target/i386: Reorg GET_HPHYS

target/i386: Reorg GET_HPHYS

Replace with PTE_HPHYS for the page table walk, and a direct call
to mmu_translate for the final stage2 translation.  Hoist the check
for HF2_NPT_MASK out to get_physical_address, which avoids the
recursive call when stage2 is disabled.

We can now return all the way out to x86_cpu_tlb_fill before raising
an exception, which means probe works.

Signed-off-by: Richard Henderson <[email protected]>
Message-Id: <20221002172956[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>