This part seems very different on Sparc32. I did not know some weeks ago, but OpenBoot until very late versions does not use the client interface but a data structure called "romvec" (arch/sparc32/romvec.c) that contains several data pointers and callbacks to different OF functions
I haven't looked at NetBSD/Sparc, unfortunately. Just NetBSD/PowerPC with Open Firmware support for Macs, old Moto stuf, etc, which makes proper call-backs, plus has specs in nauseating detail.
Have you looked at the other BSDs (Free/Open) to see if their Sparc32 boot is any different, perhaps simpler?
Interesting. Loading the kernel at once. The ELF kernel loads fine, but the CD comes with an a.out kernel that has a wrong "text" size and no data size. Since it loads directly from the CD device as opposed to from a filesystem I have no idea how much data to load and how to parse it. :-(
Yeah, the first trick is building that ELF netbsd kernel and not the bootstrap a.out thingie. A standard ELF kernel may lurk lower down on the CD somewhere. Otherwise it's cross-compile time.
The SF trick short-circuits the loaders (at least initially) by directly loading the ELF image, then passing it the magic args that it expects. The args are hard-wired inside a C array, just to get things rolling. Works surprisingly well for system bring-up.
Does a version of Smart Firmware boot Solaris on Sparc? Any chance there's some hint?
Unfortunately the version of SF that boots Solaris contains a LOT of proprietary Sun code, some in C, some in Forth/Fcode. Even we never had a copy of it - it all stayed on Sun's machines.
The Solaris versions Sun's SF was booting involved loading and running a variety of their Fcode loaders, which loaded other Fcode, which sometimes loaded even more Fcode, which eventually loaded a kernel, which would then run, making a bunch of callbacks all the while.
A variety of subtle bugs and bug-compatibility modes in the SF code are #ifdef-ed SUN_COMPATIBILITY, but other than that, there's not much else.