drm/i915: Fix CPU-spinning hangs related to fence usage by using an LRU.

The lack of a proper LRU was partially worked around by taking the fence
from the object containing the oldest seqno.  But if there are multiple
objects inactive, then they don't have seqnos and the first fence reg
among them would be chosen.  If you were trying to copy data between two
mappings, this could result in each page fault stealing the fence from
the other argument, and your application hanging.

https://bugs.freedesktop.org/show_bug.cgi?id=23566
https://bugs.freedesktop.org/show_bug.cgi?id=23220
https://bugs.freedesktop.org/show_bug.cgi?id=23253
https://bugs.freedesktop.org/show_bug.cgi?id=23366

Cc: Stable Team <stable@kernel.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 7537f57d8a8..11fc4b66c88 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -384,6 +384,9 @@ typedef struct drm_i915_private {
                  */
                 struct list_head inactive_list;
 
+                /** LRU list of objects with fence regs on them. */
+                struct list_head fence_list;
+
                 /**
                  * List of breadcrumbs associated with GPU requests currently
                  * outstanding.
@@ -451,6 +454,9 @@ struct drm_i915_gem_object {
         /** This object's place on the active/flushing/inactive lists */
         struct list_head list;
 
+        /** This object's place on the fenced object LRU */
+        struct list_head fence_list;
+
         /**
          * This is set if the object is on the active or flushing lists
          * (has pending rendering), and is not set if it's on inactive (ready