diff --git a/wpa_supplicant/Android.mk b/wpa_supplicant/Android.mk
index 4a04b3f..4b45f8c 100644
--- a/wpa_supplicant/Android.mk
+++ b/wpa_supplicant/Android.mk
@@ -27,8 +27,9 @@
 
 # Set Android extended P2P functionality
 L_CFLAGS += -DANDROID_P2P
+
 ifeq ($(BOARD_WPA_SUPPLICANT_PRIVATE_LIB),)
-L_CFLAGS += -DANDROID_P2P_STUB
+L_CFLAGS += -DANDROID_LIB_STUB
 endif
 
 # Disable roaming in wpa_supplicant
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index 239c3e8..4d801cc 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -967,6 +967,13 @@
 	val = wpa_config_parse_cipher(line, value);
 	if (val == -1)
 		return -1;
+
+	/*
+	 * Backwards compatibility - filter out WEP ciphers that were previously
+	 * allowed.
+	 */
+	val &= ~(WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40);
+
 	if (val & ~WPA_ALLOWED_GROUP_CIPHERS) {
 		wpa_printf(MSG_ERROR, "Line %d: not allowed group cipher "
 			   "(0x%x).", line, val);
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index e946567..ae34f10 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -1016,13 +1016,13 @@
 	if (config->driver_param)
 		fprintf(f, "driver_param=%s\n", config->driver_param);
 	if (config->dot11RSNAConfigPMKLifetime)
-		fprintf(f, "dot11RSNAConfigPMKLifetime=%d\n",
+		fprintf(f, "dot11RSNAConfigPMKLifetime=%u\n",
 			config->dot11RSNAConfigPMKLifetime);
 	if (config->dot11RSNAConfigPMKReauthThreshold)
-		fprintf(f, "dot11RSNAConfigPMKReauthThreshold=%d\n",
+		fprintf(f, "dot11RSNAConfigPMKReauthThreshold=%u\n",
 			config->dot11RSNAConfigPMKReauthThreshold);
 	if (config->dot11RSNAConfigSATimeout)
-		fprintf(f, "dot11RSNAConfigSATimeout=%d\n",
+		fprintf(f, "dot11RSNAConfigSATimeout=%u\n",
 			config->dot11RSNAConfigSATimeout);
 	if (config->update_config)
 		fprintf(f, "update_config=%d\n", config->update_config);
@@ -1070,27 +1070,27 @@
 #endif /* CONFIG_WPS */
 #ifdef CONFIG_P2P
 	if (config->p2p_listen_reg_class)
-		fprintf(f, "p2p_listen_reg_class=%u\n",
+		fprintf(f, "p2p_listen_reg_class=%d\n",
 			config->p2p_listen_reg_class);
 	if (config->p2p_listen_channel)
-		fprintf(f, "p2p_listen_channel=%u\n",
+		fprintf(f, "p2p_listen_channel=%d\n",
 			config->p2p_listen_channel);
 	if (config->p2p_oper_reg_class)
-		fprintf(f, "p2p_oper_reg_class=%u\n",
+		fprintf(f, "p2p_oper_reg_class=%d\n",
 			config->p2p_oper_reg_class);
 	if (config->p2p_oper_channel)
-		fprintf(f, "p2p_oper_channel=%u\n", config->p2p_oper_channel);
+		fprintf(f, "p2p_oper_channel=%d\n", config->p2p_oper_channel);
 	if (config->p2p_go_intent != DEFAULT_P2P_GO_INTENT)
-		fprintf(f, "p2p_go_intent=%u\n", config->p2p_go_intent);
+		fprintf(f, "p2p_go_intent=%d\n", config->p2p_go_intent);
 	if (config->p2p_ssid_postfix)
 		fprintf(f, "p2p_ssid_postfix=%s\n", config->p2p_ssid_postfix);
 	if (config->persistent_reconnect)
-		fprintf(f, "persistent_reconnect=%u\n",
+		fprintf(f, "persistent_reconnect=%d\n",
 			config->persistent_reconnect);
 	if (config->p2p_intra_bss != DEFAULT_P2P_INTRA_BSS)
-		fprintf(f, "p2p_intra_bss=%u\n", config->p2p_intra_bss);
+		fprintf(f, "p2p_intra_bss=%d\n", config->p2p_intra_bss);
 	if (config->p2p_group_idle)
-		fprintf(f, "p2p_group_idle=%u\n", config->p2p_group_idle);
+		fprintf(f, "p2p_group_idle=%d\n", config->p2p_group_idle);
 	if (config->p2p_passphrase_len)
 		fprintf(f, "p2p_passphrase_len=%u\n",
 			config->p2p_passphrase_len);
@@ -1118,22 +1118,21 @@
 		fprintf(f, "p2p_optimize_listen_chan=%d\n",
 			config->p2p_optimize_listen_chan);
 	if (config->p2p_go_ht40)
-		fprintf(f, "p2p_go_ht40=%u\n", config->p2p_go_ht40);
+		fprintf(f, "p2p_go_ht40=%d\n", config->p2p_go_ht40);
 	if (config->p2p_go_vht)
-		fprintf(f, "p2p_go_vht=%u\n", config->p2p_go_vht);
+		fprintf(f, "p2p_go_vht=%d\n", config->p2p_go_vht);
 	if (config->p2p_go_ctwindow != DEFAULT_P2P_GO_CTWINDOW)
-		fprintf(f, "p2p_go_ctwindow=%u\n", config->p2p_go_ctwindow);
+		fprintf(f, "p2p_go_ctwindow=%d\n", config->p2p_go_ctwindow);
 	if (config->p2p_disabled)
-		fprintf(f, "p2p_disabled=%u\n", config->p2p_disabled);
+		fprintf(f, "p2p_disabled=%d\n", config->p2p_disabled);
 	if (config->p2p_no_group_iface)
-		fprintf(f, "p2p_no_group_iface=%u\n",
+		fprintf(f, "p2p_no_group_iface=%d\n",
 			config->p2p_no_group_iface);
 	if (config->p2p_ignore_shared_freq)
-		fprintf(f, "p2p_ignore_shared_freq=%u\n",
+		fprintf(f, "p2p_ignore_shared_freq=%d\n",
 			config->p2p_ignore_shared_freq);
 	if (config->p2p_cli_probe)
-		fprintf(f, "p2p_cli_probe=%u\n",
-			config->p2p_cli_probe);
+		fprintf(f, "p2p_cli_probe=%d\n", config->p2p_cli_probe);
 #endif /* CONFIG_P2P */
 	if (config->country[0] && config->country[1]) {
 		fprintf(f, "country=%c%c\n",
@@ -1153,14 +1152,14 @@
 	if (config->max_num_sta != DEFAULT_MAX_NUM_STA)
 		fprintf(f, "max_num_sta=%u\n", config->max_num_sta);
 	if (config->disassoc_low_ack)
-		fprintf(f, "disassoc_low_ack=%u\n", config->disassoc_low_ack);
+		fprintf(f, "disassoc_low_ack=%d\n", config->disassoc_low_ack);
 #ifdef CONFIG_HS20
 	if (config->hs20)
 		fprintf(f, "hs20=1\n");
 #endif /* CONFIG_HS20 */
 #ifdef CONFIG_INTERWORKING
 	if (config->interworking)
-		fprintf(f, "interworking=%u\n", config->interworking);
+		fprintf(f, "interworking=%d\n", config->interworking);
 	if (!is_zero_ether_addr(config->hessid))
 		fprintf(f, "hessid=" MACSTR "\n", MAC2STR(config->hessid));
 	if (config->access_network_type != DEFAULT_ACCESS_NETWORK_TYPE)
@@ -1168,7 +1167,7 @@
 			config->access_network_type);
 #endif /* CONFIG_INTERWORKING */
 	if (config->pbc_in_m1)
-		fprintf(f, "pbc_in_m1=%u\n", config->pbc_in_m1);
+		fprintf(f, "pbc_in_m1=%d\n", config->pbc_in_m1);
 	if (config->wps_nfc_pw_from_config) {
 		if (config->wps_nfc_dev_pw_id)
 			fprintf(f, "wps_nfc_dev_pw_id=%d\n",
@@ -1227,7 +1226,7 @@
 		int i;
 		fprintf(f, "freq_list=");
 		for (i = 0; config->freq_list[i]; i++) {
-			fprintf(f, "%s%u", i > 0 ? " " : "",
+			fprintf(f, "%s%d", i > 0 ? " " : "",
 				config->freq_list[i]);
 		}
 		fprintf(f, "\n");
@@ -1268,7 +1267,7 @@
 		fprintf(f, "preassoc_mac_addr=%d\n", config->preassoc_mac_addr);
 
 	if (config->key_mgmt_offload != DEFAULT_KEY_MGMT_OFFLOAD)
-		fprintf(f, "key_mgmt_offload=%u\n", config->key_mgmt_offload);
+		fprintf(f, "key_mgmt_offload=%d\n", config->key_mgmt_offload);
 
 	if (config->user_mpm != DEFAULT_USER_MPM)
 		fprintf(f, "user_mpm=%d\n", config->user_mpm);
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index dbb5a47..1c63e51 100644
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -20,8 +20,7 @@
 #define DEFAULT_PROTO (WPA_PROTO_WPA | WPA_PROTO_RSN)
 #define DEFAULT_KEY_MGMT (WPA_KEY_MGMT_PSK | WPA_KEY_MGMT_IEEE8021X)
 #define DEFAULT_PAIRWISE (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
-#define DEFAULT_GROUP (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP | \
-		       WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40)
+#define DEFAULT_GROUP (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
 #define DEFAULT_FRAGMENT_SIZE 1398
 
 #define DEFAULT_BG_SCAN_PERIOD -1
diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 0c5ea8f..d0d70e9 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -4595,6 +4595,14 @@
 	} else
 		search_delay = wpas_p2p_search_delay(wpa_s);
 
+	pos = os_strstr(cmd, "freq=");
+	if (pos) {
+		pos += 5;
+		freq = atoi(pos);
+		if (freq <= 0)
+			return -1;
+	}
+
 	/* Must be searched for last, because it adds nul termination */
 	pos = os_strstr(cmd, " seek=");
 	if (pos)
@@ -4617,14 +4625,6 @@
 		seek_count = 1;
 	}
 
-	pos = os_strstr(cmd, "freq=");
-	if (pos) {
-		pos += 5;
-		freq = atoi(pos);
-		if (freq <= 0)
-			return -1;
-	}
-
 	return wpas_p2p_find(wpa_s, timeout, type, _dev_type != NULL, _dev_type,
 			     _dev_id, search_delay, seek_count, seek, freq);
 }
diff --git a/wpa_supplicant/dbus/dbus_new.c b/wpa_supplicant/dbus/dbus_new.c
index a3bf1e3..1959ea7 100644
--- a/wpa_supplicant/dbus/dbus_new.c
+++ b/wpa_supplicant/dbus/dbus_new.c
@@ -1424,12 +1424,10 @@
 
 
 /**
- *
- * Method to emit Invitation Result signal based on status and
- * bssid
- * @status: Status of the Invite request. 0 for success, other
- * for errors
- * @bssid : Basic Service Set Identifier
+ * wpas_dbus_signal_p2p_invitation_result - Emit InvitationResult signal
+ * @wpa_s: %wpa_supplicant network interface data
+ * @status: Status of invitation process
+ * @bssid: Basic Service Set Identifier
  */
 void wpas_dbus_signal_p2p_invitation_result(struct wpa_supplicant *wpa_s,
 					    int status, const u8 *bssid)
@@ -3284,6 +3282,11 @@
 };
 
 
+/**
+ * wpas_dbus_register_interface - Register an interface with D-Bus
+ * @wpa_s: wpa_supplicant interface structure
+ * Returns: 0 on success, -1 on failure
+ */
 int wpas_dbus_register_interface(struct wpa_supplicant *wpa_s)
 {
 
@@ -3334,6 +3337,11 @@
 }
 
 
+/**
+ * wpas_dbus_unregister_interface - Unregister the interface from D-Bus
+ * @wpa_s: wpa_supplicant interface structure
+ * Returns: 0 on success, -1 on failure
+ */
 int wpas_dbus_unregister_interface(struct wpa_supplicant *wpa_s)
 {
 	struct wpas_dbus_priv *ctrl_iface;
@@ -3498,7 +3506,7 @@
 /**
  * wpas_dbus_signal_peer_found - Send a peer found signal
  * @wpa_s: %wpa_supplicant network interface data
- * @dev: peer device object
+ * @dev_addr: Peer P2P Device Address
  *
  * Notify listeners about find a p2p peer device found
  */
@@ -3513,7 +3521,7 @@
 /**
  * wpas_dbus_signal_peer_lost - Send a peer lost signal
  * @wpa_s: %wpa_supplicant network interface data
- * @dev: peer device object
+ * @dev_addr: Peer P2P Device Address
  *
  * Notify listeners about lost a p2p peer device
  */
@@ -3660,6 +3668,13 @@
 }
 
 
+/**
+ * wpas_dbus_signal_peer_groups_changed - Send peer group change property signal
+ * @wpa_s: %wpa_supplicant network interface data
+ * @dev_addr: P2P Device Address
+ *
+ * Notify listeners about peer Groups property changes.
+ */
 void wpas_dbus_signal_peer_groups_changed(struct wpa_supplicant *wpa_s,
 					  const u8 *dev_addr)
 {
diff --git a/wpa_supplicant/dbus/dbus_new_handlers.c b/wpa_supplicant/dbus/dbus_new_handlers.c
index 2a7e2cf..1c04e92 100644
--- a/wpa_supplicant/dbus/dbus_new_handlers.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers.c
@@ -214,7 +214,7 @@
 		} else if (entry.type == DBUS_TYPE_STRING) {
 			if (should_quote_opt(entry.key)) {
 				size = os_strlen(entry.str_value);
-				if (size <= 0)
+				if (size == 0)
 					goto error;
 
 				size += 3;
diff --git a/wpa_supplicant/dbus/dbus_new_handlers_wps.c b/wpa_supplicant/dbus/dbus_new_handlers_wps.c
index dcae0a9..b2251ba 100644
--- a/wpa_supplicant/dbus/dbus_new_handlers_wps.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers_wps.c
@@ -53,7 +53,7 @@
 	else if (os_strcmp(val, "registrar") == 0)
 		params->role = 2;
 	else {
-		wpa_printf(MSG_DEBUG, "dbus: WPS.Start - Uknown role %s", val);
+		wpa_printf(MSG_DEBUG, "dbus: WPS.Start - Unknown role %s", val);
 		*reply = wpas_dbus_error_invalid_args(message, val);
 		return -1;
 	}
@@ -113,7 +113,7 @@
 	dbus_message_iter_recurse(&variant_iter, &array_iter);
 	dbus_message_iter_get_fixed_array(&array_iter, &params->bssid, &len);
 	if (len != ETH_ALEN) {
-		wpa_printf(MSG_DEBUG, "dbus: WPS.Stsrt - Wrong Bssid length %d",
+		wpa_printf(MSG_DEBUG, "dbus: WPS.Start - Wrong Bssid length %d",
 			   len);
 		*reply = wpas_dbus_error_invalid_args(message,
 						      "Bssid is wrong length");
diff --git a/wpa_supplicant/dbus/dbus_old_handlers.c b/wpa_supplicant/dbus/dbus_old_handlers.c
index 0ffa1be..462c713 100644
--- a/wpa_supplicant/dbus/dbus_old_handlers.c
+++ b/wpa_supplicant/dbus/dbus_old_handlers.c
@@ -500,7 +500,7 @@
 	/* EAP methods */
 	eap_methods = eap_get_names_as_string_array(&num_items);
 	if (eap_methods) {
-		dbus_bool_t success = FALSE;
+		dbus_bool_t success;
 		size_t i = 0;
 
 		success = wpa_dbus_dict_append_string_array(
@@ -884,7 +884,7 @@
 			if (should_quote_opt(entry.key)) {
 				size = os_strlen(entry.str_value);
 				/* Zero-length option check */
-				if (size <= 0)
+				if (size == 0)
 					goto error;
 				size += 3;  /* For quotes and terminator */
 				value = os_zalloc(size);
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 7be352d..2dbc39f 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -1628,6 +1628,9 @@
 			if (wpa_supplicant_req_sched_scan(wpa_s))
 				wpa_supplicant_req_new_scan(wpa_s, timeout_sec,
 							    timeout_usec);
+
+			wpa_msg_ctrl(wpa_s, MSG_INFO,
+				     WPA_EVENT_NETWORK_NOT_FOUND);
 		}
 	}
 	return 0;
@@ -1685,7 +1688,7 @@
 #else /* CONFIG_NO_SCAN_PROCESSING */
 	struct os_reltime now;
 
-	if (wpa_s->last_scan_res_used <= 0)
+	if (wpa_s->last_scan_res_used == 0)
 		return -1;
 
 	os_get_reltime(&now);
diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
index 1788113..a472feb 100644
--- a/wpa_supplicant/sme.c
+++ b/wpa_supplicant/sme.c
@@ -67,7 +67,7 @@
 
 	for (;;) {
 		int group = groups[wpa_s->sme.sae_group_index];
-		if (group < 0)
+		if (group <= 0)
 			break;
 		if (sae_set_group(&wpa_s->sme.sae, group) == 0) {
 			wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
@@ -698,6 +698,8 @@
 		return -1;
 
 	if (auth_transaction == 1) {
+		u16 res;
+
 		groups = wpa_s->conf->sae_groups;
 
 		wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
@@ -708,8 +710,14 @@
 			return -1;
 		if (groups && groups[0] <= 0)
 			groups = NULL;
-		if (sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
-				     groups) != WLAN_STATUS_SUCCESS)
+		res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
+				       groups);
+		if (res == SAE_SILENTLY_DISCARD) {
+			wpa_printf(MSG_DEBUG,
+				   "SAE: Drop commit message due to reflection attack");
+			return 0;
+		}
+		if (res != WLAN_STATUS_SUCCESS)
 			return -1;
 
 		if (sae_process_commit(&wpa_s->sme.sae) < 0) {
@@ -831,12 +839,20 @@
 
 #ifdef CONFIG_IEEE80211R
 	if (data->auth.auth_type == WLAN_AUTH_FT) {
-		union wpa_event_data edata;
-		os_memset(&edata, 0, sizeof(edata));
-		edata.ft_ies.ies = data->auth.ies;
-		edata.ft_ies.ies_len = data->auth.ies_len;
-		os_memcpy(edata.ft_ies.target_ap, data->auth.peer, ETH_ALEN);
-		wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &edata);
+		if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
+					    data->auth.ies_len, 0,
+					    data->auth.peer, NULL, 0) < 0) {
+			wpa_dbg(wpa_s, MSG_DEBUG,
+				"SME: FT Authentication response processing failed");
+			wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
+				MACSTR
+				" reason=%d locally_generated=1",
+				MAC2STR(wpa_s->pending_bssid),
+				WLAN_REASON_DEAUTH_LEAVING);
+			wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
+			wpa_supplicant_mark_disassoc(wpa_s);
+			return;
+		}
 	}
 #endif /* CONFIG_IEEE80211R */
 
diff --git a/wpa_supplicant/wpa_gui-qt4/main.cpp b/wpa_supplicant/wpa_gui-qt4/main.cpp
index 39e01bf..bbd45c6 100644
--- a/wpa_supplicant/wpa_gui-qt4/main.cpp
+++ b/wpa_supplicant/wpa_gui-qt4/main.cpp
@@ -19,6 +19,7 @@
 	argc(argc),
 	argv(argv)
 {
+	w = NULL;
 }
 
 #if !defined(QT_NO_SESSIONMANAGER) && QT_VERSION < 0x050000