diff --git a/exec.c b/exec.c
index bf2d82b..1d94ec1 100644
--- a/exec.c
+++ b/exec.c
@@ -64,6 +64,8 @@
 
 #if defined(TARGET_SPARC64)
 #define TARGET_PHYS_ADDR_SPACE_BITS 41
+#elif defined(TARGET_SPARC)
+#define TARGET_PHYS_ADDR_SPACE_BITS 36
 #elif defined(TARGET_ALPHA)
 #define TARGET_PHYS_ADDR_SPACE_BITS 42
 #define TARGET_VIRT_ADDR_SPACE_BITS 42
diff --git a/hw/esp.c b/hw/esp.c
index 88d74c9..65feaea 100644
--- a/hw/esp.c
+++ b/hw/esp.c
@@ -562,7 +562,8 @@
     s->scsi_dev[id] = scsi_disk_init(bd, 0, esp_command_complete, s);
 }
 
-void *esp_init(BlockDriverState **bd, uint32_t espaddr, void *dma_opaque)
+void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
+               void *dma_opaque)
 {
     ESPState *s;
     int esp_io_memory;
diff --git a/hw/fdc.c b/hw/fdc.c
index d89b226..ca2d320 100644
--- a/hw/fdc.c
+++ b/hw/fdc.c
@@ -370,7 +370,7 @@
     /* HW */
     qemu_irq irq;
     int dma_chann;
-    uint32_t io_base;
+    target_phys_addr_t io_base;
     /* Controller state */
     QEMUTimer *result_timer;
     uint8_t state;
@@ -464,13 +464,13 @@
 
 static uint32_t fdctrl_read_mem (void *opaque, target_phys_addr_t reg)
 {
-    return fdctrl_read(opaque, reg);
+    return fdctrl_read(opaque, (uint32_t)reg);
 }
 
 static void fdctrl_write_mem (void *opaque, 
                               target_phys_addr_t reg, uint32_t value)
 {
-    fdctrl_write(opaque, reg, value);
+    fdctrl_write(opaque, (uint32_t)reg, value);
 }
 
 static CPUReadMemoryFunc *fdctrl_mem_read[3] = {
@@ -579,7 +579,7 @@
 }
 
 fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped, 
-                       uint32_t io_base,
+                       target_phys_addr_t io_base,
                        BlockDriverState **fds)
 {
     fdctrl_t *fdctrl;
@@ -613,10 +613,14 @@
         io_mem = cpu_register_io_memory(0, fdctrl_mem_read, fdctrl_mem_write, fdctrl);
         cpu_register_physical_memory(io_base, 0x08, io_mem);
     } else {
-        register_ioport_read(io_base + 0x01, 5, 1, &fdctrl_read, fdctrl);
-        register_ioport_read(io_base + 0x07, 1, 1, &fdctrl_read, fdctrl);
-        register_ioport_write(io_base + 0x01, 5, 1, &fdctrl_write, fdctrl);
-        register_ioport_write(io_base + 0x07, 1, 1, &fdctrl_write, fdctrl);
+        register_ioport_read((uint32_t)io_base + 0x01, 5, 1, &fdctrl_read,
+                             fdctrl);
+        register_ioport_read((uint32_t)io_base + 0x07, 1, 1, &fdctrl_read,
+                             fdctrl);
+        register_ioport_write((uint32_t)io_base + 0x01, 5, 1, &fdctrl_write,
+                              fdctrl);
+        register_ioport_write((uint32_t)io_base + 0x07, 1, 1, &fdctrl_write,
+                              fdctrl);
     }
     register_savevm("fdc", io_base, 1, fdc_save, fdc_load, fdctrl);
     qemu_register_reset(fdctrl_external_reset, fdctrl);
diff --git a/hw/iommu.c b/hw/iommu.c
index 5c2768c..082451f 100644
--- a/hw/iommu.c
+++ b/hw/iommu.c
@@ -87,15 +87,15 @@
 #define PAGE_MASK	(PAGE_SIZE - 1)
 
 typedef struct IOMMUState {
-    uint32_t addr;
+    target_phys_addr_t addr;
     uint32_t regs[IOMMU_NREGS];
-    uint32_t iostart;
+    target_phys_addr_t iostart;
 } IOMMUState;
 
 static uint32_t iommu_mem_readw(void *opaque, target_phys_addr_t addr)
 {
     IOMMUState *s = opaque;
-    uint32_t saddr;
+    target_phys_addr_t saddr;
 
     saddr = (addr - s->addr) >> 2;
     switch (saddr) {
@@ -110,7 +110,7 @@
 static void iommu_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     IOMMUState *s = opaque;
-    uint32_t saddr;
+    target_phys_addr_t saddr;
 
     saddr = (addr - s->addr) >> 2;
     DPRINTF("write reg[%d] = %x\n", saddr, val);
@@ -118,32 +118,32 @@
     case IOMMU_CTRL:
 	switch (val & IOMMU_CTRL_RNGE) {
 	case IOMMU_RNGE_16MB:
-	    s->iostart = 0xff000000;
+	    s->iostart = 0xffffffffff000000ULL;
 	    break;
 	case IOMMU_RNGE_32MB:
-	    s->iostart = 0xfe000000;
+	    s->iostart = 0xfffffffffe000000ULL;
 	    break;
 	case IOMMU_RNGE_64MB:
-	    s->iostart = 0xfc000000;
+	    s->iostart = 0xfffffffffc000000ULL;
 	    break;
 	case IOMMU_RNGE_128MB:
-	    s->iostart = 0xf8000000;
+	    s->iostart = 0xfffffffff8000000ULL;
 	    break;
 	case IOMMU_RNGE_256MB:
-	    s->iostart = 0xf0000000;
+	    s->iostart = 0xfffffffff0000000ULL;
 	    break;
 	case IOMMU_RNGE_512MB:
-	    s->iostart = 0xe0000000;
+	    s->iostart = 0xffffffffe0000000ULL;
 	    break;
 	case IOMMU_RNGE_1GB:
-	    s->iostart = 0xc0000000;
+	    s->iostart = 0xffffffffc0000000ULL;
 	    break;
 	default:
 	case IOMMU_RNGE_2GB:
-	    s->iostart = 0x80000000;
+	    s->iostart = 0xffffffff80000000ULL;
 	    break;
 	}
-	DPRINTF("iostart = %x\n", s->iostart);
+	DPRINTF("iostart = %llx\n", s->iostart);
 	s->regs[saddr] = ((val & IOMMU_CTRL_MASK) | IOMMU_VERSION);
 	break;
     case IOMMU_BASE:
@@ -186,7 +186,7 @@
     iommu_mem_writew,
 };
 
-static uint32_t iommu_page_get_flags(IOMMUState *s, uint32_t addr)
+static uint32_t iommu_page_get_flags(IOMMUState *s, target_phys_addr_t addr)
 {
     uint32_t iopte;
 
@@ -196,21 +196,27 @@
     return ldl_phys(iopte);
 }
 
-static uint32_t iommu_translate_pa(IOMMUState *s, uint32_t addr, uint32_t pa)
+static target_phys_addr_t iommu_translate_pa(IOMMUState *s,
+                                             target_phys_addr_t addr,
+                                             uint32_t pte)
 {
     uint32_t tmppte;
+    target_phys_addr_t pa;
 
-    tmppte = pa;
-    pa = ((pa & IOPTE_PAGE) << 4) + (addr & PAGE_MASK);
-    DPRINTF("xlate dva %x => pa %x (iopte = %x)\n", addr, pa, tmppte);
+    tmppte = pte;
+    pa = ((pte & IOPTE_PAGE) << 4) + (addr & PAGE_MASK);
+    DPRINTF("xlate dva " TARGET_FMT_plx " => pa " TARGET_FMT_plx
+            " (iopte = %x)\n", addr, pa, tmppte);
+
     return pa;
 }
 
 void sparc_iommu_memory_rw(void *opaque, target_phys_addr_t addr,
                            uint8_t *buf, int len, int is_write)
 {
-    int l, flags;
-    target_ulong page, phys_addr;
+    int l;
+    uint32_t flags;
+    target_phys_addr_t page, phys_addr;
 
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
@@ -239,10 +245,9 @@
     IOMMUState *s = opaque;
     int i;
     
-    qemu_put_be32s(f, &s->addr);
     for (i = 0; i < IOMMU_NREGS; i++)
 	qemu_put_be32s(f, &s->regs[i]);
-    qemu_put_be32s(f, &s->iostart);
+    qemu_put_be64s(f, &s->iostart);
 }
 
 static int iommu_load(QEMUFile *f, void *opaque, int version_id)
@@ -250,13 +255,12 @@
     IOMMUState *s = opaque;
     int i;
     
-    if (version_id != 1)
+    if (version_id != 2)
         return -EINVAL;
 
-    qemu_get_be32s(f, &s->addr);
     for (i = 0; i < IOMMU_NREGS; i++)
 	qemu_put_be32s(f, &s->regs[i]);
-    qemu_get_be32s(f, &s->iostart);
+    qemu_get_be64s(f, &s->iostart);
 
     return 0;
 }
@@ -270,7 +274,7 @@
     s->regs[0] = IOMMU_VERSION;
 }
 
-void *iommu_init(uint32_t addr)
+void *iommu_init(target_phys_addr_t addr)
 {
     IOMMUState *s;
     int iommu_io_memory;
@@ -284,7 +288,7 @@
     iommu_io_memory = cpu_register_io_memory(0, iommu_mem_read, iommu_mem_write, s);
     cpu_register_physical_memory(addr, IOMMU_NREGS * 4, iommu_io_memory);
     
-    register_savevm("iommu", addr, 1, iommu_save, iommu_load, s);
+    register_savevm("iommu", addr, 2, iommu_save, iommu_load, s);
     qemu_register_reset(iommu_reset, s);
     return s;
 }
diff --git a/hw/m48t59.c b/hw/m48t59.c
index e9fb090..cda28c2 100644
--- a/hw/m48t59.c
+++ b/hw/m48t59.c
@@ -43,7 +43,7 @@
     /* Hardware parameters */
     qemu_irq IRQ;
     int mem_index;
-    uint32_t mem_base;
+    target_phys_addr_t mem_base;
     uint32_t io_base;
     uint16_t size;
     /* RTC management */
@@ -610,12 +610,12 @@
 }
 
 /* Initialisation routine */
-m48t59_t *m48t59_init (qemu_irq IRQ, target_ulong mem_base,
+m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,
                        uint32_t io_base, uint16_t size,
                        int type)
 {
     m48t59_t *s;
-    target_ulong save_base;
+    target_phys_addr_t save_base;
 
     s = qemu_mallocz(sizeof(m48t59_t));
     if (!s)
diff --git a/hw/m48t59.h b/hw/m48t59.h
index df383e9..cfe9b2a 100644
--- a/hw/m48t59.h
+++ b/hw/m48t59.h
@@ -6,7 +6,7 @@
 void m48t59_write (m48t59_t *NVRAM, uint32_t addr, uint32_t val);
 uint32_t m48t59_read (m48t59_t *NVRAM, uint32_t addr);
 void m48t59_toggle_lock (m48t59_t *NVRAM, int lock);
-m48t59_t *m48t59_init (qemu_irq IRQ, target_ulong mem_base,
+m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,
                        uint32_t io_base, uint16_t size,
                        int type);
 
diff --git a/hw/pcnet.c b/hw/pcnet.c
index f2130d7..12d9734 100644
--- a/hw/pcnet.c
+++ b/hw/pcnet.c
@@ -2018,7 +2018,8 @@
     (CPUWriteMemoryFunc *)&pcnet_ioport_writew,
 };
 
-void *lance_init(NICInfo *nd, uint32_t leaddr, void *dma_opaque, qemu_irq irq)
+void *lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
+                 qemu_irq irq)
 {
     PCNetState *d;
     int lance_io_memory;
diff --git a/hw/slavio_intctl.c b/hw/slavio_intctl.c
index 0c1eb58..94a6c96 100644
--- a/hw/slavio_intctl.c
+++ b/hw/slavio_intctl.c
@@ -371,7 +371,7 @@
     s->cpu_envs[cpu] = env;
 }
 
-void *slavio_intctl_init(uint32_t addr, uint32_t addrg,
+void *slavio_intctl_init(target_phys_addr_t addr, target_phys_addr_t addrg,
                          const uint32_t *intbit_to_level,
                          qemu_irq **irq)
 {
diff --git a/hw/slavio_misc.c b/hw/slavio_misc.c
index 9e7629e..1007238 100644
--- a/hw/slavio_misc.c
+++ b/hw/slavio_misc.c
@@ -212,7 +212,8 @@
     return 0;
 }
 
-void *slavio_misc_init(uint32_t base, qemu_irq irq)
+void *slavio_misc_init(target_phys_addr_t base, target_phys_addr_t power_base,
+                       qemu_irq irq)
 {
     int slavio_misc_io_memory;
     MiscState *s;
@@ -235,7 +236,7 @@
     // System control
     cpu_register_physical_memory(base + 0x1f00000, MISC_MAXADDR, slavio_misc_io_memory);
     // Power management
-    cpu_register_physical_memory(base + 0xa000000, MISC_MAXADDR, slavio_misc_io_memory);
+    cpu_register_physical_memory(power_base, MISC_MAXADDR, slavio_misc_io_memory);
 
     s->irq = irq;
 
diff --git a/hw/slavio_serial.c b/hw/slavio_serial.c
index 0e3a622..3da40eb 100644
--- a/hw/slavio_serial.c
+++ b/hw/slavio_serial.c
@@ -587,8 +587,8 @@
 
 }
 
-SerialState *slavio_serial_init(int base, qemu_irq irq, CharDriverState *chr1,
-                                CharDriverState *chr2)
+SerialState *slavio_serial_init(target_phys_addr_t base, qemu_irq irq,
+                                CharDriverState *chr1, CharDriverState *chr2)
 {
     int slavio_serial_io_memory, i;
     SerialState *s;
@@ -704,7 +704,7 @@
     put_queue(s, 0);
 }
 
-void slavio_serial_ms_kbd_init(int base, qemu_irq irq)
+void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq)
 {
     int slavio_serial_io_memory, i;
     SerialState *s;
diff --git a/hw/slavio_timer.c b/hw/slavio_timer.c
index 9114858..1147704 100644
--- a/hw/slavio_timer.c
+++ b/hw/slavio_timer.c
@@ -264,8 +264,8 @@
     slavio_timer_irq(s);
 }
 
-void slavio_timer_init(uint32_t addr, int irq, int mode, unsigned int cpu,
-                       void *intctl)
+void slavio_timer_init(target_phys_addr_t addr, int irq, int mode,
+                       unsigned int cpu, void *intctl)
 {
     int slavio_timer_io_memory;
     SLAVIO_TIMERState *s;
diff --git a/hw/sparc32_dma.c b/hw/sparc32_dma.c
index 8480c8d..e1baee8 100644
--- a/hw/sparc32_dma.c
+++ b/hw/sparc32_dma.c
@@ -249,8 +249,8 @@
     return 0;
 }
 
-void *sparc32_dma_init(uint32_t daddr, qemu_irq espirq, qemu_irq leirq,
-                       void *iommu)
+void *sparc32_dma_init(target_phys_addr_t daddr, qemu_irq espirq,
+                       qemu_irq leirq, void *iommu)
 {
     DMAState *s;
     int dma_io_memory;
diff --git a/hw/sun4m.c b/hw/sun4m.c
index ec195de..313e5b4 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -48,11 +48,11 @@
 #define MAX_CPUS 16
 
 struct hwdef {
-    target_ulong iommu_base, slavio_base;
-    target_ulong intctl_base, counter_base, nvram_base, ms_kb_base, serial_base;
-    target_ulong fd_base;
-    target_ulong dma_base, esp_base, le_base;
-    target_ulong tcx_base, cs_base;
+    target_phys_addr_t iommu_base, slavio_base;
+    target_phys_addr_t intctl_base, counter_base, nvram_base, ms_kb_base;
+    target_phys_addr_t serial_base, fd_base;
+    target_phys_addr_t dma_base, esp_base, le_base;
+    target_phys_addr_t tcx_base, cs_base, power_base;
     long vram_size, nvram_size;
     // IRQ numbers are not PIL ones, but master interrupt controller register
     // bit numbers
@@ -289,7 +289,7 @@
 
     iommu = iommu_init(hwdef->iommu_base);
     slavio_intctl = slavio_intctl_init(hwdef->intctl_base,
-                                       hwdef->intctl_base + 0x10000,
+                                       hwdef->intctl_base + 0x10000ULL,
                                        &hwdef->intbit_to_level[0],
                                        &slavio_irq);
     for(i = 0; i < smp_cpus; i++) {
@@ -317,10 +317,11 @@
     nvram = m48t59_init(slavio_irq[0], hwdef->nvram_base, 0,
                         hwdef->nvram_size, 8);
     for (i = 0; i < MAX_CPUS; i++) {
-        slavio_timer_init(hwdef->counter_base + i * TARGET_PAGE_SIZE,
+        slavio_timer_init(hwdef->counter_base +
+                          (target_phys_addr_t)(i * TARGET_PAGE_SIZE),
                           hwdef->clock_irq, 0, i, slavio_intctl);
     }
-    slavio_timer_init(hwdef->counter_base + 0x10000, hwdef->clock1_irq, 2,
+    slavio_timer_init(hwdef->counter_base + 0x10000ULL, hwdef->clock1_irq, 2,
                       (unsigned int)-1, slavio_intctl);
     slavio_serial_ms_kbd_init(hwdef->ms_kb_base, slavio_irq[hwdef->ms_kb_irq]);
     // Slavio TTYA (base+4, Linux ttyS0) is the first Qemu serial device
@@ -336,9 +337,9 @@
         }
     }
 
-    slavio_misc = slavio_misc_init(hwdef->slavio_base, 
+    slavio_misc = slavio_misc_init(hwdef->slavio_base, hwdef->power_base,
                                    slavio_irq[hwdef->me_irq]);
-    if (hwdef->cs_base != (target_ulong)-1)
+    if (hwdef->cs_base != (target_phys_addr_t)-1)
         cs_init(hwdef->cs_base, hwdef->cs_irq, slavio_intctl);
     sparc32_dma_set_reset_data(dma, main_esp, main_lance);
 }
@@ -424,6 +425,7 @@
         .dma_base     = 0x78400000,
         .esp_base     = 0x78800000,
         .le_base      = 0x78c00000,
+        .power_base   = 0x7a000000,
         .vram_size    = 0x00100000,
         .nvram_size   = 0x2000,
         .esp_irq = 18,
@@ -443,19 +445,20 @@
     },
     /* SS-10 */
     {
-        .iommu_base   = 0xe0000000, // XXX Actually at 0xfe0000000ULL (36 bits)
-        .tcx_base     = 0x20000000, // 0xe20000000ULL,
+        .iommu_base   = 0xfe0000000ULL,
+        .tcx_base     = 0xe20000000ULL,
         .cs_base      = -1,
-        .slavio_base  = 0xf0000000, // 0xff0000000ULL,
-        .ms_kb_base   = 0xf1000000, // 0xff1000000ULL,
-        .serial_base  = 0xf1100000, // 0xff1100000ULL,
-        .nvram_base   = 0xf1200000, // 0xff1200000ULL,
-        .fd_base      = 0xf1700000, // 0xff1700000ULL,
-        .counter_base = 0xf1300000, // 0xff1300000ULL,
-        .intctl_base  = 0xf1400000, // 0xff1400000ULL,
-        .dma_base     = 0xf0400000, // 0xef0400000ULL,
-        .esp_base     = 0xf0800000, // 0xef0800000ULL,
-        .le_base      = 0xf0c00000, // 0xef0c00000ULL,
+        .slavio_base  = 0xff0000000ULL,
+        .ms_kb_base   = 0xff1000000ULL,
+        .serial_base  = 0xff1100000ULL,
+        .nvram_base   = 0xff1200000ULL,
+        .fd_base      = 0xff1700000ULL,
+        .counter_base = 0xff1300000ULL,
+        .intctl_base  = 0xff1400000ULL,
+        .dma_base     = 0xef0400000ULL,
+        .esp_base     = 0xef0800000ULL,
+        .le_base      = 0xef0c00000ULL,
+        .power_base   = 0xefa000000ULL,
         .vram_size    = 0x00100000,
         .nvram_size   = 0x2000,
         .esp_irq = 18,
@@ -480,9 +483,10 @@
                               const char *initrd_filename, const char *cpu_model,
                               unsigned int machine, int max_ram)
 {
-    if (ram_size > max_ram) {
+    if ((unsigned int)ram_size > (unsigned int)max_ram) {
         fprintf(stderr, "qemu: Too much memory for this machine: %d, maximum %d\n",
-                ram_size / (1024 * 1024), max_ram / (1024 * 1024));
+                (unsigned int)ram_size / (1024 * 1024),
+                (unsigned int)max_ram / (1024 * 1024));
         exit(1);
     }
     sun4m_hw_init(&hwdefs[machine], ram_size, ds, cpu_model);
@@ -515,7 +519,7 @@
         cpu_model = "TI SuperSparc II";
     sun4m_common_init(ram_size, boot_device, ds, kernel_filename,
                       kernel_cmdline, initrd_filename, cpu_model,
-                      1, 0x20000000); // XXX tcx overlap, actually first 4GB ok
+                      1, PROM_ADDR); // XXX prom overlap, actually first 4GB ok
 }
 
 QEMUMachine ss5_machine = {
diff --git a/hw/tcx.c b/hw/tcx.c
index 326f458..80d60ba 100644
--- a/hw/tcx.c
+++ b/hw/tcx.c
@@ -31,7 +31,7 @@
 #define TCX_TEC_NREGS    0x1000
 
 typedef struct TCXState {
-    uint32_t addr;
+    target_phys_addr_t addr;
     DisplayState *ds;
     uint8_t *vram;
     uint32_t *vram24, *cplane;
@@ -359,7 +359,6 @@
 {
     TCXState *s = opaque;
     
-    qemu_put_be32s(f, (uint32_t *)&s->addr);
     qemu_put_be32s(f, (uint32_t *)&s->vram);
     qemu_put_be32s(f, (uint32_t *)&s->vram24);
     qemu_put_be32s(f, (uint32_t *)&s->cplane);
@@ -377,10 +376,9 @@
 {
     TCXState *s = opaque;
     
-    if (version_id != 2)
+    if (version_id != 3)
         return -EINVAL;
 
-    qemu_get_be32s(f, (uint32_t *)&s->addr);
     qemu_get_be32s(f, (uint32_t *)&s->vram);
     qemu_get_be32s(f, (uint32_t *)&s->vram24);
     qemu_get_be32s(f, (uint32_t *)&s->cplane);
@@ -492,7 +490,7 @@
     tcx_dummy_writel,
 };
 
-void tcx_init(DisplayState *ds, uint32_t addr, uint8_t *vram_base,
+void tcx_init(DisplayState *ds, target_phys_addr_t addr, uint8_t *vram_base,
               unsigned long vram_offset, int vram_size, int width, int height,
               int depth)
 {
@@ -513,23 +511,23 @@
     // 8-bit plane
     s->vram = vram_base;
     size = vram_size;
-    cpu_register_physical_memory(addr + 0x00800000, size, vram_offset);
+    cpu_register_physical_memory(addr + 0x00800000ULL, size, vram_offset);
     vram_offset += size;
     vram_base += size;
 
     io_memory = cpu_register_io_memory(0, tcx_dac_read, tcx_dac_write, s);
-    cpu_register_physical_memory(addr + 0x00200000, TCX_DAC_NREGS, io_memory);
+    cpu_register_physical_memory(addr + 0x00200000ULL, TCX_DAC_NREGS, io_memory);
 
     dummy_memory = cpu_register_io_memory(0, tcx_dummy_read, tcx_dummy_write,
                                           s);
-    cpu_register_physical_memory(addr + 0x00700000, TCX_TEC_NREGS,
+    cpu_register_physical_memory(addr + 0x00700000ULL, TCX_TEC_NREGS,
                                  dummy_memory);
     if (depth == 24) {
         // 24-bit plane
         size = vram_size * 4;
         s->vram24 = (uint32_t *)vram_base;
         s->vram24_offset = vram_offset;
-        cpu_register_physical_memory(addr + 0x02000000, size, vram_offset);
+        cpu_register_physical_memory(addr + 0x02000000ULL, size, vram_offset);
         vram_offset += size;
         vram_base += size;
 
@@ -537,20 +535,20 @@
         size = vram_size * 4;
         s->cplane = (uint32_t *)vram_base;
         s->cplane_offset = vram_offset;
-        cpu_register_physical_memory(addr + 0x0a000000, size, vram_offset);
+        cpu_register_physical_memory(addr + 0x0a000000ULL, size, vram_offset);
         graphic_console_init(s->ds, tcx24_update_display,
                              tcx24_invalidate_display, tcx24_screen_dump, s);
     } else {
-        cpu_register_physical_memory(addr + 0x00300000, TCX_THC_NREGS_8,
+        cpu_register_physical_memory(addr + 0x00300000ULL, TCX_THC_NREGS_8,
                                      dummy_memory);
         graphic_console_init(s->ds, tcx_update_display, tcx_invalidate_display,
                              tcx_screen_dump, s);
     }
     // NetBSD writes here even with 8-bit display
-    cpu_register_physical_memory(addr + 0x00301000, TCX_THC_NREGS_24,
+    cpu_register_physical_memory(addr + 0x00301000ULL, TCX_THC_NREGS_24,
                                  dummy_memory);
 
-    register_savevm("tcx", addr, 1, tcx_save, tcx_load, s);
+    register_savevm("tcx", addr, 3, tcx_save, tcx_load, s);
     qemu_register_reset(tcx_reset, s);
     tcx_reset(s);
     dpy_resize(s->ds, width, height);
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 7e993b7..b067d7b 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -290,7 +290,7 @@
 
 int cpu_sparc_signal_handler(int host_signum, void *pinfo, void *puc);
 void raise_exception(int tt);
-void do_unassigned_access(target_ulong addr, int is_write, int is_exec,
+void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
                           int is_asi);
 
 #include "cpu-all.h"
diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index 8f12667..da81562 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -117,7 +117,7 @@
     }
 
     *access_index = ((rw & 1) << 2) | (rw & 2) | (is_user? 0 : 1);
-    *physical = 0xfffff000;
+    *physical = 0xffffffffffff0000ULL;
 
     /* SPARC reference MMU table walk: Context table->L1->L2->PTE */
     /* Context base + context number */
@@ -203,7 +203,7 @@
 
     /* Even if large ptes, we map only one 4KB page in the cache to
        avoid filling it too fast */
-    *physical = ((pde & PTE_ADDR_MASK) << 4) + page_offset;
+    *physical = ((target_phys_addr_t)(pde & PTE_ADDR_MASK) << 4) + page_offset;
     return error_code;
 }
 
@@ -212,7 +212,7 @@
                               int is_user, int is_softmmu)
 {
     target_phys_addr_t paddr;
-    unsigned long vaddr;
+    target_ulong vaddr;
     int error_code = 0, prot, ret = 0, access_index;
 
     error_code = get_physical_address(env, &paddr, &prot, &access_index, address, rw, is_user);
@@ -220,7 +220,8 @@
 	vaddr = address & TARGET_PAGE_MASK;
 	paddr &= TARGET_PAGE_MASK;
 #ifdef DEBUG_MMU
-	printf("Translate at 0x%lx -> 0x%lx, vaddr 0x%lx\n", (long)address, (long)paddr, (long)vaddr);
+	printf("Translate at " TARGET_FMT_lx " -> " TARGET_FMT_plx ", vaddr "
+               TARGET_FMT_lx "\n", address, paddr, vaddr);
 #endif
 	ret = tlb_set_page_exec(env, vaddr, paddr, prot, is_user, is_softmmu);
 	return ret;
@@ -255,7 +256,8 @@
     uint32_t pde;
 
     /* Context base + context number */
-    pde_ptr = (env->mmuregs[1] << 4) + (env->mmuregs[2] << 2);
+    pde_ptr = (target_phys_addr_t)(env->mmuregs[1] << 4) +
+        (env->mmuregs[2] << 2);
     pde = ldl_phys(pde_ptr);
 
     switch (pde & PTE_ENTRYTYPE_MASK) {
@@ -314,30 +316,35 @@
 #ifdef DEBUG_MMU
 void dump_mmu(CPUState *env)
 {
-     target_ulong va, va1, va2;
-     unsigned int n, m, o;
-     target_phys_addr_t pde_ptr, pa;
+    target_ulong va, va1, va2;
+    unsigned int n, m, o;
+    target_phys_addr_t pde_ptr, pa;
     uint32_t pde;
 
     printf("MMU dump:\n");
     pde_ptr = (env->mmuregs[1] << 4) + (env->mmuregs[2] << 2);
     pde = ldl_phys(pde_ptr);
-    printf("Root ptr: " TARGET_FMT_lx ", ctx: %d\n", env->mmuregs[1] << 4, env->mmuregs[2]);
+    printf("Root ptr: " TARGET_FMT_plx ", ctx: %d\n",
+           (target_phys_addr_t)env->mmuregs[1] << 4, env->mmuregs[2]);
     for (n = 0, va = 0; n < 256; n++, va += 16 * 1024 * 1024) {
-	pde_ptr = mmu_probe(env, va, 2);
-	if (pde_ptr) {
+	pde = mmu_probe(env, va, 2);
+	if (pde) {
 	    pa = cpu_get_phys_page_debug(env, va);
- 	    printf("VA: " TARGET_FMT_lx ", PA: " TARGET_FMT_lx " PDE: " TARGET_FMT_lx "\n", va, pa, pde_ptr);
+ 	    printf("VA: " TARGET_FMT_lx ", PA: " TARGET_FMT_plx
+                   " PDE: " TARGET_FMT_lx "\n", va, pa, pde);
 	    for (m = 0, va1 = va; m < 64; m++, va1 += 256 * 1024) {
-		pde_ptr = mmu_probe(env, va1, 1);
-		if (pde_ptr) {
+		pde = mmu_probe(env, va1, 1);
+		if (pde) {
 		    pa = cpu_get_phys_page_debug(env, va1);
- 		    printf(" VA: " TARGET_FMT_lx ", PA: " TARGET_FMT_lx " PDE: " TARGET_FMT_lx "\n", va1, pa, pde_ptr);
+ 		    printf(" VA: " TARGET_FMT_lx ", PA: " TARGET_FMT_plx
+                           " PDE: " TARGET_FMT_lx "\n", va1, pa, pde);
 		    for (o = 0, va2 = va1; o < 64; o++, va2 += 4 * 1024) {
-			pde_ptr = mmu_probe(env, va2, 0);
-			if (pde_ptr) {
+			pde = mmu_probe(env, va2, 0);
+			if (pde) {
 			    pa = cpu_get_phys_page_debug(env, va2);
- 			    printf("  VA: " TARGET_FMT_lx ", PA: " TARGET_FMT_lx " PTE: " TARGET_FMT_lx "\n", va2, pa, pde_ptr);
+ 			    printf("  VA: " TARGET_FMT_lx ", PA: "
+                                   TARGET_FMT_plx " PTE: " TARGET_FMT_lx "\n",
+                                   va2, pa, pde);
 			}
 		    }
 		}
diff --git a/target-sparc/op_helper.c b/target-sparc/op_helper.c
index bdc5b0e..93f61a8 100644
--- a/target-sparc/op_helper.c
+++ b/target-sparc/op_helper.c
@@ -223,7 +223,31 @@
 	    break;
         }
 	break;
-    case 0x21 ... 0x2f: /* MMU passthrough, unassigned */
+    case 0x2e: /* MMU passthrough, 0xexxxxxxxx */
+    case 0x2f: /* MMU passthrough, 0xfxxxxxxxx */
+        switch(size) {
+        case 1:
+            ret = ldub_phys((target_phys_addr_t)T0
+                            | ((target_phys_addr_t)(asi & 0xf) << 32));
+            break;
+        case 2:
+            ret = lduw_phys((target_phys_addr_t)(T0 & ~1)
+                            | ((target_phys_addr_t)(asi & 0xf) << 32));
+            break;
+        default:
+        case 4:
+            ret = ldl_phys((target_phys_addr_t)(T0 & ~3)
+                           | ((target_phys_addr_t)(asi & 0xf) << 32));
+            break;
+        case 8:
+            ret = ldl_phys((target_phys_addr_t)(T0 & ~3)
+                           | ((target_phys_addr_t)(asi & 0xf) << 32));
+            T0 = ldl_phys((target_phys_addr_t)((T0 + 4) & ~3)
+                           | ((target_phys_addr_t)(asi & 0xf) << 32));
+	    break;
+        }
+	break;
+    case 0x21 ... 0x2d: /* MMU passthrough, unassigned */
     default:
         do_unassigned_access(T0, 0, 0, 1);
 	ret = 0;
@@ -360,12 +384,38 @@
             }
 	}
 	return;
+    case 0x2e: /* MMU passthrough, 0xexxxxxxxx */
+    case 0x2f: /* MMU passthrough, 0xfxxxxxxxx */
+	{
+            switch(size) {
+            case 1:
+                stb_phys((target_phys_addr_t)T0
+                         | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
+                break;
+            case 2:
+                stw_phys((target_phys_addr_t)(T0 & ~1)
+                            | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
+                break;
+            case 4:
+            default:
+                stl_phys((target_phys_addr_t)(T0 & ~3)
+                           | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
+                break;
+            case 8:
+                stl_phys((target_phys_addr_t)(T0 & ~3)
+                           | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
+                stl_phys((target_phys_addr_t)((T0 + 4) & ~3)
+                           | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
+                break;
+            }
+	}
+	return;
     case 0x31: /* Ross RT620 I-cache flush */
     case 0x36: /* I-cache flash clear */
     case 0x37: /* D-cache flash clear */
         break;
     case 9: /* Supervisor code access, XXX */
-    case 0x21 ... 0x2f: /* MMU passthrough, unassigned */
+    case 0x21 ... 0x2d: /* MMU passthrough, unassigned */
     default:
         do_unassigned_access(T0, 1, 0, 1);
 	return;
@@ -1035,7 +1085,7 @@
 #endif
 
 #ifndef TARGET_SPARC64
-void do_unassigned_access(target_ulong addr, int is_write, int is_exec,
+void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
                           int is_asi)
 {
     CPUState *saved_env;
@@ -1058,7 +1108,7 @@
     env->mmuregs[4] = addr; /* Fault address register */
     if ((env->mmuregs[0] & MMU_E) && !(env->mmuregs[0] & MMU_NF)) {
 #ifdef DEBUG_UNASSIGNED
-        printf("Unassigned mem access to " TARGET_FMT_lx " from " TARGET_FMT_lx
+        printf("Unassigned mem access to " TARGET_FMT_plx " from " TARGET_FMT_lx
                "\n", addr, env->pc);
 #endif
         raise_exception(TT_DATA_ACCESS);
@@ -1066,7 +1116,7 @@
     env = saved_env;
 }
 #else
-void do_unassigned_access(target_ulong addr, int is_write, int is_exec,
+void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
                           int is_asi)
 {
 #ifdef DEBUG_UNASSIGNED
@@ -1076,7 +1126,7 @@
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    printf("Unassigned mem access to " TARGET_FMT_lx " from " TARGET_FMT_lx "\n",
+    printf("Unassigned mem access to " TARGET_FMT_plx " from " TARGET_FMT_lx "\n",
            addr, env->pc);
     env = saved_env;
 #endif
diff --git a/vl.h b/vl.h
index 171b02b..36ab2d2 100644
--- a/vl.h
+++ b/vl.h
@@ -1024,7 +1024,7 @@
 typedef struct fdctrl_t fdctrl_t;
 
 fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped, 
-                       uint32_t io_base,
+                       target_phys_addr_t io_base,
                        BlockDriverState **fds);
 int fdctrl_get_drive_type(fdctrl_t *fdctrl, int drive_num);
 
@@ -1047,7 +1047,8 @@
 
 void pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn);
 void pcnet_h_reset(void *opaque);
-void *lance_init(NICInfo *nd, uint32_t leaddr, void *dma_opaque, qemu_irq irq);
+void *lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
+                 qemu_irq irq);
 
 /* vmmouse.c */
 void *vmmouse_init(void *m);
@@ -1208,7 +1209,7 @@
 extern QEMUMachine ss5_machine, ss10_machine;
 
 /* iommu.c */
-void *iommu_init(uint32_t addr);
+void *iommu_init(target_phys_addr_t addr);
 void sparc_iommu_memory_rw(void *opaque, target_phys_addr_t addr,
                                  uint8_t *buf, int len, int is_write);
 static inline void sparc_iommu_memory_read(void *opaque,
@@ -1226,13 +1227,13 @@
 }
 
 /* tcx.c */
-void tcx_init(DisplayState *ds, uint32_t addr, uint8_t *vram_base,
-	      unsigned long vram_offset, int vram_size, int width, int height,
+void tcx_init(DisplayState *ds, target_phys_addr_t addr, uint8_t *vram_base,
+              unsigned long vram_offset, int vram_size, int width, int height,
               int depth);
 
 /* slavio_intctl.c */
 void pic_set_irq_cpu(void *opaque, int irq, int level, unsigned int cpu);
-void *slavio_intctl_init(uint32_t addr, uint32_t addrg,
+void *slavio_intctl_init(target_phys_addr_t addr, target_phys_addr_t addrg,
                          const uint32_t *intbit_to_level,
                          qemu_irq **irq);
 void slavio_intctl_set_cpu(void *opaque, unsigned int cpu, CPUState *env);
@@ -1248,26 +1249,28 @@
 int load_uboot(const char *filename, target_ulong *ep, int *is_linux);
 
 /* slavio_timer.c */
-void slavio_timer_init(uint32_t addr, int irq, int mode, unsigned int cpu,
-                       void *intctl);
+void slavio_timer_init(target_phys_addr_t addr, int irq, int mode,
+                       unsigned int cpu, void *intctl);
 
 /* slavio_serial.c */
-SerialState *slavio_serial_init(int base, qemu_irq irq, CharDriverState *chr1,
-                                CharDriverState *chr2);
-void slavio_serial_ms_kbd_init(int base, qemu_irq);
+SerialState *slavio_serial_init(target_phys_addr_t base, qemu_irq irq,
+                                CharDriverState *chr1, CharDriverState *chr2);
+void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq);
 
 /* slavio_misc.c */
-void *slavio_misc_init(uint32_t base, qemu_irq irq);
+void *slavio_misc_init(target_phys_addr_t base, target_phys_addr_t power_base,
+                       qemu_irq irq);
 void slavio_set_power_fail(void *opaque, int power_failing);
 
 /* esp.c */
 void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id);
-void *esp_init(BlockDriverState **bd, uint32_t espaddr, void *dma_opaque);
+void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
+               void *dma_opaque);
 void esp_reset(void *opaque);
 
 /* sparc32_dma.c */
-void *sparc32_dma_init(uint32_t daddr, qemu_irq espirq, qemu_irq leirq,
-                       void *iommu);
+void *sparc32_dma_init(target_phys_addr_t daddr, qemu_irq espirq,
+                       qemu_irq leirq, void *iommu);
 void ledma_set_irq(void *opaque, int isr);
 void ledma_memory_read(void *opaque, target_phys_addr_t addr, 
                        uint8_t *buf, int len, int do_bswap);