I thought about it somewhat, since IT blocks are required to be able to handle faults and return to execution properly within an IT block.  It seems the gem5 solution is probably similar to what a real processor implementation would use, appending the IT state to the PC.  So an exception/interrupt within an IT block would just return and the decoder would pick off the extra IT bits from the PC (that detail how to predicate up to the next 3 ops).  If the exception/interrupt was just prior to the IT instruction, it would just get sent to the decoder like normal.

I was thinking more on the "discarding nops at decode" part.  The only case I think that could give that trouble is self-modifying code, since you'd want to track instruction addresses to know if a snooped write changed a currently executing instruction.  But gem5 doesn't really provide that now anyway and you could use cheaper structures to perform that operation (since false positives would be ok).

Nope, I haven't run FS in months.  All of my current benchmarking infrastructure (simpoints, etc) is built on ARM SE.  I'm probably one of the few people who do that.