target/riscv/pmp: Fix address matching, granularity and debug

- Rename pmp_hart_has_priv to pmp_has_access as this is a more
  appropriate name for tracing
- Add tracing for CSR reads and writes to pmpcfg and pmpaddr
  using -d trace:pmpcfg_csr_read,trace:pmpcfg_csr_write,
  trace:pmpaddr_csr_read,trace:pmpaddr_csr_write
- Add tracing for PMP access and rule matching using
  -d trace:pmp_has_access,trace:pmp_rule_match
- Add early out if not all rules are present; short-circuit
  optimization bug for discontiguous rules fixed (reported by
  wxjstz <wxjstz@126.com>)
- Fix bug where TLB entries were created for rules smaller
  than the page size (4096), which caused results of rules
  with small spans to be erroneously used in subsequent accesses
- Fix integer promotion bug in pmpcfg_csr_read (also reported
  by wxjstz <wxjstz@126.com>)
- Fix bug where PMP allowed non M-mode accesses when no rules
  have been configured (default behaviour is to deny access
  to other modes until PMP has been configured. (also reported
  by wxjstz <wxjstz@126.com>)
- Fix illegal offsets for pmpcfg CSR accesses on rv64 (reported
  by wxjstz <wxjstz@126.com>)
- Use size_t for PMP CSR address offsets (unsigned int can
  result in sign extension on some 64-bit architectures)
- Add granularity parameter and mask addresss writes so that
  granularity can be detected.
- Use NA4 bit to represent terminal granule size where G > 0
  (this is implied by the specification)
- Remove redundant debugging statements (unnecessar with the
  new tracing support).
- Simplify rule matching loop and use a ternary expression
  that contains the entire rule match result in a similar
  condensed style to spike (riscv-isa-sim).

Co-authored-by: wxjstz <wxjstz@126.com>
Signed-off-by: Michael Clark <mjc@sifive.com>

target/riscv/cpu_helper.c

@@ -414,6 +414,7 @@ int riscv_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int size,
 #if !defined(CONFIG_USER_ONLY)
     hwaddr pa = 0;
     int prot;
+    target_ulong tlb_size = TARGET_PAGE_SIZE;
 #endif
     int ret = TRANSLATE_FAIL;
 
@@ -423,17 +424,20 @@ int riscv_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int size,
 
 #if !defined(CONFIG_USER_ONLY)
     ret = get_physical_address(env, &pa, &prot, address, rw, mmu_idx);
+
     qemu_log_mask(CPU_LOG_MMU,
             "%s address=%" VADDR_PRIx " ret %d physical " TARGET_FMT_plx
              " prot %d\n", __func__, address, ret, pa, prot);
-    if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-        !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << rw)) {
-        ret = TRANSLATE_FAIL;
+
+    if (ret == TRANSLATE_SUCCESS && riscv_feature(env, RISCV_FEATURE_PMP)) {
+        ret = pmp_has_access(env, pa, size, rw, &tlb_size) ?
+              TRANSLATE_SUCCESS : TRANSLATE_FAIL;
     }
+
     if (ret == TRANSLATE_SUCCESS) {
         tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
-                     prot, mmu_idx, TARGET_PAGE_SIZE);
-    } else if (ret == TRANSLATE_FAIL) {
+                     prot, mmu_idx, tlb_size);
+    } else {
         raise_mmu_exception(env, address, rw);
     }
 #else