Running Solaris 2.6 (sparc) on qemu-system-sparc in Linux x86_64 (Mint 19)

Next chapter in our Computer Archeology articles. This time it will be about emulating the legendary Sun Solaris 2.6 that dates back to July 1997 and which included Kerberos 5, PAM, TrueType fonts, WebNFS, large file support and enhanced procfs. It was also known as SunOS 5.6

Qemu can emulate many CPU architectures, we will be concerned only with Sparc (qemu-system-sparc). I usually build qemu from source ( ) so with this exercise Im using the below qemu version compiled on Linux Mint 19 :

QEMU emulator version 3.0.50 (v3.0.0-614-g19b599f766-dirty)
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

The compilation is pretty straightforward and takes some time if we decide to compile all the emulation platforms supported by Qemu.

Also what I found very handy is the Linux build for RealVNC viewer from here ( ) and use it as a VNCviewer with Qemu since the SDL support seems flaky sometimes and breaks some character display in Solaris 2.6 in Qemu.

Next we need to get our hands on the Installer CD ISO for Sun Solaris 2.6 and the ss5.bin (SUN Station 5 PROM )  I have uploaded the gzipped tarball of the ISO and the bin here!3lcSCKiT!KcGupko0KkFagQyD8fqYJfBY_r04zqBNlbMvTQL334U

Once we download the archive we extract it to a working directory where we will hold our Solaris 2.6 environment

user@panasonic ~/SOLARIS $ gunzip sol26.tar.gz 
user@panasonic ~/SOLARIS $ tar -xvf sol26.tar 
user@panasonic ~/SOLARIS $ cd Sun-Solaris-2.6-sparc/
user@panasonic ~/SOLARIS/Sun-Solaris-2.6-sparc $ ls -la
total 552868
drwxr-xr-x 2 user user 4096 Sep 21 10:51 .
drwxr-xr-x 3 user user 4096 Sep 21 23:52 ..
-rw-r--r-- 1 user user 565862400 Sep 21 10:51 solaris-2.6-sparc.iso
-rw-r--r-- 1 user user 262144 Sep 21 10:51 ss5.bin

So we end up with 2 files in Sun-Solaris-2.6-sparc directory (Installation ISO and PROM image) Next we will create a QCOW image for the HDD and setup some networking per-requisites. Following will create a  36GB QCOW image v3

$ qemu-img create -f qcow2 disk.img 36G
Formatting 'disk.img', fmt=qcow2 size=38654705664 cluster_size=65536 lazy_refcounts=off refcount_bits=16
$ file disk.img 
disk.img: QEMU QCOW Image (v3), 38654705664 bytes

Next we will configure the networking and the /etc/qemu-ifup script.  Networking script can be saved in the emulation directory and needs to be executed with root privileges prior running qemu (you should adjust to your needs here -> enp0s25 is eth0 and wlp9s0 is wlan0 )  lets call this

#Setup tap and bridge 
tunctl -t tap0 -u user
ifconfig tap0 up
brctl addbr br0
brctl addif br0 enp0s25 vboxnet0 
brctl setfd br0 0
ifconfig enp0s25 up 
ifconfig br0 netmask broadcast up
brctl addif br0 tap0 vboxnet0 
ifconfig tap0
sysctl net.ipv4.ip_forward=1
iptables -A FORWARD --in-interface enp0s25 -j ACCEPT
iptables --table nat -A POSTROUTING --out-interface wlp9s0 -j MASQUERADE

Next we replace the /etc/qemu-ifup  script with the below

#! /bin/sh
# Script to bring a network (tap) device for qemu up.
# The idea is to add the tap device to the same bridge
# as we have default routing to.

# in order to be able to find brctl
ip=$(which ip)

if [ -n "$ip" ]; then
ip link set "$1" up
brctl=$(which brctl)
if [ ! "$ip" -o ! "$brctl" ]; then
echo "W: $0: not doing any bridge processing: neither ip nor brctl utility not found" >&2
exit 0
ifconfig "$1" up

switch=$(ip route ls |
awk '/^default / {
for(i=0;i<NF;i++) { if ($i == "dev") { print $(i+1); next; } }


# only add the interface to default-route bridge if we
# have such interface (with default route) and if that
# interface is actually a bridge.
# It is possible to have several default routes too
for br in $switch; do
if [ -d /sys/class/net/$br/bridge/. ]; then
if [ -n "$ip" ]; then
ip link set "$1" master "$br"
brctl addif $br "$1"
exit # exit with status of the previous command

echo "W: $0: no bridge for guest interface found" >&2

So once we are ready we will launch the and move on to prepare the newly created disk.img to be ready for Solaris 2.6 installation. We will be running a simulated Sparc machine with 128 MB RAM and and disguise as SPARCstation5

You need to run this as root

# qemu-system-sparc -L . -m 128 -M SS-5 -bios ss5.bin -drive file=disk.img,bus=0,unit=0,media=disk -drive file=solaris-2.6-sparc.iso,bus=0,unit=6,media=cdrom -net nic -net tap -display vnc=:1

Here is the ss5.bin (save ss5.doc and rename to ss5.bin)ss5

Next we must load the TightVNC viewer to connect to  the console (  or :1)

We add the boot cdrom:d -vs  (boot in single user mode from the ISO )

Next we need to load the disk labeling/formatting   by entering format in the root shell

Next we select 16 Other

We enter the 24620 as number of cylinders

Enter 27 as number of heads

Number of data sectors/track 107

Hit default values on the rest until you reach the disk name Qemu36GB

Next we get thrown to format prompt we finally run label on it

Once we see the below message about the corrupt label we run l

Now we are finally done, we can quit and reboot

So once we are in the SPARC boot prompt again we issue boot cdrom:d

Next the installer X11 screen should pop up

So we choose whatever suites us – this part is pretty straightforward

!!! Selet Manual Reboot option here since we need to make some changes to the system before we reboot it !!!

Finally the installation will start; it will take some time to finish so we can grab a cup of coffee

After the installer finishes we are left with a root shell in which we need to do a few things

We need to edit /a/etc/system and add to the end of it value as seen in the screenshot below  set scsi_options=0x58

Add default route to the network config file in /a/etc/defaultrouter

Add the following to /a/etc/nsswitch.conf   hosts:  file  dns      via vi

We define nameserver (google) in /a/etc/resolv.conf  nameserver

Finally we add the aliases to /a/etc/hosts

Now we are ready to reboot the installer so just type reboot in the root shell

Yet again we are back at the SPARC boot prompt, however  this time we boot the disk with Solaris

Next we define the root password

We will be given a choice to run either CDE or OpenDesktop environment next. I choose CDE  (I love the design, but hate the insecurity of it )

So by now we should have a fully working, networked Sun Solaris 2.6 environment. Reachable by from the Linux Mint system (thanks to the br0 and tun0) and able to communicate with the internet via the HotJava browser (very limited nowadays)

And finally an Nmap scan of the default Sun Solaris 2.6 installation

# nmap -sS -sV -vv
Starting Nmap 7.70SVN ( ) at 2018-09-21 22:45 CEST
NSE: Loaded 44 scripts for scanning.
Initiating ARP Ping Scan at 22:45
Scanning [1 port]
Completed ARP Ping Scan at 22:45, 0.22s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:45
Completed Parallel DNS resolution of 1 host. at 22:45, 0.02s elapsed
Initiating SYN Stealth Scan at 22:45
Scanning [1000 ports]
Discovered open port 25/tcp on
Discovered open port 111/tcp on
Discovered open port 21/tcp on
Discovered open port 23/tcp on
Discovered open port 13/tcp on
Discovered open port 512/tcp on
Discovered open port 514/tcp on
Discovered open port 79/tcp on
Discovered open port 32775/tcp on
Discovered open port 32773/tcp on
Discovered open port 515/tcp on
Discovered open port 6000/tcp on
Discovered open port 32772/tcp on
Increasing send delay for from 0 to 5 due to 144 out of 479 dropped probes since last increase.
Discovered open port 32777/tcp on
Discovered open port 6112/tcp on
Increasing send delay for from 5 to 10 due to 30 out of 99 dropped probes since last increase.
Increasing send delay for from 10 to 20 due to 13 out of 41 dropped probes since last increase.
Discovered open port 32774/tcp on
Increasing send delay for from 20 to 40 due to 11 out of 33 dropped probes since last increase.
Discovered open port 4045/tcp on
Increasing send delay for from 40 to 80 due to 11 out of 33 dropped probes since last increase.
Discovered open port 32771/tcp on
Discovered open port 9/tcp on
Discovered open port 1099/tcp on
Discovered open port 7100/tcp on
Discovered open port 19/tcp on
Discovered open port 37/tcp on
Discovered open port 32776/tcp on
Discovered open port 513/tcp on
Discovered open port 7/tcp on
Discovered open port 32779/tcp on
Discovered open port 32778/tcp on
Completed SYN Stealth Scan at 22:46, 57.78s elapsed (1000 total ports)
Initiating Service scan at 22:46
Scanning 28 services on
Completed Service scan at 22:49, 151.13s elapsed (28 services on 1 host)
NSE: Script scanning
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 22:49
Completed NSE at 22:49, 1.07s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 22:49
Completed NSE at 22:49, 1.07s elapsed
Nmap scan report for
Host is up, received arp-response (0.00031s latency).
Scanned at 2018-09-21 22:45:33 CEST for 211s
Not shown: 972 closed ports
Reason: 972 resets
7/tcp     open  echo             syn-ack ttl 255
9/tcp     open  discard?         syn-ack ttl 255
13/tcp    open  daytime          syn-ack ttl 255 Sun Solaris daytime
19/tcp    open  chargen          syn-ack ttl 255
21/tcp    open  ftp              syn-ack ttl 255 Sun SunOS ftpd 5.6
23/tcp    open  telnet           syn-ack ttl 255 Sun Solaris telnetd
25/tcp    open  smtp             syn-ack ttl 255 Sendmail SMI-8.6/SMI-SVR4
37/tcp    open  time             syn-ack ttl 255 (32 bits)
79/tcp    open  finger           syn-ack ttl 255 Sun Solaris fingerd
111/tcp   open  rpcbind          syn-ack ttl 255 2-4 (RPC #100000)
512/tcp   open  exec             syn-ack ttl 255
513/tcp   open  login            syn-ack ttl 255
514/tcp   open  tcpwrapped       syn-ack ttl 255
515/tcp   open  printer          syn-ack ttl 255 Sun Solaris lpd
1099/tcp  open  rmiregistry      syn-ack ttl 255 Java RMI
4045/tcp  open  nlockmgr         syn-ack ttl 255 1-4 (RPC #100021)
6000/tcp  open  X11              syn-ack ttl 255 (access denied)
6112/tcp  open  dtspc?           syn-ack ttl 255
7100/tcp  open  font-service     syn-ack ttl 255 Sun Solaris
32771/tcp open  rpcbind          syn-ack ttl 255
32772/tcp open  kcms_server      syn-ack ttl 255 1 (RPC #100221)
32773/tcp open  cachefsd         syn-ack ttl 255 1 (RPC #100235)
32774/tcp open  status           syn-ack ttl 255 1 (RPC #100024)
32775/tcp open  ttdbserverd      syn-ack ttl 255 1 (RPC #100083)
32776/tcp open  sometimes-rpc15? syn-ack ttl 255
32777/tcp open  dmispd           syn-ack ttl 255 1 (RPC #300598)
32778/tcp open  snmpXdmid        syn-ack ttl 255 1 (RPC #100249)
32779/tcp open  ttsession        syn-ack ttl 255 1-4 (RPC #1342177279)
MAC Address: 52:54:00:12:34:56 (QEMU virtual NIC)
Service Info: Hosts: solaris, solaris.; OSs: Solaris, Unix; CPE: cpe:/o:sun:sunos, cpe:/o:sun:sunos:5.6

Read data files from: /usr/local/bin/../share/nmap
Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 211.79 seconds
           Raw packets sent: 1984 (87.280KB) | Rcvd: 1320 (52.932KB)

Solaris is pretty much dead now it seems … and I leave it as it is (its dead ass by the road …)

Acknowledgement :  I would like to thank the following authors for their valuable information as well as inspiration

Formatting disks for Solaris –

Revisiting a Solaris on Qemu install  

Setting up TUN/TAP networking

About astr0baby

Please run Adblock or similar... we have been told to do so since Carl Sagan wrote the Contact .
This entry was posted in Uncategorized. Bookmark the permalink.

42 Responses to Running Solaris 2.6 (sparc) on qemu-system-sparc in Linux x86_64 (Mint 19)

  1. Peter Teoh says:

    oh, please don’t say that….Solaris is still very much alive: so many spinoff variant of solaris are available: OpenIndiana and Illumos among them. But your write-up is amazing, wonder how you ever figure out all the parameters:
    “qemu-system-sparc -L . -m 128 -M SS-5 -bios ss5.bin -drive file=disk.img,bus=0,unit=0,media=disk -drive file=solaris-2.6-sparc.iso,bus=0,unit=6,media=cdrom -net nic -net tap -display vnc=:1”
    I have lots of Solaris CD, will give it a try one day!

  2. Pingback: Installation de « Sun Solaris 2.6 » sous « Qemu 3.0.0 » – Rock Star Ninja

  3. viktormadarasz says:

    the link always times outs for me .. cant download

  4. viktormadarasz says:

    thanks a lot .. you are great

  5. ahmad says:

    There’s only Solaris 2.6 ISO in the link. Where can I download the ss5.bin file?

  6. Josh Williams says:

    Hey, this is amazing! I wasn’t able to get the networking stuff working (I’m doing this on Windows 10), but the rest worked great!

    I did have a question: How do you get files between your host and guest machines? A little googling shows me its possible to set up a share file between the two systems (to avoid even copying anything) but my two problems are this:

    a) Are there issues with the fact that SPARC and Intel processors are inherently different? As in, are files created in Solaris going to be readable to my host machine (and vice versa)?

    b) How would you even do that? I have the system up and running. Is it possible to add an external share folder on top of this install now? Or would I have to start from scratch.

    Thank you so much!

    • astr0baby says:

      Hi Josh,
      thanks for your comment, appreciate it. To answer your questions – Since I have fully working network in the qemu environment (running this on Linux) I use ftp or ssh to move stuff in/out. OpenSSH is not native to the Solaris Install ISOs so the best bet is FTPd, that works just fine. Please bear in mind that the Sparc 32bit platform is Big Endinan as opposed to Windows (Little Endian) so for your question about the files created on the emulated Sparc you need to understand what binary files you will be importing (issues can be with DB files etc …)you can read more on this here
      Last question’s answer – if you cannot get a network going on windows, you can setup a second IDE virtual disk that both systems can access (FAT16/32 ) and share files via that … :)
      Good Luck !

  7. Josh Williams says:

    Endianness is exactly why I’m trying to get an old-school SPARC environment going. I have a program I need to run that was compiled in SPARC, and the files it needs to process are also big-endian. The trouble is getting the program and all these files onto the guest machine, doing the processing, then being able to bring the resultant files (which should be configured in ascii) back to my host computer.

    I’ll try experimenting a bit today and get back to you! Currently I’m trying an alternative VM I found on this YouTube video here:

    Though ironically I’ve got the same networking issues there. I’ve learned more about VMs and networking in the last 24 hours than I ever knew!

  8. Josh Williams says:

    Update: Got the network stuff working. Turns out that I can do all the bridging stuff in Windows! Managed to get it pointed to the right IP and it can now at least ping google. Now I’ve just gotta work out how to use FTPd

    • astr0baby says:

      Nice ! let me know how that ends. On Linux is really simple, I have no idea how this is done on Windows (bridge, NAT, etc) but once this is up FTPd should just work (make sure you add some users on Solaris or enable root for FTP) if you get stuck you can ask here, I will try to help.

      • Josh Williams says:

        I’ve been using Cygwin because it gives me a linux-like environment on windows. It’s incomplete, but useful. If you tell me how you would go about it in linux, I might be able to figure it out on windows? Thanks again! :)

      • astr0baby says:

        Well for the NAT and bridging with tun/tap cygwin is probably not gonna help you … you can check the article, it has all the steps I did to get it running on Linux.

  9. Rat Salat says:


    You mention in this post that the Solaris instance is reachable from inside the Linux Mint system. Is it available to the outside world using these settings? I have an old piece of software that will only run on SPARC versions of Solaris and I need to be able to access it externally. I’ve been able to get the software running, but I’m using Windows and was unable to get TAP working successfully. I’m about to try your guide and do it in Linux, but I want to know if I’d be able to access the Solaris instance externally if I do so.

    Thanks so much.

    • astr0baby says:

      Hi, sure, on Linux you can set port forwarding with iptables and map the tun/apt Solaris port to anything on Linux hosts. Or you can setup port forwarding with socat (thats more ad-hoc solution if you don’t want to bother with iptables)

  10. Dan says:

    Hi, great work on this, thanks!
    I’m trying to partially follow your guide to get an existing image of a disk from an old Sun Microsystems machine running in QEMU. It’s hooked up to old (but perfectly functional) scientific equipment and the software isn’t something I could set up on a fresh Solaris install.
    I believe I reached the point where it recognizes the disk image but it just won’t boot. Any tips?

    • astr0baby says:

      Hi, what exactly are you trying to do here ? Run the old system image in Qemu ?

      • Jesus (HeyZeus) says:

        Hi, I’m trying to run one VM with 2.6 and the 2nd VM with 2.8. Fresh installs of Solaris course. There is this old piece of SW (I just have a some binary files in a TAR ball) that runs one these versions of Solaris that talks to some very old test equipment. It’s a GUI application with a a note it was written in motif. End go is to run the SW on so I can understand what the SW does with test equipment.

      • Dan says:

        Hi, so sorry I missed this response!
        Yes, I’m trying to run the old system image in Qemu rather than creating a new installation.
        I had to work on other projects so I haven’t been working on it recently.

  11. Jesus (HeyZeus) says:

    Hoping you can still assist with this old post of yours. BTW I also reviewed your Solaris 2.9 post.

    Attempting to run Solaris 6 and Solaris 8, via qemu-system-sparc that is ‘sun4m’.
    I have Ubuntu 18.04 repository of QEMU installed (ver 2.11.1) and I built the latest one from (ver 5.1.0) website. Solaris 6 version is “SunOS_5_6_SPARC_Generic_105181-05.iso” (aka 2.6.598) and the Solaris 8 version is “SunOS_5_8_SPARC_Generic_108528-29.iso”. I also have an older version which is “SunOS_5_8_SPARC_Generic_108528-11.iso”.

    I have used your site and a few other sites to attempt building the VM. I created the 36GB (also played with 9GB) hard drive. Boot of the ISO (CDROM) in single user mode to format the hard drive, and then boot of the ISO to install the OS. This includes playing with options “-M SS-5” and playing with “-bios ss5.bin” or using built in openBIOS v1.1.

    For Solaris 6, I was able to install the OS if running with “-nographic” option. It will only run Solaris 6 if X-Server is not running by using qemu option “-nographic”. If I attempt to use graphics; either by not specifying one or “–display vnc=:1”, the VM crashes: “panic[cpu0]/thread=” “trap: unexpected MMU trap”

    For Solaris 8, a bit different. Again, I must start qemu application with option ‘-nographics’. When it completes step “Copying mini-root to local disk….done”. It reboots and crashes. So I cannot even install the OS. The error is “panic – boot: ufsboot: cannot determine filesystem type of root device”

    Do you have any suggestions? I can provide more details if needed.

    Getting CDE working is important. I’m just not sure what magic you did to get it working.

    • astr0baby says:

      Hi – I think the problem is with recent qemu-system-sparc builds – something broke there – you need to git clone the qemu-repo and reset the snapshot to the time when I wrote the article to pull that

      git clone
      cd qemu
      git checkout `git rev-list -1 –before=”Feb 1 2019″ master`
      ./configure –target-list=sparc-softmmu

  12. Jesus (HeyZeus) says:

    Thank you for responding. I followed your build instructions but QEMU from GIT fails to start when I want to format (# ok boot cdrom:d -vs) the virtual HDD, I started the VM in this method with no problems when using the Ubuntu 18.04 built in version (2.11.1) or version 5.1 from website.

    Method 1:
    ${QEMU} \
    -m 256 \
    -hda solaris_6_disk.img \
    -cdrom solaris_2.6_598_sparc.iso \

    Method 2:
    ${QEMU} \
    -m 256 \
    -drive file=solaris_6_disk.img,if=scsi,bus=0,unit=0,media=disk \
    -drive file=solaris_2.6_598_sparc.iso,format=raw,if=scsi,bus=0,unit=2,media=cdrom,readonly=on \

    QEMU=”/REPO/cots/QEMU.git/qemu/build/qemu-system-sparc” ;# QEMU emulator version 5.2.50 (v5.2.0-1199-ge43d564fa3)
    QEMU=”/usr/local/bin/qemu-system-sparc” ;# QEMU emulator version 5.1.0
    QEMU=”/usr/bin/qemu-system-sparc” ;# QEMU emulator version 2.11.1(Debian 1:2.11+dfsg-1ubuntu7.33)

    When using QEMU from GIT version, it generates the following error: qemu-system-sparc: could not load prom ‘openbios-sparc32’

    When I add the option:
    -bios ss5.bin \

    I get into the PROM, but I cannot boot from CDROM no matter what method I use. It returns:
    ok boot cdrom:d -vs
    Boot device: /iommu/sbus/espdma@5,8400000/esp@5,8800000/sd@6,0:d File and args: -vs
    Can’t open boot device

    I built the entire QEMU GIT package and I still get the same error message. Any other suggestions?

      • Jesus (HeyZeus) says:

        Once again thank you!!

        Before I read your response this morning, I ran ‘strace’. I determine that my path to ‘pc-bios’ was a broken symbolic link. I specifically build projects from source code on a VM built to handle that type of work flow. Once built, I copy the build tree using TAR to an NFS share. The host computer that is set up to run the Solaris VM only has access to the NFS share. Once I created the PATH and the appropriate symbolic link; IT WORK!!! just like your document. Thank you so much!!!!

        Different question, I notice a square dot that acts like the position of the mouse (arrow). But they do not line up. Had to play with mouse moments to get them lined up. if I move to fast, then the squarish dot and arrow have larger separation. I’m using VNC for my display. Is this an artifact from QEMU or VNC?

      • astr0baby says:

        For X11 best option is to run Xnest or Xephyr on your Linux host and simply catch the guest X11

        For ex. (if your guest IP is then run)
        Xephyr -screen 1024×720- -ac -query :1

  13. Götz says:


    you wrote “use this tarball containing the ISO and BIN.” But the Mega download link contains only an ISO, no tarball, no BIN?

  14. Steff says:

    Hello, I’m using your iso image along with the ss5.bin file but am unable to go further the “label” command.
    I want to set a 3 or 4 Gb drive, it gets formatted but labelling it the following error shows:

    Illegal request during read
    ASC: 0x21 ASCQ: 0x0
    Warning: error reading backup label.
    Warning: no backup labels
    Label failed

    Why should be any “backup labels”? It’s the setting of a new drive, first installation!
    Also, it’s difficult to find any likely hard drive data (heads, sectors, cylinders) to put in.
    Please help me, many thanks.

  15. astr0baby says:

    I also had errors during label after formatting the disk under Solaris – it should not matter I guess – please check the screenshots in the article where this happens – just follow the steps (regarding the cylinders, heads …etc as it is in the article

    • Steff says:

      In the article the error seems to happen once, while it happens continuously to me without any chance to go on.

      • Steff says:

        Update: putting likely hard disk data from an old 2 Gb drive I’ve been able to label it.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.