target/arm: Implement (trivially) ARMv8.2-TTCNP

The ARMv8.2-TTCNP extension allows an implementation to optimize by
sharing TLB entries between multiple cores, provided that software
declares that it's ready to deal with this by setting a CnP bit in
the TTBRn_ELx. It is mandatory from ARMv8.2 onward.

For QEMU's TLB implementation, sharing TLB entries between different
cores would not really benefit us and would be a lot of work to
implement. So we implement this extension in the "trivial" manner:
we allow the guest to set and read back the CnP bit, but don't change
our behaviour (this is an architecturally valid implementation
choice).

The only code path which looks at the TTBRn_ELx values for the
long-descriptor format where the CnP bit is defined is already doing
enough masking to not get confused when the CnP bit at the bottom of
the register is set, so we can simply add a comment noting why we're
relying on that mask.

Backports commit 41a4bf1feab098da4cd5495cd56a99b0339e2275 from qemu

qemu/target/arm/cpu.c

@@ -1918,6 +1918,7 @@ static void arm_max_initfn(struct uc_struct *uc, Object *obj, void *opaque)
         t = cpu->isar.id_mmfr4;
         t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
         t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
+        t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
         cpu->isar.id_mmfr4 = t;
     }
 }

qemu/target/arm/cpu64.c

@@ -348,6 +348,7 @@ static void aarch64_max_initfn(struct uc_struct *uc, Object *obj, void *opaque)
     u = cpu->isar.id_mmfr4;
     u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */
     u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
+    u = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
     cpu->isar.id_mmfr4 = u;
 
     u = cpu->isar.id_aa64dfr0;

qemu/target/arm/helper.c

@@ -10468,6 +10468,10 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
 
     /* Now we can extract the actual base address from the TTBR */
     descaddr = extract64(ttbr, 0, 48);
+    /*
+     * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
+     * and also to mask out CnP (bit 0) which could validly be non-zero.
+     */
     descaddr &= ~indexmask;
 
     /*