Merge "change all vts hidl tests to use VtsHalHidlTargetBaseTest (internal master)"
diff --git a/audio/2.0/default/StreamOut.cpp b/audio/2.0/default/StreamOut.cpp
index 6ccdbcd..cdc8ded 100644
--- a/audio/2.0/default/StreamOut.cpp
+++ b/audio/2.0/default/StreamOut.cpp
@@ -79,6 +79,10 @@
         ssize_t writeResult = mStream->write(mStream, &mBuffer[0], availToRead);
         if (writeResult >= 0) {
             mStatus.reply.written = writeResult;
+            // Diagnostics of the cause of b/35813113.
+            ALOGE_IF(writeResult > availToRead,
+                    "legacy hal reports more bytes written than asked for: %lld > %lld",
+                    (long long)writeResult, (long long)availToRead);
         } else {
             mStatus.retval = Stream::analyzeStatus("write", writeResult);
         }
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index 4a4171b..9c51b15 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -144,7 +144,7 @@
             status = android::OK;
             bytesWritten = result;
         } else {
-            status = -result;
+            status = result;
             bytesWritten = 0;
         }
 
diff --git a/radio/1.0/Android.mk b/radio/1.0/Android.mk
index 7f4c7d4..94072fb 100644
--- a/radio/1.0/Android.mk
+++ b/radio/1.0/Android.mk
@@ -929,6 +929,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (CellIdentity)
+#
+GEN := $(intermediates)/android/hardware/radio/V1_0/CellIdentity.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.radio@1.0::types.CellIdentity
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (CellIdentityCdma)
 #
 GEN := $(intermediates)/android/hardware/radio/V1_0/CellIdentityCdma.java
@@ -3944,6 +3963,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (CellIdentity)
+#
+GEN := $(intermediates)/android/hardware/radio/V1_0/CellIdentity.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.radio@1.0::types.CellIdentity
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (CellIdentityCdma)
 #
 GEN := $(intermediates)/android/hardware/radio/V1_0/CellIdentityCdma.java
diff --git a/radio/1.0/types.hal b/radio/1.0/types.hal
index 91030ef..7c1d143 100644
--- a/radio/1.0/types.hal
+++ b/radio/1.0/types.hal
@@ -499,21 +499,21 @@
  * "managed roaming"
  */
 enum RegState : int32_t {
-    NOT_REG_MT_NOT_SEARCHING_OP,          // Not registered, MT is not currently searching
+    NOT_REG_MT_NOT_SEARCHING_OP = 0,      // Not registered, MT is not currently searching
                                           // a new operator to register
-    REG_HOME,                             // Registered, home network
-    NOT_REG_MT_SEARCHING_OP,              // Not registered, but MT is currently searching
+    REG_HOME = 1,                         // Registered, home network
+    NOT_REG_MT_SEARCHING_OP = 2,          // Not registered, but MT is currently searching
                                           // a new operator to register
-    REG_DENIED,                           // Registration denied
-    UNKNOWN,                              // Unknown
-    REG_ROAMING,                          // Registered, roaming
-    NOT_REG_MT_NOT_SEARCHING_OP_EM,       // Same as NOT_REG_MT_NOT_SEARCHING_OP but indicates that
+    REG_DENIED = 3,                       // Registration denied
+    UNKNOWN = 4,                          // Unknown
+    REG_ROAMING = 5,                      // Registered, roaming
+    NOT_REG_MT_NOT_SEARCHING_OP_EM = 10,  // Same as NOT_REG_MT_NOT_SEARCHING_OP but indicates that
                                           // emergency calls are enabled.
-    NOT_REG_MT_SEARCHING_OP_EM,           // Same as NOT_REG_MT_SEARCHING_OP but indicates that
+    NOT_REG_MT_SEARCHING_OP_EM = 12,      // Same as NOT_REG_MT_SEARCHING_OP but indicates that
                                           // emergency calls are enabled.
-    REG_DENIED_EM,                        // Same as REG_DENIED but indicates that
+    REG_DENIED_EM = 13,                   // Same as REG_DENIED but indicates that
                                           // emergency calls are enabled.
-    UNKNOWN_EM,                           // Same as UNKNOWN but indicates that
+    UNKNOWN_EM = 14,                      // Same as UNKNOWN but indicates that
                                           // emergency calls are enabled.
 };
 
@@ -815,6 +815,7 @@
 };
 
 enum CellInfoType : int32_t {
+    NONE = 0,
     GSM = 1,
     CDMA = 2,
     LTE = 3,
@@ -1281,11 +1282,11 @@
 };
 
 struct SetupDataCallResult {
-    int32_t status;                       // A RadioDataCallFailCause, 0 which is
-                                          // RadioDataCallFailCause:NONE if no error
-    int32_t suggestedRetryTime;           // If status != 0, this fields indicates the suggested
-                                          // retry back-off timer value RIL wants to override the
-                                          // one pre-configured in FW.
+    DataCallFailCause status;             // Data call fail cause. DataCallFailCause.NONE if no
+                                          // error.
+    int32_t suggestedRetryTime;           // If status != DataCallFailCause.NONE, this field
+                                          // indicates the suggested retry back-off timer value RIL
+                                          // wants to override the one pre-configured in FW.
                                           // The unit is milliseconds.
                                           // The value < 0 means no value is suggested.
                                           // The value 0 means retry must be done ASAP.
@@ -1296,8 +1297,8 @@
     string type;                          // One of the PDP_type values in TS 27.007 section 10.1.1.
                                           // For example, "IP", "IPV6", "IPV4V6", or "PPP". If
                                           // status is
-                                          // RadioDataCallFailCause:ONLY_SINGLE_BEARER_ALLOWED this
-                                          // is the type supported such as "IP" or "IPV6"
+                                          // DataCallFailCause.ONLY_SINGLE_BEARER_ALLOWED, this
+                                          // is the type supported such as "IP" or "IPV6".
     string ifname;                        // The network interface name
     string addresses;                     // A space-delimited list of addresses with optional "/"
                                           // prefix length, e.g., "192.0.1.3" or
@@ -1343,125 +1344,6 @@
                                           // Base64 format, see 3GPP TS 31.102 7.1.2
 };
 
-struct VoiceRegStateResult {
-    RegState regState;
-    int32_t lac;                          // LAC if registered on a GSM/WCDMA system or
-                                          // -1 if not.Valid LAC are 0x0000 - 0xffff
-    int32_t cid;                          // CID. if registered on a * GSM/WCDMA or -1 if not
-                                          // Valid CID are 0x00000000 - 0xffffffff
-                                          // In GSM, CID is Cell ID (see TS 27.007) in 16 bits
-                                          // In UMTS, CID is UMTS Cell Identity (see TS 25.331)
-                                          // in 28 bits
-    int32_t rat;                          // indicates the available voice radio technology,
-                                          // valid values as defined by RadioTechnology.
-    int32_t baseStationId;                // Base Station ID. if registered on a CDMA
-                                          // system or -1 if not. Base Station ID in decimal format
-    int32_t baseStationLatitude;          // Base Station latitude. if registered on a
-                                          // CDMA system or -1 if not. Base Station latitude is a
-                                          // decimal number as specified in 3GPP2 C.S0005-A v6.0.
-                                          // It is represented in units of 0.25 seconds and ranges
-                                          // from -1296000 to 1296000, both values inclusive
-                                          // (corresponding to a range of -90 to +90 degrees).
-    int32_t baseStationLongitude;         // Base Station longitude. if registered on a
-                                          // CDMA system or -1 if not. Base Station
-                                          // longitude is a decimal number as specified in
-                                          // 3GPP2 C.S0005-A v6.0. It is represented in
-                                          // units of 0.25 seconds and ranges from -2592000
-                                          // to 2592000, both values inclusive (corresponding
-                                          // to a range of -180 to +180 degrees).
-    bool cssSupported;                    // concurrent services support indicator. if
-                                          // registered on a CDMA system.
-                                          // false - Concurrent services not supported,
-                                          // true - Concurrent services supported
-    int32_t systemId;                     // System ID. if registered on a CDMA system or
-                                          // -1 if not. Valid System ID are 0 - 32767
-    int32_t networkId;                    // Network ID. if registered on a CDMA system or
-                                          // -1 if not. Valid System ID are 0 - 65535
-    int32_t roamingIndicator;             // TSB-58 Roaming Indicator if registered
-                                          // on a CDMA or EVDO system or -1 if not.
-                                          // Valid values are 0-255.
-    int32_t systemIsInPrl;                // indicates whether the current system is in the
-                                          // PRL if registered on a CDMA or EVDO system or -1 if
-                                          // not. 0=not in the PRL, 1=in the PRL
-    int32_t defaultRoamingIndicator;      // default Roaming Indicator from the PRL,
-                                          // if registered on a CDMA or EVDO system or -1 if not.
-                                          // Valid values are 0-255.
-    int32_t reasonForDenial;              // reasonForDenial if registration state is 3
-                                          // (Registration denied) this is an enumerated reason why
-                                          // registration was denied. See 3GPP TS 24.008,
-                                          // 10.5.3.6 and Annex G.
-                                          // 0 - General
-                                          // 1 - Authentication Failure
-                                          // 2 - IMSI unknown in HLR
-                                          // 3 - Illegal MS
-                                          // 4 - Illegal ME
-                                          // 5 - PLMN not allowed
-                                          // 6 - Location area not allowed
-                                          // 7 - Roaming not allowed
-                                          // 8 - No Suitable Cells in this Location Area
-                                          // 9 - Network failure
-                                          // 10 - Persistent location update reject
-                                          // 11 - PLMN not allowed
-                                          // 12 - Location area not allowed
-                                          // 13 - Roaming not allowed in this Location Area
-                                          // 15 - No Suitable Cells in this Location Area
-                                          // 17 - Network Failure
-                                          // 20 - MAC Failure
-                                          // 21 - Sync Failure
-                                          // 22 - Congestion
-                                          // 23 - GSM Authentication unacceptable
-                                          // 25 - Not Authorized for this CSG
-                                          // 32 - Service option not supported
-                                          // 33 - Requested service option not subscribed
-                                          // 34 - Service option temporarily out of order
-                                          // 38 - Call cannot be identified
-                                          // 48-63 - Retry upon entry into a new cell
-                                          // 95 - Semantically incorrect message
-                                          // 96 - Invalid mandatory information
-                                          // 97 - Message type non-existent or not implemented
-                                          // 98 - Message type not compatible with protocol state
-                                          // 99 - Information element non-existent or not implemented
-                                          // 100 - Conditional IE error
-                                          // 101 - Message not compatible with protocol state
-                                          // 111 - Protocol error, unspecified
-    int32_t psc;                          // Primary Scrambling Code of the current
-                                          // cell as described in TS 25.331, in hexadecimal
-                                          // format, or -1 if unknown or not registered
-                                          // to a UMTS network.
-};
-
-struct DataRegStateResult {
-    RegState regState;                    // Valid reg states are NOT_REG_MT_NOT_SEARCHING_OP,
-                                          // REG_HOME, NOT_REG_MT_SEARCHING_OP, REG_DENIED,
-                                          // UNKNOWN, REG_ROAMING defined in RegState
-    int32_t lac;                          // LAC if registered or -1 if not
-                                          // valid LAC are 0x0000 - 0xffff
-    int32_t cid;                          // CID if registered or -1 if not
-                                          // valid CID are 0x00000000 - 0x0fffffff
-    int32_t rat;                          // indicates the available data radio technology,
-                                          // valid values as defined by RadioTechnology.
-    int32_t reasonDataDenied;             // if registration state is 3 (Registration
-                                          // denied) this is an enumerated reason why
-                                          // registration was denied. See 3GPP TS 24.008,
-                                          // Annex G.6 "Additional cause codes for GMM".
-                                          // 7 == GPRS services not allowed
-                                          // 8 == GPRS services and non-GPRS services not allowed
-                                          // 9 == MS identity cannot be derived by the network
-                                          // 10 == Implicitly detached
-                                          // 14 == GPRS services not allowed in this PLMN
-                                          // 16 == MSC temporarily not reachable
-                                          // 40 == No PDP context activated
-    int32_t maxDataCalls;                 // The maximum number of simultaneous Data Calls that
-                                          // must be established using setupDataCall().
-    // The values below are optional LTE location information in decimal.
-    // If a value is unknown that value must be -1.
-    int32_t tac;                          // a 16-bit Tracking Area Code.
-    int32_t phyCid;                       // a 0-503 Physical Cell Identifier.
-    int32_t eci;                          // a 28-bit E-UTRAN Cell Identifier.
-    int32_t csgid;                        // a 27-bit Closed Subscriber Group Identity.
-    int32_t tadv;                         // a 6-bit timing advance value.
-};
-
 // See also com.android.internal.telephony.gsm.CallForwardInfo
 struct CallForwardInfo {
     CallForwardInfoStatus status;         // For queryCallForwardStatus()
@@ -1687,6 +1569,100 @@
                                           // empty
 };
 
+struct CellIdentity {
+    CellInfoType cellInfoType;            // cell type for selecting from union CellInfo
+    // Only one of the below vectors must be of size 1, based on a valid CellInfoType and
+    // others must be of size 0. If cell info type is NONE, then all the vectors
+    // must be of size 0.
+    vec<CellIdentityGsm> cellIdentityGsm;
+    vec<CellIdentityWcdma> cellIdentityWcdma;
+    vec<CellIdentityCdma> cellIdentityCdma;
+    vec<CellIdentityLte> cellIdentityLte;
+    vec<CellIdentityTdscdma> cellIdentityTdscdma;
+};
+
+struct VoiceRegStateResult {
+    RegState regState;                    // Valid reg states are NOT_REG_MT_NOT_SEARCHING_OP,
+                                          // REG_HOME, NOT_REG_MT_SEARCHING_OP, REG_DENIED,
+                                          // UNKNOWN, REG_ROAMING defined in RegState
+    int32_t rat;                          // indicates the available voice radio technology,
+                                          // valid values as defined by RadioTechnology.
+    bool cssSupported;                    // concurrent services support indicator. if
+                                          // registered on a CDMA system.
+                                          // false - Concurrent services not supported,
+                                          // true - Concurrent services supported
+    int32_t roamingIndicator;             // TSB-58 Roaming Indicator if registered
+                                          // on a CDMA or EVDO system or -1 if not.
+                                          // Valid values are 0-255.
+    int32_t systemIsInPrl;                // indicates whether the current system is in the
+                                          // PRL if registered on a CDMA or EVDO system or -1 if
+                                          // not. 0=not in the PRL, 1=in the PRL
+    int32_t defaultRoamingIndicator;      // default Roaming Indicator from the PRL,
+                                          // if registered on a CDMA or EVDO system or -1 if not.
+                                          // Valid values are 0-255.
+    int32_t reasonForDenial;              // reasonForDenial if registration state is 3
+                                          // (Registration denied) this is an enumerated reason why
+                                          // registration was denied. See 3GPP TS 24.008,
+                                          // 10.5.3.6 and Annex G.
+                                          // 0 - General
+                                          // 1 - Authentication Failure
+                                          // 2 - IMSI unknown in HLR
+                                          // 3 - Illegal MS
+                                          // 4 - Illegal ME
+                                          // 5 - PLMN not allowed
+                                          // 6 - Location area not allowed
+                                          // 7 - Roaming not allowed
+                                          // 8 - No Suitable Cells in this Location Area
+                                          // 9 - Network failure
+                                          // 10 - Persistent location update reject
+                                          // 11 - PLMN not allowed
+                                          // 12 - Location area not allowed
+                                          // 13 - Roaming not allowed in this Location Area
+                                          // 15 - No Suitable Cells in this Location Area
+                                          // 17 - Network Failure
+                                          // 20 - MAC Failure
+                                          // 21 - Sync Failure
+                                          // 22 - Congestion
+                                          // 23 - GSM Authentication unacceptable
+                                          // 25 - Not Authorized for this CSG
+                                          // 32 - Service option not supported
+                                          // 33 - Requested service option not subscribed
+                                          // 34 - Service option temporarily out of order
+                                          // 38 - Call cannot be identified
+                                          // 48-63 - Retry upon entry into a new cell
+                                          // 95 - Semantically incorrect message
+                                          // 96 - Invalid mandatory information
+                                          // 97 - Message type non-existent or not implemented
+                                          // 98 - Message type not compatible with protocol state
+                                          // 99 - Information element non-existent or not implemented
+                                          // 100 - Conditional IE error
+                                          // 101 - Message not compatible with protocol state
+                                          // 111 - Protocol error, unspecified
+    CellIdentity cellIdentity;
+};
+
+struct DataRegStateResult {
+    RegState regState;                    // Valid reg states are NOT_REG_MT_NOT_SEARCHING_OP,
+                                          // REG_HOME, NOT_REG_MT_SEARCHING_OP, REG_DENIED,
+                                          // UNKNOWN, REG_ROAMING defined in RegState
+    int32_t rat;                          // indicates the available data radio technology,
+                                          // valid values as defined by RadioTechnology.
+    int32_t reasonDataDenied;             // if registration state is 3 (Registration
+                                          // denied) this is an enumerated reason why
+                                          // registration was denied. See 3GPP TS 24.008,
+                                          // Annex G.6 "Additional cause codes for GMM".
+                                          // 7 == GPRS services not allowed
+                                          // 8 == GPRS services and non-GPRS services not allowed
+                                          // 9 == MS identity cannot be derived by the network
+                                          // 10 == Implicitly detached
+                                          // 14 == GPRS services not allowed in this PLMN
+                                          // 16 == MSC temporarily not reachable
+                                          // 40 == No PDP context activated
+    int32_t maxDataCalls;                 // The maximum number of simultaneous Data Calls that
+                                          // must be established using setupDataCall().
+    CellIdentity cellIdentity;
+};
+
 struct GsmSmsMessage {
     string smscPdu;                       // SMSC address in GSM BCD format prefixed by a length
                                           // byte (as expected by TS 27.005) or empty string for
@@ -2005,4 +1981,4 @@
                                           // to send all of them.
     vec<uint8_t> contents;                // Carrier-defined content. It is binary, opaque and
                                           // loosely defined in LTE Layer 3 spec 24.008
-};
\ No newline at end of file
+};
diff --git a/wifi/1.0/IWifiChip.hal b/wifi/1.0/IWifiChip.hal
index b0598a4..611c449 100644
--- a/wifi/1.0/IWifiChip.hal
+++ b/wifi/1.0/IWifiChip.hal
@@ -629,6 +629,19 @@
   forceDumpToDebugRingBuffer(string ringName) generates (WifiStatus status);
 
   /**
+   * API to stop the debug data collection for all ring buffers.
+   *
+   * @return status WifiStatus of the operation.
+   *         Possible status codes:
+   *         |WifiStatusCode.SUCCESS|,
+   *         |WifiStatusCode.ERROR_WIFI_CHIP_INVALID|,
+   *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+   *         |WifiStatusCode.NOT_AVAILABLE|,
+   *         |WifiStatusCode.UNKNOWN|
+   */
+  stopLoggingToDebugRingBuffer() generates (WifiStatus status);
+
+  /**
    * API to retrieve the wifi wake up reason stats for debugging.
    * The driver is expected to start maintaining these stats once the chip
    * is configured using |configureChip|. These stats must be reset whenever
diff --git a/wifi/1.0/IWifiStaIfaceEventCallback.hal b/wifi/1.0/IWifiStaIfaceEventCallback.hal
index e8df4c2..e51ea6d 100644
--- a/wifi/1.0/IWifiStaIfaceEventCallback.hal
+++ b/wifi/1.0/IWifiStaIfaceEventCallback.hal
@@ -31,9 +31,12 @@
    * |StaBackgroundScanBucketParameters.eventReportScheme|.
    *
    * @param cmdId command ID corresponding to the request.
+   * @param bucketsScanned Bitset where each bit indicates if the bucket with
+   *        that index (starting at 0) was scanned.
    * @parm result Full scan result for an AP.
    */
-  oneway onBackgroundFullScanResult(CommandId cmdId, StaScanResult result);
+  oneway onBackgroundFullScanResult(
+      CommandId cmdId, uint32_t bucketsScanned, StaScanResult result);
 
   /**
    * Called when the |StaBackgroundScanBucketParameters.eventReportScheme| flags
diff --git a/wifi/1.0/default/hidl_struct_util.cpp b/wifi/1.0/default/hidl_struct_util.cpp
index 726f011..82364cb 100644
--- a/wifi/1.0/default/hidl_struct_util.cpp
+++ b/wifi/1.0/default/hidl_struct_util.cpp
@@ -338,7 +338,6 @@
       hidl_scan_params.reportThresholdPercent;
   legacy_scan_params->report_threshold_num_scans =
       hidl_scan_params.reportThresholdNumScans;
-  // TODO(b/33194311): Expose these max limits in the HIDL interface.
   if (hidl_scan_params.buckets.size() > MAX_BUCKETS) {
     return false;
   }
@@ -366,7 +365,6 @@
             convertHidlGscanReportEventFlagToLegacy(flag);
       }
     }
-    // TODO(b/33194311): Expose these max limits in the HIDL interface.
     if (hidl_bucket_spec.frequencies.size() > MAX_CHANNELS) {
       return false;
     }
diff --git a/wifi/1.0/default/wifi_chip.cpp b/wifi/1.0/default/wifi_chip.cpp
index 6aeedf8..6f980c0 100644
--- a/wifi/1.0/default/wifi_chip.cpp
+++ b/wifi/1.0/default/wifi_chip.cpp
@@ -317,6 +317,14 @@
                          ring_name);
 }
 
+Return<void> WifiChip::stopLoggingToDebugRingBuffer(
+    stopLoggingToDebugRingBuffer_cb hidl_status_cb) {
+  return validateAndCall(this,
+                         WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                         &WifiChip::stopLoggingToDebugRingBufferInternal,
+                         hidl_status_cb);
+}
+
 Return<void> WifiChip::getDebugHostWakeReasonStats(
     getDebugHostWakeReasonStats_cb hidl_status_cb) {
   return validateAndCall(this,
@@ -735,6 +743,12 @@
   return createWifiStatusFromLegacyError(legacy_status);
 }
 
+WifiStatus WifiChip::stopLoggingToDebugRingBufferInternal() {
+  legacy_hal::wifi_error legacy_status =
+      legacy_hal_.lock()->deregisterRingBufferCallbackHandler();
+  return createWifiStatusFromLegacyError(legacy_status);
+}
+
 std::pair<WifiStatus, WifiDebugHostWakeReasonStats>
 WifiChip::getDebugHostWakeReasonStatsInternal() {
   legacy_hal::wifi_error legacy_status;
diff --git a/wifi/1.0/default/wifi_chip.h b/wifi/1.0/default/wifi_chip.h
index e1c2344..406938c 100644
--- a/wifi/1.0/default/wifi_chip.h
+++ b/wifi/1.0/default/wifi_chip.h
@@ -119,6 +119,8 @@
   Return<void> forceDumpToDebugRingBuffer(
       const hidl_string& ring_name,
       forceDumpToDebugRingBuffer_cb hidl_status_cb) override;
+  Return<void> stopLoggingToDebugRingBuffer(
+      stopLoggingToDebugRingBuffer_cb hidl_status_cb) override;
   Return<void> getDebugHostWakeReasonStats(
       getDebugHostWakeReasonStats_cb hidl_status_cb) override;
   Return<void> enableDebugErrorAlerts(
@@ -170,6 +172,7 @@
       uint32_t max_interval_in_sec,
       uint32_t min_data_size_in_bytes);
   WifiStatus forceDumpToDebugRingBufferInternal(const hidl_string& ring_name);
+  WifiStatus stopLoggingToDebugRingBufferInternal();
   std::pair<WifiStatus, WifiDebugHostWakeReasonStats>
   getDebugHostWakeReasonStatsInternal();
   WifiStatus enableDebugErrorAlertsInternal(bool enable);
diff --git a/wifi/1.0/default/wifi_sta_iface.cpp b/wifi/1.0/default/wifi_sta_iface.cpp
index 0c84102..626b195 100644
--- a/wifi/1.0/default/wifi_sta_iface.cpp
+++ b/wifi/1.0/default/wifi_sta_iface.cpp
@@ -415,7 +415,7 @@
   const auto& on_full_result_callback = [weak_ptr_this](
       legacy_hal::wifi_request_id id,
       const legacy_hal::wifi_scan_result* result,
-      uint32_t /* buckets_scanned */) {
+      uint32_t buckets_scanned) {
     const auto shared_ptr_this = weak_ptr_this.promote();
     if (!shared_ptr_this.get() || !shared_ptr_this->isValid()) {
       LOG(ERROR) << "Callback invoked on an invalid object";
@@ -428,7 +428,8 @@
       return;
     }
     for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
-      if (!callback->onBackgroundFullScanResult(id, hidl_scan_result).isOk()) {
+      if (!callback->onBackgroundFullScanResult(
+              id, buckets_scanned, hidl_scan_result).isOk()) {
         LOG(ERROR) << "Failed to invoke onBackgroundFullScanResult callback";
       }
     }
diff --git a/wifi/1.0/types.hal b/wifi/1.0/types.hal
index 3b2f25b..83e6660 100644
--- a/wifi/1.0/types.hal
+++ b/wifi/1.0/types.hal
@@ -306,6 +306,15 @@
 };
 
 /**
+ * Max limits for background scan.
+ */
+enum StaScanLimits : uint32_t {
+  MAX_CHANNELS = 16,
+  MAX_BUCKETS = 16,
+  MAX_AP_CACHE_PER_SCAN = 32
+};
+
+/**
  * Background Scan parameters per bucket that can be specified in background
  * scan requests.
  */
@@ -318,6 +327,7 @@
   /**
    * Channel frequencies (in Mhz) to scan if |band| is set to
    * |BAND_UNSPECIFIED|.
+   * Max length: |StaScanLimits.MAX_CHANNELS|.
    */
   vec<WifiChannelInMhz> frequencies;
   /**
@@ -361,6 +371,7 @@
   /**
    * Maximum number of APs that must be stored for each scan. If the maximum
    * is reached the highest RSSI results must be returned.
+   * Max length: |StaScanLimits.MAX_AP_CACHE_PER_SCAN|.
    */
   uint32_t maxApPerScan;
   /**
@@ -374,6 +385,7 @@
   uint32_t reportThresholdNumScans;
   /**
    * List of buckets to be scheduled.
+   * Max length: |StaScanLimits.MAX_BUCKETS|.
    */
   vec<StaBackgroundScanBucketParameters> buckets;
 };
@@ -506,8 +518,8 @@
    */
   bitfield<StaScanDataFlagMask> flags;
   /**
-   * Bitset where each bit indicates if the bucket with that index was
-   * scanned.
+   * Bitset where each bit indicates if the bucket with that index (starting at
+   * 0) was scanned.
    */
   uint32_t bucketsScanned;
   /**