Working secp add

evm/src/cpu/kernel/aggregator.rs

@@ -22,9 +22,9 @@ pub(crate) fn combined_kernel() -> Kernel {
         include_str!("asm/curve_mul.asm"),
         include_str!("asm/curve_add.asm"),
         include_str!("asm/moddiv.asm"),
-        // include_str!("asm/secp256k1/curve_mul.asm"),
+        include_str!("asm/secp256k1/curve_mul.asm"),
-        // include_str!("asm/secp256k1/curve_add.asm"),
+        include_str!("asm/secp256k1/curve_add.asm"),
-        // include_str!("asm/secp256k1/moddiv.asm"),
+        include_str!("asm/secp256k1/moddiv.asm"),
         include_str!("asm/ecrecover.asm"),
         include_str!("asm/storage_read.asm"),
         include_str!("asm/storage_write.asm"),

evm/src/cpu/kernel/asm/secp256k1/curve_add.asm

@@ -71,13 +71,13 @@ global ec_add_valid_points_secp:
     // stack: y1, x0, y0, x1, y1, retdest
     DUP3
     // stack: y0, y1, x0, y0, x1, y1, retdest
-    %submod
+    %submod_secp
     // stack: y0 - y1, x0, y0, x1, y1, retdest
     DUP4
     // stack: x1, y0 - y1, x0, y0, x1, y1, retdest
     DUP3
     // stack: x0, x1, y0 - y1, x0, y0, x1, y1, retdest
-    %submod
+    %submod_secp
     // stack: x0 - x1, y0 - y1, x0, y0, x1, y1, retdest
     %moddiv_secp
     // stack: lambda, x0, y0, x1, y1, retdest
@@ -138,9 +138,9 @@ ec_add_valid_points_with_lambda:
     // stack: lambda, lambda, N, x1, x0, lambda, x0, y0, x1, y1, retdest
     MULMOD
     // stack: lambda^2, x1, x0, lambda, x0, y0, x1, y1, retdest
-    %submod
+    %submod_secp
     // stack: lambda^2 - x1, x0, lambda, x0, y0, x1, y1, retdest
-    %submod
+    %submod_secp
     // stack: x2, lambda, x0, y0, x1, y1, retdest
 
     // Compute y2 = lambda*(x1 - x2) - y1
@@ -150,7 +150,7 @@ ec_add_valid_points_with_lambda:
     // stack: x2, N, x2, lambda, x0, y0, x1, y1, retdest
     DUP7
     // stack: x1, x2, N, x2, lambda, x0, y0, x1, y1, retdest
-    %submod
+    %submod_secp
     // stack: x1 - x2, N, x2, lambda, x0, y0, x1, y1, retdest
     DUP4
     // stack: lambda, x1 - x2, N, x2, lambda, x0, y0, x1, y1, retdest
@@ -160,7 +160,7 @@ ec_add_valid_points_with_lambda:
     // stack: y1, lambda * (x1 - x2), x2, lambda, x0, y0, x1, y1, retdest
     SWAP1
     // stack: lambda * (x1 - x2), y1, x2, lambda, x0, y0, x1, y1, retdest
-    %submod
+    %submod_secp
     // stack: y2, x2, lambda, x0, y0, x1, y1, retdest
 
     // Return x2,y2
@@ -246,7 +246,7 @@ global ec_double_secp:
 
 // Push the order of the Secp256k1 scalar field.
 %macro secp_base
-    PUSH 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
+    PUSH 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
 %endmacro
 
 // Assumption: x, y < N and 2N < 2^256.
@@ -311,30 +311,30 @@ global ec_double_secp:
     // stack: x^2 % N, x, N, N, x, y, b
     MULMOD
     // stack: x^3 % N, N, x, y, b
-    PUSH 3
+    PUSH 7
-    // stack: 3, x^3 % N, N, x, y, b
+    // stack: 7, x^3 % N, N, x, y, b
     ADDMOD
-    // stack: (x^3 + 3) % N, x, y, b
+    // stack: (x^3 + 7) % N, x, y, b
     DUP3
-    // stack: y, (x^3 + 3) % N, x, y, b
+    // stack: y, (x^3 + 7) % N, x, y, b
     %secp_base
-    // stack: N, y, (x^3 + 3) % N, x, y, b
+    // stack: N, y, (x^3 + 7) % N, x, y, b
     SWAP1
-    // stack: y, N, (x^3 + 3) % N, x, y, b
+    // stack: y, N, (x^3 + 7) % N, x, y, b
     DUP1
-    // stack: y, y, N, (x^3 + 3) % N, x, y, b
+    // stack: y, y, N, (x^3 + 7) % N, x, y, b
     MULMOD
-    // stack: y^2 % N, (x^3 + 3) % N, x, y, b
+    // stack: y^2 % N, (x^3 + 7) % N, x, y, b
     EQ
-    // stack: y^2 % N == (x^3 + 3) % N, x, y, b
+    // stack: y^2 % N == (x^3 + 7) % N, x, y, b
     SWAP2
-    // stack: y, x, y^2 % N == (x^3 + 3) % N, b
+    // stack: y, x, y^2 % N == (x^3 + 7) % N, b
     %ec_isidentity
-    // stack: (x,y)==(0,0), y^2 % N == (x^3 + 3) % N, b
+    // stack: (x,y)==(0,0), y^2 % N == (x^3 + 7) % N, b
     SWAP2
-    // stack: b, y^2 % N == (x^3 + 3) % N, (x,y)==(0,0)
+    // stack: b, y^2 % N == (x^3 + 7) % N, (x,y)==(0,0)
     AND
-    // stack: y^2 % N == (x^3 + 3) % N & (x < N) & (y < N), (x,y)==(0,0)
+    // stack: y^2 % N == (x^3 + 7) % N & (x < N) & (y < N), (x,y)==(0,0)
     OR
-    // stack: y^2 % N == (x^3 + 3) % N & (x < N) & (y < N) || (x,y)==(0,0)
+    // stack: y^2 % N == (x^3 + 7) % N & (x < N) & (y < N) || (x,y)==(0,0)
 %endmacro

evm/src/cpu/kernel/assembler.rs

@@ -67,7 +67,8 @@ fn find_macros(files: &[File]) -> HashMap<String, Macro> {
                     params: params.clone(),
                     items: items.clone(),
                 };
-                macros.insert(name.clone(), _macro);
+                let old = macros.insert(name.clone(), _macro);
+                assert!(old.is_none(), "Duplicate macro: {name}");
             }
         }
     }

evm/src/cpu/kernel/tests/curve_ops.rs

@@ -132,3 +132,138 @@ mod bn {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod secp {
+    use anyhow::Result;
+    use ethereum_types::U256;
+
+    use crate::cpu::kernel::aggregator::combined_kernel;
+    use crate::cpu::kernel::interpreter::run;
+    use crate::cpu::kernel::tests::u256ify;
+
+    #[test]
+    fn test_ec_ops() -> Result<()> {
+        // Make sure we can parse and assemble the entire kernel.
+        let kernel = combined_kernel();
+        let ec_add = kernel.global_labels["ec_add_secp"];
+        let ec_double = kernel.global_labels["ec_double_secp"];
+        let ec_mul = kernel.global_labels["ec_mul"];
+        let identity = ("0x0", "0x0");
+        let invalid = ("0x0", "0x3"); // Not on curve
+        let point0 = (
+            "0xc82ccceebd739e646631b7270ed8c33e96c4940b19db91eaf67da6ec92d109b",
+            "0xe0d241d2de832656c3eed78271bb06b5602d6473742c7c48a38b9f0350a76164",
+        );
+        let point1 = (
+            "0xbf26b1a7a46025d0a1787aa050d0bb83b8a4746010f873404389b8b23360919c",
+            "0x65adeff3fed1b22fa10279b5a25b96694a20bcbf6b718c0412f6d34a2e9bb924",
+        );
+        // point2 = point0 + point1
+        let point2 = (
+            "0x191e8183402c6d6f5f22a9fe2a5ce17a7dd5184bd5d359c77189e9f714a18225",
+            "0xe23fbb6913de7449d92e4dfbe278e2874fac80d53bfeb8fb3400462b7bfaec74",
+        );
+        // point3 = 2 * point0
+        let point3 = (
+            "0x7872498939b02197c2b6f0a0f5767f36551e43f910de472fbbff0538b21f5f45",
+            "0x294e15025d935438023a0e4056892abd6405fade13cf2b3131d8755be7cebad",
+        );
+        let s = "0xa72ad7d8ce24135b5138f853d7a9896381c40523b5d1cf03072151f2af10e35e";
+        // point4 = s * point0
+        let point4 = (
+            "0xd8bec38864f0fe56d429540e6de624afb8ddc7fba1f738337913922a30b96c14",
+            "0x5b086b2720ac39d173777bc36a49629c80c3a3e55e1c50527e60016d9be71318",
+        );
+
+        // Standard addition #1
+        let initial_stack = u256ify(["0xdeadbeef", point0.1, point0.0, point1.1, point1.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, u256ify([point2.1, point2.0])?);
+        // Standard addition #2
+        let initial_stack = u256ify(["0xdeadbeef", point1.1, point1.0, point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, u256ify([point2.1, point2.0])?);
+
+        // Standard doubling #1
+        let initial_stack = u256ify(["0xdeadbeef", point0.1, point0.0, point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, u256ify([point3.1, point3.0])?);
+        // Standard doubling #2
+        let initial_stack = u256ify(["0xdeadbeef", point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_double, initial_stack);
+        assert_eq!(stack, u256ify([point3.1, point3.0])?);
+        // Standard doubling #3
+        let initial_stack = u256ify(["0xdeadbeef", "0x2", point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_mul, initial_stack);
+        assert_eq!(stack, u256ify([point3.1, point3.0])?);
+
+        // Addition with identity #1
+        let initial_stack = u256ify(["0xdeadbeef", identity.1, identity.0, point1.1, point1.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, u256ify([point1.1, point1.0])?);
+        // Addition with identity #2
+        let initial_stack = u256ify(["0xdeadbeef", point1.1, point1.0, identity.1, identity.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, u256ify([point1.1, point1.0])?);
+        // Addition with identity #3
+        let initial_stack =
+            u256ify(["0xdeadbeef", identity.1, identity.0, identity.1, identity.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, u256ify([identity.1, identity.0])?);
+
+        // Addition with invalid point(s) #1
+        let initial_stack = u256ify(["0xdeadbeef", point0.1, point0.0, invalid.1, invalid.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, vec![U256::MAX, U256::MAX]);
+        // Addition with invalid point(s) #2
+        let initial_stack = u256ify(["0xdeadbeef", invalid.1, invalid.0, point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, vec![U256::MAX, U256::MAX]);
+        // Addition with invalid point(s) #3
+        let initial_stack = u256ify(["0xdeadbeef", invalid.1, invalid.0, identity.1, identity.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, vec![U256::MAX, U256::MAX]);
+        // Addition with invalid point(s) #4
+        let initial_stack = u256ify(["0xdeadbeef", invalid.1, invalid.0, invalid.1, invalid.0])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, vec![U256::MAX, U256::MAX]);
+
+        // Scalar multiplication #1
+        let initial_stack = u256ify(["0xdeadbeef", s, point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_mul, initial_stack);
+        assert_eq!(stack, u256ify([point4.1, point4.0])?);
+        // Scalar multiplication #2
+        let initial_stack = u256ify(["0xdeadbeef", "0x0", point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_mul, initial_stack);
+        assert_eq!(stack, u256ify([identity.1, identity.0])?);
+        // Scalar multiplication #3
+        let initial_stack = u256ify(["0xdeadbeef", "0x1", point0.1, point0.0])?;
+        let stack = run(&kernel.code, ec_mul, initial_stack);
+        assert_eq!(stack, u256ify([point0.1, point0.0])?);
+        // Scalar multiplication #4
+        let initial_stack = u256ify(["0xdeadbeef", s, identity.1, identity.0])?;
+        let stack = run(&kernel.code, ec_mul, initial_stack);
+        assert_eq!(stack, u256ify([identity.1, identity.0])?);
+        // Scalar multiplication #5
+        let initial_stack = u256ify(["0xdeadbeef", s, invalid.1, invalid.0])?;
+        let stack = run(&kernel.code, ec_mul, initial_stack);
+        assert_eq!(stack, vec![U256::MAX, U256::MAX]);
+
+        // Multiple calls
+        let ec_mul_hex = format!("0x{:x}", ec_mul);
+        let initial_stack = u256ify([
+            "0xdeadbeef",
+            s,
+            &ec_mul_hex,
+            identity.1,
+            identity.0,
+            point0.1,
+            point0.0,
+        ])?;
+        let stack = run(&kernel.code, ec_add, initial_stack);
+        assert_eq!(stack, u256ify([point4.1, point4.0])?);
+
+        Ok(())
+    }
+}