[BUG REPORT] Potential Interrupt bug

[bantierr]

Hi,
I think I found a bug in Toooba

Initial state:

• mie.MSIP=1
• mstatus.MIE=0,
• mip.MSIP=1
• mepc set to an illegal address
• mtval set to a valid address

From that state, the mret instruction is executed.

What I observe:

Toooba set PC=mepc, tries to fetch and raises an Instruction page fault at the pc of mepc

Expected behavior

The conditions for an interrupt are evaluated immediately after the mret instruction, PC=mtvec, and we fetch from mtvec, which cause no issues. Here is a screenshot of the waveform:

In summary, we expect nothing to happen between the time the mret instruction is executed and the interrupt is taken. Instead, we observe that a store exception is raised at PC=mepc before the interrupt is raised.

I have tried to reduce the testcase to a simpler program, with no success. Maybe this is the result of a specific micro architectural scenario ?

Artifacts

Here is the waveform if needed (and the ELF/output log):
toooba-issue.zip

Thank you for your time,
Quentin