Implement Plonky3 frontend adaptor (#306)

* feat: copy symbolic from Plonky3

* feat: copy fibo_air test from Plonky3

* feat: complete p3 frontend PoC

* chore: clean up

* chore: revert changes in middleware

* fix: clippy warnings

* feat: add keccak test and fixes

- Bring back Rc instead of Box in SymbolicExpression so that expressions
  built with folding avoid many clones
- Rewrite Expression doulbe as `e * 2` instead of `e + e` to avoid
  exponential cloning in expressions built with folding
- When a constraint doesn't use a location, change it to use a selector
  for usable columns to avoid failing in poisoned rows

* chore: clean up

* fix: clippy warnings

* chore: clean up tests

* fix: clippy warnings

* fix: remove debug print

* chore: comment about transition constraints

* chore: extend comment about PrimeField64 impl

* fix: merge renamings

* chore: add unit tests

* fix: clippy complaints

* chore: extend unit test

* chore: replace no coverage directives

* chore: remove no coverage directives

* chore: apply feedback from @adria0

* fix: clippy warnings and PCS API update

Cargo.toml

@@ -5,5 +5,6 @@ members = [
     "halo2_frontend",
     "halo2_middleware",
     "halo2_backend",
+    "p3_frontend",
 ]
 resolver = "2"

halo2_backend/src/arithmetic.rs

@@ -14,6 +14,7 @@ pub use halo2curves::{CurveAffine, CurveExt};
 /// This represents an element of a group with basic operations that can be
 /// performed. This allows an FFT implementation (for example) to operate
 /// generically over either a field or elliptic curve group.
+#[allow(dead_code)]
 pub(crate) trait FftGroup<Scalar: Field>:
     Copy + Send + Sync + 'static + GroupOpsOwned + ScalarMulOwned<Scalar>
 {

halo2_backend/src/helpers.rs

@@ -132,5 +132,5 @@ pub(crate) fn write_polynomial_slice<W: io::Write, F: SerdePrimeField, B>(
 /// Gets the total number of bytes of a slice of polynomials, assuming all polynomials are the same length
 pub(crate) fn polynomial_slice_byte_length<F: PrimeField, B>(slice: &[Polynomial<F, B>]) -> usize {
     let field_len = F::default().to_repr().as_ref().len();
-    4 + slice.len() * (4 + field_len * slice.get(0).map(|poly| poly.len()).unwrap_or(0))
+    4 + slice.len() * (4 + field_len * slice.first().map(|poly| poly.len()).unwrap_or(0))
 }

halo2_backend/src/poly/ipa/multiopen.rs

@@ -131,7 +131,7 @@ where
         let mut point_index_set = BTreeSet::new();
         for (commitment, point_idx_set) in commitment_set_map.iter() {
             if query.get_commitment() == *commitment {
-                point_index_set = point_idx_set.clone();
+                point_index_set.clone_from(point_idx_set);
             }
         }
         assert!(!point_index_set.is_empty());

halo2_backend/src/poly/query.rs

@@ -132,7 +132,7 @@ pub enum CommitmentReference<'r, C: CurveAffine, M: MSM<C>> {
 impl<'r, C: CurveAffine, M: MSM<C>> Copy for CommitmentReference<'r, C, M> {}
 
 impl<'r, C: CurveAffine, M: MSM<C>> PartialEq for CommitmentReference<'r, C, M> {
-    #![allow(clippy::vtable_address_comparisons)]
+    #![allow(ambiguous_wide_pointer_comparisons)]
     fn eq(&self, other: &Self) -> bool {
         match (self, other) {
             (&CommitmentReference::Commitment(a), &CommitmentReference::Commitment(b)) => {

halo2_frontend/src/circuit.rs

@@ -394,7 +394,7 @@ fn batch_invert_assigned<F: Field>(assigned: Vec<Vec<Assigned<F>>>) -> Vec<Vec<F
 // `Assigned<F>`.
 fn poly_invert<F: Field>(
     poly: &[Assigned<F>],
-    inv_denoms: impl Iterator<Item = F> + ExactSizeIterator,
+    inv_denoms: impl ExactSizeIterator<Item = F>,
 ) -> Vec<F> {
     assert_eq!(inv_denoms.len(), poly.len());
     poly.iter()

halo2_frontend/src/plonk/circuit/constraint_system.rs

@@ -15,6 +15,7 @@ use std::fmt::Debug;
 /// Represents an index into a vector where each entry corresponds to a distinct
 /// point that polynomials are queried at.
 #[derive(Copy, Clone, Debug)]
+#[allow(dead_code)]
 pub(crate) struct PointIndex(pub usize);
 
 /// A "virtual cell" is a PLONK cell that has been queried at a particular relative offset

halo2_proofs/benches/plonk.rs

@@ -28,6 +28,7 @@ use criterion::{BenchmarkId, Criterion};
 fn criterion_benchmark(c: &mut Criterion) {
     /// This represents an advice column at a certain row in the ConstraintSystem
     #[derive(Copy, Clone, Debug)]
+    #[allow(dead_code)]
     pub struct Variable(Column<Advice>, usize);
 
     #[derive(Clone)]

halo2_proofs/examples/circuit-layout.rs

@@ -10,6 +10,7 @@ use std::marker::PhantomData;
 
 /// This represents an advice column at a certain row in the ConstraintSystem
 #[derive(Copy, Clone, Debug)]
+#[allow(dead_code)]
 pub struct Variable(Column<Advice>, usize);
 
 #[derive(Clone)]

halo2_proofs/tests/compress_selectors.rs

@@ -45,6 +45,7 @@ struct MyCircuitConfig {
 
     s_add: Selector,
     s_mul: Selector,
+    #[allow(dead_code)]
     s_cubed: Selector,
 
     PI: Column<Instance>,
@@ -82,6 +83,7 @@ trait MyCircuitComposer<F: Field> {
         row: usize,
     ) -> Result<(), Error>;
 
+    #[allow(dead_code)]
     fn cube<FM>(&self, layouter: &mut impl Layouter<F>, f: FM) -> Result<(Cell, Cell), Error>
     where
         FM: FnMut() -> Value<(Assigned<F>, Assigned<F>)>;
@@ -362,6 +364,7 @@ fn test_mycircuit(
     let pk = keygen_pk_custom(&params, vk.clone(), &circuit, pk_keygen_compress_selectors)?;
 
     // Proving
+    #[allow(clippy::useless_vec)]
     let instances = vec![vec![Fr::one(), Fr::from_u128(3)]];
     let instances_slice: &[&[Fr]] = &(instances
         .iter()

halo2_proofs/tests/plonk_api.rs

@@ -31,6 +31,7 @@ fn plonk_api() {
 
     /// This represents an advice column at a certain row in the ConstraintSystem
     #[derive(Copy, Clone, Debug)]
+    #[allow(dead_code)]
     pub struct Variable(Column<Advice>, usize);
 
     #[derive(Clone)]

p3_frontend/Cargo.toml

@@ -0,0 +1,37 @@
+[package]
+name = "p3_frontend"
+version = "0.3.0"
+authors = [
+    "Privacy Scaling Explorations team",
+]
+edition = "2021"
+description = """
+Plonky3 frontend implementation.  Allows using a circuit defined with the Air trait from plonky3 to be proved with a halo2 backend.
+"""
+license = "MIT OR Apache-2.0"
+categories = ["cryptography"]
+keywords = ["halo", "proofs", "zkp", "zkSNARKs", "plonky3"]
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
+
+[dependencies]
+p3-air = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+p3-util = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+p3-matrix = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+p3-field = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+p3-uni-stark = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+halo2_middleware = { path = "../halo2_middleware" }
+serde = { version = "1.0", default-features = false, features = ["derive", "alloc"] }
+num-bigint = { version = "0.4.3", default-features = false }
+
+[dev-dependencies]
+halo2curves = { version = "0.6.0", default-features = false }
+rand_core = { version = "0.6", default-features = false, features = ["getrandom"] }
+halo2_backend = { path = "../halo2_backend" }
+serde_test = { version = "1.0" }
+p3-keccak-air = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+p3-keccak = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+p3-util = { git = "https://github.com/Plonky3/Plonky3", rev = "7b5b8a6" }
+rand = "0.8.5"

p3_frontend/src/air.rs

@@ -0,0 +1,7 @@
+//! Alternative `AirBuilderWithPublicValues` trait that uses `Self::Var` instead of `Self::F`.
+
+use p3_air::AirBuilder;
+
+pub trait AirBuilderWithPublicValues: AirBuilder {
+    fn public_values(&self) -> &[Self::Var];
+}