I see you clean pending status of edge vector in
riscv_clic_next_interrupt(void *opaque, int hartid)
it is not correctly! since before the edge vector is really handled, latter IRQ may come and override it, and the edge vector (such as tspend, systick) will not be handled forever.
I think you could clean them when cpu really handle it, for example in
if (enable) branch of bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
thx
alan