@samitouri / QOSamiQemu / commits / 27d543b880

hw/intc/aspeed: Drop stale pending interrupts

The Aspeed INTC records an interrupt source in the pending bitmap when the source is masked or another status bit is still being handled. When the guest later clears the status register, the model promotes all saved pending bits back to status unconditionally. This is not correct for level-triggered sources. A source can deassert while another source connected to the same OR gate keeps the aggregated INTC line asserted. Promoting the stale bit later makes the guest demux a child interrupt whose device status has already been cleared. This is visible on AST2700 I2C, where the I2C buses are aggregated through INTCIO GICINT194 before reaching the GIC. A stale I2C source bit can be promoted back to the INTCIO status register, causing Linux to run the corresponding I2C ISR with an empty I2C interrupt status register. For example, the Linux aspeed-i2c debug ring shows a transfer that first receives a valid status interrupt, then receives a spurious ISR with both isr and raw status equal to zero. The zero-status ISR clears the saved command error and the transfer completes with ret=0: event=start isr=0x00000000 raw=0x00000000 cmd_err=0 msgs_idx=0 event=isr isr=0x00010011 raw=0x00010011 cmd_err=0 msgs_idx=0 event=isr isr=0x00000000 raw=0x00000000 cmd_err=1 msgs_idx=1 event=complete ret=0 cmd_err=0 msgs_idx=1 A normal command can then be reported as zero transferred messages, which is converted to -EIO by Linux i2c_smbus_xfer_emulated(). The race is more likely when multiple I2C buses are accessed concurrently. Drop pending bits that no longer correspond to an asserted and enabled source before they can be promoted back to status. Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com> Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com> Link: https://lore.kernel.org/qemu-devel/20260612060857.1842819-1-zhangjian.3032@bytedance.com Signed-off-by: Cédric Le Goater <clg@redhat.com>

Jian Zhang committed Jun 12, 2026 at 14:08 UTC 27d543b88016e05dd2f02113d3fc4373b595b251

1 file changed +25

hw/intc/aspeed_intc.c

+25

@@ -107,6 +107,27 @@ static const AspeedINTCIRQ *aspeed_intc_get_irq(AspeedINTCClass *aic,

107 g_assert_not_reached();

108 }

109

110 +static uint32_t aspeed_intc_orgate_levels(AspeedINTCState *s, int inpin_idx)

111 +{

112 + AspeedINTCClass *aic = ASPEED_INTC_GET_CLASS(s);

113 + uint32_t levels = 0;

114 + int i;

115 +

116 + for (i = 0; i < aic->num_lines && i < 32; i++) {

117 + if (s->orgates[inpin_idx].levels[i]) {

118 + levels |= BIT(i);

119 + }

120 + }

121 +

122 + return levels;

123 +}

124 +

125 +static void aspeed_intc_drop_stale_pending(AspeedINTCState *s, int inpin_idx)

126 +{

127 + s->pending[inpin_idx] &= aspeed_intc_orgate_levels(s, inpin_idx) &

128 + s->enable[inpin_idx];

129 +}

130 +

131 /*

132 * Update the state of an interrupt controller pin by setting

133 * the specified output pin to the given level.

@@ -231,6 +252,8 @@ static void aspeed_intc_set_irq(void *opaque, int irq, int level)

252 trace_aspeed_intc_set_irq(name, inpin_idx, level);

253 enable = s->enable[inpin_idx];

254

255 + aspeed_intc_drop_stale_pending(s, inpin_idx);

256 +

257 if (!level) {

258 return;

259 }

@@ -343,6 +366,7 @@ static void aspeed_intc_status_handler(AspeedINTCState *s, hwaddr offset,

366 /* All source ISR execution are done */

367 if (!s->regs[reg]) {

368 trace_aspeed_intc_all_isr_done(name, inpin_idx);

369 + aspeed_intc_drop_stale_pending(s, inpin_idx);

370 if (s->pending[inpin_idx]) {

371 /*

372 * handle pending source interrupt

@@ -402,6 +426,7 @@ static void aspeed_intc_status_handler_multi_outpins(AspeedINTCState *s,

426 /* All source ISR executions are done from a specific bit */

427 if (data & BIT(i)) {

428 trace_aspeed_intc_all_isr_done_bit(name, inpin_idx, i);

429 + aspeed_intc_drop_stale_pending(s, inpin_idx);

430 if (s->pending[inpin_idx] & BIT(i)) {

431 /*

432 * Handle pending source interrupt.