diff --git a/Kbuild b/Kbuild
index 916015a..63cc47a 100644
--- a/Kbuild
+++ b/Kbuild
@@ -764,6 +764,18 @@
 		$(UMAC_OBJMGR_DIR)/src/wlan_objmgr_psoc_obj.o \
 		$(UMAC_OBJMGR_DIR)/src/wlan_objmgr_vdev_obj.o
 
+
+###########  UMAC MGMT TXRX ##########
+UMAC_MGMT_TXRX_DIR := $(WLAN_COMMON_ROOT)/umac/cmn_services/mgmt_txrx
+
+UMAC_MGMT_TXRX_INC := -I$(WLAN_COMMON_INC)/umac/cmn_services/mgmt_txrx/core/src \
+	-I$(WLAN_COMMON_INC)/umac/cmn_services/mgmt_txrx/dispatcher/inc \
+	-I$(WLAN_COMMON_INC)/umac/cmn_services/mgmt_txrx/dispatcher/src
+
+UMAC_MGMT_TXRX_OBJS := $(UMAC_MGMT_TXRX_DIR)/core/src/wlan_mgmt_txrx_main.o \
+	$(UMAC_MGMT_TXRX_DIR)/dispatcher/src/wlan_mgmt_txrx_utils_api.o \
+	$(UMAC_MGMT_TXRX_DIR)/dispatcher/src/wlan_mgmt_txrx_tgt_api.o
+
 ########### BMI ###########
 BMI_DIR := core/bmi
 
@@ -1110,6 +1122,7 @@
 		$(HAL_INC)
 
 INCS +=		$(UMAC_OBJMGR_INC)
+INCS +=		$(UMAC_MGMT_TXRX_INC)
 INCS +=		$(TARGET_INC)
 
 INCS +=		$(NLINK_INC) \
@@ -1153,6 +1166,7 @@
 		$(HAL_OBJS)
 
 OBJS +=		$(UMAC_OBJMGR_OBJS)
+OBJS +=		$(UMAC_MGMT_TXRX_OBJS)
 OBJS +=		$(WLAN_LOGGING_OBJS)
 OBJS +=		$(NLINK_OBJS)
 OBJS +=		$(PTT_OBJS)
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index 4167b83..39e2159 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -10010,6 +10010,7 @@
 		wlan_objmgr_vdev_obj_delete(vdev);
 		return QDF_STATUS_E_FAILURE;
 	}
+	wlan_objmgr_peer_ref_peer(peer);
 	adapter->hdd_vdev = vdev;
 
 	return QDF_STATUS_SUCCESS;
diff --git a/core/mac/src/pe/include/lim_api.h b/core/mac/src/pe/include/lim_api.h
index e06a255..f59fcf8 100644
--- a/core/mac/src/pe/include/lim_api.h
+++ b/core/mac/src/pe/include/lim_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -125,6 +125,31 @@
 tSirRetStatus peProcessMsg(tpAniSirGlobal pMac, tSirMsgQ *limMsg);
 
 /**
+ * pe_register_mgmt_rx_frm_callback() - registers callback for receiving
+ *                                      mgmt rx frames
+ * @mac_ctx: mac global ctx
+ *
+ * This function registers a PE function to mgmt txrx component and a WMA
+ * function to WMI layer as event handler for receiving mgmt frames.
+ *
+ * Return: None
+ */
+void pe_register_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx);
+
+/**
+ * pe_deregister_mgmt_rx_frm_callback() - degisters callback for receiving
+ *                                        mgmt rx frames
+ * @mac_ctx: mac global ctx
+ *
+ * This function deregisters the PE function registered to mgmt txrx component
+ * and the WMA function registered to WMI layer as event handler for receiving
+ * mgmt frames.
+ *
+ * Return: None
+ */
+void pe_deregister_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx);
+
+/**
  * pe_register_callbacks_with_wma() - register SME and PE callback functions to
  * WMA.
  * @pMac: mac global ctx
diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c
index b6b0aee..2877594 100644
--- a/core/mac/src/pe/lim/lim_api.c
+++ b/core/mac/src/pe/lim/lim_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -70,6 +70,9 @@
 #include "sys_startup.h"
 #include "cds_concurrency.h"
 #include "nan_datapath.h"
+#include "wma.h"
+#include "wlan_mgmt_txrx_utils_api.h"
+#include "wlan_objmgr_psoc_obj.h"
 
 static void __lim_init_scan_vars(tpAniSirGlobal pMac)
 {
@@ -613,6 +616,8 @@
 
 	struct mgmt_frm_reg_info *pLimMgmtRegistration = NULL;
 
+	pe_deregister_mgmt_rx_frm_callback(pMac);
+
 	if (QDF_GLOBAL_FTM_MODE != cds_get_conparam()) {
 		qdf_mutex_acquire(&pMac->lim.lim_frame_register_lock);
 		while (qdf_list_remove_front(
@@ -1004,23 +1009,22 @@
 
 /* --------------------------------------------------------------------------- */
 /**
- * pe_handle_mgmt_frame
+ * pe_handle_mgmt_frame() - Process the Management frames from TXRX
+ * @psoc: psoc context
+ * @peer: peer
+ * @buf: buffer
+ * @mgmt_rx_params; rx event params
+ * @frm_type: frame type
  *
- * FUNCTION:
- *    Process the Management frames from TL
+ * This function handles the mgmt rx frame from mgmt txrx component and forms
+ * a cds packet and schedule it in controller thread for further processing.
  *
- * LOGIC:
- *
- * ASSUMPTIONS: TL sends the packet along with the CDS GlobalContext
- *
- * NOTE:
- *
- * @param p_cds_gctx  Global Vos Context
- * @param cds_buff  Packet
- * @return None
+ * Return: QDF_STATUS_SUCCESS - in case of success
  */
-
-static QDF_STATUS pe_handle_mgmt_frame(void *p_cds_gctx, void *cds_buff)
+static QDF_STATUS pe_handle_mgmt_frame(struct wlan_objmgr_psoc *psoc,
+			struct wlan_objmgr_peer *peer, qdf_nbuf_t buf,
+			void *mgmt_rx_params,
+			uint32_t frm_type)
 {
 	tpAniSirGlobal pMac;
 	tpSirMacMgmtHdr mHdr;
@@ -1028,17 +1032,27 @@
 	cds_pkt_t *pVosPkt;
 	QDF_STATUS qdf_status;
 	uint8_t *pRxPacketInfo;
-
-	pVosPkt = (cds_pkt_t *) cds_buff;
-	if (NULL == pVosPkt) {
-		return QDF_STATUS_E_FAILURE;
-	}
+	int ret;
 
 	pMac = cds_get_context(QDF_MODULE_ID_PE);
 	if (NULL == pMac) {
 		/* cannot log a failure without a valid pMac */
-		cds_pkt_return_packet(pVosPkt);
-		pVosPkt = NULL;
+		qdf_nbuf_free(buf);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	pVosPkt = qdf_mem_malloc(sizeof(*pVosPkt));
+	if (!pVosPkt) {
+		lim_log(pMac, LOGP,
+			FL("Failed to allocate rx packet"));
+		qdf_nbuf_free(buf);
+		return QDF_STATUS_E_NOMEM;
+	}
+
+	ret = wma_form_rx_packet(buf, mgmt_rx_params, pVosPkt);
+	if (ret) {
+		lim_log(pMac, LOGP,
+			FL("Failed to fill cds packet from event buffer"));
 		return QDF_STATUS_E_FAILURE;
 	}
 
@@ -1079,7 +1093,7 @@
 
 	/* Forward to MAC via mesg = SIR_BB_XPORT_MGMT_MSG */
 	msg.type = SIR_BB_XPORT_MGMT_MSG;
-	msg.bodyptr = cds_buff;
+	msg.bodyptr = pVosPkt;
 	msg.bodyval = 0;
 
 	if (eSIR_SUCCESS != sys_bbt_process_message_core(pMac,
@@ -1094,6 +1108,43 @@
 	return QDF_STATUS_SUCCESS;
 }
 
+void pe_register_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx)
+{
+	QDF_STATUS status;
+	struct mgmt_txrx_mgmt_frame_cb_info frm_cb_info;
+
+	frm_cb_info.frm_type = MGMT_FRAME_TYPE_ALL;
+	frm_cb_info.mgmt_rx_cb = (mgmt_frame_rx_callback)
+				pe_handle_mgmt_frame;
+
+	status = wlan_mgmt_txrx_register_rx_cb(mac_ctx->psoc,
+					 WLAN_UMAC_COMP_MLME, &frm_cb_info, 1);
+	if (status != QDF_STATUS_SUCCESS)
+		lim_log(mac_ctx, LOGP,
+			FL("Registering the PE Handle with MGMT TXRX layer has failed"));
+
+	wma_register_mgmt_frm_client();
+}
+
+void pe_deregister_mgmt_rx_frm_callback(tpAniSirGlobal mac_ctx)
+{
+	QDF_STATUS status;
+	struct mgmt_txrx_mgmt_frame_cb_info frm_cb_info;
+
+	frm_cb_info.frm_type = MGMT_FRAME_TYPE_ALL;
+	frm_cb_info.mgmt_rx_cb = (mgmt_frame_rx_callback)
+				pe_handle_mgmt_frame;
+
+	status = wlan_mgmt_txrx_deregister_rx_cb(mac_ctx->psoc,
+					 WLAN_UMAC_COMP_MLME, &frm_cb_info, 1);
+	if (status != QDF_STATUS_SUCCESS)
+		lim_log(mac_ctx, LOGP,
+			FL("Deregistering the PE Handle with MGMT TXRX layer has failed"));
+
+	wma_de_register_mgmt_frm_client();
+}
+
+
 /**
  * pe_register_callbacks_with_wma() - register SME and PE callback functions to
  * WMA.
@@ -1107,12 +1158,6 @@
 
 	p_cds_gctx = cds_get_global_context();
 
-	retStatus = wma_register_mgmt_frm_client(p_cds_gctx,
-				 pe_handle_mgmt_frame);
-	if (retStatus != QDF_STATUS_SUCCESS)
-		lim_log(pMac, LOGP,
-			FL("Registering the PE Handle with WMA has failed"));
-
 	retStatus = wma_register_roaming_callbacks(p_cds_gctx,
 			ready_req->csr_roam_synch_cb,
 			ready_req->pe_roam_synch_cb);
diff --git a/core/mac/src/pe/lim/lim_p2p.c b/core/mac/src/pe/lim/lim_p2p.c
index 4109854..4e80991 100644
--- a/core/mac/src/pe/lim/lim_p2p.c
+++ b/core/mac/src/pe/lim/lim_p2p.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014,2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014,2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -359,9 +359,8 @@
 
 	/* If remain on channel timer expired and action frame is pending then
 	 * indicaiton confirmation with status failure */
-	if (pMac->lim.mgmtFrameSessionId != 0xff) {
-		lim_p2p_action_cnf(pMac, false);
-	}
+	if (pMac->lim.mgmtFrameSessionId != 0xff)
+		lim_p2p_action_cnf(pMac, NULL, false, NULL);
 
 	return;
 }
@@ -407,11 +406,13 @@
 	return;
 }
 
-QDF_STATUS lim_p2p_action_cnf(tpAniSirGlobal pMac, uint32_t tx_status)
+QDF_STATUS lim_p2p_action_cnf(void *context, qdf_nbuf_t buf,
+			      uint32_t tx_status, void *params)
 {
 	QDF_STATUS status;
 	uint32_t mgmt_frame_sessionId;
 	bool tx_complete_ack = (tx_status) ? false : true;
+	tpAniSirGlobal pMac = (tpAniSirGlobal)context;
 
 	status = pe_acquire_global_lock(&pMac->lim);
 	if (QDF_IS_STATUS_SUCCESS(status)) {
@@ -477,9 +478,9 @@
 			channel_freq);
 
 		if (!mb_msg->noack)
-			lim_p2p_action_cnf(mac_ctx,
+			lim_p2p_action_cnf(mac_ctx, packet,
 				(QDF_IS_STATUS_SUCCESS(qdf_status)) ?
-				true : false);
+				true : false, NULL);
 		mac_ctx->lim.mgmtFrameSessionId = 0xff;
 	} else {
 		qdf_status =
@@ -494,7 +495,7 @@
 		if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
 			lim_log(mac_ctx, LOGE,
 				FL("couldn't send action frame"));
-			lim_p2p_action_cnf(mac_ctx, false);
+			lim_p2p_action_cnf(mac_ctx, packet, false, NULL);
 			mac_ctx->lim.mgmtFrameSessionId = 0xff;
 		} else {
 			mac_ctx->lim.mgmtFrameSessionId = mb_msg->sessionId;
@@ -549,7 +550,7 @@
 		lim_log(mac_ctx, LOGE,
 			FL("RemainOnChannel is not running"));
 		mac_ctx->lim.mgmtFrameSessionId = mb_msg->sessionId;
-		lim_p2p_action_cnf(mac_ctx, false);
+		lim_p2p_action_cnf(mac_ctx, NULL, false, NULL);
 		mac_ctx->lim.mgmtFrameSessionId = 0xff;
 		return;
 	}
diff --git a/core/mac/src/pe/lim/lim_process_message_queue.c b/core/mac/src/pe/lim/lim_process_message_queue.c
index 7ac7688..05e31fd 100644
--- a/core/mac/src/pe/lim/lim_process_message_queue.c
+++ b/core/mac/src/pe/lim/lim_process_message_queue.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1821,10 +1821,10 @@
 		msg->bodyptr = NULL;
 		break;
 	case WMA_DISASSOC_TX_COMP:
-		lim_disassoc_tx_complete_cnf(mac_ctx, msg->bodyval);
+		lim_disassoc_tx_complete_cnf(mac_ctx, NULL, msg->bodyval, NULL);
 		break;
 	case WMA_DEAUTH_TX_COMP:
-		lim_deauth_tx_complete_cnf(mac_ctx, msg->bodyval);
+		lim_deauth_tx_complete_cnf(mac_ctx, NULL, msg->bodyval, NULL);
 		break;
 #ifdef FEATURE_AP_MCC_CH_AVOIDANCE
 	case WMA_UPDATE_Q2Q_IE_IND:
diff --git a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
index 5303a90..44374ba 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -3309,7 +3309,7 @@
 			 * failure.
 			 */
 			if (pMac->lim.mgmtFrameSessionId != 0xff) {
-				lim_p2p_action_cnf(pMac, false);
+				lim_p2p_action_cnf(pMac, NULL, false, NULL);
 				pMac->lim.mgmtFrameSessionId = 0xff;
 			}
 		} else if (PREAUTH_REQUESTOR_ID == pScanEvent->requestor) {
diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
index a153139..4efaa0e 100644
--- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -553,6 +553,7 @@
 
 	if (ANI_DRIVER_TYPE(pMac) != eDRIVER_TYPE_MFG) {
 		ready_req->pe_roam_synch_cb = pe_roam_synch_callback;
+		pe_register_mgmt_rx_frm_callback(pMac);
 		pe_register_callbacks_with_wma(pMac, ready_req);
 		pMac->lim.add_bssdescr_callback = ready_req->add_bssdescr_cb;
 	}
diff --git a/core/mac/src/pe/lim/lim_process_tdls.c b/core/mac/src/pe/lim/lim_process_tdls.c
index 3260a8b..53bcfbc 100644
--- a/core/mac/src/pe/lim/lim_process_tdls.c
+++ b/core/mac/src/pe/lim/lim_process_tdls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -502,17 +502,22 @@
 
 /**
  * lim_mgmt_tdls_tx_complete - callback to indicate Tx completion
- * @mac_ctx: pointer to mac structure
+ * @context: pointer to mac structure
+ * @buf: buffer
  * @tx_complete: indicates tx sucess/failure
+ * @params: tx completion params
  *
  * function will be invoked on receiving tx completion indication
  *
  * return: success: eHAL_STATUS_SUCCESS failure: eHAL_STATUS_FAILURE
  */
-static QDF_STATUS lim_mgmt_tdls_tx_complete(tpAniSirGlobal mac_ctx,
-					    uint32_t tx_complete)
+static QDF_STATUS lim_mgmt_tdls_tx_complete(void *context,
+					    qdf_nbuf_t buf,
+					    uint32_t tx_complete,
+					    void *params)
 {
 	tpPESession session_entry = NULL;
+	tpAniSirGlobal mac_ctx = (tpAniSirGlobal)context;
 
 	lim_log(mac_ctx, LOG1, FL("tdls_frm_session_id %x tx_complete %x"),
 		mac_ctx->lim.tdls_frm_session_id, tx_complete);
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c
index 8db860f..09271f4 100644
--- a/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -2007,16 +2007,21 @@
 
 /**
  * lim_auth_tx_complete_cnf()- Confirmation for auth sent over the air
- *
- * @mac_ctx: pointer to global mac
+ * @context: pointer to global mac
+ * @buf: buffer
  * @tx_complete : Sent status
+ * @params; tx completion params
  *
  * Return: This returns QDF_STATUS
  */
 
-static QDF_STATUS lim_auth_tx_complete_cnf(tpAniSirGlobal mac_ctx,
-					   uint32_t tx_complete)
+static QDF_STATUS lim_auth_tx_complete_cnf(void *context,
+					   qdf_nbuf_t buf,
+					   uint32_t tx_complete,
+					   void *params)
 {
+	tpAniSirGlobal mac_ctx = (tpAniSirGlobal)context;
+
 	lim_log(mac_ctx, LOG1,
 		 FL("tx_complete= %d"), tx_complete);
 	if (tx_complete) {
@@ -2542,17 +2547,25 @@
 	return QDF_STATUS_SUCCESS;
 }
 
-QDF_STATUS lim_disassoc_tx_complete_cnf(tpAniSirGlobal pMac,
-					uint32_t txCompleteSuccess)
+QDF_STATUS lim_disassoc_tx_complete_cnf(void *context,
+					qdf_nbuf_t buf,
+					uint32_t txCompleteSuccess,
+					void *params)
 {
+	tpAniSirGlobal pMac = (tpAniSirGlobal)context;
+
 	lim_log(pMac, LOG1,
 		FL("txCompleteSuccess: %d"), txCompleteSuccess);
 	return lim_send_disassoc_cnf(pMac);
 }
 
-QDF_STATUS lim_deauth_tx_complete_cnf(tpAniSirGlobal pMac,
-				      uint32_t txCompleteSuccess)
+QDF_STATUS lim_deauth_tx_complete_cnf(void *context,
+				      qdf_nbuf_t buf,
+				      uint32_t txCompleteSuccess,
+				      void *params)
 {
+	tpAniSirGlobal pMac = (tpAniSirGlobal)context;
+
 	lim_log(pMac, LOG1,
 		FL("txCompleteSuccess: %d"), txCompleteSuccess);
 	return lim_send_deauth_cnf(pMac);
@@ -3554,16 +3567,22 @@
  * lim_oper_chan_change_confirm_tx_complete_cnf()- Confirmation for oper_chan_change_confirm
  * sent over the air
  *
- * @mac_ctx: pointer to global mac
+ * @context: pointer to global mac
+ * @buf: buffer
  * @tx_complete : Sent status
+ * @params: tx completion params
  *
  * Return: This returns QDF_STATUS
  */
 
 static QDF_STATUS lim_oper_chan_change_confirm_tx_complete_cnf(
-			tpAniSirGlobal mac_ctx,
-			uint32_t tx_complete)
+			void *context,
+			qdf_nbuf_t buf,
+			uint32_t tx_complete,
+			void *params)
 {
+	tpAniSirGlobal mac_ctx = (tpAniSirGlobal)context;
+
 	lim_log(mac_ctx, LOG1,
 		 FL(" tx_complete= %d"), tx_complete);
 	return QDF_STATUS_SUCCESS;
diff --git a/core/mac/src/pe/lim/lim_types.h b/core/mac/src/pe/lim/lim_types.h
index 71cd587..0115d4a 100644
--- a/core/mac/src/pe/lim/lim_types.h
+++ b/core/mac/src/pe/lim/lim_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -851,10 +851,38 @@
 void lim_process_deauth_ack_timeout(tpAniSirGlobal pMac);
 QDF_STATUS lim_send_disassoc_cnf(tpAniSirGlobal pMac);
 QDF_STATUS lim_send_deauth_cnf(tpAniSirGlobal pMac);
-QDF_STATUS lim_disassoc_tx_complete_cnf(tpAniSirGlobal pMac,
-					uint32_t txCompleteSuccess);
-QDF_STATUS lim_deauth_tx_complete_cnf(tpAniSirGlobal pMac,
-				      uint32_t txCompleteSuccess);
+
+/**
+ * lim_disassoc_tx_complete_cnf() - callback to indicate Tx completion
+ * @context: pointer to mac structure
+ * @buf: buffer
+ * @txCompleteSuccess: indicates tx success/failure
+ * @params: tx completion params
+ *
+ * function will be invoked on receiving tx completion indication
+ *
+ * return: success: QDF_STATUS_SUCCESS failure: QDF_STATUS_E_FAILURE
+ */
+QDF_STATUS lim_disassoc_tx_complete_cnf(void *context,
+					qdf_nbuf_t buf,
+					uint32_t txCompleteSuccess,
+					void *params);
+
+/**
+ * lim_deauth_tx_complete_cnf() - callback to indicate Tx completion
+ * @context: pointer to mac structure
+ * @buf: buffer
+ * @txCompleteSuccess: indicates tx success/failure
+ * @params: tx completion params
+ *
+ * function will be invoked on receiving tx completion indication
+ *
+ * return: success: QDF_STATUS_SUCCESS failure: QDF_STATUS_E_FAILURE
+ */
+QDF_STATUS lim_deauth_tx_complete_cnf(void *context,
+				      qdf_nbuf_t buf,
+				      uint32_t txCompleteSuccess,
+				      void *params);
 
 typedef struct sSetLinkCbackParams {
 	void *cbackDataPtr;
diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c
index 3948870..f2c377c 100644
--- a/core/mac/src/pe/lim/lim_utils.c
+++ b/core/mac/src/pe/lim/lim_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -4457,12 +4457,14 @@
  *
  * @param void A pointer to pData. Shouldn't it be pPacket?!
  *
- * @return none
+ * @return QDF_STATUS_SUCCESS - in case of success
  */
-void lim_tx_complete(tHalHandle hHal, void *data, bool free)
+QDF_STATUS lim_tx_complete(tHalHandle hHal, qdf_nbuf_t buf, bool free)
 {
 	if (free)
-		cds_packet_free((void *)data);
+		cds_packet_free((void *)buf);
+
+	return QDF_STATUS_SUCCESS;
 }
 
 /**
diff --git a/core/mac/src/pe/lim/lim_utils.h b/core/mac/src/pe/lim/lim_utils.h
index c8d0942..65b881e 100644
--- a/core/mac/src/pe/lim/lim_utils.h
+++ b/core/mac/src/pe/lim/lim_utils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -348,7 +348,7 @@
 		tpPESession psessionEntry);
 
 uint8_t lim_get_ht_capability(tpAniSirGlobal, uint32_t, tpPESession);
-void lim_tx_complete(tHalHandle hHal, void *pData, bool free);
+QDF_STATUS lim_tx_complete(tHalHandle hHal, qdf_nbuf_t buf, bool free);
 
 /**
  * This function will be registered with HAL for callback when TSPEC inactivity
@@ -628,8 +628,20 @@
 
 bool lim_is_robust_mgmt_action_frame(uint8_t action_category);
 bool lim_is_ext_cap_ie_present (struct s_ext_cap *ext_cap);
-QDF_STATUS lim_p2p_action_cnf(tpAniSirGlobal mac_ctx,
-			uint32_t tx_complete_success);
+
+/**
+ * lim_p2p_action_cnf() - callback to indicate Tx completion
+ * @mac_ctx: pointer to mac structure
+ * @buf: buffer
+ * @tx_complete_success: indicates tx success/failure
+ * @params: tx completion params
+ *
+ * function will be invoked on receiving tx completion indication
+ *
+ * return: success: eHAL_STATUS_SUCCESS failure: eHAL_STATUS_FAILURE
+ */
+QDF_STATUS lim_p2p_action_cnf(void *mac_ctx, qdf_nbuf_t buf,
+			uint32_t tx_complete_success, void *params);
 void lim_update_caps_info_for_bss(tpAniSirGlobal mac_ctx,
 			uint16_t *caps, uint16_t bss_caps);
 void lim_send_set_dtim_period(tpAniSirGlobal mac_ctx, uint8_t dtim_period,
diff --git a/core/wma/inc/wma.h b/core/wma/inc/wma.h
index 31f9300..4919086 100644
--- a/core/wma/inc/wma.h
+++ b/core/wma/inc/wma.h
@@ -1188,8 +1188,8 @@
  */
 
 struct wmi_desc_t {
-	pWMATxRxCompFunc tx_cmpl_cb;
-	pWMAAckFnTxComp  ota_post_proc_cb;
+	wma_tx_dwnld_comp_callback tx_cmpl_cb;
+	wma_tx_ota_comp_callback  ota_post_proc_cb;
 	qdf_nbuf_t	 nbuf;
 	uint32_t	 desc_id;
 	uint8_t vdev_id;
@@ -1372,7 +1372,6 @@
  * @in_d0wow: D0WOW is enable/disable
  * @miracast_value: miracast value
  * @log_completion_timer: log completion timer
- * @mgmt_rx: management rx callback
  * @num_dbs_hw_modes: Number of HW modes supported by the FW
  * @dbs_mode: DBS HW mode list
  * @old_hw_mode_index: Previous configured HW mode index
@@ -1444,7 +1443,7 @@
 	wmi_resource_config wlan_resource_config;
 	uint32_t frameTransRequired;
 	tBssSystemRole wmaGlobalSystemRole;
-	pWMATxRxCompFunc tx_frm_download_comp_cb;
+	wma_tx_dwnld_comp_callback tx_frm_download_comp_cb;
 	qdf_event_t tx_frm_download_comp_event;
 	/*
 	 * Dummy event to wait for draining MSDUs left in hardware tx
@@ -1453,8 +1452,8 @@
 	 * descriptors number to be zero.
 	 */
 	qdf_event_t tx_queue_empty_event;
-	pWMAAckFnTxComp umac_ota_ack_cb[SIR_MAC_MGMT_RESERVED15];
-	pWMAAckFnTxComp umac_data_ota_ack_cb;
+	wma_tx_ota_comp_callback umac_ota_ack_cb[SIR_MAC_MGMT_RESERVED15];
+	wma_tx_ota_comp_callback umac_data_ota_ack_cb;
 	unsigned long last_umac_data_ota_timestamp;
 	qdf_nbuf_t last_umac_data_nbuf;
 	bool needShutdown;
@@ -1539,7 +1538,6 @@
 	uint32_t hw_bd_info[HW_BD_INFO_SIZE];
 	uint32_t miracast_value;
 	qdf_mc_timer_t log_completion_timer;
-	wma_mgmt_frame_rx_callback mgmt_rx;
 	uint32_t num_dbs_hw_modes;
 	struct dbs_hw_mode_info hw_mode;
 	uint32_t old_hw_mode_index;
@@ -2320,7 +2318,6 @@
 			   u_int32_t peer_type, u_int8_t vdev_id,
 			   bool roam_synch_in_progress);
 
-#endif
 struct wma_ini_config *wma_get_ini_handle(tp_wma_handle wma_handle);
 WLAN_PHY_MODE wma_chan_phy_mode(u8 chan, enum phy_ch_width chan_width,
 	u8 dot11_mode);
@@ -2345,3 +2342,33 @@
 	int tid, uint16_t queue_no);
 int wma_peer_rx_reorder_queue_remove(void *scn_handle,
 	uint8_t vdev_id, uint8_t *peer_macaddr, uint32_t peer_tid_bitmap);
+
+/**
+ * wma_form_rx_packet() - form rx cds packet
+ * @buf: buffer
+ * @mgmt_rx_params: mgmt rx params
+ * @rx_pkt: cds packet
+ *
+ * This functions forms a cds packet from the rx mgmt frame received.
+ *
+ * Return: 0 for success or error code
+ */
+int wma_form_rx_packet(qdf_nbuf_t buf,
+			void *mgmt_rx_params,
+			cds_pkt_t *rx_pkt);
+
+/**
+ * wma_mgmt_unified_cmd_send() - send the mgmt tx packet
+ * @vdev: objmgr vdev
+ * @buf: buffer
+ * @desc_id: desc id
+ * @mgmt_tx_params: mgmt rx params
+ *
+ * This functions sends mgmt tx packet to WMI layer.
+ *
+ * Return: 0 for success or error code
+ */
+QDF_STATUS wma_mgmt_unified_cmd_send(struct wlan_objmgr_vdev *vdev,
+				qdf_nbuf_t buf, uint32_t desc_id,
+				void *mgmt_tx_params);
+#endif
diff --git a/core/wma/inc/wma_types.h b/core/wma/inc/wma_types.h
index d850a8b..3911b71 100644
--- a/core/wma/inc/wma_types.h
+++ b/core/wma/inc/wma_types.h
@@ -601,13 +601,32 @@
 	uint32_t status;
 } tDisableUapsdParams, *tpDisableUapsdParams;
 
-typedef void (*pWMATxRxCompFunc)(void *pContext, void *pData,
+/**
+ * wma_tx_dwnld_comp_callback - callback function for TX dwnld complete
+ * @context: global pMac pointer
+ * @buf: buffer
+ * @bFreeData: to free/not free the buffer
+ *
+ * callback function for mgmt tx download completion.
+ *
+ * Return: QDF_STATUS_SUCCESS in case of success
+ */
+typedef QDF_STATUS (*wma_tx_dwnld_comp_callback)(void *context, qdf_nbuf_t buf,
 				 bool bFreeData);
 
-/* callback function for TX complete */
-/* parameter 1 - global pMac pointer */
-/* parameter 2 - txComplete status : 1- success, 0 - failure. */
-typedef QDF_STATUS (*pWMAAckFnTxComp)(tpAniSirGlobal, uint32_t);
+/**
+ * wma_tx_ota_comp_callback - callback function for TX complete
+ * @context: global pMac pointer
+ * @buf: buffer
+ * @status: tx completion status
+ * @params: tx completion params
+ *
+ * callback function for mgmt tx ota completion.
+ *
+ * Return: QDF_STATUS_SUCCESS in case of success
+ */
+typedef QDF_STATUS (*wma_tx_ota_comp_callback)(void *context, qdf_nbuf_t buf,
+				      uint32_t status, void *params);
 
 typedef void (*wma_txFailIndCallback)(uint8_t *, uint8_t);
 
@@ -694,9 +713,9 @@
 			 eFrameType frmType,
 			 eFrameTxDir txDir,
 			 uint8_t tid,
-			 pWMATxRxCompFunc pCompFunc,
+			 wma_tx_dwnld_comp_callback pCompFunc,
 			 void *pData,
-			 pWMAAckFnTxComp pAckTxComp,
+			 wma_tx_ota_comp_callback pAckTxComp,
 			 uint8_t txFlag, uint8_t sessionId, bool tdlsflag,
 			 uint16_t channel_freq);
 
@@ -705,13 +724,9 @@
 		    wma_dfs_radar_indication_cb radar_ind_cb,
 		    struct cds_config_info *cds_cfg);
 
-typedef QDF_STATUS (*wma_mgmt_frame_rx_callback)(void *p_cds_gctx,
-					     void *cds_buff);
+QDF_STATUS wma_register_mgmt_frm_client(void);
 
-QDF_STATUS wma_register_mgmt_frm_client(void *p_cds_gctx,
-				wma_mgmt_frame_rx_callback mgmt_rx_cb);
-
-QDF_STATUS wma_de_register_mgmt_frm_client(void *p_cds_gctx);
+QDF_STATUS wma_de_register_mgmt_frm_client(void);
 #ifdef WLAN_FEATURE_ROAM_OFFLOAD
 QDF_STATUS wma_register_roaming_callbacks(void *cds_ctx,
 		void (*csr_roam_synch_cb)(tpAniSirGlobal mac,
diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c
index b1639f0..0ea9397 100644
--- a/core/wma/src/wma_data.c
+++ b/core/wma/src/wma_data.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -76,6 +76,11 @@
 #include "cdp_txrx_stats.h"
 #include <cdp_txrx_misc.h>
 #include "enet.h"
+#include "wlan_mgmt_txrx_utils_api.h"
+#include "wlan_objmgr_psoc_obj.h"
+#include "wlan_objmgr_pdev_obj.h"
+#include "wlan_objmgr_vdev_obj.h"
+#include "wlan_objmgr_peer_obj.h"
 
 typedef struct {
 	int32_t rate;
@@ -811,7 +816,7 @@
 {
 	struct wma_tx_ack_work_ctx *work;
 	tp_wma_handle wma_handle;
-	pWMAAckFnTxComp ack_cb;
+	wma_tx_ota_comp_callback ack_cb;
 
 	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGE("%s: Driver load/unload in progress", __func__);
@@ -830,8 +835,8 @@
 
 	/* Call the Ack Cb registered by UMAC */
 	if (ack_cb)
-		ack_cb((tpAniSirGlobal) (wma_handle->mac_context),
-			work->status ? 0 : 1);
+		ack_cb((tpAniSirGlobal) (wma_handle->mac_context), NULL,
+			work->status ? 0 : 1, NULL);
 	else
 		WMA_LOGE("Data Tx Ack Cb is NULL");
 
@@ -1361,7 +1366,7 @@
 {
 	struct wma_tx_ack_work_ctx *work;
 	tp_wma_handle wma_handle;
-	pWMAAckFnTxComp ack_cb;
+	wma_tx_ota_comp_callback ack_cb;
 
 	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGE("%s: Driver load/unload in progress", __func__);
@@ -1377,8 +1382,8 @@
 		 work->sub_type, work->status);
 
 	/* Call the Ack Cb registered by UMAC */
-	ack_cb((tpAniSirGlobal) (wma_handle->mac_context),
-	       work->status ? 0 : 1);
+	ack_cb((tpAniSirGlobal) (wma_handle->mac_context), NULL,
+	       work->status ? 0 : 1, NULL);
 
 	qdf_mem_free(work);
 	wma_handle->ack_work_ctx = NULL;
@@ -2490,9 +2495,11 @@
  */
 QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 			 eFrameType frmType, eFrameTxDir txDir, uint8_t tid,
-			 pWMATxRxCompFunc tx_frm_download_comp_cb, void *pData,
-			 pWMAAckFnTxComp tx_frm_ota_comp_cb, uint8_t tx_flag,
-			 uint8_t vdev_id, bool tdlsFlag, uint16_t channel_freq)
+			 wma_tx_dwnld_comp_callback tx_frm_download_comp_cb,
+			 void *pData,
+			 wma_tx_ota_comp_callback tx_frm_ota_comp_cb,
+			 uint8_t tx_flag, uint8_t vdev_id, bool tdlsFlag,
+			 uint16_t channel_freq)
 {
 	tp_wma_handle wma_handle = (tp_wma_handle) (wma_context);
 	int32_t status;
@@ -2513,9 +2520,12 @@
 	tpAniSirGlobal pMac;
 	tpSirMacMgmtHdr mHdr;
 	struct wmi_mgmt_params mgmt_param = {0};
-	struct wmi_desc_t *wmi_desc = NULL;
 	void *ctrl_pdev;
 	void *soc = cds_get_context(QDF_MODULE_ID_SOC);
+	struct ieee80211_frame *wh;
+	struct wlan_objmgr_peer *peer = NULL;
+	struct wlan_objmgr_psoc *psoc;
+	void *mac_addr;
 
 	if (NULL == wma_handle) {
 		WMA_LOGE("wma_handle is NULL");
@@ -2845,23 +2855,29 @@
 		mgmt_param.pdata = pData;
 		mgmt_param.chanfreq = chanfreq;
 		mgmt_param.qdf_ctx = cds_get_context(QDF_MODULE_ID_QDF_DEVICE);
-		wmi_desc = wmi_desc_get(wma_handle);
-		if (!wmi_desc) {
-			WMA_LOGE("%s: Failed to get wmi_desc", __func__);
-			status = QDF_STATUS_E_FAILURE;
-		} else {
-			mgmt_param.desc_id = wmi_desc->desc_id;
-			wmi_desc->vdev_id = vdev_id;
-			status = wmi_mgmt_unified_cmd_send(
-					wma_handle->wmi_handle,
-					&mgmt_param);
-			if (status) {
-				wmi_desc_put(wma_handle, wmi_desc);
-			} else {
-				wmi_desc->nbuf = tx_frame;
-				wmi_desc->tx_cmpl_cb = tx_frm_download_comp_cb;
-				wmi_desc->ota_post_proc_cb = tx_frm_ota_comp_cb;
-			}
+
+		psoc = wma_handle->psoc;
+		if (!psoc) {
+			WMA_LOGE("%s: psoc ctx is NULL", __func__);
+			goto error;
+		}
+
+		wh = (struct ieee80211_frame *)(qdf_nbuf_data(tx_frame));
+		mac_addr = wh->i_addr1;
+		peer = wlan_objmgr_find_peer(psoc, mac_addr);
+		if (!peer) {
+			mac_addr = wh->i_addr2;
+			peer = wlan_objmgr_find_peer(psoc, mac_addr);
+		}
+
+		status = wlan_mgmt_txrx_mgmt_frame_tx(peer,
+				(tpAniSirGlobal)wma_handle->mac_context,
+				(qdf_nbuf_t)tx_frame,
+				tx_frm_download_comp_cb, tx_frm_ota_comp_cb,
+				WLAN_UMAC_COMP_MLME, &mgmt_param);
+		if (status != QDF_STATUS_SUCCESS) {
+			WMA_LOGE("%s: mgmt tx failed", __func__);
+			goto error;
 		}
 	} else {
 		/* Hand over the Tx Mgmt frame to TxRx */
diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index 50bf766..0a47e03 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -71,6 +71,11 @@
 #include <cdp_txrx_cmn.h>
 #include <cdp_txrx_misc.h>
 #include <cdp_txrx_misc.h>
+#include "wlan_mgmt_txrx_tgt_api.h"
+#include "wlan_objmgr_psoc_obj.h"
+#include "wlan_objmgr_pdev_obj.h"
+#include "wlan_objmgr_vdev_obj.h"
+
 
 /**
  * wma_send_bcn_buf_ll() - prepare and send beacon buffer to fw for LL
@@ -2492,43 +2497,56 @@
 static int wma_process_mgmt_tx_completion(tp_wma_handle wma_handle,
 					  uint32_t desc_id, uint32_t status)
 {
-	struct wmi_desc_t *wmi_desc;
+	struct wlan_objmgr_psoc *psoc;
+	qdf_nbuf_t buf = NULL;
+	uint8_t vdev_id = 0;
+	QDF_STATUS ret;
+	struct wlan_lmac_if_mgmt_txrx_rx_ops *mgmt_txrx_rx_ops;
 
-	void *pdev = cds_get_context(QDF_MODULE_ID_TXRX);
-
-	if (pdev == NULL) {
-		WMA_LOGE("%s: NULL pdev pointer", __func__);
+	if (wma_handle == NULL) {
+		WMA_LOGE("%s: wma handle is NULL", __func__);
 		return -EINVAL;
 	}
 
-	WMA_LOGI("%s: status:%d wmi_desc_id:%d", __func__, status, desc_id);
+	WMA_LOGI("%s: status:%d desc id:%d", __func__, status, desc_id);
 
-	wmi_desc = (struct wmi_desc_t *)
-			(&wma_handle->wmi_desc_pool.array[desc_id]);
 
-	if (!wmi_desc) {
-		WMA_LOGE("%s: Invalid wmi desc", __func__);
+	psoc = wma_handle->psoc;
+	if (psoc == NULL) {
+		WMA_LOGE("%s: psoc ptr is NULL", __func__);
 		return -EINVAL;
 	}
 
-	if (wmi_desc->nbuf)
-		qdf_nbuf_unmap_single(wma_handle->qdf_dev, wmi_desc->nbuf,
+	mgmt_txrx_rx_ops = &psoc->soc_cb.rx_ops.mgmt_txrx_rx_ops;
+
+	if (mgmt_txrx_rx_ops->mgmt_txrx_get_nbuf_from_desc_id)
+		buf = mgmt_txrx_rx_ops->mgmt_txrx_get_nbuf_from_desc_id(
+					psoc, desc_id);
+
+	if (mgmt_txrx_rx_ops->mgmt_txrx_get_vdev_id_from_desc_id)
+		vdev_id = mgmt_txrx_rx_ops->mgmt_txrx_get_vdev_id_from_desc_id(
+					psoc, desc_id);
+	if (buf)
+		qdf_nbuf_unmap_single(wma_handle->qdf_dev, buf,
 					  QDF_DMA_TO_DEVICE);
 
 	if (wma_handle->wma_mgmt_tx_packetdump_cb)
-		wma_handle->wma_mgmt_tx_packetdump_cb(wmi_desc->nbuf,
-			QDF_STATUS_SUCCESS, wmi_desc->vdev_id, TX_MGMT_PKT);
+		wma_handle->wma_mgmt_tx_packetdump_cb(buf,
+			QDF_STATUS_SUCCESS, vdev_id, TX_MGMT_PKT);
 
-	if (wmi_desc->tx_cmpl_cb)
-		wmi_desc->tx_cmpl_cb(wma_handle->mac_context,
-					   wmi_desc->nbuf, 1);
+	if (!mgmt_txrx_rx_ops->mgmt_tx_completion_handler) {
+		WMA_LOGE("%s: tx completion callback to mgmt txrx layer is NULL",
+			__func__);
+		return -EINVAL;
+	}
+	ret = mgmt_txrx_rx_ops->mgmt_tx_completion_handler(psoc, desc_id,
+							   status, NULL);
 
-	if (wmi_desc->ota_post_proc_cb)
-		wmi_desc->ota_post_proc_cb((tpAniSirGlobal)
-						 wma_handle->mac_context,
-						 status);
+	if (ret != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Failed to process mgmt tx completion", __func__);
+		return -EINVAL;
+	}
 
-	wmi_desc_put(wma_handle, wmi_desc);
 	return 0;
 }
 
@@ -3149,85 +3167,66 @@
 	return should_drop;
 }
 
-/**
- * wma_mgmt_rx_process() - process management rx frame.
- * @handle: wma handle
- * @data: rx data
- * @data_len: data length
- *
- * Return: 0 for success or error code
- */
-static int wma_mgmt_rx_process(void *handle, uint8_t *data,
-				  uint32_t data_len)
+int wma_form_rx_packet(qdf_nbuf_t buf,
+			void *params,
+			cds_pkt_t *rx_pkt)
 {
-	tp_wma_handle wma_handle = (tp_wma_handle) handle;
-	WMI_MGMT_RX_EVENTID_param_tlvs *param_tlvs = NULL;
-	wmi_mgmt_rx_hdr *hdr = NULL;
+	wmi_host_mgmt_rx_hdr *mgmt_rx_params =
+				(wmi_host_mgmt_rx_hdr *)params;
 	struct wma_txrx_node *iface = NULL;
 	uint8_t vdev_id = WMA_INVALID_VDEV_ID;
-	cds_pkt_t *rx_pkt;
-	qdf_nbuf_t wbuf;
 	struct ieee80211_frame *wh;
 	uint8_t mgt_type, mgt_subtype;
 	int status;
+	tp_wma_handle wma_handle = (tp_wma_handle)
+				cds_get_context(QDF_MODULE_ID_WMA);
 
 	if (!wma_handle) {
-		WMA_LOGE("%s: Failed to get WMA  context", __func__);
+		WMA_LOGE(FL("wma handle is NULL"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
-	param_tlvs = (WMI_MGMT_RX_EVENTID_param_tlvs *) data;
-	if (!param_tlvs) {
-		WMA_LOGE("Get NULL point message from FW");
+	if (!mgmt_rx_params) {
+		WMA_LOGE(FL("mgmt rx params is NULL"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
-	hdr = param_tlvs->hdr;
-	if (!hdr) {
-		WMA_LOGE("Rx event is NULL");
-		return -EINVAL;
-	}
-
-	if (hdr->buf_len < sizeof(struct ieee80211_frame)) {
-		WMA_LOGE("Invalid rx mgmt packet");
-		return -EINVAL;
-	}
-
-	rx_pkt = qdf_mem_malloc(sizeof(*rx_pkt));
-	if (!rx_pkt) {
-		WMA_LOGE("Failed to allocate rx packet");
-		return -ENOMEM;
-	}
-
 	if (cds_is_load_or_unload_in_progress()) {
 		WMA_LOGW(FL("Load/Unload in progress"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
 	if (cds_is_driver_recovering()) {
 		WMA_LOGW(FL("Recovery in progress"));
+		qdf_nbuf_free(buf);
+		qdf_mem_free(rx_pkt);
 		return -EINVAL;
 	}
 
-	qdf_mem_zero(rx_pkt, sizeof(*rx_pkt));
-
 	/*
 	 * Fill in meta information needed by pe/lim
 	 * TODO: Try to maintain rx metainfo as part of skb->data.
 	 */
-	rx_pkt->pkt_meta.channel = hdr->channel;
-	rx_pkt->pkt_meta.scan_src = hdr->flags;
+	rx_pkt->pkt_meta.channel = mgmt_rx_params->channel;
+	rx_pkt->pkt_meta.scan_src = mgmt_rx_params->flags;
 
 	/*
 	 * Get the rssi value from the current snr value
 	 * using standard noise floor of -96.
 	 */
-	rx_pkt->pkt_meta.rssi = hdr->snr + WMA_NOISE_FLOOR_DBM_DEFAULT;
-	rx_pkt->pkt_meta.snr = hdr->snr;
+	rx_pkt->pkt_meta.rssi = mgmt_rx_params->snr +
+				WMA_NOISE_FLOOR_DBM_DEFAULT;
+	rx_pkt->pkt_meta.snr = mgmt_rx_params->snr;
 
 	/* If absolute rssi is available from firmware, use it */
-	if (hdr->rssi != 0)
-		rx_pkt->pkt_meta.rssi_raw = hdr->rssi;
+	if (mgmt_rx_params->rssi != 0)
+		rx_pkt->pkt_meta.rssi_raw = mgmt_rx_params->rssi;
 	else
 		rx_pkt->pkt_meta.rssi_raw = rx_pkt->pkt_meta.rssi;
 
@@ -3238,66 +3237,26 @@
 	 */
 	rx_pkt->pkt_meta.timestamp = (uint32_t) jiffies;
 	rx_pkt->pkt_meta.mpdu_hdr_len = sizeof(struct ieee80211_frame);
-	rx_pkt->pkt_meta.mpdu_len = hdr->buf_len;
-	rx_pkt->pkt_meta.mpdu_data_len = hdr->buf_len -
+	rx_pkt->pkt_meta.mpdu_len = mgmt_rx_params->buf_len;
+	rx_pkt->pkt_meta.mpdu_data_len = mgmt_rx_params->buf_len -
 					 rx_pkt->pkt_meta.mpdu_hdr_len;
 
 	rx_pkt->pkt_meta.roamCandidateInd = 0;
 
-	/* Why not just use rx_event->hdr.buf_len? */
-	wbuf = qdf_nbuf_alloc(NULL, roundup(hdr->buf_len, 4), 0, 4, false);
-	if (!wbuf) {
-		WMA_LOGE("%s: Failed to allocate wbuf for mgmt rx len(%u)",
-			    __func__, hdr->buf_len);
-		qdf_mem_free(rx_pkt);
-		return -ENOMEM;
-	}
+	wh = (struct ieee80211_frame *)qdf_nbuf_data(buf);
 
-	qdf_nbuf_put_tail(wbuf, hdr->buf_len);
-	qdf_nbuf_set_protocol(wbuf, ETH_P_CONTROL);
-	wh = (struct ieee80211_frame *)qdf_nbuf_data(wbuf);
-
-	rx_pkt->pkt_meta.mpdu_hdr_ptr = qdf_nbuf_data(wbuf);
+	rx_pkt->pkt_meta.mpdu_hdr_ptr = qdf_nbuf_data(buf);
 	rx_pkt->pkt_meta.mpdu_data_ptr = rx_pkt->pkt_meta.mpdu_hdr_ptr +
 					 rx_pkt->pkt_meta.mpdu_hdr_len;
-	rx_pkt->pkt_meta.tsf_delta = hdr->tsf_delta;
-	rx_pkt->pkt_buf = wbuf;
-
-#ifdef BIG_ENDIAN_HOST
-	{
-		/*
-		 * for big endian host, copy engine byte_swap is enabled
-		 * But the rx mgmt frame buffer content is in network byte order
-		 * Need to byte swap the mgmt frame buffer content - so when
-		 * copy engine does byte_swap - host gets buffer content in the
-		 * correct byte order.
-		 */
-		int i;
-		uint32_t *destp, *srcp;
-		destp = (uint32_t *) wh;
-		srcp = (uint32_t *) param_tlvs->bufp;
-		for (i = 0;
-		     i < (roundup(hdr->buf_len, sizeof(uint32_t)) / 4); i++) {
-			*destp = cpu_to_le32(*srcp);
-			destp++;
-			srcp++;
-		}
-	}
-#else
-	qdf_mem_copy(wh, param_tlvs->bufp, hdr->buf_len);
-#endif
+	rx_pkt->pkt_meta.tsf_delta = mgmt_rx_params->tsf_delta;
+	rx_pkt->pkt_buf = buf;
 
 	WMA_LOGD(
 		FL("BSSID: "MAC_ADDRESS_STR" snr = %d, rssi = %d, rssi_raw = %d tsf_delta: %u"),
 			MAC_ADDR_ARRAY(wh->i_addr3),
-			hdr->snr, rx_pkt->pkt_meta.rssi,
+			mgmt_rx_params->snr, rx_pkt->pkt_meta.rssi,
 			rx_pkt->pkt_meta.rssi_raw,
-			hdr->tsf_delta);
-	if (!wma_handle->mgmt_rx) {
-		WMA_LOGE("Not registered for Mgmt rx, dropping the frame");
-		cds_pkt_return_packet(rx_pkt);
-		return -EINVAL;
-	}
+			mgmt_rx_params->tsf_delta);
 
 	/* If it is a beacon/probe response, save it for future use */
 	mgt_type = (wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
@@ -3313,19 +3272,20 @@
 			iface = &(wma_handle->interfaces[vdev_id]);
 			if (iface->rmfEnabled) {
 				status = wma_process_rmf_frame(wma_handle,
-					iface, wh, rx_pkt, wbuf);
+					iface, wh, rx_pkt, buf);
+				if (status != 0)
+					return status;
 				/*
 				 * CCMP header might have been pulled off
 				 * reinitialize the start pointer of mac header
 				 */
 				wh = (struct ieee80211_frame *)
-						qdf_nbuf_data(wbuf);
-				if (status != 0)
-					return status;
+						qdf_nbuf_data(buf);
 			}
 		}
 	}
 #endif /* WLAN_FEATURE_11W */
+
 	rx_pkt->pkt_meta.sessionId =
 		(vdev_id == WMA_INVALID_VDEV_ID ? 0 : vdev_id);
 
@@ -3341,37 +3301,160 @@
 			QDF_STATUS_SUCCESS, rx_pkt->pkt_meta.sessionId,
 			RX_MGMT_PKT);
 
-	wma_handle->mgmt_rx(wma_handle, rx_pkt);
+	return 0;
+}
+
+/**
+ * wma_mem_endianness_based_copy() - does memory copy from src to dst
+ * @dst: destination address
+ * @src: source address
+ * @size: size to be copied
+ *
+ * This function copies the memory of size passed from source
+ * address to destination address.
+ *
+ * Return: Nothing
+ */
+#ifdef BIG_ENDIAN_HOST
+static void wma_mem_endianness_based_copy(
+			uint8_t *dst, uint8_t *src, uint32_t size)
+{
+	/*
+	 * For big endian host, copy engine byte_swap is enabled
+	 * But the rx mgmt frame buffer content is in network byte order
+	 * Need to byte swap the mgmt frame buffer content - so when
+	 * copy engine does byte_swap - host gets buffer content in the
+	 * correct byte order.
+	 */
+
+	uint32_t i;
+	uint32_t *destp, *srcp;
+
+	destp = (uint32_t *) dst;
+	srcp = (uint32_t *) src;
+	for (i = 0; i < (roundup(size, sizeof(uint32_t)) / 4); i++) {
+		*destp = cpu_to_le32(*srcp);
+		destp++;
+		srcp++;
+	}
+}
+#else
+static void wma_mem_endianness_based_copy(
+			uint8_t *dst, uint8_t *src, uint32_t size)
+{
+	qdf_mem_copy(dst, src, size);
+}
+#endif
+
+/**
+ * wma_mgmt_rx_process() - process management rx frame.
+ * @handle: wma handle
+ * @data: rx data
+ * @data_len: data length
+ *
+ * Return: 0 for success or error code
+ */
+static int wma_mgmt_rx_process(void *handle, uint8_t *data,
+				  uint32_t data_len)
+{
+	tp_wma_handle wma_handle = (tp_wma_handle) handle;
+	wmi_host_mgmt_rx_hdr *mgmt_rx_params;
+	struct wlan_objmgr_psoc *psoc;
+	uint8_t *bufp;
+	qdf_nbuf_t wbuf;
+	QDF_STATUS status;
+
+	if (!wma_handle) {
+		WMA_LOGE("%s: Failed to get WMA  context", __func__);
+		return -EINVAL;
+	}
+
+	mgmt_rx_params = qdf_mem_malloc(sizeof(*mgmt_rx_params));
+	if (!mgmt_rx_params) {
+		WMA_LOGE("%s: memory allocation failed", __func__);
+		return -ENOMEM;
+	}
+
+	if (wmi_extract_mgmt_rx_params(wma_handle->wmi_handle,
+			data, mgmt_rx_params, &bufp) != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Extraction of mgmt rx params failed", __func__);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	wbuf = qdf_nbuf_alloc(NULL, roundup(mgmt_rx_params->buf_len, 4),
+				0, 4, false);
+	if (!wbuf) {
+		WMA_LOGE("%s: Failed to allocate wbuf for mgmt rx len(%u)",
+			    __func__, mgmt_rx_params->buf_len);
+		qdf_mem_free(mgmt_rx_params);
+		return -ENOMEM;
+	}
+
+	qdf_nbuf_put_tail(wbuf, mgmt_rx_params->buf_len);
+	qdf_nbuf_set_protocol(wbuf, ETH_P_CONTROL);
+
+	wma_mem_endianness_based_copy(qdf_nbuf_data(wbuf),
+			bufp, mgmt_rx_params->buf_len);
+
+	psoc = (struct wlan_objmgr_psoc *)
+				wma_handle->psoc;
+	if (!psoc) {
+		WMA_LOGE("%s: psoc ctx is NULL", __func__);
+		qdf_nbuf_free(wbuf);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	if (!psoc->soc_cb.rx_ops.mgmt_txrx_rx_ops.mgmt_rx_frame_handler) {
+		WMA_LOGE("%s: rx callback to mgmt txrx layer is NULL",
+			__func__);
+		qdf_nbuf_free(wbuf);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	status = psoc->soc_cb.rx_ops.mgmt_txrx_rx_ops.mgmt_rx_frame_handler(
+				psoc, wbuf, mgmt_rx_params);
+
+	if (status != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: Failed to process mgmt rx frame", __func__);
+		qdf_mem_free(mgmt_rx_params);
+		return -EINVAL;
+	}
+
+	qdf_mem_free(mgmt_rx_params);
 	return 0;
 }
 
 /**
  * wma_de_register_mgmt_frm_client() - deregister management frame
- * @cds_ctx: cds context
+ *
+ * This function deregisters the event handler registered for
+ * WMI_MGMT_RX_EVENTID.
  *
  * Return: QDF status
  */
-QDF_STATUS wma_de_register_mgmt_frm_client(void *cds_ctx)
+QDF_STATUS wma_de_register_mgmt_frm_client(void)
 {
-	tp_wma_handle wma_handle;
+	tp_wma_handle wma_handle = (tp_wma_handle)
+				cds_get_context(QDF_MODULE_ID_WMA);
+
+	if (!wma_handle) {
+		WMA_LOGE("%s: Failed to get WMA context", __func__);
+		return QDF_STATUS_E_NULL_VALUE;
+	}
 
 #ifdef QCA_WIFI_FTM
 	if (cds_get_conparam() == QDF_GLOBAL_FTM_MODE)
 		return QDF_STATUS_SUCCESS;
 #endif
 
-	wma_handle = cds_get_context(QDF_MODULE_ID_WMA);
-	if (!wma_handle) {
-		WMA_LOGE("%s: Failed to get WMA context", __func__);
-		return QDF_STATUS_E_FAILURE;
-	}
-
 	if (wmi_unified_unregister_event_handler(wma_handle->wmi_handle,
 						 WMI_MGMT_RX_EVENTID) != 0) {
 		WMA_LOGE("Failed to Unregister rx mgmt handler with wmi");
 		return QDF_STATUS_E_FAILURE;
 	}
-	wma_handle->mgmt_rx = NULL;
 	return QDF_STATUS_SUCCESS;
 }
 
@@ -3412,19 +3495,19 @@
 
 /**
  * wma_register_mgmt_frm_client() - register management frame callback
- * @cds_ctx: cds context
- * @mgmt_frm_rx: management frame
+ *
+ * This function registers event handler for WMI_MGMT_RX_EVENTID.
  *
  * Return: QDF status
  */
-QDF_STATUS wma_register_mgmt_frm_client(
-	void *cds_ctx, wma_mgmt_frame_rx_callback mgmt_frm_rx)
+QDF_STATUS wma_register_mgmt_frm_client(void)
 {
-	tp_wma_handle wma_handle = cds_get_context(QDF_MODULE_ID_WMA);
+	tp_wma_handle wma_handle = (tp_wma_handle)
+				cds_get_context(QDF_MODULE_ID_WMA);
 
 	if (!wma_handle) {
 		WMA_LOGE("%s: Failed to get WMA context", __func__);
-		return QDF_STATUS_E_FAILURE;
+		return QDF_STATUS_E_NULL_VALUE;
 	}
 
 	if (wmi_unified_register_event_handler(wma_handle->wmi_handle,
@@ -3434,7 +3517,6 @@
 		WMA_LOGE("Failed to register rx mgmt handler with wmi");
 		return QDF_STATUS_E_FAILURE;
 	}
-	wma_handle->mgmt_rx = mgmt_frm_rx;
 
 	return QDF_STATUS_SUCCESS;
 }
@@ -3486,3 +3568,40 @@
 	wma_handle->wma_mgmt_tx_packetdump_cb = NULL;
 	wma_handle->wma_mgmt_rx_packetdump_cb = NULL;
 }
+
+QDF_STATUS wma_mgmt_unified_cmd_send(struct wlan_objmgr_vdev *vdev,
+				qdf_nbuf_t buf, uint32_t desc_id,
+				void *mgmt_tx_params)
+{
+	tp_wma_handle wma_handle;
+	QDF_STATUS status;
+	struct wmi_mgmt_params *mgmt_params =
+			(struct wmi_mgmt_params *)mgmt_tx_params;
+
+	if (!mgmt_params) {
+		WMA_LOGE("%s: mgmt_params ptr passed is NULL", __func__);
+		return QDF_STATUS_E_INVAL;
+	}
+	mgmt_params->desc_id = desc_id;
+
+	if (!vdev) {
+		WMA_LOGE("%s: vdev ptr passed is NULL", __func__);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	wma_handle = cds_get_context(QDF_MODULE_ID_WMA);
+	if (!wma_handle) {
+		WMA_LOGE("%s: wma handle is NULL", __func__);
+		return QDF_STATUS_E_INVAL;
+	}
+
+	status = wmi_mgmt_unified_cmd_send(wma_handle->wmi_handle,
+				mgmt_params);
+	if (status != QDF_STATUS_SUCCESS) {
+		WMA_LOGE("%s: mgmt tx failed", __func__);
+		return status;
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+