Merge changes Ifec1533f,I66267892,I45ab976c into main

* changes:
  Test PSCI MEM_PROTECT
  Add Event class for KvmHypTracer
  Generalize KvmHypTracer
diff --git a/apex/Android.bp b/apex/Android.bp
index 17b1f9e..da17040 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -36,6 +36,7 @@
     name: "avf_microdroid_guest_gki_version",
     values: [
         "android14_61_pkvm_experimental",
+        "android15_66",
     ],
 }
 
@@ -175,6 +176,14 @@
                     "microdroid_gki-android14-6.1-pkvm_experimental.json",
                 ],
             },
+            android15_66: {
+                prebuilts: [
+                    "microdroid_gki-android15-6.6_initrd_debuggable",
+                    "microdroid_gki-android15-6.6_initrd_normal",
+                    "microdroid_gki-android15-6.6_kernel",
+                    "microdroid_gki-android15-6.6.json",
+                ],
+            },
         },
         release_avf_enable_device_assignment: {
             prebuilts: [
diff --git a/apex/sign_virt_apex.py b/apex/sign_virt_apex.py
index 55fe6d2..1a59894 100644
--- a/apex/sign_virt_apex.py
+++ b/apex/sign_virt_apex.py
@@ -498,7 +498,7 @@
     RunCommand(args, cmd)
 
 
-gki_versions = ['android14-6.1-pkvm_experimental']
+gki_versions = ['android14-6.1-pkvm_experimental', 'android15-6.6']
 
 # dict of (key, file) for re-sign/verification. keys are un-versioned for readability.
 virt_apex_non_gki_files = {
diff --git a/apex/virtualizationservice.xml b/apex/virtualizationservice.xml
index 60f466f..97f6b3c 100644
--- a/apex/virtualizationservice.xml
+++ b/apex/virtualizationservice.xml
@@ -1,5 +1,5 @@
 <manifest version="1.0" type="framework">
-    <hal format="aidl">
+    <hal format="aidl" min-level="202404">
         <name>android.hardware.security.keymint</name>
         <version>3</version>
         <fqname>IRemotelyProvisionedComponent/avf</fqname>
diff --git a/docs/custom_vm.md b/docs/custom_vm.md
index fce6da2..d99452c 100644
--- a/docs/custom_vm.md
+++ b/docs/custom_vm.md
@@ -252,12 +252,15 @@
 ```
 
 To see console logs only, check
-`/data/data/com.android.virtualization.vmlauncher/files/console.log`
-Or
-`/data/data/com.google.android.virtualization.vmlauncher/files/console.log`
+`/data/data/com{,.google}.android.virtualization.vmlauncher/files/console.log`
+
+For HSUM enabled devices,
+`/data/user/${current_user_id}/com{,.google}.android.virtualization.vmlauncher/files/console.log`
+
+You can monitor console out as follows
 
 ```shell
-$ adb shell su root tail +0 -F /data/data/com{,.google}.android.virtualization.vmlauncher/files/console.log
+$ adb shell 'su root tail +0 -F /data/user/$(am get-current-user)/com{,.google}.android.virtualization.vmlauncher/files/console.log'
 ```
 
 For ChromiumOS, you can ssh-in. Use following commands after network setup.
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index c6d6090..d4158d4 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -646,6 +646,74 @@
     src: ":microdroid_gki-android14-6.1-pkvm_experimental_initrd_debuggable",
 }
 
+///////////////////////////////////////
+// GKI-android15-6.6
+///////////////////////////////////////
+prebuilt_etc {
+    name: "microdroid_gki-android15-6.6.json",
+    src: "microdroid_gki-android15-6.6.json",
+}
+
+avb_add_hash_footer {
+    name: "microdroid_gki-android15-6.6_kernel_signed",
+    defaults: ["microdroid_kernel_signed_defaults"],
+    filename: "microdroid_gki-android15-6.6_kernel_signed",
+    arch: {
+        arm64: {
+            src: ":microdroid_gki_kernel_prebuilts-android15-6.6-arm64",
+        },
+        x86_64: {
+            src: ":microdroid_gki_kernel_prebuilts-android15-6.6-x86_64",
+        },
+    },
+    include_descriptors_from_images: [
+        ":microdroid_gki-android15-6.6_initrd_normal_hashdesc",
+        ":microdroid_gki-android15-6.6_initrd_debug_hashdesc",
+    ],
+}
+
+// HACK: use cc_genrule for arch-specific properties
+cc_genrule {
+    name: "microdroid_gki-android15-6.6_kernel_signed-lz4",
+    out: ["microdroid_gki-android15-6.6_kernel_signed-lz4"],
+    srcs: [":empty_file"],
+    arch: {
+        arm64: {
+            srcs: [":microdroid_gki-android15-6.6_kernel_signed"],
+            exclude_srcs: [":empty_file"],
+        },
+    },
+    tools: ["lz4"],
+    cmd: "$(location lz4) -9 $(in) $(out)",
+}
+
+prebuilt_etc {
+    name: "microdroid_gki-android15-6.6_kernel",
+    filename: "microdroid_gki-android15-6.6_kernel",
+    src: ":empty_file",
+    relative_install_path: "fs",
+    arch: {
+        arm64: {
+            src: ":microdroid_gki-android15-6.6_kernel_signed",
+        },
+        x86_64: {
+            src: ":microdroid_gki-android15-6.6_kernel_signed",
+        },
+    },
+}
+
+avb_gen_vbmeta_image {
+    name: "microdroid_gki-android15-6.6_initrd_normal_hashdesc",
+    defaults: ["microdroid_initrd_normal_defaults"],
+    src: ":microdroid_gki-android15-6.6_initrd_normal",
+}
+
+avb_gen_vbmeta_image {
+    name: "microdroid_gki-android15-6.6_initrd_debug_hashdesc",
+    defaults: ["microdroid_initrd_debug_defaults"],
+    src: ":microdroid_gki-android15-6.6_initrd_debuggable",
+}
+
 python_binary_host {
     name: "extract_microdroid_kernel_hashes",
     srcs: ["extract_microdroid_kernel_hashes.py"],
@@ -657,10 +725,16 @@
     srcs: [":microdroid_kernel"],
     arch: {
         arm64: {
-            srcs: [":microdroid_gki-android14-6.1-pkvm_experimental_kernel_signed"],
+            srcs: [
+                ":microdroid_gki-android14-6.1-pkvm_experimental_kernel_signed",
+                ":microdroid_gki-android15-6.6_kernel_signed",
+            ],
         },
         x86_64: {
-            srcs: [":microdroid_gki-android14-6.1-pkvm_experimental_kernel_signed"],
+            srcs: [
+                ":microdroid_gki-android14-6.1-pkvm_experimental_kernel_signed",
+                ":microdroid_gki-android15-6.6_kernel_signed",
+            ],
         },
     },
     out: ["lib.rs"],
diff --git a/microdroid/initrd/Android.bp b/microdroid/initrd/Android.bp
index 7246f04..9bb4657 100644
--- a/microdroid/initrd/Android.bp
+++ b/microdroid/initrd/Android.bp
@@ -52,6 +52,17 @@
 }
 
 genrule {
+    name: "microdroid_gki-android15-6.6_initrd_gen_arm64",
+    srcs: [
+        ":microdroid_ramdisk",
+        ":microdroid_first_stage_ramdisk",
+        ":microdroid_gki_modules-android15-6.6-arm64",
+    ],
+    out: ["microdroid_initrd.img"],
+    cmd: "cat $(in) > $(out)",
+}
+
+genrule {
     name: "microdroid_gki-android14-6.1-pkvm_experimental_initrd_gen_x86_64",
     srcs: [
         ":microdroid_ramdisk",
@@ -62,6 +73,17 @@
     cmd: "cat $(in) > $(out)",
 }
 
+genrule {
+    name: "microdroid_gki-android15-6.6_initrd_gen_x86_64",
+    srcs: [
+        ":microdroid_ramdisk",
+        ":microdroid_first_stage_ramdisk",
+        ":microdroid_gki_modules-android15-6.6-x86_64",
+    ],
+    out: ["microdroid_initrd.img"],
+    cmd: "cat $(in) > $(out)",
+}
+
 // This contains vbmeta hashes & related (boot)configs which are passed to kernel/init
 genrule {
     name: "microdroid_vbmeta_bootconfig_gen",
@@ -107,6 +129,17 @@
 }
 
 genrule {
+    name: "microdroid_gki-android15-6.6_initrd_debuggable_arm64",
+    tools: ["initrd_bootconfig"],
+    srcs: [
+        ":microdroid_gki-android15-6.6_initrd_gen_arm64",
+        ":microdroid_bootconfig_debuggable_src",
+    ] + bootconfigs_arm64,
+    out: ["microdroid_gki-android15-6.6_initrd_debuggable_arm64"],
+    cmd: "$(location initrd_bootconfig) attach --output $(out) $(in)",
+}
+
+genrule {
     name: "microdroid_initrd_debuggable_x86_64",
     tools: ["initrd_bootconfig"],
     srcs: [
@@ -129,6 +162,17 @@
 }
 
 genrule {
+    name: "microdroid_gki-android15-6.6_initrd_debuggable_x86_64",
+    tools: ["initrd_bootconfig"],
+    srcs: [
+        ":microdroid_gki-android15-6.6_initrd_gen_x86_64",
+        ":microdroid_bootconfig_debuggable_src",
+    ] + bootconfigs_x86_64,
+    out: ["microdroid_gki-android15-6.6_initrd_debuggable_x86_64"],
+    cmd: "$(location initrd_bootconfig) attach --output $(out) $(in)",
+}
+
+genrule {
     name: "microdroid_initrd_normal_arm64",
     tools: ["initrd_bootconfig"],
     srcs: [
@@ -151,6 +195,17 @@
 }
 
 genrule {
+    name: "microdroid_gki-android15-6.6_initrd_normal_arm64",
+    tools: ["initrd_bootconfig"],
+    srcs: [
+        ":microdroid_gki-android15-6.6_initrd_gen_arm64",
+        ":microdroid_bootconfig_normal_src",
+    ] + bootconfigs_arm64,
+    out: ["microdroid_gki-android15-6.6_initrd_normal_arm64"],
+    cmd: "$(location initrd_bootconfig) attach --output $(out) $(in)",
+}
+
+genrule {
     name: "microdroid_initrd_normal_x86_64",
     tools: ["initrd_bootconfig"],
     srcs: [
@@ -172,6 +227,17 @@
     cmd: "$(location initrd_bootconfig) attach --output $(out) $(in)",
 }
 
+genrule {
+    name: "microdroid_gki-android15-6.6_initrd_normal_x86_64",
+    tools: ["initrd_bootconfig"],
+    srcs: [
+        ":microdroid_gki-android15-6.6_initrd_gen_x86_64",
+        ":microdroid_bootconfig_normal_src",
+    ] + bootconfigs_x86_64,
+    out: ["microdroid_gki-android15-6.6_initrd_normal_x86_64"],
+    cmd: "$(location initrd_bootconfig) attach --output $(out) $(in)",
+}
+
 prebuilt_etc {
     name: "microdroid_initrd_debuggable",
     // We don't have ramdisk for architectures other than x86_64 & arm64
@@ -203,6 +269,21 @@
 }
 
 prebuilt_etc {
+    name: "microdroid_gki-android15-6.6_initrd_debuggable",
+    // We don't have ramdisk for architectures other than x86_64 & arm64
+    src: ":empty_file",
+    arch: {
+        arm64: {
+            src: ":microdroid_gki-android15-6.6_initrd_debuggable_arm64",
+        },
+        x86_64: {
+            src: ":microdroid_gki-android15-6.6_initrd_debuggable_x86_64",
+        },
+    },
+    filename: "microdroid_gki-android15-6.6_initrd_debuggable.img",
+}
+
+prebuilt_etc {
     name: "microdroid_initrd_normal",
     // We don't have ramdisk for architectures other than x86_64 & arm64
     src: ":empty_file",
@@ -231,3 +312,18 @@
     },
     filename: "microdroid_gki-android14-6.1-pkvm_experimental_initrd_normal.img",
 }
+
+prebuilt_etc {
+    name: "microdroid_gki-android15-6.6_initrd_normal",
+    // We don't have ramdisk for architectures other than x86_64 & arm64
+    src: ":empty_file",
+    arch: {
+        arm64: {
+            src: ":microdroid_gki-android15-6.6_initrd_normal_arm64",
+        },
+        x86_64: {
+            src: ":microdroid_gki-android15-6.6_initrd_normal_x86_64",
+        },
+    },
+    filename: "microdroid_gki-android15-6.6_initrd_normal.img",
+}
diff --git a/microdroid/microdroid_gki-android15-6.6.json b/microdroid/microdroid_gki-android15-6.6.json
new file mode 100644
index 0000000..f7f6d47
--- /dev/null
+++ b/microdroid/microdroid_gki-android15-6.6.json
@@ -0,0 +1,20 @@
+{
+  "kernel": "/apex/com.android.virt/etc/fs/microdroid_gki-android15-6.6_kernel",
+  "disks": [
+    {
+      "partitions": [
+        {
+          "label": "vbmeta_a",
+          "path": "/apex/com.android.virt/etc/fs/microdroid_vbmeta.img"
+        },
+        {
+          "label": "super",
+          "path": "/apex/com.android.virt/etc/fs/microdroid_super.img"
+        }
+      ],
+      "writable": false
+    }
+  ],
+  "memory_mib": 256,
+  "platform_version": "~1.0"
+}
diff --git a/tests/ferrochrome/assets/vm_config.json b/tests/ferrochrome/assets/vm_config.json
index 1d32463..358df95 100644
--- a/tests/ferrochrome/assets/vm_config.json
+++ b/tests/ferrochrome/assets/vm_config.json
@@ -2,11 +2,15 @@
     "name": "cros",
     "disks": [
         {
-            "image": "/data/local/tmp/ferrochrome/chromiumos_test_image.bin",
+            "image": "/data/local/tmp/chromiumos_test_image.bin",
             "partitions": [],
             "writable": true
         }
     ],
+    "gpu": {
+        "backend": "virglrenderer",
+        "context_types": ["virgl2"]
+    },
     "params": "root=/dev/vda3 rootwait noinitrd ro enforcing=0 cros_debug cros_secure",
     "protected": false,
     "cpu_topology": "match_host",
@@ -14,4 +18,3 @@
     "memory_mib" : 8096,
     "console_input_device": "ttyS0"
 }
-
diff --git a/tests/ferrochrome/ferrochrome.sh b/tests/ferrochrome/ferrochrome.sh
index d72e882..6814ac5 100755
--- a/tests/ferrochrome/ferrochrome.sh
+++ b/tests/ferrochrome/ferrochrome.sh
@@ -135,7 +135,12 @@
 echo "Starting ferrochrome"
 adb shell am start-activity -a ${ACTION_NAME} > /dev/null
 
-log_path="/data/data/${pkg_name}/files/console.log"
+if [[ $(adb shell getprop ro.fw.mu.headless_system_user) == "true" ]]; then
+  current_user=$(adb shell am get-current-user)
+  log_path="/data/user/${current_user}/${pkg_name}/files/console.log"
+else
+  log_path="/data/data/${pkg_name}/files/console.log"
+fi
 fecr_start_time=${EPOCHSECONDS}
 
 while [[ $((EPOCHSECONDS - fecr_start_time)) -lt ${FECR_BOOT_TIMEOUT} ]]; do
diff --git a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
index 026cf3f..aee118c 100644
--- a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
+++ b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
@@ -16,6 +16,8 @@
 package com.android.microdroid.test.device;
 
 import static android.content.pm.PackageManager.FEATURE_VIRTUALIZATION_FRAMEWORK;
+import static android.content.pm.PackageManager.FEATURE_WATCH;
+import static android.content.pm.PackageManager.FEATURE_AUTOMOTIVE;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.TruthJUnit.assume;
@@ -69,7 +71,7 @@
     protected static final String KERNEL_VERSION = SystemProperties.get("ro.kernel.version");
     protected static final Set<String> SUPPORTED_GKI_VERSIONS =
             Collections.unmodifiableSet(
-                    new HashSet(Arrays.asList("android14-6.1-pkvm_experimental")));
+                    new HashSet(Arrays.asList("android14-6.1-pkvm_experimental", "android15-6.6")));
 
     public static boolean isCuttlefish() {
         return getDeviceProperties().isCuttlefish();
@@ -222,6 +224,14 @@
                 .isFalse();
     }
 
+    protected void assumeVsrCompliant() {
+        boolean featureCheck = mCtx.getPackageManager().hasSystemFeature(FEATURE_WATCH) ||
+                               mCtx.getPackageManager().hasSystemFeature(FEATURE_AUTOMOTIVE);
+        assume().withMessage("This device is not VSR compliant")
+                .that(featureCheck)
+                .isFalse();
+    }
+
     protected boolean isGsi() {
         return new File("/system/system_ext/etc/init/init.gsi.rc").exists();
     }
diff --git a/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java b/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java
index 1fc0f92..432f5e6 100644
--- a/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java
+++ b/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java
@@ -72,7 +72,7 @@
 
     protected static final Set<String> SUPPORTED_GKI_VERSIONS =
             Collections.unmodifiableSet(
-                    new HashSet(Arrays.asList("android14-6.1-pkvm_experimental")));
+                    new HashSet(Arrays.asList("android14-6.1-pkvm_experimental", "android15-6.6")));
 
     /* Keep this sync with AssignableDevice.aidl */
     public static final class AssignableDevice {
@@ -284,6 +284,6 @@
     }
 
     protected boolean isPkvmHypervisor() throws DeviceNotAvailableException {
-        return getDevice().getProperty("ro.boot.hypervisor.version").equals("kvm.arm-protected");
+        return "kvm.arm-protected".equals(getDevice().getProperty("ro.boot.hypervisor.version"));
     }
 }
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java
index 3b755a0..08bc310 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java
@@ -63,6 +63,7 @@
     @Test
     @VsrTest(requirements = "VSR-7.1-001.005")
     public void avfIsRequired() {
+        assumeVsrCompliant();
         assume().withMessage("Requirement doesn't apply due to vendor API level")
                 .that(getVendorApiLevel())
                 .isAtLeast(202404);
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index c94f171..fd67659 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -2288,6 +2288,7 @@
     @Test
     @VsrTest(requirements = {"VSR-7.1-001.003"})
     public void kernelVersionRequirement() throws Exception {
+        assumeVsrCompliant();
         int firstApiLevel = SystemProperties.getInt("ro.product.first_api_level", 0);
         assume().withMessage("Skip on devices launched before Android 14 (API level 34)")
                 .that(firstApiLevel)