PTW: set ae_ptw for out-of-range non-leaf PTEs (#3407)

For PTEs whose physical address is out-of-range, we need to set
`ae_ptw` instead of `ae_final` to raise access-fault.

Because non-leaf PTEs will not have R or X bits set, `ae_final`
will be overrided by page-fault exceptions.

src/main/scala/rocket/PTW.scala

@@ -720,6 +720,7 @@ class PTW(n: Int)(implicit edge: TLEdgeOut, p: Parameters) extends CoreModule()(
           resp_valid(r_req_dest) := true.B
         }
 
+        resp_ae_ptw := ae && count < (pgLevels-1).U && pte.table()
         resp_ae_final := ae
         resp_pf := pf && !stage2
         resp_gf := gf || (pf && stage2)