Merge dce0800 into 6a0713e

barretenberg/cpp/src/barretenberg/bb/main.cpp

@@ -492,7 +492,7 @@ void acvm_info(const std::string& output_path)
     const char* jsonData = R"({
     "language": {
         "name" : "PLONK-CSAT",
-        "width" : 3
+        "width" : 4
     }
     })";
 

barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.cpp

@@ -13,9 +13,12 @@ template <typename Builder>
 void build_constraints(Builder& builder, AcirFormat const& constraint_system, bool has_valid_witness_assignments)
 {
     // Add arithmetic gates
-    for (const auto& constraint : constraint_system.constraints) {
+    for (const auto& constraint : constraint_system.poly_triple_constraints) {
         builder.create_poly_gate(constraint);
     }
+    for (const auto& constraint : constraint_system.quad_constraints) {
+        builder.create_big_mul_gate(constraint);
+    }
 
     // Add logic constraint
     for (const auto& constraint : constraint_system.logic_constraints) {

barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.hpp

@@ -59,7 +59,9 @@ struct AcirFormat {
     // This could be a large vector so use slab allocator, we don't expect the blackbox implementations to be so large.
     std::vector<poly_triple_<curve::BN254::ScalarField>,
                 ContainerSlabAllocator<poly_triple_<curve::BN254::ScalarField>>>
-        constraints;
+        poly_triple_constraints;
+    std::vector<mul_quad_<curve::BN254::ScalarField>, ContainerSlabAllocator<mul_quad_<curve::BN254::ScalarField>>>
+        quad_constraints;
     std::vector<BlockConstraint> block_constraints;
 
     // For serialization, update with any new fields
@@ -82,7 +84,7 @@ struct AcirFormat {
                    fixed_base_scalar_mul_constraints,
                    ec_add_constraints,
                    recursion_constraints,
-                   constraints,
+                   poly_triple_constraints,
                    block_constraints,
                    bigint_from_le_bytes_constraints,
                    bigint_to_le_bytes_constraints,

barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.test.cpp

@@ -53,7 +53,8 @@ TEST_F(AcirFormatTests, TestASingleConstraintNoPubInputs)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = { constraint },
+        .poly_triple_constraints = { constraint },
+        .quad_constraints = {},
         .block_constraints = {},
     };
 
@@ -168,7 +169,8 @@ TEST_F(AcirFormatTests, TestLogicGateFromNoirCircuit)
                                   .bigint_from_le_bytes_constraints = {},
                                   .bigint_to_le_bytes_constraints = {},
                                   .bigint_operations = {},
-                                  .constraints = { expr_a, expr_b, expr_c, expr_d },
+                                  .poly_triple_constraints = { expr_a, expr_b, expr_c, expr_d },
+                                  .quad_constraints = {},
                                   .block_constraints = {} };
 
     uint256_t inverse_of_five = fr(5).invert();
@@ -235,7 +237,7 @@ TEST_F(AcirFormatTests, TestSchnorrVerifyPass)
                                   .bigint_from_le_bytes_constraints = {},
                                   .bigint_to_le_bytes_constraints = {},
                                   .bigint_operations = {},
-                                  .constraints = { poly_triple{
+                                  .poly_triple_constraints = { poly_triple{
                                       .a = schnorr_constraint.result,
                                       .b = schnorr_constraint.result,
                                       .c = schnorr_constraint.result,
@@ -245,6 +247,7 @@ TEST_F(AcirFormatTests, TestSchnorrVerifyPass)
                                       .q_o = 1,
                                       .q_c = fr::neg_one(),
                                   } },
+                                  .quad_constraints = {},
                                   .block_constraints = {} };
 
     std::string message_string = "tenletters";
@@ -329,7 +332,7 @@ TEST_F(AcirFormatTests, TestSchnorrVerifySmallRange)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = { poly_triple{
+        .poly_triple_constraints = { poly_triple{
             .a = schnorr_constraint.result,
             .b = schnorr_constraint.result,
             .c = schnorr_constraint.result,
@@ -339,6 +342,7 @@ TEST_F(AcirFormatTests, TestSchnorrVerifySmallRange)
             .q_o = 1,
             .q_c = fr::neg_one(),
         } },
+        .quad_constraints = {},
         .block_constraints = {},
     };
 
@@ -442,7 +446,8 @@ TEST_F(AcirFormatTests, TestVarKeccak)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = { dummy },
+        .poly_triple_constraints = { dummy },
+        .quad_constraints = {},
         .block_constraints = {},
     };
 
@@ -488,7 +493,8 @@ TEST_F(AcirFormatTests, TestKeccakPermutation)
                                   .bigint_from_le_bytes_constraints = {},
                                   .bigint_to_le_bytes_constraints = {},
                                   .bigint_operations = {},
-                                  .constraints = {},
+                                  .poly_triple_constraints = {},
+                                  .quad_constraints = {},
                                   .block_constraints = {} };
 
     WitnessVector witness{ 1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13, 14, 15, 16, 17,

barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_to_constraint_buf.hpp

@@ -21,7 +21,7 @@
 #include <utility>
 
 namespace acir_format {
-
+using mul_quad = mul_quad_<bb::fr>;
 /**
  * @brief Construct a poly_tuple for a standard width-3 arithmetic gate from its acir representation
  *
@@ -90,18 +90,110 @@ poly_triple serialize_arithmetic_gate(Program::Expression const& arg)
             pt.q_o = selector_value;
             c_set = true;
         } else {
-            throw_or_abort("Cannot assign linear term to a constraint of width 3");
+            return poly_triple{
+                .a = 0,
+                .b = 0,
+                .c = 0,
+                .q_m = 0,
+                .q_l = 0,
+                .q_r = 0,
+                .q_o = 0,
+                .q_c = 0,
+            };
         }
     }
 
     // Set constant value q_c
     pt.q_c = uint256_t(arg.q_c);
     return pt;
 }
+mul_quad serialize_mul_quad_gate(Program::Expression const& arg)
+{
+    // TODO(https://github.com/AztecProtocol/barretenberg/issues/816): The initialization of the witness indices a,b,c
+    // to 0 is implicitly assuming that (builder.zero_idx == 0) which is no longer the case. Now, witness idx 0 in
+    // general will correspond to some non-zero value and some witnesses which are not explicitly set below will be
+    // erroneously populated with this value. This does not cause failures however because the corresponding selector
+    // will indeed be 0 so the gate will be satisfied. Still, its a bad idea to have erroneous wire values
+    // even if they dont break the relation. They'll still add cost in commitments, for example.
+    mul_quad quad{ .a = 0,
+                   .b = 0,
+                   .c = 0,
+                   .d = 0,
+                   .mul_scaling = 0,
+                   .a_scaling = 0,
+                   .b_scaling = 0,
+                   .c_scaling = 0,
+                   .d_scaling = 0,
+                   .const_scaling = 0 };
+
+    // Flags indicating whether each witness index for the present mul_quad has been set
+    bool a_set = false;
+    bool b_set = false;
+    bool c_set = false;
+    bool d_set = false;
+    ASSERT(arg.mul_terms.size() <= 1); // We can only accommodate 1 quadratic term
+    // Note: mul_terms are tuples of the form {selector_value, witness_idx_1, witness_idx_2}
+    if (!arg.mul_terms.empty()) {
+        const auto& mul_term = arg.mul_terms[0];
+        quad.mul_scaling = uint256_t(std::get<0>(mul_term));
+        quad.a = std::get<1>(mul_term).value;
+        quad.b = std::get<2>(mul_term).value;
+        a_set = true;
+        b_set = true;
+    }
+    // If necessary, set values for linears terms q_l * w_l, q_r * w_r and q_o * w_o
+    ASSERT(arg.linear_combinations.size() <= 4); // We can only accommodate 4 linear terms
+    for (const auto& linear_term : arg.linear_combinations) {
+        bb::fr selector_value(uint256_t(std::get<0>(linear_term)));
+        uint32_t witness_idx = std::get<1>(linear_term).value;
+
+        // If the witness index has not yet been set or if the corresponding linear term is active, set the witness
+        // index and the corresponding selector value.
+        // TODO(https://github.com/AztecProtocol/barretenberg/issues/816): May need to adjust the quad.a == witness_idx
+        // check (and the others like it) since we initialize a,b,c with 0 but 0 is a valid witness index once the
+        // +1 offset is removed from noir.
+        if (!a_set || quad.a == witness_idx) {
+            quad.a = witness_idx;
+            quad.a_scaling = selector_value;
+            a_set = true;
+        } else if (!b_set || quad.b == witness_idx) {
+            quad.b = witness_idx;
+            quad.b_scaling = selector_value;
+            b_set = true;
+        } else if (!c_set || quad.c == witness_idx) {
+            quad.c = witness_idx;
+            quad.c_scaling = selector_value;
+            c_set = true;
+        } else if (!d_set || quad.d == witness_idx) {
+            quad.d = witness_idx;
+            quad.d_scaling = selector_value;
+            d_set = true;
+        } else {
+            throw_or_abort("Cannot assign linear term to a constraint of width 4");
+        }
+    }
+
+    // Set constant value q_c
+    quad.const_scaling = uint256_t(arg.q_c);
+    return quad;
+}
 
 void handle_arithmetic(Program::Opcode::AssertZero const& arg, AcirFormat& af)
 {
-    af.constraints.push_back(serialize_arithmetic_gate(arg.value));
+    if (arg.value.linear_combinations.size() <= 3) {
+        poly_triple pt = serialize_arithmetic_gate(arg.value);
+        // Even if the number of linear terms is less than 3, we might not be able to fit it into a width-3 arithmetic
+        // gate. This is the case if the linear terms are all disctinct witness from the multiplication term. In that
+        // case, the serialize_arithmetic_gate() function will return a poly_triple with all 0's, and we use a width-4
+        // gate instead. We could probably always use a width-4 gate in fact.
+        if (pt == poly_triple{ 0, 0, 0, 0, 0, 0, 0, 0 }) {
+            af.quad_constraints.push_back(serialize_mul_quad_gate(arg.value));
+        } else {
+            af.poly_triple_constraints.push_back(pt);
+        }
+    } else {
+        af.quad_constraints.push_back(serialize_mul_quad_gate(arg.value));
+    }
 }
 
 void handle_blackbox_func_call(Program::Opcode::BlackBoxFuncCall const& arg, AcirFormat& af)

barretenberg/cpp/src/barretenberg/dsl/acir_format/bigint_constraint.test.cpp

@@ -190,7 +190,8 @@ TEST_F(BigIntTests, TestBigIntConstraintMultiple)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
     apply_constraints(constraint_system, contraints);
@@ -257,7 +258,8 @@ TEST_F(BigIntTests, TestBigIntConstraintSimple)
         .bigint_from_le_bytes_constraints = { from_le_bytes_constraint_bigint1 },
         .bigint_to_le_bytes_constraints = { result2_to_le_bytes },
         .bigint_operations = { add_constraint },
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
 
     };
@@ -309,7 +311,8 @@ TEST_F(BigIntTests, TestBigIntConstraintReuse)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
     apply_constraints(constraint_system, contraints);
@@ -365,7 +368,8 @@ TEST_F(BigIntTests, TestBigIntConstraintReuse2)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
     apply_constraints(constraint_system, contraints);
@@ -442,7 +446,8 @@ TEST_F(BigIntTests, TestBigIntDIV)
         .bigint_from_le_bytes_constraints = { from_le_bytes_constraint_bigint1, from_le_bytes_constraint_bigint2 },
         .bigint_to_le_bytes_constraints = { result3_to_le_bytes },
         .bigint_operations = { div_constraint },
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
 
     };

barretenberg/cpp/src/barretenberg/dsl/acir_format/block_constraint.test.cpp

@@ -132,7 +132,8 @@ TEST_F(UltraPlonkRAM, TestBlockConstraint)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = { block },
     };
 

barretenberg/cpp/src/barretenberg/dsl/acir_format/ec_operations.test.cpp

@@ -72,7 +72,8 @@ TEST_F(EcOperations, TestECOperations)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
 

barretenberg/cpp/src/barretenberg/dsl/acir_format/ecdsa_secp256k1.test.cpp

@@ -112,7 +112,8 @@ TEST_F(ECDSASecp256k1, TestECDSAConstraintSucceed)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
 
@@ -160,7 +161,8 @@ TEST_F(ECDSASecp256k1, TestECDSACompilesForVerifier)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
 
@@ -203,7 +205,8 @@ TEST_F(ECDSASecp256k1, TestECDSAConstraintFail)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
 

barretenberg/cpp/src/barretenberg/dsl/acir_format/ecdsa_secp256r1.test.cpp

@@ -146,7 +146,8 @@ TEST(ECDSASecp256r1, test_hardcoded)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
 
@@ -196,7 +197,8 @@ TEST(ECDSASecp256r1, TestECDSAConstraintSucceed)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
 
@@ -244,7 +246,8 @@ TEST(ECDSASecp256r1, TestECDSACompilesForVerifier)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
     auto builder = create_circuit(constraint_system);
@@ -287,7 +290,8 @@ TEST(ECDSASecp256r1, TestECDSAConstraintFail)
         .bigint_from_le_bytes_constraints = {},
         .bigint_to_le_bytes_constraints = {},
         .bigint_operations = {},
-        .constraints = {},
+        .poly_triple_constraints = {},
+        .quad_constraints = {},
         .block_constraints = {},
     };
 

barretenberg/cpp/src/barretenberg/dsl/acir_format/poseidon2_constraint.test.cpp

@@ -52,7 +52,8 @@ TEST_F(Poseidon2Tests, TestPoseidon2Permutation)
                                   .bigint_from_le_bytes_constraints = {},
                                   .bigint_to_le_bytes_constraints = {},
                                   .bigint_operations = {},
-                                  .constraints = {},
+                                  .poly_triple_constraints = {},
+                                  .quad_constraints = {},
                                   .block_constraints = {} };
 
     WitnessVector witness{