diff --git a/confirmationui/1.0/default/ConfirmationUI.cpp b/confirmationui/1.0/default/ConfirmationUI.cpp
index f241a76..41e03ce 100644
--- a/confirmationui/1.0/default/ConfirmationUI.cpp
+++ b/confirmationui/1.0/default/ConfirmationUI.cpp
@@ -43,7 +43,12 @@
     const hidl_vec<uint8_t>& extraData, const hidl_string& locale,
     const hidl_vec<UIOption>& uiOptions) {
     auto& operation = MyOperation::get();
-    return operation.init(resultCB, promptText, extraData, locale, uiOptions);
+    auto result = operation.init(resultCB, promptText, extraData, locale, uiOptions);
+    if (result == ResponseCode::OK) {
+        // This is where implementation start the UI and then call setPending on success.
+        operation.setPending();
+    }
+    return result;
 }
 
 Return<ResponseCode> ConfirmationUI::deliverSecureInputEvent(
diff --git a/confirmationui/1.0/default/PlatformSpecifics.h b/confirmationui/1.0/default/PlatformSpecifics.h
index 18b88c8..488da6d 100644
--- a/confirmationui/1.0/default/PlatformSpecifics.h
+++ b/confirmationui/1.0/default/PlatformSpecifics.h
@@ -52,8 +52,14 @@
         const uint8_t key[32], std::initializer_list<support::ByteBufferProxy> buffers);
 };
 
-using MyOperation = generic::Operation<sp<IConfirmationResultCallback>, MonotonicClockTimeStamper,
-                                       HMacImplementation>;
+class MyOperation : public generic::Operation<sp<IConfirmationResultCallback>,
+                                              MonotonicClockTimeStamper, HMacImplementation> {
+   public:
+    static MyOperation& get() {
+        static MyOperation op;
+        return op;
+    }
+};
 
 }  // namespace implementation
 }  // namespace V1_0
diff --git a/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc b/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc
index a278028..c04e55e 100644
--- a/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc
+++ b/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc
@@ -1,4 +1,4 @@
 service vendor.confirmationui-1-0 /vendor/bin/hw/android.hardware.confirmationui@1.0-service
     class hal
-    user system
-    group system drmrpc
+    user nobody
+    group drmrpc
diff --git a/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h b/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h
index a88cd40..b480942 100644
--- a/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h
+++ b/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h
@@ -55,10 +55,27 @@
         (void)uiOptions;
         resultCB_ = resultCB;
         if (error_ != ResponseCode::Ignored) return ResponseCode::OperationPending;
-        // TODO make copy of promptText before using it may reside in shared buffer
-        auto state = write(
-            WriteState(formattedMessageBuffer_),
-            map(pair(text("prompt"), text(promptText)), pair(text("extra"), bytes(extraData))));
+
+        // We need to access the prompt text multiple times. Once for formatting the CBOR message
+        // and again for rendering the dialog. It is vital that the prompt does not change
+        // in the meantime. As of this point the prompt text is in a shared buffer and therefore
+        // susceptible to TOCTOU attacks. Note that promptText.size() resides on the stack and
+        // is safe to access multiple times. So now we copy the prompt string into the
+        // scratchpad promptStringBuffer_ from where we can format the CBOR message and then
+        // pass it to the renderer.
+        if (promptText.size() >= uint32_t(MessageSize::MAX))
+            return ResponseCode::UIErrorMessageTooLong;
+        auto pos = std::copy(promptText.c_str(), promptText.c_str() + promptText.size(),
+                             promptStringBuffer_);
+        *pos = 0;  // null-terminate the prompt for the renderer.
+
+        // Note the extra data is accessed only once for formating the CBOR message. So it is safe
+        // to read it from the shared buffer directly. Anyway we don't trust or interpret the
+        // extra data in any way so all we do is take a snapshot and we don't care if it is
+        // modified concurrently.
+        auto state = write(WriteState(formattedMessageBuffer_),
+                           map(pair(text("prompt"), text(promptStringBuffer_, promptText.size())),
+                               pair(text("extra"), bytes(extraData))));
         switch (state.error_) {
             case Error::OK:
                 break;
@@ -71,20 +88,20 @@
                 return ResponseCode::Unexpected;
         }
         formattedMessageLength_ = state.data_ - formattedMessageBuffer_;
-        // setup TUI and diagnose more UI errors here.
+
         // on success record the start time
         startTime_ = TimeStamper::now();
         if (!startTime_.isOk()) {
             return ResponseCode::SystemError;
         }
-        error_ = ResponseCode::OK;
         return ResponseCode::OK;
     }
 
+    void setPending() { error_ = ResponseCode::OK; }
+
     void setHmacKey(const uint8_t (&key)[32]) { hmacKey_ = {key}; }
 
     void abort() {
-        // tear down TUI here
         if (isPending()) {
             resultCB_->result(ResponseCode::Aborted, {}, {});
             error_ = ResponseCode::Ignored;
@@ -92,7 +109,6 @@
     }
 
     void userCancel() {
-        // tear down TUI here
         if (isPending()) error_ = ResponseCode::Canceled;
     }
 
@@ -104,10 +120,10 @@
     }
 
     bool isPending() const { return error_ != ResponseCode::Ignored; }
-
-    static Operation& get() {
-        static Operation operation;
-        return operation;
+    const hidl_string getPrompt() const {
+        hidl_string s;
+        s.setToExternal(promptStringBuffer_, strlen(promptStringBuffer_));
+        return s;
     }
 
     ResponseCode deliverSecureInputEvent(const HardwareAuthToken& secureInputToken) {
@@ -156,7 +172,6 @@
         return result;
     }
     hidl_vec<uint8_t> userConfirm(const uint8_t key[32]) {
-        // tear down TUI here
         if (error_ != ResponseCode::OK) return {};
         confirmationTokenScratchpad_ = HMacer::hmac256(key, "confirmation token", getMessage());
         if (!confirmationTokenScratchpad_.isOk()) {
@@ -169,9 +184,10 @@
         return result;
     }
 
-    ResponseCode error_;
+    ResponseCode error_ = ResponseCode::Ignored;
     uint8_t formattedMessageBuffer_[uint32_t(MessageSize::MAX)];
-    size_t formattedMessageLength_;
+    char promptStringBuffer_[uint32_t(MessageSize::MAX)];
+    size_t formattedMessageLength_ = 0;
     NullOr<array<uint8_t, 32>> confirmationTokenScratchpad_;
     Callback resultCB_;
     typename TimeStamper::TimeStamp startTime_;
diff --git a/current.txt b/current.txt
index 24321cc..e351d22 100644
--- a/current.txt
+++ b/current.txt
@@ -258,3 +258,115 @@
 4e7169919d24fbe5573e5bcd683d0bd7abf553a4e6c34c41f9dfc1e12050db07 android.hardware.gnss@1.0::IGnssNavigationMessageCallback
 d4840db8efabdf1e4b344fc981cd36e5fe81a39aff6e199f6d06c1c8da413efd android.hardware.radio@1.0::types
 b280c4704dfcc548a9bf127b59b7c3578f460c50cce70a06b66fe0df8b27cff0 android.hardware.wifi@1.0::types
+
+# HALs released in Android P
+5860cf040a3d5d771967ecf648b00d06876a7120da985ee2b3e95d01f634dd20 android.hardware.audio@4.0::IDevice
+cf82a0249e918fdc657e189895e92d60af0491868477e82cdc30f6cab0ca2c65 android.hardware.audio@4.0::IDevicesFactory
+be3dc9baed45a0d330152eca3ca24fa419b375b20a41644c88d4fb46b72784d2 android.hardware.audio@4.0::IPrimaryDevice
+3e3acb70c4e6c7d578f511f4a44ee764ab9126f887a3bf65d523c42e40012bf6 android.hardware.audio@4.0::IStream
+d5de64e66b95f135dd42492250a309134b8227203ef3524440798c66b6f5a392 android.hardware.audio@4.0::IStreamIn
+888ac906461327fa0bd93854d5109be8c292a33afdb467164826970a8bd5b789 android.hardware.audio@4.0::IStreamOut
+15f6ae78e73344c8e7d68847ef03caec64fcd9f951bbcf59957d1712c247fcff android.hardware.audio@4.0::IStreamOutCallback
+e8abfc73b7f3c2095ea4fad83b5f42bced4315de2abcc3199376af880dac451b android.hardware.audio@4.0::types
+dac6018ece5af342708766287a2de2e7f3bd7e60f373dc2dddc4d4d1554e1b35 android.hardware.audio.common@4.0::types
+b04b6b364938b80008e61fa2e318bc299622433e57c2e1f6cfba332a3f6e3f15 android.hardware.audio.effect@4.0::IAcousticEchoCancelerEffect
+1c17d4ece5c8ba3f7a646a305ee0dd109b0d51372e1bd585812e513cd40e1852 android.hardware.audio.effect@4.0::IAutomaticGainControlEffect
+34174259fe6fbb1bb14e7103e097f2f25529271a676687845b2f55d6d0d9d617 android.hardware.audio.effect@4.0::IBassBoostEffect
+7a18e9bd0163f3784448f6e24be0db75f877e2f0f9bd0d7ec427f1c34b382c0b android.hardware.audio.effect@4.0::IDownmixEffect
+bac81bffbe2661d5b6839087d2dd3a27eded66e60c6c76d35c68d54014cd5c06 android.hardware.audio.effect@4.0::IEffect
+65f0bcf9e498b26f3266ad10cf513a6c2b5906cc49f9db4bc5c7d3ba11a72e05 android.hardware.audio.effect@4.0::IEffectBufferProviderCallback
+5a746e81175489eb2371b88864c36c9bb63bc64ef799fae74cd96003b013c0d1 android.hardware.audio.effect@4.0::IEffectsFactory
+839980c7c5be79da6b95fdb9354a62b04407b4b084749b7a21d2c340773d7638 android.hardware.audio.effect@4.0::IEnvironmentalReverbEffect
+2805fbdac7cff050a1c095b9276bb41ac02a3b7b354336817487eb9a4b6bb462 android.hardware.audio.effect@4.0::IEqualizerEffect
+a91b547f5922f39fe4231d97fac1c3825c1c1b0c8ef7a5136689ceed37e8bfe9 android.hardware.audio.effect@4.0::ILoudnessEnhancerEffect
+1145f5b921ddec184fda5bdc87487b46f2a89cd9f42cc882bbb3a54f4ac80466 android.hardware.audio.effect@4.0::INoiseSuppressionEffect
+3661fa0623056922fdc4235ac5a9c91a2d066ab6f1ab4297e3b240fe302ba500 android.hardware.audio.effect@4.0::IPresetReverbEffect
+e88e520f8c98a62fccd8d5316c6687808f775de145d1405a7a9a66587ee6a001 android.hardware.audio.effect@4.0::IVirtualizerEffect
+fe28829dab10d171783b79ac9cc45412739f8ff275e90228d7c6370ef189b859 android.hardware.audio.effect@4.0::IVisualizerEffect
+5d92f6fd58d40c56611bb12f03be6af9bcf2bb73dfb35b77a99bbf2c3ea5439b android.hardware.audio.effect@4.0::types
+42a06dc288f61b0690580f3d37b30b663c31d74d50bb58d0772386b550d5faab android.hardware.authsecret@1.0::IAuthSecret
+a0f93c768c353cecee6237fe479bce47404eb10b629fafe07e32a054fd67f2af android.hardware.automotive.audiocontrol@1.0::IAudioControl
+ca515ff4b63c80cf5ad7b3395c997c57d6c56157361f6c367d1c96f23cc4860a android.hardware.automotive.audiocontrol@1.0::types
+f2904a4c108ad1b93eb2fa4e43b82bd01ce1ff26156316e49d1d9fc80dfecaad android.hardware.automotive.evs@1.0::IEvsCamera
+94cba6ad04c83aa840de2ed52b74ba2126a26dd960225e61ac36703315279a80 android.hardware.automotive.evs@1.0::IEvsCameraStream
+5ea36fb043d9e3b413219de3dfd7b046b48af4fda39f167f3528652e986cb76d android.hardware.automotive.evs@1.0::IEvsDisplay
+14ef8e993a4a7c899b19bb5e39b5b0cafd28312ea2b127e35b3be8f08e23fe8e android.hardware.automotive.evs@1.0::IEvsEnumerator
+3b17c1fdfc389e0abe626c37054954b07201127d890c2bc05d47613ec1f4de4f android.hardware.automotive.evs@1.0::types
+b3caf524c46a47d67e6453a34419e1881942d059e146cda740502670e9a752c3 android.hardware.automotive.vehicle@2.0::IVehicle
+80fb4156fa91ce86e49bd2cabe215078f6b69591d416a09e914532eae6712052 android.hardware.automotive.vehicle@2.0::IVehicleCallback
+442de3a3d3819ff8b8bfe9ec710592ca8af7c16bfdb5eb8911b898b8f12b2bb0 android.hardware.automotive.vehicle@2.0::types
+32cc50cc2a7658ec613c0c2dd2accbf6a05113b749852879e818b8b7b438db19 android.hardware.bluetooth.a2dp@1.0::IBluetoothAudioHost
+ff4be64d7992f8bec97dff37f35450e79b3430c61f85f54322ce45bef229dc3b android.hardware.bluetooth.a2dp@1.0::IBluetoothAudioOffload
+27f22d2e873e6201f9620cf4d8e2facb25bd0dd30a2b911e441b4600d560fa62 android.hardware.bluetooth.a2dp@1.0::types
+3d8ed67d807e9f15d0708390a416bee00920f6a22196c104cc9e443c8d217df8 android.hardware.broadcastradio@2.0::IAnnouncementListener
+44017c42e6f4d8cb30f07eb1da04540a98736a336ac28c7e0ed2e69e1589f8d1 android.hardware.broadcastradio@2.0::IBroadcastRadio
+e5f4960290b4f3089163dd43251e1a032c81e9bdb796e75a87fc7c5810c262b3 android.hardware.broadcastradio@2.0::ICloseHandle
+7357516e8f4585e211b9b6f271af6fb82d6e9cc208df01851e63118404621e6d android.hardware.broadcastradio@2.0::ITunerCallback
+eacf4e7491fc52c4db90898faddf25ec7bc72501b07ae8737434c47cb845128c android.hardware.broadcastradio@2.0::ITunerSession
+34fe4601072aa5051eb8e41d776a9f6d43f716687de3f5c0031a12e7912ff3d6 android.hardware.broadcastradio@2.0::types
+4fb0725c36ed4f77a42b42e3f18d8b5f7919cb62b90098b23143a555aa7dd96d android.hardware.camera.device@3.4::ICameraDeviceCallback
+812fa66aa10ba0cba27cfddc2fd7f0ee27a8ab65a1f15aa79fdad97d403e6a14 android.hardware.camera.device@3.4::ICameraDeviceSession
+cc288f1f78d1e643eb3d3dbc16e1401d44033d8e6856761f5156814a29986ec7 android.hardware.camera.device@3.4::types
+6e853354199fb5773357210c7ca0f183631d48e83ea88a9be3921b51c1c0afc6 android.hardware.camera.metadata@3.3::types
+1a46aeae45b7a0e47f79b7207300532986f9d9cd7060779afc7a529f54d712ab android.hardware.confirmationui@1.0::IConfirmationResultCallback
+6d8347ff3cd7de471065ac3e8e68385073630cdeebe9f8fa58cb91cf44436c95 android.hardware.confirmationui@1.0::IConfirmationUI
+a3ff916784dce87a56c757ab5c86433f0cdf562280999a5f978a6e8a0f3f19e7 android.hardware.confirmationui@1.0::types
+1fbf2d7e383632216aaaa1d972a21a618f55659263d2e6f0b309e3cb323b4b63 android.hardware.drm@1.1::ICryptoFactory
+7877ff8e4c1e48b825e6e5e66d050288e5656ed535c61cc7830a92ed4a9e1990 android.hardware.drm@1.1::IDrmFactory
+fef2f0ebde7704548fb203df46673ceb342272fc4fa9d0af25a980d2584a36e7 android.hardware.drm@1.1::IDrmPlugin
+5047a346ecce239404b9020959f60dd467318e9c17b290a6386bc3894df62c3c android.hardware.drm@1.1::types
+be794f5df97f134d6dcabb866b250d1305100e7ae07fb253b7841df890b931bb android.hardware.gnss@1.1::IGnss
+3b912f07e276de598155615491b35f151f59cb2d7a100c831f04a23f4d625311 android.hardware.gnss@1.1::IGnssCallback
+3c5183d7506010be57e0f748e3640fc2ded1ba955784b6256ba427f4c399591c android.hardware.gnss@1.1::IGnssConfiguration
+b054af24fbb70d54cde1fb5cba126809e7c4e863e8f9115dc492321dfbcbc993 android.hardware.gnss@1.1::IGnssMeasurement
+83e7a10ff3702147bd7ffa04567b20d407a3b16bbb7705644af44d919afe9103 android.hardware.gnss@1.1::IGnssMeasurementCallback
+82da7e7624f72ff1927f48738913e20bee3a513adfe5dc7c4f888176e20376e6 android.hardware.graphics.common@1.1::types
+d9b40a5b09962a5a0780b10fe33a4e607e69e2e088fc83de88a584115b7cb1c0 android.hardware.graphics.composer@2.2::IComposer
+d6ce042995239712bc1d0970fa9d512c15c0b1ac9bcb048bd8b69f617b45c25e android.hardware.graphics.composer@2.2::IComposerClient
+dd83be076b6b3f10ed62ab34d8c8b95f2415961fb785200eb842e7bfb2b0ee92 android.hardware.graphics.mapper@2.1::IMapper
+675682dd3007805c985eaaec91612abc88f4c25b3431fb84070b7584a1a741fb android.hardware.health@2.0::IHealth
+434c4c32c00b0e54bb05e40c79503208b40f786a318029a2a4f66e34f10f2a76 android.hardware.health@2.0::IHealthInfoCallback
+c9e498f1ade5e26f00d290b4763a9671ec6720f915e7d592844b62e8cb1f9b5c android.hardware.health@2.0::types
+a6cf986593c6ad15fe2ae3a1995d2cae233500bc32c055912a42723bdc076868 android.hardware.keymaster@4.0::IKeymasterDevice
+3ce01f7a38013f15d2ffc9c66a81eb85061ab6585fb1e659fe6da36bdcbfa9cf android.hardware.keymaster@4.0::types
+6d5c646a83538f0f9d8438c259932509f4353410c6c76e56db0d6ca98b69c3bb android.hardware.media.bufferpool@1.0::IAccessor
+b8c7ed58aa8740361e63d0ce9e7c94227572a629f356958840b34809d2393a7c android.hardware.media.bufferpool@1.0::IClientManager
+4a2c0dc82780e6c90731725a103feab8ab6ecf85a64e049b9cbd2b2c61620fe1 android.hardware.media.bufferpool@1.0::IConnection
+6aef1218e5949f867b0104752ac536c1b707222a403341720de90141df129e3e android.hardware.media.bufferpool@1.0::types
+1529409ed76ae87facab152b770495e9e62544fcc5215daabf146c28d588bab9 android.hardware.neuralnetworks@1.1::IDevice
+e808a6f61cd7b47887c599d8843e67a2dcbf4ec5aadd5d22fdce93020070ef1b android.hardware.neuralnetworks@1.1::types
+8d3d86da0bfa4bf070970d8303c659f67f35d670c287d45a3f542e4fedadd578 android.hardware.nfc@1.1::INfc
+e85f566698d2a2c28100e264fcf2c691a066756ddf8dd341d009ff50cfe10614 android.hardware.nfc@1.1::INfcClientCallback
+2b8f6165b3d350485eb89eb6e931cf876688cde9155f7b31a8d8fe7abdfe5b95 android.hardware.nfc@1.1::types
+163e115e833fc1d77cdd4a8cf0c833bb8b8d74fe35c880fe693101d17774926f android.hardware.power@1.2::IPower
+7899b9305587b2d5cd74a3cc87e9090f58bf4ae74256ce3ee36e7ec011822840 android.hardware.power@1.2::types
+ab132c990a62f0aca35871c092c22fb9c85d478e22124ef6a4d0a2302da76a9f android.hardware.radio@1.2::IRadio
+cda752aeabaabc20486a82ac57a3dd107785c006094a349bc5e224e8aa22a17c android.hardware.radio@1.2::IRadioIndication
+c38b7e1f808565a535ff19fd4c1b512b22dfa0b58ec91dce03f72a8f1eaf6957 android.hardware.radio@1.2::IRadioResponse
+b65332996eb39ba63300a1011404141fa59ce5c252bc17afae637be6eeca5f55 android.hardware.radio@1.2::ISap
+508ace7d4023b865b8b77c3ca3c86cc9525ef3803dc9c6b461b7c1f91b0fec00 android.hardware.radio@1.2::types
+87385469cf4409f0f33b01508e7a477cf71f2a11e466dd7e3ab5971a1baaa72b android.hardware.radio.config@1.0::IRadioConfig
+228b2ee3c8c276c9f0afad2dc313ca3d6bbd9e482ddf313c7204c60ad9b636ab android.hardware.radio.config@1.0::IRadioConfigIndication
+a2e9b7aa09f79426f765838174e04b6f9a3e6c8b76b923fc1705632207bad44b android.hardware.radio.config@1.0::IRadioConfigResponse
+4307696b64ded9bd8de06887f9dfc533e875c4e0d83b8008df4d705164bde0b1 android.hardware.radio.config@1.0::types
+bd7699f07ba5392310fefd33ea964e01f4f4a66015146845c85055004823cc81 android.hardware.secure_element@1.0::ISecureElement
+a65aa82bbe48d81a9ae9e86247bb1b89fd2d3138d4053d7a5b716c71149b7dee android.hardware.secure_element@1.0::ISecureElementHalCallback
+2984c069f48ba35cd1bf49b0e17daad0d418fef52cb7a4a84dba0043114063d4 android.hardware.secure_element@1.0::types
+b4f507b4dc9b5cd5f0e4445926acb7d94525ae60dc307b3951142283632207b6 android.hardware.soundtrigger@2.1::ISoundTriggerHw
+92c2cc0f06ef744c5bda21f1d660258f7937203109b493eee22c3f3e2dbb0d3e android.hardware.soundtrigger@2.1::ISoundTriggerHwCallback
+8ddfa7542772cc7bca19972b2d856264efa31914bfd098aeb7c2079d950194cb android.hardware.usb.gadget@1.0::IUsbGadget
+ad0a620cda08f01b151c30cb7afa23b0637cc84340cf8dec00ac8e32cf54a8db android.hardware.usb.gadget@1.0::IUsbGadgetCallback
+51fc20f223561ac3a32ace3217837ef3860265bd91c8b7ae3859532caef9bc39 android.hardware.usb.gadget@1.0::types
+1bfc9fd9536ed09f04bcaf222a332bc919f1565d4d08bddccdebe1bfca8f01b5 android.hardware.vibrator@1.2::IVibrator
+a0aefa29881235c21e4761d15c55edc35ef85c2e0d9e01d0966176d1dbf5f811 android.hardware.vibrator@1.2::types
+8bc75a0dfac15c6f87ffec950b76c7d7de30d516b54e8e0b1f3c0ff9c7c6873b android.hardware.wifi@1.2::IWifi
+780c16fdeda13b779d993953a67f7ca578c938a172a9424c1c715ae81bc40fd7 android.hardware.wifi@1.2::IWifiChip
+167af870fdb87e1cbbaa0fa62ef35e1031caad20dd1ba695983dedb1e9993486 android.hardware.wifi@1.2::IWifiChipEventCallback
+8c7ef32fc78d5ec6e6956de3784cc2c6f42614b5272d2e461f6d60534ba38ec2 android.hardware.wifi@1.2::IWifiNanIface
+1e6074efad9da333803fb7c1acdb719d51c30b2e1e92087b0420341631c30b60 android.hardware.wifi@1.2::IWifiNanIfaceEventCallback
+a9d733eb0d555f2a6cb79a212810e81b56ecba0e31a8ffe0916de086a29e4f88 android.hardware.wifi@1.2::IWifiStaIface
+6db2e7d274be2dca9bf3087afd1f774a68c99d2b4dc7eeaf41690e5cebcbef7a android.hardware.wifi@1.2::types
+ee08280de21cb41e3ec26d6ed636c701b7f70516e71fb22f4fe60a13e603f406 android.hardware.wifi.hostapd@1.0::IHostapd
+b2479cd7a417a1cf4f3a22db4e4579e21bac38fdcaf381e2bf10176d05397e01 android.hardware.wifi.hostapd@1.0::types
+e362203b941f18bd4cba29a62adfa02453ed00d6be5b72cdb6c4d7e0bf394a40 android.hardware.wifi.supplicant@1.1::ISupplicant
+10ff2fae516346b86121368ce5790d5accdfcb73983246b813f3d488b66db45a android.hardware.wifi.supplicant@1.1::ISupplicantStaNetwork
diff --git a/gnss/1.1/default/Android.bp b/gnss/1.1/default/Android.bp
index 977a22f..44aed2b 100644
--- a/gnss/1.1/default/Android.bp
+++ b/gnss/1.1/default/Android.bp
@@ -5,6 +5,7 @@
     vendor: true,
     srcs: [
         "Gnss.cpp",
+        "GnssDebug.cpp",
         "GnssConfiguration.cpp",
         "GnssMeasurement.cpp",
         "service.cpp",
diff --git a/gnss/1.1/default/Gnss.cpp b/gnss/1.1/default/Gnss.cpp
index 98a79ee..bbc4940 100644
--- a/gnss/1.1/default/Gnss.cpp
+++ b/gnss/1.1/default/Gnss.cpp
@@ -1,9 +1,11 @@
 #define LOG_TAG "Gnss"
 
+#include <android/hardware/gnss/1.0/types.h>
 #include <log/log.h>
 
 #include "Gnss.h"
-#include "GnssConfiguration.h"
+#include "GnssConstants.h"
+#include "GnssDebug.h"
 #include "GnssMeasurement.h"
 
 namespace android {
@@ -12,10 +14,12 @@
 namespace V1_1 {
 namespace implementation {
 
+using GnssSvFlags = IGnssCallback::GnssSvFlags;
+
 const uint32_t MIN_INTERVAL_MILLIS = 100;
 sp<::android::hardware::gnss::V1_1::IGnssCallback> Gnss::sGnssCallback = nullptr;
 
-Gnss::Gnss() : mMinIntervalMs(1000) {}
+Gnss::Gnss() : mMinIntervalMs(1000), mGnssConfiguration{new GnssConfiguration()} {}
 
 Gnss::~Gnss() {
     stop();
@@ -36,7 +40,10 @@
     mIsActive = true;
     mThread = std::thread([this]() {
         while (mIsActive == true) {
-            V1_0::GnssLocation location = this->getMockLocation();
+            auto svStatus = this->getMockSvStatus();
+            this->reportSvStatus(svStatus);
+
+            auto location = this->getMockLocation();
             this->reportLocation(location);
 
             std::this_thread::sleep_for(std::chrono::milliseconds(mMinIntervalMs));
@@ -70,7 +77,6 @@
 }
 
 Return<void> Gnss::deleteAidingData(::android::hardware::gnss::V1_0::IGnss::GnssAidingData) {
-    // TODO implement
     return Void();
 }
 
@@ -124,8 +130,7 @@
 }
 
 Return<sp<::android::hardware::gnss::V1_0::IGnssDebug>> Gnss::getExtensionGnssDebug() {
-    // TODO implement
-    return ::android::sp<::android::hardware::gnss::V1_0::IGnssDebug>{};
+    return new GnssDebug();
 }
 
 Return<sp<::android::hardware::gnss::V1_0::IGnssBatching>> Gnss::getExtensionGnssBatching() {
@@ -175,8 +180,7 @@
 
 Return<sp<::android::hardware::gnss::V1_1::IGnssConfiguration>>
 Gnss::getExtensionGnssConfiguration_1_1() {
-    // TODO implement
-    return new GnssConfiguration();
+    return mGnssConfiguration;
 }
 
 Return<sp<::android::hardware::gnss::V1_1::IGnssMeasurement>>
@@ -185,27 +189,66 @@
     return new GnssMeasurement();
 }
 
-Return<bool> Gnss::injectBestLocation(const ::android::hardware::gnss::V1_0::GnssLocation&) {
-    // TODO implement
-    return bool{};
+Return<bool> Gnss::injectBestLocation(const GnssLocation&) {
+    return true;
 }
 
-Return<V1_0::GnssLocation> Gnss::getMockLocation() {
-    V1_0::GnssLocation location = {.gnssLocationFlags = 0xFF,
-                                   .latitudeDegrees = 37.4219999,
-                                   .longitudeDegrees = -122.0840575,
-                                   .altitudeMeters = 1.60062531,
-                                   .speedMetersPerSec = 0,
-                                   .bearingDegrees = 0,
-                                   .horizontalAccuracyMeters = 5,
-                                   .verticalAccuracyMeters = 5,
-                                   .speedAccuracyMetersPerSecond = 1,
-                                   .bearingAccuracyDegrees = 90,
-                                   .timestamp = 1519930775453L};
+Return<GnssLocation> Gnss::getMockLocation() const {
+    GnssLocation location = {.gnssLocationFlags = 0xFF,
+                             .latitudeDegrees = kMockLatitudeDegrees,
+                             .longitudeDegrees = kMockLongitudeDegrees,
+                             .altitudeMeters = kMockAltitudeMeters,
+                             .speedMetersPerSec = kMockSpeedMetersPerSec,
+                             .bearingDegrees = kMockBearingDegrees,
+                             .horizontalAccuracyMeters = kMockHorizontalAccuracyMeters,
+                             .verticalAccuracyMeters = kMockVerticalAccuracyMeters,
+                             .speedAccuracyMetersPerSecond = kMockSpeedAccuracyMetersPerSecond,
+                             .bearingAccuracyDegrees = kMockBearingAccuracyDegrees,
+                             .timestamp = kMockTimestamp};
     return location;
 }
 
-Return<void> Gnss::reportLocation(const V1_0::GnssLocation& location) {
+Return<GnssSvInfo> Gnss::getSvInfo(int16_t svid, GnssConstellationType type, float cN0DbHz,
+                                   float elevationDegrees, float azimuthDegrees) const {
+    GnssSvInfo svInfo = {.svid = svid,
+                         .constellation = type,
+                         .cN0Dbhz = cN0DbHz,
+                         .elevationDegrees = elevationDegrees,
+                         .azimuthDegrees = azimuthDegrees,
+                         .svFlag = GnssSvFlags::USED_IN_FIX | GnssSvFlags::HAS_EPHEMERIS_DATA |
+                                   GnssSvFlags::HAS_ALMANAC_DATA};
+    return svInfo;
+}
+
+Return<GnssSvStatus> Gnss::getMockSvStatus() const {
+    std::unique_lock<std::recursive_mutex> lock(mGnssConfiguration->getMutex());
+    GnssSvInfo mockGnssSvInfoList[] = {
+        getSvInfo(3, GnssConstellationType::GPS, 32.5, 59.1, 166.5),
+        getSvInfo(5, GnssConstellationType::GPS, 27.0, 29.0, 56.5),
+        getSvInfo(17, GnssConstellationType::GPS, 30.5, 71.0, 77.0),
+        getSvInfo(26, GnssConstellationType::GPS, 24.1, 28.0, 253.0),
+        getSvInfo(30, GnssConstellationType::GPS, 20.5, 11.5, 116.0),
+        getSvInfo(10, GnssConstellationType::GLONASS, 25.0, 66.0, 247.0)};
+
+    GnssSvStatus svStatus = {.numSvs = sizeof(mockGnssSvInfoList) / sizeof(GnssSvInfo)};
+    for (uint32_t i = 0; i < svStatus.numSvs; i++) {
+        if (mGnssConfiguration->isBlacklisted(mockGnssSvInfoList[i])) {
+            /**
+             * Note well, this is a simple, mock emulation of not using a satellite by changing the
+             * used bit.  Simply blanking the used bit, as is done here, is *not* an acceptable
+             * actual device implementation - actual devices *must not* use the satellite in the
+             * position calculation, as specified in IGnssConfiguration.hal.
+             */
+            mockGnssSvInfoList[i].svFlag &=
+                ~static_cast<uint8_t>(IGnssCallback::GnssSvFlags::USED_IN_FIX);
+        }
+        svStatus.gnssSvList[i] = mockGnssSvInfoList[i];
+    }
+
+    return svStatus;
+}
+
+Return<void> Gnss::reportLocation(const GnssLocation& location) const {
     std::unique_lock<std::mutex> lock(mMutex);
     if (sGnssCallback == nullptr) {
         ALOGE("%s: sGnssCallback is null.", __func__);
@@ -215,6 +258,16 @@
     return Void();
 }
 
+Return<void> Gnss::reportSvStatus(const GnssSvStatus& svStatus) const {
+    std::unique_lock<std::mutex> lock(mMutex);
+    if (sGnssCallback == nullptr) {
+        ALOGE("%s: sGnssCallback is null.", __func__);
+        return Void();
+    }
+    sGnssCallback->gnssSvStatusCb(svStatus);
+    return Void();
+}
+
 }  // namespace implementation
 }  // namespace V1_1
 }  // namespace gnss
diff --git a/gnss/1.1/default/Gnss.h b/gnss/1.1/default/Gnss.h
index 68c3498..99af34c 100644
--- a/gnss/1.1/default/Gnss.h
+++ b/gnss/1.1/default/Gnss.h
@@ -7,6 +7,7 @@
 #include <atomic>
 #include <mutex>
 #include <thread>
+#include "GnssConfiguration.h"
 
 namespace android {
 namespace hardware {
@@ -22,6 +23,11 @@
 using ::android::hardware::Void;
 using ::android::sp;
 
+using GnssConstellationType = V1_0::GnssConstellationType;
+using GnssLocation = V1_0::GnssLocation;
+using GnssSvInfo = V1_0::IGnssCallback::GnssSvInfo;
+using GnssSvStatus = V1_0::IGnssCallback::GnssSvStatus;
+
 /**
  * Unlike the gnss/1.0/default implementation, which is a shim layer to the legacy gps.h, this
  * default implementation serves as a mock implementation for emulators
@@ -78,14 +84,19 @@
 
     // Methods from ::android::hidl::base::V1_0::IBase follow.
    private:
-    Return<V1_0::GnssLocation> getMockLocation();
-    Return<void> reportLocation(const V1_0::GnssLocation& location);
+    Return<GnssLocation> getMockLocation() const;
+    Return<GnssSvStatus> getMockSvStatus() const;
+    Return<GnssSvInfo> getSvInfo(int16_t svid, GnssConstellationType type, float cN0DbHz,
+                                 float elevationDegress, float azimuthDegress) const;
+    Return<void> reportLocation(const GnssLocation&) const;
+    Return<void> reportSvStatus(const GnssSvStatus&) const;
 
-    static sp<::android::hardware::gnss::V1_1::IGnssCallback> sGnssCallback;
+    static sp<IGnssCallback> sGnssCallback;
+    std::atomic<long> mMinIntervalMs;
+    sp<GnssConfiguration> mGnssConfiguration;
     std::atomic<bool> mIsActive;
     std::thread mThread;
-    std::mutex mMutex;
-    std::atomic<long> mMinIntervalMs;
+    mutable std::mutex mMutex;
 };
 
 }  // namespace implementation
diff --git a/gnss/1.1/default/GnssConfiguration.cpp b/gnss/1.1/default/GnssConfiguration.cpp
index d05f317..2717571 100644
--- a/gnss/1.1/default/GnssConfiguration.cpp
+++ b/gnss/1.1/default/GnssConfiguration.cpp
@@ -1,4 +1,7 @@
+#define LOG_TAG "GnssConfiguration"
+
 #include "GnssConfiguration.h"
+#include <log/log.h>
 
 namespace android {
 namespace hardware {
@@ -43,10 +46,33 @@
 }
 
 // Methods from ::android::hardware::gnss::V1_1::IGnssConfiguration follow.
-Return<bool> GnssConfiguration::setBlacklist(
-    const hidl_vec<::android::hardware::gnss::V1_1::IGnssConfiguration::BlacklistedSource>&) {
-    // TODO implement
-    return bool{};
+Return<bool> GnssConfiguration::setBlacklist(const hidl_vec<BlacklistedSource>& sourceList) {
+    std::unique_lock<std::recursive_mutex> lock(mMutex);
+    mBlacklistedConstellationSet.clear();
+    mBlacklistedSourceSet.clear();
+    for (auto source : sourceList) {
+        if (source.svid == 0) {
+            // Wildcard blacklist, i.e., blacklist entire constellation.
+            mBlacklistedConstellationSet.insert(source.constellation);
+        } else {
+            mBlacklistedSourceSet.insert(source);
+        }
+    }
+    return true;
+}
+
+Return<bool> GnssConfiguration::isBlacklisted(const GnssSvInfo& gnssSvInfo) const {
+    std::unique_lock<std::recursive_mutex> lock(mMutex);
+    if (mBlacklistedConstellationSet.find(gnssSvInfo.constellation) !=
+        mBlacklistedConstellationSet.end()) {
+        return true;
+    }
+    BlacklistedSource source = {.constellation = gnssSvInfo.constellation, .svid = gnssSvInfo.svid};
+    return (mBlacklistedSourceSet.find(source) != mBlacklistedSourceSet.end());
+}
+
+std::recursive_mutex& GnssConfiguration::getMutex() const {
+    return mMutex;
 }
 
 // Methods from ::android::hidl::base::V1_0::IBase follow.
diff --git a/gnss/1.1/default/GnssConfiguration.h b/gnss/1.1/default/GnssConfiguration.h
index 4f7ed2b..9b2699b 100644
--- a/gnss/1.1/default/GnssConfiguration.h
+++ b/gnss/1.1/default/GnssConfiguration.h
@@ -1,9 +1,12 @@
 #ifndef ANDROID_HARDWARE_GNSS_V1_1_GNSSCONFIGURATION_H
 #define ANDROID_HARDWARE_GNSS_V1_1_GNSSCONFIGURATION_H
 
+#include <android/hardware/gnss/1.1/IGnssCallback.h>
 #include <android/hardware/gnss/1.1/IGnssConfiguration.h>
 #include <hidl/MQDescriptor.h>
 #include <hidl/Status.h>
+#include <mutex>
+#include <unordered_set>
 
 namespace android {
 namespace hardware {
@@ -19,6 +22,26 @@
 using ::android::hardware::Void;
 using ::android::sp;
 
+using BlacklistedSource = ::android::hardware::gnss::V1_1::IGnssConfiguration::BlacklistedSource;
+using GnssConstellationType = V1_0::GnssConstellationType;
+using GnssSvInfo = V1_0::IGnssCallback::GnssSvInfo;
+
+struct BlacklistedSourceHash {
+    inline int operator()(const BlacklistedSource& source) const {
+        return int(source.constellation) * 1000 + int(source.svid);
+    }
+};
+
+struct BlacklistedSourceEqual {
+    inline bool operator()(const BlacklistedSource& s1, const BlacklistedSource& s2) const {
+        return (s1.constellation == s2.constellation) && (s1.svid == s2.svid);
+    }
+};
+
+using BlacklistedSourceSet =
+    std::unordered_set<BlacklistedSource, BlacklistedSourceHash, BlacklistedSourceEqual>;
+using BlacklistedConstellationSet = std::unordered_set<GnssConstellationType>;
+
 struct GnssConfiguration : public IGnssConfiguration {
     // Methods from ::android::hardware::gnss::V1_0::IGnssConfiguration follow.
     Return<bool> setSuplEs(bool enabled) override;
@@ -30,11 +53,15 @@
     Return<bool> setEmergencySuplPdn(bool enable) override;
 
     // Methods from ::android::hardware::gnss::V1_1::IGnssConfiguration follow.
-    Return<bool> setBlacklist(
-        const hidl_vec<::android::hardware::gnss::V1_1::IGnssConfiguration::BlacklistedSource>&
-            blacklist) override;
+    Return<bool> setBlacklist(const hidl_vec<BlacklistedSource>& blacklist) override;
 
-    // Methods from ::android::hidl::base::V1_0::IBase follow.
+    Return<bool> isBlacklisted(const GnssSvInfo& gnssSvInfo) const;
+    std::recursive_mutex& getMutex() const;
+
+   private:
+    BlacklistedSourceSet mBlacklistedSourceSet;
+    BlacklistedConstellationSet mBlacklistedConstellationSet;
+    mutable std::recursive_mutex mMutex;
 };
 
 }  // namespace implementation
diff --git a/gnss/1.1/default/GnssConstants.h b/gnss/1.1/default/GnssConstants.h
new file mode 100644
index 0000000..9ce1a12
--- /dev/null
+++ b/gnss/1.1/default/GnssConstants.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef android_hardware_gnss_V1_1_GnssConstants_H_
+#define android_hardware_gnss_V1_1_GnssConstants_H_
+
+namespace android {
+namespace hardware {
+namespace gnss {
+namespace V1_1 {
+namespace implementation {
+
+const float kMockLatitudeDegrees = 37.4219999;
+const float kMockLongitudeDegrees = -122.0840575;
+const float kMockAltitudeMeters = 1.60062531;
+const float kMockSpeedMetersPerSec = 0;
+const float kMockBearingDegrees = 0;
+const float kMockHorizontalAccuracyMeters = 5;
+const float kMockVerticalAccuracyMeters = 5;
+const float kMockSpeedAccuracyMetersPerSecond = 1;
+const float kMockBearingAccuracyDegrees = 90;
+const int64_t kMockTimestamp = 1519930775453L;
+
+}  // namespace implementation
+}  // namespace V1_1
+}  // namespace gnss
+}  // namespace hardware
+}  // namespace android
+
+#endif  // android_hardware_gnss_V1_1_GnssConstants_H_
diff --git a/gnss/1.1/default/GnssDebug.cpp b/gnss/1.1/default/GnssDebug.cpp
new file mode 100644
index 0000000..62870e4
--- /dev/null
+++ b/gnss/1.1/default/GnssDebug.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "GnssDebug"
+
+#include <log/log.h>
+
+#include "GnssConstants.h"
+#include "GnssDebug.h"
+
+namespace android {
+namespace hardware {
+namespace gnss {
+namespace V1_1 {
+namespace implementation {
+
+// Methods from ::android::hardware::gnss::V1_0::IGnssDebug follow.
+Return<void> GnssDebug::getDebugData(V1_0::IGnssDebug::getDebugData_cb _hidl_cb) {
+    PositionDebug positionDebug = {
+        .valid = true,
+        .latitudeDegrees = kMockLatitudeDegrees,
+        .longitudeDegrees = kMockLongitudeDegrees,
+        .altitudeMeters = kMockAltitudeMeters,
+        .speedMetersPerSec = kMockSpeedMetersPerSec,
+        .bearingDegrees = kMockBearingDegrees,
+        .horizontalAccuracyMeters = kMockHorizontalAccuracyMeters,
+        .verticalAccuracyMeters = kMockVerticalAccuracyMeters,
+        .speedAccuracyMetersPerSecond = kMockSpeedAccuracyMetersPerSecond,
+        .bearingAccuracyDegrees = kMockBearingAccuracyDegrees,
+        .ageSeconds = 0.99};
+
+    TimeDebug timeDebug = {.timeEstimate = kMockTimestamp,
+                           .timeUncertaintyNs = 1000,
+                           .frequencyUncertaintyNsPerSec = 5.0e4};
+
+    DebugData data = {.position = positionDebug, .time = timeDebug};
+
+    _hidl_cb(data);
+
+    return Void();
+}
+
+}  // namespace implementation
+}  // namespace V1_1
+}  // namespace gnss
+}  // namespace hardware
+}  // namespace android
diff --git a/gnss/1.1/default/GnssDebug.h b/gnss/1.1/default/GnssDebug.h
new file mode 100644
index 0000000..969d337
--- /dev/null
+++ b/gnss/1.1/default/GnssDebug.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef android_hardware_gnss_V1_1_GnssDebug_H_
+#define android_hardware_gnss_V1_1_GnssDebug_H_
+
+#include <android/hardware/gnss/1.0/IGnssDebug.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace gnss {
+namespace V1_1 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using V1_0::IGnssDebug;
+
+/* Interface for GNSS Debug support. */
+struct GnssDebug : public IGnssDebug {
+    /*
+     * Methods from ::android::hardware::gnss::V1_0::IGnssDebug follow.
+     * These declarations were generated from IGnssDebug.hal.
+     */
+    Return<void> getDebugData(V1_0::IGnssDebug::getDebugData_cb _hidl_cb) override;
+};
+
+}  // namespace implementation
+}  // namespace V1_1
+}  // namespace gnss
+}  // namespace hardware
+}  // namespace android
+
+#endif  // android_hardware_gnss_V1_1_GnssDebug_H_
diff --git a/gnss/1.1/default/OWNERS b/gnss/1.1/default/OWNERS
new file mode 100644
index 0000000..a3d8577
--- /dev/null
+++ b/gnss/1.1/default/OWNERS
@@ -0,0 +1,4 @@
+wyattriley@google.com
+gomo@google.com
+smalkos@google.com
+yuhany@google.com
diff --git a/gnss/1.1/vts/OWNERS b/gnss/1.1/vts/OWNERS
index 56648ad..3ed36da 100644
--- a/gnss/1.1/vts/OWNERS
+++ b/gnss/1.1/vts/OWNERS
@@ -1,6 +1,7 @@
 wyattriley@google.com
 gomo@google.com
 smalkos@google.com
+yuhany@google.com
 
 # VTS team
 yim@google.com
diff --git a/gnss/1.1/vts/functional/gnss_hal_test.cpp b/gnss/1.1/vts/functional/gnss_hal_test.cpp
index 9c5ac2d..8928a5a 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test.cpp
@@ -33,6 +33,8 @@
         GnssHidlEnvironment::Instance()->getServiceName<IGnss>());
     list_gnss_sv_status_.clear();
     ASSERT_NE(gnss_hal_, nullptr);
+
+    SetUpGnssCallback();
 }
 
 void GnssHalTest::TearDown() {
@@ -44,6 +46,30 @@
     }
 }
 
+void GnssHalTest::SetUpGnssCallback() {
+    gnss_cb_ = new GnssCallback(*this);
+    ASSERT_NE(gnss_cb_, nullptr);
+
+    auto result = gnss_hal_->setCallback_1_1(gnss_cb_);
+    if (!result.isOk()) {
+        ALOGE("result of failed setCallback %s", result.description().c_str());
+    }
+
+    ASSERT_TRUE(result.isOk());
+    ASSERT_TRUE(result);
+
+    /*
+     * All capabilities, name and systemInfo callbacks should trigger
+     */
+    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
+    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
+    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
+
+    EXPECT_EQ(capabilities_called_count_, 1);
+    EXPECT_EQ(info_called_count_, 1);
+    EXPECT_EQ(name_called_count_, 1);
+}
+
 void GnssHalTest::StopAndClearLocations() {
     auto result = gnss_hal_->stop();
 
diff --git a/gnss/1.1/vts/functional/gnss_hal_test.h b/gnss/1.1/vts/functional/gnss_hal_test.h
index 6d5bb4c..269366a 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test.h
+++ b/gnss/1.1/vts/functional/gnss_hal_test.h
@@ -101,6 +101,12 @@
     };
 
     /*
+     * SetUpGnssCallback:
+     *   Set GnssCallback and verify the result.
+     */
+    void SetUpGnssCallback();
+
+    /*
      * StartAndGetSingleLocation:
      * Helper function to get one Location and check fields
      *
diff --git a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
index 63b6c78..8f4691e 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
@@ -39,34 +39,6 @@
 TEST_F(GnssHalTest, SetupTeardownCreateCleanup) {}
 
 /*
- * SetCallbackResponses:
- * Sets up the callback, awaits the capability, info & name
- */
-TEST_F(GnssHalTest, SetCallbackResponses) {
-    gnss_cb_ = new GnssCallback(*this);
-    ASSERT_NE(gnss_cb_, nullptr);
-
-    auto result = gnss_hal_->setCallback_1_1(gnss_cb_);
-    if (!result.isOk()) {
-        ALOGE("result of failed setCallback %s", result.description().c_str());
-    }
-
-    ASSERT_TRUE(result.isOk());
-    ASSERT_TRUE(result);
-
-    /*
-     * All capabilities, name and systemInfo callbacks should trigger
-     */
-    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
-    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
-    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
-
-    EXPECT_EQ(capabilities_called_count_, 1);
-    EXPECT_EQ(info_called_count_, 1);
-    EXPECT_EQ(name_called_count_, 1);
-}
-
-/*
  * TestGnssMeasurementCallback:
  * Gets the GnssMeasurementExtension and verify that it returns an actual extension.
  */
@@ -283,6 +255,7 @@
         if (strongest_sv_is_reobserved) break;
     }
     EXPECT_TRUE(strongest_sv_is_reobserved);
+    StopAndClearLocations();
 }
 
 /*
diff --git a/light/2.0/default/android.hardware.light@2.0-service.rc b/light/2.0/default/android.hardware.light@2.0-service.rc
index 68f74c4..b54ca95 100644
--- a/light/2.0/default/android.hardware.light@2.0-service.rc
+++ b/light/2.0/default/android.hardware.light@2.0-service.rc
@@ -3,3 +3,5 @@
     class hal
     user system
     group system
+    # shutting off lights while powering-off
+    shutdown critical