Architecture Study · Zero Knowledge

OpenVM

A first-principles study of OpenVM: how a Rust program becomes RISC-V, how execution is decomposed into chips, how traces become AIR constraints, how buses connect those constraints, and how the proving system turns the whole computation into a verifiable proof.

RISC-V RV32IM No-CPU Architecture Chips & Extensions AIR / STARK SWIRL Recursion Deferral

Primary study source: github.com/openvm-org/openvm

01 · Core idea

What is OpenVM actually trying to prove?

A zkVM lets a prover execute a program normally and produce a cryptographic proof that the execution followed the rules of the machine. The verifier does not need to replay the entire computation.

OpenVM approaches this with a modular, no-CPU architecture. Instead of putting the complete virtual machine into one giant proving circuit, it decomposes the machine into specialized chips and extensions.

The one idea to remember

Execution produces a trace → AIRs constrain the trace → buses prove that chips agree → the proof system proves those constraints → recursion makes the result scalable.

01
Compile
Rust → LLVM → RISC-V
02
Execute
RISC-V instructions run through OpenVM's chip-based machine
03
Constrain
Execution traces are represented by AIR constraints
04
Connect
Buses enforce consistency between independent chips
05
Prove
SWIRL / STARK machinery proves the algebraic claims
06
Compose
Continuations, deferral and recursion scale proof generation
07
Verify
A final proof can be checked without replaying the program
02 · Architecture

The architecture at a glance

The important architectural distinction is that OpenVM is not best understood as a conventional CPU with several peripherals. The proving architecture is intentionally decomposed into chips, with each chip responsible for a well-defined part of execution and its corresponding algebraic constraints.

Guest
Rust Program
Application logic written by the developer
Compiler
Rust + LLVM
Compiles the guest toward the RISC-V target
RISC-V RV32IM · program binary · OpenVM transpiler
Instruction layer
OpenVM ISA
RISC-V instructions plus extensible VM operations
Execution
Chip-based VM
Base, memory, program and specialized extension chips
Each chip records execution data and exposes the state needed for proving
Local correctness
AIRs
Algebraic constraints over chip execution traces
Cross-chip correctness
Buses / Interactions
Connect independent AIRs and enforce consistency
AIR constraints + interactions → polynomial claims
Proving
SWIRL / STARK
LogUp, GKR, Zerocheck, stacking, WHIR and low-degree testing
Composition
Recursion
Aggregate segment and deferred proofs into a smaller result
Final proof → verifier → accepted / rejected
03 · Compilation

From Rust to RISC-V

The developer starts with ordinary Rust guest code. They do not write AIR, STARK constraints or polynomial commitments. The normal compilation pipeline lowers the program toward a machine-level representation, targeting RISC-V.

Compilation pipeline
Rust guest program
       │
       ▼
 Rust compiler
       │
       ▼
      HIR
       │
       ▼
      MIR
       │
       ▼
   LLVM IR
       │
       ▼
 RISC-V binary
       │
       ▼
OpenVM transpiler
       │
       ▼
  OpenVM ISA

The key boundary to remember is RISC-V semantics ↔ OpenVM semantics. If the translation changes what an instruction means, the prover and the machine can disagree before the STARK system even enters the picture.

04 · ISA & extensions

A modular instruction set

OpenVM supports a RISC-V-based instruction set and is designed to be extended with specialized operations. The motivation is straightforward: some cryptographic operations are extremely expensive if decomposed into many ordinary instructions.

Base

RV32IM

Arithmetic, logic, loads, stores, branches and other ordinary RISC-V execution.

Hashing

Keccak / SHA

Specialized proving paths for cryptographic hashing workloads.

Arithmetic

Int256 / modular ops

Large-integer operations that would otherwise expand into many smaller VM steps.

Cryptography

ECC / Pairings

Specialized chips for elliptic-curve and related cryptographic operations.

Why extensions exist
Keccak using ordinary instructions

Keccak
  │
  ├── many RISC-V instructions
  ├── large execution trace
  └── expensive proving
          │
          ▼
      dedicated chip
          │
          ▼
       Keccak AIR
          │
          ▼
    smaller / specialized
       proof workload
05 · Execution

No central CPU — chips execute the machine

A useful mental model is a collection of cooperating proving components. A base chip handles ordinary operations, while memory and specialized extensions handle their own responsibilities.

Chip-based execution
                         OpenVM
                           │
        ┌──────────────────┼──────────────────┐
        │                  │                  │
        ▼                  ▼                  ▼
     Base chip         Memory chip       Extension chips
     ADD / MUL         LOAD / STORE      Keccak / SHA / ECC
     branches          read / write      Int256 / Pairing
        │                  │                  │
        └──────────────────┼──────────────────┘
                           │
                           ▼
                    Execution traces

For example, an addition can be represented by a trace row containing the operands and result. A memory operation needs more information: address, value, access type and ordering information all have to be represented in a way that later constraints can enforce memory consistency.

06 · Trace → AIR

How execution becomes mathematics

An AIR — Algebraic Intermediate Representation — replaces the informal statement "the machine executed correctly" with algebraic constraints over the execution trace.

Simplified ADD constraint
a = 5
b = 7
c = 12

constraint:
    c - a - b = 0

valid:
    12 - 5 - 7 = 0

invalid:
    13 - 5 - 7 ≠ 0

Real AIRs are substantially richer. They constrain current rows, transitions between rows, flags, selectors, memory accesses and other machine state. The central idea remains the same: a valid execution trace must satisfy every required constraint.

Base AIR

Instruction correctness

Constrains arithmetic, logic, register updates, program counter behavior and related state transitions.

Memory AIR

Read / write consistency

Constrains the representation of memory accesses and the consistency of values over time.

Extension AIR

Specialized operations

Represents the algebraic correctness of operations such as Keccak or ECC.

Boundary

Initial / final state

Connects the trace to the intended program inputs, outputs and machine state.

07 · Buses

How independent AIRs agree

AIR proves that one chip's trace obeys its own equations. That alone is not enough. The chips also have to agree with one another.

Example: a memory read
Execution chip
     │
     │ "read address 100"
     ▼
   BUS / INTERACTION
     │
     ▼
Memory chip
     │
     │ "address 100 → value 42"
     ▼
Execution state
     │
     ▼
register x5 = 42

A useful mental model is that a bus behaves like a proof-level API. One AIR emits an interaction and another AIR supplies the matching interaction. The proving system checks that the required collections of interactions match.

Audit invariant

VM semantics, AIR semantics and cross-AIR interactions must describe the same computation.

08 · Proving

SWIRL: from constraints to a proof

Once the traces, AIR constraints and cross-chip interactions are defined, the proving layer turns those statements into polynomial claims and then into a succinct cryptographic proof.

Proof pipeline
AIR constraints
      │
      ▼
Bus / interaction claims
      │
      ▼
    LogUp
      │
      ▼
GKR / reductions
      │
      ▼
  Zerocheck
      │
      ▼
Polynomial claims
      │
      ▼
  Stacking
      │
      ▼
    WHIR
      │
      ▼
Low-degree testing
      │
      ▼
 STARK / SWIRL proof
Interactions

LogUp

Supports lookup and multiset-style matching arguments used to connect interactions.

Reduction

GKR

Reduces large structured computation claims into smaller claims that are cheaper to verify.

Constraints

Zerocheck

Turns "this constraint polynomial is zero on the required domain" into a proof claim.

Polynomial proof

WHIR

Handles polynomial openings and low-degree testing inside the STARK-style proving stack.

09 · Scaling

Continuations and deferral

Large programs can produce enormous execution traces. OpenVM's proof composition architecture provides mechanisms for splitting and postponing expensive work rather than forcing everything into one monolithic proof.

Long execution
Continuation
Split execution into proof segments.
Composition
Aggregation
Combine segment proofs while preserving state continuity.
state_out(segment i) = state_in(segment i + 1)
Expensive work
Deferral
Move selected proving work outside the main execution path.
Later stage
Proof verification
Verify the deferred result as part of later proof composition.

The security boundary is the connection between segments and between deferred work and the computation that depends on it. A proof of a segment is only useful if the next segment really starts from the state produced by the previous one.

10 · Recursion

From many proofs to one root proof

Recursive verification means that one proof can be verified inside another proving computation. This allows a large collection of segment proofs to be compressed into an aggregate result.

Recursive composition
   Proof π₁        Proof π₂        Proof π₃        Proof π₄
      │               │               │               │
      └───────────────┴───────────────┴───────────────┘
                              │
                              ▼
                     Recursive verifier
                              │
                              ▼
                       Aggregate proof
                              │
                              ▼
                      Recursive verifier
                              │
                              ▼
                         ROOT PROOF
                              │
                              ▼
                           Verify

The important property is not merely that proofs are combined. The recursive verifier must correctly enforce the statement that every child proof was valid and that its public inputs and commitments are connected to the aggregate statement.

11 · Final verification

The verifier sees a proof, not the whole program

After proof composition, the final verifier checks the resulting cryptographic statement. It does not need to replay billions of VM steps.

Final boundary
Huge Rust computation
        │
        ▼
RISC-V execution
        │
        ▼
many trace rows
        │
        ▼
many AIRs + interactions
        │
        ▼
STARK / SWIRL proofs
        │
        ▼
recursive aggregation
        │
        ▼
small final proof
        │
        ▼
     VERIFIER
        │
   ┌────┴────┐
   ▼         ▼
 ACCEPT    REJECT

This is the payoff of the entire architecture: the computational work can be enormous while the final verification task is comparatively small.

12 · Worked example

One ADD, from Rust to proof

Take a tiny guest program that computes z = x + y, where x = 10 and y = 20. The exact internal trace is more detailed than this simplified example, but the architectural flow is:

One instruction end to end
Rust
 │
 │  z = x + y
 ▼
RISC-V
 │
 │  ADD
 ▼
OpenVM ISA
 │
 ▼
Execution chip
 │
 │  trace row
 ▼
ADD / Base AIR
 │
 │  constraint:
 │  result - x - y = 0
 ▼
Bus interactions
 │
 ▼
Polynomial constraints
 │
 ▼
SWIRL / STARK proving
 │
 ▼
Segment proof
 │
 ▼
Recursive aggregation
 │
 ▼
Final proof
 │
 ▼
Verifier → ACCEPT
13 · Extensibility

What happens when you add a new operation?

One of OpenVM's strongest architectural ideas is that a new specialized operation does not require redesigning one enormous monolithic circuit. The extension is integrated into the VM's execution and proving model.

Extension path
                 NEW OPERATION
                       │
        ┌──────────────┼──────────────┐
        ▼              ▼              ▼
   Guest interface   Transpiler     Executor
        │              │              │
        └──────────────┼──────────────┘
                       ▼
                  New chip
                       │
                       ▼
                    New AIR
                       │
                       ▼
                Bus interactions
                       │
                       ▼
                 STARK proof

This modularity is why understanding the chip → AIR → bus pattern is more useful than memorizing individual extension names.

14 · Technology map

OpenVM stack, layer by layer

Layer Technology / concept Purpose
GuestRustProgram being proven.
CompilerRust compiler + LLVMLower guest code toward RISC-V.
ISARISC-V RV32IMMachine-level instruction target.
TranslationOpenVM transpilerMaps RISC-V into OpenVM's instruction representation.
ExecutionModular chipsExecute different classes of operations.
MemoryMemory architectureRepresent and constrain reads and writes.
ExtensionsKeccak, SHA, ECC, arithmetic, etc.Efficient specialized operations.
ArithmetizationAIRExpress execution correctness algebraically.
InteractionBuses / lookupsConnect independent AIRs.
ProofSTARK / SWIRL stackProve polynomial constraints and interactions.
CompositionContinuationsSplit long executions into segments.
Deferred workDeferralMove selected expensive proving work to another stage.
AggregationRecursionCompress many proofs into a smaller proof.
VerificationFinal verifier / on-chain integrationCheck the resulting cryptographic statement.
Extension languageRustImplement VM extensions and proving components.
15 · Study path

How to study the OpenVM codebase

The most effective approach is to move from architecture to one concrete instruction, then expand outward into proving and recursion.

  1. Top-level architecture
    Understand the relationship between the VM, extensions, chips and proving backend.
  2. RV32IM extension
    Start with ordinary instructions before studying specialized cryptographic chips.
  3. Transpiler
    Follow how RISC-V instructions become OpenVM instructions.
  4. Executor
    See how an instruction is executed and what data is recorded for proving.
  5. Memory
    Study reads, writes, ordering, roots and the interactions that connect memory to execution.
  6. One simple chip
    Understand the complete executor → trace → AIR lifecycle with the smallest useful example.
  7. Keccak / specialized chip
    Learn why specialized operations need their own execution and AIR logic.
  8. Buses
    Trace one interaction between two chips and identify exactly what prevents mismatches.
  9. STARK backend / SWIRL
    Only after understanding AIRs and buses, study LogUp, GKR, Zerocheck, stacking and WHIR.
  10. Continuations
    Understand how long executions become independently provable segments.
  11. Recursion
    Follow how one proof becomes an input to another proof.
  12. Deferral
    Understand how expensive work can be moved out of the main proving path.
  13. Final verifier
    Finish by tracing the exact public inputs, commitments and proof checks.
16 · Security lens

Where bugs are most interesting

The architecture gives a natural audit methodology. At every boundary ask: what information crosses, what invariant must hold, where is it enforced, and can I construct a counterexample?

01

Compiler / transpiler

Can RISC-V semantics and OpenVM semantics diverge for an instruction or edge case?

02

VM execution

Can an instruction, branch, register update or program-counter transition be implemented incorrectly?

03

AIR constraints

Is every value that matters actually constrained? Are selectors, flags, boundaries and transitions fully enforced?

04

Memory

Can reads, writes, ordering or memory-root construction become inconsistent with execution?

05

Bus interactions

Can one chip emit an interaction that another chip accepts without representing the intended operation?

06

Recursive verifier

Can malformed proof data, public inputs or bounds cause an invalid child proof to be accepted?

07

Final verifier

Are commitments, field encodings, selectors and public inputs interpreted exactly as intended?

08

Composition boundaries

Do continuation and deferred proofs preserve the exact state and statement that the next stage expects?

Audit lens

Execution → Trace → AIR → Bus → Proof → Recursion → Verification

17 · Final mental model

OpenVM in one picture

The architecture to remember
                         RUST
                           │
                           ▼
                    Rust Compiler
                       + LLVM
                           │
                           ▼
                        RISC-V
                           │
                           ▼
                    OpenVM Transpiler
                           │
                           ▼
                      OpenVM ISA
                           │
                           ▼
                  ┌─────────────────┐
                  │  CHIP EXECUTION │
                  └────────┬────────┘
                           │
          ┌────────────────┼────────────────┐
          │                │                │
          ▼                ▼                ▼
       Base AIR        Memory AIR      Extension AIRs
          │                │                │
          └────────────────┼────────────────┘
                           │
                           ▼
                     BUS / LOOKUPS
                           │
                           ▼
                  AIR + INTERACTIONS
                           │
                           ▼
                     SWIRL / STARK
                           │
                           ▼
                 SEGMENT / DEFERRED
                       PROOFS
                           │
                           ▼
                      RECURSION
                           │
                           ▼
                      ROOT PROOF
                           │
                           ▼
                       VERIFIER
                           │
                    ┌──────┴──────┐
                    ▼             ▼
                 ACCEPT         REJECT
The sentence to remember

OpenVM executes a RISC-V program by decomposing machine behavior into chips, proves each chip algebraically through AIR, connects the chips through proof-level interactions, and composes those proofs until a final verifier can establish the correctness of the computation.