feat(prover,executor): BLAKE3 6-round compression accelerator

bin/cli/src/main.rs

@@ -412,7 +412,7 @@ fn cmd_execute(
     // below (the flamegraph path drives execution inside the executor and does
     // not expose per-log data). `None` means "not counted", so the accel lines
     // are omitted rather than printed as misleading zeros.
-    let mut accel_counts: Option<(u64, u64)> = None;
+    let mut accel_counts: Option<(u64, u64, u64)> = None;
 
     let cycle_count = if let Some(ref output_path) = flamegraph.path {
         // Shared execute+flamegraph path (executor::flamegraph) instead of
@@ -479,6 +479,7 @@ fn cmd_execute(
 
         let mut cycle_count: u64 = 0;
         let mut keccak_calls: u64 = 0;
+        let mut blake3_calls: u64 = 0;
         let mut ecsm_calls: u64 = 0;
         // Reused per chunk: `(current_pc, a7)` for logs whose a7 matches an
         // accelerator syscall number. This is a cheap superset — a non-ECALL
@@ -511,6 +512,7 @@ fn cmd_execute(
             for (pc, a7) in accel_candidates.drain(..) {
                 match accelerator_of(executor.instructions.get(pc), a7) {
                     Some(Accelerator::Keccak) => keccak_calls += 1,
+                    Some(Accelerator::Blake3) => blake3_calls += 1,
                     Some(Accelerator::Ecsm) => ecsm_calls += 1,
                     None => {}
                 }
@@ -526,15 +528,16 @@ fn cmd_execute(
         }
 
         if cycles {
-            accel_counts = Some((keccak_calls, ecsm_calls));
+            accel_counts = Some((keccak_calls, blake3_calls, ecsm_calls));
         }
         cycle_count
     };
 
     if cycles {
         println!("Cycles: {}", cycle_count);
-        if let Some((keccak_calls, ecsm_calls)) = accel_counts {
+        if let Some((keccak_calls, blake3_calls, ecsm_calls)) = accel_counts {
             println!("Keccak calls: {}", keccak_calls);
+            println!("Blake3 calls: {}", blake3_calls);
             println!("Ecsm calls: {}", ecsm_calls);
         }
     }

executor/programs/asm/test_blake3.s

@@ -0,0 +1,60 @@
+	.attribute	5, "rv64i2p1_m2p0_zmmul1p0"
+	.globl	main
+main:
+	# 176 bytes on the stack for the BLAKE3 state region (22 x u64):
+	# h[4 dwords] | m[8] | t[1] | block_len,flags[1] | out[8].
+	addi	sp, sp, -176
+
+	# Deterministic non-zero seed over the 14 input dwords: dword[k] = k + 1.
+	# (t therefore = 13, block_len = 14, flags = 0 — arbitrary but fixed.)
+	mv	t0, sp
+	li	t1, 1
+	li	t2, 15
+.Linit_loop:
+	sd	t1, 0(t0)
+	addi	t0, t0, 8
+	addi	t1, t1, 1
+	bne	t1, t2, .Linit_loop
+
+	# First compression.
+	# a0 = pointer to the 176-byte region (8-aligned)
+	# a7 = syscall number (u64::MAX - 2 = -3)
+	mv	a0, sp
+	li	a7, -3
+	ecall
+
+	# Chain: copy out (8 dwords at sp+112) over m (8 dwords at sp+32), so the
+	# second call consumes the first call's output AND its out-region write has
+	# non-zero previous content.
+	li	t1, 0
+.Lcopy_loop:
+	slli	t2, t1, 3
+	addi	t3, sp, 112
+	add	t3, t3, t2
+	ld	t4, 0(t3)
+	addi	t3, sp, 32
+	add	t3, t3, t2
+	sd	t4, 0(t3)
+	addi	t1, t1, 1
+	li	t2, 8
+	bne	t1, t2, .Lcopy_loop
+
+	# Second compression.
+	mv	a0, sp
+	li	a7, -3
+	ecall
+
+	# Commit the final 64-byte output.
+	li	a0, 1
+	addi	a1, sp, 112
+	li	a2, 64
+	li	a7, 64
+	ecall
+
+	# Restore stack and halt.
+	addi	sp, sp, 176
+	li	a0, 0
+	li	a7, 93
+	ecall
+.Lfunc_end0:
+	.size	main, .Lfunc_end0-main