github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/linux/dev_camx.txt

# Copyright 2023 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# The source file of camx ioctl can be found in ChromeOS source tree:
# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/refs/heads/chromeos-5.15/drivers/media/platform/camx/

# Not upstream, generated on:
# https://chromium.googlesource.com/chromiumos/third_party/kernel cdff88937190
# with -includedirs drivers/media/platform/camx/include/uapi
meta noextract

include <media/cam_req_mgr.h>
include <uapi/linux/fcntl.h>

resource fd_camx[fd]
resource session_handle[int32]
resource link_handle[int32]
resource alloc_fd[fd]

openat$camx(fd const[AT_FDCWD], file ptr[in, string["/dev/v4l/by-path/platform-soc@0:qcom_cam-req-mgr-video-index0"]], flags const[O_RDWR], mode const[0]) fd_camx

# no code handles commented out op_code

# ioctl$CAM_REQ_MGR_CREATE_DEV_NODES(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CREATE_DEV_NODES])
ioctl$CAM_REQ_MGR_CREATE_SESSION(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CREATE_SESSION])
ioctl$CAM_REQ_MGR_DESTROY_SESSION(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_DESTROY_SESSION])
ioctl$CAM_REQ_MGR_LINK(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK])
ioctl$CAM_REQ_MGR_UNLINK(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_UNLINK])
ioctl$CAM_REQ_MGR_SCHED_REQ(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_SCHED_REQ])
ioctl$CAM_REQ_MGR_FLUSH_REQ(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_FLUSH_REQ])
ioctl$CAM_REQ_MGR_SYNC_MODE(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_SYNC_MODE])
ioctl$CAM_REQ_MGR_ALLOC_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_ALLOC_BUF])
ioctl$CAM_REQ_MGR_MAP_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_MAP_BUF])
ioctl$CAM_REQ_MGR_RELEASE_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_RELEASE_BUF])
# ioctl$CAM_REQ_MGR_CACHE_OPS(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CACHE_OPS])
ioctl$CAM_REQ_MGR_LINK_CONTROL(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK_CONTROL])
ioctl$CAM_REQ_MGR_LINK_V2(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK_V2])
ioctl$CAM_REQ_MGR_REQUEST_DUMP(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_REQUEST_DUMP])

type cam_control[OPCODE, HANDLE] {
	op_code		const[OPCODE, int32]
	size		bytesize[handle, int32]
	handle_type	const[CAM_HANDLE_USER_POINTER, int32]
	reserved	const[0, int32]
	handle		ptr[in, HANDLE]
}

type cam_control$CAM_REQ_MGR_CREATE_SESSION cam_control[CAM_REQ_MGR_CREATE_SESSION, cam_req_mgr_session_info__for_create]
type cam_control$CAM_REQ_MGR_DESTROY_SESSION cam_control[CAM_REQ_MGR_DESTROY_SESSION, cam_req_mgr_session_info__for_destroy]
type cam_control$CAM_REQ_MGR_LINK cam_control[CAM_REQ_MGR_LINK, cam_req_mgr_ver_info]
type cam_control$CAM_REQ_MGR_UNLINK cam_control[CAM_REQ_MGR_UNLINK, cam_req_mgr_unlink_info]
type cam_control$CAM_REQ_MGR_SCHED_REQ cam_control[CAM_REQ_MGR_SCHED_REQ, cam_req_mgr_sched_request]
type cam_control$CAM_REQ_MGR_FLUSH_REQ cam_control[CAM_REQ_MGR_FLUSH_REQ, cam_req_mgr_flush_info]
type cam_control$CAM_REQ_MGR_SYNC_MODE cam_control[CAM_REQ_MGR_SYNC_MODE, cam_req_mgr_sync_mode]
type cam_control$CAM_REQ_MGR_ALLOC_BUF cam_control[CAM_REQ_MGR_ALLOC_BUF, cam_mem_mgr_alloc_cmd]
type cam_control$CAM_REQ_MGR_MAP_BUF cam_control[CAM_REQ_MGR_MAP_BUF, cam_mem_mgr_map_cmd]
type cam_control$CAM_REQ_MGR_RELEASE_BUF cam_control[CAM_REQ_MGR_RELEASE_BUF, cam_mem_mgr_release_cmd]
type cam_control$CAM_REQ_MGR_LINK_CONTROL cam_control[CAM_REQ_MGR_LINK_CONTROL, cam_req_mgr_link_control]
type cam_control$CAM_REQ_MGR_LINK_V2 cam_control[CAM_REQ_MGR_LINK_V2, cam_req_mgr_ver_info]
type cam_control$CAM_REQ_MGR_REQUEST_DUMP cam_control[CAM_REQ_MGR_REQUEST_DUMP, cam_dump_req_cmd]

# originally cam_req_mgr_session_info
cam_req_mgr_session_info__for_create {
	session_hdl	session_handle	(out)
	reserved	const[0, int32]
}

# originally cam_req_mgr_session_info
cam_req_mgr_session_info__for_destroy {
	session_hdl	session_handle
	reserved	const[0, int32]
}

cam_req_mgr_ver_info {
	version	int32	(out)
	u	cam_req_mgr_ver_info_union
}

cam_req_mgr_ver_info_union {
	link_info_v1	cam_req_mgr_link_info
	link_info_v2	cam_req_mgr_link_info_v2
}

cam_req_mgr_link_info {
	session_hdl	session_handle
	num_devices	len[dev_hdls, int32]
	dev_hdls	array[int32, CAM_REQ_MGR_MAX_HANDLES]
	link_hdl	link_handle	(out)
}

cam_req_mgr_link_info_v2 {
	session_hdl	session_handle
	num_devices	len[dev_hdls, int32]
	dev_hdls	array[int32, CAM_REQ_MGR_MAX_HANDLES_V2]
	link_hdl	link_handle	(out)
}

cam_req_mgr_unlink_info {
	session_hdl	session_handle
	link_hdl	link_handle
}

cam_req_mgr_sched_request {
	session_hdl	session_handle
	link_hdl	link_handle
	bubble_enable	int32
	sync_mode	flags[sync_mode_flags, int32]
	req_id		int64
}

cam_req_mgr_flush_info {
	session_hdl	session_handle
	link_hdl	link_handle
	flush_type	flags[flush_type_flags, int32]
	reserved	const[0, int32]
	req_id		int64
}

cam_req_mgr_sync_mode {
	session_hdl	session_handle
	sync_mode	flags[sync_mode_flags, int32]
	num_links	len[link_hdls, int32]
	link_hdls	array[link_handle, MAX_LINKS_PER_SESSION]
	master_link_hdl	link_handle
	reserved	const[0, int32]
}

cam_mem_mgr_alloc_cmd {
	len		int64
	align		int64
	mmu_hdls	array[int32, CAM_MEM_MMU_MAX_HANDLE]
	num_hdl		len[mmu_hdls, int32]
	flags		flags[mem_flags, int32]
	out		cam_mem_alloc_out_params	(out)
}

cam_mem_alloc_out_params {
	buf_handle	int32
	fd		alloc_fd
	vaddr		int64
}

cam_mem_mgr_map_cmd {
	mmu_hdls	array[int32, CAM_MEM_MMU_MAX_HANDLE]
	num_hdl		len[mmu_hdls, int32]
	flags		flags[mem_flags, int32]
	fd		alloc_fd
	reserved	const[0, int32]
	out		cam_mem_map_out_params	(out)
}

cam_mem_map_out_params {
	buf_handle	int32
	reserved	const[0, int32]
	vaddr		int64
}

cam_mem_mgr_release_cmd {
	buf_handle	int32
	reserved	const[0, int32]
}

cam_req_mgr_link_control {
	ops		flags[link_control_operation_flags, int32]
	session_hdl	session_handle
	num_links	len[link_hdls, int32]
	reserved	const[0, int32]
	link_hdls	array[link_handle, MAX_LINKS_PER_SESSION]
}

cam_dump_req_cmd {
	issue_req_id	int64
	session_handle	session_handle
	link_hdl	int32
	dev_handle	int32
	error_type	int32
	buf_handle	int32
	offset		int32	(out)
	reserved	const[0, int32]
}

flush_type_flags = CAM_REQ_MGR_FLUSH_TYPE_ALL, CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ, CAM_REQ_MGR_FLUSH_TYPE_MAX
sync_mode_flags = CAM_REQ_MGR_SYNC_MODE_NO_SYNC, CAM_REQ_MGR_SYNC_MODE_SYNC
link_control_operation_flags = CAM_REQ_MGR_LINK_ACTIVATE, CAM_REQ_MGR_LINK_DEACTIVATE
mem_flags = CAM_MEM_FLAG_HW_READ_WRITE, CAM_MEM_FLAG_HW_READ_ONLY, CAM_MEM_FLAG_HW_WRITE_ONLY, CAM_MEM_FLAG_KMD_ACCESS, CAM_MEM_FLAG_UMD_ACCESS, CAM_MEM_FLAG_PROTECTED_MODE, CAM_MEM_FLAG_CMD_BUF_TYPE, CAM_MEM_FLAG_PIXEL_BUF_TYPE, CAM_MEM_FLAG_STATS_BUF_TYPE, CAM_MEM_FLAG_PACKET_BUF_TYPE, CAM_MEM_FLAG_CACHE, CAM_MEM_FLAG_HW_SHARED_ACCESS, CAM_MEM_FLAG_CDSP_OUTPUT