diff options
Diffstat (limited to 'sys/linux/dev_camx.txt')
| -rw-r--r-- | sys/linux/dev_camx.txt | 184 |
1 files changed, 184 insertions, 0 deletions
diff --git a/sys/linux/dev_camx.txt b/sys/linux/dev_camx.txt new file mode 100644 index 000000000..5c8125f32 --- /dev/null +++ b/sys/linux/dev_camx.txt @@ -0,0 +1,184 @@ +# Copyright 2023 syzkaller project authors. All rights reserved. +# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. + +# The source file of camx ioctl can be found in ChromeOS source tree: +# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/refs/heads/chromeos-5.15/drivers/media/platform/camx/ + +# Not upstream, generated on: +# https://chromium.googlesource.com/chromiumos/third_party/kernel cdff88937190 +# with -includedirs drivers/media/platform/camx/include/uapi +meta noextract + +include <media/cam_req_mgr.h> + +resource fd_camx[fd] +resource session_handle[int32] +resource link_handle[int32] +resource alloc_fd[fd] + +openat$camx(fd const[AT_FDCWD], file ptr[in, string["/dev/v4l/by-path/platform-soc@0:qcom_cam-req-mgr-video-index0"]], flags const[O_RDWR], mode const[0]) fd_camx + +# no code handles commented out op_code + +# ioctl$CAM_REQ_MGR_CREATE_DEV_NODES(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CREATE_DEV_NODES]) +ioctl$CAM_REQ_MGR_CREATE_SESSION(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CREATE_SESSION]) +ioctl$CAM_REQ_MGR_DESTROY_SESSION(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_DESTROY_SESSION]) +ioctl$CAM_REQ_MGR_LINK(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK]) +ioctl$CAM_REQ_MGR_UNLINK(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_UNLINK]) +ioctl$CAM_REQ_MGR_SCHED_REQ(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_SCHED_REQ]) +ioctl$CAM_REQ_MGR_FLUSH_REQ(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_FLUSH_REQ]) +ioctl$CAM_REQ_MGR_SYNC_MODE(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_SYNC_MODE]) +ioctl$CAM_REQ_MGR_ALLOC_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_ALLOC_BUF]) +ioctl$CAM_REQ_MGR_MAP_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_MAP_BUF]) +ioctl$CAM_REQ_MGR_RELEASE_BUF(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_RELEASE_BUF]) +# ioctl$CAM_REQ_MGR_CACHE_OPS(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_CACHE_OPS]) +ioctl$CAM_REQ_MGR_LINK_CONTROL(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK_CONTROL]) +ioctl$CAM_REQ_MGR_LINK_V2(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_LINK_V2]) +ioctl$CAM_REQ_MGR_REQUEST_DUMP(fd fd_camx, cmd const[VIDIOC_CAM_CONTROL], arg ptr[inout, cam_control$CAM_REQ_MGR_REQUEST_DUMP]) + +type cam_control[OPCODE, HANDLE] { + op_code const[OPCODE, int32] + size bytesize[handle, int32] + handle_type const[CAM_HANDLE_USER_POINTER, int32] + reserved const[0, int32] + handle ptr[in, HANDLE] +} + +type cam_control$CAM_REQ_MGR_CREATE_SESSION cam_control[CAM_REQ_MGR_CREATE_SESSION, cam_req_mgr_session_info__for_create] +type cam_control$CAM_REQ_MGR_DESTROY_SESSION cam_control[CAM_REQ_MGR_DESTROY_SESSION, cam_req_mgr_session_info__for_destroy] +type cam_control$CAM_REQ_MGR_LINK cam_control[CAM_REQ_MGR_LINK, cam_req_mgr_ver_info] +type cam_control$CAM_REQ_MGR_UNLINK cam_control[CAM_REQ_MGR_UNLINK, cam_req_mgr_unlink_info] +type cam_control$CAM_REQ_MGR_SCHED_REQ cam_control[CAM_REQ_MGR_SCHED_REQ, cam_req_mgr_sched_request] +type cam_control$CAM_REQ_MGR_FLUSH_REQ cam_control[CAM_REQ_MGR_FLUSH_REQ, cam_req_mgr_flush_info] +type cam_control$CAM_REQ_MGR_SYNC_MODE cam_control[CAM_REQ_MGR_SYNC_MODE, cam_req_mgr_sync_mode] +type cam_control$CAM_REQ_MGR_ALLOC_BUF cam_control[CAM_REQ_MGR_ALLOC_BUF, cam_mem_mgr_alloc_cmd] +type cam_control$CAM_REQ_MGR_MAP_BUF cam_control[CAM_REQ_MGR_MAP_BUF, cam_mem_mgr_map_cmd] +type cam_control$CAM_REQ_MGR_RELEASE_BUF cam_control[CAM_REQ_MGR_RELEASE_BUF, cam_mem_mgr_release_cmd] +type cam_control$CAM_REQ_MGR_LINK_CONTROL cam_control[CAM_REQ_MGR_LINK_CONTROL, cam_req_mgr_link_control] +type cam_control$CAM_REQ_MGR_LINK_V2 cam_control[CAM_REQ_MGR_LINK_V2, cam_req_mgr_ver_info] +type cam_control$CAM_REQ_MGR_REQUEST_DUMP cam_control[CAM_REQ_MGR_REQUEST_DUMP, cam_dump_req_cmd] + +# originally cam_req_mgr_session_info +cam_req_mgr_session_info__for_create { + session_hdl session_handle (out) + reserved const[0, int32] +} + +# originally cam_req_mgr_session_info +cam_req_mgr_session_info__for_destroy { + session_hdl session_handle + reserved const[0, int32] +} + +cam_req_mgr_ver_info { + version int32 (out) + u cam_req_mgr_ver_info_union +} + +cam_req_mgr_ver_info_union { + link_info_v1 cam_req_mgr_link_info + link_info_v2 cam_req_mgr_link_info_v2 +} + +cam_req_mgr_link_info { + session_hdl session_handle + num_devices len[dev_hdls, int32] + dev_hdls array[int32, CAM_REQ_MGR_MAX_HANDLES] + link_hdl link_handle (out) +} + +cam_req_mgr_link_info_v2 { + session_hdl session_handle + num_devices len[dev_hdls, int32] + dev_hdls array[int32, CAM_REQ_MGR_MAX_HANDLES_V2] + link_hdl link_handle (out) +} + +cam_req_mgr_unlink_info { + session_hdl session_handle + link_hdl link_handle +} + +cam_req_mgr_sched_request { + session_hdl session_handle + link_hdl link_handle + bubble_enable int32 + sync_mode flags[sync_mode_flags, int32] + req_id int64 +} + +cam_req_mgr_flush_info { + session_hdl session_handle + link_hdl link_handle + flush_type flags[flush_type_flags, int32] + reserved const[0, int32] + req_id int64 +} + +cam_req_mgr_sync_mode { + session_hdl session_handle + sync_mode flags[sync_mode_flags, int32] + num_links len[link_hdls, int32] + link_hdls array[link_handle, MAX_LINKS_PER_SESSION] + master_link_hdl link_handle + reserved const[0, int32] +} + +cam_mem_mgr_alloc_cmd { + len int64 + align int64 + mmu_hdls array[int32, CAM_MEM_MMU_MAX_HANDLE] + num_hdl len[mmu_hdls, int32] + flags flags[mem_flags, int32] + out cam_mem_alloc_out_params (out) +} + +cam_mem_alloc_out_params { + buf_handle int32 + fd alloc_fd + vaddr int64 +} + +cam_mem_mgr_map_cmd { + mmu_hdls array[int32, CAM_MEM_MMU_MAX_HANDLE] + num_hdl len[mmu_hdls, int32] + flags flags[mem_flags, int32] + fd alloc_fd + reserved const[0, int32] + out cam_mem_map_out_params (out) +} + +cam_mem_map_out_params { + buf_handle int32 + reserved const[0, int32] + vaddr int64 +} + +cam_mem_mgr_release_cmd { + buf_handle int32 + reserved const[0, int32] +} + +cam_req_mgr_link_control { + ops flags[link_control_operation_flags, int32] + session_hdl session_handle + num_links len[link_hdls, int32] + reserved const[0, int32] + link_hdls array[link_handle, MAX_LINKS_PER_SESSION] +} + +cam_dump_req_cmd { + issue_req_id int64 + session_handle session_handle + link_hdl int32 + dev_handle int32 + error_type int32 + buf_handle int32 + offset int32 (out) + reserved const[0, int32] +} + +flush_type_flags = CAM_REQ_MGR_FLUSH_TYPE_ALL, CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ, CAM_REQ_MGR_FLUSH_TYPE_MAX +sync_mode_flags = CAM_REQ_MGR_SYNC_MODE_NO_SYNC, CAM_REQ_MGR_SYNC_MODE_SYNC +link_control_operation_flags = CAM_REQ_MGR_LINK_ACTIVATE, CAM_REQ_MGR_LINK_DEACTIVATE +mem_flags = CAM_MEM_FLAG_HW_READ_WRITE, CAM_MEM_FLAG_HW_READ_ONLY, CAM_MEM_FLAG_HW_WRITE_ONLY, CAM_MEM_FLAG_KMD_ACCESS, CAM_MEM_FLAG_UMD_ACCESS, CAM_MEM_FLAG_PROTECTED_MODE, CAM_MEM_FLAG_CMD_BUF_TYPE, CAM_MEM_FLAG_PIXEL_BUF_TYPE, CAM_MEM_FLAG_STATS_BUF_TYPE, CAM_MEM_FLAG_PACKET_BUF_TYPE, CAM_MEM_FLAG_CACHE, CAM_MEM_HW_SHARED_ACCESS, CAM_MEM_FLAG_CDSP_OUTPUT |