fixing sparc64 pmap_remove_all

[Tobias Nygren <tnn%NetBSD.org@localhost>]

Hi,

I think I know the cause of the recent sparc64 vm_page leak -- pmaps
are never free'd.

The problem is that the pmap refcount is set to zero in
pmap_remove_all(). No other ports I checked do this. When pmap_destroy()
is later called, the refcount will underflow. but because we now use
unsigned atomic ops, the greater than zero check still succeeds and so
it will think the pmap still has 2^32-1 references.

However; simply removing the pm_refs = 0 from pmap_remove_all()
doesn't work for some reason.

A working solution is to cast the return value from atomic_dec_uint_nv
in pmap_destroy into a signed value. This restores the previous
(broken) behaviour. Maybe you guys have a better idea? :-)

-Tobias