diff --git a/apexkey/OWNERS b/apexkey/OWNERS
new file mode 100644
index 0000000..38765f9
--- /dev/null
+++ b/apexkey/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 296524155
+
+jooyung@google.com
diff --git a/cas/aidl/default/Android.bp b/cas/aidl/default/Android.bp
index 9d094e0..576016e 100644
--- a/cas/aidl/default/Android.bp
+++ b/cas/aidl/default/Android.bp
@@ -26,7 +26,6 @@
         "liblog",
         "libutils",
         "libcutils",
-        "libvndksupport",
     ],
     static_libs: [
         "libaidlcommonsupport",
@@ -44,39 +43,34 @@
 
     srcs: ["service.cpp"],
 
-    stl: "c++_static",
     static_libs: [
-        "android.hardware.cas-V1-ndk",
-        "android.hardware.common-V2-ndk",
         "libaidlcommonsupport",
-        "libbase",
         "libcasexampleimpl",
-        "libcutils",
-        "libutils",
     ],
     shared_libs: [
+        "android.hardware.cas-V1-ndk",
+        "libbase",
         "libbinder_ndk",
         "liblog",
-        "libvndksupport",
+        "libutils",
+        "libcutils",
     ],
     header_libs: ["media_plugin_headers"],
+    vintf_fragments: ["android.hardware.cas-service.xml"],
 }
 
 cc_binary {
     name: "android.hardware.cas-service.example",
     defaults: ["cas_service_example_defaults"],
-    // Installed in APEX
-    installable: false,
+    init_rc: ["cas-default.rc"],
 }
 
-// TODO(b/297467514) Convert to VAPEX
 cc_binary {
     name: "android.hardware.cas-service.example-lazy",
     defaults: ["cas_service_example_defaults"],
     init_rc: ["cas-default-lazy.rc"],
-    vintf_fragments: ["android.hardware.cas-service.xml"],
     cflags: ["-DLAZY_SERVICE"],
-    overrides: ["com.android.hardware.cas"],
+    overrides: ["android.hardware.cas-service.example"],
 }
 
 cc_fuzz {
@@ -90,7 +84,6 @@
         "android.hardware.cas-V1-ndk",
         "libcutils",
         "liblog",
-        "libvndksupport",
     ],
     static_libs: [
         "libaidlcommonsupport",
@@ -101,34 +94,3 @@
         componentid: 1344,
     },
 }
-
-apex {
-    name: "com.android.hardware.cas",
-    manifest: "manifest.json",
-    file_contexts: "file_contexts",
-    key: "com.android.hardware.key",
-    certificate: ":com.android.hardware.certificate",
-    updatable: false,
-    vendor: true,
-
-    binaries: [
-        "android.hardware.cas-service.example",
-    ],
-    prebuilts: [
-        "cas-default.rc",
-        "android.hardware.cas-service.xml",
-    ],
-}
-
-prebuilt_etc {
-    name: "cas-default.rc",
-    src: "cas-default.rc",
-    installable: false,
-}
-
-prebuilt_etc {
-    name: "android.hardware.cas-service.xml",
-    src: "android.hardware.cas-service.xml",
-    sub_dir: "vintf",
-    installable: false,
-}
diff --git a/cas/aidl/default/SharedLibrary.cpp b/cas/aidl/default/SharedLibrary.cpp
index 6322ff3..c12d17d 100644
--- a/cas/aidl/default/SharedLibrary.cpp
+++ b/cas/aidl/default/SharedLibrary.cpp
@@ -19,7 +19,6 @@
 #include "SharedLibrary.h"
 #include <dlfcn.h>
 #include <utils/Log.h>
-#include <vndksupport/linker.h>
 
 namespace aidl {
 namespace android {
@@ -27,12 +26,12 @@
 namespace cas {
 
 SharedLibrary::SharedLibrary(const String8& path) {
-    mLibHandle = android_load_sphal_library(path.c_str(), RTLD_NOW);
+    mLibHandle = dlopen(path.c_str(), RTLD_NOW);
 }
 
 SharedLibrary::~SharedLibrary() {
     if (mLibHandle != NULL) {
-        android_unload_sphal_library(mLibHandle);
+        dlclose(mLibHandle);
         mLibHandle = NULL;
     }
 }
diff --git a/cas/aidl/default/cas-default.rc b/cas/aidl/default/cas-default.rc
index 0ac7fe5..5a60368 100644
--- a/cas/aidl/default/cas-default.rc
+++ b/cas/aidl/default/cas-default.rc
@@ -1,4 +1,4 @@
-service vendor.cas-default /apex/com.android.hardware.cas/bin/hw/android.hardware.cas-service.example
+service vendor.cas-default /vendor/bin/hw/android.hardware.cas-service.example
     interface aidl android.hardware.cas.IMediaCasService/default
     class hal
     user media
diff --git a/cas/aidl/default/manifest.json b/cas/aidl/default/manifest.json
deleted file mode 100644
index 16b4f67..0000000
--- a/cas/aidl/default/manifest.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-    "name": "com.android.hardware.cas",
-    "version": 1,
-    // For CAS HAL to open plugins from /vendor/lib, "vendor" namespace should be imported.
-    // ":sphal" is an alias for the "vendor" namespace in Vendor APEX.
-    "requireNativeLibs": [
-        ":sphal"
-    ]
-}
diff --git a/compatibility_matrices/compatibility_matrix.8.xml b/compatibility_matrices/compatibility_matrix.8.xml
index 098270f..0f82e5f 100644
--- a/compatibility_matrices/compatibility_matrix.8.xml
+++ b/compatibility_matrices/compatibility_matrix.8.xml
@@ -133,6 +133,7 @@
         <interface>
             <name>IFace</name>
             <instance>default</instance>
+            <instance>virtual</instance>
         </interface>
     </hal>
     <hal format="aidl" optional="true">
diff --git a/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl b/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl
index 460ff97..069b2cf 100644
--- a/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl
+++ b/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl
@@ -35,5 +35,6 @@
 @VintfStability
 union BaseBlock {
   android.hardware.common.NativeHandle nativeBlock;
+  android.hardware.HardwareBuffer hwbBlock;
   android.hardware.media.bufferpool2.BufferStatusMessage pooledBlock;
 }
diff --git a/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl b/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl
index 8b8b8e0..7cc041c 100644
--- a/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl
+++ b/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl
@@ -16,6 +16,7 @@
 
 package android.hardware.media.c2;
 
+import android.hardware.HardwareBuffer;
 import android.hardware.common.NativeHandle;
 
 /**
@@ -32,6 +33,10 @@
      */
     NativeHandle nativeBlock;
     /**
+     * #hwbBlock is the opaque representation of a GraphicBuffer
+     */
+    HardwareBuffer hwbBlock;
+    /**
      * #pooledBlock is a reference to a buffer handled by a BufferPool.
      */
     android.hardware.media.bufferpool2.BufferStatusMessage pooledBlock;
diff --git a/tetheroffload/aidl/default/Android.bp b/tetheroffload/aidl/default/Android.bp
index 8f0739c..8c96990 100644
--- a/tetheroffload/aidl/default/Android.bp
+++ b/tetheroffload/aidl/default/Android.bp
@@ -19,18 +19,52 @@
 cc_binary {
     name: "android.hardware.tetheroffload-service.example",
     relative_install_path: "hw",
-    init_rc: ["tetheroffload-example.rc"],
-    vintf_fragments: ["tetheroffload-example.xml"],
     vendor: true,
-    shared_libs: [
+
+    stl: "c++_static",
+    static_libs: [
         "android.hardware.tetheroffload-V1-ndk",
         "libbase",
+    ],
+    shared_libs: [
         "libbinder_ndk",
-        "libcutils",
-        "libutils",
+        "liblog",
     ],
     srcs: [
         "main.cpp",
         "Offload.cpp",
     ],
+
+    installable: false, // installed in APEX
+}
+
+prebuilt_etc {
+    name: "tetheroffload-example.rc",
+    src: "tetheroffload-example.rc",
+    installable: false,
+}
+
+prebuilt_etc {
+    name: "tetheroffload-example.xml",
+    src: "tetheroffload-example.xml",
+    sub_dir: "vintf",
+    installable: false,
+}
+
+apex {
+    name: "com.android.hardware.tetheroffload",
+    manifest: "apex_manifest.json",
+    file_contexts: "apex_file_contexts",
+    key: "com.android.hardware.key",
+    certificate: ":com.android.hardware.certificate",
+    updatable: false,
+    vendor: true,
+
+    binaries: [
+        "android.hardware.tetheroffload-service.example",
+    ],
+    prebuilts: [
+        "tetheroffload-example.rc",
+        "tetheroffload-example.xml",
+    ],
 }
diff --git a/cas/aidl/default/file_contexts b/tetheroffload/aidl/default/apex_file_contexts
similarity index 63%
copy from cas/aidl/default/file_contexts
copy to tetheroffload/aidl/default/apex_file_contexts
index 98bde53..a520101 100644
--- a/cas/aidl/default/file_contexts
+++ b/tetheroffload/aidl/default/apex_file_contexts
@@ -1,3 +1,3 @@
 (/.*)?                                                          u:object_r:vendor_file:s0
 /etc(/.*)?                                                      u:object_r:vendor_configs_file:s0
-/bin/hw/android\.hardware\.cas-service\.example                 u:object_r:hal_cas_default_exec:s0
+/bin/hw/android\.hardware\.tetheroffload-service\.example       u:object_r:hal_tetheroffload_default_exec:s0
diff --git a/tetheroffload/aidl/default/apex_manifest.json b/tetheroffload/aidl/default/apex_manifest.json
new file mode 100644
index 0000000..4c90889
--- /dev/null
+++ b/tetheroffload/aidl/default/apex_manifest.json
@@ -0,0 +1,4 @@
+{
+    "name": "com.android.hardware.tetheroffload",
+    "version": 1
+}
diff --git a/tetheroffload/aidl/default/tetheroffload-example.rc b/tetheroffload/aidl/default/tetheroffload-example.rc
index 46cda61..b95544b 100644
--- a/tetheroffload/aidl/default/tetheroffload-example.rc
+++ b/tetheroffload/aidl/default/tetheroffload-example.rc
@@ -1,4 +1,4 @@
-service vendor.tetheroffload-example /vendor/bin/hw/android.hardware.tetheroffload-service.example
+service vendor.tetheroffload-example /apex/com.android.hardware.tetheroffload/bin/hw/android.hardware.tetheroffload-service.example
     class hal
     user nobody
     group nobody
diff --git a/thermal/aidl/default/Android.bp b/thermal/aidl/default/Android.bp
index 49a578b..451e1e2 100644
--- a/thermal/aidl/default/Android.bp
+++ b/thermal/aidl/default/Android.bp
@@ -24,26 +24,50 @@
 cc_binary {
     name: "android.hardware.thermal-service.example",
     relative_install_path: "hw",
-    init_rc: [":android.hardware.thermal.example.rc"],
-    vintf_fragments: [":android.hardware.thermal.example.xml"],
     vendor: true,
-    shared_libs: [
-        "libbase",
-        "libbinder_ndk",
+    stl: "c++_static",
+    static_libs: [
         "android.hardware.thermal-V1-ndk",
+        "libbase",
+    ],
+    shared_libs: [
+        "libbinder_ndk",
+        "liblog",
     ],
     srcs: [
         "main.cpp",
         "Thermal.cpp",
     ],
+    installable: false,
 }
 
-filegroup {
+prebuilt_etc {
     name: "android.hardware.thermal.example.xml",
-    srcs: ["thermal-example.xml"],
+    src: "thermal-example.xml",
+    sub_dir: "vintf",
+    installable: false,
 }
 
-filegroup {
+prebuilt_etc {
     name: "android.hardware.thermal.example.rc",
-    srcs: ["thermal-example.rc"],
+    src: "thermal-example.rc",
+    installable: false,
+}
+
+apex {
+    name: "com.android.hardware.thermal",
+    manifest: "apex_manifest.json",
+    file_contexts: "apex_file_contexts",
+    key: "com.android.hardware.key",
+    certificate: ":com.android.hardware.certificate",
+    updatable: false,
+    vendor: true,
+
+    binaries: [
+        "android.hardware.thermal-service.example",
+    ],
+    prebuilts: [
+        "android.hardware.thermal.example.xml",
+        "android.hardware.thermal.example.rc",
+    ],
 }
diff --git a/cas/aidl/default/file_contexts b/thermal/aidl/default/apex_file_contexts
similarity index 64%
rename from cas/aidl/default/file_contexts
rename to thermal/aidl/default/apex_file_contexts
index 98bde53..9fa5339 100644
--- a/cas/aidl/default/file_contexts
+++ b/thermal/aidl/default/apex_file_contexts
@@ -1,3 +1,3 @@
 (/.*)?                                                          u:object_r:vendor_file:s0
 /etc(/.*)?                                                      u:object_r:vendor_configs_file:s0
-/bin/hw/android\.hardware\.cas-service\.example                 u:object_r:hal_cas_default_exec:s0
+/bin/hw/android\.hardware\.thermal-service\.example             u:object_r:hal_thermal_default_exec:s0
diff --git a/thermal/aidl/default/apex_manifest.json b/thermal/aidl/default/apex_manifest.json
new file mode 100644
index 0000000..80420d5
--- /dev/null
+++ b/thermal/aidl/default/apex_manifest.json
@@ -0,0 +1,4 @@
+{
+    "name": "com.android.hardware.thermal",
+    "version": 1
+}
diff --git a/thermal/aidl/default/thermal-example.rc b/thermal/aidl/default/thermal-example.rc
index 591ca03..36dde0d 100644
--- a/thermal/aidl/default/thermal-example.rc
+++ b/thermal/aidl/default/thermal-example.rc
@@ -1,4 +1,4 @@
-service vendor.thermal-example /vendor/bin/hw/android.hardware.thermal-service.example
+service vendor.thermal-example /apex/com.android.hardware.thermal/bin/hw/android.hardware.thermal-service.example
     class hal
     user nobody
     group system
diff --git a/weaver/aidl/android/hardware/weaver/IWeaver.aidl b/weaver/aidl/android/hardware/weaver/IWeaver.aidl
index ae816ef..30168e3 100644
--- a/weaver/aidl/android/hardware/weaver/IWeaver.aidl
+++ b/weaver/aidl/android/hardware/weaver/IWeaver.aidl
@@ -58,7 +58,9 @@
      * Throttling must be used to limit the frequency of failed read attempts.
      * The value is only returned when throttling is not active, even if the
      * correct key is provided. If called when throttling is active, the time
-     * until the next attempt can be made is returned.
+     * until the next attempt can be made is returned. Throttling must be
+     * applied on a per-slot basis so that a successful read from one slot does
+     * not reset the throttling state of any other slot.
      *
      * Service status return:
      *