diff --git a/aarch64/run_gdb.sh b/aarch64/run_gdb.sh
index 2555d13..6210c8a 100755
--- a/aarch64/run_gdb.sh
+++ b/aarch64/run_gdb.sh
@@ -42,7 +42,7 @@
 		exit 0
 		;;
 	\?)
-		echo "Invalid option: ${!OPTIND}" 1>&2
+		echo "Invalid option: -${OPTARG}" 1>&2
 		usage 1>&2
 		exit 1
 		;;
diff --git a/aarch64/run_qemu.sh b/aarch64/run_qemu.sh
index d628518..b18ca42 100755
--- a/aarch64/run_qemu.sh
+++ b/aarch64/run_qemu.sh
@@ -16,19 +16,20 @@
 
 source "$(dirname "${BASH_SOURCE[0]}")/../common.inc"
 
-default_var QEMU	"${PREBUILTS_QEMU_BIN}"
-default_var ROM_DIR	"${PREBUILTS_QEMU_ROM_DIR}"
-default_var KERNEL	"${LINUX_OUT_IMAGE}"
-default_var ROOTFS	"${PREBUILTS_KUT_ROOTFS}"
-default_var TEMPLATE	""
-default_var CPU		"max"
-default_var SMP		2
-default_var RAM		512
-default_var GIC		3
-default_var GDB		0
-default_var VERBOSE	0
-default_var KEEP_TEMP	0
-default_var TIMEOUT	""
+default_var QEMU		"${PREBUILTS_QEMU_BIN}"
+default_var ROM_DIR		"${PREBUILTS_QEMU_ROM_DIR}"
+default_var KERNEL		"${LINUX_OUT_IMAGE}"
+default_var ROOTFS		"${PREBUILTS_KUT_ROOTFS}"
+default_var TEMPLATE		""
+default_var CPU			"max"
+default_var SMP			2
+default_var RAM			512
+default_var GIC			3
+default_var GDB			0
+default_var KVM_PROTECTED	1
+default_var VERBOSE		0
+default_var KEEP_TEMP		0
+default_var TIMEOUT		""
 
 KiB=1024
 MiB=$((1024 * KiB))
@@ -39,7 +40,7 @@
 
 Usage: $0 [-h] [-v] [-K]
        [-e QEMU] [-L ROM_DIR] [-k KERNEL] [-r ROOTFS] [-R DRIVE] [-T TEMPLATE]
-       [-c CPU] [-s NUM_CPUS] [-m MEM] [-g GIC] [-G]
+       [-c CPU] [-s NUM_CPUS] [-m MEM] [-g GIC] [-G] [-N]
        [-t TIMEOUT]
 
     -h    output this help text
@@ -55,6 +56,7 @@
     -m    amount of memory in MB (defaults to ${DEFAULT_RAM})
     -g    version of GIC (defaults to ${DEFAULT_GIC})
     -G    enable debugging of emulated system with GDB
+    -N    disable protected KVM configuration
     -t    kill QEMU after given number of seconds
     -K    keep temp files
 EOF
@@ -109,7 +111,7 @@
 APPEND=()
 EXTRA_RO_MOUNTS=()
 
-while getopts ":e:L:k:r:R:T:c:s:m:g:t:vGKh" OPT; do
+while getopts ":e:L:k:r:R:T:c:s:m:g:t:vGNKh" OPT; do
 	case "${OPT}" in
 	e)	QEMU="${OPTARG}"		;;
 	L)	ROM_DIR="${OPTARG}"		;;
@@ -124,13 +126,14 @@
 	t)	TIMEOUT="${OPTARG}"		;;
 	v)	VERBOSE=1			;;
 	G)	GDB=1				;;
+	N)	KVM_PROTECTED=0			;;
 	K)	KEEP_TEMP=1			;;
 	h)
 		usage
 		exit 0
 		;;
 	\?)
-		echo "Invalid option: ${!OPTIND}" 1>&2
+		echo "Invalid option: -${OPTARG}" 1>&2
 		usage 1>&2
 		exit 1
 		;;
@@ -182,6 +185,10 @@
 	APPEND+=(nokaslr)
 fi
 
+if [ "${KVM_PROTECTED}" -eq 1 ]; then
+	APPEND+=(kvm-arm.protected=1)
+fi
+
 CMD+=(-append "${APPEND[*]}")
 
 if [ -n "${TEMPLATE}" ]; then
diff --git a/kvm-unit-tests/gen_makefile.sh b/kvm-unit-tests/gen_makefile.sh
index bbd5b32..2318aad 100755
--- a/kvm-unit-tests/gen_makefile.sh
+++ b/kvm-unit-tests/gen_makefile.sh
@@ -41,17 +41,13 @@
 # Generates target name for a group of given parameters.
 # Args:
 #   1) Root target name
-#   2) is VHE (0/1)
+#   2) KVM mode (pkvm/nvhe/vhe)
 function group_target_name {
 	local group="$1"
-	local vhe="$2"
+	local mode="$2"
 
 	group="$(target_name kut "${group}")"
-	if [ "${vhe}" -eq 1 ]; then
-		group="$(target_name vhe "${group}")"
-	else
-		group="$(target_name nvhe "${group}")"
-	fi
+	group="$(target_name "${mode}" "${group}")"
 	echo "${group}"
 }
 
@@ -82,18 +78,21 @@
 # Args:
 #   1) Target name
 #   2) Test binary path
-#   3) is VHE (0/1)
+#   3) KVM mode (pkvm/nvhe/vhe)
 #   4) is GDB (0/1)
 function test_target {
 	local target="$1"
 	local binary="$2"
-	local vhe="$3"
+	local mode="$3"
 	local gdb="$4"
 
 	local extra_args=()
-	if [ "${vhe}" -eq 1 ]; then
+	if [ "${mode}" == "vhe" ]; then
 		extra_args+=(-V)
 	fi
+	if [ "${mode}" != "pkvm" ]; then
+		extra_args+=(-N)
+	fi
 	if [ "${gdb}" -eq 1 ]; then
 		extra_args+=(-G)
 	fi
@@ -134,10 +133,10 @@
 fi
 
 TARGET_LIST=()
-for VHE in 0 1; do
+for MODE in pkvm nvhe vhe; do
 	# Emit a target for this test group.
 	ROOT="${GLOBAL_TEST_TARGET}"
-	GROUP="$(group_target_name "${ROOT}" "${VHE}")"
+	GROUP="$(group_target_name "${ROOT}" "${MODE}")"
 	dependency_target "${GROUP}" "${ROOT}"
 
 	for TEST_PATH in "${TEST_DIR}"/*; do
@@ -151,8 +150,8 @@
 		GDB_TARGET="$(target_name gdb ${TARGET})"
 		TARGET_LIST+=("${TARGET}" "${GDB_TARGET}")
 
-		test_target "${TARGET}" "${TEST_PATH}" "${VHE}" 0
-		test_target "${GDB_TARGET}" "${TEST_PATH}" "${VHE}" 1
+		test_target "${TARGET}" "${TEST_PATH}" "${MODE}" 0
+		test_target "${GDB_TARGET}" "${TEST_PATH}" "${MODE}" 1
 		dependency_target "${TARGET}" "${GROUP}"
 	done
 done
diff --git a/kvm-unit-tests/run_test.sh b/kvm-unit-tests/run_test.sh
index b38d5cc..b7ca66d 100755
--- a/kvm-unit-tests/run_test.sh
+++ b/kvm-unit-tests/run_test.sh
@@ -21,6 +21,7 @@
 default_var VERBOSE		0
 default_var QUIET		0
 default_var GDB			0
+default_var KVM_PROTECTED	1
 default_var KERNEL		""
 default_var TEST_PATH		""
 default_var DISPLAY_NAME	""
@@ -47,16 +48,18 @@
     -d    Override test name displayed in result
     -o    Redirect stdout/stderr output to given file (implies -q)
     -V    Enable VHE configuration
+    -N    Disable protected KVM configuration
     -G    Enable debugging of emulated system with GDB
 EOF
 }
 
-while getopts ":k:d:o:vVGqh" OPT; do
+while getopts ":k:d:o:vVNGqh" OPT; do
 	case "${OPT}" in
 	k)	KERNEL="${OPTARG}"		;;
 	d)	DISPLAY_NAME="${OPTARG}"	;;
 	v)	VERBOSE=1			;;
 	V)	VHE=1				;;
+	N)	KVM_PROTECTED=0			;;
 	q)	QUIET=1				;;
 	G)	GDB=1				;;
 	o)
@@ -68,7 +71,7 @@
 		exit 0
 		;;
 	\?)
-		echo "Invalid option: ${!OPTIND}" 1>&2
+		echo "Invalid option: -${OPTARG}" 1>&2
 		usage 1>&2
 		exit 1
 		;;
@@ -108,6 +111,10 @@
 	CMD+=(-c "${CPU_NVHE}")
 fi
 
+if [ "${KVM_PROTECTED}" -ne 1 ]; then
+	CMD+=(-N)
+fi
+
 if [ -n "${KERNEL}" ]; then
 	CMD+=(-k "${KERNEL}")
 fi