Instruction Sets and Assembly Language

A processor executes instructions represented by bits. An instruction set architecture (ISA) gives those bits a shared meaning, so software can request the same operations on different implementations.

What the ISA defines

The ISA specifies instructions, visible registers, data sizes, memory behavior and instruction encodings. An instruction such as add a0, a1, a2 must produce the defined result on every processor that supports it. The internal circuits and scheduling belong to the microarchitecture. Two chips can differ greatly in speed and power use while implementing the same ISA.

Binary compatibility also needs the software environment to match. A program that calls an operating-system service or library depends on more than instruction meanings. Register conventions and data layouts are part of the application binary interface, or ABI.

From readable code to bits

For C, a compiler selects assembly instructions; an assembler encodes them as machine code. Assembly is text with instruction names, registers, comments and labels. Machine code is the binary representation the processor fetches. A label such as Start: names an instruction address; it is not an instruction executed at run time. A comment begins with #.

Start:
    add a0, a1, a2   # a0 receives a1 + a2

The first register is the destination. If a1 holds 14 and a2 holds 5, the instruction writes 19 into a0; it leaves the sources unchanged. More complex expressions need several operations. Adding four register values takes three additions, with intermediate results held in registers.

Most instruction names correspond to one machine instruction. A pseudo-instruction is an assembler shorthand: mv requests a register copy and li requests a constant. A pseudo-instruction can expand into one or several real instructions, so counting assembly lines does not always give code size.

Instructions stored in memory

Under the stored-program concept, instructions and data are both represented as numbers in memory. The program counter, pc, identifies the instruction to fetch. For a sequence of 32-bit instructions, ordinary execution advances it by 4 bytes. Branches and jumps choose a different next address. The processor executes the encoding, not the assembly spelling that originally produced it.

RISC-V bases and extensions

RISC-V is an open, royalty-free ISA standard maintained by RISC-V International. RV32I supplies 40 base integer instructions and 32-bit integer registers; RV64I uses 64-bit integer registers. Both provide 32 integer registers. Optional extensions add capabilities: M supplies integer multiplication and division, A atomic operations, F and D floating point, C compressed instructions, and V vectors. The examples use RV32I and use M where mul appears.

RISC-V assembly is specific to RISC-V. A C program can be recompiled for x86 or ARM, but its RISC-V machine code cannot execute directly as those ISAs. A simulator can execute RISC-V instructions on a host with a different ISA and expose register and memory changes one step at a time.

Registers hold the values an instruction can use immediately. In RV32I each integer register holds 32 bits, and a register name identifies storage, not a C variable or a data type.

Register names and roles

There are 32 integer registers, x0 through x31. The program counter is separate. Five bits identify one integer register because there are 32 possible 5-bit patterns. A small register file also limits access cost and the space register fields consume in instructions.

Register s0 can also serve as fp, the frame pointer. Writes to zero are discarded, so it can supply a zero operand without first loading a constant. For example, add a0, a1, zero copies a1.

These names express a software agreement. In particular, the hardware does not preserve an s register automatically. A procedure that changes it must arrange to restore its incoming value. The standard ABI also reserves gp and tp for their environment roles; they are not ordinary scratch registers.

Break an expression into operations

Translate f = (g + h) - (i + j); with g, h, i, j in s1–s4 and the result in s0:

add t0, s1, s2
add t1, s3, s4
sub s0, t0, t1

With values 9, 4, 6 and 1, the first instruction leaves 13 in t0. The second leaves 7 in t1. The subtraction writes 6 into s0. Each temporary holds a result until the next instruction needs it.

The order of the two source operands matters for subtraction: sub s0, t1, t0 would give −6. The destination is always first, so sub t0, s0, t1 would instead overwrite a temporary and read the old s0. When tracing, write down the destination after each line; do not update both source registers.

Bits acquire meaning through use

A register has no signed or unsigned tag. The pattern 0xFFFFFFFF can mean signed −1 or unsigned 4,294,967,295. A signed comparison and an unsigned comparison can therefore disagree about the same stored bits. Addresses are also register bit patterns; a load interprets its base as an address.

Keep values alive for as long as needed

A compiler assigns frequently used values to registers. If it needs more live values than registers can hold, it stores some in memory, a process called spilling, and reloads them later. A spill is an actual store/load cost.

Calls create another boundary. A called procedure can overwrite t0–t6 and a0–a7. Keep a value needed after a call in a properly preserved s register, or save it to the stack before the call. Choosing t0 merely because it was free does not make its value survive.

Memory addresses identify bytes. Loads bring data into registers, and stores copy register bits back to memory. In a load-store architecture, arithmetic does not read its operands directly from memory.

Sizes and byte offsets

A byte occupies one address, a halfword two, and a 32-bit word four. RV32 has a 32-bit address space of up to 4 GiB. In the ILP32 C ABI, char uses 1 byte, short 2, and int, long and pointers 4.

The instructions lw and sw transfer words. Halfword loads are lh and lhu, and byte loads are lb and lbu. Stores use sh and sb for the smaller sizes. A store copies the low bits of its source; sb writes only the low 8 bits.

An address is a base register plus a signed 12-bit byte offset:

lw t0, 32(s3)
sw t0, 48(s3)

The load reads the word at the address in s3 plus 32. It does not add 32 to the loaded value, and it does not change s3. The store writes that value at the base plus 48. The offset range is −2048 through 2047.

Translate an array access

For an int array whose base is in s3, element A[i] begins at the base plus 4 times the index. To implement A[12] = h + A[8];, with h in s1:

lw t0, 32(s3)      # A[8]
add t0, s1, t0
sw t0, 48(s3)      # A[12]

If A[8] is 80 and h is 3, A[12] becomes 83. An offset of 8 would select A[2], since the address counts bytes. For a variable index in s4, form the address first:

slli t1, s4, 2
add t1, s3, t1
lw t0, 0(t1)

Scaling follows element size, not the processor name. An RV64 LP64 pointer or long occupies 8 bytes and uses ld/sd; an RV64 int still occupies 4.

Extend a small load

A register must hold 32 bits even when a load reads only 8. lb copies the byte's sign bit into every higher bit; lbu fills the higher bits with zeros. Thus byte 0xF0 becomes 0xFFFFFFF0 (−16) with lb, but 240 with lbu. The same distinction applies to lh and lhu. Unsigned bytes, including string bytes, use lbu.

Read the byte order

In little-endian memory, the least significant byte occupies the lowest address. Storing 0x12345678 at 0x1000 places 0x78, 0x56, 0x34, 0x12 at addresses 0x1000 through 0x1003. A byte load from the first address reads 0x78. Big-endian order places 0x12 first; RISC-V systems can define either order, while the usual teaching systems are little-endian.

A naturally aligned address is a multiple of the access size: 4 for a word and 2 for a halfword. Naturally aligned accesses have architectural support. A misaligned access may work, take extra time or raise an exception, depending on the execution environment. Place words on 4-byte boundaries and advance by 4 to reach the next word.

An immediate is a constant encoded inside an instruction. It lets a common operation such as incrementing a counter avoid a separate load.

Small constants

addi t0, t0, 1 adds 1 to t0. Its immediate is signed 12-bit two's complement, from −2048 to 2047. The processor sign-extends it to 32 bits before addition. Subtract a small constant with a negative immediate, as in addi t0, t0, -5; RV32I has no subtract-immediate instruction.

Loads, jalr, and ordinary arithmetic/logical immediate instructions use signed 12-bit immediates too. In particular, andi, ori and xori do not zero-extend their constants. Shift-immediate instructions instead encode an RV32 shift amount of 0 through 31.

Useful assembler shorthands include:

The constant −1 becomes all ones when sign-extended, which is why xori with −1 flips every bit.

Build all 32 bits

lui places a 20-bit field in bits 31–12 and clears the low 12 bits. For 0x12345678:

lui t0, 0x12345
addi t0, t0, 0x678

The intermediate value is 0x12345000; adding 1,656 supplies the low part. A low part with bit 11 set needs more care. Its 12-bit pattern represents a negative addend, so increase the upper part before adding it.

For 0x00001800, the low pattern 0x800 means −2048. Use:

lui t0, 0x2
addi t0, t0, -2048

The first result is 0x2000. Subtracting 0x800 produces 0x1800. Using upper field 0x1 would produce 0x800, one block of 4096 too low.

For any 32-bit constant, read its low 12 bits as a signed value. Subtract that signed value from the desired constant, divide by 4096, and retain the low 20 bits for lui. For 0xDEADBEEF, the signed low part is −273, so use upper field 0xDEADC, then addi with −273. Assemblers perform this split for li.

Constants, addresses and contents

li t0, 100 puts the number 100 in a register. lw t0, 100(zero) reads the contents of memory at address 100. An address can itself be loaded as a value: la t0, Item asks the assembler for the address named by Item.

auipc adds an upper immediate shifted left 12 bits to the address of that instruction. Combined with an immediate operation or load, it provides pc-relative access across about ±2 GiB. A local la commonly uses auipc plus addi; other expansions support shared-library access.

A constant such as 5,000 cannot be an addi operand. Load it into a second register with li, then use add. A larger value does not gain a wider immediate just because it is written in hexadecimal.

An arithmetic instruction reads register bits and writes a new bit pattern. Understanding that pattern requires both the operation and the intended signed or unsigned interpretation.

Addition, subtraction and overflow

In RV32I, add, sub and addi retain the low 32 result bits. Adding 1 to 0x7FFFFFFF produces 0x80000000, which represents −2,147,483,648 as a signed integer. The instruction raises no overflow exception.

For unsigned addition, software can detect wraparound:

add t0, a0, a1
bltu t0, a0, Overflow

A wrapped unsigned sum is smaller than an input. This unsigned test is not the rule for signed overflow, where input and result signs matter.

The M extension supplies mul, mulh, mulhu, div, divu, rem and remu. mul keeps the low product bits; the high-product instructions distinguish signed and unsigned inputs. Division by zero returns an all-ones quotient and the original dividend as remainder, without a division exception.

Select, set and flip bits

and, or and xor operate independently on each bit. AND with 1 keeps a bit; AND with 0 clears it. OR with 1 sets a bit, and XOR with 1 toggles it.

srli t0, a0, 4
andi t0, t0, 0xF

With a0 = 0xABCD, shifting right gives 0xABC. Masking with 0xF leaves 0xC, the original bits 7–4. The shift puts the field at the bottom; the mask removes everything above it. To set bit 4 without changing the others, use ori a0, a0, 0x10. xori with −1 flips all 32 bits.

Choose a shift by its fill rule

A left shift, sll or slli, fills low positions with zeros. A logical right shift, srl or srli, fills high positions with zeros. An arithmetic right shift, sra or srai, copies the sign bit into high positions. RV32 register shifts use only the low 5 bits of the shift-count register.

Shifting 13 left by 3 produces 104. This multiplies by 8 because no needed bits are lost. Left shifts that discard significant bits instead retain only the result that fits in the register.

For unsigned values, right shift divides by a power of 2 and rounds down. For signed values, arithmetic right shift rounds toward negative infinity: shifting −7 right by 1 gives −4. C signed division truncates toward zero, giving −3 for -7 / 2. A compiler needs a correction before replacing that signed division with a shift. A logical shift of the same negative pattern fills with zeros and gives a large positive result.

Compare to produce a value

slt writes 1 when its signed first source is smaller, and 0 otherwise. sltu uses unsigned interpretation. With 0xFFFFFFFF and 1 as inputs, slt writes 1, while sltu writes 0. Immediate versions are slti and sltiu; the latter still sign-extends its immediate before the unsigned comparison.

Bitwise AND is different from C's &&. A bitwise result can contain many set bits; logical AND produces 0 or 1 and may skip evaluating the second expression.

A conditional branch compares two registers and changes the program counter when its test succeeds. When it fails, execution continues with the next instruction.

Pick the comparison

RISC-V combines comparison and branch in one instruction. It has no integer condition flags to set first. To test against zero, use zero as one source. beqz a0, L expands to beq a0, zero, L.

Greater-than and less-than-or-equal forms are assembler shorthands with swapped sources. bgt a0, a1, L expands to blt a1, a0, L. Swapping the source order matters just as much as selecting the correct mnemonic.

Signed and unsigned control flow

If a0 holds 0xFFFFFFFF and a1 holds 1, blt a0, a1, L takes the branch because signed −1 is less than 1. bltu does not, because the first pattern is a large unsigned value. Use comparisons consistent with the data's meaning, including unsigned comparison for addresses.

An unsigned bounds check can reject negative signed indexes as well as indexes at or above a small nonnegative length:

bgeu a0, a1, OutOfBounds

For a length of 20, an index of −1 appears as unsigned 4,294,967,295 and branches. An index of 19 does not; an index of 20 does. The length must represent the array's actual nonnegative length.

Jumps and return addresses

jal ra, f writes the next instruction address, pc + 4, into ra, then jumps to f. A plain j L expands to jal zero, L; its link value is discarded. This is appropriate for a loop back edge, but does not establish a return address for a call.

jalr rd, offset(rs1) adds a signed 12-bit offset to a register value, clears bit 0 of the target, and writes its own pc + 4 into rd. ret expands to jalr zero, 0(ra), returning to the saved address without keeping a new link.

Conditional branches and jal store offsets relative to their own instruction addresses. Their reach is about ±4 KiB and ±1 MiB respectively. jalr uses a register-based target and can reach across the address space. A far conditional transfer can invert the test to skip a longer jump:

bne a0, a1, Skip
jal zero, Far
Skip:

Here Far is within jal reach. If equality holds, the short branch falls through into the jump; otherwise it skips it.

Recognize a basic block

A basic block has one entry at its beginning and no transfer of control before its end. Inside it, instructions run in sequence. Branch targets start new blocks; branches and jumps end them. This makes it possible to reason about which assignments always run before a particular test or exit.

Assembly makes every path through a decision or loop explicit. Labels mark destinations, conditional branches choose paths, and plain jumps prevent unwanted fall-through.

An if-else needs an exit path

Translate if (i == j) f = g + h; else f = g - h;, with f, g, h, i, j in s0–s4:

bne s3, s4, Else
add s0, s1, s2
j Exit
Else:
sub s0, s1, s2
Exit:

The first branch tests the opposite of the C condition so that equality falls through into addition. The jump after addition prevents execution of subtraction. With g = 10 and h = 3, equal indexes give 13; unequal indexes give 7. Removing j Exit makes the subtraction run after the addition too.

For a < b && b < c, branch to the else-part as soon as either comparison fails. For a < b || b < c, branch to the then-part as soon as either succeeds. This implements short-circuit evaluation, including skipping a second expression whose value is unnecessary.

A while loop tests before its body

For while (save[i] == k) i++;, keep i in s3, k in s5 and the array base in s6:

Loop:
slli t1, s3, 2
add t1, t1, s6
lw t0, 0(t1)
bne t0, s5, Exit
addi s3, s3, 1
j Loop
Exit:

Each visit forms the current element address, loads it and checks it. With the array {7, 7, 7, 2, 7}, initial index 0 and k = 7, the loop exits with index 3. The failed test does not increment the index. The array must contain a stopping element within its valid range.

Sum a counted array

For a nonnegative element count in a1 and the array base in a0:

li t1, 0
li t0, 0
Loop:
bge t0, a1, Done
slli t2, t0, 2
add t2, a0, t2
lw t3, 0(t2)
add t1, t1, t3
addi t0, t0, 1
j Loop
Done:
mv a0, t1
ret

The top test handles a zero length without a load. With four elements {5, -2, 10, 7}, the running sum is 5, 3, 13, then 20. The sequence executes 33 instructions: 2 setup instructions, 7 for each of four successful iterations, one failed test and 2 finish instructions.

A pointer version forms an end address once and advances the current address by 4. For a valid array range whose end address does not wrap, it can use unsigned address comparisons:

li t1, 0
slli t0, a1, 2
add t0, a0, t0
bgeu a0, t0, Done
Loop:
lw t3, 0(a0)
add t1, t1, t3
addi a0, a0, 4
bltu a0, t0, Loop
Done:
mv a0, t1
ret

There are 4 setup instructions, 4 per iteration and 2 finish instructions, totaling 22 for four elements. The initial branch skips the body for an empty range; the pointer advances by one element after each load.

Multiway decisions

A switch can use repeated comparisons or a jump table when case values are dense. A table dispatch checks the case range, scales an index by the 4-byte entry size, loads the case address and jumps through it with jalr zero, 0(t0). The range check must precede the table load so that an invalid case cannot select an unrelated address.

A machine instruction is a 32-bit word divided into fields. Encoding means choosing the right layout, assigning each operand to a field, and writing every field at its full width.

Fixed positions simplify decoding

The low 7 bits, 6–0, hold the opcode. Where present, rd occupies bits 11–7, funct3 bits 14–12, rs1 bits 19–15 and rs2 bits 24–20. Five-bit register fields name x0 through x31. Function fields distinguish operations sharing an opcode.

RV32I uses R, I, S, B, U and J formats. They fit different operands into the same 32 bits while keeping register positions stable. For signed immediates, bit 31 carries the sign.

R-type: two sources and a destination

From bit 31 down to bit 0, the R layout is:

funct7 | rs2 | rs1 | funct3 | rd | opcode
   7      5     5       3     5       7 bits

For add s0, a0, a1, rd = 8, rs1 = 10, rs2 = 11. ADD uses opcode 0110011, funct3 = 000, funct7 = 0000000:

0000000 | 01011 | 01010 | 000 | 01000 | 0110011
0000 0000 1011 0101 0000 0100 0011 0011

The hexadecimal word is 0x00B50433. SUB changes only funct7 to 0100000, giving 0x40B50433 for sub s0, a0, a1. Source fields appear in a different order from the assembly operands, so do not simply concatenate the printed register names.

I-type: one source and an immediate

The I layout is imm[11:0] | rs1 | funct3 | rd | opcode. addi uses opcode 0010011 and funct3 = 000. In addi sp, sp, -16, both register fields contain 00010. The 12-bit immediate is 111111110000 (0xFF0), producing 0xFF010113.

A load uses I-type too, with the address base as rs1 and the loaded register as rd. lw t0, 32(s3) has immediate 32, base x19, destination x5, opcode 0000011 and funct3 = 010, giving 0x0209A283.

Shift-immediate operations use the low 5 bits of the immediate region as the shift amount. The upper control bits distinguish shifts: srli t0, t1, 3 is 0x00335293, while srai t0, t1, 3 is 0x40335293. Bit 30 selects the arithmetic fill rule.

S-type: store a source value

A store has no register destination. The S layout uses that space for part of its immediate:

imm[11:5] | rs2 | rs1 | funct3 | imm[4:0] | opcode

For sw t0, 48(s3), rs2 = 5 supplies the stored value and rs1 = 19 supplies the base. The 12-bit immediate 48 splits into 0000001 and 10000. With funct3 = 010 and opcode 0100011, the result is 0x0259A823. There is no rd to fill with t0.

After joining fields, group the complete 32-bit string into eight 4-bit nibbles and convert each to one hex digit. Then decode the result: confirm the opcode, register numbers and signed immediate. Padding a register field to 5 bits is essential; dropping a leading zero changes the positions of later fields.

Branch and jump encodings save space by omitting an offset bit that is always zero. Their fields still represent byte distances, and the sign must be reconstructed before calculating the target.

B-type branch offsets

Compute the offset as the target address minus the branch address itself. A bne at 0x1010 targeting 0x1000 uses −16 bytes, not −20 and not −4 instructions.

B-type uses opcode 1100011. Its signed offset has 13 bits, including an unstored zero bit 0. The range is −4096 through +4094 bytes, in steps of 2. Placement is:

The source fields stay in their familiar positions. The funct3 values are 000 for beq, 001 for bne, 100 for blt, 101 for bge, 110 for bltu and 111 for bgeu.

For bne t0, t1, -16, the 13-bit offset is 1 1111 1111 0000. Its scattered parts are 1, 111111, 1000 and 1 in the table's order. With rs1 = 5 and rs2 = 6, the instruction is 0xFE6298E3. Replacing the offset with +12 gives 0x00629663.

Offsets support 2-byte steps because compressed instructions can be 2 bytes long. A taken target must still satisfy the active instruction alignment: RV32I without compressed instructions requires 4-byte alignment.

J-type and U-type

jal uses opcode 1101111. Its 21-bit signed byte offset omits bit 0 and places bits in the order imm[20|10:1|11|19:12] across instruction bits 31–12. The range is −1,048,576 through +1,048,574 bytes. jal ra, 192 becomes 0x0C0000EF.

U-type places its upper 20-bit value directly in instruction bits 31–12, followed by rd and the opcode. lui uses 0110111; auipc uses 0010111. Thus lui t0, 0x12345 is 0x123452B7.

Decode by the opcode first

For 0x00A12423, the low 7 bits are 0100011: a store. funct3 = 010 selects sw. The source fields give base x2 (sp) and value x10 (a0). The two immediate fragments join to 8, so the assembly is sw a0, 8(sp).

For a branch, join the scattered pieces in offset-bit order, append the implied zero, and sign-extend the full 13-bit result. Treating the 12 stored bits as an ordinary I-type immediate loses both the correct arrangement and the scale. The sign bit's fixed position and reuse of other field positions reduce decoder work, although the printed layout is less convenient to read by hand.

Relocation preserves relationships

If a branch and its target both move by the same distance, subtracting their new addresses gives the old offset. A reference into another section may change when sections are laid out separately. A linker can therefore preserve an internal relative branch while patching a reference to an external symbol.

A procedure call transfers control and data between independently written pieces of code. The calling convention tells both sides where arguments and results go and which register values must survive.

The call and return sequence

The caller places the first eight integer arguments in a0–a7; additional arguments go on the stack. The procedure returns an integer result in a0, using a1 as well for a 64-bit result in RV32.

jal ra, f stores its own address plus 4 in ra, then jumps to f. jal f is its short spelling. The pseudo-instruction call f normally expands to auipc plus jalr for longer reach; the linker may shorten it to one jal. In either case, the return address follows the actual call sequence.

ret is jalr zero, 0(ra). It jumps through the saved address, discarding a new link. A plain j f also discards its link, so it does not set up an ordinary call and return.

Decide who saves a value

Caller-saved registers include t0–t6, a0–a7 and ra. The callee can change them. If the caller needs one of their current values later, it saves that value before the call.

Callee-saved registers include s0–s11 and sp. A callee that changes an s register must save the incoming value and restore it before returning. Restoring sp returns the caller to its own frame. The processor does not enforce these promises; compiled modules cooperate because their software follows the ABI.

Suppose a caller has a loop counter in t0 and invokes a helper. The helper can legally use t0 for its own calculation. Moving the counter into s1 can make it survive helpers, but the surrounding procedure must then preserve the s1 value it received from its own caller.

A leaf procedure can need no frame

A leaf procedure calls no other procedure. This function computes (g + h) - (i + j) from arguments in a0–a3:

leaf:
add t0, a0, a1
add t1, a2, a3
sub a0, t0, t1
ret

It uses only caller-saved working registers and leaves ra unchanged. For inputs 9, 4, 6 and 1, it returns 6. It needs no stack frame.

If the calculation uses s0 instead, it must preserve that register:

addi sp, sp, -16
sw s0, 12(sp)
add t0, a0, a1
add t1, a2, a3
sub s0, t0, t1
mv a0, s0
lw s0, 12(sp)
addi sp, sp, 16
ret

The result is moved to a0 before the old s0 is restored. If the incoming s0 was 1234, it is still 1234 afterward. The allocated frame is 16 bytes to preserve standard stack alignment even though the saved word uses only 4.

A call can be read as six actions: place arguments, transfer control, acquire storage, perform the task, place the result, and return. At each boundary, distinguish the value being returned from the older values that the convention requires the procedure to preserve.

Nested calls need somewhere to keep the outer call's data. The stack provides last-in, first-out storage: the most recent call finishes first and releases its own frame.

Allocate below the old stack pointer

The stack grows toward lower addresses. addi sp, sp, -16 reserves 16 bytes; addi sp, sp, 16 releases them. The standard ABI keeps sp a multiple of 16 throughout execution. A frame can hold saved registers, the return address, spilled values, local objects and space for outgoing stack arguments.

A common nonleaf pattern is:

addi sp, sp, -16
sw ra, 12(sp)
sw s0, 8(sp)
# body, including calls
lw s0, 8(sp)
lw ra, 12(sp)
addi sp, sp, 16
ret

The offsets refer to the new sp. If it is 0x2000, the saved ra occupies 0x200C through 0x200F. The matching epilogue restores values while the frame still exists, then releases it. Every return path must balance the allocation.

A frame pointer, conventionally s0, can give local objects fixed offsets when sp changes within a procedure. Its incoming value must be preserved like any other use of s0.

Recursion keeps separate copies

Factorial needs the original n after computing fact(n - 1). It also needs its own return address after the recursive jal overwrites ra:

fact:
addi sp, sp, -16
sw ra, 12(sp)
sw a0, 8(sp)
li t0, 2
blt a0, t0, Base
addi a0, a0, -1
jal ra, fact
lw t1, 8(sp)
mul a0, t1, a0
j Done
Base:
li a0, 1
Done:
lw ra, 12(sp)
addi sp, sp, 16
ret

The M-extension mul multiplies the returned inner result by the original n. For fact(3), frames for 3, 2 and 1 coexist. The base call returns 1; the next returns 2; the outer call returns 6. With initial sp = 0x7FFFFF00, three frames lower it by 48 bytes to 0x7FFFFED0. Returns release them in reverse order.

The base test handles nonnegative 0 and 1. For this 32-bit result, factorial is exact through 12!: 479,001,600. The low product bits no longer represent the full result at 13!, which is 6,227,020,800.

Place the stack in program memory

A typical layout has code in text, globals in static data, dynamically allocated objects in the heap and call frames in the stack. The heap often grows upward and the stack downward. Actual placement belongs to the execution environment.

A pointer to a local stack object becomes invalid when that object's lifetime ends on return. Restoring sp does not erase the old bytes, but later calls can reuse them. Similarly, changing sp and continuing to use old save offsets can read the wrong frame's bytes.

A pointer is an address value. Assembly implements a dereference by using that address as a load or store base, and implements pointer arithmetic by adding a byte distance.

Follow the pointer, then access the value

With int *p in a0, lw t0, 0(a0) reads *p, while sw t0, 0(a0) writes it. The register holds the address; the memory at that address holds the integer. If a pointer variable itself is stored in memory, first load that pointer value, then use it as the base for a second load.

Taking the address of a local C object requires addressable storage, normally a stack slot. A hardware register has no memory address that can be passed as &x.

C pointer arithmetic scales automatically. For RV32 ILP32, incrementing int *p adds 4 bytes, while incrementing char *p adds 1. Assembly has no pointer type to provide the scale:

addi a0, a0, 4    # next int
addi a1, a1, 1    # next char

An array argument is its base address, not a copy of its elements. Pass the element count separately when a procedure needs it; the pointer alone does not encode the array length.

Structure fields have byte offsets

For struct item { int id; int score; };, id occupies bytes 0–3 and score bytes 4–7. With the object's address in a0, lw t0, 4(a0) reads the score. In general, field offsets follow the ABI's layout and padding rules. Do not infer every field offset just by counting source declarations.

For an array of these 8-byte structures, the next element starts 8 bytes later. Within each element the score remains 4 bytes from that element's beginning. Element stride and field offset are separate parts of the address calculation.

Copy a null-terminated string

A C byte string ends with a zero byte. To copy it, read and store one byte before deciding whether the copy is finished:

Loop:
lbu t0, 0(a1)
sb t0, 0(a0)
addi a0, a0, 1
addi a1, a1, 1
bnez t0, Loop
ret

Here a1 is the source and a0 the destination. The destination must have enough space. lbu reads an unsigned byte; sb stores only its low 8 bits. Both pointers advance by 1, including on the final iteration. The branch tests the copied byte, so the terminating zero is stored too.

Copying "RISC" takes five iterations for four letters and the zero byte. At five instructions per iteration plus ret, it executes 26 instructions. An empty string still needs one iteration to copy its terminator. A word load would read four bytes at once and would not implement this byte-at-a-time algorithm.

UTF-8 can encode one character in several bytes. This loop copies those bytes unchanged; it does not count displayed characters. Pointer-based array loops can similarly advance by the element stride without recomputing a scaled index each time. Optimizing compilers can make that transformation even when the C program uses ordinary array indexes.

A source file becomes executable instructions through several translation stages. Each stage has a different responsibility, and intermediate files retain information needed by later stages.

The compiler chooses instructions

For C, the usual path is source, assembly, object file, executable, then a running process. A compiler analyzes source code, optimizes it, allocates registers and selects instructions for a target ISA. A compiler driver can run several stages in one command.

gcc -S program.c stops after producing assembly. gcc -c program.c produces an object file without linking. The target compiler determines which ISA that assembly uses; a RISC-V program needs a RISC-V-targeting toolchain.

At -O0, values often pass through stack slots and the assembly closely follows individual source statements. At -O2, register allocation, eliminated work and restructured loops can obscure that correspondence. A C statement has no single fixed assembly translation.

The assembler encodes and records

The assembler turns mnemonics and register names into bits, expands pseudo-instructions and resolves labels it can locate. A forward branch refers to a label encountered later. An assembler can first collect positions and then encode references, or record places to fill in once the target is known.

Directives tell the assembler how to organize output; the processor does not execute them:

.data
.align 2
count:
.word 5
message:
.string "hi"
.text
.globl main
main:
# instructions follow

.word 5 emits a 4-byte data value. .string "hi" emits the character bytes and a terminating zero. On the GNU RISC-V assembler, .align 2 aligns the next item to a 4-byte boundary. .globl makes a symbol visible to other object files. Labels name positions; they do not reserve bytes by themselves.

What an object file keeps

A relocatable object typically contains a header, code in text sections, static data, a symbol table and relocation information. The symbol table distinguishes names defined here from references defined elsewhere. Optional debugging information connects instructions to source lines; -g requests it.

Common object formats include ELF, Mach-O and PE/COFF. The format organizes machine code and metadata; it is distinct from the ISA that defines each instruction's bits.

For call printf, the assembler can emit an auipc/jalr sequence without knowing the final function address. It records an undefined symbol and relocation entries so the linker can finish the reference. A local branch's distance can already be known when its target moves with the same section, though later layout changes such as relaxation can require adjustment.

Other execution paths

An interpreter performs operations through another running program. A just-in-time compiler generates machine code during execution, often after identifying frequently used code. Java commonly uses bytecode followed by interpretation and JIT compilation; Python commonly uses an interpreter. A JIT trades compilation work during execution for faster repeated execution.

An object file is therefore more than a raw instruction list, but it is not yet a complete running process. Unresolved symbols and final layout still need attention from the linker and loader.

A linker constructs an executable file from object modules and libraries. A loader uses that file to create a running process. Knowing which stage owns an address helps explain both relocation and startup errors.

Lay out modules and patch references

The linker places input sections in the executable's address space, resolves symbol definitions and uses relocation entries to patch references. A name that no linked module defines produces an "undefined reference" error.

Suppose text starts at 0x00010000 and data at 0x10000000. Object A contributes 0x100 text bytes and 0x20 data bytes; B follows immediately. B's text starts at 0x00010100 and its data at 0x10000020.

A jal in A at text offset 0x40 has address 0x00010040. If procB begins at B's text start, the call's offset is 0xC0, or 192 bytes, encoded with ra as 0x0C0000EF. A variable at offset 0x10 in B's data lands at 0x10000030. With gp = 0x10000800, its displacement is −2000, which fits a signed 12-bit load offset. These are separate text and data calculations.

Choose how library code is supplied

Static linking copies required library object code into the executable. The program carries that code, increasing file size; applying a library fix requires relinking it. Static libraries do not eliminate the program's dependency on its operating-system interface.

Dynamic linking keeps library code in shared files, such as .so, .dll or .dylib. Compatible library code pages can be shared by processes. A compatible updated library can serve programs without relinking each executable, but the required version must be available when it is needed.

With ELF lazy binding, the first call goes through a procedure linkage table (PLT) stub. The dynamic linker resolves the target and records it in the global offset table (GOT); later calls use that recorded address. Other configurations resolve symbols at load time.

Position-independent code reaches local targets using relative addressing, including auipc sequences, and uses indirection for external targets. A library's own relative distances remain valid when it moves as a unit. Binding external references may still require relocation work.

The loader creates the running state

The loader reads executable metadata, creates an address space, maps or copies code and data, sets up arguments and the initial stack, initializes required register state and transfers control to startup code. Startup code calls main; after it returns, runtime code requests process exit. Modern systems can map file pages and bring them into memory as needed.

ecall requests an environment service. On RISC-V Linux, a7 holds the system-call number and a0–a5 hold arguments. li a7, 93, li a0, 0, ecall requests exit with status 0; service 64 is write. Simulator service numbers come from the simulator's own interface.

A library missing during linking causes a link failure. A required shared library removed after linking can instead prevent loading or cause failure during runtime binding. The executable may have been built successfully even though it cannot now start.

RISC and CISC describe broad instruction-set design approaches. The useful comparison is how each represents work: operand locations, instruction length, address calculation and control flow.

Regular operations or richer instructions

RISC designs favor simple operations, many registers and load-store access. The approach developed through IBM's 801 work in the mid-1970s and Berkeley RISC and Stanford MIPS in the early 1980s. RISC-V, ARM AArch64, MIPS and Power follow this broad tradition.

CISC designs offer variable-length instructions, richer addressing and operations that can combine several steps. x86 grew from the 8086 introduced in 1978; earlier CISC families include VAX and Motorola 68000.

In Intel x86 syntax, add eax, [ebx+8] reads a 32-bit value from memory and adds it to eax. An equivalent RISC-V operation needs a load followed by arithmetic:

lw t0, 8(s1)
add a0, a0, t0

The x86 instruction combines a memory access with addition. RISC-V exposes them as separate instructions. x86 calls a 32-bit value a doubleword; its word is 16 bits. A word in the RV32 examples is 32 bits.

Encoding and addressing

An x86 instruction is 1 to 15 bytes long. Base RISC-V instructions occupy 4 bytes, with 2-byte compressed forms available through C. Regular field positions simplify decoding. Variable lengths can save space by using short encodings for common operations.

RISC-V uses register operands, immediates, base-plus-displacement addresses, and pc-relative addresses. jalr belongs to register-base addressing, while branches, jal and auipc use the pc.

x86 also combines a base, scaled index and displacement. mov eax, [ebx + esi*4 + 8] reads an indexed 4-byte element with an extra offset in one instruction. RISC-V forms the scaled index and effective address with separate instructions before loading. The work still has to occur internally in either processor.

Registers and comparisons

RISC-V has 32 integer registers, including its fixed zero register. Conventional x86-64 has 16 general-purpose registers; 32-bit x86 has 8. Many x86 arithmetic instructions use a destination that is also a source: add eax, ebx changes eax. RISC-V's three-operand add can keep both source values while writing a third register.

x86 arithmetic and cmp set flags; a later branch such as jl tests those flags. RISC-V uses blt to compare and branch directly. ARM AArch64 also uses flags, so the presence of flags alone cannot classify an ISA as CISC.

What reduced means

RISC does not mean a modern ISA must have a tiny total instruction count. RV32I has 40 base instructions, but optional extensions add many more. The central idea is regular, relatively simple operations and encodings. Compressed encodings also show that fixed instruction length is a design tendency, not a definition that every RISC instruction must satisfy.

An instruction set shapes the work a program expresses, but execution speed also depends on the processor that implements it. Compare measured or modeled program behavior, not the number of operations promised by one instruction.

Combine all three performance factors

CPU time equals instruction count times average cycles per instruction (CPI) times clock cycle time. Equivalently, divide instruction count times CPI by clock frequency. A lower instruction count can be outweighed by a higher CPI or a slower clock.

At 2 GHz, each cycle takes 0.5 ns. A version with 1.0 billion instructions and CPI 2.0 uses 2.0 billion cycles and takes 1.0 s. Another with 1.3 billion instructions and CPI 1.2 uses 1.56 billion cycles and takes 0.78 s. The second executes 30% more instructions but is about 1.28 times as fast. CPI is an average for that program on that implementation, not a universal property of an ISA.

Complex instructions still need internal work

Many modern x86 processors translate most instructions into simpler internal micro-operations. These can then use execution techniques similar to those in modern RISC cores. The external ISA still matters for encoding, decoding and compatibility even when internal operations look similar.

A complex instruction is not a promise of a fixed cycle count. A block-copy instruction and a simple copy loop can trade places in performance across processors and workloads. The processor version, data size and memory behavior matter; a one-instruction source listing cannot decide the result.

Code density is a separate measure

Shorter machine-code sequences can reduce storage and instruction-cache pressure. CISC variable lengths often help density. RISC-V's C extension provides 16-bit encodings for common operations alongside 32-bit instructions. The specification reports typical use for 50–60% of instructions, giving roughly 25–30% smaller code.

For 100 instructions with half compressed, 50 use 2 bytes and 50 use 4: 300 bytes instead of 400. The executed instruction count remains 100. A size reduction does not by itself specify a speedup, because runtime depends on more than bytes fetched.

Compatibility and tools shape the choice

Existing x86 binaries and libraries give compatibility considerable value. RISC-V freezes base sets and adds extensions. RV32I code can run on an implementation supporting RV32I when the ABI and operating environment match; using M or V adds those requirements. RV32E is a different reduced-register base and does not promise RV32I compatibility.

ARM is widely used in mobile devices as well as laptops and servers; x86 is widely used in PCs and servers; RISC-V serves embedded systems, accelerators, research and teaching. Software availability, licensing and the quality of specific chips all matter when choosing a platform.

Hand-written assembly can help a small critical routine or expose a special instruction, but it ties code to an ISA and increases maintenance work. Optimizing compilers handle register allocation and code restructuring well. Use measurement to justify replacing clear source code with assembly.