RISC-V Assembly Style Guide
OpenTitan needs to implement substantial functionality directly in RISC-V assembly.
This document describes best practices for both assembly
.S files and inline assembly statements in C and C++.
It also codifies otherwise unwritten style guidelines in one central location.
This document is not an introduction to RISC-V assembly; for that purpose, see the RISC-V Assembly Programmer’s Manual.
Assembly is typically very specialized; the following rules do not presume to describe every use-case, so use your best judgement.
This style guide is specialized for R32IMC, the ISA implemented by Ibex. As such, no advice is provided for other RISC-V extensions, though this style guide is written such that advice for other extensions could be added without conflicts.
When referring to a RISC-V register, they must be referred to by their ABI names.
See the psABI Reference for a reference to these names.
// Correct: li a0, 42 // Wrong: li x10, 42
This rule can be ignored when the ABI meaning of a register is unimportant, e.g., such as when clobbering all 31 general-purpose registers.
When performing an operation for which a pseudoinstruction exists, that pseudoinstruction must be used.
Pseudoinstructions make RISC-V’s otherwise verbose RISC style more readable; for consistency, these must be used where possible.
// Correct: sw t0, _my_global, t1 // Wrong: la t1, _my_global sw t0, 0(t1) // Correct: ret // Wrong: jr ra
Do not use aliases for opertaion-with-immediate instructions, like
add rd, rs, imm.
Assemblers usually recognize instructions like
add t0, t1, 5 as an alias for
addi. These should be avoided, since they are confusing and a potential source of errors.
// Correct: addi t0, t1, 0xf ori a0, a0, 0x4 // Wrong: add t0, t1, 0xf or a0, a0, 0x4
la to load the address of a symbol; always use
li to load an address stored in a
Some assemblers allow
la with an immediate expression instead of a symbol, allowing a form of symbol+offset.
However, support for this behavior is patchy, and the semantics of PIC
la with immediate are unclear (in PIC mode,
la should perform a GOT lookup, not a
Jumping into C
Jumping into a C function must be done either with a
call instruction, or, if that function is marked
The RISC-V jump instructions take a “link register”, which holds the return address (this should always be
ra), and a small
For jumping to a symbol, there are two user-controlled settings: “near” or “far”, and “returnable” (i.e., a link register of
The mnemonics for these are:
j sym, for a near non-returnable jump.
jal sym, for a near returnable jump.
tail sym, for a far non-returnable jump (i.e., a non-unwinding tail-call).
call sym, for a far returnable jump (i.e., function calls).
Far jumps are implemented in the assembler by emiting
auipc instructions as necessary (since the jump-and-link instruction takes only a small immediate).
Jumps into C should always be treated as far jumps, and as such use the
call instruction, unless the C function is marked
noreturn, in which case
tail can be used.
call _syscall_start tail _crt0
Control and Status Register (CSR) Names
CSRs defined in the RISC-V spec must be refered to by those names (like
mstatus), while custom non-standard ones must be encapsulated in a
Naturally, if a pseudoinstruction exists to read that CSR (like
rdtime) that one should be used, instead.
#defines for CSRs should be prefixed with
<design> is the name of the design the CSR corresponds to.
Recognized CSR prefixes:
CSR_IBEX_- A CSR specific to the Ibex core.
CSR_OT_- A CSR specific to the OpenTitan chip, beyond the Ibex core.
csrr t0, mstatus #define CSR_OT_HMAC_ENABLED ... csrw CSR_OT_HMAC_ENABLED, 0x1
Load and Store From Pointer in Register
When loading and storing from a pointer in a register, prefer to use
In the case that a pointer is being read without an offset, prefer
// Correct: lw t3, 8(sp) sb t3, 0(a0) // Wrong: lw t3, sp, 8 sb t3, a0
Compressed Instruction Mnemonics
Do not use compressed instruction mnemonics.
While Ibex implements the RISC-V C extension, it is expected that the toolchain will automatically compress instructions where possible.
Of course, this advice should be ignored when it is necessary to prove that a certain block of instructions does not exceed a particular width.
“Current Point” Label
Do not use the current point (
The current point label does not look like a label, and can be easilly missed during review.
This advice applies specifically to
.S files, as well as globally-scoped assembly in
While this is is already implicit, we only use the
.S extension for assembly files; not
Assembly files must be formatted with all directives indented two spaces, except for labels. Comments should be indented as usual.
There is no mandated requirement on aligning instruction operands.
_trap_start: .globl _trap_start csrr a0, mcause sw x1, 0(sp) sw x2, 4(sp) // ...
Comments must use either the
/* */ syntaxes.
Every function-like label which is meant to be called like a function (especially
.globls) should be given a Doxygen-style comment.
While Doxygen is not suited for assembly, that style should be used for consistency.
See the C/C++ style guide for more information.
All other advice for writing comments, as in the C/C++ style guide, also applies.
Register usage in a “function” that diverges from the RISC-V function call ABI must be documented.
This includes non-standard calling conventions, non-standard clobbers, and other behavior not expected of a well-behaved RISC-V function.
Non-standard input and output registers should use Doxygemn’s
param[in] reg and
param[out] reg annotations, respectively.
Within a function, whether or not it conforms to RISC-V’s calling convention, comments should be present to describe the asassignment of logical values to registers.
/** * Compute some stuff, outputing a 96-bit integer. * * @param[out] a0 bits [31:0] of the result. * @param[out] a1 bits [63:32] of the result. * @param[out] a2 bits [95:64] of the result. */ compute_stuff: .globl compute_stuff // a0 is to be used as an accumulator, which will be returned as-is. li a0, 0xdeadbeef // t0 is a loop variable. li t0, 0x0 1: // ... bnez t0, 1b li a1, 0xbeefcafe li a2, 0xcafedead ret
Ending an Instruction Sequence
Every code path within an assembly file must end in a non-linking jump.
Assembly should be written such that the program counter can’t wander off past the written instructions.
As such, all assembly should be ended with
ret (or any of the protection ring returns like
mret), an infinite
wfi loop, or an instruction that is guaranteed to trap and not return, like an
exit-like syscall or
loop_forever: wfi j loop_forever
Do not use
.balign as the situation requires.
The exact meaning of
.align depends on architecture; rather than asking readers to second-guess themselves, use alignment directives with strongly-typed arguments.
// Correct: .balign 8 // 8-byte aligned. tail _magic_symbol // Wrong: .align 8 // Is this 8-byte aligned, or 256-byte aligned? tail _magic_symbol
Inline Binary Directives
.8byte for inline binary data.
.long, and friends are confusing, for the same reason
This advice applies to function-scope inline assembly in
For an introduction on this syntax, check out GCC’s documentation.
When to Use
Avoid inline assembly as much as possible, as long as correctness and readability are not impacted.
Inline assembly is best reserved for when a high-level language cannot express what we need to do, such as expressing complex control flow or talking to the hardware.
If a compiler intrinsic can achieve the same effect, such as
__builtin_clz(), then that should be used instead.
The compiler is always smarter than you; only in the rare case where it is not, assembly should be used instead.
Inline assembly statements must conform to the following formatting requirements, which are chosen to closely resemble how Google’s clang-format rules format function calls.
- Neither the
__asm__keyword is specified in C; the former must be used, and should be
#defined into existence if not supported by the compiler. C++ specifies
asmto be part of the grammar, and should be used exclusively.
There should not be a space after the
asmqualfiers and the opening parentheses:
asm(...); asm volatile(...);
asmstatements should be written on one line, if possible:
asmstatements should be written with one instruction per line, formatted as follows:
asm volatile( "my_label:" " la sp, _stack_start;" " tail _crt0;" ::: "memory");
The colons separating register constraints should be surrounded with spaces, unless there are no constraints between them, in which case they should be adjacent.
asm("..." : "=a0"(foo) :: "memory");
Functions with non-returning
asm must be marked as
C and C++ compilers are, in general, not supposed to introspect
asm blocks, and as such cannot determine that they never return.
Functions marked as never returning should end in
__builtin_unreachable(), which the compiler will usually turn into an