diff --git a/adb/Android.bp b/adb/Android.bp
index 7e3be61..f6a4f39 100644
--- a/adb/Android.bp
+++ b/adb/Android.bp
@@ -29,6 +29,7 @@
         "-DANDROID_BASE_UNIQUE_FD_DISABLE_IMPLICIT_CONVERSION=1",
     ],
     cpp_std: "experimental",
+    stl: "libc++_static",
 
     use_version_lib: true,
     compile_multilib: "first",
@@ -160,7 +161,11 @@
     // libadbconnection_client doesn't need an embedded build number.
     use_version_lib: false,
 
-    version_script: "adbconnection/libadbconnection_client.map.txt",
+    target: {
+        linux: {
+            version_script: "adbconnection/libadbconnection_client.map.txt",
+        },
+    },
     stubs: {
         symbol_file: "adbconnection/libadbconnection_client.map.txt",
         versions: ["1"],
@@ -360,8 +365,6 @@
         "libz",
     ],
 
-    stl: "libc++_static",
-
     // Don't add anything here, we don't want additional shared dependencies
     // on the host adb tool, and shared libraries that link against libc++
     // will violate ODR
@@ -554,11 +557,9 @@
         keep_symbols: true,
     },
 
-    stl: "libc++_static",
     static_libs: [
         "libadbconnection_server",
         "libadbd",
-        "libadbd_auth",
         "libadbd_services",
         "libasyncio",
         "libbase",
@@ -573,6 +574,7 @@
     ],
 
     shared_libs: [
+        "libadbd_auth",
         "libcrypto",
     ],
 }
@@ -581,7 +583,6 @@
     name: "adbd_system_binaries",
     required: [
         "abb",
-        "libadbd_auth",
         "reboot",
         "set-verity-state",
     ]
@@ -735,7 +736,6 @@
         "libziparchive",
         "libz",
     ],
-    stl: "libc++_static",
     proto: {
         type: "lite",
         export_proto_headers: true,
diff --git a/adb/apex/ld.config.txt b/adb/apex/ld.config.txt
index d1858a4..ca297fe 100644
--- a/adb/apex/ld.config.txt
+++ b/adb/apex/ld.config.txt
@@ -5,16 +5,24 @@
 dir.adbd = /apex/com.android.adbd/bin/
 
 [adbd]
-additional.namespaces = platform,art
+additional.namespaces = apex,platform,art
 
 namespace.default.isolated = true
-namespace.default.search.paths = /apex/com.android.adbd/${LIB}
-namespace.default.asan.search.paths = /apex/com.android.adbd/${LIB}
 namespace.default.permitted.paths = /system/${LIB}
 namespace.default.asan.permitted.paths = /system/${LIB}
-namespace.default.links = art,platform
+namespace.default.links = apex,art,platform
+namespace.default.link.apex.shared_libs = libcrypto.so
 namespace.default.link.art.shared_libs = libadbconnection_server.so
-namespace.default.link.platform.shared_libs = libc.so:libdl.so:libm.so:libclang_rt.hwasan-aarch64-android.so
+
+# libcrypto.so in the APEX might be a symlink to /system, for APEXes bundled with the system image.
+# The dynamic linker works off of realpath, so we need to permit loading libcrypto.so from /system.
+namespace.default.link.platform.shared_libs = libc.so:libdl.so:libm.so:libclang_rt.hwasan-aarch64-android.so:liblog.so:libadbd_auth.so:libcrypto.so
+
+namespace.apex.isolated = true
+namespace.apex.search.paths = /apex/com.android.adbd/${LIB}
+namespace.apex.asan.search.paths = /apex/com.android.adbd/${LIB}
+namespace.apex.links = platform
+namespace.apex.link.platform.allow_all_shared_libs = true
 
 ###############################################################################
 # "art" APEX namespace: used for libadbdconnection_server
diff --git a/fs_mgr/libsnapshot/snapshot.cpp b/fs_mgr/libsnapshot/snapshot.cpp
index 785882a..a6f07fc 100644
--- a/fs_mgr/libsnapshot/snapshot.cpp
+++ b/fs_mgr/libsnapshot/snapshot.cpp
@@ -1709,6 +1709,8 @@
         return UpdateState::MergeNeedsReboot;
     } else if (contents == "merge-failed") {
         return UpdateState::MergeFailed;
+    } else if (contents == "cancelled") {
+        return UpdateState::Cancelled;
     } else {
         LOG(ERROR) << "Unknown merge state in update state file: \"" << contents << "\"";
         return UpdateState::None;
@@ -1731,6 +1733,8 @@
             return os << "merge-needs-reboot";
         case UpdateState::MergeFailed:
             return os << "merge-failed";
+        case UpdateState::Cancelled:
+            return os << "cancelled";
         default:
             LOG(ERROR) << "Unknown update state: " << static_cast<uint32_t>(state);
             return os;
diff --git a/healthd/charger.cpp b/healthd/charger.cpp
index 58ed416..d03978d 100644
--- a/healthd/charger.cpp
+++ b/healthd/charger.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#include <android-base/logging.h>
+
 #include "charger.sysprop.h"
 #include "healthd_mode_charger.h"
 #include "healthd_mode_charger_nops.h"
@@ -23,6 +25,7 @@
 #endif
 
 int main(int argc, char** argv) {
+    android::base::InitLogging(argv, &android::base::KernelLogger);
     if (CHARGER_FORCE_NO_UI || android::sysprop::ChargerProperties::no_ui().value_or(false)) {
         return healthd_charger_nops(argc, argv);
     } else {
diff --git a/healthd/charger_utils.cpp b/healthd/charger_utils.cpp
index 0cf9df5..8bbfb4e 100644
--- a/healthd/charger_utils.cpp
+++ b/healthd/charger_utils.cpp
@@ -17,50 +17,28 @@
 #include "charger_utils.h"
 
 #include <android-base/logging.h>
-#include <android/hidl/manager/1.0/IServiceManager.h>
+#include <android/hardware/health/2.1/IHealth.h>
 #include <health/utils.h>
 #include <health2impl/Health.h>
-#include <hidl/ServiceManagement.h>
-
-using android::hardware::getPassthroughServiceManager;
-using android::hidl::base::V1_0::IBase;
-using android::hidl::manager::V1_0::IServiceManager;
 
 namespace android {
 namespace hardware {
 namespace health {
-sp<V2_1::IHealth> GetPassthroughHealthImpl() {
-    // Not using getService() because there is no hwservicemanager in charger mode.
-    sp<IServiceManager> pm = getPassthroughServiceManager();
-    if (pm == nullptr) {
-        LOG(WARNING) << "Cannot get passthrough service manager.";
-        return nullptr;
-    }
-    sp<IBase> base = pm->get(V2_0::IHealth::descriptor, "default");
-    if (base == nullptr) {
-        LOG(WARNING) << "Cannot find passthrough implementation of health 2.0 HAL for instance "
-                        "'default' on the device.";
-        return nullptr;
-    }
-    sp<V2_1::IHealth> service = V2_1::IHealth::castFrom(base);
-    if (service == nullptr) {
-        LOG(WARNING)
-                << "Cannot cast passthrough implementation of health 2.0 HAL to 2.1 for instance "
-                   "'default' on the device.";
-        return nullptr;
-    }
-    return service;
-}
 
-sp<V2_1::IHealth> GetPassthroughHealth() {
-    auto impl = GetPassthroughHealthImpl();
-    if (impl == nullptr) {
+sp<V2_1::IHealth> GetHealthServiceOrDefault() {
+    // No need to use get_health_service from libhealthhalutils that
+    // checks for "backup" instance provided by healthd, since
+    // V2_1::implementation::Health does the same thing.
+    sp<V2_1::IHealth> service = V2_1::IHealth::getService();
+    if (service != nullptr) {
+        LOG(INFO) << "Charger uses health HAL service.";
+    } else {
         LOG(WARNING) << "Charger uses system defaults.";
         auto config = std::make_unique<healthd_config>();
         InitHealthdConfig(config.get());
-        impl = new V2_1::implementation::Health(std::move(config));
+        service = new V2_1::implementation::Health(std::move(config));
     }
-    return impl;
+    return service;
 }
 
 }  // namespace health
diff --git a/healthd/charger_utils.h b/healthd/charger_utils.h
index f96e827..39d8aab 100644
--- a/healthd/charger_utils.h
+++ b/healthd/charger_utils.h
@@ -21,7 +21,9 @@
 namespace android {
 namespace hardware {
 namespace health {
-sp<V2_1::IHealth> GetPassthroughHealth();
+// Return health HAL service. If it is not supported on the device (with
+// VINTF checks), return a default passthrough implementation.
+sp<V2_1::IHealth> GetHealthServiceOrDefault();
 }  // namespace health
 }  // namespace hardware
 }  // namespace android
diff --git a/healthd/healthd_mode_charger.cpp b/healthd/healthd_mode_charger.cpp
index 7d844c9..386ba1a 100644
--- a/healthd/healthd_mode_charger.cpp
+++ b/healthd/healthd_mode_charger.cpp
@@ -60,7 +60,7 @@
 
 using namespace android;
 using android::hardware::Return;
-using android::hardware::health::GetPassthroughHealth;
+using android::hardware::health::GetHealthServiceOrDefault;
 using android::hardware::health::HealthLoop;
 using android::hardware::health::V1_0::BatteryStatus;
 using android::hardware::health::V2_0::Result;
@@ -742,6 +742,6 @@
         }
     }
 
-    Charger charger(GetPassthroughHealth());
+    Charger charger(GetHealthServiceOrDefault());
     return charger.StartLoop();
 }
diff --git a/healthd/healthd_mode_charger_nops.cpp b/healthd/healthd_mode_charger_nops.cpp
index 13e7348..9fe381e 100644
--- a/healthd/healthd_mode_charger_nops.cpp
+++ b/healthd/healthd_mode_charger_nops.cpp
@@ -20,10 +20,10 @@
 
 #include "charger_utils.h"
 
-using android::hardware::health::GetPassthroughHealth;
+using android::hardware::health::GetHealthServiceOrDefault;
 using android::hardware::health::V2_1::implementation::HalHealthLoop;
 
 int healthd_charger_nops(int /* argc */, char** /* argv */) {
-    HalHealthLoop charger("charger", GetPassthroughHealth());
+    HalHealthLoop charger("charger", GetHealthServiceOrDefault());
     return charger.StartLoop();
 }
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 8612eb8..fc04b8f 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -73,19 +73,6 @@
     mkdir /dev/boringssl 0755 root root
     mkdir /dev/boringssl/selftest 0755 root root
 
-    # Mount binderfs
-    mkdir /dev/binderfs
-    mount binder binder /dev/binderfs stats=global
-    chmod 0755 /dev/binderfs
-
-    symlink /dev/binderfs/binder /dev/binder
-    symlink /dev/binderfs/hwbinder /dev/hwbinder
-    symlink /dev/binderfs/vndbinder /dev/vndbinder
-
-    chmod 0666 /dev/binderfs/hwbinder
-    chmod 0666 /dev/binderfs/binder
-    chmod 0666 /dev/binderfs/vndbinder
-
 # Run boringssl self test for each ABI so that later processes can skip it. http://b/139348610
 on early-init && property:ro.product.cpu.abilist32=*
     exec_start boringssl_self_test32
@@ -738,6 +725,12 @@
 
     init_user0
 
+    # Allow apexd to snapshot and restore device encrypted apex data in the case
+    # of a rollback. This should be done immediately after DE_user data keys
+    # are loaded. APEXes should not access this data until this has been
+    # completed.
+    exec_start apexd-snapshotde
+
     # Set SELinux security contexts on upgrade or policy update.
     restorecon --recursive --skip-ce /data