diff --git a/authsecret/1.0/IAuthSecret.hal b/authsecret/1.0/IAuthSecret.hal
index 6b573b3..9a0fd5f 100644
--- a/authsecret/1.0/IAuthSecret.hal
+++ b/authsecret/1.0/IAuthSecret.hal
@@ -42,5 +42,5 @@
      *
      * @param secret blob derived from the primary user's credential.
      */
-    primaryUserCredential(vec<uint8_t> secret);
+    oneway primaryUserCredential(vec<uint8_t> secret);
 };
diff --git a/automotive/evs/1.0/vts/functional/VtsHalEvsV1_0TargetTest.cpp b/automotive/evs/1.0/vts/functional/VtsHalEvsV1_0TargetTest.cpp
index 57050d7..d904ad0 100644
--- a/automotive/evs/1.0/vts/functional/VtsHalEvsV1_0TargetTest.cpp
+++ b/automotive/evs/1.0/vts/functional/VtsHalEvsV1_0TargetTest.cpp
@@ -54,7 +54,7 @@
 #include <android/hardware/automotive/evs/1.0/IEvsDisplay.h>
 
 #include <VtsHalHidlTargetTestBase.h>
-
+#include <VtsHalHidlTargetTestEnvBase.h>
 
 using namespace ::android::hardware::automotive::evs::V1_0;
 using ::android::hardware::Return;
@@ -64,13 +64,28 @@
 using ::android::hardware::hidl_string;
 using ::android::sp;
 
+// Test environment for Evs HIDL HAL.
+class EvsHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static EvsHidlEnvironment* Instance() {
+        static EvsHidlEnvironment* instance = new EvsHidlEnvironment;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<IEvsEnumerator>(); }
+
+   private:
+    EvsHidlEnvironment() {}
+};
 
 // The main test class for EVS
 class EvsHidlTest : public ::testing::VtsHalHidlTargetTestBase {
 public:
     virtual void SetUp() override {
         // Make sure we can connect to the enumerator
-        pEnumerator = IEvsEnumerator::getService(kEnumeratorName);
+        pEnumerator = getService<IEvsEnumerator>(
+            EvsHidlEnvironment::Instance()->getServiceName<IEvsEnumerator>(kEnumeratorName));
         ASSERT_NE(pEnumerator.get(), nullptr);
     }
 
@@ -480,3 +495,12 @@
     // Explicitly release the display
     pEnumerator->closeDisplay(pDisplay);
 }
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(EvsHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    EvsHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
+}
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
index 7938b73..096500e 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
@@ -342,12 +342,6 @@
          },
      .initialValue = {.int32Values = {toInt(VehicleGear::GEAR_PARK)}}},
 
-    {.config = {.prop = toInt(VehicleProperty::DISPLAY_BRIGHTNESS),
-                .access = VehiclePropertyAccess::READ_WRITE,
-                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-                .areaConfigs = {VehicleAreaConfig{.minInt32Value = 0, .maxInt32Value = 10}}},
-     .initialValue = {.int32Values = {7}}},
-
     {.config =
          {
              .prop = toInt(VehicleProperty::IGNITION_STATE),
@@ -420,6 +414,23 @@
             },
     },
 
+    {.config = {.prop = toInt(VehicleProperty::AP_POWER_STATE),
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .configArray = {3}},
+     .initialValue = {.int32Values = {toInt(VehicleApPowerState::ON_FULL), 0}}},
+
+    {.config = {.prop = toInt(VehicleProperty::DISPLAY_BRIGHTNESS),
+                .access = VehiclePropertyAccess::READ_WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .areaConfigs = {VehicleAreaConfig{.minInt32Value = 0, .maxInt32Value = 100}}},
+     .initialValue = {.int32Values = {100}}},
+
+    {.config = {.prop = toInt(VehicleProperty::AP_POWER_BOOTUP_REASON),
+                .access = VehiclePropertyAccess::READ,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE},
+     .initialValue = {.int32Values = {toInt(VehicleApPowerBootupReason::USER_POWER_ON)}}},
+
     {
         .config = {.prop = OBD2_LIVE_FRAME,
                    .access = VehiclePropertyAccess::READ,
diff --git a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
index a2f812b..5346f80 100644
--- a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
+++ b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
@@ -526,15 +526,14 @@
         return Status::INTERNAL_ERROR;
     }
 
-    // TODO: reduce object copy in this path
-    HalRequest halReq = {
-            .frameNumber = request.frameNumber,
-            .setting = mLatestReqSetting,
-            .frameIn = frameIn,
-            .shutterTs = shutterTs};
-    halReq.buffers.resize(numOutputBufs);
+    std::shared_ptr<HalRequest> halReq = std::make_shared<HalRequest>();
+    halReq->frameNumber = request.frameNumber;
+    halReq->setting = mLatestReqSetting;
+    halReq->frameIn = frameIn;
+    halReq->shutterTs = shutterTs;
+    halReq->buffers.resize(numOutputBufs);
     for (size_t i = 0; i < numOutputBufs; i++) {
-        HalStreamBuffer& halBuf = halReq.buffers[i];
+        HalStreamBuffer& halBuf = halReq->buffers[i];
         int streamId = halBuf.streamId = request.outputBuffers[i].streamId;
         halBuf.bufferId = request.outputBuffers[i].bufferId;
         const Stream& stream = mStreamMap[streamId];
@@ -546,7 +545,7 @@
         halBuf.acquireFence = allFences[i];
         halBuf.fenceTimeout = false;
     }
-    mInflightFrames.insert(halReq.frameNumber);
+    mInflightFrames.insert(halReq->frameNumber);
     // Send request to OutputThread for the rest of processing
     mOutputThread->submitRequest(halReq);
     mFirstRequest = false;
@@ -572,30 +571,31 @@
 }
 
 //TODO: refactor with processCaptureResult
-Status ExternalCameraDeviceSession::processCaptureRequestError(const HalRequest& req) {
+Status ExternalCameraDeviceSession::processCaptureRequestError(
+        const std::shared_ptr<HalRequest>& req) {
     // Return V4L2 buffer to V4L2 buffer queue
-    enqueueV4l2Frame(req.frameIn);
+    enqueueV4l2Frame(req->frameIn);
 
     // NotifyShutter
-    notifyShutter(req.frameNumber, req.shutterTs);
+    notifyShutter(req->frameNumber, req->shutterTs);
 
-    notifyError(/*frameNum*/req.frameNumber, /*stream*/-1, ErrorCode::ERROR_REQUEST);
+    notifyError(/*frameNum*/req->frameNumber, /*stream*/-1, ErrorCode::ERROR_REQUEST);
 
     // Fill output buffers
     hidl_vec<CaptureResult> results;
     results.resize(1);
     CaptureResult& result = results[0];
-    result.frameNumber = req.frameNumber;
+    result.frameNumber = req->frameNumber;
     result.partialResult = 1;
     result.inputBuffer.streamId = -1;
-    result.outputBuffers.resize(req.buffers.size());
-    for (size_t i = 0; i < req.buffers.size(); i++) {
-        result.outputBuffers[i].streamId = req.buffers[i].streamId;
-        result.outputBuffers[i].bufferId = req.buffers[i].bufferId;
+    result.outputBuffers.resize(req->buffers.size());
+    for (size_t i = 0; i < req->buffers.size(); i++) {
+        result.outputBuffers[i].streamId = req->buffers[i].streamId;
+        result.outputBuffers[i].bufferId = req->buffers[i].bufferId;
         result.outputBuffers[i].status = BufferStatus::ERROR;
-        if (req.buffers[i].acquireFence >= 0) {
+        if (req->buffers[i].acquireFence >= 0) {
             native_handle_t* handle = native_handle_create(/*numFds*/1, /*numInts*/0);
-            handle->data[0] = req.buffers[i].acquireFence;
+            handle->data[0] = req->buffers[i].acquireFence;
             result.outputBuffers[i].releaseFence.setTo(handle, /*shouldOwn*/false);
         }
     }
@@ -603,7 +603,7 @@
     // update inflight records
     {
         Mutex::Autolock _l(mLock);
-        mInflightFrames.erase(req.frameNumber);
+        mInflightFrames.erase(req->frameNumber);
     }
 
     // Callback into framework
@@ -612,51 +612,51 @@
     return Status::OK;
 }
 
-Status ExternalCameraDeviceSession::processCaptureResult(HalRequest& req) {
+Status ExternalCameraDeviceSession::processCaptureResult(std::shared_ptr<HalRequest>& req) {
     // Return V4L2 buffer to V4L2 buffer queue
-    enqueueV4l2Frame(req.frameIn);
+    enqueueV4l2Frame(req->frameIn);
 
     // NotifyShutter
-    notifyShutter(req.frameNumber, req.shutterTs);
+    notifyShutter(req->frameNumber, req->shutterTs);
 
     // Fill output buffers
     hidl_vec<CaptureResult> results;
     results.resize(1);
     CaptureResult& result = results[0];
-    result.frameNumber = req.frameNumber;
+    result.frameNumber = req->frameNumber;
     result.partialResult = 1;
     result.inputBuffer.streamId = -1;
-    result.outputBuffers.resize(req.buffers.size());
-    for (size_t i = 0; i < req.buffers.size(); i++) {
-        result.outputBuffers[i].streamId = req.buffers[i].streamId;
-        result.outputBuffers[i].bufferId = req.buffers[i].bufferId;
-        if (req.buffers[i].fenceTimeout) {
+    result.outputBuffers.resize(req->buffers.size());
+    for (size_t i = 0; i < req->buffers.size(); i++) {
+        result.outputBuffers[i].streamId = req->buffers[i].streamId;
+        result.outputBuffers[i].bufferId = req->buffers[i].bufferId;
+        if (req->buffers[i].fenceTimeout) {
             result.outputBuffers[i].status = BufferStatus::ERROR;
             native_handle_t* handle = native_handle_create(/*numFds*/1, /*numInts*/0);
-            handle->data[0] = req.buffers[i].acquireFence;
+            handle->data[0] = req->buffers[i].acquireFence;
             result.outputBuffers[i].releaseFence.setTo(handle, /*shouldOwn*/false);
-            notifyError(req.frameNumber, req.buffers[i].streamId, ErrorCode::ERROR_BUFFER);
+            notifyError(req->frameNumber, req->buffers[i].streamId, ErrorCode::ERROR_BUFFER);
         } else {
             result.outputBuffers[i].status = BufferStatus::OK;
             // TODO: refactor
-            if (req.buffers[i].acquireFence > 0) {
+            if (req->buffers[i].acquireFence > 0) {
                 native_handle_t* handle = native_handle_create(/*numFds*/1, /*numInts*/0);
-                handle->data[0] = req.buffers[i].acquireFence;
+                handle->data[0] = req->buffers[i].acquireFence;
                 result.outputBuffers[i].releaseFence.setTo(handle, /*shouldOwn*/false);
             }
         }
     }
 
     // Fill capture result metadata
-    fillCaptureResult(req.setting, req.shutterTs);
-    const camera_metadata_t *rawResult = req.setting.getAndLock();
+    fillCaptureResult(req->setting, req->shutterTs);
+    const camera_metadata_t *rawResult = req->setting.getAndLock();
     V3_2::implementation::convertToHidl(rawResult, &result.result);
-    req.setting.unlock(rawResult);
+    req->setting.unlock(rawResult);
 
     // update inflight records
     {
         Mutex::Autolock _l(mLock);
-        mInflightFrames.erase(req.frameNumber);
+        mInflightFrames.erase(req->frameNumber);
     }
 
     // Callback into framework
@@ -1387,7 +1387,7 @@
 
 int ExternalCameraDeviceSession::OutputThread::createJpegLocked(
         HalStreamBuffer &halBuf,
-        HalRequest &req)
+        const std::shared_ptr<HalRequest>& req)
 {
     int ret;
     auto lfail = [&](auto... args) {
@@ -1414,17 +1414,17 @@
     int jpegQuality, thumbQuality;
     Size thumbSize;
 
-    if (req.setting.exists(ANDROID_JPEG_QUALITY)) {
+    if (req->setting.exists(ANDROID_JPEG_QUALITY)) {
         camera_metadata_entry entry =
-            req.setting.find(ANDROID_JPEG_QUALITY);
+            req->setting.find(ANDROID_JPEG_QUALITY);
         jpegQuality = entry.data.u8[0];
     } else {
         return lfail("%s: ANDROID_JPEG_QUALITY not set",__FUNCTION__);
     }
 
-    if (req.setting.exists(ANDROID_JPEG_THUMBNAIL_QUALITY)) {
+    if (req->setting.exists(ANDROID_JPEG_THUMBNAIL_QUALITY)) {
         camera_metadata_entry entry =
-            req.setting.find(ANDROID_JPEG_THUMBNAIL_QUALITY);
+            req->setting.find(ANDROID_JPEG_THUMBNAIL_QUALITY);
         thumbQuality = entry.data.u8[0];
     } else {
         return lfail(
@@ -1432,9 +1432,9 @@
             __FUNCTION__);
     }
 
-    if (req.setting.exists(ANDROID_JPEG_THUMBNAIL_SIZE)) {
+    if (req->setting.exists(ANDROID_JPEG_THUMBNAIL_SIZE)) {
         camera_metadata_entry entry =
-            req.setting.find(ANDROID_JPEG_THUMBNAIL_SIZE);
+            req->setting.find(ANDROID_JPEG_THUMBNAIL_SIZE);
         thumbSize = Size { static_cast<uint32_t>(entry.data.i32[0]),
                            static_cast<uint32_t>(entry.data.i32[1])
         };
@@ -1494,7 +1494,7 @@
     /* Combine camera characteristics with request settings to form EXIF
      * metadata */
     common::V1_0::helper::CameraMetadata meta(parent->mCameraCharacteristics);
-    meta.append(req.setting);
+    meta.append(req->setting);
 
     /* Generate EXIF object */
     std::unique_ptr<ExifUtils> utils(ExifUtils::create());
@@ -1558,7 +1558,7 @@
 }
 
 bool ExternalCameraDeviceSession::OutputThread::threadLoop() {
-    HalRequest req;
+    std::shared_ptr<HalRequest> req;
     auto parent = mParent.promote();
     if (parent == nullptr) {
        ALOGE("%s: session has been disconnected!", __FUNCTION__);
@@ -1569,7 +1569,7 @@
     //       regularly to prevent v4l buffer queue filled with stale buffers
     //       when app doesn't program a preveiw request
     waitForNextRequest(&req);
-    if (req.frameIn == nullptr) {
+    if (req == nullptr) {
         // No new request, wait again
         return true;
     }
@@ -1577,17 +1577,17 @@
     auto onDeviceError = [&](auto... args) {
         ALOGE(args...);
         parent->notifyError(
-                req.frameNumber, /*stream*/-1, ErrorCode::ERROR_DEVICE);
+                req->frameNumber, /*stream*/-1, ErrorCode::ERROR_DEVICE);
         signalRequestDone();
         return false;
     };
 
-    if (req.frameIn->mFourcc != V4L2_PIX_FMT_MJPEG) {
+    if (req->frameIn->mFourcc != V4L2_PIX_FMT_MJPEG) {
         return onDeviceError("%s: do not support V4L2 format %c%c%c%c", __FUNCTION__,
-                req.frameIn->mFourcc & 0xFF,
-                (req.frameIn->mFourcc >> 8) & 0xFF,
-                (req.frameIn->mFourcc >> 16) & 0xFF,
-                (req.frameIn->mFourcc >> 24) & 0xFF);
+                req->frameIn->mFourcc & 0xFF,
+                (req->frameIn->mFourcc >> 8) & 0xFF,
+                (req->frameIn->mFourcc >> 16) & 0xFF,
+                (req->frameIn->mFourcc >> 24) & 0xFF);
     }
 
     std::unique_lock<std::mutex> lk(mBufferLock);
@@ -1595,7 +1595,7 @@
     // TODO: see if we can save some computation by converting to YV12 here
     uint8_t* inData;
     size_t inDataSize;
-    req.frameIn->map(&inData, &inDataSize);
+    req->frameIn->map(&inData, &inDataSize);
     // TODO: profile
     // TODO: in some special case maybe we can decode jpg directly to gralloc output?
     int res = libyuv::MJPGToI420(
@@ -1623,7 +1623,7 @@
 
     ALOGV("%s processing new request", __FUNCTION__);
     const int kSyncWaitTimeoutMs = 500;
-    for (auto& halBuf : req.buffers) {
+    for (auto& halBuf : req->buffers) {
         if (halBuf.acquireFence != -1) {
             int ret = sync_wait(halBuf.acquireFence, kSyncWaitTimeoutMs);
             if (ret) {
@@ -1780,9 +1780,9 @@
     return Status::OK;
 }
 
-Status ExternalCameraDeviceSession::OutputThread::submitRequest(const HalRequest& req) {
+Status ExternalCameraDeviceSession::OutputThread::submitRequest(
+        const std::shared_ptr<HalRequest>& req) {
     std::unique_lock<std::mutex> lk(mRequestListLock);
-    // TODO: reduce object copy in this path
     mRequestList.push_back(req);
     lk.unlock();
     mRequestCond.notify_one();
@@ -1797,7 +1797,7 @@
     }
 
     std::unique_lock<std::mutex> lk(mRequestListLock);
-    std::list<HalRequest> reqs = mRequestList;
+    std::list<std::shared_ptr<HalRequest>> reqs = std::move(mRequestList);
     mRequestList.clear();
     if (mProcessingRequest) {
         std::chrono::seconds timeout = std::chrono::seconds(kFlushWaitTimeoutSec);
@@ -1813,7 +1813,8 @@
     }
 }
 
-void ExternalCameraDeviceSession::OutputThread::waitForNextRequest(HalRequest* out) {
+void ExternalCameraDeviceSession::OutputThread::waitForNextRequest(
+        std::shared_ptr<HalRequest>* out) {
     if (out == nullptr) {
         ALOGE("%s: out is null", __FUNCTION__);
         return;
@@ -1838,7 +1839,7 @@
     *out = mRequestList.front();
     mRequestList.pop_front();
     mProcessingRequest = true;
-    mProcessingFrameNumer = out->frameNumber;
+    mProcessingFrameNumer = (*out)->frameNumber;
 }
 
 void ExternalCameraDeviceSession::OutputThread::signalRequestDone() {
@@ -1858,7 +1859,7 @@
     }
     dprintf(fd, "OutputThread request list contains frame: ");
     for (const auto& req : mRequestList) {
-        dprintf(fd, "%d, ", req.frameNumber);
+        dprintf(fd, "%d, ", req->frameNumber);
     }
     dprintf(fd, "\n");
 }
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
index 4b218e0..9c0ad7f 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
@@ -199,8 +199,8 @@
 
     Status processOneCaptureRequest(const CaptureRequest& request);
 
-    Status processCaptureResult(HalRequest&);
-    Status processCaptureRequestError(const HalRequest&);
+    Status processCaptureResult(std::shared_ptr<HalRequest>&);
+    Status processCaptureRequestError(const std::shared_ptr<HalRequest>&);
     void notifyShutter(uint32_t frameNumber, nsecs_t shutterTs);
     void notifyError(uint32_t frameNumber, int32_t streamId, ErrorCode ec);
     void invokeProcessCaptureResultCallback(
@@ -220,7 +220,7 @@
         Status allocateIntermediateBuffers(
                 const Size& v4lSize, const Size& thumbSize,
                 const hidl_vec<Stream>& streams);
-        Status submitRequest(const HalRequest&);
+        Status submitRequest(const std::shared_ptr<HalRequest>&);
         void flush();
         void dump(int fd);
         virtual bool threadLoop() override;
@@ -238,7 +238,7 @@
         static const int kReqWaitTimeoutMs = 33;   // 33ms
         static const int kReqWaitTimesMax = 90;    // 33ms * 90 ~= 3 sec
 
-        void waitForNextRequest(HalRequest* out);
+        void waitForNextRequest(std::shared_ptr<HalRequest>* out);
         void signalRequestDone();
 
         int cropAndScaleLocked(
@@ -258,15 +258,16 @@
                 void *out, size_t maxOutSize,
                 size_t &actualCodeSize);
 
-        int createJpegLocked(HalStreamBuffer &halBuf, HalRequest &req);
+        int createJpegLocked(HalStreamBuffer &halBuf, const std::shared_ptr<HalRequest>& req);
 
         const wp<ExternalCameraDeviceSession> mParent;
         const CroppingType mCroppingType;
 
-        mutable std::mutex mRequestListLock;      // Protect acccess to mRequestList
+        mutable std::mutex mRequestListLock;      // Protect acccess to mRequestList,
+                                                  // mProcessingRequest and mProcessingFrameNumer
         std::condition_variable mRequestCond;     // signaled when a new request is submitted
         std::condition_variable mRequestDoneCond; // signaled when a request is done processing
-        std::list<HalRequest> mRequestList;
+        std::list<std::shared_ptr<HalRequest>> mRequestList;
         bool mProcessingRequest = false;
         uint32_t mProcessingFrameNumer = 0;
 
diff --git a/confirmationui/1.0/vts/OWNERS b/confirmationui/1.0/vts/OWNERS
new file mode 100644
index 0000000..e7aa8b4
--- /dev/null
+++ b/confirmationui/1.0/vts/OWNERS
@@ -0,0 +1,3 @@
+jdanis@google.com
+swillden@google.com
+yim@google.com
diff --git a/confirmationui/1.0/vts/functional/Android.bp b/confirmationui/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..823e035
--- /dev/null
+++ b/confirmationui/1.0/vts/functional/Android.bp
@@ -0,0 +1,30 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalConfirmationUIV1_0TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: [
+        "VtsHalConfirmationUIV1_0TargetTest.cpp",
+    ],
+    static_libs: [
+        "android.hardware.confirmationui@1.0",
+        "android.hardware.keymaster@4.0",
+        "libcrypto",
+        "libcn-cbor",
+        "android.hardware.confirmationui-support-lib",
+    ],
+}
diff --git a/confirmationui/1.0/vts/functional/VtsHalConfirmationUIV1_0TargetTest.cpp b/confirmationui/1.0/vts/functional/VtsHalConfirmationUIV1_0TargetTest.cpp
new file mode 100644
index 0000000..463bb40
--- /dev/null
+++ b/confirmationui/1.0/vts/functional/VtsHalConfirmationUIV1_0TargetTest.cpp
@@ -0,0 +1,428 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "ConfirmationIOHidlHalTest"
+#include <cutils/log.h>
+
+#include <algorithm>
+#include <iostream>
+#include <memory>
+
+#include <android/hardware/confirmationui/1.0/IConfirmationResultCallback.h>
+#include <android/hardware/confirmationui/1.0/IConfirmationUI.h>
+#include <android/hardware/confirmationui/1.0/types.h>
+#include <android/hardware/confirmationui/support/confirmationui_utils.h>
+
+#include <VtsHalHidlTargetCallbackBase.h>
+#include <VtsHalHidlTargetTestBase.h>
+
+#include <openssl/hmac.h>
+#include <openssl/sha.h>
+
+#include <cn-cbor/cn-cbor.h>
+
+using ::android::sp;
+
+using ::std::string;
+
+namespace android {
+namespace hardware {
+
+namespace confirmationui {
+namespace V1_0 {
+
+namespace test {
+namespace {
+class HMacImplementation {
+   public:
+    static support::NullOr<support::array<uint8_t, 32>> hmac256(
+        const uint8_t key[32], std::initializer_list<support::ByteBufferProxy> buffers) {
+        HMAC_CTX hmacCtx;
+        HMAC_CTX_init(&hmacCtx);
+        if (!HMAC_Init_ex(&hmacCtx, key, 32, EVP_sha256(), nullptr)) {
+            return {};
+        }
+        for (auto& buffer : buffers) {
+            if (!HMAC_Update(&hmacCtx, buffer.data(), buffer.size())) {
+                return {};
+            }
+        }
+        support::array<uint8_t, 32> result;
+        if (!HMAC_Final(&hmacCtx, result.data(), nullptr)) {
+            return {};
+        }
+        return result;
+    }
+};
+
+using HMacer = support::HMac<HMacImplementation>;
+
+constexpr uint8_t testKeyByte = static_cast<uint8_t>(TestKeyBits::BYTE);
+
+template <typename... Data>
+hidl_vec<uint8_t> testHMAC(const Data&... data) {
+    constexpr uint8_t testKey[32] = {testKeyByte, testKeyByte, testKeyByte, testKeyByte,
+                                     testKeyByte, testKeyByte, testKeyByte, testKeyByte,
+                                     testKeyByte, testKeyByte, testKeyByte, testKeyByte,
+                                     testKeyByte, testKeyByte, testKeyByte, testKeyByte};
+    constexpr uint8_t hmac_size_bytes = sizeof testKey;
+
+    auto hmac = HMacer::hmac256(testKey, data...);
+    if (!hmac.isOk()) {
+        EXPECT_TRUE(false) << "Failed to compute test hmac.  This is a self-test error.";
+        return {};
+    }
+    hidl_vec<uint8_t> result(hmac_size_bytes);
+    copy(hmac.value().data(), hmac.value().data() + hmac_size_bytes, result.data());
+    return result;
+}
+
+using ::android::hardware::keymaster::V4_0::HardwareAuthToken;
+using ::android::hardware::keymaster::V4_0::HardwareAuthenticatorType;
+
+template <typename T>
+auto toBytes(const T& v) -> const uint8_t (&)[sizeof(T)] {
+    return *reinterpret_cast<const uint8_t(*)[sizeof(T)]>(&v);
+}
+
+HardwareAuthToken makeTestToken(const TestModeCommands command, uint64_t timestamp = 0) {
+    HardwareAuthToken auth_token;
+    auth_token.challenge = static_cast<uint64_t>(command);
+    auth_token.userId = 0;
+    auth_token.authenticatorId = 0;
+    auth_token.authenticatorType = HardwareAuthenticatorType::NONE;
+    auth_token.timestamp = timestamp;
+
+    // Canonical form  of auth-token v0
+    // version (1 byte)
+    // challenge (8 bytes)
+    // user_id (8 bytes)
+    // authenticator_id (8 bytes)
+    // authenticator_type (4 bytes)
+    // timestamp (8 bytes)
+    // total 37 bytes
+    auth_token.mac = testHMAC("\0",
+                              toBytes(auth_token.challenge),                         //
+                              toBytes(auth_token.userId),                            //
+                              toBytes(auth_token.authenticatorId),                   //
+                              toBytes(support::hton(auth_token.authenticatorType)),  //
+                              toBytes(support::hton(auth_token.timestamp)));         //
+
+    return auth_token;
+}
+
+#define DEBUG_CONFRIMATIONUI_UTILS_TEST
+
+#ifdef DEBUG_CONFRIMATIONUI_UTILS_TEST
+std::ostream& hexdump(std::ostream& out, const uint8_t* data, size_t size) {
+    for (size_t i = 0; i < size; ++i) {
+        uint8_t byte = data[i];
+        out << std::hex << std::setw(2) << std::setfill('0') << (unsigned)byte;
+        switch (i & 0xf) {
+            case 0xf:
+                out << "\n";
+                break;
+            case 7:
+                out << "  ";
+                break;
+            default:
+                out << " ";
+                break;
+        }
+    }
+    return out;
+}
+#endif
+
+constexpr char hex_value[256] = {0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 1,  2,  3,  4,  5,  6,  7, 8, 9, 0, 0, 0, 0, 0, 0,  // '0'..'9'
+                                 0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0,  // 'A'..'F'
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0,  // 'a'..'f'
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0,  //
+                                 0, 0,  0,  0,  0,  0,  0,  0, 0, 0, 0, 0, 0, 0, 0, 0};
+
+std::string hex2str(std::string a) {
+    std::string b;
+    size_t num = a.size() / 2;
+    b.resize(num);
+    for (size_t i = 0; i < num; i++) {
+        b[i] = (hex_value[a[i * 2] & 0xFF] << 4) + (hex_value[a[i * 2 + 1] & 0xFF]);
+    }
+    return b;
+}
+
+}  // namespace
+
+class ConfirmationArgs {
+   public:
+    ResponseCode error_;
+    hidl_vec<uint8_t> formattedMessage_;
+    hidl_vec<uint8_t> confirmationToken_;
+    bool verifyConfirmationToken() {
+        static constexpr char confirmationPrefix[] = "confirmation token";
+        EXPECT_EQ(32U, confirmationToken_.size());
+        return 32U == confirmationToken_.size() &&
+               !memcmp(confirmationToken_.data(),
+                       testHMAC(confirmationPrefix, formattedMessage_).data(), 32);
+    }
+};
+
+class ConfirmationTestCallback : public ::testing::VtsHalHidlTargetCallbackBase<ConfirmationArgs>,
+                                 public IConfirmationResultCallback {
+   public:
+    Return<void> result(ResponseCode error, const hidl_vec<uint8_t>& formattedMessage,
+                        const hidl_vec<uint8_t>& confirmationToken) override {
+        ConfirmationArgs args;
+        args.error_ = error;
+        args.formattedMessage_ = formattedMessage;
+        args.confirmationToken_ = confirmationToken;
+        NotifyFromCallback(args);
+        return Void();
+    }
+};
+
+class ConfirmationUIHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static ConfirmationUIHidlEnvironment* Instance() {
+        static ConfirmationUIHidlEnvironment* instance = new ConfirmationUIHidlEnvironment;
+        return instance;
+    }
+
+    void registerTestServices() override { registerTestService<IConfirmationUI>(); }
+
+   private:
+    ConfirmationUIHidlEnvironment(){};
+
+    GTEST_DISALLOW_COPY_AND_ASSIGN_(ConfirmationUIHidlEnvironment);
+};
+
+class ConfirmationUIHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    void TearDown() override { confirmator().abort(); }
+
+    static void SetUpTestCase() {
+        string service_name =
+            ConfirmationUIHidlEnvironment::Instance()->getServiceName<IConfirmationUI>();
+        confirmator_ = IConfirmationUI::getService(service_name);
+        ASSERT_NE(nullptr, confirmator_.get());
+    }
+
+    static void TearDownTestCase() { confirmator_.clear(); }
+
+    static IConfirmationUI& confirmator() { return *confirmator_; }
+
+   private:
+    static sp<IConfirmationUI> confirmator_;
+};
+
+sp<IConfirmationUI> ConfirmationUIHidlTest::confirmator_;
+
+#define ASSERT_HAL_CALL(expected, call)                               \
+    {                                                                 \
+        auto result = call;                                           \
+        ASSERT_TRUE(result.isOk());                                   \
+        ASSERT_EQ(expected, static_cast<decltype(expected)>(result)); \
+    }
+
+struct CnCborDeleter {
+    void operator()(cn_cbor* ptr) { cn_cbor_free(ptr); }
+};
+
+typedef std::unique_ptr<cn_cbor, CnCborDeleter> CnCborPtr;
+
+// Simulates the User taping Ok
+TEST_F(ConfirmationUIHidlTest, UserOkTest) {
+    static constexpr char test_prompt[] = "Me first, gimme gimme!";
+    static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + 3);
+    ASSERT_HAL_CALL(ResponseCode::OK,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+
+    ASSERT_HAL_CALL(ResponseCode::OK, confirmator().deliverSecureInputEvent(
+                                          makeTestToken(TestModeCommands::OK_EVENT)));
+
+    auto result = conf_cb->WaitForCallback();
+    ASSERT_EQ(ResponseCode::OK, result.args->error_);
+
+    ASSERT_TRUE(result.args->verifyConfirmationToken());
+
+    cn_cbor_errback cn_cbor_error;
+    auto parsed_message =
+        CnCborPtr(cn_cbor_decode(result.args->formattedMessage_.data(),
+                                 result.args->formattedMessage_.size(), &cn_cbor_error));
+    // is parsable CBOR
+    ASSERT_TRUE(parsed_message.get());
+    // is a map
+    ASSERT_EQ(CN_CBOR_MAP, parsed_message->type);
+
+    // the message must have exactly 2 key value pairs.
+    // cn_cbor holds 2*<no_of_pairs> in the length field
+    ASSERT_EQ(4, parsed_message->length);
+    // map has key "prompt"
+    auto prompt = cn_cbor_mapget_string(parsed_message.get(), "prompt");
+    ASSERT_TRUE(prompt);
+    ASSERT_EQ(CN_CBOR_TEXT, prompt->type);
+    ASSERT_EQ(22, prompt->length);
+    ASSERT_EQ(0, memcmp(test_prompt, prompt->v.str, 22));
+    // map has key "extra"
+    auto extra_out = cn_cbor_mapget_string(parsed_message.get(), "extra");
+    ASSERT_TRUE(extra_out);
+    ASSERT_EQ(CN_CBOR_BYTES, extra_out->type);
+    ASSERT_EQ(3, extra_out->length);
+    ASSERT_EQ(0, memcmp(test_extra, extra_out->v.bytes, 3));
+}
+
+// Initiates a confirmation prompt with a message that is too long
+TEST_F(ConfirmationUIHidlTest, MessageTooLongTest) {
+    static constexpr uint8_t test_extra[static_cast<uint32_t>(MessageSize::MAX)] = {};
+    static constexpr char test_prompt[] = "D\'oh!";
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + sizeof(test_extra));
+    ASSERT_HAL_CALL(ResponseCode::UIErrorMessageTooLong,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+}
+
+// If the message gets very long some HAL implementations might fail even before the message
+// reaches the trusted app implementation. But the HAL must still diagnose the correct error.
+TEST_F(ConfirmationUIHidlTest, MessageWayTooLongTest) {
+    static constexpr uint8_t test_extra[static_cast<uint32_t>(MessageSize::MAX) * 10] = {};
+    static constexpr char test_prompt[] = "D\'oh!";
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + sizeof(test_extra));
+    ASSERT_HAL_CALL(ResponseCode::UIErrorMessageTooLong,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+}
+
+// Simulates the User tapping the Cancel
+TEST_F(ConfirmationUIHidlTest, UserCancelTest) {
+    static constexpr char test_prompt[] = "Me first, gimme gimme!";
+    static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + 3);
+    ASSERT_HAL_CALL(ResponseCode::OK,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+
+    ASSERT_HAL_CALL(ResponseCode::OK, confirmator().deliverSecureInputEvent(
+                                          makeTestToken(TestModeCommands::CANCEL_EVENT)));
+
+    auto result = conf_cb->WaitForCallback();
+    ASSERT_EQ(ResponseCode::Canceled, result.args->error_);
+
+    ASSERT_EQ(0U, result.args->confirmationToken_.size());
+    ASSERT_EQ(0U, result.args->formattedMessage_.size());
+}
+
+// Simulates the framework candelling an ongoing prompt
+TEST_F(ConfirmationUIHidlTest, AbortTest) {
+    static constexpr char test_prompt[] = "Me first, gimme gimme!";
+    static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + 3);
+    ASSERT_HAL_CALL(ResponseCode::OK,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+
+    confirmator().abort();
+
+    auto result = conf_cb->WaitForCallback();
+    ASSERT_EQ(ResponseCode::Aborted, result.args->error_);
+    ASSERT_EQ(0U, result.args->confirmationToken_.size());
+    ASSERT_EQ(0U, result.args->formattedMessage_.size());
+}
+
+// Passing malformed UTF-8 to the confirmation UI
+// This test passes a string that ends in the middle of a multibyte character
+TEST_F(ConfirmationUIHidlTest, MalformedUTF8Test1) {
+    static constexpr char test_prompt[] = {char(0xc0), 0};
+    static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + 3);
+    ASSERT_HAL_CALL(ResponseCode::UIErrorMalformedUTF8Encoding,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+}
+
+// Passing malformed UTF-8 to the confirmation UI
+// This test passes a string with a 5-byte character.
+TEST_F(ConfirmationUIHidlTest, MalformedUTF8Test2) {
+    static constexpr char test_prompt[] = {char(0xf8), char(0x82), char(0x82),
+                                           char(0x82), char(0x82), 0};
+    static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + 3);
+    ASSERT_HAL_CALL(ResponseCode::UIErrorMalformedUTF8Encoding,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+}
+
+// Passing malformed UTF-8 to the confirmation UI
+// This test passes a string with a 2-byte character followed by a stray non UTF-8 character.
+TEST_F(ConfirmationUIHidlTest, MalformedUTF8Test3) {
+    static constexpr char test_prompt[] = {char(0xc0), char(0x82), char(0x83), 0};
+    static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
+    sp<ConfirmationTestCallback> conf_cb = new ConfirmationTestCallback;
+    hidl_string prompt_text(test_prompt);
+    hidl_vec<uint8_t> extra(test_extra, test_extra + 3);
+    ASSERT_HAL_CALL(ResponseCode::UIErrorMalformedUTF8Encoding,
+                    confirmator().promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}));
+}
+
+// Test the implementation of HMAC SHA 256 against a golden blob.
+TEST(ConfirmationUITestSelfTest, HMAC256SelfTest) {
+    const char key_str[32] = "keykeykeykeykeykeykeykeykeykeyk";
+    const uint8_t(&key)[32] = *reinterpret_cast<const uint8_t(*)[32]>(key_str);
+    auto expected = hex2str("2377fbcaa7fb3f6c20cfa1d9ebc60e9922cf58c909e25e300f3cb57f7805c886");
+    auto result = HMacer::hmac256(key, "value1", "value2", "value3");
+
+#ifdef DEBUG_CONFRIMATIONUI_UTILS_TEST
+    hexdump(std::cout, reinterpret_cast<const uint8_t*>(expected.data()), 32) << std::endl;
+    hexdump(std::cout, result.value().data(), 32) << std::endl;
+#endif
+
+    support::ByteBufferProxy expected_bytes(expected);
+    ASSERT_TRUE(result.isOk());
+    ASSERT_EQ(expected, result.value());
+}
+
+}  // namespace test
+}  // namespace V1_0
+}  // namespace confirmationui
+}  // namespace hardware
+}  // namespace android
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    std::vector<std::string> positional_args;
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
+}
diff --git a/gnss/1.1/Android.bp b/gnss/1.1/Android.bp
index 417b4f5..4ae4439 100644
--- a/gnss/1.1/Android.bp
+++ b/gnss/1.1/Android.bp
@@ -11,6 +11,7 @@
         "IGnssCallback.hal",
         "IGnssConfiguration.hal",
         "IGnssMeasurement.hal",
+        "IGnssMeasurementCallback.hal",
     ],
     interfaces: [
         "android.hardware.gnss@1.0",
diff --git a/gnss/1.1/IGnssMeasurement.hal b/gnss/1.1/IGnssMeasurement.hal
index 75df5a8..cd83ae3 100644
--- a/gnss/1.1/IGnssMeasurement.hal
+++ b/gnss/1.1/IGnssMeasurement.hal
@@ -17,7 +17,7 @@
 package android.hardware.gnss@1.1;
 
 import @1.0::IGnssMeasurement;
-import @1.0::IGnssMeasurementCallback;
+import IGnssMeasurementCallback;
 
 /**
  * Extended interface for GNSS Measurements support.
diff --git a/gnss/1.1/IGnssMeasurementCallback.hal b/gnss/1.1/IGnssMeasurementCallback.hal
new file mode 100644
index 0000000..5a60a56
--- /dev/null
+++ b/gnss/1.1/IGnssMeasurementCallback.hal
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.gnss@1.1;
+
+import @1.0::IGnssMeasurementCallback;
+
+/** The callback interface to report measurements from the HAL. */
+interface IGnssMeasurementCallback extends @1.0::IGnssMeasurementCallback {
+    /**
+     * Flags indicating the Accumulated Delta Range's states.
+     */
+    enum GnssAccumulatedDeltaRangeState
+            : @1.0::IGnssMeasurementCallback.GnssAccumulatedDeltaRangeState {
+        ADR_STATE_HALF_CYCLE_RESOLVED = 1 << 3, // Carrier-phase half-cycle ambiguity resolved
+    };
+
+    /**
+     * Extends a GNSS Measurement, adding the new enum.
+     */
+    struct GnssMeasurement {
+        /**
+         * GNSS measurement information for a single satellite and frequency, as in the 1.0
+         * version of the HAL.
+         *
+         * In this version of the HAL, these fields of the
+         * @1.0::IGnssMeasurementCallback.GnssMeasurement v1_0 struct are deprecated, and
+         * are no longer used by the framework:
+         *   carrierCycles
+         *   carrierPhase
+         *   carrierPhaseUncertainty
+         *
+         * Similar information about carrier phase signal tracking is still reported in these
+         * fields of @1.0::IGnssMeasurementCallback.GnssMeasurement v1_0:
+         *   accumulatedDeltaRangeM
+         *   accumulatedDeltaRangeUncertaintyM
+         */
+        @1.0::IGnssMeasurementCallback.GnssMeasurement v1_0;
+
+        /**
+         * Provides the state of Accumulated Delta Range values, including additional information
+         * beyond version 1.0 of the HAL.  See GnssAccumulatedDeltaRangeState.
+         *
+         * In this (1.1) version of the HAL, this value is used by the framework, not the
+         * value provided by v1_0.accumulatedDeltaRangeState.
+         */
+        bitfield<GnssAccumulatedDeltaRangeState> accumulatedDeltaRangeState;
+    };
+
+    /**
+     * Complete set of GNSS Measurement data, same as 1.0 with additional enum in measurements.
+     */
+    struct GnssData {
+        /** The full set of satellite measurement observations. */
+        vec<GnssMeasurement> measurements;
+
+        /** The GNSS clock time reading. */
+        GnssClock clock;
+    };
+
+    /**
+     * Callback for the hal to pass a GnssData structure back to the client.
+     *
+     * @param data Contains a reading of GNSS measurements.
+     */
+    gnssMeasurementCb(GnssData data);
+};
diff --git a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
index 264a11d..a0a1c73 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
@@ -396,6 +396,10 @@
 
     ASSERT_TRUE(result.isOk());
     EXPECT_TRUE(result);
+
+    auto resultVoid = gnss_hal_->deleteAidingData(IGnss::GnssAidingData::DELETE_ALL);
+
+    ASSERT_TRUE(resultVoid.isOk());
 }
 
 /*