1
2
3
4
5
6

struct sockaddr_nl {
    __kernel_sa_family_t	nl_family;	/* AF_NETLINK	*/
    unsigned short	nl_pad;				/* zero		*/
    __u32		nl_pid;					/* port ID	*/
    __u32		nl_groups;				/* multicast groups mask */
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

/**
 * struct nlmsghdr - fixed format metadata header of Netlink messages
 * @nlmsg_len:   Length of message including header
 * @nlmsg_type:  Message content type
 * @nlmsg_flags: Additional flags
 * @nlmsg_seq:   Sequence number
 * @nlmsg_pid:   Sending process port ID
 */
struct nlmsghdr {
	__u32		nlmsg_len;
	__u16		nlmsg_type;
	__u16		nlmsg_flags;
	__u32		nlmsg_seq;
	__u32		nlmsg_pid;
};

1
2
3
4
5
6

#define NLMSG_NOOP		0x1	/* Nothing.	 不执行任何动作，必须将该消息丢弃	*/
#define NLMSG_ERROR		0x2	/* Error	消息发生错误	*/
#define NLMSG_DONE		0x3	/* End of a dump 标识分组消息的末尾	*/
#define NLMSG_OVERRUN		0x4	/* Data lost	缓冲区溢出，表示某些消息已经丢失	*/

#define NLMSG_MIN_TYPE		0x10	/* < 0x10: reserved control messages 预留 */

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

/* Flags values */

#define NLM_F_REQUEST		0x01	/* It is request message. 	标识请求消息，一般从用户空间向内核空间发起 */
#define NLM_F_MULTI		0x02	/* Multipart message, terminated by NLMSG_DONE 用于指示该消息是一个多部分消息的一部分，后续的消息可以通过宏NLMSG_NEXT来获得 */
#define NLM_F_ACK		0x04	/* Reply with ack, with zero or error code 表示该消息是前一个请求消息的响应，顺序号与进程ID可以把请求与响应关联起来 */
#define NLM_F_ECHO		0x08	/* Receive resulting notifications 表示该消息是相关的一个包的回传 */
#define NLM_F_DUMP_INTR		0x10	/* Dump was inconsistent due to sequence change */
#define NLM_F_DUMP_FILTERED	0x20	/* Dump was filtered as requested */

/* Modifiers to GET request */
#define NLM_F_ROOT	0x100	/* specify tree	root 被许多 netlink 协议的各种数据获取操作使用，该标志指示被请求的数据表应当整体返回用户应用，而不是一个条目一个条目地返回。有该标志的请求通常导致响应消息设置 NLM_F_MULTI标志。注意，当设置了该标志时，请求是协议特定的，因此，需要在字段 nlmsg_type 中指定协议类型	*/
#define NLM_F_MATCH	0x200	/* return all matching 表示该协议特定的请求只需要一个数据子集，数据子集由指定的协议特定的过滤器来匹配	*/
#define NLM_F_ATOMIC	0x400	/* atomic GET	指示请求返回的数据应当原子地收集，这预防数据在获取期间被修改	*/
#define NLM_F_DUMP	(NLM_F_ROOT|NLM_F_MATCH)

/* Modifiers to NEW request */
#define NLM_F_REPLACE	0x100	/* Override existing	用于取代在数据表中的现有条目	*/
#define NLM_F_EXCL	0x200	/* Do not touch, if it exists 用于和 CREATE 和 APPEND 配合使用，如果条目已经存在，将失败	*/
#define NLM_F_CREATE	0x400	/* Create, if it does not exist指示应当在指定的表中创建一个条目	*/
#define NLM_F_APPEND	0x800	/* Add to end of list	指示在表末尾添加新的条目	*/

/* Modifiers to DELETE request */
#define NLM_F_NONREC	0x100	/* Do not delete recursively	*/
#define NLM_F_BULK	0x200	/* Delete multiple objects	*/

/* Flags for ACK message */
#define NLM_F_CAPPED	0x100	/* request was capped */
#define NLM_F_ACK_TLVS	0x200	/* extended ACK TVLs were included */

...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

/*
 *  <------- NLA_HDRLEN ------> <-- NLA_ALIGN(payload)-->
 * +---------------------+- - -+- - - - - - - - - -+- - -+
 * |        Header       | Pad |     Payload       | Pad |
 * |   (struct nlattr)   | ing |                   | ing |
 * +---------------------+- - -+- - - - - - - - - -+- - -+
 *  <-------------- nlattr->nla_len -------------->
 */

struct nlattr {
	__u16           nla_len;
	__u16           nla_type;
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

#define NLMSG_ALIGN(len) ( ((len)+NLMSG_ALIGNTO-1) & ~(NLMSG_ALIGNTO-1) ) /* 宏NLMSG_ALIGN(len)用于得到不小于len且字节对齐的最小数值 */

#define NLMSG_HDRLEN     ((int) NLMSG_ALIGN(sizeof(struct nlmsghdr))) /* Netlink 头部长度 */

#define NLMSG_LENGTH(len) ((len) + NLMSG_HDRLEN) /* 计算消息数据len的真实消息长度（消息体 +　消息头），一般用于分配消息缓存*/

#define NLMSG_SPACE(len) NLMSG_ALIGN(NLMSG_LENGTH(len)) /* 宏NLMSG_SPACE(len)返回不小于NLMSG_LENGTH(len)且字节对齐的最小数值，也用于分配消息缓存 */

#define NLMSG_DATA(nlh)  ((void*)(((char*)nlh) + NLMSG_LENGTH(0))) /* 宏NLMSG_DATA(nlh)用于取得消息的数据部分的首地址，设置和读取接收消息数据部分时需要使用该宏 */

#define NLMSG_NEXT(nlh,len)  ((len) -= NLMSG_ALIGN((nlh)->nlmsg_len), \
		 (struct nlmsghdr*)(((char*)(nlh)) + NLMSG_ALIGN((nlh)->nlmsg_len))) /* 宏NLMSG_NEXT(nlh,len)用于得到下一个消息的首地址, 同时len 变为剩余消息的长度。该宏一般在一个消息被分成几个部分发送或接收时使用。 */

#define NLMSG_OK(nlh,len) ((len) >= (int)sizeof(struct nlmsghdr) && (nlh)->nlmsg_len >= 		sizeof(struct nlmsghdr) &&  (nlh)->nlmsg_len <= (len)) /* 判断消息是否 >len */

#define NLMSG_PAYLOAD(nlh,len) ((nlh)->nlmsg_len - NLMSG_SPACE((len))) /* 用于返回payload的长度*/

1

int socket(int domain, int type, int protocol);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#define NETLINK_ROUTE		0	/* Routing/device hook				*/
#define NETLINK_UNUSED		1	/* Unused number				*/
#define NETLINK_USERSOCK	2	/* Reserved for user mode socket protocols 	*/
#define NETLINK_FIREWALL	3	/* Unused number, formerly ip_queue		*/
#define NETLINK_SOCK_DIAG	4	/* socket monitoring				*/
#define NETLINK_NFLOG		5	/* netfilter/iptables ULOG */
#define NETLINK_XFRM		6	/* ipsec */
#define NETLINK_SELINUX		7	/* SELinux event notifications */
#define NETLINK_ISCSI		8	/* Open-iSCSI */
#define NETLINK_AUDIT		9	/* auditing */
#define NETLINK_FIB_LOOKUP	10	
#define NETLINK_CONNECTOR	11
#define NETLINK_NETFILTER	12	/* netfilter subsystem */
#define NETLINK_IP6_FW		13
#define NETLINK_DNRTMSG		14	/* DECnet routing messages */
#define NETLINK_KOBJECT_UEVENT	15	/* Kernel messages to userspace */
#define NETLINK_GENERIC		16
/* leave room for NETLINK_DM (DM Events) */
#define NETLINK_SCSITRANSPORT	18	/* SCSI Transports */
#define NETLINK_ECRYPTFS	19
#define NETLINK_RDMA		20
#define NETLINK_CRYPTO		21	/* Crypto layer */
#define NETLINK_SMC		22	/* SMC monitoring */

#define NETLINK_INET_DIAG	NETLINK_SOCK_DIAG

#define MAX_LINKS 32

1

int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen); 

1

int sendto(int sockfd, const void *buf, size_t len, int flags, const struct sockaddr *dest_addr, socklen_t addrlen);

1

int sendmsg(int sockfd, const struct msghdr *msg, int flags);

1

int recvfrom(int sockfd, void *buf, size_t len, int flags, struct sockaddr *src_addr,socklen_t *addrlen);

1

int	(*recvmsg)(struct sock *sk, struct msghdr *msg, size_t len, int flags, int *addr_len);

1

int close(int sockfd);     //返回值:成功为0，出错为-1.

1
2
3
4
5

static inline struct sock *
netlink_kernel_create(struct net *net, int unit, struct netlink_kernel_cfg *cfg)
{
	return __netlink_kernel_create(net, unit, THIS_MODULE, cfg);
}

1
2
3
4
5
6
7
8
9

/* optional Netlink kernel configuration parameters */
struct netlink_kernel_cfg {
	unsigned int	groups;
	unsigned int	flags;
	void		(*input)(struct sk_buff *skb);
	int		(*bind)(struct net *net, int group);
	void		(*unbind)(struct net *net, int group);
	void            (*release) (struct sock *sk, unsigned long *groups);
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

/**
 * nlmsg_put - Add a new netlink message to an skb
 * @skb: socket buffer to store message in
 * @portid: netlink PORTID of requesting application
 * @seq: sequence number of message
 * @type: message type
 * @payload: length of message payload
 * @flags: message flags
 *
 * Returns: NULL if the tailroom of the skb is insufficient to store
 * the message header and payload.
 */
static inline struct nlmsghdr *nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
					 int type, int payload, int flags)
{
	if (unlikely(skb_tailroom(skb) < nlmsg_total_size(payload)))
		return NULL;

	return __nlmsg_put(skb, portid, seq, type, payload, flags);
}

1

int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);

1
2

int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
		      __u32 group, gfp_t allocation);

1

void netlink_kernel_release(struct sock *sk);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

struct nlmsghdr {
      __u32   nlmsg_len;      /* Length of message including headers */
      __u16   nlmsg_type;     /* Generic Netlink Family (subsystem) ID */
      __u16   nlmsg_flags;    /* Flags - request or dump */
      __u32   nlmsg_seq;      /* Sequence number */
      __u32   nlmsg_pid;      /* Port ID, set to 0 */
};
struct genlmsghdr {
      __u8    cmd;            /* Command, as defined by the Family */
      __u8    version;        /* Irrelevant, set to 1 */
      __u16   reserved;       /* Reserved, set to 0 */
};
/* TLV attributes follow... */

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

----------------------------------------------
| struct nlmsghdr - response header          |
----------------------------------------------
|    int error                               |
----------------------------------------------
| struct nlmsghdr - original request header |
----------------------------------------------
| ** optionally (1) payload of the request   |
----------------------------------------------
| ** optionally (2) extended ACK             |
----------------------------------------------

1
2
3
4
5
6
7

----------------------------------------------
| struct nlmsghdr - response header          |
----------------------------------------------
|    int error                               |
----------------------------------------------
| ** optionally extended ACK                 |
----------------------------------------------

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

struct nlmsghdr:
  __u32 nlmsg_len:    32
  __u16 nlmsg_type:   GENL_ID_CTRL               // (1)
  __u16 nlmsg_flags:  NLM_F_REQUEST | NLM_F_ACK  // (2)
  __u32 nlmsg_seq:    1
  __u32 nlmsg_pid:    0

struct genlmsghdr:
  __u8 cmd:           CTRL_CMD_GETFAMILY         // (3)
  __u8 version:       2 /* or 1, doesn't matter */
  __u16 reserved:     0

struct nlattr:                                   // (4)
  __u16 nla_len:      10
  __u16 nla_type:     CTRL_ATTR_FAMILY_NAME
  char data:          test1\0

(padding:)
  char data:          \0\0

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

/* Message #1 - reply */
struct nlmsghdr:
  __u32 nlmsg_len:    136
  __u16 nlmsg_type:   GENL_ID_CTRL
  __u16 nlmsg_flags:  0
  __u32 nlmsg_seq:    1    /* echoed from our request */
  __u32 nlmsg_pid:    5831 /* The PID of our user space process */

struct genlmsghdr:
  __u8 cmd:           CTRL_CMD_GETFAMILY
  __u8 version:       2
  __u16 reserved:     0

struct nlattr:
  __u16 nla_len:      10
  __u16 nla_type:     CTRL_ATTR_FAMILY_NAME
  char data:          test1\0

(padding:)
  data:               \0\0

struct nlattr:
  __u16 nla_len:      6
  __u16 nla_type:     CTRL_ATTR_FAMILY_ID
  __u16:              123  /* The Family ID we are after */

(padding:)
  char data:          \0\0

struct nlattr:
  __u16 nla_len:      9
  __u16 nla_type:     CTRL_ATTR_FAMILY_VERSION
  __u16:              1

/* ... etc, more attributes will follow. */

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

/* Message #2 - the ACK */
struct nlmsghdr:
  __u32 nlmsg_len:    36
  __u16 nlmsg_type:   NLMSG_ERROR
  __u16 nlmsg_flags:  NLM_F_CAPPED /* There won't be a payload */
  __u32 nlmsg_seq:    1    /* echoed from our request */
  __u32 nlmsg_pid:    5831 /* The PID of our user space process */

int error:            0

struct nlmsghdr: /* Copy of the request header as we sent it */
  __u32 nlmsg_len:    32
  __u16 nlmsg_type:   GENL_ID_CTRL
  __u16 nlmsg_flags:  NLM_F_REQUEST | NLM_F_ACK
  __u32 nlmsg_seq:    1
  __u32 nlmsg_pid:    0

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

struct nlmsghdr:
  __u32 nlmsg_len:    136
  __u16 nlmsg_type:   GENL_ID_CTRL
  __u16 nlmsg_flags:  0
  __u32 nlmsg_seq:    0
  __u32 nlmsg_pid:    0

struct genlmsghdr:
  __u8 cmd:           CTRL_CMD_NEWFAMILY
  __u8 version:       2
  __u16 reserved:     0

struct nlattr:
  __u16 nla_len:      10
  __u16 nla_type:     CTRL_ATTR_FAMILY_NAME
  char data:          test1\0

(padding:)
  data:               \0\0

struct nlattr:
  __u16 nla_len:      6
  __u16 nla_type:     CTRL_ATTR_FAMILY_ID
  __u16:              123  /* The Family ID we are after */

(padding:)
  char data:          \0\0

struct nlattr:
  __u16 nla_len:      9
  __u16 nla_type:     CTRL_ATTR_FAMILY_VERSION
  __u16:              1

/* ... etc, more attributes will follow. */

1
2
3
4
5
6

unsigned int group_id;

/* .. find the group ID... */

setsockopt(fd, SOL_NETLINK, NETLINK_ADD_MEMBERSHIP,
           &group_id, sizeof(group_id));

1
2
3
4
5
6

4.4BSD ADD           NLM_F_CREATE|NLM_F_EXCL
4.4BSD CHANGE        NLM_F_REPLACE

True CHANGE          NLM_F_CREATE|NLM_F_REPLACE
Append               NLM_F_CREATE
Check                NLM_F_EXCL

1
2
3

mkdir -p ~/netlink_test/kernel
cd ~/netlink_test/kernel/
touch nl_test_kernel.c Makefile

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102

#include <linux/init.h>
#include <linux/module.h>
#include <linux/types.h>
#include <net/sock.h>
#include <linux/netlink.h>

// 自定义的 Netlink 协议号
#define NETLINK_TEST     30
#define MSG_LEN            125

MODULE_LICENSE("GPL");

// 内核中的 Netlink 套接字指针
struct sock *nlsk = NULL;
extern struct net init_net;

// 用于向用户空间发送消息
int send_usrmsg(char *pbuf, uint16_t len, uint32_t pid)
{
    struct sk_buff *nl_skb;
    struct nlmsghdr *nlh;

    int ret;

    /* Allocate a new netlink message */
    nl_skb = nlmsg_new(len + 1, GFP_ATOMIC);
    if(!nl_skb)
    {
        printk("\nError:netlink alloc failure.\n\n");
        return -1;
    }

    /* Add a new netlink message to an skb
        pid是0，说明是从内核发送的
    */
    nlh = nlmsg_put(nl_skb, 0, 0, NETLINK_TEST, len, 0);
    if(nlh == NULL)
    {
        printk("\nError:nlmsg_put failaure. \n\n");
        nlmsg_free(nl_skb);
        return -1;
    }

    /* copy payload */
    memcpy(nlmsg_data(nlh), pbuf, len);
    ret = netlink_unicast(nlsk, nl_skb, pid, MSG_DONTWAIT);

    return ret;
}

// Netlink 套接字的回调函数
static void netlink_rcv_msg(struct sk_buff *skb)
{
    struct nlmsghdr *nlh = NULL;
    char *umsg = NULL;
    char *kmsg = "Hello user's program.";

    if(skb->len >= nlmsg_total_size(0))
    {
        nlh = nlmsg_hdr(skb);
        umsg = NLMSG_DATA(nlh);
        if(umsg)
        {
            // 打印接收到的用户空间消息
            printk("kernel recv from user space: %s\n", umsg);
            // 回复一条固定字符串
            send_usrmsg(kmsg, strlen(kmsg), nlh->nlmsg_pid);
        }
    }
}

struct netlink_kernel_cfg cfg = {
        .input  = netlink_rcv_msg, /* set recv callback */
};

int test_netlink_init(void)
{
    /* create netlink socket */
    nlsk = (struct sock *)netlink_kernel_create(&init_net, NETLINK_TEST, &cfg);
    if(nlsk == NULL)
    {
        printk("\nError:netlink_kernel_create error !\n");
        return -1;
    }
    printk("\ntest_netlink_init\n");

    return 0;
}

void test_netlink_exit(void)
{
    if (nlsk){
        netlink_kernel_release(nlsk); /* release ..*/
        nlsk = NULL;
    }
    printk("test_netlink_exit!\n");
}

// 模块加载时调用：创建 Netlink 套接字，注册回调
module_init(test_netlink_init);
// 模块卸载时调用：释放 Netlink 套接字资源
module_exit(test_netlink_exit);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# 定义模块名，最终会生成 nl_test_kernel.ko 文件
MODULE_NAME :=nl_test_kernel
# 指定要编译的模块对象文件
obj-m:=$(MODULE_NAME).o
	
# 指定内核源码的构建目录，通常用于内核模块编译
KERNELDIR ?=/lib/modules/$(shell uname -r)/build
# 当前目录
PWD :=$(shell pwd)


# 编译模块。调用内核的 Makefile，M=$(PWD) 表示在当前目录下查找模块源码
all:

	$(MAKE) -C $(KERNELDIR) M=$(PWD)

# 清理编译生成的文件
clean:

	$(MAKE) -C $(KERNELDIR) M=$(PWD) clean

1
2
3

obj-m := self_kkk.o

self_kkk-objs := aaa.o bbb.o

1

make

1

sudo insmod nl_test_kernel.ko

1

dmesg | tail  # 查看内核日志，确认初始化消息

1

lsmod | grep nl_test_kernel  # 检查模块列表

1
2
3

mkdir -p ~/netlink_test/user/
cd ~/netlink_test/user/
touch nl_test_user.c

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <string.h>
#include <linux/netlink.h>
#include <stdint.h>
#include <unistd.h>
#include <errno.h>

// 指定 Netlink 协议号、消息长度
#define NETLINK_TEST    30
#define MSG_LEN         125
#define MAX_PLOAD       125

// user_msg_info 用于接收内核返回的数据，包含 Netlink 消息头和消息体
typedef struct _user_msg_info
{
    struct nlmsghdr hdr;
    char  msg[MSG_LEN];
} user_msg_info;

int main(int argc, char **argv)
{
    int skfd;
    int ret;
    user_msg_info u_info;
    socklen_t len;
    struct nlmsghdr *nlh = NULL;
    struct sockaddr_nl saddr, daddr;
    char *umsg = "Hello Netlink protocol.";

    /* 创建NETLINK socket 协议号为 30（自定义） */ 
    skfd = socket(AF_NETLINK, SOCK_RAW, NETLINK_TEST);
    if(skfd == -1)
    {
        perror("\nError:Create socket error.\n");
        return -1;
    }

    // 绑定本地 Netlink 地址，nl_pid 用当前进程 PID，表示用户空间的“端口”
    memset(&saddr, 0, sizeof(saddr));
    saddr.nl_family = AF_NETLINK; // AF_NETLINK
    saddr.nl_pid = getpid();  // 端口号(port ID)
    saddr.nl_groups = 0;
    if(bind(skfd, (struct sockaddr *)&saddr, sizeof(saddr)) != 0)
    {
        perror("\nError:bind() error.\n");
        close(skfd);
        return -1;
    }

    // 设置目标地址（内核），目标地址的 nl_pid 为 0，表示消息发往内核
    memset(&daddr, 0, sizeof(daddr));
    daddr.nl_family = AF_NETLINK;
    daddr.nl_pid = 0; // to kernel
    daddr.nl_groups = 0;

    // 构造并发送消息
    nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PLOAD));
    // 构造 Netlink 消息头
    memset(nlh, 0, sizeof(struct nlmsghdr));
    nlh->nlmsg_len = NLMSG_SPACE(MAX_PLOAD);
    nlh->nlmsg_flags = 0;
    nlh->nlmsg_type = 0;
    nlh->nlmsg_seq = 0;
    nlh->nlmsg_pid = saddr.nl_pid; //self port

    // 将用户消息拷贝到消息体
    memcpy(NLMSG_DATA(nlh), umsg, strlen(umsg));
    // 通过 sendto 发送消息到内核
    ret = sendto(skfd, nlh, nlh->nlmsg_len, 0, (struct sockaddr *)&daddr, sizeof(struct sockaddr_nl));
    if(!ret)
    {
        perror("\nError:sendto error.\n");
        close(skfd);
        exit(-1);
    }
    printf("\nApplication-->Send to kernel:%s\n\n", umsg);

    // 阻塞等待内核返回消息，收到后存储到 u_info 结构体
    memset(&u_info, 0, sizeof(u_info));
    len = sizeof(struct sockaddr_nl);
    ret = recvfrom(skfd, &u_info, sizeof(user_msg_info), 0, (struct sockaddr *)&daddr, &len);
    if(!ret)
    {
        perror("\nError:recv form kernel error.\n");
        close(skfd);
        exit(-1);
    }

    // 打印从内核收到的消息，关闭 socket，释放内存
    printf("\nApplication-->From kernel:%s\n\n", u_info.msg);
    close(skfd);

    free((void *)nlh);
    return 0;
}

1

gcc -o nl_test_user nl_test_user.c

1

./nl_test_user

1

sudo rmmod nl_test_kernel

1
2

cd ~/netlink_test/kernel
make clean

1
2
3

mkdir -p ~/netlink_test/kernel/nl_test2_kernel
cd ~/netlink_test/kernel/nl_test2_kernel
touch nl_test2_kernel.c Makefile

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/fs.h>
#include <linux/cdev.h>
#include <linux/device.h>
#include <linux/uaccess.h>
#include <linux/netlink.h>
#include <linux/skbuff.h>
#include <net/netlink.h>
#include <net/net_namespace.h>

// 自定义的 Netlink 协议号、字符设备名、类名和 ioctl 命令号
#define NETLINK_USER 31
#define DEVICE_NAME "netlink_device"
#define CLASS_NAME "nlclass"
#define IOCTL_CMD 0x12345678 // Must match the command in the user program

// 全局变量：Netlink socket 指针、字符设备号、字符设备结构体、设备类指针和用户进程 PID
static struct sock *nl_sk = NULL;
static dev_t dev_num;
static struct cdev c_dev;
static struct class *cl;
static int user_pid = 0; // Store the user space process PID

// 向用户空间进程发送消息
static void send_to_user(void) {
    struct sk_buff *skb;
    char msg[] = "Hello from kernel!";
    int size = NLMSG_SPACE(strlen(msg) + 1); // including null terminator

    // 检查 user_pid 是否已设置
    if (user_pid == 0) {
        printk(KERN_ERR "User PID not set\n");
        return;
    }

    // 创建 Netlink 消息缓冲区（skb）
    skb = nlmsg_new(size, GFP_KERNEL);
    if (!skb) {
        printk(KERN_ERR "Failed to allocate new skb\n");
        return;
    }

    // 填充 Netlink 消息头和数据
    struct nlmsghdr *nlh = nlmsg_put(skb, 0, 0, NLMSG_DONE, strlen(msg) + 1, 0);
    if (!nlh) {
        nlmsg_free(skb);
        printk(KERN_ERR "Failed to put nlmsghdr\n");
        return;
    }
    memcpy(NLMSG_DATA(nlh), msg, strlen(msg) + 1);
    // nlh->nlmsg_len = strlen(msg) + 1;

    // 发送消息到用户空间指定 PID
    int res = netlink_unicast(nl_sk, skb, user_pid, MSG_DONTWAIT);
    if (res < 0) {
        printk(KERN_ERR "Error while sending to user: %d\n", res);
    }
}

static long device_ioctl(struct file *file, unsigned int cmd, unsigned long arg) {
    // 用户空间通过 ioctl 命令 IOCTL_CMD 触发内核向用户空间发送 Netlink 消息。
    switch (cmd) {
        case IOCTL_CMD:
            send_to_user();
            break;
        default:
            return -ENOTTY;
    }
    return 0;
}

static ssize_t device_write(struct file *filp, const char __user *buf, size_t len, loff_t *off) {
    char kbuf[10];
    if (len > sizeof(kbuf)) {
        return -EINVAL;
    }
    if (copy_from_user(kbuf, buf, len)) {
        return -EFAULT;
    }
    kbuf[len] = '\0';
    // 内核解析 PID 并保存到 user_pid
    user_pid = simple_strtol(kbuf, NULL, 10);
    printk(KERN_INFO "User PID set to %d\n", user_pid);
    return len;
}

static struct file_operations fops = {
    .owner = THIS_MODULE,
    // 触发消息发送
    .unlocked_ioctl = device_ioctl,
    // 设置 PID
    .write = device_write,
};

static int __init my_init(void) {
    struct netlink_kernel_cfg cfg = {
        .input = NULL,
        .groups = 0,
        .flags = 0,
    };

    printk(KERN_INFO "Module loaded\n");

    // 创建 Netlink socket
    nl_sk = netlink_kernel_create(&init_net, NETLINK_USER, &cfg);
    if (!nl_sk) {
        printk(KERN_ALERT "Error creating socket.\n");
        return -ENOMEM;
    }

    // 注册字符设备号，初始化并添加字符设备
    alloc_chrdev_region(&dev_num, 0, 1, DEVICE_NAME);
    cdev_init(&c_dev, &fops);
    cdev_add(&c_dev, dev_num, 1);

    // 创建设备类和设备节点 /dev/netlink_device
    cl = class_create(CLASS_NAME);
    device_create(cl, NULL, dev_num, NULL, DEVICE_NAME);

    return 0;
}

static void __exit my_exit(void) {
    if (nl_sk) {
        // 释放 Netlink socket
        netlink_kernel_release(nl_sk);
        nl_sk = NULL;
    }

    // 销毁设备节点、类，注销字符设备号，删除字符设备
    device_destroy(cl, dev_num);
    class_unregister(cl);
    class_destroy(cl);
    unregister_chrdev_region(dev_num, 1);
    cdev_del(&c_dev);

    printk(KERN_INFO "Module unloaded\n");
}

module_init(my_init);
module_exit(my_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("wyatt");
MODULE_DESCRIPTION("A simple Netlink example with ioctl and write");

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# 定义模块名，最终会生成 nl_test2_kernel.ko 文件
MODULE_NAME :=nl_test2_kernel
# 指定要编译的模块对象文件
obj-m:=$(MODULE_NAME).o
	
# 指定内核源码的构建目录，通常用于内核模块编译
KERNELDIR ?=/lib/modules/$(shell uname -r)/build
# 当前目录
PWD :=$(shell pwd)


# 编译模块。调用内核的 Makefile，M=$(PWD) 表示在当前目录下查找模块源码
all:

	$(MAKE) -C $(KERNELDIR) M=$(PWD) modules

# 清理编译生成的文件
clean:

	rm -rf *.o *.ko *.mod.c *.symvers *.order

1

make

1

sudo insmod nl_test2_kernel.ko

1

dmesg | tail  # 查看内核日志，确认初始化消息

1

lsmod | grep nl_test2_kernel  # 检查模块列表

1
2
3

mkdir -p ~/netlink_test/user/nl_test2_user
cd ~/netlink_test/user/nl_test2_user
touch nl_test2_user.c

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <string.h>

// 定义 Netlink 协议号、最大消息长度、ioctl 命令号（需与内核模块一致）
#define NETLINK_USER 31
#define MAX_PAYLOAD 1024 /* maximum payload size*/
#define IOCTL_CMD 0x12345678 // Must match the command in the kernel module

int main(int argc, char* argv[]) {
    struct sockaddr_nl src_addr, dest_addr;
    struct nlmsghdr *nlh = NULL;
    struct iovec iov;
    int sock_fd;
    struct msghdr msg;
    int fd;
    char pid_str[10];

    // Open the device file
    // 打开内核模块创建的字符设备
    fd = open("/dev/netlink_device", O_RDWR);
    if (fd < 0) {
        perror("Cannot open device file");
        exit(EXIT_FAILURE);
    }

    // Write the current PID to the device file
    // 获取当前进程 PID，转为字符串写入设备
    snprintf(pid_str, sizeof(pid_str), "%d", getpid());
    if (write(fd, pid_str, strlen(pid_str)) != strlen(pid_str)) {
        perror("Write to device file failed");
        close(fd);
        exit(EXIT_FAILURE);
    }

    // Close the device file after writing the PID
    close(fd);

    // Create Netlink socket
    // 创建 Netlink socket，协议号与内核模块一致
    sock_fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_USER);
    if (sock_fd < 0) {
        perror("Socket creation failed");
        return -1;
    }
    // 绑定本地地址，nl_pid 设置为本进程 PID，nl_groups 设置为 1（单播）
    memset(&src_addr, 0, sizeof(src_addr));
    src_addr.nl_family = AF_NETLINK;
    src_addr.nl_pid = getpid(); /* self pid */
    src_addr.nl_groups = 0; /* unicast */

    bind(sock_fd, (struct sockaddr*)&src_addr, sizeof(src_addr));

    printf("Waiting for message from kernel...\n");

    // Allocate memory for nlmsghdr and set up iovec and msghdr
    // 分配 Netlink 消息头缓冲区
    nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PAYLOAD));
    if (!nlh) {
        perror("Failed to allocate memory for nlmsghdr");
        close(sock_fd);
        exit(EXIT_FAILURE);
    }

    // 设置 iovec 和 msghdr，用于后续 recvmsg 接收消息
    iov.iov_base = (void *)nlh;
    iov.iov_len = NLMSG_SPACE(MAX_PAYLOAD);

    memset(&dest_addr, 0, sizeof(dest_addr));
    dest_addr.nl_family = AF_NETLINK;

    memset(&msg, 0, sizeof(msg));
    msg.msg_name = (void *)&dest_addr;
    msg.msg_namelen = sizeof(dest_addr);
    msg.msg_iov = &iov;
    msg.msg_iovlen = 1;

    // Trigger the ioctl call to send a message from the kernel
    // 通过 ioctl 触发内核发送消息
    fd = open("/dev/netlink_device", O_RDWR);
    if (fd < 0) {
        perror("Cannot open device file for ioctl");
        free(nlh);
        close(sock_fd);
        exit(EXIT_FAILURE);
    }

    if (ioctl(fd, IOCTL_CMD, 0) < 0) {
        perror("IOCTL failed");
        close(fd);
        free(nlh);
        close(sock_fd);
        exit(EXIT_FAILURE);
    }

    close(fd);

    // 使用 recvmsg 阻塞等待内核消息
    ssize_t len = recvmsg(sock_fd, &msg, 0);
    if (len < 0) {
        perror("recvmsg failed");
        free(nlh);
        close(sock_fd);
        exit(EXIT_FAILURE);
    }

    // Ensure the received message is valid
    // 检查消息长度，确保消息有效
    // if (nlh->nlmsg_len < NLMSG_HDRLEN || len != nlh->nlmsg_len) {
    if (nlh->nlmsg_len < NLMSG_HDRLEN || len < nlh->nlmsg_len) {
    //if (nlh->nlmsg_len < NLMSG_HDRLEN){
        // fprintf(stderr, "Invalid message length:%d. NLMSG_HDRLEN %d\n", nlh->nlmsg_len, NLMSG_HDRLEN);
        fprintf(stderr, "Invalid message length:%d. NLMSG_HDRLEN %d, recvmsg returned %zd\n", nlh->nlmsg_len, NLMSG_HDRLEN, len);
        // 释放分配的内存，关闭 socket
        free(nlh);
        close(sock_fd);
        exit(EXIT_FAILURE);
    }

    // 打印收到的消息内容
    printf("Received message payload: %s\n", (char*)NLMSG_DATA(nlh));

    free(nlh);
    close(sock_fd);

    return 0;
}

1

gcc -o nl_test2_user nl_test2_user.c

1

./nl_test2_user

1

dmesg | tail

1

sudo rmmod nl_test2_kernel

1
2

cd ~/netlink_test/kernel/nl_test2_kernel
make clean

1
2
3

mkdir -p ~/netlink_test/kernel/test3/
cd ~/netlink_test/kernel/test3/
touch nl_test3_kernel.c Makefile

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <linux/timer.h>
#include <linux/jiffies.h>

#define NETLINK_TEST 31

static struct sock *nl_sk = NULL;
static int user_pid = 0;
static struct timer_list my_timer;

// 发送消息到用户空间
static void send_to_user(const char *msg) {
    struct sk_buff *skb;
    struct nlmsghdr *nlh;
    int msg_size = strlen(msg) + 1;
    
    if (user_pid == 0) {
        printk(KERN_INFO "No user process registered yet\n");
        return;
    }

    skb = nlmsg_new(msg_size, GFP_ATOMIC);
    if (!skb) {
        printk(KERN_ERR "Failed to allocate skb\n");
        return;
    }

    nlh = nlmsg_put(skb, 0, 0, NLMSG_DONE, msg_size, 0);
    memcpy(nlmsg_data(nlh), msg, msg_size);

    netlink_unicast(nl_sk, skb, user_pid, MSG_DONTWAIT);
}

// 定时器回调函数
static void timer_callback(struct timer_list *timer) {
    static int count = 0;
    char msg[100];
    
    snprintf(msg, sizeof(msg), "Kernel message %d", ++count);
    send_to_user(msg);
    
    // 重新设置定时器
    mod_timer(&my_timer, jiffies + msecs_to_jiffies(2000)); // 每2秒发送一次
}

// 接收用户空间消息
static void nl_recv_msg(struct sk_buff *skb) {
    struct nlmsghdr *nlh = nlmsg_hdr(skb);
    char *msg = NLMSG_DATA(nlh);
    
    if (strncmp(msg, "REGISTER", 8) == 0) {
        user_pid = nlh->nlmsg_pid;
        printk(KERN_INFO "Registered user PID: %d\n", user_pid);
        send_to_user("Registration successful");
    } else {
        printk(KERN_INFO "Kernel received: %s\n", msg);
    }
}

static int __init nl_init(void) {
    struct netlink_kernel_cfg cfg = {
        .input = nl_recv_msg,
    };

    nl_sk = netlink_kernel_create(&init_net, NETLINK_TEST, &cfg);
    if (!nl_sk) {
        printk(KERN_ERR "Failed to create netlink socket\n");
        return -ENOMEM;
    }

    // 初始化定时器
    timer_setup(&my_timer, timer_callback, 0);
    mod_timer(&my_timer, jiffies + msecs_to_jiffies(2000));

    printk(KERN_INFO "Netlink kernel module loaded\n");
    return 0;
}

static void __exit nl_exit(void) {
    del_timer(&my_timer);
    
    if (nl_sk) {
        netlink_kernel_release(nl_sk);
        nl_sk = NULL;
    }
    printk(KERN_INFO "Netlink kernel module unloaded\n");
}

module_init(nl_init);
module_exit(nl_exit);
MODULE_LICENSE("GPL");

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# 定义模块名，最终会生成 nl_test3_kernel.ko 文件
MODULE_NAME :=nl_test3_kernel
# 指定要编译的模块对象文件
obj-m:=$(MODULE_NAME).o
	
# 指定内核源码的构建目录，通常用于内核模块编译
KERNELDIR ?=/lib/modules/$(shell uname -r)/build
# 当前目录
PWD :=$(shell pwd)


# 编译模块。调用内核的 Makefile，M=$(PWD) 表示在当前目录下查找模块源码
all:

	$(MAKE) -C $(KERNELDIR) M=$(PWD)

# 清理编译生成的文件
clean:

	$(MAKE) -C $(KERNELDIR) M=$(PWD) clean

1

make

1

sudo insmod nl_test3_kernel.ko

1
2

dmesg | tail  # 查看内核日志，确认初始化消息
lsmod | grep nl_test3_kernel  # 检查模块列表

1
2
3

mkdir -p ~/netlink_test/user/test3
cd ~/netlink_test/user/test3
touch nl_test3_user.c

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <linux/netlink.h>

#define NETLINK_TEST 31
#define MAX_PAYLOAD 1024

int main() {
    struct sockaddr_nl src_addr, dest_addr;
    struct nlmsghdr *nlh = NULL;
    struct msghdr msg;
    struct iovec iov;
    int sock_fd;
    
    // 创建Netlink socket
    sock_fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_TEST);
    if (sock_fd < 0) {
        perror("socket");
        return -1;
    }

    // 绑定本地地址
    memset(&src_addr, 0, sizeof(src_addr));
    src_addr.nl_family = AF_NETLINK;
    src_addr.nl_pid = getpid(); // 使用进程ID作为端口号
    src_addr.nl_groups = 0; // 单播

    if (bind(sock_fd, (struct sockaddr*)&src_addr, sizeof(src_addr)) < 0) {
        perror("bind");
        close(sock_fd);
        return -1;
    }

    // 向内核注册我们的PID
    memset(&dest_addr, 0, sizeof(dest_addr));
    dest_addr.nl_family = AF_NETLINK;
    dest_addr.nl_pid = 0; // 发送到内核
    dest_addr.nl_groups = 0; // 单播

    // 准备注册消息
    nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PAYLOAD));
    memset(nlh, 0, NLMSG_SPACE(MAX_PAYLOAD));
    nlh->nlmsg_len = NLMSG_SPACE(MAX_PAYLOAD);
    nlh->nlmsg_pid = getpid();
    nlh->nlmsg_flags = 0;
    strcpy(NLMSG_DATA(nlh), "REGISTER");

    // 设置消息结构
    iov.iov_base = (void *)nlh;
    iov.iov_len = nlh->nlmsg_len;
    memset(&msg, 0, sizeof(msg));
    msg.msg_name = (void *)&dest_addr;
    msg.msg_namelen = sizeof(dest_addr);
    msg.msg_iov = &iov;
    msg.msg_iovlen = 1;

    // 发送注册消息
    printf("Registering with kernel...\n");
    if (sendmsg(sock_fd, &msg, 0) < 0) {
        perror("sendmsg");
        free(nlh);
        close(sock_fd);
        return -1;
    }

    // 准备接收消息
    printf("Waiting for messages from kernel...\n");
    while (1) {
        char buffer[1024];
        struct nlmsghdr *nlh = (struct nlmsghdr *)buffer;
        
        memset(&msg, 0, sizeof(msg));
        iov.iov_base = (void *)nlh;
        iov.iov_len = sizeof(buffer);
        msg.msg_iov = &iov;
        msg.msg_iovlen = 1;
        
        // 接收内核消息
        int len = recvmsg(sock_fd, &msg, 0);
        if (len < 0) {
            perror("recvmsg");
            break;
        }
        
        // 处理接收到的消息
        printf("Received from kernel: %s\n", (char *)NLMSG_DATA(nlh));
    }

    free(nlh);
    close(sock_fd);
    return 0;
}

1

gcc -o nl_test3_user nl_test3_user.c

1

./nl_test3_user

1
2
3

root@localhost [~/netlink_test/user/test3] ➜  sudo ./nl_test3_user                                    
User space ready (PID=3695)
Waiting for kernel message...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

root@localhost [/] ➜  dmesg | tail  # 查看内核日志，确认初始化消息                [23:27:02]
[13520.575856] No user process registered yet
[13522.623843] No user process registered yet
[13524.671834] No user process registered yet
[13526.720822] No user process registered yet
[13528.767820] No user process registered yet
[13530.815806] No user process registered yet
[13532.863796] No user process registered yet
[13534.911789] No user process registered yet
[13536.959782] No user process registered yet
[13538.464832] Registered user PID: 4599

1

sudo rmmod nl_test3_kernel

1
2

cd ~/netlink_test/kernel
make clean

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

/* initialisation/exit functions */

int __init nl80211_init(void)
{
	int err;

	err = genl_register_family(&nl80211_fam);
	if (err)
		return err;

	err = netlink_register_notifier(&nl80211_netlink_notifier);
	if (err)
		goto err_out;

	return 0;
 err_out:
	genl_unregister_family(&nl80211_fam);
	return err;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

/**
 * genl_register_family - register a generic netlink family
 * @family: generic netlink family
 *
 * Registers the specified family after validating it first. Only one
 * family may be registered with the same family name or identifier.
 *
 * The family's ops, multicast groups and module pointer must already
 * be assigned.
 *
 * Return 0 on success or a negative error code.
 */
int genl_register_family(struct genl_family *family)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

static const struct genl_ops nl80211_ops[] = {
	{
		.cmd = NL80211_CMD_GET_WIPHY,
		.doit = nl80211_get_wiphy,
		.dumpit = nl80211_dump_wiphy,
		.done = nl80211_dump_wiphy_done,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_WIPHY,
		.doit = nl80211_set_wiphy,
		.policy = nl80211_policy,
		.flags = GENL_UNS_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_RTNL,
	},
    ......
}