diff --git a/hostapd/Android.mk b/hostapd/Android.mk
index 888ee2b..b96345f 100644
--- a/hostapd/Android.mk
+++ b/hostapd/Android.mk
@@ -539,7 +539,8 @@
 OBJS += src/crypto/crypto_gnutls.c
 HOBJS += src/crypto/crypto_gnutls.c
 ifdef NEED_FIPS186_2_PRF
-OBJS += src/crypto/fips_prf_gnutls.c
+OBJS += src/crypto/fips_prf_internal.c
+OBJS += src/crypto/sha1-internal.c
 endif
 LIBS += -lgcrypt
 LIBS_h += -lgcrypt
@@ -566,7 +567,8 @@
 endif
 OBJS += src/crypto/crypto_nss.c
 ifdef NEED_FIPS186_2_PRF
-OBJS += src/crypto/fips_prf_nss.c
+OBJS += src/crypto/fips_prf_internal.c
+OBJS += src/crypto/sha1-internal.c
 endif
 LIBS += -lnss3
 LIBS_h += -lnss3
diff --git a/hostapd/Makefile b/hostapd/Makefile
index c541d43..1496888 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -522,7 +522,8 @@
 OBJS += ../src/crypto/crypto_gnutls.o
 HOBJS += ../src/crypto/crypto_gnutls.o
 ifdef NEED_FIPS186_2_PRF
-OBJS += ../src/crypto/fips_prf_gnutls.o
+OBJS += ../src/crypto/fips_prf_internal.o
+SHA1OBJS += ../src/crypto/sha1-internal.o
 endif
 LIBS += -lgcrypt
 LIBS_h += -lgcrypt
@@ -549,7 +550,8 @@
 endif
 OBJS += ../src/crypto/crypto_nss.o
 ifdef NEED_FIPS186_2_PRF
-OBJS += ../src/crypto/fips_prf_nss.o
+OBJS += ../src/crypto/fips_prf_internal.o
+SHA1OBJS += ../src/crypto/sha1-internal.o
 endif
 LIBS += -lnss3
 LIBS_h += -lnss3
diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 949a9d1..b6f1d1b 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -257,6 +257,7 @@
 			if (attr == NULL) {
 				wpa_printf(MSG_ERROR, "Invalid radius_auth_req_attr: %s",
 					   buf + 19);
+				user = NULL; /* already in the BSS list */
 				goto failed;
 			}
 			if (user->accept_attr == NULL) {
@@ -2485,6 +2486,13 @@
 				conf->channel = 0;
 			} else
 				conf->channel = atoi(pos);
+		} else if (os_strcmp(buf, "chanlist") == 0) {
+			if (hostapd_parse_intlist(&conf->chanlist, pos)) {
+				wpa_printf(MSG_ERROR,
+					   "Line %d: invalid channel list",
+					   line);
+				errors++;
+			}
 		} else if (os_strcmp(buf, "beacon_int") == 0) {
 			int val = atoi(pos);
 			/* MIB defines range as 1..65535, but very small values
diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index c745fe8..81ddabc 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -154,6 +154,14 @@
 # Defaults:
 #acs_num_scans=5
 
+# Channel list restriction. This option allows hostapd to select one of the
+# provided channels when a channel should be automatically selected. This
+# is currently only used for DFS when the current channels becomes unavailable
+# due to radar interference, and is currently only useful when ieee80211h=1 is
+# set.
+# Default: not set (allow any enabled channel to be selected)
+#chanlist=100 104 108 112 116
+
 # Beacon interval in kus (1.024 ms) (default: 100; range 15..65535)
 beacon_int=100
 
@@ -1540,6 +1548,8 @@
 #	    accordance with IETF RFC 4282
 # NAI Realm(s): Semi-colon delimited NAI Realm(s)
 # EAP Method: <EAP Method>[:<[AuthParam1:Val1]>][<[AuthParam2:Val2]>][...]
+# EAP Method types, see:
+# http://www.iana.org/assignments/eap-numbers/eap-numbers.xhtml#eap-numbers-4
 # AuthParam (Table 8-188 in IEEE Std 802.11-2012):
 # ID 2 = Non-EAP Inner Authentication Type
 #	1 = PAP, 2 = CHAP, 3 = MSCHAP, 4 = MSCHAPV2