diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
index a8987a6..be6fc5d 100644
--- a/wpa_supplicant/config.c
+++ b/wpa_supplicant/config.c
@@ -4757,6 +4757,7 @@
 	{ INT(p2p_device_random_mac_addr), 0 },
 	{ STR(p2p_device_persistent_mac_addr), 0 },
 	{ INT(p2p_interface_random_mac_addr), 0 },
+	{ INT_RANGE(bss_no_flush_when_down, 0, 1), 0 },
 };
 
 #undef FUNC
diff --git a/wpa_supplicant/config.h b/wpa_supplicant/config.h
index ee20a93..e431b9c 100644
--- a/wpa_supplicant/config.h
+++ b/wpa_supplicant/config.h
@@ -1499,6 +1499,13 @@
 	 */
 	int p2p_interface_random_mac_addr;
 
+	/**
+	 * bss_no_flush_when_down - Whether to flush BSS entries when the interface is disabled
+	 *
+	 * 0 = Flush BSS entries when the interface becomes disabled (Default)
+	 * 1 = Do not flush BSS entries when the interface becomes disabled
+	 */
+	int bss_no_flush_when_down;
 };
 
 
diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index 3a6dae5..1cdfbc2 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -1520,6 +1520,9 @@
 	if (config->p2p_interface_random_mac_addr)
 		fprintf(f, "p2p_interface_random_mac_addr=%d\n",
 			config->p2p_interface_random_mac_addr);
+	if (config->bss_no_flush_when_down)
+		fprintf(f, "bss_no_flush_when_down=%d\n",
+			config->bss_no_flush_when_down);
 
 }
 
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 29fb7ec..7eb25ea 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -4569,7 +4569,8 @@
 				wpa_s, WLAN_REASON_DEAUTH_LEAVING, 1);
 		}
 		wpa_supplicant_mark_disassoc(wpa_s);
-		wpa_bss_flush(wpa_s);
+		if (!wpa_s->conf->bss_no_flush_when_down)
+			wpa_bss_flush(wpa_s);
 		radio_remove_works(wpa_s, NULL, 0);
 
 		wpa_supplicant_set_state(wpa_s, WPA_INTERFACE_DISABLED);
diff --git a/wpa_supplicant/hidl/1.2/hidl_manager.cpp b/wpa_supplicant/hidl/1.2/hidl_manager.cpp
index 62fb9aa..c6fe92f 100644
--- a/wpa_supplicant/hidl/1.2/hidl_manager.cpp
+++ b/wpa_supplicant/hidl/1.2/hidl_manager.cpp
@@ -504,12 +504,14 @@
 		// Turn on Android specific customizations for STA interfaces
 		// here!
 		//
-		// Turn on scan randomization.
-		if (wpas_mac_addr_rand_scan_set(
-			wpa_s, MAC_ADDR_RAND_SCAN, nullptr, nullptr)) {
-			wpa_printf(
-			    MSG_ERROR,
-			    "Failed to enable scan mac randomization");
+		// Turn on scan mac randomization only if driver supports.
+		if (wpa_s->mac_addr_rand_supported & MAC_ADDR_RAND_SCAN) {
+			if (wpas_mac_addr_rand_scan_set(
+				wpa_s, MAC_ADDR_RAND_SCAN, nullptr, nullptr)) {
+				wpa_printf(
+				    MSG_ERROR,
+				    "Failed to enable scan mac randomization");
+			}
 		}
 	}
 
diff --git a/wpa_supplicant/hidl/1.2/hidl_manager.h b/wpa_supplicant/hidl/1.2/hidl_manager.h
index e0038ae..7291347 100644
--- a/wpa_supplicant/hidl/1.2/hidl_manager.h
+++ b/wpa_supplicant/hidl/1.2/hidl_manager.h
@@ -357,6 +357,14 @@
 	WPA_KEY_MGMT_OWE,
     "KeyMgmt value mismatch");
 static_assert(
+    static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::WPA_PSK_SHA256) ==
+	WPA_KEY_MGMT_PSK_SHA256,
+    "KeyMgmt value mismatch");
+static_assert(
+    static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::WPA_EAP_SHA256) ==
+	WPA_KEY_MGMT_IEEE8021X_SHA256,
+    "KeyMgmt value mismatch");
+static_assert(
     static_cast<uint32_t>(ISupplicantStaNetwork::ProtoMask::WPA) ==
 	WPA_PROTO_WPA,
     "Proto value mismatch");
diff --git a/wpa_supplicant/hidl/1.2/sta_network.cpp b/wpa_supplicant/hidl/1.2/sta_network.cpp
index 944c4a9..cf15909 100644
--- a/wpa_supplicant/hidl/1.2/sta_network.cpp
+++ b/wpa_supplicant/hidl/1.2/sta_network.cpp
@@ -34,7 +34,9 @@
      static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::OSEN) |
      static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::SAE) |
      static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::SUITE_B_192) |
-     static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::OWE));
+     static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::OWE) |
+     static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::WPA_PSK_SHA256) |
+     static_cast<uint32_t>(ISupplicantStaNetwork::KeyMgmtMask::WPA_EAP_SHA256));
 constexpr uint32_t kAllowedProtoMask =
     (static_cast<uint32_t>(ISupplicantStaNetwork::ProtoMask::WPA) |
      static_cast<uint32_t>(ISupplicantStaNetwork::ProtoMask::RSN) |