chore!: opcode gas multipliers to account for slow simulation opcodes (#19130)

After these multipliers, all opcode-spam tests take 300ms or less (1
cpu, 8g ram). I chose the smallest whole-number multipliers to get us
there.

| Opcode | Multiplier | Original Cost | New Cost | Notes |
|--------|------------|---------------|------------|-------|
| FDIV | 25x | 9 | 225 |  |
| SLOAD | 10x | 129 | 1,290 |  |
| SSTORE | 20x | 1,657 | 33,140 |  |
| NOTEHASHEXISTS | 4x | 126 | 504 | +1x for slow proving |
| EMITNOTEHASH | 15x | 1,285 | 19,275 |  |
| NULLIFIEREXISTS | 7x | 132 | 924 | +1x for slow proving |
| EMITNULLIFIER | 20x | 1,540 | 30,800 |  |
| L1TOL2MSGEXISTS | 5x | 108 | 540 | +1x for slow proving |
| SENDL2TOL1MSG | 2x | 209 | 418 |  |
| CALL | 3x | 3,312 | 9,936 |  |
| STATICCALL | 3x | 3,312 | 9,936 |  |
| GETCONTRACTINSTANCE | 4x | 1,527 | 6,108 | Slow simulation |
| POSEIDON2 | 15x | 24 | 360 | |
| ECADD | 10x | 27 | 270 | |



## Discussion
For certain exceptionally slow-to-simulate opcodes, we are multiplying
their *L2 Gas* by a factor to normalize them relative to others. This
brings mana/s and worst-case simulation (when spamming an opcode) of
these outlier opcodes back near the others.

More concretely, we measured simulation time when meaningfully spamming
each opcode as many times as possible in a transaction. For such
transactions, these multipliers bring worst-case simulation down under
300ms/tx.

For context, non-outlier opcodes generally range from 150-250ms/tx (for
txs that infinitely spam the opcode).

*Note: this is only for L2 gas and is completely separate from DA gas.*

We have plans to make merkle/db optimizations in the future that might
let us reduce some of these multipliers, but that will be substantial
work that will not be complete for Alpha.

## Other changes
Gas cost changes cause AVM VK changes along with inner and outer
recursive verifier changes

## Follow-up work:
1. Commit the scripts used to measure these with consistent resources

Author: dbanks12

barretenberg/cpp/src/barretenberg/vm2/common/aztec_constants.hpp

@@ -188,7 +188,7 @@
 #define AVM_SUB_BASE_L2_GAS 12
 #define AVM_MUL_BASE_L2_GAS 27
 #define AVM_DIV_BASE_L2_GAS 27
-#define AVM_FDIV_BASE_L2_GAS 9
+#define AVM_FDIV_BASE_L2_GAS 225
 #define AVM_EQ_BASE_L2_GAS 12
 #define AVM_LT_BASE_L2_GAS 42
 #define AVM_LTE_BASE_L2_GAS 42
@@ -210,25 +210,25 @@
 #define AVM_INTERNALRETURN_BASE_L2_GAS 9
 #define AVM_SET_BASE_L2_GAS 27
 #define AVM_MOV_BASE_L2_GAS 12
-#define AVM_SLOAD_BASE_L2_GAS 129
-#define AVM_SSTORE_BASE_L2_GAS 1657
-#define AVM_NOTEHASHEXISTS_BASE_L2_GAS 126
-#define AVM_EMITNOTEHASH_BASE_L2_GAS 1285
-#define AVM_NULLIFIEREXISTS_BASE_L2_GAS 132
-#define AVM_EMITNULLIFIER_BASE_L2_GAS 1540
-#define AVM_L1TOL2MSGEXISTS_BASE_L2_GAS 108
-#define AVM_GETCONTRACTINSTANCE_BASE_L2_GAS 1527
+#define AVM_SLOAD_BASE_L2_GAS 1290
+#define AVM_SSTORE_BASE_L2_GAS 33140
+#define AVM_NOTEHASHEXISTS_BASE_L2_GAS 504
+#define AVM_EMITNOTEHASH_BASE_L2_GAS 19275
+#define AVM_NULLIFIEREXISTS_BASE_L2_GAS 924
+#define AVM_EMITNULLIFIER_BASE_L2_GAS 30800
+#define AVM_L1TOL2MSGEXISTS_BASE_L2_GAS 540
+#define AVM_GETCONTRACTINSTANCE_BASE_L2_GAS 6108
 #define AVM_EMITUNENCRYPTEDLOG_BASE_L2_GAS 15
-#define AVM_SENDL2TOL1MSG_BASE_L2_GAS 209
-#define AVM_CALL_BASE_L2_GAS 3312
-#define AVM_STATICCALL_BASE_L2_GAS 3312
+#define AVM_SENDL2TOL1MSG_BASE_L2_GAS 418
+#define AVM_CALL_BASE_L2_GAS 9936
+#define AVM_STATICCALL_BASE_L2_GAS 9936
 #define AVM_RETURN_BASE_L2_GAS 9
 #define AVM_REVERT_BASE_L2_GAS 9
 #define AVM_DEBUGLOG_BASE_L2_GAS 9
-#define AVM_POSEIDON2_BASE_L2_GAS 24
+#define AVM_POSEIDON2_BASE_L2_GAS 360
 #define AVM_SHA256COMPRESSION_BASE_L2_GAS 12288
 #define AVM_KECCAKF1600_BASE_L2_GAS 58176
-#define AVM_ECADD_BASE_L2_GAS 27
+#define AVM_ECADD_BASE_L2_GAS 270
 #define AVM_TORADIXBE_BASE_L2_GAS 24
 #define AVM_CALLDATACOPY_DYN_L2_GAS 3
 #define AVM_RETURNDATACOPY_DYN_L2_GAS 3

barretenberg/cpp/src/barretenberg/vm2/constraining/avm_fixed_vk.hpp

@@ -66,9 +66,9 @@ class AvmFixedVKCommitments {
                 uint256_t(
                     "0x090dda25e7d64ab5cabe09fd80fbb731af2a98de7a608157dc10394b4fc022a4")), // precomputed_exec_opcode_dynamic_l2_gas
             Commitment(
-                uint256_t("0x1de2201730f35721687604adf0035c8213a4b19caf17756063b9e516a0904cca"),
+                uint256_t("0x1139e8df5eabbe4201a0d73a0cfa7e12833955b6e190ec05fcdc0002d2756736"),
                 uint256_t(
-                    "0x1efb2dc65f3d27cdde93c07d042a0da3050355239d3e2d7908797b1780c10f40")), // precomputed_exec_opcode_opcode_gas
+                    "0x1ed8930b01998a1ba6c2df226f9e9a2aa93606228ed6d74b568c93cbdd6fb77f")), // precomputed_exec_opcode_opcode_gas
             Commitment(
                 uint256_t("0x296def9415d1c96b4d8ab91df5f59ad8522a726f98461b1ab5c4d4c5b22471a4"),
                 uint256_t(

barretenberg/cpp/src/barretenberg/vm2/dsl/avm2_recursion_constraint.test.cpp

@@ -136,7 +136,7 @@ TEST_F(AvmRecursionConstraintTest, GateCountAndVKCheck)
     using ProverInstance = ProverInstance_<UltraRollupFlavor>;
 
     static constexpr FF EXPECTED_OUTER_VK_HASH =
-        FF("0x077847493e9e67cc6ceb143e292d635ab7cc2b0652a00b073cdef17240c4a4dd");
+        FF("0x2db814b00aa8881bf5701dc7f203e4c7c7c976cfff151d8bfe477779c75bd96c");
 
     AcirConstraint constraint;
     WitnessVector witness;
@@ -167,7 +167,7 @@ class AvmRecursionInnerCircuitTests : public ::testing::Test {
     using FF = Builder::FF;
 
     static constexpr FF EXPECTED_INNER_VK_HASH =
-        FF("0x0badaf8fd586e28bcb8c724ae6b79e97da2dd583f37496cb68076b0d5db5b2e9");
+        FF("0x2370e99c105d4dd689b626c376de4ee5f257ed99163094d57720159ac1e96881");
 
     static void SetUpTestSuite() { bb::srs::init_file_crs_factory(bb::srs::bb_crs_path()); }
 

docs/docs-developers/docs/resources/migration_notes.md

@@ -9,6 +9,29 @@ Aztec is in full-speed development. Literally every version breaks compatibility
 
 ## TBD
 
+### [AVM] Gas cost multipliers for public execution to reach simulation/proving parity
+
+Gas costs for several AVM opcodes have been adjusted with multipliers to better align public simulation costs with actual proving costs.
+
+| Opcode | Multiplier | Previous Cost | New Cost |
+|--------|------------|---------------|----------|
+| FDIV | 25x | 9 | 225 |
+| SLOAD | 10x | 129 | 1,290 |
+| SSTORE | 20x | 1,657 | 33,140 |
+| NOTEHASHEXISTS | 4x | 126 | 504 |
+| EMITNOTEHASH | 15x | 1,285 | 19,275 |
+| NULLIFIEREXISTS | 7x | 132 | 924 |
+| EMITNULLIFIER | 20x | 1,540 | 30,800 |
+| L1TOL2MSGEXISTS | 5x | 108 | 540 |
+| SENDL2TOL1MSG | 2x | 209 | 418 |
+| CALL | 3x | 3,312 | 9,936 |
+| STATICCALL | 3x | 3,312 | 9,936 |
+| GETCONTRACTINSTANCE | 4x | 1,527 | 6,108 |
+| POSEIDON2 | 15x | 24 | 360 |
+| ECADD | 10x | 27 | 270 |
+
+**Impact**: Contracts with public bytecode performing any of these operations will see increased gas consumption.
+
 ### [PXE] deprecated `getNotes`
 
 This function serves only for debugging purposes so we are taking it out of the main PXE API. If you still need to consume it, you can

noir-projects/noir-protocol-circuits/crates/types/src/constants.nr

@@ -1096,11 +1096,13 @@ pub global L2_GAS_PER_PRIVATE_LOG: u32 = 0;
 pub global L2_GAS_PER_CONTRACT_CLASS_LOG: u32 = 0; // TODO: this should be nonzero, because the sequencer is doing work to hash this, as part of tx validation
 // Note: magic numbers here are derived from each op's AVM circuit trace area
 // https://docs.google.com/spreadsheets/d/1FPyLfJFPOfZTmZC-T6b_4yB5dSrOAofz3dufte23_TA/edit?usp=sharing
+// Some have a "SLOW_SIM_MUL" multiplier because they are slower to simulate and their trace-area-derived gas cost
+// is not sufficient to cover the simulation effort.
 pub global AVM_ADD_BASE_L2_GAS: u32 = 12;
 pub global AVM_SUB_BASE_L2_GAS: u32 = 12;
 pub global AVM_MUL_BASE_L2_GAS: u32 = 27;
 pub global AVM_DIV_BASE_L2_GAS: u32 = 27;
-pub global AVM_FDIV_BASE_L2_GAS: u32 = 9;
+pub global AVM_FDIV_BASE_L2_GAS: u32 = 9 * 25; // SLOW_SIM_MUL = 25
 pub global AVM_EQ_BASE_L2_GAS: u32 = 12;
 pub global AVM_LT_BASE_L2_GAS: u32 = 42;
 pub global AVM_LTE_BASE_L2_GAS: u32 = 42;
@@ -1122,26 +1124,26 @@ pub global AVM_INTERNALCALL_BASE_L2_GAS: u32 = 9;
 pub global AVM_INTERNALRETURN_BASE_L2_GAS: u32 = 9;
 pub global AVM_SET_BASE_L2_GAS: u32 = 27;
 pub global AVM_MOV_BASE_L2_GAS: u32 = 12;
-pub global AVM_SLOAD_BASE_L2_GAS: u32 = 129;
-pub global AVM_SSTORE_BASE_L2_GAS: u32 = 633 + L2_GAS_DISTRIBUTED_STORAGE_PREMIUM;
-pub global AVM_NOTEHASHEXISTS_BASE_L2_GAS: u32 = 126;
-pub global AVM_EMITNOTEHASH_BASE_L2_GAS: u32 = 261 + L2_GAS_DISTRIBUTED_STORAGE_PREMIUM;
-pub global AVM_NULLIFIEREXISTS_BASE_L2_GAS: u32 = 132;
-pub global AVM_EMITNULLIFIER_BASE_L2_GAS: u32 = 516 + L2_GAS_DISTRIBUTED_STORAGE_PREMIUM;
-pub global AVM_L1TOL2MSGEXISTS_BASE_L2_GAS: u32 = 108;
-pub global AVM_GETCONTRACTINSTANCE_BASE_L2_GAS: u32 = 1527; // does scalar mul
+pub global AVM_SLOAD_BASE_L2_GAS: u32 = 129 * 10; // SLOW_SIM_MUL = 10
+pub global AVM_SSTORE_BASE_L2_GAS: u32 = (633 + L2_GAS_DISTRIBUTED_STORAGE_PREMIUM) * 20; // SLOW_SIM_MUL = 20
+pub global AVM_NOTEHASHEXISTS_BASE_L2_GAS: u32 = 126 * 4; // SLOW_SIM_MUL = 3 (+1 for slow proving)
+pub global AVM_EMITNOTEHASH_BASE_L2_GAS: u32 = (261 + L2_GAS_DISTRIBUTED_STORAGE_PREMIUM) * 15; // SLOW_SIM_MUL = 15
+pub global AVM_NULLIFIEREXISTS_BASE_L2_GAS: u32 = 132 * 7; // SLOW_SIM_MUL = 6 (+1 for slow proving)
+pub global AVM_EMITNULLIFIER_BASE_L2_GAS: u32 = (516 + L2_GAS_DISTRIBUTED_STORAGE_PREMIUM) * 20; // SLOW_SIM_MUL = 20
+pub global AVM_L1TOL2MSGEXISTS_BASE_L2_GAS: u32 = 108 * 5; // SLOW_SIM_MUL = 4 (+1 for slow proving)
+pub global AVM_GETCONTRACTINSTANCE_BASE_L2_GAS: u32 = 1527 * 4; // SLOW_SIM_MUL = 4
 pub global AVM_EMITUNENCRYPTEDLOG_BASE_L2_GAS: u32 = 15;
-pub global AVM_SENDL2TOL1MSG_BASE_L2_GAS: u32 = 9 + L2_GAS_PER_L2_TO_L1_MSG;
+pub global AVM_SENDL2TOL1MSG_BASE_L2_GAS: u32 = (9 + L2_GAS_PER_L2_TO_L1_MSG) * 2; // SLOW_SIM_MUL = 2
 // See PR https://github.com/AztecProtocol/aztec-packages/pull/15495 on why we need this buffer.
-pub global AVM_CALL_BASE_L2_GAS: u32 = 3312; // hashes bytecode (1k rows for 3k fields)
-pub global AVM_STATICCALL_BASE_L2_GAS: u32 = 3312; // hashes bytecode (1k rows for 3k fields)
+pub global AVM_CALL_BASE_L2_GAS: u32 = 3312 * 3; // SLOW_SIM_MUL = 3
+pub global AVM_STATICCALL_BASE_L2_GAS: u32 = 3312 * 3; // SLOW_SIM_MUL = 3
 pub global AVM_RETURN_BASE_L2_GAS: u32 = 9;
 pub global AVM_REVERT_BASE_L2_GAS: u32 = 9;
 pub global AVM_DEBUGLOG_BASE_L2_GAS: u32 = 9;
-pub global AVM_POSEIDON2_BASE_L2_GAS: u32 = 24;
+pub global AVM_POSEIDON2_BASE_L2_GAS: u32 = 24 * 15; // SLOW_SIM_MUL = 15
 pub global AVM_SHA256COMPRESSION_BASE_L2_GAS: u32 = 12288;
 pub global AVM_KECCAKF1600_BASE_L2_GAS: u32 = 58176;
-pub global AVM_ECADD_BASE_L2_GAS: u32 = 27;
+pub global AVM_ECADD_BASE_L2_GAS: u32 = 27 * 10; // SLOW_SIM_MUL = 10
 pub global AVM_TORADIXBE_BASE_L2_GAS: u32 = 24;
 
 // Dynamic L2 GAS

yarn-project/constants/src/constants.gen.ts

@@ -419,7 +419,7 @@ export const AVM_ADD_BASE_L2_GAS = 12;
 export const AVM_SUB_BASE_L2_GAS = 12;
 export const AVM_MUL_BASE_L2_GAS = 27;
 export const AVM_DIV_BASE_L2_GAS = 27;
-export const AVM_FDIV_BASE_L2_GAS = 9;
+export const AVM_FDIV_BASE_L2_GAS = 225;
 export const AVM_EQ_BASE_L2_GAS = 12;
 export const AVM_LT_BASE_L2_GAS = 42;
 export const AVM_LTE_BASE_L2_GAS = 42;
@@ -441,25 +441,25 @@ export const AVM_INTERNALCALL_BASE_L2_GAS = 9;
 export const AVM_INTERNALRETURN_BASE_L2_GAS = 9;
 export const AVM_SET_BASE_L2_GAS = 27;
 export const AVM_MOV_BASE_L2_GAS = 12;
-export const AVM_SLOAD_BASE_L2_GAS = 129;
-export const AVM_SSTORE_BASE_L2_GAS = 1657;
-export const AVM_NOTEHASHEXISTS_BASE_L2_GAS = 126;
-export const AVM_EMITNOTEHASH_BASE_L2_GAS = 1285;
-export const AVM_NULLIFIEREXISTS_BASE_L2_GAS = 132;
-export const AVM_EMITNULLIFIER_BASE_L2_GAS = 1540;
-export const AVM_L1TOL2MSGEXISTS_BASE_L2_GAS = 108;
-export const AVM_GETCONTRACTINSTANCE_BASE_L2_GAS = 1527;
+export const AVM_SLOAD_BASE_L2_GAS = 1290;
+export const AVM_SSTORE_BASE_L2_GAS = 33140;
+export const AVM_NOTEHASHEXISTS_BASE_L2_GAS = 504;
+export const AVM_EMITNOTEHASH_BASE_L2_GAS = 19275;
+export const AVM_NULLIFIEREXISTS_BASE_L2_GAS = 924;
+export const AVM_EMITNULLIFIER_BASE_L2_GAS = 30800;
+export const AVM_L1TOL2MSGEXISTS_BASE_L2_GAS = 540;
+export const AVM_GETCONTRACTINSTANCE_BASE_L2_GAS = 6108;
 export const AVM_EMITUNENCRYPTEDLOG_BASE_L2_GAS = 15;
-export const AVM_SENDL2TOL1MSG_BASE_L2_GAS = 209;
-export const AVM_CALL_BASE_L2_GAS = 3312;
-export const AVM_STATICCALL_BASE_L2_GAS = 3312;
+export const AVM_SENDL2TOL1MSG_BASE_L2_GAS = 418;
+export const AVM_CALL_BASE_L2_GAS = 9936;
+export const AVM_STATICCALL_BASE_L2_GAS = 9936;
 export const AVM_RETURN_BASE_L2_GAS = 9;
 export const AVM_REVERT_BASE_L2_GAS = 9;
 export const AVM_DEBUGLOG_BASE_L2_GAS = 9;
-export const AVM_POSEIDON2_BASE_L2_GAS = 24;
+export const AVM_POSEIDON2_BASE_L2_GAS = 360;
 export const AVM_SHA256COMPRESSION_BASE_L2_GAS = 12288;
 export const AVM_KECCAKF1600_BASE_L2_GAS = 58176;
-export const AVM_ECADD_BASE_L2_GAS = 27;
+export const AVM_ECADD_BASE_L2_GAS = 270;
 export const AVM_TORADIXBE_BASE_L2_GAS = 24;
 export const AVM_CALLDATACOPY_DYN_L2_GAS = 3;
 export const AVM_RETURNDATACOPY_DYN_L2_GAS = 3;
@@ -543,4 +543,4 @@ export enum GeneratorIndex {
   SECRET_HASH = 20,
   TX_NULLIFIER = 32,
   SIGNATURE_PAYLOAD = 34,
-}
+}

yarn-project/simulator/src/public/fixtures/bulk_test.ts

@@ -119,9 +119,9 @@ export async function megaBulkTest(
   const argsField3 = [7, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
   const argsField4 = [9, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
   const argsField5 = [11, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField6 = [13, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField7 = [15, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField8 = [17, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  //const argsField6 = [13, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  //const argsField7 = [15, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  //const argsField8 = [17, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
   const argsU8 = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
   const genArgs = (argsField: Fr[]) => [
     argsField,
@@ -145,9 +145,9 @@ export async function megaBulkTest(
       { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField3) },
       { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField4) },
       { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField5) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField6) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField7) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField8) },
+      //{ address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField6) },
+      //{ address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField7) },
+      //{ address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField8) },
     ],
     /*teardownCall=*/ undefined,
     /*feePayer*/ undefined,