morello: Fix explicit (C)RTPIDR_EL0 access

This was clearly copied from the Armv6k TPIDRRO_EL0 and only partially
updated to work, with the name and fieldoffset left as they are for
TPIDRRO_EL0. It's hard to notice this unless you mix explicit accesses
from executive with implicit accesses from restricted, as the only other
way to notice is if you have state in TPIDRRO_EL0 you don't want to have
clobbered, which is rare since most OSes use TPIDR_EL0 as the userspace
thread pointer (with the notable exception of Darwin).

Whilst here reorder the encoding fields to match the other entries here
(and the order the specification lists them in) rather than the order in
the Armv6k table from which it was copied.

target/arm/helper.c

@@ -8573,11 +8573,11 @@ void register_cp_regs_for_features(ARMCPU *cpu)
           .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 7,
           .access = PL0_RW | PL_NO_SYSREG, .type = ARM_CP_CAP,
           .fieldoffset = offsetof(CPUARMState, cid_el0) },
-        { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
-          .opc0 = 3, .opc1 = 3, .opc2 = 4, .crn = 13, .crm = 0,
+        { .name = "RTPIDR_EL0", .state = ARM_CP_STATE_AA64,
+          .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 4,
           .access = PL0_RW | PL_IN_EXECUTIVE | PL_NO_SYSREG,
           .type = ARM_CP_CAP_ON_MORELLO,
-          .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
+          .fieldoffset = offsetof(CPUARMState, cp15.rtpidr_el0),
           .resetvalue = 0 },
         REGINFO_SENTINEL
     };