VENDOR COMMANDS(9)
πΈ Vendor commands πΈ
Kernel API Manual Β· Vendor commands(9) Β· part 1 of 3, bestie, buckle up π
π VENDOR COMMANDS π
okay so picture this: every once in a while there's some special protocol or firmware feature that literally cannot be implemented very openly. awk. π For that vibe and cases like it, the vendor command functionality lets you implement those features with (typically closed-source) userspace and firmware, using nl80211 as the configuration mechanism. slay, we have a channel β¨
A driver that supports vendor commands must register them as an array in struct wiphy, with handlers for each one. no shortcuts, no vibes-only registration, bestie π Each command also has an OUI and a sub command ID to identify it β that's its whole little identity, iykyk π¦
β οΈ okay this part matters: do NOT (ab)use this feature to implement protocol features that could openly be shared across drivers. like, it's giving off-label use and we're not doing that π In particular, it must never be required to use vendor commands to implement any "normal" functionality that higher-level userspace like connection managers etc. need. periodt. if a connection manager needs it, it's not a vendor-command thing, full stop π
more coming in part 2, don't go anywhere π
Okay so like β the amount of β¨loreβ¨ here is genuinely unhinged, but every single link is a real one, so buckle up bestie π
./include/net/cfg80211.hβ the kernel file itself, the mothership, the source of truth π
πΈ the intro squad
Introduction(9)Device registration(9)
π¦ channel + rate + capability vibes (iftype data era)
enum ieee80211_channel_flags(9)struct ieee80211_channel(9)enum ieee80211_rate_flags(9)enum ieee80211_bss_type(9)enum ieee80211_privacy(9)struct ieee80211_rate(9)struct ieee80211_he_obss_pd(9)struct cfg80211_he_bss_color(9)struct ieee80211_sta_ht_cap(9)struct ieee80211_sta_vht_cap(9)struct ieee80211_sta_he_cap(9)struct ieee80211_eht_mcs_nss_supp(9)struct ieee80211_sta_eht_cap(9)struct ieee80211_sta_uhr_cap(9)struct ieee80211_sband_iftype_data(9)enum ieee80211_edmg_bw_config(9)struct ieee80211_edmg(9)struct ieee80211_sta_s1g_cap(9)struct ieee80211_supported_band(9)_ieee80211_set_sband_iftype_data(9)ieee80211_set_sband_iftype_data(9)for_each_sband_iftype_data(9)ieee80211_get_sband_iftype_data(9)ieee80211_get_he_iftype_cap(9)ieee80211_get_he_6ghz_capa(9)ieee80211_get_eht_iftype_cap(9)ieee80211_get_uhr_iftype_cap(9)wiphy_read_of_freq_limits(9)
β¨ Actions and configuration β¨
Like, the whole "actually doing stuff" section, and it is a lot π
π the params & chandef girlies
struct vif_params(9)struct key_params(9)struct cfg80211_chan_def(9)struct cfg80211_tid_cfg(9)struct cfg80211_tid_config(9)struct cfg80211_fils_aad(9)struct cfg80211_set_hw_timestamp(9)cfg80211_get_chandef_type(9)cfg80211_chandef_create(9)cfg80211_chandef_identical(9)cfg80211_chandef_is_edmg(9)cfg80211_chandef_is_s1g(9)cfg80211_chandef_compatible(9)nl80211_chan_width_to_mhz(9)cfg80211_chandef_get_width(9)cfg80211_chandef_valid(9)cfg80211_chandef_usable(9)cfg80211_chandef_dfs_required(9)cfg80211_chandef_dfs_usable(9)cfg80211_chandef_dfs_cac_time(9)cfg80211_chandef_primary(9)cfg80211_chandef_npca_valid(9)cfg80211_chandef_add_npca(9)cfg80211_chandef_add_dbe(9)nl80211_send_chandef(9)ieee80211_chandef_max_power(9)cfg80211_chandef_s1g_pri_width(9)cfg80211_any_usable_channels(9)enum survey_info_flags(9)struct survey_info(9)
π«Ά crypto, beacon, AP settings (the build-an-AP kit)
struct cfg80211_crypto_settings(9)struct cfg80211_mbssid_config(9)struct cfg80211_mbssid_elems(9)struct cfg80211_rnr_elems(9)struct cfg80211_beacon_data(9)struct cfg80211_acl_data(9)struct cfg80211_fils_discovery(9)struct cfg80211_unsol_bcast_probe_resp(9)struct cfg80211_s1g_short_beacon(9)struct cfg80211_ap_settings(9)struct cfg80211_ap_update(9)struct cfg80211_csa_settings(9)struct cfg80211_color_change_settings(9)struct iface_combination_params(9)
π stations, links, rates, mesh, ocb
enum station_parameters_apply_mask(9)struct sta_txpwr(9)struct link_station_parameters(9)struct link_station_del_parameters(9)struct cfg80211_ttlm_params(9)struct station_parameters(9)struct station_del_parameters(9)enum cfg80211_station_type(9)cfg80211_check_station_change(9)enum rate_info_flags(9)enum rate_info_bw(9)struct rate_info(9)enum bss_param_flags(9)struct sta_bss_parameters(9)struct cfg80211_txq_stats(9)struct cfg80211_tid_stats(9)struct link_station_info(9)struct station_info(9)struct cfg80211_sar_sub_specs(9)struct cfg80211_sar_specs(9)struct cfg80211_sar_freq_ranges(9)struct cfg80211_sar_capa(9)cfg80211_get_station(9)enum monitor_flags(9)enum mpath_info_flags(9)struct mpath_info(9)enum wiphy_bss_param_flags(9)struct bss_parameters(9)struct mesh_config(9)struct mesh_setup(9)struct ocb_setup(9)struct ieee80211_txq_params(9)
π Scanning and BSS list handling π
Scanning, connecting, wowlan, and also a surprise appearance from qos maps at the end, no cap π₯
struct cfg80211_ssid(9)struct cfg80211_scan_info(9)struct cfg80211_scan_6ghz_params(9)struct cfg80211_scan_request(9)struct cfg80211_match_set(9)struct cfg80211_sched_scan_plan(9)struct cfg80211_bss_select_adjust(9)struct cfg80211_sched_scan_request(9)enum cfg80211_signal_type(9)struct cfg80211_inform_bss(9)struct cfg80211_bss_ies(9)struct cfg80211_bss(9)ieee80211_bss_get_elem(9)ieee80211_bss_get_ie(9)struct cfg80211_auth_request(9)struct cfg80211_assoc_link(9)struct cfg80211_ml_reconf_req(9)enum cfg80211_assoc_req_flags(9)struct cfg80211_assoc_request(9)struct cfg80211_deauth_request(9)struct cfg80211_disassoc_request(9)struct cfg80211_ibss_params(9)struct cfg80211_bss_selection(9)struct cfg80211_connect_params(9)enum cfg80211_connect_params_changed(9)enum wiphy_params_flags(9)struct cfg80211_pmksa(9)struct cfg80211_pkt_pattern(9)struct cfg80211_wowlan_tcp(9)struct cfg80211_wowlan(9)struct cfg80211_coalesce_rules(9)struct cfg80211_coalesce(9)struct cfg80211_wowlan_nd_match(9)struct cfg80211_wowlan_nd_info(9)struct cfg80211_wowlan_wakeup(9)struct cfg80211_gtk_rekey_data(9)struct cfg80211_update_ft_ies_params(9)struct cfg80211_mgmt_tx_params(9)struct cfg80211_dscp_exception(9)struct cfg80211_dscp_range(9)struct cfg80211_qos_map(9)
π¦ Neighbor Awareness Networking (NAN) π¦
NAN, then it just keeps going into pmk / external auth / FTM / PMSR and honestly? iconic π
struct cfg80211_nan_band_config(9)struct cfg80211_nan_conf(9)struct cfg80211_nan_channel(9)struct cfg80211_nan_local_sched(9)struct cfg80211_nan_peer_map(9)struct cfg80211_nan_peer_sched(9)enum cfg80211_nan_conf_changes(9)struct cfg80211_nan_func_filter(9)struct cfg80211_nan_func(9)struct cfg80211_pmk_conf(9)struct cfg80211_external_auth_params(9)struct cfg80211_ftm_responder_stats(9)struct cfg80211_pmsr_ftm_result(9)struct cfg80211_pmsr_result(9)struct cfg80211_pmsr_ftm_request_peer(9)struct cfg80211_pmsr_request_peer(9)struct cfg80211_pmsr_request(9)struct cfg80211_update_owe_info(9)struct mgmt_frame_regs(9)struct cfg80211_ops(9)enum wiphy_flags(9)struct ieee80211_iface_limit(9)struct ieee80211_iface_combination(9)enum wiphy_wowlan_support_flags(9)struct wiphy_wowlan_support(9)struct wiphy_coalesce_support(9)enum wiphy_vendor_command_flags(9)enum wiphy_opmode_flag(9)struct sta_opmode_info(9)struct wiphy_vendor_command(9)struct wiphy_iftype_ext_capab(9)cfg80211_get_iftype_ext_capa(9)struct cfg80211_pmsr_capabilities(9)struct wiphy_iftype_akm_suites(9)struct wiphy_radio_cfg(9)struct wiphy_radio_freq_range(9)struct wiphy_radio(9)enum wiphy_nan_flags(9)struct wiphy_nan_capa(9)
π wiphy + wireless_dev (the whole personality) π
struct wiphy(9)wiphy_priv(9)priv_to_wiphy(9)set_wiphy_dev(9)wiphy_dev(9)wiphy_name(9)wiphy_new_nm(9)wiphy_new(9)wiphy_register(9)rcu_dereference_wiphy(9)wiphy_dereference(9)get_wiphy_regdom(9)wiphy_unregister(9)wiphy_free(9)wiphy_lock(9)wiphy_unlock(9)wiphy_work_queue(9)wiphy_work_cancel(9)wiphy_work_flush(9)wiphy_delayed_work_queue(9)wiphy_delayed_work_cancel(9)wiphy_delayed_work_flush(9)wiphy_delayed_work_pending(9)wiphy_hrtimer_work_queue(9)wiphy_hrtimer_work_cancel(9)wiphy_hrtimer_work_flush(9)wiphy_hrtimer_work_pending(9)enum ieee80211_ap_reg_power(9)struct wireless_dev(9)wdev_priv(9)wdev_chandef(9)
π§ Utility functions π§
Channel math, header lengths, the little helpers that carry the whole operation fr fr
ieee80211_channel_equal(9)ieee80211_channel_to_khz(9)ieee80211_channel_to_freq_khz(9)ieee80211_channel_to_frequency(9)ieee80211_freq_khz_to_channel(9)ieee80211_frequency_to_channel(9)ieee80211_get_channel_khz(9)ieee80211_get_channel(9)cfg80211_channel_is_psc(9)ieee80211_radio_freq_range_valid(9)cfg80211_radio_chandef_valid(9)cfg80211_wdev_channel_allowed(9)ieee80211_get_response_rate(9)ieee80211_mandatory_rates(9)struct ieee80211_radiotap_iterator(9)ieee80211_get_hdrlen_from_skb(9)ieee80211_hdrlen(9)ieee80211_get_mesh_hdrlen(9)
π Data path helpers π
Converting frames, finding IEs, defragging elements β the plumbing bestie π
ieee80211_data_to_8023_exthdr(9)ieee80211_data_to_8023(9)ieee80211_is_valid_amsdu(9)ieee80211_amsdu_to_8023s(9)ieee80211_get_8023_tunnel_proto(9)ieee80211_strip_8023_mesh_hdr(9)cfg80211_classify8021d(9)cfg80211_find_elem_match(9)cfg80211_find_ie_match(9)cfg80211_find_elem(9)cfg80211_find_ie(9)cfg80211_find_ext_elem(9)cfg80211_find_ext_ie(9)cfg80211_find_vendor_elem(9)cfg80211_find_vendor_ie(9)enum cfg80211_rnr_iter_ret(9)cfg80211_iter_rnr(9)cfg80211_defragment_element(9)cfg80211_send_layer2_update(9)
πΈ Regulatory enforcement infrastructure πΈ
Rules are rules, bestie, and the regulator is always watching π
regulatory_hint(9)regulatory_set_wiphy_regd(9)regulatory_set_wiphy_regd_sync(9)wiphy_apply_custom_regulatory(9)freq_reg_info(9)reg_initiator_name(9)regulatory_pre_cac_allowed(9)
π Internal regulatory db functions π
β BSS informing + event notifying (say it with me: notify) β
cfg80211_scan_done(9)cfg80211_sched_scan_results(9)cfg80211_sched_scan_stopped(9)cfg80211_sched_scan_stopped_locked(9)cfg80211_inform_bss_frame_data(9)cfg80211_gen_new_bssid(9)cfg80211_is_element_inherited(9)cfg80211_merge_profile(9)enum cfg80211_bss_frame_type(9)cfg80211_get_ies_channel_number(9)cfg80211_ssid_eq(9)cfg80211_inform_bss_data(9)__cfg80211_get_bss(9)cfg80211_get_bss(9)cfg80211_ref_bss(9)cfg80211_put_bss(9)cfg80211_unlink_bss(9)cfg80211_bss_iter(9)cfg80211_rx_mlme_mgmt(9)cfg80211_auth_timeout(9)struct cfg80211_rx_assoc_resp_data(9)cfg80211_rx_assoc_resp(9)struct cfg80211_assoc_failure(9)cfg80211_assoc_failure(9)cfg80211_tx_mlme_mgmt(9)cfg80211_rx_unprot_mlme_mgmt(9)cfg80211_michael_mic_failure(9)cfg80211_ibss_joined(9)cfg80211_notify_new_peer_candidate(9)
π¦ RFkill integration π¦
π vendor cmd replies + events (yes, the section you literally just read, but the function-level lore) π
cfg80211_vendor_cmd_alloc_reply_skb(9)cfg80211_vendor_cmd_reply(9)cfg80211_vendor_cmd_get_sender(9)cfg80211_vendor_event_alloc(9)cfg80211_vendor_event_alloc_ucast(9)cfg80211_vendor_event(9)
π Test mode π
cfg80211_testmode_alloc_reply_skb(9)cfg80211_testmode_reply(9)cfg80211_testmode_alloc_event_skb(9)cfg80211_testmode_event(9)
π connecting, roaming, and telling everyone about it π
struct cfg80211_fils_resp_params(9)struct cfg80211_connect_resp_params(9)cfg80211_connect_done(9)cfg80211_connect_bss(9)cfg80211_connect_result(9)cfg80211_connect_timeout(9)struct cfg80211_roam_info(9)cfg80211_roamed(9)cfg80211_port_authorized(9)cfg80211_disconnected(9)cfg80211_ready_on_channel(9)cfg80211_remain_on_channel_expired(9)cfg80211_tx_mgmt_expired(9)cfg80211_sinfo_alloc_tid_stats(9)cfg80211_link_sinfo_alloc_tid_stats(9)cfg80211_sinfo_release_content(9)cfg80211_new_sta(9)cfg80211_del_sta_sinfo(9)cfg80211_del_sta(9)cfg80211_conn_failed(9)struct cfg80211_rx_info(9)cfg80211_rx_mgmt_ext(9)cfg80211_rx_mgmt_khz(9)cfg80211_rx_mgmt(9)struct cfg80211_tx_status(9)cfg80211_mgmt_tx_status_ext(9)cfg80211_mgmt_tx_status(9)cfg80211_control_port_tx_status(9)cfg80211_rx_control_port(9)cfg80211_cqm_rssi_notify(9)cfg80211_cqm_pktloss_notify(9)cfg80211_cqm_txe_notify(9)cfg80211_cqm_beacon_loss_notify(9)__cfg80211_radar_event(9)cfg80211_sta_opmode_change_notify(9)cfg80211_cac_event(9)cfg80211_background_cac_abort(9)cfg80211_gtk_rekey_notify(9)cfg80211_pmksa_candidate_notify(9)cfg80211_rx_spurious_frame(9)cfg80211_rx_unexpected_4addr_frame(9)cfg80211_probe_status(9)cfg80211_report_obss_beacon_khz(9)cfg80211_report_obss_beacon(9)struct cfg80211_beaconing_check_config(9)
β¦and here's the rest of the friend group, because this page literally does not know how to end a guest list π
πΈ the regulatory besties
cfg80211_reg_check_beaconing(9)β the one who checks if you're even allowed to beaconcfg80211_reg_can_beacon(9)β asks the regulatory gods "can I beacon??" and gets an answercfg80211_reg_can_beacon_relax(9)β same question, but the chill version, lowkey relaxed
π¦ channel switch era
cfg80211_ch_switch_notify(9)β "we moved channels, just so u know"cfg80211_ch_switch_started_notify(9)β "we're moving channels, hold my iced coffee"
β¨ operating class math (iconic honestly)
ieee80211_operating_class_to_band(9)β operating class in, band out, periodtieee80211_operating_class_to_chandef(9)β operating class in, channel definition outieee80211_chandef_to_operating_class(9)β the reverse slayieee80211_chandef_to_khz(9)β turns a channel definition into kHz, bestie
π tdls + bitrate
cfg80211_tdls_oper_request(9)β a TDLS operation request, sent, donecfg80211_calculate_bitrate(9)β the math girlie that computes bitrate
π register/unregister arc
cfg80211_unregister_wdev(9)β says bye to a wireless devicecfg80211_register_netdevice(9)β introduces a netdevice to the partycfg80211_unregister_netdevice(9)β kicks that netdevice out of the party
π§ fast BSS transition corner
struct cfg80211_ft_event_params(9)β the lil struct holding FT event paramscfg80211_ft_event(9)β the FT event itself, main character energy
π₯ p2p + IE splitting
cfg80211_get_p2p_attr(9)β digs out a P2P attributeieee80211_ie_split_ric(9)β splits IEs with the RIC handling tooieee80211_ie_split(9)β just splits IEs, no extra dramaieee80211_fragment_element(9)β breaks an element into fragments π«
β wowlan + critical protocol
cfg80211_report_wowlan_wakeup(9)β "we woke up from wowlan, here's the report"cfg80211_crit_proto_stopped(9)β the critical protocol has stopped, noted
π¦ channels & combinations
ieee80211_get_num_supported_channels(9)β counts how many channels u gotcfg80211_check_combinations(9)β checks if this combo of stuff is even legalcfg80211_iter_combinations(9)β iterates all the combos, one by onecfg80211_get_radio_idx_by_chan(9)β "which radio is this channel on??" answered
π shutting things down
cfg80211_stop_link(9)β stops a linkcfg80211_stop_iface(9)β stops an interfacecfg80211_shutdown_all_interfaces(9)β stops literally everything, no survivors π
π ext features
wiphy_ext_feature_set(9)β sets a wiphy extended feature bitwiphy_ext_feature_isset(9)β asks "is that ext feature set??"
π NAN (neighbor awareness networking) crew, part 1
cfg80211_free_nan_func(9)β frees a NAN function, memory hygiene queenstruct cfg80211_nan_match_params(9)β the struct with NAN match paramscfg80211_nan_match(9)β a NAN match happened, reporting itcfg80211_nan_func_terminated(9)β the NAN function is over, so sadcfg80211_nan_sched_update_done(9)β schedule update finished, we're so back
π₯ auth + pmsr
cfg80211_external_auth_request(9)β an external auth request, get on itcfg80211_pmsr_report(9)β peer measurement report incomingcfg80211_pmsr_complete(9)β peer measurement done, that's a wrap
π iftype, assoc comeback, owe
cfg80211_iftype_allowed(9)β is this interface type allowed?? asked and answeredcfg80211_assoc_comeback(9)β the assoc comeback (yes it's really called that, ate)cfg80211_update_owe_info_event(9)β pushes out an OWE info update event
π BSS
cfg80211_bss_flush(9)β flushes the BSS list, bye bye scan results
π color change saga
cfg80211_bss_color_notify(9)β "BSS color, just so u know"cfg80211_obss_color_collision_notify(9)β collision detected in the OBSS color, dramacfg80211_color_change_started_notify(9)β color change has beguncfg80211_color_change_aborted_notify(9)β nvm, color change aborted πcfg80211_color_change_notify(9)β color change, formally announced
β 6 GHz + MLO
cfg80211_6ghz_power_type(9)β 6 GHz power type stuff, very new-gencfg80211_links_removed(9)β links got removed, ripstruct cfg80211_mlo_reconf_done_data(9)β the struct holding MLO reconfig done datacfg80211_mlo_reconf_add_done(9)β MLO reconfig add is done, slay
π channel checks + EPCS
cfg80211_schedule_channels_check(9)β schedules a channels check for latercfg80211_epcs_changed(9)β EPCS changed, noted
π§ NAN crew, part 2 (they're back)
cfg80211_next_nan_dw_notif(9)β notification for the next NAN discovery windowcfg80211_nan_cluster_joined(9)β joined a NAN cluster, we're in the group chat nowcfg80211_nan_ulw_update(9)β NAN ULW update, whatever that needs to becfg80211_nan_channel_evac(9)β NAN channel evacuation, everybody out πββοΈ
π¦ debugfs (locked edition)
wiphy_locked_debugfs_read(9)β read from wiphy debugfs while holding the lockwiphy_locked_debugfs_write(9)β write to wiphy debugfs while holding the lock
πΈ S1G math trio
cfg80211_s1g_get_start_freq_khz(9)β start frequency in kHz, S1G flavoredcfg80211_s1g_get_end_freq_khz(9)β end frequency in kHz, same vibecfg80211_s1g_get_primary_sibling(9)β finds the primary sibling, iykyk
π last but never least
cfg80211_incumbent_signal_notify(9)β an incumbent signal showed up, everybody stay calm
okay that's genuinely everyone, no cap, I checked twice π go read the ones u need and hydrate while ur at it π«Ά
This lil rewrite was brought to u from ./include/net, dated October 2026 β so it's basically a period piece now. The page is Vendor commands(9), and yes, it's still called that, and yes, I love her for it. β¨π bye bestie π
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms