[Bug Report] Incorrect exception type of PMA violation during address translation

[Phantom1003]

Our co-simulation framework found that the exception type of address translation PMA violation is incorrect.

In the following test case, we modify a non-leaf (level 2) PTE to zero, which means the level 2 page dictionary is at 0x0000. 0x0000 is not part of the address range of the memory, which clearly violates the PMA. cva6 throws a store page fault, while spike throws an access fault.

[cva6]  Exception @     95100, PC: 0000000080000250, Cause: Store Page Fault,
[cva6]                                  tval: 0000000040201010
[spike] core   0: 0x0000000080000250 (0x00b52023) sw      a1, 0(a0)
[spike] core   0: exception trap_store_access_fault, epc 0x0000000080000250
[spike] core   0:           tval 0x0000000040201010
[spike] core   0: 0x0000000080000004 (0x34302f73) csrr    t5, mtval
[cva6]       958ns      943 M 0000000080000004 0 34302f73 csrr           t5, mtval
[spike] core   0: 0x0000000080000008 (0x34202f73) csrr    t5, mcause
[error] WDATA SIM 0000000000000007, DUT 000000000000000f
[error] check board clear 30 error
[CJ] integer register Judge Failed

According to riscv-privileged specification:

If accessing pte violates a PMA or PMP check, raise an access-fault exception corresponding to the original access type.

cva6-8.zip

@LuminaDCIX helps reproduce the problem