armv7a: correct calculation of ttbr0_mask