nervosnetwork / ckb-vm

CKB's vm, based on open source RISC-V ISA

Nervos CKB VM

---

About CKB VM

CKB VM is a pure software implementation of the RISC-V instruction set used as scripting VM in CKB. Right now it implements full IMCB instructions for both 32-bit and 64-bit register size support. In the future we might also implement V extensions to enable better crypto implementations.

License

Nervos CKB is released under the terms of the MIT license. See COPYING for more information or see https://opensource.org/licenses/MIT.

Development Process

This is now deployed and used in production CKB mainnet.

The develop branch is regularly built and tested, but is not guaranteed to be completely stable. CKB will use released versions of CKB VM which are tested and more stable.

The contribution workflow is described in CONTRIBUTING.md, and security policy is described in SECURITY.md. To propose new protocol or standard for Nervos, see Nervos RFC.

---

How to build

CKB VM is currently tested mainly with stable Rust version on 64-bit Linux, macOS, and Windows.

# download CKB VM
$ git clone https://github.com/nervosnetwork/ckb-vm
$ cd ckb-vm
$ cargo build

You can also run the tests:

make test

CKB VM has already included RISC-V binaries used in tests, so you don't need a RISC-V compiler to build binaries. However if you do want to play with your own binaries, a RISC-V compiler might be needed. riscv-tools can be a good starting point here, or if you are an expert on GNU toolchain, you might also compile upstream GCC from source with RISC-V support, here is an example. CKB VM is using standard RISC-V instructions and ELF binary format, so theoretically any RISC-V compatible compilers are able to produce contracts used in CKB VM(tho bug reports are very welcome if you find breakage).

Notes on Different Modes

Right now CKB VM has 2 different modes:

• Rust interpreter mode
• Assembly based interpreter mode(ASM mode)

For consistent behavior, you should only use ASM mode. The Rust mode is developed more to assist development, and never used in production by us. In case of bugs, there might be inconsistent behaviors between Rust mode and ASM mode.

ckb-vm's Issues

Rebuild test binarys by new gcc

The newly built gcc will bring some performance improvements

https://hub.docker.com/layers/nervos/ckb-riscv-gnu-toolchain/bionic-20210727/images/sha256-1e8835b34f7425599520e197b538bbeb262011c7c95be5f597255e0d1c309e3a?context=explore

At the same time we need the bench result of secp256k1.

Phase plan of the V instruction set

Phase plan of the V instruction set

The V instruction set has a large number of instructions, and it is difficult for us to complete these instructions at once, so these instructions are divided into 3 parts.

• The first part needs to be implemented first
• The second part depends on the situation
• And the third part is instructions that we don’t need in the short term ( Floating / atomic instructions).

Note:
The first column: implemented or not
The second column: tested or not

Part 1

[x] [ ] vsetivli     31=1 30=1 zimm10    zimm 14..12=0x7 rd 6..0=0x57
[x] [ ] vsetvli      31=0 zimm11          rs1 14..12=0x7 rd 6..0=0x57
[x] [ ] vsetvl       31=1 30..25=0x0 rs2  rs1 14..12=0x7 rd 6..0=0x57

[x] [ ] vlm.v          31..28=0 27..26=0 25=1 24..20=0xb rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vsm.v          31..28=0 27..26=0 25=1 24..20=0xb rs1 14..12=0x0 vs3 6..0=0x27

[x] [ ] vle8.v         nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vle16.v        nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vle32.v        nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vle64.v        nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x7  vd 6..0=0x07
[x] [ ] vle128.v       nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vle256.v       nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vle512.v       nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vle1024.v      nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x7  vd 6..0=0x07
[x] [ ] vse8.v         nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vse16.v        nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vse32.v        nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vse64.v        nf 28=0 27..26=0 vm 24..20=0 rs1 14..12=0x7 vs3 6..0=0x27
[x] [ ] vse128.v       nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vse256.v       nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vse512.v       nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vse1024.v      nf 28=1 27..26=0 vm 24..20=0 rs1 14..12=0x7 vs3 6..0=0x27

[x] [x] vadd.vv        31..26=0x00 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [x] vadd.vx        31..26=0x00 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [x] vadd.vi        31..26=0x00 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [x] vsub.vv         31..26=0x02 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsub.vx        31..26=0x02 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vrsub.vx       31..26=0x03 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vrsub.vi       31..26=0x03 vm vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [x] vwaddu.vv      31..26=0x30 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vwaddu.vx      31..26=0x30 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwsubu.vv      31..26=0x32 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwsubu.vx      31..26=0x32 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwadd.vv       31..26=0x31 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwadd.vx       31..26=0x31 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwsub.vv       31..26=0x33 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwsub.vx       31..26=0x33 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [x] vwaddu.wv      31..26=0x34 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vwaddu.wx      31..26=0x34 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwsubu.wv      31..26=0x36 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwsubu.wx      31..26=0x36 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwadd.wv       31..26=0x35 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwadd.wx       31..26=0x35 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwsub.wv       31..26=0x37 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwsub.wx       31..26=0x37 vm vs2 rs1 14..12=0x6 vd 6..0=0x57

[x] [ ] vzext.vf8      31..26=0x12 vm vs2 19..15=2 14..12=0x2 vd 6..0=0x57
[x] [ ] vsext.vf8      31..26=0x12 vm vs2 19..15=3 14..12=0x2 vd 6..0=0x57
[x] [ ] vzext.vf4      31..26=0x12 vm vs2 19..15=4 14..12=0x2 vd 6..0=0x57
[x] [ ] vsext.vf4      31..26=0x12 vm vs2 19..15=5 14..12=0x2 vd 6..0=0x57
[x] [x] vzext.vf2      31..26=0x12 vm vs2 19..15=6 14..12=0x2 vd 6..0=0x57
[x] [ ] vsext.vf2      31..26=0x12 vm vs2 19..15=7 14..12=0x2 vd 6..0=0x57

[x] [x] vadc.vvm       31..26=0x10 25=0 vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vadc.vxm       31..26=0x10 25=0 vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vadc.vim       31..26=0x10 25=0 vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vmadc.vvm      31..26=0x11 25=0 vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmadc.vxm      31..26=0x11 25=0 vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmadc.vim      31..26=0x11 25=0 vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vmadc.vv       31..26=0x11 25=1 vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmadc.vx       31..26=0x11 25=1 vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmadc.vi       31..26=0x11 25=1 vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [ ] vsbc.vvm       31..26=0x12 25=0 vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsbc.vxm       31..26=0x12 25=0 vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmsbc.vvm      31..26=0x13 25=0 vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmsbc.vxm      31..26=0x13 25=0 vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmsbc.vv       31..26=0x13 25=1 vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmsbc.vx       31..26=0x13 25=1 vs2 rs1 14..12=0x4 vd 6..0=0x57

[x] [ ] vand.vv         31..26=0x09 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vand.vi        31..26=0x09 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vand.vx        31..26=0x09 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vor.vv          31..26=0x0a vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vor.vx         31..26=0x0a vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vor.vi         31..26=0x0a vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vxor.vv         31..26=0x0b vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vxor.vx        31..26=0x0b vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vxor.vi        31..26=0x0b vm vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [ ] vsll.vv        31..26=0x25 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsll.vx        31..26=0x25 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [x] vsll.vi        31..26=0x25 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vsrl.vv        31..26=0x28 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsrl.vx        31..26=0x28 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vsrl.vi        31..26=0x28 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vsra.vv        31..26=0x29 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsra.vx        31..26=0x29 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vsra.vi        31..26=0x29 vm vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [x] vnsrl.wv       31..26=0x2c vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [x] vnsrl.wx       31..26=0x2c vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vnsrl.wi       31..26=0x2c vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [x] vnsra.wv       31..26=0x2d vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [x] vnsra.wx       31..26=0x2d vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vnsra.wi       31..26=0x2d vm vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [x] vmseq.vv       31..26=0x18 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [x] vmseq.vx       31..26=0x18 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [x] vmseq.vi       31..26=0x18 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vmsne.vv       31..26=0x19 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmsne.vx       31..26=0x19 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmsne.vi       31..26=0x19 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vmsltu.vv      31..26=0x1a vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmsltu.vx      31..26=0x1a vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmslt.vv       31..26=0x1b vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmslt.vx       31..26=0x1b vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [x] vmsleu.vv      31..26=0x1c vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmsleu.vx      31..26=0x1c vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmsleu.vi      31..26=0x1c vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vmsle.vv       31..26=0x1d vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmsle.vx       31..26=0x1d vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmsle.vi       31..26=0x1d vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vmsgtu.vx      31..26=0x1e vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmsgtu.vi      31..26=0x1e vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vmsgt.vx       31..26=0x1f vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmsgt.vi       31..26=0x1f vm vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [ ] vminu.vv       31..26=0x04 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vminu.vx       31..26=0x04 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmin.vv        31..26=0x05 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmin.vx        31..26=0x05 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmaxu.vv       31..26=0x06 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmaxu.vx       31..26=0x06 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmax.vv        31..26=0x07 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmax.vx        31..26=0x07 vm vs2 rs1 14..12=0x4 vd 6..0=0x57

[x] [x] vmul.vv        31..26=0x25 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vmul.vx        31..26=0x25 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vmulh.vv       31..26=0x27 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vmulh.vx       31..26=0x27 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vmulhu.vv      31..26=0x24 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vmulhu.vx      31..26=0x24 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vmulhsu.vv     31..26=0x26 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vmulhsu.vx     31..26=0x26 vm vs2 rs1 14..12=0x6 vd 6..0=0x57

[x] [ ] vdivu.vv       31..26=0x20 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vdivu.vx       31..26=0x20 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vdiv.vv        31..26=0x21 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vdiv.vx        31..26=0x21 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vremu.vv       31..26=0x22 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vremu.vx       31..26=0x22 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vrem.vv        31..26=0x23 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vrem.vx        31..26=0x23 vm vs2 rs1 14..12=0x6 vd 6..0=0x57

[x] [x] vwmulu.vv      31..26=0x38 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwmulu.vx      31..26=0x38 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwmulsu.vv     31..26=0x3a vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwmulsu.vx     31..26=0x3a vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwmul.vv       31..26=0x3b vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwmul.vx       31..26=0x3b vm vs2 rs1 14..12=0x6 vd 6..0=0x57

[x] [x] vmv.v.v        31..26=0x17 25=1 24..20=0 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmv.v.x        31..26=0x17 25=1 24..20=0 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmv.v.i        31..26=0x17 25=1 24..20=0 simm5 14..12=0x3 vd 6..0=0x57

[x] [ ] vsaddu.vv      31..26=0x20 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsaddu.vx      31..26=0x20 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vsaddu.vi      31..26=0x20 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vsadd.vv       31..26=0x21 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsadd.vx       31..26=0x21 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vsadd.vi       31..26=0x21 vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vssubu.vv      31..26=0x22 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vssubu.vx      31..26=0x22 vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vssub.vv       31..26=0x23 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vssub.vx       31..26=0x23 vm vs2 rs1 14..12=0x4 vd 6..0=0x57

[x] [x] vaaddu.vv      31..26=0x08 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vaaddu.vx      31..26=0x08 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [x] vaadd.vv       31..26=0x09 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vaadd.vx       31..26=0x09 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [x] vasubu.vv      31..26=0x0a vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vasubu.vx      31..26=0x0a vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [x] vasub.vv       31..26=0x0b vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vasub.vx       31..26=0x0b vm vs2 rs1 14..12=0x6 vd 6..0=0x57

[x] [x] vfirst.m       31..26=0x10 vm vs2 19..15=0x11 14..12=0x2 rd 6..0=0x57

[x] [ ] vmv1r.v        31..26=0x27 25=1 vs2 19..15=0 14..12=0x3 vd 6..0=0x57
[x] [ ] vmv2r.v        31..26=0x27 25=1 vs2 19..15=1 14..12=0x3 vd 6..0=0x57
[x] [ ] vmv4r.v        31..26=0x27 25=1 vs2 19..15=3 14..12=0x3 vd 6..0=0x57
[x] [ ] vmv8r.v        31..26=0x27 25=1 vs2 19..15=7 14..12=0x3 vd 6..0=0x57

Part 2

[x] [ ] vlse8.v         nf 28=0 27..26=2 vm rs2 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vlse16.v        nf 28=0 27..26=2 vm rs2 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vlse32.v        nf 28=0 27..26=2 vm rs2 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vlse64.v        nf 28=0 27..26=2 vm rs2 rs1 14..12=0x7  vd 6..0=0x07
[x] [ ] vlse128.v       nf 28=1 27..26=2 vm rs2 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vlse256.v       nf 28=1 27..26=2 vm rs2 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vlse512.v       nf 28=1 27..26=2 vm rs2 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vlse1024.v      nf 28=1 27..26=2 vm rs2 rs1 14..12=0x7  vd 6..0=0x07

[x] [ ] vsse8.v         nf 28=0 27..26=2 vm rs2 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vsse16.v        nf 28=0 27..26=2 vm rs2 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vsse32.v        nf 28=0 27..26=2 vm rs2 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vsse64.v        nf 28=0 27..26=2 vm rs2 rs1 14..12=0x7 vs3 6..0=0x27
[x] [ ] vsse128.v       nf 28=1 27..26=2 vm rs2 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vsse256.v       nf 28=1 27..26=2 vm rs2 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vsse512.v       nf 28=1 27..26=2 vm rs2 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vsse1024.v      nf 28=1 27..26=2 vm rs2 rs1 14..12=0x7 vs3 6..0=0x27

[x] [ ] vluxei8.v      nf 28=0 27..26=1 vm vs2 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vluxei16.v     nf 28=0 27..26=1 vm vs2 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vluxei32.v     nf 28=0 27..26=1 vm vs2 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vluxei64.v     nf 28=0 27..26=1 vm vs2 rs1 14..12=0x7  vd 6..0=0x07
[x] [ ] vluxei128.v    nf 28=1 27..26=1 vm vs2 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vluxei256.v    nf 28=1 27..26=1 vm vs2 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vluxei512.v    nf 28=1 27..26=1 vm vs2 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vluxei1024.v   nf 28=1 27..26=1 vm vs2 rs1 14..12=0x7  vd 6..0=0x07

[x] [ ] vsuxei8.v      nf 28=0 27..26=1 vm vs2 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vsuxei16.v     nf 28=0 27..26=1 vm vs2 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vsuxei32.v     nf 28=0 27..26=1 vm vs2 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vsuxei64.v     nf 28=0 27..26=1 vm vs2 rs1 14..12=0x7 vs3 6..0=0x27
[x] [ ] vsuxei128.v    nf 28=1 27..26=1 vm vs2 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vsuxei256.v    nf 28=1 27..26=1 vm vs2 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vsuxei512.v    nf 28=1 27..26=1 vm vs2 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vsuxei1024.v   nf 28=1 27..26=1 vm vs2 rs1 14..12=0x7 vs3 6..0=0x27

[x] [ ] vloxei8.v        nf 28=0 27..26=3 vm vs2 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vloxei16.v       nf 28=0 27..26=3 vm vs2 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vloxei32.v       nf 28=0 27..26=3 vm vs2 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vloxei64.v       nf 28=0 27..26=3 vm vs2 rs1 14..12=0x7  vd 6..0=0x07
[x] [ ] vloxei128.v      nf 28=1 27..26=3 vm vs2 rs1 14..12=0x0  vd 6..0=0x07
[x] [ ] vloxei256.v      nf 28=1 27..26=3 vm vs2 rs1 14..12=0x5  vd 6..0=0x07
[x] [ ] vloxei512.v      nf 28=1 27..26=3 vm vs2 rs1 14..12=0x6  vd 6..0=0x07
[x] [ ] vloxei1024.v     nf 28=1 27..26=3 vm vs2 rs1 14..12=0x7  vd 6..0=0x07

[x] [ ] vsoxei8.v        nf 28=0 27..26=3 vm vs2 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vsoxei16.v       nf 28=0 27..26=3 vm vs2 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vsoxei32.v       nf 28=0 27..26=3 vm vs2 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vsoxei64.v       nf 28=0 27..26=3 vm vs2 rs1 14..12=0x7 vs3 6..0=0x27
[x] [ ] vsoxei128.v      nf 28=1 27..26=3 vm vs2 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vsoxei256.v      nf 28=1 27..26=3 vm vs2 rs1 14..12=0x5 vs3 6..0=0x27
[x] [ ] vsoxei512.v      nf 28=1 27..26=3 vm vs2 rs1 14..12=0x6 vs3 6..0=0x27
[x] [ ] vsoxei1024.v     nf 28=1 27..26=3 vm vs2 rs1 14..12=0x7 vs3 6..0=0x27

[x] [ ] vl1re8.v       31..29=0 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vd  6..0=0x07
[x] [ ] vl1re16.v      31..29=0 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x5 vd  6..0=0x07
[x] [ ] vl1re32.v      31..29=0 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x6 vd  6..0=0x07
[x] [ ] vl1re64.v      31..29=0 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x7 vd  6..0=0x07
[x] [ ] vl2re8.v       31..29=1 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vd  6..0=0x07
[x] [ ] vl2re16.v      31..29=1 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x5 vd  6..0=0x07
[x] [ ] vl2re32.v      31..29=1 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x6 vd  6..0=0x07
[x] [ ] vl2re64.v      31..29=1 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x7 vd  6..0=0x07
[x] [ ] vl4re8.v       31..29=3 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vd  6..0=0x07
[x] [ ] vl4re16.v      31..29=3 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x5 vd  6..0=0x07
[x] [ ] vl4re32.v      31..29=3 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x6 vd  6..0=0x07
[x] [ ] vl4re64.v      31..29=3 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x7 vd  6..0=0x07
[x] [ ] vl8re8.v       31..29=7 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vd  6..0=0x07
[x] [ ] vl8re16.v      31..29=7 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x5 vd  6..0=0x07
[x] [ ] vl8re32.v      31..29=7 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x6 vd  6..0=0x07
[x] [ ] vl8re64.v      31..29=7 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x7 vd  6..0=0x07

[x] [ ] vs1r.v         31..29=0 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vs2r.v         31..29=1 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vs4r.v         31..29=3 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vs3 6..0=0x27
[x] [ ] vs8r.v         31..29=7 28=0 27..26=0 25=1 24..20=0x08 rs1 14..12=0x0 vs3 6..0=0x27

[x] [x] vmacc.vv       31..26=0x2d vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vmacc.vx       31..26=0x2d vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vnmsac.vv      31..26=0x2f vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vnmsac.vx      31..26=0x2f vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vmadd.vv       31..26=0x29 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vmadd.vx       31..26=0x29 vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vnmsub.vv      31..26=0x2b vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vnmsub.vx      31..26=0x2b vm vs2 rs1 14..12=0x6 vd 6..0=0x57

[x] [x] vwmaccu.vv     31..26=0x3c vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwmaccu.vx     31..26=0x3c vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwmacc.vv      31..26=0x3d vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwmacc.vx      31..26=0x3d vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwmaccsu.vv    31..26=0x3f vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [ ] vwmaccsu.vx    31..26=0x3f vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [ ] vwmaccus.vx    31..26=0x3e vm vs2 rs1 14..12=0x6 vd 6..0=0x57

[x] [x] vmerge.vvm     31..26=0x17 25=0 vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vmerge.vxm     31..26=0x17 25=0 vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vmerge.vim     31..26=0x17 25=0 vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [ ] vsmul.vv       31..26=0x27 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vsmul.vx       31..26=0x27 vm vs2 rs1 14..12=0x4 vd 6..0=0x57

[x] [ ] vssrl.vx       31..26=0x2a vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vssrl.vv       31..26=0x2a vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vssrl.vi       31..26=0x2a vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vssra.vv       31..26=0x2b vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vssra.vx       31..26=0x2b vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vssra.vi       31..26=0x2b vm vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [ ] vnclipu.wv     31..26=0x2e vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vnclipu.wx     31..26=0x2e vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vnclipu.wi     31..26=0x2e vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [ ] vnclip.wv      31..26=0x2f vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vnclip.wx      31..26=0x2f vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [ ] vnclip.wi      31..26=0x2f vm vs2 simm5 14..12=0x3 vd 6..0=0x57

[x] [x] vredsum.vs     31..26=0x00 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vredand.vs     31..26=0x01 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vredor.vs      31..26=0x02 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vredxor.vs     31..26=0x03 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vredminu.vs    31..26=0x04 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vredmin.vs     31..26=0x05 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vredmaxu.vs    31..26=0x06 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vredmax.vs     31..26=0x07 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vwredsumu.vs   31..26=0x30 vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [x] vwredsum.vs    31..26=0x31 vm vs2 vs1 14..12=0x0 vd 6..0=0x57

[x] [x] vmand.mm       31..26=0x19 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vmnand.mm      31..26=0x1d vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vmandnot.mm    31..26=0x18 vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vmxor.mm       31..26=0x1b vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vmor.mm        31..26=0x1a vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vmnor.mm       31..26=0x1e vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vmornot.mm     31..26=0x1c vm vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vmxnor.mm      31..26=0x1f vm vs2 vs1 14..12=0x2 vd 6..0=0x57

[x] [x] vcpop.m        31..26=0x10 vm vs2 19..15=0x10 14..12=0x2 rd 6..0=0x57
[x] [x] vmsbf.m        31..26=0x14 vm vs2 19..15=0x01 14..12=0x2 vd 6..0=0x57
[x] [x] vmsof.m        31..26=0x14 vm vs2 19..15=0x02 14..12=0x2 vd 6..0=0x57
[x] [x] vmsif.m        31..26=0x14 vm vs2 19..15=0x03 14..12=0x2 vd 6..0=0x57
[x] [x] viota.m        31..26=0x14 vm vs2 19..15=0x10 14..12=0x2 vd 6..0=0x57
[x] [x] vid.v          31..26=0x14 vm 24..20=0 19..15=0x11 14..12=0x2 vd 6..0=0x57
[x] [x] vmv.x.s        31..26=0x10 25=1 vs2 19..15=0 14..12=0x2 rd 6..0=0x57
[x] [x] vmv.s.x        31..26=0x10 25=1 24..20=0 rs1 14..12=0x6 vd 6..0=0x57
[x] [x] vcompress.vm   31..26=0x17 25=1 vs2 vs1 14..12=0x2 vd 6..0=0x57
[x] [x] vslide1up.vx   31..26=0x0e vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [x] vslideup.vx    31..26=0x0e vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [x] vslideup.vi    31..26=0x0e vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [x] vslide1down.vx 31..26=0x0f vm vs2 rs1 14..12=0x6 vd 6..0=0x57
[x] [x] vslidedown.vx  31..26=0x0f vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [x] vslidedown.vi  31..26=0x0f vm vs2 simm5 14..12=0x3 vd 6..0=0x57
[x] [x] vrgather.vx    31..26=0x0c vm vs2 rs1 14..12=0x4 vd 6..0=0x57
[x] [x] vrgather.vv     31..26=0x0c vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [x] vrgatherei16.vv 31..26=0x0e vm vs2 vs1 14..12=0x0 vd 6..0=0x57
[x] [ ] vrgather.vi    31..26=0x0c vm vs2 simm5 14..12=0x3 vd 6..0=0x57

Part 3

[ ] [ ] vle8ff.v         nf 28=0 27..26=0 vm 24..20=0x10 rs1 14..12=0x0  vd 6..0=0x07
[ ] [ ] vle16ff.v        nf 28=0 27..26=0 vm 24..20=0x10 rs1 14..12=0x5  vd 6..0=0x07
[ ] [ ] vle32ff.v        nf 28=0 27..26=0 vm 24..20=0x10 rs1 14..12=0x6  vd 6..0=0x07
[ ] [ ] vle64ff.v        nf 28=0 27..26=0 vm 24..20=0x10 rs1 14..12=0x7  vd 6..0=0x07
[ ] [ ] vle128ff.v       nf 28=1 27..26=0 vm 24..20=0x10 rs1 14..12=0x0  vd 6..0=0x07
[ ] [ ] vle256ff.v       nf 28=1 27..26=0 vm 24..20=0x10 rs1 14..12=0x5  vd 6..0=0x07
[ ] [ ] vle512ff.v       nf 28=1 27..26=0 vm 24..20=0x10 rs1 14..12=0x6  vd 6..0=0x07
[ ] [ ] vle1024ff.v      nf 28=1 27..26=0 vm 24..20=0x10 rs1 14..12=0x7  vd 6..0=0x07

[ ] [ ] vfadd.vf        31..26=0x00 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfsub.vf        31..26=0x02 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmin.vf        31..26=0x04 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmax.vf        31..26=0x06 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfsgnj.vf       31..26=0x08 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfsgnjn.vf      31..26=0x09 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfsgnjx.vf      31..26=0x0a vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfslide1up.vf   31..26=0x0e vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfslide1down.vf 31..26=0x0f vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmv.s.f        31..26=0x10 25=1 24..20=0 rs1      14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmerge.vfm    31..26=0x17 25=0 vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmv.v.f       31..26=0x17 25=1 24..20=0 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vmfeq.vf       31..26=0x18 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vmfle.vf       31..26=0x19 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vmflt.vf       31..26=0x1b vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vmfne.vf       31..26=0x1c vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vmfgt.vf       31..26=0x1d vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vmfge.vf       31..26=0x1f vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfdiv.vf       31..26=0x20 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfrdiv.vf      31..26=0x21 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmul.vf       31..26=0x24 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfrsub.vf      31..26=0x27 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmadd.vf      31..26=0x28 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfnmadd.vf     31..26=0x29 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmsub.vf      31..26=0x2a vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfnmsub.vf     31..26=0x2b vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmacc.vf      31..26=0x2c vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfnmacc.vf     31..26=0x2d vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfmsac.vf      31..26=0x2e vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfnmsac.vf     31..26=0x2f vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwadd.vf      31..26=0x30 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwsub.vf      31..26=0x32 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwadd.wf      31..26=0x34 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwsub.wf      31..26=0x36 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwmul.vf      31..26=0x38 vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwmacc.vf     31..26=0x3c vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwnmacc.vf    31..26=0x3d vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwmsac.vf     31..26=0x3e vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfwnmsac.vf    31..26=0x3f vm vs2 rs1 14..12=0x5 vd 6..0=0x57
[ ] [ ] vfadd.vv       31..26=0x00 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfredusum.vs   31..26=0x01 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfsub.vv       31..26=0x02 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfredosum.vs   31..26=0x03 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmin.vv       31..26=0x04 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfredmin.vs    31..26=0x05 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmax.vv       31..26=0x06 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfredmax.vs    31..26=0x07 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfsgnj.vv      31..26=0x08 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfsgnjn.vv     31..26=0x09 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfsgnjx.vv     31..26=0x0a vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmv.f.s       31..26=0x10 25=1 vs2      19..15=0 14..12=0x1 rd 6..0=0x57
[ ] [ ] vmfeq.vv       31..26=0x18 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vmfle.vv       31..26=0x19 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vmflt.vv       31..26=0x1b vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vmfne.vv       31..26=0x1c vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfdiv.vv       31..26=0x20 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmul.vv       31..26=0x24 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmadd.vv      31..26=0x28 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfnmadd.vv     31..26=0x29 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmsub.vv      31..26=0x2a vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfnmsub.vv     31..26=0x2b vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmacc.vv      31..26=0x2c vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfnmacc.vv     31..26=0x2d vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfmsac.vv      31..26=0x2e vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfnmsac.vv     31..26=0x2f vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfcvt.xu.f.v     31..26=0x12 vm vs2 19..15=0x00 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfcvt.x.f.v      31..26=0x12 vm vs2 19..15=0x01 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfcvt.f.xu.v     31..26=0x12 vm vs2 19..15=0x02 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfcvt.f.x.v      31..26=0x12 vm vs2 19..15=0x03 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfcvt.rtz.xu.f.v 31..26=0x12 vm vs2 19..15=0x06 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfcvt.rtz.x.f.v  31..26=0x12 vm vs2 19..15=0x07 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwcvt.xu.f.v     31..26=0x12 vm vs2 19..15=0x08 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwcvt.x.f.v      31..26=0x12 vm vs2 19..15=0x09 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwcvt.f.xu.v     31..26=0x12 vm vs2 19..15=0x0A 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwcvt.f.x.v      31..26=0x12 vm vs2 19..15=0x0B 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwcvt.f.f.v      31..26=0x12 vm vs2 19..15=0x0C 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwcvt.rtz.xu.f.v 31..26=0x12 vm vs2 19..15=0x0E 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwcvt.rtz.x.f.v  31..26=0x12 vm vs2 19..15=0x0F 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.xu.f.w     31..26=0x12 vm vs2 19..15=0x10 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.x.f.w      31..26=0x12 vm vs2 19..15=0x11 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.f.xu.w     31..26=0x12 vm vs2 19..15=0x12 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.f.x.w      31..26=0x12 vm vs2 19..15=0x13 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.f.f.w      31..26=0x12 vm vs2 19..15=0x14 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.rod.f.f.w  31..26=0x12 vm vs2 19..15=0x15 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.rtz.xu.f.w 31..26=0x12 vm vs2 19..15=0x16 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfncvt.rtz.x.f.w  31..26=0x12 vm vs2 19..15=0x17 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfsqrt.v       31..26=0x13 vm vs2 19..15=0x00 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfrsqrt7.v     31..26=0x13 vm vs2 19..15=0x04 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfrec7.v       31..26=0x13 vm vs2 19..15=0x05 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfclass.v      31..26=0x13 vm vs2 19..15=0x10 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwadd.vv      31..26=0x30 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwredusum.vs  31..26=0x31 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwsub.vv      31..26=0x32 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwredosum.vs  31..26=0x33 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwadd.wv      31..26=0x34 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwsub.wv      31..26=0x36 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwmul.vv      31..26=0x38 vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwmacc.vv     31..26=0x3c vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwnmacc.vv    31..26=0x3d vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwmsac.vv     31..26=0x3e vm vs2 vs1 14..12=0x1 vd 6..0=0x57
[ ] [ ] vfwnmsac.vv    31..26=0x3f vm vs2 vs1 14..12=0x1 vd 6..0=0x57

[ ] [ ] vamoswapei8.v  31..27=0x01 wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamoaddei8.v   31..27=0x00 wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamoxorei8.v   31..27=0x04 wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamoandei8.v   31..27=0x0c wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamoorei8.v    31..27=0x08 wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamominei8.v   31..27=0x10 wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamomaxei8.v   31..27=0x14 wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamominuei8.v  31..27=0x18 wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamomaxuei8.v  31..27=0x1c wd vm vs2 rs1 14..12=0x0 vd 6..0=0x2f
[ ] [ ] vamoswapei16.v 31..27=0x01 wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamoaddei16.v  31..27=0x00 wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamoxorei16.v  31..27=0x04 wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamoandei16.v  31..27=0x0c wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamoorei16.v   31..27=0x08 wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamominei16.v  31..27=0x10 wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamomaxei16.v  31..27=0x14 wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamominuei16.v 31..27=0x18 wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamomaxuei16.v 31..27=0x1c wd vm vs2 rs1 14..12=0x5 vd 6..0=0x2f
[ ] [ ] vamoswapei32.v 31..27=0x01 wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamoaddei32.v  31..27=0x00 wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamoxorei32.v  31..27=0x04 wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamoandei32.v  31..27=0x0c wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamoorei32.v   31..27=0x08 wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamominei32.v  31..27=0x10 wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamomaxei32.v  31..27=0x14 wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamominuei32.v 31..27=0x18 wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamomaxuei32.v 31..27=0x1c wd vm vs2 rs1 14..12=0x6 vd 6..0=0x2f
[ ] [ ] vamoswapei64.v 31..27=0x01 wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamoaddei64.v  31..27=0x00 wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamoxorei64.v  31..27=0x04 wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamoandei64.v  31..27=0x0c wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamoorei64.v   31..27=0x08 wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamominei64.v  31..27=0x10 wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamomaxei64.v  31..27=0x14 wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamominuei64.v 31..27=0x18 wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f
[ ] [ ] vamomaxuei64.v 31..27=0x1c wd vm vs2 rs1 14..12=0x7 vd 6..0=0x2f

Get wrong exit code when exit code >= 128.

Describe the bug

$ cat main.c

int main() {
  return 128;
}

Run it by ckb-vm:

$  /usr/local/riscv/bin/riscv64-unknown-elf-gcc main.c -o main.riscv

use bytes::Bytes;
use std::io::Read;

fn main() {
    let args: Vec<Bytes> = std::env::args().map(|a| a.into()).collect();

    let mut file = std::fs::File::open("/tmp/main.riscv").unwrap();
    let mut buffer = Vec::new();
    file.read_to_end(&mut buffer).unwrap();
    let buffer = Bytes::from(buffer);

    let r = ckb_vm::run::<u64, ckb_vm::SparseMemory<u64>>(&buffer, &args[..]).unwrap();
    println!("{:?}", r);
}

output:

-128

Argv list not endswith NULL in stack initialization

I found that ckb-vm's argv has not endswith null, and then I did a simple test.

The C Standard 5.1.2.2.1/2 says:

argv[argc] shall be a null pointer.

so create a c program:

#include <stddef.h>

int main(int argc,  char *argv[]) {
	if (argv[argc] == NULL) {
		return 0;
	}
	return 1;
}

When built by gcc, and run on Linux, it returns "0".

When built by riscv-unknown-elf-gcc, run on ckb-vm, it returns "1".

You might add a NULL here: https://github.com/nervosnetwork/ckb-vm/blob/develop/src/machine/mod.rs#L160

Enhance performance by changing trace cache strategy

In ckb-vm, the algorithm in trace cache is like this:

pub fn calculate_slot(addr: u64) -> usize {
    (addr as usize >> 5) & (8196-1)
}

We call 5 as shift amount below.

The cache missing is very high for computation heavy code. Here is the statistics for bn128-example:
https://github.com/cryptape/rvv-prototype/tree/ae405442b477a972e022016c2d791733c788cca7

cd bn128-example
make bench

For different shift amount, we got the following data:

when shift amount is 2:
Use RVV:    0m3.444s
Use IMC:    0m5.172s

when shift amount is 3:
Use RVV:    0m4.095s
Use IMC:   0m5.081s

when shift amount is 4:
Use RVV:    0m4.958s
Use IMC   0m5.798s

when shift amount is 5:
Use RVV:    0m6.084s
Use IMC:    0m7.195s

There are too many small trace fragments (< 8 instructions) in both RVV and IMC cases. It make cache missing very high.
When shift amount is reduced to 2, every single instruction own one slot and the cache missing is dramatically reduced.

Failed to build on Windows in GitHub Actions.

Describe the bug

Failed to build on Windows in GitHub Actions.

Error messages:

  --- stderr
  thread 'main' panicked at C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\ckb-vm-0.24.6\build.rs:51:17:
  Command["yasm" "-p" "gas" "-f" "x64" "-m" "amd64" "REPO_PATH\\target\\debug\\build\\ckb-vm-e4c77d8be0c21cb5\\out\\execute_x64-expanded.S" "-o" "REPO_PATH\\target\\debug\\build\\ckb-vm-e4c77d8be0c21cb5\\out\\execute_x64.o"] exits with non-success status: ExitStatus(ExitStatus(3221225781))

I know there is a new release (0.24.9), but:

• I didn't find a fix for this issue in the change log.
• I couldn't set the version, because it was introduced through dependencies (ckb-testtool).

p.s. I tried 3 times to make sure it's a deterministic failure.

Environment

• OS: windows-latest in GitHub Actions
• Version: ckb-vm v0.24.6
• Rust Toolchain: 1.76.0
• LLVM installation commands:

     - name: Install LLVM on Windows                                                                                    
       if: matrix.os == 'windows-latest'                                                                                
       shell: pwsh                                                                                                      
       run: |                                                                                                           
         iex "& {$(irm get.scoop.sh)} -RunAsAdmin"                                                                      
         scoop install llvm yasm                                                                                        
         echo "$env:USERPROFILE\scoop\shims" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append  

rdtsc function support

Is ckb-vm support rdtsc() function ? Or is there anyway to get computational cycles in ckb script ?

Replace `memmap` crate since it is unmaintained

ckb-vm/Cargo.toml

Line 28 in 99276b2

memmap = "0.7.0"

The crates mapr or memmap2 may be reasonable alternatives.

References

• Is this crate still maintained?
• memmap looks abandonned
• RUSTSEC-2020-0077: memmap: memmap is unmaintained

AOT mode should be able to share memory bound checking code

Right now we are duplicating all the bound checking code in memory reads/writes in AOT mode, resulting a very large generated binary. However, since AOT works differently from the ASM interpreter, this doesn't have to be the case: ASM interpreter only has limited places where memory checking is needed(bounded by the number of actual instruction types), so duplicating them helps with caches. AOT mode, on the other hands, generates a new series of bound checking logic for every load/store operations, given a non-trivial app, this could result in a very bloated binary.

We could generate a common memory bound checking code, and reuse that in AOT mode, this way we can have a much smaller AOT binary. Since AOT mode just flattens all the original code, CPU branch predictor should have no problems figuring out the right path to jump to.

Missing syscalls required for dynamic allocation

Syscalls for malloc() and free() are missing (e.g. 214 brk()). I've considered starting to implement them, but don't know how much is due to change in the near future.

Very cool project!

(还有我会说一点儿普通话可是我说的不好，我不知道这里有没有会说中文的人）

Formally Verify CKB-VM via Sail

Sail is a language for describing the instruction-set architecture (ISA) semantics of processors. The formal specification of RISC-V ISA is defined exactly in sail.

We could leverage sail to compile x86 and RISC-V models both down to Coq definitions. From there we can formally prove that our x86 assembly implementation of each RISC-V instruction, fully confronts to the RISC-V official specification.

Later when an aarch64 implementation is introduced, we could leverage the same proving techniques here.

This solution has the issue that Rust based interpreter cannot be proved. But once we have a formally proved assembly based fast implementation, not so many will care about Rust based interpreter :P

Performance tuning via rewriting hotspots with ASM

Redefining slow path instruction at 0x00 to 0x0f

Currently, the slowpath instruction is defined at 0xf0 - 0xff, redefining it at 0x00 to 0x0f to reduce the table size.

ckb-vm/src/machine/asm/cdefinitions_generated.h

Lines 311 to 428 in 73e3022

	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE
	.long .CKB_VM_ASM_LABEL_OP_UNLOADED - .CKB_VM_ASM_LABEL_TABLE

Remove RS3 macro from ASM code

The B extension 1.0.0 no longer contains ternary expressions, but RS3 is still defined in the ASM code and used as a temporary register.

It should be removed for readability.

Cycle profile support

When deal with high cycle cost contract, if we send such a transaction may been rejected due to the vm cycle limit (which is max_block_cycles).

A cycle profile tool would be helpful to optimize the contract code.

Expand the memory to 8 or 16 M (experimental)

Discussion: Remove duplicate out of bounds checks

In the current assembly code, every Load instruction needs to go through 3(or 4) out_of_bound checks:

#define CHECK_READ_BOUND_VERSION1(length) \
  movq REGISTER_ADDRESS(RS1), RS1; \
  addq IMMEDIATE, RS1; \
  movq RS1, TEMP1; \
  cmp $CKB_VM_ASM_RISCV_MAX_MEMORY, TEMP1; \                                     <----------------- 1st
  jae .exit_out_of_bound; \
  addq length, TEMP1; \
  cmp $CKB_VM_ASM_RISCV_MAX_MEMORY, TEMP1; \                                     <----------------- 2nd
  ja .exit_out_of_bound

#define CHECK_READ(address_reg, length) \
  movq address_reg, TEMP1; \
  shr $CKB_VM_ASM_MEMORY_FRAME_SHIFTS, TEMP1; \
  cmp $CKB_VM_ASM_MEMORY_FRAMES, TEMP1; \                                        <----------------- 3rd
  jae .exit_out_of_bound; \
  movzbl CKB_VM_ASM_ASM_CORE_MACHINE_OFFSET_FRAMES(MACHINE, TEMP1), TEMP2d; \
  cmp $0, TEMP2d; \
  jne 1f; \
  movb $1, CKB_VM_ASM_ASM_CORE_MACHINE_OFFSET_FRAMES(MACHINE, TEMP1); \
  PREPCALL; \
  MOV_TEMP1_TO_ARG1; \
  MOV_MACHINE_TO_ARG2; \
  CALL_INITED_MEMORY; \
  POSTCALL; \
1: \
  movq address_reg, TEMP1; \
  addq $length, TEMP1; \
  subq $1, TEMP1; \
  shr $CKB_VM_ASM_MEMORY_FRAME_SHIFTS, TEMP1; \                                  <----------------- 4th
  cmp $CKB_VM_ASM_MEMORY_FRAMES, TEMP1; \
  jae .exit_out_of_bound; \
  movzbl CKB_VM_ASM_ASM_CORE_MACHINE_OFFSET_FRAMES(MACHINE, TEMP1), TEMP2d; \
  cmp $0, TEMP2d; \
  jne 2f; \
  movb $1, CKB_VM_ASM_ASM_CORE_MACHINE_OFFSET_FRAMES(MACHINE, TEMP1);\
  PREPCALL; \
  MOV_TEMP1_TO_ARG1; \
  MOV_MACHINE_TO_ARG2; \
  CALL_INITED_MEMORY; \
  POSTCALL; \
2:

We first check whether the memory is out of bounds, and then check whether the frame is out of bounds. But we have enough confidence to believe that if the memory is not out of bounds, then the frame must not be out of bounds, so I think the frame out of bounds check can be deleted.

Stack pointer not aligned

During stack initialization, as follows

https://github.com/nervosnetwork/ckb-vm/blob/develop/src/machine/mod.rs#L159

And as riscv-spec-v2.2.pdf, Page 77 says, "In the standard RISC-V calling convention, the stack pointer sp is always 16-byte aligned."

inconsistent behavior here.

CKB VM Baseline JIT Implementation

Abstract

For a baseline JIT, we will follow rv8 architecture described in this paper, we won't go into much of the optimization hassles, the goal here is to setup a JIT pipeline, and being able to translate most of the program to native assembly code while applying reasonable and easy-to-develop optimizations.

This is because more sophisticated optimizations are better built on top of cranelift, where we can share a lot of existing compiler technologies in this space, so it's better not to waste too much bandwidth on a baseline JIT.

Current estimates

• Setup JIT architecture (1w)
  • Profiling hooks
  • Assembler: since there isn't an assembler ready for stable Rust(cranelift has one but not as a separate usable package), we will have to develop one. We won't go out and develop a full-featured assembler, instead we will work on just enough features for our baseline JIT use case
  • Initial translation work: pick one instruction or one basic block, and
• Add translation support for most RISC-V instructions (1.5w), instructions that won't be translated include:
  • ecall instructions
  • memory read/write operations. This one is debatable since JITing them would require a different memory architecture, we will put this on hold first, and see if we have enough time, if we do, we will add JIT support for them.
• Remaining low-hanging optimizations in rv8 paper (1w), which might include(in the order of decreasing likelihood) We will skip some of those in current baseline JIT
  • Inlining jumps to skip prologue/epilogue
  • Macro-op fusion
  • Indirect branch acceleration
  • Hot function inlining

aarch64 compatibility

cc  -ffunction-sections -fdata-sections -fPIC -I dynasm -I src/machine/asm-Wextra -Wall -c src/machine/asm/execute.S

cannot compile due it's x86 assembly
full error log: https://gist.github.com/razum2um/f8ab8d708dc6962d960c6767043c64e7

Environment
cpu: rockchip-3399, debian: 10, linux: 5.6.5, gcc: 8.3.0

Is there any earlier portable c/rust version of that? Or any plans to make it portable?

Slow performance

I'm currently writing a new RISC-V based virtual machine and I'm slowly building up a benchmark suite of programs to cross-compare my VM to other VMs available in the ecosystem. I recently added CKBVM, and here are the results for one of my benchmarks:

• Native: 3.774ms
• PolkaVM: 6.033ms
• Wasmtime: 6.054ms
• Wasmer (singlepass): 14.307ms
• Wazero: 21.621ms
• Wasm3: 109ms
• Wasmi (register): 114ms
• Wasmi (stack): 212ms
• CKB VM: 1.020s

This was very surprising to me, because this is slower than a pure Rust WASM interpreter (Wasmi), and it's even slower than a pure Rust RISC-V interpreter I wrote as a prototype a few months back in one day (I don't have concrete up to date numbers, but that one got around ~800ms on a very similar benchmark).

So I have two questions:

• Am I doing something horribly wrong which slows it down, or is this how it performs? This is how I call into CKB-VM, this is the benchmark (it's an NES emulator and the benchmark measures how long it takes for it to process a single frame) and this is the entry point for CKB VM***.
• Are there plans to make it faster? Even with a totally naive recompiler I think you should be able to quite easily speed it up to at least ~50ms without much trouble.

The benchmark executable was, of course, compiled in release mode with full fat LTO and codegen units set to 1.

*** - Please note that there are two things I needed to do which CKB VM doesn't seem to support naturally, so I had to work around it:

• I need to call into the same program with the same memory multiple times without recompiling and reinitializing everything (I'm comparing execution performance here, not the compilation nor end-to-end total times!). I work around this by stashing the values of PC and the SP, and then restoring it every time I call back into the VM. This seems to work fine.
• I need to call two different exports from the guest program. CKB VM programs are supposed to be parametrized by setting up argv, but you can only do this once when loading the program, and I don't want to load the program multiple times - I want the benchmark to be fair and not measure the initialization! - so I completely ignore argv and just set the A0 register to tell the benchmark which entry point it's supposed to call.

Neither of these negatively affects the speed in any way, as far as I can see.

`JALR` causes wrong behavior on AsmMachine when `rs1` and `rd` use the same register.

Describe the bug

The following instruction will cause different behavior on DefaultMachine(rust) and AsmMachine(asm).

   1021a:	00000097          	auipc	ra,0x0
   1021e:	fd4080e7          	jalr	-44(ra) # 0x101ee

Let's focus on the instruction 1021e. We expect this instruction to jump to rs1(which is ra) - 14 and set the pc + 4 to the rd(which is ra) register. The DefaultMachine handles this as expected. But unfortunately, the AsmMachine set the registers in a wrong ordering:

https://github.com/nervosnetwork/ckb-vm/blob/develop/src/machine/asm/execute.S#L441

AsmMachine set rd first, then read from rs1, when the rs1 and rd use the different registers this behavior is correct, but if the rs1 and rd use the same register then the WRITE_RD operation overwrite the value of rs1.

How to fix

To simply fix this problem, we can move the WRITE_RD to the after of the REGISTER_ADDRESS(RS1).

The change may cause the network consensus split. We need to wait for a hard-fork to apply it.

Fuzzing on ISA IMC

Considering the lack of fuzzing test in the IMC instruction set, a feasible method is

0. Compile a c emulator from https://github.com/rems-project/sail-riscv
1. As a control group
2. Run rfuzzing

Upgrade rust toolchain to 1.31.0

Support A extension

We can implement the A extension on ckb-vm: considering that some Rust codes may use atomic operations, and rust only provides riscv64imac-unknown-none-elf target.

$ rustup target list | grep riscv
riscv32i-unknown-none-elf
riscv32imac-unknown-none-elf
riscv32imc-unknown-none-elf
riscv64gc-unknown-linux-gnu
riscv64gc-unknown-none-elf
riscv64imac-unknown-none-elf

Feature request : pthread support

Is ckb-vm support Linux-ELF/glibc toolchain ? I need some function like pthread in my ckb script, but only Linux-ELF/glibc support pthread library.

Tagging pointers

For a design without MMU, ckb-vm can be more vulnerable to certain types of memory corruption problems. Since ckb-vm typically runs scripts that guards assets, this issue is much more critical.

One possible solution would be introducing tagging pointers, which might leverage, but would not eliminate the problem, this paper describes a similar attempt: https://arxiv.org/abs/2105.08712

Remove all `movq IMMEDIATE, %rcx` in execute_x64.S

Since macro IMMEDIATE is already %rcx

Disable args initialize in CKB

Due to CKB's design, programs receive no args in the verification phase. But CKB-VM always does the initialize_stack, as a result, CKB-VM always puts a 0 (length of args) on the top of the stack, which makes no-sense.

https://github.com/nervosnetwork/ckb-vm/blob/develop/src/machine/mod.rs#L138

It's a bit strange, and if users try to customize memory layout through the linker script, the default behavior may override some data undesirable.

We can add a new flag to the VM and automatically disable args initialization on the future version of CKB-VM. (need to be applied on the next hard-fork)

Remove confusing constructor like `machine::latest()` or `machine::default()`

Since we have two different versions now, and the supported instruction sets include IMC, B, MOP, latest() and default() bring more confusion than their benefits, so I recommend removing them.

Related code:

• https://github.com/nervosnetwork/ckb-vm/blob/develop/src/machine/mod.rs#L365-L371
• https://github.com/nervosnetwork/ckb-vm/blob/develop/tests/test_asm.rs#L26

Suspend/resume a running VM

We should be able to suspend a running CKB VM, save the states somewhere, and resume the previously running VM at a latter time, or even on a different machine. One potential design here might be:

• A signal is sent from another thread to CKB VM to start suspending
• CKB VM will pack the current register states, as well as any dirty memory pages in a packed data structure. Notice we can easily exclude the following memory pages from dirty memory page list:
  • Page with all zeros as the data
  • All executable pages, since they must come from some binaries
  • Writable pages coming from an ELF, but hasn't been modified in any way.
• Then the packed data structure can be restored elsewhere into a running VM instance that is exactly the same as what it is before suspending. Execution can then continue from there.

Is Smart Contract implemented in Nervos and what is the programming language used?

Hi friends at Nervos, how is Smart Contract implemented in Nervos and what is the programming language used?

Nathan Aw

USDT Probes on ckb-vm AsmMachine

• https://www.brendangregg.com/blog/2014-09-17/node-flame-graphs-on-linux.html
• https://github.com/sthima/node-usdt
• https://leezhenghui.github.io/linux/2019/03/05/exploring-usdt-on-linux.html

Upgrade goblin to 0.3.5

Describe the bug

Goblin <= 0.3.4 contains an arithmetic overflow decoding bad elf metadata.

It is fixed by m4b/goblin#260 but not yet released.

The overflow in question is here https://github.com/m4b/goblin/blob/0dbaa385dbba8f56267febe0ff8fd7eda23acc39/src/elf/mod.rs#L409

In debug mode the loader will panic. In release mode, further sanity checks in the loader should prevent anything catastrophic, but I have only read the code briefly.

To Reproduce

I can provide an elf binary that reproduces the error on request.

cc @mohanson @xxuejie

Use `reset()` as a general means to reuse machine

In the current CKB, a new machine needs to be created every time a script is executed, which means a malloc with a size of at least 4M. I consider using reset() to reset the state of the machine after each script execution is over, as shown below

// Start execute first script
machine.run()

// Reset states of machine
machine.reset()
machine.set_max_cycles(_)
machine.set_cycles(0)

// Start execute next script
machine.load_program(_)
machin.run()

But now there is a problem to think about: this approach breaks isolation.

cc @driftluo

Mark memset function as unsafe

Hello, I found a soundness issue in this crate.

ckb-vm/src/memory/mod.rs

Lines 131 to 138 in 1642d8f

	// Keep this in a central place to allow for future optimization
	#[inline(always)]
	pub fn memset(slice: &mut [u8], value: u8) {
	let p = slice.as_mut_ptr();
	unsafe {
	ptr::write_bytes(p, value, slice.len());
	}
	}

The unsafe function called needs to ensure that the parameter must be:

• dst must be valid for writes of count * size_of::() bytes.
• dst must be properly aligned.
  https://doc.rust-lang.org/std/ptr/fn.write_bytes.html
  and the developer who calls the ref_as_nonnull function may not notice this safety requirement.
  Marking them unsafe also means that callers must make sure they know what they're doing.

Compiled andi.c with 'riscv64-unknown-elf-gcc -o andi andi.c' not passing test

Greetings all!

I'm trying to get the example programs that I compile myself to pass the tests, but it looks as though whatever I compile is not parsed correctly by the CKB VM. The provided binaries pass just fine. I've built the riscv toolchain as described here, and I've made no changes to the CKB-VM codebase. It appears as though my compiled andi and the provided version have the same symbols, although different sizes.

Is there a compiler option I'm missing, or am I doing something silly I'm not seeing?

Thanks for any help you're able to provide.

Macro-op-fusion: Pattern design of ADC and SBB

ADC

Adding a0, a1, and a2 with results in a0 and carry-out in a1.

add  a0, a0, a1
sltu a1, a0, a1
add  a0, a0, a2
sltu a2, a0, a2
or   a1, a1, a2

• a0 ~ a2 are used as placeholders
• a0, a1, a2 != ZERO

SBB

Do a0 - a1 - a2 with results in a0 and carry-out in a1.

sub  a1, a0, a1
sltu a3, a0, a1
sub  a0, a1, a2
sltu a2, a1, a0
or   a1, a2, a3

• a0 ~ a3 are used as placeholders
• a3 is a temporary register
• a0, a1, a2, a3 != ZERO

We need to read 5 instructions to really determine whether these 5 instructions can be fused into a mop instruction, but in fact, when the first instruction is read, we have a high accuracy rate to judge whether the first instruction is the beginning of an sbb mop instructions. This way sub a1, a0, a1 of writing sub is not very common, in most cases we will write like this sub a0, a0, a1. Therefore, this effectively distinguishes sbb and normal sub.

Test code: https://github.com/mohanson/ckb-vm/tree/adcsbb