VM Version History

The CKB network has introduced various CKB-VM versions over time to enhance security, performance, resolve bugs, and support new RISC-V extensions. Even though hard forks upgrade the network, CKB ensures old Scripts continue to run and gives users the option to specify the VM version for their Script. For details on how the CKB node chooses the CKB-VM version, see vm-selection.

CKB offers a high degree of flexibility in Script referencing. By choosing between data hash and type hash, developers and users can decide whether to lock a Script to a specific VM version or allow it to track upgrades over time.

While this flexibility enables both immutable and upgradable designs, it also places responsibility on users and developers to understand the characteristics of each VM version. Certain versions may have known issues that could affect Script behavior or security.

This page lists all VM versions and discloses known issues so you can:

• Assess risks before deploying or interacting with a Script.
• Avoid unexpected behavior by being aware of edge cases, performance changes, or vulnerabilities.

VM 0

Since the genesis of CKB network.

Full description: RFC

Instruction Set

rv64imc architecture: based on core RV64I ISA with M standard extension for integer multiplication and division, and C standard extension for RCV(RISC-V Compressed Instructions)

Syscalls

Full description: RFC

• Exit
• Load Transaction Hash
• Load Transaction
• Load Script Hash
• Load Script
• Load Cell
• Load Cell By Field
• Load Cell Data
• Load Cell Data As Code
• Load Input
• Load Input By Field
• Load Header
• Load Header By Field
• Load Witness
• Debug

Cost Model

Full description: RFC

Specify the cycles needed by each CKB-VM instructions or syscalls.

1. Cycles for RISC-V instructions are determined based on real hardware that implement RISC-V ISA.
2. Cycles for syscalls are measured based on real runtime performance metrics obtained while benchmarking current CKB implementation.

Initial Loading Cycles

For each byte loaded into CKB-VM in the initial ELF loading phase, 0.25 cycles will be charged. This is to encourage dApp developers to ship smaller Scripts as well as preventing DDoS attacks using large binaries. Notice fractions will be rounded up here, so 30.25 cycles will become 31 cycles.

instructions Cycles

All instructions consume 1 cycle except the following ones:

Instruction	Cycles
JALR	3
JAL	3
J	3
JR	3
BEQ	3
BNE	3
BLT	3
BGE	3
BLTU	3
BGEU	3
BEQZ	3
BNEZ	3
LD	2
SD	2
LDSP	2
SDSP	2
LW	3
LH	3
LB	3
LWU	3
LHU	3
LBU	3
SW	3
SH	3
SB	3
LWSP	3
SWSP	3
MUL	5
MULW	5
MULH	5
MULHU	5
MULHSU	5
DIV	32
DIVW	32
DIVU	32
DIVUW	32
REM	32
REMW	32
REMU	32
REMUW	32
ECALL	500 (see note below)
EBREAK	500 (see note below)

Syscall Cycles

As shown in the above chart, each syscall will have 500 initial cycle consumptions. This is based on real performance metrics gathered benchmarking CKB implementation, certain bookkeeping logics are required for each syscall here.

In addition, for each byte loaded into CKB-VM in the syscalls, 0.25 cycles will be charged. Notice fractions will also be rounded up here, so 30.25 cycles will become 31 cycles.

Known Issues

No known issues have been reported for this VM version.

VM 1

Introduced since 1st Hard Fork – CKB Edition Mirana (2021)

Full description: RFC

Instruction Set

1. Added the RISC-V B extension (v1.0.0) 1. This extension aims at covering the four major categories of bit manipulation: counting, extracting, inserting and swapping.
2. 10 MOPs added:

Opcode	Origin
ADC 2	add + sltu + add + sltu + or
SBB	sub + sltu + sub + sltu + or
WIDE_MUL	mulh + mul
WIDE_MULU	mulhu + mul
WIDE_MULSU	mulhsu + mul
WIDE_DIV	div + rem
WIDE_DIVU	divu + remu
FAR_JUMP_REL	auipc + jalr
FAR_JUMP_ABS	lui + jalr
LD_SIGN_EXTENDED_32_CONSTANT	lui + addiw

Syscalls

Added 3 new syscalls:

• VM Version
• Current Cycles
• Exec

Full description: RFC

Cost Model

• For all B instructions, 1 cycle will be consumed.
• 10 MOPs cycle cost:

Opcode	Origin	Cycles
ADC 2	add + sltu + add + sltu + or	1 + 0 + 0 + 0 + 0
SBB	sub + sltu + sub + sltu + or	1 + 0 + 0 + 0 + 0
WIDE_MUL	mulh + mul	5 + 0
WIDE_MULU	mulhu + mul	5 + 0
WIDE_MULSU	mulhsu + mul	5 + 0
WIDE_DIV	div + rem	32 + 0
WIDE_DIVU	divu + remu	32 + 0
FAR_JUMP_REL	auipc + jalr	0 + 3
FAR_JUMP_ABS	lui + jalr	0 + 3
LD_SIGN_EXTENDED_32_CONSTANT	lui + addiw	1 + 0

Known Issues

• Exec is deprecated and not recommended for use in VM 1. Under VM 1, the exec syscall can cause unexpected behavior theoretically. However, this issue does not exist in VM 2.

VM 2

Introduced since 2nd Hard Fork – CKB Edition Meepo (2024)

Full description: RFC

Instruction Set

5 MOPs added:

Opcode	Origin	Description
ADCS	add + sltu	Overflowing addition
SBBS	sub + sltu	Borrowing subtraction
ADD3A	add + sltu + add	Overflowing addition and add the overflow flag to the third number
ADD3B	add + sltu + add	Similar to ADD3A but the registers order is different
ADD3C	add + sltu + add	Similar to ADD3A but the registers order is different

Syscalls

Added 8 spawn-related syscalls and one block-related syscall:

• Spawn
• Pipe
• Inherited File Descriptors
• Read
• Write
• Close
• Wait
• Process ID
• Load Block Extension

Full description: RFC

Cost Model

• 5 MOPs cycle cost:

Opcode	Origin	Cycles
ADCS	add + sltu	1 + 0
SBBS	sub + sltu	1 + 0
ADD3A	add + sltu + add	1 + 0 + 0
ADD3B	add + sltu + add	1 + 0 + 0
ADD3C	add + sltu + add	1 + 0 + 0

• Spawn syscall cycles:

Syscall Name	Cycles Charge
spawn	500 + SPAWN_YIELD_CYCLES_BASE + BYTES_TRANSFERRED_CYCLES + SPAWN_EXTRA_CYCLES_BASE
pipe	500 + SPAWN_YIELD_CYCLES_BASE
inherited_fd	500 + SPAWN_YIELD_CYCLES_BASE
read	500 + SPAWN_YIELD_CYCLES_BASE + BYTES_TRANSFERRED_CYCLES
write	500 + SPAWN_YIELD_CYCLES_BASE + BYTES_TRANSFERRED_CYCLES
close	500 + SPAWN_YIELD_CYCLES_BASE
wait	500 + SPAWN_YIELD_CYCLES_BASE
process_id	500
load block extension	500 + BYTES_TRANSFERRED_CYCLES

Known Issues

No known issues have been reported for this VM version.