Full FE in memory word (#2472)

This helps making successive Poseidon2GL calls cheaper (e.g. in merkle
tree and sponge).

My plan for follow-up PRs:
- use Poseidon2GL in the bootloader, hopefully making its trace smaller;
- remove all variants of PoseidonGL, as it would have been superseded;
- make another patch to the plonky3 verifier, so it benefits from this
change (instead of suffering a regression).

Author: lvella

pipeline/tests/powdr_std.rs

@@ -92,6 +92,13 @@ fn poseidon2_gl_test() {
     regular_test_gl(f, &[]);
 }
 
+#[test]
+#[ignore = "Too slow"]
+fn split_gl_vec_test() {
+    let f = "std/split_gl_vec_test.asm";
+    regular_test_gl(f, &[]);
+}
+
 #[test]
 #[ignore = "Too slow"]
 fn split_bn254_test() {

plonky3/src/params/poseidon2/goldilocks/powdr_accel_impl.rs

@@ -3,30 +3,32 @@ use p3_field::AbstractField;
 use p3_goldilocks::Goldilocks;
 use p3_symmetric::CryptographicPermutation;
 use powdr_riscv_runtime::{
-    goldilocks::Goldilocks as PowdrGoldilocks,
+    goldilocks::{extract_opaque_vec8, Goldilocks as PowdrGoldilocks, OpaqueGoldilocks},
     hash::{poseidon2_gl, poseidon2_gl_inplace},
 };
 
 #[derive(Clone, Copy, Debug)]
 pub struct Permutation;
 
 impl p3_symmetric::Permutation<[Goldilocks; 8]> for Permutation {
-    // Both Goldilocks and PowdrGoldilocks are repr(transparent), and both use
-    // canonical representation internally, so it is safe to cast between their
-    // array's references.
-    //
-    // TODO: We are relying on implementation detail. So, ideally, we should
-    // static assert that std::mem::transmute(Goldilocks::one()) == 1u64.
-
     fn permute(&self, input: [Goldilocks; 8]) -> [Goldilocks; 8] {
+        // TODO: as of this writing, I am temporarily introducing a performance regression to convert
+        // p3_goldilocks::Goldilocks to and from OpaqueGoldilocks in software. To get an improvement,
+        // we must patch the p3's Merkle Tree implementation to use OpaqueGoldilocks directly and do
+        // the conversion only once, in the output.
+
+        // Both Goldilocks and PowdrGoldilocks are repr(transparent), and both use
+        // canonical representation internally, so it is safe to cast between their
+        // array's pointers.
         let input = unsafe { &*(&input as *const _ as *const [PowdrGoldilocks; 8]) };
-        let output = poseidon2_gl(input);
-        // Let's hope the compiler optimizes this into a no-op.
-        output.map(|x| Goldilocks::from_canonical_u64(u64::from(x)))
+        let input = input.map(|x| OpaqueGoldilocks::from(x));
+        let output = poseidon2_gl(&input);
+
+        extract_opaque_vec8(&output).map(|x| Goldilocks::from_canonical_u64(x))
     }
 
     fn permute_mut(&self, data: &mut [Goldilocks; 8]) {
-        let data = unsafe { &mut *(data as *mut _ as *mut [PowdrGoldilocks; 8]) };
+        let data = unsafe { &mut *(data as *mut _ as *mut [OpaqueGoldilocks; 8]) };
         poseidon2_gl_inplace(data);
     }
 }

powdr/src/lib.rs

@@ -8,6 +8,7 @@ pub use powdr_pilopt as pilopt;
 pub use powdr_pipeline as pipeline;
 pub use powdr_riscv as riscv;
 pub use powdr_riscv_executor as riscv_executor;
+use powdr_riscv_executor::hash_map_to_memory_state;
 
 pub use powdr_pipeline::Pipeline;
 
@@ -314,7 +315,7 @@ fn run_internal(
 
     let trace_len = riscv_executor::execute(
         &asm,
-        initial_memory,
+        hash_map_to_memory_state(initial_memory),
         pipeline.data_callback().unwrap(),
         &riscv::continuations::bootloader::default_input(&[]),
         profiler,