fix(riscv64): compressed store offsets, FENCE and branch range checks

Assisted-by: GLM 5.3

asm/riscv_encode.go

@@ -373,7 +373,7 @@ var riscvFmaTable = map[string]riscvFmaEnc{
 // riscvFmaType encodes an R4-type fused multiply-add instruction.
 func riscvFmaType(enc riscvFmaEnc, rd, rs1, rs2, rs3 int) uint32 {
 	return (uint32(rs3) << 27) | (enc.fmt << 25) | (uint32(rs2) << 20) |
-		(uint32(rs1) << 15) | (0x0 << 12) /* rm=dynamic */ | (uint32(rd) << 7) | enc.opcode
+		(uint32(rs1) << 15) | (0x0 << 12) /* rm=RNE */ | (uint32(rd) << 7) | enc.opcode
 }
 
 // CSR (Control and Status Register) instructions.
@@ -522,11 +522,13 @@ func rvcCL(funct3, rd, rs1 uint32, imm uint32) uint16 {
 
 // rvcCS encodes a register-relative compressed store (op=00 quadrant): C.SW
 // (funct3=6), C.SD (funct3=7) or C.FSD (funct3=5).  imm is the full byte
-// offset; the immediate bits are extracted per the RISC-V CS format.
+// offset; the immediate bits are extracted per the RISC-V CS format, with the
+// same five-bit patterns as the load side ({5,4,3,7,6} and {5,4,3,2,6},
+// matching the toolchain's encodeCS).
 func rvcCS(funct3, rs2, rs1 uint32, imm uint32) uint16 {
-	pattern := []int{5, 3, 7, 6}
+	pattern := []int{5, 4, 3, 7, 6}
 	if funct3 == 0x6 {
-		pattern = []int{5, 3, 2, 6}
+		pattern = []int{5, 4, 3, 2, 6}
 	}
 	packed := encodeRVCPattern(imm, pattern)
 	return uint16((funct3 << 13) | ((packed>>2)&0x7)<<10 | (rs1 << 7) | ((packed & 0x3) << 5) | (rs2 << 2))