4 files changed, 27 insertions, 5 deletions

diff --git a/drivers/char/drm/drm.h b/drivers/char/drm/drm.h
index 3f28a1551621..8db9041e306c 100644
--- a/drivers/char/drm/drm.h
+++ b/drivers/char/drm/drm.h
@@ -356,7 +356,8 @@ typedef struct drm_buf_desc {
                 _DRM_PAGE_ALIGN = 0x01, /**< Align on page boundaries for DMA */
                 _DRM_AGP_BUFFER = 0x02, /**< Buffer is in AGP space */
                 _DRM_SG_BUFFER = 0x04,  /**< Scatter/gather memory buffer */
-                _DRM_FB_BUFFER = 0x08   /**< Buffer is in frame buffer */
+                _DRM_FB_BUFFER = 0x08,  /**< Buffer is in frame buffer */
+                _DRM_PCI_BUFFER_RO = 0x10 /**< Map PCI DMA buffer read-only */
         } flags;
         unsigned long agp_start; /**<
                                   * Start address of where the AGP buffers are
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index 2f18329c5eb8..0bbb04f2390f 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -431,7 +431,8 @@ typedef struct drm_device_dma {
         enum {
                 _DRM_DMA_USE_AGP = 0x01,
                 _DRM_DMA_USE_SG = 0x02,
-                _DRM_DMA_USE_FB = 0x04
+                _DRM_DMA_USE_FB = 0x04,
+                _DRM_DMA_USE_PCI_RO = 0x08
         } flags;
 
 } drm_device_dma_t;
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 6eafff13dab6..9f65f5697ba8 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -887,6 +887,9 @@ int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request)
         request->count = entry->buf_count;
         request->size = size;
 
+        if (request->flags & _DRM_PCI_BUFFER_RO)
+                dma->flags = _DRM_DMA_USE_PCI_RO;
+
         atomic_dec(&dev->buf_alloc);
         return 0;
 
@@ -1471,9 +1474,10 @@ int drm_freebufs(struct inode *inode, struct file *filp,
  * \param arg pointer to a drm_buf_map structure.
  * \return zero on success or a negative number on failure.
  *
- * Maps the AGP or SG buffer region with do_mmap(), and copies information
- * about each buffer into user space. The PCI buffers are already mapped on the
- * addbufs_pci() call.
+ * Maps the AGP, SG or PCI buffer region with do_mmap(), and copies information
+ * about each buffer into user space. For PCI buffers, it calls do_mmap() with
+ * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls
+ * drm_mmap_dma().
  */
 int drm_mapbufs(struct inode *inode, struct file *filp,
                 unsigned int cmd, unsigned long arg)
diff --git a/drivers/char/drm/drm_vm.c b/drivers/char/drm/drm_vm.c
index b40ae438f531..74686e9a2d34 100644
--- a/drivers/char/drm/drm_vm.c
+++ b/drivers/char/drm/drm_vm.c
@@ -473,6 +473,22 @@ static int drm_mmap_dma(struct file *filp, struct vm_area_struct *vma)
         }
         unlock_kernel();
 
+        if (!capable(CAP_SYS_ADMIN) &&
+            (dma->flags & _DRM_DMA_USE_PCI_RO)) {
+                vma->vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
+#if defined(__i386__) || defined(__x86_64__)
+                pgprot_val(vma->vm_page_prot) &= ~_PAGE_RW;
+#else
+                /* Ye gads this is ugly.  With more thought
+                   we could move this up higher and use
+                   `protection_map' instead.  */
+                vma->vm_page_prot =
+                    __pgprot(pte_val
+                             (pte_wrprotect
+                              (__pte(pgprot_val(vma->vm_page_prot)))));
+#endif
+        }
+
         vma->vm_ops = &drm_vm_dma_ops;
 
         vma->vm_flags |= VM_RESERVED;   /* Don't swap */