Add Uint256Mul circuit

Author: dreamATD

ceno_zkvm/src/gadgets/field/range.rs

@@ -205,7 +205,10 @@ impl<Expr: Clone, P: FieldParameters> FieldLtCols<Expr, P> {
         let mut sum_flags: Expression<E> = 0.into();
         for flag in self.byte_flags.0.iter() {
             // Assert that the flag is boolean.
-            builder.assert_bit(|| "if cond, flag", cond.expr() * flag.expr())?;
+            // It should be builder.assert_bit(|| "if cond, flag", cond.expr() * flag.expr())?;
+            // But this makes the degree of sumcheck to be 5 (which is not supported by the backend),
+            // therefore, we just assume byte flags are boolean no matter cond is 1 or 0.
+            builder.assert_bit(|| "flag", flag.expr())?;
             // Add the flag to the sum.
             sum_flags = sum_flags.clone() + flag.expr();
         }

ceno_zkvm/src/gadgets/is_zero.rs

@@ -58,7 +58,7 @@ impl IsZeroOperation<WitIn> {
         builder: &mut CircuitBuilder<E>,
         a: Expression<E>,
     ) -> Result<(), CircuitBuilderError> {
-        let one: Expression<E> = Expression::ZERO;
+        let one: Expression<E> = Expression::ONE;
 
         // 1. Input == 0 => is_zero = 1 regardless of the inverse.
         // 2. Input != 0
@@ -100,6 +100,7 @@ impl<F: SmallField> IsZeroOperation<F> {
         }
         let prod = self.inverse * a;
         debug_assert!(prod == F::ONE || prod == F::ZERO);
+        debug_assert_eq!(self.result, F::ONE - self.inverse * a);
         (a == F::ZERO) as u32
     }
 }

ceno_zkvm/src/precompiles/lookup_keccakf.rs

@@ -1015,7 +1015,7 @@ pub fn setup_gkr_circuit<E: ExtensionField>()
     fields(profiling_1)
 )]
 pub fn run_faster_keccakf<E: ExtensionField, PCS: PolynomialCommitmentScheme<E> + 'static>(
-    (layout, gkr_circuit, num_witin, num_structual_witin): (
+    (layout, gkr_circuit, num_witin, num_structural_witin): (
         TestKeccakLayout<E>,
         GKRCircuit<E>,
         u16,
@@ -1068,7 +1068,7 @@ pub fn run_faster_keccakf<E: ExtensionField, PCS: PolynomialCommitmentScheme<E>
     );
     let mut structural_witness = RowMajorMatrix::<E::BaseField>::new(
         layout.layout.phase1_witin_rmm_height(states.len()),
-        num_structual_witin as usize,
+        num_structural_witin as usize,
         InstancePaddingStrategy::Default,
     );
     let raw_witin_iter =