-
Notifications
You must be signed in to change notification settings - Fork 1.6k
PVF: Don't dispute on missing artifact #7011
Changes from 3 commits
6b66e91
6fa0046
d1a3050
5982b8b
ff77e2a
b450803
9259f72
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -691,38 +691,54 @@ trait ValidationBackend { | |
|
||
/// Tries executing a PVF. Will retry once if an error is encountered that may have been | ||
/// transient. | ||
/// | ||
/// NOTE: Should retry only on errors that are a result of execution itself, and not of | ||
/// preparation. | ||
async fn validate_candidate_with_retry( | ||
&mut self, | ||
raw_validation_code: Vec<u8>, | ||
exec_timeout: Duration, | ||
params: ValidationParams, | ||
executor_params: ExecutorParams, | ||
) -> Result<WasmValidationResult, ValidationError> { | ||
// Construct the PVF a single time, since it is an expensive operation. Cloning it is cheap. | ||
let prep_timeout = pvf_prep_timeout(&executor_params, PvfPrepTimeoutKind::Lenient); | ||
// Construct the PVF a single time, since it is an expensive operation. Cloning it is cheap. | ||
let pvf = PvfPrepData::from_code(raw_validation_code, executor_params, prep_timeout); | ||
|
||
let mut validation_result = | ||
self.validate_candidate(pvf.clone(), exec_timeout, params.encode()).await; | ||
|
||
// If we get an AmbiguousWorkerDeath error, retry once after a brief delay, on the | ||
// assumption that the conditions that caused this error may have been transient. Note that | ||
// this error is only a result of execution itself and not of preparation. | ||
if let Err(ValidationError::InvalidCandidate(WasmInvalidCandidate::AmbiguousWorkerDeath)) = | ||
validation_result | ||
{ | ||
// Wait a brief delay before retrying. | ||
futures_timer::Delay::new(PVF_EXECUTION_RETRY_DELAY).await; | ||
// Allow one retry for each kind of error. | ||
let mut num_internal_retries_left = 1; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Could make this higher, since this kind of error is probably the most likely to be transient. |
||
let mut num_awd_retries_left = 1; | ||
loop { | ||
match validation_result { | ||
Err(ValidationError::InvalidCandidate( | ||
WasmInvalidCandidate::AmbiguousWorkerDeath, | ||
)) if num_awd_retries_left > 0 => num_awd_retries_left -= 1, | ||
Err(ValidationError::InternalError(_)) if num_internal_retries_left > 0 => | ||
num_internal_retries_left -= 1, | ||
_ => break, | ||
} | ||
|
||
// If we got a possibly transient error, retry once after a brief delay, on the assumption | ||
// that the conditions that caused this error may have resolved on their own. | ||
{ | ||
// Wait a brief delay before retrying. | ||
futures_timer::Delay::new(PVF_EXECUTION_RETRY_DELAY).await; | ||
|
||
gum::warn!( | ||
target: LOG_TARGET, | ||
?pvf, | ||
"Re-trying failed candidate validation due to AmbiguousWorkerDeath." | ||
); | ||
gum::warn!( | ||
target: LOG_TARGET, | ||
?pvf, | ||
"Re-trying failed candidate validation due to possible transient error: {:?}", | ||
validation_result | ||
); | ||
|
||
// Encode the params again when re-trying. We expect the retry case to be relatively | ||
// rare, and we want to avoid unconditionally cloning data. | ||
validation_result = self.validate_candidate(pvf, exec_timeout, params.encode()).await; | ||
// Encode the params again when re-trying. We expect the retry case to be relatively | ||
// rare, and we want to avoid unconditionally cloning data. | ||
validation_result = | ||
self.validate_candidate(pvf.clone(), exec_timeout, params.encode()).await; | ||
} | ||
} | ||
|
||
validation_result | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -261,6 +261,13 @@ impl Response { | |
Self::InvalidCandidate(format!("{}: {}", ctx, msg)) | ||
} | ||
} | ||
fn format_internal(ctx: &'static str, msg: &str) -> Self { | ||
if msg.is_empty() { | ||
Self::InternalError(ctx.to_string()) | ||
} else { | ||
Self::InternalError(format!("{}: {}", ctx, msg)) | ||
} | ||
} | ||
} | ||
|
||
/// The entrypoint that the spawned execute worker should start with. The `socket_path` specifies | ||
|
@@ -359,7 +366,13 @@ fn validate_using_artifact( | |
// [`executor_intf::prepare`]. | ||
executor.execute(artifact_path.as_ref(), params) | ||
} { | ||
Err(err) => return Response::format_invalid("execute", &err), | ||
Err(err) => | ||
return if err.contains("failed to open file: No such file or directory") { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This really requires a refactor changing the error type to something sensible, like an There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Very likely to come from substrate, it's full of string errors. I agree that matching against strings is no-go, but otherwise we'd have to halt the pr. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Vote up, I've already raised that concern somewhere... Many errors coming from Substrate are not sensible at all. Also agree that string matching makes no good. @mrcnski a (probably stupid) idea: until we have an There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yeah, it comes from Substrate. Didn't think about localization. 😬 I considered just treating Checking for the file existence seems sensible to me... There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Problems with the PVF itself we agreed are also no reason to raise a dispute, since we have pre-checking enabled. Basically any error that is independent of the candidate at hand should not be cause for a dispute. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Let's in any case create a ticket for fixing those string errors - or at least the one in question right now. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Looks like // Do a length check before allocating. The returned output should not be bigger than the
// available WASM memory. Otherwise, a malicious parachain can trigger a large allocation,
// potentially causing memory exhaustion.
//
// Get the size of the WASM memory in bytes.
let memory_size = ctx.as_context().data().memory().data_size(ctx);
if checked_range(output_ptr as usize, output_len as usize, memory_size).is_none() {
Err(WasmError::Other("output exceeds bounds of wasm memory".into()))?
} (I used Anyway, basically, this one There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Raised a small fix for the output-bounds case here, but I'm still not confident that For the file-not-found case, there is not a clear way to fix the error story on the Substrate side. Just having another check here for file existence should be enough. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I am fine with the check, please reference the substrate issue though in a comment. This way, readers understand why we did it this way and we can reevaluate once the issue is fixed. |
||
// Raise an internal error if the file is missing. | ||
Response::format_internal("execute: missing file", &err) | ||
} else { | ||
Response::format_invalid("execute", &err) | ||
}, | ||
Ok(d) => d, | ||
}; | ||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updating candidate-validation tests would not harm