Merge tag 'drm-intel-gt-next-2026-10-01' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next

Driver Changes:

- Fix incorrect RCU teardown order (Christian)
- Fix potential UAF in command parsing code (Krzysztof)

- Avoid WARN splat during RPS boosting race (Krzysztof)
- Use simpler versions of min*() functions (Andy)
- Selftest improvements (Sk, Krzysztof, Jansuz)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patch.msgid.link/ar5JFG3BmldEdDzF@jlahtine-mobl

drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c

@@ -1766,6 +1766,7 @@ static int eb_reinit_userptr(struct i915_execbuffer *eb)
 
 static noinline int eb_relocate_parse_slow(struct i915_execbuffer *eb)
 {
+	const unsigned int count = eb->buffer_count;
 	bool have_copy = false;
 	struct eb_vma *ev;
 	int err = 0;
@@ -1868,7 +1869,6 @@ static noinline int eb_relocate_parse_slow(struct i915_execbuffer *eb)
 
 out:
 	if (have_copy) {
-		const unsigned int count = eb->buffer_count;
 		unsigned int i;
 
 		for (i = 0; i < count; i++) {

drivers/gpu/drm/i915/gem/i915_gem_object.c

@@ -89,6 +89,7 @@ struct drm_i915_gem_object *i915_gem_object_alloc(void)
 
 void i915_gem_object_free(struct drm_i915_gem_object *obj)
 {
+	dma_resv_fini(&obj->base._resv);
 	return kmem_cache_free(slab_objects, obj);
 }
 
@@ -144,7 +145,6 @@ void __i915_gem_object_fini(struct drm_i915_gem_object *obj)
 {
 	mutex_destroy(&obj->mm.get_page.lock);
 	mutex_destroy(&obj->mm.get_dma_page.lock);
-	dma_resv_fini(&obj->base._resv);
 }
 
 /**

drivers/gpu/drm/i915/gem/i915_gem_shmem.c

@@ -153,11 +153,8 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
 			}
 		} while (1);
 
-		nr_pages = min_array(((unsigned long[]) {
-					folio_nr_pages(folio),
-					page_count - i,
-					max_segment / PAGE_SIZE,
-				      }), 3);
+		nr_pages = min3(folio_nr_pages(folio),
+				page_count - i, max_segment / PAGE_SIZE);
 
 		if (!i ||
 		    sg->length >= max_segment ||
@@ -168,8 +165,7 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
 			st->nents++;
 			sg_set_folio(sg, folio, nr_pages * PAGE_SIZE, 0);
 		} else {
-			nr_pages = min_t(unsigned long, nr_pages,
-					 (max_segment - sg->length) / PAGE_SIZE);
+			nr_pages = min(nr_pages, (max_segment - sg->length) / PAGE_SIZE);
 
 			sg->length += nr_pages * PAGE_SIZE;
 		}

drivers/gpu/drm/i915/gt/intel_rps.c

@@ -1904,7 +1904,8 @@ static void rps_work(struct work_struct *work)
 
 out:
 	spin_lock_irq(gt->irq_lock);
-	gen6_gt_pm_unmask_irq(gt, rps->pm_events);
+	if (intel_rps_is_active(rps))
+		gen6_gt_pm_unmask_irq(gt, rps->pm_events);
 	spin_unlock_irq(gt->irq_lock);
 }
 

drivers/gpu/drm/i915/gt/selftest_hangcheck.c

@@ -278,7 +278,7 @@ static bool wait_until_running(struct hang *h, struct i915_request *rq)
 			     10) &&
 		 wait_for(i915_seqno_passed(hws_seqno(h, rq),
 					    rq->fence.seqno),
-			  1000));
+			  2000));
 }
 
 static int igt_hang_sanitycheck(void *arg)

drivers/gpu/drm/i915/gt/selftest_rc6.c

@@ -92,8 +92,8 @@ int live_rc6_manual(void *arg)
 
 		if (!rc0_power) {
 			if (rc0_freq)
-				pr_debug("No power measured while in RC0! GPU Freq: %uMHz in RC0\n",
-					 rc0_freq);
+				pr_err("No power measured while in RC0! GPU Freq: %uMHz in RC0\n",
+				       rc0_freq);
 			else
 				pr_err("No power and freq measured while in RC0\n");
 			err = -EINVAL;

drivers/gpu/drm/i915/selftests/i915_sw_fence.c

@@ -526,7 +526,7 @@ static int test_ipc(void *arg)
 	struct workqueue_struct *wq;
 	int ret = 0;
 
-	wq = alloc_workqueue("i1915-selftest", WQ_PERCPU, 0);
+	wq = alloc_workqueue("i915-selftest", WQ_PERCPU, 0);
 	if (wq == NULL)
 		return -ENOMEM;