diff --git a/Makefile b/Makefile
index 47ff4cb..58978c5 100644
--- a/Makefile
+++ b/Makefile
@@ -428,12 +428,12 @@
 
 .PHONY: test-crosvm-vhe-helloworld
 test-crosvm-vhe-helloworld: $(KERNEL_IMAGE) $(UBOOT_BIN)
-	@ $(call gen_crosvm_helloworld_test,$@,-V)
+	@ $(call gen_crosvm_helloworld_test,$@,-M vhe)
 
 .PHONY: test-crosvm-nvhe-helloworld
 test-crosvm-nvhe-helloworld: $(KERNEL_IMAGE) $(UBOOT_BIN)
-	@ $(call gen_crosvm_helloworld_test,$@,-N)
+	@ $(call gen_crosvm_helloworld_test,$@,-M nvhe)
 
 .PHONY: test-crosvm-pkvm-helloworld
 test-crosvm-pkvm-helloworld: $(KERNEL_IMAGE) $(UBOOT_BIN)
-	@ $(call gen_crosvm_helloworld_test,$@,)
+	@ $(call gen_crosvm_helloworld_test,$@,-M pkvm)
diff --git a/aarch64/run_qemu.sh b/aarch64/run_qemu.sh
index bce5d54..c886231 100755
--- a/aarch64/run_qemu.sh
+++ b/aarch64/run_qemu.sh
@@ -21,16 +21,21 @@
 default_var KERNEL		"${LINUX_OUT_IMAGE}"
 default_var ROOTFS		"${PREBUILTS_KUT_ROOTFS}"
 default_var FIRMWARE		""
-default_var CPU			"max"
+default_var CPU			""
 default_var SMP			4
 default_var RAM			512
 default_var GIC			3
 default_var GDB			0
-default_var KVM_PROTECTED	1
+default_var MODE		"pkvm"
+default_var MODE_CPU		""
 default_var VERBOSE		0
 default_var KEEP_TEMP		0
 default_var TIMEOUT		""
 
+# QEMU CPUs to use for VHE and nVHE runs
+CPU_VHE="max"
+CPU_NVHE="cortex-a53"
+
 KiB=1024
 MiB=$((1024 * KiB))
 GiB=$((1024 * MiB))
@@ -40,7 +45,7 @@
 
 Usage: $0 [-h] [-v] [-K]
        [-e QEMU] [-L ROM_DIR] [-k KERNEL] [-r ROOTFS] [-R DRIVE] [-F FIRMWARE]
-       [-c CPU] [-s NUM_CPUS] [-m MEM] [-g GIC] [-G] [-N]
+       [-c CPU] [-s NUM_CPUS] [-m MEM] [-g GIC] [-m KVM_MODE] [-G]
        [-t TIMEOUT]
 
     -h    output this help text
@@ -55,8 +60,8 @@
     -s    number of CPU cores (defaults to ${DEFAULT_SMP})
     -m    amount of memory in MB (defaults to ${DEFAULT_RAM})
     -g    version of GIC (defaults to ${DEFAULT_GIC})
+    -m    KVM mode (defaults to 'pkvm', other: 'vhe', 'nvhe')
     -G    enable debugging of emulated system with GDB
-    -N    disable protected KVM configuration
     -t    kill QEMU after given number of seconds
     -K    keep temp files
 EOF
@@ -117,7 +122,7 @@
 APPEND=()
 EXTRA_RO_MOUNTS=()
 
-while getopts ":e:L:k:r:R:F:c:s:m:g:t:vGNKh" OPT; do
+while getopts ":e:L:k:r:R:F:c:s:m:g:t:M:vGKh" OPT; do
 	case "${OPT}" in
 	e)	QEMU="${OPTARG}"		;;
 	L)	ROM_DIR="${OPTARG}"		;;
@@ -130,9 +135,9 @@
 	m)	RAM="${OPTARG}"			;;
 	g)	GIC="${OPTARG}"			;;
 	t)	TIMEOUT="${OPTARG}"		;;
+	M)	MODE="${OPTARG}"		;;
 	v)	VERBOSE=1			;;
 	G)	GDB=1				;;
-	N)	KVM_PROTECTED=0			;;
 	K)	KEEP_TEMP=1			;;
 	h)
 		usage
@@ -170,6 +175,22 @@
 	CMD_KERNEL=${FIRMWARE}
 fi
 
+case "${MODE}" in
+	vhe)	MODE_CPU="${CPU_VHE}";;
+	nvhe)	MODE_CPU="${CPU_NVHE}";;
+	pkvm)	APPEND+=(kvm-arm.mode=protected)
+		MODE_CPU="${CPU_NVHE}"
+		;;
+	*)	echo "Unknown KVM mode: ${MODE}" 1>&2
+		exit 1
+		;;
+esac
+
+# If not set by the user, use the default CPU model for the given mode.
+if [ -z "${CPU}" -a -n "${MODE_CPU}" ]; then
+	CPU="${MODE_CPU}"
+fi
+
 CMD+=("${QEMU}")
 CMD+=(-M virt)
 CMD+=(-machine virtualization=true -machine virt,gic-version=${GIC})
@@ -196,10 +217,6 @@
 	APPEND+=(nokaslr)
 fi
 
-if [ "${KVM_PROTECTED}" -eq 1 ]; then
-	APPEND+=(kvm-arm.mode=protected)
-fi
-
 CMD+=(-append "${APPEND[*]}")
 
 if [ -n "${FIRMWARE}" ]; then
diff --git a/kvm-unit-tests/gen_makefile.sh b/kvm-unit-tests/gen_makefile.sh
index 2318aad..d589e4d 100755
--- a/kvm-unit-tests/gen_makefile.sh
+++ b/kvm-unit-tests/gen_makefile.sh
@@ -86,13 +86,7 @@
 	local mode="$3"
 	local gdb="$4"
 
-	local extra_args=()
-	if [ "${mode}" == "vhe" ]; then
-		extra_args+=(-V)
-	fi
-	if [ "${mode}" != "pkvm" ]; then
-		extra_args+=(-N)
-	fi
+	local extra_args=(-M "${mode}")
 	if [ "${gdb}" -eq 1 ]; then
 		extra_args+=(-G)
 	fi
diff --git a/kvm-unit-tests/run_test.sh b/kvm-unit-tests/run_test.sh
index 0cff0eb..a0c6228 100755
--- a/kvm-unit-tests/run_test.sh
+++ b/kvm-unit-tests/run_test.sh
@@ -20,7 +20,7 @@
 default_var VERBOSE		0
 default_var QUIET		0
 default_var GDB			0
-default_var KVM_PROTECTED	1
+default_var KVM_MODE		""
 default_var KERNEL		""
 default_var FIRMWARE		""
 default_var TEST_PATH		""
@@ -30,17 +30,14 @@
 
 DEFAULT_TIMEOUT=180s
 
-# QEMU CPUs to use for VHE and nVHE runs
-CPU_VHE="max"
-CPU_NVHE="cortex-a53"
-
 RESULT_ALIGN=40
 
 function usage() {
 	cat <<EOF
 
-Usage: $0 [-h] [-v] [-q] [-G] [-V]
+Usage: $0 [-h] [-v] [-q] [-G]
        [-k KERNEL] [-F firmware] [-d DISPLAY_NAME] [-o OUTPUT] [-t TIMEOUT]
+       [-M KVM_MODE]
        PATH [-- RUN_QEMU_ARGS]
 
     PATH  Path to test binary. Basenames are resolved in the default output folder.
@@ -52,21 +49,19 @@
     -d    Override test name displayed in result
     -o    Redirect stdout/stderr output to given file (implies -q)
     -t    kill test after given number of seconds
-    -V    Enable VHE configuration
-    -N    Disable protected KVM configuration
+    -M    Select KVM mode
     -G    Enable debugging of emulated system with GDB
 EOF
 }
 
-while getopts ":k:F:d:o:t:vVNGqh" OPT; do
+while getopts ":k:F:d:o:t:M:vGqh" OPT; do
 	case "${OPT}" in
 	k)	KERNEL="${OPTARG}"		;;
 	F)	FIRMWARE="${OPTARG}"		;;
 	d)	DISPLAY_NAME="${OPTARG}"	;;
 	t)	TIMEOUT="${OPTARG}"		;;
+	M)	MODE="${OPTARG}"		;;
 	v)	VERBOSE=1			;;
-	V)	VHE=1				;;
-	N)	KVM_PROTECTED=0			;;
 	q)	QUIET=1				;;
 	G)	GDB=1				;;
 	o)
@@ -112,14 +107,8 @@
 
 CMD=("${SCRIPT_RUN_QEMU}" -R "${TEST_PATH}")
 
-if [ "${VHE}" -eq 1 ]; then
-	CMD+=(-c "${CPU_VHE}")
-else
-	CMD+=(-c "${CPU_NVHE}")
-fi
-
-if [ "${KVM_PROTECTED}" -ne 1 ]; then
-	CMD+=(-N)
+if [ -n "${MODE}" ]; then
+	CMD+=(-M "${MODE}")
 fi
 
 if [ -n "${KERNEL}" ]; then