[mip] MTIP/MEIP is software-writable via CSR write, which is read-only #275

Environment

• NutShell: commit 0b3d3a86feb1e0c7c10f446a460443ad2d696e6d
• ISA: RV64 (NutShell default)

Describe the bug

In M-mode, writing mip with software can set the machine timer interrupt pending bit (MTIP, bit 7), which the privileged ISA requires to be read-only in mip.

Minimal trigger:

li   t0, 0x880        # MTIP | MEIP
csrw mip, t0
csrr s0, mip          # mismatch here

• Write value: 0x880 = MTIP (bit 7) | MEIP (bit 11)
• After csrr s0, mip at pc = 0x8000000a:
  • Sail (expected): s0 = 0x0
  • NutShell (actual): s0 = 0x80 (MTIP stuck at 1)

MEIP is also specified as read-only in mip (platform interrupt controller only). This seed demonstrates the violation on MTIP; the write attempts both read-only machine pending bits.

Expected behavior

Per RISC-V Privileged Spec (machine.adoc — mip MTIP/MEIP):

MEIP is read-only in mip, and is set and cleared by a platform-specific interrupt controller.

MTIP is read-only in the mip register, and is cleared by writing to the memory-mapped machine-mode timer compare register.

Software CSR writes to mip must not set MTIP/MEIP. With no real timer/external interrupt pending, a write of 0x880 followed by a read must leave those bits clear.