PMP fail on boundary addresses because of size=0

[dayeol]

I found that sometimes tlb_fill gets size=0, which I don't understand,
and if size=0, PMP breaks on boundary addresses.

https://github.com/riscv/riscv-qemu/blob/riscv-qemu-3.1/target/riscv/pmp.c#L187

Let's say PMP address range is 0x1000-0x1fff,
ea will be 0x1fff so 0x2000 should not included in the range.
However, since addr + size - 1 is 0x2000 + 0 - 1 = 0x1fff, it will be considered as in-range, which is not the case.