diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 0edb256..7243d26 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -1785,7 +1785,15 @@ enum nl80211_ps_state {
  * @NL80211_ATTR_CQM_RSSI_HYST: RSSI hysteresis in dBm. This value specifies
  *	the minimum amount the RSSI level must change after an event before a
  *	new event may be issued (to reduce effects of RSSI oscillation).
- * @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT: RSSI threshold event
+ * @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT: RSSI threshold event.  This provides
+ *      the current bitrate (in 1000 bits per second) at the time that a
+ *      threshold was crossed.
+ * @NL80211_ATTR_CQM_BITRATE_THOLD: Bitrate threshold in 1000 bits per second.
+ *      This specifies the threshold at which an event will be sent.  Set to
+ *      zero to disable.  Events will be sent when the threshold is crossed
+ *      in either direction, and while under threshold, whenever the bitrate
+ *      achieves its lowest value in the current below-threshold excursion.
+ * @NL80211_ATTR_CQM_BITRATE_THRESHOLD_EVENT: New transmit bitrate
  * @__NL80211_ATTR_CQM_AFTER_LAST: internal
  * @NL80211_ATTR_CQM_MAX: highest key attribute
  */
@@ -1794,6 +1802,8 @@ enum nl80211_attr_cqm {
 	NL80211_ATTR_CQM_RSSI_THOLD,
 	NL80211_ATTR_CQM_RSSI_HYST,
 	NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
+	NL80211_ATTR_CQM_BITRATE_THOLD,
+	NL80211_ATTR_CQM_BITRATE_THRESHOLD_EVENT,
 
 	/* keep last */
 	__NL80211_ATTR_CQM_AFTER_LAST,
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 2a7936d..e7f044e 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1146,6 +1146,7 @@ struct cfg80211_pmksa {
  * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
  *	allows the driver to adjust the dynamic ps timeout value.
  * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
+ * @set_cqm_bitrate_config: Config connection quality monitor bitrate threshold.
  *
  * @mgmt_frame_register: Notify driver that a management frame type was
  *	registered. Note that this callback may not sleep, and cannot run
@@ -1301,6 +1302,10 @@ struct cfg80211_ops {
 				       struct net_device *dev,
 				       s32 rssi_thold, u32 rssi_hyst);
 
+	int	(*set_cqm_bitrate_config)(struct wiphy *wiphy,
+					  struct net_device *dev,
+					  u32 bitrate_thold);
+
 	void	(*mgmt_frame_register)(struct wiphy *wiphy,
 				       struct net_device *dev,
 				       u16 frame_type, bool reg);
@@ -2595,6 +2600,19 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
 			      enum nl80211_cqm_rssi_threshold_event rssi_event,
 			      gfp_t gfp);
 
+/**
+ * cfg80211_cqm_bitrate_notify - connection quality monitoring bitrate event
+ * @dev: network device
+ * @rate: the new transmit rate
+ * @gfp: context flags
+ *
+ * This function is called when a the transmit bitrate changes, and
+ * connection quality monitoring is configured to capture these events.
+ */
+void cfg80211_cqm_bitrate_notify(struct net_device *dev,
+				 u32 bitrate,
+				 gfp_t gfp);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 26838d9..ebb4e3a 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1028,3 +1028,16 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
 	nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
 }
 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
+
+void cfg80211_cqm_bitrate_notify(struct net_device *dev,
+				 u32 bitrate,
+				 gfp_t gfp)
+{
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	struct wiphy *wiphy = wdev->wiphy;
+	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+	/* Indicate roaming trigger event to user space */
+	nl80211_send_cqm_bitrate_notify(rdev, dev, bitrate, gfp);
+}
+EXPORT_SYMBOL(cfg80211_cqm_bitrate_notify);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c506241..de5f0b6 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4325,6 +4325,8 @@ nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
 	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
 	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
 	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
+	[NL80211_ATTR_CQM_BITRATE_THOLD] = { .type = NLA_U32 },
+	[NL80211_ATTR_CQM_BITRATE_THRESHOLD_EVENT] = { .type = NLA_U32 },
 };
 
 static int nl80211_set_cqm_rssi(struct genl_info *info,
@@ -4350,6 +4352,26 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
 					      threshold, hysteresis);
 }
 
+static int nl80211_set_cqm_bitrate(struct genl_info *info,
+					   u32 trigger_rate)
+{
+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
+	struct wireless_dev *wdev;
+	struct net_device *dev = info->user_ptr[1];
+
+	wdev = dev->ieee80211_ptr;
+
+	if (!rdev->ops->set_cqm_bitrate_config)
+		return -EOPNOTSUPP;
+
+	if (wdev->iftype != NL80211_IFTYPE_STATION &&
+	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
+		return -EOPNOTSUPP;
+
+	return rdev->ops->set_cqm_bitrate_config(wdev->wiphy, dev,
+						 trigger_rate);
+}
+
 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
@@ -4367,6 +4389,8 @@ static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
 	if (err)
 		goto out;
 
+	err = -EINVAL;
+
 	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
 	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
 		s32 threshold;
@@ -4374,8 +4398,16 @@ static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
 		threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
 		hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
 		err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
-	} else
-		err = -EINVAL;
+		if (err)
+			goto out;
+	}
+
+	if (attrs[NL80211_ATTR_CQM_BITRATE_THOLD]) {
+		u32 thold = nla_get_u32(attrs[NL80211_ATTR_CQM_BITRATE_THOLD]);
+		err = nl80211_set_cqm_bitrate(info, thold);
+		if (err)
+			goto out;
+	}
 
 out:
 	return err;
@@ -5651,6 +5683,56 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
 	nlmsg_free(msg);
 }
 
+void
+nl80211_send_cqm_bitrate_notify(struct cfg80211_registered_device *rdev,
+				struct net_device *netdev,
+				u32 bitrate,
+				gfp_t gfp)
+{
+	struct sk_buff *msg;
+	struct nlattr *pinfoattr;
+	void *hdr;
+
+	if (bitrate == 0)
+		return;
+
+
+	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+	if (!msg)
+		return;
+
+	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
+	if (!hdr) {
+		nlmsg_free(msg);
+		return;
+	}
+
+
+	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+
+	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
+	if (!pinfoattr)
+		goto nla_put_failure;
+
+	NLA_PUT_U32(msg, NL80211_ATTR_CQM_BITRATE_THRESHOLD_EVENT, bitrate);
+
+	nla_nest_end(msg, pinfoattr);
+
+	if (genlmsg_end(msg, hdr) < 0) {
+		nlmsg_free(msg);
+		return;
+	}
+
+	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+				nl80211_mlme_mcgrp.id, gfp);
+	return;
+
+ nla_put_failure:
+	genlmsg_cancel(msg, hdr);
+	nlmsg_free(msg);
+}
+
 static int nl80211_netlink_notify(struct notifier_block * nb,
 				  unsigned long state,
 				  void *_notify)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 30d2f93..769fa90 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -88,4 +88,10 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
 			     enum nl80211_cqm_rssi_threshold_event rssi_event,
 			     gfp_t gfp);
 
+void
+nl80211_send_cqm_bitrate_notify(struct cfg80211_registered_device *rdev,
+				struct net_device *netdev,
+				u32 bitrate,
+				gfp_t gfp);
+
 #endif /* __NET_WIRELESS_NL80211_H */
