diff --git a/javalib/src/android/system/virtualmachine/VirtualMachine.java b/javalib/src/android/system/virtualmachine/VirtualMachine.java
index 7713faf..f96effa 100644
--- a/javalib/src/android/system/virtualmachine/VirtualMachine.java
+++ b/javalib/src/android/system/virtualmachine/VirtualMachine.java
@@ -23,8 +23,6 @@
 import static android.system.virtualmachine.VirtualMachineCallback.ERROR_PAYLOAD_INVALID_CONFIG;
 import static android.system.virtualmachine.VirtualMachineCallback.ERROR_PAYLOAD_VERIFICATION_FAILED;
 import static android.system.virtualmachine.VirtualMachineCallback.ERROR_UNKNOWN;
-import static android.system.virtualmachine.VirtualMachineCallback.STOP_REASON_BOOTLOADER_INSTANCE_IMAGE_CHANGED;
-import static android.system.virtualmachine.VirtualMachineCallback.STOP_REASON_BOOTLOADER_PUBLIC_KEY_MISMATCH;
 import static android.system.virtualmachine.VirtualMachineCallback.STOP_REASON_CRASH;
 import static android.system.virtualmachine.VirtualMachineCallback.STOP_REASON_HANGUP;
 import static android.system.virtualmachine.VirtualMachineCallback.STOP_REASON_INFRASTRUCTURE_ERROR;
@@ -1353,10 +1351,6 @@
                     return STOP_REASON_PVM_FIRMWARE_PUBLIC_KEY_MISMATCH;
                 case DeathReason.PVM_FIRMWARE_INSTANCE_IMAGE_CHANGED:
                     return STOP_REASON_PVM_FIRMWARE_INSTANCE_IMAGE_CHANGED;
-                case DeathReason.BOOTLOADER_PUBLIC_KEY_MISMATCH:
-                    return STOP_REASON_BOOTLOADER_PUBLIC_KEY_MISMATCH;
-                case DeathReason.BOOTLOADER_INSTANCE_IMAGE_CHANGED:
-                    return STOP_REASON_BOOTLOADER_INSTANCE_IMAGE_CHANGED;
                 case DeathReason.MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE:
                     return STOP_REASON_MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE;
                 case DeathReason.MICRODROID_PAYLOAD_HAS_CHANGED:
diff --git a/libs/hyp/src/error.rs b/libs/hyp/src/error.rs
new file mode 100644
index 0000000..20a0cff
--- /dev/null
+++ b/libs/hyp/src/error.rs
@@ -0,0 +1,45 @@
+// Copyright 2023, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Error and Result types for hypervisor.
+
+use core::{fmt, result};
+
+/// Result type with hypervisor error.
+pub type Result<T> = result::Result<T, Error>;
+
+/// Hypervisor error.
+#[derive(Debug, Clone)]
+pub enum Error {
+    /// MMIO guard is not supported.
+    MmioGuardNotsupported,
+    /// Failed to invoke a certain HVC function.
+    HvcError(smccc::Error, u32),
+    /// The MMIO_GUARD granule used by the hypervisor is not supported.
+    UnsupportedMmioGuardGranule(usize),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            Self::MmioGuardNotsupported => write!(f, "MMIO guard is not supported"),
+            Self::HvcError(e, function_id) => {
+                write!(f, "Failed to invoke the HVC function with function ID {function_id}: {e}")
+            }
+            Self::UnsupportedMmioGuardGranule(g) => {
+                write!(f, "Unsupported MMIO guard granule: {g}")
+            }
+        }
+    }
+}
diff --git a/libs/hyp/src/hypervisor/common.rs b/libs/hyp/src/hypervisor/common.rs
new file mode 100644
index 0000000..550fb2e
--- /dev/null
+++ b/libs/hyp/src/hypervisor/common.rs
@@ -0,0 +1,44 @@
+// Copyright 2023, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! This module regroups some common traits shared by all the hypervisors.
+
+use crate::error::Result;
+
+/// Trait for the hypervisor.
+pub trait Hypervisor {
+    /// Initializes the hypervisor by enrolling a MMIO guard and checking the memory granule size.
+    /// By enrolling, all MMIO will be blocked unless allow-listed with `mmio_guard_map`.
+    /// Protected VMs are auto-enrolled.
+    fn mmio_guard_init(&self) -> Result<()>;
+
+    /// Maps a memory address to the hypervisor MMIO guard.
+    fn mmio_guard_map(&self, addr: usize) -> Result<()>;
+
+    /// Unmaps a memory address from the hypervisor MMIO guard.
+    fn mmio_guard_unmap(&self, addr: usize) -> Result<()>;
+
+    /// Shares a region of memory with host, granting it read, write and execute permissions.
+    /// The size of the region is equal to the memory protection granule returned by
+    /// [`hyp_meminfo`].
+    fn mem_share(&self, base_ipa: u64) -> Result<()>;
+
+    /// Revokes access permission from host to a memory region previously shared with
+    /// [`mem_share`]. The size of the region is equal to the memory protection granule returned by
+    /// [`hyp_meminfo`].
+    fn mem_unshare(&self, base_ipa: u64) -> Result<()>;
+
+    /// Returns the memory protection granule size in bytes.
+    fn memory_protection_granule(&self) -> Result<usize>;
+}
diff --git a/libs/hyp/src/hypervisor/kvm.rs b/libs/hyp/src/hypervisor/kvm.rs
index a34acc8..615c75a 100644
--- a/libs/hyp/src/hypervisor/kvm.rs
+++ b/libs/hyp/src/hypervisor/kvm.rs
@@ -14,7 +14,9 @@
 
 //! Wrappers around calls to the KVM hypervisor.
 
-use smccc::{checked_hvc64, checked_hvc64_expect_zero, Error, Result};
+use super::common::Hypervisor;
+use crate::error::{Error, Result};
+use crate::util::{page_address, SIZE_4KB};
 
 const ARM_SMCCC_KVM_FUNC_HYP_MEMINFO: u32 = 0xc6000002;
 const ARM_SMCCC_KVM_FUNC_MEM_SHARE: u32 = 0xc6000003;
@@ -25,71 +27,90 @@
 const VENDOR_HYP_KVM_MMIO_GUARD_MAP_FUNC_ID: u32 = 0xc6000007;
 const VENDOR_HYP_KVM_MMIO_GUARD_UNMAP_FUNC_ID: u32 = 0xc6000008;
 
-/// Queries the memory protection parameters for a protected virtual machine.
-///
-/// Returns the memory protection granule size in bytes.
-pub(super) fn hyp_meminfo() -> Result<u64> {
-    let args = [0u64; 17];
-    checked_hvc64(ARM_SMCCC_KVM_FUNC_HYP_MEMINFO, args)
-}
+pub(super) struct KvmHypervisor;
 
-/// Shares a region of memory with the KVM host, granting it read, write and execute permissions.
-/// The size of the region is equal to the memory protection granule returned by [`hyp_meminfo`].
-pub(super) fn mem_share(base_ipa: u64) -> Result<()> {
-    let mut args = [0u64; 17];
-    args[0] = base_ipa;
+impl Hypervisor for KvmHypervisor {
+    fn mmio_guard_init(&self) -> Result<()> {
+        mmio_guard_enroll()?;
+        let mmio_granule = mmio_guard_granule()?;
+        if mmio_granule != SIZE_4KB {
+            return Err(Error::UnsupportedMmioGuardGranule(mmio_granule));
+        }
+        Ok(())
+    }
 
-    checked_hvc64_expect_zero(ARM_SMCCC_KVM_FUNC_MEM_SHARE, args)
-}
+    fn mmio_guard_map(&self, addr: usize) -> Result<()> {
+        let mut args = [0u64; 17];
+        args[0] = page_address(addr);
 
-/// Revokes access permission from the KVM host to a memory region previously shared with
-/// [`mem_share`]. The size of the region is equal to the memory protection granule returned by
-/// [`hyp_meminfo`].
-pub(super) fn mem_unshare(base_ipa: u64) -> Result<()> {
-    let mut args = [0u64; 17];
-    args[0] = base_ipa;
+        // TODO(b/277859415): pKVM returns a i32 instead of a i64 in T.
+        // Drop this hack once T reaches EoL.
+        let is_i32_error_code = |n| u32::try_from(n).ok().filter(|v| (*v as i32) < 0).is_some();
+        match smccc::checked_hvc64_expect_zero(VENDOR_HYP_KVM_MMIO_GUARD_MAP_FUNC_ID, args) {
+            Err(smccc::Error::Unexpected(e)) if is_i32_error_code(e) => match e as u32 as i32 {
+                -1 => Err(smccc::Error::NotSupported),
+                -2 => Err(smccc::Error::NotRequired),
+                -3 => Err(smccc::Error::InvalidParameter),
+                ret => Err(smccc::Error::Unknown(ret as i64)),
+            },
+            res => res,
+        }
+        .map_err(|e| Error::HvcError(e, VENDOR_HYP_KVM_MMIO_GUARD_MAP_FUNC_ID))
+    }
 
-    checked_hvc64_expect_zero(ARM_SMCCC_KVM_FUNC_MEM_UNSHARE, args)
-}
+    fn mmio_guard_unmap(&self, addr: usize) -> Result<()> {
+        let mut args = [0u64; 17];
+        args[0] = page_address(addr);
 
-pub(super) fn mmio_guard_info() -> Result<u64> {
-    let args = [0u64; 17];
+        // TODO(b/277860860): pKVM returns NOT_SUPPORTED for SUCCESS in T.
+        // Drop this hack once T reaches EoL.
+        match smccc::checked_hvc64_expect_zero(VENDOR_HYP_KVM_MMIO_GUARD_UNMAP_FUNC_ID, args) {
+            Err(smccc::Error::NotSupported) | Ok(_) => Ok(()),
+            Err(e) => Err(Error::HvcError(e, VENDOR_HYP_KVM_MMIO_GUARD_UNMAP_FUNC_ID)),
+        }
+    }
 
-    checked_hvc64(VENDOR_HYP_KVM_MMIO_GUARD_INFO_FUNC_ID, args)
-}
+    fn mem_share(&self, base_ipa: u64) -> Result<()> {
+        let mut args = [0u64; 17];
+        args[0] = base_ipa;
 
-pub(super) fn mmio_guard_enroll() -> Result<()> {
-    let args = [0u64; 17];
+        checked_hvc64_expect_zero(ARM_SMCCC_KVM_FUNC_MEM_SHARE, args)
+    }
 
-    checked_hvc64_expect_zero(VENDOR_HYP_KVM_MMIO_GUARD_ENROLL_FUNC_ID, args)
-}
+    fn mem_unshare(&self, base_ipa: u64) -> Result<()> {
+        let mut args = [0u64; 17];
+        args[0] = base_ipa;
 
-pub(super) fn mmio_guard_map(ipa: u64) -> Result<()> {
-    let mut args = [0u64; 17];
-    args[0] = ipa;
+        checked_hvc64_expect_zero(ARM_SMCCC_KVM_FUNC_MEM_UNSHARE, args)
+    }
 
-    // TODO(b/277859415): pKVM returns a i32 instead of a i64 in T.
-    // Drop this hack once T reaches EoL.
-    let is_i32_error_code = |n| u32::try_from(n).ok().filter(|v| (*v as i32) < 0).is_some();
-    match checked_hvc64_expect_zero(VENDOR_HYP_KVM_MMIO_GUARD_MAP_FUNC_ID, args) {
-        Err(Error::Unexpected(e)) if is_i32_error_code(e) => match e as u32 as i32 {
-            -1 => Err(Error::NotSupported),
-            -2 => Err(Error::NotRequired),
-            -3 => Err(Error::InvalidParameter),
-            ret => Err(Error::Unknown(ret as i64)),
-        },
-        res => res,
+    fn memory_protection_granule(&self) -> Result<usize> {
+        let args = [0u64; 17];
+        let granule = checked_hvc64(ARM_SMCCC_KVM_FUNC_HYP_MEMINFO, args)?;
+        Ok(granule.try_into().unwrap())
     }
 }
 
-pub(super) fn mmio_guard_unmap(ipa: u64) -> Result<()> {
-    let mut args = [0u64; 17];
-    args[0] = ipa;
+fn mmio_guard_granule() -> Result<usize> {
+    let args = [0u64; 17];
 
-    // TODO(b/277860860): pKVM returns NOT_SUPPORTED for SUCCESS in T.
-    // Drop this hack once T reaches EoL.
-    match checked_hvc64_expect_zero(VENDOR_HYP_KVM_MMIO_GUARD_UNMAP_FUNC_ID, args) {
-        Err(Error::NotSupported) | Ok(_) => Ok(()),
-        x => x,
+    let granule = checked_hvc64(VENDOR_HYP_KVM_MMIO_GUARD_INFO_FUNC_ID, args)?;
+    Ok(granule.try_into().unwrap())
+}
+
+fn mmio_guard_enroll() -> Result<()> {
+    let args = [0u64; 17];
+    match smccc::checked_hvc64_expect_zero(VENDOR_HYP_KVM_MMIO_GUARD_ENROLL_FUNC_ID, args) {
+        Ok(_) => Ok(()),
+        Err(smccc::Error::NotSupported) => Err(Error::MmioGuardNotsupported),
+        Err(e) => Err(Error::HvcError(e, VENDOR_HYP_KVM_MMIO_GUARD_ENROLL_FUNC_ID)),
     }
 }
+
+fn checked_hvc64_expect_zero(function: u32, args: [u64; 17]) -> Result<()> {
+    smccc::checked_hvc64_expect_zero(function, args).map_err(|e| Error::HvcError(e, function))
+}
+
+fn checked_hvc64(function: u32, args: [u64; 17]) -> Result<u64> {
+    smccc::checked_hvc64(function, args).map_err(|e| Error::HvcError(e, function))
+}
diff --git a/libs/hyp/src/hypervisor/mod.rs b/libs/hyp/src/hypervisor/mod.rs
index 5807698..87925d2 100644
--- a/libs/hyp/src/hypervisor/mod.rs
+++ b/libs/hyp/src/hypervisor/mod.rs
@@ -14,40 +14,27 @@
 
 //! Wrappers around hypervisor back-ends.
 
+mod common;
 mod kvm;
 
-/// Queries the memory protection parameters for a protected virtual machine.
-///
-/// Returns the memory protection granule size in bytes.
-pub fn hyp_meminfo() -> smccc::Result<u64> {
-    kvm::hyp_meminfo()
+pub use common::Hypervisor;
+use kvm::KvmHypervisor;
+
+static HYPERVISOR: HypervisorBackend = HypervisorBackend::Kvm;
+
+enum HypervisorBackend {
+    Kvm,
 }
 
-/// Shares a region of memory with the host, granting it read, write and execute permissions.
-/// The size of the region is equal to the memory protection granule returned by [`hyp_meminfo`].
-pub fn mem_share(base_ipa: u64) -> smccc::Result<()> {
-    kvm::mem_share(base_ipa)
+impl HypervisorBackend {
+    fn get_hypervisor(&self) -> &'static dyn Hypervisor {
+        match self {
+            Self::Kvm => &KvmHypervisor,
+        }
+    }
 }
 
-/// Revokes access permission from the host to a memory region previously shared with
-/// [`mem_share`]. The size of the region is equal to the memory protection granule returned by
-/// [`hyp_meminfo`].
-pub fn mem_unshare(base_ipa: u64) -> smccc::Result<()> {
-    kvm::mem_unshare(base_ipa)
-}
-
-pub(crate) fn mmio_guard_info() -> smccc::Result<u64> {
-    kvm::mmio_guard_info()
-}
-
-pub(crate) fn mmio_guard_enroll() -> smccc::Result<()> {
-    kvm::mmio_guard_enroll()
-}
-
-pub(crate) fn mmio_guard_map(ipa: u64) -> smccc::Result<()> {
-    kvm::mmio_guard_map(ipa)
-}
-
-pub(crate) fn mmio_guard_unmap(ipa: u64) -> smccc::Result<()> {
-    kvm::mmio_guard_unmap(ipa)
+/// Gets the hypervisor singleton.
+pub fn get_hypervisor() -> &'static dyn Hypervisor {
+    HYPERVISOR.get_hypervisor()
 }
diff --git a/libs/hyp/src/lib.rs b/libs/hyp/src/lib.rs
index f0f0631..66c78f4 100644
--- a/libs/hyp/src/lib.rs
+++ b/libs/hyp/src/lib.rs
@@ -16,8 +16,9 @@
 
 #![no_std]
 
+mod error;
 mod hypervisor;
 mod util;
 
-pub use hypervisor::{hyp_meminfo, mem_share, mem_unshare};
-pub mod mmio_guard;
+pub use error::{Error, Result};
+pub use hypervisor::{get_hypervisor, Hypervisor};
diff --git a/libs/hyp/src/mmio_guard.rs b/libs/hyp/src/mmio_guard.rs
deleted file mode 100644
index 512eb88..0000000
--- a/libs/hyp/src/mmio_guard.rs
+++ /dev/null
@@ -1,69 +0,0 @@
-// Copyright 2022, The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Safe MMIO_GUARD support.
-
-use crate::hypervisor::{mmio_guard_enroll, mmio_guard_info, mmio_guard_map, mmio_guard_unmap};
-use crate::util::{page_address, SIZE_4KB};
-use core::{fmt, result};
-
-/// MMIO guard error.
-#[derive(Debug, Clone)]
-pub enum Error {
-    /// Failed the necessary MMIO_GUARD_ENROLL call.
-    EnrollFailed(smccc::Error),
-    /// Failed to obtain the MMIO_GUARD granule size.
-    InfoFailed(smccc::Error),
-    /// Failed to MMIO_GUARD_MAP a page.
-    MapFailed(smccc::Error),
-    /// Failed to MMIO_GUARD_UNMAP a page.
-    UnmapFailed(smccc::Error),
-    /// The MMIO_GUARD granule used by the hypervisor is not supported.
-    UnsupportedGranule(usize),
-}
-
-impl fmt::Display for Error {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match self {
-            Self::EnrollFailed(e) => write!(f, "Failed to enroll into MMIO_GUARD: {e}"),
-            Self::InfoFailed(e) => write!(f, "Failed to get the MMIO_GUARD granule: {e}"),
-            Self::MapFailed(e) => write!(f, "Failed to MMIO_GUARD map: {e}"),
-            Self::UnmapFailed(e) => write!(f, "Failed to MMIO_GUARD unmap: {e}"),
-            Self::UnsupportedGranule(g) => write!(f, "Unsupported MMIO_GUARD granule: {g}"),
-        }
-    }
-}
-
-/// Result type with mmio_guard::Error.
-pub type Result<T> = result::Result<T, Error>;
-
-/// Initializes the hypervisor by enrolling a MMIO guard and checking the memory granule size.
-pub fn init() -> Result<()> {
-    mmio_guard_enroll().map_err(Error::EnrollFailed)?;
-    let mmio_granule = mmio_guard_info().map_err(Error::InfoFailed)? as usize;
-    if mmio_granule != SIZE_4KB {
-        return Err(Error::UnsupportedGranule(mmio_granule));
-    }
-    Ok(())
-}
-
-/// Maps a memory address to the hypervisor MMIO guard.
-pub fn map(addr: usize) -> Result<()> {
-    mmio_guard_map(page_address(addr)).map_err(Error::MapFailed)
-}
-
-/// Unmaps a memory address from the hypervisor MMIO guard.
-pub fn unmap(addr: usize) -> Result<()> {
-    mmio_guard_unmap(page_address(addr)).map_err(Error::UnmapFailed)
-}
diff --git a/libs/libfdt/src/lib.rs b/libs/libfdt/src/lib.rs
index 7ddf680..61b69f5 100644
--- a/libs/libfdt/src/lib.rs
+++ b/libs/libfdt/src/lib.rs
@@ -606,6 +606,26 @@
         Ok(fdt)
     }
 
+    /// Creates an empty Flattened Device Tree with a mutable slice.
+    pub fn create_empty_tree(fdt: &mut [u8]) -> Result<&mut Self> {
+        // SAFETY - fdt_create_empty_tree() only write within the specified length,
+        //          and returns error if buffer was insufficient.
+        //          There will be no memory write outside of the given fdt.
+        let ret = unsafe {
+            libfdt_bindgen::fdt_create_empty_tree(
+                fdt.as_mut_ptr().cast::<c_void>(),
+                fdt.len() as i32,
+            )
+        };
+        fdt_err_expect_zero(ret)?;
+
+        // SAFETY - The FDT will be validated before it is returned.
+        let fdt = unsafe { Self::unchecked_from_mut_slice(fdt) };
+        fdt.check_full()?;
+
+        Ok(fdt)
+    }
+
     /// Wraps a slice containing a Flattened Device Tree.
     ///
     /// # Safety
diff --git a/pvmfw/TEST_MAPPING b/pvmfw/TEST_MAPPING
index 5e58ebb..e4a80dc 100644
--- a/pvmfw/TEST_MAPPING
+++ b/pvmfw/TEST_MAPPING
@@ -2,6 +2,9 @@
   "avf-presubmit" : [
     {
       "name" : "libpvmfw_avb.integration_test"
+    },
+    {
+      "name" : "libpvmfw.bootargs.test"
     }
   ]
 }
\ No newline at end of file
diff --git a/pvmfw/src/entry.rs b/pvmfw/src/entry.rs
index e0af856..1309d73 100644
--- a/pvmfw/src/entry.rs
+++ b/pvmfw/src/entry.rs
@@ -25,7 +25,7 @@
 use core::arch::asm;
 use core::num::NonZeroUsize;
 use core::slice;
-use hyp::mmio_guard;
+use hyp::get_hypervisor;
 use log::debug;
 use log::error;
 use log::info;
@@ -172,12 +172,12 @@
     // Use debug!() to avoid printing to the UART if we failed to configure it as only local
     // builds that have tweaked the logger::init() call will actually attempt to log the message.
 
-    mmio_guard::init().map_err(|e| {
+    get_hypervisor().mmio_guard_init().map_err(|e| {
         debug!("{e}");
         RebootReason::InternalError
     })?;
 
-    mmio_guard::map(console::BASE_ADDRESS).map_err(|e| {
+    get_hypervisor().mmio_guard_map(console::BASE_ADDRESS).map_err(|e| {
         debug!("Failed to configure the UART: {e}");
         RebootReason::InternalError
     })?;
@@ -236,7 +236,7 @@
         error!("Failed to unshare MMIO ranges: {e}");
         RebootReason::InternalError
     })?;
-    mmio_guard::unmap(console::BASE_ADDRESS).map_err(|e| {
+    get_hypervisor().mmio_guard_unmap(console::BASE_ADDRESS).map_err(|e| {
         error!("Failed to unshare the UART: {e}");
         RebootReason::InternalError
     })?;
diff --git a/pvmfw/src/helpers.rs b/pvmfw/src/helpers.rs
index 6310826..9c739d1 100644
--- a/pvmfw/src/helpers.rs
+++ b/pvmfw/src/helpers.rs
@@ -40,18 +40,19 @@
 }
 
 /// Write a value to a system register.
+///
+/// # Safety
+///
+/// Callers must ensure that side effects of updating the system register are properly handled.
 #[macro_export]
 macro_rules! write_sysreg {
     ($sysreg:literal, $val:expr) => {{
         let value: usize = $val;
-        // Safe because it writes a system register and does not affect Rust.
-        unsafe {
-            core::arch::asm!(
-                concat!("msr ", $sysreg, ", {}"),
-                in(reg) value,
-                options(nomem, nostack, preserves_flags),
-            )
-        }
+        core::arch::asm!(
+            concat!("msr ", $sysreg, ", {}"),
+            in(reg) value,
+            options(nomem, nostack, preserves_flags),
+        )
     }};
 }
 
diff --git a/pvmfw/src/memory.rs b/pvmfw/src/memory.rs
index fde3f9b..2d5eb5c 100644
--- a/pvmfw/src/memory.rs
+++ b/pvmfw/src/memory.rs
@@ -29,7 +29,7 @@
 use core::ops::Range;
 use core::ptr::NonNull;
 use core::result;
-use hyp::{hyp_meminfo, mem_share, mem_unshare, mmio_guard};
+use hyp::get_hypervisor;
 use log::error;
 use tinyvec::ArrayVec;
 
@@ -102,8 +102,8 @@
     Overlaps,
     /// Region couldn't be mapped.
     FailedToMap,
-    /// Error from an MMIO guard call.
-    MmioGuard(mmio_guard::Error),
+    /// Error from the interaction with the hypervisor.
+    Hypervisor(hyp::Error),
 }
 
 impl fmt::Display for MemoryTrackerError {
@@ -116,14 +116,14 @@
             Self::OutOfRange => write!(f, "Region is out of the tracked memory address space"),
             Self::Overlaps => write!(f, "New region overlaps with tracked regions"),
             Self::FailedToMap => write!(f, "Failed to map the new region"),
-            Self::MmioGuard(e) => e.fmt(f),
+            Self::Hypervisor(e) => e.fmt(f),
         }
     }
 }
 
-impl From<mmio_guard::Error> for MemoryTrackerError {
-    fn from(e: mmio_guard::Error) -> Self {
-        Self::MmioGuard(e)
+impl From<hyp::Error> for MemoryTrackerError {
+    fn from(e: hyp::Error) -> Self {
+        Self::Hypervisor(e)
     }
 }
 
@@ -213,7 +213,7 @@
         })?;
 
         for page_base in page_iterator(&range) {
-            mmio_guard::map(page_base)?;
+            get_hypervisor().mmio_guard_map(page_base)?;
         }
 
         if self.mmio_regions.try_push(range).is_some() {
@@ -253,7 +253,7 @@
     pub fn mmio_unmap_all(&self) -> Result<()> {
         for region in &self.mmio_regions {
             for page_base in page_iterator(region) {
-                mmio_guard::unmap(page_base)?;
+                get_hypervisor().mmio_guard_unmap(page_base)?;
             }
         }
 
@@ -278,12 +278,12 @@
 /// Gives the KVM host read, write and execute permissions on the given memory range. If the range
 /// is not aligned with the memory protection granule then it will be extended on either end to
 /// align.
-fn share_range(range: &MemoryRange, granule: usize) -> smccc::Result<()> {
+fn share_range(range: &MemoryRange, granule: usize) -> hyp::Result<()> {
     for base in (align_down(range.start, granule)
         .expect("Memory protection granule was not a power of two")..range.end)
         .step_by(granule)
     {
-        mem_share(base as u64)?;
+        get_hypervisor().mem_share(base as u64)?;
     }
     Ok(())
 }
@@ -291,12 +291,12 @@
 /// Removes permission from the KVM host to access the given memory range which was previously
 /// shared. If the range is not aligned with the memory protection granule then it will be extended
 /// on either end to align.
-fn unshare_range(range: &MemoryRange, granule: usize) -> smccc::Result<()> {
+fn unshare_range(range: &MemoryRange, granule: usize) -> hyp::Result<()> {
     for base in (align_down(range.start, granule)
         .expect("Memory protection granule was not a power of two")..range.end)
         .step_by(granule)
     {
-        mem_unshare(base as u64)?;
+        get_hypervisor().mem_unshare(base as u64)?;
     }
     Ok(())
 }
@@ -305,7 +305,7 @@
 /// with the host. Returns a pointer to the buffer.
 ///
 /// It will be aligned to the memory sharing granule size supported by the hypervisor.
-pub fn alloc_shared(size: usize) -> smccc::Result<NonNull<u8>> {
+pub fn alloc_shared(size: usize) -> hyp::Result<NonNull<u8>> {
     let layout = shared_buffer_layout(size)?;
     let granule = layout.align();
 
@@ -333,7 +333,7 @@
 ///
 /// The memory must have been allocated by `alloc_shared` with the same size, and not yet
 /// deallocated.
-pub unsafe fn dealloc_shared(vaddr: NonNull<u8>, size: usize) -> smccc::Result<()> {
+pub unsafe fn dealloc_shared(vaddr: NonNull<u8>, size: usize) -> hyp::Result<()> {
     let layout = shared_buffer_layout(size)?;
     let granule = layout.align();
 
@@ -352,9 +352,9 @@
 /// It will be aligned to the memory sharing granule size supported by the hypervisor.
 ///
 /// Panics if `size` is 0.
-fn shared_buffer_layout(size: usize) -> smccc::Result<Layout> {
+fn shared_buffer_layout(size: usize) -> hyp::Result<Layout> {
     assert_ne!(size, 0);
-    let granule = hyp_meminfo()? as usize;
+    let granule = get_hypervisor().memory_protection_granule()?;
     let allocated_size =
         align_up(size, granule).expect("Memory protection granule was not a power of two");
     Ok(Layout::from_size_align(allocated_size, granule).unwrap())
diff --git a/rialto/Android.bp b/rialto/Android.bp
index 5034bf4..cf81563 100644
--- a/rialto/Android.bp
+++ b/rialto/Android.bp
@@ -13,7 +13,6 @@
         "libbuddy_system_allocator",
         "libhyp",
         "liblog_rust_nostd",
-        "libsmccc",
         "libvmbase",
     ],
     apex_available: ["com.android.virt"],
diff --git a/rialto/src/error.rs b/rialto/src/error.rs
index 8f34676..754e554 100644
--- a/rialto/src/error.rs
+++ b/rialto/src/error.rs
@@ -16,14 +16,14 @@
 
 use aarch64_paging::MapError;
 use core::{fmt, result};
-use hyp::mmio_guard::Error as MmioError;
+use hyp::Error as HypervisorError;
 
 pub type Result<T> = result::Result<T, Error>;
 
 #[derive(Clone, Debug)]
 pub enum Error {
-    /// MMIO guard failed.
-    MmioGuard(MmioError),
+    /// Hypervisor error.
+    Hypervisor(HypervisorError),
     /// Failed when attempting to map some range in the page table.
     PageTableMapping(MapError),
     /// Failed to initialize the logger.
@@ -33,7 +33,7 @@
 impl fmt::Display for Error {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
-            Self::MmioGuard(e) => write!(f, "MMIO guard failed: {e}."),
+            Self::Hypervisor(e) => write!(f, "MMIO guard failed: {e}."),
             Self::PageTableMapping(e) => {
                 write!(f, "Failed when attempting to map some range in the page table: {e}.")
             }
@@ -42,9 +42,9 @@
     }
 }
 
-impl From<MmioError> for Error {
-    fn from(e: MmioError) -> Self {
-        Self::MmioGuard(e)
+impl From<HypervisorError> for Error {
+    fn from(e: HypervisorError) -> Self {
+        Self::Hypervisor(e)
     }
 }
 
diff --git a/rialto/src/main.rs b/rialto/src/main.rs
index 76f5495..99e07b6 100644
--- a/rialto/src/main.rs
+++ b/rialto/src/main.rs
@@ -28,7 +28,7 @@
     paging::{Attributes, MemoryRegion},
 };
 use buddy_system_allocator::LockedHeap;
-use hyp::mmio_guard;
+use hyp::get_hypervisor;
 use log::{debug, error, info};
 use vmbase::{main, power::reboot};
 
@@ -109,11 +109,11 @@
 }
 
 fn try_init_logger() -> Result<()> {
-    match mmio_guard::init() {
+    match get_hypervisor().mmio_guard_init() {
         // pKVM blocks MMIO by default, we need to enable MMIO guard to support logging.
-        Ok(()) => mmio_guard::map(vmbase::console::BASE_ADDRESS)?,
+        Ok(()) => get_hypervisor().mmio_guard_map(vmbase::console::BASE_ADDRESS)?,
         // MMIO guard enroll is not supported in unprotected VM.
-        Err(mmio_guard::Error::EnrollFailed(smccc::Error::NotSupported)) => {}
+        Err(hyp::Error::MmioGuardNotsupported) => {}
         Err(e) => return Err(e.into()),
     };
     vmbase::logger::init(log::LevelFilter::Debug).map_err(|_| Error::LoggerInit)
diff --git a/tests/hostside/AndroidTest.xml b/tests/hostside/AndroidTest.xml
index 429d910..18728ad 100644
--- a/tests/hostside/AndroidTest.xml
+++ b/tests/hostside/AndroidTest.xml
@@ -25,8 +25,6 @@
         <option name="force-root" value="false"/>
     </target_preparer>
 
-    <target_preparer class="com.android.microdroid.test.preparer.DisableMicrodroidDebugPolicyPreparer" />
-
     <test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
         <option name="jar" value="MicrodroidHostTestCases.jar" />
     </test>
diff --git a/tests/hostside/java/com/android/microdroid/test/PvmfwDebugPolicyHostTests.java b/tests/hostside/java/com/android/microdroid/test/DebugPolicyHostTests.java
similarity index 81%
rename from tests/hostside/java/com/android/microdroid/test/PvmfwDebugPolicyHostTests.java
rename to tests/hostside/java/com/android/microdroid/test/DebugPolicyHostTests.java
index 0f6d095..014f9f0 100644
--- a/tests/hostside/java/com/android/microdroid/test/PvmfwDebugPolicyHostTests.java
+++ b/tests/hostside/java/com/android/microdroid/test/DebugPolicyHostTests.java
@@ -48,11 +48,10 @@
 import java.io.File;
 import java.util.Objects;
 import java.util.concurrent.TimeUnit;
-import java.io.FileNotFoundException;
 
-/** Tests debug policy of pvmfw.bin with custom debug policy */
+/** Tests debug policy */
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class PvmfwDebugPolicyHostTests extends MicrodroidHostTestCaseBase {
+public class DebugPolicyHostTests extends MicrodroidHostTestCaseBase {
     @NonNull private static final String PVMFW_FILE_NAME = "pvmfw_test.bin";
     @NonNull private static final String BCC_FILE_NAME = "bcc.dat";
     @NonNull private static final String PACKAGE_FILE_NAME = "MicrodroidTestApp.apk";
@@ -70,6 +69,16 @@
     @NonNull private static final String CUSTOM_PVMFW_IMG_PATH = TEST_ROOT + PVMFW_FILE_NAME;
     @NonNull private static final String CUSTOM_PVMFW_IMG_PATH_PROP = "hypervisor.pvmfw.path";
 
+    @NonNull private static final String CUSTOM_DEBUG_POLICY_FILE_NAME = "debug_policy.dtb";
+
+    @NonNull
+    private static final String CUSTOM_DEBUG_POLICY_PATH =
+            TEST_ROOT + CUSTOM_DEBUG_POLICY_FILE_NAME;
+
+    @NonNull
+    private static final String CUSTOM_DEBUG_POLICY_PATH_PROP =
+            "hypervisor.virtualizationmanager.debug_policy.path";
+
     @NonNull
     private static final String AVF_DEBUG_POLICY_ADB_DT_PROP_PATH = "/avf/guest/microdroid/adb";
 
@@ -93,6 +102,7 @@
     @Nullable private TestDevice mAndroidDevice;
     @Nullable private ITestDevice mMicrodroidDevice;
     @Nullable private File mCustomPvmfwBinFileOnHost;
+    @Nullable private File mCustomDebugPolicyFileOnHost;
 
     @Before
     public void setUp() throws Exception {
@@ -114,12 +124,14 @@
         mBccFileOnHost =
                 getTestInformation().getDependencyFile(BCC_FILE_NAME, /* targetFirst= */ false);
 
-        // Prepare for loading pvmfw.bin
-        // File will be setup in individual test,
-        // and then pushed to device in launchProtectedVmAndWaitForBootCompleted.
+        // Prepare for system properties for custom debug policy.
+        // File will be prepared later in individual test by setupCustomDebugPolicy()
+        // and then pushed to device when launching with launchProtectedVmAndWaitForBootCompleted()
+        // or tryLaunchProtectedNonDebuggableVm().
         mCustomPvmfwBinFileOnHost =
                 FileUtil.createTempFile(CUSTOM_PVMFW_FILE_PREFIX, CUSTOM_PVMFW_FILE_SUFFIX);
         mAndroidDevice.setProperty(CUSTOM_PVMFW_IMG_PATH_PROP, CUSTOM_PVMFW_IMG_PATH);
+        mAndroidDevice.setProperty(CUSTOM_DEBUG_POLICY_PATH_PROP, CUSTOM_DEBUG_POLICY_PATH);
 
         // Prepare for launching microdroid
         mAndroidDevice.installPackage(findTestFile(PACKAGE_FILE_NAME), /* reinstall */ false);
@@ -138,7 +150,8 @@
         }
         mAndroidDevice.uninstallPackage(PACKAGE_NAME);
 
-        // Cleanup for custom pvmfw.bin
+        // Cleanup for custom debug policies
+        mAndroidDevice.setProperty(CUSTOM_DEBUG_POLICY_PATH_PROP, "");
         mAndroidDevice.setProperty(CUSTOM_PVMFW_IMG_PATH_PROP, "");
         FileUtil.deleteFile(mCustomPvmfwBinFileOnHost);
 
@@ -148,21 +161,15 @@
     }
 
     @Test
-    public void testAdb_boots() throws Exception {
-        assumeTrue(
-                "Skip if host wouldn't install adbd",
-                isDebugPolicyEnabled(AVF_DEBUG_POLICY_ADB_DT_PROP_PATH));
-
-        Pvmfw pvmfw = createPvmfw("avf_debug_policy_with_adb.dtbo");
-        pvmfw.serialize(mCustomPvmfwBinFileOnHost);
+    public void testAdbInDebugPolicy_withDebugLevelNone_bootWithAdbConnection() throws Exception {
+        prepareCustomDebugPolicy("avf_debug_policy_with_adb.dtbo");
 
         launchProtectedVmAndWaitForBootCompleted(MICRODROID_DEBUG_NONE);
     }
 
     @Test
-    public void testNoAdb_boots() throws Exception {
-        Pvmfw pvmfw = createPvmfw("avf_debug_policy_without_adb.dtbo");
-        pvmfw.serialize(mCustomPvmfwBinFileOnHost);
+    public void testNoAdbInDebugPolicy_withDebugLevelNone_boots() throws Exception {
+        prepareCustomDebugPolicy("avf_debug_policy_without_adb.dtbo");
 
         // VM would boot, but cannot verify directly because of no adbd in the VM.
         CommandResult result = tryLaunchProtectedNonDebuggableVm();
@@ -173,9 +180,8 @@
     }
 
     @Test
-    public void testNoAdb_noConnection() throws Exception {
-        Pvmfw pvmfw = createPvmfw("avf_debug_policy_without_adb.dtbo");
-        pvmfw.serialize(mCustomPvmfwBinFileOnHost);
+    public void testNoAdbInDebugPolicy_withDebugLevelNone_noConnection() throws Exception {
+        prepareCustomDebugPolicy("avf_debug_policy_without_adb.dtbo");
 
         assertThrows(
                 "Microdroid shouldn't be recognized because of missing adb connection",
@@ -185,6 +191,13 @@
                                 MICRODROID_DEBUG_NONE, BOOT_FAILURE_WAIT_TIME_MS));
     }
 
+    @Test
+    public void testNoAdbInDebugPolicy_withDebugLevelFull_bootWithAdbConnection() throws Exception {
+        prepareCustomDebugPolicy("avf_debug_policy_without_adb.dtbo");
+
+        launchProtectedVmAndWaitForBootCompleted(MICRODROID_DEBUG_FULL);
+    }
+
     private boolean isDebugPolicyEnabled(@NonNull String dtPropertyPath)
             throws DeviceNotAvailableException {
         CommandRunner runner = new CommandRunner(mAndroidDevice);
@@ -208,14 +221,16 @@
         return new CommandRunner(mMicrodroidDevice).run("xxd", "-p", path);
     }
 
-    @NonNull
-    private Pvmfw createPvmfw(@NonNull String debugPolicyFileName) throws FileNotFoundException {
-        File file =
+    private void prepareCustomDebugPolicy(@NonNull String debugPolicyFileName) throws Exception {
+        mCustomDebugPolicyFileOnHost =
                 getTestInformation()
                         .getDependencyFile(debugPolicyFileName, /* targetFirst= */ false);
-        return new Pvmfw.Builder(mPvmfwBinFileOnHost, mBccFileOnHost)
-                .setDebugPolicyOverlay(file)
-                .build();
+
+        Pvmfw pvmfw =
+                new Pvmfw.Builder(mPvmfwBinFileOnHost, mBccFileOnHost)
+                        .setDebugPolicyOverlay(mCustomDebugPolicyFileOnHost)
+                        .build();
+        pvmfw.serialize(mCustomPvmfwBinFileOnHost);
     }
 
     private boolean hasConsoleOutput(@NonNull CommandResult result)
@@ -242,6 +257,7 @@
                         .debugLevel(debugLevel)
                         .protectedVm(/* protectedVm= */ true)
                         .addBootFile(mCustomPvmfwBinFileOnHost, PVMFW_FILE_NAME)
+                        .addBootFile(mCustomDebugPolicyFileOnHost, CUSTOM_DEBUG_POLICY_FILE_NAME)
                         .setAdbConnectTimeoutMs(adbTimeoutMs)
                         .build(mAndroidDevice);
         assertThat(mMicrodroidDevice.waitForBootComplete(BOOT_COMPLETE_TIMEOUT_MS)).isTrue();
@@ -256,7 +272,8 @@
         // but non-debuggable VM may not enable adb.
         CommandRunner runner = new CommandRunner(mAndroidDevice);
         runner.run("mkdir", "-p", TEST_ROOT);
-        mAndroidDevice.pushFile(mCustomPvmfwBinFileOnHost, TEST_ROOT + PVMFW_FILE_NAME);
+        mAndroidDevice.pushFile(mCustomPvmfwBinFileOnHost, CUSTOM_PVMFW_IMG_PATH);
+        mAndroidDevice.pushFile(mCustomDebugPolicyFileOnHost, CUSTOM_DEBUG_POLICY_PATH);
 
         // This will fail because app wouldn't finish itself.
         // But let's run the app once and get logs.
diff --git a/virtualizationmanager/Android.bp b/virtualizationmanager/Android.bp
index c913d02..59e507f 100644
--- a/virtualizationmanager/Android.bp
+++ b/virtualizationmanager/Android.bp
@@ -56,6 +56,7 @@
         "libvmconfig",
         "libzip",
         "libvsock",
+        "liblibfdt",
         // TODO(b/202115393) stabilize the interface
         "packagemanager_aidl-rust",
     ],
@@ -78,5 +79,9 @@
     rustlibs: [
         "libtempfile",
     ],
+    data: [
+        ":test_avf_debug_policy_with_adb",
+        ":test_avf_debug_policy_without_adb",
+    ],
     test_suites: ["general-tests"],
 }
diff --git a/virtualizationmanager/src/crosvm.rs b/virtualizationmanager/src/crosvm.rs
index 60dd4cf..856ff1e 100644
--- a/virtualizationmanager/src/crosvm.rs
+++ b/virtualizationmanager/src/crosvm.rs
@@ -639,10 +639,6 @@
             "PVM_FIRMWARE_INSTANCE_IMAGE_CHANGED" => {
                 return DeathReason::PVM_FIRMWARE_INSTANCE_IMAGE_CHANGED
             }
-            "BOOTLOADER_PUBLIC_KEY_MISMATCH" => return DeathReason::BOOTLOADER_PUBLIC_KEY_MISMATCH,
-            "BOOTLOADER_INSTANCE_IMAGE_CHANGED" => {
-                return DeathReason::BOOTLOADER_INSTANCE_IMAGE_CHANGED
-            }
             "MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE" => {
                 return DeathReason::MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE
             }
diff --git a/virtualizationmanager/src/debug_config.rs b/virtualizationmanager/src/debug_config.rs
index e8863c7..7172e7d 100644
--- a/virtualizationmanager/src/debug_config.rs
+++ b/virtualizationmanager/src/debug_config.rs
@@ -17,16 +17,134 @@
 use android_system_virtualizationservice::aidl::android::system::virtualizationservice::{
     VirtualMachineAppConfig::DebugLevel::DebugLevel,
 };
-use std::fs::File;
-use std::io::Read;
-use log::info;
+use anyhow::{anyhow, Context, Error, Result};
+use std::fs;
+use std::io::ErrorKind;
+use std::path::{Path, PathBuf};
+use std::ffi::{CString, NulError};
+use log::{warn, info};
 use rustutils::system_properties;
+use libfdt::{Fdt, FdtError};
+use lazy_static::lazy_static;
 
-const DEBUG_POLICY_LOG_PATH: &str = "/proc/device-tree/avf/guest/common/log";
-const DEBUG_POLICY_RAMDUMP_PATH: &str = "/proc/device-tree/avf/guest/common/ramdump";
-const DEBUG_POLICY_ADB_PATH: &str = "/proc/device-tree/avf/guest/microdroid/adb";
+const CUSTOM_DEBUG_POLICY_OVERLAY_SYSPROP: &str =
+    "hypervisor.virtualizationmanager.debug_policy.path";
+const DEVICE_TREE_EMPTY_TREE_SIZE_BYTES: usize = 100; // rough estimation.
 
-const SYSPROP_CUSTOM_DEBUG_POLICY_PATH: &str = "hypervisor.virtualizationmanager.debug_policy.path";
+struct DPPath {
+    node_path: CString,
+    prop_name: CString,
+}
+
+impl DPPath {
+    fn new(node_path: &str, prop_name: &str) -> Result<Self, NulError> {
+        Ok(Self { node_path: CString::new(node_path)?, prop_name: CString::new(prop_name)? })
+    }
+
+    fn to_path(&self) -> PathBuf {
+        // SAFETY -- unwrap() is safe for to_str() because node_path and prop_name were &str.
+        PathBuf::from(
+            [
+                "/sys/firmware/devicetree/base",
+                self.node_path.to_str().unwrap(),
+                "/",
+                self.prop_name.to_str().unwrap(),
+            ]
+            .concat(),
+        )
+    }
+}
+
+lazy_static! {
+    static ref DP_LOG_PATH: DPPath = DPPath::new("/avf/guest/common", "log").unwrap();
+    static ref DP_RAMDUMP_PATH: DPPath = DPPath::new("/avf/guest/common", "ramdump").unwrap();
+    static ref DP_ADB_PATH: DPPath = DPPath::new("/avf/guest/microdroid", "adb").unwrap();
+}
+
+/// Get debug policy value in bool. It's true iff the value is explicitly set to <1>.
+fn get_debug_policy_bool(path: &Path) -> Result<bool> {
+    let value = match fs::read(path) {
+        Ok(value) => value,
+        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(false),
+        Err(error) => Err(error).with_context(|| format!("Failed to read {path:?}"))?,
+    };
+
+    // DT spec uses big endian although Android is always little endian.
+    match u32::from_be_bytes(value.try_into().map_err(|_| anyhow!("Malformed value in {path:?}"))?)
+    {
+        0 => Ok(false),
+        1 => Ok(true),
+        value => Err(anyhow!("Invalid value {value} in {path:?}")),
+    }
+}
+
+/// Get property value in bool. It's true iff the value is explicitly set to <1>.
+/// It takes path as &str instead of &Path, because we don't want OsStr.
+fn get_fdt_prop_bool(fdt: &Fdt, path: &DPPath) -> Result<bool> {
+    let (node_path, prop_name) = (&path.node_path, &path.prop_name);
+    let node = match fdt.node(node_path) {
+        Ok(Some(node)) => node,
+        Err(error) if error != FdtError::NotFound => Err(error)
+            .map_err(Error::msg)
+            .with_context(|| format!("Failed to get node {node_path:?}"))?,
+        _ => return Ok(false),
+    };
+
+    match node.getprop_u32(prop_name) {
+        Ok(Some(0)) => Ok(false),
+        Ok(Some(1)) => Ok(true),
+        Ok(Some(_)) => Err(anyhow!("Invalid prop value {prop_name:?} in node {node_path:?}")),
+        Err(error) if error != FdtError::NotFound => Err(error)
+            .map_err(Error::msg)
+            .with_context(|| format!("Failed to get prop {prop_name:?}")),
+        _ => Ok(false),
+    }
+}
+
+/// Fdt with owned vector.
+struct OwnedFdt {
+    buffer: Vec<u8>,
+}
+
+impl OwnedFdt {
+    fn from_overlay_onto_new_fdt(overlay_file_path: &Path) -> Result<Self> {
+        let mut overlay_buf = match fs::read(overlay_file_path) {
+            Ok(fdt) => fdt,
+            Err(error) if error.kind() == ErrorKind::NotFound => Default::default(),
+            Err(error) => {
+                Err(error).with_context(|| format!("Failed to read {overlay_file_path:?}"))?
+            }
+        };
+
+        let overlay_buf_size = overlay_buf.len();
+
+        let fdt_estimated_size = overlay_buf_size + DEVICE_TREE_EMPTY_TREE_SIZE_BYTES;
+        let mut fdt_buf = vec![0_u8; fdt_estimated_size];
+        let fdt = Fdt::create_empty_tree(fdt_buf.as_mut_slice())
+            .map_err(Error::msg)
+            .context("Failed to create an empty device tree")?;
+
+        if !overlay_buf.is_empty() {
+            let overlay_fdt = Fdt::from_mut_slice(overlay_buf.as_mut_slice())
+                .map_err(Error::msg)
+                .with_context(|| "Malformed {overlay_file_path:?}")?;
+
+            // SAFETY - Return immediately if error happens. Damaged fdt_buf and fdt are discarded.
+            unsafe {
+                fdt.apply_overlay(overlay_fdt).map_err(Error::msg).with_context(|| {
+                    "Failed to overlay {overlay_file_path:?} onto empty device tree"
+                })?;
+            }
+        }
+
+        Ok(Self { buffer: fdt_buf })
+    }
+
+    fn as_fdt(&self) -> &Fdt {
+        // SAFETY - Checked validity of buffer when instantiate.
+        unsafe { Fdt::unchecked_from_slice(&self.buffer) }
+    }
+}
 
 /// Debug configurations for both debug level and debug policy
 #[derive(Debug)]
@@ -37,43 +155,36 @@
     debug_policy_adb: bool,
 }
 
-/// Get debug policy value in bool. It's true iff the value is explicitly set to <1>.
-fn get_debug_policy_bool(path: &'static str) -> Option<bool> {
-    let mut file = File::open(path).ok()?;
-    let mut log: [u8; 4] = Default::default();
-    file.read_exact(&mut log).ok()?;
-    // DT spec uses big endian although Android is always little endian.
-    Some(u32::from_be_bytes(log) == 1)
-}
-
 impl DebugConfig {
     pub fn new(debug_level: DebugLevel) -> Self {
-        match system_properties::read(SYSPROP_CUSTOM_DEBUG_POLICY_PATH).unwrap_or_default() {
-            Some(debug_policy_path) if !debug_policy_path.is_empty() => {
-                // TODO: Read debug policy file and override log, adb, ramdump for testing.
-                info!("Debug policy is disabled by sysprop");
-                Self {
-                    debug_level,
-                    debug_policy_log: false,
-                    debug_policy_ramdump: false,
-                    debug_policy_adb: false,
-                }
+        match system_properties::read(CUSTOM_DEBUG_POLICY_OVERLAY_SYSPROP).unwrap_or_default() {
+            Some(path) if !path.is_empty() => {
+                match Self::from_custom_debug_overlay_policy(debug_level, Path::new(&path)) {
+                    Ok(debug_config) => {
+                        info!("Loaded custom debug policy overlay {path}: {debug_config:?}");
+                        return debug_config;
+                    }
+                    Err(err) => warn!("Failed to load custom debug policy overlay {path}: {err:?}"),
+                };
             }
             _ => {
-                let debug_config = Self {
-                    debug_level,
-                    debug_policy_log: get_debug_policy_bool(DEBUG_POLICY_LOG_PATH)
-                        .unwrap_or_default(),
-                    debug_policy_ramdump: get_debug_policy_bool(DEBUG_POLICY_RAMDUMP_PATH)
-                        .unwrap_or_default(),
-                    debug_policy_adb: get_debug_policy_bool(DEBUG_POLICY_ADB_PATH)
-                        .unwrap_or_default(),
+                match Self::from_host(debug_level) {
+                    Ok(debug_config) => {
+                        info!("Loaded debug policy from host OS: {debug_config:?}");
+                        return debug_config;
+                    }
+                    Err(err) => warn!("Failed to load debug policy from host OS: {err:?}"),
                 };
-                info!("Loaded debug policy from host OS: {:?}", debug_config);
-
-                debug_config
             }
         }
+
+        info!("Debug policy is disabled");
+        Self {
+            debug_level,
+            debug_policy_log: false,
+            debug_policy_ramdump: false,
+            debug_policy_adb: false,
+        }
     }
 
     /// Get whether console output should be configred for VM to leave console and adb log.
@@ -91,4 +202,123 @@
     pub fn is_ramdump_needed(&self) -> bool {
         self.debug_level != DebugLevel::NONE || self.debug_policy_ramdump
     }
+
+    // TODO: Remove this code path in user build for removing libfdt depenency.
+    fn from_custom_debug_overlay_policy(debug_level: DebugLevel, path: &Path) -> Result<Self> {
+        match OwnedFdt::from_overlay_onto_new_fdt(path) {
+            Ok(fdt) => Ok(Self {
+                debug_level,
+                debug_policy_log: get_fdt_prop_bool(fdt.as_fdt(), &DP_LOG_PATH)?,
+                debug_policy_ramdump: get_fdt_prop_bool(fdt.as_fdt(), &DP_RAMDUMP_PATH)?,
+                debug_policy_adb: get_fdt_prop_bool(fdt.as_fdt(), &DP_ADB_PATH)?,
+            }),
+            Err(err) => Err(err),
+        }
+    }
+
+    fn from_host(debug_level: DebugLevel) -> Result<Self> {
+        Ok(Self {
+            debug_level,
+            debug_policy_log: get_debug_policy_bool(&DP_LOG_PATH.to_path())?,
+            debug_policy_ramdump: get_debug_policy_bool(&DP_RAMDUMP_PATH.to_path())?,
+            debug_policy_adb: get_debug_policy_bool(&DP_ADB_PATH.to_path())?,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use anyhow::ensure;
+
+    fn can_set_sysprop() -> bool {
+        if let Ok(Some(value)) = system_properties::read("ro.build.type") {
+            return "user".eq(&value);
+        }
+        false // if we're in doubt, skip test.
+    }
+
+    #[test]
+    fn test_read_avf_debug_policy_with_adb() -> Result<()> {
+        let debug_config = DebugConfig::from_custom_debug_overlay_policy(
+            DebugLevel::FULL,
+            "avf_debug_policy_with_adb.dtbo".as_ref(),
+        )
+        .unwrap();
+
+        assert_eq!(DebugLevel::FULL, debug_config.debug_level);
+        assert!(!debug_config.debug_policy_log);
+        assert!(!debug_config.debug_policy_ramdump);
+        assert!(debug_config.debug_policy_adb);
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_read_avf_debug_policy_without_adb() -> Result<()> {
+        let debug_config = DebugConfig::from_custom_debug_overlay_policy(
+            DebugLevel::FULL,
+            "avf_debug_policy_without_adb.dtbo".as_ref(),
+        )
+        .unwrap();
+
+        assert_eq!(DebugLevel::FULL, debug_config.debug_level);
+        assert!(!debug_config.debug_policy_log);
+        assert!(!debug_config.debug_policy_ramdump);
+        assert!(!debug_config.debug_policy_adb);
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_invalid_sysprop_disables_debug_policy() -> Result<()> {
+        let debug_config = DebugConfig::from_custom_debug_overlay_policy(
+            DebugLevel::NONE,
+            "/a/does/not/exist/path.dtbo".as_ref(),
+        )
+        .unwrap();
+
+        assert_eq!(DebugLevel::NONE, debug_config.debug_level);
+        assert!(!debug_config.debug_policy_log);
+        assert!(!debug_config.debug_policy_ramdump);
+        assert!(!debug_config.debug_policy_adb);
+
+        Ok(())
+    }
+
+    fn test_new_with_custom_policy_internal() -> Result<()> {
+        let debug_config = DebugConfig::new(DebugLevel::NONE);
+
+        ensure!(debug_config.debug_level == DebugLevel::NONE);
+        ensure!(!debug_config.debug_policy_log);
+        ensure!(!debug_config.debug_policy_ramdump);
+        ensure!(debug_config.debug_policy_adb);
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_new_with_custom_policy() -> Result<()> {
+        if !can_set_sysprop() {
+            // Skip test if we can't override sysprop.
+            return Ok(());
+        }
+
+        // Setup
+        let old_sysprop = system_properties::read(CUSTOM_DEBUG_POLICY_OVERLAY_SYSPROP)
+            .context("Failed to read existing sysprop")?
+            .unwrap_or_default();
+        let file_name = "avf_debug_policy_with_adb.dtbo";
+        system_properties::write(CUSTOM_DEBUG_POLICY_OVERLAY_SYSPROP, file_name)
+            .context("Failed to set sysprop")?;
+
+        // Run test
+        let test_result = test_new_with_custom_policy_internal();
+
+        // Clean up.
+        system_properties::write(CUSTOM_DEBUG_POLICY_OVERLAY_SYSPROP, &old_sysprop)
+            .context("Failed to restore sysprop")?;
+
+        test_result
+    }
 }
diff --git a/virtualizationservice/aidl/android/system/virtualizationcommon/DeathReason.aidl b/virtualizationservice/aidl/android/system/virtualizationcommon/DeathReason.aidl
index 3f47002..0164de4 100644
--- a/virtualizationservice/aidl/android/system/virtualizationcommon/DeathReason.aidl
+++ b/virtualizationservice/aidl/android/system/virtualizationcommon/DeathReason.aidl
@@ -38,10 +38,7 @@
     PVM_FIRMWARE_PUBLIC_KEY_MISMATCH = 7,
     /** The pVM firmware failed to verify the VM because the instance image changed. */
     PVM_FIRMWARE_INSTANCE_IMAGE_CHANGED = 8,
-    /** The bootloader failed to verify the VM because the public key doesn't match. */
-    BOOTLOADER_PUBLIC_KEY_MISMATCH = 9,
-    /** The bootloader failed to verify the VM because the instance image changed. */
-    BOOTLOADER_INSTANCE_IMAGE_CHANGED = 10,
+    // 9 & 10 intentionally removed.
     /** The microdroid failed to connect to VirtualizationService's RPC server. */
     MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE = 11,
     /** The payload for microdroid is changed. */
diff --git a/virtualizationservice/src/atom.rs b/virtualizationservice/src/atom.rs
index 47a1603..4aa3550 100644
--- a/virtualizationservice/src/atom.rs
+++ b/virtualizationservice/src/atom.rs
@@ -87,12 +87,6 @@
         DeathReason::PVM_FIRMWARE_INSTANCE_IMAGE_CHANGED => {
             vm_exited::DeathReason::PvmFirmwareInstanceImageChanged
         }
-        DeathReason::BOOTLOADER_PUBLIC_KEY_MISMATCH => {
-            vm_exited::DeathReason::BootloaderPublicKeyMismatch
-        }
-        DeathReason::BOOTLOADER_INSTANCE_IMAGE_CHANGED => {
-            vm_exited::DeathReason::BootloaderInstanceImageChanged
-        }
         DeathReason::MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE => {
             vm_exited::DeathReason::MicrodroidFailedToConnectToVirtualizationService
         }
diff --git a/vmclient/src/death_reason.rs b/vmclient/src/death_reason.rs
index c417a7c..0610c1a 100644
--- a/vmclient/src/death_reason.rs
+++ b/vmclient/src/death_reason.rs
@@ -37,10 +37,6 @@
     PvmFirmwarePublicKeyMismatch,
     /// The pVM firmware failed to verify the VM because the instance image changed.
     PvmFirmwareInstanceImageChanged,
-    /// The bootloader failed to verify the VM because the public key doesn't match.
-    BootloaderPublicKeyMismatch,
-    /// The bootloader failed to verify the VM because the instance image changed.
-    BootloaderInstanceImageChanged,
     /// The microdroid failed to connect to VirtualizationService's RPC server.
     MicrodroidFailedToConnectToVirtualizationService,
     /// The payload for microdroid is changed.
@@ -71,10 +67,6 @@
             AidlDeathReason::PVM_FIRMWARE_INSTANCE_IMAGE_CHANGED => {
                 Self::PvmFirmwareInstanceImageChanged
             }
-            AidlDeathReason::BOOTLOADER_PUBLIC_KEY_MISMATCH => Self::BootloaderPublicKeyMismatch,
-            AidlDeathReason::BOOTLOADER_INSTANCE_IMAGE_CHANGED => {
-                Self::BootloaderInstanceImageChanged
-            }
             AidlDeathReason::MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE => {
                 Self::MicrodroidFailedToConnectToVirtualizationService
             }