RISC-V: mret sets mstatus.MPP=U on harts without U-mode

RISC-V: mret sets mstatus.MPP=U without U-mode

Rechecked revision

The report was rechecked against the public Unicorn dev branch at 938efd13aeab73155f31cf707a2094c6ccaa36dd.

Problem

helper_mret always writes mstatus.MPP = PRV_U. On a hart whose ISA omits U-mode, M is the least-privileged supported mode, so the post-mret MPP state must remain M rather than becoming U.

Public reproducer

The witness and the explicit U-clear riscv_any build-profile patch are available at https://github.com/carlosqwqqwq/unicorn-riscv-repros/tree/main/u034. Apply patches/no-u-any.patch to a clean public Unicorn checkout, build it, set LIBUNICORN_PATH to that build, and run u034/run.sh. The no-U run must read back MPP=3; a U-enabled control remains unchanged.

The profile patch is public and only constructs the no-U test configuration; it does not hide any source change used by the proposed fix.

Expected behavior

mret must select the least-privileged mode implemented by the hart: U when U-mode exists, otherwise M.

Root cause and proposed fix

Select PRV_U only when RVU is present and select PRV_M otherwise. The focused change is included in PR #2396.