Add GKR implementation of Grand Product lookups

[andrewmilson]

This change is 

[andrewmilson]

• Add benchmarks for GKR lookups #673
• Implement LogupOps for SIMD backend #641
• Implement GrandProductOps for SIMD backend #640
• Implement GkrOps for SIMD backend #630
• Implement MleOps for SIMD backend #629
• Add GKR implementation of Logup lookups #623
• Add GKR implementation of Grand Product lookups #620 👈
• Implement GkrOps for CPU backend #621
• Add batch GKR prover and verifier #581
• Rename CPU* structs to Cpu* to conform to Rust's naming convention #617
• Remove AVX backend #616
• Convert wide_fibbonacci AVX backend example to SIMD backend #615
• Update CI to test Wasm simd128, avx2 and aarch64 neon #614
• Fix CirclePointIndex bug in debug mode for 32-bit archs #613
• Change opt-level in benchmarks script #612
• Add benchmarks for SIMD m31 #611
• Add benchmarks for SIMD merkle #610
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @andrewmilson and the rest of your teammates on Graphite

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 93.04348% with 16 lines in your changes missing coverage. Please review.

Project coverage is 92.29%. Comparing base (1b443ac) to head (0cc0d79).
Report is 1 commits behind head on dev.

Files	Patch %	Lines
crates/prover/src/core/lookups/gkr_prover.rs	91.48%	8 Missing ⚠️
crates/prover/src/core/lookups/gkr_verifier.rs	92.64%	2 Missing and 3 partials ⚠️
crates/prover/src/core/backend/cpu/lookups/gkr.rs	95.52%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #620      +/-   ##
==========================================
+ Coverage   89.84%   92.29%   +2.44%     
==========================================
  Files          75       75              
  Lines        9588     9872     +284     
  Branches     9588     9872     +284     
==========================================
+ Hits         8614     9111     +497     
+ Misses        894      672     -222     
- Partials       80       89       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[spapinistarkware]

Reviewed 1 of 8 files at r1, all commit messages.
Reviewable status: 1 of 11 files reviewed, 4 unresolved discussions (waiting on @andrewmilson and @shaharsamocha7)

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 32 at r3 (raw file):

        claim: SecureField,
    ) -> UnivariatePoly<SecureField> {
        let k = h.n_variables();

n_variables or n_vars

Suggestion:

n_variables

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 35 at r3 (raw file):

        let n_terms = 1 << (k - 1);
        let eq_evals = h.eq_evals;
        let y = eq_evals.y();

What's this? Rename or doc.

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 51 at r3 (raw file):

                    let rhs0 = input_layer[(n_terms + i) * 2];
                    let rhs1 = input_layer[(n_terms + i) * 2 + 1];

Suggestion:

                    // Input polynomial at points (r,0,bits(i),1), ...
                    let inp_at_r0i0 = input_layer[i * 2];
                    let inp_at_r0i1 = input_layer[i * 2 + 1];

                    let inp_at_r1i0 = input_layer[(n_terms + i) * 2];
                    let inp_at_r1i1 = input_layer[(n_terms + i) * 2 + 1];
                    
                    let inp_at_r2i0 = (inp_at_r1i0.double() - inp_at_r0i0);
                    let inp_at_r2i1 = (inp_at_r0i1.double() - inp_at_r0i1);

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 54 at r3 (raw file):

                    let product2 = (rhs0.double() - lhs0) * (rhs1.double() - lhs1);
                    let product0 = lhs0 * lhs1;

Suggestion:

                    // Product polynomial prod(x) = inp(x,0)*inp(x,1)
                    //   at points (r,0,bits(i)), ...
                    let prod_at_r0i = inp_at_r0i0 * inp_at_r0i1;
                    let prod_t_r2i = inp_at_r2i0 * inp_at_r2i1;

[andrewmilson]

Reviewable status: 1 of 12 files reviewed, 4 unresolved discussions (waiting on @shaharsamocha7 and @spapinistarkware)

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 32 at r3 (raw file):

Previously, spapinistarkware (Shahar Papini) wrote…

n_variables or n_vars

Done.

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 35 at r3 (raw file):

Previously, spapinistarkware (Shahar Papini) wrote…

What's this? Rename or doc.

Done.

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 51 at r3 (raw file):

                    let rhs0 = input_layer[(n_terms + i) * 2];
                    let rhs1 = input_layer[(n_terms + i) * 2 + 1];

Done.

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 54 at r3 (raw file):

                    let product2 = (rhs0.double() - lhs0) * (rhs1.double() - lhs1);
                    let product0 = lhs0 * lhs1;

Done.

[spapinistarkware]

Reviewable status: 1 of 12 files reviewed, 4 unresolved discussions (waiting on @andrewmilson and @shaharsamocha7)

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 30 at r5 (raw file):

    ) -> UnivariatePoly<SecureField> {
        let n_variables = h.n_variables();
        let n_terms = 1 << n_variables.saturating_sub(1);

Does this function work when n_variables == 0?

Code quote:

n_variables.saturating_sub(1)

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 57 at r5 (raw file):

}

fn process_grand_product_sum(

Also, I'd like to doc somewhere that the GrandProduct layer poly is. Maybe at the enum definition.

P(x) = Inp(x,0) * Inp(x,1)

Suggestion:

/// Evaluates the sum of a grand product layer poly over a hypercube.
fn eval_grand_product_sum(

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 58 at r5 (raw file):

fn process_grand_product_sum(
    eval_at_0: &mut SecureField,

Why get them as mut instead of return them? You are passing zeros.

[andrewmilson]

Reviewable status: 1 of 12 files reviewed, 4 unresolved discussions (waiting on @shaharsamocha7 and @spapinistarkware)

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 30 at r5 (raw file):

Previously, spapinistarkware (Shahar Papini) wrote…

Does this function work when n_variables == 0?

It doesn't, thanks. Changed it to panic.

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 58 at r5 (raw file):

Previously, spapinistarkware (Shahar Papini) wrote…

Why get them as mut instead of return them? You are passing zeros.

Done.

[spapinistarkware]

Reviewed 1 of 2 files at r4, all commit messages.
Reviewable status: 2 of 12 files reviewed, 2 unresolved discussions (waiting on @andrewmilson and @shaharsamocha7)

---

crates/prover/src/core/backend/cpu/lookups/gkr.rs line 45 at r7 (raw file):

        // 1. `sum_x eq(({0}^|r|, 0, x), y) * F(r, t, x)`
        // 2. `sum_x eq((r,       t, x), y) * F(r, t, x)`
        {

Why is this in a block?

[spapinistarkware]

Reviewable status: 2 of 12 files reviewed, 3 unresolved discussions (waiting on @andrewmilson and @shaharsamocha7)

---

crates/prover/src/core/lookups/gkr_prover.rs line 391 at r7 (raw file):

/// * `k` is zero or greater than the length of `y`.
/// * `z_0` is zero.
pub fn correct_sum_as_poly_in_first_variable(

I think this function is kind of convoluted with respect to what it actually needs to do.
Here is my reasoning.

We evaluated f(0) and f(2) - the inputs.
We want to compute r(t) = f(t) * eq(t,z)/eq(0,z) / eq(0, y)
(I think this explicit formulat would also help the docs).

eq(0,y) is a const, call it a.
eq(t,z)/eq(0,z) =
(tz+(1-t)(1-z))/(1-z) =
1-t+tz/(1-z)=
1 - t(1 - z/(1-z))=
1 - t(2 - 1/(1-z))=
1-bt

We get that r(t) = f(t) * (1-bt) / a.
Also,
r(0) = f(0) / a
r(1) = claim - r(0)
r(2) = f(2)(1-2b) / a
r(1/b) = 0

Interpolate these.