diff --git a/pvmfw/src/virtio/hal.rs b/pvmfw/src/virtio/hal.rs
new file mode 100644
index 0000000..c1c8ae6
--- /dev/null
+++ b/pvmfw/src/virtio/hal.rs
@@ -0,0 +1,71 @@
+use crate::memory::{alloc_shared, dealloc_shared, virt_to_phys};
+use core::ptr::{copy_nonoverlapping, NonNull};
+use log::debug;
+use virtio_drivers::{BufferDirection, Hal, PhysAddr, VirtAddr, PAGE_SIZE};
+
+pub struct HalImpl;
+
+impl Hal for HalImpl {
+    fn dma_alloc(pages: usize) -> PhysAddr {
+        debug!("dma_alloc: pages={}", pages);
+        let size = pages * PAGE_SIZE;
+        let vaddr = alloc_shared(size)
+            .expect("Failed to allocate and share VirtIO DMA range with host")
+            .as_ptr() as VirtAddr;
+        virt_to_phys(vaddr)
+    }
+
+    fn dma_dealloc(paddr: PhysAddr, pages: usize) -> i32 {
+        debug!("dma_dealloc: paddr={:#x}, pages={}", paddr, pages);
+        let vaddr = Self::phys_to_virt(paddr);
+        let size = pages * PAGE_SIZE;
+        // Safe because the memory was allocated by `dma_alloc` above using the same allocator, and
+        // the layout is the same as was used then.
+        unsafe {
+            dealloc_shared(vaddr, size).expect("Failed to unshare VirtIO DMA range with host");
+        }
+        0
+    }
+
+    fn phys_to_virt(paddr: PhysAddr) -> VirtAddr {
+        paddr
+    }
+
+    fn share(buffer: NonNull<[u8]>, direction: BufferDirection) -> PhysAddr {
+        let size = buffer.len();
+
+        // TODO: Copy to a pre-shared region rather than allocating and sharing each time.
+        // Allocate a range of pages, copy the buffer if necessary, and share the new range instead.
+        let copy =
+            alloc_shared(size).expect("Failed to allocate and share VirtIO buffer with host");
+        if direction == BufferDirection::DriverToDevice {
+            unsafe {
+                copy_nonoverlapping(buffer.as_ptr() as *mut u8, copy.as_ptr(), size);
+            }
+        }
+        virt_to_phys(copy.as_ptr() as VirtAddr)
+    }
+
+    fn unshare(paddr: PhysAddr, buffer: NonNull<[u8]>, direction: BufferDirection) {
+        let vaddr = Self::phys_to_virt(paddr);
+        let size = buffer.len();
+        if direction == BufferDirection::DeviceToDriver {
+            debug!(
+                "Copying VirtIO buffer back from {:#x} to {:#x}.",
+                paddr,
+                buffer.as_ptr() as *mut u8 as usize
+            );
+            unsafe {
+                copy_nonoverlapping(vaddr as *const u8, buffer.as_ptr() as *mut u8, size);
+            }
+        }
+
+        // Unshare and deallocate the shared copy of the buffer.
+        debug!("Unsharing VirtIO buffer {:#x}", paddr);
+        // Safe because the memory was allocated by `share` using `alloc_shared`, and the size is
+        // the same as was used then.
+        unsafe {
+            dealloc_shared(vaddr, size).expect("Failed to unshare VirtIO buffer with host");
+        }
+    }
+}
diff --git a/pvmfw/src/virtio/pci.rs b/pvmfw/src/virtio/pci.rs
new file mode 100644
index 0000000..f9d36c6
--- /dev/null
+++ b/pvmfw/src/virtio/pci.rs
@@ -0,0 +1,73 @@
+// Copyright 2022, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Functions to scan the PCI bus for VirtIO devices.
+
+use super::hal::HalImpl;
+use crate::{entry::RebootReason, memory::MemoryTracker};
+use fdtpci::{PciError, PciInfo};
+use log::{debug, error, info};
+use virtio_drivers::{
+    device::blk::VirtIOBlk,
+    transport::{
+        pci::{bus::PciRoot, virtio_device_type, PciTransport},
+        DeviceType, Transport,
+    },
+};
+
+/// Maps the CAM and BAR range in the page table and MMIO guard.
+pub fn map_mmio(pci_info: &PciInfo, memory: &mut MemoryTracker) -> Result<(), RebootReason> {
+    memory.map_mmio_range(pci_info.cam_range.clone()).map_err(|e| {
+        error!("Failed to map PCI CAM: {}", e);
+        RebootReason::InternalError
+    })?;
+
+    memory
+        .map_mmio_range(pci_info.bar_range.start as usize..pci_info.bar_range.end as usize)
+        .map_err(|e| {
+            error!("Failed to map PCI MMIO range: {}", e);
+            RebootReason::InternalError
+        })?;
+
+    Ok(())
+}
+
+/// Finds VirtIO PCI devices.
+pub fn find_virtio_devices(pci_root: &mut PciRoot) -> Result<(), PciError> {
+    for (device_function, info) in pci_root.enumerate_bus(0) {
+        let (status, command) = pci_root.get_status_command(device_function);
+        debug!(
+            "Found PCI device {} at {}, status {:?} command {:?}",
+            info, device_function, status, command
+        );
+        if let Some(virtio_type) = virtio_device_type(&info) {
+            debug!("  VirtIO {:?}", virtio_type);
+            let mut transport = PciTransport::new::<HalImpl>(pci_root, device_function).unwrap();
+            info!(
+                "Detected virtio PCI device with device type {:?}, features {:#018x}",
+                transport.device_type(),
+                transport.read_device_features(),
+            );
+            if virtio_type == DeviceType::Block {
+                let mut blk =
+                    VirtIOBlk::<HalImpl, _>::new(transport).expect("failed to create blk driver");
+                info!("Found {} KiB block device.", blk.capacity() * 512 / 1024);
+                let mut data = [0; 512];
+                blk.read_block(0, &mut data).expect("Failed to read block device");
+            }
+        }
+    }
+
+    Ok(())
+}