# Copyright 2021 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# See https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/drm/msm_drm.h for upstream definitions

include <drm/msm_drm.h>
include <linux/fcntl.h>

resource fd_msm[fd]
resource msm_submitqueue_id[int32]
resource msm_fence_id[int32]

openat$msm(fd const[AT_FDCWD], file ptr[in, string["/dev/msm"]], flags flags[open_flags], mode const[0]) fd_msm

ioctl$DRM_IOCTL_MSM_GET_PARAM(fd fd_msm, cmd const[DRM_IOCTL_MSM_GET_PARAM], arg ptr[inout, drm_msm_param$DRM_IOCTL_MSM_GET_PARAM])
ioctl$DRM_IOCTL_MSM_GEM_NEW(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_NEW], arg ptr[inout, drm_msm_gem_new])
ioctl$DRM_IOCTL_MSM_GEM_INFO(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_INFO], arg ptr[inout, drm_msm_gem_info])
ioctl$DRM_IOCTL_MSM_GEM_CPU_PREP(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_CPU_PREP], arg ptr[in, drm_msm_gem_cpu_prep])
ioctl$DRM_IOCTL_MSM_GEM_CPU_FINI(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_CPU_FINI], arg ptr[in, drm_msm_gem_cpu_fini])
ioctl$DRM_IOCTL_MSM_GEM_SUBMIT(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_SUBMIT], arg ptr[inout, drm_msm_gem_submit])
ioctl$DRM_IOCTL_MSM_WAIT_FENCE(fd fd_msm, cmd const[DRM_IOCTL_MSM_WAIT_FENCE], arg ptr[in, drm_msm_wait_fence])
ioctl$DRM_IOCTL_MSM_GEM_MADVISE(fd fd_msm, cmd const[DRM_IOCTL_MSM_GEM_MADVISE], arg ptr[inout, drm_msm_gem_madvise])
ioctl$DRM_IOCTL_MSM_SUBMITQUEUE_NEW(fd fd_msm, cmd const[DRM_IOCTL_MSM_SUBMITQUEUE_NEW], arg ptr[inout, drm_msm_submitqueue])
ioctl$DRM_IOCTL_MSM_SUBMITQUEUE_CLOSE(fd fd_msm, cmd const[DRM_IOCTL_MSM_SUBMITQUEUE_CLOSE], arg ptr[in, msm_submitqueue_id])
ioctl$DRM_IOCTL_MSM_SUBMITQUEUE_QUERY(fd fd_msm, cmd const[DRM_IOCTL_MSM_SUBMITQUEUE_QUERY], arg ptr[inout, drm_msm_submitqueue_query])
ioctl$DRM_IOCTL_MSM_SET_PARAM(fd fd_msm, cmd const[DRM_IOCTL_MSM_SET_PARAM], arg ptr[in, drm_msm_param$DRM_IOCTL_MSM_SET_PARAM])

mmap$DRM_MSM(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd_msm, offset fileoff)
_ = __NR_mmap2

drm_msm_gem_new {
	size	int64
	flags	flags[msm_gem_new_flags, int32]
	handle	drm_gem_handle	(out)
}

drm_msm_gem_info {
	handle	drm_gem_handle
	info	flags[msm_gem_info_flags, int32]
	value	int64
	len	len[value, int32]
	pad	const[0, int32]
}

drm_msm_param$DRM_IOCTL_MSM_GET_PARAM {
	pipe	flags[msm_pipe_flags, int32]
	param	flags[msm_param_flags, int32]
	value	int64
}

drm_msm_param$DRM_IOCTL_MSM_SET_PARAM {
	pipe	flags[msm_pipe_flags, int32]
	param	flags[msm_param_set_flags, int32]
	vallen	drm_msm_param_set_union
	pad	const[0, int32]
}

drm_msm_param_set_union [
	imm	drm_msm_param_set_imm
	ptr	drm_msm_param_set_ptr
]

drm_msm_param_set_imm {
	value	int64
	len	const[0, int32]
}

drm_msm_param_set_ptr {
	value	ptr64[in, array[int8]]
	len	len[value, int32]
}

drm_msm_timespec {
	tv_sec	int64
	tv_nsec	int64
}

drm_msm_gem_cpu_prep {
	handle	drm_gem_handle
	op	flags[msm_gem_cpu_prep_flags, int32]
	timeout	drm_msm_timespec	(in)
}

drm_msm_gem_cpu_fini {
	handle	drm_gem_handle
}

drm_msm_gem_submit_reloc {
	submit_offset	int32
	or		int32
	shift		int32
	reloc_idx	int32
	reloc_offset	int64
}

drm_msm_gem_submit_cmd {
	type		flags[msm_gem_submit_cmd_flags, int32]
	submit_idx	int32
	submit_offset	int32
	size		int32[0:0x7fffffff, 4]
	pad		const[0, int32]
	nr_relocs	len[relocs, int32]
	relocs		ptr64[in, array[drm_msm_gem_submit_reloc]]
}

drm_msm_gem_submit_bo {
	flags		flags[msm_gem_submit_bo_flags, int32]
	handle		drm_gem_handle
	presumed	int64
}

drm_msm_gem_submit_syncobj {
	handle	drm_syncobj
	flags	flags[msm_gem_submit_syncobj_flags, int32]
	point	int64
}

drm_msm_gem_submit {
	flags		flags[msm_gem_submit_flags, int32]
	fence		msm_fence_id	(out)
	nr_bos		len[bos, int32]
	nr_cmds		len[cmds, int32]
	bos		ptr64[in, array[drm_msm_gem_submit_bo]]
	cmds		ptr64[in, array[drm_msm_gem_submit_cmd]]
	fence_fd	fd_sync_file[opt]
	queueid		msm_submitqueue_id
	in_syncobjs	ptr64[in, array[drm_msm_gem_submit_syncobj]]
	out_syncobjs	ptr64[in, array[drm_msm_gem_submit_syncobj]]
	nr_in_syncobjs	len[in_syncobjs, int32]
	nr_out_syncobjs	len[out_syncobjs, int32]
	syncobj_stride	int32
	pad		const[0, int32]
}

drm_msm_wait_fence {
	fence	msm_fence_id
	flags	flags[msm_wait_fence_flags, int32]
	timeout	drm_msm_timespec
	queueid	msm_submitqueue_id
}

drm_msm_gem_madvise {
	handle		drm_gem_handle
	madv		flags[msm_gem_madvise_flags, int32]
	retained	int32
}

drm_msm_submitqueue {
	flags	flags[msm_submitqueue_flags, int32]
	prio	int32[0:3]
	id	msm_submitqueue_id	(out)
}

drm_msm_submitqueue_query {
	data	ptr64[out, int8]
	id	msm_submitqueue_id	(in)
	param	flags[msm_submitqueue_query_flags, int32]	(in)
	len	len[data, int32]
	pad	const[0, int32]
}

msm_gem_new_flags = MSM_BO_SCANOUT, MSM_BO_GPU_READONLY, MSM_BO_CACHE_MASK, MSM_BO_CACHED, MSM_BO_WC, MSM_BO_UNCACHED
msm_gem_info_flags = MSM_INFO_GET_OFFSET, MSM_INFO_GET_IOVA, MSM_INFO_SET_NAME, MSM_INFO_GET_NAME, MSM_INFO_SET_IOVA
msm_param_flags = MSM_PARAM_GPU_ID, MSM_PARAM_GMEM_SIZE, MSM_PARAM_CHIP_ID, MSM_PARAM_MAX_FREQ, MSM_PARAM_TIMESTAMP, MSM_PARAM_GMEM_BASE, MSM_PARAM_NR_RINGS, MSM_PARAM_PP_PGTABLE, MSM_PARAM_FAULTS, MSM_PARAM_PRIORITIES, MSM_PARAM_SUSPENDS, MSM_PARAM_VA_START, MSM_PARAM_VA_SIZE
msm_param_set_flags = MSM_PARAM_SYSPROF, MSM_PARAM_COMM, MSM_PARAM_CMDLINE
msm_gem_cpu_prep_flags = MSM_PREP_READ, MSM_PREP_WRITE, MSM_PREP_NOSYNC, MSM_PREP_BOOST
msm_pipe_flags = MSM_PIPE_NONE, MSM_PIPE_2D0, MSM_PIPE_2D1, MSM_PIPE_3D0
msm_gem_submit_flags = MSM_PIPE_NONE, MSM_PIPE_2D0, MSM_PIPE_2D1, MSM_PIPE_3D0, MSM_SUBMIT_NO_IMPLICIT, MSM_SUBMIT_FENCE_FD_IN, MSM_SUBMIT_FENCE_FD_OUT, MSM_SUBMIT_SUDO, MSM_SUBMIT_SYNCOBJ_IN, MSM_SUBMIT_SYNCOBJ_OUT, MSM_SUBMIT_FENCE_SN_IN
msm_gem_submit_bo_flags = MSM_SUBMIT_BO_READ, MSM_SUBMIT_BO_WRITE, MSM_SUBMIT_BO_DUMP
msm_gem_submit_syncobj_flags = MSM_SYNCOBJ_RESET
msm_gem_submit_cmd_flags = MSM_SUBMIT_CMD_BUF, MSM_SUBMIT_CMD_IB_TARGET_BUF, MSM_SUBMIT_CMD_CTX_RESTORE_BUF
msm_gem_madvise_flags = MSM_MADV_WILLNEED, MSM_MADV_DONTNEED, __MSM_MADV_PURGED
msm_submitqueue_flags = MSM_SUBMITQUEUE_FLAGS
msm_submitqueue_query_flags = MSM_SUBMITQUEUE_PARAM_FAULTS
msm_wait_fence_flags = MSM_WAIT_FENCE_BOOST
