arm64: Use the right PTE when downgrading perms in pmap_promote_l2()

[markj]

Summary

When promoting a run of small mappings to a superpage, we have to
downgrade clean, writable mappings to read-only, to handle the
possibility that the MMU will concurrently mark one of the mappings as
dirty.

The code which performed this operation for the first PTE in the run
used the wrong PTE pointer. As a result, the comparison would always
fail, aborting the promotion. This only occurs when promoting writable,
clean mappings.

Fixes: ca2cae0b4dd
MFC after: 1 week

[markj]

BTW, I did some buildkernel tests on a graviton instance and found no change in the number of promotions during a buildkernel. I can't think of any non-synthetic workloads that are likely to be affected in light of the fact that arm64 implements pmap_enter(psind=1), so faults on a shared mapping skip the promotion step, assuming that some entity triggered the initial promotion through writes.

[alc]

As an aside, I would probably replicate the amd64 comments that we do not need to perform a TLB invalidation in this case.

[markj]

Add comments to pmap_promote_l2() noting that we do not invalidate the TLB.