diff --git a/apex/product_packages.mk b/apex/product_packages.mk
index ec295f5..5bc0044 100644
--- a/apex/product_packages.mk
+++ b/apex/product_packages.mk
@@ -32,4 +32,4 @@
 
 PRODUCT_SYSTEM_EXT_PROPERTIES := ro.config.isolated_compilation_enabled=true
 
-PRODUCT_SYSTEM_FSVERITY_GENERATE_METADATA := true
+PRODUCT_FSVERITY_GENERATE_METADATA := true
diff --git a/avmd/Android.bp b/avmd/Android.bp
index dc6a896..7237f5f 100644
--- a/avmd/Android.bp
+++ b/avmd/Android.bp
@@ -40,6 +40,9 @@
     name: "avmdtool_tests",
     srcs: ["tests/*_test.rs"],
     test_suites: ["general-tests"],
+    rustlibs: [
+        "libtempfile",
+    ],
     compile_multilib: "first",
     data_bins: ["avmdtool"],
     data: ["tests/data/*"],
diff --git a/avmd/tests/avmdtool_test.rs b/avmd/tests/avmdtool_test.rs
index d93cb6f..4647f06 100644
--- a/avmd/tests/avmdtool_test.rs
+++ b/avmd/tests/avmdtool_test.rs
@@ -16,19 +16,50 @@
 
 use std::fs;
 use std::process::Command;
+use tempfile::TempDir;
 
 #[test]
 fn test_dump() {
-    // test.avmd is generated with
-    // ```
-    // avmdtool create /tmp/test.amvd \
-    // --apex-payload microdroid vbmeta ./libs/apexutil/tests/data/test.apex \
-    // --apk microdroid_manager apk \
-    // ./libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk \
-    // --apk microdroid_manager extra-apk ./libs/apkverify/tests/data/v3-only-with-stamp.apk
-    //```
-    let output =
-        Command::new("./avmdtool").args(["dump", "tests/data/test.avmd"]).output().unwrap();
+    let filename = "tests/data/test.avmd";
+    assert!(
+        fs::metadata(filename).is_ok(),
+        "File '{}' does not exist. You can re-create it with:
+    avmdtool create {} \\
+    --apex-payload microdroid vbmeta tests/data/test.apex \\
+    --apk microdroid_manager apk \\
+    tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk \\
+    --apk microdroid_manager extra-apk tests/data/v3-only-with-stamp.apk",
+        filename,
+        filename
+    );
+    let output = Command::new("./avmdtool").args(["dump", filename]).output().unwrap();
     assert!(output.status.success());
     assert_eq!(output.stdout, fs::read("tests/data/test.avmd.dump").unwrap());
 }
+
+#[test]
+fn test_create() {
+    let test_dir = TempDir::new().unwrap();
+    let test_file_path = test_dir.path().join("tmp_test.amvd");
+    let output = Command::new("./avmdtool")
+        .args([
+            "create",
+            test_file_path.to_str().unwrap(),
+            "--apex-payload",
+            "microdroid",
+            "vbmeta",
+            "tests/data/test.apex",
+            "--apk",
+            "microdroid_manager",
+            "apk",
+            "tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk",
+            "--apk",
+            "microdroid_manager",
+            "extra-apk",
+            "tests/data/v3-only-with-stamp.apk",
+        ])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    assert_eq!(fs::read(test_file_path).unwrap(), fs::read("tests/data/test.avmd").unwrap());
+}
diff --git a/avmd/tests/data/test.apex b/avmd/tests/data/test.apex
new file mode 100644
index 0000000..fd79365
--- /dev/null
+++ b/avmd/tests/data/test.apex
Binary files differ
diff --git a/avmd/tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk b/avmd/tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk
new file mode 100644
index 0000000..0c9391c
--- /dev/null
+++ b/avmd/tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk
Binary files differ
diff --git a/avmd/tests/data/v3-only-with-stamp.apk b/avmd/tests/data/v3-only-with-stamp.apk
new file mode 100644
index 0000000..5f65214
--- /dev/null
+++ b/avmd/tests/data/v3-only-with-stamp.apk
Binary files differ
diff --git a/compos/benchmark/Android.bp b/compos/benchmark/Android.bp
index 37af87e..3d46a39 100644
--- a/compos/benchmark/Android.bp
+++ b/compos/benchmark/Android.bp
@@ -12,6 +12,7 @@
         "androidx.test.runner",
         "androidx.test.ext.junit",
         "MicrodroidDeviceTestHelper",
+        "MicrodroidTestHelper",
         "truth-prebuilt",
     ],
     platform_apis: true,
diff --git a/compos/benchmark/src/java/com/android/compos/benchmark/ComposBenchmark.java b/compos/benchmark/src/java/com/android/compos/benchmark/ComposBenchmark.java
index 21b2ecd..996d32a 100644
--- a/compos/benchmark/src/java/com/android/compos/benchmark/ComposBenchmark.java
+++ b/compos/benchmark/src/java/com/android/compos/benchmark/ComposBenchmark.java
@@ -26,8 +26,11 @@
 import android.os.ParcelFileDescriptor;
 import android.util.Log;
 
+import com.android.microdroid.test.common.MetricsProcessor;
+import com.android.microdroid.test.common.ProcessUtil;
 import com.android.microdroid.test.device.MicrodroidDeviceTestBase;
 
+import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -40,11 +43,15 @@
 import java.text.DateFormat;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
+import java.util.ArrayList;
 import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-
 @RunWith(JUnit4.class)
 public class ComposBenchmark extends MicrodroidDeviceTestBase {
     private static final String TAG = "ComposBenchmark";
@@ -53,100 +60,106 @@
     private static final double NANOS_IN_SEC = 1_000_000_000.0;
     private static final String METRIC_PREFIX = "avf_perf/compos/";
 
+    private final MetricsProcessor mMetricsProcessor = new MetricsProcessor(METRIC_PREFIX);
+
     private Instrumentation mInstrumentation;
 
     @Before
     public void setup() {
         mInstrumentation = getInstrumentation();
+        mInstrumentation.getUiAutomation().adoptShellPermissionIdentity();
     }
 
-    private void reportMetric(String name, String unit, double[] values) {
-        double sum = 0;
-        double squareSum = 0;
-        double min = Double.MAX_VALUE;
-        double max = Double.MIN_VALUE;
-
-        for (double val : values) {
-            sum += val;
-            squareSum += val * val;
-            min = val < min ? val : min;
-            max = val > max ? val : max;
-        }
-
-        double average = sum / values.length;
-        double variance = squareSum / values.length - average * average;
-        double stdev = Math.sqrt(variance);
-
-        Bundle bundle = new Bundle();
-        bundle.putDouble(METRIC_PREFIX + name + "_average_" + unit, average);
-        bundle.putDouble(METRIC_PREFIX + name + "_min_" + unit, min);
-        bundle.putDouble(METRIC_PREFIX + name + "_max_" + unit, max);
-        bundle.putDouble(METRIC_PREFIX + name + "_stdev_" + unit, stdev);
-        mInstrumentation.sendStatus(0, bundle);
-    }
-
-    public byte[] executeCommandBlocking(String command) {
-        try (
-            InputStream is = new ParcelFileDescriptor.AutoCloseInputStream(
-                getInstrumentation().getUiAutomation().executeShellCommand(command));
-            ByteArrayOutputStream out = new ByteArrayOutputStream()
-        ) {
-            byte[] buf = new byte[BUFFER_SIZE];
-            int length;
-            while ((length = is.read(buf)) >= 0) {
-                out.write(buf, 0, length);
-            }
-            return out.toByteArray();
-        } catch (IOException e) {
-            Log.e(TAG, "Error executing: " + command, e);
-            return null;
-        }
-    }
-
-    public String executeCommand(String command)
-            throws  InterruptedException, IOException {
-
-        getInstrumentation().getUiAutomation()
-                .adoptShellPermissionIdentity();
-        byte[] output = executeCommandBlocking(command);
-        getInstrumentation().getUiAutomation()
-                .dropShellPermissionIdentity();
-
-        if (output == null) {
-            throw new RuntimeException("Failed to run the command.");
-        } else {
-            String stdout = new String(output, "UTF-8");
-            Log.i(TAG, "Get stdout : " + stdout);
-            return stdout;
-        }
+    @After
+    public void tearDown() throws Exception {
+        mInstrumentation.getUiAutomation().dropShellPermissionIdentity();
     }
 
     @Test
-    public void testGuestCompileTime() throws InterruptedException, IOException {
-        assume().withMessage("Skip on CF; too slow").that(isCuttlefish()).isFalse();
+    public void testHostCompileTime() throws Exception {
+        final String command = "/apex/com.android.art/bin/odrefresh --force-compile";
 
-        final String command = "/apex/com.android.compos/bin/composd_cmd test-compile";
-
-        double[] compileTime = new double[ROUND_COUNT];
+        final List<Double> compileTimes = new ArrayList<>(ROUND_COUNT);
+        // The mapping is <memory metrics name> -> <all rounds value list>.
+        // EX : pss -> [10, 20, 30, ........]
+        final Map<String, List<Long>> processMemory = new HashMap<>();
 
         for (int round = 0; round < ROUND_COUNT; ++round) {
+
+            GetMetricsRunnable getMetricsRunnable =
+                    new GetMetricsRunnable("dex2oat64", processMemory);
+            Thread threadGetMetrics = new Thread(getMetricsRunnable);
+
+            threadGetMetrics.start();
+
+            Timestamp beforeCompileLatestTime = getLatestDex2oatSuccessTime();
+            Long compileStartTime = System.nanoTime();
+            executeCommand(command);
+            Long compileEndTime = System.nanoTime();
+            Timestamp afterCompileLatestTime = getLatestDex2oatSuccessTime();
+
+            assertTrue(afterCompileLatestTime != null);
+            assertTrue(
+                    beforeCompileLatestTime == null
+                            || beforeCompileLatestTime.before(afterCompileLatestTime));
+
+            double elapsedSec = (compileEndTime - compileStartTime) / NANOS_IN_SEC;
+            Log.i(TAG, "Compile time in host took " + elapsedSec + "s");
+            getMetricsRunnable.stop();
+
+            Log.i(TAG, "Waits for thread finish");
+            threadGetMetrics.join();
+            Log.i(TAG, "Thread is finish");
+
+            compileTimes.add(elapsedSec);
+        }
+
+        reportMetric("host_compile_time", "s", compileTimes);
+
+        reportAggregatedMetric(processMemory, "host_compile_dex2oat64_", "kB");
+    }
+
+    @Test
+    public void testGuestCompileTime() throws Exception {
+        assume().withMessage("Skip on CF; too slow").that(isCuttlefish()).isFalse();
+        final String command = "/apex/com.android.compos/bin/composd_cmd test-compile";
+
+        final List<Double> compileTimes = new ArrayList<>(ROUND_COUNT);
+        // The mapping is <memory metrics name> -> <all rounds value list>.
+        // EX : pss -> [10, 20, 30, ........]
+        final Map<String, List<Long>> processMemory = new HashMap<>();
+
+        for (int round = 0; round < ROUND_COUNT; ++round) {
+
+            GetMetricsRunnable getMetricsRunnable = new GetMetricsRunnable("crosvm", processMemory);
+            Thread threadGetMetrics = new Thread(getMetricsRunnable);
+
+            threadGetMetrics.start();
+
             Long compileStartTime = System.nanoTime();
             String output = executeCommand(command);
             Long compileEndTime = System.nanoTime();
-
             Pattern pattern = Pattern.compile("All Ok");
             Matcher matcher = pattern.matcher(output);
             assertTrue(matcher.find());
+            double elapsedSec = (compileEndTime - compileStartTime) / NANOS_IN_SEC;
+            Log.i(TAG, "Compile time in guest took " + elapsedSec + "s");
+            getMetricsRunnable.stop();
 
-            compileTime[round] = (compileEndTime - compileStartTime) / NANOS_IN_SEC;
+            Log.i(TAG, "Waits for thread finish");
+            threadGetMetrics.join();
+            Log.i(TAG, "Thread is finish");
+
+            compileTimes.add(elapsedSec);
         }
 
-        reportMetric("guest_compile_time", "s", compileTime);
+        reportMetric("guest_compile_time", "s", compileTimes);
+
+        reportAggregatedMetric(processMemory, "guest_compile_crosvm_", "kB");
     }
 
     private Timestamp getLatestDex2oatSuccessTime()
-            throws  InterruptedException, IOException, ParseException {
-
+            throws InterruptedException, IOException, ParseException {
         final String command = "logcat -d -e dex2oat";
         String output = executeCommand(command);
         String latestTime = null;
@@ -170,29 +183,106 @@
         return timeStampDate;
     }
 
-    @Test
-    public void testHostCompileTime()
-            throws InterruptedException, IOException, ParseException {
-
-        final String command = "/apex/com.android.art/bin/odrefresh --force-compile";
-
-        double[] compileTime = new double[ROUND_COUNT];
-
-        for (int round = 0; round < ROUND_COUNT; ++round) {
-            Timestamp beforeCompileLatestTime = getLatestDex2oatSuccessTime();
-            Long compileStartTime = System.nanoTime();
-            String output = executeCommand(command);
-            Long compileEndTime = System.nanoTime();
-            Timestamp afterCompileLatestTime = getLatestDex2oatSuccessTime();
-
-            assertTrue(afterCompileLatestTime != null);
-            assertTrue(beforeCompileLatestTime == null
-                    || beforeCompileLatestTime.before(afterCompileLatestTime));
-
-            compileTime[round] = (compileEndTime - compileStartTime) / NANOS_IN_SEC;
+    private void reportMetric(String name, String unit, List<? extends Number> values) {
+        Log.d(TAG, "Report metric " + name + "(" + unit + ") : " + values.toString());
+        Map<String, Double> stats = mMetricsProcessor.computeStats(values, name, unit);
+        Bundle bundle = new Bundle();
+        for (Map.Entry<String, Double> entry : stats.entrySet()) {
+            bundle.putDouble(entry.getKey(), entry.getValue());
         }
-
-        reportMetric("host_compile_time", "s", compileTime);
+        mInstrumentation.sendStatus(0, bundle);
     }
 
+    private void reportAggregatedMetric(
+            Map<String, List<Long>> processMemory, String prefix, String unit) {
+        processMemory.forEach((k, v) -> reportMetric(prefix + k, unit, v));
+    }
+
+    private byte[] executeCommandBlocking(String command) {
+        try (InputStream is =
+                        new ParcelFileDescriptor.AutoCloseInputStream(
+                                mInstrumentation.getUiAutomation().executeShellCommand(command));
+                ByteArrayOutputStream out = new ByteArrayOutputStream()) {
+            byte[] buf = new byte[BUFFER_SIZE];
+            int length;
+            while ((length = is.read(buf)) >= 0) {
+                out.write(buf, 0, length);
+            }
+            return out.toByteArray();
+        } catch (IOException e) {
+            Log.e(TAG, "Error executing: " + command, e);
+            return null;
+        }
+    }
+
+    private String executeCommand(String command) {
+        try {
+            byte[] output = executeCommandBlocking(command);
+
+            if (output == null) {
+                throw new RuntimeException("Failed to run the command.");
+            } else {
+                String stdout = new String(output, "UTF-8");
+                Log.i(TAG, "Get stdout : " + stdout);
+                return stdout;
+            }
+        } catch (Exception e) {
+            throw new RuntimeException("Error executing: " + command + " , Exception: " + e);
+        }
+    }
+
+    private class GetMetricsRunnable implements Runnable {
+        private final String mProcessName;
+        private Map<String, List<Long>> mProcessMemory;
+        private AtomicBoolean mStop = new AtomicBoolean(false);
+
+        GetMetricsRunnable(String processName, Map<String, List<Long>> processMemory) {
+            this.mProcessName = processName;
+            this.mProcessMemory = processMemory;
+        }
+
+        void stop() {
+            mStop.set(true);
+        }
+
+        public void run() {
+            while (!mStop.get()) {
+                try {
+                    updateProcessMemory(mProcessName, mProcessMemory);
+                    Thread.sleep(1000);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    return;
+                } catch (Exception e) {
+                    Log.e(TAG, "Get exception : " + e);
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+    }
+
+    private void updateProcessMemory(String processName, Map<String, List<Long>> processMemory)
+            throws Exception {
+        for (Map.Entry<Integer, String> process :
+                ProcessUtil.getProcessMap(this::executeCommand).entrySet()) {
+            int pId = process.getKey();
+            String pName = process.getValue();
+            if (pName.equalsIgnoreCase(processName)) {
+                for (Map.Entry<String, Long> stat :
+                        ProcessUtil.getProcessSmapsRollup(pId, this::executeCommand).entrySet()) {
+                    Log.i(
+                            TAG,
+                            "Get running process "
+                                    + pName
+                                    + " metrics : "
+                                    + stat.getKey().toLowerCase()
+                                    + '-'
+                                    + stat.getValue());
+                    processMemory
+                            .computeIfAbsent(stat.getKey().toLowerCase(), k -> new ArrayList<>())
+                            .add(stat.getValue());
+                }
+            }
+        }
+    }
 }
diff --git a/javalib/src/android/system/virtualmachine/VirtualMachine.java b/javalib/src/android/system/virtualmachine/VirtualMachine.java
index 828ac9f..ae84c08 100644
--- a/javalib/src/android/system/virtualmachine/VirtualMachine.java
+++ b/javalib/src/android/system/virtualmachine/VirtualMachine.java
@@ -45,11 +45,15 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
+import java.lang.ref.WeakReference;
 import java.nio.file.FileAlreadyExistsException;
 import java.nio.file.Files;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
+import java.util.WeakHashMap;
 import java.util.concurrent.Executor;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -65,6 +69,11 @@
  * @hide
  */
 public class VirtualMachine {
+    private static final Map<Context, Map<String, WeakReference<VirtualMachine>>> sInstances =
+            new WeakHashMap<>();
+
+    private static final Object sInstancesLock = new Object();
+
     /** Name of the directory under the files directory where all VMs created for the app exist. */
     private static final String VM_DIR = "vm";
 
@@ -159,6 +168,8 @@
 
     private final ExecutorService mExecutorService = Executors.newCachedThreadPool();
 
+    @NonNull private final Context mContext;
+
     static {
         System.loadLibrary("virtualmachine_jni");
     }
@@ -166,6 +177,7 @@
     private VirtualMachine(
             @NonNull Context context, @NonNull String name, @NonNull VirtualMachineConfig config)
             throws VirtualMachineException {
+        mContext = context;
         mPackageName = context.getPackageName();
         mName = name;
         mConfig = config;
@@ -231,6 +243,18 @@
             throw new VirtualMachineException("failed to create instance partition", e);
         }
 
+        synchronized (sInstancesLock) {
+            Map<String, WeakReference<VirtualMachine>> instancesMap;
+            if (sInstances.containsKey(context)) {
+                instancesMap = sInstances.get(context);
+            } else {
+                instancesMap = new HashMap<>();
+                sInstances.put(context, instancesMap);
+            }
+
+            instancesMap.put(name, new WeakReference<>(vm));
+        }
+
         return vm;
     }
 
@@ -249,7 +273,23 @@
             throw new VirtualMachineException(e);
         }
 
-        VirtualMachine vm = new VirtualMachine(context, name, config);
+        VirtualMachine vm;
+        synchronized (sInstancesLock) {
+            Map<String, WeakReference<VirtualMachine>> instancesMap;
+            if (sInstances.containsKey(context)) {
+                instancesMap = sInstances.get(context);
+            } else {
+                instancesMap = new HashMap<>();
+                sInstances.put(context, instancesMap);
+            }
+
+            if (instancesMap.containsKey(name)) {
+                vm = instancesMap.get(name).get();
+            } else {
+                vm = new VirtualMachine(context, name, config);
+                instancesMap.put(name, new WeakReference<>(vm));
+            }
+        }
 
         // If config file exists, but the instance image file doesn't, it means that the VM is
         // corrupted. That's different from the case that the VM doesn't exist. Throw an exception
@@ -544,6 +584,11 @@
         mInstanceFilePath.delete();
         mIdsigFilePath.delete();
         vmRootDir.delete();
+
+        synchronized (sInstancesLock) {
+            Map<String, WeakReference<VirtualMachine>> instancesMap = sInstances.get(mContext);
+            if (instancesMap != null) instancesMap.remove(mName);
+        }
     }
 
     /**
diff --git a/libs/apkverify/Android.bp b/libs/apkverify/Android.bp
index 50d7a60..9bb8f8e 100644
--- a/libs/apkverify/Android.bp
+++ b/libs/apkverify/Android.bp
@@ -13,9 +13,11 @@
         "libbyteorder",
         "libbytes",
         "liblog_rust",
+        "libnum_traits",
         "libopenssl",
         "libzip",
     ],
+    proc_macros: ["libnum_derive"],
 }
 
 rust_library {
diff --git a/libs/apkverify/src/algorithms.rs b/libs/apkverify/src/algorithms.rs
new file mode 100644
index 0000000..edfa946
--- /dev/null
+++ b/libs/apkverify/src/algorithms.rs
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! Algorithms used for APK Signature Scheme.
+
+use anyhow::{ensure, Result};
+use num_derive::FromPrimitive;
+use openssl::hash::MessageDigest;
+use openssl::pkey::{self, PKey};
+use openssl::rsa::Padding;
+use openssl::sign::Verifier;
+use std::cmp::Ordering;
+
+/// [Signature Algorithm IDs]: https://source.android.com/docs/security/apksigning/v2#signature-algorithm-ids
+///
+/// Some of the algorithms are not implemented. See b/197052981.
+#[derive(Clone, Debug, Eq, FromPrimitive)]
+#[repr(u32)]
+pub enum SignatureAlgorithmID {
+    RsaPssWithSha256 = 0x0101,
+    RsaPssWithSha512 = 0x0102,
+    RsaPkcs1V15WithSha256 = 0x0103,
+    RsaPkcs1V15WithSha512 = 0x0104,
+    EcdsaWithSha256 = 0x0201,
+    EcdsaWithSha512 = 0x0202,
+    DsaWithSha256 = 0x0301,
+    VerityRsaPkcs1V15WithSha256 = 0x0421,
+    VerityEcdsaWithSha256 = 0x0423,
+    VerityDsaWithSha256 = 0x0425,
+}
+
+impl Ord for SignatureAlgorithmID {
+    /// Ranks the signature algorithm according to the corresponding content
+    /// digest algorithm's rank.
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.to_content_digest_algorithm().cmp(&other.to_content_digest_algorithm())
+    }
+}
+
+impl PartialOrd for SignatureAlgorithmID {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl PartialEq for SignatureAlgorithmID {
+    fn eq(&self, other: &Self) -> bool {
+        self.cmp(other) == Ordering::Equal
+    }
+}
+
+impl SignatureAlgorithmID {
+    pub(crate) fn new_verifier<'a>(
+        &self,
+        public_key: &'a PKey<pkey::Public>,
+    ) -> Result<Verifier<'a>> {
+        ensure!(
+            !matches!(
+                self,
+                SignatureAlgorithmID::DsaWithSha256 | SignatureAlgorithmID::VerityDsaWithSha256
+            ),
+            "TODO(b/197052981): Algorithm '{:#?}' is not implemented.",
+            self
+        );
+        ensure!(public_key.id() == self.pkey_id(), "Public key has the wrong ID");
+        let mut verifier = Verifier::new(self.new_message_digest(), public_key)?;
+        if public_key.id() == pkey::Id::RSA {
+            verifier.set_rsa_padding(self.rsa_padding())?;
+        }
+        Ok(verifier)
+    }
+
+    /// Returns the message digest corresponding to the signature algorithm
+    /// according to the spec [Signature Algorithm IDs].
+    pub(crate) fn new_message_digest(&self) -> MessageDigest {
+        match self {
+            SignatureAlgorithmID::RsaPssWithSha256
+            | SignatureAlgorithmID::RsaPkcs1V15WithSha256
+            | SignatureAlgorithmID::EcdsaWithSha256
+            | SignatureAlgorithmID::DsaWithSha256
+            | SignatureAlgorithmID::VerityRsaPkcs1V15WithSha256
+            | SignatureAlgorithmID::VerityEcdsaWithSha256
+            | SignatureAlgorithmID::VerityDsaWithSha256 => MessageDigest::sha256(),
+            SignatureAlgorithmID::RsaPssWithSha512
+            | SignatureAlgorithmID::RsaPkcs1V15WithSha512
+            | SignatureAlgorithmID::EcdsaWithSha512 => MessageDigest::sha512(),
+        }
+    }
+
+    fn pkey_id(&self) -> pkey::Id {
+        match self {
+            SignatureAlgorithmID::RsaPssWithSha256
+            | SignatureAlgorithmID::RsaPssWithSha512
+            | SignatureAlgorithmID::RsaPkcs1V15WithSha256
+            | SignatureAlgorithmID::RsaPkcs1V15WithSha512
+            | SignatureAlgorithmID::VerityRsaPkcs1V15WithSha256 => pkey::Id::RSA,
+            SignatureAlgorithmID::EcdsaWithSha256
+            | SignatureAlgorithmID::EcdsaWithSha512
+            | SignatureAlgorithmID::VerityEcdsaWithSha256 => pkey::Id::EC,
+            SignatureAlgorithmID::DsaWithSha256 | SignatureAlgorithmID::VerityDsaWithSha256 => {
+                pkey::Id::DSA
+            }
+        }
+    }
+
+    fn rsa_padding(&self) -> Padding {
+        match self {
+            SignatureAlgorithmID::RsaPssWithSha256 | SignatureAlgorithmID::RsaPssWithSha512 => {
+                Padding::PKCS1_PSS
+            }
+            SignatureAlgorithmID::RsaPkcs1V15WithSha256
+            | SignatureAlgorithmID::VerityRsaPkcs1V15WithSha256
+            | SignatureAlgorithmID::RsaPkcs1V15WithSha512 => Padding::PKCS1,
+            SignatureAlgorithmID::EcdsaWithSha256
+            | SignatureAlgorithmID::EcdsaWithSha512
+            | SignatureAlgorithmID::VerityEcdsaWithSha256
+            | SignatureAlgorithmID::DsaWithSha256
+            | SignatureAlgorithmID::VerityDsaWithSha256 => Padding::NONE,
+        }
+    }
+
+    fn to_content_digest_algorithm(&self) -> ContentDigestAlgorithm {
+        match self {
+            SignatureAlgorithmID::RsaPssWithSha256
+            | SignatureAlgorithmID::RsaPkcs1V15WithSha256
+            | SignatureAlgorithmID::EcdsaWithSha256
+            | SignatureAlgorithmID::DsaWithSha256 => ContentDigestAlgorithm::ChunkedSha256,
+            SignatureAlgorithmID::RsaPssWithSha512
+            | SignatureAlgorithmID::RsaPkcs1V15WithSha512
+            | SignatureAlgorithmID::EcdsaWithSha512 => ContentDigestAlgorithm::ChunkedSha512,
+            SignatureAlgorithmID::VerityRsaPkcs1V15WithSha256
+            | SignatureAlgorithmID::VerityEcdsaWithSha256
+            | SignatureAlgorithmID::VerityDsaWithSha256 => {
+                ContentDigestAlgorithm::VerityChunkedSha256
+            }
+        }
+    }
+}
+
+/// The rank of the content digest algorithm in this enum is used to help pick
+/// v4 apk digest.
+/// According to APK Signature Scheme v4, [apk digest] is the first available
+/// content digest of the highest rank (rank N).
+///
+/// This rank was also used for step 3a of the v3 signature verification.
+///
+/// [apk digest]: https://source.android.com/docs/security/features/apksigning/v4#apk-digest
+/// [v3 verification]: https://source.android.com/docs/security/apksigning/v3#v3-verification
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+enum ContentDigestAlgorithm {
+    ChunkedSha256 = 1,
+    VerityChunkedSha256,
+    ChunkedSha512,
+}
diff --git a/libs/apkverify/src/bytes_ext.rs b/libs/apkverify/src/bytes_ext.rs
index 22a3085..8fb36ee 100644
--- a/libs/apkverify/src/bytes_ext.rs
+++ b/libs/apkverify/src/bytes_ext.rs
@@ -16,7 +16,7 @@
 
 //! Provides extension methods Bytes::read<T>(), which calls back ReadFromBytes::read_from_byte()
 
-use anyhow::{bail, Result};
+use anyhow::{ensure, Result};
 use bytes::{Buf, Bytes};
 use std::ops::Deref;
 
@@ -79,20 +79,18 @@
 }
 
 fn read_length_prefixed_slice(buf: &mut Bytes) -> Result<Bytes> {
-    if buf.remaining() < 4 {
-        bail!(
-            "Remaining buffer too short to contain length of length-prefixed field. Remaining: {}",
-            buf.remaining()
-        );
-    }
+    ensure!(
+        buf.remaining() >= 4,
+        "Remaining buffer too short to contain length of length-prefixed field. Remaining: {}",
+        buf.remaining()
+    );
     let len = buf.get_u32_le() as usize;
-    if len > buf.remaining() {
-        bail!(
-            "length-prefixed field longer than remaining buffer. Field length: {}, remaining: {}",
-            len,
-            buf.remaining()
-        );
-    }
+    ensure!(
+        buf.remaining() >= len,
+        "length-prefixed field longer than remaining buffer. Field length: {}, remaining: {}",
+        len,
+        buf.remaining()
+    );
     Ok(buf.split_to(len))
 }
 
diff --git a/libs/apkverify/src/lib.rs b/libs/apkverify/src/lib.rs
index c5aa9e5..040c304 100644
--- a/libs/apkverify/src/lib.rs
+++ b/libs/apkverify/src/lib.rs
@@ -16,6 +16,7 @@
 
 //! Verifies APK/APEX signing with v2/v3 scheme
 
+mod algorithms;
 mod bytes_ext;
 mod sigutil;
 #[allow(dead_code)]
@@ -23,5 +24,5 @@
 mod v3;
 mod ziputil;
 
-// TODO(jooyung) fallback to v2 when v3 not found
+// TODO(b/197052981) fallback to v2 when v3 not found
 pub use v3::{get_public_key_der, pick_v4_apk_digest, verify};
diff --git a/libs/apkverify/src/sigutil.rs b/libs/apkverify/src/sigutil.rs
index 6a7ce32..3832c09 100644
--- a/libs/apkverify/src/sigutil.rs
+++ b/libs/apkverify/src/sigutil.rs
@@ -16,19 +16,25 @@
 
 //! Utilities for Signature Verification
 
-use anyhow::{anyhow, bail, ensure, Error, Result};
+// TODO(b/246254355): Remove this once we migrate all the usages of
+// raw signature algorithm id to the enum.
+#![allow(dead_code)]
+
+use anyhow::{anyhow, ensure, Error, Result};
 use byteorder::{LittleEndian, ReadBytesExt};
 use bytes::{Buf, BufMut, Bytes, BytesMut};
+use num_traits::FromPrimitive;
 use openssl::hash::{DigestBytes, Hasher, MessageDigest};
 use std::cmp::min;
 use std::io::{self, Cursor, ErrorKind, Read, Seek, SeekFrom, Take};
 
+use crate::algorithms::SignatureAlgorithmID;
 use crate::ziputil::{set_central_directory_offset, zip_sections};
 
 const APK_SIG_BLOCK_MIN_SIZE: u32 = 32;
 const APK_SIG_BLOCK_MAGIC: u128 = 0x3234206b636f6c4220676953204b5041;
 
-// TODO(jooyung): introduce type
+// TODO(b/246254355): Migrates usages of raw signature algorithm id to the enum.
 pub const SIGNATURE_RSA_PSS_WITH_SHA256: u32 = 0x0101;
 pub const SIGNATURE_RSA_PSS_WITH_SHA512: u32 = 0x0102;
 pub const SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256: u32 = 0x0103;
@@ -40,13 +46,6 @@
 pub const SIGNATURE_VERITY_ECDSA_WITH_SHA256: u32 = 0x0423;
 pub const SIGNATURE_VERITY_DSA_WITH_SHA256: u32 = 0x0425;
 
-// TODO(jooyung): introduce type
-const CONTENT_DIGEST_CHUNKED_SHA256: u32 = 1;
-const CONTENT_DIGEST_CHUNKED_SHA512: u32 = 2;
-const CONTENT_DIGEST_VERITY_CHUNKED_SHA256: u32 = 3;
-#[allow(unused)]
-const CONTENT_DIGEST_SHA256: u32 = 4;
-
 const CHUNK_SIZE_BYTES: u64 = 1024 * 1024;
 
 /// The [APK structure] has four major sections:
@@ -97,7 +96,10 @@
     ///    order the chunks appear in the APK.
     /// (see https://source.android.com/security/apksigning/v2#integrity-protected-contents)
     pub fn compute_digest(&mut self, signature_algorithm_id: u32) -> Result<Vec<u8>> {
-        let digester = Digester::new(signature_algorithm_id)?;
+        // TODO(b/246254355): Passes the enum SignatureAlgorithmID directly to this method.
+        let signature_algorithm_id = SignatureAlgorithmID::from_u32(signature_algorithm_id)
+            .ok_or_else(|| anyhow!("Unsupported algorithm ID: {}", signature_algorithm_id))?;
+        let digester = Digester { message_digest: signature_algorithm_id.new_message_digest() };
 
         let mut digests_of_chunks = BytesMut::new();
         let mut chunk_count = 0u32;
@@ -163,30 +165,16 @@
 }
 
 struct Digester {
-    algorithm: MessageDigest,
+    message_digest: MessageDigest,
 }
 
 const CHUNK_HEADER_TOP: &[u8] = &[0x5a];
 const CHUNK_HEADER_MID: &[u8] = &[0xa5];
 
 impl Digester {
-    fn new(signature_algorithm_id: u32) -> Result<Digester> {
-        let digest_algorithm_id = to_content_digest_algorithm(signature_algorithm_id)?;
-        let algorithm = match digest_algorithm_id {
-            CONTENT_DIGEST_CHUNKED_SHA256 => MessageDigest::sha256(),
-            CONTENT_DIGEST_CHUNKED_SHA512 => MessageDigest::sha512(),
-            // TODO(jooyung): implement
-            CONTENT_DIGEST_VERITY_CHUNKED_SHA256 => {
-                bail!("TODO(b/190343842): CONTENT_DIGEST_VERITY_CHUNKED_SHA256: not implemented")
-            }
-            _ => bail!("Unknown digest algorithm: {}", digest_algorithm_id),
-        };
-        Ok(Digester { algorithm })
-    }
-
     // v2/v3 digests are computed after prepending "header" byte and "size" info.
     fn digest(&self, data: &[u8], header: &[u8], size: u32) -> Result<DigestBytes> {
-        let mut hasher = Hasher::new(self.algorithm)?;
+        let mut hasher = Hasher::new(self.message_digest)?;
         hasher.update(header)?;
         hasher.update(&size.to_le_bytes())?;
         hasher.update(data)?;
@@ -259,55 +247,6 @@
     Err(Error::new(io::Error::from(ErrorKind::NotFound)).context(context))
 }
 
-pub fn is_supported_signature_algorithm(algorithm_id: u32) -> bool {
-    matches!(
-        algorithm_id,
-        SIGNATURE_RSA_PSS_WITH_SHA256
-            | SIGNATURE_RSA_PSS_WITH_SHA512
-            | SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256
-            | SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512
-            | SIGNATURE_ECDSA_WITH_SHA256
-            | SIGNATURE_ECDSA_WITH_SHA512
-            | SIGNATURE_DSA_WITH_SHA256
-            | SIGNATURE_VERITY_RSA_PKCS1_V1_5_WITH_SHA256
-            | SIGNATURE_VERITY_ECDSA_WITH_SHA256
-            | SIGNATURE_VERITY_DSA_WITH_SHA256
-    )
-}
-
-fn to_content_digest_algorithm(algorithm_id: u32) -> Result<u32> {
-    match algorithm_id {
-        SIGNATURE_RSA_PSS_WITH_SHA256
-        | SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256
-        | SIGNATURE_ECDSA_WITH_SHA256
-        | SIGNATURE_DSA_WITH_SHA256 => Ok(CONTENT_DIGEST_CHUNKED_SHA256),
-        SIGNATURE_RSA_PSS_WITH_SHA512
-        | SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512
-        | SIGNATURE_ECDSA_WITH_SHA512 => Ok(CONTENT_DIGEST_CHUNKED_SHA512),
-        SIGNATURE_VERITY_RSA_PKCS1_V1_5_WITH_SHA256
-        | SIGNATURE_VERITY_ECDSA_WITH_SHA256
-        | SIGNATURE_VERITY_DSA_WITH_SHA256 => Ok(CONTENT_DIGEST_VERITY_CHUNKED_SHA256),
-        _ => bail!("Unknown signature algorithm: {}", algorithm_id),
-    }
-}
-
-/// This method is used to help pick v4 apk digest. According to APK Signature
-/// Scheme v4, apk digest is the first available content digest of the highest
-/// rank (rank N).
-///
-/// This rank was also used for step 3a of the v3 signature verification.
-///
-/// [v3 verification]: https://source.android.com/docs/security/apksigning/v3#v3-verification
-pub fn get_signature_algorithm_rank(algo: u32) -> Result<u32> {
-    let content_digest = to_content_digest_algorithm(algo)?;
-    match content_digest {
-        CONTENT_DIGEST_CHUNKED_SHA256 => Ok(0),
-        CONTENT_DIGEST_VERITY_CHUNKED_SHA256 => Ok(1),
-        CONTENT_DIGEST_CHUNKED_SHA512 => Ok(2),
-        _ => bail!("Unknown digest algorithm: {}", content_digest),
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/libs/apkverify/src/v3.rs b/libs/apkverify/src/v3.rs
index d429ba1..5313a9b 100644
--- a/libs/apkverify/src/v3.rs
+++ b/libs/apkverify/src/v3.rs
@@ -18,24 +18,23 @@
 //!
 //! [v3 verification]: https://source.android.com/security/apksigning/v3#verification
 
-use anyhow::{anyhow, bail, ensure, Context, Result};
+use anyhow::{ensure, Context, Result};
 use bytes::Bytes;
-use openssl::hash::MessageDigest;
+use num_traits::FromPrimitive;
 use openssl::pkey::{self, PKey};
-use openssl::rsa::Padding;
-use openssl::sign::Verifier;
 use openssl::x509::X509;
 use std::fs::File;
 use std::io::{Read, Seek};
 use std::ops::Range;
 use std::path::Path;
 
+use crate::algorithms::SignatureAlgorithmID;
 use crate::bytes_ext::{BytesExt, LengthPrefixed, ReadFromBytes};
 use crate::sigutil::*;
 
 pub const APK_SIGNATURE_SCHEME_V3_BLOCK_ID: u32 = 0xf05368c0;
 
-// TODO(jooyung): get "ro.build.version.sdk"
+// TODO(b/190343842): get "ro.build.version.sdk"
 const SDK_INT: u32 = 31;
 
 type Signers = LengthPrefixed<Vec<LengthPrefixed<Signer>>>;
@@ -71,6 +70,7 @@
 
 #[derive(Debug)]
 struct Signature {
+    /// TODO(b/246254355): Change the type of signature_algorithm_id to SignatureAlgorithmID
     signature_algorithm_id: u32,
     signature: LengthPrefixed<Bytes>,
 }
@@ -105,12 +105,11 @@
     let supported = signers.iter().filter(|s| s.sdk_range().contains(&SDK_INT)).collect::<Vec<_>>();
 
     // there should be exactly one
-    if supported.len() != 1 {
-        bail!(
-            "APK Signature Scheme V3 only supports one signer: {} signers found.",
-            supported.len()
-        )
-    }
+    ensure!(
+        supported.len() == 1,
+        "APK Signature Scheme V3 only supports one signer: {} signers found.",
+        supported.len()
+    );
 
     // Call the supplied function
     f((supported[0], sections))
@@ -143,9 +142,9 @@
         Ok(self
             .signatures
             .iter()
-            .filter(|sig| is_supported_signature_algorithm(sig.signature_algorithm_id))
-            .max_by_key(|sig| get_signature_algorithm_rank(sig.signature_algorithm_id).unwrap())
-            .ok_or_else(|| anyhow!("No supported signatures found"))?)
+            .filter(|sig| SignatureAlgorithmID::from_u32(sig.signature_algorithm_id).is_some())
+            .max_by_key(|sig| SignatureAlgorithmID::from_u32(sig.signature_algorithm_id).unwrap())
+            .context("No supported signatures found")?)
     }
 
     fn pick_v4_apk_digest(&self) -> Result<(u32, Box<[u8]>)> {
@@ -155,7 +154,7 @@
             .digests
             .iter()
             .find(|&dig| dig.signature_algorithm_id == strongest.signature_algorithm_id)
-            .ok_or_else(|| anyhow!("Digest not found"))?;
+            .context("Digest not found")?;
         Ok((digest.signature_algorithm_id, digest.digest.as_ref().to_vec().into_boxed_slice()))
     }
 
@@ -174,20 +173,20 @@
 
         // 3. Verify the min and max SDK versions in the signed data match those specified for the
         //    signer.
-        if self.sdk_range() != signed_data.sdk_range() {
-            bail!("SDK versions mismatch between signed and unsigned in v3 signer block.");
-        }
+        ensure!(
+            self.sdk_range() == signed_data.sdk_range(),
+            "SDK versions mismatch between signed and unsigned in v3 signer block."
+        );
 
         // 4. Verify that the ordered list of signature algorithm IDs in digests and signatures is
         //    identical. (This is to prevent signature stripping/addition.)
-        if !self
-            .signatures
-            .iter()
-            .map(|sig| sig.signature_algorithm_id)
-            .eq(signed_data.digests.iter().map(|dig| dig.signature_algorithm_id))
-        {
-            bail!("Signature algorithms don't match between digests and signatures records");
-        }
+        ensure!(
+            self.signatures
+                .iter()
+                .map(|sig| sig.signature_algorithm_id)
+                .eq(signed_data.digests.iter().map(|dig| dig.signature_algorithm_id)),
+            "Signature algorithms don't match between digests and signatures records"
+        );
 
         // 5. Compute the digest of APK contents using the same digest algorithm as the digest
         //    algorithm used by the signature algorithm.
@@ -199,60 +198,37 @@
         let computed = sections.compute_digest(digest.signature_algorithm_id)?;
 
         // 6. Verify that the computed digest is identical to the corresponding digest from digests.
-        if computed != digest.digest.as_ref() {
-            bail!(
-                "Digest mismatch: computed={:?} vs expected={:?}",
-                to_hex_string(&computed),
-                to_hex_string(&digest.digest),
-            );
-        }
+        ensure!(
+            computed == digest.digest.as_ref(),
+            "Digest mismatch: computed={:?} vs expected={:?}",
+            to_hex_string(&computed),
+            to_hex_string(&digest.digest),
+        );
 
         // 7. Verify that public key of the first certificate of certificates is identical
         //    to public key.
         let cert = signed_data.certificates.first().context("No certificates listed")?;
         let cert = X509::from_der(cert.as_ref())?;
-        if !cert.public_key()?.public_eq(&public_key) {
-            bail!("Public key mismatch between certificate and signature record");
-        }
+        ensure!(
+            cert.public_key()?.public_eq(&public_key),
+            "Public key mismatch between certificate and signature record"
+        );
 
-        // TODO(jooyung) 8. If the proof-of-rotation attribute exists for the signer verify that the struct is valid and this signer is the last certificate in the list.
+        // TODO(b/245914104)
+        // 8. If the proof-of-rotation attribute exists for the signer verify that the
+        // struct is valid and this signer is the last certificate in the list.
         Ok(self.public_key.to_vec().into_boxed_slice())
     }
 }
 
-fn verify_signed_data(data: &Bytes, signature: &Signature, key: &PKey<pkey::Public>) -> Result<()> {
-    let (pkey_id, padding, digest) = match signature.signature_algorithm_id {
-        SIGNATURE_RSA_PSS_WITH_SHA256 => {
-            (pkey::Id::RSA, Padding::PKCS1_PSS, MessageDigest::sha256())
-        }
-        SIGNATURE_RSA_PSS_WITH_SHA512 => {
-            (pkey::Id::RSA, Padding::PKCS1_PSS, MessageDigest::sha512())
-        }
-        SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256 | SIGNATURE_VERITY_RSA_PKCS1_V1_5_WITH_SHA256 => {
-            (pkey::Id::RSA, Padding::PKCS1, MessageDigest::sha256())
-        }
-        SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512 => {
-            (pkey::Id::RSA, Padding::PKCS1, MessageDigest::sha512())
-        }
-        SIGNATURE_ECDSA_WITH_SHA256 | SIGNATURE_VERITY_ECDSA_WITH_SHA256 => {
-            (pkey::Id::EC, Padding::NONE, MessageDigest::sha256())
-        }
-        // TODO(b/190343842) not implemented signature algorithm
-        SIGNATURE_ECDSA_WITH_SHA512
-        | SIGNATURE_DSA_WITH_SHA256
-        | SIGNATURE_VERITY_DSA_WITH_SHA256 => {
-            bail!(
-                "TODO(b/190343842) not implemented signature algorithm: {:#x}",
-                signature.signature_algorithm_id
-            );
-        }
-        _ => bail!("Unsupported signature algorithm: {:#x}", signature.signature_algorithm_id),
-    };
-    ensure!(key.id() == pkey_id, "Public key has the wrong ID");
-    let mut verifier = Verifier::new(digest, key)?;
-    if pkey_id == pkey::Id::RSA {
-        verifier.set_rsa_padding(padding)?;
-    }
+fn verify_signed_data(
+    data: &Bytes,
+    signature: &Signature,
+    public_key: &PKey<pkey::Public>,
+) -> Result<()> {
+    let mut verifier = SignatureAlgorithmID::from_u32(signature.signature_algorithm_id)
+        .context("Unsupported algorithm")?
+        .new_verifier(public_key)?;
     verifier.update(data)?;
     let verified = verifier.verify(&signature.signature)?;
     ensure!(verified, "Signature is invalid ");
@@ -260,7 +236,7 @@
 }
 
 // ReadFromBytes implementations
-// TODO(jooyung): add derive macro: #[derive(ReadFromBytes)]
+// TODO(b/190343842): add derive macro: #[derive(ReadFromBytes)]
 
 impl ReadFromBytes for Signer {
     fn read_from_bytes(buf: &mut Bytes) -> Result<Self> {
diff --git a/libs/apkverify/src/ziputil.rs b/libs/apkverify/src/ziputil.rs
index 8badff2..eb2826a 100644
--- a/libs/apkverify/src/ziputil.rs
+++ b/libs/apkverify/src/ziputil.rs
@@ -16,7 +16,7 @@
 
 //! Utilities for zip handling of APK files.
 
-use anyhow::{bail, Result};
+use anyhow::{ensure, Result};
 use bytes::{Buf, BufMut};
 use std::io::{Read, Seek, SeekFrom};
 use zip::ZipArchive;
@@ -41,25 +41,26 @@
     // open a zip to parse EOCD
     let archive = ZipArchive::new(reader)?;
     let eocd_size = archive.comment().len() + EOCD_SIZE_WITHOUT_COMMENT;
-    if archive.offset() != 0 {
-        bail!("Invalid ZIP: offset should be 0, but {}.", archive.offset());
-    }
+    ensure!(archive.offset() == 0, "Invalid ZIP: offset should be 0, but {}.", archive.offset());
     // retrieve reader back
     reader = archive.into_inner();
     // the current position should point EOCD offset
     let eocd_offset = reader.seek(SeekFrom::Current(0))? as u32;
     let mut eocd = vec![0u8; eocd_size as usize];
     reader.read_exact(&mut eocd)?;
-    if (&eocd[0..]).get_u32_le() != EOCD_SIGNATURE {
-        bail!("Invalid ZIP: ZipArchive::new() should point EOCD after reading.");
-    }
+    ensure!(
+        (&eocd[0..]).get_u32_le() == EOCD_SIGNATURE,
+        "Invalid ZIP: ZipArchive::new() should point EOCD after reading."
+    );
     let (central_directory_size, central_directory_offset) = get_central_directory(&eocd)?;
-    if central_directory_offset == ZIP64_MARK || central_directory_size == ZIP64_MARK {
-        bail!("Unsupported ZIP: ZIP64 is not supported.");
-    }
-    if central_directory_offset + central_directory_size != eocd_offset {
-        bail!("Invalid ZIP: EOCD should follow CD with no extra data or overlap.");
-    }
+    ensure!(
+        central_directory_offset != ZIP64_MARK && central_directory_size != ZIP64_MARK,
+        "Unsupported ZIP: ZIP64 is not supported."
+    );
+    ensure!(
+        central_directory_offset + central_directory_size == eocd_offset,
+        "Invalid ZIP: EOCD should follow CD with no extra data or overlap."
+    );
 
     Ok((
         reader,
@@ -73,9 +74,7 @@
 }
 
 fn get_central_directory(buf: &[u8]) -> Result<(u32, u32)> {
-    if buf.len() < EOCD_SIZE_WITHOUT_COMMENT {
-        bail!("Invalid EOCD size: {}", buf.len());
-    }
+    ensure!(buf.len() >= EOCD_SIZE_WITHOUT_COMMENT, "Invalid EOCD size: {}", buf.len());
     let mut buf = &buf[EOCD_CENTRAL_DIRECTORY_SIZE_FIELD_OFFSET..];
     let size = buf.get_u32_le();
     let offset = buf.get_u32_le();
@@ -84,9 +83,7 @@
 
 /// Update EOCD's central_directory_offset field.
 pub fn set_central_directory_offset(buf: &mut [u8], value: u32) -> Result<()> {
-    if buf.len() < EOCD_SIZE_WITHOUT_COMMENT {
-        bail!("Invalid EOCD size: {}", buf.len());
-    }
+    ensure!(buf.len() >= EOCD_SIZE_WITHOUT_COMMENT, "Invalid EOCD size: {}", buf.len());
     (&mut buf[EOCD_CENTRAL_DIRECTORY_OFFSET_FIELD_OFFSET..]).put_u32_le(value);
     Ok(())
 }
diff --git a/libs/apkverify/tests/apkverify_test.rs b/libs/apkverify/tests/apkverify_test.rs
index a674ad7..d7b1dc2 100644
--- a/libs/apkverify/tests/apkverify_test.rs
+++ b/libs/apkverify/tests/apkverify_test.rs
@@ -15,7 +15,7 @@
  */
 
 use apkverify::{testing::assert_contains, verify};
-use std::matches;
+use std::{fs, matches, path::Path};
 
 const KEY_NAMES_DSA: &[&str] = &["1024", "2048", "3072"];
 const KEY_NAMES_ECDSA: &[&str] = &["p256", "p384", "p521"];
@@ -25,7 +25,7 @@
 fn test_verify_truncated_cd() {
     use zip::result::ZipError;
     let res = verify("tests/data/v2-only-truncated-cd.apk");
-    // TODO(jooyung): consider making a helper for err assertion
+    // TODO(b/190343842): consider making a helper for err assertion
     assert!(matches!(
         res.unwrap_err().root_cause().downcast_ref::<ZipError>().unwrap(),
         ZipError::InvalidArchive(_),
@@ -34,61 +34,52 @@
 
 #[test]
 fn test_verify_v3() {
-    assert!(verify("tests/data/test.apex").is_ok());
+    validate_apk_public_key("tests/data/test.apex");
 }
 
-// TODO(b/190343842)
 #[test]
 fn test_verify_v3_dsa_sha256() {
     for key_name in KEY_NAMES_DSA.iter() {
         let res = verify(format!("tests/data/v3-only-with-dsa-sha256-{}.apk", key_name));
         assert!(res.is_err());
-        assert_contains(
-            &res.unwrap_err().to_string(),
-            "TODO(b/190343842) not implemented signature algorithm",
-        );
+        assert_contains(&res.unwrap_err().to_string(), "not implemented");
     }
 }
 
 #[test]
 fn test_verify_v3_ecdsa_sha256() {
     for key_name in KEY_NAMES_ECDSA.iter() {
-        assert!(verify(format!("tests/data/v3-only-with-ecdsa-sha256-{}.apk", key_name)).is_ok());
+        validate_apk_public_key(format!("tests/data/v3-only-with-ecdsa-sha256-{}.apk", key_name));
     }
 }
 
-// TODO(b/190343842)
 #[test]
 fn test_verify_v3_ecdsa_sha512() {
     for key_name in KEY_NAMES_ECDSA.iter() {
-        let res = verify(format!("tests/data/v3-only-with-ecdsa-sha512-{}.apk", key_name));
-        assert!(res.is_err());
-        assert_contains(
-            &res.unwrap_err().to_string(),
-            "TODO(b/190343842) not implemented signature algorithm",
-        );
+        validate_apk_public_key(format!("tests/data/v3-only-with-ecdsa-sha512-{}.apk", key_name));
     }
 }
 
 #[test]
 fn test_verify_v3_rsa_sha256() {
     for key_name in KEY_NAMES_RSA.iter() {
-        assert!(
-            verify(format!("tests/data/v3-only-with-rsa-pkcs1-sha256-{}.apk", key_name)).is_ok()
-        );
+        validate_apk_public_key(format!(
+            "tests/data/v3-only-with-rsa-pkcs1-sha256-{}.apk",
+            key_name
+        ));
     }
 }
 
 #[test]
 fn test_verify_v3_rsa_sha512() {
     for key_name in KEY_NAMES_RSA.iter() {
-        assert!(
-            verify(format!("tests/data/v3-only-with-rsa-pkcs1-sha512-{}.apk", key_name)).is_ok()
-        );
+        validate_apk_public_key(format!(
+            "tests/data/v3-only-with-rsa-pkcs1-sha512-{}.apk",
+            key_name
+        ));
     }
 }
 
-// TODO(b/190343842)
 #[test]
 fn test_verify_v3_sig_does_not_verify() {
     let path_list = [
@@ -101,13 +92,11 @@
         assert!(res.is_err());
         let error_msg = &res.unwrap_err().to_string();
         assert!(
-            error_msg.contains("Signature is invalid")
-                || error_msg.contains("TODO(b/190343842) not implemented signature algorithm")
+            error_msg.contains("Signature is invalid") || error_msg.contains("not implemented")
         );
     }
 }
 
-// TODO(b/190343842)
 #[test]
 fn test_verify_v3_digest_mismatch() {
     let path_list = [
@@ -118,10 +107,7 @@
         let res = verify(path);
         assert!(res.is_err());
         let error_msg = &res.unwrap_err().to_string();
-        assert!(
-            error_msg.contains("Digest mismatch")
-                || error_msg.contains("TODO(b/190343842) not implemented signature algorithm")
-        );
+        assert!(error_msg.contains("Digest mismatch") || error_msg.contains("not implemented"));
     }
 }
 
@@ -183,20 +169,45 @@
 
 #[test]
 fn test_verify_v3_unknown_additional_attr() {
-    assert!(verify("tests/data/v3-only-unknown-additional-attr.apk").is_ok());
+    validate_apk_public_key("tests/data/v3-only-unknown-additional-attr.apk");
 }
 
 #[test]
 fn test_verify_v3_unknown_pair_in_apk_sig_block() {
-    assert!(verify("tests/data/v3-only-unknown-pair-in-apk-sig-block.apk").is_ok());
+    validate_apk_public_key("tests/data/v3-only-unknown-pair-in-apk-sig-block.apk");
 }
 
 #[test]
 fn test_verify_v3_ignorable_unsupported_sig_algs() {
-    assert!(verify("tests/data/v3-only-with-ignorable-unsupported-sig-algs.apk").is_ok());
+    validate_apk_public_key("tests/data/v3-only-with-ignorable-unsupported-sig-algs.apk");
 }
 
 #[test]
 fn test_verify_v3_stamp() {
-    assert!(verify("tests/data/v3-only-with-stamp.apk").is_ok());
+    validate_apk_public_key("tests/data/v3-only-with-stamp.apk");
+}
+
+fn validate_apk_public_key<P: AsRef<Path>>(apk_path: P) {
+    // Validates public key from verification == expected public key.
+    let public_key_from_verification = verify(apk_path.as_ref());
+    let public_key_from_verification =
+        public_key_from_verification.expect("Error in verification result");
+
+    let expected_public_key_path = format!("{}.der", apk_path.as_ref().to_str().unwrap());
+    assert!(
+        fs::metadata(&expected_public_key_path).is_ok(),
+        "File does not exist. You can re-create it with:\n$ echo -en {} > {}\n",
+        public_key_from_verification.iter().map(|b| format!("\\\\x{:02x}", b)).collect::<String>(),
+        expected_public_key_path
+    );
+    let expected_public_key = fs::read(&expected_public_key_path).unwrap();
+    assert_eq!(
+        expected_public_key,
+        public_key_from_verification.as_ref(),
+        "{}",
+        expected_public_key_path
+    );
+
+    // TODO(b/239534874): Validates public key extracted directly from apk
+    // (without verification) == expected public key.
 }
diff --git a/libs/apkverify/tests/data/test.apex.der b/libs/apkverify/tests/data/test.apex.der
new file mode 100644
index 0000000..abeb1eb
--- /dev/null
+++ b/libs/apkverify/tests/data/test.apex.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-unknown-additional-attr.apk.der b/libs/apkverify/tests/data/v3-only-unknown-additional-attr.apk.der
new file mode 100644
index 0000000..27535ca
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-unknown-additional-attr.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-unknown-pair-in-apk-sig-block.apk.der b/libs/apkverify/tests/data/v3-only-unknown-pair-in-apk-sig-block.apk.der
new file mode 100644
index 0000000..6aafd09
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-unknown-pair-in-apk-sig-block.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p256.apk.der b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p256.apk.der
new file mode 100644
index 0000000..01927af
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p256.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p384.apk.der b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p384.apk.der
new file mode 100644
index 0000000..95baf40
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p384.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p521.apk.der b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p521.apk.der
new file mode 100644
index 0000000..b68f925
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha256-p521.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p256.apk.der b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p256.apk.der
new file mode 100644
index 0000000..01927af
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p256.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p384.apk.der b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p384.apk.der
new file mode 100644
index 0000000..95baf40
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p384.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p521.apk.der b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p521.apk.der
new file mode 100644
index 0000000..b68f925
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-ecdsa-sha512-p521.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-ignorable-unsupported-sig-algs.apk.der b/libs/apkverify/tests/data/v3-only-with-ignorable-unsupported-sig-algs.apk.der
new file mode 100644
index 0000000..96dc543
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-ignorable-unsupported-sig-algs.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-1024.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-1024.apk.der
new file mode 100644
index 0000000..6aafd09
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-1024.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-16384.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-16384.apk.der
new file mode 100644
index 0000000..31abdc7
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-16384.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-2048.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-2048.apk.der
new file mode 100644
index 0000000..96dc543
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-2048.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-3072.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-3072.apk.der
new file mode 100644
index 0000000..bd70f5f
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-3072.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk.der
new file mode 100644
index 0000000..951648e
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-4096.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-8192.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-8192.apk.der
new file mode 100644
index 0000000..15e5edf
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha256-8192.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-1024.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-1024.apk.der
new file mode 100644
index 0000000..6aafd09
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-1024.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-16384.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-16384.apk.der
new file mode 100644
index 0000000..31abdc7
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-16384.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-2048.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-2048.apk.der
new file mode 100644
index 0000000..96dc543
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-2048.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-3072.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-3072.apk.der
new file mode 100644
index 0000000..bd70f5f
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-3072.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-4096.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-4096.apk.der
new file mode 100644
index 0000000..951648e
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-4096.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-8192.apk.der b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-8192.apk.der
new file mode 100644
index 0000000..15e5edf
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-rsa-pkcs1-sha512-8192.apk.der
Binary files differ
diff --git a/libs/apkverify/tests/data/v3-only-with-stamp.apk.der b/libs/apkverify/tests/data/v3-only-with-stamp.apk.der
new file mode 100644
index 0000000..01927af
--- /dev/null
+++ b/libs/apkverify/tests/data/v3-only-with-stamp.apk.der
Binary files differ
diff --git a/microdroid/Android.bp b/microdroid/Android.bp
index 281416b..1983e70 100644
--- a/microdroid/Android.bp
+++ b/microdroid/Android.bp
@@ -57,8 +57,6 @@
         "libbinder",
         "libbinder_ndk",
         "libstdc++",
-        "logcat.microdroid",
-        "logd.microdroid",
         "secilc",
 
         // "com.android.adbd" requires these,
diff --git a/microdroid/bootconfig.app_debuggable b/microdroid/bootconfig.app_debuggable
index 0d85186..6e66371 100644
--- a/microdroid/bootconfig.app_debuggable
+++ b/microdroid/bootconfig.app_debuggable
@@ -13,7 +13,3 @@
 
 # ADB is supported but rooting is prohibited.
 androidboot.adb.enabled=1
-
-# logd is enabled
-# TODO(b/200914564) Filter only the log from the app
-androidboot.logd.enabled=1
diff --git a/microdroid/bootconfig.full_debuggable b/microdroid/bootconfig.full_debuggable
index 0bdd810..583060b 100644
--- a/microdroid/bootconfig.full_debuggable
+++ b/microdroid/bootconfig.full_debuggable
@@ -12,6 +12,3 @@
 # ro.adb.secure is still 0 (see build.prop) which means that adbd is started
 # unrooted by default. To root, developer should explicitly execute `adb root`.
 androidboot.adb.enabled=1
-
-# logd is enabled
-androidboot.logd.enabled=1
diff --git a/microdroid/bootconfig.normal b/microdroid/bootconfig.normal
index ea83287..ec85f0d 100644
--- a/microdroid/bootconfig.normal
+++ b/microdroid/bootconfig.normal
@@ -12,6 +12,3 @@
 
 # ADB is not enabled.
 androidboot.adb.enabled=0
-
-# logd is not enabled
-androidboot.logd.enabled=0
diff --git a/microdroid/init.rc b/microdroid/init.rc
index 42aa983..cd7332b 100644
--- a/microdroid/init.rc
+++ b/microdroid/init.rc
@@ -17,6 +17,14 @@
 
     start ueventd
 
+# If VM is debuggable, send logs to outside ot the VM via the serial console.
+# If non-debuggable, logs are internally consumed at /dev/null
+on early-init && property:ro.boot.microdroid.app_debuggable=1
+    setprop ro.log.file_logger.path /dev/hvc2
+
+on early-init && property:ro.boot.microdroid.app_debuggable=0
+    setprop ro.log.file_logger.path /dev/null
+
 on init
     # Mount binderfs
     mkdir /dev/binderfs
@@ -62,12 +70,6 @@
     start vendor.dice-microdroid
     start diced
 
-on init && property:ro.boot.logd.enabled=1
-    # Start logd before any other services run to ensure we capture all of their logs.
-    # TODO(b/217796229) set filterspec if debug_level is app_only
-    start logd
-    start seriallogging
-
 on init
     mkdir /mnt/apk 0755 system system
     mkdir /mnt/extra-apk 0755 root root
@@ -99,10 +101,6 @@
 on init && property:ro.boot.adb.enabled=1
     start adbd
 
-on load_persist_props_action && property:ro.boot.logd.enabled=1
-    start logd
-    start logd-reinit
-
 # Mount filesystems and start core system services.
 on late-init
     trigger early-fs
@@ -206,13 +204,3 @@
     seclabel u:r:shell:s0
     setenv HOSTNAME console
 
-service seriallogging /system/bin/logcat -b all -v threadtime -f /dev/hvc2 *:V
-    disabled
-    user logd
-    group root logd
-
-on fs
-    write /dev/event-log-tags "# content owned by logd
-"
-    chown logd logd /dev/event-log-tags
-    chmod 0644 /dev/event-log-tags
diff --git a/microdroid/ueventd.rc b/microdroid/ueventd.rc
index 340a1f7..fc165c8 100644
--- a/microdroid/ueventd.rc
+++ b/microdroid/ueventd.rc
@@ -26,6 +26,6 @@
 /dev/tty0                 0660   root       system
 
 # Virtual console for logcat
-/dev/hvc2                 0660   logd       logd
+/dev/hvc2                 0666   system     system
 
 /dev/open-dice0           0660   diced      diced
diff --git a/tests/helper/src/java/com/android/microdroid/test/common/MetricsProcessor.java b/tests/helper/src/java/com/android/microdroid/test/common/MetricsProcessor.java
index c12b07d..41534f1 100644
--- a/tests/helper/src/java/com/android/microdroid/test/common/MetricsProcessor.java
+++ b/tests/helper/src/java/com/android/microdroid/test/common/MetricsProcessor.java
@@ -33,18 +33,21 @@
      * a {@link Map} with the corresponding keys equal to [mPrefix + name +
      * _[min|max|average|stdev]_ + unit].
      */
-    public Map<String, Double> computeStats(List<Double> metrics, String name, String unit) {
+    public Map<String, Double> computeStats(List<? extends Number> metrics, String name,
+            String unit) {
         double sum = 0;
         double min = Double.MAX_VALUE;
         double max = Double.MIN_VALUE;
-        for (double d : metrics) {
+        for (Number metric : metrics) {
+            double d = metric.doubleValue();
             sum += d;
             if (min > d) min = d;
             if (max < d) max = d;
         }
         double avg = sum / metrics.size();
         double sqSum = 0;
-        for (double d : metrics) {
+        for (Number metric : metrics) {
+            double d = metric.doubleValue();
             sqSum += (d - avg) * (d - avg);
         }
         double stdDev = Math.sqrt(sqSum / (metrics.size() - 1));
diff --git a/tests/helper/src/java/com/android/microdroid/test/common/ProcessUtil.java b/tests/helper/src/java/com/android/microdroid/test/common/ProcessUtil.java
new file mode 100644
index 0000000..c5aad6e
--- /dev/null
+++ b/tests/helper/src/java/com/android/microdroid/test/common/ProcessUtil.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.microdroid.test.common;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Function;
+
+/** This class provides process utility for both device tests and host tests. */
+public final class ProcessUtil {
+
+    /** Gets metrics key and values mapping of specified process id */
+    public static Map<String, Long> getProcessSmapsRollup(
+            int pid, Function<String, String> shellExecutor) throws IOException {
+        String path = "/proc/" + pid + "/smaps_rollup";
+        return parseMemoryInfo(skipFirstLine(shellExecutor.apply("cat " + path + " || true")));
+    }
+
+    /** Gets process id and process name mapping of the device */
+    public static Map<Integer, String> getProcessMap(Function<String, String> shellExecutor)
+            throws IOException {
+        Map<Integer, String> processMap = new HashMap<>();
+        for (String ps : skipFirstLine(shellExecutor.apply("ps -Ao PID,NAME")).split("\n")) {
+            // Each line is '<pid> <name>'.
+            // EX : 11424 dex2oat64
+            ps = ps.trim();
+            if (ps.length() == 0) {
+                continue;
+            }
+            int space = ps.indexOf(" ");
+            String pName = ps.substring(space + 1);
+            int pId = Integer.parseInt(ps.substring(0, space));
+            processMap.put(pId, pName);
+        }
+
+        return processMap;
+    }
+
+    // To ensures that only one object is created at a time.
+    private ProcessUtil() {}
+
+    private static Map<String, Long> parseMemoryInfo(String file) {
+        Map<String, Long> stats = new HashMap<>();
+        for (String line : file.split("[\r\n]+")) {
+            line = line.trim();
+            if (line.length() == 0) {
+                continue;
+            }
+            // Each line is '<metrics>:        <number> kB'.
+            // EX : Pss_Anon:        70712 kB
+            if (line.endsWith(" kB")) line = line.substring(0, line.length() - 3);
+
+            String[] elems = line.split(":");
+            stats.put(elems[0].trim(), Long.parseLong(elems[1].trim()));
+        }
+        return stats;
+    }
+
+    private static String skipFirstLine(String str) {
+        int index = str.indexOf("\n");
+        return (index < 0) ? "" : str.substring(index + 1);
+    }
+}
diff --git a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
index e5bc45a..a07731e 100644
--- a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
+++ b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
@@ -210,9 +210,7 @@
 
         protected void forceStop(VirtualMachine vm) {
             try {
-                vm.clearCallback();
                 vm.stop();
-                mExecutorService.shutdown();
             } catch (VirtualMachineException e) {
                 throw new RuntimeException(e);
             }
@@ -233,6 +231,7 @@
         @Override
         @CallSuper
         public void onDied(VirtualMachine vm, int reason) {
+            vm.clearCallback();
             mExecutorService.shutdown();
         }
 
diff --git a/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java b/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java
index d016a67..69218a8 100644
--- a/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java
+++ b/tests/hostside/java/com/android/microdroid/test/MicrodroidTestCase.java
@@ -708,6 +708,11 @@
         }
     }
 
+    // TODO(b/6184548): to be replaced by ProcessUtil
+    /**
+    * @deprecated use ProcessUtil instead.
+    */
+    @Deprecated
     private Map<String, Long> parseMemInfo(String file) {
         Map<String, Long> stats = new HashMap<>();
         file.lines().forEach(line -> {
@@ -720,11 +725,21 @@
         return stats;
     }
 
+    // TODO(b/6184548): to be replaced by ProcessUtil
+    /**
+    * @deprecated use ProcessUtil instead.
+    */
+    @Deprecated
     private String skipFirstLine(String str) {
         int index = str.indexOf("\n");
         return (index < 0) ? "" : str.substring(index + 1);
     }
 
+    // TODO(b/6184548): to be replaced by ProcessUtil
+    /**
+    * @deprecated use ProcessUtil instead.
+    */
+    @Deprecated
     private List<ProcessInfo> getRunningProcessesList() {
         List<ProcessInfo> list = new ArrayList<ProcessInfo>();
         skipFirstLine(runOnMicrodroid("ps", "-Ao", "PID,NAME")).lines().forEach(ps -> {
@@ -739,10 +754,20 @@
         return list;
     }
 
+    // TODO(b/6184548): to be replaced by ProcessUtil
+    /**
+    * @deprecated use ProcessUtil instead.
+    */
+    @Deprecated
     private Map<String, Long> getProcMemInfo() {
         return parseMemInfo(runOnMicrodroid("cat", "/proc/meminfo"));
     }
 
+    // TODO(b/6184548): to be replaced by ProcessUtil
+    /**
+    * @deprecated use ProcessUtil instead.
+    */
+    @Deprecated
     private Map<String, Long> getProcSmapsRollup(int pid) {
         String path = "/proc/" + pid + "/smaps_rollup";
         return  parseMemInfo(skipFirstLine(runOnMicrodroid("cat", path, "||", "true")));
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index b92a526..c2060cb 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -206,39 +206,27 @@
 
         VirtualMachineConfig.Builder builder = mInner.newVmConfigBuilder("assets/vm_config.json");
         VirtualMachineConfig normalConfig = builder.debugLevel(DebugLevel.NONE).build();
-        VirtualMachine vm = mInner.forceCreateNewVirtualMachine("test_vm", normalConfig);
-        VmEventListener listener =
-                new VmEventListener() {
-                    @Override
-                    public void onPayloadReady(VirtualMachine vm) {
-                        forceStop(vm);
-                    }
-                };
-        listener.runToFinish(TAG, vm);
+        mInner.forceCreateNewVirtualMachine("test_vm", normalConfig);
+        assertThat(tryBootVm(TAG, "test_vm").payloadStarted).isTrue();
+
+        // Try to run the VM again with the previous instance.img
+        // We need to make sure that no changes on config don't invalidate the identity, to compare
+        // the result with the below "different debug level" test.
+        File vmRoot = new File(getContext().getFilesDir(), "vm");
+        File vmInstance = new File(new File(vmRoot, "test_vm"), "instance.img");
+        File vmInstanceBackup = File.createTempFile("instance", ".img");
+        Files.copy(vmInstance.toPath(), vmInstanceBackup.toPath(), REPLACE_EXISTING);
+        mInner.forceCreateNewVirtualMachine("test_vm", normalConfig);
+        Files.copy(vmInstanceBackup.toPath(), vmInstance.toPath(), REPLACE_EXISTING);
+        assertThat(tryBootVm(TAG, "test_vm").payloadStarted).isTrue();
 
         // Launch the same VM with different debug level. The Java API prohibits this (thankfully).
-        // For testing, we do that by creating another VM with debug level, and copy the config file
-        // from the new VM directory to the old VM directory.
+        // For testing, we do that by creating a new VM with debug level, and copy the old instance
+        // image to the new VM instance image.
         VirtualMachineConfig debugConfig = builder.debugLevel(DebugLevel.FULL).build();
-        VirtualMachine newVm = mInner.forceCreateNewVirtualMachine("test_debug_vm", debugConfig);
-        File vmRoot = new File(getContext().getFilesDir(), "vm");
-        File newVmConfig = new File(new File(vmRoot, "test_debug_vm"), "config.xml");
-        File oldVmConfig = new File(new File(vmRoot, "test_vm"), "config.xml");
-        Files.copy(newVmConfig.toPath(), oldVmConfig.toPath(), REPLACE_EXISTING);
-        newVm.delete();
-        // re-load with the copied-in config file.
-        vm = mInner.getVirtualMachineManager().get("test_vm");
-        final CompletableFuture<Boolean> payloadStarted = new CompletableFuture<>();
-        listener =
-                new VmEventListener() {
-                    @Override
-                    public void onPayloadStarted(VirtualMachine vm, ParcelFileDescriptor stream) {
-                        payloadStarted.complete(true);
-                        forceStop(vm);
-                    }
-                };
-        listener.runToFinish(TAG, vm);
-        assertThat(payloadStarted.getNow(false)).isFalse();
+        mInner.forceCreateNewVirtualMachine("test_vm", debugConfig);
+        Files.copy(vmInstanceBackup.toPath(), vmInstance.toPath(), REPLACE_EXISTING);
+        assertThat(tryBootVm(TAG, "test_vm").payloadStarted).isFalse();
     }
 
     private class VmCdis {
@@ -516,4 +504,21 @@
         assertThat(bootResult.deathReason).isEqualTo(
                 VirtualMachineCallback.DEATH_REASON_MICRODROID_INVALID_PAYLOAD_CONFIG);
     }
+
+    @Test
+    public void sameInstancesShareTheSameVmObject()
+            throws VirtualMachineException, InterruptedException, IOException {
+        VirtualMachineConfig.Builder builder =
+                mInner.newVmConfigBuilder("assets/vm_config.json");
+        VirtualMachineConfig normalConfig = builder.debugLevel(DebugLevel.NONE).build();
+        VirtualMachine vm = mInner.forceCreateNewVirtualMachine("test_vm", normalConfig);
+        VirtualMachine vm2 = mInner.getVirtualMachineManager().get("test_vm");
+        assertThat(vm).isEqualTo(vm2);
+
+        VirtualMachine newVm = mInner.forceCreateNewVirtualMachine("test_vm", normalConfig);
+        VirtualMachine newVm2 = mInner.getVirtualMachineManager().get("test_vm");
+        assertThat(newVm).isEqualTo(newVm2);
+
+        assertThat(vm).isNotEqualTo(newVm);
+    }
 }