diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 8f002e7..0f5ef33 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -17,24 +17,32 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # The image of test-e2e-qemu too: one image, one migration.
   lint-and-test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
+      # gcc's 32-bit libraries, which test-i686 links with.
+      - run: |
+          sudo apt-get update
+          sudo apt-get install --yes gcc-multilib
+
       - run: make setup
 
       # After setup: the key covers installed toolchains.
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       # Every check but the boots.
-      - run: make -k lint test
+      - run: make -k lint test test-i686
 
+  # QEMU 9.0 and newer fault unaligned loads from Device memory as arm64 does, which the
+  # aarch64 guests check; Ubuntu 24.04 has QEMU 8.2.
   test-e2e-qemu:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -57,23 +65,39 @@ jobs:
       # profile and logs errors; the builds take about a minute without it.
       - run: make setup
 
-      # Kernel RPMs and DriverSample.efi. Saved only on success, as run.sh reuses
-      # DriverSample.efi unchecked.
+      # The guests' packages and each architecture's DriverSample.efi, keyed also on the
+      # apt packages and the runner image (this file) that build DriverSample. Saved only
+      # on success, as run.sh reuses DriverSample.efi unchecked.
       - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
-            target/qemu-test/kernel-rpms
-            target/qemu-test/driver-sample
-          key: qemu-inputs-${{ hashFiles('tests/qemu/kernel.sha256', 'tests/qemu/build-driver-sample.sh') }}
+            target/qemu-test/packages
+            target/qemu-test/*/driver-sample
+          key: qemu-inputs-${{ hashFiles('tests/qemu/guest-packages-*', 'tests/qemu/build-driver-sample.sh', 'tests/qemu/ubuntu-packages', '.github/workflows/checks.yml') }}
+
+      - run: make -k test-e2e-qemu-x86_64 test-e2e-qemu-i686
+
+      # DO NOT MERGE: diagnostics for the reset on AMD runners.
+      - if: always()
+        run: tests/qemu/ci-diag-reset.sh
 
-      - run: make test-e2e-qemu
+      - if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: reset-diag
+          path: |
+            target/qemu-test/diag
+            target/qemu-test/x86_64/*/*/*.log
+            target/qemu-test/i686/*/*/*.log
+          if-no-files-found: ignore
+          retention-days: 14
 
       - if: failure()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: qemu-test-logs
           path: |
-            target/qemu-test/*/*/*.log
-            target/qemu-test/*/executables
+            target/qemu-test/*/*/*/*.log
+            target/qemu-test/*/*/executables
           if-no-files-found: ignore
           retention-days: 14
diff --git a/Cargo.lock b/Cargo.lock
index 2d183ff..153a62b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -171,6 +171,15 @@ dependencies = [
  "os_str_bytes",
 ]
 
+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "either"
 version = "1.9.0"
@@ -1047,6 +1056,7 @@ dependencies = [
 name = "uefisettings-qemu-guest"
 version = "0.1.0"
 dependencies = [
+ "crc32fast",
  "serde",
  "serde_json",
 ]
diff --git a/Makefile b/Makefile
index bb4c5c1..012a031 100644
--- a/Makefile
+++ b/Makefile
@@ -11,13 +11,15 @@
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 # The checks of uefisettings. They need GNU make and bash, rustup while
-# RUST_TOOLCHAIN is set, as it is by default, and for test-e2e-qemu an x86_64
-# host with /dev/kvm and what tests/qemu/README.md lists:
+# RUST_TOOLCHAIN is set, as it is by default, for test-i686 an x86 host with
+# gcc's 32-bit libraries, which README.md names, and for test-e2e-qemu an
+# x86_64 host with /dev/kvm and what tests/qemu/README.md lists:
 #   make                 every check of CHECKS, stopping at the first that fails
 #   make -k              every check of CHECKS, even after one fails
 #   make <check>...      the named checks, e.g. make clippy-aarch64 doc
 #   make lint            the checks of LINTS
-#   make lint test       every check but test-e2e-qemu
+#   make lint test test-i686
+#                        every check but test-e2e-qemu
 #   make RUST_TOOLCHAIN= the checks on the cargo of PATH
 #   make setup           installs, through rustup, the toolchain, components and
 #                        targets that the checks use
@@ -27,10 +29,10 @@
 #
 # A CI host runs make setup && make -k under timeout, as nothing bounds the time
 # that cargo takes: timeout -k 60 <seconds> bash -c 'make setup && make -k'. It
-# may keep target/qemu-test/kernel-rpms and target/qemu-test/driver-sample
-# between runs: tests/qemu/fetch-kernel.sh downloads only the RPMs that are
+# may keep target/qemu-test/packages and target/qemu-test/*/driver-sample
+# between runs: tests/qemu/fetch-packages.sh downloads only the packages that are
 # missing there or fail their sha256 check, and tests/qemu/run.sh builds
-# DriverSample only when it is missing, so delete target/qemu-test/driver-sample
+# DriverSample only when it is missing, so delete target/qemu-test/*/driver-sample
 # after a change to build-driver-sample.sh.
 
 SHELL := bash
@@ -58,14 +60,16 @@ export RUSTFLAGS := -D warnings
 unexport CARGO_ENCODED_RUSTFLAGS
 
 # The targets that the checks build for, comma-separated as rustup takes them.
-TARGETS := x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,x86_64-unknown-linux-musl,x86_64-unknown-uefi
+TARGETS := x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,i686-unknown-linux-gnu,x86_64-unknown-linux-musl,x86_64-unknown-uefi,i686-unknown-linux-musl,i686-unknown-uefi,aarch64-unknown-linux-musl,aarch64-unknown-uefi
 comma := ,
 
-# CI runs lint test and test-e2e-qemu: a new check joins LINTS or gets a CI job.
-LINTS := fmt clippy-x86_64 clippy-aarch64 clippy-uefi doc
-CHECKS := $(LINTS) test test-e2e-qemu
+# CI runs lint test test-i686 and test-e2e-qemu: a new check joins LINTS or
+# QEMU_TESTS or CI runs it too.
+LINTS := fmt clippy-x86_64 clippy-aarch64 clippy-i686 clippy-uefi doc
+QEMU_TESTS := test-e2e-qemu-x86_64 test-e2e-qemu-i686 test-e2e-qemu-aarch64
+CHECKS := $(LINTS) test test-i686 test-e2e-qemu
 
-.PHONY: check lint help setup toolchain $(CHECKS)
+.PHONY: check lint help setup toolchain $(CHECKS) $(QEMU_TESTS)
 
 check: $(CHECKS)
 
@@ -75,7 +79,8 @@ help:
 	@echo "checks: $(CHECKS)"
 	@echo "make runs every check; make <check>... runs the named ones."
 	@echo "make lint runs $(LINTS)."
-	@echo "make lint test runs every check but test-e2e-qemu."
+	@echo "make test-e2e-qemu runs $(QEMU_TESTS)."
+	@echo "make lint test test-i686 runs every check but test-e2e-qemu."
 	@echo "make -k runs every check, even after one fails."
 	@echo "make -n <check> prints the commands of a check without running them."
 	@echo "make RUST_TOOLCHAIN= runs the checks on the cargo of PATH."
@@ -101,7 +106,7 @@ toolchain:
 fmt: toolchain
 	cargo fmt --check
 
-clippy-x86_64 clippy-aarch64: clippy-%: toolchain
+clippy-x86_64 clippy-aarch64 clippy-i686: clippy-%: toolchain
 	cargo clippy --locked --workspace --all-targets --all-features --target $*-unknown-linux-gnu -- -D warnings
 
 # publish-hiidb, the one crate built for UEFI.
@@ -111,10 +116,17 @@ clippy-uefi: toolchain
 test: toolchain
 	scripts/assert-tests-ran.sh cargo test --locked
 
+# The tests on 32-bit glibc, where off_t is signed and has 32 bits; this
+# host runs them.
+test-i686: toolchain
+	scripts/assert-tests-ran.sh cargo test --locked --target i686-unknown-linux-gnu
+
 doc: toolchain
 	RUSTDOCFLAGS='-D warnings' cargo doc --workspace --no-deps --document-private-items --locked
 
-# Boots the scenarios of tests/qemu/scenarios.tsv under KVM, with logs in
-# target/qemu-test/<UTC time>/; see tests/qemu/README.md.
-test-e2e-qemu: toolchain
-	tests/qemu/run.sh
+test-e2e-qemu: $(QEMU_TESTS)
+
+# Boots the scenarios of tests/qemu/scenarios.tsv on one architecture, with logs in
+# target/qemu-test/<architecture>/<UTC time>/; see tests/qemu/README.md.
+$(QEMU_TESTS): test-e2e-qemu-%: toolchain
+	tests/qemu/run.sh $*
diff --git a/README.md b/README.md
index 0358088..fa7fb41 100644
--- a/README.md
+++ b/README.md
@@ -144,7 +144,7 @@ mv lib.rs thrift/rust/uefisettings_spellings_db_thrift/uefisettings_spellings_db
 
 ## Checks
 
-The `Makefile` in the root of the repository runs the checks that a change should pass: the lints (`make lint`: rustfmt, clippy for x86_64, aarch64 and UEFI, and the docs), the tests (`make test`) and the QEMU tests (`make test-e2e-qemu`).
+The `Makefile` in the root of the repository runs the checks that a change should pass: the lints (`make lint`: rustfmt, clippy for x86_64, aarch64, i686 and UEFI, and the docs), the tests (`make test`, and `make test-i686` on 32-bit glibc) and the QEMU tests (`make test-e2e-qemu`).
 
 The checks need GNU make and bash, and rustup unless `make RUST_TOOLCHAIN=` runs them on the cargo of `PATH`.
 
@@ -153,11 +153,13 @@ make setup           # once: installs, through rustup, the Rust toolchain, compo
 make                 # every check, stopping at the first that fails
 make -k              # every check, even after one fails
 make <check>...      # the named checks, e.g. make clippy-aarch64 doc
-make lint test       # every check but the QEMU tests
+make lint test test-i686 # every check but the QEMU tests
 make RUST_TOOLCHAIN= # the checks on the cargo of PATH
 make help            # lists the checks
 ```
 
+`make test-i686` also needs an x86 host (x86_64 or i686), which runs the i686 test binaries, and gcc's 32-bit libraries (Ubuntu: `gcc-multilib`, or, next to the `gcc-aarch64-linux-gnu` of [`tests/qemu/ubuntu-packages`](tests/qemu/ubuntu-packages), which conflicts with it, `libc6-dev-i386` and `lib32gcc-<gcc version>-dev`; Fedora: `glibc-devel.i686`).
+
 `make test-e2e-qemu`, the QEMU tests, also needs an x86_64 host with `/dev/kvm` and the packages that [`tests/qemu/README.md`](tests/qemu/README.md) lists.
 
 GitHub Actions runs the checks on every pull request and every push to main, as [`.github/workflows/checks.yml`](.github/workflows/checks.yml) describes.
diff --git a/src/lib/chattr.rs b/src/lib/chattr.rs
index 6e89405..a8d6119 100644
--- a/src/lib/chattr.rs
+++ b/src/lib/chattr.rs
@@ -11,6 +11,8 @@
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 use std::fs::OpenOptions;
+use std::os::raw::c_long;
+use std::os::raw::c_uint;
 use std::os::unix::io::AsRawFd;
 use std::path::Path;
 use std::path::PathBuf;
@@ -26,24 +28,24 @@ const FS_IOC_GETFLAGS: u8 = 1;
 const FS_IOC_SETFLAGS: u8 = 2;
 
 // full list of flags https://github.com/torvalds/linux/blob/master/include/uapi/linux/fs.h#L239
-pub const FS_IMMUTABLE_FL: i64 = 0x00000010; // Immutable file
+pub const FS_IMMUTABLE_FL: c_uint = 0x00000010; // Immutable file
 
-nix::ioctl_read!(
+// The requests encode the size of a long, but the kernel reads and writes an unsigned
+// int (ioctl_getflags() and ioctl_setflags() in fs/file_attr.c, Linux v6.17).
+nix::ioctl_read_bad!(
     ioctl_fs_get_attrs,
-    FS_IOC_MAGIC,
-    FS_IOC_GETFLAGS,
-    ::std::os::raw::c_long
+    nix::request_code_read!(FS_IOC_MAGIC, FS_IOC_GETFLAGS, std::mem::size_of::<c_long>()),
+    c_uint
 );
 
-nix::ioctl_write_ptr!(
+nix::ioctl_write_ptr_bad!(
     ioctl_fs_set_attrs,
-    FS_IOC_MAGIC,
-    FS_IOC_SETFLAGS,
-    ::std::os::raw::c_long
+    nix::request_code_write!(FS_IOC_MAGIC, FS_IOC_SETFLAGS, std::mem::size_of::<c_long>()),
+    c_uint
 );
 
 /// returns all extended fs attributes for the given path as a set of bit flags
-pub fn get_all_attrs(path: impl AsRef<Path>) -> Result<i64> {
+pub fn get_all_attrs(path: impl AsRef<Path>) -> Result<c_uint> {
     let path = path.as_ref();
     let file = OpenOptions::new()
         .write(false)
@@ -54,13 +56,11 @@ pub fn get_all_attrs(path: impl AsRef<Path>) -> Result<i64> {
             path.to_string_lossy()
         ))?;
     let fd = file.as_raw_fd();
-    let mut attrs = 0i64;
-    // SAFETY c_long is guaranteed to be i32 or i64 (https://doc.rust-lang.org/std/os/raw/type.c_long.html)
-    // This tool is linux specific and do not support 32bit systems, so we can assume that it's always i64
-    let attrs_ptr = &mut attrs as *mut i64;
-
+    let mut attrs: c_uint = 0;
+    // SAFETY: fd stays open while file lives, and attrs is the unsigned int that the
+    // kernel writes.
     unsafe {
-        ioctl_fs_get_attrs(fd, attrs_ptr).context("ioctl failed")?;
+        ioctl_fs_get_attrs(fd, &mut attrs).context("ioctl failed")?;
     }
 
     Ok(attrs)
@@ -68,7 +68,7 @@ pub fn get_all_attrs(path: impl AsRef<Path>) -> Result<i64> {
 
 /// writes extended fs attributes for the given path as a set of bit flags
 /// all existing attributes will be overwritten
-pub fn set_all_attrs(path: impl AsRef<Path>, attrs: i64) -> Result<()> {
+pub fn set_all_attrs(path: impl AsRef<Path>, attrs: c_uint) -> Result<()> {
     let path = path.as_ref();
     let file = OpenOptions::new()
         .write(false)
@@ -79,12 +79,10 @@ pub fn set_all_attrs(path: impl AsRef<Path>, attrs: i64) -> Result<()> {
             path.to_string_lossy()
         ))?;
     let fd = file.as_raw_fd();
-    let mut tmp = attrs;
-    // SAFETY c_long is guaranteed to be i32 or i64 (https://doc.rust-lang.org/std/os/raw/type.c_long.html)
-    // This tool is linux specific and do not support 32bit systems, so we can assume that it's always i64
-    let attrs_ptr = &mut tmp as *mut i64;
+    // SAFETY: fd stays open while file lives, and attrs is the unsigned int that the
+    // kernel reads.
     unsafe {
-        ioctl_fs_set_attrs(fd, attrs_ptr).context("ioctl failed")?;
+        ioctl_fs_set_attrs(fd, &attrs).context("ioctl failed")?;
     }
     Ok(())
 }
@@ -127,7 +125,7 @@ macro_rules! clear_attrs {
 
 pub struct EfivarsImmutabilityGuard {
     path: PathBuf,
-    attrs_before_writing: i64,
+    attrs_before_writing: c_uint,
 }
 
 impl EfivarsImmutabilityGuard {
@@ -180,7 +178,7 @@ pub mod tests {
 
     use super::*;
     //in the tests we expect that FS_NODUMP_FL is initially cleared, might be a weak assumption..
-    pub const FS_NODUMP_FL: i64 = 0x00000040; // do not dump file
+    pub const FS_NODUMP_FL: c_uint = 0x00000040; // do not dump file
     #[test]
     fn test_get_all_attrs() -> Result<()> {
         let test_file = tempfile::NamedTempFile::new().expect("Failed to create test file");
@@ -230,6 +228,14 @@ pub mod tests {
             get_all_attrs(test_file.path()).context("No error expected from get_attrs")?;
         // checking that FS_NODUMP_FL is set
         assert_eq!(attrs_after_set & FS_NODUMP_FL, FS_NODUMP_FL);
+        // checking that clearing a flag that no new file has or inherits, so that clearing it
+        // needs no capability, keeps FS_NODUMP_FL, the only flag that the owner may set on both
+        // ZFS and tmpfs
+        clear_attrs!(test_file.path(), FS_IMMUTABLE_FL)
+            .context("No error expected from clear_attrs")?;
+        let attrs_after_other_clear =
+            get_all_attrs(test_file.path()).context("No error expected from get_attrs")?;
+        assert_eq!(attrs_after_other_clear & FS_NODUMP_FL, FS_NODUMP_FL);
         clear_attrs!(test_file.path(), FS_NODUMP_FL, FS_NODUMP_FL)
             .context("No error expected from clear_attrs")?;
         let attrs_after_clear =
@@ -237,7 +243,7 @@ pub mod tests {
         // checking that FS_NODUMP_FL is cleared
         assert_eq!(attrs_after_clear & FS_NODUMP_FL, 0);
         // checking that everything else is still the same
-        assert_eq!(attrs_after_set & !FS_NODUMP_FL, attrs & !FS_NODUMP_FL);
+        assert_eq!(attrs_after_clear & !FS_NODUMP_FL, attrs & !FS_NODUMP_FL);
         Ok(())
     }
 }
diff --git a/src/lib/hii/extract.rs b/src/lib/hii/extract.rs
index 48d50ae..2a1ed23 100644
--- a/src/lib/hii/extract.rs
+++ b/src/lib/hii/extract.rs
@@ -197,13 +197,14 @@ fn copy_mapped_page(file: &File, offset: u64, dst: &mut [u8]) -> Result<usize> {
     let offset_in_page = usize::try_from(offset % page_size as u64)?;
     let len = (page_size - offset_in_page).min(dst.len());
     let page_base = offset - offset_in_page as u64;
-    let map_base = libc::off_t::try_from(page_base)
-        .with_context(|| format!("Mapping offset 0x{page_base:x} does not fit off_t"))?;
+    // mmap64(), as off_t is signed and has 32 bits on most 32-bit glibc targets.
+    let map_base = libc::off64_t::try_from(page_base)
+        .with_context(|| format!("Mapping offset 0x{page_base:x} does not fit off64_t"))?;
 
     // SAFETY: addr = NULL lets the kernel pick an unused address range, so the
     // new PROT_READ mapping cannot alias any Rust allocation (including dst).
     let mapped = unsafe {
-        libc::mmap(
+        libc::mmap64(
             ptr::null_mut(),
             page_size,
             libc::PROT_READ,
@@ -356,7 +357,7 @@ mod tests {
         }
     }
 
-    /// The offset also fails the off_t check; the overflow error must win.
+    /// The offset also fails the off64_t check; the overflow error must win.
     #[test]
     fn read_mapped_rejects_overflowing_range() {
         let (file, _) = mapped_fixture(16);
diff --git a/tests/qemu/README.md b/tests/qemu/README.md
index aa90607..620350f 100644
--- a/tests/qemu/README.md
+++ b/tests/qemu/README.md
@@ -1,12 +1,14 @@
 # QEMU tests
 
-These tests boot QEMU guests under OVMF and run `uefisettings` inside them, so they
+These tests boot x86_64, i686 and aarch64 QEMU guests under EDK2's firmware (OVMF, or
+AAVMF on aarch64) and run `uefisettings` inside them, so they
 exercise the CLI against real UEFI firmware, efivarfs and `/dev/mem` without touching the
 machine that runs them.
 
 ## Running
 
-`make test-e2e-qemu` runs every scenario, on the Rust
+`make test-e2e-qemu` runs every scenario on every architecture, and
+`make test-e2e-qemu-<arch>` on one of `x86_64`, `i686` and `aarch64`, on the Rust
 toolchain and targets that `make setup` installs (see the Checks section of the
 repository's README):
 
@@ -15,36 +17,47 @@ make setup    # once
 make test-e2e-qemu
 ```
 
-It needs an x86_64 host with `/dev/kvm` and, on Ubuntu 24.04, the packages of
+It needs an x86_64 host with `/dev/kvm`, which the x86_64 and i686 guests use; QEMU
+emulates the aarch64 guests, and must be 9.0 or newer, which faults unaligned loads from
+Device memory as arm64 does. On Ubuntu 26.04 it also needs the packages of
 [`ubuntu-packages`](ubuntu-packages):
 
 ```sh
 xargs --arg-file=tests/qemu/ubuntu-packages sudo apt-get install --yes
 ```
 
-`run.sh` alone runs the scenarios on the active toolchain of rustup, which then needs the
-musl and UEFI targets:
+The guest's kernel, firmware and busybox do not come from the host: they are the packages
+that `guest-packages-<arch>` ([x86_64](guest-packages-x86_64), [i686](guest-packages-i686)
+or [aarch64](guest-packages-aarch64)) pins, which
+[`fetch-packages.sh`](fetch-packages.sh) downloads.
+
+`run.sh` alone runs the scenarios of an architecture on the active toolchain of rustup,
+which then needs that architecture's musl and UEFI targets:
 
 ```sh
 rustup target add x86_64-unknown-linux-musl x86_64-unknown-uefi   # once
-tests/qemu/run.sh               # every scenario
-tests/qemu/run.sh boot-smoke    # the named scenarios
+tests/qemu/run.sh x86_64              # every scenario
+tests/qemu/run.sh x86_64 boot-smoke   # the named scenarios
 ```
 
-Elsewhere, the environment variables in the header of [`run.sh`](run.sh) give the paths
-of QEMU, the OVMF code and variable images, a static busybox and the directory of
-DriverSample.efi, and these tools must be on `PATH`: `virt-fw-vars`, `jq` and `cpio` for
-`run.sh`; `curl`, `rpm2cpio` and `cpio` for [`fetch-kernel.sh`](fetch-kernel.sh); and,
+Elsewhere, these tools must be on `PATH`: `qemu-system-x86_64`, `qemu-system-i386`,
+`qemu-system-aarch64`, `virt-fw-vars`, `jq` and `cpio` for `run.sh`; `curl`, `rpm2cpio`,
+`cpio`, `ar`, `tar`, `xz` and `zstd` for `fetch-packages.sh`; and,
 unless DriverSample.efi is already built, `gcc`, `g++`, `make`, `git`, `nasm`, `python3`
 and the libuuid headers for [`build-driver-sample.sh`](build-driver-sample.sh).
+The aarch64 builds also need `aarch64-linux-gnu-gcc` with the `libdl.a` of an aarch64
+glibc, or another linker that `CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER` names, and
+the i686 build of `uefisettings` a 32-bit `libdl.a` (Fedora: `glibc-devel.i686`), as the
+`libloading` crate links `-ldl`.
 
-`QEMU` must name the `qemu-system-x86_64` binary or a wrapper that `exec`s it: `run.sh`
+The `qemu-system-*` on `PATH` may be a wrapper that `exec`s QEMU: `run.sh`
 stops a boot after 120 s by signalling that program, not its children, so a wrapper that
 runs QEMU as a child would leave the guest running.
 
-Each run writes to `target/qemu-test/<UTC time>/`, with one directory per scenario. For
-each boot `N`, `bootN.console.log` has the firmware, kernel and `init` output and
-`bootN.test.log` the test output.
+Each run writes to `target/qemu-test/<arch>/<UTC time>/`, with one directory per
+scenario. For each boot `N`, `bootN.console.log` has the firmware, kernel and `init`
+output, `bootN.test.log` the test output and `bootN.qemu.log` how QEMU saw the guest end
+(`run.sh` explains its lines).
 
 [`scenarios.tsv`](scenarios.tsv) lists the scenarios and the boots of each; each file in
 [`guest/tests/`](guest/tests/) is one test binary, which a boot names, and its module
@@ -55,7 +68,7 @@ command line lacks `uefisettings.test=`. They build only with the `test-vm` feat
 
 ## HII fixture
 
-OVMF does not publish its HII database for the OS, so the HII scenarios have the firmware
+EDK2's firmware does not publish its HII database for the OS, so the HII scenarios have it
 run two drivers from the ESP before the kernel, through `Driver####` load options:
 
 - `DriverSample.efi`, EDK2's unmodified sample HII driver (BSD-2-Clause-Patent), which
@@ -63,6 +76,7 @@ run two drivers from the ESP before the kernel, through `Driver####` load option
   the first run;
 - `publish-hiidb.efi`, from [`publish-hiidb/`](publish-hiidb/), which points the `HiiDB`
   variable at a copy of the HII database, the way the firmware of OCP machines does.
+  It also puts the CRC-32 of the database in the `HiiDBCrc32` variable for the tests.
 
 [`vars/my-ifr-nv-data.json`](vars/my-ifr-nv-data.json) creates DriverSample's variable
 first, with runtime access, so that efivarfs shows it, and with DriverSample's defaults at
diff --git a/tests/qemu/build-driver-sample.sh b/tests/qemu/build-driver-sample.sh
index 45b53c8..26502f3 100755
--- a/tests/qemu/build-driver-sample.sh
+++ b/tests/qemu/build-driver-sample.sh
@@ -12,25 +12,34 @@
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 # Builds DriverSample.efi, EDK2's sample HII driver
-# (MdeModulePkg/Universal/DriverSampleDxe), which the QEMU tests load into OVMF
-# for its HII forms. The source is the edk2-stable202508 tag, checked against
+# (MdeModulePkg/Universal/DriverSampleDxe), which the QEMU tests load into EDK2's firmware
+# for its HII forms. The source is the edk2-stable202608 tag, checked against
 # its commit. DriverSample is BSD-2-Clause-Patent, so EDK2's License.txt is
 # copied next to it as DriverSample-License.txt.
 # Needs gcc, g++, make, nasm, python3, git and the libuuid headers; on Ubuntu
 # 24.04: apt-get install build-essential git nasm python3 uuid-dev.
+# AARCH64 also needs the gcc that GCC_AARCH64_PREFIX names (default: aarch64-linux-gnu-,
+# which gcc-aarch64-linux-gnu has).
 # JOBS sets the make and build job count (default: nproc).
 #
-# Usage: [JOBS=<n>] tests/qemu/build-driver-sample.sh <output directory>
+# Usage: [JOBS=<n>] tests/qemu/build-driver-sample.sh <X64|IA32|AARCH64> <output directory>
 
 set -euo pipefail
 
-if (($# != 1)); then
-    echo "usage: $0 <output directory>" >&2
+arch=${1-}
+case $arch in
+X64 | IA32 | AARCH64) ;;
+*) arch= ;;
+esac
+if (($# != 2)) || [[ -z $arch ]]; then
+    echo "usage: $0 <X64|IA32|AARCH64> <output directory>" >&2
     exit 2
 fi
-out=$(realpath -m -- "$1")
-tag=edk2-stable202508
-commit=d46aa46c8361194521391aa581593e556c707c6e
+out=$(realpath -m -- "$2")
+# EDK2's tools_def.txt reads the prefix of the AARCH64 gcc from it.
+export GCC_AARCH64_PREFIX=${GCC_AARCH64_PREFIX-aarch64-linux-gnu-}
+tag=edk2-stable202608
+commit=2970e5699ba6267f3384ffab20f96647578aebc8
 jobs=${JOBS:-$(nproc)}
 
 work=$(mktemp -d)
@@ -54,8 +63,17 @@ set -- && set +u
 # shellcheck source=/dev/null
 . ./edksetup.sh
 set -u
-build -a X64 -t GCC -b RELEASE -n "$jobs" -p MdeModulePkg/MdeModulePkg.dsc \
+# EDK2's X64 flags name no -march, so gcc's default applies, and that varies: Ubuntu's
+# amd64v3 gcc emits AVX, which faults in the firmware (CR4.OSXSAVE is clear). The DSC's
+# build options append -march=x86-64, the baseline, to EDK2's flags.
+cat >>MdeModulePkg/MdeModulePkg.dsc <<'EOF'
+
+[BuildOptions]
+  GCC:*_*_X64_CC_FLAGS = -march=x86-64
+  GCC:*_*_X64_DLINK_FLAGS = -march=x86-64
+EOF
+build -a "$arch" -t GCC -b RELEASE -n "$jobs" -p MdeModulePkg/MdeModulePkg.dsc \
     -m MdeModulePkg/Universal/DriverSampleDxe/DriverSampleDxe.inf
 mkdir -p -- "$out"
-cp Build/MdeModule/RELEASE_GCC/X64/DriverSample.efi "$out/"
+cp "Build/MdeModule/RELEASE_GCC/$arch/DriverSample.efi" "$out/"
 cp License.txt "$out/DriverSample-License.txt"
diff --git a/tests/qemu/ci-diag-attribution.py b/tests/qemu/ci-diag-attribution.py
new file mode 100755
index 0000000..4c956cc
--- /dev/null
+++ b/tests/qemu/ci-diag-attribution.py
@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+"""DO NOT MERGE: attributes each SHUTDOWN exit in a host trace to KVM (L1) or Hyper-V (L0).
+
+KVM flushes the nested mappings of a root it loads (Linux v7.0 arch/x86/kvm/mmu/mmu.c,
+kvm_mmu_load, then svm_flush_tlb_current, arch/x86/kvm/svm/svm.c:4031-4045, which calls
+hyperv_flush_guest_mapping on that root when Hyper-V's enlightened NPT TLB is on). For the
+vCPU that exits with SHUTDOWN, this takes its fatal entry (its last kvm_entry before the
+exit), the root that it loaded last before that entry (the kvmdiag/load_mmu_pgd
+kprobe on svm_load_mmu_pgd, svm.c:4442), the last event before the entry that drops the
+vCPU's root (the anchor) and the hyperv_nested_flush_guest_mapping* hypercalls between the
+anchor and the entry. Two events drop roots: kvm_mmu_zap_all_fast, which makes every root
+obsolete (mmu.c:6787-6825) and runs in whichever thread changed the memory map, the dying
+vCPU's own after its MMIO exit or another one, so it is matched by time across all threads;
+and kvm_mmu_reset_context (the kvmdiag/mmu_reset kprobe), which unloads the roots of one vCPU
+(mmu.c:6043-6047, 6083-6092), e.g. when userspace writes a PAE vCPU's PDPTRs back (Linux v7.0
+arch/x86/kvm/x86.c:12449-12477), so it counts only for the dying vCPU. Either way the vCPU
+loads a root before it enters again (kvm_mmu_load, mmu.c:6050-6080, which then flushes it).
+A root load or a reset belongs to the vCPU of its vcpu_id field, which the BTF-typed kprobes
+record, and else to the vCPU of its thread:
+
+- events lost in the window (ftrace's overwrite mode keeps each CPU's newest events only, so a
+  CPU whose oldest kept event is newer than the anchor may have lost a root load or a flush):
+  undetermined;
+- no root observed: undetermined;
+- a root loaded before the anchor: L1 (the zap's own flushes target the old roots, so they do
+  not count);
+- no "Hyper-V enlightened NPT TLB flush enabled" in dmesg: undetermined, as KVM then flushes
+  without the hypercall (svm.c:4041, svm_onhyperv.h:18-24);
+- the flush hypercalls' events not traced (--flush-events not-traced): undetermined, as an
+  absent flush then says nothing;
+- a successful flush (ret 0) of that root in the window: L0, a matching flush preceded the
+  fault;
+- no flush, or flushes of other roots, failed ones or ones after the entry only: L1.
+"""
+
+import argparse
+import gzip
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+LINE = re.compile(
+    r"^\s*(?P<comm>.+?)-(?P<tid>\d+)\s+\[(?P<cpu>\d+)\]\s+\S+\s+(?P<time>\d+\.\d+):\s+(?P<event>\w+):\s?(?P<fields>.*)$"
+)
+HEADER = re.compile(r"^# entries-in-buffer/entries-written: (?P<kept>\d+)/(?P<written>\d+)")
+SHUTDOWN = re.compile(r"^vcpu (?P<vcpu>\d+) reason shutdown\b")
+ENTRY = re.compile(r"^vcpu (?P<vcpu>\d+),")
+ROOT = re.compile(r"\broot_hpa=(?P<root>0x[0-9a-f]+)")
+VCPU_ID = re.compile(r"\bvcpu_id=(?P<vcpu>-?\d+)")
+FLUSH = re.compile(r"^address space (?P<space>[0-9a-f]+) ret (?P<ret>-?\d+)")
+FLUSH_EVENTS = ("hyperv_nested_flush_guest_mapping", "hyperv_nested_flush_guest_mapping_range")
+ZAP_EVENT = "kvm_mmu_zap_all_fast"
+RESET_EVENT = "mmu_reset"
+PROBE_LOG = "kprobe svm_load_mmu_pgd"
+ENLIGHTENED_FLUSH = "Hyper-V enlightened NPT TLB flush enabled"
+
+
+@dataclass(frozen=True)
+class Event:
+    tid: int
+    cpu: int
+    time: float
+    name: str
+    fields: str
+
+
+@dataclass(frozen=True)
+class Trace:
+    events: list[Event]
+    # entries-in-buffer and entries-written of the trace's header, None without it.
+    kept_written: tuple[int, int] | None
+
+    def losses(self) -> str | None:
+        """How many events the trace lost, or None if none."""
+        if self.kept_written is None:
+            return "the trace has no entries-in-buffer/entries-written header"
+        kept, written = self.kept_written
+        return None if kept == written else f"the trace kept {kept} of {written} events"
+
+    def lost_since(self, start: float) -> str | None:
+        """Why events after start may be missing, or None if none can be."""
+        if self.kept_written is None:
+            return "the trace has no entries-in-buffer/entries-written header"
+        kept, written = self.kept_written
+        if kept == written:
+            return None
+        oldest: dict[int, float] = {}
+        for event in self.events:
+            oldest.setdefault(event.cpu, event.time)
+        late = {cpu: time for cpu, time in oldest.items() if time > start}
+        if not late:
+            return None
+        cpus = ", ".join(f"CPU {cpu} from {time:.6f}" for cpu, time in sorted(late.items()))
+        return f"the trace kept {kept} of {written} events, {cpus} only"
+
+
+def read_trace(path: Path) -> Trace:
+    opener = gzip.open if path.suffix == ".gz" else open
+    events = []
+    kept_written = None
+    with opener(path, "rt", errors="replace") as trace:
+        for line in trace:
+            if (header := HEADER.match(line)) is not None:
+                kept_written = (int(header["kept"]), int(header["written"]))
+            elif (found := LINE.match(line)) is not None:
+                events.append(
+                    Event(int(found["tid"]), int(found["cpu"]), float(found["time"]), found["event"], found["fields"])
+                )
+    return Trace(events, kept_written)
+
+
+def probe_reason(probe_log: Path | None) -> str:
+    """What host-trace.log says about placing the kprobe."""
+    if probe_log is None or not probe_log.exists():
+        return "no host-trace.log"
+    lines = [line.strip() for line in probe_log.read_text(errors="replace").splitlines() if PROBE_LOG in line]
+    return "; ".join(dict.fromkeys(lines)) or "host-trace.log has no kprobe line"
+
+
+def belongs(event: Event, vcpu: int, thread: int) -> bool:
+    """Whether a kprobe event of one vCPU, by its vcpu_id field or else its thread, is vcpu's."""
+    if (found := VCPU_ID.search(event.fields)) is not None:
+        return int(found["vcpu"]) == vcpu
+    return event.tid == thread
+
+
+def attribute(trace: Trace, shutdown: Event, vcpu: int, reason: str, enlightened: bool, flushes_traced: bool) -> str:
+    """The verdict on one SHUTDOWN exit of vcpu, with the evidence it rests on."""
+    events = trace.events
+    before = [event for event in events if event.time <= shutdown.time]
+    entries = [
+        event
+        for event in before
+        if event.name == "kvm_entry" and (found := ENTRY.match(event.fields)) and int(found["vcpu"]) == vcpu
+    ]
+    if not entries:
+        return f"vcpu {vcpu}: undetermined: no kvm_entry before its shutdown at {shutdown.time:.6f}"
+    entry = entries[-1]
+    roots = [
+        (event, found["root"])
+        for event in before
+        if event.name == "load_mmu_pgd"
+        and belongs(event, vcpu, entry.tid)
+        and event.time <= entry.time
+        and (found := ROOT.search(event.fields))
+    ]
+    if not roots:
+        lost = trace.losses()
+        return f"vcpu {vcpu}: undetermined: no root observed ({reason}{'; ' + lost if lost else ''})"
+    load, root = roots[-1]
+    anchors = [
+        event
+        for event in before
+        if event.time <= entry.time
+        and (event.name == ZAP_EVENT or (event.name == RESET_EVENT and belongs(event, vcpu, entry.tid)))
+    ]
+    if not anchors:
+        return (
+            f"vcpu {vcpu}: undetermined: no kvm_mmu_zap_all_fast, nor kvm_mmu_reset_context of it,"
+            f" before its fatal entry at {entry.time:.6f}"
+        )
+    anchor = anchors[-1]
+    kind = "zap" if anchor.name == ZAP_EVENT else "reset"
+    if (lost := trace.lost_since(anchor.time)) is not None:
+        return f"vcpu {vcpu}: undetermined: events may be lost after the {kind} at {anchor.time:.6f} ({lost})"
+    if load.time < anchor.time:
+        return (
+            f"vcpu {vcpu}: L1: entered on a root loaded before the {kind} (root {root} loaded at"
+            f" {load.time:.6f}, {kind} in thread {anchor.tid} at {anchor.time:.6f}, fatal entry in thread"
+            f" {entry.tid} at {entry.time:.6f}, shutdown at {shutdown.time:.6f})"
+        )
+    if not enlightened:
+        return f"vcpu {vcpu}: undetermined (no enlightened NPT flush, no flush expected)"
+    if not flushes_traced:
+        return f"vcpu {vcpu}: undetermined: flush events not traced"
+    flushes = [
+        (event, int(found["space"], 16), int(found["ret"]))
+        for event in before
+        if event.name in FLUSH_EVENTS
+        and anchor.time <= event.time <= entry.time
+        and (found := FLUSH.match(event.fields))
+    ]
+    listed = ", ".join(
+        f"{space:#x} ret {ret} in thread {event.tid} at {event.time:.6f}" for event, space, ret in flushes
+    )
+    evidence = (
+        f"{kind} in thread {anchor.tid} at {anchor.time:.6f}, root {root} loaded at {load.time:.6f},"
+        f" fatal entry in thread {entry.tid}"
+        f" at {entry.time:.6f}, shutdown at {shutdown.time:.6f}; flushes between {kind} and entry: {listed or 'none'}"
+    )
+    if any(space == int(root, 16) and ret == 0 for _, space, ret in flushes):
+        return f"vcpu {vcpu}: L0: a matching flush preceded the fault ({evidence})"
+    return f"vcpu {vcpu}: L1: missing/late/mismatched/failed flush ({evidence})"
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("trace", type=Path, help="a host trace, plain or .gz")
+    parser.add_argument("--probe-log", type=Path, help="host-trace.log, for why no root was observed")
+    parser.add_argument("--dmesg", type=Path, required=True, help="the host's dmesg from before the boots")
+    parser.add_argument(
+        "--flush-events",
+        choices=("traced", "not-traced"),
+        required=True,
+        help="whether the hyperv_nested_flush_guest_mapping* events were enabled",
+    )
+    args = parser.parse_args()
+
+    trace = read_trace(args.trace)
+    reason = probe_reason(args.probe_log)
+    enlightened = ENLIGHTENED_FLUSH in args.dmesg.read_text(errors="replace")
+    shutdowns = [
+        (event, found) for event in trace.events if event.name == "kvm_exit" and (found := SHUTDOWN.match(event.fields))
+    ]
+    if not shutdowns:
+        print("attribution: no SHUTDOWN exit in the trace")
+    for event, found in shutdowns:
+        verdict = attribute(trace, event, int(found["vcpu"]), reason, enlightened, args.flush_events == "traced")
+        print(f"attribution: {verdict}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/qemu/ci-diag-kvm-amd.sh b/tests/qemu/ci-diag-kvm-amd.sh
new file mode 100755
index 0000000..81f8c8b
--- /dev/null
+++ b/tests/qemu/ci-diag-kvm-amd.sh
@@ -0,0 +1,194 @@
+#!/bin/bash
+# DO NOT MERGE: builds the runners' kvm-amd.ko (Ubuntu's 7.0.0-1017-azure) from its exact source,
+# linux-azure 7.0.0-1017.17, twice: as Ubuntu ships it ("stock") and with a proof-of-concept fix
+# ("poc"). Under Hyper-V, linux-azure's svm_load_mmu_pgd clears bits 0-11 of the guest CR3 that
+# it gives the hardware whenever CR4.PCIDE is clear (https://bugs.launchpad.net/bugs/2106673);
+# in 32-bit PAE paging, bits 5-11 address the page directory pointer table (KVM's own
+# load_pdptrs reads it at CR3 & GENMASK(11, 5)). The PoC leaves CR3 alone in PAE paging and
+# masks it as before elsewhere, the case behind the patch included: an SMM entry from long
+# mode, paging off, with PCID bits in CR3 (its RFC:
+# https://patchwork.kernel.org/project/kvm/patch/20240319163456.133942-1-vkuznets@redhat.com/).
+# Both builds take the make variables of Ubuntu's own kernel build (kmake in
+# debian/rules.d/0-common-vars.mk), so that the stock module's code is the shipped one's. The
+# script fails unless the two builds differ in svm_load_mmu_pgd alone, and reports how the stock
+# one compares with SHIPPED. The sha256 of the packages are those of the signed Sources and
+# Packages indexes of resolute-updates.
+#
+# Usage: tests/qemu/ci-diag-kvm-amd.sh DOWNLOADS OUT [SHIPPED]
+# DOWNLOADS: where the source and header packages are, or go if missing. OUT: gets
+# stock/kvm-amd.ko, poc/kvm-amd.ko, the build logs and comparison.txt. SHIPPED: a kvm-amd.ko or
+# kvm-amd.ko.zst to compare the stock build with. The source tree (1.6 GB) goes to TMPDIR.
+set -euo pipefail
+
+downloads=$1
+out=$2
+shipped=${3:-}
+release=7.0.0-1017-azure
+pool=https://archive.ubuntu.com/ubuntu/pool/main/l/linux-azure
+mkdir -p "$downloads" "$out"
+while read -r sum name; do
+    if [[ ! -f $downloads/$name ]]; then
+        curl -fsS --retry 3 -o "$downloads/$name.part" "$pool/$name"
+        mv "$downloads/$name.part" "$downloads/$name"
+    fi
+    echo "$sum  $downloads/$name" | sha256sum --check --quiet
+done <<'EOF'
+c6343795c8c7e4feff55f5b309365c8e0eaf49cd6abcb412e32315313f149536 linux-azure_7.0.0.orig.tar.gz
+d68babe1489bad6a7aeff52c4b5c914d4cb69594933d85c0ed343b4bd51ce0e8 linux-azure_7.0.0-1017.17.diff.gz
+f4a8cd2dbd28633e6bd812790e346bf60fc90cb57d3655648d448bbb7224b855 linux-headers-7.0.0-1017-azure_7.0.0-1017.17_amd64.deb
+f615cca8ffad2b52511535286e3a4e1e4d45cb557d9c4ddf762a5009d9cfa651 linux-azure-headers-7.0.0-1017_7.0.0-1017.17_all.deb
+EOF
+
+df -h "${TMPDIR:-/tmp}" >"$out/space.txt"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+tar -xzf "$downloads/linux-azure_7.0.0.orig.tar.gz" -C "$work"
+zcat "$downloads/linux-azure_7.0.0-1017.17.diff.gz" | patch -d "$work/linux-7.0" -p1 --quiet
+for deb in linux-headers-7.0.0-1017-azure_7.0.0-1017.17_amd64.deb linux-azure-headers-7.0.0-1017_7.0.0-1017.17_all.deb; do
+    dpkg-deb -x "$downloads/$deb" "$work/sysroot"
+done
+headers=$work/sysroot/usr/src/linux-headers-$release
+
+for variant in stock poc; do
+    cp -a "$work/linux-7.0/arch/x86/kvm" "$work/$variant"
+    rm "$work/$variant/Makefile"
+    # kvm-amd.ko alone, for the stock kvm.ko: the kvm-amd lines of arch/x86/kvm/Makefile.
+    cat >"$work/$variant/Kbuild" <<'EOF'
+ccflags-y += -I$(src)
+ccflags-$(CONFIG_KVM_WERROR) += -Werror
+
+kvm-amd-y		+= svm/svm.o svm/vmenter.o svm/pmu.o svm/nested.o svm/avic.o
+
+kvm-amd-$(CONFIG_KVM_AMD_SEV)	+= svm/sev.o
+kvm-amd-$(CONFIG_KVM_HYPERV)	+= svm/hyperv.o
+
+ifdef CONFIG_HYPERV
+kvm-amd-y		+= svm/svm_onhyperv.o
+endif
+
+obj-m	+= kvm-amd.o
+
+AFLAGS_svm/vmenter.o    := -iquote $(obj)
+$(obj)/svm/vmenter.o: $(obj)/kvm-asm-offsets.h
+
+$(obj)/kvm-asm-offsets.h: $(obj)/kvm-asm-offsets.s FORCE
+	$(call filechk,offsets,__KVM_ASM_OFFSETS_H__)
+
+targets += kvm-asm-offsets.s
+clean-files += kvm-asm-offsets.h
+EOF
+done
+sed -i 's/^\t\tif (!kvm_is_cr4_bit_set(vcpu, X86_CR4_PCIDE))$/\t\tif (!is_pae_paging(vcpu) \&\& !kvm_is_cr4_bit_set(vcpu, X86_CR4_PCIDE))/' \
+    "$work/poc/svm/svm.c"
+diff "$work/stock/svm/svm.c" "$work/poc/svm/svm.c" >"$out/poc.diff" || true
+poc_line=$(printf '\t\tif (!is_pae_paging(vcpu) && !kvm_is_cr4_bit_set(vcpu, X86_CR4_PCIDE))')
+mask_line=$(printf '\t\t\tcr3 &= ~X86_CR3_PCID_MASK;')
+if [[ $(grep -c '^[<>]' "$out/poc.diff") != 2 ||
+    $(grep -A 1 -F -x -e "$poc_line" "$work/poc/svm/svm.c") != "$poc_line"$'\n'"$mask_line" ]]; then
+    echo "ci-diag-kvm-amd.sh: the PoC change does not apply as one line before the PCID mask:" >&2
+    cat "$out/poc.diff" >&2
+    exit 1
+fi
+
+# modinfo_field KO FIELD: FIELD of KO's .modinfo, without kmod.
+modinfo_field() {
+    objcopy -O binary --only-section=.modinfo "$1" "$work/modinfo"
+    tr '\0' '\n' <"$work/modinfo" | sed -n "s/^$2=//p"
+}
+
+{
+    echo "compiler: $(x86_64-linux-gnu-gcc --version | head -n 1); the kernel's: $(sed -n 's/^CONFIG_CC_VERSION_TEXT=//p' "$headers/.config")"
+    echo "binutils: $(ld --version | head -n 1)"
+} >"$out/comparison.txt"
+for variant in stock poc; do
+    if ! make -C "$headers" M="$work/$variant" CC=x86_64-linux-gnu-gcc CONFIG_DEBUG_SECTION_MISMATCH=y \
+        CFLAGS_MODULE=-DPKG_ABI=1017 modules >"$out/build-$variant.log" 2>&1; then
+        tail -n 30 "$out/build-$variant.log" >&2
+        exit 1
+    fi
+    mkdir -p "$out/$variant"
+    cp "$work/$variant/kvm-amd.ko" "$out/$variant/kvm-amd.ko"
+    vermagic=$(modinfo_field "$out/$variant/kvm-amd.ko" vermagic)
+    if [[ $vermagic != "$release SMP preempt mod_unload modversions " ]]; then
+        echo "ci-diag-kvm-amd.sh: $variant/kvm-amd.ko has vermagic '$vermagic'" >&2
+        exit 1
+    fi
+    echo "$variant: $(sha256sum <"$out/$variant/kvm-amd.ko" | cut -d ' ' -f 1) srcversion $(modinfo_field "$out/$variant/kvm-amd.ko" srcversion)" >>"$out/comparison.txt"
+done
+
+# code KO: the disassembly of each function of KO, each line after its function's name, by name,
+# without what moves with the layout of the rest of the module: the order of the functions;
+# addresses and encodings; the targets of instructions that a relocation completes, whose
+# unrelocated displacements say nothing (the relocation's line, which follows, names the
+# symbol); the addends of section-relative relocations (.text, .rodata, __bug_table, ...:
+# .rodata holds the source file names, whose paths differ). The targets that the assembler
+# resolved stay, by symbol. Not compared: which offset a section-relative relocation names,
+# and the data sections (jump tables, ops tables).
+code() {
+    objdump -d -r --no-show-raw-insn "$1" | awk '
+        # flush: prints the instruction before, its targets as placeholders (<L>) if a
+        # relocation completed it, else by symbol.
+        function flush() {
+            if (insn == "") return
+            if (relocated) {
+                while (match(insn, /[0-9a-f]+ <[^>]+>/))
+                    insn = substr(insn, 1, RSTART - 1) "<L>" substr(insn, RSTART + RLENGTH)
+            } else {
+                gsub(/[0-9a-f]+ </, "<", insn)
+            }
+            print f " " insn
+            insn = ""
+        }
+        /^[0-9a-f]+ <[^>]+>:$/ { flush(); f = substr($2, 2, length($2) - 3); next }
+        f == "" || /^$/ || /^Disassembly of section/ { flush(); next }
+        {
+            sub(/^[ \t]*[0-9a-f]+:[ \t]*/, "")
+            if (/^R_[A-Z0-9_]+[ \t]/) {
+                relocated = 1
+                flush()
+                gsub(/(\.[a-z_.]+|__bug_table)[+-]0x[0-9a-f]+/, "&@")
+                gsub(/[+-]0x[0-9a-f]+@/, "+X")
+                print f " " $0
+            } else {
+                flush()
+                insn = $0
+                relocated = 0
+            }
+        }
+        END { flush() }' | LC_ALL=C sort -s -k 1,1
+}
+
+# differing A B: the functions whose lines differ between the listings of code A and B, or that
+# only one has (diff's status 1, "differ", is no failure).
+differing() {
+    { diff "$1" "$2" || (($? == 1)); } | sed -n -E 's/^[<>] ([^ ]+) .*/\1/p' | sort -u
+}
+
+# The listings outside $(...), which set -e does not reach.
+code "$out/stock/kvm-amd.ko" >"$work/stock.code"
+code "$out/poc/kvm-amd.ko" >"$work/poc.code"
+symbols=$(cut -d ' ' -f 1 "$work/stock.code" | sort -u | wc -l)
+changed=$(differing "$work/stock.code" "$work/poc.code")
+{
+    echo "code compared per function: instructions, the symbols of resolved targets and relocations;"
+    echo "not compared: offsets named by section-relative relocations, data sections"
+    echo "stock vs poc: of $symbols symbols with code, these differ: ${changed:-none}" | tr '\n' ' '
+    echo
+} >>"$out/comparison.txt"
+if [[ -n $shipped ]]; then
+    case $shipped in
+    *.zst) zstd -q -d -c "$shipped" >"$work/shipped.ko" ;;
+    *) cp "$shipped" "$work/shipped.ko" ;;
+    esac
+    code "$work/shipped.ko" >"$work/shipped.code"
+    shipped_changed=$(differing "$work/shipped.code" "$work/stock.code")
+    {
+        echo "shipped $(sha256sum <"$work/shipped.ko" | cut -d ' ' -f 1) vs stock: these differ: ${shipped_changed:-none}" | tr '\n' ' '
+        echo
+    } >>"$out/comparison.txt"
+fi
+cat "$out/comparison.txt"
+if [[ $changed != svm_load_mmu_pgd ]]; then
+    echo "ci-diag-kvm-amd.sh: the PoC must change svm_load_mmu_pgd alone" >&2
+    exit 1
+fi
diff --git a/tests/qemu/ci-diag-qmp.py b/tests/qemu/ci-diag-qmp.py
new file mode 100755
index 0000000..30eaeb8
--- /dev/null
+++ b/tests/qemu/ci-diag-qmp.py
@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""DO NOT MERGE: supervises one diagnostic guest boot over QMP.
+
+QEMU runs with its test terminal on a socket chardev (server, wait) and QMP on a socket,
+both of which this connects to. It copies the terminal to TERMINAL_LOG. Each line that the
+guest prints with the pause marker stops the VM and resumes it; in between, --pause decides:
+
+- registers: saves every vCPU's registers ("info registers" reads them from KVM, which
+  marks the vCPU dirty, so QEMU writes them back before it runs again: kvm_cpu_exec, QEMU
+  v10.2.0 accel/kvm/kvm-all.c:2913-2931, 3171-3176);
+- plain: nothing.
+
+When the guest resets (QEMU runs with -action reboot=shutdown,shutdown=pause, so a triple
+fault pauses the VM) or shuts down otherwise, it records the reason and quits QEMU.
+"""
+
+import argparse
+import enum
+import json
+import logging
+import select
+import socket
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+PAUSE_MARKER = b"diag: pause"
+CONNECT_DEADLINE_SECONDS = 60.0
+CONNECT_RETRY_SECONDS = 0.1
+
+
+class SupervisorError(Exception):
+    pass
+
+
+class Pause(enum.Enum):
+    REGISTERS = "registers"
+    PLAIN = "plain"
+
+
+def connect_unix(path: Path) -> socket.socket:
+    """Connects to QEMU's socket at path once QEMU has created it."""
+    deadline = time.monotonic() + CONNECT_DEADLINE_SECONDS
+    while True:
+        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        try:
+            sock.connect(str(path))
+            return sock
+        except (FileNotFoundError, ConnectionRefusedError) as err:
+            sock.close()
+            if time.monotonic() > deadline:
+                raise SupervisorError(f"no QEMU socket at {path}") from err
+            time.sleep(CONNECT_RETRY_SECONDS)
+
+
+@dataclass
+class Qmp:
+    sock: socket.socket
+    buffer: bytes = b""
+    events: list[dict] = field(default_factory=list)
+
+    def read_message(self) -> dict:
+        while b"\n" not in self.buffer:
+            chunk = self.sock.recv(65536)
+            if not chunk:
+                raise SupervisorError("QMP closed")
+            self.buffer += chunk
+        line, self.buffer = self.buffer.split(b"\n", 1)
+        return json.loads(line)
+
+    def execute(self, command: str, arguments: dict | None = None) -> object:
+        request: dict = {"execute": command}
+        if arguments is not None:
+            request["arguments"] = arguments
+        self.sock.sendall(json.dumps(request).encode() + b"\n")
+        while True:
+            message = self.read_message()
+            match message:
+                case {"return": value}:
+                    return value
+                case {"error": error}:
+                    raise SupervisorError(f"QMP {command}: {error}")
+                case {"event": _}:
+                    self.events.append(message)
+                case _:
+                    raise SupervisorError(f"QMP {command}: unexpected {message}")
+
+    def human(self, command_line: str) -> str:
+        output = self.execute("human-monitor-command", {"command-line": command_line})
+        if not isinstance(output, str):
+            raise SupervisorError(f"HMP {command_line}: unexpected {output!r}")
+        return output
+
+
+def pause(qmp: Qmp, mode: Pause, count: int, out: Path) -> None:
+    """Stops the VM at the guest's pause number count and resumes it, per mode."""
+    qmp.execute("stop")
+    logger.info("pause %d: stopped", count)
+    match mode:
+        case Pause.REGISTERS:
+            (out / f"registers-{count}.txt").write_text(qmp.human("info registers -a"))
+            logger.info("pause %d: saved the registers", count)
+        case Pause.PLAIN:
+            pass
+    qmp.execute("cont")
+    logger.info("pause %d: resumed", count)
+
+
+def supervise(
+    terminal: socket.socket,
+    qmp: Qmp,
+    terminal_log: Path,
+    out: Path,
+    mode: Pause,
+) -> None:
+    pauses = 0
+    line = b""
+    with terminal_log.open("ab") as log:
+        while True:
+            for event in qmp.events:
+                if handle_event(event, qmp, out):
+                    return
+            qmp.events.clear()
+            # select() does not see messages that an earlier read left in the buffer.
+            if b"\n" in qmp.buffer:
+                qmp.events.append(qmp.read_message())
+                continue
+
+            readable, _, _ = select.select([terminal, qmp.sock], [], [])
+            if qmp.sock in readable:
+                qmp.events.append(qmp.read_message())
+            if terminal not in readable:
+                continue
+
+            chunk = terminal.recv(65536)
+            if not chunk:
+                return
+            log.write(chunk)
+            log.flush()
+            # Whole lines, so that each marker counts once however the terminal splits it.
+            *lines, line = (line + chunk).split(b"\n")
+            for complete in lines:
+                if PAUSE_MARKER in complete:
+                    pauses += 1
+                    pause(qmp, mode, pauses, out)
+
+
+def handle_event(event: dict, qmp: Qmp, out: Path) -> bool:
+    """Handles one QMP event; true when the boot is over."""
+    match event:
+        case {"event": "SHUTDOWN", "data": {"reason": reason}}:
+            (out / "shutdown-reason.txt").write_text(reason + "\n")
+            logger.info("shutdown: %s", reason)
+            qmp.execute("quit")
+            return True
+        case {"event": _}:
+            logger.debug("QMP event %s", event)
+            return False
+        case _:
+            raise SupervisorError(f"QMP: unexpected {event}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--terminal-socket", type=Path, required=True)
+    parser.add_argument("--qmp-socket", type=Path, required=True)
+    parser.add_argument("--terminal-log", type=Path, required=True)
+    parser.add_argument("--out", type=Path, required=True, help="directory for the registers")
+    parser.add_argument("--pause", type=Pause, choices=list(Pause), required=True)
+    args = parser.parse_args()
+    logging.basicConfig(level=logging.INFO, format="ci-diag-qmp: %(message)s")
+
+    terminal = connect_unix(args.terminal_socket)
+    qmp = Qmp(connect_unix(args.qmp_socket))
+    greeting = qmp.read_message()
+    if "QMP" not in greeting:
+        raise SupervisorError(f"QMP greeting: {greeting}")
+    qmp.execute("qmp_capabilities")
+    try:
+        supervise(terminal, qmp, args.terminal_log, args.out, args.pause)
+    finally:
+        terminal.close()
+        qmp.sock.close()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/qemu/ci-diag-reset.sh b/tests/qemu/ci-diag-reset.sh
new file mode 100755
index 0000000..9d32066
--- /dev/null
+++ b/tests/qemu/ci-diag-reset.sh
@@ -0,0 +1,991 @@
+#!/bin/bash
+# The runner user writes the output files; sudo only reads them.
+# shellcheck disable=SC2024
+# DO NOT MERGE: diagnostics for the i686 guests that reset on GitHub's AMD runners (EPYC 7763,
+# 9V74 and 9V45; KVM nested under Hyper-V), fifth round. In the third (CI run 39936216534) a
+# PAE vCPU whose page directory pointer table does not start a page died at its first entry
+# after KVM reloaded its MMU, on a memory slot's deletion (memslot) and on QEMU's register
+# write-back after a QMP stop and register read (sync): c1, Debian's 6.1, in 10 of 10 boots
+# under each. The runners' KVM (Ubuntu's linux-azure) clears the guest CR3's low 12 bits at
+# each NPT root load for a vCPU without CR4.PCIDE, the PAE table's address bits 5-11 among them
+# (https://bugs.launchpad.net/bugs/2106673). This round tests that as the cause: c1 under
+# memslot and sync, DIAG_REPS boots each, on a kvm-amd.ko built from the runners' exact source
+# (ci-diag-kvm-amd.sh) as shipped ("stock", the control), then with a fix that leaves those
+# bits alone in PAE paging ("poc"), then the shipped module is loaded again. If the cause is
+# right, stock dies and poc survives; poc dying, or mixed, would falsify the mask as the cause;
+# a poc whose VMRUN fails ("refused"), with stock not refused, would point to Hyper-V rejecting
+# CR3 bits 5-11 of a PAE guest. Each boot's summary also gives the page offsets of the first
+# guest page walk that faults after each root zap: the mask moves a PAE vCPU's PDPT to the
+# start of its page (PDPTE[3] at offset 0x018), the fix leaves it where the guest put it.
+# A cell is a guest test and kernel command line, booted round-robin with the others, each
+# boot with a verdict, here with host traces of KVM's events but no kprobes (events): those of
+# a full trace need BTF, which the rebuilt module lacks.
+# Decision rule, per cell of DIAG_REPS boots: "dies" if at least 8 in 10 die, "survives" if at
+# most 1 in 10 dies and the others end their test, else "mixed"; a boot that its timeout ends
+# after its test started its trigger (memslot printed its BAR, just before its first toggle;
+# sync's first QMP stop), without a reset or the end of its test, "hung", is neither; a cell
+# with a boot whose VMRUN failed (KVM exit 9) is "refused" and boots no more, as that boot
+# decides it (each such boot waits out its timeout); a cell cut short by the deadline is
+# "incomplete", one whose boots do not show their controls (the kernel's "Linux version" line,
+# PTI as asked, the stressor's round trips) "invalid"; any other boot that neither dies nor ends
+# its test fails the harness.
+# Writes everything to target/qemu-test/diag/.
+#
+# DIAG_REPS: boots per cell (default 10). DIAG_TRACE_KB: the host trace's buffer per CPU in
+# KiB (default 131072). DIAG_SLOW: a factor for every boot's timeout and the deadline, for a
+# run under emulation (default 1). DIAG_ONLY: the cells' boots to run, as ARCH/LABEL separated
+# by commas or spaces (e.g. "i686/c1-memslot-poc"; default all).
+#
+# Usage: tests/qemu/ci-diag-reset.sh
+
+set -uo pipefail
+
+here=$(realpath "$(dirname "$0")")
+repo=$(realpath "$here/../..")
+out=$repo/target/qemu-test/diag
+tracing=/sys/kernel/tracing
+reps=${DIAG_REPS:-10}
+trace_kb=${DIAG_TRACE_KB:-131072}
+slow=${DIAG_SLOW:-1}
+for value in "$reps" "$trace_kb" "$slow"; do
+    if [[ ! $value =~ ^[1-9][0-9]*$ ]]; then
+        echo "ci-diag-reset.sh: DIAG_REPS, DIAG_TRACE_KB and DIAG_SLOW take positive integers, not '$value'" >&2
+        exit 2
+    fi
+done
+# The pauses of tests/sync, on the kernel command line of its boots.
+sync_pauses=5
+# No boot starts after 70 minutes, so that the job (120 minutes, of which the build and
+# tests/qemu/run.sh take about 35) uploads what the boots found.
+deadline=$((SECONDS + 4200 * slow))
+rm -rf "$out"
+mkdir -p "$out"
+
+{
+    uname -a
+    id
+    sudo --version | head -n 1
+    readlink -f "$(command -v sudo)"
+    sudo -n env | grep '^PATH='
+    grep -m1 '^model name' /proc/cpuinfo
+    grep -m1 '^flags' /proc/cpuinfo
+    # Some parameters are root's only.
+    sudo sh -c 'for p in /sys/module/kvm_amd/parameters/* /sys/module/kvm_intel/parameters/* \
+        /sys/module/kvm/parameters/*; do [ -e "$p" ] && echo "$p=$(cat "$p")"; done'
+    qemu-system-x86_64 --version
+    dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' qemu-system-x86 libc6 libglib2.0-0t64
+    apt-cache policy qemu-system-x86
+    sha256sum /usr/bin/qemu-system-i386 /usr/bin/qemu-system-x86_64
+    python3 --version
+    sudo ls "$tracing/events/hyperv" "$tracing/events/kvmmmu"
+    sudo ls /sys/kernel/btf
+    echo "kprobe targets: $(sudo grep -w -E 'svm_load_mmu_pgd|kvm_mmu_reset_context|shutdown_interception' \
+        "$tracing/available_filter_functions" | tr '\n' ' ')"
+} >"$out/facts.txt" 2>&1
+sudo dmesg >"$out/dmesg-before.txt" 2>&1
+# The host traces need sudo (GitHub's runners have it without a password); without, the
+# boots run untraced and the summary says so. tracefs is root's only, so sudo looks at it.
+host_traces=no
+sudo -n true 2>>"$out/facts.txt" && sudo test -d "$tracing/events" && host_traces=yes
+amd_host=no
+[[ -d /sys/module/kvm_amd ]] && amd_host=yes
+echo "host traces: $host_traces" >>"$out/facts.txt"
+
+# harness_fail MESSAGE: a boot that does not produce what it should, which fails the diag
+# rather than passing as a result.
+harness_failures=0
+boots=0
+flush_events=not-traced
+# KVM's message when it flushes nested mappings through Hyper-V's hypercall (Linux v7.0
+# arch/x86/kvm/svm/svm_onhyperv.c), as ci-diag-attribution.py also looks for it.
+enlightened_flush='Hyper-V enlightened NPT TLB flush enabled'
+harness_fail() {
+    echo "HARNESS FAIL: $1" | tee -a "$out/summary.txt" >&2
+    harness_failures=$((harness_failures + 1))
+}
+# On an AMD host the attribution rests on the host traces, so their absence fails the diag
+# there; elsewhere (an Intel machine without sudo) it is a note in facts.txt.
+[[ $host_traces == no && $amd_host == yes ]] &&
+    harness_fail "an AMD host, but no host traces (sudo or tracefs missing)"
+# Dumps the VMCB to dmesg if a VMRUN fails.
+[[ $host_traces == yes && $amd_host == yes ]] &&
+    echo Y | sudo tee /sys/module/kvm_amd/parameters/dump_invalid_vmcb >>"$out/facts.txt"
+
+# host_trace_start MODE: full (KVM, its MMU, Hyper-V's flush hypercalls and the kprobes below),
+# events (the same without the kprobes) or cr (KVM's control register accesses only, for the
+# CR4 that the guest kernel set). A
+# flush clears what a vCPU uses only if its address space (hyperv_nested_flush_guest_mapping*:
+# "address space") is the root that the vCPU loaded.
+host_trace_start() {
+    # An array, so that the sh -c below gets the names on one line. Task switches have no event
+    # of their own (Linux v7.0 arch/x86/kvm/trace.h): kvm_exit shows them, as "reason
+    # task_switch" (arch/x86/include/uapi/asm/svm.h:212).
+    local events=(kvm/kvm_cr) clock name
+    [[ $1 == full || $1 == events ]] && events=(kvm/kvm_entry kvm/kvm_exit kvm/kvm_userspace_exit
+        kvm/kvm_inj_exception kvm/kvm_inj_virq kvm/kvm_emulate_insn kvm/kvm_msr kvm/kvm_cr
+        kvm/kvm_page_fault kvm/kvm_mmio kvm/kvm_pio
+        kvmmmu/kvm_mmu_zap_all_fast kvmmmu/kvm_mmu_spte_requested kvmmmu/handle_mmio_page_fault
+        kvmmmu/mark_mmio_spte kvmmmu/fast_page_fault hyperv)
+    # 128 MiB per CPU by default: overwrite mode keeps each CPU's newest events only, and the
+    # attribution declares a window that lost events undetermined (run 39281579400's write
+    # boots wrote 0.5-1.1 million events, all kept in 64 MiB).
+    # The global clock, as the attribution orders events of different threads, and so of
+    # different CPUs, which the default local clock does not keep in sync (Linux v7.0
+    # Documentation/trace/ftrace.rst:540-545). An event that this kernel lacks, such as
+    # hyperv/* outside Hyper-V, is logged and left out.
+    sudo sh -c "
+        echo 0 >$tracing/tracing_on
+        echo >$tracing/trace
+        echo global >$tracing/trace_clock
+        echo 1 >$tracing/options/overwrite
+        echo $trace_kb >$tracing/buffer_size_kb
+        echo 4096 >$tracing/saved_cmdlines_size
+        echo 0 >$tracing/events/enable
+        for e in ${events[*]}; do
+            if [ -e $tracing/events/\$e/enable ]; then
+                echo 1 >$tracing/events/\$e/enable
+            else
+                echo \"no trace event \$e\"
+            fi
+        done
+        echo 1 >$tracing/tracing_on" >>"$out/host-trace.log" 2>&1
+    clock=$(sudo cat "$tracing/trace_clock")
+    echo "trace_clock: $clock" >>"$out/host-trace.log"
+    [[ $clock == *"[global]"* ]] || harness_fail "trace_clock is not global: $clock"
+    [[ $1 == cr ]] && return 0
+    if [[ $1 == full ]]; then
+        for name in "${kprobes[@]}"; do
+            kprobe_add "$name" && continue
+            # On AMD each of them is part of the verdict; Intel lacks the svm_* ones.
+            [[ $amd_host == no ]] || harness_fail "an AMD host, but no kvmdiag/$name kprobe"
+        done
+    fi
+    flush_events=$(events_enabled hyperv/hyperv_nested_flush_guest_mapping hyperv/hyperv_nested_flush_guest_mapping_range)
+    [[ $(events_enabled kvm/kvm_entry kvm/kvm_exit kvmmmu/kvm_mmu_zap_all_fast) == traced ]] ||
+        harness_fail "KVM's entry, exit or root zap events are not traced"
+    # On an AMD host with the enlightened NPT flush, the attribution needs the flushes.
+    [[ $flush_events == traced || $amd_host == no ]] ||
+        ! grep -q "$enlightened_flush" "$out/dmesg-before.txt" ||
+        harness_fail "the Hyper-V flush events are not traced on a host that uses them"
+}
+
+# events_enabled EVENT...: logs each event's enable file as read back, and prints traced if
+# all of them read 1, else not-traced.
+events_enabled() {
+    local event value state=traced
+    for event; do
+        if value=$(sudo cat "$tracing/events/$event/enable" 2>>"$out/host-trace.log"); then
+            echo "event $event enable=$value" >>"$out/host-trace.log"
+        else
+            value=missing
+            echo "event $event missing" >>"$out/host-trace.log"
+        fi
+        [[ $value == 1 ]] || state=not-traced
+    done
+    echo "$state"
+}
+
+# The kprobes of a full trace, kvmdiag/NAME, each placed by the first of its definitions that
+# the kernel takes, every refusal logged. The BTF-typed ones (CONFIG_PROBE_EVENTS_BTF_ARGS,
+# which the runners' 7.0.0-1017-azure has) name the vCPU; without, the event's thread does.
+# - load_mmu_pgd: the NPT root that KVM loads for a vCPU, svm_load_mmu_pgd(vcpu, root_hpa,
+#   root_level), Linux v7.0 arch/x86/kvm/svm/svm.c:4442, called from kvm_mmu_load_pgd
+#   (arch/x86/kvm/mmu.h:148-157); no tracepoint carries the root. The BTF-typed one adds the
+#   guest CR3 that the vCPU runs on (the VMCB's, svm.c:3606-3610; on linux-azure, only while
+#   its CR3 intercepts are off), for each walk NPF after
+#   the load to be set against the PDPT's place in its page.
+# - mmu_reset: kvm_mmu_reset_context(vcpu), which unloads the vCPU's roots
+#   (arch/x86/kvm/mmu/mmu.c:6043-6047, 6083-6092).
+# - shutdown: shutdown_interception(vcpu), before it INITs the vCPU (svm.c:2081-2109), with
+#   the CR3 that svm_handle_exit copied from the VMCB on this exit (svm.c:3606-3610; on
+#   linux-azure, only while its CR3 intercepts are off). KVM
+#   calls the VMCB undefined after a SHUTDOWN intercept (svm.c:2087-2088): a lead, not proof.
+kprobes=(load_mmu_pgd mmu_reset shutdown)
+kprobes_placed=()
+kprobe_definitions() {
+    # shellcheck disable=SC2016 # kprobe_events fetch arguments, not shell expansions
+    case $1 in
+    load_mmu_pgd)
+        printf '%s\n' 'svm_load_mmu_pgd vcpu_id=vcpu->vcpu_id root_hpa=root_hpa:x64 root_level=root_level:s32 cr3=vcpu->arch.cr3:x64' \
+            'svm_load_mmu_pgd root_hpa=$arg2:x64 root_level=$arg3:s32' \
+            'svm_load_mmu_pgd root_hpa=%si:x64 root_level=%dx:s32'
+        ;;
+    mmu_reset) printf '%s\n' 'kvm_mmu_reset_context vcpu_id=vcpu->vcpu_id' 'kvm_mmu_reset_context' ;;
+    shutdown) printf '%s\n' 'shutdown_interception vcpu_id=vcpu->vcpu_id cr3=vcpu->arch.cr3:x64' ;;
+    esac
+}
+
+# kprobe_add NAME: places kvmdiag/NAME and enables it; false if no definition takes.
+kprobe_add() {
+    local name=$1 definition
+    while read -r definition; do
+        if sudo sh -c "echo 'p:kvmdiag/$name $definition' >>$tracing/kprobe_events" 2>>"$out/host-trace.log"; then
+            kprobes_placed+=("$name")
+            echo "kprobe ${definition%% *}: $definition" >>"$out/host-trace.log"
+            sudo sh -c "echo 1 >$tracing/events/kvmdiag/$name/enable" >>"$out/host-trace.log" 2>&1
+            [[ $(events_enabled "kvmdiag/$name") == traced ]] && return 0
+            harness_fail "the kvmdiag/$name kprobe is placed but not enabled"
+            return 1
+        fi
+        echo "kprobe ${definition%% *} refused: $definition: $(sudo tail -n 2 "$tracing/error_log" | tr '\n' ' ')" \
+            >>"$out/host-trace.log"
+    done < <(kprobe_definitions "$name")
+    return 1
+}
+
+# kprobes_remove: removes the kprobes that kprobe_add placed, and checks that none is left.
+kprobes_remove() {
+    local name remaining
+    for name in "${kprobes_placed[@]}"; do
+        sudo sh -c "echo 0 >$tracing/events/kvmdiag/$name/enable; echo -:kvmdiag/$name >>$tracing/kprobe_events" \
+            >>"$out/host-trace.log" 2>&1 || harness_fail "removing the kvmdiag/$name kprobe failed"
+    done
+    kprobes_placed=()
+    remaining=$(sudo cat "$tracing/kprobe_events")
+    echo "kprobe_events after removal: ${remaining:-empty}" >>"$out/host-trace.log"
+    [[ $remaining != *kvmdiag/* ]] || harness_fail "kvmdiag kprobes are still registered: $remaining"
+}
+
+# host_trace_stop LABEL DIR MODE VCPUS: saves the trace as LABEL's and, for MODE full, writes
+# ci-diag-attribution.py's verdict to DIR/attribution.txt, from the whole trace rather than
+# from the tail that is kept (trace_tail lines, and for MODE full or events vcpu_tail of each
+# of the VCPUS vCPU threads' own).
+trace_tail=2000000
+vcpu_tail=500000
+host_trace_stop() {
+    local trace=$out/$1.host-kvm-trace.txt n tid
+    sudo sh -c "echo 0 >$tracing/tracing_on; cat $tracing/trace" >"$trace" 2>>"$out/host-trace.log"
+    kprobes_remove
+    grep -a -q -E 'kvm_(exit|cr):' "$trace" || harness_fail "$1: host trace without KVM events"
+    if [[ $3 == full ]]; then
+        python3 "$here/ci-diag-attribution.py" --probe-log "$out/host-trace.log" --dmesg "$out/dmesg-before.txt" \
+            --flush-events "$flush_events" "$trace" >"$2/attribution.txt" 2>&1 ||
+            harness_fail "$1: ci-diag-attribution.py failed, see $2/attribution.txt"
+    fi
+    tail -n "$trace_tail" "$trace" | gzip >"$trace.gz" || harness_fail "$1: compressing the host trace failed"
+    # Each vCPU thread's own tail too, which the other's lines cannot push out. The thread is
+    # the one of the vCPU's kvm_exit lines, by its id, which a line has even when its name is
+    # not known ("<...>"); kvm_inj_exception and others have no vCPU field.
+    if [[ $3 != cr ]]; then
+        for ((n = 0; n < $4; n++)); do
+            tid=$(grep -a -E "kvm_exit: vcpu $n " "$trace" | tail -n 1 |
+                sed -E 's/^.*-([0-9]+) +\[[0-9]+\].*$/\1/')
+            if [[ -z $tid ]]; then
+                harness_fail "$1: no vCPU $n thread found in the host trace"
+                continue
+            fi
+            grep -a -E -- "-$tid +\[[0-9]+\]" "$trace" | tail -n "$vcpu_tail" |
+                gzip >"$out/$1.host-kvm-trace.vcpu$n.txt.gz" || harness_fail "$1: compressing vCPU $n's trace failed"
+            require "$out/$1.host-kvm-trace.vcpu$n.txt.gz"
+        done
+    fi
+    rm -f "$trace"
+}
+
+# select_arch ARCH: run.sh's table, for the architecture that this diag runs under KVM (i686).
+select_arch() {
+    arch=$1
+    case $arch in
+    i686)
+        qemu_name='qemu-system-i386'
+        firmware=usr/share/OVMF/OVMF32_CODE_4M.fd
+        firmware_vars=usr/share/OVMF/OVMF32_VARS_4M.fd
+        vmlinuz_pattern='boot/vmlinuz-*'
+        ;;
+    *)
+        harness_fail "select_arch: no row for $arch"
+        return 1
+        ;;
+    esac
+    local runs=()
+    mapfile -t runs < <(compgen -G "$repo/target/qemu-test/$arch/2*/hii/vars.json" | sort)
+    if ((${#runs[@]} == 0)); then
+        harness_fail "no tests/qemu/run.sh $arch run with a hii scenario"
+        return 1
+    fi
+    run=$(dirname "$(dirname "${runs[-1]}")")
+    guest=$repo/target/qemu-test/$arch/guest
+    vmlinuz=$guest/$(cd "$guest" && compgen -G "$vmlinuz_pattern")
+    apt_qemu=/usr/bin/$qemu_name
+    mkdir -p "$out/$arch/binaries"
+    {
+        echo "run $run"
+        sha256sum "$guest/$firmware" "$guest/$firmware_vars" "$vmlinuz" "$run"/esp/*.efi \
+            "$run"/initramfs/bin/* "$run"/initramfs/tests/*
+    } >"$out/$arch/facts.txt" 2>&1
+    cp "$run"/esp/*.efi "$run/initramfs/bin/uefisettings" "$run"/initramfs/tests/* \
+        "$out/$arch/binaries/"
+    # The kernel's symbols, for the addresses in the traces (Debian's i686 package has them).
+    if compgen -G "$guest/boot/System.map-*" >/dev/null; then
+        cp "$guest"/boot/System.map-* "$out/$arch/binaries/" || harness_fail "$arch: copying System.map failed"
+    else
+        echo "no System.map in $guest/boot" >>"$out/$arch/facts.txt"
+    fi
+    stepwise_initrd "$out/$arch"
+}
+
+# stepwise_initrd DIR: DIR/stepwise-initrd.img, the run's initramfs with the tests of this
+# diag, which mark each step on the terminal as they go (a reset loses anything buffered):
+# - memslot toggles the memory decoding of the ivshmem-plain device 200 times, so QEMU deletes
+#   and adds the memory slot of its BAR each time, no firmware involved;
+# - sync prints the pause marker of ci-diag-qmp.py diag.pauses times, sleeping after each;
+# - with diag.stress, memslot and sync first start two processes that ping-pong a byte over
+#   two FIFOs, so the CPU switches between their address spaces at each round trip.
+stepwise_initrd() {
+    rm -rf "$1/stepwise-initramfs"
+    cp -r "$run/initramfs" "$1/stepwise-initramfs"
+    # Sourced by the tests, not run.
+    cat >"$1/stepwise-initramfs/tests/step-and-stress" <<'EOF'
+step() {
+    read -r uptime _ < /proc/uptime
+    echo "step $uptime: $*"
+    sync
+}
+stress=
+pauses=0
+read -r cmdline < /proc/cmdline
+for parameter in $cmdline; do
+    case $parameter in
+    diag.stress) stress=yes ;;
+    diag.pauses=*) pauses=${parameter#*=} ;;
+    esac
+done
+step "$(grep -m 1 '^address sizes' /proc/cpuinfo)"
+stress_report() { :; }
+if [ -n "$stress" ]; then
+    mkfifo /tmp/ping /tmp/pong
+    ( exec 3<>/tmp/ping 4<>/tmp/pong; while read -r _ <&3; do echo >&4; done ) &
+    ( exec 3<>/tmp/ping 4<>/tmp/pong; n=0; echo >&3
+      while read -r _ <&4; do n=$((n + 1)); [ $((n % 1000)) = 0 ] && echo $n > /tmp/round-trips; echo >&3; done ) &
+    sleep 1
+    step "stress: $(cat /tmp/round-trips 2>/dev/null || echo 0) round trips in about a second"
+    stress_report() { step "stress: $(cat /tmp/round-trips 2>/dev/null || echo 0) round trips"; }
+fi
+EOF
+    cat >"$1/stepwise-initramfs/tests/memslot" <<'EOF'
+#!/bin/busybox sh
+. /tests/step-and-stress
+dev=
+for d in /sys/bus/pci/devices/*; do
+    [ "$(cat "$d/vendor")" = 0x1af4 ] && [ "$(cat "$d/device")" = 0x1110 ] && dev=$d
+done
+if [ -z "$dev" ]; then
+    step "no ivshmem-plain device"
+    exit 1
+fi
+set -- $(hexdump -s 4 -n 2 -e '2/1 "%u "' "$dev/config")
+bar=$(sed -n 3p "$dev/resource")
+step "ivshmem-plain $dev: command $1 $2, BAR 2 $bar"
+start=${bar%% *}
+if [ "$((start))" = 0 ]; then
+    step "BAR 2 has no address"
+    exit 1
+fi
+off=$(($1 & ~2))
+on=$(($1 | 2))
+i=0
+while [ $i -lt 200 ]; do
+    # dd's own messages, but not its errors, filtered out; boot_verdict catches a write that
+    # does not take.
+    printf "\\$(printf %o $off)" | dd of="$dev/config" bs=1 seek=4 count=1 conv=notrunc 2>&1 | grep -v -e 'records in' -e 'records out'
+    printf "\\$(printf %o $on)" | dd of="$dev/config" bs=1 seek=4 count=1 conv=notrunc 2>&1 | grep -v -e 'records in' -e 'records out'
+    i=$((i + 1))
+    [ $((i % 50)) = 0 ] && step "toggled the memory decoding $i times"
+done
+stress_report
+step "end"
+EOF
+    cat >"$1/stepwise-initramfs/tests/sync" <<'EOF'
+#!/bin/busybox sh
+. /tests/step-and-stress
+i=1
+while [ $i -le "$pauses" ]; do
+    echo "diag: pause $i"
+    sleep 2
+    step "resumed $i"
+    i=$((i + 1))
+done
+stress_report
+step "end"
+EOF
+    chmod +x "$1/stepwise-initramfs/tests/memslot" "$1/stepwise-initramfs/tests/sync"
+    (cd "$1/stepwise-initramfs" && find . | cpio --create --format=newc --quiet) \
+        >"$1/stepwise-initrd.img"
+}
+
+# fresh_store FILE: the hii scenario's variable store, as run.sh seeds it.
+fresh_store() {
+    virt-fw-vars --input "$guest/$firmware_vars" --set-json "$run/hii/vars.json" \
+        --output "$1" 2>>"$out/virt-fw-vars.log"
+}
+
+# boot LABEL STORE QEMU HOST_TRACE PAUSE KERNEL INITRD APPEND QEMU-ARG...: one guest boot of
+# at most boot_timeout seconds, with its verdict in its DIR/verdict.txt (see boot_verdict).
+# HOST_TRACE is no or a mode of host_trace_start. PAUSE is no or a --pause mode of
+# ci-diag-qmp.py, which then serves the test terminal and QMP on sockets while QEMU pauses on
+# a reset instead of ending.
+boot_timeout=$((180 * slow))
+boot() {
+    local label=$1 store=$2 qemu=$3 host_trace=$4 pause=$5 kernel=$6 initrd=$7 append=$8
+    local rc start end dir=$out/$arch/$label sockets supervisor='' terminal control test
+    local trace=$out/$arch-${label//\//-}
+    local traces=trace:kvm_run_exit,trace:kvm_run_exit_system_event,trace:qemu_system_shutdown_request,trace:qemu_system_powerdown_request,trace:kvm_set_user_memory,trace:kvm_vcpu_ioctl,trace:vm_state_notify
+    shift 8
+    mkdir -p "$dir"
+    boots=$((boots + 1))
+    if [[ $pause != no ]]; then
+        # Unix socket paths have a limit of 108 bytes, which $dir can pass.
+        sockets=$(mktemp -d /tmp/diag.XXXXXX)
+        terminal=(-chardev "socket,id=tty,path=$sockets/terminal,server=on,wait=on")
+        control=(-action 'reboot=shutdown,shutdown=pause' -qmp "unix:$sockets/qmp,server=on,wait=off")
+        python3 "$here/ci-diag-qmp.py" --terminal-socket "$sockets/terminal" \
+            --qmp-socket "$sockets/qmp" --terminal-log "$dir/test.log" --out "$dir" \
+            --pause "$pause" >"$dir/qmp.log" 2>&1 &
+        supervisor=$!
+    else
+        terminal=(-chardev "file,id=tty,path=$dir/test.log")
+        control=(-no-reboot)
+    fi
+    [[ $host_traces == no ]] && host_trace=no
+    [[ $host_trace != no ]] && host_trace_start "$host_trace"
+    start=$(date +%s.%N)
+    # debug-threads names the vCPU threads (CPU N/KVM) for the host trace's lines.
+    timeout --foreground -k 10 "$boot_timeout" "$qemu" -machine q35 "$@" -name debug-threads=on \
+        -nodefaults -no-user-config "${control[@]}" -display none -sandbox on -m 1024 \
+        -drive "if=pflash,format=raw,unit=0,readonly=on,file=$guest/$firmware" \
+        -drive "if=pflash,format=raw,unit=1,file=$store" \
+        -drive "if=virtio,format=raw,readonly=on,file=fat:$run/esp" \
+        -kernel "$kernel" -initrd "$initrd" -append "console=ttyS0 uefisettings.tty=ttyS1 $append" \
+        -serial "file:$dir/console.log" \
+        "${terminal[@]}" -serial chardev:tty \
+        -d "guest_errors,unimp,$traces" -D "$dir/qemu.log" </dev/null >"$dir/qemu.stdout" 2>&1
+    rc=$?
+    end=$(date +%s.%N)
+    [[ $host_trace != no ]] && host_trace_stop "${trace#"$out/"}" "$dir" "$host_trace" "$(vcpus "$@")"
+    if [[ -n $supervisor ]]; then
+        wait "$supervisor"
+        echo "ci-diag-qmp.py exited with $?" >>"$dir/qmp.log"
+        rm -rf "$sockets"
+        require "$dir/qmp.log"
+    fi
+    [[ $host_trace != no ]] && require "$trace.host-kvm-trace.txt.gz"
+    [[ $host_trace == full ]] && require "$dir/attribution.txt"
+    # The artifacts of every boot; without them its lines below would read as a result.
+    if ! require "$dir/qemu.stdout" "$dir/qemu.log" "$dir/console.log" "$dir/test.log"; then
+        echo "  $arch $label: QEMU exited with $rc: $(tr '\n' ' ' <"$dir/qemu.stdout" | head -c 400)" |
+            tee -a "$out/summary.txt" >&2
+        return
+    fi
+    gzip "$dir/qemu.log" || harness_fail "$arch $label: gzip of qemu.log failed"
+    require "$dir/qemu.log.gz" || return
+    test=${append##*uefisettings.test=}
+    test=${test%% *}
+    boot_verdict "$dir" "$test" "$rc" >"$dir/verdict.txt"
+    sregs2_writes "$dir/qemu.log.gz" >"$dir/sregs2.txt" ||
+        harness_fail "$arch $label: counting the KVM_SET_SREGS2 calls failed"
+    {
+        echo "== $arch $label: $qemu -machine q35 $* -append ... $append; store $store"
+        echo "firmware $guest/$firmware; kernel $kernel; initrd $initrd"
+        echo "exit $rc after $(awk -v a="$start" -v b="$end" 'BEGIN { printf "%.1f", b - a }') s"
+        tr -d '\r' <"$dir/console.log" | grep -a 'uefisettings-qemu-test: exit' || echo "no exit line"
+        pti_line "$dir"
+        tr -d '\r' <"$dir/test.log" | grep -a -E '^test result|^step ' | tail -4 || true
+        # With -no-reboot, a reset (triple fault: KVM exit 8; reset port: exit 2) logs no
+        # shutdown request; a guest poweroff logs reason=6.
+        zcat "$dir/qemu.log.gz" | grep -a -E 'qemu_system_(shutdown|powerdown)_request|kvm_run_exit_system_event' | tail -3
+        echo "memory slot changes: $(zcat "$dir/qemu.log.gz" | grep -a -c '^kvm_set_user_memory')"
+        echo "last kvm_run_exit lines:"
+        zcat "$dir/qemu.log.gz" | grep -a kvm_run_exit | tail -4
+        echo "QEMU KVM_SET_SREGS2 per running period: $(cat "$dir/sregs2.txt")"
+        [[ -f $dir/qmp.log ]] && echo "qmp: $(grep -c ': resumed$' "$dir/qmp.log") pauses resumed;" \
+            "$(grep -a -E 'shutdown:|exited with' "$dir/qmp.log" | tr '\n' ' ')"
+        # Each vCPU's CR3 when QMP read the registers, from "info registers -a".
+        for registers in "$dir"/registers-*.txt; do
+            [[ -f $registers ]] || continue
+            awk -v pause="${registers##*registers-}" '/^CPU#/ { cpu = $1 }
+                match($0, /CR3=[0-9a-f]+/) { cr3 = substr($0, RSTART + 4, RLENGTH - 4)
+                    printf "registers at pause %s: %s CR3=%s (offset in its page 0x%s)\n", pause + 0, cpu, cr3, substr(cr3, length(cr3) - 2) }' "$registers"
+        done
+        [[ -f $dir/attribution.txt ]] && cat "$dir/attribution.txt"
+        if [[ -f $trace.host-kvm-trace.txt.gz ]]; then
+            [[ $host_trace == full ]] &&
+                zcat "$trace.host-kvm-trace.txt.gz" | awk '/ mmu_reset: / { n++ } END { print "host kvm_mmu_reset_context calls in the kept trace: " n + 0 }'
+            echo "host first faulting guest page walk after each root zap, by offset in its page: $(walk_offsets "$trace.host-kvm-trace.txt.gz")"
+            # linux-azure intercepts them after it changed the CR3 of a root load.
+            zcat "$trace.host-kvm-trace.txt.gz" | awk '/ kvm_cr: cr_(read|write) 3 = / { n++ } END { print "host kvm_cr CR3 accesses in the kept trace: " n + 0 }'
+            zcat "$trace.host-kvm-trace.txt.gz" |
+                sed -n -E 's/.* shutdown: .*vcpu_id=([0-9]+) cr3=0x([0-9a-f]+).*/shutdown probe: vcpu \1 VMCB CR3 0x\2/p'
+            # The CR4 that each vCPU's kernel set last: a CPUID mask changes it only through Linux.
+            zcat "$trace.host-kvm-trace.txt.gz" |
+                sed -n -E 's/.*CPU ([0-9]+)\/KVM-.*kvm_cr: cr_write 4 = (0x[0-9a-f]+).*/vCPU \1 CR4 \2/p' | awk '{last[$2] = $0} END {for (c in last) print "last " last[c]}'
+        fi
+        echo "verdict: $(cat "$dir/verdict.txt")"
+    } >>"$out/summary.txt"
+}
+
+# walk_offsets TRACE_GZ: the offsets in their page of the first guest page walk that faults
+# (PFERR_GUEST_PAGE, bit 33 of kvm_page_fault's error code) after each root zap
+# (kvm_mmu_zap_all_fast) in TRACE_GZ, as 0xOFFSET:COUNT, or none. A PAE vCPU's walk starts at
+# its PDPT; the error code's hex digit 8 holds bits 32-35, done in text as mawk has no strtonum.
+# On SVM the error code is the #NPF's (Linux v7.0 arch/x86/kvm/svm/svm.c:1956); on VMX it is
+# the EPT violation's exit qualification (vmx/vmx.c:6052), where no line counts.
+walk_offsets() {
+    local offsets
+    offsets=$(zcat "$1" | awk '/ kvm_mmu_zap_all_fast: / { armed = 1; next }
+        armed && / kvm_page_fault: / {
+            code = $0; sub(/.* error_code 0x/, "", code)
+            if (length(code) < 9 || substr(code, length(code) - 8, 1) !~ /[2367abef]/) next
+            address = $0; sub(/.* address 0x/, "", address); sub(/ .*/, "", address)
+            n[substr(address, length(address) - 2)]++
+            armed = 0
+        }
+        END { for (o in n) print "0x" o ":" n[o] }' | sort | tr '\n' ' ')
+    echo "${offsets:-none}"
+}
+
+# sregs2_writes QEMU_LOG_GZ: the register writes of QEMU (KVM_SET_SREGS2, which carries a PAE
+# vCPU's PDPTRs: _IOW(KVMIO, 0xcd, struct kvm_sregs2) = 0x4140aecd,
+# include/uapi/linux/kvm.h:1480) in each period that the VM ran, from its start to the first
+# pause and on from each cont, as numbers separated by spaces; false if the log has no period.
+sregs2_writes() {
+    zcat "$1" | awk '/^vm_state_notify running 1 / { n[++runs] = 0 }
+        /^kvm_vcpu_ioctl .* type 0x4140aecd,/ { n[runs]++ }
+        END { if (runs == 0) exit 1; for (i = 1; i <= runs; i++) printf "%s%d", (i > 1 ? " " : ""), n[i]; print "" }'
+}
+
+# pti_line DIR: the first "page tables isolation" line of DIR's console, or a note that it has
+# none. grep reads the file itself: at the end of a pipe, grep -m 1 would leave its writer to
+# die of SIGPIPE, which pipefail reports as no match.
+pti_line() {
+    grep -a -m 1 'page tables isolation' "$1/console.log" | tr -d '\r' || echo "no page table isolation line"
+}
+
+# boot_verdict DIR TEST RC: "refused", "died", "hung", "survived" or "other", then why, for the
+# boot in DIR of the guest test TEST, whose QEMU exited with RC. A guest whose VMRUN failed
+# (KVM_EXIT_FAIL_ENTRY, 9: QEMU v10.2.0 prints "KVM: entry failed" and stops the VM,
+# target/i386/kvm/kvm.c:6117-6133, accel/kvm/kvm-all.c:3337-3339) was refused. One that resets
+# (a KVM exit 8) before the end of its test died; one that its timeout (RC 124) ended after its
+# test started its trigger (memslot printed its BAR, just before its first toggle; sync's first
+# QMP stop), without a reset or the end of its test, hung; one that ends its test survived if
+# the test did what it should: memslot's 200 deletions of its BAR's slot, sync's pauses, a hii
+# test's pass. Anything else (an unassigned BAR, a failed test, a hang before the trigger) is
+# other.
+# The deletions count the BAR's slot from the start: Debian's 6.1 makes 8 while it boots.
+boot_verdict() {
+    local dir=$1 test=$2 rc=$3 refusals resets ended bar deletes=0 resumed
+    # grep -c reads to the end: grep -q would leave zcat to die of SIGPIPE (see pti_line).
+    refusals=$(zcat "$dir/qemu.log.gz" | grep -a -c -E '^kvm_run_exit cpu_index [0-9]+, reason 9$')
+    if ((refusals > 0)); then
+        echo "refused: KVM exit 9 ($(grep -a -m 1 'KVM: entry failed' "$dir/qemu.stdout" || echo 'no QEMU message'))"
+        return
+    fi
+    resets=$(zcat "$dir/qemu.log.gz" | grep -a -c -E '^kvm_run_exit cpu_index [0-9]+, reason 8$')
+    case $test in
+    memslot | sync) ended=$(tr -d '\r' <"$dir/test.log" | grep -a -c '^step .*: end$') ;;
+    *) ended=$(tr -d '\r' <"$dir/console.log" | grep -a -c '^uefisettings-qemu-test: exit 0 0$') ;;
+    esac
+    if [[ $test == memslot ]]; then
+        bar=$(tr -d '\r' <"$dir/test.log" | sed -n -E 's/.*, BAR 2 (0x[0-9a-f]+) .*/\1/p' | head -n 1)
+        # QEMU's trace prints the address without the resource file's leading zeros.
+        [[ -n $bar ]] && bar=$(printf '0x%x' "$bar")
+        [[ -n $bar ]] && ((bar != 0)) && deletes=$(zcat "$dir/qemu.log.gz" |
+            grep -a -c -E "^kvm_set_user_memory AddrSpace#0 .* gpa=$bar size=0x0 ")
+    fi
+    if ((resets > 0 && ended == 0)); then
+        case $test in
+        memslot) echo "died: KVM exit 8 after $deletes deletions of the slot at BAR 2 ${bar:-none}" ;;
+        sync) echo "died: KVM exit 8 after $(grep -c ': resumed$' "$dir/qmp.log") resumed pauses" ;;
+        *) echo "died: KVM exit 8" ;;
+        esac
+        return
+    fi
+    if ((ended == 0 && rc == 124)) && { [[ $test == memslot ]] && ((deletes > 0)) ||
+        { [[ $test == sync ]] && grep -q ': pause 1: stopped$' "$dir/qmp.log"; }; }; then
+        echo "hung: timeout, no reset and no end, after $([[ $test == memslot ]] && echo "$deletes deletions of the slot at BAR 2 $bar" ||
+            echo "$(grep -c ': resumed$' "$dir/qmp.log") resumed pauses") (last: $(tr -d '\r' <"$dir/test.log" | grep -a '^step ' | tail -n 1))"
+        return
+    fi
+    if ((ended == 0)); then
+        echo "other: no reset, and the test did not end well (last: $(tr -d '\r' <"$dir/test.log" |
+            grep -a '^step ' | tail -n 1)$(tr -d '\r' <"$dir/console.log" | grep -a 'uefisettings-qemu-test: exit' | tail -n 1))"
+        return
+    fi
+    case $test in
+    memslot)
+        if [[ -n $bar ]] && ((bar != 0 && deletes >= 200)); then
+            echo "survived: $deletes deletions of the slot at BAR 2 $bar"
+        else
+            echo "other: vacuous: BAR 2 '${bar:-none}', $deletes deletions of its slot"
+        fi
+        ;;
+    sync)
+        resumed=$(grep -c ': resumed$' "$dir/qmp.log")
+        if ((resumed == sync_pauses)); then
+            echo "survived: $resumed pauses"
+        else
+            echo "other: vacuous: $resumed of $sync_pauses pauses"
+        fi
+        ;;
+    *) echo "survived: the test passed" ;;
+    esac
+}
+
+# in_time LABEL: false, with a line in the summary, once the deadline has passed.
+in_time() {
+    ((SECONDS <= deadline)) && return 0
+    echo "skipped after the deadline: $1" | tee -a "$out/cells.txt" >>"$out/summary.txt"
+    return 1
+}
+
+# vcpus QEMU-ARG...: the vCPU count of the -smp in QEMU-ARG.
+vcpus() {
+    while (($# > 1)); do
+        [[ $1 == -smp ]] && echo "${2%%,*}" && return
+        shift
+    done
+    echo 1
+}
+
+# require PATH...: false, with a MISSING line per absent path, unless all exist.
+require() {
+    local path missing=0
+    for path; do
+        if [[ ! -e $path ]]; then
+            echo "MISSING $path" | tee -a "$out/summary.txt" >&2
+            harness_failures=$((harness_failures + 1))
+            missing=1
+        fi
+    done
+    return "$missing"
+}
+
+# wanted LABEL: whether DIAG_ONLY names the arch's LABEL, or is empty.
+wanted() {
+    [[ -z ${DIAG_ONLY:-} || " ${DIAG_ONLY//,/ } " == *" $arch/$1 "* ]]
+}
+
+# verdict_of DIR: the verdict of DIR's boot, or "other: no verdict".
+verdict_of() {
+    if [[ -f $1/verdict.txt ]]; then
+        cat "$1/verdict.txt"
+    else
+        echo "other: no verdict"
+    fi
+}
+
+# The cells of the arch at hand: cell NAME TEST PAUSE KERNEL APPEND QEMU-ARGS registers one,
+# run_cells boots each DIAG_REPS times round-robin, with host traces of mode cell_trace (see
+# host_trace_start); a cell whose first boot's verdict is other, or that had a refused boot,
+# boots no more, and no cell starts a boot after the deadline.
+cell_names=()
+cell_trace=full
+declare -A cell_test cell_pause cell_kernel cell_append cell_args cell_died cell_hung cell_survived cell_refused cell_other cell_skipped
+cell() {
+    wanted "$1" || return 0
+    cell_names+=("$1")
+    cell_test[$1]=$2
+    cell_pause[$1]=$3
+    cell_kernel[$1]=$4
+    cell_append[$1]=$5
+    cell_args[$1]=$6
+    cell_died[$1]=0
+    cell_hung[$1]=0
+    cell_survived[$1]=0
+    cell_refused[$1]=0
+    cell_other[$1]=0
+    cell_skipped[$1]=0
+}
+
+run_cells() {
+    local n name label args verdict first
+    for ((n = 1; n <= reps; n++)); do
+        for name in "${cell_names[@]}"; do
+            first=$(verdict_of "$out/$arch/$name/1")
+            if ((n > 1)) && [[ $first == other* ]]; then
+                echo "skipped, as its cell's first boot is other: $arch $name/$n" |
+                    tee -a "$out/cells.txt" >>"$out/summary.txt"
+                cell_skipped[$name]=$((cell_skipped[$name] + 1))
+                continue
+            fi
+            if ((cell_refused[$name] > 0)); then
+                echo "skipped, as its cell had a refused boot: $arch $name/$n" |
+                    tee -a "$out/cells.txt" >>"$out/summary.txt"
+                cell_skipped[$name]=$((cell_skipped[$name] + 1))
+                continue
+            fi
+            if ! in_time "$arch $name/$n"; then
+                cell_skipped[$name]=$((cell_skipped[$name] + 1))
+                continue
+            fi
+            label=$name/$n
+            read -r -a args <<<"${cell_args[$name]}"
+            mkdir -p "$out/$arch/$label"
+            fresh_store "$out/$arch/$label/vars.fd"
+            # The whole trace of a cell's first boot; less of the others'.
+            trace_tail=2000000 vcpu_tail=500000
+            ((n > 1)) && trace_tail=200000 vcpu_tail=100000
+            boot "$label" "$out/$arch/$label/vars.fd" "$apt_qemu" "$cell_trace" "${cell_pause[$name]}" \
+                "${cell_kernel[$name]}" "$out/$arch/stepwise-initrd.img" \
+                "ignore_loglevel panic=-1 uefisettings.test=${cell_test[$name]} diag.pauses=$sync_pauses ${cell_append[$name]}" \
+                "${args[@]}"
+            verdict=$(verdict_of "$out/$arch/$label")
+            case $verdict in
+            died*) cell_died[$name]=$((cell_died[$name] + 1)) ;;
+            hung*) cell_hung[$name]=$((cell_hung[$name] + 1)) ;;
+            survived*) cell_survived[$name]=$((cell_survived[$name] + 1)) ;;
+            refused*) cell_refused[$name]=$((cell_refused[$name] + 1)) ;;
+            *)
+                cell_other[$name]=$((cell_other[$name] + 1))
+                harness_fail "$arch $label: $verdict"
+                ;;
+            esac
+        done
+    done
+    trace_tail=2000000 vcpu_tail=500000
+    for name in "${cell_names[@]}"; do
+        report_cell "$name"
+    done
+    cell_names=()
+}
+
+# kernel_release KERNEL: the release of a kernel image, from its path: Debian's
+# boot/vmlinuz-RELEASE or lib/modules/RELEASE/vmlinuz.
+kernel_release() {
+    local base=${1##*/}
+    if [[ $base == vmlinuz ]]; then
+        base=${1%/vmlinuz}
+        echo "${base##*/}"
+    else
+        echo "${base#vmlinuz-}"
+    fi
+}
+
+# stress_round_trips DIR: the round trips that the stressor of DIR's boot made in about its
+# first second, or nothing without that line.
+stress_round_trips() {
+    tr -d '\r' <"$1/test.log" |
+        sed -n -E 's/^step [0-9.]+: stress: ([0-9]+) round trips in about a second$/\1/p' | head -n 1
+}
+
+# cell_boot_proof NAME K: why boot K of cell NAME does not show that what its verdict depends
+# on took place, or nothing: the cell's kernel booted (its "Linux version" line); PTI is on
+# with pti=on and off without (its "page tables isolation" line); the stressor made at least
+# 1000 round trips in its first second with diag.stress; a death came after its test started
+# its trigger (memslot printed its BAR; a QMP stop); QEMU's KVM_SET_SREGS2 counts exist for a
+# cell with pauses, are all 0 for plain pauses, and show a write-back after a pause with a
+# register read.
+cell_boot_proof() {
+    local name=$1 dir=$out/$arch/$1/$2 release trips count verdict after
+    release=$(kernel_release "${cell_kernel[$name]}")
+    # Each grep reads the file itself: grep -q at the end of a pipe exits at its first match, and
+    # under pipefail the writer's SIGPIPE would make the match read as a failure.
+    if ! grep -a -q -F "Linux version $release " "$dir/console.log"; then
+        echo "boot $2: no 'Linux version $release' line"
+        return
+    fi
+    if [[ " ${cell_append[$name]} " == *" pti=on "* ]]; then
+        grep -a -q 'page tables isolation: .*enabled' "$dir/console.log" ||
+            { echo "boot $2: no PTI line"; return; }
+    elif grep -a -q 'page tables isolation: .*enabled' "$dir/console.log"; then
+        echo "boot $2: PTI without pti=on"
+        return
+    fi
+    if [[ " ${cell_append[$name]} " == *" diag.stress "* ]]; then
+        trips=$(stress_round_trips "$dir")
+        if [[ ! $trips =~ ^[0-9]+$ ]] || ((trips < 1000)); then
+            echo "boot $2: the stressor did not run (round trips: ${trips:-no line})"
+            return
+        fi
+    fi
+    verdict=$(verdict_of "$dir")
+    if [[ $verdict == died* ]]; then
+        case ${cell_test[$name]} in
+        memslot)
+            if [[ ! $verdict =~ after\ ([0-9]+)\ deletions ]] || ((BASH_REMATCH[1] == 0)); then
+                echo "boot $2: died before its test printed its BAR"
+                return
+            fi
+            ;;
+        sync)
+            grep -q ': pause 1: stopped$' "$dir/qmp.log" || { echo "boot $2: died before the first pause"; return; }
+            ;;
+        esac
+    fi
+    [[ ${cell_pause[$name]} == no ]] && return
+    count=missing
+    [[ -f $dir/sregs2.txt ]] && count=$(<"$dir/sregs2.txt")
+    if [[ ! $count =~ ^[0-9]+( [0-9]+)*$ ]]; then
+        echo "boot $2: no KVM_SET_SREGS2 counts"
+        return
+    fi
+    case ${cell_pause[$name]} in
+    plain) [[ $count != *[1-9]* ]] || echo "boot $2: QEMU wrote registers back in a plain pause" ;;
+    registers)
+        # The periods from the first cont on: all but the first.
+        if grep -q ': pause 1: resumed$' "$dir/qmp.log"; then
+            after=
+            [[ $count == *" "* ]] && after=${count#* }
+            [[ $after == *[1-9]* ]] || echo "boot $2: no register write-back after a pause"
+        fi
+        ;;
+    esac
+}
+
+# report_cell NAME: the counts of a cell and its class by the decision rule of the header: it
+# decides only on all DIAG_REPS boots of a cell, and only if each of them proves what its
+# verdict depends on (cell_boot_proof); with the KVM_SET_SREGS2 counts per running period of
+# each boot of a cell with pauses, and the stressor's round trips of each of a stressed one.
+report_cell() {
+    local name=$1 died=${cell_died[$1]} hung=${cell_hung[$1]} survived=${cell_survived[$1]} refused=${cell_refused[$1]} other=${cell_other[$1]}
+    local n=$((cell_died[$1] + cell_hung[$1] + cell_survived[$1] + cell_refused[$1] + cell_other[$1])) class proof='' details='' counts='' trips='' k count
+    for ((k = 1; k <= reps; k++)); do
+        [[ -f $out/$arch/$name/$k/verdict.txt ]] || continue
+        [[ -z $proof ]] && proof=$(cell_boot_proof "$name" "$k")
+        count=missing
+        [[ -f $out/$arch/$name/$k/sregs2.txt ]] && count=$(<"$out/$arch/$name/$k/sregs2.txt")
+        counts+="[$count]"
+        trips+="[$(stress_round_trips "$out/$arch/$name/$k")]"
+    done
+    [[ ${cell_pause[$1]} != no ]] && details+="; KVM_SET_SREGS2 per running period: ${counts:-none}"
+    [[ " ${cell_append[$1]} " == *" diag.stress "* ]] && details+="; stressor round trips in the first second: ${trips:-none}"
+    if ((other > 0)); then
+        class=harness
+    elif ((refused > 0)); then
+        class=refused
+    elif ((n < reps)); then
+        class="incomplete, $n of $reps boots"
+    elif [[ -n $proof ]]; then
+        class="invalid, $proof"
+    elif ((died * 10 >= 8 * n)); then
+        class=dies
+    elif ((died * 10 <= n && died + survived == n)); then
+        class=survives
+    else
+        class=mixed
+    fi
+    echo "cell $arch $name: $n boots: $died died, $hung hung, $survived survived, $refused refused, $other other, ${cell_skipped[$1]} skipped: $class$details" |
+        tee -a "$out/cells.txt" >>"$out/summary.txt"
+}
+
+# The cells' QEMU, without the VMware backdoor port, whose handler reads the
+# registers (QEMU v10.2.0 hw/i386/vmport.c:93-107), so that QEMU writes them back: openSUSE's
+# and Fedora's kernels probe it (8 more KVM_SET_SREGS2 a boot here), Debian's 6.1 does not.
+smp1=(-accel kvm -cpu host -smp 1 -machine vmport=off)
+ivshmem='-object memory-backend-ram,id=shm,size=4M -device ivshmem-plain,memdev=shm'
+
+# kmod's modinfo, by its path: the runner user's PATH need not have /usr/sbin.
+modinfo=/usr/sbin/modinfo
+
+# kvm_amd_loadable: whether this runner can take kvm-amd.ko as built by ci-diag-kvm-amd.sh: the
+# kernel it is for, with kvm_amd loaded, no lockdown and no signature enforcement (an unsigned
+# module then loads and taints the kernel), each logged.
+kvm_amd_loadable() {
+    local lockdown sig_enforce
+    lockdown=$(sudo cat /sys/kernel/security/lockdown 2>&1)
+    sig_enforce=$(cat /sys/module/module/parameters/sig_enforce 2>&1)
+    echo "kernel $(uname -r); lockdown: $lockdown; module.sig_enforce: $sig_enforce" |
+        tee -a "$out/facts.txt" >>"$out/summary.txt"
+    if [[ $(uname -r) != 7.0.0-1017-azure || ! -d /sys/module/kvm_amd ]]; then
+        harness_fail "the kvm-amd.ko builds are for 7.0.0-1017-azure with kvm_amd loaded, not $(uname -r)"
+        return 1
+    fi
+    if [[ $lockdown != *"[none]"* || $sig_enforce != N ]]; then
+        harness_fail "this kernel may refuse an unsigned kvm-amd.ko"
+        return 1
+    fi
+}
+
+# kvm_amd_build: builds kvm-amd.ko as shipped and with the fix to $out/kvm-amd
+# (ci-diag-kvm-amd.sh), comparing the first with the module that modprobe loads.
+kvm_amd_build() {
+    local shipped
+    if ! shipped=$("$modinfo" -n kvm_amd 2>&1); then
+        harness_fail "modinfo finds no kvm_amd: $shipped"
+        return 1
+    fi
+    if ! TMPDIR=$repo/target/qemu-test "$here/ci-diag-kvm-amd.sh" "$repo/target/qemu-test/kvm-amd-downloads" \
+        "$out/kvm-amd" "$shipped" >"$out/kvm-amd-build.log" 2>&1; then
+        harness_fail "building kvm-amd.ko failed, see kvm-amd-build.log"
+        return 1
+    fi
+    cat "$out/kvm-amd/comparison.txt" >>"$out/summary.txt"
+}
+
+# kvm_amd_params: kvm_amd's parameters as NAME=VALUE lines; some are root's only.
+kvm_amd_params() {
+    sudo sh -c 'cd /sys/module/kvm_amd/parameters && for p in *; do echo "$p=$(cat "$p")"; done'
+}
+
+# load_kvm_amd KO: replaces the running kvm_amd with KO, a kvm-amd.ko, or with the shipped one for
+# "shipped", with the options that modprobe gives it (/etc/modprobe.d); true if the running
+# module then is KO's (its srcversion), /dev/kvm is open to this user again, and, with
+# dump_invalid_vmcb on again, the module has the parameters that the shipped one had
+# (kvm_amd_shipped_params).
+load_kvm_amd() {
+    local ko=$1 options='' want running params
+    if [[ -d /sys/module/kvm_amd ]] && ! sudo rmmod kvm_amd 2>>"$out/kvm-amd-load.log"; then
+        harness_fail "kvm_amd: rmmod failed, see kvm-amd-load.log"
+        return 1
+    fi
+    if [[ $ko == shipped ]]; then
+        sudo modprobe kvm_amd 2>>"$out/kvm-amd-load.log"
+        want=$("$modinfo" -F srcversion kvm_amd)
+    else
+        options=$(sudo modprobe -n -v kvm_amd | sed -n -E 's/^insmod [^ ]*\/kvm-amd\.ko[^ ]* *//p')
+        # shellcheck disable=SC2086 # modprobe's options, a word each
+        sudo insmod "$ko" $options 2>>"$out/kvm-amd-load.log"
+        want=$("$modinfo" -F srcversion "$ko")
+    fi
+    running=$(cat /sys/module/kvm_amd/srcversion 2>&1)
+    echo "kvm_amd: loaded ${ko#"$out/"}${options:+ with $options}: srcversion $running (want $want), taint '$(cat /sys/module/kvm_amd/taint 2>&1)'" |
+        tee -a "$out/cells.txt" >>"$out/summary.txt"
+    sudo dmesg | tail -n 5 >>"$out/kvm-amd-load.log"
+    if [[ $running != "$want" ]]; then
+        harness_fail "kvm_amd: the running module's srcversion is '$running', not $want"
+        return 1
+    fi
+    # Unloading kvm_amd removes /dev/kvm and loading it adds the node again (kvm_exit and
+    # kvm_init, Linux v7.0 virt/kvm/kvm_main.c:6547, 6583), root's only until udev applies
+    # checks.yml's rule.
+    sudo udevadm settle --timeout=30 2>>"$out/kvm-amd-load.log"
+    if [[ ! -r /dev/kvm || ! -w /dev/kvm ]]; then
+        harness_fail "kvm_amd: /dev/kvm is not open to $(id -un) after the load: $(ls -l /dev/kvm 2>&1)"
+        return 1
+    fi
+    echo Y | sudo tee /sys/module/kvm_amd/parameters/dump_invalid_vmcb >/dev/null
+    params=$(kvm_amd_params)
+    if [[ $params != "$kvm_amd_shipped_params" ]]; then
+        diff <(echo "$kvm_amd_shipped_params") <(echo "$params") >>"$out/kvm-amd-load.log"
+        harness_fail "kvm_amd: ${ko#"$out/"} has other parameters than the shipped one, see kvm-amd-load.log"
+        return 1
+    fi
+}
+
+# The fifth round: c1 under memslot and sync on kvm-amd.ko as shipped (stock), then with the fix
+# (poc), then the shipped module again.
+if select_arch i686; then
+    boot_timeout=$((90 * slow))
+    cell_trace=events
+    if kvm_amd_loadable && kvm_amd_build; then
+        echo Y | sudo tee /sys/module/kvm_amd/parameters/dump_invalid_vmcb >/dev/null
+        kvm_amd_shipped_params=$(kvm_amd_params)
+        for variant in stock poc; do
+            load_kvm_amd "$out/kvm-amd/$variant/kvm-amd.ko" || continue
+            cell "c1-memslot-$variant" memslot no "$vmlinuz" "" "${smp1[*]} $ivshmem"
+            cell "c1-sync-$variant" sync registers "$vmlinuz" "" "${smp1[*]}"
+            run_cells
+        done
+        load_kvm_amd shipped
+    fi
+fi
+
+sudo dmesg >"$out/dmesg-after.txt" 2>&1
+# However the variants above end, a diag that booted nothing has nothing to show.
+((boots > 0)) || harness_fail "no boot ran"
+cat "$out/summary.txt"
+echo "== cells"
+cat "$out/cells.txt"
+if ((harness_failures > 0)); then
+    echo "ci-diag-reset.sh: $harness_failures harness failures" >&2
+    exit 1
+fi
diff --git a/tests/qemu/fetch-kernel.sh b/tests/qemu/fetch-kernel.sh
deleted file mode 100755
index 732fb55..0000000
--- a/tests/qemu/fetch-kernel.sh
+++ /dev/null
@@ -1,57 +0,0 @@
-#!/bin/bash
-# Copyright 2023 Meta Platforms, Inc. and affiliates.
-#
-# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-#
-# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-#
-# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-#
-# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# Downloads the guest kernel's RPMs that tests/qemu/kernel.sha256 lists into CACHE, checks
-# them against their sha256 and unpacks them into the new directory ROOT. RPMs already in
-# CACHE with the right sha256 are not downloaded again. Each mirror gets at most 1220 s for
-# an RPM, so the download of an RPM from both mirrors stops within about 41 minutes.
-#
-# Usage: tests/qemu/fetch-kernel.sh CACHE ROOT
-
-set -euo pipefail
-
-if (($# != 2)); then
-    echo "usage: $0 CACHE ROOT" >&2
-    exit 2
-fi
-cache=$1
-root=$2
-list=$(realpath "$(dirname "$0")/kernel.sha256")
-# Fedora 43 packages; the archive keeps them once the release reaches its end of life.
-mirrors=(
-    https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/Packages/k
-    https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/43/Everything/x86_64/os/Packages/k
-)
-
-mkdir -p "$cache"
-cd "$cache"
-while read -r sum rpm; do
-    if ! sha256sum --check --status <<<"$sum  $rpm" 2>/dev/null; then
-        # --max-time ends a try that stalls: kernel-core, about 21 MB, takes 300 s only
-        # below 70 kB/s. curl makes up to 4 tries with waits of 1, 2 and 4 s between
-        # them, 1207 s in all, but waits longer when the server sends a Retry-After
-        # header, so timeout stops curl after 1210 s and kills it 10 s later. Without
-        # --foreground, timeout would move curl into a process group of its own, which a
-        # timeout around make does not reach.
-        for mirror in "${mirrors[@]}"; do
-            timeout --foreground -k 10 1210 curl --fail --silent --show-error --location \
-                --retry 3 --max-time 300 --output "$rpm" "$mirror/$rpm" && break
-        done
-    fi
-done <"$list"
-sha256sum --check --strict "$list"
-
-mkdir "$root"
-while read -r _ rpm; do
-    rpm2cpio "$rpm" | (cd "$root" && cpio --extract --make-directories --preserve-modification-time --quiet)
-done <"$list"
diff --git a/tests/qemu/fetch-packages.sh b/tests/qemu/fetch-packages.sh
new file mode 100755
index 0000000..5ec55d0
--- /dev/null
+++ b/tests/qemu/fetch-packages.sh
@@ -0,0 +1,136 @@
+#!/bin/bash
+# Copyright 2023 Meta Platforms, Inc. and affiliates.
+#
+# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+#
+# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+#
+# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Downloads the packages that LIST names into CACHE, checks them against their sha256 and
+# unpacks them, .rpm and .deb alike, into the new directory ROOT. Each line of LIST that is
+# neither empty nor a # comment holds the sha256 of a package and then its HTTPS URLs,
+# mirrors of one another that end in the same file name, with a permanent archive last, as
+# distributions drop superseded packages from their pools. The whole list is checked before
+# any download. A package already in CACHE with the right sha256 is not downloaded again;
+# otherwise its URLs are tried in order, the next one after a failed download or a sha256
+# mismatch, each for at most 1220 s. ROOT appears only once every package is right and
+# unpacked.
+#
+# Usage: tests/qemu/fetch-packages.sh LIST CACHE ROOT
+
+set -euo pipefail
+
+if (($# != 3)); then
+    echo "usage: $0 LIST CACHE ROOT" >&2
+    exit 2
+fi
+list=$(realpath "$1")
+cache=$2
+root=$(realpath -m "$3")
+if [[ -e $root ]]; then
+    echo "$root exists" >&2
+    exit 1
+fi
+
+sums=()
+files=()
+mirrors=()
+# read fails on a last line without a newline, which still counts.
+while read -r sum urls || [[ -n $sum ]]; do
+    [[ -z $sum || $sum == \#* ]] && continue
+    if [[ ! $sum =~ ^[0-9a-f]{64}$ ]]; then
+        echo "$list: $sum is not a sha256" >&2
+        exit 1
+    fi
+    read -r -a urls <<<"$urls"
+    if ((${#urls[@]} == 0)); then
+        echo "$list: no URL for $sum" >&2
+        exit 1
+    fi
+    file=${urls[0]##*/}
+    case $file in
+    *.rpm | *.deb) ;;
+    *)
+        echo "$list: $file is neither an .rpm nor a .deb" >&2
+        exit 1
+        ;;
+    esac
+    for url in "${urls[@]}"; do
+        if [[ $url != https://* ]]; then
+            echo "$list: $url is not an HTTPS URL" >&2
+            exit 1
+        fi
+        if [[ ${url##*/} != "$file" ]]; then
+            echo "$list: the URLs of $file name other files: ${urls[*]}" >&2
+            exit 1
+        fi
+    done
+    sums+=("$sum")
+    files+=("$file")
+    mirrors+=("${urls[*]}")
+done <"$list"
+if ((${#files[@]} == 0)); then
+    echo "$list: no package" >&2
+    exit 1
+fi
+
+mkdir -p "$cache"
+cd "$cache"
+for i in "${!files[@]}"; do
+    sum=${sums[i]}
+    file=${files[i]}
+    read -r -a urls <<<"${mirrors[i]}"
+    # The -f test keeps the sha256sum of uutils (Ubuntu 26.04) from printing "FAILED open
+    # or read" for a missing file, which it does even with --status.
+    if ! { [[ -f $file ]] && sha256sum --check --status <<<"$sum  $file"; } 2>/dev/null; then
+        # --max-time ends a try that stalls: the i686 kernel, the biggest package at about
+        # 52 MB, takes 300 s only below 175 kB/s. curl makes up to 4 tries with waits of 1,
+        # 2 and 4 s between them, 1207 s in all, but waits longer when the server sends a
+        # Retry-After header, so timeout stops curl after 1210 s and kills it 10 s later.
+        # Without --foreground, timeout would move curl into a process group of its own,
+        # which a timeout around make does not reach.
+        for url in "${urls[@]}"; do
+            timeout --foreground -k 10 1210 curl --fail --silent --show-error --location \
+                --proto =https --proto-redir =https --retry 3 --max-time 300 \
+                --output "$file" "$url" &&
+                sha256sum --check --status <<<"$sum  $file" && break
+        done
+    fi
+    sha256sum --check --strict <<<"$sum  $file"
+done
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+# Unpacked next to ROOT and renamed to it at the end, so that a failure leaves no ROOT.
+staging=$(mktemp -d "$root.XXXXXX")
+trap 'rm -rf "$work" "$staging"' EXIT
+# mkdir's mode, not mktemp's 0700.
+chmod "$(umask -S)" "$staging"
+unpack_failed() {
+    echo "fetch-packages.sh: cannot unpack $1" >&2
+    exit 1
+}
+for file in "${files[@]}"; do
+    echo "fetch-packages.sh: unpacking $file"
+    case $file in
+    *.rpm)
+        rpm2cpio "$file" |
+            (cd "$staging" && cpio --extract --make-directories --preserve-modification-time \
+                --no-absolute-filenames --quiet) ||
+            unpack_failed "$file"
+        ;;
+    *.deb)
+        # An ar archive whose member data.tar, compressed or not, holds the files.
+        data=$(ar t "$file" | grep -E --line-regexp 'data\.tar(\.[a-z0-9]+)?') ||
+            unpack_failed "$file"
+        ar p "$file" "$data" >"$work/$data" || unpack_failed "$file"
+        tar --extract --file "$work/$data" --directory "$staging" || unpack_failed "$file"
+        ;;
+    esac
+done
+mv -T "$staging" "$root"
diff --git a/tests/qemu/guest-packages-aarch64 b/tests/qemu/guest-packages-aarch64
new file mode 100644
index 0000000..3f56f19
--- /dev/null
+++ b/tests/qemu/guest-packages-aarch64
@@ -0,0 +1,4 @@
+# The kernel, firmware and busybox of the aarch64 guests, in the format of fetch-packages.sh.
+9328e61443dcd71e5671806fbef4345eb15a988229b011340fac8b856315c3ee https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/aarch64/os/Packages/k/kernel-core-6.17.1-300.fc43.aarch64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/43/Everything/aarch64/os/Packages/k/kernel-core-6.17.1-300.fc43.aarch64.rpm
+fad8e80e929cd00dae8c5c8e5dd3ec85f37d9a832eea776957e5e2cf86ef2ab5 https://archive.ubuntu.com/ubuntu/pool/main/e/edk2/qemu-efi-aarch64_2024.02-2ubuntu0.10_all.deb https://launchpad.net/ubuntu/+archive/primary/+files/qemu-efi-aarch64_2024.02-2ubuntu0.10_all.deb
+d96535e0402c011e0ee43449799df2f4504d44b842e4f2b3a6cbc845508eaafc https://ports.ubuntu.com/ubuntu-ports/pool/main/b/busybox/busybox-static_1.36.1-6ubuntu3.1_arm64.deb https://launchpad.net/ubuntu/+archive/primary/+files/busybox-static_1.36.1-6ubuntu3.1_arm64.deb
diff --git a/tests/qemu/guest-packages-i686 b/tests/qemu/guest-packages-i686
new file mode 100644
index 0000000..cbab1a6
--- /dev/null
+++ b/tests/qemu/guest-packages-i686
@@ -0,0 +1,4 @@
+# The kernel, firmware and busybox of the i686 guests, in the format of fetch-packages.sh.
+0d6241268f9344a998c3339c11e527ea8048d409d6c770f67c573707606a3f2e https://deb.debian.org/debian/pool/main/l/linux-signed-i386/linux-image-6.1.0-50-686-pae_6.1.176-1_i386.deb https://snapshot.debian.org/archive/debian/20260704T211317Z/pool/main/l/linux-signed-i386/linux-image-6.1.0-50-686-pae_6.1.176-1_i386.deb
+45fb466babfad1f5a51c65d656ba338ae46a7b8bbcda61234b79753a7359d423 https://archive.ubuntu.com/ubuntu/pool/universe/e/edk2/ovmf-ia32_2024.02-2ubuntu0.10_all.deb https://launchpad.net/ubuntu/+archive/primary/+files/ovmf-ia32_2024.02-2ubuntu0.10_all.deb
+39c410d5bc570ce2a4e14055bcf021afbae75bc0efe850634138234828b3416a https://archive.ubuntu.com/ubuntu/pool/main/b/busybox/busybox-static_1.36.1-6ubuntu3.1_i386.deb https://launchpad.net/ubuntu/+archive/primary/+files/busybox-static_1.36.1-6ubuntu3.1_i386.deb
diff --git a/tests/qemu/guest-packages-x86_64 b/tests/qemu/guest-packages-x86_64
new file mode 100644
index 0000000..cca7ea8
--- /dev/null
+++ b/tests/qemu/guest-packages-x86_64
@@ -0,0 +1,4 @@
+# The kernel, firmware and busybox of the x86_64 guests, in the format of fetch-packages.sh.
+ab1418c266e2b4b26090ab13e96c249a6bbe7a6fadca09c4e98c9ff477a5d58f https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/Packages/k/kernel-core-6.17.1-300.fc43.x86_64.rpm https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/43/Everything/x86_64/os/Packages/k/kernel-core-6.17.1-300.fc43.x86_64.rpm
+78a6a3a4ffa666f1cb25e9069e4ec9270b5ceac7987b6eefc2674bd3f58a1473 https://archive.ubuntu.com/ubuntu/pool/main/e/edk2/ovmf_2024.02-2ubuntu0.10_all.deb https://launchpad.net/ubuntu/+archive/primary/+files/ovmf_2024.02-2ubuntu0.10_all.deb
+944b2728f53ceb3916cec2c962873c9951e612408099601751db2a0a5d81e0ed https://archive.ubuntu.com/ubuntu/pool/main/b/busybox/busybox-static_1.36.1-6ubuntu3.1_amd64.deb https://launchpad.net/ubuntu/+archive/primary/+files/busybox-static_1.36.1-6ubuntu3.1_amd64.deb
diff --git a/tests/qemu/guest/Cargo.toml b/tests/qemu/guest/Cargo.toml
index 17a83e9..5335e2b 100644
--- a/tests/qemu/guest/Cargo.toml
+++ b/tests/qemu/guest/Cargo.toml
@@ -10,6 +10,9 @@ description = "Tests of uefisettings that run inside the QEMU test guests (tests
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 
+[dev-dependencies]
+crc32fast = "1.4"
+
 # The tests run only in the QEMU test guests, so they build only with this feature, which
 # tests/qemu/run.sh enables, and `cargo test --workspace` elsewhere builds no test binary
 # of this crate. Each file in tests/ needs a [[test]] entry that requires the feature.
diff --git a/tests/qemu/guest/src/lib.rs b/tests/qemu/guest/src/lib.rs
index 4a1a4ae..d431a13 100644
--- a/tests/qemu/guest/src/lib.rs
+++ b/tests/qemu/guest/src/lib.rs
@@ -13,10 +13,10 @@
 //! Helpers of the tests that run inside the QEMU test guests.
 //!
 //! `tests/qemu/run.sh` builds this crate's test binaries for musl and boots each scenario
-//! under OVMF, with the binaries and a static `uefisettings` in the initramfs.
+//! under EDK2's firmware, with the binaries and a static `uefisettings` in the initramfs.
 //! `tests/qemu/init` runs the test binary that the boot's kernel command line names, then
 //! checks the kernel's health. The tests assert inside the guest; libtest reports their
-//! outcomes on the second serial port.
+//! outcomes on the test terminal.
 //!
 //! Every helper and test that reads the machine's files or runs `uefisettings` calls
 //! [`require_test_vm`] first, so on any other machine the tests fail before they touch
@@ -28,11 +28,11 @@
 use std::fs;
 use std::fs::File;
 use std::io;
-use std::io::Read;
-use std::io::Seek;
-use std::io::SeekFrom;
+use std::ops::RangeInclusive;
+use std::os::unix::fs::FileExt;
 use std::process::Command;
 use std::process::Stdio;
+use std::slice;
 
 use serde::de::DeserializeOwned;
 use serde::Deserialize;
@@ -52,6 +52,11 @@ pub const EFIVARS: &str = "/sys/firmware/efi/efivars";
 pub const HIIDB_VARIABLE: &str =
     "/sys/firmware/efi/efivars/HiiDB-1b838190-4625-4ead-abc9-cd5e6af18fe0";
 
+/// The variable in which publish-hiidb puts the CRC-32 of the HII database that
+/// [`HIIDB_VARIABLE`] points at.
+pub const HIIDB_CRC32_VARIABLE: &str =
+    "/sys/firmware/efi/efivars/HiiDBCrc32-de145b29-c3cd-455f-91de-a76237b67c52";
+
 /// `Backend::Unknown` in `thrift/uefisettings_backend.thrift`.
 pub const BACKEND_UNKNOWN: i32 = 0;
 
@@ -66,6 +71,10 @@ pub const DRIVER_SAMPLE_VARIABLE: &str =
 /// Size of the attributes that efivarfs puts before the data of a variable.
 pub const EFIVARFS_HEADER_SIZE: usize = 4;
 
+/// Linux's EFAULT (`include/uapi/asm-generic/errno-base.h`), with which `/dev/mem`'s read()
+/// refuses memory that the kernel does not map.
+pub const EFAULT: i32 = 14;
+
 /// The prefix of the answer of a question whose value the HII backend cannot read
 /// (`src/lib/hii/forms.rs`).
 pub const UNAVAILABLE: &str = "<ValueUnavailable";
@@ -241,19 +250,67 @@ pub fn variable_data(path: &str) -> Option<Vec<u8>> {
     }
 }
 
-/// Reads the HII database where the `HiiDB` variable points, through `/dev/mem`, as
-/// `uefisettings` does. Panics if the variable does not exist.
+/// The HII database that publish-hiidb published.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct PublishedDatabase {
+    /// Its length, from [`HIIDB_VARIABLE`].
+    pub length: u32,
+    /// Its physical address, from [`HIIDB_VARIABLE`].
+    pub address: u64,
+    /// Its CRC-32, from [`HIIDB_CRC32_VARIABLE`], for the tests to compare: read() of
+    /// `/dev/mem` serves the database only on x86 below the end of Linux's low memory, and
+    /// mmap() needs unsafe code, which this crate forbids.
+    pub crc32: u32,
+}
+
+/// The HII database that [`HIIDB_VARIABLE`] and [`HIIDB_CRC32_VARIABLE`] describe. Panics
+/// if either variable does not exist or has the wrong size.
 #[track_caller]
-pub fn read_published_database() -> io::Result<Vec<u8>> {
+pub fn published_database() -> PublishedDatabase {
     let hiidb = variable_data(HIIDB_VARIABLE).expect("the HiiDB variable does not exist");
     let (length, address) = hiidb.split_at(size_of::<u32>());
-    let length = u32::from_le_bytes(length.try_into().expect("HiiDB holds no length"));
-    let address = u64::from_le_bytes(address.try_into().expect("HiiDB holds no 64-bit address"));
-    let mut database = vec![0; length.try_into().expect("the length exceeds usize")];
-    let mut mem = File::open("/dev/mem")?;
-    mem.seek(SeekFrom::Start(address))?;
-    mem.read_exact(&mut database)?;
-    Ok(database)
+    let crc32 =
+        variable_data(HIIDB_CRC32_VARIABLE).expect("the HiiDBCrc32 variable does not exist");
+    PublishedDatabase {
+        length: u32::from_le_bytes(length.try_into().expect("HiiDB holds no length")),
+        address: u64::from_le_bytes(address.try_into().expect("HiiDB holds no 64-bit address")),
+        crc32: u32::from_le_bytes(crc32.try_into().expect("HiiDBCrc32 holds no CRC-32")),
+    }
+}
+
+/// Reads the byte at physical `address` with read() of `/dev/mem`, which `uefisettings` tries
+/// before mmap().
+#[track_caller]
+pub fn read_dev_mem_byte(address: u64) -> io::Result<u8> {
+    require_test_vm();
+    let mut byte = 0;
+    File::open("/dev/mem")?.read_exact_at(slice::from_mut(&mut byte), address)?;
+    Ok(byte)
+}
+
+/// Whether `address` is in a System RAM range of `/proc/iomem`, which `/dev/mem` refuses to
+/// read and map under `CONFIG_STRICT_DEVMEM` (`devmem_is_allowed()`), except in x86's first
+/// MiB.
+#[track_caller]
+pub fn is_system_ram(address: u64) -> bool {
+    require_test_vm();
+    let iomem = fs::read_to_string("/proc/iomem").expect("cannot read /proc/iomem");
+    iomem
+        .lines()
+        .filter_map(|line| line.trim_start().strip_suffix(" : System RAM"))
+        .map(parse_iomem_range)
+        .any(|range| range.contains(&address))
+}
+
+/// Parses a range of `/proc/iomem`, `<start>-<end>` in hexadecimal.
+fn parse_iomem_range(range: &str) -> RangeInclusive<u64> {
+    let bounds = range
+        .split_once('-')
+        .map(|(start, end)| (u64::from_str_radix(start, 16), u64::from_str_radix(end, 16)));
+    let Some((Ok(start), Ok(end))) = bounds else {
+        panic!("/proc/iomem: cannot parse the range {range:?}");
+    };
+    start..=end
 }
 
 /// The bytes that differ between `before` and `after`, which have the same length, as
diff --git a/tests/qemu/guest/tests/boot_smoke.rs b/tests/qemu/guest/tests/boot_smoke.rs
index 44be374..657f5f4 100644
--- a/tests/qemu/guest/tests/boot_smoke.rs
+++ b/tests/qemu/guest/tests/boot_smoke.rs
@@ -10,8 +10,8 @@
 //
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-//! A guest that boots without an HII fixture: OVMF publishes no HII database, so no backend
-//! is detected and every HII command fails cleanly.
+//! A guest that boots without an HII fixture: the firmware publishes no HII database, so no
+//! backend is detected and every HII command fails cleanly.
 
 use std::fs;
 use std::io;
diff --git a/tests/qemu/guest/tests/hii.rs b/tests/qemu/guest/tests/hii.rs
index b83d8ef..5863501 100644
--- a/tests/qemu/guest/tests/hii.rs
+++ b/tests/qemu/guest/tests/hii.rs
@@ -27,7 +27,8 @@ use uefisettings_qemu_guest::driver_sample::ONE_OF_OFFSET;
 use uefisettings_qemu_guest::driver_sample::SERIAL_PORT;
 use uefisettings_qemu_guest::driver_sample::SERIAL_PORT_OFFSET;
 use uefisettings_qemu_guest::json;
-use uefisettings_qemu_guest::read_published_database;
+use uefisettings_qemu_guest::published_database;
+use uefisettings_qemu_guest::read_dev_mem_byte;
 use uefisettings_qemu_guest::single_response;
 use uefisettings_qemu_guest::uefisettings;
 use uefisettings_qemu_guest::variable_data;
@@ -36,8 +37,13 @@ use uefisettings_qemu_guest::Question;
 use uefisettings_qemu_guest::Responses;
 use uefisettings_qemu_guest::BACKEND_HII;
 use uefisettings_qemu_guest::DRIVER_SAMPLE_VARIABLE;
+use uefisettings_qemu_guest::EFAULT;
 use uefisettings_qemu_guest::UNAVAILABLE;
 
+/// Linux's SIGBUS on arm64 (`include/uapi/asm-generic/signal.h`).
+#[cfg(target_arch = "aarch64")]
+const SIGBUS: i32 = 7;
+
 /// The questions of the tests with their default answers and options, and how many times
 /// the HII database lists each.
 const DEFAULTS: [(&str, &str, &[&str], usize); 4] = [
@@ -58,7 +64,7 @@ const DEFAULTS: [(&str, &str, &[&str], usize); 4] = [
 
 /// Questions whose values the HII backend cannot read from Linux: on DriverSample's
 /// variable without runtime access, on its name/value store, and on the RAM disk form of
-/// OVMF, which has no store.
+/// the firmware, which has no store.
 const UNAVAILABLE_QUESTIONS: [&str; 4] = [
     "How tall are you? (Hex)",
     "NameValueVar0",
@@ -100,15 +106,61 @@ fn driver_sample_variable_holds_the_defaults() {
 
 #[test]
 fn extract_db_copies_the_published_database() {
-    let published = read_published_database()
-        .unwrap_or_else(|error| panic!("cannot read the published database: {error}"));
+    let published = published_database();
     let path = "/tmp/hiidb.bin";
     let output = uefisettings(&["hii", "extract-db", path]);
     assert_eq!(output.code, Some(0), "{output:#?}");
     let extracted = fs::read(path).unwrap_or_else(|error| panic!("cannot read {path}: {error}"));
-    assert!(
-        extracted == published,
-        "{path} differs from the published database"
+    assert_eq!(
+        (extracted.len(), crc32fast::hash(&extracted)),
+        (
+            usize::try_from(published.length).expect("the length exceeds usize"),
+            published.crc32
+        ),
+        "{path} differs from the published database, as (length, CRC-32)"
+    );
+}
+
+/// read() of `/dev/mem` serves the database only on x86_64: arm64 Linux maps neither
+/// runtime services data nor reserved memory, and 32-bit x86 Linux nothing above its low
+/// memory, so there `extract_db_copies_the_published_database` passes only through the
+/// fallback of `uefisettings` to mmap().
+#[test]
+fn dev_mem_read_serves_the_database_only_on_x86_64() {
+    let address = published_database().address;
+    let errno = read_dev_mem_byte(address)
+        .err()
+        .map(|error| error.raw_os_error());
+    let expected = if cfg!(target_arch = "x86_64") {
+        None
+    } else {
+        Some(Some(EFAULT))
+    };
+    assert_eq!(errno, expected, "read() of /dev/mem at {address:#x}: errno");
+}
+
+/// The emulator faults a 64-bit load from the mapped database, which publish-hiidb puts at an
+/// unaligned address, as arm64 hardware faults unaligned wide loads from Device memory
+/// (<https://github.com/linuxboot/uefisettings/pull/12>); so a load like that in `uefisettings`
+/// fails `extract_db_copies_the_published_database`.
+#[test]
+#[cfg(target_arch = "aarch64")]
+fn unaligned_wide_load_from_the_mapped_database_faults() {
+    use std::os::unix::process::ExitStatusExt;
+    use std::process::Command;
+    use std::process::Stdio;
+
+    let address = published_database().address;
+    let status = Command::new("/bin/busybox")
+        .args(["devmem", &format!("{address:#x}"), "64"])
+        .stdout(Stdio::null())
+        .status()
+        .expect("cannot run busybox devmem");
+    assert_eq!(
+        status.signal(),
+        Some(SIGBUS),
+        "devmem at {address:#x}: {status}; QEMU before 9.0 does not fault unaligned loads from \
+         Device memory"
     );
 }
 
@@ -163,7 +215,7 @@ fn show_ifr_shows_the_formsets() {
         .filter_map(|line| line.trim_start().strip_prefix("OpCode: FormSet - "))
         .filter_map(|line| line.split_once(" - GUID ").map(|(name, _)| name))
         .collect();
-    // DriverSample's two formsets and one of OVMF.
+    // DriverSample's two formsets and one of the firmware.
     for name in [
         "Browser Testcase Engine",
         "ABC Information Sample",
diff --git a/tests/qemu/guest/tests/hii_devmem_guard.rs b/tests/qemu/guest/tests/hii_devmem_guard.rs
index e5b928d..5df602b 100644
--- a/tests/qemu/guest/tests/hii_devmem_guard.rs
+++ b/tests/qemu/guest/tests/hii_devmem_guard.rs
@@ -17,14 +17,15 @@
 use std::fs;
 use std::io;
 
+use uefisettings_qemu_guest::is_system_ram;
 use uefisettings_qemu_guest::json_error;
-use uefisettings_qemu_guest::read_published_database;
+use uefisettings_qemu_guest::published_database;
 use uefisettings_qemu_guest::require_test_vm;
 
 #[test]
-fn dev_mem_refuses_to_read_the_database() {
-    let error = read_published_database().expect_err("/dev/mem served the database");
-    assert_eq!(error.kind(), io::ErrorKind::PermissionDenied, "{error}");
+fn the_database_is_in_system_ram() {
+    let address = published_database().address;
+    assert!(is_system_ram(address), "{address:#x} is not System RAM");
 }
 
 #[test]
diff --git a/tests/qemu/init b/tests/qemu/init
index ac175a4..5b494ef 100755
--- a/tests/qemu/init
+++ b/tests/qemu/init
@@ -14,8 +14,8 @@
 # PID 1 of the QEMU test guests, which tests/qemu/run.sh puts in their initramfs. It
 # mounts what uefisettings needs, runs the test binary that uefisettings.test= on the
 # kernel command line names (with the libtest filter from uefisettings.filter=, if any)
-# and then the health checks, both writing to the second serial port. It prints both exit
-# codes on the console and powers off.
+# and then the health checks, both writing to the terminal that uefisettings.tty= names.
+# It prints both exit codes on the console and powers off.
 
 /bin/busybox --install -s /bin
 # uefisettings locks a file in /run/lock before it writes a setting.
@@ -23,22 +23,28 @@ mkdir -p /dev /proc /run/lock /sys /tmp
 mount -t proc proc /proc
 mount -t sysfs sysfs /sys
 mount -t devtmpfs devtmpfs /dev
+# The modules that run.sh copies, which the guest's kernel has not built in.
+for module in /lib/modules/*.ko; do
+    [ -e "$module" ] && insmod "$module"
+done
 mount -t efivarfs efivarfs /sys/firmware/efi/efivars
 
 test=
 filter=
+tty=
 read -r cmdline < /proc/cmdline
 for parameter in $cmdline; do
     case $parameter in
     uefisettings.test=*) test=${parameter#*=} ;;
     uefisettings.filter=*) filter=${parameter#*=} ;;
+    uefisettings.tty=*) tty=/dev/${parameter#*=} ;;
     esac
 done
 
-# The firmware writes to both serial ports and may leave a line unfinished, so the
-# start and exit lines begin with a newline. run.sh prints the second port from the start
-# line on.
-printf '\nuefisettings-qemu-test: start %s %s\n' "$test" "$filter" > /dev/ttyS1
+# The firmware writes to the console and that terminal and may leave a line unfinished, so
+# the start and exit lines begin with a newline. run.sh prints the terminal's output from
+# the start line on.
+printf '\nuefisettings-qemu-test: start %s %s\n' "$test" "$filter" > "$tty"
 # The health checks judge only the test: the kernel log and taint of the boot depend on
 # the host, e.g. a RETBleed error on Intel hosts that hide IBRS from the guest.
 read -r start < /proc/sys/kernel/random/uuid
@@ -46,7 +52,7 @@ echo "uefisettings-qemu-test: start of test $start" > /dev/kmsg
 # cat, not read: busybox read reads a byte at a time, and numeric sysctls answer only a
 # read at offset 0, so read would get only the first digit.
 taint=$(cat /proc/sys/kernel/tainted /sys/kernel/warn_count)
-"/tests/$test" --test-threads=1 ${filter:+"$filter"} > /dev/ttyS1 2>&1
+"/tests/$test" --test-threads=1 ${filter:+"$filter"} > "$tty" 2>&1
 test_status=$?
 # The test added no taint (TAINT_* in include/linux/panic.h) or warning (a repeated WARN
 # adds no taint bit), and the kernel kept its log
@@ -75,6 +81,6 @@ health_status=0
         END { if (!found) print "cannot read the kernel log"; exit !found || error }' /tmp/kmsg ||
         health_status=1
     kill "$!" 2> /dev/null
-} > /dev/ttyS1 2>&1
+} > "$tty" 2>&1
 printf '\nuefisettings-qemu-test: exit %s %s\n' "$test_status" "$health_status"
 poweroff -f
diff --git a/tests/qemu/kernel.sha256 b/tests/qemu/kernel.sha256
deleted file mode 100644
index a4418de..0000000
--- a/tests/qemu/kernel.sha256
+++ /dev/null
@@ -1 +0,0 @@
-ab1418c266e2b4b26090ab13e96c249a6bbe7a6fadca09c4e98c9ff477a5d58f  kernel-core-6.17.1-300.fc43.x86_64.rpm
diff --git a/tests/qemu/publish-hiidb/build.rs b/tests/qemu/publish-hiidb/build.rs
index fa88bcf..14b1ccd 100644
--- a/tests/qemu/publish-hiidb/build.rs
+++ b/tests/qemu/publish-hiidb/build.rs
@@ -10,7 +10,7 @@
 //
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-//! Links publish-hiidb as a boot service driver: OVMF loads the image of a
+//! Links publish-hiidb as a boot service driver: EDK2's firmware loads the image of a
 //! `Driver####` load option only if it is a driver (`BmIsLoadOptionPeHeaderValid`
 //! in EDK2's `BmLoadOption.c`), and it runs those options before it starts the
 //! kernel that QEMU's `-kernel` passes it.
diff --git a/tests/qemu/publish-hiidb/src/main.rs b/tests/qemu/publish-hiidb/src/main.rs
index 7a62129..6d7d5c1 100644
--- a/tests/qemu/publish-hiidb/src/main.rs
+++ b/tests/qemu/publish-hiidb/src/main.rs
@@ -12,12 +12,16 @@
 
 //! UEFI driver for the QEMU tests of the `uefisettings` HII backend, which a
 //! `Driver####` load option runs as `publish-hiidb.efi [rt-data|reserved|loader-data]`:
-//! it copies the HII database into pages of that memory type and points the
-//! volatile `HiiDB` variable at them as `{ u32 length; u64 address }`, the way
+//! it copies the HII database into pages of that memory type, one byte in, and points
+//! the volatile `HiiDB` variable at the copy as `{ u32 length; u64 address }`, the way
 //! OCP firmware does for `src/lib/hii/extract.rs`. The x86 EFI stub reports
 //! `rt-data` (the default) and `reserved` as E820 reserved ranges, which
 //! `/dev/mem` serves under `CONFIG_STRICT_DEVMEM`; `loader-data` becomes System
 //! RAM, which it refuses.
+//! arm64 Linux maps neither `rt-data` nor `reserved`, so `/dev/mem` serves them only
+//! to mmap(), as 32-bit x86 Linux does above its low memory.
+//! The driver also puts the CRC-32 of the database in the volatile `HiiDBCrc32`
+//! variable, for the tests to check what `uefisettings` extracts.
 
 #![cfg_attr(target_os = "uefi", no_std, no_main)]
 #![deny(unsafe_code)]
@@ -51,6 +55,16 @@ const HIIDB_VENDOR: Guid = guid!("1b838190-4625-4ead-abc9-cd5e6af18fe0");
 /// Attributes of that variable: volatile and readable at runtime.
 const HIIDB_ATTRIBUTES: VariableAttributes =
     VariableAttributes::BOOTSERVICE_ACCESS.union(VariableAttributes::RUNTIME_ACCESS);
+/// Name of the variable that holds the CRC-32 of the database, for the tests
+/// only, with the attributes of `HiiDB`.
+const HIIDB_CRC32_NAME: &CStr16 = cstr16!("HiiDBCrc32");
+/// Vendor GUID of that variable, which the tests own.
+const HIIDB_CRC32_VENDOR: Guid = guid!("de145b29-c3cd-455f-91de-a76237b67c52");
+
+/// Where the copy starts in its pages: an unaligned start makes `uefisettings`
+/// read the first page from an unaligned address, which arm64 Device memory
+/// faults for wide loads (<https://github.com/linuxboot/uefisettings/pull/12>).
+const COPY_OFFSET: usize = 1;
 
 /// A failed step and the firmware's status.
 type Failure = (&'static str, Status);
@@ -59,7 +73,7 @@ type Failure = (&'static str, Status);
 /// build is a driver.
 #[cfg(not(target_os = "uefi"))]
 fn main() {
-    panic!("publish-hiidb is a UEFI driver: build it for x86_64-unknown-uefi");
+    panic!("publish-hiidb is a UEFI driver: build it for a UEFI target");
 }
 
 #[entry]
@@ -93,8 +107,11 @@ fn memory_type() -> Option<MemoryType> {
     }
 }
 
-/// Copies the exported HII database into pages of `memory_type` and points
-/// `HiiDB` at them. Returns the address and length of the copy.
+/// Copies the exported HII database into pages of `memory_type` at `COPY_OFFSET`
+/// and points `HiiDB` at the copy. Returns the address and length of the copy.
+///
+/// It first puts the CRC-32 of the database in `HiiDBCrc32`, so that `HiiDB`
+/// never exists without it.
 ///
 /// The pages are never freed: the OS reads them after boot.
 fn publish(memory_type: MemoryType) -> Result<(u64, u32), Failure> {
@@ -104,22 +121,35 @@ fn publish(memory_type: MemoryType) -> Result<(u64, u32), Failure> {
         .map_err(|error| ("exporting the HII database", error.status()))?;
     let length = u32::try_from(export.len())
         .map_err(|_| ("the HII database exceeds 4 GiB", Status::BAD_BUFFER_SIZE))?;
-    let pages = export.len().div_ceil(PAGE_SIZE);
+
+    let crc32 = boot::calculate_crc32(&export)
+        .map_err(|error| ("computing the CRC-32 of the HII database", error.status()))?;
+    runtime::set_variable(
+        HIIDB_CRC32_NAME,
+        &VariableVendor(HIIDB_CRC32_VENDOR),
+        HIIDB_ATTRIBUTES,
+        &crc32.to_le_bytes(),
+    )
+    .map_err(|error| ("setting the HiiDBCrc32 variable", error.status()))?;
+
+    let pages = (COPY_OFFSET + export.len()).div_ceil(PAGE_SIZE);
     let base = boot::allocate_pages(AllocateType::AnyPages, memory_type, pages)
         .map_err(|error| ("allocating pages", error.status()))?;
+    let copy = base.as_ptr().wrapping_add(COPY_OFFSET);
     #[expect(
         unsafe_code,
         reason = "the pages from allocate_pages() are only reachable through a raw pointer"
     )]
     // SAFETY: `allocate_pages` returned `pages * PAGE_SIZE` bytes that nothing
     // else references, and UEFI identity-maps memory, so the address is a
-    // valid pointer. `export` fits in them and does not overlap them.
+    // valid pointer. `export` fits in them after `COPY_OFFSET` and does not
+    // overlap them.
     unsafe {
         ptr::write_bytes(base.as_ptr(), 0, pages * PAGE_SIZE);
-        ptr::copy_nonoverlapping(export.as_ptr(), base.as_ptr(), export.len());
+        ptr::copy_nonoverlapping(export.as_ptr(), copy, export.len());
     }
-    // `usize` is 64 bits wide on x86_64-unknown-uefi.
-    let address = base.as_ptr().addr() as u64;
+    // `usize` has at most 64 bits on the UEFI targets.
+    let address = copy.addr() as u64;
 
     let mut data = [0; size_of::<u32>() + size_of::<u64>()];
     data[..4].copy_from_slice(&length.to_le_bytes());
diff --git a/tests/qemu/run.sh b/tests/qemu/run.sh
index c5223e7..91bd792 100755
--- a/tests/qemu/run.sh
+++ b/tests/qemu/run.sh
@@ -12,33 +12,85 @@
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 # Runs the QEMU tests: boots each scenario of tests/qemu/scenarios.tsv, or only the named
-# ones, under OVMF and fails unless the guest tests and health checks of every boot pass.
-# tests/qemu/README.md describes the requirements and the logs.
+# ones, under EDK2's firmware and fails unless the guest tests and health checks of every
+# boot pass. tests/qemu/README.md describes the requirements and the logs.
 #
-# Usage: tests/qemu/run.sh [SCENARIO...]
+# Usage: tests/qemu/run.sh ARCH [SCENARIO...]
 #
-# Environment variables, which default to the paths of the Ubuntu 24.04 packages:
-#   QEMU       the qemu-system-x86_64 to run (qemu-system-x86_64 from PATH), or a wrapper
-#              that execs it: the timeout of a boot signals that program, not its children
-#   OVMF_CODE  OVMF code image (/usr/share/OVMF/OVMF_CODE_4M.fd)
-#   OVMF_VARS  OVMF variable store, which each scenario copies (/usr/share/OVMF/OVMF_VARS_4M.fd)
-#   BUSYBOX    static busybox for the initramfs (/usr/bin/busybox)
-#   DRIVER_SAMPLE_DIR  the directory of DriverSample.efi, which build-driver-sample.sh
-#              fills if the file is missing (target/qemu-test/driver-sample)
+# ARCH is x86_64, i686 or aarch64. The guest's kernel, firmware and busybox are the
+# packages of tests/qemu/guest-packages-ARCH. QEMU is the qemu-system-* of the table below
+# from PATH, or a wrapper that execs it: the timeout of a boot signals that program, not
+# its children.
 
 set -euo pipefail
 
-qemu=${QEMU:-qemu-system-x86_64}
-ovmf_code=${OVMF_CODE:-/usr/share/OVMF/OVMF_CODE_4M.fd}
-ovmf_vars=${OVMF_VARS:-/usr/share/OVMF/OVMF_VARS_4M.fd}
-busybox=${BUSYBOX:-/usr/bin/busybox}
+if (($# < 1)); then
+    echo "usage: $0 ARCH [SCENARIO...]" >&2
+    exit 2
+fi
+arch=$1
+shift
+# The test terminal is the second serial port, but QEMU's virt machine gives the guest one
+# PL011 UART, so the aarch64 guests write to a virtio console. Debian's i686 kernel has
+# efivarfs as a module. aarch64 runs under TCG, so it boots on x86_64 hosts like the others.
+case $arch in
+x86_64)
+    qemu=(qemu-system-x86_64 -machine q35 -accel kvm -cpu host)
+    firmware=usr/share/OVMF/OVMF_CODE_4M.fd
+    firmware_vars=usr/share/OVMF/OVMF_VARS_4M.fd
+    vmlinuz_pattern='lib/modules/*/vmlinuz'
+    modules=()
+    console=ttyS0
+    tty=ttyS1
+    tty_device=(-serial chardev:tty)
+    edk2_arch=X64
+    kernel_params=()
+    ;;
+i686)
+    qemu=(qemu-system-i386 -machine q35 -accel kvm -cpu host)
+    firmware=usr/share/OVMF/OVMF32_CODE_4M.fd
+    firmware_vars=usr/share/OVMF/OVMF32_VARS_4M.fd
+    vmlinuz_pattern='boot/vmlinuz-*'
+    modules=('lib/modules/*/kernel/fs/efivarfs/efivarfs.ko')
+    console=ttyS0
+    tty=ttyS1
+    tty_device=(-serial chardev:tty)
+    edk2_arch=IA32
+    # Containment: GitHub's AMD runners' KVM (linux-azure) clears CR3 bits 0-11 of a vCPU
+    # without CR4.PCIDE at each NPT root load (https://bugs.launchpad.net/bugs/2106673);
+    # in PAE paging bits 5-11 address the PDPT, which Debian 12's kernel takes from a
+    # 32-byte slab unless pti=on (Linux v6.1 _pgd_alloc; SHARED_KERNEL_PMD is !PTI).
+    kernel_params=(pti=on)
+    ;;
+aarch64)
+    qemu=(qemu-system-aarch64 -machine virt -accel tcg -cpu cortex-a57)
+    firmware=usr/share/AAVMF/AAVMF_CODE.fd
+    firmware_vars=usr/share/AAVMF/AAVMF_VARS.fd
+    vmlinuz_pattern='lib/modules/*/vmlinuz'
+    modules=()
+    console=ttyAMA0
+    tty=hvc0
+    tty_device=(-device virtio-serial-pci -device "virtconsole,chardev=tty")
+    edk2_arch=AARCH64
+    kernel_params=()
+    # cc, the default, links for the host. Set the variable for another linker: it
+    # overrides cargo's config files, as this default does.
+    export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=${CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER-aarch64-linux-gnu-gcc}
+    ;;
+*)
+    echo "unknown architecture $arch; the architectures are x86_64, i686 and aarch64" >&2
+    exit 2
+    ;;
+esac
 
 here=$(realpath "$(dirname "$0")")
 repo=$(realpath "$here/../..")
 out=$repo/target/qemu-test
-driver_sample=${DRIVER_SAMPLE_DIR:-$out/driver-sample}
-run=$out/$(date -u +%Y%m%dT%H%M%SZ)
-target=x86_64-unknown-linux-musl
+driver_sample=$out/$arch/driver-sample
+run=$out/$arch/$(date -u +%Y%m%dT%H%M%SZ)
+# Unpacked again by every run, which keeps one copy per architecture.
+guest=$out/$arch/guest
+target=$arch-unknown-linux-musl
 
 # Every row has the 4 columns that the header of scenarios.tsv lists and the loop below
 # reads, none of them empty, so that no row silently boots nothing.
@@ -61,10 +113,9 @@ mapfile -t named < <(awk -F '\t' '$1 !~ /^(#|$)/ {
 }' "$here/scenarios.tsv")
 
 echo "run.sh: start $(date -u +%FT%TZ), logs in $run"
-mkdir -p "$run/initramfs/bin" "$run/initramfs/tests" "$run/esp"
+mkdir -p "$run/initramfs/bin" "$run/initramfs/lib/modules" "$run/initramfs/tests" "$run/esp"
 grep --max-count=1 '^model name' /proc/cpuinfo
-"$qemu" --version
-"$busybox" --help | sed -n 1p
+"${qemu[0]}" --version
 
 # virt-fw-vars has no --version option, so this asks the Python that its first line names,
 # the one that runs it, for the version of virt-firmware. Another first line, or a failure,
@@ -91,7 +142,7 @@ executables() {
 cargo build --release --locked --target "$target" --bin uefisettings \
     --manifest-path "$repo/Cargo.toml" --message-format=json-render-diagnostics |
     executables >"$run/executables"
-cargo build --release --locked --target x86_64-unknown-uefi \
+cargo build --release --locked --target "$arch-unknown-uefi" \
     --manifest-path "$here/publish-hiidb/Cargo.toml" --message-format=json-render-diagnostics |
     executables >>"$run/executables"
 cargo test --release --locked --target "$target" --features test-vm --test '*' --no-run \
@@ -100,7 +151,8 @@ cargo test --release --locked --target "$target" --features test-vm --test '*' -
 # The initramfs gets uefisettings, the test binaries, busybox and init. The ESP gets the
 # HII fixture: publish-hiidb and EDK2's DriverSample.
 unnamed=()
-while read -r name path; do
+# read fails on a last line without a newline, which still counts.
+while read -r name path || [[ -n $name ]]; do
     case $name in
     uefisettings) cp "$path" "$run/initramfs/bin/" ;;
     publish-hiidb) cp "$path" "$run/esp/" ;;
@@ -114,22 +166,34 @@ if ((${#unnamed[@]} > 0)); then
     echo "no scenario boots the test binaries ${unnamed[*]}; add them to scenarios.tsv" >&2
     exit 1
 fi
-cp "$busybox" "$run/initramfs/bin/busybox"
 cp "$here/init" "$run/initramfs/init"
 if [[ ! -f $driver_sample/DriverSample.efi ]]; then
-    "$here/build-driver-sample.sh" "$driver_sample"
+    "$here/build-driver-sample.sh" "$edk2_arch" "$driver_sample"
 fi
 cp "$driver_sample/DriverSample.efi" "$run/esp/"
 
-"$here/fetch-kernel.sh" "$out/kernel-rpms" "$run/kernel"
-vmlinuz=$(echo "$run"/kernel/lib/modules/*/vmlinuz)
-if [[ ! -f $vmlinuz ]]; then
-    echo "expected the vmlinuz of exactly one kernel in $run/kernel" >&2
-    exit 1
-fi
+rm -rf "$guest"
+"$here/fetch-packages.sh" "$here/guest-packages-$arch" "$out/packages" "$guest"
+# Prints the one file of the guest's packages that a pattern of the table matches.
+guest_file() {
+    local files
+    # Only the pattern globs, not the path of the repository.
+    mapfile -t files < <(cd "$guest" && compgen -G "$1")
+    if ((${#files[@]} != 1)) || [[ ! -f $guest/${files[0]} ]]; then
+        echo "expected exactly one $1 in $guest" >&2
+        return 1
+    fi
+    echo "$guest/${files[0]}"
+}
+vmlinuz=$(guest_file "$vmlinuz_pattern")
+for module in "${modules[@]}"; do
+    cp "$(guest_file "$module")" "$run/initramfs/lib/modules/"
+done
+cp "$guest/usr/bin/busybox" "$run/initramfs/bin/busybox"
 
 failed=()
-while IFS=$'\t' read -r -u 3 name drivers variables boots; do
+# read fails on a last line without a newline, which still counts.
+while IFS=$'\t' read -r -u 3 name drivers variables boots || [[ -n $name ]]; do
     [[ -z $name || $name == \#* ]] && continue
     (($# == 0)) || [[ " $* " == *" $name "* ]] || continue
     dir=$run/$name
@@ -140,7 +204,7 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots; do
     seed=()
     if [[ $drivers != - ]]; then
         IFS=';' read -r -a files <<<"$drivers"
-        virt-fw-vars --input "$ovmf_vars" "${files[@]/#/--append-boot-filepath=}" \
+        virt-fw-vars --input "$guest/$firmware_vars" "${files[@]/#/--append-boot-filepath=}" \
             --output-json "$dir/boot.json" 2>"$dir/virt-fw-vars.log"
         jq '.variables[].name |= sub("^Boot"; "Driver")' "$dir/boot.json" >"$dir/drivers.json"
         seed+=("$dir/drivers.json")
@@ -148,8 +212,8 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots; do
     [[ $variables == - ]] || seed+=("$here/vars/$variables")
     jq --null-input '{version: 2, variables: [inputs.variables[]]}' "${seed[@]}" \
         </dev/null >"$dir/vars.json"
-    virt-fw-vars --input "$ovmf_vars" --set-json "$dir/vars.json" --output "$dir/vars.fd" \
-        2>>"$dir/virt-fw-vars.log"
+    virt-fw-vars --input "$guest/$firmware_vars" --set-json "$dir/vars.json" \
+        --output "$dir/vars.fd" 2>>"$dir/virt-fw-vars.log"
     boot=0
     IFS=, read -r -a specs <<<"$boots"
     for spec in "${specs[@]}"; do
@@ -161,27 +225,42 @@ while IFS=$'\t' read -r -u 3 name drivers variables boots; do
         echo "run.sh: $name boot $boot: $spec"
         # Without --foreground, timeout would move QEMU into a process group of its own,
         # which a timeout around make does not reach.
-        timeout --foreground -k 10 120 "$qemu" -nodefaults -no-user-config -no-reboot \
-            -display none -sandbox on -machine q35 -accel kvm -cpu host -m 1024 -smp 2 \
-            -drive "if=pflash,format=raw,unit=0,readonly=on,file=$ovmf_code" \
+        # The QEMU log, empty if QEMU does not start, tells how the guest ended (QEMU 10.2):
+        # a poweroff makes a shutdown request (reason=6); a reset, after which -no-reboot
+        # just ends QEMU, and a kill by the timeout make none. A CPU's last KVM exit is 8
+        # (KVM_EXIT_SHUTDOWN) after its triple fault and 2 (I/O) after a reset through a port.
+        : >"$log.qemu.log"
+        timeout --foreground -k 10 120 "${qemu[@]}" -nodefaults -no-user-config -no-reboot \
+            -display none -sandbox on -m 1024 -smp 2 \
+            -drive "if=pflash,format=raw,unit=0,readonly=on,file=$guest/$firmware" \
             -drive "if=pflash,format=raw,unit=1,file=$dir/vars.fd" \
             -drive "if=virtio,format=raw,readonly=on,file=fat:$run/esp" \
             -kernel "$vmlinuz" -initrd "$dir/initrd.img" \
-            -append "console=ttyS0 quiet panic=-1 uefisettings.test=$test${filter:+ uefisettings.filter=$filter}" \
-            -serial "file:$log.console.log" -serial "file:$log.test.log" \
-            </dev/null || echo "run.sh: QEMU exited with $?"
+            -append "console=$console quiet panic=-1${kernel_params[*]:+ ${kernel_params[*]}} uefisettings.tty=$tty uefisettings.test=$test${filter:+ uefisettings.filter=$filter}" \
+            -serial "file:$log.console.log" \
+            -chardev "file,id=tty,path=$log.test.log" "${tty_device[@]}" \
+            -d guest_errors,trace:qemu_system_shutdown_request,trace:kvm_run_exit \
+            -D "$log.qemu.log" </dev/null || echo "run.sh: QEMU exited with $?"
+        # A line per KVM exit, some MB a boot, of which only each CPU's last tells the end;
+        # the other CPUs keep running after one of them triple-faults.
+        awk '!/^kvm_run_exit / { print; next }
+            { cpu = $3 + 0; last[cpu] = $0; if (cpu > max) max = cpu }
+            END { for (cpu = 0; cpu <= max; cpu++) if (cpu in last) print last[cpu] }' \
+            "$log.qemu.log" >"$log.qemu.log.new"
+        mv "$log.qemu.log.new" "$log.qemu.log"
         sed -n '/^uefisettings-qemu-test: start/,$p' "$log.test.log"
         # init prints the exit codes of the tests and the health checks last. A filter
         # that matches no test passes too, so the tests must also report a passed test.
         if ! tr -d '\r' <"$log.console.log" | grep --quiet --line-regexp 'uefisettings-qemu-test: exit 0 0' ||
             ! grep --quiet '^test result: ok\. [1-9]' "$log.test.log"; then
             failed+=("$name boot $boot")
+            sed "s/^/run.sh: $name boot $boot: QEMU: /" "$log.qemu.log"
         fi
     done
 done 3<"$here/scenarios.tsv"
 
 echo "run.sh: end $(date -u +%FT%TZ), logs in $run"
 if ((${#failed[@]} > 0)); then
-    printf 'run.sh: FAILED: %s; see its console.log and test.log\n' "${failed[@]}"
+    printf 'run.sh: FAILED: %s; see its console.log, test.log and qemu.log\n' "${failed[@]}"
     exit 1
 fi
diff --git a/tests/qemu/ubuntu-packages b/tests/qemu/ubuntu-packages
index cc835e5..ace8a5c 100644
--- a/tests/qemu/ubuntu-packages
+++ b/tests/qemu/ubuntu-packages
@@ -1,13 +1,16 @@
 build-essential
-busybox-static
 cpio
 curl
+gcc-aarch64-linux-gnu
 git
 jq
+libc6-dev-arm64-cross
+libc6-dev-i386
 nasm
-ovmf
 python3
 python3-virt-firmware
+qemu-system-arm
 qemu-system-x86
 rpm2cpio
 uuid-dev
+zstd