diff --git a/build/toolchain/BUILD.gn b/build/toolchain/BUILD.gn
index 0bfc56b..625c6b5 100644
--- a/build/toolchain/BUILD.gn
+++ b/build/toolchain/BUILD.gn
@@ -19,6 +19,7 @@
   use_platform = false
 }
 
+# Toolchain for building tests which run under Linux under Hafnium.
 embedded_clang_toolchain("aarch64_linux_clang") {
   target = "aarch64-linux-musleabi"
 
diff --git a/build/toolchain/embedded.gni b/build/toolchain/embedded.gni
index 4372904..2b232c6 100644
--- a/build/toolchain/embedded.gni
+++ b/build/toolchain/embedded.gni
@@ -371,3 +371,41 @@
     platform_name = target_name
   }
 }
+
+template("aarch64_toolchains") {
+  aarch64_toolchain("${target_name}") {
+    forward_variables_from(invoker,
+                           [
+                             "origin_address",
+                             "use_pl011",
+                             "pl011_base_address",
+                             "gic_version",
+                             "gicd_base_address",
+                             "gicr_base_address",
+                             "heap_pages",
+                             "max_cpus",
+                             "max_vms",
+                           ])
+    cpu = "${invoker.cpu}+nofp"
+  }
+
+  # Toolchain for building test VMs which run under Hafnium.
+  aarch64_toolchain("${target_name}_vm") {
+    # TODO(b/115484857): Remove access to PL011 from VMs.
+    forward_variables_from(invoker,
+                           [
+                             "origin_address",
+                             "use_pl011",
+                             "pl011_base_address",
+                             "gic_version",
+                             "gicd_base_address",
+                             "gicr_base_address",
+                           ])
+    cpu = "${invoker.cpu}+fp"
+
+    # Nonsense values because they are required but shouldn't be used.
+    heap_pages = 0
+    max_cpus = 0
+    max_vms = 0
+  }
+}
diff --git a/kokoro/ubuntu/test.sh b/kokoro/ubuntu/test.sh
index 201e2b1..c29a1fe 100755
--- a/kokoro/ubuntu/test.sh
+++ b/kokoro/ubuntu/test.sh
@@ -47,9 +47,9 @@
 # Run the tests with a timeout so they can't loop forever.
 if [ $USE_FVP == 1 ]
 then
-  HFTEST="$TIMEOUT 300s ./test/hftest/hftest.py --fvp=true --out $OUT/aem_v8a_fvp_clang --log $OUT/kokoro_log"
+  HFTEST="$TIMEOUT 300s ./test/hftest/hftest.py --fvp=true --out $OUT/aem_v8a_fvp_clang --out_initrd $OUT/aem_v8a_fvp_vm_clang --log $OUT/kokoro_log"
 else
-  HFTEST="$TIMEOUT 30s ./test/hftest/hftest.py --out $OUT/qemu_aarch64_clang --log $OUT/kokoro_log"
+  HFTEST="$TIMEOUT 30s ./test/hftest/hftest.py --out $OUT/qemu_aarch64_clang --out_initrd $OUT/qemu_aarch64_vm_clang --log $OUT/kokoro_log"
 fi
 
 # Add prebuilt libc++ to the path.
diff --git a/project/reference b/project/reference
index 9264cb7..b145760 160000
--- a/project/reference
+++ b/project/reference
@@ -1 +1 @@
-Subproject commit 9264cb73132a3c0541097c92335753685fb041b2
+Subproject commit b1457609e53750bf3a895affc43f5a2d89cd9a8f
diff --git a/test/hftest/hftest.py b/test/hftest/hftest.py
index 7834c4d..3fa902e 100755
--- a/test/hftest/hftest.py
+++ b/test/hftest/hftest.py
@@ -177,6 +177,7 @@
     parser.add_argument("image")
     parser.add_argument("--out", required=True)
     parser.add_argument("--log", required=True)
+    parser.add_argument("--out_initrd")
     parser.add_argument("--initrd")
     parser.add_argument("--suite")
     parser.add_argument("--test")
@@ -188,7 +189,7 @@
     initrd = None
     suite = args.image
     if args.initrd:
-        initrd = os.path.join(args.out, "obj", args.initrd, "initrd.img")
+        initrd = os.path.join(args.out_initrd, "obj", args.initrd, "initrd.img")
         suite += "_" + args.initrd
     vm_args = args.vm_args or ""
     log = os.path.join(args.log, suite)