Virtualizing QNX 2.15

Posted on by

(Note this is a guest post by Antoni Sawicki aka Tenox)

Enter 1988… around that time Microsoft just released MS-DOS 4.01 and IBM shipped OS/2 1.1. Compare to the other two, this QNX was years ahead of its time. Pretty much on every aspect. Now, some 25 years later QNX2 is still found running industrial machinery, clean rooms, avionics and military hardware. Some people report systems up and running non-stop for 15 years and longer!

It took me similar amount of time to acquire usable media set. QNX is an embedded system and never really seen life on a desktop machine, so finding these floppies was rather hard and expensive adventure. Fortunately I can finally let it see some daylight. Let’s examine how the system will install on a modern hardware under VMware Workstation.

qnx2-disks

The install is rather straight forward. Floppy boot comes with a login prompt.

qnx2-vmware-floppyboot

After you log in as qnx you need to swap the floppy disk to Boot Utilities and run install. The script guides you through setup steps.

qnx2-vmware-install

First you need to select the disk controller. For compatibility mode QNX 2 provides access via int 13 (real mode).

qnx2-vmware-disk
qnx2-vmware-part

Then you partition the disk. QNX partition type is either 7, 8 or 9. You will be asked to mark it bootable later on.

qnx2-vmware-kernel

Then you have to select the kernel. QNX can operate in real mode and protected mode on AT286. 

The install script copies all the data from distribution floppy disks, asks about boot loader and active partition. Finally you get to choose some video options.

qnx2-vmware-video

The system also asks about networking options. Unfortunately it only works with custom Arcnet cards so I skipped this. Once complete you are asked to remove the boot floppy disk and reboot the machine. This is what comes up after first hard disk boot.

qnx2-vmware-firstboot

I guess what is in the system will be the a topic of another post.

QNX 2.x files are here, a ready to run VMware image is here. Virtual Box here.

Updates:
You may also be be interested in QNX Windows and Fun with QNX 4 Networking posts.

48 thoughts on “Virtualizing QNX 2.15”

  3. It’s a difficult situation because the system is by no means dead or even obsolete. Dell Unix for instance was plainly abandoned and forgotten a long time ago. With QNX2 it’s unfortunately different. It’s still widely used in the embedded world. Worse, the manufacturer (QNX) still sells licenses for it. I have worked pretty hard to get my own copy.

    You can get aclock-demo bootable floppy which has a second console and few utilities like ls and tsk to play around. http://www.tenox.tc/out/aclock-qnx2-boot.img

    And don’t give hope, someone will probably eventually slip it away somewhere.

  4. The only available commands are in /cmds directory, I don’t think it is enough for cloning that aclock qnx2 fdimage onto a harddisk:

    C:\TEMP\WINDOWS>qemu-system-i386.exe -nographic -curses -fda aclock-patched-qnx2-boot.img -net none -snapshot -m 16
    [shortened]
    Login: /
    $ ls
    bitmap +boot +cmds +config
    $ ls boot
    os.2.21atp
    $ ls cmds
    aclock ed ls sh
    cat ed.macros mount timer
    colors login rtc tsk
    $ ls config
    float.slib sys.init
    $ mount
    Drive 1: Floppy, 1.4M, p=1
    $tty0 = $con , Colour at 0030
    $tty1 = $lpt , Parallel at 0378
    $tty2 = $sid , Colour at 0030
    $tty3 = $mdm , Serial at 03F8
    Library(6A): Software Math
    $

  6. That aclock disk boots in MESS. I’d be interested in hearing more about the NIC and the possibility of adding support for that to MESS (I wrote the NE2000 emulation for it).

    • Unfortunately QNX 2 does not support NE2000 or any other Ethernet. It only supports Arcnet, and not even generic. It only works with Corman Arcnet cards. Currently sold by http://www.betech.biz/ . I have a working Arcnet driver for Qemu but we are still short of Corman BIOS and chipset.

      • Is information about the qemu arcnet driver available somewhere? I’m assuming it’s for some other arcnet device? When I asked roughly 10 years ago, QNX didn’t want to give out details about how you interface to the card (which would obviously be useful if you wanted to emulate it), I guess if the cards are still being sold that might still be the case.

          • So the BIOS is the only special thing about them – you can get some other generic arcnet card which has documentation about its memory-mapped interface, and the only difference between that card and the QNX one is the BIOS?

            I can’t say I ever looked up any information about the various chips on the QNX arcnet card so wouldn’t know if they’re generally documented or not.

          • A late response but…

            So I know a little about Corman cards, not enough to write a driver. The card uses a standard Arcnet chip. The chip usually interfaces via io-ports. The Corman card has it engineered to use have those ports accessed as memory map. There is also the boot EPROM and some sort of EEPROM to store settings.

  7. If anyone wants QNX 4.25 floppy images and CD ISO I have copies. Did some major searching and found them tucked away on a server in Russia. Nothing has come up yet for QNX 2.x yet. 🙁 This is the holy grail ….I’ll keep looking.

    Cheers,
    Rob

  8. I have virtualized QNX2 and have it talking to a Siemens PLC running machine control software and this works great, but what is missing is the ARCNet connection. I also need to emulate this and was planning on writing a driver that sends ARCNet traffic over the local Ethernet network (as broadcast UDP traffic). I have several Corman ARCnet cards and confirm that it is using a standard SMC COM90C165LJ chipset and standard PHY drivers, but the issue is they’re using an FPGA (Actel A40MX02-F). The ROM bios is easy enough to copy, but it is unclear what precisely the function of the FPGA is. I believe the statement of an earlier user is correct, they are using memory mapped I/O to simplify access. I’ve purchased an ISA to USB converter and intent to interrogate the ARCNet card to see what I can learn.

    • I have just started working on a Corman Arcnet card, this one has the ROM BIOS extension for a Unisys ICON-PC. I can confirm that the purpose of the FPGA is to memory-map everything, and allow software controlled IRQ routing. QNX 2.1 manual states that diskless PC netbooting is possible.

      An earlier version of the Corman card is mentioned here:
      https://www.kernel.org/doc/Documentation/networking/arcnet-hardware.txt
      near the bottom… search for “Waterloo” or “Corman”

      Base address appears to be the EPROM
      0x1780 Microwire NVRAM port
      0x17a0 ARCNET node ID register
      0x17c0 COM9026
      0x17e0 – IRQ & LEDs?
      0x1800 2KiB Packet buffer

      I’ll continue disassembling the ROM.

  9. Today:

    I confirm that qnx2 10MB hdimage boots well in stock 0.74 dosbox.

    Earlier milestones: pce-ibmpc with both lowlevel xthd-controller driver and with int13h-biosonly qnx hd driver. 8086tiny with modded bios and image ripped from pce-ibmpc experiments.

    Next: pcem+8086

      • I think that a bare 200/16/63 qnx2-in-qemu install could work with the original bios in 8086tiny.
        Proven that the usual dummy bios c/h/s autodetection can be improved with only a little work.
        There is a thumbs rule set for deriving vintage MFM/RLL/IDE hd images’ parameters from size like:
        – #SPT must be 17, 26, 34, 35 or 63
        – 1<#HEADS<#SPT and #HEADS<=16
        – #CYLS<=1024, but rare exception when it is 1224
        – #SPT | #ALLSECTORS
        – #HEADS | #ALLSECTORS
        – #CYLS | #ALLSECTORS

        Unfortunately, intel 8086 DIV has glitches, it is usually better to hardcode a CHS lookup table upon common size values unless it is ambiguous like 820*6*17 === 615*8*17 and so on. Prime factorization of the total number of sectors seldom provides unique chs tuple solution.

        • and there is some fix you may missed:

          Fix DAA/DAS instruction bug
          github dot com/FOX21/8086tiny/commit/d9f36f482

          Fix ROL/ROR/RCL/RCR mem/reg, imm bug
          github dot com/FOX21/8086tiny/commit/f6f85d48f

          • Tried it, did not generate new bugs 🙂
            anyway, both pcix/86 and xenix8086 hang immediately after starting the vm. Trying to find it out in weekend.

            Anyway, such improvements likr DAA/RAR and classic 8086/8088-only opcode reuse in official “gaps” like C1=C3, C0=C2 etc is easy, just a minor modification of opcode lookup table is needed. The same apply to conditional jumps (0x70..0x7F maps to 0x60..0x6F )

  11. I’m taking a look (just for fun) to QNX 2 starting from the image availble at archive.org
    – via qemu -> https://archive.org/download/quantumqnx/qnx/qnx2/qnx2-hdd.rar
    – via vmware player -> https://archive.org/download/quantumqnx/qnx/qnx2/QNX2-VMware.rar

    Is it possible to mount a qnx-2 file system under Linux ?
    For ex. with a command similar to -> sudo mount -o loop -t msdos qnx2-fdd-boot.img mnt/floppy

    If not, is it the qnx-2 file system documented somewhere ?

    • I highly doubt it. When I was forced to use QNX, the workgroup server had a disk drive we could mount under the MS-DOS emulator and we could copy stuff in and out from that.

      Although the version we ran on the ICONs I’m sure wasn’t very stock. Although the model 2 stuff with it’s EGA hardware was enough to run SIERRA games.

    • Last I checked, there was no Linux support for the QNX 2 filesystem, but I seem to recall that the filesystem’s on-disk structure is documented in the manual.

  12. We actually still use QNX 2. We have a data acquisition system called Autonet that runs on QNX3.15 I think. I was told it’s just QNX2 in protected mode. We use Linksys ether16 NE2000 cards.

  13. we have a big printing offset machine ..Harris Heidelberg M3000 that use QNX2.2 OS …From MPC boots five macines in net without hard disks ..

Leave a Reply