github.com/google/syzkaller@v0.0.0-20251211124644-a066d2bc4b02/sys/linux/dev_usbmon.txt (about)

     1  # Copyright 2019 syzkaller project authors. All rights reserved.
     2  # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
     3  
     4  # https://elixir.bootlin.com/linux/latest/source/Documentation/usb/usbmon.txt
     5  # https://elixir.bootlin.com/linux/latest/source/drivers/usb/mon/mon_bin.c
     6  
     7  include <linux/fcntl.h>
     8  include <linux/ioctl.h>
     9  
    10  # The following macros were defined here because they are not visible from a separate header file
    11  
    12  define MON_IOC_MAGIC	0x92
    13  
    14  define SETUP_LEN	8
    15  define PAGE_SIZE	4096
    16  define CHUNK_SIZE	PAGE_SIZE
    17  
    18  define BUFF_MAX	(((1200*1024)+CHUNK_SIZE-1) & ~(CHUNK_SIZE-1))
    19  define BUFF_MIN	(((8*1024)+CHUNK_SIZE-1) & ~(CHUNK_SIZE-1))
    20  
    21  define MON_IOCQ_URB_LEN	_IO(MON_IOC_MAGIC, 1)
    22  define MON_IOCG_STATS	_IOR(MON_IOC_MAGIC, 3, struct {u32 queued; u32 dropped;})
    23  define MON_IOCT_RING_SIZE	_IO(MON_IOC_MAGIC, 4)
    24  define MON_IOCQ_RING_SIZE	_IO(MON_IOC_MAGIC, 5)
    25  define MON_IOCX_GET	_IOW(MON_IOC_MAGIC, 6, struct {void *hdr; void *data; size_t alloc;})
    26  define MON_IOCX_MFETCH	_IOWR(MON_IOC_MAGIC, 7, struct {u32 *offvec; u32 nfetch; u32 nflush;})
    27  define MON_IOCH_MFLUSH	_IO(MON_IOC_MAGIC, 8)
    28  define MON_IOCX_GETX	_IOW(MON_IOC_MAGIC, 10,  struct {void *hdr; void *data; size_t alloc;})
    29  
    30  resource fd_usbmon[fd]
    31  
    32  syz_open_dev$usbmon(dev ptr[in, string["/dev/usbmon#"]], id intptr, flags flags[open_flags]) fd_usbmon
    33  read$usbmon(fd fd_usbmon, buf buffer[out], count len[buf])
    34  mmap$usbmon(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd_usbmon, offset fileoff)
    35  _ = __NR_mmap2
    36  
    37  ioctl$MON_IOCQ_URB_LEN(fd fd_usbmon, cmd const[MON_IOCQ_URB_LEN])
    38  ioctl$MON_IOCQ_RING_SIZE(fd fd_usbmon, cmd const[MON_IOCQ_RING_SIZE])
    39  ioctl$MON_IOCT_RING_SIZE(fd fd_usbmon, cmd const[MON_IOCT_RING_SIZE], arg intptr[BUFF_MIN:BUFF_MAX])
    40  ioctl$MON_IOCH_MFLUSH(fd fd_usbmon, cmd const[MON_IOCH_MFLUSH], arg intptr)
    41  ioctl$MON_IOCX_GET(fd fd_usbmon, cmd const[MON_IOCX_GET], arg ptr[in, mon_bin_get])
    42  ioctl$MON_IOCX_GETX(fd fd_usbmon, cmd const[MON_IOCX_GETX], arg ptr[in, mon_bin_get])
    43  
    44  ioctl$MON_IOCX_MFETCH(fd fd_usbmon, cmd const[MON_IOCX_MFETCH], arg ptr[inout, mon_bin_mfetch])
    45  ioctl$MON_IOCG_STATS(fd fd_usbmon, cmd const[MON_IOCG_STATS], arg ptr[out, mon_bin_stats])
    46  
    47  iso_rec {
    48  	error_count	int32
    49  	numdesc		int32
    50  }
    51  
    52  mon_bin_union [
    53  	setup	array[int8, SETUP_LEN]
    54  	iso	iso_rec
    55  ]
    56  
    57  mon_bin_hdr {
    58  	id		int64
    59  	type		int8
    60  	xfer_type	int8
    61  	epnum		int8
    62  	devnum		int8
    63  	busnum		int16
    64  	flag_setup	int8
    65  	flag_data	int8
    66  	ts_sec		int64
    67  	ts_usec		int32
    68  	status		int32
    69  	len_urb		int32
    70  	len_cap		int32
    71  	s		mon_bin_union
    72  	interval	int32
    73  	start_frame	int32
    74  	xfer_flags	int32
    75  	ndesc		int32
    76  }
    77  
    78  mon_bin_get {
    79  	hdr	ptr[out, mon_bin_hdr]
    80  	data	ptr[out, array[int8]]
    81  	alloc	bytesize[data, intptr]
    82  }
    83  
    84  mon_bin_mfetch {
    85  	offvec	ptr[out, array[int32]]
    86  	nfetch	len[offvec, int32]
    87  	nflush	int32
    88  }
    89  
    90  mon_bin_stats {
    91  	queued	int32
    92  	dropped	int32
    93  }