hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs

Commit b795ea0ba471 ("hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access") placed its check ahead of the leaf-vs-non-leaf branch in riscv_iommu_spa_fetch(), so it fires on every PTE walked, including non-leaf/table entries. Per the RISC-V privileged spec's address translation algorithm (Sv39/Sv48/etc., the "leaf PTE has been reached" step, followed separately by the U-bit permission check), the U bit is only defined and checked for the leaf PTE reached at the end of the walk -- non-leaf PTEs don't carry a meaningful U bit at all. Move the check after the leaf/non-leaf branch, alongside the other leaf-only checks, mirroring how the G_STAGE U-bit check (added in 9158c900ab30) is already correctly placed. Fixes: b795ea0ba471 ("hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access") Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Message-ID: <20260717112340.1071148-1-andrew.jones@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>