diff --git a/lib/test-driver/Machine.pm b/lib/test-driver/Machine.pm
index 49e5fd767ee6..4f8dcf441a86 100644
--- a/lib/test-driver/Machine.pm
+++ b/lib/test-driver/Machine.pm
@@ -125,8 +125,8 @@ sub start {
         $ENV{USE_TMPDIR} = 1;
         $ENV{QEMU_OPTS} =
             "-no-reboot -monitor unix:./monitor -chardev socket,id=shell,path=./shell " .
+            "-device virtio-serial -device virtconsole,chardev=shell " .
             ($showGraphics ? "-serial stdio" : "-nographic");
-        $ENV{QEMU_NET_OPTS} = "guestfwd=tcp:10.0.2.6:23-chardev:shell";
         $ENV{QEMU_KERNEL_PARAMS} = "hostTmpDir=$ENV{TMPDIR}";
         chdir $self->{stateDir} or die;
         exec $self->{startCommand};
diff --git a/modules/profiles/qemu-guest.nix b/modules/profiles/qemu-guest.nix
new file mode 100644
index 000000000000..60a52ce6e122
--- /dev/null
+++ b/modules/profiles/qemu-guest.nix
@@ -0,0 +1,8 @@
+# Common configuration for virtual machines running under QEMU (using
+# virtio).
+
+{ config, pkgs, ... }:
+
+{
+  boot.initrd.kernelModules = [ "virtio_net" "virtio_pci" "virtio_blk" "virtio_balloon" "virtio_console" ];
+}
diff --git a/modules/testing/test-instrumentation.nix b/modules/testing/test-instrumentation.nix
index 78ce250675d1..6a9e2aee2938 100644
--- a/modules/testing/test-instrumentation.nix
+++ b/modules/testing/test-instrumentation.nix
@@ -24,10 +24,7 @@ in
   config = {
 
     jobs.backdoor =
-      { # If the firewall is enabled, this job must start *after* the
-        # firewall, otherwise connection tracking won't know about
-        # this connection.
-        startOn = if config.networking.firewall.enable then "started firewall" else "ip-up";
+      { startOn = "startup";
         stopOn = "never";
         
         script =
@@ -37,8 +34,10 @@ in
             export DISPLAY=:0.0
             source /etc/profile
             cd /tmp
-            echo "connecting to host..." > /dev/ttyS0
-            ${pkgs.socat}/bin/socat tcp:10.0.2.6:23 exec:${rootShell} 2> /dev/ttyS0 # || poweroff -f
+            exec < /dev/hvc0 > /dev/hvc0 2> /dev/ttyS0
+            echo "connecting to host..." >&2
+            stty -F /dev/hvc0 raw # prevent nl -> cr/nl conversion
+            ${pkgs.socat}/bin/socat stdio exec:${rootShell}
           '';
 
         respawn = false;
diff --git a/modules/virtualisation/qemu-vm.nix b/modules/virtualisation/qemu-vm.nix
index 44d6a999d44c..efa37146f214 100644
--- a/modules/virtualisation/qemu-vm.nix
+++ b/modules/virtualisation/qemu-vm.nix
@@ -228,7 +228,7 @@ let
 in
 
 {
-  require = options;
+  require = [ options ../profiles/qemu-guest.nix ];
 
   boot.loader.grub.device = mkOverride 50 "/dev/vda";
   
@@ -236,7 +236,7 @@ in
   # CIFS.  Also use paravirtualised network and block devices for
   # performance.
   boot.initrd.availableKernelModules =
-    [ "cifs" "virtio_net" "virtio_pci" "virtio_blk" "virtio_balloon" "nls_utf8" ]
+    [ "cifs" "nls_utf8" ]
     ++ optional cfg.writableStore [ "aufs" ];
 
   boot.extraModulePackages =