Allow writes to rw pages in pte_spill_v

Allow writes to rw pages in pte_spill_v

In the powerpc pmap, hash collisions can spill page table entries.
Page faults can use pte_spill_v to reinsert a spilled pte.  If the
fault is a write (DSISR_STORE), then pte_spill_v tries to check for a
read-only page.  The existing check (pte_lo & PTE_RO_64) also matched
rw pages, because PTE_RO_64 is 3 and PTE_RW_64 is 2.  This caused
pte_spill_v to deny writes to rw pages.  Then uvm_fault might allow
the write; but uvm_fault can't handle some pages in the kernel.  Such
faults caused, "panic: uvm_fault: fault on non-pageable map", or
"panic: trap type 300".

Change it to ((pte_lo & PTE_PP_64) == PTE_RO_64).  This seems to fix
one reason why bsd.mp on a macppc dual G5 might panic.

ok kettenis@ miod@