re: kern/41715

[matthew green <mrg%eterna.com.au@localhost>]

   there is a problem with the vblank callout firing while the
   drm is being torn down.  i'm not entirely sure what the
   sequence is, but the crash occurs in radeon_get_vblank_counter
   when it is called from the callout, not from the close.

this is right.
   
   i don't think drm_lastclose() is being called.
   
this isn't right.

the problem occurs because drm_vblank_cleanup() is called in
drm_unload() and not by drm_lastclose().  that leaves callouts
maybe pending, and if they fire they'll act on unmapped space.

i haven't figured out the right fix yet.  just the simple
rearrangement of code doesn't seem to work properly, though i
am avoiding the panic.


.mrg.