# Copyright 2021 syzkaller project authors. All rights reserved. # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. # See https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/drm/msm_drm.h for upstream definitions include resource fd_msm[fd] resource msm_submitqueue_id[int32] resource msm_fence_id[int32] openat$msm(fd const[AT_FDCWD], file ptr[in, string["/dev/msm"]], flags flags[open_flags], mode const[0]) fd_msm ioctl$DRM_IOCTL_MSM_GET_PARAM(fd fd_msm, cmd const[DRM_IOCTL_MSM_GET_PARAM], arg ptr[inout, drm_msm_param$DRM_IOCTL_MSM_GET_PARAM]) ioctl$DRM_IOCTL_MSM_GEM_NEW(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_NEW], arg ptr[inout, drm_msm_gem_new]) ioctl$DRM_IOCTL_MSM_GEM_INFO(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_INFO], arg ptr[inout, drm_msm_gem_info]) ioctl$DRM_IOCTL_MSM_GEM_CPU_PREP(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_CPU_PREP], arg ptr[in, drm_msm_gem_cpu_prep]) ioctl$DRM_IOCTL_MSM_GEM_CPU_FINI(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_CPU_FINI], arg ptr[in, drm_msm_gem_cpu_fini]) ioctl$DRM_IOCTL_MSM_GEM_SUBMIT(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_SUBMIT], arg ptr[inout, drm_msm_gem_submit]) ioctl$DRM_IOCTL_MSM_WAIT_FENCE(fd fd_msm, cmd const[DRM_IOCTL_MSM_WAIT_FENCE], arg ptr[in, drm_msm_wait_fence]) ioctl$DRM_IOCTL_MSM_GEM_MADVISE(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_MADVISE], arg ptr[inout, drm_msm_gem_madvise]) ioctl$DRM_IOCTL_MSM_SUBMITQUEUE_NEW(fd fd_msm, cmd const[DRM_IOCTL_MSM_SUBMITQUEUE_NEW], arg ptr[inout, drm_msm_submitqueue]) ioctl$DRM_IOCTL_MSM_SUBMITQUEUE_CLOSE(fd fd_msm, cmd const[DRM_IOCTL_MSM_SUBMITQUEUE_CLOSE], arg ptr[in, msm_submitqueue_id]) ioctl$DRM_IOCTL_MSM_SUBMITQUEUE_QUERY(fd fd_msm, cmd const[DRM_IOCTL_MSM_SUBMITQUEUE_QUERY], arg ptr[inout, drm_msm_submitqueue_query]) ioctl$DRM_IOCTL_MSM_SET_PARAM(fd fd_msm, cmd const[DRM_IOCTL_MSM_SET_PARAM], arg ptr[in, drm_msm_param$DRM_IOCTL_MSM_SET_PARAM]) mmap$DRM_MSM(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd_msm, offset fileoff) _ = __NR_mmap2 drm_msm_gem_new { size int64 flags flags[msm_gem_new_flags, int32] handle drm_gem_handle (out) } drm_msm_gem_info { handle drm_gem_handle info flags[msm_gem_info_flags, int32] value int64 len len[value, int32] pad const[0, int32] } drm_msm_param$DRM_IOCTL_MSM_GET_PARAM { pipe flags[msm_pipe_flags, int32] param flags[msm_param_flags, int32] value int64 } drm_msm_param$DRM_IOCTL_MSM_SET_PARAM { pipe flags[msm_pipe_flags, int32] param flags[msm_param_set_flags, int32] vallen drm_msm_param_set_union pad const[0, int32] } drm_msm_param_set_union [ imm drm_msm_param_set_imm ptr drm_msm_param_set_ptr ] drm_msm_param_set_imm { value int64 len const[0, int32] } drm_msm_param_set_ptr { value ptr64[in, array[int8]] len len[value, int32] } drm_msm_timespec { tv_sec int64 tv_nsec int64 } drm_msm_gem_cpu_prep { handle drm_gem_handle op flags[msm_gem_cpu_prep_flags, int32] timeout drm_msm_timespec (in) } drm_msm_gem_cpu_fini { handle drm_gem_handle } drm_msm_gem_submit_reloc { submit_offset int32 or int32 shift int32 reloc_idx int32 reloc_offset int64 } drm_msm_gem_submit_cmd { type flags[msm_gem_submit_cmd_flags, int32] submit_idx int32 submit_offset int32 size int32[0:0x7fffffff, 4] pad const[0, int32] nr_relocs len[relocs, int32] relocs ptr64[in, array[drm_msm_gem_submit_reloc]] } drm_msm_gem_submit_bo { flags flags[msm_gem_submit_bo_flags, int32] handle drm_gem_handle presumed int64 } drm_msm_gem_submit_syncobj { handle drm_syncobj flags flags[msm_gem_submit_syncobj_flags, int32] point int64 } drm_msm_gem_submit { flags flags[msm_gem_submit_flags, int32] fence msm_fence_id (out) nr_bos len[bos, int32] nr_cmds len[cmds, int32] bos ptr64[in, array[drm_msm_gem_submit_bo]] cmds ptr64[in, array[drm_msm_gem_submit_cmd]] fence_fd fd_sync_file[opt] queueid msm_submitqueue_id in_syncobjs ptr64[in, array[drm_msm_gem_submit_syncobj]] out_syncobjs ptr64[in, array[drm_msm_gem_submit_syncobj]] nr_in_syncobjs len[in_syncobjs, int32] nr_out_syncobjs len[out_syncobjs, int32] syncobj_stride int32 pad const[0, int32] } drm_msm_wait_fence { fence msm_fence_id flags flags[msm_wait_fence_flags, int32] timeout drm_msm_timespec queueid msm_submitqueue_id } drm_msm_gem_madvise { handle drm_gem_handle madv flags[msm_gem_madvise_flags, int32] retained int32 } drm_msm_submitqueue { flags flags[msm_submitqueue_flags, int32] prio int32[0:3] id msm_submitqueue_id (out) } drm_msm_submitqueue_query { data ptr64[out, int8] id msm_submitqueue_id (in) param flags[msm_submitqueue_query_flags, int32] (in) len len[data, int32] pad const[0, int32] } msm_gem_new_flags = MSM_BO_SCANOUT, MSM_BO_GPU_READONLY, MSM_BO_CACHE_MASK, MSM_BO_CACHED, MSM_BO_WC, MSM_BO_UNCACHED msm_gem_info_flags = MSM_INFO_GET_OFFSET, MSM_INFO_GET_IOVA, MSM_INFO_SET_NAME, MSM_INFO_GET_NAME, MSM_INFO_SET_IOVA msm_param_flags = MSM_PARAM_GPU_ID, MSM_PARAM_GMEM_SIZE, MSM_PARAM_CHIP_ID, MSM_PARAM_MAX_FREQ, MSM_PARAM_TIMESTAMP, MSM_PARAM_GMEM_BASE, MSM_PARAM_NR_RINGS, MSM_PARAM_PP_PGTABLE, MSM_PARAM_FAULTS, MSM_PARAM_PRIORITIES, MSM_PARAM_SUSPENDS, MSM_PARAM_VA_START, MSM_PARAM_VA_SIZE msm_param_set_flags = MSM_PARAM_SYSPROF, MSM_PARAM_COMM, MSM_PARAM_CMDLINE msm_gem_cpu_prep_flags = MSM_PREP_READ, MSM_PREP_WRITE, MSM_PREP_NOSYNC, MSM_PREP_BOOST msm_pipe_flags = MSM_PIPE_NONE, MSM_PIPE_2D0, MSM_PIPE_2D1, MSM_PIPE_3D0 msm_gem_submit_flags = MSM_PIPE_NONE, MSM_PIPE_2D0, MSM_PIPE_2D1, MSM_PIPE_3D0, MSM_SUBMIT_NO_IMPLICIT, MSM_SUBMIT_FENCE_FD_IN, MSM_SUBMIT_FENCE_FD_OUT, MSM_SUBMIT_SUDO, MSM_SUBMIT_SYNCOBJ_IN, MSM_SUBMIT_SYNCOBJ_OUT, MSM_SUBMIT_FENCE_SN_IN msm_gem_submit_bo_flags = MSM_SUBMIT_BO_READ, MSM_SUBMIT_BO_WRITE, MSM_SUBMIT_BO_DUMP msm_gem_submit_syncobj_flags = MSM_SUBMIT_SYNCOBJ_RESET msm_gem_submit_cmd_flags = MSM_SUBMIT_CMD_BUF, MSM_SUBMIT_CMD_IB_TARGET_BUF, MSM_SUBMIT_CMD_CTX_RESTORE_BUF msm_gem_madvise_flags = MSM_MADV_WILLNEED, MSM_MADV_DONTNEED, __MSM_MADV_PURGED msm_submitqueue_flags = MSM_SUBMITQUEUE_FLAGS msm_submitqueue_query_flags = MSM_SUBMITQUEUE_PARAM_FAULTS msm_wait_fence_flags = MSM_WAIT_FENCE_BOOST