diff --git a/Android.bp b/Android.bp
index 35cdb4f..068630b 100644
--- a/Android.bp
+++ b/Android.bp
@@ -34,3 +34,33 @@
         "src/drivers",
     ],
 }
+
+// Generated by building hs20-osu-client and printing LOCAL_SRC_FILES
+filegroup {
+    name: "hs20-osu-client_srcs",
+    srcs: [
+        "hs20/client/spp_client.c",
+        "hs20/client/oma_dm_client.c",
+        "hs20/client/osu_client.c",
+        "hs20/client/est.c",
+        "src/common/wpa_ctrl.c",
+        "src/common/wpa_helpers.c",
+        "src/crypto/crypto_internal.c",
+        "src/crypto/md5-internal.c",
+        "src/crypto/sha1-internal.c",
+        "src/crypto/sha256-internal.c",
+        "src/crypto/tls_openssl_ocsp.c",
+        "src/utils/base64.c",
+        "src/utils/browser-android.c",
+        "src/utils/common.c",
+        "src/utils/eloop.c",
+        "src/utils/http_curl.c",
+        "src/utils/os_unix.c",
+        "src/utils/wpa_debug.c",
+        "src/utils/wpabuf.c",
+        "src/utils/xml_libxml2.c",
+        "src/utils/xml-utils.c",
+        "src/wps/httpread.c",
+        "src/wps/http_server.c",
+    ],
+}
diff --git a/hostapd/Android.bp b/hostapd/Android.bp
index 119f66e..8a7dacf 100644
--- a/hostapd/Android.bp
+++ b/hostapd/Android.bp
@@ -39,7 +39,6 @@
     soc_specific: true,
 }
 
-
 cc_defaults {
     name: "hostapd_defaults",
     defaults: ["hostapd_cflags_defaults"],
@@ -199,7 +198,6 @@
     ],
 }
 
-
 // Generated by building hostapd and printing LOCAL_SRC_FILES.
 filegroup {
     name: "hostapd_srcs",
@@ -354,3 +352,18 @@
     name: "android.hardware.wifi.hostapd.xml",
     srcs: ["android.hardware.wifi.hostapd.xml"],
 }
+
+// Generated by building hostapd_cli and printing LOCAL_SRC_FILES
+filegroup {
+    name: "hostapd_cli_srcs",
+    srcs: [
+        "hostapd_cli.c",
+        "src/common/cli.c",
+        "src/common/wpa_ctrl.c",
+        "src/utils/common.c",
+        "src/utils/edit.c",
+        "src/utils/eloop.c",
+        "src/utils/os_unix.c",
+        "src/utils/wpa_debug.c",
+    ],
+}
diff --git a/hostapd/aidl/hostapd.cpp b/hostapd/aidl/hostapd.cpp
index ed77a82..afb4147 100644
--- a/hostapd/aidl/hostapd.cpp
+++ b/hostapd/aidl/hostapd.cpp
@@ -61,6 +61,24 @@
 int band6Ghz = (int)BandMask::BAND_6_GHZ;
 int band60Ghz = (int)BandMask::BAND_60_GHZ;
 
+int32_t aidl_client_version = 0;
+int32_t aidl_service_version = 0;
+
+/**
+ * Check that the AIDL service is running at least the expected version.
+ * Use to avoid the case where the AIDL interface version
+ * is greater than the version implemented by the service.
+ */
+inline int32_t isAidlServiceVersionAtLeast(int32_t expected_version)
+{
+	return expected_version <= aidl_service_version;
+}
+
+inline int32_t isAidlClientVersionAtLeast(int32_t expected_version)
+{
+	return expected_version <= aidl_client_version;
+}
+
 #define MAX_PORTS 1024
 bool GetInterfacesInBridge(std::string br_name,
                            std::vector<std::string>* interfaces) {
@@ -294,6 +312,33 @@
 	return true;
 }
 
+std::string getInterfaceMacAddress(const std::string& if_name)
+{
+	u8 addr[ETH_ALEN] = {};
+	struct ifreq ifr;
+	std::string mac_addr;
+
+	android::base::unique_fd sock(socket(PF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0));
+	if (sock.get() < 0) {
+		wpa_printf(MSG_ERROR, "Failed to create sock (%s) in %s",
+			strerror(errno), __FUNCTION__);
+		return "";
+	}
+
+	memset(&ifr, 0, sizeof(ifr));
+	strlcpy(ifr.ifr_name, if_name.c_str(), IFNAMSIZ);
+	if (ioctl(sock.get(), SIOCGIFHWADDR, &ifr) < 0) {
+		wpa_printf(MSG_ERROR, "Could not get interface %s hwaddr: %s",
+			   if_name.c_str(), strerror(errno));
+		return "";
+	}
+
+	memcpy(addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
+	mac_addr = StringPrintf("" MACSTR, MAC2STR(addr));
+
+	return mac_addr;
+}
+
 std::string CreateHostapdConfig(
 	const IfaceParams& iface_params,
 	const ChannelParams& channelParams,
@@ -541,64 +586,115 @@
 	std::string eht_params_as_string;
 #ifdef CONFIG_IEEE80211BE
 	if (iface_params.hwModeParams.enable80211BE && !is_60Ghz_used) {
-		eht_params_as_string = "ieee80211be=1";
+		eht_params_as_string = "ieee80211be=1\n";
+		if (isAidlServiceVersionAtLeast(2) && isAidlClientVersionAtLeast(2)) {
+			std::string interface_mac_addr = getInterfaceMacAddress(iface_params.name);
+			if (interface_mac_addr.empty()) {
+				wpa_printf(MSG_ERROR,
+				    "Unable to set interface mac address as bssid for 11BE SAP");
+				return "";
+			}
+			eht_params_as_string += StringPrintf(
+				"bssid=%s\n"
+				"mld_ap=1",
+				interface_mac_addr.c_str());
+		}
 		/* TODO set eht_su_beamformer, eht_su_beamformee, eht_mu_beamformer */
 	} else {
 		eht_params_as_string = "ieee80211be=0";
 	}
 #endif /* CONFIG_IEEE80211BE */
 
-	std::string ht_cap_vht_oper_he_oper_chwidth_as_string;
+	std::string ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string;
 	switch (iface_params.hwModeParams.maximumChannelBandwidth) {
 	case ChannelBandwidth::BANDWIDTH_20:
-		ht_cap_vht_oper_he_oper_chwidth_as_string = StringPrintf(
+		ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string = StringPrintf(
+#ifdef CONFIG_IEEE80211BE
+			"eht_oper_chwidth=0\n"
+#endif /* CONFIG_IEEE80211BE */
 #ifdef CONFIG_IEEE80211AX
 			"he_oper_chwidth=0\n"
 #endif
-			"vht_oper_chwidth=0");
+			"vht_oper_chwidth=0\n"
+			"%s", (band & band6Ghz) ? "op_class=131" : "");
 		break;
 	case ChannelBandwidth::BANDWIDTH_40:
-		ht_cap_vht_oper_he_oper_chwidth_as_string = StringPrintf(
+		ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string = StringPrintf(
 			"ht_capab=[HT40+]\n"
+#ifdef CONFIG_IEEE80211BE
+			"eht_oper_chwidth=0\n"
+#endif /* CONFIG_IEEE80211BE */
 #ifdef CONFIG_IEEE80211AX
 			"he_oper_chwidth=0\n"
 #endif
-			"vht_oper_chwidth=0");
+			"vht_oper_chwidth=0\n"
+			"%s", (band & band6Ghz) ? "op_class=132" : "");
 		break;
 	case ChannelBandwidth::BANDWIDTH_80:
-		ht_cap_vht_oper_he_oper_chwidth_as_string = StringPrintf(
+		ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string = StringPrintf(
 			"ht_capab=[HT40+]\n"
+#ifdef CONFIG_IEEE80211BE
+			"eht_oper_chwidth=%d\n"
+#endif /* CONFIG_IEEE80211BE */
 #ifdef CONFIG_IEEE80211AX
 			"he_oper_chwidth=%d\n"
 #endif
-			"vht_oper_chwidth=%d",
+			"vht_oper_chwidth=%d\n"
+			"%s",
+#ifdef CONFIG_IEEE80211BE
+			(iface_params.hwModeParams.enable80211BE && !is_60Ghz_used) ? 1 : 0,
+#endif
 #ifdef CONFIG_IEEE80211AX
 			(iface_params.hwModeParams.enable80211AX && !is_60Ghz_used) ? 1 : 0,
 #endif
-			iface_params.hwModeParams.enable80211AC ? 1 : 0);
+			iface_params.hwModeParams.enable80211AC ? 1 : 0,
+			(band & band6Ghz) ? "op_class=133" : "");
 		break;
 	case ChannelBandwidth::BANDWIDTH_160:
-		ht_cap_vht_oper_he_oper_chwidth_as_string = StringPrintf(
+		ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string = StringPrintf(
 			"ht_capab=[HT40+]\n"
+#ifdef CONFIG_IEEE80211BE
+			"eht_oper_chwidth=%d\n"
+#endif /* CONFIG_IEEE80211BE */
 #ifdef CONFIG_IEEE80211AX
 			"he_oper_chwidth=%d\n"
 #endif
-			"vht_oper_chwidth=%d",
+			"vht_oper_chwidth=%d\n"
+			"%s",
+#ifdef CONFIG_IEEE80211BE
+			(iface_params.hwModeParams.enable80211BE && !is_60Ghz_used) ? 2 : 0,
+#endif
 #ifdef CONFIG_IEEE80211AX
 			(iface_params.hwModeParams.enable80211AX && !is_60Ghz_used) ? 2 : 0,
 #endif
-			iface_params.hwModeParams.enable80211AC ? 2 : 0);
+			iface_params.hwModeParams.enable80211AC ? 2 : 0,
+			(band & band6Ghz) ? "op_class=134" : "");
 		break;
 	default:
 		if (!is_2Ghz_band_only && !is_60Ghz_used) {
 			if (iface_params.hwModeParams.enable80211AC) {
-				ht_cap_vht_oper_he_oper_chwidth_as_string =
+				ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string =
 					"ht_capab=[HT40+]\n"
 					"vht_oper_chwidth=1\n";
 			}
+			if (band & band6Ghz) {
+#ifdef CONFIG_IEEE80211BE
+				if (iface_params.hwModeParams.enable80211BE)
+					ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string += "op_class=137\n";
+				else
+					ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string += "op_class=134\n";
+#else /* CONFIG_IEEE80211BE */
+				ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string += "op_class=134\n";
+#endif /* CONFIG_IEEE80211BE */
+			}
 #ifdef CONFIG_IEEE80211AX
 			if (iface_params.hwModeParams.enable80211AX) {
-				ht_cap_vht_oper_he_oper_chwidth_as_string += "he_oper_chwidth=1";
+				ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string += "he_oper_chwidth=1\n";
+			}
+#endif
+#ifdef CONFIG_IEEE80211BE
+			if (iface_params.hwModeParams.enable80211BE) {
+				ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string += "eht_oper_chwidth=1";
 			}
 #endif
 		}
@@ -672,7 +768,7 @@
 		iface_params.hwModeParams.enable80211AC ? 1 : 0,
 		he_params_as_string.c_str(),
 		eht_params_as_string.c_str(),
-		hw_mode_as_string.c_str(), ht_cap_vht_oper_he_oper_chwidth_as_string.c_str(),
+		hw_mode_as_string.c_str(), ht_cap_vht_oper_he_oper_eht_oper_chwidth_as_string.c_str(),
 		nw_params.isHidden ? 1 : 0,
 #ifdef CONFIG_INTERWORKING
 		access_network_params_as_string.c_str(),
@@ -1012,9 +1108,13 @@
 				// Invoke the failure callback on all registered
 				// clients.
 				for (const auto& callback : callbacks_) {
-					callback->onFailure(strlen(iface_hapd->conf->bridge) > 0 ?
+					auto status = callback->onFailure(
+						strlen(iface_hapd->conf->bridge) > 0 ?
 						iface_hapd->conf->bridge : iface_hapd->conf->iface,
 							    iface_hapd->conf->iface);
+					if (!status.isOk()) {
+						wpa_printf(MSG_ERROR, "Failed to invoke onFailure");
+					}
 				}
 			}
 		};
@@ -1033,7 +1133,10 @@
 		info.clientAddress.assign(mac_addr, mac_addr + ETH_ALEN);
 		info.isConnected = authorized;
 		for (const auto &callback : callbacks_) {
-			callback->onConnectedClientsChanged(info);
+			auto status = callback->onConnectedClientsChanged(info);
+			if (!status.isOk()) {
+				wpa_printf(MSG_ERROR, "Failed to invoke onConnectedClientsChanged");
+			}
 		}
 		};
 
@@ -1057,16 +1160,23 @@
 			info.apIfaceInstanceMacAddress.assign(iface_hapd->own_addr,
 				iface_hapd->own_addr + ETH_ALEN);
 			for (const auto &callback : callbacks_) {
-				callback->onApInstanceInfoChanged(info);
+				auto status = callback->onApInstanceInfoChanged(info);
+				if (!status.isOk()) {
+					wpa_printf(MSG_ERROR,
+						   "Failed to invoke onApInstanceInfoChanged");
+				}
 			}
 		} else if (os_strncmp(txt, AP_EVENT_DISABLED, strlen(AP_EVENT_DISABLED)) == 0
                            || os_strncmp(txt, INTERFACE_DISABLED, strlen(INTERFACE_DISABLED)) == 0)
 		{
 			// Invoke the failure callback on all registered clients.
 			for (const auto& callback : callbacks_) {
-				callback->onFailure(strlen(iface_hapd->conf->bridge) > 0 ?
+				auto status = callback->onFailure(strlen(iface_hapd->conf->bridge) > 0 ?
 					iface_hapd->conf->bridge : iface_hapd->conf->iface,
 						    iface_hapd->conf->iface);
+				if (!status.isOk()) {
+					wpa_printf(MSG_ERROR, "Failed to invoke onFailure");
+				}
 			}
 		}
 	};
@@ -1130,6 +1240,14 @@
 		return createStatus(HostapdStatusCode::FAILURE_UNKNOWN);
 	}
 	callbacks_.push_back(callback);
+	if (aidl_service_version == 0) {
+	    aidl_service_version = Hostapd::version;
+	    wpa_printf(MSG_INFO, "AIDL service version: %d", aidl_service_version);
+	}
+	if (aidl_client_version == 0) {
+	    callback->getInterfaceVersion(&aidl_client_version);
+	    wpa_printf(MSG_INFO, "AIDL client version: %d", aidl_client_version);
+	}
 	return ndk::ScopedAStatus::ok();
 }
 
diff --git a/wpa_supplicant/Android.bp b/wpa_supplicant/Android.bp
index ca56d14..7fd11b5 100644
--- a/wpa_supplicant/Android.bp
+++ b/wpa_supplicant/Android.bp
@@ -332,10 +332,12 @@
         "src/common/sae_pk.c",
         "src/common/wpa_common.c",
         "src/crypto/aes-ctr.c",
+        "src/crypto/aes-encblock.c",
         "src/crypto/aes-siv.c",
         "src/crypto/crypto_openssl.c",
         "src/crypto/dh_groups.c",
         "src/crypto/fips_prf_openssl.c",
+        "src/crypto/milenage.c",
         "src/crypto/ms_funcs.c",
         "src/crypto/sha1-prf.c",
         "src/crypto/sha1-tlsprf.c",
@@ -438,6 +440,7 @@
         "src/wps/wps_upnp_event.c",
         "src/wps/wps_upnp_ssdp.c",
         "src/wps/wps_upnp_web.c",
+        "twt.c",
         "wifi_display.c",
         "wmm_ac.c",
         "wnm_sta.c",
@@ -446,3 +449,35 @@
         "wps_supplicant.c",
     ],
 }
+
+// Generated by building wpa_cli and printing LOCAL_SRC_FILES
+filegroup {
+    name: "wpa_cli_srcs",
+    srcs: [
+        "src/common/cli.c",
+        "src/utils/common.c",
+        "src/utils/edit.c",
+        "src/utils/eloop.c",
+        "src/utils/os_unix.c",
+        "src/utils/wpa_debug.c",
+        "wpa_cli.c",
+    ],
+}
+
+// Generated by building libwpa_client and printing LOCAL_SRC_FILES
+filegroup {
+    name: "libwpa_client_srcs",
+    srcs: [
+        "src/common/wpa_ctrl.c",
+        "src/utils/os_unix.c",
+    ],
+}
+
+cc_library_headers {
+    name: "libwpa_client_headers",
+    export_include_dirs: [
+        ".",
+        "wpa_client_include/libwpa_client",
+    ],
+    soc_specific: true,
+}
diff --git a/wpa_supplicant/aidl/Android.bp b/wpa_supplicant/aidl/Android.bp
index 481ad0b..2175462 100644
--- a/wpa_supplicant/aidl/Android.bp
+++ b/wpa_supplicant/aidl/Android.bp
@@ -30,7 +30,10 @@
 cc_library_static {
     name: "libwpa_aidl_bp",
     srcs: ["*.cpp"],
-    defaults: ["wpa_supplicant_cflags_defaults"],
+    defaults: [
+        "libwpa_aidl_cflags_defaults",
+        "wpa_supplicant_cflags_defaults",
+    ],
     soc_specific: true,
     shared_libs: [
         "android.hardware.wifi.supplicant-V3-ndk",
@@ -60,3 +63,22 @@
     name: "android.hardware.wifi.supplicant.xml",
     srcs: ["android.hardware.wifi.supplicant.xml"],
 }
+
+soong_config_module_type {
+    name: "libwpa_aidl_cflags_cc_defaults",
+    module_type: "cc_defaults",
+    config_namespace: "libwpa_aidl",
+    value_variables: [
+        "nl80211_driver",
+    ],
+    properties: ["cflags"],
+}
+
+libwpa_aidl_cflags_cc_defaults {
+    name: "libwpa_aidl_cflags_defaults",
+    soong_config_variables: {
+        nl80211_driver: {
+            cflags: ["-D%s"],
+        },
+    },
+}
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index d4f0f40..d4401ff 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -4526,7 +4526,11 @@
 		eapol_sm_invalidate_cached_session(wpa_s->eapol);
 	}
 
-	if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
+	if (!wpas_driver_bss_selection(wpa_s) ||
+#ifdef CONFIG_P2P
+	    wpa_s->p2p_in_invitation ||
+#endif /* CONFIG_P2P */
+	    ssid->bssid_set) {
 		wpa_s->current_bss = bss;
 #ifdef CONFIG_HS20
 		hs20_configure_frame_filters(wpa_s);