diff --git a/components/mlme/core/src/wlan_mlme_main.c b/components/mlme/core/src/wlan_mlme_main.c
index 3af2f88ad195..929a936c5d14 100644
--- a/components/mlme/core/src/wlan_mlme_main.c
+++ b/components/mlme/core/src/wlan_mlme_main.c
@@ -667,6 +667,8 @@ mlme_init_qos_edca_params(struct wlan_objmgr_psoc *psoc,
 	edca_params->enable_edca_params =
 			cfg_get(psoc, CFG_EDCA_ENABLE_PARAM);
 
+	edca_params->enable_wmm_txop =
+			cfg_get(psoc, CFG_ENABLE_WMM_TXOP);
 	edca_params->edca_ac_vo.vo_cwmin =
 			cfg_get(psoc, CFG_EDCA_VO_CWMIN);
 	edca_params->edca_ac_vo.vo_cwmax =
diff --git a/components/mlme/dispatcher/inc/cfg_mlme_edca_params.h b/components/mlme/dispatcher/inc/cfg_mlme_edca_params.h
index b9d0801d509f..14ab0046367c 100644
--- a/components/mlme/dispatcher/inc/cfg_mlme_edca_params.h
+++ b/components/mlme/dispatcher/inc/cfg_mlme_edca_params.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2011-2019 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -481,6 +482,28 @@
 		0, \
 		"Enable edca parameter")
 
+/*
+ * <ini>
+ * enable_wmm_txop - Enable WMM based txop feature
+ * @Min: 0
+ * @Max: 1
+ * @Default: 1
+ *
+ * This ini is used to enable/disable the WMM based txop feature in FW
+ *
+ * Related: None
+ *
+ * Supported Feature: STA
+ *
+ * Usage: Internal
+ *
+ * </ini>
+ */
+#define CFG_ENABLE_WMM_TXOP CFG_INI_BOOL( \
+		"enable_wmm_txop", \
+		1, \
+		"Enable WMM TXOP")
+
 /*
  * <ini>
  * gEdcaVoCwmin - Set Cwmin value for QCA_WLAN_AC_VO
@@ -838,6 +861,7 @@
 	CFG(CFG_EDCA_BK_AIFS) \
 	CFG(CFG_EDCA_BE_CWMIN) \
 	CFG(CFG_EDCA_BE_CWMAX) \
+	CFG(CFG_ENABLE_WMM_TXOP) \
 	CFG(CFG_EDCA_BE_AIFS)
 
 #endif  /* __CFG_MLME_EDCA__PARAM_H */
diff --git a/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h b/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
index 48d648184f6b..328d3edf40f4 100644
--- a/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
+++ b/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h
@@ -376,6 +376,7 @@ struct wlan_mlme_edca_params {
 	struct mlme_cfg_str etsi_acvo_b;
 
 	bool enable_edca_params;
+	bool enable_wmm_txop;
 	struct mlme_edca_ac_vo edca_ac_vo;
 	struct mlme_edca_ac_vi edca_ac_vi;
 	struct mlme_edca_ac_bk edca_ac_bk;
diff --git a/components/nan/core/src/nan_main.c b/components/nan/core/src/nan_main.c
index 26bfcce48b7d..738cd08a1a07 100644
--- a/components/nan/core/src/nan_main.c
+++ b/components/nan/core/src/nan_main.c
@@ -885,7 +885,15 @@ fail:
 	psoc_nan_obj->nan_social_ch_2g_freq = 0;
 	psoc_nan_obj->nan_social_ch_5g_freq = 0;
 	nan_set_discovery_state(psoc, NAN_DISC_DISABLED);
-	policy_mgr_check_n_start_opportunistic_timer(psoc);
+	if (ucfg_is_nan_dbs_supported(psoc))
+		policy_mgr_check_n_start_opportunistic_timer(psoc);
+
+	/*
+	 * If FW respond with NAN enable failure, then TDLS should be enable
+	 * again if there is TDLS connection exist earlier.
+	 * decrement the active TDLS session.
+	 */
+	ucfg_tdls_notify_connect_failure(psoc);
 
 done:
 	nan_conc_callback = psoc_nan_obj->cb_obj.nan_concurrency_update;
@@ -1113,7 +1121,6 @@ bool nan_is_enable_allowed(struct wlan_objmgr_psoc *psoc, uint32_t nan_ch_freq)
 	}
 
 	return (NAN_DISC_DISABLED == nan_get_discovery_state(psoc) &&
-		ucfg_is_nan_conc_control_supported(psoc) &&
 		policy_mgr_allow_concurrency(psoc, PM_NAN_DISC_MODE,
 					     nan_ch_freq, HW_MODE_20_MHZ));
 }
diff --git a/components/nan/dispatcher/src/nan_ucfg_api.c b/components/nan/dispatcher/src/nan_ucfg_api.c
index 7b23364a52a8..f32734f19919 100644
--- a/components/nan/dispatcher/src/nan_ucfg_api.c
+++ b/components/nan/dispatcher/src/nan_ucfg_api.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -35,6 +35,7 @@
 #include "cfg_nan.h"
 #include "wlan_mlme_api.h"
 #include "cfg_nan_api.h"
+#include "wlan_tdls_ucfg_api.h"
 
 struct wlan_objmgr_psoc;
 struct wlan_objmgr_vdev;
@@ -876,8 +877,16 @@ post_msg:
 			if (req_type == NAN_ENABLE_REQ) {
 				nan_set_discovery_state(psoc,
 							NAN_DISC_DISABLED);
-				policy_mgr_check_n_start_opportunistic_timer(
-									psoc);
+				if (ucfg_is_nan_dbs_supported(psoc))
+					policy_mgr_check_n_start_opportunistic_timer(psoc);
+
+				/*
+				 * If FW respond with NAN enable failure, then
+				 * TDLS should be enable again if there is TDLS
+				 * connection exist earlier.
+				 * decrement the active TDLS session.
+				 */
+				ucfg_tdls_notify_connect_failure(psoc);
 			} else if (req_type == NAN_DISABLE_REQ) {
 				nan_disable_cleanup(psoc);
 			}
diff --git a/components/p2p/core/src/wlan_p2p_off_chan_tx.c b/components/p2p/core/src/wlan_p2p_off_chan_tx.c
index 38fb76a21546..1478df85dce7 100644
--- a/components/p2p/core/src/wlan_p2p_off_chan_tx.c
+++ b/components/p2p/core/src/wlan_p2p_off_chan_tx.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1545,38 +1546,6 @@ static QDF_STATUS p2p_disable_tx_timer(struct tx_action_context *tx_ctx)
 	return status;
 }
 
-/**
- * is_rmf_mgmt_action_frame() - check RMF action frame by category
- * @action_category: action frame actegory
- *
- * This function check the frame is robust mgmt action frame or not
- *
- * Return: true - if category is robust mgmt type
- */
-static bool is_rmf_mgmt_action_frame(uint8_t action_category)
-{
-	switch (action_category) {
-	case ACTION_CATEGORY_SPECTRUM_MGMT:
-	case ACTION_CATEGORY_QOS:
-	case ACTION_CATEGORY_DLS:
-	case ACTION_CATEGORY_BACK:
-	case ACTION_CATEGORY_RRM:
-	case ACTION_FAST_BSS_TRNST:
-	case ACTION_CATEGORY_SA_QUERY:
-	case ACTION_CATEGORY_PROTECTED_DUAL_OF_PUBLIC_ACTION:
-	case ACTION_CATEGORY_WNM:
-	case ACTION_CATEGORY_MESH_ACTION:
-	case ACTION_CATEGORY_MULTIHOP_ACTION:
-	case ACTION_CATEGORY_DMG:
-	case ACTION_CATEGORY_FST:
-	case ACTION_CATEGORY_VENDOR_SPECIFIC_PROTECTED:
-		return true;
-	default:
-		break;
-	}
-	return false;
-}
-
 /**
  * p2p_populate_rmf_field() - populate unicast rmf frame
  * @tx_ctx: tx_action_context
@@ -1620,7 +1589,7 @@ static QDF_STATUS p2p_populate_rmf_field(struct tx_action_context *tx_ctx,
 	 * to get the actual action category we need to ignore the MSB.
 	 */
 	action_category = action_hdr->action_category & 0x7f;
-	if (!is_rmf_mgmt_action_frame(action_category)) {
+	if (!wlan_mgmt_is_rmf_mgmt_action_frame(action_category)) {
 		p2p_debug("non rmf act frame 0x%x category %x",
 			  tx_ctx->frame_info.sub_type,
 			  action_hdr->action_category);
diff --git a/components/pmo/dispatcher/inc/wlan_pmo_wow_public_struct.h b/components/pmo/dispatcher/inc/wlan_pmo_wow_public_struct.h
index 88b23b07ac3f..a38e36c8e84b 100644
--- a/components/pmo/dispatcher/inc/wlan_pmo_wow_public_struct.h
+++ b/components/pmo/dispatcher/inc/wlan_pmo_wow_public_struct.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -65,6 +66,7 @@
 #define PMO_MAC_ACTION_FST            18
 #define PMO_MAC_ACTION_RVS            19
 #define PMO_MAC_ACTION_VHT            21
+#define PMO_VENDOR_PROTECTED          126
 #define PMO_MAC_ACTION_MAX            256
 
 /*
@@ -96,6 +98,7 @@
  * PMO_ACTION_FST             18      1
  * PMO_ACTION_RVS             19      1
  * PMO_ACTION_VHT             21      1
+ * PMO_VENDOR_PROTECTED       126     1
  * ----------------------------+------+-------+
  */
 #define SYSTEM_SUSPEND_ALLOWED_ACTION_FRAMES_BITMAP0 \
@@ -112,7 +115,9 @@
 
 #define ALLOWED_ACTION_FRAMES_BITMAP1   0x0
 #define ALLOWED_ACTION_FRAMES_BITMAP2   0x0
-#define ALLOWED_ACTION_FRAMES_BITMAP3   0x0
+#define ALLOWED_ACTION_FRAMES_BITMAP3 \
+		(1 << (PMO_VENDOR_PROTECTED % 32))
+
 #define ALLOWED_ACTION_FRAMES_BITMAP4   0x0
 #define ALLOWED_ACTION_FRAMES_BITMAP5   0x0
 #define ALLOWED_ACTION_FRAMES_BITMAP6   0x0
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index 2a1b2efd5349..1ee2bb2b65d9 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -10552,6 +10552,13 @@ void hdd_send_mscs_action_frame(struct hdd_context *hdd_ctx,
 	uint64_t mscs_vo_pkt_delta;
 	unsigned long tx_vo_pkts;
 
+	/*
+	 * To disable MSCS feature in driver set mscs_pkt_threshold = 0
+	 * in ini file.
+	 */
+	if (!hdd_ctx->config->mscs_pkt_threshold)
+		return;
+
 	tx_vo_pkts = adapter->hdd_stats.tx_rx_stats.tx_classified_ac[SME_AC_VO];
 
 	if (!adapter->mscs_counter)
diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h
index 4e28b018aad0..3ddd2df15999 100644
--- a/core/mac/inc/qwlan_version.h
+++ b/core/mac/inc/qwlan_version.h
@@ -32,9 +32,9 @@
 #define QWLAN_VERSION_MAJOR            2
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            8
-#define QWLAN_VERSION_EXTRA            "J"
+#define QWLAN_VERSION_EXTRA            "R"
 #define QWLAN_VERSION_BUILD            31
 
-#define QWLAN_VERSIONSTR               "2.0.8.31J"
+#define QWLAN_VERSIONSTR               "2.0.8.31R"
 
 #endif /* QWLAN_VERSION_H */
diff --git a/core/mac/inc/sir_mac_prot_def.h b/core/mac/inc/sir_mac_prot_def.h
index a3f9e9f778ff..f124b5fb4be4 100644
--- a/core/mac/inc/sir_mac_prot_def.h
+++ b/core/mac/inc/sir_mac_prot_def.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2011-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -134,6 +135,7 @@
 /* block acknowledgment action frame types */
 #define SIR_MAC_ACTION_VENDOR_SPECIFIC 9
 #define SIR_MAC_ACTION_VENDOR_SPECIFIC_CATEGORY     0x7F
+#define SIR_MAC_PROT_ACTION_VENDOR_SPECIFIC_CATEGORY 0x7E
 #define SIR_MAC_ACTION_P2P_SUBTYPE_PRESENCE_RSP     2
 
 /* Public Action for 20/40 BSS Coexistence */
diff --git a/core/mac/src/pe/lim/lim_ft.c b/core/mac/src/pe/lim/lim_ft.c
index a66585ca24a2..0017167ac437 100644
--- a/core/mac/src/pe/lim/lim_ft.c
+++ b/core/mac/src/pe/lim/lim_ft.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -735,10 +736,8 @@ void lim_fill_ft_session(struct mac_context *mac,
 #ifdef WLAN_FEATURE_11W
 	ft_session->limRmfEnabled = pe_session->limRmfEnabled;
 #endif
-	if ((ft_session->limRFBand == REG_BAND_2G) &&
-		(ft_session->htSupportedChannelWidthSet ==
-		eHT_CHANNEL_WIDTH_40MHZ))
-		lim_init_obss_params(mac, ft_session);
+	/* Load default OBSS parameters to session entry */
+	lim_init_obss_params(mac, ft_session);
 
 	ft_session->enableHtSmps = pe_session->enableHtSmps;
 	ft_session->htSmpsvalue = pe_session->htSmpsvalue;
diff --git a/core/mac/src/pe/lim/lim_process_action_frame.c b/core/mac/src/pe/lim/lim_process_action_frame.c
index 1a683db31d7d..09e65cfb444b 100644
--- a/core/mac/src/pe/lim/lim_process_action_frame.c
+++ b/core/mac/src/pe/lim/lim_process_action_frame.c
@@ -1606,7 +1606,6 @@ void lim_process_action_frame(struct mac_context *mac_ctx,
 	int8_t rssi;
 	uint32_t frame_len = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
 	tpSirMacVendorSpecificFrameHdr vendor_specific;
-	uint8_t oui[] = { 0x00, 0x00, 0xf0 };
 	uint8_t dpp_oui[] = { 0x50, 0x6F, 0x9A, 0x1A };
 	tpSirMacVendorSpecificPublicActionFrameHdr pub_action;
 
@@ -1617,8 +1616,8 @@ void lim_process_action_frame(struct mac_context *mac_ctx,
 	}
 
 #ifdef WLAN_FEATURE_11W
-	if (lim_is_robust_mgmt_action_frame(action_hdr->category) &&
-	   lim_drop_unprotected_action_frame(mac_ctx, session,
+	if (wlan_mgmt_is_rmf_mgmt_action_frame(action_hdr->category) &&
+	    lim_drop_unprotected_action_frame(mac_ctx, session,
 			mac_hdr_11w, action_hdr->category))
 		return;
 #endif
@@ -1818,6 +1817,7 @@ void lim_process_action_frame(struct mac_context *mac_ctx,
 		break;
 
 	case SIR_MAC_ACTION_VENDOR_SPECIFIC_CATEGORY:
+	case SIR_MAC_PROT_ACTION_VENDOR_SPECIFIC_CATEGORY:
 		vendor_specific = (tpSirMacVendorSpecificFrameHdr) action_hdr;
 		mac_hdr = NULL;
 
@@ -1829,12 +1829,9 @@ void lim_process_action_frame(struct mac_context *mac_ctx,
 			return;
 		}
 
-		/* Check if it is a vendor specific action frame. */
-		if (LIM_IS_STA_ROLE(session) &&
-		    (!qdf_mem_cmp(session->self_mac_addr,
-					&mac_hdr->da[0], sizeof(tSirMacAddr)))
-		    && IS_WES_MODE_ENABLED(mac_ctx)
-		    && !qdf_mem_cmp(vendor_specific->Oui, oui, 3)) {
+		/* Forward all vendor specific action frames. */
+		if (!qdf_mem_cmp(session->self_mac_addr,
+				 &mac_hdr->da[0], sizeof(tSirMacAddr))) {
 			pe_debug("Rcvd Vendor specific frame OUI: %x %x %x",
 				vendor_specific->Oui[0],
 				vendor_specific->Oui[1],
@@ -1854,16 +1851,8 @@ void lim_process_action_frame(struct mac_context *mac_ctx,
 					WMA_GET_RX_RSSI_NORMALIZED(
 					rx_pkt_info), RXMGMT_FLAG_NONE);
 		} else {
-			pe_debug("Dropping the vendor specific action frame"
-					"beacause of (WES Mode not enabled "
-					"(WESMODE: %d) or OUI mismatch "
-					"(%02x %02x %02x) or not received with"
-					"SelfSta address) system role: %d",
-				IS_WES_MODE_ENABLED(mac_ctx),
-				vendor_specific->Oui[0],
-				vendor_specific->Oui[1],
-				vendor_specific->Oui[2],
-				GET_LIM_SYSTEM_ROLE(session));
+			pe_debug("Dropping the vendor specific action frame SelfSta address system role: %d",
+				 GET_LIM_SYSTEM_ROLE(session));
 		}
 	break;
 	case ACTION_CATEGORY_PUBLIC:
@@ -1896,11 +1885,15 @@ void lim_process_action_frame(struct mac_context *mac_ctx,
 			/* send the frame to supplicant */
 			/* fallthrough */
 		case SIR_MAC_ACTION_VENDOR_SPECIFIC_CATEGORY:
+		case SIR_MAC_PROT_ACTION_VENDOR_SPECIFIC_CATEGORY:
 		case SIR_MAC_ACTION_2040_BSS_COEXISTENCE:
 		case SIR_MAC_ACTION_GAS_INITIAL_REQUEST:
 		case SIR_MAC_ACTION_GAS_INITIAL_RESPONSE:
 		case SIR_MAC_ACTION_GAS_COMEBACK_REQUEST:
 		case SIR_MAC_ACTION_GAS_COMEBACK_RESPONSE:
+		default:
+			pe_debug("Public action frame: %d",
+				 action_hdr->actionID);
 			/*
 			 * Forward to the SME to HDD to wpa_supplicant
 			 * type is ACTION
@@ -1914,10 +1907,6 @@ void lim_process_action_frame(struct mac_context *mac_ctx,
 					WMA_GET_RX_RSSI_NORMALIZED(
 					rx_pkt_info), RXMGMT_FLAG_NONE);
 			break;
-		default:
-			pe_debug("Unhandled public action frame: %d",
-				 action_hdr->actionID);
-			break;
 		}
 		break;
 
diff --git a/core/mac/src/pe/lim/lim_timer_utils.c b/core/mac/src/pe/lim/lim_timer_utils.c
index a43ba3293280..2e3892e5293c 100644
--- a/core/mac/src/pe/lim/lim_timer_utils.c
+++ b/core/mac/src/pe/lim/lim_timer_utils.c
@@ -751,11 +751,16 @@ lim_deactivate_and_change_per_sta_id_timer(struct mac_context *mac, uint32_t tim
 	switch (timerId) {
 	case eLIM_CNF_WAIT_TIMER:
 
-		if (tx_timer_deactivate
-			    (&mac->lim.lim_timers.gpLimCnfWaitTimer[staId])
-		    != TX_SUCCESS) {
+		if (staId >= (mac->lim.maxStation + 1)) {
+			pe_err("Invalid staId = %d ", staId);
+			return;
+		}
+
+		if (tx_timer_deactivate(&mac->lim.lim_timers.gpLimCnfWaitTimer[staId])
+					!= TX_SUCCESS) {
 			pe_err("unable to deactivate CNF wait timer");
 		}
+
 		/* Change timer to reactivate it in future */
 		val = mac->mlme_cfg->sta.wait_cnf_timeout;
 		val = SYS_MS_TO_TICKS(val);
diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c
index d456c3f29f4c..6e85825a8c3f 100644
--- a/core/mac/src/pe/lim/lim_utils.c
+++ b/core/mac/src/pe/lim/lim_utils.c
@@ -6652,46 +6652,6 @@ void lim_update_obss_scanparams(struct pe_session *session,
 	return;
 }
 
-/**
- * lim_is_robust_mgmt_action_frame() - Check if action category is
- * robust action frame
- * @action_category: Action frame category.
- *
- * This function is used to check if given action category is robust
- * action frame.
- *
- * Return: bool
- */
-bool lim_is_robust_mgmt_action_frame(uint8_t action_category)
-{
-	switch (action_category) {
-	/*
-	 * NOTE: This function doesn't take care of the DMG
-	 * (Directional Multi-Gigatbit) BSS case as 8011ad
-	 * support is not yet added. In future, if the support
-	 * is required then this function need few more arguments
-	 * and little change in logic.
-	 */
-	case ACTION_CATEGORY_SPECTRUM_MGMT:
-	case ACTION_CATEGORY_QOS:
-	case ACTION_CATEGORY_DLS:
-	case ACTION_CATEGORY_BACK:
-	case ACTION_CATEGORY_RRM:
-	case ACTION_FAST_BSS_TRNST:
-	case ACTION_CATEGORY_SA_QUERY:
-	case ACTION_CATEGORY_PROTECTED_DUAL_OF_PUBLIC_ACTION:
-	case ACTION_CATEGORY_WNM:
-	case ACTION_CATEGORY_MESH_ACTION:
-	case ACTION_CATEGORY_MULTIHOP_ACTION:
-	case ACTION_CATEGORY_FST:
-		return true;
-	default:
-		pe_debug("non-PMF action category: %d", action_category);
-		break;
-	}
-	return false;
-}
-
 /**
  * lim_compute_ext_cap_ie_length - compute the length of ext cap ie
  * based on the bits set
diff --git a/core/mac/src/pe/lim/lim_utils.h b/core/mac/src/pe/lim/lim_utils.h
index 6126ac888c27..6b2e0103741b 100644
--- a/core/mac/src/pe/lim/lim_utils.h
+++ b/core/mac/src/pe/lim/lim_utils.h
@@ -1081,7 +1081,6 @@ static inline void lim_deactivate_and_change_timer_host_roam(
 {}
 #endif
 
-bool lim_is_robust_mgmt_action_frame(uint8_t action_category);
 uint8_t lim_compute_ext_cap_ie_length(tDot11fIEExtCap *ext_cap);
 
 void lim_update_caps_info_for_bss(struct mac_context *mac_ctx,
diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 2d5aaeb43567..854b6c35a72e 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -21017,17 +21017,21 @@ static bool csr_is_sae_single_pmk_vsie_ap(struct bss_description *bss_des)
  * @mac_ctx: mac context
  * @session: Session
  * @vdev_id: session id
+ * @psk_pmk: pmk of roamed AP
+ * @pmk_len: pmk length
  *
  * Return: True if same pmk IE is present
  */
 static void
 csr_check_and_set_sae_single_pmk_cap(struct mac_context *mac_ctx,
 				     struct csr_roam_session *session,
-				     uint8_t vdev_id)
+				     uint8_t vdev_id, uint8_t *psk_pmk,
+				     uint8_t pmk_len)
 {
 	struct wlan_objmgr_vdev *vdev;
 	struct mlme_pmk_info *pmk_info;
 	tPmkidCacheInfo *pmkid_cache;
+	struct wlan_crypto_pmksa *roam_sync_pmksa;
 	int32_t keymgmt;
 	bool val, lookup_success;
 
@@ -21052,9 +21056,28 @@ csr_check_and_set_sae_single_pmk_cap(struct mac_context *mac_ctx,
 		if (!val)
 			goto end;
 
-		wlan_crypto_set_sae_single_pmk_bss_cap(vdev,
-		   (struct qdf_mac_addr *)session->pConnectBssDesc->bssId,
-		   true);
+		roam_sync_pmksa = qdf_mem_malloc(sizeof(*roam_sync_pmksa));
+		if (roam_sync_pmksa) {
+			qdf_copy_macaddr(&roam_sync_pmksa->bssid,
+					 (struct qdf_mac_addr *)
+					 &session->pConnectBssDesc->bssId);
+			roam_sync_pmksa->single_pmk_supported = true;
+			roam_sync_pmksa->pmk_len = pmk_len;
+			qdf_mem_copy(roam_sync_pmksa->pmk, psk_pmk,
+				     roam_sync_pmksa->pmk_len);
+			sme_debug("SPMK received for " QDF_MAC_ADDR_FMT
+				  "pmk_len:%d", QDF_MAC_ADDR_REF(
+				  roam_sync_pmksa->bssid.bytes),
+				  roam_sync_pmksa->pmk_len);
+			/* update single pmk info for roamed ap to pmk table */
+			wlan_crypto_set_sae_single_pmk_info(vdev,
+							    roam_sync_pmksa);
+
+			qdf_mem_zero(roam_sync_pmksa, sizeof(*roam_sync_pmksa));
+			qdf_mem_free(roam_sync_pmksa);
+		} else {
+			goto end;
+		}
 
 		pmkid_cache = qdf_mem_malloc(sizeof(*pmkid_cache));
 		if (!pmkid_cache)
@@ -21107,7 +21130,8 @@ end:
 static inline void
 csr_check_and_set_sae_single_pmk_cap(struct mac_context *mac_ctx,
 				     struct csr_roam_session *session,
-				     uint8_t vdev_id)
+				     uint8_t vdev_id, uint8_t *psk_pmk,
+				     uint8_t pmk_len)
 {
 }
 #endif
@@ -21330,8 +21354,12 @@ csr_process_roam_sync_callback(struct mac_context *mac_ctx,
 			mac_ctx->psoc);
 		mac_ctx->sme.set_connection_info_cb(false);
 
-		csr_check_and_set_sae_single_pmk_cap(mac_ctx, session,
-						     session_id);
+		if (roam_synch_data->pmk_len)
+			csr_check_and_set_sae_single_pmk_cap(
+						mac_ctx, session,
+						session_id,
+						roam_synch_data->pmk,
+						roam_synch_data->pmk_len);
 
 		if (ucfg_pkt_capture_get_pktcap_mode(mac_ctx->psoc))
 			ucfg_pkt_capture_record_channel(vdev);
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index 68da62cca50f..507fd43a2967 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -2538,6 +2538,16 @@ QDF_STATUS wma_post_vdev_create_setup(struct wlan_objmgr_vdev *vdev)
 				 status);
 	}
 
+	wma_debug("Setting WMI_VDEV_PARAM_WMM_TXOP_ENABLE: %d",
+		  mac->mlme_cfg->edca_params.enable_wmm_txop);
+
+	status  = wma_vdev_set_param(wma_handle->wmi_handle, vdev_id,
+				WMI_VDEV_PARAM_WMM_TXOP_ENABLE,
+				mac->mlme_cfg->edca_params.enable_wmm_txop);
+
+	if (QDF_IS_STATUS_ERROR(status))
+		wma_err("failed to set WMM TXOP (status = %d)", status);
+
 	wma_debug("Setting WMI_VDEV_PARAM_DISCONNECT_TH: %d",
 		 mac->mlme_cfg->gen.dropped_pkt_disconnect_thresh);
 	status  = wma_vdev_set_param(
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c
index 63cc777ef924..19dc459dbe44 100644
--- a/core/wma/src/wma_scan_roam.c
+++ b/core/wma/src/wma_scan_roam.c
@@ -4723,6 +4723,8 @@ int wma_roam_event_callback(WMA_HANDLE handle, uint8_t *event_buf,
 			  QDF_MAC_ADDR_REF(bssid.bytes));
 		wma_handle_hw_mode_transition(wma_handle, param_buf);
 		wma_roam_ho_fail_handler(wma_handle, wmi_event->vdev_id, bssid);
+		wma_handle->interfaces[wmi_event->vdev_id].roaming_in_progress
+									= false;
 		lim_sae_auth_cleanup_retry(wma_handle->mac_context,
 					   wmi_event->vdev_id);
 		break;
diff --git a/os_if/nan/src/os_if_nan.c b/os_if/nan/src/os_if_nan.c
index a703a6730218..9a5996463cbd 100644
--- a/os_if/nan/src/os_if_nan.c
+++ b/os_if/nan/src/os_if_nan.c
@@ -37,6 +37,7 @@
 #include "wlan_utility.h"
 #include "wlan_osif_request_manager.h"
 #include "wlan_mlme_ucfg_api.h"
+#include "wlan_tdls_ucfg_api.h"
 
 #define NAN_CMD_MAX_SIZE 2048
 
@@ -2624,15 +2625,15 @@ int os_if_process_nan_req(struct wlan_objmgr_psoc *psoc, uint8_t vdev_id,
 	}
 
 	/*
-	 * If target does not support NAN DBS, send request with type GENERIC.
-	 * These will be treated as passthrough by the driver. This is to make
-	 * sure that HW mode is not set to DBS by NAN Enable request. NAN state
-	 * machine will remain unaffected in this case.
+	 * If target does not support NAN DBS, stop the opportunistic timer.
+	 * Opportunistic timer gets triggered as soon as a DBS use case is
+	 * completed and hw_mode would be set to SMM when the timer(5 seconds)
+	 * expires.
+	 * This is to make sure that HW mode is not set to DBS by NAN Enable
+	 * request. NAN state machine will remain unaffected in this case.
 	 */
-	if (!NAN_CONCURRENCY_SUPPORTED(psoc)) {
+	if (!NAN_CONCURRENCY_SUPPORTED(psoc))
 		policy_mgr_check_and_stop_opportunistic_timer(psoc, vdev_id);
-		return os_if_nan_generic_req(psoc, tb);
-	}
 
 	/*
 	 * Send all requests other than Enable/Disable as type GENERIC.