feat: add secp256r1

.vscode/settings.json

@@ -50,6 +50,8 @@
         // "tests/secp256k1-add/Cargo.toml",
         // "tests/secp256k1-decompress/Cargo.toml",
         // "tests/secp256k1-double/Cargo.toml",
+        // "tests/secp256r1-add/Cargo.toml",
+        // "tests/secp256r1-double/Cargo.toml",
         // "tests/sha-compress/Cargo.toml",
         // "tests/sha-extend/Cargo.toml",
         // "tests/sha2/Cargo.toml",

core/Cargo.toml

@@ -46,6 +46,7 @@ curve25519-dalek = { version = "4.1.2" }
 elliptic-curve = "0.13.8"
 hex = "0.4.3"
 k256 = { version = "0.13.3", features = ["expose-field"] }
+p256 = { version = "0.13.2", features = ["expose-field"] } 
 num_cpus = "1.16.0"
 serde_with = "3.8.1"
 size = "0.4.1"

core/src/operations/field/field_den.rs

@@ -113,9 +113,9 @@ where
         V: Into<AB::Expr>,
     {
         let p_a = Polynomial::from(*a);
-        let p_b = (*b).into();
+        let p_b: Polynomial<AB::Expr> = (*b).into();
         let p_result = self.result.into();
-        let p_carry = self.carry.into();
+        let p_carry: Polynomial<AB::Expr> = self.carry.into();
 
         // Compute the vanishing polynomial:
         //      lhs(x) = sign * (b(x) * result(x) + result(x)) + (1 - sign) * (b(x) * result(x) + a(x))
@@ -136,7 +136,13 @@ where
         let p_witness_low = self.witness_low.0.iter().into();
         let p_witness_high = self.witness_high.0.iter().into();
 
-        eval_field_operation::<AB, P>(builder, &p_vanishing, &p_witness_low, &p_witness_high);
+        eval_field_operation::<AB, P>(
+            builder,
+            &p_vanishing,
+            &p_witness_low,
+            &p_witness_high,
+            is_real.clone(),
+        );
 
         // Range checks for the result, carry, and witness columns.
         builder.slice_range_check_u8(&self.result.0, shard.clone(), is_real.clone());

core/src/operations/field/field_inner_product.rs

@@ -116,7 +116,7 @@ where
         let p_a_vec: Vec<Polynomial<AB::Expr>> = a.iter().map(|x| (*x).into()).collect();
         let p_b_vec: Vec<Polynomial<AB::Expr>> = b.iter().map(|x| (*x).into()).collect();
         let p_result = self.result.into();
-        let p_carry = self.carry.into();
+        let p_carry: Polynomial<AB::Expr> = self.carry.into();
 
         let p_zero = Polynomial::<AB::Expr>::new(vec![AB::Expr::zero()]);
 
@@ -135,7 +135,13 @@ where
         let p_witness_low = self.witness_low.0.iter().into();
         let p_witness_high = self.witness_high.0.iter().into();
 
-        eval_field_operation::<AB, P>(builder, &p_vanishing, &p_witness_low, &p_witness_high);
+        eval_field_operation::<AB, P>(
+            builder,
+            &p_vanishing,
+            &p_witness_low,
+            &p_witness_high,
+            is_real.clone(),
+        );
 
         // Range checks for the result, carry, and witness columns.
         builder.slice_range_check_u8(&self.result.0, shard.clone(), is_real.clone());

core/src/operations/field/field_op.rs

@@ -1,6 +1,7 @@
 use std::fmt::Debug;
 
-use num::{BigUint, Zero};
+use num::BigUint;
+use num::Zero;
 use p3_air::AirBuilder;
 use p3_field::PrimeField32;
 use sp1_derive::AlignedBorrow;
@@ -117,15 +118,6 @@
         modulus: &BigUint,
         op: FieldOperation,
     ) -> BigUint {
-        if b == &BigUint::zero() && op == FieldOperation::Div {
-            // Division by 0 is allowed only when dividing 0 so that padded rows can be all 0.
-            assert_eq!(
-                *a,
-                BigUint::zero(),
-                "division by zero is allowed only when dividing zero"
-            );
-        }
-
         let result = match op {
             // If doing the subtraction operation, a - b = result, equivalent to a = result + b.
             FieldOperation::Sub => {
@@ -212,7 +204,13 @@
         let p_vanishing = p_op_minus_result - &(&p_carry * &p_modulus);
         let p_witness_low = self.witness_low.0.iter().into();
         let p_witness_high = self.witness_high.0.iter().into();
-        eval_field_operation::<AB, P>(builder, &p_vanishing, &p_witness_low, &p_witness_high);
+        eval_field_operation::<AB, P>(
+            builder,
+            &p_vanishing,
+            &p_witness_low,
+            &p_witness_high,
+            is_real.clone(),
+        );
 
         // Range checks for the result, carry, and witness columns.
         builder.slice_range_check_u8(&self.result.0, shard.clone(), is_real.clone());

core/src/operations/field/util_air.rs

@@ -2,13 +2,16 @@
 
 use crate::air::Polynomial;
 use crate::air::SP1AirBuilder;
-use crate::operations::field::params::FieldParameters;
+use p3_air::AirBuilder;
+
+use super::params::FieldParameters;
 
 pub fn eval_field_operation<AB: SP1AirBuilder, P: FieldParameters>(
     builder: &mut AB,
     p_vanishing: &Polynomial<AB::Expr>,
     p_witness_low: &Polynomial<AB::Expr>,
     p_witness_high: &Polynomial<AB::Expr>,
+    is_real: impl Into<AB::Expr>,
 ) {
     // Reconstruct and shift back the witness polynomial
     let limb: AB::Expr = AB::F::from_canonical_u32(2u32.pow(P::NB_BITS_PER_LIMB as u32)).into();
@@ -23,8 +26,9 @@
 
     // Multiply by (x-2^NB_BITS_PER_LIMB) and make the constraint
     let root_monomial = Polynomial::new(vec![-limb, AB::F::one().into()]);
+    let real_monomial = Polynomial::new(vec![is_real.into()]);
 
-    let constraints = p_vanishing - &(p_witness * root_monomial);
+    let constraints = real_monomial * p_vanishing.clone() - &(p_witness * root_monomial);
     for constr in constraints.as_coefficients() {
         builder.assert_zero(constr);
     }

core/src/runtime/record.rs

@@ -81,6 +81,10 @@ pub struct ExecutionRecord {
 
     pub secp256k1_double_events: Vec<ECDoubleEvent>,
 
+    pub secp256r1_add_events: Vec<ECAddEvent>,
+
+    pub secp256r1_double_events: Vec<ECDoubleEvent>,
+
     pub bn254_add_events: Vec<ECAddEvent>,
 
     pub bn254_double_events: Vec<ECDoubleEvent>,
@@ -119,6 +123,9 @@ pub struct ShardingConfig {
     pub keccak_len: usize,
     pub secp256k1_add_len: usize,
     pub secp256k1_double_len: usize,
+    pub secp256r1_add_len: usize,
+    pub secp256r1_double_len: usize,
+
     pub bn254_add_len: usize,
     pub bn254_double_len: usize,
     pub bls12381_add_len: usize,
@@ -149,6 +156,8 @@ impl Default for ShardingConfig {
             keccak_len: shard_size,
             secp256k1_add_len: shard_size,
             secp256k1_double_len: shard_size,
+            secp256r1_add_len: shard_size,
+            secp256r1_double_len: shard_size,
             bn254_add_len: shard_size,
             bn254_double_len: shard_size,
             bls12381_add_len: shard_size,
@@ -211,6 +220,14 @@ impl MachineRecord for ExecutionRecord {
             "secp256k1_double_events".to_string(),
             self.secp256k1_double_events.len(),
         );
+        stats.insert(
+            "secp256r1_add_events".to_string(),
+            self.secp256r1_add_events.len(),
+        );
+        stats.insert(
+            "secp256r1_double_events".to_string(),
+            self.secp256r1_double_events.len(),
+        );
         stats.insert("bn254_add_events".to_string(), self.bn254_add_events.len());
         stats.insert(
             "bn254_double_events".to_string(),
@@ -267,6 +284,10 @@ impl MachineRecord for ExecutionRecord {
             .append(&mut other.secp256k1_add_events);
         self.secp256k1_double_events
             .append(&mut other.secp256k1_double_events);
+        self.secp256r1_add_events
+            .append(&mut other.secp256r1_add_events);
+        self.secp256r1_double_events
+            .append(&mut other.secp256r1_double_events);
         self.bn254_add_events.append(&mut other.bn254_add_events);
         self.bn254_double_events
             .append(&mut other.bn254_double_events);
@@ -452,6 +473,26 @@ impl MachineRecord for ExecutionRecord {
                 .extend_from_slice(secp256k1_double_chunk);
         }
 
+        // secp256r1 curve add events.
+        for (secp256r1_add_chunk, shard) in take(&mut self.secp256r1_add_events)
+            .chunks_mut(config.secp256r1_add_len)
+            .zip(shards.iter_mut())
+        {
+            shard
+                .secp256r1_add_events
+                .extend_from_slice(secp256r1_add_chunk);
+        }
+
+        // secp256r1 curve double events.
+        for (secp256r1_double_chunk, shard) in take(&mut self.secp256r1_double_events)
+            .chunks_mut(config.secp256r1_double_len)
+            .zip(shards.iter_mut())
+        {
+            shard
+                .secp256r1_double_events
+                .extend_from_slice(secp256r1_double_chunk);
+        }
+
         // bn254 curve add events.
         for (bn254_add_chunk, shard) in take(&mut self.bn254_add_events)
             .chunks_mut(config.bn254_add_len)

core/src/runtime/syscall.rs

@@ -18,8 +18,9 @@ use crate::syscall::{
     SyscallHalt, SyscallHintLen, SyscallHintRead, SyscallVerifySP1Proof, SyscallWrite,
 };
 use crate::utils::ec::edwards::ed25519::{Ed25519, Ed25519Parameters};
-use crate::utils::ec::weierstrass::bls12_381::Bls12381;
-use crate::utils::ec::weierstrass::{bn254::Bn254, secp256k1::Secp256k1};
+use crate::utils::ec::weierstrass::{
+    bls12_381::Bls12381, bn254::Bn254, secp256k1::Secp256k1, secp256r1::Secp256r1,
+};
 use crate::{runtime::ExecutionRecord, runtime::MemoryReadRecord, runtime::MemoryWriteRecord};
 
 /// A system call is invoked by the the `ecall` instruction with a specific value in register t0.
@@ -102,6 +103,12 @@ pub enum SyscallCode {
 
     /// Executes the `BLS12381_DOUBLE` precompile.
     BLS12381_DOUBLE = 0x00_00_01_1F,
+
+    /// Executes the `SECP256R1_ADD` precompile.
+    SECP256R1_ADD = 0x00_01_01_11,
+
+    /// Executes the `SECP256R1_DOUBLE` precompile.
+    SECP256R1_DOUBLE = 0x00_00_01_14,
 }
 
 impl SyscallCode {
@@ -132,6 +139,8 @@ impl SyscallCode {
             0x00_00_00_F1 => SyscallCode::HINT_READ,
             0x00_00_01_1D => SyscallCode::UINT256_MUL,
             0x00_00_01_1C => SyscallCode::BLS12381_DECOMPRESS,
+            0x00_01_01_11 => SyscallCode::SECP256R1_ADD,
+            0x00_00_01_14 => SyscallCode::SECP256R1_DOUBLE,
             _ => panic!("invalid syscall number: {}", value),
         }
     }
@@ -286,6 +295,14 @@ pub fn default_syscall_map() -> HashMap<SyscallCode, Rc<dyn Syscall>> {
         SyscallCode::SECP256K1_DECOMPRESS,
         Rc::new(WeierstrassDecompressChip::<Secp256k1>::new()),
     );
+    syscall_map.insert(
+        SyscallCode::SECP256R1_ADD,
+        Rc::new(WeierstrassAddAssignChip::<Secp256r1>::new()),
+    );
+    syscall_map.insert(
+        SyscallCode::SECP256R1_DOUBLE,
+        Rc::new(WeierstrassDoubleAssignChip::<Secp256r1>::new()),
+    );
     syscall_map.insert(
         SyscallCode::BN254_ADD,
         Rc::new(WeierstrassAddAssignChip::<Bn254>::new()),
@@ -402,6 +419,12 @@ mod tests {
                 SyscallCode::SECP256K1_DOUBLE => {
                     assert_eq!(code as u32, sp1_zkvm::syscalls::SECP256K1_DOUBLE)
                 }
+                SyscallCode::SECP256R1_ADD => {
+                    assert_eq!(code as u32, sp1_zkvm::syscalls::SECP256R1_ADD)
+                }
+                SyscallCode::SECP256R1_DOUBLE => {
+                    assert_eq!(code as u32, sp1_zkvm::syscalls::SECP256R1_DOUBLE)
+                }
                 SyscallCode::BLAKE3_COMPRESS_INNER => {
                     assert_eq!(code as u32, sp1_zkvm::syscalls::BLAKE3_COMPRESS_INNER)
                 }