diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index 2560b3c..1cbb58f 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -53,3 +53,4 @@ obj-y += ftlcdc200.o
 obj-y += fttsc010.o
 obj-y += ftsdc010.o
 obj-y += ftmac110.o
+obj-y += fttmr010.o
diff --git a/hw/arm/faraday_a369.c b/hw/arm/faraday_a369.c
index 71e4233..0e75b02 100644
--- a/hw/arm/faraday_a369.c
+++ b/hw/arm/faraday_a369.c
@@ -75,6 +75,14 @@ a369_board_init(QEMUMachineInitArgs *args)
         ftmac110_init(&nd_table[1], 0xC0100000, s->pic[5]);
     }
 
+    /* Timer: FTTMR010 */
+    ds = qdev_create(NULL, "fttmr010");
+    qdev_prop_set_uint32(ds, "freq", 33 * 1000000);
+    qdev_init_nofail(ds);
+    sysbus_mmio_map(SYS_BUS_DEVICE(ds), 0, 0xC0200000);
+    sysbus_connect_irq(SYS_BUS_DEVICE(ds), 1, s->pic[6]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(ds), 2, s->pic[7]);
+
     /* System start-up */
 
     if (args->kernel_filename) {
diff --git a/hw/arm/fttmr010.c b/hw/arm/fttmr010.c
new file mode 100644
index 0000000..f72a1b9
--- /dev/null
+++ b/hw/arm/fttmr010.c
@@ -0,0 +1,451 @@
+/*
+ * Faraday FTTMR010 Timer.
+ *
+ * Copyright (c) 2012 Faraday Technology
+ * Written by Dante Su <dantesu@faraday-tech.com>
+ *
+ * This code is licensed under GNU GPL v2+.
+ */
+
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+#include "sysemu/sysemu.h"
+
+#include "faraday.h"
+#include "fttmr010.h"
+
+#define TYPE_FTTMR010       "fttmr010"
+#define TYPE_FTTMR010_TIMER "fttmr010_timer"
+
+typedef struct Fttmr010State Fttmr010State;
+
+typedef struct Fttmr010Timer {
+    int id;
+    int up;
+    Fttmr010State *chip;
+    qemu_irq irq;
+    QEMUTimer *qtimer;
+    uint64_t start;
+    uint32_t intr_match1:1;
+    uint32_t intr_match2:1;
+
+    /* HW register caches */
+    uint64_t counter;
+    uint64_t reload;
+    uint32_t match1;
+    uint32_t match2;
+
+} Fttmr010Timer;
+
+struct Fttmr010State {
+    SysBusDevice busdev;
+    MemoryRegion iomem;
+    qemu_irq irq;
+    Fttmr010Timer timer[3];
+    uint32_t freq;        /* desired source clock */
+    uint64_t step;        /* get_ticks_per_sec() / freq */
+
+    /* HW register caches */
+    uint32_t cr;
+    uint32_t isr;
+    uint32_t imr;
+};
+
+#define FTTMR010(obj) \
+    OBJECT_CHECK(Fttmr010State, obj, TYPE_FTTMR010)
+
+static void fttmr010_timer_restart(Fttmr010Timer *t)
+{
+    Fttmr010State *s = t->chip;
+    uint64_t interval;
+    int pending = 0;
+
+    t->intr_match1 = 0;
+    t->intr_match2 = 0;
+
+    /* check match1 */
+    if (t->up && t->match1 <= t->counter) {
+        t->intr_match1 = 1;
+    }
+    if (!t->up && t->match1 >= t->counter) {
+        t->intr_match1 = 1;
+    }
+    if (t->match1 == t->counter) {
+        s->isr |= ISR_MATCH1(t->id);
+        ++pending;
+    }
+
+    /* check match2 */
+    if (t->up && t->match2 <= t->counter) {
+        t->intr_match2 = 1;
+    }
+    if (!t->up && t->match2 >= t->counter) {
+        t->intr_match2 = 1;
+    }
+    if (t->match2 == t->counter) {
+        s->isr |= ISR_MATCH2(t->id);
+        ++pending;
+    }
+
+    /* determine delay interval */
+    if (t->up) {
+        if ((t->match1 > t->counter) && (t->match2 > t->counter)) {
+            interval = MIN(t->match1, t->match2) - t->counter;
+        } else if (t->match1 > t->counter) {
+            interval = t->match1 - t->counter;
+        } else if (t->match2 > t->reload) {
+            interval = t->match2 - t->counter;
+        } else {
+            interval = 0xffffffffULL - t->counter;
+        }
+    } else {
+        if ((t->match1 < t->counter) && (t->match2 < t->counter)) {
+            interval = t->counter - MAX(t->match1, t->match2);
+        } else if (t->match1 < t->reload) {
+            interval = t->counter - t->match1;
+        } else if (t->match2 < t->reload) {
+            interval = t->counter - t->match2;
+        } else {
+            interval = t->counter;
+        }
+    }
+
+    if (pending) {
+        qemu_irq_pulse(s->irq);
+        qemu_irq_pulse(t->irq);
+    }
+    t->start = qemu_get_clock_ns(vm_clock);
+    qemu_mod_timer(t->qtimer, t->start + interval * s->step);
+}
+
+static uint64_t fttmr010_update_counter(Fttmr010Timer *t)
+{
+    Fttmr010State *s = t->chip;
+    uint64_t now = qemu_get_clock_ns(vm_clock);
+    uint64_t elapsed;
+    int pending = 0;
+
+    if (s->cr & CR_TMR_EN(t->id)) {
+        /* get elapsed time */
+        elapsed = (now - t->start) / s->step;
+
+        /* convert to count-up/count-down value */
+        if (t->up) {
+            t->counter = t->counter + elapsed;
+        } else {
+            if (t->counter > elapsed) {
+                t->counter -= elapsed;
+            } else {
+                t->counter = 0;
+            }
+        }
+        t->start = now;
+
+        /* check match1 */
+        if (!t->intr_match1) {
+            if (t->up && t->match1 <= t->counter) {
+                t->intr_match1 = 1;
+                s->isr |= ISR_MATCH1(t->id);
+                ++pending;
+            }
+            if (!t->up && t->match1 >= t->counter) {
+                t->intr_match1 = 1;
+                s->isr |= ISR_MATCH1(t->id);
+                ++pending;
+            }
+        }
+
+        /* check match2 */
+        if (!t->intr_match2) {
+            if (t->up && t->match2 <= t->counter) {
+                t->intr_match2 = 1;
+                s->isr |= ISR_MATCH2(t->id);
+                ++pending;
+            }
+            if (!t->up && t->match2 >= t->counter) {
+                t->intr_match2 = 1;
+                s->isr |= ISR_MATCH2(t->id);
+                ++pending;
+            }
+        }
+
+        /* check overflow/underflow */
+        if (t->up && t->counter >= 0xffffffffULL) {
+            if (s->cr & CR_TMR_OFEN(t->id)) {
+                s->isr |= ISR_OF(t->id);
+                ++pending;
+            }
+            t->counter = t->reload;
+            fttmr010_timer_restart(t);
+        }
+        if (!t->up && t->counter == 0) {
+            if (s->cr & CR_TMR_OFEN(t->id)) {
+                s->isr |= ISR_OF(t->id);
+                ++pending;
+            }
+            t->counter = t->reload;
+            fttmr010_timer_restart(t);
+        }
+    }
+
+    if (pending) {
+        qemu_irq_pulse(s->irq);
+        qemu_irq_pulse(t->irq);
+    }
+
+    return t->counter;
+}
+
+static uint64_t
+fttmr010_mem_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Fttmr010State *s = FTTMR010(opaque);
+    Fttmr010Timer *t;
+    uint64_t ret = 0;
+
+    switch (addr) {
+    case REG_TMR_BASE(0) ... REG_TMR_BASE(2) + 0x0C:
+        t = s->timer + REG_TMR_ID(addr);
+        switch (addr & 0x0f) {
+        case REG_TMR_COUNTER:
+            return fttmr010_update_counter(t);
+        case REG_TMR_RELOAD:
+            return t->reload;
+        case REG_TMR_MATCH1:
+            return t->match1;
+        case REG_TMR_MATCH2:
+            return t->match2;
+        }
+        break;
+    case REG_CR:
+        return s->cr;
+    case REG_ISR:
+        return s->isr;
+    case REG_IMR:
+        return s->imr;
+    case REG_REVR:
+        return 0x00010801;  /* rev. 1.8.1 */
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "fttmr010: undefined memory access@%#" HWADDR_PRIx "\n", addr);
+        break;
+    }
+
+    return ret;
+}
+
+static void
+fttmr010_mem_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    Fttmr010State *s = FTTMR010(opaque);
+    Fttmr010Timer *t;
+    int i;
+
+    switch (addr) {
+    case REG_TMR_BASE(0) ... REG_TMR_BASE(2) + 0x0C:
+        t = s->timer + REG_TMR_ID(addr);
+        switch (addr & 0x0f) {
+        case REG_TMR_COUNTER:
+            t->counter = (uint32_t)val;
+            break;
+        case REG_TMR_RELOAD:
+            t->reload = (uint32_t)val;
+            break;
+        case REG_TMR_MATCH1:
+            t->match1 = (uint32_t)val;
+            break;
+        case REG_TMR_MATCH2:
+            t->match2 = (uint32_t)val;
+            break;
+        }
+        break;
+    case REG_CR:
+        s->cr = (uint32_t)val;
+        for (i = 0; i < 3; ++i) {
+            t = s->timer + i;
+            if (s->cr & CR_TMR_COUNTUP(t->id)) {
+                t->up = 1;
+            } else {
+                t->up = 0;
+            }
+            if (s->cr & CR_TMR_EN(t->id)) {
+                fttmr010_timer_restart(t);
+            } else {
+                qemu_del_timer(t->qtimer);
+            }
+        }
+        break;
+    case REG_ISR:
+        s->isr &= ~((uint32_t)val);
+        break;
+    case REG_IMR:
+        s->imr = (uint32_t)val;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "fttmr010: undefined memory access@%#" HWADDR_PRIx "\n", addr);
+        break;
+    }
+}
+
+static const MemoryRegionOps mmio_ops = {
+    .read  = fttmr010_mem_read,
+    .write = fttmr010_mem_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
+static void fttmr010_timer_tick(void *opaque)
+{
+    Fttmr010Timer *t = opaque;
+    Fttmr010State *s = t->chip;
+    uint64_t now;
+
+    /* if the timer has been enabled/started */
+    if (!(s->cr & CR_TMR_EN(t->id))) {
+        return;
+    }
+
+    fttmr010_update_counter(t);
+
+    if (t->reload == t->counter) {
+        return;
+    }
+
+    now = qemu_get_clock_ns(vm_clock);
+
+    if (t->up) {
+        if (!t->intr_match1 && t->match1 > t->counter) {
+            qemu_mod_timer(t->qtimer,
+                now + (t->match1 - t->counter) * s->step);
+        } else if (!t->intr_match2 && t->match2 > t->counter) {
+            qemu_mod_timer(t->qtimer,
+                now + (t->match2 - t->counter) * s->step);
+        } else {
+            qemu_mod_timer(t->qtimer,
+                now + (0xffffffffULL - t->counter) * s->step);
+        }
+    } else {
+        if (!t->intr_match1 && t->match1 < t->counter) {
+            qemu_mod_timer(t->qtimer,
+                now + (t->counter - t->match1) * s->step);
+        } else if (!t->intr_match2 && t->match2 < t->counter) {
+            qemu_mod_timer(t->qtimer,
+                now + (t->counter - t->match2) * s->step);
+        } else {
+            qemu_mod_timer(t->qtimer,
+                now + t->counter * s->step);
+        }
+    }
+}
+
+static void fttmr010_reset(DeviceState *ds)
+{
+    Fttmr010State *s = FTTMR010(SYS_BUS_DEVICE(ds));
+    int i;
+
+    s->cr  = 0;
+    s->isr = 0;
+    s->imr = 0;
+    qemu_irq_lower(s->irq);
+
+    for (i = 0; i < 3; ++i) {
+        s->timer[i].counter = 0;
+        s->timer[i].reload  = 0;
+        s->timer[i].match1  = 0;
+        s->timer[i].match2  = 0;
+        qemu_irq_lower(s->timer[i].irq);
+        qemu_del_timer(s->timer[i].qtimer);
+    }
+}
+
+static int fttmr010_init(SysBusDevice *dev)
+{
+    Fttmr010State *s = FTTMR010(dev);
+    int i;
+
+    s->step = (uint64_t)get_ticks_per_sec() / (uint64_t)s->freq;
+
+    DPRINTF("fttmr010 freq=%d\n", s->freq);
+
+    memory_region_init_io(&s->iomem,
+                          &mmio_ops,
+                          s,
+                          TYPE_FTTMR010,
+                          0x1000);
+    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_irq(dev, &s->irq);
+    for (i = 0; i < 3; ++i) {
+        s->timer[i].id = i;
+        s->timer[i].chip = s;
+        s->timer[i].qtimer = qemu_new_timer_ns(vm_clock,
+                                        fttmr010_timer_tick, &s->timer[i]);
+        sysbus_init_irq(dev, &s->timer[i].irq);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_fttmr010_timer = {
+    .name = TYPE_FTTMR010_TIMER,
+    .version_id = 2,
+    .minimum_version_id = 2,
+    .minimum_version_id_old = 2,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64(counter, Fttmr010Timer),
+        VMSTATE_UINT64(reload, Fttmr010Timer),
+        VMSTATE_UINT32(match1, Fttmr010Timer),
+        VMSTATE_UINT32(match2, Fttmr010Timer),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static const VMStateDescription vmstate_fttmr010 = {
+    .name = TYPE_FTTMR010,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(cr, Fttmr010State),
+        VMSTATE_UINT32(isr, Fttmr010State),
+        VMSTATE_UINT32(imr, Fttmr010State),
+        VMSTATE_STRUCT_ARRAY(timer, Fttmr010State, 3, 1,
+                        vmstate_fttmr010_timer, Fttmr010Timer),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static Property fttmr010_properties[] = {
+    DEFINE_PROP_UINT32("freq", Fttmr010State, freq, 66000000),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void fttmr010_class_init(ObjectClass *klass, void *data)
+{
+    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    k->init     = fttmr010_init;
+    dc->vmsd    = &vmstate_fttmr010;
+    dc->props   = fttmr010_properties;
+    dc->reset   = fttmr010_reset;
+    dc->no_user = 1;
+}
+
+static const TypeInfo fttmr010_info = {
+    .name          = TYPE_FTTMR010,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Fttmr010State),
+    .class_init    = fttmr010_class_init,
+};
+
+static void fttmr010_register_types(void)
+{
+    type_register_static(&fttmr010_info);
+}
+
+type_init(fttmr010_register_types)
diff --git a/hw/arm/fttmr010.h b/hw/arm/fttmr010.h
new file mode 100644
index 0000000..39a5c4a
--- /dev/null
+++ b/hw/arm/fttmr010.h
@@ -0,0 +1,41 @@
+/*
+ * Faraday FTTMR010 Timer.
+ *
+ * Copyright (c) 2012 Faraday Technology
+ * Written by Dante Su <dantesu@faraday-tech.com>
+ *
+ * This code is licensed under GNU GPL v2+.
+ */
+
+#ifndef HW_ARM_FTTMR010_H
+#define HW_ARM_FTTMR010_H
+
+#include "qemu/bitops.h"
+
+#define REG_TMR_ID(off)     ((off) >> 4)
+#define REG_TMR_BASE(id)    (0x00 + ((id) << 4))
+#define REG_TMR_COUNTER     0x00
+#define REG_TMR_RELOAD      0x04
+#define REG_TMR_MATCH1      0x08
+#define REG_TMR_MATCH2      0x0C
+
+#define REG_CR              0x30    /* control register */
+#define REG_ISR             0x34    /* interrupt status register */
+#define REG_IMR             0x38    /* interrupt mask register */
+#define REG_REVR            0x3C    /* revision register */
+
+/* timer enable */
+#define CR_TMR_EN(id)       (0x01 << ((id) * 3))
+/* timer overflow interrupt enable */
+#define CR_TMR_OFEN(id)     (0x04 << ((id) * 3))
+/* timer count-up mode */
+#define CR_TMR_COUNTUP(id)  (0x01 << (9 + (id)))
+
+/* timer match 1 */
+#define ISR_MATCH1(id)      (0x01 << ((id) * 3))
+/* timer match 2 */
+#define ISR_MATCH2(id)      (0x02 << ((id) * 3))
+/* timer overflow */
+#define ISR_OF(id)          (0x04 << ((id) * 3))
+
+#endif
