Merge branch 'main' into feat/continuation-precomputed-commitments

Author: Oppen

.github/workflows/pr_main.yaml

@@ -131,6 +131,9 @@ jobs:
       - name: Run CLI tests
         run: cargo test -p cli
 
+      - name: Run syscalls host tests (keccak differential vs sha3)
+        run: make test-syscalls
+
   # "Test" is a required check — keep this name to avoid branch protection changes.
   # This gate job passes only when CLI, executor, disk-spill, and prover tests succeed.
   test:

Makefile

@@ -1,7 +1,7 @@
 .PHONY: deps deps-linux deps-macos compile-programs-asm compile-programs-rust compile-bench \
 compile-programs compile-recursion-elfs clean-asm clean-rust clean-bench clean-shared \
 clean-recursion-elfs clean test test-asm \
-test-rust test-ethrex test-executor test-flamegraph flamegraph-prover test-profile-recursion test-profile-recursion-single test-profile-recursion-multi \
+test-rust test-ethrex test-executor test-syscalls test-flamegraph flamegraph-prover test-profile-recursion test-profile-recursion-single test-profile-recursion-multi \
 test-fast test-prover test-prover-all test-prover-debug test-disk-spill test-math-cuda test-cuda-integration test-cuda-fallback \
 test-prover-cuda test-prover-comprehensive-cuda \
 bench-math-cuda bench-prover bench-prover-cuda build check clippy fmt lint regen-ethrex-fixtures \
@@ -293,7 +293,16 @@ update-ethrex-fixture-checksums:
 check-ethrex-fixture-checksums:
 	python3 tooling/ethrex-fixtures/update_readme_checksums.py --check
 
-test: compile-programs
+# The syscalls crate is excluded from the workspace (riscv-only bare-metal
+# entrypoints/allocator that assemble only for the guest target — see the root
+# Cargo.toml exclude), so the root `cargo test` never reaches its host
+# differential tests (the keccak sponge vs sha3 reference). Run them explicitly
+# in the crate dir; wired into `test` below and run as a dedicated step
+# in CI's cli-test job (pr_main.yaml).
+test-syscalls:
+	cd syscalls && cargo test
+
+test: compile-programs test-syscalls
 	cargo test
 
 # === Quick test shortcuts ===

crypto/crypto/src/hash/platform_keccak.rs

@@ -11,6 +11,15 @@ mod imp {
     };
     use lambda_vm_syscalls::keccak::Keccak256 as SyscallKeccak256;
 
+    // INVARIANT (load-bearing): this adapter must remain a PURE PASSTHROUGH of
+    // `SyscallKeccak256`. The TypeId specializations in
+    // crypto/crypto/src/merkle_tree/backends/field_element_vector.rs bypass it
+    // and drive the syscall sponge directly, on the assumption that both paths
+    // hash identically. Adding ANY behavior here (a domain prefix, extra
+    // absorption, a different reset policy) silently desyncs the specialized
+    // branches from the generic path — and the failure surfaces as in-guest
+    // proof rejection, not as a host test failure.
+
     #[derive(Clone, Default)]
     pub struct PlatformKeccak256(SyscallKeccak256);
 

crypto/crypto/src/merkle_tree/backends/field_element_vector.rs

@@ -9,6 +9,88 @@ use math::{
     traits::AsBytes,
 };
 
+#[cfg(target_arch = "riscv64")]
+use crate::hash::platform_keccak::PlatformKeccak256;
+#[cfg(target_arch = "riscv64")]
+use core::any::TypeId;
+#[cfg(target_arch = "riscv64")]
+use lambda_vm_syscalls::keccak::Keccak256 as SyscallKeccak256;
+
+/// Absorb `feed`'s byte stream into a fresh `D` and return the digest as a
+/// fixed `[u8; NUM_BYTES]`.
+///
+/// On the riscv64 guest, when `D` is the platform keccak digest and the node
+/// is 32 bytes, this drives the syscall sponge directly and squeezes straight
+/// into the result array. That skips the `Digest::finalize` blanket, which
+/// allocates a zeroed `GenericArray`, has the adapter fill a local `[u8; 32]`
+/// and copy it into that `Output`, then leaves the caller to copy the `Output`
+/// once more into its own array — two 32-byte memcpys plus a 32-byte memset of
+/// pure plumbing around the one permutation. Byte-identical to the generic
+/// path; every other digest / node size (and the entire host build) takes the
+/// generic path unchanged.
+///
+/// DO NOT replace this `TypeId` dispatch with a generic `Digest::finalize_into`
+/// fix "at the adapter altitude" — that exact refactor was implemented and
+/// MEASURED SLOWER on the guest across every formulation tried (best:
+/// +60k min = +0.14%, +1.25M blowup8 = +0.48%), including `#[inline]`
+/// adapters and a check-free `AsMut` output conversion. The residual is
+/// intrinsic: `FixedOutput::finalize_into` moves the 208-byte sponge by value
+/// through the newtype + trait layer into a non-inlined cross-crate call, and
+/// without LTO the placement isn't elided; the direct branch below builds the
+/// sponge in place at the call's ABI slot. Deleting the dispatch also cannot
+/// remove the `'static` bounds — `hash_new_parent_bytes` needs them regardless.
+#[inline]
+fn hash_streamed<D: Digest + 'static, const NUM_BYTES: usize>(
+    feed: impl Fn(&mut dyn FnMut(&[u8])),
+) -> [u8; NUM_BYTES] {
+    #[cfg(target_arch = "riscv64")]
+    if NUM_BYTES == 32 && TypeId::of::<D>() == TypeId::of::<PlatformKeccak256>() {
+        let mut hasher = SyscallKeccak256::new();
+        feed(&mut |bytes| hasher.update(bytes));
+        let mut result = [0u8; NUM_BYTES];
+        // NUM_BYTES == 32 in this branch, so the slice is exactly a [u8; 32].
+        let out: &mut [u8; 32] = (&mut result[..]).try_into().unwrap();
+        hasher.finalize(out);
+        return result;
+    }
+
+    let mut hasher = D::new();
+    feed(&mut |bytes| hasher.update(bytes));
+    let mut result_hash = [0_u8; NUM_BYTES];
+    result_hash.copy_from_slice(&hasher.finalize());
+    result_hash
+}
+
+/// Hash a Merkle parent — always exactly two concatenated 32-byte nodes.
+///
+/// On the riscv64 guest, when `D` is the platform keccak digest and nodes are
+/// 32 bytes, this is one fixed-shape 64-byte compression ([`keccak256_pair`]):
+/// a single permutation with the input lanes and padding written straight into
+/// the state, skipping the incremental sponge's per-byte absorb, running
+/// offset, and separate padding pass. Byte-identical to streaming both nodes
+/// through the digest; every other digest / node size (and the host build)
+/// takes the generic streaming-and-finalize path unchanged.
+#[inline]
+fn hash_new_parent_bytes<D: Digest + 'static, const NUM_BYTES: usize>(
+    left: &[u8; NUM_BYTES],
+    right: &[u8; NUM_BYTES],
+) -> [u8; NUM_BYTES] {
+    #[cfg(target_arch = "riscv64")]
+    if NUM_BYTES == 32 && TypeId::of::<D>() == TypeId::of::<PlatformKeccak256>() {
+        let l: &[u8; 32] = left[..].try_into().unwrap();
+        let r: &[u8; 32] = right[..].try_into().unwrap();
+        let hash = lambda_vm_syscalls::keccak::keccak256_pair(l, r);
+        let mut result = [0u8; NUM_BYTES];
+        result.copy_from_slice(&hash);
+        return result;
+    }
+
+    hash_streamed::<D, NUM_BYTES>(|sink| {
+        sink(left);
+        sink(right);
+    })
+}
+
 /// A backend for Merkle trees that uses fixed-size pairs of field elements.
 /// This is more efficient than `FieldElementVectorBackend` when the batch size is always 2,
 /// as it avoids Vec allocation overhead.
@@ -27,7 +109,7 @@ impl<F, D: Digest, const NUM_BYTES: usize> Default for FieldElementPairBackend<F
     }
 }
 
-impl<F, D: Digest, const NUM_BYTES: usize> IsMerkleTreeBackend
+impl<F, D: Digest + 'static, const NUM_BYTES: usize> IsMerkleTreeBackend
     for FieldElementPairBackend<F, D, NUM_BYTES>
 where
     F: IsField,
@@ -38,21 +120,14 @@ where
     type Data = [FieldElement<F>; 2];
 
     fn hash_data(input: &[FieldElement<F>; 2]) -> [u8; NUM_BYTES] {
-        let mut hasher = D::new();
-        input[0].stream_bytes(&mut |b| hasher.update(b));
-        input[1].stream_bytes(&mut |b| hasher.update(b));
-        let mut result_hash = [0_u8; NUM_BYTES];
-        result_hash.copy_from_slice(&hasher.finalize());
-        result_hash
+        hash_streamed::<D, NUM_BYTES>(|sink| {
+            input[0].stream_bytes(sink);
+            input[1].stream_bytes(sink);
+        })
     }
 
     fn hash_new_parent(left: &[u8; NUM_BYTES], right: &[u8; NUM_BYTES]) -> [u8; NUM_BYTES] {
-        let mut hasher = D::new();
-        hasher.update(left);
-        hasher.update(right);
-        let mut result_hash = [0_u8; NUM_BYTES];
-        result_hash.copy_from_slice(&hasher.finalize());
-        result_hash
+        hash_new_parent_bytes::<D, NUM_BYTES>(left, right)
     }
 }
 
@@ -71,7 +146,7 @@ impl<F, D: Digest, const NUM_BYTES: usize> Default for FieldElementVectorBackend
     }
 }
 
-impl<F, D: Digest, const NUM_BYTES: usize> FieldElementVectorBackend<F, D, NUM_BYTES>
+impl<F, D: Digest + 'static, const NUM_BYTES: usize> FieldElementVectorBackend<F, D, NUM_BYTES>
 where
     [u8; NUM_BYTES]: From<Output<D>>,
 {
@@ -80,15 +155,11 @@ where
     /// once, avoiding per-element allocations while staying consistent with the
     /// backend's hash function.
     pub fn hash_bytes(data: &[u8]) -> [u8; NUM_BYTES] {
-        let mut hasher = D::new();
-        hasher.update(data);
-        let mut result = [0u8; NUM_BYTES];
-        result.copy_from_slice(&hasher.finalize());
-        result
+        hash_streamed::<D, NUM_BYTES>(|sink| sink(data))
     }
 }
 
-impl<F, D: Digest, const NUM_BYTES: usize> FieldElementVectorBackend<F, D, NUM_BYTES>
+impl<F, D: Digest + 'static, const NUM_BYTES: usize> FieldElementVectorBackend<F, D, NUM_BYTES>
 where
     F: IsField,
     FieldElement<F>: AsBytes,
@@ -100,17 +171,15 @@ where
     /// `hash_data(&[a, b].concat())`: the sponge absorbs the same element bytes
     /// in the same order, just without the intermediate `Vec`.
     pub fn hash_data_from_slices(a: &[FieldElement<F>], b: &[FieldElement<F>]) -> [u8; NUM_BYTES] {
-        let mut hasher = D::new();
-        for element in a.iter().chain(b.iter()) {
-            element.stream_bytes(&mut |bytes| hasher.update(bytes));
-        }
-        let mut result_hash = [0_u8; NUM_BYTES];
-        result_hash.copy_from_slice(&hasher.finalize());
-        result_hash
+        hash_streamed::<D, NUM_BYTES>(|sink| {
+            for element in a.iter().chain(b.iter()) {
+                element.stream_bytes(sink);
+            }
+        })
     }
 }
 
-impl<F, D: Digest, const NUM_BYTES: usize> IsMerkleTreeBackend
+impl<F, D: Digest + 'static, const NUM_BYTES: usize> IsMerkleTreeBackend
     for FieldElementVectorBackend<F, D, NUM_BYTES>
 where
     F: IsField,
@@ -129,12 +198,7 @@ where
     }
 
     fn hash_new_parent(left: &[u8; NUM_BYTES], right: &[u8; NUM_BYTES]) -> [u8; NUM_BYTES] {
-        let mut hasher = D::new();
-        hasher.update(left);
-        hasher.update(right);
-        let mut result_hash = [0_u8; NUM_BYTES];
-        result_hash.copy_from_slice(&hasher.finalize());
-        result_hash
+        hash_new_parent_bytes::<D, NUM_BYTES>(left, right)
     }
 }
 

crypto/math-cuda/kernels/logup.cu

@@ -115,7 +115,7 @@ extern "C" __global__ void logup_term_ext3(
 // Accumulated column (K4): running sum of the term columns, on device.
 //   row_sum[i] = sum over all term columns of term[col][i]
 //   S = inclusive prefix scan of row_sum ;  L = S[n-1] ;  offset = L / N
-//   acc[i] = S[i] - (i+1) * offset          (matches build_accumulated_column_from_terms)
+//   acc[i] = S[i-1] - i * offset  (acc[0]=0)  (matches build_accumulated_column_from_terms)
 // Additive 3-phase Hillis-Steele scan (mirrors inverse.cu, add not mul).
 // ===========================================================================
 
@@ -193,7 +193,10 @@ extern "C" __global__ void logup_apply_offsets_add_ext3(
   scan_inout[o + 2] = v.c;
 }
 
-// acc[i] = scan[i] - (i+1) * (L * inv_N), L = scan[n-1]. inv_N is ext3 (1/N).
+// Forward accumulation (matches build_accumulated_column_from_terms):
+//   acc[i] = scan_exclusive[i] - i * (L * inv_N), L = scan[n-1], inv_N = 1/N.
+// scan is the INCLUSIVE prefix scan, so scan_exclusive[i] = scan[i-1] and
+// acc[0] = 0. This is the exclusive-scan analogue of the old inclusive form.
 extern "C" __global__ void logup_finalize_accum_ext3(
     const uint64_t *__restrict__ scan, uint64_t n, uint64_t inv0, uint64_t inv1,
     uint64_t inv2, uint64_t *__restrict__ acc) {
@@ -203,8 +206,11 @@ extern "C" __global__ void logup_finalize_accum_ext3(
   uint64_t lo = (n - 1) * 3;
   Fe3 L = make(scan[lo], scan[lo + 1], scan[lo + 2]);
   Fe3 offset = mul(L, make(inv0, inv1, inv2));
-  Fe3 s = make(scan[i * 3], scan[i * 3 + 1], scan[i * 3 + 2]);
-  Fe3 a = sub(s, mul_base(offset, i + 1));
+  // Exclusive prefix: row 0 has no predecessor, so acc[0] = 0.
+  Fe3 s = (i == 0) ? zero()
+                   : make(scan[(i - 1) * 3], scan[(i - 1) * 3 + 1],
+                          scan[(i - 1) * 3 + 2]);
+  Fe3 a = sub(s, mul_base(offset, i));
   acc[i * 3] = a.a;
   acc[i * 3 + 1] = a.b;
   acc[i * 3 + 2] = a.c;

crypto/math/src/field/extensions_goldilocks.rs

@@ -555,10 +555,14 @@ impl AsBytes for FieldElement<Degree3GoldilocksExtensionField> {
         self.to_bytes_be()
     }
 
-    // One sink call over a stack buffer instead of three (one per limb): each
-    // sink call lands as its own `Digest::update` on the guest, and dyn dispatch
-    // here is fully devirtualized by the #[inline(always)] chain, so call count
-    // — not indirection — is the cost being cut.
+    // Same 24 bytes as `as_bytes`, staged in a stack buffer so the guest skips
+    // the per-element `Vec`; `#[inline(always)]` is what lets the `dyn` sink
+    // devirtualize at the call site. Emitting them in one call rather than one
+    // per limb keeps it to a single `Digest::update`.
+    //
+    // The layout is load-bearing beyond this crate: `math-cuda`'s
+    // `keccak_leaves_ext3` kernel reads components in order 0,1,2 to match
+    // `write_bytes_be`, and CPU/GPU leaf parity depends on the two agreeing.
     #[inline(always)]
     fn stream_bytes(&self, sink: &mut dyn FnMut(&[u8])) {
         let mut buf = [0u8; 24];

crypto/math/src/traits.rs

@@ -42,6 +42,14 @@ pub trait AsBytes {
 
     /// Streams the byte representation to `sink` without heap-allocating a `Vec`.
     /// Default falls back to `as_bytes`; override for zero-allocation hashing/transcript hot paths.
+    ///
+    /// An override must stream exactly the bytes `as_bytes` would return, in
+    /// order; splitting them across several `sink` calls is fine, but the
+    /// concatenation must be identical. Merkle leaf hashes and the Fiat-Shamir
+    /// transcript take their input through here, so an override that disagrees
+    /// with `as_bytes` silently changes commitments and challenges rather than
+    /// failing to compile. `math/tests/stream_bytes_parity.rs` pins this for the
+    /// Goldilocks fields.
     fn stream_bytes(&self, sink: &mut dyn FnMut(&[u8])) {
         sink(&self.as_bytes());
     }