SASIMI 2019 Proceedings

R3-12

Binary Synthesis from RISC-V Executables
Shoki HAMANA

Nagisa ISHIURA

School of Science and Technology, Kwansei Gakuin University
2-1 Gakuen, Sanda, Hyogo, 669–1337, Japan

Abstract—This paper presents an implementation of a binary
synthesizer which converts a given executable binary code ofRISC-V into hardware functionally equivalent to a RISC-V coreexecuting the code. A CPU core and an instruction memory arereplaced by the synthesized hardware, which reduces execution
time and hardware size for small scale programs. A given binary
code is disassembled and parsed to build a control dataﬂow graph(CDFG), then traditional high-level synthesis techniques are applied to generate RT level Verilog HDL. For a small example program consisting of 34 through 160 instructions, synthesized hardware on Xilinx FPGA Artix-7 took about 74.5% less cycles thanon RISC-V Rocket core, with smaller number of LUTs.

I. Introduction
RISC-V [1] is an open-source instruction set architecture.
Publicly available RTL source codes and tool chains including compilers, simulators, debuggers, are making it easy to develop hardware and software for embedded systems.
Though the most popular usage of RISC-V cores may be
as host processors for high-performance custom hardware engines, they may also be used as main processors for low cost
IoT devices. Since RISC-V is originally not intended for highperformance processors, instruction extensions or hardware
support become options, when a RISC-V core needs more efﬁciency in computation speed or in power consumption. If thebottleneck is reduced to some core operations, customized instructions will be eﬀective. Otherwise, migration of the loads
from software to hardware should be considered.
High-level synthesis [2] or binary synthesis [3, 4, 5] is oneof the most prevailing techniques for this purpose, where a program code written in high-level languages or an executable binary code are automatically compiled into a register transfer
level hardware model.
Although the performance of the hardware generated by binary synthesis is generally lower than those by high-level synthesis, due to lack of high-level information in the input programs, binary synthesis can handle wider range of softwarecodes. The input programs may contain inline assembly or interrupt handlers in hand written assembly.
This paper presents binary synthesizer that translates aRISC-V binary code into logic synthesizable Verilog HDL description. A whole binary code is synthesized into a hardware
module functionally equivalent to the RISC-V core executing
the code. It aims at replacing the CPU core and the instruction
memory by the hardware and reducing the execution cycles
and hardware cost for small scale programs.
II. Binary Synthesis
Binary synthesis diﬀers from high-level synthesis in thefront-end part; a CDFG (control dataﬂow graph) is constructedfrom a binary code instead of a program written in a high-level

IMDMDMbinprog

RISC-VHWFig. 1. Binary synthesis of CPU compatible hardware.

language. Almost all of the back-end techniques are commonwith high-level synthesis.
The merit of binary synthesis is that it has less restrictions on
input behavior speciﬁcations. For example, C programs withpointers or complicated control structures can be synthesized
into hardware. Binary synthesis can handle programs in handwritten assembly programs or those containing inline assembly
codes intended to communicate with hardware. it can even deal
with programs containing interrupt handlers [6].
Mittal et al. [3] developed a binary synthesizer to translate
DSP binaries into FPGA hardware. It accepted programs in
C/C++, Matlab, and Simulink as well as hand-written assembly. The binary synthesizer developed by Stitt et al. [4] synthesized selected sections of binary codes of MIPS, ARM,and MicroBlaze into coprocessors, or hardware accelerators.
ACAP [5] converted MIPS binary codes into hardware. It allows either generation of coprocessors from code sections orcompilation of a whole binary code into a hardware modulethat replaces the CPU and the instruction memory.
However, to the best of our knowledge, there is no binary
synthesizer that takes RISC-V binaries.
III. Binary Synthesis from RISC-V Executables
The input to our binary synthesizer is a binary executablecode for RISC-V. As for the instruction set, we assume
RV32IM, base integer instruction set with standard extension
for integer multiplication and division. Then, as shown in Fig.
1, a hardware module which is compatible with the CPU executing the binary program is synthesized. The elimination of
the instruction memory might be useful in protecting the software from analysis.
Fig. 2 shows the ﬂow of synthesis in our method. Input programs may be written in C language or in assembly language.
Inline assembly is also allowed. They are compiled (by gcc) orassembled (by gas) and then linked to a executable binary code(by ld). The front-end of our binary synthesizer scans the disassembled code to generate a CDFG (control dataﬂow graph),
a popular data structure for high-level synthesis. The backend of the synthesizer takes the CDFG to perform a standard
sequence of high-level synthesis tasks to generate a hardware
model in Verilog HDL.
Fig. 3 (a) shows how DFG is generated from a RISC-V in-- 227 -

asm

Cgas

gcc

back-end

TABLE I
Experimental result

CDFG
library info-32756

ld

dataflow analysis+RISC-V binaryLfront-end

8<objdumpv3...
lw a1,-32756(gp)
add a0,a1,a0
sll a0,a0,0x2
sw a0,-32760(gp)bne a1,a2,0x8000...

simplification

program #insn

schedulingﬁbonacci 34
arith-test 70
FSM160bindingv3v3*

RTL IR+CDFG generator

Verilog
HDLindicates the instruction counts in the programs. “#cycle”,“#LUT”, “delay” show the execution cycle counts, the LUT
counts, and the critical path delays, respectively. The target
FPGA was Xilinx Artix-7 (XC7Z020-1CLG400I). “A,M” indicates the numbers of ALUs and multipliers allocated for synthesis. The RISC-V core used in the experiment is generated
by the Rocket Chip Generator1 with the DefaultRV32Conﬁgmode. The hardware generated by ACAP-R took 74.5% lesscycles on average. The LUT counts of the hardware are supposed to grow in proportional to the instruction counts, butwere smaller than the core when the programs were of lessthan 160 instructions.

Fig. 2. Flow of binary synthesis.
4

1: lw a3,4(a2)
2: lw a4,8(a2)
3: mul a4,a3,a4
4: addi a5,zero,115
5: mul a5,a3,a5
6: add a3,a4,a5+

LL*(a) DFG generation

8+5+

115

*5+...
80000034: addi a5,a0,580000038: addi a5,a5,58000003c: div a4,a4,a580000040: mul a3,a5,a2
80000044: blt a4,a3,0x80000038
80000048: addi a4,a4,1...

+/

*<cc

ACAP-R
A,M #cycle #LUT delay[ns]
3,0274 1,533 7.2
2,1273 2,665 11.6
2,2
164 2,362 13.3

Synthesizer: Xilinx Vivado (2017.4)
Target: Xilinx Artix-7 (XC7Z020-1CLG400I)

composer+RISC-V#cycle #LUT delay[ns]
1,483642 3,202 14.7
777

c1+(b) CDFG construction

Fig. 3. CDFG generation.

struction sequence. A load instruction (such as lw in line 1)
is converted into an add operation to calculate its eﬀective address and a load operation. An arithmetic instruction such as
mul (multiplication) in line 3 is translated into a corresponding
operation node. When the value in a register is updated, a newvalue node is generated. The value node is later assigned to a
hardware register in the binding phase. An operation to loada constant into a register (such as addi in line 4) reduced to a
constant value node.
Fig. 3 (b) illustrates how CDFG is constructed. An instruction sequence is dissected at branch instructions and branchtargets to yield a set of basic blocks. Since there is no delayedbranch in RISC-V, this dissection is straightforward. Each basic block becomes a DFG (dataﬂow graph). A conditional
branch instruction is translated into an operation to computethe branch condition and transition edges to the next DFGs.
One hard issue in binary synthesis is how to handle register jump instructions (such as jr) whose target addresses are
determined only at run time. We adopt the same strategy as
ACAP [5]. A module named “PC2state” is generated whichtranslates the instruction addresses to the corresponding state
encodings of the synthesized hardware. A register jump instruction, which writes its target address into PC (programcounter), is converted into an operation to update the state register by the output of the PC2state module. The PC2state module is generated by gathering the head states of all the DFGs.
IV. Preliminary Experiment
A binary synthesizer “ACAP-R” has been implemented
based on the method described in the previous section. The
front-end for RISC-V has been newly developed and the backend of ACAP is used as it is.
Table I summarizes the result of an experiment where small
C programs were synthesized targeting an FPGA. “#insn”

V. Conclusion
A binary synthesizer ACAP-R which generates hardware
from a RISC-V binary code has been presented.
The original version of ACAP has another synthesis modethat compiles speciﬁed code segments into coprocessors which
is tightly coupled with the CPU core. Our future work includes
extending ACAP-R to operate in this mode.
Acknowledgments—Authors would like to express their appreciation
to Dr. H. Kanbara (ASTEM/RI), Prof. H. Tomiyama (RitsumeikanUniv.), and Mr. T. Nakatani (formerly with Ritsumeikan Univ.) for
their valuable comments. We would also like to thank to the membersof Ishiura Lab. of Kwansei Gakuin Univ. for their cooperation.

References[1] D. Patterson and A. Waterman: The RISC-V Reader: An
Open Architecture Atlas, Strawberry Canyon (Nov. 2017).
[2] D. D. Gajski, N. D. Dutt, A. C-H Wu, and S. Y-L Lin:
High-Level Synthesis: Introduction to Chip and System
Design, Kluwer Academic Publishers (1992).
[3] G. Mittal, D. C. Zaretsky, X. Tang, and P. Banerjee: “Automatic translation of software binaries onto FPGAs,” inProc. DAC 2004, pp. 389–394 (June 2004).
[4] G. Stitt and F. Vahid: “Binary synthesis,” ACM TODAES,
vol. 12, no. 3, article 34 (Aug. 2007).
[5] N. Ishiura, H. Kanbara, and H. Tomiyama: “ACAP: Binarysynthesizer based on MIPS object codes,” in Proc. ITCCSCC 2014, pp. 725–728 (July 2014).
[6] N. Ito, Y. Oosako, N. Ishiura, H. Tomiyama, and H.
Kanbara: “Binary synthesis implementing external interrupt handler as independent module,” in Proc. RSP 2017,
pp. 92–98 (Oct. 2017).

1 https://github.com/freechipsproject/rocket-chip (accessed2019-06-10).

- 228 -