[WIP] Halo2 ecc snark verifier rebase 0329: post rebase

.gitignore

@@ -15,3 +15,8 @@ Cargo.lock
 
 /halo2_ecc/src/bn254/data/
 /halo2_ecc/src/secp256k1/data/
+
+# test and bench results
+*.data
+*.csv
+*.srs

CHANGELOG.md

@@ -0,0 +1,4 @@
+# v0.3.0
+
+- Remove `PlonkPlus` strategy for `GateInstructions` to reduce code complexity.
+  - Because this strategy involved 1 selector AND 1 fixed column per advice column, it seems hard to justify it will lead to better peformance for the prover or verifier.

Cargo.toml

@@ -2,7 +2,7 @@
 members = [
     "halo2-base",
     "halo2-ecc",
-    "hashes/zkevm-keccak",
+    # "hashes/zkevm-keccak",
 ]
 
 [profile.dev]
@@ -31,15 +31,15 @@ debug-assertions = false
 lto = "fat" 
 # `codegen-units = 1` can lead to WORSE performance - always bench to find best profile for your machine!
 # codegen-units = 1
-panic = "abort"
+panic = "unwind"
 incremental = false
 
 # For performance profiling
 [profile.flamegraph]
 inherits = "release"
 debug = true
 
-# patch so snark-verifier uses this crate's halo2-base 
-[patch."https://github.com/axiom-crypto/halo2-lib.git"]
-halo2-base = { path = "./halo2-base" }
-halo2-ecc = { path = "./halo2-ecc" }
+[patch."https://github.com/privacy-scaling-explorations/halo2.git"]
+halo2_proofs = { git = "https://github.com/scroll-tech/halo2.git", branch = "halo2-ecc-snark-verifier-0323"  }
+[patch."https://github.com/privacy-scaling-explorations/poseidon.git"]
+poseidon = { git = "https://github.com/scroll-tech/poseidon.git", branch = "scroll-dev-0220" }

README.md

@@ -58,10 +58,10 @@ The default features are: "jemallocator", "halo2-axiom", "display".
 You can turn off "display" for a very small performance increase, where certain statistics about the circuit are not
 computed and printed.
 
-**Exactly one** of "halo2-axiom" or "halo2-pse" feature should be turned on at all times.
+**Exactly one** of "halo2-axiom" or "halo2-scroll" feature should be turned on at all times.
 
 - The "halo2-axiom" feature uses our [`halo2_proofs`](https://github.com/axiom-crypto/halo2) which is a fork of the [PSE one](https://github.com/privacy-scaling-explorations/halo2) which we have slightly optimized for proving speed.
-- The "halo2-pse" feature uses the Privacy Scaling Explorations [`halo2_proofs`](https://github.com/privacy-scaling-explorations/halo2) which is the most stable and has the most reviewers.
+- The "halo2-scroll" feature uses the Privacy Scaling Explorations [`halo2_proofs`](https://github.com/privacy-scaling-explorations/halo2) which is the most stable and has the most reviewers.
 
 We guarantee that the proofs generated by the two forks are identical.
 

halo2-base/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "halo2-base"
-version = "0.2.2"
+version = "0.3.0"
 edition = "2021"
 
 [dependencies]
@@ -11,11 +11,13 @@ num-traits = "0.2"
 rand_chacha = "0.3"
 rustc-hash = "1.1"
 ff = "0.12"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
 
 # Use Axiom's custom halo2 monorepo for faster proving when feature = "halo2-axiom" is on
-halo2_proofs_axiom = { git = "https://github.com/axiom-crypto/halo2.git", tag = "v2023_01_17", package = "halo2_proofs", optional = true }
-# Use PSE halo2 and halo2curves for compatibility when feature = "halo2-pse" is on
-halo2_proofs = { git = "https://github.com/privacy-scaling-explorations/halo2.git", tag = "v2023_01_20", optional = true }
+halo2_proofs_axiom = { git = "https://github.com/axiom-crypto/halo2.git", branch = "axiom/dev", package = "halo2_proofs", optional = true }
+# Use PSE halo2 and halo2curves for compatibility when feature = "halo2-scroll" is on
+halo2_proofs = { git = "https://github.com/privacy-scaling-explorations/halo2.git", tag = "v2023_02_02", optional = true }
 
 # plotting circuit layout
 plotters = { version = "0.3.0", optional = true }
@@ -27,6 +29,7 @@ rand = "0.8"
 pprof = { version = "0.11", features = ["criterion", "flamegraph"] }
 criterion = "0.4"
 criterion-macro = "0.4"
+rayon = "1.6.1"
 
 # memory allocation
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
@@ -35,9 +38,9 @@ jemallocator = { version = "0.5", optional = true }
 mimalloc = { version = "0.1", default-features = false, optional = true }
 
 [features]
-default = ["halo2-axiom", "display"]
+default = ["halo2-scroll", "display"]
 dev-graph = ["halo2_proofs?/dev-graph", "halo2_proofs_axiom?/dev-graph", "plotters"]
-halo2-pse = ["halo2_proofs"]
+halo2-scroll = ["halo2_proofs"]
 halo2-axiom = ["halo2_proofs_axiom"]
 display = []
 profile = ["halo2_proofs_axiom?/profile"]

halo2-base/benches/inner_product.rs

@@ -1,9 +1,7 @@
 #![allow(unused_imports)]
 #![allow(unused_variables)]
-use halo2_base::gates::{
-    flex_gate::{FlexGateConfig, GateStrategy},
-    GateInstructions,
-};
+use halo2_base::gates::builder::{GateCircuitBuilder, GateThreadBuilder};
+use halo2_base::gates::flex_gate::{FlexGateConfig, GateChip, GateInstructions, GateStrategy};
 use halo2_base::halo2_proofs::{
     arithmetic::Field,
     circuit::*,
@@ -16,7 +14,12 @@ use halo2_base::halo2_proofs::{
     },
     transcript::{Blake2bWrite, Challenge255, TranscriptWriterBuffer},
 };
-use halo2_base::{Context, ContextParams, QuantumCell::Witness, SKIP_FIRST_PASS};
+use halo2_base::utils::ScalarField;
+use halo2_base::{
+    Context,
+    QuantumCell::{Existing, Witness},
+    SKIP_FIRST_PASS,
+};
 use itertools::Itertools;
 use rand::rngs::OsRng;
 use std::marker::PhantomData;
@@ -28,82 +31,50 @@ use pprof::criterion::{Output, PProfProfiler};
 // Thanks to the example provided by @jebbow in his article
 // https://www.jibbow.com/posts/criterion-flamegraphs/
 
-#[derive(Clone, Default)]
-struct MyCircuit<F> {
-    _marker: PhantomData<F>,
-}
-
-const NUM_ADVICE: usize = 1;
 const K: u32 = 19;
 
-impl Circuit<Fr> for MyCircuit<Fr> {
-    type Config = FlexGateConfig<Fr>;
-    type FloorPlanner = SimpleFloorPlanner;
+fn inner_prod_bench<F: ScalarField>(ctx: &mut Context<F>, a: Vec<F>, b: Vec<F>) {
+    assert_eq!(a.len(), b.len());
+    let a = ctx.assign_witnesses(a);
+    let b = ctx.assign_witnesses(b);
 
-    fn without_witnesses(&self) -> Self {
-        Self::default()
-    }
-
-    fn configure(meta: &mut ConstraintSystem<Fr>) -> Self::Config {
-        FlexGateConfig::configure(meta, GateStrategy::Vertical, &[NUM_ADVICE], 1, 0, K as usize)
-    }
-
-    fn synthesize(
-        &self,
-        config: Self::Config,
-        mut layouter: impl Layouter<Fr>,
-    ) -> Result<(), Error> {
-        let mut first_pass = SKIP_FIRST_PASS;
-
-        layouter.assign_region(
-            || "gate",
-            |region| {
-                if first_pass {
-                    first_pass = false;
-                    return Ok(());
-                }
-
-                let mut aux = Context::new(
-                    region,
-                    ContextParams {
-                        max_rows: config.max_rows,
-                        num_context_ids: 1,
-                        fixed_columns: config.constants.clone(),
-                    },
-                );
-                let ctx = &mut aux;
-
-                let a = (0..5).map(|_| Witness(Value::known(Fr::random(OsRng)))).collect_vec();
-                let b = (0..5).map(|_| Witness(Value::known(Fr::random(OsRng)))).collect_vec();
-
-                for _ in 0..(1 << K) / 16 - 10 {
-                    config.inner_product(ctx, a.clone(), b.clone());
-                }
-
-                Ok(())
-            },
-        )
+    let chip = GateChip::default();
+    for _ in 0..(1 << K) / 16 - 10 {
+        chip.inner_product(ctx, a.clone(), b.clone().into_iter().map(Existing));
     }
 }
 
 fn bench(c: &mut Criterion) {
-    let circuit = MyCircuit::<Fr> { _marker: PhantomData };
+    let k = 19u32;
+    // create circuit for keygen
+    let mut builder = GateThreadBuilder::new(false);
+    inner_prod_bench(builder.main(0), vec![Fr::zero(); 5], vec![Fr::zero(); 5]);
+    builder.config(k as usize, Some(20));
+    let circuit = GateCircuitBuilder::mock(builder);
 
-    MockProver::run(K, &circuit, vec![]).unwrap().assert_satisfied();
+    // check the circuit is correct just in case
+    MockProver::run(k, &circuit, vec![]).unwrap().assert_satisfied();
 
-    let params = ParamsKZG::<Bn256>::setup(K, OsRng);
+    let params = ParamsKZG::<Bn256>::setup(k, OsRng);
     let vk = keygen_vk(&params, &circuit).expect("vk should not fail");
     let pk = keygen_pk(&params, vk, &circuit).expect("pk should not fail");
 
+    let break_points = circuit.break_points.take();
+    drop(circuit);
+
     let mut group = c.benchmark_group("plonk-prover");
     group.sample_size(10);
     group.bench_with_input(
-        BenchmarkId::new("inner_product", K),
+        BenchmarkId::new("inner_product", k),
         &(&params, &pk),
-        |b, &(params, pk)| {
-            b.iter(|| {
-                let circuit = MyCircuit::<Fr> { _marker: PhantomData };
-                let rng = OsRng;
+        |bencher, &(params, pk)| {
+            bencher.iter(|| {
+                let mut builder = GateThreadBuilder::new(true);
+                let a = (0..5).map(|_| Fr::random(OsRng)).collect_vec();
+                let b = (0..5).map(|_| Fr::random(OsRng)).collect_vec();
+                inner_prod_bench(builder.main(0), a, b);
+                let circuit = GateCircuitBuilder::prover(builder, break_points.clone());
+
                 let mut transcript = Blake2bWrite::<_, _, Challenge255<_>>::init(vec![]);
                 create_proof::<
                     KZGCommitmentScheme<Bn256>,
@@ -112,7 +83,7 @@ fn bench(c: &mut Criterion) {
                     _,
                     Blake2bWrite<Vec<u8>, G1Affine, Challenge255<_>>,
                     _,
-                >(params, pk, &[circuit], &[&[]], rng, &mut transcript)
+                >(params, pk, &[circuit], &[&[]], OsRng, &mut transcript)
                 .expect("prover should not fail");
             })
         },