diff --git a/wpa_supplicant/Android.mk b/wpa_supplicant/Android.mk
index 1b5ea81..205d8b7 100644
--- a/wpa_supplicant/Android.mk
+++ b/wpa_supplicant/Android.mk
@@ -181,7 +181,7 @@
 LDFLAGS += -rdynamic
 L_CFLAGS += -funwind-tables
 ifdef CONFIG_WPA_TRACE_BFD
-L_CFLAGS += -DWPA_TRACE_BFD
+L_CFLAGS += -DWPA_TRACE_BFD -fno-inline -fno-optimize-sibling-calls
 LIBS += -lbfd
 LIBS_p += -lbfd
 LIBS_c += -lbfd
@@ -820,8 +820,10 @@
 CONFIG_IEEE8021X_EAPOL=y
 NEED_ECC=y
 NEED_DRAGONFLY=y
+ifndef CONFIG_FIPS
 MS_FUNCS=y
 endif
+endif
 
 ifdef CONFIG_EAP_EKE
 # EAP-EKE
diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index 49c1793..7718f94 100644
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -151,7 +151,7 @@
 LDFLAGS += -rdynamic
 CFLAGS += -funwind-tables
 ifdef CONFIG_WPA_TRACE_BFD
-CFLAGS += -DPACKAGE="wpa_supplicant" -DWPA_TRACE_BFD
+CFLAGS += -DPACKAGE="wpa_supplicant" -DWPA_TRACE_BFD -fno-inline -fno-optimize-sibling-calls
 LIBS += -lbfd -ldl -liberty -lz
 LIBS_p += -lbfd -ldl -liberty -lz
 LIBS_c += -lbfd -ldl -liberty -lz
@@ -832,8 +832,10 @@
 CONFIG_IEEE8021X_EAPOL=y
 NEED_ECC=y
 NEED_DRAGONFLY=y
+ifndef CONFIG_FIPS
 MS_FUNCS=y
 endif
+endif
 
 ifdef CONFIG_EAP_EKE
 # EAP-EKE
@@ -1194,6 +1196,7 @@
 endif
 
 ifeq ($(CONFIG_TLS), wolfssl)
+CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
 ifdef TLS_FUNCS
 CFLAGS += -DWOLFSSL_DER_LOAD
 OBJS += ../src/crypto/tls_wolfssl.o
diff --git a/wpa_supplicant/README-HS20 b/wpa_supplicant/README-HS20
index 7d30e23..f5488f2 100644
--- a/wpa_supplicant/README-HS20
+++ b/wpa_supplicant/README-HS20
@@ -618,28 +618,6 @@
 <3>ANQP fetch completed
 
 
-Hotspot 2.0 Rel 2 online signup and OSEN
-----------------------------------------
-
-Following parameters can be used to create a network profile for
-link-layer protected Hotspot 2.0 online signup connection with
-OSEN. Note that ssid and identify (NAI) values need to be set based on
-the information for the selected provider in the OSU Providers list
-ANQP-element.
-
-network={
-    ssid="HS 2.0 OSU"
-    proto=OSEN
-    key_mgmt=OSEN
-    pairwise=CCMP
-    group=GTK_NOT_USED
-    eap=WFA-UNAUTH-TLS
-    identity="anonymous@example.com"
-    ca_cert="osu-ca.pem"
-    ocsp=2
-}
-
-
 Hotspot 2.0 connection with external network selection
 ------------------------------------------------------
 
diff --git a/wpa_supplicant/aidl/vendor/aidl_manager.cpp b/wpa_supplicant/aidl/vendor/aidl_manager.cpp
index 24e5a56..c306e53 100644
--- a/wpa_supplicant/aidl/vendor/aidl_manager.cpp
+++ b/wpa_supplicant/aidl/vendor/aidl_manager.cpp
@@ -708,8 +708,6 @@
 			return KeyMgmtMask::WAPI_PSK;
 		case WPA_KEY_MGMT_WAPI_CERT:
 			return KeyMgmtMask::WAPI_CERT;
-		case WPA_KEY_MGMT_OSEN:
-			return KeyMgmtMask::OSEN;
 		case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
 		case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
 			return KeyMgmtMask::SUITE_B_192;
@@ -945,8 +943,7 @@
 			misc_utils::convertWpaBufToVector(
 			anqp->hs20_connection_capability);
 		aidl_hs20_anqp_data.osuProvidersList =
-			misc_utils::convertWpaBufToVector(
-			anqp->hs20_osu_providers_list);
+			misc_utils::convertWpaBufToVector(NULL);
 #else
 		aidl_hs20_anqp_data.operatorFriendlyName =
 			misc_utils::convertWpaBufToVector(NULL);
diff --git a/wpa_supplicant/aidl/vendor/aidl_manager.h b/wpa_supplicant/aidl/vendor/aidl_manager.h
index 667422f..73f77fa 100644
--- a/wpa_supplicant/aidl/vendor/aidl_manager.h
+++ b/wpa_supplicant/aidl/vendor/aidl_manager.h
@@ -352,10 +352,6 @@
 	WPA_KEY_MGMT_FT_PSK,
 	"KeyMgmt value mismatch");
 static_assert(
-	static_cast<uint32_t>(KeyMgmtMask::OSEN) ==
-	WPA_KEY_MGMT_OSEN,
-	"KeyMgmt value mismatch");
-static_assert(
 	static_cast<uint32_t>(KeyMgmtMask::SAE) ==
 	WPA_KEY_MGMT_SAE,
 	"KeyMgmt value mismatch");
@@ -392,10 +388,6 @@
 	WPA_PROTO_RSN,
 	"Proto value mismatch");
 static_assert(
-	static_cast<uint32_t>(ProtoMask::OSEN) ==
-	WPA_PROTO_OSEN,
-	"Proto value mismatch");
-static_assert(
 	static_cast<uint32_t>(ProtoMask::WAPI) ==
 	WPA_PROTO_WAPI,
 	"Proto value mismatch");
@@ -512,11 +504,6 @@
 	Hs20AnqpSubtypes::CONNECTION_CAPABILITY) ==
 	HS20_STYPE_CONNECTION_CAPABILITY,
 	"HS Subtype value mismatch");
-static_assert(
-	static_cast<uint32_t>(
-	Hs20AnqpSubtypes::OSU_PROVIDERS_LIST) ==
-	HS20_STYPE_OSU_PROVIDERS_LIST,
-	"HS Subtype value mismatch");
 
 static_assert(
 	static_cast<uint16_t>(
diff --git a/wpa_supplicant/aidl/vendor/p2p_iface.cpp b/wpa_supplicant/aidl/vendor/p2p_iface.cpp
index 16c5536..695cc0b 100644
--- a/wpa_supplicant/aidl/vendor/p2p_iface.cpp
+++ b/wpa_supplicant/aidl/vendor/p2p_iface.cpp
@@ -1260,7 +1260,7 @@
 	}
 	// TODO Handle pairing bootstrapping method when supplicant implementation is ready
 	if (wpas_p2p_prov_disc(
-		wpa_s, peer_address.data(), config_method_str,
+		wpa_s, peer_address.data(), config_method_str, 0,
 		WPAS_P2P_PD_FOR_GO_NEG, nullptr)) {
 		return createStatus(SupplicantStatusCode::FAILURE_UNKNOWN);
 	}
diff --git a/wpa_supplicant/aidl/vendor/sta_iface.cpp b/wpa_supplicant/aidl/vendor/sta_iface.cpp
index f6868d0..3fe0030 100644
--- a/wpa_supplicant/aidl/vendor/sta_iface.cpp
+++ b/wpa_supplicant/aidl/vendor/sta_iface.cpp
@@ -1345,22 +1345,7 @@
 ndk::ScopedAStatus StaIface::initiateHs20IconQueryInternal(
 	const std::vector<uint8_t> &mac_address, const std::string &file_name)
 {
-#ifdef CONFIG_HS20
-	struct wpa_supplicant *wpa_s = retrieveIfacePtr();
-	if (mac_address.size() != ETH_ALEN) {
-		return createStatus(SupplicantStatusCode::FAILURE_UNKNOWN);
-	}
-	wpa_s->fetch_osu_icon_in_progress = 0;
-	if (hs20_anqp_send_req(
-		wpa_s, mac_address.data(), BIT(HS20_STYPE_ICON_REQUEST),
-		reinterpret_cast<const uint8_t *>(file_name.c_str()),
-		file_name.size(), true)) {
-		return createStatus(SupplicantStatusCode::FAILURE_UNKNOWN);
-	}
-	return ndk::ScopedAStatus::ok();
-#else
 	return createStatus(SupplicantStatusCode::FAILURE_UNSUPPORTED);
-#endif /* CONFIG_HS20 */
 }
 
 std::pair<std::vector<uint8_t>, ndk::ScopedAStatus>
diff --git a/wpa_supplicant/bss.c b/wpa_supplicant/bss.c
index 10ebab0..0afac49 100644
--- a/wpa_supplicant/bss.c
+++ b/wpa_supplicant/bss.c
@@ -91,9 +91,6 @@
 	ANQP_DUP(hs20_wan_metrics);
 	ANQP_DUP(hs20_connection_capability);
 	ANQP_DUP(hs20_operating_class);
-	ANQP_DUP(hs20_osu_providers_list);
-	ANQP_DUP(hs20_operator_icon_metadata);
-	ANQP_DUP(hs20_osu_providers_nai_list);
 #endif /* CONFIG_HS20 */
 #undef ANQP_DUP
 
@@ -176,9 +173,6 @@
 	wpabuf_free(anqp->hs20_wan_metrics);
 	wpabuf_free(anqp->hs20_connection_capability);
 	wpabuf_free(anqp->hs20_operating_class);
-	wpabuf_free(anqp->hs20_osu_providers_list);
-	wpabuf_free(anqp->hs20_operator_icon_metadata);
-	wpabuf_free(anqp->hs20_osu_providers_nai_list);
 #endif /* CONFIG_HS20 */
 
 	os_free(anqp);
@@ -220,6 +214,7 @@
 		    const char *reason)
 {
 	struct wpa_connect_work *cwork;
+	unsigned int j;
 
 	if (wpa_s->last_scan_res) {
 		unsigned int i;
@@ -245,6 +240,45 @@
 		wpa_ssid_txt(bss->ssid, bss->ssid_len), reason);
 	wpas_notify_bss_removed(wpa_s, bss->bssid, bss->id);
 	wpa_bss_anqp_free(bss->anqp);
+
+	if (wpa_s->current_bss == bss) {
+		wpa_printf(MSG_DEBUG,
+			   "BSS: Clear current_bss due to bss removal");
+		wpa_s->current_bss = NULL;
+	}
+
+#ifdef CONFIG_INTERWORKING
+	if (wpa_s->interworking_gas_bss == bss) {
+		wpa_printf(MSG_DEBUG,
+			   "BSS: Clear interworking_gas_bss due to bss removal");
+		wpa_s->interworking_gas_bss = NULL;
+	}
+#endif /* CONFIG_INTERWORKING */
+
+#ifdef CONFIG_WNM
+	if (wpa_s->wnm_target_bss == bss) {
+		wpa_printf(MSG_DEBUG,
+			   "BSS: Clear wnm_target_bss due to bss removal");
+		wpa_s->wnm_target_bss = NULL;
+	}
+#endif /* CONFIG_WNM */
+
+	if (wpa_s->ml_connect_probe_bss == bss) {
+		wpa_printf(MSG_DEBUG,
+			   "BSS: Clear ml_connect_probe_bss due to bss removal");
+		wpa_s->ml_connect_probe_bss = NULL;
+	}
+
+	for (j = 0; j < MAX_NUM_MLD_LINKS; j++) {
+		if (wpa_s->links[j].bss == bss) {
+			wpa_printf(MSG_DEBUG,
+				   "BSS: Clear links[%d].bss due to bss removal",
+				   j);
+			wpa_s->valid_links &= ~BIT(j);
+			wpa_s->links[j].bss = NULL;
+		}
+	}
+
 	os_free(bss);
 }
 
@@ -423,6 +457,28 @@
 }
 
 
+#ifdef CONFIG_OWE
+static int wpa_bss_owe_trans_known(struct wpa_supplicant *wpa_s,
+				   struct wpa_bss *bss,
+				   const u8 *entry_ssid, size_t entry_ssid_len)
+{
+	const u8 *owe, *owe_bssid, *owe_ssid;
+	size_t owe_ssid_len;
+
+	owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
+	if (!owe)
+		return 0;
+
+	if (wpas_get_owe_trans_network(owe, &owe_bssid, &owe_ssid,
+				       &owe_ssid_len))
+		return 0;
+
+	return entry_ssid_len == owe_ssid_len &&
+		os_memcmp(owe_ssid, entry_ssid, owe_ssid_len) == 0;
+}
+#endif /* CONFIG_OWE */
+
+
 static int wpa_bss_known(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 {
 	struct wpa_ssid *ssid;
@@ -436,6 +492,11 @@
 		if (ssid->ssid_len == bss->ssid_len &&
 		    os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) == 0)
 			return 1;
+#ifdef CONFIG_OWE
+		if (wpa_bss_owe_trans_known(wpa_s, bss, ssid->ssid,
+					    ssid->ssid_len))
+			return 1;
+#endif /* CONFIG_OWE */
 	}
 
 	return 0;
@@ -486,6 +547,7 @@
 
 	dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
 		if (!wpa_bss_known(wpa_s, bss) &&
+		    !wpa_bss_in_use(wpa_s, bss) &&
 		    !wpa_bss_is_wps_candidate(wpa_s, bss)) {
 			wpa_bss_remove(wpa_s, bss, __func__);
 			return 0;
@@ -796,9 +858,17 @@
 		struct wpa_bss *nbss;
 		struct dl_list *prev = bss->list_id.prev;
 		struct wpa_connect_work *cwork;
-		unsigned int i;
+		unsigned int i, j;
 		bool update_current_bss = wpa_s->current_bss == bss;
 		bool update_ml_probe_bss = wpa_s->ml_connect_probe_bss == bss;
+		int update_link_bss = -1;
+
+		for (j = 0; j < MAX_NUM_MLD_LINKS; j++) {
+			if (wpa_s->links[j].bss == bss) {
+				update_link_bss = j;
+				break;
+			}
+		}
 
 		cwork = wpa_bss_check_pending_connect(wpa_s, bss);
 
@@ -820,6 +890,9 @@
 			if (update_ml_probe_bss)
 				wpa_s->ml_connect_probe_bss = nbss;
 
+			if (update_link_bss >= 0)
+				wpa_s->links[update_link_bss].bss = nbss;
+
 			if (cwork)
 				wpa_bss_update_pending_connect(cwork, nbss);
 
@@ -1591,12 +1664,9 @@
 	pos += sizeof(*ap_info);
 
 	for (i = 0; i < count; i++, pos += ap_info->tbtt_info_len) {
-		u8 bss_params;
-
 		if (end - pos < ap_info->tbtt_info_len)
 			break;
 
-		bss_params = pos[1 + ETH_ALEN + 4];
 		mld_params = pos + mld_params_offset;
 
 		link_id = *(mld_params + 1) & EHT_ML_LINK_ID_MSK;
@@ -1623,10 +1693,8 @@
 			if (!neigh_bss) {
 				*missing |= BIT(link_id);
 			} else if ((!ssid ||
-				    (bss_params & (RNR_BSS_PARAM_SAME_SSID |
-						   RNR_BSS_PARAM_CO_LOCATED)) ||
 				    wpa_scan_res_match(wpa_s, 0, neigh_bss,
-						       ssid, 1, 0)) &&
+						       ssid, 1, 0, true)) &&
 				   !wpa_bssid_ignore_is_listed(
 					   wpa_s, neigh_bss->bssid)) {
 				struct mld_link *l;
@@ -1865,8 +1933,9 @@
 	const u8 *pos = wpa_bss_ie_ptr(bss);
 	size_t len = bss->ie_len ? bss->ie_len : bss->beacon_ie_len;
 	const struct ieee80211_eht_ml *ml;
+	const struct eht_ml_reconf_common_info *common_info;
 	u16 removed_links = 0;
-	u8 ml_common_len;
+	u8 expected_ml_common_len;
 
 	if (ieee802_11_parse_elems(pos, len, &elems, 1) == ParseFailed)
 		return 0;
@@ -1881,22 +1950,33 @@
 	ml = (const struct ieee80211_eht_ml *) wpabuf_head(mlbuf);
 	len = wpabuf_len(mlbuf);
 
-	if (len < sizeof(*ml))
+	/* There must be at least one octet for the Common Info Length subfield
+	 */
+	if (len < sizeof(*ml) + 1UL)
 		goto out;
 
-	ml_common_len = 1;
-	if (ml->ml_control & RECONF_MULTI_LINK_CTRL_PRES_MLD_MAC_ADDR)
-		ml_common_len += ETH_ALEN;
+	expected_ml_common_len = 1;
+	if (le_to_host16(ml->ml_control) &
+	    RECONF_MULTI_LINK_CTRL_PRES_MLD_MAC_ADDR)
+		expected_ml_common_len += ETH_ALEN;
 
-	if (len < sizeof(*ml) + ml_common_len) {
+	common_info = (const struct eht_ml_reconf_common_info *) ml->variable;
+	if (len < sizeof(*ml) + common_info->len) {
 		wpa_printf(MSG_DEBUG,
 			   "MLD: Unexpected Reconfiguration ML element length: (%zu < %zu)",
-			   len, sizeof(*ml) + ml_common_len);
+			   len, sizeof(*ml) + common_info->len);
 		goto out;
 	}
 
-	pos = ml->variable + ml_common_len;
-	len -= sizeof(*ml) + ml_common_len;
+	if (common_info->len < expected_ml_common_len) {
+		wpa_printf(MSG_DEBUG,
+			   "MLD: Invalid common info len=%u; min expected=%u",
+			   common_info->len, expected_ml_common_len);
+		goto out;
+	}
+
+	pos = ml->variable + common_info->len;
+	len -= sizeof(*ml) + common_info->len;
 
 	while (len >= 2 + sizeof(struct ieee80211_eht_per_sta_profile)) {
 		size_t sub_elem_len = *(pos + 1);
@@ -1908,7 +1988,8 @@
 			goto out;
 		}
 
-		if  (*pos == EHT_ML_SUB_ELEM_PER_STA_PROFILE) {
+		if  (*pos == EHT_ML_SUB_ELEM_PER_STA_PROFILE &&
+		     sub_elem_len >= 2) {
 			const struct ieee80211_eht_per_sta_profile *sta_prof =
 				(const struct ieee80211_eht_per_sta_profile *)
 				(pos + 2);
diff --git a/wpa_supplicant/bss.h b/wpa_supplicant/bss.h
index 31688fa..74ef3c8 100644
--- a/wpa_supplicant/bss.h
+++ b/wpa_supplicant/bss.h
@@ -61,9 +61,6 @@
 	struct wpabuf *hs20_wan_metrics;
 	struct wpabuf *hs20_connection_capability;
 	struct wpabuf *hs20_operating_class;
-	struct wpabuf *hs20_osu_providers_list;
-	struct wpabuf *hs20_operator_icon_metadata;
-	struct wpabuf *hs20_osu_providers_nai_list;
 #endif /* CONFIG_HS20 */
 };
 
diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index 9fe83a5..47d9e6d 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -693,8 +693,6 @@
 		else if (os_strcmp(start, "RSN") == 0 ||
 			 os_strcmp(start, "WPA2") == 0)
 			val |= WPA_PROTO_RSN;
-		else if (os_strcmp(start, "OSEN") == 0)
-			val |= WPA_PROTO_OSEN;
 		else {
 			wpa_printf(MSG_ERROR, "Line %d: invalid proto '%s'",
 				   line, start);
@@ -749,14 +747,6 @@
 		pos += ret;
 	}
 
-	if (ssid->proto & WPA_PROTO_OSEN) {
-		ret = os_snprintf(pos, end - pos, "%sOSEN",
-				  pos == buf ? "" : " ");
-		if (os_snprintf_error(end - pos, ret))
-			return buf;
-		pos += ret;
-	}
-
 	if (pos == buf) {
 		os_free(buf);
 		buf = NULL;
@@ -831,10 +821,6 @@
 		else if (os_strcmp(start, "FT-SAE-EXT-KEY") == 0)
 			val |= WPA_KEY_MGMT_FT_SAE_EXT_KEY;
 #endif /* CONFIG_SAE */
-#ifdef CONFIG_HS20
-		else if (os_strcmp(start, "OSEN") == 0)
-			val |= WPA_KEY_MGMT_OSEN;
-#endif /* CONFIG_HS20 */
 #ifdef CONFIG_SUITEB
 		else if (os_strcmp(start, "WPA-EAP-SUITE-B") == 0)
 			val |= WPA_KEY_MGMT_IEEE8021X_SUITE_B;
@@ -1071,18 +1057,6 @@
 	}
 #endif /* CONFIG_SAE */
 
-#ifdef CONFIG_HS20
-	if (ssid->key_mgmt & WPA_KEY_MGMT_OSEN) {
-		ret = os_snprintf(pos, end - pos, "%sOSEN",
-				  pos == buf ? "" : " ");
-		if (os_snprintf_error(end - pos, ret)) {
-			end[-1] = '\0';
-			return buf;
-		}
-		pos += ret;
-	}
-#endif /* CONFIG_HS20 */
-
 #ifdef CONFIG_SUITEB
 	if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
 		ret = os_snprintf(pos, end - pos, "%sWPA-EAP-SUITE-B",
@@ -2138,7 +2112,27 @@
 }
 
 
+static int wpa_config_parse_p2p2_client_list(const struct parse_data *data,
+					     struct wpa_ssid *ssid, int line,
+					     const char *value)
+{
+	int *ids = wpa_config_parse_int_array(value);
+
+	if (!ids) {
+		wpa_printf(MSG_ERROR, "Line %d: Invalid p2p2_client_list '%s'",
+			   line, value);
+		return -1;
+	}
+
+	os_free(ssid->p2p2_client_list);
+	ssid->p2p2_client_list = ids;
+
+	return 0;
+}
+
+
 #ifndef NO_CONFIG_WRITE
+
 static char * wpa_config_write_p2p_client_list(const struct parse_data *data,
 					       struct wpa_ssid *ssid)
 {
@@ -2146,6 +2140,14 @@
 					  ssid->num_p2p_clients,
 					  "p2p_client_list");
 }
+
+
+static char * wpa_config_write_p2p2_client_list(const struct parse_data *data,
+						struct wpa_ssid *ssid)
+{
+	return wpa_config_write_freqs(data, ssid->p2p2_client_list);
+}
+
 #endif /* NO_CONFIG_WRITE */
 
 
@@ -2672,7 +2674,9 @@
 #ifdef CONFIG_P2P
 	{ FUNC(go_p2p_dev_addr) },
 	{ FUNC(p2p_client_list) },
+	{ FUNC(p2p2_client_list) },
 	{ FUNC(psk_list) },
+	{ INT(go_dik_id) },
 #endif /* CONFIG_P2P */
 #ifdef CONFIG_HT_OVERRIDES
 	{ INT_RANGE(disable_ht, 0, 1) },
@@ -2723,6 +2727,7 @@
 	{ INT_RANGE(macsec_port, 1, 65534) },
 	{ INT_RANGE(mka_priority, 0, 255) },
 	{ INT_RANGE(macsec_csindex, 0, 1) },
+	{ INT_RANGE(macsec_icv_indicator, 0, 1) },
 	{ FUNC_KEY(mka_cak) },
 	{ FUNC_KEY(mka_ckn) },
 #endif /* CONFIG_MACSEC */
@@ -2939,6 +2944,7 @@
 	os_free(ssid->freq_list);
 	os_free(ssid->bgscan);
 	os_free(ssid->p2p_client_list);
+	os_free(ssid->p2p2_client_list);
 	os_free(ssid->bssid_ignore);
 	os_free(ssid->bssid_accept);
 #ifdef CONFIG_HT_OVERRIDES
@@ -3094,7 +3100,6 @@
 	os_free(config->sae_groups);
 	wpabuf_free(config->ap_vendor_elements);
 	wpabuf_free(config->ap_assocresp_elements);
-	os_free(config->osu_dir);
 	os_free(config->bgscan);
 	os_free(config->wowlan_triggers);
 	os_free(config->fst_group_id);
@@ -3160,6 +3165,35 @@
 }
 
 
+#ifdef CONFIG_P2P
+/**
+ * wpa_config_get_network_with_dik_id - Get configured network based on ID of
+ *	device identity block
+ * @config: Configuration data from wpa_config_read()
+ * @dik_id: DIK ID to search for
+ * Returns: Network configuration or %NULL if not found
+ */
+struct wpa_ssid * wpa_config_get_network_with_dik_id(struct wpa_config *config,
+						     int dik_id)
+{
+	struct wpa_ssid *ssid;
+
+	for (ssid = config->ssid; ssid; ssid = ssid->next) {
+		if (ssid->disabled != 2)
+			continue;
+
+		if (ssid->go_dik_id == dik_id)
+			return ssid;
+
+		if (int_array_includes(ssid->p2p2_client_list, dik_id))
+			return ssid;
+	}
+
+	return NULL;
+}
+#endif /* CONFIG_P2P */
+
+
 /**
  * wpa_config_add_network - Add a new network with empty configuration
  * @config: Configuration data from wpa_config_read()
@@ -4841,6 +4875,46 @@
 }
 
 
+static int wpa_global_config_parse_bool(const struct global_parse_data *data,
+					struct wpa_config *config, int line,
+					const char *pos)
+{
+	int val;
+	bool *dst;
+	char *end;
+	bool same;
+
+	dst = (bool *) (((u8 *) config) + (long) data->param1);
+	val = strtol(pos, &end, 0);
+	if (*end) {
+		wpa_printf(MSG_ERROR, "Line %d: invalid number \"%s\"",
+			   line, pos);
+		return -1;
+	}
+
+	if (val < 0) {
+		wpa_printf(MSG_ERROR,
+			   "Line %d: too small %s (value=%d min_value=0)",
+			   line, data->name, val);
+		return -1;
+	}
+
+	if (val > 1) {
+		wpa_printf(MSG_ERROR,
+			   "Line %d: too large %s (value=%d max_value=1)",
+			   line, data->name, val);
+		return -1;
+	}
+
+	same = *dst == val;
+	*dst = val;
+
+	wpa_printf(MSG_DEBUG, "%s=%d", data->name, *dst);
+
+	return same;
+}
+
+
 static int wpa_global_config_parse_str(const struct global_parse_data *data,
 				       struct wpa_config *config, int line,
 				       const char *pos)
@@ -5331,6 +5405,18 @@
 }
 
 
+static int wpa_config_get_bool(const char *name, struct wpa_config *config,
+			       long offset, char *buf, size_t buflen,
+			       int pretty_print)
+{
+	bool *val = (bool*) (((u8 *) config) + (long) offset);
+
+	if (pretty_print)
+		return os_snprintf(buf, buflen, "%s=%d\n", name, *val);
+	return os_snprintf(buf, buflen, "%d", *val);
+}
+
+
 static int wpa_config_get_str(const char *name, struct wpa_config *config,
 			      long offset, char *buf, size_t buflen,
 			      int pretty_print)
@@ -5406,6 +5492,8 @@
 #define INT(f) _INT(f), NULL, NULL
 #define INT_RANGE(f, min, max) #f, wpa_global_config_parse_int_range, \
 	wpa_config_get_int, OFFSET(f), (void *) min, (void *) max
+#define BOOL(f) #f, wpa_global_config_parse_bool, wpa_config_get_bool, \
+		OFFSET(f), NULL, NULL
 #define _STR(f) #f, wpa_global_config_parse_str, wpa_config_get_str, OFFSET(f)
 #define STR(f) _STR(f), NULL, NULL
 #define STR_RANGE(f, min, max) _STR(f), (void *) min, (void *) max
@@ -5510,13 +5598,13 @@
 	{ INT(p2p_interface_random_mac_addr), 0 },
 	{ INT(p2p_6ghz_disable), 0 },
 	{ INT(p2p_dfs_chan_enable), 0 },
-	{ INT_RANGE(p2p_pairing_setup, 0, 1), 0 },
-	{ INT_RANGE(p2p_pairing_cache, 0, 1), 0 },
+	{ BOOL(p2p_pairing_setup), 0 },
+	{ BOOL(p2p_pairing_cache), 0 },
 	{ INT(p2p_bootstrap_methods), 0 },
 	{ INT(p2p_pasn_type), 0 },
 	{ INT(p2p_comeback_after), 0 },
-	{ INT_RANGE(p2p_twt_power_mgmt, 0, 1), 0 },
-	{ INT_RANGE(p2p_chan_switch_req_enable, 0, 1), 0 },
+	{ BOOL(p2p_twt_power_mgmt), 0 },
+	{ BOOL(p2p_chan_switch_req_enable), 0 },
 	{ INT(p2p_reg_info), 0 },
 	{ INT(dik_cipher), 0},
 	{ BIN(dik), 0 },
@@ -5569,7 +5657,6 @@
 	{ INT(sched_scan_interval), 0 },
 	{ INT(sched_scan_start_delay), 0 },
 	{ INT(tdls_external_control), 0},
-	{ STR(osu_dir), 0 },
 	{ STR(wowlan_triggers), CFG_CHANGED_WOWLAN_TRIGGERS },
 	{ INT(p2p_search_delay), 0},
 	{ INT_RANGE(mac_addr, 0, 2), 0 },
@@ -5598,7 +5685,7 @@
 	{ INT(gas_address3), 0 },
 	{ INT_RANGE(ftm_responder, 0, 1), 0 },
 	{ INT_RANGE(ftm_initiator, 0, 1), 0 },
-	{ INT_RANGE(twt_requester, 0, 1), 0 },
+	{ BOOL(twt_requester), 0 },
 	{ INT(gas_rand_addr_lifetime), 0 },
 	{ INT_RANGE(gas_rand_mac_addr, 0, 2), 0 },
 #ifdef CONFIG_DPP
@@ -5628,7 +5715,7 @@
 	{ INT_RANGE(mld_connect_band_pref, 0, MLD_CONNECT_BAND_PREF_MAX), 0 },
 	{ FUNC(mld_connect_bssid_pref), 0 },
 #endif /* CONFIG_TESTING_OPTIONS */
-	{ INT_RANGE(ft_prepend_pmkid, 0, 1), CFG_CHANGED_FT_PREPEND_PMKID },
+	{ BOOL(ft_prepend_pmkid), CFG_CHANGED_FT_PREPEND_PMKID },
 	{ INT_RANGE(wfa_gen_capa, 0, 2), 0},
 	{ BIN(wfa_gen_capa_supp), 0 },
 	{ BIN(wfa_gen_capa_cert), 0 },
@@ -5638,9 +5725,11 @@
 };
 
 #undef FUNC
+#undef FUNC_NO_VAR
 #undef _INT
 #undef INT
 #undef INT_RANGE
+#undef BOOL
 #undef _STR
 #undef STR
 #undef STR_RANGE
@@ -5873,7 +5962,7 @@
 	int id;
 	struct wpa_dev_ik *identity, *last = NULL;
 
-	id = -1;
+	id = 0;
 	identity = config->identity;
 	while (identity) {
 		if (identity->id > id)
diff --git a/wpa_supplicant/config.h b/wpa_supplicant/config.h
index 0643114..c8859ea 100644
--- a/wpa_supplicant/config.h
+++ b/wpa_supplicant/config.h
@@ -1450,15 +1450,6 @@
 	u8 ip_addr_end[4];
 
 	/**
-	 * osu_dir - OSU provider information directory
-	 *
-	 * If set, allow FETCH_OSU control interface command to be used to fetch
-	 * OSU provider information into all APs and store the results in this
-	 * directory.
-	 */
-	char *osu_dir;
-
-	/**
 	 * wowlan_triggers - Wake-on-WLAN triggers
 	 *
 	 * If set, these wowlan triggers will be configured.
@@ -1950,6 +1941,8 @@
 				void (*func)(void *, struct wpa_ssid *),
 				void *arg);
 struct wpa_ssid * wpa_config_get_network(struct wpa_config *config, int id);
+struct wpa_ssid * wpa_config_get_network_with_dik_id(struct wpa_config *config,
+						     int dik_id);
 struct wpa_ssid * wpa_config_add_network(struct wpa_config *config);
 int wpa_config_remove_network(struct wpa_config *config, int id);
 void wpa_config_set_network_defaults(struct wpa_ssid *ssid);
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index 4029d49..331726c 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -367,7 +367,7 @@
 	struct wpa_config *config;
 	static int id = 0;
 	static int cred_id = 0;
-	static int identity_id = 0;
+	static int identity_id = 1;
 
 	if (name == NULL)
 		return NULL;
@@ -698,6 +698,17 @@
 }
 
 
+static void write_p2p2_client_list(FILE *f, struct wpa_ssid *ssid)
+{
+	char *value = wpa_config_get(ssid, "p2p2_client_list");
+
+	if (!value)
+		return;
+	fprintf(f, "\tp2p2_client_list=%s\n", value);
+	os_free(value);
+}
+
+
 static void write_psk_list(FILE *f, struct wpa_ssid *ssid)
 {
 	struct psk_list_entry *psk;
@@ -856,7 +867,7 @@
 #endif /* IEEE8021X_EAPOL */
 	INT(mode);
 	INT(no_auto_peer);
-	INT(mesh_fwding);
+	INT_DEF(mesh_fwding, DEFAULT_MESH_FWDING);
 	INT(frequency);
 	INT(enable_edmg);
 	INT(edmg_channel);
@@ -883,7 +894,9 @@
 #ifdef CONFIG_P2P
 	write_go_p2p_dev_addr(f, ssid);
 	write_p2p_client_list(f, ssid);
+	write_p2p2_client_list(f, ssid);
 	write_psk_list(f, ssid);
+	INT(go_dik_id);
 #endif /* CONFIG_P2P */
 	INT(ap_max_inactivity);
 	INT(dtim_period);
@@ -899,6 +912,7 @@
 	INT(macsec_port);
 	INT_DEF(mka_priority, DEFAULT_PRIO_NOT_KEY_SERVER);
 	INT(macsec_csindex);
+	INT(macsec_icv_indicator);
 #endif /* CONFIG_MACSEC */
 #ifdef CONFIG_HS20
 	INT(update_identifier);
@@ -1673,9 +1687,6 @@
 	if (config->twt_requester)
 		fprintf(f, "twt_requester=%d\n", config->twt_requester);
 
-	if (config->osu_dir)
-		fprintf(f, "osu_dir=%s\n", config->osu_dir);
-
 	if (config->fst_group_id)
 		fprintf(f, "fst_group_id=%s\n", config->fst_group_id);
 	if (config->fst_priority)
diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index 92ee234..7d275cd 100644
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -695,6 +695,15 @@
 	 */
 	size_t num_p2p_clients;
 
+	/**
+	 * p2p2_client_list - Array of P2P2 Clients in a persistent group (GO)
+	 *
+	 * This is an int_array of P2P2 Clients (ID of device Identity block)
+	 * that have joined the persistent group. This is maintained on the GO
+	 *for persistent group entries (disabled == 2).
+	 */
+	int *p2p2_client_list;
+
 #ifndef P2P_MAX_STORED_CLIENTS
 #define P2P_MAX_STORED_CLIENTS 100
 #endif /* P2P_MAX_STORED_CLIENTS */
@@ -982,6 +991,14 @@
 	int macsec_csindex;
 
 	/**
+	 * macsec_icv_indicator - Always include ICV Indicator
+	 * (for compatibility with older MACsec switches)
+	 *
+	 * Range: 0-1 (default: 0)
+	 */
+	int macsec_icv_indicator;
+
+	/**
 	 * mka_ckn - MKA pre-shared CKN
 	 */
 #define MACSEC_CKN_MAX_LEN 32
@@ -1312,6 +1329,12 @@
 	 * p2p_mode - P2P R1 only, P2P R2 only, or PCC mode
 	 */
 	enum wpa_p2p_mode p2p_mode;
+
+	/**
+	 * go_dik_id - ID of Device Identity block of group owner
+	 */
+	int go_dik_id;
+
 };
 
 #endif /* CONFIG_SSID_H */
diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 43d1a66..94fcec5 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -3014,14 +3014,6 @@
 	}
 #endif /* CONFIG_DPP */
 
-	if (data.key_mgmt & WPA_KEY_MGMT_OSEN) {
-		ret = os_snprintf(pos, end - pos, "%sOSEN",
-				  pos == start ? "" : "+");
-		if (os_snprintf_error(end - pos, ret))
-			return pos;
-		pos += ret;
-	}
-
 #ifdef CONFIG_SHA384
 	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384) {
 		ret = os_snprintf(pos, end - pos, "%sEAP-SHA384",
@@ -3099,7 +3091,7 @@
 {
 	char *pos, *end;
 	int ret;
-	const u8 *ie, *ie2, *osen_ie, *p2p, *mesh, *owe, *rsnxe;
+	const u8 *ie, *ie2, *p2p, *mesh, *owe, *rsnxe;
 
 	mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
 	p2p = wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE);
@@ -3139,10 +3131,6 @@
 			return -1;
 		pos += ret;
 	}
-	osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
-	if (osen_ie)
-		pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
-					    osen_ie, 2 + osen_ie[1]);
 	owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
 	if (owe) {
 		ret = os_snprintf(pos, end - pos,
@@ -3152,7 +3140,7 @@
 		pos += ret;
 	}
 	pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
-	if (!ie && !ie2 && !osen_ie && (bss->caps & IEEE80211_CAP_PRIVACY)) {
+	if (!ie && !ie2 && (bss->caps & IEEE80211_CAP_PRIVACY)) {
 		ret = os_snprintf(pos, end - pos, "[WEP]");
 		if (os_snprintf_error(end - pos, ret))
 			return -1;
@@ -4462,14 +4450,6 @@
 		pos += ret;
 	}
 #endif /* CONFIG_SHA256 */
-#ifdef CONFIG_HS20
-	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_OSEN) {
-		ret = os_snprintf(pos, end - pos, " OSEN");
-		if (os_snprintf_error(end - pos, ret))
-			return pos - buf;
-		pos += ret;
-	}
-#endif /* CONFIG_HS20 */
 
 	return pos - buf;
 }
@@ -4962,6 +4942,28 @@
 		return res;
 	}
 
+#ifdef CONFIG_P2P
+	if (os_strcmp(field, "p2p2") == 0) {
+		if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_P2P_FEATURE_V2)
+			res = os_snprintf(buf, buflen, "supported");
+		else
+			res = os_snprintf(buf, buflen, "not supported");
+		if (os_snprintf_error(buflen, res))
+			return -1;
+		return res;
+	}
+
+	if (os_strcmp(field, "pcc_mode") == 0) {
+		if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_P2P_FEATURE_PCC_MODE)
+			res = os_snprintf(buf, buflen, "supported");
+		else
+			res = os_snprintf(buf, buflen, "not supported");
+		if (os_snprintf_error(buflen, res))
+			return -1;
+		return res;
+	}
+#endif /* CONFIG_P2P */
+
 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
 		   field);
 
@@ -5331,7 +5333,7 @@
 	size_t i;
 	int ret;
 	char *pos, *end;
-	const u8 *ie, *ie2, *osen_ie, *mesh, *owe, *rsnxe;
+	const u8 *ie, *ie2, *mesh, *owe, *rsnxe;
 
 	pos = buf;
 	end = buf + buflen;
@@ -5464,10 +5466,6 @@
 				return 0;
 			pos += ret;
 		}
-		osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
-		if (osen_ie)
-			pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
-						    osen_ie, 2 + osen_ie[1]);
 		owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
 		if (owe) {
 			ret = os_snprintf(
@@ -5478,7 +5476,7 @@
 			pos += ret;
 		}
 		pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
-		if (!ie && !ie2 && !osen_ie &&
+		if (!ie && !ie2 &&
 		    (bss->caps & IEEE80211_CAP_PRIVACY)) {
 			ret = os_snprintf(pos, end - pos, "[WEP]");
 			if (os_snprintf_error(end - pos, ret))
@@ -5666,12 +5664,6 @@
 				   anqp->hs20_connection_capability);
 		pos = anqp_add_hex(pos, end, "hs20_operating_class",
 				   anqp->hs20_operating_class);
-		pos = anqp_add_hex(pos, end, "hs20_osu_providers_list",
-				   anqp->hs20_osu_providers_list);
-		pos = anqp_add_hex(pos, end, "hs20_operator_icon_metadata",
-				   anqp->hs20_operator_icon_metadata);
-		pos = anqp_add_hex(pos, end, "hs20_osu_providers_nai_list",
-				   anqp->hs20_osu_providers_nai_list);
 #endif /* CONFIG_HS20 */
 
 		dl_list_for_each(elem, &anqp->anqp_elems,
@@ -6322,7 +6314,7 @@
 		return -1;
 	}
 
-	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
+	return wpas_p2p_prov_disc(wpa_s, addr, NULL, 0, WPAS_P2P_PD_FOR_ASP,
 				  p2ps_prov);
 }
 
@@ -6351,7 +6343,7 @@
 
 	p2ps_prov->pd_seeker = 1;
 
-	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
+	return wpas_p2p_prov_disc(wpa_s, addr, NULL, 0, WPAS_P2P_PD_FOR_ASP,
 				  p2ps_prov);
 }
 
@@ -6531,7 +6523,6 @@
 	if (pos2) {
 		pos2 += 13;
 		bootstrap = atoi(pos2);
-		pd = true;
 	}
 
 	while ((token = str_token(pos, " ", &context))) {
@@ -6590,10 +6581,11 @@
 static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
 {
 	u8 addr[ETH_ALEN];
-	char *pos;
+	char *pos, *pos2;
 	enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;
+	u16 bootstrap = 0;
 
-	/* <addr> <config method> [join|auto] */
+	/* <addr> <config method> [join|auto] [bstrapmethod=<value>] */
 
 	if (hwaddr_aton(cmd, addr))
 		return -1;
@@ -6608,7 +6600,13 @@
 	else if (os_strstr(pos, " auto") != NULL)
 		use = WPAS_P2P_PD_AUTO;
 
-	return wpas_p2p_prov_disc(wpa_s, addr, pos, use, NULL);
+	pos2 = os_strstr(pos, "bstrapmethod=");
+	if (pos2) {
+		pos2 += 13;
+		bootstrap = atoi(pos2);
+	}
+
+	return wpas_p2p_prov_disc(wpa_s, addr, pos, bootstrap, use, NULL);
 }
 
 
@@ -6626,6 +6624,52 @@
 }
 
 
+static int p2p_ctrl_validate_dira(struct wpa_supplicant *wpa_s, char *cmd,
+				  char *buf, size_t buflen)
+{
+	char *pos, *pos2;
+	u8 addr[ETH_ALEN];
+	u8 nonce[DEVICE_IDENTITY_NONCE_LEN];
+	u8 tag[DEVICE_IDENTITY_TAG_LEN];
+	int id;
+	int res;
+
+	if (hwaddr_aton(cmd, addr))
+		return -1;
+
+	pos = cmd + 17;
+	if (*pos != ' ')
+		return -1;
+
+	pos2 = os_strstr(pos, "nonce=");
+	if (pos2) {
+		pos2 += 6;
+		if (hexstr2bin(pos2, nonce, sizeof(nonce)) < 0)
+			return -1;
+	} else {
+		return -1;
+	}
+
+	pos2 = os_strstr(pos, "tag=");
+	if (pos2) {
+		pos2 += 4;
+		if (hexstr2bin(pos2, tag, sizeof(tag)) < 0)
+			return -1;
+	} else {
+		return -1;
+	}
+
+	id = wpas_p2p_validate_dira(wpa_s, addr, 0, nonce, tag);
+	if (id <= 0)
+		return -1;
+
+	res = os_snprintf(buf, buflen, "%u", id);
+	if (os_snprintf_error(buflen, res))
+		return -1;
+	return res;
+}
+
+
 static int p2p_ctrl_serv_disc_req(struct wpa_supplicant *wpa_s, char *cmd,
 				  char *buf, size_t buflen)
 {
@@ -7099,7 +7143,7 @@
 {
 	char *pos;
 	int id;
-	struct wpa_ssid *ssid;
+	struct wpa_ssid *ssid = NULL;
 	u8 *_peer = NULL, peer[ETH_ALEN];
 	int freq = 0, pref_freq = 0;
 	int ht40, vht, he, max_oper_chwidth, chwidth = 0, freq2 = 0;
@@ -7107,7 +7151,8 @@
 	bool allow_6ghz;
 	bool p2p2;
 
-	id = atoi(cmd);
+	p2p2 = os_strstr(cmd, " p2p2") != NULL;
+
 	pos = os_strstr(cmd, " peer=");
 	if (pos) {
 		pos += 6;
@@ -7115,11 +7160,19 @@
 			return -1;
 		_peer = peer;
 	}
-	ssid = wpa_config_get_network(wpa_s->conf, id);
-	if (ssid == NULL || ssid->disabled != 2) {
-		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
-			   "for persistent P2P group",
-			   id);
+
+	if (os_strncmp(cmd, "persistent=", 11) == 0) {
+		id = atoi(cmd + 11);
+		ssid = wpa_config_get_network(wpa_s->conf, id);
+		if (!ssid || ssid->disabled != 2) {
+			wpa_printf(MSG_DEBUG,
+				   "CTRL_IFACE: Could not find SSID id=%d for persistent P2P group",
+				   id);
+			return -1;
+		}
+	} else if (p2p2 && !_peer) {
+		wpa_printf(MSG_DEBUG,
+			   "CTRL_IFACE: Could not find peer for persistent P2P group");
 		return -1;
 	}
 
@@ -7162,8 +7215,6 @@
 	if (allow_6ghz && chwidth == 40)
 		max_oper_chwidth = CONF_OPER_CHWIDTH_40MHZ_6GHZ;
 
-	p2p2 = os_strstr(cmd, " p2p2") != NULL;
-
 	return wpas_p2p_invite(wpa_s, _peer, ssid, NULL, freq, freq2, ht40, vht,
 			       max_oper_chwidth, pref_freq, he, edmg,
 			       allow_6ghz, p2p2);
@@ -7206,8 +7257,8 @@
 
 static int p2p_ctrl_invite(struct wpa_supplicant *wpa_s, char *cmd)
 {
-	if (os_strncmp(cmd, "persistent=", 11) == 0)
-		return p2p_ctrl_invite_persistent(wpa_s, cmd + 11);
+	if (os_strncmp(cmd, "persistent", 10) == 0)
+		return p2p_ctrl_invite_persistent(wpa_s, cmd);
 	if (os_strncmp(cmd, "group=", 6) == 0)
 		return p2p_ctrl_invite_group(wpa_s, cmd + 6);
 
@@ -8258,7 +8309,7 @@
 	if (subtypes == 0)
 		return -1;
 
-	return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0, 0);
+	return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0);
 }
 
 
@@ -8281,7 +8332,7 @@
 
 	ret = hs20_anqp_send_req(wpa_s, addr,
 				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
-				 buf, len, 0);
+				 buf, len);
 
 	os_free(buf);
 
@@ -8327,77 +8378,12 @@
 
 	ret = hs20_anqp_send_req(wpa_s, dst_addr,
 				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
-				 buf, len, 0);
+				 buf, len);
 	os_free(buf);
 
 	return ret;
 }
 
-
-static int get_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd, char *reply,
-			 int buflen)
-{
-	u8 dst_addr[ETH_ALEN];
-	int used;
-	char *ctx = NULL, *icon, *poffset, *psize;
-
-	used = hwaddr_aton2(cmd, dst_addr);
-	if (used < 0)
-		return -1;
-	cmd += used;
-
-	icon = str_token(cmd, " ", &ctx);
-	poffset = str_token(cmd, " ", &ctx);
-	psize = str_token(cmd, " ", &ctx);
-	if (!icon || !poffset || !psize)
-		return -1;
-
-	wpa_s->fetch_osu_icon_in_progress = 0;
-	return hs20_get_icon(wpa_s, dst_addr, icon, atoi(poffset), atoi(psize),
-			     reply, buflen);
-}
-
-
-static int del_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd)
-{
-	u8 dst_addr[ETH_ALEN];
-	int used;
-	char *icon;
-
-	if (!cmd[0])
-		return hs20_del_icon(wpa_s, NULL, NULL);
-
-	used = hwaddr_aton2(cmd, dst_addr);
-	if (used < 0)
-		return -1;
-
-	while (cmd[used] == ' ')
-		used++;
-	icon = cmd[used] ? &cmd[used] : NULL;
-
-	return hs20_del_icon(wpa_s, dst_addr, icon);
-}
-
-
-static int hs20_icon_request(struct wpa_supplicant *wpa_s, char *cmd, int inmem)
-{
-	u8 dst_addr[ETH_ALEN];
-	int used;
-	char *icon;
-
-	used = hwaddr_aton2(cmd, dst_addr);
-	if (used < 0)
-		return -1;
-
-	while (cmd[used] == ' ')
-		used++;
-	icon = &cmd[used];
-
-	wpa_s->fetch_osu_icon_in_progress = 0;
-	return hs20_anqp_send_req(wpa_s, dst_addr, BIT(HS20_STYPE_ICON_REQUEST),
-				  (u8 *) icon, os_strlen(icon), inmem);
-}
-
 #endif /* CONFIG_HS20 */
 
 
@@ -9024,13 +9010,6 @@
 
 	wnm_btm_reset(wpa_s);
 
-#ifdef CONFIG_INTERWORKING
-#ifdef CONFIG_HS20
-	hs20_cancel_fetch_osu(wpa_s);
-	hs20_del_icon(wpa_s, NULL, NULL);
-#endif /* CONFIG_HS20 */
-#endif /* CONFIG_INTERWORKING */
-
 	wpa_s->ext_mgmt_frame_handling = 0;
 	wpa_s->ext_eapol_frame_io = 0;
 #ifdef CONFIG_TESTING_OPTIONS
@@ -10506,6 +10485,7 @@
 	params.key_mgmt_suite = wpa_s->key_mgmt;
 	params.wpa_proto = wpa_s->wpa_proto;
 	params.mgmt_frame_protection = wpa_s->sme.mfp;
+	params.spp_amsdu = wpa_s->sme.spp_amsdu;
 	params.rrm_used = wpa_s->rrm.rrm_used;
 	if (wpa_s->sme.prev_bssid_set)
 		params.prev_bssid = wpa_s->sme.prev_bssid;
@@ -12727,6 +12707,53 @@
 	return ret;
 }
 
+
+static int wpas_ctrl_nan_unpause_publish(struct wpa_supplicant *wpa_s,
+					 char *cmd)
+{
+	char *token, *context = NULL;
+	int publish_id = 0;
+	int peer_instance_id = 0;
+	u8 peer_addr[ETH_ALEN];
+
+	os_memset(peer_addr, 0, ETH_ALEN);
+
+	while ((token = str_token(cmd, " ", &context))) {
+		if (sscanf(token, "publish_id=%i", &publish_id) == 1)
+			continue;
+
+		if (sscanf(token, "peer_instance_id=%i",
+			   &peer_instance_id) == 1)
+			continue;
+
+		if (os_strncmp(token, "peer=", 5) == 0) {
+			if (hwaddr_aton(token + 5, peer_addr) < 0)
+				return -1;
+			continue;
+		}
+
+		wpa_printf(MSG_INFO,
+			   "CTRL: Invalid NAN_UNPAUSE_PUBLISH parameter: %s",
+			   token);
+		return -1;
+	}
+
+	if (publish_id <= 0) {
+		wpa_printf(MSG_INFO,
+			   "CTRL: Invalid or missing NAN_UNPAUSE_PUBLIH publish_id");
+		return -1;
+	}
+
+	if (is_zero_ether_addr(peer_addr)) {
+		wpa_printf(MSG_INFO,
+			   "CTRL: Invalid or missing NAN_UNPAUSE_PUBLISH address");
+		return -1;
+	}
+
+	return wpas_nan_usd_unpause_publish(wpa_s, publish_id, peer_instance_id,
+					    peer_addr);
+}
+
 #endif /* CONFIG_NAN_USD */
 
 
@@ -13029,6 +13056,11 @@
 			reply_len = -1;
 	} else if (os_strcmp(buf, "P2P_GET_PASSPHRASE") == 0) {
 		reply_len = p2p_get_passphrase(wpa_s, reply, reply_size);
+	} else if (os_strcmp(buf, "P2P_GET_DIRA") == 0) {
+		reply_len = wpas_p2p_get_dira(wpa_s, reply, reply_size);
+	} else if (os_strncmp(buf, "P2P_VALIDATE_DIRA ", 18) == 0) {
+		reply_len = p2p_ctrl_validate_dira(wpa_s, buf + 18,
+						   reply, reply_size);
 #ifdef CONFIG_PASN
 #ifdef CONFIG_TESTING_OPTIONS
 	} else if (os_strcmp(buf, "P2P_GET_PASNPTK") == 0) {
@@ -13160,25 +13192,6 @@
 	} else if (os_strncmp(buf, "HS20_GET_NAI_HOME_REALM_LIST ", 29) == 0) {
 		if (hs20_get_nai_home_realm_list(wpa_s, buf + 29) < 0)
 			reply_len = -1;
-	} else if (os_strncmp(buf, "HS20_ICON_REQUEST ", 18) == 0) {
-		if (hs20_icon_request(wpa_s, buf + 18, 0) < 0)
-			reply_len = -1;
-	} else if (os_strncmp(buf, "REQ_HS20_ICON ", 14) == 0) {
-		if (hs20_icon_request(wpa_s, buf + 14, 1) < 0)
-			reply_len = -1;
-	} else if (os_strncmp(buf, "GET_HS20_ICON ", 14) == 0) {
-		reply_len = get_hs20_icon(wpa_s, buf + 14, reply, reply_size);
-	} else if (os_strncmp(buf, "DEL_HS20_ICON ", 14) == 0) {
-		if (del_hs20_icon(wpa_s, buf + 14) < 0)
-			reply_len = -1;
-	} else if (os_strcmp(buf, "FETCH_OSU") == 0) {
-		if (hs20_fetch_osu(wpa_s, 0) < 0)
-			reply_len = -1;
-	} else if (os_strcmp(buf, "FETCH_OSU no-scan") == 0) {
-		if (hs20_fetch_osu(wpa_s, 1) < 0)
-			reply_len = -1;
-	} else if (os_strcmp(buf, "CANCEL_FETCH_OSU") == 0) {
-		hs20_cancel_fetch_osu(wpa_s);
 #endif /* CONFIG_HS20 */
 	} else if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0)
 	{
@@ -13768,6 +13781,9 @@
 	} else if (os_strncmp(buf, "NAN_TRANSMIT ", 13) == 0) {
 		if (wpas_ctrl_nan_transmit(wpa_s, buf + 13) < 0)
 			reply_len = -1;
+	} else if (os_strncmp(buf, "NAN_UNPAUSE_PUBLISH ", 20) == 0) {
+		if (wpas_ctrl_nan_unpause_publish(wpa_s, buf + 20) < 0)
+			reply_len = -1;
 	} else if (os_strcmp(buf, "NAN_FLUSH") == 0) {
 		wpas_nan_usd_flush(wpa_s);
 #endif /* CONFIG_NAN_USD */
@@ -14133,6 +14149,8 @@
 #ifdef CONFIG_AP
 		"STA-FIRST",
 #endif /* CONFIG_AP */
+		"P2P_GET_DIRA",
+		"P2P_VALIDATE_DIRA",
 		NULL
 	};
 	static const char * prefix[] = {
diff --git a/wpa_supplicant/dbus/dbus_new.c b/wpa_supplicant/dbus/dbus_new.c
index ff7e003..7893f35 100644
--- a/wpa_supplicant/dbus/dbus_new.c
+++ b/wpa_supplicant/dbus/dbus_new.c
@@ -2386,17 +2386,18 @@
 
 
 /**
- * wpas_dbus_signal_p2p_bootstrap_completed - Signals BootstrappingCompleted event
- * event
+ * wpas_dbus_signal_p2p_bootstrap_rsp - Signals BootstrappingResponse event
  * @wpa_s: %wpa_supplicant network interface data
  * @src: Source address of the peer with which bootstrapping is done
  * @status: Status of Bootstrapping handshake
+ * @bootstrap_method: Peer's bootstrap method if status is success
  *
  * Sends a signal to notify that a peer P2P Device is requesting bootstrapping
  * negotiation with us.
  */
-void wpas_dbus_signal_p2p_bootstrap_completed(struct wpa_supplicant *wpa_s,
-					      const u8 *src, int status)
+void wpas_dbus_signal_p2p_bootstrap_rsp(struct wpa_supplicant *wpa_s,
+					const u8 *src, int status,
+					u16 bootstrap_method)
 {
 	DBusMessage *msg;
 	DBusMessageIter iter;
@@ -2430,7 +2431,9 @@
 	if (!dbus_message_iter_append_basic(&iter, DBUS_TYPE_OBJECT_PATH,
 					    &path) ||
 	    !dbus_message_iter_append_basic(&iter, DBUS_TYPE_INT32,
-					    &status))
+					    &status) ||
+	    !dbus_message_iter_append_basic(&iter, DBUS_TYPE_UINT16,
+					    &bootstrap_method))
 		wpa_printf(MSG_ERROR, "dbus: Failed to construct signal");
 	else
 		dbus_connection_send(iface->con, msg, NULL);
@@ -2604,41 +2607,6 @@
 
 
 /**
- * wpas_dbus_sta_signal_prop_changed - Signals change of STA property
- * @wpa_s: %wpa_supplicant network interface data
- * @property: indicates which property has changed
- * @address: unique BSS identifier
- *
- * Sends PropertyChanged signals with path, interface, and arguments depending
- * on which property has changed.
- */
-void wpas_dbus_sta_signal_prop_changed(struct wpa_supplicant *wpa_s,
-				       enum wpas_dbus_bss_prop property,
-				       u8 address[ETH_ALEN])
-{
-	char path[WPAS_DBUS_OBJECT_PATH_MAX];
-	char *prop;
-
-	switch (property) {
-	case WPAS_DBUS_STA_PROP_ADDRESS:
-		prop = "Address";
-		break;
-	default:
-		wpa_printf(MSG_ERROR, "dbus: %s: Unknown Property value %d",
-			   __func__, property);
-		return;
-	}
-
-	os_snprintf(path, WPAS_DBUS_OBJECT_PATH_MAX,
-		    "%s/" WPAS_DBUS_NEW_STAS_PART "/" COMPACT_MACSTR,
-		    wpa_s->dbus_new_path, MAC2STR(address));
-
-	wpa_dbus_mark_property_changed(wpa_s->global->dbus, path,
-				       WPAS_DBUS_NEW_IFACE_STA, prop);
-}
-
-
-/**
  * wpas_dbus_signal_debug_level_changed - Signals change of debug param
  * @global: wpa_global structure
  *
diff --git a/wpa_supplicant/dbus/dbus_new.h b/wpa_supplicant/dbus/dbus_new.h
index f9ff636..d648435 100644
--- a/wpa_supplicant/dbus/dbus_new.h
+++ b/wpa_supplicant/dbus/dbus_new.h
@@ -268,8 +268,9 @@
 					      int op_freq);
 void wpas_dbus_signal_p2p_bootstrap_req(struct wpa_supplicant *wpa_s,
 					const u8 *src, u16 bootstrap_method);
-void wpas_dbus_signal_p2p_bootstrap_completed(struct wpa_supplicant *wpa_s,
-					      const u8 *src, int status);
+void wpas_dbus_signal_p2p_bootstrap_rsp(struct wpa_supplicant *wpa_s,
+					const u8 *src, int status,
+					u16 bootstrap_method);
 void wpas_dbus_signal_mesh_group_started(struct wpa_supplicant *wpa_s,
 					 struct wpa_ssid *ssid);
 void wpas_dbus_signal_mesh_group_removed(struct wpa_supplicant *wpa_s,
@@ -650,8 +651,9 @@
 }
 
 static inline
-void wpas_dbus_signal_p2p_bootstrap_completed(struct wpa_supplicant *wpa_s,
-					      const u8 *src, int status)
+void wpas_dbus_signal_p2p_bootstrap_rsp(struct wpa_supplicant *wpa_s,
+					const u8 *src, int status,
+					u16 bootstrap_method)
 {
 }
 
diff --git a/wpa_supplicant/dbus/dbus_new_handlers.c b/wpa_supplicant/dbus/dbus_new_handlers.c
index 2fad8dd..e43bf83 100644
--- a/wpa_supplicant/dbus/dbus_new_handlers.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers.c
@@ -5901,24 +5901,6 @@
 			    wpabuf_head(anqp->hs20_operating_class),
 			    wpabuf_len(anqp->hs20_operating_class)))
 			goto nomem;
-		if (anqp->hs20_osu_providers_list &&
-		    !wpa_dbus_dict_append_byte_array(
-			    &iter_dict, "HS20OSUProvidersList",
-			    wpabuf_head(anqp->hs20_osu_providers_list),
-			    wpabuf_len(anqp->hs20_osu_providers_list)))
-			goto nomem;
-		if (anqp->hs20_operator_icon_metadata &&
-		    !wpa_dbus_dict_append_byte_array(
-			    &iter_dict, "HS20OperatorIconMetadata",
-			    wpabuf_head(anqp->hs20_operator_icon_metadata),
-			    wpabuf_len(anqp->hs20_operator_icon_metadata)))
-			goto nomem;
-		if (anqp->hs20_osu_providers_nai_list &&
-		    !wpa_dbus_dict_append_byte_array(
-			    &iter_dict, "HS20OSUProvidersNAIList",
-			    wpabuf_head(anqp->hs20_osu_providers_nai_list),
-			    wpabuf_len(anqp->hs20_osu_providers_nai_list)))
-			goto nomem;
 #endif /* CONFIG_HS20 */
 
 		dl_list_for_each(elem, &anqp->anqp_elems,
diff --git a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
index ce49bce..fc59947 100644
--- a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
@@ -929,7 +929,7 @@
 	if (!wpa_s)
 		return wpas_dbus_error_no_p2p_mgmt_iface(message);
 
-	if (wpas_p2p_prov_disc(wpa_s, peer_addr, config_method,
+	if (wpas_p2p_prov_disc(wpa_s, peer_addr, config_method, 0,
 			       WPAS_P2P_PD_FOR_GO_NEG, NULL) < 0)
 		return wpas_dbus_error_unknown_error(message,
 				"Failed to send provision discovery request");
diff --git a/wpa_supplicant/eap_register.c b/wpa_supplicant/eap_register.c
index 3f018c4..794ec19 100644
--- a/wpa_supplicant/eap_register.c
+++ b/wpa_supplicant/eap_register.c
@@ -40,13 +40,6 @@
 		ret = eap_peer_unauth_tls_register();
 #endif /* EAP_UNAUTH_TLS */
 
-#ifdef EAP_TLS
-#ifdef CONFIG_HS20
-	if (ret == 0)
-		ret = eap_peer_wfa_unauth_tls_register();
-#endif /* CONFIG_HS20 */
-#endif /* EAP_TLS */
-
 #ifdef EAP_MSCHAPv2
 	if (ret == 0)
 		ret = eap_peer_mschapv2_register();
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 30176a0..6808956 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -443,7 +443,7 @@
 }
 
 
-static void wpa_find_assoc_pmkid(struct wpa_supplicant *wpa_s, bool authorized)
+static void wpa_find_assoc_pmkid(struct wpa_supplicant *wpa_s)
 {
 	struct wpa_ie_data ie;
 	int pmksa_set = -1;
@@ -468,8 +468,7 @@
 						    true);
 		if (pmksa_set == 0) {
 			eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
-			if (authorized)
-				wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
+			wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
 			break;
 		}
 	}
@@ -641,9 +640,6 @@
 	if (wpa_key_mgmt_wpa(ssid->key_mgmt))
 		privacy = 1;
 
-	if (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)
-		privacy = 1;
-
 	if (bss->caps & IEEE80211_CAP_PRIVACY)
 		return privacy;
 	return !privacy;
@@ -683,7 +679,7 @@
 		return 0;
 	}
 
-	while ((ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)) && rsn_ie) {
+	while ((ssid->proto & WPA_PROTO_RSN) && rsn_ie) {
 		proto_match++;
 
 		if (wpa_parse_wpa_ie(rsn_ie, 2 + rsn_ie[1], &ie)) {
@@ -718,8 +714,7 @@
 		}
 #endif /* CONFIG_WEP */
 
-		if (!(ie.proto & ssid->proto) &&
-		    !(ssid->proto & WPA_PROTO_OSEN)) {
+		if (!(ie.proto & ssid->proto)) {
 			if (debug_print)
 				wpa_dbg(wpa_s, MSG_DEBUG,
 					"   skip RSN IE - proto mismatch");
@@ -921,13 +916,6 @@
 		return 0;
 	}
 
-	if ((ssid->key_mgmt & WPA_KEY_MGMT_OSEN) &&
-	    wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE)) {
-		if (debug_print)
-			wpa_dbg(wpa_s, MSG_DEBUG, "   allow in OSEN");
-		return 1;
-	}
-
 	if (!wpa_key_mgmt_wpa(ssid->key_mgmt)) {
 		if (debug_print)
 			wpa_dbg(wpa_s, MSG_DEBUG, "   allow in non-WPA/WPA2");
@@ -1225,7 +1213,7 @@
 static bool wpa_scan_res_ok(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
 			    const u8 *match_ssid, size_t match_ssid_len,
 			    struct wpa_bss *bss, int bssid_ignore_count,
-			    bool debug_print);
+			    bool debug_print, bool link);
 
 
 #ifdef CONFIG_SAE_PK
@@ -1255,7 +1243,7 @@
 
 		count = wpa_bssid_ignore_is_listed(wpa_s, bss->bssid);
 		if (wpa_scan_res_ok(wpa_s, ssid, match_ssid, match_ssid_len,
-				    bss, count, 0))
+				    bss, count, false, false))
 			return true;
 	}
 
@@ -1267,13 +1255,10 @@
 static bool wpa_scan_res_ok(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
 			    const u8 *match_ssid, size_t match_ssid_len,
 			    struct wpa_bss *bss, int bssid_ignore_count,
-			    bool debug_print)
+			    bool debug_print, bool link)
 {
 	int res;
-	bool wpa, check_ssid, osen, rsn_osen = false;
-#ifndef CONFIG_NO_WPA
-	struct wpa_ie_data data;
-#endif /* CONFIG_NO_WPA */
+	bool wpa, check_ssid = false;
 #ifdef CONFIG_MBO
 	const u8 *assoc_disallow;
 #endif /* CONFIG_MBO */
@@ -1287,13 +1272,6 @@
 	wpa = ie && ie[1];
 	ie = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
 	wpa |= ie && ie[1];
-#ifndef CONFIG_NO_WPA
-	if (ie && wpa_parse_wpa_ie_rsn(ie, 2 + ie[1], &data) == 0 &&
-	    (data.key_mgmt & WPA_KEY_MGMT_OSEN))
-		rsn_osen = true;
-#endif /* CONFIG_NO_WPA */
-	ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
-	osen = ie != NULL;
 
 #ifdef CONFIG_SAE
 	ie = wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
@@ -1352,7 +1330,7 @@
 		return false;
 	}
 
-	if (ssid->bssid_set &&
+	if (!link && ssid->bssid_set &&
 	    !ether_addr_equal(bss->bssid, ssid->bssid)) {
 		if (debug_print)
 			wpa_dbg(wpa_s, MSG_DEBUG, "   skip - BSSID mismatch");
@@ -1382,7 +1360,7 @@
 	if (!wpa_supplicant_ssid_bss_match(wpa_s, ssid, bss, debug_print))
 		return false;
 
-	if (!osen && !wpa &&
+	if (!wpa &&
 	    !(ssid->key_mgmt & WPA_KEY_MGMT_NONE) &&
 	    !(ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
 	    !(ssid->key_mgmt & WPA_KEY_MGMT_OWE) &&
@@ -1402,13 +1380,6 @@
 	}
 #endif /* CONFIG_WEP */
 
-	if ((ssid->key_mgmt & WPA_KEY_MGMT_OSEN) && !osen && !rsn_osen) {
-		if (debug_print)
-			wpa_dbg(wpa_s, MSG_DEBUG,
-				"   skip - non-OSEN network not allowed");
-		return false;
-	}
-
 	if (!wpa_supplicant_match_privacy(bss, ssid)) {
 		if (debug_print)
 			wpa_dbg(wpa_s, MSG_DEBUG, "   skip - privacy mismatch");
@@ -1629,7 +1600,7 @@
 		return false;
 	}
 
-	if (!wpas_valid_ml_bss(wpa_s, bss)) {
+	if (!link && !wpas_valid_ml_bss(wpa_s, bss)) {
 		if (debug_print)
 			wpa_dbg(wpa_s, MSG_DEBUG,
 				"   skip - ML BSS going to be removed");
@@ -1644,12 +1615,12 @@
 struct wpa_ssid * wpa_scan_res_match(struct wpa_supplicant *wpa_s,
 				     int i, struct wpa_bss *bss,
 				     struct wpa_ssid *group,
-				     int only_first_ssid, int debug_print)
+				     int only_first_ssid, int debug_print,
+				     bool link)
 {
 	u8 wpa_ie_len, rsn_ie_len;
 	const u8 *ie;
 	struct wpa_ssid *ssid;
-	int osen;
 	const u8 *match_ssid;
 	size_t match_ssid_len;
 	int bssid_ignore_count;
@@ -1660,12 +1631,9 @@
 	ie = wpa_bss_get_rsne(wpa_s, bss, NULL, false);
 	rsn_ie_len = ie ? ie[1] : 0;
 
-	ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
-	osen = ie != NULL;
-
 	if (debug_print) {
 		wpa_dbg(wpa_s, MSG_DEBUG, "%d: " MACSTR
-			" ssid='%s' wpa_ie_len=%u rsn_ie_len=%u caps=0x%x level=%d freq=%d %s%s%s",
+			" ssid='%s' wpa_ie_len=%u rsn_ie_len=%u caps=0x%x level=%d freq=%d %s%s",
 			i, MAC2STR(bss->bssid),
 			wpa_ssid_txt(bss->ssid, bss->ssid_len),
 			wpa_ie_len, rsn_ie_len, bss->caps, bss->level,
@@ -1674,8 +1642,7 @@
 			" wps" : "",
 			(wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) ||
 			 wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE))
-			? " p2p" : "",
-			osen ? " osen=1" : "");
+			? " p2p" : "");
 	}
 
 	bssid_ignore_count = wpa_bssid_ignore_is_listed(wpa_s, bss->bssid);
@@ -1738,7 +1705,7 @@
 
 	for (ssid = group; ssid; ssid = only_first_ssid ? NULL : ssid->pnext) {
 		if (wpa_scan_res_ok(wpa_s, ssid, match_ssid, match_ssid_len,
-				    bss, bssid_ignore_count, debug_print))
+				    bss, bssid_ignore_count, debug_print, link))
 			return ssid;
 	}
 
@@ -1764,7 +1731,7 @@
 			struct wpa_bss *bss = wpa_s->last_scan_res[i];
 
 			ssid = wpa_scan_res_match(wpa_s, i, bss, group,
-						  only_first_ssid, 0);
+						  only_first_ssid, 0, false);
 			if (ssid != wpa_s->current_ssid)
 				continue;
 			wpa_dbg(wpa_s, MSG_DEBUG, "%u: " MACSTR
@@ -1786,7 +1753,7 @@
 
 		wpa_s->owe_transition_select = 1;
 		*selected_ssid = wpa_scan_res_match(wpa_s, i, bss, group,
-						    only_first_ssid, 1);
+						    only_first_ssid, 1, false);
 		wpa_s->owe_transition_select = 0;
 		if (!*selected_ssid)
 			continue;
@@ -3116,7 +3083,7 @@
 		goto fail;
 	}
 	wpa_s->enabled_4addr_mode = 1;
-	wpa_msg(wpa_s, MSG_INFO, "Successfully set 4addr mode");
+	wpa_dbg(wpa_s, MSG_DEBUG, "Successfully set 4addr mode");
 	return;
 
 fail:
@@ -3277,8 +3244,7 @@
 	wpa_s->wpa_proto = ie.proto;
 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, wpa_s->wpa_proto);
 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
-			 !!(wpa_s->wpa_proto &
-			    (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
+			 !!(wpa_s->wpa_proto & WPA_PROTO_RSN));
 
 	/* Update AKMP suite from (Re)Association Request frame info */
 	sel = ie.key_mgmt;
@@ -3359,7 +3325,7 @@
 	/* Update GTK and IGTK from AP's RSNE */
 	found = false;
 
-	if (wpa_s->wpa_proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)) {
+	if (wpa_s->wpa_proto & WPA_PROTO_RSN) {
 		const u8 *bss_rsn;
 
 		bss_rsn = wpa_bss_get_rsne(wpa_s, bss, ssid,
@@ -3597,8 +3563,7 @@
 			if (wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, p, len))
 				break;
 			found = 1;
-			wpa_find_assoc_pmkid(wpa_s,
-					     data->assoc_info.authorized);
+			wpa_find_assoc_pmkid(wpa_s);
 		}
 #ifndef CONFIG_NO_WPA
 		if (!found_x && p[0] == WLAN_EID_RSNX) {
@@ -4025,10 +3990,9 @@
 	struct eht_ml_basic_common_info *common_info;
 	const u8 *pos;
 	u16 eml_capa = 0, mld_capa = 0;
-	const u16 control =
-		host_to_le16(MULTI_LINK_CONTROL_TYPE_BASIC |
-			     BASIC_MULTI_LINK_CTRL_PRES_LINK_ID |
-			     BASIC_MULTI_LINK_CTRL_PRES_BSS_PARAM_CH_COUNT);
+	const u16 control = MULTI_LINK_CONTROL_TYPE_BASIC |
+		BASIC_MULTI_LINK_CTRL_PRES_LINK_ID |
+		BASIC_MULTI_LINK_CTRL_PRES_BSS_PARAM_CH_COUNT;
 	u8 expected_common_info_len = 9;
 	unsigned int i = 0;
 	u16 ml_control;
@@ -4085,7 +4049,7 @@
 	}
 
 	common_info = (struct eht_ml_basic_common_info *) ml->variable;
-	if (common_info->len != expected_common_info_len) {
+	if (common_info->len < expected_common_info_len) {
 		wpa_printf(MSG_DEBUG,
 			   "MLD: Invalid common info len=%u. expected=%u",
 			   common_info->len, expected_common_info_len);
@@ -4134,7 +4098,7 @@
 	ml_len -= sizeof(*ml) + common_info->len;
 	while (ml_len > 2 && i < MAX_NUM_MLD_LINKS) {
 		u8 sub_elem_len = pos[1];
-		u8 sta_info_len;
+		u8 sta_info_len, sta_info_len_min;
 		u8 nstr_bitmap_len = 0;
 		u16 ctrl;
 		const u8 *end;
@@ -4223,15 +4187,21 @@
 			goto out;
 		}
 
-		sta_info_len = 1 + ETH_ALEN + 8 + 2 + 2 + 1 + nstr_bitmap_len;
-		if (sta_info_len > ml_len || sta_info_len > end - pos ||
-		    sta_info_len + 2 > sub_elem_len ||
-		    sta_info_len != *pos) {
+		sta_info_len_min = 1 + ETH_ALEN + 8 + 2 + 2 + 1 +
+			nstr_bitmap_len;
+		if (sta_info_len_min > ml_len || sta_info_len_min > end - pos ||
+		    sta_info_len_min + 2 > sub_elem_len ||
+		    sta_info_len_min > *pos) {
 			wpa_printf(MSG_DEBUG,
-				   "MLD: Invalid STA info len=%u, len=%u",
-				   sta_info_len, *pos);
+				   "MLD: Invalid STA info min len=%u, len=%u",
+				   sta_info_len_min, *pos);
 			goto out;
 		}
+		sta_info_len = *pos;
+		/* Make static analyzers happier with an explicit check even
+		 * though this was already checked above with *pos.. */
+		if (sta_info_len < sta_info_len_min)
+			goto out;
 
 		/* Get the link address */
 		wpa_printf(MSG_DEBUG,
@@ -4870,10 +4840,6 @@
 			return; /* P2P group removed */
 		wpas_auth_failed(wpa_s, "WRONG_KEY", wpa_s->pending_bssid);
 		wpas_notify_psk_mismatch(wpa_s);
-#ifdef CONFIG_DPP2
-		wpas_dpp_send_conn_status_result(wpa_s,
-						 DPP_STATUS_AUTH_FAILURE);
-#endif /* CONFIG_DPP2 */
 	}
 	if (!wpa_s->disconnected &&
 	    (!wpa_s->auto_reconnect_disabled ||
@@ -4928,6 +4894,9 @@
 	else
 		wpa_s->disconnect_reason = reason_code;
 	wpas_notify_disconnect_reason(wpa_s);
+#ifdef CONFIG_DPP2
+	wpas_dpp_send_conn_status_result(wpa_s, DPP_STATUS_AUTH_FAILURE);
+#endif /* CONFIG_DPP2 */
 	if (wpa_supplicant_dynamic_keys(wpa_s)) {
 		wpa_dbg(wpa_s, MSG_DEBUG, "Disconnect event - remove keys");
 		wpa_clear_keys(wpa_s, wpa_s->bssid);
diff --git a/wpa_supplicant/gas_query.c b/wpa_supplicant/gas_query.c
index 7d29931..88564d5 100644
--- a/wpa_supplicant/gas_query.c
+++ b/wpa_supplicant/gas_query.c
@@ -147,6 +147,10 @@
 		gas->work = NULL;
 	}
 
+	eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
+	eloop_cancel_timeout(gas_query_timeout, gas, query);
+	eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
+
 	wpabuf_free(query->req);
 	wpabuf_free(query->adv_proto);
 	wpabuf_free(query->resp);
@@ -166,9 +170,6 @@
 		gas->current = NULL;
 	if (query->offchannel_tx_started)
 		offchannel_send_action_done(gas->wpa_s);
-	eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
-	eloop_cancel_timeout(gas_query_timeout, gas, query);
-	eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
 	dl_list_del(&query->list);
 	query->cb(query->ctx, query->addr, query->dialog_token, result,
 		  query->adv_proto, query->resp, query->status_code);
diff --git a/wpa_supplicant/hs20_supplicant.c b/wpa_supplicant/hs20_supplicant.c
index f14e6cb..d287b70 100644
--- a/wpa_supplicant/hs20_supplicant.c
+++ b/wpa_supplicant/hs20_supplicant.c
@@ -30,42 +30,6 @@
 #include "notify.h"
 
 
-#define OSU_MAX_ITEMS 10
-
-struct osu_lang_string {
-	char lang[4];
-	char text[253];
-};
-
-struct osu_icon {
-	u16 width;
-	u16 height;
-	char lang[4];
-	char icon_type[256];
-	char filename[256];
-	unsigned int id;
-	unsigned int failed:1;
-};
-
-struct osu_provider {
-	u8 bssid[ETH_ALEN];
-	u8 osu_ssid[SSID_MAX_LEN];
-	u8 osu_ssid_len;
-	u8 osu_ssid2[SSID_MAX_LEN];
-	u8 osu_ssid2_len;
-	char server_uri[256];
-	u32 osu_methods; /* bit 0 = OMA-DM, bit 1 = SOAP-XML SPP */
-	char osu_nai[256];
-	char osu_nai2[256];
-	struct osu_lang_string friendly_name[OSU_MAX_ITEMS];
-	size_t friendly_name_count;
-	struct osu_lang_string serv_desc[OSU_MAX_ITEMS];
-	size_t serv_desc_count;
-	struct osu_icon icon[OSU_MAX_ITEMS];
-	size_t icon_count;
-};
-
-
 void hs20_configure_frame_filters(struct wpa_supplicant *wpa_s)
 {
 	struct wpa_bss *bss = wpa_s->current_bss;
@@ -234,11 +198,6 @@
 		wpabuf_put_u8(buf, 0); /* Reserved */
 		if (payload)
 			wpabuf_put_data(buf, payload, payload_len);
-	} else if (stypes == BIT(HS20_STYPE_ICON_REQUEST)) {
-		wpabuf_put_u8(buf, HS20_STYPE_ICON_REQUEST);
-		wpabuf_put_u8(buf, 0); /* Reserved */
-		if (payload)
-			wpabuf_put_data(buf, payload, payload_len);
 	} else {
 		u8 i;
 		wpabuf_put_u8(buf, HS20_STYPE_QUERY_LIST);
@@ -270,14 +229,13 @@
 
 
 int hs20_anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, u32 stypes,
-		       const u8 *payload, size_t payload_len, int inmem)
+		       const u8 *payload, size_t payload_len)
 {
 	struct wpabuf *buf;
 	int ret = 0;
 	int freq;
 	struct wpa_bss *bss;
 	int res;
-	struct icon_entry *icon_entry;
 
 	bss = wpa_bss_get_bssid(wpa_s, dst);
 	if (!bss) {
@@ -307,299 +265,10 @@
 		wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
 			   "%u", res);
 
-	if (inmem) {
-		icon_entry = os_zalloc(sizeof(struct icon_entry));
-		if (!icon_entry)
-			return -1;
-		os_memcpy(icon_entry->bssid, dst, ETH_ALEN);
-		icon_entry->file_name = os_malloc(payload_len + 1);
-		if (!icon_entry->file_name) {
-			os_free(icon_entry);
-			return -1;
-		}
-		os_memcpy(icon_entry->file_name, payload, payload_len);
-		icon_entry->file_name[payload_len] = '\0';
-		icon_entry->dialog_token = res;
-
-		dl_list_add(&wpa_s->icon_head, &icon_entry->list);
-	}
-
 	return ret;
 }
 
 
-static struct icon_entry * hs20_find_icon(struct wpa_supplicant *wpa_s,
-					  const u8 *bssid,
-					  const char *file_name)
-{
-	struct icon_entry *icon;
-
-	dl_list_for_each(icon, &wpa_s->icon_head, struct icon_entry, list) {
-		if (ether_addr_equal(icon->bssid, bssid) &&
-		    os_strcmp(icon->file_name, file_name) == 0 && icon->image)
-			return icon;
-	}
-
-	return NULL;
-}
-
-
-int hs20_get_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
-		  const char *file_name, size_t offset, size_t size,
-		  char *reply, size_t buf_len)
-{
-	struct icon_entry *icon;
-	size_t out_size;
-	char *b64;
-	size_t b64_size;
-	int reply_size;
-
-	wpa_printf(MSG_DEBUG, "HS20: Get icon " MACSTR " %s @ %u +%u (%u)",
-		   MAC2STR(bssid), file_name, (unsigned int) offset,
-		   (unsigned int) size, (unsigned int) buf_len);
-
-	icon = hs20_find_icon(wpa_s, bssid, file_name);
-	if (!icon || !icon->image || offset >= icon->image_len)
-		return -1;
-	if (size > icon->image_len - offset)
-		size = icon->image_len - offset;
-	out_size = buf_len - 3 /* max base64 padding */;
-	if (size * 4 > out_size * 3)
-		size = out_size * 3 / 4;
-	if (size == 0)
-		return -1;
-
-	b64 = base64_encode(&icon->image[offset], size, &b64_size);
-	if (b64 && buf_len >= b64_size) {
-		os_memcpy(reply, b64, b64_size);
-		reply_size = b64_size;
-	} else {
-		reply_size = -1;
-	}
-	os_free(b64);
-	return reply_size;
-}
-
-
-static void hs20_free_icon_entry(struct icon_entry *icon)
-{
-	wpa_printf(MSG_DEBUG, "HS20: Free stored icon from " MACSTR
-		   " dialog_token=%u file_name=%s image_len=%u",
-		   MAC2STR(icon->bssid), icon->dialog_token,
-		   icon->file_name ? icon->file_name : "N/A",
-		   (unsigned int) icon->image_len);
-	os_free(icon->file_name);
-	os_free(icon->image);
-	os_free(icon);
-}
-
-
-int hs20_del_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
-		  const char *file_name)
-{
-	struct icon_entry *icon, *tmp;
-	int count = 0;
-
-	if (!bssid)
-		wpa_printf(MSG_DEBUG, "HS20: Delete all stored icons");
-	else if (!file_name)
-		wpa_printf(MSG_DEBUG, "HS20: Delete all stored icons for "
-			   MACSTR, MAC2STR(bssid));
-	else
-		wpa_printf(MSG_DEBUG, "HS20: Delete stored icons for "
-			   MACSTR " file name %s", MAC2STR(bssid), file_name);
-
-	dl_list_for_each_safe(icon, tmp, &wpa_s->icon_head, struct icon_entry,
-			      list) {
-		if ((!bssid || ether_addr_equal(icon->bssid, bssid)) &&
-		    (!file_name ||
-		     os_strcmp(icon->file_name, file_name) == 0)) {
-			dl_list_del(&icon->list);
-			hs20_free_icon_entry(icon);
-			count++;
-		}
-	}
-	return count == 0 ? -1 : 0;
-}
-
-
-static void hs20_set_osu_access_permission(const char *osu_dir,
-					   const char *fname)
-{
-	struct stat statbuf;
-
-	/* Get OSU directory information */
-	if (stat(osu_dir, &statbuf) < 0) {
-		wpa_printf(MSG_WARNING, "Cannot stat the OSU directory %s",
-			   osu_dir);
-		return;
-	}
-
-	if (chmod(fname, statbuf.st_mode) < 0) {
-		wpa_printf(MSG_WARNING,
-			   "Cannot change the permissions for %s", fname);
-		return;
-	}
-
-	if (lchown(fname, statbuf.st_uid, statbuf.st_gid) < 0) {
-		wpa_printf(MSG_WARNING, "Cannot change the ownership for %s",
-			   fname);
-	}
-}
-
-
-static void hs20_remove_duplicate_icons(struct wpa_supplicant *wpa_s,
-					struct icon_entry *new_icon)
-{
-	struct icon_entry *icon, *tmp;
-
-	dl_list_for_each_safe(icon, tmp, &wpa_s->icon_head, struct icon_entry,
-			      list) {
-		if (icon == new_icon)
-			continue;
-		if (ether_addr_equal(icon->bssid, new_icon->bssid) &&
-		    os_strcmp(icon->file_name, new_icon->file_name) == 0) {
-			dl_list_del(&icon->list);
-			hs20_free_icon_entry(icon);
-		}
-	}
-}
-
-
-static int hs20_process_icon_binary_file(struct wpa_supplicant *wpa_s,
-					 const u8 *sa, const u8 *pos,
-					 size_t slen, u8 dialog_token)
-{
-	char fname[256];
-	int png;
-	FILE *f;
-	u16 data_len;
-	struct icon_entry *icon;
-
-	dl_list_for_each(icon, &wpa_s->icon_head, struct icon_entry, list) {
-		if (icon->dialog_token == dialog_token && !icon->image &&
-		    ether_addr_equal(icon->bssid, sa)) {
-			icon->image = os_memdup(pos, slen);
-			if (!icon->image)
-				return -1;
-			icon->image_len = slen;
-			hs20_remove_duplicate_icons(wpa_s, icon);
-			wpa_msg(wpa_s, MSG_INFO,
-				RX_HS20_ICON MACSTR " %s %u",
-				MAC2STR(sa), icon->file_name,
-				(unsigned int) icon->image_len);
-			wpas_notify_hs20_icon_query_done(wpa_s, sa,
-							 icon->file_name,
-							 icon->image,
-							 icon->image_len);
-			return 0;
-		}
-	}
-
-	wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR " Icon Binary File",
-		MAC2STR(sa));
-
-	if (slen < 4) {
-		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
-			"value from " MACSTR, MAC2STR(sa));
-		return -1;
-	}
-
-	wpa_printf(MSG_DEBUG, "HS 2.0: Download Status Code %u", *pos);
-	if (*pos != 0)
-		return -1;
-	pos++;
-	slen--;
-
-	if ((size_t) 1 + pos[0] > slen) {
-		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
-			"value from " MACSTR, MAC2STR(sa));
-		return -1;
-	}
-	wpa_hexdump_ascii(MSG_DEBUG, "Icon Type", pos + 1, pos[0]);
-	png = os_strncasecmp((char *) pos + 1, "image/png", 9) == 0;
-	slen -= 1 + pos[0];
-	pos += 1 + pos[0];
-
-	if (slen < 2) {
-		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
-			"value from " MACSTR, MAC2STR(sa));
-		return -1;
-	}
-	data_len = WPA_GET_LE16(pos);
-	pos += 2;
-	slen -= 2;
-
-	if (data_len > slen) {
-		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon Binary File "
-			"value from " MACSTR, MAC2STR(sa));
-		return -1;
-	}
-
-	wpa_printf(MSG_DEBUG, "Icon Binary Data: %u bytes", data_len);
-	if (wpa_s->conf->osu_dir == NULL)
-		return -1;
-
-	wpa_s->osu_icon_id++;
-	if (wpa_s->osu_icon_id == 0)
-		wpa_s->osu_icon_id++;
-	snprintf(fname, sizeof(fname), "%s/osu-icon-%u.%s",
-		 wpa_s->conf->osu_dir, wpa_s->osu_icon_id,
-		 png ? "png" : "icon");
-	f = fopen(fname, "wb");
-	if (f == NULL)
-		return -1;
-
-	hs20_set_osu_access_permission(wpa_s->conf->osu_dir, fname);
-
-	if (fwrite(pos, slen, 1, f) != 1) {
-		fclose(f);
-		unlink(fname);
-		return -1;
-	}
-	fclose(f);
-
-	wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP_ICON "%s", fname);
-	return 0;
-}
-
-
-static void hs20_continue_icon_fetch(void *eloop_ctx, void *sock_ctx)
-{
-	struct wpa_supplicant *wpa_s = eloop_ctx;
-	if (wpa_s->fetch_osu_icon_in_progress)
-		hs20_next_osu_icon(wpa_s);
-}
-
-
-static void hs20_osu_icon_fetch_result(struct wpa_supplicant *wpa_s, int res)
-{
-	size_t i, j;
-	struct os_reltime now, tmp;
-	int dur;
-
-	os_get_reltime(&now);
-	os_reltime_sub(&now, &wpa_s->osu_icon_fetch_start, &tmp);
-	dur = tmp.sec * 1000 + tmp.usec / 1000;
-	wpa_printf(MSG_DEBUG, "HS 2.0: Icon fetch dur=%d ms res=%d",
-		   dur, res);
-
-	for (i = 0; i < wpa_s->osu_prov_count; i++) {
-		struct osu_provider *osu = &wpa_s->osu_prov[i];
-		for (j = 0; j < osu->icon_count; j++) {
-			struct osu_icon *icon = &osu->icon[j];
-			if (icon->id || icon->failed)
-				continue;
-			if (res < 0)
-				icon->failed = 1;
-			else
-				icon->id = wpa_s->osu_icon_id;
-			return;
-		}
-	}
-}
-
-
 void hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant *wpa_s,
 				  struct wpa_bss *bss, const u8 *sa,
 				  const u8 *data, size_t slen, u8 dialog_token)
@@ -607,7 +276,6 @@
 	const u8 *pos = data;
 	u8 subtype;
 	struct wpa_bss_anqp *anqp = NULL;
-	int ret;
 
 	if (slen < 2)
 		return;
@@ -678,46 +346,6 @@
 				wpabuf_alloc_copy(pos, slen);
 		}
 		break;
-	case HS20_STYPE_OSU_PROVIDERS_LIST:
-		wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
-			" OSU Providers list", MAC2STR(sa));
-		wpa_s->num_prov_found++;
-		if (anqp) {
-			wpabuf_free(anqp->hs20_osu_providers_list);
-			anqp->hs20_osu_providers_list =
-				wpabuf_alloc_copy(pos, slen);
-		}
-		break;
-	case HS20_STYPE_ICON_BINARY_FILE:
-		ret = hs20_process_icon_binary_file(wpa_s, sa, pos, slen,
-						    dialog_token);
-		if (wpa_s->fetch_osu_icon_in_progress) {
-			hs20_osu_icon_fetch_result(wpa_s, ret);
-			eloop_cancel_timeout(hs20_continue_icon_fetch,
-					     wpa_s, NULL);
-			eloop_register_timeout(0, 0, hs20_continue_icon_fetch,
-					       wpa_s, NULL);
-		}
-		break;
-	case HS20_STYPE_OPERATOR_ICON_METADATA:
-		wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
-			" Operator Icon Metadata", MAC2STR(sa));
-		wpa_hexdump(MSG_DEBUG, "Operator Icon Metadata", pos, slen);
-		if (anqp) {
-			wpabuf_free(anqp->hs20_operator_icon_metadata);
-			anqp->hs20_operator_icon_metadata =
-				wpabuf_alloc_copy(pos, slen);
-		}
-		break;
-	case HS20_STYPE_OSU_PROVIDERS_NAI_LIST:
-		wpa_msg(wpa_s, MSG_INFO, RX_HS20_ANQP MACSTR
-			" OSU Providers NAI List", MAC2STR(sa));
-		if (anqp) {
-			wpabuf_free(anqp->hs20_osu_providers_nai_list);
-			anqp->hs20_osu_providers_nai_list =
-				wpabuf_alloc_copy(pos, slen);
-		}
-		break;
 	default:
 		wpa_printf(MSG_DEBUG, "HS20: Unsupported subtype %u", subtype);
 		break;
@@ -725,582 +353,6 @@
 }
 
 
-void hs20_notify_parse_done(struct wpa_supplicant *wpa_s)
-{
-	if (!wpa_s->fetch_osu_icon_in_progress)
-		return;
-	if (eloop_is_timeout_registered(hs20_continue_icon_fetch, wpa_s, NULL))
-		return;
-	/*
-	 * We are going through icon fetch, but no icon response was received.
-	 * Assume this means the current AP could not provide an answer to avoid
-	 * getting stuck in fetch iteration.
-	 */
-	hs20_icon_fetch_failed(wpa_s);
-}
-
-
-static void hs20_free_osu_prov_entry(struct osu_provider *prov)
-{
-}
-
-
-void hs20_free_osu_prov(struct wpa_supplicant *wpa_s)
-{
-	size_t i;
-	for (i = 0; i < wpa_s->osu_prov_count; i++)
-		hs20_free_osu_prov_entry(&wpa_s->osu_prov[i]);
-	os_free(wpa_s->osu_prov);
-	wpa_s->osu_prov = NULL;
-	wpa_s->osu_prov_count = 0;
-}
-
-
-static void hs20_osu_fetch_done(struct wpa_supplicant *wpa_s)
-{
-	char fname[256];
-	FILE *f;
-	size_t i, j;
-
-	wpa_s->fetch_osu_info = 0;
-	wpa_s->fetch_osu_icon_in_progress = 0;
-
-	if (wpa_s->conf->osu_dir == NULL) {
-		hs20_free_osu_prov(wpa_s);
-		wpa_s->fetch_anqp_in_progress = 0;
-		return;
-	}
-
-	snprintf(fname, sizeof(fname), "%s/osu-providers.txt",
-		 wpa_s->conf->osu_dir);
-	f = fopen(fname, "w");
-	if (f == NULL) {
-		wpa_msg(wpa_s, MSG_INFO,
-			"Could not write OSU provider information");
-		hs20_free_osu_prov(wpa_s);
-		wpa_s->fetch_anqp_in_progress = 0;
-		return;
-	}
-
-	hs20_set_osu_access_permission(wpa_s->conf->osu_dir, fname);
-
-	for (i = 0; i < wpa_s->osu_prov_count; i++) {
-		struct osu_provider *osu = &wpa_s->osu_prov[i];
-		if (i > 0)
-			fprintf(f, "\n");
-		fprintf(f, "OSU-PROVIDER " MACSTR "\n"
-			"uri=%s\n"
-			"methods=%08x\n",
-			MAC2STR(osu->bssid), osu->server_uri, osu->osu_methods);
-		if (osu->osu_ssid_len) {
-			fprintf(f, "osu_ssid=%s\n",
-				wpa_ssid_txt(osu->osu_ssid,
-					     osu->osu_ssid_len));
-		}
-		if (osu->osu_ssid2_len) {
-			fprintf(f, "osu_ssid2=%s\n",
-				wpa_ssid_txt(osu->osu_ssid2,
-					     osu->osu_ssid2_len));
-		}
-		if (osu->osu_nai[0])
-			fprintf(f, "osu_nai=%s\n", osu->osu_nai);
-		if (osu->osu_nai2[0])
-			fprintf(f, "osu_nai2=%s\n", osu->osu_nai2);
-		for (j = 0; j < osu->friendly_name_count; j++) {
-			fprintf(f, "friendly_name=%s:%s\n",
-				osu->friendly_name[j].lang,
-				osu->friendly_name[j].text);
-		}
-		for (j = 0; j < osu->serv_desc_count; j++) {
-			fprintf(f, "desc=%s:%s\n",
-				osu->serv_desc[j].lang,
-				osu->serv_desc[j].text);
-		}
-		for (j = 0; j < osu->icon_count; j++) {
-			struct osu_icon *icon = &osu->icon[j];
-			if (icon->failed)
-				continue; /* could not fetch icon */
-			fprintf(f, "icon=%u:%u:%u:%s:%s:%s\n",
-				icon->id, icon->width, icon->height, icon->lang,
-				icon->icon_type, icon->filename);
-		}
-	}
-	fclose(f);
-	hs20_free_osu_prov(wpa_s);
-
-	wpa_msg(wpa_s, MSG_INFO, "OSU provider fetch completed");
-	wpa_s->fetch_anqp_in_progress = 0;
-}
-
-
-void hs20_next_osu_icon(struct wpa_supplicant *wpa_s)
-{
-	size_t i, j;
-
-	wpa_printf(MSG_DEBUG, "HS 2.0: Ready to fetch next icon");
-
-	for (i = 0; i < wpa_s->osu_prov_count; i++) {
-		struct osu_provider *osu = &wpa_s->osu_prov[i];
-		for (j = 0; j < osu->icon_count; j++) {
-			struct osu_icon *icon = &osu->icon[j];
-			if (icon->id || icon->failed)
-				continue;
-
-			wpa_printf(MSG_DEBUG, "HS 2.0: Try to fetch icon '%s' "
-				   "from " MACSTR, icon->filename,
-				   MAC2STR(osu->bssid));
-			os_get_reltime(&wpa_s->osu_icon_fetch_start);
-			if (hs20_anqp_send_req(wpa_s, osu->bssid,
-					       BIT(HS20_STYPE_ICON_REQUEST),
-					       (u8 *) icon->filename,
-					       os_strlen(icon->filename),
-					       0) < 0) {
-				icon->failed = 1;
-				continue;
-			}
-			return;
-		}
-	}
-
-	wpa_printf(MSG_DEBUG, "HS 2.0: No more icons to fetch");
-	hs20_osu_fetch_done(wpa_s);
-}
-
-
-static void hs20_osu_add_prov(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
-			      const u8 *osu_ssid, u8 osu_ssid_len,
-			      const u8 *osu_ssid2, u8 osu_ssid2_len,
-			      const u8 *pos, size_t len)
-{
-	struct osu_provider *prov;
-	const u8 *end = pos + len;
-	u16 len2;
-	const u8 *pos2;
-	u8 uri_len, osu_method_len, osu_nai_len;
-
-	wpa_hexdump(MSG_DEBUG, "HS 2.0: Parsing OSU Provider", pos, len);
-	prov = os_realloc_array(wpa_s->osu_prov,
-				wpa_s->osu_prov_count + 1,
-				sizeof(*prov));
-	if (prov == NULL)
-		return;
-	wpa_s->osu_prov = prov;
-	prov = &prov[wpa_s->osu_prov_count];
-	os_memset(prov, 0, sizeof(*prov));
-
-	os_memcpy(prov->bssid, bss->bssid, ETH_ALEN);
-	os_memcpy(prov->osu_ssid, osu_ssid, osu_ssid_len);
-	prov->osu_ssid_len = osu_ssid_len;
-	if (osu_ssid2)
-		os_memcpy(prov->osu_ssid2, osu_ssid2, osu_ssid2_len);
-	prov->osu_ssid2_len = osu_ssid2_len;
-
-	/* OSU Friendly Name Length */
-	if (end - pos < 2) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
-			   "Friendly Name Length");
-		return;
-	}
-	len2 = WPA_GET_LE16(pos);
-	pos += 2;
-	if (len2 > end - pos) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
-			   "Friendly Name Duples");
-		return;
-	}
-	pos2 = pos;
-	pos += len2;
-
-	/* OSU Friendly Name Duples */
-	while (pos - pos2 >= 4 && prov->friendly_name_count < OSU_MAX_ITEMS) {
-		struct osu_lang_string *f;
-		u8 slen;
-
-		slen = pos2[0];
-		if (1 + slen > pos - pos2) {
-			wpa_printf(MSG_DEBUG, "Invalid OSU Friendly Name");
-			break;
-		}
-		if (slen < 3) {
-			wpa_printf(MSG_DEBUG,
-				   "Invalid OSU Friendly Name (no room for language)");
-			break;
-		}
-		f = &prov->friendly_name[prov->friendly_name_count++];
-		pos2++;
-		os_memcpy(f->lang, pos2, 3);
-		pos2 += 3;
-		slen -= 3;
-		os_memcpy(f->text, pos2, slen);
-		pos2 += slen;
-	}
-
-	/* OSU Server URI */
-	if (end - pos < 1) {
-		wpa_printf(MSG_DEBUG,
-			   "HS 2.0: Not enough room for OSU Server URI length");
-		return;
-	}
-	uri_len = *pos++;
-	if (uri_len > end - pos) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Server "
-			   "URI");
-		return;
-	}
-	os_memcpy(prov->server_uri, pos, uri_len);
-	pos += uri_len;
-
-	/* OSU Method list */
-	if (end - pos < 1) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Method "
-			   "list length");
-		return;
-	}
-	osu_method_len = pos[0];
-	if (osu_method_len > end - pos - 1) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU Method "
-			   "list");
-		return;
-	}
-	pos2 = pos + 1;
-	pos += 1 + osu_method_len;
-	while (pos2 < pos) {
-		if (*pos2 < 32)
-			prov->osu_methods |= BIT(*pos2);
-		pos2++;
-	}
-
-	/* Icons Available Length */
-	if (end - pos < 2) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for Icons "
-			   "Available Length");
-		return;
-	}
-	len2 = WPA_GET_LE16(pos);
-	pos += 2;
-	if (len2 > end - pos) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for Icons "
-			   "Available");
-		return;
-	}
-	pos2 = pos;
-	pos += len2;
-
-	/* Icons Available */
-	while (pos2 < pos) {
-		struct osu_icon *icon = &prov->icon[prov->icon_count];
-		u8 flen;
-
-		if (2 + 2 + 3 + 1 + 1 > pos - pos2) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Invalid Icon Metadata");
-			break;
-		}
-
-		icon->width = WPA_GET_LE16(pos2);
-		pos2 += 2;
-		icon->height = WPA_GET_LE16(pos2);
-		pos2 += 2;
-		os_memcpy(icon->lang, pos2, 3);
-		pos2 += 3;
-
-		flen = *pos2++;
-		if (flen > pos - pos2) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon Type");
-			break;
-		}
-		os_memcpy(icon->icon_type, pos2, flen);
-		pos2 += flen;
-
-		if (pos - pos2 < 1) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon "
-				   "Filename length");
-			break;
-		}
-		flen = *pos2++;
-		if (flen > pos - pos2) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Not room for Icon "
-				   "Filename");
-			break;
-		}
-		os_memcpy(icon->filename, pos2, flen);
-		pos2 += flen;
-
-		prov->icon_count++;
-	}
-
-	/* OSU_NAI */
-	if (end - pos < 1) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU_NAI");
-		return;
-	}
-	osu_nai_len = *pos++;
-	if (osu_nai_len > end - pos) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU_NAI");
-		return;
-	}
-	os_memcpy(prov->osu_nai, pos, osu_nai_len);
-	pos += osu_nai_len;
-
-	/* OSU Service Description Length */
-	if (end - pos < 2) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
-			   "Service Description Length");
-		return;
-	}
-	len2 = WPA_GET_LE16(pos);
-	pos += 2;
-	if (len2 > end - pos) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for OSU "
-			   "Service Description Duples");
-		return;
-	}
-	pos2 = pos;
-	pos += len2;
-
-	/* OSU Service Description Duples */
-	while (pos - pos2 >= 4 && prov->serv_desc_count < OSU_MAX_ITEMS) {
-		struct osu_lang_string *f;
-		u8 descr_len;
-
-		descr_len = *pos2++;
-		if (descr_len > pos - pos2 || descr_len < 3) {
-			wpa_printf(MSG_DEBUG, "Invalid OSU Service "
-				   "Description");
-			break;
-		}
-		f = &prov->serv_desc[prov->serv_desc_count++];
-		os_memcpy(f->lang, pos2, 3);
-		os_memcpy(f->text, pos2 + 3, descr_len - 3);
-		pos2 += descr_len;
-	}
-
-	wpa_printf(MSG_DEBUG, "HS 2.0: Added OSU Provider through " MACSTR,
-		   MAC2STR(bss->bssid));
-	wpa_s->osu_prov_count++;
-}
-
-
-void hs20_osu_icon_fetch(struct wpa_supplicant *wpa_s)
-{
-	struct wpa_bss *bss;
-	struct wpabuf *prov_anqp;
-	const u8 *pos, *end;
-	u16 len;
-	const u8 *osu_ssid, *osu_ssid2;
-	u8 osu_ssid_len, osu_ssid2_len;
-	u8 num_providers;
-
-	hs20_free_osu_prov(wpa_s);
-
-	dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
-		struct wpa_ie_data data;
-		const u8 *ie;
-
-		if (bss->anqp == NULL)
-			continue;
-		prov_anqp = bss->anqp->hs20_osu_providers_list;
-		if (prov_anqp == NULL)
-			continue;
-		ie = wpa_bss_get_rsne(wpa_s, bss, NULL, false);
-		if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &data) == 0 &&
-		    (data.key_mgmt & WPA_KEY_MGMT_OSEN)) {
-			osu_ssid2 = bss->ssid;
-			osu_ssid2_len = bss->ssid_len;
-		} else {
-			osu_ssid2 = NULL;
-			osu_ssid2_len = 0;
-		}
-		wpa_printf(MSG_DEBUG, "HS 2.0: Parsing OSU Providers list from "
-			   MACSTR, MAC2STR(bss->bssid));
-		wpa_hexdump_buf(MSG_DEBUG, "HS 2.0: OSU Providers list",
-				prov_anqp);
-		pos = wpabuf_head(prov_anqp);
-		end = pos + wpabuf_len(prov_anqp);
-
-		/* OSU SSID */
-		if (end - pos < 1)
-			continue;
-		if (1 + pos[0] > end - pos) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for "
-				   "OSU SSID");
-			continue;
-		}
-		osu_ssid_len = *pos++;
-		if (osu_ssid_len > SSID_MAX_LEN) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Invalid OSU SSID "
-				   "Length %u", osu_ssid_len);
-			continue;
-		}
-		osu_ssid = pos;
-		pos += osu_ssid_len;
-
-		if (end - pos < 1) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Not enough room for "
-				   "Number of OSU Providers");
-			continue;
-		}
-		num_providers = *pos++;
-		wpa_printf(MSG_DEBUG, "HS 2.0: Number of OSU Providers: %u",
-			   num_providers);
-
-		/* OSU Providers */
-		while (end - pos > 2 && num_providers > 0) {
-			num_providers--;
-			len = WPA_GET_LE16(pos);
-			pos += 2;
-			if (len > (unsigned int) (end - pos))
-				break;
-			hs20_osu_add_prov(wpa_s, bss, osu_ssid,
-					  osu_ssid_len, osu_ssid2,
-					  osu_ssid2_len, pos, len);
-			pos += len;
-		}
-
-		if (pos != end) {
-			wpa_printf(MSG_DEBUG, "HS 2.0: Ignored %d bytes of "
-				   "extra data after OSU Providers",
-				   (int) (end - pos));
-		}
-
-		prov_anqp = bss->anqp->hs20_osu_providers_nai_list;
-		if (!prov_anqp)
-			continue;
-		wpa_printf(MSG_DEBUG,
-			   "HS 2.0: Parsing OSU Providers NAI List from "
-			   MACSTR, MAC2STR(bss->bssid));
-		wpa_hexdump_buf(MSG_DEBUG, "HS 2.0: OSU Providers NAI List",
-				prov_anqp);
-		pos = wpabuf_head(prov_anqp);
-		end = pos + wpabuf_len(prov_anqp);
-		num_providers = 0;
-		while (end - pos > 0) {
-			len = *pos++;
-			if (end - pos < len) {
-				wpa_printf(MSG_DEBUG,
-					   "HS 2.0: Not enough room for OSU_NAI");
-				break;
-			}
-			if (num_providers >= wpa_s->osu_prov_count) {
-				wpa_printf(MSG_DEBUG,
-					   "HS 2.0: Ignore unexpected OSU Provider NAI List entries");
-				break;
-			}
-			os_memcpy(wpa_s->osu_prov[num_providers].osu_nai2,
-				  pos, len);
-			pos += len;
-			num_providers++;
-		}
-	}
-
-	wpa_s->fetch_osu_icon_in_progress = 1;
-	hs20_next_osu_icon(wpa_s);
-}
-
-
-static void hs20_osu_scan_res_handler(struct wpa_supplicant *wpa_s,
-				      struct wpa_scan_results *scan_res)
-{
-	wpa_printf(MSG_DEBUG, "OSU provisioning fetch scan completed");
-	if (!wpa_s->fetch_osu_waiting_scan) {
-		wpa_printf(MSG_DEBUG, "OSU fetch have been canceled");
-		return;
-	}
-	wpa_s->network_select = 0;
-	wpa_s->fetch_all_anqp = 1;
-	wpa_s->fetch_osu_info = 1;
-	wpa_s->fetch_osu_icon_in_progress = 0;
-
-	interworking_start_fetch_anqp(wpa_s);
-}
-
-
-int hs20_fetch_osu(struct wpa_supplicant *wpa_s, int skip_scan)
-{
-	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
-			   "interface disabled");
-		return -1;
-	}
-
-	if (wpa_s->scanning) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
-			   "scanning");
-		return -1;
-	}
-
-	if (wpa_s->conf->osu_dir == NULL) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
-			   "osu_dir not configured");
-		return -1;
-	}
-
-	if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) {
-		wpa_printf(MSG_DEBUG, "HS 2.0: Cannot start fetch_osu - "
-			   "fetch in progress (%d, %d)",
-			   wpa_s->fetch_anqp_in_progress,
-			   wpa_s->network_select);
-		return -1;
-	}
-
-	wpa_msg(wpa_s, MSG_INFO, "Starting OSU provisioning information fetch");
-	wpa_s->num_osu_scans = 0;
-	wpa_s->num_prov_found = 0;
-	if (skip_scan) {
-		wpa_s->network_select = 0;
-		wpa_s->fetch_all_anqp = 1;
-		wpa_s->fetch_osu_info = 1;
-		wpa_s->fetch_osu_icon_in_progress = 0;
-
-		interworking_start_fetch_anqp(wpa_s);
-	} else {
-		hs20_start_osu_scan(wpa_s);
-	}
-
-	return 0;
-}
-
-
-void hs20_start_osu_scan(struct wpa_supplicant *wpa_s)
-{
-	wpa_s->fetch_osu_waiting_scan = 1;
-	wpa_s->num_osu_scans++;
-	wpa_s->scan_req = MANUAL_SCAN_REQ;
-	wpa_s->scan_res_handler = hs20_osu_scan_res_handler;
-	wpa_supplicant_req_scan(wpa_s, 0, 0);
-}
-
-
-void hs20_cancel_fetch_osu(struct wpa_supplicant *wpa_s)
-{
-	wpa_printf(MSG_DEBUG, "Cancel OSU fetch");
-	interworking_stop_fetch_anqp(wpa_s);
-	wpa_s->fetch_osu_waiting_scan = 0;
-	wpa_s->network_select = 0;
-	wpa_s->fetch_osu_info = 0;
-	wpa_s->fetch_osu_icon_in_progress = 0;
-}
-
-
-void hs20_icon_fetch_failed(struct wpa_supplicant *wpa_s)
-{
-	hs20_osu_icon_fetch_result(wpa_s, -1);
-	eloop_cancel_timeout(hs20_continue_icon_fetch, wpa_s, NULL);
-	eloop_register_timeout(0, 0, hs20_continue_icon_fetch, wpa_s, NULL);
-}
-
-
-void hs20_rx_subscription_remediation(struct wpa_supplicant *wpa_s,
-				      const char *url, u8 osu_method)
-{
-	if (url)
-		wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION "%u %s",
-			osu_method, url);
-	else
-		wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION);
-	wpas_notify_hs20_rx_subscription_remediation(wpa_s, url, osu_method);
-}
-
-
 void hs20_rx_deauth_imminent_notice(struct wpa_supplicant *wpa_s, u8 code,
 				    u16 reauth_delay, const char *url)
 {
@@ -1355,18 +407,3 @@
 
 	wpas_notify_hs20_t_c_acceptance(wpa_s, url);
 }
-
-
-void hs20_init(struct wpa_supplicant *wpa_s)
-{
-	dl_list_init(&wpa_s->icon_head);
-}
-
-
-void hs20_deinit(struct wpa_supplicant *wpa_s)
-{
-	eloop_cancel_timeout(hs20_continue_icon_fetch, wpa_s, NULL);
-	hs20_free_osu_prov(wpa_s);
-	if (wpa_s->icon_head.next)
-		hs20_del_icon(wpa_s, NULL, NULL);
-}
diff --git a/wpa_supplicant/hs20_supplicant.h b/wpa_supplicant/hs20_supplicant.h
index 2d478f4..3ff766e 100644
--- a/wpa_supplicant/hs20_supplicant.h
+++ b/wpa_supplicant/hs20_supplicant.h
@@ -15,7 +15,7 @@
 				 const struct wpa_ssid *ssid);
 
 int hs20_anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, u32 stypes,
-		       const u8 *payload, size_t payload_len, int inmem);
+		       const u8 *payload, size_t payload_len);
 void hs20_put_anqp_req(u32 stypes, const u8 *payload, size_t payload_len,
 		       struct wpabuf *buf);
 void hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant *wpa_s,
@@ -26,27 +26,10 @@
 int is_hs20_network(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
 		    struct wpa_bss *bss);
 int hs20_get_pps_mo_id(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid);
-void hs20_notify_parse_done(struct wpa_supplicant *wpa_s);
 
-void hs20_rx_subscription_remediation(struct wpa_supplicant *wpa_s,
-				      const char *url, u8 osu_method);
 void hs20_rx_deauth_imminent_notice(struct wpa_supplicant *wpa_s, u8 code,
 				    u16 reauth_delay, const char *url);
 void hs20_rx_t_c_acceptance(struct wpa_supplicant *wpa_s, const char *url);
 
-void hs20_free_osu_prov(struct wpa_supplicant *wpa_s);
-void hs20_next_osu_icon(struct wpa_supplicant *wpa_s);
-void hs20_osu_icon_fetch(struct wpa_supplicant *wpa_s);
-int hs20_fetch_osu(struct wpa_supplicant *wpa_s, int skip_scan);
-void hs20_cancel_fetch_osu(struct wpa_supplicant *wpa_s);
-void hs20_icon_fetch_failed(struct wpa_supplicant *wpa_s);
-void hs20_start_osu_scan(struct wpa_supplicant *wpa_s);
-void hs20_init(struct wpa_supplicant *wpa_s);
-void hs20_deinit(struct wpa_supplicant *wpa_s);
-int hs20_get_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
-		  const char *file_name, size_t offset, size_t size,
-		  char *reply, size_t buf_len);
-int hs20_del_icon(struct wpa_supplicant *wpa_s, const u8 *bssid,
-		  const char *file_name);
 
 #endif /* HS20_SUPPLICANT_H */
diff --git a/wpa_supplicant/ibss_rsn.c b/wpa_supplicant/ibss_rsn.c
index 25039a0..06228d0 100644
--- a/wpa_supplicant/ibss_rsn.c
+++ b/wpa_supplicant/ibss_rsn.c
@@ -150,6 +150,12 @@
 {
 	struct ibss_rsn_peer *peer = ctx;
 
+	if (key_flag & KEY_FLAG_NEXT) {
+		wpa_printf(MSG_DEBUG,
+			   "SUPP: Ignore set_key with KEY_FLAG_NEXT");
+		return 0;
+	}
+
 	wpa_printf(MSG_DEBUG, "SUPP: %s(alg=%d addr=" MACSTR " key_idx=%d "
 		   "set_tx=%d)",
 		   __func__, alg, MAC2STR(addr), key_idx, set_tx);
@@ -320,6 +326,12 @@
 	struct ibss_rsn *ibss_rsn = ctx;
 	u8 seq[6];
 
+	if (key_flag & KEY_FLAG_NEXT) {
+		wpa_printf(MSG_DEBUG,
+			   "AUTH: Ignore set_key with KEY_FLAG_NEXT");
+		return 0;
+	}
+
 	os_memset(seq, 0, sizeof(seq));
 
 	if (addr) {
@@ -485,7 +497,7 @@
 				"\x01\x00\x00\x0f\xac\x04"
 				"\x01\x00\x00\x0f\xac\x02"
 				"\x00\x00", 22, NULL, 0, NULL, 0, NULL, 0,
-				NULL) != WPA_IE_OK) {
+				NULL, false) != WPA_IE_OK) {
 		wpa_printf(MSG_DEBUG, "AUTH: wpa_validate_wpa_ie() failed");
 		return -1;
 	}
diff --git a/wpa_supplicant/interworking.c b/wpa_supplicant/interworking.c
index 651907b..bc26006 100644
--- a/wpa_supplicant/interworking.c
+++ b/wpa_supplicant/interworking.c
@@ -303,10 +303,6 @@
 			wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
 		if (all)
 			wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
-		if (all) {
-			wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_LIST);
-			wpabuf_put_u8(extra, HS20_STYPE_OSU_PROVIDERS_NAI_LIST);
-		}
 		gas_anqp_set_element_len(extra, len_pos);
 	}
 #endif /* CONFIG_HS20 */
@@ -1502,18 +1498,18 @@
 		char *anon;
 		/* Use anonymous NAI in Phase 1 */
 		pos = os_strchr(cred->username, '@');
-		if (pos) {
-			size_t buflen = 9 + os_strlen(pos) + 1;
-			anon = os_malloc(buflen);
-			if (anon == NULL)
-				return -1;
-			os_snprintf(anon, buflen, "anonymous%s", pos);
-		} else if (cred->realm) {
+		if (cred->realm) {
 			size_t buflen = 10 + os_strlen(cred->realm) + 1;
 			anon = os_malloc(buflen);
 			if (anon == NULL)
 				return -1;
 			os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
+		} else if (pos) {
+			size_t buflen = 9 + os_strlen(pos) + 1;
+			anon = os_malloc(buflen);
+			if (anon == NULL)
+				return -1;
+			os_snprintf(anon, buflen, "anonymous%s", pos);
 		} else {
 			anon = os_strdup("anonymous");
 			if (anon == NULL)
@@ -2698,23 +2694,14 @@
 	int found = 0;
 
 	wpa_printf(MSG_DEBUG, "Interworking: next_anqp_fetch - "
-		   "fetch_anqp_in_progress=%d fetch_osu_icon_in_progress=%d",
-		   wpa_s->fetch_anqp_in_progress,
-		   wpa_s->fetch_osu_icon_in_progress);
+		   "fetch_anqp_in_progress=%d",
+		   wpa_s->fetch_anqp_in_progress);
 
 	if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress) {
 		wpa_printf(MSG_DEBUG, "Interworking: Stop next-ANQP-fetch");
 		return;
 	}
 
-#ifdef CONFIG_HS20
-	if (wpa_s->fetch_osu_icon_in_progress) {
-		wpa_printf(MSG_DEBUG, "Interworking: Next icon (in progress)");
-		hs20_next_osu_icon(wpa_s);
-		return;
-	}
-#endif /* CONFIG_HS20 */
-
 	dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
 		if (!(bss->caps & IEEE80211_CAP_ESS))
 			continue;
@@ -2747,20 +2734,6 @@
 	}
 
 	if (found == 0) {
-#ifdef CONFIG_HS20
-		if (wpa_s->fetch_osu_info) {
-			if (wpa_s->num_prov_found == 0 &&
-			    wpa_s->fetch_osu_waiting_scan &&
-			    wpa_s->num_osu_scans < 3) {
-				wpa_printf(MSG_DEBUG, "HS 2.0: No OSU providers seen - try to scan again");
-				hs20_start_osu_scan(wpa_s);
-				return;
-			}
-			wpa_printf(MSG_DEBUG, "Interworking: Next icon");
-			hs20_osu_icon_fetch(wpa_s);
-			return;
-		}
-#endif /* CONFIG_HS20 */
 		wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
 		wpa_s->fetch_anqp_in_progress = 0;
 		if (wpa_s->network_select)
@@ -2793,7 +2766,6 @@
 
 	wpa_s->network_select = 0;
 	wpa_s->fetch_all_anqp = 1;
-	wpa_s->fetch_osu_info = 0;
 
 	interworking_start_fetch_anqp(wpa_s);
 
@@ -3141,10 +3113,6 @@
 		   " dialog_token=%u result=%d status_code=%u",
 		   MAC2STR(dst), dialog_token, result, status_code);
 	if (result != GAS_QUERY_SUCCESS) {
-#ifdef CONFIG_HS20
-		if (wpa_s->fetch_osu_icon_in_progress)
-			hs20_icon_fetch_failed(wpa_s);
-#endif /* CONFIG_HS20 */
 		anqp_result = "FAILURE";
 		goto out;
 	}
@@ -3154,10 +3122,6 @@
 	    pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
 		wpa_msg(wpa_s, MSG_DEBUG,
 			"ANQP: Unexpected Advertisement Protocol in response");
-#ifdef CONFIG_HS20
-		if (wpa_s->fetch_osu_icon_in_progress)
-			hs20_icon_fetch_failed(wpa_s);
-#endif /* CONFIG_HS20 */
 		anqp_result = "INVALID_FRAME";
 		goto out;
 	}
@@ -3208,9 +3172,6 @@
 out_parse_done:
 	if (bss)
 		wpas_notify_bss_anqp_changed(wpa_s, bss->id);
-#ifdef CONFIG_HS20
-	hs20_notify_parse_done(wpa_s);
-#endif /* CONFIG_HS20 */
 out:
 	wpas_notify_anqp_query_done(wpa_s, dst, anqp_result, bss ? bss->anqp : NULL);
 }
@@ -3233,7 +3194,6 @@
 	wpa_s->auto_network_select = 0;
 	wpa_s->auto_select = !!auto_select;
 	wpa_s->fetch_all_anqp = 0;
-	wpa_s->fetch_osu_info = 0;
 	wpa_msg(wpa_s, MSG_DEBUG,
 		"Interworking: Start scan for network selection");
 	wpa_s->scan_res_handler = interworking_scan_res_handler;
diff --git a/wpa_supplicant/nan_usd.c b/wpa_supplicant/nan_usd.c
index 577c8ac..946d62f 100644
--- a/wpa_supplicant/nan_usd.c
+++ b/wpa_supplicant/nan_usd.c
@@ -369,7 +369,7 @@
 		return -1;
 
 	if (p2p) {
-		elems = wpas_p2p_usd_elems(wpa_s);
+		elems = wpas_p2p_usd_elems(wpa_s, service_name);
 		addr = wpa_s->global->p2p_dev_addr;
 	} else {
 		addr = wpa_s->own_addr;
@@ -417,6 +417,16 @@
 }
 
 
+int wpas_nan_usd_unpause_publish(struct wpa_supplicant *wpa_s, int publish_id,
+				 u8 peer_instance_id, const u8 *peer_addr)
+{
+	if (!wpa_s->nan_de)
+		return -1;
+	return nan_de_unpause_publish(wpa_s->nan_de, publish_id,
+				      peer_instance_id, peer_addr);
+}
+
+
 int wpas_nan_usd_subscribe(struct wpa_supplicant *wpa_s,
 			   const char *service_name,
 			   enum nan_service_protocol_type srv_proto_type,
@@ -431,7 +441,7 @@
 		return -1;
 
 	if (p2p) {
-		elems = wpas_p2p_usd_elems(wpa_s);
+		elems = wpas_p2p_usd_elems(wpa_s, service_name);
 		addr = wpa_s->global->p2p_dev_addr;
 	} else {
 		addr = wpa_s->own_addr;
diff --git a/wpa_supplicant/nan_usd.h b/wpa_supplicant/nan_usd.h
index 59c0989..6a43fb2 100644
--- a/wpa_supplicant/nan_usd.h
+++ b/wpa_supplicant/nan_usd.h
@@ -26,6 +26,8 @@
 void wpas_nan_usd_cancel_publish(struct wpa_supplicant *wpa_s, int publish_id);
 int wpas_nan_usd_update_publish(struct wpa_supplicant *wpa_s, int publish_id,
 				const struct wpabuf *ssi);
+int wpas_nan_usd_unpause_publish(struct wpa_supplicant *wpa_s, int publish_id,
+				 u8 peer_instance_id, const u8 *peer_addr);
 int wpas_nan_usd_subscribe(struct wpa_supplicant *wpa_s,
 			   const char *service_name,
 			   enum nan_service_protocol_type srv_proto_type,
diff --git a/wpa_supplicant/notify.c b/wpa_supplicant/notify.c
index ea6fc69..b5d4c21 100644
--- a/wpa_supplicant/notify.c
+++ b/wpa_supplicant/notify.c
@@ -931,10 +931,12 @@
 	wpas_dbus_signal_p2p_bootstrap_req(wpa_s, src, bootstrap_method);
 }
 
-void wpas_notify_p2p_bootstrap_completed(struct wpa_supplicant *wpa_s,
-					 const u8 *src, int status)
+void wpas_notify_p2p_bootstrap_rsp(struct wpa_supplicant *wpa_s,
+				   const u8 *src, int status,
+				   u16 bootstrap_method)
 {
-	wpas_dbus_signal_p2p_bootstrap_completed(wpa_s, src, status);
+	wpas_dbus_signal_p2p_bootstrap_rsp(wpa_s, src, status,
+					   bootstrap_method);
 }
 
 #endif /* CONFIG_P2P */
diff --git a/wpa_supplicant/notify.h b/wpa_supplicant/notify.h
index 5775e37..dc8ceaf 100644
--- a/wpa_supplicant/notify.h
+++ b/wpa_supplicant/notify.h
@@ -168,8 +168,9 @@
 					 const u8 *bssid, int id, int op_freq);
 void wpas_notify_p2p_bootstrap_req(struct wpa_supplicant *wpa_s,
 				   const u8 *src, u16 bootstrap_method);
-void wpas_notify_p2p_bootstrap_completed(struct wpa_supplicant *wpa_s,
-					 const u8 *src, int status);
+void wpas_notify_p2p_bootstrap_rsp(struct wpa_supplicant *wpa_s,
+				   const u8 *src, int status,
+				   u16 bootstrap_method);
 void wpas_notify_mesh_group_started(struct wpa_supplicant *wpa_s,
 				    struct wpa_ssid *ssid);
 void wpas_notify_mesh_group_removed(struct wpa_supplicant *wpa_s,
diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c
index 0c88e17..f924dde 100644
--- a/wpa_supplicant/p2p_supplicant.c
+++ b/wpa_supplicant/p2p_supplicant.c
@@ -156,7 +156,8 @@
 static int wpas_p2p_add_group_interface(struct wpa_supplicant *wpa_s,
 					enum wpa_driver_if_type type);
 static void wpas_p2p_group_formation_failed(struct wpa_supplicant *wpa_s,
-					    int already_deleted);
+					    int already_deleted,
+					    const char *reason);
 static void wpas_p2p_optimize_listen_channel(struct wpa_supplicant *wpa_s,
 					     struct wpa_used_freq_data *freqs,
 					     unsigned int num);
@@ -1016,7 +1017,7 @@
 		wpa_printf(MSG_DEBUG, "P2P: Cancelled P2P group formation "
 			   "timeout");
 		wpa_s->p2p_in_provisioning = 0;
-		wpas_p2p_group_formation_failed(wpa_s, 1);
+		wpas_p2p_group_formation_failed(wpa_s, 1, reason);
 	}
 
 	wpa_s->p2p_in_invitation = 0;
@@ -1182,7 +1183,7 @@
 
 static int wpas_p2p_store_persistent_group(struct wpa_supplicant *wpa_s,
 					   struct wpa_ssid *ssid,
-					   const u8 *go_dev_addr)
+					   const u8 *go_dev_addr, int dik_id)
 {
 	struct wpa_ssid *s;
 	int changed = 0;
@@ -1195,6 +1196,9 @@
 		    s->ssid_len == ssid->ssid_len &&
 		    os_memcmp(ssid->ssid, s->ssid, ssid->ssid_len) == 0)
 			break;
+
+		if (dik_id && s->go_dik_id == dik_id)
+			break;
 	}
 
 	if (s) {
@@ -1238,6 +1242,7 @@
 	s->pmk_valid = ssid->pmk_valid;
 	s->pairwise_cipher = ssid->pbss ? WPA_CIPHER_GCMP : WPA_CIPHER_CCMP;
 	s->export_keys = 1;
+	s->go_dik_id = dik_id;
 
 	if (ssid->sae_password) {
 		os_free(s->sae_password);
@@ -1276,8 +1281,43 @@
 }
 
 
+static void wpas_p2p2_add_group_client_dik_id(struct wpa_ssid *s, int dik_id)
+{
+	size_t i;
+	bool found = false;
+	size_t num = int_array_len(s->p2p2_client_list);
+
+	for (i = 0; i < num; i++) {
+		if (s->p2p2_client_list[i] != dik_id)
+			continue;
+
+		if (i == num - 1)
+			return; /* already the most recent entry */
+
+		/* Move the entry to mark it most recent */
+		os_memmove(s->p2p2_client_list + i,
+			   s->p2p2_client_list + i + 1,
+			   (num - i - 1) * sizeof(int));
+		s->p2p2_client_list[num - 1] = dik_id;
+		found = true;
+		break;
+	}
+
+	if (!found && num < P2P_MAX_STORED_CLIENTS) {
+		int_array_add_unique(&s->p2p2_client_list, dik_id);
+	} else if (!found && s->p2p2_client_list) {
+		/* Not enough room for an additional entry - drop the oldest
+		 * entry
+		 */
+		os_memmove(s->p2p2_client_list, s->p2p2_client_list + 1,
+			   (num - 1) * sizeof(int));
+		s->p2p2_client_list[num - 1] = dik_id;
+	}
+}
+
+
 static void wpas_p2p_add_persistent_group_client(struct wpa_supplicant *wpa_s,
-						 const u8 *addr)
+						 const u8 *addr, int dik_id)
 {
 	struct wpa_ssid *ssid, *s;
 	u8 *n;
@@ -1302,6 +1342,11 @@
 	if (s == NULL)
 		return;
 
+	if (dik_id) {
+		wpas_p2p2_add_group_client_dik_id(s, dik_id);
+		goto done;
+	}
+
 	for (i = 0; s->p2p_client_list && i < s->num_p2p_clients; i++) {
 		if (!ether_addr_equal(s->p2p_client_list + i * 2 * ETH_ALEN,
 				      addr))
@@ -1349,6 +1394,7 @@
 			  0xff, ETH_ALEN);
 	}
 
+done:
 	if (p2p_wpa_s->conf->update_config &&
 	    wpa_config_write(p2p_wpa_s->confname, p2p_wpa_s->conf))
 		wpa_printf(MSG_DEBUG, "P2P: Failed to update configuration");
@@ -1416,10 +1462,10 @@
 }
 
 
-static void wpas_p2p_store_identity(struct wpa_supplicant *wpa_s, u8 cipher,
-				    const u8 *dik_data, size_t dik_len,
-				    const u8 *pmk, size_t pmk_len,
-				    const u8 *pmkid)
+static int wpas_p2p_store_identity(struct wpa_supplicant *wpa_s, u8 cipher,
+				   const u8 *dik_data, size_t dik_len,
+				   const u8 *pmk, size_t pmk_len,
+				   const u8 *pmkid)
 {
 	struct wpa_dev_ik *ik;
 
@@ -1436,7 +1482,7 @@
 	wpa_printf(MSG_DEBUG, "P2P: Create a new device identity entry");
 	ik = wpa_config_add_identity(wpa_s->conf);
 	if (!ik)
-		return;
+		return 0;
 
 	ik->dik = wpabuf_alloc_copy(dik_data, dik_len);
 	if (!ik->dik)
@@ -1451,17 +1497,20 @@
 	ik->dik_cipher = cipher;
 
 	if (wpa_s->conf->update_config &&
-	    wpa_config_write(wpa_s->confname, wpa_s->conf))
+	    wpa_config_write(wpa_s->confname, wpa_s->conf)) {
 		wpa_printf(MSG_DEBUG, "P2P: Failed to update configuration");
-	return;
+		return 0;
+	}
+	return ik->id;
 
 fail:
 	wpa_config_remove_identity(wpa_s->conf, ik->id);
+	return 0;
 }
 
 
-static void wpas_p2p_store_go_identity(struct wpa_supplicant *wpa_s,
-				       const u8 *go_dev_addr, const u8 *bssid)
+static int wpas_p2p_store_go_identity(struct wpa_supplicant *wpa_s,
+				      const u8 *go_dev_addr, const u8 *bssid)
 {
 	int ret;
 	u8 cipher;
@@ -1471,12 +1520,12 @@
 	struct wpa_supplicant *p2p_wpa_s = wpa_s->global->p2p_init_wpa_s;
 
 	if (!wpa_s->p2p2)
-		return;
+		return 0;
 
 	ret = p2p_get_dev_identity_key(p2p_wpa_s->global->p2p, go_dev_addr,
 				       &dik_data, &dik_len, &cipher);
 	if (ret)
-		return;
+		return 0;
 
 	ret = p2p_get_interface_addr(p2p_wpa_s->global->p2p, go_dev_addr,
 				     iface_addr);
@@ -1489,19 +1538,20 @@
 	ret = wpa_sm_pmksa_get_pmk(wpa_s->wpa, iface_addr, &pmk, &pmk_len,
 				   &pmkid);
 	if (ret)
-		return;
+		return 0;
 
 	wpa_printf(MSG_DEBUG,
 		   "P2P: Storing Device identity of GO (Interface Addr " MACSTR
 		   ")",
 		   MAC2STR(iface_addr));
-	wpas_p2p_store_identity(p2p_wpa_s, cipher, dik_data, dik_len, pmk,
-				pmk_len, pmkid);
+	return wpas_p2p_store_identity(p2p_wpa_s, cipher, dik_data, dik_len,
+				       pmk, pmk_len, pmkid);
 }
 
 
 static void wpas_group_formation_completed(struct wpa_supplicant *wpa_s,
-					   int success, int already_deleted)
+					   int already_deleted,
+					   const char *failure_reason)
 {
 	struct wpa_ssid *ssid;
 	int client;
@@ -1518,7 +1568,7 @@
 	if (wpa_s->p2p_go_group_formation_completed) {
 		wpa_s->global->p2p_group_formation = NULL;
 		wpa_s->p2p_in_provisioning = 0;
-	} else if (wpa_s->p2p_in_provisioning && !success) {
+	} else if (wpa_s->p2p_in_provisioning && failure_reason) {
 		wpa_msg(wpa_s, MSG_DEBUG,
 			"P2P: Stop provisioning state due to failure");
 		wpa_s->p2p_in_provisioning = 0;
@@ -1527,10 +1577,10 @@
 	wpa_s->p2p_retry_limit = 0;
 	wpa_s->group_formation_reported = 1;
 
-	if (!success) {
+	if (failure_reason) {
 		wpa_msg_global(wpa_s->p2pdev, MSG_INFO,
 			       P2P_EVENT_GROUP_FORMATION_FAILURE);
-		wpas_notify_p2p_group_formation_failure(wpa_s, "");
+		wpas_notify_p2p_group_formation_failure(wpa_s, failure_reason);
 		if (already_deleted)
 			return;
 		wpas_p2p_group_delete(wpa_s,
@@ -1589,7 +1639,7 @@
 
 	if (persistent)
 		wpas_p2p_store_persistent_group(wpa_s->p2pdev,
-						ssid, go_dev_addr);
+						ssid, go_dev_addr, 0);
 	else {
 		os_free(wpa_s->global->add_psk);
 		wpa_s->global->add_psk = NULL;
@@ -2211,7 +2261,8 @@
 		wpa_auth_pmksa_add_sae(hapd->wpa_auth,
 				       params->peer_device_addr,
 				       params->pmk, params->pmk_len,
-				       params->pmkid, WPA_KEY_MGMT_SAE);
+				       params->pmkid, WPA_KEY_MGMT_SAE,
+				       false);
 		hostapd_add_pmkid(hapd, params->peer_device_addr,
 				  params->pmk, params->pmk_len,
 				  params->pmkid, WPA_KEY_MGMT_SAE);
@@ -2255,7 +2306,7 @@
 		if (params->persistent_group) {
 			wpas_p2p_store_persistent_group(
 				wpa_s->p2pdev, ssid,
-				wpa_s->global->p2p_dev_addr);
+				wpa_s->global->p2p_dev_addr, 0);
 			wpas_p2p_add_psk_list(wpa_s, ssid);
 		}
 
@@ -2290,7 +2341,7 @@
 	}
 
 	if (params->p2p2) {
-		wpas_group_formation_completed(wpa_s, 1, 0);
+		wpas_group_formation_completed(wpa_s, 0, NULL);
 		wpa_printf(MSG_DEBUG,
 			   "P2P2: Group formation completed - first connection in progress");
 		goto out;
@@ -2771,18 +2822,25 @@
 #endif /* CONFIG_PASN */
 
 	wpa_printf(MSG_DEBUG, "P2P: Group Formation timed out");
-	wpas_p2p_group_formation_failed(wpa_s, 0);
+	wpas_p2p_group_formation_failed(wpa_s, 0, "Group formation timed out");
 }
 
 
 static void wpas_p2p_group_formation_failed(struct wpa_supplicant *wpa_s,
-					    int already_deleted)
+					    int already_deleted,
+					    const char *reason)
 {
+	 /* reason == NULL would indicate success in
+	  * wpas_group_formation_completed(), so make sure that is not the case
+	  * here. */
+	if (!reason)
+		reason = "";
+
 	eloop_cancel_timeout(wpas_p2p_group_formation_timeout,
 			     wpa_s->p2pdev, NULL);
 	if (wpa_s->global->p2p)
 		p2p_group_formation_failed(wpa_s->global->p2p);
-	wpas_group_formation_completed(wpa_s, 0, already_deleted);
+	wpas_group_formation_completed(wpa_s, already_deleted, reason);
 }
 
 
@@ -2859,7 +2917,8 @@
 		wpa_auth_pmksa_add_sae(hapd->wpa_auth,
 				       params->peer_device_addr,
 				       params->pmk, params->pmk_len,
-				       params->pmkid, WPA_KEY_MGMT_SAE);
+				       params->pmkid, WPA_KEY_MGMT_SAE,
+				       false);
 		hostapd_add_pmkid(hapd, params->peer_device_addr,
 				  params->pmk, params->pmk_len,
 				  params->pmkid, WPA_KEY_MGMT_SAE);
@@ -2940,7 +2999,8 @@
 			wpas_p2p_remove_pending_group_interface(wpa_s);
 			eloop_cancel_timeout(wpas_p2p_long_listen_timeout,
 					     wpa_s, NULL);
-			wpas_p2p_group_formation_failed(wpa_s, 1);
+			wpas_p2p_group_formation_failed(wpa_s, 1,
+							"Could not initialize group interface");
 			return;
 		}
 		os_memset(wpa_s->pending_interface_addr, 0, ETH_ALEN);
@@ -3164,7 +3224,7 @@
 	unsigned int duration;
 
 	if (deinit) {
-		if (work->started) {
+		if (work->started && !wpa_s->p2p_removing_listen_work) {
 			wpa_s->p2p_listen_work = NULL;
 			wpas_stop_listen(wpa_s);
 		}
@@ -3179,6 +3239,7 @@
 	if (wpa_drv_probe_req_report(wpa_s, 1) < 0) {
 		wpa_printf(MSG_DEBUG, "P2P: Failed to request the driver to "
 			   "report received Probe Request frames");
+		p2p_listen_failed(wpa_s->global->p2p, lwork->freq);
 		wpas_p2p_listen_work_done(wpa_s);
 		return;
 	}
@@ -3199,6 +3260,7 @@
 		wpa_printf(MSG_DEBUG, "P2P: Failed to request the driver "
 			   "to remain on channel (%u MHz) for Listen "
 			   "state", lwork->freq);
+		p2p_listen_failed(wpa_s->global->p2p, lwork->freq);
 		wpas_p2p_listen_work_done(wpa_s);
 		wpa_s->pending_listen_freq = 0;
 		return;
@@ -3651,7 +3713,8 @@
 				  size_t ssid_len, int *go, u8 *group_bssid,
 				  int *force_freq, int persistent_group,
 				  const struct p2p_channels *channels,
-				  int dev_pw_id, bool p2p2)
+				  int dev_pw_id, bool p2p2, const u8 **new_ssid,
+				  size_t *new_ssid_len)
 {
 	struct wpa_supplicant *wpa_s = ctx;
 	struct wpa_ssid *s;
@@ -3721,7 +3784,41 @@
 			break;
 	}
 
-	if (!s) {
+	if (p2p2) {
+		int dik_id;
+		u8 go_ssid[SSID_MAX_LEN];
+
+		dik_id = p2p_get_dik_id(wpa_s->global->p2p, sa);
+		s = wpa_config_get_network_with_dik_id(wpa_s->conf, dik_id);
+		if (!s) {
+			wpa_printf(MSG_DEBUG, "P2P2: Invitation from " MACSTR
+				   " requested reinvocation of an unknown group",
+				   MAC2STR(sa));
+			return P2P_SC_FAIL_UNKNOWN_GROUP;
+		}
+		os_free(s->ssid);
+		if (s->mode == WPAS_MODE_P2P_GO) {
+			p2p_build_ssid(wpa_s->global->p2p, go_ssid,
+				       &s->ssid_len);
+			s->ssid = os_memdup(go_ssid, s->ssid_len);
+			if (!s->ssid) {
+				s->ssid_len = 0;
+				return P2P_SC_FAIL_UNABLE_TO_ACCOMMODATE;
+			}
+			wpa_printf(MSG_DEBUG,
+				   "P2P: New random SSID for the group: %s",
+				   wpa_ssid_txt(s->ssid, s->ssid_len));
+			*new_ssid = s->ssid;
+			*new_ssid_len = s->ssid_len;
+		} else {
+			s->ssid_len = ssid_len;
+			s->ssid = os_memdup(ssid, ssid_len);
+			if (!s->ssid) {
+				s->ssid_len = 0;
+				return P2P_SC_FAIL_UNABLE_TO_ACCOMMODATE;
+			}
+		}
+	} else if (!s) {
 		wpa_printf(MSG_DEBUG, "P2P: Invitation from " MACSTR
 			   " requested reinvocation of an unknown group",
 			   MAC2STR(sa));
@@ -3828,19 +3925,25 @@
 			   " was accepted; op_freq=%d MHz, SSID=%s",
 			   MAC2STR(sa), op_freq, wpa_ssid_txt(ssid, ssid_len));
 		if (s) {
+			const char *ssid_txt;
+
+			ssid_txt = wpa_ssid_txt(s->ssid, s->ssid_len);
 			int go = s->mode == WPAS_MODE_P2P_GO;
 			if (go) {
 				wpa_msg_global(wpa_s, MSG_INFO,
 					       P2P_EVENT_INVITATION_ACCEPTED
 					       "sa=" MACSTR
-					       " persistent=%d freq=%d",
-					       MAC2STR(sa), s->id, op_freq);
+					       " persistent=%d freq=%d ssid=\"%s\" go_dev_addr="
+					       MACSTR, MAC2STR(sa), s->id,
+					       op_freq, ssid_txt,
+					       MAC2STR(go_dev_addr));
 			} else {
 				wpa_msg_global(wpa_s, MSG_INFO,
 					       P2P_EVENT_INVITATION_ACCEPTED
 					       "sa=" MACSTR
-					       " persistent=%d",
-					       MAC2STR(sa), s->id);
+					       " persistent=%d ssid=\"%s\" go_dev_addr=" MACSTR,
+					       MAC2STR(sa), s->id, ssid_txt,
+					       MAC2STR(go_dev_addr));
 			}
 			wpas_p2p_group_add_persistent(
 				wpa_s, s, go, 0, op_freq, 0,
@@ -3966,11 +4069,73 @@
 }
 
 
-static void wpas_invitation_result(void *ctx, int status, const u8 *bssid,
+static void wpas_msg_p2p_invitation_result(struct wpa_supplicant *wpa_s,
+					   int status, const u8 *new_ssid,
+					   size_t new_ssid_len, const u8 *bssid,
+					   const u8 *go_dev_addr)
+{
+	int res;
+	char buf[500];
+	char *pos, *end;
+	const char *ssid_txt = NULL;
+
+	pos = buf;
+	end = buf + sizeof(buf);
+
+	if (go_dev_addr && new_ssid && new_ssid_len) {
+		ssid_txt = wpa_ssid_txt(new_ssid, new_ssid_len);
+	} else if (go_dev_addr) {
+		struct wpa_ssid *ssid;
+
+		ssid = wpa_config_get_network(wpa_s->conf,
+					      wpa_s->pending_invite_ssid_id);
+		if (ssid)
+			ssid_txt = wpa_ssid_txt(ssid->ssid, ssid->ssid_len);
+	}
+
+	res = os_snprintf(pos, end - pos, "status=%d", status);
+	if (os_snprintf_error(end - pos, res))
+		goto fail;
+	pos += res;
+
+	if (bssid) {
+		res = os_snprintf(pos, end - pos, " " MACSTR, MAC2STR(bssid));
+		if (os_snprintf_error(end - pos, res))
+			goto fail;
+		pos += res;
+	}
+
+	if (ssid_txt) {
+		res = os_snprintf(pos, end - pos, " ssid=\"%s\"", ssid_txt);
+		if (os_snprintf_error(end - pos, res))
+			goto fail;
+		pos += res;
+	}
+
+	if (go_dev_addr) {
+		res = os_snprintf(pos, end - pos, " go_dev_addr=" MACSTR,
+				  MAC2STR(go_dev_addr));
+		if (os_snprintf_error(end - pos, res))
+			goto fail;
+		pos += res;
+	}
+
+	wpa_msg_global(wpa_s, MSG_INFO, P2P_EVENT_INVITATION_RESULT "%s", buf);
+	return;
+
+fail:
+	wpa_printf(MSG_DEBUG,
+		   "P2P: Failed to send P2P-INVITATION-RESULT message");
+}
+
+
+static void wpas_invitation_result(void *ctx, int status, const u8 *new_ssid,
+				   size_t new_ssid_len, const u8 *bssid,
 				   const struct p2p_channels *channels,
 				   const u8 *peer, int neg_freq,
 				   int peer_oper_freq, const u8 *pmkid,
-				   const u8 *pmk, size_t pmk_len)
+				   const u8 *pmk, size_t pmk_len,
+				   const u8 *go_dev_addr)
 {
 	struct wpa_supplicant *wpa_s = ctx;
 	struct wpa_ssid *ssid;
@@ -3983,14 +4148,8 @@
 	}
 #endif /* CONFIG_PASN */
 
-	if (bssid) {
-		wpa_msg_global(wpa_s, MSG_INFO, P2P_EVENT_INVITATION_RESULT
-			       "status=%d " MACSTR,
-			       status, MAC2STR(bssid));
-	} else {
-		wpa_msg_global(wpa_s, MSG_INFO, P2P_EVENT_INVITATION_RESULT
-			       "status=%d ", status);
-	}
+	wpas_msg_p2p_invitation_result(wpa_s, status, new_ssid, new_ssid_len,
+				       bssid, go_dev_addr);
 	wpas_notify_p2p_invitation_result(wpa_s, status, bssid);
 
 	wpa_printf(MSG_DEBUG, "P2P: Invitation result - status=%d peer=" MACSTR,
@@ -4053,6 +4212,16 @@
 		return;
 	}
 
+	if (new_ssid && new_ssid_len) {
+		os_free(ssid->ssid);
+		ssid->ssid = os_memdup(new_ssid, new_ssid_len);
+		if (!ssid->ssid) {
+			ssid->ssid_len = 0;
+			return;
+		}
+		ssid->ssid_len = new_ssid_len;
+	}
+
 	/*
 	 * The peer could have missed our ctrl::ack frame for Invitation
 	 * Response and continue retransmitting the frame. To reduce the
@@ -5313,19 +5482,27 @@
 	struct wpa_supplicant *wpa_s = eloop_ctx;
 
 	wpa_printf(MSG_DEBUG, "P2P2: Send bootstrapping comeback PD Request");
-	wpas_p2p_connect(wpa_s, wpa_s->p2p_bootstrap_dev_addr, wpa_s->p2p_pin,
-			 wpa_s->p2p_wps_method, wpa_s->p2p_persistent_group, 0,
-			 0, 0, wpa_s->p2p_go_intent, wpa_s->p2p_connect_freq,
-			 wpa_s->p2p_go_vht_center_freq2,
-			 wpa_s->p2p_persistent_id,
-			 wpa_s->p2p_pd_before_go_neg,
-			 wpa_s->p2p_go_ht40,
-			 wpa_s->p2p_go_vht,
-			 wpa_s->p2p_go_max_oper_chwidth,
-			 wpa_s->p2p_go_he,
-			 wpa_s->p2p_go_edmg,
-			 NULL, 0, is_p2p_allow_6ghz(wpa_s->global->p2p),
-			 wpa_s->p2p2, wpa_s->p2p_bootstrap, NULL, false);
+
+	if (wpa_s->p2p_pd_before_go_neg) {
+		wpas_p2p_connect(wpa_s, wpa_s->p2p_bootstrap_dev_addr,
+				 wpa_s->p2p_pin, wpa_s->p2p_wps_method,
+				 wpa_s->p2p_persistent_group, 0, 0, 0,
+				 wpa_s->p2p_go_intent, wpa_s->p2p_connect_freq,
+				 wpa_s->p2p_go_vht_center_freq2,
+				 wpa_s->p2p_persistent_id, 1,
+				 wpa_s->p2p_go_ht40,
+				 wpa_s->p2p_go_vht,
+				 wpa_s->p2p_go_max_oper_chwidth,
+				 wpa_s->p2p_go_he,
+				 wpa_s->p2p_go_edmg,
+				 NULL, 0, is_p2p_allow_6ghz(wpa_s->global->p2p),
+				 wpa_s->p2p2, wpa_s->p2p_bootstrap, NULL,
+				 false);
+	} else {
+		p2p_prov_disc_req(wpa_s->global->p2p,
+				  wpa_s->p2p_bootstrap_dev_addr, NULL,
+				  0, 0, 0, 1);
+	}
 }
 
 
@@ -5356,12 +5533,13 @@
 }
 
 
-static void wpas_bootstrap_completed(void *ctx, const u8 *addr,
-				     enum p2p_status_code status, int freq)
+static void wpas_bootstrap_rsp_rx(void *ctx, const u8 *addr,
+				  enum p2p_status_code status, int freq,
+				  u16 bootstrap_method)
 {
 	struct wpa_supplicant *wpa_s = ctx;
 
-	wpas_notify_p2p_bootstrap_completed(wpa_s, addr, status);
+	wpas_notify_p2p_bootstrap_rsp(wpa_s, addr, status, bootstrap_method);
 
 	if (status) {
 		wpa_msg_global(wpa_s, MSG_INFO,
@@ -5375,13 +5553,14 @@
 		       MAC2STR(addr), status);
 
 #ifdef CONFIG_PASN
-	wpas_p2p_initiate_pasn_auth(wpa_s, addr, freq);
+	if (wpa_s->p2p_pd_before_go_neg)
+		wpas_p2p_initiate_pasn_auth(wpa_s, addr, freq);
 #endif /* CONFIG_PASN */
 }
 
 
-static void wpas_validate_dira(void *ctx, const u8 *peer_addr,
-			       const u8 *dira, size_t dira_len)
+static int wpas_validate_dira(void *ctx, const u8 *peer_addr,
+			      const u8 *dira_nonce, const u8 *dira_tag)
 {
 	struct wpa_supplicant *wpa_s = ctx;
 	int ret;
@@ -5391,24 +5570,11 @@
 	size_t len[3];
 	const char *label = "DIR";
 
-	if (dira_len < 1 || dira[0] != DIRA_CIPHER_VERSION_128) {
-		wpa_printf(MSG_ERROR,
-			   "P2P2: Unsupported DIRA cipher version %d", dira[0]);
-		return;
-	}
-
-	if (dira_len < 1 + DEVICE_IDENTITY_NONCE_LEN + DEVICE_IDENTITY_TAG_LEN)
-	{
-		wpa_printf(MSG_INFO, "P2P2: Truncated DIRA (length %zu)",
-			   dira_len);
-		return;
-	}
-
 	addr[0] = (const u8 *) label;
 	len[0] = DIR_STR_LEN;
 	addr[1] = peer_addr;
 	len[1] = ETH_ALEN;
-	addr[2] = &dira[1];
+	addr[2] = dira_nonce;
 	len[2] = DEVICE_IDENTITY_NONCE_LEN;
 
 	for (ik = wpa_s->conf->identity; ik; ik = ik->next) {
@@ -5422,18 +5588,17 @@
 		if (ret < 0) {
 			wpa_printf(MSG_ERROR,
 				   "P2P2: Failed to derive DIRA Tag");
-			return;
+			return 0;
 		}
 
-		if (os_memcmp(tag, &dira[1 + DEVICE_IDENTITY_NONCE_LEN],
-			      DEVICE_IDENTITY_TAG_LEN) == 0) {
+		if (os_memcmp(tag, dira_tag, DEVICE_IDENTITY_TAG_LEN) == 0) {
 			wpa_printf(MSG_DEBUG, "P2P2: DIRA Tag matched");
 			break;
 		}
 	}
 
 	if (!ik)
-		return;
+		return 0;
 
 #ifdef CONFIG_PASN
 	p2p_pasn_pmksa_set_pmk(wpa_s->global->p2p, wpa_s->global->p2p_dev_addr,
@@ -5441,6 +5606,8 @@
 			       wpabuf_head(ik->pmk), wpabuf_len(ik->pmk),
 			       wpabuf_head(ik->pmkid));
 #endif /* CONFIG_PASN */
+
+	return ik->id;
 }
 
 
@@ -5527,6 +5694,16 @@
 	return p2p_parse_data_element(p2p, data, len);
 }
 
+
+static int wpas_p2p_pasn_validate_pmkid(void *ctx, const u8 *addr,
+					const u8 *rsn_pmkid)
+{
+	struct wpa_supplicant *wpa_s = ctx;
+
+	return p2p_pasn_validate_and_update_pmkid(wpa_s->global->p2p, addr,
+						  rsn_pmkid);
+}
+
 #endif /* CONFIG_PASN */
 
 
@@ -5657,12 +5834,13 @@
 	p2p.p2p_dfs_chan_enable = wpa_s->conf->p2p_dfs_chan_enable;
 	p2p.register_bootstrap_comeback = wpas_p2p_register_bootstrap_comeback;
 	p2p.bootstrap_req_rx = wpas_bootstrap_req_rx;
-	p2p.bootstrap_completed = wpas_bootstrap_completed;
+	p2p.bootstrap_rsp_rx = wpas_bootstrap_rsp_rx;
 	p2p.validate_dira = wpas_validate_dira;
 #ifdef CONFIG_PASN
 	p2p.pasn_send_mgmt = wpas_p2p_pasn_send_mgmt;
 	p2p.prepare_data_element = wpas_p2p_prepare_data_element;
 	p2p.parse_data_element = wpas_p2p_parse_data_element;
+	p2p.pasn_validate_pmkid = wpas_p2p_pasn_validate_pmkid;
 #endif /* CONFIG_PASN */
 
 	os_memcpy(wpa_s->global->p2p_dev_addr, wpa_s->own_addr, ETH_ALEN);
@@ -7036,6 +7214,12 @@
 			wpas_p2p_remove_pending_group_interface(wpa_s);
 		return -1;
 	}
+
+#ifdef CONFIG_PASN
+	if (wpa_s->p2p2 && !wpa_s->p2p_pd_before_go_neg)
+		wpas_p2p_initiate_pasn_auth(wpa_s, peer_addr, force_freq);
+#endif /* CONFIG_PASN */
+
 	return ret;
 }
 
@@ -8302,7 +8486,7 @@
 	}
 	if (wpa_s->global->p2p)
 		p2p_wps_success_cb(wpa_s->global->p2p, peer_addr);
-	wpas_group_formation_completed(wpa_s, 1, 0);
+	wpas_group_formation_completed(wpa_s, 0, NULL);
 }
 
 
@@ -8351,7 +8535,7 @@
 
 
 int wpas_p2p_prov_disc(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
-		       const char *config_method,
+		       const char *config_method, u16 bootstrap,
 		       enum wpas_p2p_prov_disc_use use,
 		       struct p2ps_provision *p2ps_prov)
 {
@@ -8373,6 +8557,12 @@
 			   p2ps_prov->status, p2ps_prov->info);
 
 		config_methods = 0;
+	} else if (bootstrap) {
+		wpa_s->p2p2 = true;
+		config_methods = 0;
+		wpa_s->p2p_bootstrap = bootstrap;
+		p2p_set_req_bootstrap_method(wpa_s->global->p2p, peer_addr,
+					     bootstrap);
 	} else if (os_strncmp(config_method, "display", 7) == 0)
 		config_methods = WPS_CONFIG_DISPLAY;
 	else if (os_strncmp(config_method, "keypad", 6) == 0)
@@ -8702,6 +8892,22 @@
 	else
 		os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
 
+	if (wpa_s->global->p2p && p2p2 && !ssid && peer_addr) {
+		int dik_id;
+
+		dik_id = p2p_get_dik_id(wpa_s->global->p2p, peer_addr);
+		ssid = wpa_config_get_network_with_dik_id(wpa_s->conf, dik_id);
+		if (!ssid) {
+			wpa_printf(MSG_DEBUG,
+				   "P2P: Could not find SSID for P2P2 peer "
+				   MACSTR, MAC2STR(peer_addr));
+			return -1;
+		}
+	}
+
+	if (!ssid)
+		return -1;
+
 	wpa_s->p2p_persistent_go_freq = freq;
 	wpa_s->p2p_go_ht40 = !!ht40;
 	wpa_s->p2p_go_vht = !!vht;
@@ -8766,7 +8972,8 @@
 
 #ifdef CONFIG_PASN
 	if (p2p2) {
-		if (wpas_p2p_initiate_pasn_verify(wpa_s, peer_addr, role, bssid,
+		if (peer_addr &&
+		    wpas_p2p_initiate_pasn_verify(wpa_s, peer_addr, role, bssid,
 						  ssid->ssid, ssid->ssid_len,
 						  force_freq, go_dev_addr,
 						  pref_freq) < 0) {
@@ -8873,7 +9080,7 @@
 	struct wpa_ssid *ssid = wpa_s->current_ssid;
 	const u8 *bssid;
 	u8 go_dev_addr[ETH_ALEN];
-	int persistent;
+	int persistent, dik_id;
 	int freq;
 	u8 ip[3 * 4], *ip_ptr = NULL;
 	char ip_addr[100];
@@ -8938,9 +9145,9 @@
 			       ip_addr);
 
 	if (persistent) {
+		dik_id = wpas_p2p_store_go_identity(wpa_s, go_dev_addr, bssid);
 		wpas_p2p_store_persistent_group(wpa_s->p2pdev,
-						ssid, go_dev_addr);
-		wpas_p2p_store_go_identity(wpa_s, go_dev_addr, bssid);
+						ssid, go_dev_addr, dik_id);
 	}
 
 	wpas_notify_p2p_group_started(wpa_s, ssid, persistent, 1, ip_ptr);
@@ -9407,7 +9614,7 @@
 		   "session overlap");
 	if (wpa_s != wpa_s->p2pdev)
 		wpa_msg_ctrl(wpa_s->p2pdev, MSG_INFO, WPS_EVENT_OVERLAP);
-	wpas_p2p_group_formation_failed(wpa_s, 0);
+	wpas_p2p_group_formation_failed(wpa_s, 0, "WPS PBC session overlap");
 	return 1;
 }
 
@@ -9516,7 +9723,8 @@
 			eloop_cancel_timeout(wpas_p2p_group_formation_timeout,
 					     wpa_s->p2pdev, NULL);
 			if (wpa_s->p2p_in_provisioning) {
-				wpas_group_formation_completed(wpa_s, 0, 0);
+				wpas_group_formation_completed(wpa_s, 0,
+							       "Canceled");
 				break;
 			}
 			wpas_p2p_group_delete(wpa_s,
@@ -9526,7 +9734,7 @@
 			wpa_printf(MSG_DEBUG, "P2P: Interface %s in invitation found - cancelling",
 				   wpa_s->ifname);
 			found = 1;
-			wpas_p2p_group_formation_failed(wpa_s, 0);
+			wpas_p2p_group_formation_failed(wpa_s, 0, "Canceled");
 			break;
 		}
 	}
@@ -9700,8 +9908,8 @@
 }
 
 
-static void wpas_p2p_store_client_identity(struct wpa_supplicant *wpa_s,
-					   const u8 *addr)
+static int wpas_p2p_store_client_identity(struct wpa_supplicant *wpa_s,
+					  const u8 *addr)
 {
 	u8 cipher;
 	size_t dik_len;
@@ -9713,15 +9921,15 @@
 	struct wpa_supplicant *p2p_wpa_s = wpa_s->global->p2p_init_wpa_s;
 
 	if (!wpa_s->p2p2 || !wpa_s->ap_iface)
-		return;
+		return 0;
 
 	hapd = wpa_s->ap_iface->bss[0];
 	if (!hapd)
-		return;
+		return 0;
 
 	if (p2p_get_dev_identity_key(p2p_wpa_s->global->p2p, addr,
 				     &dik_data, &dik_len, &cipher))
-		return;
+		return 0;
 
 	wpa_printf(MSG_DEBUG, "P2P: Fetch PMK from client (Device Addr " MACSTR
 		   ")", MAC2STR(addr));
@@ -9729,26 +9937,28 @@
 				   &pmkid)) {
 		if (p2p_get_interface_addr(p2p_wpa_s->global->p2p, addr,
 					   iface_addr))
-			return;
+			return 0;
 		wpa_printf(MSG_DEBUG,
 			   "P2P: Fetch PMK from client (Interface Addr " MACSTR
 			   ")", MAC2STR(iface_addr));
 		if (wpa_auth_pmksa_get_pmk(hapd->wpa_auth, iface_addr, &pmk,
 					   &pmk_len, &pmkid))
-			return;
+			return 0;
 	}
 
 	wpa_printf(MSG_DEBUG,
 		   "P2P: Storing device identity of client (Device Addr "
 		   MACSTR ")", MAC2STR(addr));
-	wpas_p2p_store_identity(p2p_wpa_s, cipher, dik_data, dik_len, pmk,
-				pmk_len, pmkid);
+	return wpas_p2p_store_identity(p2p_wpa_s, cipher, dik_data, dik_len,
+				       pmk, pmk_len, pmkid);
 }
 
 
 void wpas_p2p_notify_ap_sta_authorized(struct wpa_supplicant *wpa_s,
 				       const u8 *addr)
 {
+	int dik_id;
+
 	if (eloop_cancel_timeout(wpas_p2p_group_formation_timeout,
 				 wpa_s->p2pdev, NULL) > 0) {
 		/*
@@ -9773,7 +9983,7 @@
 			 */
 			if (wpa_s->global->p2p)
 				p2p_wps_success_cb(wpa_s->global->p2p, addr);
-			wpas_group_formation_completed(wpa_s, 1, 0);
+			wpas_group_formation_completed(wpa_s, 0, NULL);
 		}
 	}
 	if (!wpa_s->p2p_go_group_formation_completed) {
@@ -9788,8 +9998,8 @@
 	if (addr == NULL)
 		return;
 
-	wpas_p2p_store_client_identity(wpa_s, addr);
-	wpas_p2p_add_persistent_group_client(wpa_s, addr);
+	dik_id = wpas_p2p_store_client_identity(wpa_s, addr);
+	wpas_p2p_add_persistent_group_client(wpa_s, addr, dik_id);
 }
 
 
@@ -11331,12 +11541,14 @@
 }
 
 
-struct wpabuf * wpas_p2p_usd_elems(struct wpa_supplicant *wpa_s)
+struct wpabuf * wpas_p2p_usd_elems(struct wpa_supplicant *wpa_s,
+				   const char *service_name)
 {
 	struct p2p_data *p2p = wpa_s->global->p2p;
 
 	if (wpa_s->global->p2p_disabled || !p2p)
 		return NULL;
+	p2p_usd_service_hash(p2p, service_name);
 	return p2p_usd_elems(p2p);
 }
 
@@ -11397,6 +11609,29 @@
 #endif /* CONFIG_PASN */
 
 
+int wpas_p2p_get_dira(struct wpa_supplicant *wpa_s, char *buf, size_t buf_len)
+{
+	struct p2p_data *p2p = wpa_s->global->p2p;
+
+	if (wpa_s->global->p2p_disabled || !p2p)
+		return 0;
+	return p2p_get_dira_info(p2p, buf, buf_len);
+}
+
+
+int wpas_p2p_validate_dira(struct wpa_supplicant *wpa_s, const u8 *addr,
+			   u8 cipher, const u8 *nonce, const u8 *tag)
+{
+	if (cipher != DIRA_CIPHER_VERSION_128) {
+		wpa_printf(MSG_INFO, "P2P2: Unsupported DIRA cipher version %d",
+			   cipher);
+		return 0;
+	}
+
+	return wpas_validate_dira(wpa_s, addr, nonce, tag);
+}
+
+
 void wpas_p2p_update_dev_addr(struct wpa_supplicant *wpa_s)
 {
 	os_memcpy(wpa_s->global->p2p_dev_addr, wpa_s->own_addr, ETH_ALEN);
diff --git a/wpa_supplicant/p2p_supplicant.h b/wpa_supplicant/p2p_supplicant.h
index 888bce5..c5f2f9c 100644
--- a/wpa_supplicant/p2p_supplicant.h
+++ b/wpa_supplicant/p2p_supplicant.h
@@ -67,7 +67,7 @@
 	WPAS_P2P_PD_FOR_ASP
 };
 int wpas_p2p_prov_disc(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
-		       const char *config_method,
+		       const char *config_method, u16 bootstrap,
 		       enum wpas_p2p_prov_disc_use use,
 		       struct p2ps_provision *p2ps_prov);
 void wpas_send_action_tx_status(struct wpa_supplicant *wpa_s, const u8 *dst,
@@ -236,13 +236,17 @@
 		      unsigned int count);
 int wpas_p2p_lo_stop(struct wpa_supplicant *wpa_s);
 int wpas_p2p_mac_setup(struct wpa_supplicant *wpa_s);
-struct wpabuf * wpas_p2p_usd_elems(struct wpa_supplicant *wpa_s);
+struct wpabuf * wpas_p2p_usd_elems(struct wpa_supplicant *wpa_s,
+				   const char *service_name);
 void wpas_p2p_update_dev_addr(struct wpa_supplicant *wpa_s);
 int wpas_p2p_pasn_auth_rx(struct wpa_supplicant *wpa_s,
 			  const struct ieee80211_mgmt *mgmt, size_t len,
 			  int freq);
 int wpas_p2p_get_pasn_ptk(struct wpa_supplicant *wpa_s, const u8 **ptk,
 			  size_t *ptk_len);
+int wpas_p2p_get_dira(struct wpa_supplicant *wpa_s, char *buf, size_t buf_len);
+int wpas_p2p_validate_dira(struct wpa_supplicant *wpa_s, const u8 *addr,
+			   u8 cipher, const u8 *nonce, const u8 *tag);
 
 #else /* CONFIG_P2P */
 
@@ -369,7 +373,8 @@
 	return 0;
 }
 
-static inline struct wpabuf * wpas_p2p_usd_elems(struct wpa_supplicant *wpa_s)
+static inline struct wpabuf * wpas_p2p_usd_elems(struct wpa_supplicant *wpa_s,
+					const char *service_name)
 {
 	return NULL;
 }
diff --git a/wpa_supplicant/pasn_supplicant.c b/wpa_supplicant/pasn_supplicant.c
index a46fe46..b290e30 100644
--- a/wpa_supplicant/pasn_supplicant.c
+++ b/wpa_supplicant/pasn_supplicant.c
@@ -251,13 +251,13 @@
 #endif /* CONFIG_SHA384 */
 #endif /* CONFIG_IEEE80211R */
 #ifdef CONFIG_SAE
-	} else if ((sel & WPA_KEY_MGMT_SAE_EXT_KEY) &&
+	} else if ((sel & WPA_KEY_MGMT_SAE_EXT_KEY) && ssid &&
 		   (ieee802_11_rsnx_capab(rsnxe,
 					   WLAN_RSNX_CAPAB_SAE_H2E)) &&
 		   (wpas_pasn_sae_setup_pt(ssid, group) == 0)) {
 		key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
 		wpa_printf(MSG_DEBUG, "PASN: using KEY_MGMT SAE (ext key)");
-	} else if ((sel & WPA_KEY_MGMT_SAE) &&
+	} else if ((sel & WPA_KEY_MGMT_SAE) && ssid &&
 		   (ieee802_11_rsnx_capab(rsnxe,
 					   WLAN_RSNX_CAPAB_SAE_H2E)) &&
 		   (wpas_pasn_sae_setup_pt(ssid, group) == 0)) {
@@ -583,6 +583,10 @@
 		capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
 	if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA)
 		capab |= BIT(WLAN_RSNX_CAPAB_URNM_MFPR);
+	if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SPP_AMSDU) &&
+	    ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_SPP_A_MSDU))
+		capab |= BIT(WLAN_RSNX_CAPAB_SPP_A_MSDU);
+
 	pasn_set_rsnxe_caps(pasn, capab);
 	pasn_register_callbacks(pasn, wpa_s, wpas_pasn_send_mlme, NULL);
 	ssid = wpa_config_get_network(wpa_s->conf, awork->network_id);
diff --git a/wpa_supplicant/robust_av.c b/wpa_supplicant/robust_av.c
index 658103d..9156dae 100644
--- a/wpa_supplicant/robust_av.c
+++ b/wpa_supplicant/robust_av.c
@@ -541,7 +541,7 @@
 	if (wpa_s->connection_eht && eht_ie &&
 	    eht_ie[1] >= 1 + IEEE80211_EHT_CAPAB_MIN_LEN) {
 		eht = (const struct ieee80211_eht_capabilities *) &eht_ie[3];
-		if (eht->mac_cap & EHT_MACCAP_SCS_TRAFFIC_DESC)
+		if (le_to_host16(eht->mac_cap) & EHT_MACCAP_SCS_TRAFFIC_DESC)
 			allow_scs_traffic_desc = true;
 	}
 
diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
index 0a0a50f..c6b4242 100644
--- a/wpa_supplicant/sme.c
+++ b/wpa_supplicant/sme.c
@@ -551,6 +551,28 @@
 }
 
 
+static void sme_add_assoc_req_ie(struct wpa_supplicant *wpa_s,
+				 const struct wpabuf *buf)
+{
+	size_t len;
+	u8 *pos, *end;
+
+	if (!buf)
+		return;
+
+	pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
+	end = wpa_s->sme.assoc_req_ie + sizeof(wpa_s->sme.assoc_req_ie);
+	if (pos >= end)
+		return;
+
+	len = wpabuf_len(buf);
+	if (len < (size_t) (end - pos)) {
+		os_memcpy(pos, wpabuf_head(buf), len);
+		wpa_s->sme.assoc_req_ie_len += len;
+	}
+}
+
+
 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
 				    struct wpa_bss *bss, struct wpa_ssid *ssid,
 				    int start)
@@ -719,21 +741,6 @@
 			wpas_connect_work_done(wpa_s);
 			return;
 		}
-#ifdef CONFIG_HS20
-	} else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
-		   (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
-		/* No PMKSA caching, but otherwise similar to RSN/WPA */
-		wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
-		if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
-					      wpa_s->sme.assoc_req_ie,
-					      &wpa_s->sme.assoc_req_ie_len,
-					      false)) {
-			wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
-				"key management and encryption suites");
-			wpas_connect_work_done(wpa_s);
-			return;
-		}
-#endif /* CONFIG_HS20 */
 	} else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
 		   wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
 		/*
@@ -758,14 +765,10 @@
 #ifdef CONFIG_WPS
 	} else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
 		struct wpabuf *wps_ie;
+
+		wpa_s->sme.assoc_req_ie_len = 0;
 		wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
-		if (wps_ie && wpabuf_len(wps_ie) <=
-		    sizeof(wpa_s->sme.assoc_req_ie)) {
-			wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
-			os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
-				  wpa_s->sme.assoc_req_ie_len);
-		} else
-			wpa_s->sme.assoc_req_ie_len = 0;
+		sme_add_assoc_req_ie(wpa_s, wps_ie);
 		wpabuf_free(wps_ie);
 		wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
 #endif /* CONFIG_WPS */
@@ -854,6 +857,8 @@
 		}
 	}
 
+	wpa_s->sme.spp_amsdu = wpa_sm_uses_spp_amsdu(wpa_s->wpa);
+
 #ifdef CONFIG_P2P
 	if (wpa_s->global->p2p) {
 		u8 *pos;
@@ -870,18 +875,7 @@
 #endif /* CONFIG_P2P */
 
 #ifdef CONFIG_FST
-	if (wpa_s->fst_ies) {
-		int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
-
-		if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
-		    sizeof(wpa_s->sme.assoc_req_ie)) {
-			os_memcpy(wpa_s->sme.assoc_req_ie +
-				  wpa_s->sme.assoc_req_ie_len,
-				  wpabuf_head(wpa_s->fst_ies),
-				  fst_ies_len);
-			wpa_s->sme.assoc_req_ie_len += fst_ies_len;
-		}
-	}
+	sme_add_assoc_req_ie(wpa_s, wpa_s->fst_ies);
 #endif /* CONFIG_FST */
 
 	sme_auth_handle_rrm(wpa_s, bss);
@@ -924,15 +918,9 @@
 	}
 
 #ifdef CONFIG_TESTING_OPTIONS
-	if (wpa_s->rsnxe_override_assoc &&
-	    wpabuf_len(wpa_s->rsnxe_override_assoc) <=
-	    sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
+	if (wpa_s->rsnxe_override_assoc) {
 		wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
-		os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
-			  wpabuf_head(wpa_s->rsnxe_override_assoc),
-			  wpabuf_len(wpa_s->rsnxe_override_assoc));
-		wpa_s->sme.assoc_req_ie_len +=
-			wpabuf_len(wpa_s->rsnxe_override_assoc);
+		sme_add_assoc_req_ie(wpa_s, wpa_s->rsnxe_override_assoc);
 	} else
 #endif /* CONFIG_TESTING_OPTIONS */
 	if (wpa_s->rsnxe_len > 0 &&
@@ -944,6 +932,22 @@
 		wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
 	}
 
+	if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION &&
+	    wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_KNOWN_STA_IDENTIFICATION)) {
+		struct wpabuf *e;
+
+		e = wpa_sm_known_sta_identification(
+			wpa_s->wpa,
+			params.mld ? params.ap_mld_addr : bss->bssid,
+			bss->tsf);
+		if (e) {
+			wpa_printf(MSG_DEBUG,
+				   "SME: Add Known STA Identification element");
+			sme_add_assoc_req_ie(wpa_s, e);
+			wpabuf_free(e);
+		}
+	}
+
 #ifdef CONFIG_HS20
 	if (is_hs20_network(wpa_s, ssid, bss)
 #ifndef ANDROID /* Android does not use the native HS 2.0 config */
@@ -955,19 +959,11 @@
 		hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
 		if (hs20) {
 			int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
-			size_t len;
 
 			wpas_hs20_add_indication(hs20, pps_mo_id,
 						 get_hs20_version(bss));
 			wpas_hs20_add_roam_cons_sel(hs20, ssid);
-			len = sizeof(wpa_s->sme.assoc_req_ie) -
-				wpa_s->sme.assoc_req_ie_len;
-			if (wpabuf_len(hs20) <= len) {
-				os_memcpy(wpa_s->sme.assoc_req_ie +
-					  wpa_s->sme.assoc_req_ie_len,
-					  wpabuf_head(hs20), wpabuf_len(hs20));
-				wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
-			}
+			sme_add_assoc_req_ie(wpa_s, hs20);
 			wpabuf_free(hs20);
 		}
 	}
@@ -993,19 +989,7 @@
 		os_free(wpa_ie);
 	}
 
-	if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
-		struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
-		size_t len;
-
-		len = sizeof(wpa_s->sme.assoc_req_ie) -
-			wpa_s->sme.assoc_req_ie_len;
-		if (wpabuf_len(buf) <= len) {
-			os_memcpy(wpa_s->sme.assoc_req_ie +
-				  wpa_s->sme.assoc_req_ie_len,
-				  wpabuf_head(buf), wpabuf_len(buf));
-			wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
-		}
-	}
+	sme_add_assoc_req_ie(wpa_s, wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]);
 
 #ifdef CONFIG_MBO
 	mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
@@ -2664,6 +2648,7 @@
 #endif /* CONFIG_IEEE80211R */
 	params.mode = mode;
 	params.mgmt_frame_protection = wpa_s->sme.mfp;
+	params.spp_amsdu = wpa_s->sme.spp_amsdu;
 	params.rrm_used = wpa_s->rrm.rrm_used;
 	if (wpa_s->sme.prev_bssid_set)
 		params.prev_bssid = wpa_s->sme.prev_bssid;
@@ -2689,10 +2674,6 @@
 		params.wpa_proto = WPA_PROTO_WPA;
 		wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
 					elems.wpa_ie_len + 2);
-	} else if (elems.osen) {
-		params.wpa_proto = WPA_PROTO_OSEN;
-		wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
-					elems.osen_len + 2);
 	} else
 		wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 	if (elems.rsnxe)
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 31d1007..0ae27a7 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -847,7 +847,7 @@
 		struct wpa_bss *bss = wpa_s->last_scan_res[i];
 		int res;
 
-		if (wpa_scan_res_match(wpa_s, i, bss, ssid, 1, 0)) {
+		if (wpa_scan_res_match(wpa_s, i, bss, ssid, 1, 0, false)) {
 			res = wnm_nei_rep_add_bss(wpa_s, bss, buf, pref--);
 			if (res == -2)
 				continue; /* could not build entry for BSS */
@@ -1101,7 +1101,7 @@
 	/* Apply normal roaming rules if we can stay with the current BSS */
 	if (current_bss && bss != current_bss &&
 	    wpa_scan_res_match(wpa_s, 0, current_bss, wpa_s->current_ssid,
-			       1, 0) &&
+			       1, 0, false) &&
 	    !wpa_supplicant_need_to_roam_within_ess(wpa_s, current_bss, bss,
 						    true))
 		bss = current_bss;
@@ -1700,45 +1700,6 @@
 			   WPA_GET_BE24(pos), pos[3]);
 
 #ifdef CONFIG_HS20
-		if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 5 &&
-		    WPA_GET_BE24(pos) == OUI_WFA &&
-		    pos[3] == HS20_WNM_SUB_REM_NEEDED) {
-			/* Subscription Remediation subelement */
-			const u8 *ie_end;
-			u8 url_len;
-			char *url;
-			u8 osu_method;
-
-			wpa_printf(MSG_DEBUG, "WNM: Subscription Remediation "
-				   "subelement");
-			ie_end = pos + ie_len;
-			pos += 4;
-			url_len = *pos++;
-			if (url_len == 0) {
-				wpa_printf(MSG_DEBUG, "WNM: No Server URL included");
-				url = NULL;
-				osu_method = 1;
-			} else {
-				if (url_len + 1 > ie_end - pos) {
-					wpa_printf(MSG_DEBUG, "WNM: Not enough room for Server URL (len=%u) and Server Method (left %d)",
-						   url_len,
-						   (int) (ie_end - pos));
-					break;
-				}
-				url = os_malloc(url_len + 1);
-				if (url == NULL)
-					break;
-				os_memcpy(url, pos, url_len);
-				url[url_len] = '\0';
-				osu_method = pos[url_len];
-			}
-			hs20_rx_subscription_remediation(wpa_s, url,
-							 osu_method);
-			os_free(url);
-			pos = next;
-			continue;
-		}
-
 		if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 8 &&
 		    WPA_GET_BE24(pos) == OUI_WFA &&
 		    pos[3] == HS20_WNM_DEAUTH_IMMINENT_NOTICE) {
diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c
index 2f57be8..2ab2917 100644
--- a/wpa_supplicant/wpa_cli.c
+++ b/wpa_supplicant/wpa_cli.c
@@ -507,7 +507,7 @@
 		"ap_vendor_elements", "ignore_old_scan_res", "freq_list",
 		"scan_cur_freq", "scan_res_valid_for_connect",
 		"sched_scan_interval",
-		"tdls_external_control", "osu_dir", "wowlan_triggers",
+		"tdls_external_control", "wowlan_triggers",
 		"p2p_search_delay", "mac_addr", "rand_addr_lifetime",
 		"preassoc_mac_addr", "key_mgmt_offload", "passive_scan",
 		"reassoc_same_bss_optim", "wps_priority",
@@ -614,7 +614,7 @@
 		"scan_cur_freq", "scan_res_valid_for_connect",
 		"sched_scan_interval",
 		"sched_scan_start_delay",
-		"tdls_external_control", "osu_dir", "wowlan_triggers",
+		"tdls_external_control", "wowlan_triggers",
 		"p2p_search_delay", "mac_addr", "rand_addr_lifetime",
 		"preassoc_mac_addr", "key_mgmt_offload", "passive_scan",
 		"reassoc_same_bss_optim", "extended_key_id"
@@ -2778,37 +2778,6 @@
 	return wpa_ctrl_command(ctrl, cmd);
 }
 
-
-static int wpa_cli_cmd_hs20_icon_request(struct wpa_ctrl *ctrl, int argc,
-					 char *argv[])
-{
-	char cmd[512];
-
-	if (argc < 2) {
-		printf("Command needs two arguments (dst mac addr and "
-		       "icon name)\n");
-		return -1;
-	}
-
-	if (write_cmd(cmd, sizeof(cmd), "HS20_ICON_REQUEST", argc, argv) < 0)
-		return -1;
-
-	return wpa_ctrl_command(ctrl, cmd);
-}
-
-
-static int wpa_cli_cmd_fetch_osu(struct wpa_ctrl *ctrl, int argc, char *argv[])
-{
-	return wpa_ctrl_command(ctrl, "FETCH_OSU");
-}
-
-
-static int wpa_cli_cmd_cancel_fetch_osu(struct wpa_ctrl *ctrl, int argc,
-					char *argv[])
-{
-	return wpa_ctrl_command(ctrl, "CANCEL_FETCH_OSU");
-}
-
 #endif /* CONFIG_HS20 */
 
 
@@ -3922,14 +3891,6 @@
 	{ "nai_home_realm_list", wpa_cli_cmd_get_nai_home_realm_list,
 	  wpa_cli_complete_bss, cli_cmd_flag_none,
 	  "<addr> <home realm> = get HS20 nai home realm list" },
-	{ "hs20_icon_request", wpa_cli_cmd_hs20_icon_request,
-	  wpa_cli_complete_bss, cli_cmd_flag_none,
-	  "<addr> <icon name> = get Hotspot 2.0 OSU icon" },
-	{ "fetch_osu", wpa_cli_cmd_fetch_osu, NULL, cli_cmd_flag_none,
-	  "= fetch OSU provider information from all APs" },
-	{ "cancel_fetch_osu", wpa_cli_cmd_cancel_fetch_osu, NULL,
-	  cli_cmd_flag_none,
-	  "= cancel fetch_osu command" },
 #endif /* CONFIG_HS20 */
 	{ "sta_autoconnect", wpa_cli_cmd_sta_autoconnect, NULL,
 	  cli_cmd_flag_none,
@@ -4495,8 +4456,6 @@
 		wpa_cli_exec(action_file, ifname, pos);
 	} else if (str_starts(pos, ESS_DISASSOC_IMMINENT)) {
 		wpa_cli_exec(action_file, ifname, pos);
-	} else if (str_starts(pos, HS20_SUBSCRIPTION_REMEDIATION)) {
-		wpa_cli_exec(action_file, ifname, pos);
 	} else if (str_starts(pos, HS20_DEAUTH_IMMINENT_NOTICE)) {
 		wpa_cli_exec(action_file, ifname, pos);
 	} else if (str_starts(pos, HS20_T_C_ACCEPTANCE)) {
diff --git a/wpa_supplicant/wpa_gui-qt4/eventhistory.h b/wpa_supplicant/wpa_gui-qt4/eventhistory.h
index afd7b63..2122ab4 100644
--- a/wpa_supplicant/wpa_gui-qt4/eventhistory.h
+++ b/wpa_supplicant/wpa_gui-qt4/eventhistory.h
@@ -40,7 +40,7 @@
 
 public:
 	EventHistory(QWidget *parent = 0, const char *name = 0,
-		     bool modal = false, Qt::WindowFlags fl = 0);
+		     bool modal = false, Qt::WindowFlags fl = Qt::Widget);
 	~EventHistory();
 
 public slots:
diff --git a/wpa_supplicant/wpa_gui-qt4/main.cpp b/wpa_supplicant/wpa_gui-qt4/main.cpp
index bbd45c6..d395aa1 100644
--- a/wpa_supplicant/wpa_gui-qt4/main.cpp
+++ b/wpa_supplicant/wpa_gui-qt4/main.cpp
@@ -40,10 +40,10 @@
 	int ret;
 
 	locale = QLocale::system().name();
-	resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
-	if (!translator.load("wpa_gui_" + locale, resourceDir))
-		translator.load("wpa_gui_" + locale, "lang");
-	app.installTranslator(&translator);
+	resourceDir = QLibraryInfo::path(QLibraryInfo::TranslationsPath);
+	if (translator.load("wpa_gui_" + locale, resourceDir) ||
+	    translator.load("wpa_gui_" + locale, "lang"))
+		app.installTranslator(&translator);
 
 	WpaGui w(&app);
 
diff --git a/wpa_supplicant/wpa_gui-qt4/networkconfig.cpp b/wpa_supplicant/wpa_gui-qt4/networkconfig.cpp
index 2727318..59af845 100644
--- a/wpa_supplicant/wpa_gui-qt4/networkconfig.cpp
+++ b/wpa_supplicant/wpa_gui-qt4/networkconfig.cpp
@@ -37,7 +37,7 @@
 		SLOT(authChanged(int)));
 	connect(cancelButton, SIGNAL(clicked()), this, SLOT(close()));
 	connect(addButton, SIGNAL(clicked()), this, SLOT(addNetwork()));
-	connect(encrSelect, SIGNAL(activated(const QString &)), this,
+	connect(encrSelect, SIGNAL(textActivated(const QString &)), this,
 		SLOT(encrChanged(const QString &)));
 	connect(removeButton, SIGNAL(clicked()), this, SLOT(removeNetwork()));
 	connect(eapSelect, SIGNAL(activated(int)), this,
@@ -204,8 +204,8 @@
 	}
 
 	if (idstrEdit->isEnabled() && !idstrEdit->text().isEmpty()) {
-		QRegExp rx("^(\\w|-)+$");
-		if (rx.indexIn(idstrEdit->text()) < 0) {
+		QRegularExpression rx("^(\\w|-)+$");
+		if (!rx.match(idstrEdit->text()).hasMatch()) {
 			QMessageBox::warning(
 				this, tr("Network ID Error"),
 				tr("Network ID String contains non-word "
@@ -797,7 +797,7 @@
 		    tr("This will permanently remove the network\n"
 		       "from the configuration. Do you really want\n"
 		       "to remove this network?"),
-		    tr("Yes"), tr("No")) != 0)
+		    QMessageBox::Yes, QMessageBox::No) != 0)
 		return;
 
 	snprintf(cmd, sizeof(cmd), "REMOVE_NETWORK %d", edit_network_id);
diff --git a/wpa_supplicant/wpa_gui-qt4/networkconfig.h b/wpa_supplicant/wpa_gui-qt4/networkconfig.h
index fd09dec..a3a7d97 100644
--- a/wpa_supplicant/wpa_gui-qt4/networkconfig.h
+++ b/wpa_supplicant/wpa_gui-qt4/networkconfig.h
@@ -20,7 +20,7 @@
 
 public:
 	NetworkConfig(QWidget *parent = 0, const char *name = 0,
-		      bool modal = false, Qt::WindowFlags fl = 0);
+		      bool modal = false, Qt::WindowFlags fl = Qt::Widget);
 	~NetworkConfig();
 
 	virtual void paramsFromScanResults(QTreeWidgetItem *sel);
diff --git a/wpa_supplicant/wpa_gui-qt4/peers.cpp b/wpa_supplicant/wpa_gui-qt4/peers.cpp
index 0a0b3ff..268aba8 100644
--- a/wpa_supplicant/wpa_gui-qt4/peers.cpp
+++ b/wpa_supplicant/wpa_gui-qt4/peers.cpp
@@ -403,7 +403,7 @@
 
 void Peers::add_station(QString info)
 {
-	QStringList lines = info.split(QRegExp("\\n"));
+	QStringList lines = info.split(QRegularExpression("\\n"));
 	QString name;
 
 	for (QStringList::Iterator it = lines.begin();
@@ -518,7 +518,7 @@
 	 */
 
 	QStringList items =
-		params.split(QRegExp(" (?=[^']*('[^']*'[^']*)*$)"));
+		params.split(QRegularExpression(" (?=[^']*('[^']*'[^']*)*$)"));
 	QString addr = "";
 	QString name = "";
 	int config_methods = 0;
@@ -591,7 +591,7 @@
 	QString ssid, bssid, flags, wps_name, pri_dev_type;
 	int id = -1;
 
-	QStringList lines = bss.split(QRegExp("\\n"));
+	QStringList lines = bss.split(QRegularExpression("\\n"));
 	for (QStringList::Iterator it = lines.begin();
 	     it != lines.end(); it++) {
 		int pos = (*it).indexOf('=') + 1;
@@ -643,7 +643,7 @@
 			item->setData(ssid, peer_role_ssid);
 		model.appendRow(item);
 
-		lines = bss.split(QRegExp("\\n"));
+		lines = bss.split(QRegularExpression("\\n"));
 		for (QStringList::Iterator it = lines.begin();
 		     it != lines.end(); it++) {
 			if ((*it).startsWith("p2p_group_client:"))
@@ -903,7 +903,7 @@
 		 * group_capab=0x0
 		 */
 		QStringList items =
-			text.split(QRegExp(" (?=[^']*('[^']*'[^']*)*$)"));
+			text.split(QRegularExpression(" (?=[^']*('[^']*'[^']*)*$)"));
 		QString addr = items[1];
 		QString name = "";
 		QString pri_dev_type;
diff --git a/wpa_supplicant/wpa_gui-qt4/peers.h b/wpa_supplicant/wpa_gui-qt4/peers.h
index bb73737..c44bba9 100644
--- a/wpa_supplicant/wpa_gui-qt4/peers.h
+++ b/wpa_supplicant/wpa_gui-qt4/peers.h
@@ -22,7 +22,7 @@
 
 public:
 	Peers(QWidget *parent = 0, const char *name = 0,
-		    bool modal = false, Qt::WindowFlags fl = 0);
+		    bool modal = false, Qt::WindowFlags fl = Qt::Widget);
 	~Peers();
 	void setWpaGui(WpaGui *_wpagui);
 	void event_notify(WpaMsg msg);
diff --git a/wpa_supplicant/wpa_gui-qt4/scanresults.cpp b/wpa_supplicant/wpa_gui-qt4/scanresults.cpp
index a2e3072..ba04b4f 100644
--- a/wpa_supplicant/wpa_gui-qt4/scanresults.cpp
+++ b/wpa_supplicant/wpa_gui-qt4/scanresults.cpp
@@ -77,7 +77,7 @@
 
 		QString ssid, bssid, freq, signal, flags;
 
-		QStringList lines = bss.split(QRegExp("\\n"));
+		QStringList lines = bss.split(QRegularExpression("\\n"));
 		for (QStringList::Iterator it = lines.begin();
 		     it != lines.end(); it++) {
 			int pos = (*it).indexOf('=') + 1;
diff --git a/wpa_supplicant/wpa_gui-qt4/scanresults.h b/wpa_supplicant/wpa_gui-qt4/scanresults.h
index 2cddd13..39bba90 100644
--- a/wpa_supplicant/wpa_gui-qt4/scanresults.h
+++ b/wpa_supplicant/wpa_gui-qt4/scanresults.h
@@ -20,7 +20,7 @@
 
 public:
 	ScanResults(QWidget *parent = 0, const char *name = 0,
-		    bool modal = false, Qt::WindowFlags fl = 0);
+		    bool modal = false, Qt::WindowFlags fl = Qt::Widget);
 	~ScanResults();
 
 public slots:
diff --git a/wpa_supplicant/wpa_gui-qt4/userdatarequest.h b/wpa_supplicant/wpa_gui-qt4/userdatarequest.h
index b6d1ad2..3f7dccb 100644
--- a/wpa_supplicant/wpa_gui-qt4/userdatarequest.h
+++ b/wpa_supplicant/wpa_gui-qt4/userdatarequest.h
@@ -20,7 +20,7 @@
 
 public:
 	UserDataRequest(QWidget *parent = 0, const char *name = 0,
-			bool modal = false, Qt::WindowFlags fl = 0);
+			bool modal = false, Qt::WindowFlags fl = Qt::Widget);
 	~UserDataRequest();
 
 	int setParams(WpaGui *_wpagui, const char *reqMsg);
diff --git a/wpa_supplicant/wpa_gui-qt4/wpagui.cpp b/wpa_supplicant/wpa_gui-qt4/wpagui.cpp
index 9404ab4..0c125d9 100644
--- a/wpa_supplicant/wpa_gui-qt4/wpagui.cpp
+++ b/wpa_supplicant/wpa_gui-qt4/wpagui.cpp
@@ -99,9 +99,9 @@
 	connect(disconnectButton, SIGNAL(clicked()), this, SLOT(disconnect()));
 	connect(scanButton, SIGNAL(clicked()), this, SLOT(scan()));
 	connect(connectButton, SIGNAL(clicked()), this, SLOT(connectB()));
-	connect(adapterSelect, SIGNAL(activated(const QString&)), this,
+	connect(adapterSelect, SIGNAL(textActivated(const QString&)), this,
 		SLOT(selectAdapter(const QString&)));
-	connect(networkSelect, SIGNAL(activated(const QString&)), this,
+	connect(networkSelect, SIGNAL(textActivated(const QString&)), this,
 		SLOT(selectNetwork(const QString&)));
 	connect(addNetworkButton, SIGNAL(clicked()), this, SLOT(addNetwork()));
 	connect(editNetworkButton, SIGNAL(clicked()), this,
@@ -1078,7 +1078,7 @@
 	char reply[10];
 	size_t reply_len = sizeof(reply);
 
-	if (cmd.contains(QRegExp("^\\d+:")))
+	if (cmd.contains(QRegularExpression("^\\d+:")))
 		cmd.truncate(cmd.indexOf(':'));
 	else
 		cmd = "any";
@@ -1095,7 +1095,7 @@
 	char reply[10];
 	size_t reply_len = sizeof(reply);
 
-	if (cmd.contains(QRegExp("^\\d+:")))
+	if (cmd.contains(QRegularExpression("^\\d+:")))
 		cmd.truncate(cmd.indexOf(':'));
 	else if (!cmd.startsWith("all")) {
 		debug("Invalid editNetwork '%s'",
@@ -1114,7 +1114,7 @@
 	char reply[10];
 	size_t reply_len = sizeof(reply);
 
-	if (cmd.contains(QRegExp("^\\d+:")))
+	if (cmd.contains(QRegularExpression("^\\d+:")))
 		cmd.truncate(cmd.indexOf(':'));
 	else if (!cmd.startsWith("all")) {
 		debug("Invalid editNetwork '%s'",
@@ -1132,7 +1132,7 @@
 	QString cmd(sel);
 	int id = -1;
 
-	if (cmd.contains(QRegExp("^\\d+:"))) {
+	if (cmd.contains(QRegularExpression("^\\d+:"))) {
 		cmd.truncate(cmd.indexOf(':'));
 		id = cmd.toInt();
 	}
@@ -1204,7 +1204,7 @@
 	char reply[10];
 	size_t reply_len = sizeof(reply);
 
-	if (cmd.contains(QRegExp("^\\d+:")))
+	if (cmd.contains(QRegularExpression("^\\d+:")))
 		cmd.truncate(cmd.indexOf(':'));
 	else if (!cmd.startsWith("all")) {
 		debug("Invalid editNetwork '%s'",
@@ -1476,7 +1476,7 @@
 
 	QString msg, status(buf);
 
-	QStringList lines = status.split(QRegExp("\\n"));
+	QStringList lines = status.split(QRegularExpression("\\n"));
 	for (QStringList::Iterator it = lines.begin();
 	     it != lines.end(); it++) {
 		int pos = (*it).indexOf('=') + 1;
diff --git a/wpa_supplicant/wpa_gui-qt4/wpagui.h b/wpa_supplicant/wpa_gui-qt4/wpagui.h
index f0a34c9..898722b 100644
--- a/wpa_supplicant/wpa_gui-qt4/wpagui.h
+++ b/wpa_supplicant/wpa_gui-qt4/wpagui.h
@@ -49,7 +49,7 @@
 	};
 
 	WpaGui(QApplication *app, QWidget *parent = 0, const char *name = 0,
-	       Qt::WindowFlags fl = 0);
+	       Qt::WindowFlags fl = Qt::Widget);
 	~WpaGui();
 
 	virtual int ctrlRequest(const char *cmd, char *buf, size_t *buflen);
diff --git a/wpa_supplicant/wpa_gui-qt4/wpamsg.h b/wpa_supplicant/wpa_gui-qt4/wpamsg.h
index 8f2fcdc..fe36e20 100644
--- a/wpa_supplicant/wpa_gui-qt4/wpamsg.h
+++ b/wpa_supplicant/wpa_gui-qt4/wpamsg.h
@@ -10,7 +10,7 @@
 #define WPAMSG_H
 
 #include <QDateTime>
-#include <QLinkedList>
+#include <QList>
 
 class WpaMsg {
 public:
@@ -30,6 +30,6 @@
 	QDateTime timestamp;
 };
 
-typedef QLinkedList<WpaMsg> WpaMsgList;
+typedef QList<WpaMsg> WpaMsgList;
 
 #endif /* WPAMSG_H */
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 9843679..b8c6f55 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -799,7 +799,6 @@
 #ifdef CONFIG_HS20
 	if (wpa_s->drv_priv)
 		wpa_drv_configure_frame_filters(wpa_s, 0);
-	hs20_deinit(wpa_s);
 #endif /* CONFIG_HS20 */
 
 	for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
@@ -1060,6 +1059,13 @@
 	if (wpa_supplicant_update_scan_results(wpa_s, wpa_s->bssid) < 0)
 		return;
 
+	/* wpa->current_bss might have changed due to memory reallocation, so
+	 * need to update ssid/ssid_len */
+	if (!wpa_s->current_bss)
+		return;
+	ssid = wpa_s->current_bss->ssid;
+	ssid_len = wpa_s->current_bss->ssid_len;
+
 	bss = wpa_bss_get_bssid_latest(wpa_s, wpa_s->bssid);
 	if (!bss)
 		return;
@@ -1816,16 +1822,15 @@
 #ifdef CONFIG_SAE
 	enum sae_pwe sae_pwe;
 #endif /* CONFIG_SAE */
-	const u8 *bss_wpa, *bss_rsn, *bss_rsnx, *bss_osen;
+	const u8 *bss_wpa, *bss_rsn, *bss_rsnx;
 	bool wmm;
 
 	if (bss) {
 		bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 		bss_rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
 		bss_rsnx = wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
-		bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
 	} else {
-		bss_wpa = bss_rsn = bss_rsnx = bss_osen = NULL;
+		bss_wpa = bss_rsn = bss_rsnx = NULL;
 	}
 
 	if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
@@ -1841,34 +1846,17 @@
 		   (ie.key_mgmt & ssid->key_mgmt)) {
 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
 		proto = WPA_PROTO_WPA;
-#ifdef CONFIG_HS20
-	} else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN) &&
-		   wpa_parse_wpa_ie(bss_osen, 2 + bss_osen[1], &ie) == 0 &&
-		   (ie.group_cipher & ssid->group_cipher) &&
-		   (ie.pairwise_cipher & ssid->pairwise_cipher) &&
-		   (ie.key_mgmt & ssid->key_mgmt)) {
-		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
-		proto = WPA_PROTO_OSEN;
-	} else if (bss_rsn && (ssid->proto & WPA_PROTO_OSEN) &&
-	    wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
-	    (ie.group_cipher & ssid->group_cipher) &&
-	    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
-	    (ie.key_mgmt & ssid->key_mgmt)) {
-		wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using OSEN (within RSN)");
-		proto = WPA_PROTO_RSN;
-#endif /* CONFIG_HS20 */
 	} else if (bss) {
 		wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
 		wpa_dbg(wpa_s, MSG_DEBUG,
 			"WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
 			ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
 			ssid->key_mgmt);
-		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
+		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s",
 			MAC2STR(bss->bssid),
 			wpa_ssid_txt(bss->ssid, bss->ssid_len),
 			bss_wpa ? " WPA" : "",
-			bss_rsn ? " RSN" : "",
-			bss_osen ? " OSEN" : "");
+			bss_rsn ? " RSN" : "");
 		if (bss_rsn) {
 			wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
 			if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
@@ -1895,9 +1883,7 @@
 		}
 		return -1;
 	} else {
-		if (ssid->proto & WPA_PROTO_OSEN)
-			proto = WPA_PROTO_OSEN;
-		else if (ssid->proto & WPA_PROTO_RSN)
+		if (ssid->proto & WPA_PROTO_RSN)
 			proto = WPA_PROTO_RSN;
 		else
 			proto = WPA_PROTO_WPA;
@@ -1927,7 +1913,7 @@
 #ifdef CONFIG_OWE
 			if ((ssid->key_mgmt & WPA_KEY_MGMT_OWE) &&
 			    !ssid->owe_only &&
-			    !bss_wpa && !bss_rsn && !bss_osen) {
+			    !bss_wpa && !bss_rsn) {
 				wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
 				wpa_s->wpa_proto = 0;
 				*wpa_ie_len = 0;
@@ -1951,7 +1937,7 @@
 	wpa_s->wpa_proto = proto;
 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
 	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
-			 !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
+			 !!(ssid->proto & WPA_PROTO_RSN));
 
 	if (bss || !wpa_s->ap_ies_from_associnfo) {
 		const u8 *rsnoe = NULL, *rsno2e = NULL, *rsnxoe = NULL;
@@ -2139,11 +2125,6 @@
 	} else if (sel & WPA_KEY_MGMT_WPA_NONE) {
 		wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
 		wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
-#ifdef CONFIG_HS20
-	} else if (sel & WPA_KEY_MGMT_OSEN) {
-		wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
-		wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
-#endif /* CONFIG_HS20 */
 #ifdef CONFIG_OWE
 	} else if (sel & WPA_KEY_MGMT_OWE) {
 		wpa_s->key_mgmt = WPA_KEY_MGMT_OWE;
@@ -2277,6 +2258,16 @@
 		wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_SSID_PROTECTION, false);
 	}
 
+	wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_SPP_AMSDU,
+			 (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SPP_AMSDU) &&
+			 ieee802_11_rsnx_capab(bss_rsnx,
+					       WLAN_RSNX_CAPAB_SPP_A_MSDU) &&
+			 wpa_s->pairwise_cipher & (WPA_CIPHER_CCMP_256 |
+						   WPA_CIPHER_GCMP_256 |
+						   WPA_CIPHER_CCMP |
+						   WPA_CIPHER_GCMP) &&
+			 (wpa_s->wpa_proto & WPA_PROTO_RSN));
+
 	if (!skip_default_rsne) {
 		if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie,
 						    wpa_ie_len)) {
@@ -2592,7 +2583,8 @@
 		if (style == WPAS_MAC_ADDR_STYLE_DEDICATED_PER_ESS) {
 			/* Pregenerated addresses do not expire but their value
 			 * might have changed, so let's check that. */
-			if (ether_addr_equal(wpa_s->own_addr, ssid->mac_value))
+			if (ssid &&
+			    ether_addr_equal(wpa_s->own_addr, ssid->mac_value))
 				return 0;
 		} else if ((wpa_s->last_mac_addr_change.sec != 0 ||
 			    wpa_s->last_mac_addr_change.usec != 0) &&
@@ -3727,19 +3719,6 @@
 			os_free(wpa_ie);
 			return NULL;
 		}
-#ifdef CONFIG_HS20
-	} else if (bss && wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
-		   (ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
-		/* No PMKSA caching, but otherwise similar to RSN/WPA */
-		wpa_ie_len = max_wpa_ie_len;
-		if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
-					      wpa_ie, &wpa_ie_len, false)) {
-			wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
-				"key management and encryption suites");
-			os_free(wpa_ie);
-			return NULL;
-		}
-#endif /* CONFIG_HS20 */
 	} else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
 		   wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
 		/*
@@ -6390,6 +6369,12 @@
 #endif /* CONFIG_NO_ROBUST_AV */
 	wpa_s->ml_probe_mld_id = -1;
 
+#ifdef CONFIG_PMKSA_CACHE_EXTERNAL
+#ifdef CONFIG_MESH
+	dl_list_init(&wpa_s->mesh_external_pmksa_cache);
+#endif /* CONFIG_MESH */
+#endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
+
 	return wpa_s;
 }
 
@@ -6605,7 +6590,7 @@
 
 	htcaps_mask->ht_capabilities_info |= msk;
 	htcaps->ht_capabilities_info &= ~msk;
-	htcaps->ht_capabilities_info |= (tx_stbc << 7) & msk;
+	htcaps->ht_capabilities_info |= host_to_le16(tx_stbc << 7) & msk;
 
 	return 0;
 }
@@ -6631,7 +6616,7 @@
 
 	htcaps_mask->ht_capabilities_info |= msk;
 	htcaps->ht_capabilities_info &= ~msk;
-	htcaps->ht_capabilities_info |= (rx_stbc << 8) & msk;
+	htcaps->ht_capabilities_info |= host_to_le16(rx_stbc << 8) & msk;
 
 	return 0;
 }
@@ -6698,13 +6683,15 @@
 
 #ifdef CONFIG_HT_OVERRIDES
 	if (ssid->disable_sgi) {
-		vhtcaps_mask->vht_capabilities_info |= (VHT_CAP_SHORT_GI_80 |
-							VHT_CAP_SHORT_GI_160);
-		vhtcaps->vht_capabilities_info &= ~(VHT_CAP_SHORT_GI_80 |
-						    VHT_CAP_SHORT_GI_160);
+		vhtcaps_mask->vht_capabilities_info |=
+			host_to_le32(VHT_CAP_SHORT_GI_80 |
+				     VHT_CAP_SHORT_GI_160);
+		vhtcaps->vht_capabilities_info &=
+			host_to_le32(~(VHT_CAP_SHORT_GI_80 |
+				       VHT_CAP_SHORT_GI_160));
 		wpa_msg(wpa_s, MSG_DEBUG,
 			"disable-sgi override specified, vht-caps: 0x%x",
-			vhtcaps->vht_capabilities_info);
+			le_to_host32(vhtcaps->vht_capabilities_info));
 	}
 
 	/* if max ampdu is <= 3, we have to make the HT cap the same */
@@ -7901,12 +7888,6 @@
 	if (wpa_bss_init(wpa_s) < 0)
 		return -1;
 
-#ifdef CONFIG_PMKSA_CACHE_EXTERNAL
-#ifdef CONFIG_MESH
-	dl_list_init(&wpa_s->mesh_external_pmksa_cache);
-#endif /* CONFIG_MESH */
-#endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
-
 	/*
 	 * Set Wake-on-WLAN triggers, if configured.
 	 * Note: We don't restore/remove the triggers on shutdown (it doesn't
@@ -7942,9 +7923,6 @@
 
 	wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
 
-#ifdef CONFIG_HS20
-	hs20_init(wpa_s);
-#endif /* CONFIG_HS20 */
 #ifdef CONFIG_MBO
 	if (!wpa_s->disable_mbo_oce && wpa_s->conf->oce) {
 		if ((wpa_s->conf->oce & OCE_STA) &&
@@ -9179,7 +9157,7 @@
 	if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
 	    (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
 	    !(wpa_key_mgmt_sae(ssid->key_mgmt) &&
-	      (ssid->sae_password || ssid->pmk_valid)) &&
+	      (ssid->passphrase || ssid->sae_password || ssid->pmk_valid)) &&
 	    !ssid->mem_only_psk)
 		return 1;
 
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index ae181ee..cf10118 100644
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -1256,6 +1256,10 @@
 # mka_priority (Priority of MKA Actor) is in 0..255 range with 255 being
 # default priority
 #
+# macsec_icv_indicator: Always include ICV indicator
+# 0 = ICV Indicator is not included when ICV has default length (default)
+# 1 = ICV Indicator is always included (compatibility mode)
+#
 # mixed_cell: This option can be used to configure whether so called mixed
 # cells, i.e., networks that use both plaintext and encryption in the same
 # SSID, are allowed when selecting a BSS from scan results.
diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h
index d27ff1a..8965bfa 100644
--- a/wpa_supplicant/wpa_supplicant_i.h
+++ b/wpa_supplicant/wpa_supplicant_i.h
@@ -470,15 +470,6 @@
 	WPAS_TEST_FAILURE_SCAN_TRIGGER,
 };
 
-struct icon_entry {
-	struct dl_list list;
-	u8 bssid[ETH_ALEN];
-	u8 dialog_token;
-	char *file_name;
-	u8 *image;
-	size_t image_len;
-};
-
 struct wpa_bss_tmp_disallowed {
 	struct dl_list list;
 	u8 bssid[ETH_ALEN];
@@ -1057,6 +1048,7 @@
 		u8 sched_obss_scan;
 		u16 obss_scan_int;
 		u16 bss_max_idle_period;
+		bool spp_amsdu;
 #ifdef CONFIG_SAE
 		struct sae_data sae;
 		struct wpabuf *sae_token;
@@ -1273,17 +1265,7 @@
 	unsigned int auto_network_select:1;
 	unsigned int interworking_fast_assoc_tried:1;
 	unsigned int fetch_all_anqp:1;
-	unsigned int fetch_osu_info:1;
-	unsigned int fetch_osu_waiting_scan:1;
-	unsigned int fetch_osu_icon_in_progress:1;
 	struct wpa_bss *interworking_gas_bss;
-	unsigned int osu_icon_id;
-	struct dl_list icon_head; /* struct icon_entry */
-	struct osu_provider *osu_prov;
-	size_t osu_prov_count;
-	struct os_reltime osu_icon_fetch_start;
-	unsigned int num_osu_scans;
-	unsigned int num_prov_found;
 #endif /* CONFIG_INTERWORKING */
 	unsigned int drv_capa_known;
 
@@ -2024,7 +2006,8 @@
 struct wpa_ssid * wpa_scan_res_match(struct wpa_supplicant *wpa_s,
 				     int i, struct wpa_bss *bss,
 				     struct wpa_ssid *group,
-				     int only_first_ssid, int debug_print);
+				     int only_first_ssid, int debug_print,
+				     bool link);
 
 struct wpa_bss * wpa_supplicant_select_bss(struct wpa_supplicant *wpa_s,
 					   struct wpa_ssid *group,
diff --git a/wpa_supplicant/wpas_kay.c b/wpa_supplicant/wpas_kay.c
index 600b3bc..7893a39 100644
--- a/wpa_supplicant/wpas_kay.c
+++ b/wpa_supplicant/wpas_kay.c
@@ -249,6 +249,7 @@
 				  ssid->macsec_replay_window,
 				  ssid->macsec_offload, ssid->macsec_port,
 				  ssid->mka_priority, ssid->macsec_csindex,
+				  ssid->macsec_icv_indicator,
 				  wpa_s->ifname, wpa_s->own_addr);
 	/* ieee802_1x_kay_init() frees kay_ctx on failure */
 	if (res == NULL)