Accelerated hashing using custom RISC-V instructions

[edubart]

Context

The guest machine performs numerous Keccak-256 operations during advances that generates outputs, which requires computing merkle proofs. Currently, machine-guest-tools uses a native Keccak-256 implementation that runs through emulation, resulting in significantly higher CPU cycle consumption compared to host-side execution.

Possible solutions

Implement a custom RISC-V instruction for Keccak-256 hashing (with potential SHA-256 support in the future) to offload computation to the host.

Technical considerations

• Opcode allocation: Which custom/reserved opcode space can we use without conflicting with future RISC-V specifications?
• Memory handling: How should the instruction handle virtual memory address translation for large data buffers spanning multiple pages that may trigger page faults?
• Instruction granularity: Should this be a single instruction or split into multiple operations (e.g., init/update/finalize)?
• Scope: Should we leverage Solidity-specific hashing functions? Should SHA-256 be included?
• Extensibility: How can we design this to support adding more custom accelerated instructions in the future?
• Metering: So far all instructions RISC-V implemented were lightweight, could such instructions be abused to prolong the validation time of node runners? Should it be privileged or granular? Should we also tackle metering to remediate the problem?
• RISC-V extension: Should we attempt to implement existing RISC-V extensions for SHA-256 and make merkle proofs of outputs always use SHA-256?