OpenTitan needs to implement substantial functionality directly in RISC-V assembly. This document describes best practices for both assembly .S files and inline assembly statements in C and C++. It also codifies otherwise unwritten style guidelines in one central location.
This document is not an introduction to RISC-V assembly; for that purpose, see the RISC-V Assembly Programmer's Manual.
Assembly is typically very specialized; the following rules do not presume to describe every use-case, so use your best judgment.
This style guide is specialized for R32IMC, the ISA implemented by Ibex. As such, no advice is provided for other RISC-V extensions, though this style guide is written such that advice for other extensions could be added without conflicts.
When referring to a RISC-V register, they must be referred to by their ABI names.
See the psABI Reference for a reference to these names.
Example:
// Correct: li a0, 42 // Wrong: li x10, 42
This rule can be ignored when the ABI meaning of a register is unimportant, e.g., such as when clobbering all 31 general-purpose registers.
When performing an operation for which a pseudoinstruction exists, that pseudoinstruction must be used.
Pseudoinstructions make RISC-V's otherwise verbose RISC style more readable; for consistency, these must be used where possible.
Example:
// Correct: sw t0, _my_global, t1 // Wrong: la t1, _my_global sw t0, 0(t1) // Correct: ret // Wrong: jr ra
Do not use aliases for operation-with-immediate instructions, like add rd, rs, imm.
Assemblers usually recognize instructions like add t0, t1, 5 as an alias for addi. These should be avoided, since they are confusing and a potential source of errors.
Example:
// Correct: addi t0, t1, 0xf ori a0, a0, 0x4 // Wrong: add t0, t1, 0xf or a0, a0, 0x4
Always use la to load the address of a symbol; always use li to load an address stored in a #define.
Some assemblers allow la with an immediate expression instead of a symbol, allowing a form of symbol+offset. However, support for this behavior is patchy, and the semantics of PIC la with immediate are unclear (in PIC mode, la should perform a GOT lookup, not a pc-relative load).
Jumping into a C function must be done either with a call instruction, or, if that function is marked noreturn, a tail instruction.
The RISC-V jump instructions take a “link register”, which holds the return address (this should always be zero or ra), and a small pc-relative immediate. For jumping to a symbol, there are two user-controlled settings: “near” or “far”, and “returnable” (i.e., a link register of zero or ra). The mnemonics for these are:
j sym, for a near non-returnable jump.jal sym, for a near returnable jump.tail sym, for a far non-returnable jump (i.e., a non-unwinding tail-call).call sym, for a far returnable jump (i.e., function calls).Far jumps are implemented in the assembler by emitting auipc instructions as necessary (since the jump-and-link instruction takes only a small immediate). Jumps into C should always be treated as far jumps, and as such use the call instruction, unless the C function is marked noreturn, in which case tail can be used.
Example:
call _syscall_start
tail _crt0
CSRs defined in the RISC-V spec must be referred to by those names (like mstatus), while custom non-standard ones must be encapsulated in a #define.
Naturally, if a pseudoinstruction exists to read that CSR (like rdtime) that one should be used, instead.
#defines for CSRs should be prefixed with CSR_<design>_, where <design> is the name of the design the CSR corresponds to.
Recognized CSR prefixes:
CSR_IBEX_ - A CSR specific to the Ibex core.CSR_OT_ - A CSR specific to the OpenTitan chip, beyond the Ibex core.Example:
csrr t0, mstatus #define CSR_OT_HMAC_ENABLED ... csrw CSR_OT_HMAC_ENABLED, 0x1
When loading and storing from a pointer in a register, prefer to use n(reg) shorthand.
In the case that a pointer is being read without an offset, prefer 0(reg) over (reg).
// Correct: lw t3, 8(sp) sb t3, 0(a0) // Wrong: lw t3, sp, 8 sb t3, a0
Do not use compressed instruction mnemonics.
While Ibex implements the RISC-V C extension, it is expected that the toolchain will automatically compress instructions where possible.
Of course, this advice should be ignored when it is necessary to prove that a certain block of instructions does not exceed a particular width.
Do not use the current point (.) label.
The current point label does not look like a label, and can be easily missed during review.
Local labels (for control flow) should start with .L_.
This is the convention for private symbols in ELF files. After the prefix, labels should be snake_case like other symbols.
.L_my_label: beqz a0, .L_my_label
.S FilesThis advice applies specifically to .S files, as well as globally-scoped assembly in .c and .cc files.
While this is is already implicit, we only use the .S extension for assembly files; not .s or .asm. Note that .s actually means something else; .S files have the preprocessor run on them; .s files do not.
Assembly files must be formatted with all directives indented two spaces, except for labels. Comments should be indented as usual.
There is no mandated requirement on aligning instruction operands.
Example:
_trap_start: csrr a0, mcause sw x1, 0(sp) sw x2, 4(sp) // ...
Comments must use either the // or /* */ syntaxes.
Every function-like label which is meant to be called like a function (especially .globals) should be given a Doxygen-style comment. While Doxygen is not suited for assembly, that style should be used for consistency. See the [C/C++ style guide]({{< relref “c_cpp_coding_style” >}}) for more information.
Comments should be indented to match the line immediately after. For example:
// This comment is correctly indented. call foo // This one is not. call foo
All other advice for writing comments, as in the C/C++ style guide, also applies.
All “top-level” symbols must have the correct preamble and footer of directives.
To aid the disassembler, every function must follow the following template:
/** * Comment describing what my function does */ .section .some_section // Optional if the previous symbol is in this setion. .balign 4 .global my_function // Only for exported symbols. .type my_function, @function my_function: // Instructions and stuff. .size my_function, .-my_function
Note that .global is not spelled with the legacy .globl spelling. If the symbol represents a global variable that does not consist of encoded RISC-V instructions, @function should be replaced with @object, so that the disassembler does not disassemble it as code. Thus, interrupt vectors, although not actually functions, are marked with @function.
The first instruction in the function should immediately follow the opening label.
Register usage in a “function” that diverges from the RISC-V function call ABI must be documented.
This includes non-standard calling conventions, non-standard clobbers, and other behavior not expected of a well-behaved RISC-V function. Non-standard input and output registers should use Doxygen's param[in] reg and param[out] reg annotations, respectively.
Within a function, whether or not it conforms to RISC-V's calling convention, comments should be present to describe the assignment of logical values to registers.
Example:
/** * Compute some stuff, outputing a 96-bit integer. * * @param[out] a0 bits [31:0] of the result. * @param[out] a1 bits [63:32] of the result. * @param[out] a2 bits [95:64] of the result. */ .balign 4 .global compute_stuff .type compute_stuff, @function compute_stuff: // a0 is to be used as an accumulator, which will be returned as-is. li a0, 0xdeadbeef // t0 is a loop variable. li t0, 0x0 1: // ... bnez t0, 1b li a1, 0xbeefcafe li a2, 0xcafedead ret .size compute_stuff, .-compute_stuff
Every code path within an assembly file must end in a non-linking jump.
Assembly should be written such that the program counter can't wander off past the written instructions. As such, all assembly should be ended with ret (or any of the protection ring returns like mret), an infinite wfi loop, or an instruction that is guaranteed to trap and not return, like an exit-like syscall or unimp.
Example:
loop_forever: wfi j loop_forever
Functions may end without a terminator instruction if they are intended to fall through to the next one, so long as this is explicitly noted in a comment.
Do not use .align; use .p2align and .balign as the situation requires.
The exact meaning of .align depends on architecture; rather than asking readers to second-guess themselves, use alignment directives with strongly-typed arguments.
Example:
// Correct: .balign 8 // 8-byte aligned. tail _magic_symbol // Wrong: .align 8 // Is this 8-byte aligned, or 256-byte aligned? tail _magic_symbol
Always use .byte/.2byte/.4byte/.8byte for inline binary data.
.word, .long, and friends are confusing, for the same reason .align is.
If a sequence of zeroes is required, use .zero count, instead.
.extern DirectiveAll symbols are implicitly external unless defined in the current file; there is no need to use the .extern directive.
.extern was previously allowed to “bring” symbols into scope, but GNU-flavored assemblers ignore it. Because it is not checked, it can bit-rot, and thus provides diminishing value.
This advice applies to function-scope inline assembly in .c and .cc files. For an introduction on this syntax, check out GCC's documentation.
Avoid inline assembly as much as possible, as long as correctness and readability are not impacted.
Inline assembly is best reserved for when a high-level language cannot express what we need to do, such as expressing complex control flow or talking to the hardware. If a compiler intrinsic can achieve the same effect, such as __builtin_clz(), then that should be used instead.
The compiler is always smarter than you; only in the rare case where it is not, assembly should be used instead.
Inline assembly statements must conform to the following formatting requirements, which are chosen to closely resemble how Google's clang-format rules format function calls.
asm or __asm__ keyword is specified in C; the former must be used, and should be #defined into existence if not supported by the compiler. C++ specifies asm to be part of the grammar, and should be used exclusively.asm qualfiers and the opening parentheses:asm(...); asm volatile(...);
asm statements should be written on one line, if possible:asm volatile("wfi");
asm statements should be written with one instruction per line, formatted as follows:asm volatile( "my_label:" " la sp, _stack_start;" " tail _crt0;" ::: "memory");
asm("..." : "=a0"(foo) :: "memory");
asmFunctions with non-returning asm must be marked as noreturn.
C and C++ compilers are, in general, not supposed to introspect asm blocks, and as such cannot determine that they never return. Functions marked as never returning should end in __builtin_unreachable(), which the compiler will usually turn into an unimp.