diff --git a/hostapd/Android.mk b/hostapd/Android.mk
index dff5704..3bde8d5 100644
--- a/hostapd/Android.mk
+++ b/hostapd/Android.mk
@@ -263,6 +263,7 @@
 OBJS += src/common/sae.c
 NEED_ECC=y
 NEED_DH_GROUPS=y
+NEED_HMAC_SHA256_KDF=y
 NEED_DRAGONFLY=y
 endif
 
@@ -328,6 +329,10 @@
 L_CFLAGS += -DCONFIG_WEP
 endif
 
+ifdef CONFIG_NO_TKIP
+L_CFLAGS += -DCONFIG_NO_TKIP
+endif
+
 
 include $(LOCAL_PATH)/src/drivers/drivers.mk
 
diff --git a/hostapd/Makefile b/hostapd/Makefile
index 4adf996..9c7fc5c 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -296,6 +296,7 @@
 OBJS += ../src/common/sae.o
 NEED_ECC=y
 NEED_DH_GROUPS=y
+NEED_HMAC_SHA256_KDF=y
 NEED_AP_MLME=y
 NEED_DRAGONFLY=y
 endif
@@ -1246,6 +1247,10 @@
 CFLAGS += -DCONFIG_WEP
 endif
 
+ifdef CONFIG_NO_TKIP
+CFLAGS += -DCONFIG_NO_TKIP
+endif
+
 ALL=hostapd hostapd_cli
 
 all: verify_config $(ALL)
diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 1d8c039..cc1855d 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -4215,6 +4215,8 @@
 		bss->no_beacon_rsnxe = atoi(pos);
 	} else if (os_strcmp(buf, "skip_prune_assoc") == 0) {
 		bss->skip_prune_assoc = atoi(pos);
+	} else if (os_strcmp(buf, "ft_rsnxe_used") == 0) {
+		bss->ft_rsnxe_used = atoi(pos);
 #endif /* CONFIG_TESTING_OPTIONS */
 #ifdef CONFIG_SAE
 	} else if (os_strcmp(buf, "sae_password") == 0) {
diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
index d90b5dc..6e8352f 100644
--- a/hostapd/ctrl_iface.c
+++ b/hostapd/ctrl_iface.c
@@ -1477,6 +1477,12 @@
 			if (hapd->started)
 				hostapd_setup_sae_pt(hapd->conf);
 		}
+
+#ifdef CONFIG_TESTING_OPTIONS
+		if (os_strcmp(cmd, "ft_rsnxe_used") == 0)
+			wpa_auth_set_ft_rsnxe_used(hapd->wpa_auth,
+						   hapd->conf->ft_rsnxe_used);
+#endif /* CONFIG_TESTING_OPTIONS */
 	}
 
 	return ret;
@@ -2433,6 +2439,7 @@
 #endif /* CONFIG_TESTING_OPTIONS */
 
 
+#ifdef NEED_AP_MLME
 static int hostapd_ctrl_check_freq_params(struct hostapd_freq_params *params)
 {
 	switch (params->bandwidth) {
@@ -2521,6 +2528,7 @@
 
 	return 0;
 }
+#endif /* NEED_AP_MLME */
 
 
 static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
@@ -3099,6 +3107,34 @@
 }
 
 
+static int hostapd_ctrl_driver_flags2(struct hostapd_iface *iface, char *buf,
+				      size_t buflen)
+{
+	int ret, i;
+	char *pos, *end;
+
+	ret = os_snprintf(buf, buflen, "%016llX:\n",
+			  (long long unsigned) iface->drv_flags2);
+	if (os_snprintf_error(buflen, ret))
+		return -1;
+
+	pos = buf + ret;
+	end = buf + buflen;
+
+	for (i = 0; i < 64; i++) {
+		if (iface->drv_flags2 & (1LLU << i)) {
+			ret = os_snprintf(pos, end - pos, "%s\n",
+					  driver_flag2_to_string(1LLU << i));
+			if (os_snprintf_error(end - pos, ret))
+				return -1;
+			pos += ret;
+		}
+	}
+
+	return pos - buf;
+}
+
+
 static int hostapd_ctrl_iface_acl_del_mac(struct mac_acl_entry **acl, int *num,
 					  const char *txtaddr)
 {
@@ -3511,6 +3547,9 @@
 	} else if (os_strcmp(buf, "DRIVER_FLAGS") == 0) {
 		reply_len = hostapd_ctrl_driver_flags(hapd->iface, reply,
 						      reply_size);
+	} else if (os_strcmp(buf, "DRIVER_FLAGS2") == 0) {
+		reply_len = hostapd_ctrl_driver_flags2(hapd->iface, reply,
+						       reply_size);
 	} else if (os_strcmp(buf, "TERMINATE") == 0) {
 		eloop_terminate();
 	} else if (os_strncmp(buf, "ACCEPT_ACL ", 11) == 0) {
diff --git a/hostapd/defconfig b/hostapd/defconfig
index f630a22..2341765 100644
--- a/hostapd/defconfig
+++ b/hostapd/defconfig
@@ -393,3 +393,10 @@
 # release under this optional build parameter. This functionality is subject to
 # be completely removed in a future release.
 #CONFIG_WEP=y
+
+# Remove all TKIP functionality
+# TKIP is an old cryptographic data confidentiality algorithm that is not
+# considered secure. It should not be used anymore. For now, the default hostapd
+# build includes this to allow mixed mode WPA+WPA2 networks to be enabled, but
+# that functionality is subject to be removed in the future.
+#CONFIG_NO_TKIP=y
diff --git a/hostapd/main.c b/hostapd/main.c
index 85c1fd1..3ce8126 100644
--- a/hostapd/main.c
+++ b/hostapd/main.c
@@ -220,6 +220,7 @@
 		struct wowlan_triggers *triggs;
 
 		iface->drv_flags = capa.flags;
+		iface->drv_flags2 = capa.flags2;
 		iface->probe_resp_offloads = capa.probe_resp_offloads;
 		/*
 		 * Use default extended capa values from per-radio information