diff --git a/barretenberg/cpp/docs/Doxyfile b/barretenberg/cpp/docs/Doxyfile
index 9727453b25c5..2bdf7d08b706 100644
--- a/barretenberg/cpp/docs/Doxyfile
+++ b/barretenberg/cpp/docs/Doxyfile
@@ -1355,7 +1355,7 @@ HTML_EXTRA_FILES =
# The default value is: AUTO_LIGHT.
# This tag requires that the tag GENERATE_HTML is set to YES.
-HTML_COLORSTYLE = AUTO_LIGHT
+HTML_COLORSTYLE = TOGGLE
# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. Doxygen
# will adjust the colors in the style sheet and background images according to
diff --git a/barretenberg/cpp/docs/src/sumcheck-outline.md b/barretenberg/cpp/docs/src/sumcheck-outline.md
index 6a78eddad0b5..c141e96446eb 100644
--- a/barretenberg/cpp/docs/src/sumcheck-outline.md
+++ b/barretenberg/cpp/docs/src/sumcheck-outline.md
@@ -24,11 +24,11 @@ The implementation consists of several components.
### Sumcheck Relation {#SumcheckRelation}
-Given multilinear polynomials \f$ P*1,\ldots, P_N \in \mathbb{F}[X_0,\ldots, X*{d-1}] \f$ and a polynomial \f$ F \f$ in \f$ N \f$ variables, we run Sumcheck over the polynomial
+Given multilinear polynomials \f$ P_1,\ldots, P_N \in \mathbb{F}[X_0,\ldots, X_{d-1}] \f$ and a polynomial \f$ F \f$ in \f$ N \f$ variables, we run Sumcheck over the polynomial
\f{align}{
\tilde{F}
-(X*0,\ldots, X*{d-1}) =
-pow*{\beta}(X_0,\ldots, X*{d-1}) \cdot F\left( P*1 (X_0,\ldots, X*{d-1}), \ldots, P*N (X_0,\ldots, X*{d-1}) \right)
+(X_0,\ldots, X_{d-1}) =
+pow_{\beta}(X_0,\ldots, X_{d-1}) \cdot F\left( P_1 (X_0,\ldots, X_{d-1}), \ldots, P_N (X_0,\ldots, X_{d-1}) \right)
\f}
to establish that \f$ F(P_1(\vec \ell),\ldots, P_N(\vec \ell) ) = 0 \f$, i.e. that \f$ F \f$ is satisfied at every
point \f$\vec \ell \{0,1\}^d\f$.
@@ -55,9 +55,9 @@ The following constants are used in this exposition.
The significance of this parameter becomes apparent in Section [Masking Evaluations of Multilinear Witnesses](#MaskingEvalsOfWitnesses). It is formally defined as follows
\f{align}{
-D*w = \deg*{P*1, \ldots, P*{N*w}} F(P_1,\ldots, P*{N})
+D_w = \deg_{P_1, \ldots, P_{N_w}} F(P_1,\ldots, P_{N})
\f}
-where by \f$ \deg*{P_1, \ldots, P*{N*w}} \f$ we mean the total degree of the relation polynomial \f$ F \f$ in the witness polynomials \f$ P_1,\ldots, P*{N_w}\f$ considered as variables.
+where by \f$ \deg_{P_1, \ldots, P_{N_w}} \f$ we mean the total degree of the relation polynomial \f$ F \f$ in the witness polynomials \f$ P_1,\ldots, P_{N_w}\f$ considered as variables.
For example, given a polynomial \f$P_1 + P_{N_w+1} \cdot P_{N_w + 2} \cdot P_{1}^2 \cdot P_{2}\f$ in prover polynomials, where \f$N_w>2\f$, its witness degree \f$ D_w \f$ is \f$3\f$, whereas its total degree \f$D\f$ is equal to \f$ 6 \f$.
@@ -78,18 +78,18 @@ Sumcheck Prover algorithm takes a reference to an object of this class.
The prover evaluates the round univariate
\f{align}{
-\tilde{S}^i = \sum*{\vec \ell \in \{0,1\}^{d-1-i}} \tilde{F}\left(P_1(u_0,\ldots, u*{i-1}, X*i,\vec \ell), \ldots, P_N(u_0,\ldots, u*{i-1}, X*i,\vec \ell)\right)
+\tilde{S}^i = \sum_{\vec \ell \in \{0,1\}^{d-1-i}} \tilde{F}\left(P_1(u_0,\ldots, u_{i-1}, X_i,\vec \ell), \ldots, P_N(u_0,\ldots, u_{i-1}, X_i,\vec \ell)\right)
\f}
-over the domain \f$ 0,\ldots, D \f$. In fact, it is more efficient to perform this computation sub-relation-wise, because the degrees of individual subrelations as polynomials in \f$ P_1,\ldots, P_N\f$ are generally smaller than \f$D\f$ defined in [Main Parameters](#MainParameters). Taking this into account, for a given subrelation of \f$F\f$, we perform expensive subrelation evaluations at points \f$(u_0,\ldots, u*{i-1}, k, \vec \ell)\f$ for \f$\ell \in \{0,1\}^{d-1-i} \f$ and \f$k\f$ from \f$0\f$ only up to the degree of the subrelation as a polynomial in \f$P_1,\ldots,P_N\f$ incremented by \f$1\f$.
+over the domain \f$ 0,\ldots, D \f$. In fact, it is more efficient to perform this computation sub-relation-wise, because the degrees of individual subrelations as polynomials in \f$ P_1,\ldots, P_N\f$ are generally smaller than \f$D\f$ defined in [Main Parameters](#MainParameters). Taking this into account, for a given subrelation of \f$F\f$, we perform expensive subrelation evaluations at points \f$(u_0,\ldots, u_{i-1}, k, \vec \ell)\f$ for \f$\ell \in \{0,1\}^{d-1-i} \f$ and \f$k\f$ from \f$0\f$ only up to the degree of the subrelation as a polynomial in \f$P_1,\ldots,P_N\f$ incremented by \f$1\f$.
At the implementation level, the evaluations of \f$\tilde{S}^i\f$ are obtained using the method \ref bb::SumcheckProverRound< Flavor >::compute_univariate "compute univariate" consisting of the following sub-methods:
-- \ref bb::SumcheckProverRound::extend*edges "Extend evaluations" of linear univariate
- polynomials \f$ P_j(u_0,\ldots, u*{i-1}, X_i, \vec \ell) \f$ to the domain \f$0,\ldots, D\f$. It is a cheap operation applied only once for every \f$\vec \ell \in \{0,1\}^d\f$ which allows to compute subrelations of \f$ F \f$ at such arguments.
+- \ref bb::SumcheckProverRound::extend_edges "Extend evaluations" of linear univariate
+ polynomials \f$ P_j(u_0,\ldots, u_{i-1}, X_i, \vec \ell) \f$ to the domain \f$0,\ldots, D\f$. It is a cheap operation applied only once for every \f$\vec \ell \in \{0,1\}^d\f$ which allows to compute subrelations of \f$ F \f$ at such arguments.
- \ref bb::SumcheckProverRound::accumulate_relation_univariates "Accumulate per-relation contributions" of the extended
polynomials to auxiliary univariates \f$ T^i(X_i)\f$ defined in \ref SumcheckProverContributionsofPow "this section"
-- \ref bb::SumcheckProverRound::extend*and_batch_univariates "Extend and batch the subrelation contributions"
- multiplying by the constants \f$c_i\f$ and the evaluations of \f$ ( (1−X_i) + X_i\cdot \beta_i ) \f$ stemming from \f$F\f$ being multiplied by \f$pow*{\beta}\f$.
+- \ref bb::SumcheckProverRound::extend_and_batch_univariates "Extend and batch the subrelation contributions"
+ multiplying by the constants \f$c_i\f$ and the evaluations of \f$ ( (1−X_i) + X_i\cdot \beta_i ) \f$ stemming from \f$F\f$ being multiplied by \f$pow_{\beta}\f$.
#### Get Round Challenge {#GetRoundChallenge}
@@ -97,22 +97,22 @@ After computing Round Univariate and adding its evaluations \f$\tilde{S}^i(0),\l
#### Populate/Update Book-keeping Table {#BookKeepingTable}
-To keep prover's work linear in the number of coefficients of \f$P_1,\ldots, P_N\f$, we \ref bb::SumcheckProver< Flavor >::partially*evaluate "populate" a table of \f$\texttt{partially_evaluated_polynomials}\f$ after getting the first challenge \f$ u_0 \f$ with the values \f$P_j(u_0,\vec \ell )\f$, namely
+To keep prover's work linear in the number of coefficients of \f$P_1,\ldots, P_N\f$, we \ref bb::SumcheckProver< Flavor >::partially_evaluate "populate" a table of \f$\texttt{partially_evaluated_polynomials}\f$ after getting the first challenge \f$ u_0 \f$ with the values \f$P_j(u_0,\vec \ell )\f$, namely
\f{align}{
-\texttt{partially_evaluated_polynomials}*{\ell,j} \gets P*j(0, \ell) + u*{0} \cdot \left(P_j(1, \vec \ell) - P_j(0, \ell)\right) \f}
+\texttt{partially_evaluated_polynomials}_{\ell,j} \gets P_j(0, \ell) + u_{0} \cdot \left(P_j(1, \vec \ell) - P_j(0, \ell)\right) \f}
for \f$ \vec \ell \in \{0,1\}^{d-1}\f$ identified with the binary representation of \f$ 0\leq \ell \leq 2^{d-1}-1\f$.
-In Round \f$0< i \leq d-1\f$, the prover algorithm \ref bb::SumcheckProver< Flavor >::partially*evaluate "updates" the top \f$ 2^{d-1 - i}\f$ values in the book-keeping table
+In Round \f$0< i \leq d-1\f$, the prover algorithm \ref bb::SumcheckProver< Flavor >::partially_evaluate "updates" the top \f$ 2^{d-1 - i}\f$ values in the book-keeping table
\f{align}{
-\texttt{partially_evaluated_polynomials}*{\ell,j} \gets \texttt{partially*evaluated_polynomials}*{2 \ell,j} + u*{i} \cdot (\texttt{partially_evaluated_polynomials}*{2\ell+1,j} - \texttt{partially*evaluated_polynomials}*{2\ell,j}) \f}
+\texttt{partially_evaluated_polynomials}_{\ell,j} \gets \texttt{partially_evaluated_polynomials}_{2 \ell,j} + u_{i} \cdot (\texttt{partially_evaluated_polynomials}_{2\ell+1,j} - \texttt{partially_evaluated_polynomials}_{2\ell,j}) \f}
where \f$\vec \ell \in \{0,1\}^{d-1-i}\f$.
-After the final update, i.e. when \f$ i = d-1 \f$, the upper row of the table contains the evaluations of Prover Polynomials at the challenge point \f$ (u*0,\ldots, u*{d-1}) \f$.
+After the final update, i.e. when \f$ i = d-1 \f$, the upper row of the table contains the evaluations of Prover Polynomials at the challenge point \f$ (u_0,\ldots, u_{d-1}) \f$.
#### Add Claimed Evaluations to Transcript {#ClaimedEvaluations}
-After computing the last challenge \f$ u*{d-1} \f$ in Round \f$ d-1 \f$ and updating \f$
+After computing the last challenge \f$ u_{d-1} \f$ in Round \f$ d-1 \f$ and updating \f$
\texttt{partially_evaluated_polynomials} \f$, the prover looks into the top row of the table containing evaluations
-\f$P_1(u_0,\ldots, u*{d-1}), \ldots, P*N(u_0,\ldots, u*{d-1})\f$ and concatenates these values with the last challenge
+\f$P_1(u_0,\ldots, u_{d-1}), \ldots, P_N(u_0,\ldots, u_{d-1})\f$ and concatenates these values with the last challenge
to the transcript.
## Sumcheck Verifier Algorithm {#NonZKSumcheckVerifier}
@@ -126,11 +126,11 @@ The verifier's work reduces to the following.
For \f$ i = 0,\ldots, d-1\f$:
- Using \ref bb::BaseTranscript::receive_from_prover "receive_from_prover" method from \ref bb::BaseTranscript< TranscriptParams > "Base Transcript Class", extract the evaluations of Round Univariate \f$ \tilde{S}^i(0),\ldots, \tilde{S}^i(D) \f$ from the transcript.
-- \ref bb::SumcheckVerifierRound< Flavor >::check*sum "Check target sum": \f$\quad \sigma*{
+- \ref bb::SumcheckVerifierRound< Flavor >::check_sum "Check target sum": \f$\quad \sigma_{
i } \stackrel{?}{=} \tilde{S}^i(0) + \tilde{S}^i(1) \f$.
- \ref bb::BaseTranscript::get_challenge "Get the next challenge" \f$u_i\f$ by hashing the transcript.
method.
-- \ref bb::SumcheckVerifierRound< Flavor >::compute*next_target_sum "Compute next target sum" :\f$ \quad \sigma*{i+1}
+- \ref bb::SumcheckVerifierRound< Flavor >::compute_next_target_sum "Compute next target sum" :\f$ \quad \sigma_{i+1}
\gets \tilde{S}^i(u_i) \f$
### Verifier's Data before Final Step {#SumcheckVerifierData}
@@ -142,13 +142,13 @@ and computed \f$\sigma_d = \tilde{S}^{d-1}(u_{d-1})\f$.
### Final Verification Step {#NonZKSumcheckVerification}
- Extract claimed evaluations of prover polynomials \f$P_1,\ldots, P_N\f$ at the challenge point \f$
- (u_0,\ldots,u_{d-1}) \f$ from the transcript and \ref bb::SumcheckVerifierRound< Flavor >::compute*full_honk_relation_purported_value "compute evaluation:"
- \f{align}{\tilde{F}\left( P_1(u_0,\ldots, u*{d-1}), \ldots, P*N(u_0,\ldots, u*{d-1}) \right)\f}
+ (u_0,\ldots,u_{d-1}) \f$ from the transcript and \ref bb::SumcheckVerifierRound< Flavor >::compute_full_honk_relation_purported_value "compute evaluation:"
+ \f{align}{\tilde{F}\left( P_1(u_0,\ldots, u_{d-1}), \ldots, P_N(u_0,\ldots, u_{d-1}) \right)\f}
-- Compare \f$ \sigma*d \f$ against the evaluation of \f$ \tilde{F} \f$ at \f$P_1(u_0,\ldots, u*{d-1}), \ldots,
- P*N(u_0,\ldots, u*{d-1})\f$:
- \f{align}{\quad \sigma*{ d } \stackrel{?}{=} \tilde{F}\left(P_1(u*{0}, \ldots, u*{d-1}),\ldots, P_N(u_0,\ldots,
- u*{d-1})\right)\f}
+- Compare \f$ \sigma_d \f$ against the evaluation of \f$ \tilde{F} \f$ at \f$P_1(u_0,\ldots, u_{d-1}), \ldots,
+ P_N(u_0,\ldots, u_{d-1})\f$:
+ \f{align}{\quad \sigma_{ d } \stackrel{?}{=} \tilde{F}\left(P_1(u_{0}, \ldots, u_{d-1}),\ldots, P_N(u_0,\ldots,
+ u_{d-1})\right)\f}
## Witness Information Leakage {#NonZKSumcheckLeakage}
@@ -159,129 +159,144 @@ As explained in Section 13.3 of ::setup_zk_sumcheck_data "setup_zk_sumcheck_data", which also adds the Libra sum to the transcript.
### Pre-computed Data and Book-Keeping {#LibraBookKeeping}
-
-As in [Sumcheck Book-keeping](#BookKeepingTable), we use a table of evaluations of Libra univariates to avoid extra computational costs.
-Namely, before Round \f$ i \f$, the prover needs the table of values
+As in [Sumcheck Book-keeping](#BookKeepingTable), we use a table of evaluations of Libra univariates that is being updated in each round.
+Namely, before entering the first round, the prover updates the vector of Libra univariates in place
\f{align}{
-\texttt{libra*table}*{j,k} \gets \rho \cdot 2^{d-1-i} \cdot g*{j,k} \text{ for } j= i,\ldots, d-1, \text{ and } k=0,\ldots, \tilde{D}
-\f}
-and the term
+ \texttt{libra_univariates}_{j}(k) \gets \texttt{libra_challenge} \cdot 2^{d-1} \cdot g_{j}(k) \text{ for } j= i,\ldots, d-1, \text{ and } k=0,\ldots, \tilde{D}
+\f}
+and computes the term
\f{align}{
-\texttt{libra_running_sum} \gets \rho \cdot 2^{d-1-i}\left( \sum*{j=0}^{i-1}g*j(u_j) + \sum*{j = i+1}^{d-1} ( g*{j,0} + g*{j,1}) \right).
+ \texttt{libra_running_sum} \gets 2^{-1} \left( \texttt{libra_challenge} \cdot \texttt{libra_total_sum} - \left(\texttt{libra_univariates}_{0}(0) + \texttt{libra_univariates}_{0}(1)\right) \right).
\f}
+
+These entities are created inside \ref bb::SumcheckProver< Flavor >::setup_zk_sumcheck_data "setup_zk_sumcheck_data" and stored in a \ref bb::SumcheckProverRound< Flavor >::ZKSumcheckData "ZKSumcheckData structure" zk_sumcheck_data.
+All the modifications between the Sumcheck rounds are performed by the method \ref bb::SumcheckProver< Flavor >::update_libra_data "update Libra data" that is called by \ref bb::SumcheckProver< Flavor >::update_zk_sumcheck_data "update_zk_sumcheck_data".
+
### First Round {#LibraFirstRound}
-The prover computes first Libra round univariate
+The prover computes the first Libra round univariate
\f{align}{
-\texttt{libra*univariate}\_0(X_0) = \rho \cdot \sum*{\vec \ell \in \{0,1\}^{d-1}} G(X*0,\vec \ell) =
-2^{d-1} \rho\cdot g_0(X_0) + 2^{d-1} \rho \cdot \sum*{i=1}^{d-1}\left(g*i(0)+g_i(1)\right)
+ \texttt{libra_round_univariate}_0(X_0) = \texttt{libra_challenge} \cdot \sum_{\vec \ell \in \{0,1\}^{d-1}} G(X_0,\vec \ell) =
+ 2^{d-1} \texttt{libra_challenge}\cdot g_0(X_0) + 2^{d-2} \texttt{libra_challenge} \cdot \sum_{i=1}^{d-1}\left(g_i(0)+g_i(1)\right).
\f}
-which could be expressed as follows
+By design of the method \ref bb::SumcheckProver< Flavor >::setup_zk_sumcheck_data "setup_zk_sumcheck_data", the latter could be expressed as follows
\f{align}{
-\texttt{libra_univariate}\_0 (k) \gets \texttt{libra_table}*{0,k} + \texttt{libra_running_sum}
+ \texttt{libra_round_univariate}_0 (k) \gets \texttt{libra_univariates}_{0}(k) + \texttt{libra_running_sum}
\f}
-for \f$k=0,\ldots, \tilde{D}\f$.
+for \f$k=0,\ldots, \tilde{D}\f$. It is done by the method \ref bb::SumcheckProverRound< Flavor >::compute_libra_round_univariate "compute_libra_round_univariate" called inside \ref bb::SumcheckProverRound< Flavor >::compute_univariate "Sumcheck Round Univariate computation", which also takes care of adding \f$\texttt{libra_round_univariate}\f$ to the \f$\texttt{round_unviariate}\f$.
-When the prover receives the challenge \f$u_0\f$, it computes the value \f$g_0(u_0)\f$ using \ref bb::Univariate::evaluate "evaluate" method, updates the running sum
+When the prover receives the challenge \f$u_0\f$, it \ref bb::SumcheckProver< Flavor >::update_libra_data "updates Libra data":
+
+- updates the table of Libra univariates by multiplying every term by \f$1/2\f$.
+- computes the value \f$2^{d-2} \cdot \texttt{libra_challenge} \cdot g_0(u_0)\f$ applying \ref bb::Univariate::evaluate "evaluate" method to the first univariate in the table \f$\texttt{libra_univariates}\f$
+- places the value \f$ g_0(u_0)\f$ to the vector \f$ \texttt{libra_evaluations}\f$
+- updates the running sum
\f{align}{
-\texttt{libra*running_sum} \gets 2^{-1} \cdot \left( (g_0(u_0) + \texttt{libra_running_sum}) - (\texttt{libra_table}*{1,0} + \texttt{libra*table}*{1,1})\right)
+ \texttt{libra_running_sum} \gets 2^{d-2} \cdot \texttt{libra_challenge} \cdot g_0(u_0) + 2^{-1} \cdot \left( \texttt{libra_running_sum} - (\texttt{libra_univariates}_{1}(0) + \texttt{libra_univariates}_{1}(1)) \right)
\f}
-and updates the libra table by releasing the first column and multiplying reamining terms by \f$1/2\f$.
### Round Univariates in Subsequent Rounds {#LibraRoundUnivariates}
-
-Similarly, to compute the contribution of Libra masking polynomial \f$G\f$ to the round univariates \f$\tilde{S}_i\f$ defined in [Compute Round Univariates](#ComputeRoundUnivariates), consider
+In Round \f$ i \f$, the prover computes \f$ i \f$-th Libra round univariate
\f{align}{
-\texttt{libra*univariate}\_i(X_i) = \rho \cdot \sum*{\vec \ell \in \{0,1\}^{d-1 - i}} G(u*0,\ldots, u*{i-1}, X*{i}, \vec \ell) =
-\rho \cdot 2^{d-1 - i} \left( \sum*{j = 0}^{i-1} g*j(u*{j}) + g*{i}(X_i) + \sum*{j=i+1}^{d-1} \left(g*{j,0} + g*{j,1}\right) \right)
+\texttt{libra_univariate}_i(X_i) = \texttt{libra_challenge} \cdot \sum_{\vec \ell \in \{0,1\}^{d-1 - i}} G(u_0,\ldots, u_{i-1}, X_{i}, \vec \ell) =
+\texttt{libra_challenge} \cdot 2^{d-1 - i} \left( \sum_{j = 0}^{i-1} g_j(u_{j}) + g_{i}(X_i) + \sum_{j=i+1}^{d-1} \left(g_{j,0} + g_{j,1}\right) \right)
\f}
-Therefore, the contribution of the \f$\texttt{libra_univariate}_{i}(X_{i})\f$ at \f$X_{i} = k\f$ to \f$\tilde{S}^i(k)\f$, where \f$k=0,\ldots, \tilde{D}\f$, is given by the formula
+
+By design of the method \ref bb::SumcheckProver< Flavor >::update_zk_sumcheck_data "update_zk_sumcheck_data", the latter could be expressed as follows
\f{align}{
-\texttt{libra*univariate}\_i(k) = \rho \cdot 2^{d-1-i} \left(\sum*{j = 0}^{i-1} g*j(u*{j}) + g*{i,k}+ \sum*{j=i+1}^{d-1}\left(g*{j,0}+g*{j,1}\right)\right) = \texttt{libra*table}*{i,k} + \texttt{libra_running_sum}.
+ \texttt{libra_round_univariate}_i (k) \gets \texttt{libra_univariates}_{i}(k) + \texttt{libra_running_sum}
\f}
+for \f$k=0,\ldots, \tilde{D}\f$. This computation is done by the method \ref bb::SumcheckProverRound< Flavor >::compute_libra_round_univariate "compute_libra_round_univariate" called inside \ref bb::SumcheckProverRound< Flavor >::compute_univariate "Sumcheck Round Univariate computation", which also adds \f$\texttt{libra_round_univariate}\f$ to the \f$\texttt{round_unviariate}\f$.
-### Updating Partial Evaluations {#LibraUpdatePartialEvaluations}
-In Rounds \f$ i = 1,\ldots d-2\f$, after correcting Sumcheck round univariate \f$S*{i}(X*{i})\f$ by \f$ \texttt{libra*univariate}\_i(X_i)\f$, the prover gets the challenge \f$u*{i}\f$, computes the value \f$\texttt{libra*univariate}*{i}(u*{i})\f$ and updates the running sum
-\f{align}{
-\texttt{libra_running_sum} \gets 2^{-1} \cdot \left( (g_i(u_i) + \texttt{libra_running_sum}) - (\texttt{libra_table}*{i+1,0} + \texttt{libra*table}*{i+1,1})\right)
-\f}
+### Updating Libra Data in Subsequent Rounds {#UpdateLibraData}
-### Final Round {#LibraFinalRound}
+When the prover receives new challenge \f$u_i\f$, it \ref bb::SumcheckProver< Flavor >::update_libra_data "updates Libra data". If \f$ i < d-1\f$, the prover
-After sending the evaluations of \f$\texttt{libra_univariate}_{d-1}\f$ at over the domain \f$\{0,\ldots, \tilde{D}\}\f$, the prover gets the last challenge \f$u_{d-1}\f$ and has to send the claimed evaluation \f$G(u_0,\ldots, u_{d-1})\f$. It boils down to sending and proving the evaluations
+- updates the table of Libra univariates by multiplying every term by \f$1/2\f$.
+- computes the value \f$2^{d-i - 2} \cdot \texttt{libra_challenge} \cdot g_0(u_0)\f$ applying \ref bb::Univariate::evaluate "evaluate" method to the first univariate in the table \f$\texttt{libra_univariates}\f$
+- places the value \f$ g_0(u_0)\f$ to the vector \f$ \texttt{libra_evaluations}\f$
+- updates the running sum
\f{align}{
-v_i = g_i(u_i) \text{ for } i = 0,\ldots, d-1.
+ \texttt{libra_running_sum} \gets 2^{d-i-2} \cdot \texttt{libra_challenge} \cdot g_0(u_0) + 2^{-1} \cdot \left( \texttt{libra_running_sum} - (\texttt{libra_univariates}_{i+1}(0) + \texttt{libra_univariates}_{i+1}(1)) \right)
\f}
+If \f$ i = d-1\f$, the prover
+- computes the value \f$ g_{d-1}(u_{d-1})\f$ applying \ref bb::Univariate::evaluate "evaluate" method to the last univariate in the table \f$\texttt{libra_univariates}\f$ and dividing the result by \f$ \texttt{libra_challenge} \f$.
+- updates the table of Libra univariates by multiplying every term by \f$\texttt{libra_challenge}^{-1}\f$.
+
+### Proving the Evaluations of Libra Univariates {#ProvingLibraEvaluations}
+Libra claimed evaluations \f$ g_0(u_0), \ldots, g_{d-1}(u_d-1)\f$ have to proved using shplonk .
+
## Libra Costs {#LibraCosts}
@@ -318,18 +333,18 @@ Using the PCS introduced in Section 4 of ::create_evaluation_masking_table "creates the vector" of univariates
\f{align}{
-\texttt{masking*terms_evaluations}*{k,j}\gets \rho*j \cdot (1-k) k
+\texttt{masking_terms_evaluations}_j(k)\gets \texttt{eval_masking_scalars}_j \cdot (1-k) k
\f}
-for \f$j=1, \ldots, N_w\f$ and \f$ k=2,\ldots, \tilde{D} \f$ and stores the vector of running quadratic terms
+of the same size as the ExtendedEdges created by the ZK Flavor running Sumcheck.
+
+When the prover receives the challenge \f$ u_i \f$, this vector is \ref bb::SumcheckProver< Flavor >::update_masking_terms_evaluations "updated" as follows
+
\f{align}{
-\texttt{running_quadratic_term}\_j \gets \rho_j \cdot \sum*{k=0}^{i-1} (1-u_k) u_k.
+ \texttt{masking_terms_evaluations}_j(k) \gets \texttt{eval_masking_scalars}_j \cdot u_i \cdot (1-u_i)
\f}
### Computing Evaluations of Round Univariates {#RoundUnivariatesMaskedEval}
In Round \f$i \in \{0,\ldots, d-1\}\f$, the prover computes univariate polynomials
\f{align}{
-\widehat{S}^i(X*i) = \sum*{\vec\ell \in \{0,1\}^{d-1-i}} F\left(\widehat{P}_1(u_0,\ldots, u_{i-1}, X*i, \vec \ell),\ldots,\widehat{P}*{N*w}(u_0,\ldots, u*{i-1}, X*i, \vec \ell), P*{N*w+1}(u_0,\ldots, u*{i-1}, X*i, \vec \ell), \ldots, P*{N}(u*0,\ldots, u*{i-1}, X*i, \vec \ell) \right)
+\widehat{S}^i(X_i) = \sum_{\vec\ell \in \{0,1\}^{d-1-i}} F\left(\widehat{P}_1(u_0,\ldots, u_{i-1}, X_i, \vec \ell),\ldots,\widehat{P}_{N_w}(u_0,\ldots, u_{i-1}, X_i, \vec \ell), P_{N_w+1}(u_0,\ldots, u_{i-1}, X_i, \vec \ell), \ldots, P_{N}(u_0,\ldots, u_{i-1}, X_i, \vec \ell) \right)
\f}
which reduces to computing at most \f$ (D+ D_w + 1) \times N \times 2^{d-1 - i}\f$ values
\f{align}{
-&\ P_j(u_0,\ldots, u*{i-1}, k, \vec \ell) + \rho*j \cdot \sum*{k=0}^{i-1} u*k(1-u_k) + \rho_j\cdot (1-k) k \quad \text{ for } j=1,\ldots, N_w\\
-&\ P_j(u_0,\ldots, u*{i-1}, k, \vec \ell) \quad \text { for } j= N*w+1,\ldots, N
+&\ P_j(u_0,\ldots, u_{i-1}, k, \vec \ell) + \rho_j \cdot \sum_{k=0}^{i-1} u_k(1-u_k) + \rho_j\cdot (1-k) k \quad \text{ for } j=1,\ldots, N_w\\
+&\ P_j(u_0,\ldots, u_{i-1}, k, \vec \ell) \quad \text { for } j= N_w+1,\ldots, N
+\f}
+By design, we have
+\f{align}{
+ \texttt{masking_terms_evaluations}_j(k) = \rho_j \cdot \sum_{k=0}^{i-1} u_k(1-u_k) + \rho_j\cdot (1-k) k.
\f}
-The values \f$ \texttt{running_quadratic_term}\_j = \rho_j \cdot \sum*{k=0}^{i-1} u_k(1-u_k)\f$ are available from Round \f$i-1\f$.
-The products \f$ \rho_j \cdot (1-k) k\f$ are taken from the table \f$ \texttt{masking_terms_evaluations}\f$.
-The prover performs an extra addition per evaluation \f$\widehat{P}_j(u_0,\ldots, u_{i-1}, k, \vec \ell)\f$ for \f$k=0,1\f$ and two extra additions per evaluation for \f$k=2,\ldots, D+D_w\f$ compared to evaluating the original witness polynomials \f$P_j\f$.
-It results in \f$2 (D+D_w) N_w (2^d-1) \f$ extra additions compared to [Non-ZK-Sumcheck](#NonZKSumcheck).
+Then the method \ref bb::SumcheckProverRound< Flavor >::extend_zk_edges "extend_zk_edges" gets the \f$j\f$-th edge corresponding to the witness polynomial and corrects it with the univariate \f$ \texttt{masking_terms_evaluations}_j\f$. The non-witness polynomials are treated as in \ref bb::SumcheckProverRound< Flavor >::extend_edges "extend_edges" used in non-ZK Flavors.
-Upon receiving the round challenge \f$ u_i\f$, the prover prepares the correcting term for the next round
-\f{align}{
-\texttt{running_quadratic_terms}\_j \gets \texttt{running_quadratic_terms}\_j + \rho_j \cdot (1-u_i) u_i .
-\f}
### Witness Evaluation Masking Costs {#MaskingCosts}
+The prover performs an extra addition per evaluation \f$\widehat{P}_j(u_0,\ldots, u_{i-1}, k, \vec \ell)\f$ for \f$k=0,1\f$ and two extra additions per evaluation for \f$k=2,\ldots, D+D_w\f$ compared to evaluating the original witness polynomials \f$P_j\f$.
+It results in \f$2 (D+D_w) N_w (2^d-1) \f$ extra additions compared to [Non-ZK-Sumcheck](#NonZKSumcheck).
In contrast to non-ZK-Sumcheck, the prover needs to compute \f$\tilde{D} \sim D+D_w \f$ evaluations of round univariates \f$S_i\f$, which results in
\f{align}{
@@ -465,9 +486,9 @@ The total costs of ZK Sumcheck are obtained from [Libra Costs](#LibraCosts) and
## Theoretic Field Operations vs. Implementation
The table above sets a reasonable upper bound on the amount of prover's field operations.
-However, in the implementation, the relation \f$ F \f$ is computed as a vector of its subrelations, which allows us to decrease the costs of computing the round univariates. Namely, for a given subrelation \f$ F*j \f$, its maximum partial degree \f$D_j\f$ and its witness degree \f$D*{w,j} \f$ are generally less than \f$ D\f$ and \f$ D*w \f$, respectively.
+However, in the implementation, the relation \f$ F \f$ is computed as a vector of its subrelations, which allows us to decrease the costs of computing the round univariates. Namely, for a given subrelation \f$ F_j \f$, its maximum partial degree \f$D_j\f$ and its witness degree \f$D_{w,j} \f$ are generally less than \f$ D\f$ and \f$ D_w \f$, respectively.
Therefore, we compute \f$ F_j \f$'s contribution to Sumcheck Round Univariates by evaluating the univariate polynomial
\f{align}{
-\sum*{\vec \ell\in \{0,1\}^{d-1-i}} pow*{\beta}(u_0,\ldots, u*{i-1}, X*i, \vec \ell) \cdot F_j(u_0,\ldots, u*{i-1}, X*i,\vec \ell)
+\sum_{\vec \ell\in \{0,1\}^{d-1-i}} pow_{\beta}(u_0,\ldots, u_{i-1}, X_i, \vec \ell) \cdot F_j(u_0,\ldots, u_{i-1}, X_i,\vec \ell)
\f}
-at \f$ X_i = 0,\ldots, D_i + D*{w,i}\f$ and extend the resulting univariate of degree \f$D_j+D_{w,j}\f$ to the entire domain \f$\{ 0,\ldots, D+D_w\}\f$, which is way cheaper than evaluating the sum above at \f$ X*i = D*{j}+ D\_{w,j}+1, \ldots, D+ D_w \f$
+at \f$ X_i = 0,\ldots, D_i + D_{w,i}\f$ and extend the resulting univariate of degree \f$D_j+D_{w,j}\f$ to the entire domain \f$\{ 0,\ldots, D+D_w\}\f$, which is way cheaper than evaluating the sum above at \f$ X_i = D_{j}+ D\_{w,j}+1, \ldots, D+ D_w \f$
diff --git a/barretenberg/cpp/pil/avm/gas.pil b/barretenberg/cpp/pil/avm/gas.pil
index ec344c393ee5..ef680830f783 100644
--- a/barretenberg/cpp/pil/avm/gas.pil
+++ b/barretenberg/cpp/pil/avm/gas.pil
@@ -1,6 +1,7 @@
include "fixed/gas.pil";
-// Gas is a "virtual" trace. Things are only in a separate file for modularity.
+// This is a "virtual" trace. Things are only in a separate file for modularity.
+// That is, this trace is expected to be in 1-1 relation with the main trace.
// However, the columns and relations are set on the "main" namespace.
namespace main(256);
//===== GAS ACCOUNTING ========================================================
diff --git a/barretenberg/cpp/pil/avm/kernel.pil b/barretenberg/cpp/pil/avm/kernel.pil
index 9cc48c6da6c2..9763bcaaa428 100644
--- a/barretenberg/cpp/pil/avm/kernel.pil
+++ b/barretenberg/cpp/pil/avm/kernel.pil
@@ -1,9 +1,14 @@
-include "main.pil";
include "constants_gen.pil";
-namespace kernel(256);
- pol public kernel_inputs;
+// The kernel trace is divided into two parts:
+// - A 1-1 virtual trace
+// - The public inputs which are looked up from the virtual trace
+// This is a "virtual" trace. Things are only in a separate file for modularity.
+// That is, this trace is expected to be in 1-1 relation with the main trace.
+// However, the columns and relations are set on the "main" namespace.
+namespace main(256);
+ pol public kernel_inputs;
pol public kernel_value_out;
pol public kernel_side_effect_out;
pol public kernel_metadata_out;
@@ -12,10 +17,9 @@ namespace kernel(256);
pol commit kernel_in_offset;
pol commit kernel_out_offset;
- // Note: in the future, with some codegen adjustments, this column will not be needed
- // as we can just add every entry in the public kernel_inputs to the lookup table
- pol commit q_public_input_kernel_add_to_table;
- pol commit q_public_input_kernel_out_add_to_table;
+ // These are selectors for the lookups on the public inputs.
+ pol commit sel_kernel_inputs;
+ pol commit sel_kernel_out;
// Kernel Outputs
//
@@ -24,7 +28,8 @@ namespace kernel(256);
// Global side effect counter; incremented after each side effect is produced.
pol commit side_effect_counter;
- // TODO(https://github.com/AztecProtocol/aztec-packages/issues/6465): Must constrain write_offset counters to be less than side effect MAX
+ // TODO(https://github.com/AztecProtocol/aztec-packages/issues/6465): Must constrain write_offset
+ // counters to be less than side effect MAX
// Current write offsets for each opcode
pol commit note_hash_exist_write_offset;
pol commit nullifier_exists_write_offset;
@@ -39,30 +44,146 @@ namespace kernel(256);
pol commit emit_unencrypted_log_write_offset;
pol commit emit_l2_to_l1_msg_write_offset;
-
- pol NOT_LAST = (1 - main.sel_last);
-
// Constraints to increase the offsets when the opcodes are found
#[NOTE_HASH_EXISTS_INC_CONSISTENCY_CHECK]
- NOT_LAST * (note_hash_exist_write_offset' - (note_hash_exist_write_offset + main.sel_op_note_hash_exists)) = 0;
+ sel_execution_row * (note_hash_exist_write_offset' - (note_hash_exist_write_offset + sel_op_note_hash_exists)) = 0;
#[EMIT_NOTE_HASH_INC_CONSISTENCY_CHECK]
- NOT_LAST * (emit_note_hash_write_offset' - (emit_note_hash_write_offset + main.sel_op_emit_note_hash)) = 0;
- // if main.ib is set on op_nullifier_exists, then the nullifier_exists_write_offset will be incremented by 1, otherwise non_exists will be incremented
+ sel_execution_row * (emit_note_hash_write_offset' - (emit_note_hash_write_offset + sel_op_emit_note_hash)) = 0;
+
+ // if ib is set on op_nullifier_exists, then the nullifier_exists_write_offset
+ // will be incremented by 1, otherwise non_exists will be incremented.
#[NULLIFIER_EXISTS_INC_CONSISTENCY_CHECK]
- NOT_LAST * (nullifier_exists_write_offset' - (nullifier_exists_write_offset + (main.sel_op_nullifier_exists * main.ib))) = 0;
+ sel_execution_row * (nullifier_exists_write_offset' - (nullifier_exists_write_offset + (sel_op_nullifier_exists * ib))) = 0;
#[NULLIFIER_NON_EXISTS_INC_CONSISTENCY_CHECK]
- NOT_LAST * (nullifier_non_exists_write_offset' - (nullifier_non_exists_write_offset + (main.sel_op_nullifier_exists * (1 - main.ib)))) = 0;
+ sel_execution_row * (nullifier_non_exists_write_offset' - (nullifier_non_exists_write_offset + (sel_op_nullifier_exists * (1 - ib)))) = 0;
+
#[EMIT_NULLIFIER_INC_CONSISTENCY_CHECK]
- NOT_LAST * (emit_nullifier_write_offset' - (emit_nullifier_write_offset + main.sel_op_emit_nullifier)) = 0;
+ sel_execution_row * (emit_nullifier_write_offset' - (emit_nullifier_write_offset + sel_op_emit_nullifier)) = 0;
+
#[L1_TO_L2_MSG_EXISTS_INC_CONSISTENCY_CHECK]
- NOT_LAST * (l1_to_l2_msg_exists_write_offset' - (l1_to_l2_msg_exists_write_offset + main.sel_op_l1_to_l2_msg_exists)) = 0;
+ sel_execution_row * (l1_to_l2_msg_exists_write_offset' - (l1_to_l2_msg_exists_write_offset + sel_op_l1_to_l2_msg_exists)) = 0;
+
#[EMIT_UNENCRYPTED_LOG_INC_CONSISTENCY_CHECK]
- NOT_LAST * (emit_unencrypted_log_write_offset' - (emit_unencrypted_log_write_offset + main.sel_op_emit_unencrypted_log)) = 0;
- #[EMIT_L2_TO_L1_MSG_INC_CONSISTENCY_CHECK]
- NOT_LAST * (emit_l2_to_l1_msg_write_offset' - (emit_l2_to_l1_msg_write_offset + main.sel_op_emit_l2_to_l1_msg)) = 0;
+ sel_execution_row * (emit_unencrypted_log_write_offset' - (emit_unencrypted_log_write_offset + sel_op_emit_unencrypted_log)) = 0;
+ #[EMIT_L2_TO_L1_MSG_INC_CONSISTENCY_CHECK]
+ sel_execution_row * (emit_l2_to_l1_msg_write_offset' - (emit_l2_to_l1_msg_write_offset + sel_op_emit_l2_to_l1_msg)) = 0;
#[SLOAD_INC_CONSISTENCY_CHECK]
- NOT_LAST * (sload_write_offset' - (sload_write_offset + main.sel_op_sload)) = 0;
+ sel_execution_row * (sload_write_offset' - (sload_write_offset + sel_op_sload)) = 0;
+
#[SSTORE_INC_CONSISTENCY_CHECK]
- NOT_LAST * (sstore_write_offset' - (sstore_write_offset + main.sel_op_sstore)) = 0;
+ sel_execution_row * (sstore_write_offset' - (sstore_write_offset + sel_op_sstore)) = 0;
+
+ //===== KERNEL INPUTS CONSTRAINTS ===========================================
+ // The general pattern for environment lookups is as follows:
+ // Each kernel opcode related to some fixed positions in the `public kernel_inputs` polynomial
+ // We can lookup into a fixed index of this polynomial by including constraints that force the value
+ // of kernel_in_offset to the value relevant to the given opcode that is active
+
+ // TODO: I think we can replace all these (IN) with a single lookup.
+ // CONTEXT - ENVIRONMENT
+ #[ADDRESS_KERNEL]
+ sel_op_address * (kernel_in_offset - constants.ADDRESS_SELECTOR) = 0;
+
+ #[STORAGE_ADDRESS_KERNEL]
+ sel_op_storage_address * (kernel_in_offset - constants.STORAGE_ADDRESS_SELECTOR) = 0;
+
+ #[SENDER_KERNEL]
+ sel_op_sender * (kernel_in_offset - constants.SENDER_SELECTOR) = 0;
+
+ #[FUNCTION_SELECTOR_KERNEL]
+ sel_op_function_selector * (kernel_in_offset - constants.FUNCTION_SELECTOR_SELECTOR) = 0;
+
+ #[FEE_TRANSACTION_FEE_KERNEL]
+ sel_op_transaction_fee * (kernel_in_offset - constants.TRANSACTION_FEE_SELECTOR) = 0;
+
+ // CONTEXT - ENVIRONMENT - GLOBALS
+ #[CHAIN_ID_KERNEL]
+ sel_op_chain_id * (kernel_in_offset - constants.CHAIN_ID_SELECTOR) = 0;
+
+ #[VERSION_KERNEL]
+ sel_op_version * (kernel_in_offset - constants.VERSION_SELECTOR) = 0;
+
+ #[BLOCK_NUMBER_KERNEL]
+ sel_op_block_number * (kernel_in_offset - constants.BLOCK_NUMBER_SELECTOR) = 0;
+
+ #[TIMESTAMP_KERNEL]
+ sel_op_timestamp * (kernel_in_offset - constants.TIMESTAMP_SELECTOR) = 0;
+
+ #[COINBASE_KERNEL]
+ sel_op_coinbase * (kernel_in_offset - constants.COINBASE_SELECTOR) = 0;
+
+ // CONTEXT - ENVIRONMENT - GLOBALS - FEES
+ #[FEE_DA_GAS_KERNEL]
+ sel_op_fee_per_da_gas * (kernel_in_offset - constants.FEE_PER_DA_GAS_SELECTOR) = 0;
+
+ #[FEE_L2_GAS_KERNEL]
+ sel_op_fee_per_l2_gas * (kernel_in_offset - constants.FEE_PER_L2_GAS_SELECTOR) = 0;
+
+ // OUTPUTS LOOKUPS
+ // Constrain the value of kernel_out_offset to be the correct offset for the operation being performed
+ #[NOTE_HASH_KERNEL_OUTPUT]
+ sel_op_note_hash_exists * (kernel_out_offset - (constants.START_NOTE_HASH_EXISTS_WRITE_OFFSET + note_hash_exist_write_offset)) = 0;
+ sel_first * note_hash_exist_write_offset = 0;
+
+ #[EMIT_NOTE_HASH_KERNEL_OUTPUT]
+ sel_op_emit_note_hash * (kernel_out_offset - (constants.START_EMIT_NOTE_HASH_WRITE_OFFSET + emit_note_hash_write_offset)) = 0;
+ sel_first * emit_note_hash_write_offset = 0;
+
+ #[NULLIFIER_EXISTS_KERNEL_OUTPUT]
+ sel_op_nullifier_exists * (kernel_out_offset - ((ib * (constants.START_NULLIFIER_EXISTS_OFFSET + nullifier_exists_write_offset)) + ((1 - ib) * (constants.START_NULLIFIER_NON_EXISTS_OFFSET + nullifier_non_exists_write_offset)))) = 0;
+ sel_first * nullifier_exists_write_offset = 0;
+ sel_first * nullifier_non_exists_write_offset = 0;
+
+ #[EMIT_NULLIFIER_KERNEL_OUTPUT]
+ sel_op_emit_nullifier * (kernel_out_offset - (constants.START_EMIT_NULLIFIER_WRITE_OFFSET + emit_nullifier_write_offset)) = 0;
+ sel_first * emit_nullifier_write_offset = 0;
+
+ #[L1_TO_L2_MSG_EXISTS_KERNEL_OUTPUT]
+ sel_op_l1_to_l2_msg_exists * (kernel_out_offset - (constants.START_L1_TO_L2_MSG_EXISTS_WRITE_OFFSET + l1_to_l2_msg_exists_write_offset)) = 0;
+ sel_first * l1_to_l2_msg_exists_write_offset = 0;
+
+ #[EMIT_UNENCRYPTED_LOG_KERNEL_OUTPUT]
+ sel_op_emit_unencrypted_log * (kernel_out_offset - (constants.START_EMIT_UNENCRYPTED_LOG_WRITE_OFFSET + emit_unencrypted_log_write_offset)) = 0;
+ sel_first * emit_unencrypted_log_write_offset = 0;
+
+ // TODO: Add the equivalent for GETCONTRACTINSTANCE?
+
+ #[EMIT_L2_TO_L1_MSGS_KERNEL_OUTPUT]
+ sel_op_emit_l2_to_l1_msg * (kernel_out_offset - (constants.START_EMIT_L2_TO_L1_MSG_WRITE_OFFSET + emit_l2_to_l1_msg_write_offset)) = 0;
+ sel_first * emit_l2_to_l1_msg_write_offset = 0;
+
+ #[SLOAD_KERNEL_OUTPUT]
+ sel_op_sload * (kernel_out_offset - (constants.START_SLOAD_WRITE_OFFSET + sload_write_offset)) = 0;
+ sel_first * sload_write_offset = 0;
+
+ #[SSTORE_KERNEL_OUTPUT]
+ sel_op_sstore * (kernel_out_offset - (constants.START_SSTORE_WRITE_OFFSET + sstore_write_offset)) = 0;
+ sel_first * sstore_write_offset = 0;
+
+ // When we encounter a state writing opcode
+ // We increment the side effect counter by 1
+ #[SIDE_EFFECT_COUNTER_INCREMENT]
+ KERNEL_OUTPUT_SELECTORS * (side_effect_counter' - (side_effect_counter + 1)) = 0;
+
+ //===== LOOKUPS INTO THE PUBLIC INPUTS ===========================================
+ pol KERNEL_INPUT_SELECTORS = sel_op_address + sel_op_storage_address + sel_op_sender
+ + sel_op_function_selector + sel_op_transaction_fee + sel_op_chain_id
+ + sel_op_version + sel_op_block_number + sel_op_coinbase + sel_op_timestamp
+ + sel_op_fee_per_l2_gas + sel_op_fee_per_da_gas;
+ // Ensure that only one kernel lookup is active when the kernel_in_offset is active
+ #[KERNEL_INPUT_ACTIVE_CHECK]
+ KERNEL_INPUT_SELECTORS * (1 - sel_q_kernel_lookup) = 0;
+
+ pol KERNEL_OUTPUT_SELECTORS = sel_op_note_hash_exists + sel_op_emit_note_hash + sel_op_nullifier_exists
+ + sel_op_emit_nullifier + sel_op_l1_to_l2_msg_exists + sel_op_emit_unencrypted_log
+ + sel_op_emit_l2_to_l1_msg + sel_op_sload + sel_op_sstore;
+ #[KERNEL_OUTPUT_ACTIVE_CHECK]
+ KERNEL_OUTPUT_SELECTORS * (1 - sel_q_kernel_output_lookup) = 0;
+
+ #[KERNEL_OUTPUT_LOOKUP]
+ sel_q_kernel_output_lookup {kernel_out_offset, ia, side_effect_counter, ib} in sel_kernel_out {clk, kernel_value_out, kernel_side_effect_out, kernel_metadata_out};
+
+ #[LOOKUP_INTO_KERNEL]
+ sel_q_kernel_lookup { main.ia, kernel_in_offset } in sel_kernel_inputs { kernel_inputs, clk };
diff --git a/barretenberg/cpp/pil/avm/main.pil b/barretenberg/cpp/pil/avm/main.pil
index 634f53bd7fa3..f1b03e37c3a1 100644
--- a/barretenberg/cpp/pil/avm/main.pil
+++ b/barretenberg/cpp/pil/avm/main.pil
@@ -370,21 +370,6 @@ namespace main(256);
// This works in combination with op_fdiv_err * (sel_op_fdiv - 1) = 0;
// Drawback is the need to paralllelize the latter.
- //===== KERNEL LOOKUPS =======================================================
- pol KERNEL_INPUT_SELECTORS = sel_op_address + sel_op_storage_address + sel_op_sender
- + sel_op_function_selector + sel_op_transaction_fee + sel_op_chain_id
- + sel_op_version + sel_op_block_number + sel_op_coinbase + sel_op_timestamp
- + sel_op_fee_per_l2_gas + sel_op_fee_per_da_gas;
- // Ensure that only one kernel lookup is active when the kernel_in_offset is active
- #[KERNEL_INPUT_ACTIVE_CHECK]
- KERNEL_INPUT_SELECTORS * (1 - sel_q_kernel_lookup) = 0;
-
- pol KERNEL_OUTPUT_SELECTORS = sel_op_note_hash_exists + sel_op_emit_note_hash + sel_op_nullifier_exists
- + sel_op_emit_nullifier + sel_op_l1_to_l2_msg_exists + sel_op_emit_unencrypted_log
- + sel_op_emit_l2_to_l1_msg + sel_op_sload + sel_op_sstore;
- #[KERNEL_OUTPUT_ACTIVE_CHECK]
- KERNEL_OUTPUT_SELECTORS * (1 - sel_q_kernel_output_lookup) = 0;
-
//===== CONTROL FLOW =======================================================
// pol commit sel_halted;
// sel_halted * (1 - sel_halted) = 0;
@@ -517,97 +502,6 @@ namespace main(256);
#[DAGASLEFT]
sel_op_dagasleft * (ia - da_gas_remaining') = 0;
- //===== KERNEL INPUTS CONSTRAINTS ===========================================
- // The general pattern for environment lookups is as follows:
- // Each kernel opcode related to some fixed positions in the `public kernel_inputs` polynomial
- // We can lookup into a fixed index of this polynomial by including constraints that force the value
- // of kernel_in_offset to the value relevant to the given opcode that is active
-
- // CONTEXT - ENVIRONMENT
- #[ADDRESS_KERNEL]
- sel_op_address * (kernel.kernel_in_offset - constants.ADDRESS_SELECTOR) = 0;
-
- #[STORAGE_ADDRESS_KERNEL]
- sel_op_storage_address * (kernel.kernel_in_offset - constants.STORAGE_ADDRESS_SELECTOR) = 0;
-
- #[SENDER_KERNEL]
- sel_op_sender * (kernel.kernel_in_offset - constants.SENDER_SELECTOR) = 0;
-
- #[FUNCTION_SELECTOR_KERNEL]
- sel_op_function_selector * (kernel.kernel_in_offset - constants.FUNCTION_SELECTOR_SELECTOR) = 0;
-
- #[FEE_TRANSACTION_FEE_KERNEL]
- sel_op_transaction_fee * (kernel.kernel_in_offset - constants.TRANSACTION_FEE_SELECTOR) = 0;
-
- // CONTEXT - ENVIRONMENT - GLOBALS
- #[CHAIN_ID_KERNEL]
- sel_op_chain_id * (kernel.kernel_in_offset - constants.CHAIN_ID_SELECTOR) = 0;
-
- #[VERSION_KERNEL]
- sel_op_version * (kernel.kernel_in_offset - constants.VERSION_SELECTOR) = 0;
-
- #[BLOCK_NUMBER_KERNEL]
- sel_op_block_number * (kernel.kernel_in_offset - constants.BLOCK_NUMBER_SELECTOR) = 0;
-
- #[TIMESTAMP_KERNEL]
- sel_op_timestamp * (kernel.kernel_in_offset - constants.TIMESTAMP_SELECTOR) = 0;
-
- #[COINBASE_KERNEL]
- sel_op_coinbase * (kernel.kernel_in_offset - constants.COINBASE_SELECTOR) = 0;
-
- // CONTEXT - ENVIRONMENT - GLOBALS - FEES
- #[FEE_DA_GAS_KERNEL]
- sel_op_fee_per_da_gas * (kernel.kernel_in_offset - constants.FEE_PER_DA_GAS_SELECTOR) = 0;
-
- #[FEE_L2_GAS_KERNEL]
- sel_op_fee_per_l2_gas * (kernel.kernel_in_offset - constants.FEE_PER_L2_GAS_SELECTOR) = 0;
-
- // OUTPUTS LOOKUPS
- // Constrain the value of kernel_out_offset to be the correct offset for the operation being performed
- #[NOTE_HASH_KERNEL_OUTPUT]
- sel_op_note_hash_exists * (kernel.kernel_out_offset - (constants.START_NOTE_HASH_EXISTS_WRITE_OFFSET + kernel.note_hash_exist_write_offset)) = 0;
- sel_first * kernel.note_hash_exist_write_offset = 0;
-
-
- #[EMIT_NOTE_HASH_KERNEL_OUTPUT]
- sel_op_emit_note_hash * (kernel.kernel_out_offset - (constants.START_EMIT_NOTE_HASH_WRITE_OFFSET + kernel.emit_note_hash_write_offset)) = 0;
- sel_first * kernel.emit_note_hash_write_offset = 0;
-
- #[NULLIFIER_EXISTS_KERNEL_OUTPUT]
- sel_op_nullifier_exists * (kernel.kernel_out_offset - ((ib * (constants.START_NULLIFIER_EXISTS_OFFSET + kernel.nullifier_exists_write_offset)) + ((1 - ib) * (constants.START_NULLIFIER_NON_EXISTS_OFFSET + kernel.nullifier_non_exists_write_offset)))) = 0;
- sel_first * kernel.nullifier_exists_write_offset = 0;
- sel_first * kernel.nullifier_non_exists_write_offset = 0;
-
- #[EMIT_NULLIFIER_KERNEL_OUTPUT]
- sel_op_emit_nullifier * (kernel.kernel_out_offset - (constants.START_EMIT_NULLIFIER_WRITE_OFFSET + kernel.emit_nullifier_write_offset)) = 0;
- sel_first * kernel.emit_nullifier_write_offset = 0;
-
- #[L1_TO_L2_MSG_EXISTS_KERNEL_OUTPUT]
- sel_op_l1_to_l2_msg_exists * (kernel.kernel_out_offset - (constants.START_L1_TO_L2_MSG_EXISTS_WRITE_OFFSET + kernel.l1_to_l2_msg_exists_write_offset)) = 0;
- sel_first * kernel.l1_to_l2_msg_exists_write_offset = 0;
-
- #[EMIT_UNENCRYPTED_LOG_KERNEL_OUTPUT]
- sel_op_emit_unencrypted_log * (kernel.kernel_out_offset - (constants.START_EMIT_UNENCRYPTED_LOG_WRITE_OFFSET + kernel.emit_unencrypted_log_write_offset)) = 0;
- sel_first * kernel.emit_unencrypted_log_write_offset = 0;
-
- // TODO: Add the equivalent for GETCONTRACTINSTANCE?
-
- #[EMIT_L2_TO_L1_MSGS_KERNEL_OUTPUT]
- sel_op_emit_l2_to_l1_msg * (kernel.kernel_out_offset - (constants.START_EMIT_L2_TO_L1_MSG_WRITE_OFFSET + kernel.emit_l2_to_l1_msg_write_offset)) = 0;
- sel_first * kernel.emit_l2_to_l1_msg_write_offset = 0;
-
- #[SLOAD_KERNEL_OUTPUT]
- sel_op_sload * (kernel.kernel_out_offset - (constants.START_SLOAD_WRITE_OFFSET + kernel.sload_write_offset)) = 0;
- sel_first * kernel.sload_write_offset = 0;
-
- #[SSTORE_KERNEL_OUTPUT]
- sel_op_sstore * (kernel.kernel_out_offset - (constants.START_SSTORE_WRITE_OFFSET + kernel.sstore_write_offset)) = 0;
- sel_first * kernel.sstore_write_offset = 0;
-
- // When we encounter a state writing opcode
- // We increment the side effect counter by 1
- KERNEL_OUTPUT_SELECTORS * (kernel.side_effect_counter' - (kernel.side_effect_counter + 1)) = 0;
-
//===== Memory Slice Constraints ============================================
pol commit sel_slice_gadget; // Selector to activate a slice gadget operation in the gadget (#[PERM_MAIN_SLICE]).
@@ -616,12 +510,6 @@ namespace main(256);
//====== Inter-table Constraints ============================================
- #[KERNEL_OUTPUT_LOOKUP]
- sel_q_kernel_output_lookup {kernel.kernel_out_offset, ia, kernel.side_effect_counter, ib} in kernel.q_public_input_kernel_out_add_to_table {clk, kernel.kernel_value_out, kernel.kernel_side_effect_out, kernel.kernel_metadata_out};
-
- #[LOOKUP_INTO_KERNEL]
- sel_q_kernel_lookup { main.ia, kernel.kernel_in_offset } in kernel.q_public_input_kernel_add_to_table { kernel.kernel_inputs, clk };
-
#[INCL_MAIN_TAG_ERR]
mem.tag_err {mem.clk} in tag_err {clk};
diff --git a/barretenberg/cpp/src/barretenberg/flavor/flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/flavor.hpp
index db63d9cb0cdf..0c2845a3021c 100644
--- a/barretenberg/cpp/src/barretenberg/flavor/flavor.hpp
+++ b/barretenberg/cpp/src/barretenberg/flavor/flavor.hpp
@@ -443,6 +443,8 @@ template concept IsFoldingFlavor = IsAnyOf,
MegaRecursiveFlavor_,
MegaRecursiveFlavor_, MegaRecursiveFlavor_>;
+template
+concept FlavorHasZK = T::HasZK;
template
inline std::string flavor_get_label(Container&& container, const Element& element) {
diff --git a/barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/ultra_keccak.hpp b/barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/ultra_keccak.hpp
index 7f28be204a26..ecb74ee54943 100644
--- a/barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/ultra_keccak.hpp
+++ b/barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/ultra_keccak.hpp
@@ -33,6 +33,8 @@ class UltraKeccakFlavor {
using CommitmentKey = bb::CommitmentKey;
using VerifierCommitmentKey = bb::VerifierCommitmentKey;
+ // Indicates that this flavor runs with non-ZK Sumcheck.
+ static constexpr bool HasZK = false;
static constexpr size_t NUM_WIRES = CircuitBuilder::NUM_WIRES;
// The number of multivariate polynomials on which a sumcheck prover sumcheck operates (including shifts). We often
// need containers of this size to hold related data, so we choose a name more agnostic than `NUM_POLYNOMIALS`.
@@ -42,6 +44,8 @@ class UltraKeccakFlavor {
static constexpr size_t NUM_PRECOMPUTED_ENTITIES = 25;
// The total number of witness entities not including shifts.
static constexpr size_t NUM_WITNESS_ENTITIES = 8;
+ // The total number of witnesses including shifts and derived entities.
+ static constexpr size_t NUM_ALL_WITNESS_ENTITIES = 13;
// Total number of folded polynomials, which is just all polynomials except the shifts
static constexpr size_t NUM_FOLDED_ENTITIES = NUM_PRECOMPUTED_ENTITIES + NUM_WITNESS_ENTITIES;
diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp
index d5f71eec3c17..a25bf3f8d818 100644
--- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp
+++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp
@@ -1,5 +1,6 @@
#pragma once
#include "barretenberg/plonk_honk_shared/library/grand_product_delta.hpp"
+#include "barretenberg/polynomials/polynomial_arithmetic.hpp"
#include "barretenberg/sumcheck/instance/prover_instance.hpp"
#include "barretenberg/sumcheck/sumcheck_output.hpp"
#include "barretenberg/transcript/transcript.hpp"
@@ -120,23 +121,44 @@ template class SumcheckProver {
using ProverPolynomials = typename Flavor::ProverPolynomials;
using PartiallyEvaluatedMultivariates = typename Flavor::PartiallyEvaluatedMultivariates;
using ClaimedEvaluations = typename Flavor::AllValues;
+
using Transcript = typename Flavor::Transcript;
using Instance = ProverInstance_;
using RelationSeparator = typename Flavor::RelationSeparator;
+ /**
+ * @brief The total algebraic degree of the Sumcheck relation \f$ F \f$ as a polynomial in Prover Polynomials
+ * \f$P_1,\ldots, P_N\f$.
+ */
+ static constexpr size_t MAX_PARTIAL_RELATION_LENGTH = Flavor::MAX_PARTIAL_RELATION_LENGTH;
+ // this constant specifies the number of coefficients of libra polynomials, and evaluations of round univariate
+ static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH;
+ // Specify the number of all witnesses including shifts and derived witnesses from flavors that have ZK,
+ // otherwise, set this constant to 0
+ static constexpr size_t NUM_ALL_WITNESS_ENTITIES = Flavor::NUM_ALL_WITNESS_ENTITIES;
/**
* @brief The size of the hypercube, i.e. \f$ 2^d\f$.
*
*/
+
+ using SumcheckRoundUnivariate = typename bb::Univariate;
+ using EvaluationMaskingTable =
+ std::array, NUM_ALL_WITNESS_ENTITIES>;
const size_t multivariate_n;
/**
* @brief The number of variables
*
*/
const size_t multivariate_d;
+ using EvalMaskingScalars = std::array;
+ // Define the length of Libra Univariates. For non-ZK Flavors: set to 0.
+ static constexpr size_t LIBRA_UNIVARIATES_LENGTH = Flavor::HasZK ? Flavor::BATCHED_RELATION_PARTIAL_LENGTH : 0;
+ using LibraUnivariates = std::vector>;
std::shared_ptr transcript;
SumcheckProverRound round;
+ // Declare a container for ZK Sumcheck data
+ ZKSumcheckData zk_sumcheck_data;
/**
*
@@ -178,57 +200,94 @@ template class SumcheckProver {
* @param gate_challenges
* @return SumcheckOutput
*/
-
SumcheckOutput prove(ProverPolynomials& full_polynomials,
const bb::RelationParameters& relation_parameters,
const RelationSeparator alpha,
const std::vector& gate_challenges)
{
-
+ // In case the Flavor has ZK, we populate sumcheck data structure with randomness, compute correcting term for
+ // the total sum, etc.
+ if constexpr (Flavor::HasZK) {
+ setup_zk_sumcheck_data(zk_sumcheck_data);
+ };
bb::PowPolynomial pow_univariate(gate_challenges);
pow_univariate.compute_values();
-
std::vector multivariate_challenge;
multivariate_challenge.reserve(multivariate_d);
-
+ size_t round_idx = 0;
// In the first round, we compute the first univariate polynomial and populate the book-keeping table of
- // #partially_evaluated_polynomials, which has \f$ n/2 \f$ rows and \f$ N \f$ columns.
- auto round_univariate = round.compute_univariate(full_polynomials, relation_parameters, pow_univariate, alpha);
+ // #partially_evaluated_polynomials, which has \f$ n/2 \f$ rows and \f$ N \f$ columns. When the Flavor has ZK,
+ // compute_univariate also takes into account the zk_sumcheck_data.
+ auto round_univariate = round.compute_univariate(
+ round_idx, full_polynomials, relation_parameters, pow_univariate, alpha, zk_sumcheck_data);
+ // Place the evaluations of the round univariate into transcript.
transcript->send_to_verifier("Sumcheck:univariate_0", round_univariate);
FF round_challenge = transcript->template get_challenge("Sumcheck:u_0");
multivariate_challenge.emplace_back(round_challenge);
+ // Prepare sumcheck book-keeping table for the next round
partially_evaluate(full_polynomials, multivariate_n, round_challenge);
+ // Prepare ZK Sumcheck data for the next round
+ if constexpr (Flavor::HasZK) {
+ update_zk_sumcheck_data(zk_sumcheck_data, round_challenge, round_idx);
+ };
pow_univariate.partially_evaluate(round_challenge);
round.round_size = round.round_size >> 1; // TODO(#224)(Cody): Maybe partially_evaluate should do this and
// release memory? // All but final round
// We operate on partially_evaluated_polynomials in place.
for (size_t round_idx = 1; round_idx < multivariate_d; round_idx++) {
// Write the round univariate to the transcript
- round_univariate =
- round.compute_univariate(partially_evaluated_polynomials, relation_parameters, pow_univariate, alpha);
+ round_univariate = round.compute_univariate(round_idx,
+ partially_evaluated_polynomials,
+ relation_parameters,
+ pow_univariate,
+ alpha,
+ zk_sumcheck_data);
+ // Place evaluations of Sumcheck Round Univariate in the transcript
transcript->send_to_verifier("Sumcheck:univariate_" + std::to_string(round_idx), round_univariate);
FF round_challenge = transcript->template get_challenge("Sumcheck:u_" + std::to_string(round_idx));
multivariate_challenge.emplace_back(round_challenge);
+ // Prepare sumcheck book-keeping table for the next round
partially_evaluate(partially_evaluated_polynomials, round.round_size, round_challenge);
+ // Prepare evaluation masking and libra structures for the next round (for ZK Flavors)
+ if constexpr (Flavor::HasZK) {
+ update_zk_sumcheck_data(zk_sumcheck_data, round_challenge, round_idx);
+ };
+
pow_univariate.partially_evaluate(round_challenge);
round.round_size = round.round_size >> 1;
}
+ // Check that the challenges \f$ u_0,\ldots, u_{d-1} \f$ do not satisfy the equation \f$ u_0(1-u_0) + \ldots +
+ // u_{d-1} (1 - u_{d-1}) = 0 \f$. This equation is satisfied with probability ~ 1/|FF|, in such cases the prover
+ // has to abort and start ZK Sumcheck anew.
+ if constexpr (Flavor::HasZK) {
+ check_that_evals_do_not_leak_witness_data(multivariate_challenge);
+ };
+ // Zero univariates are used to pad the proof to the fixed size CONST_PROOF_SIZE_LOG_N.
auto zero_univariate = bb::Univariate::zero();
for (size_t idx = multivariate_d; idx < CONST_PROOF_SIZE_LOG_N; idx++) {
transcript->send_to_verifier("Sumcheck:univariate_" + std::to_string(idx), zero_univariate);
FF round_challenge = transcript->template get_challenge("Sumcheck:u_" + std::to_string(idx));
multivariate_challenge.emplace_back(round_challenge);
}
-
- // Final round: Extract multivariate evaluations from #partially_evaluated_polynomials and add to transcript
+ // The evaluations of Libra uninvariates at \f$ g_0(u_0), \ldots, g_{d-1} (u_{d-1}) \f$ are added to the
+ // transcript.
+ if constexpr (Flavor::HasZK) {
+ transcript->send_to_verifier("Libra:evaluations", zk_sumcheck_data.libra_evaluations);
+ };
+
+ // Claimed evaluations of Prover polynomials are extracted and added to the transcript. When Flavor has ZK, the
+ // evaluations of all witnesses are masked.
ClaimedEvaluations multivariate_evaluations;
- for (auto [eval, poly] :
- zip_view(multivariate_evaluations.get_all(), partially_evaluated_polynomials.get_all())) {
- eval = poly[0];
- }
+ multivariate_evaluations = extract_claimed_evaluations(partially_evaluated_polynomials);
transcript->send_to_verifier("Sumcheck:evaluations", multivariate_evaluations.get_all());
-
- return { multivariate_challenge, multivariate_evaluations };
+ // For ZK Flavors: the evaluations of Libra univariates are included in the Sumcheck Output
+ if constexpr (!Flavor::HasZK) {
+ return SumcheckOutput{ multivariate_challenge, multivariate_evaluations };
+ } else {
+ return SumcheckOutput{ multivariate_challenge,
+ multivariate_evaluations,
+ zk_sumcheck_data.libra_evaluations };
+ }
};
/**
@@ -291,6 +350,278 @@ template class SumcheckProver {
}
});
};
+
+ /**
+ * @brief This method takes the book-keeping table containing partially evaluated prover polynomials and creates a
+ * vector containing the evaluations of all prover polynomials at the point \f$ (u_0, \ldots, u_{d-1} )\f$.
+ * For ZK Flavors: this method takes the book-keeping table containing partially evaluated prover polynomials
+and creates a vector containing the evaluations of all witness polynomials at the point \f$ (u_0, \ldots, u_{d-1} )\f$
+masked by the terms \f$ \texttt{eval_masking_scalars}_j\cdot \sum u_i(1-u_i)\f$ and the evaluations of all non-witness
+polynomials that are sent in clear.
+ *
+ * @param partially_evaluated_polynomials
+ * @param multivariate_evaluations
+ */
+ ClaimedEvaluations extract_claimed_evaluations(PartiallyEvaluatedMultivariates& partially_evaluated_polynomials)
+ {
+ ClaimedEvaluations multivariate_evaluations;
+ if constexpr (!Flavor::HasZK) {
+ for (auto [eval, poly] :
+ zip_view(multivariate_evaluations.get_all(), partially_evaluated_polynomials.get_all())) {
+ eval = poly[0];
+ };
+ } else {
+ // Extract claimed evaluations of non-witness polynomials
+ for (auto [eval, poly] : zip_view(multivariate_evaluations.get_non_witnesses(),
+ partially_evaluated_polynomials.get_non_witnesses())) {
+ eval = poly[0];
+ };
+ // Extract claimed evaluations of all witness polynomials
+ for (auto [eval, poly, masking_term] : zip_view(multivariate_evaluations.get_all_witnesses(),
+ partially_evaluated_polynomials.get_all_witnesses(),
+ zk_sumcheck_data.masking_terms_evaluations)) {
+ eval = poly[0] + masking_term.value_at(0);
+ }
+ }
+ return multivariate_evaluations;
+ };
+
+ /**
+ * @brief Create and populate the structure required for the ZK Sumcheck.
+
+ * @details This method creates an array of random field elements \f$ \rho_1,\ldots, \rho_{N_w}\f$ aimed to mask the
+ evaluations of witness polynomials, these are contained in \f$ \texttt{eval_masking_scalars} \f$. In order to
+ optimize the computation of Sumcheck Round Univariates, it populates a table of univariates \f$
+ \texttt{masking_terms_evaluations} \f$ which contains at the beginning the evaluations of polynomials \f$ \rho_j
+ \cdot (1-X)\cdot X \f$ at \f$ 0,\ldots, \text{MAX_PARTIAL_RELATION_LENGTH} - 1\f$. This method also creates Libra
+ univariates, computes the Libra total sum and adds it to the transcript, and sets up all auxiliary objects.
+ *
+ * @param zk_sumcheck_data
+ */
+ void setup_zk_sumcheck_data(ZKSumcheckData& zk_sumcheck_data)
+ {
+
+ EvalMaskingScalars eval_masking_scalars;
+
+ for (size_t k = 0; k < NUM_ALL_WITNESS_ENTITIES; ++k) {
+ eval_masking_scalars[k] = FF::random_element();
+ };
+ // Generate random scalars \f$ \rho_1,\ldots, \rho_{N_w}\f$ to mask the evaluations of witness polynomials and
+ // populate the table masking_terms_evaluations with the terms \f$ \rho_j \cdot (1-k) \cdot k \f$
+ auto masking_terms_evaluations = create_evaluation_masking_table(eval_masking_scalars);
+ // Generate random Libra Polynomials to mask Round Univariates.
+ LibraUnivariates libra_univariates = generate_libra_polynomials(multivariate_d);
+ // have to commit to libra_univariates here
+ auto libra_scaling_factor = FF(1);
+ FF libra_total_sum = compute_libra_total_sum(libra_univariates, libra_scaling_factor);
+ transcript->send_to_verifier("Libra:Sum", libra_total_sum);
+ // get the challenge for the zk-sumcheck claim \sigma + \rho \cdot libra_total_sum
+ FF libra_challenge = transcript->template get_challenge("Libra:Challenge");
+ // Initialize Libra running sum by multiplpying it by Libra challenge \f$\rho\f$;
+ auto libra_running_sum = libra_total_sum * libra_challenge;
+ // Multiply the column-univariates of the array of libra polynomials by libra challenge and power of \f$ 2\f$,
+ // modify libra running_sum subtracting the contribution from the first univariate
+ setup_libra_data(libra_univariates, libra_scaling_factor, libra_challenge, libra_running_sum);
+
+ std::vector libra_evaluations;
+ libra_evaluations.reserve(multivariate_d);
+ zk_sumcheck_data = ZKSumcheckData(eval_masking_scalars,
+ masking_terms_evaluations,
+ libra_univariates,
+ libra_scaling_factor,
+ libra_challenge,
+ libra_running_sum,
+ libra_evaluations);
+ };
+
+ /**
+ * @brief Given number of univariate polynomials and the number of their evaluations meant to be hidden, this method
+ * produces a vector of univariate polynomials of degree \ref ZK_BATCHED_LENGTH "ZK_BATCHED_LENGTH - 1" with
+ * independent uniformly random coefficients.
+ *
+ */
+ static LibraUnivariates generate_libra_polynomials(size_t number_of_polynomials)
+ {
+ LibraUnivariates libra_full_polynomials(number_of_polynomials);
+ for (auto& libra_polynomial : libra_full_polynomials) {
+ // generate random polynomial of required size
+ libra_polynomial = bb::Univariate::get_random();
+ };
+
+ return libra_full_polynomials;
+ };
+ /**
+ * @brief Generate an array of random scalars of size equal to the number of all witness polynomials and populate a
+ * table of evaluations of the quadratic terms needed for masking evaluations of witnesses.
+ *
+ * @param evaluations
+ */
+ static EvaluationMaskingTable create_evaluation_masking_table(EvalMaskingScalars eval_masking_scalars)
+ {
+ EvaluationMaskingTable output_table;
+ for (size_t column_idx = 0; column_idx < NUM_ALL_WITNESS_ENTITIES; ++column_idx) {
+ for (size_t row_idx = 0; row_idx < MAX_PARTIAL_RELATION_LENGTH; ++row_idx) {
+ auto scalar = FF(row_idx);
+ output_table[column_idx].value_at(row_idx) =
+ scalar * (FF(1) - scalar) * eval_masking_scalars[column_idx];
+ };
+ };
+ return output_table;
+ };
+
+ /**
+ * @brief Update the table of masking quadratic terms by adding a contribution from a current challenge.
+ *
+ @details At initialization, \f$j\f$'th column of the masking terms evaluations table is a vector \f$(0, 0, \rho_2
+ \cdot 2, \ldots, \rho_j \cdot k (1-k), \ldots, \rho_j \cdot (D-1) (1-(D-1)))\f$. Upon getting current round
+ challenge, the prover adds the term \f$ \rho_j \cdot u_i \cdot (1-u_i)\f$ to each entry in the table.
+
+ It is useful at the stage of evaluating the relation \f$ \tilde{F} \f$ at the arguments given by the values of
+ \f$(\widehat{P}_1, \ldots, \widehat{P}_{N_w})\f$ at the points \f$u_0,\ldots, u_{i}, k, \vec \ell)\f$.
+ * @param evaluations
+ * @param masking_scalars
+ * @param round_challenge
+ */
+ void update_masking_terms_evaluations(ZKSumcheckData& zk_sumcheck_data, FF round_challenge)
+ {
+ for (auto [masking_term, masking_scalar] :
+ zip_view(zk_sumcheck_data.masking_terms_evaluations, zk_sumcheck_data.eval_masking_scalars)) {
+ for (size_t k = 0; k < MAX_PARTIAL_RELATION_LENGTH; ++k) {
+ masking_term.value_at(k) += round_challenge * (FF(1) - round_challenge) * masking_scalar;
+ }
+ }
+ }
+ /**
+ * @brief Compute the sum of the randomly sampled multivariate polynomial \f$ G = \sum_{i=0}^{n-1} g_i(X_i) \f$ over
+ * the Boolean hypercube.
+ *
+ * @param libra_univariates
+ * @param scaling_factor
+ * @return FF
+ */
+ static FF compute_libra_total_sum(auto libra_univariates, FF& scaling_factor)
+ {
+ FF total_sum = 0;
+ scaling_factor = scaling_factor / 2;
+
+ for (auto univariate : libra_univariates) {
+ total_sum += univariate.value_at(0) + univariate.value_at(1);
+ scaling_factor *= 2;
+ }
+ total_sum *= scaling_factor;
+
+ return total_sum;
+ }
+ /**
+ * @brief Set up Libra book-keeping table that simplifies the computation of Libra Round Univariates
+ *
+ * @details The array of Libra univariates is getting scaled
+ * \f{align}{
+ \texttt{libra_univariates} \gets \texttt{libra_univariates}\cdot \rho \cdot 2^{d-1}
+ \f}
+ * We also initialize
+ * \f{align}{
+ \texttt{libra_running_sum} \gets \texttt{libra_total_sum} - \texttt{libra_univariates}_{0,0} -
+ \texttt{libra_univariates}_{0,1} \f}.
+ * @param libra_table
+ * @param libra_round_factor
+ * @param libra_challenge
+ */
+ void setup_libra_data(auto& libra_univariates,
+ FF& libra_scaling_factor,
+ const FF libra_challenge,
+ FF& libra_running_sum)
+ {
+ libra_scaling_factor *= libra_challenge; // \rho * 2^{d-1}
+ for (auto& univariate : libra_univariates) {
+ univariate *= libra_scaling_factor;
+ };
+ // subtract the contribution of the first libra univariate from libra total sum
+ libra_running_sum += -libra_univariates[0].value_at(0) - libra_univariates[0].value_at(1);
+ libra_running_sum *= FF(1) / FF(2);
+ }
+
+ /**
+ * @brief Upon receiving the challenge \f$u_i\f$, the prover updates Libra data. If \f$ i < d-1\f$
+
+ - update the table of Libra univariates by multiplying every term by \f$1/2\f$.
+ - computes the value \f$2^{d-i - 2} \cdot \texttt{libra_challenge} \cdot g_0(u_0)\f$ applying \ref
+ bb::Univariate::evaluate "evaluate" method to the first univariate in the table \f$\texttt{libra_univariates}\f$
+ - places the value \f$ g_0(u_0)\f$ to the vector \f$ \texttt{libra_evaluations}\f$
+ - update the running sum
+ \f{align}{
+ \texttt{libra_running_sum} \gets 2^{d-i-2} \cdot \texttt{libra_challenge} \cdot g_0(u_0) + 2^{-1}
+ \cdot \left( \texttt{libra_running_sum} - (\texttt{libra_univariates}_{i+1}(0) +
+ \texttt{libra_univariates}_{i+1}(1)) \right) \f} If \f$ i = d-1\f$
+ - compute the value \f$ g_{d-1}(u_{d-1})\f$ applying \ref bb::Univariate::evaluate "evaluate" method to the
+ last univariate in the table \f$\texttt{libra_univariates}\f$ and dividing the result by \f$
+ \texttt{libra_challenge} \f$.
+ - update the table of Libra univariates by multiplying every term by \f$\texttt{libra_challenge}^{-1}\f$.
+ @todo Refactor once the Libra univariates are extracted from the Proving Key. Then the prover does not need to
+ update the first round_idx - 1 univariates and could release the memory. Also, use batch_invert / reduce
+ the number of divisions by 2.
+ * @param libra_univariates
+ * @param round_challenge
+ * @param round_idx
+ * @param libra_running_sum
+ * @param libra_evaluations
+ */
+ void update_libra_data(ZKSumcheckData& zk_sumcheck_data, const FF round_challenge, size_t round_idx)
+ {
+ // when round_idx = d - 1, the update is not needed
+ if (round_idx < zk_sumcheck_data.libra_univariates.size() - 1) {
+ for (auto& univariate : zk_sumcheck_data.libra_univariates) {
+ univariate *= FF(1) / FF(2);
+ };
+ // compute the evaluation \f$ \rho \cdot 2^{d-2-i} \çdot g_i(u_i) \f$
+ auto libra_evaluation = zk_sumcheck_data.libra_univariates[round_idx].evaluate(round_challenge);
+ auto next_libra_univariate = zk_sumcheck_data.libra_univariates[round_idx + 1];
+ // update the running sum by adding g_i(u_i) and subtracting (g_i(0) + g_i(1))
+ zk_sumcheck_data.libra_running_sum +=
+ -next_libra_univariate.value_at(0) - next_libra_univariate.value_at(1);
+ zk_sumcheck_data.libra_running_sum *= FF(1) / FF(2);
+
+ zk_sumcheck_data.libra_running_sum += libra_evaluation;
+ zk_sumcheck_data.libra_scaling_factor *= FF(1) / FF(2);
+
+ zk_sumcheck_data.libra_evaluations.emplace_back(libra_evaluation / zk_sumcheck_data.libra_scaling_factor);
+ } else {
+ // compute the evaluation of the last Libra univariate at the challenge u_{d-1}
+ auto libra_evaluation = zk_sumcheck_data.libra_univariates[round_idx].evaluate(round_challenge) /
+ zk_sumcheck_data.libra_scaling_factor;
+ // place the evalution into the vector of Libra evaluations
+ zk_sumcheck_data.libra_evaluations.emplace_back(libra_evaluation);
+ for (auto univariate : zk_sumcheck_data.libra_univariates) {
+ univariate *= FF(1) / zk_sumcheck_data.libra_challenge;
+ }
+ };
+ }
+
+ void update_zk_sumcheck_data(ZKSumcheckData& zk_sumcheck_data, FF round_challenge, size_t round_idx)
+ {
+ update_libra_data(zk_sumcheck_data, round_challenge, round_idx);
+ update_masking_terms_evaluations(zk_sumcheck_data, round_challenge);
+ }
+ /**
+ * @brief By the design of ZK Sumcheck, instead of claimed evaluations of witness polynomials \f$ P_1, \ldots,
+ P_{N_w} \f$, the prover sends the evaluations of the witness polynomials masked by the terms \f$ \rho_j
+ \sum_{i=0}^{d-1} u_i(1-u_i) \f$ for \f$ j= 1, \ldots N_w\f$. If the challenges satisfy the equation
+ \f$\sum_{i=0}^{d-1} u_i(1-u_i) = 0\f$, each masking term is \f$0 \f$, which could lead to the leakage of witness
+ information. The challenges satisfy this equation with probability \f$ \sim 1/|\mathbb{F}|\f$.
+ *
+ * @param multivariate_challenge
+ */
+ void check_that_evals_do_not_leak_witness_data(std::vector multivariate_challenge)
+ {
+ auto masking_term = FF(0);
+ for (auto challenge : multivariate_challenge) {
+ masking_term += challenge * (FF(1) - challenge);
+ }
+ if (masking_term == FF(0)) {
+ throw_or_abort("The evaluations of witness polynomials are not masked, because u_0(1-u_0)+...+u_{d-1} "
+ "(1-u_{d-1}) = 0 ");
+ };
+ }
};
/*! \brief Implementation of the sumcheck Verifier for statements of the form \f$\sum_{\vec \ell \in \{0,1\}^d}
pow_{\beta}(\vec \ell) \cdot F \left(P_1(\vec \ell),\ldots, P_N(\vec \ell) \right) = 0 \f$ for multilinear
@@ -339,6 +670,9 @@ template class SumcheckVerifier {
*
*/
using ClaimedEvaluations = typename Flavor::AllValues;
+ // For ZK Flavors: the verifier obtains a vector of evaluations of \f$ d \f$ univariate polynomials and uses them to
+ // compute full_honk_relation_purported_value
+ using ClaimedLibraEvaluations = typename std::vector;
using Transcript = typename Flavor::Transcript;
using RelationSeparator = typename Flavor::RelationSeparator;
@@ -389,8 +723,21 @@ template class SumcheckVerifier {
throw_or_abort("Number of variables in multivariate is 0.");
}
+ FF libra_challenge;
+ FF libra_total_sum;
+ if constexpr (Flavor::HasZK) {
+ // get the claimed sum of libra masking multivariate over the hypercube
+ libra_total_sum = transcript->template receive_from_prover("Libra:Sum");
+ // get the challenge for the ZK Sumcheck claim
+ libra_challenge = transcript->template get_challenge("Libra:Challenge");
+ }
std::vector multivariate_challenge;
multivariate_challenge.reserve(multivariate_d);
+ // if Flavor has ZK, the target total sum is corrected by Libra total sum multiplied by the Libra
+ // challenge
+ if constexpr (Flavor::HasZK) {
+ round.target_total_sum += libra_total_sum * libra_challenge;
+ };
for (size_t round_idx = 0; round_idx < CONST_PROOF_SIZE_LOG_N; round_idx++) {
// Obtain the round univariate from the transcript
std::string round_univariate_label = "Sumcheck:univariate_" + std::to_string(round_idx);
@@ -417,7 +764,6 @@ template class SumcheckVerifier {
bool checked = round.check_sum(round_univariate);
verified = verified && checked;
multivariate_challenge.emplace_back(round_challenge);
-
round.compute_next_target_sum(round_univariate, round_challenge);
pow_univariate.partially_evaluate(round_challenge);
} else {
@@ -425,29 +771,42 @@ template class SumcheckVerifier {
}
}
}
-
+ // Extract claimed evaluations of Libra univariates and compute their sum multiplied by the Libra challenge
+ ClaimedLibraEvaluations libra_evaluations(multivariate_d);
+ FF full_libra_purported_value = FF(0);
+ if constexpr (Flavor::HasZK) {
+ for (size_t idx = 0; idx < multivariate_d; idx++) {
+ libra_evaluations[idx] =
+ transcript->template receive_from_prover("libra_evaluation" + std::to_string(idx));
+ full_libra_purported_value += libra_evaluations[idx];
+ };
+ full_libra_purported_value *= libra_challenge;
+ };
// Final round
ClaimedEvaluations purported_evaluations;
auto transcript_evaluations =
transcript->template receive_from_prover>("Sumcheck:evaluations");
-
for (auto [eval, transcript_eval] : zip_view(purported_evaluations.get_all(), transcript_evaluations)) {
eval = transcript_eval;
}
-
- FF full_honk_relation_purported_value = round.compute_full_honk_relation_purported_value(
- purported_evaluations, relation_parameters, pow_univariate, alpha);
-
- bool checked = false;
+ // Evaluate the Honk relation at the point (u_0, ..., u_{d-1}) using claimed evaluations of prover polynomials.
+ // In ZK Flavors, the evaluation is corrected by full_libra_purported_value
+ FF full_honk_purported_value = round.compute_full_honk_relation_purported_value(
+ purported_evaluations, relation_parameters, pow_univariate, alpha, full_libra_purported_value);
+ bool final_check(false);
//! [Final Verification Step]
if constexpr (IsRecursiveFlavor) {
- checked = (full_honk_relation_purported_value.get_value() == round.target_total_sum.get_value());
+ final_check = (full_honk_purported_value.get_value() == round.target_total_sum.get_value());
} else {
- checked = (full_honk_relation_purported_value == round.target_total_sum);
+ final_check = (full_honk_purported_value == round.target_total_sum);
+ }
+ verified = final_check && verified;
+ // For ZK Flavors: the evaluations of Libra univariates are included in the Sumcheck Output
+ if constexpr (!Flavor::HasZK) {
+ return SumcheckOutput{ multivariate_challenge, purported_evaluations, verified };
+ } else {
+ return SumcheckOutput{ multivariate_challenge, purported_evaluations, libra_evaluations, verified };
}
- verified = verified && checked;
- //! [Final Verification Step]
- return SumcheckOutput{ multivariate_challenge, purported_evaluations, verified };
};
};
} // namespace bb
diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.test.cpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.test.cpp
index ebbb6b4e1917..cc38be1383a0 100644
--- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.test.cpp
+++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.test.cpp
@@ -7,189 +7,179 @@
#include "barretenberg/relations/permutation_relation.hpp"
#include "barretenberg/relations/ultra_arithmetic_relation.hpp"
#include "barretenberg/stdlib_circuit_builders/plookup_tables/fixed_base/fixed_base.hpp"
+#include "barretenberg/stdlib_circuit_builders/ultra_flavor.hpp"
+#include "barretenberg/stdlib_circuit_builders/ultra_zk_flavor.hpp"
#include "barretenberg/transcript/transcript.hpp"
-
#include
using namespace bb;
namespace {
-using Flavor = UltraFlavor;
-using FF = typename Flavor::FF;
-using Polynomial = Polynomial;
-using ProverPolynomials = typename Flavor::ProverPolynomials;
-using RelationSeparator = Flavor::RelationSeparator;
-const size_t NUM_POLYNOMIALS = Flavor::NUM_ALL_ENTITIES;
-
-Polynomial random_poly(size_t size)
-{
- auto poly = Polynomial(size);
- for (auto& coeff : poly) {
- coeff = FF::random_element();
+template class SumcheckTests : public ::testing::Test {
+ public:
+ using FF = typename Flavor::FF;
+ using ProverPolynomials = typename Flavor::ProverPolynomials;
+ using RelationSeparator = Flavor::RelationSeparator;
+ const size_t NUM_POLYNOMIALS = Flavor::NUM_ALL_ENTITIES;
+ static void SetUpTestSuite() { bb::srs::init_crs_factory("../srs_db/ignition"); }
+
+ Polynomial random_poly(size_t size)
+ {
+ auto poly = bb::Polynomial(size);
+ for (auto& coeff : poly) {
+ coeff = FF::random_element();
+ }
+ return poly;
}
- return poly;
-}
-ProverPolynomials construct_ultra_full_polynomials(auto& input_polynomials)
-{
- ProverPolynomials full_polynomials;
- for (auto [full_poly, input_poly] : zip_view(full_polynomials.get_all(), input_polynomials)) {
- full_poly = input_poly.share();
+ ProverPolynomials construct_ultra_full_polynomials(auto& input_polynomials)
+ {
+ ProverPolynomials full_polynomials;
+ for (auto [full_poly, input_poly] : zip_view(full_polynomials.get_all(), input_polynomials)) {
+ full_poly = input_poly.share();
+ }
+ return full_polynomials;
}
- return full_polynomials;
-}
-} // namespace
-class SumcheckTests : public ::testing::Test {
- protected:
- static void SetUpTestSuite() { bb::srs::init_crs_factory("../srs_db/ignition"); }
-};
+ void test_polynomial_normalization()
+ {
+ // TODO(#225)(Cody): We should not use real constants like this in the tests, at least not in so many of them.
+ const size_t multivariate_d(3);
+ const size_t multivariate_n(1 << multivariate_d);
-TEST_F(SumcheckTests, PolynomialNormalization)
-{
- // TODO(#225)(Cody): We should not use real constants like this in the tests, at least not in so many of them.
- const size_t multivariate_d(3);
- const size_t multivariate_n(1 << multivariate_d);
-
- // Randomly construct the prover polynomials that are input to Sumcheck.
- // Note: ProverPolynomials are defined as spans so the polynomials they point to need to exist in memory.
- std::array, NUM_POLYNOMIALS> random_polynomials;
- for (auto& poly : random_polynomials) {
- poly = random_poly(multivariate_n);
- }
- auto full_polynomials = construct_ultra_full_polynomials(random_polynomials);
+ // Randomly construct the prover polynomials that are input to Sumcheck.
+ // Note: ProverPolynomials are defined as spans so the polynomials they point to need to exist in memory.
+ std::vector> random_polynomials(NUM_POLYNOMIALS);
+ for (auto& poly : random_polynomials) {
+ poly = random_poly(multivariate_n);
+ }
+ auto full_polynomials = construct_ultra_full_polynomials(random_polynomials);
- info(full_polynomials.w_l[0]);
- info(full_polynomials.w_l[1]);
- info(full_polynomials.w_l[2]);
- info(full_polynomials.w_l[3]);
+ auto transcript = Flavor::Transcript::prover_init_empty();
- auto transcript = Flavor::Transcript::prover_init_empty();
+ auto sumcheck = SumcheckProver(multivariate_n, transcript);
+ RelationSeparator alpha;
+ for (size_t idx = 0; idx < alpha.size(); idx++) {
+ alpha[idx] = transcript->template get_challenge("Sumcheck:alpha_" + std::to_string(idx));
+ }
- auto sumcheck = SumcheckProver(multivariate_n, transcript);
- RelationSeparator alpha;
- for (size_t idx = 0; idx < alpha.size(); idx++) {
- alpha[idx] = transcript->template get_challenge("Sumcheck:alpha_" + std::to_string(idx));
- }
+ std::vector gate_challenges(multivariate_d);
+ for (size_t idx = 0; idx < multivariate_d; idx++) {
+ gate_challenges[idx] =
+ transcript->template get_challenge("Sumcheck:gate_challenge_" + std::to_string(idx));
+ }
+ auto output = sumcheck.prove(full_polynomials, {}, alpha, gate_challenges);
+
+ FF u_0 = output.challenge[0];
+ FF u_1 = output.challenge[1];
+ FF u_2 = output.challenge[2];
+
+ /* sumcheck.prove() terminates with sumcheck.multivariates.folded_polynoimals as an array such that
+ * sumcheck.multivariates.folded_polynoimals[i][0] is the evaluatioin of the i'th multivariate at the vector of
+ challenges u_i. What does this mean?
+
+ Here we show that if the multivariate is F(X0, X1, X2) defined as above, then what we get is F(u0, u1, u2) and
+ not, say F(u2, u1, u0). This is in accordance with Adrian's thesis (cf page 9).
+ */
+
+ // Get the values of the Lagrange basis polys L_i defined
+ // by: L_i(v) = 1 if i = v, 0 otherwise, for v from 0 to 7.
+ FF one{ 1 };
+ // clang-format off
+ FF l_0 = (one - u_0) * (one - u_1) * (one - u_2);
+ FF l_1 = (u_0) * (one - u_1) * (one - u_2);
+ FF l_2 = (one - u_0) * (u_1) * (one - u_2);
+ FF l_3 = (u_0) * (u_1) * (one - u_2);
+ FF l_4 = (one - u_0) * (one - u_1) * (u_2);
+ FF l_5 = (u_0) * (one - u_1) * (u_2);
+ FF l_6 = (one - u_0) * (u_1) * (u_2);
+ FF l_7 = (u_0) * (u_1) * (u_2);
+ // clang-format on
+ FF hand_computed_value;
+ for (auto [full_poly, partial_eval_poly] :
+ zip_view(full_polynomials.get_all(), sumcheck.partially_evaluated_polynomials.get_all())) {
+ // full_polynomials[0][0] = w_l[0], full_polynomials[1][1] = w_r[1], and so on.
+ hand_computed_value = l_0 * full_poly[0] + l_1 * full_poly[1] + l_2 * full_poly[2] + l_3 * full_poly[3] +
+ l_4 * full_poly[4] + l_5 * full_poly[5] + l_6 * full_poly[6] + l_7 * full_poly[7];
+ EXPECT_EQ(hand_computed_value, partial_eval_poly[0]);
+ }
- std::vector gate_challenges(multivariate_d);
- for (size_t idx = 0; idx < multivariate_d; idx++) {
- gate_challenges[idx] = transcript->template get_challenge("Sumcheck:gate_challenge_" + std::to_string(idx));
- }
- auto output = sumcheck.prove(full_polynomials, {}, alpha, gate_challenges);
-
- FF u_0 = output.challenge[0];
- FF u_1 = output.challenge[1];
- FF u_2 = output.challenge[2];
-
- /* sumcheck.prove() terminates with sumcheck.multivariates.folded_polynoimals as an array such that
- * sumcheck.multivariates.folded_polynoimals[i][0] is the evaluatioin of the i'th multivariate at the vector of
- challenges u_i. What does this mean?
-
- Here we show that if the multivariate is F(X0, X1, X2) defined as above, then what we get is F(u0, u1, u2) and
- not, say F(u2, u1, u0). This is in accordance with Adrian's thesis (cf page 9).
- */
-
- // Get the values of the Lagrange basis polys L_i defined
- // by: L_i(v) = 1 if i = v, 0 otherwise, for v from 0 to 7.
- FF one{ 1 };
- // clang-format off
- FF l_0 = (one - u_0) * (one - u_1) * (one - u_2);
- FF l_1 = ( u_0) * (one - u_1) * (one - u_2);
- FF l_2 = (one - u_0) * ( u_1) * (one - u_2);
- FF l_3 = ( u_0) * ( u_1) * (one - u_2);
- FF l_4 = (one - u_0) * (one - u_1) * ( u_2);
- FF l_5 = ( u_0) * (one - u_1) * ( u_2);
- FF l_6 = (one - u_0) * ( u_1) * ( u_2);
- FF l_7 = ( u_0) * ( u_1) * ( u_2);
- // clang-format on
- FF hand_computed_value;
- for (auto [full_poly, partial_eval_poly] :
- zip_view(full_polynomials.get_all(), sumcheck.partially_evaluated_polynomials.get_all())) {
- // full_polynomials[0][0] = w_l[0], full_polynomials[1][1] = w_r[1], and so on.
- hand_computed_value = l_0 * full_poly[0] + l_1 * full_poly[1] + l_2 * full_poly[2] + l_3 * full_poly[3] +
- l_4 * full_poly[4] + l_5 * full_poly[5] + l_6 * full_poly[6] + l_7 * full_poly[7];
- EXPECT_EQ(hand_computed_value, partial_eval_poly[0]);
+ // We can also check the correctness of the multilinear evaluations produced by Sumcheck by directly evaluating
+ // the full polynomials at challenge u via the evaluate_mle() function
+ std::vector u_challenge = { u_0, u_1, u_2 };
+ for (auto [full_poly, claimed_eval] :
+ zip_view(full_polynomials.get_all(), output.claimed_evaluations.get_all())) {
+ Polynomial poly(full_poly);
+ auto v_expected = poly.evaluate_mle(u_challenge);
+ EXPECT_EQ(v_expected, claimed_eval);
+ }
}
- // We can also check the correctness of the multilinear evaluations produced by Sumcheck by directly evaluating the
- // full polynomials at challenge u via the evaluate_mle() function
- std::vector u_challenge = { u_0, u_1, u_2 };
- for (auto [full_poly, claimed_eval] : zip_view(full_polynomials.get_all(), output.claimed_evaluations.get_all())) {
- bb::Polynomial poly(full_poly);
- auto v_expected = poly.evaluate_mle(u_challenge);
- EXPECT_EQ(v_expected, claimed_eval);
- }
-}
+ void test_prover()
+ {
+ const size_t multivariate_d(2);
+ const size_t multivariate_n(1 << multivariate_d);
-TEST_F(SumcheckTests, Prover)
-{
- const size_t multivariate_d(2);
- const size_t multivariate_n(1 << multivariate_d);
-
- // Randomly construct the prover polynomials that are input to Sumcheck.
- // Note: ProverPolynomials are defined as spans so the polynomials they point to need to exist in memory.
- std::array, NUM_POLYNOMIALS> random_polynomials;
- for (auto& poly : random_polynomials) {
- poly = random_poly(multivariate_n);
- }
- auto full_polynomials = construct_ultra_full_polynomials(random_polynomials);
+ // Randomly construct the prover polynomials that are input to Sumcheck.
+ // Note: ProverPolynomials are defined as spans so the polynomials they point to need to exist in memory.
+ std::vector> random_polynomials(NUM_POLYNOMIALS);
+ for (auto& poly : random_polynomials) {
+ poly = random_poly(multivariate_n);
+ }
+ auto full_polynomials = construct_ultra_full_polynomials(random_polynomials);
- auto transcript = Flavor::Transcript::prover_init_empty();
+ auto transcript = Flavor::Transcript::prover_init_empty();
- auto sumcheck = SumcheckProver(multivariate_n, transcript);
+ auto sumcheck = SumcheckProver(multivariate_n, transcript);
- RelationSeparator alpha;
- for (size_t idx = 0; idx < alpha.size(); idx++) {
- alpha[idx] = transcript->template get_challenge("Sumcheck:alpha_" + std::to_string(idx));
- }
+ RelationSeparator alpha;
+ for (size_t idx = 0; idx < alpha.size(); idx++) {
+ alpha[idx] = transcript->template get_challenge("Sumcheck:alpha_" + std::to_string(idx));
+ }
- std::vector gate_challenges(multivariate_d);
- for (size_t idx = 0; idx < gate_challenges.size(); idx++) {
- gate_challenges[idx] = transcript->template get_challenge("Sumcheck:gate_challenge_" + std::to_string(idx));
- }
- auto output = sumcheck.prove(full_polynomials, {}, alpha, gate_challenges);
- FF u_0 = output.challenge[0];
- FF u_1 = output.challenge[1];
- std::vector expected_values;
- for (auto& polynomial_ptr : full_polynomials.get_all()) {
- auto& polynomial = polynomial_ptr;
- // using knowledge of inputs here to derive the evaluation
- FF expected_lo = polynomial[0] * (FF(1) - u_0) + polynomial[1] * u_0;
- expected_lo *= (FF(1) - u_1);
- FF expected_hi = polynomial[2] * (FF(1) - u_0) + polynomial[3] * u_0;
- expected_hi *= u_1;
- expected_values.emplace_back(expected_lo + expected_hi);
- }
+ std::vector gate_challenges(multivariate_d);
+ for (size_t idx = 0; idx < gate_challenges.size(); idx++) {
+ gate_challenges[idx] =
+ transcript->template get_challenge("Sumcheck:gate_challenge_" + std::to_string(idx));
+ }
+ auto output = sumcheck.prove(full_polynomials, {}, alpha, gate_challenges);
+ FF u_0 = output.challenge[0];
+ FF u_1 = output.challenge[1];
+ std::vector expected_values;
+ for (auto& polynomial_ptr : full_polynomials.get_all()) {
+ auto& polynomial = polynomial_ptr;
+ // using knowledge of inputs here to derive the evaluation
+ FF expected_lo = polynomial[0] * (FF(1) - u_0) + polynomial[1] * u_0;
+ expected_lo *= (FF(1) - u_1);
+ FF expected_hi = polynomial[2] * (FF(1) - u_0) + polynomial[3] * u_0;
+ expected_hi *= u_1;
+ expected_values.emplace_back(expected_lo + expected_hi);
+ }
- for (auto [eval, expected] : zip_view(output.claimed_evaluations.get_all(), expected_values)) {
- eval = expected;
+ for (auto [eval, expected] : zip_view(output.claimed_evaluations.get_all(), expected_values)) {
+ eval = expected;
+ }
}
-}
-// TODO(#225): make the inputs to this test more interesting, e.g. non-trivial permutations
-TEST_F(SumcheckTests, ProverAndVerifierSimple)
-{
- auto run_test = [](bool expect_verified) {
+ // TODO(#225): make the inputs to this test more interesting, e.g. non-trivial permutations
+ void test_prover_verifier_flow()
+ {
const size_t multivariate_d(2);
const size_t multivariate_n(1 << multivariate_d);
// Construct prover polynomials where each is the zero polynomial.
// Note: ProverPolynomials are defined as spans so the polynomials they point to need to exist in memory.
- std::array, NUM_POLYNOMIALS> zero_polynomials;
+ std::vector> zero_polynomials(NUM_POLYNOMIALS);
for (auto& poly : zero_polynomials) {
poly = bb::Polynomial(multivariate_n);
}
auto full_polynomials = construct_ultra_full_polynomials(zero_polynomials);
// Add some non-trivial values to certain polynomials so that the arithmetic relation will have non-trivial
- // contribution. Note: since all other polynomials are set to 0, all other relations are trivially satisfied.
+ // contribution. Note: since all other polynomials are set to 0, all other relations are trivially
+ // satisfied.
std::array w_l;
- if (expect_verified) {
- w_l = { 0, 1, 2, 0 };
- } else {
- w_l = { 0, 0, 2, 0 };
- }
+ w_l = { 0, 1, 2, 0 };
std::array w_r = { 0, 1, 2, 0 };
std::array w_o = { 0, 2, 4, 0 };
std::array w_4 = { 0, 0, 0, 0 };
@@ -218,7 +208,87 @@ TEST_F(SumcheckTests, ProverAndVerifierSimple)
.gamma = FF::random_element(),
.public_input_delta = FF::one(),
};
+ auto prover_transcript = Flavor::Transcript::prover_init_empty();
+ auto sumcheck_prover = SumcheckProver(multivariate_n, prover_transcript);
+
+ RelationSeparator prover_alpha;
+ for (size_t idx = 0; idx < prover_alpha.size(); idx++) {
+ prover_alpha[idx] = prover_transcript->template get_challenge("Sumcheck:alpha_" + std::to_string(idx));
+ }
+ std::vector prover_gate_challenges(multivariate_d);
+ for (size_t idx = 0; idx < multivariate_d; idx++) {
+ prover_gate_challenges[idx] =
+ prover_transcript->template get_challenge("Sumcheck:gate_challenge_" + std::to_string(idx));
+ }
+ auto output =
+ sumcheck_prover.prove(full_polynomials, relation_parameters, prover_alpha, prover_gate_challenges);
+
+ auto verifier_transcript = Flavor::Transcript::verifier_init_empty(prover_transcript);
+
+ auto sumcheck_verifier = SumcheckVerifier(multivariate_d, verifier_transcript);
+ RelationSeparator verifier_alpha;
+ for (size_t idx = 0; idx < verifier_alpha.size(); idx++) {
+ verifier_alpha[idx] =
+ verifier_transcript->template get_challenge("Sumcheck:alpha_" + std::to_string(idx));
+ }
+ std::vector verifier_gate_challenges(multivariate_d);
+ for (size_t idx = 0; idx < multivariate_d; idx++) {
+ verifier_gate_challenges[idx] =
+ verifier_transcript->template get_challenge("Sumcheck:gate_challenge_" + std::to_string(idx));
+ }
+ auto verifier_output = sumcheck_verifier.verify(relation_parameters, verifier_alpha, verifier_gate_challenges);
+
+ auto verified = verifier_output.verified.value();
+
+ EXPECT_EQ(verified, true);
+ };
+
+ void test_failure_prover_verifier_flow()
+ {
+ const size_t multivariate_d(2);
+ const size_t multivariate_n(1 << multivariate_d);
+
+ // Construct prover polynomials where each is the zero polynomial.
+ // Note: ProverPolynomials are defined as spans so the polynomials they point to need to exist in memory.
+ std::vector> zero_polynomials(NUM_POLYNOMIALS);
+ for (auto& poly : zero_polynomials) {
+ poly = bb::Polynomial(multivariate_n);
+ }
+ auto full_polynomials = construct_ultra_full_polynomials(zero_polynomials);
+ // Add some non-trivial values to certain polynomials so that the arithmetic relation will have non-trivial
+ // contribution. Note: since all other polynomials are set to 0, all other relations are trivially
+ // satisfied.
+ std::array w_l;
+ w_l = { 0, 0, 2, 0 }; // this witness value makes the circuit from previous test invalid
+ std::array w_r = { 0, 1, 2, 0 };
+ std::array w_o = { 0, 2, 4, 0 };
+ std::array w_4 = { 0, 0, 0, 0 };
+ std::array q_m = { 0, 0, 1, 0 };
+ std::array q_l = { 0, 1, 0, 0 };
+ std::array q_r = { 0, 1, 0, 0 };
+ std::array q_o = { 0, -1, -1, 0 };
+ std::array q_c = { 0, 0, 0, 0 };
+ std::array q_arith = { 0, 1, 1, 0 };
+ // Setting all of these to 0 ensures the GrandProductRelation is satisfied
+
+ full_polynomials.w_l = bb::Polynomial(w_l);
+ full_polynomials.w_r = bb::Polynomial(w_r);
+ full_polynomials.w_o = bb::Polynomial(w_o);
+ full_polynomials.w_4 = bb::Polynomial(w_4);
+ full_polynomials.q_m = bb::Polynomial(q_m);
+ full_polynomials.q_l = bb::Polynomial(q_l);
+ full_polynomials.q_r = bb::Polynomial(q_r);
+ full_polynomials.q_o = bb::Polynomial(q_o);
+ full_polynomials.q_c = bb::Polynomial(q_c);
+ full_polynomials.q_arith = bb::Polynomial(q_arith);
+
+ // Set aribitrary random relation parameters
+ RelationParameters relation_parameters{
+ .beta = FF::random_element(),
+ .gamma = FF::random_element(),
+ .public_input_delta = FF::one(),
+ };
auto prover_transcript = Flavor::Transcript::prover_init_empty();
auto sumcheck_prover = SumcheckProver(multivariate_n, prover_transcript);
@@ -231,7 +301,8 @@ TEST_F(SumcheckTests, ProverAndVerifierSimple)
prover_gate_challenges[idx] =
prover_transcript->template get_challenge("Sumcheck:gate_challenge_" + std::to_string(idx));
}
- auto output = sumcheck_prover.prove(full_polynomials, {}, prover_alpha, prover_gate_challenges);
+ auto output =
+ sumcheck_prover.prove(full_polynomials, relation_parameters, prover_alpha, prover_gate_challenges);
auto verifier_transcript = Flavor::Transcript::verifier_init_empty(prover_transcript);
@@ -250,9 +321,38 @@ TEST_F(SumcheckTests, ProverAndVerifierSimple)
auto verified = verifier_output.verified.value();
- EXPECT_EQ(verified, expect_verified);
+ EXPECT_EQ(verified, false);
};
+};
+
+// Define the FlavorTypes
+using FlavorTypes = testing::Types;
- run_test(/* expect_verified=*/true);
- run_test(/* expect_verified=*/false);
+TYPED_TEST_SUITE(SumcheckTests, FlavorTypes);
+
+#define SKIP_IF_ZK() \
+ if (std::is_same::value) { \
+ GTEST_SKIP() << "Skipping test for UltraFlavorWithZK"; \
+ }
+
+TYPED_TEST(SumcheckTests, PolynomialNormalization)
+{
+ SKIP_IF_ZK();
+ this->test_polynomial_normalization();
}
+// Test the prover
+TYPED_TEST(SumcheckTests, Prover)
+{
+ this->test_prover();
+}
+// Tests the prover-verifier flow
+TYPED_TEST(SumcheckTests, ProverAndVerifierSimple)
+{
+ this->test_prover_verifier_flow();
+}
+// This tests is fed an invalid circuit and checks that the verifier would output false.
+TYPED_TEST(SumcheckTests, ProverAndVerifierSimpleFailure)
+{
+ this->test_failure_prover_verifier_flow();
+}
+} // namespace
diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_output.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_output.hpp
index 9abd4a2feb02..da4b98ce43ba 100644
--- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_output.hpp
+++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_output.hpp
@@ -1,5 +1,5 @@
#pragma once
-
+#include "barretenberg/flavor/flavor.hpp"
#include
#include
#include
@@ -11,15 +11,34 @@ namespace bb {
* =(u_0,\ldots, u_{d-1})\f$. These are computed by \ref bb::SumcheckProver< Flavor > "Sumcheck Prover" and need to be
* checked using Zeromorph.
*/
-template struct SumcheckOutput {
+template struct SumcheckOutput {
using FF = typename Flavor::FF;
using ClaimedEvaluations = typename Flavor::AllValues;
// \f$ \vec u = (u_0, ..., u_{d-1}) \f$
std::vector challenge;
- // Evaluations in \f$ \vec u \f$ of the polynomials used in Sumcheck
+ // Evaluations at \f$ \vec u \f$ of the polynomials used in Sumcheck
ClaimedEvaluations claimed_evaluations;
// Whether or not the evaluations of multilinear polynomials \f$ P_1, \ldots, P_N \f$ and final Sumcheck evaluation
// have been confirmed
std::optional verified = false; // optional b/c this struct is shared by the Prover/Verifier
};
+/**
+ * @brief A modification of SumcheckOutput required by ZK Flavors where a vector of evaluations of Libra univariates is
+ * included.
+ *
+ * @tparam Flavor
+ */
+template struct SumcheckOutput>> {
+ using FF = typename Flavor::FF;
+ using ClaimedEvaluations = typename Flavor::AllValues;
+ // \f$ \vec u = (u_0, ..., u_{d-1}) \f$
+ std::vector challenge;
+ // Evaluations at \f$ \vec u \f$ of the polynomials used in Sumcheck
+ ClaimedEvaluations claimed_evaluations;
+ // Include ClaimedLibraEvaluations conditioned on FlavorHasZK concept
+ std::vector claimed_libra_evaluations;
+ // Whether or not the evaluations of multilinear polynomials \f$ P_1, \ldots, P_N \f$ and final Sumcheck evaluation
+ // have been confirmed
+ std::optional verified = false; // Optional b/c this struct is shared by the Prover/Verifier
+};
} // namespace bb
diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp
index 6b014b663789..14ccd07c72fc 100644
--- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp
+++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp
@@ -6,6 +6,7 @@
#include "barretenberg/relations/relation_types.hpp"
#include "barretenberg/relations/utils.hpp"
#include "barretenberg/stdlib/primitives/bool/bool.hpp"
+#include "zk_sumcheck_data.hpp"
namespace bb {
@@ -59,9 +60,8 @@ template class SumcheckProverRound {
* "MAX_PARTIAL_RELATION_LENGTH + 1".
*/
static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH;
-
+ using SumcheckRoundUnivariate = bb::Univariate;
SumcheckTupleOfTuplesOfUnivariates univariate_accumulators;
-
// Prover constructor
SumcheckProverRound(size_t initial_round_size)
: round_size(initial_round_size)
@@ -87,7 +87,9 @@ template class SumcheckProverRound {
input in the first round, or from the \ref multivariates table. Using general method
\ref bb::Univariate::extend_to "extend_to", the evaluations of these polynomials are extended from the
domain \f$ \{0,1\} \f$ to the domain \f$ \{0,\ldots, D\} \f$ required for the computation of the round univariate.
-
+ * In the case when witness polynomials are masked (ZK Flavors), this method has to distinguish between witness and
+ * non-witness polynomials. The witness univariates obtained from witness multilinears are corrected by a masking
+ * quadratic term extended to the same length MAX_PARTIAL_RELATION_LENGTH.
* Should only be called externally with relation_idx equal to 0.
* In practice, #multivariates is either ProverPolynomials or PartiallyEvaluatedMultivariates.
*
@@ -98,13 +100,33 @@ template class SumcheckProverRound {
*/
template
void extend_edges(ExtendedEdges& extended_edges,
- const ProverPolynomialsOrPartiallyEvaluatedMultivariates& multivariates,
- size_t edge_idx)
+ ProverPolynomialsOrPartiallyEvaluatedMultivariates& multivariates,
+ size_t edge_idx,
+ std::optional> zk_sumcheck_data = std::nullopt)
{
- for (auto [extended_edge, multivariate] : zip_view(extended_edges.get_all(), multivariates.get_all())) {
- bb::Univariate edge({ multivariate[edge_idx], multivariate[edge_idx + 1] });
- extended_edge = edge.template extend_to();
- }
+
+ if constexpr (!Flavor::HasZK) {
+ for (auto [extended_edge, multivariate] : zip_view(extended_edges.get_all(), multivariates.get_all())) {
+ bb::Univariate edge({ multivariate[edge_idx], multivariate[edge_idx + 1] });
+ extended_edge = edge.template extend_to();
+ }
+ } else {
+ // extend edges of witness polynomials and add correcting terms
+ for (auto [extended_edge, multivariate, masking_univariate] :
+ zip_view(extended_edges.get_all_witnesses(),
+ multivariates.get_all_witnesses(),
+ zk_sumcheck_data.value().masking_terms_evaluations)) {
+ bb::Univariate edge({ multivariate[edge_idx], multivariate[edge_idx + 1] });
+ extended_edge = edge.template extend_to();
+ extended_edge += masking_univariate;
+ };
+ // extend edges of public polynomials
+ for (auto [extended_edge, multivariate] :
+ zip_view(extended_edges.get_non_witnesses(), multivariates.get_non_witnesses())) {
+ bb::Univariate edge({ multivariate[edge_idx], multivariate[edge_idx + 1] });
+ extended_edge = edge.template extend_to();
+ };
+ };
}
/**
@@ -130,11 +152,13 @@ template class SumcheckProverRound {
method \ref extend_and_batch_univariates "extend and batch univariates".
*/
template
- bb::Univariate compute_univariate(
+ SumcheckRoundUnivariate compute_univariate(
+ const size_t round_idx,
ProverPolynomialsOrPartiallyEvaluatedMultivariates& polynomials,
const bb::RelationParameters& relation_parameters,
const bb::PowPolynomial& pow_polynomial,
- const RelationSeparator alpha)
+ const RelationSeparator alpha,
+ std::optional> zk_sumcheck_data = std::nullopt) // only submitted when Flavor HasZK
{
BB_OP_COUNT_TIME();
@@ -162,8 +186,11 @@ template class SumcheckProverRound {
size_t end = (thread_idx + 1) * iterations_per_thread;
for (size_t edge_idx = start; edge_idx < end; edge_idx += 2) {
- extend_edges(extended_edges[thread_idx], polynomials, edge_idx);
-
+ if constexpr (!Flavor::HasZK) {
+ extend_edges(extended_edges[thread_idx], polynomials, edge_idx);
+ } else {
+ extend_edges(extended_edges[thread_idx], polynomials, edge_idx, zk_sumcheck_data);
+ }
// Compute the \f$ \ell \f$-th edge's univariate contribution,
// scale it by the corresponding \f$ pow_{\beta} \f$ contribution and add it to the accumulators for \f$
// \tilde{S}^i(X_i) \f$. If \f$ \ell \f$'s binary representation is given by \f$ (\ell_{i+1},\ldots,
@@ -180,10 +207,19 @@ template class SumcheckProverRound {
for (auto& accumulators : thread_univariate_accumulators) {
Utils::add_nested_tuples(univariate_accumulators, accumulators);
}
-
+ // For ZK Flavors: The evaluations of the round univariates are masked by the evaluations of Libra univariates
+ if constexpr (Flavor::HasZK) {
+ auto libra_round_univariate = compute_libra_round_univariate(zk_sumcheck_data.value(), round_idx);
+ // Batch the univariate contributions from each sub-relation to obtain the round univariate
+ auto round_univariate =
+ batch_over_relations(univariate_accumulators, alpha, pow_polynomial);
+ // Mask the round univariate
+ return round_univariate + libra_round_univariate;
+ }
// Batch the univariate contributions from each sub-relation to obtain the round univariate
- return batch_over_relations>(
- univariate_accumulators, alpha, pow_polynomial);
+ else {
+ return batch_over_relations(univariate_accumulators, alpha, pow_polynomial);
+ }
}
/**
@@ -263,6 +299,32 @@ template class SumcheckProverRound {
Utils::apply_to_tuple_of_tuples(tuple, extend_and_sum);
}
+ /**
+ * @brief Compute Libra round univariate expressed given by the formula
+ \f{align}{
+ \texttt{libra_round_univariate}_i(k) =
+ \rho \cdot 2^{d-1-i} \left(\sum_{j = 0}^{i-1} g_j(u_{j}) + g_{i,k}+
+ \sum_{j=i+1}^{d-1}\left(g_{j,0}+g_{j,1}\right)\right)
+ = \texttt{libra_univariates}_{i}(k) + \texttt{libra_running_sum}
+ \f}.
+ *
+ * @param zk_sumcheck_data
+ * @param round_idx
+ */
+ static SumcheckRoundUnivariate compute_libra_round_univariate(ZKSumcheckData zk_sumcheck_data,
+ size_t round_idx)
+ {
+ SumcheckRoundUnivariate libra_round_univariate;
+ // select the i'th column of Libra book-keeping table
+ auto current_column = zk_sumcheck_data.libra_univariates[round_idx];
+ // the evaluation of Libra round univariate at k=0...D are equal to \f$\texttt{libra_univariates}_{i}(k)\f$
+ // corrected by the Libra running sum
+ for (size_t idx = 0; idx < BATCHED_RELATION_PARTIAL_LENGTH; ++idx) {
+ libra_round_univariate.value_at(idx) = current_column.value_at(idx) + zk_sumcheck_data.libra_running_sum;
+ };
+ return libra_round_univariate;
+ }
+
private:
/**
* @brief In Round \f$ i \f$, for a given point \f$ \vec \ell \in \{0,1\}^{d-1 - i}\f$, calculate the contribution
@@ -295,7 +357,6 @@ template class SumcheckProverRound {
const FF& scaling_factor)
{
using Relation = std::tuple_element_t;
-
// Check if the relation is skippable to speed up accumulation
if constexpr (!isSkippable) {
// If not, accumulate normally
@@ -310,7 +371,6 @@ template class SumcheckProverRound {
scaling_factor);
}
}
-
// Repeat for the next relation.
if constexpr (relation_idx + 1 < NUM_RELATIONS) {
accumulate_relation_univariates(
@@ -340,6 +400,7 @@ template class SumcheckVerifierRound {
public:
using FF = typename Flavor::FF;
using ClaimedEvaluations = typename Flavor::AllValues;
+ using ClaimedLibraEvaluations = typename std::vector;
bool round_failed = false;
/**
@@ -352,6 +413,7 @@ template class SumcheckVerifierRound {
* MAX_PARTIAL_RELATION_LENGTH "MAX_PARTIAL_RELATION_LENGTH + 1".
*/
static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH;
+ using SumcheckRoundUnivariate = bb::Univariate;
FF target_total_sum = 0;
@@ -370,7 +432,7 @@ template class SumcheckVerifierRound {
* @param univariate Round univariate \f$\tilde{S}^{i}\f$ represented by its evaluations over \f$0,\ldots,D\f$.
*
*/
- bool check_sum(bb::Univariate& univariate)
+ bool check_sum(SumcheckRoundUnivariate& univariate)
{
FF total_sum = univariate.value_at(0) + univariate.value_at(1);
// TODO(#673): Conditionals like this can go away once native verification is is just recursive verification
@@ -437,7 +499,7 @@ template class SumcheckVerifierRound {
* @param round_challenge \f$ u_i\f$
* @return FF \f$ \sigma_{i+1} = \tilde{S}^i(u_i)\f$
*/
- FF compute_next_target_sum(bb::Univariate& univariate, FF& round_challenge)
+ FF compute_next_target_sum(SumcheckRoundUnivariate& univariate, FF& round_challenge)
{
// Evaluate \f$\tilde{S}^{i}(u_{i}) \f$
target_total_sum = univariate.evaluate(round_challenge);
@@ -473,7 +535,8 @@ template class SumcheckVerifierRound {
FF compute_full_honk_relation_purported_value(ClaimedEvaluations purported_evaluations,
const bb::RelationParameters& relation_parameters,
const bb::PowPolynomial& pow_polynomial,
- const RelationSeparator alpha)
+ const RelationSeparator alpha,
+ std::optional full_libra_purported_value = std::nullopt)
{
// The verifier should never skip computation of contributions from any relation
Utils::template accumulate_relation_evaluations_without_skipping<>(
@@ -482,6 +545,9 @@ template class SumcheckVerifierRound {
FF running_challenge{ 1 };
FF output{ 0 };
Utils::scale_and_batch_elements(relation_evaluations, alpha, running_challenge, output);
+ if constexpr (Flavor::HasZK) {
+ output += full_libra_purported_value.value();
+ };
return output;
}
};
diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/zk_sumcheck_data.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/zk_sumcheck_data.hpp
new file mode 100644
index 000000000000..f438ab379162
--- /dev/null
+++ b/barretenberg/cpp/src/barretenberg/sumcheck/zk_sumcheck_data.hpp
@@ -0,0 +1,53 @@
+#pragma once
+
+#include
+#include
+#include
+
+namespace bb {
+
+/**
+ * @brief This structure is created to contain various polynomials and constants required by ZK Sumcheck.
+ *
+ */
+template struct ZKSumcheckData {
+ using FF = typename Flavor::FF;
+ /**
+ * @brief The total algebraic degree of the Sumcheck relation \f$ F \f$ as a polynomial in Prover Polynomials
+ * \f$P_1,\ldots, P_N\f$.
+ */
+ static constexpr size_t MAX_PARTIAL_RELATION_LENGTH = Flavor::MAX_PARTIAL_RELATION_LENGTH;
+ // The number of all witnesses including shifts and derived witnesses from flavors that have ZK,
+ // otherwise, set this constant to 0.
+ /**
+ * @brief The total algebraic degree of the Sumcheck relation \f$ F \f$ as a polynomial in Prover Polynomials
+ * \f$P_1,\ldots, P_N\f$ incremented by 1, i.e. it is equal \ref MAX_PARTIAL_RELATION_LENGTH
+ * "MAX_PARTIAL_RELATION_LENGTH + 1".
+ */
+ static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH;
+ // Initialize the length of the array of evaluation masking scalars as 0 for non-ZK Flavors and as
+ // NUM_ALL_WITNESS_ENTITIES for ZK FLavors
+ static constexpr size_t MASKING_SCALARS_LENGTH = Flavor::HasZK ? Flavor::NUM_ALL_WITNESS_ENTITIES : 0;
+ // Array of random scalars used to hide the witness info from leaking through the claimed evaluations
+ using EvalMaskingScalars = std::array;
+ // Auxiliary table that represents the evaluations of quadratic polynomials r_j * X(1-X) at 0,...,
+ // MAX_PARTIAL_RELATION_LENGTH - 1
+ using EvaluationMaskingTable = std::array, MASKING_SCALARS_LENGTH>;
+ // The size of the LibraUnivariates. We ensure that they do not take extra space when Flavor runs non-ZK
+ // Sumcheck.
+ static constexpr size_t LIBRA_UNIVARIATES_LENGTH = Flavor::HasZK ? Flavor::BATCHED_RELATION_PARTIAL_LENGTH : 0;
+ // Container for the Libra Univariates. Their number depends on the size of the circuit.
+ using LibraUnivariates = std::vector>;
+ // Container for the evaluations of Libra Univariates that have to be proven.
+ using ClaimedLibraEvaluations = std::vector;
+
+ EvalMaskingScalars eval_masking_scalars;
+ EvaluationMaskingTable masking_terms_evaluations;
+ LibraUnivariates libra_univariates;
+ FF libra_scaling_factor{ 1 };
+ FF libra_challenge;
+ FF libra_running_sum;
+ ClaimedLibraEvaluations libra_evaluations;
+};
+
+} // namespace bb
diff --git a/barretenberg/cpp/src/barretenberg/vm/avm/generated/circuit_builder.cpp b/barretenberg/cpp/src/barretenberg/vm/avm/generated/circuit_builder.cpp
index 5ddd018b6d69..7db313939c46 100644
--- a/barretenberg/cpp/src/barretenberg/vm/avm/generated/circuit_builder.cpp
+++ b/barretenberg/cpp/src/barretenberg/vm/avm/generated/circuit_builder.cpp
@@ -40,10 +40,10 @@ AvmCircuitBuilder::ProverPolynomials AvmCircuitBuilder::compute_polynomials() co
polys.main_sel_first[i] = rows[i].main_sel_first;
polys.main_zeroes[i] = rows[i].main_zeroes;
polys.powers_power_of_2[i] = rows[i].powers_power_of_2;
- polys.kernel_kernel_inputs[i] = rows[i].kernel_kernel_inputs;
- polys.kernel_kernel_value_out[i] = rows[i].kernel_kernel_value_out;
- polys.kernel_kernel_side_effect_out[i] = rows[i].kernel_kernel_side_effect_out;
- polys.kernel_kernel_metadata_out[i] = rows[i].kernel_kernel_metadata_out;
+ polys.main_kernel_inputs[i] = rows[i].main_kernel_inputs;
+ polys.main_kernel_value_out[i] = rows[i].main_kernel_value_out;
+ polys.main_kernel_side_effect_out[i] = rows[i].main_kernel_side_effect_out;
+ polys.main_kernel_metadata_out[i] = rows[i].main_kernel_metadata_out;
polys.main_calldata[i] = rows[i].main_calldata;
polys.main_returndata[i] = rows[i].main_returndata;
polys.alu_a_hi[i] = rows[i].alu_a_hi;
@@ -151,21 +151,6 @@ AvmCircuitBuilder::ProverPolynomials AvmCircuitBuilder::compute_polynomials() co
polys.keccakf1600_input[i] = rows[i].keccakf1600_input;
polys.keccakf1600_output[i] = rows[i].keccakf1600_output;
polys.keccakf1600_sel_keccakf1600[i] = rows[i].keccakf1600_sel_keccakf1600;
- polys.kernel_emit_l2_to_l1_msg_write_offset[i] = rows[i].kernel_emit_l2_to_l1_msg_write_offset;
- polys.kernel_emit_note_hash_write_offset[i] = rows[i].kernel_emit_note_hash_write_offset;
- polys.kernel_emit_nullifier_write_offset[i] = rows[i].kernel_emit_nullifier_write_offset;
- polys.kernel_emit_unencrypted_log_write_offset[i] = rows[i].kernel_emit_unencrypted_log_write_offset;
- polys.kernel_kernel_in_offset[i] = rows[i].kernel_kernel_in_offset;
- polys.kernel_kernel_out_offset[i] = rows[i].kernel_kernel_out_offset;
- polys.kernel_l1_to_l2_msg_exists_write_offset[i] = rows[i].kernel_l1_to_l2_msg_exists_write_offset;
- polys.kernel_note_hash_exist_write_offset[i] = rows[i].kernel_note_hash_exist_write_offset;
- polys.kernel_nullifier_exists_write_offset[i] = rows[i].kernel_nullifier_exists_write_offset;
- polys.kernel_nullifier_non_exists_write_offset[i] = rows[i].kernel_nullifier_non_exists_write_offset;
- polys.kernel_q_public_input_kernel_add_to_table[i] = rows[i].kernel_q_public_input_kernel_add_to_table;
- polys.kernel_q_public_input_kernel_out_add_to_table[i] = rows[i].kernel_q_public_input_kernel_out_add_to_table;
- polys.kernel_side_effect_counter[i] = rows[i].kernel_side_effect_counter;
- polys.kernel_sload_write_offset[i] = rows[i].kernel_sload_write_offset;
- polys.kernel_sstore_write_offset[i] = rows[i].kernel_sstore_write_offset;
polys.main_abs_da_rem_gas_hi[i] = rows[i].main_abs_da_rem_gas_hi;
polys.main_abs_da_rem_gas_lo[i] = rows[i].main_abs_da_rem_gas_lo;
polys.main_abs_l2_rem_gas_hi[i] = rows[i].main_abs_l2_rem_gas_hi;
@@ -180,6 +165,10 @@ AvmCircuitBuilder::ProverPolynomials AvmCircuitBuilder::compute_polynomials() co
polys.main_dyn_da_gas_op_cost[i] = rows[i].main_dyn_da_gas_op_cost;
polys.main_dyn_gas_multiplier[i] = rows[i].main_dyn_gas_multiplier;
polys.main_dyn_l2_gas_op_cost[i] = rows[i].main_dyn_l2_gas_op_cost;
+ polys.main_emit_l2_to_l1_msg_write_offset[i] = rows[i].main_emit_l2_to_l1_msg_write_offset;
+ polys.main_emit_note_hash_write_offset[i] = rows[i].main_emit_note_hash_write_offset;
+ polys.main_emit_nullifier_write_offset[i] = rows[i].main_emit_nullifier_write_offset;
+ polys.main_emit_unencrypted_log_write_offset[i] = rows[i].main_emit_unencrypted_log_write_offset;
polys.main_ia[i] = rows[i].main_ia;
polys.main_ib[i] = rows[i].main_ib;
polys.main_ic[i] = rows[i].main_ic;
@@ -191,12 +180,18 @@ AvmCircuitBuilder::ProverPolynomials AvmCircuitBuilder::compute_polynomials() co
polys.main_ind_addr_d[i] = rows[i].main_ind_addr_d;
polys.main_internal_return_ptr[i] = rows[i].main_internal_return_ptr;
polys.main_inv[i] = rows[i].main_inv;
+ polys.main_kernel_in_offset[i] = rows[i].main_kernel_in_offset;
+ polys.main_kernel_out_offset[i] = rows[i].main_kernel_out_offset;
+ polys.main_l1_to_l2_msg_exists_write_offset[i] = rows[i].main_l1_to_l2_msg_exists_write_offset;
polys.main_l2_gas_remaining[i] = rows[i].main_l2_gas_remaining;
polys.main_l2_out_of_gas[i] = rows[i].main_l2_out_of_gas;
polys.main_mem_addr_a[i] = rows[i].main_mem_addr_a;
polys.main_mem_addr_b[i] = rows[i].main_mem_addr_b;
polys.main_mem_addr_c[i] = rows[i].main_mem_addr_c;
polys.main_mem_addr_d[i] = rows[i].main_mem_addr_d;
+ polys.main_note_hash_exist_write_offset[i] = rows[i].main_note_hash_exist_write_offset;
+ polys.main_nullifier_exists_write_offset[i] = rows[i].main_nullifier_exists_write_offset;
+ polys.main_nullifier_non_exists_write_offset[i] = rows[i].main_nullifier_non_exists_write_offset;
polys.main_op_err[i] = rows[i].main_op_err;
polys.main_opcode_val[i] = rows[i].main_opcode_val;
polys.main_pc[i] = rows[i].main_pc;
@@ -209,6 +204,8 @@ AvmCircuitBuilder::ProverPolynomials AvmCircuitBuilder::compute_polynomials() co
polys.main_sel_bin[i] = rows[i].main_sel_bin;
polys.main_sel_calldata[i] = rows[i].main_sel_calldata;
polys.main_sel_execution_row[i] = rows[i].main_sel_execution_row;
+ polys.main_sel_kernel_inputs[i] = rows[i].main_sel_kernel_inputs;
+ polys.main_sel_kernel_out[i] = rows[i].main_sel_kernel_out;
polys.main_sel_last[i] = rows[i].main_sel_last;
polys.main_sel_mem_op_a[i] = rows[i].main_sel_mem_op_a;
polys.main_sel_mem_op_b[i] = rows[i].main_sel_mem_op_b;
@@ -284,7 +281,10 @@ AvmCircuitBuilder::ProverPolynomials AvmCircuitBuilder::compute_polynomials() co
polys.main_sel_rng_16[i] = rows[i].main_sel_rng_16;
polys.main_sel_rng_8[i] = rows[i].main_sel_rng_8;
polys.main_sel_slice_gadget[i] = rows[i].main_sel_slice_gadget;
+ polys.main_side_effect_counter[i] = rows[i].main_side_effect_counter;
+ polys.main_sload_write_offset[i] = rows[i].main_sload_write_offset;
polys.main_space_id[i] = rows[i].main_space_id;
+ polys.main_sstore_write_offset[i] = rows[i].main_sstore_write_offset;
polys.main_tag_err[i] = rows[i].main_tag_err;
polys.main_w_in_tag[i] = rows[i].main_w_in_tag;
polys.mem_addr[i] = rows[i].mem_addr;
@@ -634,10 +634,10 @@ AvmCircuitBuilder::ProverPolynomials AvmCircuitBuilder::compute_polynomials() co
polys.range_check_l2_gas_lo_counts[i] = rows[i].range_check_l2_gas_lo_counts;
polys.range_check_da_gas_hi_counts[i] = rows[i].range_check_da_gas_hi_counts;
polys.range_check_da_gas_lo_counts[i] = rows[i].range_check_da_gas_lo_counts;
- polys.lookup_cd_value_counts[i] = rows[i].lookup_cd_value_counts;
- polys.lookup_ret_value_counts[i] = rows[i].lookup_ret_value_counts;
polys.kernel_output_lookup_counts[i] = rows[i].kernel_output_lookup_counts;
polys.lookup_into_kernel_counts[i] = rows[i].lookup_into_kernel_counts;
+ polys.lookup_cd_value_counts[i] = rows[i].lookup_cd_value_counts;
+ polys.lookup_ret_value_counts[i] = rows[i].lookup_ret_value_counts;
polys.incl_main_tag_err_counts[i] = rows[i].incl_main_tag_err_counts;
polys.incl_mem_tag_err_counts[i] = rows[i].incl_mem_tag_err_counts;
polys.lookup_mem_rng_chk_lo_counts[i] = rows[i].lookup_mem_rng_chk_lo_counts;
@@ -710,16 +710,20 @@ bool AvmCircuitBuilder::check_circuit() const
r = 0;
}
+ std::array subrelation_failed = { false };
for (size_t r = 0; r < num_rows; ++r) {
Relation::accumulate(result, polys.get_row(r), {}, 1);
for (size_t j = 0; j < result.size(); ++j) {
- if (result[j] != 0) {
+ if (!subrelation_failed[j] && result[j] != 0) {
signal_error(format("Relation ",
Relation::NAME,
", subrelation ",
Relation::get_subrelation_label(j),
" failed at row ",
r));
+ // We will not check this subrelation for any other rows.
+ // Since the accumulation will keep being != 0.
+ subrelation_failed[j] = true;
}
}
}
diff --git a/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.cpp b/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.cpp
index da053ff63384..9cf8f248f46b 100644
--- a/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.cpp
+++ b/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.cpp
@@ -21,10 +21,10 @@ AvmFlavor::AllConstRefValues::AllConstRefValues(
, main_sel_first(il[13])
, main_zeroes(il[14])
, powers_power_of_2(il[15])
- , kernel_kernel_inputs(il[16])
- , kernel_kernel_value_out(il[17])
- , kernel_kernel_side_effect_out(il[18])
- , kernel_kernel_metadata_out(il[19])
+ , main_kernel_inputs(il[16])
+ , main_kernel_value_out(il[17])
+ , main_kernel_side_effect_out(il[18])
+ , main_kernel_metadata_out(il[19])
, main_calldata(il[20])
, main_returndata(il[21])
, alu_a_hi(il[22])
@@ -132,140 +132,140 @@ AvmFlavor::AllConstRefValues::AllConstRefValues(
, keccakf1600_input(il[124])
, keccakf1600_output(il[125])
, keccakf1600_sel_keccakf1600(il[126])
- , kernel_emit_l2_to_l1_msg_write_offset(il[127])
- , kernel_emit_note_hash_write_offset(il[128])
- , kernel_emit_nullifier_write_offset(il[129])
- , kernel_emit_unencrypted_log_write_offset(il[130])
- , kernel_kernel_in_offset(il[131])
- , kernel_kernel_out_offset(il[132])
- , kernel_l1_to_l2_msg_exists_write_offset(il[133])
- , kernel_note_hash_exist_write_offset(il[134])
- , kernel_nullifier_exists_write_offset(il[135])
- , kernel_nullifier_non_exists_write_offset(il[136])
- , kernel_q_public_input_kernel_add_to_table(il[137])
- , kernel_q_public_input_kernel_out_add_to_table(il[138])
- , kernel_side_effect_counter(il[139])
- , kernel_sload_write_offset(il[140])
- , kernel_sstore_write_offset(il[141])
- , main_abs_da_rem_gas_hi(il[142])
- , main_abs_da_rem_gas_lo(il[143])
- , main_abs_l2_rem_gas_hi(il[144])
- , main_abs_l2_rem_gas_lo(il[145])
- , main_alu_in_tag(il[146])
- , main_base_da_gas_op_cost(il[147])
- , main_base_l2_gas_op_cost(il[148])
- , main_bin_op_id(il[149])
- , main_call_ptr(il[150])
- , main_da_gas_remaining(il[151])
- , main_da_out_of_gas(il[152])
- , main_dyn_da_gas_op_cost(il[153])
- , main_dyn_gas_multiplier(il[154])
- , main_dyn_l2_gas_op_cost(il[155])
- , main_ia(il[156])
- , main_ib(il[157])
- , main_ic(il[158])
- , main_id(il[159])
- , main_id_zero(il[160])
- , main_ind_addr_a(il[161])
- , main_ind_addr_b(il[162])
- , main_ind_addr_c(il[163])
- , main_ind_addr_d(il[164])
- , main_internal_return_ptr(il[165])
- , main_inv(il[166])
- , main_l2_gas_remaining(il[167])
- , main_l2_out_of_gas(il[168])
- , main_mem_addr_a(il[169])
- , main_mem_addr_b(il[170])
- , main_mem_addr_c(il[171])
- , main_mem_addr_d(il[172])
- , main_op_err(il[173])
- , main_opcode_val(il[174])
- , main_pc(il[175])
- , main_r_in_tag(il[176])
- , main_rwa(il[177])
- , main_rwb(il[178])
- , main_rwc(il[179])
- , main_rwd(il[180])
- , main_sel_alu(il[181])
- , main_sel_bin(il[182])
- , main_sel_calldata(il[183])
- , main_sel_execution_row(il[184])
- , main_sel_last(il[185])
- , main_sel_mem_op_a(il[186])
- , main_sel_mem_op_b(il[187])
- , main_sel_mem_op_c(il[188])
- , main_sel_mem_op_d(il[189])
- , main_sel_mov_ia_to_ic(il[190])
- , main_sel_mov_ib_to_ic(il[191])
- , main_sel_op_add(il[192])
- , main_sel_op_address(il[193])
- , main_sel_op_and(il[194])
- , main_sel_op_block_number(il[195])
- , main_sel_op_calldata_copy(il[196])
- , main_sel_op_cast(il[197])
- , main_sel_op_chain_id(il[198])
- , main_sel_op_cmov(il[199])
- , main_sel_op_coinbase(il[200])
- , main_sel_op_dagasleft(il[201])
- , main_sel_op_div(il[202])
- , main_sel_op_ecadd(il[203])
- , main_sel_op_emit_l2_to_l1_msg(il[204])
- , main_sel_op_emit_note_hash(il[205])
- , main_sel_op_emit_nullifier(il[206])
- , main_sel_op_emit_unencrypted_log(il[207])
- , main_sel_op_eq(il[208])
- , main_sel_op_external_call(il[209])
- , main_sel_op_external_return(il[210])
- , main_sel_op_external_revert(il[211])
- , main_sel_op_fdiv(il[212])
- , main_sel_op_fee_per_da_gas(il[213])
- , main_sel_op_fee_per_l2_gas(il[214])
- , main_sel_op_function_selector(il[215])
- , main_sel_op_get_contract_instance(il[216])
- , main_sel_op_internal_call(il[217])
- , main_sel_op_internal_return(il[218])
- , main_sel_op_jump(il[219])
- , main_sel_op_jumpi(il[220])
- , main_sel_op_keccak(il[221])
- , main_sel_op_l1_to_l2_msg_exists(il[222])
- , main_sel_op_l2gasleft(il[223])
- , main_sel_op_lt(il[224])
- , main_sel_op_lte(il[225])
- , main_sel_op_mov(il[226])
- , main_sel_op_msm(il[227])
- , main_sel_op_mul(il[228])
- , main_sel_op_not(il[229])
- , main_sel_op_note_hash_exists(il[230])
- , main_sel_op_nullifier_exists(il[231])
- , main_sel_op_or(il[232])
- , main_sel_op_pedersen(il[233])
- , main_sel_op_pedersen_commit(il[234])
- , main_sel_op_poseidon2(il[235])
- , main_sel_op_radix_le(il[236])
- , main_sel_op_sender(il[237])
- , main_sel_op_set(il[238])
- , main_sel_op_sha256(il[239])
- , main_sel_op_shl(il[240])
- , main_sel_op_shr(il[241])
- , main_sel_op_sload(il[242])
- , main_sel_op_sstore(il[243])
- , main_sel_op_storage_address(il[244])
- , main_sel_op_sub(il[245])
- , main_sel_op_timestamp(il[246])
- , main_sel_op_transaction_fee(il[247])
- , main_sel_op_version(il[248])
- , main_sel_op_xor(il[249])
- , main_sel_q_kernel_lookup(il[250])
- , main_sel_q_kernel_output_lookup(il[251])
- , main_sel_resolve_ind_addr_a(il[252])
- , main_sel_resolve_ind_addr_b(il[253])
- , main_sel_resolve_ind_addr_c(il[254])
- , main_sel_resolve_ind_addr_d(il[255])
- , main_sel_returndata(il[256])
- , main_sel_rng_16(il[257])
- , main_sel_rng_8(il[258])
- , main_sel_slice_gadget(il[259])
- , main_space_id(il[260])
+ , main_abs_da_rem_gas_hi(il[127])
+ , main_abs_da_rem_gas_lo(il[128])
+ , main_abs_l2_rem_gas_hi(il[129])
+ , main_abs_l2_rem_gas_lo(il[130])
+ , main_alu_in_tag(il[131])
+ , main_base_da_gas_op_cost(il[132])
+ , main_base_l2_gas_op_cost(il[133])
+ , main_bin_op_id(il[134])
+ , main_call_ptr(il[135])
+ , main_da_gas_remaining(il[136])
+ , main_da_out_of_gas(il[137])
+ , main_dyn_da_gas_op_cost(il[138])
+ , main_dyn_gas_multiplier(il[139])
+ , main_dyn_l2_gas_op_cost(il[140])
+ , main_emit_l2_to_l1_msg_write_offset(il[141])
+ , main_emit_note_hash_write_offset(il[142])
+ , main_emit_nullifier_write_offset(il[143])
+ , main_emit_unencrypted_log_write_offset(il[144])
+ , main_ia(il[145])
+ , main_ib(il[146])
+ , main_ic(il[147])
+ , main_id(il[148])
+ , main_id_zero(il[149])
+ , main_ind_addr_a(il[150])
+ , main_ind_addr_b(il[151])
+ , main_ind_addr_c(il[152])
+ , main_ind_addr_d(il[153])
+ , main_internal_return_ptr(il[154])
+ , main_inv(il[155])
+ , main_kernel_in_offset(il[156])
+ , main_kernel_out_offset(il[157])
+ , main_l1_to_l2_msg_exists_write_offset(il[158])
+ , main_l2_gas_remaining(il[159])
+ , main_l2_out_of_gas(il[160])
+ , main_mem_addr_a(il[161])
+ , main_mem_addr_b(il[162])
+ , main_mem_addr_c(il[163])
+ , main_mem_addr_d(il[164])
+ , main_note_hash_exist_write_offset(il[165])
+ , main_nullifier_exists_write_offset(il[166])
+ , main_nullifier_non_exists_write_offset(il[167])
+ , main_op_err(il[168])
+ , main_opcode_val(il[169])
+ , main_pc(il[170])
+ , main_r_in_tag(il[171])
+ , main_rwa(il[172])
+ , main_rwb(il[173])
+ , main_rwc(il[174])
+ , main_rwd(il[175])
+ , main_sel_alu(il[176])
+ , main_sel_bin(il[177])
+ , main_sel_calldata(il[178])
+ , main_sel_execution_row(il[179])
+ , main_sel_kernel_inputs(il[180])
+ , main_sel_kernel_out(il[181])
+ , main_sel_last(il[182])
+ , main_sel_mem_op_a(il[183])
+ , main_sel_mem_op_b(il[184])
+ , main_sel_mem_op_c(il[185])
+ , main_sel_mem_op_d(il[186])
+ , main_sel_mov_ia_to_ic(il[187])
+ , main_sel_mov_ib_to_ic(il[188])
+ , main_sel_op_add(il[189])
+ , main_sel_op_address(il[190])
+ , main_sel_op_and(il[191])
+ , main_sel_op_block_number(il[192])
+ , main_sel_op_calldata_copy(il[193])
+ , main_sel_op_cast(il[194])
+ , main_sel_op_chain_id(il[195])
+ , main_sel_op_cmov(il[196])
+ , main_sel_op_coinbase(il[197])
+ , main_sel_op_dagasleft(il[198])
+ , main_sel_op_div(il[199])
+ , main_sel_op_ecadd(il[200])
+ , main_sel_op_emit_l2_to_l1_msg(il[201])
+ , main_sel_op_emit_note_hash(il[202])
+ , main_sel_op_emit_nullifier(il[203])
+ , main_sel_op_emit_unencrypted_log(il[204])
+ , main_sel_op_eq(il[205])
+ , main_sel_op_external_call(il[206])
+ , main_sel_op_external_return(il[207])
+ , main_sel_op_external_revert(il[208])
+ , main_sel_op_fdiv(il[209])
+ , main_sel_op_fee_per_da_gas(il[210])
+ , main_sel_op_fee_per_l2_gas(il[211])
+ , main_sel_op_function_selector(il[212])
+ , main_sel_op_get_contract_instance(il[213])
+ , main_sel_op_internal_call(il[214])
+ , main_sel_op_internal_return(il[215])
+ , main_sel_op_jump(il[216])
+ , main_sel_op_jumpi(il[217])
+ , main_sel_op_keccak(il[218])
+ , main_sel_op_l1_to_l2_msg_exists(il[219])
+ , main_sel_op_l2gasleft(il[220])
+ , main_sel_op_lt(il[221])
+ , main_sel_op_lte(il[222])
+ , main_sel_op_mov(il[223])
+ , main_sel_op_msm(il[224])
+ , main_sel_op_mul(il[225])
+ , main_sel_op_not(il[226])
+ , main_sel_op_note_hash_exists(il[227])
+ , main_sel_op_nullifier_exists(il[228])
+ , main_sel_op_or(il[229])
+ , main_sel_op_pedersen(il[230])
+ , main_sel_op_pedersen_commit(il[231])
+ , main_sel_op_poseidon2(il[232])
+ , main_sel_op_radix_le(il[233])
+ , main_sel_op_sender(il[234])
+ , main_sel_op_set(il[235])
+ , main_sel_op_sha256(il[236])
+ , main_sel_op_shl(il[237])
+ , main_sel_op_shr(il[238])
+ , main_sel_op_sload(il[239])
+ , main_sel_op_sstore(il[240])
+ , main_sel_op_storage_address(il[241])
+ , main_sel_op_sub(il[242])
+ , main_sel_op_timestamp(il[243])
+ , main_sel_op_transaction_fee(il[244])
+ , main_sel_op_version(il[245])
+ , main_sel_op_xor(il[246])
+ , main_sel_q_kernel_lookup(il[247])
+ , main_sel_q_kernel_output_lookup(il[248])
+ , main_sel_resolve_ind_addr_a(il[249])
+ , main_sel_resolve_ind_addr_b(il[250])
+ , main_sel_resolve_ind_addr_c(il[251])
+ , main_sel_resolve_ind_addr_d(il[252])
+ , main_sel_returndata(il[253])
+ , main_sel_rng_16(il[254])
+ , main_sel_rng_8(il[255])
+ , main_sel_slice_gadget(il[256])
+ , main_side_effect_counter(il[257])
+ , main_sload_write_offset(il[258])
+ , main_space_id(il[259])
+ , main_sstore_write_offset(il[260])
, main_tag_err(il[261])
, main_w_in_tag(il[262])
, mem_addr(il[263])
@@ -615,10 +615,10 @@ AvmFlavor::AllConstRefValues::AllConstRefValues(
, range_check_l2_gas_lo_counts(il[607])
, range_check_da_gas_hi_counts(il[608])
, range_check_da_gas_lo_counts(il[609])
- , lookup_cd_value_counts(il[610])
- , lookup_ret_value_counts(il[611])
- , kernel_output_lookup_counts(il[612])
- , lookup_into_kernel_counts(il[613])
+ , kernel_output_lookup_counts(il[610])
+ , lookup_into_kernel_counts(il[611])
+ , lookup_cd_value_counts(il[612])
+ , lookup_ret_value_counts(il[613])
, incl_main_tag_err_counts(il[614])
, incl_mem_tag_err_counts(il[615])
, lookup_mem_rng_chk_lo_counts(il[616])
@@ -681,10 +681,10 @@ AvmFlavor::AllConstRefValues::AllConstRefValues(
, range_check_l2_gas_lo_inv(il[673])
, range_check_da_gas_hi_inv(il[674])
, range_check_da_gas_lo_inv(il[675])
- , lookup_cd_value_inv(il[676])
- , lookup_ret_value_inv(il[677])
- , kernel_output_lookup_inv(il[678])
- , lookup_into_kernel_inv(il[679])
+ , kernel_output_lookup_inv(il[676])
+ , lookup_into_kernel_inv(il[677])
+ , lookup_cd_value_inv(il[678])
+ , lookup_ret_value_inv(il[679])
, incl_main_tag_err_inv(il[680])
, incl_mem_tag_err_inv(il[681])
, lookup_mem_rng_chk_lo_inv(il[682])
@@ -717,81 +717,81 @@ AvmFlavor::AllConstRefValues::AllConstRefValues(
, lookup_div_u16_5_inv(il[709])
, lookup_div_u16_6_inv(il[710])
, lookup_div_u16_7_inv(il[711])
- , alu_div_u16_r1_shift(il[712])
- , slice_clk_shift(il[713])
- , alu_div_u16_r6_shift(il[714])
- , kernel_nullifier_exists_write_offset_shift(il[715])
- , mem_tsp_shift(il[716])
- , main_internal_return_ptr_shift(il[717])
- , main_sel_execution_row_shift(il[718])
- , alu_sel_rng_chk_shift(il[719])
+ , alu_a_hi_shift(il[712])
+ , alu_a_lo_shift(il[713])
+ , alu_b_hi_shift(il[714])
+ , alu_b_lo_shift(il[715])
+ , alu_cmp_rng_ctr_shift(il[716])
+ , alu_div_u16_r0_shift(il[717])
+ , alu_div_u16_r1_shift(il[718])
+ , alu_div_u16_r2_shift(il[719])
, alu_div_u16_r3_shift(il[720])
- , kernel_emit_note_hash_write_offset_shift(il[721])
- , alu_p_sub_b_hi_shift(il[722])
- , slice_sel_return_shift(il[723])
- , kernel_side_effect_counter_shift(il[724])
+ , alu_div_u16_r4_shift(il[721])
+ , alu_div_u16_r5_shift(il[722])
+ , alu_div_u16_r6_shift(il[723])
+ , alu_div_u16_r7_shift(il[724])
, alu_op_add_shift(il[725])
, alu_op_cast_shift(il[726])
- , kernel_emit_nullifier_write_offset_shift(il[727])
- , slice_cnt_shift(il[728])
- , alu_sel_cmp_shift(il[729])
- , alu_u16_r1_shift(il[730])
- , binary_acc_ia_shift(il[731])
- , alu_div_u16_r0_shift(il[732])
- , kernel_l1_to_l2_msg_exists_write_offset_shift(il[733])
- , alu_a_hi_shift(il[734])
- , alu_div_u16_r5_shift(il[735])
- , kernel_emit_unencrypted_log_write_offset_shift(il[736])
- , mem_val_shift(il[737])
- , slice_sel_start_shift(il[738])
- , binary_acc_ic_shift(il[739])
- , alu_sel_div_rng_chk_shift(il[740])
- , alu_u16_r6_shift(il[741])
- , alu_op_shr_shift(il[742])
- , slice_space_id_shift(il[743])
- , mem_tag_shift(il[744])
- , alu_op_mul_shift(il[745])
- , binary_mem_tag_ctr_shift(il[746])
- , kernel_emit_l2_to_l1_msg_write_offset_shift(il[747])
- , alu_sel_alu_shift(il[748])
- , mem_rw_shift(il[749])
- , mem_glob_addr_shift(il[750])
- , alu_u16_r3_shift(il[751])
- , kernel_sstore_write_offset_shift(il[752])
- , mem_sel_mem_shift(il[753])
- , slice_sel_mem_active_shift(il[754])
- , alu_op_shl_shift(il[755])
- , alu_b_hi_shift(il[756])
- , alu_cmp_rng_ctr_shift(il[757])
- , alu_op_cast_prev_shift(il[758])
- , alu_sel_rng_chk_lookup_shift(il[759])
- , slice_sel_cd_cpy_shift(il[760])
- , main_pc_shift(il[761])
- , alu_u8_r1_shift(il[762])
- , alu_p_sub_a_lo_shift(il[763])
- , main_da_gas_remaining_shift(il[764])
- , alu_b_lo_shift(il[765])
- , alu_u8_r0_shift(il[766])
- , alu_p_sub_b_lo_shift(il[767])
- , kernel_nullifier_non_exists_write_offset_shift(il[768])
- , alu_u16_r4_shift(il[769])
- , binary_acc_ib_shift(il[770])
- , alu_u16_r0_shift(il[771])
- , alu_div_u16_r2_shift(il[772])
- , alu_op_div_shift(il[773])
- , alu_a_lo_shift(il[774])
- , alu_op_sub_shift(il[775])
- , alu_div_u16_r7_shift(il[776])
- , alu_u16_r5_shift(il[777])
- , alu_u16_r2_shift(il[778])
- , kernel_note_hash_exist_write_offset_shift(il[779])
- , main_l2_gas_remaining_shift(il[780])
- , kernel_sload_write_offset_shift(il[781])
- , slice_addr_shift(il[782])
- , binary_op_id_shift(il[783])
- , alu_p_sub_a_hi_shift(il[784])
- , slice_col_offset_shift(il[785])
- , alu_div_u16_r4_shift(il[786])
+ , alu_op_cast_prev_shift(il[727])
+ , alu_op_div_shift(il[728])
+ , alu_op_mul_shift(il[729])
+ , alu_op_shl_shift(il[730])
+ , alu_op_shr_shift(il[731])
+ , alu_op_sub_shift(il[732])
+ , alu_p_sub_a_hi_shift(il[733])
+ , alu_p_sub_a_lo_shift(il[734])
+ , alu_p_sub_b_hi_shift(il[735])
+ , alu_p_sub_b_lo_shift(il[736])
+ , alu_sel_alu_shift(il[737])
+ , alu_sel_cmp_shift(il[738])
+ , alu_sel_div_rng_chk_shift(il[739])
+ , alu_sel_rng_chk_shift(il[740])
+ , alu_sel_rng_chk_lookup_shift(il[741])
+ , alu_u16_r0_shift(il[742])
+ , alu_u16_r1_shift(il[743])
+ , alu_u16_r2_shift(il[744])
+ , alu_u16_r3_shift(il[745])
+ , alu_u16_r4_shift(il[746])
+ , alu_u16_r5_shift(il[747])
+ , alu_u16_r6_shift(il[748])
+ , alu_u8_r0_shift(il[749])
+ , alu_u8_r1_shift(il[750])
+ , binary_acc_ia_shift(il[751])
+ , binary_acc_ib_shift(il[752])
+ , binary_acc_ic_shift(il[753])
+ , binary_mem_tag_ctr_shift(il[754])
+ , binary_op_id_shift(il[755])
+ , main_da_gas_remaining_shift(il[756])
+ , main_emit_l2_to_l1_msg_write_offset_shift(il[757])
+ , main_emit_note_hash_write_offset_shift(il[758])
+ , main_emit_nullifier_write_offset_shift(il[759])
+ , main_emit_unencrypted_log_write_offset_shift(il[760])
+ , main_internal_return_ptr_shift(il[761])
+ , main_l1_to_l2_msg_exists_write_offset_shift(il[762])
+ , main_l2_gas_remaining_shift(il[763])
+ , main_note_hash_exist_write_offset_shift(il[764])
+ , main_nullifier_exists_write_offset_shift(il[765])
+ , main_nullifier_non_exists_write_offset_shift(il[766])
+ , main_pc_shift(il[767])
+ , main_sel_execution_row_shift(il[768])
+ , main_side_effect_counter_shift(il[769])
+ , main_sload_write_offset_shift(il[770])
+ , main_sstore_write_offset_shift(il[771])
+ , mem_glob_addr_shift(il[772])
+ , mem_rw_shift(il[773])
+ , mem_sel_mem_shift(il[774])
+ , mem_tag_shift(il[775])
+ , mem_tsp_shift(il[776])
+ , mem_val_shift(il[777])
+ , slice_addr_shift(il[778])
+ , slice_clk_shift(il[779])
+ , slice_cnt_shift(il[780])
+ , slice_col_offset_shift(il[781])
+ , slice_sel_cd_cpy_shift(il[782])
+ , slice_sel_mem_active_shift(il[783])
+ , slice_sel_return_shift(il[784])
+ , slice_sel_start_shift(il[785])
+ , slice_space_id_shift(il[786])
{}
AvmFlavor::ProverPolynomials::ProverPolynomials(ProvingKey& proving_key)
@@ -824,10 +824,10 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
main_sel_first[row_idx],
main_zeroes[row_idx],
powers_power_of_2[row_idx],
- kernel_kernel_inputs[row_idx],
- kernel_kernel_value_out[row_idx],
- kernel_kernel_side_effect_out[row_idx],
- kernel_kernel_metadata_out[row_idx],
+ main_kernel_inputs[row_idx],
+ main_kernel_value_out[row_idx],
+ main_kernel_side_effect_out[row_idx],
+ main_kernel_metadata_out[row_idx],
main_calldata[row_idx],
main_returndata[row_idx],
alu_a_hi[row_idx],
@@ -935,21 +935,6 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
keccakf1600_input[row_idx],
keccakf1600_output[row_idx],
keccakf1600_sel_keccakf1600[row_idx],
- kernel_emit_l2_to_l1_msg_write_offset[row_idx],
- kernel_emit_note_hash_write_offset[row_idx],
- kernel_emit_nullifier_write_offset[row_idx],
- kernel_emit_unencrypted_log_write_offset[row_idx],
- kernel_kernel_in_offset[row_idx],
- kernel_kernel_out_offset[row_idx],
- kernel_l1_to_l2_msg_exists_write_offset[row_idx],
- kernel_note_hash_exist_write_offset[row_idx],
- kernel_nullifier_exists_write_offset[row_idx],
- kernel_nullifier_non_exists_write_offset[row_idx],
- kernel_q_public_input_kernel_add_to_table[row_idx],
- kernel_q_public_input_kernel_out_add_to_table[row_idx],
- kernel_side_effect_counter[row_idx],
- kernel_sload_write_offset[row_idx],
- kernel_sstore_write_offset[row_idx],
main_abs_da_rem_gas_hi[row_idx],
main_abs_da_rem_gas_lo[row_idx],
main_abs_l2_rem_gas_hi[row_idx],
@@ -964,6 +949,10 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
main_dyn_da_gas_op_cost[row_idx],
main_dyn_gas_multiplier[row_idx],
main_dyn_l2_gas_op_cost[row_idx],
+ main_emit_l2_to_l1_msg_write_offset[row_idx],
+ main_emit_note_hash_write_offset[row_idx],
+ main_emit_nullifier_write_offset[row_idx],
+ main_emit_unencrypted_log_write_offset[row_idx],
main_ia[row_idx],
main_ib[row_idx],
main_ic[row_idx],
@@ -975,12 +964,18 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
main_ind_addr_d[row_idx],
main_internal_return_ptr[row_idx],
main_inv[row_idx],
+ main_kernel_in_offset[row_idx],
+ main_kernel_out_offset[row_idx],
+ main_l1_to_l2_msg_exists_write_offset[row_idx],
main_l2_gas_remaining[row_idx],
main_l2_out_of_gas[row_idx],
main_mem_addr_a[row_idx],
main_mem_addr_b[row_idx],
main_mem_addr_c[row_idx],
main_mem_addr_d[row_idx],
+ main_note_hash_exist_write_offset[row_idx],
+ main_nullifier_exists_write_offset[row_idx],
+ main_nullifier_non_exists_write_offset[row_idx],
main_op_err[row_idx],
main_opcode_val[row_idx],
main_pc[row_idx],
@@ -993,6 +988,8 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
main_sel_bin[row_idx],
main_sel_calldata[row_idx],
main_sel_execution_row[row_idx],
+ main_sel_kernel_inputs[row_idx],
+ main_sel_kernel_out[row_idx],
main_sel_last[row_idx],
main_sel_mem_op_a[row_idx],
main_sel_mem_op_b[row_idx],
@@ -1068,7 +1065,10 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
main_sel_rng_16[row_idx],
main_sel_rng_8[row_idx],
main_sel_slice_gadget[row_idx],
+ main_side_effect_counter[row_idx],
+ main_sload_write_offset[row_idx],
main_space_id[row_idx],
+ main_sstore_write_offset[row_idx],
main_tag_err[row_idx],
main_w_in_tag[row_idx],
mem_addr[row_idx],
@@ -1418,10 +1418,10 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
range_check_l2_gas_lo_counts[row_idx],
range_check_da_gas_hi_counts[row_idx],
range_check_da_gas_lo_counts[row_idx],
- lookup_cd_value_counts[row_idx],
- lookup_ret_value_counts[row_idx],
kernel_output_lookup_counts[row_idx],
lookup_into_kernel_counts[row_idx],
+ lookup_cd_value_counts[row_idx],
+ lookup_ret_value_counts[row_idx],
incl_main_tag_err_counts[row_idx],
incl_mem_tag_err_counts[row_idx],
lookup_mem_rng_chk_lo_counts[row_idx],
@@ -1484,10 +1484,10 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
range_check_l2_gas_lo_inv[row_idx],
range_check_da_gas_hi_inv[row_idx],
range_check_da_gas_lo_inv[row_idx],
- lookup_cd_value_inv[row_idx],
- lookup_ret_value_inv[row_idx],
kernel_output_lookup_inv[row_idx],
lookup_into_kernel_inv[row_idx],
+ lookup_cd_value_inv[row_idx],
+ lookup_ret_value_inv[row_idx],
incl_main_tag_err_inv[row_idx],
incl_mem_tag_err_inv[row_idx],
lookup_mem_rng_chk_lo_inv[row_idx],
@@ -1520,81 +1520,81 @@ AvmFlavor::AllConstRefValues AvmFlavor::ProverPolynomials::get_row(size_t row_id
lookup_div_u16_5_inv[row_idx],
lookup_div_u16_6_inv[row_idx],
lookup_div_u16_7_inv[row_idx],
+ alu_a_hi_shift[row_idx],
+ alu_a_lo_shift[row_idx],
+ alu_b_hi_shift[row_idx],
+ alu_b_lo_shift[row_idx],
+ alu_cmp_rng_ctr_shift[row_idx],
+ alu_div_u16_r0_shift[row_idx],
alu_div_u16_r1_shift[row_idx],
- slice_clk_shift[row_idx],
- alu_div_u16_r6_shift[row_idx],
- kernel_nullifier_exists_write_offset_shift[row_idx],
- mem_tsp_shift[row_idx],
- main_internal_return_ptr_shift[row_idx],
- main_sel_execution_row_shift[row_idx],
- alu_sel_rng_chk_shift[row_idx],
+ alu_div_u16_r2_shift[row_idx],
alu_div_u16_r3_shift[row_idx],
- kernel_emit_note_hash_write_offset_shift[row_idx],
- alu_p_sub_b_hi_shift[row_idx],
- slice_sel_return_shift[row_idx],
- kernel_side_effect_counter_shift[row_idx],
+ alu_div_u16_r4_shift[row_idx],
+ alu_div_u16_r5_shift[row_idx],
+ alu_div_u16_r6_shift[row_idx],
+ alu_div_u16_r7_shift[row_idx],
alu_op_add_shift[row_idx],
alu_op_cast_shift[row_idx],
- kernel_emit_nullifier_write_offset_shift[row_idx],
- slice_cnt_shift[row_idx],
- alu_sel_cmp_shift[row_idx],
- alu_u16_r1_shift[row_idx],
- binary_acc_ia_shift[row_idx],
- alu_div_u16_r0_shift[row_idx],
- kernel_l1_to_l2_msg_exists_write_offset_shift[row_idx],
- alu_a_hi_shift[row_idx],
- alu_div_u16_r5_shift[row_idx],
- kernel_emit_unencrypted_log_write_offset_shift[row_idx],
- mem_val_shift[row_idx],
- slice_sel_start_shift[row_idx],
- binary_acc_ic_shift[row_idx],
- alu_sel_div_rng_chk_shift[row_idx],
- alu_u16_r6_shift[row_idx],
- alu_op_shr_shift[row_idx],
- slice_space_id_shift[row_idx],
- mem_tag_shift[row_idx],
+ alu_op_cast_prev_shift[row_idx],
+ alu_op_div_shift[row_idx],
alu_op_mul_shift[row_idx],
- binary_mem_tag_ctr_shift[row_idx],
- kernel_emit_l2_to_l1_msg_write_offset_shift[row_idx],
- alu_sel_alu_shift[row_idx],
- mem_rw_shift[row_idx],
- mem_glob_addr_shift[row_idx],
- alu_u16_r3_shift[row_idx],
- kernel_sstore_write_offset_shift[row_idx],
- mem_sel_mem_shift[row_idx],
- slice_sel_mem_active_shift[row_idx],
alu_op_shl_shift[row_idx],
- alu_b_hi_shift[row_idx],
- alu_cmp_rng_ctr_shift[row_idx],
- alu_op_cast_prev_shift[row_idx],
- alu_sel_rng_chk_lookup_shift[row_idx],
- slice_sel_cd_cpy_shift[row_idx],
- main_pc_shift[row_idx],
- alu_u8_r1_shift[row_idx],
+ alu_op_shr_shift[row_idx],
+ alu_op_sub_shift[row_idx],
+ alu_p_sub_a_hi_shift[row_idx],
alu_p_sub_a_lo_shift[row_idx],
- main_da_gas_remaining_shift[row_idx],
- alu_b_lo_shift[row_idx],
- alu_u8_r0_shift[row_idx],
+ alu_p_sub_b_hi_shift[row_idx],
alu_p_sub_b_lo_shift[row_idx],
- kernel_nullifier_non_exists_write_offset_shift[row_idx],
- alu_u16_r4_shift[row_idx],
- binary_acc_ib_shift[row_idx],
+ alu_sel_alu_shift[row_idx],
+ alu_sel_cmp_shift[row_idx],
+ alu_sel_div_rng_chk_shift[row_idx],
+ alu_sel_rng_chk_shift[row_idx],
+ alu_sel_rng_chk_lookup_shift[row_idx],
alu_u16_r0_shift[row_idx],
- alu_div_u16_r2_shift[row_idx],
- alu_op_div_shift[row_idx],
- alu_a_lo_shift[row_idx],
- alu_op_sub_shift[row_idx],
- alu_div_u16_r7_shift[row_idx],
- alu_u16_r5_shift[row_idx],
+ alu_u16_r1_shift[row_idx],
alu_u16_r2_shift[row_idx],
- kernel_note_hash_exist_write_offset_shift[row_idx],
+ alu_u16_r3_shift[row_idx],
+ alu_u16_r4_shift[row_idx],
+ alu_u16_r5_shift[row_idx],
+ alu_u16_r6_shift[row_idx],
+ alu_u8_r0_shift[row_idx],
+ alu_u8_r1_shift[row_idx],
+ binary_acc_ia_shift[row_idx],
+ binary_acc_ib_shift[row_idx],
+ binary_acc_ic_shift[row_idx],
+ binary_mem_tag_ctr_shift[row_idx],
+ binary_op_id_shift[row_idx],
+ main_da_gas_remaining_shift[row_idx],
+ main_emit_l2_to_l1_msg_write_offset_shift[row_idx],
+ main_emit_note_hash_write_offset_shift[row_idx],
+ main_emit_nullifier_write_offset_shift[row_idx],
+ main_emit_unencrypted_log_write_offset_shift[row_idx],
+ main_internal_return_ptr_shift[row_idx],
+ main_l1_to_l2_msg_exists_write_offset_shift[row_idx],
main_l2_gas_remaining_shift[row_idx],
- kernel_sload_write_offset_shift[row_idx],
+ main_note_hash_exist_write_offset_shift[row_idx],
+ main_nullifier_exists_write_offset_shift[row_idx],
+ main_nullifier_non_exists_write_offset_shift[row_idx],
+ main_pc_shift[row_idx],
+ main_sel_execution_row_shift[row_idx],
+ main_side_effect_counter_shift[row_idx],
+ main_sload_write_offset_shift[row_idx],
+ main_sstore_write_offset_shift[row_idx],
+ mem_glob_addr_shift[row_idx],
+ mem_rw_shift[row_idx],
+ mem_sel_mem_shift[row_idx],
+ mem_tag_shift[row_idx],
+ mem_tsp_shift[row_idx],
+ mem_val_shift[row_idx],
slice_addr_shift[row_idx],
- binary_op_id_shift[row_idx],
- alu_p_sub_a_hi_shift[row_idx],
+ slice_clk_shift[row_idx],
+ slice_cnt_shift[row_idx],
slice_col_offset_shift[row_idx],
- alu_div_u16_r4_shift[row_idx] };
+ slice_sel_cd_cpy_shift[row_idx],
+ slice_sel_mem_active_shift[row_idx],
+ slice_sel_return_shift[row_idx],
+ slice_sel_start_shift[row_idx],
+ slice_space_id_shift[row_idx] };
}
AvmFlavor::CommitmentLabels::CommitmentLabels()
@@ -1615,10 +1615,10 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::main_sel_first = "MAIN_SEL_FIRST";
Base::main_zeroes = "MAIN_ZEROES";
Base::powers_power_of_2 = "POWERS_POWER_OF_2";
- Base::kernel_kernel_inputs = "KERNEL_KERNEL_INPUTS";
- Base::kernel_kernel_value_out = "KERNEL_KERNEL_VALUE_OUT";
- Base::kernel_kernel_side_effect_out = "KERNEL_KERNEL_SIDE_EFFECT_OUT";
- Base::kernel_kernel_metadata_out = "KERNEL_KERNEL_METADATA_OUT";
+ Base::main_kernel_inputs = "MAIN_KERNEL_INPUTS";
+ Base::main_kernel_value_out = "MAIN_KERNEL_VALUE_OUT";
+ Base::main_kernel_side_effect_out = "MAIN_KERNEL_SIDE_EFFECT_OUT";
+ Base::main_kernel_metadata_out = "MAIN_KERNEL_METADATA_OUT";
Base::main_calldata = "MAIN_CALLDATA";
Base::main_returndata = "MAIN_RETURNDATA";
Base::alu_a_hi = "ALU_A_HI";
@@ -1726,21 +1726,6 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::keccakf1600_input = "KECCAKF1600_INPUT";
Base::keccakf1600_output = "KECCAKF1600_OUTPUT";
Base::keccakf1600_sel_keccakf1600 = "KECCAKF1600_SEL_KECCAKF1600";
- Base::kernel_emit_l2_to_l1_msg_write_offset = "KERNEL_EMIT_L2_TO_L1_MSG_WRITE_OFFSET";
- Base::kernel_emit_note_hash_write_offset = "KERNEL_EMIT_NOTE_HASH_WRITE_OFFSET";
- Base::kernel_emit_nullifier_write_offset = "KERNEL_EMIT_NULLIFIER_WRITE_OFFSET";
- Base::kernel_emit_unencrypted_log_write_offset = "KERNEL_EMIT_UNENCRYPTED_LOG_WRITE_OFFSET";
- Base::kernel_kernel_in_offset = "KERNEL_KERNEL_IN_OFFSET";
- Base::kernel_kernel_out_offset = "KERNEL_KERNEL_OUT_OFFSET";
- Base::kernel_l1_to_l2_msg_exists_write_offset = "KERNEL_L1_TO_L2_MSG_EXISTS_WRITE_OFFSET";
- Base::kernel_note_hash_exist_write_offset = "KERNEL_NOTE_HASH_EXIST_WRITE_OFFSET";
- Base::kernel_nullifier_exists_write_offset = "KERNEL_NULLIFIER_EXISTS_WRITE_OFFSET";
- Base::kernel_nullifier_non_exists_write_offset = "KERNEL_NULLIFIER_NON_EXISTS_WRITE_OFFSET";
- Base::kernel_q_public_input_kernel_add_to_table = "KERNEL_Q_PUBLIC_INPUT_KERNEL_ADD_TO_TABLE";
- Base::kernel_q_public_input_kernel_out_add_to_table = "KERNEL_Q_PUBLIC_INPUT_KERNEL_OUT_ADD_TO_TABLE";
- Base::kernel_side_effect_counter = "KERNEL_SIDE_EFFECT_COUNTER";
- Base::kernel_sload_write_offset = "KERNEL_SLOAD_WRITE_OFFSET";
- Base::kernel_sstore_write_offset = "KERNEL_SSTORE_WRITE_OFFSET";
Base::main_abs_da_rem_gas_hi = "MAIN_ABS_DA_REM_GAS_HI";
Base::main_abs_da_rem_gas_lo = "MAIN_ABS_DA_REM_GAS_LO";
Base::main_abs_l2_rem_gas_hi = "MAIN_ABS_L2_REM_GAS_HI";
@@ -1755,6 +1740,10 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::main_dyn_da_gas_op_cost = "MAIN_DYN_DA_GAS_OP_COST";
Base::main_dyn_gas_multiplier = "MAIN_DYN_GAS_MULTIPLIER";
Base::main_dyn_l2_gas_op_cost = "MAIN_DYN_L2_GAS_OP_COST";
+ Base::main_emit_l2_to_l1_msg_write_offset = "MAIN_EMIT_L2_TO_L1_MSG_WRITE_OFFSET";
+ Base::main_emit_note_hash_write_offset = "MAIN_EMIT_NOTE_HASH_WRITE_OFFSET";
+ Base::main_emit_nullifier_write_offset = "MAIN_EMIT_NULLIFIER_WRITE_OFFSET";
+ Base::main_emit_unencrypted_log_write_offset = "MAIN_EMIT_UNENCRYPTED_LOG_WRITE_OFFSET";
Base::main_ia = "MAIN_IA";
Base::main_ib = "MAIN_IB";
Base::main_ic = "MAIN_IC";
@@ -1766,12 +1755,18 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::main_ind_addr_d = "MAIN_IND_ADDR_D";
Base::main_internal_return_ptr = "MAIN_INTERNAL_RETURN_PTR";
Base::main_inv = "MAIN_INV";
+ Base::main_kernel_in_offset = "MAIN_KERNEL_IN_OFFSET";
+ Base::main_kernel_out_offset = "MAIN_KERNEL_OUT_OFFSET";
+ Base::main_l1_to_l2_msg_exists_write_offset = "MAIN_L1_TO_L2_MSG_EXISTS_WRITE_OFFSET";
Base::main_l2_gas_remaining = "MAIN_L2_GAS_REMAINING";
Base::main_l2_out_of_gas = "MAIN_L2_OUT_OF_GAS";
Base::main_mem_addr_a = "MAIN_MEM_ADDR_A";
Base::main_mem_addr_b = "MAIN_MEM_ADDR_B";
Base::main_mem_addr_c = "MAIN_MEM_ADDR_C";
Base::main_mem_addr_d = "MAIN_MEM_ADDR_D";
+ Base::main_note_hash_exist_write_offset = "MAIN_NOTE_HASH_EXIST_WRITE_OFFSET";
+ Base::main_nullifier_exists_write_offset = "MAIN_NULLIFIER_EXISTS_WRITE_OFFSET";
+ Base::main_nullifier_non_exists_write_offset = "MAIN_NULLIFIER_NON_EXISTS_WRITE_OFFSET";
Base::main_op_err = "MAIN_OP_ERR";
Base::main_opcode_val = "MAIN_OPCODE_VAL";
Base::main_pc = "MAIN_PC";
@@ -1784,6 +1779,8 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::main_sel_bin = "MAIN_SEL_BIN";
Base::main_sel_calldata = "MAIN_SEL_CALLDATA";
Base::main_sel_execution_row = "MAIN_SEL_EXECUTION_ROW";
+ Base::main_sel_kernel_inputs = "MAIN_SEL_KERNEL_INPUTS";
+ Base::main_sel_kernel_out = "MAIN_SEL_KERNEL_OUT";
Base::main_sel_last = "MAIN_SEL_LAST";
Base::main_sel_mem_op_a = "MAIN_SEL_MEM_OP_A";
Base::main_sel_mem_op_b = "MAIN_SEL_MEM_OP_B";
@@ -1859,7 +1856,10 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::main_sel_rng_16 = "MAIN_SEL_RNG_16";
Base::main_sel_rng_8 = "MAIN_SEL_RNG_8";
Base::main_sel_slice_gadget = "MAIN_SEL_SLICE_GADGET";
+ Base::main_side_effect_counter = "MAIN_SIDE_EFFECT_COUNTER";
+ Base::main_sload_write_offset = "MAIN_SLOAD_WRITE_OFFSET";
Base::main_space_id = "MAIN_SPACE_ID";
+ Base::main_sstore_write_offset = "MAIN_SSTORE_WRITE_OFFSET";
Base::main_tag_err = "MAIN_TAG_ERR";
Base::main_w_in_tag = "MAIN_W_IN_TAG";
Base::mem_addr = "MEM_ADDR";
@@ -2232,10 +2232,10 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::range_check_l2_gas_lo_inv = "RANGE_CHECK_L2_GAS_LO_INV";
Base::range_check_da_gas_hi_inv = "RANGE_CHECK_DA_GAS_HI_INV";
Base::range_check_da_gas_lo_inv = "RANGE_CHECK_DA_GAS_LO_INV";
- Base::lookup_cd_value_inv = "LOOKUP_CD_VALUE_INV";
- Base::lookup_ret_value_inv = "LOOKUP_RET_VALUE_INV";
Base::kernel_output_lookup_inv = "KERNEL_OUTPUT_LOOKUP_INV";
Base::lookup_into_kernel_inv = "LOOKUP_INTO_KERNEL_INV";
+ Base::lookup_cd_value_inv = "LOOKUP_CD_VALUE_INV";
+ Base::lookup_ret_value_inv = "LOOKUP_RET_VALUE_INV";
Base::incl_main_tag_err_inv = "INCL_MAIN_TAG_ERR_INV";
Base::incl_mem_tag_err_inv = "INCL_MEM_TAG_ERR_INV";
Base::lookup_mem_rng_chk_lo_inv = "LOOKUP_MEM_RNG_CHK_LO_INV";
@@ -2275,10 +2275,10 @@ AvmFlavor::CommitmentLabels::CommitmentLabels()
Base::range_check_l2_gas_lo_counts = "RANGE_CHECK_L2_GAS_LO_COUNTS";
Base::range_check_da_gas_hi_counts = "RANGE_CHECK_DA_GAS_HI_COUNTS";
Base::range_check_da_gas_lo_counts = "RANGE_CHECK_DA_GAS_LO_COUNTS";
- Base::lookup_cd_value_counts = "LOOKUP_CD_VALUE_COUNTS";
- Base::lookup_ret_value_counts = "LOOKUP_RET_VALUE_COUNTS";
Base::kernel_output_lookup_counts = "KERNEL_OUTPUT_LOOKUP_COUNTS";
Base::lookup_into_kernel_counts = "LOOKUP_INTO_KERNEL_COUNTS";
+ Base::lookup_cd_value_counts = "LOOKUP_CD_VALUE_COUNTS";
+ Base::lookup_ret_value_counts = "LOOKUP_RET_VALUE_COUNTS";
Base::incl_main_tag_err_counts = "INCL_MAIN_TAG_ERR_COUNTS";
Base::incl_mem_tag_err_counts = "INCL_MEM_TAG_ERR_COUNTS";
Base::lookup_mem_rng_chk_lo_counts = "LOOKUP_MEM_RNG_CHK_LO_COUNTS";
diff --git a/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.hpp b/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.hpp
index 739a85d4cefc..a88d98f21a2b 100644
--- a/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.hpp
+++ b/barretenberg/cpp/src/barretenberg/vm/avm/generated/flavor.hpp
@@ -10,7 +10,6 @@
#include "barretenberg/flavor/flavor.hpp"
#include "barretenberg/flavor/flavor_macros.hpp"
#include "barretenberg/polynomials/evaluation_domain.hpp"
-#include "barretenberg/polynomials/polynomial.hpp"
#include "barretenberg/transcript/transcript.hpp"
#include "barretenberg/vm/avm/generated/flavor_settings.hpp"
@@ -103,10 +102,10 @@ template using tuple_cat_t = decltype(std::tuple_cat(std::
// The entities that will be used in the flavor.
// clang-format off
#define PRECOMPUTED_ENTITIES byte_lookup_sel_bin, byte_lookup_table_byte_lengths, byte_lookup_table_in_tags, byte_lookup_table_input_a, byte_lookup_table_input_b, byte_lookup_table_op_id, byte_lookup_table_output, gas_base_da_gas_fixed_table, gas_base_l2_gas_fixed_table, gas_dyn_da_gas_fixed_table, gas_dyn_l2_gas_fixed_table, gas_sel_gas_cost, main_clk, main_sel_first, main_zeroes, powers_power_of_2
-#define WIRE_ENTITIES kernel_kernel_inputs, kernel_kernel_value_out, kernel_kernel_side_effect_out, kernel_kernel_metadata_out, main_calldata, main_returndata, alu_a_hi, alu_a_lo, alu_b_hi, alu_b_lo, alu_borrow, alu_cf, alu_clk, alu_cmp_rng_ctr, alu_div_u16_r0, alu_div_u16_r1, alu_div_u16_r2, alu_div_u16_r3, alu_div_u16_r4, alu_div_u16_r5, alu_div_u16_r6, alu_div_u16_r7, alu_divisor_hi, alu_divisor_lo, alu_ff_tag, alu_ia, alu_ib, alu_ic, alu_in_tag, alu_op_add, alu_op_cast, alu_op_cast_prev, alu_op_div, alu_op_div_a_lt_b, alu_op_div_std, alu_op_eq, alu_op_eq_diff_inv, alu_op_lt, alu_op_lte, alu_op_mul, alu_op_not, alu_op_shl, alu_op_shr, alu_op_sub, alu_p_a_borrow, alu_p_b_borrow, alu_p_sub_a_hi, alu_p_sub_a_lo, alu_p_sub_b_hi, alu_p_sub_b_lo, alu_partial_prod_hi, alu_partial_prod_lo, alu_quotient_hi, alu_quotient_lo, alu_remainder, alu_res_hi, alu_res_lo, alu_sel_alu, alu_sel_cmp, alu_sel_div_rng_chk, alu_sel_rng_chk, alu_sel_rng_chk_lookup, alu_sel_shift_which, alu_shift_lt_bit_len, alu_t_sub_s_bits, alu_two_pow_s, alu_two_pow_t_sub_s, alu_u128_tag, alu_u16_r0, alu_u16_r1, alu_u16_r10, alu_u16_r11, alu_u16_r12, alu_u16_r13, alu_u16_r14, alu_u16_r2, alu_u16_r3, alu_u16_r4, alu_u16_r5, alu_u16_r6, alu_u16_r7, alu_u16_r8, alu_u16_r9, alu_u16_tag, alu_u32_tag, alu_u64_tag, alu_u8_r0, alu_u8_r1, alu_u8_tag, binary_acc_ia, binary_acc_ib, binary_acc_ic, binary_clk, binary_ia_bytes, binary_ib_bytes, binary_ic_bytes, binary_in_tag, binary_mem_tag_ctr, binary_mem_tag_ctr_inv, binary_op_id, binary_sel_bin, binary_start, conversion_clk, conversion_input, conversion_num_limbs, conversion_radix, conversion_sel_to_radix_le, keccakf1600_clk, keccakf1600_input, keccakf1600_output, keccakf1600_sel_keccakf1600, kernel_emit_l2_to_l1_msg_write_offset, kernel_emit_note_hash_write_offset, kernel_emit_nullifier_write_offset, kernel_emit_unencrypted_log_write_offset, kernel_kernel_in_offset, kernel_kernel_out_offset, kernel_l1_to_l2_msg_exists_write_offset, kernel_note_hash_exist_write_offset, kernel_nullifier_exists_write_offset, kernel_nullifier_non_exists_write_offset, kernel_q_public_input_kernel_add_to_table, kernel_q_public_input_kernel_out_add_to_table, kernel_side_effect_counter, kernel_sload_write_offset, kernel_sstore_write_offset, main_abs_da_rem_gas_hi, main_abs_da_rem_gas_lo, main_abs_l2_rem_gas_hi, main_abs_l2_rem_gas_lo, main_alu_in_tag, main_base_da_gas_op_cost, main_base_l2_gas_op_cost, main_bin_op_id, main_call_ptr, main_da_gas_remaining, main_da_out_of_gas, main_dyn_da_gas_op_cost, main_dyn_gas_multiplier, main_dyn_l2_gas_op_cost, main_ia, main_ib, main_ic, main_id, main_id_zero, main_ind_addr_a, main_ind_addr_b, main_ind_addr_c, main_ind_addr_d, main_internal_return_ptr, main_inv, main_l2_gas_remaining, main_l2_out_of_gas, main_mem_addr_a, main_mem_addr_b, main_mem_addr_c, main_mem_addr_d, main_op_err, main_opcode_val, main_pc, main_r_in_tag, main_rwa, main_rwb, main_rwc, main_rwd, main_sel_alu, main_sel_bin, main_sel_calldata, main_sel_execution_row, main_sel_last, main_sel_mem_op_a, main_sel_mem_op_b, main_sel_mem_op_c, main_sel_mem_op_d, main_sel_mov_ia_to_ic, main_sel_mov_ib_to_ic, main_sel_op_add, main_sel_op_address, main_sel_op_and, main_sel_op_block_number, main_sel_op_calldata_copy, main_sel_op_cast, main_sel_op_chain_id, main_sel_op_cmov, main_sel_op_coinbase, main_sel_op_dagasleft, main_sel_op_div, main_sel_op_ecadd, main_sel_op_emit_l2_to_l1_msg, main_sel_op_emit_note_hash, main_sel_op_emit_nullifier, main_sel_op_emit_unencrypted_log, main_sel_op_eq, main_sel_op_external_call, main_sel_op_external_return, main_sel_op_external_revert, main_sel_op_fdiv, main_sel_op_fee_per_da_gas, main_sel_op_fee_per_l2_gas, main_sel_op_function_selector, main_sel_op_get_contract_instance, main_sel_op_internal_call, main_sel_op_internal_return, main_sel_op_jump, main_sel_op_jumpi, main_sel_op_keccak, main_sel_op_l1_to_l2_msg_exists, main_sel_op_l2gasleft, main_sel_op_lt, main_sel_op_lte, main_sel_op_mov, main_sel_op_msm, main_sel_op_mul, main_sel_op_not, main_sel_op_note_hash_exists, main_sel_op_nullifier_exists, main_sel_op_or, main_sel_op_pedersen, main_sel_op_pedersen_commit, main_sel_op_poseidon2, main_sel_op_radix_le, main_sel_op_sender, main_sel_op_set, main_sel_op_sha256, main_sel_op_shl, main_sel_op_shr, main_sel_op_sload, main_sel_op_sstore, main_sel_op_storage_address, main_sel_op_sub, main_sel_op_timestamp, main_sel_op_transaction_fee, main_sel_op_version, main_sel_op_xor, main_sel_q_kernel_lookup, main_sel_q_kernel_output_lookup, main_sel_resolve_ind_addr_a, main_sel_resolve_ind_addr_b, main_sel_resolve_ind_addr_c, main_sel_resolve_ind_addr_d, main_sel_returndata, main_sel_rng_16, main_sel_rng_8, main_sel_slice_gadget, main_space_id, main_tag_err, main_w_in_tag, mem_addr, mem_clk, mem_diff_hi, mem_diff_lo, mem_diff_mid, mem_glob_addr, mem_last, mem_lastAccess, mem_one_min_inv, mem_r_in_tag, mem_rw, mem_sel_mem, mem_sel_mov_ia_to_ic, mem_sel_mov_ib_to_ic, mem_sel_op_a, mem_sel_op_b, mem_sel_op_c, mem_sel_op_cmov, mem_sel_op_d, mem_sel_op_poseidon_read_a, mem_sel_op_poseidon_read_b, mem_sel_op_poseidon_read_c, mem_sel_op_poseidon_read_d, mem_sel_op_poseidon_write_a, mem_sel_op_poseidon_write_b, mem_sel_op_poseidon_write_c, mem_sel_op_poseidon_write_d, mem_sel_op_slice, mem_sel_resolve_ind_addr_a, mem_sel_resolve_ind_addr_b, mem_sel_resolve_ind_addr_c, mem_sel_resolve_ind_addr_d, mem_sel_rng_chk, mem_skip_check_tag, mem_space_id, mem_tag, mem_tag_err, mem_tsp, mem_val, mem_w_in_tag, pedersen_clk, pedersen_input, pedersen_output, pedersen_sel_pedersen, poseidon2_B_10_0, poseidon2_B_10_1, poseidon2_B_10_2, poseidon2_B_10_3, poseidon2_B_11_0, poseidon2_B_11_1, poseidon2_B_11_2, poseidon2_B_11_3, poseidon2_B_12_0, poseidon2_B_12_1, poseidon2_B_12_2, poseidon2_B_12_3, poseidon2_B_13_0, poseidon2_B_13_1, poseidon2_B_13_2, poseidon2_B_13_3, poseidon2_B_14_0, poseidon2_B_14_1, poseidon2_B_14_2, poseidon2_B_14_3, poseidon2_B_15_0, poseidon2_B_15_1, poseidon2_B_15_2, poseidon2_B_15_3, poseidon2_B_16_0, poseidon2_B_16_1, poseidon2_B_16_2, poseidon2_B_16_3, poseidon2_B_17_0, poseidon2_B_17_1, poseidon2_B_17_2, poseidon2_B_17_3, poseidon2_B_18_0, poseidon2_B_18_1, poseidon2_B_18_2, poseidon2_B_18_3, poseidon2_B_19_0, poseidon2_B_19_1, poseidon2_B_19_2, poseidon2_B_19_3, poseidon2_B_20_0, poseidon2_B_20_1, poseidon2_B_20_2, poseidon2_B_20_3, poseidon2_B_21_0, poseidon2_B_21_1, poseidon2_B_21_2, poseidon2_B_21_3, poseidon2_B_22_0, poseidon2_B_22_1, poseidon2_B_22_2, poseidon2_B_22_3, poseidon2_B_23_0, poseidon2_B_23_1, poseidon2_B_23_2, poseidon2_B_23_3, poseidon2_B_24_0, poseidon2_B_24_1, poseidon2_B_24_2, poseidon2_B_24_3, poseidon2_B_25_0, poseidon2_B_25_1, poseidon2_B_25_2, poseidon2_B_25_3, poseidon2_B_26_0, poseidon2_B_26_1, poseidon2_B_26_2, poseidon2_B_26_3, poseidon2_B_27_0, poseidon2_B_27_1, poseidon2_B_27_2, poseidon2_B_27_3, poseidon2_B_28_0, poseidon2_B_28_1, poseidon2_B_28_2, poseidon2_B_28_3, poseidon2_B_29_0, poseidon2_B_29_1, poseidon2_B_29_2, poseidon2_B_29_3, poseidon2_B_30_0, poseidon2_B_30_1, poseidon2_B_30_2, poseidon2_B_30_3, poseidon2_B_31_0, poseidon2_B_31_1, poseidon2_B_31_2, poseidon2_B_31_3, poseidon2_B_32_0, poseidon2_B_32_1, poseidon2_B_32_2, poseidon2_B_32_3, poseidon2_B_33_0, poseidon2_B_33_1, poseidon2_B_33_2, poseidon2_B_33_3, poseidon2_B_34_0, poseidon2_B_34_1, poseidon2_B_34_2, poseidon2_B_34_3, poseidon2_B_35_0, poseidon2_B_35_1, poseidon2_B_35_2, poseidon2_B_35_3, poseidon2_B_36_0, poseidon2_B_36_1, poseidon2_B_36_2, poseidon2_B_36_3, poseidon2_B_37_0, poseidon2_B_37_1, poseidon2_B_37_2, poseidon2_B_37_3, poseidon2_B_38_0, poseidon2_B_38_1, poseidon2_B_38_2, poseidon2_B_38_3, poseidon2_B_39_0, poseidon2_B_39_1, poseidon2_B_39_2, poseidon2_B_39_3, poseidon2_B_40_0, poseidon2_B_40_1, poseidon2_B_40_2, poseidon2_B_40_3, poseidon2_B_41_0, poseidon2_B_41_1, poseidon2_B_41_2, poseidon2_B_41_3, poseidon2_B_42_0, poseidon2_B_42_1, poseidon2_B_42_2, poseidon2_B_42_3, poseidon2_B_43_0, poseidon2_B_43_1, poseidon2_B_43_2, poseidon2_B_43_3, poseidon2_B_44_0, poseidon2_B_44_1, poseidon2_B_44_2, poseidon2_B_44_3, poseidon2_B_45_0, poseidon2_B_45_1, poseidon2_B_45_2, poseidon2_B_45_3, poseidon2_B_46_0, poseidon2_B_46_1, poseidon2_B_46_2, poseidon2_B_46_3, poseidon2_B_47_0, poseidon2_B_47_1, poseidon2_B_47_2, poseidon2_B_47_3, poseidon2_B_48_0, poseidon2_B_48_1, poseidon2_B_48_2, poseidon2_B_48_3, poseidon2_B_49_0, poseidon2_B_49_1, poseidon2_B_49_2, poseidon2_B_49_3, poseidon2_B_4_0, poseidon2_B_4_1, poseidon2_B_4_2, poseidon2_B_4_3, poseidon2_B_50_0, poseidon2_B_50_1, poseidon2_B_50_2, poseidon2_B_50_3, poseidon2_B_51_0, poseidon2_B_51_1, poseidon2_B_51_2, poseidon2_B_51_3, poseidon2_B_52_0, poseidon2_B_52_1, poseidon2_B_52_2, poseidon2_B_52_3, poseidon2_B_53_0, poseidon2_B_53_1, poseidon2_B_53_2, poseidon2_B_53_3, poseidon2_B_54_0, poseidon2_B_54_1, poseidon2_B_54_2, poseidon2_B_54_3, poseidon2_B_55_0, poseidon2_B_55_1, poseidon2_B_55_2, poseidon2_B_55_3, poseidon2_B_56_0, poseidon2_B_56_1, poseidon2_B_56_2, poseidon2_B_56_3, poseidon2_B_57_0, poseidon2_B_57_1, poseidon2_B_57_2, poseidon2_B_57_3, poseidon2_B_58_0, poseidon2_B_58_1, poseidon2_B_58_2, poseidon2_B_58_3, poseidon2_B_59_0, poseidon2_B_59_1, poseidon2_B_59_2, poseidon2_B_59_3, poseidon2_B_5_0, poseidon2_B_5_1, poseidon2_B_5_2, poseidon2_B_5_3, poseidon2_B_6_0, poseidon2_B_6_1, poseidon2_B_6_2, poseidon2_B_6_3, poseidon2_B_7_0, poseidon2_B_7_1, poseidon2_B_7_2, poseidon2_B_7_3, poseidon2_B_8_0, poseidon2_B_8_1, poseidon2_B_8_2, poseidon2_B_8_3, poseidon2_B_9_0, poseidon2_B_9_1, poseidon2_B_9_2, poseidon2_B_9_3, poseidon2_EXT_LAYER_4, poseidon2_EXT_LAYER_5, poseidon2_EXT_LAYER_6, poseidon2_EXT_LAYER_7, poseidon2_T_0_4, poseidon2_T_0_5, poseidon2_T_0_6, poseidon2_T_0_7, poseidon2_T_1_4, poseidon2_T_1_5, poseidon2_T_1_6, poseidon2_T_1_7, poseidon2_T_2_4, poseidon2_T_2_5, poseidon2_T_2_6, poseidon2_T_2_7, poseidon2_T_3_4, poseidon2_T_3_5, poseidon2_T_3_6, poseidon2_T_3_7, poseidon2_T_60_4, poseidon2_T_60_5, poseidon2_T_60_6, poseidon2_T_60_7, poseidon2_T_61_4, poseidon2_T_61_5, poseidon2_T_61_6, poseidon2_T_61_7, poseidon2_T_62_4, poseidon2_T_62_5, poseidon2_T_62_6, poseidon2_T_62_7, poseidon2_T_63_4, poseidon2_T_63_5, poseidon2_T_63_6, poseidon2_T_63_7, poseidon2_a_0, poseidon2_a_1, poseidon2_a_2, poseidon2_a_3, poseidon2_b_0, poseidon2_b_1, poseidon2_b_2, poseidon2_b_3, poseidon2_clk, poseidon2_input_addr, poseidon2_mem_addr_read_a, poseidon2_mem_addr_read_b, poseidon2_mem_addr_read_c, poseidon2_mem_addr_read_d, poseidon2_mem_addr_write_a, poseidon2_mem_addr_write_b, poseidon2_mem_addr_write_c, poseidon2_mem_addr_write_d, poseidon2_output_addr, poseidon2_sel_poseidon_perm, sha256_clk, sha256_input, sha256_output, sha256_sel_sha256_compression, sha256_state, slice_addr, slice_clk, slice_cnt, slice_col_offset, slice_one_min_inv, slice_sel_cd_cpy, slice_sel_mem_active, slice_sel_return, slice_sel_start, slice_space_id, slice_val, lookup_byte_lengths_counts, lookup_byte_operations_counts, lookup_opcode_gas_counts, range_check_l2_gas_hi_counts, range_check_l2_gas_lo_counts, range_check_da_gas_hi_counts, range_check_da_gas_lo_counts, lookup_cd_value_counts, lookup_ret_value_counts, kernel_output_lookup_counts, lookup_into_kernel_counts, incl_main_tag_err_counts, incl_mem_tag_err_counts, lookup_mem_rng_chk_lo_counts, lookup_mem_rng_chk_mid_counts, lookup_mem_rng_chk_hi_counts, lookup_pow_2_0_counts, lookup_pow_2_1_counts, lookup_u8_0_counts, lookup_u8_1_counts, lookup_u16_0_counts, lookup_u16_1_counts, lookup_u16_2_counts, lookup_u16_3_counts, lookup_u16_4_counts, lookup_u16_5_counts, lookup_u16_6_counts, lookup_u16_7_counts, lookup_u16_8_counts, lookup_u16_9_counts, lookup_u16_10_counts, lookup_u16_11_counts, lookup_u16_12_counts, lookup_u16_13_counts, lookup_u16_14_counts, lookup_div_u16_0_counts, lookup_div_u16_1_counts, lookup_div_u16_2_counts, lookup_div_u16_3_counts, lookup_div_u16_4_counts, lookup_div_u16_5_counts, lookup_div_u16_6_counts, lookup_div_u16_7_counts
-#define DERIVED_WITNESS_ENTITIES perm_pos_mem_read_a_inv, perm_pos_mem_read_b_inv, perm_pos_mem_read_c_inv, perm_pos_mem_read_d_inv, perm_pos_mem_write_a_inv, perm_pos_mem_write_b_inv, perm_pos_mem_write_c_inv, perm_pos_mem_write_d_inv, perm_slice_mem_inv, perm_main_alu_inv, perm_main_bin_inv, perm_main_conv_inv, perm_main_pos2_perm_inv, perm_main_pedersen_inv, perm_main_slice_inv, perm_main_mem_a_inv, perm_main_mem_b_inv, perm_main_mem_c_inv, perm_main_mem_d_inv, perm_main_mem_ind_addr_a_inv, perm_main_mem_ind_addr_b_inv, perm_main_mem_ind_addr_c_inv, perm_main_mem_ind_addr_d_inv, lookup_byte_lengths_inv, lookup_byte_operations_inv, lookup_opcode_gas_inv, range_check_l2_gas_hi_inv, range_check_l2_gas_lo_inv, range_check_da_gas_hi_inv, range_check_da_gas_lo_inv, lookup_cd_value_inv, lookup_ret_value_inv, kernel_output_lookup_inv, lookup_into_kernel_inv, incl_main_tag_err_inv, incl_mem_tag_err_inv, lookup_mem_rng_chk_lo_inv, lookup_mem_rng_chk_mid_inv, lookup_mem_rng_chk_hi_inv, lookup_pow_2_0_inv, lookup_pow_2_1_inv, lookup_u8_0_inv, lookup_u8_1_inv, lookup_u16_0_inv, lookup_u16_1_inv, lookup_u16_2_inv, lookup_u16_3_inv, lookup_u16_4_inv, lookup_u16_5_inv, lookup_u16_6_inv, lookup_u16_7_inv, lookup_u16_8_inv, lookup_u16_9_inv, lookup_u16_10_inv, lookup_u16_11_inv, lookup_u16_12_inv, lookup_u16_13_inv, lookup_u16_14_inv, lookup_div_u16_0_inv, lookup_div_u16_1_inv, lookup_div_u16_2_inv, lookup_div_u16_3_inv, lookup_div_u16_4_inv, lookup_div_u16_5_inv, lookup_div_u16_6_inv, lookup_div_u16_7_inv
-#define SHIFTED_ENTITIES alu_div_u16_r1_shift, slice_clk_shift, alu_div_u16_r6_shift, kernel_nullifier_exists_write_offset_shift, mem_tsp_shift, main_internal_return_ptr_shift, main_sel_execution_row_shift, alu_sel_rng_chk_shift, alu_div_u16_r3_shift, kernel_emit_note_hash_write_offset_shift, alu_p_sub_b_hi_shift, slice_sel_return_shift, kernel_side_effect_counter_shift, alu_op_add_shift, alu_op_cast_shift, kernel_emit_nullifier_write_offset_shift, slice_cnt_shift, alu_sel_cmp_shift, alu_u16_r1_shift, binary_acc_ia_shift, alu_div_u16_r0_shift, kernel_l1_to_l2_msg_exists_write_offset_shift, alu_a_hi_shift, alu_div_u16_r5_shift, kernel_emit_unencrypted_log_write_offset_shift, mem_val_shift, slice_sel_start_shift, binary_acc_ic_shift, alu_sel_div_rng_chk_shift, alu_u16_r6_shift, alu_op_shr_shift, slice_space_id_shift, mem_tag_shift, alu_op_mul_shift, binary_mem_tag_ctr_shift, kernel_emit_l2_to_l1_msg_write_offset_shift, alu_sel_alu_shift, mem_rw_shift, mem_glob_addr_shift, alu_u16_r3_shift, kernel_sstore_write_offset_shift, mem_sel_mem_shift, slice_sel_mem_active_shift, alu_op_shl_shift, alu_b_hi_shift, alu_cmp_rng_ctr_shift, alu_op_cast_prev_shift, alu_sel_rng_chk_lookup_shift, slice_sel_cd_cpy_shift, main_pc_shift, alu_u8_r1_shift, alu_p_sub_a_lo_shift, main_da_gas_remaining_shift, alu_b_lo_shift, alu_u8_r0_shift, alu_p_sub_b_lo_shift, kernel_nullifier_non_exists_write_offset_shift, alu_u16_r4_shift, binary_acc_ib_shift, alu_u16_r0_shift, alu_div_u16_r2_shift, alu_op_div_shift, alu_a_lo_shift, alu_op_sub_shift, alu_div_u16_r7_shift, alu_u16_r5_shift, alu_u16_r2_shift, kernel_note_hash_exist_write_offset_shift, main_l2_gas_remaining_shift, kernel_sload_write_offset_shift, slice_addr_shift, binary_op_id_shift, alu_p_sub_a_hi_shift, slice_col_offset_shift, alu_div_u16_r4_shift
-#define TO_BE_SHIFTED(e) e.alu_div_u16_r1, e.slice_clk, e.alu_div_u16_r6, e.kernel_nullifier_exists_write_offset, e.mem_tsp, e.main_internal_return_ptr, e.main_sel_execution_row, e.alu_sel_rng_chk, e.alu_div_u16_r3, e.kernel_emit_note_hash_write_offset, e.alu_p_sub_b_hi, e.slice_sel_return, e.kernel_side_effect_counter, e.alu_op_add, e.alu_op_cast, e.kernel_emit_nullifier_write_offset, e.slice_cnt, e.alu_sel_cmp, e.alu_u16_r1, e.binary_acc_ia, e.alu_div_u16_r0, e.kernel_l1_to_l2_msg_exists_write_offset, e.alu_a_hi, e.alu_div_u16_r5, e.kernel_emit_unencrypted_log_write_offset, e.mem_val, e.slice_sel_start, e.binary_acc_ic, e.alu_sel_div_rng_chk, e.alu_u16_r6, e.alu_op_shr, e.slice_space_id, e.mem_tag, e.alu_op_mul, e.binary_mem_tag_ctr, e.kernel_emit_l2_to_l1_msg_write_offset, e.alu_sel_alu, e.mem_rw, e.mem_glob_addr, e.alu_u16_r3, e.kernel_sstore_write_offset, e.mem_sel_mem, e.slice_sel_mem_active, e.alu_op_shl, e.alu_b_hi, e.alu_cmp_rng_ctr, e.alu_op_cast_prev, e.alu_sel_rng_chk_lookup, e.slice_sel_cd_cpy, e.main_pc, e.alu_u8_r1, e.alu_p_sub_a_lo, e.main_da_gas_remaining, e.alu_b_lo, e.alu_u8_r0, e.alu_p_sub_b_lo, e.kernel_nullifier_non_exists_write_offset, e.alu_u16_r4, e.binary_acc_ib, e.alu_u16_r0, e.alu_div_u16_r2, e.alu_op_div, e.alu_a_lo, e.alu_op_sub, e.alu_div_u16_r7, e.alu_u16_r5, e.alu_u16_r2, e.kernel_note_hash_exist_write_offset, e.main_l2_gas_remaining, e.kernel_sload_write_offset, e.slice_addr, e.binary_op_id, e.alu_p_sub_a_hi, e.slice_col_offset, e.alu_div_u16_r4
+#define WIRE_ENTITIES main_kernel_inputs, main_kernel_value_out, main_kernel_side_effect_out, main_kernel_metadata_out, main_calldata, main_returndata, alu_a_hi, alu_a_lo, alu_b_hi, alu_b_lo, alu_borrow, alu_cf, alu_clk, alu_cmp_rng_ctr, alu_div_u16_r0, alu_div_u16_r1, alu_div_u16_r2, alu_div_u16_r3, alu_div_u16_r4, alu_div_u16_r5, alu_div_u16_r6, alu_div_u16_r7, alu_divisor_hi, alu_divisor_lo, alu_ff_tag, alu_ia, alu_ib, alu_ic, alu_in_tag, alu_op_add, alu_op_cast, alu_op_cast_prev, alu_op_div, alu_op_div_a_lt_b, alu_op_div_std, alu_op_eq, alu_op_eq_diff_inv, alu_op_lt, alu_op_lte, alu_op_mul, alu_op_not, alu_op_shl, alu_op_shr, alu_op_sub, alu_p_a_borrow, alu_p_b_borrow, alu_p_sub_a_hi, alu_p_sub_a_lo, alu_p_sub_b_hi, alu_p_sub_b_lo, alu_partial_prod_hi, alu_partial_prod_lo, alu_quotient_hi, alu_quotient_lo, alu_remainder, alu_res_hi, alu_res_lo, alu_sel_alu, alu_sel_cmp, alu_sel_div_rng_chk, alu_sel_rng_chk, alu_sel_rng_chk_lookup, alu_sel_shift_which, alu_shift_lt_bit_len, alu_t_sub_s_bits, alu_two_pow_s, alu_two_pow_t_sub_s, alu_u128_tag, alu_u16_r0, alu_u16_r1, alu_u16_r10, alu_u16_r11, alu_u16_r12, alu_u16_r13, alu_u16_r14, alu_u16_r2, alu_u16_r3, alu_u16_r4, alu_u16_r5, alu_u16_r6, alu_u16_r7, alu_u16_r8, alu_u16_r9, alu_u16_tag, alu_u32_tag, alu_u64_tag, alu_u8_r0, alu_u8_r1, alu_u8_tag, binary_acc_ia, binary_acc_ib, binary_acc_ic, binary_clk, binary_ia_bytes, binary_ib_bytes, binary_ic_bytes, binary_in_tag, binary_mem_tag_ctr, binary_mem_tag_ctr_inv, binary_op_id, binary_sel_bin, binary_start, conversion_clk, conversion_input, conversion_num_limbs, conversion_radix, conversion_sel_to_radix_le, keccakf1600_clk, keccakf1600_input, keccakf1600_output, keccakf1600_sel_keccakf1600, main_abs_da_rem_gas_hi, main_abs_da_rem_gas_lo, main_abs_l2_rem_gas_hi, main_abs_l2_rem_gas_lo, main_alu_in_tag, main_base_da_gas_op_cost, main_base_l2_gas_op_cost, main_bin_op_id, main_call_ptr, main_da_gas_remaining, main_da_out_of_gas, main_dyn_da_gas_op_cost, main_dyn_gas_multiplier, main_dyn_l2_gas_op_cost, main_emit_l2_to_l1_msg_write_offset, main_emit_note_hash_write_offset, main_emit_nullifier_write_offset, main_emit_unencrypted_log_write_offset, main_ia, main_ib, main_ic, main_id, main_id_zero, main_ind_addr_a, main_ind_addr_b, main_ind_addr_c, main_ind_addr_d, main_internal_return_ptr, main_inv, main_kernel_in_offset, main_kernel_out_offset, main_l1_to_l2_msg_exists_write_offset, main_l2_gas_remaining, main_l2_out_of_gas, main_mem_addr_a, main_mem_addr_b, main_mem_addr_c, main_mem_addr_d, main_note_hash_exist_write_offset, main_nullifier_exists_write_offset, main_nullifier_non_exists_write_offset, main_op_err, main_opcode_val, main_pc, main_r_in_tag, main_rwa, main_rwb, main_rwc, main_rwd, main_sel_alu, main_sel_bin, main_sel_calldata, main_sel_execution_row, main_sel_kernel_inputs, main_sel_kernel_out, main_sel_last, main_sel_mem_op_a, main_sel_mem_op_b, main_sel_mem_op_c, main_sel_mem_op_d, main_sel_mov_ia_to_ic, main_sel_mov_ib_to_ic, main_sel_op_add, main_sel_op_address, main_sel_op_and, main_sel_op_block_number, main_sel_op_calldata_copy, main_sel_op_cast, main_sel_op_chain_id, main_sel_op_cmov, main_sel_op_coinbase, main_sel_op_dagasleft, main_sel_op_div, main_sel_op_ecadd, main_sel_op_emit_l2_to_l1_msg, main_sel_op_emit_note_hash, main_sel_op_emit_nullifier, main_sel_op_emit_unencrypted_log, main_sel_op_eq, main_sel_op_external_call, main_sel_op_external_return, main_sel_op_external_revert, main_sel_op_fdiv, main_sel_op_fee_per_da_gas, main_sel_op_fee_per_l2_gas, main_sel_op_function_selector, main_sel_op_get_contract_instance, main_sel_op_internal_call, main_sel_op_internal_return, main_sel_op_jump, main_sel_op_jumpi, main_sel_op_keccak, main_sel_op_l1_to_l2_msg_exists, main_sel_op_l2gasleft, main_sel_op_lt, main_sel_op_lte, main_sel_op_mov, main_sel_op_msm, main_sel_op_mul, main_sel_op_not, main_sel_op_note_hash_exists, main_sel_op_nullifier_exists, main_sel_op_or, main_sel_op_pedersen, main_sel_op_pedersen_commit, main_sel_op_poseidon2, main_sel_op_radix_le, main_sel_op_sender, main_sel_op_set, main_sel_op_sha256, main_sel_op_shl, main_sel_op_shr, main_sel_op_sload, main_sel_op_sstore, main_sel_op_storage_address, main_sel_op_sub, main_sel_op_timestamp, main_sel_op_transaction_fee, main_sel_op_version, main_sel_op_xor, main_sel_q_kernel_lookup, main_sel_q_kernel_output_lookup, main_sel_resolve_ind_addr_a, main_sel_resolve_ind_addr_b, main_sel_resolve_ind_addr_c, main_sel_resolve_ind_addr_d, main_sel_returndata, main_sel_rng_16, main_sel_rng_8, main_sel_slice_gadget, main_side_effect_counter, main_sload_write_offset, main_space_id, main_sstore_write_offset, main_tag_err, main_w_in_tag, mem_addr, mem_clk, mem_diff_hi, mem_diff_lo, mem_diff_mid, mem_glob_addr, mem_last, mem_lastAccess, mem_one_min_inv, mem_r_in_tag, mem_rw, mem_sel_mem, mem_sel_mov_ia_to_ic, mem_sel_mov_ib_to_ic, mem_sel_op_a, mem_sel_op_b, mem_sel_op_c, mem_sel_op_cmov, mem_sel_op_d, mem_sel_op_poseidon_read_a, mem_sel_op_poseidon_read_b, mem_sel_op_poseidon_read_c, mem_sel_op_poseidon_read_d, mem_sel_op_poseidon_write_a, mem_sel_op_poseidon_write_b, mem_sel_op_poseidon_write_c, mem_sel_op_poseidon_write_d, mem_sel_op_slice, mem_sel_resolve_ind_addr_a, mem_sel_resolve_ind_addr_b, mem_sel_resolve_ind_addr_c, mem_sel_resolve_ind_addr_d, mem_sel_rng_chk, mem_skip_check_tag, mem_space_id, mem_tag, mem_tag_err, mem_tsp, mem_val, mem_w_in_tag, pedersen_clk, pedersen_input, pedersen_output, pedersen_sel_pedersen, poseidon2_B_10_0, poseidon2_B_10_1, poseidon2_B_10_2, poseidon2_B_10_3, poseidon2_B_11_0, poseidon2_B_11_1, poseidon2_B_11_2, poseidon2_B_11_3, poseidon2_B_12_0, poseidon2_B_12_1, poseidon2_B_12_2, poseidon2_B_12_3, poseidon2_B_13_0, poseidon2_B_13_1, poseidon2_B_13_2, poseidon2_B_13_3, poseidon2_B_14_0, poseidon2_B_14_1, poseidon2_B_14_2, poseidon2_B_14_3, poseidon2_B_15_0, poseidon2_B_15_1, poseidon2_B_15_2, poseidon2_B_15_3, poseidon2_B_16_0, poseidon2_B_16_1, poseidon2_B_16_2, poseidon2_B_16_3, poseidon2_B_17_0, poseidon2_B_17_1, poseidon2_B_17_2, poseidon2_B_17_3, poseidon2_B_18_0, poseidon2_B_18_1, poseidon2_B_18_2, poseidon2_B_18_3, poseidon2_B_19_0, poseidon2_B_19_1, poseidon2_B_19_2, poseidon2_B_19_3, poseidon2_B_20_0, poseidon2_B_20_1, poseidon2_B_20_2, poseidon2_B_20_3, poseidon2_B_21_0, poseidon2_B_21_1, poseidon2_B_21_2, poseidon2_B_21_3, poseidon2_B_22_0, poseidon2_B_22_1, poseidon2_B_22_2, poseidon2_B_22_3, poseidon2_B_23_0, poseidon2_B_23_1, poseidon2_B_23_2, poseidon2_B_23_3, poseidon2_B_24_0, poseidon2_B_24_1, poseidon2_B_24_2, poseidon2_B_24_3, poseidon2_B_25_0, poseidon2_B_25_1, poseidon2_B_25_2, poseidon2_B_25_3, poseidon2_B_26_0, poseidon2_B_26_1, poseidon2_B_26_2, poseidon2_B_26_3, poseidon2_B_27_0, poseidon2_B_27_1, poseidon2_B_27_2, poseidon2_B_27_3, poseidon2_B_28_0, poseidon2_B_28_1, poseidon2_B_28_2, poseidon2_B_28_3, poseidon2_B_29_0, poseidon2_B_29_1, poseidon2_B_29_2, poseidon2_B_29_3, poseidon2_B_30_0, poseidon2_B_30_1, poseidon2_B_30_2, poseidon2_B_30_3, poseidon2_B_31_0, poseidon2_B_31_1, poseidon2_B_31_2, poseidon2_B_31_3, poseidon2_B_32_0, poseidon2_B_32_1, poseidon2_B_32_2, poseidon2_B_32_3, poseidon2_B_33_0, poseidon2_B_33_1, poseidon2_B_33_2, poseidon2_B_33_3, poseidon2_B_34_0, poseidon2_B_34_1, poseidon2_B_34_2, poseidon2_B_34_3, poseidon2_B_35_0, poseidon2_B_35_1, poseidon2_B_35_2, poseidon2_B_35_3, poseidon2_B_36_0, poseidon2_B_36_1, poseidon2_B_36_2, poseidon2_B_36_3, poseidon2_B_37_0, poseidon2_B_37_1, poseidon2_B_37_2, poseidon2_B_37_3, poseidon2_B_38_0, poseidon2_B_38_1, poseidon2_B_38_2, poseidon2_B_38_3, poseidon2_B_39_0, poseidon2_B_39_1, poseidon2_B_39_2, poseidon2_B_39_3, poseidon2_B_40_0, poseidon2_B_40_1, poseidon2_B_40_2, poseidon2_B_40_3, poseidon2_B_41_0, poseidon2_B_41_1, poseidon2_B_41_2, poseidon2_B_41_3, poseidon2_B_42_0, poseidon2_B_42_1, poseidon2_B_42_2, poseidon2_B_42_3, poseidon2_B_43_0, poseidon2_B_43_1, poseidon2_B_43_2, poseidon2_B_43_3, poseidon2_B_44_0, poseidon2_B_44_1, poseidon2_B_44_2, poseidon2_B_44_3, poseidon2_B_45_0, poseidon2_B_45_1, poseidon2_B_45_2, poseidon2_B_45_3, poseidon2_B_46_0, poseidon2_B_46_1, poseidon2_B_46_2, poseidon2_B_46_3, poseidon2_B_47_0, poseidon2_B_47_1, poseidon2_B_47_2, poseidon2_B_47_3, poseidon2_B_48_0, poseidon2_B_48_1, poseidon2_B_48_2, poseidon2_B_48_3, poseidon2_B_49_0, poseidon2_B_49_1, poseidon2_B_49_2, poseidon2_B_49_3, poseidon2_B_4_0, poseidon2_B_4_1, poseidon2_B_4_2, poseidon2_B_4_3, poseidon2_B_50_0, poseidon2_B_50_1, poseidon2_B_50_2, poseidon2_B_50_3, poseidon2_B_51_0, poseidon2_B_51_1, poseidon2_B_51_2, poseidon2_B_51_3, poseidon2_B_52_0, poseidon2_B_52_1, poseidon2_B_52_2, poseidon2_B_52_3, poseidon2_B_53_0, poseidon2_B_53_1, poseidon2_B_53_2, poseidon2_B_53_3, poseidon2_B_54_0, poseidon2_B_54_1, poseidon2_B_54_2, poseidon2_B_54_3, poseidon2_B_55_0, poseidon2_B_55_1, poseidon2_B_55_2, poseidon2_B_55_3, poseidon2_B_56_0, poseidon2_B_56_1, poseidon2_B_56_2, poseidon2_B_56_3, poseidon2_B_57_0, poseidon2_B_57_1, poseidon2_B_57_2, poseidon2_B_57_3, poseidon2_B_58_0, poseidon2_B_58_1, poseidon2_B_58_2, poseidon2_B_58_3, poseidon2_B_59_0, poseidon2_B_59_1, poseidon2_B_59_2, poseidon2_B_59_3, poseidon2_B_5_0, poseidon2_B_5_1, poseidon2_B_5_2, poseidon2_B_5_3, poseidon2_B_6_0, poseidon2_B_6_1, poseidon2_B_6_2, poseidon2_B_6_3, poseidon2_B_7_0, poseidon2_B_7_1, poseidon2_B_7_2, poseidon2_B_7_3, poseidon2_B_8_0, poseidon2_B_8_1, poseidon2_B_8_2, poseidon2_B_8_3, poseidon2_B_9_0, poseidon2_B_9_1, poseidon2_B_9_2, poseidon2_B_9_3, poseidon2_EXT_LAYER_4, poseidon2_EXT_LAYER_5, poseidon2_EXT_LAYER_6, poseidon2_EXT_LAYER_7, poseidon2_T_0_4, poseidon2_T_0_5, poseidon2_T_0_6, poseidon2_T_0_7, poseidon2_T_1_4, poseidon2_T_1_5, poseidon2_T_1_6, poseidon2_T_1_7, poseidon2_T_2_4, poseidon2_T_2_5, poseidon2_T_2_6, poseidon2_T_2_7, poseidon2_T_3_4, poseidon2_T_3_5, poseidon2_T_3_6, poseidon2_T_3_7, poseidon2_T_60_4, poseidon2_T_60_5, poseidon2_T_60_6, poseidon2_T_60_7, poseidon2_T_61_4, poseidon2_T_61_5, poseidon2_T_61_6, poseidon2_T_61_7, poseidon2_T_62_4, poseidon2_T_62_5, poseidon2_T_62_6, poseidon2_T_62_7, poseidon2_T_63_4, poseidon2_T_63_5, poseidon2_T_63_6, poseidon2_T_63_7, poseidon2_a_0, poseidon2_a_1, poseidon2_a_2, poseidon2_a_3, poseidon2_b_0, poseidon2_b_1, poseidon2_b_2, poseidon2_b_3, poseidon2_clk, poseidon2_input_addr, poseidon2_mem_addr_read_a, poseidon2_mem_addr_read_b, poseidon2_mem_addr_read_c, poseidon2_mem_addr_read_d, poseidon2_mem_addr_write_a, poseidon2_mem_addr_write_b, poseidon2_mem_addr_write_c, poseidon2_mem_addr_write_d, poseidon2_output_addr, poseidon2_sel_poseidon_perm, sha256_clk, sha256_input, sha256_output, sha256_sel_sha256_compression, sha256_state, slice_addr, slice_clk, slice_cnt, slice_col_offset, slice_one_min_inv, slice_sel_cd_cpy, slice_sel_mem_active, slice_sel_return, slice_sel_start, slice_space_id, slice_val, lookup_byte_lengths_counts, lookup_byte_operations_counts, lookup_opcode_gas_counts, range_check_l2_gas_hi_counts, range_check_l2_gas_lo_counts, range_check_da_gas_hi_counts, range_check_da_gas_lo_counts, kernel_output_lookup_counts, lookup_into_kernel_counts, lookup_cd_value_counts, lookup_ret_value_counts, incl_main_tag_err_counts, incl_mem_tag_err_counts, lookup_mem_rng_chk_lo_counts, lookup_mem_rng_chk_mid_counts, lookup_mem_rng_chk_hi_counts, lookup_pow_2_0_counts, lookup_pow_2_1_counts, lookup_u8_0_counts, lookup_u8_1_counts, lookup_u16_0_counts, lookup_u16_1_counts, lookup_u16_2_counts, lookup_u16_3_counts, lookup_u16_4_counts, lookup_u16_5_counts, lookup_u16_6_counts, lookup_u16_7_counts, lookup_u16_8_counts, lookup_u16_9_counts, lookup_u16_10_counts, lookup_u16_11_counts, lookup_u16_12_counts, lookup_u16_13_counts, lookup_u16_14_counts, lookup_div_u16_0_counts, lookup_div_u16_1_counts, lookup_div_u16_2_counts, lookup_div_u16_3_counts, lookup_div_u16_4_counts, lookup_div_u16_5_counts, lookup_div_u16_6_counts, lookup_div_u16_7_counts
+#define DERIVED_WITNESS_ENTITIES perm_pos_mem_read_a_inv, perm_pos_mem_read_b_inv, perm_pos_mem_read_c_inv, perm_pos_mem_read_d_inv, perm_pos_mem_write_a_inv, perm_pos_mem_write_b_inv, perm_pos_mem_write_c_inv, perm_pos_mem_write_d_inv, perm_slice_mem_inv, perm_main_alu_inv, perm_main_bin_inv, perm_main_conv_inv, perm_main_pos2_perm_inv, perm_main_pedersen_inv, perm_main_slice_inv, perm_main_mem_a_inv, perm_main_mem_b_inv, perm_main_mem_c_inv, perm_main_mem_d_inv, perm_main_mem_ind_addr_a_inv, perm_main_mem_ind_addr_b_inv, perm_main_mem_ind_addr_c_inv, perm_main_mem_ind_addr_d_inv, lookup_byte_lengths_inv, lookup_byte_operations_inv, lookup_opcode_gas_inv, range_check_l2_gas_hi_inv, range_check_l2_gas_lo_inv, range_check_da_gas_hi_inv, range_check_da_gas_lo_inv, kernel_output_lookup_inv, lookup_into_kernel_inv, lookup_cd_value_inv, lookup_ret_value_inv, incl_main_tag_err_inv, incl_mem_tag_err_inv, lookup_mem_rng_chk_lo_inv, lookup_mem_rng_chk_mid_inv, lookup_mem_rng_chk_hi_inv, lookup_pow_2_0_inv, lookup_pow_2_1_inv, lookup_u8_0_inv, lookup_u8_1_inv, lookup_u16_0_inv, lookup_u16_1_inv, lookup_u16_2_inv, lookup_u16_3_inv, lookup_u16_4_inv, lookup_u16_5_inv, lookup_u16_6_inv, lookup_u16_7_inv, lookup_u16_8_inv, lookup_u16_9_inv, lookup_u16_10_inv, lookup_u16_11_inv, lookup_u16_12_inv, lookup_u16_13_inv, lookup_u16_14_inv, lookup_div_u16_0_inv, lookup_div_u16_1_inv, lookup_div_u16_2_inv, lookup_div_u16_3_inv, lookup_div_u16_4_inv, lookup_div_u16_5_inv, lookup_div_u16_6_inv, lookup_div_u16_7_inv
+#define SHIFTED_ENTITIES alu_a_hi_shift, alu_a_lo_shift, alu_b_hi_shift, alu_b_lo_shift, alu_cmp_rng_ctr_shift, alu_div_u16_r0_shift, alu_div_u16_r1_shift, alu_div_u16_r2_shift, alu_div_u16_r3_shift, alu_div_u16_r4_shift, alu_div_u16_r5_shift, alu_div_u16_r6_shift, alu_div_u16_r7_shift, alu_op_add_shift, alu_op_cast_shift, alu_op_cast_prev_shift, alu_op_div_shift, alu_op_mul_shift, alu_op_shl_shift, alu_op_shr_shift, alu_op_sub_shift, alu_p_sub_a_hi_shift, alu_p_sub_a_lo_shift, alu_p_sub_b_hi_shift, alu_p_sub_b_lo_shift, alu_sel_alu_shift, alu_sel_cmp_shift, alu_sel_div_rng_chk_shift, alu_sel_rng_chk_shift, alu_sel_rng_chk_lookup_shift, alu_u16_r0_shift, alu_u16_r1_shift, alu_u16_r2_shift, alu_u16_r3_shift, alu_u16_r4_shift, alu_u16_r5_shift, alu_u16_r6_shift, alu_u8_r0_shift, alu_u8_r1_shift, binary_acc_ia_shift, binary_acc_ib_shift, binary_acc_ic_shift, binary_mem_tag_ctr_shift, binary_op_id_shift, main_da_gas_remaining_shift, main_emit_l2_to_l1_msg_write_offset_shift, main_emit_note_hash_write_offset_shift, main_emit_nullifier_write_offset_shift, main_emit_unencrypted_log_write_offset_shift, main_internal_return_ptr_shift, main_l1_to_l2_msg_exists_write_offset_shift, main_l2_gas_remaining_shift, main_note_hash_exist_write_offset_shift, main_nullifier_exists_write_offset_shift, main_nullifier_non_exists_write_offset_shift, main_pc_shift, main_sel_execution_row_shift, main_side_effect_counter_shift, main_sload_write_offset_shift, main_sstore_write_offset_shift, mem_glob_addr_shift, mem_rw_shift, mem_sel_mem_shift, mem_tag_shift, mem_tsp_shift, mem_val_shift, slice_addr_shift, slice_clk_shift, slice_cnt_shift, slice_col_offset_shift, slice_sel_cd_cpy_shift, slice_sel_mem_active_shift, slice_sel_return_shift, slice_sel_start_shift, slice_space_id_shift
+#define TO_BE_SHIFTED(e) e.alu_a_hi, e.alu_a_lo, e.alu_b_hi, e.alu_b_lo, e.alu_cmp_rng_ctr, e.alu_div_u16_r0, e.alu_div_u16_r1, e.alu_div_u16_r2, e.alu_div_u16_r3, e.alu_div_u16_r4, e.alu_div_u16_r5, e.alu_div_u16_r6, e.alu_div_u16_r7, e.alu_op_add, e.alu_op_cast, e.alu_op_cast_prev, e.alu_op_div, e.alu_op_mul, e.alu_op_shl, e.alu_op_shr, e.alu_op_sub, e.alu_p_sub_a_hi, e.alu_p_sub_a_lo, e.alu_p_sub_b_hi, e.alu_p_sub_b_lo, e.alu_sel_alu, e.alu_sel_cmp, e.alu_sel_div_rng_chk, e.alu_sel_rng_chk, e.alu_sel_rng_chk_lookup, e.alu_u16_r0, e.alu_u16_r1, e.alu_u16_r2, e.alu_u16_r3, e.alu_u16_r4, e.alu_u16_r5, e.alu_u16_r6, e.alu_u8_r0, e.alu_u8_r1, e.binary_acc_ia, e.binary_acc_ib, e.binary_acc_ic, e.binary_mem_tag_ctr, e.binary_op_id, e.main_da_gas_remaining, e.main_emit_l2_to_l1_msg_write_offset, e.main_emit_note_hash_write_offset, e.main_emit_nullifier_write_offset, e.main_emit_unencrypted_log_write_offset, e.main_internal_return_ptr, e.main_l1_to_l2_msg_exists_write_offset, e.main_l2_gas_remaining, e.main_note_hash_exist_write_offset, e.main_nullifier_exists_write_offset, e.main_nullifier_non_exists_write_offset, e.main_pc, e.main_sel_execution_row, e.main_side_effect_counter, e.main_sload_write_offset, e.main_sstore_write_offset, e.mem_glob_addr, e.mem_rw, e.mem_sel_mem, e.mem_tag, e.mem_tsp, e.mem_val, e.slice_addr, e.slice_clk, e.slice_cnt, e.slice_col_offset, e.slice_sel_cd_cpy, e.slice_sel_mem_active, e.slice_sel_return, e.slice_sel_start, e.slice_space_id
#define ALL_ENTITIES PRECOMPUTED_ENTITIES, WIRE_ENTITIES, DERIVED_WITNESS_ENTITIES, SHIFTED_ENTITIES
// clang-format on
@@ -128,6 +127,9 @@ class AvmFlavor {
using VerifierCommitmentKey = AvmFlavorSettings::VerifierCommitmentKey;
using RelationSeparator = AvmFlavorSettings::RelationSeparator;
+ // This flavor would not be used with ZK Sumcheck
+ static constexpr bool HasZK = false;
+
static constexpr size_t NUM_PRECOMPUTED_ENTITIES = 16;
static constexpr size_t NUM_WITNESS_ENTITIES = 696;
static constexpr size_t NUM_SHIFTED_ENTITIES = 75;
@@ -135,6 +137,8 @@ class AvmFlavor {
// We have two copies of the witness entities, so we subtract the number of fixed ones (they have no shift), one for
// the unshifted and one for the shifted
static constexpr size_t NUM_ALL_ENTITIES = 787;
+ // The total number of witnesses including shifts and derived entities.
+ static constexpr size_t NUM_ALL_WITNESS_ENTITIES = NUM_WITNESS_ENTITIES + NUM_SHIFTED_ENTITIES;
using MainRelations = std::tuple<
// Relations
@@ -337,7 +341,7 @@ class AvmFlavor {
ProverPolynomials(ProvingKey& proving_key);
- [[nodiscard]] size_t get_polynomial_size() const { return kernel_kernel_inputs.size(); }
+ [[nodiscard]] size_t get_polynomial_size() const { return main_kernel_inputs.size(); }
/**
* @brief Returns the evaluations of all prover polynomials at one point on the boolean hypercube, which
* represents one row in the execution trace.
@@ -415,4 +419,4 @@ class AvmFlavor {
};
};
-} // namespace bb
\ No newline at end of file
+} // namespace bb
diff --git a/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.cpp b/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.cpp
index b06fa434c4da..8a9e2d32c814 100644
--- a/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.cpp
+++ b/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.cpp
@@ -35,10 +35,10 @@ template std::vector AvmFullRow::names()
"main_sel_first",
"main_zeroes",
"powers_power_of_2",
- "kernel_kernel_inputs",
- "kernel_kernel_value_out",
- "kernel_kernel_side_effect_out",
- "kernel_kernel_metadata_out",
+ "main_kernel_inputs",
+ "main_kernel_value_out",
+ "main_kernel_side_effect_out",
+ "main_kernel_metadata_out",
"main_calldata",
"main_returndata",
"alu_a_hi",
@@ -146,21 +146,6 @@ template std::vector AvmFullRow::names()
"keccakf1600_input",
"keccakf1600_output",
"keccakf1600_sel_keccakf1600",
- "kernel_emit_l2_to_l1_msg_write_offset",
- "kernel_emit_note_hash_write_offset",
- "kernel_emit_nullifier_write_offset",
- "kernel_emit_unencrypted_log_write_offset",
- "kernel_kernel_in_offset",
- "kernel_kernel_out_offset",
- "kernel_l1_to_l2_msg_exists_write_offset",
- "kernel_note_hash_exist_write_offset",
- "kernel_nullifier_exists_write_offset",
- "kernel_nullifier_non_exists_write_offset",
- "kernel_q_public_input_kernel_add_to_table",
- "kernel_q_public_input_kernel_out_add_to_table",
- "kernel_side_effect_counter",
- "kernel_sload_write_offset",
- "kernel_sstore_write_offset",
"main_abs_da_rem_gas_hi",
"main_abs_da_rem_gas_lo",
"main_abs_l2_rem_gas_hi",
@@ -175,6 +160,10 @@ template std::vector AvmFullRow::names()
"main_dyn_da_gas_op_cost",
"main_dyn_gas_multiplier",
"main_dyn_l2_gas_op_cost",
+ "main_emit_l2_to_l1_msg_write_offset",
+ "main_emit_note_hash_write_offset",
+ "main_emit_nullifier_write_offset",
+ "main_emit_unencrypted_log_write_offset",
"main_ia",
"main_ib",
"main_ic",
@@ -186,12 +175,18 @@ template std::vector AvmFullRow::names()
"main_ind_addr_d",
"main_internal_return_ptr",
"main_inv",
+ "main_kernel_in_offset",
+ "main_kernel_out_offset",
+ "main_l1_to_l2_msg_exists_write_offset",
"main_l2_gas_remaining",
"main_l2_out_of_gas",
"main_mem_addr_a",
"main_mem_addr_b",
"main_mem_addr_c",
"main_mem_addr_d",
+ "main_note_hash_exist_write_offset",
+ "main_nullifier_exists_write_offset",
+ "main_nullifier_non_exists_write_offset",
"main_op_err",
"main_opcode_val",
"main_pc",
@@ -204,6 +199,8 @@ template std::vector AvmFullRow::names()
"main_sel_bin",
"main_sel_calldata",
"main_sel_execution_row",
+ "main_sel_kernel_inputs",
+ "main_sel_kernel_out",
"main_sel_last",
"main_sel_mem_op_a",
"main_sel_mem_op_b",
@@ -279,7 +276,10 @@ template std::vector AvmFullRow::names()
"main_sel_rng_16",
"main_sel_rng_8",
"main_sel_slice_gadget",
+ "main_side_effect_counter",
+ "main_sload_write_offset",
"main_space_id",
+ "main_sstore_write_offset",
"main_tag_err",
"main_w_in_tag",
"mem_addr",
@@ -652,10 +652,10 @@ template std::vector AvmFullRow::names()
"range_check_l2_gas_lo_inv",
"range_check_da_gas_hi_inv",
"range_check_da_gas_lo_inv",
- "lookup_cd_value_inv",
- "lookup_ret_value_inv",
"kernel_output_lookup_inv",
"lookup_into_kernel_inv",
+ "lookup_cd_value_inv",
+ "lookup_ret_value_inv",
"incl_main_tag_err_inv",
"incl_mem_tag_err_inv",
"lookup_mem_rng_chk_lo_inv",
@@ -695,10 +695,10 @@ template std::vector AvmFullRow::names()
"range_check_l2_gas_lo_counts",
"range_check_da_gas_hi_counts",
"range_check_da_gas_lo_counts",
- "lookup_cd_value_counts",
- "lookup_ret_value_counts",
"kernel_output_lookup_counts",
"lookup_into_kernel_counts",
+ "lookup_cd_value_counts",
+ "lookup_ret_value_counts",
"incl_main_tag_err_counts",
"incl_mem_tag_err_counts",
"lookup_mem_rng_chk_lo_counts",
@@ -752,10 +752,10 @@ template RefVector AvmFullRow::as_vector() const
main_sel_first,
main_zeroes,
powers_power_of_2,
- kernel_kernel_inputs,
- kernel_kernel_value_out,
- kernel_kernel_side_effect_out,
- kernel_kernel_metadata_out,
+ main_kernel_inputs,
+ main_kernel_value_out,
+ main_kernel_side_effect_out,
+ main_kernel_metadata_out,
main_calldata,
main_returndata,
alu_a_hi,
@@ -863,21 +863,6 @@ template RefVector AvmFullRow::as_vector() const
keccakf1600_input,
keccakf1600_output,
keccakf1600_sel_keccakf1600,
- kernel_emit_l2_to_l1_msg_write_offset,
- kernel_emit_note_hash_write_offset,
- kernel_emit_nullifier_write_offset,
- kernel_emit_unencrypted_log_write_offset,
- kernel_kernel_in_offset,
- kernel_kernel_out_offset,
- kernel_l1_to_l2_msg_exists_write_offset,
- kernel_note_hash_exist_write_offset,
- kernel_nullifier_exists_write_offset,
- kernel_nullifier_non_exists_write_offset,
- kernel_q_public_input_kernel_add_to_table,
- kernel_q_public_input_kernel_out_add_to_table,
- kernel_side_effect_counter,
- kernel_sload_write_offset,
- kernel_sstore_write_offset,
main_abs_da_rem_gas_hi,
main_abs_da_rem_gas_lo,
main_abs_l2_rem_gas_hi,
@@ -892,6 +877,10 @@ template RefVector AvmFullRow::as_vector() const
main_dyn_da_gas_op_cost,
main_dyn_gas_multiplier,
main_dyn_l2_gas_op_cost,
+ main_emit_l2_to_l1_msg_write_offset,
+ main_emit_note_hash_write_offset,
+ main_emit_nullifier_write_offset,
+ main_emit_unencrypted_log_write_offset,
main_ia,
main_ib,
main_ic,
@@ -903,12 +892,18 @@ template RefVector AvmFullRow::as_vector() const
main_ind_addr_d,
main_internal_return_ptr,
main_inv,
+ main_kernel_in_offset,
+ main_kernel_out_offset,
+ main_l1_to_l2_msg_exists_write_offset,
main_l2_gas_remaining,
main_l2_out_of_gas,
main_mem_addr_a,
main_mem_addr_b,
main_mem_addr_c,
main_mem_addr_d,
+ main_note_hash_exist_write_offset,
+ main_nullifier_exists_write_offset,
+ main_nullifier_non_exists_write_offset,
main_op_err,
main_opcode_val,
main_pc,
@@ -921,6 +916,8 @@ template RefVector AvmFullRow::as_vector() const
main_sel_bin,
main_sel_calldata,
main_sel_execution_row,
+ main_sel_kernel_inputs,
+ main_sel_kernel_out,
main_sel_last,
main_sel_mem_op_a,
main_sel_mem_op_b,
@@ -996,7 +993,10 @@ template RefVector AvmFullRow::as_vector() const
main_sel_rng_16,
main_sel_rng_8,
main_sel_slice_gadget,
+ main_side_effect_counter,
+ main_sload_write_offset,
main_space_id,
+ main_sstore_write_offset,
main_tag_err,
main_w_in_tag,
mem_addr,
@@ -1369,10 +1369,10 @@ template RefVector AvmFullRow::as_vector() const
range_check_l2_gas_lo_inv,
range_check_da_gas_hi_inv,
range_check_da_gas_lo_inv,
- lookup_cd_value_inv,
- lookup_ret_value_inv,
kernel_output_lookup_inv,
lookup_into_kernel_inv,
+ lookup_cd_value_inv,
+ lookup_ret_value_inv,
incl_main_tag_err_inv,
incl_mem_tag_err_inv,
lookup_mem_rng_chk_lo_inv,
@@ -1412,10 +1412,10 @@ template RefVector AvmFullRow::as_vector() const
range_check_l2_gas_lo_counts,
range_check_da_gas_hi_counts,
range_check_da_gas_lo_counts,
- lookup_cd_value_counts,
- lookup_ret_value_counts,
kernel_output_lookup_counts,
lookup_into_kernel_counts,
+ lookup_cd_value_counts,
+ lookup_ret_value_counts,
incl_main_tag_err_counts,
incl_mem_tag_err_counts,
lookup_mem_rng_chk_lo_counts,
diff --git a/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.hpp b/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.hpp
index 5b4b63b6b26a..07e82e9798fe 100644
--- a/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.hpp
+++ b/barretenberg/cpp/src/barretenberg/vm/avm/generated/full_row.hpp
@@ -26,10 +26,10 @@ template struct AvmFullRow {
FF main_sel_first{};
FF main_zeroes{};
FF powers_power_of_2{};
- FF kernel_kernel_inputs{};
- FF kernel_kernel_value_out{};
- FF kernel_kernel_side_effect_out{};
- FF kernel_kernel_metadata_out{};
+ FF main_kernel_inputs{};
+ FF main_kernel_value_out{};
+ FF main_kernel_side_effect_out{};
+ FF main_kernel_metadata_out{};
FF main_calldata{};
FF main_returndata{};
FF alu_a_hi{};
@@ -137,21 +137,6 @@ template struct AvmFullRow {
FF keccakf1600_input{};
FF keccakf1600_output{};
FF keccakf1600_sel_keccakf1600{};
- FF kernel_emit_l2_to_l1_msg_write_offset{};
- FF kernel_emit_note_hash_write_offset{};
- FF kernel_emit_nullifier_write_offset{};
- FF kernel_emit_unencrypted_log_write_offset{};
- FF kernel_kernel_in_offset{};
- FF kernel_kernel_out_offset{};
- FF kernel_l1_to_l2_msg_exists_write_offset{};
- FF kernel_note_hash_exist_write_offset{};
- FF kernel_nullifier_exists_write_offset{};
- FF kernel_nullifier_non_exists_write_offset{};
- FF kernel_q_public_input_kernel_add_to_table{};
- FF kernel_q_public_input_kernel_out_add_to_table{};
- FF kernel_side_effect_counter{};
- FF kernel_sload_write_offset{};
- FF kernel_sstore_write_offset{};
FF main_abs_da_rem_gas_hi{};
FF main_abs_da_rem_gas_lo{};
FF main_abs_l2_rem_gas_hi{};
@@ -166,6 +151,10 @@ template struct AvmFullRow {
FF main_dyn_da_gas_op_cost{};
FF main_dyn_gas_multiplier{};
FF main_dyn_l2_gas_op_cost{};
+ FF main_emit_l2_to_l1_msg_write_offset{};
+ FF main_emit_note_hash_write_offset{};
+ FF main_emit_nullifier_write_offset{};
+ FF main_emit_unencrypted_log_write_offset{};
FF main_ia{};
FF main_ib{};
FF main_ic{};
@@ -177,12 +166,18 @@ template struct AvmFullRow {
FF main_ind_addr_d{};
FF main_internal_return_ptr{};
FF main_inv{};
+ FF main_kernel_in_offset{};
+ FF main_kernel_out_offset{};
+ FF main_l1_to_l2_msg_exists_write_offset{};
FF main_l2_gas_remaining{};
FF main_l2_out_of_gas{};
FF main_mem_addr_a{};
FF main_mem_addr_b{};
FF main_mem_addr_c{};
FF main_mem_addr_d{};
+ FF main_note_hash_exist_write_offset{};
+ FF main_nullifier_exists_write_offset{};
+ FF main_nullifier_non_exists_write_offset{};
FF main_op_err{};
FF main_opcode_val{};
FF main_pc{};
@@ -195,6 +190,8 @@ template struct AvmFullRow {
FF main_sel_bin{};
FF main_sel_calldata{};
FF main_sel_execution_row{};
+ FF main_sel_kernel_inputs{};
+ FF main_sel_kernel_out{};
FF main_sel_last{};
FF main_sel_mem_op_a{};
FF main_sel_mem_op_b{};
@@ -270,7 +267,10 @@ template struct AvmFullRow {
FF main_sel_rng_16{};
FF main_sel_rng_8{};
FF main_sel_slice_gadget{};
+ FF main_side_effect_counter{};
+ FF main_sload_write_offset{};
FF main_space_id{};
+ FF main_sstore_write_offset{};
FF main_tag_err{};
FF main_w_in_tag{};
FF mem_addr{};
@@ -643,10 +643,10 @@ template struct AvmFullRow {
FF range_check_l2_gas_lo_inv{};
FF range_check_da_gas_hi_inv{};
FF range_check_da_gas_lo_inv{};
- FF lookup_cd_value_inv{};
- FF lookup_ret_value_inv{};
FF kernel_output_lookup_inv{};
FF lookup_into_kernel_inv{};
+ FF lookup_cd_value_inv{};
+ FF lookup_ret_value_inv{};
FF incl_main_tag_err_inv{};
FF incl_mem_tag_err_inv{};
FF lookup_mem_rng_chk_lo_inv{};
@@ -686,10 +686,10 @@ template struct AvmFullRow {
FF range_check_l2_gas_lo_counts{};
FF range_check_da_gas_hi_counts{};
FF range_check_da_gas_lo_counts{};
- FF lookup_cd_value_counts{};
- FF lookup_ret_value_counts{};
FF kernel_output_lookup_counts{};
FF lookup_into_kernel_counts{};
+ FF lookup_cd_value_counts{};
+ FF lookup_ret_value_counts{};
FF incl_main_tag_err_counts{};
FF incl_mem_tag_err_counts{};
FF lookup_mem_rng_chk_lo_counts{};
diff --git a/barretenberg/cpp/src/barretenberg/vm/avm/generated/prover.cpp b/barretenberg/cpp/src/barretenberg/vm/avm/generated/prover.cpp
index d5cbab1767e0..41e801b4c83d 100644
--- a/barretenberg/cpp/src/barretenberg/vm/avm/generated/prover.cpp
+++ b/barretenberg/cpp/src/barretenberg/vm/avm/generated/prover.cpp
@@ -8,7 +8,6 @@
#include "barretenberg/honk/proof_system/logderivative_library.hpp"
#include "barretenberg/honk/proof_system/permutation_library.hpp"
#include "barretenberg/plonk_honk_shared/library/grand_product_library.hpp"
-#include "barretenberg/polynomials/polynomial.hpp"
#include "barretenberg/relations/permutation_relation.hpp"
#include "barretenberg/sumcheck/sumcheck.hpp"
diff --git a/barretenberg/cpp/src/barretenberg/vm/avm/generated/relations/kernel.hpp b/barretenberg/cpp/src/barretenberg/vm/avm/generated/relations/kernel.hpp
index b75bec675d73..6fa15bbad85b 100644
--- a/barretenberg/cpp/src/barretenberg/vm/avm/generated/relations/kernel.hpp
+++ b/barretenberg/cpp/src/barretenberg/vm/avm/generated/relations/kernel.hpp
@@ -10,7 +10,9 @@ template class kernelImpl {
public:
using FF = FF_;
- static constexpr std::array SUBRELATION_PARTIAL_LENGTHS = { 3, 3, 4, 4, 3, 3, 3, 3, 3, 3 };
+ static constexpr std::array