qcacld-3.0: UMAC Converged driver init/deinit with mgmt txrx comp

MCL driver interactions with mgmt txrx component in init deinit
of driver. Also, changes to make legacy path to go through mgmt
txrx component for both tx and rx mgmt. frames.

Change-Id: Icf368358fef3b9204bed5195a2502b0ea5f052d8
CRs-Fixed: 1103247
diff --git a/Kbuild b/Kbuild
index 916015a..63cc47a 100644
--- a/Kbuild
+++ b/Kbuild
@@ -764,6 +764,18 @@
 		$(UMAC_OBJMGR_DIR)/src/wlan_objmgr_psoc_obj.o \
 		$(UMAC_OBJMGR_DIR)/src/wlan_objmgr_vdev_obj.o
 
+
+###########  UMAC MGMT TXRX ##########
+UMAC_MGMT_TXRX_DIR := $(WLAN_COMMON_ROOT)/umac/cmn_services/mgmt_txrx
+
+UMAC_MGMT_TXRX_INC := -I$(WLAN_COMMON_INC)/umac/cmn_services/mgmt_txrx/core/src \
+	-I$(WLAN_COMMON_INC)/umac/cmn_services/mgmt_txrx/dispatcher/inc \
+	-I$(WLAN_COMMON_INC)/umac/cmn_services/mgmt_txrx/dispatcher/src
+
+UMAC_MGMT_TXRX_OBJS := $(UMAC_MGMT_TXRX_DIR)/core/src/wlan_mgmt_txrx_main.o \
+	$(UMAC_MGMT_TXRX_DIR)/dispatcher/src/wlan_mgmt_txrx_utils_api.o \
+	$(UMAC_MGMT_TXRX_DIR)/dispatcher/src/wlan_mgmt_txrx_tgt_api.o
+
 ########### BMI ###########
 BMI_DIR := core/bmi
 
@@ -1110,6 +1122,7 @@
 		$(HAL_INC)
 
 INCS +=		$(UMAC_OBJMGR_INC)
+INCS +=		$(UMAC_MGMT_TXRX_INC)
 INCS +=		$(TARGET_INC)
 
 INCS +=		$(NLINK_INC) \
@@ -1153,6 +1166,7 @@
 		$(HAL_OBJS)
 
 OBJS +=		$(UMAC_OBJMGR_OBJS)
+OBJS +=		$(UMAC_MGMT_TXRX_OBJS)
 OBJS +=		$(WLAN_LOGGING_OBJS)
 OBJS +=		$(NLINK_OBJS)
 OBJS +=		$(PTT_OBJS)
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index 4167b83..39e2159 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -10010,6 +10010,7 @@
 		wlan_objmgr_vdev_obj_delete(vdev);
 		return QDF_STATUS_E_FAILURE;
 	}
+	wlan_objmgr_peer_ref_peer(peer);
 	adapter->hdd_vdev = vdev;
 
 	return QDF_STATUS_SUCCESS;
diff --git a/core/mac/src/pe/include/lim_api.h b/core/mac/src/pe/include/lim_api.h
index e06a255..f59fcf8 100644
--- a/core/mac/src/pe/include/lim_api.h
+++ b/core/mac/src/pe/include/lim_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -125,6 +125,31 @@
 tSirRetStatus peProcessMsg(tpAniSirGlobal pMac, tSirMsgQ *limMsg);
 
 /**
+ * pe_register_mgmt_rx_frm_callback() - registers callback for receiving
+ *                                      mgmt rx frames
+ * @mac_ctx: mac global ctx
+ *
+ * This function registers a PE function to mgmt txrx component and a WMA
+ * function to WMI layer as event handler for receiving mgmt frames.
+ *
+ * Return: None
+ */
+void pe_register_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx);
+
+/**
+ * pe_deregister_mgmt_rx_frm_callback() - degisters callback for receiving
+ *                                        mgmt rx frames
+ * @mac_ctx: mac global ctx
+ *
+ * This function deregisters the PE function registered to mgmt txrx component
+ * and the WMA function registered to WMI layer as event handler for receiving
+ * mgmt frames.
+ *
+ * Return: None
+ */
+void pe_deregister_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx);
+
+/**
  * pe_register_callbacks_with_wma() - register SME and PE callback functions to
  * WMA.
  * @pMac: mac global ctx
diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c
index b6b0aee..2877594 100644
--- a/core/mac/src/pe/lim/lim_api.c
+++ b/core/mac/src/pe/lim/lim_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -70,6 +70,9 @@
 #include "sys_startup.h"
 #include "cds_concurrency.h"
 #include "nan_datapath.h"
+#include "wma.h"
+#include "wlan_mgmt_txrx_utils_api.h"
+#include "wlan_objmgr_psoc_obj.h"
 
 static void __lim_init_scan_vars(tpAniSirGlobal pMac)
 {
@@ -613,6 +616,8 @@
 
 	struct mgmt_frm_reg_info *pLimMgmtRegistration = NULL;
 
+	pe_deregister_mgmt_rx_frm_callback(pMac);
+
 	if (QDF_GLOBAL_FTM_MODE != cds_get_conparam()) {
 		qdf_mutex_acquire(&pMac->lim.lim_frame_register_lock);
 		while (qdf_list_remove_front(
@@ -1004,23 +1009,22 @@
 
 /* --------------------------------------------------------------------------- */
 /**
- * pe_handle_mgmt_frame
+ * pe_handle_mgmt_frame() - Process the Management frames from TXRX
+ * @psoc: psoc context
+ * @peer: peer
+ * @buf: buffer
+ * @mgmt_rx_params; rx event params
+ * @frm_type: frame type
  *
- * FUNCTION:
- *    Process the Management frames from TL
+ * This function handles the mgmt rx frame from mgmt txrx component and forms
+ * a cds packet and schedule it in controller thread for further processing.
  *
- * LOGIC:
- *
- * ASSUMPTIONS: TL sends the packet along with the CDS GlobalContext
- *
- * NOTE:
- *
- * @param p_cds_gctx  Global Vos Context
- * @param cds_buff  Packet
- * @return None
+ * Return: QDF_STATUS_SUCCESS - in case of success
  */
-
-static QDF_STATUS pe_handle_mgmt_frame(void *p_cds_gctx, void *cds_buff)
+static QDF_STATUS pe_handle_mgmt_frame(struct wlan_objmgr_psoc *psoc,
+			struct wlan_objmgr_peer *peer, qdf_nbuf_t buf,
+			void *mgmt_rx_params,
+			uint32_t frm_type)
 {
 	tpAniSirGlobal pMac;
 	tpSirMacMgmtHdr mHdr;
@@ -1028,17 +1032,27 @@
 	cds_pkt_t *pVosPkt;
 	QDF_STATUS qdf_status;
 	uint8_t *pRxPacketInfo;
-
-	pVosPkt = (cds_pkt_t *) cds_buff;
-	if (NULL == pVosPkt) {
-		return QDF_STATUS_E_FAILURE;
-	}
+	int ret;
 
 	pMac = cds_get_context(QDF_MODULE_ID_PE);
 	if (NULL == pMac) {
 		/* cannot log a failure without a valid pMac */
-		cds_pkt_return_packet(pVosPkt);
-		pVosPkt = NULL;
+		qdf_nbuf_free(buf);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	pVosPkt = qdf_mem_malloc(sizeof(*pVosPkt));
+	if (!pVosPkt) {
+		lim_log(pMac, LOGP,
+			FL("Failed to allocate rx packet"));
+		qdf_nbuf_free(buf);
+		return QDF_STATUS_E_NOMEM;
+	}
+
+	ret = wma_form_rx_packet(buf, mgmt_rx_params, pVosPkt);
+	if (ret) {
+		lim_log(pMac, LOGP,
+			FL("Failed to fill cds packet from event buffer"));
 		return QDF_STATUS_E_FAILURE;
 	}
 
@@ -1079,7 +1093,7 @@
 
 	/* Forward to MAC via mesg = SIR_BB_XPORT_MGMT_MSG */
 	msg.type = SIR_BB_XPORT_MGMT_MSG;
-	msg.bodyptr = cds_buff;
+	msg.bodyptr = pVosPkt;
 	msg.bodyval = 0;
 
 	if (eSIR_SUCCESS != sys_bbt_process_message_core(pMac,
@@ -1094,6 +1108,43 @@
 	return QDF_STATUS_SUCCESS;
 }
 
+void pe_register_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx)
+{
+	QDF_STATUS status;
+	struct mgmt_txrx_mgmt_frame_cb_info frm_cb_info;
+
+	frm_cb_info.frm_type = MGMT_FRAME_TYPE_ALL;
+	frm_cb_info.mgmt_rx_cb = (mgmt_frame_rx_callback)
+				pe_handle_mgmt_frame;
+
+	status = wlan_mgmt_txrx_register_rx_cb(mac_ctx->psoc,
+					 WLAN_UMAC_COMP_MLME, &frm_cb_info, 1);
+	if (status != QDF_STATUS_SUCCESS)
+		lim_log(mac_ctx, LOGP,
+			FL("Registering the PE Handle with MGMT TXRX layer has failed"));
+
+	wma_register_mgmt_frm_client();
+}
+
+void pe_deregister_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx)
+{
+	QDF_STATUS status;
+	struct mgmt_txrx_mgmt_frame_cb_info frm_cb_info;
+
+	frm_cb_info.frm_type = MGMT_FRAME_TYPE_ALL;
+	frm_cb_info.mgmt_rx_cb = (mgmt_frame_rx_callback)
+				pe_handle_mgmt_frame;
+
+	status = wlan_mgmt_txrx_deregister_rx_cb(mac_ctx->psoc,
+					 WLAN_UMAC_COMP_MLME, &frm_cb_info, 1);
+	if (status != QDF_STATUS_SUCCESS)
+		lim_log(mac_ctx, LOGP,
+			FL("Deregistering the PE Handle with MGMT TXRX layer has failed"));
+
+	wma_de_register_mgmt_frm_client();
+}
+
+
 /**
  * pe_register_callbacks_with_wma() - register SME and PE callback functions to
  * WMA.
@@ -1107,12 +1158,6 @@
 
 	p_cds_gctx = cds_get_global_context();
 
-	retStatus = wma_register_mgmt_frm_client(p_cds_gctx,
-				 pe_handle_mgmt_frame);
-	if (retStatus != QDF_STATUS_SUCCESS)
-		lim_log(pMac, LOGP,
-			FL("Registering the PE Handle with WMA has failed"));
-
 	retStatus = wma_register_roaming_callbacks(p_cds_gctx,
 			ready_req->csr_roam_synch_cb,
 			ready_req->pe_roam_synch_cb);
diff --git a/core/mac/src/pe/lim/lim_p2p.c b/core/mac/src/pe/lim/lim_p2p.c
index 4109854..4e80991 100644
--- a/core/mac/src/pe/lim/lim_p2p.c
+++ b/core/mac/src/pe/lim/lim_p2p.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -359,9 +359,8 @@
 
 	/* If remain on channel timer expired and action frame is pending then
 	 * indicaiton confirmation with status failure */
-	if (pMac->lim.mgmtFrameSessionId != 0xff) {
-		lim_p2p_action_cnf(pMac, false);
-	}
+	if (pMac->lim.mgmtFrameSessionId != 0xff)
+		lim_p2p_action_cnf(pMac, NULL, false, NULL);
 
 	return;
 }
@@ -407,11 +406,13 @@
 	return;
 }
 
-QDF_STATUS lim_p2p_action_cnf(tpAniSirGlobal pMac, uint32_t tx_status)
+QDF_STATUS lim_p2p_action_cnf(void *context, qdf_nbuf_t buf,
+			      uint32_t tx_status, void *params)
 {
 	QDF_STATUS status;
 	uint32_t mgmt_frame_sessionId;
 	bool tx_complete_ack = (tx_status) ? false : true;
+	tpAniSirGlobal pMac = (tpAniSirGlobal)context;
 
 	status = pe_acquire_global_lock(&pMac->lim);
 	if (QDF_IS_STATUS_SUCCESS(status)) {
@@ -477,9 +478,9 @@
 			channel_freq);
 
 		if (!mb_msg->noack)
-			lim_p2p_action_cnf(mac_ctx,
+			lim_p2p_action_cnf(mac_ctx, packet,
 				(QDF_IS_STATUS_SUCCESS(qdf_status)) ?
-				true : false);
+				true : false, NULL);
 		mac_ctx->lim.mgmtFrameSessionId = 0xff;
 	} else {
 		qdf_status =
@@ -494,7 +495,7 @@
 		if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
 			lim_log(mac_ctx, LOGE,
 				FL("couldn't send action frame"));
-			lim_p2p_action_cnf(mac_ctx, false);
+			lim_p2p_action_cnf(mac_ctx, packet, false, NULL);
 			mac_ctx->lim.mgmtFrameSessionId = 0xff;
 		} else {
 			mac_ctx->lim.mgmtFrameSessionId = mb_msg->sessionId;
@@ -549,7 +550,7 @@
 		lim_log(mac_ctx, LOGE,
 			FL("RemainOnChannel is not running"));
 		mac_ctx->lim.mgmtFrameSessionId = mb_msg->sessionId;
-		lim_p2p_action_cnf(mac_ctx, false);
+		lim_p2p_action_cnf(mac_ctx, NULL, false, NULL);
 		mac_ctx->lim.mgmtFrameSessionId = 0xff;
 		return;
 	}
diff --git a/core/mac/src/pe/lim/lim_process_message_queue.c b/core/mac/src/pe/lim/lim_process_message_queue.c
index 7ac7688..05e31fd 100644
--- a/core/mac/src/pe/lim/lim_process_message_queue.c
+++ b/core/mac/src/pe/lim/lim_process_message_queue.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1821,10 +1821,10 @@
 		msg->bodyptr = NULL;
 		break;
 	case WMA_DISASSOC_TX_COMP:
-		lim_disassoc_tx_complete_cnf(mac_ctx, msg->bodyval);
+		lim_disassoc_tx_complete_cnf(mac_ctx, NULL, msg->bodyval, NULL);
 		break;
 	case WMA_DEAUTH_TX_COMP:
-		lim_deauth_tx_complete_cnf(mac_ctx, msg->bodyval);
+		lim_deauth_tx_complete_cnf(mac_ctx, NULL, msg->bodyval, NULL);
 		break;
 #ifdef FEATURE_AP_MCC_CH_AVOIDANCE
 	case WMA_UPDATE_Q2Q_IE_IND:
diff --git a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
index 5303a90..44374ba 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -3309,7 +3309,7 @@
 			 * failure.
 			 */
 			if (pMac->lim.mgmtFrameSessionId != 0xff) {
-				lim_p2p_action_cnf(pMac, false);
+				lim_p2p_action_cnf(pMac, NULL, false, NULL);
 				pMac->lim.mgmtFrameSessionId = 0xff;
 			}
 		} else if (PREAUTH_REQUESTOR_ID == pScanEvent->requestor) {
diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index a153139..4efaa0e 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -553,6 +553,7 @@
 
 	if (ANI_DRIVER_TYPE(pMac) != eDRIVER_TYPE_MFG) {
 		ready_req->pe_roam_synch_cb = pe_roam_synch_callback;
+		pe_register_mgmt_rx_frm_callback(pMac);
 		pe_register_callbacks_with_wma(pMac, ready_req);
 		pMac->lim.add_bssdescr_callback = ready_req->add_bssdescr_cb;
 	}
diff --git a/core/mac/src/pe/lim/lim_process_tdls.c b/core/mac/src/pe/lim/lim_process_tdls.c
index 3260a8b..53bcfbc 100644
--- a/core/mac/src/pe/lim/lim_process_tdls.c
+++ b/core/mac/src/pe/lim/lim_process_tdls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -502,17 +502,22 @@
 
 /**
  * lim_mgmt_tdls_tx_complete - callback to indicate Tx completion
- * @mac_ctx: pointer to mac structure
+ * @context: pointer to mac structure
+ * @buf: buffer
  * @tx_complete: indicates tx sucess/failure
+ * @params: tx completion params
  *
  * function will be invoked on receiving tx completion indication
  *
  * return: success: eHAL_STATUS_SUCCESS failure: eHAL_STATUS_FAILURE
  */
-static QDF_STATUS lim_mgmt_tdls_tx_complete(tpAniSirGlobal mac_ctx,
-					    uint32_t tx_complete)
+static QDF_STATUS lim_mgmt_tdls_tx_complete(void *context,
+					    qdf_nbuf_t buf,
+					    uint32_t tx_complete,
+					    void *params)
 {
 	tpPESession session_entry = NULL;
+	tpAniSirGlobal mac_ctx = (tpAniSirGlobal)context;
 
 	lim_log(mac_ctx, LOG1, FL("tdls_frm_session_id %x tx_complete %x"),
 		mac_ctx->lim.tdls_frm_session_id, tx_complete);
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c
index 8db860f..09271f4 100644
--- a/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -2007,16 +2007,21 @@
 
 /**
  * lim_auth_tx_complete_cnf()- Confirmation for auth sent over the air
- *
- * @mac_ctx: pointer to global mac
+ * @context: pointer to global mac
+ * @buf: buffer
  * @tx_complete : Sent status
+ * @params; tx completion params
  *
  * Return: This returns QDF_STATUS
  */
 
-static QDF_STATUS lim_auth_tx_complete_cnf(tpAniSirGlobal mac_ctx,
-					   uint32_t tx_complete)
+static QDF_STATUS lim_auth_tx_complete_cnf(void *context,
+					   qdf_nbuf_t buf,
+					   uint32_t tx_complete,
+					   void *params)
 {
+	tpAniSirGlobal mac_ctx = (tpAniSirGlobal)context;
+
 	lim_log(mac_ctx, LOG1,
 		 FL("tx_complete= %d"), tx_complete);
 	if (tx_complete) {
@@ -2542,17 +2547,25 @@
 	return QDF_STATUS_SUCCESS;
 }
 
-QDF_STATUS lim_disassoc_tx_complete_cnf(tpAniSirGlobal pMac,
-					uint32_t txCompleteSuccess)
+QDF_STATUS lim_disassoc_tx_complete_cnf(void *context,
+					qdf_nbuf_t buf,
+					uint32_t txCompleteSuccess,
+					void *params)
 {
+	tpAniSirGlobal pMac = (tpAniSirGlobal)context;
+
 	lim_log(pMac, LOG1,
 		FL("txCompleteSuccess: %d"), txCompleteSuccess);
 	return lim_send_disassoc_cnf(pMac);
 }
 
-QDF_STATUS lim_deauth_tx_complete_cnf(tpAniSirGlobal pMac,
-				      uint32_t txCompleteSuccess)
+QDF_STATUS lim_deauth_tx_complete_cnf(void *context,
+				      qdf_nbuf_t buf,
+				      uint32_t txCompleteSuccess,
+				      void *params)
 {
+	tpAniSirGlobal pMac = (tpAniSirGlobal)context;
+
 	lim_log(pMac, LOG1,
 		FL("txCompleteSuccess: %d"), txCompleteSuccess);
 	return lim_send_deauth_cnf(pMac);
@@ -3554,16 +3567,22 @@
  * lim_oper_chan_change_confirm_tx_complete_cnf()- Confirmation for oper_chan_change_confirm
  * sent over the air
  *
- * @mac_ctx: pointer to global mac
+ * @context: pointer to global mac
+ * @buf: buffer
  * @tx_complete : Sent status
+ * @params: tx completion params
  *
  * Return: This returns QDF_STATUS
  */
 
 static QDF_STATUS lim_oper_chan_change_confirm_tx_complete_cnf(
-			tpAniSirGlobal mac_ctx,
-			uint32_t tx_complete)
+			void *context,
+			qdf_nbuf_t buf,
+			uint32_t tx_complete,
+			void *params)
 {
+	tpAniSirGlobal mac_ctx = (tpAniSirGlobal)context;
+
 	lim_log(mac_ctx, LOG1,
 		 FL(" tx_complete= %d"), tx_complete);
 	return QDF_STATUS_SUCCESS;
diff --git a/core/mac/src/pe/lim/lim_types.h b/core/mac/src/pe/lim/lim_types.h
index 71cd587..0115d4a 100644
--- a/core/mac/src/pe/lim/lim_types.h
+++ b/core/mac/src/pe/lim/lim_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -851,10 +851,38 @@
 void lim_process_deauth_ack_timeout(tpAniSirGlobal pMac);
 QDF_STATUS lim_send_disassoc_cnf(tpAniSirGlobal pMac);
 QDF_STATUS lim_send_deauth_cnf(tpAniSirGlobal pMac);
-QDF_STATUS lim_disassoc_tx_complete_cnf(tpAniSirGlobal pMac,
-					uint32_t txCompleteSuccess);
-QDF_STATUS lim_deauth_tx_complete_cnf(tpAniSirGlobal pMac,
-				      uint32_t txCompleteSuccess);
+
+/**
+ * lim_disassoc_tx_complete_cnf() - callback to indicate Tx completion
+ * @context: pointer to mac structure
+ * @buf: buffer
+ * @txCompleteSuccess: indicates tx success/failure
+ * @params: tx completion params
+ *
+ * function will be invoked on receiving tx completion indication
+ *
+ * return: success: QDF_STATUS_SUCCESS failure: QDF_STATUS_E_FAILURE
+ */
+QDF_STATUS lim_disassoc_tx_complete_cnf(void *context,
+					qdf_nbuf_t buf,
+					uint32_t txCompleteSuccess,
+					void *params);
+
+/**
+ * lim_deauth_tx_complete_cnf() - callback to indicate Tx completion
+ * @context: pointer to mac structure
+ * @buf: buffer
+ * @txCompleteSuccess: indicates tx success/failure
+ * @params: tx completion params
+ *
+ * function will be invoked on receiving tx completion indication
+ *
+ * return: success: QDF_STATUS_SUCCESS failure: QDF_STATUS_E_FAILURE
+ */
+QDF_STATUS lim_deauth_tx_complete_cnf(void *context,
+				      qdf_nbuf_t buf,
+				      uint32_t txCompleteSuccess,
+				      void *params);
 
 typedef struct sSetLinkCbackParams {
 	void *cbackDataPtr;
diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c
index 3948870..f2c377c 100644
--- a/core/mac/src/pe/lim/lim_utils.c
+++ b/core/mac/src/pe/lim/lim_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -4457,12 +4457,14 @@
  *
  * @param void A pointer to pData. Shouldn't it be pPacket?!
  *
- * @return none
+ * @return QDF_STATUS_SUCCESS - in case of success
  */
-void lim_tx_complete(tHalHandle hHal, void *data, bool free)
+QDF_STATUS lim_tx_complete(tHalHandle hHal, qdf_nbuf_t buf, bool free)
 {
 	if (free)
-		cds_packet_free((void *)data);
+		cds_packet_free((void *)buf);
+
+	return QDF_STATUS_SUCCESS;
 }
 
 /**
diff --git a/core/mac/src/pe/lim/lim_utils.h b/core/mac/src/pe/lim/lim_utils.h
index c8d0942..65b881e 100644
--- a/core/mac/src/pe/lim/lim_utils.h
+++ b/core/mac/src/pe/lim/lim_utils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -348,7 +348,7 @@
 		tpPESession psessionEntry);
 
 uint8_t lim_get_ht_capability(tpAniSirGlobal, uint32_t, tpPESession);
-void lim_tx_complete(tHalHandle hHal, void *pData, bool free);
+QDF_STATUS lim_tx_complete(tHalHandle hHal, qdf_nbuf_t buf, bool free);
 
 /**
  * This function will be registered with HAL for callback when TSPEC inactivity
@@ -628,8 +628,20 @@
 
 bool lim_is_robust_mgmt_action_frame(uint8_t action_category);
 bool lim_is_ext_cap_ie_present (struct s_ext_cap *ext_cap);
-QDF_STATUS lim_p2p_action_cnf(tpAniSirGlobal mac_ctx,
-			uint32_t tx_complete_success);
+
+/**
+ * lim_p2p_action_cnf() - callback to indicate Tx completion
+ * @mac_ctx: pointer to mac structure
+ * @buf: buffer
+ * @tx_complete_success: indicates tx success/failure
+ * @params: tx completion params
+ *
+ * function will be invoked on receiving tx completion indication
+ *
+ * return: success: eHAL_STATUS_SUCCESS failure: eHAL_STATUS_FAILURE
+ */
+QDF_STATUS lim_p2p_action_cnf(void *mac_ctx, qdf_nbuf_t buf,
+			uint32_t tx_complete_success, void *params);
 void lim_update_caps_info_for_bss(tpAniSirGlobal mac_ctx,
 			uint16_t *caps, uint16_t bss_caps);
 void lim_send_set_dtim_period(tpAniSirGlobal mac_ctx, uint8_t dtim_period,
diff --git a/core/wma/inc/wma.h b/core/wma/inc/wma.h
index 31f9300..4919086 100644
--- a/core/wma/inc/wma.h
+++ b/core/wma/inc/wma.h
@@ -1188,8 +1188,8 @@
  */
 
 struct wmi_desc_t {
-	pWMATxRxCompFunc tx_cmpl_cb;
-	pWMAAckFnTxComp  ota_post_proc_cb;
+	wma_tx_dwnld_comp_callback tx_cmpl_cb;
+	wma_tx_ota_comp_callback  ota_post_proc_cb;
 	qdf_nbuf_t	 nbuf;
 	uint32_t	 desc_id;
 	uint8_t vdev_id;
@@ -1372,7 +1372,6 @@
  * @in_d0wow: D0WOW is enable/disable
  * @miracast_value: miracast value
  * @log_completion_timer: log completion timer
- * @mgmt_rx: management rx callback
  * @num_dbs_hw_modes: Number of HW modes supported by the FW
  * @dbs_mode: DBS HW mode list
  * @old_hw_mode_index: Previous configured HW mode index
@@ -1444,7 +1443,7 @@
 	wmi_resource_config wlan_resource_config;
 	uint32_t frameTransRequired;
 	tBssSystemRole wmaGlobalSystemRole;
-	pWMATxRxCompFunc tx_frm_download_comp_cb;
+	wma_tx_dwnld_comp_callback tx_frm_download_comp_cb;
 	qdf_event_t tx_frm_download_comp_event;
 	/*
 	 * Dummy event to wait for draining MSDUs left in hardware tx
@@ -1453,8 +1452,8 @@
 	 * descriptors number to be zero.
 	 */
 	qdf_event_t tx_queue_empty_event;
-	pWMAAckFnTxComp umac_ota_ack_cb[SIR_MAC_MGMT_RESERVED15];
-	pWMAAckFnTxComp umac_data_ota_ack_cb;
+	wma_tx_ota_comp_callback umac_ota_ack_cb[SIR_MAC_MGMT_RESERVED15];
+	wma_tx_ota_comp_callback umac_data_ota_ack_cb;
 	unsigned long last_umac_data_ota_timestamp;
 	qdf_nbuf_t last_umac_data_nbuf;
 	bool needShutdown;
@@ -1539,7 +1538,6 @@
 	uint32_t hw_bd_info[HW_BD_INFO_SIZE];
 	uint32_t miracast_value;
 	qdf_mc_timer_t log_completion_timer;
-	wma_mgmt_frame_rx_callback mgmt_rx;
 	uint32_t num_dbs_hw_modes;
 	struct dbs_hw_mode_info hw_mode;
 	uint32_t old_hw_mode_index;
@@ -2320,7 +2318,6 @@
 			   u_int32_t peer_type, u_int8_t vdev_id,
 			   bool roam_synch_in_progress);
 
-#endif
 struct wma_ini_config *wma_get_ini_handle(tp_wma_handle wma_handle);
 WLAN_PHY_MODE wma_chan_phy_mode(u8 chan, enum phy_ch_width chan_width,
 	u8 dot11_mode);
@@ -2345,3 +2342,33 @@
 	int tid, uint16_t queue_no);
 int wma_peer_rx_reorder_queue_remove(void *scn_handle,
 	uint8_t vdev_id, uint8_t *peer_macaddr, uint32_t peer_tid_bitmap);
+
+/**
+ * wma_form_rx_packet() - form rx cds packet
+ * @buf: buffer
+ * @mgmt_rx_params: mgmt rx params
+ * @rx_pkt: cds packet
+ *
+ * This functions forms a cds packet from the rx mgmt frame received.
+ *
+ * Return: 0 for success or error code
+ */
+int wma_form_rx_packet(qdf_nbuf_t buf,
+			void *mgmt_rx_params,
+			cds_pkt_t *rx_pkt);
+
+/**
+ * wma_mgmt_unified_cmd_send() - send the mgmt tx packet
+ * @vdev: objmgr vdev
+ * @buf: buffer
+ * @desc_id: desc id
+ * @mgmt_tx_params: mgmt rx params
+ *
+ * This functions sends mgmt tx packet to WMI layer.
+ *
+ * Return: 0 for success or error code
+ */
+QDF_STATUS wma_mgmt_unified_cmd_send(struct wlan_objmgr_vdev *vdev,
+				qdf_nbuf_t buf, uint32_t desc_id,
+				void *mgmt_tx_params);
+#endif
diff --git a/core/wma/inc/wma_types.h b/core/wma/inc/wma_types.h
index d850a8b..3911b71 100644
--- a/core/wma/inc/wma_types.h
+++ b/core/wma/inc/wma_types.h
@@ -601,13 +601,32 @@
 	uint32_t status;
 } tDisableUapsdParams, *tpDisableUapsdParams;
 
-typedef void (*pWMATxRxCompFunc)(void *pContext, void *pData,
+/**
+ * wma_tx_dwnld_comp_callback - callback function for TX dwnld complete
+ * @context: global pMac pointer
+ * @buf: buffer
+ * @bFreeData: to free/not free the buffer
+ *
+ * callback function for mgmt tx download completion.
+ *
+ * Return: QDF_STATUS_SUCCESS in case of success
+ */
+typedef QDF_STATUS (*wma_tx_dwnld_comp_callback)(void *context, qdf_nbuf_t buf,
 				 bool bFreeData);
 
-/* callback function for TX complete */
-/* parameter 1 - global pMac pointer */
-/* parameter 2 - txComplete status : 1- success, 0 - failure. */
-typedef QDF_STATUS (*pWMAAckFnTxComp)(tpAniSirGlobal, uint32_t);
+/**
+ * wma_tx_ota_comp_callback - callback function for TX complete
+ * @context: global pMac pointer
+ * @buf: buffer
+ * @status: tx completion status
+ * @params: tx completion params
+ *
+ * callback function for mgmt tx ota completion.
+ *
+ * Return: QDF_STATUS_SUCCESS in case of success
+ */
+typedef QDF_STATUS (*wma_tx_ota_comp_callback)(void *context, qdf_nbuf_t buf,
+				      uint32_t status, void *params);
 
 typedef void (*wma_txFailIndCallback)(uint8_t *, uint8_t);
 
@@ -694,9 +713,9 @@
 			 eFrameType frmType,
 			 eFrameTxDir txDir,
 			 uint8_t tid,
-			 pWMATxRxCompFunc pCompFunc,
+			 wma_tx_dwnld_comp_callback pCompFunc,
 			 void *pData,
-			 pWMAAckFnTxComp pAckTxComp,
+			 wma_tx_ota_comp_callback pAckTxComp,
 			 uint8_t txFlag, uint8_t sessionId, bool tdlsflag,
 			 uint16_t channel_freq);
 
@@ -705,13 +724,9 @@
 		    wma_dfs_radar_indication_cb radar_ind_cb,
 		    struct cds_config_info *cds_cfg);
 
-typedef QDF_STATUS (*wma_mgmt_frame_rx_callback)(void *p_cds_gctx,
-					     void *cds_buff);
+QDF_STATUS wma_register_mgmt_frm_client(void);
 
-QDF_STATUS wma_register_mgmt_frm_client(void *p_cds_gctx,
-				wma_mgmt_frame_rx_callback mgmt_rx_cb);
-
-QDF_STATUS wma_de_register_mgmt_frm_client(void *p_cds_gctx);
+QDF_STATUS wma_de_register_mgmt_frm_client(void);
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 QDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
 		void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c
index b1639f0..0ea9397 100644
--- a/core/wma/src/wma_data.c
+++ b/core/wma/src/wma_data.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -76,6 +76,11 @@
 #include "cdp_txrx_stats.h"
 #include <cdp_txrx_misc.h>
 #include "enet.h"
+#include "wlan_mgmt_txrx_utils_api.h"
+#include "wlan_objmgr_psoc_obj.h"
+#include "wlan_objmgr_pdev_obj.h"
+#include "wlan_objmgr_vdev_obj.h"
+#include "wlan_objmgr_peer_obj.h"
 
 typedef struct {
 	int32_t rate;
@@ -811,7 +816,7 @@
 {
 	struct wma_tx_ack_work_ctx *work;
 	tp_wma_handle wma_handle;
-	pWMAAckFnTxComp ack_cb;
+	wma_tx_ota_comp_callback ack_cb;
 
 	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGE("%s: Driver load/unload in progress", __func__);
@@ -830,8 +835,8 @@
 
 	/* Call the Ack Cb registered by UMAC */
 	if (ack_cb)
-		ack_cb((tpAniSirGlobal) (wma_handle->mac_context),
-			work->status ? 0 : 1);
+		ack_cb((tpAniSirGlobal) (wma_handle->mac_context), NULL,
+			work->status ? 0 : 1, NULL);
 	else
 		WMA_LOGE("Data Tx Ack Cb is NULL");
 
@@ -1361,7 +1366,7 @@
 {
 	struct wma_tx_ack_work_ctx *work;
 	tp_wma_handle wma_handle;
-	pWMAAckFnTxComp ack_cb;
+	wma_tx_ota_comp_callback ack_cb;
 
 	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGE("%s: Driver load/unload in progress", __func__);
@@ -1377,8 +1382,8 @@
 		 work->sub_type, work->status);
 
 	/* Call the Ack Cb registered by UMAC */
-	ack_cb((tpAniSirGlobal) (wma_handle->mac_context),
-	       work->status ? 0 : 1);
+	ack_cb((tpAniSirGlobal) (wma_handle->mac_context), NULL,
+	       work->status ? 0 : 1, NULL);
 
 	qdf_mem_free(work);
 	wma_handle->ack_work_ctx = NULL;
@@ -2490,9 +2495,11 @@
  */
 QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 			 eFrameType frmType, eFrameTxDir txDir, uint8_t tid,
-			 pWMATxRxCompFunc tx_frm_download_comp_cb, void *pData,
-			 pWMAAckFnTxComp tx_frm_ota_comp_cb, uint8_t tx_flag,
-			 uint8_t vdev_id, bool tdlsFlag, uint16_t channel_freq)
+			 wma_tx_dwnld_comp_callback tx_frm_download_comp_cb,
+			 void *pData,
+			 wma_tx_ota_comp_callback tx_frm_ota_comp_cb,
+			 uint8_t tx_flag, uint8_t vdev_id, bool tdlsFlag,
+			 uint16_t channel_freq)
 {
 	tp_wma_handle wma_handle = (tp_wma_handle) (wma_context);
 	int32_t status;
@@ -2513,9 +2520,12 @@
 	tpAniSirGlobal pMac;
 	tpSirMacMgmtHdr mHdr;
 	struct wmi_mgmt_params mgmt_param = {0};
-	struct wmi_desc_t *wmi_desc = NULL;
 	void *ctrl_pdev;
 	void *soc = cds_get_context(QDF_MODULE_ID_SOC);
+	struct ieee80211_frame *wh;
+	struct wlan_objmgr_peer *peer = NULL;
+	struct wlan_objmgr_psoc *psoc;
+	void *mac_addr;
 
 	if (NULL == wma_handle) {
 		WMA_LOGE("wma_handle is NULL");
@@ -2845,23 +2855,29 @@
 		mgmt_param.pdata = pData;
 		mgmt_param.chanfreq = chanfreq;
 		mgmt_param.qdf_ctx = cds_get_context(QDF_MODULE_ID_QDF_DEVICE);
-		wmi_desc = wmi_desc_get(wma_handle);
-		if (!wmi_desc) {
-			WMA_LOGE("%s: Failed to get wmi_desc", __func__);
-			status = QDF_STATUS_E_FAILURE;
-		} else {
-			mgmt_param.desc_id = wmi_desc->desc_id;
-			wmi_desc->vdev_id = vdev_id;
-			status = wmi_mgmt_unified_cmd_send(
-					wma_handle->wmi_handle,
-					&mgmt_param);
-			if (status) {
-				wmi_desc_put(wma_handle, wmi_desc);
-			} else {
-				wmi_desc->nbuf = tx_frame;
-				wmi_desc->tx_cmpl_cb = tx_frm_download_comp_cb;
-				wmi_desc->ota_post_proc_cb = tx_frm_ota_comp_cb;
-			}
+
+		psoc = wma_handle->psoc;
+		if (!psoc) {
+			WMA_LOGE("%s: psoc ctx is NULL", __func__);
+			goto error;
+		}
+
+		wh = (struct ieee80211_frame *)(qdf_nbuf_data(tx_frame));
+		mac_addr = wh->i_addr1;
+		peer = wlan_objmgr_find_peer(psoc, mac_addr);
+		if (!peer) {
+			mac_addr = wh->i_addr2;
+			peer = wlan_objmgr_find_peer(psoc, mac_addr);
+		}
+
+		status = wlan_mgmt_txrx_mgmt_frame_tx(peer,
+				(tpAniSirGlobal)wma_handle->mac_context,
+				(qdf_nbuf_t)tx_frame,
+				tx_frm_download_comp_cb, tx_frm_ota_comp_cb,
+				WLAN_UMAC_COMP_MLME, &mgmt_param);
+		if (status != QDF_STATUS_SUCCESS) {
+			WMA_LOGE("%s: mgmt tx failed", __func__);
+			goto error;
 		}
 	} else {
 		/* Hand over the Tx Mgmt frame to TxRx */
diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index 50bf766..0a47e03 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,6 +71,11 @@
 #include <cdp_txrx_cmn.h>
 #include <cdp_txrx_misc.h>
 #include <cdp_txrx_misc.h>
+#include "wlan_mgmt_txrx_tgt_api.h"
+#include "wlan_objmgr_psoc_obj.h"
+#include "wlan_objmgr_pdev_obj.h"
+#include "wlan_objmgr_vdev_obj.h"
+
 
 /**
  * wma_send_bcn_buf_ll() - prepare and send beacon buffer to fw for LL
@@ -2492,43 +2497,56 @@
 static int wma_process_mgmt_tx_completion(tp_wma_handle wma_handle,
 					  uint32_t desc_id, uint32_t status)
 {
-	struct wmi_desc_t *wmi_desc;
+	struct wlan_objmgr_psoc *psoc;
+	qdf_nbuf_t buf = NULL;
+	uint8_t vdev_id = 0;
+	QDF_STATUS ret;
+	struct wlan_lmac_if_mgmt_txrx_rx_ops *mgmt_txrx_rx_ops;
 
-	void *pdev = cds_get_context(QDF_MODULE_ID_TXRX);
-
-	if (pdev == NULL) {
-		WMA_LOGE("%s: NULL pdev pointer", __func__);
+	if (wma_handle == NULL) {
+		WMA_LOGE("%s: wma handle is NULL", __func__);
 		return -EINVAL;
 	}
 
-	WMA_LOGI("%s: status:%d wmi_desc_id:%d", __func__, status, desc_id);
+	WMA_LOGI("%s: status:%d desc id:%d", __func__, status, desc_id);
 
-	wmi_desc = (struct wmi_desc_t *)
-			(&wma_handle->wmi_desc_pool.array[desc_id]);
 
-	if (!wmi_desc) {
-		WMA_LOGE("%s: Invalid wmi desc", __func__);
+	psoc = wma_handle->psoc;
+	if (psoc == NULL) {
+		WMA_LOGE("%s: psoc ptr is NULL", __func__);
 		return -EINVAL;
 	}
 
-	if (wmi_desc->nbuf)
-		qdf_nbuf_unmap_single(wma_handle->qdf_dev, wmi_desc->nbuf,
+	mgmt_txrx_rx_ops = &psoc->soc_cb.rx_ops.mgmt_txrx_rx_ops;
+
+	if (mgmt_txrx_rx_ops->mgmt_txrx_get_nbuf_from_desc_id)
+		buf = mgmt_txrx_rx_ops->mgmt_txrx_get_nbuf_from_desc_id(
+					psoc, desc_id);
+
+	if (mgmt_txrx_rx_ops->mgmt_txrx_get_vdev_id_from_desc_id)
+		vdev_id = mgmt_txrx_rx_ops->mgmt_txrx_get_vdev_id_from_desc_id(
+					psoc, desc_id);
+	if (buf)
+		qdf_nbuf_unmap_single(wma_handle->qdf_dev, buf,
 					  QDF_DMA_TO_DEVICE);
 
 	if (wma_handle->wma_mgmt_tx_packetdump_cb)
-		wma_handle->wma_mgmt_tx_packetdump_cb(wmi_desc->nbuf,
-			QDF_STATUS_SUCCESS, wmi_desc->vdev_id, TX_MGMT_PKT);
+		wma_handle->wma_mgmt_tx_packetdump_cb(buf,
+			QDF_STATUS_SUCCESS, vdev_id, TX_MGMT_PKT);
 
-	if (wmi_desc->tx_cmpl_cb)
-		wmi_desc->tx_cmpl_cb(wma_handle->mac_context,
-					   wmi_desc->nbuf, 1);
+	if (!mgmt_txrx_rx_ops->mgmt_tx_completion_handler) {
+		WMA_LOGE("%s: tx completion callback to mgmt txrx layer is NULL",
+			__func__);
+		return -EINVAL;
+	}
+	ret = mgmt_txrx_rx_ops->mgmt_tx_completion_handler(psoc, desc_id,
+							   status, NULL);
 
-	if (wmi_desc->ota_post_proc_cb)
-		wmi_desc->ota_post_proc_cb((tpAniSirGlobal)
-						 wma_handle->mac_context,
-						 status);
+	if (ret != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Failed to process mgmt tx completion", __func__);
+		return -EINVAL;
+	}
 
-	wmi_desc_put(wma_handle, wmi_desc);
 	return 0;
 }
 
@@ -3149,85 +3167,66 @@
 	return should_drop;
 }
 
-/**
- * wma_mgmt_rx_process() - process management rx frame.
- * @handle: wma handle
- * @data: rx data
- * @data_len: data length
- *
- * Return: 0 for success or error code
- */
-static int wma_mgmt_rx_process(void *handle, uint8_t *data,
-				  uint32_t data_len)
+int wma_form_rx_packet(qdf_nbuf_t buf,
+			void *params,
+			cds_pkt_t *rx_pkt)
 {
-	tp_wma_handle wma_handle = (tp_wma_handle) handle;
-	WMI_MGMT_RX_EVENTID_param_tlvs *param_tlvs = NULL;
-	wmi_mgmt_rx_hdr *hdr = NULL;
+	wmi_host_mgmt_rx_hdr *mgmt_rx_params =
+				(wmi_host_mgmt_rx_hdr *)params;
 	struct wma_txrx_node *iface = NULL;
 	uint8_t vdev_id = WMA_INVALID_VDEV_ID;
-	cds_pkt_t *rx_pkt;
-	qdf_nbuf_t wbuf;
 	struct ieee80211_frame *wh;
 	uint8_t mgt_type, mgt_subtype;
 	int status;
+	tp_wma_handle wma_handle = (tp_wma_handle)
+				cds_get_context(QDF_MODULE_ID_WMA);
 
 	if (!wma_handle) {
-		WMA_LOGE("%s: Failed to get WMA  context", __func__);
+		WMA_LOGE(FL("wma handle is NULL"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
-	param_tlvs = (WMI_MGMT_RX_EVENTID_param_tlvs *) data;
-	if (!param_tlvs) {
-		WMA_LOGE("Get NULL point message from FW");
+	if (!mgmt_rx_params) {
+		WMA_LOGE(FL("mgmt rx params is NULL"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
-	hdr = param_tlvs->hdr;
-	if (!hdr) {
-		WMA_LOGE("Rx event is NULL");
-		return -EINVAL;
-	}
-
-	if (hdr->buf_len < sizeof(struct ieee80211_frame)) {
-		WMA_LOGE("Invalid rx mgmt packet");
-		return -EINVAL;
-	}
-
-	rx_pkt = qdf_mem_malloc(sizeof(*rx_pkt));
-	if (!rx_pkt) {
-		WMA_LOGE("Failed to allocate rx packet");
-		return -ENOMEM;
-	}
-
 	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGW(FL("Load/Unload in progress"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
 	if (cds_is_driver_recovering()) {
 		WMA_LOGW(FL("Recovery in progress"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
-	qdf_mem_zero(rx_pkt, sizeof(*rx_pkt));
-
 	/*
 	 * Fill in meta information needed by pe/lim
 	 * TODO: Try to maintain rx metainfo as part of skb->data.
 	 */
-	rx_pkt->pkt_meta.channel = hdr->channel;
-	rx_pkt->pkt_meta.scan_src = hdr->flags;
+	rx_pkt->pkt_meta.channel = mgmt_rx_params->channel;
+	rx_pkt->pkt_meta.scan_src = mgmt_rx_params->flags;
 
 	/*
 	 * Get the rssi value from the current snr value
 	 * using standard noise floor of -96.
 	 */
-	rx_pkt->pkt_meta.rssi = hdr->snr + WMA_NOISE_FLOOR_DBM_DEFAULT;
-	rx_pkt->pkt_meta.snr = hdr->snr;
+	rx_pkt->pkt_meta.rssi = mgmt_rx_params->snr +
+				WMA_NOISE_FLOOR_DBM_DEFAULT;
+	rx_pkt->pkt_meta.snr = mgmt_rx_params->snr;
 
 	/* If absolute rssi is available from firmware, use it */
-	if (hdr->rssi != 0)
-		rx_pkt->pkt_meta.rssi_raw = hdr->rssi;
+	if (mgmt_rx_params->rssi != 0)
+		rx_pkt->pkt_meta.rssi_raw = mgmt_rx_params->rssi;
 	else
 		rx_pkt->pkt_meta.rssi_raw = rx_pkt->pkt_meta.rssi;
 
@@ -3238,66 +3237,26 @@
 	 */
 	rx_pkt->pkt_meta.timestamp = (uint32_t) jiffies;
 	rx_pkt->pkt_meta.mpdu_hdr_len = sizeof(struct ieee80211_frame);
-	rx_pkt->pkt_meta.mpdu_len = hdr->buf_len;
-	rx_pkt->pkt_meta.mpdu_data_len = hdr->buf_len -
+	rx_pkt->pkt_meta.mpdu_len = mgmt_rx_params->buf_len;
+	rx_pkt->pkt_meta.mpdu_data_len = mgmt_rx_params->buf_len -
 					 rx_pkt->pkt_meta.mpdu_hdr_len;
 
 	rx_pkt->pkt_meta.roamCandidateInd = 0;
 
-	/* Why not just use rx_event->hdr.buf_len? */
-	wbuf = qdf_nbuf_alloc(NULL, roundup(hdr->buf_len, 4), 0, 4, false);
-	if (!wbuf) {
-		WMA_LOGE("%s: Failed to allocate wbuf for mgmt rx len(%u)",
-			    __func__, hdr->buf_len);
-		qdf_mem_free(rx_pkt);
-		return -ENOMEM;
-	}
+	wh = (struct ieee80211_frame *)qdf_nbuf_data(buf);
 
-	qdf_nbuf_put_tail(wbuf, hdr->buf_len);
-	qdf_nbuf_set_protocol(wbuf, ETH_P_CONTROL);
-	wh = (struct ieee80211_frame *)qdf_nbuf_data(wbuf);
-
-	rx_pkt->pkt_meta.mpdu_hdr_ptr = qdf_nbuf_data(wbuf);
+	rx_pkt->pkt_meta.mpdu_hdr_ptr = qdf_nbuf_data(buf);
 	rx_pkt->pkt_meta.mpdu_data_ptr = rx_pkt->pkt_meta.mpdu_hdr_ptr +
 					 rx_pkt->pkt_meta.mpdu_hdr_len;
-	rx_pkt->pkt_meta.tsf_delta = hdr->tsf_delta;
-	rx_pkt->pkt_buf = wbuf;
-
-#ifdef BIG_ENDIAN_HOST
-	{
-		/*
-		 * for big endian host, copy engine byte_swap is enabled
-		 * But the rx mgmt frame buffer content is in network byte order
-		 * Need to byte swap the mgmt frame buffer content - so when
-		 * copy engine does byte_swap - host gets buffer content in the
-		 * correct byte order.
-		 */
-		int i;
-		uint32_t *destp, *srcp;
-		destp = (uint32_t *) wh;
-		srcp = (uint32_t *) param_tlvs->bufp;
-		for (i = 0;
-		     i < (roundup(hdr->buf_len, sizeof(uint32_t)) / 4); i++) {
-			*destp = cpu_to_le32(*srcp);
-			destp++;
-			srcp++;
-		}
-	}
-#else
-	qdf_mem_copy(wh, param_tlvs->bufp, hdr->buf_len);
-#endif
+	rx_pkt->pkt_meta.tsf_delta = mgmt_rx_params->tsf_delta;
+	rx_pkt->pkt_buf = buf;
 
 	WMA_LOGD(
 		FL("BSSID: "MAC_ADDRESS_STR" snr = %d, rssi = %d, rssi_raw = %d tsf_delta: %u"),
 			MAC_ADDR_ARRAY(wh->i_addr3),
-			hdr->snr, rx_pkt->pkt_meta.rssi,
+			mgmt_rx_params->snr, rx_pkt->pkt_meta.rssi,
 			rx_pkt->pkt_meta.rssi_raw,
-			hdr->tsf_delta);
-	if (!wma_handle->mgmt_rx) {
-		WMA_LOGE("Not registered for Mgmt rx, dropping the frame");
-		cds_pkt_return_packet(rx_pkt);
-		return -EINVAL;
-	}
+			mgmt_rx_params->tsf_delta);
 
 	/* If it is a beacon/probe response, save it for future use */
 	mgt_type = (wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
@@ -3313,19 +3272,20 @@
 			iface = &(wma_handle->interfaces[vdev_id]);
 			if (iface->rmfEnabled) {
 				status = wma_process_rmf_frame(wma_handle,
-					iface, wh, rx_pkt, wbuf);
+					iface, wh, rx_pkt, buf);
+				if (status != 0)
+					return status;
 				/*
 				 * CCMP header might have been pulled off
 				 * reinitialize the start pointer of mac header
 				 */
 				wh = (struct ieee80211_frame *)
-						qdf_nbuf_data(wbuf);
-				if (status != 0)
-					return status;
+						qdf_nbuf_data(buf);
 			}
 		}
 	}
 #endif /* WLAN_FEATURE_11W */
+
 	rx_pkt->pkt_meta.sessionId =
 		(vdev_id == WMA_INVALID_VDEV_ID ? 0 : vdev_id);
 
@@ -3341,37 +3301,160 @@
 			QDF_STATUS_SUCCESS, rx_pkt->pkt_meta.sessionId,
 			RX_MGMT_PKT);
 
-	wma_handle->mgmt_rx(wma_handle, rx_pkt);
+	return 0;
+}
+
+/**
+ * wma_mem_endianness_based_copy() - does memory copy from src to dst
+ * @dst: destination address
+ * @src: source address
+ * @size: size to be copied
+ *
+ * This function copies the memory of size passed from source
+ * address to destination address.
+ *
+ * Return: Nothing
+ */
+#ifdef BIG_ENDIAN_HOST
+static void wma_mem_endianness_based_copy(
+			uint8_t *dst, uint8_t *src, uint32_t size)
+{
+	/*
+	 * For big endian host, copy engine byte_swap is enabled
+	 * But the rx mgmt frame buffer content is in network byte order
+	 * Need to byte swap the mgmt frame buffer content - so when
+	 * copy engine does byte_swap - host gets buffer content in the
+	 * correct byte order.
+	 */
+
+	uint32_t i;
+	uint32_t *destp, *srcp;
+
+	destp = (uint32_t *) dst;
+	srcp = (uint32_t *) src;
+	for (i = 0; i < (roundup(size, sizeof(uint32_t)) / 4); i++) {
+		*destp = cpu_to_le32(*srcp);
+		destp++;
+		srcp++;
+	}
+}
+#else
+static void wma_mem_endianness_based_copy(
+			uint8_t *dst, uint8_t *src, uint32_t size)
+{
+	qdf_mem_copy(dst, src, size);
+}
+#endif
+
+/**
+ * wma_mgmt_rx_process() - process management rx frame.
+ * @handle: wma handle
+ * @data: rx data
+ * @data_len: data length
+ *
+ * Return: 0 for success or error code
+ */
+static int wma_mgmt_rx_process(void *handle, uint8_t *data,
+				  uint32_t data_len)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	wmi_host_mgmt_rx_hdr *mgmt_rx_params;
+	struct wlan_objmgr_psoc *psoc;
+	uint8_t *bufp;
+	qdf_nbuf_t wbuf;
+	QDF_STATUS status;
+
+	if (!wma_handle) {
+		WMA_LOGE("%s: Failed to get WMA  context", __func__);
+		return -EINVAL;
+	}
+
+	mgmt_rx_params = qdf_mem_malloc(sizeof(*mgmt_rx_params));
+	if (!mgmt_rx_params) {
+		WMA_LOGE("%s: memory allocation failed", __func__);
+		return -ENOMEM;
+	}
+
+	if (wmi_extract_mgmt_rx_params(wma_handle->wmi_handle,
+			data, mgmt_rx_params, &bufp) != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Extraction of mgmt rx params failed", __func__);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	wbuf = qdf_nbuf_alloc(NULL, roundup(mgmt_rx_params->buf_len, 4),
+				0, 4, false);
+	if (!wbuf) {
+		WMA_LOGE("%s: Failed to allocate wbuf for mgmt rx len(%u)",
+			    __func__, mgmt_rx_params->buf_len);
+		qdf_mem_free(mgmt_rx_params);
+		return -ENOMEM;
+	}
+
+	qdf_nbuf_put_tail(wbuf, mgmt_rx_params->buf_len);
+	qdf_nbuf_set_protocol(wbuf, ETH_P_CONTROL);
+
+	wma_mem_endianness_based_copy(qdf_nbuf_data(wbuf),
+			bufp, mgmt_rx_params->buf_len);
+
+	psoc = (struct wlan_objmgr_psoc *)
+				wma_handle->psoc;
+	if (!psoc) {
+		WMA_LOGE("%s: psoc ctx is NULL", __func__);
+		qdf_nbuf_free(wbuf);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	if (!psoc->soc_cb.rx_ops.mgmt_txrx_rx_ops.mgmt_rx_frame_handler) {
+		WMA_LOGE("%s: rx callback to mgmt txrx layer is NULL",
+			__func__);
+		qdf_nbuf_free(wbuf);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	status = psoc->soc_cb.rx_ops.mgmt_txrx_rx_ops.mgmt_rx_frame_handler(
+				psoc, wbuf, mgmt_rx_params);
+
+	if (status != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Failed to process mgmt rx frame", __func__);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	qdf_mem_free(mgmt_rx_params);
 	return 0;
 }
 
 /**
  * wma_de_register_mgmt_frm_client() - deregister management frame
- * @cds_ctx: cds context
+ *
+ * This function deregisters the event handler registered for
+ * WMI_MGMT_RX_EVENTID.
  *
  * Return: QDF status
  */
-QDF_STATUS wma_de_register_mgmt_frm_client(void *cds_ctx)
+QDF_STATUS wma_de_register_mgmt_frm_client(void)
 {
-	tp_wma_handle wma_handle;
+	tp_wma_handle wma_handle = (tp_wma_handle)
+				cds_get_context(QDF_MODULE_ID_WMA);
+
+	if (!wma_handle) {
+		WMA_LOGE("%s: Failed to get WMA context", __func__);
+		return QDF_STATUS_E_NULL_VALUE;
+	}
 
 #ifdef QCA_WIFI_FTM
 	if (cds_get_conparam() == QDF_GLOBAL_FTM_MODE)
 		return QDF_STATUS_SUCCESS;
 #endif
 
-	wma_handle = cds_get_context(QDF_MODULE_ID_WMA);
-	if (!wma_handle) {
-		WMA_LOGE("%s: Failed to get WMA context", __func__);
-		return QDF_STATUS_E_FAILURE;
-	}
-
 	if (wmi_unified_unregister_event_handler(wma_handle->wmi_handle,
 						 WMI_MGMT_RX_EVENTID) != 0) {
 		WMA_LOGE("Failed to Unregister rx mgmt handler with wmi");
 		return QDF_STATUS_E_FAILURE;
 	}
-	wma_handle->mgmt_rx = NULL;
 	return QDF_STATUS_SUCCESS;
 }
 
@@ -3412,19 +3495,19 @@
 
 /**
  * wma_register_mgmt_frm_client() - register management frame callback
- * @cds_ctx: cds context
- * @mgmt_frm_rx: management frame
+ *
+ * This function registers event handler for WMI_MGMT_RX_EVENTID.
  *
  * Return: QDF status
  */
-QDF_STATUS wma_register_mgmt_frm_client(
-	void *cds_ctx, wma_mgmt_frame_rx_callback mgmt_frm_rx)
+QDF_STATUS wma_register_mgmt_frm_client(void)
 {
-	tp_wma_handle wma_handle = cds_get_context(QDF_MODULE_ID_WMA);
+	tp_wma_handle wma_handle = (tp_wma_handle)
+				cds_get_context(QDF_MODULE_ID_WMA);
 
 	if (!wma_handle) {
 		WMA_LOGE("%s: Failed to get WMA context", __func__);
-		return QDF_STATUS_E_FAILURE;
+		return QDF_STATUS_E_NULL_VALUE;
 	}
 
 	if (wmi_unified_register_event_handler(wma_handle->wmi_handle,
@@ -3434,7 +3517,6 @@
 		WMA_LOGE("Failed to register rx mgmt handler with wmi");
 		return QDF_STATUS_E_FAILURE;
 	}
-	wma_handle->mgmt_rx = mgmt_frm_rx;
 
 	return QDF_STATUS_SUCCESS;
 }
@@ -3486,3 +3568,40 @@
 	wma_handle->wma_mgmt_tx_packetdump_cb = NULL;
 	wma_handle->wma_mgmt_rx_packetdump_cb = NULL;
 }
+
+QDF_STATUS wma_mgmt_unified_cmd_send(struct wlan_objmgr_vdev *vdev,
+				qdf_nbuf_t buf, uint32_t desc_id,
+				void *mgmt_tx_params)
+{
+	tp_wma_handle wma_handle;
+	QDF_STATUS status;
+	struct wmi_mgmt_params *mgmt_params =
+			(struct wmi_mgmt_params *)mgmt_tx_params;
+
+	if (!mgmt_params) {
+		WMA_LOGE("%s: mgmt_params ptr passed is NULL", __func__);
+		return QDF_STATUS_E_INVAL;
+	}
+	mgmt_params->desc_id = desc_id;
+
+	if (!vdev) {
+		WMA_LOGE("%s: vdev ptr passed is NULL", __func__);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	wma_handle = cds_get_context(QDF_MODULE_ID_WMA);
+	if (!wma_handle) {
+		WMA_LOGE("%s: wma handle is NULL", __func__);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	status = wmi_mgmt_unified_cmd_send(wma_handle->wmi_handle,
+				mgmt_params);
+	if (status != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: mgmt tx failed", __func__);
+		return status;
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+