diff --git a/hostapd/Android.mk b/hostapd/Android.mk
index 680c572..5674962 100644
--- a/hostapd/Android.mk
+++ b/hostapd/Android.mk
@@ -276,6 +276,7 @@
 ifdef CONFIG_SAE_PK
 L_CFLAGS += -DCONFIG_SAE_PK
 NEED_AES_SIV=y
+NEED_BASE64=y
 OBJS += src/common/sae_pk.c
 endif
 NEED_ECC=y
@@ -956,6 +957,17 @@
 endif
 endif
 
+ifdef CONFIG_SAE
+ifdef NEED_SHA384
+# Need to add HMAC-SHA384 KDF as well, if SHA384 was enabled.
+NEED_HMAC_SHA384_KDF=y
+endif
+ifdef NEED_SHA512
+# Need to add HMAC-SHA512 KDF as well, if SHA512 was enabled.
+NEED_HMAC_SHA512_KDF=y
+endif
+endif
+
 L_CFLAGS += -DCONFIG_SHA256
 ifneq ($(CONFIG_TLS), openssl)
 ifneq ($(CONFIG_TLS), gnutls)
diff --git a/hostapd/Makefile b/hostapd/Makefile
index 489922c..4c31ba9 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -299,6 +299,7 @@
 ifdef CONFIG_SAE_PK
 CFLAGS += -DCONFIG_SAE_PK
 NEED_AES_SIV=y
+NEED_BASE64=y
 OBJS += ../src/common/sae_pk.o
 endif
 NEED_ECC=y
@@ -1069,6 +1070,17 @@
 endif
 endif
 
+ifdef CONFIG_SAE
+ifdef NEED_SHA384
+# Need to add HMAC-SHA384 KDF as well, if SHA384 was enabled.
+NEED_HMAC_SHA384_KDF=y
+endif
+ifdef NEED_SHA512
+# Need to add HMAC-SHA512 KDF as well, if SHA512 was enabled.
+NEED_HMAC_SHA512_KDF=y
+endif
+endif
+
 CFLAGS += -DCONFIG_SHA256
 ifneq ($(CONFIG_TLS), openssl)
 ifneq ($(CONFIG_TLS), linux)
@@ -1369,6 +1381,8 @@
 SOBJS += ../src/common/sae_pk.o
 SOBJS += ../src/common/dragonfly.o
 SOBJS += $(AESOBJS)
+SOBJS += ../src/crypto/sha384.o
+SOBJS += ../src/crypto/sha512.o
 SOBJS += ../src/crypto/sha256-prf.o
 SOBJS += ../src/crypto/sha384-prf.o
 SOBJS += ../src/crypto/sha512-prf.o
@@ -1376,6 +1390,10 @@
 SOBJS += ../src/crypto/sha256-kdf.o
 SOBJS += ../src/crypto/sha384-kdf.o
 SOBJS += ../src/crypto/sha512-kdf.o
+SOBJS += ../src/common/wpa_common.o
+SOBJS += ../src/crypto/random.o
+SOBJS += ../src/crypto/sha1-prf.o
+SOBJS += ../src/utils/eloop.o
 
 _OBJS_VAR := NOBJS
 include ../src/objs.mk
diff --git a/hostapd/README-MULTI-AP b/hostapd/README-MULTI-AP
index ccee69e..6190cac 100644
--- a/hostapd/README-MULTI-AP
+++ b/hostapd/README-MULTI-AP
@@ -155,6 +155,6 @@
 ----------
 
 [1] https://www.wi-fi.org/discover-wi-fi/wi-fi-easymesh
-[2] https://github.com/prplfoundation/prplMesh
+[2] https://gitlab.com/prpl-foundation/prplmesh/prplMesh
 [3] https://www.wi-fi.org/file/multi-ap-specification-v10
     (requires registration)
diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 9470cae..f4a6aeb 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -2756,8 +2756,6 @@
 			return 1;
 		}
 		bss->eap_teap_auth = val;
-	} else if (os_strcmp(buf, "eap_teap_pac_no_inner") == 0) {
-		bss->eap_teap_pac_no_inner = atoi(pos);
 	} else if (os_strcmp(buf, "eap_teap_separate_result") == 0) {
 		bss->eap_teap_separate_result = atoi(pos);
 	} else if (os_strcmp(buf, "eap_teap_id") == 0) {
@@ -3964,6 +3962,10 @@
 			return 1;
 		}
 		conf->mbssid = mbssid;
+	} else if (os_strcmp(buf, "mbssid_index") == 0) {
+		bss->mbssid_index = atoi(pos);
+	} else if (os_strcmp(buf, "mbssid_max") == 0) {
+		conf->mbssid_max = atoi(pos);
 #endif /* CONFIG_IEEE80211AX */
 	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
 		bss->max_listen_interval = atoi(pos);
@@ -5132,6 +5134,10 @@
 		if (val < 0 || val > 1)
 			return 1;
 		bss->ssid_protection = val;
+	} else if (os_strcmp(buf, "channel_usage") == 0) {
+		conf->channel_usage = atoi(pos);
+	} else if (os_strcmp(buf, "peer_to_peer_twt") == 0) {
+		conf->peer_to_peer_twt = atoi(pos);
 #ifdef CONFIG_IEEE80211BE
 	} else if (os_strcmp(buf, "ieee80211be") == 0) {
 		conf->ieee80211be = atoi(pos);
diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
index ea19ba7..dd445d8 100644
--- a/hostapd/ctrl_iface.c
+++ b/hostapd/ctrl_iface.c
@@ -2707,7 +2707,7 @@
 	}
 
 	ret = hostapd_ctrl_check_freq_params(&settings.freq_params,
-					     settings.punct_bitmap);
+					     settings.freq_params.punct_bitmap);
 	if (ret) {
 		wpa_printf(MSG_INFO,
 			   "chanswitch: invalid frequency settings provided");
@@ -3210,6 +3210,7 @@
 
 
 #ifdef NEED_AP_MLME
+
 static int hostapd_ctrl_iface_track_sta_list(struct hostapd_data *hapd,
 					     char *buf, size_t buflen)
 {
@@ -3243,6 +3244,35 @@
 
 	return pos - buf;
 }
+
+
+static int hostapd_ctrl_iface_dump_beacon(struct hostapd_data *hapd,
+					  char *buf, size_t buflen)
+{
+	struct beacon_data beacon;
+	char *pos, *end;
+	int ret;
+
+	if (hostapd_build_beacon_data(hapd, &beacon) < 0)
+		return -1;
+
+	if (2 * (beacon.head_len + beacon.tail_len) > buflen)
+		return -1;
+
+	pos = buf;
+	end = buf + buflen;
+
+	ret = wpa_snprintf_hex(pos, end - pos, beacon.head, beacon.head_len);
+	pos += ret;
+
+	ret = wpa_snprintf_hex(pos, end - pos, beacon.tail, beacon.tail_len);
+	pos += ret;
+
+	free_beacon_data(&beacon);
+
+	return pos - buf;
+}
+
 #endif /* NEED_AP_MLME */
 
 
@@ -4026,7 +4056,7 @@
 	}
 
 	ret = hostapd_nan_usd_transmit(hapd, handle, ssi, NULL, peer_addr,
-				    req_instance_id);
+				       req_instance_id);
 fail:
 	wpabuf_free(ssi);
 	return ret;
@@ -4347,6 +4377,9 @@
 	} else if (os_strcmp(buf, "TRACK_STA_LIST") == 0) {
 		reply_len = hostapd_ctrl_iface_track_sta_list(
 			hapd, reply, reply_size);
+	} else if (os_strcmp(buf, "DUMP_BEACON") == 0) {
+		reply_len = hostapd_ctrl_iface_dump_beacon(hapd, reply,
+							   reply_size);
 #endif /* NEED_AP_MLME */
 	} else if (os_strcmp(buf, "PMKSA") == 0) {
 		reply_len = hostapd_ctrl_iface_pmksa_list(hapd, reply,
diff --git a/hostapd/hlr_auc_gw.c b/hostapd/hlr_auc_gw.c
index 5caa779..291acf9 100644
--- a/hostapd/hlr_auc_gw.c
+++ b/hostapd/hlr_auc_gw.c
@@ -1,6 +1,6 @@
 /*
  * HLR/AuC testing gateway for hostapd EAP-SIM/AKA database/authenticator
- * Copyright (c) 2005-2007, 2012-2017, Jouni Malinen <j@w1.fi>
+ * Copyright (c) 2005-2007, 2012-2024, Jouni Malinen <j@w1.fi>
  *
  * This software may be distributed under the terms of the BSD license.
  * See README for more details.
@@ -66,6 +66,7 @@
 static int sqn_changes = 0;
 static int ind_len = 5;
 static int stdout_debug = 1;
+static bool stop = false;
 
 /* GSM triplets */
 struct gsm_triplet {
@@ -877,6 +878,12 @@
 	if (os_strncmp(cmd, "AKA-AUTS ", 9) == 0)
 		return aka_auts(cmd + 9, resp, resp_len);
 
+	if (strncmp(cmd, "TERMINATE", 9) == 0) {
+		stop = true;
+		resp[0] = '\0';
+		return 0;
+	}
+
 	printf("Unknown request: %s\n", cmd);
 	return -1;
 }
@@ -931,10 +938,13 @@
 	struct gsm_triplet *g, *gprev;
 	struct milenage_parameters *m, *prev;
 
-	if (update_milenage && milenage_file && sqn_changes)
+	if (update_milenage && milenage_file && sqn_changes) {
+		sqn_changes = 0;
 		update_milenage_file(milenage_file);
+	}
 
 	g = gsm_db;
+	gsm_db = NULL;
 	while (g) {
 		gprev = g;
 		g = g->next;
@@ -942,16 +952,21 @@
 	}
 
 	m = milenage_db;
+	milenage_db = NULL;
 	while (m) {
 		prev = m;
 		m = m->next;
 		os_free(prev);
 	}
 
-	if (serv_sock >= 0)
+	if (serv_sock >= 0) {
 		close(serv_sock);
-	if (socket_path)
+		serv_sock = -1;
+	}
+	if (socket_path) {
 		unlink(socket_path);
+		socket_path = NULL;
+	}
 
 #ifdef CONFIG_SQLITE
 	if (sqlite_db) {
@@ -965,6 +980,7 @@
 static void handle_term(int sig)
 {
 	printf("Signal %d - terminate\n", sig);
+	cleanup();
 	exit(0);
 }
 
@@ -973,7 +989,7 @@
 {
 	printf("HLR/AuC testing gateway for hostapd EAP-SIM/AKA "
 	       "database/authenticator\n"
-	       "Copyright (c) 2005-2017, Jouni Malinen <j@w1.fi>\n"
+	       "Copyright (c) 2005-2024, Jouni Malinen <j@w1.fi>\n"
 	       "\n"
 	       "usage:\n"
 	       "hlr_auc_gw [-hu] [-s<socket path>] [-g<triplet file>] "
@@ -1081,8 +1097,9 @@
 		signal(SIGTERM, handle_term);
 		signal(SIGINT, handle_term);
 
-		for (;;)
+		while (!stop)
 			process(serv_sock);
+		cleanup();
 	} else {
 		char buf[1000];
 		socket_path = NULL;
diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index 93524cf..b1e8ac5 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -1030,6 +1030,18 @@
 # Valid range: 0..20 TUs; default is 0 (disabled)
 #unsol_bcast_probe_resp_interval=0
 
+#channel_usage: Whether Channel Usage procedures is supported by AP.
+# 0 = Channel Usage support is disabled (default)
+# 1 = Channel Usage support is enabled
+#channel_usage=0
+
+#peer_to_peer_twt: Indicates an HE AP supports negotiating a peer-to-peer
+# TWT schedule that is requested by a non-AP STA to establish a
+# channel-usage-aidable BSS or an off-channel TDLS direct link.
+# 0 = Does not support Peer-to-peer TWT (default)
+# 1 = Supports Peer-to-peer TWT
+#peer_to_peer_twt=0
+
 ##### IEEE 802.11be related configuration #####################################
 
 #ieee80211be: Whether IEEE 802.11be (EHT) is enabled
@@ -3411,6 +3423,18 @@
 # 2 = Enhanced multiple BSSID advertisement enabled.
 #mbssid=0
 #
+# Maximum number of BSSs that can be added into a Multiple BSSID set
+# This is a radio level parameter. If not set (or 0), the maximum is determined
+# automatically based on the configured BSSs which may limit dynamic addition
+# of new BSSs.
+#mbssid_max=0
+#
+# Multiple BSSID Index override
+# This is a BSS level parameter. If not set (or 0), the BSSID index is
+# determined automatically based on the configured BSSs which may limit dynamic
+# addition of new BSSs.
+#mbssid_index=0
+#
 # The transmitting interface should be added with the 'interface' option while
 # the non-transmitting interfaces should be added using the 'bss' option.
 # Security configuration should be added separately per interface, if required.
diff --git a/hostapd/main.c b/hostapd/main.c
index 50b9f04..5769fa0 100644
--- a/hostapd/main.c
+++ b/hostapd/main.c
@@ -162,6 +162,7 @@
 	struct wpa_driver_capa capa;
 #ifdef CONFIG_IEEE80211BE
 	struct hostapd_data *h_hapd = NULL;
+	void *shared_hapd = NULL;
 #endif /* CONFIG_IEEE80211BE */
 
 	if (hapd->driver == NULL || hapd->driver->hapd_init == NULL) {
@@ -170,8 +171,11 @@
 	}
 
 #ifdef CONFIG_IEEE80211BE
-	if (conf->mld_ap)
+	if (conf->mld_ap) {
+		if (!hapd->mld)
+			hostapd_bss_setup_multi_link(hapd, iface->interfaces);
 		h_hapd = hostapd_mld_get_first_bss(hapd);
+	}
 
 	if (h_hapd) {
 		hapd->drv_priv = h_hapd->drv_priv;
@@ -255,6 +259,42 @@
 
 	params.own_addr = hapd->own_addr;
 
+#ifdef CONFIG_IEEE80211BE
+	if (hapd->driver->can_share_drv &&
+	    hapd->driver->can_share_drv(hapd, &params, &shared_hapd)) {
+		char force_ifname[IFNAMSIZ];
+		const u8 *addr = params.bssid;
+		u8 if_addr[ETH_ALEN];
+
+		if (!shared_hapd) {
+			wpa_printf(MSG_ERROR, "Failed to get the shared drv");
+			os_free(params.bridge);
+			return -1;
+		}
+
+		/* Share an already initialized driver interface instance
+		 * using an AP mode BSS in it instead of adding a new driver
+		 * interface instance for the same driver. */
+		if (hostapd_if_add(shared_hapd, WPA_IF_AP_BSS,
+				   params.ifname, addr, hapd,
+				   &hapd->drv_priv, force_ifname, if_addr,
+				   params.num_bridge && params.bridge[0] ?
+				   params.bridge[0] : NULL,
+				   0)) {
+			wpa_printf(MSG_ERROR, "Failed to add BSS (BSSID="
+				   MACSTR ")", MAC2STR(hapd->own_addr));
+			os_free(params.bridge);
+			return -1;
+		}
+		os_free(params.bridge);
+
+		hapd->interface_added = 1;
+		os_memcpy(params.own_addr, addr ? addr : if_addr, ETH_ALEN);
+
+		goto pre_setup_mld;
+	}
+#endif /* CONFIG_IEEE80211BE */
+
 	hapd->drv_priv = hapd->driver->hapd_init(hapd, &params);
 	os_free(params.bridge);
 	if (hapd->drv_priv == NULL) {
@@ -265,6 +305,7 @@
 	}
 
 #ifdef CONFIG_IEEE80211BE
+pre_setup_mld:
 	/*
 	 * This is the first interface added to the AP MLD, so have the
 	 * interface hardware address be the MLD address, while the link address