# Copyright 2017 syzkaller project authors. All rights reserved. # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. include <asm/ioctl.h> include <uapi/linux/fcntl.h> include <uapi/linux/dma-buf.h> include <drivers/staging/android/uapi/ion.h> resource fd_ion[fd] resource fd_dma_buf[fd] openat$ion(fd const[AT_FDCWD], file ptr[in, string["/dev/ion"]], flags flags[open_flags], mode const[0]) fd_ion ioctl$ION_IOC_ALLOC(fd fd_ion, cmd const[ION_IOC_ALLOC], arg ptr[inout, ion_allocation_data]) ioctl$ION_IOC_HEAP_QUERY(fd fd_ion, cmd const[ION_IOC_HEAP_QUERY], arg ptr[inout, ion_heap_query]) ioctl$DMA_BUF_IOCTL_SYNC(fd fd_dma_buf, cmd const[DMA_BUF_IOCTL_SYNC], arg ptr[in, flags[dma_buf_sync_flags, int64]]) ion_allocation_data { len int64 heap_id_mask flags[ion_heap_mask, int32] flags flags[ion_alloc_flags, int32] fd fd_dma_buf[opt] unused const[0, int32] } ion_heap_query { cnt len[heaps, int32] reserved0 const[0, int32] heaps ptr64[out, ion_heap_data] reserved1 const[0, int32] reserved2 const[0, int32] } ion_heap_data { name string["name", MAX_HEAP_NAME] type int32 heap_id int32 reserved0 int32 reserved1 int32 reserved2 int32 } ion_alloc_flags = ION_FLAG_CACHED ion_heap_mask = ION_HEAP_TYPE_SYSTEM_BIT, ION_HEAP_TYPE_SYSTEM_CONTIG_BIT, ION_HEAP_TYPE_CARVEOUT_BIT, ION_HEAP_TYPE_CHUNK_BIT, ION_HEAP_TYPE_DMA_BIT, ION_HEAP_TYPE_CUSTOM_BIT dma_buf_sync_flags = DMA_BUF_SYNC_READ, DMA_BUF_SYNC_WRITE, DMA_BUF_SYNC_END define ION_HEAP_TYPE_SYSTEM_BIT 1 << ION_HEAP_TYPE_SYSTEM define ION_HEAP_TYPE_SYSTEM_CONTIG_BIT 1 << ION_HEAP_TYPE_SYSTEM_CONTIG define ION_HEAP_TYPE_CARVEOUT_BIT 1 << ION_HEAP_TYPE_CARVEOUT define ION_HEAP_TYPE_CHUNK_BIT 1 << ION_HEAP_TYPE_CHUNK define ION_HEAP_TYPE_DMA_BIT 1 << ION_HEAP_TYPE_DMA define ION_HEAP_TYPE_CUSTOM_BIT 1 << ION_HEAP_TYPE_CUSTOM