From 932cc812abe37c45a872e1bafc4a2ec662d67d4a Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Tue, 28 Sep 2021 16:57:22 -0700 Subject: [PATCH 1/9] U32ArithmeticGate --- src/gates/arithmetic_u32.rs | 220 ++++++++++++++++++++++++++++++++++++ src/gates/mod.rs | 1 + 2 files changed, 221 insertions(+) create mode 100644 src/gates/arithmetic_u32.rs diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs new file mode 100644 index 00000000..43883b7c --- /dev/null +++ b/src/gates/arithmetic_u32.rs @@ -0,0 +1,220 @@ +use std::marker::PhantomData; + +use crate::field::extension_field::target::ExtensionTarget; +use crate::field::extension_field::Extendable; +use crate::field::field_types::RichField; +use crate::gates::gate::Gate; +use crate::iop::generator::{GeneratedValues, SimpleGenerator, WitnessGenerator}; +use crate::iop::target::Target; +use crate::iop::wire::Wire; +use crate::iop::witness::{PartitionWitness, Witness}; +use crate::plonk::circuit_builder::CircuitBuilder; +use crate::plonk::vars::{EvaluationTargets, EvaluationVars, EvaluationVarsBase}; + +/// Number of arithmetic operations performed by an arithmetic gate. +pub const NUM_U32_ARITHMETIC_OPS: usize = 12; + +/// A gate to perform a basic mul-add on 32-bit values (we assume they are range-checked beforehand). +#[derive(Debug)] +pub struct U32ArithmeticGate; + +impl U32ArithmeticGate { + pub fn wire_ith_multiplicand_0(i: usize) -> usize { + 5 * i + } + pub fn wire_ith_multiplicand_1(i: usize) -> usize { + 5 * i + 1 + } + pub fn wire_ith_addend(i: usize) -> usize { + 5 * i + 2 + } + pub fn wire_ith_output_small_limb(i: usize) -> usize { + 5 * i + 3 + } + pub fn wire_ith_output_large_limb(i: usize) -> usize { + 5 * i + 4 + } +} + +impl, const D: usize> Gate for U32ArithmeticGate { + fn id(&self) -> String { + format!("{:?}", self) + } + + fn eval_unfiltered(&self, vars: EvaluationVars) -> Vec { + let mut constraints = Vec::new(); + for i in 0..NUM_U32_ARITHMETIC_OPS { + let multiplicand_0 = vars.local_wires[Self::wire_ith_multiplicand_0(i)]; + let multiplicand_1 = vars.local_wires[Self::wire_ith_multiplicand_1(i)]; + let addend = vars.local_wires[Self::wire_ith_addend(i)]; + + let computed_output = multiplicand_0 * multiplicand_1 + addend; + + let output_small = vars.local_wires[Self::wire_ith_output_small_limb(i)]; + let output_large = vars.local_wires[Self::wire_ith_output_large_limb(i)]; + + let base: F::Extension = F::from_canonical_u64(1 << 32u64).into(); + let combined_output = output_large * base + output_small; + + constraints.push(combined_output - computed_output); + } + + constraints + } + + fn eval_unfiltered_base(&self, vars: EvaluationVarsBase) -> Vec { + let mut constraints = Vec::new(); + for i in 0..NUM_U32_ARITHMETIC_OPS { + let multiplicand_0 = vars.local_wires[Self::wire_ith_multiplicand_0(i)]; + let multiplicand_1 = vars.local_wires[Self::wire_ith_multiplicand_1(i)]; + let addend = vars.local_wires[Self::wire_ith_addend(i)]; + + let computed_output = multiplicand_0 * multiplicand_1 + addend; + + let output_small = vars.local_wires[Self::wire_ith_output_small_limb(i)]; + let output_large = vars.local_wires[Self::wire_ith_output_large_limb(i)]; + + let base = F::from_canonical_u64(1 << 32u64); + let combined_output = output_large * base + output_small; + + constraints.push(combined_output - computed_output); + } + + constraints + } + + fn eval_unfiltered_recursively( + &self, + builder: &mut CircuitBuilder, + vars: EvaluationTargets, + ) -> Vec> { + let mut constraints = Vec::new(); + + for i in 0..NUM_U32_ARITHMETIC_OPS { + let multiplicand_0 = vars.local_wires[Self::wire_ith_multiplicand_0(i)]; + let multiplicand_1 = vars.local_wires[Self::wire_ith_multiplicand_1(i)]; + let addend = vars.local_wires[Self::wire_ith_addend(i)]; + + let computed_output = builder.mul_add_extension(multiplicand_0, multiplicand_1, addend); + + let output_small = vars.local_wires[Self::wire_ith_output_small_limb(i)]; + let output_large = vars.local_wires[Self::wire_ith_output_large_limb(i)]; + + let base: F::Extension = F::from_canonical_u64(1 << 32u64).into(); + let base_target = builder.constant_extension(base); + let combined_output = + builder.mul_add_extension(output_large, base_target, output_small); + + constraints.push(builder.sub_extension(combined_output, computed_output)); + } + + constraints + } + + fn generators( + &self, + gate_index: usize, + local_constants: &[F], + ) -> Vec>> { + (0..NUM_U32_ARITHMETIC_OPS) + .map(|i| { + let g: Box> = Box::new( + U32ArithmeticGenerator { + gate_index, + i, + _phantom: PhantomData, + } + .adapter(), + ); + g + }) + .collect::>() + } + + fn num_wires(&self) -> usize { + NUM_U32_ARITHMETIC_OPS * 5 + } + + fn num_constants(&self) -> usize { + 0 + } + + fn degree(&self) -> usize { + 2 + } + + fn num_constraints(&self) -> usize { + NUM_U32_ARITHMETIC_OPS + } +} + +#[derive(Clone, Debug)] +struct U32ArithmeticGenerator, const D: usize> { + gate_index: usize, + i: usize, + _phantom: PhantomData, +} + +impl, const D: usize> SimpleGenerator + for U32ArithmeticGenerator +{ + fn dependencies(&self) -> Vec { + let local_target = |input| Target::wire(self.gate_index, input); + + let mut deps = Vec::new(); + deps.push(local_target(U32ArithmeticGate::wire_ith_multiplicand_0( + self.i, + ))); + deps.push(local_target(U32ArithmeticGate::wire_ith_multiplicand_1( + self.i, + ))); + deps.push(local_target(U32ArithmeticGate::wire_ith_addend(self.i))); + deps + } + + fn run_once(&self, witness: &PartitionWitness, out_buffer: &mut GeneratedValues) { + let local_wire = |input| Wire { + gate: self.gate_index, + input, + }; + + let get_local_wire = |input| witness.get_wire(local_wire(input)); + + let multiplicand_0 = get_local_wire(U32ArithmeticGate::wire_ith_multiplicand_0(self.i)); + let multiplicand_1 = get_local_wire(U32ArithmeticGate::wire_ith_multiplicand_1(self.i)); + let addend = get_local_wire(U32ArithmeticGate::wire_ith_addend(self.i)); + + let output = multiplicand_0 * multiplicand_1 + addend; + let output_u64 = output.to_canonical_u64(); + + let output_large_u64 = output_u64 >> 32; + let output_small_u64 = output_u64 & (1 << 32 - 1); + + let output_large = F::from_canonical_u64(output_large_u64); + let output_small = F::from_canonical_u64(output_small_u64); + + let output_large_wire = local_wire(U32ArithmeticGate::wire_ith_output_large_limb(self.i)); + let output_small_wire = local_wire(U32ArithmeticGate::wire_ith_output_small_limb(self.i)); + + out_buffer.set_wire(output_large_wire, output_large); + out_buffer.set_wire(output_small_wire, output_small); + } +} + +#[cfg(test)] +mod tests { + use anyhow::Result; + + use crate::field::crandall_field::CrandallField; + use crate::gates::arithmetic_u32::U32ArithmeticGate; + use crate::gates::gate_testing::{test_eval_fns, test_low_degree}; + + #[test] + fn low_degree() { + test_low_degree::(U32ArithmeticGate) + } + #[test] + fn eval_fns() -> Result<()> { + test_eval_fns::(U32ArithmeticGate) + } +} diff --git a/src/gates/mod.rs b/src/gates/mod.rs index 9f0be32a..a3513361 100644 --- a/src/gates/mod.rs +++ b/src/gates/mod.rs @@ -2,6 +2,7 @@ #![allow(clippy::new_ret_no_self)] pub mod arithmetic; +pub mod arithmetic_u32; pub mod base_sum; pub mod comparison; pub mod constant; From 0811279fb77fd9488b650a6e6bf31746c7f16059 Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Wed, 29 Sep 2021 14:45:14 -0700 Subject: [PATCH 2/9] range check outputs, and addressed comments --- src/gates/arithmetic_u32.rs | 198 ++++++++++++++++++++++++++++-------- 1 file changed, 154 insertions(+), 44 deletions(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index 43883b7c..91ffcad5 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -1,8 +1,11 @@ use std::marker::PhantomData; +use itertools::unfold; + use crate::field::extension_field::target::ExtensionTarget; use crate::field::extension_field::Extendable; -use crate::field::field_types::RichField; +use crate::field::field_types::{Field, RichField}; +use crate::gates::arithmetic::NUM_ARITHMETIC_OPS; use crate::gates::gate::Gate; use crate::iop::generator::{GeneratedValues, SimpleGenerator, WitnessGenerator}; use crate::iop::target::Target; @@ -12,13 +15,15 @@ use crate::plonk::circuit_builder::CircuitBuilder; use crate::plonk::vars::{EvaluationTargets, EvaluationVars, EvaluationVarsBase}; /// Number of arithmetic operations performed by an arithmetic gate. -pub const NUM_U32_ARITHMETIC_OPS: usize = 12; +pub const NUM_U32_ARITHMETIC_OPS: usize = 4; /// A gate to perform a basic mul-add on 32-bit values (we assume they are range-checked beforehand). #[derive(Debug)] -pub struct U32ArithmeticGate; +pub struct U32ArithmeticGate, const D: usize> { + _phantom: PhantomData, +} -impl U32ArithmeticGate { +impl, const D: usize> U32ArithmeticGate { pub fn wire_ith_multiplicand_0(i: usize) -> usize { 5 * i } @@ -28,21 +33,34 @@ impl U32ArithmeticGate { pub fn wire_ith_addend(i: usize) -> usize { 5 * i + 2 } - pub fn wire_ith_output_small_limb(i: usize) -> usize { + + pub fn wire_ith_output_low_half(i: usize) -> usize { 5 * i + 3 } - pub fn wire_ith_output_large_limb(i: usize) -> usize { + pub fn wire_ith_output_high_half(i: usize) -> usize { 5 * i + 4 } + + pub fn limb_bits() -> usize { + 2 + } + pub fn num_limbs() -> usize { + 64 / Self::limb_bits() + } + + pub fn wire_ith_output_jth_limb(i: usize, j: usize) -> usize { + debug_assert!(j < Self::num_limbs()); + 5 * NUM_ARITHMETIC_OPS + Self::num_limbs() * i + j + } } -impl, const D: usize> Gate for U32ArithmeticGate { +impl, const D: usize> Gate for U32ArithmeticGate { fn id(&self) -> String { format!("{:?}", self) } fn eval_unfiltered(&self, vars: EvaluationVars) -> Vec { - let mut constraints = Vec::new(); + let mut constraints = Vec::with_capacity(self.num_constraints()); for i in 0..NUM_U32_ARITHMETIC_OPS { let multiplicand_0 = vars.local_wires[Self::wire_ith_multiplicand_0(i)]; let multiplicand_1 = vars.local_wires[Self::wire_ith_multiplicand_1(i)]; @@ -50,20 +68,37 @@ impl, const D: usize> Gate for U32ArithmeticG let computed_output = multiplicand_0 * multiplicand_1 + addend; - let output_small = vars.local_wires[Self::wire_ith_output_small_limb(i)]; - let output_large = vars.local_wires[Self::wire_ith_output_large_limb(i)]; + let output_low = vars.local_wires[Self::wire_ith_output_low_half(i)]; + let output_high = vars.local_wires[Self::wire_ith_output_high_half(i)]; - let base: F::Extension = F::from_canonical_u64(1 << 32u64).into(); - let combined_output = output_large * base + output_small; + let base = F::Extension::from_canonical_u64(1 << 32u64); + let combined_output = output_high * base + output_low; constraints.push(combined_output - computed_output); + + let mut combined_limbs = F::Extension::ZERO; + for j in 0..Self::num_limbs() { + let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; + let max_limb = 1 << Self::limb_bits(); + let product = (0..max_limb) + .map(|x| this_limb - F::Extension::from_canonical_usize(x)) + .product(); + constraints.push(product); + + let base = F::Extension::from_canonical_u64(1u64 << (j * Self::limb_bits())); + combined_limbs += base * this_limb; + } + + let combined_halves = + output_low + F::Extension::from_canonical_u64(1 << 32u64) * output_high; + constraints.push(combined_limbs - combined_halves); } constraints } fn eval_unfiltered_base(&self, vars: EvaluationVarsBase) -> Vec { - let mut constraints = Vec::new(); + let mut constraints = Vec::with_capacity(self.num_constraints()); for i in 0..NUM_U32_ARITHMETIC_OPS { let multiplicand_0 = vars.local_wires[Self::wire_ith_multiplicand_0(i)]; let multiplicand_1 = vars.local_wires[Self::wire_ith_multiplicand_1(i)]; @@ -71,13 +106,29 @@ impl, const D: usize> Gate for U32ArithmeticG let computed_output = multiplicand_0 * multiplicand_1 + addend; - let output_small = vars.local_wires[Self::wire_ith_output_small_limb(i)]; - let output_large = vars.local_wires[Self::wire_ith_output_large_limb(i)]; + let output_low = vars.local_wires[Self::wire_ith_output_low_half(i)]; + let output_high = vars.local_wires[Self::wire_ith_output_high_half(i)]; let base = F::from_canonical_u64(1 << 32u64); - let combined_output = output_large * base + output_small; + let combined_output = output_high * base + output_low; constraints.push(combined_output - computed_output); + + let mut combined_limbs = F::ZERO; + for j in 0..Self::num_limbs() { + let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; + let max_limb = 1 << Self::limb_bits(); + let product = (0..max_limb) + .map(|x| this_limb - F::from_canonical_usize(x)) + .product(); + constraints.push(product); + + let base = F::from_canonical_u64(1u64 << (j * Self::limb_bits())); + combined_limbs += base * this_limb; + } + + let combined_halves = output_low + F::from_canonical_u64(1 << 32u64) * output_high; + constraints.push(combined_limbs - combined_halves); } constraints @@ -88,7 +139,7 @@ impl, const D: usize> Gate for U32ArithmeticG builder: &mut CircuitBuilder, vars: EvaluationTargets, ) -> Vec> { - let mut constraints = Vec::new(); + let mut constraints = Vec::with_capacity(self.num_constraints()); for i in 0..NUM_U32_ARITHMETIC_OPS { let multiplicand_0 = vars.local_wires[Self::wire_ith_multiplicand_0(i)]; @@ -97,15 +148,39 @@ impl, const D: usize> Gate for U32ArithmeticG let computed_output = builder.mul_add_extension(multiplicand_0, multiplicand_1, addend); - let output_small = vars.local_wires[Self::wire_ith_output_small_limb(i)]; - let output_large = vars.local_wires[Self::wire_ith_output_large_limb(i)]; + let output_low = vars.local_wires[Self::wire_ith_output_low_half(i)]; + let output_high = vars.local_wires[Self::wire_ith_output_high_half(i)]; let base: F::Extension = F::from_canonical_u64(1 << 32u64).into(); let base_target = builder.constant_extension(base); - let combined_output = - builder.mul_add_extension(output_large, base_target, output_small); + let combined_output = builder.mul_add_extension(output_high, base_target, output_low); constraints.push(builder.sub_extension(combined_output, computed_output)); + + let mut combined_limbs = builder.zero_extension(); + for j in 0..Self::num_limbs() { + let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; + let max_limb = 1 << Self::limb_bits(); + + let mut product = builder.one_extension(); + for x in 0..max_limb { + let x_target = + builder.constant_extension(F::Extension::from_canonical_usize(x)); + let diff = builder.sub_extension(this_limb, x_target); + product = builder.mul_extension(product, diff); + } + constraints.push(product); + + let base = builder.constant_extension(F::Extension::from_canonical_u64( + 1u64 << (j * Self::limb_bits()), + )); + combined_limbs = builder.mul_add_extension(base, this_limb, combined_limbs); + } + + let high_base = + builder.constant_extension(F::Extension::from_canonical_u64(1 << 32u64)); + let combined_halves = builder.mul_add_extension(output_high, high_base, output_low); + constraints.push(builder.sub_extension(combined_limbs, combined_halves)); } constraints @@ -132,7 +207,7 @@ impl, const D: usize> Gate for U32ArithmeticG } fn num_wires(&self) -> usize { - NUM_U32_ARITHMETIC_OPS * 5 + NUM_U32_ARITHMETIC_OPS * (5 + Self::num_limbs()) } fn num_constants(&self) -> usize { @@ -140,11 +215,11 @@ impl, const D: usize> Gate for U32ArithmeticG } fn degree(&self) -> usize { - 2 + 1 << Self::limb_bits() } fn num_constraints(&self) -> usize { - NUM_U32_ARITHMETIC_OPS + NUM_U32_ARITHMETIC_OPS * (2 + Self::num_limbs()) } } @@ -161,14 +236,16 @@ impl, const D: usize> SimpleGenerator fn dependencies(&self) -> Vec { let local_target = |input| Target::wire(self.gate_index, input); - let mut deps = Vec::new(); - deps.push(local_target(U32ArithmeticGate::wire_ith_multiplicand_0( + let mut deps = Vec::with_capacity(3); + deps.push(local_target( + U32ArithmeticGate::::wire_ith_multiplicand_0(self.i), + )); + deps.push(local_target( + U32ArithmeticGate::::wire_ith_multiplicand_1(self.i), + )); + deps.push(local_target(U32ArithmeticGate::::wire_ith_addend( self.i, ))); - deps.push(local_target(U32ArithmeticGate::wire_ith_multiplicand_1( - self.i, - ))); - deps.push(local_target(U32ArithmeticGate::wire_ith_addend(self.i))); deps } @@ -180,29 +257,58 @@ impl, const D: usize> SimpleGenerator let get_local_wire = |input| witness.get_wire(local_wire(input)); - let multiplicand_0 = get_local_wire(U32ArithmeticGate::wire_ith_multiplicand_0(self.i)); - let multiplicand_1 = get_local_wire(U32ArithmeticGate::wire_ith_multiplicand_1(self.i)); - let addend = get_local_wire(U32ArithmeticGate::wire_ith_addend(self.i)); + let multiplicand_0 = + get_local_wire(U32ArithmeticGate::::wire_ith_multiplicand_0(self.i)); + let multiplicand_1 = + get_local_wire(U32ArithmeticGate::::wire_ith_multiplicand_1(self.i)); + let addend = get_local_wire(U32ArithmeticGate::::wire_ith_addend(self.i)); let output = multiplicand_0 * multiplicand_1 + addend; - let output_u64 = output.to_canonical_u64(); + let mut output_u64 = output.to_canonical_u64(); - let output_large_u64 = output_u64 >> 32; - let output_small_u64 = output_u64 & (1 << 32 - 1); + let output_high_u64 = output_u64 >> 32; + let output_low_u64 = output_u64 & ((1 << 32) - 1); - let output_large = F::from_canonical_u64(output_large_u64); - let output_small = F::from_canonical_u64(output_small_u64); + let output_high = F::from_canonical_u64(output_high_u64); + let output_low = F::from_canonical_u64(output_low_u64); - let output_large_wire = local_wire(U32ArithmeticGate::wire_ith_output_large_limb(self.i)); - let output_small_wire = local_wire(U32ArithmeticGate::wire_ith_output_small_limb(self.i)); + let output_high_wire = + local_wire(U32ArithmeticGate::::wire_ith_output_high_half(self.i)); + let output_low_wire = + local_wire(U32ArithmeticGate::::wire_ith_output_low_half(self.i)); - out_buffer.set_wire(output_large_wire, output_large); - out_buffer.set_wire(output_small_wire, output_small); + out_buffer.set_wire(output_high_wire, output_high); + out_buffer.set_wire(output_low_wire, output_low); + + let limb_base = 1 << U32ArithmeticGate::::limb_bits(); + let output_limbs_u64: Vec<_> = unfold((), move |_| { + if output_u64 == 0 { + return None; + } + let ret = output_u64 % limb_base; + output_u64 /= limb_base; + Some(ret) + }) + .collect(); + let output_limbs_F: Vec<_> = output_limbs_u64 + .iter() + .cloned() + .map(F::from_canonical_u64) + .collect(); + + for j in 0..U32ArithmeticGate::::num_limbs() { + let wire = local_wire(U32ArithmeticGate::::wire_ith_output_jth_limb( + self.i, j, + )); + out_buffer.set_wire(wire, output_limbs_F[j]); + } } } #[cfg(test)] mod tests { + use std::marker::PhantomData; + use anyhow::Result; use crate::field::crandall_field::CrandallField; @@ -211,10 +317,14 @@ mod tests { #[test] fn low_degree() { - test_low_degree::(U32ArithmeticGate) + test_low_degree::(U32ArithmeticGate:: { + _phantom: PhantomData, + }) } #[test] fn eval_fns() -> Result<()> { - test_eval_fns::(U32ArithmeticGate) + test_eval_fns::(U32ArithmeticGate:: { + _phantom: PhantomData, + }) } } From 455bc4d553f420b806731d532edb74598b4b0665 Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Wed, 29 Sep 2021 15:35:15 -0700 Subject: [PATCH 3/9] only 3 copies :( --- src/gates/arithmetic_u32.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index 91ffcad5..6747ad57 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -15,7 +15,7 @@ use crate::plonk::circuit_builder::CircuitBuilder; use crate::plonk::vars::{EvaluationTargets, EvaluationVars, EvaluationVarsBase}; /// Number of arithmetic operations performed by an arithmetic gate. -pub const NUM_U32_ARITHMETIC_OPS: usize = 4; +pub const NUM_U32_ARITHMETIC_OPS: usize = 3; /// A gate to perform a basic mul-add on 32-bit values (we assume they are range-checked beforehand). #[derive(Debug)] From 862eee8e70e008fdeaf6fc0efd617702833c759b Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Wed, 29 Sep 2021 16:33:34 -0700 Subject: [PATCH 4/9] fix --- src/gates/arithmetic_u32.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index 6747ad57..baa52497 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -5,7 +5,6 @@ use itertools::unfold; use crate::field::extension_field::target::ExtensionTarget; use crate::field::extension_field::Extendable; use crate::field::field_types::{Field, RichField}; -use crate::gates::arithmetic::NUM_ARITHMETIC_OPS; use crate::gates::gate::Gate; use crate::iop::generator::{GeneratedValues, SimpleGenerator, WitnessGenerator}; use crate::iop::target::Target; @@ -25,19 +24,24 @@ pub struct U32ArithmeticGate, const D: usize> { impl, const D: usize> U32ArithmeticGate { pub fn wire_ith_multiplicand_0(i: usize) -> usize { + debug_assert!(i < NUM_U32_ARITHMETIC_OPS); 5 * i } pub fn wire_ith_multiplicand_1(i: usize) -> usize { + debug_assert!(i < NUM_U32_ARITHMETIC_OPS); 5 * i + 1 } pub fn wire_ith_addend(i: usize) -> usize { + debug_assert!(i < NUM_U32_ARITHMETIC_OPS); 5 * i + 2 } pub fn wire_ith_output_low_half(i: usize) -> usize { + debug_assert!(i < NUM_U32_ARITHMETIC_OPS); 5 * i + 3 } pub fn wire_ith_output_high_half(i: usize) -> usize { + debug_assert!(i < NUM_U32_ARITHMETIC_OPS); 5 * i + 4 } @@ -49,8 +53,9 @@ impl, const D: usize> U32ArithmeticGate { } pub fn wire_ith_output_jth_limb(i: usize, j: usize) -> usize { + debug_assert!(i < NUM_U32_ARITHMETIC_OPS); debug_assert!(j < Self::num_limbs()); - 5 * NUM_ARITHMETIC_OPS + Self::num_limbs() * i + j + 5 * NUM_U32_ARITHMETIC_OPS + Self::num_limbs() * i + j } } From 3d207464f5a721c6dab5628e464d98b04d5b1546 Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Wed, 29 Sep 2021 20:04:42 -0700 Subject: [PATCH 5/9] combine halves separately --- src/gates/arithmetic_u32.rs | 68 ++++++++++++++++++++++++------------- 1 file changed, 45 insertions(+), 23 deletions(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index baa52497..557a8500 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -81,7 +81,9 @@ impl, const D: usize> Gate for U32ArithmeticG constraints.push(combined_output - computed_output); - let mut combined_limbs = F::Extension::ZERO; + let mut combined_low_limbs = F::Extension::ZERO; + let mut combined_high_limbs = F::Extension::ZERO; + let midpoint = Self::num_limbs() / 2; for j in 0..Self::num_limbs() { let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; let max_limb = 1 << Self::limb_bits(); @@ -90,13 +92,18 @@ impl, const D: usize> Gate for U32ArithmeticG .product(); constraints.push(product); - let base = F::Extension::from_canonical_u64(1u64 << (j * Self::limb_bits())); - combined_limbs += base * this_limb; + if j < midpoint { + let base = F::Extension::from_canonical_u64(1u64 << (j * Self::limb_bits())); + combined_low_limbs += base * this_limb; + } else { + let base = F::Extension::from_canonical_u64( + 1u64 << ((j - midpoint) * Self::limb_bits()), + ); + combined_high_limbs += base * this_limb; + } } - - let combined_halves = - output_low + F::Extension::from_canonical_u64(1 << 32u64) * output_high; - constraints.push(combined_limbs - combined_halves); + constraints.push(combined_low_limbs - output_low); + constraints.push(combined_high_limbs - output_high); } constraints @@ -119,7 +126,9 @@ impl, const D: usize> Gate for U32ArithmeticG constraints.push(combined_output - computed_output); - let mut combined_limbs = F::ZERO; + let mut combined_low_limbs = F::ZERO; + let mut combined_high_limbs = F::ZERO; + let midpoint = Self::num_limbs() / 2; for j in 0..Self::num_limbs() { let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; let max_limb = 1 << Self::limb_bits(); @@ -128,12 +137,16 @@ impl, const D: usize> Gate for U32ArithmeticG .product(); constraints.push(product); - let base = F::from_canonical_u64(1u64 << (j * Self::limb_bits())); - combined_limbs += base * this_limb; + if j < midpoint { + let base = F::from_canonical_u64(1u64 << (j * Self::limb_bits())); + combined_low_limbs += base * this_limb; + } else { + let base = F::from_canonical_u64(1u64 << ((j - midpoint) * Self::limb_bits())); + combined_high_limbs += base * this_limb; + } } - - let combined_halves = output_low + F::from_canonical_u64(1 << 32u64) * output_high; - constraints.push(combined_limbs - combined_halves); + constraints.push(combined_low_limbs - output_low); + constraints.push(combined_high_limbs - output_high); } constraints @@ -162,7 +175,9 @@ impl, const D: usize> Gate for U32ArithmeticG constraints.push(builder.sub_extension(combined_output, computed_output)); - let mut combined_limbs = builder.zero_extension(); + let mut combined_low_limbs = builder.zero_extension(); + let mut combined_high_limbs = builder.zero_extension(); + let midpoint = Self::num_limbs() / 2; for j in 0..Self::num_limbs() { let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; let max_limb = 1 << Self::limb_bits(); @@ -176,16 +191,23 @@ impl, const D: usize> Gate for U32ArithmeticG } constraints.push(product); - let base = builder.constant_extension(F::Extension::from_canonical_u64( - 1u64 << (j * Self::limb_bits()), - )); - combined_limbs = builder.mul_add_extension(base, this_limb, combined_limbs); + if j < midpoint { + let base = builder.constant_extension(F::Extension::from_canonical_u64( + 1u64 << (j * Self::limb_bits()), + )); + combined_low_limbs = + builder.mul_add_extension(base, this_limb, combined_low_limbs); + } else { + let base = builder.constant_extension(F::Extension::from_canonical_u64( + 1u64 << ((j - midpoint) * Self::limb_bits()), + )); + combined_high_limbs = + builder.mul_add_extension(base, this_limb, combined_high_limbs); + } } - let high_base = - builder.constant_extension(F::Extension::from_canonical_u64(1 << 32u64)); - let combined_halves = builder.mul_add_extension(output_high, high_base, output_low); - constraints.push(builder.sub_extension(combined_limbs, combined_halves)); + constraints.push(builder.sub_extension(combined_low_limbs, output_low)); + constraints.push(builder.sub_extension(combined_high_limbs, output_high)); } constraints @@ -224,7 +246,7 @@ impl, const D: usize> Gate for U32ArithmeticG } fn num_constraints(&self) -> usize { - NUM_U32_ARITHMETIC_OPS * (2 + Self::num_limbs()) + NUM_U32_ARITHMETIC_OPS * (3 + Self::num_limbs()) } } From 6e21528ad0bae799ede5c8d9447e656e67b80eb2 Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Thu, 30 Sep 2021 10:13:28 -0700 Subject: [PATCH 6/9] constraints test, and fixes --- src/gates/arithmetic_u32.rs | 73 ++++++++++++++++++++++++++++++++++++- 1 file changed, 71 insertions(+), 2 deletions(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index 557a8500..a10d6e22 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -323,7 +323,7 @@ impl, const D: usize> SimpleGenerator .map(F::from_canonical_u64) .collect(); - for j in 0..U32ArithmeticGate::::num_limbs() { + for j in 0..output_limbs_F.len() { let wire = local_wire(U32ArithmeticGate::::wire_ith_output_jth_limb( self.i, j, )); @@ -337,10 +337,17 @@ mod tests { use std::marker::PhantomData; use anyhow::Result; + use itertools::{izip, unfold}; + use rand::Rng; use crate::field::crandall_field::CrandallField; - use crate::gates::arithmetic_u32::U32ArithmeticGate; + use crate::field::extension_field::quartic::QuarticExtension; + use crate::field::field_types::Field; + use crate::gates::arithmetic_u32::{NUM_U32_ARITHMETIC_OPS, U32ArithmeticGate}; + use crate::gates::gate::Gate; use crate::gates::gate_testing::{test_eval_fns, test_low_degree}; + use crate::hash::hash_types::HashOut; + use crate::plonk::vars::EvaluationVars; #[test] fn low_degree() { @@ -348,10 +355,72 @@ mod tests { _phantom: PhantomData, }) } + #[test] fn eval_fns() -> Result<()> { test_eval_fns::(U32ArithmeticGate:: { _phantom: PhantomData, }) } + + #[test] + fn test_gate_constraint() { + type F = CrandallField; + type FF = QuarticExtension; + const D: usize = 4; + + fn get_wires(multiplicands_0: Vec, multiplicands_1: Vec, addends: Vec) -> Vec { + let mut v0 = Vec::new(); + let mut v1 = Vec::new(); + + let limb_bits = U32ArithmeticGate::::limb_bits(); + let num_limbs = U32ArithmeticGate::::num_limbs(); + let limb_base = 1 << limb_bits; + for c in 0..NUM_U32_ARITHMETIC_OPS { + let m0 = multiplicands_0[c]; + let m1 = multiplicands_1[c]; + let a = addends[c]; + + let mut output = m0 * m1 + a; + let output_low = output & ((1 << 32) - 1); + let output_high = output >> 32; + + let mut output_limbs = Vec::with_capacity(num_limbs); + for i in 0..num_limbs { + output_limbs.push(output % limb_base); + output /= limb_base; + } + let mut output_limbs_F: Vec<_> = output_limbs.iter().cloned().map(F::from_canonical_u64).collect(); + + v0.push(F::from_canonical_u64(m0)); + v0.push(F::from_canonical_u64(m1)); + v0.push(F::from_canonical_u64(a)); + v0.push(F::from_canonical_u64(output_low)); + v0.push(F::from_canonical_u64(output_high)); + v1.append(&mut output_limbs_F); + } + + v0.iter().chain(v1.iter()).map(|&x| x.into()).collect::>() + } + + let mut rng = rand::thread_rng(); + let multiplicands_0: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS).map(|_| rng.gen::() as u64).collect(); + let multiplicands_1: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS).map(|_| rng.gen::() as u64).collect(); + let addends: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS).map(|_| rng.gen::() as u64).collect(); + + let gate = U32ArithmeticGate:: { + _phantom: PhantomData, + }; + + let vars = EvaluationVars { + local_constants: &[], + local_wires: &get_wires(multiplicands_0, multiplicands_1, addends), + public_inputs_hash: &HashOut::rand(), + }; + + assert!( + gate.eval_unfiltered(vars).iter().all(|x| x.is_zero()), + "Gate constraints are not satisfied." + ); + } } From ffd069c6ce2147f27b20f30e2ff159e02783eb4c Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Thu, 30 Sep 2021 10:13:33 -0700 Subject: [PATCH 7/9] fmt --- src/gates/arithmetic_u32.rs | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index a10d6e22..69039fba 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -343,7 +343,7 @@ mod tests { use crate::field::crandall_field::CrandallField; use crate::field::extension_field::quartic::QuarticExtension; use crate::field::field_types::Field; - use crate::gates::arithmetic_u32::{NUM_U32_ARITHMETIC_OPS, U32ArithmeticGate}; + use crate::gates::arithmetic_u32::{U32ArithmeticGate, NUM_U32_ARITHMETIC_OPS}; use crate::gates::gate::Gate; use crate::gates::gate_testing::{test_eval_fns, test_low_degree}; use crate::hash::hash_types::HashOut; @@ -369,7 +369,11 @@ mod tests { type FF = QuarticExtension; const D: usize = 4; - fn get_wires(multiplicands_0: Vec, multiplicands_1: Vec, addends: Vec) -> Vec { + fn get_wires( + multiplicands_0: Vec, + multiplicands_1: Vec, + addends: Vec, + ) -> Vec { let mut v0 = Vec::new(); let mut v1 = Vec::new(); @@ -390,7 +394,11 @@ mod tests { output_limbs.push(output % limb_base); output /= limb_base; } - let mut output_limbs_F: Vec<_> = output_limbs.iter().cloned().map(F::from_canonical_u64).collect(); + let mut output_limbs_F: Vec<_> = output_limbs + .iter() + .cloned() + .map(F::from_canonical_u64) + .collect(); v0.push(F::from_canonical_u64(m0)); v0.push(F::from_canonical_u64(m1)); @@ -400,13 +408,22 @@ mod tests { v1.append(&mut output_limbs_F); } - v0.iter().chain(v1.iter()).map(|&x| x.into()).collect::>() + v0.iter() + .chain(v1.iter()) + .map(|&x| x.into()) + .collect::>() } let mut rng = rand::thread_rng(); - let multiplicands_0: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS).map(|_| rng.gen::() as u64).collect(); - let multiplicands_1: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS).map(|_| rng.gen::() as u64).collect(); - let addends: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS).map(|_| rng.gen::() as u64).collect(); + let multiplicands_0: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS) + .map(|_| rng.gen::() as u64) + .collect(); + let multiplicands_1: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS) + .map(|_| rng.gen::() as u64) + .collect(); + let addends: Vec<_> = (0..NUM_U32_ARITHMETIC_OPS) + .map(|_| rng.gen::() as u64) + .collect(); let gate = U32ArithmeticGate:: { _phantom: PhantomData, From 1af224d895b894ad03d528065865867c71ad3209 Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Thu, 30 Sep 2021 10:17:51 -0700 Subject: [PATCH 8/9] Horner's method --- src/gates/arithmetic_u32.rs | 34 +++++++++++++--------------------- 1 file changed, 13 insertions(+), 21 deletions(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index 69039fba..dddc35b2 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -84,7 +84,8 @@ impl, const D: usize> Gate for U32ArithmeticG let mut combined_low_limbs = F::Extension::ZERO; let mut combined_high_limbs = F::Extension::ZERO; let midpoint = Self::num_limbs() / 2; - for j in 0..Self::num_limbs() { + let base = F::Extension::from_canonical_u64(1u64 << Self::limb_bits()); + for j in (0..Self::num_limbs()).rev() { let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; let max_limb = 1 << Self::limb_bits(); let product = (0..max_limb) @@ -93,13 +94,9 @@ impl, const D: usize> Gate for U32ArithmeticG constraints.push(product); if j < midpoint { - let base = F::Extension::from_canonical_u64(1u64 << (j * Self::limb_bits())); - combined_low_limbs += base * this_limb; + combined_low_limbs = base * combined_low_limbs + this_limb; } else { - let base = F::Extension::from_canonical_u64( - 1u64 << ((j - midpoint) * Self::limb_bits()), - ); - combined_high_limbs += base * this_limb; + combined_high_limbs = base * combined_high_limbs + this_limb; } } constraints.push(combined_low_limbs - output_low); @@ -129,7 +126,8 @@ impl, const D: usize> Gate for U32ArithmeticG let mut combined_low_limbs = F::ZERO; let mut combined_high_limbs = F::ZERO; let midpoint = Self::num_limbs() / 2; - for j in 0..Self::num_limbs() { + let base = F::from_canonical_u64(1u64 << Self::limb_bits()); + for j in (0..Self::num_limbs()).rev() { let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; let max_limb = 1 << Self::limb_bits(); let product = (0..max_limb) @@ -138,11 +136,9 @@ impl, const D: usize> Gate for U32ArithmeticG constraints.push(product); if j < midpoint { - let base = F::from_canonical_u64(1u64 << (j * Self::limb_bits())); - combined_low_limbs += base * this_limb; + combined_low_limbs = base * combined_low_limbs + this_limb; } else { - let base = F::from_canonical_u64(1u64 << ((j - midpoint) * Self::limb_bits())); - combined_high_limbs += base * this_limb; + combined_high_limbs = base * combined_high_limbs + this_limb; } } constraints.push(combined_low_limbs - output_low); @@ -178,7 +174,9 @@ impl, const D: usize> Gate for U32ArithmeticG let mut combined_low_limbs = builder.zero_extension(); let mut combined_high_limbs = builder.zero_extension(); let midpoint = Self::num_limbs() / 2; - for j in 0..Self::num_limbs() { + let base = builder + .constant_extension(F::Extension::from_canonical_u64(1u64 << Self::limb_bits())); + for j in (0..Self::num_limbs()).rev() { let this_limb = vars.local_wires[Self::wire_ith_output_jth_limb(i, j)]; let max_limb = 1 << Self::limb_bits(); @@ -192,17 +190,11 @@ impl, const D: usize> Gate for U32ArithmeticG constraints.push(product); if j < midpoint { - let base = builder.constant_extension(F::Extension::from_canonical_u64( - 1u64 << (j * Self::limb_bits()), - )); combined_low_limbs = - builder.mul_add_extension(base, this_limb, combined_low_limbs); + builder.mul_add_extension(base, combined_low_limbs, this_limb); } else { - let base = builder.constant_extension(F::Extension::from_canonical_u64( - 1u64 << ((j - midpoint) * Self::limb_bits()), - )); combined_high_limbs = - builder.mul_add_extension(base, this_limb, combined_high_limbs); + builder.mul_add_extension(base, combined_high_limbs, this_limb); } } From 094f29a1a7c00f97038cf80ceddaa92e6f96ae78 Mon Sep 17 00:00:00 2001 From: Nicholas Ward Date: Thu, 30 Sep 2021 14:37:23 -0700 Subject: [PATCH 9/9] set 0 limb targets --- src/gates/arithmetic_u32.rs | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index dddc35b2..7732364e 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -299,15 +299,14 @@ impl, const D: usize> SimpleGenerator out_buffer.set_wire(output_high_wire, output_high); out_buffer.set_wire(output_low_wire, output_low); + let num_limbs = U32ArithmeticGate::::num_limbs(); let limb_base = 1 << U32ArithmeticGate::::limb_bits(); let output_limbs_u64: Vec<_> = unfold((), move |_| { - if output_u64 == 0 { - return None; - } let ret = output_u64 % limb_base; output_u64 /= limb_base; Some(ret) }) + .take(num_limbs) .collect(); let output_limbs_F: Vec<_> = output_limbs_u64 .iter() @@ -315,7 +314,7 @@ impl, const D: usize> SimpleGenerator .map(F::from_canonical_u64) .collect(); - for j in 0..output_limbs_F.len() { + for j in 0..num_limbs { let wire = local_wire(U32ArithmeticGate::::wire_ith_output_jth_limb( self.i, j, ));