# GXemul: Unsupported guest OSes

Back to the index.

- HelenOS/maltabe 0.7.2
- HelenOS/rpi 0.7.2
- HelenOS/ppc 0.7.1
- Mach/PMAX
- Redhat Linux for DECstation
- OpenBSD/sgi
- OpenBSD/arc 2.3
- OpenBSD/luna88k
- Debian GNU/Linux for CATS
- Linux/Malta (variant 1)
- Linux/Malta (variant 2)
- Linux/QEMU_MIPS
- Windows NT/MIPS
- NetBSD/playstation2
- NetBSD/raspberrypi
- Linux/VoCore
- FreeBSD/VoCore

NOTE: The guest operating systems listed on this page are here because they do not work well enough to be regarded as "stable"/supported. If they become stable, they'll be moved to the guest OS page.

This page contains instructions on how installation of guest OSes could potentially be done, once the emulation is stable/complete enough. In some cases, it contains notes about starting guest OSes that are not complete (i.e. just booting a kernel, not a full installation of a guest OS).

### HelenOS/maltabe:

Modern versions of HelenOS almost run in GXemul, using the Malta big-endian emulation mode, without a graphical framebuffer. The PCI devices in GXemul are not detected/supported yet.

To run HelenOS for Malta in GXemul:

1. Download the HelenOS kernel:

       	http://www.helenos.org/releases/HelenOS-0.7.2-mips32-malta-be.boot

2. Start GXemul using the following command line:

         	gxemul -e maltabe HelenOS-0.7.2-mips32-malta-be.boot

### HelenOS/rpi:

The Raspberry Pi mode in GXemul is just a dummy so far. These instructions are used as a reminder for me when I wish to experiment with the HelenOS kernel:

1. Download the HelenOS kernel:

       	http://www.helenos.org/releases/HelenOS-0.7.2-arm32-raspberrypi.bin

2. Start GXemul using the following command line:

         	gxemul -VE rpi -tv 0x8000:0x40:0x8000:HelenOS-0.7.2-arm32-raspberrypi.bin

### HelenOS/ppc:

This does not work yet.

1. Download the HelenOS PPC ISO image:

       	http://www.helenos.org/releases/HelenOS-0.7.1-ppc32.iso

2. Start GXemul using the following command line:

         	gxemul -M 256 -v -x -e g4 -d HelenOS-0.7.1-ppc32.iso  -j BOOT/image.boot

### Mach/PMAX:

Read the following link if you want to know more about Mach in general: http://www-2.cs.cmu.edu/afs/cs/project/mach/public/www/mach.html

NOTE: Mach for DECstation requires some files (called 'startup' and 'emulator') which I haven't been able to find on the web. Without these, Mach will not get very far. These installation instructions are preliminary.

The following steps should let you experiment with running Mach for DECstation in the emulator:

1. Download the pmax binary distribution for Mach 3.0:

       	http://lost-contact.mit.edu/afs/athena/user/d/a/
       	    daveg/Info/Links/Mach/src/release/pmax.tar.Z
       	7263343 bytes, md5 = f9d76c240a6e169921a1df99ad560cc0

2. Extract the Mach kernel:

               tar xfvz pmax.tar.Z pmax_mach/special/mach.boot.MK83.STD+ANY

3. Create an empty disk image:

       	dd if=/dev/zero of=disk.img bs=1 count=512 seek=400000000

4. Load the contents of pmax.tar.Z onto the disk image. This is complicated, and should be described in more detail some time. For now, use your imagination, for example using OpenBSD/pmax:

       	disklabel -E rz1; newfs -O /dev/rz1a;
       	mount /dev/rz1a /mnt; cd /mnt; download pmax.tar.Z using ftp;
       	tar xzvf pmax.tar.Z; mv pmax_mach/* .; rmdir pmax_mach;
       	mkdir mach_servers;
       	cd mach_servers;
       	cp ../etc/mach_init .;
       	cp ../tests/test_service startup;
       	dd if=/dev/zero of=paging_file bs=65536 count=400;
       	cd /; sync; umount /mnt

5. Start the emulator with the following command:

       	gxemul -c 'put w 0x800990e0, 0' -c 'put w 0x80099144, 0' \
       	    -c 'put w 0x8004aae8, 0' -e 3max -X -d disk.img \
       	    pmax_mach/special/mach.boot.MK83.STD+ANY

Earlier versions of GXemul had a configure option to enable better R3000 cache emulation, but since Mach was more or less the only thing that used it, I removed it. Today's version of GXemul can thus not boot mach.boot.MK83.STD+ANY straight off, it has to be patched to skip the cache detection.

The -c commands above patch the kernel to get past the cache detection. Thanks to Artur Bujdoso for these values.

TODO: Better instructions on how to create the old-style UFS disk image.

### Redhat Linux for DECstation:

The following steps should let you run Redhat Linux for DECstation in GXemul:

1. Download a kernel. David Muse' Debian-install kernel works fine:

       	http://www.firstworks.com/mips-linux-2.4.31/vmlinux-2.4.31

2. Download a root filesystem tree:

       	ftp://ftp.linux-mips.org/pub/linux/mips/mipsel-linux/root/mipsel-root-20011216.tgz
       	19486676 bytes, md5 = 5bcb725c90209479cd7ead8ad0c4a414

3. Create a disk image which will contain the Redhat filesystem:

       	dd if=/dev/zero of=redhat_mips.img bs=1024 count=1 seek=2000000

4. This is the tricky part: on redhat_mips.img, you need to create an MS-DOS (!) partition table, and then an ext2 partition. This is what Linux will then see as /dev/sda1.

   I recommend you run fdisk and mke2fs and untar the archive from within Debian/DECstation or Debian/CATS running inside the emulator. (Alternatively, if you are on a Linux host, you could use a loopback mount, or similar. This might require root access. See e.g. http://www.mega-tokyo.com/osfaq2/index.php/Disk%20Images%20Under%20Linux.)

   In order to actually boot the system you need to modify /etc/fstab. Change

       	/dev/root               /               nfs     defaults        1 1
       	#/dev/sdc1              /               ext2    defaults        1 1
       	none                    /proc           proc    defaults        0 0
       	none                    /dev/pts        devpts  mode=0622       0 0

   to

       	#/dev/root              /               nfs     defaults        1 1
       	/dev/sda1               /               ext2    defaults        1 1
       	none                    /proc           proc    defaults        0 0
       	none                    /dev/pts        devpts  mode=0622       0 0

   (Note sda1 instead of sdc1.)

To boot Redhat linux from the disk image, use the following command line:

    	gxemul -X -e3max -o "root=/dev/sda1 ro" -d redhat_mips.img vmlinux-2.4.31

If you need to boot into single user mode, change options to `-o "root=/dev/sda1 rw init=/bin/sh"`.

### OpenBSD/sgi:

OpenBSD/sgi can (almost) run in GXemul on an emulated O2 (SGI-IP32) with root on nfs.

NOTE: I haven't succeeded all the way with this yet, and this shows/triggers many bugs in the emulator, but some of it works.

GXemul does not yet emulate the AHC PCI SCSI controller in the O2. (I have mailed Adaptec several times, asking for documentation, but never received any reply.) OpenBSD/sgi can still run in the emulator, as long as it doesn't use SCSI. For a simple test with the ramdisk (install) kernel, try dowloading

    	ftp://ftp.se.openbsd.org/pub/OpenBSD/4.0/sgi/bsd.rd

and run `gxemul -xeo2 bsd.rd`.

It might also be possible to netboot. Another emulated machine must then be used as the nfs root server, and the emulated O2 machine must boot as a diskless client. Performing this setup is quite time consuming, but necessary:

1. First of all, the "`nfs server`" machine must be set up. This needs to have a 800 MB `/tftpboot` partition. Install NetBSD/pmax 3.1 from CDROM. (Don't forget to add the extra partition!)

2. Configure the nfs server machine to act as an nfs server. Start up the emulated DECstation:

       	gxemul -e 3max -d nbsd_pmax.img

   and enter the following commands as `root` inside the emulator:

   `` |
       echo hostname=server >> /etc/rc.conf
       echo ifconfig_le0=\"inet 10.0.0.2\" >> /etc/rc.conf
       echo nameserver 10.0.0.254 >> /etc/resolv.conf
       echo 10.0.0.254 > /etc/mygate
       echo /tftpboot -maproot=root 10.0.0.1 > /etc/exports
       echo rpcbind=YES >> /etc/rc.conf
       echo nfs_server=YES >> /etc/rc.conf
       echo mountd=YES >> /etc/rc.conf
       echo bootparamd=YES >> /etc/rc.conf
       printf "client root=10.0.0.2:/tftpboot \\\n swap=10.0.0.2:/tftpboot/swap\n" > /etc/bootparams
       echo "10:20:30:00:00:10 client" > /etc/ethers
       echo 10.0.0.1 client > /etc/hosts
       reboot

3. Start the DECstation emulation again, and enter the following commands to download the OpenBSD/sgi distribution:
   (NOTE: This takes quite some time, even if you have a fast network connection.)

   `` |
       cd /tftpboot; ftp -i ftp.se.openbsd.org
       (log in as anonymous...)
       cd pub/OpenBSD/4.0/sgi
       mget b*tgz c*tgz e* g* m*
       quit
       sh
       for a in *.tgz; do echo $a; tar zxfp $a; done
       echo 10.0.0.2:/tftpboot / nfs rw 0 0 > /tftpboot/etc/fstab
       rm *.tgz
       dd if=/dev/zero of=swap bs=1024 count=32768
       halt

4. Download the OpenBSD/sgi GENERIC and RAMDISK kernels:

       	ftp://ftp.se.openbsd.org/pub/OpenBSD/4.0/sgi/bsd
       	ftp://ftp.se.openbsd.org/pub/OpenBSD/4.0/sgi/bsd.rd

5. Create a configuration file called `config_client`:

   `` |
       !  Configuration file for running OpenBSD/sgi diskless with
       !  a NetBSD/pmax machine as the nfs server.
       !
       !  This config file is for the client.

       net(
       	add_remote("localhost:12444")   ! the server
       	local_port(12445)               ! the client
       )

       machine(
       	name("client machine")
       	serial_nr(1)

               type("sgi")
               subtype("o2")

               ! load("bsd")
               load("bsd.rd")
       )

   ... and another configuration file for the server, `config_server`:

   `` |
       net(
       	local_port(12444)               ! the server
       	add_remote("localhost:12445")   ! the client
       )

       machine(
       	name("nfs server")
       	serial_nr(2)

               type("dec")
               subtype("5000/200")

               disk("nbsd_pmax.img")
       )

6. Boot the "`nfs server`" and the OpenBSD/sgi "`client machine`" as two separate emulator instances:

       	in one xterm:
       	gxemul @config_server

       	and then, in another xterm:
       	gxemul @config_client

7. In the OpenBSD/sgi window, choose "`s`" (for Shell), and type:

   `` |
       ifconfig mec0 10.0.0.1; route add default 10.0.0.254
       mount -v 10.0.0.2:/tftpboot /mnt
       cd /mnt/dev; ./MAKEDEV all; cd /; umount /mnt
       halt

   You might want to log in as `root` on the server machine, and run `tcpdump -lnvv` or similar, to see that what the client machine actually does on the network. The `MAKEDEV` script takes almost forever, so be patient.

NOTE: Everything up to this point should work. However, the next step (in gray) doesn't actually work:

Once everything has been set up correctly, change `bsd.rd` in `config_client` to just `bsd` (the GENERIC kernel). It should now be possible to boot OpenBSD/sgi using the NetBSD/pmax nfs server. (When asked for "`root device :`" on the OpenBSD machine, enter `mec0`.)

But it doesn't work. Probably because GXemul's implementation of the mec (ethernet card used in the O2) is too much of a quick hack. For now, use the `bsd.rd` kernel, and (at every boot) type:

    	s  (for Shell)
    	ifconfig mec0 10.0.0.1; route add default 10.0.0.254
    	mount -v 10.0.0.2:/tftpboot /mnt
    	cd /mnt; usr/sbin/chroot .
    	sh etc/rc

This will not cause OpenBSD to be booted normally, but at least a few basic things will work. By the way, the emulator performs so poorly, that you will have time to fetch several cups of coffee for each of the steps above.

### OpenBSD/arc:

It is (almost) possible to install and run OpenBSD/arc on an emulated Acer PICA-61 in the emulator.

Earlier, I had this guest OS listed as officially working in the emulator, but for several reasons, it has been moved down here to the "informative-but-not-really-working" section.

- The last OpenBSD/arc release was 2.3. This means that it is very old, it would not give a fair picture of what OpenBSD is (if you are just looking to find out what it is like), and it is not worth experimenting with it. See http://www.openbsd.org/arc.html for more information.
- OpenBSD/arc was (if I understood things correctly) never really stable, even on real hardare. Problems with too small an interrupt stack. Bugs are triggered in the emulator that have to do with issues such as this.

Currently, I don't test for every release whether or not OpenBSD/arc can be installed. Releases prior to 0.3.7 (but probably not 0.3.7) should work. Anyway, here are the old installation instructions:

To install OpenBSD/arc onto an emulated harddisk image, follow these instructions:

1. Create an empty harddisk image, which will be the root disk that OpenBSD installs itself onto:

       	dd if=/dev/zero of=obsd_arc.img bs=1024 count=1 seek=700000

2. Download the entire arc directory from the ftp server: (approx. 75 MB)

       	wget -np -l 0 -r ftp://ftp.se.openbsd.org/pub/OpenBSD/2.3/arc/

3. You now need to make an ISO image of the entire directory you downloaded. (I recommend using `mkisofs` for that purpose. If you don't already have `mkisofs` installed on your system, you need to install it in order to do this.)

       	mkisofs -o openbsd_arc_2.3.iso ftp.se.openbsd.org/pub/OpenBSD/

4. Start the emulator using this command line:

       	gxemul -e pica -X -d obsd_arc.img -d b:openbsd_arc_2.3.iso -j 2.3/arc/bsd.rd

   and proceed like you would do if you were installing OpenBSD on a real Acer PICA-61. (Answer 'no' when asked if you want to configure networking, and then install from CD-ROM.)

Once the install has finished, the following command should let you boot from the harddisk image:

    	gxemul -X -e pica -d obsd_arc.img ftp.se.openbsd.org/pub/OpenBSD/2.3/arc/bsd

The system is very sensitive to (I think) kernel stack overflow, so it crashes easily. If I remember correctly from mailing lists, this also happened on real hardware.

### OpenBSD/luna88k:

IT DOES NOT WORK YET!

These instructions are here mostly for me to remember how to debug/proceed:

Download a RAMDISK kernel:

- https://ftp.eu.openbsd.org/pub/OpenBSD/5.4/luna88k/bsd.rd
- https://ftp.eu.openbsd.org/pub/OpenBSD/5.9/luna88k/bsd.rd
- https://ftp.eu.openbsd.org/pub/OpenBSD/6.2/luna88k/bsd.rd

For 5.4 and below:

    	gxemul -e luna-88k 0x20000:0x20:bsd.rd

or for the newer ones:

    	gxemul -e luna-88k bsd.rd

From 6.0 and newer, bugs are triggered (most likely in GXemul):

    	panic: amap_wipeout: corrupt amap

The 5.9 kernel gets further than 6.0 (reaching userland), but it seems that OpenBSD was compiled with too heavy optimizations, so the framebuffer scroll up routine does not contain any loads or stores.

Using a breakpoint `-p om1_windowmove` in both OpenBSD 5.9 and 6.2 indicates that 5.9 must have been optimized too heavily; it loops when trying to copy pixels to scroll up the text, but the loop contains "nothing":

    s001553b8: 64e70001	subu	r7,r7,1
    s001553bc: 61270001	addu	r9,r7,1
    s001553c0: ec4c0004	bcnd.n	eq0,r12,0x001553d0	; <om1_windowmove+0x3b0>
    s001553c4: 59600000 (d)	or	r11,r0,0x0
    s001553c8: f1a08832	set	r13,r0,1<18>
    s001553cc: f562600d	addu	r11,r2,r13
    s001553d0: 60420004	addu	r2,r2,4
    s001553d4: eda9fff9	bcnd.n	ne0,r9,0x001553b8	; <om1_windowmove+0x398>
    s001553d8: 616b0004 (d)	addu	r11,r11,4
    s001553b8: 64e70001	subu	r7,r7,1
    ...

compared to what it looks like in 6.2:

    s001547a4: 64e70001	subu	r7,r7,1
    s001547a8: 61270001	addu	r9,r7,1
    s001547ac: 60420004	addu	r2,r2,4
    s001547b0: eda9fffa	bcnd.n	ne0,r9,0x00154798	; <om1_windowmove+0x398>
    s001547b4: 616b0004 (d)	addu	r11,r11,4
    s00154798: edac003e	bcnd.n	ne0,r12,0x00154890	; <om1_windowmove+0x490>
    s0015479c: f1208832 (d)	set	r9,r0,1<18>
    s00154890: f5021409	ld	r8,r2,r9	; [0xb10c958c]
    s00154894: c7ffffc4	br.n	0x001547a4	; <om1_windowmove+0x3a4>
    s00154898: f500240b (d)	st	r8,r0,r11	; [0xb1087f8c]
    s001547a4: 64e70001	subu	r7,r7,1

Note the actual loads and stores to video ram (0xb10.....).

Going back all the way to an old 5.4 kernel allows the framebuffer to be used:

    	gxemul -X -e luna-88k 0x20000:0x20:bsd.rd

The following is not needed in order to experiment with booting OpenBSD, but can be interesting nonetheless: Download https://ftp.eu.openbsd.org/pub/OpenBSD/6.2/luna88k/boot and try

    	gxemul -v -e luna-88k 0x00700000:0x20:0x00700000:boot

### Debian GNU/Linux for CATS:

Debian GNU/Linux for CATS (ARM) could theoretically run in GXemul, however:

- The DEC 21143 NIC is not emulated well enough for Linux to accept it.
- Development of Debian for CATS seems to have died? The latest install kernel is quite old.

IT DOES NOT WORK YET!

The following installation instructions would theoretically work:

1. Create an empty harddisk image, which will be the root disk that Debian installs itself onto:

       	dd if=/dev/zero of=debian_cats.img bs=1024 count=1 seek=3300000

2. Download the tftpboot install kernel:

       	http://ftp.debian.org/debian/dists/oldstable/main/disks-arm/current/cats/tftpboot.img

3. Start the installation using the following command line:

       	gxemul -XEcats -d debian_cats.img tftpboot.img

It doesn't work, though, because the NIC isn't working well enough.

The only use of Debian/CATS in the emulator right now is as a way to manipulate Linux disk images, if you are on a non-Linux host. By choosing "Execute a shell" in the installer's menu, you can have access to tools such as fdisk and mke2fs, which are useful for creating Linux paritions on disk images.

### Linux/Malta (variant 1):

The Malta emulation mode is best suited for running NetBSD/evbmips, however, it is possible to experiment with Linux/Malta as well.

The general idea behind Linux/Malta seems to be that the end user always compiles his/her own kernel, applies patches, downloads userland separately, etc. For that reason, Linux/Malta support in the emulator is not tested for every release (sometimes it works, sometimes it doesn't work), and these instructions are kind of "fuzzy".

1. Create an empty harddisk image, which will be the root disk that Linux/Malta will be installed onto:

       	dd if=/dev/zero of=linux.img bs=1024 count=1 seek=5000000

2. Download a MIPS root filesystem tree:

       	ftp://ftp.linux-mips.org/pub/linux/mips/mipsel-linux/root/mipsel-root-20011216.tgz
       	19486676 bytes, md5 = 5bcb725c90209479cd7ead8ad0c4a414

   This is an old Redhat tree from 2001, but it seems to almost work.

3. Download one precompiled Malta kernel, with ramdisk, and one without ramdisk (which will be used later on when booting from disk):

       	TODO

4. Start the emulator with the ramdisk kernel, create a MS-DOS style MBR on the disk, create the filesystem, and extract the userland files:

       	gunzip vmlinux_2.*
       	gunzip mipsel-root-20011216.tar
       	gxemul -xemalta -d linux.img -d mipsel-root-20011216.tar vmlinux_2.4.33.2-ide-pci-ramdisk.elf
       	Inside GXemul: Log in as root and execute the following commands:
       	fdisk /dev/hda
       	(enter suitable commands, e.g. n, p, 1, 1, 9921, w)
       	mkfs /dev/hda1
       	mount /dev/hda1 /mnt
       	cd /mnt; tar -xf /dev/hdb; cd ..
       	umount /mnt; sync; reboot

It should now be possible to boot from the disk image, using the following command:

    	gxemul -xemalta -d linux.img -o "root=/dev/hda1 rw" vmlinux_2.6.18-rc4-ide-pci-novty.elf

There's a slight problem with this specific Redhat tree, so when you see the message "Configuring kernel parameters: [ OK ]", press CTRL-C once.

### Linux/Malta (variant 2):

The Malta emulation mode is best suited for running NetBSD/evbmips, however, it is possible to experiment with Linux/Malta as well.

It is also possible to experiment with much newer Linux userland, compared to the Linux/Malta variant 1 above, by using a kernel and disk image from http://people.debian.org/~aurel32/qemu/mipsel/. THIS DOES NOT WORK YET!

1. Download the Malta kernel and disk image:

       	wget http://people.debian.org/~aurel32/qemu/mipsel/vmlinux-2.6.26-1-4kc-malta
       	wget http://people.debian.org/~aurel32/qemu/mipsel/debian_lenny_mipsel_small.qcow.gz (142 MB)

2. The disk image is both compressed and in QEMU format, so we need to extract it:

       	gunzip debian_lenny_mipsel_small.qcow.gz
       	qemu-img convert -f qcow -O raw debian_lenny_mipsel_small.qcow debian_lenny_mipsel_small.raw

   (`qemu-img` actually requires that you have QEMU installed.)

It should now be possible to boot from the disk image, using the following command:

    	gxemul -e malta -d debian_lenny_mipsel_small.raw -o "root=/dev/hda1 console=ttyS0" vmlinux-2.6.26-1-4kc-malta

NOTE: IT DOES NOT WORK YET!

### Linux/QEMU_MIPS:

I've added a machine mode which emulates the MIPS machine mode used in Fabrice Bellard's QEMU. Starting with QEMU 0.9.0, there are other MIPS modes in QEMU (i.e. Malta); the QEMU_MIPS mode in GXemul refers to the old QEMU-specific MIPS machine.

The following steps should let you boot into the Linux/QEMU_MIPS kernel, in way similar to the `run-qemu` script:

1. Download the archive from http://wiki.qemu.org/Download and extract it:

       	wget http://wiki.qemu.org/download/mips-test-0.2.tar.gz
       	tar zxvf mips-test-0.2.tar.gz

2. Start GXemul using the following command line:

       	gxemul -E qemu_mips -x -M 128 -o 'console=ttyS0
       		rd_start=0x80800000 rd_size=10000000 init=/bin/sh'
       		0x80800000:mips-test/initrd.gz mips-test/vmlinux-2.6.18-3-qemu

### Windows NT/MIPS:

Old versions of Windows NT could run on MIPS hardware, e.g. the PICA 61. It is theoretically possible that the emulation provided by GXemul some day could be stable/complete enough to emulate such hardware well enough to fool Windows NT into thinking that it is running on a real machine. IT DOES NOT WORK YET!

Installation steps similar to these would be required to install Windows NT onto a disk image:

1. Put a "Windows NT 4.0 for MIPS" CDROM (or similar) into your CDROM drive. (On FreeBSD systems, it is usually called `/dev/cd0c` or similar. Change that to whatever the CDROM is called on your system, or the name of a raw .iso image. I have tried this with the Swedish version, but it might work with other versions too.)

2. Create an empty harddisk image, which will be the disk image that you will install Windows NT onto:

       	dd if=/dev/zero of=winnt_test.img bs=1024 count=1 seek=999000

3. Run the ARC installer, to partition the disk image:

       	gxemul -X -e pica -d winnt_test.img -d bc6:/dev/cd0c -j MIPS\\ARCINST

   Note that `ARCINST` almost works, but not quite.

4. Run the SETUP program:

       	gxemul -X -e pica -d winnt_test.img -d bc6:/dev/cd0c -j MIPS\\SETUPLDR

`SETUPLDR` manages to load some drivers from the cdrom, but then it crashes because of incomplete emulation of some hardware devices.

### NetBSD/playstation2:

This doesn't work, and the playstation2 port of NetBSD is dead at the time of writing this.

To attempt to run the latest snapshot (from 2002):

1. Download ftp://ftp.netbsd.org/pub/NetBSD/arch/playstation2/snapshot/20020327/binary/kernel/netbsd-GENERIC.gz and run

       	gxemul -X -E playstation2 netbsd-GENERIC.gz

Supplying a disk image with `-d` almost works. Then it hangs, waiting for keyboard input from a keyboard which doesn't exist.

### NetBSD/raspberrypi:

This doesn't work yet. Starting point for development:

See http://wiki.netbsd.org/ports/evbarm/raspberry_pi/ for more info on NetBSD.

To start debugging/development:

1. Download something similar to:

       	http://nyftp.netbsd.org/pub/NetBSD-daily/HEAD/201310032210Z/evbarm/binary/kernel/netbsd-RPI.gz

2. `gxemul -tviK -E rpi netbsd-RPI.gz`

TODO: Everything.

    GXemul> u
    <kernel_text>
    c00081e0:  e10f1000	mrs	r1,CPSR
    c00081e4:  e166f001	msr	SPSR_sx,r1
    c00081e8:  e28f1048	add	r1,pc,#0x48
    c00081ec:  e8912106	ldmia	r1,{r1,r2,r8,sp}
    c00081f0:  ee0d8f90	mcr	15,0,r8,cr13,cr0,4

    It starts up in kernel_text, which is in NetBSD usr/src/sys/arch/arm/arm32/locore.S:

    ENTRY_NP(kernel_text)

    ASENTRY_NP(start)
            mrs     r1, cpsr                /* fetch CPSR value */
            msr     spsr_sx, r1             /* set SPSR[23:8] to known value */

            adr     r1, .Lstart
            ldmia   r1, {r1, r2, r8, sp}    /* Set initial stack and */

    #if defined(TPIDRPRW_IS_CURCPU) || defined(TPIDRPRW_IS_CURLWP)
            mcr     p15, 0, r8, c13, c0, 4
    #endif
    #if defined(TPIDRPRW_IS_CURLWP)
            ldr     r8, [r8, #L_CPU]        /* r8 needs curcpu in it */
    #endif

            mov     r4, #0
    #ifdef _ARM_ARCH_DWORD_OK
            mov     r5, #0
    #endif

Also useful for testing:

    https://github.com/raspberrypi/firmware/blob/master/boot/kernel.img
    gxemul -tvK -E rpi 0x00000000:kernel.img

FreeBSD sd card image:

    http://www.db.net/downloads/bsd-pi-250580M.img.xz
    # Extract the kernel from the second (2) slice' first partition (a):
    mdconfig -a -t vnode -f bsd-pi-250580M.img
    mount /dev/md0s2a /mnt/
    cp /mnt/boot/kernel/kernel* .
    umount /mnt
    mdconfig -d -u 0
    gxemul -tK -E rpi kernel

### Linux/VoCore:

This doesn't work yet. Only serial console output is implemented, nothing else. Starting point for development:

See http://vocore.io/v1d.html for info about the first VoCore model. (There are some newer ones too.)

See https://openwrt.org/toh/vocore/vocore?datasrt=model for downloadable Linux kernel files etc.

To start debugging/development:

1. Download http://downloads.lede-project.org/releases/17.01.4/targets/ramips/rt305x/lede-17.01.4-ramips-rt305x-vocore-16M-initramfs-kernel.bin

2.     dd if=lede-17.01.4-ramips-rt305x-vocore-16M-initramfs-kernel.bin of=apa bs=64 iseek=1 oseek=0
       lzma -d < apa > apa2

3. `gxemul -E vocore 0x80000000:0:0x80000000:apa2`

ORIGINAL kernel (from vocore.io):

1. Download http://vonger.cn/upload/vocore.dock2.bin (which may be corrupt? lzma complains...)

2.     dd if=vocore.dock2.bin of=apa5 bs=64 iseek=1 oseek=0
       lzma -dv < apa5 > apa6

3. `gxemul -E vocore 0x80000000:0:0x80000000:apa6`

TODO: Pretty much Everything.

### FreeBSD/VoCore:

This doesn't work yet. See comments about Linux above.

According to https://lists.freebsd.org/pipermail/freebsd-mips/2016-January/004332.html, a kernel at https://www.dropbox.com/s/nkwzx5omtx3ye7t/kernel.uboot.rt5350?dl=0 can be experimented with:

    kernel.uboot.rt5350: u-boot legacy uImage, FreeBSD Kernel Image, Linux/MIPS, OS Kernel Image (gzip), 1467294 bytes, Tue Dec 29 17:04:13 2015, Load Address: 0x80001120, Entry Point: 0x80001120, Header CRC: 0x3F6D1694, Data CRC: 0x6AF182B5

    dd if=kernel.uboot.rt5350 of=apa3 bs=64 iseek=1 oseek=0
    gunzip < apa3 > apa4

    gxemul -VEvocore 0x80001120:0:0x80001120:apa4

TODO: Pretty much Everything.