Index: target-sparc/op_helper.c
===================================================================
--- target-sparc/op_helper.c	(revision 7235)
+++ target-sparc/op_helper.c	(working copy)
@@ -39,6 +39,55 @@
 #endif
 #endif
 
+// Calculates TSB pointer value for fault page size 8k or 64k
+static uint64_t ultrasparc_tsb_pointer_value(uint64_t tsb_register, uint64_t tag_access_register, int page_size)
+{
+
+    uint64_t tsb_base = tsb_register & ~0x1fffULL;
+    int tsb_split = (env->dmmuregs[5] & 0x1000ULL)?1:0;
+    int tsb_size  = env->dmmuregs[5] & 0xf;
+
+    //uint64_t tag_access_context = tag_access_register & 0x1fffULL;
+    uint64_t tag_access_va = tag_access_register & ~0x1fffULL;
+
+    // now reorder bits
+    uint64_t tsb_base_mask = ~0x1fffULL;
+    uint64_t va = tag_access_va;
+
+    // move va bits to correct position
+    if (page_size == 8*1024) {
+        // VA<21+N:13> 0000
+        va >>= 9;
+    } else if (page_size == 64*1024) {
+        // VA<24+N:16> 0000
+        va >>= 12;
+    }
+
+    if (tsb_size)
+        tsb_base_mask <<= tsb_size;
+
+    // calculate tsb_base mask and adjust va if split is in use
+    if (tsb_split) {
+    //For a split TSB (TSB register split field=1):
+        if (page_size == 8*1024) {
+            //8K_POINTER = TSB_Base<63:14+N> 0 VA<21+N:13> 0000
+            va &= ~(1ULL << (13 + tsb_size));
+        } else if (page_size == 64*1024) {
+            //64K_POINTER = TSB_Base<63:14+N> 1 VA<24+N:16> 0000
+            va |= (1ULL << (13 + tsb_size));
+        }
+        tsb_base_mask <<= 1;
+    }
+
+    return ((tsb_base & tsb_base_mask) | (va & ~tsb_base_mask)) & ~0xfULL;
+}
+
+// Calculates tag target register value by reordering bits in tag access register
+static uint64_t ultrasparc_tag_target_value(uint64_t tag_access_register)
+{
+    return (((tag_access_register & 0x1fff)<<48)|(tag_access_register >> 22));
+}
+
 static inline void address_mask(CPUState *env1, target_ulong *addr)
 {
 #ifdef TARGET_SPARC64
@@ -1652,13 +1701,32 @@
         {
             int reg = (addr >> 3) & 0xf;
 
-            ret = env->immuregs[reg];
+            if (reg == 0)
+            {
+                // I-TSB Tag Target register
+                ret = ultrasparc_tag_target_value(env->immuregs[6]);
+            }
+            else
+            {
+                ret = env->immuregs[reg];
+            }
+
             break;
         }
     case 0x51: // I-MMU 8k TSB pointer
+        {
+            // env->immuregs[5] holds I-MMU TSB register value
+            // env->immuregs[6] holds I-MMU Tag Access register value
+            ret = ultrasparc_tsb_pointer_value(env->immuregs[5], env->immuregs[6], 8*1024);
+            break;
+        }
     case 0x52: // I-MMU 64k TSB pointer
-        // XXX
-        break;
+        {
+            // env->immuregs[5] holds I-MMU TSB register value
+            // env->immuregs[6] holds I-MMU Tag Access register value
+            ret = ultrasparc_tsb_pointer_value(env->immuregs[5], env->immuregs[6], 64*1024);
+            break;
+        }
     case 0x55: // I-MMU data access
         {
             int reg = (addr >> 3) & 0x3f;
@@ -1677,9 +1745,31 @@
         {
             int reg = (addr >> 3) & 0xf;
 
-            ret = env->dmmuregs[reg];
+            if (reg == 0)
+            {
+                // D-TSB Tag Target register
+                ret = ultrasparc_tag_target_value(env->dmmuregs[6]);
+            }
+            else
+            {
+                ret = env->dmmuregs[reg];
+            }
             break;
         }
+    case 0x59: // D-MMU 8k TSB pointer
+        {
+            // env->dmmuregs[5] holds D-MMU TSB register value
+            // env->dmmuregs[6] holds D-MMU Tag Access register value
+            ret = ultrasparc_tsb_pointer_value(env->dmmuregs[5], env->dmmuregs[6], 8*1024);
+            break;
+        }
+    case 0x5a: // D-MMU 64k TSB pointer
+        {
+            // env->dmmuregs[5] holds D-MMU TSB register value
+            // env->dmmuregs[6] holds D-MMU Tag Access register value
+            ret = ultrasparc_tsb_pointer_value(env->dmmuregs[5], env->dmmuregs[6], 64*1024);
+            break;
+        }
     case 0x5d: // D-MMU data access
         {
             int reg = (addr >> 3) & 0x3f;
@@ -1707,8 +1797,6 @@
     case 0x76: // E-cache tag
     case 0x7e: // E-cache tag
         break;
-    case 0x59: // D-MMU 8k TSB pointer
-    case 0x5a: // D-MMU 64k TSB pointer
     case 0x5b: // D-MMU data pointer
     case 0x48: // Interrupt dispatch, RO
     case 0x49: // Interrupt data receive
