Extended camera

msm_sdm1_camera.txt

include <linux/ioctl.h>
include <../include/uapi/media/msmb_ispif.h>
include <../include/uapi/media/msmb_pproc.h>

resource fd_sdmvideo1[fd]

syz_open_dev$sdmvideo1(dev ptr[in, string["/dev/video#"]], id intptr, flags flags[open_flags]) fd_sdmvideo1
syz_open_dev$sdmv4lsubdev(dev ptr[in, string["/dev/v4l-subdev#"]], id intptr, flags flags[open_flags]) fd_sdmvideo1
syz_open_dev$sdmmedia(dev ptr[in, string["/dev/media#"]], id intptr, flags flags[open_flags]) fd_sdmvideo1
syz_open_dev$sdmjpeg(dev ptr[in, string["/dev/jpeg#"]], id intptr, flags flags[open_flags]) fd_sdmvideo1

ioctl$VIDIOC_MSM_ISPIF_CFG(fd fd_sdmvideo1, cmd const[VIDIOC_MSM_ISPIF_CFG], arg ptr[inout, msmb_ispif_cfg_data])
ioctl$VIDIOC_MSM_ISPIF_CFG_EXT(fd fd_sdmvideo1, cmd const[VIDIOC_MSM_ISPIF_CFG_EXT], arg ptr[inout, ispif_cfg_data_ext])
ioctl$VIDIOC_MSM_CPP_CFG(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_CFG], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_GET_EVENTPAYLOAD(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_GET_EVENTPAYLOAD], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_GET_INST_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_GET_INST_INFO], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_LOAD_FIRMWARE(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_LOAD_FIRMWARE], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_GET_HW_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_GET_HW_INFO], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_FLUSH_QUEUE(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_FLUSH_QUEUE], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_VPE_CFG(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_VPE_CFG], arg ptr[inout, msmb_vpe_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_VPE_TRANSACTION_SETUP(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_VPE_TRANSACTION_SETUP], arg ptr[inout, msmb_vpe_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_VPE_GET_EVENTPAYLOAD(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_VPE_GET_EVENTPAYLOAD], arg ptr[inout, msmb_vpe_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_VPE_GET_INST_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_VPE_GET_INST_INFO], arg ptr[inout, msmb_vpe_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_VPE_ENQUEUE_STREAM_BUFF_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_VPE_ENQUEUE_STREAM_BUFF_INFO], arg ptr[inout, msmb_vpe_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO], arg ptr[inout, msmb_vpe_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_QUEUE_BUF(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_QUEUE_BUF], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_APPEND_STREAM_BUFF_INFO(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_APPEND_STREAM_BUFF_INFO], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_SET_CLOCK(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_SET_CLOCK], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_POP_STREAM_BUFFER(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_POP_STREAM_BUFFER], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_IOMMU_ATTACH(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_IOMMU_ATTACH], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_IOMMU_DETACH(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_IOMMU_DETACH], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])
ioctl$VIDIOC_MSM_CPP_DELETE_STREAM_BUFF(fd fd_sdmvideo0, cmd const[VIDIOC_MSM_CPP_DELETE_STREAM_BUFF], arg ptr[inout, msmb_cpp_camera_v4l2_ioctl_t])

msmb_ispif_cfg_data {
    cfg_type flags[msmb_ispif_cfg_type_t, int32]
    cfg msmb_ispif_union
}

msmb_ispif_union [
    reg_dump int32
    csid_version int32
    vfe_info msm_ispif_vfe_info
    params msm_ispif_param_data
]

msm_ispif_vfe_info {
    num_isps int32
    info array[msm_isp_info, 2]
}

msm_isp_info {
    max_resolution int32
    id int32
    ver int32
}

msm_ispif_param_data {
    num int32
    entries array[msm_ispif_params_entry, MAX_PARAM_ENTRIES]
}

msm_ispif_params_entry {
    vfe_intf flags[msm_ispif_vfe_intf, int32]
    intftype flags[msm_ispif_intftype, int32]
    num_cids int32
    cids array[flags[msm_ispif_cid, int32], 3]
    csid flags[msm_ispif_csid, int32]
    crop_enable int32
    crop_start_pixel int16
    crop_end_pixel int16
}

ispif_cfg_data_ext {
    cfg_type flags[msmb_ispif_cfg_type_t, int32]
    data buffer[inout]
    size int32
}


msmb_cpp_camera_v4l2_ioctl_t {
    id int32
    len int64
    trans_code int64
    ioctl_ptr ptr[inout, msm_cpp_frame_info_t]
}

msmb_vpe_camera_v4l2_ioctl_t {
    id int32
    len int64
    trans_code int64
    ioctl_ptr ptr[inout, msm_vpe_frame_info_t]
}

msm_cpp_frame_info_t {
    frame_id int32
    timestamp timeval
    inst_id int32
    identity int32
    client_id int32
    frame_type flags[msm_cpp_frame_type, int32]
    num_strips int32
    msg_len int32
    cpp_cmd_msg buffer[inout]
    src_fd int32
    dst_fd int32
    in_time timeval
    out_time timeval
#Cross check the cookie and statu ptr
    cookie ptr[inout, int32]
    status ptr[inout, int32]
    duplicate_output buffer[inout]
    duplicate_identity int32
    feature_mask int32
    we_disable int8
    input_buffer_info msm_cpp_buffer_info_t
    output_buffer_info array[msm_cpp_buffer_info_t, 8]
    duplicate_buffer_info msm_cpp_buffer_info_t
    tnr_scratch_buffer_info array[msm_cpp_buffer_info_t, 2]
    reserved const[0, int32]
    partial_frame_indicator int8
    first_payload int8
    last_payload int8
    first_stripe_index int32
    last_stripe_index int32
    stripe_info_offset int32
    stripe_info int32
    batch_info msm_cpp_batch_info_t
}

msm_cpp_buffer_info_t {
    fd int32
    index int32
    offset int32
    native_buff int8
    processed_divert int8
    identity int32
}

msm_cpp_batch_info_t {
    batch_mode flags[msm_cpp_batch_mode_t, int32]
    batch_size int32
    intra_plane_offset array[int32, 8]
    pick_preview_idx int32
    cont_idx int32
}


msm_vpe_frame_info_t {
    frame_id int32
    timestamp timeval
    inst_id int32
    identity int32
    client_id int32
    frame_type flags[msm_vpe_frame_type, int32]
    strip_info msm_vpe_frame_strip_info
    src_fd int32
    dst_fd int32
    src_ion_handle ptr[inout, ion_handle]
    dest_ion_handle ptr[inout, ion_handle]
    src_phyaddr int32
    dest_phyaddr int32
    src_chroma_plane_offset int32
    dest_chroma_plane_offset int32
    in_time timeval
    out_time timeval
#Cross check cookie
    cookie ptr[inout, int32]
    input_buffer_info msm_vpe_buffer_info_t
    output_buffer_info msm_vpe_buffer_info_t
}

msm_vpe_frame_strip_info {
    src_w int32
    src_h int32
    dst_w int32
    dst_h int32
    src_x int32
    src_y int32
    phase_step_x int32
    phase_step_y int32
    phase_init_x int32
    phase_init_y int32
}

msm_vpe_buffer_info_t {
    fd int32
    index int32
    offset int32
    native_buff int8
    processed_divert int8
}

define MAX_PARAM_ENTRIES (INTF_MAX * 2)
define ISPIF_INIT2 2
define ISPIF_RELEASE2 8

msmb_ispif_cfg_type_t = ISPIF_CLK_ENABLE, ISPIF_CLK_DISABLE, ISPIF_INIT2, ISPIF_CFG, ISPIF_START_FRAME_BOUNDARY, ISPIF_RESTART_FRAME_BOUNDARY, ISPIF_STOP_FRAME_BOUNDARY, ISPIF_STOP_IMMEDIATELY, ISPIF_RELEASE2, ISPIF_ENABLE_REG_DUMP, ISPIF_SET_VFE_INFO, ISPIF_CFG2, ISPIF_CFG_STEREO
msm_ispif_vfe_intf = VFE0, VFE1, VFE_MAX
msm_ispif_intftype = PIX0, RDI0, PIX1, RDI1, RDI2, INTF_MAX
msm_ispif_cid = CID0, CID1, CID2, CID3, CID4, CID5, CID6, CID7, CID8, CID9, CID10, CID11, CID12, CID13, CID14, CID15, CID_MAX
msm_ispif_csid = CSID0, CSID1, CSID2, CSID3, CSID_MAX
msm_cpp_frame_type = MSM_CPP_OFFLINE_FRAME, MSM_CPP_REALTIME_FRAME
msm_vpe_frame_type = MSM_VPE_OFFLINE_FRAME, MSM_VPE_REALTIME_FRAME