sys/linux: add descriptions for camx driver

3 files changed, 230 insertions, 0 deletions

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index a5dd6c367..b2d70658f 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -38,6 +38,7 @@ Google Inc.
  Hrutvik Kanabar
  Zachary O'Keefe
  Etienne Perot
+ Hidenori Kobayashi
 Baozeng Ding
 Lorenzo Stoakes
 Jeremy Huang
diff --git a/sys/linux/dev_camx.txt b/sys/linux/dev_camx.txt
new file mode 100644
index 000000000..5c8125f32
--- /dev/null
+++ b/sys/linux/dev_camx.txt
@@ -0,0 +1,184 @@
+# Copyright 2023 syzkaller project authors. All rights reserved.
+# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+# The source file of camx ioctl can be found in ChromeOS source tree:
+# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/refs/heads/chromeos-5.15/drivers/media/platform/camx/
+
+# Not upstream, generated on:
+# https://chromium.googlesource.com/chromiumos/third_party/kernel cdff88937190
+# with -includedirs drivers/media/platform/camx/include/uapi
+meta noextract
+
+include <media/cam_req_mgr.h>
+
+resource fd_camx[fd]
+resource session_handle[int32]
+resource link_handle[int32]
+resource alloc_fd[fd]
+
+openat$camx(fd const[AT_FDCWD], file ptr[in, string["/dev/v4l/by-path/platform-soc@0:qcom_cam-req-mgr-video-index0"]], flags const[O_RDWR], mode const[0]) fd_camx
+
+# no code handles commented out op_code
+
+# ioctl$CAM_REQ_MGR_CREATE_DEV_NODES(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CREATE_DEV_NODES])
+ioctl$CAM_REQ_MGR_CREATE_SESSION(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CREATE_SESSION])
+ioctl$CAM_REQ_MGR_DESTROY_SESSION(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_DESTROY_SESSION])
+ioctl$CAM_REQ_MGR_LINK(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK])
+ioctl$CAM_REQ_MGR_UNLINK(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_UNLINK])
+ioctl$CAM_REQ_MGR_SCHED_REQ(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_SCHED_REQ])
+ioctl$CAM_REQ_MGR_FLUSH_REQ(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_FLUSH_REQ])
+ioctl$CAM_REQ_MGR_SYNC_MODE(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_SYNC_MODE])
+ioctl$CAM_REQ_MGR_ALLOC_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_ALLOC_BUF])
+ioctl$CAM_REQ_MGR_MAP_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_MAP_BUF])
+ioctl$CAM_REQ_MGR_RELEASE_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_RELEASE_BUF])
+# ioctl$CAM_REQ_MGR_CACHE_OPS(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CACHE_OPS])
+ioctl$CAM_REQ_MGR_LINK_CONTROL(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK_CONTROL])
+ioctl$CAM_REQ_MGR_LINK_V2(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK_V2])
+ioctl$CAM_REQ_MGR_REQUEST_DUMP(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_REQUEST_DUMP])
+
+type cam_control[OPCODE, HANDLE] {
+	op_code		const[OPCODE, int32]
+	size		bytesize[handle, int32]
+	handle_type	const[CAM_HANDLE_USER_POINTER, int32]
+	reserved	const[0, int32]
+	handle		ptr[in, HANDLE]
+}
+
+type cam_control$CAM_REQ_MGR_CREATE_SESSION cam_control[CAM_REQ_MGR_CREATE_SESSION, cam_req_mgr_session_info__for_create]
+type cam_control$CAM_REQ_MGR_DESTROY_SESSION cam_control[CAM_REQ_MGR_DESTROY_SESSION, cam_req_mgr_session_info__for_destroy]
+type cam_control$CAM_REQ_MGR_LINK cam_control[CAM_REQ_MGR_LINK, cam_req_mgr_ver_info]
+type cam_control$CAM_REQ_MGR_UNLINK cam_control[CAM_REQ_MGR_UNLINK, cam_req_mgr_unlink_info]
+type cam_control$CAM_REQ_MGR_SCHED_REQ cam_control[CAM_REQ_MGR_SCHED_REQ, cam_req_mgr_sched_request]
+type cam_control$CAM_REQ_MGR_FLUSH_REQ cam_control[CAM_REQ_MGR_FLUSH_REQ, cam_req_mgr_flush_info]
+type cam_control$CAM_REQ_MGR_SYNC_MODE cam_control[CAM_REQ_MGR_SYNC_MODE, cam_req_mgr_sync_mode]
+type cam_control$CAM_REQ_MGR_ALLOC_BUF cam_control[CAM_REQ_MGR_ALLOC_BUF, cam_mem_mgr_alloc_cmd]
+type cam_control$CAM_REQ_MGR_MAP_BUF cam_control[CAM_REQ_MGR_MAP_BUF, cam_mem_mgr_map_cmd]
+type cam_control$CAM_REQ_MGR_RELEASE_BUF cam_control[CAM_REQ_MGR_RELEASE_BUF, cam_mem_mgr_release_cmd]
+type cam_control$CAM_REQ_MGR_LINK_CONTROL cam_control[CAM_REQ_MGR_LINK_CONTROL, cam_req_mgr_link_control]
+type cam_control$CAM_REQ_MGR_LINK_V2 cam_control[CAM_REQ_MGR_LINK_V2, cam_req_mgr_ver_info]
+type cam_control$CAM_REQ_MGR_REQUEST_DUMP cam_control[CAM_REQ_MGR_REQUEST_DUMP, cam_dump_req_cmd]
+
+# originally cam_req_mgr_session_info
+cam_req_mgr_session_info__for_create {
+	session_hdl	session_handle	(out)
+	reserved	const[0, int32]
+}
+
+# originally cam_req_mgr_session_info
+cam_req_mgr_session_info__for_destroy {
+	session_hdl	session_handle
+	reserved	const[0, int32]
+}
+
+cam_req_mgr_ver_info {
+	version	int32	(out)
+	u	cam_req_mgr_ver_info_union
+}
+
+cam_req_mgr_ver_info_union {
+	link_info_v1	cam_req_mgr_link_info
+	link_info_v2	cam_req_mgr_link_info_v2
+}
+
+cam_req_mgr_link_info {
+	session_hdl	session_handle
+	num_devices	len[dev_hdls, int32]
+	dev_hdls	array[int32, CAM_REQ_MGR_MAX_HANDLES]
+	link_hdl	link_handle	(out)
+}
+
+cam_req_mgr_link_info_v2 {
+	session_hdl	session_handle
+	num_devices	len[dev_hdls, int32]
+	dev_hdls	array[int32, CAM_REQ_MGR_MAX_HANDLES_V2]
+	link_hdl	link_handle	(out)
+}
+
+cam_req_mgr_unlink_info {
+	session_hdl	session_handle
+	link_hdl	link_handle
+}
+
+cam_req_mgr_sched_request {
+	session_hdl	session_handle
+	link_hdl	link_handle
+	bubble_enable	int32
+	sync_mode	flags[sync_mode_flags, int32]
+	req_id		int64
+}
+
+cam_req_mgr_flush_info {
+	session_hdl	session_handle
+	link_hdl	link_handle
+	flush_type	flags[flush_type_flags, int32]
+	reserved	const[0, int32]
+	req_id		int64
+}
+
+cam_req_mgr_sync_mode {
+	session_hdl	session_handle
+	sync_mode	flags[sync_mode_flags, int32]
+	num_links	len[link_hdls, int32]
+	link_hdls	array[link_handle, MAX_LINKS_PER_SESSION]
+	master_link_hdl	link_handle
+	reserved	const[0, int32]
+}
+
+cam_mem_mgr_alloc_cmd {
+	len		int64
+	align		int64
+	mmu_hdls	array[int32, CAM_MEM_MMU_MAX_HANDLE]
+	num_hdl		len[mmu_hdls, int32]
+	flags		flags[mem_flags, int32]
+	out		cam_mem_alloc_out_params	(out)
+}
+
+cam_mem_alloc_out_params {
+	buf_handle	int32
+	fd		alloc_fd
+	vaddr		int64
+}
+
+cam_mem_mgr_map_cmd {
+	mmu_hdls	array[int32, CAM_MEM_MMU_MAX_HANDLE]
+	num_hdl		len[mmu_hdls, int32]
+	flags		flags[mem_flags, int32]
+	fd		alloc_fd
+	reserved	const[0, int32]
+	out		cam_mem_map_out_params	(out)
+}
+
+cam_mem_map_out_params {
+	buf_handle	int32
+	reserved	const[0, int32]
+	vaddr		int64
+}
+
+cam_mem_mgr_release_cmd {
+	buf_handle	int32
+	reserved	const[0, int32]
+}
+
+cam_req_mgr_link_control {
+	ops		flags[link_control_operation_flags, int32]
+	session_hdl	session_handle
+	num_links	len[link_hdls, int32]
+	reserved	const[0, int32]
+	link_hdls	array[link_handle, MAX_LINKS_PER_SESSION]
+}
+
+cam_dump_req_cmd {
+	issue_req_id	int64
+	session_handle	session_handle
+	link_hdl	int32
+	dev_handle	int32
+	error_type	int32
+	buf_handle	int32
+	offset		int32	(out)
+	reserved	const[0, int32]
+}
+
+flush_type_flags = CAM_REQ_MGR_FLUSH_TYPE_ALL, CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ, CAM_REQ_MGR_FLUSH_TYPE_MAX
+sync_mode_flags = CAM_REQ_MGR_SYNC_MODE_NO_SYNC, CAM_REQ_MGR_SYNC_MODE_SYNC
+link_control_operation_flags = CAM_REQ_MGR_LINK_ACTIVATE, CAM_REQ_MGR_LINK_DEACTIVATE
+mem_flags = CAM_MEM_FLAG_HW_READ_WRITE, CAM_MEM_FLAG_HW_READ_ONLY, CAM_MEM_FLAG_HW_WRITE_ONLY, CAM_MEM_FLAG_KMD_ACCESS, CAM_MEM_FLAG_UMD_ACCESS, CAM_MEM_FLAG_PROTECTED_MODE, CAM_MEM_FLAG_CMD_BUF_TYPE, CAM_MEM_FLAG_PIXEL_BUF_TYPE, CAM_MEM_FLAG_STATS_BUF_TYPE, CAM_MEM_FLAG_PACKET_BUF_TYPE, CAM_MEM_FLAG_CACHE, CAM_MEM_HW_SHARED_ACCESS, CAM_MEM_FLAG_CDSP_OUTPUT
diff --git a/sys/linux/dev_camx.txt.const b/sys/linux/dev_camx.txt.const
new file mode 100644
index 000000000..49cdf782f
--- /dev/null
+++ b/sys/linux/dev_camx.txt.const
@@ -0,0 +1,45 @@
+# Code generated by syz-sysgen. DO NOT EDIT.
+arches = arm64
+AT_FDCWD = ???
+CAM_HANDLE_USER_POINTER = arm64:1
+CAM_MEM_FLAG_CACHE = arm64:1024
+CAM_MEM_FLAG_CDSP_OUTPUT = arm64:4096
+CAM_MEM_FLAG_CMD_BUF_TYPE = arm64:64
+CAM_MEM_FLAG_HW_READ_ONLY = arm64:2
+CAM_MEM_FLAG_HW_READ_WRITE = arm64:1
+CAM_MEM_FLAG_HW_WRITE_ONLY = arm64:4
+CAM_MEM_FLAG_KMD_ACCESS = arm64:8
+CAM_MEM_FLAG_PACKET_BUF_TYPE = arm64:512
+CAM_MEM_FLAG_PIXEL_BUF_TYPE = arm64:128
+CAM_MEM_FLAG_PROTECTED_MODE = arm64:32
+CAM_MEM_FLAG_STATS_BUF_TYPE = arm64:256
+CAM_MEM_FLAG_UMD_ACCESS = arm64:16
+CAM_MEM_HW_SHARED_ACCESS = ???
+CAM_MEM_MMU_MAX_HANDLE = arm64:16
+CAM_REQ_MGR_ALLOC_BUF = arm64:274
+CAM_REQ_MGR_CREATE_SESSION = arm64:267
+CAM_REQ_MGR_DESTROY_SESSION = arm64:268
+CAM_REQ_MGR_FLUSH_REQ = arm64:272
+CAM_REQ_MGR_FLUSH_TYPE_ALL = arm64:0
+CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ = arm64:1
+CAM_REQ_MGR_FLUSH_TYPE_MAX = arm64:2
+CAM_REQ_MGR_LINK = arm64:269
+CAM_REQ_MGR_LINK_ACTIVATE = arm64:0
+CAM_REQ_MGR_LINK_CONTROL = arm64:278
+CAM_REQ_MGR_LINK_DEACTIVATE = arm64:1
+CAM_REQ_MGR_LINK_V2 = arm64:279
+CAM_REQ_MGR_MAP_BUF = arm64:275
+CAM_REQ_MGR_MAX_HANDLES = arm64:64
+CAM_REQ_MGR_MAX_HANDLES_V2 = arm64:128
+CAM_REQ_MGR_RELEASE_BUF = arm64:276
+CAM_REQ_MGR_REQUEST_DUMP = arm64:280
+CAM_REQ_MGR_SCHED_REQ = arm64:271
+CAM_REQ_MGR_SYNC_MODE = arm64:273
+CAM_REQ_MGR_SYNC_MODE_NO_SYNC = arm64:0
+CAM_REQ_MGR_SYNC_MODE_SYNC = arm64:1
+CAM_REQ_MGR_UNLINK = arm64:270
+MAX_LINKS_PER_SESSION = arm64:2
+O_RDWR = ???
+VIDIOC_CAM_CONTROL = arm64:3222820544
+__NR_ioctl = arm64:29
+__NR_openat = arm64:56