[BUG] Access faults report physical address in tval

Created by: MaistoV

I noticed that the PMP exception reporting in CVA6 returns the physical address as exception tval, e.g., here and here, where lsu_paddr_o is the address the PMP checks are performed against, i.e., here, so it must be the final translated physical address.

This is explicitly against the privileged spec:

3.1.16 Machine Trap Value Register (mtval): If mtval is written with a nonzero value when a breakpoint, address-misaligned, access-fault, or page-fault exception occurs on an instruction fetch, load, or store, then mtval will contain the faulting virtual address. When page-based virtual memory is enabled, mtval is written with the faulting virtual address, even for physical-memory access-fault exceptions.

4.1.9 Supervisor Trap Value (stval) Register: If stval is written with a nonzero value when a breakpoint, address-misaligned, access-fault, or page-fault exception occurs on an instruction fetch, load, or store, then stval will contain the faulting virtual address.

Is there a reason behind this choice or is it just a latent bug?