checkasm/riscv: preserve T1 whilst calling...

This preserves T1 whilst calling the instrumented function. In a Sci-Fi
setting where type-based Control Flow Integrity (CFI) is supported, the
calling code (i.e., the `checkasm` test case) will set T1 to the expected
value of the landing pad label (LPL) of the instrumented function.

The call wrapper will always use LPL zero which is a wild card. We should
preserve the value of T1 at least until the indirect call to the
instrumented function. Of course this is Sci-Fi, because:
1) there is no hardware (or even QEMU) support yet,
2) all our assembler functions currently use LPL zero anyway.

This uses T3 rather than T2 because indirect branches with T2 is reserved
for notionally direct calls made with an indirect call instruction (e.g.
due to GOT indirection), and are exempted from forward-edge CFI checks.

tests/checkasm/riscv/checkasm.S

@@ -89,8 +89,8 @@ func checkasm_get_wrapper, v
 
         /* Clobber the vector configuration */
         li      t0, 0        /* Vector length: zero */
-        li      t1, -1 << 31 /* Vector type:   illegal */
-        vsetvl  zero, t0, t1
+        li      t2, -4       /* Vector type:   illegal */
+        vsetvl  zero, t0, t2
         csrwi   vxrm, 3      /* Rounding mode: round-to-odd */
         csrwi   vxsat, 1     /* Saturation:    encountered */
 
@@ -120,7 +120,7 @@ func checkasm_get_wrapper, v
 
         /* Clobber the saved and temporary registers */
         .irp    n, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
-        .if (\n > 0 && \n < 7)
+        .if (\n > 1 && \n < 7)
         mv      t\n, t0
         .endif
         fmv.d.x ft\n, t0
@@ -131,9 +131,9 @@ func checkasm_get_wrapper, v
         /* Call the tested function */
         la.tls.ie t0, checked_func
         add     t0, tp, t0
-        ld      t1, (t0)
+        ld      t3, (t0)
         sd      zero, (t0)
-        jalr    t1
+        jalr    t3
 
         /* Check special register values */
         la.tls.ie t0, saved_regs