aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux
diff options
context:
space:
mode:
Diffstat (limited to 'sys/linux')
-rw-r--r--sys/linux/dev_media.txt103
-rw-r--r--sys/linux/dev_media.txt.const22
-rw-r--r--sys/linux/dev_video4linux.txt55
-rw-r--r--sys/linux/sys.txt1
4 files changed, 151 insertions, 30 deletions
diff --git a/sys/linux/dev_media.txt b/sys/linux/dev_media.txt
new file mode 100644
index 000000000..8a3f845c0
--- /dev/null
+++ b/sys/linux/dev_media.txt
@@ -0,0 +1,103 @@
+# Copyright 2022 syzkaller project authors. All rights reserved.
+# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+include <uapi/linux/media.h>
+
+resource fd_media[fd]
+resource fd_request[fd]
+resource media_entity_id[int32]: MEDIA_ENT_ID_FLAG_NEXT
+resource media_pad_index[int16]
+
+syz_open_dev$media(dev ptr[in, string["/dev/media#"]], id intptr, flags flags[open_flags]) fd_media
+
+ioctl$MEDIA_IOC_DEVICE_INFO(fd fd_media, cmd const[MEDIA_IOC_DEVICE_INFO], arg ptr[out, array[int8, MEDIA_DEVICE_INFO_SIZE]])
+ioctl$MEDIA_IOC_ENUM_ENTITIES(fd fd_media, cmd const[MEDIA_IOC_ENUM_ENTITIES], arg ptr[inout, media_entity_desc])
+ioctl$MEDIA_IOC_ENUM_LINKS(fd fd_media, cmd const[MEDIA_IOC_ENUM_LINKS], arg ptr[inout, media_links_enum])
+ioctl$MEDIA_IOC_SETUP_LINK(fd fd_media, cmd const[MEDIA_IOC_SETUP_LINK], arg ptr[in, media_link_desc])
+ioctl$MEDIA_IOC_G_TOPOLOGY(fd fd_media, cmd const[MEDIA_IOC_G_TOPOLOGY], arg ptr[inout, media_v2_topology])
+ioctl$MEDIA_IOC_REQUEST_ALLOC(fd fd_media, cmd const[MEDIA_IOC_REQUEST_ALLOC], arg ptr[out, fd_request])
+
+ioctl$MEDIA_REQUEST_IOC_QUEUE(fd fd_request, cmd const[MEDIA_REQUEST_IOC_QUEUE], arg const[0])
+ioctl$MEDIA_REQUEST_IOC_REINIT(fd fd_request, cmd const[MEDIA_REQUEST_IOC_REINIT], arg const[0])
+
+define MEDIA_DEVICE_INFO_SIZE sizeof(struct media_device_info)
+define MEDIA_ENTITY_DESC_SIZE sizeof(struct media_entity_desc)
+
+media_entity_desc {
+ id media_entity_id (in)
+} [size[MEDIA_ENTITY_DESC_SIZE]]
+
+media_links_enum {
+ entity media_entity_id (in)
+ pads ptr[out, array[media_pad_desc, 2]]
+ links ptr[out, array[media_link_desc, 2]]
+}
+
+media_link_desc {
+ source media_pad_desc
+ sink media_pad_desc
+ flags flags[media_link_flags, int32]
+ reserved array[int32, 2]
+}
+
+media_link_flags = MEDIA_LNK_FL_ENABLED, MEDIA_LNK_FL_IMMUTABLE, MEDIA_LNK_FL_DYNAMIC, MEDIA_LNK_FL_DATA_LINK, MEDIA_LNK_FL_INTERFACE_LINK
+
+media_pad_desc {
+ entity media_entity_id
+ index media_pad_index
+ flags flags[media_pad_flags, int32]
+ reserved array[int32, 2]
+}
+
+media_pad_flags = MEDIA_PAD_FL_SINK, MEDIA_PAD_FL_SOURCE, MEDIA_PAD_FL_MUST_CONNECT
+
+media_v2_topology {
+ topology_version int64 (out)
+ num_entities len[ptr_entities, int32]
+ reserved1 const[0, int32]
+ ptr_entities ptr64[out, array[media_v2_entity]]
+ num_interfaces len[ptr_interfaces, int32]
+ reserved2 const[0, int32]
+ ptr_interfaces ptr64[out, array[media_v2_interface]]
+ num_pads len[ptr_pads, int32]
+ reserved3 const[0, int32]
+ ptr_pads ptr64[out, array[media_v2_pad]]
+ num_links len[ptr_links, int32]
+ reserved4 const[0, int32]
+ ptr_links ptr64[out, array[media_v2_link]]
+} [packed]
+
+media_v2_entity {
+ id media_entity_id
+ name array[int8, 64]
+ function int32
+ flags int32
+ reserved array[int32, 5]
+} [packed]
+
+media_v2_interface {
+ id int32
+ intf_type int32
+ flags int32
+ reserved array[int32, 9]
+ raw array[int32, 16]
+} [packed]
+
+media_v2_pad {
+ id int32
+ entity_id media_entity_id
+ flags int32
+# The v1 pad indexes are int16, so we use int16 as resource base,
+# but v2 pad indexes are int32, so we need the pad.
+ index media_pad_index
+ index_pad const[0, int16]
+ reserved array[int32, 4]
+} [packed]
+
+media_v2_link {
+ id int32
+ source_id int32
+ sink_id int32
+ flags int32
+ reserved array[int32, 6]
+} [packed]
diff --git a/sys/linux/dev_media.txt.const b/sys/linux/dev_media.txt.const
new file mode 100644
index 000000000..4ea0e793c
--- /dev/null
+++ b/sys/linux/dev_media.txt.const
@@ -0,0 +1,22 @@
+# Code generated by syz-sysgen. DO NOT EDIT.
+arches = 386, amd64, arm, arm64, mips64le, ppc64le, riscv64, s390x
+MEDIA_DEVICE_INFO_SIZE = 256
+MEDIA_ENTITY_DESC_SIZE = 256
+MEDIA_ENT_ID_FLAG_NEXT = 2147483648
+MEDIA_IOC_DEVICE_INFO = 3238034432
+MEDIA_IOC_ENUM_ENTITIES = 3238034433
+MEDIA_IOC_ENUM_LINKS = 3223878658, 386:arm:3223092226
+MEDIA_IOC_G_TOPOLOGY = 3225975812
+MEDIA_IOC_REQUEST_ALLOC = 2147777541, mips64le:ppc64le:1074035717
+MEDIA_IOC_SETUP_LINK = 3224665091
+MEDIA_LNK_FL_DATA_LINK = 0
+MEDIA_LNK_FL_DYNAMIC = 4
+MEDIA_LNK_FL_ENABLED = 1
+MEDIA_LNK_FL_IMMUTABLE = 2
+MEDIA_LNK_FL_INTERFACE_LINK = 268435456
+MEDIA_PAD_FL_MUST_CONNECT = 4
+MEDIA_PAD_FL_SINK = 1
+MEDIA_PAD_FL_SOURCE = 2
+MEDIA_REQUEST_IOC_QUEUE = 31872, mips64le:ppc64le:536902784
+MEDIA_REQUEST_IOC_REINIT = 31873, mips64le:ppc64le:536902785
+__NR_ioctl = 54, amd64:16, arm64:riscv64:29, mips64le:5015
diff --git a/sys/linux/dev_video4linux.txt b/sys/linux/dev_video4linux.txt
index e0c49e035..fb9b75b7d 100644
--- a/sys/linux/dev_video4linux.txt
+++ b/sys/linux/dev_video4linux.txt
@@ -17,10 +17,7 @@ include <uapi/linux/v4l2-controls.h>
include <uapi/linux/media.h>
resource fd_video[fd]
-resource fd_dmabuf[fd]
resource fd_v4l2_buffer[fd]
-resource fd_media[fd]
-resource fd_request[fd]
syz_open_dev$video(dev ptr[in, string["/dev/video#"]], id intptr, flags flags[open_flags]) fd_video
syz_open_dev$video4linux(dev ptr[in, string["/dev/v4l-subdev#"]], id intptr, flags flags[open_flags]) fd_video
@@ -50,6 +47,9 @@ ioctl$VIDIOC_ENUM_FMT(fd fd_video, cmd const[VIDIOC_ENUM_FMT], arg ptr[inout, v4
ioctl$VIDIOC_G_FMT(fd fd_video, cmd const[VIDIOC_G_FMT], arg ptr[inout, v4l2_format[v4l2_buf_type]])
ioctl$VIDIOC_S_FMT(fd fd_video, cmd const[VIDIOC_S_FMT], arg ptr[inout, v4l2_format[v4l2_buf_type]])
ioctl$VIDIOC_REQBUFS(fd fd_video, cmd const[VIDIOC_REQBUFS], arg ptr[inout, v4l2_requestbuffers[v4l2_buf_type]])
+# This variant serves as fd_v4l2_buffer constructor.
+# Potentially more ioctl can create fd_v4l2_buffer, but the kernel code is hard to understand.
+ioctl$VIDIOC_QUERYBUF_DMABUF(fd fd_video, cmd const[VIDIOC_QUERYBUF], arg ptr[inout, v4l2_buffer_t[v4l2_buf_type, V4L2_MEMORY_DMABUF, fd_v4l2_buffer]])
ioctl$VIDIOC_QUERYBUF(fd fd_video, cmd const[VIDIOC_QUERYBUF], arg ptr[inout, v4l2_buffer[v4l2_buf_type]])
ioctl$VIDIOC_G_FBUF(fd fd_video, cmd const[VIDIOC_G_FBUF], arg ptr[inout, v4l2_framebuffer])
ioctl$VIDIOC_S_FBUF(fd fd_video, cmd const[VIDIOC_S_FBUF], arg ptr[in, v4l2_framebuffer])
@@ -146,8 +146,10 @@ ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(fd fd_video, cmd const[VIDIOC_SUBDEV_ENUM_DV
ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(fd fd_video, cmd const[VIDIOC_SUBDEV_QUERY_DV_TIMINGS], arg ptr[out, v4l2_dv_timings])
ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(fd fd_video, cmd const[VIDIOC_SUBDEV_DV_TIMINGS_CAP], arg ptr[inout, v4l2_dv_timings_cap])
-ioctl$MEDIA_IOC_REQUEST_ALLOC(fd fd_media, cmd const[MEDIA_IOC_REQUEST_ALLOC], arg ptr[out, fd_request])
-ioctl$MEDIA_REQUEST_IOC_QUEUE(fd fd_request, cmd const[MEDIA_REQUEST_IOC_QUEUE], arg const[0])
+# Generally we don't specify close on resources,
+# but fd_v4l2_buffer is not used as input anywhere else (why is it needed?).
+# So this is added to prevent compilation errors.
+close$fd_v4l2_buffer(fd fd_v4l2_buffer)
v4l2_capability {
driver array[int8, 16]
@@ -273,9 +275,19 @@ type v4l2_requestbuffers[BUF_TYPE] {
reserved const[0, int32]
}
-# TODO: The field directions needs to be defined. Recursively, v4l2_buffer_union,
-# v4l2_plane, v4l2_plane_union needs checking.
-type v4l2_buffer[BUF_TYPE] {
+type v4l2_buffer[BUF_TYPE] [
+ mmap v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_MMAP, intptr]
+ userptr v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_USERPTR, ptr[out, int8]]
+ overlay v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_OVERLAY, int32]
+ fd v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_DMABUF, fd_v4l2_buffer[opt]]
+ multiplanar_mmap v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_MMAP, ptr[inout, array[v4l2_plane[intptr], 2]]]
+ multiplanar_userptr v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_USERPTR, array[v4l2_plane[ptr[out, int8]], 2]]
+ multiplanar_overlay v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_OVERLAY, array[v4l2_plane[int32], 2]]
+ multiplanar_fd v4l2_buffer_t[BUF_TYPE, V4L2_MEMORY_DMABUF, array[v4l2_plane[fd_v4l2_buffer[opt]], 2]]
+]
+
+# TODO: The field directions needs to be defined. Recursively v4l2_plane, v4l2_plane_union needs checking.
+type v4l2_buffer_t[BUF_TYPE, MEM_TYPE, ARG_TYPE] {
index int32
type flags[BUF_TYPE, int32]
bytesused len[type, int32]
@@ -284,20 +296,13 @@ type v4l2_buffer[BUF_TYPE] {
timestamp timeval
timecode v4l2_timecode
sequence int32
- memory flags[v4l2_memory, int32]
- m v4l2_buffer_union
+ memory const[MEM_TYPE, int32]
+ m alignptr[ARG_TYPE] (out)
length int32
reserved2 const[0, int32]
request_fd fd_request[opt]
}
-v4l2_buffer_union [
- offset int32
- userptr intptr
- planes ptr[inout, v4l2_plane]
- fd fd_v4l2_buffer[opt]
-]
-
v4l2_timecode {
type flags[v4l2_timecode_type, int32]
flags flags[v4l2_timecode_flags, int32]
@@ -308,20 +313,14 @@ v4l2_timecode {
userbits array[int8, 4]
}
-v4l2_plane {
+type v4l2_plane[ARG_TYPE] {
bytesused int32
length int32
- m v4l2_plane_union
+ m alignptr[ARG_TYPE]
data_offset int32
reserved array[const[0, int32], 11]
}
-v4l2_plane_union [
- mem_offset int32
- userptr intptr
- fd fd_v4l2_buffer[opt]
-]
-
v4l2_framebuffer {
capability flags[v4l2_framebuffer_capability, int32]
flags flags[v4l2_framebuffer_flags, int32]
@@ -345,9 +344,7 @@ type v4l2_exportbuffer[BUF_TYPE] {
index int32
plane int32
flags flags[pipe_flags, int32]
-# TODO: This should've been out, look into the problem. Otherwise, the resource is
-# never used.
- fd fd_dmabuf[opt]
+ fd fd_dma_buf (out)
reserved array[const[0, int32], 11]
}
@@ -503,7 +500,7 @@ v4l2_ext_controls {
ctrl_class flags[v4l2_ext_ctrl_class, int32]
count int32
error_idx int32
- request_fd fd[opt] (in)
+ request_fd fd_request[opt] (in)
reserved const[0, int32]
controls ptr[inout, v4l2_ext_control]
}
diff --git a/sys/linux/sys.txt b/sys/linux/sys.txt
index 70ecc63c5..fd934f976 100644
--- a/sys/linux/sys.txt
+++ b/sys/linux/sys.txt
@@ -610,7 +610,6 @@ openat$vcsu(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsu"]], flags flags[o
syz_open_dev$vcsu(dev ptr[in, string["/dev/vcsu#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$ircomm(dev ptr[in, string["/dev/ircomm#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$audion(dev ptr[in, string["/dev/audio#"]], id intptr, flags flags[open_flags]) fd
-syz_open_dev$media(dev ptr[in, string["/dev/media#"]], id intptr, flags flags[open_flags]) fd_media
openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
openat$zero(fd const[AT_FDCWD], file ptr[in, string["/dev/zero"]], flags flags[open_flags], mode const[0]) fd
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 00:39:15 +0000