Repository navigation
Reuse multiply scratch and check exponents four bits at a time - #1
Open
OverActiveBladderSystem wants to merge 2 commits into
Open
OverActiveBladderSystem wants to merge 2 commits into
OverActiveBladderSystem wants to merge 2 commits into
Conversation
The multiply keeps one scratch per thread. MSVC link-time optimization miscompiles that function when it is inlined, so it stays out of line there. Exponents under 64 bits use the one-bit walk. Longer exponents use the four-bit walk. The tests compare both with the older multiply.
OverActiveBladderSystem
force-pushed
the
OABS-verifier-scratch-and-4bit-window
branch
from
October 19, 2026 21:58
2361791 to
d4cb718
Compare
The review asked to drop the debug print, include vdf_new.h directly in the regression test, and either fill the unused table slot with the identity or assert that it is never read. Filling the slot slowed the short mix by about 26 percent, so the slot stays unused and an assert guards the read. The shallow-copy sites now say they share limb storage with the source form. The MSVC noinline comment now says that moving the scratch into another file does not stop the link-time miscompile.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes in the proof checker.
qfb_nucomp in src/nucomp.h still creates and frees GMP temporaries on every call. Pull request 298 already stopped doing that in qfb_nudupl, the square, by keeping those temporaries for the life of the thread. This applies that same pattern to the multiply. The ordered swap still returns before any scratch value is used, and each thread has its own scratch, including the two threads in ParallelProver.
Pull request 298 is merged on main, and it is not in any release. The published release is still 1.1.14. A full_node gets that code only after a new chiavdf release is tagged and a chia-blockchain release installs it, which is why the square speedup is not in the checker people are running today.
FastPowFormNucomp in src/proof_common.h still walks the exponent one bit at a time. This builds x^1 through x^15 and consumes the exponent four bits at a time. The coefficient a is reduced when it passes half the discriminant size, including after a window multiply, and the function still does one full reduction before returning. Exponent 0 still returns the identity. A zero digit skips the multiply.
The multiply is the other hot call, about 260 times per piece, and it was still paying to create and free temporaries on every entry. A fixed 5-bit window was slower on a 264-bit exponent. A sliding window saved about 0.11 ms, which is inside the noise of one block, because squaring is still most of the remaining time. Those were left out.
Same build, one proof piece, generic math library, Windows x64: main without this patch was 5.209 ms, and this patch was 4.562 ms, about 12 percent. The proof bytes from the old one-bit check and from this four-bit check were identical, and both checks accepted them. The checks used the iteration counts of the software timelord and of the program that prepares proofs for an ASIC, and they ran on this PC. No ASIC hardware was used. The ASIC chip does not call these functions. A one-byte change in a known proof still fails.
This pull request alone, on the same build as current main, is the 12 percent above. The larger figures need more than these two files, and none of them are in the 1.1.14 release.
On this Windows PC, against the released 1.1.14 checker with the generic math library, the same proofs gave:
The AVX2 library is selected by pull request 423, together with mpir_gc_x64 pull request 5. That change is not in this branch. Linux releases use GMP, so they do not get that Windows library swap. They would get pull request 298 and this patch only after a chiavdf release is tagged and a chia-blockchain release installs it.