[PATCH v2 0/2] iio: add IRQF_NO_THREAD to hardirq-only trigger helpers

[PATCH v2 0/2] iio: add IRQF_NO_THREAD to hardirq-only trigger helpers

[Runyu Xiao]

This series fixes two IIO trigger registration sites that pass
iio_trigger_generic_data_rdy_poll() to request_irq() without
IRQF_NO_THREAD.

Both sites are intended to drive iio_trigger_poll() from hardirq
context, but under forced IRQ threading they can otherwise run through
irq/... thread context instead.

This issue was first flagged by our static analysis tool while scanning
request_irq() sites that register iio_trigger_generic_data_rdy_poll(),
then manually audited on Linux v6.18.21.

It was further validated with a no-device QEMU selftest using irq_sim
to model a parent IRQ and a child IIO trigger IRQ under threadirqs. The
same trigger path ran from irq/... thread context without IRQF_NO_THREAD
and stayed in hardirq context after adding IRQF_NO_THREAD. The selftest
logged:

  3395 selftest: phase=bad current=irq/30-patchpar in_hardirq=0
  3395 selftest: phase=fixed current=swapper/0 in_hardirq=1
  3395 selftest: validation succeeded

Patch 1 fixes the ADIS non-FIFO managed trigger path.
Patch 2 fixes the BMI160 data-ready trigger path.

Build-tested by compiling adis_trigger.o and bmi160_core.o.

No ADIS or BMI160 hardware was available for end-to-end runtime testing
on this submission branch.

Changes in v2:
- move build/runtime validation notes out of the per-patch commit
  messages

Runyu Xiao (2):
  iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
  iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

 drivers/iio/imu/adis_trigger.c       | 3 +--
 drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
 2 files changed, 3 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH v2 1/2] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

[Runyu Xiao]

devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
through devm_request_irq() on the non-FIFO path, but it does not add
IRQF_NO_THREAD to the IRQ flags.

When the kernel is booted with forced IRQ threading, the parent IRQ can
otherwise be threaded by the IRQ core and the subsequent IIO trigger
child IRQ is then dispatched from irq/... thread context instead of
hardirq context. Because iio_trigger_generic_data_rdy_poll()
immediately drives iio_trigger_poll(), this violates the hardirq-only
IIO trigger helper contract and can push downstream trigger consumers
through the wrong execution context.

Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the
non-FIFO request_irq() path, while preserving the current trigger
polarity and IRQF_NO_AUTOEN behavior.

Fixes: fec86c6b8369 ("iio: imu: adis: Add Managed device functions")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
v2:
- move build/runtime validation notes to the cover letter

 drivers/iio/imu/adis_trigger.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
index d76e13cbac68..ae1506ca85fd 100644
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -94,7 +94,7 @@ int devm_adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
 	else
 		ret = devm_request_irq(&adis->spi->dev, adis->spi->irq,
 				       &iio_trigger_generic_data_rdy_poll,
-				       adis->irq_flag,
+				       adis->irq_flag | IRQF_NO_THREAD,
 				       indio_dev->name,
 				       adis->trig);
 	if (ret)
@@ -103,4 +103,4 @@ int devm_adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
 	return devm_iio_trigger_register(&adis->spi->dev, adis->trig);
 }
 EXPORT_SYMBOL_NS_GPL(devm_adis_probe_trigger, "IIO_ADISLIB");
-- 
2.34.1

[PATCH v2 2/2] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

[Runyu Xiao]

bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
through devm_request_irq(), but it passes only irq_type and does not add
IRQF_NO_THREAD.

When the kernel is booted with forced IRQ threading, the parent IRQ can
otherwise be threaded by the IRQ core and the subsequent IIO trigger
child IRQ is dispatched from irq/... thread context instead of hardirq
context. Because the handler immediately pushes the event into
iio_trigger_poll(), this violates the hardirq-only IIO trigger helper
contract and can drive downstream trigger consumers through the wrong
execution context.

Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data-
ready trigger handler.

Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
v2:
- move build/runtime validation notes to the cover letter

 drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
index 5f47708b4c5d..caee8dfd101e 100644
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -793,7 +793,8 @@ int bmi160_probe_trigger(struct iio_dev *indio_dev, int irq, u32 irq_type)
 
 	ret = devm_request_irq(&indio_dev->dev, irq,
 			       &iio_trigger_generic_data_rdy_poll,
-			       irq_type, "bmi160", data->trig);
+			       irq_type | IRQF_NO_THREAD,
+			       "bmi160", data->trig);
 	if (ret)
 		return ret;
 
-- 
2.34.1

Re: [PATCH v2 0/2] iio: add IRQF_NO_THREAD to hardirq-only trigger helpers

[Jonathan Cameron]

On Thu,  4 Jun 2026 09:42:45 +0800
Runyu Xiao <runyu.xiao@seu.edu.cn> wrote:

> This series fixes two IIO trigger registration sites that pass
> iio_trigger_generic_data_rdy_poll() to request_irq() without
> IRQF_NO_THREAD.
> 
> Both sites are intended to drive iio_trigger_poll() from hardirq
> context, but under forced IRQ threading they can otherwise run through
> irq/... thread context instead.
> 
> This issue was first flagged by our static analysis tool while scanning
> request_irq() sites that register iio_trigger_generic_data_rdy_poll(),
> then manually audited on Linux v6.18.21.
> 
> It was further validated with a no-device QEMU selftest using irq_sim
> to model a parent IRQ and a child IIO trigger IRQ under threadirqs. The
> same trigger path ran from irq/... thread context without IRQF_NO_THREAD
> and stayed in hardirq context after adding IRQF_NO_THREAD. The selftest
> logged:
> 
>   3395 selftest: phase=bad current=irq/30-patchpar in_hardirq=0
>   3395 selftest: phase=fixed current=swapper/0 in_hardirq=1
>   3395 selftest: validation succeeded
> 
> Patch 1 fixes the ADIS non-FIFO managed trigger path.
> Patch 2 fixes the BMI160 data-ready trigger path.
> 
> Build-tested by compiling adis_trigger.o and bmi160_core.o.
> 
> No ADIS or BMI160 hardware was available for end-to-end runtime testing
> on this submission branch.
> 
> Changes in v2:
> - move build/runtime validation notes out of the per-patch commit
>   messages
> 
Both applied to the fixes-togreg branch of iio.git. Note I'll be
rebasing that on rc1 before sending a pull request.

Thanks,

Jonathan

> Runyu Xiao (2):
>   iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
>   iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
> 
>  drivers/iio/imu/adis_trigger.c       | 3 +--
>  drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 

Re: [PATCH v2 0/2] iio: add IRQF_NO_THREAD to hardirq-only trigger helpers

[Jonathan Cameron]

On Thu,  4 Jun 2026 09:42:45 +0800
Runyu Xiao <runyu.xiao@seu.edu.cn> wrote:

> This series fixes two IIO trigger registration sites that pass
> iio_trigger_generic_data_rdy_poll() to request_irq() without
> IRQF_NO_THREAD.
> 
> Both sites are intended to drive iio_trigger_poll() from hardirq
> context, but under forced IRQ threading they can otherwise run through
> irq/... thread context instead.
> 
> This issue was first flagged by our static analysis tool while scanning
> request_irq() sites that register iio_trigger_generic_data_rdy_poll(),
> then manually audited on Linux v6.18.21.
> 
> It was further validated with a no-device QEMU selftest using irq_sim
> to model a parent IRQ and a child IIO trigger IRQ under threadirqs. The
> same trigger path ran from irq/... thread context without IRQF_NO_THREAD
> and stayed in hardirq context after adding IRQF_NO_THREAD. The selftest
> logged:
> 
>   3395 selftest: phase=bad current=irq/30-patchpar in_hardirq=0
>   3395 selftest: phase=fixed current=swapper/0 in_hardirq=1
>   3395 selftest: validation succeeded
> 
> Patch 1 fixes the ADIS non-FIFO managed trigger path.
> Patch 2 fixes the BMI160 data-ready trigger path.
> 
> Build-tested by compiling adis_trigger.o and bmi160_core.o.
> 
> No ADIS or BMI160 hardware was available for end-to-end runtime testing
> on this submission branch.
> 
> Changes in v2:
> - move build/runtime validation notes out of the per-patch commit
>   messages
> 
I forgot to say - there was something corrupted in the 1st patch so
I made the same edit by hand.  That is probably what stopped Sashiko
from looking at these.

Jonathan

> Runyu Xiao (2):
>   iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
>   iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
> 
>  drivers/iio/imu/adis_trigger.c       | 3 +--
>  drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
>  2 files changed, 3 insertions(+), 3 deletions(-)
>