tests: riscv: pmp: Add test case for null pointer access

Adds `test_null_pointer_access` to verify that attempting to write to a
null pointer (address 0x0) correctly triggers a fatal error, confirming
the Physical Memory Protection (PMP) guard functionality.

Signed-off-by: Firas Sammoura <[email protected]>

Author: fsammoura1980

tests/arch/riscv/pmp/null-pointer/CMakeLists.txt

@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: Apache-2.0
+
+cmake_minimum_required(VERSION 3.20.0)
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+project(riscv_pmp)
+
+FILE(GLOB app_sources src/*.c)
+target_sources(app PRIVATE ${app_sources})

tests/arch/riscv/pmp/null-pointer/prj.conf

@@ -0,0 +1,2 @@
+CONFIG_ZTEST=y
+CONFIG_NULL_POINTER_EXCEPTION_DETECTION_PMP=y

tests/arch/riscv/pmp/null-pointer/src/main.c

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2025 Google LLC
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr/ztest.h>
+
+static volatile bool valid_fault;
+
+void k_sys_fatal_error_handler(unsigned int reason, const struct arch_esf *pEsf)
+{
+	TC_PRINT("Caught system error -- reason %d %d\n", reason, valid_fault);
+	if (!valid_fault) {
+		TC_PRINT("fatal error was unexpected, aborting\n");
+		TC_END_REPORT(TC_FAIL);
+		k_fatal_halt(reason);
+	}
+
+	TC_PRINT("fatal error expected as part of test case\n");
+	valid_fault = false; /* reset back to normal */
+	TC_END_REPORT(TC_PASS);
+}
+
+static void check_null_ptr_guard(void)
+{
+	volatile int *null_ptr = NULL;
+
+	valid_fault = true;
+	*null_ptr = 42;
+
+	if (valid_fault) {
+		/*
+		 * valid_fault gets cleared if an expected exception took place
+		 */
+		TC_PRINT("test function was supposed to fault but didn't\n");
+		ztest_test_fail();
+	}
+}
+
+ZTEST(riscv_pmp_null_pointer, test_null_pointer_access)
+{
+	check_null_ptr_guard();
+
+	zassert_unreachable("Write to stack guard did not fault");
+	TC_END_REPORT(TC_FAIL);
+}
+
+ZTEST_SUITE(riscv_pmp_null_pointer, NULL, NULL, NULL, NULL, NULL);

tests/arch/riscv/pmp/null-pointer/testcase.yaml

@@ -0,0 +1,8 @@
+common:
+  filter: CONFIG_RISCV_PMP
+
+tests:
+  arch.riscv.pmp.null_pointer.locked: {}
+  arch.riscv.pmp.null_pointer.unlocked:
+    extra_configs:
+      - CONFIG_PMP_NO_LOCK_GLOBAL=y