The init routine of the network card driver in Solaris 2.6 has this piece of code:
| call ddi_get_parent |
| ld [%l0 + 0xc], %o0 |
| call ddi_get_driver_private |
| nop |
| add %o0, 0x4, %g2 |
| st %g2, [%l0 + 0x720] |
That's how it looks in Solaris 9:
| call ddi_get_parent |
| ld [%l0 + 0x10], %o0 |
| call ddi_get_driver_private |
| nop |
| add %o0, 0x10, %g2 |
| st %g2, [%l0 + 0x728] |
Adding 0x10 to the base of dma registers, makes a pointer to a nowhere.
Yes, qemu is not precise, and doesn't emulate memory aliasing (Blue Swirl had a patch for it), but hey, Solaris works on sun4m only due to a coincidence!
So, all the Solaris versions from 5.7 to 9 can be booted in qemu by hot patching in kadb (booting kadb is already described in the how-to).
That's how I patched Solaris 9 for booting under qemu:
| kadb[0]: le#leinit:b | set a deferred breakpoint |
| kadb[0]: :c | continue execution |
| ... | |
| kadb[0]: leinit+0x654?i | check that we are at the correct place |
| add %o0, 0x10, %g2 | |
| kadb[0]: leinit+0x654/X | |
| leinit+0x654: 84022010 | |
| kadb[0]: leinit+0x654/W 84022004 | |
| leinit+0x654: 0x84022010 = 0x84022004 | patch |
| kadb[0]: leinit:d | delete the breakpoint |
| kadb[0]: :c | continue |
Once again I can only recommend reading the PANIC! UNIX System Crash Dump Analysis Handbook to understand the basics before patching anything.
