diff --git a/widevine/Android.bp b/widevine/Android.bp
index a875333..12fa020 100644
--- a/widevine/Android.bp
+++ b/widevine/Android.bp
@@ -15,26 +15,234 @@ sh_binary {
     owner: "widevine",
 }
 
+prebuilt_apex {
+    name: "com.google.android.widevine",
+    src: "com.google.android.widevine.apex",
+    installable:true,
+    vendor:true,
+    apex_name:"com.google.android.widevine",
+}
+
+soong_config_module_type {
+    name: "widevine_apex_defaults",
+    module_type: "apex_defaults",
+    config_namespace: "ANDROID",
+    bool_variables: ["TARGET_ENABLE_MEDIADRM_64"],
+    properties: ["compile_multilib"],
+}
+
+widevine_apex_defaults {
+    name: "com.google.android.widevine-defaults",
+    compile_multilib: "prefer32",
+    soong_config_variables: {
+        TARGET_ENABLE_MEDIADRM_64: {
+            compile_multilib: "first",
+        },
+    },
+    prebuilts: [
+        "com.google.android.widevine.xml",  // etc/vintf
+    ],
+    // TODO(b/274041915) remove updatable:false
+    updatable: false,
+    // TODO(b/268439003) We need an API to get apex version. Until then
+    // we'll read apex_manifest.pb to get the version. To label apex_manifest.pb
+    // as vendor_configs_file (which the apex can access), turn off force-label.
+    use_file_contexts_as_is: true,
+    // min_sdk_version: "34",
+    min_sdk_version: "UpsideDownCake",
+    vendor: true,
+}
+
+soong_config_module_type {
+    name: "widevine_key_apex_defaults",
+    module_type: "apex_defaults",
+    config_namespace: "widevine",
+    bool_variables: ["use_devkey"],
+    properties: ["key", "certificate"],
+}
+
+widevine_key_apex_defaults {
+    name: "com.google.android.widevine-key-defaults",
+    key: "com.google.android.widevine.key",
+    certificate: ":com.google.android.widevine.certificate",
+    soong_config_variables: {
+        use_devkey: {
+            key: "com_google_android_widevine-image.key",
+            certificate: ":com_google_android_widevine-container",
+        },
+    },
+}
+
 cc_prebuilt_binary {
     name: "android.hardware.drm-service.widevine",
+    owner: "widevine",
+    proprietary: true,
+    min_sdk_version: "UpsideDownCake",
+    relative_install_path: "hw",
     srcs: ["android.hardware.drm-service.widevine"],
     vendor: true,
-    relative_install_path: "hw",
-    init_rc: ["android.hardware.drm-service.widevine.rc"],
-    vintf_fragments: ["manifest_android.hardware.drm-service.widevine.xml"],
     required: [
         "libwvaidl",
     ],
-    check_elf_files: false,
+    shared_libs:[
+        "liblog",
+        "libbinder_ndk",
+    ],
 }
 
 cc_prebuilt_library_shared {
-    name: "libwvaidl",
-    srcs: ["libwvaidl.so"],
+    name: "libcrypto",
+    srcs: ["libcrypto.so"],
+    vendor:true,
+}
+
+// cc_prebuilt_library_shared {
+//     name: "liblog",
+//     srcs: ["liblog.so"],
+//     vendor:true,
+// }
+
+apex {
+    name: "com.google.android.widevine",
+    manifest: "apex_manifest.json",
+    prebuilts: [
+        "com.google.android.widevine.rc",
+        "com.google.android.widevine.xml",  // etc/vintf
+    ],
+    defaults: [
+        "com.google.android.widevine-defaults",
+        "com.google.android.widevine-key-defaults",
+    ],
+    binaries: ["android.hardware.drm-service.widevine"],
+    file_contexts: "file_contexts",
+    native_shared_libs: [
+        "libcrypto",
+        // "liblog",
+    ],
+    
+    // min_sdk_version: "34",
+    // install sysconfig to allow the apex to be updatable
+    required: [
+        "allowlist_com.google.android.widevine.xml",
+    ],
+    // installable: false,
+    // apex_available: [
+    //     "//apex_available:platform",
+    // ],
+
+}
+
+apex_key {
+    name: "com.google.android.widevine.key",
+    public_key: "com.google.android.widevine.avbpubkey",
+    private_key: "com.google.android.widevine.pem",
+}
+
+android_app_certificate {
+    name: "com.google.android.widevine.certificate",
+    certificate: "com.google.android.widevine",
+}
+
+prebuilt_etc {
+    name: "com.google.android.widevine.rc",
+    src: "com.google.android.widevine.rc",
+    vendor:true,
+}
+
+prebuilt_etc {
+    name: "com.google.android.widevine.xml",
+    src: "com.google.android.widevine.xml",
+    sub_dir: "vintf",
+    installable: false,
+    vendor:true,
+}
+
+prebuilt_etc {
+    name: "allowlist_com.google.android.widevine.xml",
+    src: "allowlist_com.google.android.widevine.xml",
     vendor: true,
-    check_elf_files: false,
+    sub_dir: "sysconfig",
 }
 
+// cc_prebuilt_binary {
+//     name: "android.hardware.drm-service.widevine",
+//     srcs: ["android.hardware.drm-service.widevine"],
+// }
+
+// apex {
+//     name: "com.google.android.widevine",
+//     manifest: "apex_manifest.json",
+//     prebuilts: [
+//         "com.google.android.widevine.rc",
+//         "com.google.android.widevine.xml",  // etc/vintf
+//     ],
+//     defaults: [
+//         "com.google.android.widevine-defaults",
+//         "com.google.android.widevine-key-defaults",
+//     ],
+//     binaries: ["android.hardware.drm-service.widevine"],
+//     file_contexts: "file_contexts",
+    
+//     native_shared_libs: ["ibcrypto"],
+//     // install sysconfig to allow the apex to be updatable
+//     required: [
+//         "allowlist_com.google.android.widevine.xml",
+//     ],
+//     key: "com.google.android.widevine.key",
+// }
+
+
+
+// apex_key {
+//     name: "com.google.android.widevine.key",
+//     public_key: "com.google.android.widevine.avbpubkey",
+//     private_key: "com.google.android.widevine.pem",
+// }
+
+// android_app_certificate {
+//     name: "com.google.android.widevine.certificate",
+//     certificate: "com.google.android.widevine",
+// }
+
+// prebuilt_etc {
+//     name: "com.google.android.widevine.rc",
+//     src: "com.google.android.widevine.rc",
+// }
+
+// prebuilt_etc {
+//     name: "com.google.android.widevine.xml",
+//     src: "com.google.android.widevine.xml",
+//     sub_dir: "vintf",
+//     installable: false,
+// }
+
+// prebuilt_etc {
+//     name: "allowlist_com.google.android.widevine.xml",
+//     src: "allowlist_com.google.android.widevine.xml",
+//     vendor: true,
+//     sub_dir: "sysconfig",
+// }
+
+//cc_prebuilt_binary {
+//    name: "android.hardware.drm-service.widevine",
+//    srcs: ["android.hardware.drm-service.widevine"],
+//    vendor: true,
+//    relative_install_path: "hw",
+//    init_rc: ["android.hardware.drm-service.widevine.rc"],
+//    vintf_fragments: ["manifest_android.hardware.drm-service.widevine.xml"],
+//    required: [
+//        "libwvaidl",
+//    ],
+//    check_elf_files: false,
+//}
+
+// cc_prebuilt_library_shared {
+//     name: "libwvaidl",
+//     srcs: ["libwvaidl.so"],
+//     vendor: true,
+//     check_elf_files: false,
+// }
+
 //cc_prebuilt_library_shared {
     //name: "libwvdrmengine",
     //srcs: ["libwvdrmengine.so"],
diff --git a/widevine/allowlist_com.google.android.widevine.xml b/widevine/allowlist_com.google.android.widevine.xml
new file mode 100644
index 0000000..91581b9
--- /dev/null
+++ b/widevine/allowlist_com.google.android.widevine.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+ This XML file declares the vendor apex package names eligible for installation.
+-->
+
+<config>
+<allowed-vendor-apex package="com.google.android.widevine" installerPackage="com.android.vending" />
+</config>
diff --git a/widevine/android.hardware.drm-service.widevine b/widevine/android.hardware.drm-service.widevine
old mode 100755
new mode 100644
index 8f5a57f..cd2f147
Binary files a/widevine/android.hardware.drm-service.widevine and b/widevine/android.hardware.drm-service.widevine differ
diff --git a/widevine/android.hardware.drm-service.widevine.rc b/widevine/android.hardware.drm-service.widevine.rc
deleted file mode 100644
index 2e21c0b..0000000
--- a/widevine/android.hardware.drm-service.widevine.rc
+++ /dev/null
@@ -1,10 +0,0 @@
-on property:init.svc.mediadrm=running
-    mkdir /data/vendor/mediadrm 0770 media mediadrm
-
-service vendor.drm-widevine-hal /vendor/bin/hw/android.hardware.drm-service.widevine
-    interface aidl android.hardware.drm::IDrmFactory/widevine
-    class hal
-    user media
-    group media mediadrm drmrpc system
-    ioprio rt 4
-    task_profiles ProcessCapacityHigh
diff --git a/widevine/apex_manifest.json b/widevine/apex_manifest.json
new file mode 100644
index 0000000..84f6795
--- /dev/null
+++ b/widevine/apex_manifest.json
@@ -0,0 +1,7 @@
+{
+    "name": "com.google.android.widevine",
+    "version": 1,
+    "requireNativeLibs": [
+        "liboemcrypto.so"
+    ]
+}
\ No newline at end of file
diff --git a/widevine/com.google.android.widevine.apex b/widevine/com.google.android.widevine.apex
new file mode 100644
index 0000000..aacb263
Binary files /dev/null and b/widevine/com.google.android.widevine.apex differ
diff --git a/widevine/com.google.android.widevine.avbpubkey b/widevine/com.google.android.widevine.avbpubkey
new file mode 100644
index 0000000..e748b67
Binary files /dev/null and b/widevine/com.google.android.widevine.avbpubkey differ
diff --git a/widevine/com.google.android.widevine.pem b/widevine/com.google.android.widevine.pem
new file mode 100644
index 0000000..bb1b4de
--- /dev/null
+++ b/widevine/com.google.android.widevine.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDOOLpUo4QRrwlQ
+VpaIOK8plveqKbSW++kkCvX4DV1w712W6LR9tfX8JMcKlI1KY3j7cH2Yn0R8AYhW
+wRGfB33SQqkoWOQuYKngcTSXpWZsrYgwo8DbShhcbtQIKRs65oK0OLUmzGWKfoKS
+u4dp768WsssZrrKU1qZRXqhEybmKrrgxmJT7/vtrLFdrXzuqTiRBBemTlIgACnca
+TtHvXUipOkN+Fhn83XmW8hSuWciI80srtiyoTM7fUB4WMgq5kP16x5yViu/wbFWt
+v5L0if35fREClFVCLnqqPjROF2YbjB7kucvg6zNNadrP0po7psEKcUX90MW5nojD
+DrYMUkKHidCBDFh1RdmdQslUlCcifbdBFgc2uAwu95J20MxoyggsA1m/JEVN/O7a
+G7pNq5nSLRO9mAli8MBIAAOgtl5R8E28LEQL6vKAHRuLmaSiB7ztaCdzlBwq9fCd
+BI8fe5hH+wVh7RrToRcdZXjDakXa18vwUe8PHbM/ui4x4t1naEaGxPDFI9MzY+Kn
+YjMMQk6YDMt+jAPN1u78cb1Q+Mi6WXZViHou2qU9NI7ubrCXVnMgMmtK5hXTb2HF
+oKI2gP7+cOFK3323xyDaqzgZ65ZI2FlGZy5JkUoZfOCZEXxwme1eTwmzi6a/qHzg
+2zHQJghNTu0ZQsQaF9r3IVBAV3PgGwIDAQABAoICAAXdIBM7CQzVrM6ff61E61oj
+5Evu3qcyZ4kyVJcmjiMhc0hQup0eeO2gABbhbXkRhgWkR7X4xWI/Suiomb8rX90E
+Lzop+OcGsZ3jqiqrtdNeRdKYPWoe2715G0dWH+OXXV0RhbkiM7rx6PWSJoIRIinj
+kJnc2VAZIGaM6fz2vXNfj3Y9j/LwZ6a+/odbkF9B1I8Sw3cCULGrmoJhfl+vh9rk
+ALpLl5aUl5n+rS7d97FJNbh6+B8a/ADmjsxzxNFM+aAtn9qytirgcbk8ismwSMv4
+zeyEWj5FAxDnLuaPjMQ4wkIftFfjaDSJz4J8Sw1qKvAIk4RplM2338yoFO4ZwrF5
+3LIw/AskywUJxR+QjHQ5sy4/v1KK7nUIRr9+U5ytlxa2BuAziuw4VpTMIyphW8HF
+PIVdq3v9pzrAaBpXRzBt9blBTQOPAO4poEOKcz3idxFIf2UekTtsmeA8o464rQSv
+U2Y4pVkOLNehpIHPQx+u51tMDEL1ZtYwG6jItWmw+NYtSYSpyZVTdbDSPR6XMKM5
+nyapKd3VJ6FUNisI3DETjAbtLoY/2pCV5/NYZjCtlBpIdprautaLPA6kUwgwGS/R
+HoUS+56kPvcquoZmbIYVzq4992+CaXE11UgrBnmOIMbafrBZASZtEJ69BaDHHAuN
+ml9A6/UYl6AKgThZuTCFAoIBAQDiEVI1chhl1iHqnaWT5aEdi0awAY9Npc9RejNw
+l93uiVJi49PFRFzsYQWRZdZ4/NNs1kGHomcIKPsEzjMNla/5osf8cR7h19JGd1ZW
+xpb0saZJ9+t/YrXMU1A3vF7VDjxYEkQnX6jdQY0ICzOPrpTHARs3X0NlKyFODWPB
+Fcb96F7b3AxJeauHgETHrmBfKVYDs6sOqikTxHpHjE/L6/y7wJjIvq1nbzxiJy2Y
+P5WhdCcKW+roaAsIhYAjCzji2NcYffHiTQYAGxepL9krENXPLLVkf1Gdqy9cEf1J
+jNnFmKa96HirL1ewCvbFh6UNZitImHa5vO1AZXTbiDgOgOefAoIBAQDphrbRGQlx
+D2NVIE3aRNVcIdG+wdGxSS+sK2Pa3hBKUjrxFp4tU0Mt+tHDRwAW6cVCkeNYM6bs
+M4KbnXTjTT2XCHoxkqc/BpluLVrfb+P2aGJyX2QX+SHviCqXaYqyzSw3Tdi8GvWH
+VY5gBONXZ/SHesiMBrGY03ULpH6tmfZ/UFREENBNXkEs0Mv7CHA5P7boI87GkVmd
+ZI1QYeBoPwq4RydBWnWD2+SYW+eHlTHSAy6nxC/LcQZqwwLhKdgHDYGgvSo2T9yW
+psc9a8OcDvYdm0jeL45DB9pcXE/FGZ16X29Wq6hoVN2aeTjrO+IMXM3uKafr10wW
+e/J9qFGDmmYFAoIBADuolIhULsoZI2Q17C9GhykzyxjBoJ6+JiL7W73X5hKAHMTK
+GOXTL66VwBFpzZqqJeVv+WUg343QusW+4Mwx93mqkpo1BBBXkz9TWO6Xg9jZVOfq
+TDSWySE9z0qWJHSXSCd50pCNdxPEq8I2qom9abfGu/b15eQ56JUfhXa8F4KEIxxk
+Sr3NJQ4iNIR5qScT0oYxkO/SyfpUfGyLQ7et9Elb/zXi1AIa4dWJP0gRZ5xu+aqL
+LUfdxSOfj3wwBvgef00QV5f/+ZhnjevxG5941uPQiaIW02QHe/0RJkWVrRavPTma
+stWCLeLgUdU5Ab6yerOywIotqHK5E4invxtcu0MCggEBAOLqlkaEb5o++6TCKSRI
+8pH+AtO7fkko9nv0BamtUmMFmGSgN7+PQp4xNRbtrPaW3akcHa+dMTwfqXARBn3A
+lnJmOGZnPMCPZxOaWsz26qqLL+43Jwnseb9JrylF0xJ/L9HlgQ73m1GQHzLKTSan
+ywLCmpEGCBiakQdpJfcGvnFj2x3wwJgNWIN1uGAMCRB4CwFzmf91SYEZLf/Hu8lQ
+SNhbu5dTkRE54NzzoP0sSibqFLHMfyzOfQ/MwsWMZXAk/ar1ZUk1PQHeuYfDaWYB
+W8HVHG9aAoC75sEMqi65/z3j8kpjrtcCb/skg9yAadzdaPVd4N/YawUGF9Fmdx7M
+LwkCggEAA7Z1nof0SnAILuaiW4moO368G9wRjIexIZGiooDUQrek5oOLcb7n8EvO
+J1n2BDqILpeusEzCOIoEDBDBPX8i4NnFGj+bwfkoop47zaSMwcWHFciTkkaFnGH6
+AlXc/oDBL8/6YXPSpE5ihw7oNzsoap12niHgUYwC91QLfPdlyCvuiysWDWlGWK5d
+zqglATmt2Wvir+vF4OPnnxGS4DcqYGu6dOSpjF1Pl7QXxNBRKAQJnlLjxw66y1Wm
+jFxf8NXXs1tphpdUdQPuIfmB/g0WzpaGSKpTfL+Ex5+m9FPm+X4Luoe8RfH6lB6P
+NeDaCQSbZnEP9SYC+JZstmKE/Uwqyw==
+-----END PRIVATE KEY-----
diff --git a/widevine/com.google.android.widevine.rc b/widevine/com.google.android.widevine.rc
new file mode 100644
index 0000000..f190dc1
--- /dev/null
+++ b/widevine/com.google.android.widevine.rc
@@ -0,0 +1,10 @@
+on property:apex.all.ready=true
+    mkdir /data/vendor/mediadrm 0770 media mediadrm
+
+service vendor.drm-widevine-hal /apex/com.google.android.widevine/bin/hw/android.hardware.drm-service.widevine
+    interface aidl android.hardware.drm.IDrmFactory/widevine
+    class hal
+    user media
+    group media mediadrm drmrpc system
+    ioprio rt 4
+    task_profiles ProcessCapacityHigh
\ No newline at end of file
diff --git a/widevine/manifest_android.hardware.drm-service.widevine.xml b/widevine/com.google.android.widevine.xml
similarity index 92%
rename from widevine/manifest_android.hardware.drm-service.widevine.xml
rename to widevine/com.google.android.widevine.xml
index 914783f..cc21f32 100644
--- a/widevine/manifest_android.hardware.drm-service.widevine.xml
+++ b/widevine/com.google.android.widevine.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2021 The Android Open Source Project
+<!-- Copyright (C) 2022 The Android Open Source Project
 
      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.
@@ -19,4 +19,4 @@
         <version>1</version>
         <fqname>IDrmFactory/widevine</fqname>
     </hal>
-</manifest>
+</manifest>
\ No newline at end of file
diff --git a/widevine/file_contexts b/widevine/file_contexts
new file mode 100644
index 0000000..ea029e0
--- /dev/null
+++ b/widevine/file_contexts
@@ -0,0 +1,9 @@
+(/.*)?    u:object_r:vendor_file:s0
+/bin/hw/android\.hardware\.drm-service\.widevine    u:object_r:hal_drm_widevine_exec:s0
+/etc(/.*)?    u:object_r:vendor_configs_file:s0
+# TODO(b/268439003) Following two entries are typically handled by the build system.
+# We override it so that the Widevine APEX can access it to get the apex version.
+# When we have a proper API, we can delete these along with
+# use_file_contexts_as_is property in Android.bp
+/apex_manifest\.pb u:object_r:vendor_configs_file:s0
+/ u:object_r:system_file:s0
\ No newline at end of file
diff --git a/widevine/libcrypto.so b/widevine/libcrypto.so
new file mode 100755
index 0000000..a17193b
Binary files /dev/null and b/widevine/libcrypto.so differ