diff --git a/.gitignore b/.gitignore
index 9d986ba..46f53d0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,4 @@
 # Extensions and prefixes.
-*.html
 *.log
 *.tmp
 *~
@@ -7,8 +6,5 @@
 gitignore*
 
 # Specific files.
+/out
 /9p
-/README.html
-
-# GEM5
-/m5out
diff --git a/README.adoc b/README.adoc
index 17a1862..1a537e6 100644
--- a/README.adoc
+++ b/README.adoc
@@ -127,13 +127,13 @@ git clean -xdf .
 To only nuke one architecture, do:
 
 ....
-rm -rf buildroot/output.x86_64~
+rm -rf out/x86_64/buildroot
 ....
 
 Only nuke one one package:
 
 ....
-rm -rf buildroot/output.x86_64~/build/host-qemu-custom
+rm -rf out/x86_64/buildroot/build/host-qemu-custom
 ./build
 ....
 
@@ -335,7 +335,7 @@ So for example when you run:
 Stdout shows a line with the full command of type:
 
 ....
-./buildroot/output.arm~/host/usr/bin/qemu-system-arm -m 128M -monitor telnet::45454,server,nowait -netdev user,hostfwd=tcp::45455-:45455,id=net0 -smp 1  -M versatilepb -append 'root=/dev/sda nokaslr norandmaps printk.devkmsg=on printk.time=y' -device rtl8139,netdev=net0 -dtb ./buildroot/output.arm~/images/versatile-pb.dtb -kernel ./buildroot/output.arm~/images/zImage -serial stdio    -drive file='./buildroot/output.arm~/images/rootfs.ext2.qcow2,if=scsi,format=qcow2'
+./out/arm/buildroot/host/usr/bin/qemu-system-arm -m 128M -monitor telnet::45454,server,nowait -netdev user,hostfwd=tcp::45455-:45455,id=net0 -smp 1  -M versatilepb -append 'root=/dev/sda nokaslr norandmaps printk.devkmsg=on printk.time=y' -device rtl8139,netdev=net0 -dtb ./out/arm/buildroot/images/versatile-pb.dtb -kernel ./out/arm/buildroot/images/zImage -serial stdio    -drive file='./out/arm/buildroot/images/rootfs.ext2.qcow2,if=scsi,format=qcow2'
 ....
 
 This line is also saved to a file for convenience:
@@ -516,7 +516,7 @@ Shell 2:
 In GDB, hit `Ctrl + C`, and note how it says:
 
 ....
-scanning for modules in /home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64~/build/linux-custom
+scanning for modules in /home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64/buildroot/build/linux-custom
 loading @0xffffffffc0000000: ../kernel_module-1.0//timer.ko
 ....
 
@@ -851,13 +851,13 @@ But TODO I don't think you can see where you are in the kernel source code and l
 
 Step debug userland processes to understand how they are talking to the kernel.
 
-Then in guest:
+Guest:
 
 ....
 /gdbserver.sh /myinsmod.out /hello.ko
 ....
 
-In host:
+Host:
 
 ....
 ./rungdbserver kernel_module-1.0/user/myinsmod.out
@@ -866,12 +866,12 @@ In host:
 You can find the executable with:
 
 ....
-find buildroot/output.x86_64~/build -name myinsmod.out
+find out/x86_64/buildroot/build -name myinsmod.out
 ....
 
 TODO: automate the path finding:
 
-* using the executable from under `buildroot/output.x86_64~/target` would be easier as the path is the same as in guest, but unfortunately those executables are stripped to make the guest smaller. `BR2_STRIP_none=y` should disable stripping, but make the image way larger.
+* using the executable from under `out/x86_64/buildroot/target` would be easier as the path is the same as in guest, but unfortunately those executables are stripped to make the guest smaller. `BR2_STRIP_none=y` should disable stripping, but make the image way larger.
 * `outputx86_64~/staging/` would be even better than `target/` as the docs say that this directory contains binaries before they were stripped. However, only a few binaries are pre-installed there by default, and it seems to be a manual per package thing.
 +
 E.g. `pciutils` has for `lspci`:
@@ -1158,19 +1158,19 @@ Finally, the docs are lying, arguments with dots that come after `-` are still t
 
 We disable networking by default because it starts an userland process, and we want to keep the number of userland processes to a minimum to make the system more understandable.
 
-To enable it run:
+Enable:
 
 ....
 /sbin/ifup -a
 ....
 
-To disable it, run:
+Disable:
 
 ....
 /sbin/ifdown -a
 ....
 
-To test it out, try:
+Test:
 
 ....
 wget google.com
@@ -1314,7 +1314,7 @@ This can be solved by increasing the memory with:
 
 The main ingredients to get initrd working are:
 
-* `BR2_TARGET_ROOTFS_CPIO=y`: make Buildroot generate `output/images/rootfs.cpio` in addition to the other images.
+* `BR2_TARGET_ROOTFS_CPIO=y`: make Buildroot generate `images/rootfs.cpio` in addition to the other images.
 +
 It is also possible to compress that image with other options.
 * `qemu -initrd`: make QEMU put the image into memory and tell the kernel about it.
@@ -1361,7 +1361,7 @@ The `-l` (ell) should only be used the first time you move to / from a different
 It is interesting to see how this increases the size of the kernel image if you do a:
 
 ....
-ls -lh buildroot/output.x86_64~/images/bzImage
+ls -lh out/x86_64/buildroot/images/bzImage
 ....
 
 before and after using initramfs, since the `.cpio` is now glued to the kernel image.
@@ -1404,7 +1404,7 @@ Build configuration can be observed in guest with:
 or on host:
 
 ....
-cat buildroot/output.*~/build/linux-custom/.config
+cat out/*/buildroot/build/linux-custom/.config
 ....
 
 === Find the kernel version
@@ -1614,10 +1614,10 @@ instruction count firmware: 20708
 gem5:
 
 ....
-./run -a arm -g -E 'm5 exit'
+./run -a aarch64 -g -E 'm5 exit'
 # Or:
 # ./run -a arm -g -E 'm5 exit' -- --cpu-type=HPI --caches
-grep sim_insts m5out/stats.txt
+grep sim_insts out/aarch64/gem5/m5out/stats.txt
 ....
 
 Notes:
@@ -1627,7 +1627,7 @@ Notes:
 It can be found from:
 +
 ....
-readelf -e buildroot/output.x86_64~/build/linux-*/vmlinux | grep Entry
+readelf -e out/x86_64/buildroot/build/linux-*/vmlinux | grep Entry
 ....
 +
 TODO confirm further. If I try to break there with:
@@ -2014,7 +2014,7 @@ This has nothing to do with the Linux kernel, but it is cool:
 ....
 sudo apt-get install qemu-user
 ./build -a arm
-cd buildroot/output.arm~/target
+cd out/arm/buildroot/target
 qemu-arm -L . bin/ls
 ....
 
@@ -2088,7 +2088,7 @@ To do it for the Linux kernel boot we have a helper:
 You can then inspect the instructions with:
 
 ....
-less ./buildroot/output.x86_64~/lkmc/trace.txt
+less ./out/x86_64/qemu/trace.txt
 ....
 
 This functionality relies on the following setup:
@@ -2121,7 +2121,7 @@ We can further use Binutils' `addr2line` to get the line that corresponds to eac
 ....
 ./trace-boot -a x86_64
 ./trace2line -a x86_64
-less ./buildroot/output.x86_64~/lkmc/trace-lines.txt
+less ./out/x86_64/qemu/trace-lines.txt
 ....
 
 The format is as follows:
@@ -2308,7 +2308,7 @@ Now you can play a fun little game with your friends:
 To find out why your program is slow, a good first step is to have a look at the statistics for the run:
 
 ....
-cat m5out/stats.txt
+cat out/aarch64/gem5/m5out/stats.txt
 ....
 
 Whenever we run `m5 dumpstats` or `m5 exit`, a section with the following format is added to that file:
@@ -2463,7 +2463,7 @@ m5 resetstats && sleep 10 && m5 dumpstats
 and then:
 
 ....
-grep numCycles m5out/stats.txt
+grep numCycles out/aarch64/gem5/m5out/stats.txt
 ....
 
 TODO: why doesn't this exist:
@@ -2585,17 +2585,17 @@ Running a benchmark of a different size requires a rebuild with:
 ....
 ./build \
   -a arm \
-  -c 'BR2_PACKAGE_PARSEC_BENCHMARK_INPUT_SIZE="simsmall"' \
-  -c BR2_TARGET_ROOTFS_EXT2_SIZE="500M" \
-  -g \
   -b br2_parsec \
+  -c 'BR2_PACKAGE_PARSEC_BENCHMARK_INPUT_SIZE="simsmall"' \
+  -g \
   -- parsec-benchmark-reconfigure \
 ;
 ....
 
-and then try running the benchmarks as before.
 
-The rebuild is required because some of the input sizes
+Large input sizes will likely require tweaking <<br2_target_rootfs_ext2_size>>.
+
+The rebuild is required because we unpack input files on the host.
 
 Separating input sizes also allows to create smaller images when only running the smaller benchmarks.
 
@@ -2620,7 +2620,7 @@ Note that dots cannot be used as in `1.5G`, so just use Megs as in `1500M` inste
 Unfortunately, TODO we don't have a perfect way to find the right value for `BR2_TARGET_ROOTFS_EXT2_SIZE`. One good heuristic is:
 
 ....
-du -hsx buildroot/output.arm-gem5~/target/parsec
+du -hsx out/arm-gem5/buildroot/target/parsec
 ....
 
 https://stackoverflow.com/questions/49211241/is-there-a-way-to-automatically-detect-the-minimum-required-br2-target-rootfs-ex
@@ -2693,10 +2693,10 @@ If you want to remove PARSEC later, Buildroot doesn't provide an automated packa
 ....
 rm -rf \
   ./buildroot/dl/parsec-* \
-  ./buildroot/output.arm-gem5~/build/parsec-* \
-  ./buildroot/output.arm-gem5~/build/packages-file-list.txt \
-  ./buildroot/output.arm-gem5~/images/rootfs.* \
-  ./buildroot/output.arm-gem5~/target/parsec-* \
+  ./out/arm-gem5/buildroot/build/parsec-* \
+  ./out/arm-gem5/buildroot/build/packages-file-list.txt \
+  ./out/arm-gem5/buildroot/images/rootfs.* \
+  ./out/arm-gem5/buildroot/target/parsec-* \
 ;
 ./build -a arm -g
 ....
@@ -2744,7 +2744,7 @@ This is due mainly to the `pkg-generic` `GLOBAL_INSTRUMENTATION_HOOKS` sanitatio
 The pause is followed by:
 
 ....
-buildroot/output.arm~/build/parsec-benchmark-custom/.stamp_target_installed
+out/arm/buildroot/build/parsec-benchmark-custom/.stamp_target_installed
 ....
 
 so which shows that the whole delay is inside our install itself.
@@ -2824,7 +2824,7 @@ warn: Couldn't read data from debugger.
 I've also tried the fix at: https://stackoverflow.com/questions/27411621/remote-g-packet-reply-is-too-long-aarch64-arm64 by adding to the link:rungdb[] script:
 
 ....
--ex 'set tdesc filename buildroot/output.aarch64~/build/gdb-7.11.1/./gdb/features/aarch64.xml'
+-ex 'set tdesc filename out/aarch64/buildroot/build/gdb-7.11.1/./gdb/features/aarch64.xml'
 ....
 
 but it did not help.
@@ -2924,7 +2924,7 @@ This makes it easier to remember which checkpoint is which, especially since the
 
 Internals:
 
-* the checkpoints are stored under `m5out/cpts/$arch/cpt.$todo_whatisthis`
+* the checkpoints are stored under `out/$arch/gem5/m5out/cpt.$todo_whatisthis`
 * <<m5>> is a guest utility present inside the gem5 tree which we cross-compiled and installed into the guest
 
 ==== gem5 restore checkpoint with a different CPU
@@ -2998,9 +2998,9 @@ TODO Now we just need to network them up to have some more fun! See dist-gem5: h
 
 We would like to be able to run both gem5 and QEMU with the same minimal kernel build to:
 
-* do a single Buildroot build for both. Otherwise, we have to create two full `buildroot/output*` directories, which takes up a lot of time.
+* do a single Buildroot build for both. Otherwise, we have to create two full `out/.*/buildroot/` directories, which takes up a lot of time.
 +
-Alternatively, we could try to be brave and switch between two kernel builds inside `buildroot/output.*/`, but that would be too hackish.
+Alternatively, we could try to be brave and switch between two kernel builds inside `out/.*/buildroot/`, but that would be too hackish.
 * be able to compare behaviour between QEMU and gem5 when one is doing something weird.
 +
 Note however that there are also variations which need to be controlled, e.g. kernel command line, DTB and QEMU's non-determinism.
@@ -3023,7 +3023,7 @@ but this strategy failed for the other archs for some reason.
 
 ===== QEMU with gem5 kernel configuration ARM
 
-To test this, hack up `run` to use the `buildroot/output.arm-gem5~` directory, and then run:
+To test this, hack up `run` to use the `out/arm-gem5/buildroot` directory, and then run:
 
 ....
 ./run -a arm
@@ -3084,27 +3084,27 @@ Boot fails with:
 
 ....
 --- BEGIN LIBC BACKTRACE ---
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z15print_backtracev+0x29)[0x557f6290bc89]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z12abortHandleri+0x4a)[0x557f6291f88a]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z15print_backtracev+0x29)[0x557f6290bc89]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z12abortHandleri+0x4a)[0x557f6291f88a]
 /lib/x86_64-linux-gnu/libpthread.so.0(+0x13150)[0x7fbb3bd13150]
 /lib/x86_64-linux-gnu/libc.so.6(gsignal+0xcb)[0x7fbb3a3450bb]
 /lib/x86_64-linux-gnu/libc.so.6(abort+0x16d)[0x7fbb3a346f5d]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x4110bf)[0x557f626570bf]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA8PS2Mouse11processDataEh+0x12a)[0x557f6264940a]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA5I80425writeEP6Packet+0xa2c)[0x557f6264bb5c]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN7PioPort10recvAtomicEP6Packet+0x6e)[0x557f6311eace]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15NoncoherentXBar10recvAtomicEP6Packets+0x279)[0x557f62b63969]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6Bridge15BridgeSlavePort10recvAtomicEP6Packet+0x36)[0x557f62b3a7f6]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN12CoherentXBar10recvAtomicEP6Packets+0x57b)[0x557f62b4724b]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU8writeMemEPhjm5FlagsImEPm+0x49d)[0x557f627fd12d]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN17SimpleExecContext8writeMemEPhjm5FlagsImEPm+0x29)[0x557f6280b439]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZNK10X86ISAInst2St7executeEP11ExecContextPN5Trace10InstRecordE+0x29b)[0x557f6301712b]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU4tickEv+0x3b4)[0x557f627fc054]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN10EventQueue10serviceOneEv+0xd9)[0x557f62912f79]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z9doSimLoopP10EventQueue+0x58)[0x557f6292cb88]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z8simulatem+0xc1a)[0x557f6292db7a]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x8a9c7b)[0x557f62aefc7b]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x72d5ab)[0x557f629735ab]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x4110bf)[0x557f626570bf]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA8PS2Mouse11processDataEh+0x12a)[0x557f6264940a]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA5I80425writeEP6Packet+0xa2c)[0x557f6264bb5c]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN7PioPort10recvAtomicEP6Packet+0x6e)[0x557f6311eace]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15NoncoherentXBar10recvAtomicEP6Packets+0x279)[0x557f62b63969]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6Bridge15BridgeSlavePort10recvAtomicEP6Packet+0x36)[0x557f62b3a7f6]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN12CoherentXBar10recvAtomicEP6Packets+0x57b)[0x557f62b4724b]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU8writeMemEPhjm5FlagsImEPm+0x49d)[0x557f627fd12d]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN17SimpleExecContext8writeMemEPhjm5FlagsImEPm+0x29)[0x557f6280b439]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZNK10X86ISAInst2St7executeEP11ExecContextPN5Trace10InstRecordE+0x29b)[0x557f6301712b]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU4tickEv+0x3b4)[0x557f627fc054]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN10EventQueue10serviceOneEv+0xd9)[0x557f62912f79]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z9doSimLoopP10EventQueue+0x58)[0x557f6292cb88]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z8simulatem+0xc1a)[0x557f6292db7a]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x8a9c7b)[0x557f62aefc7b]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x72d5ab)[0x557f629735ab]
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalFrameEx+0x6e54)[0x7fbb3bfd37e4]
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalCodeEx+0x7d8)[0x7fbb3c0fdb88]
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalFrameEx+0x5bf0)[0x7fbb3bfd2580]
@@ -3117,7 +3117,7 @@ Boot fails with:
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalFrameEx+0x5bf0)[0x7fbb3bfd2580]
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalCodeEx+0x7d8)[0x7fbb3c0fdb88]
 --- END LIBC BACKTRACE ---
-./run: line 249: 21991 Aborted                 (core dumped) M5_PATH='/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/system' '/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt' '/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/configs/example/fs.py' --checkpoint-dir='./m5out/cpts/x86_64' --disk-image='/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/images/rootfs.ext2' --mem-size=256MB --num-cpus='1' --kernel=/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64~/build/linux-custom/vmlinux --command-line='earlyprintk=ttyS0 console=ttyS0 lpj=7999923 root=/dev/hda nokaslr norandmaps printk.devkmsg=on printk.time=y init=/eval_base64.sh - lkmc_eval="bTUgZXhpdA=="'
+./run: line 249: 21991 Aborted                 (core dumped) M5_PATH='/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/system' '/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt' '/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/configs/example/fs.py' --checkpoint-dir='./m5out/cpts/x86_64' --disk-image='/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/images/rootfs.ext2' --mem-size=256MB --num-cpus='1' --kernel=/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64/buildroot/build/linux-custom/vmlinux --command-line='earlyprintk=ttyS0 console=ttyS0 lpj=7999923 root=/dev/hda nokaslr norandmaps printk.devkmsg=on printk.time=y init=/eval_base64.sh - lkmc_eval="bTUgZXhpdA=="'
 ....
 
 dmesg stops at:
@@ -3144,27 +3144,27 @@ If I append `savedefconfig` to our `kernel_config_fragment`:
 
 ....
 --- BEGIN LIBC BACKTRACE ---
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z15print_backtracev+0x29)[0x559636f44c89]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z12abortHandleri+0x4a)[0x559636f5888a]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z15print_backtracev+0x29)[0x559636f44c89]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z12abortHandleri+0x4a)[0x559636f5888a]
 /lib/x86_64-linux-gnu/libpthread.so.0(+0x13150)[0x7f855f8f3150]
 /lib/x86_64-linux-gnu/libc.so.6(gsignal+0xcb)[0x7f855df250bb]
 /lib/x86_64-linux-gnu/libc.so.6(abort+0x16d)[0x7f855df26f5d]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x4110bf)[0x559636c900bf]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA8PS2Mouse11processDataEh+0x12a)[0x559636c8240a]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA5I80425writeEP6Packet+0xa2c)[0x559636c84b5c]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN7PioPort10recvAtomicEP6Packet+0x6e)[0x559637757ace]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15NoncoherentXBar10recvAtomicEP6Packets+0x279)[0x55963719c969]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6Bridge15BridgeSlavePort10recvAtomicEP6Packet+0x36)[0x5596371737f6]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN12CoherentXBar10recvAtomicEP6Packets+0x57b)[0x55963718024b]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU8writeMemEPhjm5FlagsImEPm+0x49d)[0x559636e3612d]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN17SimpleExecContext8writeMemEPhjm5FlagsImEPm+0x29)[0x559636e44439]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZNK10X86ISAInst2St7executeEP11ExecContextPN5Trace10InstRecordE+0x29b)[0x55963765012b]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU4tickEv+0x3b4)[0x559636e35054]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN10EventQueue10serviceOneEv+0xd9)[0x559636f4bf79]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z9doSimLoopP10EventQueue+0x58)[0x559636f65b88]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z8simulatem+0xc1a)[0x559636f66b7a]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x8a9c7b)[0x559637128c7b]
-/home/ciro/bak/git/linux-kernel-module-cheat/buildroot/output.x86_64-gem5~/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x72d5ab)[0x559636fac5ab]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x4110bf)[0x559636c900bf]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA8PS2Mouse11processDataEh+0x12a)[0x559636c8240a]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6X86ISA5I80425writeEP6Packet+0xa2c)[0x559636c84b5c]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN7PioPort10recvAtomicEP6Packet+0x6e)[0x559637757ace]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15NoncoherentXBar10recvAtomicEP6Packets+0x279)[0x55963719c969]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN6Bridge15BridgeSlavePort10recvAtomicEP6Packet+0x36)[0x5596371737f6]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN12CoherentXBar10recvAtomicEP6Packets+0x57b)[0x55963718024b]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU8writeMemEPhjm5FlagsImEPm+0x49d)[0x559636e3612d]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN17SimpleExecContext8writeMemEPhjm5FlagsImEPm+0x29)[0x559636e44439]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZNK10X86ISAInst2St7executeEP11ExecContextPN5Trace10InstRecordE+0x29b)[0x55963765012b]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN15AtomicSimpleCPU4tickEv+0x3b4)[0x559636e35054]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_ZN10EventQueue10serviceOneEv+0xd9)[0x559636f4bf79]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z9doSimLoopP10EventQueue+0x58)[0x559636f65b88]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(_Z8simulatem+0xc1a)[0x559636f66b7a]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x8a9c7b)[0x559637128c7b]
+/home/ciro/bak/git/linux-kernel-module-cheat/out/x86_64-gem5/buildroot/build/gem5-1.0/gem5/build/X86/gem5.opt(+0x72d5ab)[0x559636fac5ab]
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalFrameEx+0x6e54)[0x7f855fbb37e4]
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalCodeEx+0x7d8)[0x7f855fcddb88]
 /usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0(PyEval_EvalFrameEx+0x5bf0)[0x7f855fbb2580]
@@ -3231,7 +3231,7 @@ m5 writefile myfileguest myfilehost
 Host:
 
 ....
-cat m5out/myfilehost
+cat out/aarch64/gem5/m5out/myfilehost
 ....
 
 Does not work for subdirectories, gem5 crashes:
@@ -3247,7 +3247,7 @@ https://stackoverflow.com/questions/49516399/how-to-use-m5-readfile-and-m5-execf
 Host:
 
 ....
-date >m5out/myreadfile
+date >readfile.gitignore
 ....
 
 Guest:
@@ -3359,7 +3359,7 @@ cp br2.gitignore.example br2.gitignore
 `make menuconfig` is a convenient way to find Buildroot configurations:
 
 ....
-cd buildroot/output.x86_64~
+cd out/x86_64/buildroot
 make menuconfig
 ....
 
@@ -3432,7 +3432,7 @@ If you don't set it, the default is to use `~/.buildroot-ccache` with `5G`, whic
 I find it very relaxing to watch ccache at work with:
 
 ....
-watch -n1 'make -C buildroot/output.x86_64~/ ccache-stats'
+watch -n1 'make -C out/x86_64/buildroot/ ccache-stats'
 ....
 
 or if you have it installed on host and the environment variables exported simply with:
@@ -3452,7 +3452,7 @@ Send a pull request if you try it out on something significantly different.
 === Find which packages are making the build slow
 
 ....
-cd buildroot/output.x86_64~
+cd out/x86_64/buildroot
 make graph-build graph-depends
 xdg-open graphs/build.pie-packages.pdf
 xdg-open graphs/graph-depends.pdf
diff --git a/br2 b/br2
index 6af2e65..d8528c1 100644
--- a/br2
+++ b/br2
@@ -7,6 +7,12 @@ BR2_TARGET_ROOTFS_EXT2=y
 BR2_TARGET_ROOTFS_INITRAMFS=n
 BR2_TARGET_ROOTFS_EXT2_SIZE="512M"
 
+# We were tempted to do this to disable S40network neatly,
+# but that package also creates extra configuration files
+# such as /etc/network/interfaces which we need. So we just
+# remove the init.d file for now.
+#BR2_PACKAGE_IFUPDOWN_SCRIPTS=n
+
 BR2_CCACHE=y
 # Otherwise our precious debug would break!
 BR2_CCACHE_USE_BASEDIR=n
@@ -29,9 +35,6 @@ BR2_TOOLCHAIN_BUILDROOT_CXX=y
 BR2_TOOLCHAIN_BUILDROOT_FORTRAN=y
 BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
 
-# We use our own to turn it on and off at runtime.
-BR2_PACKAGE_IFUPDOWN_SCRIPTS=n
-
 # lscpu: TODO not installing?
 BR2_PACKAGE_UTIL_LINUX=y
 BR2_PACKAGE_UTIL_LINUX_BINARIES=y
diff --git a/build b/build
index 773c407..d506e45 100755
--- a/build
+++ b/build
@@ -83,6 +83,7 @@ done
 shift $(($OPTIND - 1))
 extra_make_args="$extra_make_args $@"
 set_common_vars "$arch" "$gem5"
+config_file="${buildroot_out_dir}/.config"
 case "$arch" in
   x86_64)
     defconfig=qemu_x86_64_defconfig
@@ -108,7 +109,7 @@ if "$configure"; then
   for p in $(find "${root_dir}/buildroot_patches/" -maxdepth 1 -name '*.patch' -print); do
     patch -N -r - -p 1 <"$p" || :
   done
-  make O="$out_dir" BR2_EXTERNAL="../kernel_module:../gem5:../parsec-benchmark" "$defconfig"
+  make O="$buildroot_out_dir" BR2_EXTERNAL="../kernel_module:../gem5:../parsec-benchmark" "$defconfig"
   # TODO Can't get rid of these for now.
   # http://stackoverflow.com/questions/44078245/is-it-possible-to-use-config-fragments-with-buildroots-config
   for config_fragment in $config_fragments; do
@@ -116,6 +117,7 @@ if "$configure"; then
   done
   printf "
 BR2_JLEVEL=$j
+BR2_DL_DIR=\"${common_dir}/dl\"
 BR2_ROOTFS_POST_SCRIPT_ARGS=\"$post_script_args\"
 " >> "${config_file}"
   if "$gem5"; then
@@ -151,13 +153,14 @@ BR2_ROOTFS_POST_SCRIPT_ARGS=\"$post_script_args\"
     # http://lists.busybox.net/pipermail/buildroot/2017-August/201053.html
     sed -Ei 's/^BR2_PACKAGE_LINUX_TOOLS_GPIO/BR2_PACKAGE_LINUX_TOOLS_GPIO=n/' "${config_file}"
   fi
-  make O="$out_dir" olddefconfig
+  make O="$buildroot_out_dir" olddefconfig
 fi
 
 # Build.
 mkdir -p \
+  "${gem5_out_dir}" \
+  "${qemu_out_dir}" \
   "${root_dir}/9p" \
-  "${lkmc_out_dir}" \
 ;
 cd "${buildroot_dir}"
 # HOST_QEMU_OPTS is a hack that happens to work because the QEMU package luckly uses += at all times.
@@ -172,10 +175,10 @@ cmd="time \
   env \
   -u LD_LIBRARY_PATH \
   make \
-  O='${out_dir}' \
-  HOST_QEMU_OPTS='--enable-debug --extra-cflags=-DDEBUG_PL061=1 --enable-trace-backends=simple $qemu_sdl' \
+  O='${buildroot_out_dir}' \
+  HOST_QEMU_OPTS='--enable-debug --extra-cflags=-DDEBUG_PL061=1 --enable-trace-backends=simple ${qemu_sdl}' \
   V='$v' \
-  $extra_make_args \
+  ${extra_make_args} \
   all \
 "
 echo "$cmd" | tee "${root_dir}/build.log"
diff --git a/build-doc b/build-doc
index b3ffede..a485c49 100755
--- a/build-doc
+++ b/build-doc
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-asciidoctor README.adoc
+asciidoctor -o out/README.html README.adoc
diff --git a/common b/common
index 3bac4f8..54c8a2e 100644
--- a/common
+++ b/common
@@ -8,8 +8,12 @@ set_common_vars() {
   if "$gem5" && [ ! "$arch" = aarch64 ]; then
     arch_dir="${arch}-gem5"
   fi
-  out_dir="${buildroot_dir}/output.${arch_dir}~"
-  config_file="${out_dir}/.config"
-  lkmc_out_dir="${out_dir}/lkmc"
-  images_dir="${out_dir}/images"
+  out_dir="${root_dir}/out"
+  out_arch_dir="${out_dir}/${arch_dir}"
+  buildroot_out_dir="${out_arch_dir}/buildroot"
+  build_dir="${buildroot_out_dir}/build"
+  host_dir="${buildroot_out_dir}/host"
+  gem5_out_dir="${out_arch_dir}/gem5"
+  qemu_out_dir="${out_arch_dir}/qemu"
+  common_dir="${out_dir}/common"
 }
diff --git a/run b/run
index fd030c7..7359ed6 100755
--- a/run
+++ b/run
@@ -90,6 +90,7 @@ done
 shift "$(($OPTIND - 1))"
 extra_flags="$extra_flags $@"
 set_common_vars "$arch" "$gem5"
+images_dir="${buildroot_out_dir}/images"
 if "$debug" && "$kvm"; then
   echo 'error: -d and -K are incompatible' 1>&2
   exit 1
@@ -117,29 +118,27 @@ if [ -n "$extra_append_after_dash" ]; then
 fi
 
 if "$gem5"; then
-  build_dir="${out_dir}/build/gem5-1.0"
+  gem5_build_dir="${buildroot_out_dir}/build/gem5-1.0"
+  gem5_src_dir="${gem5_build_dir}/gem5"
   memory="${memory}B"
-  gem5_dir="${build_dir}/gem5"
   if [ "$arch" = x86_64 ]; then
     gem5_arch=X86
   else
     gem5_arch=ARM
   fi
-  m5out_dir="${root_dir}/m5out"
-  gem5_cpt_dir="${m5out_dir}/cpts/${arch}"
-  mkdir -p "$gem5_cpt_dir"
+  m5out_dir="${gem5_out_dir}/m5out"
   gem5_common="\
-M5_PATH='${build_dir}/system' \
-$debug_vm \
-'${gem5_dir}/build/${gem5_arch}/gem5.opt' \
+M5_PATH='${gem5_build_dir}/system' \
+${debug_vm} \
+'${gem5_src_dir}/build/${gem5_arch}/gem5.opt' \
 ${gem5opts} \
-'${gem5_dir}/configs/example/fs.py' \
---checkpoint-dir='${gem5_cpt_dir}' \
---disk-image='${out_dir}/images/rootfs.ext2' \
---kernel='${out_dir}/build/linux-custom/vmlinux' \
+-d '${m5out_dir}' \
+'${gem5_src_dir}/configs/example/fs.py' \
+--disk-image='${images_dir}/rootfs.ext2' \
+--kernel='${buildroot_out_dir}/build/linux-custom/vmlinux' \
 --mem-size=${memory} \
 --num-cpus='${cpus}' \
---script='${m5out_dir}/myreadfile' \
+--script='${root_dir}/readfile.gitignore' \
 "
   if [ "$arch" = x86_64 ]; then
     if "$kvm"; then
@@ -155,7 +154,7 @@ ${extra_flags} \
     # Anything smaller than physical blows up as expected, but why can't it auto-detect the right value?
     cmd="${gem5_common} \
 --command-line='earlyprintk=pl011,0x1c090000 console=ttyAMA0 lpj=19988480 rw loglevel=8 mem=${memory} root=/dev/sda ${extra_append}' \
---dtb-file='${gem5_dir}/system/arm/dt/$([ "$arch" = arm ] && echo "armv7_gem5_v1_${cpus}cpu" || echo "armv8_gem5_v1_${cpus}cpu").dtb' \
+--dtb-file='${gem5_src_dir}/system/arm/dt/$([ "$arch" = arm ] && echo "armv7_gem5_v1_${cpus}cpu" || echo "armv8_gem5_v1_${cpus}cpu").dtb' \
 --machine-type=VExpress_GEM5_V1 \
 ${extra_flags} \
 "
@@ -167,15 +166,15 @@ else
   extra_flags="${extra_flags_qemu} ${extra_flags}"
   qemu_common="\
 ${debug_vm} \
-'${out_dir}/host/usr/bin/qemu-system-${arch}' \
+'${buildroot_out_dir}/host/usr/bin/qemu-system-${arch}' \
 -gdb tcp::1234 \
 -m ${memory} \
 -monitor telnet::45454,server,nowait \
 -netdev user,hostfwd=tcp::45455-:45455,hostfwd=tcp::45456-:22,id=net0 \
 -smp ${cpus} \
--trace enable=${trace_enable},file='${lkmc_out_dir}/trace.bin' \
+-trace enable=${trace_enable},file='${qemu_out_dir}/trace.bin' \
 -virtfs local,path=9p,mount_tag=host_scratch,security_model=mapped,id=host_scratch \
--virtfs local,path=${out_dir}/build,mount_tag=host_out,security_model=mapped,id=host_out \
+-virtfs local,path=${buildroot_out_dir}/build,mount_tag=host_out,security_model=mapped,id=host_out \
 "
   if "$initrd"; then
     extra_flags="${extra_flags} -initrd '${images_dir}/rootfs.cpio'"
diff --git a/rungdb b/rungdb
index 08c10f6..b30fa30 100755
--- a/rungdb
+++ b/rungdb
@@ -42,8 +42,8 @@ else
   port=1234
 fi
 set_common_vars "$arch" "$gem5"
-gdb="${out_dir}/host/usr/bin/${arch}-linux-gdb ${before}"
-cd "${out_dir}/build/linux-custom/"
+gdb="${host_dir}/usr/bin/${arch}-linux-gdb ${before}"
+cd "${build_dir}/linux-custom/"
 if "$kgdb"; then
     cmd="\
 ${gdb} \
diff --git a/rungdb-user b/rungdb-user
index 05c51a2..af439d3 100755
--- a/rungdb-user
+++ b/rungdb-user
@@ -30,8 +30,8 @@ else
   brk=''
 fi
 set_common_vars "$arch" "$gem5"
-executable="${out_dir}/build/${executable_rel}"
-readelf="${out_dir}/host/usr/bin/${arch}-linux-readelf"
+executable="${build_dir}/${executable_rel}"
+readelf="${host_dir}/usr/bin/${arch}-linux-readelf"
 addr="$("$readelf" -h "$executable" | awk '/Entry/{ print $NF }' )"
 ex="-ex \"add-symbol-file $executable $addr\""
 # -L or else lx-symbols throws for arm:
diff --git a/rungdbserver b/rungdbserver
index 80ac184..1ddc9d0 100755
--- a/rungdbserver
+++ b/rungdbserver
@@ -16,11 +16,11 @@ done
 shift "$(($OPTIND - 1))"
 executable="$1"
 set_common_vars "$arch" "$gem5"
-"${out_dir}/host/usr/bin/${arch}-linux-gdb" \
+"${host_dir}/usr/bin/${arch}-linux-gdb" \
   -q \
-  -ex "set sysroot ${out_dir}/staging" \
+  -ex "set sysroot ${buildroot_out_dir}/staging" \
   -ex 'target remote localhost:45455' \
   -ex 'tb main' \
   -ex 'c' \
-  "${out_dir}/build/${executable}" \
+  "${build_dir}/${executable}" \
 ;
diff --git a/trace-boot b/trace-boot
index 07c0635..76973b1 100755
--- a/trace-boot
+++ b/trace-boot
@@ -11,13 +11,13 @@ while getopts a: OPT; do
 done
 set_common_vars "$arch" false
 time ./run -a "$arch" -e 'init=/poweroff.out' -T exec_tb
-time ./qemu/scripts/simpletrace.py "${out_dir}/build/host-qemu-custom/trace-events-all" "${lkmc_out_dir}/trace.bin" >"${lkmc_out_dir}/trace.txt"
+time ./qemu/scripts/simpletrace.py "${build_dir}/host-qemu-custom/trace-events-all" "${qemu_out_dir}/trace.bin" >"${qemu_out_dir}/trace.txt"
 
 # Instruction count.
 # We could put this on a separate script, but it just adds more arch boilerplate to a new script.
 # So let's just leave it here for now since it did not add a significant processing time.
-echo "instruction count all: $(wc -l "${lkmc_out_dir}/trace.txt" | cut -d' ' -f1)"
-entry_addr=$("${out_dir}"/host/bin/*-buildroot-*-readelf -h "${out_dir}/build/linux-custom/vmlinux" | grep 'Entry point address' | sed -E 's/.*: *//')
+echo "instruction count all: $(wc -l "${qemu_out_dir}/trace.txt" | cut -d' ' -f1)"
+entry_addr=$("${host_dir}"/bin/*-buildroot-*-readelf -h "${build_dir}/linux-custom/vmlinux" | grep 'Entry point address' | sed -E 's/.*: *//')
 echo "entry address: ${entry_addr}"
-sed "/${entry_addr}/q" "${lkmc_out_dir}/trace.txt" >"${lkmc_out_dir}/trace-boot.txt"
-echo "instruction count firmware: $(wc -l "${lkmc_out_dir}/trace-boot.txt" | cut -d' ' -f1)"
+sed "/${entry_addr}/q" "${qemu_out_dir}/trace.txt" >"${qemu_out_dir}/trace-boot.txt"
+echo "instruction count firmware: $(wc -l "${qemu_out_dir}/trace-boot.txt" | cut -d' ' -f1)"
diff --git a/trace2line b/trace2line
index 026249d..f145cdf 100755
--- a/trace2line
+++ b/trace2line
@@ -10,9 +10,9 @@ while getopts a: OPT; do
   esac
 done
 set_common_vars "$arch" false
-kernel_dir="${out_dir}/build/linux-custom"
-sed -E 's/.*pc=//' "${lkmc_out_dir}/trace.txt" | \
-  xargs "${out_dir}/host/bin/${arch}-linux-addr2line" -e "${kernel_dir}/vmlinux" -fp | \
+kernel_dir="${build_dir}/linux-custom"
+sed -E 's/.*pc=//' "${qemu_out_dir}/trace.txt" | \
+  xargs "${host_dir}/bin/${arch}-linux-addr2line" -e "${kernel_dir}/vmlinux" -fp | \
   sed -E "s|at ${kernel_dir}/(\./\|)||" | \
   uniq -c \
-> "${lkmc_out_dir}/trace-lines.txt"
+> "${qemu_out_dir}/trace-lines.txt"