diff --git a/config/nuttx-qemu-armv7a-knsh.yaml b/config/nuttx-qemu-armv7a-knsh.yaml
new file mode 100644
index 0000000..aa431fd
--- /dev/null
+++ b/config/nuttx-qemu-armv7a-knsh.yaml
@@ -0,0 +1,32 @@
+# NuttX kernel-mode (CONFIG_BUILD_KERNEL=y) target for QEMU armv7a.
+#
+# The CMake build installs application binaries to <build>/bin and the
+# builder sets exec_cwd=<build> for kernel-mode cores, so the hostfs
+# mount data 'fs=.' maps /system to the build directory and
+# /system/bin/init resolves to <build>/bin/init. Semihosting is
+# required for the hostfs mount.
+
+config:
+  cwd: './external'
+  build_dir: './build'
+
+product:
+
+  name: "ntfc-armv7a-knsh"
+  cores:
+    core0:
+      name: 'main'
+      device: 'qemu'
+      exec_path: 'qemu-system-arm'
+      exec_args: '-semihosting -cpu cortex-a7 -nographic
+                 -machine virt,highmem=off,virtualization=off,gic-version=2
+                 -chardev stdio,id=con,mux=on -serial chardev:con
+                 -mon chardev=con,mode=readline'
+      defconfig: 'boards/arm/qemu/qemu-armv7a/configs/knsh'
+      boot_timeout: 15
+      kv:
+        CONFIG_INIT_MOUNT_DATA: "fs=."
+        # required by the arch/os ostest test case
+        CONFIG_SYSTEM_SETLOGMASK: "y"
+        # required by the arch/os heap stability test case
+        CONFIG_TESTING_HEAP: "y"
diff --git a/config/nuttx-qemu-armv8a-knsh.yaml b/config/nuttx-qemu-armv8a-knsh.yaml
new file mode 100644
index 0000000..c54e37f
--- /dev/null
+++ b/config/nuttx-qemu-armv8a-knsh.yaml
@@ -0,0 +1,32 @@
+# NuttX kernel-mode (CONFIG_BUILD_KERNEL=y) target for QEMU armv8a.
+#
+# The CMake build installs application binaries to <build>/bin and the
+# builder sets exec_cwd=<build> for kernel-mode cores, so the hostfs
+# mount data 'fs=.' maps /system to the build directory and
+# /system/bin/init resolves to <build>/bin/init. Semihosting is
+# required for the hostfs mount.
+
+config:
+  cwd: './external'
+  build_dir: './build'
+
+product:
+
+  name: "ntfc-armv8a-knsh"
+  cores:
+    core0:
+      name: 'main'
+      device: 'qemu'
+      exec_path: 'qemu-system-aarch64'
+      exec_args: '-semihosting -cpu cortex-a53 -nographic
+                 -machine virt,virtualization=on,gic-version=3
+                 -net none -chardev stdio,id=con,mux=on
+                 -serial chardev:con -mon chardev=con,mode=readline'
+      defconfig: 'boards/arm64/qemu/qemu-armv8a/configs/knsh'
+      boot_timeout: 15
+      kv:
+        CONFIG_INIT_MOUNT_DATA: "fs=."
+        # required by the arch/os ostest test case
+        CONFIG_SYSTEM_SETLOGMASK: "y"
+        # required by the arch/os heap stability test case
+        CONFIG_TESTING_HEAP: "y"
diff --git a/config/nuttx-qemu-intel64-knsh.yaml b/config/nuttx-qemu-intel64-knsh.yaml
new file mode 100644
index 0000000..95b727f
--- /dev/null
+++ b/config/nuttx-qemu-intel64-knsh.yaml
@@ -0,0 +1,39 @@
+# NuttX kernel-mode (CONFIG_BUILD_KERNEL=y) target for QEMU intel64.
+#
+# The knsh_romfs configuration loads user-space applications from a
+# ROMFS image linked into the kernel; there is no hostfs, so exec_cwd
+# is not relevant for the mount. Application command discovery uses the
+# <build>/bin directory registered by the builder.
+#
+# Requires NuttX with CMake kernel-build support for x86_64 (branch
+# fix-x86_64-cmake-kernel-build in the vendored checkout: arch_interface
+# guard, CMAKE_LD, relocatable binary install, board ROMFS generation).
+
+config:
+  cwd: './external'
+  build_dir: './build'
+
+product:
+
+  name: "ntfc-intel64-knsh"
+  cores:
+    core0:
+      name: 'main'
+      device: 'qemu'
+      exec_path: 'qemu-system-x86_64'
+      exec_args: '-m 2G -cpu host -enable-kvm -nographic -serial mon:stdio'
+      defconfig: 'boards/x86_64/qemu/qemu-intel64/configs/knsh_romfs'
+      boot_timeout: 15
+      kv:
+        # resolve bare command names against the ROMFS mount point
+        CONFIG_LIBC_ENVPATH: "y"
+        CONFIG_PATH_INITIAL: "/system/bin"
+        # required by the arch/os ostest test case
+        CONFIG_SYSTEM_SETLOGMASK: "y"
+        # required by the arch/os heap stability test case
+        CONFIG_TESTING_HEAP: "y"
+        # setlocale()/nl_langinfo(), referenced by the LTP strftime cases
+        CONFIG_LIBC_LOCALE: "y"
+        # without it SIGKILL is absent from the default action table and
+        # can be ignored, which the LTP sigignore cases check for
+        CONFIG_SIG_SIGKILL_ACTION: "y"
diff --git a/config/nuttx-qemu-riscv-rv-virt-knsh64.yaml b/config/nuttx-qemu-riscv-rv-virt-knsh64.yaml
new file mode 100644
index 0000000..08f4df1
--- /dev/null
+++ b/config/nuttx-qemu-riscv-rv-virt-knsh64.yaml
@@ -0,0 +1,31 @@
+# NuttX kernel-mode (CONFIG_BUILD_KERNEL=y) reference target.
+#
+# The knsh64 configuration is an S-mode build: QEMU boots its bundled
+# OpenSBI firmware (no '-bios none') and NTFC appends '-kernel <elf>'.
+#
+# The CMake build installs application binaries to <build>/bin and the
+# builder sets exec_cwd=<build> for kernel-mode cores, so the hostfs
+# mount data 'fs=.' maps /system to the build directory and
+# /system/bin/init resolves to <build>/bin/init.
+
+config:
+  cwd: './external'
+  build_dir: './build'
+
+product:
+
+  name: "ntfc-rv-virt-knsh64"
+  cores:
+    core0:
+      name: 'main'
+      device: 'qemu'
+      exec_path: 'qemu-system-riscv64'
+      exec_args: '-semihosting -M virt,aclint=on -cpu rv64 -smp 1 -nographic'
+      defconfig: 'boards/risc-v/qemu-rv/rv-virt/configs/knsh64'
+      boot_timeout: 15
+      kv:
+        CONFIG_INIT_MOUNT_DATA: "fs=."
+        # required by the arch/os ostest test case
+        CONFIG_SYSTEM_SETLOGMASK: "y"
+        # required by the arch/os heap stability test case
+        CONFIG_TESTING_HEAP: "y"
diff --git a/config/nuttx-serial-knsh.yaml.example b/config/nuttx-serial-knsh.yaml.example
new file mode 100644
index 0000000..db4b083
--- /dev/null
+++ b/config/nuttx-serial-knsh.yaml.example
@@ -0,0 +1,33 @@
+# Template for a kernel-mode (CONFIG_BUILD_KERNEL=y) hardware target
+# on a serial console. Copy, rename and fill in the board specifics.
+#
+# Kernel-mode hardware notes:
+# - There is no hostfs on hardware: application binaries must reach the
+#   target filesystem. Either the board defconfig bakes a ROMFS into the
+#   kernel image, or 'apps_image' generates one from <build>/bin and the
+#   'flash' command writes it with $APPS_IMG.
+# - When NTFC builds the image, command discovery uses <build>/bin. For
+#   prebuilt images (no 'defconfig'), commands are discovered once from
+#   the running target by listing CONFIG_PATH_INITIAL.
+# - Kernel boot (mount filesystem, load init ELF) plus a bootloader can
+#   exceed the 5 second default boot wait; raise 'boot_timeout'.
+
+config:
+  cwd: './external'
+  build_dir: './build'
+
+product:
+
+  name: "ntfc-<board>-knsh"
+  cores:
+    core0:
+      name: 'main'
+      device: 'serial'
+      exec_path: '/dev/ttyUSB0'
+      exec_args: '115200,n,8,1'
+      defconfig: 'boards/<arch>/<chip>/<board>/configs/knsh'
+      boot_timeout: 30
+      apps_image:
+        type: romfs
+      flash: '<flash-tool> write $IMAGE_BIN <kernel-address> $APPS_IMG <apps-address>'
+      reboot: '<reset-tool command>'