diff --git a/aarch64/run_qemu.sh b/aarch64/run_qemu.sh
index a807d13..19b97d4 100755
--- a/aarch64/run_qemu.sh
+++ b/aarch64/run_qemu.sh
@@ -20,7 +20,7 @@
 default_var ROM_DIR		"${PREBUILTS_QEMU_ROM_DIR}"
 default_var KERNEL		"${LINUX_OUT_IMAGE}"
 default_var ROOTFS		"${PREBUILTS_KUT_ROOTFS}"
-default_var FIRMWARE		""
+default_var TEMPLATE		""
 default_var CPU			""
 default_var SMP			2
 default_var RAM			512
@@ -44,7 +44,7 @@
 	cat <<EOF
 
 Usage: $0 [-h] [-v] [-K]
-       [-e QEMU] [-L ROM_DIR] [-k KERNEL] [-r ROOTFS] [-R DRIVE] [-F FIRMWARE]
+       [-e QEMU] [-L ROM_DIR] [-k KERNEL] [-r ROOTFS] [-R DRIVE] [-F TEMPLATE]
        [-c CPU] [-s NUM_CPUS] [-m MEM] [-g GIC] [-M KVM_MODE] [-G]
        [-t TIMEOUT] [-a APPEND]
 
@@ -55,7 +55,7 @@
     -k    kernel image
     -r    root filesystem image
     -R    additional drive image(s) to mount as read-only
-    -F    VM firmware image
+    -F    VM template image
     -c    CPU model (defaults to "${DEFAULT_CPU}")
     -s    number of CPU cores (defaults to ${DEFAULT_SMP})
     -m    amount of memory in MB (defaults to ${DEFAULT_RAM})
@@ -89,11 +89,7 @@
 	printf '0x%x\n' $1
 }
 
-# On a real system, the firmware, not the kernel, would live in a separate
-# memory slot, described in the DT as "pkvm_guest_firmware" and
-# compatible = "linux,pkvm-guest-firmware-memory". Here, as a temporary
-# solution for testing on QEMU, we put the kernel in such memory slot.
-function kernel_payload_overlay() {
+function template_overlay() {
 	local in="$1"
 	local out="$2"
 	local tmp="$3"
@@ -103,10 +99,10 @@
 	# Convert input DTB back to source.
 	${DTC} -I dtb -O dts -o "${tmp}" "${in}"
 
-	# Append an overlay describing the kernel payload.
+	# Append an overlay describing the template.
 	cat <<EOF >> "${tmp}"
 &{/} {
-	pkvm_kernel_payload@${addr} {
+	pkvm_template@${addr} {
 		compatible = "pkvm,arm64";
 		#address-cells = <2>;
 		#size-cells = <1>;
@@ -130,7 +126,7 @@
 	k)	KERNEL="${OPTARG}"		;;
 	r)	ROOTFS="${OPTARG}"		;;
 	R)	EXTRA_RO_MOUNTS+=("${OPTARG}")	;;
-	F)	FIRMWARE="${OPTARG}"		;;
+	F)	TEMPLATE="${OPTARG}"		;;
 	c)	CPU="${OPTARG}"			;;
 	s)	SMP="${OPTARG}"			;;
 	m)	RAM="${OPTARG}"			;;
@@ -172,11 +168,6 @@
 	CMD+=(timeout -k 1s --foreground "${TIMEOUT}")
 fi
 
-CMD_KERNEL=${KERNEL}
-if [ -n "${FIRMWARE}" ]; then
-	CMD_KERNEL=${FIRMWARE}
-fi
-
 case "${MODE}" in
 	vhe)	MODE_CPU="${CPU_VHE}";;
 	nvhe)	MODE_CPU="${CPU_NVHE}";;
@@ -200,7 +191,7 @@
 CMD+=(-smp "${SMP}")
 CMD+=(-m "${RAM}")
 CMD+=(-L "${ROM_DIR}")
-CMD+=(-kernel "${CMD_KERNEL}")
+CMD+=(-kernel "${KERNEL}")
 CMD+=(-drive file="${ROOTFS}",readonly,if=virtio,format=raw)
 CMD+=(-object rng-random,filename=/dev/urandom,id=rng0)
 CMD+=(-device virtio-rng-pci,rng=rng0)
@@ -221,7 +212,7 @@
 
 CMD+=(-append "${APPEND[*]}")
 
-if [ -n "${FIRMWARE}" ]; then
+if [ -n "${TEMPLATE}" ]; then
 	QEMU_DTB="$(mktemp)"
 	QEMU_PATCHED_DTB="$(mktemp)"
 	TMP_DTS="$(mktemp)"
@@ -233,24 +224,23 @@
 	"${CMD[@]}" -machine dumpdtb="${QEMU_DTB}" > /dev/null
 
 	# Compile the overlayed DTB with dummy values to determine its size.
-	kernel_payload_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" 0x0 0x0
+	template_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" 0x0 0x0
 	TMP_DTB_SIZE=$(file_size "${QEMU_PATCHED_DTB}")
 
 	# From QEMU's hw/arm/boot.c:
 	# RAM always starts at 1GiB PA offset. The kernel is placed there.
 	# 128MiB (or RAM/2 if RAM<256MiB) is left to the kernel to decompress.
 	# This is followed by the ramdisk and then 2MiB-aligned DTB.
-	# In our case, for testing, `-kernel` is the firmware, and we place the
-	# actual kernel Image at the following page (assume 64KiB page size).
-	KERNEL_PAYLOAD_ADDR=$(( 1*GiB + 128*MiB + TMP_DTB_SIZE ))
-	KERNEL_PAYLOAD_ADDR=$(hex $(align_up_pow2 $KERNEL_PAYLOAD_ADDR 64*KiB))
-	KERNEL_SIZE=$(hex $(file_size "${KERNEL}"))
+	# We place the template at the following page (assume 64KiB page size).
+	TEMPLATE_ADDR=$(( 1*GiB + 128*MiB + TMP_DTB_SIZE ))
+	TEMPLATE_ADDR=$(hex $(align_up_pow2 $TEMPLATE_ADDR 64*KiB))
+	TEMPLATE_SIZE=$(hex $(file_size "${TEMPLATE}"))
 
-	kernel_payload_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" \
-			 "${KERNEL_PAYLOAD_ADDR}" "${KERNEL_SIZE}"
+	template_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" \
+			 "${TEMPLATE_ADDR}" "${TEMPLATE_SIZE}"
 
 	CMD+=(-dtb "${QEMU_PATCHED_DTB}")
-	CMD+=(-device loader,file="${KERNEL}",addr=${KERNEL_PAYLOAD_ADDR},force-raw=true)
+	CMD+=(-device loader,file="${TEMPLATE}",addr=${TEMPLATE_ADDR},force-raw=true)
 fi
 
 if [ "${VERBOSE}" -eq 1 ]; then