Index: dev/drm/drm_irq.c
===================================================================
--- dev/drm/drm_irq.c	(revision 190481)
+++ dev/drm/drm_irq.c	(working copy)
@@ -70,6 +70,9 @@
 	struct drm_device *dev = (struct drm_device *)arg;
 	int i;
 
+	/* Make sure that we are called with the lock held */
+	mtx_assert(&dev->vbl_lock, MA_OWNED);
+
 	if (callout_pending(&dev->vblank_disable_timer)) {
 		/* callout was reset */
 		return;
@@ -86,8 +89,8 @@
 		return;
 
 	for (i = 0; i < dev->num_crtcs; i++) {
-		if (atomic_read(&dev->vblank[i].refcount) == 0 &&
-		    dev->vblank[i].enabled && !dev->vblank[i].inmodeset) {
+		if (dev->vblank[i].refcount == 0 &&
+		    dev->vblank[i].enabled) {
 			DRM_DEBUG("disabling vblank on crtc %d\n", i);
 			dev->vblank[i].last =
 			    dev->driver->get_vblank_counter(dev, i);
@@ -95,6 +98,7 @@
 			dev->vblank[i].enabled = 0;
 		}
 	}
+	DRM_DEBUG("complete\n");
 }
 
 void drm_vblank_cleanup(struct drm_device *dev)
@@ -109,7 +113,9 @@
 
 	callout_drain(&dev->vblank_disable_timer);
 
+	DRM_SPINLOCK(&dev->vbl_lock);
 	vblank_disable_fn((void *)dev);
+	DRM_SPINUNLOCK(&dev->vbl_lock);
 
 	free(dev->vblank, DRM_MEM_DRIVER);
 
@@ -132,14 +138,15 @@
 	DRM_DEBUG("\n");
 
 	/* Zero per-crtc vblank stuff */
+	DRM_SPINLOCK(&dev->vbl_lock);
 	for (i = 0; i < num_crtcs; i++) {
 		DRM_INIT_WAITQUEUE(&dev->vblank[i].queue);
 		TAILQ_INIT(&dev->vblank[i].sigs);
-		atomic_set(&dev->vblank[i].count, 0);
-		atomic_set(&dev->vblank[i].refcount, 0);
+		dev->vblank[i].refcount = 0;
+		atomic_set_acq_32(&dev->vblank[i].count, 0);
 	}
-
 	dev->vblank_disable_allowed = 0;
+	DRM_SPINUNLOCK(&dev->vbl_lock);
 
 	return 0;
 
@@ -150,7 +157,7 @@
 
 int drm_irq_install(struct drm_device *dev)
 {
-	int crtc, retcode;
+	int retcode;
 
 	if (dev->irq == 0 || dev->dev_private == NULL)
 		return EINVAL;
@@ -187,17 +194,6 @@
 	DRM_LOCK();
 	dev->driver->irq_postinstall(dev);
 	DRM_UNLOCK();
-	if (dev->driver->enable_vblank) {
-		DRM_SPINLOCK(&dev->vbl_lock);
-		for( crtc = 0 ; crtc < dev->num_crtcs ; crtc++) {
-			if (dev->driver->enable_vblank(dev, crtc) == 0) {
-				dev->vblank[crtc].enabled = 1;
-			}
-		}
-		callout_reset(&dev->vblank_disable_timer, 5 * DRM_HZ,
-		    (timeout_t *)vblank_disable_fn, (void *)dev);
-		DRM_SPINUNLOCK(&dev->vbl_lock);
-	}
 
 	return 0;
 err:
@@ -212,6 +208,8 @@
 {
 	int crtc;
 
+	DRM_SPINLOCK_ASSERT(&dev->dev_lock);
+
 	if (!dev->irq_enabled)
 		return EINVAL;
 
@@ -231,12 +229,13 @@
 	}
 	DRM_SPINUNLOCK(&dev->vbl_lock);
 
-	DRM_DEBUG("irq=%d\n", dev->irq);
-
 	dev->driver->irq_uninstall(dev);
+	DRM_UNLOCK();
 
-	DRM_UNLOCK();
 	bus_teardown_intr(dev->device, dev->irqr, dev->irqh);
+
+	DRM_DEBUG("irq=%d, uninstall complete\n", dev->irq);
+
 	DRM_LOCK();
 
 	return 0;
@@ -272,7 +271,7 @@
 
 u32 drm_vblank_count(struct drm_device *dev, int crtc)
 {
-	return atomic_read(&dev->vblank[crtc].count);
+	return atomic_load_acq_32(&dev->vblank[crtc].count);
 }
 
 static void drm_update_vblank_count(struct drm_device *dev, int crtc)
@@ -298,45 +297,49 @@
 	DRM_DEBUG("enabling vblank interrupts on crtc %d, missed %d\n",
 	    crtc, diff);
 
-	atomic_add(diff, &dev->vblank[crtc].count);
+	atomic_add_rel_32(&dev->vblank[crtc].count, diff);
 }
 
 int drm_vblank_get(struct drm_device *dev, int crtc)
 {
 	int ret = 0;
 
-	DRM_SPINLOCK(&dev->vbl_lock);
+	/* Make sure that we are called with the lock held */
+	mtx_assert(&dev->vbl_lock, MA_OWNED);
+
 	/* Going from 0->1 means we have to enable interrupts again */
-	atomic_add_acq_int(&dev->vblank[crtc].refcount, 1);
-	if (dev->vblank[crtc].refcount == 1 &&
+	if (++dev->vblank[crtc].refcount == 1 &&
 	    !dev->vblank[crtc].enabled) {
 		ret = dev->driver->enable_vblank(dev, crtc);
 		DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret);
 		if (ret)
-			atomic_dec(&dev->vblank[crtc].refcount);
+			--dev->vblank[crtc].refcount;
 		else {
 			dev->vblank[crtc].enabled = 1;
 			drm_update_vblank_count(dev, crtc);
 		}
 	}
-	DRM_SPINUNLOCK(&dev->vbl_lock);
 
+	if (dev->vblank[crtc].enabled) {
+		dev->vblank[crtc].last =
+		    dev->driver->get_vblank_counter(dev, crtc);
+	}
+
 	return ret;
 }
 
 void drm_vblank_put(struct drm_device *dev, int crtc)
 {
-	KASSERT(atomic_read(&dev->vblank[crtc].refcount) > 0,
+	/* Make sure that we are called with the lock held */
+	mtx_assert(&dev->vbl_lock, MA_OWNED);
+
+	KASSERT(dev->vblank[crtc].refcount > 0,
 	    ("invalid refcount"));
 
 	/* Last user schedules interrupt disable */
-	atomic_subtract_acq_int(&dev->vblank[crtc].refcount, 1);
-
-	DRM_SPINLOCK(&dev->vbl_lock);
-	if (dev->vblank[crtc].refcount == 0)
+	if (--dev->vblank[crtc].refcount == 0)
 	    callout_reset(&dev->vblank_disable_timer, 5 * DRM_HZ,
 		(timeout_t *)vblank_disable_fn, (void *)dev);
-	DRM_SPINUNLOCK(&dev->vbl_lock);
 }
 
 int drm_modeset_ctl(struct drm_device *dev, void *data,
@@ -345,13 +348,11 @@
 	struct drm_modeset_ctl *modeset = data;
 	int crtc, ret = 0;
 
-	DRM_DEBUG("num_crtcs=%d\n", dev->num_crtcs);
 	/* If drm_vblank_init() hasn't been called yet, just no-op */
 	if (!dev->num_crtcs)
 		goto out;
 
 	crtc = modeset->crtc;
-	DRM_DEBUG("crtc=%d\n", crtc);
 	if (crtc >= dev->num_crtcs) {
 		ret = EINVAL;
 		goto out;
@@ -366,25 +367,25 @@
 	 */
 	switch (modeset->cmd) {
 	case _DRM_PRE_MODESET:
-		DRM_DEBUG("pre-modeset\n");
+		DRM_DEBUG("pre-modeset, crtc %d\n", crtc);
+		DRM_SPINLOCK(&dev->vbl_lock);
 		if (!dev->vblank[crtc].inmodeset) {
 			dev->vblank[crtc].inmodeset = 0x1;
 			if (drm_vblank_get(dev, crtc) == 0)
 				dev->vblank[crtc].inmodeset |= 0x2;
 		}
+		DRM_SPINUNLOCK(&dev->vbl_lock);
 		break;
 	case _DRM_POST_MODESET:
-		DRM_DEBUG("post-modeset\n");
+		DRM_DEBUG("post-modeset, crtc %d\n", crtc);
+		DRM_SPINLOCK(&dev->vbl_lock);
 		if (dev->vblank[crtc].inmodeset) {
-			DRM_SPINLOCK(&dev->vbl_lock);
-			dev->vblank_disable_allowed = 1;
-			DRM_SPINUNLOCK(&dev->vbl_lock);
-
 			if (dev->vblank[crtc].inmodeset & 0x2)
 				drm_vblank_put(dev, crtc);
-
 			dev->vblank[crtc].inmodeset = 0;
 		}
+		dev->vblank_disable_allowed = 1;
+		DRM_SPINUNLOCK(&dev->vbl_lock);
 		break;
 	default:
 		ret = EINVAL;
@@ -418,7 +419,9 @@
 	if (crtc >= dev->num_crtcs)
 		return EINVAL;
 
+	DRM_SPINLOCK(&dev->vbl_lock);
 	ret = drm_vblank_get(dev, crtc);
+	DRM_SPINUNLOCK(&dev->vbl_lock);
 	if (ret) {
 		DRM_ERROR("failed to acquire vblank counter, %d\n", ret);
 		return ret;
@@ -463,7 +466,6 @@
 	} else {
 		DRM_DEBUG("waiting on vblank count %d, crtc %d\n",
 		    vblwait->request.sequence, crtc);
-		dev->vblank[crtc].last = vblwait->request.sequence;
 		for ( ret = 0 ; !ret && !(((drm_vblank_count(dev, crtc) -
 		    vblwait->request.sequence) <= (1 << 23)) ||
 		    !dev->irq_enabled) ; ) {
@@ -477,6 +479,10 @@
 			mtx_unlock(&dev->irq_lock);
 		}
 
+		if (ret == EWOULDBLOCK) {
+			DRM_DEBUG("timed out waiting on vblank\n");
+			/* ret = EBUSY; */
+		}
 		if (ret != EINTR && ret != ERESTART) {
 			struct timeval now;
 
@@ -492,7 +498,9 @@
 	}
 
 done:
+	DRM_SPINLOCK(&dev->vbl_lock);
 	drm_vblank_put(dev, crtc);
+	DRM_SPINUNLOCK(&dev->vbl_lock);
 	return ret;
 }
 
@@ -526,7 +534,7 @@
 
 void drm_handle_vblank(struct drm_device *dev, int crtc)
 {
-	atomic_inc(&dev->vblank[crtc].count);
+	atomic_add_rel_32(&dev->vblank[crtc].count, 1);
 	DRM_WAKEUP(&dev->vblank[crtc].queue);
 	drm_vbl_send_signals(dev, crtc);
 }
Index: dev/drm/i915_irq.c
===================================================================
--- dev/drm/i915_irq.c	(revision 190481)
+++ dev/drm/i915_irq.c	(working copy)
@@ -154,7 +154,7 @@
 	low_frame = pipe ? PIPEBFRAMEPIXEL : PIPEAFRAMEPIXEL;
 
 	if (!i915_pipe_enabled(dev, pipe)) {
-		DRM_ERROR("trying to get vblank count for disabled pipe %d\n", pipe);
+		DRM_DEBUG("trying to get vblank count for disabled pipe %d\n", pipe);
 		return 0;
 	}
 
@@ -183,7 +183,7 @@
 	int reg = pipe ? PIPEB_FRMCOUNT_GM45 : PIPEA_FRMCOUNT_GM45;
 
 	if (!i915_pipe_enabled(dev, pipe)) {
-		DRM_ERROR("trying to get vblank count for disabled pipe %d\n", pipe);
+		DRM_DEBUG("trying to get vblank count for disabled pipe %d\n", pipe);
 		return 0;
 	}
 
@@ -205,7 +205,7 @@
 	iir = I915_READ(IIR);
 
 	if (IS_I965G(dev)) {
-		vblank_status = I915_START_VBLANK_INTERRUPT_STATUS;
+		vblank_status = PIPE_START_VBLANK_INTERRUPT_STATUS;
 		vblank_enable = PIPE_START_VBLANK_INTERRUPT_ENABLE;
 	} else {
 		vblank_status = I915_VBLANK_INTERRUPT_STATUS;
@@ -343,6 +343,9 @@
 
 	DRM_DEBUG("irq_nr=%d breadcrumb=%d\n", irq_nr,
 		  READ_BREADCRUMB(dev_priv));
+	DRM_DEBUG("ier: %08x, imr: %08x, pipeastat: %08x, pipebstat: %08x\n",
+	    I915_READ(IER), I915_READ(IER),
+	    I915_READ(PIPEASTAT), I915_READ(PIPEBSTAT));
 
 	i915_user_irq_get(dev);
 	DRM_WAIT_ON(ret, dev_priv->irq_queue, 3 * DRM_HZ,
@@ -352,7 +355,8 @@
 	if (ret == -ERESTART)
 		DRM_DEBUG("restarting syscall\n");
 
-	if (ret == -EBUSY) {
+	if (ret == -EWOULDBLOCK) {
+		/* ret = -EBUSY; */
 		DRM_ERROR("EBUSY -- rec: %d emitted: %d\n",
 			  READ_BREADCRUMB(dev_priv), (int)dev_priv->counter);
 	}
@@ -408,11 +412,8 @@
 int i915_enable_vblank(struct drm_device *dev, int pipe)
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-	int pipeconf_reg = (pipe == 0) ? PIPEACONF : PIPEBCONF;
-	u32 pipeconf;
 
-	pipeconf = I915_READ(pipeconf_reg);
-	if (!(pipeconf & PIPEACONF_ENABLE))
+	if (!i915_pipe_enabled(dev, pipe))
 		return -EINVAL;
 
 	DRM_SPINLOCK(&dev_priv->user_irq_lock);
@@ -503,8 +504,6 @@
 	atomic_set_int(&dev_priv->irq_received, 0);
 
 	I915_WRITE(HWSTAM, 0xeffe);
-	I915_WRITE(PIPEASTAT, 0);
-	I915_WRITE(PIPEBSTAT, 0);
 	I915_WRITE(IMR, 0xffffffff);
 	I915_WRITE(IER, 0x0);
 	(void) I915_READ(IER);
@@ -521,12 +520,14 @@
 	/* Unmask the interrupts that we always want on. */
 	dev_priv->irq_mask_reg = ~I915_INTERRUPT_ENABLE_FIX;
 
-	dev_priv->pipestat[0] = 0;
-	dev_priv->pipestat[1] = 0;
-
 	/* Disable pipe interrupt enables, clear pending pipe status */
-	I915_WRITE(PIPEASTAT, I915_READ(PIPEASTAT) & 0x8000ffff);
-	I915_WRITE(PIPEBSTAT, I915_READ(PIPEBSTAT) & 0x8000ffff);
+	/*
+	 * If you driver is going to be brain-damaged and setup
+	 * vblank interrupts before you install the handler, then
+	 * you can't nuke it here.
+	 */ 
+	I915_WRITE(PIPEASTAT, dev_priv->pipestat[0] | 0x8000ffff);
+	I915_WRITE(PIPEBSTAT, dev_priv->pipestat[1] | 0x8000ffff);
 
 	/* Clear pending interrupt status */
 	I915_WRITE(IIR, I915_READ(IIR));
Index: dev/drm/i915_dma.c
===================================================================
--- dev/drm/i915_dma.c	(revision 190481)
+++ dev/drm/i915_dma.c	(working copy)
@@ -444,6 +444,8 @@
 	if (dev_priv->sarea_priv)
 		dev_priv->sarea_priv->last_enqueue = dev_priv->counter;
 
+	DRM_DEBUG("emitting: %d\n", dev_priv->counter);
+
 	BEGIN_LP_RING(4);
 	OUT_RING(MI_STORE_DWORD_INDEX);
 	OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
@@ -481,6 +483,7 @@
 	}
 
 	i915_emit_breadcrumb(dev);
+
 	return 0;
 }
 
Index: dev/drm/i915_drv.c
===================================================================
--- dev/drm/i915_drv.c	(revision 190481)
+++ dev/drm/i915_drv.c	(working copy)
@@ -52,7 +52,10 @@
 		return -ENODEV;
 	}
 
+	DRM_LOCK();
+	DRM_DEBUG("starting suspend\n");
 	i915_save_state(dev);
+	DRM_UNLOCK();
 
 	return (bus_generic_suspend(kdev));
 }
@@ -61,7 +64,10 @@
 {
 	struct drm_device *dev = device_get_softc(kdev);
 
+	DRM_LOCK();
+	DRM_DEBUG("starting resume\n");
 	i915_restore_state(dev);
+	DRM_UNLOCK();
 
 	return (bus_generic_resume(kdev));
 }
Index: dev/drm/drm_sysctl.c
===================================================================
--- dev/drm/drm_sysctl.c	(revision 190481)
+++ dev/drm/drm_sysctl.c	(working copy)
@@ -38,6 +38,7 @@
 static int	   drm_vm_info DRM_SYSCTL_HANDLER_ARGS;
 static int	   drm_clients_info DRM_SYSCTL_HANDLER_ARGS;
 static int	   drm_bufs_info DRM_SYSCTL_HANDLER_ARGS;
+static int	   drm_vblank_info DRM_SYSCTL_HANDLER_ARGS;
 
 struct drm_sysctl_list {
 	const char *name;
@@ -47,6 +48,7 @@
 	{"vm",	    drm_vm_info},
 	{"clients", drm_clients_info},
 	{"bufs",    drm_bufs_info},
+	{"vblank",    drm_vblank_info},
 };
 #define DRM_SYSCTL_ENTRIES (sizeof(drm_sysctl_list)/sizeof(drm_sysctl_list[0]))
 
@@ -313,3 +315,25 @@
 	free(tempprivs, DRM_MEM_DRIVER);
 	return retcode;
 }
+
+static int drm_vblank_info DRM_SYSCTL_HANDLER_ARGS
+{
+	struct drm_device *dev = arg1;
+	char buf[128];
+	int retcode;
+	int i;
+
+	DRM_SYSCTL_PRINT("\ncrtc ref count    last     enabled inmodeset\n");
+	for(i = 0 ; i < dev->num_crtcs ; i++) {
+		DRM_SYSCTL_PRINT("  %02d  %02d %08d %08d %02d      %02d\n",
+		    i, atomic_load_acq_32(&dev->vblank[i].refcount),
+		    atomic_load_acq_32(&dev->vblank[i].count),
+		    atomic_load_acq_32(&dev->vblank[i].last),
+		    atomic_load_acq_int(&dev->vblank[i].enabled),
+		    atomic_load_acq_int(&dev->vblank[i].inmodeset));
+	}
+
+	SYSCTL_OUT(req, "", -1);
+done:
+	return retcode;
+}