Gracefully handle filtering bitfields & candidates #4280

emostov · 2021-11-14T11:26:58Z

target pr: #4028
target branch: bernhard-inherent-filtering

This updates the logic for sanitize_bitfields and sanitize_backed_candidates to never error when there is an issue, but instead to simply skip the problematic items.

We are not worried about unbounded iteration due to malicious inputs in either case because we will totally drop all bitfields and backed candidates if all the inherent data is overweight prior to calling either function.

…t-filtering-2

runtime/parachains/src/paras_inherent.rs

drahnr · 2021-11-14T13:46:12Z

runtime/parachains/src/paras_inherent.rs

 			// Abort if the total weight of the block exceeds the max block weight
+			// TODO this should just limit disputes


Actually limit disputes, but remove everything else an issue a warning.

runtime/parachains/src/paras_inherent.rs

drahnr · 2021-11-15T09:36:20Z

runtime/parachains/src/inclusion.rs

@@ -398,7 +398,7 @@ impl<T: Config> Pallet<T> {
 		signed_bitfields: UncheckedSignedAvailabilityBitfields,
 		disputed_bitfield: DisputedBitfield,
 		core_lookup: impl Fn(CoreIndex) -> Option<ParaId>,
-	) -> Result<Vec<(CoreIndex, CandidateHash)>, DispatchError> {
+	) -> Vec<(CoreIndex, CandidateHash)> {


We should consider returning Result<Vec<(CoreIndex)>, Vec<(CoreIndex)>> to be able to easily evaluate if the sanitization caused any changes and be able to warn outside this fn call and also keep the assert_noop! storage check macro.

This would be a rather backwards change, so I am happy to discuss this.

We can use assert_storage_noop! if we need to check for storage root changes https://crates.parity.io/frame_support/macro.assert_storage_noop.html

What storage changes though do you want the system to keep track of? It seems like the calling logic doesn't have any handling based on if storage changes are made here

I can't follow. The Ok()/Err() would be independent of the storage_noop and we should verify that no storage was written in case we do error (which from the tests is never the case), which I missed. So please discard that part :]

drahnr · 2021-11-15T09:37:36Z

runtime/parachains/src/inclusion.rs

+						},
+					)
+				}
+			};


drahnr · 2021-11-15T09:38:04Z

runtime/parachains/src/inclusion.rs

 			}

 			// out of order.
 			{
-				let bare_bitfield = default_bitfield();


runtime/parachains/src/inclusion.rs

drahnr · 2021-11-15T09:40:27Z

runtime/parachains/src/paras_inherent.rs

-		}
-	};
-}
-


👍 I feel a lot better seeing this removed, it added quite some mental overhead combined with the const generic

runtime/parachains/src/paras_inherent.rs

drahnr

Mostly nits, one design decission worth discussing. Other than that, LGTM! Thank you!

* move things around, add filter methods�� * validator keys, modify availability bitfields according to disputes * simplify, keep the filter -> sanitize generic for both usecases * minor * assure tests still work, reduce changeset * integration * start entropy passing * fixins * compile, 1 failing test * filter with coverage * fixins * Update runtime/parachains/src/paras_inherent.rs Co-authored-by: Robert Habermeier <[email protected]> * slip of the pen * improve test cases * misc * fix * fixins * test avoid extra into() calls in assert_noop! * chores * ff * test fixup superfluous into call * chore: pfmt * improve apply_block_weight_limit to try to maximize the number of sufficiently backed blocks and add extra bitfields in a round-robin fashion * new code treats the lack of backed candidates as ok * Use vrf based entropy * fixup vrf random * add warn * slip of the pen * fixup * assure ordering * rethink apply_weights * mock * use a closure as predicate check * extract and use DisputedBitfield * chore: simplify * remove stray dbg * chore: fmt * address feedback * fix test, halfway there * stage1 * dbg stuff * make group selection align * fix session index * fix wrongly returned candidates * cleanup * chore fmt * fix ensure check * make good case test work * more tests for bitfields * create sanitize_backed_candidates * fixup tests * update guide * add check referenced in the guide * improve weights code * fmt * fixins * Update roadmap/implementers-guide/src/runtime/inclusion.md Co-authored-by: Zeke Mostov <[email protected]> * compiling + address review * add comments * fix weight calc * address review comments and test failure * fix * fix: condition * Fix random_sel function * Fix overlength block check * Zeke + Ladi commit for disputes filtering + integration test builder + runtime benchmarks + integration tests * Add benchmarks for code upgrades * Code upgrade bench; Feature gate TestWeightInfo * Try and make CI happier * Feature gate enter test to not(benchmarks) * Make sure no unused imports/fn * refactor, re-use, the beginning * Fix issue with frame benchmarking dep compilation * More precise feature gating for some derives * integrate piece-wise * foo * fixins * chore fmt * fixins * rename const generic * Update runtime/parachains/src/paras_inherent.rs Co-authored-by: Zeke Mostov <[email protected]> * Fix compilation * limit to test * remove unused spam slots * spellcheck * remove a tick, fix a typo * Add Code upgrade weights * comment improvements + >= Co-authored-by: Zeke Mostov <[email protected]> * remove another tick * Update runtime/parachains/src/paras_inherent/benchmarking.rs Co-authored-by: Zeke Mostov <[email protected]> * saturating fixins + some spaces * fix * benchmarking - preliminary results * Add training wheels * Refactor some early exit logic for enter * Gracefully handle filtering bitfields & candidates (#4280) This updates the logic for sanitize_bitfields and sanitize_backed_candidates to never error when there is an issue, but instead to simply skip the problematic items. * Refactor inherent data weight limiting logic (#4287) * Apply suggestions from code review * Update runtime/parachains/src/builder.rs Co-authored-by: Zeke Mostov <[email protected]> * Update runtime/parachains/src/builder.rs * Update runtime/parachains/src/paras_inherent.rs * final pass * Run cargo +nightly-2021-10-29 fmt * Update implementors guide with `sanitize_*` & `enter` (#4294) * Make spell check happier * Make wasm runtimes compile with benchmarks enabled (#4303) * comment stuff out, use old toml * Seems to be working? * Remove feature gating from builder * Remove commented out stuff * Remove generic from digest * Update weight files for runtime Co-authored-by: Robert Habermeier <[email protected]> Co-authored-by: Zeke Mostov <[email protected]> Co-authored-by: Lldenaurois <[email protected]> Co-authored-by: Zeke Mostov <[email protected]> Co-authored-by: Bastian Köcher <[email protected]>

* move paras inherent filtering to runtime (#4028) * move things around, add filter methods�� * validator keys, modify availability bitfields according to disputes * simplify, keep the filter -> sanitize generic for both usecases * minor * assure tests still work, reduce changeset * integration * start entropy passing * fixins * compile, 1 failing test * filter with coverage * fixins * Update runtime/parachains/src/paras_inherent.rs Co-authored-by: Robert Habermeier <[email protected]> * slip of the pen * improve test cases * misc * fix * fixins * test avoid extra into() calls in assert_noop! * chores * ff * test fixup superfluous into call * chore: pfmt * improve apply_block_weight_limit to try to maximize the number of sufficiently backed blocks and add extra bitfields in a round-robin fashion * new code treats the lack of backed candidates as ok * Use vrf based entropy * fixup vrf random * add warn * slip of the pen * fixup * assure ordering * rethink apply_weights * mock * use a closure as predicate check * extract and use DisputedBitfield * chore: simplify * remove stray dbg * chore: fmt * address feedback * fix test, halfway there * stage1 * dbg stuff * make group selection align * fix session index * fix wrongly returned candidates * cleanup * chore fmt * fix ensure check * make good case test work * more tests for bitfields * create sanitize_backed_candidates * fixup tests * update guide * add check referenced in the guide * improve weights code * fmt * fixins * Update roadmap/implementers-guide/src/runtime/inclusion.md Co-authored-by: Zeke Mostov <[email protected]> * compiling + address review * add comments * fix weight calc * address review comments and test failure * fix * fix: condition * Fix random_sel function * Fix overlength block check * Zeke + Ladi commit for disputes filtering + integration test builder + runtime benchmarks + integration tests * Add benchmarks for code upgrades * Code upgrade bench; Feature gate TestWeightInfo * Try and make CI happier * Feature gate enter test to not(benchmarks) * Make sure no unused imports/fn * refactor, re-use, the beginning * Fix issue with frame benchmarking dep compilation * More precise feature gating for some derives * integrate piece-wise * foo * fixins * chore fmt * fixins * rename const generic * Update runtime/parachains/src/paras_inherent.rs Co-authored-by: Zeke Mostov <[email protected]> * Fix compilation * limit to test * remove unused spam slots * spellcheck * remove a tick, fix a typo * Add Code upgrade weights * comment improvements + >= Co-authored-by: Zeke Mostov <[email protected]> * remove another tick * Update runtime/parachains/src/paras_inherent/benchmarking.rs Co-authored-by: Zeke Mostov <[email protected]> * saturating fixins + some spaces * fix * benchmarking - preliminary results * Add training wheels * Refactor some early exit logic for enter * Gracefully handle filtering bitfields & candidates (#4280) This updates the logic for sanitize_bitfields and sanitize_backed_candidates to never error when there is an issue, but instead to simply skip the problematic items. * Refactor inherent data weight limiting logic (#4287) * Apply suggestions from code review * Update runtime/parachains/src/builder.rs Co-authored-by: Zeke Mostov <[email protected]> * Update runtime/parachains/src/builder.rs * Update runtime/parachains/src/paras_inherent.rs * final pass * Run cargo +nightly-2021-10-29 fmt * Update implementors guide with `sanitize_*` & `enter` (#4294) * Make spell check happier * Make wasm runtimes compile with benchmarks enabled (#4303) * comment stuff out, use old toml * Seems to be working? * Remove feature gating from builder * Remove commented out stuff * Remove generic from digest * Update weight files for runtime Co-authored-by: Robert Habermeier <[email protected]> Co-authored-by: Zeke Mostov <[email protected]> Co-authored-by: Lldenaurois <[email protected]> Co-authored-by: Zeke Mostov <[email protected]> Co-authored-by: Bastian Köcher <[email protected]> * prefer code upgrades in inherent filtering (#4334) * impl prefered items Closes #4330 * do not stop attempting to select, just because one did not fit * doc * prefered -> preferred * missing usage of the preferred indices * sigh * shuffle is not available for chacha * remove duplicate weight addition * ref vs no ref * add additional assurances to `create_inherent` (#4349) * minor: move checks into separate fn * add additional validity checks * simplify shuffling * Closes potential OOB weight * improve docs * fooo * remove obsolete comment * move filtering into the rollback-transaction Technically this is not necessary but avoids future footguns. * move check up and avoid duplicate checks * refactor: make sure backed candidates are sane, even more * doc wording Co-authored-by: Zeke Mostov <[email protected]> * refactor: avoid const generics for sake of wasm size `true` -> `FullCheck::Skip`, `false` -> `FullCheck::Yes`. * chore: unify `CandidateCheckContext` instance names * refactor: introduce `IndexedRetain` for `Vec<T>` * chore: make tests prefix free * doc: re-introduce removed comment * refactor: remove another const generic to save some wasm size Co-authored-by: Zeke Mostov <[email protected]> * Inherent filtering follow up (#4305) * Add feature more feature gating for benchmarking + tests * New line * cargo run --quiet --release --features=runtime-benchmarks -- benchmark --chain=kusama-dev --steps=50 --repeat=20 --pallet=runtime_parachains::paras_inherent --extrinsic=* --execution=wasm --wasm-execution=compiled --heap-pages=4096 --header=./file_header.txt --output=./runtime/kusama/src/weights/runtime_parachains_paras_inherent.rs * cargo run --quiet --release --features=runtime-benchmarks -- benchmark --chain=polkadot-dev --steps=50 --repeat=20 --pallet=runtime_parachains::paras_inherent --extrinsic=* --execution=wasm --wasm-execution=compiled --heap-pages=4096 --header=./file_header.txt --output=./runtime/polkadot/src/weights/runtime_parachains_paras_inherent.rs * Do not assume we use max validators per core * Use kusama weights for rococo (hopefully temp) * cargo run --quiet --release --features=runtime-benchmarks -- benchmark --chain=westend-dev --steps=50 --repeat=20 --pallet=runtime_parachains::paras_inherent --extrinsic=* --execution=wasm --wasm-execution=compiled --heap-pages=4096 --header=./file_header.txt --output=./runtime/westend/src/weights/runtime_parachains_paras_inherent.rs * Add more validity votes when neccesary * Some fixes for the last commit * Restore westend weights * cargo run --quiet --release --features=runtime-benchmarks -- benchmark --chain=westend-dev --steps=50 --repeat=20 --pallet=runtime_parachains::paras_inherent --extrinsic=* --execution=wasm --wasm-execution=compiled --heap-pages=4096 --header=./file_header.txt --output=./runtime/westend/src/weights/runtime_parachains_paras_inherent.rs * Revert bad westend weights write * Make sure to update val idx before skipping * Fix validity vote range to max at group size' * Temp setup for rococo * cargo run --quiet --release --features runtime-benchmarks -- benchmark --chain=rococo-dev --steps=50 --repeat=20 --pallet=runtime_parachains::paras_inherent --extrinsic=* --execution=wasm --wasm-execution=compiled --heap-pages=4096 --output=./runtime/rococo/src/weights/runtime_parachains_paras_inherent.rs --header=./file_header.txt * Augment generated Rococo weights * Make it compile * Revert range for enter_backed_candidates_variable * Delete runtime/kusama/src/weights/runtime_paras_paras_inherent.rs Co-authored-by: Parity Bot <[email protected]> * prepare worker: Catch unexpected unwinds (#4304) * prepare worker: Catch unexpected unwinds * Use more specific wording for unknown panic payload * Treat non-deterministic prep errors as internal errors (#4364) Closes #4293 This PR changes the way how we treat a certain subset of PVF preparation errors. Specifically, now only the deterministic errors are treated as invalid candidates. That is, the errors that are easily attributable to either the the PVF contents or the wasmtime code, but not e.g. I/O errors that could be triggered by the OS (insufficient memory, disk failure, too much load, etc). The latter are treated as internal errors and thus do not trigger the disputes. Co-authored-by: Robert Habermeier <[email protected]> Co-authored-by: Zeke Mostov <[email protected]> Co-authored-by: Lldenaurois <[email protected]> Co-authored-by: Zeke Mostov <[email protected]> Co-authored-by: Bastian Köcher <[email protected]> Co-authored-by: Parity Bot <[email protected]> Co-authored-by: Sergei Shulepov <[email protected]>

emostov added 4 commits November 13, 2021 19:43

Don't Ever error with sanitize + rand changes

04d5d0a

Merge branch 'bernhard-inherent-filtering' into zeke-bernhard-inheren…

93b6918

…t-filtering-2

Do not return result for sanitize_bitfields / process bitfields

f26d668

Update test for process_bitfields

f419eca

github-actions bot added the A3-in_progress Pull request is in progress. No review needed at this stage. label Nov 14, 2021

emostov added 2 commits November 14, 2021 12:40

sanitize_backe_candidate return vec; not result

5c424a1

Fix signature check test'

8963ae9

emostov requested review from drahnr and Lldenaurois November 14, 2021 13:04

emostov commented Nov 14, 2021

View reviewed changes

runtime/parachains/src/paras_inherent.rs Outdated Show resolved Hide resolved

emostov marked this pull request as ready for review November 14, 2021 13:06

github-actions bot added A0-please_review Pull request needs code review. and removed A3-in_progress Pull request is in progress. No review needed at this stage. labels Nov 14, 2021

drahnr reviewed Nov 14, 2021

View reviewed changes

emostov added 2 commits November 14, 2021 14:52

Some small fixes

91c42c4

Some small fixes

98679a9

drahnr reviewed Nov 14, 2021

View reviewed changes

runtime/parachains/src/paras_inherent.rs Outdated Show resolved Hide resolved

Rename const generice for sanitize bitfields

7d330e8