diff --git a/Android.bp b/Android.bp
index ff918ed..2593715 100644
--- a/Android.bp
+++ b/Android.bp
@@ -115,6 +115,13 @@
 cc_library {
     name: "libhidltransport",
     vendor_available: true,
+
+    visibility: [
+        ":__subpackages__",
+        "//hardware:__subpackages__",
+        "//test/sts:__subpackages__",
+        "//vendor:__subpackages__",
+    ],
 }
 
 cc_defaults {
diff --git a/TEST_MAPPING b/TEST_MAPPING
index a3cd219..22c9d36 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -4,6 +4,9 @@
       "name": "libhidl_test"
     },
     {
+      "name": "VtsHidlAllocatorV1_0TargetTest"
+    },
+    {
       "name": "hal_implementation_test"
     },
     {
diff --git a/base/HidlInternal.cpp b/base/HidlInternal.cpp
index e38a664..e5c8f70 100644
--- a/base/HidlInternal.cpp
+++ b/base/HidlInternal.cpp
@@ -18,6 +18,9 @@
 
 #include <hidl/HidlInternal.h>
 
+#ifdef __ANDROID__
+#include <android/api-level.h>
+#endif
 #include <android-base/logging.h>
 #include <android-base/properties.h>
 #include <android-base/stringprintf.h>
@@ -50,9 +53,16 @@
     LOG(FATAL) << message;
 }
 
-std::string getVndkVersionStr() {
-    static std::string vndkVersion = base::GetProperty("ro.vndk.version", "");
-    return vndkVersion;
+std::string getVndkSpHwPath(const char* lib) {
+    static std::string vndk_version = base::GetProperty("ro.vndk.version", "");
+#ifdef __ANDROID__
+    static int api_level = android_get_device_api_level();
+    if (api_level >= __ANDROID_API_R__) {
+        return android::base::StringPrintf("/apex/com.android.vndk.v%s/%s/hw/",
+                                           vndk_version.c_str(), lib);
+    }
+#endif
+    return android::base::StringPrintf("/system/%s/vndk-sp-%s/hw/", lib, vndk_version.c_str());
 }
 
 // ----------------------------------------------------------------------
@@ -133,8 +143,7 @@
     if (instrumentationLibPath.size() > 0) {
         instrumentationLibPaths.push_back(instrumentationLibPath);
     } else {
-        static std::string halLibPathVndkSp = android::base::StringPrintf(
-            HAL_LIBRARY_PATH_VNDK_SP_FOR_VERSION, getVndkVersionStr().c_str());
+        static std::string halLibPathVndkSp = getVndkSpHwPath();
 #ifndef __ANDROID_VNDK__
         instrumentationLibPaths.push_back(HAL_LIBRARY_PATH_SYSTEM);
 #endif
diff --git a/base/include/hidl/HidlInternal.h b/base/include/hidl/HidlInternal.h
index ee87b87..3cd246a 100644
--- a/base/include/hidl/HidlInternal.h
+++ b/base/include/hidl/HidlInternal.h
@@ -44,8 +44,12 @@
 //to avoid creating dependencies on liblog.
 void logAlwaysFatal(const char *message);
 
-// Returns vndk version from "ro.vndk.version"
-std::string getVndkVersionStr();
+// Returns VNDK-SP hw path according to "ro.vndk.version"
+#if defined(__LP64__)
+std::string getVndkSpHwPath(const char* lib = "lib64");
+#else
+std::string getVndkSpHwPath(const char* lib = "lib");
+#endif
 
 // Explicitly invokes the parameterized element's destructor;
 // intended to be used alongside the placement new operator.
@@ -114,22 +118,18 @@
 };
 
 #define HAL_LIBRARY_PATH_SYSTEM_64BIT "/system/lib64/hw/"
-#define HAL_LIBRARY_PATH_VNDK_SP_64BIT_FOR_VERSION "/apex/com.android.vndk.v%s/lib64/hw/"
 #define HAL_LIBRARY_PATH_VENDOR_64BIT "/vendor/lib64/hw/"
 #define HAL_LIBRARY_PATH_ODM_64BIT    "/odm/lib64/hw/"
 #define HAL_LIBRARY_PATH_SYSTEM_32BIT "/system/lib/hw/"
-#define HAL_LIBRARY_PATH_VNDK_SP_32BIT_FOR_VERSION "/apex/com.android.vndk.v%s/lib/hw/"
 #define HAL_LIBRARY_PATH_VENDOR_32BIT "/vendor/lib/hw/"
 #define HAL_LIBRARY_PATH_ODM_32BIT    "/odm/lib/hw/"
 
 #if defined(__LP64__)
 #define HAL_LIBRARY_PATH_SYSTEM HAL_LIBRARY_PATH_SYSTEM_64BIT
-#define HAL_LIBRARY_PATH_VNDK_SP_FOR_VERSION HAL_LIBRARY_PATH_VNDK_SP_64BIT_FOR_VERSION
 #define HAL_LIBRARY_PATH_VENDOR HAL_LIBRARY_PATH_VENDOR_64BIT
 #define HAL_LIBRARY_PATH_ODM    HAL_LIBRARY_PATH_ODM_64BIT
 #else
 #define HAL_LIBRARY_PATH_SYSTEM HAL_LIBRARY_PATH_SYSTEM_32BIT
-#define HAL_LIBRARY_PATH_VNDK_SP_FOR_VERSION HAL_LIBRARY_PATH_VNDK_SP_32BIT_FOR_VERSION
 #define HAL_LIBRARY_PATH_VENDOR HAL_LIBRARY_PATH_VENDOR_32BIT
 #define HAL_LIBRARY_PATH_ODM    HAL_LIBRARY_PATH_ODM_32BIT
 #endif
diff --git a/minijail/Android.bp b/minijail/Android.bp
index c01a12b..83db2d9 100644
--- a/minijail/Android.bp
+++ b/minijail/Android.bp
@@ -1,3 +1,6 @@
+// TODO(b/110363419): remove or make failures harder
+// Deprecated: most minijail users should either use libavservices_minijail
+// or reinstitute this (w/ fatal checks).
 cc_library_shared {
     name: "libhwminijail",
     defaults: ["hidl_defaults"],
@@ -10,4 +13,9 @@
         "libbase",
         "libminijail",
     ],
+    visibility: [
+        ":__subpackages__",
+        "//hardware/interfaces/configstore/1.1/default",
+        "//vendor:__subpackages__",
+    ],
 }
diff --git a/transport/HidlBinderSupport.cpp b/transport/HidlBinderSupport.cpp
index 89b3a24..b48b460 100644
--- a/transport/HidlBinderSupport.cpp
+++ b/transport/HidlBinderSupport.cpp
@@ -19,6 +19,9 @@
 #include <hidl/HidlBinderSupport.h>
 
 #include <android/hidl/base/1.0/BpHwBase.h>
+#include <android/hidl/manager/1.0/BpHwServiceManager.h>
+#include <android/hidl/manager/1.1/BpHwServiceManager.h>
+#include <android/hidl/manager/1.2/BpHwServiceManager.h>
 #include <hwbinder/IPCThreadState.h>
 #include "InternalStatic.h"  // TODO(b/69122224): remove this include, for getOrCreateCachedBinder
 
@@ -206,16 +209,34 @@
     return status;
 }
 
+// assume: iface != nullptr, iface isRemote
+// This function is to sandbox a cast through a BpHw* class into a function, so
+// that we can remove cfi sanitization from it. Do not add additional
+// functionality here.
+__attribute__((no_sanitize("cfi"))) static inline BpHwRefBase* forceGetRefBase(
+        ::android::hidl::base::V1_0::IBase* ifacePtr) {
+    using ::android::hidl::base::V1_0::BpHwBase;
+
+    // canary only
+    static_assert(sizeof(BpHwBase) == sizeof(hidl::manager::V1_0::BpHwServiceManager));
+    static_assert(sizeof(BpHwBase) == sizeof(hidl::manager::V1_1::BpHwServiceManager));
+    static_assert(sizeof(BpHwBase) == sizeof(hidl::manager::V1_2::BpHwServiceManager));
+
+    // All BpHw* are generated the same. This may be BpHwServiceManager,
+    // BpHwFoo, or any other class. For ABI compatibility, we can't modify the
+    // class hierarchy of these, so we have no way to get BpHwRefBase from a
+    // remote ifacePtr.
+    BpHwBase* bpBase = static_cast<BpHwBase*>(ifacePtr);
+    return static_cast<BpHwRefBase*>(bpBase);
+}
+
 sp<IBinder> getOrCreateCachedBinder(::android::hidl::base::V1_0::IBase* ifacePtr) {
     if (ifacePtr == nullptr) {
         return nullptr;
     }
 
     if (ifacePtr->isRemote()) {
-        using ::android::hidl::base::V1_0::BpHwBase;
-
-        BpHwBase* bpBase = static_cast<BpHwBase*>(ifacePtr);
-        BpHwRefBase* bpRefBase = static_cast<BpHwRefBase*>(bpBase);
+        BpHwRefBase* bpRefBase = forceGetRefBase(ifacePtr);
         return sp<IBinder>(bpRefBase->remote());
     }
 
diff --git a/transport/ServiceManagement.cpp b/transport/ServiceManagement.cpp
index 2f69351..cbe7ac6 100644
--- a/transport/ServiceManagement.cpp
+++ b/transport/ServiceManagement.cpp
@@ -394,8 +394,7 @@
 
         dlerror(); // clear
 
-        static std::string halLibPathVndkSp = android::base::StringPrintf(
-            HAL_LIBRARY_PATH_VNDK_SP_FOR_VERSION, details::getVndkVersionStr().c_str());
+        static std::string halLibPathVndkSp = details::getVndkSpHwPath();
         std::vector<std::string> paths = {
             HAL_LIBRARY_PATH_ODM, HAL_LIBRARY_PATH_VENDOR, halLibPathVndkSp,
 #ifndef __ANDROID_VNDK__
@@ -512,10 +511,8 @@
     Return<void> debugDump(debugDump_cb _hidl_cb) override {
         using Arch = ::android::hidl::base::V1_0::DebugInfo::Architecture;
         using std::literals::string_literals::operator""s;
-        static std::string halLibPathVndkSp64 = android::base::StringPrintf(
-            HAL_LIBRARY_PATH_VNDK_SP_64BIT_FOR_VERSION, details::getVndkVersionStr().c_str());
-        static std::string halLibPathVndkSp32 = android::base::StringPrintf(
-            HAL_LIBRARY_PATH_VNDK_SP_32BIT_FOR_VERSION, details::getVndkVersionStr().c_str());
+        static std::string halLibPathVndkSp64 = details::getVndkSpHwPath("lib64");
+        static std::string halLibPathVndkSp32 = details::getVndkSpHwPath("lib");
         static std::vector<std::pair<Arch, std::vector<const char*>>> sAllPaths{
             {Arch::IS_64BIT,
              {
diff --git a/transport/allocator/1.0/vts/functional/Android.bp b/transport/allocator/1.0/vts/functional/Android.bp
index f3cbed6..ba7aa70 100644
--- a/transport/allocator/1.0/vts/functional/Android.bp
+++ b/transport/allocator/1.0/vts/functional/Android.bp
@@ -24,6 +24,7 @@
     static_libs: [
         "android.hidl.allocator@1.0",
     ],
+    test_suites: ["general-tests", "vts"],
 }
 
 vts_config {
diff --git a/transport/allocator/1.0/vts/functional/AndroidTest.xml b/transport/allocator/1.0/vts/functional/AndroidTest.xml
deleted file mode 100644
index 6ac167f..0000000
--- a/transport/allocator/1.0/vts/functional/AndroidTest.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2018 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-<configuration description="Config for VTS VtsHidlAllocatorV1_0Target test cases">
-    <option name="config-descriptor:metadata" key="plan" value="vts-treble" />
-    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
-        <option name="abort-on-push-failure" value="false"/>
-        <option name="push-group" value="HalHidlTargetTest.push"/>
-    </target_preparer>
-    <multi_target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer" />
-    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
-        <option name="test-module-name" value="VtsHidlAllocatorV1_0Target"/>
-        <option name="binary-test-working-directory" value="_32bit::/data/nativetest/" />
-        <option name="binary-test-working-directory" value="_64bit::/data/nativetest64/" />
-        <option name="binary-test-source" value="_32bit::DATA/nativetest/VtsHidlAllocatorV1_0TargetTest/VtsHidlAllocatorV1_0TargetTest" />
-        <option name="binary-test-source" value="_64bit::DATA/nativetest64/VtsHidlAllocatorV1_0TargetTest/VtsHidlAllocatorV1_0TargetTest" />
-        <option name="binary-test-type" value="hal_hidl_gtest"/>
-        <option name="test-timeout" value="5m"/>
-    </test>
-</configuration>
diff --git a/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp b/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp
index 39ce606..340ec0c 100644
--- a/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp
+++ b/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp
@@ -14,11 +14,12 @@
  * limitations under the License.
  */
 
-#include <VtsHalHidlTargetTestBase.h>
-#include <VtsHalHidlTargetTestEnvBase.h>
 #include <android-base/logging.h>
 #include <android/hidl/allocator/1.0/IAllocator.h>
 #include <android/hidl/memory/1.0/IMemory.h>
+#include <gtest/gtest.h>
+#include <hidl/GtestPrinter.h>
+#include <hidl/ServiceManagement.h>
 #include <hidlmemory/mapping.h>
 
 using ::android::sp;
@@ -32,20 +33,10 @@
 #define ASSERT_OK(ret) ASSERT_TRUE((ret).isOk())
 #define EXPECT_OK(ret) EXPECT_TRUE((ret).isOk())
 
-class AllocatorEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
-   public:
-    virtual void registerTestServices() override { registerTestService<IAllocator>(); }
-
-    static AllocatorEnvironment* instance() {
-        static AllocatorEnvironment* instance = new AllocatorEnvironment();
-        return instance;
-    };
-};
-
-class AllocatorHidlTest : public ::testing::VtsHalHidlTargetTestBase {
-   public:
+class AllocatorHidlTest : public ::testing::TestWithParam<std::string> {
+  public:
     virtual void SetUp() override {
-        allocator = getService<IAllocator>(AllocatorEnvironment::instance());
+        allocator = IAllocator::getService(GetParam());
         ASSERT_NE(allocator, nullptr);
     }
 
@@ -88,13 +79,13 @@
     sp<IAllocator> allocator;
 };
 
-TEST_F(AllocatorHidlTest, TestAllocateSizes) {
+TEST_P(AllocatorHidlTest, TestAllocateSizes) {
     for (size_t size : {1, 1023, 1024, 1025, 4096}) {
         expectAllocateSuccess(size);
     }
 }
 
-TEST_F(AllocatorHidlTest, TestBatchAllocateSizes) {
+TEST_P(AllocatorHidlTest, TestBatchAllocateSizes) {
     for (size_t count : {1, 1, 2, 3, 10}) {
         for (size_t size : {1, 1023, 1024, 1025, 4096}) {
             expectBatchAllocateSuccess(size, count);
@@ -102,7 +93,7 @@
     }
 }
 
-TEST_F(AllocatorHidlTest, TestCommit) {
+TEST_P(AllocatorHidlTest, TestCommit) {
     constexpr size_t kSize = 1337;
 
     sp<IMemory> memory = expectAllocateSuccess(kSize);
@@ -131,9 +122,7 @@
     }
 }
 
-int main(int argc, char** argv) {
-    ::testing::AddGlobalTestEnvironment(AllocatorEnvironment::instance());
-    ::testing::InitGoogleTest(&argc, argv);
-    AllocatorEnvironment::instance()->init(&argc, argv);
-    return RUN_ALL_TESTS();
-}
+INSTANTIATE_TEST_SUITE_P(
+        PerInstance, AllocatorHidlTest,
+        testing::ValuesIn(android::hardware::getAllHalInstanceNames(IAllocator::descriptor)),
+        android::hardware::PrintInstanceNameToString);
diff --git a/transport/base/1.0/vts/functional/Android.bp b/transport/base/1.0/vts/functional/Android.bp
index 3f1c239..1c6e7ad 100644
--- a/transport/base/1.0/vts/functional/Android.bp
+++ b/transport/base/1.0/vts/functional/Android.bp
@@ -34,6 +34,7 @@
         "libinit_test_utils",
     ],
     test_suites: [
+        "general-tests",
         "vts",
     ],
     require_root: true,
diff --git a/transport/include/hidl/HidlBinderSupport.h b/transport/include/hidl/HidlBinderSupport.h
index 5dec5cd..f0981ff 100644
--- a/transport/include/hidl/HidlBinderSupport.h
+++ b/transport/include/hidl/HidlBinderSupport.h
@@ -204,13 +204,19 @@
     if (binderIface.get() == nullptr) {
         return nullptr;
     }
+
     if (binderIface->localBinder() == nullptr) {
         return new ProxyType(binderIface);
     }
+
+    // Ensure that IBinder is BnHwBase (not JHwBinder, for instance)
+    if (!binderIface->checkSubclass(IBase::descriptor)) {
+        return new ProxyType(binderIface);
+    }
     sp<IBase> base = static_cast<BnHwBase*>(binderIface.get())->getImpl();
+
     if (details::canCastInterface(base.get(), IType::descriptor)) {
-        StubType* stub = static_cast<StubType*>(binderIface.get());
-        return stub->getImpl();
+        return static_cast<IType*>(base.get());
     } else {
         return nullptr;
     }
diff --git a/transport/include/hidl/HidlLazyUtils.h b/transport/include/hidl/HidlLazyUtils.h
index 56d3fde..97fe20e 100644
--- a/transport/include/hidl/HidlLazyUtils.h
+++ b/transport/include/hidl/HidlLazyUtils.h
@@ -38,13 +38,13 @@
  **/
 class LazyServiceRegistrar {
    public:
-     LazyServiceRegistrar();
      static LazyServiceRegistrar& getInstance();
      status_t registerService(const sp<::android::hidl::base::V1_0::IBase>& service,
                               const std::string& name = "default");
 
    private:
      std::shared_ptr<details::LazyServiceRegistrarImpl> mImpl;
+     LazyServiceRegistrar();
 };
 
 }  // namespace hardware