diff --git a/Makefile b/Makefile
index 0d05b19..f9895ad 100644
--- a/Makefile
+++ b/Makefile
@@ -56,7 +56,7 @@
 ifdef KERNEL_IMAGE
 CUSTOM_KERNEL_IMAGE = 1
 else
-KERNEL_IMAGE := $(LINUX_OUT)/arch/arm64/boot/Image.gz
+KERNEL_IMAGE := $(LINUX_OUT)/arch/arm64/boot/Image
 endif
 
 ##
@@ -296,6 +296,7 @@
 	O=$(UBOOT_OUT)
 
 UBOOT_CONFIG := $(UBOOT_OUT)/.config
+UBOOT_BIN := $(UBOOT_OUT)/u-boot.bin
 
 .PHONY: u-boot_defconfig
 u-boot_defconfig $(UBOOT_CONFIG):
@@ -306,7 +307,7 @@
 	+ $(UBOOT_MAKE) menuconfig
 
 .PHONY: u-boot
-u-boot: $(UBOOT_CONFIG)
+u-boot $(UBOOT_BIN): $(UBOOT_CONFIG)
 	+ $(UBOOT_MAKE)
 
 .PHONY: u-boot_clean
@@ -406,6 +407,7 @@
 define gen_crosvm_helloworld_test
 	$(KUT_RUN_TEST) -d $(1) $(2) -t 300s \
 		-k $(KERNEL_IMAGE) \
+		-F $(UBOOT_BIN) \
 		-o $(CROSVM_HELLOWORLD_LOG_DIR)/$(1).log \
 		$(CROSVM_HELLOWORLD_SCRIPT_DIR)/host.sh -- \
 		-R $(CROSVM_HELLOWORLD_SCRIPT_DIR)/guest.sh \
@@ -425,13 +427,13 @@
 	@ for x in $(CROSVM_HELLOWORLD_TESTS); do echo $x; done
 
 .PHONY: test-crosvm-vhe-helloworld
-test-crosvm-vhe-helloworld: $(KERNEL_IMAGE)
+test-crosvm-vhe-helloworld: $(KERNEL_IMAGE) $(UBOOT_BIN)
 	@ $(call gen_crosvm_helloworld_test,$@,-V)
 
 .PHONY: test-crosvm-nvhe-helloworld
-test-crosvm-nvhe-helloworld: $(KERNEL_IMAGE)
+test-crosvm-nvhe-helloworld: $(KERNEL_IMAGE) $(UBOOT_BIN)
 	@ $(call gen_crosvm_helloworld_test,$@,-N)
 
 .PHONY: test-crosvm-pkvm-helloworld
-test-crosvm-pkvm-helloworld: $(KERNEL_IMAGE)
+test-crosvm-pkvm-helloworld: $(KERNEL_IMAGE) $(UBOOT_BIN)
 	@ $(call gen_crosvm_helloworld_test,$@,)
diff --git a/aarch64/run_qemu.sh b/aarch64/run_qemu.sh
index b02310b..ceb499b 100755
--- a/aarch64/run_qemu.sh
+++ b/aarch64/run_qemu.sh
@@ -20,7 +20,7 @@
 default_var ROM_DIR		"${PREBUILTS_QEMU_ROM_DIR}"
 default_var KERNEL		"${LINUX_OUT_IMAGE}"
 default_var ROOTFS		"${PREBUILTS_KUT_ROOTFS}"
-default_var TEMPLATE		""
+default_var FIRMWARE		""
 default_var CPU			"max"
 default_var SMP			4
 default_var RAM			512
@@ -39,7 +39,7 @@
 	cat <<EOF
 
 Usage: $0 [-h] [-v] [-K]
-       [-e QEMU] [-L ROM_DIR] [-k KERNEL] [-r ROOTFS] [-R DRIVE] [-T TEMPLATE]
+       [-e QEMU] [-L ROM_DIR] [-k KERNEL] [-r ROOTFS] [-R DRIVE] [-F FIRMWARE]
        [-c CPU] [-s NUM_CPUS] [-m MEM] [-g GIC] [-G] [-N]
        [-t TIMEOUT]
 
@@ -50,7 +50,7 @@
     -k    kernel image
     -r    root filesystem image
     -R    additional drive image(s) to mount as read-only
-    -T    VM template image
+    -F    VM firmware image
     -c    CPU model (defaults to "${DEFAULT_CPU}")
     -s    number of CPU cores (defaults to ${DEFAULT_SMP})
     -m    amount of memory in MB (defaults to ${DEFAULT_RAM})
@@ -83,7 +83,11 @@
 	printf '0x%x\n' $1
 }
 
-function template_overlay() {
+# On a real system, the firmware, not the kernel, would live in a separate
+# memory slot, described in the DT as "pkvm_guest_firmware" and
+# compatible = "linux,pkvm-guest-firmware-memory". Here, as a temporary
+# solution for testing on QEMU, we put the kernel in such memory slot.
+function kernel_payload_overlay() {
 	local in="$1"
 	local out="$2"
 	local tmp="$3"
@@ -93,10 +97,10 @@
 	# Convert input DTB back to source.
 	dtc -I dtb -O dts -o "${tmp}" "${in}"
 
-	# Append an overlay describing the template.
+	# Append an overlay describing the kernel payload.
 	cat <<EOF >> "${tmp}"
 &{/} {
-	pkvm_template@${addr} {
+	pkvm_kernel_payload@${addr} {
 		compatible = "pkvm,arm64";
 		#address-cells = <2>;
 		#size-cells = <1>;
@@ -113,14 +117,14 @@
 APPEND=()
 EXTRA_RO_MOUNTS=()
 
-while getopts ":e:L:k:r:R:T:c:s:m:g:t:vGNKh" OPT; do
+while getopts ":e:L:k:r:R:F:c:s:m:g:t:vGNKh" OPT; do
 	case "${OPT}" in
 	e)	QEMU="${OPTARG}"		;;
 	L)	ROM_DIR="${OPTARG}"		;;
 	k)	KERNEL="${OPTARG}"		;;
 	r)	ROOTFS="${OPTARG}"		;;
 	R)	EXTRA_RO_MOUNTS+=("${OPTARG}")	;;
-	T)	TEMPLATE="${OPTARG}"		;;
+	F)	FIRMWARE="${OPTARG}"		;;
 	c)	CPU="${OPTARG}"			;;
 	s)	SMP="${OPTARG}"			;;
 	m)	RAM="${OPTARG}"			;;
@@ -161,6 +165,11 @@
 	CMD+=(timeout -k 1s --foreground "${TIMEOUT}")
 fi
 
+CMD_KERNEL=${KERNEL}
+if [ -n "${FIRMWARE}" ]; then
+	CMD_KERNEL=${FIRMWARE}
+fi
+
 CMD+=("${QEMU}")
 CMD+=(-M virt)
 CMD+=(-machine virtualization=true -machine virt,gic-version=${GIC})
@@ -168,7 +177,7 @@
 CMD+=(-smp "${SMP}")
 CMD+=(-m "${RAM}")
 CMD+=(-L "${ROM_DIR}")
-CMD+=(-kernel "${KERNEL}")
+CMD+=(-kernel "${CMD_KERNEL}")
 CMD+=(-drive file="${ROOTFS}",readonly,if=virtio,format=raw)
 CMD+=(-object rng-random,filename=/dev/urandom,id=rng0)
 CMD+=(-device virtio-rng-pci,rng=rng0)
@@ -193,7 +202,7 @@
 
 CMD+=(-append "${APPEND[*]}")
 
-if [ -n "${TEMPLATE}" ]; then
+if [ -n "${FIRMWARE}" ]; then
 	QEMU_DTB="$(mktemp)"
 	QEMU_PATCHED_DTB="$(mktemp)"
 	TMP_DTS="$(mktemp)"
@@ -205,23 +214,24 @@
 	"${CMD[@]}" -machine dumpdtb="${QEMU_DTB}" > /dev/null
 
 	# Compile the overlayed DTB with dummy values to determine its size.
-	template_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" 0x0 0x0
+	kernel_payload_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" 0x0 0x0
 	TMP_DTB_SIZE=$(file_size "${QEMU_PATCHED_DTB}")
 
 	# From QEMU's hw/arm/boot.c:
 	# RAM always starts at 1GiB PA offset. The kernel is placed there.
 	# 128MiB (or RAM/2 if RAM<256MiB) is left to the kernel to decompress.
 	# This is followed by the ramdisk and then 2MiB-aligned DTB.
-	# We place the template at the following page (assume 64KiB page size).
-	TEMPLATE_ADDR=$(( 1*GiB + 128*MiB + TMP_DTB_SIZE ))
-	TEMPLATE_ADDR=$(hex $(align_up_pow2 $TEMPLATE_ADDR 64*KiB))
-	TEMPLATE_SIZE=$(hex $(file_size "${TEMPLATE}"))
+	# In our case, for testing, `-kernel` is the firmware, and we place the
+	# actual kernel Image at the following page (assume 64KiB page size).
+	KERNEL_PAYLOAD_ADDR=$(( 1*GiB + 128*MiB + TMP_DTB_SIZE ))
+	KERNEL_PAYLOAD_ADDR=$(hex $(align_up_pow2 $KERNEL_PAYLOAD_ADDR 64*KiB))
+	KERNEL_SIZE=$(hex $(file_size "${KERNEL}"))
 
-	template_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" \
-			 "${TEMPLATE_ADDR}" "${TEMPLATE_SIZE}"
+	kernel_payload_overlay "${QEMU_DTB}" "${QEMU_PATCHED_DTB}" "${TMP_DTS}" \
+			 "${KERNEL_PAYLOAD_ADDR}" "${KERNEL_SIZE}"
 
 	CMD+=(-dtb "${QEMU_PATCHED_DTB}")
-	CMD+=(-device loader,file="${TEMPLATE}",addr=${TEMPLATE_ADDR},force-raw=true)
+	CMD+=(-device loader,file="${KERNEL}",addr=${KERNEL_PAYLOAD_ADDR},force-raw=true)
 fi
 
 if [ "${VERBOSE}" -eq 1 ]; then
diff --git a/kvm-unit-tests/run_test.sh b/kvm-unit-tests/run_test.sh
index 1e224f1..0cff0eb 100755
--- a/kvm-unit-tests/run_test.sh
+++ b/kvm-unit-tests/run_test.sh
@@ -22,6 +22,7 @@
 default_var GDB			0
 default_var KVM_PROTECTED	1
 default_var KERNEL		""
+default_var FIRMWARE		""
 default_var TEST_PATH		""
 default_var DISPLAY_NAME	""
 default_var OUTPUT		""
@@ -39,7 +40,7 @@
 	cat <<EOF
 
 Usage: $0 [-h] [-v] [-q] [-G] [-V]
-       [-k KERNEL] [-d DISPLAY_NAME] [-o OUTPUT] [-t TIMEOUT]
+       [-k KERNEL] [-F firmware] [-d DISPLAY_NAME] [-o OUTPUT] [-t TIMEOUT]
        PATH [-- RUN_QEMU_ARGS]
 
     PATH  Path to test binary. Basenames are resolved in the default output folder.
@@ -47,6 +48,7 @@
     -v    Print invoked command
     -q    Print only the result of the test
     -k    Kernel image
+    -F    Firmware
     -d    Override test name displayed in result
     -o    Redirect stdout/stderr output to given file (implies -q)
     -t    kill test after given number of seconds
@@ -56,9 +58,10 @@
 EOF
 }
 
-while getopts ":k:d:o:t:vVNGqh" OPT; do
+while getopts ":k:F:d:o:t:vVNGqh" OPT; do
 	case "${OPT}" in
 	k)	KERNEL="${OPTARG}"		;;
+	F)	FIRMWARE="${OPTARG}"		;;
 	d)	DISPLAY_NAME="${OPTARG}"	;;
 	t)	TIMEOUT="${OPTARG}"		;;
 	v)	VERBOSE=1			;;
@@ -123,6 +126,10 @@
 	CMD+=(-k "${KERNEL}")
 fi
 
+if [ -n "${FIRMWARE}" ]; then
+	CMD+=(-F "${FIRMWARE}")
+fi
+
 if [ "${GDB}" -eq 1 ]; then
 	CMD+=(-G)
 	# Disable timeout unless overridden by user.