arch-arm: Fix CNTFRQ_EL0 permission bits

The register is marked as being writable at EL3 only (mon).  However the
arm arm states the register is accessible at the highest implemented EL.
Which means that if EL1 is the highest EL, EL1 code should be able to
modify the register value.

Change-Id: If9884fa2232869c043c96eba320e3c69efbab517
Reviewed-by: Richard Cooper <richard.cooper@arm.com>
Reviewed-on: https://gem5-review.googlesource.com/c/public/gem5/+/25428
Reviewed-by: Jason Lowe-Power <jason@lowepower.com>
Maintainer: Bobby R. Bruce <bbruce@ucdavis.edu>
Tested-by: kokoro <noreply+kokoro@google.com>

src/arch/arm/miscregs.cc

@@ -3707,8 +3707,9 @@ ISA::initializeMiscRegMetadata()
     InitReg(MISCREG_HTPIDR)
       .hyp().monNonSecure();
     InitReg(MISCREG_CNTFRQ)
-      .unverifiable()
-      .reads(1).mon();
+      .reads(1)
+      .highest(system)
+      .privSecureWrite(aarch32EL3);
     InitReg(MISCREG_CNTKCTL)
       .allPrivileges().exceptUserMode();
     InitReg(MISCREG_CNTP_TVAL)
@@ -4453,7 +4454,9 @@ ISA::initializeMiscRegMetadata()
       .allPrivileges().exceptUserMode()
       .mapsTo(MISCREG_CNTKCTL);
     InitReg(MISCREG_CNTFRQ_EL0)
-      .reads(1).mon()
+      .reads(1)
+      .highest(system)
+      .privSecureWrite(aarch32EL3)
       .mapsTo(MISCREG_CNTFRQ);
     InitReg(MISCREG_CNTPCT_EL0)
       .reads(1)