linux-kernel-module-cheat

My goal is to emulate the ARM A9 processor as found on the Zynq-7000, running baremetal software.  I have tried 2 different approaches to this and run into road blocks on both.  Any suggestions on how to proceed would be appreciated.

• How to make bare metal ARM programs and run them on QEMU?

which links to
Linux Kernel Module Cheat (LKMC, using v3.0)
built using ./build --arch arm qemu-baremetal

The examples on the site of using the ARM virtual machine (-virt flag) work fine. Trying to modify this to work with my setup is what's causing problems (details below).

• How to run a bare metal ELF file on QEMU?

I tried to copy the example command line invocation, but with the -cpu cortex-a9 option instead:
qemu-system-arm: mach-virt: CPU cortex-a9 not supported
Then I changed the whole invocation to be
qemu-system-arm -M xilinx-zynq-a9 -cpu cortex-a9 -nographic -kernel hello.elf -m 512M -serial mon:stdio -s -S
And it crashed with the error
qemu: fatal: Trying to execute code outside RAM or ROM at 0x40000000
Which makes sense, because the application was built with the LKMC, and I was trying to run it outside of that framework.

So then I tried running my own application, which was compiled using a modified version of the Xilinx toolchain. I'm sure it won't work right away, as there will be some parts of the bootup sequence that I have to change. But I'm trying to figure out what those are and change them. Running with
qemu-system-arm -M xilinx-zynq-a9 -cpu cortex-a9 -nographic -kernel helloworld.elf -m 512M -serial mon:stdio -s -S
allows GDB to connect successfully, but it can't read the symbol table properly. Using
arm-none-eabi-objdump -D helloworld.elf
tells me that main is at 0x001004fc, but GDB thinks it's at 0x40000324 (using the command info address main).

The PYNQ-Z1 (webpage, datasheet) has a 32-bit ARM Cortex-A9 processor, so that's why I'm using qemu-system-arm instead of qemu-system-aarch64. Someone can correct me if that's wrong.

As a note, I cannot simply switch to a different architecture; the code that I am using cannot tolerate changes other than small tweaks to make the Board Support Package (BSP) compatible with the simulator, without harming the validity of my research.

What I have been going off of for a while now is
./run --arch arm -m 512M --baremetal pynq/helloworld --wait-gdb
./run-gdb --arch arm --baremetal pynq/helloworld --no-continue -- main
and I step through using GDB to find where there are data aborts and figure out what kind of hardware is not supported by Qemu.

The software that I am running is built using a modified Xilinx toolchain, and so includes many of the Xilinx standard library functions.  In modifying the code to work with the virtual machine, I have discovered a few changes so far, such as changing the address of the UART device and disabling some boot-up tasks such as invalidating the SCU or changing the cache controller configuration, presumably because these things are not emulated by Qemu.

When debugging bootup, the next problem I have run into booting up is the XTime functions (xtime_l.c).  These functions are wrappers around reading the global system timer.  The results of the command info mtree in the Qemu interface seem to indicate that there is no global timer device with which to interact.  Is there a way to add a timer device to the ARM virtual machine? It doesn't matter what the base address is, as long as it can be used in the same way as on the Zynq, using register reads and writes.

Then I tried to use the specific machine flag xilinx-zynq-a9.  LKMC generates the following command: