apollo_starknet_os_program: restore keccak syscall in virtual OS

Re-adds the keccak syscall to the virtual OS (reverts the removal from #12355) and bumps
allowed_virtual_os_program_hashes to the new virtual_os program hash.

Cleans up the now-redundant 'Keccak' arm in test_contract's
test_forbidden_syscall_in_virtual_mode and drops the corresponding case in
test_forbidden_syscall.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Yoni-Starkware

crates/apollo_starknet_os_program/src/cairo/starkware/starknet/core/os/constants.cairo

@@ -69,7 +69,7 @@ const ALLOWED_VIRTUAL_OS_PROGRAM_HASHES_0 = (
     0x03e98c2d7703b03a7edb73ed7f075f97f1dcbaa8f717cdf6e1a57bf058265473
 );
 const ALLOWED_VIRTUAL_OS_PROGRAM_HASHES_1 = (
-    0x039f55918423cade9e95a6a52286b56bed1c5c9b6fe39aa00301361457a3c604
+    0x0542f701524219b8333d8a74a7eee00724673d53d1c78915e8f6d241e4ad81b9
 );
 const ALLOWED_VIRTUAL_OS_PROGRAM_HASHES_LEN = 2;
 

crates/apollo_starknet_os_program/src/cairo/starkware/starknet/core/os/execution/execute_syscalls__virtual.cairo

@@ -9,6 +9,7 @@ from starkware.starknet.common.new_syscalls import (
     EMIT_EVENT_SELECTOR,
     GET_CLASS_HASH_AT_SELECTOR,
     GET_EXECUTION_INFO_SELECTOR,
+    KECCAK_SELECTOR,
     LIBRARY_CALL_SELECTOR,
     SECP256K1_ADD_SELECTOR,
     SECP256K1_GET_POINT_FROM_X_SELECTOR,
@@ -39,6 +40,7 @@ from starkware.starknet.core.os.execution.syscall_impls import (
     execute_call_contract,
     execute_get_class_hash_at,
     execute_get_execution_info,
+    execute_keccak,
     execute_library_call,
     execute_secp256k1_add,
     execute_secp256k1_get_point_from_x,
@@ -157,6 +159,16 @@ func execute_syscalls{
         );
     }
 
+    if (selector == KECCAK_SELECTOR) {
+        execute_keccak();
+        %{ OsLoggerExitSyscall %}
+        return execute_syscalls(
+            block_context=block_context,
+            execution_context=execution_context,
+            syscall_ptr_end=syscall_ptr_end,
+        );
+    }
+
     if (selector == SHA256_PROCESS_BLOCK_SELECTOR) {
         execute_sha256_process_block();
         %{ OsLoggerExitSyscall %}

crates/apollo_starknet_os_program/src/program_hash.json

@@ -1,6 +1,6 @@
 {
-  "os": "0x2a4b5650b64c1a13a4d2754353ddd85d4b970766063220253a4f96643ba23f6",
-  "virtual_os": "0x39f55918423cade9e95a6a52286b56bed1c5c9b6fe39aa00301361457a3c604",
+  "os": "0x3bd43ee8e972acc8afd825f8254a6e842884591bff817c3e2a7795577054da",
+  "virtual_os": "0x542f701524219b8333d8a74a7eee00724673d53d1c78915e8f6d241e4ad81b9",
   "aggregator": "0x700786d51b3854af43d8e12180380bda3029be6c1767e007858de6ca2edac40",
   "aggregator_with_prefix": "0xe08d300e3f5996e43d6d7cc5a20068e0e58cf1309089f2348317ac580f6c1f"
 }

crates/apollo_starknet_os_program/src/virtual_os_test.rs

@@ -23,7 +23,7 @@ fn test_program_bytecode_lengths() {
     "#]]
     .assert_debug_eq(&OS_PROGRAM.data_len());
     expect![[r#"
-        10261
+        10717
     "#]]
     .assert_debug_eq(&VIRTUAL_OS_PROGRAM.data_len());
 }

crates/blockifier/resources/blockifier_versioned_constants_0_14_3.json

@@ -68,7 +68,7 @@
     "os_constants": {
         "allowed_virtual_os_program_hashes": [
             "0x3e98c2d7703b03a7edb73ed7f075f97f1dcbaa8f717cdf6e1a57bf058265473",
-            "0x39f55918423cade9e95a6a52286b56bed1c5c9b6fe39aa00301361457a3c604"
+            "0x542f701524219b8333d8a74a7eee00724673d53d1c78915e8f6d241e4ad81b9"
         ],
         "constructor_entry_point_selector": "0x28ffe4ff0f226a9107253e17a904099aa4f63a02a5621de0576e5aa71bc5194",
         "default_entry_point_selector": "0x0",

crates/blockifier/resources/versioned_constants_diff_regression/0.14.2_0.14.3.txt

@@ -1,2 +1,2 @@
 ~ /enable_casm_hash_migration: true
-+ /os_constants/allowed_virtual_os_program_hashes/1: "0x39f55918423cade9e95a6a52286b56bed1c5c9b6fe39aa00301361457a3c604"
++ /os_constants/allowed_virtual_os_program_hashes/1: "0x542f701524219b8333d8a74a7eee00724673d53d1c78915e8f6d241e4ad81b9"

crates/blockifier_test_utils/resources/feature_contracts/cairo1/test_contract.cairo

@@ -1411,8 +1411,7 @@ mod TestContract {
 
     // Tests forbidden syscalls in virtual OS mode.
     // Gets valid class_hash and contract_address from the current contract.
-    // syscall_selector should be one of: 'Deploy', 'GetBlockHash', 'Keccak', 'ReplaceClass',
-    // 'MetaTxV0'.
+    // syscall_selector should be one of: 'Deploy', 'GetBlockHash', 'ReplaceClass', 'MetaTxV0'.
     #[external(v0)]
     fn test_forbidden_syscall_in_virtual_mode(self: @ContractState, syscall_selector: felt252) {
         let execution_info = get_execution_info().unbox();
@@ -1421,11 +1420,6 @@ mod TestContract {
 
         if syscall_selector == 'GetBlockHash' {
             syscalls::get_block_hash_syscall(0).unwrap_syscall();
-        } else if syscall_selector == 'Keccak' {
-            // Use the high-level keccak function which internally calls the keccak syscall.
-            let mut input: Array<u256> = Default::default();
-            input.append(u256 { low: 1, high: 0 });
-            keccak::keccak_u256s_le_inputs(input.span());
         } else if syscall_selector == 'ReplaceClass' {
             syscalls::replace_class_syscall(class_hash).unwrap_syscall();
         } else if syscall_selector == 'Deploy' {

crates/starknet_os_flow_tests/src/virtual_os_test.rs

@@ -145,7 +145,6 @@ async fn test_cairo0_contract_os_error() {
 #[rstest]
 #[case::deploy("Deploy")]
 #[case::get_block_hash("GetBlockHash")]
-#[case::keccak("Keccak")]
 #[case::replace_class("ReplaceClass")]
 #[case::meta_tx_v0("MetaTxV0")]
 #[tokio::test]
@@ -299,9 +298,7 @@ async fn prove_and_verify_multicall_tx() {
     };
 
     // TODO(Yoni): add more inner calls (e.g. sha256, secp256k1, send_message_to_l1).
-    // TODO(Yoni): restore the keccak inner call once the keccak syscall is allowed in
-    // virtual OS mode (added in a follow-up PR stacked on top of this one).
-    // serialize_call("test_keccak", &[]);
+    serialize_call("test_keccak", &[]);
     serialize_call("test_ec_op", &[]);
 
     // The dummy account's `__execute__(contract_address, selector, calldata)` forwards