panic in bus_dma_tag_destroy()

[Chuck Tuffli]

I'm seeing a panic in bus_dma_tag_destroy() on the free of
dmat->segments. In comparing this to FBSD 4.10 and 5.x, the code seems
closest to the 5.x branch with the exception that 5.x seems to defer
the allocation of segments til bus_dmamap_create() while DFly
allocates this in bus_dma_tag_create(). The only other thing I noticed
was that DFly allocates segments with M_INTWAIT while FBSD allocates
it with M_NOWAIT.

This cause grief when unloading a kld which destroys a DMA tag
allocated by

	/* create a parent DMA tag for the device */
	if (bus_dma_tag_create(NULL,
			1, 0, 
			BUS_SPACE_MAXADDR_32BIT,
			BUS_SPACE_MAXADDR,
			NULL, NULL,
			BUS_SPACE_MAXSIZE_32BIT,
			BUS_SPACE_MAXSIZE_32BIT,
			BUS_SPACE_UNRESTRICTED,
			0,
			&svd->parent_dmat) != 0) {
		device_printf(dev, "can't create parent DMA tag\n");
		goto svd_pci_fail;
	}

There are no children of parent_dmat when the driver calls
bus_dma_tag_destroy(). Before it paniced, I printed out a couple of
values from the bus_dma_tag struct

parent_dmat 0xce926d38
map_count 0
ref_count 1
segments  0xc1a7f000

Any thoughts?

-- 
Chuck Tuffli
Agilent Technologies