diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index aa49f6c..913bc04 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -3402,6 +3402,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
 #ifdef CONFIG_MBO
 	} else if (os_strcmp(buf, "mbo") == 0) {
 		bss->mbo_enabled = atoi(pos);
+	} else if (os_strcmp(buf, "mbo_cell_conn_pref") == 0) {
+		bss->mbo_cell_conn_pref = atoi(pos);
 #endif /* CONFIG_MBO */
 #ifdef CONFIG_TESTING_OPTIONS
 #define PARSE_TEST_PROBABILITY(_val)				\
diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index c9cc22a..e5b62d1 100644
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -524,6 +524,7 @@ struct hostapd_bss_config {
 	int osen;
 	int proxy_arp;
 	int na_mcast_to_ucast;
+	u8 mbo_cell_conn_pref;
 #ifdef CONFIG_HS20
 	int hs20;
 	int disable_dgaf;
diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
index 72b0e6a..4255a02 100644
--- a/src/ap/gas_serv.c
+++ b/src/ap/gas_serv.c
@@ -168,6 +168,22 @@ static void anqp_add_hs_capab_list(struct hostapd_data *hapd,
 #endif /* CONFIG_HS20 */
 
 
+#ifdef CONFIG_MBO
+static void anqp_add_mbo_cell_conn_pref(struct hostapd_data *hapd,
+				   struct wpabuf *buf)
+{
+	u8 *len;
+
+	len = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
+	wpabuf_put_be24(buf, OUI_WFA);
+	wpabuf_put_u8(buf, MBO_ANQP_OUI_TYPE);
+	wpabuf_put_u8(buf, MBO_ANQP_SUBTYPE_CELL_CONN_PREF);
+	wpabuf_put_data(buf, &hapd->conf->mbo_cell_conn_pref, 1);
+	gas_anqp_set_element_len(buf, len);
+}
+#endif /* CONFIG_MBO */
+
+
 static struct anqp_element * get_anqp_elem(struct hostapd_data *hapd,
 					   u16 infoid)
 {
@@ -929,6 +945,11 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
 		anqp_add_icon_binary_file(hapd, buf, icon_name, icon_name_len);
 #endif /* CONFIG_HS20 */
 
+#ifdef CONFIG_MBO
+	if (request & ANQP_REQ_MBO_CELL_CONN_PREF)
+		anqp_add_mbo_cell_conn_pref(hapd, buf);
+#endif /* CONFIG_MBO */
+
 	return buf;
 }
 
@@ -1148,6 +1169,23 @@ static void rx_anqp_hs_icon_request(struct hostapd_data *hapd,
 }
 
 
+#ifdef CONFIG_MBO
+static void rx_anqp_mbo_query_list(struct hostapd_data *hapd, u8 subtype,
+				  struct anqp_query_info *qi)
+{
+	switch (subtype) {
+	case MBO_ANQP_SUBTYPE_CELL_CONN_PREF:
+		set_anqp_req(ANQP_REQ_MBO_CELL_CONN_PREF,
+			     "MBO Cellular Connection Preference", 1, qi);
+		break;
+	default:
+		wpa_printf(MSG_DEBUG, "ANQP: Unsupported MBO subtype %u", subtype);
+		break;
+	}
+}
+#endif /* CONFIG_MBO */
+
+
 static void rx_anqp_vendor_specific(struct hostapd_data *hapd,
 				    const u8 *pos, const u8 *end,
 				    struct anqp_query_info *qi)
@@ -1184,6 +1222,33 @@ static void rx_anqp_vendor_specific(struct hostapd_data *hapd,
 	}
 #endif /* CONFIG_P2P */
 
+#ifdef CONFIG_MBO
+	if (*pos == MBO_ANQP_OUI_TYPE) {
+		/*
+		 * This is for MBO ANQP element.
+		 */
+		pos++;
+		if (pos + 1 >= end)
+			return;
+
+		subtype = *pos++;
+		switch (subtype) {
+		case MBO_ANQP_SUBTYPE_QUERY_LIST:
+			wpa_printf(MSG_DEBUG, "ANQP: MBO Query List");
+			while (pos < end) {
+				rx_anqp_mbo_query_list(hapd, *pos, qi);
+				pos++;
+			}
+			break;
+		default:
+			wpa_printf(MSG_DEBUG, "ANQP: Unsupported MBO query subtype "
+				   "%u", subtype);
+			break;
+		}
+		return;
+	}
+#endif /* CONFIG_MBO */
+
 	if (*pos != HS20_ANQP_OUI_TYPE) {
 		wpa_printf(MSG_DEBUG, "ANQP: Unsupported WFA vendor type %u",
 			   *pos);
diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
index 9051e4f..c664a4a 100644
--- a/src/ap/gas_serv.h
+++ b/src/ap/gas_serv.h
@@ -41,7 +41,7 @@
 #define ANQP_REQ_EMERGENCY_NAI \
 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
 /*
- * First 16 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+ * First 12 Hotspot 2.0 vendor specific ANQP-elements can be included in the
  * optimized bitmap.
  */
 #define ANQP_REQ_HS_CAPABILITY_LIST \
@@ -61,6 +61,13 @@
 #define ANQP_REQ_ICON_REQUEST \
 	(0x10000 << HS20_STYPE_ICON_REQUEST)
 
+/*
+ * First 4 MBO vendor specific ANQP-elements can be included in the
+ * optimized bitmap.
+ */
+#define ANQP_REQ_MBO_CELL_CONN_PREF \
+	(0x10000000 << MBO_ANQP_SUBTYPE_CELL_CONN_PREF)
+
 struct gas_dialog_info {
 	u8 valid;
 	struct wpabuf *sd_resp; /* Fragmented response */
diff --git a/src/common/ieee802_11_defs.h b/src/common/ieee802_11_defs.h
index 259862d..f9eb89b 100644
--- a/src/common/ieee802_11_defs.h
+++ b/src/common/ieee802_11_defs.h
@@ -1415,9 +1415,11 @@ enum wfa_wnm_notif_subelem_id {
 	WFA_WNM_NOTIF_SUBELEM_CELL_DATA_CAPA = 3,
 };
 
-/* MBO v0.0_r25, 4.3: MBO ANQP-elements */
+/* MBO v0.0_r27, 4.3: MBO ANQP-elements */
 #define MBO_ANQP_OUI_TYPE 0x12
-#define MBO_ANQP_SUBTYPE_CELL_CONN_PREF 1
+#define MBO_ANQP_SUBTYPE_QUERY_LIST     1
+#define MBO_ANQP_SUBTYPE_CELL_CONN_PREF 2
+
 
 /* Wi-Fi Direct (P2P) */
 
-- 
1.9.1

