aarch64: Save correct value of x18 on trapframe for nested faults

x18 is overwritten with a temporary copy of the kernel stack pointer
when it is saved in the trapframe.  This does not matter in terms of
function since nested exception return does not restore x18 from the
trapframe, but it does mean that examining x18 in a debugger in stack
frames above a nested fault outputs the wrong register value.

To fix, compute the value of the original stack pointer to save in x18
later after the trapframe has been constructed.

Reviewed by:	jhb, andrew
Sponsored by:	AFRL, DARPA
Differential Revision:	https://reviews.freebsd.org/D52472

sys/arm64/arm64/exception.S

@@ -42,7 +42,6 @@
  */
 .macro	save_registers_head el
 .if \el == 1
-	mov	x18, sp
 	stp	x0,  x1,  [sp, #-(TF_SIZE - TF_X + 128)]!
 .else
 	stp	x0,  x1,  [sp, #-(TF_SIZE - TF_X)]!
@@ -61,7 +60,9 @@
 	stp	x24, x25, [sp, #(24 * 8)]
 	stp	x26, x27, [sp, #(26 * 8)]
 	stp	x28, x29, [sp, #(28 * 8)]
-.if \el == 0
+.if \el == 1
+	add	x18, sp, #(TF_SIZE - TF_X + 128)
+.else
 	mrs	x18, sp_el0
 .endif
 	mrs	x10, elr_el1