#include <fcntl.h>
#include <stdio.h>
#include <sys/mman.h>
#include <unistd.h>
#include <xf86drm.h>

#define log(fmt, args...) printf("%s():%d " fmt "\n", __func__, __LINE__, ##args)
#define err(fmt, args...) printf("\033[35m%s():%d " fmt "\033[0m\n", __func__, __LINE__, ##args)

static int create_dumb_buffer(int fd, int width, int height){
    int ret = 0;
    struct drm_mode_create_dumb create = {};
    create.width  = width;
    create.height =height;
    create.bpp    = 4*8; // byte per pixel
    ret = drmIoctl(fd, DRM_IOCTL_MODE_CREATE_DUMB, &create);
    if(ret){
        err("ret:%d", ret);
        return 0;
    }    
    return create.handle;
}

static int get_dumb_buffer_offset(int fd, int handle){
    struct drm_mode_map_dumb map = {};  
    map.handle = handle;
    int ret = drmIoctl(fd, DRM_IOCTL_MODE_MAP_DUMB, &map);
    if(ret){
        err("ret:%d", ret);
        return 0;
    }
    return map.offset;
}

static void* mmap_dumb_buffer(int fd, int size, int offset){
    void *addr = NULL;
    addr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, offset);
    if(!addr){
        err("mmap dumb buffer offset:0x%x failed", offset);
        return NULL;
    }
    return addr;
}

static void destroy_dumb_buffer(int fd, int handle){
    struct drm_mode_destroy_dumb destroy = {};
    destroy.handle = handle;
    int ret = drmIoctl(fd, DRM_IOCTL_MODE_DESTROY_DUMB, &destroy);
    if(ret){
        err("DRM_IOCTL_MODE_DESTROY_DUMB failed. ret:%d", ret);
        return;
    }
}

int main(int argc, char **argv){
    int fd;
    int width = 1024;
    int height = 1;
    int size = width*height;
    fd = open("/dev/dri/card0", O_RDWR | O_CLOEXEC);
    if(fd<=0){
        err("open dev failed.");
        return -1;
    }
    int handle = create_dumb_buffer(fd, width, height);
    log("create dumb buffer, get handle:%d", handle);

    int offset = get_dumb_buffer_offset(fd, handle);
    log("get dumb buffer offset:0x%x", offset);

    void *addr = mmap_dumb_buffer(fd, size, offset);
    log("get dumb buffer addr:%p",addr);

    //在addr所指向的buffer上进行绘图
    memset(addr, 0, width*height);

    munmap(addr, size); 

    destroy_dumb_buffer(fd, handle);
    log("destroy dumb buffer");

    getchar();
    close(fd);
    return 0;
}

#include <linux/module.h>
#include <linux/platform_device.h>
#include <drm/drm_drv.h>
#include <drm/drm_file.h>
#include <drm/drm_ioctl.h>

#define DRIVER_NAME "drm dumb driver"
#define DRIVER_DESC "Virtual drm dumb driver"
#define DRIVER_DATE "20191114"
#define DRIVER_MAJOR 1
#define DRIVER_MINOR 0

#define MAX_NUM 10
#define log(fmt, args...) printk("%s():%d " fmt "\n", __func__, __LINE__, ##args)
#define err(fmt, args...) printk("\033[35m%s():%d " fmt "\033[0m\n", __func__, __LINE__, ##args)

struct dumb_device {
    struct drm_device drm;
    struct platform_device *platform_dev;
};

static struct dumb_device* dumb_device = NULL;
static struct page  *pages[MAX_NUM] = {0};
static u32   buffer_size[MAX_NUM] = {0};
static int page_idx = 0;

static int dumb_mmap_impl(struct file* filp, struct vm_area_struct* vma) {
    unsigned long pfn_start = 0;    
    unsigned long size = vma->vm_end - vma->vm_start;
    int ret = 0;
    int idx = 0;
    /*********************************************************************
     * vm_pgoff: 也是vm_are_struct的一个字段
     * 表示偏移量，它是以page size计数的。 pg表示page计数，off表示偏移
     *********************************************************************/
    idx = vma->vm_pgoff;
    pfn_start = page_to_pfn(pages[idx]);

    log("idx:%d phy: 0x%lx, vm_pgoff: 0x%lx, vma->vm_start:0x%lx, size: 0x%lx",
            idx, pfn_start << PAGE_SHIFT, vma->vm_pgoff, vma->vm_start, size);

    ret = remap_pfn_range(vma, vma->vm_start, pfn_start, size, vma->vm_page_prot);
    if (ret)
        err("remap_pfn_range failed at [0x%lx  0x%lx]", vma->vm_start, vma->vm_end);
    else{
        unsigned long virt_start = (unsigned long)page_address(pages[idx]);        
        log("map 0x%lx to 0x%lx, size: 0x%lx",  virt_start, vma->vm_start, size);
    }

    return 0;
}

static const struct file_operations dumb_driver_fops = {
    .owner      = THIS_MODULE,
    .open       = drm_open,
    .release    = drm_release,
    .unlocked_ioctl = drm_ioctl,
    .compat_ioctl = drm_compat_ioctl,    
    .mmap   = dumb_mmap_impl,
};

static void dumb_release(struct drm_device* dev) { log(); }

static int dumb_create_impl(struct drm_file     *file_priv, 
                            struct drm_device   *dev, 
                            struct drm_mode_create_dumb* args) {
    u32 size = 0;
    log();

    if(page_idx>=MAX_NUM){
        err("only support alloc %d buffers", MAX_NUM);
        return -ENOMEM;
    }

    size = roundup((args->width * args->height * args->bpp/8), PAGE_SIZE);

    // 分配页面
    pages[page_idx] = alloc_pages(GFP_KERNEL, get_order(size));
    if (!pages[page_idx]) {
        err("alloc_pages() failed");
        return -ENOMEM;
    }
    buffer_size[page_idx] = size;

    // 赋值返回参数
    args->size    = size;
    args->pitch   = args->width * args->bpp/8;
    args->handle  = page_idx++;

    return 0;
}

static int dumb_map_offset_impl(struct drm_file     *file_priv, 
                                struct drm_device   *dev, 
                                uint32_t handle, uint64_t* offset) {
    log("%d", handle);
    //根据handle得到一个offset，为了简单，这里直接使用handle
    *offset = 0x1000*(u64)handle;
    return 0;
}
static  int dumb_destroy_impl(struct drm_file *file_priv, struct drm_device *dev, uint32_t handle){
    log("handle:%d", handle);

    free_pages((unsigned long)page_address(pages[handle]), get_order(buffer_size[handle]));

    return 0;
}
static struct drm_driver dumb_driver = {    
    .fops            = &dumb_driver_fops,    
    .release         = dumb_release,
    
    .dumb_create     = dumb_create_impl,
    .dumb_map_offset = dumb_map_offset_impl,
    .dumb_destroy    = dumb_destroy_impl,

    .name  = DRIVER_NAME,
    .desc  = DRIVER_DESC,
    .date  = DRIVER_DATE,
    .major = DRIVER_MAJOR,
    .minor = DRIVER_MINOR,
};

static int __init dumb_drv_init(void) {
    int ret;
    struct platform_device* pdev = NULL;

    log("build time: %s %s", __DATE__, __TIME__);

    pdev = platform_device_register_simple(DRIVER_NAME, -1, NULL, 0);
    if (IS_ERR(pdev)) return PTR_ERR(pdev);

    if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) {
        ret = -ENOMEM;
        goto out_unregister;
    }

    // 分配
    dumb_device = devm_drm_dev_alloc(&pdev->dev, &dumb_driver, struct dumb_device, drm);
    if (IS_ERR(dumb_device)) {
        ret = PTR_ERR(dumb_device);
        goto out_devres;
    }

    // 注册
    ret = drm_dev_register(&dumb_device->drm, 0);
    if (ret) goto out_devres;

    dumb_device->platform_dev = pdev;

    log("Finish");
    return 0;

out_devres:
    devres_release_group(&pdev->dev, NULL);

out_unregister:
    platform_device_unregister(pdev);

    return ret;
}

static void __exit dumb_drv_exit(void) {    
    struct platform_device *pdev = dumb_device->platform_dev;
    log();

    drm_dev_unregister(&dumb_device->drm);
    devres_release_group(&pdev->dev, NULL);
    platform_device_unregister(pdev);
    
}

module_init(dumb_drv_init);
module_exit(dumb_drv_exit);

MODULE_AUTHOR("kevin");
MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_LICENSE("GPL");

#include <linux/module.h>
#include <linux/platform_device.h>
#include <drm/drm_gem.h>
#include <drm/drm_drv.h>
#include <drm/drm_file.h>
#include <drm/drm_ioctl.h>

#define DRIVER_NAME "drm dumb gem driver"
#define DRIVER_DESC "Virtual drm dumb driver"
#define DRIVER_DATE "20191116"
#define DRIVER_MAJOR 1
#define DRIVER_MINOR 0

#define log(fmt, args...) printk("%s():%d " fmt "\n", __func__, __LINE__, ##args)
#define err(fmt, args...) printk("\033[35m%s():%d " fmt "\033[0m\n", __func__, __LINE__, ##args)

#define DRM_GEM_OBJECT_TO_DUMB_BUFFER_OBJ(target) \
    container_of(target, struct dumb_buffer_object, gem_obj)

struct dumb_device {
    struct drm_device drm;
    struct platform_device *platform_dev;
};

struct dumb_buffer_object{
    struct drm_gem_object gem_obj;
    struct page  *start_page;
    u32    size;
};

static struct dumb_device* dumb_device = NULL;

static int dumb_gem_mmap_impl(struct file* filp, struct vm_area_struct* vma) {

    log("call drm_gem_mmap()");

    // 利用GEM方法进行mapping，
    // 在它里面会调用之前设置好的drm_gem_object_funcs.mmap()
    return drm_gem_mmap(filp, vma);
}

static const struct file_operations dumb_driver_fops = {
    .owner      = THIS_MODULE,
    .open       = drm_open,
    .release    = drm_release,
    .poll       = drm_poll,
    .read       = drm_read,
    .llseek     = noop_llseek,
    .mmap       = dumb_gem_mmap_impl,
    .unlocked_ioctl = drm_ioctl,
    .compat_ioctl = drm_compat_ioctl,    
};
static int dumb_gem_obj_mmap(struct drm_gem_object *gem_obj, struct vm_area_struct *vma){
    int ret = 0;
    unsigned long pfn_start = 0;    
    unsigned long size = vma->vm_end - vma->vm_start;
    struct dumb_buffer_object *dumb_buffer_obj = NULL;

    dumb_buffer_obj = DRM_GEM_OBJECT_TO_DUMB_BUFFER_OBJ(gem_obj);

    log("mmaping dumb_buffer_obj:%p", dumb_buffer_obj);

    pfn_start = page_to_pfn(dumb_buffer_obj->start_page);
        
    ret = remap_pfn_range(vma, vma->vm_start, pfn_start, size, vma->vm_page_prot);
    if (ret){
        err("remap_pfn_range failed at [0x%lx  0x%lx]", vma->vm_start, vma->vm_end);
    }
    
    return 0;
}

static const struct drm_gem_object_funcs dumb_gem_obj_funcs = {
    .open   = NULL,
    .mmap   = dumb_gem_obj_mmap, 
  //.vm_ops = &dumb_gem_vm_ops, // 赋值到struct vm_area_struct 的vm_ops, 供缺页时调用。
};
static void dumb_release(struct drm_device* dev) { log(); }

static int dumb_create_gem_impl(struct drm_file* file_priv, struct drm_device* dev, struct drm_mode_create_dumb* args) {
    u32 size = 0;
    int ret = 0;    
    struct dumb_buffer_object  *dumb_buffer_obj;
    struct drm_gem_object   *gem_obj;
    log();

    size = ALIGN((args->width * args->height * args->bpp/8), PAGE_SIZE);

    //1. 分配buffer_obj
    //   可以在此处分配page,也可以在fault时再分配
    dumb_buffer_obj = kzalloc(sizeof(*dumb_buffer_obj), GFP_KERNEL);
    size = roundup(size, PAGE_SIZE);
    log("page_size:%d",size);


    // 2. 初始化dumb_buffer_obj内的drm_gem_object
    gem_obj = &(dumb_buffer_obj->gem_obj);
    gem_obj->funcs = &dumb_gem_obj_funcs; /* 设置该gem object的操作函数 */
    
    drm_gem_object_init(dev, gem_obj, size);
    
    // 3. 利用GEM方法生成一个gem_obj对应的handle
    ret = drm_gem_handle_create(file_priv, gem_obj, &args->handle);
    if(ret){
        log();
    }
    
    dumb_buffer_obj->start_page = alloc_pages(GFP_KERNEL, get_order(size));
    if (!dumb_buffer_obj->start_page) {
        err("alloc_pages() failed");
        return -ENOMEM;
    }
    dumb_buffer_obj->size = size;

    // 4. 赋值返回参数
    args->size  = size;
    args->pitch = args->width*args->bpp/8; //TODO: 应计算得到

    log("create dumb_buffer_obj:%p success, return handle:%d", dumb_buffer_obj, args->handle);
    return 0;
}

static int dumb_map_offset_gem_impl(struct drm_file* file_priv, struct drm_device* dev, uint32_t handle, uint64_t* offset) {
    int ret;

    log("handle:%d", handle);
    
    // 利用GEM方法得到一个offset
    ret =drm_gem_dumb_map_offset(file_priv, dev, handle, offset);
    if(ret){
        err("drm_gem_dumb_map_offset failed. ret:%d", ret);
    }else{
        log("get offset:0x%llx from drm_gem_dumb_map_offset()", *offset);
    }

    return ret;
}
static int dumb_release_gem_impl(struct drm_file     *file_priv, 
                             struct drm_device   *dev, 
                             u32 handle){
    struct drm_gem_object *gem_obj;
    struct dumb_buffer_object *dumb_buffer_obj = NULL;

    log("");
    gem_obj = drm_gem_object_lookup(file_priv, handle);
    dumb_buffer_obj = DRM_GEM_OBJECT_TO_DUMB_BUFFER_OBJ(gem_obj);

    log("free page:%p",dumb_buffer_obj->start_page);

    free_pages((unsigned long)page_address(dumb_buffer_obj->start_page), get_order(dumb_buffer_obj->size));
    
    kfree(dumb_buffer_obj);

    return 0;

}

static struct drm_driver dumb_driver = {
    .driver_features = DRIVER_GEM,
    .fops            = &dumb_driver_fops,    
    .release         = dumb_release,
    
    .dumb_create     = dumb_create_gem_impl,
    .dumb_map_offset = dumb_map_offset_gem_impl,
    .dumb_destroy    = dumb_release_gem_impl,

    .name = DRIVER_NAME,
    .desc = DRIVER_DESC,
    .date = DRIVER_DATE,
    .major = DRIVER_MAJOR,
    .minor = DRIVER_MINOR,
};

static int __init dumb_drv_init(void) {
    int ret;
    struct platform_device* pdev = NULL;

    log("build time: %s %s", __DATE__, __TIME__);

    pdev = platform_device_register_simple(DRIVER_NAME, -1, NULL, 0);
    if (IS_ERR(pdev)) return PTR_ERR(pdev);

    if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) {
        ret = -ENOMEM;
        goto out_unregister;
    }

    dumb_device = devm_drm_dev_alloc(&pdev->dev, &dumb_driver, struct dumb_device, drm);
    if (IS_ERR(dumb_device)) {
        ret = PTR_ERR(dumb_device);
        goto out_devres;
    }

    ret = drm_dev_register(&dumb_device->drm, 0);
    if (ret) goto out_devres;

    dumb_device->platform_dev = pdev;

    log("Finish");
    return 0;

out_devres:
    devres_release_group(&pdev->dev, NULL);
out_unregister:
    platform_device_unregister(pdev);

    return ret;
}

static void __exit dumb_drv_exit(void) {
    struct platform_device *pdev = dumb_device->platform_dev;
    log();

    drm_dev_unregister(&dumb_device->drm);
    devres_release_group(&pdev->dev, NULL);
    platform_device_unregister(pdev);
    
}

module_init(dumb_drv_init);
module_exit(dumb_drv_exit);

MODULE_AUTHOR("kevin");
MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_LICENSE("GPL");

#include <linux/module.h>
#include <linux/platform_device.h>
#include <linux/slab.h>
#include <linux/dma-buf.h>
#include <drm/drm_drv.h>
#include <drm/drm_file.h>
#include <drm/drm_ioctl.h>

#define DRIVER_NAME "drm prime driver"
#define DRIVER_DESC "test drm prime driver"
#define DRIVER_DATE "20191124"
#define DRIVER_MAJOR 1
#define DRIVER_MINOR 0

#define log(fmt, args...) printk("%s():%d " fmt "\n", __func__, __LINE__, ##args)
#define err(fmt, args...) printk("\033[35m%s():%d " fmt "\033[0m\n", __func__, __LINE__, ##args)

struct dumb_device {
    struct drm_device drm;
    struct platform_device* platform_dev;
};

#define MAX_NUM 10

static struct dumb_device* dumb_device = NULL;
static struct page* pages[MAX_NUM] = {0};
static u32 buffer_size[MAX_NUM] = {0};
static int page_idx = 0;

static int prime_dmabuf_attach_impl(struct dma_buf* dmabuf, struct dma_buf_attachment* attachment) {
    log("attach dmabuf to device, return attachment");
    return 0;
}
static void prime_dmabuf_detach_impl(struct dma_buf* dmabuf, struct dma_buf_attachment* attachment) { log("detach dmabuf"); }
static struct sg_table* prime_dmabuf_map_impl(struct dma_buf_attachment* attachment, enum dma_data_direction dir) {
    struct page* page = attachment->dmabuf->priv;
    struct sg_table* table;
    int err;

    log("page:%p", page);
    table = kmalloc(sizeof(*table), GFP_KERNEL);
    if (!table) {
        log();
        return ERR_PTR(-ENOMEM);
    }

    // 生成散列表并赋值
    err = sg_alloc_table(table, 1, GFP_KERNEL);
    if (err) {
        log();
        kfree(table);
        return ERR_PTR(err);
    }

    sg_set_page(table->sgl, page, PAGE_SIZE, 0);
    sg_dma_address(table->sgl) = dma_map_page(&(dumb_device->platform_dev->dev), page, 0, PAGE_SIZE, dir);
    log("map attachment into sg_table and return sg_table");

    return table;
}
static void prime_dmabuf_unmap_impl(struct dma_buf_attachment* attachment, struct sg_table* table, enum dma_data_direction dir) {
    log();
    dma_unmap_page(attachment->dev, sg_dma_address(table->sgl), PAGE_SIZE, dir);
    sg_free_table(table);
    kfree(table);
}
static void prime_dmabuf_release_impl(struct dma_buf* dma_buf) {
    struct page* page = dma_buf->priv;

    log("put_page:%p", page);
    put_page(page);
}
static int prime_dmabuf_vmap_impl(struct dma_buf* dma_buf, struct dma_buf_map* map) {
    void* vaddr = NULL;
    struct page* page = dma_buf->priv;

    vaddr = vmap(&page, 1, 0, PAGE_KERNEL);
    dma_buf_map_set_vaddr(map, vaddr);
    log("mapping page:%p, get virtual addr:%p", page, vaddr);

    return 0;
}
static void prime_dmabuf_vunmap_impl(struct dma_buf* dma_buf, struct dma_buf_map* map) {
    log("unmapping addr:%p", map->vaddr);
    vunmap(map->vaddr);
}
static int prime_dmabuf_mmap_impl(struct dma_buf* dma_buf, struct vm_area_struct* vma) {
    struct page* page = dma_buf->priv;
    log();
    return remap_pfn_range(vma, vma->vm_start, page_to_pfn(page), PAGE_SIZE, vma->vm_page_prot);
}

static const struct dma_buf_ops exp_dmabuf_ops = {
    .attach         = prime_dmabuf_attach_impl,
    .detach         = prime_dmabuf_detach_impl,
    .map_dma_buf    = prime_dmabuf_map_impl,
    .unmap_dma_buf  = prime_dmabuf_unmap_impl,
    .release        = prime_dmabuf_release_impl,
    .mmap           = prime_dmabuf_mmap_impl,
    .vmap           = prime_dmabuf_vmap_impl,
    .vunmap         = prime_dmabuf_vunmap_impl,
};

static int prime_handle_to_fd_impl(struct drm_device* dev, struct drm_file* file_priv, uint32_t handle, uint32_t flags,
                                        int* prime_fd) {
    DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
    struct dma_buf* dmabuf;

    log("dma_buf -> page:%p", pages[handle]);

    exp_info.ops  = &exp_dmabuf_ops;
    exp_info.size = buffer_size[handle];
    exp_info.flags= O_CLOEXEC;
    exp_info.priv = pages[handle];  // buffer和dmabuf建立关联

    // 构建一个dma_buf
    dmabuf = dma_buf_export(&exp_info);
    if (IS_ERR(dmabuf)) {
        log();
        return -1;
    }

    // 为该dma_buf生成fd
    *prime_fd = dma_buf_fd(dmabuf, O_CLOEXEC);
    if (prime_fd <= 0) {
        log();
        return -1;
    }

    return 0;
}

static int prime_fd_to_handle_impl(struct drm_device* dev, struct drm_file* file_priv, int prime_fd, uint32_t* handle) {
    struct dma_buf* dma_buf;
    struct page* page = NULL;
    int idx = 0;
    log();

    dma_buf = dma_buf_get(prime_fd);
    page = dma_buf->priv;

    if (dma_buf->ops == &exp_dmabuf_ops) {
        for (idx = 0; idx < MAX_NUM; idx++) {
            if (pages[idx] == page) {
                break;
            }
        }
        *handle = idx;
        log("return handle:%d", *handle);
    } else {
        log("doesn't support");
        return -1;
    }

    dma_buf_put(dma_buf);
    return 0;
}

static const struct file_operations dumb_driver_fops = {
    .owner          = THIS_MODULE, 
    .open           = drm_open, 
    .release        = drm_release, 
    .unlocked_ioctl = drm_ioctl, 
    .compat_ioctl   = drm_compat_ioctl,
};

static void dumb_release(struct drm_device* dev) { log(); }

static int dumb_create_impl(struct drm_file     *file_priv, 
                            struct drm_device   *dev, 
                            struct drm_mode_create_dumb* args) {
    u32 size = 0;
    log();

    if(page_idx>=MAX_NUM){
        err("only support alloc %d buffers", MAX_NUM);
        return -ENOMEM;
    }

    size = roundup((args->width * args->height * args->bpp/8), PAGE_SIZE);

    // 分配页面
    pages[page_idx] = alloc_pages(GFP_KERNEL, get_order(size));
    if (!pages[page_idx]) {
        err("alloc_pages() failed");
        return -ENOMEM;
    }

    buffer_size[page_idx] = size;

    // 赋值返回参数
    args->size    = size;
    args->pitch   = args->width * args->bpp/8;
    args->handle  = page_idx++;

    return 0;
}

static  int dumb_destroy_impl(struct drm_file *file_priv, struct drm_device *dev, uint32_t handle){
    log("handle:%d", handle);

    //__free_pages(pages[handle], get_order(dumb_buffer_size[handle]));
    free_pages((unsigned long)page_address(pages[handle]), get_order(buffer_size[handle]));
    return 0;
}
static struct drm_driver dumb_driver = {
    .release = dumb_release,
    .fops    = &dumb_driver_fops,

    .dumb_create  = dumb_create_impl,
    .dumb_destroy = dumb_destroy_impl,

    .prime_handle_to_fd = prime_handle_to_fd_impl,
    .prime_fd_to_handle = prime_fd_to_handle_impl,  //其他驱动分配的dma_buf导入到DRM系统

    .name = DRIVER_NAME,
    .desc = DRIVER_DESC,
    .date = DRIVER_DATE,
    .major = DRIVER_MAJOR,
    .minor = DRIVER_MINOR,
};

static int __init dumb_drv_init(void) {
    int ret;
    struct platform_device* pdev = NULL;

    log("build time: %s %s", __DATE__, __TIME__);

    pdev = platform_device_register_simple(DRIVER_NAME, -1, NULL, 0);
    if (IS_ERR(pdev)) return PTR_ERR(pdev);

    if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) {
        ret = -ENOMEM;
        goto out_unregister;
    }

    // 分配
    dumb_device = devm_drm_dev_alloc(&pdev->dev, &dumb_driver, struct dumb_device, drm);
    if (IS_ERR(dumb_device)) {
        ret = PTR_ERR(dumb_device);
        goto out_devres;
    }

    // 注册
    ret = drm_dev_register(&dumb_device->drm, 0);
    if (ret) goto out_devres;

    dumb_device->platform_dev = pdev;

    log("Finish");
    return 0;

out_devres:
    devres_release_group(&pdev->dev, NULL);

out_unregister:
    platform_device_unregister(pdev);

    return ret;
}

static void __exit dumb_drv_exit(void) {
    struct platform_device *pdev = dumb_device->platform_dev;
    log();

    drm_dev_unregister(&dumb_device->drm);
    devres_release_group(&pdev->dev, NULL);
    platform_device_unregister(pdev);
    
}

module_init(dumb_drv_init);
module_exit(dumb_drv_exit);

MODULE_AUTHOR("kevin");
MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_LICENSE("GPL");

#include <linux/dma-buf.h>
#include <linux/module.h>
#include <linux/miscdevice.h>
#include <linux/slab.h>

#define log(fmt, args...) printk("%s():%d " fmt "\n", __func__, __LINE__, ##args)

static int test_dma_buf(struct dma_buf* dma_buf) {
    struct dma_buf_attachment* attachment;
    struct sg_table* table;
    struct device* dev;
    unsigned int reg_addr, reg_size;
    struct scatterlist* sg;
    struct page* page;
    int i = 0;

    if (!dma_buf) {
        log();
        return -EINVAL;
    }

    dev = kzalloc(sizeof(*dev), GFP_KERNEL);
    if (!dev) {
        log();
        return -ENOMEM;
    }
    dev_set_name(dev, "importer");

    attachment = dma_buf_attach(dma_buf, dev);
    if (IS_ERR(attachment)) {
        pr_err("dma_buf_attach() failed\n");
        return PTR_ERR(attachment);
    }

    log("call dma_buf_map_attachment to get sg_table");
    table = dma_buf_map_attachment(attachment, DMA_BIDIRECTIONAL);
    if (IS_ERR(table)) {
        pr_err("dma_buf_map_attachment() failed\n");
        dma_buf_detach(dma_buf, attachment);
        return PTR_ERR(table);
    }

    log("table->nents:%d", table->nents);

    sg = table->sgl;
    for (i = 0; i < table->nents; i++) {
        reg_addr = sg_dma_address(sg);
        reg_size = sg_dma_len(sg);
        page = sg_page(sg);
        log("addr = 0x%08x, size = 0x%08x  %p %p\n", reg_addr, reg_size, page, page_address(page));
        sg = sg_next(sg);
    }

    // do something on dma-buf

    log("unmap and detach dma_buf");
    dma_buf_unmap_attachment(attachment, table, DMA_BIDIRECTIONAL);
    dma_buf_detach(dma_buf, attachment);

    return 0;
}
static long importer_ioctl(struct file* filp, unsigned int cmd, unsigned long arg) {
    int fd;
    struct dma_buf* dma_buf;

    if (copy_from_user(&fd, (void __user*)arg, sizeof(int))) {
        log("copy_from_user() failed");
        return -EFAULT;
    }

    dma_buf = dma_buf_get(fd);
    log("get dma_buf:%p by fd:%d", dma_buf, fd);
    if (IS_ERR(dma_buf)) {
        log();
        return PTR_ERR(dma_buf);
    }

    test_dma_buf(dma_buf);
    return 0;
}

static struct file_operations importer_fops = {
    .owner = THIS_MODULE, 
    .unlocked_ioctl = importer_ioctl,
};

static struct miscdevice mdev = {
    .minor = MISC_DYNAMIC_MINOR, 
    .name  = "importer", 
    .fops  = &importer_fops,
};
static int __init importer_init(void) {
    log();
    return misc_register(&mdev);
}
static void __exit importer_exit(void) {
    log();
    misc_deregister(&mdev);
}
module_init(importer_init);
module_exit(importer_exit);
MODULE_LICENSE("GPL v2");

#define SHARE_DMABUF_PATH "./share_dmabuf_file"
static void send_fd(int fd)
{
    int ret = 0;
    char c = 0;
    struct iovec iov[1];

    iov[0].iov_base = &c;
    iov[0].iov_len  = 1;

    int sockfd = 0;
    struct sockaddr_un addr;
    bzero(&addr, sizeof(addr));

    addr.sun_family = AF_UNIX;
    strcpy(addr.sun_path, SHARE_DMABUF_PATH);

    sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
    if (sockfd < 0) {
        perror("socket error");
        exit(-1);
    }

    ret = connect(sockfd, (struct sockaddr *)&addr, sizeof(addr));
    if(ret <0){
        perror("connect() failed");
        exit(0);
    }

    int cmsgsize = CMSG_LEN(sizeof(int));
    struct cmsghdr* cmptr = (struct cmsghdr*)malloc(cmsgsize);
    if(cmptr == NULL){
        err_exit();
    }

    cmptr->cmsg_level = SOL_SOCKET;
    cmptr->cmsg_type  = SCM_RIGHTS;
    cmptr->cmsg_len   = cmsgsize;

    struct msghdr msg;
    msg.msg_iov     = iov;
    msg.msg_iovlen  = 1;
    msg.msg_name    = NULL;
    msg.msg_namelen = 0;
    msg.msg_control = cmptr;
    msg.msg_controllen = cmsgsize;
    *(int *)CMSG_DATA(cmptr) = fd;

    ret = sendmsg(sockfd, &msg, 0);
    if (ret == -1){
        perror("sendmsg() failed.");
        err_exit();
    }    
    free(cmptr);
    close(sockfd);    
}

static int recv_fd(int sock)
{    
    struct cmsghdr* pcmsg = NULL;
    union {
        struct cmsghdr cm;
        char control[CMSG_SPACE(sizeof(int))];
    } control_un;

    char buf;
    struct iovec iov[1];
    iov[0].iov_base = &buf;
    iov[0].iov_len  = sizeof(buf);

    struct msghdr msg;
    msg.msg_iov = iov;
    msg.msg_iovlen  = 1;
    msg.msg_name = NULL;
    msg.msg_namelen = 0;
    msg.msg_control = control_un.control;
    msg.msg_controllen = sizeof(control_un.control);;

    int ret = recvmsg(sock, &msg, 0);    
    if (ret == -1) {
        printf("\033[31m%s:%d sock:%d err:%m \033[0m\n\n",__func__,__LINE__, sock); 
        exit(1);
    }
    pcmsg = CMSG_FIRSTHDR(&msg);
    int fd = *(int *)CMSG_DATA(pcmsg);
    return fd;
}
static int recv_prime_fd_from_socket(void){
    int sockfd = 0;
    struct sockaddr_un addr;
    unlink(SHARE_DMABUF_PATH);
    addr.sun_family = AF_UNIX;
    strcpy(addr.sun_path, SHARE_DMABUF_PATH);
    int prime_fd;
    int clientfd;
    struct sockaddr cliaddr;
    socklen_t clilen;

    unsigned int len = strlen(addr.sun_path) + sizeof(addr.sun_family);
    sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
    if (sockfd < 0) {
        perror("socket error");
        exit(-1);
    }
    if (bind(sockfd, (struct sockaddr*)&addr, len) < 0) {
        perror("bind error");
        close(sockfd);
        exit(-1);
    }

    listen(sockfd, 2);

    clientfd = accept(sockfd, (struct sockaddr *)&cliaddr, &clilen);
    if(clientfd<=0){
        log("clientfd:%d %m", clientfd);
        exit(-1);
    }
    prime_fd = recv_fd(clientfd);

    log("Recv prime_fd: %d", prime_fd);

   return prime_fd;
}

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <xf86drm.h>

#include <sys/socket.h>
#include <sys/un.h>

#define SHARE_DMABUF_PATH "./tt"

#define log(fmt, args...) printf("%s():%d " fmt "\n", __func__, __LINE__, ##args)

#define err_return(fmt, args...) do{ \
    printf("%s():%d " fmt "\n", __func__, __LINE__, ##args); \
    return -1;\
}while(0)

#define err_exit(fmt, args...) do{ \
    printf("%s():%d " fmt "\n", __func__, __LINE__, ##args); \
    exit(1);\
}while(0)

struct buffer_object {
    uint32_t width;
    uint32_t height;
    uint32_t pitch;
    uint32_t handle;
    uint32_t size;
    int      prime_fd;
};

struct buffer_object buf;

static int create_dumb_get_prime_fd(int fd, struct buffer_object *bo){
    int ret = 0;    
    struct drm_mode_create_dumb create = {};    

    create.width  = bo->width;
    create.height = bo->height;
    create.bpp    = 4*8; //ARGB

    ret = drmIoctl(fd, DRM_IOCTL_MODE_CREATE_DUMB, &create);
    if(ret){
        err_return("drmIoctl(DRM_IOCTL_MODE_CREATE_DUMB) failed");
    }

    ret = drmPrimeHandleToFD(fd, create.handle, DRM_CLOEXEC, &bo->prime_fd);
    if(ret){
        err_return("drmPrimeHandleToFD() failed");
    }
    bo->handle = create.handle;
    log("get handle:%d prime fd:%d", create.handle, bo->prime_fd);
    return 0;
}

static void destroy_fd(int fd, struct buffer_object *bo){
    int ret = 0;
    uint32_t handle = 0;

    struct drm_mode_destroy_dumb destroy = {};

    ret = drmPrimeFDToHandle(fd, bo->prime_fd, &handle);
    if(ret){
        err_exit("drmFDToPrimeHandle() failed");
    }
    log("handle:%d vs bo->handle:%d", handle, bo->handle);
    destroy.handle = handle;

    drmIoctl(fd, DRM_IOCTL_MODE_DESTROY_DUMB, &destroy);
}
int main(int argc, char **argv){
    int fd;

    fd = open("/dev/dri/card0", O_RDWR | O_CLOEXEC);
    if(fd<=0){
        printf("%s():%d\n", __func__,__LINE__);
        return -1;
    }
    buf.width = 1024;
    buf.height = 1;
    create_dumb_get_prime_fd(fd, &buf);

    send_fd(buf.prime_fd);

    printf("press any key to exit\n");
    getchar();
    
    destroy_fd(fd, &buf);

    close(fd);

    return 0;
}

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/ioctl.h>

#define log(fmt, args...) printf("%s():%d " fmt "\n", __func__, __LINE__, ##args)
#define SHARE_DMABUF_PATH "./tt"


#define err_return(fmt, args...) do{ \
    printf("%s():%d " fmt "\n", __func__, __LINE__, ##args); \
    return -1;\
}while(0)

#define err_return_void(fmt, args...) do{ \
    printf("%s():%d " fmt "\n", __func__, __LINE__, ##args); \
    return;\
}while(0)

int main(int argc, char **argv){
    int ret = 0;
    int fd;
    int prime_fd = 5;

    fd = open("/dev/importer", O_RDWR | O_CLOEXEC);
    if(fd<=0){
        printf("%s():%d\n", __func__,__LINE__);
        return -1;
    }

    prime_fd = recv_prime_fd_from_socket();

    // 把fd传递给import驱动进行访问
    ret = ioctl(fd, 0, &prime_fd);
    if(ret<0){
        err_return("ioctl failed");
    }
    close(prime_fd);
    close(fd);

    return 0;
}

/**
 * DRM_GEM_SHMEM_DRIVER_OPS - Default shmem GEM operations
 *
 * This macro provides a shortcut for setting the shmem GEM operations in
 * the &drm_driver structure.
 * 这个宏定义了一组shmem 的GEM操作，利用它可以快捷的在drm_driver结构中定义GEM操作。
 * 
 * 在udl, hyperv, vkms, tiny, mgag200和gud 驱动中有用到它，可做参考。
 * 
 */
#define DRM_GEM_SHMEM_DRIVER_OPS \
    .prime_handle_to_fd = drm_gem_prime_handle_to_fd, \
    .prime_fd_to_handle = drm_gem_prime_fd_to_handle, \
    .gem_prime_import_sg_table = drm_gem_shmem_prime_import_sg_table, \
    .gem_prime_mmap     = drm_gem_prime_mmap, \
    .dumb_create        = drm_gem_shmem_dumb_create

// GEM 提供的可供driver使用的struct file_operations
#define DEFINE_DRM_GEM_FOPS(name) \
    static const struct file_operations name = {\
        .owner      = THIS_MODULE,\
        .open       = drm_open,\
        .release    = drm_release,\
        .unlocked_ioctl = drm_ioctl,\
        .compat_ioctl   = drm_compat_ioctl,\
        .poll       = drm_poll,\
        .read       = drm_read,\
        .llseek     = noop_llseek,\
        .mmap       = drm_gem_mmap,\
    }

/**
 * DRM_GEM_CMA_DRIVER_OPS_WITH_DUMB_CREATE - CMA GEM driver operations
 * @dumb_create_func: callback function for .dumb_create
 *
 * This macro provides a shortcut for setting the default GEM operations in the
 * &drm_driver structure.
 *
 * This macro is a variant of DRM_GEM_CMA_DRIVER_OPS for drivers that
 * override the default implementation of &struct rm_driver.dumb_create. Use
 * DRM_GEM_CMA_DRIVER_OPS if possible. Drivers that require a virtual address
 * on imported buffers should use
 * DRM_GEM_CMA_DRIVER_OPS_VMAP_WITH_DUMB_CREATE() instead.
 * 
 * 使用到它的现有驱动有: aspeed, sti vc4 hisilicon ingenic shmobile xlnx imx sun4i tiny meson 等
 */
#define DRM_GEM_CMA_DRIVER_OPS_WITH_DUMB_CREATE(dumb_create_func) \
    .dumb_create        = (dumb_create_func), \
    .prime_handle_to_fd = drm_gem_prime_handle_to_fd, \
    .prime_fd_to_handle = drm_gem_prime_fd_to_handle, \
    .gem_prime_import_sg_table = drm_gem_cma_prime_import_sg_table, \
    .gem_prime_mmap     = drm_gem_prime_mmap

#define DRM_GEM_CMA_DRIVER_OPS \
    DRM_GEM_CMA_DRIVER_OPS_WITH_DUMB_CREATE(drm_gem_cma_dumb_create)

/**
 * define DRM_GEM_VRAM_DRIVER - default callback functions for \
    &struct drm_driver
 *
 * Drivers that use VRAM MM and GEM VRAM can use this macro to initialize
 * &struct drm_driver with default functions.
 * 
* 使用到它的现有驱动有: ast, tiny vboxvideo
 */
#define DRM_GEM_VRAM_DRIVER \
    .debugfs_init             = drm_vram_mm_debugfs_init, \
    .dumb_create          = drm_gem_vram_driver_dumb_create, \
    .dumb_map_offset      = drm_gem_ttm_dumb_map_offset, \
    .gem_prime_mmap       = drm_gem_prime_mmap

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <time.h>
#include <unistd.h>
#include <xf86drm.h>
#include <xf86drmMode.h>
struct buffer_object {
    uint32_t width;
    uint32_t height;
    uint32_t pitch;
    uint32_t handle;
    uint32_t size;
    uint32_t fb_id;
};
struct buffer_object buf;
static int modeset_create_fb(int fd, struct buffer_object *bo)
{
    struct drm_mode_create_dumb create = {};
    struct drm_mode_map_dumb map = {};

    create.width = bo->width;
    create.height = bo->height;
    create.bpp = 32;
    drmIoctl(fd, DRM_IOCTL_MODE_CREATE_DUMB, &create);    
    bo->pitch = create.pitch;
    bo->size = create.size;
    bo->handle = create.handle;
    drmModeAddFB(fd, bo->width, bo->height, 24, 32, bo->pitch,bo->handle, &bo->fb_id);
        
    // drmModeAddFB2 可以传递多个handle
    // drmModeAddFB(fd, bo->width, bo->height, 24, 32, bo->pitch,
    //         bo->handle, &bo->fb_id);  //--> calling mode_config_funcs.fb_create()

    map.handle = create.handle;
    drmIoctl(fd, DRM_IOCTL_MODE_MAP_DUMB, &map);
    return 0;
}

static void modeset_destroy_fb(int fd, struct buffer_object *bo)
{
    struct drm_mode_destroy_dumb destroy = {};
    drmModeRmFB(fd, bo->fb_id);
    destroy.handle = bo->handle;
    drmIoctl(fd, DRM_IOCTL_MODE_DESTROY_DUMB, &destroy);
}

static uint32_t get_property_id(int fd, drmModeObjectProperties *props, const char *name)
{
    drmModePropertyPtr property;
    uint32_t i, id = 0;
    for (i = 0; i < props->count_props; i++) {
        property = drmModeGetProperty(fd, props->props[i]);
        if (!strcmp(property->name, name)){
            id = property->prop_id;
        }
        drmModeFreeProperty(property);
        if (id)
            break;
    }
    return id;
}

int main(int argc, char **argv)
{
    int fd;
    drmModeConnector *conn;
    drmModeRes *res;
    drmModePlaneRes *plane_res;
    drmModeObjectProperties *props;
    drmModeAtomicReq *req;
    uint32_t conn_id;
    uint32_t crtc_id;
    uint32_t plane_id;
    uint32_t blob_id;
    uint32_t property_crtc_id;
    uint32_t property_mode_id;
    uint32_t property_active;
    uint32_t property_fb_id;
    uint32_t property_crtc_x;
    uint32_t property_crtc_y;
    uint32_t property_crtc_w;
    uint32_t property_crtc_h;
    uint32_t property_src_x;
    uint32_t property_src_y;
    uint32_t property_src_w;
    uint32_t property_src_h;

    fd = open("/dev/dri/card0", O_RDWR | O_CLOEXEC);
    res = drmModeGetResources(fd);
    crtc_id = res->crtcs[0];
    conn_id = res->connectors[0];
    drmSetClientCap(fd, DRM_CLIENT_CAP_UNIVERSAL_PLANES, 1);
    plane_res = drmModeGetPlaneResources(fd);
    plane_id = plane_res->planes[0];
    conn = drmModeGetConnector(fd, conn_id);
    buf.width = conn->modes[0].hdisplay;
    buf.height = conn->modes[0].vdisplay;
    modeset_create_fb(fd, &buf);
    drmSetClientCap(fd, DRM_CLIENT_CAP_ATOMIC, 1);

    props = drmModeObjectGetProperties(fd, conn_id, DRM_MODE_OBJECT_CONNECTOR);
    property_crtc_id = get_property_id(fd, props, "CRTC_ID");
    drmModeFreeObjectProperties(props);

    props = drmModeObjectGetProperties(fd, crtc_id, DRM_MODE_OBJECT_CRTC);
    property_active = get_property_id(fd, props, "ACTIVE");
    property_mode_id = get_property_id(fd, props, "MODE_ID");
    drmModeFreeObjectProperties(props);

    drmModeCreatePropertyBlob(fd, &conn->modes[0], sizeof(conn->modes[0]), &blob_id);

    req = drmModeAtomicAlloc();
    drmModeAtomicAddProperty(req, crtc_id, property_active, 1);
    drmModeAtomicAddProperty(req, crtc_id, property_mode_id, blob_id);
    drmModeAtomicAddProperty(req, conn_id, property_crtc_id, crtc_id);
    drmModeAtomicCommit(fd, req, DRM_MODE_ATOMIC_ALLOW_MODESET, NULL);
    drmModeAtomicFree(req);
    
    /* get plane properties */
    props = drmModeObjectGetProperties(fd, plane_id, DRM_MODE_OBJECT_PLANE);
    property_crtc_id = get_property_id(fd, props, "CRTC_ID");
    property_fb_id = get_property_id(fd, props, "FB_ID");
    property_crtc_x = get_property_id(fd, props, "CRTC_X");
    property_crtc_y = get_property_id(fd, props, "CRTC_Y");
    property_crtc_w = get_property_id(fd, props, "CRTC_W");
    property_crtc_h = get_property_id(fd, props, "CRTC_H");
    property_src_x = get_property_id(fd, props, "SRC_X");
    property_src_y = get_property_id(fd, props, "SRC_Y");
    property_src_w = get_property_id(fd, props, "SRC_W");
    property_src_h = get_property_id(fd, props, "SRC_H");
    drmModeFreeObjectProperties(props);

    /* atomic plane update */
    req = drmModeAtomicAlloc();
    drmModeAtomicAddProperty(req, plane_id, property_crtc_id, crtc_id);
    drmModeAtomicAddProperty(req, plane_id, property_fb_id, buf.fb_id);
    drmModeAtomicAddProperty(req, plane_id, property_crtc_x, 50);
    drmModeAtomicAddProperty(req, plane_id, property_crtc_y, 50);
    drmModeAtomicAddProperty(req, plane_id, property_crtc_w, 320);
    drmModeAtomicAddProperty(req, plane_id, property_crtc_h, 320);
    drmModeAtomicAddProperty(req, plane_id, property_src_x, 0);
    drmModeAtomicAddProperty(req, plane_id, property_src_y, 0);
    drmModeAtomicAddProperty(req, plane_id, property_src_w, 320 << 16);
    drmModeAtomicAddProperty(req, plane_id, property_src_h, 320 << 16);
    drmModeAtomicCommit(fd, req, 0, NULL);
    drmModeAtomicFree(req);

    printf("drmModeAtomicCommit SetPlane done\n");
    getchar();

    modeset_destroy_fb(fd, &buf);
    drmModeFreeConnector(conn);
    drmModeFreePlaneResources(plane_res);
    drmModeFreeResources(res);

    close(fd);

    return 0;
}

#include <xf86drm.h>
#include <xf86drmMode.h>

int main() {
    int drm_fd = open("/dev/dri/card0", O_RDWR); // 打开 DRM 设备

    // 读取 GPU 固件数据（假设存在 firmware.bin 文件）
    FILE *firmware_file = fopen("firmware.bin", "rb");
    fseek(firmware_file, 0, SEEK_END);
    size_t firmware_size = ftell(firmware_file);
    fseek(firmware_file, 0, SEEK_SET);
    void *firmware_data = malloc(firmware_size);
    fread(firmware_data, 1, firmware_size, firmware_file);
    fclose(firmware_file);

    // 创建 DRM blob
    uint32_t blob_handle;
    drmModeCreatePropertyBlob(drm_fd, firmware_data, firmware_size, &blob_handle);

    // 将 blob 设置为 GPU 的固件
    // ...（其他操作，例如加载到显卡）

    // 清理资源
    free(firmware_data);
    close(drm_fd);

    return 0;
}