Recursive proof isn't correct (yet)

evm/src/all_stark.rs

@@ -139,7 +139,7 @@ mod tests {
     }
 
     #[test]
-    fn test_recursive_all_stark_verifier() -> Result<()> {
+    fn test_all_stark_recursive_verifier() -> Result<()> {
         init_logger();
 
         let config = StarkConfig::standard_fast_config();
@@ -158,12 +158,15 @@ mod tests {
         let circuit_config = CircuitConfig::standard_recursion_config();
         let mut builder = CircuitBuilder::<F, D>::new(circuit_config);
         let mut pw = PartialWitness::new();
-        let degree_bits = inner_proof
+        let degree_bits = inner_proof.degree_bits(inner_config);
-            .stark_proofs
+        let nums_ctl_zs = inner_proof.nums_ctl_zs();
-            .iter()
+        let pt = add_virtual_all_proof(
-            .map(|proof| proof.proof.recover_degree_bits(inner_config))
+            &mut builder,
-            .collect::<Vec<_>>();
+            &inner_all_stark,
-        let pt = add_virtual_all_proof(&mut builder, &inner_all_stark, inner_config, &degree_bits);
+            inner_config,
+            &degree_bits,
+            &nums_ctl_zs,
+        );
         set_all_proof_target(&mut pw, &pt, &inner_proof, builder.zero());
 
         verify_proof_circuit::<F, C, D>(&mut builder, inner_all_stark, pt, inner_config);

evm/src/proof.rs

@@ -22,6 +22,22 @@ pub struct AllProof<F: RichField + Extendable<D>, C: GenericConfig<D, F = F>, co
     pub stark_proofs: Vec<StarkProofWithPublicInputs<F, C, D>>,
 }
 
+impl<F: RichField + Extendable<D>, C: GenericConfig<D, F = F>, const D: usize> AllProof<F, C, D> {
+    pub fn degree_bits(&self, config: &StarkConfig) -> Vec<usize> {
+        self.stark_proofs
+            .iter()
+            .map(|proof| proof.proof.recover_degree_bits(config))
+            .collect()
+    }
+
+    pub fn nums_ctl_zs(&self) -> Vec<usize> {
+        self.stark_proofs
+            .iter()
+            .map(|proof| proof.proof.openings.ctl_zs_last.len())
+            .collect()
+    }
+}
+
 pub(crate) struct AllProofChallenges<F: RichField + Extendable<D>, const D: usize> {
     pub stark_challenges: Vec<StarkProofChallenges<F, D>>,
     pub ctl_challenges: GrandProductChallengeSet<F>,

evm/src/recursive_verifier.rs

@@ -1,5 +1,3 @@
-use std::iter::once;
-
 use itertools::Itertools;
 use plonky2::field::extension_field::Extendable;
 use plonky2::field::field_types::Field;
@@ -235,6 +233,7 @@ pub fn add_virtual_all_proof<F: RichField + Extendable<D>, const D: usize>(
     all_stark: &AllStark<F, D>,
     config: &StarkConfig,
     degree_bits: &[usize],
+    nums_ctl_zs: &[usize],
 ) -> AllProofTarget<D> {
     let stark_proofs = vec![
         {
@@ -243,6 +242,7 @@ pub fn add_virtual_all_proof<F: RichField + Extendable<D>, const D: usize>(
                 all_stark.cpu_stark,
                 config,
                 degree_bits[Table::Cpu as usize],
+                nums_ctl_zs[Table::Cpu as usize],
             );
             let public_inputs = builder.add_virtual_targets(CpuStark::<F, D>::PUBLIC_INPUTS);
             StarkProofWithPublicInputsTarget {
@@ -256,6 +256,7 @@ pub fn add_virtual_all_proof<F: RichField + Extendable<D>, const D: usize>(
                 all_stark.keccak_stark,
                 config,
                 degree_bits[Table::Keccak as usize],
+                nums_ctl_zs[Table::Keccak as usize],
             );
             let public_inputs = builder.add_virtual_targets(KeccakStark::<F, D>::PUBLIC_INPUTS);
             StarkProofWithPublicInputsTarget {
@@ -298,14 +299,11 @@ pub fn add_virtual_stark_proof<F: RichField + Extendable<D>, S: Stark<F, D>, con
     let fri_params = config.fri_params(degree_bits);
     let cap_height = fri_params.config.cap_height;
 
-    let num_leaves_per_oracle = once(S::COLUMNS)
+    let num_leaves_per_oracle = vec![
-        .chain(
+        S::COLUMNS,
-            stark
+        stark.num_permutation_batches(config) + num_ctl_zs,
-                .uses_permutation_args()
+        stark.quotient_degree_factor() * config.num_challenges,
-                .then(|| stark.num_permutation_batches(config)),
+    ];
-        )
-        .chain(once(stark.quotient_degree_factor() * config.num_challenges))
-        .collect_vec();
 
     let permutation_zs_cap = builder.add_virtual_cap(cap_height);
 
@@ -313,7 +311,7 @@ pub fn add_virtual_stark_proof<F: RichField + Extendable<D>, S: Stark<F, D>, con
         trace_cap: builder.add_virtual_cap(cap_height),
         permutation_ctl_zs_cap: permutation_zs_cap,
         quotient_polys_cap: builder.add_virtual_cap(cap_height),
-        openings: add_stark_opening_set::<F, S, D>(builder, stark, config),
+        openings: add_stark_opening_set::<F, S, D>(builder, stark, num_ctl_zs, config),
         opening_proof: builder.add_virtual_fri_proof(&num_leaves_per_oracle, &fri_params),
     }
 }
@@ -329,10 +327,10 @@ fn add_stark_opening_set<F: RichField + Extendable<D>, S: Stark<F, D>, const D:
         local_values: builder.add_virtual_extension_targets(S::COLUMNS),
         next_values: builder.add_virtual_extension_targets(S::COLUMNS),
         permutation_ctl_zs: builder
-            .add_virtual_extension_targets(stark.num_permutation_batches(config)),
+            .add_virtual_extension_targets(stark.num_permutation_batches(config) + num_ctl_zs),
         permutation_ctl_zs_right: builder
-            .add_virtual_extension_targets(stark.num_permutation_batches(config)),
+            .add_virtual_extension_targets(stark.num_permutation_batches(config) + num_ctl_zs),
-        ctl_zs_last: vec![],
+        ctl_zs_last: builder.add_virtual_targets(num_ctl_zs),
         quotient_polys: builder
             .add_virtual_extension_targets(stark.quotient_degree_factor() * num_challenges),
     }

plonky2/src/fri/witness_util.rs

@@ -18,10 +18,6 @@ pub fn set_fri_proof_target<F, W, H, const D: usize>(
 {
     witness.set_target(fri_proof_target.pow_witness, fri_proof.pow_witness);
 
-    dbg!(
-        fri_proof_target.final_poly.0.len(),
-        fri_proof.final_poly.coeffs.len()
-    );
     for (&t, &x) in fri_proof_target
         .final_poly
         .0