1# Copyright 2015 syzkaller project authors. All rights reserved. 2# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. 3 4include <drm/drm.h> 5include <drm/drm_mode.h> 6include <linux/agp_backend.h> 7 8resource fd_dri[fd] 9resource drmctx[int32] 10resource drm_agp_handle[intptr] 11resource drm_gem_handle[int32] 12resource drm_gem_name[int32] 13 14syz_open_dev$dri(dev ptr[in, string["/dev/dri/card#"]], id intptr, flags flags[open_flags]) fd_dri 15syz_open_dev$dricontrol(dev ptr[in, string["/dev/dri/controlD#"]], id intptr, flags flags[open_flags]) fd_dri 16syz_open_dev$drirender(dev ptr[in, string["/dev/dri/renderD#"]], id intptr, flags flags[open_flags]) fd_dri 17 18ioctl$DRM_IOCTL_VERSION(fd fd_dri, cmd const[DRM_IOCTL_VERSION], arg ptr[in, drm_version]) 19ioctl$DRM_IOCTL_GET_UNIQUE(fd fd_dri, cmd const[DRM_IOCTL_GET_UNIQUE], arg ptr[in, drm_unique_out]) 20ioctl$DRM_IOCTL_GET_MAGIC(fd fd_dri, cmd const[DRM_IOCTL_GET_MAGIC], arg ptr[in, int32]) 21ioctl$DRM_IOCTL_IRQ_BUSID(fd fd_dri, cmd const[DRM_IOCTL_IRQ_BUSID], arg ptr[in, drm_irq_busid]) 22ioctl$DRM_IOCTL_GET_MAP(fd fd_dri, cmd const[DRM_IOCTL_GET_MAP], arg ptr[in, drm_map]) 23ioctl$DRM_IOCTL_GET_CLIENT(fd fd_dri, cmd const[DRM_IOCTL_GET_CLIENT], arg ptr[in, drm_client]) 24ioctl$DRM_IOCTL_GET_STATS(fd fd_dri, cmd const[DRM_IOCTL_GET_STATS], arg buffer[out]) 25ioctl$DRM_IOCTL_GET_CAP(fd fd_dri, cmd const[DRM_IOCTL_GET_CAP], arg ptr[in, drm_get_cap]) 26ioctl$DRM_IOCTL_SET_CLIENT_CAP(fd fd_dri, cmd const[DRM_IOCTL_SET_CLIENT_CAP], arg ptr[in, drm_get_cap]) 27ioctl$DRM_IOCTL_SET_VERSION(fd fd_dri, cmd const[DRM_IOCTL_SET_VERSION], arg ptr[in, drm_set_version]) 28ioctl$DRM_IOCTL_SET_UNIQUE(fd fd_dri, cmd const[DRM_IOCTL_SET_UNIQUE], arg ptr[in, drm_unique_in]) 29ioctl$DRM_IOCTL_AUTH_MAGIC(fd fd_dri, cmd const[DRM_IOCTL_AUTH_MAGIC], arg ptr[in, int32]) 30ioctl$DRM_IOCTL_ADD_MAP(fd fd_dri, cmd const[DRM_IOCTL_ADD_MAP], arg ptr[in, drm_map]) 31ioctl$DRM_IOCTL_RM_MAP(fd fd_dri, cmd const[DRM_IOCTL_RM_MAP], arg ptr[in, drm_map]) 32ioctl$DRM_IOCTL_SET_SAREA_CTX(fd fd_dri, cmd const[DRM_IOCTL_SET_SAREA_CTX], arg ptr[in, drm_ctx_priv_map]) 33ioctl$DRM_IOCTL_GET_SAREA_CTX(fd fd_dri, cmd const[DRM_IOCTL_GET_SAREA_CTX], arg ptr[in, drm_ctx_priv_map]) 34ioctl$DRM_IOCTL_SET_MASTER(fd fd_dri, cmd const[DRM_IOCTL_SET_MASTER]) 35ioctl$DRM_IOCTL_DROP_MASTER(fd fd_dri, cmd const[DRM_IOCTL_DROP_MASTER]) 36ioctl$DRM_IOCTL_ADD_CTX(fd fd_dri, cmd const[DRM_IOCTL_ADD_CTX], arg ptr[out, drm_ctx]) 37ioctl$DRM_IOCTL_RM_CTX(fd fd_dri, cmd const[DRM_IOCTL_RM_CTX], arg ptr[in, drm_ctx]) 38ioctl$DRM_IOCTL_GET_CTX(fd fd_dri, cmd const[DRM_IOCTL_GET_CTX], arg ptr[in, drm_ctx]) 39ioctl$DRM_IOCTL_SWITCH_CTX(fd fd_dri, cmd const[DRM_IOCTL_SWITCH_CTX], arg ptr[in, drm_ctx]) 40ioctl$DRM_IOCTL_NEW_CTX(fd fd_dri, cmd const[DRM_IOCTL_NEW_CTX], arg ptr[in, drm_ctx]) 41ioctl$DRM_IOCTL_RES_CTX(fd fd_dri, cmd const[DRM_IOCTL_RES_CTX], arg ptr[in, drm_ctx_res]) 42ioctl$DRM_IOCTL_LOCK(fd fd_dri, cmd const[DRM_IOCTL_LOCK], arg ptr[in, drm_lock]) 43ioctl$DRM_IOCTL_UNLOCK(fd fd_dri, cmd const[DRM_IOCTL_UNLOCK], arg ptr[in, drm_lock]) 44ioctl$DRM_IOCTL_ADD_BUFS(fd fd_dri, cmd const[DRM_IOCTL_ADD_BUFS], arg ptr[in, drm_buf_desc]) 45ioctl$DRM_IOCTL_MARK_BUFS(fd fd_dri, cmd const[DRM_IOCTL_MARK_BUFS], arg ptr[in, drm_buf_desc]) 46ioctl$DRM_IOCTL_INFO_BUFS(fd fd_dri, cmd const[DRM_IOCTL_INFO_BUFS], arg ptr[in, drm_buf_desc]) 47ioctl$DRM_IOCTL_MAP_BUFS(fd fd_dri, cmd const[DRM_IOCTL_MAP_BUFS], arg ptr[in, drm_buf_map]) 48ioctl$DRM_IOCTL_FREE_BUFS(fd fd_dri, cmd const[DRM_IOCTL_FREE_BUFS], arg ptr[in, drm_buf_free]) 49ioctl$DRM_IOCTL_DMA(fd fd_dri, cmd const[DRM_IOCTL_DMA], arg ptr[in, drm_dma]) 50ioctl$DRM_IOCTL_CONTROL(fd fd_dri, cmd const[DRM_IOCTL_CONTROL], arg ptr[in, drm_control]) 51ioctl$DRM_IOCTL_AGP_ACQUIRE(fd fd_dri, cmd const[DRM_IOCTL_AGP_ACQUIRE]) 52ioctl$DRM_IOCTL_AGP_RELEASE(fd fd_dri, cmd const[DRM_IOCTL_AGP_RELEASE]) 53ioctl$DRM_IOCTL_AGP_ENABLE(fd fd_dri, cmd const[DRM_IOCTL_AGP_ENABLE], arg ptr[in, int32]) 54ioctl$DRM_IOCTL_AGP_INFO(fd fd_dri, cmd const[DRM_IOCTL_AGP_INFO], arg buffer[out]) 55ioctl$DRM_IOCTL_AGP_ALLOC(fd fd_dri, cmd const[DRM_IOCTL_AGP_ALLOC], arg ptr[inout, drm_agp_buffer]) 56ioctl$DRM_IOCTL_AGP_FREE(fd fd_dri, cmd const[DRM_IOCTL_AGP_FREE], arg ptr[in, drm_agp_buffer]) 57ioctl$DRM_IOCTL_AGP_BIND(fd fd_dri, cmd const[DRM_IOCTL_AGP_BIND], arg ptr[in, drm_agp_binding]) 58ioctl$DRM_IOCTL_AGP_UNBIND(fd fd_dri, cmd const[DRM_IOCTL_AGP_UNBIND], arg ptr[in, drm_agp_binding]) 59ioctl$DRM_IOCTL_SG_ALLOC(fd fd_dri, cmd const[DRM_IOCTL_SG_ALLOC], arg ptr[in, drm_scatter_gather]) 60ioctl$DRM_IOCTL_SG_FREE(fd fd_dri, cmd const[DRM_IOCTL_SG_FREE], arg ptr[in, drm_scatter_gather]) 61ioctl$DRM_IOCTL_WAIT_VBLANK(fd fd_dri, cmd const[DRM_IOCTL_WAIT_VBLANK], arg ptr[in, drm_wait_vblank]) 62ioctl$DRM_IOCTL_MODESET_CTL(fd fd_dri, cmd const[DRM_IOCTL_MODESET_CTL], arg ptr[in, drm_modeset_ctl]) 63ioctl$DRM_IOCTL_GEM_OPEN(fd fd_dri, cmd const[DRM_IOCTL_GEM_OPEN], arg ptr[inout, drm_gem_open]) 64ioctl$DRM_IOCTL_GEM_CLOSE(fd fd_dri, cmd const[DRM_IOCTL_GEM_CLOSE], arg ptr[in, drm_gem_close]) 65ioctl$DRM_IOCTL_GEM_FLINK(fd fd_dri, cmd const[DRM_IOCTL_GEM_FLINK], arg ptr[inout, drm_gem_flink]) 66ioctl$DRM_IOCTL_MODE_GETRESOURCES(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETRESOURCES], arg ptr[in, drm_mode_card_res]) 67ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(fd fd_dri, cmd const[DRM_IOCTL_PRIME_HANDLE_TO_FD], arg ptr[inout, drm_prime_handle]) 68ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(fd fd_dri, cmd const[DRM_IOCTL_PRIME_FD_TO_HANDLE], arg ptr[inout, drm_prime_handle]) 69ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETPLANERESOURCES], arg ptr[in, drm_mode_get_plane_res]) 70ioctl$DRM_IOCTL_MODE_GETCRTC(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETCRTC], arg ptr[in, drm_mode_crtc]) 71ioctl$DRM_IOCTL_MODE_SETCRTC(fd fd_dri, cmd const[DRM_IOCTL_MODE_SETCRTC], arg ptr[in, drm_mode_crtc]) 72 73#ioctl$DRM_IOCTL_MODE_GETPLANE(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETPLANE], arg ptr[in, drm_mode_get_plane]) 74#ioctl$DRM_IOCTL_MODE_SETPLANE(fd fd_dri, cmd const[DRM_IOCTL_MODE_SETPLANE], arg ptr[in, drm_mode_set_plane]) 75#ioctl$DRM_IOCTL_MODE_CURSOR(fd fd_dri, cmd const[DRM_IOCTL_MODE_CURSOR], arg ptr[in, drm_mode_cursor]) 76#ioctl$DRM_IOCTL_MODE_GETGAMMA(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETGAMMA], arg ptr[in, drm_mode_crtc_lut]) 77#ioctl$DRM_IOCTL_MODE_SETGAMMA(fd fd_dri, cmd const[DRM_IOCTL_MODE_SETGAMMA], arg ptr[in, drm_mode_crtc_lut]) 78#ioctl$DRM_IOCTL_MODE_GETENCODER(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETENCODER], arg ptr[in, drm_mode_get_encoder]) 79#ioctl$DRM_IOCTL_MODE_GETCONNECTOR(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETCONNECTOR], arg ptr[in, drm_mode_get_connector]) 80#ioctl$DRM_IOCTL_MODE_GETPROPERTY(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETPROPERTY], arg ptr[in, drm_mode_get_property]) 81#ioctl$DRM_IOCTL_MODE_SETPROPERTY(fd fd_dri, cmd const[DRM_IOCTL_MODE_SETPROPERTY], arg ptr[in, drm_mode_connector_set_property]) 82#ioctl$DRM_IOCTL_MODE_GETPROPBLOB(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETPROPBLOB], arg ptr[in, drm_mode_get_blob]) 83#ioctl$DRM_IOCTL_MODE_GETFB(fd fd_dri, cmd const[DRM_IOCTL_MODE_GETFB], arg ptr[in, drm_mode_fb_cmd]) 84#ioctl$DRM_IOCTL_MODE_ADDFB(fd fd_dri, cmd const[DRM_IOCTL_MODE_ADDFB], arg ptr[in, drm_mode_fb_cmd]) 85#ioctl$DRM_IOCTL_MODE_ADDFB2(fd fd_dri, cmd const[DRM_IOCTL_MODE_ADDFB2], arg ptr[in, drm_mode_fb_cmd2]) 86#ioctl$DRM_IOCTL_MODE_RMFB(fd fd_dri, cmd const[DRM_IOCTL_MODE_RMFB], arg ptr[in, int32]) 87#ioctl$DRM_IOCTL_MODE_PAGE_FLIP(fd fd_dri, cmd const[DRM_IOCTL_MODE_PAGE_FLIP], arg ptr[in, drm_mode_crtc_page_flip]) 88#ioctl$DRM_IOCTL_MODE_DIRTYFB(fd fd_dri, cmd const[DRM_IOCTL_MODE_DIRTYFB], arg ptr[in, drm_mode_fb_dirty_cmd]) 89#ioctl$DRM_IOCTL_MODE_CREATE_DUMB(fd fd_dri, cmd const[DRM_IOCTL_MODE_CREATE_DUMB], arg ptr[in, drm_mode_create_dumb]) 90#ioctl$DRM_IOCTL_MODE_MAP_DUMB(fd fd_dri, cmd const[DRM_IOCTL_MODE_MAP_DUMB], arg ptr[in, drm_mode_map_dumb]) 91#ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(fd fd_dri, cmd const[DRM_IOCTL_MODE_DESTROY_DUMB], arg ptr[in, drm_mode_destroy_dumb]) 92#ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(fd fd_dri, cmd const[DRM_IOCTL_MODE_OBJ_GETPROPERTIES], arg ptr[in, drm_mode_obj_get_properties]) 93#ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(fd fd_dri, cmd const[DRM_IOCTL_MODE_OBJ_SETPROPERTY], arg ptr[in, drm_mode_obj_set_property]) 94#ioctl$DRM_IOCTL_MODE_CURSOR2(fd fd_dri, cmd const[DRM_IOCTL_MODE_CURSOR2], arg ptr[in, drm_mode_cursor2]) 95#ioctl$DRM_IOCTL_MODE_ATOMIC(fd fd_dri, cmd const[DRM_IOCTL_MODE_ATOMIC], arg ptr[in, drm_mode_atomic]) 96#ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(fd fd_dri, cmd const[DRM_IOCTL_MODE_CREATEPROPBLOB], arg ptr[in, drm_mode_create_blob]) 97#ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(fd fd_dri, cmd const[DRM_IOCTL_MODE_DESTROYPROPBLOB], arg ptr[in, drm_mode_destroy_blob]) 98 99drm_version { 100 maj int32 101 min int32 102 patch int32 103 namelen len[name, intptr] 104 name buffer[out] 105 datelen len[date, intptr] 106 date buffer[out] 107 desclen len[desc, intptr] 108 desc buffer[out] 109} 110 111drm_unique_in { 112 len len[uni, intptr] 113 uni buffer[in] 114} 115 116drm_unique_out { 117 len len[uni, intptr] 118 uni buffer[out] 119} 120 121drm_irq_busid { 122 irq int32 123 bus int32 124 dev int32 125 func int32 126} 127 128drm_map { 129 off vma[opt] 130 size intptr 131 type flags[drm_map_type, int32] 132 flags flags[drm_map_flags, int32] 133 handle vma 134 mtrr int32 135} 136 137drm_client { 138 idx int32 139 auth int32 140 pid pid 141# pid is declared is long 142 pid_pad int32 143 uid uid 144# uid is declared is long 145 uid_pad int32 146 magic intptr 147 iocs intptr 148} 149 150drm_get_cap { 151 cap int64 152 val int64 153} 154 155drm_set_version { 156 di_maj int32 157 di_min int32 158 dd_maj int32 159 dd_min int32 160} 161 162drm_ctx_priv_map { 163 ctxid drmctx 164 handle buffer[out] 165} 166 167drm_ctx { 168 handle drmctx 169 flags flags[drm_ctx_flags, int32] 170} 171 172drm_ctx_res { 173 count len[context, int32] 174 context ptr[out, array[drm_ctx]] 175} 176 177drm_lock { 178 context drmctx 179 flags flags[drm_lock_flags, int32] 180} 181 182drm_buf_desc { 183 count int32 184 size int32 185 lomark int32 186 himark int32 187 flags flags[drm_buf_flags, int32] 188# TODO: what is agp addresses? should it be a special type? 189 agpaddr intptr 190} 191 192drm_buf_map { 193 count len[list, int32] 194 virtual buffer[out] 195 list ptr[in, array[drm_buf_pub]] 196} 197 198drm_buf_pub { 199 idx int32 200 total len[addr, int32] 201 used int32 202 addr buffer[out] 203} 204 205drm_buf_free { 206 count len[list, int32] 207 list ptr[in, array[int32]] 208} 209 210drm_dma { 211 context drmctx 212 sendcnt len[sendind, int32] 213 sendind ptr[in, array[int32]] 214 sendsiz ptr[in, array[int32]] 215 flags flags[drm_dma_flags, int32] 216 reqcnd len[reqind, int32] 217 reqsiz0 int32 218 reqind ptr[in, array[int32]] 219 reqsiz ptr[in, array[int32]] 220 granted const[0, int32] 221} 222 223drm_control { 224 func flags[drm_control_type, int32] 225 irq int32 226} 227 228drm_agp_buffer { 229 size intptr 230 handle drm_agp_handle[opt] 231 type flags[drm_agp_mem_type, intptr] 232 physic intptr 233} 234 235drm_agp_binding { 236 handle drm_agp_handle 237 offset intptr 238} 239 240drm_scatter_gather { 241 size intptr 242 handle drm_agp_handle 243} 244 245drm_wait_vblank { 246 type flags[drm_vblank_seq_type, int32] 247 seq int32 248 signal signalno 249} 250 251drm_modeset_ctl { 252 crtc int32 253 cmd int32 254} 255 256drm_gem_open { 257# input: 258 name drm_gem_name[opt] 259# output: 260 handle drm_gem_handle[opt] 261 size int64 262} 263 264drm_gem_close { 265 handle drm_gem_handle 266 pad const[0, int32] 267} 268 269drm_gem_flink { 270 handle drm_gem_handle[opt] 271 name drm_gem_name[opt] 272} 273 274drm_mode_card_res { 275 fbid ptr[out, array[int32]] 276 crtcid ptr[out, array[int32]] 277 connid ptr[out, array[int32]] 278 encid ptr[out, array[int32]] 279 nfbid len[fbid, int32] 280 ncrtcid len[crtcid, int32] 281 nconnid len[connid, int32] 282 nencid len[encid, int32] 283 maxw const[0, int32] 284 maxh const[0, int32] 285 minw const[0, int32] 286 minh const[0, int32] 287} 288 289drm_prime_handle { 290 handle drm_gem_handle 291 flags flags[dup_flags, int32] 292 fd fd_dri 293} 294 295drm_mode_get_plane_res { 296 ids ptr[out, array[int32]] 297 cnt len[ids, int32] 298} 299 300drm_mode_crtc { 301 connect ptr[in, array[int32]] 302 cnt len[connect, int32] 303 crtcid int32 304 x int32 305 y int32 306 gamma int32 307 valid int32 308 mode drm_mode_modeinfo 309} 310 311drm_mode_modeinfo { 312 clock int32 313 hdisp int16 314 hsyncs int16 315 hsynce int16 316 htotal int16 317 hskew int16 318 vdisp int16 319 vsyncs int16 320 vsynce int16 321 vtotal int16 322 vscan int16 323 vrefr int16 324 flag int32 325 type int32 326 name array[int8, DRM_DISPLAY_MODE_LEN] 327} 328 329drm_agp_mem_type = 0, 1, 2, AGP_USER_MEMORY, AGP_USER_CACHED_MEMORY 330drm_map_type = _DRM_FRAME_BUFFER, _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, _DRM_SCATTER_GATHER, _DRM_CONSISTENT 331drm_map_flags = _DRM_RESTRICTED, _DRM_READ_ONLY, _DRM_LOCKED, _DRM_KERNEL, _DRM_WRITE_COMBINING, _DRM_CONTAINS_LOCK, _DRM_REMOVABLE, _DRM_DRIVER 332drm_ctx_flags = _DRM_CONTEXT_PRESERVED, _DRM_CONTEXT_2DONLY 333drm_lock_flags = _DRM_LOCK_READY, _DRM_LOCK_QUIESCENT, _DRM_LOCK_FLUSH, _DRM_LOCK_FLUSH_ALL, _DRM_HALT_ALL_QUEUES, _DRM_HALT_CUR_QUEUES 334drm_buf_flags = _DRM_PAGE_ALIGN, _DRM_AGP_BUFFER, _DRM_SG_BUFFER, _DRM_FB_BUFFER, _DRM_PCI_BUFFER_RO 335drm_dma_flags = _DRM_DMA_BLOCK, _DRM_DMA_WHILE_LOCKED, _DRM_DMA_PRIORITY, _DRM_DMA_WAIT, _DRM_DMA_SMALLER_OK, _DRM_DMA_LARGER_OK 336drm_control_type = DRM_ADD_COMMAND, DRM_RM_COMMAND, DRM_INST_HANDLER, DRM_UNINST_HANDLER 337drm_vblank_seq_type = _DRM_VBLANK_ABSOLUTE, _DRM_VBLANK_RELATIVE, _DRM_VBLANK_HIGH_CRTC_MASK, _DRM_VBLANK_EVENT, _DRM_VBLANK_FLIP, _DRM_VBLANK_NEXTONMISS, _DRM_VBLANK_SECONDARY, _DRM_VBLANK_SIGNAL 338