diff --git a/hostapd/Android.mk b/hostapd/Android.mk
index ed9f654..ee153d0 100644
--- a/hostapd/Android.mk
+++ b/hostapd/Android.mk
@@ -532,6 +532,10 @@
 ifdef TLS_FUNCS
 OBJS += src/crypto/tls_gnutls.c
 LIBS += -lgnutls -lgpg-error
+ifdef CONFIG_GNUTLS_EXTRA
+L_CFLAGS += -DCONFIG_GNUTLS_EXTRA
+LIBS += -lgnutls-extra
+endif
 endif
 OBJS += src/crypto/crypto_gnutls.c
 HOBJS += src/crypto/crypto_gnutls.c
diff --git a/hostapd/Makefile b/hostapd/Makefile
index 6809b07..f5dfce0 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -825,6 +825,12 @@
 CFLAGS += -DCONFIG_DEBUG_FILE
 endif
 
+ifdef CONFIG_SQLITE
+CFLAGS += -DCONFIG_SQLITE
+LIBS += -lsqlite3
+LIBS_h += -lsqlite3
+endif
+
 ALL=hostapd hostapd_cli
 
 all: verify_config $(ALL)
@@ -892,11 +898,6 @@
 LIBS_n += -lcrypto
 endif
 
-ifdef CONFIG_SQLITE
-CFLAGS += -DCONFIG_SQLITE
-LIBS_h += -lsqlite3
-endif
-
 HOBJS += hlr_auc_gw.o ../src/utils/common.o ../src/utils/wpa_debug.o ../src/utils/os_$(CONFIG_OS).o ../src/utils/wpabuf.o ../src/crypto/milenage.o
 HOBJS += ../src/crypto/aes-encblock.o
 ifdef CONFIG_INTERNAL_AES
diff --git a/hostapd/hlr_auc_gw.c b/hostapd/hlr_auc_gw.c
index e27ddab..e04e2e9 100644
--- a/hostapd/hlr_auc_gw.c
+++ b/hostapd/hlr_auc_gw.c
@@ -78,6 +78,7 @@
 	u8 opc[16];
 	u8 amf[2];
 	u8 sqn[6];
+	int set;
 };
 
 static struct milenage_parameters *milenage_db = NULL;
@@ -155,6 +156,8 @@
 	struct milenage_parameters *m = ctx;
 	int i;
 
+	m->set = 1;
+
 	for (i = 0; i < argc; i++) {
 		if (os_strcmp(col[i], "ki") == 0 && argv[i] &&
 		    hexstr2bin(argv[i], m->ki, sizeof(m->ki))) {
@@ -201,6 +204,8 @@
 			 NULL) != SQLITE_OK)
 		return NULL;
 
+	if (!db_tmp_milenage.set)
+		return NULL;
 	return &db_tmp_milenage;
 }
 
diff --git a/hostapd/hlr_auc_gw.txt b/hostapd/hlr_auc_gw.txt
index e4b6783..097bbce 100644
--- a/hostapd/hlr_auc_gw.txt
+++ b/hostapd/hlr_auc_gw.txt
@@ -63,6 +63,12 @@
 );
 
 
+hostapd (EAP server) can also be configured to store the EAP-SIM/AKA
+pseudonyms and reauth information into a SQLite database. This is
+configured with the db parameter within the eap_sim_db configuration
+option.
+
+
 "hlr_auc_gw -D /path/to/hlr_auc_gw.db" can then be used to fetch
 Milenage parameters based on IMSI from the database. The database can be
 updated dynamically while hlr_auc_gw is running to add/remove/modify
@@ -78,7 +84,7 @@
 radius_server_clients=hostapd.radius_clients
 eap_server=1
 eap_user_file=hostapd.eap_user
-eap_sim_db=unix:/tmp/hlr_auc_gw.sock
+eap_sim_db=unix:/tmp/hlr_auc_gw.sock db=/tmp/eap_sim.db
 eap_sim_aka_result_ind=1
 
 hostapd.radius_clients:
diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index 5a2c2ea..edbd772 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -681,8 +681,10 @@
 # This is a text string in implementation specific format. The example
 # implementation in eap_sim_db.c uses this as the UNIX domain socket name for
 # the HLR/AuC gateway (e.g., hlr_auc_gw). In this case, the path uses "unix:"
-# prefix.
+# prefix. If hostapd is built with SQLite support (CONFIG_SQLITE=y in .config),
+# database file can be described with an optional db=<path> parameter.
 #eap_sim_db=unix:/tmp/hlr_auc_gw.sock
+#eap_sim_db=unix:/tmp/hlr_auc_gw.sock db=/tmp/hostapd.db
 
 # Encryption key for EAP-FAST PAC-Opaque values. This key must be a secret,
 # random value. It is configured as a 16-octet value in hex format. It can be