Merge "apexd: Allow mounting on squashfs."
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v1_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v1_apex.asciipb
new file mode 100644
index 0000000..5bef6b2
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v1_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v1.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v1.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_additional_file_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_additional_file_apex.asciipb
new file mode 100644
index 0000000..f203241
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_additional_file_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_additional_file.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_additional_file.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_additional_folder_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_additional_folder_apex.asciipb
new file mode 100644
index 0000000..d5b1515
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_additional_folder_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_additional_folder.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_additional_folder.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_apex.asciipb
new file mode 100644
index 0000000..5c1ecd8
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_apk_in_apex_sdk_target_p_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_apk_in_apex_sdk_target_p_apex.asciipb
new file mode 100644
index 0000000..a3e05b5
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_apk_in_apex_sdk_target_p_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_different_certificate_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_different_certificate_apex.asciipb
new file mode 100644
index 0000000..d4f42de
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_different_certificate_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_different_certificate.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_different_certificate.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_different_package_name_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_different_package_name_apex.asciipb
new file mode 100644
index 0000000..30c1658
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_different_package_name_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_different_package_name.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_different_package_name.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_no_hashtree_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_no_hashtree_apex.asciipb
new file mode 100644
index 0000000..7a4ba73
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_no_hashtree_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_no_hashtree.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_no_hashtree.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_sdk_target_p_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_sdk_target_p_apex.asciipb
new file mode 100644
index 0000000..e046e3a
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_sdk_target_p_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_sdk_target_p.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_sdk_target_p.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_apex.asciipb
new file mode 100644
index 0000000..6ea9a6b
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_signed_bob.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_signed_bob.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_rot_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_rot_apex.asciipb
new file mode 100644
index 0000000..fe76dce
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_rot_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_signed_bob_rot.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_signed_bob_rot.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_rot_rollback_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_rot_rollback_apex.asciipb
new file mode 100644
index 0000000..c90ffbb
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_signed_bob_rot_rollback_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_unsigned_apk_container_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_unsigned_apk_container_apex.asciipb
new file mode 100644
index 0000000..580a5f8
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_unsigned_apk_container_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_unsigned_apk_container.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_unsigned_apk_container.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_unsigned_payload_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_unsigned_payload_apex.asciipb
new file mode 100644
index 0000000..779f499
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_unsigned_payload_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_unsigned_payload.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_unsigned_payload.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_with_post_install_hook_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_with_post_install_hook_apex.asciipb
new file mode 100644
index 0000000..0bf9288
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_with_post_install_hook_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_with_post_install_hook.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_with_post_install_hook.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_with_pre_install_hook_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_with_pre_install_hook_apex.asciipb
new file mode 100644
index 0000000..5a1baf9
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_with_pre_install_hook_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_with_pre_install_hook.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_with_pre_install_hook.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_without_apk_in_apex_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_without_apk_in_apex_apex.asciipb
new file mode 100644
index 0000000..316c8d1
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_without_apk_in_apex_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_without_apk_in_apex.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_without_apk_in_apex.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_wrong_sha_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_wrong_sha_apex.asciipb
new file mode 100644
index 0000000..3d5c0e9
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v2_wrong_sha_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v2_wrong_sha.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v2_wrong_sha.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_apex.asciipb
new file mode 100644
index 0000000..e03ee6e
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v3.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v3.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_signed_bob_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_signed_bob_apex.asciipb
new file mode 100644
index 0000000..daecf3c
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_signed_bob_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v3_signed_bob.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v3_signed_bob.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_signed_bob_rot_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_signed_bob_rot_apex.asciipb
new file mode 100644
index 0000000..420522b
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__arm_com_android_apex_cts_shim_v3_signed_bob_rot_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_arm64/com.android.apex.cts.shim.v3_signed_bob_rot.apex"
+  }
+  dest_file: "shim/prebuilts//arm/com.android.apex.cts.shim.v3_signed_bob_rot.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v1_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v1_apex.asciipb
new file mode 100644
index 0000000..239132a
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v1_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v1.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v1.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_additional_file_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_additional_file_apex.asciipb
new file mode 100644
index 0000000..f84e0c8
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_additional_file_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_additional_file.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_additional_file.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_additional_folder_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_additional_folder_apex.asciipb
new file mode 100644
index 0000000..635e2bb
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_additional_folder_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_additional_folder.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_additional_folder.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_apex.asciipb
new file mode 100644
index 0000000..cea5340
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_apk_in_apex_sdk_target_p_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_apk_in_apex_sdk_target_p_apex.asciipb
new file mode 100644
index 0000000..2622af8
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_apk_in_apex_sdk_target_p_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_different_certificate_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_different_certificate_apex.asciipb
new file mode 100644
index 0000000..c25509a
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_different_certificate_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_different_certificate.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_different_certificate.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_different_package_name_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_different_package_name_apex.asciipb
new file mode 100644
index 0000000..ab8601f
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_different_package_name_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_different_package_name.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_different_package_name.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_no_hashtree_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_no_hashtree_apex.asciipb
new file mode 100644
index 0000000..f1ccd78
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_no_hashtree_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_no_hashtree.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_no_hashtree.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_sdk_target_p_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_sdk_target_p_apex.asciipb
new file mode 100644
index 0000000..1f24ded
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_sdk_target_p_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_sdk_target_p.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_sdk_target_p.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_apex.asciipb
new file mode 100644
index 0000000..e8c48e1
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_signed_bob.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_signed_bob.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_rot_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_rot_apex.asciipb
new file mode 100644
index 0000000..faf0e28
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_rot_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_signed_bob_rot.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_signed_bob_rot.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_rot_rollback_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_rot_rollback_apex.asciipb
new file mode 100644
index 0000000..5f1e664
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_signed_bob_rot_rollback_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_unsigned_apk_container_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_unsigned_apk_container_apex.asciipb
new file mode 100644
index 0000000..03634a9
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_unsigned_apk_container_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_unsigned_apk_container.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_unsigned_apk_container.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_unsigned_payload_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_unsigned_payload_apex.asciipb
new file mode 100644
index 0000000..aef234a
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_unsigned_payload_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_unsigned_payload.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_unsigned_payload.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_with_post_install_hook_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_with_post_install_hook_apex.asciipb
new file mode 100644
index 0000000..87b7c50
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_with_post_install_hook_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_with_post_install_hook.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_with_post_install_hook.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_with_pre_install_hook_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_with_pre_install_hook_apex.asciipb
new file mode 100644
index 0000000..727bce0
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_with_pre_install_hook_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_with_pre_install_hook.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_with_pre_install_hook.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_without_apk_in_apex_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_without_apk_in_apex_apex.asciipb
new file mode 100644
index 0000000..23155ba
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_without_apk_in_apex_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_without_apk_in_apex.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_without_apk_in_apex.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_wrong_sha_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_wrong_sha_apex.asciipb
new file mode 100644
index 0000000..2190954
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v2_wrong_sha_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v2_wrong_sha.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v2_wrong_sha.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_apex.asciipb
new file mode 100644
index 0000000..e7006ae
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v3.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v3.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_signed_bob_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_signed_bob_apex.asciipb
new file mode 100644
index 0000000..bdcb62f
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_signed_bob_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v3_signed_bob.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v3_signed_bob.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_signed_bob_rot_apex.asciipb b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_signed_bob_rot_apex.asciipb
new file mode 100644
index 0000000..4f25858
--- /dev/null
+++ b/.prebuilt_info/prebuilt_info_shim_prebuilts__x86_com_android_apex_cts_shim_v3_signed_bob_rot_apex.asciipb
@@ -0,0 +1,12 @@
+drops {
+  android_build_drop {
+    build_id: "6508977"
+    target: "CtsShim"
+    source_file: "aosp_x86_64/com.android.apex.cts.shim.v3_signed_bob_rot.apex"
+  }
+  dest_file: "shim/prebuilts//x86/com.android.apex.cts.shim.v3_signed_bob_rot.apex"
+  version: ""
+  version_group: ""
+  git_project: "platform/system/apex"
+  git_branch: "rvc-dev"
+}
diff --git a/apexd/Android.bp b/apexd/Android.bp
index a07fad8..e9e5470 100644
--- a/apexd/Android.bp
+++ b/apexd/Android.bp
@@ -207,6 +207,7 @@
   static: {
     whole_static_libs: ["libc++fs"],
   },
+  cpp_std: "experimental",
   shared: {
     static_libs: ["libc++fs"],
   },
@@ -310,7 +311,7 @@
   tools: ["avbtool"],
   cmd: "unzip -q $(in) -d $(genDir) apex_payload.img && " +
        "$(location avbtool) print_partition_digests --image $(genDir)/apex_payload.img " +
-       "| cut -c 3-| tee $(out)" 
+       "| cut -c 3-| tee $(out)"
 }
 
 genrule {
@@ -321,7 +322,23 @@
   tools: ["avbtool"],
   cmd: "unzip -q $(in) -d $(genDir) apex_payload.img && " +
        "$(location avbtool) print_partition_digests --image $(genDir)/apex_payload.img " +
-       "| cut -c 3-| tee $(out)"  
+       "| cut -c 3-| tee $(out)"
+}
+
+genrule {
+  // Generates an apex which has same module name as apex.apexd_test.apex, but
+  // is actually signed with a different key.
+  name: "gen_key_mismatch_apex",
+  out: ["apex.apexd_test_different_key.apex"],
+  srcs: [":apex.apexd_test_no_inst_key"],
+  tools: ["soong_zip", "zipalign", "conv_apex_manifest"],
+  cmd: "unzip -q $(in) -d $(genDir) && " +
+       "$(location conv_apex_manifest) setprop name com.android.apex.test_package $(genDir)/apex_manifest.pb && " +
+       "$(location soong_zip) -d -C $(genDir) -D $(genDir) " +
+       "-s apex_manifest.pb -s apex_payload.img -s apex_pubkey " +
+       "-o $(genDir)/unaligned.apex && " +
+       "$(location zipalign) -f 4096 $(genDir)/unaligned.apex " +
+       "$(genDir)/apex.apexd_test_different_key.apex"
 }
 
 cc_test {
@@ -351,6 +368,8 @@
     ":apex.apexd_test_preinstall",
     ":apex.apexd_test_prepostinstall.fail",
     ":apex.apexd_test_v2",
+    ":apex.corrupted_b146895998",
+    ":gen_key_mismatch_apex",
     ":gen_manifest_mismatch_apex",
     ":gen_manifest_mismatch_apex_no_hashtree",
     ":gen_corrupt_superblock_apex",
@@ -368,6 +387,7 @@
     "apex_database_test.cpp",
     "apex_file_test.cpp",
     "apex_manifest_test.cpp",
+    "apex_preinstalled_data_test.cpp",
     "apexd_verity_test.cpp",
     "apexservice_test.cpp",
   ],
diff --git a/apexd/TEST_MAPPING b/apexd/TEST_MAPPING
index d8d14ef..77ff9b8 100644
--- a/apexd/TEST_MAPPING
+++ b/apexd/TEST_MAPPING
@@ -7,6 +7,9 @@
   "imports": [
     {
       "path": "system/apex/tests"
+    },
+    {
+      "path": "vendor/xts/gts-tests/hostsidetests/stagedinstall"
     }
   ]
 }
diff --git a/apexd/apex_file.cpp b/apexd/apex_file.cpp
index 4cfdda7..83264d3 100644
--- a/apexd/apex_file.cpp
+++ b/apexd/apex_file.cpp
@@ -23,28 +23,24 @@
 
 #include <filesystem>
 #include <fstream>
+#include <span>
 
 #include <android-base/file.h>
 #include <android-base/logging.h>
 #include <android-base/scopeguard.h>
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
-#include <google/protobuf/util/message_differencer.h>
 #include <libavb/libavb.h>
+#include <ziparchive/zip_archive.h>
 
 #include "apex_constants.h"
-#include "apex_preinstalled_data.h"
 #include "apexd_utils.h"
-#include "string_log.h"
 
 using android::base::borrowed_fd;
-using android::base::EndsWith;
 using android::base::Error;
 using android::base::ReadFullyAtOffset;
 using android::base::Result;
-using android::base::StartsWith;
 using android::base::unique_fd;
-using google::protobuf::util::MessageDifferencer;
 
 namespace android {
 namespace apex {
@@ -148,15 +144,13 @@
   }
 
   return ApexFile(path, image_offset, image_size, std::move(*manifest), pubkey,
-                  isPathForBuiltinApexes(path), *fs_type);
+                  *fs_type);
 }
 
 // AVB-related code.
 
 namespace {
 
-static constexpr const char* kApexKeyProp = "apex.key";
-
 static constexpr int kVbMetaMaxSize = 64 * 1024;
 
 std::string bytes_to_hex(const uint8_t* bytes, size_t bytes_len) {
@@ -216,26 +210,10 @@
          memcmp(&public_key_content[0], key, length) == 0;
 }
 
-Result<std::string> getPublicKeyName(const ApexFile& apex, const uint8_t* data,
-                                     size_t length) {
-  size_t keyNameLen;
-  const char* keyName = avb_property_lookup(data, length, kApexKeyProp,
-                                            strlen(kApexKeyProp), &keyNameLen);
-  if (keyName == nullptr || keyNameLen == 0) {
-    return Error() << "Cannot find prop '" << kApexKeyProp << "' from "
-                   << apex.GetPath();
-  }
-
-  if (keyName != apex.GetManifest().name()) {
-    return Error() << "Key mismatch: apex name is '"
-                   << apex.GetManifest().name() << "'"
-                   << " but key name is '" << keyName << "'";
-  }
-  return keyName;
-}
-
-Result<void> verifyVbMetaSignature(const ApexFile& apex, const uint8_t* data,
-                                   size_t length) {
+// Verifies correctness of vbmeta and returns public key it was signed with.
+Result<std::span<const uint8_t>> verifyVbMetaSignature(const ApexFile& apex,
+                                                       const uint8_t* data,
+                                                       size_t length) {
   const uint8_t* pk;
   size_t pk_len;
   AvbVBMetaVerifyResult res;
@@ -256,33 +234,16 @@
       return Error() << "Error verifying " << apex.GetPath() << ": "
                      << "unsupported version";
     default:
-      return Errorf("Unknown vmbeta_image_verify return value");
+      return Error() << "Unknown vmbeta_image_verify return value : " << res;
   }
 
-  Result<std::string> key_name = getPublicKeyName(apex, data, length);
-  if (!key_name.ok()) {
-    return key_name.error();
-  }
-
-  Result<const std::string> public_key = getApexKey(*key_name);
-  if (public_key.ok()) {
-    // TODO(b/115718846)
-    // We need to decide whether we need rollback protection, and whether
-    // we can use the rollback protection provided by libavb.
-    if (!CompareKeys(pk, pk_len, *public_key)) {
-      return Error() << "Error verifying " << apex.GetPath() << ": "
-                     << "public key doesn't match the pre-installed one";
-    }
-  } else {
-    return public_key.error();
-  }
-  LOG(VERBOSE) << apex.GetPath() << ": public key matches.";
-  return {};
+  return std::span<const uint8_t>(pk, pk_len);
 }
 
 Result<std::unique_ptr<uint8_t[]>> verifyVbMeta(const ApexFile& apex,
                                                 const unique_fd& fd,
-                                                const AvbFooter& footer) {
+                                                const AvbFooter& footer,
+                                                const std::string& public_key) {
   if (footer.vbmeta_size > kVbMetaMaxSize) {
     return Errorf("VbMeta size in footer exceeds kVbMetaMaxSize.");
   }
@@ -294,12 +255,17 @@
     return ErrnoError() << "Couldn't read AVB meta-data";
   }
 
-  Result<void> st =
+  Result<std::span<const uint8_t>> st =
       verifyVbMetaSignature(apex, vbmeta_buf.get(), footer.vbmeta_size);
   if (!st.ok()) {
     return st.error();
   }
 
+  if (!CompareKeys(st->data(), st->size(), public_key)) {
+    return Error() << "Error verifying " << apex.GetPath() << " : "
+                   << "public key doesn't match the pre-installed one";
+  }
+
   return vbmeta_buf;
 }
 
@@ -326,6 +292,11 @@
       continue;
     }
 
+    // Check that hashtree descriptor actually fits into memory.
+    const uint8_t* vbmeta_end = vbmeta_data + vbmeta_size;
+    if ((uint8_t*)descriptors[i] + sizeof(AvbHashtreeDescriptor) > vbmeta_end) {
+      return Errorf("Invalid length for AvbHashtreeDescriptor");
+    }
     return (const AvbHashtreeDescriptor*)descriptors[i];
   }
 
@@ -346,7 +317,8 @@
 
 }  // namespace
 
-Result<ApexVerityData> ApexFile::VerifyApexVerity() const {
+Result<ApexVerityData> ApexFile::VerifyApexVerity(
+    const std::string& public_key) const {
   ApexVerityData verityData;
 
   unique_fd fd(open(GetPath().c_str(), O_RDONLY | O_CLOEXEC));
@@ -360,7 +332,7 @@
   }
 
   Result<std::unique_ptr<uint8_t[]>> vbmeta_data =
-      verifyVbMeta(*this, fd, **footer);
+      verifyVbMeta(*this, fd, **footer, public_key);
   if (!vbmeta_data.ok()) {
     return vbmeta_data.error();
   }
@@ -389,62 +361,5 @@
   return verityData;
 }
 
-Result<void> ApexFile::VerifyManifestMatches(
-    const std::string& mount_path) const {
-  Result<ApexManifest> verifiedManifest =
-      ReadManifest(mount_path + "/" + kManifestFilenamePb);
-  if (!verifiedManifest.ok()) {
-    return verifiedManifest.error();
-  }
-
-  if (!MessageDifferencer::Equals(manifest_, *verifiedManifest)) {
-    return Errorf(
-        "Manifest inside filesystem does not match manifest outside it");
-  }
-
-  return {};
-}
-
-Result<std::vector<std::string>> FindApexes(
-    const std::vector<std::string>& paths) {
-  std::vector<std::string> result;
-  for (const auto& path : paths) {
-    auto exist = PathExists(path);
-    if (!exist.ok()) {
-      return exist.error();
-    }
-    if (!*exist) continue;
-
-    const auto& apexes = FindApexFilesByName(path);
-    if (!apexes.ok()) {
-      return apexes;
-    }
-
-    result.insert(result.end(), apexes->begin(), apexes->end());
-  }
-  return result;
-}
-
-Result<std::vector<std::string>> FindApexFilesByName(const std::string& path) {
-  auto filter_fn = [](const std::filesystem::directory_entry& entry) {
-    std::error_code ec;
-    if (entry.is_regular_file(ec) &&
-        EndsWith(entry.path().filename().string(), kApexPackageSuffix)) {
-      return true;  // APEX file, take.
-    }
-    return false;
-  };
-  return ReadDir(path, filter_fn);
-}
-
-bool isPathForBuiltinApexes(const std::string& path) {
-  for (const auto& dir : kApexPackageBuiltinDirs) {
-    if (StartsWith(path, dir)) {
-      return true;
-    }
-  }
-  return false;
-}
-
 }  // namespace apex
 }  // namespace android
diff --git a/apexd/apex_file.h b/apexd/apex_file.h
index 88914a9..a7bc123 100644
--- a/apexd/apex_file.h
+++ b/apexd/apex_file.h
@@ -23,9 +23,7 @@
 
 #include <android-base/result.h>
 #include <libavb/libavb.h>
-#include <ziparchive/zip_archive.h>
 
-#include "apex_constants.h"
 #include "apex_manifest.h"
 
 namespace android {
@@ -52,23 +50,19 @@
   size_t GetImageSize() const { return image_size_; }
   const ApexManifest& GetManifest() const { return manifest_; }
   const std::string& GetBundledPublicKey() const { return apex_pubkey_; }
-  bool IsBuiltin() const { return is_builtin_; }
   const std::string& GetFsType() const { return fs_type_; }
-  android::base::Result<ApexVerityData> VerifyApexVerity() const;
-  android::base::Result<void> VerifyManifestMatches(
-      const std::string& mount_path) const;
+  android::base::Result<ApexVerityData> VerifyApexVerity(
+      const std::string& public_key) const;
 
  private:
   ApexFile(const std::string& apex_path, int32_t image_offset,
            size_t image_size, ApexManifest manifest,
-           const std::string& apex_pubkey, bool is_builtin,
-           const std::string& fs_type)
+           const std::string& apex_pubkey, const std::string& fs_type)
       : apex_path_(apex_path),
         image_offset_(image_offset),
         image_size_(image_size),
         manifest_(std::move(manifest)),
         apex_pubkey_(apex_pubkey),
-        is_builtin_(is_builtin),
         fs_type_(fs_type) {}
 
   std::string apex_path_;
@@ -76,17 +70,9 @@
   size_t image_size_;
   ApexManifest manifest_;
   std::string apex_pubkey_;
-  bool is_builtin_;
   std::string fs_type_;
 };
 
-android::base::Result<std::vector<std::string>> FindApexes(
-    const std::vector<std::string>& paths);
-android::base::Result<std::vector<std::string>> FindApexFilesByName(
-    const std::string& path);
-
-bool isPathForBuiltinApexes(const std::string& path);
-
 }  // namespace apex
 }  // namespace android
 
diff --git a/apexd/apex_file_test.cpp b/apexd/apex_file_test.cpp
index 0fc022c..2cf7d5d 100644
--- a/apexd/apex_file_test.cpp
+++ b/apexd/apex_file_test.cpp
@@ -26,7 +26,6 @@
 #include <ziparchive/zip_archive.h>
 
 #include "apex_file.h"
-#include "apex_preinstalled_data.h"
 
 using android::base::Result;
 
@@ -93,12 +92,11 @@
 }
 
 TEST_P(ApexFileTest, VerifyApexVerity) {
-  ASSERT_RESULT_OK(collectPreinstalledData({"/system_ext/apex"}));
   const std::string filePath = testDataDir + GetParam().prefix + ".apex";
   Result<ApexFile> apexFile = ApexFile::Open(filePath);
   ASSERT_RESULT_OK(apexFile);
 
-  auto verity_or = apexFile->VerifyApexVerity();
+  auto verity_or = apexFile->VerifyApexVerity(apexFile->GetBundledPublicKey());
   ASSERT_RESULT_OK(verity_or);
 
   const ApexVerityData& data = *verity_or;
@@ -117,13 +115,12 @@
   EXPECT_EQ(std::string(rootDigest), data.root_digest);
 }
 
-TEST_P(ApexFileTest, VerifyApexVerityNoKeyInst) {
-  const std::string filePath =
-      testDataDir + GetParam().prefix + "_no_inst_key.apex";
+TEST_P(ApexFileTest, VerifyApexVerityWrongKey) {
+  const std::string filePath = testDataDir + GetParam().prefix + ".apex";
   Result<ApexFile> apexFile = ApexFile::Open(filePath);
   ASSERT_RESULT_OK(apexFile);
 
-  auto verity_or = apexFile->VerifyApexVerity();
+  auto verity_or = apexFile->VerifyApexVerity("wrong-key");
   ASSERT_FALSE(verity_or.ok());
 }
 
@@ -141,6 +138,13 @@
   EXPECT_EQ(keyContent, apexFile->GetBundledPublicKey());
 }
 
+TEST(ApexFileTest, CorrutedApexB146895998) {
+  const std::string apex_path = testDataDir + "corrupted_b146895998.apex";
+  Result<ApexFile> apex = ApexFile::Open(apex_path);
+  ASSERT_RESULT_OK(apex);
+  ASSERT_FALSE(apex->VerifyApexVerity("ignored"));
+}
+
 TEST_P(ApexFileTest, RetrieveFsType) {
   const std::string filePath = testDataDir + GetParam().prefix + ".apex";
   Result<ApexFile> apexFile = ApexFile::Open(filePath);
diff --git a/apexd/apex_preinstalled_data.cpp b/apexd/apex_preinstalled_data.cpp
index d62c28c..827566f 100644
--- a/apexd/apex_preinstalled_data.cpp
+++ b/apexd/apex_preinstalled_data.cpp
@@ -27,7 +27,6 @@
 #include "apex_constants.h"
 #include "apex_file.h"
 #include "apexd_utils.h"
-#include "string_log.h"
 
 using android::base::Error;
 using android::base::Result;
@@ -35,28 +34,13 @@
 namespace android {
 namespace apex {
 
-namespace {
-
-struct ApexPreinstalledData {
-  std::string name;
-  std::string key;
-  std::string path;
-};
-
-std::unordered_map<std::string, ApexPreinstalledData> gScannedPreinstalledData;
-
-Result<std::vector<ApexPreinstalledData>> collectPreinstalleDataFromDir(
-    const std::string& dir) {
+Result<void> ApexPreinstalledData::ScanDir(const std::string& dir) {
   LOG(INFO) << "Scanning " << dir << " for preinstalled data";
-  std::vector<ApexPreinstalledData> ret;
   if (access(dir.c_str(), F_OK) != 0 && errno == ENOENT) {
-    LOG(INFO) << "... does not exist. Skipping";
-    return ret;
+    LOG(INFO) << dir << " does not exist. Skipping";
+    return {};
   }
-  const bool scanBuiltinApexes = isPathForBuiltinApexes(dir);
-  if (!scanBuiltinApexes) {
-    return Error() << "Can't scan preinstalled APEX data from " << dir;
-  }
+
   Result<std::vector<std::string>> apex_files = FindApexFilesByName(dir);
   if (!apex_files.ok()) {
     return apex_files.error();
@@ -67,67 +51,71 @@
     if (!apex_file.ok()) {
       return Error() << "Failed to open " << file << " : " << apex_file.error();
     }
-    ApexPreinstalledData apexPreInstalledData;
-    apexPreInstalledData.name = apex_file->GetManifest().name();
-    apexPreInstalledData.key = apex_file->GetBundledPublicKey();
-    apexPreInstalledData.path = apex_file->GetPath();
-    ret.push_back(apexPreInstalledData);
-  }
-  return ret;
-}
 
-Result<void> updatePreinstalledData(
-    const std::vector<ApexPreinstalledData>& apexes) {
-  for (const ApexPreinstalledData& apex : apexes) {
-    if (gScannedPreinstalledData.find(apex.name) ==
-        gScannedPreinstalledData.end()) {
-      gScannedPreinstalledData.insert({apex.name, apex});
+    const std::string& name = apex_file->GetManifest().name();
+    ApexData apex_data;
+    apex_data.public_key = apex_file->GetBundledPublicKey();
+    apex_data.path = apex_file->GetPath();
+
+    auto it = data_.find(name);
+    if (it == data_.end()) {
+      LOG(INFO) << "Added " << apex_data.path << " ( " << name
+                << " ) to list of pre-installed apexes";
+      data_[name] = apex_data;
+    } else if (it->second.public_key != apex_data.public_key) {
+      return Error() << "Key for package " << name
+                     << " does not match with previously scanned key";
     } else {
-      const std::string& existing_key =
-          gScannedPreinstalledData.at(apex.name).key;
-      if (existing_key != apex.key) {
-        return Error() << "Key for package " << apex.name
-                       << " does not match with previously scanned key";
-      }
+      LOG(INFO) << apex_data.path << " ( " << name << " ) is already added";
     }
   }
   return {};
 }
 
-}  // namespace
+ApexPreinstalledData& ApexPreinstalledData::GetInstance() {
+  static ApexPreinstalledData instance;
+  return instance;
+}
 
-Result<void> collectPreinstalledData(const std::vector<std::string>& dirs) {
+Result<void> ApexPreinstalledData::Initialize(
+    const std::vector<std::string>& dirs) {
   for (const auto& dir : dirs) {
-    Result<std::vector<ApexPreinstalledData>> preinstalledData =
-        collectPreinstalleDataFromDir(dir);
-    if (!preinstalledData.ok()) {
-      return Error() << "Failed to collect keys from " << dir << " : "
-                     << preinstalledData.error();
-    }
-    Result<void> st = updatePreinstalledData(*preinstalledData);
-    if (!st.ok()) {
-      return st;
+    if (auto result = ScanDir(dir); !result.ok()) {
+      return result.error();
     }
   }
   return {};
 }
 
-Result<const std::string> getApexKey(const std::string& name) {
-  if (gScannedPreinstalledData.find(name) == gScannedPreinstalledData.end()) {
+Result<const std::string> ApexPreinstalledData::GetPublicKey(
+    const std::string& name) const {
+  auto it = data_.find(name);
+  if (it == data_.end()) {
     return Error() << "No preinstalled data found for package " << name;
   }
-  return gScannedPreinstalledData[name].key;
+  return it->second.public_key;
 }
 
-Result<const std::string> getApexPreinstalledPath(const std::string& name) {
-  if (gScannedPreinstalledData.find(name) == gScannedPreinstalledData.end()) {
+Result<const std::string> ApexPreinstalledData::GetPreinstalledPath(
+    const std::string& name) const {
+  auto it = data_.find(name);
+  if (it == data_.end()) {
     return Error() << "No preinstalled data found for package " << name;
   }
-  return gScannedPreinstalledData[name].path;
+  return it->second.path;
 }
 
-bool HasPreInstalledVersion(const std::string& name) {
-  return gScannedPreinstalledData.find(name) != gScannedPreinstalledData.end();
+bool ApexPreinstalledData::HasPreInstalledVersion(
+    const std::string& name) const {
+  return data_.find(name) != data_.end();
+}
+
+bool ApexPreinstalledData::IsPreInstalledApex(const ApexFile& apex) const {
+  auto it = data_.find(apex.GetManifest().name());
+  if (it == data_.end()) {
+    return false;
+  }
+  return it->second.path == apex.GetPath();
 }
 
 }  // namespace apex
diff --git a/apexd/apex_preinstalled_data.h b/apexd/apex_preinstalled_data.h
index 1b80aad..44ac32b 100644
--- a/apexd/apex_preinstalled_data.h
+++ b/apexd/apex_preinstalled_data.h
@@ -17,18 +17,73 @@
 #pragma once
 
 #include <string>
+#include <unordered_map>
 #include <vector>
+#include "apex_file.h"
 
 #include <android-base/result.h>
 
 namespace android {
 namespace apex {
 
-android::base::Result<void> collectPreinstalledData(
-    const std::vector<std::string>& apex_dirs);
-android::base::Result<const std::string> getApexKey(const std::string& name);
-android::base::Result<const std::string> getApexPreinstalledPath(
-    const std::string& name);
-bool HasPreInstalledVersion(const std::string& name);
+// This class encapsulates pre-installed data for all the apexes on device.
+// This data can be used to verify validity of an apex before trying to mount
+// it.
+//
+// It's expected to have a single instance of this class in a process that
+// mounts apexes (e.g. apexd, otapreopt_chroot).
+class ApexPreinstalledData final {
+ public:
+  // c-tor and d-tor are exposed for testing.
+  ApexPreinstalledData(){};
+
+  ~ApexPreinstalledData() { data_.clear(); };
+
+  // Returns a singletone instance of this class.
+  static ApexPreinstalledData& GetInstance();
+
+  // Initializes instance by collecting pre-installed data from the given
+  // |dirs|.
+  // Note: this call is **not thread safe** and is expected to be performed in a
+  // single thread during initialization of apexd. After initialization is
+  // finished, all queries to the instance are thread safe.
+  android::base::Result<void> Initialize(const std::vector<std::string>& dirs);
+
+  // Returns trusted public key for an apex with the given |name|.
+  android::base::Result<const std::string> GetPublicKey(
+      const std::string& name) const;
+
+  // Returns path to the pre-installed version of an apex with the given |name|.
+  android::base::Result<const std::string> GetPreinstalledPath(
+      const std::string& name) const;
+
+  // Checks whether there is a pre-installed version of an apex with the given
+  // |name|.
+  bool HasPreInstalledVersion(const std::string& name) const;
+
+  // Checks if given |apex| is pre-installed.
+  bool IsPreInstalledApex(const ApexFile& apex) const;
+
+ private:
+  // Non-copyable && non-moveable.
+  ApexPreinstalledData(const ApexPreinstalledData&) = delete;
+  ApexPreinstalledData& operator=(const ApexPreinstalledData&) = delete;
+  ApexPreinstalledData& operator=(ApexPreinstalledData&&) = delete;
+  ApexPreinstalledData(ApexPreinstalledData&&) = delete;
+
+  // Scans apexes in the given directory and adds collected data into |data_|.
+  android::base::Result<void> ScanDir(const std::string& dir);
+
+  // Internal struct to hold pre-installed data for the given apex.
+  struct ApexData {
+    // Public key of this apex.
+    std::string public_key;
+    // Path to the pre-installed version of this apex.
+    std::string path;
+  };
+
+  std::unordered_map<std::string, ApexData> data_;
+};
+
 }  // namespace apex
 }  // namespace android
diff --git a/apexd/apex_preinstalled_data_test.cpp b/apexd/apex_preinstalled_data_test.cpp
new file mode 100644
index 0000000..8efe68a
--- /dev/null
+++ b/apexd/apex_preinstalled_data_test.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <filesystem>
+#include <string>
+
+#include <errno.h>
+#include <sys/stat.h>
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/stringprintf.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "apex_file.h"
+#include "apex_preinstalled_data.h"
+#include "apexd_test_utils.h"
+#include "apexd_verity.h"
+
+namespace android {
+namespace apex {
+
+using namespace std::literals;
+
+namespace fs = std::filesystem;
+
+using android::apex::testing::IsOk;
+using android::base::GetExecutableDirectory;
+using android::base::StringPrintf;
+using ::testing::HasSubstr;
+
+static std::string GetTestDataDir() { return GetExecutableDirectory(); }
+static std::string GetTestFile(const std::string& name) {
+  return GetTestDataDir() + "/" + name;
+}
+
+TEST(ApexPreinstalledDataTest, InitializeSuccess) {
+  // Prepare test data.
+  TemporaryDir td;
+  fs::copy(GetTestFile("apex.apexd_test.apex"), td.path);
+  fs::copy(GetTestFile("apex.apexd_test_different_app.apex"), td.path);
+
+  ApexPreinstalledData instance;
+  ASSERT_TRUE(IsOk(instance.Initialize({td.path})));
+
+  // Now test that apexes were scanned correctly;
+  auto test_fn = [&](const std::string& apex_name) {
+    auto apex = ApexFile::Open(GetTestFile(apex_name));
+    ASSERT_TRUE(IsOk(apex));
+
+    {
+      auto ret = instance.GetPublicKey(apex->GetManifest().name());
+      ASSERT_TRUE(IsOk(ret));
+      ASSERT_EQ(apex->GetBundledPublicKey(), *ret);
+    }
+
+    {
+      auto ret = instance.GetPreinstalledPath(apex->GetManifest().name());
+      ASSERT_TRUE(IsOk(ret));
+      ASSERT_EQ(StringPrintf("%s/%s", td.path, apex_name.c_str()), *ret);
+    }
+
+    ASSERT_TRUE(instance.HasPreInstalledVersion(apex->GetManifest().name()));
+  };
+
+  test_fn("apex.apexd_test.apex");
+  test_fn("apex.apexd_test_different_app.apex");
+}
+
+TEST(ApexPreinstalledDataTest, InitializeFailureCorruptApex) {
+  // Prepare test data.
+  TemporaryDir td;
+  fs::copy(GetTestFile("apex.apexd_test.apex"), td.path);
+  fs::copy(GetTestFile("apex.apexd_test_corrupt_superblock_apex.apex"),
+           td.path);
+
+  ApexPreinstalledData instance;
+  ASSERT_FALSE(IsOk(instance.Initialize({td.path})));
+}
+
+TEST(ApexPreinstalledData, InitializeFailureSameNameDifferentKeys) {
+  // Prepare test data.
+  TemporaryDir td;
+  fs::copy(GetTestFile("apex.apexd_test.apex"), td.path);
+  fs::copy(GetTestFile("apex.apexd_test_different_key.apex"), td.path);
+
+  ApexPreinstalledData instance;
+  auto result = instance.Initialize({td.path});
+
+  ASSERT_FALSE(IsOk(result));
+  ASSERT_THAT(result.error().message(),
+              HasSubstr("does not match with previously scanned key"));
+}
+
+TEST(ApexPreinstalledData, IsPreInstalledApex) {
+  // Prepare test data.
+  TemporaryDir td;
+  fs::copy(GetTestFile("apex.apexd_test.apex"), td.path);
+
+  ApexPreinstalledData instance;
+  ASSERT_TRUE(IsOk(instance.Initialize({td.path})));
+
+  auto apex1 = ApexFile::Open(StringPrintf("%s/apex.apexd_test.apex", td.path));
+  ASSERT_TRUE(IsOk(apex1));
+  ASSERT_TRUE(instance.IsPreInstalledApex(*apex1));
+
+  // It's same apex, but path is different. Shouldn't be treated as
+  // pre-installed.
+  auto apex2 = ApexFile::Open(GetTestFile("apex.apexd_test.apex"));
+  ASSERT_TRUE(IsOk(apex2));
+  ASSERT_FALSE(instance.IsPreInstalledApex(*apex2));
+
+  auto apex3 =
+      ApexFile::Open(GetTestFile("apex.apexd_test_different_app.apex"));
+  ASSERT_TRUE(IsOk(apex3));
+  ASSERT_FALSE(instance.IsPreInstalledApex(*apex3));
+}
+
+}  // namespace apex
+}  // namespace android
diff --git a/apexd/apex_shim.cpp b/apexd/apex_shim.cpp
index 74ea343..8733484 100644
--- a/apexd/apex_shim.cpp
+++ b/apexd/apex_shim.cpp
@@ -51,8 +51,9 @@
     "apex_manifest.json",
     "apex_manifest.pb",
     "etc/hash.txt",
-    "app/CtsShimPrebuilt/CtsShimPrebuilt.apk",
-    "priv-app/CtsShimPrivPrebuilt/CtsShimPrivPrebuilt.apk",
+    "app/CtsShim/CtsShim.apk",
+    "app/CtsShimTargetPSdk/CtsShimTargetPSdk.apk",
+    "priv-app/CtsShimPriv/CtsShimPriv.apk",
 };
 
 Result<std::string> CalculateSha512(const std::string& path) {
diff --git a/apexd/apexd.cpp b/apexd/apexd.cpp
index e0dce8e..093f0be 100644
--- a/apexd/apexd.cpp
+++ b/apexd/apexd.cpp
@@ -44,6 +44,7 @@
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
+#include <google/protobuf/util/message_differencer.h>
 #include <libavb/libavb.h>
 #include <libdm/dm.h>
 #include <libdm/dm_table.h>
@@ -90,8 +91,8 @@
 using android::dm::DmDeviceState;
 using android::dm::DmTable;
 using android::dm::DmTargetVerity;
-
 using apex::proto::SessionState;
+using google::protobuf::util::MessageDifferencer;
 
 namespace android {
 namespace apex {
@@ -141,7 +142,7 @@
   return ret;
 })();
 
-static constexpr const int kNumRetriesWhenCheckpointingEnabled = 2;
+static constexpr const int kNumRetriesWhenCheckpointingEnabled = 1;
 
 bool isBootstrapApex(const ApexFile& apex) {
   return std::find(kBootstrapApexes.begin(), kBootstrapApexes.end(),
@@ -347,9 +348,16 @@
 
 Result<void> VerifyMountedImage(const ApexFile& apex,
                                 const std::string& mount_point) {
-  auto result = apex.VerifyManifestMatches(mount_point);
-  if (!result.ok()) {
-    return result;
+  // Verify that apex_manifest.pb inside mounted image matches the one in the
+  // outer .apex container.
+  Result<ApexManifest> verified_manifest =
+      ReadManifest(mount_point + "/" + kManifestFilenamePb);
+  if (!verified_manifest.ok()) {
+    return verified_manifest.error();
+  }
+  if (!MessageDifferencer::Equals(*verified_manifest, apex.GetManifest())) {
+    return Errorf(
+        "Manifest inside filesystem does not match manifest outside it");
   }
   if (shim::IsShimApex(apex)) {
     return shim::ValidateShimApex(mount_point, apex);
@@ -406,7 +414,14 @@
   }
   LOG(VERBOSE) << "Loopback device created: " << loopbackDevice.name;
 
-  auto verityData = apex.VerifyApexVerity();
+  auto& instance = ApexPreinstalledData::GetInstance();
+
+  auto public_key = instance.GetPublicKey(apex.GetManifest().name());
+  if (!public_key.ok()) {
+    return public_key.error();
+  }
+
+  auto verityData = apex.VerifyApexVerity(*public_key);
   if (!verityData.ok()) {
     return Error() << "Failed to verify Apex Verity data for " << full_path
                    << ": " << verityData.error();
@@ -421,7 +436,7 @@
   // dm-verity because they are already in the dm-verity protected partition;
   // system. However, note that we don't skip verification to ensure that APEXes
   // are correctly signed.
-  const bool mountOnVerity = !isPathForBuiltinApexes(full_path);
+  const bool mountOnVerity = !instance.IsPreInstalledApex(apex);
   DmVerityDevice verityDev;
   loop::LoopbackDeviceUniqueFd loop_for_hash;
   if (mountOnVerity) {
@@ -618,9 +633,26 @@
     }
   }
 
-  // 2) If we found hooks, run the pre/post-install.
+  // 2) If we found hooks, temp mount if required, and run the pre/post-install.
   if (has_hooks) {
-    Result<void> install_status = (*call)(apexes);
+    std::vector<std::string> mount_points;
+    for (const ApexFile& apex : apexes) {
+      // Retrieve the mount data if the apex is already temp mounted, temp
+      // mount it otherwise.
+      std::string mount_point =
+          apexd_private::GetPackageTempMountPoint(apex.GetManifest());
+      Result<MountedApexData> mount_data =
+          apexd_private::getTempMountedApexData(apex.GetManifest().name());
+      if (!mount_data.ok()) {
+        mount_data = apexd_private::TempMountPackage(apex, mount_point);
+        if (!mount_data.ok()) {
+          return mount_data.error();
+        }
+      }
+      mount_points.push_back(mount_point);
+    }
+
+    Result<void> install_status = (*call)(apexes, mount_points);
     if (!install_status.ok()) {
       return install_status;
     }
@@ -675,7 +707,13 @@
 // This function should only verification checks that are necessary to run on
 // each boot. Try to avoid putting expensive checks inside this function.
 Result<void> VerifyPackageBoot(const ApexFile& apex_file) {
-  Result<ApexVerityData> verity_or = apex_file.VerifyApexVerity();
+  // TODO(ioffe): why do we need this here?
+  auto& instance = ApexPreinstalledData::GetInstance();
+  auto public_key = instance.GetPublicKey(apex_file.GetManifest().name());
+  if (!public_key.ok()) {
+    return public_key.error();
+  }
+  Result<ApexVerityData> verity_or = apex_file.VerifyApexVerity(*public_key);
   if (!verity_or.ok()) {
     return verity_or.error();
   }
@@ -701,7 +739,6 @@
   if (!verify_package_boot_status.ok()) {
     return verify_package_boot_status;
   }
-  Result<ApexVerityData> verity_or = apex_file.VerifyApexVerity();
 
   constexpr const auto kSuccessFn = [](const std::string& /*mount_point*/) {
     return Result<void>{};
@@ -1121,7 +1158,10 @@
   std::vector<com::android::apex::ApexInfo> apexInfos;
 
   auto convertToAutogen = [&apexInfos](const ApexFile& apex, bool isActive) {
-    auto preinstalledPath = getApexPreinstalledPath(apex.GetManifest().name());
+    auto& instance = ApexPreinstalledData::GetInstance();
+
+    auto preinstalledPath =
+        instance.GetPreinstalledPath(apex.GetManifest().name());
     std::optional<std::string> preinstalledModulePath;
     if (preinstalledPath.ok()) {
       preinstalledModulePath = *preinstalledPath;
@@ -1129,7 +1169,7 @@
     com::android::apex::ApexInfo apexInfo(
         apex.GetManifest().name(), apex.GetPath(), preinstalledModulePath,
         apex.GetManifest().version(), apex.GetManifest().versionname(),
-        apex.IsBuiltin(), isActive);
+        instance.IsPreInstalledApex(apex), isActive);
     apexInfos.emplace_back(apexInfo);
   };
 
@@ -1238,7 +1278,7 @@
  **/
 Result<void> abortStagedSession(int session_id) {
   auto session = ApexSession::GetSession(session_id);
-  if (!session) {
+  if (!session.ok()) {
     return Error() << "No session found with id " << session_id;
   }
   switch (session->GetState()) {
@@ -1311,14 +1351,15 @@
 }
 
 bool ShouldActivateApexOnData(const ApexFile& apex) {
-  return HasPreInstalledVersion(apex.GetManifest().name());
+  return ApexPreinstalledData::GetInstance().HasPreInstalledVersion(
+      apex.GetManifest().name());
 }
 
 }  // namespace
 
 Result<void> scanPackagesDirAndActivate(const char* apex_package_dir) {
   auto apexes = ScanApexFiles(apex_package_dir);
-  if (!apexes.ok()) {
+  if (!apexes) {
     return apexes.error();
   }
   return ActivateApexPackages(*apexes);
@@ -1383,7 +1424,7 @@
     for (const auto& apex_name : session.GetApexNames()) {
       Result<void> result =
           snapshotDataDirectory(base_dir, session.GetRollbackId(), apex_name);
-      if (!result.ok()) {
+      if (!result) {
         LOG(ERROR) << "Snapshot failed for " << apex_name << ": "
                    << result.error();
       }
@@ -1416,7 +1457,7 @@
 int snapshotOrRestoreDeUserData() {
   auto user_dirs = GetDeUserDirs();
 
-  if (!user_dirs.ok()) {
+  if (!user_dirs) {
     LOG(ERROR) << "Error reading dirs " << user_dirs.error();
     return 1;
   }
@@ -1436,7 +1477,7 @@
                              const std::string& apex_name) {
   auto base_dir = StringPrintf("%s/%d", kCeDataDir, user_id);
   Result<void> result = snapshotDataDirectory(base_dir, rollback_id, apex_name);
-  if (!result.ok()) {
+  if (!result) {
     return result.error();
   }
   auto ce_snapshot_path =
@@ -1457,7 +1498,7 @@
   namespace fs = std::filesystem;
   auto from_path = std::string(kApexDataDir) + "/sessions";
   auto exists = PathExists(from_path);
-  if (!exists.ok()) {
+  if (!exists) {
     return Error() << "Failed to access " << from_path << ": "
                    << exists.error();
   }
@@ -1502,6 +1543,36 @@
   return {};
 }
 
+/**
+ * Deletes all credential-encrypted snapshots for the given user, except for
+ * those listed in retain_rollback_ids.
+ */
+Result<void> destroyCeSnapshotsNotSpecified(
+    int user_id, const std::vector<int>& retain_rollback_ids) {
+  auto snapshot_root =
+      StringPrintf("%s/%d/%s", kCeDataDir, user_id, kApexSnapshotSubDir);
+  auto snapshot_dirs = GetSubdirs(snapshot_root);
+  if (!snapshot_dirs) {
+    return Error() << "Error reading snapshot dirs " << snapshot_dirs.error();
+  }
+
+  for (const auto& snapshot_dir : *snapshot_dirs) {
+    uint snapshot_id;
+    bool parse_ok = ParseUint(
+        std::filesystem::path(snapshot_dir).filename().c_str(), &snapshot_id);
+    if (parse_ok &&
+        std::find(retain_rollback_ids.begin(), retain_rollback_ids.end(),
+                  snapshot_id) == retain_rollback_ids.end()) {
+      Result<void> result = DeleteDir(snapshot_dir);
+      if (!result) {
+        return Error() << "Destroy CE snapshot failed for " << snapshot_dir
+                       << " : " << result.error();
+      }
+    }
+  }
+  return {};
+}
+
 void restorePreRestoreSnapshotsIfPresent(const std::string& base_dir,
                                          const ApexSession& session) {
   auto pre_restore_snapshot_path =
@@ -1564,36 +1635,6 @@
   }
 }
 
-/**
- * Deletes all credential-encrypted snapshots for the given user, except for
- * those listed in retain_rollback_ids.
- */
-Result<void> destroyCeSnapshotsNotSpecified(
-    int user_id, const std::vector<int>& retain_rollback_ids) {
-  auto snapshot_root =
-      StringPrintf("%s/%d/%s", kCeDataDir, user_id, kApexSnapshotSubDir);
-  auto snapshot_dirs = GetSubdirs(snapshot_root);
-  if (!snapshot_dirs) {
-    return Error() << "Error reading snapshot dirs " << snapshot_dirs.error();
-  }
-
-  for (const auto& snapshot_dir : *snapshot_dirs) {
-    uint snapshot_id;
-    bool parse_ok = ParseUint(
-        std::filesystem::path(snapshot_dir).filename().c_str(), &snapshot_id);
-    if (parse_ok &&
-        std::find(retain_rollback_ids.begin(), retain_rollback_ids.end(),
-                  snapshot_id) == retain_rollback_ids.end()) {
-      Result<void> result = DeleteDir(snapshot_dir);
-      if (!result) {
-        return Error() << "Destroy CE snapshot failed for " << snapshot_dir
-                       << " : " << result.error();
-      }
-    }
-  }
-  return {};
-}
-
 void scanStagedSessionsDirAndStage() {
   LOG(INFO) << "Scanning " << kApexSessionsDir
             << " looking for sessions to be activated.";
@@ -1684,7 +1725,7 @@
     for (const auto& apex : apexes) {
       // TODO(b/158470836): Avoid opening ApexFile repeatedly.
       Result<ApexFile> apex_file = ApexFile::Open(apex);
-      if (!apex_file.ok()) {
+      if (!apex_file) {
         LOG(ERROR) << "Cannot open apex file during staging: " << apex;
         continue;
       }
@@ -1829,11 +1870,12 @@
   LOG(DEBUG) << "unstagePackages() for " << Join(paths, ',');
 
   for (const std::string& path : paths) {
-    if (isPathForBuiltinApexes(path)) {
-      return Error() << "Can't uninstall pre-installed apex " << path;
+    auto apex = ApexFile::Open(path);
+    if (!apex.ok()) {
+      return apex.error();
     }
-    if (access(path.c_str(), F_OK) != 0) {
-      return ErrnoError() << "Can't access " << path;
+    if (ApexPreinstalledData::GetInstance().IsPreInstalledApex(*apex)) {
+      return Error() << "Can't uninstall pre-installed apex " << path;
     }
   }
 
@@ -1913,7 +1955,7 @@
 Result<void> revertActiveSessionsAndReboot(
     const std::string& crashing_native_process) {
   auto status = revertActiveSessions(crashing_native_process);
-  if (!status) {
+  if (!status.ok()) {
     return status;
   }
   LOG(ERROR) << "Successfully reverted. Time to reboot device.";
@@ -1937,16 +1979,17 @@
                << preAllocate.error();
   }
 
-  std::vector<std::string> bootstrap_apex_dirs{
+  ApexPreinstalledData& instance = ApexPreinstalledData::GetInstance();
+  static const std::vector<std::string> kBootstrapApexDirs{
       kApexPackageSystemDir, kApexPackageSystemExtDir, kApexPackageVendorDir};
-  Result<void> status = collectPreinstalledData(bootstrap_apex_dirs);
+  Result<void> status = instance.Initialize(kBootstrapApexDirs);
   if (!status.ok()) {
     LOG(ERROR) << "Failed to collect APEX keys : " << status.error();
     return 1;
   }
 
   // Activate built-in APEXes for processes launched before /data is mounted.
-  for (const auto& dir : bootstrap_apex_dirs) {
+  for (const auto& dir : kBootstrapApexDirs) {
     auto scan_status = ScanApexFiles(dir.c_str());
     if (!scan_status.ok()) {
       LOG(ERROR) << "Failed to scan APEX files in " << dir << " : "
@@ -1997,7 +2040,8 @@
 
 void initialize(CheckpointInterface* checkpoint_service) {
   initializeVold(checkpoint_service);
-  Result<void> status = collectPreinstalledData(kApexPackageBuiltinDirs);
+  ApexPreinstalledData& instance = ApexPreinstalledData::GetInstance();
+  Result<void> status = instance.Initialize(kApexPackageBuiltinDirs);
   if (!status.ok()) {
     LOG(ERROR) << "Failed to collect APEX keys : " << status.error();
     return;
@@ -2018,18 +2062,14 @@
   // checkpointing.
   if (gSupportsFsCheckpoints) {
     Result<bool> needs_revert = gVoldService->NeedsRollback();
-    if (!needs_revert) {
+    if (!needs_revert.ok()) {
       LOG(ERROR) << "Failed to check if we need a revert: "
                  << needs_revert.error();
     } else if (*needs_revert) {
       LOG(INFO) << "Exceeded number of session retries ("
                 << kNumRetriesWhenCheckpointingEnabled
                 << "). Starting a revert";
-      Result<void> status = revertActiveSessions("");
-      if (!status) {
-        LOG(ERROR) << "Failed to revert (as requested by fs checkpointing) : "
-                   << status.error();
-      }
+      revertActiveSessions("");
     }
   }
 
@@ -2063,20 +2103,28 @@
 
   if (auto ret = ActivateApexPackages(data_apex); !ret.ok()) {
     LOG(ERROR) << "Failed to activate packages from "
-               << kActiveApexPackagesDataDir << " : " << ret.error();
-    if (auto revert = revertActiveSessionsAndReboot(""); !revert.ok()) {
-      LOG(ERROR) << "Failed to revert : " << revert.error();
+               << kActiveApexPackagesDataDir << " : " << status.error();
+    Result<void> revert_status = revertActiveSessionsAndReboot("");
+    if (!revert_status.ok()) {
+      LOG(ERROR) << "Failed to revert : " << revert_status.error()
+                 << kActiveApexPackagesDataDir << " : " << ret.error();
     }
   }
 
   // Now also scan and activate APEXes from pre-installed directories.
   for (const auto& dir : kApexPackageBuiltinDirs) {
-    // TODO(b/123622800): if activation failed, revert and reboot.
-    status = scanPackagesDirAndActivate(dir.c_str());
-    if (!status) {
+    auto scan_status = ScanApexFiles(dir.c_str());
+    if (!scan_status.ok()) {
+      LOG(ERROR) << "Failed to scan APEX packages from " << dir << " : "
+                 << scan_status.error();
+      if (auto revert = revertActiveSessionsAndReboot(""); !revert.ok()) {
+        LOG(ERROR) << "Failed to revert : " << revert.error();
+      }
+    }
+    if (auto activate = ActivateApexPackages(*scan_status); !activate.ok()) {
       // This should never happen. Like **really** never.
       LOG(ERROR) << "Failed to activate packages from " << dir << " : "
-                 << status.error();
+                 << activate.error();
     }
   }
 
@@ -2131,7 +2179,7 @@
 
   if (!gSupportsFsCheckpoints) {
     Result<void> backup_status = BackupActivePackages();
-    if (!backup_status) {
+    if (!backup_status.ok()) {
       // Do not proceed with staged install without backup
       return backup_status.error();
     }
diff --git a/apexd/apexd_loop.cpp b/apexd/apexd_loop.cpp
index aaeeaff..ac5d3b4 100644
--- a/apexd/apexd_loop.cpp
+++ b/apexd/apexd_loop.cpp
@@ -38,6 +38,7 @@
 #include "apexd_utils.h"
 #include "string_log.h"
 
+using android::base::Basename;
 using android::base::Error;
 using android::base::Result;
 using android::base::StartsWith;
@@ -81,12 +82,8 @@
 }
 
 Result<void> configureReadAhead(const std::string& device_path) {
-  auto pos = device_path.find("/dev/block/");
-  if (pos != 0) {
-    return Error() << "Device path does not start with /dev/block.";
-  }
-  pos = device_path.find_last_of('/');
-  std::string device_name = device_path.substr(pos + 1, std::string::npos);
+  CHECK(StartsWith(device_path, "/dev/"));
+  std::string device_name = Basename(device_path);
 
   std::string sysfs_device =
       StringPrintf("/sys/block/%s/queue/read_ahead_kb", device_name.c_str());
@@ -257,25 +254,35 @@
     return ErrnoError() << "Failed LOOP_CTL_GET_FREE";
   }
 
-  std::string device = StringPrintf("/dev/block/loop%d", num);
+  std::string opened_device;
+  const std::vector<std::string> candidate_devices = {
+      StringPrintf("/dev/block/loop%d", num),
+      StringPrintf("/dev/loop%d", num),
+  };
 
   LoopbackDeviceUniqueFd device_fd;
   {
     // See comment on kLoopDeviceRetryAttempts.
     unique_fd sysfs_fd;
     for (size_t i = 0; i != kLoopDeviceRetryAttempts; ++i) {
-      sysfs_fd.reset(open(device.c_str(), O_RDWR | O_CLOEXEC));
-      if (sysfs_fd.get() != -1) {
+      for (auto& device : candidate_devices) {
+        sysfs_fd.reset(open(device.c_str(), O_RDWR | O_CLOEXEC));
+        if (sysfs_fd.get() != -1) {
+          opened_device = device;
+          break;
+        }
+      }
+      if (!opened_device.empty()) {
         break;
       }
-      PLOG(WARNING) << "Loopback device " << device
+      PLOG(WARNING) << "Loopback device " << num
                     << " not ready. Waiting 50ms...";
       usleep(50000);
     }
     if (sysfs_fd.get() == -1) {
-      return ErrnoError() << "Failed to open " << device;
+      return ErrnoError() << "Failed to open loopback device " << num;
     }
-    device_fd = LoopbackDeviceUniqueFd(std::move(sysfs_fd), device);
+    device_fd = LoopbackDeviceUniqueFd(std::move(sysfs_fd), opened_device);
     CHECK_NE(device_fd.get(), -1);
   }
 
@@ -285,7 +292,7 @@
     return configureStatus.error();
   }
 
-  Result<void> readAheadStatus = configureReadAhead(device);
+  Result<void> readAheadStatus = configureReadAhead(opened_device);
   if (!readAheadStatus.ok()) {
     return readAheadStatus.error();
   }
diff --git a/apexd/apexd_prepostinstall.cpp b/apexd/apexd_prepostinstall.cpp
index 9a58aa6..7bf9cfc 100644
--- a/apexd/apexd_prepostinstall.cpp
+++ b/apexd/apexd_prepostinstall.cpp
@@ -59,12 +59,9 @@
   close(STDERR_FILENO);
 }
 
-// Instead of temp mounting inside this fuction, we can make a caller do it.
-// This will align with the plan of extending temp mounting to provide a
-// way to run additional pre-reboot verification of an APEX.
-// TODO(b/158470432): pass mount points instead of apex files.
 template <typename Fn>
-Result<void> StageFnInstall(const std::vector<ApexFile>& apexes, Fn fn,
+Result<void> StageFnInstall(const std::vector<ApexFile>& apexes,
+                            const std::vector<std::string>& mount_points, Fn fn,
                             const char* arg, const char* name) {
   // TODO(b/158470023): consider supporting a session with more than one
   //   pre-install hook.
@@ -80,7 +77,22 @@
   CHECK(hook_idx != -1);
   LOG(VERBOSE) << name << " for " << apexes[hook_idx].GetPath();
 
-  std::vector<MountedApexData> mounted_apexes;
+  // Create invocation args.
+  std::vector<std::string> args{
+      "/system/bin/apexd", arg,
+      mount_points[hook_idx]  // Make the APEX with hook first.
+  };
+  for (size_t i = 0; i < mount_points.size(); i++) {
+    if ((int)i != hook_idx) {
+      args.push_back(mount_points[i]);
+    }
+  }
+
+  return ForkAndRun(args);
+}
+
+template <typename Fn>
+int RunFnInstall(char** in_argv, Fn fn, const char* name) {
   std::vector<std::string> activation_dirs;
   auto preinstall_guard = android::base::make_scope_guard([&]() {
     for (const std::string& active_point : activation_dirs) {
@@ -91,57 +103,6 @@
     }
   });
 
-  for (const ApexFile& apex : apexes) {
-    // 1) Retrieve the mount data if the apex is already temp mounted, temp
-    // mount it otherwise.
-    Result<MountedApexData> mount_data =
-        apexd_private::getTempMountedApexData(apex.GetManifest().name());
-    if (!mount_data.ok()) {
-      std::string mount_point =
-          apexd_private::GetPackageTempMountPoint(apex.GetManifest());
-      mount_data = apexd_private::TempMountPackage(apex, mount_point);
-      if (!mount_data.ok()) {
-        return mount_data.error();
-      }
-    }
-    mounted_apexes.push_back(std::move(*mount_data));
-
-    // Given the fact, that we only allow updates of existing APEXes, all the
-    // activation points will always be already created. Only scenario, when it
-    // won't be the case might be apexservice_test. But even then, it might be
-    // safer to move active_point creation logic to run after unshare.
-    // TODO(b/158470432): maybe move creation of activation points inside
-    //   RunFnInstall?
-    // 2) Ensure there is an activation point, and we will clean it up.
-    std::string active_point =
-        apexd_private::GetActiveMountPoint(apex.GetManifest());
-    if (0 == mkdir(active_point.c_str(), kMkdirMode)) {
-      activation_dirs.emplace_back(std::move(active_point));
-    } else {
-      int saved_errno = errno;
-      if (saved_errno != EEXIST) {
-        return Error() << "Unable to create mount point" << active_point << ": "
-                       << strerror(saved_errno);
-      }
-    }
-  }
-
-  // 3) Create invocation args.
-  std::vector<std::string> args{
-      "/system/bin/apexd", arg,
-      mounted_apexes[hook_idx].mount_point,  // Make the APEX with hook first.
-  };
-  for (size_t i = 0; i < mounted_apexes.size(); i++) {
-    if ((int)i != hook_idx) {
-      args.push_back(mounted_apexes[i].mount_point);
-    }
-  }
-
-  return ForkAndRun(args);
-}
-
-template <typename Fn>
-int RunFnInstall(char** in_argv, Fn fn, const char* name) {
   // 1) Unshare.
   if (unshare(CLONE_NEWNS) != 0) {
     PLOG(ERROR) << "Failed to unshare() for apex " << name;
@@ -157,7 +118,8 @@
 
   std::string hook_path;
   {
-    auto bind_fn = [&fn, name](const std::string& mount_point) {
+    auto bind_fn = [&fn, name,
+                    activation_dirs](const std::string& mount_point) mutable {
       std::string hook;
       std::string active_point;
       {
@@ -180,6 +142,14 @@
         const auto& manifest = *manifest_or;
         hook = (manifest.*fn)();
         active_point = apexd_private::GetActiveMountPoint(manifest);
+        // Ensure there is an activation point. If not, create one and delete
+        // later.
+        if (0 == mkdir(active_point.c_str(), kMkdirMode)) {
+          activation_dirs.push_back(active_point);
+        } else if (errno != EEXIST) {
+          PLOG(ERROR) << "Unable to create mount point " << active_point;
+          _exit(205);
+        }
       }
 
       // 3) Activate the new apex.
@@ -230,17 +200,19 @@
 
 }  // namespace
 
-Result<void> StagePreInstall(const std::vector<ApexFile>& apexes) {
-  return StageFnInstall(apexes, &ApexManifest::preinstallhook, "--pre-install",
-                        "pre-install");
+Result<void> StagePreInstall(const std::vector<ApexFile>& apexes,
+                             const std::vector<std::string>& mount_points) {
+  return StageFnInstall(apexes, mount_points, &ApexManifest::preinstallhook,
+                        "--pre-install", "pre-install");
 }
 
 int RunPreInstall(char** in_argv) {
   return RunFnInstall(in_argv, &ApexManifest::preinstallhook, "pre-install");
 }
 
-Result<void> StagePostInstall(const std::vector<ApexFile>& apexes) {
-  return StageFnInstall(apexes, &ApexManifest::postinstallhook,
+Result<void> StagePostInstall(const std::vector<ApexFile>& apexes,
+                              const std::vector<std::string>& mount_points) {
+  return StageFnInstall(apexes, mount_points, &ApexManifest::postinstallhook,
                         "--post-install", "post-install");
 }
 
diff --git a/apexd/apexd_prepostinstall.h b/apexd/apexd_prepostinstall.h
index 66cd2f5..65125ba 100644
--- a/apexd/apexd_prepostinstall.h
+++ b/apexd/apexd_prepostinstall.h
@@ -27,16 +27,20 @@
 
 class ApexFile;
 
-// Temp mounts given apexes and then forks into:
-// apexd --pre-install <mount-point-of-apex-with-hook> [<other-mount-points>]
+// Forks into: apexd --pre-install <mount-point-of-apex-with-hook>
+// [<other-mount-points>] The caller must pass the temp mount point for each
+// apex file.
 android::base::Result<void> StagePreInstall(
-    const std::vector<ApexFile>& apexes);
+    const std::vector<ApexFile>& apexes,
+    const std::vector<std::string>& mount_points);
 int RunPreInstall(char** argv);
 
-// Temp mounts given apexes and then forks into:
-// apexd --post-install <mount-point-of-apex-with-hook> [<other-mount-points>]
+// Forks into: apexd --post-install <mount-point-of-apex-with-hook>
+// [<other-mount-points>] The caller must pass the temp mount point for each
+// apex file.
 android::base::Result<void> StagePostInstall(
-    const std::vector<ApexFile>& apexes);
+    const std::vector<ApexFile>& apexes,
+    const std::vector<std::string>& mount_points);
 int RunPostInstall(char** argv);
 
 }  // namespace apex
diff --git a/apexd/apexd_testdata/Android.bp b/apexd/apexd_testdata/Android.bp
index 99943f1..9c41241 100644
--- a/apexd/apexd_testdata/Android.bp
+++ b/apexd/apexd_testdata/Android.bp
@@ -226,3 +226,10 @@
   name: "another_prebuilt_file",
   src: "another_prebuilt_file",
 }
+
+prebuilt_apex {
+  name: "apex.corrupted_b146895998",
+  src: "corrupted_b146895998.apex",
+  filename: "corrupted_b146895998.apex",
+  installable: false,
+}
diff --git a/apexd/apexd_testdata/corrupted_b146895998.apex b/apexd/apexd_testdata/corrupted_b146895998.apex
new file mode 100644
index 0000000..1d02697
--- /dev/null
+++ b/apexd/apexd_testdata/corrupted_b146895998.apex
Binary files differ
diff --git a/apexd/apexd_utils.h b/apexd/apexd_utils.h
index 73853c9..e0486f9 100644
--- a/apexd/apexd_utils.h
+++ b/apexd/apexd_utils.h
@@ -36,8 +36,8 @@
 #include <cutils/android_reboot.h>
 
 #include "apex_constants.h"
-#include "string_log.h"
 
+using android::base::EndsWith;
 using android::base::ErrnoError;
 using android::base::Error;
 using android::base::Result;
@@ -241,6 +241,39 @@
   return GetSubdirs(kDeNDataDir);
 }
 
+inline Result<std::vector<std::string>> FindApexFilesByName(
+    const std::string& path) {
+  auto filter_fn = [](const std::filesystem::directory_entry& entry) {
+    std::error_code ec;
+    if (entry.is_regular_file(ec) &&
+        EndsWith(entry.path().filename().string(), kApexPackageSuffix)) {
+      return true;  // APEX file, take.
+    }
+    return false;
+  };
+  return ReadDir(path, filter_fn);
+}
+
+inline Result<std::vector<std::string>> FindApexes(
+    const std::vector<std::string>& paths) {
+  std::vector<std::string> result;
+  for (const auto& path : paths) {
+    auto exist = PathExists(path);
+    if (!exist.ok()) {
+      return exist.error();
+    }
+    if (!*exist) continue;
+
+    const auto& apexes = FindApexFilesByName(path);
+    if (!apexes.ok()) {
+      return apexes;
+    }
+
+    result.insert(result.end(), apexes->begin(), apexes->end());
+  }
+  return result;
+}
+
 }  // namespace apex
 }  // namespace android
 
diff --git a/apexd/apexd_verity_test.cpp b/apexd/apexd_verity_test.cpp
index cf2317c..f431bd3 100644
--- a/apexd/apexd_verity_test.cpp
+++ b/apexd/apexd_verity_test.cpp
@@ -25,7 +25,6 @@
 #include <gtest/gtest.h>
 
 #include "apex_file.h"
-#include "apex_preinstalled_data.h"
 #include "apexd_test_utils.h"
 #include "apexd_verity.h"
 
@@ -45,12 +44,11 @@
 }
 
 TEST(ApexdVerityTest, ReusesHashtree) {
-  ASSERT_TRUE(IsOk(collectPreinstalledData({"/system_ext/apex"})));
   TemporaryDir td;
 
   auto apex = ApexFile::Open(GetTestFile("apex.apexd_test_no_hashtree.apex"));
   ASSERT_TRUE(IsOk(apex));
-  auto verity_data = apex->VerifyApexVerity();
+  auto verity_data = apex->VerifyApexVerity(apex->GetBundledPublicKey());
   ASSERT_TRUE(IsOk(verity_data));
 
   auto hashtree_file = StringPrintf("%s/hashtree", td.path);
@@ -78,12 +76,11 @@
 }
 
 TEST(ApexdVerityTest, RegenerateHashree) {
-  ASSERT_TRUE(IsOk(collectPreinstalledData({"/system_ext/apex"})));
   TemporaryDir td;
 
   auto apex = ApexFile::Open(GetTestFile("apex.apexd_test_no_hashtree.apex"));
   ASSERT_TRUE(IsOk(apex));
-  auto verity_data = apex->VerifyApexVerity();
+  auto verity_data = apex->VerifyApexVerity(apex->GetBundledPublicKey());
   ASSERT_TRUE(IsOk(verity_data));
 
   auto hashtree_file = StringPrintf("%s/hashtree", td.path);
@@ -98,7 +95,7 @@
   auto apex2 =
       ApexFile::Open(GetTestFile("apex.apexd_test_no_hashtree_2.apex"));
   ASSERT_TRUE(IsOk(apex2));
-  auto verity_data2 = apex2->VerifyApexVerity();
+  auto verity_data2 = apex2->VerifyApexVerity(apex2->GetBundledPublicKey());
   ASSERT_TRUE(IsOk(verity_data2));
 
   // Now call PrepareHashTree again. Since digest doesn't match, hashtree
diff --git a/apexd/apexservice.cpp b/apexd/apexservice.cpp
index b505a01..c900bb7 100644
--- a/apexd/apexservice.cpp
+++ b/apexd/apexservice.cpp
@@ -267,15 +267,16 @@
 }
 
 static ApexInfo getApexInfo(const ApexFile& package) {
+  auto& instance = ApexPreinstalledData::GetInstance();
   ApexInfo out;
   out.moduleName = package.GetManifest().name();
   out.modulePath = package.GetPath();
   out.versionCode = package.GetManifest().version();
   out.versionName = package.GetManifest().versionname();
-  out.isFactory = package.IsBuiltin();
+  out.isFactory = instance.IsPreInstalledApex(package);
   out.isActive = false;
   Result<std::string> preinstalledPath =
-      getApexPreinstalledPath(package.GetManifest().name());
+      instance.GetPreinstalledPath(package.GetManifest().name());
   if (preinstalledPath.ok()) {
     out.preinstalledModulePath = *preinstalledPath;
   }
@@ -447,7 +448,7 @@
 BinderStatus ApexService::abortStagedSession(int session_id) {
   LOG(DEBUG) << "abortStagedSession() received by ApexService.";
   Result<void> res = ::android::apex::abortStagedSession(session_id);
-  if (!res) {
+  if (!res.ok()) {
     return BinderStatus::fromExceptionCode(
         BinderStatus::EX_ILLEGAL_ARGUMENT,
         String8(res.error().message().c_str()));
@@ -458,7 +459,7 @@
 BinderStatus ApexService::revertActiveSessions() {
   LOG(DEBUG) << "revertActiveSessions() received by ApexService.";
   Result<void> res = ::android::apex::revertActiveSessions("");
-  if (!res) {
+  if (!res.ok()) {
     return BinderStatus::fromExceptionCode(
         BinderStatus::EX_ILLEGAL_ARGUMENT,
         String8(res.error().message().c_str()));
@@ -474,7 +475,7 @@
 
   LOG(DEBUG) << "resumeRevertIfNeeded() received by ApexService.";
   Result<void> res = ::android::apex::resumeRevertIfNeeded();
-  if (!res) {
+  if (!res.ok()) {
     return BinderStatus::fromExceptionCode(
         BinderStatus::EX_ILLEGAL_ARGUMENT,
         String8(res.error().message().c_str()));
@@ -562,7 +563,8 @@
       !root.isOk()) {
     return root;
   }
-  if (auto res = ::android::apex::collectPreinstalledData(paths); !res) {
+  ApexPreinstalledData& instance = ApexPreinstalledData::GetInstance();
+  if (auto res = instance.Initialize(paths); !res) {
     return BinderStatus::fromExceptionCode(
         BinderStatus::EX_SERVICE_SPECIFIC,
         String8(res.error().message().c_str()));
diff --git a/apexd/apexservice_test.cpp b/apexd/apexservice_test.cpp
index 1e09aaf..4cbd6f7 100644
--- a/apexd/apexservice_test.cpp
+++ b/apexd/apexservice_test.cpp
@@ -59,8 +59,8 @@
 #include "apexd_session.h"
 #include "apexd_test_utils.h"
 #include "apexd_utils.h"
-
 #include "session_state.pb.h"
+#include "string_log.h"
 
 using apex::proto::SessionState;
 
@@ -1384,7 +1384,13 @@
   ASSERT_TRUE(factoryPackages->size() > 0);
 
   for (const ApexInfo& package : *factoryPackages) {
-    ASSERT_TRUE(isPathForBuiltinApexes(package.modulePath));
+    bool is_builtin = false;
+    for (const auto& dir : kApexPackageBuiltinDirs) {
+      if (StartsWith(package.modulePath, dir)) {
+        is_builtin = true;
+      }
+    }
+    ASSERT_TRUE(is_builtin);
   }
 }
 
@@ -2420,10 +2426,6 @@
 }
 
 TEST_F(ApexServiceRevertTest, RevertStoresCrashingNativeProcess) {
-  if (supports_fs_checkpointing_) {
-    GTEST_SKIP() << "Can't run if filesystem checkpointing is enabled";
-  }
-
   PrepareTestApexForInstall installer(GetTestFile("apex.apexd_test_v2.apex"));
   if (!installer.Prepare()) {
     return;
@@ -2736,6 +2738,31 @@
   ASSERT_FALSE(IsOk(service_->submitStagedSession(params, &list)));
 }
 
+TEST_F(ApexServiceTest, SubmitStagedSessionCorruptApexFailsB146895998) {
+  PrepareTestApexForInstall installer(GetTestFile("corrupted_b146895998.apex"),
+                                      "/data/app-staging/session_71",
+                                      "staging_data_file");
+
+  if (!installer.Prepare()) {
+    FAIL() << GetDebugStr(&installer);
+  }
+
+  ApexInfoList list;
+  ApexSessionParams params;
+  params.sessionId = 71;
+  ASSERT_FALSE(IsOk(service_->submitStagedSession(params, &list)));
+}
+
+TEST_F(ApexServiceTest, StageCorruptApexFailsB146895998) {
+  PrepareTestApexForInstall installer(GetTestFile("corrupted_b146895998.apex"));
+
+  if (!installer.Prepare()) {
+    FAIL() << GetDebugStr(&installer);
+  }
+
+  ASSERT_FALSE(IsOk(service_->stagePackages({installer.test_file})));
+}
+
 TEST_F(ApexServiceTest, RemountPackagesPackageOnSystemChanged) {
   static constexpr const char* kSystemPath =
       "/system_ext/apex/apex.apexd_test.apex";
diff --git a/apexer/Android.bp b/apexer/Android.bp
index 2953754..03fdbd6 100644
--- a/apexer/Android.bp
+++ b/apexer/Android.bp
@@ -110,6 +110,12 @@
   ignore_system_library_special_case: true,
   key: "com.android.support.apexer.key",
   binaries: apexer_tools + apexer_go_tools,
+  enabled: false,
+  target: {
+    linux_glibc_x86_64: {
+      enabled: true,
+    },
+  },
 }
 
 // TODO(b/148659029): this test can't run in TEST_MAPPING.
diff --git a/apexer/apexer_test.py b/apexer/apexer_test.py
index db99c67..176b994 100644
--- a/apexer/apexer_test.py
+++ b/apexer/apexer_test.py
@@ -287,6 +287,7 @@
         cmd.append('add_hashtree_footer')
         cmd.append('--do_not_generate_fec')
         cmd.extend(['--algorithm', 'SHA256_RSA4096'])
+        cmd.extend(['--hash_algorithm', 'sha256'])
         cmd.extend(['--key', os.path.join(get_current_dir(), TEST_PRIVATE_KEY)])
         manifest_apex = ValidateApexManifest(container_files["apex_manifest.pb"])
         cmd.extend(['--prop', 'apex.key:' + manifest_apex.name])
diff --git a/shim/Android.bp b/shim/Android.bp
index a92a706..351e754 100644
--- a/shim/Android.bp
+++ b/shim/Android.bp
@@ -17,8 +17,21 @@
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v1_prebuilt",
-  overrides: ["com.android.apex.cts.shim.v1"],
-  src: "com.android.apex.cts.shim.v1.apex",
+  overrides: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v1.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v1.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v1.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v1.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.apex",
   prefer: true,
   installable: true,
@@ -26,49 +39,140 @@
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v2_prebuilt",
-  src: "com.android.apex.cts.shim.v2.apex",
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.v2.apex",
   installable: false,
 }
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v2_wrong_sha_prebuilt",
-  src: "com.android.apex.cts.shim.v2_wrong_sha.apex",
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_wrong_sha.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_wrong_sha.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_wrong_sha.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_wrong_sha.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.v2_wrong_sha.apex",
   installable: false,
 }
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v2_additional_file_prebuilt",
-  src: "com.android.apex.cts.shim.v2_additional_file.apex",
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_additional_file.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_additional_file.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_additional_file.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_additional_file.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.v2_additional_file.apex",
   installable: false,
 }
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v2_additional_folder_prebuilt",
-  src: "com.android.apex.cts.shim.v2_additional_folder.apex",
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_additional_folder.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_additional_folder.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_additional_folder.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_additional_folder.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.v2_additional_folder.apex",
   installable: false,
 }
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v2_with_pre_install_hook_prebuilt",
-  src: "com.android.apex.cts.shim.v2_with_pre_install_hook.apex",
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_with_pre_install_hook.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_with_pre_install_hook.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_with_pre_install_hook.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_with_pre_install_hook.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.v2_with_pre_install_hook.apex",
   installable: false,
 }
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v2_with_post_install_hook_prebuilt",
-  src: "com.android.apex.cts.shim.v2_with_post_install_hook.apex",
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_with_post_install_hook.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v2_with_post_install_hook.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_with_post_install_hook.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v2_with_post_install_hook.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.v2_with_post_install_hook.apex",
   installable: false,
 }
 
 prebuilt_apex {
   name: "com.android.apex.cts.shim.v3_prebuilt",
-  src: "com.android.apex.cts.shim.v3.apex",
+  arch: {
+    arm: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v3.apex",
+    },
+    arm64: {
+      src: "prebuilts/arm/com.android.apex.cts.shim.v3.apex",
+    },
+    x86: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v3.apex",
+    },
+    x86_64: {
+      src: "prebuilts/x86/com.android.apex.cts.shim.v3.apex",
+    },
+  },
   filename: "com.android.apex.cts.shim.v3.apex",
   installable: false,
 }
diff --git a/shim/README.md b/shim/README.md
index 467bf9f..7506a97 100644
--- a/shim/README.md
+++ b/shim/README.md
@@ -30,7 +30,8 @@
   com.android.apex.cts.shim.v2 \
   com.android.apex.cts.shim.v2_additional_file \
   com.android.apex.cts.shim.v2_additional_folder \
-  com.android.apex.cts.shim.v2_different_certificate
+  com.android.apex.cts.shim.v2_different_certificate \
+  com.android.apex.cts.shim.v2_different_package_name \
   com.android.apex.cts.shim.v2_with_pre_install_hook \
   com.android.apex.cts.shim.v2_with_post_install_hook \
   com.android.apex.cts.shim.v2_wrong_sha \
diff --git a/shim/build/Android.bp b/shim/build/Android.bp
index ee4f82d..2667984 100644
--- a/shim/build/Android.bp
+++ b/shim/build/Android.bp
@@ -55,7 +55,7 @@
   file_contexts: ":apex.test-file_contexts",
   key: "com.android.apex.cts.shim.key",
   prebuilts: ["hash_of_dev_null"],
-  apps: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  apps: ["CtsShim", "CtsShimPriv"],
   installable: false,
   allowed_files: "default_shim_allowed_list.txt",
 }
@@ -67,7 +67,18 @@
   file_contexts: ":apex.test-file_contexts",
   key: "com.android.apex.cts.shim.key",
   prebuilts: ["hash_of_dev_null"],
-  apps: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  apps: ["CtsShim", "CtsShimPriv"],
+  installable: false,
+  allowed_files: "default_shim_allowed_list.txt",
+}
+
+apex {
+  name: "com.android.apex.cts.shim.v2_without_apk_in_apex",
+  manifest: "manifest_v2.json",
+  androidManifest: "AndroidManifest.xml",
+  file_contexts: ":apex.test-file_contexts",
+  key: "com.android.apex.cts.shim.key",
+  prebuilts: ["hash_of_dev_null"],
   installable: false,
   allowed_files: "default_shim_allowed_list.txt",
 }
@@ -79,12 +90,31 @@
   file_contexts: ":apex.test-file_contexts",
   key: "com.android.apex.cts.shim.key",
   prebuilts: ["hash_of_dev_null"],
-  apps: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  apps: ["CtsShim", "CtsShimPriv"],
   installable: false,
   allowed_files: "default_shim_allowed_list.txt",
   test_only_no_hashtree: true,
 }
 
+apex {
+  name: "com.android.apex.cts.shim.v2_unsigned_payload",
+  manifest: "manifest_v2.json",
+  androidManifest: "AndroidManifest.xml",
+  file_contexts: ":apex.test-file_contexts",
+  key: "com.android.apex.cts.shim.key",
+  prebuilts: ["hash_of_dev_null"],
+  apps: ["CtsShim", "CtsShimPriv"],
+  installable: false,
+  allowed_files: "default_shim_allowed_list.txt",
+  test_only_unsigned_payload: true,
+}
+
+override_apex {
+    name: "com.android.apex.cts.shim.v2_different_package_name",
+    package_name: "com.android.apex.cts.shim.different",
+    base: "com.android.apex.cts.shim.v2",
+}
+
 genrule {
   name: "generate_empty_hash",
   out: ["hash.txt"],
@@ -169,9 +199,11 @@
   name: "generate_hash_v1",
   srcs: [
     ":com.android.apex.cts.shim.v2",
+    ":com.android.apex.cts.shim.v2_without_apk_in_apex",
     ":com.android.apex.cts.shim.v2_additional_file",
     ":com.android.apex.cts.shim.v2_additional_folder",
     ":com.android.apex.cts.shim.v2_different_certificate",
+    ":com.android.apex.cts.shim.v2_different_package_name",
     ":com.android.apex.cts.shim.v2_no_hashtree",
     ":com.android.apex.cts.shim.v2_signed_bob",
     ":com.android.apex.cts.shim.v2_signed_bob_rot",
@@ -179,6 +211,7 @@
     ":com.android.apex.cts.shim.v2_with_pre_install_hook",
     ":com.android.apex.cts.shim.v2_with_post_install_hook",
     ":com.android.apex.cts.shim.v2_sdk_target_p",
+    ":com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p",
     ":com.android.apex.cts.shim.v3",
     ":com.android.apex.cts.shim.v3_signed_bob",
     ":com.android.apex.cts.shim.v3_signed_bob_rot",
@@ -201,10 +234,24 @@
   file_contexts: ":apex.test-file_contexts",
   key: "com.android.apex.cts.shim.key",
   prebuilts: ["hash_v1"],
-  apps: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  apps: ["CtsShim", "CtsShimPriv"],
   allowed_files: "default_shim_allowed_list.txt",
 }
 
+// This is to install the flattened version of com.android.apex.cts.shim.
+// Because com.android.apex.cts.shim is provided as prebuilt and the build system
+// doesn't support install "flattened" version from "prebult" yet, GSI, which should
+// have both "flatttened" and "unflattened" APEXes, is missing the flattened version
+// of com.android.apex.cts.shim.
+// TODO(b/159426728):  When the build system can install "flattened" from "prebuilts",
+// this can be removed.
+override_apex {
+  name: "com.android.apex.cts.shim.v1_with_prebuilts",
+  base: "com.android.apex.cts.shim.v1",
+  apps: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  allowed_files: "prebuilts_shim_allowed_list.txt",
+}
+
 genrule {
   name: "com.android.apex.cts.shim_not_pre_installed.pem",
   out: ["com.android.apex.cts.shim_not_pre_installed.pem"],
@@ -405,7 +452,7 @@
   file_contexts: ":apex.test-file_contexts",
   key: "com.android.apex.cts.shim.key",
   prebuilts: ["hash_of_dev_null"],
-  apps: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  apps: ["CtsShim", "CtsShimPriv"],
   installable: false,
   min_sdk_version: "29",
 }
@@ -427,5 +474,28 @@
   key: "com.android.apex.cts.shim.key",
   prebuilts: ["hash_of_dev_null"],
   installable: false,
-  apps: ["CtsShimPrebuilt", "CtsShimPrivPrebuilt"],
+  apps: ["CtsShim", "CtsShimPriv"],
+}
+
+// Apex shim with apk-in-apex that targets sdk P
+apex {
+  name: "com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p",
+  manifest: "manifest_v2.json",
+  androidManifest: "AndroidManifest.xml",
+  file_contexts: ":apex.test-file_contexts",
+  key: "com.android.apex.cts.shim.key",
+  prebuilts: ["hash_of_dev_null"],
+  apps: ["CtsShimTargetPSdk"],
+  installable: false,
+}
+
+// Apex shim with unsigned apk
+genrule {
+  name: "com.android.apex.cts.shim.v2_unsigned_apk_container",
+  srcs: [":com.android.apex.cts.shim.v2"],
+  out: ["com.android.apex.cts.shim.v2_unsigned_apk_container.apex"],
+  cmd: "cp -v $(in) $(out) && zip -d $(out) META-INF*",
+  dist: {
+    targets: ["apps_only"],
+  }
 }
diff --git a/shim/build/default_shim_allowed_list.txt b/shim/build/default_shim_allowed_list.txt
index 7da513f..a2dada0 100644
--- a/shim/build/default_shim_allowed_list.txt
+++ b/shim/build/default_shim_allowed_list.txt
@@ -1,4 +1,4 @@
 ./apex_manifest.pb
-./app/CtsShimPrebuilt/CtsShimPrebuilt.apk
+./app/CtsShim/CtsShim.apk
 ./etc/hash.txt
-./priv-app/CtsShimPrivPrebuilt/CtsShimPrivPrebuilt.apk
+./priv-app/CtsShimPriv/CtsShimPriv.apk
diff --git a/shim/build/prebuilts_shim_allowed_list.txt b/shim/build/prebuilts_shim_allowed_list.txt
new file mode 100644
index 0000000..7da513f
--- /dev/null
+++ b/shim/build/prebuilts_shim_allowed_list.txt
@@ -0,0 +1,4 @@
+./apex_manifest.pb
+./app/CtsShimPrebuilt/CtsShimPrebuilt.apk
+./etc/hash.txt
+./priv-app/CtsShimPrivPrebuilt/CtsShimPrivPrebuilt.apk
diff --git a/shim/com.android.apex.cts.shim.v1.apex b/shim/com.android.apex.cts.shim.v1.apex
deleted file mode 100644
index d703580..0000000
--- a/shim/com.android.apex.cts.shim.v1.apex
+++ /dev/null
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_no_hashtree.apex b/shim/com.android.apex.cts.shim.v2_no_hashtree.apex
deleted file mode 100644
index 92c6348..0000000
--- a/shim/com.android.apex.cts.shim.v2_no_hashtree.apex
+++ /dev/null
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob.apex b/shim/com.android.apex.cts.shim.v2_signed_bob.apex
deleted file mode 100644
index ebb7ba0..0000000
--- a/shim/com.android.apex.cts.shim.v2_signed_bob.apex
+++ /dev/null
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v3.apex b/shim/com.android.apex.cts.shim.v3.apex
deleted file mode 100644
index 597acfa..0000000
--- a/shim/com.android.apex.cts.shim.v3.apex
+++ /dev/null
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v3_signed_bob.apex b/shim/com.android.apex.cts.shim.v3_signed_bob.apex
deleted file mode 100644
index 18a687b..0000000
--- a/shim/com.android.apex.cts.shim.v3_signed_bob.apex
+++ /dev/null
Binary files differ
diff --git a/shim/com.android.apex.cts.shim_not_pre_installed.apex b/shim/com.android.apex.cts.shim_not_pre_installed.apex
deleted file mode 100644
index 6e5b1c6..0000000
--- a/shim/com.android.apex.cts.shim_not_pre_installed.apex
+++ /dev/null
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v1.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v1.apex
index 412a584..7b5758d 100644
--- a/shim/com.android.apex.cts.shim.v2.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v1.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2.apex
index f94a486..dc2c8c9 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_additional_file.apex
similarity index 96%
rename from shim/com.android.apex.cts.shim.v2_additional_file.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_additional_file.apex
index 6b9d9af..3cf8175 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_additional_file.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_folder.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_additional_folder.apex
similarity index 96%
rename from shim/com.android.apex.cts.shim.v2_additional_folder.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_additional_folder.apex
index df05d31..5335818 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_folder.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_additional_folder.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_different_certificate.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex
similarity index 94%
copy from shim/com.android.apex.cts.shim.v2_different_certificate.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex
index b26a754..4f0edff 100644
--- a/shim/com.android.apex.cts.shim.v2_different_certificate.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_different_certificate.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_different_certificate.apex
similarity index 95%
rename from shim/com.android.apex.cts.shim.v2_different_certificate.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_different_certificate.apex
index b26a754..af89d20 100644
--- a/shim/com.android.apex.cts.shim.v2_different_certificate.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_different_certificate.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_different_package_name.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_different_package_name.apex
index f94a486..12b85e4 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_different_package_name.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_no_hashtree.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_no_hashtree.apex
index f94a486..00c0c19 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_no_hashtree.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_sdk_target_p.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_sdk_target_p.apex
index f94a486..50e77bd 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_sdk_target_p.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_different_certificate.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_different_certificate.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob.apex
index b26a754..3bde9ba 100644
--- a/shim/com.android.apex.cts.shim.v2_different_certificate.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob_rot.apex
similarity index 86%
rename from shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob_rot.apex
index 2310823..26c3f27 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob_rot.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
index f94a486..81aaecf 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_unsigned_apk_container.apex
similarity index 88%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_unsigned_apk_container.apex
index f94a486..b8444ba 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_unsigned_apk_container.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_unsigned_payload.apex
similarity index 87%
rename from shim/com.android.apex.cts.shim.v2.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_unsigned_payload.apex
index 412a584..d2be4a2 100644
--- a/shim/com.android.apex.cts.shim.v2.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_unsigned_payload.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_with_post_install_hook.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_with_post_install_hook.apex
similarity index 96%
rename from shim/com.android.apex.cts.shim.v2_with_post_install_hook.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_with_post_install_hook.apex
index 93cfa49..e1f904e 100644
--- a/shim/com.android.apex.cts.shim.v2_with_post_install_hook.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_with_post_install_hook.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_with_pre_install_hook.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
similarity index 96%
rename from shim/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
index c58736a..c8aa9d9 100644
--- a/shim/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_without_apk_in_apex.apex
similarity index 95%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v2_without_apk_in_apex.apex
index 6b9d9af..41c29bf 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_without_apk_in_apex.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_wrong_sha.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_wrong_sha.apex
similarity index 96%
rename from shim/com.android.apex.cts.shim.v2_wrong_sha.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v2_wrong_sha.apex
index 5282c4f..1447e7d 100644
--- a/shim/com.android.apex.cts.shim.v2_wrong_sha.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v2_wrong_sha.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v3.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v3.apex
index f94a486..e538f83 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v3.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v3_signed_bob.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim.v3_signed_bob.apex
index 6b9d9af..86b418e 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v3_signed_bob.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v3_signed_bob_rot.apex b/shim/prebuilts/arm/com.android.apex.cts.shim.v3_signed_bob_rot.apex
similarity index 86%
rename from shim/com.android.apex.cts.shim.v3_signed_bob_rot.apex
rename to shim/prebuilts/arm/com.android.apex.cts.shim.v3_signed_bob_rot.apex
index f0073b4..29a0877 100644
--- a/shim/com.android.apex.cts.shim.v3_signed_bob_rot.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim.v3_signed_bob_rot.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/arm/com.android.apex.cts.shim_not_pre_installed.apex
similarity index 95%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/arm/com.android.apex.cts.shim_not_pre_installed.apex
index 6b9d9af..e8705c7 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/arm/com.android.apex.cts.shim_not_pre_installed.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v1.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v1.apex
index 412a584..04ec92d 100644
--- a/shim/com.android.apex.cts.shim.v2.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v1.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2.apex
index f94a486..ff54789 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_additional_file.apex
similarity index 96%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_additional_file.apex
index 6b9d9af..3cf8175 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_additional_file.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_folder.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_additional_folder.apex
similarity index 96%
copy from shim/com.android.apex.cts.shim.v2_additional_folder.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_additional_folder.apex
index df05d31..5335818 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_folder.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_additional_folder.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_different_certificate.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex
similarity index 94%
copy from shim/com.android.apex.cts.shim.v2_different_certificate.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex
index b26a754..4f0edff 100644
--- a/shim/com.android.apex.cts.shim.v2_different_certificate.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_different_certificate.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_different_certificate.apex
similarity index 95%
copy from shim/com.android.apex.cts.shim.v2_different_certificate.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_different_certificate.apex
index b26a754..af89d20 100644
--- a/shim/com.android.apex.cts.shim.v2_different_certificate.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_different_certificate.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_different_package_name.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_different_package_name.apex
index f94a486..eca1c37 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_different_package_name.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_no_hashtree.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_no_hashtree.apex
index f94a486..19da864 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_no_hashtree.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_sdk_target_p.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_sdk_target_p.apex
index f94a486..6b7436b 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_sdk_target_p.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob.apex
index 6b9d9af..659f462 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob_rot.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob_rot.apex
index 2310823..c5e2210 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob_rot.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
index f94a486..3ff88a9 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_unsigned_apk_container.apex
similarity index 88%
rename from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
rename to shim/prebuilts/x86/com.android.apex.cts.shim.v2_unsigned_apk_container.apex
index f94a486..07b8a6f 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_unsigned_apk_container.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_unsigned_payload.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_unsigned_payload.apex
index 412a584..cd70226 100644
--- a/shim/com.android.apex.cts.shim.v2.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_unsigned_payload.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_with_post_install_hook.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_with_post_install_hook.apex
similarity index 96%
copy from shim/com.android.apex.cts.shim.v2_with_post_install_hook.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_with_post_install_hook.apex
index 93cfa49..e1f904e 100644
--- a/shim/com.android.apex.cts.shim.v2_with_post_install_hook.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_with_post_install_hook.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_with_pre_install_hook.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
similarity index 96%
copy from shim/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
index c58736a..c8aa9d9 100644
--- a/shim/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_with_pre_install_hook.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_without_apk_in_apex.apex
similarity index 95%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_without_apk_in_apex.apex
index 6b9d9af..41c29bf 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_without_apk_in_apex.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_wrong_sha.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_wrong_sha.apex
similarity index 96%
copy from shim/com.android.apex.cts.shim.v2_wrong_sha.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v2_wrong_sha.apex
index 5282c4f..1447e7d 100644
--- a/shim/com.android.apex.cts.shim.v2_wrong_sha.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v2_wrong_sha.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v3.apex
similarity index 87%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v3.apex
index f94a486..b3ecef7 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v3.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v3_signed_bob.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v3_signed_bob.apex
index 6b9d9af..9281ee3 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v3_signed_bob.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex b/shim/prebuilts/x86/com.android.apex.cts.shim.v3_signed_bob_rot.apex
similarity index 86%
copy from shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim.v3_signed_bob_rot.apex
index 2310823..23b2378 100644
--- a/shim/com.android.apex.cts.shim.v2_signed_bob_rot.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim.v3_signed_bob_rot.apex
Binary files differ
diff --git a/shim/com.android.apex.cts.shim.v2_additional_file.apex b/shim/prebuilts/x86/com.android.apex.cts.shim_not_pre_installed.apex
similarity index 95%
copy from shim/com.android.apex.cts.shim.v2_additional_file.apex
copy to shim/prebuilts/x86/com.android.apex.cts.shim_not_pre_installed.apex
index 6b9d9af..e8705c7 100644
--- a/shim/com.android.apex.cts.shim.v2_additional_file.apex
+++ b/shim/prebuilts/x86/com.android.apex.cts.shim_not_pre_installed.apex
Binary files differ
diff --git a/tests/TEST_MAPPING b/tests/TEST_MAPPING
index 5688b40..6fdce6e 100644
--- a/tests/TEST_MAPPING
+++ b/tests/TEST_MAPPING
@@ -7,22 +7,10 @@
       "name": "apex_targetprep_tests"
     },
     {
-      "name": "adbd_e2e_tests"
-    },
-    {
-      "name": "apexd_host_tests"
-    },
-    {
-      "name": "conscrypt_e2e_tests"
-    },
-    {
       "name": "sdkextensions_e2e_tests"
     },
     {
       "name": "timezone_data_e2e_tests"
-    },
-    {
-      "name": "ipsec_e2e_tests"
     }
   ],
   "postsubmit": [
@@ -36,29 +24,6 @@
     {
       "name": "media_swcodec_e2e_tests",
       "keywords": ["primary-device"]
-    },
-    // The following changes are in post-submit to restrict to physical
-    // devices (currently userspace reboot fails on cuttlefish).
-    // TODO(b/147726967): Remove when Userspace reboot works on cuttlefish
-    {
-      "name": "adbd_e2e_tests",
-      "keywords": ["primary-device"]
-    },
-    {
-      "name": "conscrypt_e2e_tests",
-      "keywords": ["primary-device"]
-    },
-    {
-      "name": "sdkextensions_e2e_tests",
-      "keywords": ["primary-device"]
-    },
-    {
-      "name": "timezone_data_e2e_tests",
-      "keywords": ["primary-device"]
-    },
-    {
-      "name": "ipsec_e2e_tests",
-      "keywords": ["primary-device"]
     }
   ],
   "imports": [
diff --git a/tests/media-e2e-tests.xml b/tests/media-e2e-tests.xml
index 106d314..255b179 100644
--- a/tests/media-e2e-tests.xml
+++ b/tests/media-e2e-tests.xml
@@ -16,7 +16,6 @@
 <configuration description="Config for media module e2e test cases">
     <option name="test-suite-tag" value="media_e2e_tests" />
     <option name="test-suite-tag" value="apct" />
-
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer"/>
     <test class="com.android.tradefed.testtype.HostTest" >
         <option name="jar" value="media_e2e_tests.jar" />
diff --git a/tests/testdata/trigger_watchdog.rc b/tests/testdata/trigger_watchdog.rc
index 0ab35be..8295a7e 100644
--- a/tests/testdata/trigger_watchdog.rc
+++ b/tests/testdata/trigger_watchdog.rc
@@ -37,4 +37,4 @@
 
 service rebooting_service /system/bin/false
     reboot_on_failure reboot,apex-revert-test
-    disabled
\ No newline at end of file
+    disabled
diff --git a/tests/testdata/trigger_watchdog.sh b/tests/testdata/trigger_watchdog.sh
index 78ae0fe..9e03c7d 100644
--- a/tests/testdata/trigger_watchdog.sh
+++ b/tests/testdata/trigger_watchdog.sh
@@ -11,7 +11,12 @@
     /system/bin/setprop debug.trigger_watchdog.status kill
     while :
     do
-        /system/bin/pkill system_server
+        pid=`pidof system_server`
+        if [ ! -z "$pid" ]
+        then
+            /system/bin/log -t TriggerWatchdog "Killing system_server pid=$pid ..."
+            kill $pid
+        fi
         sleep 1
     done
 fi