diff --git a/authfs/src/common.rs b/authfs/src/common.rs
index 2220ae7..522397f 100644
--- a/authfs/src/common.rs
+++ b/authfs/src/common.rs
@@ -14,7 +14,8 @@
  * limitations under the License.
  */
 
-pub const COMMON_PAGE_SIZE: u64 = 4096;
+/// Common block and page size in Linux.
+pub const CHUNK_SIZE: u64 = 4096;
 
 pub fn divide_roundup(dividend: u64, divisor: u64) -> u64 {
     (dividend + divisor - 1) / divisor
diff --git a/authfs/src/crypto.rs b/authfs/src/crypto.rs
index 8b8905c..672dfb6 100644
--- a/authfs/src/crypto.rs
+++ b/authfs/src/crypto.rs
@@ -26,6 +26,8 @@
 
 use authfs_crypto_bindgen::{SHA256_Final, SHA256_Init, SHA256_Update, SHA256_CTX};
 
+pub type Sha256Hash = [u8; Sha256Hasher::HASH_SIZE];
+
 pub struct Sha256Hasher {
     ctx: SHA256_CTX,
 }
@@ -33,6 +35,12 @@
 impl Sha256Hasher {
     pub const HASH_SIZE: usize = 32;
 
+    pub const HASH_OF_4096_ZEROS: [u8; Self::HASH_SIZE] = [
+        0xad, 0x7f, 0xac, 0xb2, 0x58, 0x6f, 0xc6, 0xe9, 0x66, 0xc0, 0x04, 0xd7, 0xd1, 0xd1, 0x6b,
+        0x02, 0x4f, 0x58, 0x05, 0xff, 0x7c, 0xb4, 0x7c, 0x7a, 0x85, 0xda, 0xbd, 0x8b, 0x48, 0x89,
+        0x2c, 0xa7,
+    ];
+
     pub fn new() -> Result<Sha256Hasher, CryptoError> {
         // Safe assuming the crypto FFI should initialize the uninitialized `ctx`, which is
         // currently a pure data struct.
@@ -58,6 +66,17 @@
         }
     }
 
+    pub fn update_from<I, T>(&mut self, iter: I) -> Result<&mut Self, CryptoError>
+    where
+        I: IntoIterator<Item = T>,
+        T: AsRef<[u8]>,
+    {
+        for data in iter {
+            self.update(data.as_ref())?;
+        }
+        Ok(self)
+    }
+
     pub fn finalize(&mut self) -> Result<[u8; Self::HASH_SIZE], CryptoError> {
         let mut md = [0u8; Self::HASH_SIZE];
         // Safe assuming the crypto FFI will not touch beyond `ctx` as pure data.
@@ -93,4 +112,11 @@
         assert_eq!(s, "039058c6f2c0cb492c533b0a4d14ef77cc0f78abccced5287d84a1a2011cfb81");
         Ok(())
     }
+
+    #[test]
+    fn sha256_of_4096_zeros() -> Result<(), CryptoError> {
+        let hash = Sha256Hasher::new()?.update(&[0u8; 4096])?.finalize()?;
+        assert_eq!(hash, Sha256Hasher::HASH_OF_4096_ZEROS);
+        Ok(())
+    }
 }
diff --git a/authfs/src/fsverity.rs b/authfs/src/fsverity.rs
index 306c9d9..37d96c1 100644
--- a/authfs/src/fsverity.rs
+++ b/authfs/src/fsverity.rs
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,319 +14,10 @@
  * limitations under the License.
  */
 
-use libc::EIO;
-use std::io;
-use thiserror::Error;
+mod builder;
+mod common;
+mod sys;
+mod verifier;
 
-use crate::auth::Authenticator;
-use crate::common::divide_roundup;
-use crate::crypto::{CryptoError, Sha256Hasher};
-use crate::reader::ReadOnlyDataByChunk;
-
-const ZEROS: [u8; 4096] = [0u8; 4096];
-
-// The size of `struct fsverity_formatted_digest` in Linux with SHA-256.
-const SIZE_OF_FSVERITY_FORMATTED_DIGEST_SHA256: usize = 12 + Sha256Hasher::HASH_SIZE;
-
-#[derive(Error, Debug)]
-pub enum FsverityError {
-    #[error("Cannot verify a signature")]
-    BadSignature,
-    #[error("Insufficient data, only got {0}")]
-    InsufficientData(usize),
-    #[error("Cannot verify a block")]
-    CannotVerify,
-    #[error("I/O error")]
-    Io(#[from] io::Error),
-    #[error("Crypto")]
-    UnexpectedCryptoError(#[from] CryptoError),
-}
-
-type HashBuffer = [u8; Sha256Hasher::HASH_SIZE];
-
-fn hash_with_padding(chunk: &[u8], pad_to: usize) -> Result<HashBuffer, CryptoError> {
-    let padding_size = pad_to - chunk.len();
-    Sha256Hasher::new()?.update(&chunk)?.update(&ZEROS[..padding_size])?.finalize()
-}
-
-fn verity_check<T: ReadOnlyDataByChunk>(
-    chunk: &[u8],
-    chunk_index: u64,
-    file_size: u64,
-    merkle_tree: &T,
-) -> Result<HashBuffer, FsverityError> {
-    // The caller should not be able to produce a chunk at the first place if `file_size` is 0. The
-    // current implementation expects to crash when a `ReadOnlyDataByChunk` implementation reads
-    // beyone the file size, including empty file.
-    assert_ne!(file_size, 0);
-
-    let chunk_hash = hash_with_padding(&chunk, T::CHUNK_SIZE as usize)?;
-
-    fsverity_walk(chunk_index, file_size, merkle_tree)?.try_fold(
-        chunk_hash,
-        |actual_hash, result| {
-            let (merkle_chunk, hash_offset_in_chunk) = result?;
-            let expected_hash =
-                &merkle_chunk[hash_offset_in_chunk..hash_offset_in_chunk + Sha256Hasher::HASH_SIZE];
-            if actual_hash != expected_hash {
-                return Err(FsverityError::CannotVerify);
-            }
-            Ok(hash_with_padding(&merkle_chunk, T::CHUNK_SIZE as usize)?)
-        },
-    )
-}
-
-fn log128_ceil(num: u64) -> Option<u64> {
-    match num {
-        0 => None,
-        n => Some(divide_roundup(64 - (n - 1).leading_zeros() as u64, 7)),
-    }
-}
-
-/// Given a chunk index and the size of the file, returns an iterator that walks the Merkle tree
-/// from the leaf to the root. The iterator carries the slice of the chunk/node as well as the
-/// offset of the child node's hash. It is up to the iterator user to use the node and hash,
-/// e.g. for the actual verification.
-#[allow(clippy::needless_collect)]
-fn fsverity_walk<T: ReadOnlyDataByChunk>(
-    chunk_index: u64,
-    file_size: u64,
-    merkle_tree: &T,
-) -> Result<impl Iterator<Item = Result<([u8; 4096], usize), FsverityError>> + '_, FsverityError> {
-    let hashes_per_node = T::CHUNK_SIZE / Sha256Hasher::HASH_SIZE as u64;
-    let hash_pages = divide_roundup(file_size, hashes_per_node * T::CHUNK_SIZE);
-    debug_assert_eq!(hashes_per_node, 128u64);
-    let max_level = log128_ceil(hash_pages).expect("file should not be empty") as u32;
-    let root_to_leaf_steps = (0..=max_level)
-        .rev()
-        .map(|x| {
-            let leaves_per_hash = hashes_per_node.pow(x);
-            let leaves_size_per_hash = T::CHUNK_SIZE * leaves_per_hash;
-            let leaves_size_per_node = leaves_size_per_hash * hashes_per_node;
-            let nodes_at_level = divide_roundup(file_size, leaves_size_per_node);
-            let level_size = nodes_at_level * T::CHUNK_SIZE;
-            let offset_in_level = (chunk_index / leaves_per_hash) * Sha256Hasher::HASH_SIZE as u64;
-            (level_size, offset_in_level)
-        })
-        .scan(0, |level_offset, (level_size, offset_in_level)| {
-            let this_level_offset = *level_offset;
-            *level_offset += level_size;
-            let global_hash_offset = this_level_offset + offset_in_level;
-            Some(global_hash_offset)
-        })
-        .map(|global_hash_offset| {
-            let chunk_index = global_hash_offset / T::CHUNK_SIZE;
-            let hash_offset_in_chunk = (global_hash_offset % T::CHUNK_SIZE) as usize;
-            (chunk_index, hash_offset_in_chunk)
-        })
-        .collect::<Vec<_>>();
-
-    Ok(root_to_leaf_steps.into_iter().rev().map(move |(chunk_index, hash_offset_in_chunk)| {
-        let mut merkle_chunk = [0u8; 4096];
-        let _ = merkle_tree.read_chunk(chunk_index, &mut merkle_chunk)?;
-        Ok((merkle_chunk, hash_offset_in_chunk))
-    }))
-}
-
-fn build_fsverity_formatted_digest(
-    root_hash: &HashBuffer,
-    file_size: u64,
-) -> Result<[u8; SIZE_OF_FSVERITY_FORMATTED_DIGEST_SHA256], CryptoError> {
-    let desc_hash = Sha256Hasher::new()?
-        .update(&1u8.to_le_bytes())? // version
-        .update(&1u8.to_le_bytes())? // hash_algorithm
-        .update(&12u8.to_le_bytes())? // log_blocksize
-        .update(&0u8.to_le_bytes())? // salt_size
-        .update(&0u32.to_le_bytes())? // sig_size
-        .update(&file_size.to_le_bytes())? // data_size
-        .update(root_hash)? // root_hash, first 32 bytes
-        .update(&[0u8; 32])? // root_hash, last 32 bytes
-        .update(&[0u8; 32])? // salt
-        .update(&[0u8; 32])? // reserved
-        .update(&[0u8; 32])? // reserved
-        .update(&[0u8; 32])? // reserved
-        .update(&[0u8; 32])? // reserved
-        .update(&[0u8; 16])? // reserved
-        .finalize()?;
-
-    let mut fsverity_digest = [0u8; SIZE_OF_FSVERITY_FORMATTED_DIGEST_SHA256];
-    fsverity_digest[0..8].copy_from_slice(b"FSVerity");
-    fsverity_digest[8..10].copy_from_slice(&1u16.to_le_bytes());
-    fsverity_digest[10..12].copy_from_slice(&32u16.to_le_bytes());
-    fsverity_digest[12..].copy_from_slice(&desc_hash);
-    Ok(fsverity_digest)
-}
-
-pub struct FsverityChunkedFileReader<F: ReadOnlyDataByChunk, M: ReadOnlyDataByChunk> {
-    chunked_file: F,
-    file_size: u64,
-    merkle_tree: M,
-    root_hash: HashBuffer,
-}
-
-impl<F: ReadOnlyDataByChunk, M: ReadOnlyDataByChunk> FsverityChunkedFileReader<F, M> {
-    pub fn new<A: Authenticator>(
-        authenticator: &A,
-        chunked_file: F,
-        file_size: u64,
-        sig: Vec<u8>,
-        merkle_tree: M,
-    ) -> Result<FsverityChunkedFileReader<F, M>, FsverityError> {
-        // TODO(victorhsieh): Use generic constant directly once supported. No need to assert
-        // afterward.
-        let mut buf = [0u8; 4096];
-        assert_eq!(buf.len() as u64, M::CHUNK_SIZE);
-        let size = merkle_tree.read_chunk(0, &mut buf)?;
-        if buf.len() != size {
-            return Err(FsverityError::InsufficientData(size));
-        }
-        let root_hash = Sha256Hasher::new()?.update(&buf[..])?.finalize()?;
-        let fsverity_digest = build_fsverity_formatted_digest(&root_hash, file_size)?;
-        let valid = authenticator.verify(&sig, &fsverity_digest)?;
-        if valid {
-            Ok(FsverityChunkedFileReader { chunked_file, file_size, merkle_tree, root_hash })
-        } else {
-            Err(FsverityError::BadSignature)
-        }
-    }
-}
-
-impl<F: ReadOnlyDataByChunk, M: ReadOnlyDataByChunk> ReadOnlyDataByChunk
-    for FsverityChunkedFileReader<F, M>
-{
-    fn read_chunk(&self, chunk_index: u64, buf: &mut [u8]) -> io::Result<usize> {
-        debug_assert!(buf.len() as u64 >= Self::CHUNK_SIZE);
-        let size = self.chunked_file.read_chunk(chunk_index, buf)?;
-        let root_hash = verity_check(&buf[..size], chunk_index, self.file_size, &self.merkle_tree)
-            .map_err(|_| io::Error::from_raw_os_error(EIO))?;
-        if root_hash != self.root_hash {
-            Err(io::Error::from_raw_os_error(EIO))
-        } else {
-            Ok(size)
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::FakeAuthenticator;
-    use crate::reader::{ChunkedFileReader, ReadOnlyDataByChunk};
-    use anyhow::Result;
-    use std::fs::File;
-    use std::io::Read;
-
-    type LocalFsverityChunkedFileReader =
-        FsverityChunkedFileReader<ChunkedFileReader, ChunkedFileReader>;
-
-    fn total_chunk_number(file_size: u64) -> u64 {
-        (file_size + 4095) / 4096
-    }
-
-    // Returns a reader with fs-verity verification and the file size.
-    fn new_reader_with_fsverity(
-        content_path: &str,
-        merkle_tree_path: &str,
-        signature_path: &str,
-    ) -> Result<(LocalFsverityChunkedFileReader, u64)> {
-        let file_reader = ChunkedFileReader::new(File::open(content_path)?)?;
-        let file_size = file_reader.len();
-        let merkle_tree = ChunkedFileReader::new(File::open(merkle_tree_path)?)?;
-        let mut sig = Vec::new();
-        let _ = File::open(signature_path)?.read_to_end(&mut sig)?;
-        let authenticator = FakeAuthenticator::always_succeed();
-        Ok((
-            FsverityChunkedFileReader::new(
-                &authenticator,
-                file_reader,
-                file_size,
-                sig,
-                merkle_tree,
-            )?,
-            file_size,
-        ))
-    }
-
-    #[test]
-    fn fsverity_verify_full_read_4k() -> Result<()> {
-        let (file_reader, file_size) = new_reader_with_fsverity(
-            "testdata/input.4k",
-            "testdata/input.4k.merkle_dump",
-            "testdata/input.4k.fsv_sig",
-        )?;
-
-        for i in 0..total_chunk_number(file_size) {
-            let mut buf = [0u8; 4096];
-            assert!(file_reader.read_chunk(i, &mut buf[..]).is_ok());
-        }
-        Ok(())
-    }
-
-    #[test]
-    fn fsverity_verify_full_read_4k1() -> Result<()> {
-        let (file_reader, file_size) = new_reader_with_fsverity(
-            "testdata/input.4k1",
-            "testdata/input.4k1.merkle_dump",
-            "testdata/input.4k1.fsv_sig",
-        )?;
-
-        for i in 0..total_chunk_number(file_size) {
-            let mut buf = [0u8; 4096];
-            assert!(file_reader.read_chunk(i, &mut buf[..]).is_ok());
-        }
-        Ok(())
-    }
-
-    #[test]
-    fn fsverity_verify_full_read_4m() -> Result<()> {
-        let (file_reader, file_size) = new_reader_with_fsverity(
-            "testdata/input.4m",
-            "testdata/input.4m.merkle_dump",
-            "testdata/input.4m.fsv_sig",
-        )?;
-
-        for i in 0..total_chunk_number(file_size) {
-            let mut buf = [0u8; 4096];
-            assert!(file_reader.read_chunk(i, &mut buf[..]).is_ok());
-        }
-        Ok(())
-    }
-
-    #[test]
-    fn fsverity_verify_bad_merkle_tree() -> Result<()> {
-        let (file_reader, _) = new_reader_with_fsverity(
-            "testdata/input.4m",
-            "testdata/input.4m.merkle_dump.bad", // First leaf node is corrupted.
-            "testdata/input.4m.fsv_sig",
-        )?;
-
-        // A lowest broken node (a 4K chunk that contains 128 sha256 hashes) will fail the read
-        // failure of the underlying chunks, but not before or after.
-        let mut buf = [0u8; 4096];
-        let num_hashes = 4096 / 32;
-        let last_index = num_hashes;
-        for i in 0..last_index {
-            assert!(file_reader.read_chunk(i, &mut buf[..]).is_err());
-        }
-        assert!(file_reader.read_chunk(last_index, &mut buf[..]).is_ok());
-        Ok(())
-    }
-
-    #[test]
-    fn invalid_signature() -> Result<()> {
-        let authenticator = FakeAuthenticator::always_fail();
-        let file_reader = ChunkedFileReader::new(File::open("testdata/input.4m")?)?;
-        let file_size = file_reader.len();
-        let merkle_tree = ChunkedFileReader::new(File::open("testdata/input.4m.merkle_dump")?)?;
-        let sig = include_bytes!("../testdata/input.4m.fsv_sig").to_vec();
-        assert!(FsverityChunkedFileReader::new(
-            &authenticator,
-            file_reader,
-            file_size,
-            sig,
-            merkle_tree
-        )
-        .is_err());
-        Ok(())
-    }
-}
+pub use self::builder::MerkleLeaves;
+pub use self::verifier::FsverityChunkedFileReader;
diff --git a/authfs/src/fsverity/builder.rs b/authfs/src/fsverity/builder.rs
new file mode 100644
index 0000000..607d3a7
--- /dev/null
+++ b/authfs/src/fsverity/builder.rs
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use super::common::{build_fsverity_digest, merkle_tree_height, FsverityError};
+use crate::common::CHUNK_SIZE;
+use crate::crypto::{CryptoError, Sha256Hash, Sha256Hasher};
+
+const HASH_SIZE: usize = Sha256Hasher::HASH_SIZE;
+const HASH_PER_PAGE: usize = CHUNK_SIZE as usize / HASH_SIZE;
+
+/// MerkleLeaves can be used by the class' customer for bookkeeping integrity data for their bytes.
+/// It can also be used to generate the standard fs-verity digest for the source data.
+///
+/// It's in-memory because for the initial use cases, we don't need to read back an existing file,
+/// and only need to deal with new files. Also, considering that the output file won't be large at
+/// the moment, it is sufficient to simply keep the Merkle tree in memory in the trusted world. To
+/// further simplify the initial implementation, we only need to keep the leaf nodes in memory, and
+/// generate the tree / root hash when requested.
+pub struct MerkleLeaves {
+    leaves: Vec<Sha256Hash>,
+    file_size: u64,
+}
+
+fn hash_all_pages(source: &[Sha256Hash]) -> Result<Vec<Sha256Hash>, CryptoError> {
+    source
+        .chunks(HASH_PER_PAGE)
+        .map(|chunk| {
+            let padding_bytes = (HASH_PER_PAGE - chunk.len()) * HASH_SIZE;
+            Ok(Sha256Hasher::new()?
+                .update_from(chunk)?
+                .update(&vec![0u8; padding_bytes])?
+                .finalize()?)
+        })
+        .collect()
+}
+
+#[allow(dead_code)]
+impl MerkleLeaves {
+    /// Creates a `MerkleLeaves` instance with empty data.
+    pub fn new() -> Self {
+        Self { leaves: Vec::new(), file_size: 0 }
+    }
+
+    /// Updates the hash of the `index`-th leaf, and increase the size to `size_at_least` if the
+    /// current size is smaller.
+    pub fn update_hash(&mut self, index: usize, hash: &Sha256Hash, size_at_least: u64) {
+        // +1 since index is zero-based.
+        if self.leaves.len() < index + 1 {
+            // When resizing, fill in hash of zeros by default. This makes it easy to handle holes
+            // in a file.
+            self.leaves.resize(index + 1, Sha256Hasher::HASH_OF_4096_ZEROS);
+        }
+        self.leaves[index].clone_from_slice(hash);
+
+        if size_at_least > self.file_size {
+            self.file_size = size_at_least;
+        }
+    }
+
+    /// Returns whether `index` is within the bound of leaves.
+    pub fn is_index_valid(&self, index: usize) -> bool {
+        index < self.leaves.len()
+    }
+
+    /// Returns whether the `index`-th hash is consistent to `hash`.
+    pub fn is_consistent(&self, index: usize, hash: &Sha256Hash) -> bool {
+        if let Some(element) = self.leaves.get(index) {
+            element == hash
+        } else {
+            false
+        }
+    }
+
+    fn calculate_root_hash(&self) -> Result<Sha256Hash, FsverityError> {
+        match self.leaves.len() {
+            // Special cases per fs-verity digest definition.
+            0 => {
+                debug_assert_eq!(self.file_size, 0);
+                Ok([0u8; HASH_SIZE])
+            }
+            1 => {
+                debug_assert!(self.file_size <= CHUNK_SIZE && self.file_size > 0);
+                Ok(self.leaves[0])
+            }
+            n => {
+                debug_assert_eq!((self.file_size - 1) / CHUNK_SIZE, n as u64);
+                let size_for_equivalent = n as u64 * CHUNK_SIZE;
+                let level = merkle_tree_height(size_for_equivalent).unwrap(); // safe since n > 0
+
+                // `leaves` is owned and can't be the initial state below. Here we manually hash it
+                // first to avoid a copy and to get the type right.
+                let second_level = hash_all_pages(&self.leaves)?;
+                let hashes =
+                    (1..=level).try_fold(second_level, |source, _| hash_all_pages(&source))?;
+                if hashes.len() != 1 {
+                    Err(FsverityError::InvalidState)
+                } else {
+                    Ok(hashes.into_iter().next().unwrap())
+                }
+            }
+        }
+    }
+
+    /// Returns the fs-verity digest based on the current tree and file size.
+    pub fn calculate_fsverity_digest(&self) -> Result<Sha256Hash, FsverityError> {
+        let root_hash = self.calculate_root_hash()?;
+        Ok(build_fsverity_digest(&root_hash, self.file_size)?)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    // Test data below can be generated by:
+    //  $ perl -e 'print "\x{00}" x 6000' > foo
+    //  $ perl -e 'print "\x{01}" x 5000' >> foo
+    //  $ fsverity digest foo
+    use super::*;
+    use anyhow::Result;
+
+    #[test]
+    fn merkle_tree_empty_file() -> Result<()> {
+        assert_eq!(
+            to_u8_vec("3d248ca542a24fc62d1c43b916eae5016878e2533c88238480b26128a1f1af95"),
+            generate_fsverity_digest_sequentially(&Vec::new())?
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn merkle_tree_file_size_less_than_or_equal_to_4k() -> Result<()> {
+        // Test a file that contains 4096 '\01's.
+        assert_eq!(
+            to_u8_vec("cd0875ca59c7d37e962c5e8f5acd3770750ac80225e2df652ce5672fd34500af"),
+            generate_fsverity_digest_sequentially(&vec![1; 4096])?
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn merkle_tree_more_sizes() -> Result<()> {
+        // Test files that contains >4096 '\01's.
+
+        assert_eq!(
+            to_u8_vec("2901b849fda2d91e3929524561c4a47e77bb64734319759507b2029f18b9cc52"),
+            generate_fsverity_digest_sequentially(&vec![1; 4097])?
+        );
+
+        assert_eq!(
+            to_u8_vec("2a476d58eb80394052a3a783111e1458ac3ecf68a7878183fed86ca0ff47ec0d"),
+            generate_fsverity_digest_sequentially(&vec![1; 8192])?
+        );
+
+        // Test with max size that still fits in 2 levels.
+        assert_eq!(
+            to_u8_vec("26b7c190a34e19f420808ee7ec233b09fa6c34543b5a9d2950530114c205d14f"),
+            generate_fsverity_digest_sequentially(&vec![1; 524288])?
+        );
+
+        // Test with data that requires 3 levels.
+        assert_eq!(
+            to_u8_vec("316835d9be1c95b5cd55d07ae7965d651689efad186e26cbf680e40b683a3262"),
+            generate_fsverity_digest_sequentially(&vec![1; 524289])?
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn merkle_tree_non_sequential() -> Result<()> {
+        let mut tree = MerkleLeaves::new();
+        let hash = Sha256Hasher::new()?.update(&vec![1u8; CHUNK_SIZE as usize])?.finalize()?;
+
+        // Update hashes of 4 1-blocks.
+        tree.update_hash(1, &hash, CHUNK_SIZE * 2);
+        tree.update_hash(3, &hash, CHUNK_SIZE * 4);
+        tree.update_hash(0, &hash, CHUNK_SIZE);
+        tree.update_hash(2, &hash, CHUNK_SIZE * 3);
+
+        assert_eq!(
+            to_u8_vec("7d3c0d2e1dc54230b20ed875f5f3a4bd3f9873df601936b3ca8127d4db3548f3"),
+            tree.calculate_fsverity_digest()?
+        );
+        Ok(())
+    }
+
+    fn generate_fsverity_digest_sequentially(test_data: &[u8]) -> Result<Sha256Hash> {
+        let mut tree = MerkleLeaves::new();
+        for (index, chunk) in test_data.chunks(CHUNK_SIZE as usize).enumerate() {
+            let hash = Sha256Hasher::new()?
+                .update(&chunk)?
+                .update(&vec![0u8; CHUNK_SIZE as usize - chunk.len()])?
+                .finalize()?;
+
+            tree.update_hash(index, &hash, CHUNK_SIZE * index as u64 + chunk.len() as u64);
+        }
+        Ok(tree.calculate_fsverity_digest()?)
+    }
+
+    fn to_u8_vec(hex_str: &str) -> Vec<u8> {
+        assert!(hex_str.len() % 2 == 0);
+        (0..hex_str.len())
+            .step_by(2)
+            .map(|i| u8::from_str_radix(&hex_str[i..i + 2], 16).unwrap())
+            .collect()
+    }
+}
diff --git a/authfs/src/fsverity/common.rs b/authfs/src/fsverity/common.rs
new file mode 100644
index 0000000..8889f5c
--- /dev/null
+++ b/authfs/src/fsverity/common.rs
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use std::io;
+
+use thiserror::Error;
+
+use super::sys::{FS_VERITY_HASH_ALG_SHA256, FS_VERITY_LOG_BLOCKSIZE, FS_VERITY_VERSION};
+use crate::common::{divide_roundup, CHUNK_SIZE};
+use crate::crypto::{CryptoError, Sha256Hash, Sha256Hasher};
+
+#[derive(Error, Debug)]
+pub enum FsverityError {
+    #[error("Cannot verify a signature")]
+    BadSignature,
+    #[error("Insufficient data, only got {0}")]
+    InsufficientData(usize),
+    #[error("Cannot verify a block")]
+    CannotVerify,
+    #[error("I/O error")]
+    Io(#[from] io::Error),
+    #[error("Crypto")]
+    UnexpectedCryptoError(#[from] CryptoError),
+    #[error("Invalid state")]
+    InvalidState,
+}
+
+fn log128_ceil(num: u64) -> Option<u64> {
+    match num {
+        0 => None,
+        n => Some(divide_roundup(64 - (n - 1).leading_zeros() as u64, 7)),
+    }
+}
+
+/// Return the Merkle tree height for our tree configuration, or None if the size is 0.
+pub fn merkle_tree_height(data_size: u64) -> Option<u64> {
+    let hashes_per_node = CHUNK_SIZE / Sha256Hasher::HASH_SIZE as u64;
+    let hash_pages = divide_roundup(data_size, hashes_per_node * CHUNK_SIZE);
+    log128_ceil(hash_pages)
+}
+
+pub fn build_fsverity_digest(
+    root_hash: &Sha256Hash,
+    file_size: u64,
+) -> Result<Sha256Hash, CryptoError> {
+    // Little-endian byte representation of fsverity_descriptor from linux/fsverity.h
+    // Not FFI-ed as it seems easier to deal with the raw bytes manually.
+    Sha256Hasher::new()?
+        .update(&FS_VERITY_VERSION.to_le_bytes())? // version
+        .update(&FS_VERITY_HASH_ALG_SHA256.to_le_bytes())? // hash_algorithm
+        .update(&FS_VERITY_LOG_BLOCKSIZE.to_le_bytes())? // log_blocksize
+        .update(&0u8.to_le_bytes())? // salt_size
+        .update(&0u32.to_le_bytes())? // sig_size
+        .update(&file_size.to_le_bytes())? // data_size
+        .update(root_hash)? // root_hash, first 32 bytes
+        .update(&[0u8; 32])? // root_hash, last 32 bytes, always 0 because we are using sha256.
+        .update(&[0u8; 32])? // salt
+        .update(&[0u8; 32])? // reserved
+        .update(&[0u8; 32])? // reserved
+        .update(&[0u8; 32])? // reserved
+        .update(&[0u8; 32])? // reserved
+        .update(&[0u8; 16])? // reserved
+        .finalize()
+}
diff --git a/authfs/src/fsverity/sys.rs b/authfs/src/fsverity/sys.rs
new file mode 100644
index 0000000..b3222db
--- /dev/null
+++ b/authfs/src/fsverity/sys.rs
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/// Magic used in fs-verity digest
+pub const FS_VERITY_MAGIC: &[u8; 8] = b"FSVerity";
+
+/// fs-verity version that we are using
+pub const FS_VERITY_VERSION: u8 = 1;
+
+/// Hash algorithm to use from linux/fsverity.h
+pub const FS_VERITY_HASH_ALG_SHA256: u8 = 1;
+
+/// Log 2 of the block size (only 4096 is supported now)
+pub const FS_VERITY_LOG_BLOCKSIZE: u8 = 12;
diff --git a/authfs/src/fsverity/verifier.rs b/authfs/src/fsverity/verifier.rs
new file mode 100644
index 0000000..fd108f5
--- /dev/null
+++ b/authfs/src/fsverity/verifier.rs
@@ -0,0 +1,297 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use libc::EIO;
+use std::io;
+
+use super::common::{build_fsverity_digest, merkle_tree_height, FsverityError};
+use super::sys::{FS_VERITY_HASH_ALG_SHA256, FS_VERITY_MAGIC};
+use crate::auth::Authenticator;
+use crate::common::{divide_roundup, CHUNK_SIZE};
+use crate::crypto::{CryptoError, Sha256Hasher};
+use crate::reader::ReadOnlyDataByChunk;
+
+const ZEROS: [u8; CHUNK_SIZE as usize] = [0u8; CHUNK_SIZE as usize];
+
+// The size of `struct fsverity_formatted_digest` in Linux with SHA-256.
+const SIZE_OF_FSVERITY_FORMATTED_DIGEST_SHA256: usize = 12 + Sha256Hasher::HASH_SIZE;
+
+type HashBuffer = [u8; Sha256Hasher::HASH_SIZE];
+
+fn hash_with_padding(chunk: &[u8], pad_to: usize) -> Result<HashBuffer, CryptoError> {
+    let padding_size = pad_to - chunk.len();
+    Sha256Hasher::new()?.update(&chunk)?.update(&ZEROS[..padding_size])?.finalize()
+}
+
+fn verity_check<T: ReadOnlyDataByChunk>(
+    chunk: &[u8],
+    chunk_index: u64,
+    file_size: u64,
+    merkle_tree: &T,
+) -> Result<HashBuffer, FsverityError> {
+    // The caller should not be able to produce a chunk at the first place if `file_size` is 0. The
+    // current implementation expects to crash when a `ReadOnlyDataByChunk` implementation reads
+    // beyond the file size, including empty file.
+    assert_ne!(file_size, 0);
+
+    let chunk_hash = hash_with_padding(&chunk, CHUNK_SIZE as usize)?;
+
+    fsverity_walk(chunk_index, file_size, merkle_tree)?.try_fold(
+        chunk_hash,
+        |actual_hash, result| {
+            let (merkle_chunk, hash_offset_in_chunk) = result?;
+            let expected_hash =
+                &merkle_chunk[hash_offset_in_chunk..hash_offset_in_chunk + Sha256Hasher::HASH_SIZE];
+            if actual_hash != expected_hash {
+                return Err(FsverityError::CannotVerify);
+            }
+            Ok(hash_with_padding(&merkle_chunk, CHUNK_SIZE as usize)?)
+        },
+    )
+}
+
+/// Given a chunk index and the size of the file, returns an iterator that walks the Merkle tree
+/// from the leaf to the root. The iterator carries the slice of the chunk/node as well as the
+/// offset of the child node's hash. It is up to the iterator user to use the node and hash,
+/// e.g. for the actual verification.
+#[allow(clippy::needless_collect)]
+fn fsverity_walk<T: ReadOnlyDataByChunk>(
+    chunk_index: u64,
+    file_size: u64,
+    merkle_tree: &T,
+) -> Result<impl Iterator<Item = Result<([u8; 4096], usize), FsverityError>> + '_, FsverityError> {
+    let hashes_per_node = CHUNK_SIZE / Sha256Hasher::HASH_SIZE as u64;
+    debug_assert_eq!(hashes_per_node, 128u64);
+    let max_level = merkle_tree_height(file_size).expect("file should not be empty") as u32;
+    let root_to_leaf_steps = (0..=max_level)
+        .rev()
+        .map(|x| {
+            let leaves_per_hash = hashes_per_node.pow(x);
+            let leaves_size_per_hash = CHUNK_SIZE * leaves_per_hash;
+            let leaves_size_per_node = leaves_size_per_hash * hashes_per_node;
+            let nodes_at_level = divide_roundup(file_size, leaves_size_per_node);
+            let level_size = nodes_at_level * CHUNK_SIZE;
+            let offset_in_level = (chunk_index / leaves_per_hash) * Sha256Hasher::HASH_SIZE as u64;
+            (level_size, offset_in_level)
+        })
+        .scan(0, |level_offset, (level_size, offset_in_level)| {
+            let this_level_offset = *level_offset;
+            *level_offset += level_size;
+            let global_hash_offset = this_level_offset + offset_in_level;
+            Some(global_hash_offset)
+        })
+        .map(|global_hash_offset| {
+            let chunk_index = global_hash_offset / CHUNK_SIZE;
+            let hash_offset_in_chunk = (global_hash_offset % CHUNK_SIZE) as usize;
+            (chunk_index, hash_offset_in_chunk)
+        })
+        .collect::<Vec<_>>(); // Needs to collect first to be able to reverse below.
+
+    Ok(root_to_leaf_steps.into_iter().rev().map(move |(chunk_index, hash_offset_in_chunk)| {
+        let mut merkle_chunk = [0u8; 4096];
+        // read_chunk is supposed to return a full chunk, or an incomplete one at the end of the
+        // file. In the incomplete case, the hash is calculated with 0-padding to the chunk size.
+        // Therefore, we don't need to check the returned size here.
+        let _ = merkle_tree.read_chunk(chunk_index, &mut merkle_chunk)?;
+        Ok((merkle_chunk, hash_offset_in_chunk))
+    }))
+}
+
+fn build_fsverity_formatted_digest(
+    root_hash: &HashBuffer,
+    file_size: u64,
+) -> Result<[u8; SIZE_OF_FSVERITY_FORMATTED_DIGEST_SHA256], CryptoError> {
+    let digest = build_fsverity_digest(root_hash, file_size)?;
+    // Little-endian byte representation of fsverity_formatted_digest from linux/fsverity.h
+    // Not FFI-ed as it seems easier to deal with the raw bytes manually.
+    let mut formatted_digest = [0u8; SIZE_OF_FSVERITY_FORMATTED_DIGEST_SHA256];
+    formatted_digest[0..8].copy_from_slice(FS_VERITY_MAGIC);
+    formatted_digest[8..10].copy_from_slice(&(FS_VERITY_HASH_ALG_SHA256 as u16).to_le_bytes());
+    formatted_digest[10..12].copy_from_slice(&(Sha256Hasher::HASH_SIZE as u16).to_le_bytes());
+    formatted_digest[12..].copy_from_slice(&digest);
+    Ok(formatted_digest)
+}
+
+pub struct FsverityChunkedFileReader<F: ReadOnlyDataByChunk, M: ReadOnlyDataByChunk> {
+    chunked_file: F,
+    file_size: u64,
+    merkle_tree: M,
+    root_hash: HashBuffer,
+}
+
+impl<F: ReadOnlyDataByChunk, M: ReadOnlyDataByChunk> FsverityChunkedFileReader<F, M> {
+    pub fn new<A: Authenticator>(
+        authenticator: &A,
+        chunked_file: F,
+        file_size: u64,
+        sig: Vec<u8>,
+        merkle_tree: M,
+    ) -> Result<FsverityChunkedFileReader<F, M>, FsverityError> {
+        let mut buf = [0u8; CHUNK_SIZE as usize];
+        let size = merkle_tree.read_chunk(0, &mut buf)?;
+        if buf.len() != size {
+            return Err(FsverityError::InsufficientData(size));
+        }
+        let root_hash = Sha256Hasher::new()?.update(&buf[..])?.finalize()?;
+        let formatted_digest = build_fsverity_formatted_digest(&root_hash, file_size)?;
+        let valid = authenticator.verify(&sig, &formatted_digest)?;
+        if valid {
+            Ok(FsverityChunkedFileReader { chunked_file, file_size, merkle_tree, root_hash })
+        } else {
+            Err(FsverityError::BadSignature)
+        }
+    }
+}
+
+impl<F: ReadOnlyDataByChunk, M: ReadOnlyDataByChunk> ReadOnlyDataByChunk
+    for FsverityChunkedFileReader<F, M>
+{
+    fn read_chunk(&self, chunk_index: u64, buf: &mut [u8]) -> io::Result<usize> {
+        debug_assert!(buf.len() as u64 >= CHUNK_SIZE);
+        let size = self.chunked_file.read_chunk(chunk_index, buf)?;
+        let root_hash = verity_check(&buf[..size], chunk_index, self.file_size, &self.merkle_tree)
+            .map_err(|_| io::Error::from_raw_os_error(EIO))?;
+        if root_hash != self.root_hash {
+            Err(io::Error::from_raw_os_error(EIO))
+        } else {
+            Ok(size)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::auth::FakeAuthenticator;
+    use crate::reader::{ChunkedFileReader, ReadOnlyDataByChunk};
+    use anyhow::Result;
+    use std::fs::File;
+    use std::io::Read;
+
+    type LocalFsverityChunkedFileReader =
+        FsverityChunkedFileReader<ChunkedFileReader, ChunkedFileReader>;
+
+    fn total_chunk_number(file_size: u64) -> u64 {
+        (file_size + 4095) / 4096
+    }
+
+    // Returns a reader with fs-verity verification and the file size.
+    fn new_reader_with_fsverity(
+        content_path: &str,
+        merkle_tree_path: &str,
+        signature_path: &str,
+    ) -> Result<(LocalFsverityChunkedFileReader, u64)> {
+        let file_reader = ChunkedFileReader::new(File::open(content_path)?)?;
+        let file_size = file_reader.len();
+        let merkle_tree = ChunkedFileReader::new(File::open(merkle_tree_path)?)?;
+        let mut sig = Vec::new();
+        let _ = File::open(signature_path)?.read_to_end(&mut sig)?;
+        let authenticator = FakeAuthenticator::always_succeed();
+        Ok((
+            FsverityChunkedFileReader::new(
+                &authenticator,
+                file_reader,
+                file_size,
+                sig,
+                merkle_tree,
+            )?,
+            file_size,
+        ))
+    }
+
+    #[test]
+    fn fsverity_verify_full_read_4k() -> Result<()> {
+        let (file_reader, file_size) = new_reader_with_fsverity(
+            "testdata/input.4k",
+            "testdata/input.4k.merkle_dump",
+            "testdata/input.4k.fsv_sig",
+        )?;
+
+        for i in 0..total_chunk_number(file_size) {
+            let mut buf = [0u8; 4096];
+            assert!(file_reader.read_chunk(i, &mut buf[..]).is_ok());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn fsverity_verify_full_read_4k1() -> Result<()> {
+        let (file_reader, file_size) = new_reader_with_fsverity(
+            "testdata/input.4k1",
+            "testdata/input.4k1.merkle_dump",
+            "testdata/input.4k1.fsv_sig",
+        )?;
+
+        for i in 0..total_chunk_number(file_size) {
+            let mut buf = [0u8; 4096];
+            assert!(file_reader.read_chunk(i, &mut buf[..]).is_ok());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn fsverity_verify_full_read_4m() -> Result<()> {
+        let (file_reader, file_size) = new_reader_with_fsverity(
+            "testdata/input.4m",
+            "testdata/input.4m.merkle_dump",
+            "testdata/input.4m.fsv_sig",
+        )?;
+
+        for i in 0..total_chunk_number(file_size) {
+            let mut buf = [0u8; 4096];
+            assert!(file_reader.read_chunk(i, &mut buf[..]).is_ok());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn fsverity_verify_bad_merkle_tree() -> Result<()> {
+        let (file_reader, _) = new_reader_with_fsverity(
+            "testdata/input.4m",
+            "testdata/input.4m.merkle_dump.bad", // First leaf node is corrupted.
+            "testdata/input.4m.fsv_sig",
+        )?;
+
+        // A lowest broken node (a 4K chunk that contains 128 sha256 hashes) will fail the read
+        // failure of the underlying chunks, but not before or after.
+        let mut buf = [0u8; 4096];
+        let num_hashes = 4096 / 32;
+        let last_index = num_hashes;
+        for i in 0..last_index {
+            assert!(file_reader.read_chunk(i, &mut buf[..]).is_err());
+        }
+        assert!(file_reader.read_chunk(last_index, &mut buf[..]).is_ok());
+        Ok(())
+    }
+
+    #[test]
+    fn invalid_signature() -> Result<()> {
+        let authenticator = FakeAuthenticator::always_fail();
+        let file_reader = ChunkedFileReader::new(File::open("testdata/input.4m")?)?;
+        let file_size = file_reader.len();
+        let merkle_tree = ChunkedFileReader::new(File::open("testdata/input.4m.merkle_dump")?)?;
+        let sig = include_bytes!("../../testdata/input.4m.fsv_sig").to_vec();
+        assert!(FsverityChunkedFileReader::new(
+            &authenticator,
+            file_reader,
+            file_size,
+            sig,
+            merkle_tree
+        )
+        .is_err());
+        Ok(())
+    }
+}
diff --git a/authfs/src/fusefs.rs b/authfs/src/fusefs.rs
index 0dfd0af..f5dd6ec 100644
--- a/authfs/src/fusefs.rs
+++ b/authfs/src/fusefs.rs
@@ -29,14 +29,11 @@
 use fuse::filesystem::{Context, DirEntry, DirectoryIterator, Entry, FileSystem, ZeroCopyWriter};
 use fuse::mount::MountOption;
 
-use crate::common::{divide_roundup, COMMON_PAGE_SIZE};
+use crate::common::{divide_roundup, CHUNK_SIZE};
 use crate::fsverity::FsverityChunkedFileReader;
 use crate::reader::{ChunkedFileReader, ReadOnlyDataByChunk};
 use crate::remote_file::{RemoteChunkedFileReader, RemoteFsverityMerkleTreeReader};
 
-// We're reading the backing file by chunk, so setting the block size to be the same.
-const BLOCK_SIZE: usize = COMMON_PAGE_SIZE as usize;
-
 const DEFAULT_METADATA_TIMEOUT: std::time::Duration = Duration::from_secs(5);
 
 pub type Inode = u64;
@@ -89,9 +86,9 @@
 
 cfg_if::cfg_if! {
     if #[cfg(all(target_arch = "aarch64", target_pointer_width = "64"))] {
-        fn blk_size() -> libc::c_int { BLOCK_SIZE as libc::c_int }
+        fn blk_size() -> libc::c_int { CHUNK_SIZE as libc::c_int }
     } else {
-        fn blk_size() -> libc::c_long { BLOCK_SIZE as libc::c_long }
+        fn blk_size() -> libc::c_long { CHUNK_SIZE as libc::c_long }
     }
 }
 
@@ -135,7 +132,7 @@
             return None;
         }
         let chunk_data_size =
-            std::cmp::min(self.remaining, BLOCK_SIZE - (self.offset % BLOCK_SIZE as u64) as usize);
+            std::cmp::min(self.remaining, (CHUNK_SIZE - self.offset % CHUNK_SIZE) as usize);
         let retval = (self.offset, chunk_data_size);
         self.offset += chunk_data_size as u64;
         self.remaining = self.remaining.saturating_sub(chunk_data_size);
@@ -144,7 +141,7 @@
 }
 
 fn offset_to_chunk_index(offset: u64) -> u64 {
-    offset / BLOCK_SIZE as u64
+    offset / CHUNK_SIZE
 }
 
 fn read_chunks<W: io::Write, T: ReadOnlyDataByChunk>(
@@ -163,13 +160,13 @@
             // instead of accepting a buffer, the writer could expose the final destination buffer
             // for the reader to write to. It might not be generally applicable though, e.g. with
             // virtio transport, the buffer may not be continuous.
-            let mut buf = [0u8; BLOCK_SIZE];
+            let mut buf = [0u8; CHUNK_SIZE as usize];
             let read_size = file.read_chunk(offset_to_chunk_index(current_offset), &mut buf)?;
             if read_size < planned_data_size {
                 return Err(io::Error::from_raw_os_error(libc::ENODATA));
             }
 
-            let begin = (current_offset % BLOCK_SIZE as u64) as usize;
+            let begin = (current_offset % CHUNK_SIZE) as usize;
             let end = begin + planned_data_size;
             let s = w.write(&buf[begin..end])?;
             if s != planned_data_size {
diff --git a/authfs/src/reader.rs b/authfs/src/reader.rs
index d365a41..0242afa 100644
--- a/authfs/src/reader.rs
+++ b/authfs/src/reader.rs
@@ -20,14 +20,11 @@
 use std::io::Result;
 use std::os::unix::fs::FileExt;
 
-use crate::common::COMMON_PAGE_SIZE;
+use crate::common::CHUNK_SIZE;
 
 /// A trait for reading data by chunks. The data is assumed readonly and has fixed length. Chunks
 /// can be read by specifying the chunk index. Only the last chunk may have incomplete chunk size.
 pub trait ReadOnlyDataByChunk {
-    /// Default chunk size.
-    const CHUNK_SIZE: u64 = COMMON_PAGE_SIZE;
-
     /// Read the `chunk_index`-th chunk to `buf`. Each slice/chunk has size `CHUNK_SIZE` except for
     /// the last one, which can be an incomplete chunk. `buf` is currently required to be large
     /// enough to hold a full chunk of data. Reading beyond the file size (including empty file)
@@ -35,10 +32,10 @@
     fn read_chunk(&self, chunk_index: u64, buf: &mut [u8]) -> Result<usize>;
 }
 
-fn chunk_index_to_range(size: u64, chunk_size: u64, chunk_index: u64) -> Result<(u64, u64)> {
-    let start = chunk_index * chunk_size;
+fn chunk_index_to_range(size: u64, chunk_index: u64) -> Result<(u64, u64)> {
+    let start = chunk_index * CHUNK_SIZE;
     assert!(start < size);
-    let end = std::cmp::min(size, start + chunk_size);
+    let end = std::cmp::min(size, start + CHUNK_SIZE);
     Ok((start, end))
 }
 
@@ -62,8 +59,8 @@
 
 impl ReadOnlyDataByChunk for ChunkedFileReader {
     fn read_chunk(&self, chunk_index: u64, buf: &mut [u8]) -> Result<usize> {
-        debug_assert!(buf.len() as u64 >= Self::CHUNK_SIZE);
-        let (start, end) = chunk_index_to_range(self.size, Self::CHUNK_SIZE, chunk_index)?;
+        debug_assert!(buf.len() as u64 >= CHUNK_SIZE);
+        let (start, end) = chunk_index_to_range(self.size, chunk_index)?;
         let size = (end - start) as usize;
         self.file.read_at(&mut buf[..size], start)
     }
diff --git a/authfs/src/remote_file.rs b/authfs/src/remote_file.rs
index 7c3d12e..01e803c 100644
--- a/authfs/src/remote_file.rs
+++ b/authfs/src/remote_file.rs
@@ -19,6 +19,7 @@
 use std::io::Write;
 use std::sync::{Arc, Mutex};
 
+use crate::common::CHUNK_SIZE;
 use crate::reader::ReadOnlyDataByChunk;
 
 use authfs_aidl_interface::aidl::com::android::virt::fs::IVirtFdService;
@@ -49,7 +50,7 @@
 
 impl ReadOnlyDataByChunk for RemoteChunkedFileReader {
     fn read_chunk(&self, chunk_index: u64, mut buf: &mut [u8]) -> io::Result<usize> {
-        let offset = i64::try_from(chunk_index * Self::CHUNK_SIZE)
+        let offset = i64::try_from(chunk_index * CHUNK_SIZE)
             .map_err(|_| io::Error::from_raw_os_error(libc::EOVERFLOW))?;
 
         let service = Arc::clone(&self.service);
@@ -77,7 +78,7 @@
 
 impl ReadOnlyDataByChunk for RemoteFsverityMerkleTreeReader {
     fn read_chunk(&self, chunk_index: u64, mut buf: &mut [u8]) -> io::Result<usize> {
-        let offset = i64::try_from(chunk_index * Self::CHUNK_SIZE)
+        let offset = i64::try_from(chunk_index * CHUNK_SIZE)
             .map_err(|_| io::Error::from_raw_os_error(libc::EOVERFLOW))?;
 
         let service = Arc::clone(&self.service);
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index ac6e055..8159d3d 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -46,6 +46,7 @@
     deps: [
         "init_second_stage",
         "microdroid_init_rc",
+        "ueventd.rc",
         "libbinder",
         "libstdc++",
         "logcat",
diff --git a/microdroid/README.md b/microdroid/README.md
index fef5997..e6cbec8 100644
--- a/microdroid/README.md
+++ b/microdroid/README.md
@@ -53,7 +53,24 @@
 
 ```
 $ adb shell 'HOME=/data/local/tmp; /apex/com.android.virt/bin/assemble_cvd < /dev/null'
-$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/crosvm run --disable-sandbox --bios=bootloader --serial=type=stdout --disk=cuttlefish_runtime/composite.img'
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/crosvm run --cid=5 --disable-sandbox --bios=bootloader --serial=type=stdout --disk=cuttlefish_runtime/composite.img'
 ```
 
-At this moment, this doesn't boot to the shell, but to the second-stage init.
+The CID in `--cid` parameter can be anything greater than 2 (`VMADDR_CID_HOST`).
+
+## ADB
+
+```
+$ adb forward tcp:8000 vsock:5:5555
+$ adb connect localhost:8000
+```
+
+`5` in `vsock:5` should match with the CID number that was given to `crosvm`.
+`5555` must be the value. `8000` however can be any port in the development
+machine.
+
+Done. Now you can log into microdroid. Have fun!
+
+```
+$ adb -s localhost:8000 shell
+```
diff --git a/microdroid/init.rc b/microdroid/init.rc
index 9500f7c..2c32b28 100644
--- a/microdroid/init.rc
+++ b/microdroid/init.rc
@@ -13,6 +13,9 @@
 # Cgroups are mounted right before early-init using list from /etc/cgroups.json
 on early-init
     start ueventd
+    setprop ro.apex.updatable true
+    setprop ro.debuggable 1
+    setprop ro.adb.secure 0
 
     # Generate ld.config.txt
     exec -- /system/bin/bootstrap/linkerconfig --target /linkerconfig
diff --git a/microdroid/uboot-env.txt b/microdroid/uboot-env.txt
index cdd2c19..d845086 100644
--- a/microdroid/uboot-env.txt
+++ b/microdroid/uboot-env.txt
@@ -1,12 +1,10 @@
 # Static u-boot environment variables for microdroid. See b/180481192
 
 # Boot the device following the Android boot procedure
-bootcmd=boot_android virtio -
+bootcmd=boot_android virtio 0#misc
 
 # Kernel commandlines
-bootargs=rdinit=/bin/init_vendor panic=-1 androidboot.first_stage_console=1 androidboot.hardware=microdroid androidboot.boot_devices=10000.pci
+bootargs=rdinit=/bin/init_vendor panic=-1 androidboot.first_stage_console=1 androidboot.hardware=microdroid androidboot.boot_devices=10000.pci androidboot.selinux=permissive
 
-# 0:2 is the misc partition
-bootdevice=0:2
 bootdelay=0
 fdtaddr=0x80000000
diff --git a/tests/Android.bp b/tests/Android.bp
new file mode 100644
index 0000000..1b747fe
--- /dev/null
+++ b/tests/Android.bp
@@ -0,0 +1,95 @@
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+kernel_version = "5.10"
+
+kernel_stem = "kernel_prebuilts-" + kernel_version
+kernel_modules_stem = "virt_device_prebuilts_kernel_modules-" + kernel_version
+
+cc_test {
+    name: "VirtualizationTestCases",
+    test_suites: ["device-tests"],
+    srcs: [
+        "common.cc",
+        "vsock_test.cc",
+    ],
+    local_include_dirs: ["include"],
+    data: [
+        ":virt_test_kernel",
+        ":virt_test_initramfs",
+        "vsock_config.json",
+    ],
+    static_libs: [
+        // The existence of the library in the system partition is not guaranteed.
+        // Let's have our own copy of it.
+        "android.system.virtmanager-cpp",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder",
+        "liblog",
+        "libutils",
+    ],
+}
+
+cc_defaults {
+    name: "virt_test_guest_binary",
+    static_libs: [
+        "libbase",
+        "liblog",
+    ],
+    static_executable: true,
+    installable: false,
+}
+
+cc_binary {
+    name: "virt_test_vsock_guest",
+    srcs: ["vsock_guest.cc"],
+    stem: "vsock_client",
+    defaults: ["virt_test_guest_binary"],
+}
+
+prebuilt_etc {
+    name: "virt_test_kernel",
+    src: "nofile",
+    arch: {
+        arm64: {
+            src: ":" + kernel_stem + "-arm64",
+        },
+        x86_64: {
+            src: ":" + kernel_stem + "-x86_64",
+        },
+    },
+}
+
+android_filesystem {
+    name: "virt_test_initramfs",
+    arch: {
+        arm64: {
+            deps: [kernel_modules_stem + "-arm64"],
+        },
+        x86_64: {
+            deps: [kernel_modules_stem + "-x86_64"],
+        },
+    },
+    deps: [
+        "virt_test_guest_init",
+        "virt_test_vsock_guest",
+    ],
+    type: "cpio",
+}
diff --git a/tests/hostside/AndroidTest.xml b/tests/AndroidTest.xml
similarity index 60%
rename from tests/hostside/AndroidTest.xml
rename to tests/AndroidTest.xml
index 0995881..1f42bff 100644
--- a/tests/hostside/AndroidTest.xml
+++ b/tests/AndroidTest.xml
@@ -14,7 +14,7 @@
      limitations under the License.
 -->
 
-<configuration description="Config for Virtualization host tests">
+<configuration description="Config for Virtualization tests">
 
     <!-- Basic checks that the device has all the prerequisites. -->
     <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
@@ -33,18 +33,27 @@
     <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
         <option name="cleanup" value="true" />
         <option name="abort-on-push-failure" value="true" />
-        <option name="push-file" key="vm_config.json" value="/data/local/tmp/virt-test/vm_config.json" />
-        <option name="push-file" key="virt_hostside_tests_kernel" value="/data/local/tmp/virt-test/kernel" />
-        <option name="push-file" key="virt_hostside_tests_initramfs.img" value="/data/local/tmp/virt-test/initramfs" />
-        <option name="push-file" key="vsock_server" value="/data/local/tmp/virt-test/vsock_server" />
+        <option name="push-file" key="VirtualizationTestCases" value="/data/local/tmp/virt-test/VirtualizationTestCases" />
+        <option name="push-file" key="virt_test_kernel"        value="/data/local/tmp/virt-test/kernel" />
+        <option name="push-file" key="virt_test_initramfs.img" value="/data/local/tmp/virt-test/initramfs" />
+        <option name="push-file" key="vsock_config.json"       value="/data/local/tmp/virt-test/vsock_config.json" />
     </target_preparer>
 
     <!-- Root currently needed to run CrosVM.
          TODO: Give sufficient permissions to the adb shell user (b/171240450). -->
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer"/>
 
-    <test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
-        <option name="jar" value="VirtualizationHostTestCases.jar" />
-        <option name="runtime-hint" value="2m" />
+    <!-- Run Virt Manager for the duration of the test.
+         TODO: Run Virt Manager as a system service. -->
+    <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
+        <option name="throw-if-cmd-fail" value="true" />
+        <option name="run-bg-command" value="/apex/com.android.virt/bin/virtmanager" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp/virt-test" />
+        <option name="module-name" value="VirtualizationTestCases" />
+        <!-- test-timeout unit is ms, value = 2 minutes -->
+        <option name="native-test-timeout" value="120000" />
     </test>
 </configuration>
diff --git a/tests/common.cc b/tests/common.cc
new file mode 100644
index 0000000..10c98b6
--- /dev/null
+++ b/tests/common.cc
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "virt/VirtualizationTest.h"
+
+namespace virt {
+
+void VirtualizationTest::SetUp() {
+    status_t err = getService<IVirtManager>(String16("android.system.virtmanager"), &mVirtManager);
+    ASSERT_EQ(err, 0);
+}
+
+} // namespace virt
diff --git a/tests/hostside/Android.bp b/tests/hostside/Android.bp
deleted file mode 100644
index 7946080..0000000
--- a/tests/hostside/Android.bp
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright (C) 2020 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-kernel_version = "5.10"
-
-kernel_stem = "kernel_prebuilts-" + kernel_version
-kernel_modules_stem = "virt_device_prebuilts_kernel_modules-" + kernel_version
-
-// JAR containing all virtualization host-side tests.
-java_test_host {
-    name: "VirtualizationHostTestCases",
-    srcs: ["java/**/*.java"],
-    test_suites: ["device-tests"],
-    libs: ["tradefed"],
-    data: [
-        ":virt_hostside_tests_kernel",
-        ":virt_hostside_tests_initramfs",
-        ":virt_hostside_tests_vm_config",
-    ],
-    required: [
-        "virt_hostside_tests_vsock_server",
-    ],
-}
-
-prebuilt_etc {
-    name: "virt_hostside_tests_kernel",
-    src: "nofile",
-    arch: {
-        arm64: {
-            src: ":" + kernel_stem + "-arm64",
-        },
-        x86_64: {
-            src: ":" + kernel_stem + "-x86_64",
-        },
-    },
-}
-
-// Copy config files to output directory so that AndroidTest.xml can copy them to the device.
-filegroup {
-    name: "virt_hostside_tests_vm_config",
-    srcs: ["vm_config.json"],
-}
-
-android_filesystem {
-    name: "virt_hostside_tests_initramfs",
-    arch: {
-        arm64: {
-            deps: [kernel_modules_stem + "-arm64"],
-        },
-        x86_64: {
-            deps: [kernel_modules_stem + "-x86_64"],
-        },
-    },
-    deps: [
-        "virt_hostside_tests_guest_init",
-        "virt_hostside_tests_vsock_client",
-    ],
-    type: "cpio",
-}
diff --git a/tests/hostside/java/android/virt/test/VirtTestCase.java b/tests/hostside/java/android/virt/test/VirtTestCase.java
deleted file mode 100644
index 5c030a8..0000000
--- a/tests/hostside/java/android/virt/test/VirtTestCase.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.virt.test;
-
-import static org.junit.Assert.*;
-
-import com.android.tradefed.testtype.DeviceTestCase;
-
-import org.junit.Before;
-
-import java.util.ArrayList;
-
-public abstract class VirtTestCase extends DeviceTestCase {
-
-    private static final String DEVICE_DIR = "/data/local/tmp/virt-test";
-
-    @Before
-    public void setUp() throws Exception {
-        getDevice().waitForDeviceAvailable();
-    }
-
-    protected String getDevicePathForTestBinary(String targetName) throws Exception {
-        String path = String.format("%s/%s", DEVICE_DIR, targetName);
-        if (!getDevice().doesFileExist(path)) {
-            throw new IllegalArgumentException(String.format(
-                    "Binary for target %s not found on device at \"%s\"", targetName, path));
-        }
-        return path;
-    }
-
-    protected static String createCommand(String prog, Object... args) {
-        ArrayList<String> strings = new ArrayList<>();
-        strings.add(prog);
-        for (Object arg : args) {
-            strings.add(arg.toString());
-        }
-        for (String str : strings) {
-            if (str.indexOf(' ') != -1) {
-                throw new IllegalArgumentException("TODO: implement quotes around arguments");
-            } else if (str.indexOf('\'') != -1) {
-                throw new IllegalArgumentException("TODO: implement escaping arguments");
-            }
-        }
-        return String.join(" ", strings);
-    }
-
-}
diff --git a/tests/hostside/java/android/virt/test/VsockTest.java b/tests/hostside/java/android/virt/test/VsockTest.java
deleted file mode 100644
index 9de4f2e..0000000
--- a/tests/hostside/java/android/virt/test/VsockTest.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.virt.test;
-
-import com.android.tradefed.log.LogUtil.CLog;
-import com.android.tradefed.util.CommandResult;
-
-import org.junit.Test;
-
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-
-public class VsockTest extends VirtTestCase {
-    private static final long     TIMEOUT = 2L;
-    private static final TimeUnit TIMEOUT_UNIT = TimeUnit.MINUTES;
-    private static final int      RETRIES = 0;
-
-    private static final Integer  GUEST_PORT = 45678;
-    private static final String   TEST_MESSAGE = "HelloWorld";
-
-    private static final String   SERVER_TARGET = "vsock_server";
-    private static final String   VIRT_MANAGER_COMMAND = "/apex/com.android.virt/bin/virtmanager";
-
-    @Test
-    public void testVsockServer() throws Exception {
-        ExecutorService executor = Executors.newFixedThreadPool(2);
-
-        final String serverPath = getDevicePathForTestBinary(SERVER_TARGET);
-        final String vmConfigPath = getDevicePathForTestBinary("vm_config.json");
-        final String serverCmd = createCommand(serverPath, GUEST_PORT, vmConfigPath);
-
-        // Start Virt Manager. This will eventually be a system service, but for now we run it
-        // manually.
-        Future<?> virtManagerTask = executor.submit(() -> {
-            CommandResult res = getDevice().executeShellV2Command(
-                    VIRT_MANAGER_COMMAND, TIMEOUT, TIMEOUT_UNIT, RETRIES);
-            CLog.d(res.getStdout());
-            return null;
-        });
-
-        // Start server in Android that listens for vsock connections.
-        // It will receive a message from a client in the guest VM.
-        Future<?> serverTask = executor.submit(() -> {
-            CommandResult res = getDevice().executeShellV2Command(
-                    serverCmd, TIMEOUT, TIMEOUT_UNIT, RETRIES);
-            assertEquals(TEST_MESSAGE, res.getStdout().trim());
-            return null;
-        });
-
-        // Wait for the server to finish processing the message.
-        serverTask.get(TIMEOUT, TIMEOUT_UNIT);
-    }
-}
diff --git a/tests/hostside/native/vsock/Android.bp b/tests/hostside/native/vsock/Android.bp
deleted file mode 100644
index 5151d62..0000000
--- a/tests/hostside/native/vsock/Android.bp
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright (C) 2020 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-cc_test {
-    name: "virt_hostside_tests_vsock_server",
-    srcs: ["server.cc"],
-    static_libs: [
-        // The existence of the library in the system partition is not guaranteed.
-        // Let's have our own copy of it.
-        "android.system.virtmanager-cpp",
-    ],
-    shared_libs: [
-        "libbase",
-        "libbinder",
-        "liblog",
-        "libutils",
-    ],
-    test_suites: ["device-tests"],
-    stem: "vsock_server",
-}
-
-cc_binary {
-    name: "virt_hostside_tests_vsock_client",
-    srcs: ["client.cc"],
-    static_libs: [
-        "libbase",
-        "liblog",
-    ],
-    static_executable: true,
-    installable: false,
-    stem: "vsock_client",
-}
diff --git a/tests/hostside/native/vsock/server.cc b/tests/hostside/native/vsock/server.cc
deleted file mode 100644
index 1a1aa37..0000000
--- a/tests/hostside/native/vsock/server.cc
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright (C) 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <sys/socket.h>
-#include <unistd.h>
-
-// Needs to be included after sys/socket.h
-#include <linux/vm_sockets.h>
-
-#include <iostream>
-
-#include "android-base/file.h"
-#include "android-base/logging.h"
-#include "android-base/parseint.h"
-#include "android-base/unique_fd.h"
-#include "android/system/virtmanager/IVirtManager.h"
-#include "android/system/virtmanager/IVirtualMachine.h"
-#include "binder/IServiceManager.h"
-
-using namespace android;
-using namespace android::base;
-using namespace android::system::virtmanager;
-
-int main(int argc, const char *argv[]) {
-    unsigned int port;
-    if (argc != 3 || !ParseUint(argv[1], &port)) {
-        LOG(ERROR) << "Usage: " << argv[0] << " <port> <vm_config.json>";
-        return EXIT_FAILURE;
-    }
-    String16 vm_config(argv[2]);
-
-    unique_fd server_fd(TEMP_FAILURE_RETRY(socket(AF_VSOCK, SOCK_STREAM, 0)));
-    if (server_fd < 0) {
-        PLOG(ERROR) << "socket";
-        return EXIT_FAILURE;
-    }
-
-    struct sockaddr_vm server_sa = (struct sockaddr_vm){
-            .svm_family = AF_VSOCK,
-            .svm_port = port,
-            .svm_cid = VMADDR_CID_ANY,
-    };
-
-    int ret = TEMP_FAILURE_RETRY(bind(server_fd, (struct sockaddr *)&server_sa, sizeof(server_sa)));
-    if (ret != 0) {
-        PLOG(ERROR) << "bind";
-        return EXIT_FAILURE;
-    }
-
-    LOG(INFO) << "Listening on port " << port << "...";
-    ret = TEMP_FAILURE_RETRY(listen(server_fd, 1));
-    if (ret != 0) {
-        PLOG(ERROR) << "listen";
-        return EXIT_FAILURE;
-    }
-
-    LOG(INFO) << "Getting Virt Manager";
-    sp<IVirtManager> virt_manager;
-    status_t err = getService<IVirtManager>(String16("android.system.virtmanager"), &virt_manager);
-    if (err != 0) {
-        LOG(ERROR) << "Error getting Virt Manager from Service Manager: " << err;
-        return EXIT_FAILURE;
-    }
-    sp<IVirtualMachine> vm;
-    binder::Status status = virt_manager->startVm(vm_config, &vm);
-    if (!status.isOk()) {
-        LOG(ERROR) << "Error starting VM: " << status;
-        return EXIT_FAILURE;
-    }
-    int32_t cid;
-    status = vm->getCid(&cid);
-    if (!status.isOk()) {
-        LOG(ERROR) << "Error getting CID: " << status;
-        return EXIT_FAILURE;
-    }
-    LOG(INFO) << "VM starting with CID " << cid;
-
-    LOG(INFO) << "Accepting connection...";
-    struct sockaddr_vm client_sa;
-    socklen_t client_sa_len = sizeof(client_sa);
-    unique_fd client_fd(
-            TEMP_FAILURE_RETRY(accept(server_fd, (struct sockaddr *)&client_sa, &client_sa_len)));
-    if (client_fd < 0) {
-        PLOG(ERROR) << "accept";
-        return EXIT_FAILURE;
-    }
-    LOG(INFO) << "Connection from CID " << client_sa.svm_cid << " on port " << client_sa.svm_port;
-
-    LOG(INFO) << "Reading message from the client...";
-    std::string msg;
-    if (!ReadFdToString(client_fd, &msg)) {
-        PLOG(ERROR) << "ReadFdToString";
-        return EXIT_FAILURE;
-    }
-
-    // Print the received message to stdout.
-    std::cout << msg << std::endl;
-
-    LOG(INFO) << "Exiting...";
-    return EXIT_SUCCESS;
-}
diff --git a/tests/hostside/nofile b/tests/hostside/nofile
deleted file mode 100644
index eb4638a..0000000
--- a/tests/hostside/nofile
+++ /dev/null
@@ -1,2 +0,0 @@
-// This file is used as src of virt_hostside_tests_kernel module for the architectures
-// other than arm64 and x86_64
diff --git a/tests/include/virt/VirtualizationTest.h b/tests/include/virt/VirtualizationTest.h
new file mode 100644
index 0000000..a996f11
--- /dev/null
+++ b/tests/include/virt/VirtualizationTest.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "android/system/virtmanager/IVirtManager.h"
+#include "android/system/virtmanager/IVirtualMachine.h"
+#include "binder/IServiceManager.h"
+#include "gtest/gtest.h"
+
+using namespace android;
+using namespace android::system::virtmanager;
+
+namespace virt {
+
+class VirtualizationTest : public ::testing::Test {
+protected:
+    void SetUp() override;
+
+    sp<IVirtManager> mVirtManager;
+};
+
+} // namespace virt
diff --git a/tests/hostside/native/init/Android.bp b/tests/init/Android.bp
similarity index 94%
rename from tests/hostside/native/init/Android.bp
rename to tests/init/Android.bp
index f2c179b..1643acd 100644
--- a/tests/hostside/native/init/Android.bp
+++ b/tests/init/Android.bp
@@ -17,7 +17,7 @@
 }
 
 cc_binary {
-    name: "virt_hostside_tests_guest_init",
+    name: "virt_test_guest_init",
     srcs: ["main.cc"],
     static_executable: true,
     installable: false,
diff --git a/tests/hostside/native/init/main.cc b/tests/init/main.cc
similarity index 100%
rename from tests/hostside/native/init/main.cc
rename to tests/init/main.cc
diff --git a/tests/nofile b/tests/nofile
new file mode 100644
index 0000000..9e4b854
--- /dev/null
+++ b/tests/nofile
@@ -0,0 +1,2 @@
+// This file is used as src of virt_test_kernel module for the architectures
+// other than arm64 and x86_64
diff --git a/tests/hostside/vm_config.json b/tests/vsock_config.json
similarity index 100%
rename from tests/hostside/vm_config.json
rename to tests/vsock_config.json
diff --git a/tests/hostside/native/vsock/client.cc b/tests/vsock_guest.cc
similarity index 100%
rename from tests/hostside/native/vsock/client.cc
rename to tests/vsock_guest.cc
diff --git a/tests/vsock_test.cc b/tests/vsock_test.cc
new file mode 100644
index 0000000..74e984f
--- /dev/null
+++ b/tests/vsock_test.cc
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <sys/socket.h>
+#include <unistd.h>
+
+// Needs to be included after sys/socket.h
+#include <linux/vm_sockets.h>
+
+#include <iostream>
+
+#include "android-base/file.h"
+#include "android-base/logging.h"
+#include "android-base/parseint.h"
+#include "android-base/unique_fd.h"
+
+#include "virt/VirtualizationTest.h"
+
+using namespace android::base;
+
+namespace virt {
+
+static constexpr int kGuestPort = 45678;
+static constexpr const char kVmConfigPath[] = "/data/local/tmp/virt-test/vsock_config.json";
+static constexpr const char kTestMessage[] = "HelloWorld";
+
+TEST_F(VirtualizationTest, TestVsock) {
+    binder::Status status;
+
+    unique_fd server_fd(TEMP_FAILURE_RETRY(socket(AF_VSOCK, SOCK_STREAM, 0)));
+    ASSERT_GE(server_fd, 0) << strerror(errno);
+
+    struct sockaddr_vm server_sa = (struct sockaddr_vm){
+            .svm_family = AF_VSOCK,
+            .svm_port = kGuestPort,
+            .svm_cid = VMADDR_CID_ANY,
+    };
+
+    int ret = TEMP_FAILURE_RETRY(bind(server_fd, (struct sockaddr *)&server_sa, sizeof(server_sa)));
+    ASSERT_EQ(ret, 0) << strerror(errno);
+
+    LOG(INFO) << "Listening on port " << kGuestPort << "...";
+    ret = TEMP_FAILURE_RETRY(listen(server_fd, 1));
+    ASSERT_EQ(ret, 0) << strerror(errno);
+
+    sp<IVirtualMachine> vm;
+    status = mVirtManager->startVm(String16(kVmConfigPath), &vm);
+    ASSERT_TRUE(status.isOk()) << "Error starting VM: " << status;
+
+    int32_t cid;
+    status = vm->getCid(&cid);
+    ASSERT_TRUE(status.isOk()) << "Error getting CID: " << status;
+    LOG(INFO) << "VM starting with CID " << cid;
+
+    LOG(INFO) << "Accepting connection...";
+    struct sockaddr_vm client_sa;
+    socklen_t client_sa_len = sizeof(client_sa);
+    unique_fd client_fd(
+            TEMP_FAILURE_RETRY(accept(server_fd, (struct sockaddr *)&client_sa, &client_sa_len)));
+    ASSERT_GE(client_fd, 0) << strerror(errno);
+    LOG(INFO) << "Connection from CID " << client_sa.svm_cid << " on port " << client_sa.svm_port;
+
+    LOG(INFO) << "Reading message from the client...";
+    std::string msg;
+    ASSERT_TRUE(ReadFdToString(client_fd, &msg));
+
+    LOG(INFO) << "Received message: " << msg;
+    ASSERT_EQ(msg, kTestMessage);
+}
+
+} // namespace virt