qemu arm will not successfully load an uncompressed kernel because it hardcodes the load address as 0x40010000, which is not an offset of 0x8000 from a nice round number and apparently that offset is required. It will load a zImage (#liminix doesn’t currently build this target because we use U-boot everywhere else and why ship a self-extracting compressed kernel when that task can/should be performed by the bootloader) because they can relocate while uncompressing, and apparently it will also load a U-boot uimage - but looking at the source code I think it’ll only load the old-style uimage and not the FIT uimages that #liminix is using on arm{32,64}. Or I could use -device loader instead of -kernel and have full control of where it loads into, but then it’s not called with the DTB address in r2 as the linux kernel expects it to be.
So many options, none of them really very good…
Background reading upon which some of these assertions are based: https://people.kernel.org/linusw/how-the-arm32-kernel-starts