P2P: Allow P2P client to specify preferred group channel
[mech_eap.git] / wpa_supplicant / p2p_supplicant.c
index bbf4578..004cf74 100644 (file)
 #define P2P_MAX_INITIAL_CONN_WAIT 10
 #endif /* P2P_MAX_INITIAL_CONN_WAIT */
 
+#ifndef P2P_CONCURRENT_SEARCH_DELAY
+#define P2P_CONCURRENT_SEARCH_DELAY 500
+#endif /* P2P_CONCURRENT_SEARCH_DELAY */
+
+enum p2p_group_removal_reason {
+       P2P_GROUP_REMOVAL_UNKNOWN,
+       P2P_GROUP_REMOVAL_SILENT,
+       P2P_GROUP_REMOVAL_FORMATION_FAILED,
+       P2P_GROUP_REMOVAL_REQUESTED,
+       P2P_GROUP_REMOVAL_IDLE_TIMEOUT,
+       P2P_GROUP_REMOVAL_UNAVAILABLE,
+       P2P_GROUP_REMOVAL_GO_ENDING_SESSION
+};
+
 
 static void wpas_p2p_long_listen_timeout(void *eloop_ctx, void *timeout_ctx);
 static struct wpa_supplicant *
@@ -68,14 +82,15 @@ static void wpas_p2p_join_scan(void *eloop_ctx, void *timeout_ctx);
 static int wpas_p2p_join(struct wpa_supplicant *wpa_s, const u8 *iface_addr,
                         const u8 *dev_addr, enum p2p_wps_method wps_method,
                         int auto_join);
-static void wpas_p2p_pd_before_join_timeout(void *eloop_ctx,
-                                           void *timeout_ctx);
 static int wpas_p2p_create_iface(struct wpa_supplicant *wpa_s);
 static void wpas_p2p_cross_connect_setup(struct wpa_supplicant *wpa_s);
 static void wpas_p2p_group_idle_timeout(void *eloop_ctx, void *timeout_ctx);
 static void wpas_p2p_set_group_idle_timeout(struct wpa_supplicant *wpa_s);
+static void wpas_p2p_group_formation_timeout(void *eloop_ctx,
+                                            void *timeout_ctx);
 static void wpas_p2p_fallback_to_go_neg(struct wpa_supplicant *wpa_s,
                                        int group_added);
+static int wpas_p2p_stop_find_oper(struct wpa_supplicant *wpa_s);
 
 
 static void wpas_p2p_scan_res_handler(struct wpa_supplicant *wpa_s,
@@ -91,8 +106,12 @@ static void wpas_p2p_scan_res_handler(struct wpa_supplicant *wpa_s,
 
        for (i = 0; i < scan_res->num; i++) {
                struct wpa_scan_res *bss = scan_res->res[i];
+               struct os_time time_tmp_age, entry_ts;
+               time_tmp_age.sec = bss->age / 1000;
+               time_tmp_age.usec = (bss->age % 1000) * 1000;
+               os_time_sub(&scan_res->fetch_time, &time_tmp_age, &entry_ts);
                if (p2p_scan_res_handler(wpa_s->global->p2p, bss->bssid,
-                                        bss->freq, bss->level,
+                                        bss->freq, &entry_ts, bss->level,
                                         (const u8 *) (bss + 1),
                                         bss->ie_len) > 0)
                        break;
@@ -107,6 +126,7 @@ static int wpas_p2p_scan(void *ctx, enum p2p_scan_type type, int freq,
                         const u8 *req_dev_types, const u8 *dev_id, u16 pw_id)
 {
        struct wpa_supplicant *wpa_s = ctx;
+       struct wpa_supplicant *ifs;
        struct wpa_driver_scan_params params;
        int ret;
        struct wpabuf *wps_ie, *ies;
@@ -116,6 +136,18 @@ static int wpas_p2p_scan(void *ctx, enum p2p_scan_type type, int freq,
        if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
                return -1;
 
+       for (ifs = wpa_s->global->ifaces; ifs; ifs = ifs->next) {
+               if (ifs->sta_scan_pending &&
+                   wpas_p2p_in_progress(wpa_s) == 2) {
+                       wpa_printf(MSG_DEBUG, "Delaying P2P scan to allow "
+                                  "pending station mode scan to be "
+                                  "completed on interface %s", ifs->ifname);
+                       wpa_s->global->p2p_cb_on_scan_complete = 1;
+                       wpa_supplicant_req_scan(ifs, 0, 0);
+                       return 1;
+               }
+       }
+
        os_memset(&params, 0, sizeof(params));
 
        /* P2P Wildcard SSID */
@@ -151,11 +183,6 @@ static int wpas_p2p_scan(void *ctx, enum p2p_scan_type type, int freq,
                break;
        case P2P_SCAN_FULL:
                break;
-       case P2P_SCAN_SPECIFIC:
-               social_channels[0] = freq;
-               social_channels[1] = 0;
-               params.freqs = social_channels;
-               break;
        case P2P_SCAN_SOCIAL_PLUS_ONE:
                social_channels[3] = freq;
                params.freqs = social_channels;
@@ -167,10 +194,13 @@ static int wpas_p2p_scan(void *ctx, enum p2p_scan_type type, int freq,
        wpabuf_free(ies);
 
        if (ret) {
-               if (wpa_s->scanning ||
-                   wpa_s->scan_res_handler == wpas_p2p_scan_res_handler) {
-                       wpa_s->p2p_cb_on_scan_complete = 1;
-                       ret = 1;
+               for (ifs = wpa_s->global->ifaces; ifs; ifs = ifs->next) {
+                       if (ifs->scanning ||
+                           ifs->scan_res_handler == wpas_p2p_scan_res_handler) {
+                               wpa_s->global->p2p_cb_on_scan_complete = 1;
+                               ret = 1;
+                               break;
+                       }
                }
        } else
                wpa_s->scan_res_handler = wpas_p2p_scan_res_handler;
@@ -219,7 +249,8 @@ static struct wpa_supplicant * wpas_get_p2p_group(struct wpa_supplicant *wpa_s,
 }
 
 
-static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
+static int wpas_p2p_group_delete(struct wpa_supplicant *wpa_s,
+                                enum p2p_group_removal_reason removal_reason)
 {
        struct wpa_ssid *ssid;
        char *gtype;
@@ -229,16 +260,22 @@ static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
        if (ssid == NULL) {
                /*
                 * The current SSID was not known, but there may still be a
-                * pending P2P group interface waiting for provisioning.
+                * pending P2P group interface waiting for provisioning or a
+                * P2P group that is trying to reconnect.
                 */
                ssid = wpa_s->conf->ssid;
                while (ssid) {
-                       if (ssid->p2p_group &&
-                           (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION ||
-                            (ssid->key_mgmt & WPA_KEY_MGMT_WPS)))
+                       if (ssid->p2p_group && ssid->disabled != 2)
                                break;
                        ssid = ssid->next;
                }
+               if (ssid == NULL &&
+                       wpa_s->p2p_group_interface == NOT_P2P_GROUP_INTERFACE)
+               {
+                       wpa_printf(MSG_ERROR, "P2P: P2P group interface "
+                                  "not found");
+                       return -1;
+               }
        }
        if (wpa_s->p2p_group_interface == P2P_GROUP_INTERFACE_GO)
                gtype = "GO";
@@ -257,10 +294,13 @@ static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
                        P2P_EVENT_CROSS_CONNECT_DISABLE "%s %s",
                        wpa_s->ifname, wpa_s->cross_connect_uplink);
        }
-       switch (wpa_s->removal_reason) {
+       switch (removal_reason) {
        case P2P_GROUP_REMOVAL_REQUESTED:
                reason = " reason=REQUESTED";
                break;
+       case P2P_GROUP_REMOVAL_FORMATION_FAILED:
+               reason = " reason=FORMATION_FAILED";
+               break;
        case P2P_GROUP_REMOVAL_IDLE_TIMEOUT:
                reason = " reason=IDLE";
                break;
@@ -274,7 +314,7 @@ static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
                reason = "";
                break;
        }
-       if (!silent) {
+       if (removal_reason != P2P_GROUP_REMOVAL_SILENT) {
                wpa_msg(wpa_s->parent, MSG_INFO,
                        P2P_EVENT_GROUP_REMOVED "%s %s%s",
                        wpa_s->ifname, gtype, reason);
@@ -282,8 +322,12 @@ static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
 
        if (eloop_cancel_timeout(wpas_p2p_group_idle_timeout, wpa_s, NULL) > 0)
                wpa_printf(MSG_DEBUG, "P2P: Cancelled P2P group idle timeout");
+       if (eloop_cancel_timeout(wpas_p2p_group_formation_timeout,
+                                wpa_s->parent, NULL) > 0)
+               wpa_printf(MSG_DEBUG, "P2P: Cancelled P2P group formation "
+                          "timeout");
 
-       if (!silent && ssid)
+       if (removal_reason != P2P_GROUP_REMOVAL_SILENT && ssid)
                wpas_notify_p2p_group_removed(wpa_s, ssid, gtype);
 
        if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE) {
@@ -300,7 +344,7 @@ static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
                if (wpa_s && ifname)
                        wpa_drv_if_remove(wpa_s, type, ifname);
                os_free(ifname);
-               return;
+               return 1;
        }
 
        wpa_printf(MSG_DEBUG, "P2P: Remove temporary group network");
@@ -325,6 +369,7 @@ static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
                wpa_config_remove_network(wpa_s->conf, id);
                wpa_supplicant_clear_status(wpa_s);
                wpa_supplicant_cancel_sched_scan(wpa_s);
+               wpa_s->sta_scan_pending = 0;
        } else {
                wpa_printf(MSG_DEBUG, "P2P: Temporary group network not "
                           "found");
@@ -333,6 +378,8 @@ static void wpas_p2p_group_delete(struct wpa_supplicant *wpa_s, int silent)
                wpa_supplicant_ap_deinit(wpa_s);
        else
                wpa_drv_deinit_p2p_cli(wpa_s);
+
+       return 0;
 }
 
 
@@ -490,6 +537,7 @@ static void wpas_p2p_add_persistent_group_client(struct wpa_supplicant *wpa_s,
        struct wpa_ssid *ssid, *s;
        u8 *n;
        size_t i;
+       int found = 0;
 
        ssid = wpa_s->current_ssid;
        if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GO ||
@@ -510,17 +558,40 @@ static void wpas_p2p_add_persistent_group_client(struct wpa_supplicant *wpa_s,
 
        for (i = 0; s->p2p_client_list && i < s->num_p2p_clients; i++) {
                if (os_memcmp(s->p2p_client_list + i * ETH_ALEN, addr,
-                             ETH_ALEN) == 0)
-                       return; /* already in list */
+                             ETH_ALEN) != 0)
+                       continue;
+
+               if (i == s->num_p2p_clients - 1)
+                       return; /* already the most recent entry */
+
+               /* move the entry to mark it most recent */
+               os_memmove(s->p2p_client_list + i * ETH_ALEN,
+                          s->p2p_client_list + (i + 1) * ETH_ALEN,
+                          (s->num_p2p_clients - i - 1) * ETH_ALEN);
+               os_memcpy(s->p2p_client_list +
+                         (s->num_p2p_clients - 1) * ETH_ALEN, addr, ETH_ALEN);
+               found = 1;
+               break;
        }
 
-       n = os_realloc(s->p2p_client_list,
-                      (s->num_p2p_clients + 1) * ETH_ALEN);
-       if (n == NULL)
-               return;
-       os_memcpy(n + s->num_p2p_clients * ETH_ALEN, addr, ETH_ALEN);
-       s->p2p_client_list = n;
-       s->num_p2p_clients++;
+       if (!found && s->num_p2p_clients < P2P_MAX_STORED_CLIENTS) {
+               n = os_realloc_array(s->p2p_client_list,
+                                    s->num_p2p_clients + 1, ETH_ALEN);
+               if (n == NULL)
+                       return;
+               os_memcpy(n + s->num_p2p_clients * ETH_ALEN, addr, ETH_ALEN);
+               s->p2p_client_list = n;
+               s->num_p2p_clients++;
+       } else if (!found) {
+               /* Not enough room for an additional entry - drop the oldest
+                * entry */
+               os_memmove(s->p2p_client_list,
+                          s->p2p_client_list + ETH_ALEN,
+                          (s->num_p2p_clients - 1) * ETH_ALEN);
+               os_memcpy(s->p2p_client_list +
+                         (s->num_p2p_clients - 1) * ETH_ALEN,
+                         addr, ETH_ALEN);
+       }
 
 #ifndef CONFIG_NO_CONFIG_WRITE
        if (wpa_s->parent->conf->update_config &&
@@ -553,7 +624,8 @@ static void wpas_group_formation_completed(struct wpa_supplicant *wpa_s,
        if (!success) {
                wpa_msg(wpa_s->parent, MSG_INFO,
                        P2P_EVENT_GROUP_FORMATION_FAILURE);
-               wpas_p2p_group_delete(wpa_s, 0);
+               wpas_p2p_group_delete(wpa_s,
+                                     P2P_GROUP_REMOVAL_FORMATION_FAILED);
                return;
        }
 
@@ -659,19 +731,13 @@ static void wpas_p2p_send_action_tx_status(struct wpa_supplicant *wpa_s,
        if (result != OFFCHANNEL_SEND_ACTION_SUCCESS &&
            wpa_s->pending_pd_before_join &&
            (os_memcmp(dst, wpa_s->pending_join_dev_addr, ETH_ALEN) == 0 ||
-            os_memcmp(dst, wpa_s->pending_join_iface_addr, ETH_ALEN) == 0)) {
+            os_memcmp(dst, wpa_s->pending_join_iface_addr, ETH_ALEN) == 0) &&
+           wpa_s->p2p_fallback_to_go_neg) {
                wpa_s->pending_pd_before_join = 0;
-               if (wpa_s->p2p_fallback_to_go_neg) {
-                       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: No ACK for PD Req "
-                               "during p2p_connect-auto");
-                       wpas_p2p_fallback_to_go_neg(wpa_s, 0);
-                       return;
-               }
-
-               wpa_printf(MSG_DEBUG, "P2P: Starting pending "
-                          "join-existing-group operation (no ACK for PD "
-                          "Req)");
-               wpas_p2p_join_start(wpa_s);
+               wpa_dbg(wpa_s, MSG_DEBUG, "P2P: No ACK for PD Req "
+                       "during p2p_connect-auto");
+               wpas_p2p_fallback_to_go_neg(wpa_s, 0);
+               return;
        }
 }
 
@@ -740,15 +806,28 @@ static void p2p_go_configured(void *ctx, void *data)
                wpa_printf(MSG_DEBUG, "P2P: Group setup without provisioning");
                if (wpa_s->global->p2p_group_formation == wpa_s)
                        wpa_s->global->p2p_group_formation = NULL;
-               wpa_msg(wpa_s->parent, MSG_INFO, P2P_EVENT_GROUP_STARTED
-                       "%s GO ssid=\"%s\" freq=%d passphrase=\"%s\" "
-                       "go_dev_addr=" MACSTR "%s",
-                       wpa_s->ifname,
-                       wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
-                       ssid->frequency,
-                       params->passphrase ? params->passphrase : "",
-                       MAC2STR(wpa_s->global->p2p_dev_addr),
-                       params->persistent_group ? " [PERSISTENT]" : "");
+               if (os_strlen(params->passphrase) > 0) {
+                       wpa_msg(wpa_s->parent, MSG_INFO, P2P_EVENT_GROUP_STARTED
+                               "%s GO ssid=\"%s\" freq=%d passphrase=\"%s\" "
+                               "go_dev_addr=" MACSTR "%s", wpa_s->ifname,
+                               wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
+                               ssid->frequency, params->passphrase,
+                               MAC2STR(wpa_s->global->p2p_dev_addr),
+                               params->persistent_group ? " [PERSISTENT]" :
+                               "");
+               } else {
+                       char psk[65];
+                       wpa_snprintf_hex(psk, sizeof(psk), params->psk,
+                                        sizeof(params->psk));
+                       wpa_msg(wpa_s->parent, MSG_INFO, P2P_EVENT_GROUP_STARTED
+                               "%s GO ssid=\"%s\" freq=%d psk=%s "
+                               "go_dev_addr=" MACSTR "%s", wpa_s->ifname,
+                               wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
+                               ssid->frequency, psk,
+                               MAC2STR(wpa_s->global->p2p_dev_addr),
+                               params->persistent_group ? " [PERSISTENT]" :
+                               "");
+               }
 
                if (params->persistent_group)
                        network_id = wpas_p2p_store_persistent_group(
@@ -774,7 +853,7 @@ static void p2p_go_configured(void *ctx, void *data)
                                          params->peer_device_addr);
        else if (wpa_s->p2p_pin[0])
                wpa_supplicant_ap_wps_pin(wpa_s, params->peer_interface_addr,
-                                         wpa_s->p2p_pin, NULL, 0);
+                                         wpa_s->p2p_pin, NULL, 0, 0);
        os_free(wpa_s->go_params);
        wpa_s->go_params = NULL;
 }
@@ -786,12 +865,18 @@ static void wpas_start_wps_go(struct wpa_supplicant *wpa_s,
 {
        struct wpa_ssid *ssid;
 
-       if (wpas_copy_go_neg_results(wpa_s, params) < 0)
+       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Starting GO");
+       if (wpas_copy_go_neg_results(wpa_s, params) < 0) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Could not copy GO Negotiation "
+                       "results");
                return;
+       }
 
        ssid = wpa_config_add_network(wpa_s->conf);
-       if (ssid == NULL)
+       if (ssid == NULL) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Could not add network for GO");
                return;
+       }
 
        wpa_s->show_group_started = 0;
 
@@ -802,6 +887,7 @@ static void wpas_start_wps_go(struct wpa_supplicant *wpa_s,
        ssid->mode = group_formation ? WPAS_MODE_P2P_GROUP_FORMATION :
                WPAS_MODE_P2P_GO;
        ssid->frequency = params->freq;
+       ssid->ht40 = params->ht40;
        ssid->ssid = os_zalloc(params->ssid_len + 1);
        if (ssid->ssid) {
                os_memcpy(ssid->ssid, params->ssid, params->ssid_len);
@@ -811,7 +897,22 @@ static void wpas_start_wps_go(struct wpa_supplicant *wpa_s,
        ssid->key_mgmt = WPA_KEY_MGMT_PSK;
        ssid->proto = WPA_PROTO_RSN;
        ssid->pairwise_cipher = WPA_CIPHER_CCMP;
-       ssid->passphrase = os_strdup(params->passphrase);
+       if (os_strlen(params->passphrase) > 0) {
+               ssid->passphrase = os_strdup(params->passphrase);
+               if (ssid->passphrase == NULL) {
+                       wpa_msg(wpa_s, MSG_ERROR, "P2P: Failed to copy "
+                               "passphrase for GO");
+                       wpa_config_remove_network(wpa_s->conf, ssid->id);
+                       return;
+               }
+       } else
+               ssid->passphrase = NULL;
+       ssid->psk_set = params->psk_set;
+       if (ssid->psk_set)
+               os_memcpy(ssid->psk, params->psk, sizeof(ssid->psk));
+       else if (ssid->passphrase)
+               wpa_config_update_psk(ssid);
+       ssid->ap_max_inactivity = wpa_s->parent->conf->p2p_go_max_inactivity;
 
        wpa_s->ap_configured_cb = p2p_go_configured;
        wpa_s->ap_configured_cb_ctx = wpa_s;
@@ -819,6 +920,8 @@ static void wpas_start_wps_go(struct wpa_supplicant *wpa_s,
        wpa_s->connect_without_scan = ssid;
        wpa_s->reassociate = 1;
        wpa_s->disconnected = 0;
+       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Request scan (that will be skipped) to "
+               "start GO)");
        wpa_supplicant_req_scan(wpa_s, 0, 0);
 }
 
@@ -999,6 +1102,9 @@ void wpas_go_neg_completed(void *ctx, struct p2p_go_neg_results *res)
                return;
        }
 
+       if (wpa_s->p2p_go_ht40)
+               res->ht40 = 1;
+
        wpa_msg(wpa_s, MSG_INFO, P2P_EVENT_GO_NEG_SUCCESS);
        wpas_notify_p2p_go_neg_completed(wpa_s, res);
 
@@ -1151,6 +1257,135 @@ static int wpas_send_probe_resp(void *ctx, const struct wpabuf *buf)
 }
 
 
+/*
+ * DNS Header section is used only to calculate compression pointers, so the
+ * contents of this data does not matter, but the length needs to be reserved
+ * in the virtual packet.
+ */
+#define DNS_HEADER_LEN 12
+
+/*
+ * 27-octet in-memory packet from P2P specification containing two implied
+ * queries for _tcp.lcoal. PTR IN and _udp.local. PTR IN
+ */
+#define P2P_SD_IN_MEMORY_LEN 27
+
+static int p2p_sd_dns_uncompress_label(char **upos, char *uend, u8 *start,
+                                      u8 **spos, const u8 *end)
+{
+       while (*spos < end) {
+               u8 val = ((*spos)[0] & 0xc0) >> 6;
+               int len;
+
+               if (val == 1 || val == 2) {
+                       /* These are reserved values in RFC 1035 */
+                       wpa_printf(MSG_DEBUG, "P2P: Invalid domain name "
+                                  "sequence starting with 0x%x", val);
+                       return -1;
+               }
+
+               if (val == 3) {
+                       u16 offset;
+                       u8 *spos_tmp;
+
+                       /* Offset */
+                       if (*spos + 2 > end) {
+                               wpa_printf(MSG_DEBUG, "P2P: No room for full "
+                                          "DNS offset field");
+                               return -1;
+                       }
+
+                       offset = (((*spos)[0] & 0x3f) << 8) | (*spos)[1];
+                       if (offset >= *spos - start) {
+                               wpa_printf(MSG_DEBUG, "P2P: Invalid DNS "
+                                          "pointer offset %u", offset);
+                               return -1;
+                       }
+
+                       (*spos) += 2;
+                       spos_tmp = start + offset;
+                       return p2p_sd_dns_uncompress_label(upos, uend, start,
+                                                          &spos_tmp,
+                                                          *spos - 2);
+               }
+
+               /* Label */
+               len = (*spos)[0] & 0x3f;
+               if (len == 0)
+                       return 0;
+
+               (*spos)++;
+               if (*spos + len > end) {
+                       wpa_printf(MSG_DEBUG, "P2P: Invalid domain name "
+                                  "sequence - no room for label with length "
+                                  "%u", len);
+                       return -1;
+               }
+
+               if (*upos + len + 2 > uend)
+                       return -2;
+
+               os_memcpy(*upos, *spos, len);
+               *spos += len;
+               *upos += len;
+               (*upos)[0] = '.';
+               (*upos)++;
+               (*upos)[0] = '\0';
+       }
+
+       return 0;
+}
+
+
+/* Uncompress domain names per RFC 1035 using the P2P SD in-memory packet.
+ * Returns -1 on parsing error (invalid input sequence), -2 if output buffer is
+ * not large enough */
+static int p2p_sd_dns_uncompress(char *buf, size_t buf_len, const u8 *msg,
+                                size_t msg_len, size_t offset)
+{
+       /* 27-octet in-memory packet from P2P specification */
+       const char *prefix = "\x04_tcp\x05local\x00\x00\x0C\x00\x01"
+               "\x04_udp\xC0\x11\x00\x0C\x00\x01";
+       u8 *tmp, *end, *spos;
+       char *upos, *uend;
+       int ret = 0;
+
+       if (buf_len < 2)
+               return -1;
+       if (offset > msg_len)
+               return -1;
+
+       tmp = os_malloc(DNS_HEADER_LEN + P2P_SD_IN_MEMORY_LEN + msg_len);
+       if (tmp == NULL)
+               return -1;
+       spos = tmp + DNS_HEADER_LEN + P2P_SD_IN_MEMORY_LEN;
+       end = spos + msg_len;
+       spos += offset;
+
+       os_memset(tmp, 0, DNS_HEADER_LEN);
+       os_memcpy(tmp + DNS_HEADER_LEN, prefix, P2P_SD_IN_MEMORY_LEN);
+       os_memcpy(tmp + DNS_HEADER_LEN + P2P_SD_IN_MEMORY_LEN, msg, msg_len);
+
+       upos = buf;
+       uend = buf + buf_len;
+
+       ret = p2p_sd_dns_uncompress_label(&upos, uend, tmp, &spos, end);
+       if (ret) {
+               os_free(tmp);
+               return ret;
+       }
+
+       if (upos == buf) {
+               upos[0] = '.';
+               upos[1] = '\0';
+       } else if (upos[-1] == '.')
+               upos[-1] = '\0';
+
+       os_free(tmp);
+       return 0;
+}
+
+
 static struct p2p_srv_bonjour *
 wpas_p2p_service_get_bonjour(struct wpa_supplicant *wpa_s,
                             const struct wpabuf *query)
@@ -1241,13 +1476,40 @@ static void wpas_sd_all_bonjour(struct wpa_supplicant *wpa_s,
 }
 
 
+static int match_bonjour_query(struct p2p_srv_bonjour *bsrv, const u8 *query,
+                              size_t query_len)
+{
+       char str_rx[256], str_srv[256];
+
+       if (query_len < 3 || wpabuf_len(bsrv->query) < 3)
+               return 0; /* Too short to include DNS Type and Version */
+       if (os_memcmp(query + query_len - 3,
+                     wpabuf_head_u8(bsrv->query) + wpabuf_len(bsrv->query) - 3,
+                     3) != 0)
+               return 0; /* Mismatch in DNS Type or Version */
+       if (query_len == wpabuf_len(bsrv->query) &&
+           os_memcmp(query, wpabuf_head(bsrv->query), query_len - 3) == 0)
+               return 1; /* Binary match */
+
+       if (p2p_sd_dns_uncompress(str_rx, sizeof(str_rx), query, query_len - 3,
+                                 0))
+               return 0; /* Failed to uncompress query */
+       if (p2p_sd_dns_uncompress(str_srv, sizeof(str_srv),
+                                 wpabuf_head(bsrv->query),
+                                 wpabuf_len(bsrv->query) - 3, 0))
+               return 0; /* Failed to uncompress service */
+
+       return os_strcmp(str_rx, str_srv) == 0;
+}
+
+
 static void wpas_sd_req_bonjour(struct wpa_supplicant *wpa_s,
                                struct wpabuf *resp, u8 srv_trans_id,
                                const u8 *query, size_t query_len)
 {
        struct p2p_srv_bonjour *bsrv;
-       struct wpabuf buf;
        u8 *len_pos;
+       int matches = 0;
 
        wpa_hexdump_ascii(MSG_DEBUG, "P2P: SD Request for Bonjour",
                          query, query_len);
@@ -1263,39 +1525,52 @@ static void wpas_sd_req_bonjour(struct wpa_supplicant *wpa_s,
                return;
        }
 
-       if (wpabuf_tailroom(resp) < 5)
-               return;
-       /* Length (to be filled) */
-       len_pos = wpabuf_put(resp, 2);
-       wpabuf_put_u8(resp, P2P_SERV_BONJOUR);
-       wpabuf_put_u8(resp, srv_trans_id);
+       dl_list_for_each(bsrv, &wpa_s->global->p2p_srv_bonjour,
+                        struct p2p_srv_bonjour, list) {
+               if (!match_bonjour_query(bsrv, query, query_len))
+                       continue;
+
+               if (wpabuf_tailroom(resp) <
+                   5 + query_len + wpabuf_len(bsrv->resp))
+                       return;
+
+               matches++;
 
-       wpabuf_set(&buf, query, query_len);
-       bsrv = wpas_p2p_service_get_bonjour(wpa_s, &buf);
-       if (bsrv == NULL) {
+               /* Length (to be filled) */
+               len_pos = wpabuf_put(resp, 2);
+               wpabuf_put_u8(resp, P2P_SERV_BONJOUR);
+               wpabuf_put_u8(resp, srv_trans_id);
+
+               /* Status Code */
+               wpabuf_put_u8(resp, P2P_SD_SUCCESS);
+               wpa_hexdump_ascii(MSG_DEBUG, "P2P: Matching Bonjour service",
+                                 wpabuf_head(bsrv->resp),
+                                 wpabuf_len(bsrv->resp));
+
+               /* Response Data */
+               wpabuf_put_data(resp, query, query_len); /* Key */
+               wpabuf_put_buf(resp, bsrv->resp); /* Value */
+
+               WPA_PUT_LE16(len_pos, (u8 *) wpabuf_put(resp, 0) - len_pos - 2);
+       }
+
+       if (matches == 0) {
                wpa_printf(MSG_DEBUG, "P2P: Requested Bonjour service not "
                           "available");
+               if (wpabuf_tailroom(resp) < 5)
+                       return;
+
+               /* Length (to be filled) */
+               len_pos = wpabuf_put(resp, 2);
+               wpabuf_put_u8(resp, P2P_SERV_BONJOUR);
+               wpabuf_put_u8(resp, srv_trans_id);
 
                /* Status Code */
                wpabuf_put_u8(resp, P2P_SD_REQUESTED_INFO_NOT_AVAILABLE);
                /* Response Data: empty */
                WPA_PUT_LE16(len_pos, (u8 *) wpabuf_put(resp, 0) - len_pos -
                             2);
-               return;
        }
-
-       /* Status Code */
-       wpabuf_put_u8(resp, P2P_SD_SUCCESS);
-       wpa_hexdump_ascii(MSG_DEBUG, "P2P: Matching Bonjour service",
-                         wpabuf_head(bsrv->resp), wpabuf_len(bsrv->resp));
-
-       if (wpabuf_tailroom(resp) >=
-           wpabuf_len(bsrv->query) + wpabuf_len(bsrv->resp)) {
-               /* Response Data */
-               wpabuf_put_buf(resp, bsrv->query); /* Key */
-               wpabuf_put_buf(resp, bsrv->resp); /* Value */
-       }
-       WPA_PUT_LE16(len_pos, (u8 *) wpabuf_put(resp, 0) - len_pos - 2);
 }
 
 
@@ -1416,6 +1691,62 @@ static void wpas_sd_req_upnp(struct wpa_supplicant *wpa_s,
 }
 
 
+#ifdef CONFIG_WIFI_DISPLAY
+static void wpas_sd_req_wfd(struct wpa_supplicant *wpa_s,
+                           struct wpabuf *resp, u8 srv_trans_id,
+                           const u8 *query, size_t query_len)
+{
+       const u8 *pos;
+       u8 role;
+       u8 *len_pos;
+
+       wpa_hexdump(MSG_DEBUG, "P2P: SD Request for WFD", query, query_len);
+
+       if (!wpa_s->global->wifi_display) {
+               wpa_printf(MSG_DEBUG, "P2P: WFD protocol not available");
+               wpas_sd_add_proto_not_avail(resp, P2P_SERV_WIFI_DISPLAY,
+                                           srv_trans_id);
+               return;
+       }
+
+       if (query_len < 1) {
+               wpa_printf(MSG_DEBUG, "P2P: Missing WFD Requested Device "
+                          "Role");
+               return;
+       }
+
+       if (wpabuf_tailroom(resp) < 5)
+               return;
+
+       pos = query;
+       role = *pos++;
+       wpa_printf(MSG_DEBUG, "P2P: WSD for device role 0x%x", role);
+
+       /* TODO: role specific handling */
+
+       /* Length (to be filled) */
+       len_pos = wpabuf_put(resp, 2);
+       wpabuf_put_u8(resp, P2P_SERV_WIFI_DISPLAY);
+       wpabuf_put_u8(resp, srv_trans_id);
+       wpabuf_put_u8(resp, P2P_SD_SUCCESS); /* Status Code */
+
+       while (pos < query + query_len) {
+               if (*pos < MAX_WFD_SUBELEMS &&
+                   wpa_s->global->wfd_subelem[*pos] &&
+                   wpabuf_tailroom(resp) >=
+                   wpabuf_len(wpa_s->global->wfd_subelem[*pos])) {
+                       wpa_printf(MSG_DEBUG, "P2P: Add WSD response "
+                                  "subelement %u", *pos);
+                       wpabuf_put_buf(resp, wpa_s->global->wfd_subelem[*pos]);
+               }
+               pos++;
+       }
+
+       WPA_PUT_LE16(len_pos, (u8 *) wpabuf_put(resp, 0) - len_pos - 2);
+}
+#endif /* CONFIG_WIFI_DISPLAY */
+
+
 void wpas_sd_request(void *ctx, int freq, const u8 *sa, u8 dialog_token,
                     u16 update_indic, const u8 *tlvs, size_t tlvs_len)
 {
@@ -1507,6 +1838,12 @@ void wpas_sd_request(void *ctx, int freq, const u8 *sa, u8 dialog_token,
                        wpas_sd_req_upnp(wpa_s, resp, srv_trans_id,
                                         pos, tlv_end - pos);
                        break;
+#ifdef CONFIG_WIFI_DISPLAY
+               case P2P_SERV_WIFI_DISPLAY:
+                       wpas_sd_req_wfd(wpa_s, resp, srv_trans_id,
+                                       pos, tlv_end - pos);
+                       break;
+#endif /* CONFIG_WIFI_DISPLAY */
                default:
                        wpa_printf(MSG_DEBUG, "P2P: Unavailable service "
                                   "protocol %u", srv_proto);
@@ -1624,6 +1961,88 @@ u64 wpas_p2p_sd_request_upnp(struct wpa_supplicant *wpa_s, const u8 *dst,
 }
 
 
+#ifdef CONFIG_WIFI_DISPLAY
+
+static u64 wpas_p2p_sd_request_wfd(struct wpa_supplicant *wpa_s, const u8 *dst,
+                                  const struct wpabuf *tlvs)
+{
+       if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_MGMT)
+               return 0;
+       if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
+               return 0;
+       return (uintptr_t) p2p_sd_request_wfd(wpa_s->global->p2p, dst, tlvs);
+}
+
+
+#define MAX_WFD_SD_SUBELEMS 20
+
+static void wfd_add_sd_req_role(struct wpabuf *tlvs, u8 id, u8 role,
+                               const char *subelems)
+{
+       u8 *len;
+       const char *pos;
+       int val;
+       int count = 0;
+
+       len = wpabuf_put(tlvs, 2);
+       wpabuf_put_u8(tlvs, P2P_SERV_WIFI_DISPLAY); /* Service Protocol Type */
+       wpabuf_put_u8(tlvs, id); /* Service Transaction ID */
+
+       wpabuf_put_u8(tlvs, role);
+
+       pos = subelems;
+       while (*pos) {
+               val = atoi(pos);
+               if (val >= 0 && val < 256) {
+                       wpabuf_put_u8(tlvs, val);
+                       count++;
+                       if (count == MAX_WFD_SD_SUBELEMS)
+                               break;
+               }
+               pos = os_strchr(pos + 1, ',');
+               if (pos == NULL)
+                       break;
+               pos++;
+       }
+
+       WPA_PUT_LE16(len, (u8 *) wpabuf_put(tlvs, 0) - len - 2);
+}
+
+
+u64 wpas_p2p_sd_request_wifi_display(struct wpa_supplicant *wpa_s,
+                                    const u8 *dst, const char *role)
+{
+       struct wpabuf *tlvs;
+       u64 ret;
+       const char *subelems;
+       u8 id = 1;
+
+       subelems = os_strchr(role, ' ');
+       if (subelems == NULL)
+               return 0;
+       subelems++;
+
+       tlvs = wpabuf_alloc(4 * (2 + 1 + 1 + 1 + MAX_WFD_SD_SUBELEMS));
+       if (tlvs == NULL)
+               return 0;
+
+       if (os_strstr(role, "[source]"))
+               wfd_add_sd_req_role(tlvs, id++, 0x00, subelems);
+       if (os_strstr(role, "[pri-sink]"))
+               wfd_add_sd_req_role(tlvs, id++, 0x01, subelems);
+       if (os_strstr(role, "[sec-sink]"))
+               wfd_add_sd_req_role(tlvs, id++, 0x02, subelems);
+       if (os_strstr(role, "[source+sink]"))
+               wfd_add_sd_req_role(tlvs, id++, 0x03, subelems);
+
+       ret = wpas_p2p_sd_request_wfd(wpa_s, dst, tlvs);
+       wpabuf_free(tlvs);
+       return ret;
+}
+
+#endif /* CONFIG_WIFI_DISPLAY */
+
+
 int wpas_p2p_sd_cancel_request(struct wpa_supplicant *wpa_s, u64 req)
 {
        if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_MGMT)
@@ -1701,14 +2120,6 @@ int wpas_p2p_service_add_bonjour(struct wpa_supplicant *wpa_s,
 {
        struct p2p_srv_bonjour *bsrv;
 
-       bsrv = wpas_p2p_service_get_bonjour(wpa_s, query);
-       if (bsrv) {
-               wpabuf_free(query);
-               wpabuf_free(bsrv->resp);
-               bsrv->resp = resp;
-               return 0;
-       }
-
        bsrv = os_zalloc(sizeof(*bsrv));
        if (bsrv == NULL)
                return -1;
@@ -1897,6 +2308,15 @@ static void wpas_prov_disc_fail(void *ctx, const u8 *peer,
                return;
        }
 
+       if (status == P2P_PROV_DISC_TIMEOUT_JOIN) {
+               wpa_s->pending_pd_before_join = 0;
+               wpa_printf(MSG_DEBUG, "P2P: Starting pending "
+                          "join-existing-group operation (no ACK for PD "
+                          "Req attempts)");
+               wpas_p2p_join_start(wpa_s);
+               return;
+       }
+
        wpa_msg(wpa_s, MSG_INFO, P2P_EVENT_PROV_DISC_FAILURE
                " p2p_dev_addr=" MACSTR " status=%d",
                MAC2STR(peer), status);
@@ -2023,9 +2443,11 @@ static void wpas_invitation_received(void *ctx, const u8 *sa, const u8 *bssid,
                           " was accepted; op_freq=%d MHz",
                           MAC2STR(sa), op_freq);
                if (s) {
+                       int go = s->mode == WPAS_MODE_P2P_GO;
                        wpas_p2p_group_add_persistent(
-                               wpa_s, s, s->mode == WPAS_MODE_P2P_GO, 0);
+                               wpa_s, s, go, go ? op_freq : 0, 0);
                } else if (bssid) {
+                       wpa_s->user_initiated_pd = 0;
                        wpas_p2p_join(wpa_s, bssid, go_dev_addr,
                                      wpa_s->p2p_wps_method, 0);
                }
@@ -2090,8 +2512,22 @@ static void wpas_invitation_result(void *ctx, int status, const u8 *bssid)
                return;
        }
 
+       /*
+        * The peer could have missed our ctrl::ack frame for Invitation
+        * Response and continue retransmitting the frame. To reduce the
+        * likelihood of the peer not getting successful TX status for the
+        * Invitation Response frame, wait a short time here before starting
+        * the persistent group so that we will remain on the current channel to
+        * acknowledge any possible retransmission from the peer.
+        */
+       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: 50 ms wait on current channel before "
+               "starting persistent group");
+       os_sleep(0, 50000);
+
        wpas_p2p_group_add_persistent(wpa_s, ssid,
-                                     ssid->mode == WPAS_MODE_P2P_GO, 0);
+                                     ssid->mode == WPAS_MODE_P2P_GO,
+                                     wpa_s->p2p_persistent_go_freq,
+                                     wpa_s->p2p_go_ht40);
 }
 
 
@@ -2228,26 +2664,47 @@ struct p2p_oper_class_map {
        enum { BW20, BW40PLUS, BW40MINUS } bw;
 };
 
+static struct p2p_oper_class_map op_class[] = {
+       { HOSTAPD_MODE_IEEE80211G, 81, 1, 13, 1, BW20 },
+#if 0 /* Do not enable HT40 on 2 GHz for now */
+       { HOSTAPD_MODE_IEEE80211G, 83, 1, 9, 1, BW40PLUS },
+       { HOSTAPD_MODE_IEEE80211G, 84, 5, 13, 1, BW40MINUS },
+#endif
+       { HOSTAPD_MODE_IEEE80211A, 115, 36, 48, 4, BW20 },
+       { HOSTAPD_MODE_IEEE80211A, 124, 149, 161, 4, BW20 },
+       { HOSTAPD_MODE_IEEE80211A, 116, 36, 44, 8, BW40PLUS },
+       { HOSTAPD_MODE_IEEE80211A, 117, 40, 48, 8, BW40MINUS },
+       { HOSTAPD_MODE_IEEE80211A, 126, 149, 157, 8, BW40PLUS },
+       { HOSTAPD_MODE_IEEE80211A, 127, 153, 161, 8, BW40MINUS },
+       { -1, 0, 0, 0, 0, BW20 }
+};
+
+
+static int wpas_p2p_verify_channel(struct wpa_supplicant *wpa_s,
+                                  struct hostapd_hw_modes *mode,
+                                  u8 channel, u8 bw)
+{
+       int flag;
+
+       if (!has_channel(wpa_s->global, mode, channel, &flag))
+               return -1;
+       if (bw == BW40MINUS &&
+           (!(flag & HOSTAPD_CHAN_HT40MINUS) ||
+            !has_channel(wpa_s->global, mode, channel - 4, NULL)))
+               return 0;
+       if (bw == BW40PLUS &&
+           (!(flag & HOSTAPD_CHAN_HT40PLUS) ||
+            !has_channel(wpa_s->global, mode, channel + 4, NULL)))
+               return 0;
+       return 1;
+}
+
+
 static int wpas_p2p_setup_channels(struct wpa_supplicant *wpa_s,
                                   struct p2p_channels *chan)
 {
        struct hostapd_hw_modes *mode;
        int cla, op;
-       struct p2p_oper_class_map op_class[] = {
-               { HOSTAPD_MODE_IEEE80211G, 81, 1, 13, 1, BW20 },
-               { HOSTAPD_MODE_IEEE80211G, 82, 14, 14, 1, BW20 },
-#if 0 /* Do not enable HT40 on 2 GHz for now */
-               { HOSTAPD_MODE_IEEE80211G, 83, 1, 9, 1, BW40PLUS },
-               { HOSTAPD_MODE_IEEE80211G, 84, 5, 13, 1, BW40MINUS },
-#endif
-               { HOSTAPD_MODE_IEEE80211A, 115, 36, 48, 4, BW20 },
-               { HOSTAPD_MODE_IEEE80211A, 124, 149, 161, 4, BW20 },
-               { HOSTAPD_MODE_IEEE80211A, 116, 36, 44, 8, BW40PLUS },
-               { HOSTAPD_MODE_IEEE80211A, 117, 40, 48, 8, BW40MINUS },
-               { HOSTAPD_MODE_IEEE80211A, 126, 149, 157, 8, BW40PLUS },
-               { HOSTAPD_MODE_IEEE80211A, 127, 153, 161, 8, BW40MINUS },
-               { -1, 0, 0, 0, 0, BW20 }
-       };
 
        if (wpa_s->hw.modes == NULL) {
                wpa_printf(MSG_DEBUG, "P2P: Driver did not support fetching "
@@ -2267,16 +2724,7 @@ static int wpas_p2p_setup_channels(struct wpa_supplicant *wpa_s,
                if (mode == NULL)
                        continue;
                for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
-                       int flag;
-                       if (!has_channel(wpa_s->global, mode, ch, &flag))
-                               continue;
-                       if (o->bw == BW40MINUS &&
-                           (!(flag & HOSTAPD_CHAN_HT40MINUS) ||
-                            !has_channel(wpa_s->global, mode, ch - 4, NULL)))
-                               continue;
-                       if (o->bw == BW40PLUS &&
-                           (!(flag & HOSTAPD_CHAN_HT40PLUS) ||
-                            !has_channel(wpa_s->global, mode, ch + 4, NULL)))
+                       if (wpas_p2p_verify_channel(wpa_s, mode, ch, o->bw) < 1)
                                continue;
                        if (reg == NULL) {
                                wpa_printf(MSG_DEBUG, "P2P: Add operating "
@@ -2300,6 +2748,32 @@ static int wpas_p2p_setup_channels(struct wpa_supplicant *wpa_s,
 }
 
 
+int wpas_p2p_get_ht40_mode(struct wpa_supplicant *wpa_s,
+                          struct hostapd_hw_modes *mode, u8 channel)
+{
+       int op, ret;
+
+       for (op = 0; op_class[op].op_class; op++) {
+               struct p2p_oper_class_map *o = &op_class[op];
+               u8 ch;
+
+               for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
+                       if (o->mode != HOSTAPD_MODE_IEEE80211A ||
+                           o->bw == BW20 || ch != channel)
+                               continue;
+                       ret = wpas_p2p_verify_channel(wpa_s, mode, ch, o->bw);
+                       if (ret < 0)
+                               continue;
+                       else if (ret > 0)
+                               return (o->bw == BW40MINUS) ? -1 : 1;
+                       else
+                               return 0;
+               }
+       }
+       return 0;
+}
+
+
 static int wpas_get_noa(void *ctx, const u8 *interface_addr, u8 *buf,
                        size_t buf_len)
 {
@@ -2480,6 +2954,8 @@ int wpas_p2p_init(struct wpa_global *global, struct wpa_supplicant *wpa_s)
 
        p2p.p2p_intra_bss = wpa_s->conf->p2p_intra_bss;
 
+       p2p.max_listen = wpa_s->max_remain_on_chan;
+
        global->p2p = p2p_init(&p2p);
        if (global->p2p == NULL)
                return -1;
@@ -2518,7 +2994,6 @@ void wpas_p2p_deinit(struct wpa_supplicant *wpa_s)
        wpa_s->go_params = NULL;
        eloop_cancel_timeout(wpas_p2p_group_formation_timeout, wpa_s, NULL);
        eloop_cancel_timeout(wpas_p2p_join_scan, wpa_s, NULL);
-       eloop_cancel_timeout(wpas_p2p_pd_before_join_timeout, wpa_s, NULL);
        wpa_s->p2p_long_listen = 0;
        eloop_cancel_timeout(wpas_p2p_long_listen_timeout, wpa_s, NULL);
        eloop_cancel_timeout(wpas_p2p_group_idle_timeout, wpa_s, NULL);
@@ -2539,13 +3014,14 @@ void wpas_p2p_deinit_global(struct wpa_global *global)
 {
        struct wpa_supplicant *wpa_s, *tmp;
 
+       wpa_s = global->ifaces;
+       if (wpa_s)
+               wpas_p2p_service_flush(wpa_s);
+
        if (global->p2p == NULL)
                return;
 
        /* Remove remaining P2P group interfaces */
-       wpa_s = global->ifaces;
-       if (wpa_s)
-               wpas_p2p_service_flush(wpa_s);
        while (wpa_s && wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
                wpa_s = wpa_s->next;
        while (wpa_s) {
@@ -2578,6 +3054,8 @@ void wpas_p2p_deinit_global(struct wpa_global *global)
 
 static int wpas_p2p_create_iface(struct wpa_supplicant *wpa_s)
 {
+       if (wpa_s->conf->p2p_no_group_iface)
+               return 0; /* separate interface disabled per configuration */
        if (wpa_s->drv_flags &
            (WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE |
             WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P))
@@ -2598,7 +3076,7 @@ static int wpas_p2p_start_go_neg(struct wpa_supplicant *wpa_s,
                                 enum p2p_wps_method wps_method,
                                 int go_intent, const u8 *own_interface_addr,
                                 unsigned int force_freq, int persistent_group,
-                                struct wpa_ssid *ssid)
+                                struct wpa_ssid *ssid, unsigned int pref_freq)
 {
        if (persistent_group && wpa_s->conf->persistent_reconnect)
                persistent_group = 2;
@@ -2609,11 +3087,18 @@ static int wpas_p2p_start_go_neg(struct wpa_supplicant *wpa_s,
                                           force_freq, persistent_group);
        }
 
+       /*
+        * Increase GO config timeout if HT40 is used since it takes some time
+        * to scan channels for coex purposes before the BSS can be started.
+        */
+       p2p_set_config_timeout(wpa_s->global->p2p,
+                              wpa_s->p2p_go_ht40 ? 255 : 100, 20);
+
        return p2p_connect(wpa_s->global->p2p, peer_addr, wps_method,
                           go_intent, own_interface_addr, force_freq,
                           persistent_group, ssid ? ssid->ssid : NULL,
                           ssid ? ssid->ssid_len : 0,
-                          wpa_s->p2p_pd_before_go_neg);
+                          wpa_s->p2p_pd_before_go_neg, pref_freq);
 }
 
 
@@ -2622,7 +3107,7 @@ static int wpas_p2p_auth_go_neg(struct wpa_supplicant *wpa_s,
                                enum p2p_wps_method wps_method,
                                int go_intent, const u8 *own_interface_addr,
                                unsigned int force_freq, int persistent_group,
-                               struct wpa_ssid *ssid)
+                               struct wpa_ssid *ssid, unsigned int pref_freq)
 {
        if (persistent_group && wpa_s->conf->persistent_reconnect)
                persistent_group = 2;
@@ -2633,7 +3118,7 @@ static int wpas_p2p_auth_go_neg(struct wpa_supplicant *wpa_s,
        return p2p_authorize(wpa_s->global->p2p, peer_addr, wps_method,
                             go_intent, own_interface_addr, force_freq,
                             persistent_group, ssid ? ssid->ssid : NULL,
-                            ssid ? ssid->ssid_len : 0);
+                            ssid ? ssid->ssid_len : 0, pref_freq);
 }
 
 
@@ -2660,21 +3145,6 @@ static void wpas_p2p_check_join_scan_limit(struct wpa_supplicant *wpa_s)
 }
 
 
-static void wpas_p2p_pd_before_join_timeout(void *eloop_ctx, void *timeout_ctx)
-{
-       struct wpa_supplicant *wpa_s = eloop_ctx;
-       if (!wpa_s->pending_pd_before_join)
-               return;
-       /*
-        * Provision Discovery Response may have been lost - try to connect
-        * anyway since we do not need any information from this PD.
-        */
-       wpa_printf(MSG_DEBUG, "P2P: PD timeout for join-existing-group - "
-                  "try to connect anyway");
-       wpas_p2p_join_start(wpa_s);
-}
-
-
 static int wpas_check_freq_conflict(struct wpa_supplicant *wpa_s, int freq)
 {
        struct wpa_supplicant *iface;
@@ -2792,7 +3262,7 @@ static void wpas_p2p_scan_res_join(struct wpa_supplicant *wpa_s,
                if (p2p_prov_disc_req(wpa_s->global->p2p,
                                      wpa_s->pending_join_dev_addr,
                                      wpa_s->pending_pd_config_methods, join,
-                                     0) < 0) {
+                                     0, wpa_s->user_initiated_pd) < 0) {
                        wpa_s->p2p_auto_pd = 0;
                        wpa_msg(wpa_s, MSG_INFO, P2P_EVENT_PROV_DISC_FAILURE
                                " p2p_dev_addr=" MACSTR " status=N/A",
@@ -2813,7 +3283,8 @@ static void wpas_p2p_scan_res_join(struct wpa_supplicant *wpa_s,
                                         wpa_s->p2p_go_intent,
                                         wpa_s->p2p_connect_freq,
                                         wpa_s->p2p_persistent_id,
-                                        wpa_s->p2p_pd_before_go_neg);
+                                        wpa_s->p2p_pd_before_go_neg,
+                                        wpa_s->p2p_go_ht40);
                        return;
                }
 
@@ -2901,25 +3372,13 @@ static void wpas_p2p_scan_res_join(struct wpa_supplicant *wpa_s,
 
                if (p2p_prov_disc_req(wpa_s->global->p2p,
                                      wpa_s->pending_join_dev_addr, method, 1,
-                                     freq) < 0) {
+                                     freq, wpa_s->user_initiated_pd) < 0) {
                        wpa_printf(MSG_DEBUG, "P2P: Failed to send Provision "
                                   "Discovery Request before joining an "
                                   "existing group");
                        wpa_s->pending_pd_before_join = 0;
                        goto start;
                }
-
-               /*
-                * Actual join operation will be started from the Action frame
-                * TX status callback (if no ACK is received) or when the
-                * Provision Discovery Response is received. Use a short
-                * timeout as a backup mechanism should the Provision Discovery
-                * Response be lost for any reason.
-                */
-               eloop_cancel_timeout(wpas_p2p_pd_before_join_timeout, wpa_s,
-                                    NULL);
-               eloop_register_timeout(2, 0, wpas_p2p_pd_before_join_timeout,
-                                      wpa_s, NULL);
                return;
        }
 
@@ -3036,7 +3495,6 @@ static int wpas_p2p_join_start(struct wpa_supplicant *wpa_s)
        struct p2p_go_neg_results res;
        struct wpa_bss *bss;
 
-       eloop_cancel_timeout(wpas_p2p_pd_before_join_timeout, wpa_s, NULL);
        group = wpas_p2p_get_group_iface(wpa_s, 0, 0);
        if (group == NULL)
                return -1;
@@ -3044,6 +3502,15 @@ static int wpas_p2p_join_start(struct wpa_supplicant *wpa_s)
                os_memcpy(group->p2p_pin, wpa_s->p2p_pin,
                          sizeof(group->p2p_pin));
                group->p2p_wps_method = wpa_s->p2p_wps_method;
+       } else {
+               /*
+                * Need to mark the current interface for p2p_group_formation
+                * when a separate group interface is not used. This is needed
+                * to allow p2p_cancel stop a pending p2p_connect-join.
+                * wpas_p2p_init_group_interface() addresses this for the case
+                * where a separate group interface is used.
+                */
+               wpa_s->global->p2p_group_formation = wpa_s;
        }
 
        group->p2p_in_provisioning = 1;
@@ -3082,6 +3549,60 @@ static int wpas_p2p_join_start(struct wpa_supplicant *wpa_s)
 }
 
 
+static int wpas_p2p_setup_freqs(struct wpa_supplicant *wpa_s, int freq,
+                               int *force_freq, int *pref_freq,
+                               int *oper_freq)
+{
+       if (freq > 0) {
+               if (!p2p_supported_freq(wpa_s->global->p2p, freq)) {
+                       wpa_printf(MSG_DEBUG, "P2P: The forced channel "
+                                  "(%u MHz) is not supported for P2P uses",
+                                  freq);
+                       return -3;
+               }
+
+               if (*oper_freq > 0 && freq != *oper_freq &&
+                   !(wpa_s->drv_flags &
+                     WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT)) {
+                       wpa_printf(MSG_DEBUG, "P2P: Cannot start P2P group "
+                                  "on %u MHz while connected on another "
+                                  "channel (%u MHz)", freq, *oper_freq);
+                       return -2;
+               }
+               wpa_printf(MSG_DEBUG, "P2P: Trying to force us to use the "
+                          "requested channel (%u MHz)", freq);
+               *force_freq = freq;
+       } else if (*oper_freq > 0 &&
+                  !p2p_supported_freq(wpa_s->global->p2p, *oper_freq)) {
+               if (!(wpa_s->drv_flags &
+                     WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT)) {
+                       wpa_printf(MSG_DEBUG, "P2P: Cannot start P2P group "
+                                  "while connected on non-P2P supported "
+                                  "channel (%u MHz)", *oper_freq);
+                       return -2;
+               }
+               wpa_printf(MSG_DEBUG, "P2P: Current operating channel "
+                          "(%u MHz) not available for P2P - try to use "
+                          "another channel", *oper_freq);
+               *force_freq = 0;
+       } else if (*oper_freq > 0 && *pref_freq == 0 &&
+                  (wpa_s->drv_flags &
+                   WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT)) {
+               wpa_printf(MSG_DEBUG, "P2P: Trying to prefer the channel we "
+                          "are already using (%u MHz) on another interface",
+                          *oper_freq);
+               *pref_freq = *oper_freq;
+       } else if (*oper_freq > 0) {
+               wpa_printf(MSG_DEBUG, "P2P: Trying to force us to use the "
+                          "channel we are already using (%u MHz) on another "
+                          "interface", *oper_freq);
+               *force_freq = *oper_freq;
+       }
+
+       return 0;
+}
+
+
 /**
  * wpas_p2p_connect - Request P2P Group Formation to be started
  * @wpa_s: Pointer to wpa_supplicant data from wpa_supplicant_add_iface()
@@ -3099,6 +3620,7 @@ static int wpas_p2p_join_start(struct wpa_supplicant *wpa_s)
  *     parameters or -1 to generate new values (SSID/passphrase)
  * @pd: Whether to send Provision Discovery prior to GO Negotiation as an
  *     interoperability workaround when initiating group formation
+ * @ht40: Start GO with 40 MHz channel width
  * Returns: 0 or new PIN (if pin was %NULL) on success, -1 on unspecified
  *     failure, -2 on failure due to channel not currently available,
  *     -3 if forced channel is not supported
@@ -3106,11 +3628,12 @@ static int wpas_p2p_join_start(struct wpa_supplicant *wpa_s)
 int wpas_p2p_connect(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
                     const char *pin, enum p2p_wps_method wps_method,
                     int persistent_group, int auto_join, int join, int auth,
-                    int go_intent, int freq, int persistent_id, int pd)
+                    int go_intent, int freq, int persistent_id, int pd,
+                    int ht40)
 {
-       int force_freq = 0, oper_freq = 0;
+       int force_freq = 0, pref_freq = 0, oper_freq = 0;
        u8 bssid[ETH_ALEN];
-       int ret = 0;
+       int ret = 0, res;
        enum wpa_driver_if_type iftype;
        const u8 *if_addr;
        struct wpa_ssid *ssid = NULL;
@@ -3138,6 +3661,7 @@ int wpas_p2p_connect(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
        wpa_s->p2p_connect_freq = freq;
        wpa_s->p2p_fallback_to_go_neg = 0;
        wpa_s->p2p_pd_before_go_neg = !!pd;
+       wpa_s->p2p_go_ht40 = !!ht40;
 
        if (pin)
                os_strlcpy(wpa_s->p2p_pin, pin, sizeof(wpa_s->p2p_pin));
@@ -3173,6 +3697,7 @@ int wpas_p2p_connect(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
                                   wpa_s->p2p_auto_started.sec,
                                   wpa_s->p2p_auto_started.usec);
                }
+               wpa_s->user_initiated_pd = 1;
                if (wpas_p2p_join(wpa_s, iface_addr, dev_addr, wps_method,
                                  auto_join) < 0)
                        return -1;
@@ -3180,52 +3705,18 @@ int wpas_p2p_connect(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
        }
 
        if (wpa_s->current_ssid && wpa_drv_get_bssid(wpa_s, bssid) == 0 &&
-           wpa_s->assoc_freq)
+           wpa_s->assoc_freq) {
                oper_freq = wpa_s->assoc_freq;
-       else {
+       else {
                oper_freq = wpa_drv_shared_freq(wpa_s);
                if (oper_freq < 0)
                        oper_freq = 0;
        }
 
-       if (freq > 0) {
-               if (!p2p_supported_freq(wpa_s->global->p2p, freq)) {
-                       wpa_printf(MSG_DEBUG, "P2P: The forced channel "
-                                  "(%u MHz) is not supported for P2P uses",
-                                  freq);
-                       return -3;
-               }
-
-               if (oper_freq > 0 && freq != oper_freq &&
-                   !(wpa_s->drv_flags &
-                     WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT)) {
-                       wpa_printf(MSG_DEBUG, "P2P: Cannot start P2P group "
-                                  "on %u MHz while connected on another "
-                                  "channel (%u MHz)", freq, oper_freq);
-                       return -2;
-               }
-               wpa_printf(MSG_DEBUG, "P2P: Trying to force us to use the "
-                          "requested channel (%u MHz)", freq);
-               force_freq = freq;
-       } else if (oper_freq > 0 &&
-                  !p2p_supported_freq(wpa_s->global->p2p, oper_freq)) {
-               if (!(wpa_s->drv_flags &
-                     WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT)) {
-                       wpa_printf(MSG_DEBUG, "P2P: Cannot start P2P group "
-                                  "while connected on non-P2P supported "
-                                  "channel (%u MHz)", oper_freq);
-                       return -2;
-               }
-               wpa_printf(MSG_DEBUG, "P2P: Current operating channel "
-                          "(%u MHz) not available for P2P - try to use "
-                          "another channel", oper_freq);
-               force_freq = 0;
-       } else if (oper_freq > 0) {
-               wpa_printf(MSG_DEBUG, "P2P: Trying to force us to use the "
-                          "channel we are already using (%u MHz) on another "
-                          "interface", oper_freq);
-               force_freq = oper_freq;
-       }
+       res = wpas_p2p_setup_freqs(wpa_s, freq, &force_freq, &pref_freq,
+                                  &oper_freq);
+       if (res)
+               return res;
 
        wpa_s->create_p2p_iface = wpas_p2p_create_iface(wpa_s);
 
@@ -3247,15 +3738,15 @@ int wpas_p2p_connect(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
        if (auth) {
                if (wpas_p2p_auth_go_neg(wpa_s, peer_addr, wps_method,
                                         go_intent, if_addr,
-                                        force_freq, persistent_group, ssid) <
-                   0)
+                                        force_freq, persistent_group, ssid,
+                                        pref_freq) < 0)
                        return -1;
                return ret;
        }
 
        if (wpas_p2p_start_go_neg(wpa_s, peer_addr, wps_method,
                                  go_intent, if_addr, force_freq,
-                                 persistent_group, ssid) < 0) {
+                                 persistent_group, ssid, pref_freq) < 0) {
                if (wpa_s->create_p2p_iface)
                        wpas_p2p_remove_pending_group_interface(wpa_s);
                return -1;
@@ -3314,12 +3805,12 @@ void wpas_p2p_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
 {
        wpa_printf(MSG_DEBUG, "P2P: Cancel remain-on-channel callback "
                   "(p2p_long_listen=%d ms pending_action_tx=%p)",
-                  wpa_s->p2p_long_listen, wpa_s->pending_action_tx);
+                  wpa_s->p2p_long_listen, offchannel_pending_action_tx(wpa_s));
        if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
                return;
        if (p2p_listen_end(wpa_s->global->p2p, freq) > 0)
                return; /* P2P module started a new operation */
-       if (wpa_s->pending_action_tx)
+       if (offchannel_pending_action_tx(wpa_s))
                return;
        if (wpa_s->p2p_long_listen > 0)
                wpa_s->p2p_long_listen -= wpa_s->max_remain_on_chan;
@@ -3369,13 +3860,14 @@ int wpas_p2p_group_remove(struct wpa_supplicant *wpa_s, const char *ifname)
 
 static int wpas_p2p_init_go_params(struct wpa_supplicant *wpa_s,
                                   struct p2p_go_neg_results *params,
-                                  int freq)
+                                  int freq, int ht40)
 {
        u8 bssid[ETH_ALEN];
        int res;
 
        os_memset(params, 0, sizeof(*params));
        params->role_go = 1;
+       params->ht40 = ht40;
        if (freq) {
                wpa_printf(MSG_DEBUG, "P2P: Set GO freq based on forced "
                           "frequency %d MHz", freq);
@@ -3387,7 +3879,11 @@ static int wpas_p2p_init_go_params(struct wpa_supplicant *wpa_s,
                wpa_printf(MSG_DEBUG, "P2P: Set GO freq based on configured "
                           "frequency %d MHz", params->freq);
        } else if (wpa_s->conf->p2p_oper_reg_class == 115 ||
-                  wpa_s->conf->p2p_oper_reg_class == 124) {
+                  wpa_s->conf->p2p_oper_reg_class == 116 ||
+                  wpa_s->conf->p2p_oper_reg_class == 117 ||
+                  wpa_s->conf->p2p_oper_reg_class == 124 ||
+                  wpa_s->conf->p2p_oper_reg_class == 126 ||
+                  wpa_s->conf->p2p_oper_reg_class == 127) {
                params->freq = 5000 + 5 * wpa_s->conf->p2p_oper_channel;
                wpa_printf(MSG_DEBUG, "P2P: Set GO freq based on configured "
                           "frequency %d MHz", params->freq);
@@ -3460,18 +3956,27 @@ wpas_p2p_get_group_iface(struct wpa_supplicant *wpa_s, int addr_allocated,
 {
        struct wpa_supplicant *group_wpa_s;
 
-       if (!wpas_p2p_create_iface(wpa_s))
+       if (!wpas_p2p_create_iface(wpa_s)) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Use same interface for group "
+                       "operations");
                return wpa_s;
+       }
 
        if (wpas_p2p_add_group_interface(wpa_s, go ? WPA_IF_P2P_GO :
-                                        WPA_IF_P2P_CLIENT) < 0)
+                                        WPA_IF_P2P_CLIENT) < 0) {
+               wpa_msg(wpa_s, MSG_ERROR, "P2P: Failed to add group interface");
                return NULL;
+       }
        group_wpa_s = wpas_p2p_init_group_interface(wpa_s, go);
        if (group_wpa_s == NULL) {
+               wpa_msg(wpa_s, MSG_ERROR, "P2P: Failed to initialize group "
+                       "interface");
                wpas_p2p_remove_pending_group_interface(wpa_s);
                return NULL;
        }
 
+       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Use separate group interface %s",
+               group_wpa_s->ifname);
        return group_wpa_s;
 }
 
@@ -3487,7 +3992,7 @@ wpas_p2p_get_group_iface(struct wpa_supplicant *wpa_s, int addr_allocated,
  * i.e., without using Group Owner Negotiation.
  */
 int wpas_p2p_group_add(struct wpa_supplicant *wpa_s, int persistent_group,
-                      int freq)
+                      int freq, int ht40)
 {
        struct p2p_go_neg_results params;
        unsigned int r;
@@ -3497,7 +4002,7 @@ int wpas_p2p_group_add(struct wpa_supplicant *wpa_s, int persistent_group,
 
        /* Make sure we are not running find during connection establishment */
        wpa_printf(MSG_DEBUG, "P2P: Stop any on-going P2P FIND");
-       wpas_p2p_stop_find(wpa_s);
+       wpas_p2p_stop_find_oper(wpa_s);
 
        if (freq == 2) {
                wpa_printf(MSG_DEBUG, "P2P: Request to start GO on 2.4 GHz "
@@ -3545,7 +4050,7 @@ int wpas_p2p_group_add(struct wpa_supplicant *wpa_s, int persistent_group,
                return -1;
        }
 
-       if (wpas_p2p_init_go_params(wpa_s, &params, freq))
+       if (wpas_p2p_init_go_params(wpa_s, &params, freq, ht40))
                return -1;
        if (params.freq &&
            !p2p_supported_freq(wpa_s->global->p2p, params.freq)) {
@@ -3612,7 +4117,7 @@ static int wpas_start_p2p_client(struct wpa_supplicant *wpa_s,
 
 int wpas_p2p_group_add_persistent(struct wpa_supplicant *wpa_s,
                                  struct wpa_ssid *ssid, int addr_allocated,
-                                 int freq)
+                                 int freq, int ht40)
 {
        struct p2p_go_neg_results params;
        int go = 0;
@@ -3628,7 +4133,7 @@ int wpas_p2p_group_add_persistent(struct wpa_supplicant *wpa_s,
        }
 
        /* Make sure we are not running find during connection establishment */
-       wpas_p2p_stop_find(wpa_s);
+       wpas_p2p_stop_find_oper(wpa_s);
 
        wpa_s->p2p_fallback_to_go_neg = 0;
 
@@ -3638,18 +4143,22 @@ int wpas_p2p_group_add_persistent(struct wpa_supplicant *wpa_s,
        if (ssid->mode != WPAS_MODE_P2P_GO)
                return -1;
 
-       if (wpas_p2p_init_go_params(wpa_s, &params, freq))
+       if (wpas_p2p_init_go_params(wpa_s, &params, freq, ht40))
                return -1;
 
        params.role_go = 1;
-       if (ssid->passphrase == NULL ||
-           os_strlen(ssid->passphrase) >= sizeof(params.passphrase)) {
-               wpa_printf(MSG_DEBUG, "P2P: Invalid passphrase in persistent "
-                          "group");
-               return -1;
+       params.psk_set = ssid->psk_set;
+       if (params.psk_set)
+               os_memcpy(params.psk, ssid->psk, sizeof(params.psk));
+       if (ssid->passphrase) {
+               if (os_strlen(ssid->passphrase) >= sizeof(params.passphrase)) {
+                       wpa_printf(MSG_ERROR, "P2P: Invalid passphrase in "
+                                  "persistent group");
+                       return -1;
+               }
+               os_strlcpy(params.passphrase, ssid->passphrase,
+                          sizeof(params.passphrase));
        }
-       os_strlcpy(params.passphrase, ssid->passphrase,
-                  sizeof(params.passphrase));
        os_memcpy(params.ssid, ssid->ssid, ssid->ssid_len);
        params.ssid_len = ssid->ssid_len;
        params.persistent_group = 1;
@@ -3851,7 +4360,7 @@ int wpas_p2p_prov_disc(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
 
        return p2p_prov_disc_req(wpa_s->global->p2p, peer_addr,
                                 config_methods, use == WPAS_P2P_PD_FOR_JOIN,
-                                0);
+                                0, 1);
 }
 
 
@@ -3864,20 +4373,19 @@ int wpas_p2p_scan_result_text(const u8 *ies, size_t ies_len, char *buf,
 
 static void wpas_p2p_clear_pending_action_tx(struct wpa_supplicant *wpa_s)
 {
-       if (!wpa_s->pending_action_tx)
+       if (!offchannel_pending_action_tx(wpa_s))
                return;
 
        wpa_printf(MSG_DEBUG, "P2P: Drop pending Action TX due to new "
                   "operation request");
-       wpabuf_free(wpa_s->pending_action_tx);
-       wpa_s->pending_action_tx = NULL;
+       offchannel_clear_pending_action_tx(wpa_s);
 }
 
 
 int wpas_p2p_find(struct wpa_supplicant *wpa_s, unsigned int timeout,
                  enum p2p_discovery_type type,
                  unsigned int num_req_dev_types, const u8 *req_dev_types,
-                 const u8 *dev_id)
+                 const u8 *dev_id, unsigned int search_delay)
 {
        wpas_p2p_clear_pending_action_tx(wpa_s);
        wpa_s->p2p_long_listen = 0;
@@ -3885,32 +4393,42 @@ int wpas_p2p_find(struct wpa_supplicant *wpa_s, unsigned int timeout,
        if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_MGMT)
                return wpa_drv_p2p_find(wpa_s, timeout, type);
 
-       if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
+       if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL ||
+           wpa_s->p2p_in_provisioning)
                return -1;
 
        wpa_supplicant_cancel_sched_scan(wpa_s);
 
        return p2p_find(wpa_s->global->p2p, timeout, type,
-                       num_req_dev_types, req_dev_types, dev_id);
+                       num_req_dev_types, req_dev_types, dev_id,
+                       search_delay);
 }
 
 
-void wpas_p2p_stop_find(struct wpa_supplicant *wpa_s)
+static int wpas_p2p_stop_find_oper(struct wpa_supplicant *wpa_s)
 {
        wpas_p2p_clear_pending_action_tx(wpa_s);
        wpa_s->p2p_long_listen = 0;
        eloop_cancel_timeout(wpas_p2p_long_listen_timeout, wpa_s, NULL);
        eloop_cancel_timeout(wpas_p2p_join_scan, wpa_s, NULL);
-       wpa_s->p2p_cb_on_scan_complete = 0;
+       wpa_s->global->p2p_cb_on_scan_complete = 0;
 
        if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_MGMT) {
                wpa_drv_p2p_stop_find(wpa_s);
-               return;
+               return 1;
        }
 
        if (wpa_s->global->p2p)
                p2p_stop_find(wpa_s->global->p2p);
 
+       return 0;
+}
+
+
+void wpas_p2p_stop_find(struct wpa_supplicant *wpa_s)
+{
+       if (wpas_p2p_stop_find_oper(wpa_s) > 0)
+               return;
        wpas_p2p_remove_pending_group_interface(wpa_s);
 }
 
@@ -4064,11 +4582,16 @@ int wpas_p2p_reject(struct wpa_supplicant *wpa_s, const u8 *addr)
 
 /* Invite to reinvoke a persistent group */
 int wpas_p2p_invite(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
-                   struct wpa_ssid *ssid, const u8 *go_dev_addr)
+                   struct wpa_ssid *ssid, const u8 *go_dev_addr, int freq,
+                   int ht40, int pref_freq)
 {
        enum p2p_invite_role role;
-       u8 *bssid = NULL;
+       u8 *bssid = NULL, bssid_buf[ETH_ALEN];
+       int force_freq = 0, oper_freq = 0;
+       int res;
 
+       wpa_s->p2p_persistent_go_freq = freq;
+       wpa_s->p2p_go_ht40 = !!ht40;
        if (ssid->mode == WPAS_MODE_P2P_GO) {
                role = P2P_INVITE_ROLE_GO;
                if (peer_addr == NULL) {
@@ -4093,6 +4616,22 @@ int wpas_p2p_invite(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
        }
        wpa_s->pending_invite_ssid_id = ssid->id;
 
+       if (wpa_s->current_ssid && wpa_drv_get_bssid(wpa_s, bssid_buf) == 0 &&
+           wpa_s->assoc_freq) {
+               oper_freq = wpa_s->assoc_freq;
+               if (bssid == NULL)
+                       bssid = bssid_buf;
+       } else {
+               oper_freq = wpa_drv_shared_freq(wpa_s);
+               if (oper_freq < 0)
+                       oper_freq = 0;
+       }
+
+       res = wpas_p2p_setup_freqs(wpa_s, freq, &force_freq, &pref_freq,
+                                  &oper_freq);
+       if (res)
+               return res;
+
        if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_MGMT)
                return wpa_drv_p2p_invite(wpa_s, peer_addr, role, bssid,
                                          ssid->ssid, ssid->ssid_len,
@@ -4102,7 +4641,8 @@ int wpas_p2p_invite(struct wpa_supplicant *wpa_s, const u8 *peer_addr,
                return -1;
 
        return p2p_invite(wpa_s->global->p2p, peer_addr, role, bssid,
-                         ssid->ssid, ssid->ssid_len, 0, go_dev_addr, 1);
+                         ssid->ssid, ssid->ssid_len, force_freq, go_dev_addr,
+                         1, pref_freq);
 }
 
 
@@ -4112,9 +4652,14 @@ int wpas_p2p_invite_group(struct wpa_supplicant *wpa_s, const char *ifname,
 {
        struct wpa_global *global = wpa_s->global;
        enum p2p_invite_role role;
-       u8 *bssid = NULL;
+       u8 *bssid = NULL, bssid_buf[ETH_ALEN];
        struct wpa_ssid *ssid;
        int persistent;
+       int force_freq = 0, oper_freq = 0, pref_freq = 0;
+       int res;
+
+       wpa_s->p2p_persistent_go_freq = 0;
+       wpa_s->p2p_go_ht40 = 0;
 
        for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
                if (os_strcmp(wpa_s->ifname, ifname) == 0)
@@ -4163,9 +4708,25 @@ int wpas_p2p_invite_group(struct wpa_supplicant *wpa_s, const char *ifname,
        if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
                return -1;
 
+       if (wpa_s->current_ssid && wpa_drv_get_bssid(wpa_s, bssid_buf) == 0 &&
+           wpa_s->assoc_freq) {
+               oper_freq = wpa_s->assoc_freq;
+               if (bssid == NULL)
+                       bssid = bssid_buf;
+       } else {
+               oper_freq = wpa_drv_shared_freq(wpa_s);
+               if (oper_freq < 0)
+                       oper_freq = 0;
+       }
+
+       res = wpas_p2p_setup_freqs(wpa_s, 0, &force_freq, &pref_freq,
+                                  &oper_freq);
+       if (res)
+               return res;
+
        return p2p_invite(wpa_s->global->p2p, peer_addr, role, bssid,
-                         ssid->ssid, ssid->ssid_len, wpa_s->assoc_freq,
-                         go_dev_addr, persistent);
+                         ssid->ssid, ssid->ssid_len, force_freq,
+                         go_dev_addr, persistent, pref_freq);
 }
 
 
@@ -4178,11 +4739,13 @@ void wpas_p2p_completed(struct wpa_supplicant *wpa_s)
        int persistent;
        int freq;
 
-       eloop_cancel_timeout(wpas_p2p_group_formation_timeout, wpa_s->parent,
-                            NULL);
+       if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GROUP_FORMATION) {
+               eloop_cancel_timeout(wpas_p2p_group_formation_timeout,
+                                    wpa_s->parent, NULL);
+       }
 
        if (!wpa_s->show_group_started || !ssid)
-               return;
+               goto done;
 
        wpa_s->show_group_started = 0;
 
@@ -4224,6 +4787,19 @@ void wpas_p2p_completed(struct wpa_supplicant *wpa_s)
        if (network_id < 0)
                network_id = ssid->id;
        wpas_notify_p2p_group_started(wpa_s, ssid, network_id, 1);
+
+done:
+       if (wpa_s->global->p2p_cb_on_scan_complete && !wpa_s->global->p2p_disabled &&
+           wpa_s->global->p2p != NULL) {
+               wpa_s->global->p2p_cb_on_scan_complete = 0;
+               if (p2p_other_scan_completed(wpa_s->global->p2p) == 1) {
+                       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Pending P2P operation "
+                               "continued after successful connection");
+                       p2p_increase_search_delay(
+                               wpa_s->global->p2p,
+                               wpas_p2p_search_delay(wpa_s));
+               }
+       }
 }
 
 
@@ -4261,8 +4837,15 @@ int wpas_p2p_ext_listen(struct wpa_supplicant *wpa_s, unsigned int period,
 
 static int wpas_p2p_is_client(struct wpa_supplicant *wpa_s)
 {
-       return wpa_s->current_ssid != NULL &&
-               wpa_s->current_ssid->p2p_group &&
+       if (wpa_s->current_ssid == NULL) {
+               /*
+                * current_ssid can be cleared when P2P client interface gets
+                * disconnected, so assume this interface was used as P2P
+                * client.
+                */
+               return 1;
+       }
+       return wpa_s->current_ssid->p2p_group &&
                wpa_s->current_ssid->mode == WPAS_MODE_INFRA;
 }
 
@@ -4279,8 +4862,7 @@ static void wpas_p2p_group_idle_timeout(void *eloop_ctx, void *timeout_ctx)
 
        wpa_printf(MSG_DEBUG, "P2P: Group idle timeout reached - terminate "
                   "group");
-       wpa_s->removal_reason = P2P_GROUP_REMOVAL_IDLE_TIMEOUT;
-       wpas_p2p_group_delete(wpa_s, 0);
+       wpas_p2p_group_delete(wpa_s, P2P_GROUP_REMOVAL_IDLE_TIMEOUT);
 }
 
 
@@ -4340,14 +4922,15 @@ static void wpas_p2p_set_group_idle_timeout(struct wpa_supplicant *wpa_s)
 }
 
 
-void wpas_p2p_deauth_notif(struct wpa_supplicant *wpa_s, const u8 *bssid,
-                          u16 reason_code, const u8 *ie, size_t ie_len,
-                          int locally_generated)
+/* Returns 1 if the interface was removed */
+int wpas_p2p_deauth_notif(struct wpa_supplicant *wpa_s, const u8 *bssid,
+                         u16 reason_code, const u8 *ie, size_t ie_len,
+                         int locally_generated)
 {
        if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
-               return;
+               return 0;
        if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_MGMT)
-               return;
+               return 0;
 
        if (!locally_generated)
                p2p_deauth_notif(wpa_s->global->p2p, bssid, reason_code, ie,
@@ -4359,9 +4942,13 @@ void wpas_p2p_deauth_notif(struct wpa_supplicant *wpa_s, const u8 *bssid,
            wpa_s->current_ssid->mode == WPAS_MODE_INFRA) {
                wpa_printf(MSG_DEBUG, "P2P: GO indicated that the P2P Group "
                           "session is ending");
-               wpa_s->removal_reason = P2P_GROUP_REMOVAL_GO_ENDING_SESSION;
-               wpas_p2p_group_delete(wpa_s, 0);
+               if (wpas_p2p_group_delete(wpa_s,
+                                         P2P_GROUP_REMOVAL_GO_ENDING_SESSION)
+                   > 0)
+                       return 1;
        }
+
+       return 0;
 }
 
 
@@ -4692,6 +5279,13 @@ void wpas_p2p_update_channel_list(struct wpa_supplicant *wpa_s)
 }
 
 
+static void wpas_p2p_scan_res_ignore(struct wpa_supplicant *wpa_s,
+                                    struct wpa_scan_results *scan_res)
+{
+       wpa_printf(MSG_DEBUG, "P2P: Ignore scan results");
+}
+
+
 int wpas_p2p_cancel(struct wpa_supplicant *wpa_s)
 {
        struct wpa_global *global = wpa_s->global;
@@ -4715,6 +5309,18 @@ int wpas_p2p_cancel(struct wpa_supplicant *wpa_s)
                found = 1;
        }
 
+       if (wpa_s->scan_res_handler == wpas_p2p_scan_res_join) {
+               wpa_printf(MSG_DEBUG, "P2P: Stop pending scan for join");
+               wpa_s->scan_res_handler = wpas_p2p_scan_res_ignore;
+               found = 1;
+       }
+
+       if (wpa_s->pending_pd_before_join) {
+               wpa_printf(MSG_DEBUG, "P2P: Stop pending PD before join");
+               wpa_s->pending_pd_before_join = 0;
+               found = 1;
+       }
+
        wpas_p2p_stop_find(wpa_s);
 
        for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
@@ -4728,7 +5334,12 @@ int wpas_p2p_cancel(struct wpa_supplicant *wpa_s)
                        found = 1;
                        eloop_cancel_timeout(wpas_p2p_group_formation_timeout,
                                             wpa_s->parent, NULL);
-                       wpas_p2p_group_delete(wpa_s, 0);
+                       if (wpa_s->p2p_in_provisioning) {
+                               wpas_group_formation_completed(wpa_s, 0);
+                               break;
+                       }
+                       wpas_p2p_group_delete(wpa_s,
+                                             P2P_GROUP_REMOVAL_REQUESTED);
                        break;
                }
        }
@@ -4749,8 +5360,7 @@ void wpas_p2p_interface_unavailable(struct wpa_supplicant *wpa_s)
 
        wpa_printf(MSG_DEBUG, "P2P: Remove group due to driver resource not "
                   "being available anymore");
-       wpa_s->removal_reason = P2P_GROUP_REMOVAL_UNAVAILABLE;
-       wpas_p2p_group_delete(wpa_s, 0);
+       wpas_p2p_group_delete(wpa_s, P2P_GROUP_REMOVAL_UNAVAILABLE);
 }
 
 
@@ -4796,19 +5406,36 @@ int wpas_p2p_disconnect(struct wpa_supplicant *wpa_s)
        if (wpa_s == NULL)
                return -1;
 
-       wpa_s->removal_reason = P2P_GROUP_REMOVAL_REQUESTED;
-       wpas_p2p_group_delete(wpa_s, 0);
-
-       return 0;
+       return wpas_p2p_group_delete(wpa_s, P2P_GROUP_REMOVAL_REQUESTED) < 0 ?
+               -1 : 0;
 }
 
 
 int wpas_p2p_in_progress(struct wpa_supplicant *wpa_s)
 {
+       int ret;
+
        if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
                return 0;
 
-       return p2p_in_progress(wpa_s->global->p2p);
+       ret = p2p_in_progress(wpa_s->global->p2p);
+       if (ret == 0) {
+               /*
+                * Check whether there is an ongoing WPS provisioning step (or
+                * other parts of group formation) on another interface since
+                * p2p_in_progress() does not report this to avoid issues for
+                * scans during such provisioning step.
+                */
+               if (wpa_s->global->p2p_group_formation &&
+                   wpa_s->global->p2p_group_formation != wpa_s) {
+                       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Another interface (%s) "
+                               "in group formation",
+                               wpa_s->global->p2p_group_formation->ifname);
+                       ret = 1;
+               }
+       }
+
+       return ret;
 }
 
 
@@ -4882,13 +5509,14 @@ static void wpas_p2p_fallback_to_go_neg(struct wpa_supplicant *wpa_s,
        wpa_s = wpa_s->parent;
        offchannel_send_action_done(wpa_s);
        if (group_added)
-               wpas_p2p_group_delete(group, 1);
+               wpas_p2p_group_delete(group, P2P_GROUP_REMOVAL_SILENT);
        wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Fall back to GO Negotiation");
        wpas_p2p_connect(wpa_s, wpa_s->pending_join_dev_addr, wpa_s->p2p_pin,
                         wpa_s->p2p_wps_method, wpa_s->p2p_persistent_group, 0,
                         0, 0, wpa_s->p2p_go_intent, wpa_s->p2p_connect_freq,
                         wpa_s->p2p_persistent_id,
-                        wpa_s->p2p_pd_before_go_neg);
+                        wpa_s->p2p_pd_before_go_neg,
+                        wpa_s->p2p_go_ht40);
 }
 
 
@@ -4907,3 +5535,41 @@ int wpas_p2p_scan_no_go_seen(struct wpa_supplicant *wpa_s)
 
        return 1;
 }
+
+
+unsigned int wpas_p2p_search_delay(struct wpa_supplicant *wpa_s)
+{
+       const char *rn, *rn2;
+       struct wpa_supplicant *ifs;
+
+       if (wpa_s->wpa_state > WPA_SCANNING) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Use %u ms search delay due to "
+                       "concurrent operation",
+                       P2P_CONCURRENT_SEARCH_DELAY);
+               return P2P_CONCURRENT_SEARCH_DELAY;
+       }
+
+       if (!wpa_s->driver->get_radio_name)
+               return 0;
+       rn = wpa_s->driver->get_radio_name(wpa_s->drv_priv);
+       if (rn == NULL || rn[0] == '\0')
+               return 0;
+
+       for (ifs = wpa_s->global->ifaces; ifs; ifs = ifs->next) {
+               if (ifs == wpa_s || !ifs->driver->get_radio_name)
+                       continue;
+
+               rn2 = ifs->driver->get_radio_name(ifs->drv_priv);
+               if (!rn2 || os_strcmp(rn, rn2) != 0)
+                       continue;
+               if (ifs->wpa_state > WPA_SCANNING) {
+                       wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Use %u ms search "
+                               "delay due to concurrent operation on "
+                               "interface %s",
+                               P2P_CONCURRENT_SEARCH_DELAY, ifs->ifname);
+                       return P2P_CONCURRENT_SEARCH_DELAY;
+               }
+       }
+
+       return 0;
+}