s * cache_t,
+			   ARMword index)
+{
+	int way = cache_t->way;
+	int set_v = index_cache_set (index, cache_t);
+	int i = 0, index_v = 0;
+	cache_set_t *set;
+
+	while ((way >>= 1) >= 1)
+		i++;
+	index_v = index >> (32 - i);
+	set = cache_t->sets + set_v;
+
+	return set->lines + index_v;
+}
+
+
+/* mmu cache alloc
+ *
+ * @state :ARMul_State
+ * @cache_t	:cache_t to alloc from
+ * @va		:virtual address that require cache alloc, need not cache aligned
+ * @pa		:physical address of va
+ *
+ * $	cache_alloced, always alloc OK
+ */
+cache_line_t *
+mmu_cache_alloc (ARMul_State * state, cache_s * cache_t, ARMword va,
+		 ARMword pa)
+{
+	cache_line_t *cache;
+	cache_set_t *set;
+	int i;
+
+	va = va_cache_align (va, cache_t);
+	pa = va_cache_align (pa, cache_t);
+
+	set = &cache_t->sets[va_cache_set (va, cache_t)];
+
+	/*robin-round */
+	cache = &set->lines[set->cycle++];
+	if (set->cycle == cache_t->way)
+		set->cycle = 0;
+
+	if (cache_t->w_mode == CACHE_WRITE_BACK) {
+		ARMword t;
+
+		/*if cache valid, try to write back */
+		if (cache->tag & TAG_VALID_FLAG) {
+			mmu_cache_write_back (state, cache_t, cache);
+		}
+		/*read in cache_line */
+		t = pa;
+		for (i = 0; i < (cache_t->width >> WORD_SHT);
+		     i++, t += WORD_SIZE) {
+			//cache->data[i] = mem_read_word (state, t);
+			bus_read(32, t, &cache->data[i]);
+		}
+	}
+	/*store tag and pa */
+	cache->tag = va | TAG_VALID_FLAG;
+	cache->pa = pa;
+
+	return cache;
+};
+
+/* mmu_cache_write_back write cache data to memory
+ * @state
+ * @cache_t :cache_t of the cache line
+ * @cache : cache line
+ */
+void
+mmu_cache_write_back (ARMul_State * state, cache_s * cache_t,
+		      cache_line_t * cache)
+{
+	ARMword pa = cache->pa;
+	int nw = cache_t->width >> WORD_SHT;
+	ARMword *data = cache->data;
+	int i;
+	int t0, t1, t2;
+
+	if ((cache->tag & 1) == 0)
+		return;
+
+	switch (cache->
+		tag & ~1 & (TAG_FIRST_HALF_DIRTY | TAG_LAST_HALF_DIRTY)) {
+	case 0:
+		return;
+	case TAG_FIRST_HALF_DIRTY:
+		nw /= 2;
+		break;
+	case TAG_LAST_HALF_DIRTY:
+		nw /= 2;
+		pa += nw << WORD_SHT;
+		data += nw;
+		break;
+	case TAG_FIRST_HALF_DIRTY | TAG_LAST_HALF_DIRTY:
+		break;
+	}
+	for (i = 0; i < nw; i++, data++, pa += WORD_SIZE)
+		//mem_write_word (state, pa, *data);
+		bus_write(32, pa, *data);
+
+	cache->tag &= ~(TAG_FIRST_HALF_DIRTY | TAG_LAST_HALF_DIRTY);
+};
+
+
+/* mmu_cache_clean: clean a cache of va in cache_t
+ *
+ * @state	:ARMul_State
+ * @cache_t	:cache_t to clean
+ * @va		:virtaul address
+ */
+void
+mmu_cache_clean (ARMul_State * state, cache_s * cache_t, ARMword va)
+{
+	cache_line_t *cache;
+
+	cache = mmu_cache_search (state, cache_t, va);
+	if (cache)
+		mmu_cache_write_back (state, cache_t, cache);
+}
+
+/* mmu_cache_clean_by_index: clean a cache by set/index format value
+ *
+ * @state	:ARMul_State
+ * @cache_t	:cache_t to clean
+ * @va		:set/index format value
+ */
+void
+mmu_cache_clean_by_index (ARMul_State * state, cache_s * cache_t,
+			  ARMword index)
+{
+	cache_line_t *cache;
+
+	cache = mmu_cache_search_by_index (state, cache_t, index);
+	if (cache)
+		mmu_cache_write_back (state, cache_t, cache);
+}
+
+/* mmu_cache_invalidate : invalidate a cache of va
+ *
+ * @state	:ARMul_State
+ * @cache_t	:cache_t to invalid
+ * @va		:virt_addr to invalid
+ */
+void
+mmu_cache_invalidate (ARMul_State * state, cache_s * cache_t, ARMword va)
+{
+	cache_line_t *cache;
+
+	cache = mmu_cache_search (state, cache_t, va);
+	if (cache) {
+		mmu_cache_write_back (state, cache_t, cache);
+		cache->tag = 0;
+	}
+}
+
+/* mmu_cache_invalidate_by_index : invalidate a cache by index format
+ *
+ * @state	:ARMul_State
+ * @cache_t	:cache_t to invalid
+ * @index	:set/index data
+ */
+void
+mmu_cache_invalidate_by_index (ARMul_State * state, cache_s * cache_t,
+			       ARMword index)
+{
+	cache_line_t *cache;
+
+	cache = mmu_cache_search_by_index (state, cache_t, index);
+	if (cache) {
+		mmu_cache_write_back (state, cache_t, cache);
+		cache->tag = 0;
+	}
+}
+
+/* mmu_cache_invalidate_all
+ *
+ * @state:
+ * @cache_t
+ * */
+void
+mmu_cache_invalidate_all (ARMul_State * state, cache_s * cache_t)
+{
+	int i, j;
+	cache_set_t *set;
+	cache_line_t *cache;
+
+	set = cache_t->sets;
+	for (i = 0; i < cache_t->set; i++, set++) {
+		cache = set->lines;
+		for (j = 0; j < cache_t->way; j++, cache++) {
+			mmu_cache_write_back (state, cache_t, cache);
+			cache->tag = 0;
+		}
+	}
+};
+
+void
+mmu_cache_soft_flush (ARMul_State * state, cache_s * cache_t, ARMword pa)
+{
+	ARMword set, way;
+	cache_line_t *cache;
+	pa = (pa / cache_t->width);
+	way = pa & (cache_t->way - 1);
+	set = (pa / cache_t->way) & (cache_t->set - 1);
+	cache = &cache_t->sets[set].lines[way];
+
+	mmu_cache_write_back (state, cache_t, cache);
+	cache->tag = 0;
+}
+
+cache_line_t*  mmu_cache_dirty_cache(ARMul_State *state,cache_s *cache){
+	int i;
+	int j;
+	cache_line_t *cache_line = NULL;
+	cache_set_t *cache_set = cache->sets;
+	int sets = cache->set;
+	for (i = 0; i < sets; i++){
+		for(j = 0,cache_line = &cache_set[i].lines[0]; j < cache->way; j++,cache_line++){
+			if((cache_line->tag & TAG_FIRST_HALF_DIRTY) || (cache_line->tag & TAG_LAST_HALF_DIRTY))
+				return cache_line;
+		}
+	}
+	return NULL;
+}
diff --git a/src/core/arm/interpreter/mmu/cache.h b/src/core/arm/interpreter/mmu/cache.h
new file mode 100644
index 000000000..d308d9b87
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/cache.h
@@ -0,0 +1,168 @@
+#ifndef _MMU_CACHE_H_
+#define _MMU_CACHE_H_
+
+typedef struct cache_line_t
+{
+    ARMword tag;        /*      cache line align address |
+                   bit2: last half dirty
+                   bit1: first half dirty
+                   bit0: cache valid flag
+                 */
+    ARMword pa;        /*physical address */
+    ARMword *data;        /*array of cached data */
+} cache_line_t;
+#define TAG_VALID_FLAG 0x00000001
+#define TAG_FIRST_HALF_DIRTY 0x00000002
+#define TAG_LAST_HALF_DIRTY    0x00000004
+
+/*cache set association*/
+typedef struct cache_set_s
+{
+    cache_line_t *lines;
+    int cycle;
+} cache_set_t;
+
+enum
+{
+    CACHE_WRITE_BACK,
+    CACHE_WRITE_THROUGH,
+};
+
+typedef struct cache_s
+{
+    int width;        /*bytes in a line */
+    int way;        /*way of set asscociate */
+    int set;        /*num of set */
+    int w_mode;        /*write back or write through */
+    //int a_mode;   /*alloc mode: random or round-bin*/
+    cache_set_t *sets;
+  /**/} cache_s;
+
+typedef struct cache_desc_s
+{
+    int width;
+    int way;
+    int set;
+    int w_mode;
+//      int a_mode;
+} cache_desc_t;
+
+
+/*virtual address to cache set index*/
+#define va_cache_set(va, cache_t) \
+    (((va) / (cache_t)->width) & ((cache_t)->set - 1))
+/*virtual address to cahce line aligned*/
+#define va_cache_align(va, cache_t) \
+        ((va) & ~((cache_t)->width - 1))
+/*virtaul address to cache line word index*/
+#define va_cache_index(va, cache_t) \
+        (((va) & ((cache_t)->width - 1)) >> WORD_SHT)
+
+/*see Page 558 in arm manual*/
+/*set/index format value to cache set value*/
+#define index_cache_set(index, cache_t) \
+    (((index) / (cache_t)->width) & ((cache_t)->set - 1))
+
+/*************************cache********************/
+/* mmu cache init
+ *
+ * @cache_t :cache_t to init
+ * @width    :cache line width in byte
+ * @way        :way of each cache set
+ * @set        :cache set num
+ * @w_mode    :cache w_mode
+ *
+ * $ -1: error
+ *      0: sucess
+ */
+int
+mmu_cache_init (cache_s * cache_t, int width, int way, int set, int w_mode);
+
+/* free a cache_t's inner data, the ptr self is not freed,
+ * when needed do like below:
+ *         mmu_cache_exit(cache);
+ *         free(cache_t);
+ *
+ * @cache_t : the cache_t to free
+ */
+void mmu_cache_exit (cache_s * cache_t);
+
+/* mmu cache search
+ *
+ * @state    :ARMul_State
+ * @cache_t    :cache_t to search
+ * @va        :virtual address
+ *
+ * $    NULL:    no cache match
+ *         cache    :cache matched
+ * */
+cache_line_t *mmu_cache_search (ARMul_State * state, cache_s * cache_t,
+                ARMword va);
+
+/*  mmu cache search by set/index 
+ *
+ * @state    :ARMul_State
+ * @cache_t    :cache_t to search
+ * @index       :set/index value. 
+ *
+ * $    NULL:    no cache match
+ *         cache    :cache matched
+ * */
+
+cache_line_t *mmu_cache_search_by_index (ARMul_State * state,
+                     cache_s * cache_t, ARMword index);
+
+/* mmu cache alloc
+ *
+ * @state :ARMul_State
+ * @cache_t    :cache_t to alloc from
+ * @va        :virtual address that require cache alloc, need not cache aligned
+ * @pa        :physical address of va
+ *
+ * $    cache_alloced, always alloc OK
+ */
+cache_line_t *mmu_cache_alloc (ARMul_State * state, cache_s * cache_t,
+                   ARMword va, ARMword pa);
+
+/* mmu_cache_write_back write cache data to memory
+ *
+ * @state:
+ * @cache_t :cache_t of the cache line
+ * @cache : cache line
+ */
+void
+mmu_cache_write_back (ARMul_State * state, cache_s * cache_t,
+              cache_line_t * cache);
+
+/* mmu_cache_clean: clean a cache of va in cache_t
+ *
+ * @state    :ARMul_State
+ * @cache_t    :cache_t to clean
+ * @va        :virtaul address
+ */
+void mmu_cache_clean (ARMul_State * state, cache_s * cache_t, ARMword va);
+void
+mmu_cache_clean_by_index (ARMul_State * state, cache_s * cache_t,
+              ARMword index);
+
+/* mmu_cache_invalidate : invalidate a cache of va
+ *
+ * @state    :ARMul_State
+ * @cache_t    :cache_t to invalid
+ * @va        :virt_addr to invalid
+ */
+void
+mmu_cache_invalidate (ARMul_State * state, cache_s * cache_t, ARMword va);
+
+void
+mmu_cache_invalidate_by_index (ARMul_State * state, cache_s * cache_t,
+                   ARMword index);
+
+void mmu_cache_invalidate_all (ARMul_State * state, cache_s * cache_t);
+
+void
+mmu_cache_soft_flush (ARMul_State * state, cache_s * cache_t, ARMword pa);
+
+cache_line_t* mmu_cache_dirty_cache(ARMul_State * state, cache_s * cache_t);
+
+#endif /*_MMU_CACHE_H_*/
diff --git a/src/core/arm/interpreter/mmu/maverick.cpp b/src/core/arm/interpreter/mmu/maverick.cpp
new file mode 100644
index 000000000..0e98ef22b
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/maverick.cpp
@@ -0,0 +1,1206 @@
+/*  maverick.c -- Cirrus/DSP co-processor interface.
+    Copyright (C) 2003 Free Software Foundation, Inc.
+    Contributed by Aldy Hernandez (aldyh@redhat.com).
+ 
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+ 
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+ 
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */
+
+#include <assert.h>
+
+#include "core/arm/interpreter/armdefs.h"
+#include "core/arm/interpreter/armemu.h"
+
+
+/*#define CIRRUS_DEBUG 1	*/
+#if CIRRUS_DEBUG
+#  define printfdbg printf
+#else
+#  define printfdbg printf_nothing
+#endif
+
+#define POS64(i) ( (~(i)) >> 63 )
+#define NEG64(i) ( (i) >> 63 )
+
+/* Define Co-Processor instruction handlers here.  */
+
+/* Here's ARMulator's DSP definition.  A few things to note:
+   1) it has 16 64-bit registers and 4 72-bit accumulators
+   2) you can only access its registers with MCR and MRC.  */
+
+/* We can't define these in here because this file might not be linked
+   unless the target is arm9e-*.  They are defined in wrapper.c.
+   Eventually the simulator should be made to handle any coprocessor
+   at run time.  */
+struct maverick_regs
+{
+	union
+	{
+		int i;
+		float f;
+	} upper;
+
+	union
+	{
+		int i;
+		float f;
+	} lower;
+};
+
+union maverick_acc_regs
+{
+	long double ld;		/* Acc registers are 72-bits.  */
+};
+
+struct maverick_regs DSPregs[16];
+union maverick_acc_regs DSPacc[4];
+ARMword DSPsc;
+
+#define DEST_REG	(BITS (12, 15))
+#define SRC1_REG	(BITS (16, 19))
+#define SRC2_REG	(BITS (0, 3))
+
+static int lsw_int_index, msw_int_index;
+static int lsw_float_index, msw_float_index;
+
+static double mv_getRegDouble (int);
+static long long mv_getReg64int (int);
+static void mv_setRegDouble (int, double val);
+static void mv_setReg64int (int, long long val);
+
+static union
+{
+	double d;
+	long long ll;
+	int ints[2];
+} reg_conv;
+
+static void
+printf_nothing (void *foo, ...)
+{
+}
+
+static void
+cirrus_not_implemented (char *insn)
+{
+	fprintf (stderr, "Cirrus instruction '%s' not implemented.\n", insn);
+	fprintf (stderr, "aborting!\n");
+
+	// skyeye_exit (1);
+}
+
+static unsigned
+DSPInit (ARMul_State * state)
+{
+	NOTICE_LOG(ARM11, "ARMul_ConsolePrint: DSP present");
+	return TRUE;
+}
+
+unsigned
+DSPMRC4 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword * value)
+{
+	switch (BITS (5, 7)) {
+	case 0:		/* cfmvrdl */
+		/* Move lower half of a DF stored in a DSP reg into an Arm reg.  */
+		printfdbg ("cfmvrdl\n");
+		printfdbg ("\tlower half=0x%x\n", DSPregs[SRC1_REG].lower.i);
+		printfdbg ("\tentire thing=%g\n", mv_getRegDouble (SRC1_REG));
+
+		*value = (ARMword) DSPregs[SRC1_REG].lower.i;
+		break;
+
+	case 1:		/* cfmvrdh */
+		/* Move upper half of a DF stored in a DSP reg into an Arm reg.  */
+		printfdbg ("cfmvrdh\n");
+		printfdbg ("\tupper half=0x%x\n", DSPregs[SRC1_REG].upper.i);
+		printfdbg ("\tentire thing=%g\n", mv_getRegDouble (SRC1_REG));
+
+		*value = (ARMword) DSPregs[SRC1_REG].upper.i;
+		break;
+
+	case 2:		/* cfmvrs */
+		/* Move SF from upper half of a DSP register to an Arm register.  */
+		*value = (ARMword) DSPregs[SRC1_REG].upper.i;
+		printfdbg ("cfmvrs = mvf%d <-- %f\n",
+			   SRC1_REG, DSPregs[SRC1_REG].upper.f);
+		break;
+
+#ifdef doesnt_work
+	case 4:		/* cfcmps */
+		{
+			float a, b;
+			int n, z, c, v;
+
+			a = DSPregs[SRC1_REG].upper.f;
+			b = DSPregs[SRC2_REG].upper.f;
+
+			printfdbg ("cfcmps\n");
+			printfdbg ("\tcomparing %f and %f\n", a, b);
+
+			z = a == b;	/* zero */
+			n = a != b;	/* negative */
+			v = a > b;	/* overflow */
+			c = 0;	/* carry */
+			*value = (n << 31) | (z << 30) | (c << 29) | (v <<
+								      28);
+			break;
+		}
+
+	case 5:		/* cfcmpd */
+		{
+			double a, b;
+			int n, z, c, v;
+
+			a = mv_getRegDouble (SRC1_REG);
+			b = mv_getRegDouble (SRC2_REG);
+
+			printfdbg ("cfcmpd\n");
+			printfdbg ("\tcomparing %g and %g\n", a, b);
+
+			z = a == b;	/* zero */
+			n = a != b;	/* negative */
+			v = a > b;	/* overflow */
+			c = 0;	/* carry */
+			*value = (n << 31) | (z << 30) | (c << 29) | (v <<
+								      28);
+			break;
+		}
+#else
+	case 4:		/* cfcmps */
+		{
+			float a, b;
+			int n, z, c, v;
+
+			a = DSPregs[SRC1_REG].upper.f;
+			b = DSPregs[SRC2_REG].upper.f;
+
+			printfdbg ("cfcmps\n");
+			printfdbg ("\tcomparing %f and %f\n", a, b);
+
+			z = a == b;	/* zero */
+			n = a < b;	/* negative */
+			c = a > b;	/* carry */
+			v = 0;	/* fixme */
+			printfdbg ("\tz = %d, n = %d\n", z, n);
+			*value = (n << 31) | (z << 30) | (c << 29) | (v <<
+								      28);
+			break;
+		}
+
+	case 5:		/* cfcmpd */
+		{
+			double a, b;
+			int n, z, c, v;
+
+			a = mv_getRegDouble (SRC1_REG);
+			b = mv_getRegDouble (SRC2_REG);
+
+			printfdbg ("cfcmpd\n");
+			printfdbg ("\tcomparing %g and %g\n", a, b);
+
+			z = a == b;	/* zero */
+			n = a < b;	/* negative */
+			c = a > b;	/* carry */
+			v = 0;	/* fixme */
+			*value = (n << 31) | (z << 30) | (c << 29) | (v <<
+								      28);
+			break;
+		}
+#endif
+	default:
+		fprintf (stderr, "unknown opcode in DSPMRC4 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPMRC5 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword * value)
+{
+	switch (BITS (5, 7)) {
+	case 0:		/* cfmvr64l */
+		/* Move lower half of 64bit int from Cirrus to Arm.  */
+		*value = (ARMword) DSPregs[SRC1_REG].lower.i;
+		printfdbg ("cfmvr64l ARM_REG = mvfx%d <-- %d\n",
+			   DEST_REG, (int) *value);
+		break;
+
+	case 1:		/* cfmvr64h */
+		/* Move upper half of 64bit int from Cirrus to Arm.  */
+		*value = (ARMword) DSPregs[SRC1_REG].upper.i;
+		printfdbg ("cfmvr64h <-- %d\n", (int) *value);
+		break;
+
+	case 4:		/* cfcmp32 */
+		{
+			int res;
+			int n, z, c, v;
+			unsigned int a, b;
+
+			printfdbg ("cfcmp32 mvfx%d - mvfx%d\n", SRC1_REG,
+				   SRC2_REG);
+
+			/* FIXME: see comment for cfcmps.  */
+			a = DSPregs[SRC1_REG].lower.i;
+			b = DSPregs[SRC2_REG].lower.i;
+
+			res = DSPregs[SRC1_REG].lower.i -
+				DSPregs[SRC2_REG].lower.i;
+			/* zero */
+			z = res == 0;
+			/* negative */
+			n = res < 0;
+			/* overflow */
+			v = SubOverflow (DSPregs[SRC1_REG].lower.i,
+					 DSPregs[SRC2_REG].lower.i, res);
+			/* carry */
+			c = (NEG (a) && POS (b) ||
+			     (NEG (a) && POS (res)) || (POS (b)
+							&& POS (res)));
+
+			*value = (n << 31) | (z << 30) | (c << 29) | (v <<
+								      28);
+			break;
+		}
+
+	case 5:		/* cfcmp64 */
+		{
+			long long res;
+			int n, z, c, v;
+			unsigned long long a, b;
+
+			printfdbg ("cfcmp64 mvdx%d - mvdx%d\n", SRC1_REG,
+				   SRC2_REG);
+
+			/* fixme: see comment for cfcmps.  */
+
+			a = mv_getReg64int (SRC1_REG);
+			b = mv_getReg64int (SRC2_REG);
+
+			res = mv_getReg64int (SRC1_REG) -
+				mv_getReg64int (SRC2_REG);
+			/* zero */
+			z = res == 0;
+			/* negative */
+			n = res < 0;
+			/* overflow */
+			v = ((NEG64 (a) && POS64 (b) && POS64 (res))
+			     || (POS64 (a) && NEG64 (b) && NEG64 (res)));
+			/* carry */
+			c = (NEG64 (a) && POS64 (b) ||
+			     (NEG64 (a) && POS64 (res)) || (POS64 (b)
+							    && POS64 (res)));
+
+			*value = (n << 31) | (z << 30) | (c << 29) | (v <<
+								      28);
+			break;
+		}
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPMRC5 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPMRC6 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword * value)
+{
+	switch (BITS (5, 7)) {
+	case 0:		/* cfmval32 */
+		cirrus_not_implemented ("cfmval32");
+		break;
+
+	case 1:		/* cfmvam32 */
+		cirrus_not_implemented ("cfmvam32");
+		break;
+
+	case 2:		/* cfmvah32 */
+		cirrus_not_implemented ("cfmvah32");
+		break;
+
+	case 3:		/* cfmva32 */
+		cirrus_not_implemented ("cfmva32");
+		break;
+
+	case 4:		/* cfmva64 */
+		cirrus_not_implemented ("cfmva64");
+		break;
+
+	case 5:		/* cfmvsc32 */
+		cirrus_not_implemented ("cfmvsc32");
+		break;
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPMRC6 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPMCR4 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword value)
+{
+	switch (BITS (5, 7)) {
+	case 0:		/* cfmvdlr */
+		/* Move the lower half of a DF value from an Arm register into
+		   the lower half of a Cirrus register.  */
+		printfdbg ("cfmvdlr <-- 0x%x\n", (int) value);
+		DSPregs[SRC1_REG].lower.i = (int) value;
+		break;
+
+	case 1:		/* cfmvdhr */
+		/* Move the upper half of a DF value from an Arm register into
+		   the upper half of a Cirrus register.  */
+		printfdbg ("cfmvdhr <-- 0x%x\n", (int) value);
+		DSPregs[SRC1_REG].upper.i = (int) value;
+		break;
+
+	case 2:		/* cfmvsr */
+		/* Move SF from Arm register into upper half of Cirrus register.  */
+		printfdbg ("cfmvsr <-- 0x%x\n", (int) value);
+		DSPregs[SRC1_REG].upper.i = (int) value;
+		break;
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPMCR4 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPMCR5 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword value)
+{
+	union
+	{
+		int s;
+		unsigned int us;
+	} val;
+
+	switch (BITS (5, 7)) {
+	case 0:		/* cfmv64lr */
+		/* Move lower half of a 64bit int from an ARM register into the
+		   lower half of a DSP register and sign extend it.  */
+		printfdbg ("cfmv64lr mvdx%d <-- 0x%x\n", SRC1_REG,
+			   (int) value);
+		DSPregs[SRC1_REG].lower.i = (int) value;
+		break;
+
+	case 1:		/* cfmv64hr */
+		/* Move upper half of a 64bit int from an ARM register into the
+		   upper half of a DSP register.  */
+		printfdbg ("cfmv64hr ARM_REG = mvfx%d <-- 0x%x\n",
+			   SRC1_REG, (int) value);
+		DSPregs[SRC1_REG].upper.i = (int) value;
+		break;
+
+	case 2:		/* cfrshl32 */
+		printfdbg ("cfrshl32\n");
+		val.us = value;
+		if (val.s > 0)
+			DSPregs[SRC2_REG].lower.i =
+				DSPregs[SRC1_REG].lower.i << value;
+		else
+			DSPregs[SRC2_REG].lower.i =
+				DSPregs[SRC1_REG].lower.i >> -value;
+		break;
+
+	case 3:		/* cfrshl64 */
+		printfdbg ("cfrshl64\n");
+		val.us = value;
+		if (val.s > 0)
+			mv_setReg64int (SRC2_REG,
+					mv_getReg64int (SRC1_REG) << value);
+		else
+			mv_setReg64int (SRC2_REG,
+					mv_getReg64int (SRC1_REG) >> -value);
+		break;
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPMCR5 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPMCR6 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword value)
+{
+	switch (BITS (5, 7)) {
+	case 0:		/* cfmv32al */
+		cirrus_not_implemented ("cfmv32al");
+		break;
+
+	case 1:		/* cfmv32am */
+		cirrus_not_implemented ("cfmv32am");
+		break;
+
+	case 2:		/* cfmv32ah */
+		cirrus_not_implemented ("cfmv32ah");
+		break;
+
+	case 3:		/* cfmv32a */
+		cirrus_not_implemented ("cfmv32a");
+		break;
+
+	case 4:		/* cfmv64a */
+		cirrus_not_implemented ("cfmv64a");
+		break;
+
+	case 5:		/* cfmv32sc */
+		cirrus_not_implemented ("cfmv32sc");
+		break;
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPMCR6 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPLDC4 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword data)
+{
+	static unsigned words;
+
+	if (type != ARMul_DATA) {
+		words = 0;
+		return ARMul_DONE;
+	}
+
+	if (BIT (22)) {		/* it's a long access, get two words */
+		/* cfldrd */
+
+		printfdbg
+			("cfldrd: %x (words = %d) (bigend = %d) DESTREG = %d\n",
+			 data, words, state->bigendSig, DEST_REG);
+
+		if (words == 0) {
+			if (state->bigendSig)
+				DSPregs[DEST_REG].upper.i = (int) data;
+			else
+				DSPregs[DEST_REG].lower.i = (int) data;
+		}
+		else {
+			if (state->bigendSig)
+				DSPregs[DEST_REG].lower.i = (int) data;
+			else
+				DSPregs[DEST_REG].upper.i = (int) data;
+		}
+
+		++words;
+
+		if (words == 2) {
+			printfdbg ("\tmvd%d <-- mem = %g\n", DEST_REG,
+				   mv_getRegDouble (DEST_REG));
+
+			return ARMul_DONE;
+		}
+		else
+			return ARMul_INC;
+	}
+	else {
+		/* Get just one word.  */
+
+		/* cfldrs */
+		printfdbg ("cfldrs\n");
+
+		DSPregs[DEST_REG].upper.i = (int) data;
+
+		printfdbg ("\tmvf%d <-- mem = %f\n", DEST_REG,
+			   DSPregs[DEST_REG].upper.f);
+
+		return ARMul_DONE;
+	}
+}
+
+unsigned
+DSPLDC5 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword data)
+{
+	static unsigned words;
+
+	if (type != ARMul_DATA) {
+		words = 0;
+		return ARMul_DONE;
+	}
+
+	if (BIT (22)) {
+		/* It's a long access, get two words.  */
+
+		/* cfldr64 */
+		printfdbg ("cfldr64: %d\n", data);
+
+		if (words == 0) {
+			if (state->bigendSig)
+				DSPregs[DEST_REG].upper.i = (int) data;
+			else
+				DSPregs[DEST_REG].lower.i = (int) data;
+		}
+		else {
+			if (state->bigendSig)
+				DSPregs[DEST_REG].lower.i = (int) data;
+			else
+				DSPregs[DEST_REG].upper.i = (int) data;
+		}
+
+		++words;
+
+		if (words == 2) {
+			printfdbg ("\tmvdx%d <-- mem = %lld\n", DEST_REG,
+				   mv_getReg64int (DEST_REG));
+
+			return ARMul_DONE;
+		}
+		else
+			return ARMul_INC;
+	}
+	else {
+		/* Get just one word.  */
+
+		/* cfldr32 */
+		printfdbg ("cfldr32 mvfx%d <-- %d\n", DEST_REG, (int) data);
+
+		/* 32bit ints should be sign extended to 64bits when loaded.  */
+		mv_setReg64int (DEST_REG, (long long) data);
+
+		return ARMul_DONE;
+	}
+}
+
+unsigned
+DSPSTC4 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword * data)
+{
+	static unsigned words;
+
+	if (type != ARMul_DATA) {
+		words = 0;
+		return ARMul_DONE;
+	}
+
+	if (BIT (22)) {
+		/* It's a long access, get two words.  */
+		/* cfstrd */
+		printfdbg ("cfstrd\n");
+
+		if (words == 0) {
+			if (state->bigendSig)
+				*data = (ARMword) DSPregs[DEST_REG].upper.i;
+			else
+				*data = (ARMword) DSPregs[DEST_REG].lower.i;
+		}
+		else {
+			if (state->bigendSig)
+				*data = (ARMword) DSPregs[DEST_REG].lower.i;
+			else
+				*data = (ARMword) DSPregs[DEST_REG].upper.i;
+		}
+
+		++words;
+
+		if (words == 2) {
+			printfdbg ("\tmem = mvd%d = %g\n", DEST_REG,
+				   mv_getRegDouble (DEST_REG));
+
+			return ARMul_DONE;
+		}
+		else
+			return ARMul_INC;
+	}
+	else {
+		/* Get just one word.  */
+		/* cfstrs */
+		printfdbg ("cfstrs mvf%d <-- %f\n", DEST_REG,
+			   DSPregs[DEST_REG].upper.f);
+
+		*data = (ARMword) DSPregs[DEST_REG].upper.i;
+
+		return ARMul_DONE;
+	}
+}
+
+unsigned
+DSPSTC5 (ARMul_State * state,
+	 unsigned type, ARMword instr, ARMword * data)
+{
+	static unsigned words;
+
+	if (type != ARMul_DATA) {
+		words = 0;
+		return ARMul_DONE;
+	}
+
+	if (BIT (22)) {
+		/* It's a long access, store two words.  */
+		/* cfstr64 */
+		printfdbg ("cfstr64\n");
+
+		if (words == 0) {
+			if (state->bigendSig)
+				*data = (ARMword) DSPregs[DEST_REG].upper.i;
+			else
+				*data = (ARMword) DSPregs[DEST_REG].lower.i;
+		}
+		else {
+			if (state->bigendSig)
+				*data = (ARMword) DSPregs[DEST_REG].lower.i;
+			else
+				*data = (ARMword) DSPregs[DEST_REG].upper.i;
+		}
+
+		++words;
+
+		if (words == 2) {
+			printfdbg ("\tmem = mvd%d = %lld\n", DEST_REG,
+				   mv_getReg64int (DEST_REG));
+
+			return ARMul_DONE;
+		}
+		else
+			return ARMul_INC;
+	}
+	else {
+		/* Store just one word.  */
+		/* cfstr32 */
+		*data = (ARMword) DSPregs[DEST_REG].lower.i;
+
+		printfdbg ("cfstr32 MEM = %d\n", (int) *data);
+
+		return ARMul_DONE;
+	}
+}
+
+unsigned
+DSPCDP4 (ARMul_State * state, unsigned type, ARMword instr)
+{
+	int opcode2;
+
+	opcode2 = BITS (5, 7);
+
+	switch (BITS (20, 21)) {
+	case 0:
+		switch (opcode2) {
+		case 0:	/* cfcpys */
+			printfdbg ("cfcpys mvf%d = mvf%d = %f\n",
+				   DEST_REG, SRC1_REG,
+				   DSPregs[SRC1_REG].upper.f);
+			DSPregs[DEST_REG].upper.f = DSPregs[SRC1_REG].upper.f;
+			break;
+
+		case 1:	/* cfcpyd */
+			printfdbg ("cfcpyd mvd%d = mvd%d = %g\n",
+				   DEST_REG, SRC1_REG,
+				   mv_getRegDouble (SRC1_REG));
+			mv_setRegDouble (DEST_REG,
+					 mv_getRegDouble (SRC1_REG));
+			break;
+
+		case 2:	/* cfcvtds */
+			printfdbg ("cfcvtds mvf%d = (float) mvd%d = %f\n",
+				   DEST_REG, SRC1_REG,
+				   (float) mv_getRegDouble (SRC1_REG));
+			DSPregs[DEST_REG].upper.f =
+				(float) mv_getRegDouble (SRC1_REG);
+			break;
+
+		case 3:	/* cfcvtsd */
+			printfdbg ("cfcvtsd mvd%d = mvf%d = %g\n",
+				   DEST_REG, SRC1_REG,
+				   (double) DSPregs[SRC1_REG].upper.f);
+			mv_setRegDouble (DEST_REG,
+					 (double) DSPregs[SRC1_REG].upper.f);
+			break;
+
+		case 4:	/* cfcvt32s */
+			printfdbg ("cfcvt32s mvf%d = mvfx%d = %f\n",
+				   DEST_REG, SRC1_REG,
+				   (float) DSPregs[SRC1_REG].lower.i);
+			DSPregs[DEST_REG].upper.f =
+				(float) DSPregs[SRC1_REG].lower.i;
+			break;
+
+		case 5:	/* cfcvt32d */
+			printfdbg ("cfcvt32d mvd%d = mvfx%d = %g\n",
+				   DEST_REG, SRC1_REG,
+				   (double) DSPregs[SRC1_REG].lower.i);
+			mv_setRegDouble (DEST_REG,
+					 (double) DSPregs[SRC1_REG].lower.i);
+			break;
+
+		case 6:	/* cfcvt64s */
+			printfdbg ("cfcvt64s mvf%d = mvdx%d = %f\n",
+				   DEST_REG, SRC1_REG,
+				   (float) mv_getReg64int (SRC1_REG));
+			DSPregs[DEST_REG].upper.f =
+				(float) mv_getReg64int (SRC1_REG);
+			break;
+
+		case 7:	/* cfcvt64d */
+			printfdbg ("cfcvt64d mvd%d = mvdx%d = %g\n",
+				   DEST_REG, SRC1_REG,
+				   (double) mv_getReg64int (SRC1_REG));
+			mv_setRegDouble (DEST_REG,
+					 (double) mv_getReg64int (SRC1_REG));
+			break;
+		}
+		break;
+
+	case 1:
+		switch (opcode2) {
+		case 0:	/* cfmuls */
+			printfdbg ("cfmuls mvf%d = mvf%d = %f\n",
+				   DEST_REG,
+				   SRC1_REG,
+				   DSPregs[SRC1_REG].upper.f *
+				   DSPregs[SRC2_REG].upper.f);
+
+			DSPregs[DEST_REG].upper.f = DSPregs[SRC1_REG].upper.f
+				* DSPregs[SRC2_REG].upper.f;
+			break;
+
+		case 1:	/* cfmuld */
+			printfdbg ("cfmuld mvd%d = mvd%d = %g\n",
+				   DEST_REG,
+				   SRC1_REG,
+				   mv_getRegDouble (SRC1_REG) *
+				   mv_getRegDouble (SRC2_REG));
+
+			mv_setRegDouble (DEST_REG, mv_getRegDouble (SRC1_REG)
+					 * mv_getRegDouble (SRC2_REG));
+			break;
+
+		default:
+			fprintf (stderr, "unknown opcode in DSPCDP4 0x%x\n",
+				 instr);
+			cirrus_not_implemented ("unknown");
+			break;
+		}
+		break;
+
+	case 3:
+		switch (opcode2) {
+		case 0:	/* cfabss */
+			DSPregs[DEST_REG].upper.f =
+				(DSPregs[SRC1_REG].upper.f <
+				 0.0F ? -DSPregs[SRC1_REG].upper.
+				 f : DSPregs[SRC1_REG].upper.f);
+			printfdbg ("cfabss mvf%d = |mvf%d| = %f\n", DEST_REG,
+				   SRC1_REG, DSPregs[DEST_REG].upper.f);
+			break;
+
+		case 1:	/* cfabsd */
+			mv_setRegDouble (DEST_REG,
+					 (mv_getRegDouble (SRC1_REG) < 0.0 ?
+					  -mv_getRegDouble (SRC1_REG)
+					  : mv_getRegDouble (SRC1_REG)));
+			printfdbg ("cfabsd mvd%d = |mvd%d| = %g\n",
+				   DEST_REG, SRC1_REG,
+				   mv_getRegDouble (DEST_REG));
+			break;
+
+		case 2:	/* cfnegs */
+			DSPregs[DEST_REG].upper.f =
+				-DSPregs[SRC1_REG].upper.f;
+			printfdbg ("cfnegs mvf%d = -mvf%d = %f\n", DEST_REG,
+				   SRC1_REG, DSPregs[DEST_REG].upper.f);
+			break;
+
+		case 3:	/* cfnegd */
+			mv_setRegDouble (DEST_REG,
+					 -mv_getRegDouble (SRC1_REG));
+			printfdbg ("cfnegd mvd%d = -mvd%d = %g\n", DEST_REG,
+				   mv_getRegDouble (DEST_REG));
+			break;
+
+		case 4:	/* cfadds */
+			DSPregs[DEST_REG].upper.f = DSPregs[SRC1_REG].upper.f
+				+ DSPregs[SRC2_REG].upper.f;
+			printfdbg ("cfadds mvf%d = mvf%d + mvf%d = %f\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].upper.f);
+			break;
+
+		case 5:	/* cfaddd */
+			mv_setRegDouble (DEST_REG, mv_getRegDouble (SRC1_REG)
+					 + mv_getRegDouble (SRC2_REG));
+			printfdbg ("cfaddd: mvd%d = mvd%d + mvd%d = %g\n",
+				   DEST_REG,
+				   SRC1_REG, SRC2_REG,
+				   mv_getRegDouble (DEST_REG));
+			break;
+
+		case 6:	/* cfsubs */
+			DSPregs[DEST_REG].upper.f = DSPregs[SRC1_REG].upper.f
+				- DSPregs[SRC2_REG].upper.f;
+			printfdbg ("cfsubs: mvf%d = mvf%d - mvf%d = %f\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].upper.f);
+			break;
+
+		case 7:	/* cfsubd */
+			mv_setRegDouble (DEST_REG, mv_getRegDouble (SRC1_REG)
+					 - mv_getRegDouble (SRC2_REG));
+			printfdbg ("cfsubd: mvd%d = mvd%d - mvd%d = %g\n",
+				   DEST_REG,
+				   SRC1_REG, SRC2_REG,
+				   mv_getRegDouble (DEST_REG));
+			break;
+		}
+		break;
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPCDP4 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPCDP5 (ARMul_State * state, unsigned type, ARMword instr)
+{
+	int opcode2;
+	char shift;
+
+	opcode2 = BITS (5, 7);
+
+	/* Shift constants are 7bit signed numbers in bits 0..3|5..7.  */
+	shift = BITS (0, 3) | (BITS (5, 7)) << 4;
+	if (shift & 0x40)
+		shift |= 0xc0;
+
+	switch (BITS (20, 21)) {
+	case 0:
+		/* cfsh32 */
+		printfdbg ("cfsh32 %s amount=%d\n",
+			   shift < 0 ? "right" : "left", shift);
+		if (shift < 0)
+			/* Negative shift is a right shift.  */
+			DSPregs[DEST_REG].lower.i =
+				DSPregs[SRC1_REG].lower.i >> -shift;
+		else
+			/* Positive shift is a left shift.  */
+			DSPregs[DEST_REG].lower.i =
+				DSPregs[SRC1_REG].lower.i << shift;
+		break;
+
+	case 1:
+		switch (opcode2) {
+		case 0:	/* cfmul32 */
+			DSPregs[DEST_REG].lower.i = DSPregs[SRC1_REG].lower.i
+				* DSPregs[SRC2_REG].lower.i;
+			printfdbg ("cfmul32 mvfx%d = mvfx%d * mvfx%d = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 1:	/* cfmul64 */
+			mv_setReg64int (DEST_REG, mv_getReg64int (SRC1_REG)
+					* mv_getReg64int (SRC2_REG));
+			printfdbg
+				("cfmul64 mvdx%d = mvdx%d * mvdx%d = %lld\n",
+				 DEST_REG, SRC1_REG, SRC2_REG,
+				 mv_getReg64int (DEST_REG));
+			break;
+
+		case 2:	/* cfmac32 */
+			DSPregs[DEST_REG].lower.i
+				+=
+				DSPregs[SRC1_REG].lower.i *
+				DSPregs[SRC2_REG].lower.i;
+			printfdbg ("cfmac32 mvfx%d += mvfx%d * mvfx%d = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 3:	/* cfmsc32 */
+			DSPregs[DEST_REG].lower.i
+				-=
+				DSPregs[SRC1_REG].lower.i *
+				DSPregs[SRC2_REG].lower.i;
+			printfdbg ("cfmsc32 mvfx%d -= mvfx%d * mvfx%d = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 4:	/* cfcvts32 */
+			/* fixme: this should round */
+			DSPregs[DEST_REG].lower.i =
+				(int) DSPregs[SRC1_REG].upper.f;
+			printfdbg ("cfcvts32 mvfx%d = mvf%d = %d\n", DEST_REG,
+				   SRC1_REG, DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 5:	/* cfcvtd32 */
+			/* fixme: this should round */
+			DSPregs[DEST_REG].lower.i =
+				(int) mv_getRegDouble (SRC1_REG);
+			printfdbg ("cfcvtd32 mvdx%d = mvd%d = %d\n", DEST_REG,
+				   SRC1_REG, DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 6:	/* cftruncs32 */
+			DSPregs[DEST_REG].lower.i =
+				(int) DSPregs[SRC1_REG].upper.f;
+			printfdbg ("cftruncs32 mvfx%d = mvf%d = %d\n",
+				   DEST_REG, SRC1_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 7:	/* cftruncd32 */
+			DSPregs[DEST_REG].lower.i =
+				(int) mv_getRegDouble (SRC1_REG);
+			printfdbg ("cftruncd32 mvfx%d = mvd%d = %d\n",
+				   DEST_REG, SRC1_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+		}
+		break;
+
+	case 2:
+		/* cfsh64 */
+		printfdbg ("cfsh64\n");
+
+		if (shift < 0)
+			/* Negative shift is a right shift.  */
+			mv_setReg64int (DEST_REG,
+					mv_getReg64int (SRC1_REG) >> -shift);
+		else
+			/* Positive shift is a left shift.  */
+			mv_setReg64int (DEST_REG,
+					mv_getReg64int (SRC1_REG) << shift);
+		printfdbg ("\t%llx\n", mv_getReg64int (DEST_REG));
+		break;
+
+	case 3:
+		switch (opcode2) {
+		case 0:	/* cfabs32 */
+			DSPregs[DEST_REG].lower.i =
+				(DSPregs[SRC1_REG].lower.i <
+				 0 ? -DSPregs[SRC1_REG].lower.
+				 i : DSPregs[SRC1_REG].lower.i);
+			printfdbg ("cfabs32 mvfx%d = |mvfx%d| = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 1:	/* cfabs64 */
+			mv_setReg64int (DEST_REG,
+					(mv_getReg64int (SRC1_REG) < 0
+					 ? -mv_getReg64int (SRC1_REG)
+					 : mv_getReg64int (SRC1_REG)));
+			printfdbg ("cfabs64 mvdx%d = |mvdx%d| = %lld\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   mv_getReg64int (DEST_REG));
+			break;
+
+		case 2:	/* cfneg32 */
+			DSPregs[DEST_REG].lower.i =
+				-DSPregs[SRC1_REG].lower.i;
+			printfdbg ("cfneg32 mvfx%d = -mvfx%d = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 3:	/* cfneg64 */
+			mv_setReg64int (DEST_REG, -mv_getReg64int (SRC1_REG));
+			printfdbg ("cfneg64 mvdx%d = -mvdx%d = %lld\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   mv_getReg64int (DEST_REG));
+			break;
+
+		case 4:	/* cfadd32 */
+			DSPregs[DEST_REG].lower.i = DSPregs[SRC1_REG].lower.i
+				+ DSPregs[SRC2_REG].lower.i;
+			printfdbg ("cfadd32 mvfx%d = mvfx%d + mvfx%d = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 5:	/* cfadd64 */
+			mv_setReg64int (DEST_REG, mv_getReg64int (SRC1_REG)
+					+ mv_getReg64int (SRC2_REG));
+			printfdbg
+				("cfadd64 mvdx%d = mvdx%d + mvdx%d = %lld\n",
+				 DEST_REG, SRC1_REG, SRC2_REG,
+				 mv_getReg64int (DEST_REG));
+			break;
+
+		case 6:	/* cfsub32 */
+			DSPregs[DEST_REG].lower.i = DSPregs[SRC1_REG].lower.i
+				- DSPregs[SRC2_REG].lower.i;
+			printfdbg ("cfsub32 mvfx%d = mvfx%d - mvfx%d = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   DSPregs[DEST_REG].lower.i);
+			break;
+
+		case 7:	/* cfsub64 */
+			mv_setReg64int (DEST_REG, mv_getReg64int (SRC1_REG)
+					- mv_getReg64int (SRC2_REG));
+			printfdbg ("cfsub64 mvdx%d = mvdx%d - mvdx%d = %d\n",
+				   DEST_REG, SRC1_REG, SRC2_REG,
+				   mv_getReg64int (DEST_REG));
+			break;
+		}
+		break;
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPCDP5 0x%x\n", instr);
+		cirrus_not_implemented ("unknown");
+		break;
+	}
+
+	return ARMul_DONE;
+}
+
+unsigned
+DSPCDP6 (ARMul_State * state, unsigned type, ARMword instr)
+{
+	int opcode2;
+
+	opcode2 = BITS (5, 7);
+
+	switch (BITS (20, 21)) {
+	case 0:
+		/* cfmadd32 */
+		cirrus_not_implemented ("cfmadd32");
+		break;
+
+	case 1:
+		/* cfmsub32 */
+		cirrus_not_implemented ("cfmsub32");
+		break;
+
+	case 2:
+		/* cfmadda32 */
+		cirrus_not_implemented ("cfmadda32");
+		break;
+
+	case 3:
+		/* cfmsuba32 */
+		cirrus_not_implemented ("cfmsuba32");
+		break;
+
+	default:
+		fprintf (stderr, "unknown opcode in DSPCDP6 0x%x\n", instr);
+	}
+
+	return ARMul_DONE;
+}
+
+/* Conversion functions.
+
+   32-bit integers are stored in the LOWER half of a 64-bit physical
+   register.
+
+   Single precision floats are stored in the UPPER half of a 64-bit
+   physical register.  */
+
+static double
+mv_getRegDouble (int regnum)
+{
+	reg_conv.ints[lsw_float_index] = DSPregs[regnum].upper.i;
+	reg_conv.ints[msw_float_index] = DSPregs[regnum].lower.i;
+	return reg_conv.d;
+}
+
+static void
+mv_setRegDouble (int regnum, double val)
+{
+	reg_conv.d = val;
+	DSPregs[regnum].upper.i = reg_conv.ints[lsw_float_index];
+	DSPregs[regnum].lower.i = reg_conv.ints[msw_float_index];
+}
+
+static long long
+mv_getReg64int (int regnum)
+{
+	reg_conv.ints[lsw_int_index] = DSPregs[regnum].lower.i;
+	reg_conv.ints[msw_int_index] = DSPregs[regnum].upper.i;
+	return reg_conv.ll;
+}
+
+static void
+mv_setReg64int (int regnum, long long val)
+{
+	reg_conv.ll = val;
+	DSPregs[regnum].lower.i = reg_conv.ints[lsw_int_index];
+	DSPregs[regnum].upper.i = reg_conv.ints[msw_int_index];
+}
+
+/* Compute LSW in a double and a long long.  */
+
+void
+mv_compute_host_endianness (ARMul_State * state)
+{
+	static union
+	{
+		long long ll;
+		int ints[2];
+		int i;
+		double d;
+		float floats[2];
+		float f;
+	} conv;
+
+	/* Calculate where's the LSW in a 64bit int.  */
+	conv.ll = 45;
+
+	if (conv.ints[0] == 0) {
+		msw_int_index = 0;
+		lsw_int_index = 1;
+	}
+	else {
+		assert (conv.ints[1] == 0);
+		msw_int_index = 1;
+		lsw_int_index = 0;
+	}
+
+	/* Calculate where's the LSW in a double.  */
+	conv.d = 3.0;
+
+	if (conv.ints[0] == 0) {
+		msw_float_index = 0;
+		lsw_float_index = 1;
+	}
+	else {
+		assert (conv.ints[1] == 0);
+		msw_float_index = 1;
+		lsw_float_index = 0;
+	}
+
+	printfdbg ("lsw_int_index   %d\n", lsw_int_index);
+	printfdbg ("lsw_float_index %d\n", lsw_float_index);
+}
diff --git a/src/core/arm/interpreter/mmu/rb.cpp b/src/core/arm/interpreter/mmu/rb.cpp
new file mode 100644
index 000000000..07b11e311
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/rb.cpp
@@ -0,0 +1,126 @@
+#include "core/arm/interpreter/armdefs.h"
+
+/*chy 2004-06-06, fix bug found by wenye@cs.ucsb.edu*/
+ARMword rb_masks[] = {
+	0x0,			//RB_INVALID
+	4,			//RB_1
+	16,			//RB_4
+	32,			//RB_8
+};
+
+/*mmu_rb_init
+ * @rb_t	:rb_t to init
+ * @num		:number of entry
+ * */
+int
+mmu_rb_init (rb_s * rb_t, int num)
+{
+	int i;
+	rb_entry_t *entrys;
+
+	entrys = (rb_entry_t *) malloc (sizeof (*entrys) * num);
+	if (entrys == NULL) {
+		printf ("SKYEYE:mmu_rb_init malloc error\n");
+		return -1;
+	}
+	for (i = 0; i < num; i++) {
+		entrys[i].type = RB_INVALID;
+		entrys[i].fault = NO_FAULT;
+	}
+
+	rb_t->entrys = entrys;
+	rb_t->num = num;
+	return 0;
+}
+
+/*mmu_rb_exit*/
+void
+mmu_rb_exit (rb_s * rb_t)
+{
+	free (rb_t->entrys);
+};
+
+/*mmu_rb_search
+ * @rb_t	:rb_t to serach
+ * @va		:va address to math
+ *
+ * $	NULL :not match
+ * 		NO-NULL:
+ * */
+rb_entry_t *
+mmu_rb_search (rb_s * rb_t, ARMword va)
+{
+	int i;
+	rb_entry_t *rb = rb_t->entrys;
+
+	DEBUG_LOG(ARM11, "va = %x\n", va);
+	for (i = 0; i < rb_t->num; i++, rb++) {
+		//2004-06-06 lyh  bug from wenye@cs.ucsb.edu
+		if (rb->type) {
+			if ((va >= rb->va)
+			    && (va < (rb->va + rb_masks[rb->type])))
+				return rb;
+		}
+	}
+	return NULL;
+};
+
+void
+mmu_rb_invalidate_entry (rb_s * rb_t, int i)
+{
+	rb_t->entrys[i].type = RB_INVALID;
+}
+
+void
+mmu_rb_invalidate_all (rb_s * rb_t)
+{
+	int i;
+
+	for (i = 0; i < rb_t->num; i++)
+		mmu_rb_invalidate_entry (rb_t, i);
+};
+
+void
+mmu_rb_load (ARMul_State * state, rb_s * rb_t, int i_rb, int type, ARMword va)
+{
+	rb_entry_t *rb;
+	int i;
+	ARMword max_start, min_end;
+	fault_t fault;
+	tlb_entry_t *tlb;
+
+	/*align va according to type */
+	va &= ~(rb_masks[type] - 1);
+	/*invalidate all RB match [va, va + rb_masks[type]] */
+	for (rb = rb_t->entrys, i = 0; i < rb_t->num; i++, rb++) {
+		if (rb->type) {
+			max_start = max (va, rb->va);
+			min_end =
+				min (va + rb_masks[type],
+				     rb->va + rb_masks[rb->type]);
+			if (max_start < min_end)
+				rb->type = RB_INVALID;
+		}
+	}
+	/*load word */
+	rb = &rb_t->entrys[i_rb];
+	rb->type = type;
+	fault = translate (state, va, D_TLB (), &tlb);
+	if (fault) {
+		rb->fault = fault;
+		return;
+	}
+	fault = check_access (state, va, tlb, 1);
+	if (fault) {
+		rb->fault = fault;
+		return;
+	}
+
+	rb->fault = NO_FAULT;
+	va = tlb_va_to_pa (tlb, va);
+	//2004-06-06 lyh  bug from wenye@cs.ucsb.edu
+	for (i = 0; i < (rb_masks[type] / 4); i++, va += WORD_SIZE) {
+		//rb->data[i] = mem_read_word (state, va);
+		bus_read(32, va, &rb->data[i]);
+	};
+}
diff --git a/src/core/arm/interpreter/mmu/rb.h b/src/core/arm/interpreter/mmu/rb.h
new file mode 100644
index 000000000..7bf0ebb26
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/rb.h
@@ -0,0 +1,55 @@
+#ifndef _MMU_RB_H
+#define _MMU_RB_H
+
+enum rb_type_t
+{
+    RB_INVALID = 0,        //invalid
+    RB_1,            //1     word
+    RB_4,            //4 word
+    RB_8,            //8 word
+};
+
+/*bytes of each rb_type*/
+extern ARMword rb_masks[];
+
+#define RB_WORD_NUM 8
+typedef struct rb_entry_s
+{
+    ARMword data[RB_WORD_NUM];    //array to store data
+    ARMword va;        //first word va
+    int type;        //rb type
+    fault_t fault;        //fault set by rb alloc
+} rb_entry_t;
+
+typedef struct rb_s
+{
+    int num;
+    rb_entry_t *entrys;
+} rb_s;
+
+/*mmu_rb_init
+ * @rb_t    :rb_t to init
+ * @num        :number of entry
+ * */
+int mmu_rb_init (rb_s * rb_t, int num);
+
+/*mmu_rb_exit*/
+void mmu_rb_exit (rb_s * rb_t);
+
+
+/*mmu_rb_search
+ * @rb_t    :rb_t to serach
+ * @va        :va address to math
+ *
+ * $    NULL :not match
+ *         NO-NULL:
+ * */
+rb_entry_t *mmu_rb_search (rb_s * rb_t, ARMword va);
+
+
+void mmu_rb_invalidate_entry (rb_s * rb_t, int i);
+void mmu_rb_invalidate_all (rb_s * rb_t);
+void mmu_rb_load (ARMul_State * state, rb_s * rb_t, int i_rb,
+          int type, ARMword va);
+
+#endif /*_MMU_RB_H_*/
diff --git a/src/core/arm/interpreter/mmu/sa_mmu.cpp b/src/core/arm/interpreter/mmu/sa_mmu.cpp
new file mode 100644
index 000000000..eff5002de
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/sa_mmu.cpp
@@ -0,0 +1,864 @@
+/*
+    armmmu.c - Memory Management Unit emulation.
+    ARMulator extensions for the ARM7100 family.
+    Copyright (C) 1999  Ben Williamson
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+#include <assert.h>
+#include <string.h>
+
+#include "core/arm/interpreter/armdefs.h"
+
+/**
+ *  The interface of read data from bus
+ */
+int bus_read(short size, int addr, uint32_t * value) {
+    ERROR_LOG(ARM11, "unimplemented bus_read");
+    return 0;
+}
+
+/**
+ * The interface of write data from bus
+ */
+int bus_write(short size, int addr, uint32_t value) {
+    ERROR_LOG(ARM11, "unimplemented bus_write");
+    return 0;
+}
+
+
+typedef struct sa_mmu_desc_s
+{
+	int i_tlb;
+	cache_desc_t i_cache;
+
+	int d_tlb;
+	cache_desc_t main_d_cache;
+	cache_desc_t mini_d_cache;
+	int rb;
+	wb_desc_t wb;
+} sa_mmu_desc_t;
+
+static sa_mmu_desc_t sa11xx_mmu_desc = {
+	32,
+	{32, 32, 16, CACHE_WRITE_BACK},
+
+	32,
+	{32, 32, 8, CACHE_WRITE_BACK},
+	{32, 2, 8, CACHE_WRITE_BACK},
+	4,
+	//{8, 4},  for word size 
+	{8, 16},		//for byte size,   chy 2003-07-11
+};
+
+static fault_t sa_mmu_write (ARMul_State * state, ARMword va, ARMword data,
+			     ARMword datatype);
+static fault_t sa_mmu_read (ARMul_State * state, ARMword va, ARMword * data,
+			    ARMword datatype);
+static fault_t update_cache (ARMul_State * state, ARMword va, ARMword data,
+			     ARMword datatype, cache_line_t * cache,
+			     cache_s * cache_t, ARMword real_va);
+
+void
+mmu_wb_write_bytes (ARMul_State * state, wb_s * wb_t, ARMword pa,
+		    ARMbyte * data, int n);
+int
+sa_mmu_init (ARMul_State * state)
+{
+	sa_mmu_desc_t *desc;
+	cache_desc_t *c_desc;
+
+	state->mmu.control = 0x70;
+	state->mmu.translation_table_base = 0xDEADC0DE;
+	state->mmu.domain_access_control = 0xDEADC0DE;
+	state->mmu.fault_status = 0;
+	state->mmu.fault_address = 0;
+	state->mmu.process_id = 0;
+
+	desc = &sa11xx_mmu_desc;
+	if (mmu_tlb_init (I_TLB (), desc->i_tlb)) {
+		ERROR_LOG(ARM11, "i_tlb init %d\n", -1);
+		goto i_tlb_init_error;
+	}
+
+	c_desc = &desc->i_cache;
+	if (mmu_cache_init (I_CACHE (), c_desc->width, c_desc->way,
+			    c_desc->set, c_desc->w_mode)) {
+		ERROR_LOG(ARM11, "i_cache init %d\n", -1);
+		goto i_cache_init_error;
+	}
+
+	if (mmu_tlb_init (D_TLB (), desc->d_tlb)) {
+		ERROR_LOG(ARM11, "d_tlb init %d\n", -1);
+		goto d_tlb_init_error;
+	}
+
+	c_desc = &desc->main_d_cache;
+	if (mmu_cache_init (MAIN_D_CACHE (), c_desc->width, c_desc->way,
+			    c_desc->set, c_desc->w_mode)) {
+		ERROR_LOG(ARM11, "main_d_cache init %d\n", -1);
+		goto main_d_cache_init_error;
+	}
+
+	c_desc = &desc->mini_d_cache;
+	if (mmu_cache_init (MINI_D_CACHE (), c_desc->width, c_desc->way,
+			    c_desc->set, c_desc->w_mode)) {
+		ERROR_LOG(ARM11, "mini_d_cache init %d\n", -1);
+		goto mini_d_cache_init_error;
+	}
+
+	if (mmu_wb_init (WB (), desc->wb.num, desc->wb.nb)) {
+		ERROR_LOG(ARM11, "wb init %d\n", -1);
+		goto wb_init_error;
+	}
+
+	if (mmu_rb_init (RB (), desc->rb)) {
+		ERROR_LOG(ARM11, "rb init %d\n", -1);
+		goto rb_init_error;
+	}
+	return 0;
+
+      rb_init_error:
+	mmu_wb_exit (WB ());
+      wb_init_error:
+	mmu_cache_exit (MINI_D_CACHE ());
+      mini_d_cache_init_error:
+	mmu_cache_exit (MAIN_D_CACHE ());
+      main_d_cache_init_error:
+	mmu_tlb_exit (D_TLB ());
+      d_tlb_init_error:
+	mmu_cache_exit (I_CACHE ());
+      i_cache_init_error:
+	mmu_tlb_exit (I_TLB ());
+      i_tlb_init_error:
+	return -1;
+}
+
+void
+sa_mmu_exit (ARMul_State * state)
+{
+	mmu_rb_exit (RB ());
+	mmu_wb_exit (WB ());
+	mmu_cache_exit (MINI_D_CACHE ());
+	mmu_cache_exit (MAIN_D_CACHE ());
+	mmu_tlb_exit (D_TLB ());
+	mmu_cache_exit (I_CACHE ());
+	mmu_tlb_exit (I_TLB ());
+};
+
+
+static fault_t
+sa_mmu_load_instr (ARMul_State * state, ARMword va, ARMword * instr)
+{
+	fault_t fault;
+	tlb_entry_t *tlb;
+	cache_line_t *cache;
+	int c;			//cache bit
+	ARMword pa;		//physical addr
+
+	static int debug_count = 0;	//used for debug
+
+	DEBUG_LOG(ARM11, "va = %x\n", va);
+
+	va = mmu_pid_va_map (va);
+	if (MMU_Enabled) {
+		/*align check */
+		if ((va & (WORD_SIZE - 1)) && MMU_Aligned) {
+			DEBUG_LOG(ARM11, "align\n");
+			return ALIGNMENT_FAULT;
+		}
+		else
+			va &= ~(WORD_SIZE - 1);
+
+		/*translate tlb */
+		fault = translate (state, va, I_TLB (), &tlb);
+		if (fault) {
+			DEBUG_LOG(ARM11, "translate\n");
+			return fault;
+		}
+
+		/*check access */
+		fault = check_access (state, va, tlb, 1);
+		if (fault) {
+			DEBUG_LOG(ARM11, "check_fault\n");
+			return fault;
+		}
+	}
+
+	/*search cache no matter MMU enabled/disabled */
+	cache = mmu_cache_search (state, I_CACHE (), va);
+	if (cache) {
+		*instr = cache->data[va_cache_index (va, I_CACHE ())];
+		return NO_FAULT;
+	}
+
+	/*if MMU disabled or C flag is set alloc cache */
+	if (MMU_Disabled) {
+		c = 1;
+		pa = va;
+	}
+	else {
+		c = tlb_c_flag (tlb);
+		pa = tlb_va_to_pa (tlb, va);
+	}
+
+	if (c) {
+		int index;
+
+		debug_count++;
+		cache = mmu_cache_alloc (state, I_CACHE (), va, pa);
+		index = va_cache_index (va, I_CACHE ());
+		*instr = cache->data[va_cache_index (va, I_CACHE ())];
+	}
+	else
+		//*instr = mem_read_word (state, pa);
+		bus_read(32, pa, instr);
+
+	return NO_FAULT;
+};
+
+
+
+static fault_t
+sa_mmu_read_byte (ARMul_State * state, ARMword virt_addr, ARMword * data)
+{
+	//ARMword temp,offset;
+	fault_t fault;
+	fault = sa_mmu_read (state, virt_addr, data, ARM_BYTE_TYPE);
+	return fault;
+}
+
+static fault_t
+sa_mmu_read_halfword (ARMul_State * state, ARMword virt_addr, ARMword * data)
+{
+	//ARMword temp,offset;
+	fault_t fault;
+	fault = sa_mmu_read (state, virt_addr, data, ARM_HALFWORD_TYPE);
+	return fault;
+}
+
+static fault_t
+sa_mmu_read_word (ARMul_State * state, ARMword virt_addr, ARMword * data)
+{
+	return sa_mmu_read (state, virt_addr, data, ARM_WORD_TYPE);
+}
+
+
+
+
+static fault_t
+sa_mmu_read (ARMul_State * state, ARMword va, ARMword * data,
+	     ARMword datatype)
+{
+	fault_t fault;
+	rb_entry_t *rb;
+	tlb_entry_t *tlb;
+	cache_line_t *cache;
+	ARMword pa, real_va, temp, offset;
+
+	DEBUG_LOG(ARM11, "va = %x\n", va);
+
+	va = mmu_pid_va_map (va);
+	real_va = va;
+	/*if MMU disabled, memory_read */
+	if (MMU_Disabled) {
+		//*data = mem_read_word(state, va);
+		if (datatype == ARM_BYTE_TYPE)
+			//*data = mem_read_byte (state, va);
+			bus_read(8, va, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//*data = mem_read_halfword (state, va);
+			bus_read(16, va, data);
+		else if (datatype == ARM_WORD_TYPE)
+			//*data = mem_read_word (state, va);
+			bus_read(32, va, data);
+		else {
+			printf ("SKYEYE:1 sa_mmu_read error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+
+		return NO_FAULT;
+	}
+
+	/*align check */
+	if (((va & 3) && (datatype == ARM_WORD_TYPE) && MMU_Aligned) ||
+	    ((va & 1) && (datatype == ARM_HALFWORD_TYPE) && MMU_Aligned)) {
+		DEBUG_LOG(ARM11, "align\n");
+		return ALIGNMENT_FAULT;
+	}			// else
+
+	va &= ~(WORD_SIZE - 1);
+
+	/*translate va to tlb */
+	fault = translate (state, va, D_TLB (), &tlb);
+	if (fault) {
+		DEBUG_LOG(ARM11, "translate\n");
+		return fault;
+	}
+	/*check access permission */
+	fault = check_access (state, va, tlb, 1);
+	if (fault)
+		return fault;
+	/*search in read buffer */
+	rb = mmu_rb_search (RB (), va);
+	if (rb) {
+		if (rb->fault)
+			return rb->fault;
+		*data = rb->data[(va & (rb_masks[rb->type] - 1)) >> WORD_SHT];
+		goto datatrans;
+		//return 0;
+	};
+	/*search main cache */
+	cache = mmu_cache_search (state, MAIN_D_CACHE (), va);
+	if (cache) {
+		*data = cache->data[va_cache_index (va, MAIN_D_CACHE ())];
+		goto datatrans;
+		//return 0;
+	}
+	/*search mini cache */
+	cache = mmu_cache_search (state, MINI_D_CACHE (), va);
+	if (cache) {
+		*data = cache->data[va_cache_index (va, MINI_D_CACHE ())];
+		goto datatrans;
+		//return 0;
+	}
+
+	/*get phy_addr */
+	pa = tlb_va_to_pa (tlb, va);
+	if ((pa >= 0xe0000000) && (pa < 0xe8000000)) {
+		if (tlb_c_flag (tlb)) {
+			if (tlb_b_flag (tlb)) {
+				mmu_cache_soft_flush (state, MAIN_D_CACHE (),
+						      pa);
+			}
+			else {
+				mmu_cache_soft_flush (state, MINI_D_CACHE (),
+						      pa);
+			}
+		}
+		return NO_FAULT;
+	}
+
+	/*if Buffer, drain Write Buffer first */
+	if (tlb_b_flag (tlb))
+		mmu_wb_drain_all (state, WB ());
+
+	/*alloc cache or mem_read */
+	if (tlb_c_flag (tlb) && MMU_DCacheEnabled) {
+		cache_s *cache_t;
+
+		if (tlb_b_flag (tlb))
+			cache_t = MAIN_D_CACHE ();
+		else
+			cache_t = MINI_D_CACHE ();
+		cache = mmu_cache_alloc (state, cache_t, va, pa);
+		*data = cache->data[va_cache_index (va, cache_t)];
+	}
+	else {
+		//*data = mem_read_word(state, pa);
+		if (datatype == ARM_BYTE_TYPE)
+			//*data = mem_read_byte (state, pa | (real_va & 3));
+			bus_read(8, pa | (real_va & 3), data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//*data = mem_read_halfword (state, pa | (real_va & 2));
+			bus_read(16, pa | (real_va & 2), data);
+		else if (datatype == ARM_WORD_TYPE)
+			//*data = mem_read_word (state, pa);
+			bus_read(32, pa, data);
+		else {
+			printf ("SKYEYE:2 sa_mmu_read error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+		return NO_FAULT;
+	}
+
+
+      datatrans:
+	if (datatype == ARM_HALFWORD_TYPE) {
+		temp = *data;
+		offset = (((ARMword) state->bigendSig * 2) ^ (real_va & 2)) << 3;	/* bit offset into the word */
+		*data = (temp >> offset) & 0xffff;
+	}
+	else if (datatype == ARM_BYTE_TYPE) {
+		temp = *data;
+		offset = (((ARMword) state->bigendSig * 3) ^ (real_va & 3)) << 3;	/* bit offset into the word */
+		*data = (temp >> offset & 0xffL);
+	}
+      end:
+	return NO_FAULT;
+}
+
+
+static fault_t
+sa_mmu_write_byte (ARMul_State * state, ARMword virt_addr, ARMword data)
+{
+	return sa_mmu_write (state, virt_addr, data, ARM_BYTE_TYPE);
+}
+
+static fault_t
+sa_mmu_write_halfword (ARMul_State * state, ARMword virt_addr, ARMword data)
+{
+	return sa_mmu_write (state, virt_addr, data, ARM_HALFWORD_TYPE);
+}
+
+static fault_t
+sa_mmu_write_word (ARMul_State * state, ARMword virt_addr, ARMword data)
+{
+	return sa_mmu_write (state, virt_addr, data, ARM_WORD_TYPE);
+}
+
+
+
+static fault_t
+sa_mmu_write (ARMul_State * state, ARMword va, ARMword data, ARMword datatype)
+{
+	tlb_entry_t *tlb;
+	cache_line_t *cache;
+	int b;
+	ARMword pa, real_va;
+	fault_t fault;
+
+	DEBUG_LOG(ARM11, "va = %x, val = %x\n", va, data);
+	va = mmu_pid_va_map (va);
+	real_va = va;
+
+	/*search instruction cache */
+	cache = mmu_cache_search (state, I_CACHE (), va);
+	if (cache) {
+		update_cache (state, va, data, datatype, cache, I_CACHE (),
+			      real_va);
+	}
+
+	if (MMU_Disabled) {
+		//mem_write_word(state, va, data);
+		if (datatype == ARM_BYTE_TYPE)
+			//mem_write_byte (state, va, data);
+			bus_write(8, va, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//mem_write_halfword (state, va, data);
+			bus_write(16, va, data);
+		else if (datatype == ARM_WORD_TYPE)
+			//mem_write_word (state, va, data);
+			bus_write(32, va, data);
+		else {
+			printf ("SKYEYE:1 sa_mmu_write error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+
+		return NO_FAULT;
+	}
+	/*align check */
+	//if ((va & (WORD_SIZE - 1)) && MMU_Aligned){
+	if (((va & 3) && (datatype == ARM_WORD_TYPE) && MMU_Aligned) ||
+	    ((va & 1) && (datatype == ARM_HALFWORD_TYPE) && MMU_Aligned)) {
+		DEBUG_LOG(ARM11, "align\n");
+		return ALIGNMENT_FAULT;
+	}			//else
+	va &= ~(WORD_SIZE - 1);
+	/*tlb translate */
+	fault = translate (state, va, D_TLB (), &tlb);
+	if (fault) {
+		DEBUG_LOG(ARM11, "translate\n");
+		return fault;
+	}
+	/*tlb check access */
+	fault = check_access (state, va, tlb, 0);
+	if (fault) {
+		DEBUG_LOG(ARM11, "check_access\n");
+		return fault;
+	}
+	/*search main cache */
+	cache = mmu_cache_search (state, MAIN_D_CACHE (), va);
+	if (cache) {
+		update_cache (state, va, data, datatype, cache,
+			      MAIN_D_CACHE (), real_va);
+	}
+	else {
+		/*search mini cache */
+		cache = mmu_cache_search (state, MINI_D_CACHE (), va);
+		if (cache) {
+			update_cache (state, va, data, datatype, cache,
+				      MINI_D_CACHE (), real_va);
+		}
+	}
+
+	if (!cache) {
+		b = tlb_b_flag (tlb);
+		pa = tlb_va_to_pa (tlb, va);
+		if (b) {
+			if (MMU_WBEnabled) {
+				if (datatype == ARM_WORD_TYPE)
+					mmu_wb_write_bytes (state, WB (), pa,
+							    (ARMbyte*)&data, 4);
+				else if (datatype == ARM_HALFWORD_TYPE)
+					mmu_wb_write_bytes (state, WB (),
+							    (pa |
+							     (real_va & 2)),
+							    (ARMbyte*)&data, 2);
+				else if (datatype == ARM_BYTE_TYPE)
+					mmu_wb_write_bytes (state, WB (),
+							    (pa |
+							     (real_va & 3)),
+							    (ARMbyte*)&data, 1);
+
+			}
+			else {
+				if (datatype == ARM_WORD_TYPE)
+					//mem_write_word (state, pa, data);
+					bus_write(32, pa, data);
+				else if (datatype == ARM_HALFWORD_TYPE)
+					/*
+					mem_write_halfword (state,
+							    (pa |
+							     (real_va & 2)),
+							    data);
+					*/
+					bus_write(16, pa | (real_va & 2), data);
+				else if (datatype == ARM_BYTE_TYPE)
+					/*
+					mem_write_byte (state,
+							(pa | (real_va & 3)),
+							data);
+					*/
+					bus_write(8, pa | (real_va & 3), data);
+			}
+		}
+		else {
+			mmu_wb_drain_all (state, WB ());
+
+			if (datatype == ARM_WORD_TYPE)
+				//mem_write_word (state, pa, data);
+				bus_write(32, pa, data);
+			else if (datatype == ARM_HALFWORD_TYPE)
+				/*
+					mem_write_halfword (state,
+						    (pa | (real_va & 2)),
+						    data);
+				*/
+				bus_write(16, pa | (real_va & 2), data);
+			else if (datatype == ARM_BYTE_TYPE)
+				/*
+				mem_write_byte (state, (pa | (real_va & 3)),
+						data);
+				*/
+				bus_write(8, pa | (real_va & 3), data);
+		}
+	}
+	return NO_FAULT;
+}
+
+static fault_t
+update_cache (ARMul_State * state, ARMword va, ARMword data, ARMword datatype,
+	      cache_line_t * cache, cache_s * cache_t, ARMword real_va)
+{
+	ARMword temp, offset;
+
+	ARMword index = va_cache_index (va, cache_t);
+
+	//cache->data[index] = data;
+
+	if (datatype == ARM_WORD_TYPE)
+		cache->data[index] = data;
+	else if (datatype == ARM_HALFWORD_TYPE) {
+		temp = cache->data[index];
+		offset = (((ARMword) state->bigendSig * 2) ^ (real_va & 2)) << 3;	/* bit offset into the word */
+		cache->data[index] =
+			(temp & ~(0xffffL << offset)) | ((data & 0xffffL) <<
+							 offset);
+	}
+	else if (datatype == ARM_BYTE_TYPE) {
+		temp = cache->data[index];
+		offset = (((ARMword) state->bigendSig * 3) ^ (real_va & 3)) << 3;	/* bit offset into the word */
+		cache->data[index] =
+			(temp & ~(0xffL << offset)) | ((data & 0xffL) <<
+						       offset);
+	}
+
+	if (index < (cache_t->width >> (WORD_SHT + 1)))
+		cache->tag |= TAG_FIRST_HALF_DIRTY;
+	else
+		cache->tag |= TAG_LAST_HALF_DIRTY;
+
+	return NO_FAULT;
+}
+
+ARMword
+sa_mmu_mrc (ARMul_State * state, ARMword instr, ARMword * value)
+{
+	mmu_regnum_t creg = (mmu_regnum_t)(BITS (16, 19) & 15);
+	ARMword data;
+
+	switch (creg) {
+	case MMU_ID:
+//              printf("mmu_mrc read ID     ");
+		data = 0x41007100;	/* v3 */
+		data = state->cpu->cpu_val;
+		break;
+	case MMU_CONTROL:
+//              printf("mmu_mrc read CONTROL");
+		data = state->mmu.control;
+		break;
+	case MMU_TRANSLATION_TABLE_BASE:
+//              printf("mmu_mrc read TTB    ");
+		data = state->mmu.translation_table_base;
+		break;
+	case MMU_DOMAIN_ACCESS_CONTROL:
+//              printf("mmu_mrc read DACR   ");
+		data = state->mmu.domain_access_control;
+		break;
+	case MMU_FAULT_STATUS:
+//              printf("mmu_mrc read FSR    ");
+		data = state->mmu.fault_status;
+		break;
+	case MMU_FAULT_ADDRESS:
+//              printf("mmu_mrc read FAR    ");
+		data = state->mmu.fault_address;
+		break;
+	case MMU_PID:
+		data = state->mmu.process_id;
+	default:
+		printf ("mmu_mrc read UNKNOWN - reg %d\n", creg);
+		data = 0;
+		break;
+	}
+//      printf("\t\t\t\t\tpc = 0x%08x\n", state->Reg[15]);
+	*value = data;
+	return data;
+}
+
+void
+sa_mmu_cache_ops (ARMul_State * state, ARMword instr, ARMword value)
+{
+	int CRm, OPC_2;
+
+	CRm = BITS (0, 3);
+	OPC_2 = BITS (5, 7);
+
+	if (OPC_2 == 0 && CRm == 7) {
+		mmu_cache_invalidate_all (state, I_CACHE ());
+		mmu_cache_invalidate_all (state, MAIN_D_CACHE ());
+		mmu_cache_invalidate_all (state, MINI_D_CACHE ());
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 5) {
+		mmu_cache_invalidate_all (state, I_CACHE ());
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 6) {
+		mmu_cache_invalidate_all (state, MAIN_D_CACHE ());
+		mmu_cache_invalidate_all (state, MINI_D_CACHE ());
+		return;
+	}
+
+	if (OPC_2 == 1 && CRm == 6) {
+		mmu_cache_invalidate (state, MAIN_D_CACHE (), value);
+		mmu_cache_invalidate (state, MINI_D_CACHE (), value);
+		return;
+	}
+
+	if (OPC_2 == 1 && CRm == 0xa) {
+		mmu_cache_clean (state, MAIN_D_CACHE (), value);
+		mmu_cache_clean (state, MINI_D_CACHE (), value);
+		return;
+	}
+
+	if (OPC_2 == 4 && CRm == 0xa) {
+		mmu_wb_drain_all (state, WB ());
+		return;
+	}
+	ERROR_LOG(ARM11, "Unknow OPC_2 = %x CRm = %x\n", OPC_2, CRm);
+}
+
+static void
+sa_mmu_tlb_ops (ARMul_State * state, ARMword instr, ARMword value)
+{
+	int CRm, OPC_2;
+
+	CRm = BITS (0, 3);
+	OPC_2 = BITS (5, 7);
+
+
+	if (OPC_2 == 0 && CRm == 0x7) {
+		mmu_tlb_invalidate_all (state, I_TLB ());
+		mmu_tlb_invalidate_all (state, D_TLB ());
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 0x5) {
+		mmu_tlb_invalidate_all (state, I_TLB ());
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 0x6) {
+		mmu_tlb_invalidate_all (state, D_TLB ());
+		return;
+	}
+
+	if (OPC_2 == 1 && CRm == 0x6) {
+		mmu_tlb_invalidate_entry (state, D_TLB (), value);
+		return;
+	}
+
+	ERROR_LOG(ARM11, "Unknow OPC_2 = %x CRm = %x\n", OPC_2, CRm);
+}
+
+static void
+sa_mmu_rb_ops (ARMul_State * state, ARMword instr, ARMword value)
+{
+	int CRm, OPC_2;
+
+	CRm = BITS (0, 3);
+	OPC_2 = BITS (5, 7);
+
+	if (OPC_2 == 0x0 && CRm == 0x0) {
+		mmu_rb_invalidate_all (RB ());
+		return;
+	}
+
+	if (OPC_2 == 0x2) {
+		int idx = CRm & 0x3;
+		int type = ((CRm >> 2) & 0x3) + 1;
+
+		if ((idx < 4) && (type < 4))
+			mmu_rb_load (state, RB (), idx, type, value);
+		return;
+	}
+
+	if ((OPC_2 == 1) && (CRm < 4)) {
+		mmu_rb_invalidate_entry (RB (), CRm);
+		return;
+	}
+
+	ERROR_LOG(ARM11, "Unknow OPC_2 = %x CRm = %x\n", OPC_2, CRm);
+}
+
+static ARMword
+sa_mmu_mcr (ARMul_State * state, ARMword instr, ARMword value)
+{
+	mmu_regnum_t creg = (mmu_regnum_t)(BITS (16, 19) & 15);
+	if (!strncmp (state->cpu->cpu_arch_name, "armv4", 5)) {
+		switch (creg) {
+		case MMU_CONTROL:
+//              printf("mmu_mcr wrote CONTROL      ");
+			state->mmu.control = (value | 0x70) & 0xFFFD;
+			break;
+		case MMU_TRANSLATION_TABLE_BASE:
+//              printf("mmu_mcr wrote TTB          ");
+			state->mmu.translation_table_base =
+				value & 0xFFFFC000;
+			break;
+		case MMU_DOMAIN_ACCESS_CONTROL:
+//              printf("mmu_mcr wrote DACR         ");
+			state->mmu.domain_access_control = value;
+			break;
+
+		case MMU_FAULT_STATUS:
+			state->mmu.fault_status = value & 0xFF;
+			break;
+		case MMU_FAULT_ADDRESS:
+			state->mmu.fault_address = value;
+			break;
+
+		case MMU_CACHE_OPS:
+			sa_mmu_cache_ops (state, instr, value);
+			break;
+		case MMU_TLB_OPS:
+			sa_mmu_tlb_ops (state, instr, value);
+			break;
+		case MMU_SA_RB_OPS:
+			sa_mmu_rb_ops (state, instr, value);
+			break;
+		case MMU_SA_DEBUG:
+			break;
+		case MMU_SA_CP15_R15:
+			break;
+		case MMU_PID:
+			//2004-06-06 lyh, bug provided by wen ye wenye@cs.ucsb.edu
+			state->mmu.process_id = value & 0x7e000000;
+			break;
+
+		default:
+			printf ("mmu_mcr wrote UNKNOWN - reg %d\n", creg);
+			break;
+		}
+	}
+    return 0;
+}
+
+//teawater add for arm2x86 2005.06.24-------------------------------------------
+static int
+sa_mmu_v2p_dbct (ARMul_State * state, ARMword virt_addr, ARMword * phys_addr)
+{
+	fault_t fault;
+	tlb_entry_t *tlb;
+
+	virt_addr = mmu_pid_va_map (virt_addr);
+	if (MMU_Enabled) {
+
+		/*align check */
+		if ((virt_addr & (WORD_SIZE - 1)) && MMU_Aligned) {
+			DEBUG_LOG(ARM11, "align\n");
+			return ALIGNMENT_FAULT;
+		}
+		else
+			virt_addr &= ~(WORD_SIZE - 1);
+
+		/*translate tlb */
+		fault = translate (state, virt_addr, I_TLB (), &tlb);
+		if (fault) {
+			DEBUG_LOG(ARM11, "translate\n");
+			return fault;
+		}
+
+		/*check access */
+		fault = check_access (state, virt_addr, tlb, 1);
+		if (fault) {
+			DEBUG_LOG(ARM11, "check_fault\n");
+			return fault;
+		}
+	}
+
+	if (MMU_Disabled) {
+		*phys_addr = virt_addr;
+	}
+	else {
+		*phys_addr = tlb_va_to_pa (tlb, virt_addr);
+	}
+
+	return (0);
+}
+
+//AJ2D--------------------------------------------------------------------------
+
+/*sa mmu_ops_t*/
+mmu_ops_t sa_mmu_ops = {
+	sa_mmu_init,
+	sa_mmu_exit,
+	sa_mmu_read_byte,
+	sa_mmu_write_byte,
+	sa_mmu_read_halfword,
+	sa_mmu_write_halfword,
+	sa_mmu_read_word,
+	sa_mmu_write_word,
+	sa_mmu_load_instr,
+	sa_mmu_mcr,
+	sa_mmu_mrc,
+//teawater add for arm2x86 2005.06.24-------------------------------------------
+	sa_mmu_v2p_dbct,
+//AJ2D--------------------------------------------------------------------------
+};
diff --git a/src/core/arm/interpreter/mmu/sa_mmu.h b/src/core/arm/interpreter/mmu/sa_mmu.h
new file mode 100644
index 000000000..64b1c5470
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/sa_mmu.h
@@ -0,0 +1,58 @@
+/*
+    sa_mmu.h - StrongARM Memory Management Unit emulation.
+    ARMulator extensions for SkyEye.
+	<lyhost@263.net>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+#ifndef _SA_MMU_H_
+#define _SA_MMU_H_
+
+
+/**
+ *  The interface of read data from bus
+ */
+int bus_read(short size, int addr, uint32_t * value);
+
+/**
+ * The interface of write data from bus
+ */
+int bus_write(short size, int addr, uint32_t value);
+
+
+typedef struct sa_mmu_s
+{
+	tlb_s i_tlb;
+	cache_s i_cache;
+
+	tlb_s d_tlb;
+	cache_s main_d_cache;
+	cache_s mini_d_cache;
+	rb_s rb_t;
+	wb_s wb_t;
+} sa_mmu_t;
+
+#define I_TLB() (&state->mmu.u.sa_mmu.i_tlb)
+#define I_CACHE() (&state->mmu.u.sa_mmu.i_cache)
+
+#define D_TLB() (&state->mmu.u.sa_mmu.d_tlb)
+#define MAIN_D_CACHE() (&state->mmu.u.sa_mmu.main_d_cache)
+#define MINI_D_CACHE() (&state->mmu.u.sa_mmu.mini_d_cache)
+#define WB() (&state->mmu.u.sa_mmu.wb_t)
+#define RB() (&state->mmu.u.sa_mmu.rb_t)
+
+extern mmu_ops_t sa_mmu_ops;
+#endif /*_SA_MMU_H_*/
diff --git a/src/core/arm/interpreter/mmu/tlb.cpp b/src/core/arm/interpreter/mmu/tlb.cpp
new file mode 100644
index 000000000..ca60ac1a1
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/tlb.cpp
@@ -0,0 +1,307 @@
+#include <assert.h>
+
+#include "core/arm/interpreter/armdefs.h"
+
+ARMword tlb_masks[] = {
+	0x00000000,		/* TLB_INVALID */
+	0xFFFFF000,		/* TLB_SMALLPAGE */
+	0xFFFF0000,		/* TLB_LARGEPAGE */
+	0xFFF00000,		/* TLB_SECTION */
+	0xFFFFF000,		/*TLB_ESMALLPAGE, have TEX attirbute, only for XScale */
+	0xFFFFFC00		/* TLB_TINYPAGE */
+};
+
+/* This function encodes table 8-2 Interpreting AP bits,
+   returning non-zero if access is allowed. */
+static int
+check_perms (ARMul_State * state, int ap, int read)
+{
+	int s, r, user;
+
+	s = state->mmu.control & CONTROL_SYSTEM;
+	r = state->mmu.control & CONTROL_ROM;
+	//chy 2006-02-15 , should consider system mode, don't conside 26bit mode
+	user = (state->Mode == USER32MODE) || (state->Mode == USER26MODE) || (state->Mode == SYSTEM32MODE);
+
+	switch (ap) {
+	case 0:
+		return read && ((s && !user) || r);
+	case 1:
+		return !user;
+	case 2:
+		return read || !user;
+	case 3:
+		return 1;
+	}
+	return 0;
+}
+
+fault_t
+check_access (ARMul_State * state, ARMword virt_addr, tlb_entry_t * tlb,
+	      int read)
+{
+	int access;
+
+	state->mmu.last_domain = tlb->domain;
+	access = (state->mmu.domain_access_control >> (tlb->domain * 2)) & 3;
+	if ((access == 0) || (access == 2)) {
+		/* It's unclear from the documentation whether this
+		   should always raise a section domain fault, or if
+		   it should be a page domain fault in the case of an
+		   L1 that describes a page table.  In the ARM710T
+		   datasheets, "Figure 8-9: Sequence for checking faults"
+		   seems to indicate the former, while "Table 8-4: Priority
+		   encoding of fault status" gives a value for FS[3210] in
+		   the event of a domain fault for a page.  Hmm. */
+		return SECTION_DOMAIN_FAULT;
+	}
+	if (access == 1) {
+		/* client access - check perms */
+		int subpage, ap;
+
+		switch (tlb->mapping) {
+			/*ks 2004-05-09   
+			 *   only for XScale
+			 *   Extend Small Page(ESP) Format
+			 *   31-12 bits    the base addr of ESP
+			 *   11-10 bits    SBZ
+			 *   9-6   bits    TEX
+			 *   5-4   bits    AP
+			 *   3     bit     C
+			 *   2     bit     B
+			 *   1-0   bits    11
+			 * */
+		case TLB_ESMALLPAGE:	//xj
+			subpage = 0;
+			//printf("TLB_ESMALLPAGE virt_addr=0x%x  \n",virt_addr );
+			break;
+
+		case TLB_TINYPAGE:
+			subpage = 0;
+			//printf("TLB_TINYPAGE virt_addr=0x%x  \n",virt_addr );
+			break;
+
+		case TLB_SMALLPAGE:
+			subpage = (virt_addr >> 10) & 3;
+			break;
+		case TLB_LARGEPAGE:
+			subpage = (virt_addr >> 14) & 3;
+			break;
+		case TLB_SECTION:
+			subpage = 3;
+			break;
+		default:
+			assert (0);
+			subpage = 0;	/* cleans a warning */
+		}
+		ap = (tlb->perms >> (subpage * 2 + 4)) & 3;
+		if (!check_perms (state, ap, read)) {
+			if (tlb->mapping == TLB_SECTION) {
+				return SECTION_PERMISSION_FAULT;
+			}
+			else {
+				return SUBPAGE_PERMISSION_FAULT;
+			}
+		}
+	}
+	else {			/* access == 3 */
+		/* manager access - don't check perms */
+	}
+	return NO_FAULT;
+}
+
+fault_t
+translate (ARMul_State * state, ARMword virt_addr, tlb_s * tlb_t,
+	   tlb_entry_t ** tlb)
+{
+	*tlb = mmu_tlb_search (state, tlb_t, virt_addr);
+	if (!*tlb) {
+		/* walk the translation tables */
+		ARMword l1addr, l1desc;
+		tlb_entry_t entry;
+
+		l1addr = state->mmu.translation_table_base & 0xFFFFC000;
+		l1addr = (l1addr | (virt_addr >> 18)) & ~3;
+		//l1desc = mem_read_word (state, l1addr);
+		bus_read(32, l1addr, &l1desc);
+		switch (l1desc & 3) {
+		case 0:
+			/* 
+			 * according to Figure 3-9 Sequence for checking faults in arm manual,
+			 * section translation fault should be returned here. 
+			 */
+			{
+				return SECTION_TRANSLATION_FAULT;
+			}
+		case 3:
+			/* fine page table */
+			// dcl 2006-01-08
+			{
+				ARMword l2addr, l2desc;
+
+				l2addr = l1desc & 0xFFFFF000;
+				l2addr = (l2addr |
+					  ((virt_addr & 0x000FFC00) >> 8)) &
+					~3;
+				//l2desc = mem_read_word (state, l2addr);				 
+				bus_read(32, l2addr, &l2desc);
+
+				entry.virt_addr = virt_addr;
+				entry.phys_addr = l2desc;
+				entry.perms = l2desc & 0x00000FFC;
+				entry.domain = (l1desc >> 5) & 0x0000000F;
+				switch (l2desc & 3) {
+				case 0:
+					state->mmu.last_domain = entry.domain;
+					return PAGE_TRANSLATION_FAULT;
+				case 3:
+					entry.mapping = TLB_TINYPAGE;
+					break;
+				case 1:
+					// this is untested
+					entry.mapping = TLB_LARGEPAGE;
+					break;
+				case 2:
+					// this is untested
+					entry.mapping = TLB_SMALLPAGE;
+					break;
+				}
+			}
+			break;
+		case 1:
+			/* coarse page table */
+			{
+				ARMword l2addr, l2desc;
+
+				l2addr = l1desc & 0xFFFFFC00;
+				l2addr = (l2addr |
+					  ((virt_addr & 0x000FF000) >> 10)) &
+					~3;
+				//l2desc = mem_read_word (state, l2addr);
+				bus_read(32, l2addr, &l2desc);
+
+				entry.virt_addr = virt_addr;
+				entry.phys_addr = l2desc;
+				entry.perms = l2desc & 0x00000FFC;
+				entry.domain = (l1desc >> 5) & 0x0000000F;
+				//printf("SKYEYE:PAGE virt_addr = %x,l1desc=%x,phys_addr=%x\n",virt_addr,l1desc,entry.phys_addr);
+				//chy 2003-09-02 for xscale
+				switch (l2desc & 3) {
+				case 0:
+					state->mmu.last_domain = entry.domain;
+					return PAGE_TRANSLATION_FAULT;
+				case 3:
+					if (!state->is_XScale) {
+						state->mmu.last_domain =
+							entry.domain;
+						return PAGE_TRANSLATION_FAULT;
+					};
+					//ks 2004-05-09 xscale shold use Extend Small Page
+					//entry.mapping = TLB_SMALLPAGE;
+					entry.mapping = TLB_ESMALLPAGE;	//xj
+					break;
+				case 1:
+					entry.mapping = TLB_LARGEPAGE;
+					break;
+				case 2:
+					entry.mapping = TLB_SMALLPAGE;
+					break;
+				}
+			}
+			break;
+		case 2:
+			/* section */
+			//printf("SKYEYE:WARNING: not implement section mapping incompletely\n");
+			//printf("SKYEYE:SECTION virt_addr = %x,l1desc=%x\n",virt_addr,l1desc);
+			//return SECTION_DOMAIN_FAULT;
+			//#if 0
+			entry.virt_addr = virt_addr;
+			entry.phys_addr = l1desc;
+			entry.perms = l1desc & 0x00000C0C;
+			entry.domain = (l1desc >> 5) & 0x0000000F;
+			entry.mapping = TLB_SECTION;
+			break;
+			//#endif
+		}
+		entry.virt_addr &= tlb_masks[entry.mapping];
+		entry.phys_addr &= tlb_masks[entry.mapping];
+
+		/* place entry in the tlb */
+		*tlb = &tlb_t->entrys[tlb_t->cycle];
+		tlb_t->cycle = (tlb_t->cycle + 1) % tlb_t->num;
+		**tlb = entry;
+	}
+	state->mmu.last_domain = (*tlb)->domain;
+	return NO_FAULT;
+}
+
+int
+mmu_tlb_init (tlb_s * tlb_t, int num)
+{
+	tlb_entry_t *e;
+	int i;
+
+	e = (tlb_entry_t *) malloc (sizeof (*e) * num);
+	if (e == NULL) {
+		ERROR_LOG(ARM11, "malloc size %d\n", sizeof (*e) * num);
+		goto tlb_malloc_error;
+	}
+	tlb_t->entrys = e;
+	for (i = 0; i < num; i++, e++)
+		e->mapping = TLB_INVALID;
+	tlb_t->cycle = 0;
+	tlb_t->num = num;
+	return 0;
+
+      tlb_malloc_error:
+	return -1;
+}
+
+void
+mmu_tlb_exit (tlb_s * tlb_t)
+{
+	free (tlb_t->entrys);
+};
+
+void
+mmu_tlb_invalidate_all (ARMul_State * state, tlb_s * tlb_t)
+{
+	int entry;
+
+	for (entry = 0; entry < tlb_t->num; entry++) {
+		tlb_t->entrys[entry].mapping = TLB_INVALID;
+	}
+	tlb_t->cycle = 0;
+}
+
+void
+mmu_tlb_invalidate_entry (ARMul_State * state, tlb_s * tlb_t, ARMword addr)
+{
+	tlb_entry_t *tlb;
+
+	tlb = mmu_tlb_search (state, tlb_t, addr);
+	if (tlb) {
+		tlb->mapping = TLB_INVALID;
+	}
+}
+
+tlb_entry_t *
+mmu_tlb_search (ARMul_State * state, tlb_s * tlb_t, ARMword virt_addr)
+{
+	int entry;
+
+	for (entry = 0; entry < tlb_t->num; entry++) {
+		tlb_entry_t *tlb;
+		ARMword mask;
+
+		tlb = &(tlb_t->entrys[entry]);
+		if (tlb->mapping == TLB_INVALID) {
+			continue;
+		}
+		mask = tlb_masks[tlb->mapping];
+		if ((virt_addr & mask) == (tlb->virt_addr & mask)) {
+			return tlb;
+		}
+	}
+	return NULL;
+}
diff --git a/src/core/arm/interpreter/mmu/tlb.h b/src/core/arm/interpreter/mmu/tlb.h
new file mode 100644
index 000000000..40856567b
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/tlb.h
@@ -0,0 +1,87 @@
+#ifndef _MMU_TLB_H_
+#define _MMU_TLB_H_
+
+typedef enum tlb_mapping_t
+{
+    TLB_INVALID = 0,
+    TLB_SMALLPAGE = 1,
+    TLB_LARGEPAGE = 2,
+    TLB_SECTION = 3,
+    TLB_ESMALLPAGE = 4,
+    TLB_TINYPAGE = 5
+} tlb_mapping_t;
+
+extern ARMword tlb_masks[];
+
+/* Permissions bits in a TLB entry:
+ *
+ *         31         12 11 10  9  8  7  6  5  4  3   2   1   0
+ *        +-------------+-----+-----+-----+-----+---+---+-------+
+ * Page:|             | ap3 | ap2 | ap1 | ap0 | C | B |       |
+ *        +-------------+-----+-----+-----+-----+---+---+-------+
+ *
+ *         31         12 11 10  9              4  3   2   1   0
+ *            +-------------+-----+-----------------+---+---+-------+
+ * Section:    |             |  AP |                 | C | B |       |
+ *            +-------------+-----+-----------------+---+---+-------+
+ */
+
+/*
+section:
+    section base address    [31:20]
+    AP            - table 8-2, page 8-8
+    domain
+    C,B
+
+page:
+    page base address    [31:16] or [31:12]
+    ap[3:0]
+    domain (from L1)
+    C,B
+*/
+
+
+typedef struct tlb_entry_t
+{
+    ARMword virt_addr;
+    ARMword phys_addr;
+    ARMword perms;
+    ARMword domain;
+    tlb_mapping_t mapping;
+} tlb_entry_t;
+
+typedef struct tlb_s
+{
+    int num;        /*num of tlb entry */
+    int cycle;        /*current tlb cycle */
+    tlb_entry_t *entrys;
+} tlb_s;
+
+
+#define tlb_c_flag(tlb) \
+    ((tlb)->perms & 0x8)
+#define tlb_b_flag(tlb) \
+    ((tlb)->perms & 0x4)
+
+#define  tlb_va_to_pa(tlb, va) ((tlb->phys_addr & tlb_masks[tlb->mapping]) | (va & ~tlb_masks[tlb->mapping]))
+fault_t
+check_access (ARMul_State * state, ARMword virt_addr, tlb_entry_t * tlb,
+          int read);
+
+fault_t
+translate (ARMul_State * state, ARMword virt_addr, tlb_s * tlb_t,
+       tlb_entry_t ** tlb);
+
+int mmu_tlb_init (tlb_s * tlb_t, int num);
+
+void mmu_tlb_exit (tlb_s * tlb_t);
+
+void mmu_tlb_invalidate_all (ARMul_State * state, tlb_s * tlb_t);
+
+void
+mmu_tlb_invalidate_entry (ARMul_State * state, tlb_s * tlb_t, ARMword addr);
+
+tlb_entry_t *mmu_tlb_search (ARMul_State * state, tlb_s * tlb_t,
+                 ARMword virt_addr);
+
+#endif        /*_MMU_TLB_H_*/
diff --git a/src/core/arm/interpreter/mmu/wb.cpp b/src/core/arm/interpreter/mmu/wb.cpp
new file mode 100644
index 000000000..82c0cec02
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/wb.cpp
@@ -0,0 +1,149 @@
+#include "core/arm/interpreter/armdefs.h"
+
+/* wb_init
+ * @wb_t	:wb_t to init
+ * @num		:num of entrys
+ * @nb		:num of byte of each entry
+ *
+ * $	-1:error
+ * 		 0:ok
+ * */
+int
+mmu_wb_init (wb_s * wb_t, int num, int nb)
+{
+	int i;
+	wb_entry_t *entrys, *wb;
+
+	entrys = (wb_entry_t *) malloc (sizeof (*entrys) * num);
+	if (entrys == NULL) {
+		ERROR_LOG(ARM11, "malloc size %d\n", sizeof (*entrys) * num);
+		goto entrys_malloc_error;
+	}
+
+	for (wb = entrys, i = 0; i < num; i++, wb++) {
+		/*chy 2004-06-06, fix bug found by wenye@cs.ucsb.edu */
+		//wb->data = (ARMword *)malloc(sizeof(ARMword) * nb);
+		wb->data = (ARMbyte *) malloc (nb);
+		if (wb->data == NULL) {
+			ERROR_LOG(ARM11, "malloc size of %d\n", nb);
+			goto data_malloc_error;
+		}
+
+	};
+
+	wb_t->first = wb_t->last = wb_t->used = 0;
+	wb_t->num = num;
+	wb_t->nb = nb;
+	wb_t->entrys = entrys;
+	return 0;
+
+      data_malloc_error:
+	while (--i >= 0)
+		free (entrys[i].data);
+	free (entrys);
+      entrys_malloc_error:
+	return -1;
+};
+
+/* wb_exit
+ * @wb_t :wb_t to exit
+ * */
+void
+mmu_wb_exit (wb_s * wb_t)
+{
+	int i;
+	wb_entry_t *wb;
+
+	wb = wb_t->entrys;
+	for (i = 0; i < wb_t->num; i++, wb++) {
+		free (wb->data);
+	}
+	free (wb_t->entrys);
+};
+
+/* wb_write_words :put words in Write Buffer
+ * @state:	ARMul_State
+ * @wb_t:	write buffer
+ * @pa:		physical address
+ * @data:	data ptr
+ * @n		number of word to write
+ *
+ * Note: write buffer merge is not implemented, can be done late
+ * */
+void
+mmu_wb_write_bytes (ARMul_State * state, wb_s * wb_t, ARMword pa,
+		    ARMbyte * data, int n)
+{
+	int i;
+	wb_entry_t *wb;
+
+	while (n) {
+		if (wb_t->num == wb_t->used) {
+			/*clean the last wb entry */
+			ARMword t;
+
+			wb = &wb_t->entrys[wb_t->last];
+			t = wb->pa;
+			for (i = 0; i < wb->nb; i++) {
+				//mem_write_byte (state, t, wb->data[i]);
+				bus_write(8, t, wb->data[i]);
+				//t += WORD_SIZE;
+				t++;
+			}
+			wb_t->last++;
+			if (wb_t->last == wb_t->num)
+				wb_t->last = 0;
+			wb_t->used--;
+		}
+
+		wb = &wb_t->entrys[wb_t->first];
+		i = (n < wb_t->nb) ? n : wb_t->nb;
+
+		wb->pa = pa;
+		//pa += i << WORD_SHT;
+		pa += i;
+
+		wb->nb = i;
+		//memcpy(wb->data, data, i << WORD_SHT);
+		memcpy (wb->data, data, i);
+		data += i;
+		n -= i;
+		wb_t->first++;
+		if (wb_t->first == wb_t->num)
+			wb_t->first = 0;
+		wb_t->used++;
+	};
+//teawater add for set_dirty fflash cache function 2005.07.18-------------------
+#ifdef DBCT
+	if (!skyeye_config.no_dbct) {
+		tb_setdirty (state, pa, NULL);
+	}
+#endif
+//AJ2D--------------------------------------------------------------------------
+}
+
+/* wb_drain_all
+ * @wb_t wb_t to drain
+ * */
+void
+mmu_wb_drain_all (ARMul_State * state, wb_s * wb_t)
+{
+	ARMword pa;
+	wb_entry_t *wb;
+	int i;
+
+	while (wb_t->used) {
+		wb = &wb_t->entrys[wb_t->last];
+		pa = wb->pa;
+		for (i = 0; i < wb->nb; i++) {
+			//mem_write_byte (state, pa, wb->data[i]);
+			bus_write(8, pa, wb->data[i]);
+			//pa += WORD_SIZE;
+			pa++;
+		}
+		wb_t->last++;
+		if (wb_t->last == wb_t->num)
+			wb_t->last = 0;
+		wb_t->used--;
+	};
+}
diff --git a/src/core/arm/interpreter/mmu/wb.h b/src/core/arm/interpreter/mmu/wb.h
new file mode 100644
index 000000000..8fb7de946
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/wb.h
@@ -0,0 +1,63 @@
+#ifndef _MMU_WB_H_
+#define _MMU_WB_H_
+
+typedef struct wb_entry_s
+{
+    ARMword pa;        //phy_addr
+    ARMbyte *data;        //data
+    int nb;            //number byte to write
+} wb_entry_t;
+
+typedef struct wb_s
+{
+    int num;        //number of wb_entry
+    int nb;            //number of byte of each entry
+    int first;        //
+    int last;        //
+    int used;        //
+    wb_entry_t *entrys;
+} wb_s;
+
+typedef struct wb_desc_s
+{
+    int num;
+    int nb;
+} wb_desc_t;
+
+/* wb_init
+ * @wb_t    :wb_t to init
+ * @num        :num of entrys
+ * @nw        :num of word of each entry
+ *
+ * $    -1:error
+ *          0:ok
+ * */
+int mmu_wb_init (wb_s * wb_t, int num, int nb);
+
+
+/* wb_exit
+ * @wb_t :wb_t to exit
+ * */
+void mmu_wb_exit (wb_s * wb);
+
+
+/* wb_write_bytes :put bytess in Write Buffer
+ * @state:    ARMul_State
+ * @wb_t:    write buffer
+ * @pa:        physical address
+ * @data:    data ptr
+ * @n        number of byte to write
+ *
+ * Note: write buffer merge is not implemented, can be done late
+ * */
+void
+mmu_wb_write_bytess (ARMul_State * state, wb_s * wb_t, ARMword pa,
+             ARMbyte * data, int n);
+
+
+/* wb_drain_all
+ * @wb_t wb_t to drain
+ * */
+void mmu_wb_drain_all (ARMul_State * state, wb_s * wb_t);
+
+#endif /*_MMU_WB_H_*/
diff --git a/src/core/arm/interpreter/mmu/xscale_copro.cpp b/src/core/arm/interpreter/mmu/xscale_copro.cpp
new file mode 100644
index 000000000..433ce8e02
--- /dev/null
+++ b/src/core/arm/interpreter/mmu/xscale_copro.cpp
@@ -0,0 +1,1391 @@
+/*
+    armmmu.c - Memory Management Unit emulation.
+    ARMulator extensions for the ARM7100 family.
+    Copyright (C) 1999  Ben Williamson
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+#include <assert.h>
+#include <string.h>
+
+#include "core/arm/interpreter/armdefs.h"
+#include "core/arm/interpreter/armemu.h"
+
+/*#include "pxa.h" */
+
+/* chy 2005-09-19 */
+
+/* extern pxa270_io_t pxa270_io; */
+/* chy 2005-09-19 -----end */
+
+typedef struct xscale_mmu_desc_s
+{
+	int i_tlb;
+	cache_desc_t i_cache;
+
+	int d_tlb;
+	cache_desc_t main_d_cache;
+	cache_desc_t mini_d_cache;
+	//int   rb;  xscale has no read buffer
+	wb_desc_t wb;
+} xscale_mmu_desc_t;
+
+static xscale_mmu_desc_t pxa_mmu_desc = {
+	32,
+	{32, 32, 32, CACHE_WRITE_BACK},
+
+	32,
+	{32, 32, 32, CACHE_WRITE_BACK},
+	{32, 2, 8, CACHE_WRITE_BACK},
+	{8, 16},		//for byte size, 
+};
+
+//chy 2005-09-19 for cp6
+#define CR0_ICIP   0
+#define CR1_ICMR   1
+//chy 2005-09-19 ---end
+//----------- for cp14-----------------
+#define  CCLKCFG   6
+#define  PWRMODE   7
+typedef struct xscale_cp14_reg_s
+{
+	unsigned cclkcfg;	//reg6
+	unsigned pwrmode;	//reg7
+} xscale_cp14_reg_s;
+
+xscale_cp14_reg_s pxa_cp14_regs;
+
+//--------------------------------------
+
+static fault_t xscale_mmu_write (ARMul_State * state, ARMword va,
+				 ARMword data, ARMword datatype);
+static fault_t xscale_mmu_read (ARMul_State * state, ARMword va,
+				ARMword * data, ARMword datatype);
+
+ARMword xscale_mmu_mrc (ARMul_State * state, ARMword instr, ARMword * value);
+ARMword xscale_mmu_mcr (ARMul_State * state, ARMword instr, ARMword value);
+
+
+/* jeff add 2010.9.26 for pxa270 cp6*/
+#define PXA270_ICMR 0x40D00004
+#define PXA270_ICPR 0x40D00010
+#define PXA270_ICLR 0x40D00008
+//chy 2005-09-19 for xscale pxa27x cp6
+unsigned
+xscale_cp6_mrc (ARMul_State * state, unsigned type, ARMword instr,
+		ARMword * data)
+{
+	unsigned opcode_2 = BITS (5, 7);
+	unsigned CRm = BITS (0, 3);
+	unsigned reg = BITS (16, 19);
+	unsigned result;
+
+	//printf("SKYEYE: xscale_cp6_mrc:opcode_2 0x%x, CRm 0x%x, reg 0x%x,reg[15] 0x%x, instr %x\n",opcode_2,CRm,reg,state->Reg[15], instr);
+
+	switch (reg) {
+	case CR0_ICIP: {		// cp 6 reg 0
+		//printf("cp6_mrc cr0 ICIP              \n");
+		/* *data = (pxa270_io.icmr & pxa270_io.icpr) & ~pxa270_io.iclr; */
+		/* use bus_read get the pxa270 machine registers  2010.9.26 jeff*/
+		int icmr, icpr, iclr;
+		bus_read(32, PXA270_ICMR, (uint32_t*)&icmr);
+		bus_read(32, PXA270_ICPR, (uint32_t*)&icpr);
+		bus_read(32, PXA270_ICLR, (uint32_t*)&iclr);
+		*data = (icmr & icpr)  & ~iclr;
+		}
+		break;
+	case CR1_ICMR: {	// cp 6 reg 1
+		//printf("cp6_mrc cr1 ICMR\n");
+		/* *data = pxa270_io.icmr; */
+		int icmr;
+		/* use bus_read get the pxa270 machine registers  2010.9.26 jeff*/
+		bus_read(32, PXA270_ICMR, (uint32_t*)&icmr);
+		*data = icmr;
+		}
+		break;
+	default:
+		*data = 0;
+		printf ("SKYEYE:cp6_mrc unknown cp6 regs!!!!!!\n");
+		printf ("SKYEYE: xscale_cp6_mrc:opcode_2 0x%x, CRm 0x%x, reg 0x%x,reg[15] 0x%x, instr %x\n", opcode_2, CRm, reg, state->Reg[15], instr);
+		break;
+	}
+	return 0;
+}
+
+//chy 2005-09-19 end
+//xscale cp13 ----------------------------------------------------
+unsigned
+xscale_cp13_init (ARMul_State * state)
+{
+	//printf("SKYEYE: xscale_cp13_init: begin\n");
+	return 0;
+}
+
+unsigned
+xscale_cp13_exit (ARMul_State * state)
+{
+	//printf("SKYEYE: xscale_cp13_exit: begin\n");
+	return 0;
+}
+
+unsigned
+xscale_cp13_ldc (ARMul_State * state, unsigned type, ARMword instr,
+		 ARMword data)
+{
+	printf ("SKYEYE: xscale_cp13_ldc: ERROR isn't existed,");
+	SKYEYE_OUTREGS (stderr);
+	fprintf (stderr, "\n");
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+unsigned
+xscale_cp13_stc (ARMul_State * state, unsigned type, ARMword instr,
+		 ARMword * data)
+{
+	printf ("SKYEYE: xscale_cp13_stc: ERROR isn't existed,");
+	SKYEYE_OUTREGS (stderr);
+	fprintf (stderr, "\n");
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+unsigned
+xscale_cp13_mrc (ARMul_State * state, unsigned type, ARMword instr,
+		 ARMword * data)
+{
+	printf ("SKYEYE: xscale_cp13_mrc: ERROR isn't existed,");
+	SKYEYE_OUTREGS (stderr);
+	fprintf (stderr, "\n");
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+unsigned
+xscale_cp13_mcr (ARMul_State * state, unsigned type, ARMword instr,
+		 ARMword data)
+{
+	printf ("SKYEYE: xscale_cp13_mcr: ERROR isn't existed,");
+	SKYEYE_OUTREGS (stderr);
+	fprintf (stderr, "\n");
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+unsigned
+xscale_cp13_cdp (ARMul_State * state, unsigned type, ARMword instr)
+{
+	printf ("SKYEYE: xscale_cp13_cdp: ERROR isn't existed,");
+	SKYEYE_OUTREGS (stderr);
+	fprintf (stderr, "\n");
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+unsigned
+xscale_cp13_read_reg (ARMul_State * state, unsigned reg, ARMword * data)
+{
+	printf ("SKYEYE: xscale_cp13_read_reg: ERROR isn't existed,");
+	SKYEYE_OUTREGS (stderr);
+	fprintf (stderr, "\n");
+	return 0;
+	//exit(-1);
+}
+
+unsigned
+xscale_cp13_write_reg (ARMul_State * state, unsigned reg, ARMword data)
+{
+	printf ("SKYEYE: xscale_cp13_write_reg: ERROR isn't existed,");
+	SKYEYE_OUTREGS (stderr);
+	fprintf (stderr, "\n");
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+//------------------------------------------------------------------
+//xscale cp14 ----------------------------------------------------
+unsigned
+xscale_cp14_init (ARMul_State * state)
+{
+	//printf("SKYEYE: xscale_cp14_init: begin\n");
+	pxa_cp14_regs.cclkcfg = 0;
+	pxa_cp14_regs.pwrmode = 0;
+	return 0;
+}
+
+unsigned
+xscale_cp14_exit (ARMul_State * state)
+{
+	//printf("SKYEYE: xscale_cp14_exit: begin\n");
+	return 0;
+}
+
+unsigned
+xscale_cp14_ldc (ARMul_State * state, unsigned type, ARMword instr,
+		 ARMword data)
+{
+	printf ("SKYEYE: xscale_cp14_ldc: ERROR isn't existed, reg15 0x%x\n",
+		state->Reg[15]);
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+unsigned
+xscale_cp14_stc (ARMul_State * state, unsigned type, ARMword instr,
+		 ARMword * data)
+{
+	printf ("SKYEYE: xscale_cp14_stc: ERROR isn't existed, reg15 0x%x\n",
+		state->Reg[15]);
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+
+unsigned
+xscale_cp14_mrc (ARMul_State * state, unsigned type, ARMword instr,
+		 ARMword * data)
+{
+	unsigned opcode_2 = BITS (5, 7);
+	unsigned CRm = BITS (0, 3);
+	unsigned reg = BITS (16, 19);
+	unsigned result;
+
+	//printf("SKYEYE: xscale_cp14_mrc:opcode_2 0x%x, CRm 0x%x, reg 0x%x,reg[15] 0x%x, instr %x\n",opcode_2,CRm,reg,\
+	state->Reg[15], instr);
+
+	switch (reg) {
+	case CCLKCFG:		// cp 14 reg 6
+		//printf("cp14_mrc cclkcfg              \n");
+		*data = pxa_cp14_regs.cclkcfg;
+		break;
+	case PWRMODE:		// cp 14 reg 7
+		//printf("cp14_mrc pwrmode              \n");
+		*data = pxa_cp14_regs.pwrmode;
+		break;
+	default:
+		*data = 0;
+		printf ("SKYEYE:cp14_mrc unknown cp14 regs!!!!!!\n");
+		break;
+	}
+	return 0;
+}
+unsigned xscale_cp14_mcr (ARMul_State * state, unsigned type, ARMword instr,
+			  ARMword data)
+{
+	unsigned opcode_2 = BITS (5, 7);
+	unsigned CRm = BITS (0, 3);
+	unsigned reg = BITS (16, 19);
+	unsigned result;
+
+	//printf("SKYEYE: xscale_cp14_mcr:opcode_2 0x%x, CRm 0x%x, reg 0x%x,reg[15] 0x%x, instr %x\n",opcode_2,CRm,reg,\
+	  state->Reg[15], instr);
+
+	switch (reg) {
+	case CCLKCFG:		// cp 14 reg 6
+		//printf("cp14_mcr cclkcfg              \n");
+		pxa_cp14_regs.cclkcfg = data & 0xf;
+		break;
+		case PWRMODE:	// cp 14 reg 7
+			//printf("cp14_mcr pwrmode              \n");
+		pxa_cp14_regs.pwrmode = data & 0x3;
+		break;
+		default:printf ("SKYEYE: cp14_mcr unknown cp14 regs!!!!!!\n");
+		break;
+	}
+	return 0;
+}
+unsigned xscale_cp14_cdp (ARMul_State * state, unsigned type, ARMword instr)
+{
+	printf ("SKYEYE: xscale_cp14_cdp: ERROR isn't existed, reg15 0x%x\n",
+		state->Reg[15]);
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+unsigned xscale_cp14_read_reg (ARMul_State * state, unsigned reg,
+			       ARMword * data)
+{
+	printf ("SKYEYE: xscale_cp14_read_reg: ERROR isn't existed, reg15 0x%x\n", state->Reg[15]);
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+	return 0; //No matter return value, only for compiler.
+}
+unsigned xscale_cp14_write_reg (ARMul_State * state, unsigned reg,
+				ARMword data)
+{
+	printf ("SKYEYE: xscale_cp14_write_reg: ERROR isn't existed, reg15 0x%x\n", state->Reg[15]);
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+
+	return 0; //No matter return value, only for compiler.
+}
+
+//------------------------------------------------------------------
+//cp15 -------------------------------------
+unsigned xscale_cp15_ldc (ARMul_State * state, unsigned type, ARMword instr,
+			  ARMword data)
+{
+	printf ("SKYEYE: xscale_cp15_ldc: ERROR isn't existed\n");
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+
+	return 0; //No matter return value, only for compiler.
+}
+unsigned xscale_cp15_stc (ARMul_State * state, unsigned type, ARMword instr,
+			  ARMword * data)
+{
+	printf ("SKYEYE: xscale_cp15_stc: ERROR isn't existed\n");
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+
+	return 0; //No matter return value, only for compiler.
+}
+unsigned xscale_cp15_cdp (ARMul_State * state, unsigned type, ARMword instr)
+{
+	printf ("SKYEYE: xscale_cp15_cdp: ERROR isn't existed\n");
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+
+	return 0; //No matter return value, only for compiler.
+}
+unsigned xscale_cp15_read_reg (ARMul_State * state, unsigned reg,
+			       ARMword * data)
+{
+//chy 2003-09-03: for xsacle_cp15_cp_access_allowed
+	if (reg == 15) {
+		*data = state->mmu.copro_access;
+		//printf("SKYEYE: xscale_cp15_read_reg: reg 0x%x,data %x\n",reg,*data);
+		return 0;
+	}
+	printf ("SKYEYE: xscale_cp15_read_reg: reg 0x%x, ERROR isn't existed\n", reg);
+	SKYEYE_OUTREGS (stderr);
+	// skyeye_exit (-1);
+
+	return 0; //No matter return value, only for compiler.
+}
+
+//chy 2003-09-03 used by macro CP_ACCESS_ALLOWED in armemu.h
+unsigned xscale_cp15_cp_access_allowed (ARMul_State * state, unsigned reg,
+					unsigned cpnum)
+{
+	unsigned data;
+
+	xscale_cp15_read_reg (state, reg, &data);
+	//printf("SKYEYE: cp15_cp_access_allowed data %x, cpnum %x, result %x\n", data, cpnum, (data & 1<<cpnum));
+	if (data & 1 << cpnum)
+		return 1;
+	else
+		return 0;
+}
+
+unsigned xscale_cp15_write_reg (ARMul_State * state, unsigned reg,
+				ARMword value)
+{
+	switch (reg) {
+	case MMU_FAULT_STATUS:
+		//printf("SKYEYE:cp15_write_reg  wrote FS        val 0x%x \n",value);
+		state->mmu.fault_status = value & 0x6FF;
+		break;
+	case MMU_FAULT_ADDRESS:
+		//printf("SKYEYE:cp15_write_reg wrote FA         val 0x%x \n",value);
+		state->mmu.fault_address = value;
+		break;
+	default:
+		printf ("SKYEYE: xscale_cp15_write_reg: reg 0x%x R15 %x ERROR isn't existed\n", reg, state->Reg[15]);
+		SKYEYE_OUTREGS (stderr);
+		// skyeye_exit (-1);
+	}
+	return 0;
+}
+
+unsigned
+xscale_cp15_init (ARMul_State * state)
+{
+	xscale_mmu_desc_t *desc;
+	cache_desc_t *c_desc;
+
+	state->mmu.control = 0;
+	state->mmu.translation_table_base = 0xDEADC0DE;
+	state->mmu.domain_access_control = 0xDEADC0DE;
+	state->mmu.fault_status = 0;
+	state->mmu.fault_address = 0;
+	state->mmu.process_id = 0;
+	state->mmu.cache_type = 0xB1AA1AA;	//0000 1011 0001 1010 1010 0001 1010 1010
+	state->mmu.aux_control = 0;
+
+	desc = &pxa_mmu_desc;
+
+	if (mmu_tlb_init (I_TLB (), desc->i_tlb)) {
+		ERROR_LOG(ARM11, "i_tlb init %d\n", -1);
+		goto i_tlb_init_error;
+	}
+
+	c_desc = &desc->i_cache;
+	if (mmu_cache_init (I_CACHE (), c_desc->width, c_desc->way,
+			    c_desc->set, c_desc->w_mode)) {
+		ERROR_LOG(ARM11, "i_cache init %d\n", -1);
+		goto i_cache_init_error;
+	}
+
+	if (mmu_tlb_init (D_TLB (), desc->d_tlb)) {
+		ERROR_LOG(ARM11, "d_tlb init %d\n", -1);
+		goto d_tlb_init_error;
+	}
+
+	c_desc = &desc->main_d_cache;
+	if (mmu_cache_init (MAIN_D_CACHE (), c_desc->width, c_desc->way,
+			    c_desc->set, c_desc->w_mode)) {
+		ERROR_LOG(ARM11, "main_d_cache init %d\n", -1);
+		goto main_d_cache_init_error;
+	}
+
+	c_desc = &desc->mini_d_cache;
+	if (mmu_cache_init (MINI_D_CACHE (), c_desc->width, c_desc->way,
+			    c_desc->set, c_desc->w_mode)) {
+		ERROR_LOG(ARM11, "mini_d_cache init %d\n", -1);
+		goto mini_d_cache_init_error;
+	}
+
+	if (mmu_wb_init (WB (), desc->wb.num, desc->wb.nb)) {
+		ERROR_LOG(ARM11, "wb init %d\n", -1);
+		goto wb_init_error;
+	}
+#if 0
+	if (mmu_rb_init (RB (), desc->rb)) {
+		ERROR_LOG(ARM11, "rb init %d\n", -1);
+		goto rb_init_error;
+	}
+#endif
+
+	return 0;
+#if 0
+      rb_init_error:
+	mmu_wb_exit (WB ());
+#endif
+      wb_init_error:
+	mmu_cache_exit (MINI_D_CACHE ());
+      mini_d_cache_init_error:
+	mmu_cache_exit (MAIN_D_CACHE ());
+      main_d_cache_init_error:
+	mmu_tlb_exit (D_TLB ());
+      d_tlb_init_error:
+	mmu_cache_exit (I_CACHE ());
+      i_cache_init_error:
+	mmu_tlb_exit (I_TLB ());
+      i_tlb_init_error:
+	return -1;
+}
+
+unsigned
+xscale_cp15_exit (ARMul_State * state)
+{
+	//mmu_rb_exit(RB());
+	mmu_wb_exit (WB ());
+	mmu_cache_exit (MINI_D_CACHE ());
+	mmu_cache_exit (MAIN_D_CACHE ());
+	mmu_tlb_exit (D_TLB ());
+	mmu_cache_exit (I_CACHE ());
+	mmu_tlb_exit (I_TLB ());
+	return 0;
+};
+
+
+static fault_t
+	xscale_mmu_load_instr (ARMul_State * state, ARMword va,
+			       ARMword * instr)
+{
+	fault_t fault;
+	tlb_entry_t *tlb;
+	cache_line_t *cache;
+	int c;			//cache bit
+	ARMword pa;		//physical addr
+
+	static int debug_count = 0;	//used for debug
+
+	DEBUG_LOG(ARM11, "va = %x\n", va);
+
+	va = mmu_pid_va_map (va);
+	if (MMU_Enabled) {
+		/*align check */
+		if ((va & (INSN_SIZE - 1)) && MMU_Aligned) {
+			DEBUG_LOG(ARM11, "align\n");
+			return ALIGNMENT_FAULT;
+		}
+		else
+			va &= ~(INSN_SIZE - 1);
+
+		/*translate tlb */
+		fault = translate (state, va, I_TLB (), &tlb);
+		if (fault) {
+			DEBUG_LOG(ARM11, "translate\n");
+			return fault;
+		}
+
+		/*check access */
+		fault = check_access (state, va, tlb, 1);
+		if (fault) {
+			DEBUG_LOG(ARM11, "check_fault\n");
+			return fault;
+		}
+	}
+	//chy 2003-09-02 for test, don't use cache  ?????       
+#if 0
+	/*search cache no matter MMU enabled/disabled */
+	cache = mmu_cache_search (state, I_CACHE (), va);
+	if (cache) {
+		*instr = cache->data[va_cache_index (va, I_CACHE ())];
+		return 0;
+	}
+#endif
+	/*if MMU disabled or C flag is set alloc cache */
+	if (MMU_Disabled) {
+		c = 1;
+		pa = va;
+	}
+	else {
+		c = tlb_c_flag (tlb);
+		pa = tlb_va_to_pa (tlb, va);
+	}
+
+	//chy 2003-09-03 only read mem, don't use cache now,will change later ????
+	//*instr = mem_read_word (state, pa);
+	bus_read(32, pa, instr);
+#if 0
+//-----------------------------------------------------------
+	//chy 2003-09-02 for test????
+	if (pa >= 0xa01c8000 && pa <= 0xa01c8020) {
+		printf ("SKYEYE:load_instr: pa %x, va %x,instr %x, R15 %x\n",
+			pa, va, *instr, state->Reg[15]);
+	}
+
+//----------------------------------------------------------------------        
+#endif
+	return NO_FAULT;
+
+	if (c) {
+		int index;
+
+		debug_count++;
+		cache = mmu_cache_alloc (state, I_CACHE (), va, pa);
+		index = va_cache_index (va, I_CACHE ());
+		*instr = cache->data[va_cache_index (va, I_CACHE ())];
+	}
+	else
+		//*instr = mem_read_word (state, pa);
+		bus_read(32, pa, instr);
+
+	return NO_FAULT;
+};
+
+
+
+static fault_t
+	xscale_mmu_read_byte (ARMul_State * state, ARMword virt_addr,
+			      ARMword * data)
+{
+	//ARMword temp,offset;
+	fault_t fault;
+	fault = xscale_mmu_read (state, virt_addr, data, ARM_BYTE_TYPE);
+	return fault;
+}
+
+static fault_t
+	xscale_mmu_read_halfword (ARMul_State * state, ARMword virt_addr,
+				  ARMword * data)
+{
+	//ARMword temp,offset;
+	fault_t fault;
+	fault = xscale_mmu_read (state, virt_addr, data, ARM_HALFWORD_TYPE);
+	return fault;
+}
+
+static fault_t
+	xscale_mmu_read_word (ARMul_State * state, ARMword virt_addr,
+			      ARMword * data)
+{
+	return xscale_mmu_read (state, virt_addr, data, ARM_WORD_TYPE);
+}
+
+
+
+
+static fault_t
+	xscale_mmu_read (ARMul_State * state, ARMword va, ARMword * data,
+			 ARMword datatype)
+{
+	fault_t fault;
+//      rb_entry_t *rb;
+	tlb_entry_t *tlb;
+	cache_line_t *cache;
+	ARMword pa, real_va, temp, offset;
+	//chy 2003-09-02 for test ????
+	static unsigned chyst1 = 0, chyst2 = 0;
+
+	DEBUG_LOG(ARM11, "va = %x\n", va);
+
+	va = mmu_pid_va_map (va);
+	real_va = va;
+	/*if MMU disabled, memory_read */
+	if (MMU_Disabled) {
+		//*data = mem_read_word(state, va);
+		if (datatype == ARM_BYTE_TYPE)
+			//*data = mem_read_byte (state, va);
+			bus_read(8, va, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//*data = mem_read_halfword (state, va);
+			bus_read(16, va, data);
+		else if (datatype == ARM_WORD_TYPE)
+			//*data = mem_read_word (state, va);
+			bus_read(32, va, data);
+		else {
+			printf ("SKYEYE:1 xscale_mmu_read error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+
+		return NO_FAULT;
+	}
+
+	/*align check */
+	if (((va & 3) && (datatype == ARM_WORD_TYPE) && MMU_Aligned) ||
+	    ((va & 1) && (datatype == ARM_HALFWORD_TYPE) && MMU_Aligned)) {
+		DEBUG_LOG(ARM11, "align\n");
+		return ALIGNMENT_FAULT;
+	}			// else
+
+	va &= ~(WORD_SIZE - 1);
+
+	/*translate va to tlb */
+	fault = translate (state, va, D_TLB (), &tlb);
+	if (fault) {
+		DEBUG_LOG(ARM11, "translate\n");
+		return fault;
+	}
+	/*check access permission */
+	fault = check_access (state, va, tlb, 1);
+	if (fault)
+		return fault;
+
+#if 0
+//------------------------------------------------
+//chy 2003-09-02 for test only ,should commit ????
+	if (datatype == ARM_WORD_TYPE) {
+		if (real_va >= 0xffff0000 && real_va <= 0xffff0020) {
+			pa = tlb_va_to_pa (tlb, va);
+			*data = mem_read_word (state, pa);
+			chyst1++;
+			printf ("**SKYEYE:mmu_read word %d: pa %x, va %x, data %x, R15 %x\n", chyst1, pa, real_va, *data, state->Reg[15]);
+			/*
+			   cache==mmu_cache_search(state,MAIN_D_CACHE(),va);
+			   if(cache){
+			   *data = cache->data[va_cache_index(va, MAIN_D_CACHE())];
+			   printf("cached data %x\n",*data);
+			   }else   printf("no cached data\n");
+			 */
+		}
+	}
+//-------------------------------------------------
+#endif
+#if 0
+	/*search in read buffer */
+	rb = mmu_rb_search (RB (), va);
+	if (rb) {
+		if (rb->fault)
+			return rb->fault;
+		*data = rb->data[(va & (rb_masks[rb->type] - 1)) >> WORD_SHT];
+		goto datatrans;
+		//return 0;
+	};
+#endif
+
+	/*2004-07-19 chy: add support of xscale MMU CacheDisabled option */
+	if (MMU_CacheDisabled) {
+		//if(1){ can be used to test cache error
+		/*get phy_addr */
+		pa = tlb_va_to_pa (tlb, real_va);
+		if (datatype == ARM_BYTE_TYPE)
+			//*data = mem_read_byte (state, pa);
+			bus_read(8, pa, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//*data = mem_read_halfword (state, pa);
+			bus_read(16, pa, data);
+		else if (datatype == ARM_WORD_TYPE)
+			//*data = mem_read_word (state, pa);
+			bus_read(32, pa, data);
+		else {
+			printf ("SKYEYE:MMU_CacheDisabled xscale_mmu_read error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+		return NO_FAULT;
+	}
+
+
+	/*search main cache */
+	cache = mmu_cache_search (state, MAIN_D_CACHE (), va);
+	if (cache) {
+		*data = cache->data[va_cache_index (va, MAIN_D_CACHE ())];
+#if 0
+//------------------------------------------------------------------------
+//chy 2003-09-02 for test only ,should commit ????
+		if (real_va >= 0xffff0000 && real_va <= 0xffff0020) {
+			pa = tlb_va_to_pa (tlb, va);
+			chyst2++;
+			printf ("**SKYEYE:mmu_read wordk:cache %d: pa %x, va %x, data %x, R15 %x\n", chyst2, pa, real_va, *data, state->Reg[15]);
+		}
+//-------------------------------------------------------------------
+#endif
+		goto datatrans;
+		//return 0;
+	}
+	//chy 2003-08-24, now maybe we don't need minidcache  ????
+#if 0
+	/*search mini cache */
+	cache = mmu_cache_search (state, MINI_D_CACHE (), va);
+	if (cache) {
+		*data = cache->data[va_cache_index (va, MINI_D_CACHE ())];
+		goto datatrans;
+		//return 0;
+	}
+#endif
+	/*get phy_addr */
+	pa = tlb_va_to_pa (tlb, va);
+	//chy 2003-08-24 , in xscale it means what ?????
+#if 0
+	if ((pa >= 0xe0000000) && (pa < 0xe8000000)) {
+
+		if (tlb_c_flag (tlb)) {
+			if (tlb_b_flag (tlb)) {
+				mmu_cache_soft_flush (state, MAIN_D_CACHE (),
+						      pa);
+			}
+			else {
+				mmu_cache_soft_flush (state, MINI_D_CACHE (),
+						      pa);
+			}
+		}
+		return 0;
+	}
+#endif
+	//chy 2003-08-24, check phy addr
+	//ywc 2004-11-30, inactive this check because of using 0xc0000000 as the framebuffer start address
+	/*
+	   if(pa >= 0xb0000000){
+	   printf("SKYEYE:xscale_mmu_read: phy address 0x%x error,reg[15] 0x%x\n",pa,state->Reg[15]);
+	   return 0;
+	   }
+	 */
+
+	//chy 2003-08-24, now maybe we don't need wb  ????
+#if 0
+	/*if Buffer, drain Write Buffer first */
+	if (tlb_b_flag (tlb))
+		mmu_wb_drain_all (state, WB ());
+#endif
+	/*alloc cache or mem_read */
+	if (tlb_c_flag (tlb) && MMU_DCacheEnabled) {
+		cache_s *cache_t;
+
+		if (tlb_b_flag (tlb))
+			cache_t = MAIN_D_CACHE ();
+		else
+			cache_t = MINI_D_CACHE ();
+		cache = mmu_cache_alloc (state, cache_t, va, pa);
+		*data = cache->data[va_cache_index (va, cache_t)];
+	}
+	else {
+		//*data = mem_read_word(state, pa);
+		if (datatype == ARM_BYTE_TYPE)
+			//*data = mem_read_byte (state, pa | (real_va & 3));
+			bus_read(8, pa | (real_va & 3), data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//*data = mem_read_halfword (state, pa | (real_va & 2));
+			bus_read(16, pa | (real_va & 2), data);
+		else if (datatype == ARM_WORD_TYPE)
+			//*data = mem_read_word (state, pa);
+			bus_read(32, pa, data);
+		else {
+			printf ("SKYEYE:2 xscale_mmu_read error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+		return NO_FAULT;
+	}
+
+
+      datatrans:
+	if (datatype == ARM_HALFWORD_TYPE) {
+		temp = *data;
+		offset = (((ARMword) state->bigendSig * 2) ^ (real_va & 2)) << 3;	/* bit offset into the word */
+		*data = (temp >> offset) & 0xffff;
+	}
+	else if (datatype == ARM_BYTE_TYPE) {
+		temp = *data;
+		offset = (((ARMword) state->bigendSig * 3) ^ (real_va & 3)) << 3;	/* bit offset into the word */
+		*data = (temp >> offset & 0xffL);
+	}
+      end:
+	return NO_FAULT;
+}
+
+
+static fault_t
+	xscale_mmu_write_byte (ARMul_State * state, ARMword virt_addr,
+			       ARMword data)
+{
+	return xscale_mmu_write (state, virt_addr, data, ARM_BYTE_TYPE);
+}
+
+static fault_t
+	xscale_mmu_write_halfword (ARMul_State * state, ARMword virt_addr,
+				   ARMword data)
+{
+	return xscale_mmu_write (state, virt_addr, data, ARM_HALFWORD_TYPE);
+}
+
+static fault_t
+	xscale_mmu_write_word (ARMul_State * state, ARMword virt_addr,
+			       ARMword data)
+{
+	return xscale_mmu_write (state, virt_addr, data, ARM_WORD_TYPE);
+}
+
+
+
+static fault_t
+	xscale_mmu_write (ARMul_State * state, ARMword va, ARMword data,
+			  ARMword datatype)
+{
+	tlb_entry_t *tlb;
+	cache_line_t *cache;
+	cache_s *cache_t;
+	int b;
+	ARMword pa, real_va, temp, offset;
+	fault_t fault;
+
+	ARMword index;
+//chy 2003-09-02 for test ????
+//      static unsigned chyst1=0,chyst2=0;
+
+	DEBUG_LOG(ARM11, "va = %x, val = %x\n", va, data);
+	va = mmu_pid_va_map (va);
+	real_va = va;
+
+	if (MMU_Disabled) {
+		//mem_write_word(state, va, data);
+		if (datatype == ARM_BYTE_TYPE)
+			//mem_write_byte (state, va, data);
+			bus_write(8, va, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//mem_write_halfword (state, va, data);
+			bus_write(16, va, data);
+		else if (datatype == ARM_WORD_TYPE)
+			//mem_write_word (state, va, data);
+			bus_write(32, va, data);
+		else {
+			printf ("SKYEYE:1 xscale_mmu_write error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+
+		return NO_FAULT;
+	}
+	/*align check */
+	if (((va & 3) && (datatype == ARM_WORD_TYPE) && MMU_Aligned) ||
+	    ((va & 1) && (datatype == ARM_HALFWORD_TYPE) && MMU_Aligned)) {
+		DEBUG_LOG(ARM11, "align\n");
+		return ALIGNMENT_FAULT;
+	}			//else
+	va &= ~(WORD_SIZE - 1);
+	/*tlb translate */
+	fault = translate (state, va, D_TLB (), &tlb);
+	if (fault) {
+		DEBUG_LOG(ARM11, "translate\n");
+		return fault;
+	}
+	/*tlb check access */
+	fault = check_access (state, va, tlb, 0);
+	if (fault) {
+		DEBUG_LOG(ARM11, "check_access\n");
+		return fault;
+	}
+
+	/*2004-07-19 chy: add support for xscale MMU_CacheDisabled */
+	if (MMU_CacheDisabled) {
+		//if(1){ can be used to test the cache error
+		/*get phy_addr */
+		pa = tlb_va_to_pa (tlb, real_va);
+		if (datatype == ARM_BYTE_TYPE)
+			//mem_write_byte (state, pa, data);
+			bus_write(8, pa, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			//mem_write_halfword (state, pa, data);
+			bus_write(16, pa, data);
+		else if (datatype == ARM_WORD_TYPE)
+			//mem_write_word (state, pa, data);
+			bus_write(32, pa , data);
+		else {
+			printf ("SKYEYE:MMU_CacheDisabled xscale_mmu_write error: unknown data type %d\n", datatype);
+			// skyeye_exit (-1);
+		}
+
+		return NO_FAULT;
+	}
+
+	/*search main cache */
+	b = tlb_b_flag (tlb);
+	pa = tlb_va_to_pa (tlb, va);
+	cache = mmu_cache_search (state, MAIN_D_CACHE (), va);
+	if (cache) {
+		cache_t = MAIN_D_CACHE ();
+		goto has_cache;
+	}
+	//chy 2003-08-24, now maybe we don't need minidcache  ????
+#if 0
+	/*search mini cache */
+	cache = mmu_cache_search (state, MINI_D_CACHE (), va);
+	if (cache) {
+		cache_t = MINI_D_CACHE ();
+		goto has_cache;
+	}
+#endif
+	b = tlb_b_flag (tlb);
+	pa = tlb_va_to_pa (tlb, va);
+	//chy 2003-08-24, check phy addr 0xa0000000, size 0x04000000
+	//ywc 2004-11-30, inactive this check because of using 0xc0000000 as the framebuffer start address
+	/*
+	   if(pa >= 0xb0000000){
+	   printf("SKYEYE:xscale_mmu_write phy address 0x%x error,reg[15] 0x%x\n",pa,state->Reg[15]);
+	   return 0;
+	   }
+	 */
+
+	//chy 2003-08-24, now maybe we don't need WB  ????
+#if 0
+	if (b) {
+		if (MMU_WBEnabled) {
+			if (datatype == ARM_WORD_TYPE)
+				mmu_wb_write_bytes (state, WB (), pa, &data,
+						    4);
+			else if (datatype == ARM_HALFWORD_TYPE)
+				mmu_wb_write_bytes (state, WB (),
+						    (pa | (real_va & 2)),
+						    &data, 2);
+			else if (datatype == ARM_BYTE_TYPE)
+				mmu_wb_write_bytes (state, WB (),
+						    (pa | (real_va & 3)),
+						    &data, 1);
+
+		}
+		else {
+			if (datatype == ARM_WORD_TYPE)
+				mem_write_word (state, pa, data);
+			else if (datatype == ARM_HALFWORD_TYPE)
+				mem_write_halfword (state,
+						    (pa | (real_va & 2)),
+						    data);
+			else if (datatype == ARM_BYTE_TYPE)
+				mem_write_byte (state, (pa | (real_va & 3)),
+						data);
+		}
+	}
+	else {
+
+		mmu_wb_drain_all (state, WB ());
+
+		if (datatype == ARM_WORD_TYPE)
+			mem_write_word (state, pa, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			mem_write_halfword (state, (pa | (real_va & 2)),
+					    data);
+		else if (datatype == ARM_BYTE_TYPE)
+			mem_write_byte (state, (pa | (real_va & 3)), data);
+	}
+#endif
+	//chy 2003-08-24, just write phy addr
+	if (datatype == ARM_WORD_TYPE)
+		//mem_write_word (state, pa, data);
+		bus_write(32, pa, data);
+	else if (datatype == ARM_HALFWORD_TYPE)
+		//mem_write_halfword (state, (pa | (real_va & 2)), data);
+		bus_write(16, pa | (real_va & 2), data);
+	else if (datatype == ARM_BYTE_TYPE)
+		//mem_write_byte (state, (pa | (real_va & 3)), data);
+		bus_write(8, (pa | (real_va & 3)), data);
+#if 0
+//-------------------------------------------------------------
+//chy 2003-09-02 for test ????
+	if (datatype == ARM_WORD_TYPE) {
+		if (real_va >= 0xffff0000 && real_va <= 0xffff0020) {
+			printf ("**SKYEYE:mmu_write word: pa %x, va %x, data %x, R15 %x \n", pa, real_va, data, state->Reg[15]);
+		}
+	}
+//--------------------------------------------------------------
+#endif
+	return NO_FAULT;
+
+      has_cache:
+	index = va_cache_index (va, cache_t);
+	//cache->data[index] = data;
+
+	if (datatype == ARM_WORD_TYPE)
+		cache->data[index] = data;
+	else if (datatype == ARM_HALFWORD_TYPE) {
+		temp = cache->data[index];
+		offset = (((ARMword) state->bigendSig * 2) ^ (real_va & 2)) << 3;	/* bit offset into the word */
+		cache->data[index] =
+			(temp & ~(0xffffL << offset)) | ((data & 0xffffL) <<
+							 offset);
+	}
+	else if (datatype == ARM_BYTE_TYPE) {
+		temp = cache->data[index];
+		offset = (((ARMword) state->bigendSig * 3) ^ (real_va & 3)) << 3;	/* bit offset into the word */
+		cache->data[index] =
+			(temp & ~(0xffL << offset)) | ((data & 0xffL) <<
+						       offset);
+	}
+
+	if (index < (cache_t->width >> (WORD_SHT + 1)))
+		cache->tag |= TAG_FIRST_HALF_DIRTY;
+	else
+		cache->tag |= TAG_LAST_HALF_DIRTY;
+//-------------------------------------------------------------
+//chy 2003-09-03 be sure the changed value will be in memory as soon as possible, so I cache can get the newest value
+#if 0
+	{
+		if (datatype == ARM_WORD_TYPE)
+			mem_write_word (state, pa, data);
+		else if (datatype == ARM_HALFWORD_TYPE)
+			mem_write_halfword (state, (pa | (real_va & 2)),
+					    data);
+		else if (datatype == ARM_BYTE_TYPE)
+			mem_write_byte (state, (pa | (real_va & 3)), data);
+	}
+#endif
+#if 0
+//chy 2003-09-02 for test ????
+	if (datatype == ARM_WORD_TYPE) {
+		if (real_va >= 0xffff0000 && real_va <= 0xffff0020) {
+			printf ("**SKYEYE:mmu_write word:cache: pa %x, va %x, data %x, R15 %x\n", pa, real_va, data, state->Reg[15]);
+		}
+	}
+//-------------------------------------------------------------
+#endif
+	if (datatype == ARM_WORD_TYPE)
+		//mem_write_word (state, pa, data);
+		bus_write(32, pa, data);
+	else if (datatype == ARM_HALFWORD_TYPE)
+		//mem_write_halfword (state, (pa | (real_va & 2)), data);
+		bus_write(16, pa | (real_va & 2), data);
+	else if (datatype == ARM_BYTE_TYPE)
+		//mem_write_byte (state, (pa | (real_va & 3)), data);
+		bus_write(8, (pa | (real_va & 3)), data);
+	return NO_FAULT;
+}
+
+ARMword xscale_cp15_mrc (ARMul_State * state,
+			 unsigned type, ARMword instr, ARMword * value)
+{
+	return xscale_mmu_mrc (state, instr, value);
+}
+
+ARMword xscale_mmu_mrc (ARMul_State * state, ARMword instr, ARMword * value)
+{
+	ARMword data;
+	unsigned opcode_2 = BITS (5, 7);
+	unsigned CRm = BITS (0, 3);
+	unsigned reg = BITS (16, 19);
+	unsigned result;
+	mmu_regnum_t creg = (mmu_regnum_t)reg;
+
+/*
+ printf("SKYEYE: xscale_cp15_mrc:opcode_2 0x%x, CRm 0x%x, reg 0x%x,reg[15] 0x%x, instr %x\n",opcode_2,CRm,reg,\
+	state->Reg[15], instr);
+*/
+	switch (creg) {
+	case MMU_ID:		//XSCALE_CP15
+		//printf("mmu_mrc read ID       \n");
+		data = (opcode_2 ? state->mmu.cache_type : state->cpu->
+			cpu_val);
+		break;
+	case MMU_CONTROL:	//XSCALE_CP15_AUX_CONTROL
+		//printf("mmu_mrc read CONTROL  \n");
+		data = (opcode_2 ? state->mmu.aux_control : state->mmu.
+			control);
+		break;
+	case MMU_TRANSLATION_TABLE_BASE:
+		//printf("mmu_mrc read TTB      \n");
+		data = state->mmu.translation_table_base;
+		break;
+	case MMU_DOMAIN_ACCESS_CONTROL:
+		//printf("mmu_mrc read DACR     \n");
+		data = state->mmu.domain_access_control;
+		break;
+	case MMU_FAULT_STATUS:
+		//printf("mmu_mrc read FSR      \n");
+		data = state->mmu.fault_status;
+		break;
+	case MMU_FAULT_ADDRESS:
+		//printf("mmu_mrc read FAR      \n");
+		data = state->mmu.fault_address;
+		break;
+	case MMU_PID:
+		//printf("mmu_mrc read PID      \n");
+		data = state->mmu.process_id;
+	case XSCALE_CP15_COPRO_ACCESS:
+		//printf("xscale cp15 read coprocessor access\n");
+		data = state->mmu.copro_access;
+		break;
+	default:
+		data = 0;
+		printf ("SKYEYE: xscale_cp15_mrc read UNKNOWN - reg %d, pc 0x%x\n", creg, state->Reg[15]);
+		// skyeye_exit (-1);
+		break;
+	}
+	*value = data;
+	//printf("SKYEYE: xscale_cp15_mrc:end value  0x%x\n",data);
+	return ARMul_DONE;
+}
+
+void xscale_cp15_cache_ops (ARMul_State * state, ARMword instr, ARMword value)
+{
+//chy: 2003-08-24 now, the BTB isn't simualted ....????
+
+	unsigned CRm, OPC_2;
+
+	CRm = BITS (0, 3);
+	OPC_2 = BITS (5, 7);
+	//err_msg("SKYEYE: xscale cp15_cache_ops:OPC_2 = 0x%x CRm = 0x%x, Reg15 0x%x\n", OPC_2, CRm,state->Reg[15]);
+
+	if (OPC_2 == 0 && CRm == 7) {
+		mmu_cache_invalidate_all (state, I_CACHE ());
+		mmu_cache_invalidate_all (state, MAIN_D_CACHE ());
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 5) {
+		mmu_cache_invalidate_all (state, I_CACHE ());
+		return;
+	}
+	if (OPC_2 == 1 && CRm == 5) {
+		mmu_cache_invalidate (state, I_CACHE (), value);
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 6) {
+		mmu_cache_invalidate_all (state, MAIN_D_CACHE ());
+		return;
+	}
+
+	if (OPC_2 == 1 && CRm == 6) {
+		mmu_cache_invalidate (state, MAIN_D_CACHE (), value);
+		return;
+	}
+
+	if (OPC_2 == 1 && CRm == 0xa) {
+		mmu_cache_clean (state, MAIN_D_CACHE (), value);
+		return;
+	}
+
+	if (OPC_2 == 4 && CRm == 0xa) {
+		mmu_wb_drain_all (state, WB ());
+		return;
+	}
+
+	if (OPC_2 == 6 && CRm == 5) {
+		//chy 2004-07-19 shoud fix in the future????!!!!
+		//printf("SKYEYE: xscale_cp15_cache_ops:invalidate BTB CANT!!!!!!!!!!\n"); 
+		//exit(-1);
+		return;
+	}
+
+	if (OPC_2 == 5 && CRm == 2) {
+		//printf("SKYEYE: cp15_c_o: A L in D C, value %x, reg15 %x\n",value, state->Reg[15]); 
+		//exit(-1);
+		//chy 2003-09-01 for test
+		mmu_cache_invalidate_all (state, MAIN_D_CACHE ());
+		return;
+	}
+
+	ERROR_LOG(ARM11, "SKYEYE: xscale cp15_cache_ops:Unknown OPC_2 = 0x%x CRm = 0x%x, Reg15 0x%x\n", OPC_2, CRm, state->Reg[15]);
+	// skyeye_exit (-1);
+}
+
+static void
+	xscale_cp15_tlb_ops (ARMul_State * state, ARMword instr,
+			     ARMword value)
+{
+	int CRm, OPC_2;
+
+	CRm = BITS (0, 3);
+	OPC_2 = BITS (5, 7);
+
+
+	//err_msg("SKYEYE:xscale_cp15_tlb_ops:OPC_2 = 0x%x CRm = 0x%x,Reg[15] 0x%x\n", OPC_2, CRm,state->Reg[15]);
+	if (OPC_2 == 0 && CRm == 0x7) {
+		mmu_tlb_invalidate_all (state, I_TLB ());
+		mmu_tlb_invalidate_all (state, D_TLB ());
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 0x5) {
+		mmu_tlb_invalidate_all (state, I_TLB ());
+		return;
+	}
+
+	if (OPC_2 == 1 && CRm == 0x5) {
+		mmu_tlb_invalidate_entry (state, I_TLB (), value);
+		return;
+	}
+
+	if (OPC_2 == 0 && CRm == 0x6) {
+		mmu_tlb_invalidate_all (state, D_TLB ());
+		return;
+	}
+
+	if (OPC_2 == 1 && CRm == 0x6) {
+		mmu_tlb_invalidate_entry (state, D_TLB (), value);
+		return;
+	}
+
+	ERROR_LOG(ARM11, "SKYEYE:xscale_cp15_tlb_ops:Unknow OPC_2 = 0x%x CRm = 0x%x,Reg[15] 0x%x\n", OPC_2, CRm, state->Reg[15]);
+	// skyeye_exit (-1);
+}
+
+
+ARMword xscale_cp15_mcr (ARMul_State * state,
+			 unsigned type, ARMword instr, ARMword value)
+{
+	return xscale_mmu_mcr (state, instr, value);
+}
+
+ARMword xscale_mmu_mcr (ARMul_State * state, ARMword instr, ARMword value)
+{
+	ARMword data;
+	unsigned opcode_2 = BITS (5, 7);
+	unsigned CRm = BITS (0, 3);
+	unsigned reg = BITS (16, 19);
+	unsigned result;
+	mmu_regnum_t creg = (mmu_regnum_t)reg;
+
+	//printf("SKYEYE: xscale_cp15_mcr: opcode_2 0x%x, CRm 0x%x, reg ox%x, value 0x%x, reg[15] 0x%x, instr 0x%x\n",opcode_2,CRm,reg, value, state->Reg[15], instr);
+
+	switch (creg) {
+	case MMU_CONTROL:
+		//printf("mmu_mcr wrote CONTROL  val 0x%x       \n",value);
+		state->mmu.control =
+			(opcode_2 ? (value & 0x33) : (value & 0x3FFF));
+		break;
+	case MMU_TRANSLATION_TABLE_BASE:
+		//printf("mmu_mcr wrote TTB      val 0x%x       \n",value);
+		state->mmu.translation_table_base = value & 0xFFFFC000;
+		break;
+	case MMU_DOMAIN_ACCESS_CONTROL:
+		//printf("mmu_mcr wrote DACR    val 0x%x \n",value);
+		state->mmu.domain_access_control = value;
+		break;
+
+	case MMU_FAULT_STATUS:
+		//printf("mmu_mcr wrote FS        val 0x%x \n",value);
+		state->mmu.fault_status = value & 0x6FF;
+		break;
+	case MMU_FAULT_ADDRESS:
+		//printf("mmu_mcr wrote FA         val 0x%x \n",value);
+		state->mmu.fault_address = value;
+		break;
+
+	case MMU_CACHE_OPS:
+//              printf("mmu_mcr wrote CO         val 0x%x \n",value);
+		xscale_cp15_cache_ops (state, instr, value);
+		break;
+	case MMU_TLB_OPS:
+		//printf("mmu_mcr wrote TO          val 0x%x \n",value);
+		xscale_cp15_tlb_ops (state, instr, value);
+		break;
+	case MMU_PID:
+		//printf("mmu_mcr wrote PID          val 0x%x \n",value);
+		state->mmu.process_id = value & 0xfe000000;
+		break;
+	case XSCALE_CP15_COPRO_ACCESS:
+		//printf("xscale cp15 write coprocessor access  val 0x %x\n",value);
+		state->mmu.copro_access = value & 0x3ff;
+		break;
+
+	default:
+		printf ("SKYEYE: xscale_cp15_mcr wrote UNKNOWN - reg %d, reg15 0x%x\n", creg, state->Reg[15]);
+		break;
+	}
+	//printf("SKYEYE: xscale_cp15_mcr wrote val 0x%x\n", value);
+	return 0;
+}
+
+//teawater add for arm2x86 2005.06.24-------------------------------------------
+static int xscale_mmu_v2p_dbct (ARMul_State * state, ARMword virt_addr,
+				ARMword * phys_addr)
+{
+	fault_t fault;
+	tlb_entry_t *tlb;
+
+	virt_addr = mmu_pid_va_map (virt_addr);
+	if (MMU_Enabled) {
+
+		/*align check */
+		if ((virt_addr & (WORD_SIZE - 1)) && MMU_Aligned) {
+			DEBUG_LOG(ARM11, "align\n");
+			return ALIGNMENT_FAULT;
+		}
+		else
+			virt_addr &= ~(WORD_SIZE - 1);
+
+		/*translate tlb */
+		fault = translate (state, virt_addr, I_TLB (), &tlb);
+		if (fault) {
+			DEBUG_LOG(ARM11, "translate\n");
+			return fault;
+		}
+
+		/*check access */
+		fault = check_access (state, virt_addr, tlb, 1);
+		if (fault) {
+			DEBUG_LOG(ARM11, "check_fault\n");
+			return fault;
+		}
+	}
+
+	if (MMU_Disabled) {
+		*phys_addr = virt_addr;
+	}
+	else {
+		*phys_addr = tlb_va_to_pa (tlb, virt_addr);
+	}
+
+	return (0);
+}
+
+//AJ2D--------------------------------------------------------------------------
+
+/*xscale mmu_ops_t*/
+//mmu_ops_t xscale_mmu_ops = {
+//	xscale_cp15_init,
+//		xscale_cp15_exit,
+//		xscale_mmu_read_byte,
+//		xscale_mmu_write_byte,
+//		xscale_mmu_read_halfword,
+//		xscale_mmu_write_halfword,
+//		xscale_mmu_read_word,
+//		xscale_mmu_write_word,
+//		xscale_mmu_load_instr, xscale_mmu_mcr, xscale_mmu_mrc,
+////teawater add for arm2x86 2005.06.24-------------------------------------------
+//		xscale_mmu_v2p_dbct,
+////AJ2D--------------------------------------------------------------------------
+//};