diff --git a/build/debian/build.sh b/build/debian/build.sh
index 8c17514..3d3820a 100755
--- a/build/debian/build.sh
+++ b/build/debian/build.sh
@@ -61,6 +61,7 @@
         # just for testing
         echo libseccomp: $(curl -is https://deb.debian.org/debian/pool/main/libs/libseccomp/libseccomp2_2.5.4-1+deb12u1_arm64.deb | head -n 1)
         echo libsemanage-common: $(curl -is https://deb.debian.org/debian/pool/main/libs/libsemanage/libsemanage-common_3.4-1_all.deb | head -n 1)
+        echo libpcre2: $(curl -is https://deb.debian.org/debian/pool/main/p/pcre2/libpcre2-8-0_10.42-1_arm64.deb | head -n 1)
 }
 
 download_debian_cloud_image() {
diff --git a/build/debian/fai_config/hooks/extrbase.BASE b/build/debian/fai_config/hooks/extrbase.BASE
new file mode 100755
index 0000000..05d1e96
--- /dev/null
+++ b/build/debian/fai_config/hooks/extrbase.BASE
@@ -0,0 +1,6 @@
+#!/bin/sh
+set -euE
+
+touch "${LOGDIR}/skip.extrbase"
+
+debootstrap --verbose --variant minbase --arch "$DEBOOTSTRAP_ARCH" "$SUITE" "$FAI_ROOT" "$DEBOOTSTRAP_MIRROR"
diff --git a/tests/hostside/Android.bp b/tests/hostside/Android.bp
index 2eca2fa..d0838a6 100644
--- a/tests/hostside/Android.bp
+++ b/tests/hostside/Android.bp
@@ -16,7 +16,6 @@
     static_libs: [
         "MicrodroidHostTestHelper",
         "compatibility-host-util",
-        "cts-host-utils",
         "cts-statsd-atom-host-test-utils",
         "microdroid_payload_metadata",
     ],
diff --git a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
index 3a76328..2d55d66 100644
--- a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
+++ b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
@@ -32,12 +32,11 @@
 
 import static java.util.stream.Collectors.toList;
 
-import android.cts.host.utils.DeviceJUnit4ClassRunnerWithParameters;
-import android.cts.host.utils.DeviceJUnit4Parameterized;
 import android.cts.statsdatom.lib.ConfigUtils;
 import android.cts.statsdatom.lib.ReportUtils;
 
 import com.android.compatibility.common.util.CddTest;
+import com.android.compatibility.common.util.VsrTest;
 import com.android.microdroid.test.common.ProcessUtil;
 import com.android.microdroid.test.host.CommandRunner;
 import com.android.microdroid.test.host.MicrodroidHostTestCaseBase;
@@ -48,6 +47,7 @@
 import com.android.tradefed.device.ITestDevice;
 import com.android.tradefed.device.TestDevice;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner.TestMetrics;
+import com.android.tradefed.testtype.junit4.DeviceParameterizedRunner;
 import com.android.tradefed.util.CommandResult;
 import com.android.tradefed.util.CommandStatus;
 import com.android.tradefed.util.FileUtil;
@@ -55,6 +55,9 @@
 import com.android.tradefed.util.xml.AbstractXmlParser;
 import com.android.virt.PayloadMetadata;
 
+import junitparams.Parameters;
+import junitparams.naming.TestCaseName;
+
 import org.json.JSONArray;
 import org.json.JSONObject;
 import org.junit.After;
@@ -64,8 +67,6 @@
 import org.junit.Test;
 import org.junit.rules.TestName;
 import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.junit.runners.Parameterized.UseParametersRunnerFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.helpers.DefaultHandler;
 
@@ -75,8 +76,8 @@
 import java.io.PipedOutputStream;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -87,8 +88,7 @@
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
-@RunWith(DeviceJUnit4Parameterized.class)
-@UseParametersRunnerFactory(DeviceJUnit4ClassRunnerWithParameters.RunnerFactory.class)
+@RunWith(DeviceParameterizedRunner.class)
 public class MicrodroidHostTests extends MicrodroidHostTestCaseBase {
     private static final String APK_NAME = "MicrodroidTestApp.apk";
     private static final String APK_UPDATED_NAME = "MicrodroidTestAppUpdated.apk";
@@ -111,26 +111,38 @@
         }
     }
 
-    @Parameterized.Parameters(name = "protectedVm={0},gki={1}")
-    public static Collection<Object[]> params() {
-        List<Object[]> ret = new ArrayList<>();
-        ret.add(new Object[] {true /* protectedVm */, null /* use microdroid kernel */});
-        ret.add(new Object[] {false /* protectedVm */, null /* use microdroid kernel */});
+    // This map is needed because the parameterizer `DeviceParameterizedRunner` doesn't support "-"
+    // in test names. The key is the test name, while the value is the actual kernel version.
+    private static HashMap<String, String> sGkiVersions = new HashMap<>();
+
+    private static void initGkiVersions() {
+        if (!sGkiVersions.isEmpty()) {
+            return;
+        }
+        sGkiVersions.put("null", null); /* use microdroid kernel */
         // TODO(b/302465542): run only the latest GKI on presubmit to reduce running time
         for (String gki : SUPPORTED_GKI_VERSIONS) {
-            ret.add(new Object[] {true /* protectedVm */, gki});
-            ret.add(new Object[] {false /* protectedVm */, gki});
+            String key = gki.split("-")[0];
+            assertThat(sGkiVersions.containsKey(key)).isFalse();
+            sGkiVersions.put(key, gki);
+        }
+    }
+
+    public static List<Object[]> params() {
+        List<Object[]> ret = new ArrayList<>();
+        for (Object[] gki : gkiVersions()) {
+            ret.add(new Object[] {true /* protectedVm */, gki[0]});
+            ret.add(new Object[] {false /* protectedVm */, gki[0]});
         }
         return ret;
     }
 
-    @Parameterized.Parameter(0)
-    public boolean mProtectedVm;
-
-    @Parameterized.Parameter(1)
-    public String mGki;
-
-    private String mOs;
+    public static List<Object[]> gkiVersions() {
+        initGkiVersions();
+        return sGkiVersions.keySet().stream()
+                .map(gki -> new Object[] {gki})
+                .collect(Collectors.toList());
+    }
 
     @Rule public TestLogData mTestLogs = new TestLogData();
     @Rule public TestName mTestName = new TestName();
@@ -290,9 +302,11 @@
             File key,
             Map<String, File> keyOverrides,
             boolean isProtected,
-            boolean updateBootconfigs)
+            boolean updateBootconfigs,
+            String gki)
             throws Exception {
         CommandRunner android = new CommandRunner(getDevice());
+        gki = sGkiVersions.get(gki);
 
         File virtApexDir = FileUtil.createTempDir("virt_apex");
 
@@ -344,7 +358,8 @@
         //   - its idsig
 
         // Load etc/microdroid.json
-        File microdroidConfigFile = new File(virtApexEtcDir, mOs + ".json");
+        final String os = (gki == null) ? "microdroid" : "microdroid_gki-" + gki;
+        File microdroidConfigFile = new File(virtApexEtcDir, os + ".json");
         JSONObject config = new JSONObject(FileUtil.readStringFromFile(microdroidConfigFile));
 
         // Replace paths so that the config uses re-signed images from TEST_ROOT
@@ -360,7 +375,7 @@
         }
 
         // Add partitions to the second disk
-        final String initrdPath = TEST_ROOT + "etc/" + mOs + "_initrd_debuggable.img";
+        final String initrdPath = TEST_ROOT + "etc/" + os + "_initrd_debuggable.img";
         config.put("initrd", initrdPath);
         // Add instance image as a partition in disks[1]
         disks.put(
@@ -408,6 +423,9 @@
                         "--console " + CONSOLE_PATH,
                         "--log " + LOG_PATH,
                         configPath);
+        if (gki != null) {
+            args.add("--gki " + gki);
+        }
 
         PipedInputStream pis = new PipedInputStream();
         Process process = createRunUtil().runCmdInBackground(args, new PipedOutputStream(pis));
@@ -416,28 +434,34 @@
 
     @Test
     @CddTest
+    @VsrTest(requirements = {"VSR-7.1-001.008"})
     public void UpgradedPackageIsAcceptedWithSecretkeeper() throws Exception {
+        // Preconditions
+        assumeVmTypeSupported(true);
         assumeUpdatableVmSupported();
+
         getDevice().uninstallPackage(PACKAGE_NAME);
         getDevice().installPackage(findTestFile(APK_NAME), /* reinstall= */ true);
-        ensureMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG);
+        ensureProtectedMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG);
 
         getDevice().uninstallPackage(PACKAGE_NAME);
         cleanUpVirtualizationTestSetup(getDevice());
         // Install the updated version of app (versionCode 6)
         getDevice().installPackage(findTestFile(APK_UPDATED_NAME), /* reinstall= */ true);
-        ensureMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG);
+        ensureProtectedMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG);
     }
 
     @Test
     @CddTest
+    @VsrTest(requirements = {"VSR-7.1-001.008"})
     public void DowngradedPackageIsRejectedProtectedVm() throws Exception {
-        assumeProtectedVm(); // Rollback protection is provided only for protected VM.
+        // Preconditions: Rollback protection is provided only for protected VM.
+        assumeVmTypeSupported(true);
 
         // Install the upgraded version (v6)
         getDevice().uninstallPackage(PACKAGE_NAME);
         getDevice().installPackage(findTestFile(APK_UPDATED_NAME), /* reinstall= */ true);
-        ensureMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG);
+        ensureProtectedMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG);
 
         getDevice().uninstallPackage(PACKAGE_NAME);
         cleanUpVirtualizationTestSetup(getDevice());
@@ -447,11 +471,11 @@
         assertThrows(
                 "pVM must fail to boot with downgraded payload apk",
                 DeviceRuntimeException.class,
-                () -> ensureMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG));
+                () -> ensureProtectedMicrodroidBootsSuccessfully(INSTANCE_ID_FILE, INSTANCE_IMG));
     }
 
-    private void ensureMicrodroidBootsSuccessfully(String instanceIdPath, String instanceImgPath)
-            throws DeviceNotAvailableException {
+    private void ensureProtectedMicrodroidBootsSuccessfully(
+            String instanceIdPath, String instanceImgPath) throws DeviceNotAvailableException {
         final String configPath = "assets/vm_config.json";
         ITestDevice microdroid = null;
         int timeout = 30000; // 30 seconds
@@ -461,7 +485,7 @@
                             .debugLevel("full")
                             .memoryMib(minMemorySize())
                             .cpuTopology("match_host")
-                            .protectedVm(mProtectedVm)
+                            .protectedVm(true)
                             .instanceIdFile(instanceIdPath)
                             .instanceImgFile(instanceImgPath)
                             .setAdbConnectTimeoutMs(timeout)
@@ -476,10 +500,13 @@
     }
 
     @Test
+    @Parameters(method = "gkiVersions")
+    @TestCaseName("{method}_gki_{0}")
     @CddTest(requirements = {"9.17/C-2-1", "9.17/C-2-2", "9.17/C-2-6"})
-    public void protectedVmRunsPvmfw() throws Exception {
+    public void protectedVmRunsPvmfw(String gki) throws Exception {
         // Arrange
-        assumeProtectedVm();
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(true);
         final String configPath = "assets/vm_config_apex.json";
 
         // Act
@@ -489,7 +516,7 @@
                         .memoryMib(minMemorySize())
                         .cpuTopology("match_host")
                         .protectedVm(true)
-                        .gki(mGki)
+                        .gki(sGkiVersions.get(gki))
                         .name("protected_vm_runs_pvmfw")
                         .build(getAndroidDevice());
 
@@ -506,10 +533,13 @@
     }
 
     @Test
-    @CddTest(requirements = {"9.17/C-2-1", "9.17/C-2-2", "9.17/C-2-6"})
-    public void protectedVmWithImageSignedWithDifferentKeyFailsToVerifyPayload() throws Exception {
-        // Arrange
-        assumeProtectedVm();
+    @Parameters(method = "gkiVersions")
+    @TestCaseName("{method}_gki_{0}")
+    @CddTest(requirements = {"9.17/C-2-1", "9.17/C-2-2", "9.17/C-2-5", "9.17/C-2-6"})
+    public void protectedVmWithImageSignedWithDifferentKeyFailsToVerifyPayload(String gki)
+            throws Exception {
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(true);
         File key = findTestFile("test.com.android.virt.pem");
 
         // Act
@@ -518,7 +548,8 @@
                         key,
                         /* keyOverrides= */ Map.of(),
                         /* isProtected= */ true,
-                        /* updateBootconfigs= */ true);
+                        /* updateBootconfigs= */ true,
+                        gki);
 
         // Assert
         vmInfo.mProcess.waitFor(5L, TimeUnit.SECONDS);
@@ -531,15 +562,23 @@
     }
 
     @Test
+    @Parameters(method = "gkiVersions")
+    @TestCaseName("{method}_gki_{0}")
     @CddTest(requirements = {"9.17/C-2-2", "9.17/C-2-6"})
-    public void testBootSucceedsWhenNonProtectedVmStartsWithImagesSignedWithDifferentKey()
+    public void testBootSucceedsWhenNonProtectedVmStartsWithImagesSignedWithDifferentKey(String gki)
             throws Exception {
-        assumeNonProtectedVm();
+        // Preconditions
+        assumeKernelSupported(gki);
+
         File key = findTestFile("test.com.android.virt.pem");
         Map<String, File> keyOverrides = Map.of();
         VmInfo vmInfo =
                 runMicrodroidWithResignedImages(
-                        key, keyOverrides, /* isProtected= */ false, /* updateBootconfigs= */ true);
+                        key,
+                        keyOverrides,
+                        /* isProtected= */ false,
+                        /* updateBootconfigs= */ true,
+                        gki);
         assertThatEventually(
                 100000,
                 () ->
@@ -551,16 +590,23 @@
     }
 
     @Test
-    @CddTest(requirements = {"9.17/C-2-2", "9.17/C-2-6"})
-    public void testBootFailsWhenVbMetaDigestDoesNotMatchBootconfig() throws Exception {
+    @Parameters(method = "gkiVersions")
+    @TestCaseName("{method}_gki_{0}")
+    @CddTest(requirements = {"9.17/C-2-2", "9.17/C-2-5", "9.17/C-2-6"})
+    public void testBootFailsWhenVbMetaDigestDoesNotMatchBootconfig(String gki) throws Exception {
         // protectedVmWithImageSignedWithDifferentKeyRunsPvmfw() is the protected case.
-        assumeNonProtectedVm();
+        assumeKernelSupported(gki);
+
         // Sign everything with key1 except vbmeta
         File key = findTestFile("test.com.android.virt.pem");
         // To be able to stop it, it should be a daemon.
         VmInfo vmInfo =
                 runMicrodroidWithResignedImages(
-                        key, Map.of(), /* isProtected= */ false, /* updateBootconfigs= */ false);
+                        key,
+                        Map.of(),
+                        /* isProtected= */ false,
+                        /* updateBootconfigs= */ false,
+                        gki);
         // Wait so that init can print errors to console (time in cuttlefish >> in real device)
         assertThatEventually(
                 100000,
@@ -608,7 +654,8 @@
     }
 
     private boolean isTombstoneGeneratedWithCmd(
-            boolean protectedVm, String configPath, String... crashCommand) throws Exception {
+            boolean protectedVm, String gki, String configPath, String... crashCommand)
+            throws Exception {
         CommandRunner android = new CommandRunner(getDevice());
         String testStartTime = android.runWithTimeout(1000, "date", "'+%Y-%m-%d %H:%M:%S.%N'");
 
@@ -618,7 +665,7 @@
                         .memoryMib(minMemorySize())
                         .cpuTopology("match_host")
                         .protectedVm(protectedVm)
-                        .gki(mGki)
+                        .gki(sGkiVersions.get(gki))
                         .build(getAndroidDevice());
         mMicrodroidDevice.waitForBootComplete(BOOT_COMPLETE_TIMEOUT);
         mMicrodroidDevice.enableAdbRoot();
@@ -634,12 +681,19 @@
     }
 
     @Test
-    public void testTombstonesAreGeneratedUponUserspaceCrash() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testTombstonesAreGeneratedUponUserspaceCrash(boolean protectedVm, String gki)
+            throws Exception {
+        // Preconditions
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
         // TODO(b/291867858): tombstones are failing in HWASAN enabled Microdroid.
         assumeFalse("tombstones are failing in HWASAN enabled Microdroid.", isHwasan());
         assertThat(
                         isTombstoneGeneratedWithCmd(
-                                mProtectedVm,
+                                protectedVm,
+                                gki,
                                 "assets/vm_config.json",
                                 "kill",
                                 "-SIGSEGV",
@@ -648,12 +702,19 @@
     }
 
     @Test
-    public void testTombstonesAreNotGeneratedIfNotExportedUponUserspaceCrash() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testTombstonesAreNotGeneratedIfNotExportedUponUserspaceCrash(
+            boolean protectedVm, String gki) throws Exception {
+        // Preconditions
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
         // TODO(b/291867858): tombstones are failing in HWASAN enabled Microdroid.
         assumeFalse("tombstones are failing in HWASAN enabled Microdroid.", isHwasan());
         assertThat(
                         isTombstoneGeneratedWithCmd(
-                                mProtectedVm,
+                                protectedVm,
+                                gki,
                                 "assets/vm_config_no_tombstone.json",
                                 "kill",
                                 "-SIGSEGV",
@@ -662,13 +723,22 @@
     }
 
     @Test
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
     @Ignore("b/341087884") // TODO(b/341087884): fix & re-enable
-    public void testTombstonesAreGeneratedUponKernelCrash() throws Exception {
+    public void testTombstonesAreGeneratedUponKernelCrash(boolean protectedVm, String gki)
+            throws Exception {
+        // Preconditions
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
         assumeFalse("Cuttlefish is not supported", isCuttlefish());
         assumeFalse("Skipping test because ramdump is disabled on user build", isUserBuild());
+
+        // Act
         assertThat(
                         isTombstoneGeneratedWithCmd(
-                                mProtectedVm,
+                                protectedVm,
+                                gki,
                                 "assets/vm_config.json",
                                 "echo",
                                 "c",
@@ -678,10 +748,12 @@
     }
 
     private boolean isTombstoneGeneratedWithVmRunApp(
-            boolean protectedVm, boolean debuggable, String... additionalArgs) throws Exception {
+            boolean protectedVm, String gki, boolean debuggable, String... additionalArgs)
+            throws Exception {
         // we can't use microdroid builder as it wants ADB connection (debuggable)
         CommandRunner android = new CommandRunner(getDevice());
         String testStartTime = android.runWithTimeout(1000, "date", "'+%Y-%m-%d %H:%M:%S.%N'");
+        gki = sGkiVersions.get(gki);
 
         android.run("rm", "-rf", TEST_ROOT + "*");
         android.run("mkdir", "-p", TEST_ROOT + "*");
@@ -708,9 +780,9 @@
         if (protectedVm) {
             cmd.add("--protected");
         }
-        if (mGki != null) {
+        if (gki != null) {
             cmd.add("--gki");
-            cmd.add(mGki);
+            cmd.add(gki);
         }
         Collections.addAll(cmd, additionalArgs);
 
@@ -718,52 +790,89 @@
         return isTombstoneReceivedFromHostLogcat(testStartTime);
     }
 
-    private boolean isTombstoneGeneratedWithCrashPayload(boolean protectedVm, boolean debuggable)
-            throws Exception {
+    private boolean isTombstoneGeneratedWithCrashPayload(
+            boolean protectedVm, String gki, boolean debuggable) throws Exception {
         return isTombstoneGeneratedWithVmRunApp(
-                protectedVm, debuggable, "--payload-binary-name", "MicrodroidCrashNativeLib.so");
+                protectedVm,
+                gki,
+                debuggable,
+                "--payload-binary-name",
+                "MicrodroidCrashNativeLib.so");
     }
 
     @Test
-    public void testTombstonesAreGeneratedWithCrashPayload() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testTombstonesAreGeneratedWithCrashPayload(boolean protectedVm, String gki)
+            throws Exception {
+        // Preconditions
         // TODO(b/291867858): tombstones are failing in HWASAN enabled Microdroid.
         assumeFalse("tombstones are failing in HWASAN enabled Microdroid.", isHwasan());
-        assertThat(isTombstoneGeneratedWithCrashPayload(mProtectedVm, /* debuggable= */ true))
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
+
+        // Act
+        assertThat(isTombstoneGeneratedWithCrashPayload(protectedVm, gki, /* debuggable= */ true))
                 .isTrue();
     }
 
     @Test
-    public void testTombstonesAreNotGeneratedWithCrashPayloadWhenNonDebuggable() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testTombstonesAreNotGeneratedWithCrashPayloadWhenNonDebuggable(
+            boolean protectedVm, String gki) throws Exception {
+        // Preconditions
         // TODO(b/291867858): tombstones are failing in HWASAN enabled Microdroid.
         assumeFalse("tombstones are failing in HWASAN enabled Microdroid.", isHwasan());
-        assertThat(isTombstoneGeneratedWithCrashPayload(mProtectedVm, /* debuggable= */ false))
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
+
+        // Act
+        assertThat(isTombstoneGeneratedWithCrashPayload(protectedVm, gki, /* debuggable= */ false))
                 .isFalse();
     }
 
-    private boolean isTombstoneGeneratedWithCrashConfig(boolean protectedVm, boolean debuggable)
-            throws Exception {
+    private boolean isTombstoneGeneratedWithCrashConfig(
+            boolean protectedVm, String gki, boolean debuggable) throws Exception {
         return isTombstoneGeneratedWithVmRunApp(
-                protectedVm, debuggable, "--config-path", "assets/vm_config_crash.json");
+                protectedVm, gki, debuggable, "--config-path", "assets/vm_config_crash.json");
     }
 
     @Test
-    public void testTombstonesAreGeneratedWithCrashConfig() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testTombstonesAreGeneratedWithCrashConfig(boolean protectedVm, String gki)
+            throws Exception {
+        // Preconditions
         // TODO(b/291867858): tombstones are failing in HWASAN enabled Microdroid.
         assumeFalse("tombstones are failing in HWASAN enabled Microdroid.", isHwasan());
-        assertThat(isTombstoneGeneratedWithCrashConfig(mProtectedVm, /* debuggable= */ true))
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
+
+        // Act
+        assertThat(isTombstoneGeneratedWithCrashConfig(protectedVm, gki, /* debuggable= */ true))
                 .isTrue();
     }
 
     @Test
-    public void testTombstonesAreNotGeneratedWithCrashConfigWhenNonDebuggable() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testTombstonesAreNotGeneratedWithCrashConfigWhenNonDebuggable(
+            boolean protectedVm, String gki) throws Exception {
         // TODO(b/291867858): tombstones are failing in HWASAN enabled Microdroid.
         assumeFalse("tombstones are failing in HWASAN enabled Microdroid.", isHwasan());
-        assertThat(isTombstoneGeneratedWithCrashConfig(mProtectedVm, /* debuggable= */ false))
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
+        assertThat(isTombstoneGeneratedWithCrashConfig(protectedVm, gki, /* debuggable= */ false))
                 .isFalse();
     }
 
     @Test
-    public void testTelemetryPushedAtoms() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testTelemetryPushedAtoms(boolean protectedVm, String gki) throws Exception {
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
         // Reset statsd config and report before the test
         ConfigUtils.removeConfig(getDevice());
         ReportUtils.clearReports(getDevice());
@@ -784,8 +893,8 @@
                         .debugLevel("full")
                         .memoryMib(minMemorySize())
                         .cpuTopology("match_host")
-                        .protectedVm(mProtectedVm)
-                        .gki(mGki)
+                        .protectedVm(protectedVm)
+                        .gki(sGkiVersions.get(gki))
                         .name("test_telemetry_pushed_atoms")
                         .build(device);
         microdroid.waitForBootComplete(BOOT_COMPLETE_TIMEOUT);
@@ -815,7 +924,7 @@
             assertThat(atomVmCreationRequested.getHypervisor())
                     .isEqualTo(AtomsProto.VmCreationRequested.Hypervisor.PKVM);
         }
-        assertThat(atomVmCreationRequested.getIsProtected()).isEqualTo(mProtectedVm);
+        assertThat(atomVmCreationRequested.getIsProtected()).isEqualTo(protectedVm);
         assertThat(atomVmCreationRequested.getCreationSucceeded()).isTrue();
         assertThat(atomVmCreationRequested.getBinderExceptionCode()).isEqualTo(0);
         assertThat(atomVmCreationRequested.getVmIdentifier())
@@ -921,29 +1030,41 @@
     }
 
     @Test
-    @CddTest(requirements = {"9.17/C-1-1", "9.17/C-1-2", "9.17/C-1-3"})
-    public void testMicrodroidBoots() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    @CddTest(requirements = {"9.17/C-1-1", "9.17/C-1-2", "9.17/C/1-3"})
+    public void testMicrodroidBoots(boolean protectedVm, String gki) throws Exception {
+        // Preconditions
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
+
         final String configPath = "assets/vm_config.json"; // path inside the APK
         testMicrodroidBootsWithBuilder(
                 MicrodroidBuilder.fromDevicePath(getPathForPackage(PACKAGE_NAME), configPath)
                         .debugLevel("full")
                         .memoryMib(minMemorySize())
                         .cpuTopology("match_host")
-                        .protectedVm(mProtectedVm)
+                        .protectedVm(protectedVm)
                         .name("test_microdroid_boots")
-                        .gki(mGki));
+                        .gki(sGkiVersions.get(gki)));
     }
 
     @Test
-    public void testMicrodroidRamUsage() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testMicrodroidRamUsage(boolean protectedVm, String gki) throws Exception {
+        // Preconditions
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
+
         final String configPath = "assets/vm_config.json";
         mMicrodroidDevice =
                 MicrodroidBuilder.fromDevicePath(getPathForPackage(PACKAGE_NAME), configPath)
                         .debugLevel("full")
                         .memoryMib(minMemorySize())
                         .cpuTopology("match_host")
-                        .protectedVm(mProtectedVm)
-                        .gki(mGki)
+                        .protectedVm(protectedVm)
+                        .gki(sGkiVersions.get(gki))
                         .name("test_microdroid_ram_usage")
                         .build(getAndroidDevice());
         mMicrodroidDevice.waitForBootComplete(BOOT_COMPLETE_TIMEOUT);
@@ -1125,8 +1246,12 @@
     }
 
     @Test
-    public void testDeviceAssignment() throws Exception {
-        // Check for preconditions
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testDeviceAssignment(boolean protectedVm, String gki) throws Exception {
+        // Preconditions
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
         assumeVfioPlatformSupported();
 
         List<AssignableDevice> devices = getAssignableDevices();
@@ -1136,7 +1261,7 @@
 
         // Try assign devices one by one
         for (AssignableDevice device : devices) {
-            launchWithDeviceAssignment(device.node);
+            launchWithDeviceAssignment(device.node, protectedVm, gki);
 
             String dtPath =
                     new CommandRunner(mMicrodroidDevice)
@@ -1158,7 +1283,8 @@
         }
     }
 
-    private void launchWithDeviceAssignment(String device) throws Exception {
+    private void launchWithDeviceAssignment(String device, boolean protectedVm, String gki)
+            throws Exception {
         Objects.requireNonNull(device);
         final String configPath = "assets/vm_config.json";
 
@@ -1167,8 +1293,8 @@
                         .debugLevel("full")
                         .memoryMib(minMemorySize())
                         .cpuTopology("match_host")
-                        .protectedVm(mProtectedVm)
-                        .gki(mGki)
+                        .protectedVm(protectedVm)
+                        .gki(sGkiVersions.get(gki))
                         .addAssignableDevice(device)
                         .build(getAndroidDevice());
 
@@ -1186,7 +1312,13 @@
     }
 
     @Test
-    public void testHugePages() throws Exception {
+    @Parameters(method = "params")
+    @TestCaseName("{method}_protectedVm_{0}_gki_{1}")
+    public void testHugePages(boolean protectedVm, String gki) throws Exception {
+        // Preconditions
+        assumeKernelSupported(gki);
+        assumeVmTypeSupported(protectedVm);
+
         ITestDevice device = getDevice();
         boolean disableRoot = !device.isAdbRoot();
         CommandRunner android = new CommandRunner(device);
@@ -1207,8 +1339,8 @@
                         .debugLevel("full")
                         .memoryMib(minMemorySize())
                         .cpuTopology("match_host")
-                        .protectedVm(mProtectedVm)
-                        .gki(mGki)
+                        .protectedVm(protectedVm)
+                        .gki(sGkiVersions.get(gki))
                         .hugePages(true)
                         .name("test_huge_pages")
                         .build(getAndroidDevice());
@@ -1230,19 +1362,6 @@
 
         getDevice().installPackage(findTestFile(APK_NAME), /* reinstall= */ false);
 
-        // Skip test if given device doesn't support protected or non-protected VM.
-        assumeTrue(
-                "Microdroid is not supported for specific VM protection type",
-                getAndroidDevice().supportsMicrodroid(mProtectedVm));
-
-        if (mGki != null) {
-            assumeTrue(
-                    "GKI version \"" + mGki + "\" is not supported on this device",
-                    getSupportedGKIVersions().contains(mGki));
-        }
-
-        mOs = (mGki != null) ? "microdroid_gki-" + mGki : "microdroid";
-
         new CommandRunner(getDevice())
                 .tryRun(
                         "pm",
@@ -1265,14 +1384,6 @@
         getDevice().uninstallPackage(PACKAGE_NAME);
     }
 
-    private void assumeProtectedVm() {
-        assumeTrue("This test is only for protected VM.", mProtectedVm);
-    }
-
-    private void assumeNonProtectedVm() {
-        assumeFalse("This test is only for non-protected VM.", mProtectedVm);
-    }
-
     private void assumeVfioPlatformSupported() throws Exception {
         TestDevice device = getAndroidDevice();
         assumeTrue(
@@ -1302,4 +1413,19 @@
         runUtil.unsetEnvVariable("LD_LIBRARY_PATH");
         return runUtil;
     }
+
+    private void assumeKernelSupported(String gki) throws Exception {
+        String gkiVersion = sGkiVersions.get(gki);
+        if (gkiVersion != null) {
+            assumeTrue(
+                    "Skipping test as the GKI is not supported: " + gkiVersion,
+                    getSupportedGKIVersions().contains(gkiVersion));
+        }
+    }
+
+    private void assumeVmTypeSupported(boolean protectedVm) throws Exception {
+        assumeTrue(
+                "Microdroid is not supported for specific VM protection type",
+                getAndroidDevice().supportsMicrodroid(protectedVm));
+    }
 }
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index d38af45..c09f033 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -1212,7 +1212,7 @@
     }
 
     @Test
-    @CddTest(requirements = {"9.17/C-1-1", "9.17/C-2-7"})
+    @CddTest(requirements = {"9.17/C-1-1", "9.17/C-2-7", "9.17/C-3-4"})
     public void instancesOfSameVmHaveDifferentCdis() throws Exception {
         assumeSupportedDevice();
         // TODO(b/325094712): VMs on CF with same payload have the same secret. This is because
@@ -1239,7 +1239,7 @@
     }
 
     @Test
-    @CddTest(requirements = {"9.17/C-1-1", "9.17/C-2-7"})
+    @CddTest(requirements = {"9.17/C-1-1", "9.17/C-2-7", "9.17/C-3-4"})
     public void sameInstanceKeepsSameCdis() throws Exception {
         assumeSupportedDevice();
         assume().withMessage("Skip on CF. Too Slow. b/257270529").that(isCuttlefish()).isFalse();