Fix crashdumps on twe. The twe_immediate_request() path was not only

copying data to a temporary buffer before the I/O, but also copying that
temporary buffer back to the original data location after the I/O.  When
you're dumping kernel heap and stack and protected pages, this is very
very bad.

A belated thanks to Robert Watson for donating hardware for this (and future)
work.

MFC after: 3 days

1 files changed, 1 insertions, 3 deletions

diff --git a/sys/dev/twe/twe_freebsd.c b/sys/dev/twe/twe_freebsd.c
index a29b3ddb76a3..fd0a99319b99 100644
--- a/sys/dev/twe/twe_freebsd.c
+++ b/sys/dev/twe/twe_freebsd.c
@@ -1069,9 +1069,8 @@ twe_map_request(struct twe_request *tr)
 	 * Map the data buffer into bus space and build the s/g list.
 	 */
 	if (tr->tr_flags & TWE_CMD_IMMEDIATE) {
-	    bcopy(tr->tr_data, sc->twe_immediate, tr->tr_length);
 	    error = bus_dmamap_load(sc->twe_immediate_dmat, sc->twe_immediate_map, sc->twe_immediate,
-			    tr->tr_length, twe_setup_data_dmamap, tr, 0);
+			    tr->tr_length, twe_setup_data_dmamap, tr, BUS_DMA_NOWAIT);
 	} else {
 	    error = bus_dmamap_load(sc->twe_buffer_dmat, tr->tr_dmamap, tr->tr_data, tr->tr_length, 
 				    twe_setup_data_dmamap, tr, 0);
@@ -1127,7 +1126,6 @@ twe_unmap_request(struct twe_request *tr)
 	}
 
 	if (tr->tr_flags & TWE_CMD_IMMEDIATE) {
-	    bcopy(sc->twe_immediate, tr->tr_data, tr->tr_length);
 	    bus_dmamap_unload(sc->twe_immediate_dmat, sc->twe_immediate_map);
 	} else {
 	    bus_dmamap_unload(sc->twe_buffer_dmat, tr->tr_dmamap);