 @@ -1831,63 +1831,73 @@ static void send_deauth(struct hostapd_d
 	reply.u.deauth.reason_code = host_to_le16(reason_code);
 	if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
 		wpa_printf(MSG_INFO, "Failed to send deauth: %s",
 			   strerror(errno));
+}
 static int add_associated_sta(struct hostapd_data *hapd,
 			      struct sta_info *sta)
+{
 	struct ieee80211_ht_capabilities ht_cap;
 	struct ieee80211_vht_capabilities vht_cap;
 	int set = 1;
 	/*
 	 * Remove the STA entry to ensure the STA PS state gets cleared and
 	 * configuration gets updated. This is relevant for cases, such as
 	 * FT-over-the-DS, where a station re-associates back to the same AP but
 	 * skips the authentication flow, or if working with a driver that
 	 * does not support full AP client state.
+	 *
 	 * Skip this if the STA has already completed FT reassociation and the
 	 * TK has been configured since the TX/RX PN must not be reset to 0 for
 	 * the same key.
 	 */
-	if (!sta->added_unassoc)
+	if (!sta->added_unassoc &&
 	    (!(sta->flags & WLAN_STA_AUTHORIZED) ||
 	     !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) {
 		hostapd_drv_sta_remove(hapd, sta->addr);
 		wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
 		set = 0;
+	}
 #ifdef CONFIG_IEEE80211N
 	if (sta->flags & WLAN_STA_HT)
 		hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
 #endif /* CONFIG_IEEE80211N */
 #ifdef CONFIG_IEEE80211AC
 	if (sta->flags & WLAN_STA_VHT)
 		hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
 #endif /* CONFIG_IEEE80211AC */
 	/*
 	 * Add the station with forced WLAN_STA_ASSOC flag. The sta->flags
 	 * will be set when the ACK frame for the (Re)Association Response frame
 	 * is processed (TX status driver event).
 	 */
 	if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
 			    sta->supported_rates, sta->supported_rates_len,
 			    sta->listen_interval,
 			    sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
 			    sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
 			    sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
 			    sta->vht_opmode, sta->p2p_ie ? 1 : 0,
-			    sta->added_unassoc)) {
+			    set)) {
 		hostapd_logger(hapd, sta->addr,
 			       HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
 			       "Could not %s STA to kernel driver",
-			       sta->added_unassoc ? "set" : "add");
+			       set ? "set" : "add");
 		if (sta->added_unassoc) {
 			hostapd_drv_sta_remove(hapd, sta->addr);
 			sta->added_unassoc = 0;
+		}
 		return -1;
+	}
 	sta->added_unassoc = 0;
 	return 0;
+}

 @@ -770,38 +770,47 @@ void wpa_ft_install_ptk(struct wpa_state
+{
 	enum wpa_alg alg;
 	int klen;
 	/* MLME-SETKEYS.request(PTK) */
 	alg = wpa_cipher_to_alg(sm->pairwise);
 	klen = wpa_cipher_key_len(sm->pairwise);
 	if (!wpa_cipher_valid_pairwise(sm->pairwise)) {
 		wpa_printf(MSG_DEBUG, "FT: Unknown pairwise alg 0x%x - skip "
 			   "PTK configuration", sm->pairwise);
 		return;
+	}
 	if (sm->tk_already_set) {
 		/* Must avoid TK reconfiguration to prevent clearing of TX/RX
 		 * PN in the driver */
 		wpa_printf(MSG_DEBUG,
 			   "FT: Do not re-install same PTK to the driver");
 		return;
+	}
 	/* FIX: add STA entry to kernel/driver here? The set_key will fail
 	 * most likely without this.. At the moment, STA entry is added only
 	 * after association has been completed. This function will be called
 	 * again after association to get the PTK configured, but that could be
 	 * optimized by adding the STA entry earlier.
 	 */
 	if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, 0,
 			     sm->PTK.tk, klen))
 		return;
 	/* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */
 	sm->pairwise_set = TRUE;
 	sm->tk_already_set = TRUE;
+}
 static int wpa_ft_process_auth_req(struct wpa_state_machine *sm,
 				   const u8 *ies, size_t ies_len,
 				   u8 **resp_ies, size_t *resp_ies_len)
+{
 	struct rsn_mdie *mdie;
 	struct rsn_ftie *ftie;
 	u8 pmk_r1[PMK_LEN], pmk_r1_name[WPA_PMK_NAME_LEN];
 	u8 ptk_name[WPA_PMK_NAME_LEN];
 	struct wpa_auth_config *conf;
 	struct wpa_ft_ies parse;
 @@ -888,26 +897,27 @@ static int wpa_ft_process_auth_req(struc
 	wpa_hexdump(MSG_DEBUG, "FT: Received SNonce",
 		    sm->SNonce, WPA_NONCE_LEN);
 	wpa_hexdump(MSG_DEBUG, "FT: Generated ANonce",
 		    sm->ANonce, WPA_NONCE_LEN);
 	if (wpa_pmk_r1_to_ptk(pmk_r1, sm->SNonce, sm->ANonce, sm->addr,
 			      sm->wpa_auth->addr, pmk_r1_name,
 			      &sm->PTK, ptk_name, sm->wpa_key_mgmt,
 			      pairwise) < 0)
 		return WLAN_STATUS_UNSPECIFIED_FAILURE;
 	sm->pairwise = pairwise;
 	sm->PTK_valid = TRUE;
 	sm->tk_already_set = FALSE;
 	wpa_ft_install_ptk(sm);
 	buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
 + FT_R1KH_ID_LEN + 200;
 	*resp_ies = os_zalloc(buflen);
 	if (*resp_ies == NULL) {
 		return WLAN_STATUS_UNSPECIFIED_FAILURE;
+	}
 	pos = *resp_ies;
 	end = *resp_ies + buflen;
 	ret = wpa_write_rsn_ie(conf, pos, end - pos, parse.rsn_pmkid);

 @@ -1735,26 +1735,29 @@ int wpa_auth_sm_event(struct wpa_state_m
 		break;
 	case WPA_ASSOC_FT:
 #ifdef CONFIG_IEEE80211R
 		wpa_printf(MSG_DEBUG, "FT: Retry PTK configuration "
 			   "after association");
 		wpa_ft_install_ptk(sm);
 		/* Using FT protocol, not WPA auth state machine */
 		sm->ft_completed = 1;
 		return 0;
 #else /* CONFIG_IEEE80211R */
 		break;
 #endif /* CONFIG_IEEE80211R */
 	case WPA_DRV_STA_REMOVED:
 		sm->tk_already_set = FALSE;
 		return 0;
+	}
 #ifdef CONFIG_IEEE80211R
 	sm->ft_completed = 0;
 #endif /* CONFIG_IEEE80211R */
 #ifdef CONFIG_IEEE80211W
 	if (sm->mgmt_frame_prot && event == WPA_AUTH)
 		remove_ptk = 0;
 #endif /* CONFIG_IEEE80211W */
 	if (remove_ptk) {
 		sm->PTK_valid = FALSE;
 @@ -1888,26 +1891,41 @@ SM_STATE(WPA_PTK, AUTHENTICATION2)
 		sm->Disconnect = TRUE;
 		return;
+	}
 	wpa_hexdump(MSG_DEBUG, "WPA: Assign ANonce", sm->ANonce,
 		    WPA_NONCE_LEN);
 	/* IEEE 802.11i does not clear TimeoutCtr here, but this is more
 	 * logical place than INITIALIZE since AUTHENTICATION2 can be
 	 * re-entered on ReAuthenticationRequest without going through
 	 * INITIALIZE. */
 	sm->TimeoutCtr = 0;
+}
 static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm)
+{
 	if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
 		wpa_printf(MSG_ERROR,
 			   "WPA: Failed to get random data for ANonce");
 		sm->Disconnect = TRUE;
 		return -1;
+	}
 	wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce,
 		    WPA_NONCE_LEN);
 	sm->TimeoutCtr = 0;
 	return 0;
+}
 SM_STATE(WPA_PTK, INITPMK)
+{
 	u8 msk[2 * PMK_LEN];
 	size_t len = 2 * PMK_LEN;
 	SM_ENTRY_MA(WPA_PTK, INITPMK, wpa_ptk);
 #ifdef CONFIG_IEEE80211R
 	sm->xxkey_len = 0;
 #endif /* CONFIG_IEEE80211R */
 	if (sm->pmksa) {
 		wpa_printf(MSG_DEBUG, "WPA: PMK from PMKSA cache");
 		os_memcpy(sm->PMK, sm->pmksa->pmk, sm->pmksa->pmk_len);
 		sm->pmk_len = sm->pmksa->pmk_len;
 @@ -2445,29 +2463,32 @@ SM_STEP(WPA_PTK)
 		SM_ENTER(WPA_PTK, INITIALIZE);
 	else if (sm->Disconnect
 		 /* || FIX: dot11RSNAConfigSALifetime timeout */) {
 		wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
 				"WPA_PTK: sm->Disconnect");
 		SM_ENTER(WPA_PTK, DISCONNECT);
+	}
 	else if (sm->DeauthenticationRequest)
 		SM_ENTER(WPA_PTK, DISCONNECTED);
 	else if (sm->AuthenticationRequest)
 		SM_ENTER(WPA_PTK, AUTHENTICATION);
 	else if (sm->ReAuthenticationRequest)
 		SM_ENTER(WPA_PTK, AUTHENTICATION2);
-	else if (sm->PTKRequest)
+	else if (sm->PTKRequest) {
-		SM_ENTER(WPA_PTK, PTKSTART);
+		if (wpa_auth_sm_ptk_update(sm) < 0)
-	else switch (sm->wpa_ptk_state) {
+			SM_ENTER(WPA_PTK, DISCONNECTED);
 		else
 			SM_ENTER(WPA_PTK, PTKSTART);
 	} else switch (sm->wpa_ptk_state) {
 	case WPA_PTK_INITIALIZE:
 		break;
 	case WPA_PTK_DISCONNECT:
 		SM_ENTER(WPA_PTK, DISCONNECTED);
 		break;
 	case WPA_PTK_DISCONNECTED:
 		SM_ENTER(WPA_PTK, INITIALIZE);
 		break;
 	case WPA_PTK_AUTHENTICATION:
 		SM_ENTER(WPA_PTK, AUTHENTICATION2);
 		break;
 	case WPA_PTK_AUTHENTICATION2:
 		if (wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) &&
 @@ -3240,26 +3261,34 @@ int wpa_auth_sta_key_mgmt(struct wpa_sta
 		return -1;
 	return sm->wpa_key_mgmt;
+}
 int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm)
+{
 	if (sm == NULL)
 		return 0;
 	return sm->wpa;
+}
 int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm)
+{
 	if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt))
 		return 0;
 	return sm->tk_already_set;
+}
 int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
 			     struct rsn_pmksa_cache_entry *entry)
+{
 	if (sm == NULL || sm->pmksa != entry)
 		return -1;
 	sm->pmksa = NULL;
 	return 0;
+}
 struct rsn_pmksa_cache_entry *
 wpa_auth_sta_get_pmksa(struct wpa_state_machine *sm)
+{

 @@ -257,39 +257,40 @@ int wpa_validate_osen(struct wpa_authent
 int wpa_auth_uses_mfp(struct wpa_state_machine *sm);
 struct wpa_state_machine *
 wpa_auth_sta_init(struct wpa_authenticator *wpa_auth, const u8 *addr,
 		  const u8 *p2p_dev_addr);
 int wpa_auth_sta_associated(struct wpa_authenticator *wpa_auth,
 			    struct wpa_state_machine *sm);
 void wpa_auth_sta_no_wpa(struct wpa_state_machine *sm);
 void wpa_auth_sta_deinit(struct wpa_state_machine *sm);
 void wpa_receive(struct wpa_authenticator *wpa_auth,
 		 struct wpa_state_machine *sm,
 		 u8 *data, size_t data_len);
 enum wpa_event {
 	WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH,
-	WPA_REAUTH_EAPOL, WPA_ASSOC_FT
+	WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED
 };
 void wpa_remove_ptk(struct wpa_state_machine *sm);
 int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event);
 void wpa_auth_sm_notify(struct wpa_state_machine *sm);
 void wpa_gtk_rekey(struct wpa_authenticator *wpa_auth);
 int wpa_get_mib(struct wpa_authenticator *wpa_auth, char *buf, size_t buflen);
 int wpa_get_mib_sta(struct wpa_state_machine *sm, char *buf, size_t buflen);
 void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth);
 int wpa_auth_pairwise_set(struct wpa_state_machine *sm);
 int wpa_auth_get_pairwise(struct wpa_state_machine *sm);
 int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm);
 int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm);
 int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm);
 int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
 			     struct rsn_pmksa_cache_entry *entry);
 struct rsn_pmksa_cache_entry *
 wpa_auth_sta_get_pmksa(struct wpa_state_machine *sm);
 void wpa_auth_sta_local_mic_failure_report(struct wpa_state_machine *sm);
 const u8 * wpa_auth_get_wpa_ie(struct wpa_authenticator *wpa_auth,
 			       size_t *len);
 int wpa_auth_pmksa_add(struct wpa_state_machine *sm, const u8 *pmk,
 		       unsigned int pmk_len,
 		       int session_timeout, struct eapol_state_machine *eapol);
 int wpa_auth_pmksa_add_preauth(struct wpa_authenticator *wpa_auth,
 			       const u8 *pmk, size_t len, const u8 *sta_addr,
 			       int session_timeout,

 @@ -55,26 +55,27 @@ struct wpa_state_machine {
 	Boolean EAPOLKeyPairwise;
 	Boolean EAPOLKeyRequest;
 	Boolean MICVerified;
 	Boolean GUpdateStationKeys;
 	u8 ANonce[WPA_NONCE_LEN];
 	u8 SNonce[WPA_NONCE_LEN];
 	u8 alt_SNonce[WPA_NONCE_LEN];
 	u8 alt_replay_counter[WPA_REPLAY_COUNTER_LEN];
 	u8 PMK[PMK_LEN_MAX];
 	unsigned int pmk_len;
 	struct wpa_ptk PTK;
 	Boolean PTK_valid;
 	Boolean pairwise_set;
 	Boolean tk_already_set;
 	int keycount;
 	Boolean Pair;
 	struct wpa_key_replay_counter {
 		u8 counter[WPA_REPLAY_COUNTER_LEN];
 		Boolean valid;
 	} key_replay[RSNA_MAX_EAPOL_RETRIES],
 		prev_key_replay[RSNA_MAX_EAPOL_RETRIES];
 	Boolean PInitAKeys; /* WPA only, not in IEEE 802.11i */
 	Boolean PTKRequest; /* not in IEEE 802.11i state machine */
 	Boolean has_GTK;
 	Boolean PtkGroupInit; /* init request for PTK Group state machine */
 	u8 *last_rx_eapol_key; /* starting from IEEE 802.1X header */

 @@ -208,28 +208,40 @@ struct wpa_eapol_key_192 {
 #define WPA_TK_MAX_LEN 32
 /**
  * struct wpa_ptk - WPA Pairwise Transient Key
  * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
  */
 struct wpa_ptk {
 	u8 kck[WPA_KCK_MAX_LEN]; /* EAPOL-Key Key Confirmation Key (KCK) */
 	u8 kek[WPA_KEK_MAX_LEN]; /* EAPOL-Key Key Encryption Key (KEK) */
 	u8 tk[WPA_TK_MAX_LEN]; /* Temporal Key (TK) */
 	size_t kck_len;
 	size_t kek_len;
 	size_t tk_len;
 	int installed; /* 1 if key has already been installed to driver */
 };
 struct wpa_gtk {
 	u8 gtk[WPA_GTK_MAX_LEN];
 	size_t gtk_len;
 };
 #ifdef CONFIG_IEEE80211W
 struct wpa_igtk {
 	u8 igtk[WPA_IGTK_MAX_LEN];
 	size_t igtk_len;
 };
 #endif /* CONFIG_IEEE80211W */
 /* WPA IE version 1
  * 00-50-f2:1 (OUI:OUI type)
  * 0x01 0x00 (version; little endian)
  * (all following fields are optional:)
  * Group Suite Selector (4 octets) (default: TKIP)
  * Pairwise Suite Count (2 octets, little endian) (default: 1)
  * Pairwise Suite List (4 * n octets) (default: TKIP)
  * Authenticated Key Management Suite Count (2 octets, little endian)
  *    (default: 1)
  * Authenticated Key Management Suite List (4 * n octets)
  *    (default: unspec 802.1X)
  * WPA Capabilities (2 octets, little endian) (default: 0)

 @@ -102,26 +102,27 @@ struct wpa_tdls_peer {
 	u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
 	size_t rsnie_i_len;
 	u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
 	size_t rsnie_p_len;
 	u32 lifetime;
 	int cipher; /* Selected cipher (WPA_CIPHER_*) */
 	u8 dtoken;
 	struct tpk {
 		u8 kck[16]; /* TPK-KCK */
 		u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
 	} tpk;
 	int tpk_set;
 	int tk_set; /* TPK-TK configured to the driver */
 	int tpk_success;
 	int tpk_in_progress;
 	struct tpk_timer {
 		u8 dest[ETH_ALEN];
 		int count;      /* Retry Count */
 		int timer;      /* Timeout in milliseconds */
 		u8 action_code; /* TDLS frame type */
 		u8 dialog_token;
 		u16 status_code;
 		u32 peer_capab;
 		int buf_len;    /* length of TPK message for retransmission */
 		u8 *buf;        /* buffer for TPK message */
 @@ -182,49 +183,66 @@ static int wpa_tdls_del_key(struct wpa_s
 		return -1;
+	}
 	return 0;
+}
 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
+{
 	u8 key_len;
 	u8 rsc[6];
 	enum wpa_alg alg;
 	if (peer->tk_set) {
 		/*
 		 * This same TPK-TK has already been configured to the driver
 		 * and this new configuration attempt (likely due to an
 		 * unexpected retransmitted frame) would result in clearing
 		 * the TX/RX sequence number which can break security, so must
 		 * not allow that to happen.
 		 */
 		wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
 			   " has already been configured to the driver - do not reconfigure",
 			   MAC2STR(peer->addr));
 		return -1;
+	}
 	os_memset(rsc, 0, 6);
 	switch (peer->cipher) {
 	case WPA_CIPHER_CCMP:
 		alg = WPA_ALG_CCMP;
 		key_len = 16;
 		break;
 	case WPA_CIPHER_NONE:
 		wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
 			   "NONE - do not use pairwise keys");
 		return -1;
 	default:
 		wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
 			   sm->pairwise_cipher);
 		return -1;
+	}
 	wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
 		   MAC2STR(peer->addr));
 	if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
 			   rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
 		wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
 			   "driver");
 		return -1;
+	}
 	peer->tk_set = 1;
 	return 0;
+}
 static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
 				 u8 action_code, u8 dialog_token,
 				 u16 status_code, u32 peer_capab,
 				 int initiator, const u8 *buf, size_t len)
+{
 	return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
 				     status_code, peer_capab, initiator, buf,
 				     len);
+}
 @@ -686,27 +704,27 @@ static void wpa_tdls_peer_clear(struct w
 	peer->ht_capabilities = NULL;
 	os_free(peer->vht_capabilities);
 	peer->vht_capabilities = NULL;
 	os_free(peer->ext_capab);
 	peer->ext_capab = NULL;
 	os_free(peer->supp_channels);
 	peer->supp_channels = NULL;
 	os_free(peer->supp_oper_classes);
 	peer->supp_oper_classes = NULL;
 	peer->rsnie_i_len = peer->rsnie_p_len = 0;
 	peer->cipher = 0;
 	peer->qos_info = 0;
 	peer->wmm_capable = 0;
-	peer->tpk_set = peer->tpk_success = 0;
+	peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
 	peer->chan_switch_enabled = 0;
 	os_memset(&peer->tpk, 0, sizeof(peer->tpk));
 	os_memset(peer->inonce, 0, WPA_NONCE_LEN);
 	os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
+}
 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
+{
 	wpa_tdls_peer_clear(sm, peer);
 	wpa_tdls_peer_remove_from_list(sm, peer);
 	os_free(peer);
+}
 @@ -1149,26 +1167,27 @@ skip_rsnie:
 	pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
 	ftie = (struct wpa_tdls_ftie *) pos;
 	ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
 	ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
 	if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
 		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 			"TDLS: Failed to get random data for initiator Nonce");
 		os_free(rbuf);
 		wpa_tdls_peer_free(sm, peer);
 		return -1;
+	}
 	peer->tk_set = 0; /* A new nonce results in a new TK */
 	wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
 		    peer->inonce, WPA_NONCE_LEN);
 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
 	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
 		    (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
 	pos = (u8 *) (ftie + 1);
 #ifdef CONFIG_TDLS_TESTING
 	if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
 		wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
 			   "FTIE");
 @@ -1741,26 +1760,39 @@ static int wpa_tdls_addset_peer(struct w
 				       peer->capability,
 				       peer->supp_rates, peer->supp_rates_len,
 				       peer->ht_capabilities,
 				       peer->vht_capabilities,
 				       peer->qos_info, peer->wmm_capable,
 				       peer->ext_capab, peer->ext_capab_len,
 				       peer->supp_channels,
 				       peer->supp_channels_len,
 				       peer->supp_oper_classes,
 				       peer->supp_oper_classes_len);
+}
 static int tdls_nonce_set(const u8 *nonce)
+{
 	int i;
 	for (i = 0; i < WPA_NONCE_LEN; i++) {
 		if (nonce[i])
 			return 1;
+	}
 	return 0;
+}
 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
 				   const u8 *buf, size_t len)
+{
 	struct wpa_tdls_peer *peer;
 	struct wpa_eapol_ie_parse kde;
 	struct wpa_ie_data ie;
 	int cipher;
 	const u8 *cpos;
 	struct wpa_tdls_ftie *ftie = NULL;
 	struct wpa_tdls_timeoutie *timeoutie;
 	struct wpa_tdls_lnkid *lnkid;
 	u32 lifetime = 0;
 #if 0
 @@ -1994,42 +2026,44 @@ skip_rsn:
 	if (!wpa_tdls_get_privacy(sm)) {
 		peer->rsnie_i_len = 0;
 		peer->rsnie_p_len = 0;
 		peer->cipher = WPA_CIPHER_NONE;
 		goto skip_rsn_check;
+	}
 	ftie = (struct wpa_tdls_ftie *) kde.ftie;
 	os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
 	peer->rsnie_i_len = kde.rsn_ie_len;
 	peer->cipher = cipher;
-	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
+	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
 	    !tdls_nonce_set(peer->inonce)) {
 		/*
 		 * There is no point in updating the RNonce for every obtained
 		 * TPK M1 frame (e.g., retransmission due to timeout) with the
 		 * same INonce (SNonce in FTIE). However, if the TPK M1 is
 		 * retransmitted with a different INonce, update the RNonce
 		 * since this is for a new TDLS session.
 		 */
 		wpa_printf(MSG_DEBUG,
 			   "TDLS: New TPK M1 INonce - generate new RNonce");
 		os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
 		if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
 			wpa_msg(sm->ctx->ctx, MSG_WARNING,
 				"TDLS: Failed to get random data for responder nonce");
 			goto error;
+		}
 		peer->tk_set = 0; /* A new nonce results in a new TK */
+	}
 #if 0
 	/* get version info from RSNIE received from Peer */
 	hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
 	rsn_ver = WPA_GET_LE16(hdr->version);
 	/* use min(peer's version, out version) */
 	if (rsn_ver > RSN_VERSION)
 		rsn_ver = RSN_VERSION;
 	hdr = (struct rsn_ie_hdr *) peer->rsnie_p;

 @@ -500,27 +500,26 @@ static void wpa_supplicant_process_1_of_
 	/* Calculate PTK which will be stored as a temporary PTK until it has
 	 * been verified when processing message 3/4. */
 	ptk = &sm->tptk;
 	wpa_derive_ptk(sm, src_addr, key, ptk);
 	if (sm->pairwise_cipher == WPA_CIPHER_TKIP) {
 		u8 buf[8];
 		/* Supplicant: swap tx/rx Mic keys */
 		os_memcpy(buf, &ptk->tk[16], 8);
 		os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);
 		os_memcpy(&ptk->tk[24], buf, 8);
 		os_memset(buf, 0, sizeof(buf));
+	}
 	sm->tptk_set = 1;
 	sm->tk_to_set = 1;
 	kde = sm->assoc_wpa_ie;
 	kde_len = sm->assoc_wpa_ie_len;
 #ifdef CONFIG_P2P
 	if (sm->p2p) {
 		kde_buf = os_malloc(kde_len + 2 + RSN_SELECTOR_LEN + 1);
 		if (kde_buf) {
 			u8 *pos;
 			wpa_printf(MSG_DEBUG, "P2P: Add IP Address Request KDE "
 				   "into EAPOL-Key 2/4");
 			os_memcpy(kde_buf, kde, kde_len);
 			kde = kde_buf;
 @@ -605,27 +604,27 @@ static void wpa_sm_rekey_ptk(void *eloop
 	struct wpa_sm *sm = eloop_ctx;
 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Request PTK rekeying");
 	wpa_sm_key_request(sm, 0, 1);
+}
 static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
 				      const struct wpa_eapol_key *key)
+{
 	int keylen, rsclen;
 	enum wpa_alg alg;
 	const u8 *key_rsc;
-	if (!sm->tk_to_set) {
+	if (sm->ptk.installed) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"WPA: Do not re-install same PTK to the driver");
 		return 0;
+	}
 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 		"WPA: Installing PTK to the driver");
 	if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Pairwise Cipher "
 			"Suite: NONE - do not use pairwise keys");
 		return 0;
+	}
 @@ -649,27 +648,27 @@ static int wpa_supplicant_install_ptk(st
+	}
 	if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, key_rsc, rsclen,
 			   sm->ptk.tk, keylen) < 0) {
 		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 			"WPA: Failed to set PTK to the "
 			"driver (alg=%d keylen=%d bssid=" MACSTR ")",
 			alg, keylen, MAC2STR(sm->bssid));
 		return -1;
+	}
 	/* TK is not needed anymore in supplicant */
 	os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
-	sm->tk_to_set = 0;
+	sm->ptk.installed = 1;
 	if (sm->wpa_ptk_rekey) {
 		eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
 		eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
 				       sm, NULL);
+	}
 	return 0;
+}
 static int wpa_supplicant_check_group_cipher(struct wpa_sm *sm,
 					     int group_cipher,
 @@ -699,31 +698,43 @@ static int wpa_supplicant_check_group_ci
+}
 struct wpa_gtk_data {
 	enum wpa_alg alg;
 	int tx, key_rsc_len, keyidx;
 	u8 gtk[32];
 	int gtk_len;
 };
 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
 				      const struct wpa_gtk_data *gd,
-				      const u8 *key_rsc)
+				      const u8 *key_rsc, int wnm_sleep)
+{
 	const u8 *_gtk = gd->gtk;
 	u8 gtk_buf[32];
 	/* Detect possible key reinstallation */
 	if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
 	     os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
 	    (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
 	     os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
 		       sm->gtk_wnm_sleep.gtk_len) == 0)) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
 			gd->keyidx, gd->tx, gd->gtk_len);
 		return 0;
+	}
 	wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 		"WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
 		gd->keyidx, gd->tx, gd->gtk_len);
 	wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
 	if (sm->group_cipher == WPA_CIPHER_TKIP) {
 		/* Swap Tx/Rx keys for Michael MIC */
 		os_memcpy(gtk_buf, gd->gtk, 16);
 		os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
 		os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
 		_gtk = gtk_buf;
+	}
 	if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
 @@ -738,26 +749,35 @@ static int wpa_supplicant_install_gtk(st
+		}
 	} else if (wpa_sm_set_key(sm, gd->alg, broadcast_ether_addr,
 				  gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
 				  _gtk, gd->gtk_len) < 0) {
 		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 			"WPA: Failed to set GTK to "
 			"the driver (alg=%d keylen=%d keyidx=%d)",
 			gd->alg, gd->gtk_len, gd->keyidx);
 		os_memset(gtk_buf, 0, sizeof(gtk_buf));
 		return -1;
+	}
 	os_memset(gtk_buf, 0, sizeof(gtk_buf));
 	if (wnm_sleep) {
 		sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
 		os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
 			  sm->gtk_wnm_sleep.gtk_len);
 	} else {
 		sm->gtk.gtk_len = gd->gtk_len;
 		os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
+	}
 	return 0;
+}
 static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
 						int tx)
+{
 	if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
 		/* Ignore Tx bit for GTK if a pairwise key is used. One AP
 		 * seemed to set this bit (incorrectly, since Tx is only when
 		 * doing Group Key only APs) and without this workaround, the
 		 * data connection does not work because wpa_supplicant
 		 * configured non-zero keyidx to be used for unicast. */
 @@ -830,74 +850,110 @@ static int wpa_supplicant_pairwise_gtk(s
 	gtk_len -= 2;
 	os_memcpy(gd.gtk, gtk, gtk_len);
 	gd.gtk_len = gtk_len;
 	key_rsc = key->key_rsc;
 	if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
 		key_rsc = null_rsc;
 	if (sm->group_cipher != WPA_CIPHER_GTK_NOT_USED &&
 	    (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
 					       gtk_len, gtk_len,
 					       &gd.key_rsc_len, &gd.alg) ||
-	     wpa_supplicant_install_gtk(sm, &gd, key_rsc))) {
+	     wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"RSN: Failed to install GTK");
 		os_memset(&gd, 0, sizeof(gd));
 		return -1;
+	}
 	os_memset(&gd, 0, sizeof(gd));
 	wpa_supplicant_key_neg_complete(sm, sm->bssid,
 					key_info & WPA_KEY_INFO_SECURE);
 	return 0;
+}
 #ifdef CONFIG_IEEE80211W
 static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
 				       const struct wpa_igtk_kde *igtk,
 				       int wnm_sleep)
+{
 	size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
 	u16 keyidx = WPA_GET_LE16(igtk->keyid);
 	/* Detect possible key reinstallation */
 	if ((sm->igtk.igtk_len == len &&
 	     os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
 	    (sm->igtk_wnm_sleep.igtk_len == len &&
 	     os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
 		       sm->igtk_wnm_sleep.igtk_len) == 0)) {
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 			"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
 			keyidx);
 		return  0;
+	}
 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 		"WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x",
 		keyidx, MAC2STR(igtk->pn));
 	wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
 	if (keyidx > 4095) {
 		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 			"WPA: Invalid IGTK KeyID %d", keyidx);
 		return -1;
+	}
 	if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
 			   broadcast_ether_addr,
 			   keyidx, 0, igtk->pn, sizeof(igtk->pn),
 			   igtk->igtk, len) < 0) {
 		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 			"WPA: Failed to configure IGTK to the driver");
 		return -1;
+	}
 	if (wnm_sleep) {
 		sm->igtk_wnm_sleep.igtk_len = len;
 		os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
 			  sm->igtk_wnm_sleep.igtk_len);
 	} else {
 		sm->igtk.igtk_len = len;
 		os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
+	}
 	return 0;
+}
 #endif /* CONFIG_IEEE80211W */
 static int ieee80211w_set_keys(struct wpa_sm *sm,
 			       struct wpa_eapol_ie_parse *ie)
+{
 #ifdef CONFIG_IEEE80211W
 	if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher))
 		return 0;
 	if (ie->igtk) {
 		size_t len;
 		const struct wpa_igtk_kde *igtk;
 		u16 keyidx;
 		len = wpa_cipher_key_len(sm->mgmt_group_cipher);
 		if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
 			return -1;
 		igtk = (const struct wpa_igtk_kde *) ie->igtk;
-		keyidx = WPA_GET_LE16(igtk->keyid);
+		if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d "
 			"pn %02x%02x%02x%02x%02x%02x",
 			keyidx, MAC2STR(igtk->pn));
 		wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK",
 				igtk->igtk, len);
 		if (keyidx > 4095) {
 			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 				"WPA: Invalid IGTK KeyID %d", keyidx);
 			return -1;
 		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
 				   broadcast_ether_addr,
 				   keyidx, 0, igtk->pn, sizeof(igtk->pn),
 				   igtk->igtk, len) < 0) {
 			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 				"WPA: Failed to configure IGTK to the driver");
 			return -1;
+	}
 	return 0;
 #else /* CONFIG_IEEE80211W */
 	return 0;
 #endif /* CONFIG_IEEE80211W */
+}
 static void wpa_report_ie_mismatch(struct wpa_sm *sm,
 				   const char *reason, const u8 *src_addr,
 				   const u8 *wpa_ie, size_t wpa_ie_len,
 				   const u8 *rsn_ie, size_t rsn_ie_len)
 @@ -1526,27 +1582,27 @@ static void wpa_supplicant_process_1_of_
 							key_data_len,
 							key_info, ver, &gd);
+	}
 	wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
 	if (ret)
 		goto failed;
 	key_rsc = key->key_rsc;
 	if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
 		key_rsc = null_rsc;
-	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) ||
+	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
 	    wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
 		goto failed;
 	os_memset(&gd, 0, sizeof(gd));
 	if (rekey) {
 		wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Group rekeying "
 			"completed with " MACSTR " [GTK=%s]",
 			MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
 		wpa_sm_cancel_auth_timeout(sm);
 		wpa_sm_set_state(sm, WPA_COMPLETED);
 	} else {
 		wpa_supplicant_key_neg_complete(sm, sm->bssid,
 						key_info &
 @@ -2297,66 +2353,72 @@ void wpa_sm_deinit(struct wpa_sm *sm)
+}
 /**
  * wpa_sm_notify_assoc - Notify WPA state machine about association
  * @sm: Pointer to WPA state machine data from wpa_sm_init()
  * @bssid: The BSSID of the new association
+ *
  * This function is called to let WPA state machine know that the connection
  * was established.
  */
 void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
+{
-	int clear_ptk = 1;
+	int clear_keys = 1;
 	if (sm == NULL)
 		return;
 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 		"WPA: Association event - clear replay counter");
 	os_memcpy(sm->bssid, bssid, ETH_ALEN);
 	os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
 	sm->rx_replay_counter_set = 0;
 	sm->renew_snonce = 1;
 	if (os_memcmp(sm->preauth_bssid, bssid, ETH_ALEN) == 0)
 		rsn_preauth_deinit(sm);
 #ifdef CONFIG_IEEE80211R
 	if (wpa_ft_is_completed(sm)) {
 		/*
 		 * Clear portValid to kick EAPOL state machine to re-enter
 		 * AUTHENTICATED state to get the EAPOL port Authorized.
 		 */
 		eapol_sm_notify_portValid(sm->eapol, FALSE);
 		wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
 		/* Prepare for the next transition */
 		wpa_ft_prepare_auth_request(sm, NULL);
-		clear_ptk = 0;
+		clear_keys = 0;
+	}
 #endif /* CONFIG_IEEE80211R */
-	if (clear_ptk) {
+	if (clear_keys) {
 		/*
 		 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
 		 * this is not part of a Fast BSS Transition.
 		 */
 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PTK");
 		sm->ptk_set = 0;
 		os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 		sm->tptk_set = 0;
 		os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 		os_memset(&sm->gtk, 0, sizeof(sm->gtk));
 		os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
 #ifdef CONFIG_IEEE80211W
 		os_memset(&sm->igtk, 0, sizeof(sm->igtk));
 		os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
 #endif /* CONFIG_IEEE80211W */
+	}
 #ifdef CONFIG_TDLS
 	wpa_tdls_assoc(sm);
 #endif /* CONFIG_TDLS */
 #ifdef CONFIG_P2P
 	os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
 #endif /* CONFIG_P2P */
+}
 /**
 @@ -2368,26 +2430,29 @@ void wpa_sm_notify_assoc(struct wpa_sm *
  */
 void wpa_sm_notify_disassoc(struct wpa_sm *sm)
+{
 	eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
 	eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
 	peerkey_deinit(sm);
 	rsn_preauth_deinit(sm);
 	pmksa_cache_clear_current(sm);
 	if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
 		sm->dot11RSNA4WayHandshakeFailures++;
 #ifdef CONFIG_TDLS
 	wpa_tdls_disassoc(sm);
 #endif /* CONFIG_TDLS */
 #ifdef CONFIG_IEEE80211R
 	sm->ft_reassoc_completed = 0;
 #endif /* CONFIG_IEEE80211R */
 	/* Keys are not needed in the WPA state machine anymore */
 	wpa_sm_drop_sa(sm);
 	sm->msg_3_of_4_ok = 0;
+}
 /**
  * wpa_sm_set_pmk - Set PMK
  * @sm: Pointer to WPA state machine data from wpa_sm_init()
  * @pmk: The new PMK
  * @pmk_len: The length of the new PMK in bytes
 @@ -2867,26 +2932,32 @@ int wpa_sm_pmksa_cache_list(struct wpa_s
+{
 	return pmksa_cache_list(sm->pmksa, buf, len);
+}
 void wpa_sm_drop_sa(struct wpa_sm *sm)
+{
 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PMK and PTK");
 	sm->ptk_set = 0;
 	sm->tptk_set = 0;
 	os_memset(sm->pmk, 0, sizeof(sm->pmk));
 	os_memset(&sm->ptk, 0, sizeof(sm->ptk));
 	os_memset(&sm->tptk, 0, sizeof(sm->tptk));
 	os_memset(&sm->gtk, 0, sizeof(sm->gtk));
 	os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
 #ifdef CONFIG_IEEE80211W
 	os_memset(&sm->igtk, 0, sizeof(sm->igtk));
 	os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
 #endif /* CONFIG_IEEE80211W */
 #ifdef CONFIG_IEEE80211R
 	os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
 	os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
 	os_memset(sm->pmk_r1, 0, sizeof(sm->pmk_r1));
 #endif /* CONFIG_IEEE80211R */
+}
 int wpa_sm_has_ptk(struct wpa_sm *sm)
+{
 	if (sm == NULL)
 		return 0;
 	return sm->ptk_set;
 @@ -2930,58 +3001,40 @@ int wpa_wnmsleep_install_key(struct wpa_
 		if (gd.gtk_len != buf[4]) {
 			wpa_printf(MSG_DEBUG, "GTK len mismatch len %d vs %d",
 				   gd.gtk_len, buf[4]);
 			return -1;
+		}
 		gd.keyidx = keyinfo & 0x03; /* B0 - B1 */
 		gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
 		         sm, !!(keyinfo & WPA_KEY_INFO_TXRX));
 		os_memcpy(gd.gtk, buf + 13, gd.gtk_len);
 		wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
 				gd.gtk, gd.gtk_len);
-		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
+		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
 			os_memset(&gd, 0, sizeof(gd));
 			wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
 				   "WNM mode");
 			return -1;
+		}
 		os_memset(&gd, 0, sizeof(gd));
 #ifdef CONFIG_IEEE80211W
 	} else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
-		struct wpa_igtk_kde igd;
+		const struct wpa_igtk_kde *igtk;
 		u16 keyidx;
-		os_memset(&igd, 0, sizeof(igd));
+		igtk = (const struct wpa_igtk_kde *) (buf + 2);
-		keylen = wpa_cipher_key_len(sm->mgmt_group_cipher);
+		if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
 		os_memcpy(igd.keyid, buf + 2, 2);
 		os_memcpy(igd.pn, buf + 4, 6);
 		keyidx = WPA_GET_LE16(igd.keyid);
 		os_memcpy(igd.igtk, buf + 10, keylen);
 		wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)",
 				igd.igtk, keylen);
 		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
 				   broadcast_ether_addr,
 				   keyidx, 0, igd.pn, sizeof(igd.pn),
 				   igd.igtk, keylen) < 0) {
 			wpa_printf(MSG_DEBUG, "Failed to install the IGTK in "
 				   "WNM mode");
 			os_memset(&igd, 0, sizeof(igd));
 			return -1;
 		os_memset(&igd, 0, sizeof(igd));
 #endif /* CONFIG_IEEE80211W */
 	} else {
 		wpa_printf(MSG_DEBUG, "Unknown element id");
 		return -1;
+	}
 	return 0;
+}
 #endif /* CONFIG_WNM */
 #ifdef CONFIG_PEERKEY
 int wpa_sm_rx_eapol_peerkey(struct wpa_sm *sm, const u8 *src_addr,

 @@ -143,26 +143,27 @@ static u8 * wpa_ft_gen_req_ies(struct wp
 			       const u8 *kck, size_t kck_len,
 			       const u8 *target_ap,
 			       const u8 *ric_ies, size_t ric_ies_len,
 			       const u8 *ap_mdie)
+{
 	size_t buf_len;
 	u8 *buf, *pos, *ftie_len, *ftie_pos;
 	struct rsn_mdie *mdie;
 	struct rsn_ftie *ftie;
 	struct rsn_ie_hdr *rsnie;
 	u16 capab;
 	sm->ft_completed = 0;
 	sm->ft_reassoc_completed = 0;
 	buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
 + sm->r0kh_id_len + ric_ies_len + 100;
 	buf = os_zalloc(buf_len);
 	if (buf == NULL)
 		return NULL;
 	pos = buf;
 	/* RSNIE[PMKR0Name/PMKR1Name] */
 	rsnie = (struct rsn_ie_hdr *) pos;
 	rsnie->elem_id = WLAN_EID_RSN;
 	WPA_PUT_LE16(rsnie->version, RSN_VERSION);
 	pos = (u8 *) (rsnie + 1);
 @@ -671,26 +672,31 @@ int wpa_ft_validate_reassoc_resp(struct
 	struct rsn_mdie *mdie;
 	struct rsn_ftie *ftie;
 	unsigned int count;
 	u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
 	wpa_hexdump(MSG_DEBUG, "FT: Response IEs", ies, ies_len);
 	if (!wpa_key_mgmt_ft(sm->key_mgmt)) {
 		wpa_printf(MSG_DEBUG, "FT: Reject FT IEs since FT is not "
 			   "enabled for this connection");
 		return -1;
+	}
 	if (sm->ft_reassoc_completed) {
 		wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission");
 		return 0;
+	}
 	if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) {
 		wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs");
 		return -1;
+	}
 	mdie = (struct rsn_mdie *) parse.mdie;
 	if (mdie == NULL || parse.mdie_len < sizeof(*mdie) ||
 	    os_memcmp(mdie->mobility_domain, sm->mobility_domain,
 		      MOBILITY_DOMAIN_ID_LEN) != 0) {
 		wpa_printf(MSG_DEBUG, "FT: Invalid MDIE");
 		return -1;
+	}
 @@ -771,26 +777,28 @@ int wpa_ft_validate_reassoc_resp(struct
 		       parse.ric, parse.ric_len,
 		       mic) < 0) {
 		wpa_printf(MSG_DEBUG, "FT: Failed to calculate MIC");
 		return -1;
+	}
 	if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
 		wpa_printf(MSG_DEBUG, "FT: Invalid MIC in FTIE");
 		wpa_hexdump(MSG_MSGDUMP, "FT: Received MIC", ftie->mic, 16);
 		wpa_hexdump(MSG_MSGDUMP, "FT: Calculated MIC", mic, 16);
 		return -1;
+	}
 	sm->ft_reassoc_completed = 1;
 	if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0)
 		return -1;
 #ifdef CONFIG_IEEE80211W
 	if (wpa_ft_process_igtk_subelem(sm, parse.igtk, parse.igtk_len) < 0)
 		return -1;
 #endif /* CONFIG_IEEE80211W */
 	if (sm->set_ptk_after_assoc) {
 		wpa_printf(MSG_DEBUG, "FT: Try to set PTK again now that we "
 			   "are associated");
 		if (wpa_ft_install_ptk(sm, src_addr) < 0)
 			return -1;

 @@ -14,33 +14,38 @@
 struct wpa_peerkey;
 struct wpa_tdls_peer;
 struct wpa_eapol_key;
 /**
  * struct wpa_sm - Internal WPA state machine data
  */
 struct wpa_sm {
 	u8 pmk[PMK_LEN_MAX];
 	size_t pmk_len;
 	struct wpa_ptk ptk, tptk;
 	int ptk_set, tptk_set;
 	unsigned int msg_3_of_4_ok:1;
 	unsigned int tk_to_set:1;
 	u8 snonce[WPA_NONCE_LEN];
 	u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
 	int renew_snonce;
 	u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
 	int rx_replay_counter_set;
 	u8 request_counter[WPA_REPLAY_COUNTER_LEN];
 	struct wpa_gtk gtk;
 	struct wpa_gtk gtk_wnm_sleep;
 #ifdef CONFIG_IEEE80211W
 	struct wpa_igtk igtk;
 	struct wpa_igtk igtk_wnm_sleep;
 #endif /* CONFIG_IEEE80211W */
 	struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
 	struct rsn_pmksa_cache *pmksa; /* PMKSA cache */
 	struct rsn_pmksa_cache_entry *cur_pmksa; /* current PMKSA entry */
 	struct dl_list pmksa_candidates;
 	struct l2_packet_data *l2_preauth;
 	struct l2_packet_data *l2_preauth_br;
 	struct l2_packet_data *l2_tdls;
 	u8 preauth_bssid[ETH_ALEN]; /* current RSN pre-auth peer or
 				     * 00:00:00:00:00:00 if no pre-auth is
 				     * in progress */
 @@ -113,26 +118,27 @@ struct wpa_sm {
 #ifdef CONFIG_IEEE80211R
 	u8 xxkey[PMK_LEN]; /* PSK or the second 256 bits of MSK */
 	size_t xxkey_len;
 	u8 pmk_r0[PMK_LEN];
 	u8 pmk_r0_name[WPA_PMK_NAME_LEN];
 	u8 pmk_r1[PMK_LEN];
 	u8 pmk_r1_name[WPA_PMK_NAME_LEN];
 	u8 mobility_domain[MOBILITY_DOMAIN_ID_LEN];
 	u8 r0kh_id[FT_R0KH_ID_MAX_LEN];
 	size_t r0kh_id_len;
 	u8 r1kh_id[FT_R1KH_ID_LEN];
 	int ft_completed;
 	int ft_reassoc_completed;
 	int over_the_ds_in_progress;
 	u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */
 	int set_ptk_after_assoc;
 	u8 mdie_ft_capab; /* FT Capability and Policy from target AP MDIE */
 	u8 *assoc_resp_ies; /* MDIE and FTIE from (Re)Association Response */
 	size_t assoc_resp_ies_len;
 #endif /* CONFIG_IEEE80211R */
 #ifdef CONFIG_P2P
 	u8 p2p_ip_addr[3 * 4];
 #endif /* CONFIG_P2P */
 #ifdef CONFIG_TESTING_OPTIONS

 @@ -250,27 +250,27 @@ static void ieee802_11_rx_wnmsleep_resp(
 	 * Action [1] | Dialog Token [1] | Key Data Len [2] | Key Data |
 	 * WNM-Sleep Mode IE | TFS Response IE
 	 */
 	const u8 *pos = frm; /* point to payload after the action field */
 	u16 key_len_total;
 	struct wnm_sleep_element *wnmsleep_ie = NULL;
 	/* multiple TFS Resp IE (assuming consecutive) */
 	const u8 *tfsresp_ie_start = NULL;
 	const u8 *tfsresp_ie_end = NULL;
 	size_t left;
 	if (!wpa_s->wnmsleep_used) {
 		wpa_printf(MSG_DEBUG,
-			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
+			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
 		return;
+	}
 	if (len < 3)
 		return;
 	key_len_total = WPA_GET_LE16(frm + 1);
 	wpa_printf(MSG_DEBUG, "WNM-Sleep Mode Response token=%u key_len_total=%d",
 		   frm[0], key_len_total);
 	left = len - 3;
 	if (key_len_total > left) {
 		wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field");
 		return;
 @@ -289,26 +289,28 @@ static void ieee802_11_rx_wnmsleep_resp(
 			if (!tfsresp_ie_start)
 				tfsresp_ie_start = pos;
 			tfsresp_ie_end = pos;
 		} else
 			wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos);
 		pos += ie_len + 2;
+	}
 	if (!wnmsleep_ie) {
 		wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found");
 		return;
+	}
 	wpa_s->wnmsleep_used = 0;
 	if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
 	    wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
 		wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
 			   "frame (action=%d, intval=%d)",
 			   wnmsleep_ie->action_type, wnmsleep_ie->intval);
 		if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) {
 			wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start,
 						     tfsresp_ie_end);
 		} else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) {
 			wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total);
+		}
 	} else {
 		wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame "