wpa_supplicant: Call frequency conflict handling during auth
[mech_eap.git] / wpa_supplicant / wpa_supplicant.c
index d999e06..af7b847 100644 (file)
@@ -1,6 +1,6 @@
 /*
  * WPA Supplicant
- * Copyright (c) 2003-2012, Jouni Malinen <j@w1.fi>
+ * Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi>
  *
  * This software may be distributed under the terms of the BSD license.
  * See README for more details.
@@ -54,7 +54,7 @@
 
 const char *wpa_supplicant_version =
 "wpa_supplicant v" VERSION_STR "\n"
-"Copyright (c) 2003-2013, Jouni Malinen <j@w1.fi> and contributors";
+"Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi> and contributors";
 
 const char *wpa_supplicant_license =
 "This software may be distributed under the terms of the BSD license.\n"
@@ -104,11 +104,6 @@ const char *wpa_supplicant_full_license5 =
 "\n";
 #endif /* CONFIG_NO_STDOUT_DEBUG */
 
-extern int wpa_debug_level;
-extern int wpa_debug_show_keys;
-extern int wpa_debug_timestamp;
-extern struct wpa_driver_ops *wpa_drivers[];
-
 /* Configure default/group WEP keys for static WEP */
 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 {
@@ -200,8 +195,6 @@ static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
         * So, wait a second until scanning again.
         */
        wpa_supplicant_req_scan(wpa_s, 1, 0);
-
-       wpas_p2p_continue_after_scan(wpa_s);
 }
 
 
@@ -404,6 +397,11 @@ static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
        os_free(wpa_s->confanother);
        wpa_s->confanother = NULL;
 
+#ifdef CONFIG_P2P
+       os_free(wpa_s->conf_p2p_dev);
+       wpa_s->conf_p2p_dev = NULL;
+#endif /* CONFIG_P2P */
+
        wpa_sm_set_eapol(wpa_s->wpa, NULL);
        eapol_sm_deinit(wpa_s->eapol);
        wpa_s->eapol = NULL;
@@ -462,6 +460,9 @@ static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
        os_free(wpa_s->manual_scan_freqs);
        wpa_s->manual_scan_freqs = NULL;
 
+       os_free(wpa_s->manual_sched_scan_freqs);
+       wpa_s->manual_sched_scan_freqs = NULL;
+
        gas_query_deinit(wpa_s->gas);
        wpa_s->gas = NULL;
 
@@ -484,9 +485,16 @@ static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
        wpa_s->ext_pw = NULL;
 
        wpabuf_free(wpa_s->last_gas_resp);
+       wpa_s->last_gas_resp = NULL;
+       wpabuf_free(wpa_s->prev_gas_resp);
+       wpa_s->prev_gas_resp = NULL;
 
        os_free(wpa_s->last_scan_res);
        wpa_s->last_scan_res = NULL;
+
+#ifdef CONFIG_HS20
+       hs20_free_osu_prov(wpa_s);
+#endif /* CONFIG_HS20 */
 }
 
 
@@ -500,29 +508,23 @@ static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
  */
 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 {
-       if (wpa_s->keys_cleared) {
-               /* Some drivers (e.g., ndiswrapper & NDIS drivers) seem to have
-                * timing issues with keys being cleared just before new keys
-                * are set or just after association or something similar. This
-                * shows up in group key handshake failing often because of the
-                * client not receiving the first encrypted packets correctly.
-                * Skipping some of the extra key clearing steps seems to help
-                * in completing group key handshake more reliably. */
-               wpa_dbg(wpa_s, MSG_DEBUG, "No keys have been configured - "
-                       "skip key clearing");
-               return;
-       }
+       int i, max;
 
-       /* MLME-DELETEKEYS.request */
-       wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 0, 0, NULL, 0, NULL, 0);
-       wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 1, 0, NULL, 0, NULL, 0);
-       wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 2, 0, NULL, 0, NULL, 0);
-       wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 3, 0, NULL, 0, NULL, 0);
 #ifdef CONFIG_IEEE80211W
-       wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 4, 0, NULL, 0, NULL, 0);
-       wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 5, 0, NULL, 0, NULL, 0);
+       max = 6;
+#else /* CONFIG_IEEE80211W */
+       max = 4;
 #endif /* CONFIG_IEEE80211W */
-       if (addr) {
+
+       /* MLME-DELETEKEYS.request */
+       for (i = 0; i < max; i++) {
+               if (wpa_s->keys_cleared & BIT(i))
+                       continue;
+               wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
+                               NULL, 0);
+       }
+       if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
+           !is_zero_ether_addr(addr)) {
                wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
                                0);
                /* MLME-SETPROTECTION.request(None) */
@@ -531,7 +533,7 @@ void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
                        MLME_SETPROTECTION_PROTECT_TYPE_NONE,
                        MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
        }
-       wpa_s->keys_cleared = 1;
+       wpa_s->keys_cleared = (u32) -1;
 }
 
 
@@ -579,12 +581,16 @@ static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
                name = wpa_s->current_ssid->bgscan;
        else
                name = wpa_s->conf->bgscan;
-       if (name == NULL)
+       if (name == NULL || name[0] == '\0')
                return;
        if (wpas_driver_bss_selection(wpa_s))
                return;
        if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
                return;
+#ifdef CONFIG_P2P
+       if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
+               return;
+#endif /* CONFIG_P2P */
 
        bgscan_deinit(wpa_s);
        if (wpa_s->current_ssid) {
@@ -662,6 +668,17 @@ void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
                wpa_supplicant_state_txt(wpa_s->wpa_state),
                wpa_supplicant_state_txt(state));
 
+       if (state == WPA_INTERFACE_DISABLED) {
+               /* Assure normal scan when interface is restored */
+               wpa_s->normal_scans = 0;
+       }
+
+       if (state == WPA_COMPLETED) {
+               wpas_connect_work_done(wpa_s);
+               /* Reinitialize normal_scan counter */
+               wpa_s->normal_scans = 0;
+       }
+
        if (state != WPA_SCANNING)
                wpa_supplicant_notify_scanning(wpa_s, 0);
 
@@ -935,13 +952,14 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 {
        struct wpa_ie_data ie;
        int sel, proto;
-       const u8 *bss_wpa, *bss_rsn;
+       const u8 *bss_wpa, *bss_rsn, *bss_osen;
 
        if (bss) {
                bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
                bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
+               bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
        } else
-               bss_wpa = bss_rsn = NULL;
+               bss_wpa = bss_rsn = bss_osen = NULL;
 
        if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
            wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
@@ -957,11 +975,22 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
                   (ie.key_mgmt & ssid->key_mgmt)) {
                wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
                proto = WPA_PROTO_WPA;
+#ifdef CONFIG_HS20
+       } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
+               /* TODO: parse OSEN element */
+               ie.group_cipher = WPA_CIPHER_CCMP;
+               ie.pairwise_cipher = WPA_CIPHER_CCMP;
+               ie.key_mgmt = WPA_KEY_MGMT_OSEN;
+               proto = WPA_PROTO_OSEN;
+#endif /* CONFIG_HS20 */
        } else if (bss) {
                wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
                return -1;
        } else {
-               if (ssid->proto & WPA_PROTO_RSN)
+               if (ssid->proto & WPA_PROTO_OSEN)
+                       proto = WPA_PROTO_OSEN;
+               else if (ssid->proto & WPA_PROTO_RSN)
                        proto = WPA_PROTO_RSN;
                else
                        proto = WPA_PROTO_WPA;
@@ -994,7 +1023,7 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
        wpa_s->wpa_proto = proto;
        wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
        wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
-                        !!(ssid->proto & WPA_PROTO_RSN));
+                        !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
 
        if (bss || !wpa_s->ap_ies_from_associnfo) {
                if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
@@ -1065,6 +1094,11 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
        } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
                wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
                wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
+#ifdef CONFIG_HS20
+       } else if (sel & WPA_KEY_MGMT_OSEN) {
+               wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
+               wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
+#endif /* CONFIG_HS20 */
        } else {
                wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
                        "authenticated key management type");
@@ -1086,6 +1120,18 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
                wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
                wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
                        "AES-128-CMAC");
+       } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
+               wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
+               wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
+                       "BIP-GMAC-128");
+       } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
+               wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
+               wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
+                       "BIP-GMAC-256");
+       } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
+               wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
+               wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
+                       "BIP-CMAC-256");
        } else {
                wpa_s->mgmt_group_cipher = 0;
                wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
@@ -1210,6 +1256,10 @@ static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
 #endif /* CONFIG_INTERWORKING */
                break;
        case 5: /* Bits 40-47 */
+#ifdef CONFIG_HS20
+               if (wpa_s->conf->hs20)
+                       *pos |= 0x40; /* Bit 46 - WNM-Notification */
+#endif /* CONFIG_HS20 */
                break;
        case 6: /* Bits 48-55 */
                break;
@@ -1220,7 +1270,7 @@ static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf)
 {
        u8 *pos = buf;
-       u8 len = 4, i;
+       u8 len = 6, i;
 
        if (len < wpa_s->extended_capa_len)
                len = wpa_s->extended_capa_len;
@@ -1247,6 +1297,70 @@ int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf)
 }
 
 
+static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
+                         struct wpa_bss *test_bss)
+{
+       struct wpa_bss *bss;
+
+       dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
+               if (bss == test_bss)
+                       return 1;
+       }
+
+       return 0;
+}
+
+
+static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
+                          struct wpa_ssid *test_ssid)
+{
+       struct wpa_ssid *ssid;
+
+       for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
+               if (ssid == test_ssid)
+                       return 1;
+       }
+
+       return 0;
+}
+
+
+int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
+                       struct wpa_ssid *test_ssid)
+{
+       if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
+               return 0;
+
+       return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
+}
+
+
+void wpas_connect_work_free(struct wpa_connect_work *cwork)
+{
+       if (cwork == NULL)
+               return;
+       os_free(cwork);
+}
+
+
+void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
+{
+       struct wpa_connect_work *cwork;
+       struct wpa_radio_work *work = wpa_s->connect_work;
+
+       if (!work)
+               return;
+
+       wpa_s->connect_work = NULL;
+       cwork = work->ctx;
+       work->ctx = NULL;
+       wpas_connect_work_free(cwork);
+       radio_work_done(work);
+}
+
+
+static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
+
 /**
  * wpa_supplicant_associate - Request association
  * @wpa_s: Pointer to wpa_supplicant data
@@ -1258,19 +1372,7 @@ int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf)
 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
                              struct wpa_bss *bss, struct wpa_ssid *ssid)
 {
-       u8 wpa_ie[200];
-       size_t wpa_ie_len;
-       int use_crypt, ret, i, bssid_changed;
-       int algs = WPA_AUTH_ALG_OPEN;
-       unsigned int cipher_pairwise, cipher_group;
-       struct wpa_driver_associate_params params;
-       int wep_keys_set = 0;
-       int assoc_failed = 0;
-       struct wpa_ssid *old_ssid;
-#ifdef CONFIG_HT_OVERRIDES
-       struct ieee80211_ht_capabilities htcaps;
-       struct ieee80211_ht_capabilities htcaps_mask;
-#endif /* CONFIG_HT_OVERRIDES */
+       struct wpa_connect_work *cwork;
 
 #ifdef CONFIG_IBSS_RSN
        ibss_rsn_deinit(wpa_s->ibss_rsn);
@@ -1311,8 +1413,77 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
                return;
        }
 
+       if (wpa_s->connect_work) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
+               return;
+       }
+
+       if (radio_work_pending(wpa_s, "connect")) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
+               return;
+       }
+
+       cwork = os_zalloc(sizeof(*cwork));
+       if (cwork == NULL)
+               return;
+
+       cwork->bss = bss;
+       cwork->ssid = ssid;
+
+       if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
+                          wpas_start_assoc_cb, cwork) < 0) {
+               os_free(cwork);
+       }
+}
+
+
+static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
+{
+       struct wpa_connect_work *cwork = work->ctx;
+       struct wpa_bss *bss = cwork->bss;
+       struct wpa_ssid *ssid = cwork->ssid;
+       struct wpa_supplicant *wpa_s = work->wpa_s;
+       u8 wpa_ie[200];
+       size_t wpa_ie_len;
+       int use_crypt, ret, i, bssid_changed;
+       int algs = WPA_AUTH_ALG_OPEN;
+       unsigned int cipher_pairwise, cipher_group;
+       struct wpa_driver_associate_params params;
+       int wep_keys_set = 0;
+       int assoc_failed = 0;
+       struct wpa_ssid *old_ssid;
+#ifdef CONFIG_HT_OVERRIDES
+       struct ieee80211_ht_capabilities htcaps;
+       struct ieee80211_ht_capabilities htcaps_mask;
+#endif /* CONFIG_HT_OVERRIDES */
+#ifdef CONFIG_VHT_OVERRIDES
+       struct ieee80211_vht_capabilities vhtcaps;
+       struct ieee80211_vht_capabilities vhtcaps_mask;
+#endif /* CONFIG_VHT_OVERRIDES */
+
+       if (deinit) {
+               if (work->started) {
+                       wpa_s->connect_work = NULL;
+
+                       /* cancel possible auth. timeout */
+                       eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
+                                            NULL);
+               }
+               wpas_connect_work_free(cwork);
+               return;
+       }
+
+       wpa_s->connect_work = work;
+
+       if (!wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
+               wpas_connect_work_done(wpa_s);
+               return;
+       }
+
        os_memset(&params, 0, sizeof(params));
        wpa_s->reassociate = 0;
+       wpa_s->eap_expected_failure = 0;
        if (bss && !wpas_driver_bss_selection(wpa_s)) {
 #ifdef CONFIG_IEEE80211R
                const u8 *ie, *md = NULL;
@@ -1462,6 +1633,8 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
                                "disallows" : "allows");
                }
        }
+
+       os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
 #endif /* CONFIG_P2P */
 
 #ifdef CONFIG_HS20
@@ -1469,7 +1642,8 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
                struct wpabuf *hs20;
                hs20 = wpabuf_alloc(20);
                if (hs20) {
-                       wpas_hs20_add_indication(hs20);
+                       int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
+                       wpas_hs20_add_indication(hs20, pps_mo_id);
                        os_memcpy(wpa_ie + wpa_ie_len, wpabuf_head(hs20),
                                  wpabuf_len(hs20));
                        wpa_ie_len += wpabuf_len(hs20);
@@ -1551,6 +1725,8 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
                        params.bssid = bss->bssid;
                        params.freq = bss->freq;
                }
+               params.bssid_hint = bss->bssid;
+               params.freq_hint = bss->freq;
        } else {
                params.ssid = ssid->ssid;
                params.ssid_len = ssid->ssid_len;
@@ -1565,6 +1741,14 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
        if (ssid->mode == WPAS_MODE_IBSS && ssid->frequency > 0 &&
            params.freq == 0)
                params.freq = ssid->frequency; /* Initial channel for IBSS */
+
+       if (ssid->mode == WPAS_MODE_IBSS) {
+               if (ssid->beacon_int)
+                       params.beacon_int = ssid->beacon_int;
+               else
+                       params.beacon_int = wpa_s->conf->beacon_int;
+       }
+
        params.wpa_ie = wpa_ie;
        params.wpa_ie_len = wpa_ie_len;
        params.pairwise_suite = cipher_pairwise;
@@ -1623,6 +1807,13 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
        params.htcaps_mask = (u8 *) &htcaps_mask;
        wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
 #endif /* CONFIG_HT_OVERRIDES */
+#ifdef CONFIG_VHT_OVERRIDES
+       os_memset(&vhtcaps, 0, sizeof(vhtcaps));
+       os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
+       params.vhtcaps = &vhtcaps;
+       params.vhtcaps_mask = &vhtcaps_mask;
+       wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, &params);
+#endif /* CONFIG_VHT_OVERRIDES */
 
 #ifdef CONFIG_P2P
        /*
@@ -1631,9 +1822,11 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
         * least prioritized connection.
         */
        if (wpa_s->num_multichan_concurrent < 2) {
-               int freq = wpa_drv_shared_freq(wpa_s);
-               if (freq > 0 && freq != params.freq) {
-                       wpa_printf(MSG_DEBUG, "Shared interface with conflicting frequency found (%d != %d)",
+               int freq, num;
+               num = get_shared_radio_freqs(wpa_s, &freq, 1);
+               if (num > 0 && freq > 0 && freq != params.freq) {
+                       wpa_printf(MSG_DEBUG,
+                                  "Assoc conflicting freq found (%d != %d)",
                                   freq, params.freq);
                        if (wpas_p2p_handle_frequency_conflicts(wpa_s,
                                                                params.freq,
@@ -1978,7 +2171,7 @@ int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
        }
        if (pkcs11_module_path != NULL) {
                pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
-               if (pkcs11_engine_path_copy == NULL) {
+               if (pkcs11_module_path_copy == NULL) {
                        os_free(pkcs11_engine_path_copy);
                        return -1;
                }
@@ -2520,9 +2713,15 @@ int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
        wpa_s->prev_scan_wildcard = 0;
 
        if (wpa_supplicant_enabled_networks(wpa_s)) {
-               if (wpa_supplicant_delayed_sched_scan(wpa_s, interface_count,
+               if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
+                       wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
+                       interface_count = 0;
+               }
+               if (!wpa_s->p2p_mgmt &&
+                   wpa_supplicant_delayed_sched_scan(wpa_s,
+                                                     interface_count % 3,
                                                      100000))
-                       wpa_supplicant_req_scan(wpa_s, interface_count,
+                       wpa_supplicant_req_scan(wpa_s, interface_count % 3,
                                                100000);
                interface_count++;
        } else
@@ -2728,6 +2927,27 @@ static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
 }
 
 
+static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
+                              struct ieee80211_ht_capabilities *htcaps,
+                              struct ieee80211_ht_capabilities *htcaps_mask,
+                              int disabled)
+{
+       /* Masking these out disables LDPC */
+       u16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
+
+       wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
+
+       if (disabled)
+               htcaps->ht_capabilities_info &= ~msk;
+       else
+               htcaps->ht_capabilities_info |= msk;
+
+       htcaps_mask->ht_capabilities_info |= msk;
+
+       return 0;
+}
+
+
 void wpa_supplicant_apply_ht_overrides(
        struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
        struct wpa_driver_associate_params *params)
@@ -2751,6 +2971,13 @@ void wpa_supplicant_apply_ht_overrides(
        wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
        wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
        wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
+       wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
+
+       if (ssid->ht40_intolerant) {
+               u16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
+               htcaps->ht_capabilities_info |= bit;
+               htcaps_mask->ht_capabilities_info |= bit;
+       }
 }
 
 #endif /* CONFIG_HT_OVERRIDES */
@@ -2763,6 +2990,10 @@ void wpa_supplicant_apply_vht_overrides(
 {
        struct ieee80211_vht_capabilities *vhtcaps;
        struct ieee80211_vht_capabilities *vhtcaps_mask;
+#ifdef CONFIG_HT_OVERRIDES
+       int max_ampdu;
+       const u32 max_ampdu_mask = VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX;
+#endif /* CONFIG_HT_OVERRIDES */
 
        if (!ssid)
                return;
@@ -2778,6 +3009,20 @@ void wpa_supplicant_apply_vht_overrides(
        vhtcaps->vht_capabilities_info = ssid->vht_capa;
        vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
 
+#ifdef CONFIG_HT_OVERRIDES
+       /* if max ampdu is <= 3, we have to make the HT cap the same */
+       if (ssid->vht_capa_mask & max_ampdu_mask) {
+               max_ampdu = (ssid->vht_capa & max_ampdu_mask) >>
+                       find_first_bit(max_ampdu_mask);
+
+               max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
+               wpa_set_ampdu_factor(wpa_s,
+                                    (void *) params->htcaps,
+                                    (void *) params->htcaps_mask,
+                                    max_ampdu);
+       }
+#endif /* CONFIG_HT_OVERRIDES */
+
 #define OVERRIDE_MCS(i)                                                        \
        if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
                vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
@@ -2905,12 +3150,104 @@ static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
        if (rn)
                os_strlcpy(radio->name, rn, sizeof(radio->name));
        dl_list_init(&radio->ifaces);
+       dl_list_init(&radio->work);
        dl_list_add(&radio->ifaces, &wpa_s->radio_list);
 
        return radio;
 }
 
 
+static void radio_work_free(struct wpa_radio_work *work)
+{
+       if (work->wpa_s->scan_work == work) {
+               /* This should not really happen. */
+               wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
+                       work->type, work, work->started);
+               work->wpa_s->scan_work = NULL;
+       }
+
+#ifdef CONFIG_P2P
+       if (work->wpa_s->p2p_scan_work == work) {
+               /* This should not really happen. */
+               wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
+                       work->type, work, work->started);
+               work->wpa_s->p2p_scan_work = NULL;
+       }
+#endif /* CONFIG_P2P */
+
+       dl_list_del(&work->list);
+       os_free(work);
+}
+
+
+static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
+{
+       struct wpa_radio *radio = eloop_ctx;
+       struct wpa_radio_work *work;
+       struct os_reltime now, diff;
+       struct wpa_supplicant *wpa_s;
+
+       work = dl_list_first(&radio->work, struct wpa_radio_work, list);
+       if (work == NULL)
+               return;
+
+       if (work->started)
+               return; /* already started and still in progress */
+
+       wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
+                             radio_list);
+       if (wpa_s && wpa_s->external_scan_running) {
+               wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
+               return;
+       }
+
+       os_get_reltime(&now);
+       os_reltime_sub(&now, &work->time, &diff);
+       wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
+               work->type, work, diff.sec, diff.usec);
+       work->started = 1;
+       work->time = now;
+       work->cb(work, 0);
+}
+
+
+/*
+ * This function removes both started and pending radio works running on
+ * the provided interface's radio.
+ * Prior to the removal of the radio work, its callback (cb) is called with
+ * deinit set to be 1. Each work's callback is responsible for clearing its
+ * internal data and restoring to a correct state.
+ * @wpa_s: wpa_supplicant data
+ * @type: type of works to be removed
+ * @remove_all: 1 to remove all the works on this radio, 0 to remove only
+ * this interface's works.
+ */
+void radio_remove_works(struct wpa_supplicant *wpa_s,
+                       const char *type, int remove_all)
+{
+       struct wpa_radio_work *work, *tmp;
+       struct wpa_radio *radio = wpa_s->radio;
+
+       dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
+                             list) {
+               if (type && os_strcmp(type, work->type) != 0)
+                       continue;
+
+               /* skip other ifaces' works */
+               if (!remove_all && work->wpa_s != wpa_s)
+                       continue;
+
+               wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
+                       work->type, work, work->started ? " (started)" : "");
+               work->cb(work, 1);
+               radio_work_free(work);
+       }
+
+       /* in case we removed the started work */
+       radio_work_check_next(wpa_s);
+}
+
+
 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
 {
        struct wpa_radio *radio = wpa_s->radio;
@@ -2921,16 +3258,124 @@ static void radio_remove_interface(struct wpa_supplicant *wpa_s)
        wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
                   wpa_s->ifname, radio->name);
        dl_list_del(&wpa_s->radio_list);
+       radio_remove_works(wpa_s, NULL, 0);
        wpa_s->radio = NULL;
-
        if (!dl_list_empty(&radio->ifaces))
                return; /* Interfaces remain for this radio */
 
        wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
+       eloop_cancel_timeout(radio_start_next_work, radio, NULL);
        os_free(radio);
 }
 
 
+void radio_work_check_next(struct wpa_supplicant *wpa_s)
+{
+       struct wpa_radio *radio = wpa_s->radio;
+
+       if (dl_list_empty(&radio->work))
+               return;
+       eloop_cancel_timeout(radio_start_next_work, radio, NULL);
+       eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
+}
+
+
+/**
+ * radio_add_work - Add a radio work item
+ * @wpa_s: Pointer to wpa_supplicant data
+ * @freq: Frequency of the offchannel operation in MHz or 0
+ * @type: Unique identifier for each type of work
+ * @next: Force as the next work to be executed
+ * @cb: Callback function for indicating when radio is available
+ * @ctx: Context pointer for the work (work->ctx in cb())
+ * Returns: 0 on success, -1 on failure
+ *
+ * This function is used to request time for an operation that requires
+ * exclusive radio control. Once the radio is available, the registered callback
+ * function will be called. radio_work_done() must be called once the exclusive
+ * radio operation has been completed, so that the radio is freed for other
+ * operations. The special case of deinit=1 is used to free the context data
+ * during interface removal. That does not allow the callback function to start
+ * the radio operation, i.e., it must free any resources allocated for the radio
+ * work and return.
+ *
+ * The @freq parameter can be used to indicate a single channel on which the
+ * offchannel operation will occur. This may allow multiple radio work
+ * operations to be performed in parallel if they apply for the same channel.
+ * Setting this to 0 indicates that the work item may use multiple channels or
+ * requires exclusive control of the radio.
+ */
+int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
+                  const char *type, int next,
+                  void (*cb)(struct wpa_radio_work *work, int deinit),
+                  void *ctx)
+{
+       struct wpa_radio_work *work;
+       int was_empty;
+
+       work = os_zalloc(sizeof(*work));
+       if (work == NULL)
+               return -1;
+       wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
+       os_get_reltime(&work->time);
+       work->freq = freq;
+       work->type = type;
+       work->wpa_s = wpa_s;
+       work->cb = cb;
+       work->ctx = ctx;
+
+       was_empty = dl_list_empty(&wpa_s->radio->work);
+       if (next)
+               dl_list_add(&wpa_s->radio->work, &work->list);
+       else
+               dl_list_add_tail(&wpa_s->radio->work, &work->list);
+       if (was_empty) {
+               wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
+               radio_work_check_next(wpa_s);
+       }
+
+       return 0;
+}
+
+
+/**
+ * radio_work_done - Indicate that a radio work item has been completed
+ * @work: Completed work
+ *
+ * This function is called once the callback function registered with
+ * radio_add_work() has completed its work.
+ */
+void radio_work_done(struct wpa_radio_work *work)
+{
+       struct wpa_supplicant *wpa_s = work->wpa_s;
+       struct os_reltime now, diff;
+       unsigned int started = work->started;
+
+       os_get_reltime(&now);
+       os_reltime_sub(&now, &work->time, &diff);
+       wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
+               work->type, work, started ? "done" : "canceled",
+               diff.sec, diff.usec);
+       radio_work_free(work);
+       if (started)
+               radio_work_check_next(wpa_s);
+}
+
+
+int radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
+{
+       struct wpa_radio_work *work;
+       struct wpa_radio *radio = wpa_s->radio;
+
+       dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
+               if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
+                       return 1;
+       }
+
+       return 0;
+}
+
+
 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
                            struct wpa_interface *iface)
 {
@@ -2968,10 +3413,7 @@ next_driver:
                os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
        }
 
-       if (wpa_s->driver->get_radio_name)
-               rn = wpa_s->driver->get_radio_name(wpa_s->drv_priv);
-       else
-               rn = NULL;
+       rn = wpa_driver_get_radio_name(wpa_s);
        if (rn && rn[0] == '\0')
                rn = NULL;
 
@@ -3018,6 +3460,11 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
                wpa_s->confanother = os_rel2abs_path(iface->confanother);
                wpa_config_read(wpa_s->confanother, wpa_s->conf);
 
+#ifdef CONFIG_P2P
+               wpa_s->conf_p2p_dev = os_rel2abs_path(iface->conf_p2p_dev);
+               wpa_config_read(wpa_s->conf_p2p_dev, wpa_s->conf);
+#endif /* CONFIG_P2P */
+
                /*
                 * Override ctrl_interface and driver_param if set on command
                 * line.
@@ -3243,6 +3690,8 @@ static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
        wpa_supplicant_cleanup(wpa_s);
 
 #ifdef CONFIG_P2P
+       if (wpa_s == wpa_s->parent)
+               wpas_p2p_group_remove(wpa_s, "*");
        if (wpa_s == wpa_s->global->p2p_init_wpa_s && wpa_s->global->p2p) {
                wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Disable P2P since removing "
                        "the management interface is being removed");
@@ -3250,6 +3699,7 @@ static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
        }
 #endif /* CONFIG_P2P */
 
+       wpas_ctrl_radio_work_flush(wpa_s);
        radio_remove_interface(wpa_s);
 
        if (wpa_s->drv_priv)
@@ -3646,6 +4096,7 @@ void wpa_supplicant_deinit(struct wpa_global *global)
        os_free(global->params.override_ctrl_interface);
 
        os_free(global->p2p_disallow_freq.range);
+       os_free(global->p2p_go_avoid_freq.range);
        os_free(global->add_psk);
 
        os_free(global);
@@ -3738,6 +4189,8 @@ void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
        int count;
        int *freqs = NULL;
 
+       wpas_connect_work_done(wpa_s);
+
        /*
         * Remove possible authentication timeout since the connection failed.
         */
@@ -3824,8 +4277,6 @@ void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
         */
        wpa_supplicant_req_scan(wpa_s, timeout / 1000,
                                1000 * (timeout % 1000));
-
-       wpas_p2p_continue_after_scan(wpa_s);
 }
 
 
@@ -3944,7 +4395,7 @@ int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
        }
 
        if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
-           !ssid->ext_psk)
+           (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
                return 1;
 
        return 0;
@@ -3991,17 +4442,23 @@ void wpas_auth_failed(struct wpa_supplicant *wpa_s)
 
        if (ssid->auth_failures > 50)
                dur = 300;
-       else if (ssid->auth_failures > 20)
-               dur = 120;
        else if (ssid->auth_failures > 10)
-               dur = 60;
+               dur = 120;
        else if (ssid->auth_failures > 5)
+               dur = 90;
+       else if (ssid->auth_failures > 3)
+               dur = 60;
+       else if (ssid->auth_failures > 2)
                dur = 30;
        else if (ssid->auth_failures > 1)
                dur = 20;
        else
                dur = 10;
 
+       if (ssid->auth_failures > 1 &&
+           wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
+               dur += os_random() % (ssid->auth_failures * 10);
+
        os_get_reltime(&now);
        if (now.sec + dur <= ssid->disabled_until.sec)
                return;
@@ -4090,42 +4547,6 @@ void wpas_request_connection(struct wpa_supplicant *wpa_s)
 }
 
 
-static int wpas_conn_in_progress(struct wpa_supplicant *wpa_s)
-{
-       return wpa_s->wpa_state >= WPA_AUTHENTICATING &&
-               wpa_s->wpa_state != WPA_COMPLETED;
-}
-
-
-/**
- * wpas_wpa_is_in_progress - Check whether a connection is in progress
- * @wpa_s: Pointer to wpa_supplicant data
- * @include_current: Whether to consider specified interface
- *
- * This function is to check if the wpa state is in beginning of the connection
- * during 4-way handshake or group key handshake with WPA on any shared
- * interface.
- */
-int wpas_wpa_is_in_progress(struct wpa_supplicant *wpa_s, int include_current)
-{
-       struct wpa_supplicant *ifs;
-
-       dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
-                        radio_list) {
-               if (!include_current && ifs == wpa_s)
-                       continue;
-
-               if (wpas_conn_in_progress(ifs)) {
-                       wpa_dbg(wpa_s, MSG_DEBUG, "Connection is in progress "
-                               "on interface %s - defer", ifs->ifname);
-                       return 1;
-               }
-       }
-
-       return 0;
-}
-
-
 void dump_freq_array(struct wpa_supplicant *wpa_s, const char *title,
                     int *freq_array, unsigned int len)
 {
@@ -4164,7 +4585,7 @@ int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
        }
 
        /* If get_radio_name is not supported, use only the local freq */
-       if (!wpa_s->driver->get_radio_name) {
+       if (!wpa_driver_get_radio_name(wpa_s)) {
                freq = wpa_drv_shared_freq(wpa_s);
                if (freq > 0 && idx < len &&
                    (idx == 0 || freq_array[0] != freq))