Ensure driver has been initialized (dev_private != NULL) before installing

    irq handler in DRM(irq_install). Modify all drivers to ensure irq
    handler is removed before cleanup and cleanup is called at takedown.
    Remove unused buffer private struct fields in i810, i830. Check for
    lock on init/cleanup in all drivers except i810/i830. The current DDX
    for i810 and i830 doesn't hold the lock on kernel init (FIXME?).

31 files changed, 257 insertions, 101 deletions

diff --git a/linux-core/drm_dma.c b/linux-core/drm_dma.c
index 7c1785b4..34ab5322 100644
--- a/linux-core/drm_dma.c
+++ b/linux-core/drm_dma.c
@@ -194,6 +194,13 @@ int DRM(irq_install)( drm_device_t *dev, int irq )
 		return -EINVAL;
 
 	down( &dev->struct_sem );
+
+				/* Driver must have been initialized */
+	if ( !dev->dev_private ) {
+		up( &dev->struct_sem );
+		return -EINVAL;
+	}
+
 	if ( dev->irq ) {
 		up( &dev->struct_sem );
 		return -EBUSY;
diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c
index 30b7dfcf..8e0e8f45 100644
--- a/linux-core/i810_dma.c
+++ b/linux-core/i810_dma.c
@@ -234,11 +234,19 @@ static int i810_dma_get_buffer(drm_device_t *dev, drm_i810_dma_t *d,
 	return retcode;
 }
 
-static int i810_dma_cleanup(drm_device_t *dev)
+int i810_dma_cleanup(drm_device_t *dev)
 {
 	drm_device_dma_t *dma = dev->dma;
 
-	if(dev->dev_private) {
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if (dev->irq) DRM(irq_uninstall)(dev);
+#endif
+
+	if (dev->dev_private) {
 		int i;
 	   	drm_i810_private_t *dev_priv =
 	     		(drm_i810_private_t *) dev->dev_private;
diff --git a/linux-core/i810_drv.h b/linux-core/i810_drv.h
index 27166449..aa82c647 100644
--- a/linux-core/i810_drv.h
+++ b/linux-core/i810_drv.h
@@ -38,8 +38,6 @@ typedef struct drm_i810_buf_priv {
 	int currently_mapped;
 	void *virtual;
 	void *kernel_virtual;
-	int map_count;
-   	struct vm_area_struct *vma;
 } drm_i810_buf_priv_t;
 
 typedef struct _drm_i810_ring_buffer{
@@ -86,6 +84,7 @@ extern int  i810_getbuf(struct inode *inode, struct file *filp,
 			unsigned int cmd, unsigned long arg);
 extern int  i810_dma_init(struct inode *inode, struct file *filp,
 			  unsigned int cmd, unsigned long arg);
+extern int  i810_dma_cleanup(drm_device_t *dev);
 extern int  i810_flush_ioctl(struct inode *inode, struct file *filp,
 			     unsigned int cmd, unsigned long arg);
 extern void i810_reclaim_buffers(struct file *filp);
diff --git a/linux-core/i830_dma.c b/linux-core/i830_dma.c
index d206d5b5..af9c1cb7 100644
--- a/linux-core/i830_dma.c
+++ b/linux-core/i830_dma.c
@@ -234,16 +234,24 @@ static int i830_dma_get_buffer(drm_device_t *dev, drm_i830_dma_t *d,
 	return retcode;
 }
 
-static int i830_dma_cleanup(drm_device_t *dev)
+int i830_dma_cleanup(drm_device_t *dev)
 {
 	drm_device_dma_t *dma = dev->dma;
 
-	if(dev->dev_private) {
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if (dev->irq) DRM(irq_uninstall)(dev);
+#endif
+
+	if (dev->dev_private) {
 		int i;
 	   	drm_i830_private_t *dev_priv = 
 	     		(drm_i830_private_t *) dev->dev_private;
 	   
-	   	if(dev_priv->ring.virtual_start) {
+	   	if (dev_priv->ring.virtual_start) {
 		   	DRM(ioremapfree)((void *) dev_priv->ring.virtual_start,
 					 dev_priv->ring.Size);
 		}
@@ -255,14 +263,6 @@ static int i830_dma_cleanup(drm_device_t *dev)
 		   	I830_WRITE(0x02080, 0x1ffff000);
 		}
 
-		/* Disable interrupts here because after dev_private
-		 * is freed, it's too late.
-		 */
-		if (dev->irq) {
-			I830_WRITE16( I830REG_INT_MASK_R, 0xffff );
-			I830_WRITE16( I830REG_INT_ENABLE_R, 0x0 );
-		}
-
 	   	DRM(free)(dev->dev_private, sizeof(drm_i830_private_t), 
 			 DRM_MEM_DRIVER);
 	   	dev->dev_private = NULL;
diff --git a/linux-core/i830_drv.h b/linux-core/i830_drv.h
index 6b172ece..b611c133 100644
--- a/linux-core/i830_drv.h
+++ b/linux-core/i830_drv.h
@@ -38,8 +38,6 @@ typedef struct drm_i830_buf_priv {
 	int currently_mapped;
 	void *virtual;
 	void *kernel_virtual;
-	int map_count;
-   	struct vm_area_struct *vma;
 } drm_i830_buf_priv_t;
 
 typedef struct _drm_i830_ring_buffer{
@@ -99,6 +97,7 @@ extern int  i830_getbuf(struct inode *inode, struct file *filp,
 			unsigned int cmd, unsigned long arg);
 extern int  i830_dma_init(struct inode *inode, struct file *filp,
 			  unsigned int cmd, unsigned long arg);
+extern int  i830_dma_cleanup(drm_device_t *dev);
 extern int  i830_flush_ioctl(struct inode *inode, struct file *filp,
 			     unsigned int cmd, unsigned long arg);
 extern void i830_reclaim_buffers(struct file *filp);
diff --git a/linux-core/i830_irq.c b/linux-core/i830_irq.c
index cedafc0d..1fcd9f0a 100644
--- a/linux-core/i830_irq.c
+++ b/linux-core/i830_irq.c
@@ -41,12 +41,12 @@ void DRM(dma_service)(int irq, void *device, struct pt_regs *regs)
 	drm_device_t	 *dev = (drm_device_t *)device;
       	drm_i830_private_t *dev_priv = (drm_i830_private_t *)dev->dev_private;
    	u16 temp;
-   
+
       	temp = I830_READ16(I830REG_INT_IDENTITY_R);
-	printk("%s: %x\n", __FUNCTION__, temp);
-	
-   	if(temp == 0) 
-	   return;
+	DRM_DEBUG("%x\n", temp);
+
+   	if (temp == 0) 
+		return;
 
 	I830_WRITE16(I830REG_INT_IDENTITY_R, temp); 
 
@@ -176,3 +176,34 @@ int i830_irq_wait( struct inode *inode, struct file *filp, unsigned int cmd,
 	return i830_wait_irq( dev, irqwait.irq_seq );
 }
 
+
+/* drm_dma.h hooks
+*/
+void DRM(driver_irq_preinstall)( drm_device_t *dev ) {
+	drm_i830_private_t *dev_priv =
+		(drm_i830_private_t *)dev->dev_private;
+
+	I830_WRITE16( I830REG_HWSTAM, 0xffff );
+	I830_WRITE16( I830REG_INT_MASK_R, 0x0 );
+	I830_WRITE16( I830REG_INT_ENABLE_R, 0x0 );
+}
+
+void DRM(driver_irq_postinstall)( drm_device_t *dev ) {
+	drm_i830_private_t *dev_priv =
+		(drm_i830_private_t *)dev->dev_private;
+
+	I830_WRITE16( I830REG_INT_ENABLE_R, 0x2 );
+	atomic_set(&dev_priv->irq_received, 0);
+	atomic_set(&dev_priv->irq_emitted, 0);
+	init_waitqueue_head(&dev_priv->irq_queue);
+}
+
+void DRM(driver_irq_uninstall)( drm_device_t *dev ) {
+	drm_i830_private_t *dev_priv =
+		(drm_i830_private_t *)dev->dev_private;
+	if (!dev_priv)
+		return;
+
+	I830_WRITE16( I830REG_INT_MASK_R, 0xffff );
+	I830_WRITE16( I830REG_INT_ENABLE_R, 0x0 );
+}
diff --git a/linux/drm_dma.h b/linux/drm_dma.h
index 7c1785b4..34ab5322 100644
--- a/linux/drm_dma.h
+++ b/linux/drm_dma.h
@@ -194,6 +194,13 @@ int DRM(irq_install)( drm_device_t *dev, int irq )
 		return -EINVAL;
 
 	down( &dev->struct_sem );
+
+				/* Driver must have been initialized */
+	if ( !dev->dev_private ) {
+		up( &dev->struct_sem );
+		return -EINVAL;
+	}
+
 	if ( dev->irq ) {
 		up( &dev->struct_sem );
 		return -EBUSY;
diff --git a/linux/gamma.h b/linux/gamma.h
index da8f52bb..54dafcfc 100644
--- a/linux/gamma.h
+++ b/linux/gamma.h
@@ -63,6 +63,12 @@
 #define __HAVE_COUNTER9		_DRM_STAT_SPECIAL
 #define __HAVE_COUNTER10	_DRM_STAT_MISSED
 
+/* Driver customization:
+ */
+#define DRIVER_PRETAKEDOWN() do {					\
+	gamma_do_cleanup_dma( dev );					\
+} while (0)
+
 /* DMA customization:
  */
 #define __HAVE_DMA			1
diff --git a/linux/gamma_dma.c b/linux/gamma_dma.c
index 691c55a4..0aacc4e9 100644
--- a/linux/gamma_dma.c
+++ b/linux/gamma_dma.c
@@ -645,6 +645,14 @@ int gamma_do_cleanup_dma( drm_device_t *dev )
 {
 	DRM_DEBUG( "%s\n", __FUNCTION__ );
 
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_gamma_private_t *dev_priv = dev->dev_private;
 
@@ -666,6 +674,8 @@ int gamma_dma_init( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_gamma_init_t init;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	if ( copy_from_user( &init, (drm_gamma_init_t *)arg, sizeof(init) ) )
 		return -EFAULT;
 
@@ -838,6 +848,8 @@ void DRM(driver_irq_postinstall)( drm_device_t *dev ) {
 void DRM(driver_irq_uninstall)( drm_device_t *dev ) {
 	drm_gamma_private_t *dev_priv =
 				(drm_gamma_private_t *)dev->dev_private;
+	if (!dev_priv)
+		return;
 
 	while(GAMMA_READ(GAMMA_INFIFOSPACE) < 3);
 
diff --git a/linux/gamma_drv.h b/linux/gamma_drv.h
index fc91993f..fc78a11a 100644
--- a/linux/gamma_drv.h
+++ b/linux/gamma_drv.h
@@ -49,6 +49,7 @@ extern int gamma_dma_init( struct inode *inode, struct file *filp,
 extern int gamma_dma_copy( struct inode *inode, struct file *filp,
 			 unsigned int cmd, unsigned long arg );
 
+extern int gamma_do_cleanup_dma( drm_device_t *dev );
 extern void gamma_dma_ready(drm_device_t *dev);
 extern void gamma_dma_quiescent_single(drm_device_t *dev);
 extern void gamma_dma_quiescent_dual(drm_device_t *dev);
diff --git a/linux/i810.h b/linux/i810.h
index 72cbed32..bfb760ab 100644
--- a/linux/i810.h
+++ b/linux/i810.h
@@ -86,7 +86,11 @@
  */
 #define __HAVE_RELEASE		1
 #define DRIVER_RELEASE() do {						\
-	i810_reclaim_buffers( filp );				\
+	i810_reclaim_buffers( filp );					\
+} while (0)
+
+#define DRIVER_PRETAKEDOWN() do {					\
+	i810_dma_cleanup( dev );					\
 } while (0)
 
 /* DMA customization:
@@ -104,6 +108,7 @@
 /* Don't need an irq any more.  The template code will make sure that
  * a noop stub is generated for compatibility.
  */
+/* XXX: Add vblank support? */
 #define __HAVE_DMA_IRQ		0
 
 /* Buffer customization:
diff --git a/linux/i810_dma.c b/linux/i810_dma.c
index 30b7dfcf..8e0e8f45 100644
--- a/linux/i810_dma.c
+++ b/linux/i810_dma.c
@@ -234,11 +234,19 @@ static int i810_dma_get_buffer(drm_device_t *dev, drm_i810_dma_t *d,
 	return retcode;
 }
 
-static int i810_dma_cleanup(drm_device_t *dev)
+int i810_dma_cleanup(drm_device_t *dev)
 {
 	drm_device_dma_t *dma = dev->dma;
 
-	if(dev->dev_private) {
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if (dev->irq) DRM(irq_uninstall)(dev);
+#endif
+
+	if (dev->dev_private) {
 		int i;
 	   	drm_i810_private_t *dev_priv =
 	     		(drm_i810_private_t *) dev->dev_private;
diff --git a/linux/i810_drv.h b/linux/i810_drv.h
index 27166449..aa82c647 100644
--- a/linux/i810_drv.h
+++ b/linux/i810_drv.h
@@ -38,8 +38,6 @@ typedef struct drm_i810_buf_priv {
 	int currently_mapped;
 	void *virtual;
 	void *kernel_virtual;
-	int map_count;
-   	struct vm_area_struct *vma;
 } drm_i810_buf_priv_t;
 
 typedef struct _drm_i810_ring_buffer{
@@ -86,6 +84,7 @@ extern int  i810_getbuf(struct inode *inode, struct file *filp,
 			unsigned int cmd, unsigned long arg);
 extern int  i810_dma_init(struct inode *inode, struct file *filp,
 			  unsigned int cmd, unsigned long arg);
+extern int  i810_dma_cleanup(drm_device_t *dev);
 extern int  i810_flush_ioctl(struct inode *inode, struct file *filp,
 			     unsigned int cmd, unsigned long arg);
 extern void i810_reclaim_buffers(struct file *filp);
diff --git a/linux/i830.h b/linux/i830.h
index 432397a8..5775162a 100644
--- a/linux/i830.h
+++ b/linux/i830.h
@@ -87,7 +87,11 @@
  */
 #define __HAVE_RELEASE		1
 #define DRIVER_RELEASE() do {						\
-	i830_reclaim_buffers( filp );				\
+	i830_reclaim_buffers( filp );					\
+} while (0)
+
+#define DRIVER_PRETAKEDOWN() do {					\
+	i830_dma_cleanup( dev );					\
 } while (0)
 
 /* DMA customization:
@@ -107,45 +111,17 @@
  * the card, but are subject to subtle interactions between bios,
  * hardware and the driver.
  */
+/* XXX: Add vblank support? */
 #define USE_IRQS 0
 
-
 #if USE_IRQS
 #define __HAVE_DMA_IRQ		1
 #define __HAVE_SHARED_IRQ	1
-
-#define DRIVER_PREINSTALL() do {			\
-	drm_i830_private_t *dev_priv =			\
-		(drm_i830_private_t *)dev->dev_private;	\
-							\
-   	I830_WRITE16( I830REG_HWSTAM, 0xffff );	\
-        I830_WRITE16( I830REG_INT_MASK_R, 0x0 );	\
-      	I830_WRITE16( I830REG_INT_ENABLE_R, 0x0 );	\
-} while (0)
-
-
-#define DRIVER_POSTINSTALL() do {				\
-	drm_i830_private_t *dev_priv =				\
-		(drm_i830_private_t *)dev->dev_private;		\
-   	I830_WRITE16( I830REG_INT_ENABLE_R, 0x2 );		\
-   	atomic_set(&dev_priv->irq_received, 0);			\
-   	atomic_set(&dev_priv->irq_emitted, 0);			\
-	init_waitqueue_head(&dev_priv->irq_queue);		\
-} while (0)
-
-
-/* This gets called too late to be useful: dev_priv has already been
- * freed.
- */
-#define DRIVER_UNINSTALL() do {					\
-} while (0)
-
 #else
 #define __HAVE_DMA_IRQ          0
 #endif
 
 
-
 /* Buffer customization:
  */
 
diff --git a/linux/i830_dma.c b/linux/i830_dma.c
index d206d5b5..af9c1cb7 100644
--- a/linux/i830_dma.c
+++ b/linux/i830_dma.c
@@ -234,16 +234,24 @@ static int i830_dma_get_buffer(drm_device_t *dev, drm_i830_dma_t *d,
 	return retcode;
 }
 
-static int i830_dma_cleanup(drm_device_t *dev)
+int i830_dma_cleanup(drm_device_t *dev)
 {
 	drm_device_dma_t *dma = dev->dma;
 
-	if(dev->dev_private) {
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if (dev->irq) DRM(irq_uninstall)(dev);
+#endif
+
+	if (dev->dev_private) {
 		int i;
 	   	drm_i830_private_t *dev_priv = 
 	     		(drm_i830_private_t *) dev->dev_private;
 	   
-	   	if(dev_priv->ring.virtual_start) {
+	   	if (dev_priv->ring.virtual_start) {
 		   	DRM(ioremapfree)((void *) dev_priv->ring.virtual_start,
 					 dev_priv->ring.Size);
 		}
@@ -255,14 +263,6 @@ static int i830_dma_cleanup(drm_device_t *dev)
 		   	I830_WRITE(0x02080, 0x1ffff000);
 		}
 
-		/* Disable interrupts here because after dev_private
-		 * is freed, it's too late.
-		 */
-		if (dev->irq) {
-			I830_WRITE16( I830REG_INT_MASK_R, 0xffff );
-			I830_WRITE16( I830REG_INT_ENABLE_R, 0x0 );
-		}
-
 	   	DRM(free)(dev->dev_private, sizeof(drm_i830_private_t), 
 			 DRM_MEM_DRIVER);
 	   	dev->dev_private = NULL;
diff --git a/linux/i830_drv.h b/linux/i830_drv.h
index 6b172ece..b611c133 100644
--- a/linux/i830_drv.h
+++ b/linux/i830_drv.h
@@ -38,8 +38,6 @@ typedef struct drm_i830_buf_priv {
 	int currently_mapped;
 	void *virtual;
 	void *kernel_virtual;
-	int map_count;
-   	struct vm_area_struct *vma;
 } drm_i830_buf_priv_t;
 
 typedef struct _drm_i830_ring_buffer{
@@ -99,6 +97,7 @@ extern int  i830_getbuf(struct inode *inode, struct file *filp,
 			unsigned int cmd, unsigned long arg);
 extern int  i830_dma_init(struct inode *inode, struct file *filp,
 			  unsigned int cmd, unsigned long arg);
+extern int  i830_dma_cleanup(drm_device_t *dev);
 extern int  i830_flush_ioctl(struct inode *inode, struct file *filp,
 			     unsigned int cmd, unsigned long arg);
 extern void i830_reclaim_buffers(struct file *filp);
diff --git a/linux/i830_irq.c b/linux/i830_irq.c
index cedafc0d..1fcd9f0a 100644
--- a/linux/i830_irq.c
+++ b/linux/i830_irq.c
@@ -41,12 +41,12 @@ void DRM(dma_service)(int irq, void *device, struct pt_regs *regs)
 	drm_device_t	 *dev = (drm_device_t *)device;
       	drm_i830_private_t *dev_priv = (drm_i830_private_t *)dev->dev_private;
    	u16 temp;
-   
+
       	temp = I830_READ16(I830REG_INT_IDENTITY_R);
-	printk("%s: %x\n", __FUNCTION__, temp);
-	
-   	if(temp == 0) 
-	   return;
+	DRM_DEBUG("%x\n", temp);
+
+   	if (temp == 0) 
+		return;
 
 	I830_WRITE16(I830REG_INT_IDENTITY_R, temp); 
 
@@ -176,3 +176,34 @@ int i830_irq_wait( struct inode *inode, struct file *filp, unsigned int cmd,
 	return i830_wait_irq( dev, irqwait.irq_seq );
 }
 
+
+/* drm_dma.h hooks
+*/
+void DRM(driver_irq_preinstall)( drm_device_t *dev ) {
+	drm_i830_private_t *dev_priv =
+		(drm_i830_private_t *)dev->dev_private;
+
+	I830_WRITE16( I830REG_HWSTAM, 0xffff );
+	I830_WRITE16( I830REG_INT_MASK_R, 0x0 );
+	I830_WRITE16( I830REG_INT_ENABLE_R, 0x0 );
+}
+
+void DRM(driver_irq_postinstall)( drm_device_t *dev ) {
+	drm_i830_private_t *dev_priv =
+		(drm_i830_private_t *)dev->dev_private;
+
+	I830_WRITE16( I830REG_INT_ENABLE_R, 0x2 );
+	atomic_set(&dev_priv->irq_received, 0);
+	atomic_set(&dev_priv->irq_emitted, 0);
+	init_waitqueue_head(&dev_priv->irq_queue);
+}
+
+void DRM(driver_irq_uninstall)( drm_device_t *dev ) {
+	drm_i830_private_t *dev_priv =
+		(drm_i830_private_t *)dev->dev_private;
+	if (!dev_priv)
+		return;
+
+	I830_WRITE16( I830REG_INT_MASK_R, 0xffff );
+	I830_WRITE16( I830REG_INT_ENABLE_R, 0x0 );
+}
diff --git a/shared-core/mga_dma.c b/shared-core/mga_dma.c
index 96fd97ff..71b9f3a3 100644
--- a/shared-core/mga_dma.c
+++ b/shared-core/mga_dma.c
@@ -639,6 +639,14 @@ int mga_do_cleanup_dma( drm_device_t *dev )
 {
 	DRM_DEBUG( "\n" );
 
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_mga_private_t *dev_priv = dev->dev_private;
 
@@ -666,6 +674,8 @@ int mga_dma_init( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_mga_init_t init;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared-core/mga_irq.c b/shared-core/mga_irq.c
index 28e9a262..a2a4db53 100644
--- a/shared-core/mga_irq.c
+++ b/shared-core/mga_irq.c
@@ -93,8 +93,9 @@ void mga_driver_irq_postinstall( drm_device_t *dev ) {
 void mga_driver_irq_uninstall( drm_device_t *dev ) {
   	drm_mga_private_t *dev_priv = 
 	   (drm_mga_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		MGA_WRITE( MGA_IEN, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	MGA_WRITE( MGA_IEN, 0 );
 }
diff --git a/shared-core/r128_cce.c b/shared-core/r128_cce.c
index ad03f4f9..608b7da6 100644
--- a/shared-core/r128_cce.c
+++ b/shared-core/r128_cce.c
@@ -613,6 +613,15 @@ static int r128_do_init_cce( drm_device_t *dev, drm_r128_init_t *init )
 
 int r128_do_cleanup_cce( drm_device_t *dev )
 {
+
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_r128_private_t *dev_priv = dev->dev_private;
 
@@ -649,6 +658,8 @@ int r128_cce_init( DRM_IOCTL_ARGS )
 
 	DRM_DEBUG( "\n" );
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared-core/r128_irq.c b/shared-core/r128_irq.c
index bfc30405..f3f84d8c 100644
--- a/shared-core/r128_irq.c
+++ b/shared-core/r128_irq.c
@@ -93,8 +93,9 @@ void r128_driver_irq_postinstall( drm_device_t *dev ) {
 void r128_driver_irq_uninstall( drm_device_t *dev ) {
   	drm_r128_private_t *dev_priv = 
 	   (drm_r128_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		R128_WRITE( R128_GEN_INT_CNTL, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	R128_WRITE( R128_GEN_INT_CNTL, 0 );
 }
diff --git a/shared-core/radeon_cp.c b/shared-core/radeon_cp.c
index fce148a0..281b0cf0 100644
--- a/shared-core/radeon_cp.c
+++ b/shared-core/radeon_cp.c
@@ -1266,6 +1266,14 @@ int radeon_do_cleanup_cp( drm_device_t *dev )
 {
 	DRM_DEBUG( "\n" );
 
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_radeon_private_t *dev_priv = dev->dev_private;
 
@@ -1298,6 +1306,8 @@ int radeon_cp_init( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_radeon_init_t init;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared-core/radeon_irq.c b/shared-core/radeon_irq.c
index 9199fbbf..c6bd90e5 100644
--- a/shared-core/radeon_irq.c
+++ b/shared-core/radeon_irq.c
@@ -249,8 +249,9 @@ void DRM(driver_irq_postinstall)( drm_device_t *dev ) {
 void DRM(driver_irq_uninstall)( drm_device_t *dev ) {
 	drm_radeon_private_t *dev_priv =
 		(drm_radeon_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		RADEON_WRITE( RADEON_GEN_INT_CNTL, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	RADEON_WRITE( RADEON_GEN_INT_CNTL, 0 );
 }
diff --git a/shared/mga.h b/shared/mga.h
index 49530442..96179627 100644
--- a/shared/mga.h
+++ b/shared/mga.h
@@ -72,7 +72,7 @@
 /* Driver customization:
  */
 #define DRIVER_PRETAKEDOWN() do {					\
-	if ( dev->dev_private ) mga_do_cleanup_dma( dev );		\
+	mga_do_cleanup_dma( dev );					\
 } while (0)
 
 /* DMA customization:
diff --git a/shared/mga_dma.c b/shared/mga_dma.c
index 96fd97ff..71b9f3a3 100644
--- a/shared/mga_dma.c
+++ b/shared/mga_dma.c
@@ -639,6 +639,14 @@ int mga_do_cleanup_dma( drm_device_t *dev )
 {
 	DRM_DEBUG( "\n" );
 
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_mga_private_t *dev_priv = dev->dev_private;
 
@@ -666,6 +674,8 @@ int mga_dma_init( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_mga_init_t init;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared/mga_irq.c b/shared/mga_irq.c
index 28e9a262..a2a4db53 100644
--- a/shared/mga_irq.c
+++ b/shared/mga_irq.c
@@ -93,8 +93,9 @@ void mga_driver_irq_postinstall( drm_device_t *dev ) {
 void mga_driver_irq_uninstall( drm_device_t *dev ) {
   	drm_mga_private_t *dev_priv = 
 	   (drm_mga_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		MGA_WRITE( MGA_IEN, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	MGA_WRITE( MGA_IEN, 0 );
 }
diff --git a/shared/r128.h b/shared/r128.h
index 29b26cd2..f23f46ee 100644
--- a/shared/r128.h
+++ b/shared/r128.h
@@ -85,7 +85,7 @@
 } while (0)
 
 #define DRIVER_PRETAKEDOWN() do {					\
-	if ( dev->dev_private ) r128_do_cleanup_cce( dev );		\
+	r128_do_cleanup_cce( dev );					\
 } while (0)
 
 /* DMA customization:
diff --git a/shared/r128_cce.c b/shared/r128_cce.c
index ad03f4f9..608b7da6 100644
--- a/shared/r128_cce.c
+++ b/shared/r128_cce.c
@@ -613,6 +613,15 @@ static int r128_do_init_cce( drm_device_t *dev, drm_r128_init_t *init )
 
 int r128_do_cleanup_cce( drm_device_t *dev )
 {
+
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_r128_private_t *dev_priv = dev->dev_private;
 
@@ -649,6 +658,8 @@ int r128_cce_init( DRM_IOCTL_ARGS )
 
 	DRM_DEBUG( "\n" );
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared/r128_irq.c b/shared/r128_irq.c
index bfc30405..f3f84d8c 100644
--- a/shared/r128_irq.c
+++ b/shared/r128_irq.c
@@ -93,8 +93,9 @@ void r128_driver_irq_postinstall( drm_device_t *dev ) {
 void r128_driver_irq_uninstall( drm_device_t *dev ) {
   	drm_r128_private_t *dev_priv = 
 	   (drm_r128_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		R128_WRITE( R128_GEN_INT_CNTL, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	R128_WRITE( R128_GEN_INT_CNTL, 0 );
 }
diff --git a/shared/radeon_cp.c b/shared/radeon_cp.c
index fce148a0..281b0cf0 100644
--- a/shared/radeon_cp.c
+++ b/shared/radeon_cp.c
@@ -1266,6 +1266,14 @@ int radeon_do_cleanup_cp( drm_device_t *dev )
 {
 	DRM_DEBUG( "\n" );
 
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_radeon_private_t *dev_priv = dev->dev_private;
 
@@ -1298,6 +1306,8 @@ int radeon_cp_init( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_radeon_init_t init;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared/radeon_irq.c b/shared/radeon_irq.c
index 9199fbbf..c6bd90e5 100644
--- a/shared/radeon_irq.c
+++ b/shared/radeon_irq.c
@@ -249,8 +249,9 @@ void DRM(driver_irq_postinstall)( drm_device_t *dev ) {
 void DRM(driver_irq_uninstall)( drm_device_t *dev ) {
 	drm_radeon_private_t *dev_priv =
 		(drm_radeon_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		RADEON_WRITE( RADEON_GEN_INT_CNTL, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	RADEON_WRITE( RADEON_GEN_INT_CNTL, 0 );
 }