[PATCH 0/2] iio: add IRQF_NO_THREAD to hardirq-only trigger helpers

[PATCH 0/2] iio: add IRQF_NO_THREAD to hardirq-only trigger helpers

[Runyu Xiao]

This series fixes two IIO trigger registration sites that pass
iio_trigger_generic_data_rdy_poll() to request_irq() without
IRQF_NO_THREAD.

Both sites are intended to drive iio_trigger_poll() from hardirq
context, but under forced IRQ threading they can otherwise run through
irq/... thread context instead.

This issue was first flagged by our static analysis tool while scanning
request_irq() sites that register iio_trigger_generic_data_rdy_poll(),
then manually audited on Linux v6.18.21.

It was further validated with a no-device QEMU selftest using irq_sim
to model a parent IRQ and a child IIO trigger IRQ under threadirqs. The
same trigger path ran from irq/... thread context without IRQF_NO_THREAD
and stayed in hardirq context after adding IRQF_NO_THREAD. The selftest
logged:

  3395 selftest: phase=bad current=irq/30-patchpar in_hardirq=0
  3395 selftest: phase=fixed current=swapper/0 in_hardirq=1
  3395 selftest: validation succeeded

Patch 1 fixes the ADIS non-FIFO managed trigger path.
Patch 2 fixes the BMI160 data-ready trigger path.

Build-tested by compiling adis_trigger.o and bmi160_core.o.

No ADIS or BMI160 hardware was available for end-to-end runtime testing
on this submission branch.

Runyu Xiao (2):
  iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
  iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

 drivers/iio/imu/adis_trigger.c       | 3 +--
 drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
 2 files changed, 3 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 1/2] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

[Runyu Xiao]

devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
through devm_request_irq() on the non-FIFO path, but it does not add
IRQF_NO_THREAD to the IRQ flags.

When the kernel is booted with forced IRQ threading, the parent IRQ can
otherwise be threaded by the IRQ core and the subsequent IIO trigger
child IRQ is then dispatched from irq/... thread context instead of
hardirq context. Because iio_trigger_generic_data_rdy_poll()
immediately drives iio_trigger_poll(), this violates the hardirq-only
IIO trigger helper contract and can push downstream trigger consumers
through the wrong execution context.

Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the
non-FIFO request_irq() path, while preserving the current trigger
polarity and IRQF_NO_AUTOEN behavior.

Build-tested by compiling adis_trigger.o.

No ADIS hardware was available for end-to-end runtime testing on this
submission branch.

Fixes: fec86c6b8369 ("iio: imu: adis: Add Managed device functions")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/iio/imu/adis_trigger.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
index d76e13cbac68..ae1506ca85fd 100644
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -94,7 +94,7 @@ int devm_adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
 	else
 		ret = devm_request_irq(&adis->spi->dev, adis->spi->irq,
 				       &iio_trigger_generic_data_rdy_poll,
-				       adis->irq_flag,
+				       adis->irq_flag | IRQF_NO_THREAD,
 				       indio_dev->name,
 				       adis->trig);
 	if (ret)
@@ -103,4 +103,4 @@ int devm_adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
 	return devm_iio_trigger_register(&adis->spi->dev, adis->trig);
 }
 EXPORT_SYMBOL_NS_GPL(devm_adis_probe_trigger, "IIO_ADISLIB");
-- 
2.34.1

Re: [PATCH 1/2] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

[Andy Shevchenko]

On Tue, Jun 02, 2026 at 05:17:26PM +0800, Runyu Xiao wrote:
> devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
> through devm_request_irq() on the non-FIFO path, but it does not add
> IRQF_NO_THREAD to the IRQ flags.
> 
> When the kernel is booted with forced IRQ threading, the parent IRQ can
> otherwise be threaded by the IRQ core and the subsequent IIO trigger
> child IRQ is then dispatched from irq/... thread context instead of
> hardirq context. Because iio_trigger_generic_data_rdy_poll()
> immediately drives iio_trigger_poll(), this violates the hardirq-only
> IIO trigger helper contract and can push downstream trigger consumers
> through the wrong execution context.
> 
> Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the
> non-FIFO request_irq() path, while preserving the current trigger
> polarity and IRQF_NO_AUTOEN behavior.

> Build-tested by compiling adis_trigger.o.
> 
> No ADIS hardware was available for end-to-end runtime testing on this
> submission branch.

These two paragraphs are unneeded details and can go to the cover letter.

...

Code wise IIRC another approach was discussed. But Jonathan may know better.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/2] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

[Jonathan Cameron]

On Wed, 3 Jun 2026 04:05:48 +0300
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Tue, Jun 02, 2026 at 05:17:26PM +0800, Runyu Xiao wrote:
> > devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
> > through devm_request_irq() on the non-FIFO path, but it does not add
> > IRQF_NO_THREAD to the IRQ flags.
> > 
> > When the kernel is booted with forced IRQ threading, the parent IRQ can
> > otherwise be threaded by the IRQ core and the subsequent IIO trigger
> > child IRQ is then dispatched from irq/... thread context instead of
> > hardirq context. Because iio_trigger_generic_data_rdy_poll()
> > immediately drives iio_trigger_poll(), this violates the hardirq-only
> > IIO trigger helper contract and can push downstream trigger consumers
> > through the wrong execution context.
> > 
> > Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the
> > non-FIFO request_irq() path, while preserving the current trigger
> > polarity and IRQF_NO_AUTOEN behavior.  
> 
> > Build-tested by compiling adis_trigger.o.
> > 
> > No ADIS hardware was available for end-to-end runtime testing on this
> > submission branch.  
> 
> These two paragraphs are unneeded details and can go to the cover letter.
> 
> ...
> 
> Code wise IIRC another approach was discussed. But Jonathan may know better.
> 

Whilst I dislike the necessity of marking these, I'm not aware of another
solution.  Maybe the discussion Andy refers to what the one around
papering over ONESHOT where if that flag is set and there isn't a thread
handler it's a driver bug.

For this we might be able to on day do something cleverer but that would
first mean fixing up how we run top halfs when only the thread is called.

So with a patch descriptions tweaked as Andy suggests I'll pick these up.

[PATCH 2/2] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

[Runyu Xiao]

bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
through devm_request_irq(), but it passes only irq_type and does not add
IRQF_NO_THREAD.

When the kernel is booted with forced IRQ threading, the parent IRQ can
otherwise be threaded by the IRQ core and the subsequent IIO trigger
child IRQ is dispatched from irq/... thread context instead of hardirq
context. Because the handler immediately pushes the event into
iio_trigger_poll(), this violates the hardirq-only IIO trigger helper
contract and can drive downstream trigger consumers through the wrong
execution context.

Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data-
ready trigger handler.

Build-tested by compiling bmi160_core.o.

No BMI160 hardware was available for end-to-end runtime testing on this
submission branch.

Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
index 5f47708b4c5d..caee8dfd101e 100644
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -793,7 +793,8 @@ int bmi160_probe_trigger(struct iio_dev *indio_dev, int irq, u32 irq_type)
 
 	ret = devm_request_irq(&indio_dev->dev, irq,
 			       &iio_trigger_generic_data_rdy_poll,
-			       irq_type, "bmi160", data->trig);
+			       irq_type | IRQF_NO_THREAD,
+			       "bmi160", data->trig);
 	if (ret)
 		return ret;
 
-- 
2.34.1

Re: [PATCH 2/2] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

[Andy Shevchenko]

On Tue, Jun 02, 2026 at 05:17:27PM +0800, Runyu Xiao wrote:
> bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
> through devm_request_irq(), but it passes only irq_type and does not add
> IRQF_NO_THREAD.
> 
> When the kernel is booted with forced IRQ threading, the parent IRQ can
> otherwise be threaded by the IRQ core and the subsequent IIO trigger
> child IRQ is dispatched from irq/... thread context instead of hardirq
> context. Because the handler immediately pushes the event into
> iio_trigger_poll(), this violates the hardirq-only IIO trigger helper
> contract and can drive downstream trigger consumers through the wrong
> execution context.
> 
> Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data-
> ready trigger handler.
> 
> Build-tested by compiling bmi160_core.o.
> 
> No BMI160 hardware was available for end-to-end runtime testing on this
> submission branch.

Same comments as per previous patch.

-- 
With Best Regards,
Andy Shevchenko