16 files changed, 198 insertions, 73 deletions

diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index d48776e4f343..334c2ece855a 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1955,8 +1955,9 @@ static void at76_dwork_hw_scan(struct work_struct *work)
 
 static int at76_hw_scan(struct ieee80211_hw *hw,
                         struct ieee80211_vif *vif,
-                        struct cfg80211_scan_request *req)
+                        struct ieee80211_scan_request *hw_req)
 {
+        struct cfg80211_scan_request *req = &hw_req->req;
         struct at76_priv *priv = hw->priv;
         struct at76_req_scan scan;
         u8 *ssid = NULL;
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a21080028c54..b8314a534972 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3137,10 +3137,11 @@ exit:
 
 static int ath10k_hw_scan(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
-                          struct cfg80211_scan_request *req)
+                          struct ieee80211_scan_request *hw_req)
 {
         struct ath10k *ar = hw->priv;
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        struct cfg80211_scan_request *req = &hw_req->req;
         struct wmi_start_scan_arg arg;
         int ret = 0;
         int i;
diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c
index 9afcd4ce3368..b2fb6c632092 100644
--- a/drivers/net/wireless/cw1200/scan.c
+++ b/drivers/net/wireless/cw1200/scan.c
@@ -53,9 +53,10 @@ static int cw1200_scan_start(struct cw1200_common *priv, struct wsm_scan *scan)
 
 int cw1200_hw_scan(struct ieee80211_hw *hw,
                    struct ieee80211_vif *vif,
-                   struct cfg80211_scan_request *req)
+                   struct ieee80211_scan_request *hw_req)
 {
         struct cw1200_common *priv = hw->priv;
+        struct cfg80211_scan_request *req = &hw_req->req;
         struct wsm_template_frame frame = {
                 .frame_type = WSM_FRAME_TYPE_PROBE_REQUEST,
         };
diff --git a/drivers/net/wireless/cw1200/scan.h b/drivers/net/wireless/cw1200/scan.h
index 5a8296ccfa82..cc75459e5784 100644
--- a/drivers/net/wireless/cw1200/scan.h
+++ b/drivers/net/wireless/cw1200/scan.h
@@ -41,7 +41,7 @@ struct cw1200_scan {
 
 int cw1200_hw_scan(struct ieee80211_hw *hw,
                    struct ieee80211_vif *vif,
-                   struct cfg80211_scan_request *req);
+                   struct ieee80211_scan_request *hw_req);
 void cw1200_scan_work(struct work_struct *work);
 void cw1200_scan_timeout(struct work_struct *work);
 void cw1200_clear_recent_scan_work(struct work_struct *work);
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index ecc674627e6e..03de7467aecf 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -1572,8 +1572,9 @@ il_scan_initiate(struct il_priv *il, struct ieee80211_vif *vif)
 
 int
 il_mac_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-               struct cfg80211_scan_request *req)
+               struct ieee80211_scan_request *hw_req)
 {
+        struct cfg80211_scan_request *req = &hw_req->req;
         struct il_priv *il = hw->priv;
         int ret;
 
diff --git a/drivers/net/wireless/iwlegacy/common.h b/drivers/net/wireless/iwlegacy/common.h
index ea5c0f863c4e..5b972798bdff 100644
--- a/drivers/net/wireless/iwlegacy/common.h
+++ b/drivers/net/wireless/iwlegacy/common.h
@@ -1787,7 +1787,7 @@ int il_scan_cancel(struct il_priv *il);
 int il_scan_cancel_timeout(struct il_priv *il, unsigned long ms);
 void il_force_scan_end(struct il_priv *il);
 int il_mac_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                   struct cfg80211_scan_request *req);
+                   struct ieee80211_scan_request *hw_req);
 void il_internal_short_hw_scan(struct il_priv *il);
 int il_force_reset(struct il_priv *il, bool external);
 u16 il_fill_probe_req(struct il_priv *il, struct ieee80211_mgmt *frame,
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 29af7b51e370..afb98f4fdaf3 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1495,9 +1495,10 @@ static int iwlagn_mac_change_interface(struct ieee80211_hw *hw,
 
 static int iwlagn_mac_hw_scan(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif,
-                              struct cfg80211_scan_request *req)
+                              struct ieee80211_scan_request *hw_req)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        struct cfg80211_scan_request *req = &hw_req->req;
         int ret;
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 7215f5980186..4dc2e05f49ce 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -1537,9 +1537,10 @@ static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
 
 static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
-                               struct cfg80211_scan_request *req)
+                               struct ieee80211_scan_request *hw_req)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct cfg80211_scan_request *req = &hw_req->req;
         int ret;
 
         if (req->n_channels == 0 || req->n_channels > MAX_NUM_SCAN_CHANNELS)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 06a0722164da..eba51460a5de 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1736,9 +1736,10 @@ static void hw_scan_work(struct work_struct *work)
 
 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif,
-                                  struct cfg80211_scan_request *req)
+                                  struct ieee80211_scan_request *hw_req)
 {
         struct mac80211_hwsim_data *hwsim = hw->priv;
+        struct cfg80211_scan_request *req = &hw_req->req;
 
         mutex_lock(&hwsim->mutex);
         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 4e782f18ae34..38234851457e 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -991,8 +991,9 @@ out:
 
 static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif,
-                             struct cfg80211_scan_request *req)
+                             struct ieee80211_scan_request *hw_req)
 {
+        struct cfg80211_scan_request *req = &hw_req->req;
         struct wl1251 *wl = hw->priv;
         struct sk_buff *skb;
         size_t ssid_len = 0;
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 3d6028e62750..e5ffb8b91dd4 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -3540,8 +3540,9 @@ out:
 
 static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif,
-                             struct cfg80211_scan_request *req)
+                             struct ieee80211_scan_request *hw_req)
 {
+        struct cfg80211_scan_request *req = &hw_req->req;
         struct wl1271 *wl = hw->priv;
         int ret;
         u8 *ssid = NULL;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 18c2bdbaf988..9536ee3e22a9 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -768,6 +768,26 @@ struct ieee80211_sched_scan_ies {
         size_t len[IEEE80211_NUM_BANDS];
 };
 
+/**
+ * struct ieee80211_scan_ies - descriptors for different blocks of IEs
+ *
+ * This structure is used to point to different blocks of IEs in HW scan.
+ * These blocks contain the IEs passed by userspace and the ones generated
+ * by mac80211.
+ *
+ * @ies: pointers to band specific IEs.
+ * @len: lengths of band_specific IEs.
+ * @common_ies: IEs for all bands (especially vendor specific ones)
+ * @common_ie_len: length of the common_ies
+ */
+struct ieee80211_scan_ies {
+        const u8 *ies[IEEE80211_NUM_BANDS];
+        size_t len[IEEE80211_NUM_BANDS];
+        const u8 *common_ies;
+        size_t common_ie_len;
+};
+
+
 static inline struct ieee80211_tx_info *IEEE80211_SKB_CB(struct sk_buff *skb)
 {
         return (struct ieee80211_tx_info *)skb->cb;
@@ -1606,6 +1626,9 @@ struct ieee80211_tx_control {
  *      on single-channel hardware.  It can also be used as an
  *      optimization in certain channel switch cases with
  *      multi-channel.
+ *
+ * @IEEE80211_SINGLE_HW_SCAN_ON_ALL_BANDS: The HW supports scanning on all bands
+ *      in one command, mac80211 doesn't have to run separate scans per band.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1638,6 +1661,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
         IEEE80211_HW_CHANCTX_STA_CSA                    = 1<<28,
         IEEE80211_HW_CHANGE_RUNNING_CHANCTX             = 1<<29,
+        IEEE80211_SINGLE_HW_SCAN_ON_ALL_BANDS           = 1<<30,
 };
 
 /**
@@ -1764,6 +1788,19 @@ struct ieee80211_hw {
 };
 
 /**
+ * struct ieee80211_scan_request - hw scan request
+ *
+ * @ies: pointers different parts of IEs (in req.ie)
+ * @req: cfg80211 request.
+ */
+struct ieee80211_scan_request {
+        struct ieee80211_scan_ies ies;
+
+        /* Keep last */
+        struct cfg80211_scan_request req;
+};
+
+/**
  * wiphy_to_ieee80211_hw - return a mac80211 driver hw struct from a wiphy
  *
  * @wiphy: the &struct wiphy which we want to query
@@ -2874,7 +2911,7 @@ struct ieee80211_ops {
         void (*set_default_unicast_key)(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif, int idx);
         int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                       struct cfg80211_scan_request *req);
+                       struct ieee80211_scan_request *req);
         void (*cancel_hw_scan)(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif);
         int (*sched_scan_start)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 2265bd7a44ba..faa0d90f6e80 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -314,7 +314,7 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
 
 static inline int drv_hw_scan(struct ieee80211_local *local,
                               struct ieee80211_sub_if_data *sdata,
-                              struct cfg80211_scan_request *req)
+                              struct ieee80211_scan_request *req)
 {
         int ret;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 6c8089429892..f88bd1659cde 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1152,7 +1152,8 @@ struct ieee80211_local {
         unsigned long scanning;
         struct cfg80211_ssid scan_ssid;
         struct cfg80211_scan_request *int_scan_req;
-        struct cfg80211_scan_request *scan_req, *hw_scan_req;
+        struct cfg80211_scan_request *scan_req;
+        struct ieee80211_scan_request *hw_scan_req;
         struct cfg80211_chan_def scan_chandef;
         enum ieee80211_band hw_scan_band;
         int scan_channel_idx;
@@ -1756,8 +1757,10 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                     const u8 *bssid, u16 stype, u16 reason,
                                     bool send_frame, u8 *frame_buf);
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             size_t buffer_len, const u8 *ie, size_t ie_len,
-                             enum ieee80211_band band, u32 rate_mask,
+                             size_t buffer_len,
+                             struct ieee80211_scan_ies *ie_desc,
+                             const u8 *ie, size_t ie_len,
+                             u8 bands_used, u32 *rate_masks,
                              struct cfg80211_chan_def *chandef);
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           u8 *dst, u32 ratemask,
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f40661eb75b5..116959e070d0 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -235,38 +235,51 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
 {
         struct cfg80211_scan_request *req = local->scan_req;
         struct cfg80211_chan_def chandef;
-        enum ieee80211_band band;
+        u8 bands_used = 0;
         int i, ielen, n_chans;
 
         if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
                 return false;
 
-        do {
-                if (local->hw_scan_band == IEEE80211_NUM_BANDS)
-                        return false;
-
-                band = local->hw_scan_band;
-                n_chans = 0;
+        if (local->hw.flags & IEEE80211_SINGLE_HW_SCAN_ON_ALL_BANDS) {
                 for (i = 0; i < req->n_channels; i++) {
-                        if (req->channels[i]->band == band) {
-                                local->hw_scan_req->channels[n_chans] =
+                        local->hw_scan_req->req.channels[i] = req->channels[i];
+                        bands_used |= BIT(req->channels[i]->band);
+                }
+
+                n_chans = req->n_channels;
+        } else {
+                do {
+                        if (local->hw_scan_band == IEEE80211_NUM_BANDS)
+                                return false;
+
+                        n_chans = 0;
+
+                        for (i = 0; i < req->n_channels; i++) {
+                                if (req->channels[i]->band !=
+                                    local->hw_scan_band)
+                                        continue;
+                                local->hw_scan_req->req.channels[n_chans] =
                                                         req->channels[i];
                                 n_chans++;
+                                bands_used |= BIT(req->channels[i]->band);
                         }
-                }
 
-                local->hw_scan_band++;
-        } while (!n_chans);
+                        local->hw_scan_band++;
+                } while (!n_chans);
+        }
 
-        local->hw_scan_req->n_channels = n_chans;
+        local->hw_scan_req->req.n_channels = n_chans;
         ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
 
-        ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
+        ielen = ieee80211_build_preq_ies(local,
+                                         (u8 *)local->hw_scan_req->req.ie,
                                          local->hw_scan_ies_bufsize,
-                                         req->ie, req->ie_len, band,
-                                         req->rates[band], &chandef);
-        local->hw_scan_req->ie_len = ielen;
-        local->hw_scan_req->no_cck = req->no_cck;
+                                         &local->hw_scan_req->ies,
+                                         req->ie, req->ie_len,
+                                         bands_used, req->rates, &chandef);
+        local->hw_scan_req->req.ie_len = ielen;
+        local->hw_scan_req->req.no_cck = req->no_cck;
 
         return true;
 }
@@ -291,7 +304,9 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (WARN_ON(!local->scan_req))
                 return;
 
-        if (hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
+        if (hw_scan && !aborted &&
+            !(local->hw.flags & IEEE80211_SINGLE_HW_SCAN_ON_ALL_BANDS) &&
+            ieee80211_prep_hw_scan(local)) {
                 int rc;
 
                 rc = drv_hw_scan(local,
@@ -473,6 +488,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                 u8 *ies;
 
                 local->hw_scan_ies_bufsize = local->scan_ies_len + req->ie_len;
+
+                if (local->hw.flags & IEEE80211_SINGLE_HW_SCAN_ON_ALL_BANDS) {
+                        int i, n_bands = 0;
+                        u8 bands_counted = 0;
+
+                        for (i = 0; i < req->n_channels; i++) {
+                                if (bands_counted & BIT(req->channels[i]->band))
+                                        continue;
+                                bands_counted |= BIT(req->channels[i]->band);
+                                n_bands++;
+                        }
+
+                        local->hw_scan_ies_bufsize *= n_bands;
+                }
+
                 local->hw_scan_req = kmalloc(
                                 sizeof(*local->hw_scan_req) +
                                 req->n_channels * sizeof(req->channels[0]) +
@@ -480,13 +510,13 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                 if (!local->hw_scan_req)
                         return -ENOMEM;
 
-                local->hw_scan_req->ssids = req->ssids;
-                local->hw_scan_req->n_ssids = req->n_ssids;
+                local->hw_scan_req->req.ssids = req->ssids;
+                local->hw_scan_req->req.n_ssids = req->n_ssids;
                 ies = (u8 *)local->hw_scan_req +
                         sizeof(*local->hw_scan_req) +
                         req->n_channels * sizeof(req->channels[0]);
-                local->hw_scan_req->ie = ies;
-                local->hw_scan_req->flags = req->flags;
+                local->hw_scan_req->req.ie = ies;
+                local->hw_scan_req->req.flags = req->flags;
 
                 local->hw_scan_band = 0;
 
@@ -976,6 +1006,7 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_sched_scan_ies sched_scan_ies = {};
         struct cfg80211_chan_def chandef;
         int ret, i, iebufsz;
+        struct ieee80211_scan_ies dummy_ie_desc;
 
         iebufsz = local->scan_ies_len + req->ie_len;
 
@@ -985,6 +1016,8 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                 return -ENOTSUPP;
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                u32 rate_masks[IEEE80211_NUM_BANDS] = {};
+
                 if (!local->hw.wiphy->bands[i])
                         continue;
 
@@ -995,11 +1028,13 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                 }
 
                 ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
+                rate_masks[i] = (u32) -1;
 
                 sched_scan_ies.len[i] =
                         ieee80211_build_preq_ies(local, sched_scan_ies.ie[i],
-                                                 iebufsz, req->ie, req->ie_len,
-                                                 i, (u32) -1, &chandef);
+                                                 iebufsz, &dummy_ie_desc,
+                                                 req->ie, req->ie_len, BIT(i),
+                                                 rate_masks, &chandef);
         }
 
         ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 42d448d765b4..e31458201278 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1219,14 +1219,17 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         }
 }
 
-int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             size_t buffer_len, const u8 *ie, size_t ie_len,
-                             enum ieee80211_band band, u32 rate_mask,
-                             struct cfg80211_chan_def *chandef)
+static int ieee80211_build_preq_ies_band(struct ieee80211_local *local,
+                                         u8 *buffer, size_t buffer_len,
+                                         const u8 *ie, size_t ie_len,
+                                         enum ieee80211_band band,
+                                         u32 rate_mask,
+                                         struct cfg80211_chan_def *chandef,
+                                         size_t *offset)
 {
         struct ieee80211_supported_band *sband;
         u8 *pos = buffer, *end = buffer + buffer_len;
-        size_t offset = 0, noffset;
+        size_t noffset;
         int supp_rates_len, i;
         u8 rates[32];
         int num_rates;
@@ -1234,6 +1237,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         int shift;
         u32 rate_flags;
 
+        *offset = 0;
+
         sband = local->hw.wiphy->bands[band];
         if (WARN_ON_ONCE(!sband))
                 return 0;
@@ -1272,12 +1277,12 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                 noffset = ieee80211_ie_split(ie, ie_len,
                                              before_extrates,
                                              ARRAY_SIZE(before_extrates),
-                                             offset);
-                if (end - pos < noffset - offset)
+                                             *offset);
+                if (end - pos < noffset - *offset)
                         goto out_err;
-                memcpy(pos, ie + offset, noffset - offset);
-                pos += noffset - offset;
-                offset = noffset;
+                memcpy(pos, ie + *offset, noffset - *offset);
+                pos += noffset - *offset;
+                *offset = noffset;
         }
 
         ext_rates_len = num_rates - supp_rates_len;
@@ -1311,12 +1316,12 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                 };
                 noffset = ieee80211_ie_split(ie, ie_len,
                                              before_ht, ARRAY_SIZE(before_ht),
-                                             offset);
-                if (end - pos < noffset - offset)
+                                             *offset);
+                if (end - pos < noffset - *offset)
                         goto out_err;
-                memcpy(pos, ie + offset, noffset - offset);
-                pos += noffset - offset;
-                offset = noffset;
+                memcpy(pos, ie + *offset, noffset - *offset);
+                pos += noffset - *offset;
+                *offset = noffset;
         }
 
         if (sband->ht_cap.ht_supported) {
@@ -1351,12 +1356,12 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                 };
                 noffset = ieee80211_ie_split(ie, ie_len,
                                              before_vht, ARRAY_SIZE(before_vht),
-                                             offset);
-                if (end - pos < noffset - offset)
+                                             *offset);
+                if (end - pos < noffset - *offset)
                         goto out_err;
-                memcpy(pos, ie + offset, noffset - offset);
-                pos += noffset - offset;
-                offset = noffset;
+                memcpy(pos, ie + *offset, noffset - *offset);
+                pos += noffset - *offset;
+                *offset = noffset;
         }
 
         if (sband->vht_cap.vht_supported) {
@@ -1366,21 +1371,54 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                                                  sband->vht_cap.cap);
         }
 
-        /* add any remaining custom IEs */
-        if (ie && ie_len) {
-                noffset = ie_len;
-                if (end - pos < noffset - offset)
-                        goto out_err;
-                memcpy(pos, ie + offset, noffset - offset);
-                pos += noffset - offset;
-        }
-
         return pos - buffer;
  out_err:
         WARN_ONCE(1, "not enough space for preq IEs\n");
         return pos - buffer;
 }
 
+int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
+                             size_t buffer_len,
+                             struct ieee80211_scan_ies *ie_desc,
+                             const u8 *ie, size_t ie_len,
+                             u8 bands_used, u32 *rate_masks,
+                             struct cfg80211_chan_def *chandef)
+{
+        size_t pos = 0, old_pos = 0, custom_ie_offset = 0;
+        int i;
+
+        memset(ie_desc, 0, sizeof(*ie_desc));
+
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                if (bands_used & BIT(i)) {
+                        pos += ieee80211_build_preq_ies_band(local,
+                                                             buffer + pos,
+                                                             buffer_len - pos,
+                                                             ie, ie_len, i,
+                                                             rate_masks[i],
+                                                             chandef,
+                                                             &custom_ie_offset);
+                        ie_desc->ies[i] = buffer + old_pos;
+                        ie_desc->len[i] = pos - old_pos;
+                        old_pos = pos;
+                }
+        }
+
+        /* add any remaining custom IEs */
+        if (ie && ie_len) {
+                if (WARN_ONCE(buffer_len - pos < ie_len - custom_ie_offset,
+                              "not enough space for preq custom IEs\n"))
+                        return pos;
+                memcpy(buffer + pos, ie + custom_ie_offset,
+                       ie_len - custom_ie_offset);
+                ie_desc->common_ies = buffer + pos;
+                ie_desc->common_ie_len = ie_len - custom_ie_offset;
+                pos += ie_len - custom_ie_offset;
+        }
+
+        return pos;
+};
+
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           u8 *dst, u32 ratemask,
                                           struct ieee80211_channel *chan,
@@ -1393,6 +1431,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         int ies_len;
+        u32 rate_masks[IEEE80211_NUM_BANDS] = {};
+        struct ieee80211_scan_ies dummy_ie_desc;
 
         /*
          * Do not send DS Channel parameter for directed probe requests
@@ -1410,10 +1450,11 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         if (!skb)
                 return NULL;
 
+        rate_masks[chan->band] = ratemask;
         ies_len = ieee80211_build_preq_ies(local, skb_tail_pointer(skb),
-                                           skb_tailroom(skb),
-                                           ie, ie_len, chan->band,
-                                           ratemask, &chandef);
+                                           skb_tailroom(skb), &dummy_ie_desc,
+                                           ie, ie_len, BIT(chan->band),
+                                           rate_masks, &chandef);
         skb_put(skb, ies_len);
 
         if (dst) {