diff --git a/openwrt_patches-21.02/408-2102-hostapd-Add-hostapd-patches-for-WiFi-certification-MBO-test.patch b/openwrt_patches-21.02/408-2102-hostapd-Add-hostapd-patches-for-WiFi-certification-MBO-test.patch
new file mode 100644
index 0000000..d27bbb5
--- /dev/null
+++ b/openwrt_patches-21.02/408-2102-hostapd-Add-hostapd-patches-for-WiFi-certification-MBO-test.patch
@@ -0,0 +1,610 @@
+From 44c75ac86f456f7c10367a11303426903fa27e58 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Dec 2021 14:45:19 +0800
+Subject: [PATCH] Add hostapd patches for WiFi certification MBO test plan
+
+---
+ ...hbor_count-and-hostapd_neighbor_inse.patch | 77 +++++++++++++++
+ ...g-neighbor-report-elements-in-ANQP-r.patch | 94 +++++++++++++++++++
+ ...g-neignbor-report-elements-in-BTM-re.patch | 68 ++++++++++++++
+ ...onfigure-BSS-Termination-TSF-by-usin.patch | 66 +++++++++++++
+ ...erface-if-BSS-Termination-TSF-is-set.patch | 47 ++++++++++
+ ...assoc_frame_timer-to-send-disassocia.patch | 63 +++++++++++++
+ ...g-neighbor-report-elements-in-BTM-re.patch | 31 ++++++
+ ...hostapd_neighbor_set_own_report_pref.patch | 89 ++++++++++++++++++
+ 8 files changed, 535 insertions(+)
+ create mode 100644 package/network/services/hostapd/patches/902-2102-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch
+ create mode 100644 package/network/services/hostapd/patches/903-2102-Support-including-neighbor-report-elements-in-ANQP-r.patch
+ create mode 100644 package/network/services/hostapd/patches/904-2102-Support-including-neignbor-report-elements-in-BTM-re.patch
+ create mode 100644 package/network/services/hostapd/patches/905-2102-Add-support-to-configure-BSS-Termination-TSF-by-usin.patch
+ create mode 100644 package/network/services/hostapd/patches/906-2102-Disable-interface-if-BSS-Termination-TSF-is-set.patch
+ create mode 100644 package/network/services/hostapd/patches/907-2102-Add-set_send_disassoc_frame_timer-to-send-disassocia.patch
+ create mode 100644 package/network/services/hostapd/patches/908-2102-Support-including-neighbor-report-elements-in-BTM-re.patch
+ create mode 100644 package/network/services/hostapd/patches/909-2102-Add-hostapd_neighbor_set_own_report_pref.patch
+
+diff --git a/package/network/services/hostapd/patches/902-2102-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch b/package/network/services/hostapd/patches/902-2102-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch
+new file mode 100644
+index 0000000..038d71d
+--- /dev/null
++++ b/package/network/services/hostapd/patches/902-2102-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch
+@@ -0,0 +1,77 @@
++From e42eb49238eec538262e465599bf417a1a8f228f Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 10:54:35 +0800
++Subject: [PATCH] Add hostapd_neighbor_count() and
++ hostapd_neighbor_insert_buffer ()
++
++The first function can count the number of neighbor report in neighbore report
++database. The second can iterate neighbor report database to build up neighbor
++report data.
++---
++ src/ap/neighbor_db.c | 37 +++++++++++++++++++++++++++++++++++++
++ src/ap/neighbor_db.h |  3 +++
++ 2 files changed, 40 insertions(+)
++
++diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
++index 2bbe318..10143a0 100644
++--- a/src/ap/neighbor_db.c
+++++ b/src/ap/neighbor_db.c
++@@ -88,6 +88,43 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
++ }
++ 
++ 
+++int hostapd_neighbor_count(struct hostapd_data *hapd)
+++{
+++	struct hostapd_neighbor_entry *nr;
+++	int count = 0;
+++
+++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
+++			 list) {
+++		count++;
+++	}
+++	return count;
+++}
+++
+++
+++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
+++        size_t buflen)
+++{
+++	struct hostapd_neighbor_entry *nr;
+++	char *pos, *end;
+++
+++	pos = buf;
+++	end = buf + buflen;
+++
+++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
+++			 list) {
+++		/* For neighbor report IE, we only need bssid and nr*/
+++		int ret;
+++		char nrie[2 * 255 + 1];
+++		*pos++ = WLAN_EID_NEIGHBOR_REPORT;
+++		*pos++ = wpabuf_len(nr->nr);
+++ 		os_memcpy (pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
+++		pos += wpabuf_len(nr->nr);
+++	}
+++
+++	return pos - buf;
+++}
+++
+++
++ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
++ {
++ 	wpabuf_free(nr->nr);
++diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
++index bed0a2f..e93d1d5 100644
++--- a/src/ap/neighbor_db.h
+++++ b/src/ap/neighbor_db.h
++@@ -23,4 +23,7 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
++ 			    const struct wpa_ssid_value *ssid);
++ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
++ 
+++int hostapd_neighbor_count(struct hostapd_data *hapd);
+++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
+++        size_t buflen);
++ #endif /* NEIGHBOR_DB_H */
++-- 
++2.18.0
++
+diff --git a/package/network/services/hostapd/patches/903-2102-Support-including-neighbor-report-elements-in-ANQP-r.patch b/package/network/services/hostapd/patches/903-2102-Support-including-neighbor-report-elements-in-ANQP-r.patch
+new file mode 100644
+index 0000000..e3f07a5
+--- /dev/null
++++ b/package/network/services/hostapd/patches/903-2102-Support-including-neighbor-report-elements-in-ANQP-r.patch
+@@ -0,0 +1,94 @@
++From 38d9a0b2008ec6555d8b776d64040a0166633c6e Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 11:03:15 +0800
++Subject: [PATCH] Support including neighbor report elements in ANQP response
++
++---
++ src/ap/gas_serv.c | 29 +++++++++++++++++++++++++++++
++ src/ap/gas_serv.h |  2 ++
++ 2 files changed, 31 insertions(+)
++
++diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
++index 9567e20..43bd658 100644
++--- a/src/ap/gas_serv.c
+++++ b/src/ap/gas_serv.c
++@@ -19,6 +19,7 @@
++ #include "dpp_hostapd.h"
++ #include "sta_info.h"
++ #include "gas_serv.h"
+++#include "neighbor_db.h"
++ 
++ 
++ #ifdef CONFIG_DPP
++@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
++ 	}
++ }
++ 
+++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
+++				       struct wpabuf *buf)
+++{
+++	struct hostapd_neighbor_entry *nr;
+++	u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
+++	if (dl_list_empty(&hapd->nr_db)) {
+++		wpabuf_put_le16(buf, 0);
+++	}
+++	else {
+++		dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
+++			wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
+++			wpabuf_put_u8(buf, wpabuf_len(nr->nr));
+++			wpabuf_put_buf(buf, nr->nr);
+++		}
+++	}
+++	gas_anqp_set_element_len(buf, len_pos);
+++}
+++
++ 
++ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
++ 					struct wpabuf *buf)
++@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
++ 		len += 1000;
++ 	if (request & ANQP_REQ_ICON_REQUEST)
++ 		len += 65536;
+++    if (request & ANQP_REQ_NEIGHBOR_REPORT) {
+++        len += (40 * hostapd_neighbor_count(hapd));
+++    }
++ #ifdef CONFIG_FILS
++ 	if (request & ANQP_FILS_REALM_INFO)
++ 		len += 2 * dl_list_len(&hapd->conf->fils_realms);
++@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
++ 		anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
++ 	if (request & ANQP_REQ_EMERGENCY_NAI)
++ 		anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
+++	if (request & ANQP_REQ_NEIGHBOR_REPORT)
+++		anqp_add_neighbor_report(hapd, buf);
++ 
++ 	for (i = 0; i < num_extra_req; i++) {
++ #ifdef CONFIG_FILS
++@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
++ 			     "Emergency NAI",
++ 			     get_anqp_elem(hapd, info_id) != NULL, qi);
++ 		break;
+++	case ANQP_NEIGHBOR_REPORT:
+++		set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
+++			     "Neighbor Report",
+++			     get_anqp_elem(hapd, info_id) != NULL, qi);
+++		break;
++ 	default:
++ #ifdef CONFIG_FILS
++ 		if (info_id == ANQP_FILS_REALM_INFO &&
++diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
++index 1528af4..d0241f2 100644
++--- a/src/ap/gas_serv.h
+++++ b/src/ap/gas_serv.h
++@@ -40,6 +40,8 @@
++ 	(1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
++ #define ANQP_REQ_EMERGENCY_NAI \
++ 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
+++#define ANQP_REQ_NEIGHBOR_REPORT \
+++	(1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
++ /*
++  * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
++  * optimized bitmap.
++-- 
++2.18.0
++
+diff --git a/package/network/services/hostapd/patches/904-2102-Support-including-neignbor-report-elements-in-BTM-re.patch b/package/network/services/hostapd/patches/904-2102-Support-including-neignbor-report-elements-in-BTM-re.patch
+new file mode 100644
+index 0000000..3a6c82e
+--- /dev/null
++++ b/package/network/services/hostapd/patches/904-2102-Support-including-neignbor-report-elements-in-BTM-re.patch
+@@ -0,0 +1,68 @@
++From 2b36d2c5f227a0f2aeb7bb443e79a5282309614b Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 12:17:24 +0800
++Subject: [PATCH] Support including neignbor report elements in BTM response
++
++---
++ src/ap/wnm_ap.c | 26 ++++++++++++++++++++++++--
++ 1 file changed, 24 insertions(+), 2 deletions(-)
++
++diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
++index 248f5a1..f3a7c92 100644
++--- a/src/ap/wnm_ap.c
+++++ b/src/ap/wnm_ap.c
++@@ -20,6 +20,7 @@
++ #include "ap/wpa_auth.h"
++ #include "mbo_ap.h"
++ #include "wnm_ap.h"
+++#include "ap/neighbor_db.h"
++ 
++ #define MAX_TFS_IE_LEN  1024
++ 
++@@ -368,9 +369,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
++ 	u8 *pos;
++ 	int res;
++ 
++-	mgmt = os_zalloc(sizeof(*mgmt));
++-	if (mgmt == NULL)
+++  	int nr_num = hostapd_neighbor_count(hapd);
+++	int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
+++	int total_nr_size = nr_num * nr_size;
+++	u8 *nr_data = os_malloc(total_nr_size);
+++	int nr_data_len = 0;
+++	if (nr_data == NULL) {
+++		wpa_printf (MSG_ERROR, "Failed to allocate memory");
+++	} else {
+++	    nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
+++	}
+++	mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
+++	if (mgmt == NULL) {
+++		wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
++ 		return -1;
+++	}
++ 	os_memcpy(mgmt->da, addr, ETH_ALEN);
++ 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
++ 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
++@@ -380,10 +393,19 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
++ 	mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
++ 	mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
++ 	mgmt->u.action.u.bss_tm_req.req_mode = 0;
+++	if (nr_num) {
+++		mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
+++	}
++ 	mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
++ 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
++ 	pos = mgmt->u.action.u.bss_tm_req.variable;
++ 
+++
+++	if (nr_num) {
+++		os_memcpy(pos, nr_data, nr_data_len);
+++		pos += nr_data_len;
+++	}
+++
++ 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
++ 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
++ 		   "validity_interval=%u",
++-- 
++2.18.0
++
+diff --git a/package/network/services/hostapd/patches/905-2102-Add-support-to-configure-BSS-Termination-TSF-by-usin.patch b/package/network/services/hostapd/patches/905-2102-Add-support-to-configure-BSS-Termination-TSF-by-usin.patch
+new file mode 100644
+index 0000000..ec90f9e
+--- /dev/null
++++ b/package/network/services/hostapd/patches/905-2102-Add-support-to-configure-BSS-Termination-TSF-by-usin.patch
+@@ -0,0 +1,66 @@
++From c4f5049289bf5ce13ca0f10fedb6c0255c95d183 Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 11:27:23 +0800
++Subject: [PATCH] Add support to configure BSS Termination TSF by using
++ hostapd_cli cmd
++
++---
++ hostapd/ctrl_iface.c | 9 +++++++++
++ src/ap/ap_config.c   | 1 +
++ src/ap/ap_config.h   | 1 +
++ 3 files changed, 11 insertions(+)
++
++diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
++index 5b7f075..87f219d 100644
++--- a/hostapd/ctrl_iface.c
+++++ b/hostapd/ctrl_iface.c
++@@ -946,6 +946,10 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
++ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
++ 			return -1;
++ 		}
+++		if (hapd->conf->bss_termination_tsf) {
+++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
+++		}
+++
++ 		end++;
++ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
++ 	}
++@@ -1515,6 +1519,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
++ #endif /* CONFIG_DPP */
++ 	} else if (os_strcasecmp(cmd, "setband") == 0) {
++ 		ret = hostapd_ctrl_iface_set_band(hapd, value);
+++	} else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
+++		int termination_sec = atoi(value);
+++		hapd->conf->bss_termination_tsf = termination_sec;
+++		wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
+++                termination_sec);
++ 	} else {
++ 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
++ 		if (ret)
++diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
++index 91ceb9c..262f8e7 100644
++--- a/src/ap/ap_config.c
+++++ b/src/ap/ap_config.c
++@@ -164,6 +164,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
++ #ifdef CONFIG_TESTING_OPTIONS
++ 	bss->sae_commit_status = -1;
++ #endif /* CONFIG_TESTING_OPTIONS */
+++	bss->bss_termination_tsf = 0;
++ }
++ 
++ 
++diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
++index 09823bf..f0825f2 100644
++--- a/src/ap/ap_config.h
+++++ b/src/ap/ap_config.h
++@@ -551,6 +551,7 @@ struct hostapd_bss_config {
++ 	int wnm_sleep_mode;
++ 	int wnm_sleep_mode_no_keys;
++ 	int bss_transition;
+++	unsigned int bss_termination_tsf;
++ 
++ 	/* IEEE 802.11u - Interworking */
++ 	int interworking;
++-- 
++2.18.0
++
+diff --git a/package/network/services/hostapd/patches/906-2102-Disable-interface-if-BSS-Termination-TSF-is-set.patch b/package/network/services/hostapd/patches/906-2102-Disable-interface-if-BSS-Termination-TSF-is-set.patch
+new file mode 100644
+index 0000000..b3d296b
+--- /dev/null
++++ b/package/network/services/hostapd/patches/906-2102-Disable-interface-if-BSS-Termination-TSF-is-set.patch
+@@ -0,0 +1,47 @@
++From d9388fc13d85f057caf06b55c3ac1ba2e807b3d9 Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 12:22:57 +0800
++Subject: [PATCH] Disable interface if BSS Termination TSF is set
++
++---
++ src/ap/wnm_ap.c | 17 +++++++++++++++++
++ 1 file changed, 17 insertions(+)
++
++diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
++index f3a7c92..9772835 100644
++--- a/src/ap/wnm_ap.c
+++++ b/src/ap/wnm_ap.c
++@@ -755,6 +755,22 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ }
++ 
++ 
+++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
+++{
+++	struct hostapd_data *hapd = eloop_ctx;
+++	hostapd_disable_iface(hapd->iface);
+++}
+++
+++
+++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
+++			       int disable_iface_timer)
+++{
+++	wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
+++	eloop_register_timeout(disable_iface_timer, 0,
+++			       bss_termination_disable_iface, hapd, NULL);
+++}
+++
+++
++ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
++ 				   struct sta_info *sta, const char *url,
++ 				   int disassoc_timer)
++@@ -841,6 +857,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
++ 	    bss_term_dur) {
++ 		os_memcpy(pos, bss_term_dur, 12);
++ 		pos += 12;
+++		set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
++ 	}
++ 
++ 	if (url) {
++-- 
++2.18.0
++
+diff --git a/package/network/services/hostapd/patches/907-2102-Add-set_send_disassoc_frame_timer-to-send-disassocia.patch b/package/network/services/hostapd/patches/907-2102-Add-set_send_disassoc_frame_timer-to-send-disassocia.patch
+new file mode 100644
+index 0000000..814658d
+--- /dev/null
++++ b/package/network/services/hostapd/patches/907-2102-Add-set_send_disassoc_frame_timer-to-send-disassocia.patch
+@@ -0,0 +1,63 @@
++From cdba633ed9955ecf99f9d9833b10083b6e780314 Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 12:46:01 +0800
++Subject: [PATCH] Add set_send_disassoc_frame_timer() to send disassociate
++ frame
++
++Function set_disassoc_timer() may fail if key was deleted first. This new
++function will not ask to delete key as set_disassoc_timer() did.
++---
++ src/ap/wnm_ap.c | 30 +++++++++++++++++++++++++++++-
++ 1 file changed, 29 insertions(+), 1 deletion(-)
++
++diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
++index 9772835..4edfecf 100644
++--- a/src/ap/wnm_ap.c
+++++ b/src/ap/wnm_ap.c
++@@ -755,6 +755,34 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
++ }
++ 
++ 
+++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
+++			       int disassoc_timer)
+++{
+++	int timeout, beacon_int;
+++
+++	/*
+++	 * Prevent STA from reconnecting using cached PMKSA to force
+++	 * full authentication with the authentication server (which may
+++	 * decide to reject the connection),
+++	 */
+++	wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
+++
+++	beacon_int = hapd->iconf->beacon_int;
+++	if (beacon_int < 1)
+++		beacon_int = 100; /* best guess */
+++	/* Calculate timeout in ms based on beacon_int in TU */
+++	timeout = disassoc_timer * beacon_int * 128 / 125;
+++	wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
+++		   " set to %d ms", MAC2STR(sta->addr), timeout);
+++
+++	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
+++
+++	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
+++	if (sta)
+++		ap_sta_disassociate(hapd, sta, reason);
+++}
+++
+++
++ void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++ {
++ 	struct hostapd_data *hapd = eloop_ctx;
++@@ -893,7 +921,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
++ 
++ 	if (disassoc_timer) {
++ 		/* send disassociation frame after time-out */
++-		set_disassoc_timer(hapd, sta, disassoc_timer);
+++		set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
++ 	}
++ 
++ 	return 0;
++-- 
++2.18.0
++
+diff --git a/package/network/services/hostapd/patches/908-2102-Support-including-neighbor-report-elements-in-BTM-re.patch b/package/network/services/hostapd/patches/908-2102-Support-including-neighbor-report-elements-in-BTM-re.patch
+new file mode 100644
+index 0000000..4389af5
+--- /dev/null
++++ b/package/network/services/hostapd/patches/908-2102-Support-including-neighbor-report-elements-in-BTM-re.patch
+@@ -0,0 +1,31 @@
++From f0403572a26f0e2acb6eb91a71516ddc65b3683f Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 13:51:28 +0800
++Subject: [PATCH] Support including neighbor report elements in BTM request
++
++---
++ hostapd/ctrl_iface.c | 7 ++++++-
++ 1 file changed, 6 insertions(+), 1 deletion(-)
++
++diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
++index 87f219d..a5c2ae4 100644
++--- a/hostapd/ctrl_iface.c
+++++ b/hostapd/ctrl_iface.c
++@@ -976,8 +976,13 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
++ 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
++ 	}
++ 
++-	if (os_strstr(cmd, " pref=1"))
+++	if (os_strstr(cmd, " pref=1")) {
++ 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
+++		if (nei_len == 0) {
+++			// Add neigibor report from neighbor report db to nei_rep buffer
+++			nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
+++		}
+++	}
++ 	if (os_strstr(cmd, " abridged=1"))
++ 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
++ 	if (os_strstr(cmd, " disassoc_imminent=1"))
++-- 
++2.18.0
++
+diff --git a/package/network/services/hostapd/patches/909-2102-Add-hostapd_neighbor_set_own_report_pref.patch b/package/network/services/hostapd/patches/909-2102-Add-hostapd_neighbor_set_own_report_pref.patch
+new file mode 100644
+index 0000000..7aaeea8
+--- /dev/null
++++ b/package/network/services/hostapd/patches/909-2102-Add-hostapd_neighbor_set_own_report_pref.patch
+@@ -0,0 +1,89 @@
++From 65aeee466fac6ef75fb7fc1ebb72c494275b900b Mon Sep 17 00:00:00 2001
++From: "howard.hsu" <howard-yh.hsu@mediatek.com>
++Date: Mon, 25 Oct 2021 14:53:40 +0800
++Subject: [PATCH] Add hostapd_neighbor_set_own_report_pref()
++
++If my own BSS is going to terminate itself, the preference value of neighbor
++report must be set to 0.
++---
++ hostapd/ctrl_iface.c |  5 ++++-
++ src/ap/neighbor_db.c | 37 +++++++++++++++++++++++++++++++++++++
++ src/ap/neighbor_db.h |  2 ++
++ 3 files changed, 43 insertions(+), 1 deletion(-)
++
++diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
++index a5c2ae4..d653ec8 100644
++--- a/hostapd/ctrl_iface.c
+++++ b/hostapd/ctrl_iface.c
++@@ -985,8 +985,11 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
++ 	}
++ 	if (os_strstr(cmd, " abridged=1"))
++ 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
++-	if (os_strstr(cmd, " disassoc_imminent=1"))
+++	if (os_strstr(cmd, " disassoc_imminent=1")) {
++ 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
+++		/* Set own BSS neighbor report preference value as 0 */
+++		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
+++	}
++ 
++ #ifdef CONFIG_MBO
++ 	pos = os_strstr(cmd, "mbo=");
++diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
++index 10143a0..1efd984 100644
++--- a/src/ap/neighbor_db.c
+++++ b/src/ap/neighbor_db.c
++@@ -353,3 +353,40 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
++ 	wpabuf_free(nr);
++ #endif /* NEED_AP_MLME */
++ }
+++
+++
+++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
+++			 size_t buflen, const int pref)
+++{
+++	struct hostapd_neighbor_entry *nr;
+++	char *pos, *end, *next_nr;
+++
+++	pos = nei_buf;
+++	end = nei_buf + buflen;
+++	next_nr = nei_buf;
+++
+++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
+++			 list) {
+++		pos = next_nr;
+++		next_nr = pos + 2 + wpabuf_len(nr->nr);
+++		/* Shift 2 bytes for Element ID and Neighbor report length */
+++		pos = pos + 2;
+++		if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
+++			/* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
+++			pos = pos + 6 + 4 + 1 + 1 + 1;
+++
+++			/* Iterate Subelement */
+++			while (next_nr - pos > 0) {
+++				if (*pos == 3) {
+++					pos = pos + 2;
+++					*pos = pref;
+++					return;
+++				} else {
+++					pos++;
+++					int shift_len = *pos++;
+++					pos = pos + shift_len;
+++				}
+++			}
+++		}
+++	}
+++}
++diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
++index e93d1d5..dc6807b 100644
++--- a/src/ap/neighbor_db.h
+++++ b/src/ap/neighbor_db.h
++@@ -26,4 +26,6 @@ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
++ int hostapd_neighbor_count(struct hostapd_data *hapd);
++ int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++         size_t buflen);
+++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
+++			 size_t buflen, const int pref);
++ #endif /* NEIGHBOR_DB_H */
++-- 
++2.18.0
++
+-- 
+2.18.0
+