diff --git a/THOUGHTS.txt b/THOUGHTS.txt
index 4ae73dc..2e2df44 100644
--- a/THOUGHTS.txt
+++ b/THOUGHTS.txt
@@ -2436,3 +2436,17 @@ Sun Sep 17 16:44:31 BST 2023
 Can we figure out which bits of the old doc are missing from the new
 one and just transplant those? Then we can merge it sooner
 instead of blocking on writig all the new stuff
+
+We need to find a nice place for an introduction to choosing
+rootfsType
+
+Mon Sep 18 17:07:56 BST 2023
+
+Let's see if we can hack up an aarch64 qemu port
+
+From https://gist.github.com/oznu/ac9efae7c24fd1f37f1d933254587aa4 :
+
+curl -L https://releases.linaro.org/components/kernel/uefi-linaro/latest/release/qemu64/QEMU_EFI.fd -O
+dd if=/dev/zero of=flash1.img bs=1M count=64
+dd if=/dev/zero of=flash0.img bs=1M count=64
+dd if=QEMU_EFI.fd of=flash0.img conv=notrunc
diff --git a/default.nix b/default.nix
index 5f23d16..46692fa 100644
--- a/default.nix
+++ b/default.nix
@@ -16,6 +16,7 @@ let
       ];
     };
   });
+  pkgsNative = pkgs.pkgsBuildBuild;
 
   config = (pkgs.lib.evalModules {
     modules = [
@@ -49,16 +50,19 @@ in {
   # cross-compiling nix-shell for any package we're customizing
   inherit pkgs;
 
-  buildEnv = pkgs.mkShell {
-    packages = with pkgs.pkgsBuildBuild; [
-      tufted
-      routeros.routeros
-      routeros.ros-exec-script
-      mips-vm
-      borderVm.build.vm
-      go-l2tp
-      min-copy-closure
-      fennelrepl
-    ];
-  };
+  buildEnv =
+    pkgs.mkShell {
+      packages =
+        with pkgsNative; [
+        tufted
+        routeros.routeros
+        routeros.ros-exec-script
+        borderVm.build.vm
+        go-l2tp
+        min-copy-closure
+        fennelrepl
+        (mips-vm.override { inherit (pkgs) ubootQemuAarch64; })
+      ];
+
+    };
 }
diff --git a/devices/qemu-aarch64/default.nix b/devices/qemu-aarch64/default.nix
new file mode 100644
index 0000000..0c33b64
--- /dev/null
+++ b/devices/qemu-aarch64/default.nix
@@ -0,0 +1,92 @@
+# This "device" generates images that can be used with the QEMU
+# emulator. The default output is a directory containing separate
+# kernel (uncompressed vmlinux) and initrd (squashfs) images
+{
+  system = {
+    crossSystem = {
+      config = "aarch64-unknown-linux-musl";
+    };
+  };
+
+  module = {pkgs, config, ... }: {
+    kernel = {
+      src = pkgs.pkgsBuildBuild.fetchurl {
+        name = "linux.tar.gz";
+        url = "https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.71.tar.gz";
+        hash = "sha256-yhO2cXIeIgUxkSZf/4aAsF11uxyh+UUZu6D1h92vCD8=";
+      };
+      config = {
+        CPU_LITTLE_ENDIAN= "y";
+        CPU_BIG_ENDIAN= "n";
+
+        VIRTUALIZATION = "y";
+        ACPI="y";
+        ARM64_VA_BITS_48="y";
+        # ARM_MHU="y";
+        # PLATFORM_MHU="y";
+        ARM_SMMU="y";
+        ARM_SMMU_V3="y";
+        ARCH_VEXPRESS = "y";
+
+        
+        PCI_HOST_GENERIC="y";
+
+        MTD = "y";
+        MTD_BLOCK2MTD = "y";
+        MTD_BLKDEVS = "y";
+        MTD_BLOCK = "y";
+
+        VIRTIO_MENU = "y";
+        PCI = "y";
+        VIRTIO_PCI = "y";
+        BLOCK = "y";
+        VIRTIO_BLK = "y";
+        NETDEVICES = "y";
+        VIRTIO_NET = "y";
+
+        # https://stackoverflow.com/a/68340492
+        CMDLINE="\"earlycon=ttyS0 console=ttyS0\"";
+        CMDLINE_FROM_BOOTLOADER = "y";
+        ARM64 = "y";
+        PINCTRL = "y";
+        
+        EFI_EARLYCON = "y";
+        SERIAL_EARLYCON_ARM_SEMIHOST = "y"; # earlycon=smh
+        SERIAL_AMBA_PL011 = "y";
+        SERIAL_AMBA_PL011_CONSOLE = "y";
+
+        SERIAL_8250= "y";
+        SERIAL_8250_CONSOLE= "y";
+        SERIAL_EARLYCON = "y";
+        
+      };
+    };
+    hardware =
+      let
+        mac80211 =  pkgs.mac80211.override {
+          drivers = ["mac80211_hwsim"];
+          klibBuild = config.system.outputs.kernel.modulesupport;
+        };
+      in {
+        defaultOutput = "vmroot";
+        loadAddress = "0x0";
+        entryPoint  = "0x0";
+        dts.src = ./empty.dts;
+        rootDevice = "/dev/mtd1";
+
+        flash.eraseBlockSize = "65536"; # c.f. pkgs/mips-vm/mips-vm.sh
+        networkInterfaces =
+          let inherit (config.system.service.network) link;
+          in {
+            wan = link.build { ifname = "eth0"; };
+            lan = link.build { ifname = "eth1"; };
+
+            wlan_24 = link.build {
+              ifname = "wlan0";
+              dependencies = [ mac80211 ];
+            };
+          };
+      };
+
+  };
+}
diff --git a/devices/qemu-aarch64/empty.dts b/devices/qemu-aarch64/empty.dts
new file mode 100644
index 0000000..9998882
--- /dev/null
+++ b/devices/qemu-aarch64/empty.dts
@@ -0,0 +1,3 @@
+/dts-v1/;
+
+/ { };
\ No newline at end of file
diff --git a/kernel/uimage.nix b/kernel/uimage.nix
index c92faa8..8e57bc3 100644
--- a/kernel/uimage.nix
+++ b/kernel/uimage.nix
@@ -6,6 +6,7 @@
 } :
 let
   objcopy = "${stdenv.cc.bintools.targetPrefix}objcopy";
+  arch = "arm64";
 in {
   kernel
 , commandLine
@@ -40,7 +41,7 @@ stdenv.mkDerivation {
   buildPhase = ''
     ${objcopy} -O binary -R .reginfo -R .notes -R .note -R .comment -R .mdebug -R .note.gnu.build-id -S vmlinux.elf vmlinux.bin
     rm -f vmlinux.bin.lzma ; lzma -k -z  vmlinux.bin
-    mkimage -A mips -O linux -T kernel -C lzma -a ${loadAddress} -e ${entryPoint} -n 'MIPS Liminix Linux ${extraName}' -d vmlinux.bin.lzma kernel.uimage
+    mkimage -A ${arch} -O linux -T kernel -C lzma -a ${loadAddress} -e ${entryPoint} -n '${arch} Liminix Linux ${extraName}' -d vmlinux.bin.lzma kernel.uimage
   '';
   installPhase = ''
     cp kernel.uimage $out
diff --git a/modules/kernel.nix b/modules/kernel.nix
index d9e5178..b215ab7 100644
--- a/modules/kernel.nix
+++ b/modules/kernel.nix
@@ -56,9 +56,9 @@ in {
         MODULE_SIG = if modular then "y" else "n";
         DEBUG_FS = "y";
 
-        MIPS_BOOTLOADER_CMDLINE_REQUIRE_COOKIE = "y";
-        MIPS_BOOTLOADER_CMDLINE_COOKIE = "\"liminix\"";
-        MIPS_CMDLINE_DTB_EXTEND = "y";
+        # MIPS_BOOTLOADER_CMDLINE_REQUIRE_COOKIE = "y";
+        # MIPS_BOOTLOADER_CMDLINE_COOKIE = "\"liminix\"";
+        # MIPS_CMDLINE_DTB_EXTEND = "y";
 
         # basic networking protocols
         NET = "y";
diff --git a/modules/outputs.nix b/modules/outputs.nix
index b0edf17..3bc5bb6 100644
--- a/modules/outputs.nix
+++ b/modules/outputs.nix
@@ -76,11 +76,12 @@ in
         inherit dtb;
       };
       # could use trivial-builders.linkFarmFromDrvs here?
-      vmroot = pkgs.runCommand "qemu" {} ''
+      vmroot = pkgs.runCommandCC "vmroot" {} ''
         mkdir $out
         cd $out
         ln -s ${config.system.outputs.rootfs} rootfs
         ln -s ${kernel} vmlinux
+        ${pkgs.stdenv.cc.targetPrefix}objcopy -O binary -S ${kernel} Image
         ln -s ${manifest} manifest
         ln -s ${kernel.headers} build
       '';
diff --git a/pkgs/kernel/default.nix b/pkgs/kernel/default.nix
index b2b8b9f..1ca4cd6 100644
--- a/pkgs/kernel/default.nix
+++ b/pkgs/kernel/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "-I${openssl.dev}/include -L${openssl.out}/lib -L${ncurses.out}/lib";
   PKG_CONFIG_PATH = "./pkgconfig";
   CROSS_COMPILE = stdenv.cc.bintools.targetPrefix;
-  ARCH = "mips";  # kernel uses "mips" here for both mips and mipsel
+  ARCH = "arm64";
   KBUILD_BUILD_HOST = "liminix.builder";
 
   dontStrip = true;
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    ./cmdline-cookie.patch
+#    ./cmdline-cookie.patch
   ];
 
   # this is here to work around what I think is a bug in nixpkgs
diff --git a/pkgs/mips-vm/default.nix b/pkgs/mips-vm/default.nix
index 21d268c..bd9dc46 100644
--- a/pkgs/mips-vm/default.nix
+++ b/pkgs/mips-vm/default.nix
@@ -1,12 +1,14 @@
 {
   qemu
 , socat
+, ubootQemuAarch64
 , writeShellScriptBin
 , symlinkJoin
 , lib
 }: let
   mips-vm = writeShellScriptBin "mips-vm" ''
      export PATH="${lib.makeBinPath [qemu]}:$PATH"
+     export UBOOT=${ubootQemuAarch64}/u-boot.bin
      ${builtins.readFile ./mips-vm.sh}
   '';
   connect = writeShellScriptBin "connect-vm" ''
diff --git a/pkgs/mips-vm/mips-vm.sh b/pkgs/mips-vm/mips-vm.sh
index 2f534ab..02852c4 100755
--- a/pkgs/mips-vm/mips-vm.sh
+++ b/pkgs/mips-vm/mips-vm.sh
@@ -39,11 +39,36 @@ if test -n "$3"; then
     initramfs="-initrd $3"
 fi
 
+cat <<_IGNORE
+fdt addr 5edbbdb0
+fdt set /chosen bootargs 'earlycon=smh console=ttyAMA0 rw root=/dev/vda'
+run bootcmd_qfw
+_IGNORE
 
 INIT=${INIT-/bin/init}
 echo $QEMU_OPTIONS
-qemu-system-mips \
-    -M malta -m 256 \
+set -x
+qemu-system-aarch64 \
+    -echr 16 \
+    -M virt  -m 512 \
+    -semihosting \
+    -cpu cortex-a72 -bios $UBOOT \
+    -drive file=$rootfs,format=raw,readonly=off,if=virtio,index=0 \
+    -kernel $1 \
+    -display none $flags
+
+
+exit
+
+    -device nand,chip_id=0x59,id=cheeky \
+    -drive file=$rootfs,format=raw,readonly=off,if=mtd,index=0,id=cheeky \
+
+
+-drive file=flash0.img,format=raw,if=pflash \
+    -drive file=flash1.img,format=raw,if=pflash \
+ # -D log.txt
+qemu-system-aarch64 \
+    -M virt,gic-version=max -cpu max -m 512 -D log.txt \
     -echr 16 \
     -append "liminix default console=ttyS0,38400n8 panic=10 oops=panic init=$INIT loglevel=8 root=/dev/mtdblock0 block2mtd.block2mtd=/dev/vda,65536" \
     -drive file=$rootfs,format=raw,readonly=off,if=virtio,index=0 \
diff --git a/shell.nix b/shell.nix
index 02b7cd8..aa11a21 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,7 +1,7 @@
 let
   nixpkgs = <nixpkgs>;
   liminix = (import ./default.nix {
-    device = (import ./devices/qemu);
+    device = (import ./devices/qemu-aarch64);
     liminix-config = ./vanilla-configuration.nix;
     inherit nixpkgs;
   });