Update EIP-2537: MSM gas repricing

[Marchhill]

This PR makes granular changes to the discount table for MSM, giving G1 and G2 their own discount tables. The following changes are made:

G1:

const adjustments = [
    { startIndex: 1, endIndex: 1, multiplier: 1.5 },
    { startIndex: 3, endIndex: 5, multiplier: 1.25 },
    { startIndex: 6, endIndex: 12, multiplier: 1.5 },
    { startIndex: 13, endIndex: 20, multiplier: 1.75 },
    { startIndex: 21, endIndex: 29, multiplier: 2 },
    { startIndex: 30, endIndex: 128, multiplier: 2.5 }
];

Also 2.5x for max discount.

G2:

const adjustments = [
    { startIndex: 1, endIndex: 1, multiplier: 1.5 },
    { startIndex: 2, endIndex: 5, multiplier: 2 },
    { startIndex: 6, endIndex: 9, multiplier: 2.5 },
    { startIndex: 10, endIndex: 13, multiplier: 3 },
    { startIndex: 14, endIndex: 20, multiplier: 3.5 },
    { startIndex: 21, endIndex: 128, multiplier: 4 }
];

Also 4x for max discount.

Note that this also includes a change to G2 mul which affects G2 MSM price (see #9097).

This gives the following results for Nethermind on a NUC (aiming for ~80MGas/s to match Ecrecover):

g1msm-1: 159.0 mgas/s (155.3-162.9) 
g1msm-10: 91.13 mgas/s (90.89-91.37)
g1msm-11: 87.45 mgas/s (87.21-87.68)
g1msm-12: 83.89 mgas/s (81.62-86.28)
g1msm-128: 83.04 mgas/s (82.57-83.51)
g1msm-13: 95.91 mgas/s (95.37-96.45)
g1msm-14: 92.93 mgas/s (92.51-93.34)
g1msm-15: 83.73 mgas/s (80.18-87.61)
g1msm-16: 79.12 mgas/s (76.19-82.29)
g1msm-17: 82.05 mgas/s (81.80-82.29)
g1msm-18: 82.02 mgas/s (81.71-82.34)
g1msm-19: 77.52 mgas/s (75.01-80.21)
g1msm-2: 82.04 mgas/s (79.67-84.57)
g1msm-20: 82.28 mgas/s (82.00-82.55)
g1msm-2048: 90.14 mgas/s (88.20-92.17)
g1msm-21: 90.76 mgas/s (88.18-93.49)
g1msm-22: 87.87 mgas/s (84.99-90.96)
g1msm-23: 90.91 mgas/s (90.59-91.23)
g1msm-24: 85.95 mgas/s (82.99-89.13)
g1msm-25: 89.25 mgas/s (88.99-89.50)
g1msm-256: 86.62 mgas/s (85.96-87.29)
g1msm-26: 84.36 mgas/s (81.21-87.76)
g1msm-27: 87.78 mgas/s (87.49-88.08)
g1msm-28: 82.54 mgas/s (79.75-85.53)
g1msm-29: 85.55 mgas/s (85.16-85.94)
g1msm-3: 96.70 mgas/s (95.25-98.19)
g1msm-30: 101.2 mgas/s (97.90-104.7)
g1msm-31: 105.3 mgas/s (104.8-105.7)
g1msm-32: 102.4 mgas/s (101.9-103.0)
g1msm-4: 92.38 mgas/s (89.17-95.82)
g1msm-4096: 93.82 mgas/s (90.39-97.51)
g1msm-5: 89.31 mgas/s (86.11-92.76)
g1msm-512: 90.21 mgas/s (89.74-90.70)
g1msm-6: 94.95 mgas/s (94.12-95.81)
g1msm-64: 86.09 mgas/s (82.11-90.48)
g1msm-7: 95.65 mgas/s (92.51-99.01)
g1msm-8: 92.10 mgas/s (92.03-92.18)
g1msm-9: 84.08 mgas/s (80.26-88.29)
g2msm-1: 93.10 mgas/s (85.74-101.8)
g2msm-10: 94.51 mgas/s (86.57-104.0)
g2msm-11: 87.62 mgas/s (78.23-99.56)
g2msm-12: 89.33 mgas/s (82.16-97.88)
g2msm-128: 75.06 mgas/s (67.88-83.93)
g2msm-13: 84.62 mgas/s (77.13-93.73)
g2msm-14: 91.53 mgas/s (83.02-102.0)
g2msm-15: 92.39 mgas/s (81.37-106.9)
g2msm-16: 95.46 mgas/s (85.89-107.4)
g2msm-17: 84.91 mgas/s (76.77-94.99)
g2msm-18: 94.71 mgas/s (87.22-103.6)
g2msm-19: 87.91 mgas/s (79.06-98.99)
g2msm-2: 92.87 mgas/s (84.47-103.1)
g2msm-20: 93.55 mgas/s (85.13-103.8)
g2msm-2048: 96.32 mgas/s (86.31-109.0)
g2msm-21: 106.5 mgas/s (96.72-118.5)
g2msm-22: 107.8 mgas/s (96.11-122.7)
g2msm-23: 94.72 mgas/s (87.03-103.9)
g2msm-24: 101.9 mgas/s (95.29-109.4)
g2msm-25: 94.65 mgas/s (84.80-107.1)
g2msm-256: 80.92 mgas/s (71.32-93.50)
g2msm-26: 96.59 mgas/s (86.76-108.9)
g2msm-27: 97.09 mgas/s (86.79-110.2)
g2msm-28: 99.22 mgas/s (92.10-107.5)
g2msm-29: 95.41 mgas/s (88.14-104.0)
g2msm-3: 88.60 mgas/s (81.36-97.25)
g2msm-30: 96.92 mgas/s (87.77-108.2)
g2msm-31: 93.81 mgas/s (89.56-98.48)
g2msm-32: 102.1 mgas/s (93.50-112.5)
g2msm-4: 79.59 mgas/s (74.19-85.83)
g2msm-4096: 104.1 mgas/s (95.68-114.1)
g2msm-5: 80.36 mgas/s (76.30-84.89)
g2msm-512: 89.00 mgas/s (82.91-96.05)
g2msm-6: 91.34 mgas/s (85.12-98.54)
g2msm-64: 85.75 mgas/s (79.90-92.52)
g2msm-7: 92.69 mgas/s (83.70-103.8)
g2msm-8: 83.39 mgas/s (76.65-91.41)
g2msm-9: 81.03 mgas/s (74.96-88.18)

[eth-bot]

✅ All reviewers have approved.

[kevaundray]

This is effectively 2x scaling for G2MSM and 2.5x scaling for G1MSM

[chfast]

If discount tables are split between G1 and G2 they don't make sense any more. Just put the total cost in the table...

[garyschulte]

+1. Relevant besu benchmarks for msm:
https://gist.github.com/garyschulte/7de012b3caf1ac72a3e9cfcd90943e6d
https://gist.github.com/garyschulte/ba828407b166dc1efa23aef5887c9078

[Marchhill]

If discount tables are split between G1 and G2 they don't make sense any more. Just put the total cost in the table...

Do you mean precompute the gas costs for each number of pairs and put that in a table? I think keeping the discount table is cleaner as we couldn't put all pair counts >128 in a table, and also we want to keep multiplication_cost as its own variable so we can easily change it

[chfast]

For k=1 we should put 1000 (the same cost as multiplication). Otherwise, we incentivize contracts to put a condition to redirect inputs from MSM to MUL in case they have single point.
In other words, if you have single point to multiply, you should not use any MSM algorithm. Just use regular multiplication in your MSM precompile implementation.

[chfast]

These values are not monotonic, so you have to fix this.

[chfast]

For me the terminal value k=128 is 520.

[garyschulte]

These values are not monotonic, so you have to fix this.

missed that. they should definitely be monotonic, regardless of the performance profile for any particular k,

[chfast]

we want to keep multiplication_cost as its own variable so we can easily change it

This I don't agree with. We started with a table created 4 years ago that tries to estimate some fucked up curve of gas costs. And now we try to find a constant N that will somehow fix it, but in the end we get a curve fucked up N times.

But I don't care some much any more. If people prefer to operate on permilles instead of absolute values let it be.

[jwasinger]

Also, at least for Gnark's implementation of MSM, mul isn't even used as a component. So it's very strange that it should be a factor in the cost model.

[kevaundray]

I don't know the original rationale for using MUL, however, one reasoning is that MSM is tied to cost of ADD and there's a relationship between the cost of ADD and cost of a MUL

[chfast]

My proposed "discounts" for G1MSM

[[1, 1000], [2, 949], [3, 848], [4, 797], [5, 764], [6, 750], [7, 738], [8, 728], [9, 719], [10, 712], [11, 705], [12, 698], [13, 692], [14, 687], [15, 682], [16, 677], [17, 673], [18, 669], [19, 665], [20, 661], [21, 658], [22, 654], [23, 651], [24, 648], [25, 645], [26, 642], [27, 640], [28, 637], [29, 635], [30, 632], [31, 630], [32, 627], [33, 625], [34, 623], [35, 621], [36, 619], [37, 617], [38, 615], [39, 613], [40, 611], [41, 609], [42, 608], [43, 606], [44, 604], [45, 603], [46, 601], [47, 599], [48, 598], [49, 596], [50, 595], [51, 593], [52, 592], [53, 591], [54, 589], [55, 588], [56, 586], [57, 585], [58, 584], [59, 582], [60, 581], [61, 580], [62, 579], [63, 577], [64, 576], [65, 575], [66, 574], [67, 573], [68, 572], [69, 570], [70, 569], [71, 568], [72, 567], [73, 566], [74, 565], [75, 564], [76, 563], [77, 562], [78, 561], [79, 560], [80, 559], [81, 558], [82, 557], [83, 556], [84, 555], [85, 554], [86, 553], [87, 552], [88, 551], [89, 550], [90, 549], [91, 548], [92, 547], [93, 547], [94, 546], [95, 545], [96, 544], [97, 543], [98, 542], [99, 541], [100, 540], [101, 540], [102, 539], [103, 538], [104, 537], [105, 536], [106, 536], [107, 535], [108, 534], [109, 533], [110, 532], [111, 532], [112, 531], [113, 530], [114, 529], [115, 528], [116, 528], [117, 527], [118, 526], [119, 525], [120, 525], [121, 524], [122, 523], [123, 522], [124, 522], [125, 521], [126, 520], [127, 520], [128, 519]]

I plotted the values: original, proposed here and proposed by me (evmone) for visualization (without value for 1 where I argue it should be 1000).

[chfast]

My proposed "discounts" for G2MSM, based on benchmarking evmone/BLST (the same way as G1MSM).

[[1, 1000], [2, 1000], [3, 923], [4, 884], [5, 855], [6, 832], [7, 812], [8, 796], [9, 782], [10, 770], [11, 759], [12, 749], [13, 740], [14, 732], [15, 724], [16, 717], [17, 711], [18, 704], [19, 699], [20, 693], [21, 688], [22, 683], [23, 679], [24, 674], [25, 670], [26, 666], [27, 663], [28, 659], [29, 655], [30, 652], [31, 649], [32, 646], [33, 643], [34, 640], [35, 637], [36, 634], [37, 632], [38, 629], [39, 627], [40, 624], [41, 622], [42, 620], [43, 618], [44, 615], [45, 613], [46, 611], [47, 609], [48, 607], [49, 606], [50, 604], [51, 602], [52, 600], [53, 598], [54, 597], [55, 595], [56, 593], [57, 592], [58, 590], [59, 589], [60, 587], [61, 586], [62, 584], [63, 583], [64, 582], [65, 580], [66, 579], [67, 578], [68, 576], [69, 575], [70, 574], [71, 573], [72, 571], [73, 570], [74, 569], [75, 568], [76, 567], [77, 566], [78, 565], [79, 563], [80, 562], [81, 561], [82, 560], [83, 559], [84, 558], [85, 557], [86, 556], [87, 555], [88, 554], [89, 553], [90, 552], [91, 552], [92, 551], [93, 550], [94, 549], [95, 548], [96, 547], [97, 546], [98, 545], [99, 545], [100, 544], [101, 543], [102, 542], [103, 541], [104, 541], [105, 540], [106, 539], [107, 538], [108, 537], [109, 537], [110, 536], [111, 535], [112, 535], [113, 534], [114, 533], [115, 532], [116, 532], [117, 531], [118, 530], [119, 530], [120, 529], [121, 528], [122, 528], [123, 527], [124, 526], [125, 526], [126, 525], [127, 524], [128, 524]]

The table proposed in this PR suggests there is something seriously broken in the implementation benchamarked or in the benchmarks themselves. Because the values suggests that up to 45 points there is no benefit of using MSM over naive chain of MULs (ignoring ADD cost which is only ~2.5% overhead). This means we can't ship this EIP with such implementation.

Classing plot for visualization.

[Marchhill]

we want to keep multiplication_cost as its own variable so we can easily change it

This I don't agree with. We started with a table created 4 years ago that tries to estimate some fucked up curve of gas costs. And now we try to find a constant N that will somehow fix it, but in the end we get a curve fucked up N times.

But I don't care some much any more. If people prefer to operate on permilles instead of absolute values let it be.

Ok then, I still think it's easier because as I say you would still need to use a similar formula to calculate for values >128 pairs unless we had a massive table.

The new discount table looks good to me.

[mratsim]

Here are my benchmarks on Cosntantine with a Ryzen 7840U (laptop 15~28W, 2023) with the current state of discount table.

git clone https://github.com/mratsim/constantine
cd constantine
CC=clang nimble bench_eth_evm_precompiles

table change: https://github.com/mratsim/constantine/compare/eip2537-repricing

Before

--------------------------------------------------------------------------------------------------------------------------------
BLS12_G1MSM   2            21312 gas     123.44 MGas/s        5791.998 ops/s       172652 ns/op       568662 CPU cycles (approx)
BLS12_G1MSM   4            30768 gas     103.14 MGas/s        3352.026 ops/s       298327 ns/op       982598 CPU cycles (approx)
BLS12_G1MSM   8            43488 gas      81.72 MGas/s        1879.056 ops/s       532182 ns/op      1752854 CPU cycles (approx)
BLS12_G1MSM  16            64128 gas      66.60 MGas/s        1038.514 ops/s       962914 ns/op      3171573 CPU cycles (approx)
BLS12_G1MSM  32           103296 gas      60.53 MGas/s         585.945 ops/s      1706644 ns/op      5621216 CPU cycles (approx)
BLS12_G1MSM  64           170496 gas      49.20 MGas/s         288.579 ops/s      3465253 ns/op     11413591 CPU cycles (approx)
BLS12_G1MSM 128           267264 gas      42.06 MGas/s         157.383 ops/s      6353910 ns/op     20928068 CPU cycles (approx)
--------------------------------------------------------------------------------------------------------------------------------
BLS12_G2MSM   2            39960 gas     125.27 MGas/s        3134.865 ops/s       318993 ns/op      1050621 CPU cycles (approx)
BLS12_G2MSM   4            57690 gas     113.40 MGas/s        1965.726 ops/s       508718 ns/op      1675561 CPU cycles (approx)
BLS12_G2MSM   8            81540 gas      89.35 MGas/s        1095.742 ops/s       912624 ns/op      3005920 CPU cycles (approx)
BLS12_G2MSM  16           120240 gas      75.99 MGas/s         631.979 ops/s      1582332 ns/op      5211765 CPU cycles (approx)
BLS12_G2MSM  32           193680 gas      68.76 MGas/s         355.031 ops/s      2816656 ns/op      9277253 CPU cycles (approx)
BLS12_G2MSM  64           319680 gas      59.71 MGas/s         186.768 ops/s      5354222 ns/op     17635190 CPU cycles (approx)
BLS12_G2MSM 128           501120 gas      50.71 MGas/s         101.196 ops/s      9881793 ns/op     32547890 CPU cycles (approx)
--------------------------------------------------------------------------------------------------------------------------------

After

--------------------------------------------------------------------------------------------------------------------------------
BLS12_G1MSM   2            22776 gas     129.98 MGas/s        5706.753 ops/s       175231 ns/op       577150 CPU cycles (approx)
BLS12_G1MSM   4            38256 gas     126.63 MGas/s        3310.096 ops/s       302106 ns/op       995045 CPU cycles (approx)
BLS12_G1MSM   8            69888 gas     130.63 MGas/s        1869.194 ops/s       534990 ns/op      1762104 CPU cycles (approx)
BLS12_G1MSM  16           129984 gas     139.49 MGas/s        1073.163 ops/s       931825 ns/op      3069168 CPU cycles (approx)
BLS12_G1MSM  32           240768 gas     146.89 MGas/s         610.073 ops/s      1639148 ns/op      5398905 CPU cycles (approx)
BLS12_G1MSM  64           442368 gas     125.96 MGas/s         284.735 ops/s      3512043 ns/op     11567724 CPU cycles (approx)
BLS12_G1MSM 128           797184 gas     125.89 MGas/s         157.913 ops/s      6332612 ns/op     20857920 CPU cycles (approx)
--------------------------------------------------------------------------------------------------------------------------------
BLS12_G2MSM   2            45000 gas     143.42 MGas/s        3187.058 ops/s       313769 ns/op      1033457 CPU cycles (approx)
BLS12_G2MSM   4            79560 gas     157.94 MGas/s        1985.155 ops/s       503739 ns/op      1659170 CPU cycles (approx)
BLS12_G2MSM   8           143280 gas     157.53 MGas/s        1099.433 ops/s       909560 ns/op      2995829 CPU cycles (approx)
BLS12_G2MSM  16           258120 gas     162.32 MGas/s         628.841 ops/s      1590228 ns/op      5237769 CPU cycles (approx)
BLS12_G2MSM  32           465120 gas     164.52 MGas/s         353.720 ops/s      2827096 ns/op      9311646 CPU cycles (approx)
BLS12_G2MSM  64           838080 gas     156.34 MGas/s         186.543 ops/s      5360708 ns/op     17656630 CPU cycles (approx)
BLS12_G2MSM 128          1509120 gas     152.68 MGas/s         101.171 ops/s      9884219 ns/op     32555919 CPU cycles (approx)
--------------------------------------------------------------------------------------------------------------------------------

[ralexstokes]

lgtm

[eth-bot]

All Reviewers Have Approved; Performing Automatic Merge...