sys/linux/dev_ion.txt

# Copyright 2017 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <asm/ioctl.h>
include <uapi/linux/fcntl.h>
include <uapi/linux/dma-buf.h>
include <drivers/staging/android/uapi/ion.h>

resource fd_ion[fd]
resource fd_dma_buf[fd]

openat$ion(fd const[AT_FDCWD], file ptr[in, string["/dev/ion"]], flags flags[open_flags], mode const[0]) fd_ion

ioctl$ION_IOC_ALLOC(fd fd_ion, cmd const[ION_IOC_ALLOC], arg ptr[inout, ion_allocation_data])
ioctl$ION_IOC_HEAP_QUERY(fd fd_ion, cmd const[ION_IOC_HEAP_QUERY], arg ptr[inout, ion_heap_query])

ioctl$DMA_BUF_IOCTL_SYNC(fd fd_dma_buf, cmd const[DMA_BUF_IOCTL_SYNC], arg ptr[in, flags[dma_buf_sync_flags, int64]])

ion_allocation_data {
	len		int64
	heap_id_mask	flags[ion_heap_mask, int32]
	flags		flags[ion_alloc_flags, int32]
	fd		fd_dma_buf[opt]
	unused		const[0, int32]
}

ion_heap_query {
	cnt		len[heaps, int32]
	reserved0	const[0, int32]
	heaps		ptr64[out, ion_heap_data]
	reserved1	const[0, int32]
	reserved2	const[0, int32]
}

ion_heap_data {
	name		string["name", MAX_HEAP_NAME]
	type		int32
	heap_id		int32
	reserved0	int32
	reserved1	int32
	reserved2	int32
}

ion_alloc_flags = ION_FLAG_CACHED
ion_heap_mask = ION_HEAP_TYPE_SYSTEM_BIT, ION_HEAP_TYPE_SYSTEM_CONTIG_BIT, ION_HEAP_TYPE_CARVEOUT_BIT, ION_HEAP_TYPE_CHUNK_BIT, ION_HEAP_TYPE_DMA_BIT, ION_HEAP_TYPE_CUSTOM_BIT
dma_buf_sync_flags = DMA_BUF_SYNC_READ, DMA_BUF_SYNC_WRITE, DMA_BUF_SYNC_END

define ION_HEAP_TYPE_SYSTEM_BIT	1 << ION_HEAP_TYPE_SYSTEM
define ION_HEAP_TYPE_SYSTEM_CONTIG_BIT	1 << ION_HEAP_TYPE_SYSTEM_CONTIG
define ION_HEAP_TYPE_CARVEOUT_BIT	1 << ION_HEAP_TYPE_CARVEOUT
define ION_HEAP_TYPE_CHUNK_BIT	1 << ION_HEAP_TYPE_CHUNK
define ION_HEAP_TYPE_DMA_BIT	1 << ION_HEAP_TYPE_DMA
define ION_HEAP_TYPE_CUSTOM_BIT	1 << ION_HEAP_TYPE_CUSTOM