Non-Executable PMP regions of size less than 4K trigger instruction access faults non-deterministically

Host environment

• QEMU flavor: qemu-system-riscv64
• QEMU version: 7.2.0, master

Emulated/Virtualized environment

• Operating system: Bare-metal
• Architecture: RISC-V

Description of problem

When a non-executable PMP region of size less than 4K (page size) with a start address that is not 4K-aligned is created, QEMU will non-deterministically dispatch instruction access faults when instructions are executed from the PMP-covered region (will in some cases, won't in others, based on the current TLB state)

Steps to reproduce

1. Create a PMP region of size less than 4K, that is not aligned to the start of the page, make it non-executable
2. Flush TLB with sfence.vma x0, x0
3. Jump to the start of the pmp-protected page and start executing instructions
4. Notice that no instruction access fault is reported once we reach the protected region inside the page

Additional information

@rth7680 I believe this is at least partially an unintentional result of this commit that you authored: 7e0d9973, which modified the behavior of get_page_addr_code_hostp probes to probe a single byte, instead of a full page size (signaled by passing 0). This means that we initially probe the first byte of the page, see that no PMP faults are raised, and then assume that no other bytes in the page can cause a PMP fault.

Note that I believe that simply changing this back to 0 from 1 is not enough, as this will likely simply reintroduce the issue I originally reported in #1053 (closed).