diff --git a/src/common/privsep_commands.h b/src/common/privsep_commands.h
index 1eb3a7050..cc900be9d 100644
--- a/src/common/privsep_commands.h
+++ b/src/common/privsep_commands.h
@@ -70,7 +70,6 @@ enum privsep_event {
 	PRIVSEP_EVENT_STKSTART,
 	PRIVSEP_EVENT_FT_RESPONSE,
 	PRIVSEP_EVENT_RX_EAPOL,
-	PRIVSEP_EVENT_STA_RX,
 };
 
 #endif /* PRIVSEP_COMMANDS_H */
diff --git a/src/drivers/driver.h b/src/drivers/driver.h
index 1ee43c627..5fbb79125 100644
--- a/src/drivers/driver.h
+++ b/src/drivers/driver.h
@@ -404,12 +404,6 @@ struct wpa_driver_capa {
 };
 
 
-struct ieee80211_rx_status {
-        int channel;
-        int ssi;
-};
-
-
 struct hostapd_data;
 
 struct hostap_sta_driver_data {
@@ -1724,7 +1718,14 @@ typedef enum wpa_event_type {
 	/**
 	 * EVENT_RX_MGMT - Report RX of a management frame
 	 */
-	EVENT_RX_MGMT
+	EVENT_RX_MGMT,
+
+	/**
+	 * EVENT_MLME_RX - Report reception of frame for MLME (test use only)
+	 *
+	 * This event is used only by driver_test.c and userspace MLME.
+	 */
+	EVENT_MLME_RX
 } wpa_event_type;
 
 
@@ -1966,6 +1967,17 @@ union wpa_event_data {
 		struct wpa_driver_scan_ssid ssids[WPAS_MAX_SCAN_SSIDS];
 		size_t num_ssids;
 	} scan_info;
+
+	/**
+	 * struct mlme_rx - Data for EVENT_MLME_RX events
+	 */
+	struct mlme_rx {
+		const u8 *buf;
+		size_t len;
+		int freq;
+		int channel;
+		int ssi;
+	} mlme_rx;
 };
 
 /**
@@ -1998,9 +2010,6 @@ void wpa_supplicant_event(void *ctx, wpa_event_type event,
 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
 			     const u8 *buf, size_t len);
 
-void wpa_supplicant_sta_rx(void *ctx, const u8 *buf, size_t len,
-			   struct ieee80211_rx_status *rx_status);
-
 const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie);
 const u8 * wpa_scan_get_vendor_ie(const struct wpa_scan_res *res,
 				  u32 vendor_type);
diff --git a/src/drivers/driver_privsep.c b/src/drivers/driver_privsep.c
index 077f853a6..d9911e98f 100644
--- a/src/drivers/driver_privsep.c
+++ b/src/drivers/driver_privsep.c
@@ -438,22 +438,6 @@ static void wpa_driver_privsep_event_rx_eapol(void *ctx, u8 *buf, size_t len)
 }
 
 
-static void wpa_driver_privsep_event_sta_rx(void *ctx, u8 *buf, size_t len)
-{
-#ifdef CONFIG_CLIENT_MLME
-	struct ieee80211_rx_status *rx_status;
-
-	if (len < sizeof(*rx_status))
-		return;
-	rx_status = (struct ieee80211_rx_status *) buf;
-	buf += sizeof(*rx_status);
-	len -= sizeof(*rx_status);
-
-	wpa_supplicant_sta_rx(ctx, buf, len, rx_status);
-#endif /* CONFIG_CLIENT_MLME */
-}
-
-
 static void wpa_driver_privsep_receive(int sock, void *eloop_ctx,
 				       void *sock_ctx)
 {
@@ -530,10 +514,6 @@ static void wpa_driver_privsep_receive(int sock, void *eloop_ctx,
 		wpa_driver_privsep_event_rx_eapol(drv->ctx, event_buf,
 						  event_len);
 		break;
-	case PRIVSEP_EVENT_STA_RX:
-		wpa_driver_privsep_event_sta_rx(drv->ctx, event_buf,
-						event_len);
-		break;
 	}
 
 	os_free(buf);
diff --git a/src/drivers/driver_test.c b/src/drivers/driver_test.c
index 6a4925238..add1e9801 100644
--- a/src/drivers/driver_test.c
+++ b/src/drivers/driver_test.c
@@ -1790,11 +1790,11 @@ static void wpa_driver_test_mlme(struct wpa_driver_test_data *drv,
 				 socklen_t fromlen,
 				 const u8 *data, size_t data_len)
 {
-#ifdef CONFIG_CLIENT_MLME
-	struct ieee80211_rx_status rx_status;
-	os_memset(&rx_status, 0, sizeof(rx_status));
-	wpa_supplicant_sta_rx(drv->ctx, data, data_len, &rx_status);
-#endif /* CONFIG_CLIENT_MLME */
+	union wpa_event_data event;
+	os_memset(&event, 0, sizeof(event));
+	event.mlme_rx.buf = data;
+	event.mlme_rx.len = data_len;
+	wpa_supplicant_event(drv->ctx, EVENT_MLME_RX, &event);
 }
 
 
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 3c2010c5e..5d3533a79 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -37,6 +37,7 @@
 #include "bgscan.h"
 #include "ap.h"
 #include "bss.h"
+#include "mlme.h"
 
 
 static int wpa_supplicant_select_config(struct wpa_supplicant *wpa_s)
@@ -1503,6 +1504,19 @@ void wpa_supplicant_event(void *ctx, wpa_event_type event,
 			   data->rx_mgmt.frame_len, data->rx_mgmt.fi);
 		break;
 #endif /* CONFIG_AP */
+#ifdef CONFIG_CLIENT_MLME
+	case EVENT_MLME_RX: {
+		struct ieee80211_rx_status rx_status;
+		os_memset(&rx_status, 0, sizeof(rx_status));
+		rx_status.freq = data->mlme_rx.freq;
+		rx_status.channel = data->mlme_rx.channel;
+		rx_status.ssi = data->mlme_rx.ssi;
+		ieee80211_sta_rx(wpa_s, data->mlme_rx.buf, data->mlme_rx.len,
+				 &rx_status);
+		break;
+	}
+#endif /* CONFIG_CLIENT_MLME */
+
 	default:
 		wpa_printf(MSG_INFO, "Unknown event %d", event);
 		break;
diff --git a/wpa_supplicant/mlme.h b/wpa_supplicant/mlme.h
index ee57dfbd9..5db36656c 100644
--- a/wpa_supplicant/mlme.h
+++ b/wpa_supplicant/mlme.h
@@ -19,6 +19,12 @@
 
 struct wpa_supplicant;
 
+struct ieee80211_rx_status {
+	int freq;
+        int channel;
+        int ssi;
+};
+
 #ifdef CONFIG_CLIENT_MLME
 
 int ieee80211_sta_init(struct wpa_supplicant *wpa_s);
diff --git a/wpa_supplicant/wpa_priv.c b/wpa_supplicant/wpa_priv.c
index b7825ed2a..d2a991b97 100644
--- a/wpa_supplicant/wpa_priv.c
+++ b/wpa_supplicant/wpa_priv.c
@@ -915,35 +915,6 @@ void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
 }
 
 
-#ifdef CONFIG_CLIENT_MLME
-void wpa_supplicant_sta_rx(void *ctx, const u8 *buf, size_t len,
-			   struct ieee80211_rx_status *rx_status)
-{
-	struct wpa_priv_interface *iface = ctx;
-	struct msghdr msg;
-	struct iovec io[3];
-	int event = PRIVSEP_EVENT_STA_RX;
-
-	wpa_printf(MSG_DEBUG, "STA RX from driver");
-	io[0].iov_base = &event;
-	io[0].iov_len = sizeof(event);
-	io[1].iov_base = (u8 *) rx_status;
-	io[1].iov_len = sizeof(*rx_status);
-	io[2].iov_base = (u8 *) buf;
-	io[2].iov_len = len;
-
-	os_memset(&msg, 0, sizeof(msg));
-	msg.msg_iov = io;
-	msg.msg_iovlen = 3;
-	msg.msg_name = &iface->drv_addr;
-	msg.msg_namelen = sizeof(iface->drv_addr);
-
-	if (sendmsg(iface->fd, &msg, 0) < 0)
-		perror("sendmsg(wpas_socket)");
-}
-#endif /* CONFIG_CLIENT_MLME */
-
-
 static void wpa_priv_terminate(int sig, void *eloop_ctx, void *signal_ctx)
 {
 	wpa_printf(MSG_DEBUG, "wpa_priv termination requested");
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index fd8a19f6a..fc42d2939 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1819,14 +1819,6 @@ void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
 }
 
 
-void wpa_supplicant_sta_rx(void *ctx, const u8 *buf, size_t len,
-			   struct ieee80211_rx_status *rx_status)
-{
-	struct wpa_supplicant *wpa_s = ctx;
-	ieee80211_sta_rx(wpa_s, buf, len, rx_status);
-}
-
-
 /**
  * wpa_supplicant_driver_init - Initialize driver interface parameters
  * @wpa_s: Pointer to wpa_supplicant data