sys/linux: add /dev/media descriptions

Move existing bits of /dev/media descriptions from sys.txt and dev_video4linux.txt
and complete the descriptions.

Also provide more concrete specialization of VIDIOC_QUERYBUF ioctl.
Add ioctl specialization that serves as fd_v4l2_buffer resource constructor
(returns it outside of a union).

4 files changed, 151 insertions, 30 deletions

diff --git a/sys/linux/dev_media.txt b/sys/linux/dev_media.txt
new file mode 100644
index 000000000..8a3f845c0
--- /dev/null
+++ b/sys/linux/dev_media.txt
@@ -0,0 +1,103 @@
+# Copyright 2022 syzkaller project authors. All rights reserved.
+# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+include <uapi/linux/media.h>
+
+resource fd_media[fd]
+resource fd_request[fd]
+resource media_entity_id[int32]: MEDIA_ENT_ID_FLAG_NEXT
+resource media_pad_index[int16]
+
+syz_open_dev$media(dev ptr[in, string["/dev/media#"]], id intptr, flags flags[open_flags]) fd_media
+
+ioctl$MEDIA_IOC_DEVICE_INFO(fd fd_media, cmd const[MEDIA_IOC_DEVICE_INFO], arg ptr[out, array[int8, MEDIA_DEVICE_INFO_SIZE]])
+ioctl$MEDIA_IOC_ENUM_ENTITIES(fd fd_media, cmd const[MEDIA_IOC_ENUM_ENTITIES], arg ptr[inout, media_entity_desc])
+ioctl$MEDIA_IOC_ENUM_LINKS(fd fd_media, cmd const[MEDIA_IOC_ENUM_LINKS], arg ptr[inout, media_links_enum])
+ioctl$MEDIA_IOC_SETUP_LINK(fd fd_media, cmd const[MEDIA_IOC_SETUP_LINK], arg ptr[in, media_link_desc])
+ioctl$MEDIA_IOC_G_TOPOLOGY(fd fd_media, cmd const[MEDIA_IOC_G_TOPOLOGY], arg ptr[inout, media_v2_topology])
+ioctl$MEDIA_IOC_REQUEST_ALLOC(fd fd_media, cmd const[MEDIA_IOC_REQUEST_ALLOC], arg ptr[out, fd_request])
+
+ioctl$MEDIA_REQUEST_IOC_QUEUE(fd fd_request, cmd const[MEDIA_REQUEST_IOC_QUEUE], arg const[0])
+ioctl$MEDIA_REQUEST_IOC_REINIT(fd fd_request, cmd const[MEDIA_REQUEST_IOC_REINIT], arg const[0])
+
+define MEDIA_DEVICE_INFO_SIZE	sizeof(struct media_device_info)
+define MEDIA_ENTITY_DESC_SIZE	sizeof(struct media_entity_desc)
+
+media_entity_desc {
+	id	media_entity_id	(in)
+} [size[MEDIA_ENTITY_DESC_SIZE]]
+
+media_links_enum {
+	entity	media_entity_id	(in)
+	pads	ptr[out, array[media_pad_desc, 2]]
+	links	ptr[out, array[media_link_desc, 2]]
+}
+
+media_link_desc {
+	source		media_pad_desc
+	sink		media_pad_desc
+	flags		flags[media_link_flags, int32]
+	reserved	array[int32, 2]
+}
+
+media_link_flags = MEDIA_LNK_FL_ENABLED, MEDIA_LNK_FL_IMMUTABLE, MEDIA_LNK_FL_DYNAMIC, MEDIA_LNK_FL_DATA_LINK, MEDIA_LNK_FL_INTERFACE_LINK
+
+media_pad_desc {
+	entity		media_entity_id
+	index		media_pad_index
+	flags		flags[media_pad_flags, int32]
+	reserved	array[int32, 2]
+}
+
+media_pad_flags = MEDIA_PAD_FL_SINK, MEDIA_PAD_FL_SOURCE, MEDIA_PAD_FL_MUST_CONNECT
+
+media_v2_topology {
+	topology_version	int64	(out)
+	num_entities		len[ptr_entities, int32]
+	reserved1		const[0, int32]
+	ptr_entities		ptr64[out, array[media_v2_entity]]
+	num_interfaces		len[ptr_interfaces, int32]
+	reserved2		const[0, int32]
+	ptr_interfaces		ptr64[out, array[media_v2_interface]]
+	num_pads		len[ptr_pads, int32]
+	reserved3		const[0, int32]
+	ptr_pads		ptr64[out, array[media_v2_pad]]
+	num_links		len[ptr_links, int32]
+	reserved4		const[0, int32]
+	ptr_links		ptr64[out, array[media_v2_link]]
+} [packed]
+
+media_v2_entity {
+	id		media_entity_id
+	name		array[int8, 64]
+	function	int32
+	flags		int32
+	reserved	array[int32, 5]
+} [packed]
+
+media_v2_interface {
+	id		int32
+	intf_type	int32
+	flags		int32
+	reserved	array[int32, 9]
+	raw		array[int32, 16]
+} [packed]
+
+media_v2_pad {
+	id		int32
+	entity_id	media_entity_id
+	flags		int32
+# The v1 pad indexes are int16, so we use int16 as resource base,
+# but v2 pad indexes are int32, so we need the pad.
+	index		media_pad_index
+	index_pad	const[0, int16]
+	reserved	array[int32, 4]
+} [packed]
+
+media_v2_link {
+	id		int32
+	source_id	int32
+	sink_id		int32
+	flags		int32
+	reserved	array[int32, 6]
+} [packed]
diff --git a/sys/linux/dev_media.txt.const b/sys/linux/dev_media.txt.const
new file mode 100644
index 000000000..4ea0e793c
--- /dev/null
+++ b/sys/linux/dev_media.txt.const
@@ -0,0 +1,22 @@
+# Code generated by syz-sysgen. DO NOT EDIT.
+arches = 386, amd64, arm, arm64, mips64le, ppc64le, riscv64, s390x
+MEDIA_DEVICE_INFO_SIZE = 256
+MEDIA_ENTITY_DESC_SIZE = 256
+MEDIA_ENT_ID_FLAG_NEXT = 2147483648
+MEDIA_IOC_DEVICE_INFO = 3238034432
+MEDIA_IOC_ENUM_ENTITIES = 3238034433
+MEDIA_IOC_ENUM_LINKS = 3223878658, 386:arm:3223092226
+MEDIA_IOC_G_TOPOLOGY = 3225975812
+MEDIA_IOC_REQUEST_ALLOC = 2147777541, mips64le:ppc64le:1074035717
+MEDIA_IOC_SETUP_LINK = 3224665091
+MEDIA_LNK_FL_DATA_LINK = 0
+MEDIA_LNK_FL_DYNAMIC = 4
+MEDIA_LNK_FL_ENABLED = 1
+MEDIA_LNK_FL_IMMUTABLE = 2
+MEDIA_LNK_FL_INTERFACE_LINK = 268435456
+MEDIA_PAD_FL_MUST_CONNECT = 4
+MEDIA_PAD_FL_SINK = 1
+MEDIA_PAD_FL_SOURCE = 2
+MEDIA_REQUEST_IOC_QUEUE = 31872, mips64le:ppc64le:536902784
+MEDIA_REQUEST_IOC_REINIT = 31873, mips64le:ppc64le:536902785
+__NR_ioctl = 54, amd64:16, arm64:riscv64:29, mips64le:5015
diff --git a/sys/linux/dev_video4linux.txt b/sys/linux/dev_video4linux.txt
index e0c49e035..fb9b75b7d 100644
--- a/sys/linux/dev_video4linux.txt
+++ b/sys/linux/dev_video4linux.txt
@@ -17,10 +17,7 @@ include <uapi/linux/v4l2-controls.h>
 include <uapi/linux/media.h>
 
 resource fd_video[fd]
-resource fd_dmabuf[fd]
 resource fd_v4l2_buffer[fd]
-resource fd_media[fd]
-resource fd_request[fd]
 
 syz_open_dev$video(dev ptr[in, string["/dev/video#"]], id intptr, flags flags[open_flags]) fd_video
 syz_open_dev$video4linux(dev ptr[in, string["/dev/v4l-subdev#"]], id intptr, flags flags[open_flags]) fd_video
@@ -50,6 +47,9 @@ ioctl$VIDIOC_ENUM_FMT(fd fd_video, cmd const[VIDIOC_ENUM_FMT], arg ptr[inout, v4
 ioctl$VIDIOC_G_FMT(fd fd_video, cmd const[VIDIOC_G_FMT], arg ptr[inout, v4l2_format[v4l2_buf_type]])
 ioctl$VIDIOC_S_FMT(fd fd_video, cmd const[VIDIOC_S_FMT], arg ptr[inout, v4l2_format[v4l2_buf_type]])
 ioctl$VIDIOC_REQBUFS(fd fd_video, cmd const[VIDIOC_REQBUFS], arg ptr[inout, v4l2_requestbuffers[v4l2_buf_type]])
+# This variant serves as fd_v4l2_buffer constructor.
+# Potentially more ioctl can create fd_v4l2_buffer, but the kernel code is hard to understand.
+ioctl$VIDIOC_QUERYBUF_DMABUF(fd fd_video, cmd const[VIDIOC_QUERYBUF], arg ptr[inout, v4l2_buffer_t[v4l2_buf_type, V4L2_MEMORY_DMABUF, fd_v4l2_buffer]])
 ioctl$VIDIOC_QUERYBUF(fd fd_video, cmd const[VIDIOC_QUERYBUF], arg ptr[inout, v4l2_buffer[v4l2_buf_type]])
 ioctl$VIDIOC_G_FBUF(fd fd_video, cmd const[VIDIOC_G_FBUF], arg ptr[inout, v4l2_framebuffer])
 ioctl$VIDIOC_S_FBUF(fd fd_video, cmd const[VIDIOC_S_FBUF], arg ptr[in, v4l2_framebuffer])
@@ -146,8 +146,10 @@ ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(fd fd_video, cmd const[VIDIOC_SUBDEV_ENUM_DV
 ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(fd fd_video, cmd const[VIDIOC_SUBDEV_QUERY_DV_TIMINGS], arg ptr[out, v4l2_dv_timings])
 ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(fd fd_video, cmd const[VIDIOC_SUBDEV_DV_TIMINGS_CAP], arg ptr[inout, v4l2_dv_timings_cap])
 
-ioctl$MEDIA_IOC_REQUEST_ALLOC(fd fd_media, cmd const[MEDIA_IOC_REQUEST_ALLOC], arg ptr[out, fd_request])
-ioctl$MEDIA_REQUEST_IOC_QUEUE(fd fd_request, cmd const[MEDIA_REQUEST_IOC_QUEUE], arg const[0])
+# Generally we don't specify close on resources,
+# but fd_v4l2_buffer is not used as input anywhere else (why is it needed?).
+# So this is added to prevent compilation errors.
+close$fd_v4l2_buffer(fd fd_v4l2_buffer)
 
 v4l2_capability {
 	driver		array[int8, 16]
@@ -273,9 +275,19 @@ type v4l2_requestbuffers[BUF_TYPE] {
 	reserved	const[0, int32]
 }
 
-# TODO: The field directions needs to be defined. Recursively, v4l2_buffer_union,
-# v4l2_plane, v4l2_plane_union needs checking.
-type v4l2_buffer[BUF_TYPE] {
+type v4l2_buffer[BUF_TYPE] [
+	mmap			v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_MMAP, intptr]
+	userptr			v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_USERPTR, ptr[out, int8]]
+	overlay			v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_OVERLAY, int32]
+	fd			v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_DMABUF, fd_v4l2_buffer[opt]]
+	multiplanar_mmap	v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_MMAP, ptr[inout, array[v4l2_plane[intptr], 2]]]
+	multiplanar_userptr	v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_USERPTR, array[v4l2_plane[ptr[out, int8]], 2]]
+	multiplanar_overlay	v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_OVERLAY, array[v4l2_plane[int32], 2]]
+	multiplanar_fd		v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_DMABUF, array[v4l2_plane[fd_v4l2_buffer[opt]], 2]]
+]
+
+# TODO: The field directions needs to be defined. Recursively v4l2_plane, v4l2_plane_union needs checking.
+type v4l2_buffer_t[BUF_TYPE, MEM_TYPE, ARG_TYPE] {
 	index		int32
 	type		flags[BUF_TYPE, int32]
 	bytesused	len[type, int32]
@@ -284,20 +296,13 @@ type v4l2_buffer[BUF_TYPE] {
 	timestamp	timeval
 	timecode	v4l2_timecode
 	sequence	int32
-	memory		flags[v4l2_memory, int32]
-	m		v4l2_buffer_union
+	memory		const[MEM_TYPE, int32]
+	m		alignptr[ARG_TYPE]	(out)
 	length		int32
 	reserved2	const[0, int32]
 	request_fd	fd_request[opt]
 }
 
-v4l2_buffer_union [
-	offset	int32
-	userptr	intptr
-	planes	ptr[inout, v4l2_plane]
-	fd	fd_v4l2_buffer[opt]
-]
-
 v4l2_timecode {
 	type		flags[v4l2_timecode_type, int32]
 	flags		flags[v4l2_timecode_flags, int32]
@@ -308,20 +313,14 @@ v4l2_timecode {
 	userbits	array[int8, 4]
 }
 
-v4l2_plane {
+type v4l2_plane[ARG_TYPE] {
 	bytesused	int32
 	length		int32
-	m		v4l2_plane_union
+	m		alignptr[ARG_TYPE]
 	data_offset	int32
 	reserved	array[const[0, int32], 11]
 }
 
-v4l2_plane_union [
-	mem_offset	int32
-	userptr		intptr
-	fd		fd_v4l2_buffer[opt]
-]
-
 v4l2_framebuffer {
 	capability	flags[v4l2_framebuffer_capability, int32]
 	flags		flags[v4l2_framebuffer_flags, int32]
@@ -345,9 +344,7 @@ type v4l2_exportbuffer[BUF_TYPE] {
 	index		int32
 	plane		int32
 	flags		flags[pipe_flags, int32]
-# TODO: This should've been out, look into the problem. Otherwise, the resource is
-# never used.
-	fd		fd_dmabuf[opt]
+	fd		fd_dma_buf	(out)
 	reserved	array[const[0, int32], 11]
 }
 
@@ -503,7 +500,7 @@ v4l2_ext_controls {
 	ctrl_class	flags[v4l2_ext_ctrl_class, int32]
 	count		int32
 	error_idx	int32
-	request_fd	fd[opt]	(in)
+	request_fd	fd_request[opt]	(in)
 	reserved	const[0, int32]
 	controls	ptr[inout, v4l2_ext_control]
 }
diff --git a/sys/linux/sys.txt b/sys/linux/sys.txt
index 70ecc63c5..fd934f976 100644
--- a/sys/linux/sys.txt
+++ b/sys/linux/sys.txt
@@ -610,7 +610,6 @@ openat$vcsu(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsu"]], flags flags[o
 syz_open_dev$vcsu(dev ptr[in, string["/dev/vcsu#"]], id intptr, flags flags[open_flags]) fd
 syz_open_dev$ircomm(dev ptr[in, string["/dev/ircomm#"]], id intptr, flags flags[open_flags]) fd
 syz_open_dev$audion(dev ptr[in, string["/dev/audio#"]], id intptr, flags flags[open_flags]) fd
-syz_open_dev$media(dev ptr[in, string["/dev/media#"]], id intptr, flags flags[open_flags]) fd_media
 
 openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
 openat$zero(fd const[AT_FDCWD], file ptr[in, string["/dev/zero"]], flags flags[open_flags], mode const[0]) fd