# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <asm/ioctls.h>
include <linux/stat.h>
include <uapi/linux/fuse.h>

resource fd_fuse[fd]

syz_fuse_mount(target ptr[in, filename], mode flags[fuse_mode], uid uid, gid gid, maxread intptr, flags flags[mount_flags]) fd_fuse
syz_fuseblk_mount(target ptr[in, filename], blkdev ptr[in, filename], mode flags[fuse_mode], uid uid, gid gid, maxread intptr, blksize intptr, flags flags[mount_flags]) fd_fuse
ioctl$FUSE_DEV_IOC_CLONE(fd fd_fuse, cmd const[FUSE_DEV_IOC_CLONE], arg ptr[in, fd_fuse])
write$fuse(fd fd_fuse, arg ptr[in, fuse_out], len bytesize[arg])

# 1 stands for default_permissions, 2 - allow_other
fuse_mode = 1, 2, S_IFREG, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK, S_IFLNK, S_IFDIR

fuse_out {
	len	len[parent, int32]
	err	int32[0:1]
	unique	int64[0:10]
	data	fuse_reply
}

fuse_reply [
	random				array[int8]
	fuse_init_out			fuse_init_out
	fuse_bmap_out			fuse_bmap_out
	fuse_ioctl_out			fuse_ioctl_out
	fuse_poll_out			fuse_poll_out
	fuse_notify_poll_wakeup_out	fuse_notify_poll_wakeup_out
	fuse_notify_inval_inode_out	fuse_notify_inval_inode_out
	fuse_notify_inval_entry_out	fuse_notify_inval_entry_out
	fuse_notify_delete_out		fuse_notify_delete_out
	fuse_notify_store_out		fuse_notify_store_out
	fuse_notify_retrieve_out	fuse_notify_retrieve_out
] [varlen]

fuse_init_out {
	maj	const[FUSE_KERNEL_VERSION, int32]
	min	const[FUSE_KERNEL_MINOR_VERSION, int32]
	readah	int32
	flags	int32
	backg	int16
	congest	int16
	maxwr	int32
	timegr	int32
	unused0	array[const[0, int32], 9]
}

fuse_bmap_out {
	block	int64
}

fuse_ioctl_out {
	res	int32
	flags	int32
	iniovs	int32
	outiovs	int32
}

fuse_poll_out {
	revents	int32
}

fuse_notify_poll_wakeup_out {
	kh	int16
}

fuse_notify_inval_inode_out {
	ino	int64
	off	int64
	len2	int16
}

fuse_notify_inval_entry_out {
	par	int64
	namelen	int32
}

fuse_notify_delete_out {
	par	int64
	child	int64
	namelen	int32
}

fuse_notify_store_out {
	nodeid	int64
	off	int64
	size	int32
}

fuse_notify_retrieve_out {
	unique2	int64[0:10]
	nodeid	int64
	off	int64
	size	int32
}